trustci 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hidetaka Okamoto
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,86 @@
+# trustci
+
+Bulk-register [npm Trusted Publishers](https://docs.npmjs.com/trusted-publishers/)
+across **all public packages in a monorepo** with a single command. Wraps
+`npm trust` and supports **GitHub Actions**, **GitLab CI/CD**, and **CircleCI**.
+
+Setting up trusted publishing one package at a time is tedious in a monorepo.
+`trustci` detects your workspace, finds every public package, and runs the right
+`npm trust <provider> …` for each.
+
+## Requirements
+
+- **npm** 11.5.1 or later (for `npm trust`)
+- **Node** 22.14.0 or later
+
+## Usage
+
+```bash
+# Preview the commands without running anything (recommended first step)
+npx trustci --dry-run --provider github --repo me/repo --file release.yml --allow-publish
+
+# Actually register (asks for confirmation unless -y)
+npx trustci --provider github --repo me/repo --file release.yml --allow-publish
+
+# List current trusted publishers for every public package
+npx trustci list
+```
+
+### Providers
+
+| Provider   | Required flags                                                                                  | Optional        |
+| ---------- | ---------------------------------------------------------------------------------------------- | --------------- |
+| `github`   | `--repo <owner/repo>` `--file <workflow>`                                                       | `--env <name>`  |
+| `gitlab`   | `--project <group/project>` (or `--repo`) `--file <workflow>`                                   | `--env <name>`  |
+| `circleci` | `--org-id` `--project-id` `--pipeline-definition-id` `--vcs-origin <url>`                        | `--context-id` (repeatable) |
+
+At least one of `--allow-publish` / `--allow-stage-publish` is required.
+
+```bash
+# GitLab
+npx trustci --provider gitlab --project me/repo --file .gitlab-ci.yml --allow-publish -y
+
+# CircleCI (vcs-origin must include the protocol)
+npx trustci --provider circleci \
+  --org-id <uuid> --project-id <uuid> --pipeline-definition-id <uuid> \
+  --vcs-origin https://github.com/me/repo \
+  --context-id <uuid> \
+  --allow-publish
+```
+
+### Common options
+
+| Flag                     | Description                                          |
+| ------------------------ | --------------------------------------------------- |
+| `--dry-run`              | Print the `npm trust` commands without executing.   |
+| `--only <name-glob>`     | Only include packages matching (repeatable).        |
+| `--exclude <name-glob>`  | Exclude packages matching (repeatable).             |
+| `-y`, `--yes`            | Skip the confirmation prompt (and npm's).           |
+| `-h`, `--help`           | Show help.                                          |
+| `-v`, `--version`        | Show version.                                       |
+
+## Workspace detection
+
+Patterns are read from the first of:
+
+1. `pnpm-workspace.yaml` (`packages:`)
+2. `package.json` (`workspaces`)
+3. `lerna.json` (`packages`)
+
+Packages marked `"private": true` are always excluded. On a real (non-dry) run,
+packages not yet published to the registry are skipped with a warning.
+
+## Development
+
+Built with [Bun](https://bun.sh), ships zero runtime dependencies, and the
+published artifact is plain Node-compatible JS.
+
+```bash
+bun install
+bun test
+bun run build   # -> dist/cli.js (npx entry point), via `bun build --target node`
+```
+
+## License
+
+MIT

package/dist/cli.js

@@ -0,0 +1,636 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import process2 from "node:process";
+import { createInterface } from "node:readline/promises";
+
+// src/args.ts
+import { parseArgs } from "node:util";
+
+// src/types.ts
+var PROVIDERS = ["github", "gitlab", "circleci"];
+
+// src/args.ts
+class ArgError extends Error {
+}
+var options = {
+  provider: { type: "string" },
+  repo: { type: "string" },
+  project: { type: "string" },
+  env: { type: "string" },
+  file: { type: "string" },
+  "org-id": { type: "string" },
+  "project-id": { type: "string" },
+  "pipeline-definition-id": { type: "string" },
+  "vcs-origin": { type: "string" },
+  "context-id": { type: "string", multiple: true },
+  "allow-publish": { type: "boolean" },
+  "allow-stage-publish": { type: "boolean" },
+  "dry-run": { type: "boolean" },
+  only: { type: "string", multiple: true },
+  exclude: { type: "string", multiple: true },
+  yes: { type: "boolean", short: "y" },
+  help: { type: "boolean", short: "h" },
+  version: { type: "boolean", short: "v" }
+};
+function require_(value, flag, provider) {
+  if (!value)
+    throw new ArgError(`--${flag} is required for --provider ${provider}.`);
+  return value;
+}
+function parseCliArgs(argv) {
+  let values;
+  let positionals;
+  try {
+    const parsed = parseArgs({ args: argv, options, allowPositionals: true, strict: true });
+    values = parsed.values;
+    positionals = parsed.positionals;
+  } catch (err) {
+    throw new ArgError(err.message);
+  }
+  if (values.help)
+    return { kind: "help" };
+  if (values.version)
+    return { kind: "version" };
+  const dryRun = values["dry-run"] === true;
+  const sub = positionals[0];
+  if (sub === "list") {
+    return { kind: "list", pkg: positionals[1], dryRun };
+  }
+  if (sub === "trust") {
+    if (positionals.length > 1) {
+      throw new ArgError(`Unexpected argument "${positionals[1]}" after "trust".`);
+    }
+  } else if (sub !== undefined) {
+    throw new ArgError(`Unknown command "${sub}". Did you mean "list" or "trust", or did you forget --provider?`);
+  }
+  const provider = values.provider;
+  if (!provider)
+    throw new ArgError("--provider is required (github | gitlab | circleci).");
+  if (!PROVIDERS.includes(provider)) {
+    throw new ArgError(`Unknown provider "${provider}". Must be one of: ${PROVIDERS.join(", ")}.`);
+  }
+  const common = {
+    allowPublish: values["allow-publish"] === true,
+    allowStagePublish: values["allow-stage-publish"] === true,
+    yes: values.yes === true
+  };
+  if (!common.allowPublish && !common.allowStagePublish) {
+    throw new ArgError("At least one of --allow-publish or --allow-stage-publish is required.");
+  }
+  let providerOptions;
+  switch (provider) {
+    case "github":
+      providerOptions = {
+        provider: "github",
+        repo: require_(values.repo, "repo", "github"),
+        file: require_(values.file, "file", "github"),
+        env: values.env,
+        ...common
+      };
+      break;
+    case "gitlab": {
+      const project = values.project ?? values.repo;
+      providerOptions = {
+        provider: "gitlab",
+        project: require_(project, "project", "gitlab"),
+        file: require_(values.file, "file", "gitlab"),
+        env: values.env,
+        ...common
+      };
+      break;
+    }
+    case "circleci": {
+      const vcsOrigin = require_(values["vcs-origin"], "vcs-origin", "circleci");
+      if (!vcsOrigin.includes("://")) {
+        throw new ArgError(`--vcs-origin must include a protocol, e.g. https://github.com/org/repo (got "${vcsOrigin}").`);
+      }
+      providerOptions = {
+        provider: "circleci",
+        orgId: require_(values["org-id"], "org-id", "circleci"),
+        projectId: require_(values["project-id"], "project-id", "circleci"),
+        pipelineDefinitionId: require_(values["pipeline-definition-id"], "pipeline-definition-id", "circleci"),
+        vcsOrigin,
+        contextIds: values["context-id"] ?? [],
+        ...common
+      };
+      break;
+    }
+  }
+  return {
+    kind: "trust",
+    options: providerOptions,
+    dryRun,
+    only: values.only ?? [],
+    exclude: values.exclude ?? []
+  };
+}
+
+// src/exec.ts
+import { spawnSync } from "node:child_process";
+function run(cmd, args) {
+  const res = spawnSync(cmd, args, { encoding: "utf8" });
+  return {
+    status: res.status ?? (res.error || res.signal ? 1 : 0),
+    stdout: res.stdout ?? "",
+    stderr: res.stderr ?? ""
+  };
+}
+function runInherit(cmd, args) {
+  const res = spawnSync(cmd, args, { stdio: "inherit" });
+  return res.status ?? (res.error || res.signal ? 1 : 0);
+}
+
+// src/npm.ts
+var MIN_NODE = "22.14.0";
+var MIN_NPM = "11.5.1";
+function cmpVersion(a, b) {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+  for (let i = 0;i < 3; i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0)
+      return d > 0 ? 1 : -1;
+  }
+  return 0;
+}
+function getNpmVersion() {
+  const r = run("npm", ["--version"]);
+  if (r.status !== 0)
+    return null;
+  const v = r.stdout.trim();
+  return v || null;
+}
+function checkVersions() {
+  const node = process.versions.node;
+  if (cmpVersion(node, MIN_NODE) < 0) {
+    return `trustci requires Node ${MIN_NODE} or later (found ${node}).`;
+  }
+  const npm = getNpmVersion();
+  if (!npm) {
+    return "Could not determine the npm version. Is npm installed and on your PATH?";
+  }
+  if (cmpVersion(npm, MIN_NPM) < 0) {
+    return `trustci requires npm ${MIN_NPM} or later for trusted publishing (found ${npm}).
+` + "Update with: npm install -g npm@latest";
+  }
+  return null;
+}
+function isPublished(name) {
+  const r = run("npm", ["view", name, "version"]);
+  if (r.status === 0) {
+    return r.stdout.trim().length > 0;
+  }
+  const out = `${r.stderr}
+${r.stdout}`;
+  if (out.includes("E404") || out.includes("404 Not Found")) {
+    return false;
+  }
+  throw new Error(`failed to check the registry for ${name}: ${r.stderr.trim() || "unknown error"}`);
+}
+function commonFlags(o) {
+  const a = [];
+  if (o.allowPublish)
+    a.push("--allow-publish");
+  if (o.allowStagePublish)
+    a.push("--allow-stage-publish");
+  if (o.yes)
+    a.push("-y");
+  return a;
+}
+function buildTrustArgs(o, pkg) {
+  const args = ["trust", o.provider, pkg];
+  switch (o.provider) {
+    case "github":
+      args.push("--repository", o.repo, "--file", o.file);
+      if (o.env)
+        args.push("--environment", o.env);
+      break;
+    case "gitlab":
+      args.push("--project", o.project, "--file", o.file);
+      if (o.env)
+        args.push("--environment", o.env);
+      break;
+    case "circleci":
+      args.push("--org-id", o.orgId, "--project-id", o.projectId, "--pipeline-definition-id", o.pipelineDefinitionId, "--vcs-origin", o.vcsOrigin);
+      for (const c of o.contextIds)
+        args.push("--context-id", c);
+      break;
+  }
+  args.push(...commonFlags(o));
+  return args;
+}
+function shellQuote(s) {
+  return /^[A-Za-z0-9_@%/:.,=+-]+$/.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
+}
+function displayCommand(args) {
+  return ["npm", ...args].map(shellQuote).join(" ");
+}
+
+// src/workspace.ts
+import { existsSync, readFileSync } from "node:fs";
+import path2 from "node:path";
+
+// src/glob.ts
+import { readdirSync } from "node:fs";
+import path from "node:path";
+var ALWAYS_IGNORE = new Set(["node_modules", ".git", "dist", "build", "coverage", ".turbo"]);
+function escape(s) {
+  return s.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+}
+function compilePathGlob(pattern) {
+  const segments = pattern.replace(/\/+$/, "").split("/");
+  const parts = [];
+  for (let i = 0;i < segments.length; i++) {
+    const seg = segments[i];
+    if (seg === "**") {
+      parts.push("(?:.*/)?");
+      if (i < segments.length - 1)
+        continue;
+      parts[parts.length - 1] = "(?:.*)?";
+      break;
+    }
+    const segRe = escape(seg).replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]");
+    parts.push(segRe);
+    if (i < segments.length - 1)
+      parts.push("/");
+  }
+  let body = parts.join("").replace(/\(\?:\.\*\/\)\?\//g, "(?:.*/)?");
+  if (body.endsWith("/(?:.*)?")) {
+    body = `${body.slice(0, -"/(?:.*)?".length)}(?:/.*)?`;
+  }
+  return new RegExp(`^${body}$`);
+}
+function collectDirs(root) {
+  const out = [];
+  const walk = (abs, rel) => {
+    let entries;
+    try {
+      entries = readdirSync(abs, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory())
+        continue;
+      if (ALWAYS_IGNORE.has(entry.name))
+        continue;
+      const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+      out.push(childRel);
+      walk(path.join(abs, entry.name), childRel);
+    }
+  };
+  walk(root, "");
+  return out;
+}
+function expandPatterns(root, patterns) {
+  const positives = [];
+  const negatives = [];
+  for (const raw of patterns) {
+    const pattern = raw.trim();
+    if (!pattern)
+      continue;
+    if (pattern.startsWith("!")) {
+      negatives.push(compilePathGlob(pattern.slice(1)));
+    } else {
+      positives.push(compilePathGlob(pattern));
+    }
+  }
+  if (positives.length === 0)
+    return [];
+  const dirs = collectDirs(root);
+  const matched = new Set;
+  for (const rel of dirs) {
+    if (positives.some((re) => re.test(rel)) && !negatives.some((re) => re.test(rel))) {
+      matched.add(rel);
+    }
+  }
+  return [...matched].sort().map((rel) => path.resolve(root, rel));
+}
+function matchName(pattern, name) {
+  const re = new RegExp(`^${escape(pattern).replace(/\*/g, ".*").replace(/\?/g, ".")}$`);
+  return re.test(name);
+}
+
+// src/workspace.ts
+function stripComment(line) {
+  let inSingle = false;
+  let inDouble = false;
+  for (let i = 0;i < line.length; i++) {
+    const c = line[i];
+    if (c === "'" && !inDouble)
+      inSingle = !inSingle;
+    else if (c === '"' && !inSingle)
+      inDouble = !inDouble;
+    else if (c === "#" && !inSingle && !inDouble)
+      return line.slice(0, i);
+  }
+  return line;
+}
+function unquote(s) {
+  const t = s.trim();
+  if (t.length >= 2 && (t[0] === '"' && t.at(-1) === '"' || t[0] === "'" && t.at(-1) === "'")) {
+    return t.slice(1, -1);
+  }
+  return t;
+}
+function parseFlowArray(s) {
+  const open = s.indexOf("[");
+  const close = s.lastIndexOf("]");
+  if (open === -1 || close === -1)
+    return [];
+  return s.slice(open + 1, close).split(",").map((x) => unquote(x)).filter(Boolean);
+}
+function parsePnpmPackages(content) {
+  const lines = content.split(/\r?\n/);
+  const result = [];
+  let inBlock = false;
+  for (const rawLine of lines) {
+    const line = stripComment(rawLine);
+    const trimmed = line.trim();
+    if (!trimmed)
+      continue;
+    if (!inBlock) {
+      const m = /^packages\s*:\s*(.*)$/.exec(trimmed);
+      if (!m)
+        continue;
+      const rest = (m[1] ?? "").trim();
+      if (rest.startsWith("["))
+        return parseFlowArray(rest);
+      inBlock = true;
+      continue;
+    }
+    if (trimmed.startsWith("-")) {
+      const val = unquote(trimmed.slice(1).trim());
+      if (val)
+        result.push(val);
+    } else {
+      break;
+    }
+  }
+  return result;
+}
+function readJson(file) {
+  return JSON.parse(readFileSync(file, "utf8"));
+}
+function readJsonSafe(file) {
+  try {
+    const json = readJson(file);
+    return json && typeof json === "object" ? json : null;
+  } catch {
+    return null;
+  }
+}
+function detectPatterns(root) {
+  const pnpmFile = path2.join(root, "pnpm-workspace.yaml");
+  if (existsSync(pnpmFile)) {
+    const patterns = parsePnpmPackages(readFileSync(pnpmFile, "utf8"));
+    if (patterns.length > 0)
+      return { source: "pnpm-workspace.yaml", patterns };
+  }
+  const pkgFile = path2.join(root, "package.json");
+  if (existsSync(pkgFile)) {
+    const json = readJsonSafe(pkgFile);
+    if (json) {
+      const ws = json.workspaces;
+      const patterns = Array.isArray(ws) ? ws : Array.isArray(ws?.packages) ? ws.packages : [];
+      if (patterns.length > 0)
+        return { source: "package.json (workspaces)", patterns };
+    }
+  }
+  const lernaFile = path2.join(root, "lerna.json");
+  if (existsSync(lernaFile)) {
+    const json = readJsonSafe(lernaFile);
+    if (json) {
+      const patterns = Array.isArray(json.packages) ? json.packages : ["packages/*"];
+      if (patterns.length > 0)
+        return { source: "lerna.json", patterns };
+    }
+  }
+  return { source: "none", patterns: [] };
+}
+function readPkg(dir) {
+  const file = path2.join(dir, "package.json");
+  if (!existsSync(file))
+    return null;
+  const json = readJsonSafe(file);
+  if (!json || typeof json.name !== "string" || !json.name)
+    return null;
+  return {
+    name: json.name,
+    version: typeof json.version === "string" ? json.version : undefined,
+    private: json.private === true,
+    dir
+  };
+}
+function discoverPackages(root) {
+  const { source, patterns } = detectPatterns(root);
+  const dirs = expandPatterns(root, patterns);
+  const all = [];
+  const seen = new Set;
+  for (const dir of dirs) {
+    const pkg = readPkg(dir);
+    if (pkg && !seen.has(pkg.name)) {
+      seen.add(pkg.name);
+      all.push(pkg);
+    }
+  }
+  return { source, patterns, all };
+}
+function filterPackages(all, only, exclude) {
+  return all.filter((pkg) => {
+    if (pkg.private)
+      return false;
+    if (only.length > 0 && !only.some((p) => matchName(p, pkg.name)))
+      return false;
+    if (exclude.some((p) => matchName(p, pkg.name)))
+      return false;
+    return true;
+  });
+}
+
+// src/cli.ts
+var VERSION = "0.1.0";
+var HELP = `trustci — bulk-register npm Trusted Publishers across a monorepo
+
+Usage:
+  trustci [trust] --provider <github|gitlab|circleci> [provider flags] [options]
+  trustci list [package] [--dry-run]
+
+Providers:
+  github     --repo <owner/repo> --file <workflow> [--env <name>]
+  gitlab     --project <group/project> --file <workflow> [--env <name>]
+             (--repo is accepted as an alias for --project)
+  circleci   --org-id <uuid> --project-id <uuid> --pipeline-definition-id <uuid>
+             --vcs-origin <url> [--context-id <uuid> ...]
+
+Permissions (at least one required):
+  --allow-publish           allow npm publish
+  --allow-stage-publish     allow npm stage publish
+
+Options:
+  --dry-run                 print the npm trust commands without executing them
+  --only <name-glob>        only include packages matching (repeatable)
+  --exclude <name-glob>     exclude packages matching (repeatable)
+  -y, --yes                 skip the confirmation prompt (and npm's)
+  -h, --help                show this help
+  -v, --version             show the trustci version
+
+Workspaces are detected from pnpm-workspace.yaml, package.json "workspaces",
+or lerna.json. Private packages ("private": true) are always excluded.
+
+Examples:
+  trustci --dry-run --provider github --repo me/repo --file release.yml --allow-publish
+  trustci --provider gitlab --project me/repo --file .gitlab-ci.yml --allow-publish -y
+  trustci --provider circleci --org-id <uuid> --project-id <uuid> \\
+    --pipeline-definition-id <uuid> --vcs-origin https://github.com/me/repo --allow-publish
+  trustci list
+`;
+async function confirm(question) {
+  const rl = createInterface({ input: process2.stdin, output: process2.stderr });
+  try {
+    const answer = (await rl.question(`${question} [y/N] `)).trim().toLowerCase();
+    return answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+async function runList(pkg, dryRun) {
+  const targets = [];
+  if (pkg) {
+    targets.push(pkg);
+  } else {
+    const { all, source } = discoverPackages(process2.cwd());
+    const pub = filterPackages(all, [], []);
+    if (pub.length === 0) {
+      console.error(`No public workspace packages found (detected via ${source}).`);
+      return 1;
+    }
+    targets.push(...pub.map((p) => p.name));
+  }
+  let failures = 0;
+  for (const name of targets) {
+    const args = ["trust", "list", name];
+    if (dryRun) {
+      console.log(displayCommand(args));
+    } else {
+      console.error(`
+$ ${displayCommand(args)}`);
+      if (runInherit("npm", args) !== 0)
+        failures++;
+    }
+  }
+  return failures > 0 ? 1 : 0;
+}
+async function runTrust(parsed) {
+  const root = process2.cwd();
+  const { all, source } = discoverPackages(root);
+  if (all.length === 0) {
+    console.error(`No workspace packages found (detected via ${source}).`);
+    return 1;
+  }
+  const candidates = filterPackages(all, parsed.only, parsed.exclude);
+  if (candidates.length === 0) {
+    console.error(`No public packages matched (out of ${all.length} discovered via ${source}).`);
+    return 1;
+  }
+  console.error(`Detected ${all.length} package(s) via ${source}; ${candidates.length} public after filters.`);
+  const provider = parsed.options.provider;
+  if (parsed.dryRun) {
+    console.log(`
+# ${candidates.length} command(s) for provider "${provider}" (dry run):
+`);
+    for (const pkg of candidates) {
+      console.log(displayCommand(buildTrustArgs(parsed.options, pkg.name)));
+    }
+    console.error(`
+(dry run — registry publish-state was not checked and nothing was executed)`);
+    return 0;
+  }
+  const targets = [];
+  for (const pkg of candidates) {
+    try {
+      if (isPublished(pkg.name)) {
+        targets.push(pkg);
+      } else {
+        console.warn(`skip ${pkg.name}: not published to the registry yet`);
+      }
+    } catch (err) {
+      console.error(`error: ${err.message}`);
+      return 1;
+    }
+  }
+  if (targets.length === 0) {
+    console.error("Nothing to do: no published packages to register.");
+    return 1;
+  }
+  console.error(`
+Will register ${targets.length} package(s) with ${provider}:`);
+  for (const pkg of targets)
+    console.error(`  - ${pkg.name}`);
+  if (!parsed.options.yes) {
+    if (!process2.stdin.isTTY) {
+      console.error("error: confirmation required but stdin is not a TTY. Pass --yes (-y) to run non-interactively.");
+      return 1;
+    }
+    if (!await confirm(`
+Proceed?`)) {
+      console.error("Aborted.");
+      return 1;
+    }
+  }
+  let failures = 0;
+  for (const pkg of targets) {
+    const args = buildTrustArgs(parsed.options, pkg.name);
+    console.error(`
+$ ${displayCommand(args)}`);
+    const code = runInherit("npm", args);
+    if (code !== 0) {
+      failures++;
+      console.error(`  ${pkg.name}: failed (exit ${code})`);
+    }
+  }
+  console.error(`
+Done. ${targets.length - failures} succeeded, ${failures} failed.`);
+  return failures > 0 ? 1 : 0;
+}
+async function main() {
+  let parsed;
+  try {
+    parsed = parseCliArgs(process2.argv.slice(2));
+  } catch (err) {
+    if (err instanceof ArgError) {
+      console.error(`error: ${err.message}
+`);
+      console.error(HELP);
+      return 1;
+    }
+    throw err;
+  }
+  if (parsed.kind === "help") {
+    console.log(HELP);
+    return 0;
+  }
+  if (parsed.kind === "version") {
+    console.log(VERSION);
+    return 0;
+  }
+  const verr = checkVersions();
+  if (verr) {
+    if (parsed.dryRun) {
+      console.error(`warning: ${verr}
+(continuing because --dry-run does not execute npm)
+`);
+    } else {
+      console.error(`error: ${verr}`);
+      return 1;
+    }
+  }
+  return parsed.kind === "list" ? runList(parsed.pkg, parsed.dryRun) : runTrust(parsed);
+}
+main().then((code) => {
+  process2.exitCode = code;
+}, (err) => {
+  console.error(err);
+  process2.exitCode = 1;
+});

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "trustci",
+  "version": "0.1.0",
+  "description": "Bulk-register npm Trusted Publishers (npm trust) across all public packages in a monorepo. Supports GitHub, GitLab and CircleCI.",
+  "type": "module",
+  "bin": {
+    "trustci": "dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22.14.0",
+    "npm": ">=11.5.1"
+  },
+  "scripts": {
+    "build": "bun build src/cli.ts --target node --outfile dist/cli.js",
+    "test": "bun test",
+    "prepublishOnly": "bun run build"
+  },
+  "keywords": [
+    "npm",
+    "trusted-publishing",
+    "trusted-publisher",
+    "oidc",
+    "monorepo",
+    "cli",
+    "npm-trust",
+    "github-actions",
+    "gitlab",
+    "circleci"
+  ],
+  "license": "MIT",
+  "devDependencies": {
+    "@types/bun": "latest",
+    "typescript": "^5"
+  }
+}