@gjsify/cli 0.6.1 → 0.7.2

package/lib/cli-app.js

@@ -19,7 +19,7 @@ import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import yargs from 'yargs';
-import { buildCommand as build, testCommand as test, runCommand as run, infoCommand as info, systemCheckCommand as systemCheck, checkCommand as check, showcaseCommand as showcase, createCommand as create, gresourceCommand as gresource, gettextCommand as gettext, gsettingsCommand as gsettings, flatpakCommand as flatpak, dlxCommand as dlx, installCommand as install, foreachCommand as foreach, workspaceCommand as workspace, packCommand as pack, publishCommand as publish, whoamiCommand as whoami, loginCommand as login, logoutCommand as logout, selfUpdateCommand as selfUpdate, generateInstallerCommand as generateInstaller, uninstallCommand as uninstall, formatCommand as format, lintCommand as lint, fixCommand as fix, upgradeCommand as upgrade, barrelsCommand as barrels, tscCommand as tsc, affectedCommand as affected, } from './commands/index.js';
+import { buildCommand as build, testCommand as test, runCommand as run, infoCommand as info, systemCheckCommand as systemCheck, checkCommand as check, showcaseCommand as showcase, createCommand as create, gresourceCommand as gresource, gettextCommand as gettext, gsettingsCommand as gsettings, flatpakCommand as flatpak, dlxCommand as dlx, installCommand as install, foreachCommand as foreach, workspaceCommand as workspace, packCommand as pack, publishCommand as publish, whoamiCommand as whoami, loginCommand as login, logoutCommand as logout, trustCommand as trust, selfUpdateCommand as selfUpdate, generateInstallerCommand as generateInstaller, uninstallCommand as uninstall, formatCommand as format, lintCommand as lint, fixCommand as fix, upgradeCommand as upgrade, barrelsCommand as barrels, tscCommand as tsc, affectedCommand as affected, } from './commands/index.js';
 import { APP_NAME } from './constants.js';
 // Detect which runtime is executing the CLI (GJS or Node.js).
 // GJS MUST be checked first because @gjsify/process sets
@@ -95,6 +95,7 @@ export async function runCli(argv) {
         .command(whoami.command, whoami.description, whoami.builder, whoami.handler)
         .command(login.command, login.description, login.builder, login.handler)
         .command(logout.command, logout.description, logout.builder, logout.handler)
+        .command(trust.command, trust.description, trust.builder, trust.handler)
         .command(selfUpdate.command, selfUpdate.description, selfUpdate.builder, selfUpdate.handler)
         .command(generateInstaller.command, generateInstaller.description, generateInstaller.builder, generateInstaller.handler)
         .command(uninstall.command, uninstall.description, uninstall.builder, uninstall.handler)

package/lib/commands/index.d.ts

@@ -19,6 +19,7 @@ export * from './publish.js';
 export * from './whoami.js';
 export * from './login.js';
 export * from './logout.js';
+export * from './trust.js';
 export * from './self-update.js';
 export * from './generate-installer.js';
 export * from './uninstall.js';

package/lib/commands/index.js

@@ -19,6 +19,7 @@ export * from './publish.js';
 export * from './whoami.js';
 export * from './login.js';
 export * from './logout.js';
+export * from './trust.js';
 export * from './self-update.js';
 export * from './generate-installer.js';
 export * from './uninstall.js';

package/lib/commands/install.js

@@ -396,6 +396,134 @@ async function workspaceInstall(cwd, args, signal) {
     // (GI_TYPELIB_PATH for native prebuilds) reflects the freshly installed
     // tree — see the final `writeWorkspaceBinShims` call below.
     writeWorkspaceBinShims(cwd, workspaces);
+    // Materialise the workspace↔workspace symlinks: per-requester links
+    // (`<requester>/node_modules/<dep>`) plus a root hoist of every workspace
+    // into `node_modules/<name>` so transitive workspace deps resolve via
+    // Node's parent-walk from any descendant. Idempotent (rm + symlink, and
+    // the hoist skips entries that already exist), so it's safe to run more
+    // than once.
+    const wireWorkspaceSymlinks = async () => {
+        // Per-requester symlinks — pre-dedup the parent-dir mkdirs (every
+        // symlink for the same workspace shares a single `node_modules`
+        // parent), then run the per-link rm + symlink steps with bounded
+        // concurrency. Pure sync loops here used to dominate the tail of large
+        // installs (~793 symlinks × ~10ms each for mkdir+rm+symlink = ~24s of
+        // serial syscalls). With async + a 32-wide pool the same set lands in
+        // 1-2s.
+        if (symlinks.length > 0) {
+            const fsp = await import('node:fs/promises');
+            const parentDirs = new Set();
+            const plans = [];
+            for (const link of symlinks) {
+                const target = byName.get(link.fromWorkspaceName);
+                if (!target)
+                    continue;
+                const linkPath = join(target.location, 'node_modules', link.depName);
+                parentDirs.add(dirname(linkPath));
+                const relTarget = relative(dirname(linkPath), link.targetLocation);
+                plans.push({ linkPath, relTarget });
+            }
+            // Phase 1: one mkdir per unique parent (max ~213 instead of ~793).
+            await Promise.all([...parentDirs].map((dir) => fsp.mkdir(dir, { recursive: true })));
+            // Phase 2: per-link rm + symlink, pooled. A semaphore-style cursor
+            // keeps the concurrent in-flight count bounded so we don't blow up
+            // the file-descriptor table on huge monorepos.
+            const SYMLINK_CONCURRENCY = 32;
+            let cursor = 0;
+            const workers = [];
+            const wireOne = async (linkPath, relTarget) => {
+                // Remove any prior entry — regular dir, broken symlink, file,
+                // or a normal symlink left over from a previous install.
+                // `{ recursive: true, force: true }` handles every shape (rm
+                // no-ops on missing paths under force; recursive covers dirs).
+                try {
+                    await fsp.rm(linkPath, { recursive: true, force: true });
+                }
+                catch {
+                    /* unexpected; symlink call below will surface the real
+                       cause if it persists. */
+                }
+                await fsp.symlink(relTarget, linkPath);
+            };
+            for (let i = 0; i < Math.min(SYMLINK_CONCURRENCY, plans.length); i++) {
+                workers.push((async () => {
+                    while (true) {
+                        const idx = cursor++;
+                        if (idx >= plans.length)
+                            return;
+                        const p = plans[idx];
+                        if (!p)
+                            return;
+                        await wireOne(p.linkPath, p.relTarget);
+                    }
+                })());
+            }
+            await Promise.all(workers);
+            console.log(`gjsify install: wired ${symlinks.length} workspace symlink(s)`);
+        }
+        // Hoist EVERY workspace package to the repo root's `node_modules/` so
+        // transitive workspace deps are reachable from any descendant via
+        // standard Node parent-walk resolution. yarn's `nodeLinker:
+        // node-modules` does the same thing — the entire workspace graph is
+        // materialised at the root, which is how rolldown's resolver finds
+        // e.g. `@gjsify/abort-controller/register` injected from a
+        // deeply-nested package's `node_modules/.cache/gjsify/` cache file
+        // when the consumer didn't declare a direct dep on it (auto-globals
+        // injection at build time).
+        //
+        // Without this hoist, each workspace's `node_modules/` only contains
+        // its direct declared deps, and any auto-injected register import for
+        // a workspace package the consumer didn't list as a dep externalises
+        // and the bundle fails at runtime with `Module not found`.
+        const rootBinDir = join(cwd, 'node_modules');
+        let rootHoisted = 0;
+        for (const ws of workspaces) {
+            // Skip the root workspace itself (its location IS cwd; it can't
+            // symlink itself into its own node_modules).
+            if (ws.location === cwd)
+                continue;
+            if (!ws.name)
+                continue;
+            const linkPath = join(rootBinDir, ws.name);
+            // If a symlink already exists here (from the per-requester loop
+            // above when the root workspace declared this dep directly), it
+            // already points at the right place — skip. We don't try to
+            // remove + recreate because under GJS's Gio-backed fs polyfill,
+            // `rmSync` on a symlink can race with `symlinkSync` and surface
+            // EEXIST. A real directory at this path is also left alone —
+            // someone else (npm, yarn) seeded it and we shouldn't clobber.
+            let existsHere = false;
+            try {
+                lstatSync(linkPath);
+                existsHere = true;
+            }
+            catch {
+                /* ENOENT */
+            }
+            if (existsHere)
+                continue;
+            mkdirSync(dirname(linkPath), { recursive: true });
+            const relTarget = relative(dirname(linkPath), ws.location);
+            symlinkSync(relTarget, linkPath);
+            rootHoisted++;
+        }
+        if (rootHoisted > 0) {
+            console.log(`gjsify install: hoisted ${rootHoisted} workspace(s) to root node_modules/`);
+        }
+    };
+    // Wire workspace↔workspace symlinks EARLY too — same rationale as the bin
+    // shims. These symlinks point at local workspace source trees and never
+    // depend on the external download, yet they USED to run only at the tail
+    // of the install. An interrupted/timed-out external fetch then left the
+    // tree with NO workspace symlinks at all, so cross-package imports
+    // (`@gjsify/native-fs-bridge` → `@gjsify/native-platform`) failed to
+    // resolve even though every package was on disk. Materialising them here
+    // makes workspace resolution survive a failed external phase. Safe to run
+    // before `installPackages`: that phase only fetches NON-workspace names
+    // (workspace-named deps are routed to symlinks and excluded from
+    // `externalSpecs`), and `extractOne` only `rm`s the individual external
+    // package dest it is about to write — never a workspace symlink.
+    await wireWorkspaceSymlinks();
     // Read top-level package.json's `overrides` (npm-native) or `resolutions`
     // (yarn-native, kept as the existing field name in pre-Phase-D.8 repos).
     // Flat `name → range` entries become global overrides applied to every
@@ -506,112 +634,13 @@ async function workspaceInstall(cwd, args, signal) {
             signal,
         });
     }
-    // Workspace symlink wiring — pre-dedup the parent-dir mkdirs (every
-    // symlink for the same workspace shares a single `node_modules` parent),
-    // then run the per-link rm + symlink steps with bounded concurrency.
-    // Pure sync loops here used to dominate the tail of large installs
-    // (~793 symlinks × ~10ms each for mkdir+rm+symlink = ~24s of serial
-    // syscalls). With async + a 32-wide pool the same set lands in 1-2s.
-    if (symlinks.length > 0) {
-        const fsp = await import('node:fs/promises');
-        const parentDirs = new Set();
-        const plans = [];
-        for (const link of symlinks) {
-            const target = byName.get(link.fromWorkspaceName);
-            if (!target)
-                continue;
-            const linkPath = join(target.location, 'node_modules', link.depName);
-            parentDirs.add(dirname(linkPath));
-            const relTarget = relative(dirname(linkPath), link.targetLocation);
-            plans.push({ linkPath, relTarget });
-        }
-        // Phase 1: one mkdir per unique parent (max ~213 instead of ~793).
-        await Promise.all([...parentDirs].map((dir) => fsp.mkdir(dir, { recursive: true })));
-        // Phase 2: per-link rm + symlink, pooled. A semaphore-style cursor
-        // keeps the concurrent in-flight count bounded so we don't blow up
-        // the file-descriptor table on huge monorepos.
-        const SYMLINK_CONCURRENCY = 32;
-        let cursor = 0;
-        const workers = [];
-        const wireOne = async (linkPath, relTarget) => {
-            // Remove any prior entry — regular dir, broken symlink, file, or
-            // a normal symlink left over from a previous install.
-            // `{ recursive: true, force: true }` handles every shape (rm
-            // no-ops on missing paths under force; recursive covers dirs).
-            try {
-                await fsp.rm(linkPath, { recursive: true, force: true });
-            }
-            catch {
-                /* unexpected; symlink call below will surface the real
-                   cause if it persists. */
-            }
-            await fsp.symlink(relTarget, linkPath);
-        };
-        for (let i = 0; i < Math.min(SYMLINK_CONCURRENCY, plans.length); i++) {
-            workers.push((async () => {
-                while (true) {
-                    const idx = cursor++;
-                    if (idx >= plans.length)
-                        return;
-                    const p = plans[idx];
-                    if (!p)
-                        return;
-                    await wireOne(p.linkPath, p.relTarget);
-                }
-            })());
-        }
-        await Promise.all(workers);
-        console.log(`gjsify install: wired ${symlinks.length} workspace symlink(s)`);
-    }
-    // Hoist EVERY workspace package to the repo root's `node_modules/` so
-    // transitive workspace deps are reachable from any descendant via
-    // standard Node parent-walk resolution. yarn's `nodeLinker: node-modules`
-    // does the same thing — the entire workspace graph is materialised at
-    // the root, which is how rolldown's resolver finds e.g.
-    // `@gjsify/abort-controller/register` injected from a deeply-nested
-    // package's `node_modules/.cache/gjsify/` cache file when the consumer
-    // didn't declare a direct dep on it (auto-globals injection at build
-    // time).
-    //
-    // Without this hoist, each workspace's `node_modules/` only contains
-    // its direct declared deps, and any auto-injected register import for
-    // a workspace package the consumer didn't list as a dep externalises
-    // and the bundle fails at runtime with `Module not found`.
-    const rootBinDir = join(cwd, 'node_modules');
-    let rootHoisted = 0;
-    for (const ws of workspaces) {
-        // Skip the root workspace itself (its location IS cwd; it can't
-        // symlink itself into its own node_modules).
-        if (ws.location === cwd)
-            continue;
-        if (!ws.name)
-            continue;
-        const linkPath = join(rootBinDir, ws.name);
-        // If a symlink already exists here (from the per-workspace loop
-        // above when the root workspace declared this dep directly), it
-        // already points at the right place — skip. We don't try to
-        // remove + recreate because under GJS's Gio-backed fs polyfill,
-        // `rmSync` on a symlink can race with `symlinkSync` and surface
-        // EEXIST. A real directory at this path is also left alone —
-        // someone else (npm, yarn) seeded it and we shouldn't clobber.
-        let existsHere = false;
-        try {
-            lstatSync(linkPath);
-            existsHere = true;
-        }
-        catch {
-            /* ENOENT */
-        }
-        if (existsHere)
-            continue;
-        mkdirSync(dirname(linkPath), { recursive: true });
-        const relTarget = relative(dirname(linkPath), ws.location);
-        symlinkSync(relTarget, linkPath);
-        rootHoisted++;
-    }
-    if (rootHoisted > 0) {
-        console.log(`gjsify install: hoisted ${rootHoisted} workspace(s) to root node_modules/`);
-    }
+    // Re-wire workspace symlinks once more now that the external + scoped
+    // installs are done. The EARLY pass above already created them so workspace
+    // resolution survives a failed external phase; this final idempotent pass
+    // is a cheap safety net in case any later step disturbed one (the per-link
+    // rm+symlink re-establishes them, the root hoist skips entries that already
+    // exist — so it's a near no-op when nothing changed).
+    await wireWorkspaceSymlinks();
     // Re-write workspace bins into `node_modules/.bin/` now that the tree is
     // fully materialized. The early pass at the top of this function already
     // guaranteed the shims exist; this final pass refreshes their GJS-preamble

package/lib/commands/trust.d.ts

@@ -0,0 +1,16 @@
+import type { Command } from '../types/index.js';
+import { type TrustEntry } from '../utils/trust-registry.js';
+interface TrustOptions {
+    packages?: string[];
+    repository?: string;
+    workflow: string;
+    environment?: string;
+    registry?: string;
+    otp?: string;
+    'dry-run'?: boolean;
+    force?: boolean;
+    list?: boolean;
+    'no-private'?: boolean;
+}
+export declare const trustCommand: Command<unknown, TrustOptions>;
+export type { TrustEntry };

package/lib/commands/trust.js

@@ -0,0 +1,306 @@
+// `gjsify trust [packages..]` — configure npm "Trusted Publishers" (OIDC /
+// GitHub Actions) for publishable workspace packages, natively (no `npm`).
+//
+// npm Trusted Publishing is configured PER PACKAGE against the registry's
+// trust API (npm >= 11.10). This command sweeps every publishable workspace
+// (same discovery as `gjsify foreach` / `publish`), skips packages already
+// trusted for this repo+workflow, reports unpublished ones separately, and
+// POSTs the GitHub config for the rest — so `.github/workflows/release.yml`
+// can publish via OIDC with no long-lived NPM_TOKEN.
+//
+// 2FA: the registry challenges with 401 + `www-authenticate: otp`. We send a
+// TOTP via the `npm-otp` header (prompted on demand, or `--otp`), matching
+// `gjsify login`'s legacy/header-OTP path — no browser web-auth flow. After
+// one successful OTP the registry opens a ~5-min skip window, so subsequent
+// packages go through without re-prompting; when it lapses we re-prompt.
+//
+// Reference: refs/npm-cli/lib/trust-cmd.js + lib/commands/trust/github.js.
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { DEFAULT_REGISTRY, buildHeaders, registryFor, whoami } from '@gjsify/npm-registry';
+import { discoverWorkspaces, filterWorkspaces } from '@gjsify/workspace';
+import { hasAnyCredential, loadNpmrc } from '../utils/load-npmrc.js';
+import { promptLine } from '../utils/prompt.js';
+import { classifyTrustList, githubTrustBody, normalizeWorkflowFile, parseRepoFromGitRemote, trustUrl, validateRepository, } from '../utils/trust-registry.js';
+export const trustCommand = {
+    command: 'trust [packages..]',
+    description: 'Configure npm Trusted Publishers (OIDC/GitHub Actions) for publishable workspace packages so release.yml can publish without a token. Native — no `npm` needed. Incremental: skips already-configured packages.',
+    builder: (yargs) => yargs
+        .positional('packages', {
+        description: 'Optional package-name globs to limit the sweep (default: all publishable workspaces).',
+        type: 'string',
+        array: true,
+    })
+        .option('repository', {
+        description: 'GitHub repo as `owner/repo`. Default: inferred from the `origin` git remote.',
+        type: 'string',
+    })
+        .option('workflow', {
+        description: 'Workflow filename allowed to publish (basename only).',
+        type: 'string',
+        default: 'release.yml',
+    })
+        .option('environment', {
+        description: 'Optional GitHub Actions environment the workflow must run in.',
+        type: 'string',
+    })
+        .option('registry', {
+        description: `Registry override. Default: scope-aware lookup from .npmrc (falls back to ${DEFAULT_REGISTRY}).`,
+        type: 'string',
+    })
+        .option('otp', {
+        description: 'npm 2FA one-time code; sent as `npm-otp`. Prompted on demand if omitted.',
+        type: 'string',
+    })
+        .option('dry-run', {
+        description: 'List what would be configured without writing anything.',
+        type: 'boolean',
+        default: false,
+    })
+        .option('force', {
+        description: 'Re-POST the config even for packages already trusted for this repo+workflow.',
+        type: 'boolean',
+        default: false,
+    })
+        .option('list', {
+        description: 'Only report each package’s current trust state; configure nothing.',
+        type: 'boolean',
+        default: false,
+    })
+        .option('private', {
+        description: 'Include private workspaces (default false — private packages are not publishable).',
+        type: 'boolean',
+        default: false,
+    }),
+    handler: async (args) => {
+        const cwd = process.cwd();
+        const npmrc = await loadNpmrc(cwd);
+        if (!hasAnyCredential(npmrc)) {
+            console.error('gjsify trust: no npm token configured. Run `gjsify login` first.');
+            process.exit(1);
+        }
+        // Pre-flight: a present-but-DEAD token would otherwise surface as a
+        // confusing per-package `401 "You must be logged in to publish
+        // packages"`. Probe `/-/whoami` once and fail early with the real fix.
+        // (Skipped for --dry-run, which never writes.) `whoami` throws on a
+        // 401/non-2xx and returns `{}` on a dead-but-200 token — both are dead.
+        const probeRegistry = args.registry ?? process.env.npm_config_registry ?? npmrc.registry ?? DEFAULT_REGISTRY;
+        if (args['dry-run'] !== true) {
+            let who;
+            try {
+                who = await whoami(probeRegistry, npmrc);
+            }
+            catch (e) {
+                const msg = e instanceof Error ? e.message : String(e);
+                console.error(`gjsify trust: npm auth check failed (${msg}).\n` +
+                    'Your ~/.npmrc token is dead or revoked — refresh it with `npm login`, then re-run.\n' +
+                    '(`gjsify trust` uses the ~/.npmrc bearer token directly — unlike `npm trust`, which logs in via the browser.)');
+                process.exit(1);
+                return;
+            }
+            if (!who.username) {
+                console.error('gjsify trust: your npm token appears dead or revoked (registry returned an empty whoami).\n' +
+                    'Refresh it with `npm login`, then re-run.');
+                process.exit(1);
+            }
+            console.log(`gjsify trust: authenticated as ${who.username}`);
+        }
+        // Repository: flag wins, else infer from the origin remote.
+        let repository = args.repository;
+        if (!repository) {
+            const r = spawnSync('git', ['remote', 'get-url', 'origin'], { cwd, encoding: 'utf8' });
+            if (r.status === 0)
+                repository = parseRepoFromGitRemote(r.stdout) ?? undefined;
+        }
+        if (!repository) {
+            console.error('gjsify trust: could not determine the GitHub repository.\n' +
+                'Pass --repository owner/repo (no `origin` remote to infer from).');
+            process.exit(1);
+        }
+        if (!validateRepository(repository)) {
+            console.error(`gjsify trust: --repository must be "owner/repo", got "${repository}".`);
+            process.exit(1);
+        }
+        const workflow = normalizeWorkflowFile(args.workflow);
+        const environment = args.environment;
+        const listOnly = args.list === true;
+        const dryRun = args['dry-run'] === true;
+        const force = args.force === true;
+        // Warn (don't fail) if the workflow file isn't present — the trust
+        // config is still valid, but a typo'd workflow name silently never
+        // publishes, so surface it.
+        const wfPath = join(cwd, '.github', 'workflows', workflow);
+        if (!existsSync(wfPath)) {
+            console.warn(`gjsify trust: note — ${wfPath} not found; configuring trust for "${workflow}" anyway.`);
+        }
+        // Publishable workspaces: non-private by default, optionally name-filtered.
+        const all = discoverWorkspaces(cwd, { includeRoot: true });
+        const selected = filterWorkspaces(all, {
+            noPrivate: args.private !== true,
+            include: args.packages && args.packages.length > 0 ? args.packages : undefined,
+        }).filter((ws) => ws.name);
+        if (selected.length === 0) {
+            console.error('gjsify trust: no publishable workspace packages matched.');
+            process.exit(1);
+        }
+        console.log(`gjsify trust: ${selected.length} package(s) | repo=${repository} workflow=${workflow}`);
+        if (dryRun)
+            console.log('(dry-run — nothing will be written)');
+        console.log();
+        // A one-shot OTP supplied via --otp, used on the FIRST challenge then
+        // cleared (a TOTP code is single-use within its ~30s window). After the
+        // first successful OTP the registry opens a ~5-min skip window, so we
+        // do NOT cache + re-send the code — that would re-challenge once it
+        // expires. Instead each request tries WITHOUT an OTP first (the window
+        // covers it) and only prompts when actually challenged. Mirrors npm's
+        // `otplease`.
+        let pendingOtp = args.otp;
+        const request = async (method, url, body) => {
+            const doFetch = async (code) => {
+                const headers = buildHeaders(url, { npmrc });
+                headers['accept'] = 'application/json';
+                if (body !== undefined)
+                    headers['content-type'] = 'application/json';
+                if (code)
+                    headers['npm-otp'] = code;
+                return fetch(url, {
+                    method,
+                    headers,
+                    body: body === undefined ? undefined : JSON.stringify(body),
+                });
+            };
+            // 1) Try without an OTP — succeeds outright (read) or via an active
+            //    2FA-skip window.
+            let res = await doFetch();
+            // 2) On a challenge, use the --otp (once) or prompt, and retry.
+            if (await isOtpChallenge(res)) {
+                let code = pendingOtp;
+                pendingOtp = undefined; // one-shot — never reuse a stale code
+                if (!code) {
+                    code = await promptLine('This operation requires a one-time password.\nEnter OTP: ');
+                }
+                if (!code) {
+                    console.error('gjsify trust: no OTP entered.');
+                    process.exit(1);
+                }
+                res = await doFetch(code);
+                // 3) Still challenged → the code was stale/expired. Prompt fresh once.
+                if (await isOtpChallenge(res)) {
+                    const fresh = await promptLine('OTP rejected (expired?) — enter a fresh code: ');
+                    if (!fresh) {
+                        console.error('gjsify trust: no OTP entered.');
+                        process.exit(1);
+                    }
+                    res = await doFetch(fresh);
+                }
+            }
+            const text = await res.text().catch(() => '');
+            let json = undefined;
+            try {
+                json = text ? JSON.parse(text) : undefined;
+            }
+            catch {
+                /* non-JSON body — leave json undefined */
+            }
+            return { status: res.status, json, text };
+        };
+        let ok = 0;
+        let skipped = 0;
+        let unpublished = 0;
+        let failed = 0;
+        const needsPublish = [];
+        const failures = [];
+        for (const ws of selected) {
+            const name = ws.name;
+            const registry = args.registry ?? registryFor(name, npmrc) ?? DEFAULT_REGISTRY;
+            const url = trustUrl(registry, name);
+            process.stdout.write(`→ ${name.padEnd(42)} `);
+            // Read current state.
+            const listed = await request('GET', url);
+            const state = classifyTrustList(listed.status, listed.json, { repository, workflow });
+            if (listOnly) {
+                if (state === 'trusted')
+                    console.log('trusted');
+                else if (state === 'unpublished')
+                    console.log('unpublished');
+                else if (state === 'auth-required')
+                    console.log('auth-required (could not read)');
+                else if (state === 'untrusted')
+                    console.log('not trusted');
+                else
+                    console.log(`error (HTTP ${listed.status})`);
+                continue;
+            }
+            if (state === 'trusted' && !force) {
+                console.log('already configured — skip');
+                skipped++;
+                continue;
+            }
+            if (state === 'unpublished') {
+                console.log('not on npm yet — needs first-publish, skip');
+                unpublished++;
+                needsPublish.push(name);
+                continue;
+            }
+            if (dryRun) {
+                console.log('would configure');
+                ok++;
+                continue;
+            }
+            // Configure.
+            const body = githubTrustBody({ repository, workflow, environment });
+            const created = await request('POST', url, body);
+            if (created.status >= 200 && created.status < 300) {
+                console.log('configured');
+                ok++;
+            }
+            else if (created.status === 409) {
+                // Exact config already exists — idempotent, not a failure.
+                console.log('already configured (409) — done');
+                skipped++;
+            }
+            else if (created.status === 404) {
+                console.log('not on npm yet — needs first-publish, skip');
+                unpublished++;
+                needsPublish.push(name);
+            }
+            else {
+                console.log(`FAILED (HTTP ${created.status})`);
+                failed++;
+                failures.push(`${name} — HTTP ${created.status}${created.text ? `: ${firstLine(created.text)}` : ''}`);
+            }
+        }
+        if (listOnly)
+            return;
+        console.log();
+        console.log(`Done: ${ok} ${dryRun ? 'would-configure' : 'configured'}, ${skipped} already-configured, ${unpublished} unpublished, ${failed} failed.`);
+        if (needsPublish.length > 0) {
+            console.log('Need a first publish before they can be trust-configured (then re-run `gjsify trust`):');
+            for (const n of needsPublish)
+                console.log(`  ${n}`);
+        }
+        if (failures.length > 0) {
+            console.log('Failed (re-run `gjsify trust` — it is incremental; usually a lapsed 2FA window or rate-limit):');
+            for (const f of failures)
+                console.log(`  ${f}`);
+            process.exit(1);
+        }
+    },
+};
+/** True when a response is an npm OTP / 2FA challenge. */
+async function isOtpChallenge(res) {
+    if (res.status !== 401)
+        return false;
+    const wwwAuth = (res.headers.get('www-authenticate') ?? '').toLowerCase();
+    if (wwwAuth.includes('otp'))
+        return true;
+    const text = await res
+        .clone()
+        .text()
+        .catch(() => '');
+    return /one-time pass/i.test(text) || /\bEOTP\b/.test(text);
+}
+function firstLine(s) {
+    return s.split('\n')[0].slice(0, 200);
+}

package/lib/utils/prompt.js

@@ -69,10 +69,13 @@ function readLine() {
         let buf = '';
         const onData = (chunk) => {
             buf += typeof chunk === 'string' ? chunk : chunk.toString('utf-8');
-            const nl = buf.indexOf('\n');
-            if (nl >= 0) {
+            // Accept CR, LF, or CRLF as the line terminator. A bare CR (`\r`)
+            // is what some terminals / the GJS terminal-native stdin deliver on
+            // Enter — keying only on `\n` made the prompt hang forever there.
+            const m = buf.search(/[\r\n]/);
+            if (m >= 0) {
                 cleanup();
-                resolve(buf.slice(0, nl).replace(/\r$/, ''));
+                resolve(buf.slice(0, m));
             }
         };
         const onEnd = () => {