@ozyman42/ozy-cli 0.4.9-linux-x64.0 → 0.4.9

package/src/commands/npm/setup/index.ts

@@ -0,0 +1,189 @@
+import { $ } from 'bun';
+import { existsSync } from 'node:fs';
+import { Effect, Option } from 'effect';
+import { makeCommand } from '@/common/command';
+import { log } from '@/common/log';
+import { acquireToken } from './npm-auth';
+import { fetchPackageInfo } from './package-registry';
+import { addTrustedPublisher, setPackageAccessPolicy } from './trusted-publishing';
+import { checkGitHubAccess } from './git-remote';
+import { workflowExists, createWorkflow } from './workflow';
+import { validatePackageJson } from './package-json-validate';
+
+enum SetupError {
+  NoGitRepo = 'NoGitRepo',
+  NoPackageJson = 'NoPackageJson',
+  InvalidPackageJson = 'InvalidPackageJson',
+  NpmNotFound = 'NpmNotFound',
+  GhNotFound = 'GhNotFound',
+  NotLoggedIn = 'NotLoggedIn',
+  NoGitRemote = 'NoGitRemote',
+  RepoNotFound = 'RepoNotFound',
+  NoWriteAccess = 'NoWriteAccess',
+  BuildFailed = 'BuildFailed',
+  PublishFailed = 'PublishFailed',
+  TrustedPublishingFailed = 'TrustedPublishingFailed',
+  AccessPolicyFailed = 'AccessPolicyFailed',
+}
+
+export const setup = makeCommand('setup', 'configure a new npm package for publishing', () =>
+  Effect.gen(function* () {
+    const cwd = process.cwd();
+
+    // 1. npm
+    log('checking npm...');
+    const npmCheck = yield* Effect.promise(() => $`which npm`.quiet().nothrow());
+    if (npmCheck.exitCode !== 0)
+      yield* Effect.fail(`${SetupError.NpmNotFound}: "npm" not found in PATH — install Node.js from nodejs.org`);
+    const npmVersion = (yield* Effect.promise(() => $`npm --version`.quiet().nothrow())).stdout.toString().trim();
+    const [major, minor] = npmVersion.split('.').map(Number);
+    if (major < 11 || (major === 11 && minor < 10))
+      yield* Effect.fail(`${SetupError.NpmNotFound}: npm ${npmVersion} is too old — "npm trust" requires 11.10.0+ (run "npm install -g npm")`);
+    const { token: npmToken, user: npmUser } = yield* acquireToken().pipe(
+      Effect.mapError(e => `${SetupError.NotLoggedIn}: npm authentication failed: ${e}`)
+    );
+    log(`  ✓ logged into npm as ${npmUser}`);
+
+    // 2. GitHub CLI
+    log('checking GitHub...');
+    const ghCheck = yield* Effect.promise(() => $`which gh`.quiet().nothrow());
+    if (ghCheck.exitCode !== 0)
+      yield* Effect.fail(`${SetupError.GhNotFound}: "gh" not found in PATH — install GitHub CLI from cli.github.com`);
+    let ghUser = yield* Effect.promise(() => $`gh api user --jq .login`.quiet().nothrow());
+    if (ghUser.exitCode !== 0) {
+      log('  not logged in — opening gh auth login...');
+      yield* Effect.promise(() => $`gh auth login`.nothrow());
+      ghUser = yield* Effect.promise(() => $`gh api user --jq .login`.quiet().nothrow());
+    }
+    if (ghUser.exitCode !== 0)
+      yield* Effect.fail(`${SetupError.NotLoggedIn}: not logged into GitHub — run "gh auth login"`);
+    log(`  ✓ logged into github as ${ghUser.stdout.toString().trim()}`);
+
+    // 3. git repo root
+    if (!existsSync(`${cwd}/.git`))
+      yield* Effect.fail(`${SetupError.NoGitRepo}: current directory is not a git repository — run "git init" first`);
+
+    // 4. package.json — read and fatal-check
+    log('checking package.json...');
+    const pkgFile = Bun.file(`${cwd}/package.json`);
+    if (!(yield* Effect.promise(() => pkgFile.exists())))
+      yield* Effect.fail(`${SetupError.NoPackageJson}: no package.json found — run this command from a package directory`);
+    let pkg: any = yield* Effect.tryPromise({
+      try: () => pkgFile.json(),
+      catch: () => `${SetupError.InvalidPackageJson}: package.json contains invalid JSON — fix it and retry`,
+    });
+    const { name } = pkg;
+    if (!name)
+      yield* Effect.fail(`${SetupError.InvalidPackageJson}: package.json is missing a "name" field`);
+    log(`  name: ${name}`);
+
+    const fatal = validatePackageJson(pkg).find(i => i.fatal);
+    if (fatal)
+      yield* Effect.fail(`${SetupError.InvalidPackageJson}: ${fatal.field}: ${fatal.issue}`);
+
+    // 5. git remote
+    log('checking git remote...');
+    const remoteOption = yield* Effect.promise(() => getRemoteUrl(cwd));
+    if (Option.isNone(remoteOption))
+      yield* Effect.fail(`${SetupError.NoGitRemote}: no git remote configured — run "git remote add origin <url>" first`);
+    const remote = (remoteOption as Option.Some<string>).value;
+    log(`  remote: ${remote}`);
+    const accessOption = yield* Effect.promise(() => checkGitHubAccess(remote));
+    if (Option.isNone(accessOption))
+      yield* Effect.fail(`${SetupError.RepoNotFound}: could not reach GitHub repo at ${remote} — check "gh auth status"`);
+    const access = (accessOption as Option.Some<{ owner: string; repo: string; canPush: boolean }>).value;
+    if (!access.canPush)
+      yield* Effect.fail(`${SetupError.NoWriteAccess}: no push access to ${access.owner}/${access.repo} — you need write permissions`);
+    const repoHttpsUrl = `https://github.com/${access.owner}/${access.repo}`;
+    log(`  ✓ ${access.owner}/${access.repo} (write access confirmed)`);
+
+    // 6. Sync package.json repository URL from git remote; report other non-fatal issues
+    const expectedRepoUrl = `git+${repoHttpsUrl}.git`;
+    const currentRepoUrl = typeof pkg.repository === 'object' ? pkg.repository?.url : pkg.repository;
+    if (currentRepoUrl !== expectedRepoUrl) {
+      log('syncing package.json repository URL...');
+      log(`  was: ${currentRepoUrl ?? '(missing)'}`);
+      pkg = { ...pkg, repository: { type: 'git', url: expectedRepoUrl } };
+      yield* Effect.promise(() => Bun.write(`${cwd}/package.json`, JSON.stringify(pkg, null, 2) + '\n'));
+      log(`  ✓ set to ${expectedRepoUrl}`);
+    }
+
+    const nonFatal = validatePackageJson(pkg).filter(i => !i.fatal);
+    if (nonFatal.length > 0) {
+      log('package.json issues (fix manually):');
+      for (const { field, issue } of nonFatal) log(`  ${field}: ${issue}`);
+    }
+
+    // 7. Publish workflow
+    log('checking publish workflow...');
+    if (!(yield* Effect.promise(() => workflowExists(cwd)))) {
+      yield* Effect.promise(() => createWorkflow(cwd));
+      log('  ✓ created .github/workflows/publish.yml');
+    } else {
+      log('  ✓ already exists');
+    }
+
+    // 8. npm package — initial publish if not yet on registry
+    log('checking npm registry...');
+    const infoOption = yield* fetchPackageInfo(name).pipe(
+      Effect.mapError(e => `${SetupError.NpmNotFound}: npm registry lookup failed: ${e}`)
+    );
+    if (Option.isNone(infoOption)) {
+      log('  package not yet published — building and creating initial release...');
+      const buildResult = yield* Effect.promise(() => $`bun run build`.nothrow());
+      if (buildResult.exitCode !== 0)
+        yield* Effect.fail(`${SetupError.BuildFailed}: build failed: ${buildResult.stderr.toString().trim()}`);
+      const distPkgFile = Bun.file(`${cwd}/dist/package.json`);
+      if (!(yield* Effect.promise(() => distPkgFile.exists())))
+        yield* Effect.fail(`${SetupError.BuildFailed}: build succeeded but dist/package.json is missing — build script must produce it`);
+      yield* Effect.tryPromise({
+        try: () => distPkgFile.json(),
+        catch: () => `${SetupError.BuildFailed}: dist/package.json exists but contains invalid JSON — check your build script`,
+      });
+      yield* npmPublish(npmToken).pipe(
+        Effect.mapError(e => `${SetupError.PublishFailed}: ${e}`)
+      );
+      log(`  ✓ published ${name}`);
+    } else {
+      const version = infoOption.value.latestVersion ?? '(unknown)';
+      log(`  ✓ exists (latest v${version})`);
+    }
+
+    // 9. Trusted publishing
+    log('checking trusted publishing...');
+    const ownerRepo = `${access.owner}/${access.repo}`;
+    const trust = yield* addTrustedPublisher(name, ownerRepo, npmToken).pipe(
+      Effect.mapError(e => `${SetupError.TrustedPublishingFailed}: ${e}`)
+    );
+    log(trust.alreadyConfigured ? '  ✓ already configured' : '  ✓ configured');
+
+    // 10. Package access policy — require 2FA, disallow automation tokens
+    log('setting package access policy...');
+    yield* setPackageAccessPolicy(name, npmToken, trust.otp).pipe(
+      Effect.mapError(e => `${SetupError.AccessPolicyFailed}: ${e}`)
+    );
+    log('  ✓ configured');
+  })
+);
+
+async function getRemoteUrl(cwd: string): Promise<Option.Option<string>> {
+  const result = await $`git -C ${cwd} remote get-url origin`.quiet().nothrow();
+  if (result.exitCode !== 0) return Option.none();
+  return Option.some(result.stdout.toString().trim());
+}
+
+function npmPublish(token: string): Effect.Effect<void, string> {
+  return Effect.tryPromise({
+    try: async () => {
+      const proc = Bun.spawn(['npm', 'publish', 'dist/', '--access', 'public', '--no-provenance'], {
+        stdin: 'inherit',
+        stdout: 'inherit',
+        stderr: 'inherit',
+        env: { ...process.env, NODE_AUTH_TOKEN: token },
+      });
+      const exitCode = await proc.exited;
+      if (exitCode !== 0) throw new Error('npm publish failed — see output above');
+    },
+    catch: (e) => e instanceof Error ? e.message : String(e),
+  });
+}

package/src/commands/npm/setup/npm-auth.ts

@@ -0,0 +1,58 @@
+import { $ } from 'bun';
+import { readFileSync, writeFileSync, unlinkSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { Effect, Option } from 'effect';
+import { log } from '@/common/log';
+
+const npmrcPath = `${homedir()}/.npmrc`;
+const TOKEN_RE = /^\/\/registry\.npmjs\.org\/:_authToken=(\S+)$/m;
+
+function readNpmrc(): string {
+  try { return readFileSync(npmrcPath, 'utf8'); } catch { return ''; }
+}
+
+function stripTokenFromDisk(): void {
+  const content = readNpmrc();
+  const stripped = content.replace(TOKEN_RE, '').replace(/\n{3,}/g, '\n\n').trim();
+  if (!stripped) {
+    try { unlinkSync(npmrcPath); } catch {}
+  } else {
+    writeFileSync(npmrcPath, stripped + '\n');
+  }
+}
+
+async function whoamiWithToken(token: string): Promise<Option.Option<string>> {
+  const result = await $`npm whoami`
+    .env({ ...process.env, NODE_AUTH_TOKEN: token })
+    .quiet().nothrow();
+  if (result.exitCode !== 0) return Option.none();
+  return Option.some(result.stdout.toString().trim());
+}
+
+export function acquireToken(): Effect.Effect<{ token: string; user: string }, string> {
+  return Effect.tryPromise({
+    try: async () => {
+      const existing = readNpmrc().match(TOKEN_RE)?.[1];
+      if (existing) {
+        const userOption = await whoamiWithToken(existing);
+        if (Option.isSome(userOption)) {
+          stripTokenFromDisk();
+          return { token: existing, user: userOption.value };
+        }
+      }
+
+      log('  not logged in — opening npm login...');
+      await $`npm login`.nothrow();
+
+      const token = readNpmrc().match(TOKEN_RE)?.[1];
+      if (!token) throw new Error('npm login did not produce a token — try running "npm login" manually');
+
+      const userOption = await whoamiWithToken(token);
+      if (Option.isNone(userOption)) throw new Error('npm login succeeded but token verification failed');
+
+      stripTokenFromDisk();
+      return { token, user: userOption.value };
+    },
+    catch: (e) => e instanceof Error ? e.message : String(e),
+  });
+}

package/src/commands/npm/setup/package-json-validate.ts

@@ -0,0 +1,68 @@
+interface Pkg {
+  name: string;
+  version: string;
+  repository?: { type?: string; url?: string } | string;
+  publishConfig?: { access?: string; provenance?: boolean };
+  scripts?: Record<string, string>;
+  files?: string[];
+}
+
+export interface PackageJsonIssue {
+  field: string;
+  issue: string;
+  fatal?: boolean;
+}
+
+const GITHUB_URL_RE = /^git\+https:\/\/github\.com\/[^/]+\/[^/]+\.git$/;
+
+function isValidGitHubUrl(url: string): boolean {
+  return GITHUB_URL_RE.test(url);
+}
+
+function normalizeRepoUrl(url: string): string {
+  if (!url.startsWith('git+')) url = `git+${url}`;
+  if (!url.endsWith('.git')) url = `${url}.git`;
+  return url;
+}
+
+export function validatePackageJson(pkg: Pkg): PackageJsonIssue[] {
+  const issues: PackageJsonIssue[] = [];
+
+  const repoUrl = typeof pkg.repository === 'object' ? pkg.repository?.url : pkg.repository;
+  if (!repoUrl) {
+    issues.push({ field: 'repository', issue: 'missing — required for provenance' });
+  } else if (!isValidGitHubUrl(repoUrl)) {
+    issues.push({ field: 'repository.url', issue: `not a valid GitHub URL (got "${repoUrl}")` });
+  }
+
+  if (pkg.publishConfig?.access !== 'public') {
+    issues.push({ field: 'publishConfig.access', issue: 'should be "public"' });
+  }
+  if (pkg.publishConfig?.provenance !== true) {
+    issues.push({ field: 'publishConfig.provenance', issue: 'should be true' });
+  }
+
+  if (!pkg.version) {
+    issues.push({ field: 'version', issue: 'missing — add a "version" field (e.g. "0.0.1")', fatal: true });
+  }
+
+  if (!pkg.scripts?.['build']) {
+    issues.push({ field: 'scripts.build', issue: 'missing — add a "build" script before running setup', fatal: true });
+  }
+
+  if (!pkg.files?.includes('dist')) {
+    issues.push({ field: 'files', issue: '"dist" not included — built output won\'t be published' });
+  }
+
+  return issues;
+}
+
+export function buildFixedPackageJson(pkg: Pkg, repoUrl: string): Pkg {
+  const url = normalizeRepoUrl(repoUrl);
+  return {
+    ...pkg,
+    repository: { type: 'git', url },
+    publishConfig: { access: 'public', provenance: true },
+    files: pkg.files?.includes('dist') ? pkg.files : [...(pkg.files ?? []), 'dist'],
+  };
+}

package/src/commands/npm/setup/package-registry.ts

@@ -0,0 +1,24 @@
+import { Effect, Option } from 'effect';
+
+export interface PackageRegistryInfo {
+  name: string;
+  latestVersion: string;
+  distTags: Record<string, string>;
+}
+
+export function fetchPackageInfo(name: string): Effect.Effect<Option.Option<PackageRegistryInfo>, string> {
+  return Effect.tryPromise({
+    try: async () => {
+      const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}`);
+      if (res.status === 404) return Option.none<PackageRegistryInfo>();
+      if (!res.ok) throw new Error(`registry error ${res.status} for ${name}`);
+      const data = await res.json() as any;
+      return Option.some({
+        name: data.name,
+        latestVersion: data['dist-tags']?.latest,
+        distTags: data['dist-tags'] ?? {},
+      });
+    },
+    catch: (e) => e instanceof Error ? e.message : String(e),
+  });
+}

package/src/commands/npm/setup/publish-workflow.yml

@@ -0,0 +1,35 @@
+name: Publish to npm
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch: {}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: prod
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Build
+        run: bun run build
+
+      - name: Publish
+        run: npm publish dist/ --access public

package/src/commands/npm/setup/setup.test.ts

@@ -0,0 +1,117 @@
+import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { validatePackageJson } from './package-json-validate';
+import { parseGithubOwnerRepo } from './git-remote';
+import { workflowExists, createWorkflow } from './workflow';
+import { Option } from "effect";
+
+// ── validatePackageJson ──────────────────────────────────────────────────────
+
+describe('validatePackageJson', () => {
+  const base = {
+    name: '@scope/pkg',
+    version: '1.0.0',
+    repository: { type: 'git', url: 'git+https://github.com/owner/repo.git' },
+    publishConfig: { access: 'public' as const, provenance: true },
+    scripts: { build: 'bun run build' },
+    files: ['dist'],
+  };
+
+  test('returns no issues for a valid package', () => {
+    expect(validatePackageJson(base)).toEqual([]);
+  });
+
+  test('fatal: missing version', () => {
+    const issues = validatePackageJson({ ...base, version: '' });
+    expect(issues.some(i => i.field === 'version' && i.fatal)).toBe(true);
+  });
+
+  test('fatal: missing build script', () => {
+    const issues = validatePackageJson({ ...base, scripts: {} });
+    expect(issues.some(i => i.field === 'scripts.build' && i.fatal)).toBe(true);
+  });
+
+  test('non-fatal: missing repository', () => {
+    const issues = validatePackageJson({ ...base, repository: undefined as any });
+    expect(issues.some(i => i.field === 'repository' && !i.fatal)).toBe(true);
+  });
+
+  test('non-fatal: invalid repository url', () => {
+    const issues = validatePackageJson({ ...base, repository: { type: 'git', url: 'git+.git' } });
+    expect(issues.some(i => i.field === 'repository.url' && !i.fatal)).toBe(true);
+  });
+
+  test('non-fatal: publishConfig.access not public', () => {
+    const issues = validatePackageJson({ ...base, publishConfig: { access: 'restricted', provenance: true } });
+    expect(issues.some(i => i.field === 'publishConfig.access')).toBe(true);
+  });
+
+  test('non-fatal: publishConfig.provenance not true', () => {
+    const issues = validatePackageJson({ ...base, publishConfig: { access: 'public', provenance: false } });
+    expect(issues.some(i => i.field === 'publishConfig.provenance')).toBe(true);
+  });
+
+  test('non-fatal: dist not in files', () => {
+    const issues = validatePackageJson({ ...base, files: ['src'] });
+    expect(issues.some(i => i.field === 'files')).toBe(true);
+  });
+});
+
+// ── parseGithubOwnerRepo ─────────────────────────────────────────────────────
+
+describe('parseGithubOwnerRepo', () => {
+  test('parses https url', () => {
+    expect(parseGithubOwnerRepo('https://github.com/owner/repo.git')).toEqual(Option.some({ owner: 'owner', repo: 'repo' }));
+  });
+
+  test('parses https url without .git', () => {
+    expect(parseGithubOwnerRepo('https://github.com/owner/repo')).toEqual(Option.some({ owner: 'owner', repo: 'repo' }));
+  });
+
+  test('parses standard ssh url', () => {
+    expect(parseGithubOwnerRepo('git@github.com:owner/repo.git')).toEqual(Option.some({ owner: 'owner', repo: 'repo' }));
+  });
+
+  test('parses ssh alias url', () => {
+    expect(parseGithubOwnerRepo('git@github-ozyman42:ozyman42/test.git')).toEqual(Option.some({ owner: 'ozyman42', repo: 'test' }));
+  });
+
+  test('returns null for unrecognised url', () => {
+    expect(parseGithubOwnerRepo('not-a-url')).toBeNull();
+  });
+});
+
+// ── workflow helpers ─────────────────────────────────────────────────────────
+
+describe('workflow', () => {
+  let tmpDir: string;
+
+  beforeEach(async () => {
+    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'ozy-test-'));
+  });
+
+  afterEach(async () => {
+    await fs.rm(tmpDir, { recursive: true, force: true });
+  });
+
+  test('workflowExists returns false when missing', async () => {
+    expect(await workflowExists(tmpDir)).toBe(false);
+  });
+
+  test('createWorkflow creates a valid yaml file', async () => {
+    await createWorkflow(tmpDir);
+    expect(await workflowExists(tmpDir)).toBe(true);
+    const content = await fs.readFile(path.join(tmpDir, '.github/workflows/publish.yml'), 'utf8');
+    expect(content).toContain('npm publish dist/');
+    expect(content).toContain('id-token: write');
+    expect(content).toContain('bun run build');
+  });
+
+  test('createWorkflow is idempotent', async () => {
+    await createWorkflow(tmpDir);
+    await createWorkflow(tmpDir);
+    expect(await workflowExists(tmpDir)).toBe(true);
+  });
+});

package/src/commands/npm/setup/trusted-publishing.ts

@@ -0,0 +1,106 @@
+import { $ } from 'bun';
+import { createInterface } from 'node:readline';
+import { Effect } from 'effect';
+import { log } from '@/common/log';
+
+function encodePackageName(name: string): string {
+  if (!name.startsWith('@')) return encodeURIComponent(name);
+  const slash = name.indexOf('/');
+  return `@${name.slice(1, slash)}%2F${name.slice(slash + 1)}`;
+}
+
+function promptPasscode(): Promise<string> {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise(resolve => {
+    rl.question('  enter the passcode from the browser: ', answer => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+
+async function registryPost(
+  url: string,
+  body: string,
+  authToken: string,
+  { existingOtp, alreadyExistsStatus }: { existingOtp?: string; alreadyExistsStatus?: number } = {},
+): Promise<{ otp?: string; alreadyExists: boolean }> {
+  const headers: Record<string, string> = {
+    Authorization: `Bearer ${authToken}`,
+    'Content-Type': 'application/json',
+  };
+
+  const post = (otp?: string) => fetch(url, {
+    method: 'POST',
+    headers: otp ? { ...headers, 'npm-otp': otp } : headers,
+    body,
+  });
+
+  const check = (res: Response) => {
+    if (res.ok) return true;
+    if (alreadyExistsStatus && res.status === alreadyExistsStatus) return true;
+    return false;
+  };
+
+  if (existingOtp) {
+    const res = await post(existingOtp);
+    if (check(res)) return { otp: existingOtp, alreadyExists: !res.ok };
+  }
+
+  let res = await post();
+  if (check(res)) return { otp: undefined, alreadyExists: !res.ok };
+
+  if (res.status === 401) {
+    const notice = res.headers.get('npm-notice') ?? '';
+    const loginUrl = notice.match(/https:\/\/www\.npmjs\.com\/login\/[a-f0-9-]+/)?.[0];
+    if (!loginUrl) throw new Error('2FA required but could not parse login URL');
+    await $`open ${loginUrl}`.quiet().nothrow();
+    const otp = await promptPasscode();
+    res = await post(otp);
+    if (check(res)) return { otp, alreadyExists: !res.ok };
+  }
+
+  throw new Error(`${res.status} ${await res.text()}`);
+}
+
+export function addTrustedPublisher(
+  name: string,
+  ownerRepo: string,
+  token: string,
+): Effect.Effect<{ alreadyConfigured: boolean; otp?: string }, string> {
+  const encoded = encodePackageName(name);
+  log('  setting up (may require 2FA)...');
+  const body = JSON.stringify([{
+    type: 'github',
+    claims: { repository: ownerRepo, workflow_ref: { file: 'pipeline.yml' } },
+    permissions: ['createPackage'],
+  }]);
+  return Effect.tryPromise({
+    try: async () => {
+      const { otp, alreadyExists } = await registryPost(
+        `https://registry.npmjs.org/-/package/${encoded}/trust`, body, token,
+        { alreadyExistsStatus: 409 },
+      );
+      return { alreadyConfigured: alreadyExists, otp };
+    },
+    catch: (e) => `trust setup failed: ${e instanceof Error ? e.message : String(e)}`,
+  });
+}
+
+export function setPackageAccessPolicy(
+  name: string,
+  token: string,
+  existingOtp?: string,
+): Effect.Effect<void, string> {
+  const encoded = encodePackageName(name);
+  const body = JSON.stringify({ publish_requires_tfa: true, automation_token_overrides_tfa: false });
+  return Effect.tryPromise({
+    try: async () => {
+      await registryPost(
+        `https://registry.npmjs.org/-/package/${encoded}/access`, body, token,
+        { existingOtp },
+      );
+    },
+    catch: (e) => `access policy setup failed: ${e instanceof Error ? e.message : String(e)}`,
+  });
+}

package/src/commands/npm/setup/workflow.ts

@@ -0,0 +1,20 @@
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import WORKFLOW_TEMPLATE from './publish-workflow.yml' with { type: 'text' };
+
+const WORKFLOW_PATH = '.github/workflows/publish.yml';
+
+export async function workflowExists(repoRoot: string): Promise<boolean> {
+  try {
+    await fs.access(path.join(repoRoot, WORKFLOW_PATH));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function createWorkflow(repoRoot: string): Promise<void> {
+  const fullPath = path.join(repoRoot, WORKFLOW_PATH);
+  await fs.mkdir(path.dirname(fullPath), { recursive: true });
+  await fs.writeFile(fullPath, WORKFLOW_TEMPLATE, 'utf8');
+}