package-registry-manager 0.21.0 → 0.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
     "provenance": true
   },
   "scripts": {
-    "syntax": "node --check src/cli.mjs && node --check src/index.mjs && node --check src/browser.mjs && node --check src/browser-options.mjs && node --check src/automation.mjs && node --check src/profile.mjs && node --check src/setup.mjs && node --check src/auth-urls.mjs && node --check src/containers.mjs && node --check src/flows.mjs && node --check src/prerequisites.mjs && node --check src/registry-state.mjs && node --check src/workflows.mjs && node --check src/publishers.mjs && node --check src/skips.mjs && node --check src/tokens.mjs && node --check src/approvals.mjs && node --check src/default-browser.mjs && node --check src/pages.mjs && node --check scripts/publish-to-npm.mjs && node --check scripts/setup-npm.mjs && node --check scripts/sanitize-npm-userconfig.mjs",
+    "syntax": "node --check src/cli.mjs && node --check src/index.mjs && node --check src/browser.mjs && node --check src/browser-options.mjs && node --check src/automation.mjs && node --check src/profile.mjs && node --check src/setup.mjs && node --check src/auth-urls.mjs && node --check src/containers.mjs && node --check src/flows.mjs && node --check src/prerequisites.mjs && node --check src/registry-state.mjs && node --check src/workflows.mjs && node --check src/publishers.mjs && node --check src/skips.mjs && node --check src/tokens.mjs && node --check src/approvals.mjs && node --check src/default-browser.mjs && node --check src/pages.mjs && node --check src/crates-api.mjs && node --check src/sign-in-import.mjs && node --check scripts/publish-to-npm.mjs && node --check scripts/setup-npm.mjs && node --check scripts/sanitize-npm-userconfig.mjs",
     "lint": "eslint src test scripts --max-warnings 0",
     "lint:fix": "eslint src test scripts --fix --max-warnings 0",
     "format": "prettier --write .",

package/src/automation.mjs

@@ -9,6 +9,7 @@ import {
 
 import { snapshotBrowser } from "./browser-options.mjs";
 import { defaultBrowserProfile, ensureProfileIgnored } from "./profile.mjs";
+import { IMPORT_CHOICES, migrationFor } from "./sign-in-import.mjs";
 
 /** How long `--browser-attach extension` waits for the extension to connect. */
 export const EXTENSION_TIMEOUT_MS = 300_000;
@@ -21,9 +22,11 @@ export function relayExtensionDirectory() {
 /**
  * The `launchRealBrowser` options for the automated browser: the dedicated
  * profile by default, optionally seeded from a real profile, or a temporary
- * snapshot of the user's own profile with `--browser-attach snapshot`.
+ * snapshot of the user's own profile with `--browser-attach snapshot`. With
+ * the `domains` import scope only the cookies of `domains`, the registry's
+ * sign-in domains, are imported.
  */
-export function launchOptions(browser, profile, verbose = false) {
+export function launchOptions(browser, profile, verbose = false, domains = []) {
   const options = {
     engine: "playwright",
     channel: browser.channel,
@@ -48,11 +51,13 @@ export function launchOptions(browser, profile, verbose = false) {
     return options;
   }
   options.userDataDir = profile;
-  if (browser.import) {
-    options.migrateFrom = {
-      browser: browser.import.browser,
-      ...(browser.import.profile ? { profile: browser.import.profile } : {}),
-    };
+  // `default` and `auto` are resolved to an installed browser before launch.
+  if (browser.import && !IMPORT_CHOICES.includes(browser.import.browser)) {
+    options.migrateFrom = migrationFor(
+      browser.import,
+      browser.importScope ?? "full",
+      domains,
+    );
   }
   return options;
 }
@@ -68,9 +73,14 @@ export function extensionInstructions(directory) {
 
 /**
  * Connects the browser that fills forms and returns a page with `goto`,
- * `evaluate`, and `close`.
+ * `evaluate`, `close`, and, for a launched profile, `clearCookies(domains)`.
  */
-export async function connectAutomation({ browser, profile, verbose = false }) {
+export async function connectAutomation({
+  browser,
+  profile,
+  verbose = false,
+  domains = [],
+}) {
   if (browser.attach?.mode === "extension") {
     return connectExtension();
   }
@@ -78,12 +88,20 @@ export async function connectAutomation({ browser, profile, verbose = false }) {
     await ensureProfileIgnored(profile, { verbose });
   }
   const connection = await launchRealBrowser(
-    launchOptions(browser, profile, verbose),
+    launchOptions(browser, profile, verbose, domains),
   );
   return {
     goto: (url) => connection.page.goto(url),
     evaluate: (script) => connection.page.evaluate(script),
     close: () => connection.browser.close(),
+    async clearCookies(names) {
+      for (const name of names) {
+        const escaped = name.replaceAll(".", "\\.");
+        await connection.page
+          .context()
+          .clearCookies({ domain: new RegExp(`(?:^|\\.)${escaped}$`) });
+      }
+    },
   };
 }
 

package/src/browser-options.mjs

@@ -5,8 +5,20 @@ import {
   LAUNCH_RESTRICTIONS,
 } from "browser-commander";
 
-/** Browsers whose profile `--browser-import` can migrate. */
-export const IMPORT_BROWSERS = ["chrome", "edge", "brave", "firefox"];
+import {
+  IMPORT_CHOICES,
+  IMPORT_SCOPES,
+  importSources,
+} from "./sign-in-import.mjs";
+
+/**
+ * What `--browser-import` accepts: every browser Browser Commander reads,
+ * plus `default` (the system default browser) and `auto` (accept the
+ * sign-in import offer, the default browser first).
+ */
+export function importBrowsers() {
+  return [...importSources(), ...IMPORT_CHOICES];
+}
 /** How `--browser-attach` reaches the user's own browser. */
 export const ATTACH_MODES = ["snapshot", "extension"];
 
@@ -31,6 +43,7 @@ export function parseBrowserOptions({
   channel = "chrome",
   executable,
   importFrom,
+  importScope,
   attach,
   preferences = [],
   restrictions = [],
@@ -40,6 +53,7 @@ export function parseBrowserOptions({
     channel,
     executable: executable ? path.resolve(executable) : null,
     import: importFrom ? parseImport(importFrom) : null,
+    importScope: parseImportScope(importScope, importFrom),
     attach: attach ? parseAttach(attach) : null,
     preferences: parsePreferences(preferences),
     restrictions: validateRestrictions(restrictions),
@@ -67,19 +81,41 @@ export function parseBrowserOptions({
   return options;
 }
 
-/** Parses `<chrome|edge|brave|firefox>[:profile]`. */
+/** Parses `<browser>[:profile]`, `default`, or `auto`. */
 export function parseImport(spec) {
   const separator = spec.indexOf(":");
   const browser = separator === -1 ? spec : spec.slice(0, separator);
   const profile = separator === -1 ? null : spec.slice(separator + 1);
-  if (!IMPORT_BROWSERS.includes(browser) || profile === "") {
+  const choice = IMPORT_CHOICES.includes(browser);
+  if (
+    !importBrowsers().includes(browser) ||
+    profile === "" ||
+    (choice && profile !== null)
+  ) {
     throw new Error(
-      "--browser-import must be <chrome|edge|brave|firefox>[:profile]",
+      `--browser-import must be <${importSources().join("|")}>[:profile], default, or auto`,
     );
   }
   return { browser, profile };
 }
 
+/**
+ * Parses `--browser-import-scope`: `full` migrates the whole profile and
+ * `domains` only the registry's sign-in cookies. Without it a named browser
+ * is migrated fully, as before, and `default`, `auto`, and the sign-in offer
+ * import only the sign-in domains.
+ */
+export function parseImportScope(scope, importFrom) {
+  if (scope === undefined || scope === null) {
+    const named = importFrom && !IMPORT_CHOICES.includes(importFrom);
+    return named ? "full" : "domains";
+  }
+  if (!IMPORT_SCOPES.includes(scope)) {
+    throw new Error("--browser-import-scope must be full or domains");
+  }
+  return scope;
+}
+
 /** Parses `snapshot`, `snapshot:<profile>`, or `extension`. */
 export function parseAttach(spec) {
   if (spec === "extension") {

package/src/cli.mjs

@@ -50,9 +50,13 @@ Setup options:
   --open-with <app>               Open sign-in and approval pages in this
                                   application instead of the default browser,
                                   such as "Google Chrome" (macOS) or firefox
-  --keep-session                  Stay signed in to npm after setup; the
-                                  session token stays in npm's user
-                                  configuration until npm logout
+  --manual                        crates.io: create, use, and revoke the
+                                  first-publish token by hand instead of
+                                  through the crates.io API
+  --keep-session                  Stay signed in after setup: npm keeps its
+                                  session token in npm's user configuration
+                                  until npm logout; crates.io keeps only the
+                                  automated profile's browser session
   --browser <default|automated>   Open sign-in and approval pages in your
                                   default browser, or in the automated
                                   profile too (default: default)
@@ -63,10 +67,16 @@ Setup options:
                                   instead of the channel's
   --browser-profile <path>        Dedicated automation profile, used to fill
                                   forms (default: per-user state directory)
-  --browser-import <browser>[:<profile>]
-                                  Copy cookies, history, and other data from
-                                  your chrome, edge, brave, or firefox profile
-                                  into the automated profile first
+  --browser-import <browser>[:<profile>]|default|auto
+                                  Copy data from your chrome, edge, brave,
+                                  chromium, or firefox profile into the
+                                  automated profile first; default takes the
+                                  system default browser, auto the first
+                                  browser signed in to the registry
+  --browser-import-scope <full|domains>
+                                  Import the whole profile, or only the
+                                  registry's sign-in cookies (default: full
+                                  for a named browser, domains otherwise)
   --browser-attach <mode>         Fill forms in your own browser instead:
                                   snapshot[:<profile>] launches a temporary
                                   copy of your profile, extension drives your
@@ -100,11 +110,13 @@ export async function main(args = process.argv.slice(2)) {
       "no-browser": { type: "boolean", default: false },
       "open-with": { type: "string" },
       "keep-session": { type: "boolean", default: false },
+      manual: { type: "boolean", default: false },
       browser: { type: "string", default: "default" },
       "browser-channel": { type: "string", default: "chrome" },
       "browser-profile": { type: "string" },
       "browser-executable": { type: "string" },
       "browser-import": { type: "string" },
+      "browser-import-scope": { type: "string" },
       "browser-attach": { type: "string" },
       "browser-pref": { type: "string", multiple: true },
       "browser-restriction": { type: "string", multiple: true },
@@ -133,6 +145,7 @@ export async function main(args = process.argv.slice(2)) {
     channel: values["browser-channel"],
     executable: values["browser-executable"],
     importFrom: values["browser-import"],
+    importScope: values["browser-import-scope"],
     attach: values["browser-attach"],
     preferences: values["browser-pref"],
     restrictions: values["browser-restriction"],
@@ -168,6 +181,7 @@ export async function main(args = process.argv.slice(2)) {
   });
   const planOptions = {
     verifyRelease: values["verify-release"],
+    manual: values.manual,
     workflow: await workflowOverride(repository, values.workflow),
     publisherEnvironment: nonEmpty(values.environment, "--environment"),
     environment,

package/src/crates-api.mjs

@@ -0,0 +1,423 @@
+// The crates.io first publish through the crates.io API (#26): the automated
+// browser holds the crates.io session, a short-lived token limited to one
+// crate is created from inside the page, handed only to the `cargo publish`
+// child process, used to attach the trusted publisher, then revoked and the
+// revocation verified. The token never reaches the DOM, the terminal, the
+// clipboard, or cargo's credentials file.
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+import { registryEndpoint, USER_AGENT } from "./registry-state.mjs";
+import { offerSignInImport, signInDomains } from "./sign-in-import.mjs";
+import { checkCratesToken, CRATES_TOKENS_URL } from "./tokens.mjs";
+
+/** Where the automated browser signs in to crates.io. */
+export const CRATES_IO_URL = "https://crates.io/";
+/** Where a crates.io account verifies its email address. */
+export const CRATES_PROFILE_URL = "https://crates.io/settings/profile";
+/** How long the first-publish token lives, in milliseconds. */
+export const TOKEN_LIFETIME_MS = 60 * 60_000;
+/** The only endpoints the first-publish token may call. */
+export const TOKEN_SCOPES = ["publish-new", "trusted-publishing"];
+/** How long the sign-in waits for the maintainer, in milliseconds. */
+export const SIGN_IN_TIMEOUT_MS = 10 * 60_000;
+
+/** The `PUT /api/v1/me/tokens` body: one crate, two endpoints, one hour. */
+export function tokenRequest(crate, now = new Date()) {
+  return {
+    api_token: {
+      name: `prm-first-publish-${crate}`,
+      crate_scopes: [crate],
+      endpoint_scopes: TOKEN_SCOPES,
+      expired_at: new Date(now.getTime() + TOKEN_LIFETIME_MS).toISOString(),
+    },
+  };
+}
+
+/** The `POST /api/v1/trusted_publishing/github_configs` body. */
+export function githubConfigRequest(crate, publisher) {
+  return {
+    github_config: {
+      crate,
+      repository_owner: publisher.organization,
+      repository_name: publisher.repository,
+      workflow_filename: publisher.workflow,
+      environment: publisher.environment || null,
+    },
+  };
+}
+
+/**
+ * A script that calls the crates.io API from inside the page with its
+ * session cookie and returns `{ status, body }` to the tool, never to the DOM.
+ */
+export function pageFetchScript(method, apiPath, body) {
+  const init = {
+    method,
+    credentials: "same-origin",
+    headers: { accept: "application/json" },
+  };
+  if (body !== undefined) {
+    init.headers["content-type"] = "application/json";
+    init.body = JSON.stringify(body);
+  }
+  return `(async () => {
+  const response = await fetch(${JSON.stringify(apiPath)}, ${JSON.stringify(init)});
+  const body = await response.json().catch(() => null);
+  return { status: response.status, body };
+})()`;
+}
+
+/** Clicks crates.io's "Log in with GitHub" button; returns whether it found one. */
+export const LOGIN_CLICK_SCRIPT = `(() => {
+  const button = [...document.querySelectorAll("button, a")].find((element) =>
+    /log\\s*in with github/i.test(element.textContent || ""),
+  );
+  if (button) {
+    button.click();
+  }
+  return Boolean(button);
+})()`;
+
+/** The first error detail of a crates.io answer. */
+export function errorDetail(body) {
+  return String(body?.errors?.[0]?.detail ?? "no error detail");
+}
+
+/** Reads the crates.io session of the page from `GET /api/v1/me`. */
+export async function readSession(page) {
+  const { status, body } = await page.evaluate(
+    pageFetchScript("GET", "/api/v1/me"),
+  );
+  return {
+    signedIn: status === 200,
+    login: body?.user?.login,
+    emailVerified: body?.user?.email_verified === true,
+    emailSent: body?.user?.email_verification_sent === true,
+  };
+}
+
+/**
+ * Signs the automated browser in to crates.io: an existing session is kept,
+ * otherwise "Log in with GitHub" is clicked and `/me` polled until it answers
+ * 200. crates.io lets only accounts with a verified email publish, so an
+ * unverified one stops here with the settings link.
+ */
+export async function signIn(page, options = {}) {
+  await page.goto(CRATES_IO_URL);
+  let session = await readSession(page);
+  const signedInBefore = session.signedIn;
+  if (!session.signedIn) {
+    console.log(
+      "  Not signed in to crates.io; finish the GitHub sign-in in the automated browser.",
+    );
+    if (!(await page.evaluate(LOGIN_CLICK_SCRIPT))) {
+      console.log('  Click "Log in with GitHub" on crates.io.');
+    }
+    const deadline = Date.now() + (options.timeoutMs ?? SIGN_IN_TIMEOUT_MS);
+    const interval = options.pollIntervalMs ?? 2_000;
+    while (!session.signedIn) {
+      if (Date.now() > deadline) {
+        throw new Error("timed out waiting for the crates.io sign-in");
+      }
+      await new Promise((resolve) => setTimeout(resolve, interval));
+      session = await readSession(page);
+    }
+  }
+  console.log(
+    `  Signed in to crates.io as ${session.login ?? "your account"}.`,
+  );
+  if (!session.emailVerified) {
+    const sent = session.emailSent
+      ? " A verification email was sent; follow its link,"
+      : " Add and verify an email address";
+    throw new Error(
+      `crates.io only lets accounts with a verified email address publish or attach trusted publishers.${sent} at ${CRATES_PROFILE_URL}, then re-run setup`,
+    );
+  }
+  return { ...session, signedInBefore };
+}
+
+/** The question asked once before the token is created. */
+export function firstPublishQuestion(crate, version, publisher) {
+  const release = version ? `${crate} v${version}` : crate;
+  const attach = publisher
+    ? `, attach ${publisher.workflow} as trusted publisher`
+    : "";
+  return `Create a 1-hour token limited to crate ${crate} with publish-new + trusted-publishing, publish ${release}${attach}, revoke the token? [y/N] `;
+}
+
+/**
+ * Reads `version` from the `[package]` table of a Cargo.toml, or `undefined`
+ * when it is inherited from the workspace.
+ */
+export async function crateVersion(directory) {
+  const text = await readFile(path.join(directory, "Cargo.toml"), "utf8").catch(
+    () => "",
+  );
+  let table = "";
+  for (const line of text.split(/\r?\n/)) {
+    const header = /^\s*\[([^\]]+)\]/.exec(line);
+    if (header) {
+      table = header[1].trim();
+      continue;
+    }
+    const value = /^\s*version\s*=\s*["']([^"']+)["']/.exec(line);
+    if (table === "package" && value) {
+      return value[1];
+    }
+  }
+  return undefined;
+}
+
+/** Calls the crates.io API with the token from the tool, never from the page. */
+async function tokenCall(base, token, method, apiPath, body, options) {
+  const fetcher = options.fetch ?? globalThis.fetch;
+  const url = `${base}${apiPath}`;
+  const headers = {
+    accept: "application/json",
+    authorization: token,
+    "user-agent": USER_AGENT,
+  };
+  if (body !== undefined) {
+    headers["content-type"] = "application/json";
+  }
+  try {
+    const response = await fetcher(url, {
+      method,
+      headers,
+      body: body === undefined ? undefined : JSON.stringify(body),
+      signal: AbortSignal.timeout(options.timeoutMs ?? 30_000),
+    });
+    if (options.verbose) {
+      console.error(`${method} ${url} -> ${response.status}`);
+    }
+    const parsed = await response.json().catch(() => null);
+    return { status: response.status, body: parsed };
+  } catch (error) {
+    if (options.verbose) {
+      console.error(`${method} ${url} failed: ${error.message}`);
+    }
+    return { status: 0, body: { errors: [{ detail: error.message }] } };
+  }
+}
+
+/**
+ * Attaches the trusted publisher with the page's session cookie, for a crate
+ * that already exists or when the token could not. Returns whether it worked.
+ */
+export async function attachWithSession(page, crate, publisher) {
+  const { status, body } = await page.evaluate(
+    pageFetchScript(
+      "POST",
+      "/api/v1/trusted_publishing/github_configs",
+      githubConfigRequest(crate, publisher),
+    ),
+  );
+  return reportAttach(status, body);
+}
+
+function reportAttach(status, body) {
+  if (status >= 200 && status < 300) {
+    console.log("  crates.io stored the trusted publisher.");
+    return true;
+  }
+  console.error(
+    `warning: crates.io did not attach the trusted publisher (${status}: ${errorDetail(body)})`,
+  );
+  return false;
+}
+
+/**
+ * Publishes a crate for the first time through the crates.io API.
+ * `publish(env)` runs `cargo publish` with `env` added to its own environment
+ * only; `waitForRegistry()` polls until the crate is visible. The token is
+ * revoked in `finally`, and the run fails while crates.io still accepts it.
+ * Returns `{ attached }`, whether the trusted publisher was attached.
+ */
+export async function firstPublish({
+  page,
+  crate,
+  publisher,
+  publish,
+  waitForRegistry,
+  now = new Date(),
+  env = process.env,
+  ...options
+}) {
+  const created = await page.evaluate(
+    pageFetchScript("PUT", "/api/v1/me/tokens", tokenRequest(crate, now)),
+  );
+  // The token lives only in `secret` and is dropped once revoked.
+  const secret = { token: created.body?.api_token?.token };
+  if (created.status !== 200 || !secret.token) {
+    throw new Error(
+      `crates.io did not create the first-publish token (${created.status}: ${errorDetail(created.body)}); nothing was published`,
+    );
+  }
+  const tokenId = created.body.api_token.id;
+  console.log(
+    "  Created a 1-hour first-publish token; it stays in this process only.",
+  );
+  const base = registryEndpoint("crates-io", env);
+  let attached = false;
+  let failure;
+  try {
+    const result = await publish({ CARGO_REGISTRY_TOKEN: secret.token });
+    if (result.code !== 0) {
+      throw new Error(`cargo exited with status ${result.code}`);
+    }
+    await waitForRegistry();
+    if (publisher) {
+      const answer = await tokenCall(
+        base,
+        secret.token,
+        "POST",
+        "/trusted_publishing/github_configs",
+        githubConfigRequest(crate, publisher),
+        options,
+      );
+      attached = reportAttach(answer.status, answer.body);
+    }
+  } catch (error) {
+    failure = error;
+  }
+  try {
+    await revoke(page, base, secret.token, tokenId, options);
+  } catch (error) {
+    throw failure
+      ? new Error(`${error.message}; the run failed before: ${failure.message}`)
+      : error;
+  } finally {
+    delete secret.token;
+  }
+  if (failure) {
+    throw failure;
+  }
+  return { attached };
+}
+
+/**
+ * Revokes the token with `DELETE /api/v1/tokens/current`, falls back to the
+ * page session, and verifies that crates.io rejects it.
+ */
+async function revoke(page, base, token, tokenId, options) {
+  const answer = await tokenCall(
+    base,
+    token,
+    "DELETE",
+    "/tokens/current",
+    undefined,
+    options,
+  );
+  let state = await checkCratesToken(base, token, options);
+  if (state !== "revoked" && tokenId !== undefined) {
+    if (options.verbose) {
+      console.error(
+        `token revocation answered ${answer.status}; revoking through the browser session`,
+      );
+    }
+    await page
+      .evaluate(pageFetchScript("DELETE", `/api/v1/me/tokens/${tokenId}`))
+      .catch(() => undefined);
+    state = await checkCratesToken(base, token, options);
+  }
+  if (state === "revoked") {
+    console.log("  Revoked the first-publish token; crates.io rejects it now.");
+    return;
+  }
+  if (state === undefined) {
+    console.error(
+      `warning: crates.io gave no clear answer about the first-publish token; check that it is revoked at ${CRATES_TOKENS_URL}`,
+    );
+    return;
+  }
+  throw new Error(
+    `the first-publish token still authenticates on crates.io; revoke it at ${CRATES_TOKENS_URL}`,
+  );
+}
+
+/**
+ * Runs a crates.io API step of a setup session: `crates-sign-in`,
+ * `first-publish`, `attach-trusted-publisher`, or the cleanup step
+ * `crates-sign-out`.
+ */
+export async function runCratesApiStep(session, step) {
+  const { options, plan, conditions } = session;
+  if (options.noBrowser) {
+    throw new Error(
+      "the crates.io API steps drive the automated browser; drop --no-browser, or pass --manual for the manual checklist",
+    );
+  }
+  const crate = plan.package.name;
+  const domains = signInDomains(plan.registry);
+  let page = await session.automatedPage();
+  switch (step.id) {
+    case "crates-sign-in": {
+      await page.goto(CRATES_IO_URL);
+      if (!(await readSession(page)).signedIn) {
+        // Whether imported or signed in by hand, the sign-in is this run's.
+        conditions.add("crates-signed-in");
+        if (await offerSignInImport(session, domains)) {
+          page = await session.automatedPage();
+        }
+      }
+      await signIn(page, options);
+      return;
+    }
+    case "first-publish": {
+      const version = await crateVersion(session.cwd(step));
+      const publisher = plan.trusted_publisher;
+      if (step.confirm && !options.yes) {
+        const answer = await session.prompt(
+          firstPublishQuestion(crate, version, publisher),
+        );
+        if (!/^(?:y|yes)$/i.test(answer)) {
+          throw new Error(
+            "the first publish was declined; no token was created and nothing was published",
+          );
+        }
+      }
+      const { attached } = await firstPublish({
+        page,
+        crate,
+        publisher,
+        publish: (env) => session.runProcess(step, true, env),
+        waitForRegistry: () =>
+          session.wait({ id: "wait-for-registry", url: step.url }),
+        env: options.env ?? process.env,
+        fetch: options.fetch,
+        verbose: options.verbose,
+      });
+      if (attached) {
+        conditions.delete("trust-missing");
+      }
+      return;
+    }
+    case "attach-trusted-publisher":
+      if (!plan.trusted_publisher) {
+        console.log(
+          "  No GitHub repository or release workflow is known, so the trusted publisher is configured in the form.",
+        );
+      } else if (await attachWithSession(page, crate, plan.trusted_publisher)) {
+        conditions.delete("trust-missing");
+        return;
+      }
+      conditions.add("trust-api-failed");
+      return;
+    case "crates-sign-out":
+      if (options.keepSession) {
+        console.log(
+          `Keeping the ${domains.join(" / ")} sign-in in the automated profile (--keep-session); the next run reuses it. No token is kept.`,
+        );
+      } else if (page.clearCookies) {
+        await page.clearCookies(domains);
+        console.log(
+          `  Removed the ${domains.join(" / ")} sign-in cookies from the automated profile.`,
+        );
+      }
+      return;
+    default:
+      throw new Error(`no crates.io API step ${step.id}`);
+  }
+}

package/src/flows.mjs

@@ -4,6 +4,7 @@ import {
   registryEndpoint,
   registryStateUrl,
 } from "./registry-state.mjs";
+import { CRATES_IO_URL } from "./crates-api.mjs";
 import { CRATES_TOKENS_URL, tokenSecretSteps } from "./tokens.mjs";
 
 /** Step conditions that only hold while a package is not yet published. */
@@ -15,6 +16,7 @@ export const BOOTSTRAP_CONDITIONS = new Set([
 /** Step conditions evaluated in the cleanup phase, after every other step. */
 export const CLEANUP_CONDITIONS = new Set([
   "tool-signed-in",
+  "crates-signed-in",
   "worktree-created",
 ]);
 
@@ -226,13 +228,15 @@ export function npmFlow(packageInfo, context) {
   const name = packageInfo.name;
   const registry = registryEndpoint("npm");
   const trustNpm = context.trustNpm ?? DEFAULT_TRUST_NPM;
+  // npm trust list needs a 2FA approval; with --json npm holds the approval
+  // URL back until it exits, so the human output is read instead (#24).
   const trustList = command("npx", [
     "-y",
     trustNpm,
     "trust",
     "list",
     name,
-    "--json",
+    "--browser=false",
   ]);
   const steps = [
     step(
@@ -449,7 +453,85 @@ export function npmFlow(packageInfo, context) {
   return steps;
 }
 
+/**
+ * The crates.io flow. By default the crates.io API publishes the first
+ * version with a short-lived token the tool creates, uses, and revokes
+ * itself (#26); `context.manual` keeps the manual token checklist.
+ */
 export function cratesFlow(packageInfo, context) {
+  return context.manual
+    ? manualCratesFlow(packageInfo, context)
+    : apiCratesFlow(packageInfo, context);
+}
+
+function apiCratesFlow(packageInfo, context) {
+  const name = packageInfo.name;
+  const api = registryStateUrl(packageInfo);
+  const steps = [
+    step(
+      "validate-package",
+      "Validate the crate",
+      "check",
+      "Package the crate without uploading it.",
+      { command: command("cargo", ["publish", "--dry-run"]) },
+    ),
+    checkRegistryStep("crates.io", api),
+    ...worktreeSteps(),
+    step(
+      "crates-sign-in",
+      "Sign in to crates.io in the automated browser",
+      "api",
+      'Reuse the automated profile\'s crates.io session, or click "Log in with GitHub" and wait until GET /api/v1/me answers. crates.io needs a verified email address.',
+      { url: CRATES_IO_URL, when: "trust-missing" },
+    ),
+    step(
+      "first-publish",
+      "Publish the first version",
+      "api",
+      `After one confirmation, create a 1-hour token limited to the crate ${name} with the publish-new and trusted-publishing scopes from inside the crates.io page, run cargo publish from the clean checkout with the token only in its environment, wait for the registry, attach the trusted publisher with the token, then revoke it and verify crates.io rejects it. The token is never printed or stored.`,
+      {
+        command: command("cargo", ["publish"]),
+        url: api,
+        when: "package-missing",
+        cwd: packageCwd(context.directory),
+        confirm: true,
+      },
+    ),
+    step(
+      "attach-trusted-publisher",
+      "Attach the crates.io trusted publisher",
+      "api",
+      "POST the repository's GitHub Actions workflow to /api/v1/trusted_publishing/github_configs with the browser session.",
+      { when: "trust-missing" },
+    ),
+    step(
+      "configure-trusted-publisher",
+      "Configure crates.io trusted publishing",
+      "browser",
+      "The API could not attach the trusted publisher; add the repository's GitHub Actions workflow in the form, then review and submit.",
+      {
+        url: `https://crates.io/crates/${encodeURIComponent(name)}/settings/new-trusted-publisher`,
+        when: "trust-api-failed",
+      },
+    ),
+  ];
+  if (context.slug) {
+    steps.push(...tokenSecretSteps(packageInfo, context.slug));
+  }
+  steps.push(
+    step(
+      "crates-sign-out",
+      "Sign the automated browser out of crates.io",
+      "api",
+      "Remove the sign-in this run brought into the automated profile; --keep-session keeps it. No token outlives the run either way.",
+      { when: "crates-signed-in" },
+    ),
+    removeWorktreeStep(),
+  );
+  return steps;
+}
+
+function manualCratesFlow(packageInfo, context) {
   const name = packageInfo.name;
   const api = registryStateUrl(packageInfo);
   const steps = [

package/src/plan.mjs

@@ -173,6 +173,7 @@ function flowPlan(inspection, packageInfo, options) {
     environment,
     verifyRelease: Boolean(options.verifyRelease),
     trustNpm: options.environment?.trustNpm,
+    manual: Boolean(options.manual),
   };
   const mode = planMode(packageInfo);
   let steps = FLOWS.get(packageInfo.registry)(packageInfo, context);

package/src/setup.mjs

@@ -19,6 +19,7 @@ import {
   withFreshLinks,
 } from "./approvals.mjs";
 import { connectAutomation } from "./automation.mjs";
+import { runCratesApiStep } from "./crates-api.mjs";
 import {
   detachedRunner,
   npmPrefillScript,
@@ -31,6 +32,7 @@ import { packageDirectory } from "./plan.mjs";
 import { twoFactorMode } from "./prerequisites.mjs";
 import { protectLegacyProfile } from "./profile.mjs";
 import { getJson, probePackage } from "./registry-state.mjs";
+import { launchBrowser, signInDomains } from "./sign-in-import.mjs";
 import { reportTokenSecrets, verifyTokenRevoked } from "./tokens.mjs";
 
 export { defaultBrowserProfile } from "./profile.mjs";
@@ -43,6 +45,10 @@ const INTERACTIVE_CHECKS = new Set(["check-trust", "verify-trusted-publisher"]);
 const PAGES_CHANGES = new Set(["enable-pages", "use-pages-workflow"]);
 /** Checks whose failure is an answer, so their output is not echoed. */
 const QUIET_CHECKS = new Set(["check-sign-in", "check-pages"]);
+/** A trusted publisher in `npm trust list` output, human-readable or JSON. */
+const LISTED_PUBLISHER = /^\s*(?:id|type|file):\s*\S|"(?:id|type|file)"\s*:/m;
+/** What `npm trust github` prints once the registry stored the publisher. */
+const TRUST_CREATED = /Trust configuration created successfully/i;
 /** npm's answer when a workflow publishes without an attached trusted publisher. */
 const PUBLISH_REJECTED = /\bE404\b|404 Not Found|invalid-publisher/i;
 /** Where `--browser` opens URLs that need no automation. */
@@ -107,8 +113,7 @@ class SetupSession {
       this.conditions.add("trust-missing");
     }
     this.values = {};
-    this.deferred = [];
-    this.automation = null;
+    this.automation = options.automation ?? null;
     this.temporary = null;
     this.shim = null;
   }
@@ -116,7 +121,7 @@ class SetupSession {
   async run() {
     for (const step of this.plan.steps) {
       if (CLEANUP_CONDITIONS.has(step.when)) {
-        this.deferred.push(step);
+        // cleanup() runs these, even after a failed step.
       } else if (!step.when || this.conditions.has(step.when)) {
         this.log(`==> ${step.title}`);
         await this.runStep(step);
@@ -126,12 +131,21 @@ class SetupSession {
     }
   }
 
+  /**
+   * Runs every cleanup step of the plan whose condition holds, including
+   * those after a step that failed (#24).
+   */
   async cleanup() {
-    for (const step of this.deferred) {
+    for (const step of cleanupSteps(this.plan)) {
       if (step.id === "sign-out" && this.keepsSession(step)) {
         console.log(
           "Keeping the npm session (--keep-session): its token stays in npm's user configuration until you run npm logout, and the next run reuses it while npm whoami succeeds.",
         );
+      } else if (this.conditions.has(step.when) && step.kind === "api") {
+        this.log(`==> ${step.title}`);
+        await runCratesApiStep(this, step).catch((error) =>
+          console.error(`warning: ${step.id} failed: ${error.message}`),
+        );
       } else if (this.conditions.has(step.when)) {
         this.log(`==> ${step.title}`);
         const result = await this.runProcess(step, true);
@@ -179,6 +193,8 @@ class SetupSession {
         return this.wait(step);
       case "browser":
         return this.browser(step);
+      case "api":
+        return runCratesApiStep(this, step);
       default:
         console.log(step.description);
         if (step.url) {
@@ -226,8 +242,7 @@ class SetupSession {
         return;
       case "check-trust":
       case "verify-trusted-publisher": {
-        const trusted =
-          result.code === 0 && /"(?:id|type|file)"\s*:/.test(output);
+        const trusted = result.code === 0 && listsTrustedPublisher(output);
         toggle(this.conditions, "trust-missing", !trusted);
         if (step.id === "verify-trusted-publisher" && !trusted) {
           throw new Error(
@@ -483,7 +498,9 @@ class SetupSession {
         `${step.command.program} exited with status ${result.code}`,
       );
     }
-    if (step.id === "sign-in") {
+    if (step.id === "attach-trusted-publisher") {
+      this.confirmTrustCreated(result.stdout);
+    } else if (step.id === "sign-in") {
       this.conditions.add("tool-signed-in");
     } else if (step.id === "prepare-worktree") {
       this.conditions.add("worktree-created");
@@ -497,6 +514,17 @@ class SetupSession {
     }
   }
 
+  /**
+   * npm prints the stored configuration once `npm trust github` succeeds, so
+   * that answer verifies it without a second 2FA-gated `npm trust list`.
+   */
+  confirmTrustCreated(output) {
+    if (TRUST_CREATED.test(stripAnsi(output))) {
+      console.log("  npm stored the trusted publisher.");
+      this.conditions.delete("trust-missing");
+    }
+  }
+
   recordPack(output) {
     const packed = packedEntry(output);
     for (const file of packed.files ?? []) {
@@ -606,12 +634,34 @@ class SetupSession {
       }
       return;
     }
-    this.automation ??= await connectAutomation({
-      browser: this.options.browserOptions,
-      profile: this.options.browserProfile,
-      verbose: this.options.verbose,
-    });
-    await this.automation.goto(url);
+    await (await this.automatedPage()).goto(url);
+  }
+
+  /**
+   * The automated page, launched once. The crates.io sign-in step offers
+   * `--browser-import default|auto` itself, once it knows a sign-in is missing.
+   */
+  async automatedPage(browser = this.options.browserOptions) {
+    if (!this.automation) {
+      const domains = signInDomains(this.plan.registry);
+      this.automation = await connectAutomation({
+        browser: await launchBrowser(browser, domains, {
+          deferred: this.plan.registry === "crates-io",
+          verbose: this.options.verbose,
+        }),
+        profile: this.options.browserProfile,
+        verbose: this.options.verbose,
+        domains,
+      });
+    }
+    return this.automation;
+  }
+
+  /** Relaunches the automated browser with other options, such as an import. */
+  async reconnect(browser) {
+    await this.automation?.close();
+    this.automation = null;
+    return this.automatedPage(browser);
   }
 
   /**
@@ -668,9 +718,10 @@ class SetupSession {
     return result;
   }
 
-  async runProcess(step, mirror) {
+  /** Runs a step's command; `extra` is added to that child's environment only. */
+  async runProcess(step, mirror, extra = undefined) {
     const { command, cwd } = this.prepare(step);
-    let env = process.env;
+    let env = extra ? { ...process.env, ...extra } : process.env;
     const npm = ["npm", "npx"].includes(command.program);
     if (npm) {
       await this.detectDefaultBrowser();
@@ -730,6 +781,20 @@ class SetupSession {
   }
 }
 
+/** The plan's cleanup steps, which run after every other step, even a failed one. */
+export function cleanupSteps(plan) {
+  return plan.steps.filter((step) => CLEANUP_CONDITIONS.has(step.when));
+}
+
+/** Whether `npm trust list` output names a trusted publisher. */
+export function listsTrustedPublisher(output) {
+  return LISTED_PUBLISHER.test(stripAnsi(output));
+}
+
+function stripAnsi(text) {
+  return String(text ?? "").replaceAll(ANSI, "");
+}
+
 /**
  * npm's warnings from `npm pack`, such as fields it auto-corrected or removed
  * from the packed package.json, without npm's advice to run its fixer, which

package/src/sign-in-import.mjs

@@ -0,0 +1,266 @@
+// Reusing a registry sign-in from an installed browser (#26): the automated
+// profile stays fresh and clean by default; when a step needs a sign-in it
+// does not hold, the tool offers to import only the cookies of the registry's
+// sign-in domains from a browser that has them. Cookie values are never
+// printed, logged, or cached: they are only counted.
+import * as commander from "browser-commander";
+
+import { detectDefaultBrowser } from "./default-browser.mjs";
+
+/** Browser Commander's cookie sources, should a release stop exporting them. */
+const FALLBACK_SOURCES = ["chrome", "edge", "brave", "chromium", "firefox"];
+/** `--browser-import` values that pick the source browser for the user. */
+export const IMPORT_CHOICES = ["default", "auto"];
+/** `--browser-import-scope` values. */
+export const IMPORT_SCOPES = ["domains", "full"];
+
+/** The domains whose cookies hold each registry's sign-in. */
+export const SIGN_IN_DOMAINS = {
+  "crates-io": ["crates.io", "github.com"],
+  npm: ["npmjs.com"],
+  pypi: ["pypi.org", "github.com"],
+};
+
+/** Display names of the source browsers, as the default-browser query names them. */
+const SOURCE_NAMES = {
+  chrome: "Google Chrome",
+  edge: "Microsoft Edge",
+  brave: "Brave",
+  chromium: "Chromium",
+  firefox: "Firefox",
+};
+
+/**
+ * Every browser `--browser-import` can read, from Browser Commander. Safari,
+ * Opera, Vivaldi, and Arc follow once Browser Commander reads them
+ * (link-foundation/browser-commander#114).
+ */
+export function importSources() {
+  return [...(commander.SUPPORTED_COOKIE_BROWSERS ?? FALLBACK_SOURCES)];
+}
+
+/** The sign-in domains of a registry, or none. */
+export function signInDomains(registry) {
+  return SIGN_IN_DOMAINS[registry] ?? [];
+}
+
+/** The display name of a source browser. */
+export function sourceName(browser) {
+  return SOURCE_NAMES[browser] ?? browser;
+}
+
+/** The source id of a default-browser display name, when it can be imported. */
+export function sourceId(displayName) {
+  const entry = Object.entries(SOURCE_NAMES).find(
+    ([, name]) => name === displayName,
+  );
+  return entry && importSources().includes(entry[0]) ? entry[0] : undefined;
+}
+
+/**
+ * The migration Browser Commander runs: the whole profile for `full`, or
+ * only the cookies of `domains`.
+ */
+export function migrationFor(source, scope, domains) {
+  const migration = { browser: source.browser };
+  if (source.profile) {
+    migration.profile = source.profile;
+  }
+  if (scope === "domains" && domains.length > 0) {
+    migration.include = ["cookies"];
+    migration.domains = domains;
+  }
+  return migration;
+}
+
+/**
+ * Lists the installed browser profiles that hold cookies for any of
+ * `domains`, the default browser first. Each entry is
+ * `{ browser, profile, label, domains }`; cookie values are discarded.
+ */
+export async function findSignInSources(domains, options = {}) {
+  const list = options.listProfiles ?? commander.listBrowserProfiles;
+  const read = options.readCookies ?? commander.readBrowserCookies;
+  const preferred = options.defaultSource;
+  const browsers = (options.sources ?? importSources()).toSorted(
+    (left, right) => Number(right === preferred) - Number(left === preferred),
+  );
+  const found = [];
+  for (const browser of browsers) {
+    const profiles = await list({ browser }).catch(() => []);
+    for (const profile of profiles) {
+      const matched = [];
+      for (const domain of domains) {
+        const cookies = await read({
+          browser,
+          profile: profile.path,
+          domainFilter: domain,
+          ignoreDecryptionErrors: true,
+          cache: false,
+        }).catch((error) => {
+          if (options.verbose) {
+            console.error(
+              `could not read ${browser} cookies for ${domain}: ${error.message}`,
+            );
+          }
+          return [];
+        });
+        if (cookies.length > 0) {
+          matched.push(domain);
+        }
+      }
+      if (matched.length > 0) {
+        const name = profile.displayName ?? profile.name;
+        found.push({
+          browser,
+          profile: profile.path,
+          label:
+            profiles.length > 1
+              ? `${sourceName(browser)} (${name})`
+              : sourceName(browser),
+          domains: matched,
+        });
+      }
+    }
+  }
+  return found;
+}
+
+/** The source id of the system default browser, when it can be imported. */
+export async function defaultSource(options = {}) {
+  const name =
+    options.defaultBrowserName ??
+    (await detectDefaultBrowser({ verbose: options.verbose }));
+  return name ? sourceId(name) : undefined;
+}
+
+/**
+ * Asks once which installed browser's sign-in to import, the default browser
+ * first; `auto` takes it without asking. Returns the chosen source or
+ * `undefined`.
+ */
+export async function chooseSignInSource(sources, domains, ask, auto) {
+  if (sources.length === 0) {
+    return undefined;
+  }
+  const [first] = sources;
+  const question = `Import your ${domains.join(" / ")} sign-in from ${first.label} into the automated profile?`;
+  if (auto) {
+    console.log(`  ${question} yes (--browser-import auto)`);
+    return first;
+  }
+  if (sources.length > 1) {
+    sources.forEach((source, index) =>
+      console.log(
+        `  ${index + 1}. ${source.label} (${source.domains.join(", ")})`,
+      ),
+    );
+  }
+  const choices = sources.length > 1 ? `[Y/n/1-${sources.length}]` : "[Y/n]";
+  const answer = String(await ask(`${question} ${choices} `)).trim();
+  if (/^(?:n|no)$/i.test(answer)) {
+    return undefined;
+  }
+  const index = Number(answer);
+  return Number.isInteger(index) && index >= 1 && index <= sources.length
+    ? sources[index - 1]
+    : first;
+}
+
+/**
+ * Resolves `--browser-import default|auto` to an installed source browser:
+ * the system default browser, or for `auto` the first browser with a
+ * sign-in for `domains`. Throws when `default` names a browser Browser
+ * Commander cannot read yet, such as Safari.
+ */
+export async function resolveImportChoice(choice, domains, options = {}) {
+  const preferred = await defaultSource(options);
+  if (choice === "default") {
+    if (!preferred) {
+      throw new Error(
+        "--browser-import default: the default browser cannot be imported yet (Browser Commander reads " +
+          `${importSources().join(", ")}; see link-foundation/browser-commander#114)`,
+      );
+    }
+    return { browser: preferred, profile: null };
+  }
+  const [found] = await findSignInSources(domains, {
+    ...options,
+    defaultSource: preferred,
+  });
+  return found ? { browser: found.browser, profile: found.profile } : null;
+}
+
+/**
+ * The browser options a launch uses: `--browser-import default|auto` is
+ * resolved to an installed browser, except where a step offers the import
+ * once it knows the sign-in is missing (`deferred`).
+ */
+export async function launchBrowser(browser, domains, options = {}) {
+  const choice = browser?.import?.browser;
+  if (!IMPORT_CHOICES.includes(choice)) {
+    return browser;
+  }
+  const source = options.deferred
+    ? null
+    : await resolveImportChoice(choice, domains, options);
+  if (!source && !options.deferred) {
+    console.error(
+      `warning: no installed browser holds a sign-in for ${domains.join(", ") || "this registry"}; the automated profile starts without one`,
+    );
+  }
+  return { ...browser, import: source };
+}
+
+/**
+ * Offers, once, to import the sign-in for `domains` from an installed browser
+ * into the automated profile, then relaunches it with the import. Only a
+ * dedicated profile is offered the import, and only without a named
+ * `--browser-import`, which already migrated at launch. Returns whether the
+ * sign-in was imported.
+ */
+export async function offerSignInImport(session, domains) {
+  const browser = session.options.browserOptions;
+  const choice = browser?.import?.browser;
+  if (
+    !browser ||
+    browser.attach ||
+    (choice && !IMPORT_CHOICES.includes(choice))
+  ) {
+    return false;
+  }
+  const options = {
+    verbose: session.options.verbose,
+    ...session.options.importDiscovery,
+  };
+  const preferred = await defaultSource(options);
+  const sources =
+    choice === "default"
+      ? [preferred].filter(Boolean).map((id) => ({
+          browser: id,
+          profile: null,
+          label: sourceName(id),
+          domains,
+        }))
+      : await findSignInSources(domains, {
+          ...options,
+          defaultSource: preferred,
+        });
+  const source = await chooseSignInSource(
+    sources,
+    domains,
+    (message) => session.prompt(message),
+    Boolean(choice),
+  );
+  if (!source) {
+    return false;
+  }
+  await session.reconnect({
+    ...browser,
+    import: { browser: source.browser, profile: source.profile },
+  });
+  console.log(
+    `  Imported the ${domains.join(" / ")} sign-in from ${source.label}.`,
+  );
+  return true;
+}