@gjsify/cli 0.6.1 → 0.7.2

package/lib/utils/trust-registry.d.ts

@@ -0,0 +1,71 @@
+/** `<registry>/-/package/<@scope%2fname>/trust`. */
+export declare function trustUrl(registry: string, pkgName: string): string;
+/** `<trustUrl>/<id>` for revoke (the id is path-encoded). */
+export declare function trustRevokeUrl(registry: string, pkgName: string, id: string): string;
+export interface GithubTrustClaims {
+    repository: string;
+    workflow_ref: {
+        file: string;
+    };
+    environment?: string;
+}
+export declare const PERMISSION_PUBLISH = "createPackage";
+export declare const PERMISSION_STAGE_PUBLISH = "createStagedPackage";
+export interface GithubTrustConfig {
+    type: 'github';
+    claims: GithubTrustClaims;
+    permissions: string[];
+}
+/** A single entry as returned by the list endpoint. */
+export interface TrustEntry {
+    id?: string;
+    type?: string;
+    claims?: {
+        repository?: string;
+        workflow_ref?: {
+            file?: string;
+        };
+        environment?: string;
+    };
+}
+/**
+ * The POST body for `trust github`. npm always sends an ARRAY with a single
+ * config object carrying `type`, `claims` AND `permissions` (the last is
+ * required — `--allow-publish` → `['createPackage']`).
+ */
+export declare function githubTrustBody(opts: {
+    repository: string;
+    workflow: string;
+    environment?: string;
+    permissions?: string[];
+}): GithubTrustConfig[];
+/** npm requires the workflow as a bare basename (no directory), `.yml`/`.yaml`. */
+export declare function normalizeWorkflowFile(wf: string): string;
+/** `owner/repo` — exactly two non-empty segments. */
+export declare function validateRepository(repo: string): boolean;
+/** True when an existing trust entry already grants THIS repo + workflow. */
+export declare function matchesGithubTrust(entry: TrustEntry, opts: {
+    repository: string;
+    workflow: string;
+}): boolean;
+export type TrustState = 'trusted' | 'untrusted' | 'unpublished' | 'auth-required' | 'error';
+/**
+ * Classify a `trust list` response against the desired repo+workflow.
+ *   404 → unpublished (package not on the registry yet)
+ *   401 → auth-required (OTP / lapsed 2FA-skip window — can't tell the state)
+ *   2xx + array with a matching github entry → trusted
+ *   2xx + array without a match → untrusted (publish, but not for us)
+ *   anything else → error
+ */
+export declare function classifyTrustList(status: number, body: unknown, opts: {
+    repository: string;
+    workflow: string;
+}): TrustState;
+/**
+ * Derive `owner/repo` from a git remote URL. Handles the common GitHub forms:
+ *   git@github.com:owner/repo.git
+ *   ssh://git@github.com/owner/repo.git
+ *   https://github.com/owner/repo(.git)
+ * Returns null when it can't confidently extract two segments.
+ */
+export declare function parseRepoFromGitRemote(url: string): string | null;

package/lib/utils/trust-registry.js

@@ -0,0 +1,110 @@
+// Pure helpers for the npm "Trusted Publishers" (OIDC) registry API, used by
+// `gjsify trust`. The wire contract mirrors npm's `trust` command (npm >= 11.10):
+//
+//   list:   GET    <registry>/-/package/<escaped>/trust            -> [{id,type,claims}]
+//   github: POST   <registry>/-/package/<escaped>/trust            body: [{type,claims}]
+//   revoke: DELETE <registry>/-/package/<escaped>/trust/<id>
+//
+// Everything here is side-effect-free so it can be unit-tested without a
+// network; the command (commands/trust.ts) does the fetch + OTP orchestration.
+// Reference: refs/npm-cli/lib/trust-cmd.js + lib/commands/trust/*.js.
+import { escapePackageName } from './publish-headers.js';
+/** `<registry>/-/package/<@scope%2fname>/trust`. */
+export function trustUrl(registry, pkgName) {
+    const base = registry.endsWith('/') ? registry.slice(0, -1) : registry;
+    return `${base}/-/package/${escapePackageName(pkgName)}/trust`;
+}
+/** `<trustUrl>/<id>` for revoke (the id is path-encoded). */
+export function trustRevokeUrl(registry, pkgName, id) {
+    return `${trustUrl(registry, pkgName)}/${encodeURIComponent(id)}`;
+}
+// Registry permission tokens (npm >= 11.10, the 2026-05-20 trust-API change).
+// `createPackage` is what `--allow-publish` grants; `createStagedPackage` is
+// `--allow-stage-publish`. The registry rejects a config with no permissions
+// (`400 "permissions is required and must contain at least one valid route"`).
+export const PERMISSION_PUBLISH = 'createPackage';
+export const PERMISSION_STAGE_PUBLISH = 'createStagedPackage';
+/**
+ * The POST body for `trust github`. npm always sends an ARRAY with a single
+ * config object carrying `type`, `claims` AND `permissions` (the last is
+ * required — `--allow-publish` → `['createPackage']`).
+ */
+export function githubTrustBody(opts) {
+    const claims = {
+        repository: opts.repository,
+        workflow_ref: { file: normalizeWorkflowFile(opts.workflow) },
+    };
+    if (opts.environment)
+        claims.environment = opts.environment;
+    const permissions = opts.permissions && opts.permissions.length > 0 ? opts.permissions : [PERMISSION_PUBLISH];
+    return [{ type: 'github', claims, permissions }];
+}
+/** npm requires the workflow as a bare basename (no directory), `.yml`/`.yaml`. */
+export function normalizeWorkflowFile(wf) {
+    const base = wf.split('/').pop() ?? wf;
+    return base;
+}
+/** `owner/repo` — exactly two non-empty segments. */
+export function validateRepository(repo) {
+    const parts = repo.split('/');
+    return parts.length === 2 && parts[0].length > 0 && parts[1].length > 0;
+}
+/** True when an existing trust entry already grants THIS repo + workflow. */
+export function matchesGithubTrust(entry, opts) {
+    if (entry.type !== 'github')
+        return false;
+    const repo = entry.claims?.repository;
+    const file = entry.claims?.workflow_ref?.file;
+    return repo === opts.repository && file === normalizeWorkflowFile(opts.workflow);
+}
+/**
+ * Classify a `trust list` response against the desired repo+workflow.
+ *   404 → unpublished (package not on the registry yet)
+ *   401 → auth-required (OTP / lapsed 2FA-skip window — can't tell the state)
+ *   2xx + array with a matching github entry → trusted
+ *   2xx + array without a match → untrusted (publish, but not for us)
+ *   anything else → error
+ */
+export function classifyTrustList(status, body, opts) {
+    if (status === 404)
+        return 'unpublished';
+    if (status === 401)
+        return 'auth-required';
+    if (status >= 200 && status < 300) {
+        const entries = Array.isArray(body) ? body : [];
+        return entries.some((e) => matchesGithubTrust(e, opts)) ? 'trusted' : 'untrusted';
+    }
+    return 'error';
+}
+/**
+ * Derive `owner/repo` from a git remote URL. Handles the common GitHub forms:
+ *   git@github.com:owner/repo.git
+ *   ssh://git@github.com/owner/repo.git
+ *   https://github.com/owner/repo(.git)
+ * Returns null when it can't confidently extract two segments.
+ */
+export function parseRepoFromGitRemote(url) {
+    let s = url.trim();
+    if (!s)
+        return null;
+    // Strip a trailing .git
+    s = s.replace(/\.git$/, '');
+    // scp-like: git@host:owner/repo
+    const scp = s.match(/^[^/@]+@[^:]+:(.+)$/);
+    if (scp) {
+        return twoSegments(scp[1]);
+    }
+    // URL forms: ssh://, https://, http://, git://
+    const m = s.match(/^[a-z]+:\/\/[^/]+\/(.+)$/i);
+    if (m) {
+        return twoSegments(m[1]);
+    }
+    return null;
+}
+function twoSegments(path) {
+    const parts = path.split('/').filter((p) => p.length > 0);
+    if (parts.length < 2)
+        return null;
+    // owner/repo are the LAST two segments (handles nested groups → take repo + its owner)
+    return `${parts[parts.length - 2]}/${parts[parts.length - 1]}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/cli",
-    "version": "0.6.1",
+    "version": "0.7.2",
     "description": "CLI for Gjsify",
     "type": "module",
     "main": "lib/index.js",
@@ -120,19 +120,19 @@
         "cli"
     ],
     "dependencies": {
-        "@gjsify/buffer": "^0.6.1",
-        "@gjsify/create-app": "^0.6.1",
-        "@gjsify/node-globals": "^0.6.1",
-        "@gjsify/node-polyfills": "^0.6.1",
-        "@gjsify/npm-registry": "^0.6.1",
-        "@gjsify/resolve-npm": "^0.6.1",
-        "@gjsify/rolldown-plugin-gjsify": "^0.6.1",
-        "@gjsify/rolldown-plugin-pnp": "^0.6.1",
-        "@gjsify/semver": "^0.6.1",
-        "@gjsify/tar": "^0.6.1",
-        "@gjsify/tsc": "^0.6.1",
-        "@gjsify/web-polyfills": "^0.6.1",
-        "@gjsify/workspace": "^0.6.1",
+        "@gjsify/buffer": "^0.7.2",
+        "@gjsify/create-app": "^0.7.2",
+        "@gjsify/node-globals": "^0.7.2",
+        "@gjsify/node-polyfills": "^0.7.2",
+        "@gjsify/npm-registry": "^0.7.2",
+        "@gjsify/resolve-npm": "^0.7.2",
+        "@gjsify/rolldown-plugin-gjsify": "^0.7.2",
+        "@gjsify/rolldown-plugin-pnp": "^0.7.2",
+        "@gjsify/semver": "^0.7.2",
+        "@gjsify/tar": "^0.7.2",
+        "@gjsify/tsc": "^0.7.2",
+        "@gjsify/web-polyfills": "^0.7.2",
+        "@gjsify/workspace": "^0.7.2",
         "cosmiconfig": "^9.0.2",
         "get-tsconfig": "^4.14.0",
         "pkg-types": "^2.3.1",
@@ -140,13 +140,13 @@
         "yargs": "^18.0.0"
     },
     "devDependencies": {
-        "@gjsify/unit": "^0.6.1",
+        "@gjsify/unit": "^0.7.2",
         "@types/yargs": "^17.0.35",
         "typescript": "^6.0.3"
     },
     "peerDependencies": {
-        "@gjsify/oxfmt-native": "^0.6.1",
-        "@gjsify/rolldown-native": "^0.6.1"
+        "@gjsify/oxfmt-native": "^0.7.2",
+        "@gjsify/rolldown-native": "^0.7.2"
     },
     "peerDependenciesMeta": {
         "@gjsify/oxfmt-native": {