package-registry-manager 0.23.1 → 0.24.0

package/CHANGELOG.md

@@ -24,9 +24,16 @@ currently shares its release version with the Rust implementation.
   variables and secret, `packages: write`, and package linking (#5).
 - `setup --browser default|automated` chooses where sign-in and approval URLs
   open; `default`, the default, uses the user's default browser (#9).
+- An npm first publish stops before the sign-in when the packed tarball
+  contains repository development directories such as `.github/` or `tests/`,
+  which a package.json without a `files` allowlist lets in.
 
 ### Changed
 
+- `setup` stays signed in by default: the npm session token and the crates.io
+  sign-in in the automated profile are kept, so the next run (npm: within two
+  hours) skips the sign-in. `--sign-out` signs out at the end instead;
+  `--keep-session` is still accepted and is now the default.
 - npm web-auth URLs (`npm login`, `npm publish` 2FA, `npm trust`) open in the
   user's default browser (`open`, `xdg-open`, or the Windows URL handler),
   where they are usually already signed in. The automated browser profile is
@@ -35,7 +42,7 @@ currently shares its release version with the Rust implementation.
   outside any repository (`~/Library/Application Support` on macOS,
   `$XDG_STATE_HOME` or `~/.local/state` on Linux, `%LOCALAPPDATA%` on Windows,
   each followed by `package-registry-manager/browser-profile`) (#8).
-- `browser-commander` is required at `^0.33.2`, its latest release (#28). A
+- `browser-commander` is required at `^0.34.0`, its latest release (#28). A
   launch still names its channel (`chrome` by default), so the upstream switch
   of channel-less launches to Chrome for Testing does not change which browser
   opens.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.23.1",
+  "version": "0.24.0",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -41,7 +41,7 @@
   },
   "dependencies": {
     "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/29808e088ac8fd8374361920bbebab07a4d63ac6",
-    "browser-commander": "^0.33.2",
+    "browser-commander": "^0.34.0",
     "command-stream": "^2.4.0",
     "playwright": "^1.63.0",
     "selenium-webdriver": "^4.50.0"

package/src/cli-main.mjs

@@ -68,10 +68,12 @@ Setup options:
   --manual                        crates.io: create, use, and revoke the
                                   first-publish token by hand instead of
                                   through the crates.io API
-  --keep-session                  Stay signed in after setup: npm keeps its
-                                  session token in npm's user configuration
-                                  until npm logout; the shared browser profile
-                                  keeps registry sessions across packages
+  --sign-out                      Sign out at the end of setup: npm logout
+                                  for the npm session this run signed in, and
+                                  removal of the crates.io sign-in it brought
+                                  into the automated profile. Without it the
+                                  next run reuses both sessions; npm ends its
+                                  session token after two hours
   --browser <default|automated>   Open sign-in and approval pages in your
                                   default browser, or in the automated profile;
                                   npm reuses the automated profile
@@ -132,6 +134,7 @@ export async function main(args = process.argv.slice(2)) {
       yes: { type: "boolean", default: false },
       "no-browser": { type: "boolean", default: false },
       "open-with": { type: "string" },
+      "sign-out": { type: "boolean", default: false },
       "keep-session": { type: "boolean", default: false },
       manual: { type: "boolean", default: false },
       browser: { type: "string", default: "default" },
@@ -249,6 +252,9 @@ export async function main(args = process.argv.slice(2)) {
     if (values["open-with"] !== undefined && values["no-browser"]) {
       throw new Error("--open-with and --no-browser are mutually exclusive");
     }
+    if (values["sign-out"] && values["keep-session"]) {
+      throw new Error("--sign-out and --keep-session are mutually exclusive");
+    }
     if (!browserOptions.attach) {
       browserOptions.import ??= { browser: "auto", profile: null };
     }
@@ -276,7 +282,7 @@ export async function main(args = process.argv.slice(2)) {
             defaultBrowserProfile({ channel: browserOptions.channel }),
         ),
         openWith: nonEmpty(values["open-with"], "--open-with"),
-        keepSession: values["keep-session"],
+        keepSession: !values["sign-out"],
         planOptions: {
           workflow: values.workflow,
           publisherEnvironment: values.environment,
@@ -364,6 +370,9 @@ export async function main(args = process.argv.slice(2)) {
   if (values["open-with"] !== undefined && values["no-browser"]) {
     throw new Error("--open-with and --no-browser are mutually exclusive");
   }
+  if (values["sign-out"] && values["keep-session"]) {
+    throw new Error("--sign-out and --keep-session are mutually exclusive");
+  }
 
   const plans = buildPlans(inspection, registries, planOptions);
   const selected = values.all
@@ -381,7 +390,7 @@ export async function main(args = process.argv.slice(2)) {
       yes: values.yes,
       noBrowser: values["no-browser"],
       openWith: nonEmpty(values["open-with"], "--open-with"),
-      keepSession: values["keep-session"],
+      keepSession: !values["sign-out"],
       secretName: values["secret-name"],
       rotateToken,
       migrate: values.migrate,

package/src/crates-api.mjs

@@ -407,7 +407,7 @@ export async function runCratesApiStep(session, step) {
     case "crates-sign-out":
       if (options.keepSession) {
         console.log(
-          `Keeping the ${domains.join(" / ")} sign-in in the automated profile (--keep-session); the next run reuses it. No token is kept.`,
+          `Keeping the ${domains.join(" / ")} sign-in in the automated profile; the next run reuses it. No token is kept.`,
         );
       } else if (page.clearCookies) {
         await page.clearCookies(domains);

package/src/flows.mjs

@@ -477,7 +477,7 @@ export function npmFlow(packageInfo, context) {
       "sign-out",
       "Sign out of npm",
       "command",
-      "Revoke the session token created by the web login.",
+      "With --sign-out, revoke the session token created by the web login now; otherwise the next run reuses it and npm ends it after two hours.",
       { command: command("npm", ["logout"]), when: "tool-signed-in" },
     ),
     removeWorktreeStep(),
@@ -555,7 +555,7 @@ function apiCratesFlow(packageInfo, context) {
       "crates-sign-out",
       "Sign the automated browser out of crates.io",
       "api",
-      "Remove the sign-in this run brought into the automated profile; --keep-session keeps it. No token outlives the run either way.",
+      "With --sign-out, remove the sign-in this run brought into the automated profile; otherwise the next run reuses it. No token outlives the run either way.",
       { when: "crates-signed-in" },
     ),
     removeWorktreeStep(),

package/src/setup.mjs

@@ -107,14 +107,14 @@ export class SetupSession {
       ) {
         if (step.id === "sign-out" && this.keepsSession(step)) {
           console.log(
-            "Keeping the npm session for reuse; run npm logout to revoke it.",
+            "Keeping the npm session for reuse; npm ends it after two hours, npm logout sooner.",
           );
         } else {
           deferred.push(step);
         }
       } else if (step.id === "sign-out" && this.keepsSession(step)) {
         console.log(
-          "Keeping the npm session for reuse: its token stays in npm's user configuration until you run npm logout, and the next run reuses it while npm whoami succeeds.",
+          "Keeping the npm session for reuse: the next run within two hours skips the sign-in while npm whoami succeeds. npm ends the session token after two hours; npm logout ends it now.",
         );
       } else if (this.conditions.has(step.when) && step.kind === "api") {
         this.log(`==> ${step.title}`);
@@ -608,6 +608,12 @@ export class SetupSession {
     console.log(
       `  ${packed.filename}: ${packed.size} bytes packed, ${packed.unpackedSize} bytes unpacked, ${packed.entryCount} files`,
     );
+    const development = developmentDirectories(packed);
+    if (development.length > 0) {
+      throw new Error(
+        `the package would publish repository development files (${development.join(", ")}); add a "files" allowlist to package.json, commit it to the published ref, and re-run. Nothing was published.`,
+      );
+    }
     this.values.tarball = path.join(
       this.values.pack_destination,
       packed.filename,
@@ -882,6 +888,39 @@ export function packedEntry(output) {
   return packed;
 }
 
+/**
+ * Top-level repository directories of development files: CI, tests, and
+ * editor and build state, which belong in no published package.
+ */
+const DEVELOPMENT_DIRECTORIES = new Set([
+  ".changeset",
+  ".github",
+  ".husky",
+  ".idea",
+  ".vscode",
+  "__tests__",
+  "coverage",
+  "experiments",
+  "target",
+  "test",
+  "tests",
+]);
+
+/**
+ * The development directories a packed tarball contains, as `name/`, which
+ * a package.json without a `files` allowlist lets in.
+ */
+export function developmentDirectories(packed) {
+  const found = new Set();
+  for (const file of packed.files ?? []) {
+    const [top, ...rest] = String(file.path).split("/");
+    if (rest.length > 0 && DEVELOPMENT_DIRECTORIES.has(top)) {
+      found.add(`${top}/`);
+    }
+  }
+  return [...found].sort();
+}
+
 function reportPackWarnings(stderr) {
   const warnings = packWarnings(stderr);
   if (warnings.length === 0) {