@izykitten/ce 0.0.3-dev.8 → 0.0.3-dev.9

package/README.md

@@ -52,7 +52,30 @@ ce bun publish                         # direct publication with Bun
 ce bun --stage publish ./package.tgz    # npm staging; no Bun executable is needed
 ```
 
-Staging always runs [`npm stage publish`](https://docs.npmjs.com/cli/v12/commands/npm-stage), using npm's configuration and lifecycle scripts. It requires an npm version with that command (CI uses 12.2.1). Direct publication uses the requested client and its existing authentication. Ce neither probes token permissions nor retries a failed publish through another mode. The CI workflow always selects staging; direct publication remains an explicit publishing command outside that workflow.
+Staging always runs [`npm stage publish`](https://docs.npmjs.com/cli/v12/commands/npm-stage), using npm's configuration and lifecycle scripts. It requires an npm version with that command (CI uses 12.2.1). Direct publication uses the requested client. Existing authentication remains in effect unless one of ce's authentication options is selected. Ce does not retry a failed publish through another mode. The CI workflow stages npmjs releases and publishes directly to Forgejo.
+
+For npm token authentication, name the environment variable that holds the token and pass an explicit native registry:
+
+```sh
+ce npm --token-env=NODE_AUTH_TOKEN --stage publish ./package.tgz \
+  --registry=https://registry.npmjs.org/
+```
+
+Ce supplies a registry/path-scoped token through npm's child-process environment. It preserves existing npm configuration and writes no credential files. It checks authentication with `npm whoami` before publishing; `--no-check-auth` skips that probe, and `--check-auth` enables it again. The credentials are passed only to the npm backend, including `ce bun --stage`; direct Bun publishing continues to use Bun's authentication. Native configuration retains its normal precedence, including scoped registry mappings. Ce's `--dry-run` previews the command without reading the token, authenticating, or running lifecycle scripts.
+
+Forgejo's integrated npm registry can use the same Actions OIDC exchange as Docker login:
+
+```yaml
+enable-openid-connect: true
+env:
+  AUD: your-authorized-integration-audience
+steps:
+  - run: >-
+      ce npm --forgejo-oidc publish ./package.tgz
+      --registry=${{ forgejo.server_url }}/api/packages/${{ forgejo.repository_owner }}/npm/
+```
+
+`--forgejo-oidc` reads `AUD`, `ACTIONS_ID_TOKEN_REQUEST_URL` and `ACTIONS_ID_TOKEN_REQUEST_TOKEN`, fetches a JWT through ce's existing token exchange, and scopes it to the selected npm registry. The registry and token endpoint must have the same HTTP(S) origin. Tokens expiring within five minutes are refused. The JWT is fetched immediately before authentication/publication; npm receives a fixed token for that invocation. No credentials are saved and no static-token fallback occurs. Forgejo has no npm staging or `whoami` endpoint, so this mode requires direct npm publication and skips the authentication probe by default. Use `--check-auth` only for a compatible endpoint. The two authentication modes are mutually exclusive; existing native `ce npm login` behavior is unchanged.
 
 Without an explicit tag, ce reads the selected package's version and infers the first prerelease label: `1.2.3-dev.8` gives `dev`, `1.2.3-rc.1` gives `rc`. Stable versions receive no injected tag, preserving the client's normal defaults and npm's check against implicitly moving `latest` to an older version. Numeric labels, version-like labels and the prerelease label `latest` require an explicit `--tag`.
 
@@ -320,9 +343,9 @@ Compared with the Python version:
 
 [The Forgejo build workflow](.forgejo/workflows/build.yml) builds, type-checks and tests PRs, pushes to `main` and `dev`, version tags (`v*`), and manual runs. Every successful build uploads the packed npm tarball as an artifact.
 
-Version-tag pushes also authenticate with the repository's `NPM_TOKEN` Actions secret and stage that exact tarball using `ce npm --stage publish`. The Git tag must match `v` followed by the version in `package.json`. Ce infers a prerelease's channel from the packed version; stable versions keep npm's native default and version checks. For a manual run, select **stage** to request staging and optionally set **npm_tag** to override the dist-tag. Manual runs without **stage** build, check and upload the package artifact.
+Version-tag pushes publish that exact tarball to the repository owner's Forgejo npm registry with `ce npm --forgejo-oidc publish`, then stage it on npmjs with `ce npm --token-env=NODE_AUTH_TOKEN --stage publish`. The Git tag must match `v` followed by the version in `package.json`. Ce infers a prerelease's channel from the packed version; stable versions keep npm's native default and version checks. For a manual run, select **stage** to request both release uploads and optionally set **npm_tag** to override the dist-tag. Manual runs without **stage** build, check and upload the package artifact.
 
-Use a granular npm token with read/write access to `@izykitten/ce`; a [stage-only token](https://docs.npmjs.com/about-access-tokens#about-stage-only-tokens) keeps final publication dependent on maintainer approval. The workflow configures token authentication without interactive `npm login`, verifies it with `npm whoami`, and removes its temporary npm configuration when the staging step exits. The token is available only to that step, which does not run on PRs or ordinary branch pushes.
+The job enables Forgejo OIDC. Its public `AUD` identifies the Authorized Integration whose backend permissions must allow publication to this repository's package registry. The Forgejo step requires no static registry token. For npmjs, use a granular `NPM_TOKEN` with read/write access to `@izykitten/ce`; a [stage-only token](https://docs.npmjs.com/about-access-tokens#about-stage-only-tokens) keeps final publication dependent on maintainer approval. Ce configures the token and verifies authentication without interactive `npm login` or temporary credential files. `NPM_TOKEN` is available only to the npmjs staging step. Neither release step runs on PRs or ordinary branch pushes.
 
 CI runs `npm stage publish`, which [uploads a pending version without publishing it](https://docs.npmjs.com/cli/v12/commands/npm-stage). Review and approve the staged version in npm's dashboard with your own authentication. Staged and published versions share the same version namespace: bump `package.json` to an unused version before staging, and use the matching `v...` Git tag for an automatic release run. The workflow uses npm 12.2.1 for staging and never runs the approval command.
 

package/dist/ce.js

@@ -350,8 +350,8 @@ function envFlag(name, unset = false, allowed = "true or false") {
 function shellQuote(arg) {
   return /^[A-Za-z0-9_@%+=:,./-]+$/u.test(arg) ? arg : `'${arg.replaceAll("'", `'\\''`)}'`;
 }
-function childEnv() {
-  return Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined));
+function childEnv(overrides = {}) {
+  return Object.fromEntries(Object.entries({ ...process.env, ...overrides }).filter((entry) => entry[1] !== undefined));
 }
 function which(command) {
   const candidates = command.includes("/") ? [command] : (process.env.PATH ?? "").split(path3.delimiter).filter(Boolean).map((dir) => path3.join(dir, command));
@@ -366,11 +366,11 @@ function which(command) {
 }
 var system = {
   which,
-  run(argv, input) {
+  run(argv, input, env) {
     const result = spawnSync(argv[0], argv.slice(1), {
       input,
       stdio: [input === undefined ? "ignore" : "pipe", "ignore", "pipe"],
-      env: childEnv(),
+      env: childEnv(env),
       encoding: "utf8",
       maxBuffer: Infinity
     });
@@ -392,13 +392,13 @@ var system = {
   sleepSync(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
   },
-  exec(file, argv) {
+  exec(file, argv, env) {
     const resolved = system.which(file);
     if (!resolved) {
       logError(`ce: ${file} not found on PATH`);
       return 1;
     }
-    process.execve(resolved, argv, childEnv());
+    process.execve(resolved, argv, childEnv(env));
     throw new Error(`execve returned for ${file}`);
   }
 };
@@ -2885,6 +2885,17 @@ function parseCeOptions(given, options, tool) {
       use(arg, "publishing");
       options.stage = true;
       argv = argv.slice(1);
+    } else if (arg === "--token-env" || arg?.startsWith("--token-env=")) {
+      use("--token-env", "publishing");
+      options.tokenEnv = value("--token-env");
+    } else if (arg === "--forgejo-oidc") {
+      use(arg, "publishing");
+      options.forgejoOidc = true;
+      argv = argv.slice(1);
+    } else if (arg === "--check-auth" || arg === "--no-check-auth") {
+      use(arg, "publishing");
+      options.checkAuth = arg === "--check-auth";
+      argv = argv.slice(1);
     } else if (arg === "--auto-tag" || arg === "--no-auto-tag") {
       use(arg, "publishing");
       options.autoTag = arg === "--auto-tag";
@@ -2900,6 +2911,62 @@ function parseCeOptions(given, options, tool) {
 // src/publish.ts
 import fs6 from "node:fs";
 import path5 from "node:path";
+
+// src/npm-auth.ts
+function registryUrl(registry) {
+  if (!registry)
+    throw new CeError("ce: token authentication requires an explicit native --registry");
+  let url;
+  try {
+    url = new URL(registry);
+    if (!["http:", "https:"].includes(url.protocol) || !url.hostname || url.username || url.password || url.search || url.hash || /[\u0000-\u0020\\=]/u.test(registry))
+      throw new Error("invalid registry");
+  } catch {
+    throw new CeError("ce: token authentication requires an absolute HTTP(S) registry URL without credentials, query, fragment, whitespace, backslashes or equals signs");
+  }
+  if (!url.pathname.endsWith("/"))
+    url.pathname += "/";
+  return url;
+}
+function credentials(url, token) {
+  return {
+    registry: url.href,
+    env: { [`npm_config_//${url.host}${url.pathname}:_authToken`]: token },
+    token
+  };
+}
+function npmAuth(registry, tokenEnv, preview) {
+  if (!/^[A-Za-z_][A-Za-z\d_]*$/u.test(tokenEnv))
+    throw new CeError("ce: --token-env requires an environment variable name");
+  const url = registryUrl(registry);
+  const token = preview ? "" : process.env[tokenEnv];
+  if (!preview && (!token || /[\s\p{Cc}]/u.test(token)))
+    throw new CeError(`ce: ${tokenEnv} must contain a nonempty npm token without control characters`);
+  return credentials(url, token ?? "");
+}
+async function forgejoNpmAuth(registry, preview) {
+  const url = registryUrl(registry);
+  const audience = process.env.AUD;
+  const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+  const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+  if (!audience || !requestUrl || !preview && !requestToken)
+    throw new CeError("ce: Forgejo npm OIDC requires AUD, ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN; enable-openid-connect must be enabled for the job");
+  try {
+    const request = new URL(requestUrl);
+    if (request.username || request.password || request.origin !== url.origin)
+      throw new Error("different server");
+  } catch {
+    throw new CeError("ce: Forgejo npm registry and OIDC token request must use the same HTTP(S) origin without URL credentials");
+  }
+  if (preview)
+    return credentials(url, "");
+  const token = await forgejoOidcJwt(audience, requestUrl, requestToken);
+  if (needsRefresh(jwtExpiry(token)))
+    throw new CeError("ce: Forgejo OIDC token expires within the five-minute window; refusing to publish");
+  return credentials(url, token);
+}
+
+// src/publish.ts
 function isPackageManager(value) {
   return value === "npm" || value === "bun";
 }
@@ -2934,7 +3001,8 @@ var VALUES = new Set([
   "--omit",
   "--cpu",
   "--os",
-  "--libc"
+  "--libc",
+  "--token-env"
 ]);
 var SWITCHES = new Set([
   "--dry-run",
@@ -2978,7 +3046,28 @@ var WORKSPACES = new Set([
   "--recursive",
   "-r"
 ]);
-var CE_FLAGS = new Set(["--stage", "--auto-tag", "--no-auto-tag"]);
+var CE_FLAGS = new Set([
+  "--stage",
+  "--auto-tag",
+  "--no-auto-tag",
+  "--token-env",
+  "--check-auth",
+  "--no-check-auth",
+  "--forgejo-oidc"
+]);
+var AUTH_CONFIG = new Set([
+  "--userconfig",
+  "--globalconfig",
+  "--cafile",
+  "--ca",
+  "--cache",
+  "--prefix",
+  "--loglevel",
+  "--logs-dir",
+  "--use-system-ca",
+  "--use-openssl-ca",
+  "--use-bundled-ca"
+]);
 var PORTABLE_STAGE = new Set([
   "--tag",
   "--access",
@@ -3112,13 +3201,14 @@ function inferTag(data) {
     throw new CeError(`ce: prerelease ${JSON.stringify(data.version)} needs an explicit --tag; its first label is ambiguous or promotes latest`);
   return channel;
 }
-function runPackageManager(manager, given, options = {}) {
+async function runPackageManager(manager, given, options = {}) {
   const dryRun = options.dryRun ?? envFlag("CE_DRY_RUN");
   const command = invocation(manager, given);
   if (options.stage && !command)
     throw new CeError("ce: --stage requires npm publish or bun publish");
   const staged = options.stage || command?.staged;
   const client = staged ? "npm" : manager;
+  const help = given.some((arg) => ["--help", "-h", "--version"].includes(arg));
   let args = given;
   if (command) {
     for (let i = 0;i < given.length; ) {
@@ -3141,7 +3231,6 @@ function runPackageManager(manager, given, options = {}) {
         i = arg.startsWith("-") ? nextIndex(given, i) : i + 1;
       }
     }
-    const help = given.some((arg) => ["--help", "-h", "--version"].includes(arg));
     if ((options.autoTag ?? true) && !help && !explicitTag(given) && !(client === "npm" && (process.env.npm_config_tag || process.env.NPM_CONFIG_TAG))) {
       const tag = inferTag(manifest(manager, prefix, body));
       if (tag)
@@ -3153,6 +3242,38 @@ function runPackageManager(manager, given, options = {}) {
       ...body
     ];
   }
+  let auth;
+  const authConfig = [];
+  if (!help && (options.tokenEnv !== undefined || options.checkAuth !== undefined || options.forgejoOidc)) {
+    if (!command || client !== "npm")
+      throw new CeError("ce: token authentication requires npm publish or bun --stage publish");
+    if (options.tokenEnv !== undefined && options.forgejoOidc)
+      throw new CeError("ce: choose --token-env or --forgejo-oidc, not both");
+    if (options.tokenEnv === undefined && !options.forgejoOidc)
+      throw new CeError("ce: --check-auth and --no-check-auth require --token-env or --forgejo-oidc");
+    if (options.forgejoOidc && staged)
+      throw new CeError("ce: the Forgejo npm registry does not support staged publishing; use direct publish");
+    let registry;
+    for (let i = 0;i < args.length; ) {
+      const arg = args[i];
+      if (arg === "--")
+        break;
+      const end = arg.startsWith("-") ? nextIndex(args, i) : i + 1;
+      if (option(arg) === "--registry")
+        registry = {
+          index: i,
+          joined: arg.includes("="),
+          value: arg.includes("=") ? arg.slice(arg.indexOf("=") + 1) : args[i + 1]
+        };
+      if (AUTH_CONFIG.has(option(arg)))
+        authConfig.push(...args.slice(i, end));
+      i = end;
+    }
+    auth = options.forgejoOidc ? await forgejoNpmAuth(registry?.value, dryRun) : npmAuth(registry?.value, options.tokenEnv, dryRun);
+    args = [...args];
+    if (registry)
+      args[registry.joined ? registry.index : registry.index + 1] = registry.joined ? `--registry=${auth.registry}` : auth.registry;
+  }
   if (dryRun) {
     if (!system.which(client))
       logError(`ce: warning: ${client} is not on PATH, so running this here would fail`);
@@ -3160,7 +3281,19 @@ function runPackageManager(manager, given, options = {}) {
 `);
     return 0;
   }
-  return system.exec(client, [client, ...args]);
+  if (auth && (options.checkAuth ?? !options.forgejoOidc)) {
+    if (!system.which("npm")) {
+      logError("ce: npm not found on PATH");
+      return 1;
+    }
+    const result = system.run(["npm", "whoami", ...authConfig, `--registry=${auth.registry}`], undefined, auth.env);
+    if (result.status !== 0) {
+      logError(`ce: npm authentication failed for ${auth.registry}`);
+      io.stderr(result.stderr.replaceAll(auth.token, "[REDACTED]"));
+      return result.status;
+    }
+  }
+  return auth ? system.exec(client, [client, ...args], auth.env) : system.exec(client, [client, ...args]);
 }
 
 // src/cli.ts
@@ -3213,6 +3346,15 @@ Publishing options (npm and bun):
                       Explicit --tag and publishConfig.tag take precedence.
                       With npm, npm_config_tag/NPM_CONFIG_TAG also take precedence.
                       Stable versions retain the native tag default and checks.
+    --token-env=NAME  Configure npm token authentication from an environment
+                      variable for this invocation. Requires native --registry.
+                      Supports npm and Bun staging; saves no credentials.
+    --forgejo-oidc    Fetch a Forgejo JWT using AUD and the Actions OIDC request
+                      variables. Requires npm direct publish and --registry
+                      on the same server; saves no credentials. No staging.
+    --no-check-auth   Skip the npm whoami check enabled by --token-env.
+    --check-auth      Enable that check (off by default for Forgejo).
+                      Requires --token-env or --forgejo-oidc.
     Examples:
         ce npm --stage publish ./package.tgz
         ce bun publish --tag next
@@ -3317,6 +3459,8 @@ async function main(argv) {
       throw new CeError("ce: login takes no native arguments; use ce <engine> login, or place ce options before login");
     if (options.used.has("--stage"))
       throw new CeError("ce: --stage requires npm publish or bun publish");
+    if (options.tokenEnv !== undefined || options.checkAuth !== undefined || options.forgejoOidc)
+      throw new CeError("ce: token authentication requires npm publish or bun --stage publish");
     return login(undefined, options.dryRun ?? envFlag("CE_DRY_RUN"));
   }
   if (command === "credential-helper")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@izykitten/ce",
-  "version": "0.0.3-dev.8",
+  "version": "0.0.3-dev.9",
   "description": "CI wrapper for container builds and npm/Bun publishing, with tag/cache rewriting, registry login, and a Forgejo OIDC Docker credential helper",
   "type": "module",
   "license": "BSD-3-Clause",