package-registry-manager 0.22.4 → 0.22.6

package/src/model.mjs

@@ -8,9 +8,24 @@ export const REGISTRIES = Object.freeze([
   "packagist",
   "docker-hub",
   "ghcr",
+  "rubygems",
+  "jsr",
+  "vscode-marketplace",
+  "open-vsx",
+  "chrome-web-store",
 ]);
 
 const REGISTRY_ALIASES = new Map([
+  ["ruby", "rubygems"],
+  ["rubygems", "rubygems"],
+  ["gem", "rubygems"],
+  ["jsr", "jsr"],
+  ["vscode", "vscode-marketplace"],
+  ["vsce", "vscode-marketplace"],
+  ["vscode-marketplace", "vscode-marketplace"],
+  ["ovsx", "open-vsx"],
+  ["open-vsx", "open-vsx"],
+  ["chrome-web-store", "chrome-web-store"],
   ["npm", "npm"],
   ["cargo", "crates-io"],
   ["crate", "crates-io"],

package/src/npm-policy.mjs

@@ -0,0 +1,69 @@
+import { npmName, registryEndpoint, USER_AGENT } from "./registry-state.mjs";
+
+/** Bounded punctuation variants, including npm's punctuation-free moniker. */
+export function nameVariants(name) {
+  const slash = name.lastIndexOf("/");
+  const scope = slash < 0 ? "" : name.slice(0, slash + 1);
+  const leaf = name.slice(slash + 1);
+  const pieces = leaf.split(/[._-]+/).filter(Boolean);
+  let variants = [pieces[0]];
+  for (const piece of pieces.slice(1)) {
+    variants = variants
+      .flatMap((prefix) =>
+        ["", "-", ".", "_"].map((separator) => prefix + separator + piece),
+      )
+      .slice(0, 64);
+  }
+  return [...new Set(variants.map((variant) => scope + variant))].filter(
+    (variant) => variant !== name,
+  );
+}
+
+/** npm dry-run cannot validate unpublished server-side block/similarity rules. */
+export async function checkNamePolicy(name, options = {}) {
+  if (
+    name.length > 214 ||
+    !/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(name) ||
+    ["node_modules", "favicon.ico"].includes(name)
+  ) {
+    throw new Error(
+      `npm name '${name}' is invalid; choose a lowercase descriptive name or @owner/name`,
+    );
+  }
+  const base = registryEndpoint("npm", options.env ?? process.env);
+  for (const variant of [name, ...nameVariants(name)]) {
+    const response = await (options.fetch ?? globalThis.fetch)(
+      `${base}/${npmName(variant)}?_=${Date.now()}`,
+      {
+        headers: {
+          accept: "application/json",
+          "cache-control": "no-cache, no-store",
+          "user-agent": USER_AGENT,
+        },
+        signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
+      },
+    );
+    if (response.status === 404) {
+      continue;
+    }
+    if (!response.ok) {
+      throw new Error(
+        `npm name policy lookup failed (${response.status}); no approval requested`,
+      );
+    }
+    if (variant !== name) {
+      throw new Error(
+        `npm name '${name}' is similar to existing '${variant}'; use @owner/${name} or a longer descriptive name`,
+      );
+    }
+    return;
+  }
+}
+
+/** Report npm policy refusal once, without entering authentication retry logic. */
+export function policyRefusal(output) {
+  return (
+    /\bE403\b|403 Forbidden/i.test(output) &&
+    /too similar|forbidden|blocked|not allowed/i.test(output)
+  );
+}

package/src/package-coverage.mjs

@@ -0,0 +1,106 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import {
+  executableLines,
+  parseWorkflow,
+  scriptReferences,
+} from "./publishers.mjs";
+
+/** Keep executable steps for this manifest, preserving the job's OIDC identity. */
+export function packageWorkflows(workflows, packageInfo) {
+  const directory = path.posix.dirname(packageInfo.manifest);
+  const working = (lines) =>
+    lines
+      .map(
+        (line) => /^\s*working-directory\s*:\s*['"]?([\w./-]+)/.exec(line)?.[1],
+      )
+      .filter(Boolean)
+      .at(-1);
+  return workflows.map((workflow) => {
+    const parsed = parseWorkflow(workflow.contents);
+    const jobs = parsed.jobs.flatMap((job) => {
+      const start = job.lines.findIndex((line) => /^\s*steps\s*:/.test(line));
+      if (start < 0) {
+        const called = job.lines.some((line) =>
+          /^\s*uses\s*:\s*["']?\.\/\.github\/workflows\//.test(line),
+        );
+        const cwd = working(job.lines) ?? working(parsed.header) ?? ".";
+        return called &&
+          cwd.replace(/^\.\//, "").replace(/\/$/, "") === directory
+          ? [`  ${job.name}:\n${job.lines.join("\n")}`]
+          : [];
+      }
+      const prefix = job.lines.slice(0, start + 1);
+      const blocks = [];
+      for (const line of job.lines.slice(start + 1)) {
+        if (/^\s*-\s+[\w-]+\s*:/.test(line)) {
+          blocks.push([]);
+        }
+        if (blocks.length) {
+          blocks.at(-1).push(line);
+        }
+      }
+      const fallback = working(prefix) ?? working(parsed.header) ?? ".";
+      const matching = blocks.filter((block) => {
+        const commands = executableLines(block);
+        if (!commands.length) {
+          return false;
+        }
+        const text = commands.join("\n");
+        if (/--workspaces|--recursive|\bpublish\s+--all\b/.test(text)) {
+          return true;
+        }
+        if (
+          text.includes(`--workspace=${packageInfo.name}`) ||
+          text.includes(`--workspace ${packageInfo.name}`)
+        ) {
+          return true;
+        }
+        const cd = /\bcd\s+['"]?([\w./-]+)/.exec(text)?.[1];
+        const scripts = scriptReferences(commands);
+        const inferred = scripts.find(
+          (script) => directory !== "." && script.startsWith(`${directory}/`),
+        )
+          ? directory
+          : undefined;
+        const cwd =
+          (working(block) ?? cd ?? inferred ?? fallback)
+            .replace(/^\.\//, "")
+            .replace(/\/$/, "") || ".";
+        return cwd === directory;
+      });
+      return matching.length
+        ? [
+            `  ${job.name}:\n${prefix.join("\n")}\n${matching.flat().join("\n")}`,
+          ]
+        : [];
+    });
+    return {
+      ...workflow,
+      contents: `${parsed.header.join("\n")}\njobs:\n${jobs.join("\n")}`,
+    };
+  });
+}
+
+/** Warn when a second npm manifest re-exports a sibling but stops tracking it. */
+export async function auditWrappers(root, packages) {
+  const npm = packages.filter((item) => item.registry === "npm");
+  for (const wrapper of npm) {
+    const data = JSON.parse(
+      (await readFile(path.join(root, wrapper.manifest), "utf8")).replace(
+        /^\uFEFF/,
+        "",
+      ),
+    );
+    for (const target of npm.filter(
+      (target) => target !== wrapper && data.dependencies?.[target.name],
+    )) {
+      if (wrapper.version !== target.version) {
+        wrapper.warnings = [
+          ...(wrapper.warnings ?? []),
+          `wrapper ${wrapper.name}@${wrapper.version} differs from ${target.name}@${target.version}; update both manifests and the wrapper dependency for every release`,
+        ];
+      }
+    }
+  }
+}

package/src/plan.mjs

@@ -6,9 +6,13 @@ import {
   npmFlow,
   pypiFlow,
 } from "./flows.mjs";
+import { credentialPolicy } from "./credential-cycle.mjs";
+import { trustedFlow, tokenFlow } from "./extra-flows.mjs";
+import { bootstrapRef } from "./bootstrap-reference.mjs";
 import { pagesSteps } from "./pages.mjs";
 import { planPrerequisites } from "./prerequisites.mjs";
 import { TRUSTED_REGISTRIES } from "./publishers.mjs";
+import { applyPython } from "./python.mjs";
 
 const FLOWS = new Map([
   ["npm", npmFlow],
@@ -16,6 +20,9 @@ const FLOWS = new Map([
   ["pypi", pypiFlow],
   ["docker-hub", dockerHubFlow],
   ["ghcr", ghcrFlow],
+  ["rubygems", trustedFlow],
+  ["nuget", trustedFlow],
+  ["jsr", trustedFlow],
 ]);
 
 /**
@@ -64,6 +71,9 @@ function buildPlan(inspection, packageInfo, options) {
     case "pypi":
     case "docker-hub":
     case "ghcr":
+    case "rubygems":
+    case "nuget":
+    case "jsr":
       return flowPlan(inspection, packageInfo, options);
     case "go-modules":
       steps = [
@@ -83,37 +93,17 @@ function buildPlan(inspection, packageInfo, options) {
         },
       ];
       break;
-    case "nuget":
-      steps = [
-        check(
-          "pack-package",
-          "Build the NuGet package",
-          "Create the package locally without pushing it.",
-          command("dotnet", ["pack", "--configuration", "Release"]),
-        ),
-        browser(
-          "configure-trusted-publishing",
-          "Configure NuGet trusted publishing",
-          "Sign in and add a GitHub Actions federated credential for this package.",
-          "https://www.nuget.org/account/TrustedPublishing",
-        ),
-      ];
-      break;
     case "maven-central":
-      steps = [
-        check(
-          "verify-build",
-          "Verify the Maven build",
-          "Run the build lifecycle without deploying an artifact.",
-          command("mvn", ["--batch-mode", "verify"]),
-        ),
-        browser(
-          "verify-namespace",
-          "Verify a Central namespace",
-          "Sign in to the Central Portal and verify the namespace used by the package coordinates.",
-          "https://central.sonatype.com/publishing/namespaces",
-        ),
-      ];
+    case "vscode-marketplace":
+    case "open-vsx":
+    case "chrome-web-store":
+      if (!packageInfo.workflow && !options.workflow) {
+        return {
+          ...basePlan(inspection, packageInfo, []),
+          skipped_reason: `no workflow publishes ${packageInfo.name} to ${packageInfo.registry}; pass --workflow <file> for an explicit setup target`,
+        };
+      }
+      steps = tokenFlow(packageInfo);
       break;
     case "packagist":
       steps = [
@@ -142,6 +132,7 @@ function basePlan(inspection, packageInfo, steps) {
   return {
     schema_version: 1,
     registry: packageInfo.registry,
+    credential_policy: credentialPolicy(packageInfo.registry),
     package: structuredClone(packageInfo),
     repository: structuredClone(inspection.repository),
     steps,
@@ -166,6 +157,27 @@ function flowPlan(inspection, packageInfo, options) {
       skipped_reason: `several workflows publish to ${packageInfo.registry} (${packageInfo.workflow_candidates.join(", ")}); pass --workflow <file> to choose the trusted publisher`,
     };
   }
+  if (
+    trusted &&
+    (!workflow ||
+      (options.addPublishJob &&
+        !packageInfo.workflow &&
+        !packageInfo.workflow_candidates?.length))
+  ) {
+    return {
+      ...basePlan(inspection, packageInfo, [
+        {
+          id: "add-publishing-workflow",
+          title: "Offer a publishing job in a reviewed pull request",
+          kind: "manual",
+          description:
+            "Add the missing publishing job to the workflow used by the other registries, on a new branch and pull request. Review and merge it, then re-run setup to attach the trusted publisher.",
+          confirm: true,
+        },
+      ]),
+      skipped_reason: `no workflow publishes ${packageInfo.name} to ${packageInfo.registry}; CI releases will not reach it; add a publishing job or pass --workflow <file> before attaching a trusted publisher`,
+    };
+  }
   const context = {
     directory: packageDirectory(packageInfo.manifest),
     slug,
@@ -182,6 +194,14 @@ function flowPlan(inspection, packageInfo, options) {
   } else if (mode === "attach") {
     steps = steps.filter((item) => !BOOTSTRAP_CONDITIONS.has(item.when));
   }
+  if (options.ref) {
+    const ref = bootstrapRef(options.ref);
+    const fetch = steps.find((step) => step.id === "fetch-default-branch");
+    if (fetch) {
+      fetch.command.args = ["fetch", "origin", ref];
+      fetch.title = `Fetch bootstrap ref ${ref}`;
+    }
+  }
   // Pages readiness belongs to the repository, so it is checked in every mode.
   const pages = inspection.repository.pages_workflow;
   if (slug && pages) {
@@ -213,6 +233,7 @@ function flowPlan(inspection, packageInfo, options) {
       plan.trusted_publisher.project = packageInfo.name;
     }
   }
+  applyPython(plan, options.environment?.python);
   return plan;
 }
 

package/src/prerequisites.mjs

@@ -1,6 +1,7 @@
 import { exec } from "command-stream";
 
 import { automatedDescription } from "./browser-options.mjs";
+import { probePython } from "./python.mjs";
 import { getJson, registryEndpoint } from "./registry-state.mjs";
 
 /** The Node.js versions npm 11 runs on. */
@@ -154,6 +155,7 @@ export async function probeEnvironment(options = {}) {
       : null;
   return {
     offline,
+    python: options.python ? await probePython({ verbose }) : undefined,
     node: nodeVersion,
     npm: npmVersion?.code === 0 ? npmVersion.stdout.trim() : null,
     trustNpm: spec,

package/src/publishers.mjs

@@ -1,10 +1,29 @@
 import { readFile, realpath, stat } from "node:fs/promises";
 import path from "node:path";
+import { stripComments, commandPosition } from "./source-code.mjs";
 
 /** Registries whose trusted publisher is bound to a workflow file. */
-export const TRUSTED_REGISTRIES = Object.freeze(["npm", "crates-io", "pypi"]);
+export const TRUSTED_REGISTRIES = Object.freeze([
+  "npm",
+  "crates-io",
+  "pypi",
+  "rubygems",
+  "nuget",
+  "jsr",
+]);
 
-const JOB_PATTERNS = new Map([
+export const JOB_PATTERNS = new Map([
+  ["rubygems", /\bgem\s+push\b|rubygems\/release-gem/],
+  ["nuget", /\bdotnet\s+nuget\s+push\b|\bnuget\s+push\b/],
+  ["jsr", /\bdeno\s+publish\b|\bjsr\s+publish\b/],
+  ["docker-hub", /docker\/login-action|\bdocker\s+(?:login|push)\b/],
+  ["maven-central", /\bmvn\s+(?:-\S+\s+)*deploy\b|\bgradle(?:w)?\s+publish\b/],
+  ["vscode-marketplace", /\bvsce\s+publish\b/],
+  ["open-vsx", /\bovsx\s+publish\b/],
+  [
+    "chrome-web-store",
+    /chrome-webstore-upload|chrome-web-store|chromewebstore/,
+  ],
   [
     "npm",
     /\b(?:npm|pnpm)\s+(?:-r\s+|--recursive\s+)?(?:stage\s+)?publish\b|\byarn\s+npm\s+publish\b|\bchangeset\s+publish\b|changesets\/action\/publish@|JS-DevTools\/npm-publish/,
@@ -15,7 +34,7 @@ const JOB_PATTERNS = new Map([
   ],
   [
     "pypi",
-    /pypa\/gh-action-pypi-publish|\btwine\s+upload\b|\b(?:uv|poetry|hatch|flit|pdm)\s+publish\b/,
+    /pypa\/gh-action-pypi-publish|\b(?:python(?:3(?:\.\d+)?)?\s+-m\s+)?twine\s+upload\b|\b(?:uv|poetry|hatch|flit|pdm)\s+publish\b/,
   ],
 ]);
 
@@ -24,6 +43,12 @@ const JOB_PATTERNS = new Map([
 // `.arg("publish")` within the next few lines.
 const SCRIPT_WINDOW = 3;
 const SCRIPT_PATTERNS = new Map([
+  ["rubygems", [/\bgem\b/, /["'`]push["'`]/]],
+  ["nuget", [/\b(?:dotnet|nuget)\b/, /["'`]push["'`]/]],
+  ["jsr", [/\b(?:deno|jsr)\b/, /["'`]publish["'`]/]],
+  ["maven-central", [/\b(?:mvn|gradle)\b/, /["'`]deploy["'`]/]],
+  ["vscode-marketplace", [/\bvsce\b/, /["'`]publish["'`]/]],
+  ["open-vsx", [/\bovsx\b/, /["'`]publish["'`]/]],
   ["npm", [/\b(?:npm|pnpm|yarn)\b/, /["'`]publish["'`]/]],
   ["crates-io", [/\bcargo\b/, /["'`]publish["'`]/]],
   [
@@ -33,6 +58,27 @@ const SCRIPT_PATTERNS = new Map([
 ]);
 
 const TOKEN_SECRETS = new Map([
+  ["rubygems", ["GEM_HOST_API_KEY", "RUBYGEMS_API_KEY"]],
+  ["nuget", ["NUGET_API_KEY", "NUGET_TOKEN"]],
+  ["jsr", ["JSR_TOKEN"]],
+  ["docker-hub", ["DOCKERHUB_TOKEN", "DOCKER_HUB_TOKEN", "DOCKER_PASSWORD"]],
+  [
+    "maven-central",
+    [
+      "MAVEN_CENTRAL_TOKEN",
+      "MAVEN_CENTRAL_PASSWORD",
+      "OSSRH_TOKEN",
+      "OSSRH_PASSWORD",
+      "SONATYPE_TOKEN",
+      "CENTRAL_TOKEN",
+    ],
+  ],
+  ["vscode-marketplace", ["VSCE_PAT", "VSCE_TOKEN"]],
+  ["open-vsx", ["OVSX_PAT", "OVSX_TOKEN"]],
+  [
+    "chrome-web-store",
+    ["CHROME_WEB_STORE_REFRESH_TOKEN", "CHROME_REFRESH_TOKEN"],
+  ],
   ["npm", ["NPM_TOKEN", "NPM_AUTH_TOKEN"]],
   [
     "crates-io",
@@ -61,9 +107,6 @@ const RUN_SCRIPT =
 const CHANGESETS_PUBLISH = /^\s*publish(?:-script)?\s*:\s*(.+?)\s*$/;
 const LOCAL_WORKFLOW =
   /^\s*uses\s*:\s*["']?\.\/\.github\/workflows\/([\w.-]+\.ya?ml)/;
-const SCRIPT_COMMENT = /^\s*(?:#|\/\/|\/?\*)/;
-const COMMAND_PREFIX =
-  /^\s*(?:(?:npx|bunx|exec|sudo|env|time|command|pnpm\s+exec|yarn|\w+=\S*)\s+)*$/;
 const MAX_SCRIPT_BYTES = 1024 * 1024;
 
 /**
@@ -71,7 +114,7 @@ const MAX_SCRIPT_BYTES = 1024 * 1024;
  * parser is bundled. Full-line comments are dropped.
  */
 export function parseWorkflow(contents) {
-  const lines = contents.split(/\r?\n/).filter((line) => !/^\s*#/.test(line));
+  const lines = stripComments(contents).split(/\r?\n/);
   const start = lines.findIndex((line) => /^jobs\s*:\s*$/.test(line));
   if (start === -1) {
     return { header: lines, jobs: [] };
@@ -145,7 +188,9 @@ export async function detectPublisher(root, workflows, registry) {
       });
     }
   }
-  const trusted = found.filter((item) => item.idToken);
+  const trusted = found.filter(
+    (item) => !TRUSTED_REGISTRIES.includes(registry) || item.idToken,
+  );
   const files = [...new Set(trusted.map((item) => item.workflow))];
   if (files.length > 1) {
     return {
@@ -215,7 +260,7 @@ export function tokenSecrets(workflows, registry) {
   const names = TOKEN_SECRETS.get(registry) ?? [];
   const found = [];
   for (const workflow of workflows) {
-    const lines = workflow.contents
+    const lines = stripComments(workflow.contents)
       .split(/\r?\n/)
       .filter((line) => !/^\s*#/.test(line));
     for (const name of names) {
@@ -231,7 +276,9 @@ export function tokenSecrets(workflows, registry) {
 
 /** Explains how to replace a long-lived token secret with trusted publishing. */
 export function tokenSecretWarning(registry, { workflow, secret }) {
-  return `${workflow} reads secrets.${secret}; publish with ${TRUSTED_PUBLISHING_HINTS.get(registry)} and delete the long-lived token`;
+  return TRUSTED_REGISTRIES.includes(registry)
+    ? `${workflow} reads secrets.${secret}; publish with ${TRUSTED_PUBLISHING_HINTS.get(registry) ?? `${registry} trusted publishing (id-token: write)`} and delete the long-lived token after verification`
+    : `${workflow} reads secrets.${secret}; ensure a scoped expiring publishing token through gh-manager`;
 }
 
 /** Names of the long-lived token secrets that trusted publishing replaces. */
@@ -250,14 +297,15 @@ async function anyJobPublishes(root, parsed, registry) {
 
 async function jobPublishes(root, parsed, job, registry) {
   const pattern = JOB_PATTERNS.get(registry);
-  if (publishingLine(job.lines, pattern)) {
+  const executable = executableLines(job.lines);
+  if (publishingLine(executable, pattern)) {
     return true;
   }
   const directories = workingDirectories([...parsed.header, ...job.lines]);
   const scripts = [];
-  for (const script of scriptReferences(job.lines)) {
+  for (const script of scriptReferences(executable)) {
     const contents = await readInside(root, directories, script);
-    const lines = contents === null ? [] : codeLines(contents);
+    const lines = contents === null ? [] : codeLines(contents, script);
     if (scriptPublishes(lines, registry)) {
       return true;
     }
@@ -274,8 +322,11 @@ async function jobPublishes(root, parsed, job, registry) {
   }
   // A package script may run from the job, its changesets command, or a
   // script, as in `$\`npm run changeset:publish\``.
-  for (const line of [...job.lines, ...commands, ...scripts]) {
+  for (const line of [...executable, ...commands, ...scripts]) {
     for (const match of line.matchAll(RUN_SCRIPT)) {
+      if (!commandPosition(line.slice(0, match.index))) {
+        continue;
+      }
       const manifest = await readInside(root, directories, "package.json");
       const command =
         manifest === null
@@ -312,17 +363,52 @@ function onlyCalled(header) {
 }
 
 function publishingLine(lines, pattern) {
+  if (!pattern) {
+    return false;
+  }
+  const matcher = new RegExp(pattern.source, "g");
   return lines.some(
-    (line) => pattern.test(line) && !line.includes("--dry-run"),
+    (line) =>
+      !line.includes("--dry-run") &&
+      [...line.matchAll(matcher)].some(
+        (match) =>
+          commandPosition(line.slice(0, match.index)) ||
+          /^\s*-?\s*uses\s*:\s*['"]?[\w./-]*$/.test(line.slice(0, match.index)),
+      ),
   );
 }
 
-function codeLines(contents) {
-  return contents
+/** Extract executable run blocks and action references; names and env values are inert. */
+export function executableLines(lines) {
+  const result = [];
+  let blockIndent = null;
+  for (const line of lines) {
+    const indent = indentOf(line);
+    if (blockIndent !== null && (line.trim() === "" || indent > blockIndent)) {
+      result.push(line);
+      continue;
+    }
+    blockIndent = null;
+    if (/^\s*-?\s*uses\s*:/.test(line)) {
+      result.push(line);
+    }
+    const match = /^\s*-?\s*run\s*:\s*(.*)$/.exec(line);
+    if (!match) {
+      continue;
+    }
+    if (/^[|>][-+\d]*$/.test(match[1])) {
+      blockIndent = indent + (line.trimStart().startsWith("-") ? 2 : 0);
+    } else {
+      result.push(unquote(match[1]));
+    }
+  }
+  return result;
+}
+
+function codeLines(contents, script) {
+  return stripComments(contents, script)
     .split(/\r?\n/)
-    .filter(
-      (line) => !line.includes("--dry-run") && !SCRIPT_COMMENT.test(line),
-    );
+    .filter((line) => !line.includes("--dry-run"));
 }
 
 function scriptPublishes(lines, registry) {
@@ -336,23 +422,23 @@ function scriptPublishes(lines, registry) {
   ) {
     return true;
   }
-  const [program, subcommand] = SCRIPT_PATTERNS.get(registry);
+  const patterns = SCRIPT_PATTERNS.get(registry);
+  if (!patterns) {
+    return false;
+  }
+  const [program, subcommand] = patterns;
   return lines.some(
     (line, index) =>
       program.test(line) &&
+      /(?:exec|spawn|run|Command::new|subprocess|system|(?:npm|pnpm|yarn)\s*\(\s*\[)/.test(
+        line,
+      ) &&
       lines
         .slice(index, index + SCRIPT_WINDOW)
         .some((nearby) => subcommand.test(nearby)),
   );
 }
 
-// A script mentions `cargo publish` in messages and comments too; it runs it
-// only where the command starts a line, a shell command or a string literal.
-function commandPosition(prefix) {
-  const segment = prefix.split(/["'`;&|(]/).at(-1);
-  return COMMAND_PREFIX.test(segment);
-}
-
 function packageScript(contents, name) {
   try {
     const command = JSON.parse(contents).scripts?.[name];