The ADO 'pwsh' task runs with $ErrorActionPreference='Stop' and pwsh 7.4+ defaults $PSNativeCommandUseErrorActionPreference to $true, so a non-zero 'npm publish' exit (e.g. version already exists) threw a terminating error before the $LASTEXITCODE inspection, defeating the skip logic. Relax both so the skip check runs.

Replace the inline pwsh publish loop with a shared TypeScript script (publish-npm-packages.ts). A Node child process exposes the npm exit code directly, so the 'already exists' skip logic always runs (the pwsh version could throw before its LASTEXITCODE check). The deployment job now checks out sources and pins Node to run the script.

1ES release jobs forbid 'checkout', so the shared Node script approach cannot run in the publish deployment job. Go back to inline pwsh, but fix the real failure: after a skipped 'npm publish', the non-zero $LASTEXITCODE leaked as the pwsh process exit code and failed the task. Capture the exit code immediately, classify the output, and exit 0 explicitly when there is no genuine error. Also keep the EAP relaxation so npm's non-zero exit does not throw first.

The ADO PowerShell task appends 'exit $LASTEXITCODE' after the inline script (unless ignoreLASTEXITCODE is set). After a skipped 'npm publish' the leftover non-zero code fails the task even though we handled it. Reset $global:LASTEXITCODE explicitly (0 on success/skip, 1 on genuine error) in addition to our own exit, so both the appended line and our exit agree under either invocation scope.

Replace the inline pwsh publish with a shared, self-contained publish-npm-packages.ts run by node. It classifies each package as published/skipped/failed (treating ADO feed immutability and existing-upstream 403s as skippable no-ops), emits Azure DevOps log groups with colored status, prints a summary, and controls its own exit code so there is no leaked pwsh $LASTEXITCODE. 1ES release jobs forbid checkout, so the script is copied into the packages artifact at pack time and the release job downloads the whole artifact and runs it with a NodeTool-pinned Node.