@lpm-registry/cli 0.2.3 → 0.2.4

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.2.4] - 2026-03-18
+
+### Added
+
+- **2FA support for publish** — CLI prompts for TOTP code before uploading when user or org has 2FA enabled. OIDC (CI/CD) tokens are exempt.
+- **Lifecycle scripts quality check** — New `no-lifecycle-scripts` check (2pts) flags packages with `preinstall`, `install`, `postinstall`, `preuninstall`, `uninstall`, or `postuninstall` scripts
+
+### Changed
+
+- Quality scoring rebalanced: `small-deps` 4pts→3pts, `has-exports-map` 4pts→3pts to accommodate the new lifecycle scripts check (total remains 100)
+- API client now passes through OTP-related 401/403 responses to callers instead of throwing generic auth errors
+
 ## [0.2.2] - 2026-03-16
 
 ### Added

package/lib/api.js

@@ -114,12 +114,31 @@ export async function request(path, options = {}) {
 			clearTimeout(timeoutId)
 
 			// Handle authentication errors immediately (no retry)
+			// Exception: 2FA OTP responses (401 with OTP_REQUIRED/OTP_INVALID code)
+			// must be returned to the caller so the publish handler can prompt for OTP
 			if (response.status === 401) {
+				const cloned = response.clone()
+				let data = {}
+				try {
+					data = await cloned.json()
+				} catch {
+					// Not JSON
+				}
+				if (data.code === "OTP_REQUIRED" || data.code === "OTP_INVALID") {
+					return response
+				}
 				throw new Error(ERROR_MESSAGES.notAuthenticated)
 			}
 
 			if (response.status === 403) {
-				const data = await response.json().catch(() => ({}))
+				const cloned403 = response.clone()
+				const data = await cloned403.json().catch(() => ({}))
+
+				// 2FA enforcement responses must be returned to the caller
+				if (data.code === "ORG_2FA_REQUIRED") {
+					return response
+				}
+
 				const errorMessage = data.error || "Access denied."
 
 				// Check for license/purchase required error

package/lib/commands/publish.js

@@ -692,6 +692,43 @@ export async function publish(options = {}) {
 			}
 		}
 
+		// 9.5. Pre-upload 2FA check — prompt for OTP BEFORE uploading the tarball
+		// This avoids uploading the entire tarball twice for large packages.
+		let otpCode = null
+		if (!oidcAvailable && whoami) {
+			const userHas2fa = whoami.mfa_enabled
+			const publishingOrg = whoami.organizations?.find(
+				org => org.slug === owner,
+			)
+			const orgRequires2fa = publishingOrg?.require_2fa
+
+			if (orgRequires2fa && !userHas2fa) {
+				spinner.stop()
+				log.error(
+					"This organization requires two-factor authentication. Enable 2FA in your account settings.",
+				)
+				process.exit(1)
+			}
+
+			if (userHas2fa || orgRequires2fa) {
+				spinner.stop()
+				otpCode = await p.text({
+					message: "Enter 2FA code",
+					placeholder: "123456",
+					validate: value => {
+						if (!/^\d{6}$/.test(value))
+							return "Enter a 6-digit code from your authenticator app"
+					},
+				})
+
+				if (p.isCancel(otpCode)) {
+					p.cancel("Publish cancelled.")
+					process.exit(0)
+				}
+				spinner.start()
+			}
+		}
+
 		// 10. Read tarball and generate integrity hashes
 		spinner.text = "Reading tarball..."
 		const tarballData = await readFileAsync(tarballPath)
@@ -761,12 +798,19 @@ export async function publish(options = {}) {
 			payload._ecosystem = ecosystem
 		}
 
+		const publishHeaders = {
+			"Content-Type": "application/json",
+		}
+
+		// Include OTP header if 2FA code was collected pre-upload
+		if (otpCode) {
+			publishHeaders["x-otp"] = otpCode
+		}
+
 		const response = await request(`/${encodeURIComponent(name)}`, {
 			method: "PUT",
 			body: JSON.stringify(payload),
-			headers: {
-				"Content-Type": "application/json",
-			},
+			headers: publishHeaders,
 			onRetry: (attempt, max) => {
 				spinner.text = `Uploading to registry (retry ${attempt}/${max})...`
 			},

package/lib/quality/checks.js

@@ -254,6 +254,35 @@ const noEval = {
 	},
 }
 
+const noLifecycleScripts = {
+	id: "no-lifecycle-scripts",
+	category: "health",
+	label: "No lifecycle scripts",
+	maxPoints: 2,
+	run: ({ packageJson }) => {
+		const lifecycleNames = [
+			"preinstall",
+			"install",
+			"postinstall",
+			"preuninstall",
+			"uninstall",
+			"postuninstall",
+		]
+		const scripts = packageJson.scripts || {}
+		const found = lifecycleNames.filter(name => scripts[name])
+		if (found.length === 0) {
+			return {
+				passed: true,
+				detail: "No lifecycle scripts detected",
+			}
+		}
+		return {
+			passed: false,
+			detail: `Lifecycle scripts found: ${found.join(", ")}`,
+		}
+	},
+}
+
 const hasEngines = {
 	id: "has-engines",
 	category: "code",
@@ -274,7 +303,7 @@ const hasExportsMap = {
 	id: "has-exports-map",
 	category: "code",
 	label: 'Has "exports" map',
-	maxPoints: 4,
+	maxPoints: 3,
 	run: ({ packageJson }) => {
 		const hasField = !!packageJson.exports
 		return {
@@ -290,16 +319,15 @@ const smallDeps = {
 	id: "small-deps",
 	category: "code",
 	label: "Small dependency footprint",
-	maxPoints: 4,
+	maxPoints: 3,
 	run: ({ packageJson }) => {
 		const deps = packageJson.dependencies
 			? Object.keys(packageJson.dependencies).length
 			: 0
 		let points
-		if (deps === 0) points = 4
-		else if (deps <= 3) points = 3
-		else if (deps <= 7) points = 2
-		else if (deps <= 15) points = 1
+		if (deps === 0) points = 3
+		else if (deps <= 3) points = 2
+		else if (deps <= 7) points = 1
 		else points = 0
 		return {
 			passed: points > 0,
@@ -610,6 +638,7 @@ export const checks = [
 	hasHomepage,
 	reasonableSize,
 	noVulnerabilities,
+	noLifecycleScripts,
 	maintenanceHealth,
 	semverConsistency,
 	authorVerified,
@@ -630,6 +659,7 @@ export {
 	hasHomepage,
 	reasonableSize,
 	noVulnerabilities,
+	noLifecycleScripts,
 	maintenanceHealth,
 	semverConsistency,
 	authorVerified,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@lpm-registry/cli",
-	"version": "0.2.3",
+	"version": "0.2.4",
 	"description": "CLI for Licensed Package Manager",
 	"author": "LPM <hello@lpm.dev> (https://lpm.dev)",
 	"repository": {