@smoothbricks/cli 0.10.2 → 0.10.3

package/dist/release/index.d.ts

@@ -11,6 +11,14 @@ export interface ReleasePublishOptions {
 }
 export interface ReleaseRepairPendingOptions {
     dryRun?: boolean;
+    platformOutputs?: string;
+    ref?: string;
+}
+export interface ReleasePlatformOutputsOptions {
+    bump: string;
+    output: string;
+    ref?: string;
+    targets: string;
 }
 export interface ReleaseTrustPublisherOptions {
     dryRun?: boolean;
@@ -37,7 +45,9 @@ export interface ReleaseRetagUnpublishedOptions {
 export declare function releaseVersion(root: string, options: ReleaseVersionOptions): Promise<void>;
 export declare function releasePublish(root: string, options: ReleasePublishOptions): Promise<void>;
 export declare function releaseRepairPending(root: string, options: ReleaseRepairPendingOptions): Promise<void>;
+export declare function releaseCollectPlatformOutputs(root: string, options: ReleasePlatformOutputsOptions): Promise<void>;
 export declare function releaseTrustPublisher(root: string, options: ReleaseTrustPublisherOptions): Promise<void>;
+export declare function npmTrustGithubArgs(packageName: string, repository: string, workflow: string, dryRun: boolean): string[];
 export interface TrustPublisherShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
     repository: string;
     workflow: string;
@@ -45,7 +55,8 @@ export interface TrustPublisherShell<Package extends ReleasePackageInfo = Releas
     packageExists(name: string): Promise<boolean>;
     bootstrapNpmPackages(options: BootstrapNpmPackagesOptions): Promise<Package[]>;
     trustPublisher(pkg: Package, dryRun: boolean, env?: Record<string, string>): Promise<TrustPublisherResult>;
-    trustedPublishers(pkg: Package): Promise<TrustedPublisher[]>;
+    trustedPublishers(pkg: Package): Promise<TrustedPublisherLookup>;
+    login(): Promise<void>;
     log(message: string): void;
     error(message: string): void;
 }
@@ -56,9 +67,16 @@ export interface TrustedPublisher {
     file?: string;
     repository?: string;
 }
+export interface NpmTrustAccessDenied {
+    readonly status: 'access-denied';
+    readonly identity: string;
+    readonly owners: string;
+}
+export type TrustedPublisherLookup = TrustedPublisher[] | NpmTrustAccessDenied;
 export declare function configureTrustedPublishers<Package extends ReleasePackageInfo>(shell: TrustPublisherShell<Package>, options: ReleaseTrustPublisherOptions): Promise<void>;
 export declare function releaseBootstrapNpmPackages(root: string, options: ReleaseBootstrapNpmPackagesOptions): Promise<void>;
 export declare function releaseRetagUnpublished(root: string, options: ReleaseRetagUnpublishedOptions): Promise<void>;
 export declare function printReleaseState(root: string): Promise<void>;
+export declare function npmTrustListAccessDenied(stdout: string, stderr: string): boolean;
 export declare function parseTrustedPublishers(stdout: string, packageName: string): TrustedPublisher[];
 //# sourceMappingURL=index.d.ts.map

package/dist/release/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,KAAK,2BAA2B,EAIjC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAML,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AAkBnB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhG;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhG;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB5G;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAkC9G;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3G,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAuEf;AAuCD,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAelH;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AAkkCD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAe9F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,KAAK,2BAA2B,EAIjC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAML,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AAsBnB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhG;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhG;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5G;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B9G;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3G,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,EAAE,GAAG,oBAAoB,CAAC;AAE/E,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAuEf;AAkED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAelH;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AAqoCD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEhF;AAoBD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAe9F"}

package/dist/release/index.js

@@ -1,21 +1,22 @@
 import { appendFile, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { Writable } from 'node:stream';
 import { $ } from 'bun';
+import { githubCiApplyOutputs, githubCiNxRunMany } from '../github-ci/index.js';
 import { assertNoConflictMarkers } from '../lib/conflict-markers.js';
 import { withDevenvEnv } from '../lib/devenv.js';
 import { isRecord, readJsonObject, stringProperty } from '../lib/json.js';
-import { decode, run, runInteractiveStatus, runResult, runStatus } from '../lib/run.js';
+import { decode, run, runInteractiveStatus, runResult } from '../lib/run.js';
 import { listReleasePackages, readPackageJson, repositoryInfo } from '../lib/workspace.js';
 import { readPackedPackageJson, validatePackedWorkspaceDependencies } from '../monorepo/packed-manifest.js';
 import { bootstrapNpmPackages, NPM_BOOTSTRAP_DIST_TAG, NPM_BOOTSTRAP_VERSION, } from './bootstrap-npm-packages.js';
 import { autoReleaseCandidatePackages } from './candidates.js';
 import { collectOwnedReleaseTagRecords, pendingReleaseTargets, releaseTag, releaseTagAliases, } from './core.js';
-import { createOrUpdateGithubRelease, renderNxProjectChangelogContents, withNxWorkspaceRoot, } from './github-release.js';
+import { createOrUpdateGithubRelease, githubReleaseLookupExists, renderNxProjectChangelogContents, withNxWorkspaceRoot, } from './github-release.js';
 import { publishWithAuthDiagnostics } from './npm-auth.js';
-import { bumpStableReleaseToNext, completeReleaseAtHead as completeReleaseAtHeadWithShell, repairPendingTargets, runReleaseVersion, } from './orchestration.js';
+import { bumpStableReleaseToNext, collectRepairPlatformOutputs, completeReleaseAtHead as completeReleaseAtHeadWithShell, repairPendingTargets, runReleaseVersion, } from './orchestration.js';
 import { retagUnpublished } from './retag-unpublished.js';
 export async function releaseVersion(root, options) {
     const bump = releaseBumpArg(options.bump);
@@ -78,23 +79,38 @@ export async function releasePublish(root, options) {
     }
 }
 export async function releaseRepairPending(root, options) {
-    const branch = await releaseBranch(root);
-    const remote = await releaseRemote(root, branch);
-    console.log(`Repair pending releases: fetching ${remote}/${branch} and tags.`);
-    await fetchReleaseRefs(root, remote, branch);
-    const remoteRef = `${remote}/${branch}`;
-    const restoreRef = (await gitRefExists(root, remoteRef)) ? remoteRef : await gitHead(root);
-    console.log(`Repair pending releases: planning from ${restoreRef}.`);
-    const targets = await listPendingReleaseTargets(root, restoreRef);
-    console.log(targets.length === 0
-        ? 'Repair pending releases: no pending durable state repairs found.'
-        : `Repair pending releases: ${targets.length} release target${targets.length === 1 ? '' : 's'} need repair.`);
-    for (const target of targets) {
-        console.log(`Repair pending releases: target ${target.sha.slice(0, 12)} needs ${repairTargetSummary(target)}.`);
-    }
-    const summaries = await repairPendingTargets(releaseRepairShell(root), targets, restoreRef, options.dryRun === true);
+    const repairRef = await fetchReleaseRepairRef(root, options.ref);
+    const restoreRef = options.ref ? await gitHead(root) : repairRef;
+    console.log(`Repair pending releases: planning from ${repairRef}.`);
+    const targets = await listPendingReleaseTargets(root, repairRef);
+    logPendingReleaseTargets(targets);
+    const platformOutputs = options.platformOutputs ? resolve(root, options.platformOutputs) : undefined;
+    const summaries = await repairPendingTargets(releaseRepairShell(root, platformOutputs), targets, restoreRef, options.dryRun === true);
     await writeRepairSummary(summaries, options.dryRun === true);
 }
+export async function releaseCollectPlatformOutputs(root, options) {
+    const restoreRef = await gitHead(root);
+    const releaseRef = await fetchReleaseRepairRef(root, options.ref);
+    const packages = releasePackages(root);
+    const packagesAtHead = await releasePackagesAtHead(root, packages);
+    const currentPackages = packagesAtHead.length > 0
+        ? packagesAtHead
+        : await releasePlatformPackages(root, packages, releaseBumpArg(options.bump));
+    console.log(currentPackages.length === 0
+        ? 'Release platform outputs: no current release packages selected.'
+        : `Release platform outputs: building current outputs for ${packageSummary(currentPackages)}.`);
+    const outputRoot = resolve(root, options.output);
+    await githubCiNxRunMany(root, {
+        targets: options.targets,
+        projects: releasePackageProjects(currentPackages),
+        collectOutputs: join(outputRoot, 'current'),
+        allowEmptyProjects: true,
+    });
+    console.log(`Repair platform outputs: planning from ${releaseRef}.`);
+    const targets = await listPendingReleaseTargets(root, releaseRef);
+    logPendingReleaseTargets(targets);
+    await collectRepairPlatformOutputs(releaseRepairOutputsShell(root, options.targets, join(outputRoot, 'repairs')), targets, restoreRef);
+}
 export async function releaseTrustPublisher(root, options) {
     const repository = githubRepositoryFromRootPackage(root);
     const workflow = 'publish.yml';
@@ -111,18 +127,20 @@ export async function releaseTrustPublisher(root, options) {
             promptOtp: (packageName) => promptForNpmOtp(packageName),
             log: (message) => console.log(message),
         }, bootstrapOptions),
-        trustPublisher: (pkg, dryRun, env) => {
-            const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
-            if (dryRun) {
-                args.push('--dry-run');
-            }
-            return runLatestNpmTrust(root, args, env);
-        },
+        trustPublisher: (pkg, dryRun, env) => runLatestNpmTrust(root, npmTrustGithubArgs(pkg.name, repository, workflow, dryRun), env),
         trustedPublishers: (pkg) => listTrustedPublishers(root, pkg),
+        login: () => runLatestNpm(root, ['login', '--auth-type=web']),
         log: (message) => console.log(message),
         error: (message) => console.error(message),
     }, options);
 }
+export function npmTrustGithubArgs(packageName, repository, workflow, dryRun) {
+    const args = ['trust', 'github', packageName, '--file', workflow, '--repo', repository, '--allow-publish', '--yes'];
+    if (dryRun) {
+        args.push('--dry-run');
+    }
+    return args;
+}
 export async function configureTrustedPublishers(shell, options) {
     const packages = shell.listReleasePackages();
     const selectedPackages = selectedTrustPublisherPackages(packages, options.packages ?? []);
@@ -149,7 +167,7 @@ export async function configureTrustedPublishers(shell, options) {
     const failedPackages = [];
     for (const pkg of selectedPackages) {
         if (!options.dryRun) {
-            const trustedPublishers = await shell.trustedPublishers(pkg);
+            const trustedPublishers = await trustedPublishersWithOwnerLogin(shell, pkg);
             if (hasMatchingGithubTrustedPublisher(trustedPublishers, shell.repository, shell.workflow)) {
                 shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
                 continue;
@@ -186,6 +204,23 @@ export async function configureTrustedPublishers(shell, options) {
         shell.error(`Trusted publishing was not configured for: ${failedPackages.join(', ')}`);
     }
 }
+async function trustedPublishersWithOwnerLogin(shell, pkg) {
+    let result = await shell.trustedPublishers(pkg);
+    if (Array.isArray(result)) {
+        return result;
+    }
+    shell.error(`${pkg.name}: npm trust access denied for npm account "${result.identity}". ` +
+        `npm trust requires package write access. Package owners:\n${result.owners}`);
+    shell.log(`${pkg.name}: opening npm browser login. Sign in as a listed package owner, then return here.`);
+    await shell.login();
+    result = await shell.trustedPublishers(pkg);
+    if (Array.isArray(result)) {
+        return result;
+    }
+    throw new Error(`${pkg.name}: npm trust access denied for npm account "${result.identity}". ` +
+        `npm trust requires package write access. Package owners:\n${result.owners}\n` +
+        'npm browser login completed, but the selected account still cannot manage this package.');
+}
 function selectedTrustPublisherPackages(packages, selections) {
     if (selections.length === 0) {
         return packages;
@@ -350,6 +385,14 @@ async function releaseVersionPackages(root, packages, bump) {
         packageHasHistory: (packagePath) => packageHasHistory(root, packagePath),
     }, packages);
 }
+async function releasePlatformPackages(root, packages, bump) {
+    const candidates = await releaseVersionPackages(root, packages, bump);
+    if (candidates.length === 0) {
+        return [];
+    }
+    // Nx may version additional reverse dependents, so use its dry-run result rather than only the direct candidates.
+    return runNxReleaseVersionPreview(root, releasePackageProjects(candidates), bump);
+}
 async function runNxReleaseVersion(root, projects, bump, dryRun) {
     if (dryRun) {
         return runNxReleaseVersionPreview(root, projects, bump);
@@ -392,6 +435,7 @@ async function runNxReleaseVersionPreview(root, projects, bump) {
             gitPush: false,
             stageChanges: false,
             createRelease: false,
+            forceChangelogGeneration: true,
             dryRun: true,
         });
         releasePreviewChangelogs.clear();
@@ -568,9 +612,8 @@ function releaseNextShell(root) {
         },
     };
 }
-function releaseRepairShell(root) {
+function releaseTargetCheckoutShell(root) {
     return {
-        ...releaseCompletionShell(root),
         checkout: (ref) => run('git', ['switch', '--detach', ref], root),
         withDevenvEnv: (runWithEnv) => withDevenvEnv(root, runWithEnv),
         beforeRepairTarget: (target) => {
@@ -581,6 +624,30 @@ function releaseRepairShell(root) {
         },
     };
 }
+function releaseRepairShell(root, platformOutputs) {
+    return {
+        ...releaseCompletionShell(root),
+        ...releaseTargetCheckoutShell(root),
+        prepareRepairTarget: async (target) => {
+            if (!platformOutputs || target.npmPackages.length === 0) {
+                return;
+            }
+            const output = join(platformOutputs, target.sha);
+            console.log(`Repair pending releases: applying cross-platform outputs from ${output}.`);
+            await githubCiApplyOutputs(root, [output], target.sha);
+        },
+    };
+}
+function releaseRepairOutputsShell(root, targetGlobs, outputRoot) {
+    return {
+        ...releaseTargetCheckoutShell(root),
+        collectRepairTargetOutputs: (target) => githubCiNxRunMany(root, {
+            targets: targetGlobs,
+            projects: releasePackageProjects(target.npmPackages),
+            collectOutputs: join(outputRoot, target.sha),
+        }),
+    };
+}
 function releaseRetagShell(root, remote) {
     return {
         listReleasePackages: () => releasePackages(root),
@@ -596,6 +663,25 @@ function releaseRetagShell(root, remote) {
         log: (message) => console.log(message),
     };
 }
+async function fetchReleaseRepairRef(root, requestedRef) {
+    const branch = await releaseBranch(root);
+    const remote = await releaseRemote(root, branch);
+    console.log(`Repair pending releases: fetching ${remote}/${branch} and tags.`);
+    await fetchReleaseRefs(root, remote, branch);
+    if (requestedRef) {
+        return requestedRef;
+    }
+    const remoteRef = `${remote}/${branch}`;
+    return (await gitRefExists(root, remoteRef)) ? remoteRef : gitHead(root);
+}
+function logPendingReleaseTargets(targets) {
+    console.log(targets.length === 0
+        ? 'Repair pending releases: no pending durable state repairs found.'
+        : `Repair pending releases: ${targets.length} release target${targets.length === 1 ? '' : 's'} need repair.`);
+    for (const target of targets) {
+        console.log(`Repair pending releases: target ${target.sha.slice(0, 12)} needs ${repairTargetSummary(target)}.`);
+    }
+}
 async function listPendingReleaseTargets(root, ref) {
     const head = await gitHead(root);
     return pendingReleaseTargets(await listOwnedReleaseTagRecords(root, ref), head);
@@ -795,7 +881,8 @@ function repairReasons(target, pkg) {
     return reasons;
 }
 async function fetchReleaseRefs(root, remote, branch) {
-    await run('git', ['fetch', '--tags', remote, branch], root);
+    // `retag-unpublished` intentionally moves repairable tags, so the remote tag is authoritative.
+    await run('git', ['fetch', '--force', '--tags', remote, branch], root);
 }
 async function gitRefExists(root, ref) {
     const result = await $ `git rev-parse --verify ${ref}`.cwd(root).quiet().nothrow();
@@ -1003,7 +1090,8 @@ async function pushRetaggedReleaseTags(root, remote, updates) {
     await run('git', ['push', '--atomic', ...leases, remote, ...refspecs], root);
 }
 async function githubReleaseExists(root, tag) {
-    return (await runStatus('gh', ['release', 'view', tag, '--json', 'tagName'], root, true)) === 0;
+    const result = await $ `gh release view ${tag} --json tagName`.cwd(root).quiet().nothrow();
+    return githubReleaseLookupExists(tag, result.exitCode, decode(result.stdout), decode(result.stderr));
 }
 function githubReleaseUrl(root, tag) {
     return `https://github.com/${githubRepositoryFromRootPackage(root)}/releases/tag/${encodeURIComponent(tag)}`;
@@ -1143,11 +1231,32 @@ async function listTrustedPublishers(root, pkg) {
         }
         result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
     }
+    if (result.exitCode !== 0 && npmTrustListAccessDenied(result.stdout, result.stderr)) {
+        return npmTrustAccessDetails(root, pkg.name);
+    }
     if (result.exitCode !== 0) {
         throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${result.exitCode}`);
     }
     return parseTrustedPublishers(result.stdout, pkg.name);
 }
+export function npmTrustListAccessDenied(stdout, stderr) {
+    return /\bE403\b/.test(`${stdout}\n${stderr}`);
+}
+async function npmTrustAccessDetails(root, packageName) {
+    const [identityResult, ownersResult] = await Promise.all([
+        runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', 'whoami'], root),
+        runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', 'owner', 'ls', packageName], root),
+    ]);
+    return {
+        status: 'access-denied',
+        identity: identityResult.exitCode === 0 && identityResult.stdout.trim().length > 0
+            ? identityResult.stdout.trim()
+            : '(not authenticated)',
+        owners: ownersResult.exitCode === 0 && ownersResult.stdout.trim().length > 0
+            ? ownersResult.stdout.trim()
+            : '(owner lookup unavailable)',
+    };
+}
 export function parseTrustedPublishers(stdout, packageName) {
     if (stdout.trim().length === 0) {
         return [];

package/dist/release/orchestration.d.ts

@@ -27,12 +27,18 @@ export interface ReleaseCompletionShell<Package extends ReleasePackageInfo = Rel
 export interface ReleaseNextShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
     bumpStablePackagesToNext(packages: Package[]): Promise<void>;
 }
-export interface ReleaseRepairShell<Package extends ReleasePackageInfo = ReleasePackageInfo> extends ReleaseCompletionShell<Package> {
+export interface ReleaseTargetCheckoutShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
     checkout(ref: string): Promise<void>;
     withDevenvEnv<T>(runWithEnv: () => Promise<T>): Promise<T>;
     beforeRepairTarget?(target: ReleaseTarget<Package>): void;
     afterRepairTarget?(target: ReleaseTarget<Package>): void;
 }
+export interface ReleaseRepairShell<Package extends ReleasePackageInfo = ReleasePackageInfo> extends ReleaseCompletionShell<Package>, ReleaseTargetCheckoutShell<Package> {
+    prepareRepairTarget?(target: ReleaseTarget<Package>): Promise<void>;
+}
+export interface ReleaseRepairOutputsShell<Package extends ReleasePackageInfo = ReleasePackageInfo> extends ReleaseTargetCheckoutShell<Package> {
+    collectRepairTargetOutputs(target: ReleaseTarget<Package>): Promise<void>;
+}
 export interface ReleaseVersionShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
     releasePackagesAtHead(): Promise<Package[]>;
     releaseVersionPackages(bump: string): Promise<Package[]>;
@@ -53,5 +59,6 @@ export declare function runReleaseVersion<Package extends ReleasePackageInfo>(sh
 export declare function completeReleaseAtHead<Package extends ReleasePackageInfo>(shell: ReleaseCompletionShell<Package>, packages: Package[], dryRun: boolean, rerunRequired: boolean): Promise<ReleaseSummary<Package>>;
 export declare function bumpStableReleaseToNext<Package extends ReleasePackageInfo>(shell: ReleaseNextShell<Package>, packages: Package[], dryRun: boolean, rerunRequired: boolean): Promise<Package[]>;
 export declare function repairPendingTargets<Package extends ReleasePackageInfo>(shell: ReleaseRepairShell<Package>, targets: Array<ReleaseTarget<Package>>, restoreRef: string, dryRun: boolean): Promise<Array<ReleaseSummary<Package>>>;
+export declare function collectRepairPlatformOutputs<Package extends ReleasePackageInfo>(shell: ReleaseRepairOutputsShell<Package>, targets: Array<ReleaseTarget<Package>>, restoreRef: string): Promise<void>;
 export declare function completeRepairTargetAtHead<Package extends ReleasePackageInfo>(shell: ReleaseCompletionShell<Package>, target: ReleaseTarget<Package>, dryRun: boolean): Promise<ReleaseSummary<Package>>;
 //# sourceMappingURL=orchestration.d.ts.map

package/dist/release/orchestration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestration.d.ts","sourceRoot":"","sources":["../../src/release/orchestration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGnE,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,cAAc,EAAE,OAAO,EAAE,CAAC;IAC1B,kBAAkB,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzD,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC7F,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,yBAAyB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,gBAAgB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACvF,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,kBAAkB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB,CACzF,SAAQ,sBAAsB,CAAC,OAAO,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,kBAAkB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,qBAAqB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC3F,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,aAAa,GAAG,mBAAmB,CAAC;CACpF;AAED,wBAAsB,iBAAiB,CAAC,OAAO,SAAS,kBAAkB,EACxE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAyCxC;AAED,wBAAsB,qBAAqB,CAAC,OAAO,SAAS,kBAAkB,EAC5E,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAYlC;AAED,wBAAsB,uBAAuB,CAAC,OAAO,SAAS,kBAAkB,EAC9E,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAChC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,OAAO,EAAE,CAAC,CAOpB;AAED,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAClC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAuBzC;AAmBD,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAUlC"}
+{"version":3,"file":"orchestration.d.ts","sourceRoot":"","sources":["../../src/release/orchestration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGnE,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,cAAc,EAAE,OAAO,EAAE,CAAC;IAC1B,kBAAkB,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzD,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC7F,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,yBAAyB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,gBAAgB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACvF,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACjG,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,kBAAkB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,kBAAkB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB,CACzF,SAAQ,sBAAsB,CAAC,OAAO,CAAC,EACrC,0BAA0B,CAAC,OAAO,CAAC;IACrC,mBAAmB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,yBAAyB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB,CAChG,SAAQ,0BAA0B,CAAC,OAAO,CAAC;IAC3C,0BAA0B,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,qBAAqB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC3F,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,aAAa,GAAG,mBAAmB,CAAC;CACpF;AAED,wBAAsB,iBAAiB,CAAC,OAAO,SAAS,kBAAkB,EACxE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAyCxC;AAED,wBAAsB,qBAAqB,CAAC,OAAO,SAAS,kBAAkB,EAC5E,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAYlC;AAED,wBAAsB,uBAAuB,CAAC,OAAO,SAAS,kBAAkB,EAC9E,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAChC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,OAAO,EAAE,CAAC,CAOpB;AAED,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAClC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAkCzC;AAED,wBAAsB,4BAA4B,CAAC,OAAO,SAAS,kBAAkB,EACnF,KAAK,EAAE,yBAAyB,CAAC,OAAO,CAAC,EACzC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EACtC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAmBD,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAUlC"}

package/dist/release/orchestration.js

@@ -72,7 +72,10 @@ export async function repairPendingTargets(shell, targets, restoreRef, dryRun) {
             }
             shell.beforeRepairTarget?.(target);
             try {
-                summaries.push(await shell.withDevenvEnv(() => completeRepairTargetAtHead(shell, target, dryRun)));
+                summaries.push(await shell.withDevenvEnv(async () => {
+                    await shell.prepareRepairTarget?.(target);
+                    return completeRepairTargetAtHead(shell, target, dryRun);
+                }));
             }
             finally {
                 shell.afterRepairTarget?.(target);
@@ -81,9 +84,43 @@ export async function repairPendingTargets(shell, targets, restoreRef, dryRun) {
     }
     finally {
         await shell.checkout(restoreRef);
+        if (targets.length > 0) {
+            // Loading devenv at a historical release can rebuild ignored tool outputs
+            // from that checkout. Refresh after restoring HEAD so later release phases
+            // cannot combine the current CLI with an older Nx plugin build.
+            await shell.withDevenvEnv(async () => undefined);
+        }
     }
     return summaries;
 }
+export async function collectRepairPlatformOutputs(shell, targets, restoreRef) {
+    const outputTargets = targets.filter((target) => target.npmPackages.length > 0);
+    if (outputTargets.length === 0) {
+        return;
+    }
+    try {
+        for (const target of outputTargets) {
+            await shell.checkout(target.sha);
+            if (target.packages.length === 0) {
+                // invariant throw: release target discovery must never yield a package-free target.
+                throw new Error(`Release commit ${target.sha} has no release packages after checkout.`);
+            }
+            shell.beforeRepairTarget?.(target);
+            try {
+                await shell.withDevenvEnv(() => shell.collectRepairTargetOutputs(target));
+            }
+            finally {
+                shell.afterRepairTarget?.(target);
+            }
+        }
+    }
+    finally {
+        await shell.checkout(restoreRef);
+        // Historical devenv activation may rebuild ignored tool outputs. Restore the
+        // dispatch environment before the macOS job performs any further work.
+        await shell.withDevenvEnv(async () => undefined);
+    }
+}
 function repairDryRunSummary(target) {
     return {
         sha: target.sha,

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -46,6 +46,11 @@ install_devenv() {
 
 build_devenv_shell() {
   devenv shell --verbose -- date
+  # enterShell exports this for the bootstrap itself; persist it for the
+  # independent workflow step shells that run after this composite action.
+  if [ -n "${GITHUB_ENV:-}" ]; then
+    echo "TTSC_TSGO_BINARY=$repo_root/node_modules/@typescript/native/bin/tsc" >> "$GITHUB_ENV"
+  fi
   # Add repo-local tools only after the shell exists; cleanup steps use an
   # explicit PATH because failures before this point must still refresh caches.
   add_repo_paths

package/managed/raw/tooling/direnv/setup-environment.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 import { existsSync } from 'node:fs';
-import { mkdir, rmdir } from 'node:fs/promises';
+import { mkdir, rmdir, stat } from 'node:fs/promises';
 import path from 'node:path';
 import { $ } from 'bun';
 
@@ -8,6 +8,13 @@ const devenvRoot = process.env.DEVENV_ROOT;
 const projectRoot = path.resolve(`${devenvRoot}/../..`);
 const startedWithoutNodeModules = !existsSync(path.join(projectRoot, 'node_modules'));
 
+// A legitimate concurrent setup finishes well within this; anything older is a
+// leftover from an interrupted run (CTRL-C/kill before the finally-cleanup) and
+// would otherwise wedge every future shell load behind the 120s spin + EEXIST.
+// NOTE: must be declared ABOVE the top-level setup block below — module consts
+// are not hoisted, and the lock loop runs during that block.
+const STALE_LOCK_MS = 10 * 60_000;
+
 class CapturedCommandError extends Error {
   constructor(
     public readonly command: string,
@@ -67,7 +74,9 @@ try {
 }
 
 async function installLocalDependencies(): Promise<void> {
-  // Serialize concurrent direnv activations installing into the same node_modules.
+  // bun install runs the root prepare script, which patches TypeScript with
+  // ts-patch. Multiple concurrent direnv activations can otherwise race while
+  // mutating the same files under node_modules.
   await withSetupLock(async () => {
     await runSetupCommand('bun install --no-summary', $`bun install --no-summary`);
   });
@@ -104,14 +113,42 @@ async function acquireLock(lockDir: string): Promise<void> {
       await mkdir(lockDir, { recursive: false });
       return;
     } catch (error) {
-      if (!(error instanceof Error && 'code' in error && error.code === 'EEXIST') || Date.now() > deadline) {
+      if (!isFileExistsError(error) || Date.now() > deadline) {
         throw error;
       }
+      if (await isStaleLock(lockDir)) {
+        // Surface the self-heal so an interrupted-run leftover is visible in
+        // the direnv log rather than silently absorbed.
+        console.error(`! Breaking stale setup lock (${lockDir}) left by an interrupted run`);
+        // Best-effort: if a concurrent process breaks it first, the rmdir
+        // fails silently and the next mkdir attempt settles the race.
+        await rmdir(lockDir).catch(() => undefined);
+        continue;
+      }
       await Bun.sleep(100);
     }
   }
 }
 
+async function isStaleLock(lockDir: string): Promise<boolean> {
+  try {
+    const info = await stat(lockDir);
+    return Date.now() - info.mtimeMs > STALE_LOCK_MS;
+  } catch (error) {
+    // Only "lock vanished" is expected here (a concurrent process released
+    // it); anything else must surface — a swallowed ReferenceError in this
+    // exact spot once disabled stale detection entirely.
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return false; // gone — let the mkdir retry acquire it
+    }
+    throw error;
+  }
+}
+
+function isFileExistsError(error: unknown): boolean {
+  return error instanceof Error && 'code' in error && error.code === 'EEXIST';
+}
+
 function replayCapturedOutput(error: unknown): void {
   if (!(error instanceof CapturedCommandError)) {
     return;

package/managed/templates/github/actions/cache-nix-devenv/action.yml

@@ -33,10 +33,10 @@ runs:
           ~/.local/state/nix/profiles
           ~/.cache/nix
         key:
-          ${{ runner.os }}-nix-v3-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix',
-          'tooling/direnv/devenv.lock') }}
+          ${{ runner.os }}-${{ runner.arch }}-nix-v3-${{ hashFiles('tooling/direnv/devenv.yaml',
+          'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
         restore-keys: |
-          ${{ runner.os }}-nix-v3-
+          ${{ runner.os }}-${{ runner.arch }}-nix-v3-
 
     - name: Save Nix profiles and store NAR
       if: ${{ inputs.segment == 'nix' && inputs.mode == 'save' }}
@@ -48,8 +48,8 @@ runs:
           ~/.local/state/nix/profiles
           ~/.cache/nix
         key:
-          ${{ runner.os }}-nix-v3-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix',
-          'tooling/direnv/devenv.lock') }}
+          ${{ runner.os }}-${{ runner.arch }}-nix-v3-${{ hashFiles('tooling/direnv/devenv.yaml',
+          'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
 
     # .devenv/.direnv are small, but they contain absolute /nix/store pointers.
     # Workflows restore this segment only after an exact Nix cache hit.
@@ -62,10 +62,11 @@ runs:
           ${{ github.workspace }}/tooling/direnv/.devenv
           ${{ github.workspace }}/tooling/direnv/.direnv
         key:
-          ${{ runner.os }}-devenv-v3-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix',
-          'tooling/direnv/devenv.lock', 'tooling/direnv/envrc.sh', 'tooling/direnv/setup-environment.ts') }}
+          ${{ runner.os }}-${{ runner.arch }}-devenv-v3-${{ hashFiles('tooling/direnv/devenv.yaml',
+          'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock', 'tooling/direnv/envrc.sh',
+          'tooling/direnv/setup-environment.ts') }}
         restore-keys: |
-          ${{ runner.os }}-devenv-v3-
+          ${{ runner.os }}-${{ runner.arch }}-devenv-v3-
 
     - name: Save devenv and direnv state
       if: ${{ inputs.segment == 'devenv' && inputs.mode == 'save' }}
@@ -75,5 +76,6 @@ runs:
           ${{ github.workspace }}/tooling/direnv/.devenv
           ${{ github.workspace }}/tooling/direnv/.direnv
         key:
-          ${{ runner.os }}-devenv-v3-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix',
-          'tooling/direnv/devenv.lock', 'tooling/direnv/envrc.sh', 'tooling/direnv/setup-environment.ts') }}
+          ${{ runner.os }}-${{ runner.arch }}-devenv-v3-${{ hashFiles('tooling/direnv/devenv.yaml',
+          'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock', 'tooling/direnv/envrc.sh',
+          'tooling/direnv/setup-environment.ts') }}

package/managed/templates/github/actions/cache-node-modules/action.yml

@@ -8,6 +8,7 @@ runs:
       uses: actions/cache@v5.0.5
       with:
         path: node_modules
-        key: ${{ runner.os }}-node-{{NODE_MODULES_CACHE_KEY}}
+        # prettier-ignore
+        key: ${{ runner.os }}-${{ runner.arch }}-node-{{NODE_MODULES_CACHE_KEY}}
         restore-keys: |
-          ${{ runner.os }}-node-
+          ${{ runner.os }}-${{ runner.arch }}-node-

package/managed/templates/github/actions/cache-nx/action.yml

@@ -16,6 +16,6 @@ runs:
         path: |
           .nx/cache
           .nx/workspace-data/*.db*
-        key: ${{ runner.os }}-nx-db-v1-${{ github.sha }}
+        key: ${{ runner.os }}-${{ runner.arch }}-nx-db-v1-${{ github.sha }}
         restore-keys: |
-          ${{ runner.os }}-nx-db-v1-
+          ${{ runner.os }}-${{ runner.arch }}-nx-db-v1-

package/managed/templates/github/actions/save-nix-devenv/action.yml

@@ -14,13 +14,21 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: 🧹 Cleanup and cache Nix store
+    - name: 🧹 Prepare Nix/devenv cache save
       id: cleanup-cache
       shell: bash
       working-directory: tooling/direnv
-      # build-shell normally adds repo paths to GITHUB_PATH, but this cleanup
-      # must still run when build-shell fails before that happens.
+      env:
+        NIX_CACHE_HIT: ${{ inputs.nix-cache-hit }}
+      # An exact Nix cache hit is immutable and cannot be overwritten by
+      # actions/cache. Avoid rebuilding its ~2 GB NAR just to discard it.
+      # build-shell normally adds repo paths to GITHUB_PATH, but cleanup must
+      # still run after a cache miss when build-shell fails before that happens.
       run: |
+        if [[ "$NIX_CACHE_HIT" == 'true' ]]; then
+          echo 'cache-ready=true' >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
         export PATH="$(../../tooling/direnv/repo-path)"
         smoo github-ci cleanup-cache