@smoothbricks/cli 0.10.2 → 0.10.4

package/src/release/index.ts

@@ -1,13 +1,24 @@
+import { existsSync, readFileSync } from 'node:fs';
 import { appendFile, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { Writable } from 'node:stream';
 import { $ } from 'bun';
+import typia from 'typia';
+import { githubCiApplyOutputs, githubCiNxRunMany } from '../github-ci/index.js';
 import { assertNoConflictMarkers } from '../lib/conflict-markers.js';
 import { withDevenvEnv } from '../lib/devenv.js';
-import { isRecord, readJsonObject, stringProperty } from '../lib/json.js';
-import { decode, run, runInteractiveStatus, runResult, runStatus } from '../lib/run.js';
+import {
+  type NxJson,
+  type NxProjectJson,
+  type NxTargetConfig,
+  type PackageJson,
+  parseNxJsonText,
+  parseNxProjectJsonText,
+  parsePackageJsonText,
+} from '../lib/json.js';
+import { decode, run, runInteractiveStatus, runResult } from '../lib/run.js';
 import { listReleasePackages, readPackageJson, repositoryInfo } from '../lib/workspace.js';
 import { readPackedPackageJson, validatePackedWorkspaceDependencies } from '../monorepo/packed-manifest.js';
 import {
@@ -29,14 +40,18 @@ import {
 } from './core.js';
 import {
   createOrUpdateGithubRelease,
+  githubReleaseLookupExists,
   renderNxProjectChangelogContents,
   withNxWorkspaceRoot,
 } from './github-release.js';
 import { publishWithAuthDiagnostics } from './npm-auth.js';
 import {
   bumpStableReleaseToNext,
+  collectRepairPlatformOutputs,
   completeReleaseAtHead as completeReleaseAtHeadWithShell,
   type ReleaseCompletionShell,
+  type ReleaseRepairOutputsShell,
+  type ReleaseRepairShell,
   type ReleaseSummary,
   type ReleaseVersionMode,
   repairPendingTargets,
@@ -57,6 +72,15 @@ export interface ReleasePublishOptions {
 
 export interface ReleaseRepairPendingOptions {
   dryRun?: boolean;
+  platformOutputs?: string;
+  ref?: string;
+}
+
+export interface ReleasePlatformOutputsOptions {
+  bump: string;
+  output: string;
+  ref?: string;
+  targets: string;
 }
 
 export interface ReleaseTrustPublisherOptions {
@@ -162,26 +186,56 @@ export async function releasePublish(root: string, options: ReleasePublishOption
 }
 
 export async function releaseRepairPending(root: string, options: ReleaseRepairPendingOptions): Promise<void> {
-  const branch = await releaseBranch(root);
-  const remote = await releaseRemote(root, branch);
-  console.log(`Repair pending releases: fetching ${remote}/${branch} and tags.`);
-  await fetchReleaseRefs(root, remote, branch);
-  const remoteRef = `${remote}/${branch}`;
-  const restoreRef = (await gitRefExists(root, remoteRef)) ? remoteRef : await gitHead(root);
-  console.log(`Repair pending releases: planning from ${restoreRef}.`);
-  const targets = await listPendingReleaseTargets(root, restoreRef);
-  console.log(
-    targets.length === 0
-      ? 'Repair pending releases: no pending durable state repairs found.'
-      : `Repair pending releases: ${targets.length} release target${targets.length === 1 ? '' : 's'} need repair.`,
+  const repairRef = await fetchReleaseRepairRef(root, options.ref);
+  const restoreRef = options.ref ? await gitHead(root) : repairRef;
+  console.log(`Repair pending releases: planning from ${repairRef}.`);
+  const targets = await listPendingReleaseTargets(root, repairRef);
+  logPendingReleaseTargets(targets);
+  const platformOutputs = options.platformOutputs ? resolve(root, options.platformOutputs) : undefined;
+  const summaries = await repairPendingTargets(
+    releaseRepairShell(root, platformOutputs),
+    targets,
+    restoreRef,
+    options.dryRun === true,
   );
-  for (const target of targets) {
-    console.log(`Repair pending releases: target ${target.sha.slice(0, 12)} needs ${repairTargetSummary(target)}.`);
-  }
-  const summaries = await repairPendingTargets(releaseRepairShell(root), targets, restoreRef, options.dryRun === true);
   await writeRepairSummary(summaries, options.dryRun === true);
 }
 
+export async function releaseCollectPlatformOutputs(
+  root: string,
+  options: ReleasePlatformOutputsOptions,
+): Promise<void> {
+  const restoreRef = await gitHead(root);
+  const releaseRef = await fetchReleaseRepairRef(root, options.ref);
+  const packages = releasePackages(root);
+  const packagesAtHead = await releasePackagesAtHead(root, packages);
+  const currentPackages =
+    packagesAtHead.length > 0
+      ? packagesAtHead
+      : await releasePlatformPackages(root, packages, releaseBumpArg(options.bump));
+  console.log(
+    currentPackages.length === 0
+      ? 'Release platform outputs: no current release packages selected.'
+      : `Release platform outputs: building current outputs for ${packageSummary(currentPackages)}.`,
+  );
+  const outputRoot = resolve(root, options.output);
+  await githubCiNxRunMany(root, {
+    targets: options.targets,
+    projects: releasePackageProjects(currentPackages),
+    collectOutputs: join(outputRoot, 'current'),
+    allowEmptyProjects: true,
+  });
+
+  console.log(`Repair platform outputs: planning from ${releaseRef}.`);
+  const targets = await listPendingReleaseTargets(root, releaseRef);
+  logPendingReleaseTargets(targets);
+  await collectRepairPlatformOutputs(
+    releaseRepairOutputsShell(root, options.targets, join(outputRoot, 'repairs')),
+    targets,
+    restoreRef,
+  );
+}
+
 export async function releaseTrustPublisher(root: string, options: ReleaseTrustPublisherOptions): Promise<void> {
   const repository = githubRepositoryFromRootPackage(root);
   const workflow = 'publish.yml';
@@ -203,14 +257,10 @@ export async function releaseTrustPublisher(root: string, options: ReleaseTrustP
           },
           bootstrapOptions,
         ),
-      trustPublisher: (pkg, dryRun, env) => {
-        const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
-        if (dryRun) {
-          args.push('--dry-run');
-        }
-        return runLatestNpmTrust(root, args, env);
-      },
+      trustPublisher: (pkg, dryRun, env) =>
+        runLatestNpmTrust(root, npmTrustGithubArgs(pkg.name, repository, workflow, dryRun), env),
       trustedPublishers: (pkg) => listTrustedPublishers(root, pkg),
+      login: () => runLatestNpm(root, ['login', '--auth-type=web']),
       log: (message) => console.log(message),
       error: (message) => console.error(message),
     },
@@ -218,6 +268,19 @@ export async function releaseTrustPublisher(root: string, options: ReleaseTrustP
   );
 }
 
+export function npmTrustGithubArgs(
+  packageName: string,
+  repository: string,
+  workflow: string,
+  dryRun: boolean,
+): string[] {
+  const args = ['trust', 'github', packageName, '--file', workflow, '--repo', repository, '--allow-publish', '--yes'];
+  if (dryRun) {
+    args.push('--dry-run');
+  }
+  return args;
+}
+
 export interface TrustPublisherShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
   repository: string;
   workflow: string;
@@ -225,7 +288,8 @@ export interface TrustPublisherShell<Package extends ReleasePackageInfo = Releas
   packageExists(name: string): Promise<boolean>;
   bootstrapNpmPackages(options: BootstrapNpmPackagesOptions): Promise<Package[]>;
   trustPublisher(pkg: Package, dryRun: boolean, env?: Record<string, string>): Promise<TrustPublisherResult>;
-  trustedPublishers(pkg: Package): Promise<TrustedPublisher[]>;
+  trustedPublishers(pkg: Package): Promise<TrustedPublisherLookup>;
+  login(): Promise<void>;
   log(message: string): void;
   error(message: string): void;
 }
@@ -239,6 +303,14 @@ export interface TrustedPublisher {
   repository?: string;
 }
 
+export interface NpmTrustAccessDenied {
+  readonly status: 'access-denied';
+  readonly identity: string;
+  readonly owners: string;
+}
+
+export type TrustedPublisherLookup = TrustedPublisher[] | NpmTrustAccessDenied;
+
 export async function configureTrustedPublishers<Package extends ReleasePackageInfo>(
   shell: TrustPublisherShell<Package>,
   options: ReleaseTrustPublisherOptions,
@@ -275,7 +347,7 @@ export async function configureTrustedPublishers<Package extends ReleasePackageI
   const failedPackages: string[] = [];
   for (const pkg of selectedPackages) {
     if (!options.dryRun) {
-      const trustedPublishers = await shell.trustedPublishers(pkg);
+      const trustedPublishers = await trustedPublishersWithOwnerLogin(shell, pkg);
       if (hasMatchingGithubTrustedPublisher(trustedPublishers, shell.repository, shell.workflow)) {
         shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
         continue;
@@ -315,6 +387,33 @@ export async function configureTrustedPublishers<Package extends ReleasePackageI
   }
 }
 
+async function trustedPublishersWithOwnerLogin<Package extends ReleasePackageInfo>(
+  shell: TrustPublisherShell<Package>,
+  pkg: Package,
+): Promise<TrustedPublisher[]> {
+  let result = await shell.trustedPublishers(pkg);
+  if (Array.isArray(result)) {
+    return result;
+  }
+
+  shell.error(
+    `${pkg.name}: npm trust access denied for npm account "${result.identity}". ` +
+      `npm trust requires package write access. Package owners:\n${result.owners}`,
+  );
+  shell.log(`${pkg.name}: opening npm browser login. Sign in as a listed package owner, then return here.`);
+  await shell.login();
+
+  result = await shell.trustedPublishers(pkg);
+  if (Array.isArray(result)) {
+    return result;
+  }
+  throw new Error(
+    `${pkg.name}: npm trust access denied for npm account "${result.identity}". ` +
+      `npm trust requires package write access. Package owners:\n${result.owners}\n` +
+      'npm browser login completed, but the selected account still cannot manage this package.',
+  );
+}
+
 function selectedTrustPublisherPackages<Package extends ReleasePackageInfo>(
   packages: Package[],
   selections: string[],
@@ -483,7 +582,7 @@ async function publishPlaceholderPackage(
           name: pkg.name,
           version: NPM_BOOTSTRAP_VERSION,
           description: `Bootstrap placeholder for ${pkg.name}. Real releases are published by SmoothBricks CI.`,
-          license: stringProperty(pkg.json, 'license') ?? 'UNLICENSED',
+          license: pkg.json.license ?? 'UNLICENSED',
           repository: pkg.json.repository,
           publishConfig: { access: 'public' },
         },
@@ -507,7 +606,7 @@ function safeTarballPrefix(name: string): string {
 
 async function assertPackedWorkspaceDependencies(root: string, tarball: string, pkg: ReleasePackage): Promise<void> {
   const manifest = await readPackedPackageJson(root, tarball, pkg.name);
-  const failures = validatePackedWorkspaceDependencies(root, pkg, manifest);
+  const failures = validatePackedWorkspaceDependencies(root, pkg, manifest, { mode: 'publish' });
   if (failures.length > 0) {
     throw new Error(failures.join('\n'));
   }
@@ -548,6 +647,19 @@ async function releaseVersionPackages(
   );
 }
 
+async function releasePlatformPackages(
+  root: string,
+  packages: ReleasePackage[],
+  bump: string,
+): Promise<ReleasePackage[]> {
+  const candidates = await releaseVersionPackages(root, packages, bump);
+  if (candidates.length === 0) {
+    return [];
+  }
+  // Nx may version additional reverse dependents, so use its dry-run result rather than only the direct candidates.
+  return runNxReleaseVersionPreview(root, releasePackageProjects(candidates), bump);
+}
+
 async function runNxReleaseVersion(
   root: string,
   projects: string,
@@ -603,6 +715,7 @@ async function runNxReleaseVersionPreview(root: string, projects: string, bump:
       gitPush: false,
       stageChanges: false,
       createRelease: false,
+      forceChangelogGeneration: true,
       dryRun: true,
     });
     releasePreviewChangelogs.clear();
@@ -680,8 +793,7 @@ async function packageVersionAtRef(root: string, packagePath: string, ref: strin
     return null;
   }
   try {
-    const parsed = JSON.parse(decode(result.stdout));
-    return isRecord(parsed) ? stringProperty(parsed, 'version') : null;
+    return parsePackageJsonText(decode(result.stdout))?.version ?? null;
   } catch {
     return null;
   }
@@ -808,17 +920,11 @@ function releaseNextShell(root: string): { bumpStablePackagesToNext(packages: Re
   };
 }
 
-function releaseRepairShell(root: string): ReleaseCompletionShell<ReleasePackage> & {
-  checkout(ref: string): Promise<void>;
-  withDevenvEnv<T>(runWithEnv: () => Promise<T>): Promise<T>;
-  beforeRepairTarget(target: ReleaseTarget): void;
-  afterRepairTarget(target: ReleaseTarget): void;
-} {
+function releaseTargetCheckoutShell(root: string) {
   return {
-    ...releaseCompletionShell(root),
-    checkout: (ref) => run('git', ['switch', '--detach', ref], root),
-    withDevenvEnv: (runWithEnv) => withDevenvEnv(root, runWithEnv),
-    beforeRepairTarget: (target) => {
+    checkout: (ref: string) => run('git', ['switch', '--detach', ref], root),
+    withDevenvEnv: <T>(runWithEnv: () => Promise<T>) => withDevenvEnv(root, runWithEnv),
+    beforeRepairTarget: (target: ReleaseTarget) => {
       console.log(`::group::Repair pending release ${target.sha.slice(0, 12)} (${packageSummary(target.packages)})`);
     },
     afterRepairTarget: () => {
@@ -827,6 +933,37 @@ function releaseRepairShell(root: string): ReleaseCompletionShell<ReleasePackage
   };
 }
 
+function releaseRepairShell(root: string, platformOutputs?: string): ReleaseRepairShell<ReleasePackage> {
+  return {
+    ...releaseCompletionShell(root),
+    ...releaseTargetCheckoutShell(root),
+    prepareRepairTarget: async (target) => {
+      if (!platformOutputs || target.npmPackages.length === 0) {
+        return;
+      }
+      const output = join(platformOutputs, target.sha);
+      console.log(`Repair pending releases: applying cross-platform outputs from ${output}.`);
+      await githubCiApplyOutputs(root, [output], target.sha);
+    },
+  };
+}
+
+function releaseRepairOutputsShell(
+  root: string,
+  targetGlobs: string,
+  outputRoot: string,
+): ReleaseRepairOutputsShell<ReleasePackage> {
+  return {
+    ...releaseTargetCheckoutShell(root),
+    collectRepairTargetOutputs: (target) =>
+      githubCiNxRunMany(root, {
+        targets: targetGlobs,
+        projects: releasePackageProjects(target.npmPackages),
+        collectOutputs: join(outputRoot, target.sha),
+      }),
+  };
+}
+
 function releaseRetagShell(root: string, remote: string) {
   return {
     listReleasePackages: () => releasePackages(root),
@@ -844,6 +981,29 @@ function releaseRetagShell(root: string, remote: string) {
   };
 }
 
+async function fetchReleaseRepairRef(root: string, requestedRef?: string): Promise<string> {
+  const branch = await releaseBranch(root);
+  const remote = await releaseRemote(root, branch);
+  console.log(`Repair pending releases: fetching ${remote}/${branch} and tags.`);
+  await fetchReleaseRefs(root, remote, branch);
+  if (requestedRef) {
+    return requestedRef;
+  }
+  const remoteRef = `${remote}/${branch}`;
+  return (await gitRefExists(root, remoteRef)) ? remoteRef : gitHead(root);
+}
+
+function logPendingReleaseTargets(targets: ReleaseTarget[]): void {
+  console.log(
+    targets.length === 0
+      ? 'Repair pending releases: no pending durable state repairs found.'
+      : `Repair pending releases: ${targets.length} release target${targets.length === 1 ? '' : 's'} need repair.`,
+  );
+  for (const target of targets) {
+    console.log(`Repair pending releases: target ${target.sha.slice(0, 12)} needs ${repairTargetSummary(target)}.`);
+  }
+}
+
 async function listPendingReleaseTargets(root: string, ref: string): Promise<ReleaseTarget[]> {
   const head = await gitHead(root);
   return pendingReleaseTargets(await listOwnedReleaseTagRecords(root, ref), head);
@@ -1069,7 +1229,8 @@ function repairReasons(target: ReleaseTarget, pkg: ReleasePackage): string[] {
 }
 
 async function fetchReleaseRefs(root: string, remote: string, branch: string): Promise<void> {
-  await run('git', ['fetch', '--tags', remote, branch], root);
+  // `retag-unpublished` intentionally moves repairable tags, so the remote tag is authoritative.
+  await run('git', ['fetch', '--force', '--tags', remote, branch], root);
 }
 
 async function gitRefExists(root: string, ref: string): Promise<boolean> {
@@ -1112,74 +1273,83 @@ async function packageChangedFilesSince(root: string, ref: string, packagePath:
     .map((path) => (path.startsWith(packagePrefix) ? path.slice(packagePrefix.length) : path));
 }
 
-async function packageJsonAtRef(
-  root: string,
-  ref: string,
-  packagePath: string,
-): Promise<Record<string, unknown> | null> {
+async function packageJsonAtRef(root: string, ref: string, packagePath: string): Promise<PackageJson | null> {
   const result = await $`git show ${`${ref}:${packagePath}/package.json`}`.cwd(root).quiet().nothrow();
   if (result.exitCode !== 0) {
     return null;
   }
   try {
-    const parsed = JSON.parse(decode(result.stdout));
-    return isRecord(parsed) ? parsed : null;
+    return parsePackageJsonText(decode(result.stdout));
   } catch {
     return null;
   }
 }
 
-async function currentPackageJson(root: string, packagePath: string): Promise<Record<string, unknown> | null> {
+async function currentPackageJson(root: string, packagePath: string): Promise<PackageJson | null> {
   return readPackageJson(join(root, packagePath, 'package.json'))?.json ?? null;
 }
 
 async function packageBuildInputPatterns(root: string, projectName: string, _packagePath: string): Promise<string[]> {
   const project = await nxProjectJson(root, projectName);
-  const nxJson = readJsonObject(join(root, 'nx.json')) ?? {};
-  return resolveBuildInputPatterns(project, nxJson);
+  return resolveBuildInputPatterns(project, readNxJson(join(root, 'nx.json')));
 }
 
-async function nxProjectJson(root: string, projectName: string): Promise<Record<string, unknown>> {
+async function nxProjectJson(root: string, projectName: string): Promise<NxProjectJson> {
   const result = await $`nx show project ${projectName} --json`.cwd(root).quiet();
-  const parsed = JSON.parse(decode(result.stdout));
-  if (!isRecord(parsed)) {
+  const parsed = parseNxProjectJsonText(decode(result.stdout));
+  if (!parsed) {
     throw new Error(`Unable to inspect Nx project ${projectName}.`);
   }
   return parsed;
 }
 
-function resolveBuildInputPatterns(project: Record<string, unknown>, nxJson: Record<string, unknown>): string[] {
-  const targets = recordProperty(project, 'targets');
+function readNxJson(path: string): NxJson {
+  if (!existsSync(path)) {
+    return {};
+  }
+  try {
+    return parseNxJsonText(readFileSync(path, 'utf8')) ?? {};
+  } catch {
+    return {};
+  }
+}
+
+function resolveBuildInputPatterns(project: NxProjectJson, nxJson: NxJson): string[] {
+  const targets = project.targets;
   if (!targets) {
     return [];
   }
   return normalizeInputPatterns(collectBuildInputs(targets), nxJson);
 }
 
-function collectBuildInputs(targets: Record<string, unknown>): string[] {
-  const build = recordProperty(targets, 'build');
+function collectBuildInputs(targets: Record<string, NxTargetConfig>): string[] {
+  const build = targets.build;
   if (!build) {
     return ['production'];
   }
-  const directInputs = stringArrayProperty(build, 'inputs');
+  const directInputs = stringInputs(build.inputs);
   if (directInputs.length > 0) {
     return directInputs;
   }
   const inputs: string[] = [];
-  for (const dependency of stringArrayProperty(build, 'dependsOn')) {
-    if (dependency.startsWith('^')) {
+  for (const dependency of build.dependsOn ?? []) {
+    if (typeof dependency !== 'string' || dependency.startsWith('^')) {
       continue;
     }
     const targetName = dependency.includes(':') ? dependency.split(':')[1] : dependency;
     if (!targetName) {
       continue;
     }
-    inputs.push(...stringArrayProperty(recordProperty(targets, targetName), 'inputs'));
+    inputs.push(...stringInputs(targets[targetName]?.inputs));
   }
   return inputs.length > 0 ? inputs : ['production'];
 }
 
-function normalizeInputPatterns(inputs: string[], nxJson: Record<string, unknown>): string[] {
+function stringInputs(inputs: NxTargetConfig['inputs'] | undefined): string[] {
+  return Array.isArray(inputs) ? inputs.filter((entry): entry is string => typeof entry === 'string') : [];
+}
+
+function normalizeInputPatterns(inputs: string[], nxJson: NxJson): string[] {
   const patterns: string[] = [];
   const seen = new Set<string>();
   for (const input of inputs) {
@@ -1190,14 +1360,13 @@ function normalizeInputPatterns(inputs: string[], nxJson: Record<string, unknown
   return patterns;
 }
 
-function expandInputPattern(input: string, nxJson: Record<string, unknown>, seen: Set<string>): string[] {
+function expandInputPattern(input: string, nxJson: NxJson, seen: Set<string>): string[] {
   if (seen.has(input)) {
     return [];
   }
   seen.add(input);
   if (!input.includes('{')) {
-    const namedInputs = recordProperty(nxJson, 'namedInputs');
-    const namedInput = namedInputs?.[input];
+    const namedInput = nxJson.namedInputs?.[input];
     if (Array.isArray(namedInput)) {
       return namedInput.flatMap((entry) => (typeof entry === 'string' ? expandInputPattern(entry, nxJson, seen) : []));
     }
@@ -1212,19 +1381,6 @@ function expandInputPattern(input: string, nxJson: Record<string, unknown>, seen
   return [`${excluded ? '!' : ''}${packageRelative}`];
 }
 
-function recordProperty(record: Record<string, unknown> | null, key: string): Record<string, unknown> | null {
-  if (!record) {
-    return null;
-  }
-  const value = record[key];
-  return isRecord(value) ? value : null;
-}
-
-function stringArrayProperty(record: Record<string, unknown> | null, key: string): string[] {
-  const value = record?.[key];
-  return Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string') : [];
-}
-
 async function packageHasHistory(root: string, packagePath: string): Promise<boolean> {
   const result = await $`git log --format=%H -- ${packagePath}`.cwd(root).quiet().nothrow();
   if (result.exitCode !== 0) {
@@ -1309,7 +1465,8 @@ async function pushRetaggedReleaseTags(
 }
 
 async function githubReleaseExists(root: string, tag: string): Promise<boolean> {
-  return (await runStatus('gh', ['release', 'view', tag, '--json', 'tagName'], root, true)) === 0;
+  const result = await $`gh release view ${tag} --json tagName`.cwd(root).quiet().nothrow();
+  return githubReleaseLookupExists(tag, result.exitCode, decode(result.stdout), decode(result.stderr));
 }
 
 function githubReleaseUrl(root: string, tag: string): string {
@@ -1462,61 +1619,113 @@ async function runLatestNpmTrust(
   if (status === 0) {
     return 'configured';
   }
-  throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')} failed with exit code ${status}`);
+  throw new Error(npmCommandFailedMessage(npmArgs, status));
 }
 
-async function listTrustedPublishers(root: string, pkg: Pick<ReleasePackage, 'name'>): Promise<TrustedPublisher[]> {
+async function listTrustedPublishers(root: string, pkg: Pick<ReleasePackage, 'name'>): Promise<TrustedPublisherLookup> {
   const args = ['trust', 'list', pkg.name, '--json'];
   let result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
   if (result.exitCode !== 0 && /\bEOTP\b/.test(`${result.stdout}\n${result.stderr}`)) {
     const status = await runInteractiveStatus('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
     if (status !== 0) {
-      throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${status}`);
+      throw new Error(npmCommandFailedMessage(args, status));
     }
     result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
   }
+  if (result.exitCode !== 0 && npmTrustListAccessDenied(result.stdout, result.stderr)) {
+    return npmTrustAccessDetails(root, pkg.name);
+  }
   if (result.exitCode !== 0) {
-    throw new Error(
-      `nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${result.exitCode}`,
-    );
+    throw new Error(npmCommandFailedMessage(args, result.exitCode, result.stdout, result.stderr));
   }
   return parseTrustedPublishers(result.stdout, pkg.name);
 }
 
+/** npm trust list/setup requires an authenticated package owner. */
+export function npmTrustListAccessDenied(stdout: string, stderr: string): boolean {
+  const output = `${stdout}\n${stderr}`;
+  // E403: authenticated but not an owner. E401 / login-required: no usable session.
+  return (
+    /\bE403\b/.test(output) ||
+    /\bE401\b/.test(output) ||
+    /You must be logged in to publish packages/i.test(output) ||
+    /npm error 401 Unauthorized/i.test(output)
+  );
+}
+
+function npmCommandFailedMessage(npmArgs: string[], exitCode: number, stdout = '', stderr = ''): string {
+  const command = `nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')}`;
+  const detail = npmFailureDetail(stdout, stderr);
+  return detail.length > 0
+    ? `${command} failed with exit code ${exitCode}\n${detail}`
+    : `${command} failed with exit code ${exitCode}`;
+}
+
+function npmFailureDetail(stdout: string, stderr: string): string {
+  const chunks = [stderr.trim(), stdout.trim()].filter((chunk) => chunk.length > 0);
+  if (chunks.length === 0) {
+    return '';
+  }
+  // Prefer the actionable npm error line over notice spam when present.
+  const joined = chunks.join('\n');
+  const errorLines = joined
+    .split('\n')
+    .map((line) => line.trimEnd())
+    .filter((line) => /npm error|error code|401 Unauthorized|403 Forbidden|E401|E403|logged in/i.test(line));
+  if (errorLines.length > 0) {
+    return errorLines.slice(0, 8).join('\n');
+  }
+  // Fall back to a short tail of combined output.
+  return joined.split('\n').slice(-12).join('\n');
+}
+
+async function npmTrustAccessDetails(root: string, packageName: string): Promise<NpmTrustAccessDenied> {
+  const [identityResult, ownersResult] = await Promise.all([
+    runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', 'whoami'], root),
+    runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', 'owner', 'ls', packageName], root),
+  ]);
+  return {
+    status: 'access-denied',
+    identity:
+      identityResult.exitCode === 0 && identityResult.stdout.trim().length > 0
+        ? identityResult.stdout.trim()
+        : '(not authenticated)',
+    owners:
+      ownersResult.exitCode === 0 && ownersResult.stdout.trim().length > 0
+        ? ownersResult.stdout.trim()
+        : '(owner lookup unavailable)',
+  };
+}
+
 export function parseTrustedPublishers(stdout: string, packageName: string): TrustedPublisher[] {
   if (stdout.trim().length === 0) {
     return [];
   }
-  const parsed = JSON.parse(stdout) as unknown;
+  // createIsParse returns null for non-matching shapes and bare `null`.
+  const parsed = parseTrustedPublisherJson(stdout);
   if (parsed === null) {
-    return [];
-  }
-  if (Array.isArray(parsed)) {
-    return parsed.map((value) => parseTrustedPublisher(value, packageName));
-  }
-  if (isRecord(parsed)) {
-    return [parseTrustedPublisher(parsed, packageName)];
+    if (stdout.trim() === 'null') {
+      return [];
+    }
+    throw new Error(`${packageName}: npm trust list returned invalid trusted publisher JSON.`);
   }
-  throw new Error(`${packageName}: npm trust list returned invalid JSON.`);
+  return (Array.isArray(parsed) ? parsed : [parsed]).map((value) => ({
+    id: value.id,
+    type: value.type,
+    file: value.file,
+    repository: value.repository,
+  }));
 }
 
-function parseTrustedPublisher(value: unknown, packageName: string): TrustedPublisher {
-  if (!isRecord(value)) {
-    throw new Error(`${packageName}: npm trust list returned invalid trusted publisher entry.`);
-  }
-  const id = stringProperty(value, 'id');
-  const type = stringProperty(value, 'type');
-  if (!id || !type) {
-    throw new Error(`${packageName}: npm trust list returned a trusted publisher without id or type.`);
-  }
-  return {
-    id,
-    type,
-    file: stringProperty(value, 'file') ?? undefined,
-    repository: stringProperty(value, 'repository') ?? undefined,
-  };
+interface TrustedPublisherJson {
+  id: string;
+  type: string;
+  file?: string;
+  repository?: string;
 }
 
+const parseTrustedPublisherJson = typia.json.createIsParse<TrustedPublisherJson | TrustedPublisherJson[]>();
+
 async function runLatestNpmPublish(root: string, npmArgs: string[]): Promise<void> {
   await runLatestNpm(root, npmArgs, { NODE_AUTH_TOKEN: '', NPM_TOKEN: '' });
 }