X_REGISTRY_BOOTSTRAP_OWED
Means
a publishable workspace is absent from the registry — its packument answers 404
Typical cause
a package added after a release run: no run has ever seen it, so trusted publishing has nothing to bootstrap from. The finding names its ordinal in the derived publish order and how many packages a release publishes irreversibly before dying on this one. @ultimat3/flags was this until 2.0.0; @ultimat3/scraping until 2026-08-19
Fix
npm publish -w <pkg> --access public --provenance=false (PUBLISHING.md step 1), then bun run scripts/trust-publishers.ts