package-registry-manager 0.25.0 → 0.26.0

package/src/extra-flows.mjs

@@ -1,8 +1,12 @@
+import { credentialRequirements } from "./credential-requirements.mjs";
 import { credentialSteps } from "./credential-cycle.mjs";
 import { tokenSecretSteps } from "./tokens.mjs";
 
 /** Additional OIDC registries never fall back to a stored publishing token. */
 export function trustedFlow(item, context) {
+  if (item.registry === "nuget") {
+    return nugetFlow(item, context);
+  }
   const specs = {
     rubygems: [
       "gem",
@@ -73,16 +77,132 @@ export function tokenFlow(item) {
       ]
     : [];
   if (item.registry === "maven-central") {
+    const group = /^([\w.-]+):/.exec(item.name ?? "")?.[1];
     steps.push({
       id: "verify-namespace",
-      title: "Verify a Central namespace",
+      title: `Verify the Central namespace${group ? ` ${group}` : ""}`,
       kind: "browser",
       description:
-        "Sign in to the Central Portal and verify the namespace used by the package coordinates.",
+        "Sign in to the Central Portal and verify the namespace used by the package coordinates. Publishing stays blocked until the namespace reads back as verified.",
       url: "https://central.sonatype.com/publishing/namespaces",
+      ...(group ? { namespace: group } : {}),
+      state: "manual-prerequisite",
     });
+    return steps.concat(mavenCredentialSteps(item));
   }
   return steps.concat(
     credentialSteps(item.registry, item.token_secrets?.[0] ?? item.registry),
   );
 }
+
+/**
+ * Central publishing needs a provider-specific pair plus signing material; no
+ * OIDC is claimed. Missing secrets are requested, present ones are kept, and
+ * nothing is rotated or revoked.
+ */
+export function mavenCredentialSteps(item) {
+  const requirements =
+    item.credential_requirements ?? credentialRequirements("maven-central");
+  const pick = (...roles) =>
+    requirements.secrets.filter((entry) => roles.includes(entry.role));
+  const describe = (entries) =>
+    entries.map((entry) => entry.secret).join(" + ");
+  const pair = pick("central-username", "central-token");
+  const signing = pick("gpg-private-key", "gpg-passphrase");
+  return [
+    {
+      id: "ensure-central-credential-pair",
+      title: `Ensure the Central user-token pair ${describe(pair)}`,
+      kind: "api",
+      confirm: true,
+      secrets: pair,
+      oidc: "unsupported",
+      description: `${requirements.oidc_note} Generate a Central Portal user token (username + password pair) only when ${describe(pair)} is missing, hold the values in memory, and store them as encrypted GitHub secrets through gh-manager. Existing secrets are kept; nothing is rotated or revoked.`,
+      url: "https://central.sonatype.com/usertoken",
+    },
+    {
+      id: "ensure-signing-key",
+      title: `Ensure the signing prerequisites ${describe(signing)}`,
+      kind: "manual",
+      confirm: true,
+      secrets: signing,
+      state: "manual-prerequisite",
+      description:
+        "Maven Central rejects unsigned artifacts. Provide an armored GPG private key whose public key is on a public keyserver, and its passphrase, as encrypted GitHub secrets; keys are never written to disk or printed.",
+    },
+  ];
+}
+
+/** Public Packagist: tags plus hook or update API; no OIDC, explicit states otherwise. */
+export function packagistSteps(item) {
+  const requirements =
+    item.credential_requirements ?? credentialRequirements("packagist");
+  const api = requirements.secrets;
+  const referenced = api.every((entry) => entry.referenced);
+  return [
+    {
+      id: "verify-packagist-package",
+      title: "Read back the Packagist package and exact stable tag",
+      kind: "check",
+      description: `Read https://repo.packagist.org/p2/${item.name}.json and require the exact stable version ${item.version ?? "(unresolved)"} from a tag; dev branches do not count.`,
+      url: `https://packagist.org/packages/${item.name}`,
+    },
+    {
+      id: "packagist-github-hook",
+      title: "Confirm the Packagist GitHub integration",
+      kind: "manual",
+      state: "manual-prerequisite",
+      description:
+        'Packagist updates on tag pushes through its GitHub hook/app integration. GitHub does not expose that installation to this tool, so confirm it on the package page (no "not auto-updated" warning).',
+      url: `https://packagist.org/packages/${item.name}`,
+    },
+    {
+      id: "packagist-update-api",
+      title: referenced
+        ? `Keep the update-package API path ${api.map((entry) => entry.secret).join(" + ")}`
+        : "Packagist update-package API is not configured",
+      kind: "manual",
+      state: referenced ? "configured" : "unsupported-without-credentials",
+      secrets: api,
+      oidc: "unsupported",
+      description: `${requirements.oidc_note} ${referenced ? "The workflow calls the update-package API; keep both secrets as encrypted GitHub secrets. Nothing is rotated or revoked." : "Rely on the GitHub hook, or add PACKAGIST_USERNAME and PACKAGIST_TOKEN (Packagist profile API token) as encrypted GitHub secrets for the update-package API."}`,
+      url: "https://packagist.org/profile/",
+    },
+  ];
+}
+
+/** NuGet uses explicit account policy and preserves provided fallback credentials. */
+export function nugetFlow(item, context) {
+  return [
+    {
+      id: "validate-package",
+      title: "Validate NuGet package",
+      kind: "check",
+      description:
+        "Build and test the selected project before configuration; do not upload.",
+      command: {
+        program: "dotnet",
+        args: [
+          "test",
+          item.manifest.split("/").at(-1),
+          "--configuration",
+          "Release",
+        ],
+      },
+    },
+    {
+      id: "configure-nuget-policy",
+      title: "Verify exact NuGet trusted publishing policy",
+      kind: "api",
+      description:
+        "Read explicit nuget.username, package_owner, package_ids and operations from .package-registry-manager.json; resolve immutable GitHub IDs, verify the authenticated profile, discover before creating a narrow policy, read activation back and ensure effective NUGET_USER through gh-manager. Retain existing fallback secrets.",
+    },
+    {
+      id: "verify-nuget-release",
+      title: "Verify NuGet CI and exact public consumer",
+      kind: "api",
+      description: `Verify ${context.workflow}: successful OIDC exchange and actual upload are separate gates. Retain existing token fallbacks. Require the repaired current-main revision, every required build/test/documentation/mirror/release stage, exact public package download and consumer restore/build. A skipped stage or placeholder remains incomplete.`,
+    },
+    ...(context.slug ? tokenSecretSteps(item, context.slug) : []),
+  ];
+}

package/src/flows.mjs

@@ -244,6 +244,11 @@ export function npmFlow(packageInfo, context) {
     name,
     "--browser=false",
   ]);
+  const artifact =
+    packageInfo.generated_alias ?? packageInfo.generated_artifact;
+  const packCwd = artifact
+    ? "{generated_package}"
+    : packageCwd(context.directory);
   const steps = [
     step(
       "validate-package",
@@ -276,6 +281,17 @@ export function npmFlow(packageInfo, context) {
       { command: command("npm", ["whoami"]) },
     ),
     ...worktreeSteps(),
+    ...(artifact
+      ? [
+          step(
+            "prepare-generated-artifact",
+            "Generate the selected npm artifact",
+            "check",
+            "Run the declared generator in the clean checkout and validate the generated name/version before packing.",
+            { when: "package-missing" },
+          ),
+        ]
+      : []),
     step(
       "pack",
       "Pack the package",
@@ -290,7 +306,7 @@ export function npmFlow(packageInfo, context) {
           "{pack_destination}",
         ]),
         when: "package-missing",
-        cwd: packageCwd(context.directory),
+        cwd: packCwd,
       },
     ),
     step(
@@ -337,7 +353,7 @@ export function npmFlow(packageInfo, context) {
           "--provenance=false",
         ]),
         when: "package-missing",
-        cwd: packageCwd(context.directory),
+        cwd: packCwd,
       },
     ),
     // Sign in right before publishing, so the sign-in, publish, and trust
@@ -373,7 +389,7 @@ export function npmFlow(packageInfo, context) {
           "--provenance=false",
         ]),
         when: "package-missing",
-        cwd: packageCwd(context.directory),
+        cwd: packCwd,
         confirm: true,
       },
     ),

package/src/generated-artifact.mjs

@@ -0,0 +1,48 @@
+import path from "node:path";
+import { readFile, realpath } from "node:fs/promises";
+
+/** Generate each declared artifact, then pack only the selected validated directory. */
+export async function prepareGeneratedArtifact(session) {
+  const item = session.plan.package;
+  const metadata = item.generated_alias ?? item.generated_artifact;
+  if (!metadata?.generator) {
+    throw new Error(
+      "generated npm artifact has no declared generator; configure it before bootstrap",
+    );
+  }
+  const source = await realpath(
+    path.resolve(session.values.worktree, path.dirname(item.manifest)),
+  );
+  const generator = await realpath(path.resolve(source, metadata.generator));
+  if (!generator.startsWith(`${source}${path.sep}`)) {
+    throw new Error("npm artifact generator must be inside the source package");
+  }
+  const destination = path.join(session.values.pack_destination, "generated");
+  for (const command of [
+    {
+      program: "npm",
+      args: ["ci", "--ignore-scripts", "--no-audit", "--no-fund"],
+    },
+    { program: "node", args: [generator, "--output-dir", destination] },
+  ]) {
+    const result = await session.capture({ command, cwd: source });
+    if (result.code !== 0) {
+      throw new Error(
+        `${command.program} failed while generating npm artifacts`,
+      );
+    }
+  }
+  const selected = await realpath(path.resolve(destination, item.name));
+  if (!selected.startsWith(`${await realpath(destination)}${path.sep}`)) {
+    throw new Error("invalid generated package path");
+  }
+  const actual = JSON.parse(
+    await readFile(path.join(selected, "package.json"), "utf8"),
+  );
+  if (actual.name !== item.name || actual.version !== item.version) {
+    throw new Error(
+      "generated artifact identity/version differs from inspection; nothing was published",
+    );
+  }
+  session.values.generated_package = selected;
+}

package/src/github.mjs

@@ -6,6 +6,8 @@ import {
   createRunManager,
   createSecretHealth,
   createSecretManager,
+  createVariableManager,
+  createRepairVerifier,
 } from "@link-foundation/gh-manager";
 
 /** GitHub-only operations, supplied by the installed gh-manager library. */
@@ -32,6 +34,8 @@ export function githubServices(options = {}) {
     repos: createRepoManager(context),
     runs: createRunManager(context),
     health: createSecretHealth(context),
+    variables: (scope) => createVariableManager({ ...context, scope }),
+    repair: createRepairVerifier(context),
     secrets: (scope) => {
       if (typeof scope.repo === "string") {
         const [owner, name, extra] = scope.repo.split("/");

package/src/identity-conflicts.mjs

@@ -0,0 +1,130 @@
+/** Registry normalization follows the registry's identity rules, not processing order. */
+export function registryIdentity(registry, name) {
+  const normalized = registry === "go-modules" ? name : name.toLowerCase();
+  return `${registry}:${registry === "pypi" ? normalized.replace(/[-_.]+/g, "-") : registry === "crates-io" ? normalized.replaceAll("_", "-") : normalized}`;
+}
+
+/** Keep all source evidence so a collision cannot be hidden by --package filtering. */
+export function identityConflicts(inspections) {
+  const groups = new Map();
+  for (const inspection of inspections) {
+    const repo = inspection.repository ?? {};
+    const repository =
+      repo.github_owner && repo.github_repository
+        ? `${repo.github_owner}/${repo.github_repository}`
+        : (repo.root ?? ".");
+    for (const item of inspection.packages.filter((p) => p.publishable)) {
+      const identity = registryIdentity(item.registry, item.name);
+      const source = {
+        repository,
+        manifest: item.manifest,
+        source_artifact: item.generated_alias?.source_manifest ?? item.manifest,
+        version: item.version,
+        registry_repository: item.registry_repository,
+        registry_owners: item.registry_owners,
+        permissions: "unknown",
+        shared_artifact: item.shared_artifact,
+      };
+      if (!groups.has(identity)) {
+        groups.set(identity, []);
+      }
+      const group = groups.get(identity);
+      if (
+        !group.some(
+          (entry) =>
+            entry.repository === repository && entry.manifest === item.manifest,
+        )
+      ) {
+        group.push(source);
+      }
+    }
+  }
+  return [...groups]
+    .filter(([, sources]) => sources.length > 1)
+    .map(([identity, sources]) => ({ identity, sources }));
+}
+
+/** Annotate each source before selection or external mutation. */
+export function markIdentityConflicts(inspections) {
+  const conflicts = identityConflicts(inspections);
+  for (const inspection of inspections) {
+    for (const item of inspection.packages) {
+      const conflict = conflicts.find(
+        (group) =>
+          group.identity === registryIdentity(item.registry, item.name),
+      );
+      if (conflict) {
+        item.identity_conflicts = conflict.sources;
+      }
+    }
+  }
+  return conflicts;
+}
+
+export function validateIdentities(plans) {
+  const conflicts = identityConflicts(
+    plans.map((plan) => ({
+      repository: plan.repository,
+      packages: [plan.package],
+    })),
+  );
+  const annotated = plans.filter(
+    (plan) => plan.package.identity_conflicts?.length,
+  );
+  const unresolved = [
+    ...conflicts,
+    ...annotated.map((p) => ({
+      identity: registryIdentity(p.registry, p.package.name),
+      sources: p.package.identity_conflicts,
+    })),
+  ].filter((group) => !reviewedMapping(group, plans));
+  if (unresolved.length) {
+    throw new Error(
+      `conflicting package identities require distinct configured names before setup: ${JSON.stringify(unresolved)}`,
+    );
+  }
+}
+
+/** Require a complete, identical source/version inventory and one selected canonical publisher. */
+function reviewedMapping(group, plans) {
+  const mapping = group.sources[0].shared_artifact;
+  if (
+    !mapping?.reviewed ||
+    typeof mapping.artifact !== "string" ||
+    !mapping.artifact ||
+    !mapping.publisher ||
+    !Array.isArray(mapping.sources)
+  ) {
+    return false;
+  }
+  const key = (source) =>
+    JSON.stringify([
+      source.repository,
+      source.manifest,
+      source.version ?? null,
+    ]);
+  if (
+    new Set(mapping.sources.map(key)).size !== group.sources.length ||
+    !group.sources.every(
+      (source) =>
+        mapping.sources.some((entry) => key(entry) === key(source)) &&
+        JSON.stringify(source.shared_artifact) === JSON.stringify(mapping),
+    )
+  ) {
+    return false;
+  }
+  return plans
+    .filter(
+      (plan) =>
+        registryIdentity(plan.registry, plan.package.name) === group.identity,
+    )
+    .every((plan) => {
+      const repo = plan.repository;
+      return (
+        (repo.github_owner
+          ? `${repo.github_owner}/${repo.github_repository}`
+          : repo.root) === mapping.publisher.repository &&
+        plan.package.manifest === mapping.publisher.manifest
+      );
+    });
+}

package/src/manifest-proposal.mjs

@@ -1,7 +1,7 @@
 import { mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { exec } from "command-stream";
+import { exec } from "./exec.mjs";
 import {
   githubSlug,
   manifestUrls,

package/src/model.mjs

@@ -13,9 +13,15 @@ export const REGISTRIES = Object.freeze([
   "vscode-marketplace",
   "open-vsx",
   "chrome-web-store",
+  "cmake",
+  "conan",
+  "vcpkg",
 ]);
 
 const REGISTRY_ALIASES = new Map([
+  ["cmake", "cmake"],
+  ["conan", "conan"],
+  ["vcpkg", "vcpkg"],
   ["ruby", "rubygems"],
   ["rubygems", "rubygems"],
   ["gem", "rubygems"],

package/src/npm-release.mjs

@@ -0,0 +1,68 @@
+import { probePackage } from "./registry-state.mjs";
+import { repositorySlug } from "./repository-identity.mjs";
+
+/** The successful npm CLI line binds each name to the actual released version. */
+export function publishedNpmVersions(source, names) {
+  const result = new Map();
+  for (const match of source.matchAll(
+    /(?:^|\s)\+\s+((?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*)@([0-9][0-9A-Za-z.+-]*)(?=\s|$)/g,
+  )) {
+    if (names.includes(match[1])) {
+      result.set(match[1], match[2]);
+    }
+  }
+  return result;
+}
+
+/** Verify every generated name against its own exact public version after CI. */
+export async function verifyNpmRelease(session, runId) {
+  const item = session.plan.package;
+  const names = (item.generated_alias ?? item.generated_artifact)?.names ?? [
+    item.name,
+  ];
+  const slug = repositorySlug(session.plan.repository);
+  const capture = (args) =>
+    session.capture({
+      command: {
+        program: "gh",
+        args: ["run", "view", String(runId), "--repo", slug, ...args],
+      },
+      cwd: ".",
+    });
+  const result = await capture(["--json", "jobs"]);
+  if (result.code !== 0) {
+    throw new Error(
+      "release jobs are unavailable; exact alias versions remain unverified",
+    );
+  }
+  const versions = new Map();
+  for (const job of JSON.parse(result.stdout).jobs ?? []) {
+    const log = await capture(["--job", String(job.databaseId), "--log"]);
+    if (log.code !== 0) {
+      continue;
+    }
+    for (const entry of publishedNpmVersions(String(log.stdout), names)) {
+      versions.set(...entry);
+    }
+  }
+  const evidence = [];
+  for (const name of names) {
+    const version = versions.get(name);
+    if (!version) {
+      throw new Error(
+        `successful release log does not establish the actual version for ${name}`,
+      );
+    }
+    const state = await (session.options.probePackage ?? probePackage)(
+      { ...item, name, version },
+      session.options,
+    );
+    if (state.manifest_version_exists !== true) {
+      throw new Error(
+        `exact released version ${name}@${version} remains unverified`,
+      );
+    }
+    evidence.push({ name, version, url: state.version_evidence_url });
+  }
+  return evidence;
+}