@ozyman42/ozy-cli 0.4.8-windows-x64.0 → 0.4.8

package/src/commands/git/setup.ts

@@ -0,0 +1,182 @@
+import { Command } from 'commander';
+import { Effect, Layer, Option, pipe } from 'effect';
+import { log } from '@/common/log';
+import { cliModules, type CLIModules } from '@/modules/cli';
+import { commonModules, CommonModules } from '@/modules/common';
+import { effunct, type EffectGen } from 'effective-modules';
+import { GitImpl } from '@/modules/cli/git/impl';
+import { GitHubImpl } from '@/modules/cli/github/impl';
+import { AgentClientImpl } from '@/modules/cli/agent-client/impl';
+import { OSPlatformImpl } from '@/modules/common/os-platform/impl';
+import { SSHConfigImpl } from '@/modules/common/ssh-config/impl';
+import { AGENT_SOCK_FILE_PATH, FUTURE_TOOL_NAME, STANDARD_REMOTE_PREFIX } from '../../common/constants';
+import { CredentialId } from '@/modules/common/crypto/impl';
+import { BunFileSystem } from "@effect/platform-bun";
+import type { GitUser } from '@/modules/cli/git/interface';
+
+type AllModules = CLIModules.Git | CLIModules.GitHub | CLIModules.AgentClient | CommonModules.SSHConfig;
+
+const GITHUB_CLIENT_ID = 'Ov23liKYxk1Ag7SsNhbP';
+const GITHUB_CLIENT_SECRET = 'e2901fbe93c591e7a53a903e70490ff87e998159';
+const OAUTH_SCOPES = 'read:user user:email write:ssh_signing_key write:public_key';
+const KEY_PREFIX = `${FUTURE_TOOL_NAME}-`;
+
+function parseCredentialIdFromTitle(title: string): Option.Option<string> {
+  const match = title.match(/\(([^)]+)\)$/);
+  if (!match) return Option.none();
+  return Option.some(match[1]!);
+}
+
+function baseKey(pubkey: string): string {
+  return pubkey.split(' ').slice(0, 2).join(' ');
+}
+
+export enum GitSetupError {
+  NotInGitRepositoryError = 'NotInGitRepositoryError',
+  NoRemoteOriginError = 'NoRemoteOriginError',
+  OAuthFailedError = 'OAuthFailedError',
+  GitHubUserFetchFailedError = 'GitHubUserFetchFailedError',
+  RepoAccessDeniedError = 'RepoAccessDeniedError',
+  MultipleJiveSigningKeysError = 'MultipleJiveSigningKeysError',
+  MultipleJiveAuthnKeysError = 'MultipleJiveAuthnKeysError',
+  MissingCredentialIdError = 'MissingCredentialIdError',
+  SigningAuthnKeyMismatchError = 'SigningAuthnKeyMismatchError',
+  AgentStartFailedError = 'AgentStartFailedError',
+  AgentProcedureFailedError = 'AgentProcedureFailedError',
+  GitCloneFailedError = 'GitCloneFailedError',
+  GitConfigFailedError = 'GitConfigFailedError',
+}
+
+function* gitSetup(ownerRepoArg?: string): Effect.fn.Return<void, string, AllModules> {
+  const git = yield* cliModules.Git;
+  const github = yield* cliModules.GitHub;
+  const agentClient = yield* cliModules.AgentClient;
+  const sshConfig = yield* commonModules.SSHConfig;
+  const isCloneMode = ownerRepoArg !== undefined;
+
+  // 1. Parse owner/repo
+  const { owner, repo } = yield* git.resolveOwnerAndRepo(Option.fromNullishOr(ownerRepoArg));
+  log(`Setting up ${owner}/${repo}`);
+
+  // 2. GitHub OAuth
+  const token = yield* github.authorize(GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, OAUTH_SCOPES);
+  log('✓ Authorized with GitHub');
+
+  // 3. Fetch user info
+  const { login, email } = yield* github.getUser(token);
+  const gitUser: GitUser = {name: login, email: email};
+  log(`  Logged in as: ${gitUser.name} <${gitUser.email}>`);
+
+  // 4. Check GitHub signing keys for <tool name>: prefix
+  const signingKeys = yield* github.getSigningKeys(token);
+  const toolKeys = signingKeys.filter(k => k.title.startsWith(KEY_PREFIX));
+  if (toolKeys.length > 1)
+    return yield* Effect.fail(`${GitSetupError.MultipleJiveSigningKeysError}: Found ${toolKeys.length} signing keys with "${KEY_PREFIX}" prefix — expected at most 1`);
+  let maybeKey: Option.Option<{ credentialId: string; pubkey: string }> = Option.none();
+  if (toolKeys[0]) {
+    const credentialId = parseCredentialIdFromTitle(toolKeys[0].title);
+    if (Option.isNone(credentialId))
+      return yield* Effect.fail(`${GitSetupError.MissingCredentialIdError}: signing key title "${toolKeys[0].title}" has no credentialId`);
+    maybeKey = Option.some({ credentialId: credentialId.value, pubkey: baseKey(toolKeys[0].key) });
+  }
+
+  // 5. Check authn keys too — must match signing key if both present.
+  const authnKeys = yield* github.getAuthnKeys(token);
+  const toolAuthnKeys = authnKeys.filter(k => k.title.startsWith(KEY_PREFIX));
+  if (toolAuthnKeys.length > 1)
+    return yield* Effect.fail(`${GitSetupError.MultipleJiveAuthnKeysError}: Found ${toolAuthnKeys.length} authn keys with "${KEY_PREFIX}" prefix — expected at most 1`);
+  let maybeAuthnKey: Option.Option<{ credentialId: string; pubkey: string }> = Option.none();
+  if (toolAuthnKeys[0]) {
+    const credentialId = parseCredentialIdFromTitle(toolAuthnKeys[0].title);
+    if (Option.isNone(credentialId))
+      return yield* Effect.fail(`${GitSetupError.MissingCredentialIdError}: authn key title "${toolAuthnKeys[0].title}" has no credentialId`);
+    maybeAuthnKey = Option.some({ credentialId: credentialId.value, pubkey: baseKey(toolAuthnKeys[0].key) });
+  }
+  if (Option.isSome(maybeKey) && Option.isSome(maybeAuthnKey) && maybeKey.value.pubkey !== maybeAuthnKey.value.pubkey)
+    return yield* Effect.fail(`${GitSetupError.SigningAuthnKeyMismatchError}: signing key and authn key pubkeys don't match — GitHub account is in an inconsistent state`);
+
+  // 6. Call agent to get/create/verify key (starts agent if not running)
+  const { credentialId, pubkey } = yield* pipe(
+    Effect.gen(() => agentClient.usingClient(function* (client): EffectGen<{ pubkey: string; credentialId: string }, string> {
+      return yield* pipe(
+        client.Setup({
+          pubkey: Option.map(maybeKey, k => k.pubkey),
+          credentialId: Option.map(maybeKey, k => k.credentialId),
+          username: login,
+        }),
+        Effect.mapError(e => `${GitSetupError.AgentProcedureFailedError}: ${String(e)}`)
+      );
+    })),
+    Effect.catchTag("AgentClientError", err => Effect.fail(err.reason)),
+    Effect.catchTag("AgentClientUsageError", err => Effect.fail(err.cause))
+  );
+  const credentialFriendlyName = new CredentialId(credentialId).humanReadableName;
+  const keyTitle = `${credentialFriendlyName} (${credentialId})`;
+
+  // 8. Register signing key on GitHub if not already present
+  if (Option.isNone(maybeKey)) {
+    yield* github.addSigningKey(token, keyTitle, pubkey);
+    log(`✓ Registered GitHub signing key: ${keyTitle}`);
+  }
+
+  // 9. Register key as authn key on GitHub account if not already present
+  if (Option.isNone(maybeAuthnKey)) {
+    yield* github.addAuthnKey(token, keyTitle, pubkey);
+    log(`✓ Registered authn key on GitHub account`);
+  }
+
+  // 10. Write ssh config (pubkey file written by agent via KeyMapStore.addKey)
+  const pubkeyPath = sshConfig.getPubkeyPath(credentialFriendlyName);
+  yield* sshConfig.writeHost({
+    section: {
+      HostName: "github.com",
+      User: "git",
+      IdentityFile: pubkeyPath,
+      IdentitiesOnly: "yes",
+      IdentityAgent: AGENT_SOCK_FILE_PATH,
+    },
+  });
+
+  // 11. Clone if in clone mode
+  if (isCloneMode) {
+    yield* git.clone(owner, repo);
+    log(`✓ Cloned into ${repo}/`);
+  }
+
+  // 12. Set repo config plus any submodules' config
+  log('\nSetting git config:');
+  yield* git.setupRepo({
+    dir: process.cwd(),
+    remoteURL: `${STANDARD_REMOTE_PREFIX}${owner}/${repo}.git`,
+    user: gitUser,
+    pubkeyPath,
+  });
+
+  log(`\n✓ Setup complete for ${owner}/${repo}`);
+}
+
+const layerLive = pipe(
+  GitImpl.Layer,
+  Layer.provideMerge(GitHubImpl.Layer),
+  Layer.provideMerge(AgentClientImpl.Layer),
+  Layer.provideMerge(OSPlatformImpl.Layer),
+  Layer.provideMerge(SSHConfigImpl.Layer),
+  Layer.provideMerge(BunFileSystem.layer)
+)
+
+export const setup = new Command('setup')
+  .description('setup verified git commits for current repo')
+  .argument('[owner/repo]', 'GitHub repo to clone and set up (omit if already in a repo with a remote)')
+  .action(async (ownerRepo?: string) => {
+    function* program() {
+      yield* pipe(
+        effunct(gitSetup)(ownerRepo),
+        Effect.provide(layerLive),
+        Effect.catch(err => Effect.gen(function* () {
+          log(`✗ ${err}`);
+        }))
+      );
+    }
+    await Effect.runPromise(Effect.gen(program));
+    process.exit();
+  });

package/src/commands/index.ts

@@ -0,0 +1,15 @@
+import { program } from 'commander';
+import { git } from './git';
+import { npm } from './npm';
+import { upgrade } from './upgrade';
+import { ssh } from "./ssh";
+import { CLI_CMD_NAME, CURRENT_VERSION } from '@/common/constants';
+
+program.name(CLI_CMD_NAME).version(CURRENT_VERSION);
+
+[git, npm, ssh, upgrade]
+  .forEach(cmd => { program.addCommand(cmd) });
+
+program.parse();
+
+if (process.argv.length <= 2) program.help();

package/src/commands/npm/index.ts

@@ -0,0 +1,8 @@
+import { Command } from 'commander';
+import { setup } from './setup';
+
+export const npm = new Command('npm')
+  .summary('npm package management utilities');
+
+[setup]
+  .forEach(cmd => { npm.addCommand(cmd) });

package/src/commands/npm/setup/git-remote.ts

@@ -0,0 +1,78 @@
+import { $ } from 'bun';
+import { Effect, Option } from 'effect';
+
+export interface RepoAccess {
+  owner: string;
+  repo: string;
+  canPush: boolean;
+}
+
+export interface CreatedRepo {
+  owner: string;
+  repo: string;
+  url: string;
+  sshUrl: string;
+}
+
+// Handles https://github.com/owner/repo.git, git@github.com:owner/repo.git,
+// and SSH aliases like github-ozyman42:owner/repo.git
+export function parseGithubOwnerRepo(url: string): Option.Option<{ owner: string; repo: string }> {
+  const https = url.match(/github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?$/);
+  if (https) return Option.some({ owner: https[1]!, repo: https[2]! });
+  const alias = url.match(/^[^:]+:([^/]+)\/([^/]+?)(?:\.git)?$/);
+  if (alias) return Option.some({ owner: alias[1]!, repo: alias[2]! });
+  return Option.none();
+}
+
+async function viewRepo(nameWithOwner: string): Promise<Option.Option<CreatedRepo>> {
+  const view = await $`gh repo view ${nameWithOwner} --json name,owner,url,sshUrl`.quiet().nothrow();
+  if (view.exitCode !== 0) return Option.none();
+  try {
+    const data = JSON.parse(view.stdout.toString());
+    return Option.some({ owner: data.owner.login, repo: data.name, url: data.url, sshUrl: data.sshUrl });
+  } catch {
+    return Option.none();
+  }
+}
+
+export function ensureGitHubRepo(name: string, isPrivate = false): Effect.Effect<{ repo: CreatedRepo; created: boolean }, string> {
+  return Effect.tryPromise({
+    try: async () => {
+      const whoami = await $`gh api user --jq .login`.quiet().nothrow();
+      const owner = whoami.exitCode === 0 ? whoami.stdout.toString().trim() : null;
+
+      if (owner) {
+        const existingOption = await viewRepo(`${owner}/${name}`);
+        if (Option.isSome(existingOption)) return { repo: existingOption.value, created: false };
+      }
+
+      const visibility = isPrivate ? '--private' : '--public';
+      const create = await $`gh repo create ${name} ${visibility}`.quiet().nothrow();
+      if (create.exitCode !== 0) {
+        throw new Error(`gh repo create failed: ${create.stderr.toString().trim()}`);
+      }
+      const createdOption = await viewRepo(name);
+      if (Option.isNone(createdOption)) throw new Error(`repo created but could not retrieve details for "${name}"`);
+      return { repo: createdOption.value, created: true };
+    },
+    catch: (e) => e instanceof Error ? e.message : String(e),
+  });
+}
+
+export async function checkGitHubAccess(remoteUrl: string): Promise<Option.Option<RepoAccess>> {
+  const parsedOption = parseGithubOwnerRepo(remoteUrl);
+  if (Option.isNone(parsedOption)) return Option.none();
+  const { owner, repo } = parsedOption.value;
+
+  const result = await $`gh api repos/${owner}/${repo}`.quiet().nothrow();
+  if (result.exitCode !== 0) return Option.none();
+
+  let data: any;
+  try {
+    data = JSON.parse(result.stdout.toString());
+  } catch {
+    return Option.none();
+  }
+
+  return Option.some({ owner, repo, canPush: data?.permissions?.push === true });
+}

package/src/commands/npm/setup/index.ts

@@ -0,0 +1,189 @@
+import { $ } from 'bun';
+import { existsSync } from 'node:fs';
+import { Effect, Option } from 'effect';
+import { makeCommand } from '@/common/command';
+import { log } from '@/common/log';
+import { acquireToken } from './npm-auth';
+import { fetchPackageInfo } from './package-registry';
+import { addTrustedPublisher, setPackageAccessPolicy } from './trusted-publishing';
+import { checkGitHubAccess } from './git-remote';
+import { workflowExists, createWorkflow } from './workflow';
+import { validatePackageJson } from './package-json-validate';
+
+enum SetupError {
+  NoGitRepo = 'NoGitRepo',
+  NoPackageJson = 'NoPackageJson',
+  InvalidPackageJson = 'InvalidPackageJson',
+  NpmNotFound = 'NpmNotFound',
+  GhNotFound = 'GhNotFound',
+  NotLoggedIn = 'NotLoggedIn',
+  NoGitRemote = 'NoGitRemote',
+  RepoNotFound = 'RepoNotFound',
+  NoWriteAccess = 'NoWriteAccess',
+  BuildFailed = 'BuildFailed',
+  PublishFailed = 'PublishFailed',
+  TrustedPublishingFailed = 'TrustedPublishingFailed',
+  AccessPolicyFailed = 'AccessPolicyFailed',
+}
+
+export const setup = makeCommand('setup', 'configure a new npm package for publishing', () =>
+  Effect.gen(function* () {
+    const cwd = process.cwd();
+
+    // 1. npm
+    log('checking npm...');
+    const npmCheck = yield* Effect.promise(() => $`which npm`.quiet().nothrow());
+    if (npmCheck.exitCode !== 0)
+      yield* Effect.fail(`${SetupError.NpmNotFound}: "npm" not found in PATH — install Node.js from nodejs.org`);
+    const npmVersion = (yield* Effect.promise(() => $`npm --version`.quiet().nothrow())).stdout.toString().trim();
+    const [major, minor] = npmVersion.split('.').map(Number);
+    if (major < 11 || (major === 11 && minor < 10))
+      yield* Effect.fail(`${SetupError.NpmNotFound}: npm ${npmVersion} is too old — "npm trust" requires 11.10.0+ (run "npm install -g npm")`);
+    const { token: npmToken, user: npmUser } = yield* acquireToken().pipe(
+      Effect.mapError(e => `${SetupError.NotLoggedIn}: npm authentication failed: ${e}`)
+    );
+    log(`  ✓ logged into npm as ${npmUser}`);
+
+    // 2. GitHub CLI
+    log('checking GitHub...');
+    const ghCheck = yield* Effect.promise(() => $`which gh`.quiet().nothrow());
+    if (ghCheck.exitCode !== 0)
+      yield* Effect.fail(`${SetupError.GhNotFound}: "gh" not found in PATH — install GitHub CLI from cli.github.com`);
+    let ghUser = yield* Effect.promise(() => $`gh api user --jq .login`.quiet().nothrow());
+    if (ghUser.exitCode !== 0) {
+      log('  not logged in — opening gh auth login...');
+      yield* Effect.promise(() => $`gh auth login`.nothrow());
+      ghUser = yield* Effect.promise(() => $`gh api user --jq .login`.quiet().nothrow());
+    }
+    if (ghUser.exitCode !== 0)
+      yield* Effect.fail(`${SetupError.NotLoggedIn}: not logged into GitHub — run "gh auth login"`);
+    log(`  ✓ logged into github as ${ghUser.stdout.toString().trim()}`);
+
+    // 3. git repo root
+    if (!existsSync(`${cwd}/.git`))
+      yield* Effect.fail(`${SetupError.NoGitRepo}: current directory is not a git repository — run "git init" first`);
+
+    // 4. package.json — read and fatal-check
+    log('checking package.json...');
+    const pkgFile = Bun.file(`${cwd}/package.json`);
+    if (!(yield* Effect.promise(() => pkgFile.exists())))
+      yield* Effect.fail(`${SetupError.NoPackageJson}: no package.json found — run this command from a package directory`);
+    let pkg: any = yield* Effect.tryPromise({
+      try: () => pkgFile.json(),
+      catch: () => `${SetupError.InvalidPackageJson}: package.json contains invalid JSON — fix it and retry`,
+    });
+    const { name } = pkg;
+    if (!name)
+      yield* Effect.fail(`${SetupError.InvalidPackageJson}: package.json is missing a "name" field`);
+    log(`  name: ${name}`);
+
+    const fatal = validatePackageJson(pkg).find(i => i.fatal);
+    if (fatal)
+      yield* Effect.fail(`${SetupError.InvalidPackageJson}: ${fatal.field}: ${fatal.issue}`);
+
+    // 5. git remote
+    log('checking git remote...');
+    const remoteOption = yield* Effect.promise(() => getRemoteUrl(cwd));
+    if (Option.isNone(remoteOption))
+      yield* Effect.fail(`${SetupError.NoGitRemote}: no git remote configured — run "git remote add origin <url>" first`);
+    const remote = (remoteOption as Option.Some<string>).value;
+    log(`  remote: ${remote}`);
+    const accessOption = yield* Effect.promise(() => checkGitHubAccess(remote));
+    if (Option.isNone(accessOption))
+      yield* Effect.fail(`${SetupError.RepoNotFound}: could not reach GitHub repo at ${remote} — check "gh auth status"`);
+    const access = (accessOption as Option.Some<{ owner: string; repo: string; canPush: boolean }>).value;
+    if (!access.canPush)
+      yield* Effect.fail(`${SetupError.NoWriteAccess}: no push access to ${access.owner}/${access.repo} — you need write permissions`);
+    const repoHttpsUrl = `https://github.com/${access.owner}/${access.repo}`;
+    log(`  ✓ ${access.owner}/${access.repo} (write access confirmed)`);
+
+    // 6. Sync package.json repository URL from git remote; report other non-fatal issues
+    const expectedRepoUrl = `git+${repoHttpsUrl}.git`;
+    const currentRepoUrl = typeof pkg.repository === 'object' ? pkg.repository?.url : pkg.repository;
+    if (currentRepoUrl !== expectedRepoUrl) {
+      log('syncing package.json repository URL...');
+      log(`  was: ${currentRepoUrl ?? '(missing)'}`);
+      pkg = { ...pkg, repository: { type: 'git', url: expectedRepoUrl } };
+      yield* Effect.promise(() => Bun.write(`${cwd}/package.json`, JSON.stringify(pkg, null, 2) + '\n'));
+      log(`  ✓ set to ${expectedRepoUrl}`);
+    }
+
+    const nonFatal = validatePackageJson(pkg).filter(i => !i.fatal);
+    if (nonFatal.length > 0) {
+      log('package.json issues (fix manually):');
+      for (const { field, issue } of nonFatal) log(`  ${field}: ${issue}`);
+    }
+
+    // 7. Publish workflow
+    log('checking publish workflow...');
+    if (!(yield* Effect.promise(() => workflowExists(cwd)))) {
+      yield* Effect.promise(() => createWorkflow(cwd));
+      log('  ✓ created .github/workflows/publish.yml');
+    } else {
+      log('  ✓ already exists');
+    }
+
+    // 8. npm package — initial publish if not yet on registry
+    log('checking npm registry...');
+    const infoOption = yield* fetchPackageInfo(name).pipe(
+      Effect.mapError(e => `${SetupError.NpmNotFound}: npm registry lookup failed: ${e}`)
+    );
+    if (Option.isNone(infoOption)) {
+      log('  package not yet published — building and creating initial release...');
+      const buildResult = yield* Effect.promise(() => $`bun run build`.nothrow());
+      if (buildResult.exitCode !== 0)
+        yield* Effect.fail(`${SetupError.BuildFailed}: build failed: ${buildResult.stderr.toString().trim()}`);
+      const distPkgFile = Bun.file(`${cwd}/dist/package.json`);
+      if (!(yield* Effect.promise(() => distPkgFile.exists())))
+        yield* Effect.fail(`${SetupError.BuildFailed}: build succeeded but dist/package.json is missing — build script must produce it`);
+      yield* Effect.tryPromise({
+        try: () => distPkgFile.json(),
+        catch: () => `${SetupError.BuildFailed}: dist/package.json exists but contains invalid JSON — check your build script`,
+      });
+      yield* npmPublish(npmToken).pipe(
+        Effect.mapError(e => `${SetupError.PublishFailed}: ${e}`)
+      );
+      log(`  ✓ published ${name}`);
+    } else {
+      const version = infoOption.value.latestVersion ?? '(unknown)';
+      log(`  ✓ exists (latest v${version})`);
+    }
+
+    // 9. Trusted publishing
+    log('checking trusted publishing...');
+    const ownerRepo = `${access.owner}/${access.repo}`;
+    const trust = yield* addTrustedPublisher(name, ownerRepo, npmToken).pipe(
+      Effect.mapError(e => `${SetupError.TrustedPublishingFailed}: ${e}`)
+    );
+    log(trust.alreadyConfigured ? '  ✓ already configured' : '  ✓ configured');
+
+    // 10. Package access policy — require 2FA, disallow automation tokens
+    log('setting package access policy...');
+    yield* setPackageAccessPolicy(name, npmToken, trust.otp).pipe(
+      Effect.mapError(e => `${SetupError.AccessPolicyFailed}: ${e}`)
+    );
+    log('  ✓ configured');
+  })
+);
+
+async function getRemoteUrl(cwd: string): Promise<Option.Option<string>> {
+  const result = await $`git -C ${cwd} remote get-url origin`.quiet().nothrow();
+  if (result.exitCode !== 0) return Option.none();
+  return Option.some(result.stdout.toString().trim());
+}
+
+function npmPublish(token: string): Effect.Effect<void, string> {
+  return Effect.tryPromise({
+    try: async () => {
+      const proc = Bun.spawn(['npm', 'publish', 'dist/', '--access', 'public', '--no-provenance'], {
+        stdin: 'inherit',
+        stdout: 'inherit',
+        stderr: 'inherit',
+        env: { ...process.env, NODE_AUTH_TOKEN: token },
+      });
+      const exitCode = await proc.exited;
+      if (exitCode !== 0) throw new Error('npm publish failed — see output above');
+    },
+    catch: (e) => e instanceof Error ? e.message : String(e),
+  });
+}

package/src/commands/npm/setup/npm-auth.ts

@@ -0,0 +1,58 @@
+import { $ } from 'bun';
+import { readFileSync, writeFileSync, unlinkSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { Effect, Option } from 'effect';
+import { log } from '@/common/log';
+
+const npmrcPath = `${homedir()}/.npmrc`;
+const TOKEN_RE = /^\/\/registry\.npmjs\.org\/:_authToken=(\S+)$/m;
+
+function readNpmrc(): string {
+  try { return readFileSync(npmrcPath, 'utf8'); } catch { return ''; }
+}
+
+function stripTokenFromDisk(): void {
+  const content = readNpmrc();
+  const stripped = content.replace(TOKEN_RE, '').replace(/\n{3,}/g, '\n\n').trim();
+  if (!stripped) {
+    try { unlinkSync(npmrcPath); } catch {}
+  } else {
+    writeFileSync(npmrcPath, stripped + '\n');
+  }
+}
+
+async function whoamiWithToken(token: string): Promise<Option.Option<string>> {
+  const result = await $`npm whoami`
+    .env({ ...process.env, NODE_AUTH_TOKEN: token })
+    .quiet().nothrow();
+  if (result.exitCode !== 0) return Option.none();
+  return Option.some(result.stdout.toString().trim());
+}
+
+export function acquireToken(): Effect.Effect<{ token: string; user: string }, string> {
+  return Effect.tryPromise({
+    try: async () => {
+      const existing = readNpmrc().match(TOKEN_RE)?.[1];
+      if (existing) {
+        const userOption = await whoamiWithToken(existing);
+        if (Option.isSome(userOption)) {
+          stripTokenFromDisk();
+          return { token: existing, user: userOption.value };
+        }
+      }
+
+      log('  not logged in — opening npm login...');
+      await $`npm login`.nothrow();
+
+      const token = readNpmrc().match(TOKEN_RE)?.[1];
+      if (!token) throw new Error('npm login did not produce a token — try running "npm login" manually');
+
+      const userOption = await whoamiWithToken(token);
+      if (Option.isNone(userOption)) throw new Error('npm login succeeded but token verification failed');
+
+      stripTokenFromDisk();
+      return { token, user: userOption.value };
+    },
+    catch: (e) => e instanceof Error ? e.message : String(e),
+  });
+}

package/src/commands/npm/setup/package-json-validate.ts

@@ -0,0 +1,68 @@
+interface Pkg {
+  name: string;
+  version: string;
+  repository?: { type?: string; url?: string } | string;
+  publishConfig?: { access?: string; provenance?: boolean };
+  scripts?: Record<string, string>;
+  files?: string[];
+}
+
+export interface PackageJsonIssue {
+  field: string;
+  issue: string;
+  fatal?: boolean;
+}
+
+const GITHUB_URL_RE = /^git\+https:\/\/github\.com\/[^/]+\/[^/]+\.git$/;
+
+function isValidGitHubUrl(url: string): boolean {
+  return GITHUB_URL_RE.test(url);
+}
+
+function normalizeRepoUrl(url: string): string {
+  if (!url.startsWith('git+')) url = `git+${url}`;
+  if (!url.endsWith('.git')) url = `${url}.git`;
+  return url;
+}
+
+export function validatePackageJson(pkg: Pkg): PackageJsonIssue[] {
+  const issues: PackageJsonIssue[] = [];
+
+  const repoUrl = typeof pkg.repository === 'object' ? pkg.repository?.url : pkg.repository;
+  if (!repoUrl) {
+    issues.push({ field: 'repository', issue: 'missing — required for provenance' });
+  } else if (!isValidGitHubUrl(repoUrl)) {
+    issues.push({ field: 'repository.url', issue: `not a valid GitHub URL (got "${repoUrl}")` });
+  }
+
+  if (pkg.publishConfig?.access !== 'public') {
+    issues.push({ field: 'publishConfig.access', issue: 'should be "public"' });
+  }
+  if (pkg.publishConfig?.provenance !== true) {
+    issues.push({ field: 'publishConfig.provenance', issue: 'should be true' });
+  }
+
+  if (!pkg.version) {
+    issues.push({ field: 'version', issue: 'missing — add a "version" field (e.g. "0.0.1")', fatal: true });
+  }
+
+  if (!pkg.scripts?.['build']) {
+    issues.push({ field: 'scripts.build', issue: 'missing — add a "build" script before running setup', fatal: true });
+  }
+
+  if (!pkg.files?.includes('dist')) {
+    issues.push({ field: 'files', issue: '"dist" not included — built output won\'t be published' });
+  }
+
+  return issues;
+}
+
+export function buildFixedPackageJson(pkg: Pkg, repoUrl: string): Pkg {
+  const url = normalizeRepoUrl(repoUrl);
+  return {
+    ...pkg,
+    repository: { type: 'git', url },
+    publishConfig: { access: 'public', provenance: true },
+    files: pkg.files?.includes('dist') ? pkg.files : [...(pkg.files ?? []), 'dist'],
+  };
+}

package/src/commands/npm/setup/package-registry.ts

@@ -0,0 +1,24 @@
+import { Effect, Option } from 'effect';
+
+export interface PackageRegistryInfo {
+  name: string;
+  latestVersion: string;
+  distTags: Record<string, string>;
+}
+
+export function fetchPackageInfo(name: string): Effect.Effect<Option.Option<PackageRegistryInfo>, string> {
+  return Effect.tryPromise({
+    try: async () => {
+      const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}`);
+      if (res.status === 404) return Option.none<PackageRegistryInfo>();
+      if (!res.ok) throw new Error(`registry error ${res.status} for ${name}`);
+      const data = await res.json() as any;
+      return Option.some({
+        name: data.name,
+        latestVersion: data['dist-tags']?.latest,
+        distTags: data['dist-tags'] ?? {},
+      });
+    },
+    catch: (e) => e instanceof Error ? e.message : String(e),
+  });
+}

package/src/commands/npm/setup/publish-workflow.yml

@@ -0,0 +1,35 @@
+name: Publish to npm
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch: {}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: prod
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Build
+        run: bun run build
+
+      - name: Publish
+        run: npm publish dist/ --access public