From 76a811e22f2a4f869e961e21df38f92ab30c5459 Mon Sep 17 00:00:00 2001
From: Theo Browne <6751787+t3dotgg@users.noreply.github.com>
Date: Tue, 6 Oct 2026 22:31:56 -0700
Subject: [PATCH 1/2] fix(release): trust-setup.sh --relink for the recreated
 repo

npm binds a trust to the repo's GitHub ID at its first publish, and the
repo was recreated in the history cleanup. --relink revokes each
package's trusts before it creates the new ones.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 npm/README.md      |  4 ++++
 npm/trust-setup.sh | 17 +++++++++++++++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/npm/README.md b/npm/README.md
index 1cf765c28..4efbca0e8 100644
--- a/npm/README.md
+++ b/npm/README.md
@@ -102,6 +102,10 @@ collides with a placeholder. npm drops a new trust that publishes nothing in 2 d
 shortly before the first tag. Add required reviewers to the `npm` environment (repo settings,
 Environments) to approve each publish by hand.
 
+The first publish binds each trust to the repo's GitHub ID, not only its name. The repo was
+recreated on 2026-10-07 (history cleanup), so before the next release run
+`npm/trust-setup.sh --relink`: it revokes the old trusts and creates new ones for the new repo.
+
 While the repo is private, npm publishes with no provenance. From a public repo it adds
 provenance by itself.
 
diff --git a/npm/trust-setup.sh b/npm/trust-setup.sh
index ce3a65c68..a9af08317 100755
--- a/npm/trust-setup.sh
+++ b/npm/trust-setup.sh
@@ -10,10 +10,14 @@
 #      publish it. When the package already trusts something else, it stops and prints the
 #      revoke command (it does not revoke by itself).
 # npm drops a new trust that publishes nothing in 2 days. So run this shortly before the first tag.
+# The first publish binds a trust to the repo's GitHub ID, not only its name. After the repo is
+# recreated (as on 2026-10-07), run it with --relink: it revokes every trust of each package first.
 #
-# usage: npm/trust-setup.sh          needs npm 11.15.0 or later (npm trust)
+# usage: npm/trust-setup.sh [--relink]    needs npm 11.15.0 or later (npm trust)
 set -euo pipefail
-[[ ${1:-} != help ]] || { sed -n '2,14p' "$0" >&2; exit 2; }
+[[ ${1:-} != help ]] || { sed -n '2,16p' "$0" >&2; exit 2; }
+relink=0
+[[ ${1:-} != --relink ]] || relink=1
 repo=pingdotgg/ts-rust
 packages=(tsc-rs @tsc-rs/linux-x64 @tsc-rs/darwin-arm64)
 
@@ -43,6 +47,15 @@ EOF
 done
 
 for name in "${packages[@]}"; do
+  if ((relink)); then
+    for id in $(npm trust list "$name" --json | node -e '
+      const text = require("fs").readFileSync(0, "utf8").trim();
+      for (const t of text ? JSON.parse(`[${text.replace(/}\s*{/g, "},{")}]`) : []) console.log(t.id);
+    '); do
+      npm trust revoke "$name" --id="$id"
+      sleep 2
+    done
+  fi
   # `npm trust list --json` prints one JSON object per trust (npm/cli lib/trust-cmd.js
   # logOptions): id, type, file, repository, environment and permissions. createPackage is
   # --allow-publish.

From ef5f9e36b979349d59850ecb80f3ca929be5a52a Mon Sep 17 00:00:00 2001
From: Theo Browne <6751787+t3dotgg@users.noreply.github.com>
Date: Tue, 6 Oct 2026 23:40:27 -0700
Subject: [PATCH 2/2] fix(release): trust-setup.sh --relink stops when the
 trust list fails

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 npm/trust-setup.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/npm/trust-setup.sh b/npm/trust-setup.sh
index a9af08317..e562357c1 100755
--- a/npm/trust-setup.sh
+++ b/npm/trust-setup.sh
@@ -48,10 +48,12 @@ done
 
 for name in "${packages[@]}"; do
   if ((relink)); then
-    for id in $(npm trust list "$name" --json | node -e '
+    # An assignment, not `for id in $(...)`: set -e stops the script when the list or the parse fails.
+    ids=$(npm trust list "$name" --json | node -e '
       const text = require("fs").readFileSync(0, "utf8").trim();
       for (const t of text ? JSON.parse(`[${text.replace(/}\s*{/g, "},{")}]`) : []) console.log(t.id);
-    '); do
+    ')
+    for id in $ids; do
       npm trust revoke "$name" --id="$id"
       sleep 2
     done