package-registry-manager 0.22.3 → 0.22.5

package/src/python.mjs

@@ -0,0 +1,149 @@
+import { readdir } from "node:fs/promises";
+import path from "node:path";
+import { exec } from "command-stream";
+
+// requires-python describes interpreter releases. Reject unsupported or
+// prerelease syntax rather than silently choosing an incompatible executable.
+function release(value) {
+  return /^\d+(?:\.\d+){0,2}$/.test(value)
+    ? value.split(".").map(Number)
+    : null;
+}
+
+function compare(left, right) {
+  for (let i = 0; i < 3; i += 1) {
+    const difference = (left[i] ?? 0) - (right[i] ?? 0);
+    if (difference) {
+      return Math.sign(difference);
+    }
+  }
+  return 0;
+}
+
+/** Tests stable interpreter versions against requires-python specifiers. */
+export function pythonMatches(version, requirement = "") {
+  const actual = release(version);
+  if (!actual) {
+    return false;
+  }
+  if (!requirement.trim()) {
+    return true;
+  }
+  return requirement.split(",").every((clause) => {
+    const match =
+      /^\s*(~=|==|!=|<=|>=|<|>)\s*(\d+(?:\.\d+){0,2})(\.\*)?\s*$/.exec(clause);
+    if (!match) {
+      return false;
+    }
+    const [, operator, text, wildcard] = match;
+    const expected = release(text);
+    if (wildcard) {
+      const equal = expected.every((part, i) => actual[i] === part);
+      return operator === "==" ? equal : operator === "!=" && !equal;
+    }
+    const order = compare(actual, expected);
+    switch (operator) {
+      case "==":
+        return order === 0;
+      case "!=":
+        return order !== 0;
+      case ">=":
+        return order >= 0;
+      case "<=":
+        return order <= 0;
+      case ">":
+        return order > 0;
+      case "<":
+        return order < 0;
+      case "~=": {
+        if (expected.length < 2) {
+          return false;
+        }
+        const upper = expected.slice(0, -1);
+        upper[upper.length - 1] += 1;
+        return order >= 0 && compare(actual, upper) < 0;
+      }
+      default:
+        return false;
+    }
+  });
+}
+
+/** Selects the first installed compatible interpreter, preferring PATH defaults. */
+export function choosePython(tools, requirement) {
+  return tools.find((tool) => pythonMatches(tool.version, requirement)) ?? null;
+}
+
+async function candidatePrograms() {
+  const candidates = new Set(["python", "python3"]);
+  for (const directory of (process.env.PATH ?? "").split(path.delimiter)) {
+    if (!directory) {
+      continue;
+    }
+    const entries = await readdir(directory).catch(() => []);
+    for (const entry of entries.sort()) {
+      if (/^python3\.\d+(?:\.exe)?$/.test(entry)) {
+        candidates.add(entry);
+      }
+    }
+  }
+  return [...candidates].slice(0, 32);
+}
+
+/** Probes only interpreter versions, without loading manifests or package code. */
+export async function probePython(options = {}) {
+  const candidates = options.candidates ?? (await candidatePrograms());
+  const probe =
+    options.probe ??
+    (async (program, args) => {
+      if (options.verbose) {
+        console.error(`+ ${program} ${args.join(" ")}`);
+      }
+      return exec(program, args, {
+        capture: true,
+        mirror: false,
+        stdin: "ignore",
+      });
+    });
+  const tools = [];
+  for (const program of candidates) {
+    try {
+      const result = await probe(program, ["--version"]);
+      const version = /^Python (\d+\.\d+\.\d+)\s*$/.exec(
+        String(result.stdout ?? "").trim(),
+      )?.[1];
+      if (result.code === 0 && version) {
+        tools.push({ program, version });
+      }
+    } catch {
+      // An unavailable candidate is not an installed interpreter.
+    }
+  }
+  return tools;
+}
+
+/** Adds a Python prerequisite and selects the executable used by the build step. */
+export function applyPython(plan, tools) {
+  const build = plan.steps.find((step) => step.id === "build-package");
+  if (plan.registry !== "pypi" || !build || !tools) {
+    return;
+  }
+  const requirement = plan.package.requires_python ?? "";
+  const selected = choosePython(tools, requirement);
+  const item = {
+    id: "python",
+    title: "Python",
+    detected: selected
+      ? `${selected.program} (${selected.version})`
+      : "no compatible interpreter found",
+    required: `Install Python satisfying ${requirement || "the project requirements"} and its build module (python -m pip install build)`,
+    ok: Boolean(selected),
+  };
+  plan.prerequisites = [
+    ...(plan.prerequisites ?? []).filter((entry) => entry.id !== "python"),
+    item,
+  ];
+  if (selected) {
+    build.command = { program: selected.program, args: ["-m", "build"] };
+  }
+}

package/src/setup-batch.mjs

@@ -0,0 +1,174 @@
+import { rm } from "node:fs/promises";
+import { protectLegacyProfile } from "./profile.mjs";
+import { SetupSession, prompt } from "./setup.mjs";
+import { offerWorkflow } from "./workflow-proposal.mjs";
+import { signInDomains } from "./sign-in-import.mjs";
+import { oidcReleaseNote } from "./approvals.mjs";
+
+/** Validates a plan before running any registry or repository mutations. */
+export function validatePlan(plan, execute = true) {
+  if (!plan.package.publishable) {
+    throw new Error(
+      `${plan.package.name} is not publishable: ${(plan.package.problems ?? []).join("; ")}`,
+    );
+  }
+  if (
+    execute &&
+    plan.skipped_reason &&
+    !plan.steps.some((step) => step.id === "add-publishing-workflow")
+  ) {
+    throw new Error(plan.skipped_reason);
+  }
+  const python = plan.prerequisites?.find(
+    (item) => item.id === "python" && item.ok === false,
+  );
+  if (execute && python) {
+    throw new Error(`${python.detected}; ${python.required}`);
+  }
+}
+
+/** Runs one package, using the same executor as setup --all. */
+export async function executePlan(plan, options) {
+  return executePlans([plan], options, false);
+}
+
+/** Runs all plans with one browser session and defers sign-out until the end. */
+export async function executePlans(plans, options, summary = true) {
+  if (plans.length === 0) {
+    throw new Error("no publishable package manifests were found");
+  }
+  for (const plan of plans) {
+    validatePlan(plan, options.execute);
+  }
+  for (const plan of plans) {
+    if (plan.mode === "complete") {
+      console.log(
+        `${plan.package.name} already publishes through trusted publishing; ${plan.steps.length ? "only the repository checks remain." : "nothing to do."}`,
+      );
+    }
+  }
+  if (
+    plans.every((plan) => plan.mode === "complete" && plan.steps.length === 0)
+  ) {
+    const outcomes = plans.map((plan) => ({
+      registry: plan.registry,
+      package: plan.package.name,
+      status: "complete",
+    }));
+    printSummary(outcomes, summary);
+    return outcomes;
+  }
+  if (!options.execute) {
+    console.log(
+      "Dry run only. Re-run with --execute to run these steps and open the registry.",
+    );
+    return [];
+  }
+  const missing = plans.filter((plan) =>
+    plan.steps.some((step) => step.id === "add-publishing-workflow"),
+  );
+  if (missing.length) {
+    const result = await offerWorkflow(missing, {
+      ...options,
+      prompt: options.prompt ?? prompt,
+    });
+    const outcomes = plans.map((plan) => ({
+      registry: plan.registry,
+      package: plan.package.name,
+      status: missing.includes(plan) ? result.status : "blocked",
+      ...(result.url ? { url: result.url } : {}),
+    }));
+    printSummary(outcomes, summary);
+    return outcomes;
+  }
+  if (options.browserProfile) {
+    await protectLegacyProfile(
+      options.repository,
+      options.browserProfile,
+      options,
+    );
+  }
+  const domains = [
+    ...new Set(plans.flatMap((plan) => signInDomains(plan.registry))),
+  ];
+  let automation = options.automation ?? null;
+  const deferred = new Map();
+  const outcomes = [];
+  let failure;
+  try {
+    for (const plan of plans) {
+      const session = new SetupSession(plan, {
+        ...options,
+        automation,
+        domains,
+      });
+      try {
+        await session.run();
+        outcomes.push({
+          registry: plan.registry,
+          package: plan.package.name,
+          status: plan.steps.length === 0 ? "complete" : "configured",
+        });
+        if (plan.trusted_publisher?.workflow) {
+          console.log(`\n${oidcReleaseNote(plan.trusted_publisher.workflow)}`);
+        }
+      } catch (error) {
+        outcomes.push({
+          registry: plan.registry,
+          package: plan.package.name,
+          status: "failed",
+        });
+        failure = error;
+      } finally {
+        const steps = await session.cleanup({
+          deferAuth: plans.length > 1,
+          closeBrowser: false,
+        });
+        automation = session.automation;
+        for (const step of steps) {
+          deferred.set(`${plan.registry}:${step.id}`, { session, step });
+        }
+      }
+      if (failure) {
+        break;
+      }
+    }
+  } finally {
+    for (const { session, step } of deferred.values()) {
+      session.automation = automation;
+      try {
+        await session.runStep(step);
+      } catch (error) {
+        console.error(`warning: ${step.id} failed: ${error.message}`);
+      } finally {
+        if (session.shim?.directory) {
+          await rm(session.shim.directory, { recursive: true, force: true });
+        }
+      }
+    }
+    await automation?.close();
+    for (const plan of plans.slice(outcomes.length)) {
+      outcomes.push({
+        registry: plan.registry,
+        package: plan.package.name,
+        status: "not-run",
+      });
+    }
+    printSummary(outcomes, summary);
+  }
+  if (failure) {
+    throw failure;
+  }
+  return outcomes;
+}
+
+function printSummary(outcomes, enabled) {
+  if (enabled) {
+    console.log("\nSetup summary:");
+    for (const item of outcomes) {
+      console.log(
+        `- ${item.registry}: ${item.package}: ${item.status}${item.url ? ` (${item.url})` : ""}`,
+      );
+    }
+  }
+}

package/src/setup.mjs

@@ -15,7 +15,6 @@ import {
 import {
   approvalDeadline,
   TWO_FACTOR_HINT,
-  oidcReleaseNote,
   withFreshLinks,
 } from "./approvals.mjs";
 import { connectAutomation } from "./automation.mjs";
@@ -30,7 +29,6 @@ import { CLEANUP_CONDITIONS } from "./flows.mjs";
 import { pagesSettingsUrl, pagesState } from "./pages.mjs";
 import { packageDirectory } from "./plan.mjs";
 import { twoFactorMode } from "./prerequisites.mjs";
-import { protectLegacyProfile } from "./profile.mjs";
 import { getJson, probePackage } from "./registry-state.mjs";
 import { launchBrowser, signInDomains } from "./sign-in-import.mjs";
 import { reportTokenSecrets, verifyTokenRevoked } from "./tokens.mjs";
@@ -54,54 +52,9 @@ const PUBLISH_REJECTED = /\bE404\b|404 Not Found|invalid-publisher/i;
 /** Where `--browser` opens URLs that need no automation. */
 export const BROWSER_MODES = ["default", "automated"];
 
-/**
- * Runs a setup plan. Without `options.execute` it only reports a dry run.
- * Steps whose `when` condition does not hold are skipped, so a re-run after a
- * partial success resumes where the previous run stopped.
- */
-export async function executePlan(plan, options) {
-  if (!plan.package.publishable) {
-    throw new Error(
-      `${plan.package.name} is not publishable: ${(plan.package.problems ?? []).join("; ")}`,
-    );
-  }
-  if (plan.mode === "complete") {
-    const remaining =
-      plan.steps.length === 0
-        ? "nothing to do."
-        : "only the repository checks remain.";
-    console.log(
-      `${plan.package.name} already publishes through trusted publishing; ${remaining}`,
-    );
-    if (plan.steps.length === 0) {
-      return;
-    }
-  }
-  if (!options.execute) {
-    console.log(
-      "Dry run only. Re-run with --execute to run these steps and open the registry.",
-    );
-    return;
-  }
-  if (options.browserProfile) {
-    await protectLegacyProfile(
-      options.repository,
-      options.browserProfile,
-      options,
-    );
-  }
-  const session = new SetupSession(plan, options);
-  try {
-    await session.run();
-  } finally {
-    await session.cleanup();
-  }
-  if (plan.trusted_publisher?.workflow) {
-    console.log(`\n${oidcReleaseNote(plan.trusted_publisher.workflow)}`);
-  }
-}
+export { executePlan, executePlans } from "./setup-batch.mjs";
 
-class SetupSession {
+export class SetupSession {
   constructor(plan, options) {
     this.plan = plan;
     this.options = options;
@@ -135,9 +88,22 @@ class SetupSession {
    * Runs every cleanup step of the plan whose condition holds, including
    * those after a step that failed (#24).
    */
-  async cleanup() {
+  async cleanup({ deferAuth = false, closeBrowser = true } = {}) {
+    const deferred = [];
     for (const step of cleanupSteps(this.plan)) {
-      if (step.id === "sign-out" && this.keepsSession(step)) {
+      if (
+        deferAuth &&
+        ["sign-out", "crates-sign-out"].includes(step.id) &&
+        this.conditions.has(step.when)
+      ) {
+        if (step.id === "sign-out" && this.options.keepSession) {
+          console.log(
+            "Keeping the npm session (--keep-session); run npm logout to revoke it.",
+          );
+        } else {
+          deferred.push(step);
+        }
+      } else if (step.id === "sign-out" && this.keepsSession(step)) {
         console.log(
           "Keeping the npm session (--keep-session): its token stays in npm's user configuration until you run npm logout, and the next run reuses it while npm whoami succeeds.",
         );
@@ -148,13 +114,17 @@ class SetupSession {
         );
       } else if (this.conditions.has(step.when)) {
         this.log(`==> ${step.title}`);
-        const result = await this.runProcess(step, true);
-        if (result.code !== 0) {
-          console.error(`warning: ${step.id} exited with ${result.code}`);
+        try {
+          const result = await this.runProcess(step, true);
+          if (result.code !== 0) {
+            console.error(`warning: ${step.id} exited with ${result.code}`);
+          }
+        } catch (error) {
+          console.error(`warning: ${step.id} failed: ${error.message}`);
         }
       }
     }
-    if (this.automation) {
+    if (this.automation && closeBrowser) {
       await this.automation.close();
     }
     for (const directory of [this.temporary, this.shim?.directory]) {
@@ -162,6 +132,9 @@ class SetupSession {
         await rm(directory, { recursive: true, force: true });
       }
     }
+    this.shim = null;
+    this.temporary = null;
+    return deferred;
   }
 
   keepsSession(step) {
@@ -643,7 +616,7 @@ class SetupSession {
    */
   async automatedPage(browser = this.options.browserOptions) {
     if (!this.automation) {
-      const domains = signInDomains(this.plan.registry);
+      const domains = this.options.domains ?? signInDomains(this.plan.registry);
       this.automation = await connectAutomation({
         browser: await launchBrowser(browser, domains, {
           deferred: this.plan.registry === "crates-io",
@@ -872,7 +845,7 @@ function render(command) {
 }
 
 /** Asks a question on the terminal; a closed stdin answers with "". */
-async function prompt(message) {
+export async function prompt(message) {
   const terminal = createInterface({ input: stdin, output: stdout });
   try {
     return await new Promise((resolve) => {

package/src/webdriver-automation.mjs

@@ -0,0 +1,125 @@
+// Firefox-family browsers use Browser Commander's native WebDriver/BiDi API.
+// Its real/CDP launcher and migration target writers do not support them yet.
+import { launchWebDriver, readBrowserCookies } from "browser-commander";
+
+import {
+  assertDedicatedProfile,
+  resolveExecutable,
+} from "./browser-catalogue.mjs";
+import { ensureProfileIgnored } from "./profile.mjs";
+import { IMPORT_CHOICES } from "./sign-in-import.mjs";
+
+/** True only for a requested host or its subdomains, never a substring. */
+export function matchesDomains(host, domains) {
+  const normalized = host.replace(/^\./, "").toLowerCase();
+  return domains.some(
+    (domain) => normalized === domain || normalized.endsWith(`.${domain}`),
+  );
+}
+
+/** The BiDi cookie shape; session cookies omit expiry. */
+export function bidiCookie(cookie) {
+  const result = {
+    name: cookie.name,
+    value: { type: "string", value: cookie.value },
+    domain: cookie.domain,
+    path: cookie.path ?? "/",
+    httpOnly: cookie.httpOnly ?? false,
+    secure: cookie.secure ?? false,
+    sameSite: (cookie.sameSite ?? "Lax").toLowerCase(),
+  };
+  if (cookie.expires > 0) {
+    result.expiry = cookie.expires;
+  }
+  return result;
+}
+
+/** Launches the selected installed Firefox variant and exposes the common page API. */
+export async function connectWebDriverAutomation(
+  { browser, profile, verbose, domains },
+  dependencies = {},
+) {
+  // Validation happens before profile creation, including programmatic callers.
+  if (
+    browser.attach ||
+    browser.restrictions.length ||
+    Object.keys(browser.preferences).length ||
+    (browser.import && browser.importScope === "full")
+  ) {
+    throw new Error(
+      `unsupported Firefox launch options for ${browser.channel}; use --browser-import-scope domains without snapshot, preferences or restrictions`,
+    );
+  }
+  if (browser.import && domains.length === 0) {
+    throw new Error("a domains import needs the registry's sign-in domains");
+  }
+  const executablePath = await (
+    dependencies.resolveExecutable ?? resolveExecutable
+  )({
+    channel: browser.channel.toLowerCase(),
+    executablePath: browser.executable,
+  });
+  assertDedicatedProfile(profile);
+  await ensureProfileIgnored(profile, { verbose });
+  const connection = await (dependencies.launchWebDriver ?? launchWebDriver)({
+    browser: "firefox",
+    executablePath,
+    userDataDir: profile,
+    headless: false,
+    bidi: true,
+    verbose,
+  });
+  try {
+    await connection.page.bidiCommand("storage.getCookies", {});
+    if (browser.import && !IMPORT_CHOICES.includes(browser.import.browser)) {
+      const read = dependencies.readCookies ?? readBrowserCookies;
+      const seen = new Set();
+      for (const domain of domains) {
+        const cookies = await read({
+          browser: browser.import.browser,
+          profile: browser.import.profile ?? undefined,
+          domainFilter: domain,
+          cache: false,
+        });
+        for (const cookie of cookies) {
+          const key = JSON.stringify([cookie.domain, cookie.path, cookie.name]);
+          if (!matchesDomains(cookie.domain, domains) || seen.has(key)) {
+            continue;
+          }
+          seen.add(key);
+          await connection.page.bidiCommand("storage.setCookie", {
+            cookie: bidiCookie(cookie),
+          });
+        }
+      }
+    }
+  } catch (error) {
+    await connection.close().catch(() => {});
+    throw new Error(
+      `could not prepare ${browser.channel} sign-in cookies (WebDriver BiDi storage is required)`,
+      { cause: error },
+    );
+  }
+  return {
+    goto: (url) => connection.page.goto(url),
+    evaluate: (script) => connection.page.evaluate(script),
+    close: () => connection.close(),
+    async clearCookies(names) {
+      const { cookies } = await connection.page.bidiCommand(
+        "storage.getCookies",
+        {},
+      );
+      for (const cookie of cookies) {
+        if (matchesDomains(cookie.domain, names)) {
+          await connection.page.bidiCommand("storage.deleteCookies", {
+            filter: {
+              name: cookie.name,
+              domain: cookie.domain,
+              path: cookie.path,
+            },
+          });
+        }
+      }
+    },
+  };
+}