From 85fbaffc671c205223dd82d398c7b9c8b31f12f2 Mon Sep 17 00:00:00 2001
From: Lakshman Turlapati <lakshmantvnm@gmail.com>
Date: Sun, 16 Aug 2026 20:52:27 -0500
Subject: [PATCH] fix: include sanitized npm publish output in release failures

Trusted-publisher mismatches currently collapse to PUBLISH_AMBIGUOUS
with no registry reason, which blocks diagnosing a failed 0.2.1 publish.
---
 .github/workflows/release.yml | 2 +-
 scripts/release/publisher.mjs | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5fe45e8..624efd6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -289,7 +289,7 @@ jobs:
 
           const pinned = {
             "config.mjs": "f6ecee16c34c1cf27b6f2eeee3701314c2b4324db152791111cecc6ab51299a7",
-            "release-publisher.mjs": "ae010272f10e604380b8bf6f8e4cc9379112fa78a774f3360f35010826f08a9f",
+            "release-publisher.mjs": "a6757a8a8c5f4ef67ab6318e8f492844c6b100bf0f12051a6fd1d5b9bd9f0636",
             "release-line.json": "06706bfef1b06028d3066a6e4b938df9ecfbaa196ea0bafba5ae39f1a32d3da0",
           };
           const expected = ["release-seal.json"];
diff --git a/scripts/release/publisher.mjs b/scripts/release/publisher.mjs
index b943234..bf8d255 100644
--- a/scripts/release/publisher.mjs
+++ b/scripts/release/publisher.mjs
@@ -595,8 +595,12 @@ async function publish(configuredDirectory) {
       const result = registry.publish(archive);
       assertInputsUnchanged(inputs);
       if (!successful(result)) {
+        const detail = String(result.output ?? "")
+          .replace(/(token|authorization|bearer|otp)[=:\s]+\S+/giu, "$1=[redacted]")
+          .trim()
+          .slice(-1500);
         throw new Error(
-          `[PUBLISH_AMBIGUOUS] ${archive.name}@${archive.version} publish returned an error; rerun this exact sealed release to determine registry state`,
+          `[PUBLISH_AMBIGUOUS] ${archive.name}@${archive.version} publish returned an error (status ${String(result.status)}); rerun this exact sealed release to determine registry state${detail ? `: ${detail}` : ""}`,
         );
       }
       await validateAfterPublish(archive, registry, inputs);