package-registry-manager 0.22.6 → 0.22.8

package/src/credential-setup.mjs

@@ -1,8 +1,14 @@
-import { spawn } from "node:child_process";
-import { readFile } from "node:fs/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { verifyCredentialWorkflow } from "./credential-verification.mjs";
-import { needsRotation, rotateCredential } from "./credential-cycle.mjs";
+import { githubServices } from "./github.mjs";
+import {
+  cycleCredential,
+  secretName,
+  trackedTokenIds,
+  recordTokenId,
+  completeRotation,
+} from "./ci-credential-cycle.mjs";
+import { AUTH_FAILURE_PATTERNS } from "./publishing-policy.mjs";
 import {
   TOKEN_PROVIDERS,
   tokenFormScript,
@@ -10,42 +16,7 @@ import {
   revokedScript,
 } from "./credential-browser.mjs";
 
-/** Exact argv and stdin transport. Suppress all output from secret mutations. */
-export function secretCommand(args, input, cwd) {
-  return new Promise((resolve, reject) => {
-    const child = spawn("gh-manager", args, {
-      cwd,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
-    let output = "";
-    child.stdout.on("data", (chunk) => {
-      if (input === undefined) {
-        output += chunk;
-      }
-    });
-    child.stderr.on("data", () => {});
-    child.on("error", () =>
-      reject(
-        new Error(
-          "gh-manager with secret get-metadata/ensure support is required (gh-manager#6)",
-        ),
-      ),
-    );
-    child.stdin.on("error", () => {});
-    child.on("close", (code) =>
-      code === 0
-        ? resolve(output)
-        : reject(
-            new Error(
-              "gh-manager secret operation failed; verify installation, permissions and secret support (gh-manager#6)",
-            ),
-          ),
-    );
-    child.stdin.end(input ?? "");
-  });
-}
-
-/** Execute the token lifecycle without putting values in argv, diagnostics or files. */
+/** Provision only when GitHub CI reports a missing or broken credential. */
 export async function setupCredential(session) {
   const { plan, options } = session;
   const provider = TOKEN_PROVIDERS[plan.registry];
@@ -62,149 +33,226 @@ export async function setupCredential(session) {
     throw error;
   });
   const settings = JSON.parse(contents).tokens?.[plan.registry] ?? {};
-  if (!/^[\w.-]+\.ya?ml$/.test(settings.verification_workflow ?? "")) {
-    throw new Error(
-      "configure tokens.<registry>.verification_workflow for a reviewed dry-run login workflow before creating credentials",
-    );
-  }
   const { github_owner: owner, github_repository: repository } =
     plan.repository;
   if (!owner || !repository) {
     throw new Error("token setup requires GitHub repository coordinates");
   }
-  const secret =
-    settings.secret ?? plan.package.token_secrets?.[0] ?? provider.secret;
-  if (!/^[A-Z][A-Z0-9_]*$/.test(secret)) {
-    throw new Error("invalid registry secret name");
-  }
+  const slug = `${owner}/${repository}`;
+  const secret = secretName(
+    options.secretName ??
+      settings.secret ??
+      plan.package.token_secrets?.[0] ??
+      provider.secret,
+    plan.registry,
+    slug,
+  );
   if (settings.level && !["repo", "org"].includes(settings.level)) {
     throw new Error("token secret level must be repo or org");
   }
-  const scope =
-    settings.level === "repo"
-      ? ["--repo", `${owner}/${repository}`]
-      : ["--org", owner];
-  const visibility =
+  const github = options.github ?? githubServices(options);
+  const scope = { repo: slug };
+  const healthOptions = {
+    scope,
+    failurePatterns: AUTH_FAILURE_PATTERNS[plan.registry] ?? [],
+    inputs: settings.verification_workflow
+      ? { prm_nonce: `prm-${Date.now()}` }
+      : {},
+  };
+  const stateFile =
+    options.browserProfile &&
+    path.join(path.dirname(options.browserProfile), "credential-ids.json");
+  const key = `${slug}:${secret}`;
+  const targets =
     settings.level === "repo"
-      ? []
-      : ["--visibility", "selected", "--repos", `${owner}/${repository}`];
-  const workflow = await readFile(
-    path.join(
-      options.repository,
-      ".github/workflows",
-      settings.verification_workflow,
-    ),
-    "utf8",
-  );
-  if (
-    !workflow.includes("workflow_dispatch") ||
-    !workflow.includes("inputs.prm_nonce") ||
-    !workflow.includes("run-name:")
-  ) {
-    throw new Error(
-      "verification workflow requires workflow_dispatch input prm_nonce and run-name containing inputs.prm_nonce",
-    );
-  }
-  const days = settings.expiry_days ?? 30;
-  if (!Number.isInteger(days) || days < 1 || days > 90) {
-    throw new Error("token expiry_days must be between 1 and 90");
-  }
-  if (options.noBrowser) {
-    throw new Error(
-      "registry token creation requires the dedicated automated browser",
-    );
-  }
-  if (
-    options.browserOptions?.attach ||
-    options.browserOptions?.importScope === "full"
-  ) {
-    throw new Error(
-      "token setup requires a dedicated profile with domain-scoped sign-in import",
-    );
-  }
-  const run = options.secretCommand ?? secretCommand;
-  const previous = JSON.parse(
-    await run(
-      ["secret", "get-metadata", secret, ...scope, "--json"],
-      undefined,
-      options.repository,
-    ),
-  );
-  const verify = () =>
-    verifyCredentialWorkflow(session, settings.verification_workflow);
-  if (!needsRotation(previous)) {
-    try {
-      await verify();
-      return;
-    } catch {
-      previous.valid = false;
-    }
-  }
-  if (
-    !options.yes &&
-    !/^y(?:es)?$/i.test(
-      await session.prompt(
-        "Create and store a scoped credential, verify it, then revoke the replaced token? [y/N] ",
-      ),
-    )
-  ) {
-    throw new Error("credential creation declined");
-  }
-  if (session.automation) {
-    await session.automation.close();
-  }
-  session.automation = null;
-  const page = await session.automatedPage(
-    { ...options.browserOptions, importScope: "domains" },
-    true,
-  );
-  const expiry = new Date(Date.now() + days * 86_400_000).toISOString();
-  await rotateCredential(previous, {
+      ? [slug]
+      : (options.secretRepositories?.[`${plan.registry}:${secret}`] ?? [slug]);
+  let state = {};
+  let page;
+  let approved = false;
+  let repositorySecretPresent = false;
+  const result = await cycleCredential({
+    health: () => github.health.health(secret, healthOptions),
+    metadata: async () => {
+      let metadata = await github.secrets(scope).getMetadata(secret);
+      repositorySecretPresent = Boolean(metadata);
+      if (!metadata && settings.level !== "repo") {
+        try {
+          metadata = await github.secrets({ org: owner }).getMetadata(secret);
+        } catch (error) {
+          if (![403, 404, 422].includes(error.status)) {
+            throw error;
+          }
+        }
+      }
+      if (stateFile) {
+        state = JSON.parse(
+          await readFile(stateFile, "utf8").catch((error) => {
+            if (error.code === "ENOENT") {
+              return "{}";
+            }
+            throw error;
+          }),
+        );
+      }
+      const ids = trackedTokenIds(state, targets, secret);
+      const currentId =
+        settings.token_id ?? state[key]?.at(-1) ?? metadata?.token_id;
+      const retained = Object.entries(state).some(
+        ([entry, values]) =>
+          !targets.some((repo) => entry === `${repo}:${secret}`) &&
+          values.includes(currentId),
+      );
+      return metadata || ids.length
+        ? {
+            ...metadata,
+            present: Boolean(metadata),
+            token_id: retained ? undefined : currentId,
+            token_ids: ids,
+          }
+        : null;
+    },
     create: async () => {
-      await page.goto(provider.url);
-      await session.prompt(
-        `Sign in, then press Enter to fill the narrow publishing scope (${provider.scope})...`,
+      if (
+        options.noBrowser ||
+        options.browserOptions?.attach ||
+        options.browserOptions?.importScope === "full"
+      ) {
+        throw new Error(
+          "token setup requires a dedicated profile with domain-scoped sign-in import",
+        );
+      }
+      const days = settings.expiry_days ?? 30;
+      if (!Number.isInteger(days) || days < 1 || days > 90) {
+        throw new Error("token expiry_days must be between 1 and 90");
+      }
+      if (
+        !approved &&
+        !options.yes &&
+        !/^y(?:es)?$/i.test(
+          await session.prompt(
+            "Create and store a scoped credential, verify it, then revoke the replaced token? [y/N] ",
+          ),
+        )
+      ) {
+        throw new Error("credential creation declined");
+      }
+      approved = true;
+      page ??= await session.automatedPage(
+        {
+          ...options.browserOptions,
+          import: options.browserOptions?.import ?? {
+            browser: "auto",
+            profile: null,
+          },
+          importScope: "domains",
+        },
+        true,
       );
+      await page.goto(provider.url);
       await page.evaluate(
-        tokenFormScript(provider, `prm-${repository}`, expiry),
+        tokenFormScript(
+          provider,
+          `prm-${repository}-${secret}`,
+          new Date(Date.now() + days * 86_400_000).toISOString(),
+        ),
       );
       await session.prompt(
-        `Review the scope and expiry, create the token in this browser, then press Enter (never paste its value)...`,
+        `Review the publishing scope (${provider.scope}) and expiry, create the token in this browser, then press Enter (never paste its value)...`,
       );
-      const credential = await page.evaluate(READ_TOKEN);
-      if (!credential.expires_at) {
-        throw new Error(
-          "registry did not provide a verifiable expiry; no secret was stored",
-        );
+      return page.evaluate(READ_TOKEN);
+    },
+    ensure: async (credential, health) => {
+      const repos = targets;
+      let stored = await github
+        .secrets(settings.level === "repo" ? scope : { org: owner })
+        .ensure(secret, {
+          ...(settings.level === "repo"
+            ? {}
+            : { repos, visibility: "selected" }),
+          health,
+          rotateBeforeMs: 0,
+          failurePatterns: healthOptions.failurePatterns,
+          acquire: async () => ({
+            value: credential.value,
+            expiresAt: credential.expires_at,
+          }),
+        });
+      if (stored.path === "organization") {
+        for (const repo of repos) {
+          const override =
+            repo === slug
+              ? repositorySecretPresent
+              : await github.secrets({ repo }).getMetadata(secret);
+          if (!override) {
+            continue;
+          }
+          const replacement = await github.secrets({ repo }).ensure(secret, {
+            health,
+            rotateBeforeMs: 0,
+            acquire: async () => ({
+              value: credential.value,
+              expiresAt: credential.expires_at,
+            }),
+          });
+          if (replacement.valueChanged === false) {
+            throw new Error(
+              "gh-manager did not replace the repository credential override",
+            );
+          }
+          if (repo === slug) {
+            stored = {
+              ...replacement,
+              path: "repository",
+              fallbackReason:
+                "An existing repository secret overrides the organization secret; replaced the repository credential too.",
+            };
+          }
+        }
       }
-      return credential;
+      if (stored.valueChanged === false) {
+        throw new Error("gh-manager did not store the replacement credential");
+      }
+      if (stateFile) {
+        recordTokenId(state, targets, secret, credential.id);
+        await mkdir(path.dirname(stateFile), { recursive: true });
+        await writeFile(stateFile, JSON.stringify(state), { mode: 0o600 });
+      }
+      return stored;
+    },
+    test: async (stored) => {
+      const repos = stored ? targets : [slug];
+      const results = await Promise.all(
+        repos.map((repo) =>
+          github.health.test(secret, { ...healthOptions, scope: { repo } }),
+        ),
+      );
+      return {
+        status: results.some((item) => item.status === "auth-failing")
+          ? "auth-failing"
+          : results.every((item) => item.status === "ok")
+            ? "ok"
+            : "unknown",
+      };
     },
-    store: (credential) =>
-      run(
-        [
-          "secret",
-          "ensure",
-          secret,
-          ...scope,
-          ...visibility,
-          "--expires-at",
-          credential.expires_at,
-          "--token-id",
-          credential.id,
-          "--registry",
-          plan.registry,
-        ],
-        credential.value,
-        options.repository,
-      ),
-    verify,
     revoke: async (id) => {
       await page.goto(provider.url.replace(/\/create$/, ""));
       await session.prompt(
         `Revoke registry token ${id} in this browser, then press Enter...`,
       );
     },
-    revoked: async (id) => page.evaluate(revokedScript(id)),
+    revoked: (id) => page.evaluate(revokedScript(id)),
   });
-  console.log("  Credential verified; replaced token revocation verified.");
+  if (stateFile && result.changed) {
+    completeRotation(state, targets, secret, result.token_id);
+    await writeFile(stateFile, JSON.stringify(state), { mode: 0o600 });
+  }
+  session.outcome = {
+    status: result.changed ? "configured" : "complete",
+    secret,
+    ...(result.path ? { secret_scope: result.path } : {}),
+    ...(result.fallbackReason
+      ? { fallback_reason: result.fallbackReason }
+      : {}),
+  };
 }

package/src/discovery.mjs

@@ -4,6 +4,7 @@ import path from "node:path";
 import { CONTAINER_FILES, containerPackages } from "./containers.mjs";
 import { packageWorkflows, auditWrappers } from "./package-coverage.mjs";
 import { REGISTRIES } from "./model.mjs";
+import { inspectManifestRepositories } from "./repository-identity.mjs";
 import {
   TRUSTED_REGISTRIES,
   detectPublisher,
@@ -214,7 +215,7 @@ export async function inspectRepository(repository, options = {}) {
       left.manifest.localeCompare(right.manifest),
     );
   }
-  return inspection;
+  return inspectManifestRepositories(inspection);
 }
 
 /**

package/src/github.mjs

@@ -0,0 +1,42 @@
+import {
+  createRestClient,
+  resolveToken,
+  createRepoManager,
+  createRunManager,
+  createSecretHealth,
+  createSecretManager,
+} from "@link-foundation/gh-manager";
+
+/** GitHub-only operations, supplied by the installed gh-manager library. */
+export function githubServices(options = {}) {
+  const { token } = resolveToken(options);
+  if (!token && !options.rest) {
+    throw new Error(
+      "sign in to GitHub with gh auth login before scanning or setting secrets",
+    );
+  }
+  const rest = options.rest ?? createRestClient({ token });
+  const log = {
+    debug: (message) => {
+      if (options.verbose) {
+        console.error(message);
+      }
+    },
+  };
+  const context = { rest, log };
+  return {
+    repos: createRepoManager(context),
+    runs: createRunManager(context),
+    health: createSecretHealth(context),
+    secrets: (scope) => {
+      if (typeof scope.repo === "string") {
+        const [owner, name, extra] = scope.repo.split("/");
+        if (!owner || !name || extra !== undefined) {
+          throw new Error("invalid repository secret scope");
+        }
+        scope = { ...scope, repo: { owner, name } };
+      }
+      return createSecretManager({ ...context, scope });
+    },
+  };
+}

package/src/index.mjs

@@ -2,5 +2,7 @@ export { npmPrefillScript, openInUserBrowser } from "./browser.mjs";
 export { inspectRepository } from "./discovery.mjs";
 export { REGISTRIES, parseRegistry } from "./model.mjs";
 export { buildPlans, packageDirectory } from "./plan.mjs";
+export { scanRepositories } from "./organization-scan.mjs";
+export { cycleCredential, secretName } from "./ci-credential-cycle.mjs";
 export { ensureProfileIgnored } from "./profile.mjs";
 export { defaultBrowserProfile, executePlan, executePlans } from "./setup.mjs";

package/src/manifest-proposal.mjs

@@ -0,0 +1,201 @@
+import { mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { exec } from "command-stream";
+import {
+  githubSlug,
+  manifestUrls,
+  repositorySlug,
+} from "./repository-identity.mjs";
+
+function runner(options) {
+  return (
+    options.run ??
+    (async (program, args, cwd = options.repository) => {
+      const result = await exec(program, args, {
+        cwd,
+        env: process.env,
+        capture: true,
+        mirror: false,
+        stdin: "ignore",
+      });
+      if (result.code !== 0) {
+        throw new Error(
+          `${program} failed while preparing the manifest repository proposal`,
+        );
+      }
+      return String(result.stdout ?? "").trim();
+    })
+  );
+}
+
+function safeManifest(manifest) {
+  if (
+    !manifest ||
+    manifest
+      .split("/")
+      .some((part) => !part || part === "." || part === "..") ||
+    path.isAbsolute(manifest) ||
+    manifest.includes("\\")
+  ) {
+    throw new Error("unsafe manifest path for repository repair");
+  }
+}
+
+/** Change only stale repository values; preserve npm's repository.directory. */
+export function manifestRepositoryProposal(contents, manifest, slug) {
+  if (!githubSlug(slug)) {
+    throw new Error("invalid canonical repository");
+  }
+  const urls = manifestUrls(contents, manifest);
+  const stale = urls.filter(
+    (url) =>
+      githubSlug(url) && githubSlug(url).toLowerCase() !== slug.toLowerCase(),
+  );
+  if (!stale.length) {
+    return contents;
+  }
+  const url = `https://github.com/${slug}`;
+  if (manifest.endsWith("package.json")) {
+    const document = JSON.parse(contents.replace(/^\uFEFF/, ""));
+    if (typeof document.repository === "string") {
+      document.repository = url;
+    } else {
+      document.repository.url = `git+${url}.git`;
+    }
+    return `${JSON.stringify(document, null, 2)}\n`;
+  }
+  let proposal = contents;
+  for (const old of stale) {
+    proposal = proposal.replaceAll(old, old.replace(githubSlug(old), slug));
+  }
+  return proposal;
+}
+
+/** Check remote metadata before retrying; the original run may use an old SHA. */
+export async function verifyRemoteManifest(plan, options, reference) {
+  safeManifest(plan.package.manifest);
+  const run = runner(options);
+  const slug = repositorySlug(plan.repository);
+  const ref =
+    reference ??
+    (await run("gh", ["api", `repos/${slug}`, "--jq", ".default_branch"]));
+  if (!ref || ref.startsWith("-") || /[\s:]/.test(ref)) {
+    throw new Error("invalid remote manifest reference");
+  }
+  await run("git", ["fetch", "origin", ref]);
+  const contents = await run("git", [
+    "show",
+    `FETCH_HEAD:${plan.package.manifest}`,
+  ]);
+  return (
+    manifestRepositoryProposal(contents, plan.package.manifest, slug) ===
+    contents
+  );
+}
+
+/** Offer a reviewed branch and draft PR from the current remote default branch. */
+export async function offerManifestRepository(plan, options) {
+  const run = runner(options);
+  const slug = repositorySlug(plan.repository);
+  const manifest = plan.package.manifest;
+  safeManifest(manifest);
+  const remote = githubSlug(await run("git", ["remote", "get-url", "origin"]));
+  if (!remote) {
+    throw new Error(
+      "origin must be a GitHub repository for the manifest proposal",
+    );
+  }
+  const canonical = await run("gh", [
+    "api",
+    `repos/${remote}`,
+    "--jq",
+    ".full_name",
+  ]);
+  if (canonical.toLowerCase() !== slug.toLowerCase()) {
+    throw new Error("origin must resolve to the repository being repaired");
+  }
+  const base = await run("gh", [
+    "api",
+    `repos/${slug}`,
+    "--jq",
+    ".default_branch",
+  ]);
+  if (!base || base.startsWith("-") || /[\s:]/.test(base)) {
+    throw new Error("invalid default branch");
+  }
+  await run("git", ["fetch", "origin", base]);
+  const contents = await run("git", ["show", `FETCH_HEAD:${manifest}`]);
+  const proposal = manifestRepositoryProposal(contents, manifest, slug);
+  if (proposal === contents) {
+    return undefined;
+  }
+  console.log(`Proposed ${manifest}:\n${proposal}`);
+  if (
+    !options.yes &&
+    !/^y(?:es)?$/i.test(
+      await options.prompt(
+        "Create a branch and draft pull request with this repository URL fix? [y/N] ",
+      ),
+    )
+  ) {
+    return { status: "blocked" };
+  }
+  const branch = `prm/repository-url-${Date.now()}`;
+  const temporary = await mkdtemp(path.join(os.tmpdir(), "prm-manifest-"));
+  const checkout = path.join(temporary, "checkout");
+  let created = false;
+  try {
+    await run("git", ["worktree", "add", "-b", branch, checkout, "FETCH_HEAD"]);
+    created = true;
+    const target = path.join(checkout, manifest);
+    const root = await realpath(checkout);
+    const physical = await realpath(target);
+    if (
+      !physical.startsWith(`${root}${path.sep}`) ||
+      physical !== path.join(root, manifest)
+    ) {
+      throw new Error(
+        "manifest must stay inside the proposal worktree without symlinks",
+      );
+    }
+    const current = await readFile(target, "utf8");
+    const updated = manifestRepositoryProposal(current, manifest, slug);
+    await writeFile(target, updated);
+    await run("git", ["add", "--", manifest], checkout);
+    await run(
+      "git",
+      ["commit", "-m", "Fix manifest repository URL after repository transfer"],
+      checkout,
+    );
+    await run("git", ["push", "origin", `HEAD:refs/heads/${branch}`], checkout);
+    const url = await run(
+      "gh",
+      [
+        "pr",
+        "create",
+        "--repo",
+        slug,
+        "--base",
+        base,
+        "--head",
+        branch,
+        "--draft",
+        "--title",
+        "Fix manifest repository URL after repository transfer",
+        "--body",
+        `Update ${manifest} to name ${slug}. Review and merge this change, then re-run package-registry-manager setup to verify the repository metadata and retry the release.`,
+      ],
+      checkout,
+    );
+    console.log(
+      `Review and merge ${url}, then re-run setup. Release retries are paused.`,
+    );
+    return { status: "manifest-pr", url };
+  } finally {
+    if (created) {
+      await run("git", ["worktree", "remove", "--force", checkout]);
+    }
+    await rm(temporary, { recursive: true, force: true });
+  }
+}