package-registry-manager 0.22.7 → 0.22.9

package/README.md

@@ -22,4 +22,18 @@ version after confirmation; later versions publish through CI. Missing CI
 publishing jobs are offered in a draft pull request, and PyPI builds select an
 interpreter satisfying `requires-python`. See the repository README for the
 registry walkthroughs and safety details.
+Account scans and setup are available in both ports:
+
+```sh
+package-registry-manager inspect --org link-foundation
+package-registry-manager plan --user LOGIN --format json
+package-registry-manager setup --org link-foundation --all --execute --browser-import auto
+```
+
+Scans read matched manifests/workflows through gh-manager. Account setup shares
+one browser, groups npm approvals, and uses CI evidence to preserve healthy tokens
+or verify replacements before revocation. `--secret-name '{REGISTRY}_TOKEN_{REPO}'`
+selects custom credential names. Rust requires Node.js and npm for its pinned
+GitHub CLI dependency.
+
 See the [bootstrap, wrapper and credential guide](../docs/registry-setup.md) for branch/PR setup, dual npm names, registry policies and integration limits.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.22.7",
+  "version": "0.22.9",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -40,8 +40,9 @@
     "audit": "node scripts/npm-audit.mjs"
   },
   "dependencies": {
-    "browser-commander": "^0.26.3",
-    "command-stream": "^2.0.0",
+    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/29808e088ac8fd8374361920bbebab07a4d63ac6",
+    "browser-commander": "^0.30.1",
+    "command-stream": "^2.0.2",
     "playwright": "^1.63.0",
     "selenium-webdriver": "^4.50.0"
   },

package/src/ci-credential-cycle.mjs

@@ -0,0 +1,121 @@
+/** Resolve a caller-selected name before making any GitHub or browser mutations. */
+export function secretName(template, registry, slug) {
+  const [owner, repo] = slug.split("/");
+  const normalize = (value) =>
+    value.toUpperCase().replaceAll(/[^A-Z0-9_]/g, "_");
+  const values = {
+    REGISTRY: normalize(registry),
+    REPO: normalize(repo),
+    ORG: normalize(owner),
+    OWNER: normalize(owner),
+  };
+  const name = template.replaceAll(
+    /\{([A-Z]+)\}/g,
+    (match, key) => values[key] ?? match,
+  );
+  if (!/^[A-Z_][A-Z0-9_]{0,244}$/.test(name) || name.startsWith("GITHUB_")) {
+    throw new Error("invalid registry secret name or naming template");
+  }
+  return name;
+}
+
+/** IDs are revocable only after every tracked consumer is being replaced. */
+export function trackedTokenIds(state, repos, secret) {
+  const keys = new Set(repos.map((repo) => `${repo}:${secret}`));
+  const retained = new Set(
+    Object.entries(state)
+      .filter(([key]) => !keys.has(key))
+      .flatMap(([, ids]) => ids),
+  );
+  return [
+    ...new Set(repos.flatMap((repo) => state[`${repo}:${secret}`] ?? [])),
+  ].filter((id) => !retained.has(id));
+}
+
+/** Remember candidates for every consumer, including uncertain verification. */
+export function recordTokenId(state, repos, secret, id) {
+  for (const repo of repos) {
+    const key = `${repo}:${secret}`;
+    state[key] = [...new Set([...(state[key] ?? []), id])];
+  }
+}
+
+/** Successful verification leaves the replacement associated with every target. */
+export function completeRotation(state, repos, secret, id) {
+  for (const repo of repos) {
+    state[`${repo}:${secret}`] = [id];
+  }
+}
+
+/** CI drives rotation. Uncertain tests preserve every existing credential. */
+export async function cycleCredential(adapter) {
+  const health = await adapter.health();
+  if (health.status === "ok") {
+    return { status: "ok", changed: false };
+  }
+  const previous = await adapter.metadata();
+  if (health.status === "unknown" && previous && previous.present !== false) {
+    const tested = await adapter.test();
+    if (tested.status === "ok") {
+      return { status: "ok", changed: false };
+    }
+    if (tested.status !== "auth-failing") {
+      throw new Error(
+        "credential verification is unknown; existing credential retained",
+      );
+    }
+  }
+  const candidates = [];
+  try {
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      const candidate = await adapter.create();
+      candidates.push(candidate);
+      if (
+        !candidate.value ||
+        !candidate.id ||
+        (candidate.expires_at &&
+          !(Date.parse(candidate.expires_at) > Date.now()))
+      ) {
+        throw new Error("registry returned no usable credential");
+      }
+      const stored = await adapter.ensure(candidate, {
+        status: "auth-failing",
+      });
+      candidate.value = "";
+      const tested = await adapter.test(stored);
+      if (tested.status === "ok") {
+        const ids = new Set([
+          previous?.token_id,
+          ...(previous?.token_ids ?? []),
+          ...candidates.slice(0, -1).map((item) => item.id),
+        ]);
+        ids.delete(undefined);
+        ids.delete(candidate.id);
+        for (const id of ids) {
+          await adapter.revoke(id);
+          if (!(await adapter.revoked(id))) {
+            throw new Error("previous token revocation could not be verified");
+          }
+        }
+        return {
+          ...stored,
+          status: "ok",
+          changed: true,
+          token_id: candidate.id,
+        };
+      }
+      if (tested.status !== "auth-failing") {
+        throw new Error(
+          "credential verification is unknown; old and replacement credentials retained",
+        );
+      }
+    }
+    throw new Error(
+      "credential verification is auth-failing after two candidates; old credentials retained",
+    );
+  } finally {
+    for (const candidate of candidates) {
+      candidate.value = "";
+    }
+  }
+}

package/src/cli.mjs

@@ -21,6 +21,7 @@ import {
   executePlans,
 } from "./setup.mjs";
 import { importSources } from "./sign-in-import.mjs";
+import { accountCommand } from "./organization-setup.mjs";
 
 export { isDirectExecution };
 
@@ -36,6 +37,8 @@ Global options:
   -h, --help                      Print this help
   -V, --version                   Print the version
   --repository <path>             Repository to inspect (default: .)
+  --org <org> | --user <login>      Scan repositories through gh-manager
+  --secret-name <template>         Secret name; supports {REGISTRY}, {REPO}, {ORG}
   --format <text|json>            Output format (default: text)
   --offline                       Do not look up packages on registries
   --verbose                       Print command details and output, and
@@ -109,6 +112,9 @@ export async function main(args = process.argv.slice(2)) {
     options: {
       ref: { type: "string" },
       repository: { type: "string", default: "." },
+      org: { type: "string" },
+      user: { type: "string" },
+      "secret-name": { type: "string" },
       format: { type: "string", default: "text" },
       verbose: { type: "boolean", default: false },
       offline: { type: "boolean", default: false },
@@ -168,6 +174,68 @@ export async function main(args = process.argv.slice(2)) {
   });
 
   const repository = path.resolve(values.repository);
+  const command = positionals[0];
+  if (values.org || values.user) {
+    if (values.org && values.user) {
+      throw new Error("--org and --user are mutually exclusive");
+    }
+    if (values.repository !== "." || values.ref) {
+      throw new Error("account scans cannot use --repository or --ref");
+    }
+    if (!["inspect", "plan", "setup"].includes(command)) {
+      throw new Error(`unknown command '${command}'`);
+    }
+    if (command === "setup" && (!values.all || values.package)) {
+      throw new Error("account setup requires --all without --package");
+    }
+    if (values["dry-run"] && values.execute) {
+      throw new Error("--dry-run and --execute are mutually exclusive");
+    }
+    if (values.yes && !values.execute) {
+      throw new Error("--yes requires --execute");
+    }
+    if (values["no-browser"] && !values.execute) {
+      throw new Error("--no-browser requires --execute");
+    }
+    if (values["open-with"] !== undefined && values["no-browser"]) {
+      throw new Error("--open-with and --no-browser are mutually exclusive");
+    }
+    if (!browserOptions.attach) {
+      browserOptions.import ??= { browser: "auto", profile: null };
+    }
+    return accountCommand(
+      command,
+      {
+        org: values.org,
+        user: values.user,
+        format: values.format,
+        offline: values.offline,
+        verbose: values.verbose,
+        registries: (values.registry ?? []).map(parseRegistry),
+        execute: values.execute,
+        yes: values.yes,
+        noBrowser: values["no-browser"],
+        secretName: values["secret-name"],
+        package: values.package,
+        browser: values.browser,
+        browserOptions,
+        browserProfile: path.resolve(
+          values["browser-profile"] ??
+            defaultBrowserProfile({ channel: browserOptions.channel }),
+        ),
+        openWith: nonEmpty(values["open-with"], "--open-with"),
+        keepSession: values["keep-session"],
+        planOptions: {
+          workflow: values.workflow,
+          publisherEnvironment: values.environment,
+          addPublishJob: values["add-publish-job"],
+          manual: values.manual,
+          verifyRelease: values["verify-release"],
+        },
+      },
+      outputPlans,
+    );
+  }
   const discovered = values.ref
     ? await inspectReference(repository, values.ref, {
         includeSkipped: values.verbose,
@@ -176,7 +244,6 @@ export async function main(args = process.argv.slice(2)) {
   const inspection = values.offline
     ? discovered
     : await probeRegistryState(discovered, { verbose: values.verbose });
-  const command = positionals[0];
   if (command === "inspect") {
     outputInspection(inspection, values.format);
     return;
@@ -260,6 +327,10 @@ export async function main(args = process.argv.slice(2)) {
       noBrowser: values["no-browser"],
       openWith: nonEmpty(values["open-with"], "--open-with"),
       keepSession: values["keep-session"],
+      secretName: values["secret-name"],
+      quietBrowser: selected.some((plan) =>
+        plan.steps.some((step) => step.id === "manage-registry-token"),
+      ),
       browser: values.browser,
       browserOptions,
       browserProfile: path.resolve(

package/src/credential-cycle.mjs

@@ -84,7 +84,7 @@ export function credentialSteps(registry, secret) {
       id: "manage-registry-token",
       title: `Ensure and rotate ${secret}`,
       kind: "api",
-      description: `${credentialPolicy(registry).description}. Check expiry and validity, create the narrowest publishing credential in the browser, store through gh-manager stdin, verify in a dry-run workflow, then revoke and verify the replaced token. Requires gh-manager secret support and a configured verification workflow.`,
+      description: `${credentialPolicy(registry).description}. Check gh-manager CI health; keep healthy secrets, create missing or auth-failing credentials in the browser, ensure organization access with repository fallback, test through gh-manager, then revoke the replaced token. Retry once only on an authentication failure.`,
       confirm: true,
     },
   ];