package-registry-manager 0.22.4 → 0.22.6

package/src/python.mjs

@@ -0,0 +1,149 @@
+import { readdir } from "node:fs/promises";
+import path from "node:path";
+import { exec } from "command-stream";
+
+// requires-python describes interpreter releases. Reject unsupported or
+// prerelease syntax rather than silently choosing an incompatible executable.
+function release(value) {
+  return /^\d+(?:\.\d+){0,2}$/.test(value)
+    ? value.split(".").map(Number)
+    : null;
+}
+
+function compare(left, right) {
+  for (let i = 0; i < 3; i += 1) {
+    const difference = (left[i] ?? 0) - (right[i] ?? 0);
+    if (difference) {
+      return Math.sign(difference);
+    }
+  }
+  return 0;
+}
+
+/** Tests stable interpreter versions against requires-python specifiers. */
+export function pythonMatches(version, requirement = "") {
+  const actual = release(version);
+  if (!actual) {
+    return false;
+  }
+  if (!requirement.trim()) {
+    return true;
+  }
+  return requirement.split(",").every((clause) => {
+    const match =
+      /^\s*(~=|==|!=|<=|>=|<|>)\s*(\d+(?:\.\d+){0,2})(\.\*)?\s*$/.exec(clause);
+    if (!match) {
+      return false;
+    }
+    const [, operator, text, wildcard] = match;
+    const expected = release(text);
+    if (wildcard) {
+      const equal = expected.every((part, i) => actual[i] === part);
+      return operator === "==" ? equal : operator === "!=" && !equal;
+    }
+    const order = compare(actual, expected);
+    switch (operator) {
+      case "==":
+        return order === 0;
+      case "!=":
+        return order !== 0;
+      case ">=":
+        return order >= 0;
+      case "<=":
+        return order <= 0;
+      case ">":
+        return order > 0;
+      case "<":
+        return order < 0;
+      case "~=": {
+        if (expected.length < 2) {
+          return false;
+        }
+        const upper = expected.slice(0, -1);
+        upper[upper.length - 1] += 1;
+        return order >= 0 && compare(actual, upper) < 0;
+      }
+      default:
+        return false;
+    }
+  });
+}
+
+/** Selects the first installed compatible interpreter, preferring PATH defaults. */
+export function choosePython(tools, requirement) {
+  return tools.find((tool) => pythonMatches(tool.version, requirement)) ?? null;
+}
+
+async function candidatePrograms() {
+  const candidates = new Set(["python", "python3"]);
+  for (const directory of (process.env.PATH ?? "").split(path.delimiter)) {
+    if (!directory) {
+      continue;
+    }
+    const entries = await readdir(directory).catch(() => []);
+    for (const entry of entries.sort()) {
+      if (/^python3\.\d+(?:\.exe)?$/.test(entry)) {
+        candidates.add(entry);
+      }
+    }
+  }
+  return [...candidates].slice(0, 32);
+}
+
+/** Probes only interpreter versions, without loading manifests or package code. */
+export async function probePython(options = {}) {
+  const candidates = options.candidates ?? (await candidatePrograms());
+  const probe =
+    options.probe ??
+    (async (program, args) => {
+      if (options.verbose) {
+        console.error(`+ ${program} ${args.join(" ")}`);
+      }
+      return exec(program, args, {
+        capture: true,
+        mirror: false,
+        stdin: "ignore",
+      });
+    });
+  const tools = [];
+  for (const program of candidates) {
+    try {
+      const result = await probe(program, ["--version"]);
+      const version = /^Python (\d+\.\d+\.\d+)\s*$/.exec(
+        String(result.stdout ?? "").trim(),
+      )?.[1];
+      if (result.code === 0 && version) {
+        tools.push({ program, version });
+      }
+    } catch {
+      // An unavailable candidate is not an installed interpreter.
+    }
+  }
+  return tools;
+}
+
+/** Adds a Python prerequisite and selects the executable used by the build step. */
+export function applyPython(plan, tools) {
+  const build = plan.steps.find((step) => step.id === "build-package");
+  if (plan.registry !== "pypi" || !build || !tools) {
+    return;
+  }
+  const requirement = plan.package.requires_python ?? "";
+  const selected = choosePython(tools, requirement);
+  const item = {
+    id: "python",
+    title: "Python",
+    detected: selected
+      ? `${selected.program} (${selected.version})`
+      : "no compatible interpreter found",
+    required: `Install Python satisfying ${requirement || "the project requirements"} and its build module (python -m pip install build)`,
+    ok: Boolean(selected),
+  };
+  plan.prerequisites = [
+    ...(plan.prerequisites ?? []).filter((entry) => entry.id !== "python"),
+    item,
+  ];
+  if (selected) {
+    build.command = { program: selected.program, args: ["-m", "build"] };
+  }
+}

package/src/setup-batch.mjs

@@ -0,0 +1,174 @@
+import { rm } from "node:fs/promises";
+import { protectLegacyProfile } from "./profile.mjs";
+import { SetupSession, prompt } from "./setup.mjs";
+import { offerWorkflow } from "./workflow-proposal.mjs";
+import { signInDomains } from "./sign-in-import.mjs";
+import { oidcReleaseNote } from "./approvals.mjs";
+
+/** Validates a plan before running any registry or repository mutations. */
+export function validatePlan(plan, execute = true) {
+  if (!plan.package.publishable) {
+    throw new Error(
+      `${plan.package.name} is not publishable: ${(plan.package.problems ?? []).join("; ")}`,
+    );
+  }
+  if (
+    execute &&
+    plan.skipped_reason &&
+    !plan.steps.some((step) => step.id === "add-publishing-workflow")
+  ) {
+    throw new Error(plan.skipped_reason);
+  }
+  const python = plan.prerequisites?.find(
+    (item) => item.id === "python" && item.ok === false,
+  );
+  if (execute && python) {
+    throw new Error(`${python.detected}; ${python.required}`);
+  }
+}
+
+/** Runs one package, using the same executor as setup --all. */
+export async function executePlan(plan, options) {
+  return executePlans([plan], options, false);
+}
+
+/** Runs all plans with one browser session and defers sign-out until the end. */
+export async function executePlans(plans, options, summary = true) {
+  if (plans.length === 0) {
+    throw new Error("no publishable package manifests were found");
+  }
+  for (const plan of plans) {
+    validatePlan(plan, options.execute);
+  }
+  for (const plan of plans) {
+    if (plan.mode === "complete") {
+      console.log(
+        `${plan.package.name} already publishes through trusted publishing; ${plan.steps.length ? "only the repository checks remain." : "nothing to do."}`,
+      );
+    }
+  }
+  if (
+    plans.every((plan) => plan.mode === "complete" && plan.steps.length === 0)
+  ) {
+    const outcomes = plans.map((plan) => ({
+      registry: plan.registry,
+      package: plan.package.name,
+      status: "complete",
+    }));
+    printSummary(outcomes, summary);
+    return outcomes;
+  }
+  if (!options.execute) {
+    console.log(
+      "Dry run only. Re-run with --execute to run these steps and open the registry.",
+    );
+    return [];
+  }
+  const missing = plans.filter((plan) =>
+    plan.steps.some((step) => step.id === "add-publishing-workflow"),
+  );
+  if (missing.length) {
+    const result = await offerWorkflow(missing, {
+      ...options,
+      prompt: options.prompt ?? prompt,
+    });
+    const outcomes = plans.map((plan) => ({
+      registry: plan.registry,
+      package: plan.package.name,
+      status: missing.includes(plan) ? result.status : "blocked",
+      ...(result.url ? { url: result.url } : {}),
+    }));
+    printSummary(outcomes, summary);
+    return outcomes;
+  }
+  if (options.browserProfile) {
+    await protectLegacyProfile(
+      options.repository,
+      options.browserProfile,
+      options,
+    );
+  }
+  const domains = [
+    ...new Set(plans.flatMap((plan) => signInDomains(plan.registry))),
+  ];
+  let automation = options.automation ?? null;
+  const deferred = new Map();
+  const outcomes = [];
+  let failure;
+  try {
+    for (const plan of plans) {
+      const session = new SetupSession(plan, {
+        ...options,
+        automation,
+        domains,
+      });
+      try {
+        await session.run();
+        outcomes.push({
+          registry: plan.registry,
+          package: plan.package.name,
+          status: plan.steps.length === 0 ? "complete" : "configured",
+        });
+        if (plan.trusted_publisher?.workflow) {
+          console.log(`\n${oidcReleaseNote(plan.trusted_publisher.workflow)}`);
+        }
+      } catch (error) {
+        outcomes.push({
+          registry: plan.registry,
+          package: plan.package.name,
+          status: "failed",
+        });
+        failure = error;
+      } finally {
+        const steps = await session.cleanup({
+          deferAuth: plans.length > 1,
+          closeBrowser: false,
+        });
+        automation = session.automation;
+        for (const step of steps) {
+          deferred.set(`${plan.registry}:${step.id}`, { session, step });
+        }
+      }
+      if (failure) {
+        break;
+      }
+    }
+  } finally {
+    for (const { session, step } of deferred.values()) {
+      session.automation = automation;
+      try {
+        await session.runStep(step);
+      } catch (error) {
+        console.error(`warning: ${step.id} failed: ${error.message}`);
+      } finally {
+        if (session.shim?.directory) {
+          await rm(session.shim.directory, { recursive: true, force: true });
+        }
+      }
+    }
+    await automation?.close();
+    for (const plan of plans.slice(outcomes.length)) {
+      outcomes.push({
+        registry: plan.registry,
+        package: plan.package.name,
+        status: "not-run",
+      });
+    }
+    printSummary(outcomes, summary);
+  }
+  if (failure) {
+    throw failure;
+  }
+  return outcomes;
+}
+
+function printSummary(outcomes, enabled) {
+  if (enabled) {
+    console.log("\nSetup summary:");
+    for (const item of outcomes) {
+      console.log(
+        `- ${item.registry}: ${item.package}: ${item.status}${item.url ? ` (${item.url})` : ""}`,
+      );
+    }
+  }
+}

package/src/setup.mjs

@@ -15,7 +15,6 @@ import {
 import {
   approvalDeadline,
   TWO_FACTOR_HINT,
-  oidcReleaseNote,
   withFreshLinks,
 } from "./approvals.mjs";
 import { connectAutomation } from "./automation.mjs";
@@ -27,10 +26,11 @@ import {
 } from "./browser.mjs";
 import { detectDefaultBrowser, openWithCommand } from "./default-browser.mjs";
 import { CLEANUP_CONDITIONS } from "./flows.mjs";
+import { setupCredential } from "./credential-setup.mjs";
+import { checkNamePolicy, policyRefusal } from "./npm-policy.mjs";
 import { pagesSettingsUrl, pagesState } from "./pages.mjs";
 import { packageDirectory } from "./plan.mjs";
 import { twoFactorMode } from "./prerequisites.mjs";
-import { protectLegacyProfile } from "./profile.mjs";
 import { getJson, probePackage } from "./registry-state.mjs";
 import { launchBrowser, signInDomains } from "./sign-in-import.mjs";
 import { reportTokenSecrets, verifyTokenRevoked } from "./tokens.mjs";
@@ -54,54 +54,9 @@ const PUBLISH_REJECTED = /\bE404\b|404 Not Found|invalid-publisher/i;
 /** Where `--browser` opens URLs that need no automation. */
 export const BROWSER_MODES = ["default", "automated"];
 
-/**
- * Runs a setup plan. Without `options.execute` it only reports a dry run.
- * Steps whose `when` condition does not hold are skipped, so a re-run after a
- * partial success resumes where the previous run stopped.
- */
-export async function executePlan(plan, options) {
-  if (!plan.package.publishable) {
-    throw new Error(
-      `${plan.package.name} is not publishable: ${(plan.package.problems ?? []).join("; ")}`,
-    );
-  }
-  if (plan.mode === "complete") {
-    const remaining =
-      plan.steps.length === 0
-        ? "nothing to do."
-        : "only the repository checks remain.";
-    console.log(
-      `${plan.package.name} already publishes through trusted publishing; ${remaining}`,
-    );
-    if (plan.steps.length === 0) {
-      return;
-    }
-  }
-  if (!options.execute) {
-    console.log(
-      "Dry run only. Re-run with --execute to run these steps and open the registry.",
-    );
-    return;
-  }
-  if (options.browserProfile) {
-    await protectLegacyProfile(
-      options.repository,
-      options.browserProfile,
-      options,
-    );
-  }
-  const session = new SetupSession(plan, options);
-  try {
-    await session.run();
-  } finally {
-    await session.cleanup();
-  }
-  if (plan.trusted_publisher?.workflow) {
-    console.log(`\n${oidcReleaseNote(plan.trusted_publisher.workflow)}`);
-  }
-}
+export { executePlan, executePlans } from "./setup-batch.mjs";
 
-class SetupSession {
+export class SetupSession {
   constructor(plan, options) {
     this.plan = plan;
     this.options = options;
@@ -135,9 +90,22 @@ class SetupSession {
    * Runs every cleanup step of the plan whose condition holds, including
    * those after a step that failed (#24).
    */
-  async cleanup() {
+  async cleanup({ deferAuth = false, closeBrowser = true } = {}) {
+    const deferred = [];
     for (const step of cleanupSteps(this.plan)) {
-      if (step.id === "sign-out" && this.keepsSession(step)) {
+      if (
+        deferAuth &&
+        ["sign-out", "crates-sign-out"].includes(step.id) &&
+        this.conditions.has(step.when)
+      ) {
+        if (step.id === "sign-out" && this.options.keepSession) {
+          console.log(
+            "Keeping the npm session (--keep-session); run npm logout to revoke it.",
+          );
+        } else {
+          deferred.push(step);
+        }
+      } else if (step.id === "sign-out" && this.keepsSession(step)) {
         console.log(
           "Keeping the npm session (--keep-session): its token stays in npm's user configuration until you run npm logout, and the next run reuses it while npm whoami succeeds.",
         );
@@ -148,13 +116,17 @@ class SetupSession {
         );
       } else if (this.conditions.has(step.when)) {
         this.log(`==> ${step.title}`);
-        const result = await this.runProcess(step, true);
-        if (result.code !== 0) {
-          console.error(`warning: ${step.id} exited with ${result.code}`);
+        try {
+          const result = await this.runProcess(step, true);
+          if (result.code !== 0) {
+            console.error(`warning: ${step.id} exited with ${result.code}`);
+          }
+        } catch (error) {
+          console.error(`warning: ${step.id} failed: ${error.message}`);
         }
       }
     }
-    if (this.automation) {
+    if (this.automation && closeBrowser) {
       await this.automation.close();
     }
     for (const directory of [this.temporary, this.shim?.directory]) {
@@ -162,6 +134,9 @@ class SetupSession {
         await rm(directory, { recursive: true, force: true });
       }
     }
+    this.shim = null;
+    this.temporary = null;
+    return deferred;
   }
 
   keepsSession(step) {
@@ -175,6 +150,9 @@ class SetupSession {
   async runStep(step) {
     switch (step.kind) {
       case "check":
+        if (step.id === "check-name-policy") {
+          return checkNamePolicy(this.plan.package.name, this.options);
+        }
         if (step.id === "check-registry") {
           return this.checkRegistry();
         }
@@ -194,9 +172,25 @@ class SetupSession {
       case "browser":
         return this.browser(step);
       case "api":
-        return runCratesApiStep(this, step);
+        return step.id === "manage-registry-token"
+          ? setupCredential(this)
+          : runCratesApiStep(this, step);
       default:
         console.log(step.description);
+        if (step.id === "confirm-oidc-cleanup") {
+          if (this.conditions.has("oidc-release-verified")) {
+            return;
+          }
+          const answer = await this.prompt(
+            "Has a new release succeeded through OIDC without a stored registry token? [y/N] ",
+          );
+          if (!/^(?:y|yes)$/i.test(answer)) {
+            throw new Error(
+              "a verified OIDC release is required before deleting token secrets",
+            );
+          }
+          return;
+        }
         if (step.url) {
           console.log(`  ${step.url}`);
         }
@@ -475,6 +469,14 @@ class SetupSession {
         ? await this.capture(step)
         : await this.runProcess(step, true);
     if (result.code !== 0) {
+      if (
+        step.id === "first-publish" &&
+        policyRefusal(String(result.stderr) + String(result.stdout))
+      ) {
+        throw new Error(
+          "npm refused this name under its policy; no retry. Choose @owner/name or a longer descriptive name.",
+        );
+      }
       if (step.id === "attach-trusted-publisher") {
         console.error(
           "warning: npm trust failed; falling back to the browser form",
@@ -527,6 +529,15 @@ class SetupSession {
 
   recordPack(output) {
     const packed = packedEntry(output);
+    if (
+      packed.name !== this.plan.package.name ||
+      (this.plan.package.version &&
+        packed.version !== this.plan.package.version)
+    ) {
+      throw new Error(
+        "bootstrap ref package identity/version differs from inspection; inspect the selected ref again before publication",
+      );
+    }
     for (const file of packed.files ?? []) {
       console.log(`  ${String(file.size).padStart(8)}  ${file.path}`);
     }
@@ -551,6 +562,9 @@ class SetupSession {
         (step.id !== "confirm-provenance" ||
           isTrustedRelease(document, this.values))
       ) {
+        if (step.id === "confirm-provenance") {
+          this.conditions.add("oidc-release-verified");
+        }
         console.log(`  ${url} is ready`);
         return;
       }
@@ -641,16 +655,16 @@ class SetupSession {
    * The automated page, launched once. The crates.io sign-in step offers
    * `--browser-import default|auto` itself, once it knows a sign-in is missing.
    */
-  async automatedPage(browser = this.options.browserOptions) {
+  async automatedPage(browser = this.options.browserOptions, quiet = false) {
     if (!this.automation) {
-      const domains = signInDomains(this.plan.registry);
+      const domains = this.options.domains ?? signInDomains(this.plan.registry);
       this.automation = await connectAutomation({
         browser: await launchBrowser(browser, domains, {
           deferred: this.plan.registry === "crates-io",
-          verbose: this.options.verbose,
+          verbose: quiet ? false : this.options.verbose,
         }),
         profile: this.options.browserProfile,
-        verbose: this.options.verbose,
+        verbose: quiet ? false : this.options.verbose,
         domains,
       });
     }
@@ -872,7 +886,7 @@ function render(command) {
 }
 
 /** Asks a question on the terminal; a closed stdin answers with "". */
-async function prompt(message) {
+export async function prompt(message) {
   const terminal = createInterface({ input: stdin, output: stdout });
   try {
     return await new Promise((resolve) => {

package/src/sign-in-import.mjs

@@ -15,6 +15,14 @@ export const IMPORT_SCOPES = ["domains", "full"];
 
 /** The domains whose cookies hold each registry's sign-in. */
 export const SIGN_IN_DOMAINS = {
+  "docker-hub": ["docker.com", "docker.io"],
+  "maven-central": ["sonatype.com"],
+  "vscode-marketplace": ["dev.azure.com", "login.microsoftonline.com"],
+  "open-vsx": ["open-vsx.org", "github.com"],
+  "chrome-web-store": ["google.com"],
+  rubygems: ["rubygems.org", "github.com"],
+  nuget: ["nuget.org", "login.microsoftonline.com"],
+  jsr: ["jsr.io", "github.com"],
   "crates-io": ["crates.io", "github.com"],
   npm: ["npmjs.com"],
   pypi: ["pypi.org", "github.com"],

package/src/skips.mjs

@@ -12,6 +12,9 @@ export const TEST_DIRECTORIES = Object.freeze([
   "__fixtures__",
   "__tests__",
   "examples",
+  "docs",
+  "experiments",
+  "case-studies",
 ]);
 
 /**

package/src/source-code.mjs

@@ -0,0 +1,61 @@
+/** Removes comments without interpreting comment markers inside quoted strings. */
+export function stripComments(contents, language = "shell") {
+  const cStyle = /\.(?:[cm]?[jt]s|[cm]ts|rs)$/.test(language);
+  let quote = null;
+  let block = false;
+  let line = false;
+  let escaped = false;
+  let result = "";
+  for (let index = 0; index < contents.length; index += 1) {
+    const character = contents[index];
+    const next = contents[index + 1];
+    if (character === "\n" && line) {
+      line = false;
+    }
+    if (line || block) {
+      if (block && character === "*" && next === "/") {
+        block = false;
+        result += "  ";
+        index += 1;
+      } else {
+        result += character === "\n" ? "\n" : " ";
+      }
+    } else if (quote) {
+      result += character;
+      if (!escaped && character === quote) {
+        quote = null;
+      }
+      escaped = !escaped && character === "\\";
+    } else if (["'", '"', "`"].includes(character)) {
+      quote = character;
+      result += character;
+    } else if (
+      (cStyle && character === "/" && next === "/") ||
+      (!cStyle && character === "#")
+    ) {
+      line = true;
+      result += " ";
+    } else if (cStyle && character === "/" && next === "*") {
+      block = true;
+      result += "  ";
+      index += 1;
+    } else {
+      result += character;
+    }
+  }
+  return result;
+}
+
+/** Whether a prefix places a publishing command in an executed command. */
+export function commandPosition(prefix) {
+  const segment = prefix.split(/[;&|]/).at(-1).trimStart();
+  return (
+    /^(?:(?:npx|bunx|exec|sudo|env|time|command|pnpm\s+exec|yarn|\w+=\S*)\s+)*$/.test(
+      segment,
+    ) ||
+    /(?:\$|shell)\s*`\s*$/.test(segment) ||
+    /(?:exec(?:Sync)?|spawn(?:Sync)?|run(?:_command)?|system|check_call|check_output|Popen)\s*\(\s*["'`]\s*$/.test(
+      segment,
+    )
+  );
+}

package/src/tokens.mjs

@@ -29,6 +29,14 @@ export function tokenSecretSteps(packageInfo, slug) {
       },
       cwd: ".",
     },
+    {
+      id: "confirm-oidc-cleanup",
+      title: "Confirm a successful OIDC release before deleting secrets",
+      kind: "manual",
+      description:
+        "Verify that a new release succeeded through OIDC without a stored registry token. Confirm registry acceptance and remove token references from every workflow before deleting unused secrets.",
+      when: "token-secret-present",
+    },
     {
       id: "delete-token-secret",
       title: "Delete the leftover token secrets",