@gjsify/cli 0.15.1 → 0.16.1

package/lib/commands/onboard.js

@@ -0,0 +1,453 @@
+// `gjsify onboard [--dry-run] [--otp <code>] [--registry <url>] [--json] [--yes]`
+//
+// One command that ensures EVERY publishable `@gjsify/*` workspace is both
+// PUBLISHED on npm AND has a Trusted Publisher configured for this repo's
+// `release.yml`. It does the minimum work — publishing/trusting only what's
+// missing — and folds the whole manual bootstrap sequence documented in
+// AGENTS.md ("New @gjsify/* package: first-publish + Trusted Publisher
+// bootstrap") into a single idempotent sweep:
+//
+//   1. Auth gate — `whoami` first. If the token is live, proceed without asking
+//      for credentials; only when it is dead/missing do we run the `gjsify
+//      login` flow (unless `--yes` on a non-TTY, which fails clearly).
+//   2. Enumerate publishable workspaces (non-private, excluding `@girs/*`).
+//   3. Determine each package's state CONCURRENTLY (bounded) by reading npm's
+//      Trusted-Publisher config: unpublished (404) / published-but-untrusted /
+//      published-and-trusted. Reads never prompt for 2FA.
+//   4. Act on the gaps, minimally: build+publish+trust an unpublished package;
+//      trust a published-but-untrusted one; skip an already-done one.
+//   5. Share ONE OTP across every publish + trust operation — the cached code
+//      is tried before prompting, so a whole sweep of N packages typically
+//      needs the user to type an OTP only once (see utils/npm-otp.ts).
+//
+// Re-running when everything is already published + trusted does nothing and
+// exits 0. `--dry-run` reports the plan and changes nothing.
+import { spawn, spawnSync } from 'node:child_process';
+import { DEFAULT_REGISTRY, buildHeaders, registryFor, whoami } from '@gjsify/npm-registry';
+import { discoverWorkspaces, filterWorkspaces } from '@gjsify/workspace';
+import { hasAnyCredential, loadNpmrc } from '../utils/load-npmrc.js';
+import { OtpProvider } from '../utils/npm-otp.js';
+import { publishWorkspace } from './publish.js';
+import { createTrustRequester } from './trust.js';
+import { runLogin, LoginError } from './login.js';
+import { detectPackageManager } from './workspace.js';
+import { findWorkspaceRoot } from '../utils/workspace-root.js';
+import { classifyTrustList, githubTrustBody, normalizeWorkflowFile, parseRepoFromGitRemote, trustUrl, validateRepository, } from '../utils/trust-registry.js';
+export const onboardCommand = {
+    command: 'onboard',
+    description: 'Ensure every publishable @gjsify/* workspace is both published on npm and has a Trusted Publisher configured — publishing/trusting only what is missing, one shared OTP across the whole sweep. Idempotent.',
+    builder: (yargs) => yargs
+        .option('repository', {
+        description: 'GitHub repo as `owner/repo`. Default: inferred from the `origin` git remote.',
+        type: 'string',
+    })
+        .option('workflow', {
+        description: 'Workflow filename allowed to publish via OIDC (basename only).',
+        type: 'string',
+        default: 'release.yml',
+    })
+        .option('environment', {
+        description: 'Optional GitHub Actions environment the workflow must run in.',
+        type: 'string',
+    })
+        .option('registry', {
+        description: `Registry override. Default: scope-aware lookup from .npmrc (falls back to ${DEFAULT_REGISTRY}).`,
+        type: 'string',
+    })
+        .option('otp', {
+        description: 'npm 2FA one-time code, used as the initial shared code. Prompted on demand (once) if omitted and a challenge occurs.',
+        type: 'string',
+    })
+        .option('concurrency', {
+        description: 'How many packages to probe (read state) in parallel.',
+        type: 'number',
+        default: 8,
+    })
+        .option('dry-run', {
+        description: 'Report the plan (what would be published / trusted) without changing anything.',
+        type: 'boolean',
+        default: false,
+    })
+        .option('json', {
+        description: 'Emit a machine-readable summary object as the final line of stdout.',
+        type: 'boolean',
+        default: false,
+    })
+        .option('yes', {
+        description: 'Non-interactive: never prompt. Fail clearly if a login or an OTP is required and not supplied via flags.',
+        type: 'boolean',
+        default: false,
+    }),
+    handler: async (args) => {
+        const cwd = process.cwd();
+        const dryRun = args['dry-run'] === true;
+        const asJson = args.json === true;
+        const nonInteractive = args.yes === true;
+        const log = (msg = '') => {
+            // In --json mode keep stdout clean for the final summary object;
+            // route progress to stderr.
+            if (asJson)
+                process.stderr.write(`${msg}\n`);
+            else
+                process.stdout.write(`${msg}\n`);
+        };
+        let npmrc = await loadNpmrc(cwd);
+        const defaultRegistry = args.registry ?? process.env.npm_config_registry ?? npmrc.registry ?? DEFAULT_REGISTRY;
+        // 1. Auth gate — whoami first; only login when the token is dead/missing.
+        let username;
+        try {
+            username = await ensureAuthenticated({
+                npmrc,
+                registry: defaultRegistry,
+                cwd,
+                nonInteractive,
+                dryRun,
+                otp: args.otp,
+                log,
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (asJson)
+                process.stdout.write(`${JSON.stringify({ ok: false, error: 'auth', message: msg })}\n`);
+            else
+                console.error(msg);
+            process.exit(1);
+            return;
+        }
+        // Login may have written a fresh token — reload so the probes/ops use it.
+        npmrc = await loadNpmrc(cwd);
+        if (username)
+            log(`gjsify onboard: authenticated as ${username}`);
+        // Repository: flag wins, else infer from the origin remote.
+        let repository = args.repository;
+        if (!repository) {
+            const r = spawnSync('git', ['remote', 'get-url', 'origin'], { cwd, encoding: 'utf8' });
+            if (r.status === 0)
+                repository = parseRepoFromGitRemote(r.stdout) ?? undefined;
+        }
+        if (!repository || !validateRepository(repository)) {
+            const msg = 'gjsify onboard: could not determine the GitHub repository — pass --repository owner/repo.';
+            if (asJson)
+                process.stdout.write(`${JSON.stringify({ ok: false, error: 'repository', message: msg })}\n`);
+            else
+                console.error(msg);
+            process.exit(1);
+            return;
+        }
+        const workflow = normalizeWorkflowFile(args.workflow);
+        const environment = args.environment;
+        // 2. Enumerate publishable workspaces (non-private, exclude @girs/*).
+        const root = findWorkspaceRoot(cwd) ?? cwd;
+        const all = discoverWorkspaces(root, { includeRoot: true });
+        const selected = filterWorkspaces(all, { noPrivate: true, exclude: ['@girs/*'] }).filter((ws) => ws.name);
+        if (selected.length === 0) {
+            const msg = 'gjsify onboard: no publishable workspace packages found.';
+            if (asJson)
+                process.stdout.write(`${JSON.stringify({ ok: false, error: 'no-packages', message: msg })}\n`);
+            else
+                console.error(msg);
+            process.exit(1);
+            return;
+        }
+        log(`gjsify onboard: ${selected.length} package(s) | repo=${repository} workflow=${workflow}`);
+        if (dryRun)
+            log('(dry-run — nothing will be published or configured)');
+        log();
+        // 3. Determine per-package state CONCURRENTLY. Reads use a plain
+        // authenticated GET (no OTP prompting — a 401 becomes `auth-required`).
+        const plans = await mapWithConcurrency(selected, Math.max(1, args.concurrency), (ws) => probeTrustState(ws, {
+            registryOverride: args.registry,
+            npmrc,
+            repository,
+            workflow,
+        }));
+        // Summary table (published✓ / trusted✓ vs work to do).
+        const toPublish = plans.filter((p) => p.action === 'publish-and-trust');
+        const toTrust = plans.filter((p) => p.action === 'trust');
+        const done = plans.filter((p) => p.action === 'skip');
+        const blocked = plans.filter((p) => p.action === 'blocked');
+        for (const p of plans)
+            log(`  ${statusCell(p)}  ${p.ws.name}`);
+        log();
+        log(`Plan: ${done.length} already done, ${toPublish.length} to publish+trust, ${toTrust.length} to trust, ${blocked.length} unreadable.`);
+        const results = [];
+        if (dryRun) {
+            for (const p of plans) {
+                results.push({
+                    name: p.ws.name,
+                    result: p.action === 'skip' ? 'already-done' : p.action === 'blocked' ? 'failed' : 'skipped-dry-run',
+                    detail: p.action === 'publish-and-trust'
+                        ? 'would publish + trust'
+                        : p.action === 'trust'
+                            ? 'would trust'
+                            : undefined,
+                });
+            }
+            finish(results, plans, { asJson, dryRun });
+            return;
+        }
+        // 4. Act on the gaps, minimally. Publishes + trust POSTs run SERIALLY so
+        // the shared OTP is prompted at most once (and reused everywhere).
+        const otpProvider = new OtpProvider(args.otp, nonInteractive ? async () => '' : undefined);
+        const trustRequest = createTrustRequester({ npmrc, otpProvider });
+        const trustBody = githubTrustBody({ repository, workflow, environment });
+        let failed = 0;
+        for (const p of plans) {
+            if (p.action === 'skip') {
+                results.push({ name: p.ws.name, result: 'already-done' });
+                continue;
+            }
+            if (p.action === 'blocked') {
+                log(`→ ${p.ws.name}: cannot read trust state (HTTP ${p.httpStatus}) — skipped`);
+                results.push({ name: p.ws.name, result: 'failed', detail: `state HTTP ${p.httpStatus}` });
+                failed++;
+                continue;
+            }
+            let publishedNow = false;
+            if (p.action === 'publish-and-trust') {
+                log(`→ ${p.ws.name}: building + publishing…`);
+                try {
+                    await buildIfPresent(p.ws, log);
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    log(`  build failed: ${msg}`);
+                    results.push({ name: p.ws.name, result: 'failed', detail: `build: ${msg}` });
+                    failed++;
+                    continue;
+                }
+                const pub = await publishWorkspace({
+                    wsDir: p.ws.location,
+                    tag: 'latest',
+                    access: 'public',
+                    provenance: false,
+                    tolerate: true, // a concurrent/racey publish is harmless
+                    tolerateUntrustedNew: false,
+                    trustedFlag: undefined,
+                    registry: p.registry,
+                    verbose: false,
+                    json: false,
+                    otpProvider,
+                    seedOtpFirst: false,
+                });
+                if (!pub.ok) {
+                    const detail = describePublishFailure(pub);
+                    log(`  publish failed: ${detail}`);
+                    results.push({ name: p.ws.name, result: 'failed', detail: `publish: ${detail}` });
+                    failed++;
+                    continue;
+                }
+                publishedNow = pub.action !== 'skipped-untrusted-new';
+                log(`  published ${pub.name}@${'version' in pub ? pub.version : ''}`);
+            }
+            // Configure the Trusted Publisher.
+            const created = await trustRequest('POST', p.url, trustBody);
+            if (created.status >= 200 && created.status < 300) {
+                log(`  trusted ${p.ws.name}`);
+                results.push({
+                    name: p.ws.name,
+                    result: publishedNow ? 'published+trusted' : 'trusted',
+                });
+            }
+            else if (created.status === 409) {
+                results.push({ name: p.ws.name, result: publishedNow ? 'published+trusted' : 'trusted' });
+            }
+            else if (created.status === 404) {
+                // Freshly-published package not yet provisioned for trust config.
+                log(`  ${p.ws.name}: published but not yet trust-configurable (re-run onboard)`);
+                results.push({
+                    name: p.ws.name,
+                    result: publishedNow ? 'published' : 'failed',
+                    detail: 'trust config deferred (404)',
+                });
+                if (!publishedNow)
+                    failed++;
+            }
+            else {
+                log(`  trust failed (HTTP ${created.status})`);
+                results.push({
+                    name: p.ws.name,
+                    result: 'failed',
+                    detail: `trust HTTP ${created.status}`,
+                });
+                failed++;
+            }
+        }
+        finish(results, plans, { asJson, dryRun, failed });
+    },
+};
+/** Print the summary + exit with the right code. */
+function finish(results, plans, opts) {
+    const failed = opts.failed ?? 0;
+    if (opts.asJson) {
+        process.stdout.write(`${JSON.stringify({
+            ok: failed === 0,
+            dryRun: opts.dryRun,
+            total: plans.length,
+            published: results.filter((r) => r.result === 'published' || r.result === 'published+trusted')
+                .length,
+            trusted: results.filter((r) => r.result === 'trusted' || r.result === 'published+trusted').length,
+            alreadyDone: results.filter((r) => r.result === 'already-done').length,
+            failed,
+            results,
+        }, null, 2)}\n`);
+    }
+    else {
+        const line = opts.dryRun
+            ? 'Dry-run complete — nothing changed.'
+            : `Done: ${results.filter((r) => r.result.includes('published')).length} published, ` +
+                `${results.filter((r) => r.result === 'trusted' || r.result === 'published+trusted').length} trusted, ` +
+                `${results.filter((r) => r.result === 'already-done').length} already done, ${failed} failed.`;
+        process.stdout.write(`\n${line}\n`);
+    }
+    process.exit(failed > 0 ? 1 : 0);
+}
+/** A compact per-package status cell for the summary table. */
+function statusCell(p) {
+    switch (p.action) {
+        case 'skip':
+            return 'published✓ trusted✓';
+        case 'trust':
+            return 'published✓ trust…  ';
+        case 'publish-and-trust':
+            return 'publish…   trust… ';
+        case 'blocked':
+            return `unreadable (${p.httpStatus})`;
+    }
+}
+/**
+ * Run the whoami liveness check, and only run the login flow when the token is
+ * dead/missing. Returns the authenticated username. Throws on a non-interactive
+ * gate that would need input.
+ */
+async function ensureAuthenticated(ctx) {
+    const { npmrc, registry, cwd, nonInteractive, dryRun, otp, log } = ctx;
+    // A live token short-circuits — no credential prompt.
+    if (hasAnyCredential(npmrc)) {
+        try {
+            const who = await whoami(registry, npmrc);
+            if (who.username)
+                return who.username;
+        }
+        catch {
+            /* fall through to the login path */
+        }
+    }
+    // Token dead or missing.
+    if (dryRun) {
+        log('gjsify onboard: no live npm token — dry-run continues (state reads may be limited).');
+        return undefined;
+    }
+    if (nonInteractive) {
+        throw new Error('gjsify onboard: not authenticated and --yes was passed — run `gjsify login` first (or omit --yes to log in interactively).');
+    }
+    log('gjsify onboard: no live npm token — logging in…');
+    try {
+        const res = await runLogin({ registry, otp, cwd });
+        return res.username;
+    }
+    catch (err) {
+        if (err instanceof LoginError)
+            throw new Error(err.message);
+        throw err;
+    }
+}
+/**
+ * Read a package's current published + trust state via a plain authenticated
+ * GET on its trust config (no OTP prompting). 404 → unpublished; a matching
+ * github entry → trusted; otherwise → published-but-untrusted.
+ */
+async function probeTrustState(ws, ctx) {
+    const registry = ctx.registryOverride ?? registryFor(ws.name, ctx.npmrc) ?? DEFAULT_REGISTRY;
+    const url = trustUrl(registry, ws.name);
+    let state = 'error';
+    let httpStatus = 0;
+    try {
+        const headers = buildHeaders(url, { npmrc: ctx.npmrc });
+        headers['accept'] = 'application/json';
+        const res = await fetch(url, { method: 'GET', headers });
+        httpStatus = res.status;
+        const text = await res.text().catch(() => '');
+        let json = undefined;
+        try {
+            json = text ? JSON.parse(text) : undefined;
+        }
+        catch {
+            /* non-JSON body */
+        }
+        state = classifyTrustList(res.status, json, { repository: ctx.repository, workflow: ctx.workflow });
+    }
+    catch {
+        state = 'error';
+    }
+    let action;
+    switch (state) {
+        case 'trusted':
+            action = 'skip';
+            break;
+        case 'untrusted':
+            action = 'trust';
+            break;
+        case 'unpublished':
+            action = 'publish-and-trust';
+            break;
+        default:
+            action = 'blocked'; // auth-required / error — can't determine
+    }
+    return { ws, registry, url, state, httpStatus, action };
+}
+/** Run the package's `build` script (if it declares one) before publishing. */
+async function buildIfPresent(ws, log) {
+    const scripts = ws.manifest.scripts ?? {};
+    if (typeof scripts.build !== 'string')
+        return; // nothing to build
+    const pm = detectPackageManager();
+    const argv = ['run', 'build'];
+    log(`  $ ${pm} ${argv.join(' ')}`);
+    await new Promise((resolve, reject) => {
+        const child = spawn(pm, argv, {
+            cwd: ws.location,
+            stdio: 'inherit',
+            env: { ...process.env },
+        });
+        child.on('close', (code) => {
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`build exited with code ${code}`));
+        });
+        child.on('error', reject);
+    });
+}
+/** Human-readable reason for a failed publish outcome. */
+function describePublishFailure(pub) {
+    switch (pub.action) {
+        case 'otp-required':
+            return 'npm required a 2FA code (re-run with --otp, or on a TTY)';
+        case 'oidc-failed':
+        case 'oidc-no-token':
+            return 'OIDC/token auth failed';
+        case 'diagnostic':
+            return `HTTP 404 (${pub.diag.reason})`;
+        case 'error':
+            return `HTTP ${pub.status} ${pub.statusText}`;
+        default:
+            return 'unknown';
+    }
+}
+/** Map with bounded concurrency, preserving input order in the result. */
+async function mapWithConcurrency(items, limit, fn) {
+    const results = Array.from({ length: items.length });
+    let next = 0;
+    const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+        while (true) {
+            const i = next++;
+            if (i >= items.length)
+                return;
+            results[i] = await fn(items[i]);
+        }
+    });
+    await Promise.all(workers);
+    return results;
+}

package/lib/commands/pack.js

@@ -172,8 +172,18 @@ export async function packWorkspace(wsDir, opts = {}) {
  * Walk the workspace and return the list of files to include in the tarball,
  * relative to `wsDir`. Mirrors npm pack's selection rules:
  *
- *   - If pkg.files exists: use it as an allowlist (with .npmignore as a
- *     blacklist within those globs)
+ *   - If pkg.files exists: the array is an ALLOWLIST that overrides
+ *     .gitignore / .npmignore entirely. Every file under an allowlisted
+ *     path/dir ships from disk; only the hardcoded implicit-exclusion set
+ *     (node_modules, .git, lockfiles, … — applied by `walkAll` /
+ *     `expandFilesPatterns`) and npm's always-ignore names are dropped.
+ *     This matches `npm pack`: a `files` entry re-includes a path even when
+ *     .gitignore/.npmignore would drop it (verified against `npm pack
+ *     --dry-run`). Trimming `files`-allowlisted content by .gitignore
+ *     silently dropped build-generated-but-allowlisted files like
+ *     adwaita-web's `src/styles.generated.ts` (gitignored, allowlisted via
+ *     `files: ["src"]`) — shipping a broken tarball whose `src/index.ts`
+ *     imported a file the tarball didn't contain.
  *   - Otherwise: walk everything, apply .npmignore + .gitignore, drop the
  *     implicit-exclusion set (node_modules, .git, …)
  *
@@ -185,18 +195,22 @@ function collectFiles(wsDir, pkg) {
     const filesField = Array.isArray(pkg.files)
         ? pkg.files.filter((f) => typeof f === 'string')
         : null;
-    let candidates;
+    const out = new Set();
     if (filesField) {
-        candidates = expandFilesPatterns(wsDir, filesField);
+        // A `files` allowlist overrides .gitignore/.npmignore — ship every
+        // allowlisted path from disk. `expandFilesPatterns` already excludes
+        // the NEVER_INCLUDED_BASENAMES set (node_modules, .git, lockfiles, …)
+        // via `walkAll`, so junk is still kept out.
+        for (const f of expandFilesPatterns(wsDir, filesField))
+            out.add(f);
     }
     else {
-        candidates = walkAll(wsDir);
-    }
-    const ignore = loadIgnore(wsDir);
-    const out = new Set();
-    for (const f of candidates) {
-        if (!ignore(f))
-            out.add(f);
+        // No `files` field — walk everything and apply .npmignore/.gitignore.
+        const ignore = loadIgnore(wsDir);
+        for (const f of walkAll(wsDir)) {
+            if (!ignore(f))
+                out.add(f);
+        }
     }
     for (const f of always) {
         if (existsSync(join(wsDir, f)))

package/lib/commands/publish.d.ts

@@ -1,4 +1,6 @@
 import type { Command } from '../types/index.js';
+import { type Diagnose404Result } from '../utils/publish-diagnose.js';
+import { OtpProvider } from '../utils/npm-otp.js';
 interface PublishOptions {
     path?: string;
     tag?: string;
@@ -13,4 +15,94 @@ interface PublishOptions {
     'check-trusted'?: boolean;
 }
 export declare const publishCommand: Command<unknown, PublishOptions>;
+/** Input to {@link publishWorkspace} — the token-auth-aware, OTP-shareable publish flow. */
+export interface PublishWorkspaceInput {
+    /** Workspace directory to pack + publish. */
+    wsDir: string;
+    tag: string;
+    access?: string;
+    provenance: boolean;
+    /** Treat "already published" as success. */
+    tolerate: boolean;
+    /** Skip an un-bootstrapped new package on the OIDC path. */
+    tolerateUntrustedNew: boolean;
+    /** `--trusted` (force OIDC) / `undefined` | `'auto'` (auto-detect). */
+    trustedFlag: boolean | 'auto' | undefined;
+    /** Registry override. Default: `$npm_config_registry` → scope-aware npmrc → npmjs. */
+    registry?: string;
+    verbose: boolean;
+    /** Redirect lifecycle-script stdout → stderr so `--json` stdout stays clean. */
+    json: boolean;
+    /** Shared OTP provider — inject ONE across many packages to reuse a single code. */
+    otpProvider: OtpProvider;
+    /** Send the cached code on the first PUT (publish `--otp`). */
+    seedOtpFirst: boolean;
+}
+/** Discriminated result of {@link publishWorkspace}; the caller owns presentation. */
+export type PublishOutcome = {
+    ok: true;
+    action: 'published';
+    name: string;
+    version: string;
+    filename: string;
+    size: number;
+    integrity: string;
+    tag: string;
+    registry: string;
+} | {
+    ok: true;
+    action: 'republish-tolerated';
+    name: string;
+    version: string;
+    status: number;
+} | {
+    ok: true;
+    action: 'skipped-untrusted-new';
+    name: string;
+    version: string;
+} | {
+    ok: false;
+    action: 'otp-required';
+    name: string;
+    version: string;
+    status: number;
+} | {
+    ok: false;
+    action: 'oidc-failed';
+    name: string;
+    version: string;
+    error: unknown;
+} | {
+    ok: false;
+    action: 'oidc-no-token';
+    name: string;
+    version: string;
+    error: unknown;
+} | {
+    ok: false;
+    action: 'diagnostic';
+    name: string;
+    version: string;
+    status: number;
+    diag: Diagnose404Result;
+} | {
+    ok: false;
+    action: 'error';
+    name: string;
+    version: string;
+    status: number;
+    statusText: string;
+    text: string;
+};
+/**
+ * Pack + PUT a single workspace to its npm registry, returning a structured
+ * outcome instead of writing/exiting. Extracted from the `publish` command so
+ * `gjsify onboard` can drive the SAME publish flow while sharing one
+ * {@link OtpProvider} across every package in a sweep.
+ *
+ * The OTP dance runs through `withOtpRetry(provider)`: the cached code is tried
+ * before prompting, so a shared provider needs only one interactive entry for N
+ * packages.
+ */
+export declare function publishWorkspace(input: PublishWorkspaceInput): Promise<PublishOutcome>;
 export {};