@gjsify/cli 0.19.0 → 0.21.0

package/lib/commands/login.js

@@ -22,6 +22,7 @@ import { DEFAULT_REGISTRY, registryFor, whoami } from '@gjsify/npm-registry';
 import { loadNpmrc } from '../utils/load-npmrc.js';
 import { writeAuthToken } from '../utils/auth-npmrc.js';
 import { promptCredentials, promptLine } from '../utils/prompt.js';
+import { clearCachedOtp, readCachedOtp, writeCachedOtp } from '../utils/npm-otp-cache.js';
 /** Thrown by {@link runLogin} on any recoverable login failure (bad creds, no token, …). */
 export class LoginError extends Error {
     constructor(message) {
@@ -117,19 +118,26 @@ export async function runLogin(opts) {
     async function putUser(path, otp) {
         return fetch(`${couchUrl}${path}`, { method: 'PUT', headers: authHeaders(otp), body: JSON.stringify(body) });
     }
-    let otp = opts.otp;
+    // Seed the OTP from --otp, else the short-lived cross-invocation cache (a
+    // sibling `gjsify` command's still-valid code in the ~30 s window).
+    const otpFromFlag = typeof opts.otp === 'string' && opts.otp.length > 0;
+    let otp = opts.otp ?? readCachedOtp(registryClean);
     let res = await putUser('', otp);
     // 2FA: 401 + www-authenticate "otp" (or a one-time-pass body) → prompt + retry.
-    if (res.status === 401 && !otp) {
+    // Re-prompt when the code was missing OR a stale CACHED code (not an
+    // explicitly-passed --otp, which the caller owns) was rejected.
+    if (res.status === 401 && !otpFromFlag) {
         const wwwAuth = (res.headers.get('www-authenticate') ?? '').toLowerCase();
         const text = await res
             .clone()
             .text()
             .catch(() => '');
         if (wwwAuth.includes('otp') || /one-time pass/i.test(text)) {
+            clearCachedOtp(registryClean); // the seeded/cached code was stale or absent
             otp = await promptLine(`This operation requires a one-time password.\nEnter OTP: `);
             if (!otp)
                 throw new LoginError('gjsify login: no OTP entered.');
+            writeCachedOtp(registryClean, otp);
             res = await putUser('', otp);
         }
     }
@@ -160,6 +168,11 @@ export async function runLogin(opts) {
             `Your registry may require the web-OAuth flow — use \`npm login\`.`);
     }
     const npmrcPath = writeAuthToken(registryClean, data.token);
+    // Login succeeded with an OTP → keep it in the short-lived cache (refresh
+    // its TTL) so the immediately-following `onboard`/`publish`/`trust` reuses
+    // the one typed code instead of prompting again.
+    if (otp)
+        writeCachedOtp(registryClean, otp);
     // Confirm the freshly-written token authenticates.
     const verifyNpmrc = await loadNpmrc(opts.cwd ?? process.cwd());
     const who = await whoami(registryClean, verifyNpmrc);

package/lib/commands/logout.js

@@ -10,6 +10,7 @@
 import { DEFAULT_REGISTRY, registryFor, resolveAuthForUrl } from '@gjsify/npm-registry';
 import { loadNpmrc } from '../utils/load-npmrc.js';
 import { removeAuthToken } from '../utils/auth-npmrc.js';
+import { clearCachedOtp } from '../utils/npm-otp-cache.js';
 export const logoutCommand = {
     command: 'logout',
     description: 'Log out of an npm registry (Node-free `npm logout`). Revokes the token on the registry (best-effort) and removes it from ~/.npmrc.',
@@ -49,6 +50,9 @@ export const logoutCommand = {
                 /* offline / registry down — fall through to local removal */
             }
         }
+        // Drop any short-lived cached OTP for this registry — the token it would
+        // have accompanied is now revoked.
+        clearCachedOtp(registryClean);
         const { path, removed } = removeAuthToken(registryClean);
         if (args.json) {
             process.stdout.write(`${JSON.stringify({ registry: registryClean, revoked, removed })}\n`);

package/lib/commands/onboard.js

@@ -11,19 +11,21 @@
 //      for credentials; only when it is dead/missing do we run the `gjsify
 //      login` flow (unless `--yes` on a non-TTY, which fails clearly).
 //   2. Enumerate publishable workspaces (non-private, excluding `@girs/*`).
-//   3. Determine each package's state CONCURRENTLY (bounded) by reading npm's
-//      Trusted-Publisher config: unpublished (404) / published-but-untrusted /
-//      published-and-trusted. Reads never prompt for 2FA.
+//   3. Determine each package's state (bounded concurrency) by reading npm's
+//      Trusted-Publisher config through the SAME requester path `gjsify trust`
+//      uses: unpublished (404) / published-but-untrusted / published-and-trusted.
+//      A 2FA-gated read is answered with the shared OTP (the first read is
+//      serial so the prompt happens once); a transient 401 is retried once.
 //   4. Act on the gaps, minimally: build+publish+trust an unpublished package;
 //      trust a published-but-untrusted one; skip an already-done one.
-//   5. Share ONE OTP across every publish + trust operation — the cached code
-//      is tried before prompting, so a whole sweep of N packages typically
+//   5. Share ONE OTP across every read + publish + trust operation — the cached
+//      code is tried before prompting, so a whole sweep of N packages typically
 //      needs the user to type an OTP only once (see utils/npm-otp.ts).
 //
 // Re-running when everything is already published + trusted does nothing and
 // exits 0. `--dry-run` reports the plan and changes nothing.
 import { spawn, spawnSync } from 'node:child_process';
-import { DEFAULT_REGISTRY, buildHeaders, registryFor, whoami } from '@gjsify/npm-registry';
+import { DEFAULT_REGISTRY, whoami } from '@gjsify/npm-registry';
 import { discoverWorkspaces, filterWorkspaces } from '@gjsify/workspace';
 import { hasAnyCredential, loadNpmrc } from '../utils/load-npmrc.js';
 import { OtpProvider } from '../utils/npm-otp.js';
@@ -32,7 +34,8 @@ import { createTrustRequester } from './trust.js';
 import { runLogin, LoginError } from './login.js';
 import { detectPackageManager } from './workspace.js';
 import { findWorkspaceRoot } from '../utils/workspace-root.js';
-import { classifyTrustList, githubTrustBody, normalizeWorkflowFile, parseRepoFromGitRemote, trustUrl, validateRepository, } from '../utils/trust-registry.js';
+import { githubTrustBody, normalizeWorkflowFile, parseRepoFromGitRemote, validateRepository, } from '../utils/trust-registry.js';
+import { DEFAULT_PROBE_CONCURRENCY, probeAllTrustStates } from '../utils/onboard-probe.js';
 export const onboardCommand = {
     command: 'onboard',
     description: 'Ensure every publishable @gjsify/* workspace is both published on npm and has a Trusted Publisher configured — publishing/trusting only what is missing, one shared OTP across the whole sweep. Idempotent.',
@@ -59,9 +62,9 @@ export const onboardCommand = {
         type: 'string',
     })
         .option('concurrency', {
-        description: 'How many packages to probe (read state) in parallel.',
+        description: 'How many packages to probe (read state) in parallel (kept small so a single token does not burst npm; the first read is always serial to prompt for the shared OTP once).',
         type: 'number',
-        default: 8,
+        default: DEFAULT_PROBE_CONCURRENCY,
     })
         .option('dry-run', {
         description: 'Report the plan (what would be published / trusted) without changing anything.',
@@ -154,14 +157,28 @@ export const onboardCommand = {
         if (dryRun)
             log('(dry-run — nothing will be published or configured)');
         log();
-        // 3. Determine per-package state CONCURRENTLY. Reads use a plain
-        // authenticated GET (no OTP prompting — a 401 becomes `auth-required`).
-        const plans = await mapWithConcurrency(selected, Math.max(1, args.concurrency), (ws) => probeTrustState(ws, {
+        // Shared OTP provider + trust requester, built ONCE up front so the
+        // state-READ probes AND the act-phase writes share ONE OTP (typed once
+        // for the whole sweep, cache-first — the file cache in utils/npm-otp.ts
+        // extends that reuse across sibling `gjsify` invocations). The provider
+        // is scoped to the default registry so the file cache keys correctly.
+        const otpProvider = new OtpProvider(args.otp, nonInteractive ? async () => '' : undefined, {
+            registry: defaultRegistry,
+        });
+        const trustRequest = createTrustRequester({ npmrc, otpProvider });
+        // 3. Determine per-package state. Reads run through the SAME
+        // `TrustRequester` path `gjsify trust` uses (identical endpoint + auth +
+        // OTP handling) — so a 2FA-gated trust-state read is answered with the
+        // shared code instead of the plain-fetch 401→`unreadable` cascade
+        // (task #60). The first read is serial (prompts for the shared OTP once,
+        // before the burst); the rest run at a SMALL concurrency cap so a single
+        // token never faces a 127-wide parallel read.
+        const plans = await probeAllTrustStates(trustRequest, selected, Math.max(1, args.concurrency), {
             registryOverride: args.registry,
             npmrc,
             repository,
             workflow,
-        }));
+        });
         // Summary table (published✓ / trusted✓ vs work to do).
         const toPublish = plans.filter((p) => p.action === 'publish-and-trust');
         const toTrust = plans.filter((p) => p.action === 'trust');
@@ -188,9 +205,8 @@ export const onboardCommand = {
             return;
         }
         // 4. Act on the gaps, minimally. Publishes + trust POSTs run SERIALLY so
-        // the shared OTP is prompted at most once (and reused everywhere).
-        const otpProvider = new OtpProvider(args.otp, nonInteractive ? async () => '' : undefined);
-        const trustRequest = createTrustRequester({ npmrc, otpProvider });
+        // the shared OTP is prompted at most once (and reused everywhere) —
+        // reusing the `otpProvider` + `trustRequest` built for the probe phase.
         const trustBody = githubTrustBody({ repository, workflow, environment });
         let failed = 0;
         for (const p of plans) {
@@ -353,50 +369,6 @@ async function ensureAuthenticated(ctx) {
         throw err;
     }
 }
-/**
- * Read a package's current published + trust state via a plain authenticated
- * GET on its trust config (no OTP prompting). 404 → unpublished; a matching
- * github entry → trusted; otherwise → published-but-untrusted.
- */
-async function probeTrustState(ws, ctx) {
-    const registry = ctx.registryOverride ?? registryFor(ws.name, ctx.npmrc) ?? DEFAULT_REGISTRY;
-    const url = trustUrl(registry, ws.name);
-    let state = 'error';
-    let httpStatus = 0;
-    try {
-        const headers = buildHeaders(url, { npmrc: ctx.npmrc });
-        headers['accept'] = 'application/json';
-        const res = await fetch(url, { method: 'GET', headers });
-        httpStatus = res.status;
-        const text = await res.text().catch(() => '');
-        let json = undefined;
-        try {
-            json = text ? JSON.parse(text) : undefined;
-        }
-        catch {
-            /* non-JSON body */
-        }
-        state = classifyTrustList(res.status, json, { repository: ctx.repository, workflow: ctx.workflow });
-    }
-    catch {
-        state = 'error';
-    }
-    let action;
-    switch (state) {
-        case 'trusted':
-            action = 'skip';
-            break;
-        case 'untrusted':
-            action = 'trust';
-            break;
-        case 'unpublished':
-            action = 'publish-and-trust';
-            break;
-        default:
-            action = 'blocked'; // auth-required / error — can't determine
-    }
-    return { ws, registry, url, state, httpStatus, action };
-}
 /** Run the package's `build` script (if it declares one) before publishing. */
 async function buildIfPresent(ws, log) {
     const scripts = ws.manifest.scripts ?? {};
@@ -436,18 +408,3 @@ function describePublishFailure(pub) {
             return 'unknown';
     }
 }
-/** Map with bounded concurrency, preserving input order in the result. */
-async function mapWithConcurrency(items, limit, fn) {
-    const results = Array.from({ length: items.length });
-    let next = 0;
-    const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
-        while (true) {
-            const i = next++;
-            if (i >= items.length)
-                return;
-            results[i] = await fn(items[i]);
-        }
-    });
-    await Promise.all(workers);
-    return results;
-}

package/lib/commands/publish.js

@@ -187,7 +187,23 @@ export const publishCommand = {
         // silent hang reading a non-existent terminal. `--otp` seeds the code so
         // it rides the first PUT (matching npm's `--otp` behaviour).
         const interactiveOtp = Boolean(process.stdin.isTTY && process.stdout.isTTY);
-        const otpProvider = new OtpProvider(otp, interactiveOtp ? promptLine : async () => '');
+        // Scope the shared OTP file cache to this package's registry so a typed
+        // code carries over to a sibling `gjsify trust`/`publish` in the window.
+        const otpNpmrc = await loadNpmrc(wsDir);
+        let otpPkgName;
+        try {
+            otpPkgName = JSON.parse(readFileSync(join(wsDir, 'package.json'), 'utf-8')).name;
+        }
+        catch {
+            /* no readable manifest — fall back to the default registry below */
+        }
+        const otpRegistry = process.env.npm_config_registry ??
+            (otpPkgName ? registryFor(otpPkgName, otpNpmrc) : undefined) ??
+            otpNpmrc.registry ??
+            DEFAULT_REGISTRY;
+        const otpProvider = new OtpProvider(otp, interactiveOtp ? promptLine : async () => '', {
+            registry: otpRegistry,
+        });
         const outcome = await publishWorkspace({
             wsDir,
             tag,

package/lib/commands/trust.js

@@ -16,13 +16,70 @@
 //
 // Reference: refs/npm-cli/lib/trust-cmd.js + lib/commands/trust/github.js.
 import { spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { DEFAULT_REGISTRY, buildHeaders, registryFor, whoami } from '@gjsify/npm-registry';
 import { discoverWorkspaces, filterWorkspaces } from '@gjsify/workspace';
 import { hasAnyCredential, loadNpmrc } from '../utils/load-npmrc.js';
 import { OtpProvider, withOtpRetry } from '../utils/npm-otp.js';
 import { classifyTrustList, githubTrustBody, normalizeWorkflowFile, parseRepoFromGitRemote, trustUrl, validateRepository, } from '../utils/trust-registry.js';
+/**
+ * Publishable packages under `packages/node-gi/*` that are NOT root workspaces
+ * (the workspaces glob excludes `packages/node-gi/*`) yet publish via release.yml —
+ * `@gjsify/node-gi` + the `@gjsify/gtk-runtime-*` bundles. `discoverWorkspaces`
+ * misses them, so `gjsify trust` would never configure their Trusted Publisher.
+ * Enumerate them here as Workspace-shaped entries so the sweep covers them too.
+ * Best-effort: a missing dir / unreadable manifest is simply skipped.
+ */
+function discoverNodeGiPublishables(cwd) {
+    // Walk up from cwd to the repo root — the dir that holds `packages/node-gi` —
+    // so the command works from the root or any subdirectory.
+    let root = cwd;
+    for (let i = 0; i < 8; i++) {
+        if (existsSync(join(root, 'packages', 'node-gi')))
+            break;
+        const parent = dirname(root);
+        if (parent === root)
+            return [];
+        root = parent;
+    }
+    const base = join(root, 'packages', 'node-gi');
+    if (!existsSync(base))
+        return [];
+    const out = [];
+    let entries;
+    try {
+        entries = readdirSync(base, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const location = join(base, entry.name);
+        const pkgPath = join(location, 'package.json');
+        if (!existsSync(pkgPath))
+            continue;
+        try {
+            const manifest = JSON.parse(readFileSync(pkgPath, 'utf8'));
+            if (!manifest || typeof manifest.name !== 'string' || manifest.name.length === 0)
+                continue;
+            out.push({
+                location,
+                relativeLocation: join('packages', 'node-gi', entry.name),
+                name: manifest.name,
+                version: typeof manifest.version === 'string' ? manifest.version : '0.0.0',
+                manifest,
+                private: manifest.private === true,
+            });
+        }
+        catch {
+            /* unreadable / malformed — skip */
+        }
+    }
+    return out;
+}
 export const trustCommand = {
     command: 'trust [packages..]',
     description: 'Configure npm Trusted Publishers (OIDC/GitHub Actions) for publishable workspace packages so release.yml can publish without a token. Native — no `npm` needed. Incremental: skips already-configured packages.',
@@ -136,12 +193,19 @@ export const trustCommand = {
         }
         // Publishable workspaces: non-private by default, optionally name-filtered.
         const all = discoverWorkspaces(cwd, { includeRoot: true });
-        const selected = filterWorkspaces(all, {
+        // PLUS the publishable packages/node-gi/* packages (node-gi + gtk-runtime-*),
+        // which publish via release.yml but are NOT root workspaces, so
+        // discoverWorkspaces misses them and their Trusted Publisher would never get
+        // configured. Dedup by name so a real workspace always wins.
+        const workspaceNames = new Set(all.map((ws) => ws.name));
+        const extra = discoverNodeGiPublishables(cwd).filter((ws) => !workspaceNames.has(ws.name));
+        const merged = [...all, ...extra];
+        const selected = filterWorkspaces(merged, {
             noPrivate: args.private !== true,
             include: args.packages && args.packages.length > 0 ? args.packages : undefined,
         }).filter((ws) => ws.name);
         if (selected.length === 0) {
-            console.error('gjsify trust: no publishable workspace packages matched.');
+            console.error('gjsify trust: no publishable packages matched.');
             process.exit(1);
         }
         console.log(`gjsify trust: ${selected.length} package(s) | repo=${repository} workflow=${workflow}`);

package/lib/utils/npm-otp-cache.d.ts

@@ -0,0 +1,31 @@
+/** TTL for a cached OTP — one TOTP window. Short by design (never raise past ~60 s). */
+export declare const OTP_CACHE_TTL_MS = 30000;
+/** Env var that disables the cross-invocation OTP cache entirely. */
+export declare const OTP_CACHE_OPT_OUT_ENV = "GJSIFY_NO_OTP_CACHE";
+/** Injectable knobs so the unit tests stay hermetic (real callers pass nothing). */
+export interface OtpCacheOptions {
+    /** Override the cache base dir. Defaults to `$XDG_RUNTIME_DIR` → OS temp dir. */
+    dir?: string;
+    /** Injected clock (epoch-ms). Defaults to `Date.now()`. */
+    now?: number;
+    /** Override the TTL for a write. Defaults to {@link OTP_CACHE_TTL_MS}. */
+    ttlMs?: number;
+}
+/** `true` unless `GJSIFY_NO_OTP_CACHE` is set to a truthy value. */
+export declare function isOtpCacheEnabled(): boolean;
+/**
+ * Read the cached code for `registry`, or `undefined` on a miss / expiry /
+ * opt-out. An EXPIRED entry is deleted as a side effect.
+ */
+export declare function readCachedOtp(registry: string, opts?: OtpCacheOptions): string | undefined;
+/**
+ * Persist `otp` for `registry` with a fresh TTL, perms 0600. No-op on opt-out
+ * or empty code. Best-effort — a write failure never throws.
+ */
+export declare function writeCachedOtp(registry: string, otp: string, opts?: OtpCacheOptions): void;
+/** Drop the cached code for a single registry (invalid/consumed OTP, or logout). */
+export declare function clearCachedOtp(registry: string, opts?: OtpCacheOptions): void;
+/** Drop the entire cache dir (e.g. a broad logout). Best-effort. */
+export declare function clearAllCachedOtp(opts?: OtpCacheOptions): void;
+/** POSIX file-mode bits of the cache file (test helper); `undefined` if absent. */
+export declare function cachedOtpFileMode(registry: string, opts?: OtpCacheOptions): number | undefined;

package/lib/utils/npm-otp-cache.js

@@ -0,0 +1,142 @@
+// Short-lived, CROSS-INVOCATION cache for the npm 2FA one-time code.
+//
+// A TOTP stays valid for its ~30 s window, so a `login → onboard → publish →
+// trust` sequence of SEPARATE `gjsify` processes should reuse ONE typed code
+// instead of prompting per command. The in-process `OtpProvider` cache
+// (utils/npm-otp.ts) only survives a single command; this file is the layer
+// under it that survives across invocations.
+//
+// Design:
+//   - Stored in a temp file (under `$XDG_RUNTIME_DIR`, else the OS temp dir —
+//     NEVER the repo), perms 0600, with a stamped absolute `expiresAt`.
+//   - TTL = one TOTP window (30 s), deliberately short. A read past the expiry
+//     ignores AND deletes the file.
+//   - Keyed by the REGISTRY URL, so a code for one registry is never replayed
+//     against another.
+//   - Best-effort: a cache miss/error NEVER breaks the command — a stale or
+//     unreadable entry degrades to "no cached code" (re-prompt).
+//   - Opt-out: `GJSIFY_NO_OTP_CACHE=1` disables it entirely; `gjsify logout`
+//     clears it.
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+/** TTL for a cached OTP — one TOTP window. Short by design (never raise past ~60 s). */
+export const OTP_CACHE_TTL_MS = 30_000;
+/** Env var that disables the cross-invocation OTP cache entirely. */
+export const OTP_CACHE_OPT_OUT_ENV = 'GJSIFY_NO_OTP_CACHE';
+const CACHE_DIR_NAME = 'gjsify-otp';
+/** `true` unless `GJSIFY_NO_OTP_CACHE` is set to a truthy value. */
+export function isOtpCacheEnabled() {
+    const v = process.env[OTP_CACHE_OPT_OUT_ENV];
+    return !(v === '1' || v === 'true' || v === 'yes');
+}
+/** Trailing-slash-insensitive registry key so `…/` and `…` map to one entry. */
+function normalizeRegistry(registry) {
+    return registry.endsWith('/') ? registry.slice(0, -1) : registry;
+}
+function cacheBaseDir(opts) {
+    if (opts?.dir)
+        return opts.dir;
+    const xdg = process.env.XDG_RUNTIME_DIR;
+    const base = xdg && xdg.length > 0 ? xdg : tmpdir();
+    return join(base, CACHE_DIR_NAME);
+}
+/** Registry-scoped cache file path (filename derived from the registry). */
+function cacheFileFor(registry, opts) {
+    const safe = normalizeRegistry(registry)
+        .replace(/[^a-zA-Z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 120);
+    return join(cacheBaseDir(opts), `otp-${safe || 'default'}.json`);
+}
+/**
+ * Read the cached code for `registry`, or `undefined` on a miss / expiry /
+ * opt-out. An EXPIRED entry is deleted as a side effect.
+ */
+export function readCachedOtp(registry, opts) {
+    if (!isOtpCacheEnabled())
+        return undefined;
+    const now = opts?.now ?? Date.now();
+    const file = cacheFileFor(registry, opts);
+    try {
+        if (!existsSync(file))
+            return undefined;
+        const entry = JSON.parse(readFileSync(file, 'utf8'));
+        if (!entry || typeof entry.otp !== 'string' || typeof entry.expiresAt !== 'number') {
+            deleteCacheFile(file);
+            return undefined;
+        }
+        // Registry mismatch (sanitized filename collision) → miss, don't delete.
+        if (entry.registry !== normalizeRegistry(registry))
+            return undefined;
+        if (now >= entry.expiresAt) {
+            deleteCacheFile(file); // expired → ignore + delete
+            return undefined;
+        }
+        return entry.otp.length > 0 ? entry.otp : undefined;
+    }
+    catch {
+        // Corrupt / unreadable — treat as a miss, best-effort remove.
+        deleteCacheFile(file);
+        return undefined;
+    }
+}
+/**
+ * Persist `otp` for `registry` with a fresh TTL, perms 0600. No-op on opt-out
+ * or empty code. Best-effort — a write failure never throws.
+ */
+export function writeCachedOtp(registry, otp, opts) {
+    if (!isOtpCacheEnabled())
+        return;
+    if (!otp || otp.length === 0)
+        return;
+    const now = opts?.now ?? Date.now();
+    const ttl = opts?.ttlMs ?? OTP_CACHE_TTL_MS;
+    try {
+        const dir = cacheBaseDir(opts);
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const file = cacheFileFor(registry, opts);
+        const entry = { otp, expiresAt: now + ttl, registry: normalizeRegistry(registry) };
+        writeFileSync(file, JSON.stringify(entry), { mode: 0o600 });
+        // Enforce 0600 even when the file pre-existed with looser perms (writeFile
+        // only applies `mode` on create) — the code is a live secret.
+        chmodSync(file, 0o600);
+    }
+    catch {
+        /* best-effort — a cache write must never break the command */
+    }
+}
+/** Drop the cached code for a single registry (invalid/consumed OTP, or logout). */
+export function clearCachedOtp(registry, opts) {
+    deleteCacheFile(cacheFileFor(registry, opts));
+}
+/** Drop the entire cache dir (e.g. a broad logout). Best-effort. */
+export function clearAllCachedOtp(opts) {
+    try {
+        rmSync(cacheBaseDir(opts), { recursive: true, force: true });
+    }
+    catch {
+        /* ignore */
+    }
+}
+/** POSIX file-mode bits of the cache file (test helper); `undefined` if absent. */
+export function cachedOtpFileMode(registry, opts) {
+    const file = cacheFileFor(registry, opts);
+    try {
+        if (!existsSync(file))
+            return undefined;
+        return statSync(file).mode & 0o777;
+    }
+    catch {
+        return undefined;
+    }
+}
+function deleteCacheFile(file) {
+    try {
+        if (existsSync(file))
+            rmSync(file, { force: true });
+    }
+    catch {
+        /* ignore */
+    }
+}

package/lib/utils/npm-otp.d.ts

@@ -6,31 +6,55 @@ export type OtpPromptFn = (question: string) => Promise<string>;
  * Unifies the detection logic previously inlined in both publish.ts and trust.ts.
  */
 export declare function isOtpChallenge(res: Response): Promise<boolean>;
+/** Options controlling the cross-invocation file cache an {@link OtpProvider} rides on top of. */
+export interface OtpProviderOptions {
+    /**
+     * Registry URL scoping the SHORT-LIVED cross-invocation OTP cache
+     * (`utils/npm-otp-cache.ts`). When set, a provider constructed WITHOUT an
+     * explicit seed reads the file-cached code first (so a sibling `gjsify`
+     * command's typed OTP is reused within its ~30 s TOTP window), and every
+     * newly typed/seeded code is written back for the next command. Omit → the
+     * provider is in-process-only (the historical behaviour).
+     */
+    registry?: string;
+}
 /**
  * Holds ONE OTP code across a run and knows how to prompt for a fresh one.
  *
- * `current()` returns the cached code (seeded from `--otp`, or the last one the
- * user typed). `refresh()` prompts for a new code and caches it. A single
- * provider instance shared across many publish + trust operations is what makes
- * `gjsify onboard` need only one OTP entry for the whole sweep.
+ * `current()` returns the cached code (seeded from `--otp`, the cross-invocation
+ * file cache, or the last one the user typed). `refresh()` prompts for a new
+ * code and caches it (in-process AND — when a `registry` is set — in the
+ * short-lived file cache). A single provider instance shared across many
+ * publish + trust operations is what makes `gjsify onboard` need only one OTP
+ * entry for the whole sweep; the file cache extends that reuse across SEPARATE
+ * `gjsify` invocations (`login → onboard → publish → trust`).
  */
 export declare class OtpProvider {
     private cached;
     private readonly promptFn;
+    private readonly registry;
     /**
      * @param seed     Initial cached code (from `--otp`), or undefined.
      * @param promptFn How to read a fresh code. Defaults to the TTY-aware
      *                 `promptLine`. Non-interactive callers pass a function that
      *                 returns `''` so a challenge surfaces instead of hanging.
+     * @param options  Optional cross-invocation file-cache scoping (`registry`).
      */
-    constructor(seed?: string, promptFn?: OtpPromptFn);
+    constructor(seed?: string, promptFn?: OtpPromptFn, options?: OtpProviderOptions);
     /** The currently cached OTP code, if any. */
     current(): string | undefined;
     /**
-     * Prompt for a fresh code, cache it, and return it (the trimmed input, or
-     * `''` when nothing was entered — the caller treats empty as "give up").
+     * Prompt for a fresh code, cache it (in-process + file cache), and return
+     * it (the trimmed input, or `''` when nothing was entered — the caller
+     * treats empty as "give up").
      */
     refresh(question?: string): Promise<string>;
+    /**
+     * Drop the cached code (in-process AND the cross-invocation file entry)
+     * after npm rejects it as invalid/consumed — so the NEXT command re-prompts
+     * instead of replaying a single-use code that the registry already burned.
+     */
+    invalidate(): void;
 }
 export interface OtpRetryOptions {
     /**