package-registry-manager 0.24.0 → 0.25.1

package/README.md

@@ -70,3 +70,15 @@ local `--offline` commands keep local scope. Both CLIs' GitHub dependency needs
 Node.js 22.12 or newer and npm; JavaScript checks the runtime before loading it.
 
 See the [bootstrap, wrapper and credential guide](../docs/registry-setup.md) for branch/PR setup, dual npm names, registry policies and integration limits.
+
+Migration tries trusted publishing first and retains token fallback and expiry
+metadata by default. `--delete-token-secrets` explicitly opts into cleanup after
+OIDC publication and verification that no workflow still uses the credentials.
+Saved crates.io API sessions run headlessly; sign-in opens a visible window only
+when user action is needed. Organization migration skips and reports scan errors
+while continuing for clean repositories.
+
+NuGet setup uses an explicit login profile, package owner and exact package IDs.
+Trusted publishing is preferred; existing provided fallback credentials are retained.
+See [audit and NuGet configuration](../docs/issue-73-requirements.md) for setup,
+identity decisions and the distinction between verified configuration and release.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.24.0",
+  "version": "0.25.1",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -40,9 +40,9 @@
     "audit": "node scripts/npm-audit.mjs"
   },
   "dependencies": {
-    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/29808e088ac8fd8374361920bbebab07a4d63ac6",
+    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/0b3ceb1590be7eb0340ae088730698b5ae9bebfc",
     "browser-commander": "^0.34.0",
-    "command-stream": "^2.4.0",
+    "command-stream": "^2.6.0",
     "playwright": "^1.63.0",
     "selenium-webdriver": "^4.50.0"
   },

package/src/audit-config.mjs

@@ -0,0 +1,96 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+/** Explicit source decisions supplement static discovery without executing build files. */
+export async function auditConfig(root) {
+  const config = JSON.parse(
+    await readFile(
+      path.join(root, ".package-registry-manager.json"),
+      "utf8",
+    ).catch((error) => {
+      if (error.code === "ENOENT") {
+        return "{}";
+      }
+      throw error;
+    }),
+  );
+  if (
+    config.publish !== undefined &&
+    (!Array.isArray(config.publish) ||
+      config.publish.some(
+        (file) =>
+          typeof file !== "string" ||
+          path.posix.normalize(file) !== file ||
+          file.startsWith("/") ||
+          file.split("/").includes(".."),
+      ))
+  ) {
+    throw new Error(
+      "publish must list exact repository-relative manifest paths",
+    );
+  }
+  return config;
+}
+
+/** A reviewed mapping chooses one canonical artifact; references never publish a different tarball. */
+export function applyAuditConfig(items, config, workflows) {
+  for (const item of items.filter(Boolean)) {
+    const gradle = config.gradle?.find(
+      (entry) => entry.manifest === item.manifest,
+    );
+    if (gradle) {
+      if (
+        ![
+          gradle.group,
+          gradle.artifact,
+          gradle.version,
+          gradle.component,
+        ].every((value) => typeof value === "string" && /^[\w.-]+$/.test(value))
+      ) {
+        throw new Error(
+          "explicit Gradle publication requires resolved group, artifact, version and component",
+        );
+      }
+      Object.assign(item, {
+        registry: "maven-central",
+        name: `${gradle.group}:${gradle.artifact}`,
+        version: gradle.version,
+        publishable: true,
+        publication_component: gradle.component,
+      });
+      delete item.discovery_skip;
+    }
+    const shared = config.shared_artifacts?.find(
+      (entry) =>
+        `${entry.registry}:${entry.name}` === `${item.registry}:${item.name}`,
+    );
+    if (shared) {
+      item.shared_artifact = shared;
+    }
+    if (item.distribution) {
+      item.distribution = {
+        ...item.distribution,
+        ...config.distribution?.[item.manifest],
+        workflows: workflows
+          .filter((workflow) =>
+            item.registry === "conan"
+              ? /conan\s+upload/.test(workflow.contents)
+              : item.registry === "vcpkg"
+                ? /vcpkg.*(?:x-add-version|registry|publish)/.test(
+                    workflow.contents,
+                  )
+                : /cpack|cmake.*--install/.test(workflow.contents),
+          )
+          .map((workflow) => ({
+            workflow: workflow.name,
+            remote_variable: /CONAN_REMOTE_URL/.test(workflow.contents)
+              ? "CONAN_REMOTE_URL"
+              : undefined,
+            credential_names: ["CONAN_LOGIN_USERNAME", "CONAN_PASSWORD"].filter(
+              (name) => workflow.contents.includes(name),
+            ),
+          })),
+      };
+    }
+  }
+}

package/src/automation.mjs

@@ -29,14 +29,20 @@ export function relayExtensionDirectory() {
  * the `domains` import scope only the cookies of `domains`, the registry's
  * sign-in domains, are imported.
  */
-export function launchOptions(browser, profile, verbose = false, domains = []) {
+export function launchOptions(
+  browser,
+  profile,
+  verbose = false,
+  domains = [],
+  headless = false,
+) {
   const options = {
     engine:
       findBrowserSource(browser.channel)?.controlProtocol === "cdp"
         ? "playwright"
         : "selenium",
     channel: browser.channel,
-    headless: false,
+    headless,
     verbose,
   };
   if (browser.executable) {
@@ -82,7 +88,7 @@ export function extensionInstructions(directory) {
  * `evaluate`, `close`, and, for a launched profile, `clearCookies(domains)`.
  */
 export async function connectAutomation(
-  { browser, profile, verbose = false, domains = [] },
+  { browser, profile, verbose = false, domains = [], headless = false },
   dependencies = {},
 ) {
   if (browser.attach?.mode === "extension") {
@@ -90,7 +96,7 @@ export async function connectAutomation(
   }
   if (findBrowserSource(browser.channel)?.controlProtocol === "bidi") {
     return connectWebDriverAutomation(
-      { browser, profile, verbose, domains },
+      { browser, profile, verbose, domains, headless },
       dependencies,
     );
   }
@@ -99,8 +105,9 @@ export async function connectAutomation(
   }
   const connection = await (
     dependencies.launchRealBrowser ?? launchRealBrowser
-  )(launchOptions(browser, profile, verbose, domains));
+  )(launchOptions(browser, profile, verbose, domains, headless));
   return {
+    headless,
     goto: (url) => connection.page.goto(url),
     evaluate: (script) => connection.page.evaluate(script),
     close: () => connection.close(),

package/src/bootstrap-recovery.mjs

@@ -0,0 +1,163 @@
+import { probePackage } from "./registry-state.mjs";
+import {
+  publisherIdentities,
+  publisherMatches,
+  repositorySlug,
+} from "./repository-identity.mjs";
+
+/** Bootstrap is a repaired prerequisite, separate from OIDC rejection. */
+export function bootstrapNames(log) {
+  const names = [];
+  for (const match of log.matchAll(
+    /npm owner setup required for ([^:\n]+):/gi,
+  )) {
+    for (const name of match[1].split(/[,\s]+/).filter(Boolean)) {
+      if (!/^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/.test(name)) {
+        return [];
+      }
+      names.push(name);
+    }
+  }
+  return [...new Set(names)];
+}
+
+/** Fresh name and exact publisher checks are equivalent to the owner-setup preflight. */
+export async function verifyBootstrapRecovery(session) {
+  if (!session.bootstrapNames?.length) {
+    return;
+  }
+  for (const name of session.bootstrapNames) {
+    const state = await (session.options.probePackage ?? probePackage)(
+      { ...session.plan.package, name },
+      session.options,
+    );
+    if (state.exists !== true) {
+      throw new Error(`bootstrap preflight still unresolved for ${name}`);
+    }
+    const trust = session.plan.steps?.find(
+      (step) => step.id === "verify-trusted-publisher",
+    )?.command;
+    const args = trust
+      ? trust.args.map((argument) =>
+          argument === session.plan.package.name ? name : argument,
+        )
+      : ["-y", "npm@^11.15", "trust", "list", name, "--browser=false"];
+    const result = await session.capture({
+      command: { program: trust?.program ?? "npx", args },
+    });
+    if (
+      result.code !== 0 ||
+      !publisherIdentities(String(result.stdout)).some((publisher) =>
+        publisherMatches(publisher, session.plan.trusted_publisher),
+      )
+    ) {
+      throw new Error(`bootstrap publisher is not verified for ${name}`);
+    }
+  }
+  const slug = repositorySlug(session.plan.repository);
+  const result = await session.capture({
+    command: {
+      program: "gh",
+      args: [
+        "api",
+        `repos/${slug}/commits/${session.releaseSelection.branch}`,
+        "--jq",
+        ".sha",
+      ],
+    },
+    cwd: ".",
+  });
+  if (
+    result.code !== 0 ||
+    String(result.stdout).trim() !== session.releaseSelection.run.headSha
+  ) {
+    throw new Error(
+      "default branch changed; follow the new revision's release instead of rerunning the old SHA",
+    );
+  }
+}
+
+/** Retry only jobs whose own failed log contains the repaired prerequisite. */
+export async function recoverBootstrap(session) {
+  await verifyBootstrapRecovery(session);
+  const selection = session.releaseSelection;
+  const slug = repositorySlug(session.plan.repository);
+  const jobIds = [];
+  for (const job of selection.jobs ?? []) {
+    if (job.conclusion !== "failure") {
+      continue;
+    }
+    const log = await session.capture({
+      command: {
+        program: "gh",
+        args: [
+          "run",
+          "view",
+          String(selection.run.databaseId),
+          "--repo",
+          slug,
+          "--job",
+          String(job.databaseId),
+          "--log",
+        ],
+      },
+      cwd: ".",
+    });
+    if (log.code !== 0) {
+      throw new Error(
+        "causal failed-job logs are unavailable; no CI was restarted",
+      );
+    }
+    if (
+      bootstrapNames(String(log.stdout)).some((name) =>
+        session.bootstrapNames.includes(name),
+      )
+    ) {
+      jobIds.push(job.databaseId);
+    }
+  }
+  if (!jobIds.length) {
+    throw new Error(
+      "no causal bootstrap job could be verified; unrelated failed jobs were not retried",
+    );
+  }
+  const changes =
+    session.options.recoveryChanges?.get(
+      `${slug}:${session.plan.trusted_publisher.workflow}`,
+    ) ?? [];
+  if (!changes.length) {
+    throw new Error(
+      "no verified configuration change in this setup; CI was not restarted",
+    );
+  }
+  const { githubServices } = await import("./github.mjs");
+  const github = session.options.github ?? githubServices(session.options);
+  const result = await github.repair.verify({
+    repo: slug,
+    workflow: session.plan.trusted_publisher.workflow,
+    runId: selection.run.databaseId,
+    jobIds,
+    changes: changes.map(() => ({
+      kind: "setting",
+      changed: true,
+      verified: true,
+    })),
+    timeout: session.options.waitTimeoutMs ?? 600000,
+  });
+  console.log(JSON.stringify({ bootstrap_recovery: result }));
+  session.conditions.delete("release-dispatch");
+  session.values.run_id = String(result.runId);
+  if (result.status !== "success") {
+    throw new Error(
+      `repaired bootstrap CI remains ${result.status}; ${result.runUrl ?? selection.run.url}`,
+    );
+  }
+  const { verifyNpmRelease } = await import("./npm-release.mjs");
+  const packages = await verifyNpmRelease(session, result.runId);
+  session.outcome = {
+    status: "verified",
+    url: result.runUrl,
+    ci: result,
+    packages,
+  };
+}

package/src/browser.mjs

@@ -42,10 +42,10 @@ export function openerSucceeded(file, code) {
  * Starts an opener through command-stream without a shell and settles once it
  * exits, or after `graceMs` while it keeps running in the background.
  */
-export function detachedRunner(graceMs = OPENER_GRACE_MS) {
+export function detachedRunner(graceMs = OPENER_GRACE_MS, spawnChild = spawn) {
   return (file, args) =>
     new Promise((resolve, reject) => {
-      const child = spawn(file, args, {
+      const child = spawnChild(file, args, {
         detached: process.platform !== "win32",
         stdio: "ignore",
         shell: false,

package/src/cli-main.mjs

@@ -36,7 +36,8 @@ Global options:
   --org <org> | --user <login>      Scan repositories through gh-manager
   --secret-name <template>         Secret name; supports {REGISTRY}, {REPO}, {ORG}
   --rotate-token <secret>          Explicitly replace a legacy crates.io token
-  --migrate                       Convert token jobs in PRs, then verify OIDC and clean up secrets
+  --migrate                       Convert jobs to OIDC with token fallback, then verify releases
+  --delete-token-secrets          Opt in to verified unused token and expiry cleanup
   --token-expiry-days <N>          Read browser token inventory in account scans
   --format <text|json>            Output format (default: text)
   --offline                       Do not look up packages on registries
@@ -118,6 +119,7 @@ export async function main(args = process.argv.slice(2)) {
       "secret-name": { type: "string" },
       "rotate-token": { type: "string" },
       migrate: { type: "boolean", default: false },
+      "delete-token-secrets": { type: "boolean", default: false },
       "token-expiry-days": { type: "string" },
       format: { type: "string", default: "text" },
       verbose: { type: "boolean", default: false },
@@ -273,6 +275,7 @@ export async function main(args = process.argv.slice(2)) {
         secretName: values["secret-name"],
         rotateToken,
         migrate: values.migrate,
+        deleteTokenSecrets: values["delete-token-secrets"],
         tokenExpiryDays,
         package: values.package,
         browser: values.browser,
@@ -288,6 +291,7 @@ export async function main(args = process.argv.slice(2)) {
           publisherEnvironment: values.environment,
           addPublishJob: values["add-publish-job"],
           migrate: values.migrate,
+          deleteTokenSecrets: values["delete-token-secrets"],
           manual: values.manual,
           verifyRelease: values["verify-release"],
         },
@@ -331,6 +335,7 @@ export async function main(args = process.argv.slice(2)) {
   const planOptions = {
     rotateToken,
     migrate: values.migrate,
+    deleteTokenSecrets: values["delete-token-secrets"],
     ref: values.ref,
     verifyRelease: values["verify-release"],
     manual: values.manual,
@@ -375,9 +380,10 @@ export async function main(args = process.argv.slice(2)) {
   }
 
   const plans = buildPlans(inspection, registries, planOptions);
-  const selected = values.all
-    ? plans.filter((plan) => plan.package.publishable)
-    : [selectPlan(plans, values.package)];
+  const selected =
+    values.all || (values.migrate && !values.package)
+      ? plans.filter((plan) => plan.package.publishable)
+      : [selectPlan(plans, values.package)];
   outputPlans(selected, values.format);
   await executePlans(
     selected,
@@ -394,6 +400,7 @@ export async function main(args = process.argv.slice(2)) {
       secretName: values["secret-name"],
       rotateToken,
       migrate: values.migrate,
+      deleteTokenSecrets: values["delete-token-secrets"],
       quietBrowser: selected.some((plan) =>
         plan.steps.some((step) =>
           ["manage-registry-token", "rotate-crates-token"].includes(step.id),
@@ -408,7 +415,7 @@ export async function main(args = process.argv.slice(2)) {
       verbose: values.verbose,
       verifyRelease: values["verify-release"],
     },
-    values.all,
+    values.all || values.migrate,
   );
 }
 
@@ -520,7 +527,14 @@ function outputInspection(inspection, format) {
         packageInfo.exists_on_registry ? "published" : "not published yet",
       );
     }
-    if (packageInfo.trusted_publishing) {
+    if (packageInfo.registry_http_status) {
+      details.push(
+        `registry state unknown (HTTP ${packageInfo.registry_http_status})`,
+      );
+    }
+    if (packageInfo.publishing_policy === "oidc-with-token-fallback") {
+      details.push("trusted publishing + token fallback");
+    } else if (packageInfo.trusted_publishing) {
       details.push("trusted publishing");
     }
     process.stdout.write(

package/src/cpp-distribution.mjs

@@ -0,0 +1,127 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+/** Read distribution metadata without executing a CMake file or Python recipe. */
+export async function cppDistribution(
+  contents,
+  filename,
+  manifest,
+  manifestPath,
+) {
+  let cmake = filename === "CMakeLists.txt" ? contents : "";
+  if (!cmake) {
+    try {
+      cmake = await readFile(
+        path.join(path.dirname(manifestPath), "CMakeLists.txt"),
+        "utf8",
+      );
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+  }
+  const project =
+    /\bproject\s*\(\s*([\w.-]+)\s+VERSION\s+(\d+(?:\.\d+)+)/i.exec(cmake);
+  let name = project?.[1];
+  let version = project?.[2];
+  const registry =
+    filename === "vcpkg.json"
+      ? "vcpkg"
+      : filename === "conanfile.py"
+        ? "conan"
+        : "cmake";
+  if (registry === "vcpkg") {
+    const data = JSON.parse(contents);
+    name = data.name;
+    version =
+      data.version ??
+      data["version-semver"] ??
+      data["version-string"] ??
+      data["version-date"];
+  } else if (registry === "conan") {
+    name = /^\s*name\s*=\s*["']([^"']+)/m.exec(contents)?.[1] ?? name;
+    version = /^\s*version\s*=\s*["']([^"']+)/m.exec(contents)?.[1] ?? version;
+  }
+  if (
+    !name ||
+    (registry === "cmake" &&
+      !/install\s*\(|CPack|configure_package_config_file/i.test(contents))
+  ) {
+    return {
+      manifest,
+      discovery_skip:
+        "CMake build definition has no distribution installation/configuration",
+      publishable: false,
+    };
+  }
+  return {
+    registry,
+    name,
+    version: version ?? null,
+    manifest,
+    publishable: true,
+    distribution: {
+      version_source: project
+        ? path.posix.join(path.posix.dirname(manifest), "CMakeLists.txt")
+        : manifest,
+      provider_status: "unverified",
+      ...(registry === "conan"
+        ? {
+            remote_required: "CONAN_REMOTE_URL",
+            credential_names: ["CONAN_LOGIN_USERNAME", "CONAN_PASSWORD"],
+          }
+        : {}),
+    },
+    warnings: [
+      registry === "conan"
+        ? "Conan remote configuration and publication remain unverified; a local recipe does not establish registry presence"
+        : `${registry} distribution metadata does not establish a public registry publication`,
+    ],
+  };
+}
+
+/** Validation and explicit channel prerequisites; no upload is performed. */
+export function cppPlan(item) {
+  const commands = {
+    cmake: {
+      program: "cmake",
+      args: ["-S", ".", "-B", "build/prm-validation"],
+    },
+    conan: { program: "conan", args: ["inspect", ".", "--format=json"] },
+    vcpkg: {
+      program: "vcpkg",
+      args: ["install", "--dry-run", "--x-manifest-root=."],
+    },
+  };
+  return [
+    {
+      id: "validate-package",
+      title: `Validate ${item.registry} distribution`,
+      kind: "check",
+      command: commands[item.registry],
+      description:
+        "Validate the manifest locally before reviewing any publication settings.",
+    },
+    ...(item.registry === "conan"
+      ? [
+          {
+            id: "audit-distribution-channel",
+            title: "Read Conan remote and credential health",
+            kind: "api",
+            description:
+              "Read effective remote configuration and credential health through gh-manager. Unknown credentials and missing remotes remain explicit; do not upload or rotate credentials.",
+          },
+        ]
+      : []),
+    {
+      id: "review-distribution-channel",
+      title: "Resolve the distribution provider and CI configuration",
+      kind: "manual",
+      description:
+        item.registry === "conan"
+          ? "Read CONAN_REMOTE_URL and credential health for CONAN_LOGIN_USERNAME/CONAN_PASSWORD through gh-manager at the effective repository/environment scope. Choose the exact remote, validate conan create and consumer tests in reviewed CI, then configure narrowly scoped existing credentials. No public registry state or permission is established by a recipe."
+          : `Review ${item.registry === "vcpkg" ? "the chosen vcpkg registry repository, baseline, port and version database" : "CMake install/export, package config, CPack and GitHub Release workflow"}; validate installation and a consumer in CI. Provider lookup/setup is unsupported until the destination is explicitly configured; publication remains unverified.`,
+    },
+  ];
+}

package/src/crates-api.mjs

@@ -350,11 +350,15 @@ export async function runCratesApiStep(session, step) {
   }
   const crate = plan.package.name;
   const domains = signInDomains(plan.registry);
-  let page = await session.automatedPage();
+  let page = await session.automatedPage(undefined, false, true);
   switch (step.id) {
     case "crates-sign-in": {
       await page.goto(CRATES_IO_URL);
-      if (!(await readSession(page)).signedIn) {
+      const saved = await readSession(page);
+      if (!saved.signedIn || !saved.emailVerified) {
+        page = await session.visiblePage();
+      }
+      if (!saved.signedIn) {
         // Whether imported or signed in by hand, the sign-in is this run's.
         conditions.add("crates-signed-in");
         if (await offerSignInImport(session, domains)) {
@@ -362,6 +366,9 @@ export async function runCratesApiStep(session, step) {
         }
       }
       await signIn(page, options);
+      console.log(
+        "Using your crates.io session to register trusted publishers; no action needed while API requests run.",
+      );
       return;
     }
     case "first-publish": {

package/src/credential-cycle.mjs

@@ -1,8 +1,13 @@
 /** Registry-specific policy; tokens are never a fallback for OIDC registries. */
 export function credentialPolicy(registry) {
-  if (
-    ["npm", "pypi", "crates-io", "rubygems", "nuget", "jsr"].includes(registry)
-  ) {
+  if (registry === "nuget") {
+    return {
+      mode: "oidc-with-token-fallback",
+      description:
+        "NuGet: NuGet/login OIDC first, retain provided fallback secrets; never create a persistent publishing key",
+    };
+  }
+  if (["npm", "pypi", "crates-io", "rubygems", "jsr"].includes(registry)) {
     return {
       mode: "trusted",
       description: `${registry}: trusted publishing; remove unused long-lived tokens after verification`,

package/src/default-browser.mjs

@@ -1,4 +1,4 @@
-import { exec } from "command-stream";
+import { exec } from "./exec.mjs";
 
 import { browserSources, catalogueName } from "./browser-catalogue.mjs";
 

package/src/default-scope.mjs

@@ -1,4 +1,4 @@
-import { exec } from "command-stream";
+import { exec } from "./exec.mjs";
 
 async function github(args) {
   try {