CI's dylint job flagged the new crate against the `perfectionist` lint
library (which clippy does not run). Fix every finding:

- Reorder derive lists to the configured `prefix_then_alphabetical`
  order (`Debug, Default, Clone, ...`).
- Rename the single-letter `R` reporter generic to `Reporter`, bound as
  `self::Reporter`, matching the existing pacquet convention.
- Move the inline `mod tests { ... }` blocks for `capabilities`,
  `generate_qr_code`, and `web_auth_timeout_error` into external
  `tests.rs` files (the crate's `unit_test_file_layout` is `external_only`).
- Add trailing commas to multi-line macro invocations.

No behavior change. Verified clean with the same command CI runs:
`RUSTFLAGS='-D warnings' cargo dylint --all -- --all-targets --workspace`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RWejcxTU8n144a1KK4nRj8

The production `EnterKeyListener` used `spawn_blocking` + a blocking
`stdin().read_line()`, which cannot be cancelled: if the user never
pressed Enter (e.g. authentication completed via a phone QR scan), the
reader thread lingered until process exit. Replace it with a dedicated
thread that polls stdin with a 100ms timeout via `crossterm::event::poll`
and re-checks a cancel flag each tick, so dropping the handle stops the
thread within one poll interval.

`crossterm` reads in the terminal's default (cooked) mode — no raw mode —
matching pnpm's plain `readline.createInterface({ input: process.stdin })`,
which reacts to a submitted line rather than individual keypresses. In
Node, stdin is event-loop-driven so `rl.close()` needs no thread to
cancel; the poll loop is the Rust equivalent.

Adds `crossterm` to `[workspace.dependencies]`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RWejcxTU8n144a1KK4nRj8

A code review of the cancellable web-auth listener surfaced two items:

- The polling reader thread could consume one keystroke in the window
  between the handle being dropped (cancel flag set) and the thread
  noticing it: `event::poll` reports input, then `event::read` swallows a
  key meant for whatever reads stdin next. Re-check the cancel flag after
  poll and before read so a dropped handle leaves the input buffered,
  matching pnpm's clean `readline` close.
- Drop the redundant `Option<sender>`: the Enter arm returns right after
  sending, so the oneshot sender moves directly into `send()`.

Also document that the handle is meant to be raced and never resolves on a
stdin read error, so it must not be awaited on its own.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RWejcxTU8n144a1KK4nRj8

Review follow-up: keep the polling/cancel rationale on `HostEnterHandle`
(where `Drop` lives) and trim `listen`'s doc to its unique cooked-mode
detail; drop a select-arm comment sentence that restated automatic `Drop`
and the function's own doc comment.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RWejcxTU8n144a1KK4nRj8

…nale

Round-3 review follow-up:
- The `HostEnterHandle` doc blamed `std`'s blocking `read_line` for needing
  a poll loop, but the listener uses crossterm's `event::read()`
  (`read_line` was the pre-crossterm implementation). Name the real
  primitive.
- Drop the `listen` doc's reference to the private `HostEnterHandle` type
  (a public method's docs must not name a more-private item); point to "the
  returned handle" instead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RWejcxTU8n144a1KK4nRj8

Brings in 95 commits from main — pacquet command ports (pack, deploy,
config, audit, global install, completion, dist-tag, list/ls, and more),
pnpr fixes, the pnpm v12 rebrand, and version bumps. Only Cargo.lock
conflicted; resolved by taking main's lockfile and re-adding this branch's
network-web-auth subtree (crossterm, qrcode, open) via cargo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RWejcxTU8n144a1KK4nRj8

Port the `pnpm publish` command to Rust as the new `pacquet-publish` crate
and wire it into the CLI, faithfully reproducing pnpm's
`pnpm11/releasing/commands/src/publish` (upstream commit `54c5c0e028`).

The function-based dependency injection upstream uses (a `context` bag of
`fetch` / `Date.now` / `ci-info` / `process.env` / `execa` closures) is ported
to pacquet's trait-based seam: `self`-less capability traits (`OidcFetch`,
`EnvVar`, `CiInfo`, `Clock`, `RunCommand`, `ConfirmPrompt`) composed as bounds
on a single `Sys` type parameter, with the real OS behind `Host` and
`fn`-bound unit-struct fakes in the tests. The OTP / web-authentication flow
reuses the existing `pacquet-network-web-auth` seam.

What landed:

- OIDC trusted publishing: `oidc::get_id_token`, `oidc::fetch_auth_token`,
  `oidc::determine_provenance`, and the `fetch_token_and_provenance_by_oidc`
  precedence orchestration — each unit-tested through the capability fakes
  (the external-service happy paths a real fixture can't stage).
- The `libnpmpublish`-equivalent publish document builder and PUT, with OTP /
  web-auth challenge handling, plus token, OTP-env (`PNPM_CONFIG_OTP`) and
  `tokenHelper` support.
- Registry-config-key parsing, packed-tarball manifest extraction, the
  `npm publish --json` summary, the git working-tree / branch / remote checks,
  and the publish-lifecycle scripts (`prepublishOnly` / `prepublish` /
  `publish` / `postpublish`).
- A `publish` subcommand for the single-package and pre-built-tarball paths.

Scope not yet ported (errors clearly rather than diverging silently):

- `--recursive` / `--batch` workspace publishing.
- Signed provenance attestation generation (needs sigstore, which pacquet does
  not bundle); the OIDC-driven provenance *flag* is determined, but a `true`
  result is refused at publish time.

Running `cargo dylint` locally surfaced perfectionist findings the CI log had
not reached (it aborted on the earlier lib errors):

- `unit_test_file_layout`: move every inline `#[cfg(test)] mod tests { ... }`
  block into an external `tests.rs` sibling, matching the workspace convention.
- `macro_trailing_comma`: use the nested multi-line `assert!(matches!(...))`
  form (no trailing comma) and drop trailing commas from the now single-line
  `assert_eq!` calls that collapsed after de-indentation.
- `single_letter_generic` / single-letter closure params: rename the remaining
  one-letter closure bindings to descriptive names.

Correctness:
- Don't hard-fail a publish when provenance was only auto-detected by OIDC for
  a public CI repo. An explicit `--provenance` still errors (pacquet can't
  generate the attestation yet), but the auto-detected case now warns and
  publishes, matching what pnpm would do minus the attestation.
- Propagate a malformed package-visibility response as a hard error instead of
  silently treating it as "not public", matching the unguarded `response.json()`
  in the TS source.
- Collapse `.` / `..` segments when matching a tar entry against
  `package/package.json`, mirroring `path.normalize`.
- Honor a manifest-level `tag` over the default dist-tag, mirroring
  libnpmpublish's `manifest.tag || defaultTag`.

Cleanup:
- Reuse the tarball digests already computed for the summary instead of hashing
  the tarball a second time while building the publish document.
- Send the request body as `bytes::Bytes` so the megabytes-large body is not
  re-copied on each PUT (including the OTP retry).
- Drop the unused `is_stage` parameter from the document builder.

- Honor `--ignore-scripts` (and the `ignore-scripts` config setting) when
  packing for publish, not just for the publish-lifecycle scripts. Previously
  `prepack` / `prepare` / `postpack` still ran when the user asked for no
  scripts, because the pack step read only `config.ignore_scripts`.
- Broaden OTP challenge detection to match npm-registry-fetch: accept the `otp`
  token as a comma-separated entry of `WWW-Authenticate` (exact token, not a
  loose substring) and fall back to a `one-time pass` body, so 2FA works against
  registries that omit the header.

Self-review round 4 findings:

- clean_version now drops build metadata to match `semver.clean`, which
  returns SemVer.version (major.minor.patch[-prerelease], never +build).
  node_semver's Display appends +build, so a manifest version like
  `1.2.3+build` was being registered verbatim instead of as `1.2.3`.
- Hoist the explicit `--provenance` hard error ahead of the OIDC token
  exchange so a request that cannot be honored fails before performing
  authenticated network round-trips.
- Document that execute_token_helper is a faithful port that is not yet
  wired into the publish auth path: pacquet reuses the shared, pre-resolved
  AuthHeaders map, which has no per-registry tokenHelper slot. Wiring it is a
  config/network-layer change; a tokenHelper-only registry is currently
  unauthenticated on publish.

Brings in 3 commits from main: the cli_args.rs split (#12690,
CLI-only), plus the bytes and tower-http dependency-version bumps. Only
Cargo.lock conflicted; resolved by taking main's lockfile and re-adding this
branch's network-web-auth subtree (crossterm, qrcode, open) via cargo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RWejcxTU8n144a1KK4nRj8

pnpm's 2FA/OTP/web-auth tests build their mock context through one shared
test-helper package, reused by publish's otp.test.ts and login's
login.test.ts. Mirror that with pacquet-network-web-auth-testing: a
FakeHost implementing every web-auth capability (Clock, Sleep,
WebAuthFetch, PromptOtp, EnterKeyListener, the TTY probes, OpenUrl) over
thread-local script state, plus the recording/strict reporters, the
response builders, and a reusable FakeOtpError. Extracted verbatim from
network-web-auth's inline with_otp_handling test fakes so the
network-web-auth, publish, and future pacquet login tests share one
fake. No production code is touched.

Replace with_otp_handling's inline fakes with the shared
pacquet-network-web-auth-testing crate. Because a crate's own unit tests
cannot depend on a helper crate that depends back on it (the helper sees
the non-test build, so the two builds' types do not unify), move these
tests from the in-lib `mod tests` to tests/with_otp_handling.rs, where
the integration-test crate and the helper both link the same build. The
scenarios are unchanged; they now drive FakeHost / FakeOtpError from the
shared crate instead of file-local copies.

Add a Sys type parameter (the web-auth host: Clock + Sleep +
WebAuthFetch + the TTY probes + EnterKeyListener + OpenUrl + PromptOtp)
instead of hardcoding the real WebAuthHost, so a test can drive the OTP
orchestration with a fake host while the PUT still goes through a mocked
registry. Production passes the real host at the single call site; the
web-auth Clock is aliased to avoid colliding with the OIDC capability
Clock already imported here.

Drive publish_with_otp_handling through the full OTP flow with the shared
FakeHost on the web-auth side and mockito on the PUT side, distinguishing
the first attempt from the retry by the npm-otp header each carries.
Covers pnpm otp.test.ts's classic prompt-and-retry, second-challenge,
non-interactive, web-auth poll-then-retry, and timeout cases — verifying
the put_publish 401 classification feeds the with_otp_handling
orchestration and that the challenge OTP / web token reaches the retry
request, an integration a mocked operation cannot reach.

The production Host impls were the lowest-covered file. Cover the two
that carry real branching and are portably testable:

- OidcFetch::fetch against a mockito server: GET (accept/authorization
  headers + per-request timeout), POST (zero-length body), a non-2xx
  classified as a completed response, and a refused connection mapped to
  a transport error.
- RunCommand::run as a real subprocess (unix-gated, matching the crate's
  /bin/sh convention): stdout/success capture, non-zero exit, the cwd
  argument, and a missing program surfacing as an io::Error.

The remaining Host impls are left to their consumers' fake-Sys tests:
EnvVar/CiInfo/Clock are one-line passes through to std whose only test
seam is the process-global env/clock the Sys seam exists to avoid, and
ConfirmPrompt reads an interactive TTY.

Fix CI Format + Dylint on the coverage commits:

- rustfmt: collapse a one-line mockito mock builder in the Host fetch
  tests.
- dylint bare_identifier_reference: link the GhEnv/GlEnv doc references
  as intra-doc links.
- dylint macro_trailing_comma: add the trailing comma to the multi-line
  assert_eq! invocations in the OIDC orchestrator tests.

Verified with the CI commands: cargo fmt --check and
cargo dylint --all -- --all-targets --workspace (the --all-targets flag
the earlier scoped run omitted, which is why these slipped through).

The Dense1x2 renderer's default draws dark QR modules as block glyphs and
light modules as blank cells. On the usual light-on-dark terminal that
inverts the code — light modules appear lit, dark modules blank, and the
light quiet zone vanishes into the background — so it scans awkwardly and
looks nothing like pnpm's output.

pnpm renders through qrcode-terminal's small mode, which draws the light
modules (and the quiet zone) as the block glyphs and leaves dark modules
blank, showing dark modules inside a light frame. Swap the renderer's
dark and light colors to match that polarity exactly.

Addresses review #12691 (r3518711611): the shared crate held
module-level thread_local scenario state reconfigured by pub set_*
setters and read by a shared FakeHost — shared mutable state that
contradicts the DI convention (CODE_STYLE_GUIDE 'Dependency injection for
tests', principle 3: keep a stateful fake's state in a static inside each
#[test] body so tests never share or race).

Replace it with a web_auth_fake!() macro that expands, inside a test
body, to fn-local thread_local statics plus a local FakeHost (all eight
web-auth capabilities), the recording/strict reporters, and the reset /
set_* / infos / warns config fns. Nothing mutable lives at module scope.
The stateless helpers (InputResponse, SleepBehavior, FetchScript,
FakeOtpError, ok_202, ok_token, web_auth_body) stay pub. The
network-web-auth OTP integration tests and the publish OTP orchestration
tests invoke the macro at the top of each test; scenarios are unchanged.

Other module-level shared-mutable test statics found by a codebase scan
are tracked in #12779.

Close the smaller publish_packed_pkg holes CodeCov flagged:

- web_auth_fetch_options: the OidcHttpOptions -> WebAuthFetchOptions
  retry/timeout mapping.
- OtpError for PublishHttpError: an Otp variant surfaces a challenge, a
  Transport variant does not (the previously-uncovered None arm).
- the From<CreatePublishOptionsError> and From<WithOtpError> conversions
  into PublishPackedPkgError.

…references

Apply the #12737 paradigm to this branch's files: pacquet and
the TypeScript pnpm CLI are co-developed parallel implementations at
near-complete parity, neither downstream of the other, so comments
describe pacquet's own behavior rather than pointing at the TS source.

Removed the `/blob/` permalinks to the pnpm-org TypeScript repos and the
'Ports / Mirrors / matching the TS X' framing (cited TS symbols and files
like otp.test.ts, recursivePublish, generateProvenance, createReadline-
Interface, execa, libnpmpublish, sigstore-js), rewriting the affected
prose. Kept issue/PR references, pnpm-product mentions, shared-contract
identifiers (ERR_PNPM_* codes, the pnpm:global reporter channel, npm
registry terms), third-party attributions, and Rust intra-doc links.

Comment-only, except two incidental lint fixes to the new tests surfaced
while verifying (a Default field-reassign and a use-collapse).

Two publish-flow helpers CodeCov flagged, both registry-free:

- pack_for_publish: pack a tempdir package (scripts ignored) and assert a
  .tgz lands in the destination and the returned manifest is the packed
  one.
- run_publish_scripts: a declared prepublishOnly runs through sh -c in the
  package dir (unix-gated), and an all-absent script set is a no-op.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KtBQzmLLDU3RcGzzCMopPB

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KtBQzmLLDU3RcGzzCMopPB

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KtBQzmLLDU3RcGzzCMopPB

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KtBQzmLLDU3RcGzzCMopPB

Drive the real pacquet publish binary against a mockito registry, porting
the plain token-auth scenarios from pnpm's test/publish/publish.ts that
don't depend on OIDC / provenance / OTP: the package document + tarball
attachment, --dry-run uploading nothing, publishConfig.registry override,
--tag, scoped %2f-escaped path with --access, publishing a prebuilt
tarball, a missing-tarball error, --json summary, and the publish
lifecycle scripts (run and --ignore-scripts). CI env is cleared per spawn
so the OIDC probe stays offline.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KtBQzmLLDU3RcGzzCMopPB

…istry

Cover run_recursive's actual publish loop with a mockito registry, porting
the plain token-auth scenarios from pnpm's recursivePublish.ts: each
eligible package is probed (404) then PUT, --force skips the probe and
republishes, --report-summary records both packages, and --json prints the
per-package array. Refreshes the file header now that the publish loop is
exercised.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KtBQzmLLDU3RcGzzCMopPB

… paths

Add a single-package test for `pacquet publish <dir>` (publishing a
package in a subdirectory rather than the cwd) and a recursive test where
one package's version already exists on the registry (probe returns it) so
it is skipped while the absent package is published.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KtBQzmLLDU3RcGzzCMopPB

Fixes the Format CI failure from the previous commit and drops the
resulting single-line trailing comma dylint flagged.

A 5xx PUT response is a completed request, so publish surfaces
FailedToPublishError rather than a transport error. Closes the last
offline-reachable branch of publish_packed_pkg's publish tail (the
remaining gaps are provenance signing and the staged path).

The only non-deterministic step in generate_provenance was the sigstore
Fulcio/Rekor signing call, which made the whole function untestable offline
(and left it uncovered). Extract that step behind a SignProvenance
capability on Sys — the DI seam AGENTS.md prescribes for publish's
external-service paths — with the real sigstore exchange in the Host impl.

generate_provenance is now deterministic given a fake signer. Adds a direct
unit test (statement + token + signer -> attachment), a signer-failure
path, and a --provenance flow test that drives the real generate_provenance
through publish_packed_pkg and asserts the signed .sigstore bundle is
spliced into the PUT document's _attachments.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KtBQzmLLDU3RcGzzCMopPB

… pnpm

The QR was drawn with the qrcode crate's Dense1x2 renderer (a four-module
quiet zone) at its default error-correction level, so it came out larger and
with a much thicker margin than pnpm's qrcode-terminal output. Replicate
qrcode-terminal small mode instead: encode a single byte segment at EC level
L (matching the version, and so the size, pnpm renders) and frame it with a
one-module light border. Dark-on-light polarity is unchanged.

The module pattern can still differ from pnpm because the qrcode crate and
qrcode-terminal pick different mask patterns (qrcode-terminal's penalty uses
the short 1011101 rule-3 core), but the size, margin, and polarity now match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KtBQzmLLDU3RcGzzCMopPB