@williamthorsen/release-kit 14.0.0 → 14.2.0

package/.meta/changelog.json

@@ -1,4 +1,177 @@
 [
+  {
+    "version": "14.2.0",
+    "date": "2026-10-12",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Adds an optional `aliases` array to a `repoLabels.labels` entry, which `sync-labels` writes to `.github/labels.yaml` so that the sync renames each existing label named by an alias to the entry's name and keeps it on the issues and pull requests that have it. (#1015)",
+            "hash": "29e43c8066d15d956e60964e616a1bb51c3cd6bd",
+            "entry": 1
+          },
+          {
+            "description": "Makes `release-kit sync-labels` reject a config whose alias names a label that the config resolves or appears twice, because the sync would otherwise merge one declared label into another and delete it. (#1015)",
+            "hash": "29e43c8066d15d956e60964e616a1bb51c3cd6bd",
+            "entry": 2
+          },
+          {
+            "description": "Adds the `confidence:high` (\"Clearly worth doing\"), `confidence:medium` (\"Worth doing, but arguable\"), and `confidence:low` (\"Not worth a ticket now\") labels to the `common` preset of `release-kit sync-labels`, and documents in `docs/labels.md` that the family grades how advisable a recommendation is. (#1019)",
+            "hash": "a92f374228e4a2ccc1f7053b1565cbf081c241b8",
+            "entry": 1
+          },
+          {
+            "description": "Adds a warning to the `release-kit` readyup kit that names each `scope:` label in `.github/labels.yaml` with a non-empty description, archived labels included, because GitHub's label list groups scope labels compactly only when they have no description. (#1022)",
+            "hash": "b24ced5a34b7f3baacbbf2bbe2aca5e0eb08d548",
+            "entry": 1
+          },
+          {
+            "description": "Adds the `releases` block to `.config/release-kit.config.ts`, in which an entry renames a discovered workspace's release target, excludes the workspace with `false`, or declares a composite of named members that the root `package.json` versions, as an alternative to the `workspaces` and `project` blocks, which keep working unchanged. (#1028)",
+            "hash": "6427c9642c3517bc4a0a6c8b8f6ff1012bd0adcf",
+            "entry": 1
+          },
+          {
+            "description": "Lets `release-kit prepare --only` select a `releases` composite by its target name, and makes a narrowed run that leaves the composite out skip it with a warning that names it. (#1028)",
+            "hash": "6427c9642c3517bc4a0a6c8b8f6ff1012bd0adcf",
+            "entry": 2
+          },
+          {
+            "description": "Adds directory release targets to `release-kit`: A `releases` entry whose `path` is not a workspace now declares a target that `prepare` versions from the directory's `package.json` or `version.json`, whose `CHANGELOG.md` `prepare` writes, and whose tags `push` and `create-github-release` handle, while `publish` skips them because a directory does not have any package to publish to npm. (#1029)",
+            "hash": "06d7ada2cd352d9ba9cfbf1cc30195b2273488d9",
+            "entry": 1
+          },
+          {
+            "description": "Adds the repo-root target `{ path: '.' }`, which versions the root `package.json`, tags `v{version}`, and writes every commit in the repo to `./CHANGELOG.md`, replacing a `project` block whose window covered the whole repo only while every workspace was excluded. (#1029)",
+            "hash": "06d7ada2cd352d9ba9cfbf1cc30195b2273488d9",
+            "entry": 2
+          },
+          {
+            "description": "Adds the `changelogMarkdown.keepVersions` config option, which makes `prepare` write only the newest `keepVersions` sections to `CHANGELOG.md`, with links to `changelogs/CHANGELOG-v{major}.md` archive files that contain the older sections, and delete any archive file that is no longer needed after the option is raised or removed. (#1031)",
+            "hash": "0368850a5719d9a9ee21db6a82063adc44b4ea70",
+            "entry": 1
+          },
+          {
+            "description": "Extends `prepare` to read hand-written sections from the `changelogs/` archive files as well as from `CHANGELOG.md`, so that an archived section written by hand is kept when the changelog is regenerated. (#1031)",
+            "hash": "0368850a5719d9a9ee21db6a82063adc44b4ea70",
+            "entry": 2
+          },
+          {
+            "description": "Adds the warning \"published packages ship the changelog archives\" to the release-kit readyup kit, which reports each publishable package whose `files` field omits `changelogs/` while `keepVersions` is set, because the links in `CHANGELOG.md` to the archive files would otherwise be broken in the published package. (#1031)",
+            "hash": "0368850a5719d9a9ee21db6a82063adc44b4ea70",
+            "entry": 3
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Fixes the issue that the `npm-auto-publish` kit crashed without reporting any results in a repo whose `origin` remote is missing or does not point to GitHub, and makes its trusted-publisher and provenance checks name that cause and advise adding the remote. (#1018)",
+            "hash": "7faff3726a51003c80060ba5fd98235338997145",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that `release-kit prepare` accepted two workspaces whose directories share a name, which `--only` and the dependency graph use to identify a workspace, and makes `prepare` and `release-kit overrides validate` stop with an error that lists the path of each. (#1026)",
+            "hash": "7211951adb8e3e7b05a35196096d67bc33890801",
+            "entry": 2
+          },
+          {
+            "description": "Fixes the issue that `release-kit push` never pushed the project tag on HEAD, and failed with `HEAD does not have any release tags.` when the project tag was the only release tag. (#1027)",
+            "hash": "ffab419c87725051d04a1d817fc4be8b7222694b",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that `release-kit create-github-release` did not create a GitHub Release for the project tag; a private workspace's tag is still skipped. (#1027)",
+            "hash": "ffab419c87725051d04a1d817fc4be8b7222694b",
+            "entry": 2
+          },
+          {
+            "description": "Makes `release-kit publish` skip a project tag named by `--tags` with the warning `Skipping v0.13.0: a project tag is not an npm package.`, since the project does not have an npm package to publish. (#1027)",
+            "hash": "ffab419c87725051d04a1d817fc4be8b7222694b",
+            "entry": 3
+          }
+        ]
+      },
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Replaces `releasePrepare`, `releasePrepareMono`, and `releasePrepareProject` with `releasePrepareTargets`, which prepares a release from one list of package and project targets resolved from any config shape. (#1026)",
+            "hash": "7211951adb8e3e7b05a35196096d67bc33890801",
+            "entry": 1
+          }
+        ]
+      },
+      {
+        "title": "📚 Documentation",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Rewrites `docs/api.md` to describe what the `.` and `./config` entries export, and drops its sections on `deriveWorkspaceConfig`, the script-based approach, and `resolveReleaseTags`, none of which the package exports. (#1026)",
+            "hash": "7211951adb8e3e7b05a35196096d67bc33890801",
+            "entry": 3
+          },
+          {
+            "description": "Documents in `docs/project-releases.md` the tag pattern that a scaffolded `create-github-release.yaml` needs in order to trigger on a project tag, because its default `'*-v[0-9]*.[0-9]*.[0-9]*'` filter does not match a `v<version>` tag. (#1027)",
+            "hash": "ffab419c87725051d04a1d817fc4be8b7222694b",
+            "entry": 4
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "14.1.0",
+    "date": "2026-10-11",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Stops `release-kit init` from scaffolding `publish.yaml` and `create-github-release.yaml` when every package is private, even with `--force`, and removes the provenance and trusted-publisher steps from the next steps that it prints. (#995)",
+            "hash": "93355490219535fac282ab2256179094ca920e47",
+            "entry": 1
+          },
+          {
+            "description": "Stops `release-kit update-templates` from re-creating a deleted `publish.yaml` or `create-github-release.yaml` when every package is private, while it still refreshes either workflow that exists. (#995)",
+            "hash": "93355490219535fac282ab2256179094ca920e47",
+            "entry": 2
+          },
+          {
+            "description": "Makes `release-kit prepare` refuse, before it writes any file and in a dry run too, to release a publishable package that npm does not list or that it cannot look up, and prints `npm publish --access public` as the fix for each unlisted package. (#996)",
+            "hash": "7b8b6d67b264af56dff761d0bf987eca8bc2f934",
+            "entry": 1
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Fixes the issue that the `npm-auto-publish` kit's \"published to npm\" check reported a failed lookup, such as an unreachable registry or an authentication error, as an unpublished package and ignored `publishConfig.registry`. (#996)",
+            "hash": "7b8b6d67b264af56dff761d0bf987eca8bc2f934",
+            "entry": 2
+          },
+          {
+            "description": "Fixes the issue that release-kit's changelog generation treated a floating major tag such as `v1` as a release and added a spurious release to the history, by counting a tag only when the rest of its name after the prefix is a complete SemVer version such as `1.0.0` or `1.0.0-beta.1`. (#1000)",
+            "hash": "712e7500109b4bb3db579b60c72e4bf85b308098",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that `release-kit show-tag-prefixes` counted every tag that starts with a workspace's prefix, including floating pointers such as `core-v1` and non-release tags such as `core-vnext`, rather than only the tags that release-kit counts as releases. (#1000)",
+            "hash": "712e7500109b4bb3db579b60c72e4bf85b308098",
+            "entry": 2
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "14.0.0",
     "date": "2026-10-08",

package/.readyup/kits/default.js

@@ -16,6 +16,9 @@ import {
   readFile
 } from "readyup/check-utils";
 
+// src/changelogArchive.ts
+var CHANGELOG_ARCHIVE_DIRECTORY = "changelogs";
+
 // src/init/detectRepoType.ts
 import { existsSync, readFileSync } from "node:fs";
 
@@ -98,7 +101,7 @@ function translateGlob(pattern) {
 
 // .readyup/kits/default.ts
 function getMinVersion() {
-  const picked = { "version": "14.0.0" };
+  const picked = { "version": "14.2.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("release-kit/package.json: 'version' must be a string");
   }
@@ -114,9 +117,9 @@ var CONFIG_EXPORT_PATTERNS = [
   /export\s*\{[^}]*\b(?:config|default)\b[^}]*\}/,
   /export\s*\*/
 ];
-var COMMON_PRESET_HASH = "618bb5cbcbdd4f4f0c2a777add7e14d992d48483350dd9651bf8cf4c1fa9d418";
-var SYNC_LABELS_WORKFLOW_HASH = "6b50015e2919ffa4b16d0b4a1f340e585ff3e5b779a2256010d3c62fa07ff8f2";
-var RELEASE_WORKFLOW_HASH_MONOREPO = "4a20ff3315155500f64a27133c54eb1bc1f07a4acc370ec0d83176109041c60d";
+var COMMON_PRESET_HASH = "1d3e2df1ccd7deea4707fa07a4ae171d761344b65c1a311467fc0f66b70ee646";
+var SYNC_LABELS_WORKFLOW_HASH = "0a88829d154c0de7cdd4246fede99e9311a89ab4199034dbe601663d641ab1e4";
+var RELEASE_WORKFLOW_HASH_MONOREPO = "f63f4cabb57f94ee6550f17a9874c7a346d46554595ddbcd46fdd3208d613437";
 var RELEASE_WORKFLOW_HASH_SINGLE = "d26dd4ca186632b388ea46bd885721124c03d19918e511baa40821d2d760da69";
 var PUBLISH_WORKFLOW_HASH_MONOREPO = "0afa9ffe914f3dc8f043e68252ebc604c8cc1a953422fcea37a909a4def370ee";
 var PUBLISH_WORKFLOW_HASH_SINGLE = "6f31183e0a1e66be791a19266c3b028dadbd9fe010f7fc4452f3f8970c937b43";
@@ -257,6 +260,13 @@ var default_default = defineRdyKit({
                   severity: "warn",
                   check: () => labelsHaveCurrentPresetHash("common", COMMON_PRESET_HASH),
                   fix: "Run `release-kit sync-labels generate` to incorporate updated common labels"
+                },
+                {
+                  name: "scope labels in .github/labels.yaml have no description",
+                  severity: "warn",
+                  quiet: true,
+                  check: () => scopeLabelsHaveNoDescriptions(),
+                  fix: "Remove `description` from these scope labels in the repoLabels block of .config/release-kit.config.ts, so that GitHub groups them compactly, then run `release-kit sync-labels generate`"
                 }
               ]
             }
@@ -272,6 +282,16 @@ var default_default = defineRdyKit({
           check: () => packagesShipChangelog(),
           fix: 'Add "CHANGELOG.md" to the files field of each affected package.json'
         },
+        {
+          name: "published packages ship the changelog archives",
+          severity: "warn",
+          skip: () => {
+            if (!hasPublishablePackages()) return "no publishable packages";
+            return changelogArchivesAreEnabled() ? false : "changelogMarkdown.keepVersions is not set";
+          },
+          check: () => packagesShipChangelogArchives(),
+          fix: 'Add "changelogs/" to the files field of each affected package.json, so that the links from CHANGELOG.md to its archive files resolve in the published package'
+        },
         {
           name: "changelog.json generation is enabled",
           severity: "recommend",
@@ -335,6 +355,11 @@ var default_default = defineRdyKit({
     }
   ]
 });
+function changelogArchivesAreEnabled() {
+  const content = readFile(".config/release-kit.config.ts");
+  if (content === void 0) return false;
+  return /changelogMarkdown\s*:\s*\{[^}]*keepVersions\s*:/.test(content);
+}
 function changelogJsonIsEnabled() {
   const content = readFile(".config/release-kit.config.ts");
   if (content === void 0) return true;
@@ -355,6 +380,9 @@ function labelsHaveCurrentPresetHash(presetName, expectedHash) {
 function packagesShipChangelog() {
   return reportWorkspacesOmitting("CHANGELOG.md");
 }
+function packagesShipChangelogArchives() {
+  return reportWorkspacesOmitting(`${CHANGELOG_ARCHIVE_DIRECTORY}/CHANGELOG-v1.md`, `${CHANGELOG_ARCHIVE_DIRECTORY}/`);
+}
 function packagesShipChangelogJson() {
   return reportWorkspacesOmitting(resolveChangelogJsonOutputPath());
 }
@@ -390,7 +418,7 @@ function releaseNotesInjectsIntoReadme() {
   if (content === void 0) return false;
   return /shouldInjectIntoReadme\s*:\s*true/.test(content);
 }
-function reportWorkspacesOmitting(path) {
+function reportWorkspacesOmitting(path, label = path) {
   const failing = [];
   const packageWorkspaces = discoverWorkspaces({ filter: (w) => w.isPackage });
   for (const { dir, packageJson } of packageWorkspaces) {
@@ -401,7 +429,7 @@ function reportWorkspacesOmitting(path) {
   if (failing.length === 0) return true;
   return {
     ok: false,
-    detail: `files field omits ${path}: ${failing.join(", ")}`
+    detail: `files field omits ${label}: ${failing.join(", ")}`
   };
 }
 function resolveChangelogJsonOutputPath() {
@@ -410,6 +438,32 @@ function resolveChangelogJsonOutputPath() {
   const match = /changelogJson\s*:\s*\{[^}]*outputPath\s*:\s*['"]([^'"]+)['"]/.exec(content);
   return match?.[1] ?? DEFAULT_CHANGELOG_JSON_PATH;
 }
+function scopeLabelsHaveNoDescriptions() {
+  const content = readFile(".github/labels.yaml");
+  if (content === void 0) return true;
+  const described = [];
+  let currentName;
+  for (const line of content.split("\n")) {
+    const nameMatch = /^- name:\s*(.*?)\s*$/.exec(line);
+    if (nameMatch) {
+      currentName = stripYamlQuotes(nameMatch[1] ?? "");
+      continue;
+    }
+    const descriptionMatch = /^\s+description:\s*(.*?)\s*$/.exec(line);
+    if (descriptionMatch && currentName?.startsWith("scope:")) {
+      if (stripYamlQuotes(descriptionMatch[1] ?? "") !== "") described.push(currentName);
+    }
+  }
+  if (described.length === 0) return true;
+  return {
+    ok: false,
+    detail: `scope labels with a description: ${described.join(", ")}`
+  };
+}
+function stripYamlQuotes(value) {
+  const match = /^(['"])(.*)\1$/.exec(value);
+  return match?.[2] ?? value;
+}
 export {
   COMMON_PRESET_HASH,
   CREATE_GITHUB_RELEASE_WORKFLOW_HASH_MONOREPO,
@@ -420,12 +474,15 @@ export {
   RELEASE_WORKFLOW_HASH_MONOREPO,
   RELEASE_WORKFLOW_HASH_SINGLE,
   SYNC_LABELS_WORKFLOW_HASH,
+  changelogArchivesAreEnabled,
   changelogJsonIsEnabled,
   configFileExportsConfig,
   default_default as default,
   packagesShipChangelog,
+  packagesShipChangelogArchives,
   packagesShipChangelogJson,
   readmeHasReleaseNotesMarkers,
   readmesHaveReleaseNotesMarkers,
-  resolveChangelogJsonOutputPath
+  resolveChangelogJsonOutputPath,
+  scopeLabelsHaveNoDescriptions
 };

package/.readyup/kits/npm-auto-publish.js

@@ -13,7 +13,7 @@ import {
   fileContains,
   fileExists,
   getJsonValue,
-  isRecord,
+  isRecord as isRecord2,
   readFile,
   readJsonFile
 } from "readyup/check-utils";
@@ -23,10 +23,16 @@ function hasProvenance(workflowContent) {
   return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
 }
 
-// .readyup/kits/npm-auto-publish.ts
+// src/npmRegistry.ts
+import { execFileSync } from "node:child_process";
+
+// src/typeGuards.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/npmRegistry.ts
 var AUTH_ERROR_CODES = /* @__PURE__ */ new Set(["E401", "ENEEDAUTH"]);
-var OTP_ERROR_CODE = "EOTP";
-var PUBLISH_WORKFLOW_FILE = "publish.yaml";
 var UNREACHABLE_ERROR_CODES = /* @__PURE__ */ new Set([
   "EAI_AGAIN",
   "ECONNREFUSED",
@@ -36,6 +42,55 @@ var UNREACHABLE_ERROR_CODES = /* @__PURE__ */ new Set([
   "ERR_SOCKET_TIMEOUT",
   "ETIMEDOUT"
 ]);
+function classifyNpmPackageLookup(result) {
+  if (result.exitOk) {
+    return { status: "published" };
+  }
+  const error = readNpmError(result.stdout);
+  if (error === void 0) {
+    return { status: "unverifiable", detail: "The npm registry query failed without a readable error payload" };
+  }
+  if (error.code === "E404") {
+    return { status: "unpublished" };
+  }
+  if (AUTH_ERROR_CODES.has(error.code)) {
+    return { status: "unverifiable", detail: `The npm registry rejected the session (${error.code})` };
+  }
+  if (UNREACHABLE_ERROR_CODES.has(error.code)) {
+    return { status: "unverifiable", detail: `Cannot reach the npm registry (${error.code})` };
+  }
+  return { status: "unverifiable", detail: `The npm registry query failed (${error.code}): ${error.summary}` };
+}
+function lookUpNpmPackage(packageName, registry) {
+  const args = ["view", packageName, "version", "--json", ...registry === void 0 ? [] : ["--registry", registry]];
+  return classifyNpmPackageLookup(runNpmJson(args));
+}
+function readNpmError(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return void 0;
+  }
+  if (!isRecord(parsed) || !isRecord(parsed["error"]) || typeof parsed["error"]["code"] !== "string") {
+    return void 0;
+  }
+  const { code, summary } = parsed["error"];
+  return { code, summary: typeof summary === "string" ? summary : "" };
+}
+function runNpmJson(args) {
+  try {
+    return { exitOk: true, stdout: execFileSync("npm", args, { encoding: "utf8", stdio: "pipe" }) };
+  } catch (error) {
+    const stdout = isRecord(error) && typeof error["stdout"] === "string" ? error["stdout"] : "";
+    return { exitOk: false, stdout };
+  }
+}
+
+// .readyup/kits/npm-auto-publish.ts
+var OTP_ERROR_CODE = "EOTP";
+var PUBLISH_WORKFLOW_FILE = "publish.yaml";
+var NO_GITHUB_REMOTE_FIX = "Add an origin remote that points to the GitHub repo, then run this check again";
 var repoChecklist = defineRdyChecklist({
   name: "repo",
   checks: [
@@ -149,7 +204,7 @@ function buildWorkspaceCheck(workspace) {
         const auth = getCachedNpmAuthStatus();
         return auth.status === "unreachable" ? auth.detail : false;
       },
-      check: () => isPublishedToNpm(displayName),
+      check: () => describeNpmPackageLookup(lookUpNpmPackage(displayName, readPublishRegistry(workspace))),
       fix: `Run "npm publish --access public" from ${workspace.dir} to bootstrap the package on npm`,
       checks: [
         {
@@ -158,10 +213,8 @@ function buildWorkspaceCheck(workspace) {
             const capability = getCachedTrustCapability();
             return capability.ok ? false : capability.detail;
           },
-          check: () => checkTrustedPublisher(displayName),
-          get fix() {
-            return `Run: npm trust github ${displayName} --repo ${getCachedOwnerRepo()} --file ${PUBLISH_WORKFLOW_FILE}`;
-          }
+          check: () => describeTrustedPublisher(getTrustQueryResult(displayName), displayName, getCachedOwnerRepo()),
+          fix: formatTrustCommand(displayName, "<owner>/<repo>")
         }
       ]
     },
@@ -182,25 +235,18 @@ function buildWorkspaceCheck(workspace) {
 function checkProvenanceMatchesVisibility() {
   const workflowPath = ".github/workflows/publish.yaml";
   const content = readFile(workflowPath);
+  const ownerRepo = getCachedOwnerRepo();
+  if (!ownerRepo.ok) {
+    return classifyProvenanceSetting(content, ownerRepo);
+  }
   let visibility;
   try {
-    visibility = isRepoPrivate() ? "private" : "public";
+    visibility = isRepoPrivate(ownerRepo.value) ? "private" : "public";
   } catch {
     visibility = "unknown";
   }
   return classifyProvenanceSetting(content, visibility);
 }
-function checkTrustedPublisher(packageName) {
-  const result = getTrustQueryResult(packageName);
-  switch (result.status) {
-    case "configured":
-      return { ok: true };
-    case "not-configured":
-      return { ok: false, detail: "The npm registry does not list any trusted publisher for this package" };
-    default:
-      return { ok: false, detail: result.detail };
-  }
-}
 function classifyNpmAuth(result) {
   if (result.exitOk) {
     return { status: "authenticated" };
@@ -225,6 +271,9 @@ function classifyProvenanceSetting(workflowContent, visibility) {
       fix: "Check the file's permissions"
     };
   }
+  if (typeof visibility !== "string") {
+    return { ok: false, detail: visibility.detail, fix: NO_GITHUB_REMOTE_FIX };
+  }
   if (visibility === "unknown") {
     return {
       ok: false,
@@ -282,14 +331,40 @@ function classifyTrustQuery(result, expectedRepo, expectedFile) {
   if (relationships.length === 0) {
     return { status: "not-configured" };
   }
+  if (!expectedRepo.ok) {
+    return {
+      status: "error",
+      detail: `Cannot compare the trusted publisher with this repo; found ${describeTrustRelationships(relationships)}`
+    };
+  }
   const isMatch = relationships.some(
-    (relationship) => relationship.type === "github" && relationship.repository === expectedRepo && relationship.file === expectedFile
+    (relationship) => relationship.type === "github" && relationship.repository === expectedRepo.value && relationship.file === expectedFile
   );
   return isMatch ? { status: "configured" } : {
     status: "mismatched",
-    detail: `Expected github ${expectedRepo} (${expectedFile}); found ${describeTrustRelationships(relationships)}`
+    detail: `Expected github ${expectedRepo.value} (${expectedFile}); found ${describeTrustRelationships(relationships)}`
+  };
+}
+function describeNpmPackageLookup(lookup) {
+  if (lookup.status === "published") {
+    return { ok: true };
+  }
+  if (lookup.status === "unpublished") {
+    return { ok: false, detail: "The npm registry does not list this package" };
+  }
+  return {
+    ok: false,
+    detail: lookup.detail,
+    fix: "Restore access to the npm registry, then run this check again"
   };
 }
+function describeTrustedPublisher(result, packageName, ownerRepo) {
+  if (result.status === "configured") {
+    return { ok: true };
+  }
+  const detail = result.status === "not-configured" ? "The npm registry does not list any trusted publisher for this package" : result.detail;
+  return ownerRepo.ok ? { ok: false, detail, fix: formatTrustCommand(packageName, ownerRepo.value) } : { ok: false, detail: `${detail}. ${ownerRepo.detail}`, fix: NO_GITHUB_REMOTE_FIX };
+}
 function describeTrustRelationships(relationships) {
   return relationships.map((relationship) => {
     const type = typeof relationship.type === "string" ? relationship.type : "(unknown)";
@@ -298,32 +373,21 @@ function describeTrustRelationships(relationships) {
     return `${type} ${repository} (${file})`;
   }).join(", ");
 }
+function formatTrustCommand(packageName, ownerRepo) {
+  return `Run: npm trust github ${packageName} --repo ${ownerRepo} --file ${PUBLISH_WORKFLOW_FILE}`;
+}
 var getCachedNpmAuthStatus = /* @__PURE__ */ (() => {
   let cached;
-  return () => cached ??= classifyNpmAuth(runNpmJson("npm whoami --json"));
+  return () => cached ??= classifyNpmAuth(runNpmJson(["whoami", "--json"]));
 })();
 var getCachedOwnerRepo = /* @__PURE__ */ (() => {
   let cached;
-  return () => cached ??= getOwnerRepo();
+  return () => cached ??= resolveOwnerRepo();
 })();
 var getCachedTrustCapability = /* @__PURE__ */ (() => {
   let cached;
   return () => cached ??= resolveTrustCapability();
 })();
-function getOwnerRepo() {
-  const url = execSync("git remote get-url origin", {
-    encoding: "utf8"
-  }).trim();
-  const sshMatch = url.match(/git@github\.com:(.+?)(?:\.git)?$/);
-  if (sshMatch?.[1]) {
-    return sshMatch[1];
-  }
-  const httpsMatch = url.match(/github\.com\/(.+?)(?:\.git)?$/);
-  if (httpsMatch?.[1]) {
-    return httpsMatch[1];
-  }
-  throw new Error(`Cannot parse GitHub owner/repo from remote URL: ${url}`);
-}
 var trustQueryResults = /* @__PURE__ */ new Map();
 function getTrustQueryResult(packageName) {
   const cached = trustQueryResults.get(packageName);
@@ -331,7 +395,7 @@ function getTrustQueryResult(packageName) {
     return cached;
   }
   const result = classifyTrustQuery(
-    runNpmJson(`npm trust list ${packageName} --json`),
+    runNpmJson(["trust", "list", packageName, "--json"]),
     getCachedOwnerRepo(),
     PUBLISH_WORKFLOW_FILE
   );
@@ -352,40 +416,24 @@ function hasTokenReferences() {
   }
   return false;
 }
-function isPublishedToNpm(packageName) {
-  try {
-    execSync(`npm view ${packageName} version`, {
-      encoding: "utf8",
-      stdio: "pipe"
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function isRepoPrivate() {
-  const ownerRepo = getOwnerRepo();
+function isRepoPrivate(ownerRepo) {
   const result = execSync(`gh api repos/${ownerRepo} --jq .private`, {
     encoding: "utf8"
   }).trim();
   return result === "true";
 }
+function parseGitHubOwnerRepo(url) {
+  const match = /git@github\.com:(.+?)(?:\.git)?$/.exec(url) ?? /github\.com\/(.+?)(?:\.git)?$/.exec(url);
+  const ownerRepo = match?.[1];
+  return ownerRepo === void 0 ? { ok: false, detail: `The origin remote does not point to GitHub: ${url}` } : { ok: true, value: ownerRepo };
+}
 function probeTrustQuery() {
   const probeName = selectProbeName();
   return probeName === void 0 ? void 0 : getTrustQueryResult(probeName);
 }
-function readNpmError(stdout) {
-  let parsed;
-  try {
-    parsed = JSON.parse(stdout);
-  } catch {
-    return void 0;
-  }
-  if (!isRecord(parsed) || !isRecord(parsed["error"]) || typeof parsed["error"]["code"] !== "string") {
-    return void 0;
-  }
-  const { code, summary } = parsed["error"];
-  return { code, summary: typeof summary === "string" ? summary : "" };
+function readPublishRegistry(workspace) {
+  const registry = getJsonValue(workspace.packageJson, "publishConfig", "registry");
+  return typeof registry === "string" ? registry : void 0;
 }
 function readTrustRelationships(stdout) {
   let parsed;
@@ -395,25 +443,26 @@ function readTrustRelationships(stdout) {
     return void 0;
   }
   if (Array.isArray(parsed)) {
-    return parsed.filter((entry) => isRecord(entry) && "type" in entry);
+    return parsed.filter((entry) => isRecord2(entry) && "type" in entry);
   }
-  if (!isRecord(parsed)) {
+  if (!isRecord2(parsed)) {
     return void 0;
   }
   return "type" in parsed ? [parsed] : [];
 }
+function resolveOwnerRepo() {
+  let url;
+  try {
+    url = execSync("git remote get-url origin", { encoding: "utf8", stdio: "pipe" }).trim();
+  } catch {
+    return { ok: false, detail: "The repo does not have a readable origin remote" };
+  }
+  return parseGitHubOwnerRepo(url);
+}
 function resolveTrustCapability() {
   const auth = getCachedNpmAuthStatus();
   return classifyTrustCapability(auth, auth.status === "authenticated" ? probeTrustQuery() : void 0);
 }
-function runNpmJson(command) {
-  try {
-    return { exitOk: true, stdout: execSync(command, { encoding: "utf8", stdio: "pipe" }) };
-  } catch (error) {
-    const stdout = isRecord(error) && typeof error["stdout"] === "string" ? error["stdout"] : "";
-    return { exitOk: false, stdout };
-  }
-}
 function selectProbeName() {
   return discoverWorkspaces({ filter: (workspace) => workspace.isPackage }).find(
     (workspace) => workspace.name !== void 0
@@ -433,7 +482,10 @@ export {
   classifyTrustCapability,
   classifyTrustQuery,
   npm_auto_publish_default as default,
+  describeNpmPackageLookup,
+  describeTrustedPublisher,
   packagesChecklist,
+  parseGitHubOwnerRepo,
   selectProbeName,
   skipIfNotPublishable,
   skipIfNothingPublishable