@ozyman42/ozy-cli 0.0.4 → 0.1.0

package/dist/index.js

@@ -2784,7 +2784,7 @@ var require_ssh_config2 = __commonJS((exports) => {
   exports.default = ssh_config_1.default;
 });
 // package.json
-var version = "0.0.4";
+var version = "0.1.0";
 
 // node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
@@ -2815,9 +2815,13 @@ function log(...stuff) {
 // src/common/command.ts
 function makeCommand(name, description, action) {
   return new Command(name).description(description).action(async () => {
-    const result = await action();
-    if (!result.success) {
-      log(`${result.error}: ${result.reason}`);
+    try {
+      const result = await action();
+      if (!result.success) {
+        log(`\u2717 ${result.error}: ${result.reason}`);
+      }
+    } catch (err) {
+      log(`\u2717 unexpected error: ${err instanceof Error ? err.message : String(err)}`);
     }
     process.exit();
   });
@@ -8446,9 +8450,435 @@ var git = new Command("git").summary("setup git in repo for verified commits");
   git.addCommand(cmd);
 });
 
+// src/commands/npm/setup/index.ts
+var {$: $6 } = globalThis.Bun;
+import { existsSync as existsSync4 } from "fs";
+
+// src/commands/npm/setup/npm-auth.ts
+var {$: $3 } = globalThis.Bun;
+import { readFileSync, writeFileSync, unlinkSync } from "fs";
+import { homedir } from "os";
+var npmrcPath = `${homedir()}/.npmrc`;
+var TOKEN_RE = /^\/\/registry\.npmjs\.org\/:_authToken=(\S+)$/m;
+function readNpmrc() {
+  try {
+    return readFileSync(npmrcPath, "utf8");
+  } catch {
+    return "";
+  }
+}
+function stripTokenFromDisk() {
+  const content = readNpmrc();
+  const stripped = content.replace(TOKEN_RE, "").replace(/\n{3,}/g, `
+
+`).trim();
+  if (!stripped) {
+    try {
+      unlinkSync(npmrcPath);
+    } catch {}
+  } else {
+    writeFileSync(npmrcPath, stripped + `
+`);
+  }
+}
+async function whoamiWithToken(token) {
+  const result = await $3`npm whoami`.env({ ...process.env, NODE_AUTH_TOKEN: token }).quiet().nothrow();
+  if (result.exitCode !== 0)
+    return null;
+  return result.stdout.toString().trim();
+}
+async function acquireToken() {
+  const existing = readNpmrc().match(TOKEN_RE)?.[1];
+  if (existing) {
+    const user2 = await whoamiWithToken(existing);
+    if (user2) {
+      stripTokenFromDisk();
+      return { token: existing, user: user2 };
+    }
+  }
+  log("  not logged in \u2014 opening npm login...");
+  await $3`npm login`.nothrow();
+  const token = readNpmrc().match(TOKEN_RE)?.[1];
+  if (!token)
+    throw new Error('npm login did not produce a token \u2014 try running "npm login" manually');
+  const user = await whoamiWithToken(token);
+  if (!user)
+    throw new Error("npm login succeeded but token verification failed");
+  stripTokenFromDisk();
+  return { token, user };
+}
+
+// src/commands/npm/setup/package-registry.ts
+async function fetchPackageInfo(name) {
+  const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}`);
+  if (res.status === 404)
+    return null;
+  if (!res.ok)
+    throw new Error(`registry error ${res.status} for ${name}`);
+  const data = await res.json();
+  return {
+    name: data.name,
+    latestVersion: data["dist-tags"]?.latest,
+    distTags: data["dist-tags"] ?? {}
+  };
+}
+
+// src/commands/npm/setup/trusted-publishing.ts
+var {$: $4 } = globalThis.Bun;
+import { createInterface } from "readline";
+function encodePackageName(name) {
+  if (!name.startsWith("@"))
+    return encodeURIComponent(name);
+  const slash = name.indexOf("/");
+  return `@${name.slice(1, slash)}%2F${name.slice(slash + 1)}`;
+}
+function promptPasscode() {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve5) => {
+    rl.question("  enter the passcode from the browser: ", (answer) => {
+      rl.close();
+      resolve5(answer.trim());
+    });
+  });
+}
+async function registryPost(url, body, authToken, { existingOtp, alreadyExistsStatus } = {}) {
+  const headers = {
+    Authorization: `Bearer ${authToken}`,
+    "Content-Type": "application/json"
+  };
+  const post = (otp) => fetch(url, {
+    method: "POST",
+    headers: otp ? { ...headers, "npm-otp": otp } : headers,
+    body
+  });
+  const check = (res2) => {
+    if (res2.ok)
+      return true;
+    if (alreadyExistsStatus && res2.status === alreadyExistsStatus)
+      return true;
+    return false;
+  };
+  if (existingOtp) {
+    const res2 = await post(existingOtp);
+    if (check(res2))
+      return { otp: existingOtp, alreadyExists: !res2.ok };
+  }
+  let res = await post();
+  if (check(res))
+    return { otp: undefined, alreadyExists: !res.ok };
+  if (res.status === 401) {
+    const notice = res.headers.get("npm-notice") ?? "";
+    const loginUrl = notice.match(/https:\/\/www\.npmjs\.com\/login\/[a-f0-9-]+/)?.[0];
+    if (!loginUrl)
+      throw new Error("2FA required but could not parse login URL");
+    await $4`open ${loginUrl}`.quiet().nothrow();
+    const otp = await promptPasscode();
+    res = await post(otp);
+    if (check(res))
+      return { otp, alreadyExists: !res.ok };
+  }
+  throw new Error(`${res.status} ${await res.text()}`);
+}
+async function addTrustedPublisher(name, ownerRepo, token, environment = "prod") {
+  const encoded = encodePackageName(name);
+  log("  setting up (may require 2FA)...");
+  const body = JSON.stringify([{
+    type: "github",
+    claims: { repository: ownerRepo, workflow_ref: { file: "publish.yml" }, environment },
+    permissions: ["createPackage"]
+  }]);
+  try {
+    const { otp, alreadyExists } = await registryPost(`https://registry.npmjs.org/-/package/${encoded}/trust`, body, token, { alreadyExistsStatus: 409 });
+    return { alreadyConfigured: alreadyExists, otp };
+  } catch (e) {
+    throw new Error(`trust setup failed: ${e.message}`);
+  }
+}
+async function setPackageAccessPolicy(name, token, existingOtp) {
+  const encoded = encodePackageName(name);
+  const body = JSON.stringify({ publish_requires_tfa: true, automation_token_overrides_tfa: false });
+  try {
+    await registryPost(`https://registry.npmjs.org/-/package/${encoded}/access`, body, token, { existingOtp });
+  } catch (e) {
+    throw new Error(`access policy setup failed: ${e.message}`);
+  }
+}
+
+// src/commands/npm/setup/git-remote.ts
+var {$: $5 } = globalThis.Bun;
+function parseGithubOwnerRepo(url) {
+  const https = url.match(/github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?$/);
+  if (https)
+    return { owner: https[1], repo: https[2] };
+  const alias = url.match(/^[^:]+:([^/]+)\/([^/]+?)(?:\.git)?$/);
+  if (alias)
+    return { owner: alias[1], repo: alias[2] };
+  return null;
+}
+async function checkGitHubAccess(remoteUrl) {
+  const parsed = parseGithubOwnerRepo(remoteUrl);
+  if (!parsed)
+    return null;
+  const result = await $5`gh api repos/${parsed.owner}/${parsed.repo}`.quiet().nothrow();
+  if (result.exitCode !== 0)
+    return null;
+  let data;
+  try {
+    data = JSON.parse(result.stdout.toString());
+  } catch {
+    return null;
+  }
+  return { ...parsed, canPush: data?.permissions?.push === true };
+}
+
+// src/commands/npm/setup/workflow.ts
+import * as fs3 from "fs/promises";
+import * as path from "path";
+
+// src/commands/npm/setup/publish-workflow.yml
+var publish_workflow_default = `name: Publish to npm
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch: {}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: prod
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Build
+        run: bun run build
+
+      - name: Publish
+        run: npm publish dist/ --access public
+`;
+
+// src/commands/npm/setup/workflow.ts
+var WORKFLOW_PATH = ".github/workflows/publish.yml";
+async function workflowExists(repoRoot) {
+  try {
+    await fs3.access(path.join(repoRoot, WORKFLOW_PATH));
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function createWorkflow(repoRoot) {
+  const fullPath = path.join(repoRoot, WORKFLOW_PATH);
+  await fs3.mkdir(path.dirname(fullPath), { recursive: true });
+  await fs3.writeFile(fullPath, publish_workflow_default, "utf8");
+}
+
+// src/commands/npm/setup/package-json-validate.ts
+var GITHUB_URL_RE = /^git\+https:\/\/github\.com\/[^/]+\/[^/]+\.git$/;
+function isValidGitHubUrl(url) {
+  return GITHUB_URL_RE.test(url);
+}
+function validatePackageJson(pkg) {
+  const issues = [];
+  const repoUrl = typeof pkg.repository === "object" ? pkg.repository?.url : pkg.repository;
+  if (!repoUrl) {
+    issues.push({ field: "repository", issue: "missing \u2014 required for provenance" });
+  } else if (!isValidGitHubUrl(repoUrl)) {
+    issues.push({ field: "repository.url", issue: `not a valid GitHub URL (got "${repoUrl}")` });
+  }
+  if (pkg.publishConfig?.access !== "public") {
+    issues.push({ field: "publishConfig.access", issue: 'should be "public"' });
+  }
+  if (pkg.publishConfig?.provenance !== true) {
+    issues.push({ field: "publishConfig.provenance", issue: "should be true" });
+  }
+  if (!pkg.version) {
+    issues.push({ field: "version", issue: 'missing \u2014 add a "version" field (e.g. "0.0.1")', fatal: true });
+  }
+  if (!pkg.scripts?.build) {
+    issues.push({ field: "scripts.build", issue: 'missing \u2014 add a "build" script before running setup', fatal: true });
+  }
+  if (!pkg.files?.includes("dist")) {
+    issues.push({ field: "files", issue: `"dist" not included \u2014 built output won't be published` });
+  }
+  return issues;
+}
+
+// src/commands/npm/setup/index.ts
+var setup2 = makeCommand("setup", "configure a new npm package for publishing", async () => {
+  const cwd = process.cwd();
+  log("checking npm...");
+  const npmCheck = await $6`which npm`.quiet().nothrow();
+  if (npmCheck.exitCode !== 0) {
+    return Err("NpmNotFound" /* NpmNotFound */, '"npm" not found in PATH \u2014 install Node.js from nodejs.org');
+  }
+  const npmVersion = (await $6`npm --version`.quiet().nothrow()).stdout.toString().trim();
+  const [major, minor] = npmVersion.split(".").map(Number);
+  if (major < 11 || major === 11 && minor < 10) {
+    return Err("NpmNotFound" /* NpmNotFound */, `npm ${npmVersion} is too old \u2014 "npm trust" requires 11.10.0+ (run "npm install -g npm")`);
+  }
+  let npmToken, npmUser;
+  try {
+    ({ token: npmToken, user: npmUser } = await acquireToken());
+  } catch (e) {
+    return Err("NotLoggedIn" /* NotLoggedIn */, `npm authentication failed: ${e.message}`);
+  }
+  log(`  \u2713 logged in as ${npmUser}`);
+  log("checking GitHub...");
+  const ghCheck = await $6`which gh`.quiet().nothrow();
+  if (ghCheck.exitCode !== 0) {
+    return Err("GhNotFound" /* GhNotFound */, '"gh" not found in PATH \u2014 install GitHub CLI from cli.github.com');
+  }
+  let ghUser = await $6`gh api user --jq .login`.quiet().nothrow();
+  if (ghUser.exitCode !== 0) {
+    log("  not logged in \u2014 opening gh auth login...");
+    await $6`gh auth login`.nothrow();
+    ghUser = await $6`gh api user --jq .login`.quiet().nothrow();
+  }
+  if (ghUser.exitCode !== 0) {
+    return Err("NotLoggedIn" /* NotLoggedIn */, 'not logged into GitHub \u2014 run "gh auth login"');
+  }
+  log(`  \u2713 logged in as ${ghUser.stdout.toString().trim()}`);
+  log("checking git repo...");
+  if (!existsSync4(`${cwd}/.git`)) {
+    return Err("NoGitRepo" /* NoGitRepo */, 'current directory is not a git repository \u2014 run "git init" first');
+  }
+  log("  \u2713 git repo");
+  log("checking package.json...");
+  const pkgFile = Bun.file(`${cwd}/package.json`);
+  if (!await pkgFile.exists()) {
+    return Err("NoPackageJson" /* NoPackageJson */, "no package.json found \u2014 run this command from a package directory");
+  }
+  let pkg;
+  try {
+    pkg = await pkgFile.json();
+  } catch {
+    return Err("InvalidPackageJson" /* InvalidPackageJson */, "package.json contains invalid JSON \u2014 fix it and retry");
+  }
+  const { name } = pkg;
+  if (!name) {
+    return Err("InvalidPackageJson" /* InvalidPackageJson */, 'package.json is missing a "name" field');
+  }
+  log(`  name: ${name}`);
+  const fatal = validatePackageJson(pkg).find((i) => i.fatal);
+  if (fatal) {
+    return Err("InvalidPackageJson" /* InvalidPackageJson */, `${fatal.field}: ${fatal.issue}`);
+  }
+  log("checking git remote...");
+  const remote = await getRemoteUrl(cwd);
+  if (!remote) {
+    return Err("NoGitRemote" /* NoGitRemote */, 'no git remote configured \u2014 run "git remote add origin <url>" first');
+  }
+  log(`  remote: ${remote}`);
+  const access2 = await checkGitHubAccess(remote);
+  if (!access2) {
+    return Err("RepoNotFound" /* RepoNotFound */, `could not reach GitHub repo at ${remote} \u2014 check "gh auth status"`);
+  }
+  if (!access2.canPush) {
+    return Err("NoWriteAccess" /* NoWriteAccess */, `no push access to ${access2.owner}/${access2.repo} \u2014 you need write permissions`);
+  }
+  const repoHttpsUrl = `https://github.com/${access2.owner}/${access2.repo}`;
+  log(`  \u2713 ${access2.owner}/${access2.repo} (write access confirmed)`);
+  const expectedRepoUrl = `git+${repoHttpsUrl}.git`;
+  const currentRepoUrl = typeof pkg.repository === "object" ? pkg.repository?.url : pkg.repository;
+  if (currentRepoUrl !== expectedRepoUrl) {
+    log("syncing package.json repository URL...");
+    log(`  was: ${currentRepoUrl ?? "(missing)"}`);
+    pkg = { ...pkg, repository: { type: "git", url: expectedRepoUrl } };
+    await Bun.write(`${cwd}/package.json`, JSON.stringify(pkg, null, 2) + `
+`);
+    log(`  \u2713 set to ${expectedRepoUrl}`);
+  }
+  const nonFatal = validatePackageJson(pkg).filter((i) => !i.fatal);
+  if (nonFatal.length > 0) {
+    log("package.json issues (fix manually):");
+    for (const { field, issue } of nonFatal)
+      log(`  ${field}: ${issue}`);
+  }
+  log("checking publish workflow...");
+  if (!await workflowExists(cwd)) {
+    await createWorkflow(cwd);
+    log("  \u2713 created .github/workflows/publish.yml");
+  } else {
+    log("  \u2713 already exists");
+  }
+  log("checking npm registry...");
+  const info = await fetchPackageInfo(name).catch((err) => {
+    throw new Error(`npm registry lookup failed: ${err.message}`);
+  });
+  if (!info) {
+    log("  package not yet published \u2014 building and creating initial release...");
+    const buildResult = await $6`bun run build`.nothrow();
+    if (buildResult.exitCode !== 0) {
+      throw new Error(`build failed: ${buildResult.stderr.toString().trim()}`);
+    }
+    const distPkgFile = Bun.file(`${cwd}/dist/package.json`);
+    if (!await distPkgFile.exists()) {
+      throw new Error("build succeeded but dist/package.json is missing \u2014 build script must produce it");
+    }
+    try {
+      await distPkgFile.json();
+    } catch {
+      throw new Error("dist/package.json exists but contains invalid JSON \u2014 check your build script");
+    }
+    await npmPublish(npmToken);
+    log(`  \u2713 published ${name}`);
+  } else {
+    const version2 = info.latestVersion ?? "(unknown)";
+    log(`  \u2713 exists (latest v${version2})`);
+  }
+  log("checking trusted publishing...");
+  const ownerRepo = `${access2.owner}/${access2.repo}`;
+  const trust = await addTrustedPublisher(name, ownerRepo, npmToken);
+  log(trust.alreadyConfigured ? "  \u2713 already configured" : "  \u2713 configured");
+  log("setting package access policy...");
+  await setPackageAccessPolicy(name, npmToken, trust.otp);
+  log("  \u2713 configured");
+  return Ok(true);
+});
+async function getRemoteUrl(cwd) {
+  const result = await $6`git -C ${cwd} remote get-url origin`.quiet().nothrow();
+  if (result.exitCode !== 0)
+    return;
+  return result.stdout.toString().trim();
+}
+async function npmPublish(token) {
+  const proc = Bun.spawn(["npm", "publish", "dist/", "--access", "public", "--no-provenance"], {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    env: { ...process.env, NODE_AUTH_TOKEN: token }
+  });
+  const exitCode = await proc.exited;
+  if (exitCode !== 0)
+    throw new Error("npm publish failed \u2014 see output above");
+}
+
+// src/commands/npm/index.ts
+var npm = new Command("npm").summary("npm package management utilities");
+[setup2].forEach((cmd) => {
+  npm.addCommand(cmd);
+});
+
 // src/commands/index.ts
 program.name("ozy").version(version);
-[git].forEach((cmd) => {
+[git, npm].forEach((cmd) => {
   program.addCommand(cmd);
 });
 program.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ozyman42/ozy-cli",
-  "version": "0.0.4",
+  "version": "0.1.0",
   "description": "Ozymandias' personal tools",
   "type": "module",
   "bin": {