@smoothbricks/cli 0.2.0 → 0.3.1

package/dist/release/index.js

@@ -6,15 +6,15 @@ import { Writable } from 'node:stream';
 import { $ } from 'bun';
 import { withDevenvEnv } from '../lib/devenv.js';
 import { isRecord, readJsonObject, stringProperty } from '../lib/json.js';
-import { decode, run, runResult, runStatus } from '../lib/run.js';
+import { decode, run, runInteractiveStatus, runResult, runStatus } from '../lib/run.js';
 import { listReleasePackages, readPackageJson, repositoryInfo } from '../lib/workspace.js';
 import { readPackedPackageJson, validatePackedWorkspaceDependencies } from '../monorepo/packed-manifest.js';
 import { bootstrapNpmPackages, NPM_BOOTSTRAP_DIST_TAG, NPM_BOOTSTRAP_VERSION, } from './bootstrap-npm-packages.js';
 import { autoReleaseCandidatePackages } from './candidates.js';
-import { collectOwnedReleaseTagRecords, pendingReleaseTargets, releaseTag, } from './core.js';
-import { createOrUpdateGithubRelease, renderNxProjectChangelogContents } from './github-release.js';
+import { collectOwnedReleaseTagRecords, pendingReleaseTargets, releaseTag, releaseTagAliases, } from './core.js';
+import { createOrUpdateGithubRelease, renderNxProjectChangelogContents, withNxWorkspaceRoot, } from './github-release.js';
 import { publishWithAuthDiagnostics } from './npm-auth.js';
-import { completeReleaseAtHead as completeReleaseAtHeadWithShell, repairPendingTargets, runReleaseVersion, } from './orchestration.js';
+import { bumpStableReleaseToNext, completeReleaseAtHead as completeReleaseAtHeadWithShell, repairPendingTargets, runReleaseVersion, } from './orchestration.js';
 import { retagUnpublished } from './retag-unpublished.js';
 export async function releaseVersion(root, options) {
     const bump = releaseBumpArg(options.bump);
@@ -33,6 +33,9 @@ export async function releaseVersion(root, options) {
     else if (result.status === 'no-release-needed') {
         console.log('Nx did not create a release commit; no release needed.');
     }
+    if (result.status === 'dry-run') {
+        await writeReleasePreviewSummary(root, packages, result.packages);
+    }
     await writeReleaseGithubOutput(options.githubOutput, result.packages, result.mode);
 }
 export async function releasePublish(root, options) {
@@ -40,15 +43,20 @@ export async function releasePublish(root, options) {
     const packages = await releasePackagesAtHead(root, releasePackages(root));
     if (packages.length === 0) {
         if (bump === 'auto') {
+            if (options.dryRun === true) {
+                console.log('No release tags found at HEAD because dry-run versioning does not create release commits or tags.');
+                return;
+            }
             console.log('No release tags found at HEAD; no release to publish.');
             const summary = {
                 sha: await gitHead(root),
-                dryRun: options.dryRun === true,
+                dryRun: false,
                 packages,
                 pushed: false,
                 published: [],
                 alreadyPublished: [],
                 githubReleases: [],
+                githubReleaseLinks: [],
                 rerunRequired: false,
                 noRelease: true,
             };
@@ -59,6 +67,10 @@ export async function releasePublish(root, options) {
     }
     const summary = await completeReleaseAtHeadWithShell(releaseCompletionShell(root), packages, options.dryRun === true, await newerCommitsRemain(root));
     await writeReleaseSummary(summary);
+    const bumpedPackages = await bumpStableReleaseToNext(releaseNextShell(root), packages, options.dryRun === true, summary.rerunRequired);
+    if (bumpedPackages.length > 0) {
+        console.log(`Prepared next prerelease for ${packageSummary(bumpedPackages)}.`);
+    }
 }
 export async function releaseRepairPending(root, options) {
     const branch = await releaseBranch(root);
@@ -72,6 +84,9 @@ export async function releaseRepairPending(root, options) {
     console.log(targets.length === 0
         ? 'Repair pending releases: no pending durable state repairs found.'
         : `Repair pending releases: ${targets.length} release target${targets.length === 1 ? '' : 's'} need repair.`);
+    for (const target of targets) {
+        console.log(`Repair pending releases: target ${target.sha.slice(0, 12)} needs ${repairTargetSummary(target)}.`);
+    }
     const summaries = await repairPendingTargets(releaseRepairShell(root), targets, restoreRef, options.dryRun === true);
     await writeRepairSummary(summaries, options.dryRun === true);
 }
@@ -91,7 +106,6 @@ export async function releaseTrustPublisher(root, options) {
             promptOtp: (packageName) => promptForNpmOtp(packageName),
             log: (message) => console.log(message),
         }, bootstrapOptions),
-        login: () => runLatestNpm(root, ['login', '--auth-type=web']),
         trustPublisher: (pkg, dryRun, env) => {
             const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
             if (dryRun) {
@@ -99,28 +113,27 @@ export async function releaseTrustPublisher(root, options) {
             }
             return runLatestNpmTrust(root, args, env);
         },
-        promptOtp: (packageName) => promptForNpmOtp(packageName),
+        trustedPublishers: (pkg) => listTrustedPublishers(root, pkg),
         log: (message) => console.log(message),
         error: (message) => console.error(message),
     }, options);
 }
 export async function configureTrustedPublishers(shell, options) {
     const packages = shell.listReleasePackages();
-    if (packages.length === 0) {
+    const selectedPackages = selectedTrustPublisherPackages(packages, options.packages ?? []);
+    if (selectedPackages.length === 0) {
         throw new Error('No owned release packages found.');
     }
-    let bootstrapLoggedIn = false;
     if (options.bootstrap) {
-        const bootstrapped = await shell.bootstrapNpmPackages({
+        await shell.bootstrapNpmPackages({
             dryRun: options.dryRun === true,
             skipLogin: options.skipLogin === true,
             otp: options.bootstrapOtp,
-            packages: [],
+            packages: options.packages ?? [],
         });
-        bootstrapLoggedIn = bootstrapped.length > 0 && !options.dryRun && !options.skipLogin;
     }
     if (!options.dryRun) {
-        const packageStates = await Promise.all(packages.map(async (pkg) => ((await shell.packageExists(pkg.name)) ? null : pkg.name)));
+        const packageStates = await Promise.all(selectedPackages.map(async (pkg) => ((await shell.packageExists(pkg.name)) ? null : pkg.name)));
         const missingPackages = packageStates.filter((name) => name !== null);
         if (missingPackages.length > 0) {
             throw new Error('npm trusted publishing can only be configured after packages exist on the registry. ' +
@@ -128,16 +141,23 @@ export async function configureTrustedPublishers(shell, options) {
                 `Missing packages: ${missingPackages.join(', ')}`);
         }
     }
-    if (!options.dryRun && !options.skipLogin && !bootstrapLoggedIn) {
-        await shell.login();
-    }
     const failedPackages = [];
-    for (const pkg of packages) {
+    for (const pkg of selectedPackages) {
+        if (!options.dryRun) {
+            const trustedPublishers = await shell.trustedPublishers(pkg);
+            if (hasMatchingGithubTrustedPublisher(trustedPublishers, shell.repository, shell.workflow)) {
+                shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
+                continue;
+            }
+            if (trustedPublishers.length > 0) {
+                throw new Error(`${pkg.name}: npm trusted publisher exists but does not match GitHub Actions ${shell.repository}/${shell.workflow}. ` +
+                    'Use npm trust list to inspect it and npm trust revoke --id <trust-id> before reconfiguring.');
+            }
+        }
         shell.log(`${pkg.name}: trusting GitHub Actions ${shell.repository}/${shell.workflow}`);
         while (true) {
-            const otp = options.dryRun ? undefined : (options.otp ?? (await shell.promptOtp(pkg.name)));
             try {
-                const result = await shell.trustPublisher(pkg, options.dryRun === true, otp ? { NPM_CONFIG_OTP: otp } : undefined);
+                const result = await shell.trustPublisher(pkg, options.dryRun === true);
                 if (result === 'already-configured') {
                     shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
                 }
@@ -147,9 +167,9 @@ export async function configureTrustedPublishers(shell, options) {
                 shell.error(`${pkg.name}: npm trusted publisher setup failed.`);
                 shell.error(error instanceof Error ? error.message : String(error));
                 if (!options.dryRun) {
-                    shell.error('npm OTP codes are single-use. Generate a fresh OTP before retrying this package.');
+                    shell.error('npm owns trusted publishing authentication. Complete the npm browser challenge, then retry.');
                 }
-                if (options.otp || options.dryRun) {
+                if (options.dryRun) {
                     failedPackages.push(pkg.name);
                     break;
                 }
@@ -159,10 +179,33 @@ export async function configureTrustedPublishers(shell, options) {
     }
     if (failedPackages.length > 0) {
         shell.error(`Trusted publishing was not configured for: ${failedPackages.join(', ')}`);
-        if (options.otp) {
-            shell.error('Rerun smoo release trust-publisher without --otp to enter a fresh OTP for each failed package.');
+    }
+}
+function selectedTrustPublisherPackages(packages, selections) {
+    if (selections.length === 0) {
+        return packages;
+    }
+    const byName = new Map(packages.map((pkg) => [pkg.name, pkg]));
+    const selected = [];
+    const unknown = [];
+    for (const name of selections) {
+        const pkg = byName.get(name);
+        if (pkg) {
+            selected.push(pkg);
+        }
+        else {
+            unknown.push(name);
         }
     }
+    if (unknown.length > 0) {
+        throw new Error(`Unknown owned release package selection: ${unknown.join(', ')}`);
+    }
+    return selected;
+}
+function hasMatchingGithubTrustedPublisher(trustedPublishers, repository, workflow) {
+    return trustedPublishers.some((trustedPublisher) => trustedPublisher.type === 'github' &&
+        trustedPublisher.repository === repository &&
+        trustedPublisher.file === workflow);
 }
 export async function releaseBootstrapNpmPackages(root, options) {
     await bootstrapNpmPackages({
@@ -198,6 +241,7 @@ export async function releaseRetagUnpublished(root, options) {
 export async function printReleaseState(root) {
     console.log(JSON.stringify(await getReleaseState(root), null, 2));
 }
+const releasePreviewChangelogs = new Map();
 async function getReleaseState(root) {
     return getReleaseStateForPackages(root, listReleasePackages(root));
 }
@@ -293,6 +337,7 @@ async function releaseVersionPackages(root, packages, bump) {
     }
     return autoReleaseCandidatePackages({
         gitRefExists: (ref) => gitRefExists(root, ref),
+        latestStableReleaseRef: (projectName) => latestStableReleaseRef(root, projectName),
         packageChangedFilesSince: (ref, packagePath) => packageChangedFilesSince(root, ref, packagePath),
         packageJsonAtRef: (ref, packagePath) => packageJsonAtRef(root, ref, packagePath),
         currentPackageJson: (packagePath) => currentPackageJson(root, packagePath),
@@ -301,6 +346,9 @@ async function releaseVersionPackages(root, packages, bump) {
     }, packages);
 }
 async function runNxReleaseVersion(root, projects, bump, dryRun) {
+    if (dryRun) {
+        return runNxReleaseVersionPreview(root, projects, bump);
+    }
     // Nx owns local release mutation: package versions, bun.lock updates, the
     // release commit, and annotated tags. smoo owns remote publication after the
     // workflow validates the exact release commit Nx produced.
@@ -309,10 +357,66 @@ async function runNxReleaseVersion(root, projects, bump, dryRun) {
         nxArgs.push(bump);
     }
     nxArgs.push(`--projects=${projects}`, '--git-commit=true', '--git-tag=true', '--git-push=false');
-    if (dryRun) {
-        nxArgs.push('--dry-run');
-    }
     await run('nx', nxArgs, root);
+    return [];
+}
+async function runNxReleaseVersionPreview(root, projects, bump) {
+    return withNxWorkspaceRoot(root, async () => {
+        const { createAPI } = await import('nx/src/command-line/release/version.js');
+        const { createAPI: createChangelogAPI } = await import('nx/src/command-line/release/changelog.js');
+        const projectNames = projects.split(',').filter(Boolean);
+        const result = await createAPI({}, false)({
+            specifier: bump === 'auto' ? undefined : bump,
+            projects: projectNames,
+            gitCommit: true,
+            gitTag: true,
+            gitPush: false,
+            dryRun: true,
+        });
+        const changelogResult = await createChangelogAPI({
+            changelog: {
+                workspaceChangelog: false,
+                projectChangelogs: { createRelease: false, file: false },
+            },
+        }, false)({
+            projects: projectNames,
+            versionData: result.projectsVersionData,
+            releaseGraph: result.releaseGraph,
+            gitCommit: false,
+            gitTag: false,
+            gitPush: false,
+            stageChanges: false,
+            createRelease: false,
+            dryRun: true,
+        });
+        releasePreviewChangelogs.clear();
+        for (const [projectName, changelog] of Object.entries(changelogResult.projectChangelogs ?? {})) {
+            releasePreviewChangelogs.set(projectName, changelog.contents);
+        }
+        const packagesByProject = new Map(releasePackages(root).map((pkg) => [pkg.projectName, pkg]));
+        return Object.entries(result.projectsVersionData)
+            .map(([projectName, data]) => {
+            const pkg = packagesByProject.get(projectName);
+            if (!pkg || !data.newVersion) {
+                return null;
+            }
+            return { ...pkg, version: data.newVersion };
+        })
+            .filter((pkg) => pkg !== null);
+    });
+}
+async function runNxNextPrereleaseVersion(root, projects) {
+    await run('nx', [
+        'release',
+        'version',
+        'prerelease',
+        `--projects=${projects}`,
+        '--preid=next',
+        '--git-commit=true',
+        '--git-tag=false',
+        '--git-push=false',
+        '--git-commit-message=chore(release): prepare next prerelease',
+    ], root);
 }
 async function releasePackagesAtHead(root, packages) {
     return releasePackagesAtRef(root, packages, 'HEAD');
@@ -381,7 +485,7 @@ async function gitTagsAtRef(root, ref) {
         .filter(Boolean);
 }
 async function previousReleaseTag(root, pkg, currentTag) {
-    const result = await $ `git tag --list ${`${pkg.name}@*`} --sort=-v:refname --merged ${currentTag}`
+    const result = await $ `git tag --list ${`${pkg.projectName}@*`} --sort=-v:refname --merged ${currentTag}`
         .cwd(root)
         .quiet()
         .nothrow();
@@ -429,6 +533,11 @@ async function pushReleaseRefs(root, packages) {
     await run('git', ['push', '--atomic', remote, ...refspecs], root);
     return true;
 }
+async function pushCurrentBranch(root) {
+    const branch = await releaseBranch(root);
+    const remote = await releaseRemote(root, branch);
+    await run('git', ['push', remote, `HEAD:refs/heads/${branch}`], root);
+}
 function releaseCompletionShell(root) {
     return {
         gitHead: () => gitHead(root),
@@ -446,6 +555,14 @@ function releaseCompletionShell(root) {
         createGithubRelease: (pkg, dryRun) => createGithubRelease(root, pkg, dryRun),
     };
 }
+function releaseNextShell(root) {
+    return {
+        bumpStablePackagesToNext: async (packages) => {
+            await runNxNextPrereleaseVersion(root, releasePackageProjects(packages));
+            await pushCurrentBranch(root);
+        },
+    };
+}
 function releaseRepairShell(root) {
     return {
         ...releaseCompletionShell(root),
@@ -490,15 +607,23 @@ async function listOwnedReleaseTagRecords(root, ref) {
 }
 async function durableReleaseTagState(root, pkg, tag) {
     const packageVersion = `${pkg.name}@${pkg.version}`;
+    const githubReleaseTags = releaseTagAliases({ ...pkg, projectName: projectNameFromReleaseTag(tag) });
     const start = Date.now();
-    console.log(`${packageVersion}: checking durable state (npm + GitHub Release ${tag}).`);
+    console.log(`${packageVersion}: checking durable state (npm + GitHub Release ${githubReleaseTags.join(' or ')}).`);
     const [npmPublished, githubReleasePresent] = await Promise.all([
         npmVersionExists(root, pkg.name, pkg.version),
-        githubReleaseExists(root, tag),
+        anyGithubReleaseExists(root, githubReleaseTags),
     ]);
     console.log(`${packageVersion}: durable state npm=${yesNo(npmPublished)} github=${yesNo(githubReleasePresent)} (${Date.now() - start}ms).`);
     return { npmPublished, githubReleaseExists: githubReleasePresent };
 }
+function projectNameFromReleaseTag(tag) {
+    const versionSeparator = tag.lastIndexOf('@');
+    if (versionSeparator <= 0) {
+        return tag;
+    }
+    return tag.slice(0, versionSeparator);
+}
 async function gitReleaseTagsByCreatorDate(root) {
     const result = await $ `git for-each-ref --sort=-creatordate --format=${'%(refname:short)%09%(creatordate:unix)%09%(*objectname)%09%(objectname)'} refs/tags`
         .cwd(root)
@@ -537,7 +662,7 @@ async function createGithubRelease(root, pkg, dryRun) {
     const previousTag = await previousReleaseTag(root, pkg, currentTag);
     if (dryRun) {
         await renderNxProjectChangelogContents({ root, pkg, previousTag, dryRun });
-        return;
+        return null;
     }
     const contents = await renderNxProjectChangelogContents({ root, pkg, previousTag, dryRun });
     await createOrUpdateGithubRelease(pkg, contents, {
@@ -545,6 +670,7 @@ async function createGithubRelease(root, pkg, dryRun) {
         runGhRelease: (args) => run('gh', args, root),
         log: (message) => console.log(message),
     });
+    return githubReleaseUrl(root, currentTag);
 }
 function envPresence(name) {
     return `${name}=${process.env[name] ? 'present' : 'missing'}`;
@@ -579,7 +705,7 @@ async function writeReleaseSummary(summary) {
         lines.push(`- Git refs pushed: ${summary.pushed ? 'yes' : 'already current'}`);
         lines.push(`- npm published: ${packageSummary(summary.published)}`);
         lines.push(`- npm already published: ${packageSummary(summary.alreadyPublished)}`);
-        lines.push(`- GitHub Releases created/updated: ${packageSummary(summary.githubReleases)}`);
+        lines.push(`- GitHub Releases created/updated: ${githubReleaseSummary(summary)}`);
     }
     if (summary.rerunRequired) {
         const message = 'A previous incomplete release was repaired; newer commits remain. Run Publish again.';
@@ -593,6 +719,32 @@ async function writeReleaseSummary(summary) {
         await appendFile(summaryPath, `${text}\n`);
     }
 }
+async function writeReleasePreviewSummary(root, currentPackages, previewPackages) {
+    const lines = ['## Release Preview', '', `- Commit: \`${(await gitHead(root)).slice(0, 12)}\``, '- Mode: dry run'];
+    if (previewPackages.length === 0) {
+        lines.push('- Result: no release needed');
+    }
+    else {
+        lines.push('- Packages:');
+        const currentByName = new Map(currentPackages.map((pkg) => [pkg.name, pkg]));
+        for (const pkg of previewPackages) {
+            lines.push(`  - \`${pkg.name}\`: \`${currentByName.get(pkg.name)?.version ?? 'unknown'}\` -> \`${pkg.version}\``);
+        }
+        for (const pkg of previewPackages) {
+            const contents = releasePreviewChangelogs.get(pkg.projectName);
+            if (!contents) {
+                throw new Error(`Nx did not generate a project changelog for ${pkg.projectName}.`);
+            }
+            lines.push('', `### ${pkg.name} ${pkg.version}`, '', contents.trim());
+        }
+    }
+    const text = `${lines.join('\n')}\n`;
+    console.log(text.trimEnd());
+    const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+    if (summaryPath) {
+        await appendFile(summaryPath, `${text}\n`);
+    }
+}
 async function writeRepairSummary(summaries, dryRun) {
     const lines = ['## Pending Release Repair', '', `- Mode: ${dryRun ? 'dry run' : 'release'}`];
     if (summaries.length === 0) {
@@ -600,7 +752,7 @@ async function writeRepairSummary(summaries, dryRun) {
     }
     else {
         for (const summary of summaries) {
-            lines.push(`- Repaired \`${summary.sha.slice(0, 12)}\`: ${packageSummary(summary.packages)}`);
+            lines.push(`- ${dryRun ? 'Would repair' : 'Repaired'} \`${summary.sha.slice(0, 12)}\`: ${packageSummary(summary.packages)}`);
         }
     }
     const text = `${lines.join('\n')}\n`;
@@ -616,6 +768,27 @@ function packageSummary(packages) {
     }
     return packages.map((pkg) => `${pkg.name}@${pkg.version}`).join(', ');
 }
+function githubReleaseSummary(summary) {
+    if (summary.githubReleaseLinks.length > 0) {
+        return summary.githubReleaseLinks.map(({ pkg, url }) => `[${pkg.name}@${pkg.version}](${url})`).join(', ');
+    }
+    return packageSummary(summary.githubReleases);
+}
+function repairTargetSummary(target) {
+    return target.packages
+        .map((pkg) => `${pkg.name}@${pkg.version} (${repairReasons(target, pkg).join(' + ')})`)
+        .join(', ');
+}
+function repairReasons(target, pkg) {
+    const reasons = [];
+    if (target.npmPackages.includes(pkg)) {
+        reasons.push('npm missing');
+    }
+    if (target.githubPackages.includes(pkg)) {
+        reasons.push('GitHub Release missing');
+    }
+    return reasons;
+}
 async function fetchReleaseRefs(root, remote, branch) {
     await run('git', ['fetch', '--tags', remote, branch], root);
 }
@@ -623,6 +796,27 @@ async function gitRefExists(root, ref) {
     const result = await $ `git rev-parse --verify ${ref}`.cwd(root).quiet().nothrow();
     return result.exitCode === 0;
 }
+async function latestStableReleaseRef(root, projectName) {
+    // List tags matching <projectName>@* sorted newest-first by version, then
+    // return the first non-prerelease tag as a full ref.
+    const pattern = `${projectName}@*`;
+    const result = await $ `git tag --list ${pattern} --sort=-v:refname`.cwd(root).quiet().nothrow();
+    if (result.exitCode !== 0) {
+        return null;
+    }
+    const tags = decode(result.stdout)
+        .split('\n')
+        .map((t) => t.trim())
+        .filter(Boolean);
+    const prefix = `${projectName}@`;
+    for (const tagName of tags) {
+        const version = tagName.slice(prefix.length);
+        if (version && !version.includes('-')) {
+            return `refs/tags/${tagName}`;
+        }
+    }
+    return null;
+}
 async function packageChangedFilesSince(root, ref, packagePath) {
     const result = await $ `git diff --name-only ${`${ref}..HEAD`} -- ${packagePath}`.cwd(root).quiet().nothrow();
     if (result.exitCode !== 0) {
@@ -806,6 +1000,17 @@ async function pushRetaggedReleaseTags(root, remote, updates) {
 async function githubReleaseExists(root, tag) {
     return (await runStatus('gh', ['release', 'view', tag, '--json', 'tagName'], root, true)) === 0;
 }
+function githubReleaseUrl(root, tag) {
+    return `https://github.com/${githubRepositoryFromRootPackage(root)}/releases/tag/${encodeURIComponent(tag)}`;
+}
+async function anyGithubReleaseExists(root, tags) {
+    for (const tag of tags) {
+        if (await githubReleaseExists(root, tag)) {
+            return true;
+        }
+    }
+    return false;
+}
 async function assertRemoteTagExists(root, tag) {
     const branch = await releaseBranch(root);
     const remote = await releaseRemote(root, branch);
@@ -917,15 +1122,58 @@ async function runLatestNpm(root, npmArgs, env) {
     await run('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs], root, env);
 }
 async function runLatestNpmTrust(root, npmArgs, env) {
-    const result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs], root, env);
-    if (result.exitCode === 0) {
+    const status = await runInteractiveStatus('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs], root, env);
+    if (status === 0) {
         return 'configured';
     }
-    const output = `${result.stdout}\n${result.stderr}`;
-    if (/\bE409\b|\b409 Conflict\b/.test(output)) {
-        return 'already-configured';
+    throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')} failed with exit code ${status}`);
+}
+async function listTrustedPublishers(root, pkg) {
+    const args = ['trust', 'list', pkg.name, '--json'];
+    let result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
+    if (result.exitCode !== 0 && /\bEOTP\b/.test(`${result.stdout}\n${result.stderr}`)) {
+        const status = await runInteractiveStatus('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
+        if (status !== 0) {
+            throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${status}`);
+        }
+        result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
+    }
+    if (result.exitCode !== 0) {
+        throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${result.exitCode}`);
+    }
+    return parseTrustedPublishers(result.stdout, pkg.name);
+}
+export function parseTrustedPublishers(stdout, packageName) {
+    if (stdout.trim().length === 0) {
+        return [];
+    }
+    const parsed = JSON.parse(stdout);
+    if (parsed === null) {
+        return [];
+    }
+    if (Array.isArray(parsed)) {
+        return parsed.map((value) => parseTrustedPublisher(value, packageName));
+    }
+    if (isRecord(parsed)) {
+        return [parseTrustedPublisher(parsed, packageName)];
     }
-    throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')} failed with exit code ${result.exitCode}`);
+    throw new Error(`${packageName}: npm trust list returned invalid JSON.`);
+}
+function parseTrustedPublisher(value, packageName) {
+    if (!isRecord(value)) {
+        throw new Error(`${packageName}: npm trust list returned invalid trusted publisher entry.`);
+    }
+    const id = stringProperty(value, 'id');
+    const type = stringProperty(value, 'type');
+    if (!id || !type) {
+        throw new Error(`${packageName}: npm trust list returned a trusted publisher without id or type.`);
+    }
+    return {
+        id,
+        type,
+        file: stringProperty(value, 'file') ?? undefined,
+        repository: stringProperty(value, 'repository') ?? undefined,
+    };
 }
 async function runLatestNpmPublish(root, npmArgs) {
     await runLatestNpm(root, npmArgs, { NODE_AUTH_TOKEN: '', NPM_TOKEN: '' });
@@ -935,7 +1183,7 @@ function missingNpmPackagePublishGuidance(pkg) {
 }
 async function promptForNpmOtp(packageName) {
     if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        throw new Error(`npm trust requires a one-time password for ${packageName}. Pass --otp <code> in non-interactive shells.`);
+        throw new Error(`npm requires a one-time password for ${packageName}. Pass --otp <code> in non-interactive shells.`);
     }
     const mutedOutput = new Writable({
         write(_chunk, _encoding, callback) {

package/dist/release/orchestration.d.ts

@@ -8,6 +8,10 @@ export interface ReleaseSummary<Package extends ReleasePackageInfo = ReleasePack
     published: Package[];
     alreadyPublished: Package[];
     githubReleases: Package[];
+    githubReleaseLinks: Array<{
+        pkg: Package;
+        url: string;
+    }>;
     rerunRequired: boolean;
     noRelease: boolean;
 }
@@ -18,7 +22,10 @@ export interface ReleaseCompletionShell<Package extends ReleasePackageInfo = Rel
     buildReleaseCandidate(packages: Package[]): Promise<void>;
     publishPackage(pkg: Package, distTag: string, dryRun: boolean): Promise<void>;
     listGithubMissingPackages(packages: Package[]): Promise<Package[]>;
-    createGithubRelease(pkg: Package, dryRun: boolean): Promise<void>;
+    createGithubRelease(pkg: Package, dryRun: boolean): Promise<string | null>;
+}
+export interface ReleaseNextShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+    bumpStablePackagesToNext(packages: Package[]): Promise<void>;
 }
 export interface ReleaseRepairShell<Package extends ReleasePackageInfo = ReleasePackageInfo> extends ReleaseCompletionShell<Package> {
     checkout(ref: string): Promise<void>;
@@ -31,7 +38,7 @@ export interface ReleaseVersionShell<Package extends ReleasePackageInfo = Releas
     releaseVersionPackages(bump: string): Promise<Package[]>;
     ensureLocalReleaseTags(packages: Package[]): Promise<void>;
     gitHead(): Promise<string>;
-    runNxReleaseVersion(packages: Package[], bump: string, dryRun: boolean): Promise<void>;
+    runNxReleaseVersion(packages: Package[], bump: string, dryRun: boolean): Promise<Package[]>;
     assertCleanGitTree(): Promise<void>;
 }
 export interface ReleaseVersionResult<Package extends ReleasePackageInfo = ReleasePackageInfo> {
@@ -44,6 +51,7 @@ export declare function runReleaseVersion<Package extends ReleasePackageInfo>(sh
     dryRun: boolean;
 }): Promise<ReleaseVersionResult<Package>>;
 export declare function completeReleaseAtHead<Package extends ReleasePackageInfo>(shell: ReleaseCompletionShell<Package>, packages: Package[], dryRun: boolean, rerunRequired: boolean): Promise<ReleaseSummary<Package>>;
+export declare function bumpStableReleaseToNext<Package extends ReleasePackageInfo>(shell: ReleaseNextShell<Package>, packages: Package[], dryRun: boolean, rerunRequired: boolean): Promise<Package[]>;
 export declare function repairPendingTargets<Package extends ReleasePackageInfo>(shell: ReleaseRepairShell<Package>, targets: Array<ReleaseTarget<Package>>, restoreRef: string, dryRun: boolean): Promise<Array<ReleaseSummary<Package>>>;
 export declare function completeRepairTargetAtHead<Package extends ReleasePackageInfo>(shell: ReleaseCompletionShell<Package>, target: ReleaseTarget<Package>, dryRun: boolean): Promise<ReleaseSummary<Package>>;
 //# sourceMappingURL=orchestration.d.ts.map

package/dist/release/orchestration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestration.d.ts","sourceRoot":"","sources":["../../src/release/orchestration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGnE,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,cAAc,EAAE,OAAO,EAAE,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC7F,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,yBAAyB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,kBAAkB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB,CACzF,SAAQ,sBAAsB,CAAC,OAAO,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,kBAAkB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,qBAAqB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC3F,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,aAAa,GAAG,mBAAmB,CAAC;CACpF;AAED,wBAAsB,iBAAiB,CAAC,OAAO,SAAS,kBAAkB,EACxE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAyCxC;AAED,wBAAsB,qBAAqB,CAAC,OAAO,SAAS,kBAAkB,EAC5E,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAYlC;AAED,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAClC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAmBzC;AAED,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAUlC"}
+{"version":3,"file":"orchestration.d.ts","sourceRoot":"","sources":["../../src/release/orchestration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGnE,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,cAAc,EAAE,OAAO,EAAE,CAAC;IAC1B,kBAAkB,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzD,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC7F,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,yBAAyB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,gBAAgB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACvF,wBAAwB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,kBAAkB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB,CACzF,SAAQ,sBAAsB,CAAC,OAAO,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,kBAAkB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,qBAAqB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC3F,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,aAAa,GAAG,mBAAmB,CAAC;CACpF;AAED,wBAAsB,iBAAiB,CAAC,OAAO,SAAS,kBAAkB,EACxE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAyCxC;AAED,wBAAsB,qBAAqB,CAAC,OAAO,SAAS,kBAAkB,EAC5E,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAYlC;AAED,wBAAsB,uBAAuB,CAAC,OAAO,SAAS,kBAAkB,EAC9E,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAChC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,OAAO,EAAE,CAAC,CAOpB;AAED,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAClC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAuBzC;AAmBD,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAUlC"}