@lpm-registry/cli 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.2.2] - 2026-03-16
+
+### Added
+
+- `publish.sh` script for automated linting, testing, and publishing to npm
+- Local project scanning for test files during quality checks — authors no longer need to ship test files in the tarball to earn quality points
+- Registry-scoped token storage — dev and production tokens no longer overwrite each other
+
+### Changed
+
+- Token storage is now scoped per registry URL with automatic migration from legacy un-scoped keys
+- Quality check "Has test files" now scans the local project directory instead of only the tarball contents
+
 ## [0.2.1] - 2026-03-12
 
 ### Added

package/lib/commands/publish.js

@@ -308,6 +308,48 @@ async function packWithTar(ecosystem, name, version) {
 	}
 }
 
+/**
+ * Scan local project directory for test files.
+ * This avoids requiring test files in the tarball to earn quality points.
+ * Uses a limited-depth scan, skipping known non-source directories.
+ */
+function scanProjectForTestFiles() {
+	const skipDirs = new Set([
+		"node_modules",
+		".git",
+		"dist",
+		"build",
+		".next",
+		".nuxt",
+		"coverage",
+		".lpm",
+	])
+
+	const result = []
+
+	function walk(dir, depth = 0) {
+		if (depth > 4) return
+		let entries
+		try {
+			entries = fs.readdirSync(dir, { withFileTypes: true })
+		} catch {
+			return
+		}
+		for (const entry of entries) {
+			if (entry.isDirectory()) {
+				if (!skipDirs.has(entry.name)) {
+					walk(path.join(dir, entry.name), depth + 1)
+				}
+			} else if (entry.isFile()) {
+				result.push({ path: path.join(dir, entry.name) })
+			}
+		}
+	}
+
+	walk(process.cwd())
+	return result
+}
+
 export async function publish(options = {}) {
 	const checkOnly = !!options.check
 	const dryRun = !!options.dryRun
@@ -468,11 +510,13 @@ export async function publish(options = {}) {
 
 		// 7. Run quality checks and display report
 		spinner.text = "Running quality checks..."
+		const projectFiles = scanProjectForTestFiles()
 		const qualityResult = runQualityChecks({
 			packageJson: pkg,
 			readme,
 			lpmConfig,
 			files: npmPackMeta.files || [],
+			projectFiles,
 			unpackedSize: npmPackMeta.unpackedSize,
 			ecosystem,
 			swiftManifest,

package/lib/config.js

@@ -64,6 +64,7 @@ export function clearTransientToken() {
 /**
  * Get the stored auth token from secure storage.
  * Priority: transient (OIDC) > LPM_TOKEN env var > secure storage > legacy storage
+ * Tokens are scoped per registry URL so dev and production don't collide.
  * @returns {Promise<string | null>}
  */
 export async function getToken() {
@@ -74,15 +75,17 @@ export async function getToken() {
 	const envToken = process.env.LPM_TOKEN
 	if (envToken) return envToken
 
-	// Try secure store
-	const secureToken = await secureGetToken()
+	const registryUrl = getRegistryUrl()
+
+	// Try secure store (registry-scoped)
+	const secureToken = await secureGetToken(registryUrl)
 	if (secureToken) return secureToken
 
-	// Migration: check if token exists in old storage
+	// Migration: check if token exists in old Conf storage
 	const legacyToken = config.get("token")
 	if (legacyToken) {
-		// Migrate to secure storage
-		await secureSetToken(legacyToken)
+		// Migrate to secure storage (scoped to current registry)
+		await secureSetToken(legacyToken, registryUrl)
 		config.delete("token")
 		return legacyToken
 	}
@@ -91,26 +94,27 @@ export async function getToken() {
 }
 
 /**
- * Set the auth token in secure storage.
+ * Set the auth token in secure storage (scoped to current registry).
  * @param {string | null} token
  * @returns {Promise<void>}
  */
 export async function setToken(token) {
+	const registryUrl = getRegistryUrl()
 	if (token === null) {
-		await secureClearToken()
+		await secureClearToken(registryUrl)
 	} else {
-		await secureSetToken(token)
+		await secureSetToken(token, registryUrl)
 	}
 	// Ensure legacy token is cleared
 	config.delete("token")
 }
 
 /**
- * Clear the auth token from secure storage.
+ * Clear the auth token from secure storage (scoped to current registry).
  * @returns {Promise<void>}
  */
 export async function clearToken() {
-	await secureClearToken()
+	await secureClearToken(getRegistryUrl())
 	config.delete("token")
 }
 

package/lib/quality/checks.js

@@ -336,8 +336,11 @@ const hasTestFiles = {
 	category: "testing",
 	label: "Has test files",
 	maxPoints: 7,
-	run: ({ files }) => {
-		const testFiles = files.filter(f => {
+	run: ({ projectFiles, files }) => {
+		// Prefer projectFiles (local project scan) over files (tarball)
+		// so authors don't need to ship test files in the package
+		const fileList = projectFiles || files
+		const testFiles = fileList.filter(f => {
 			const name = (f.path || f).toLowerCase()
 			return (
 				name.includes(".test.") ||

package/lib/quality/display.js

@@ -76,6 +76,14 @@ export function displayQualityReport({ score, checks, meta }) {
 		}
 	}
 
+	if (failed.length > 0 && score < 90) {
+		console.log(
+			chalk.dim(
+				"  Use the lpm-guide skill in your AI editor to improve quality and prepare for publish",
+			),
+		)
+	}
+
 	// Score summary at the end
 	console.log("")
 	console.log(

package/lib/quality/score.js

@@ -37,6 +37,7 @@ function getChecksForEcosystem(ecosystem) {
  * @param {string|null} params.readme - README content
  * @param {object|null} params.lpmConfig - Parsed lpm.config.json
  * @param {Array} params.files - File list (each has .path)
+ * @param {Array} [params.projectFiles] - Local project file list for test detection
  * @param {number} [params.unpackedSize] - Unpacked size in bytes
  * @param {string} [params.ecosystem] - Ecosystem identifier (default: "js")
  * @param {object} [params.swiftManifest] - Parsed Swift manifest metadata (for Swift packages)
@@ -47,6 +48,7 @@ export function runQualityChecks({
 	readme,
 	lpmConfig,
 	files,
+	projectFiles,
 	unpackedSize,
 	ecosystem = "js",
 	swiftManifest,
@@ -57,6 +59,7 @@ export function runQualityChecks({
 		readme,
 		lpmConfig,
 		files,
+		projectFiles,
 		unpackedSize,
 		swiftManifest,
 		xcframeworkMeta,

package/lib/secure-store.js

@@ -259,30 +259,63 @@ export async function isUsingKeychain() {
 }
 
 // ============================================================================
-// Token-Specific Helpers
+// Token-Specific Helpers (Registry-Aware)
 // ============================================================================
 
 /**
- * Get the stored auth token.
+ * Build a registry-scoped key for token storage.
+ * Each registry URL gets its own token slot so dev and production
+ * tokens don't overwrite each other.
+ * @param {string} [registryUrl]
+ * @returns {string}
+ */
+function tokenKey(registryUrl) {
+	if (!registryUrl) return KEYTAR_ACCOUNT_NAME
+	return `${KEYTAR_ACCOUNT_NAME}:${registryUrl}`
+}
+
+/**
+ * Get the stored auth token for a specific registry.
+ * Falls back to the legacy un-scoped key and migrates it forward.
+ * @param {string} [registryUrl] - Registry URL to scope the token to
  * @returns {Promise<string | null>}
  */
-export async function getToken() {
-	return getSecret(KEYTAR_ACCOUNT_NAME)
+export async function getToken(registryUrl) {
+	const key = tokenKey(registryUrl)
+
+	// Try registry-scoped key first
+	const scoped = await getSecret(key)
+	if (scoped) return scoped
+
+	// Migration: if legacy un-scoped token exists, migrate it to the
+	// default registry key (production) so existing logins keep working
+	if (registryUrl) {
+		const legacy = await getSecret(KEYTAR_ACCOUNT_NAME)
+		if (legacy) {
+			await setSecret(key, legacy)
+			await deleteSecret(KEYTAR_ACCOUNT_NAME)
+			return legacy
+		}
+	}
+
+	return null
 }
 
 /**
- * Set the auth token.
+ * Set the auth token for a specific registry.
  * @param {string} token
+ * @param {string} [registryUrl] - Registry URL to scope the token to
  * @returns {Promise<void>}
  */
-export async function setToken(token) {
-	return setSecret(KEYTAR_ACCOUNT_NAME, token)
+export async function setToken(token, registryUrl) {
+	return setSecret(tokenKey(registryUrl), token)
 }
 
 /**
- * Clear the auth token.
+ * Clear the auth token for a specific registry.
+ * @param {string} [registryUrl] - Registry URL to scope the token to
  * @returns {Promise<boolean>}
  */
-export async function clearToken() {
-	return deleteSecret(KEYTAR_ACCOUNT_NAME)
+export async function clearToken(registryUrl) {
+	return deleteSecret(tokenKey(registryUrl))
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@lpm-registry/cli",
-	"version": "0.2.1",
+	"version": "0.2.2",
 	"description": "CLI for Licensed Package Manager",
 	"author": "LPM <hello@lpm.dev> (https://lpm.dev)",
 	"repository": {