@smoothbricks/cli 0.2.0 → 0.3.1

package/src/release/index.ts

@@ -6,7 +6,7 @@ import { Writable } from 'node:stream';
 import { $ } from 'bun';
 import { withDevenvEnv } from '../lib/devenv.js';
 import { isRecord, readJsonObject, stringProperty } from '../lib/json.js';
-import { decode, run, runResult, runStatus } from '../lib/run.js';
+import { decode, run, runInteractiveStatus, runResult, runStatus } from '../lib/run.js';
 import { listReleasePackages, readPackageJson, repositoryInfo } from '../lib/workspace.js';
 import { readPackedPackageJson, validatePackedWorkspaceDependencies } from '../monorepo/packed-manifest.js';
 import {
@@ -24,10 +24,16 @@ import {
   pendingReleaseTargets,
   type ReleasePackageInfo,
   releaseTag,
+  releaseTagAliases,
 } from './core.js';
-import { createOrUpdateGithubRelease, renderNxProjectChangelogContents } from './github-release.js';
+import {
+  createOrUpdateGithubRelease,
+  renderNxProjectChangelogContents,
+  withNxWorkspaceRoot,
+} from './github-release.js';
 import { publishWithAuthDiagnostics } from './npm-auth.js';
 import {
+  bumpStableReleaseToNext,
   completeReleaseAtHead as completeReleaseAtHeadWithShell,
   type ReleaseCompletionShell,
   type ReleaseSummary,
@@ -55,9 +61,9 @@ export interface ReleaseRepairPendingOptions {
 export interface ReleaseTrustPublisherOptions {
   dryRun?: boolean;
   bootstrap?: boolean;
-  otp?: string;
   bootstrapOtp?: string;
   skipLogin?: boolean;
+  packages?: string[];
 }
 
 export interface ReleaseBootstrapNpmPackagesOptions {
@@ -97,6 +103,9 @@ export async function releaseVersion(root: string, options: ReleaseVersionOption
   } else if (result.status === 'no-release-needed') {
     console.log('Nx did not create a release commit; no release needed.');
   }
+  if (result.status === 'dry-run') {
+    await writeReleasePreviewSummary(root, packages, result.packages);
+  }
   await writeReleaseGithubOutput(options.githubOutput, result.packages, result.mode);
 }
 
@@ -105,15 +114,22 @@ export async function releasePublish(root: string, options: ReleasePublishOption
   const packages = await releasePackagesAtHead(root, releasePackages(root));
   if (packages.length === 0) {
     if (bump === 'auto') {
+      if (options.dryRun === true) {
+        console.log(
+          'No release tags found at HEAD because dry-run versioning does not create release commits or tags.',
+        );
+        return;
+      }
       console.log('No release tags found at HEAD; no release to publish.');
       const summary: ReleaseSummary<ReleasePackage> = {
         sha: await gitHead(root),
-        dryRun: options.dryRun === true,
+        dryRun: false,
         packages,
         pushed: false,
         published: [],
         alreadyPublished: [],
         githubReleases: [],
+        githubReleaseLinks: [],
         rerunRequired: false,
         noRelease: true,
       };
@@ -129,6 +145,15 @@ export async function releasePublish(root: string, options: ReleasePublishOption
     await newerCommitsRemain(root),
   );
   await writeReleaseSummary(summary);
+  const bumpedPackages = await bumpStableReleaseToNext(
+    releaseNextShell(root),
+    packages,
+    options.dryRun === true,
+    summary.rerunRequired,
+  );
+  if (bumpedPackages.length > 0) {
+    console.log(`Prepared next prerelease for ${packageSummary(bumpedPackages)}.`);
+  }
 }
 
 export async function releaseRepairPending(root: string, options: ReleaseRepairPendingOptions): Promise<void> {
@@ -145,6 +170,9 @@ export async function releaseRepairPending(root: string, options: ReleaseRepairP
       ? 'Repair pending releases: no pending durable state repairs found.'
       : `Repair pending releases: ${targets.length} release target${targets.length === 1 ? '' : 's'} need repair.`,
   );
+  for (const target of targets) {
+    console.log(`Repair pending releases: target ${target.sha.slice(0, 12)} needs ${repairTargetSummary(target)}.`);
+  }
   const summaries = await repairPendingTargets(releaseRepairShell(root), targets, restoreRef, options.dryRun === true);
   await writeRepairSummary(summaries, options.dryRun === true);
 }
@@ -170,7 +198,6 @@ export async function releaseTrustPublisher(root: string, options: ReleaseTrustP
           },
           bootstrapOptions,
         ),
-      login: () => runLatestNpm(root, ['login', '--auth-type=web']),
       trustPublisher: (pkg, dryRun, env) => {
         const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
         if (dryRun) {
@@ -178,7 +205,7 @@ export async function releaseTrustPublisher(root: string, options: ReleaseTrustP
         }
         return runLatestNpmTrust(root, args, env);
       },
-      promptOtp: (packageName) => promptForNpmOtp(packageName),
+      trustedPublishers: (pkg) => listTrustedPublishers(root, pkg),
       log: (message) => console.log(message),
       error: (message) => console.error(message),
     },
@@ -192,38 +219,43 @@ export interface TrustPublisherShell<Package extends ReleasePackageInfo = Releas
   listReleasePackages(): Package[];
   packageExists(name: string): Promise<boolean>;
   bootstrapNpmPackages(options: BootstrapNpmPackagesOptions): Promise<Package[]>;
-  login(): Promise<void>;
   trustPublisher(pkg: Package, dryRun: boolean, env?: Record<string, string>): Promise<TrustPublisherResult>;
-  promptOtp(packageName: string): Promise<string>;
+  trustedPublishers(pkg: Package): Promise<TrustedPublisher[]>;
   log(message: string): void;
   error(message: string): void;
 }
 
 export type TrustPublisherResult = 'configured' | 'already-configured';
 
+export interface TrustedPublisher {
+  id: string;
+  type: string;
+  file?: string;
+  repository?: string;
+}
+
 export async function configureTrustedPublishers<Package extends ReleasePackageInfo>(
   shell: TrustPublisherShell<Package>,
   options: ReleaseTrustPublisherOptions,
 ): Promise<void> {
   const packages = shell.listReleasePackages();
-  if (packages.length === 0) {
+  const selectedPackages = selectedTrustPublisherPackages(packages, options.packages ?? []);
+  if (selectedPackages.length === 0) {
     throw new Error('No owned release packages found.');
   }
 
-  let bootstrapLoggedIn = false;
   if (options.bootstrap) {
-    const bootstrapped = await shell.bootstrapNpmPackages({
+    await shell.bootstrapNpmPackages({
       dryRun: options.dryRun === true,
       skipLogin: options.skipLogin === true,
       otp: options.bootstrapOtp,
-      packages: [],
+      packages: options.packages ?? [],
     });
-    bootstrapLoggedIn = bootstrapped.length > 0 && !options.dryRun && !options.skipLogin;
   }
 
   if (!options.dryRun) {
     const packageStates = await Promise.all(
-      packages.map(async (pkg) => ((await shell.packageExists(pkg.name)) ? null : pkg.name)),
+      selectedPackages.map(async (pkg) => ((await shell.packageExists(pkg.name)) ? null : pkg.name)),
     );
     const missingPackages = packageStates.filter((name): name is string => name !== null);
     if (missingPackages.length > 0) {
@@ -235,21 +267,26 @@ export async function configureTrustedPublishers<Package extends ReleasePackageI
     }
   }
 
-  if (!options.dryRun && !options.skipLogin && !bootstrapLoggedIn) {
-    await shell.login();
-  }
-
   const failedPackages: string[] = [];
-  for (const pkg of packages) {
+  for (const pkg of selectedPackages) {
+    if (!options.dryRun) {
+      const trustedPublishers = await shell.trustedPublishers(pkg);
+      if (hasMatchingGithubTrustedPublisher(trustedPublishers, shell.repository, shell.workflow)) {
+        shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
+        continue;
+      }
+      if (trustedPublishers.length > 0) {
+        throw new Error(
+          `${pkg.name}: npm trusted publisher exists but does not match GitHub Actions ${shell.repository}/${shell.workflow}. ` +
+            'Use npm trust list to inspect it and npm trust revoke --id <trust-id> before reconfiguring.',
+        );
+      }
+    }
+
     shell.log(`${pkg.name}: trusting GitHub Actions ${shell.repository}/${shell.workflow}`);
     while (true) {
-      const otp = options.dryRun ? undefined : (options.otp ?? (await shell.promptOtp(pkg.name)));
       try {
-        const result = await shell.trustPublisher(
-          pkg,
-          options.dryRun === true,
-          otp ? { NPM_CONFIG_OTP: otp } : undefined,
-        );
+        const result = await shell.trustPublisher(pkg, options.dryRun === true);
         if (result === 'already-configured') {
           shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
         }
@@ -258,9 +295,9 @@ export async function configureTrustedPublishers<Package extends ReleasePackageI
         shell.error(`${pkg.name}: npm trusted publisher setup failed.`);
         shell.error(error instanceof Error ? error.message : String(error));
         if (!options.dryRun) {
-          shell.error('npm OTP codes are single-use. Generate a fresh OTP before retrying this package.');
+          shell.error('npm owns trusted publishing authentication. Complete the npm browser challenge, then retry.');
         }
-        if (options.otp || options.dryRun) {
+        if (options.dryRun) {
           failedPackages.push(pkg.name);
           break;
         }
@@ -270,10 +307,44 @@ export async function configureTrustedPublishers<Package extends ReleasePackageI
   }
   if (failedPackages.length > 0) {
     shell.error(`Trusted publishing was not configured for: ${failedPackages.join(', ')}`);
-    if (options.otp) {
-      shell.error('Rerun smoo release trust-publisher without --otp to enter a fresh OTP for each failed package.');
+  }
+}
+
+function selectedTrustPublisherPackages<Package extends ReleasePackageInfo>(
+  packages: Package[],
+  selections: string[],
+): Package[] {
+  if (selections.length === 0) {
+    return packages;
+  }
+  const byName = new Map(packages.map((pkg) => [pkg.name, pkg]));
+  const selected: Package[] = [];
+  const unknown: string[] = [];
+  for (const name of selections) {
+    const pkg = byName.get(name);
+    if (pkg) {
+      selected.push(pkg);
+    } else {
+      unknown.push(name);
     }
   }
+  if (unknown.length > 0) {
+    throw new Error(`Unknown owned release package selection: ${unknown.join(', ')}`);
+  }
+  return selected;
+}
+
+function hasMatchingGithubTrustedPublisher(
+  trustedPublishers: TrustedPublisher[],
+  repository: string,
+  workflow: string,
+): boolean {
+  return trustedPublishers.some(
+    (trustedPublisher) =>
+      trustedPublisher.type === 'github' &&
+      trustedPublisher.repository === repository &&
+      trustedPublisher.file === workflow,
+  );
 }
 
 export async function releaseBootstrapNpmPackages(
@@ -325,6 +396,7 @@ interface ReleaseState {
 }
 
 type ReleasePackage = ReturnType<typeof listReleasePackages>[number];
+const releasePreviewChangelogs = new Map<string, string>();
 
 type ReleaseTarget = CoreReleaseTarget<ReleasePackage>;
 type ReleaseTagRecord = CoreReleaseTagRecord<ReleasePackage>;
@@ -459,6 +531,7 @@ async function releaseVersionPackages(
   return autoReleaseCandidatePackages(
     {
       gitRefExists: (ref) => gitRefExists(root, ref),
+      latestStableReleaseRef: (projectName) => latestStableReleaseRef(root, projectName),
       packageChangedFilesSince: (ref, packagePath) => packageChangedFilesSince(root, ref, packagePath),
       packageJsonAtRef: (ref, packagePath) => packageJsonAtRef(root, ref, packagePath),
       currentPackageJson: (packagePath) => currentPackageJson(root, packagePath),
@@ -470,7 +543,16 @@ async function releaseVersionPackages(
   );
 }
 
-async function runNxReleaseVersion(root: string, projects: string, bump: string, dryRun: boolean): Promise<void> {
+async function runNxReleaseVersion(
+  root: string,
+  projects: string,
+  bump: string,
+  dryRun: boolean,
+): Promise<ReleasePackage[]> {
+  if (dryRun) {
+    return runNxReleaseVersionPreview(root, projects, bump);
+  }
+
   // Nx owns local release mutation: package versions, bun.lock updates, the
   // release commit, and annotated tags. smoo owns remote publication after the
   // workflow validates the exact release commit Nx produced.
@@ -479,10 +561,78 @@ async function runNxReleaseVersion(root: string, projects: string, bump: string,
     nxArgs.push(bump);
   }
   nxArgs.push(`--projects=${projects}`, '--git-commit=true', '--git-tag=true', '--git-push=false');
-  if (dryRun) {
-    nxArgs.push('--dry-run');
-  }
   await run('nx', nxArgs, root);
+  return [];
+}
+
+async function runNxReleaseVersionPreview(root: string, projects: string, bump: string): Promise<ReleasePackage[]> {
+  return withNxWorkspaceRoot(root, async () => {
+    const { createAPI } = await import('nx/src/command-line/release/version.js');
+    const { createAPI: createChangelogAPI } = await import('nx/src/command-line/release/changelog.js');
+    const projectNames = projects.split(',').filter(Boolean);
+    const result = await createAPI(
+      {},
+      false,
+    )({
+      specifier: bump === 'auto' ? undefined : bump,
+      projects: projectNames,
+      gitCommit: true,
+      gitTag: true,
+      gitPush: false,
+      dryRun: true,
+    });
+    const changelogResult = await createChangelogAPI(
+      {
+        changelog: {
+          workspaceChangelog: false,
+          projectChangelogs: { createRelease: false, file: false },
+        },
+      },
+      false,
+    )({
+      projects: projectNames,
+      versionData: result.projectsVersionData,
+      releaseGraph: result.releaseGraph,
+      gitCommit: false,
+      gitTag: false,
+      gitPush: false,
+      stageChanges: false,
+      createRelease: false,
+      dryRun: true,
+    });
+    releasePreviewChangelogs.clear();
+    for (const [projectName, changelog] of Object.entries(changelogResult.projectChangelogs ?? {})) {
+      releasePreviewChangelogs.set(projectName, changelog.contents);
+    }
+    const packagesByProject = new Map(releasePackages(root).map((pkg) => [pkg.projectName, pkg]));
+    return Object.entries(result.projectsVersionData)
+      .map(([projectName, data]) => {
+        const pkg = packagesByProject.get(projectName);
+        if (!pkg || !data.newVersion) {
+          return null;
+        }
+        return { ...pkg, version: data.newVersion };
+      })
+      .filter((pkg): pkg is ReleasePackage => pkg !== null);
+  });
+}
+
+async function runNxNextPrereleaseVersion(root: string, projects: string): Promise<void> {
+  await run(
+    'nx',
+    [
+      'release',
+      'version',
+      'prerelease',
+      `--projects=${projects}`,
+      '--preid=next',
+      '--git-commit=true',
+      '--git-tag=false',
+      '--git-push=false',
+      '--git-commit-message=chore(release): prepare next prerelease',
+    ],
+    root,
+  );
 }
 
 async function releasePackagesAtHead(root: string, packages: ReleasePackage[]): Promise<ReleasePackage[]> {
@@ -567,7 +717,7 @@ async function gitTagsAtRef(root: string, ref: string): Promise<string[]> {
 }
 
 async function previousReleaseTag(root: string, pkg: ReleasePackage, currentTag: string): Promise<string | null> {
-  const result = await $`git tag --list ${`${pkg.name}@*`} --sort=-v:refname --merged ${currentTag}`
+  const result = await $`git tag --list ${`${pkg.projectName}@*`} --sort=-v:refname --merged ${currentTag}`
     .cwd(root)
     .quiet()
     .nothrow();
@@ -620,6 +770,12 @@ async function pushReleaseRefs(root: string, packages: ReleasePackage[]): Promis
   return true;
 }
 
+async function pushCurrentBranch(root: string): Promise<void> {
+  const branch = await releaseBranch(root);
+  const remote = await releaseRemote(root, branch);
+  await run('git', ['push', remote, `HEAD:refs/heads/${branch}`], root);
+}
+
 function releaseCompletionShell(root: string): ReleaseCompletionShell<ReleasePackage> {
   return {
     gitHead: () => gitHead(root),
@@ -638,6 +794,15 @@ function releaseCompletionShell(root: string): ReleaseCompletionShell<ReleasePac
   };
 }
 
+function releaseNextShell(root: string): { bumpStablePackagesToNext(packages: ReleasePackage[]): Promise<void> } {
+  return {
+    bumpStablePackagesToNext: async (packages) => {
+      await runNxNextPrereleaseVersion(root, releasePackageProjects(packages));
+      await pushCurrentBranch(root);
+    },
+  };
+}
+
 function releaseRepairShell(root: string): ReleaseCompletionShell<ReleasePackage> & {
   checkout(ref: string): Promise<void>;
   withDevenvEnv<T>(runWithEnv: () => Promise<T>): Promise<T>;
@@ -692,11 +857,12 @@ async function listOwnedReleaseTagRecords(root: string, ref: string): Promise<Re
 
 async function durableReleaseTagState(root: string, pkg: Pick<ReleasePackage, 'name' | 'version'>, tag: string) {
   const packageVersion = `${pkg.name}@${pkg.version}`;
+  const githubReleaseTags = releaseTagAliases({ ...pkg, projectName: projectNameFromReleaseTag(tag) });
   const start = Date.now();
-  console.log(`${packageVersion}: checking durable state (npm + GitHub Release ${tag}).`);
+  console.log(`${packageVersion}: checking durable state (npm + GitHub Release ${githubReleaseTags.join(' or ')}).`);
   const [npmPublished, githubReleasePresent] = await Promise.all([
     npmVersionExists(root, pkg.name, pkg.version),
-    githubReleaseExists(root, tag),
+    anyGithubReleaseExists(root, githubReleaseTags),
   ]);
   console.log(
     `${packageVersion}: durable state npm=${yesNo(npmPublished)} github=${yesNo(githubReleasePresent)} (${Date.now() - start}ms).`,
@@ -704,6 +870,14 @@ async function durableReleaseTagState(root: string, pkg: Pick<ReleasePackage, 'n
   return { npmPublished, githubReleaseExists: githubReleasePresent };
 }
 
+function projectNameFromReleaseTag(tag: string): string {
+  const versionSeparator = tag.lastIndexOf('@');
+  if (versionSeparator <= 0) {
+    return tag;
+  }
+  return tag.slice(0, versionSeparator);
+}
+
 async function gitReleaseTagsByCreatorDate(root: string): Promise<GitReleaseTagInfo[]> {
   const result =
     await $`git for-each-ref --sort=-creatordate --format=${'%(refname:short)%09%(creatordate:unix)%09%(*objectname)%09%(objectname)'} refs/tags`
@@ -738,7 +912,7 @@ async function listMissingGithubReleasePackages(root: string, packages: ReleaseP
   ).filter((pkg): pkg is ReleasePackage => pkg !== null);
 }
 
-async function createGithubRelease(root: string, pkg: ReleasePackage, dryRun: boolean): Promise<void> {
+async function createGithubRelease(root: string, pkg: ReleasePackage, dryRun: boolean): Promise<string | null> {
   const currentTag = releaseTag(pkg);
   console.log(`${pkg.name}@${pkg.version}: rendering GitHub Release notes for ${currentTag}.`);
   console.log(`GitHub release auth: ${envPresence('GH_TOKEN')}, ${envPresence('GITHUB_TOKEN')}.`);
@@ -748,7 +922,7 @@ async function createGithubRelease(root: string, pkg: ReleasePackage, dryRun: bo
   const previousTag = await previousReleaseTag(root, pkg, currentTag);
   if (dryRun) {
     await renderNxProjectChangelogContents({ root, pkg, previousTag, dryRun });
-    return;
+    return null;
   }
   const contents = await renderNxProjectChangelogContents({ root, pkg, previousTag, dryRun });
   await createOrUpdateGithubRelease(pkg, contents, {
@@ -756,6 +930,7 @@ async function createGithubRelease(root: string, pkg: ReleasePackage, dryRun: bo
     runGhRelease: (args) => run('gh', args, root),
     log: (message) => console.log(message),
   });
+  return githubReleaseUrl(root, currentTag);
 }
 
 function envPresence(name: string): string {
@@ -793,7 +968,7 @@ async function writeReleaseSummary(summary: ReleaseSummary<ReleasePackage>): Pro
     lines.push(`- Git refs pushed: ${summary.pushed ? 'yes' : 'already current'}`);
     lines.push(`- npm published: ${packageSummary(summary.published)}`);
     lines.push(`- npm already published: ${packageSummary(summary.alreadyPublished)}`);
-    lines.push(`- GitHub Releases created/updated: ${packageSummary(summary.githubReleases)}`);
+    lines.push(`- GitHub Releases created/updated: ${githubReleaseSummary(summary)}`);
   }
   if (summary.rerunRequired) {
     const message = 'A previous incomplete release was repaired; newer commits remain. Run Publish again.';
@@ -808,13 +983,45 @@ async function writeReleaseSummary(summary: ReleaseSummary<ReleasePackage>): Pro
   }
 }
 
+async function writeReleasePreviewSummary(
+  root: string,
+  currentPackages: ReleasePackage[],
+  previewPackages: ReleasePackage[],
+): Promise<void> {
+  const lines = ['## Release Preview', '', `- Commit: \`${(await gitHead(root)).slice(0, 12)}\``, '- Mode: dry run'];
+  if (previewPackages.length === 0) {
+    lines.push('- Result: no release needed');
+  } else {
+    lines.push('- Packages:');
+    const currentByName = new Map(currentPackages.map((pkg) => [pkg.name, pkg]));
+    for (const pkg of previewPackages) {
+      lines.push(`  - \`${pkg.name}\`: \`${currentByName.get(pkg.name)?.version ?? 'unknown'}\` -> \`${pkg.version}\``);
+    }
+    for (const pkg of previewPackages) {
+      const contents = releasePreviewChangelogs.get(pkg.projectName);
+      if (!contents) {
+        throw new Error(`Nx did not generate a project changelog for ${pkg.projectName}.`);
+      }
+      lines.push('', `### ${pkg.name} ${pkg.version}`, '', contents.trim());
+    }
+  }
+  const text = `${lines.join('\n')}\n`;
+  console.log(text.trimEnd());
+  const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+  if (summaryPath) {
+    await appendFile(summaryPath, `${text}\n`);
+  }
+}
+
 async function writeRepairSummary(summaries: Array<ReleaseSummary<ReleasePackage>>, dryRun: boolean): Promise<void> {
   const lines = ['## Pending Release Repair', '', `- Mode: ${dryRun ? 'dry run' : 'release'}`];
   if (summaries.length === 0) {
     lines.push('- Result: no pending releases needed repair');
   } else {
     for (const summary of summaries) {
-      lines.push(`- Repaired \`${summary.sha.slice(0, 12)}\`: ${packageSummary(summary.packages)}`);
+      lines.push(
+        `- ${dryRun ? 'Would repair' : 'Repaired'} \`${summary.sha.slice(0, 12)}\`: ${packageSummary(summary.packages)}`,
+      );
     }
   }
   const text = `${lines.join('\n')}\n`;
@@ -832,6 +1039,30 @@ function packageSummary(packages: ReleasePackage[]): string {
   return packages.map((pkg) => `${pkg.name}@${pkg.version}`).join(', ');
 }
 
+function githubReleaseSummary(summary: ReleaseSummary<ReleasePackage>): string {
+  if (summary.githubReleaseLinks.length > 0) {
+    return summary.githubReleaseLinks.map(({ pkg, url }) => `[${pkg.name}@${pkg.version}](${url})`).join(', ');
+  }
+  return packageSummary(summary.githubReleases);
+}
+
+function repairTargetSummary(target: ReleaseTarget): string {
+  return target.packages
+    .map((pkg) => `${pkg.name}@${pkg.version} (${repairReasons(target, pkg).join(' + ')})`)
+    .join(', ');
+}
+
+function repairReasons(target: ReleaseTarget, pkg: ReleasePackage): string[] {
+  const reasons: string[] = [];
+  if (target.npmPackages.includes(pkg)) {
+    reasons.push('npm missing');
+  }
+  if (target.githubPackages.includes(pkg)) {
+    reasons.push('GitHub Release missing');
+  }
+  return reasons;
+}
+
 async function fetchReleaseRefs(root: string, remote: string, branch: string): Promise<void> {
   await run('git', ['fetch', '--tags', remote, branch], root);
 }
@@ -841,6 +1072,28 @@ async function gitRefExists(root: string, ref: string): Promise<boolean> {
   return result.exitCode === 0;
 }
 
+async function latestStableReleaseRef(root: string, projectName: string): Promise<string | null> {
+  // List tags matching <projectName>@* sorted newest-first by version, then
+  // return the first non-prerelease tag as a full ref.
+  const pattern = `${projectName}@*`;
+  const result = await $`git tag --list ${pattern} --sort=-v:refname`.cwd(root).quiet().nothrow();
+  if (result.exitCode !== 0) {
+    return null;
+  }
+  const tags = decode(result.stdout)
+    .split('\n')
+    .map((t) => t.trim())
+    .filter(Boolean);
+  const prefix = `${projectName}@`;
+  for (const tagName of tags) {
+    const version = tagName.slice(prefix.length);
+    if (version && !version.includes('-')) {
+      return `refs/tags/${tagName}`;
+    }
+  }
+  return null;
+}
+
 async function packageChangedFilesSince(root: string, ref: string, packagePath: string): Promise<string[]> {
   const result = await $`git diff --name-only ${`${ref}..HEAD`} -- ${packagePath}`.cwd(root).quiet().nothrow();
   if (result.exitCode !== 0) {
@@ -1054,6 +1307,19 @@ async function githubReleaseExists(root: string, tag: string): Promise<boolean>
   return (await runStatus('gh', ['release', 'view', tag, '--json', 'tagName'], root, true)) === 0;
 }
 
+function githubReleaseUrl(root: string, tag: string): string {
+  return `https://github.com/${githubRepositoryFromRootPackage(root)}/releases/tag/${encodeURIComponent(tag)}`;
+}
+
+async function anyGithubReleaseExists(root: string, tags: string[]): Promise<boolean> {
+  for (const tag of tags) {
+    if (await githubReleaseExists(root, tag)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 async function assertRemoteTagExists(root: string, tag: string): Promise<void> {
   const branch = await releaseBranch(root);
   const remote = await releaseRemote(root, branch);
@@ -1182,17 +1448,68 @@ async function runLatestNpmTrust(
   npmArgs: string[],
   env?: Record<string, string>,
 ): Promise<TrustPublisherResult> {
-  const result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs], root, env);
-  if (result.exitCode === 0) {
+  const status = await runInteractiveStatus(
+    'nix',
+    ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs],
+    root,
+    env,
+  );
+  if (status === 0) {
     return 'configured';
   }
-  const output = `${result.stdout}\n${result.stderr}`;
-  if (/\bE409\b|\b409 Conflict\b/.test(output)) {
-    return 'already-configured';
+  throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')} failed with exit code ${status}`);
+}
+
+async function listTrustedPublishers(root: string, pkg: Pick<ReleasePackage, 'name'>): Promise<TrustedPublisher[]> {
+  const args = ['trust', 'list', pkg.name, '--json'];
+  let result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
+  if (result.exitCode !== 0 && /\bEOTP\b/.test(`${result.stdout}\n${result.stderr}`)) {
+    const status = await runInteractiveStatus('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
+    if (status !== 0) {
+      throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${status}`);
+    }
+    result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
   }
-  throw new Error(
-    `nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')} failed with exit code ${result.exitCode}`,
-  );
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${result.exitCode}`,
+    );
+  }
+  return parseTrustedPublishers(result.stdout, pkg.name);
+}
+
+export function parseTrustedPublishers(stdout: string, packageName: string): TrustedPublisher[] {
+  if (stdout.trim().length === 0) {
+    return [];
+  }
+  const parsed = JSON.parse(stdout) as unknown;
+  if (parsed === null) {
+    return [];
+  }
+  if (Array.isArray(parsed)) {
+    return parsed.map((value) => parseTrustedPublisher(value, packageName));
+  }
+  if (isRecord(parsed)) {
+    return [parseTrustedPublisher(parsed, packageName)];
+  }
+  throw new Error(`${packageName}: npm trust list returned invalid JSON.`);
+}
+
+function parseTrustedPublisher(value: unknown, packageName: string): TrustedPublisher {
+  if (!isRecord(value)) {
+    throw new Error(`${packageName}: npm trust list returned invalid trusted publisher entry.`);
+  }
+  const id = stringProperty(value, 'id');
+  const type = stringProperty(value, 'type');
+  if (!id || !type) {
+    throw new Error(`${packageName}: npm trust list returned a trusted publisher without id or type.`);
+  }
+  return {
+    id,
+    type,
+    file: stringProperty(value, 'file') ?? undefined,
+    repository: stringProperty(value, 'repository') ?? undefined,
+  };
 }
 
 async function runLatestNpmPublish(root: string, npmArgs: string[]): Promise<void> {
@@ -1206,7 +1523,7 @@ function missingNpmPackagePublishGuidance(pkg: Pick<ReleasePackage, 'name'>): st
 async function promptForNpmOtp(packageName: string): Promise<string> {
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     throw new Error(
-      `npm trust requires a one-time password for ${packageName}. Pass --otp <code> in non-interactive shells.`,
+      `npm requires a one-time password for ${packageName}. Pass --otp <code> in non-interactive shells.`,
     );
   }