package-registry-manager 0.22.3 → 0.22.5

package/README.md

@@ -10,12 +10,15 @@ browser, filling forms in a dedicated visible browser profile.
 npx package-registry-manager inspect --repository /path/to/repository
 npx package-registry-manager plan --repository /path/to/repository --format json
 npx package-registry-manager setup --repository /path/to/repository --registry npm
+npx package-registry-manager setup --repository /path/to/repository --all --execute
 ```
 
 The package installs the command as both `package-registry-manager` and
 `package-registry-manager-js`; use the second name when the Rust command of the
 same name is also on your `PATH`.
 
-Setup is a dry run unless `--execute` is present, and it never publishes an
-artifact. See the repository README for all registry walkthroughs and safety
-details.
+Setup is a dry run unless `--execute` is present. It can publish the first
+version after confirmation; later versions publish through CI. Missing CI
+publishing jobs are offered in a draft pull request, and PyPI builds select an
+interpreter satisfying `requires-python`. See the repository README for the
+registry walkthroughs and safety details.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.22.3",
+  "version": "0.22.5",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
     "provenance": true
   },
   "scripts": {
-    "syntax": "node --check src/cli.mjs && node --check src/direct-execution.mjs && node --check src/index.mjs && node --check src/browser.mjs && node --check src/browser-options.mjs && node --check src/browser-catalogue.mjs && node --check src/automation.mjs && node --check src/profile.mjs && node --check src/setup.mjs && node --check src/auth-urls.mjs && node --check src/containers.mjs && node --check src/flows.mjs && node --check src/prerequisites.mjs && node --check src/registry-state.mjs && node --check src/workflows.mjs && node --check src/publishers.mjs && node --check src/skips.mjs && node --check src/tokens.mjs && node --check src/approvals.mjs && node --check src/default-browser.mjs && node --check src/pages.mjs && node --check src/crates-api.mjs && node --check src/sign-in-import.mjs && node --check scripts/publish-to-npm.mjs && node --check scripts/setup-npm.mjs && node --check scripts/sanitize-npm-userconfig.mjs",
+    "syntax": "node --check src/cli.mjs && node --check src/direct-execution.mjs && node --check src/index.mjs && node --check src/browser.mjs && node --check src/browser-options.mjs && node --check src/browser-catalogue.mjs && node --check src/automation.mjs && node --check src/webdriver-automation.mjs && node --check src/profile.mjs && node --check src/setup.mjs && node --check src/auth-urls.mjs && node --check src/containers.mjs && node --check src/flows.mjs && node --check src/prerequisites.mjs && node --check src/registry-state.mjs && node --check src/workflows.mjs && node --check src/publishers.mjs && node --check src/skips.mjs && node --check src/tokens.mjs && node --check src/approvals.mjs && node --check src/default-browser.mjs && node --check src/pages.mjs && node --check src/crates-api.mjs && node --check src/sign-in-import.mjs && node --check scripts/publish-to-npm.mjs && node --check scripts/setup-npm.mjs && node --check scripts/sanitize-npm-userconfig.mjs && node --check src/python.mjs && node --check src/setup-batch.mjs && node --check src/workflow-proposal.mjs",
     "lint": "eslint src test scripts --max-warnings 0",
     "lint:fix": "eslint src test scripts --fix --max-warnings 0",
     "format": "prettier --write .",
@@ -36,12 +36,14 @@
     "check:duplication": "jscpd src",
     "check": "npm run syntax && npm run lint && npm run format:check && npm run check:duplication",
     "test": "node --test --test-timeout=30000",
-    "pack:check": "npm pack --dry-run"
+    "pack:check": "npm pack --dry-run",
+    "audit": "node scripts/npm-audit.mjs"
   },
   "dependencies": {
-    "browser-commander": "^0.25.0",
-    "command-stream": "^1.5.0",
-    "playwright": "^1.63.0"
+    "browser-commander": "^0.26.0",
+    "command-stream": "^1.6.2",
+    "playwright": "^1.63.0",
+    "selenium-webdriver": "^4.50.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/src/automation.mjs

@@ -5,8 +5,11 @@ import {
   attachViaExtension,
   EXTENSION_DIRECTORY,
   launchRealBrowser,
+  findBrowserSource,
 } from "browser-commander";
 
+import { connectWebDriverAutomation } from "./webdriver-automation.mjs";
+
 import { snapshotBrowser } from "./browser-options.mjs";
 import { defaultBrowserProfile, ensureProfileIgnored } from "./profile.mjs";
 import { IMPORT_CHOICES, migrationFor } from "./sign-in-import.mjs";
@@ -28,7 +31,10 @@ export function relayExtensionDirectory() {
  */
 export function launchOptions(browser, profile, verbose = false, domains = []) {
   const options = {
-    engine: "playwright",
+    engine:
+      findBrowserSource(browser.channel)?.controlProtocol === "cdp"
+        ? "playwright"
+        : "selenium",
     channel: browser.channel,
     headless: false,
     verbose,
@@ -75,25 +81,29 @@ export function extensionInstructions(directory) {
  * Connects the browser that fills forms and returns a page with `goto`,
  * `evaluate`, `close`, and, for a launched profile, `clearCookies(domains)`.
  */
-export async function connectAutomation({
-  browser,
-  profile,
-  verbose = false,
-  domains = [],
-}) {
+export async function connectAutomation(
+  { browser, profile, verbose = false, domains = [] },
+  dependencies = {},
+) {
   if (browser.attach?.mode === "extension") {
     return connectExtension();
   }
+  if (findBrowserSource(browser.channel)?.controlProtocol === "bidi") {
+    return connectWebDriverAutomation(
+      { browser, profile, verbose, domains },
+      dependencies,
+    );
+  }
   if (!browser.attach) {
     await ensureProfileIgnored(profile, { verbose });
   }
-  const connection = await launchRealBrowser(
-    launchOptions(browser, profile, verbose, domains),
-  );
+  const connection = await (
+    dependencies.launchRealBrowser ?? launchRealBrowser
+  )(launchOptions(browser, profile, verbose, domains));
   return {
     goto: (url) => connection.page.goto(url),
     evaluate: (script) => connection.page.evaluate(script),
-    close: () => connection.browser.close(),
+    close: () => connection.close(),
     async clearCookies(names) {
       for (const name of names) {
         const escaped = name.replaceAll(".", "\\.");

package/src/browser-catalogue.mjs

@@ -1,4 +1,5 @@
-import { existsSync } from "node:fs";
+import { constants, existsSync, realpathSync } from "node:fs";
+import { access } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 
@@ -7,10 +8,10 @@ import { BROWSER_IDS, findBrowserSource } from "browser-commander";
 /** Catalogue entries reached through Browser Commander's public exports. */
 export const browserSources = () => BROWSER_IDS.map(findBrowserSource);
 
-/** The installed channels supported by Browser Commander's real launcher. */
+/** Catalogue channels with a launch control protocol. */
 export function launchChannels() {
   return browserSources()
-    .filter((source) => source.controlProtocol === "cdp")
+    .filter((source) => ["cdp", "bidi"].includes(source.controlProtocol))
     .flatMap((source) => [source.id, ...(source.aliases ?? [])]);
 }
 
@@ -121,13 +122,88 @@ export function installedDescription(options = {}) {
 /** Reject unavailable engines before creating an automated profile. */
 export function validateChannel(channel) {
   const known = findBrowserSource(channel);
-  if (known?.controlProtocol === "cdp") {
+  if (["cdp", "bidi"].includes(known?.controlProtocol)) {
     return channel;
   }
   const reason = known
-    ? `${channel} requires ${known.controlProtocol ?? known.family} control, which browser-commander's real launcher does not support yet (https://github.com/link-foundation/browser-commander/issues/114)`
+    ? `${channel} has no launch control protocol supported by this manager${known.family === "safari" ? " (Safari setup: https://github.com/link-foundation/browser-commander/issues/126)" : ""}`
     : `unknown --browser-channel '${channel}'`;
   throw new Error(
     `${reason}; choose from ${launchChannels().join(", ")}. ${installedDescription()}`,
   );
 }
+
+/** Resolves the selected installed binary using catalogue paths and PATH. */
+export async function resolveExecutable(
+  { channel, executablePath },
+  discovery = {},
+) {
+  const platform = discovery.platform ?? process.platform;
+  const environment = discovery.environment ?? process.env;
+  const options = {
+    ...discovery,
+    platform,
+    environment:
+      platform === "win32"
+        ? Object.fromEntries(
+            Object.entries(environment).map(([key, value]) => [
+              key.toUpperCase(),
+              value,
+            ]),
+          )
+        : environment,
+  };
+  const source = findBrowserSource(channel);
+  const candidates = executablePath
+    ? [executablePath]
+    : installedCandidates({ ...source, roots: {} }, options);
+  for (const candidate of candidates) {
+    try {
+      await (discovery.access ?? access)(candidate, constants.X_OK);
+      return candidate;
+    } catch {
+      // Continue through the catalogue's executable paths and PATH names.
+    }
+  }
+  throw new Error(
+    `could not find an installed ${channel} browser; use --browser-executable`,
+  );
+}
+
+/** Refuses a source profile even when reached through a symlink. */
+export function assertDedicatedProfile(profile, discovery = {}) {
+  const physical = (file) => {
+    try {
+      return realpathSync(file);
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+      return path.join(physical(path.dirname(file)), path.basename(file));
+    }
+  };
+  const requested = physical(path.resolve(profile));
+  const roots = browserSources().flatMap((source) =>
+    installedCandidates(
+      {
+        ...source,
+        executables: {},
+        executableNames: [],
+      },
+      discovery,
+    ),
+  );
+  for (const root of roots) {
+    const relative = path.relative(physical(path.resolve(root)), requested);
+    if (
+      relative === "" ||
+      (!relative.startsWith(`..${path.sep}`) &&
+        relative !== ".." &&
+        !path.isAbsolute(relative))
+    ) {
+      throw new Error(
+        "automation requires a dedicated profile, not a browser default profile; use --browser-import to reuse sign-in",
+      );
+    }
+  }
+}

package/src/browser-options.mjs

@@ -55,7 +55,11 @@ export function parseBrowserOptions({
     channel: attach === "extension" ? channel : validateChannel(channel),
     executable: executable ? path.resolve(executable) : null,
     import: importFrom ? parseImport(importFrom) : null,
-    importScope: parseImportScope(importScope, importFrom),
+    importScope:
+      (importScope === undefined || importScope === null) &&
+      findBrowserSource(channel)?.controlProtocol === "bidi"
+        ? "domains"
+        : parseImportScope(importScope, importFrom),
     attach: attach ? parseAttach(attach) : null,
     preferences: parsePreferences(preferences),
     restrictions: validateRestrictions(restrictions),
@@ -80,9 +84,34 @@ export function parseBrowserOptions({
       "--browser-attach extension cannot be combined with --browser-executable, --browser-pref, or --browser-restriction",
     );
   }
+  validateEngineOptions(options);
   return options;
 }
 
+/** Rejects capabilities the installed upstream non-CDP launchers lack. */
+function validateEngineOptions(options) {
+  if (
+    options.attach?.mode === "extension" ||
+    findBrowserSource(options.channel)?.controlProtocol === "cdp"
+  ) {
+    return;
+  }
+  const unsupported = options.attach
+    ? "--browser-attach snapshot"
+    : options.restrictions.length
+      ? "--browser-restriction"
+      : Object.keys(options.preferences).length
+        ? "--browser-pref"
+        : options.import && options.importScope === "full"
+          ? "--browser-import-scope full"
+          : null;
+  if (unsupported) {
+    throw new Error(
+      `${unsupported} is unavailable for ${options.channel} in the installed browser-commander; use --browser-import-scope domains for sign-in cookies`,
+    );
+  }
+}
+
 /** Parses `<browser>[:profile]`, `default`, or `auto`. */
 export function parseImport(spec, discovery = {}) {
   const separator = spec.indexOf(":");

package/src/cli.mjs

@@ -14,7 +14,11 @@ import { parseRegistry } from "./model.mjs";
 import { buildPlans } from "./plan.mjs";
 import { probeEnvironment, renderPrerequisites } from "./prerequisites.mjs";
 import { probeRegistryState } from "./registry-state.mjs";
-import { BROWSER_MODES, defaultBrowserProfile, executePlan } from "./setup.mjs";
+import {
+  BROWSER_MODES,
+  defaultBrowserProfile,
+  executePlans,
+} from "./setup.mjs";
 import { importSources } from "./sign-in-import.mjs";
 
 export { isDirectExecution };
@@ -25,6 +29,7 @@ Commands:
   inspect                         Discover supported package manifests
   plan [--registry <registry>]    Print ordered setup plans
   setup --registry <registry>     Bootstrap or attach trusted publishing
+  setup --all                     Set up every publishable package in one session
 
 Global options:
   -h, --help                      Print this help
@@ -41,6 +46,8 @@ Plan and setup options:
   --workflow <file>               Trusted-publisher workflow file in
                                   .github/workflows, when detection finds
                                   several or the wrong one
+  --add-publish-job                Propose missing publishing jobs in a draft PR;
+                                  --workflow chooses its target file
   --environment <name>            GitHub environment of the trusted publisher
   --package <name>                Plan only this package, or select it for
                                   setup when a registry has several
@@ -104,11 +111,13 @@ export async function main(args = process.argv.slice(2)) {
       offline: { type: "boolean", default: false },
       "verify-release": { type: "boolean", default: false },
       workflow: { type: "string" },
+      "add-publish-job": { type: "boolean", default: false },
       environment: { type: "string" },
       "dry-run": { type: "boolean", default: false },
       registry: { type: "string", multiple: true },
       package: { type: "string" },
       execute: { type: "boolean", default: false },
+      all: { type: "boolean", default: false },
       yes: { type: "boolean", default: false },
       "no-browser": { type: "boolean", default: false },
       "open-with": { type: "string" },
@@ -175,6 +184,12 @@ export async function main(args = process.argv.slice(2)) {
   const environment = await probeEnvironment({
     offline: values.offline,
     verbose: values.verbose,
+    python: inspection.packages.some(
+      (item) =>
+        item.registry === "pypi" &&
+        item.publishable &&
+        (registries.length === 0 || registries.includes("pypi")),
+    ),
     npm: inspection.packages.some(
       (item) =>
         item.registry === "npm" &&
@@ -185,7 +200,12 @@ export async function main(args = process.argv.slice(2)) {
   const planOptions = {
     verifyRelease: values["verify-release"],
     manual: values.manual,
-    workflow: await workflowOverride(repository, values.workflow),
+    workflow: await workflowOverride(
+      repository,
+      values.workflow,
+      values["add-publish-job"],
+    ),
+    addPublishJob: values["add-publish-job"],
     publisherEnvironment: nonEmpty(values.environment, "--environment"),
     environment,
     browser: browserSummary(command, values, browserOptions),
@@ -198,7 +218,10 @@ export async function main(args = process.argv.slice(2)) {
     outputPlans(plans, values.format);
     return;
   }
-  if (registries.length !== 1) {
+  if (values.all && values.package) {
+    throw new Error("--all and --package are mutually exclusive");
+  }
+  if (!values.all && registries.length !== 1) {
     throw new Error("setup requires exactly one --registry <registry>");
   }
   if (values["dry-run"] && values.execute) {
@@ -215,26 +238,36 @@ export async function main(args = process.argv.slice(2)) {
   }
 
   const plans = buildPlans(inspection, registries, planOptions);
-  const plan = selectPlan(plans, values.package);
-  outputPlans([plan], values.format);
-  await executePlan(plan, {
-    repository,
-    execute: values.execute,
-    yes: values.yes,
-    noBrowser: values["no-browser"],
-    openWith: nonEmpty(values["open-with"], "--open-with"),
-    keepSession: values["keep-session"],
-    browser: values.browser,
-    browserOptions,
-    browserProfile: path.resolve(
-      values["browser-profile"] ?? defaultBrowserProfile(),
-    ),
-    verbose: values.verbose,
-    verifyRelease: values["verify-release"],
-  });
+  const selected = values.all
+    ? plans.filter((plan) => plan.package.publishable)
+    : [selectPlan(plans, values.package)];
+  outputPlans(selected, values.format);
+  await executePlans(
+    selected,
+    {
+      inspection,
+      workflow: planOptions.workflow,
+      publisherEnvironment: planOptions.publisherEnvironment,
+      repository,
+      execute: values.execute,
+      yes: values.yes,
+      noBrowser: values["no-browser"],
+      openWith: nonEmpty(values["open-with"], "--open-with"),
+      keepSession: values["keep-session"],
+      browser: values.browser,
+      browserOptions,
+      browserProfile: path.resolve(
+        values["browser-profile"] ??
+          defaultBrowserProfile({ channel: browserOptions.channel }),
+      ),
+      verbose: values.verbose,
+      verifyRelease: values["verify-release"],
+    },
+    values.all,
+  );
 }
 
-async function workflowOverride(repository, workflow) {
+async function workflowOverride(repository, workflow, adding = false) {
   if (workflow === undefined) {
     return undefined;
   }
@@ -248,7 +281,7 @@ async function workflowOverride(repository, workflow) {
     (metadata) => metadata.isFile(),
     () => false,
   );
-  if (!found) {
+  if (!found && !adding) {
     throw new Error(`--workflow: .github/workflows/${workflow} does not exist`);
   }
   return workflow;
@@ -273,7 +306,10 @@ function browserSummary(command, values, browserOptions) {
     channel: browserOptions.channel,
     profile:
       values.browser === "automated" && !browserOptions.attach
-        ? path.resolve(values["browser-profile"] ?? defaultBrowserProfile())
+        ? path.resolve(
+            values["browser-profile"] ??
+              defaultBrowserProfile({ channel: browserOptions.channel }),
+          )
         : undefined,
     import: browserOptions.import ?? undefined,
     attach: browserOptions.attach ?? undefined,

package/src/discovery.mjs

@@ -178,6 +178,11 @@ function withPublisher(item, workflows, publishers) {
   const secrets = tokenSecrets(workflows, item.registry);
   const warnings = [
     ...publisher.warnings,
+    ...(!publisher.workflow && publisher.candidates.length === 0
+      ? [
+          `no workflow publishes ${item.name} to ${item.registry}; CI releases will not reach it`,
+        ]
+      : []),
     ...secrets.map((secret) => tokenSecretWarning(item.registry, secret)),
   ];
   if (warnings.length > 0) {
@@ -291,7 +296,17 @@ function parsePyproject(contents, manifest) {
   if (!name) {
     return null;
   }
-  return packageInfo("pypi", name, tomlString(section, "version"), manifest);
+  const item = packageInfo(
+    "pypi",
+    name,
+    tomlString(section, "version"),
+    manifest,
+  );
+  const required = tomlString(section, "requires-python");
+  if (required) {
+    item.requires_python = required;
+  }
+  return item;
 }
 
 function parseDotnet(contents, manifestPath, manifest) {

package/src/index.mjs

@@ -3,4 +3,4 @@ export { inspectRepository } from "./discovery.mjs";
 export { REGISTRIES, parseRegistry } from "./model.mjs";
 export { buildPlans, packageDirectory } from "./plan.mjs";
 export { ensureProfileIgnored } from "./profile.mjs";
-export { defaultBrowserProfile, executePlan } from "./setup.mjs";
+export { defaultBrowserProfile, executePlan, executePlans } from "./setup.mjs";

package/src/plan.mjs

@@ -9,6 +9,7 @@ import {
 import { pagesSteps } from "./pages.mjs";
 import { planPrerequisites } from "./prerequisites.mjs";
 import { TRUSTED_REGISTRIES } from "./publishers.mjs";
+import { applyPython } from "./python.mjs";
 
 const FLOWS = new Map([
   ["npm", npmFlow],
@@ -166,6 +167,27 @@ function flowPlan(inspection, packageInfo, options) {
       skipped_reason: `several workflows publish to ${packageInfo.registry} (${packageInfo.workflow_candidates.join(", ")}); pass --workflow <file> to choose the trusted publisher`,
     };
   }
+  if (
+    trusted &&
+    (!workflow ||
+      (options.addPublishJob &&
+        !packageInfo.workflow &&
+        !packageInfo.workflow_candidates?.length))
+  ) {
+    return {
+      ...basePlan(inspection, packageInfo, [
+        {
+          id: "add-publishing-workflow",
+          title: "Offer a publishing job in a reviewed pull request",
+          kind: "manual",
+          description:
+            "Add the missing publishing job to the workflow used by the other registries, on a new branch and pull request. Review and merge it, then re-run setup to attach the trusted publisher.",
+          confirm: true,
+        },
+      ]),
+      skipped_reason: `no workflow publishes ${packageInfo.name} to ${packageInfo.registry}; CI releases will not reach it; add a publishing job or pass --workflow <file> before attaching a trusted publisher`,
+    };
+  }
   const context = {
     directory: packageDirectory(packageInfo.manifest),
     slug,
@@ -213,6 +235,7 @@ function flowPlan(inspection, packageInfo, options) {
       plan.trusted_publisher.project = packageInfo.name;
     }
   }
+  applyPython(plan, options.environment?.python);
   return plan;
 }
 

package/src/prerequisites.mjs

@@ -1,6 +1,7 @@
 import { exec } from "command-stream";
 
 import { automatedDescription } from "./browser-options.mjs";
+import { probePython } from "./python.mjs";
 import { getJson, registryEndpoint } from "./registry-state.mjs";
 
 /** The Node.js versions npm 11 runs on. */
@@ -154,6 +155,7 @@ export async function probeEnvironment(options = {}) {
       : null;
   return {
     offline,
+    python: options.python ? await probePython({ verbose }) : undefined,
     node: nodeVersion,
     npm: npmVersion?.code === 0 ? npmVersion.stdout.trim() : null,
     trustNpm: spec,

package/src/profile.mjs

@@ -3,6 +3,7 @@ import os from "node:os";
 import path from "node:path";
 
 import { exec } from "command-stream";
+import { findBrowserSource } from "browser-commander";
 
 const APPLICATION = "package-registry-manager";
 const PROFILE = "browser-profile";
@@ -17,20 +18,26 @@ export function defaultBrowserProfile({
   platform = process.platform,
   env = process.env,
   home = os.homedir(),
+  channel = "chrome",
 } = {}) {
+  const source = findBrowserSource(channel);
+  const profile =
+    source?.controlProtocol && source.controlProtocol !== "cdp"
+      ? `${PROFILE}-${source.id}`
+      : PROFILE;
   const join = platform === "win32" ? path.win32.join : path.posix.join;
   if (platform === "win32") {
     const base = env.LOCALAPPDATA || join(home, "AppData", "Local");
-    return join(base, APPLICATION, PROFILE);
+    return join(base, APPLICATION, profile);
   }
   if (platform === "darwin") {
-    return join(home, "Library", "Application Support", APPLICATION, PROFILE);
+    return join(home, "Library", "Application Support", APPLICATION, profile);
   }
   // The XDG specification ignores relative values.
   const state = path.posix.isAbsolute(env.XDG_STATE_HOME ?? "")
     ? env.XDG_STATE_HOME
     : join(home, ".local", "state");
-  return join(state, APPLICATION, PROFILE);
+  return join(state, APPLICATION, profile);
 }
 
 /** The profile location used before it moved out of the repository. */

package/src/publishers.mjs

@@ -15,7 +15,7 @@ const JOB_PATTERNS = new Map([
   ],
   [
     "pypi",
-    /pypa\/gh-action-pypi-publish|\btwine\s+upload\b|\b(?:uv|poetry|hatch|flit|pdm)\s+publish\b/,
+    /pypa\/gh-action-pypi-publish|\b(?:python(?:3(?:\.\d+)?)?\s+-m\s+)?twine\s+upload\b|\b(?:uv|poetry|hatch|flit|pdm)\s+publish\b/,
   ],
 ]);