@bongos/core 1.19.737 → 1.19.738

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.737",
-  "core_contract": "1.19.737",
-  "source_commit": "1ceb8f6a2ad0321079098910ad8a721dffa67454",
+  "core_version": "1.19.738",
+  "core_contract": "1.19.738",
+  "source_commit": "37a35be93e9879af0144594f30a8a894a84502f5",
   "source_ref": "HEAD",
-  "built_at": "2026-09-14T01:10:42.991Z",
+  "built_at": "2026-09-14T01:52:45.616Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 479,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2109,
+    "functional_verbatim": 2107,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2612,
-  "tree_sha256": "c34cdc2f87b36f12f71f276e47ce740238e94841fab60b4245613189e0c527d2",
+  "file_count": 2610,
+  "tree_sha256": "476bbdb5c1700b8ecf374a05e95a28bc6c61df721e5eb815c65439e08126feab",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2492,7 +2492,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d1b64255f150e8c8a1b88cffa7326633b7e5bc22e22744f7b1d9ee47410f9e13"
+      "sha256": "63fe92dfdaaacde0ba4dfb7882c97c6b875cd90d9b5f3dac0dacc404dbb1531f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2752,7 +2752,7 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "36e3c53a8bbe0b987e19333f12cac4dc0951822686759623e3273843e313188e"
+      "sha256": "3691b017562bde760fbe3ff29a5efb80d886dd770f1187dc4673459871cec513"
     },
     {
       "path": "docs/recipes/windows-builders.md",
@@ -7537,12 +7537,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "fc4587a7fbaaa14aad1e0296015adb626e89da62f4a90a95647f1bbb55a61f1e"
+      "sha256": "35ace7cf502387465f75cea83b1159bb82349d019555503f51769a264fd19c3e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d7595c39c515821f76d0b5045c3a9cbb400f2c36a663046d19dfc7cab098cf69"
+      "sha256": "4fbaebd587863651e105d72ed373cef166d16eebd5f86a5d51395d98c33c5f60"
     },
     {
       "path": "public-docs/index.html",
@@ -8122,7 +8122,7 @@
     {
       "path": "scripts/gds/go-live.js",
       "mode": "0000644",
-      "sha256": "95c5109be4ab748c5ee59f22489ba5e3de45bafccf1c543d8cf174fc89d75dab"
+      "sha256": "f246947d973eec84ea174736bc87bf52b4716c939fc86bff4037b330f6790f9a"
     },
     {
       "path": "scripts/gds/goal-names.js",
@@ -8157,7 +8157,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "e81ab71bcd7d2f06b5aaf462dd099776c966f9840a109846a9753f12482b5281"
+      "sha256": "3879084ce7246d6fdcf3a053006e86e7d533016b6dbb9b5aa160d65a3e9336f5"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -8299,11 +8299,6 @@
       "mode": "0000644",
       "sha256": "d34cbccec1fa3053f960c1ac0950ce7e6b4b05f9d32a23304c4c3abc41c22ef7"
     },
-    {
-      "path": "scripts/gds/npmrc.js",
-      "mode": "0000644",
-      "sha256": "1beffeed111e8528cfa0a629d5ef81c766023de5c6820a81659a390070868228"
-    },
     {
       "path": "scripts/gds/oauth-secret.js",
       "mode": "0000644",
@@ -8362,7 +8357,7 @@
     {
       "path": "scripts/gds/provision-config.js",
       "mode": "0000644",
-      "sha256": "359674dd4ba6c7c4dd446882ec88f7d9feffd474300e17736d3129c2526082c1"
+      "sha256": "48d13ecda786629148713e0bd89f0d020ee47de107fa5a2327d44989783907ac"
     },
     {
       "path": "scripts/gds/provision-net.js",
@@ -8377,7 +8372,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "77ca585d99f4058427f1abbe629d66ce5ec9f87b6c974aebc114d1c0e734d8e2"
+      "sha256": "c5822f3b29f90998c831639df2b0925033f17758cc329609de507f5e6e1ad7c8"
     },
     {
       "path": "scripts/gds/provision-units.js",
@@ -8387,7 +8382,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "007c5cfa3b42567df0016038fc7ec5c7dbdab60ec6ec8ecd9d06386933e5641d"
+      "sha256": "614aa63d02f3ae97f39e492cb0948a92b40364e25f4780d87546b64c01e5c69c"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -8857,7 +8852,7 @@
     {
       "path": "scripts/gds/start.js",
       "mode": "0000644",
-      "sha256": "1bfa9d27bc91836f636f57466876d40c56e13bdb1038451e8298c8a32cb674d6"
+      "sha256": "7e4b7cd97e9a414cf55e1118c902b4ab17239d3810fe26e5b90aa18d6a948432"
     },
     {
       "path": "scripts/gds/status.js",
@@ -8902,12 +8897,12 @@
     {
       "path": "scripts/gds/update-channel.js",
       "mode": "0000644",
-      "sha256": "db54fba6065c8b662f574aa9443e686df4e5a152865342999b1f20d50ece01ed"
+      "sha256": "1aeeb6171244e1d42ee7189a3aa2ae5d83fd175bfe1ce89300d6ca7511819f0b"
     },
     {
       "path": "scripts/gds/upgrade.js",
       "mode": "0000644",
-      "sha256": "64b2571770a5be9dc046f6c64adf45a09642c6961a6036c9405e1c933be6c3b7"
+      "sha256": "7a82fb0cf919e14700ceba718e28da1324df2eab669a847348271c85b2f7bd66"
     },
     {
       "path": "scripts/gds/validate-design.js",
@@ -9347,7 +9342,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9ad95d6241cc8f3dfda5d02445246c1f7fd62b75b5014a15a9254c15a620aef7"
+      "sha256": "4c5bdcc7f30c8ae47bdb1ecb596b692bd6405a227fc895fa5bfcd33cd8f92340"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10567,7 +10562,7 @@
     {
       "path": "tests/go_live.mjs",
       "mode": "0000644",
-      "sha256": "2fc62d14a1c7e4fbd63fe4a18a4d1be85dfc481bc12a913cdd0d3812984bd79f"
+      "sha256": "fb937d66f8efa9fdcfb58715785a0c9d94e52034d04175aec78310c70bd53a7f"
     },
     {
       "path": "tests/goal_abuse_matrix.mjs",
@@ -11287,7 +11282,7 @@
     {
       "path": "tests/init.mjs",
       "mode": "0000644",
-      "sha256": "3026220335d63e157a1732d03ee6e66f0509bf965cb8676a651cbb3e1780be34"
+      "sha256": "945aaac204e9e60772d3e7b361c97c099d236e6be6b4b794cce36ecb391d8a1a"
     },
     {
       "path": "tests/instance_config.mjs",
@@ -11679,11 +11674,6 @@
       "mode": "0000644",
       "sha256": "c57c0211709ab041ee895bbb4ade9f4b146b43147570bf282e6d6a808560db76"
     },
-    {
-      "path": "tests/npmrc.mjs",
-      "mode": "0000644",
-      "sha256": "1aaa68ee1a4c4a58563cef86aac44cfa0e046ad7376d3a2108bf6dd455580942"
-    },
     {
       "path": "tests/oauth_secret.mjs",
       "mode": "0000644",
@@ -11982,7 +11972,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "0e177a4817094985e4aeec0c74883502762304d2174c1e13e77a87404b739088"
+      "sha256": "25fbd2adccf79e921c642f8f57b082f5f19fa01cd981cd5b813dc1070511aadb"
     },
     {
       "path": "tests/provision_restart.mjs",
@@ -12702,7 +12692,7 @@
     {
       "path": "tests/start_env_guard.mjs",
       "mode": "0000644",
-      "sha256": "9b0a7d7aeb761cb6fb0c5e1ae650e0848af12e92887ebd630814b35b434c1f41"
+      "sha256": "dd7171dbc59e024de99a063763219237814cf4c943fb3d873cc324f3bfde7f25"
     },
     {
       "path": "tests/start_rebase_warning.mjs",
@@ -12922,7 +12912,7 @@
     {
       "path": "tests/upgrade.mjs",
       "mode": "0000644",
-      "sha256": "010c9ac8b05e25c10b9d43c7efd02454facf0d5663df11df555ea913697e23e8"
+      "sha256": "def73ab0f532c04df167d77917981eaf7e0dc7e1d2a7e7c85f3f962d7d65ce2a"
     },
     {
       "path": "tests/upgrade_persist_pin.mjs",

package/docs/module-api-changelog.md

@@ -1948,5 +1948,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.735 with no explicit bump. run 34771773838. (task 1002620)
   1.19.737 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.736 with no explicit bump. run 34795026282. (task 1002620)
+  1.19.738 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.737 with no explicit bump. run 34797297122. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/upgrading-the-core.md

@@ -108,7 +108,7 @@ node .claude/scheduled-tasks/core-update-subscription/subscribe.js            #
 node .claude/scheduled-tasks/core-update-subscription/subscribe.js --apply    # upgrade
 ```
 
-Each subscribed instance: read its installed core → ask the registry (`npm view`, needs `NPM_TOKEN`) → resolve the newest version its channel permits → if newer, `bongos upgrade --to <v> --registry` with **auto-rollback ON**. It prints one line per instance plus a tally; a non-zero exit means an upgrade failed (already auto-reverted).
+Each subscribed instance: read its installed core → ask the registry (`npm view`, no credential needed — the package is public) → resolve the newest version its channel permits → if newer, `bongos upgrade --to <v> --registry` with **auto-rollback ON**. It prints one line per instance plus a tally; a non-zero exit means an upgrade failed (already auto-reverted).
 
 **Triple-gated, so nothing moves by accident:** the `core-update-subscription` routine is `requiresAutonomy: true` + **default OFF** in [`config/scheduled-routines.json`](../../config/scheduled-routines.json), the roster ships empty, and every upgrade is health-gated. Arm it by enabling the routine's timer on the control plane once autonomy is on.
 
@@ -116,7 +116,8 @@ Each subscribed instance: read its installed core → ask the registry (`npm vie
 
 ## Gotchas
 
-- **`--registry` no longer needs a hand-exported `NPM_TOKEN`** (task 1002754). The instance `.npmrc` reads `_authToken=<redacted>, and npm gives that per-project key precedence — so with the env var unset it expanded EMPTY and **masked a perfectly valid literal token in `~/.npmrc`** (npm went anonymous; the private core 404'd; the error blamed a "missing" credential the box actually held). `bongos upgrade --registry` now resolves the credential itself: env `NPM_TOKEN` wins, else the **user-level `~/.npmrc`'s literal `//registry.npmjs.org/:_authToken=…`** is injected into the install's environment (forward install and rollback reinstall both). A pin bump on a box whose `~/.npmrc` authenticates therefore succeeds with **no exported env var**. Resolver: `resolveNpmToken()` in [`scripts/gds/npmrc.js`](../../scripts/gds/npmrc.js).
+- **`--registry` needs no credential at all** (task 1003878). `@bongos/core` is **public** on npm (task 1003872), so `bongos upgrade --registry` resolves it from the default registry like any other dependency — no token, no login, and no instance `.npmrc`. An install failure on this path is therefore a *real* failure (network, registry outage, or a version that was never published), never a missing credential.
+  *History, so the symptom is recognisable on an old instance:* the core used to publish private, and the instance `.npmrc` read `_authToken=<redacted> npm gives that per-project key precedence, so with the env var unset it expanded EMPTY and **masked a perfectly valid literal token in `~/.npmrc`** — npm went anonymous, the private core 404'd, and the error blamed a credential the box actually held. Task 1002754 worked around it by resolving the token in-process; task 1003878 deleted the whole mechanism along with the `.npmrc` that caused it. An instance still carrying a committed `.npmrc` from a pre-1003878 scaffold can safely delete it.
 - **A green `publish` run is not evidence of a publish.** The publish-on-merge lane succeeds on its no-op paths too (cascade terminator, armed-gate). Read the run's **job summary**, which now states the verdict explicitly: `PUBLISHED @bongos/core@<v>` vs `NO-OP — nothing was published this run`.
 - **`PGDATABASE` is load-bearing on a co-tenant droplet.** `migrate.sh` defaults `PGDATABASE` to `example` — **production**. Always set `PGDATABASE=<instance-db>` explicitly, or you migrate the wrong database.
 - **The health check polls the restart** (fixed in task [#1984](https://example.com/builders#/task/1984)). The service binds its port ~1s after `systemctl restart`, so `--health-url` now polls up to ~30s for a 2xx before reporting a warning — an immediate `fetch failed` no longer means a failed upgrade. (Pre-1984 cores fetched once and spuriously reported `fetch failed`; there, confirm with `is-active` + a manual `curl`.)

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.737",
+  "version": "1.19.738",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.737",
+      "version": "1.19.738",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.737",
+  "version": "1.19.738",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/go-live.js

@@ -84,7 +84,7 @@ function isSafeToken(v) {
 // unit name that the script would then try to `systemctl stop`. Absent, the stop and
 // the restart are simply skipped: there is no `reset --hard` to race.
 const REQUIRED_FIELDS = ['instanceDir', 'service', 'healthUrl', 'versionUrl'];
-const OPTIONAL_FIELDS = ['ssh', 'local', 'deployTimer', 'deployService', 'npmEnvFile', 'runAs', 'backupDb', 'backupDir', 'env', 'registryPackage', 'pinMode'];
+const OPTIONAL_FIELDS = ['ssh', 'local', 'deployTimer', 'deployService', 'runAs', 'backupDb', 'backupDir', 'env', 'registryPackage', 'pinMode'];
 
 // How the bump is made durable — the other half of co-tenant mode (task 1003521).
 //
@@ -153,7 +153,6 @@ const CONFIG_TEMPLATE = `{
       "versionUrl": "http://127.0.0.1:3002/version",    // box-side truth read back after
       "deployTimer": "my-deploy.timer",                 // optional: pull-deploy timer (its reset --hard is the hazard)
       "deployService": "my-deploy.service",             // optional: forced tick proves the pin stuck
-      "npmEnvFile": "/etc/my/npm.env",                  // optional: root-only NPM_TOKEN for a PRIVATE package
       "runAs": "me",                                    // optional: unprivileged owner of the instance
       "backupDb": "mydb",                               // optional: pg_dump before the bump
       "backupDir": "~/backups",
@@ -247,40 +246,19 @@ function remote(target, script, { run = spawnSync, timeoutMs = 900000 } = {}) {
 // `sudo -u <user> -H env K=V … <cmd>` — the shape every runbook entry uses. Returns
 // a string safe to embed because every component was allowlist-validated.
 //
-// A privileged child needs npm auth, and there is NO WAY to hand it a secret through
-// sudo without logging it (task 1003218, corrected).
-//
-//   `env NPM_TOKEN="$NPM_TOKEN" …`     → sudo logs it in COMMAND=
-//   `sudo --preserve-env=NPM_TOKEN …`  → sudo logs it in ENV=
-//
-// The first was the original bug; the second was my "fix", which only MOVED the value
-// to a different field of the same log line. Both put a live credential in a
-// persistent journal. What matters is that sudo logs its whole invocation, so the
-// secret must never be part of it.
-//
-// So the child DERIVES the token itself, from a file it can already read. Only the
-// `sed` appears in argv; the value never does. This is the shape docs/recipes/
-// core-release-pipeline.md already documents as the safe one. The guard matters as
-// much as the derivation: an EMPTY token silently sends npm to the public registry,
-// which 404s the private package, which auto-rolls-back "cleanly" having taught you
-// nothing — so an empty read aborts loudly instead of half-running.
-//
-// (The nightly lane never takes this path: it runs under systemd as the owner with an
-// EnvironmentFile, no sudo, and leaks nothing. This is the manual/agent path only.)
-const NPM_AUTH_PREAMBLE = [
-  'export NPM_TOKEN="${NPM_TOKEN:-$(sed -n \'s/.*_authToken=//p\' "$HOME/.npmrc" 2>/dev/null | head -1)}"',
-  '[ -n "$NPM_TOKEN" ] || { echo "go-live: EMPTY NPM_TOKEN — npm would 404 the private core and roll back; aborting" >&2; exit 12; }',
-].join('; ');
-
 // `sudo -u <user> -H env K=V … <cmd>` — the shape every runbook entry uses. Returns
 // a string safe to embed because every component was allowlist-validated.
 //
-// `needsNpm` wraps the command so it derives its own npm auth (see above) instead of
-// having a secret handed across the privilege boundary. Only NON-secret configuration
-// (PGDATABASE, HOME) travels in the plain `env K=V` list — seeing those in a log is
-// useful rather than harmful.
-function asOwner(target, cmd, { needsNpm = false } = {}) {
-  const inner = needsNpm ? `sh -c ${shq(`${NPM_AUTH_PREAMBLE}; ${cmd}`)}` : cmd;
+// Only NON-secret configuration (PGDATABASE, HOME) travels in the plain `env K=V` list —
+// seeing those in a log is useful rather than harmful.
+//
+// This used to take a `needsNpm` option wrapping the command in a preamble that DERIVED an
+// npm credential on the far side, because sudo logs its whole invocation and there was no way
+// to hand a privileged child a secret without journalling it (task 1003218). @bongos/core is
+// public (task 1003872), so the deploy path needs no npm credential at all and the whole
+// hazard is gone rather than mitigated (task 1003878).
+function asOwner(target, cmd) {
+  const inner = cmd;
   const envPairs = Object.entries(target.env || {}).map(([k, v]) => `${k}=${v}`);
   if (!target.runAs) {
     const joined = envPairs.join(' ');
@@ -622,23 +600,21 @@ function renderReport(r) {
 // Phases
 // ---------------------------------------------------------------------------
 
-// Registry proof + optional content proof, in ONE round-trip. The registry is
-// consulted ON THE BOX because a PRIVATE package 404s without the root-only
-// NPM_TOKEN, and because the box's answer is the one that matters.
+// Registry proof + optional content proof, in ONE round-trip. The registry is still
+// consulted ON THE BOX — not because auth lives there (the package is public now), but
+// because the box's answer is the one that matters: its network, its resolver, its cache.
 function probeRemote(target, targetVersion, marker, opts = {}) {
   const pkg = target.registryPackage || '@bongos/core';
-  const src = target.npmEnvFile ? `set -a; . ${target.npmEnvFile}; set +a` : 'true';
   const script = `
 set -uo pipefail
-${src}
 echo "##REGISTRY##"
-${asOwner(target, `npm view ${pkg}@${targetVersion} version`, { needsNpm: true })} 2>&1 | tail -1
+${asOwner(target, `npm view ${pkg}@${targetVersion} version`)} 2>&1 | tail -1
 echo "##TREE##"
 ( cd ${target.instanceDir} && ${target.runAs ? `sudo -u ${target.runAs} -H ` : ''}git status --porcelain | head -20 )
 echo "##INSTALLED##"
 ${asOwner(target, `node -e "console.log(require('${target.instanceDir}/node_modules/${pkg}/package.json').version)"`)} 2>&1 | tail -1
 ${marker ? `echo "##MARKER##"
-${asOwner(target, `sh -c ${shq(markerProbe(pkg, targetVersion, marker))}`, { needsNpm: true })}` : ''}
+${asOwner(target, `sh -c ${shq(markerProbe(pkg, targetVersion, marker))}`)}` : ''}
 echo "##END##"
 `;
   const res = remote(target, script, opts);
@@ -709,7 +685,6 @@ function applyGoLive(target, targetName, targetVersion, from, opts = {}) {
   const pkg = target.registryPackage || '@bongos/core';
   const pinMode = pinModeOf(target);
   const steps = [];
-  const src = target.npmEnvFile ? `set -a; . ${target.npmEnvFile}; set +a` : 'true';
 
   // Phase A — stop the pull-deploy timer, then back up. The timer's `reset --hard`
   // is the hazard: it would revert an uncommitted pin mid-flight. A co-tenant has no
@@ -738,8 +713,7 @@ echo "##END##"
   const upgrade = upgradeCommand(target, targetVersion);
   const phaseB = remote(target, `
 set -uo pipefail
-${src}
-${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade}"`, { needsNpm: true })}
+${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade}"`)}
 `, opts);
   const rolledBack = /rolled back/i.test(phaseB.stdout + phaseB.stderr);
   steps.push({
@@ -995,7 +969,7 @@ if (require.main === module) {
 module.exports = {
   loadConfig, selectTarget, validateTarget, planGoLive, artistGateEntries, readArtistGate, ARTIST_GATE_PATH, ARTIST_GATE_LEVELS,
   parseMarker, parseMarkerHits,
-  renderPlan, renderReport, failureExcerpt, asOwner, isSafeToken, NPM_AUTH_PREAMBLE, refreshMain, isLocalTarget, gitRefExists, SUDO_PREAMBLE,
+  renderPlan, renderReport, failureExcerpt, asOwner, isSafeToken, refreshMain, isLocalTarget, gitRefExists, SUDO_PREAMBLE,
   applyGoLive, upgradeCommand, pinStep, pinModeOf,
   CONFIG_TEMPLATE, HALTS, SEMVER_RE, PIN_MODES, DEFAULT_PIN_MODE,
 };

package/scripts/gds/init.js

@@ -59,13 +59,13 @@
 //   bongos init --vendor-core <tgz>   greenfield only: vendor the @bongos/core .tgz + pin
 //                                       package.json to file:vendor/… + generate package-lock.json,
 //                                       so the scaffold is `npm ci`-installable (ADR 0108 gap 1/4).
-//                                       Without it the scaffold pins the caret range (which now
-//                                       resolves from the PRIVATE registry — see --registry-core).
-//   bongos init --registry-core       greenfield only: keep the caret pin + write an env-fed
-//                                       .npmrc (`_authToken=${NPM_TOKEN}`) so `npm ci` pulls the
-//                                       PRIVATE @bongos/core from the npm registry (ADR 0134).
-//                                       With NPM_TOKEN set it also generates package-lock.json;
-//                                       without a token it 404s (the expected tokenless outcome).
+//                                       Without it the scaffold pins the caret range, which
+//                                       resolves from the public npm registry (--registry-core).
+//   bongos init --registry-core       greenfield only: keep the caret pin and generate
+//                                       package-lock.json from the registry. @bongos/core is
+//                                       PUBLIC (task 1003872), so this needs no token, no login
+//                                       and no .npmrc — it resolves from the default registry
+//                                       like any other dependency.
 //                                       Mutually exclusive with --vendor-core (registry vs tarball).
 
 const fs = require('node:fs');
@@ -78,7 +78,6 @@ const { materializeClaude } = require('./claude-materialize'); // ADR 0108 §3 (
 const { detectStack, formatStackSummary } = require('./adopt-detect'); // ADR 0121 §Decision 4 (task 2043): inspect an existing repo before layering
 const { resolveBacklogTasks, DEFAULT_MAX: BACKLOG_MAX } = require('./adopt-import'); // ADR 0121 §Decision 3 (task 2044): import an existing backlog
 const { preflightAdopt, formatPreflight } = require('./adopt-preflight'); // ADR 0121 §Decision 5 (task 2045): the accept-gated conflict pre-flight
-const { writeNpmrc, hasNpmToken } = require('./npmrc'); // ADR 0134 (task 2090): the registry-install path's env-fed .npmrc
 
 const KNOWN_MODULES = ['game', 'art-pipeline', 'discord', 'dev-box'];
 
@@ -946,7 +945,7 @@ async function main(argv) {
   const adopt = hasFlag('--adopt', args); // brownfield: LAYER onto an existing repo (ADR 0121)
   const accept = hasFlag('--accept', args) || hasFlag('--yes', args) || hasFlag('-y', args); // adopt pre-flight accept-gate (§Decision 5)
   const vendorCore = arg('--vendor-core', args); // greenfield: vendor + file:-pin a core .tgz, then generate the lockfile (ADR 0108 gap 1/4, task 2053)
-  const registryCore = hasFlag('--registry-core', args); // greenfield: caret pin + env-fed .npmrc → `npm ci` pulls the PRIVATE core from the registry (ADR 0134, task 2090)
+  const registryCore = hasFlag('--registry-core', args); // greenfield: keep the caret pin and generate the lockfile from the public registry (task 1003878)
 
   if (adopt && force) {
     console.error('init: --force is a greenfield-only overwrite; --adopt never overwrites, so --force is ignored.');
@@ -1030,30 +1029,23 @@ async function main(argv) {
     }
   }
 
-  // Registry-install path (ADR 0134, task 2090): keep the caret pin writeConfigs wrote
-  // and add an env-fed .npmrc so `npm ci` pulls the PRIVATE @bongos/core from the
-  // registry. With NPM_TOKEN present we also generate package-lock.json (a reproducible
-  // `npm ci` later); without a token we still write the caret pin + .npmrc so the
-  // scaffold is registry-shaped, and say plainly that the private package 404s until a
-  // token is provided — the expected tokenless outcome the ADR calls to verify.
+  // Registry-install path: keep the caret pin writeConfigs wrote and generate
+  // package-lock.json from the registry, so a later `npm ci` is reproducible.
+  //
+  // This used to write an env-fed npm auth file and skip the lockfile when no credential was
+  // present, because @bongos/core published PRIVATE. It is public now (task 1003872), so it
+  // resolves from the default registry like any other dependency: no auth file, no credential,
+  // and no tokenless-404 branch to explain (task 1003878).
   if (registryCore) {
     if (dryRun) {
-      console.log(`\n[dry-run] would write .npmrc (env-fed @bongos auth) and ${hasNpmToken()
-        ? 'run `npm install` to generate package-lock.json from the registry'
-        : 'SKIP lockfile generation (no NPM_TOKEN — the private core 404s until one is provided)'}`);
+      console.log('\n[dry-run] would run `npm install` to generate package-lock.json from the registry');
     } else {
-      console.log('\nWiring the registry-install path (ADR 0134):');
-      writeNpmrc(dir, { log: console.log });
-      if (hasNpmToken()) {
-        const inst = upgrade.npmInstall(dir);
-        if (!inst.ok) {
-          console.error(`  ! npm install failed (${inst.reason || 'exit ' + inst.code}) — confirm NPM_TOKEN reaches the private @bongos org; package-lock.json not generated.`);
-        } else {
-          console.log('  ✓ npm install → package-lock.json generated (pulled @bongos/core from the registry)');
-        }
+      console.log('\nWiring the registry-install path:');
+      const inst = upgrade.npmInstall(dir);
+      if (!inst.ok) {
+        console.error(`  ! npm install failed (${inst.reason || 'exit ' + inst.code}) — package-lock.json not generated. @bongos/core is public, so this is a real failure (network, registry outage, or an unpublished version), not a missing credential.`);
       } else {
-        console.log('  • no NPM_TOKEN in the environment — wrote the caret pin + .npmrc but skipped lockfile generation.');
-        console.log('    Provide a read-only automation token (paid `bongos` org) as NPM_TOKEN before `npm ci`; without it the private package 404s cleanly.');
+        console.log('  ✓ npm install → package-lock.json generated (pulled @bongos/core from the registry)');
       }
     }
   }

package/scripts/gds/provision-config.js

@@ -19,12 +19,6 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // plain require (its require.main guard means importing it runs no CLI).
 const oauthSecret = require('./oauth-secret');
 
-// The registry-install gates + env-fed .npmrc (ADR 0134, task 2090). Lets the
-// standalone scaffold OPT IN to pulling the PRIVATE @bongos/core from the npm
-// registry (PROVISION_CORE_FROM_REGISTRY=1) instead of vendoring a tarball, with a
-// fail-soft fallback to the vendored path when no NPM_TOKEN is present.
-const { registryCoreRequested, hasNpmToken } = require('./npmrc');
-
 // The HTTP User-Agent the manifest conversion stamps its GitHub call with (GitHub
 // requires a UA). Overridable so a fork can identify itself; not secret.
 const MANIFEST_UA = process.env.PROVISION_GITHUB_UA || 'cloudbongos-provisioner';
@@ -195,10 +189,8 @@ module.exports = {
   REPO_ROOT,
   coreVersionSafe,
   hasFlag,
-  hasNpmToken,
   loadDeps,
   numEnv,
   oauthSecret,
   provisionerBotEmail,
-  registryCoreRequested,
 };

package/scripts/gds/provision-repo.js

@@ -14,7 +14,7 @@ const crypto = require('node:crypto');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { CONFIG, REPO_ROOT, coreVersionSafe, hasNpmToken, provisionerBotEmail, registryCoreRequested } = require('./provision-config.js');
+const { CONFIG, REPO_ROOT, coreVersionSafe, provisionerBotEmail } = require('./provision-config.js');
 // The repo-identity + owner-credential leaf (task 1003081). Carved OUT of this file so
 // upgrade.js can reach these three without pulling provision*.js into the merge
 // resolver's executed closure; re-exported below so every existing caller is unchanged.
@@ -602,18 +602,20 @@ async function scaffoldStandaloneRepo(inst, deps) {
       exec(`git -C ${root} checkout -B main`);
     }
 
-    // Core-install path (ADR 0134, task 2090). DEFAULT = vendor a tarball built from THIS
-    // control-plane checkout (offline, proven — task 2053). OPT-IN = pull the PRIVATE
-    // @bongos/core from the npm registry (PROVISION_CORE_FROM_REGISTRY=1). The registry
-    // path needs NPM_TOKEN at `npm ci` time; if the flag is set but no token is present we
-    // FAIL SOFT to the vendored path so a tokenless standup still works (never a broken
-    // instance). The env is injectable for tests; the runner falls back to process.env.
-    const env = deps.env || process.env;
-    const wantRegistry = registryCoreRequested(env);
-    const useRegistry = wantRegistry && hasNpmToken(env);
-    if (wantRegistry && !useRegistry) {
-      log('  [scaffold] PROVISION_CORE_FROM_REGISTRY set but no NPM_TOKEN in env — falling back to the vendored-tarball core (ADR 0134 fail-soft).');
-    }
+    // Core-install path: vendor a tarball built from THIS control-plane checkout
+    // (offline, proven — task 2053).
+    //
+    // This used to be a fork: an opt-in env var selected the registry, and a missing npm
+    // credential silently failed it soft back to vendored. Both halves were auth-era and both
+    // are gone (task 1003878) — @bongos/core is public, so nothing needs a credential, and an
+    // env var that silently changed which install path ran is the divergence behind task
+    // 1003520. tests/provision.mjs pins both retired names and proves they are inert.
+    //
+    // Vendored stays the default here for a reason that has nothing to do with auth and
+    // survives the package going public: THIS CHECKOUT IS ROUTINELY AHEAD OF THE REGISTRY.
+    // A control plane on an unreleased CORE_VERSION has no published version to install, so
+    // the registry path would 404 on exactly the commits an operator most wants to stand up.
+    // Whether the vendored path still earns its keep at all is gate 6's call (task 1003879).
 
     // materialize config/ + .claude/ + a pinned package.json + lockfile via `bongos init`.
     // --no-seed: the instance's own DB is seeded by migrate, not here (and on the adopt path
@@ -627,27 +629,21 @@ async function scaffoldStandaloneRepo(inst, deps) {
     // BLOCKING pre-flight finding still hard-stops — it cannot be waved through). init refuses
     // --adopt together with --force, so the two flag sets are mutually exclusive by design.
     //
-    // Two mutually exclusive core-resolution shapes, orthogonal to the mode:
-    //   registry (--registry-core): caret pin + env-fed .npmrc; `npm ci` pulls from the
-    //     registry. init generates the lockfile (NPM_TOKEN is present — we gated on it).
-    //   vendored (--vendor-core, default): a tarball built from this checkout, file:-pinned.
+    // Core resolution is vendored (--vendor-core): a tarball built from this checkout,
+    // file:-pinned. init still accepts --registry-core for an operator who explicitly wants
+    // a published version, and that flag no longer needs any credential.
     const modeFlags = mode === 'adopt' ? '--adopt --accept' : '--force';
     const spec = instanceInitSpec(inst, { ownerLogin });
     const specPath = path.join(os.tmpdir(), `bongos-init-${inst.slug}.json`);
     writeFile(specPath, JSON.stringify(spec, null, 2));
-    if (useRegistry) {
-      log(`  [scaffold] core install: registry — PRIVATE @bongos/core@${coreV} via env-fed NPM_TOKEN (ADR 0134)`);
-      exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed ${modeFlags} --registry-core`);
-    } else {
-      // Vendored tarball — resolveVendorableCoreTarball's three-rung ladder (shared
-      // with the re-provision pin refresh, task 1003050).
-      const { tgz, packDest } = resolveVendorableCoreTarball({
-        instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:',
-      });
-      exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed ${modeFlags} --vendor-core ${tgz}`);
-      // init --vendor-core COPIED the tarball into the child's vendor/ — the temp pack dir is spent.
-      if (packDest) exec(`rm -rf ${packDest}`);
-    }
+    // Vendored tarball — resolveVendorableCoreTarball's three-rung ladder (shared
+    // with the re-provision pin refresh, task 1003050).
+    const { tgz, packDest } = resolveVendorableCoreTarball({
+      instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:',
+    });
+    exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed ${modeFlags} --vendor-core ${tgz}`);
+    // init --vendor-core COPIED the tarball into the child's vendor/ — the temp pack dir is spent.
+    if (packDest) exec(`rm -rf ${packDest}`);
 
     // 4. commit + push to the instance's own main (keep node_modules out).
     //

package/scripts/gds/provision.js

@@ -360,11 +360,9 @@ async function provisionInstance(inst, deps) {
     // repo + install the pinned @bongos/core, so the migrate + service below run
     // from the INSTANCE root, not this control-plane checkout. cwd = standaloneRoot.
     // boxExec = the control plane (where scaffoldStandaloneRepo just created the dir).
-    // REGISTRY CORE (ADR 0134): when the scaffold pinned the registry core, the committed
-    // .npmrc reads `_authToken=${NPM_TOKEN}` — so `npm ci` resolves the PRIVATE package
-    // only if NPM_TOKEN is in this runner's env (makeExec inherits process.env). The
-    // scaffold already gated on the token, so it is present; the VENDORED default needs
-    // no token (the tarball is committed). A tokenless registry `npm ci` 404s cleanly.
+    // CORE RESOLUTION: the vendored default needs no network at all (the tarball is
+    // committed). A registry pin resolves from the public registry — @bongos/core is public
+    // (task 1003872), so `npm ci` needs no credential either way (task 1003878).
     const root = standaloneRoot(inst);
     log('  [code] standalone — pull instance repo + npm ci (pinned @bongos/core)');
     boxExec(standalonePullCmd(), { cwd: root });

package/scripts/gds/start.js

@@ -587,7 +587,7 @@ function instanceNotRunningCard({ origin, depsMissing } = {}) {
     out.push(`${surface.strong(`Don't run ${surface.code('bongos dev')} for this.`)} It stands up a separate local instance with its own empty database — it cannot show you this board, and it would hide the outage behind an empty one.`);
     if (depsMissing) {
       out.push('');
-      out.push(`(The ${surface.code('bongos')} CLI isn't installed here. It's optional — the website above is the same board. ${surface.code('@bongos/core')} is a ${surface.strong('private')} package, so installing it needs an ${surface.code('NPM_TOKEN')}; a 404 without one is expected, not a missing version.)`);
+      out.push(`(The ${surface.code('bongos')} CLI isn't installed here. It's optional — the website above is the same board. ${surface.code('@bongos/core')} is ${surface.strong('public')} on npm, so ${surface.code('npm install @bongos/core')} needs no token or login; a failure here is a real error, not the expected tokenless 404 it used to be.)`);
     }
     return out.join('\n');
   }

package/scripts/gds/update-channel.js

@@ -122,9 +122,9 @@ function resolveChannelTarget({ installed, channel, available } = {}) {
 
 // ---- registry: what versions of the core are published? ---------------------
 
-// List published versions of @bongos/core from the registry via `npm view … versions --json`
-// (ADR 0134 — the private scoped package resolves through the instance's env-fed .npmrc, so run this
-// with cwd inside an instance that has one + NPM_TOKEN in env). Fail-SOFT: any error returns
+// List published versions of @bongos/core from the registry via `npm view … versions --json`.
+// The package is public (task 1003872), so this needs no credential and no instance-local
+// `.npmrc` — any cwd resolves it. Fail-SOFT: any error returns
 // { ok:false } so the routine skips that instance rather than crashing the whole sweep. `run` +
 // `pkg` are injectable for tests.
 function listAvailableVersions({ cwd = process.cwd(), pkg = CORE_PKG, run = spawnSync, env = process.env } = {}) {

package/scripts/gds/upgrade.js

@@ -32,7 +32,6 @@ const path = require('node:path');
 const crypto = require('node:crypto');
 const { spawnSync } = require('node:child_process');
 const { arg, hasFlag } = require('./cli-lib');
-const { writeNpmrc, hasNpmToken, resolveNpmToken } = require('./npmrc'); // ADR 0134 (task 2090): the --registry channel's env-fed .npmrc; resolveNpmToken task 1002754
 
 const CORE_PKG = '@bongos/core';
 const ARTIFACT = 'bongos-core';
@@ -98,9 +97,9 @@ function writePin(instanceDir, vendorRel, fsImpl = fs) {
   return prev;
 }
 
-// Rewrite the consumer package.json to pin an EXACT registry version (ADR 0134, task
-// 2090): the registry sibling of writePin. `npm install` then resolves @bongos/core@version
-// from the registry (auth via the env-fed .npmrc). Returns the previous dep string.
+// Rewrite the consumer package.json to pin an EXACT registry version: the registry sibling
+// of writePin. `npm install` then resolves @bongos/core@version from the public registry —
+// no credential, since the package is public (task 1003872). Returns the previous dep string.
 function writeRegistryPin(instanceDir, version, fsImpl = fs) {
   const pkgPath = path.join(instanceDir, 'package.json');
   const pkg = readJson(pkgPath, fsImpl);
@@ -478,13 +477,13 @@ function reportModulePreflight(mods, targetVersion, { log = console.log, err = c
   return lines;
 }
 
-function npmInstall(instanceDir, run = spawnSync, extraEnv = null) {
+function npmInstall(instanceDir, run = spawnSync) {
   // `npm install` (NOT `npm ci`): the pin just changed, so the lockfile must be regenerated from the
   // new tarball; `npm ci` would refuse on the package.json↔lock divergence.
-  // extraEnv (task 1002754): the registry path injects a resolved NPM_TOKEN here so the
-  // instance `.npmrc`'s `${NPM_TOKEN}` expansion never shadows a valid user-level token.
+  // This used to take an extraEnv carrying a resolved npm credential, because the instance
+  // `.npmrc`'s env expansion could shadow a valid user-level one (task 1002754). The core is
+  // public and writes no `.npmrc`, so there is no credential to resolve (task 1003878).
   const opts = { cwd: instanceDir, stdio: 'inherit' };
-  if (extraEnv) opts.env = { ...process.env, ...extraEnv };
   const r = run('npm', ['install', '--no-audit', '--no-fund'], opts);
   return !r || r.error ? { ok: false, reason: r && r.error ? r.error.message : 'spawn failed' } : { ok: r.status === 0, code: r.status };
 }
@@ -983,11 +982,8 @@ async function rollback({ instanceDir, snapshot, fromVersion, toVersion, opts },
   try { restore(instanceDir, snapshot.prevPin, fsImpl); result.restoreOk = true; log(`  ✓ restored pin → ${snapshot.prevPin}`); }
   catch (e) { result.restoreOk = false; err(`  ! could not restore pin (${e.message}) — package.json may need manual repair`); }
 
-  // 2. reinstall the previous core. Same credential resolution as the forward path
-  //    (task 1002754): the previous pin may be a registry pin too, and a rollback
-  //    must never fail on the env-shadowing trap the forward install just avoided.
-  const rbCred = resolveNpmToken();
-  const inst = npmInstall(instanceDir, run, rbCred.source === 'user-npmrc' ? { NPM_TOKEN: rbCred.token } : null);
+  // 2. reinstall the previous core.
+  const inst = npmInstall(instanceDir, run);
   result.reinstallOk = !!inst.ok;
   if (inst.ok) log('  ✓ reinstalled previous core');
   else err(`  ! reinstall of previous core failed (${inst.reason || 'exit ' + inst.code}) — the instance may need manual repair`);
@@ -1094,24 +1090,16 @@ async function runUpgrade(opts, deps = {}) {
     return { ok: false, error: 'post-restart health check is mandatory for a bump that restarts the service, but no --health-url was given.\n  Pass --health-url <url> to confirm the new core serves after restart, or --no-health-check to explicitly skip the confirmation.' };
   }
 
-  // 2. bump the pin. Two mutually exclusive core sources (ADR 0134, task 2090):
-  //    REGISTRY (--registry): pin @bongos/core@<version> + ensure the env-fed .npmrc, so
-  //      the `npm install` below pulls the PRIVATE package from the registry (needs NPM_TOKEN).
+  // 2. bump the pin. Two mutually exclusive core sources:
+  //    REGISTRY (--registry): pin @bongos/core@<version> and let `npm install` pull it from
+  //      the public registry. No credential — the package is public (task 1003872), which
+  //      also retired the whole resolve-a-token-and-inject-it dance (task 1002754/1003878).
   //    VENDORED (default, --from <tgz>): copy the .tgz into vendor/ + rewrite the file: dep.
-  let installEnv = null;
   if (opts.registry) {
     if (opts.from) return { ok: false, error: '--registry and --from are mutually exclusive (registry pull vs vendored tarball) — pick one core source' };
-    // task 1002754 — resolve the credential HERE instead of demanding a hand-exported
-    // env var: env NPM_TOKEN wins, else the user-level ~/.npmrc's literal token is
-    // injected into the install's env so the instance `.npmrc`'s `${NPM_TOKEN}`
-    // expansion (which OUTRANKS the user-level key and expands EMPTY when unset)
-    // can never shadow a working credential again.
-    const cred = resolveNpmToken();
-    if (!cred.token) log('  ! no NPM_TOKEN in env and no literal token in ~/.npmrc — `npm install` will 404 on the PRIVATE @bongos/core until a read-only automation token is provided (ADR 0134).');
-    else if (cred.source === 'user-npmrc') { installEnv = { NPM_TOKEN: cred.token }; log('  ✓ registry credential: inherited from the user-level ~/.npmrc (no NPM_TOKEN export needed — task 1002754)'); }
     const prevPin = dryRun ? null : writeRegistryPin(instanceDir, targetVersion, fsImpl);
-    if (!dryRun) { writeNpmrc(instanceDir, { fsImpl, overwrite: false, log }); snapshot = { prevPin, prevVersion: fromVersion }; }
-    log(`  ${dryRun ? '[dry-run] would pin' : '✓ pinned'} ${CORE_PKG} → ${targetVersion} (registry)${dryRun ? ' + write an env-fed .npmrc' : ''}${prevPin ? `  (was ${prevPin})` : ''}`);
+    if (!dryRun) { snapshot = { prevPin, prevVersion: fromVersion }; }
+    log(`  ${dryRun ? '[dry-run] would pin' : '✓ pinned'} ${CORE_PKG} → ${targetVersion} (registry)${prevPin ? `  (was ${prevPin})` : ''}`);
   } else {
     let vendorRel = opts.pinPath || (opts.from ? null : vendorRelFor(targetVersion));
     if (opts.from) {
@@ -1130,7 +1118,7 @@ async function runUpgrade(opts, deps = {}) {
   if (dryRun) { log('  [dry-run] would: npm install → npm run migrate → materialize .claude → regen API docs+client → restart → verify'); return { ok: true, dryRun: true, fromVersion, toVersion: targetVersion }; }
 
   // 3. npm install.
-  const inst = npmInstall(instanceDir, run, installEnv);
+  const inst = npmInstall(instanceDir, run);
   if (!inst.ok) {
     const error = `npm install failed (${inst.reason || 'exit ' + inst.code})`;
     if (rollbackOnFailure && snapshot) {
@@ -1370,7 +1358,7 @@ async function main(argv = process.argv.slice(2)) {
       '',
       '  --to <version>       target core version — presence switches from pre-check to a real bump',
       '  --from <tgz>         source tarball to vendor into vendor/ (else it must already be there)',
-      '  --registry           pull @bongos/core@<--to> from the npm registry (env-fed .npmrc + NPM_TOKEN) instead of vendoring a tarball (ADR 0134); mutually exclusive with --from',
+      '  --registry           pull @bongos/core@<--to> from the public npm registry (no token needed) instead of vendoring a tarball; mutually exclusive with --from',
       '  --instance <dir>     consumer instance root (default: cwd)',
       '  --service <unit>     systemd unit to restart after applying',
       '  --restart-cmd <cmd>  explicit restart command (overrides --service)',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.737'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.738'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/go_live.mjs

@@ -442,26 +442,27 @@ test("'could not check' is a distinct halt from 'absent'", () => {
 // `env K=V` list that omits it drops it too. This cost a real failed go-live.
 // ---------------------------------------------------------------------------
 
-test('a privileged npm command DERIVES its token — no secret in argv at all', () => {
-  const cmd = G.asOwner({ runAs: 'lars', env: { PGDATABASE: 'cb' } }, 'npm install', { needsNpm: true });
-  // THE REGRESSION, TWICE (task 1003218). `env NPM_TOKEN="$NPM_TOKEN"` put the value in
-  // sudo's COMMAND= field. `--preserve-env=NPM_TOKEN` moved it to sudo's ENV= field —
-  // a different field of the SAME log line, which is not a fix. sudo logs its whole
-  // invocation, so the only safe answer is that the secret is never part of it.
-  assert.ok(!/NPM_TOKEN=npm_/.test(cmd), 'no token VALUE may appear');
-  assert.ok(!/--preserve-env/.test(cmd), '--preserve-env logs the value in ENV=');
-  assert.ok(!/env [^;]*NPM_TOKEN="\$NPM_TOKEN"/.test(cmd), 'no by-reference assignment in argv either');
-  // What SHOULD be there: the child deriving it, and refusing to run on an empty read.
-  assert.match(cmd, /_authToken/);
-  assert.match(cmd, /EMPTY NPM_TOKEN/);
+test('a privileged npm command carries NO credential machinery at all', () => {
+  const cmd = G.asOwner({ runAs: 'lars', env: { PGDATABASE: 'cb' } }, 'npm install');
+  // HISTORY, so nobody reintroduces it (task 1003218, twice). `env NPM_TOKEN="$NPM_TOKEN"`
+  // put the value in sudo's COMMAND= field; `--preserve-env=NPM_TOKEN` moved it to sudo's
+  // ENV= field — a different field of the SAME log line, which was never a fix. The third
+  // shape had the child DERIVE the token from a file so only a `sed` appeared in argv.
+  //
+  // All three are now moot rather than mitigated: @bongos/core is public (task 1003872), so
+  // the deploy path needs no npm credential and the hazard cannot recur (task 1003878). This
+  // asserts the ABSENCE, which is a stronger guarantee than any of the three mitigations.
+  assert.doesNotMatch(cmd, /NPM_TOKEN/, 'no token by value, by reference, or by derivation');
+  assert.doesNotMatch(cmd, /--preserve-env/, '--preserve-env would log the value in ENV=');
+  assert.doesNotMatch(cmd, /_authToken/, 'nothing reads a credential out of an .npmrc');
   // Non-secret config still travels plainly.
   assert.match(cmd, /PGDATABASE=cb/);
 });
 
-test('an empty token ABORTS rather than half-running', () => {
-  // An empty token sends npm to the PUBLIC registry, which 404s the private core, which
-  // auto-rolls-back "cleanly" — a failure that teaches you nothing. Fail loudly instead.
-  assert.match(G.NPM_AUTH_PREAMBLE, /exit 12/);
+test('the retired auth preamble is really gone from the module surface', () => {
+  // It was exported and embedded into every privileged command. A re-export would mean the
+  // mitigation came back, which now means a credential came back with it.
+  assert.equal(G.NPM_AUTH_PREAMBLE, undefined, 'NPM_AUTH_PREAMBLE must not be exported');
 });
 
 test('a command that does not need npm is left alone', () => {
@@ -470,10 +471,10 @@ test('a command that does not need npm is left alone', () => {
   assert.ok(!cmd.includes('NPM_TOKEN'));
 });
 
-test('with no privilege drop the command still derives its own auth', () => {
-  const cmd = G.asOwner({ env: { A: 'b' } }, 'npm x', { needsNpm: true });
+test('with no privilege drop the command is still credential-free', () => {
+  const cmd = G.asOwner({ env: { A: 'b' } }, 'npm x');
   assert.ok(!cmd.startsWith('sudo'));
-  assert.match(cmd, /_authToken/);
+  assert.doesNotMatch(cmd, /NPM_TOKEN|_authToken/);
 });
 
 test('the report surfaces the failing tool’s own words', () => {

package/tests/init.mjs

@@ -768,10 +768,10 @@ async function runSeedTests() {
   });
 }
 
-// ---- greenfield registry-install path (ADR 0134, task 2090) ----------------
+// ---- greenfield registry-install path ---------------------------------------
 // main() with --registry-core --dry-run only LOGS (no fs, no network), so we capture
-// console output and assert the plan. The real write+install path is proven by the
-// CLI scratch run in the session log; the pure gates live in tests/npmrc.mjs.
+// console output and assert the plan. The package is public (task 1003872), so this path
+// writes no `.npmrc` and needs no token; tests/npmrc.mjs went with the module (task 1003878).
 async function runRegistryCoreTests() {
   const at = async (name, fn) => {
     try { await fn(); passed++; console.log(`  ok  ${name}`); }
@@ -799,14 +799,19 @@ async function runRegistryCoreTests() {
     return { code, out: lines.join('\n') };
   };
 
-  await at('main --registry-core --dry-run: plans the env-fed .npmrc; does NOT vendor a tarball', async () => {
+  await at('main --registry-core --dry-run: plans a plain lockfile generation, no .npmrc, no token', async () => {
     const { dir, p } = specFile();
     try {
       const { code, out } = await capture(['--from', p, '--dir', join(dir, 'out'), '--no-seed', '--registry-core', '--dry-run']);
       assert.equal(code, 0);
-      assert.match(out, /would write \.npmrc \(env-fed @bongos auth\)/);
+      assert.match(out, /would run `npm install` to generate package-lock\.json/);
       assert.ok(!/vendor/i.test(out), 'no vendored-tarball step on the registry path');
-      assert.equal(existsSync(join(dir, 'out', '.npmrc')), false, 'dry-run writes nothing');
+      // The load-bearing half (task 1003878): a public package resolves from the default
+      // registry, so planning an `.npmrc` or mentioning a token would mean the retired
+      // auth path came back.
+      assert.doesNotMatch(out, /\.npmrc/, 'must not plan an .npmrc');
+      assert.doesNotMatch(out, /NPM_TOKEN/, 'must not mention a token');
+      assert.equal(existsSync(join(dir, 'out', '.npmrc')), false, 'writes no .npmrc at all');
     } finally { rmSync(dir, { recursive: true, force: true }); }
   });
 

package/tests/provision.mjs

@@ -599,18 +599,41 @@ async function scaffoldWithEnv(env) {
   }
 }
 
-await ta('scaffoldStandaloneRepo: PROVISION_CORE_FROM_REGISTRY=1 + NPM_TOKEN → registry path (init --registry-core, no tarball build)', async () => {
+// Provisioning used to FORK on two env vars: PROVISION_CORE_FROM_REGISTRY chose the registry
+// path, and a missing NPM_TOKEN silently failed it soft back to the vendored tarball. Both are
+// gone (task 1003878) — the package is public, so nothing needs a token, and an env var that
+// silently changed which install path ran is the divergence behind task 1003520.
+//
+// These two assert the ABSENCE of that fork, which is why they set the retired vars explicitly:
+// a test that merely stopped mentioning them would pass whether or not the fork came back.
+await ta('scaffoldStandaloneRepo: the retired PROVISION_CORE_FROM_REGISTRY env no longer diverts to the registry', async () => {
   const joined = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1', NPM_TOKEN: 'npm_readonly' });
-  assert.match(joined, /init\.js --from .* --dir .* --no-seed --force --registry-core/, 'materializes via --registry-core');
-  assert.ok(!/package-core\.js/.test(joined), 'does NOT build a core tarball on the registry path');
-  assert.ok(!/--vendor-core/.test(joined), 'does NOT vendor a tarball on the registry path');
-});
-
-await ta('scaffoldStandaloneRepo: registry requested but NO NPM_TOKEN → FAILS SOFT to the vendored tarball', async () => {
-  const joined = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1' });
-  assert.match(joined, /node scripts\/gds\/package-core\.js/, 'builds the core tarball (vendored fallback)');
+  assert.match(joined, /node scripts\/gds\/package-core\.js/, 'still vendors — the env var is inert');
   assert.match(joined, /init\.js --from .* --dir .* --no-seed --force --vendor-core /, 'file:-pins the vendored tarball');
-  assert.ok(!/--registry-core/.test(joined), 'does NOT take the registry path without a token');
+  assert.ok(!/--registry-core/.test(joined), 'the retired env var must not resurrect the registry path');
+});
+
+await ta('scaffoldStandaloneRepo: a token in env changes NOTHING about the install path', async () => {
+  // BOTH runs set the retired request flag and vary ONLY the token — that is precisely the
+  // old divergence (flag + token → registry; flag, no token → vendored fail-soft). Comparing
+  // two runs that DON'T set the flag would pass whether or not the fork existed, which an
+  // adversarial re-add of the fork proved while this test was written that way.
+  const withToken = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1', NPM_TOKEN: 'npm_readonly' });
+  const without = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1' });
+  // THE LOAD-BEARING ASSERTION. The old fail-soft made a tokenless standup take a DIFFERENT
+  // install path than a tokenized one — two modes diverging on an env var (task 1003520).
+  // One public path means the presence of a credential cannot change the outcome at all.
+  // Normalize the per-run random temp names (scratch dir, spec file, pack dir) — they differ
+  // between any two runs and say nothing about which install path was taken.
+  const norm = (t) => t
+    .replace(/scaffold-[A-Za-z0-9]+/g, 'SCRATCH')
+    .replace(/bongos-init-[^\s.]+/g, 'SPEC')
+    .replace(/core-pack-[^\s/]+/g, 'PACK');
+  assert.equal(
+    norm(withToken),
+    norm(without),
+    'the command sequence must be identical with and without a token',
+  );
 });
 
 await ta('scaffoldStandaloneRepo: default (no registry env) stays on the vendored tarball path', async () => {

package/tests/start_env_guard.mjs

@@ -107,10 +107,15 @@ t('a hosted origin leads with the board being a website that needs no install',
   assert.ok(/healthz/.test(card), 'offers the health probe instead of a bring-up');
 });
 
-t('a hosted origin explains the private-package 404 rather than implying a lost version', () => {
+t('a hosted origin says the core installs with no token, and never re-offers the retired NPM_TOKEN advice', () => {
   const card = instanceNotRunningCard({ origin: 'https://example-instance.cloudbongos.com', depsMissing: true });
-  assert.ok(/private/i.test(card) && /NPM_TOKEN/.test(card), 'names the real cause of a tokenless install failure');
-  assert.ok(/not a missing version/.test(card), 'kills the "go find a version that still exists" wild goose chase');
+  assert.ok(/public/i.test(card), 'names the package as public — it is (task 1003872)');
+  assert.ok(/no token|needs no token/i.test(card), 'tells the reader nothing needs authenticating');
+  // The load-bearing half: this card spent months telling people to go find an NPM_TOKEN for
+  // a package that is now public. Advising that again would send a newcomer hunting a
+  // credential that does not exist and cannot be issued to them.
+  assert.doesNotMatch(card, /NPM_TOKEN/, 'must not resurrect the token advice');
+  assert.doesNotMatch(card, /\bprivate\b/i, 'must not call the package private');
 });
 
 t('isLocalOrigin: loopback is local, everything else is remote', () => {

package/tests/upgrade.mjs

@@ -444,7 +444,7 @@ t('runUpgrade --registry + --from: refuses (mutually exclusive core sources)', a
   assert.match(res.error, /mutually exclusive/);
 });
 
-t('runUpgrade --registry (full): pins the exact version + writes the env-fed .npmrc, then install→migrate→verify', async () => {
+t('runUpgrade --registry (full): pins the exact version, writes NO .npmrc, then install→migrate→verify', async () => {
   const dir = scratchConsumer({ pinned: '1.16.0', installed: '1.16.0' });
   const calls = [];
   const res = await u.runUpgrade(
@@ -460,8 +460,11 @@ t('runUpgrade --registry (full): pins the exact version + writes the env-fed .np
   assert.equal(res.ok, true, 'registry upgrade succeeds');
   assert.equal(res.toVersion, '1.17.0');
   assert.equal(JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).dependencies['@bongos/core'], '1.17.0', 'exact registry pin (no file:)');
-  const npmrc = readFileSync(join(dir, '.npmrc'), 'utf8');
-  assert.match(npmrc, /_authToken=\$\{NPM_TOKEN\}/, 'wrote the env-fed .npmrc');
+  // @bongos/core is public (task 1003872), so the registry path writes no `.npmrc` and
+  // resolves from the default registry. An `.npmrc` reappearing here would mean the retired
+  // auth plumbing came back — and it is the file whose `${NPM_TOKEN}` expansion used to
+  // SHADOW a working user-level credential (task 1002754), so its absence is load-bearing.
+  assert.equal(existsSync(join(dir, '.npmrc')), false, 'writes no .npmrc on the registry path');
   assert.ok(calls.some((c) => /^npm install/.test(c)), 'ran npm install (resolves from the registry)');
   assert.ok(!calls.some((c) => /vendor/.test(c)), 'did not vendor a tarball');
 });

package/scripts/gds/npmrc.js

@@ -1,124 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-//
-// scripts/gds/npmrc.js — env-fed `.npmrc` for installing the PRIVATE @bongos/* core
-// from the npm registry (ADR 0134, task 2090). The single place that knows the
-// registry host + scope + the `.npmrc` shape + the opt-in/token gates, shared by:
-//   • init.js       — the greenfield `--registry-core` scaffold
-//   • provision.js  — the standalone scaffold's registry path (opt-in, fail-soft)
-//   • upgrade.js     — the `--registry <version>` update channel
-//
-// WHY private + env-fed. `@bongos/core` publishes as a SCOPED, PRIVATE package (ADR
-// 0134): a private scoped package can only be installed with auth. Consumers
-// authenticate with an `.npmrc` whose token EXPANDS FROM THE ENVIRONMENT at install
-// time (`_authToken=${NPM_TOKEN}`) — so the committed file carries NO secret, and a
-// tokenless install 404s cleanly (the expected pre-launch outcome).
-//
-// The vendored-tarball path (task 2053) stays the DEFAULT/fallback until this registry
-// path is proven end-to-end on a real greenfield standup (ADR 0134 §Consequences).
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const REGISTRY_HOST = 'registry.npmjs.org';
-const CORE_SCOPE = '@bongos'; // the paid, canonical npm org (ADR 0134 scope correction, task 2092)
-const TOKEN_ENV = 'NPM_TOKEN';
-const REQUEST_ENV = 'PROVISION_CORE_FROM_REGISTRY';
-
-// The `.npmrc` a scaffolded instance commits. The token is the LITERAL `${NPM_TOKEN}`
-// (npm expands env vars in `.npmrc` values at read time), so the file is safe to
-// commit — it holds no secret. Scoping @bongos to the registry keeps every unrelated
-// install on the default public registry.
-function npmrcContent({ scope = CORE_SCOPE, host = REGISTRY_HOST, tokenEnv = TOKEN_ENV } = {}) {
-  return [
-    `; Cloud Bongos — env-fed auth for the PRIVATE ${scope}/* packages (ADR 0134, task 2090).`,
-    `; The token EXPANDS FROM THE ENVIRONMENT at install time; nothing secret is committed here.`,
-    `; \`npm ci\` needs ${tokenEnv} set (a read-only npm access token from the paid \`bongos\` org);`,
-    `; without it the private package 404s — that is the expected tokenless outcome.`,
-    `${scope}:registry=https://${host}/`,
-    `//${host}/:_authToken=\${${tokenEnv}}`,
-    '',
-  ].join('\n');
-}
-
-// Is a registry token present in the environment? The fail-soft gate: provisioning
-// falls back to the vendored tarball when this is false, so a tokenless standup still
-// works (never a broken instance).
-function hasNpmToken(env = process.env) {
-  return !!String(env[TOKEN_ENV] || '').trim();
-}
-
-// resolveNpmToken (task 1002754) — the install-time credential resolver that removes
-// the hand-exported-NPM_TOKEN step from deploys.
-//
-// THE TRAP. The committed instance `.npmrc` reads `_authToken=${NPM_TOKEN}`; npm gives
-// a per-project key precedence over the user-level one, so with NPM_TOKEN unset the
-// expansion is EMPTY and it MASKS a perfectly valid literal token in ~/.npmrc — npm
-// goes anonymous and the private core 404s. Every deploy then silently depended on the
-// operator remembering `export NPM_TOKEN=…` (the ADR-0162 shape: a human-gated step in
-// the ship path). npm's config syntax cannot express "env var, else fall through", so
-// the fix is to RESOLVE the credential here and feed it to the child install's env —
-// the committed file stays secret-free and unchanged.
-//
-// Order: env NPM_TOKEN wins (explicit operator intent), else the user-level ~/.npmrc's
-// literal `//<host>/:_authToken=<value>` (ignoring env-fed `${…}` values — those are
-// the trap, not a credential). Returns { token, source: 'env'|'user-npmrc'|null }.
-function resolveNpmToken({ env = process.env, homedir, fsImpl = fs, host = REGISTRY_HOST } = {}) {
-  const fromEnv = String(env[TOKEN_ENV] || '').trim();
-  if (fromEnv) return { token: fromEnv, source: 'env' };
-  const home = homedir || (env.HOME || env.USERPROFILE || '');
-  if (home) {
-    try {
-      const raw = fsImpl.readFileSync(path.join(home, '.npmrc'), 'utf8');
-      const re = new RegExp(`^\\s*//${host.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}/:_authToken\\s*=\\s*(.+?)\\s*$`, 'm');
-      const m = re.exec(raw);
-      const val = m && m[1].replace(/^["']|["']$/g, '');
-      if (val && !val.includes('${')) return { token: val, source: 'user-npmrc' };
-    } catch { /* no user npmrc, unreadable — fall through to null */ }
-  }
-  return { token: null, source: null };
-}
-
-// Has the operator opted the standalone scaffold into the registry path? OFF by
-// default — the vendored tarball stays the default until the registry path is proven
-// end-to-end (ADR 0134). '1'/'true'/'yes'/'on' (case-insensitive) → true.
-function registryCoreRequested(env = process.env) {
-  return /^(1|true|yes|on)$/i.test(String(env[REQUEST_ENV] || '').trim());
-}
-
-// Write the env-fed `.npmrc` into an instance dir. Default overwrites (a greenfield
-// scaffold owns the file); pass overwrite:false to leave a pre-existing `.npmrc`
-// untouched (an upgrade must not clobber a consumer's other registries). Returns the
-// path (or null when skipped). Dry-run writes nothing.
-function writeNpmrc(dir, { fsImpl = fs, dryRun = false, overwrite = true, log = () => {} } = {}) {
-  const p = path.join(dir, '.npmrc');
-  if (!overwrite && fsImpl.existsSync(p)) {
-    log(`  • .npmrc already present — left untouched (add \`${CORE_SCOPE}:registry\` + \`_authToken=\${${TOKEN_ENV}}\` if the private core doesn't resolve).`);
-    return null;
-  }
-  if (dryRun) {
-    log(`  [dry-run] would write ${p} (env-fed ${CORE_SCOPE} auth; token via $${TOKEN_ENV}, never committed)`);
-    return p;
-  }
-  fsImpl.writeFileSync(p, npmrcContent());
-  log(`  ✓ wrote .npmrc (env-fed ${CORE_SCOPE} auth; token via $${TOKEN_ENV}, never committed)`);
-  return p;
-}
-
-module.exports = {
-  REGISTRY_HOST, CORE_SCOPE, TOKEN_ENV, REQUEST_ENV,
-  npmrcContent, hasNpmToken, resolveNpmToken, registryCoreRequested, writeNpmrc,
-};
-
-// Tiny CLI: `node scripts/gds/npmrc.js [--print | --write <dir>]` — print the `.npmrc`
-// body or materialize it into <dir>. Handy for a manual registry-standup rehearsal.
-if (require.main === module) {
-  const args = process.argv.slice(2);
-  const writeIdx = args.indexOf('--write');
-  if (writeIdx !== -1 && args[writeIdx + 1]) {
-    const p = writeNpmrc(path.resolve(args[writeIdx + 1]), { log: console.log });
-    process.stdout.write(`${p}\n`);
-  } else {
-    process.stdout.write(npmrcContent());
-  }
-}

package/tests/npmrc.mjs

@@ -1,154 +0,0 @@
-// tests/npmrc.mjs
-//
-// Unit tests for scripts/gds/npmrc.js (ADR 0134, task 2090) — the single source of the
-// env-fed `.npmrc` used to install the PRIVATE @bongos/core from the npm registry, plus
-// the opt-in / token gates that keep the vendored-tarball path the default/fallback.
-//
-// Run:  node tests/npmrc.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import { mkdtempSync, writeFileSync, readFileSync, existsSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-const require = createRequire(import.meta.url);
-const n = require('../scripts/gds/npmrc.js');
-
-let passed = 0, failed = 0;
-function test(name, fn) {
-  try { fn(); passed++; console.log(`  ok  ${name}`); }
-  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
-}
-
-// ---- npmrcContent ----------------------------------------------------------
-test('npmrcContent: scopes @bongos to the registry + auth token EXPANDS from the env (literal ${NPM_TOKEN})', () => {
-  const body = n.npmrcContent();
-  assert.match(body, /@bongos:registry=https:\/\/registry\.npmjs\.org\//);
-  assert.match(body, /\/\/registry\.npmjs\.org\/:_authToken=\$\{NPM_TOKEN\}/);
-});
-
-test('npmrcContent: carries NO real secret — only the ${NPM_TOKEN} placeholder', () => {
-  const body = n.npmrcContent();
-  // the only _authToken= assignment must be the env placeholder, never a concrete value
-  const tokenLines = body.split('\n').filter((l) => /_authToken=/.test(l));
-  assert.equal(tokenLines.length, 1);
-  assert.equal(tokenLines[0].trim(), '//registry.npmjs.org/:_authToken=${NPM_TOKEN}');
-});
-
-test('npmrcContent: comment lines use the ini `;` comment char', () => {
-  const comments = n.npmrcContent().split('\n').filter((l) => l.startsWith(';'));
-  assert.ok(comments.length >= 3, 'has explanatory comments');
-});
-
-test('npmrcContent: honors custom scope/host/tokenEnv', () => {
-  const body = n.npmrcContent({ scope: '@acme', host: 'npm.acme.dev', tokenEnv: 'ACME_TOKEN' });
-  assert.match(body, /@acme:registry=https:\/\/npm\.acme\.dev\//);
-  assert.match(body, /\/\/npm\.acme\.dev\/:_authToken=\$\{ACME_TOKEN\}/);
-});
-
-// ---- gates -----------------------------------------------------------------
-test('hasNpmToken: true only when NPM_TOKEN is a non-empty string', () => {
-  assert.equal(n.hasNpmToken({ NPM_TOKEN: 'npm_abc' }), true);
-  assert.equal(n.hasNpmToken({ NPM_TOKEN: '' }), false);
-  assert.equal(n.hasNpmToken({ NPM_TOKEN: '   ' }), false);
-  assert.equal(n.hasNpmToken({}), false);
-});
-
-test('registryCoreRequested: 1/true/yes/on → true; everything else → false', () => {
-  for (const v of ['1', 'true', 'TRUE', 'yes', 'on']) assert.equal(n.registryCoreRequested({ PROVISION_CORE_FROM_REGISTRY: v }), true, v);
-  for (const v of ['0', 'false', 'no', '', 'off', 'garbage']) assert.equal(n.registryCoreRequested({ PROVISION_CORE_FROM_REGISTRY: v }), false, v);
-  assert.equal(n.registryCoreRequested({}), false, 'unset');
-});
-
-// ---- writeNpmrc ------------------------------------------------------------
-test('writeNpmrc: writes the env-fed .npmrc + returns its path', () => {
-  const dir = mkdtempSync(join(tmpdir(), 'npmrc-'));
-  try {
-    const p = n.writeNpmrc(dir, { log: () => {} });
-    assert.equal(p, join(dir, '.npmrc'));
-    assert.equal(readFileSync(p, 'utf8'), n.npmrcContent());
-  } finally { rmSync(dir, { recursive: true, force: true }); }
-});
-
-test('writeNpmrc: dry-run writes nothing but returns the intended path', () => {
-  const dir = mkdtempSync(join(tmpdir(), 'npmrc-'));
-  try {
-    const p = n.writeNpmrc(dir, { dryRun: true, log: () => {} });
-    assert.equal(p, join(dir, '.npmrc'));
-    assert.equal(existsSync(join(dir, '.npmrc')), false, 'dry-run must not write');
-  } finally { rmSync(dir, { recursive: true, force: true }); }
-});
-
-test('writeNpmrc: overwrite:false leaves a pre-existing .npmrc untouched (returns null)', () => {
-  const dir = mkdtempSync(join(tmpdir(), 'npmrc-'));
-  try {
-    const existing = '@other:registry=https://npm.other.dev/\n';
-    writeFileSync(join(dir, '.npmrc'), existing);
-    const p = n.writeNpmrc(dir, { overwrite: false, log: () => {} });
-    assert.equal(p, null, 'skipped');
-    assert.equal(readFileSync(join(dir, '.npmrc'), 'utf8'), existing, 'existing content preserved');
-  } finally { rmSync(dir, { recursive: true, force: true }); }
-});
-
-test('writeNpmrc: overwrite:true (default) replaces an existing .npmrc', () => {
-  const dir = mkdtempSync(join(tmpdir(), 'npmrc-'));
-  try {
-    writeFileSync(join(dir, '.npmrc'), 'stale\n');
-    n.writeNpmrc(dir, { log: () => {} });
-    assert.equal(readFileSync(join(dir, '.npmrc'), 'utf8'), n.npmrcContent());
-  } finally { rmSync(dir, { recursive: true, force: true }); }
-});
-
-// ---- resolveNpmToken (task 1002754) ----------------------------------------
-// The install-time credential resolver that removes the hand-exported-NPM_TOKEN
-// deploy step: env wins, else the user-level ~/.npmrc's LITERAL token; env-fed
-// `${…}` values in the user file are the trap, never a credential.
-test('resolveNpmToken: env NPM_TOKEN wins over everything', () => {
-  const home = mkdtempSync(join(tmpdir(), 'npmrc-home-'));
-  try {
-    writeFileSync(join(home, '.npmrc'), '//registry.npmjs.org/:_authToken=npm_userlevel\n');
-    const r = n.resolveNpmToken({ env: { NPM_TOKEN: ' npm_fromenv ' }, homedir: home });
-    assert.deepEqual(r, { token: 'npm_fromenv', source: 'env' });
-  } finally { rmSync(home, { recursive: true, force: true }); }
-});
-
-test('resolveNpmToken: falls back to the user-level ~/.npmrc literal token', () => {
-  const home = mkdtempSync(join(tmpdir(), 'npmrc-home-'));
-  try {
-    writeFileSync(join(home, '.npmrc'),
-      'registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=npm_ABC123\nfund=false\n');
-    const r = n.resolveNpmToken({ env: {}, homedir: home });
-    assert.deepEqual(r, { token: 'npm_ABC123', source: 'user-npmrc' });
-  } finally { rmSync(home, { recursive: true, force: true }); }
-});
-
-test('resolveNpmToken: an env-fed ${…} value in the user file is the trap, not a credential', () => {
-  const home = mkdtempSync(join(tmpdir(), 'npmrc-home-'));
-  try {
-    writeFileSync(join(home, '.npmrc'), '//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n');
-    const r = n.resolveNpmToken({ env: {}, homedir: home });
-    assert.deepEqual(r, { token: null, source: null });
-  } finally { rmSync(home, { recursive: true, force: true }); }
-});
-
-test('resolveNpmToken: a token for a DIFFERENT host is not borrowed', () => {
-  const home = mkdtempSync(join(tmpdir(), 'npmrc-home-'));
-  try {
-    writeFileSync(join(home, '.npmrc'), '//npm.pkg.github.com/:_authToken=ghp_other\n');
-    const r = n.resolveNpmToken({ env: {}, homedir: home });
-    assert.deepEqual(r, { token: null, source: null });
-  } finally { rmSync(home, { recursive: true, force: true }); }
-});
-
-test('resolveNpmToken: no user npmrc at all → null, never a throw', () => {
-  const home = mkdtempSync(join(tmpdir(), 'npmrc-home-'));
-  try {
-    const r = n.resolveNpmToken({ env: {}, homedir: home });
-    assert.deepEqual(r, { token: null, source: null });
-  } finally { rmSync(home, { recursive: true, force: true }); }
-});
-
-console.log('');
-console.log(`npmrc tests: ${passed} passed, ${failed} failed`);
-process.exit(failed ? 1 : 0);