@packtory/bootstrap-npm-package 0.0.1 → 0.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) [2023]
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bootstrap-npm-package/bootstrap-runner.js

@@ -0,0 +1,69 @@
+const registryUrl = 'https://registry.npmjs.org/';
+const workaroundUrl = 'https://github.com/npm/cli/issues/8544';
+const distTag = 'bootstrap';
+const placeholderVersion = '0.0.1';
+const placeholderLicense = 'MIT';
+function buildManifestDescription(packageName) {
+    return (`Placeholder claiming the npm package name "${packageName}" so a trusted publisher ` +
+        `can be configured. See ${workaroundUrl}.`);
+}
+function buildDeprecationMessage() {
+    return `Placeholder published as a workaround so a Trusted Publisher could be configured. See ${workaroundUrl}.`;
+}
+function buildManifest(packageName) {
+    return {
+        name: packageName,
+        version: placeholderVersion,
+        description: buildManifestDescription(packageName),
+        license: placeholderLicense,
+        deprecated: buildDeprecationMessage()
+    };
+}
+function buildReadme(packageName) {
+    return [
+        `# ${packageName}`,
+        '',
+        `This version is a placeholder published only to claim the npm name \`${packageName}\` so a Trusted Publisher`,
+        'can subsequently be configured for it. It contains no real package content and is published already',
+        'deprecated.',
+        '',
+        `Workaround context: ${workaroundUrl}`,
+        ''
+    ].join('\n');
+}
+function buildTrustedPublisherUrl(packageName) {
+    return `https://www.npmjs.com/package/${packageName}/access`;
+}
+function buildAuthenticatedMessage(username) {
+    return username === undefined || username.length === 0
+        ? 'Authenticated to npm'
+        : `Authenticated to npm as ${username}`;
+}
+function buildPublishLogMessage(packageName, version) {
+    return `Publishing ${packageName}@${version} (already deprecated) under dist-tag ${distTag}`;
+}
+export function createBootstrapRunner(dependencies) {
+    const { placeholderTarballBuilder, webLogin, packagePublication, promptForOneTimePassword, log } = dependencies;
+    return {
+        async run(input) {
+            const manifest = buildManifest(input.packageName);
+            const readmeContent = buildReadme(input.packageName);
+            log(`Building placeholder tarball for ${input.packageName}@${manifest.version}`);
+            const tarball = await placeholderTarballBuilder.build({ manifest, readmeContent });
+            log('Opening browser for npm web login');
+            const session = await webLogin.login({ registryUrl, hostname: input.hostname });
+            log(buildAuthenticatedMessage(session.username));
+            log(buildPublishLogMessage(input.packageName, manifest.version));
+            await packagePublication.publish({
+                manifest,
+                tarball,
+                token: session.token,
+                registryUrl,
+                distTag,
+                promptForOneTimePassword
+            });
+            log(`Done. Configure the Trusted Publisher at ${buildTrustedPublisherUrl(input.packageName)}`);
+        }
+    };
+}
+//# sourceMappingURL=bootstrap-runner.js.map

package/bootstrap-npm-package/bootstrap-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-runner.js","sourceRoot":"","sources":["../../../../source/bootstrap-npm-package/bootstrap-runner.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,aAAa,GAAG,wCAAwC,CAAC;AAC/D,MAAM,OAAO,GAAG,WAAW,CAAC;AAC5B,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,SAAS,wBAAwB,CAAC,WAAmB;IACjD,OAAO,CACH,8CAA8C,WAAW,2BAA2B;QACpF,0BAA0B,aAAa,GAAG,CAC7C,CAAC;AACN,CAAC;AAED,SAAS,uBAAuB;IAC5B,OAAO,yFAAyF,aAAa,GAAG,CAAC;AACrH,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB;IACtC,OAAO;QACH,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,wBAAwB,CAAC,WAAW,CAAC;QAClD,OAAO,EAAE,kBAAkB;QAC3B,UAAU,EAAE,uBAAuB,EAAE;KACxC,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB;IACpC,OAAO;QACH,KAAK,WAAW,EAAE;QAClB,EAAE;QACF,wEAAwE,WAAW,2BAA2B;QAC9G,qGAAqG;QACrG,aAAa;QACb,EAAE;QACF,uBAAuB,aAAa,EAAE;QACtC,EAAE;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAmB;IACjD,OAAO,iCAAiC,WAAW,SAAS,CAAC;AACjE,CAAC;AAED,SAAS,yBAAyB,CAAC,QAA4B;IAC3D,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAClD,CAAC,CAAC,sBAAsB;QACxB,CAAC,CAAC,2BAA2B,QAAQ,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAmB,EAAE,OAAe;IAChE,OAAO,cAAc,WAAW,IAAI,OAAO,wCAAwC,OAAO,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAmD;IACrF,MAAM,EAAE,yBAAyB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC;IAEhH,OAAO;QACH,KAAK,CAAC,GAAG,CAAC,KAAK;YACX,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAErD,GAAG,CAAC,oCAAoC,KAAK,CAAC,WAAW,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YACjF,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;YAEnF,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAChF,GAAG,CAAC,yBAAyB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEjD,GAAG,CAAC,sBAAsB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACjE,MAAM,kBAAkB,CAAC,OAAO,CAAC;gBAC7B,QAAQ;gBACR,OAAO;gBACP,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW;gBACX,OAAO;gBACP,wBAAwB;aAC3B,CAAC,CAAC;YAEH,GAAG,CAAC,4CAA4C,wBAAwB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;KACJ,CAAC;AACN,CAAC"}

package/bootstrap-npm-package/package-publication.js

@@ -0,0 +1,42 @@
+function isRecord(value) {
+    return value instanceof Object && !Array.isArray(value);
+}
+function isOneTimePasswordRequiredError(error) {
+    return isRecord(error) && error.code === 'EOTP';
+}
+function extractWebOtpUrls(error) {
+    const { body } = error;
+    if (!isRecord(body)) {
+        return undefined;
+    }
+    const { authUrl, doneUrl } = body;
+    if (typeof authUrl !== 'string' || typeof doneUrl !== 'string') {
+        return undefined;
+    }
+    return { authUrl, doneUrl };
+}
+export function createPackagePublication(dependencies) {
+    const { publish } = dependencies;
+    return {
+        async publish(input) {
+            const baseOptions = {
+                defaultTag: input.distTag,
+                access: 'public',
+                registry: input.registryUrl,
+                forceAuth: { token: input.token },
+                authType: 'web'
+            };
+            try {
+                await publish(input.manifest, input.tarball, baseOptions);
+            }
+            catch (error) {
+                if (!isOneTimePasswordRequiredError(error)) {
+                    throw error;
+                }
+                const otp = await input.promptForOneTimePassword(extractWebOtpUrls(error));
+                await publish(input.manifest, input.tarball, { ...baseOptions, otp });
+            }
+        }
+    };
+}
+//# sourceMappingURL=package-publication.js.map

package/bootstrap-npm-package/package-publication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-publication.js","sourceRoot":"","sources":["../../../../source/bootstrap-npm-package/package-publication.ts"],"names":[],"mappings":"AA+CA,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAc;IAClD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAkC;IACzD,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,YAAsD;IAC3F,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC;IAEjC,OAAO;QACH,KAAK,CAAC,OAAO,CAAC,KAAK;YACf,MAAM,WAAW,GAAyB;gBACtC,UAAU,EAAE,KAAK,CAAC,OAAO;gBACzB,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,KAAK,CAAC,WAAW;gBAC3B,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBACjC,QAAQ,EAAE,KAAK;aAClB,CAAC;YAEF,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzC,MAAM,KAAK,CAAC;gBAChB,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3E,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1E,CAAC;QACL,CAAC;KACJ,CAAC;AACN,CAAC"}

package/bootstrap-npm-package/placeholder-tarball.js

@@ -0,0 +1,47 @@
+const staticFileModificationTimeEpochMilliseconds = 0;
+const regularFileMode = 420;
+const gzipHeaderOperatingSystemFieldIndex = 9;
+const gzipHeaderOperatingSystemUnknown = 255;
+const manifestJsonIndent = 2;
+function normalizeGzipHeader(data) {
+    const normalized = Buffer.from(data);
+    normalized[gzipHeaderOperatingSystemFieldIndex] = gzipHeaderOperatingSystemUnknown;
+    return normalized;
+}
+function serializeManifest(manifest) {
+    return `${JSON.stringify(manifest, null, manifestJsonIndent)}\n`;
+}
+function appendFile(pack, name, content) {
+    pack.entry({
+        name,
+        size: Buffer.byteLength(content),
+        mtime: new Date(staticFileModificationTimeEpochMilliseconds),
+        mode: regularFileMode
+    }, content);
+}
+function toBuffer(chunk) {
+    return Buffer.from(chunk);
+}
+async function collectGzippedTarball(pack, createGzip) {
+    const tarballStream = pack.pipe(createGzip());
+    const chunks = [];
+    for await (const chunk of tarballStream) {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- gzip stream yields buffers in this usage
+        chunks.push(toBuffer(chunk));
+    }
+    return normalizeGzipHeader(Buffer.concat(chunks));
+}
+export function createPlaceholderTarballBuilder(dependencies) {
+    const { createGzip, createPack } = dependencies;
+    return {
+        async build(input) {
+            const pack = createPack();
+            const result = collectGzippedTarball(pack, createGzip);
+            appendFile(pack, 'package/package.json', serializeManifest(input.manifest));
+            appendFile(pack, 'package/readme.md', input.readmeContent);
+            pack.finalize();
+            return result;
+        }
+    };
+}
+//# sourceMappingURL=placeholder-tarball.js.map

package/bootstrap-npm-package/placeholder-tarball.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"placeholder-tarball.js","sourceRoot":"","sources":["../../../../source/bootstrap-npm-package/placeholder-tarball.ts"],"names":[],"mappings":"AAyBA,MAAM,2CAA2C,GAAG,CAAC,CAAC;AACtD,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,mCAAmC,GAAG,CAAC,CAAC;AAC9C,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,SAAS,mBAAmB,CAAC,IAAY;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,UAAU,CAAC,mCAAmC,CAAC,GAAG,gCAAgC,CAAC;IACnF,OAAO,UAAU,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAA6B;IACpD,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,IAAY,EAAE,OAAe;IAC7D,IAAI,CAAC,KAAK,CACN;QACI,IAAI;QACJ,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;QAChC,KAAK,EAAE,IAAI,IAAI,CAAC,2CAA2C,CAAC;QAC5D,IAAI,EAAE,eAAe;KACxB,EACD,OAAO,CACV,CAAC;AACN,CAAC;AAED,SAAS,QAAQ,CAAC,KAAsB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAAc,EAAE,UAAkC;IACnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,aAAuC,EAAE,CAAC;QAChE,mHAAmH;QACnH,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAwB,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC3C,YAA6D;IAE7D,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC;IAEhD,OAAO;QACH,KAAK,CAAC,KAAK,CAAC,KAAK;YACb,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACvD,UAAU,CAAC,IAAI,EAAE,sBAAsB,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5E,UAAU,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC;QAClB,CAAC;KACJ,CAAC;AACN,CAAC"}

package/bootstrap-npm-package/web-login.js

@@ -0,0 +1,13 @@
+export function createWebLogin(dependencies) {
+    const { loginWeb, openInBrowser } = dependencies;
+    return {
+        async login(input) {
+            return loginWeb(openInBrowser, {
+                registry: input.registryUrl,
+                hostname: input.hostname,
+                authType: 'web'
+            });
+        }
+    };
+}
+//# sourceMappingURL=web-login.js.map

package/bootstrap-npm-package/web-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-login.js","sourceRoot":"","sources":["../../../../source/bootstrap-npm-package/web-login.ts"],"names":[],"mappings":"AA6BA,MAAM,UAAU,cAAc,CAAC,YAA4C;IACvE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,YAAY,CAAC;IAEjD,OAAO;QACH,KAAK,CAAC,KAAK,CAAC,KAAK;YACb,OAAO,QAAQ,CAAC,aAAa,EAAE;gBAC3B,QAAQ,EAAE,KAAK,CAAC,WAAW;gBAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK;aAClB,CAAC,CAAC;QACP,CAAC;KACJ,CAAC;AACN,CAAC"}

package/package.json

@@ -1,7 +1,46 @@
 {
-  "name": "@packtory/bootstrap-npm-package",
-  "version": "0.0.1",
-  "description": "Placeholder claiming the npm package name \"@packtory/bootstrap-npm-package\" so a trusted publisher can be configured. See https://github.com/npm/cli/issues/8544.",
-  "license": "MIT",
-  "deprecated": "Placeholder published as a workaround so a Trusted Publisher could be configured. See https://github.com/npm/cli/issues/8544."
-}
+    "author": "Mathias Schreck <schreck.mathias@gmail.com>",
+    "bin": {
+        "bootstrap-npm-package": "./packages/bootstrap-npm-package/bootstrap-npm-package.entry-point.js"
+    },
+    "contributors": [
+        "Christian Rackerseder <github@echooff.de>"
+    ],
+    "dependencies": {
+        "cmd-ts": "0.15.0",
+        "libnpmpublish": "11.2.0",
+        "npm-profile": "13.0.0",
+        "open": "11.0.0",
+        "tar-stream": "3.1.8"
+    },
+    "description": "Claim a brand-new npm name so a Trusted Publisher can be configured for it (workaround for npm/cli#8544).",
+    "engines": {
+        "node": "^24 || ^26"
+    },
+    "exports": {
+        "./package.json": "./package.json"
+    },
+    "keywords": [
+        "bundler",
+        "bundling",
+        "modules",
+        "monorepo",
+        "npm",
+        "package",
+        "packaging",
+        "publish",
+        "publishing",
+        "versioning"
+    ],
+    "license": "MIT",
+    "name": "@packtory/bootstrap-npm-package",
+    "repository": {
+        "type": "git",
+        "url": "git+ssh://git@github.com/enormora/packtory.git"
+    },
+    "sideEffects": [
+        "./packages/bootstrap-npm-package/bootstrap-npm-package.entry-point.js"
+    ],
+    "type": "module",
+    "version": "0.0.2"
+}

package/packages/bootstrap-npm-package/bootstrap-npm-package.entry-point.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+import os from 'node:os';
+import readline from 'node:readline/promises';
+import zlib from 'node:zlib';
+import { binary, command, positional, run, string } from 'cmd-ts';
+import { publish as libnpmpublishPublish } from 'libnpmpublish';
+import { loginWeb, webAuthOpener } from 'npm-profile';
+import open from 'open';
+import tar from 'tar-stream';
+import { createBootstrapRunner } from "../../bootstrap-npm-package/bootstrap-runner.js";
+import { createPackagePublication } from "../../bootstrap-npm-package/package-publication.js";
+import { createPlaceholderTarballBuilder } from "../../bootstrap-npm-package/placeholder-tarball.js";
+import { createWebLogin } from "../../bootstrap-npm-package/web-login.js";
+const npmRegistryUrl = 'https://registry.npmjs.org/';
+async function openInBrowser(loginUrl) {
+    await open(loginUrl, { wait: false });
+}
+async function promptForOneTimePasswordViaTerminal() {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new Error('The npm registry requested a one-time password, but stdin is not an interactive terminal');
+    }
+    const prompt = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await prompt.question('Registry one-time password: ');
+        const trimmed = answer.trim();
+        if (trimmed.length === 0) {
+            throw new Error('One-time password input was empty');
+        }
+        return trimmed;
+    }
+    finally {
+        prompt.close();
+    }
+}
+async function promptForOneTimePasswordViaBrowser(urls) {
+    process.stdout.write('Opening browser to authorize the publish; complete the prompt in your browser…\n');
+    const result = await webAuthOpener(openInBrowser, urls.authUrl, urls.doneUrl, { registry: npmRegistryUrl });
+    return result.token;
+}
+async function promptForOneTimePassword(urls) {
+    if (urls === undefined) {
+        return promptForOneTimePasswordViaTerminal();
+    }
+    return promptForOneTimePasswordViaBrowser(urls);
+}
+function createDependencies() {
+    return {
+        placeholderTarballBuilder: createPlaceholderTarballBuilder({
+            createGzip: zlib.createGzip,
+            createPack: tar.pack
+        }),
+        webLogin: createWebLogin({ loginWeb, openInBrowser }),
+        packagePublication: createPackagePublication({ publish: libnpmpublishPublish }),
+        promptForOneTimePassword,
+        log: (message) => {
+            process.stdout.write(`${message}\n`);
+        }
+    };
+}
+function createComposedRunner() {
+    return createBootstrapRunner(createDependencies());
+}
+const bootstrapCommand = command({
+    name: 'bootstrap-npm-package',
+    description: 'Publishes a deprecated placeholder version 0.0.1 of a brand-new npm package so ' +
+        'a Trusted Publisher can subsequently be configured for the name.',
+    args: {
+        packageName: positional({ type: string, displayName: 'package-name' })
+    },
+    async handler(args) {
+        const runner = createComposedRunner();
+        const input = { packageName: args.packageName, hostname: os.hostname() };
+        await runner.run(input);
+    }
+});
+await run(binary(bootstrapCommand), process.argv);
+//# sourceMappingURL=bootstrap-npm-package.entry-point.js.map

package/packages/bootstrap-npm-package/bootstrap-npm-package.entry-point.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-npm-package.entry-point.js","sourceRoot":"","sources":["../../../../../source/packages/bootstrap-npm-package/bootstrap-npm-package.entry-point.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,wBAAwB,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,GAAG,MAAM,YAAY,CAAC;AAC7B,OAAO,EACH,qBAAqB,EAIxB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAmB,MAAM,oDAAoD,CAAC;AAC/G,OAAO,EAAE,+BAA+B,EAAE,MAAM,oDAAoD,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAW1E,MAAM,cAAc,GAAG,6BAA6B,CAAC;AAErD,KAAK,UAAU,aAAa,CAAC,QAAgB;IACzC,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,mCAAmC;IAC9C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;YAAS,CAAC;QACP,MAAM,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kCAAkC,CAAC,IAAgB;IAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACzG,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IAC5G,OAAO,MAAM,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,IAA4B;IAChE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,mCAAmC,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,kCAAkC,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,kBAAkB;IACvB,OAAO;QACH,yBAAyB,EAAE,+BAA+B,CAAC;YACvD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,GAAG,CAAC,IAAI;SACvB,CAAC;QACF,QAAQ,EAAE,cAAc,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;QACrD,kBAAkB,EAAE,wBAAwB,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;QAC/E,wBAAwB;QACxB,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACzC,CAAC;KACJ,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB;IACzB,OAAO,qBAAqB,CAAC,kBAAkB,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,gBAAgB,GAAG,OAAO,CAAC;IAC7B,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EACP,iFAAiF;QACjF,kEAAkE;IACtE,IAAI,EAAE;QACF,WAAW,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;KACzE;IACD,KAAK,CAAC,OAAO,CAAC,IAAI;QACd,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAmB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACzF,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/readme.md

@@ -1,7 +1,49 @@
 # @packtory/bootstrap-npm-package
 
-This version is a placeholder published only to claim the npm name `@packtory/bootstrap-npm-package` so a Trusted Publisher
-can subsequently be configured for it. It contains no real package content and is published already
-deprecated.
+**Claim a brand-new npm package name so a Trusted Publisher can be configured for it**
 
-Workaround context: https://github.com/npm/cli/issues/8544
+npm's Trusted Publisher configuration UI is reachable only on the per-package settings page, which means a Trusted Publisher cannot be configured before the package exists on the registry. See [`npm/cli#8544`](https://github.com/npm/cli/issues/8544) for tracking.
+
+This tool publishes a placeholder `0.0.1` for a brand-new npm name on `registry.npmjs.org` so the per-package settings page becomes reachable. The placeholder is marked deprecated in the manifest and shipped under the `bootstrap` dist-tag, so `latest` stays empty until the first real release. After running it, configure the Trusted Publisher in the npm UI and proceed with normal OIDC-backed publishes for `0.0.2` and later.
+
+## Installation
+
+```bash
+npm install -g @packtory/bootstrap-npm-package
+```
+
+## Usage
+
+```bash
+bootstrap-npm-package <package-name>
+```
+
+Example for a brand-new scoped package:
+
+```bash
+bootstrap-npm-package @your-scope/new-package
+```
+
+The tool will:
+
+1. Build a placeholder tarball containing only a minimal `package.json` and `readme.md` that explains the workaround.
+2. Open your browser for the standard npm web login flow and wait for you to complete it (2FA included).
+3. Publish version `0.0.1` against `registry.npmjs.org` under the `bootstrap` dist-tag so it never sits on `latest`. The manifest carries the deprecation message in the same write, so a separate `npm deprecate` is not needed.
+4. Print the URL for the new package's Trusted Publisher settings page.
+
+After the tool exits, configure the Trusted Publisher in the npm UI, then publish `0.0.2` (and later) from CI via OIDC with full provenance.
+
+## Argument
+
+- `<package-name>`: required. The npm name to claim, scoped (e.g. `@scope/foo`) or unscoped.
+
+The registry, the workaround URL embedded in the placeholder, and the placeholder's dist-tag are intentionally not configurable — the tool is single-purpose and targets `registry.npmjs.org`, the `npm/cli#8544` tracking issue, and the `bootstrap` dist-tag.
+
+## What gets published
+
+The tarball contains exactly two files:
+
+- `package/package.json` with the minimal fields `name`, `version`, `description`, `license`, `deprecated`.
+- `package/readme.md` explaining that the version is a placeholder and pointing at the workaround context.
+
+The published version has no provenance attestation, no SBOM, and no runtime content. The `deprecated` field is set on publish so consumers see the warning even if they attempt to install it explicitly.

package/sbom.cdx.json

@@ -0,0 +1,118 @@
+{
+    "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
+    "bomFormat": "CycloneDX",
+    "specVersion": "1.6",
+    "version": 1,
+    "metadata": {
+        "tools": {
+            "components": [
+                {
+                    "type": "application",
+                    "name": "packtory",
+                    "version": "0.0.29"
+                }
+            ]
+        },
+        "component": {
+            "type": "library",
+            "name": "@packtory/bootstrap-npm-package",
+            "version": "0.0.2",
+            "bom-ref": "pkg:npm/@packtory/bootstrap-npm-package@0.0.2",
+            "purl": "pkg:npm/@packtory/bootstrap-npm-package@0.0.2"
+        }
+    },
+    "components": [
+        {
+            "type": "library",
+            "name": "cmd-ts",
+            "version": "0.15.0",
+            "bom-ref": "pkg:npm/cmd-ts@0.15.0",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/cmd-ts@0.15.0"
+        },
+        {
+            "type": "library",
+            "name": "libnpmpublish",
+            "version": "11.2.0",
+            "bom-ref": "pkg:npm/libnpmpublish@11.2.0",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "ISC"
+                }
+            ],
+            "purl": "pkg:npm/libnpmpublish@11.2.0"
+        },
+        {
+            "type": "library",
+            "name": "npm-profile",
+            "version": "13.0.0",
+            "bom-ref": "pkg:npm/npm-profile@13.0.0",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "ISC"
+                }
+            ],
+            "purl": "pkg:npm/npm-profile@13.0.0"
+        },
+        {
+            "type": "library",
+            "name": "open",
+            "version": "11.0.0",
+            "bom-ref": "pkg:npm/open@11.0.0",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/open@11.0.0"
+        },
+        {
+            "type": "library",
+            "name": "tar-stream",
+            "version": "3.1.8",
+            "bom-ref": "pkg:npm/tar-stream@3.1.8",
+            "scope": "required",
+            "licenses": [
+                {
+                    "expression": "MIT"
+                }
+            ],
+            "purl": "pkg:npm/tar-stream@3.1.8"
+        }
+    ],
+    "dependencies": [
+        {
+            "ref": "pkg:npm/@packtory/bootstrap-npm-package@0.0.2",
+            "dependsOn": [
+                "pkg:npm/cmd-ts@0.15.0",
+                "pkg:npm/libnpmpublish@11.2.0",
+                "pkg:npm/npm-profile@13.0.0",
+                "pkg:npm/open@11.0.0",
+                "pkg:npm/tar-stream@3.1.8"
+            ]
+        },
+        {
+            "ref": "pkg:npm/cmd-ts@0.15.0"
+        },
+        {
+            "ref": "pkg:npm/libnpmpublish@11.2.0"
+        },
+        {
+            "ref": "pkg:npm/npm-profile@13.0.0"
+        },
+        {
+            "ref": "pkg:npm/open@11.0.0"
+        },
+        {
+            "ref": "pkg:npm/tar-stream@3.1.8"
+        }
+    ]
+}