oche-cli 0.2.0 → 0.3.0

package/dist/index.js

@@ -3371,7 +3371,7 @@ var program = new Command();
 // package.json
 var package_default = {
   name: "oche-cli",
-  version: "0.2.0",
+  version: "0.3.0",
   description: "Command-line client for Oche: promote dev \u2192 staging \u2192 main from your terminal.",
   license: "MIT",
   repository: {
@@ -4182,6 +4182,22 @@ async function npmOut(bin, args) {
     return null;
   }
 }
+async function npmRead(bin, args) {
+  const quiet = await npmOut(bin, args);
+  if (quiet !== null) return quiet;
+  closeReader();
+  return new Promise((resolve) => {
+    const child = spawn(bin[0], [...bin.slice(1), ...args], { stdio: ["inherit", "pipe", "inherit"] });
+    let out = "";
+    child.stdout.on("data", (d) => {
+      out += d.toString();
+      for (const line of d.toString().split("\n")) if (/https?:\/\/|ENTER/.test(line)) process.stderr.write(`${line}
+`);
+    });
+    child.on("error", () => resolve(null));
+    child.on("exit", (code) => resolve(code === 0 ? out : null));
+  });
+}
 function npmLive(bin, args) {
   closeReader();
   return new Promise((resolve, reject) => {
@@ -4197,6 +4213,36 @@ async function localPackage() {
     return null;
   }
 }
+function parseTrustList(out) {
+  const entries = [];
+  let depth = 0;
+  let start = -1;
+  let inString = false;
+  for (let i = 0; i < out.length; i++) {
+    const ch = out[i];
+    if (inString) {
+      if (ch === "\\") i++;
+      else if (ch === '"') inString = false;
+    } else if (ch === '"') inString = true;
+    else if (ch === "{") {
+      if (depth++ === 0) start = i;
+    } else if (ch === "}" && --depth === 0) {
+      try {
+        const v = JSON.parse(out.slice(start, i + 1));
+        if (typeof v.id === "string") entries.push(v);
+      } catch {
+      }
+    }
+  }
+  if (!entries.length) {
+    try {
+      const v = JSON.parse(out);
+      if (Array.isArray(v)) return v.filter((e) => typeof e?.id === "string");
+    } catch {
+    }
+  }
+  return entries;
+}
 function printSteps(st) {
   for (const s of st.steps) {
     print(`  ${s.done ? c.green("\u2713") : c.dim("\u25CB")} ${s.label}${!s.done && s.hint ? c.dim(`  ${s.hint}`) : ""}`);
@@ -4277,20 +4323,29 @@ async function npmSetupCommand(client2, repoArg, opts) {
       throw e;
     }
   }
-  const trusted = await npmOut(bin, ["trust", "list", name, "--json"]);
-  const already = Boolean(trusted && trusted.includes(`${repo.owner}/${repo.repo}`) && trusted.includes(WORKFLOW_FILE));
-  if (already) {
+  const listed = await npmRead(bin, ["trust", "list", name, "--json"]);
+  if (listed === null) throw new CliError(`Couldn't read npm's trusted publishers for ${name}. Run \`npm trust list ${name}\` to see why.`);
+  const trust = parseTrustList(listed);
+  const sameRepo = (t) => t.type === "github" && t.repository?.toLowerCase() === slug(repo).toLowerCase();
+  if (trust.some((t) => sameRepo(t) && t.file === WORKFLOW_FILE)) {
     ok(`npm already trusts ${WORKFLOW_FILE} in ${slug(repo)}`);
   } else {
-    const old = others.find((f) => trusted && new RegExp(`(^|[^\\w.-])${f.replace(/\./g, "\\.")}`).test(trusted));
-    if (old) print(`
-npm trusts ${old} to publish ${name} today. This points it at ${WORKFLOW_FILE} instead.`);
     print(`
 npm will trust ${c.bold(`${slug(repo)} \u2192 .github/workflows/${WORKFLOW_FILE}`)} to publish ${name}. npm may ask for 2FA.`);
     if (!await ask2("Continue?")) throw new CliError("Stopped before changing npm's trust settings.");
     await npmLive(bin, ["trust", "github", name, "--file", WORKFLOW_FILE, "--repository", slug(repo), "--allow-publish", ...opts.yes ? ["--yes"] : []]);
     ok("npm trusts the workflow");
   }
+  for (const t of trust.filter((t2) => sameRepo(t2) && t2.file !== WORKFLOW_FILE)) {
+    print(`
+npm still trusts ${c.bold(t.file ?? "another workflow")} in ${slug(repo)} to publish ${name}.${others.includes(t.file ?? "") ? " Oche's PR removes that file." : ""}`);
+    if (await ask2(`Revoke it? Only ${WORKFLOW_FILE} will be able to publish.`)) {
+      await npmLive(bin, ["trust", "revoke", name, `--id=${t.id}`]);
+      ok(`Revoked ${t.file}`);
+    } else {
+      print(c.dim(`Kept. Revoke it later with: npm trust revoke ${name} --id=${t.id}`));
+    }
+  }
   st = await api.npmTrust(repo, { packageName: name, npmUser });
   print();
   printSteps(st);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oche-cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Command-line client for Oche: promote dev → staging → main from your terminal.",
   "license": "MIT",
   "repository": {