package-registry-manager 0.22.4 → 0.22.5

package/README.md

@@ -10,12 +10,15 @@ browser, filling forms in a dedicated visible browser profile.
 npx package-registry-manager inspect --repository /path/to/repository
 npx package-registry-manager plan --repository /path/to/repository --format json
 npx package-registry-manager setup --repository /path/to/repository --registry npm
+npx package-registry-manager setup --repository /path/to/repository --all --execute
 ```
 
 The package installs the command as both `package-registry-manager` and
 `package-registry-manager-js`; use the second name when the Rust command of the
 same name is also on your `PATH`.
 
-Setup is a dry run unless `--execute` is present, and it never publishes an
-artifact. See the repository README for all registry walkthroughs and safety
-details.
+Setup is a dry run unless `--execute` is present. It can publish the first
+version after confirmation; later versions publish through CI. Missing CI
+publishing jobs are offered in a draft pull request, and PyPI builds select an
+interpreter satisfying `requires-python`. See the repository README for the
+registry walkthroughs and safety details.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.22.4",
+  "version": "0.22.5",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
     "provenance": true
   },
   "scripts": {
-    "syntax": "node --check src/cli.mjs && node --check src/direct-execution.mjs && node --check src/index.mjs && node --check src/browser.mjs && node --check src/browser-options.mjs && node --check src/browser-catalogue.mjs && node --check src/automation.mjs && node --check src/webdriver-automation.mjs && node --check src/profile.mjs && node --check src/setup.mjs && node --check src/auth-urls.mjs && node --check src/containers.mjs && node --check src/flows.mjs && node --check src/prerequisites.mjs && node --check src/registry-state.mjs && node --check src/workflows.mjs && node --check src/publishers.mjs && node --check src/skips.mjs && node --check src/tokens.mjs && node --check src/approvals.mjs && node --check src/default-browser.mjs && node --check src/pages.mjs && node --check src/crates-api.mjs && node --check src/sign-in-import.mjs && node --check scripts/publish-to-npm.mjs && node --check scripts/setup-npm.mjs && node --check scripts/sanitize-npm-userconfig.mjs",
+    "syntax": "node --check src/cli.mjs && node --check src/direct-execution.mjs && node --check src/index.mjs && node --check src/browser.mjs && node --check src/browser-options.mjs && node --check src/browser-catalogue.mjs && node --check src/automation.mjs && node --check src/webdriver-automation.mjs && node --check src/profile.mjs && node --check src/setup.mjs && node --check src/auth-urls.mjs && node --check src/containers.mjs && node --check src/flows.mjs && node --check src/prerequisites.mjs && node --check src/registry-state.mjs && node --check src/workflows.mjs && node --check src/publishers.mjs && node --check src/skips.mjs && node --check src/tokens.mjs && node --check src/approvals.mjs && node --check src/default-browser.mjs && node --check src/pages.mjs && node --check src/crates-api.mjs && node --check src/sign-in-import.mjs && node --check scripts/publish-to-npm.mjs && node --check scripts/setup-npm.mjs && node --check scripts/sanitize-npm-userconfig.mjs && node --check src/python.mjs && node --check src/setup-batch.mjs && node --check src/workflow-proposal.mjs",
     "lint": "eslint src test scripts --max-warnings 0",
     "lint:fix": "eslint src test scripts --fix --max-warnings 0",
     "format": "prettier --write .",
@@ -40,7 +40,7 @@
     "audit": "node scripts/npm-audit.mjs"
   },
   "dependencies": {
-    "browser-commander": "^0.25.0",
+    "browser-commander": "^0.26.0",
     "command-stream": "^1.6.2",
     "playwright": "^1.63.0",
     "selenium-webdriver": "^4.50.0"

package/src/browser-catalogue.mjs

@@ -11,7 +11,7 @@ export const browserSources = () => BROWSER_IDS.map(findBrowserSource);
 /** Catalogue channels with a launch control protocol. */
 export function launchChannels() {
   return browserSources()
-    .filter((source) => source.controlProtocol)
+    .filter((source) => ["cdp", "bidi"].includes(source.controlProtocol))
     .flatMap((source) => [source.id, ...(source.aliases ?? [])]);
 }
 
@@ -122,11 +122,11 @@ export function installedDescription(options = {}) {
 /** Reject unavailable engines before creating an automated profile. */
 export function validateChannel(channel) {
   const known = findBrowserSource(channel);
-  if (known?.controlProtocol) {
+  if (["cdp", "bidi"].includes(known?.controlProtocol)) {
     return channel;
   }
   const reason = known
-    ? `${channel} has no launch control protocol in browser-commander's catalogue${known.family === "safari" ? " (Safari setup: https://github.com/link-foundation/browser-commander/issues/126)" : ""}`
+    ? `${channel} has no launch control protocol supported by this manager${known.family === "safari" ? " (Safari setup: https://github.com/link-foundation/browser-commander/issues/126)" : ""}`
     : `unknown --browser-channel '${channel}'`;
   throw new Error(
     `${reason}; choose from ${launchChannels().join(", ")}. ${installedDescription()}`,

package/src/cli.mjs

@@ -14,7 +14,11 @@ import { parseRegistry } from "./model.mjs";
 import { buildPlans } from "./plan.mjs";
 import { probeEnvironment, renderPrerequisites } from "./prerequisites.mjs";
 import { probeRegistryState } from "./registry-state.mjs";
-import { BROWSER_MODES, defaultBrowserProfile, executePlan } from "./setup.mjs";
+import {
+  BROWSER_MODES,
+  defaultBrowserProfile,
+  executePlans,
+} from "./setup.mjs";
 import { importSources } from "./sign-in-import.mjs";
 
 export { isDirectExecution };
@@ -25,6 +29,7 @@ Commands:
   inspect                         Discover supported package manifests
   plan [--registry <registry>]    Print ordered setup plans
   setup --registry <registry>     Bootstrap or attach trusted publishing
+  setup --all                     Set up every publishable package in one session
 
 Global options:
   -h, --help                      Print this help
@@ -41,6 +46,8 @@ Plan and setup options:
   --workflow <file>               Trusted-publisher workflow file in
                                   .github/workflows, when detection finds
                                   several or the wrong one
+  --add-publish-job                Propose missing publishing jobs in a draft PR;
+                                  --workflow chooses its target file
   --environment <name>            GitHub environment of the trusted publisher
   --package <name>                Plan only this package, or select it for
                                   setup when a registry has several
@@ -104,11 +111,13 @@ export async function main(args = process.argv.slice(2)) {
       offline: { type: "boolean", default: false },
       "verify-release": { type: "boolean", default: false },
       workflow: { type: "string" },
+      "add-publish-job": { type: "boolean", default: false },
       environment: { type: "string" },
       "dry-run": { type: "boolean", default: false },
       registry: { type: "string", multiple: true },
       package: { type: "string" },
       execute: { type: "boolean", default: false },
+      all: { type: "boolean", default: false },
       yes: { type: "boolean", default: false },
       "no-browser": { type: "boolean", default: false },
       "open-with": { type: "string" },
@@ -175,6 +184,12 @@ export async function main(args = process.argv.slice(2)) {
   const environment = await probeEnvironment({
     offline: values.offline,
     verbose: values.verbose,
+    python: inspection.packages.some(
+      (item) =>
+        item.registry === "pypi" &&
+        item.publishable &&
+        (registries.length === 0 || registries.includes("pypi")),
+    ),
     npm: inspection.packages.some(
       (item) =>
         item.registry === "npm" &&
@@ -185,7 +200,12 @@ export async function main(args = process.argv.slice(2)) {
   const planOptions = {
     verifyRelease: values["verify-release"],
     manual: values.manual,
-    workflow: await workflowOverride(repository, values.workflow),
+    workflow: await workflowOverride(
+      repository,
+      values.workflow,
+      values["add-publish-job"],
+    ),
+    addPublishJob: values["add-publish-job"],
     publisherEnvironment: nonEmpty(values.environment, "--environment"),
     environment,
     browser: browserSummary(command, values, browserOptions),
@@ -198,7 +218,10 @@ export async function main(args = process.argv.slice(2)) {
     outputPlans(plans, values.format);
     return;
   }
-  if (registries.length !== 1) {
+  if (values.all && values.package) {
+    throw new Error("--all and --package are mutually exclusive");
+  }
+  if (!values.all && registries.length !== 1) {
     throw new Error("setup requires exactly one --registry <registry>");
   }
   if (values["dry-run"] && values.execute) {
@@ -215,27 +238,36 @@ export async function main(args = process.argv.slice(2)) {
   }
 
   const plans = buildPlans(inspection, registries, planOptions);
-  const plan = selectPlan(plans, values.package);
-  outputPlans([plan], values.format);
-  await executePlan(plan, {
-    repository,
-    execute: values.execute,
-    yes: values.yes,
-    noBrowser: values["no-browser"],
-    openWith: nonEmpty(values["open-with"], "--open-with"),
-    keepSession: values["keep-session"],
-    browser: values.browser,
-    browserOptions,
-    browserProfile: path.resolve(
-      values["browser-profile"] ??
-        defaultBrowserProfile({ channel: browserOptions.channel }),
-    ),
-    verbose: values.verbose,
-    verifyRelease: values["verify-release"],
-  });
+  const selected = values.all
+    ? plans.filter((plan) => plan.package.publishable)
+    : [selectPlan(plans, values.package)];
+  outputPlans(selected, values.format);
+  await executePlans(
+    selected,
+    {
+      inspection,
+      workflow: planOptions.workflow,
+      publisherEnvironment: planOptions.publisherEnvironment,
+      repository,
+      execute: values.execute,
+      yes: values.yes,
+      noBrowser: values["no-browser"],
+      openWith: nonEmpty(values["open-with"], "--open-with"),
+      keepSession: values["keep-session"],
+      browser: values.browser,
+      browserOptions,
+      browserProfile: path.resolve(
+        values["browser-profile"] ??
+          defaultBrowserProfile({ channel: browserOptions.channel }),
+      ),
+      verbose: values.verbose,
+      verifyRelease: values["verify-release"],
+    },
+    values.all,
+  );
 }
 
-async function workflowOverride(repository, workflow) {
+async function workflowOverride(repository, workflow, adding = false) {
   if (workflow === undefined) {
     return undefined;
   }
@@ -249,7 +281,7 @@ async function workflowOverride(repository, workflow) {
     (metadata) => metadata.isFile(),
     () => false,
   );
-  if (!found) {
+  if (!found && !adding) {
     throw new Error(`--workflow: .github/workflows/${workflow} does not exist`);
   }
   return workflow;

package/src/discovery.mjs

@@ -178,6 +178,11 @@ function withPublisher(item, workflows, publishers) {
   const secrets = tokenSecrets(workflows, item.registry);
   const warnings = [
     ...publisher.warnings,
+    ...(!publisher.workflow && publisher.candidates.length === 0
+      ? [
+          `no workflow publishes ${item.name} to ${item.registry}; CI releases will not reach it`,
+        ]
+      : []),
     ...secrets.map((secret) => tokenSecretWarning(item.registry, secret)),
   ];
   if (warnings.length > 0) {
@@ -291,7 +296,17 @@ function parsePyproject(contents, manifest) {
   if (!name) {
     return null;
   }
-  return packageInfo("pypi", name, tomlString(section, "version"), manifest);
+  const item = packageInfo(
+    "pypi",
+    name,
+    tomlString(section, "version"),
+    manifest,
+  );
+  const required = tomlString(section, "requires-python");
+  if (required) {
+    item.requires_python = required;
+  }
+  return item;
 }
 
 function parseDotnet(contents, manifestPath, manifest) {

package/src/index.mjs

@@ -3,4 +3,4 @@ export { inspectRepository } from "./discovery.mjs";
 export { REGISTRIES, parseRegistry } from "./model.mjs";
 export { buildPlans, packageDirectory } from "./plan.mjs";
 export { ensureProfileIgnored } from "./profile.mjs";
-export { defaultBrowserProfile, executePlan } from "./setup.mjs";
+export { defaultBrowserProfile, executePlan, executePlans } from "./setup.mjs";

package/src/plan.mjs

@@ -9,6 +9,7 @@ import {
 import { pagesSteps } from "./pages.mjs";
 import { planPrerequisites } from "./prerequisites.mjs";
 import { TRUSTED_REGISTRIES } from "./publishers.mjs";
+import { applyPython } from "./python.mjs";
 
 const FLOWS = new Map([
   ["npm", npmFlow],
@@ -166,6 +167,27 @@ function flowPlan(inspection, packageInfo, options) {
       skipped_reason: `several workflows publish to ${packageInfo.registry} (${packageInfo.workflow_candidates.join(", ")}); pass --workflow <file> to choose the trusted publisher`,
     };
   }
+  if (
+    trusted &&
+    (!workflow ||
+      (options.addPublishJob &&
+        !packageInfo.workflow &&
+        !packageInfo.workflow_candidates?.length))
+  ) {
+    return {
+      ...basePlan(inspection, packageInfo, [
+        {
+          id: "add-publishing-workflow",
+          title: "Offer a publishing job in a reviewed pull request",
+          kind: "manual",
+          description:
+            "Add the missing publishing job to the workflow used by the other registries, on a new branch and pull request. Review and merge it, then re-run setup to attach the trusted publisher.",
+          confirm: true,
+        },
+      ]),
+      skipped_reason: `no workflow publishes ${packageInfo.name} to ${packageInfo.registry}; CI releases will not reach it; add a publishing job or pass --workflow <file> before attaching a trusted publisher`,
+    };
+  }
   const context = {
     directory: packageDirectory(packageInfo.manifest),
     slug,
@@ -213,6 +235,7 @@ function flowPlan(inspection, packageInfo, options) {
       plan.trusted_publisher.project = packageInfo.name;
     }
   }
+  applyPython(plan, options.environment?.python);
   return plan;
 }
 

package/src/prerequisites.mjs

@@ -1,6 +1,7 @@
 import { exec } from "command-stream";
 
 import { automatedDescription } from "./browser-options.mjs";
+import { probePython } from "./python.mjs";
 import { getJson, registryEndpoint } from "./registry-state.mjs";
 
 /** The Node.js versions npm 11 runs on. */
@@ -154,6 +155,7 @@ export async function probeEnvironment(options = {}) {
       : null;
   return {
     offline,
+    python: options.python ? await probePython({ verbose }) : undefined,
     node: nodeVersion,
     npm: npmVersion?.code === 0 ? npmVersion.stdout.trim() : null,
     trustNpm: spec,

package/src/publishers.mjs

@@ -15,7 +15,7 @@ const JOB_PATTERNS = new Map([
   ],
   [
     "pypi",
-    /pypa\/gh-action-pypi-publish|\btwine\s+upload\b|\b(?:uv|poetry|hatch|flit|pdm)\s+publish\b/,
+    /pypa\/gh-action-pypi-publish|\b(?:python(?:3(?:\.\d+)?)?\s+-m\s+)?twine\s+upload\b|\b(?:uv|poetry|hatch|flit|pdm)\s+publish\b/,
   ],
 ]);
 

package/src/python.mjs

@@ -0,0 +1,149 @@
+import { readdir } from "node:fs/promises";
+import path from "node:path";
+import { exec } from "command-stream";
+
+// requires-python describes interpreter releases. Reject unsupported or
+// prerelease syntax rather than silently choosing an incompatible executable.
+function release(value) {
+  return /^\d+(?:\.\d+){0,2}$/.test(value)
+    ? value.split(".").map(Number)
+    : null;
+}
+
+function compare(left, right) {
+  for (let i = 0; i < 3; i += 1) {
+    const difference = (left[i] ?? 0) - (right[i] ?? 0);
+    if (difference) {
+      return Math.sign(difference);
+    }
+  }
+  return 0;
+}
+
+/** Tests stable interpreter versions against requires-python specifiers. */
+export function pythonMatches(version, requirement = "") {
+  const actual = release(version);
+  if (!actual) {
+    return false;
+  }
+  if (!requirement.trim()) {
+    return true;
+  }
+  return requirement.split(",").every((clause) => {
+    const match =
+      /^\s*(~=|==|!=|<=|>=|<|>)\s*(\d+(?:\.\d+){0,2})(\.\*)?\s*$/.exec(clause);
+    if (!match) {
+      return false;
+    }
+    const [, operator, text, wildcard] = match;
+    const expected = release(text);
+    if (wildcard) {
+      const equal = expected.every((part, i) => actual[i] === part);
+      return operator === "==" ? equal : operator === "!=" && !equal;
+    }
+    const order = compare(actual, expected);
+    switch (operator) {
+      case "==":
+        return order === 0;
+      case "!=":
+        return order !== 0;
+      case ">=":
+        return order >= 0;
+      case "<=":
+        return order <= 0;
+      case ">":
+        return order > 0;
+      case "<":
+        return order < 0;
+      case "~=": {
+        if (expected.length < 2) {
+          return false;
+        }
+        const upper = expected.slice(0, -1);
+        upper[upper.length - 1] += 1;
+        return order >= 0 && compare(actual, upper) < 0;
+      }
+      default:
+        return false;
+    }
+  });
+}
+
+/** Selects the first installed compatible interpreter, preferring PATH defaults. */
+export function choosePython(tools, requirement) {
+  return tools.find((tool) => pythonMatches(tool.version, requirement)) ?? null;
+}
+
+async function candidatePrograms() {
+  const candidates = new Set(["python", "python3"]);
+  for (const directory of (process.env.PATH ?? "").split(path.delimiter)) {
+    if (!directory) {
+      continue;
+    }
+    const entries = await readdir(directory).catch(() => []);
+    for (const entry of entries.sort()) {
+      if (/^python3\.\d+(?:\.exe)?$/.test(entry)) {
+        candidates.add(entry);
+      }
+    }
+  }
+  return [...candidates].slice(0, 32);
+}
+
+/** Probes only interpreter versions, without loading manifests or package code. */
+export async function probePython(options = {}) {
+  const candidates = options.candidates ?? (await candidatePrograms());
+  const probe =
+    options.probe ??
+    (async (program, args) => {
+      if (options.verbose) {
+        console.error(`+ ${program} ${args.join(" ")}`);
+      }
+      return exec(program, args, {
+        capture: true,
+        mirror: false,
+        stdin: "ignore",
+      });
+    });
+  const tools = [];
+  for (const program of candidates) {
+    try {
+      const result = await probe(program, ["--version"]);
+      const version = /^Python (\d+\.\d+\.\d+)\s*$/.exec(
+        String(result.stdout ?? "").trim(),
+      )?.[1];
+      if (result.code === 0 && version) {
+        tools.push({ program, version });
+      }
+    } catch {
+      // An unavailable candidate is not an installed interpreter.
+    }
+  }
+  return tools;
+}
+
+/** Adds a Python prerequisite and selects the executable used by the build step. */
+export function applyPython(plan, tools) {
+  const build = plan.steps.find((step) => step.id === "build-package");
+  if (plan.registry !== "pypi" || !build || !tools) {
+    return;
+  }
+  const requirement = plan.package.requires_python ?? "";
+  const selected = choosePython(tools, requirement);
+  const item = {
+    id: "python",
+    title: "Python",
+    detected: selected
+      ? `${selected.program} (${selected.version})`
+      : "no compatible interpreter found",
+    required: `Install Python satisfying ${requirement || "the project requirements"} and its build module (python -m pip install build)`,
+    ok: Boolean(selected),
+  };
+  plan.prerequisites = [
+    ...(plan.prerequisites ?? []).filter((entry) => entry.id !== "python"),
+    item,
+  ];
+  if (selected) {
+    build.command = { program: selected.program, args: ["-m", "build"] };
+  }
+}

package/src/setup-batch.mjs

@@ -0,0 +1,174 @@
+import { rm } from "node:fs/promises";
+import { protectLegacyProfile } from "./profile.mjs";
+import { SetupSession, prompt } from "./setup.mjs";
+import { offerWorkflow } from "./workflow-proposal.mjs";
+import { signInDomains } from "./sign-in-import.mjs";
+import { oidcReleaseNote } from "./approvals.mjs";
+
+/** Validates a plan before running any registry or repository mutations. */
+export function validatePlan(plan, execute = true) {
+  if (!plan.package.publishable) {
+    throw new Error(
+      `${plan.package.name} is not publishable: ${(plan.package.problems ?? []).join("; ")}`,
+    );
+  }
+  if (
+    execute &&
+    plan.skipped_reason &&
+    !plan.steps.some((step) => step.id === "add-publishing-workflow")
+  ) {
+    throw new Error(plan.skipped_reason);
+  }
+  const python = plan.prerequisites?.find(
+    (item) => item.id === "python" && item.ok === false,
+  );
+  if (execute && python) {
+    throw new Error(`${python.detected}; ${python.required}`);
+  }
+}
+
+/** Runs one package, using the same executor as setup --all. */
+export async function executePlan(plan, options) {
+  return executePlans([plan], options, false);
+}
+
+/** Runs all plans with one browser session and defers sign-out until the end. */
+export async function executePlans(plans, options, summary = true) {
+  if (plans.length === 0) {
+    throw new Error("no publishable package manifests were found");
+  }
+  for (const plan of plans) {
+    validatePlan(plan, options.execute);
+  }
+  for (const plan of plans) {
+    if (plan.mode === "complete") {
+      console.log(
+        `${plan.package.name} already publishes through trusted publishing; ${plan.steps.length ? "only the repository checks remain." : "nothing to do."}`,
+      );
+    }
+  }
+  if (
+    plans.every((plan) => plan.mode === "complete" && plan.steps.length === 0)
+  ) {
+    const outcomes = plans.map((plan) => ({
+      registry: plan.registry,
+      package: plan.package.name,
+      status: "complete",
+    }));
+    printSummary(outcomes, summary);
+    return outcomes;
+  }
+  if (!options.execute) {
+    console.log(
+      "Dry run only. Re-run with --execute to run these steps and open the registry.",
+    );
+    return [];
+  }
+  const missing = plans.filter((plan) =>
+    plan.steps.some((step) => step.id === "add-publishing-workflow"),
+  );
+  if (missing.length) {
+    const result = await offerWorkflow(missing, {
+      ...options,
+      prompt: options.prompt ?? prompt,
+    });
+    const outcomes = plans.map((plan) => ({
+      registry: plan.registry,
+      package: plan.package.name,
+      status: missing.includes(plan) ? result.status : "blocked",
+      ...(result.url ? { url: result.url } : {}),
+    }));
+    printSummary(outcomes, summary);
+    return outcomes;
+  }
+  if (options.browserProfile) {
+    await protectLegacyProfile(
+      options.repository,
+      options.browserProfile,
+      options,
+    );
+  }
+  const domains = [
+    ...new Set(plans.flatMap((plan) => signInDomains(plan.registry))),
+  ];
+  let automation = options.automation ?? null;
+  const deferred = new Map();
+  const outcomes = [];
+  let failure;
+  try {
+    for (const plan of plans) {
+      const session = new SetupSession(plan, {
+        ...options,
+        automation,
+        domains,
+      });
+      try {
+        await session.run();
+        outcomes.push({
+          registry: plan.registry,
+          package: plan.package.name,
+          status: plan.steps.length === 0 ? "complete" : "configured",
+        });
+        if (plan.trusted_publisher?.workflow) {
+          console.log(`\n${oidcReleaseNote(plan.trusted_publisher.workflow)}`);
+        }
+      } catch (error) {
+        outcomes.push({
+          registry: plan.registry,
+          package: plan.package.name,
+          status: "failed",
+        });
+        failure = error;
+      } finally {
+        const steps = await session.cleanup({
+          deferAuth: plans.length > 1,
+          closeBrowser: false,
+        });
+        automation = session.automation;
+        for (const step of steps) {
+          deferred.set(`${plan.registry}:${step.id}`, { session, step });
+        }
+      }
+      if (failure) {
+        break;
+      }
+    }
+  } finally {
+    for (const { session, step } of deferred.values()) {
+      session.automation = automation;
+      try {
+        await session.runStep(step);
+      } catch (error) {
+        console.error(`warning: ${step.id} failed: ${error.message}`);
+      } finally {
+        if (session.shim?.directory) {
+          await rm(session.shim.directory, { recursive: true, force: true });
+        }
+      }
+    }
+    await automation?.close();
+    for (const plan of plans.slice(outcomes.length)) {
+      outcomes.push({
+        registry: plan.registry,
+        package: plan.package.name,
+        status: "not-run",
+      });
+    }
+    printSummary(outcomes, summary);
+  }
+  if (failure) {
+    throw failure;
+  }
+  return outcomes;
+}
+
+function printSummary(outcomes, enabled) {
+  if (enabled) {
+    console.log("\nSetup summary:");
+    for (const item of outcomes) {
+      console.log(
+        `- ${item.registry}: ${item.package}: ${item.status}${item.url ? ` (${item.url})` : ""}`,
+      );
+    }
+  }
+}

package/src/setup.mjs

@@ -15,7 +15,6 @@ import {
 import {
   approvalDeadline,
   TWO_FACTOR_HINT,
-  oidcReleaseNote,
   withFreshLinks,
 } from "./approvals.mjs";
 import { connectAutomation } from "./automation.mjs";
@@ -30,7 +29,6 @@ import { CLEANUP_CONDITIONS } from "./flows.mjs";
 import { pagesSettingsUrl, pagesState } from "./pages.mjs";
 import { packageDirectory } from "./plan.mjs";
 import { twoFactorMode } from "./prerequisites.mjs";
-import { protectLegacyProfile } from "./profile.mjs";
 import { getJson, probePackage } from "./registry-state.mjs";
 import { launchBrowser, signInDomains } from "./sign-in-import.mjs";
 import { reportTokenSecrets, verifyTokenRevoked } from "./tokens.mjs";
@@ -54,54 +52,9 @@ const PUBLISH_REJECTED = /\bE404\b|404 Not Found|invalid-publisher/i;
 /** Where `--browser` opens URLs that need no automation. */
 export const BROWSER_MODES = ["default", "automated"];
 
-/**
- * Runs a setup plan. Without `options.execute` it only reports a dry run.
- * Steps whose `when` condition does not hold are skipped, so a re-run after a
- * partial success resumes where the previous run stopped.
- */
-export async function executePlan(plan, options) {
-  if (!plan.package.publishable) {
-    throw new Error(
-      `${plan.package.name} is not publishable: ${(plan.package.problems ?? []).join("; ")}`,
-    );
-  }
-  if (plan.mode === "complete") {
-    const remaining =
-      plan.steps.length === 0
-        ? "nothing to do."
-        : "only the repository checks remain.";
-    console.log(
-      `${plan.package.name} already publishes through trusted publishing; ${remaining}`,
-    );
-    if (plan.steps.length === 0) {
-      return;
-    }
-  }
-  if (!options.execute) {
-    console.log(
-      "Dry run only. Re-run with --execute to run these steps and open the registry.",
-    );
-    return;
-  }
-  if (options.browserProfile) {
-    await protectLegacyProfile(
-      options.repository,
-      options.browserProfile,
-      options,
-    );
-  }
-  const session = new SetupSession(plan, options);
-  try {
-    await session.run();
-  } finally {
-    await session.cleanup();
-  }
-  if (plan.trusted_publisher?.workflow) {
-    console.log(`\n${oidcReleaseNote(plan.trusted_publisher.workflow)}`);
-  }
-}
+export { executePlan, executePlans } from "./setup-batch.mjs";
 
-class SetupSession {
+export class SetupSession {
   constructor(plan, options) {
     this.plan = plan;
     this.options = options;
@@ -135,9 +88,22 @@ class SetupSession {
    * Runs every cleanup step of the plan whose condition holds, including
    * those after a step that failed (#24).
    */
-  async cleanup() {
+  async cleanup({ deferAuth = false, closeBrowser = true } = {}) {
+    const deferred = [];
     for (const step of cleanupSteps(this.plan)) {
-      if (step.id === "sign-out" && this.keepsSession(step)) {
+      if (
+        deferAuth &&
+        ["sign-out", "crates-sign-out"].includes(step.id) &&
+        this.conditions.has(step.when)
+      ) {
+        if (step.id === "sign-out" && this.options.keepSession) {
+          console.log(
+            "Keeping the npm session (--keep-session); run npm logout to revoke it.",
+          );
+        } else {
+          deferred.push(step);
+        }
+      } else if (step.id === "sign-out" && this.keepsSession(step)) {
         console.log(
           "Keeping the npm session (--keep-session): its token stays in npm's user configuration until you run npm logout, and the next run reuses it while npm whoami succeeds.",
         );
@@ -148,13 +114,17 @@ class SetupSession {
         );
       } else if (this.conditions.has(step.when)) {
         this.log(`==> ${step.title}`);
-        const result = await this.runProcess(step, true);
-        if (result.code !== 0) {
-          console.error(`warning: ${step.id} exited with ${result.code}`);
+        try {
+          const result = await this.runProcess(step, true);
+          if (result.code !== 0) {
+            console.error(`warning: ${step.id} exited with ${result.code}`);
+          }
+        } catch (error) {
+          console.error(`warning: ${step.id} failed: ${error.message}`);
         }
       }
     }
-    if (this.automation) {
+    if (this.automation && closeBrowser) {
       await this.automation.close();
     }
     for (const directory of [this.temporary, this.shim?.directory]) {
@@ -162,6 +132,9 @@ class SetupSession {
         await rm(directory, { recursive: true, force: true });
       }
     }
+    this.shim = null;
+    this.temporary = null;
+    return deferred;
   }
 
   keepsSession(step) {
@@ -643,7 +616,7 @@ class SetupSession {
    */
   async automatedPage(browser = this.options.browserOptions) {
     if (!this.automation) {
-      const domains = signInDomains(this.plan.registry);
+      const domains = this.options.domains ?? signInDomains(this.plan.registry);
       this.automation = await connectAutomation({
         browser: await launchBrowser(browser, domains, {
           deferred: this.plan.registry === "crates-io",
@@ -872,7 +845,7 @@ function render(command) {
 }
 
 /** Asks a question on the terminal; a closed stdin answers with "". */
-async function prompt(message) {
+export async function prompt(message) {
   const terminal = createInterface({ input: stdin, output: stdout });
   try {
     return await new Promise((resolve) => {

package/src/workflow-proposal.mjs

@@ -0,0 +1,333 @@
+import {
+  mkdir,
+  mkdtemp,
+  writeFile,
+  rm,
+  realpath,
+  lstat,
+} from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { exec } from "command-stream";
+import { packageDirectory } from "./plan.mjs";
+import { parseWorkflow } from "./publishers.mjs";
+import { readWorkflows } from "./workflows.mjs";
+
+const quote = (text) => `'${text.replaceAll("'", "''")}'`;
+const RELEASE_IF =
+  "github.event_name == 'release' || ((github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == format('refs/heads/{0}', github.event.repository.default_branch))";
+
+function job(packageInfo, index, environment) {
+  if (
+    !/^(?:[\w@.-]+\/)*[\w@.-]+$/.test(packageInfo.manifest) ||
+    packageInfo.manifest.split("/").some((part) => ["..", "."].includes(part))
+  ) {
+    throw new Error("unsafe manifest path for publishing job");
+  }
+  const directory = packageDirectory(packageInfo.manifest);
+  const lines = [
+    `  prm-publish-${packageInfo.registry}-${index + 1}:`,
+    `    if: ${RELEASE_IF}`,
+    "    runs-on: ubuntu-latest",
+    "    timeout-minutes: 15",
+    "    permissions:",
+    "      contents: read",
+    "      id-token: write",
+    ...(environment ? [`    environment: ${quote(environment)}`] : []),
+    "    defaults:",
+    "      run:",
+    `        working-directory: ${quote(directory)}`,
+    "    steps:",
+    "      - uses: actions/checkout@v6",
+    "        with:",
+    "          persist-credentials: false",
+  ];
+  switch (packageInfo.registry) {
+    case "npm":
+      lines.push(
+        "      - uses: actions/setup-node@v6",
+        "        with:",
+        "          node-version: '22'",
+        "      - run: npm install --global npm@^11",
+        "      - run: npm install",
+        "      - run: npm run build --if-present",
+        "      - run: npm publish --provenance --access public",
+      );
+      break;
+    case "crates-io":
+      lines.push(
+        "      - uses: dtolnay/rust-toolchain@stable",
+        "      - uses: rust-lang/crates-io-auth-action@v1",
+        "        id: auth",
+        "      - run: cargo publish",
+        "        env:",
+        "          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}",
+      );
+      break;
+    case "pypi":
+      lines.push("      - uses: actions/setup-python@v6", "        with:");
+      lines.push(
+        packageInfo.manifest.endsWith("pyproject.toml") &&
+          packageInfo.requires_python
+          ? `          python-version-file: ${quote(packageInfo.manifest)}`
+          : "          python-version: '3.x'",
+      );
+      lines.push(
+        "      - run: python -m pip install build",
+        "      - run: python -m build",
+        "      - uses: pypa/gh-action-pypi-publish@release/v1",
+        "        with:",
+        `          packages-dir: ${quote(`${directory === "." ? "" : `${directory}/`}dist/`)}`,
+      );
+      break;
+    default:
+      throw new Error(`no publishing job template for ${packageInfo.registry}`);
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+/** Generates reviewable workflow contents without modifying the checkout. */
+export function workflowProposal(
+  inspection,
+  packages,
+  workflows,
+  override,
+  chosenEnvironment,
+) {
+  const known = [
+    ...new Set(
+      inspection.packages
+        .filter(
+          (item) =>
+            item.publishable !== false &&
+            ["npm", "crates-io", "pypi"].includes(item.registry),
+        )
+        .map((item) => item.workflow)
+        .filter(Boolean),
+    ),
+  ];
+  if (!override && known.length > 1) {
+    throw new Error(
+      "publishing uses several files; pass --add-publish-job --workflow <file> to choose the shared workflow",
+    );
+  }
+  const workflow =
+    override ??
+    known[0] ??
+    inspection.repository.release_workflow ??
+    "release.yml";
+  if (!/^[\w.-]+\.ya?ml$/.test(workflow)) {
+    throw new Error("invalid publishing workflow name");
+  }
+  let contents =
+    workflows.find((item) => item.name === workflow)?.contents ??
+    "name: Package release\non:\n  workflow_dispatch:\n  release:\n    types: [published]\npermissions:\n  contents: read\njobs:\n";
+  const parsed = parseWorkflow(contents);
+  const environments = [
+    ...new Set(
+      inspection.packages
+        .filter((item) => item.workflow === workflow)
+        .map((item) => item.environment ?? null),
+    ),
+  ];
+  if (chosenEnvironment === undefined && environments.length > 1) {
+    throw new Error(
+      "publishing jobs use different environments; choose a shared environment with --environment",
+    );
+  }
+  let addition = packages
+    .map((item, index) =>
+      job(item, index, chosenEnvironment ?? environments[0]),
+    )
+    .join("\n");
+  for (const item of parseWorkflow(`jobs:\n${addition}`).jobs) {
+    if (parsed.jobs.some((existing) => existing.name === item.name)) {
+      throw new Error(
+        `publishing job ${item.name} already exists; inspect the workflow before adding it again`,
+      );
+    }
+  }
+  const lines = contents.split(/\r?\n/);
+  const start = lines.findIndex((line) => /^jobs\s*:\s*$/.test(line));
+  if (start === -1) {
+    throw new Error(
+      "workflow has no editable jobs block; add a publishing job manually",
+    );
+  }
+  let end = lines.findIndex((line, index) => index > start && /^\S/.test(line));
+  end = end === -1 ? lines.length : end;
+  // Match the existing job indentation without reformatting unrelated YAML.
+  const indent = parsed.jobs.length
+    ? (lines
+        .slice(start + 1, end)
+        .find((line) => /^\s+\S/.test(line) && !/^\s*#/.test(line))
+        ?.search(/\S/) ?? 2)
+    : 2;
+  if (indent !== 2) {
+    if (indent < 2) {
+      throw new Error("unsupported jobs indentation");
+    }
+    addition = addition
+      .split("\n")
+      .map((line) => (line ? `${" ".repeat(indent - 2)}${line}` : line))
+      .join("\n");
+  }
+  contents = `${lines.slice(0, end).join("\n").trimEnd()}\n\n${addition}${lines.slice(end).join("\n")}`;
+  return { workflow, contents };
+}
+
+/** Creates a branch and draft PR; never writes or pushes the default branch. */
+export async function offerWorkflow(plans, options) {
+  const inspection = options.inspection ?? {
+    repository: plans[0].repository,
+    packages: plans.map((plan) => plan.package),
+  };
+  const proposal = workflowProposal(
+    inspection,
+    plans.map((plan) => plan.package),
+    await readWorkflows(options.repository),
+    options.workflow,
+    options.publisherEnvironment,
+  );
+  console.log(
+    `Proposed .github/workflows/${proposal.workflow}:\n${proposal.contents}`,
+  );
+  if (
+    !options.yes &&
+    !/^y(?:es)?$/i.test(
+      (
+        await options.prompt(
+          "Create a branch and draft pull request with these publishing jobs? [y/N] ",
+        )
+      ).trim(),
+    )
+  ) {
+    return { status: "blocked" };
+  }
+  const run =
+    options.run ??
+    (async (program, args, cwd = options.repository) => {
+      if (options.verbose) {
+        console.error(`+ ${program} ${args.join(" ")}`);
+      }
+      const result = await exec(program, args, {
+        cwd,
+        capture: true,
+        mirror: false,
+        stdin: "ignore",
+      });
+      if (result.code !== 0) {
+        throw new Error(
+          `${program} failed: ${String(result.stderr ?? result.stdout ?? "")}`,
+        );
+      }
+      return String(result.stdout ?? "").trim();
+    });
+  const remote = await run("git", ["remote", "get-url", "origin"]);
+  const slug = `${inspection.repository.github_owner}/${inspection.repository.github_repository}`;
+  if (
+    !inspection.repository.github_owner ||
+    !inspection.repository.github_repository ||
+    !["https://github.com/", "git@github.com:", "ssh://git@github.com/"].some(
+      (prefix) =>
+        remote === `${prefix}${slug}` || remote === `${prefix}${slug}.git`,
+    )
+  ) {
+    throw new Error(
+      "origin must match the inspected GitHub repository before proposing a workflow",
+    );
+  }
+  const base = await run("gh", [
+    "repo",
+    "view",
+    slug,
+    "--json",
+    "defaultBranchRef",
+    "--jq",
+    ".defaultBranchRef.name",
+  ]);
+  await run("git", ["fetch", "origin", base]);
+  const branch = `prm/publish-jobs-${Date.now()}`;
+  const temporary = await mkdtemp(path.join(os.tmpdir(), "prm-workflow-"));
+  const checkout = path.join(temporary, "checkout");
+  let created = false;
+  try {
+    await run("git", [
+      "worktree",
+      "add",
+      "-b",
+      branch,
+      checkout,
+      `origin/${base}`,
+    ]);
+    created = true;
+    // Recompute from the default branch to preserve edits made since inspection.
+    const current = workflowProposal(
+      inspection,
+      plans.map((plan) => plan.package),
+      await readWorkflows(checkout),
+      proposal.workflow,
+      options.publisherEnvironment,
+    );
+    if (current.contents !== proposal.contents) {
+      console.log(`Updated proposal from ${base}:\n${current.contents}`);
+      if (
+        !options.yes &&
+        !/^y(?:es)?$/i.test(
+          (await options.prompt("Use this updated proposal? [y/N] ")).trim(),
+        )
+      ) {
+        return { status: "blocked" };
+      }
+    }
+    const file = `.github/workflows/${current.workflow}`;
+    await mkdir(path.dirname(path.join(checkout, file)), { recursive: true });
+    const target = path.join(checkout, file);
+    const physicalParent = await realpath(path.dirname(target));
+    if (
+      !physicalParent.startsWith(`${await realpath(checkout)}${path.sep}`) ||
+      (await lstat(target).catch(() => null))?.isSymbolicLink()
+    ) {
+      throw new Error(
+        "workflow must stay inside the proposal worktree without symlinks",
+      );
+    }
+    await writeFile(target, current.contents);
+    await run("git", ["add", "--", file], checkout);
+    await run(
+      "git",
+      ["commit", "-m", "Add missing trusted publishing jobs"],
+      checkout,
+    );
+    await run("git", ["push", "origin", `HEAD:refs/heads/${branch}`], checkout);
+    const body = `Add missing publishing jobs for ${plans.map((plan) => `${plan.registry}: ${plan.package.name}`).join(", ")} in ${current.workflow}. Review the build, versioning, triggers and job dependencies before merging. Then re-run setup to attach the trusted publishers to this file.`;
+    const url = await run(
+      "gh",
+      [
+        "pr",
+        "create",
+        "--repo",
+        slug,
+        "--base",
+        base,
+        "--head",
+        branch,
+        "--draft",
+        "--title",
+        "Add missing trusted publishing jobs",
+        "--body",
+        body,
+      ],
+      checkout,
+    );
+    console.log(
+      `Review ${url}, merge it, then re-run setup. Trusted publishers have not been attached.`,
+    );
+    return { status: "workflow-pr", url };
+  } finally {
+    if (created) {
+      await run("git", ["worktree", "remove", "--force", checkout]);
+    }
+    await rm(temporary, { recursive: true, force: true });
+  }
+}