@gjsify/cli 0.20.0 → 0.22.0

package/lib/utils/npm-otp.d.ts

@@ -6,31 +6,55 @@ export type OtpPromptFn = (question: string) => Promise<string>;
  * Unifies the detection logic previously inlined in both publish.ts and trust.ts.
  */
 export declare function isOtpChallenge(res: Response): Promise<boolean>;
+/** Options controlling the cross-invocation file cache an {@link OtpProvider} rides on top of. */
+export interface OtpProviderOptions {
+    /**
+     * Registry URL scoping the SHORT-LIVED cross-invocation OTP cache
+     * (`utils/npm-otp-cache.ts`). When set, a provider constructed WITHOUT an
+     * explicit seed reads the file-cached code first (so a sibling `gjsify`
+     * command's typed OTP is reused within its ~30 s TOTP window), and every
+     * newly typed/seeded code is written back for the next command. Omit → the
+     * provider is in-process-only (the historical behaviour).
+     */
+    registry?: string;
+}
 /**
  * Holds ONE OTP code across a run and knows how to prompt for a fresh one.
  *
- * `current()` returns the cached code (seeded from `--otp`, or the last one the
- * user typed). `refresh()` prompts for a new code and caches it. A single
- * provider instance shared across many publish + trust operations is what makes
- * `gjsify onboard` need only one OTP entry for the whole sweep.
+ * `current()` returns the cached code (seeded from `--otp`, the cross-invocation
+ * file cache, or the last one the user typed). `refresh()` prompts for a new
+ * code and caches it (in-process AND — when a `registry` is set — in the
+ * short-lived file cache). A single provider instance shared across many
+ * publish + trust operations is what makes `gjsify onboard` need only one OTP
+ * entry for the whole sweep; the file cache extends that reuse across SEPARATE
+ * `gjsify` invocations (`login → onboard → publish → trust`).
  */
 export declare class OtpProvider {
     private cached;
     private readonly promptFn;
+    private readonly registry;
     /**
      * @param seed     Initial cached code (from `--otp`), or undefined.
      * @param promptFn How to read a fresh code. Defaults to the TTY-aware
      *                 `promptLine`. Non-interactive callers pass a function that
      *                 returns `''` so a challenge surfaces instead of hanging.
+     * @param options  Optional cross-invocation file-cache scoping (`registry`).
      */
-    constructor(seed?: string, promptFn?: OtpPromptFn);
+    constructor(seed?: string, promptFn?: OtpPromptFn, options?: OtpProviderOptions);
     /** The currently cached OTP code, if any. */
     current(): string | undefined;
     /**
-     * Prompt for a fresh code, cache it, and return it (the trimmed input, or
-     * `''` when nothing was entered — the caller treats empty as "give up").
+     * Prompt for a fresh code, cache it (in-process + file cache), and return
+     * it (the trimmed input, or `''` when nothing was entered — the caller
+     * treats empty as "give up").
      */
     refresh(question?: string): Promise<string>;
+    /**
+     * Drop the cached code (in-process AND the cross-invocation file entry)
+     * after npm rejects it as invalid/consumed — so the NEXT command re-prompts
+     * instead of replaying a single-use code that the registry already burned.
+     */
+    invalidate(): void;
 }
 export interface OtpRetryOptions {
     /**

package/lib/utils/npm-otp.js

@@ -19,6 +19,7 @@
 // Standalone `publish`/`trust` keep their existing single-command UX: each
 // still constructs its own provider and prompts on demand.
 import { promptLine } from './prompt.js';
+import { clearCachedOtp, readCachedOtp, writeCachedOtp } from './npm-otp-cache.js';
 const DEFAULT_QUESTION = 'This operation requires a one-time password.\nEnter OTP: ';
 /**
  * True when a response is an npm OTP / 2FA challenge (401 + a `www-authenticate`
@@ -40,38 +41,69 @@ export async function isOtpChallenge(res) {
 /**
  * Holds ONE OTP code across a run and knows how to prompt for a fresh one.
  *
- * `current()` returns the cached code (seeded from `--otp`, or the last one the
- * user typed). `refresh()` prompts for a new code and caches it. A single
- * provider instance shared across many publish + trust operations is what makes
- * `gjsify onboard` need only one OTP entry for the whole sweep.
+ * `current()` returns the cached code (seeded from `--otp`, the cross-invocation
+ * file cache, or the last one the user typed). `refresh()` prompts for a new
+ * code and caches it (in-process AND — when a `registry` is set — in the
+ * short-lived file cache). A single provider instance shared across many
+ * publish + trust operations is what makes `gjsify onboard` need only one OTP
+ * entry for the whole sweep; the file cache extends that reuse across SEPARATE
+ * `gjsify` invocations (`login → onboard → publish → trust`).
  */
 export class OtpProvider {
     cached;
     promptFn;
+    registry;
     /**
      * @param seed     Initial cached code (from `--otp`), or undefined.
      * @param promptFn How to read a fresh code. Defaults to the TTY-aware
      *                 `promptLine`. Non-interactive callers pass a function that
      *                 returns `''` so a challenge surfaces instead of hanging.
+     * @param options  Optional cross-invocation file-cache scoping (`registry`).
      */
-    constructor(seed, promptFn = promptLine) {
-        this.cached = seed && seed.length > 0 ? seed : undefined;
+    constructor(seed, promptFn = promptLine, options = {}) {
         this.promptFn = promptFn;
+        this.registry = options.registry;
+        const explicit = seed && seed.length > 0 ? seed : undefined;
+        if (explicit) {
+            this.cached = explicit;
+            // An explicit --otp seeds the cross-invocation cache too, so a
+            // sibling command in the same window reuses it without a prompt.
+            if (this.registry)
+                writeCachedOtp(this.registry, explicit);
+        }
+        else {
+            // No explicit code — fall back to the short-lived file cache.
+            this.cached = this.registry ? readCachedOtp(this.registry) : undefined;
+        }
     }
     /** The currently cached OTP code, if any. */
     current() {
         return this.cached;
     }
     /**
-     * Prompt for a fresh code, cache it, and return it (the trimmed input, or
-     * `''` when nothing was entered — the caller treats empty as "give up").
+     * Prompt for a fresh code, cache it (in-process + file cache), and return
+     * it (the trimmed input, or `''` when nothing was entered — the caller
+     * treats empty as "give up").
      */
     async refresh(question = DEFAULT_QUESTION) {
         const code = (await this.promptFn(question)).trim();
-        if (code)
+        if (code) {
             this.cached = code;
+            if (this.registry)
+                writeCachedOtp(this.registry, code);
+        }
         return code;
     }
+    /**
+     * Drop the cached code (in-process AND the cross-invocation file entry)
+     * after npm rejects it as invalid/consumed — so the NEXT command re-prompts
+     * instead of replaying a single-use code that the registry already burned.
+     */
+    invalidate() {
+        this.cached = undefined;
+        if (this.registry)
+            clearCachedOtp(this.registry);
+    }
 }
 /**
  * Run `doFetch` with cache-first OTP retry against a shared {@link OtpProvider}.
@@ -98,11 +130,18 @@ export async function withOtpRetry(doFetch, provider, opts = {}) {
     let res = await doFetch(seededFirst ? cached : undefined);
     if (!(await isOtpChallenge(res)))
         return res;
+    // The seeded (`--otp`/file-cached) code was rejected/consumed — drop it so
+    // it is not replayed and the cross-invocation cache entry is cleared.
+    if (seededFirst)
+        provider.invalidate();
     // Try the cached code if we haven't already sent it.
     if (!seededFirst && provider.current() !== undefined) {
         res = await doFetch(provider.current());
         if (!(await isOtpChallenge(res)))
             return res;
+        // Cached code rejected/consumed (stale seed, or a sibling command
+        // already burned the file-cached single-use code) → invalidate.
+        provider.invalidate();
     }
     // Cache empty, rejected, or expired → prompt for a fresh code and retry.
     for (let i = 0; i < maxPrompts; i++) {
@@ -112,6 +151,9 @@ export async function withOtpRetry(doFetch, provider, opts = {}) {
         res = await doFetch(fresh);
         if (!(await isOtpChallenge(res)))
             return res;
+        // The freshly-typed code was also rejected — clear it before re-prompting
+        // so a wedged sequence never leaves a burned code in the file cache.
+        provider.invalidate();
     }
     return res;
 }

package/lib/utils/onboard-probe.d.ts

@@ -0,0 +1,55 @@
+import { type NpmrcConfig } from '@gjsify/npm-registry';
+import type { Workspace } from '@gjsify/workspace';
+import type { TrustRequester } from '../commands/trust.js';
+import { type TrustState } from './trust-registry.js';
+/** What a package needs, computed from its published + trust state. */
+export type PkgAction = 'skip' | 'trust' | 'publish-and-trust' | 'blocked';
+/** A per-package plan produced by the probe phase. */
+export interface PkgPlan {
+    ws: Workspace;
+    registry: string;
+    url: string;
+    state: TrustState;
+    httpStatus: number;
+    action: PkgAction;
+}
+/** Everything a probe needs beyond the requester + workspace. */
+export interface ProbeContext {
+    registryOverride?: string;
+    npmrc: NpmrcConfig;
+    repository: string;
+    workflow: string;
+}
+/** Tunables (also the test seams) for a single probe read. */
+export interface ProbeOptions {
+    /** Retry once on a transient `auth-required` (401). Default true. */
+    retryOn401?: boolean;
+    /** Backoff before the single 401 retry. Default {@link PROBE_RETRY_DELAY_MS}. */
+    retryDelayMs?: number;
+    /** Injected delay (tests pass a no-op). Default: real `setTimeout`. */
+    sleep?: (ms: number) => Promise<void>;
+}
+/** Small backoff before the one-shot retry of a transient 401 read. */
+export declare const PROBE_RETRY_DELAY_MS = 400;
+/** Default probe concurrency — kept SMALL so a single token never bursts npm. */
+export declare const DEFAULT_PROBE_CONCURRENCY = 4;
+/** Map a classified trust state to the action the onboard sweep should take. */
+export declare function actionForState(state: TrustState): PkgAction;
+/**
+ * Read one package's published + trust state via the SHARED trust requester —
+ * the exact `trustUrl` + `buildHeaders` auth + `withOtpRetry` path `gjsify
+ * trust` uses. On a transient `auth-required` (401 that was not an answerable
+ * OTP challenge — e.g. a parallel-burst rejection or a lapsed 2FA-skip window),
+ * it retries ONCE after a short backoff.
+ */
+export declare function probeTrustState(request: TrustRequester, ws: Workspace, ctx: ProbeContext, opts?: ProbeOptions): Promise<PkgPlan>;
+/**
+ * Probe every selected workspace. The FIRST package is read SERIALLY so a
+ * 2FA-gated read triggers the single shared-OTP prompt (typed once) before the
+ * concurrent burst — the rest reuse the now-cached code — and so a single token
+ * never faces a 127-wide parallel read. The remaining packages are read with a
+ * bounded (small) concurrency cap.
+ */
+export declare function probeAllTrustStates(request: TrustRequester, selected: readonly Workspace[], concurrency: number, ctx: ProbeContext, opts?: ProbeOptions): Promise<PkgPlan[]>;
+/** Map with bounded concurrency, preserving input order in the result. */
+export declare function mapWithConcurrency<T, R>(items: readonly T[], limit: number, fn: (item: T) => Promise<R>): Promise<R[]>;

package/lib/utils/onboard-probe.js

@@ -0,0 +1,90 @@
+// Trusted-Publisher STATE-READ path for `gjsify onboard`, extracted so it can
+// be unit-tested against a mocked requester (no live npm).
+//
+// The bug this fixes (task #60): `gjsify onboard` read all ~127 packages'
+// trust state with a PLAIN authenticated `fetch` (no OTP handling) run in a
+// wide concurrent burst — every read came back `401 → auth-required →
+// unreadable`, so the sweep planned `0 to publish+trust, 0 to trust, 127
+// unreadable`. Meanwhile a targeted `gjsify trust <pkg> --otp <code>` READ the
+// same state fine with the SAME token, because its read runs through the shared
+// `TrustRequester` (→ `withOtpRetry`): a 401 that is an OTP challenge is
+// answered with the shared code, and non-OTP transient 401s are tolerated.
+//
+// Fix: onboard now reads through the EXACT same `TrustRequester` path as
+// `gjsify trust` (identical `trustUrl` + `buildHeaders` auth + OTP handling),
+// PLUS a one-shot retry on a transient 401, PLUS a first-serial-then-bounded
+// probe order so the ONE shared OTP is prompted at most once and npm is never
+// hit with a 127-wide parallel burst from a single token.
+import { DEFAULT_REGISTRY, registryFor } from '@gjsify/npm-registry';
+import { classifyTrustList, trustUrl } from './trust-registry.js';
+/** Small backoff before the one-shot retry of a transient 401 read. */
+export const PROBE_RETRY_DELAY_MS = 400;
+/** Default probe concurrency — kept SMALL so a single token never bursts npm. */
+export const DEFAULT_PROBE_CONCURRENCY = 4;
+/** Map a classified trust state to the action the onboard sweep should take. */
+export function actionForState(state) {
+    switch (state) {
+        case 'trusted':
+            return 'skip';
+        case 'untrusted':
+            return 'trust';
+        case 'unpublished':
+            return 'publish-and-trust';
+        default:
+            // auth-required / error — can't determine, so don't act blindly.
+            return 'blocked';
+    }
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Read one package's published + trust state via the SHARED trust requester —
+ * the exact `trustUrl` + `buildHeaders` auth + `withOtpRetry` path `gjsify
+ * trust` uses. On a transient `auth-required` (401 that was not an answerable
+ * OTP challenge — e.g. a parallel-burst rejection or a lapsed 2FA-skip window),
+ * it retries ONCE after a short backoff.
+ */
+export async function probeTrustState(request, ws, ctx, opts = {}) {
+    const registry = ctx.registryOverride ?? registryFor(ws.name, ctx.npmrc) ?? DEFAULT_REGISTRY;
+    const url = trustUrl(registry, ws.name);
+    const classifyOpts = { repository: ctx.repository, workflow: ctx.workflow };
+    let res = await request('GET', url);
+    let state = classifyTrustList(res.status, res.json, classifyOpts);
+    if (state === 'auth-required' && opts.retryOn401 !== false) {
+        const sleep = opts.sleep ?? defaultSleep;
+        await sleep(opts.retryDelayMs ?? PROBE_RETRY_DELAY_MS);
+        res = await request('GET', url);
+        state = classifyTrustList(res.status, res.json, classifyOpts);
+    }
+    return { ws, registry, url, state, httpStatus: res.status, action: actionForState(state) };
+}
+/**
+ * Probe every selected workspace. The FIRST package is read SERIALLY so a
+ * 2FA-gated read triggers the single shared-OTP prompt (typed once) before the
+ * concurrent burst — the rest reuse the now-cached code — and so a single token
+ * never faces a 127-wide parallel read. The remaining packages are read with a
+ * bounded (small) concurrency cap.
+ */
+export async function probeAllTrustStates(request, selected, concurrency, ctx, opts = {}) {
+    if (selected.length === 0)
+        return [];
+    const first = await probeTrustState(request, selected[0], ctx, opts);
+    const rest = await mapWithConcurrency(selected.slice(1), Math.max(1, concurrency), (ws) => probeTrustState(request, ws, ctx, opts));
+    return [first, ...rest];
+}
+/** Map with bounded concurrency, preserving input order in the result. */
+export async function mapWithConcurrency(items, limit, fn) {
+    const results = Array.from({ length: items.length });
+    let next = 0;
+    const workers = Array.from({ length: Math.min(Math.max(1, limit), items.length) }, async () => {
+        while (true) {
+            const i = next++;
+            if (i >= items.length)
+                return;
+            results[i] = await fn(items[i]);
+        }
+    });
+    await Promise.all(workers);
+    return results;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.20.0",
+    "version": "0.22.0",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -125,19 +125,19 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/buffer": "^0.20.0",
-        "@gjsify/create-app": "^0.20.0",
-        "@gjsify/node-globals": "^0.20.0",
-        "@gjsify/node-polyfills": "^0.20.0",
-        "@gjsify/npm-registry": "^0.20.0",
-        "@gjsify/resolve-npm": "^0.20.0",
-        "@gjsify/rolldown-plugin-gjsify": "^0.20.0",
-        "@gjsify/rolldown-plugin-pnp": "^0.20.0",
-        "@gjsify/semver": "^0.20.0",
-        "@gjsify/tar": "^0.20.0",
-        "@gjsify/tsc": "^0.20.0",
-        "@gjsify/web-polyfills": "^0.20.0",
-        "@gjsify/workspace": "^0.20.0",
+        "@gjsify/buffer": "^0.22.0",
+        "@gjsify/create-app": "^0.22.0",
+        "@gjsify/node-globals": "^0.22.0",
+        "@gjsify/node-polyfills": "^0.22.0",
+        "@gjsify/npm-registry": "^0.22.0",
+        "@gjsify/resolve-npm": "^0.22.0",
+        "@gjsify/rolldown-plugin-gjsify": "^0.22.0",
+        "@gjsify/rolldown-plugin-pnp": "^0.22.0",
+        "@gjsify/semver": "^0.22.0",
+        "@gjsify/tar": "^0.22.0",
+        "@gjsify/tsc": "^0.22.0",
+        "@gjsify/web-polyfills": "^0.22.0",
+        "@gjsify/workspace": "^0.22.0",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
         "pkg-types": "^2.3.1",
@@ -145,13 +145,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.20.0",
+        "@gjsify/unit": "^0.22.0",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.20.0",
-        "@gjsify/rolldown-native": "^0.20.0"
+        "@gjsify/oxfmt-native": "^0.22.0",
+        "@gjsify/rolldown-native": "^0.22.0"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {