@decohere/ci-tools 0.0.1-dev.20261105.103 → 0.0.1-dev.20261105.116

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.20261105.103",
+  "version": "0.0.1-dev.20261105.116",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",
@@ -41,11 +41,9 @@
     "./changeset/check-status": "./src/changeset/check-status.mjs",
     "./github/create-issue": "./src/github/create-issue.mjs",
     "./github/ensure-metadata": "./src/github/ensure-metadata.mjs",
-    "./github/create-or-update-pr": "./src/github/create-or-update-pr.mjs",
     "./github/publish-verify": "./src/github/publish-verify.mjs",
     "./github/first-publish-check": "./src/github/first-publish-check.mjs",
-    "./github/npm-bootstrap": "./src/github/npm-bootstrap.mjs",
-    "./github/smoke-create-launcher": "./src/github/smoke-create-launcher.mjs"
+    "./github/npm-bootstrap": "./src/github/npm-bootstrap.mjs"
   },
   "scripts": {
     "test": "vitest run"

package/src/release/promote-latest.mjs

@@ -43,6 +43,13 @@ export function promoteLatest(options) {
 	}
 	log(`Promoting ${version} to latest on ${packages.length} packages`);
 
+	// Once a stable version is out, latest belongs to releases: see "Stable release" in docs/ci.
+	const current = /^latest: (.+)$/m.exec(npm("dist-tag", "ls", LAUNCH_PACKAGE).stdout)?.[1];
+	if (current != null && !current.includes("-") && version.includes("-")) {
+		log(`latest is the stable ${current}, and ${version} is a dev version. Nothing moved.`);
+		return 1;
+	}
+
 	const tag = run("git", ["tag", "--list", `v${version}`]).stdout.trim();
 	if (tag !== `v${version}`) {
 		log(`${version} has no v${version} tag, so it didn't fully ship. Nothing moved.`);

package/src/release/restamp-build.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+/**
+ * Gives a tested build its stable version by changing only `package.json` files, so what ships is
+ * the code that was tested. Refuses if the old version appears anywhere else, because then the
+ * version couldn't be changed in those files alone. Checks everything before writing anything.
+ *
+ *   node restamp-build.mjs <build dir> <tested version> <stable version>
+ */
+import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const STABLE = /^\d+\.\d+\.\d+$/;
+const DEPENDENCY_KEYS = [
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies",
+];
+
+function listFiles(dir) {
+	return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+		const path = join(dir, entry.name);
+		return entry.isDirectory() ? listFiles(path) : [path];
+	});
+}
+
+/**
+ * @param {{ dir: string, from: string, to: string }} options
+ * @returns {{ packages: string[] }}
+ */
+export function restampBuild({ dir, from, to }) {
+	if (!STABLE.test(to)) {
+		throw new Error(`${to} isn't a stable version: expected major.minor.patch`);
+	}
+
+	const files = listFiles(dir);
+	const stamped = [];
+	const elsewhere = [];
+	for (const file of files) {
+		const text = readFileSync(file, "utf8");
+		if (file.endsWith("/package.json")) {
+			const manifest = JSON.parse(text);
+			if (manifest.version !== from) {
+				throw new Error(`${manifest.name} is at ${manifest.version}, not ${from}`);
+			}
+			manifest.version = to;
+			for (const key of DEPENDENCY_KEYS) {
+				for (const name of Object.keys(manifest[key] ?? {})) {
+					if (name.startsWith("@decohere/") && manifest[key][name] === from) {
+						manifest[key][name] = to;
+					}
+				}
+			}
+			const output = `${JSON.stringify(manifest, null, 2)}\n`;
+			if (output.includes(from)) elsewhere.push(relative(dir, file));
+			stamped.push({ file, name: manifest.name, output });
+		} else if (text.includes(from)) {
+			elsewhere.push(relative(dir, file));
+		}
+	}
+
+	if (stamped.length === 0) {
+		throw new Error(`No packages in ${dir}`);
+	}
+	if (elsewhere.length > 0) {
+		throw new Error(`${from} also appears in: ${elsewhere.join(", ")}`);
+	}
+
+	for (const { file, output } of stamped) {
+		writeFileSync(file, output);
+	}
+	return { packages: stamped.map((item) => item.name).sort() };
+}
+
+if (
+	process.argv[1] != null &&
+	import.meta.url === pathToFileURL(resolve(process.argv[1])).href
+) {
+	const [dir, from, to] = process.argv.slice(2);
+	if (!dir || !from || !to) {
+		console.error("Usage: restamp-build.mjs <build dir> <tested version> <stable version>");
+		process.exit(1);
+	}
+	const { packages } = restampBuild({ dir, from, to });
+	console.log(`${packages.length} packages now at ${to}`);
+}

package/tests/github/publish-workflow.test.mjs

@@ -0,0 +1,68 @@
+import { fileURLToPath } from "node:url";
+import { describe, expect, it, vi } from "vitest";
+
+const fs = await vi.importActual("node:fs");
+const PUBLISH_YML = fileURLToPath(
+	new URL("../../../../.github/workflows/publish.yml", import.meta.url),
+);
+
+describe("publish.yml", () => {
+	const yml = fs.readFileSync(PUBLISH_YML, "utf8");
+
+	it("defaults a stable release to a dry run", () => {
+		const dryRun = yml.slice(yml.indexOf("dry_run:"), yml.indexOf("\nconcurrency:"));
+
+		expect(dryRun).toMatch(/default: true/);
+	});
+
+	it("stops a stable release before publishing on a dry run, or if its checks fail", () => {
+		const verify = yml.slice(yml.indexOf("\n  verify:"), yml.indexOf("\n  npm:"));
+
+		expect(verify).toContain("inputs.dry_run != true");
+		expect(verify).toContain("needs.release-build.result == 'success'");
+	});
+
+	it("ships a stable release from the tested build, without rebuilding it", () => {
+		const build = yml.slice(yml.indexOf("\n  release-build:"), yml.indexOf("\n  verify:"));
+
+		expect(build).toContain("forge-release-beta-");
+		expect(build).toContain("restamp-build.mjs");
+		expect(build).not.toContain("forge --log-level info build");
+	});
+
+	it("only tags a version once npm and the images have shipped", () => {
+		const tag = yml.slice(yml.indexOf("\n  tag:"));
+		const needs = /needs: \[(.+)\]/.exec(tag)?.[1].split(", ");
+
+		expect(needs).toContain("npm");
+		expect(needs).toContain("check-images");
+	});
+
+	it("checks the images with no login, as a stranger would", () => {
+		const job = yml.slice(yml.indexOf("\n  check-images:"), yml.indexOf("\n  tag:"));
+
+		expect(job).toContain("permissions: {}");
+		expect(job).toContain("docker manifest inspect");
+		expect(job).not.toContain("docker login");
+	});
+
+	it("reads npm without a token: the packages are public and publishing is OIDC", () => {
+		const workflows = fileURLToPath(new URL("../../../../.github/", import.meta.url));
+		const files = fs
+			.readdirSync(workflows, { recursive: true })
+			.filter((file) => /\.ya?ml$/.test(file));
+		expect(files.length).toBeGreaterThan(0);
+		for (const file of files) {
+			expect(fs.readFileSync(`${workflows}${file}`, "utf8"), file).not.toMatch(
+				/NODE_AUTH_TOKEN|_authToken/,
+			);
+		}
+	});
+
+	it("grants the tag job actions:read so publish-prepare can download CI artifacts", () => {
+		const tag = yml.slice(yml.indexOf("\n  tag:"));
+		const perms = tag.slice(tag.indexOf("permissions:"), tag.indexOf("steps:"));
+		expect(perms).toMatch(/contents:\s*write/);
+		expect(perms).toMatch(/actions:\s*read/);
+	});
+});

package/src/github/create-or-update-pr.mjs

@@ -1,143 +0,0 @@
-import { execSync } from "node:child_process";
-import { readFileSync } from "node:fs";
-
-function getArg(name, fallback) {
-	const equals = process.argv.find((arg) => arg.startsWith(`--${name}=`));
-	if (equals) return equals.slice(name.length + 3);
-	const index = process.argv.indexOf(`--${name}`);
-	if (index >= 0) return process.argv[index + 1];
-	return fallback;
-}
-
-function hasFlag(name) {
-	return process.argv.includes(`--${name}`);
-}
-
-function run(command) {
-	return execSync(command, { encoding: "utf8" }).trim();
-}
-
-function parseRepoFromRemoteUrl(url) {
-	const sshMatch = url.match(/github\.com:([^/]+)\/([^/.]+)(?:\.git)?$/);
-	if (sshMatch) return { owner: sshMatch[1], repo: sshMatch[2] };
-	const httpsMatch = url.match(/github\.com\/([^/]+)\/([^/.]+)(?:\.git)?$/);
-	if (httpsMatch) return { owner: httpsMatch[1], repo: httpsMatch[2] };
-	throw new Error(`Unable to parse GitHub owner/repo from remote URL: ${url}`);
-}
-
-async function request(apiBaseUrl, token, method, path, body) {
-	const response = await fetch(`${apiBaseUrl}${path}`, {
-		method,
-		headers: {
-			Authorization: `Bearer ${token}`,
-			Accept: "application/vnd.github+json",
-			"X-GitHub-Api-Version": "2022-11-28",
-			"Content-Type": "application/json",
-		},
-		body: body == null ? undefined : JSON.stringify(body),
-	});
-	if (!response.ok) {
-		const message = await response.text();
-		throw new Error(`GitHub API ${method} ${path} failed (${response.status}): ${message}`);
-	}
-	return response.status === 204 ? undefined : response.json();
-}
-
-if (hasFlag("help")) {
-	console.log(`Usage: node create-or-update-pr.mjs [options]
-
-Required:
-  --title <title>                PR title
-  --body <markdown>              PR body markdown
-    or
-  --body-file <path>             Read PR body markdown from file
-
-Optional:
-  --base <branch>                Base branch (default: main)
-  --head <branch>                Head branch (default: current git branch)
-  --draft                        Create as draft
-  --labels <a,b,c>               Apply labels
-  --reviewers <u1,u2>            Request reviewers
-  --dry-run                      Print intended operation without calling API
-  --help                         Show this help
-
-Auth: Set GITHUB_TOKEN or GH_TOKEN
-`);
-	process.exit(0);
-}
-
-const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN;
-if (token == null || token.length === 0) throw new Error("Missing GITHUB_TOKEN or GH_TOKEN");
-
-const apiBaseUrl = process.env.GITHUB_API_URL ?? "https://api.github.com";
-const base = getArg("base", "main");
-const head = getArg("head", run("git rev-parse --abbrev-ref HEAD"));
-const title = getArg("title");
-const bodyFile = getArg("body-file");
-const body = getArg("body", bodyFile ? readFileSync(bodyFile, "utf8") : undefined);
-const draft = hasFlag("draft");
-const dryRun = hasFlag("dry-run");
-const labels = (getArg("labels") ?? "")
-	.split(",")
-	.map((v) => v.trim())
-	.filter(Boolean);
-const reviewers = (getArg("reviewers") ?? "")
-	.split(",")
-	.map((v) => v.trim())
-	.filter(Boolean);
-
-if (!title) throw new Error("Missing required argument: --title");
-if (!body) throw new Error("Missing required argument: --body or --body-file");
-
-const remoteUrl = run("git config --get remote.origin.url");
-const parsedRepo = parseRepoFromRemoteUrl(remoteUrl);
-const owner = getArg("owner", parsedRepo.owner);
-const repo = getArg("repo", parsedRepo.repo);
-
-const findPath = `/repos/${owner}/${repo}/pulls?state=open&head=${encodeURIComponent(`${owner}:${head}`)}&base=${encodeURIComponent(base)}`;
-
-if (dryRun) {
-	console.log(
-		JSON.stringify({ owner, repo, base, head, title, draft, labels, reviewers }, null, 2),
-	);
-	process.exit(0);
-}
-
-const existing = await request(apiBaseUrl, token, "GET", findPath);
-const pr = existing[0]
-	? await request(
-			apiBaseUrl,
-			token,
-			"PATCH",
-			`/repos/${owner}/${repo}/pulls/${existing[0].number}`,
-			{ title, body, base },
-		)
-	: await request(apiBaseUrl, token, "POST", `/repos/${owner}/${repo}/pulls`, {
-			title,
-			body,
-			base,
-			head,
-			draft,
-		});
-
-if (labels.length > 0) {
-	await request(
-		apiBaseUrl,
-		token,
-		"POST",
-		`/repos/${owner}/${repo}/issues/${pr.number}/labels`,
-		{ labels },
-	);
-}
-
-if (reviewers.length > 0) {
-	await request(
-		apiBaseUrl,
-		token,
-		"POST",
-		`/repos/${owner}/${repo}/pulls/${pr.number}/requested_reviewers`,
-		{ reviewers },
-	);
-}
-
-console.log(`${existing[0] ? "Updated" : "Created"} PR #${pr.number}: ${pr.html_url}`);

package/src/github/smoke-create-launcher.mjs

@@ -1,85 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-import { mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-
-/**
- * Run `npx @decohere/create@version --help` from an empty temp directory.
- * Must not use the repo cwd — after `@decohere/cli` is pinned, pnpm installs
- * `@decohere/create` into the workspace tree and npm's npx misses the bin.
- * No token: the packages are public, so this installs the launcher the way a user does.
- * Anonymous reads go through npm's cache, which can lag minutes behind a publish, so it
- * first waits until npm serves the version (`attempts` tries, `intervalMs` apart).
- *
- * @param {{
- *   createVersion: string,
- *   attempts?: number,
- *   intervalMs?: number,
- *   sleep?: (ms: number) => void,
- *   mkdtempSync?: typeof mkdtempSync,
- *   writeFileSync?: typeof writeFileSync,
- *   spawnSync?: typeof spawnSync,
- *   tmpdir?: () => string,
- *   stdio?: import("node:child_process").StdioOptions,
- * }} options
- */
-export function runCreateLauncherSmoke(options) {
-	const version = options.createVersion?.trim() ?? "";
-	if (!version) {
-		throw new Error("CREATE_VERSION is required");
-	}
-
-	const mkdtemp = options.mkdtempSync ?? mkdtempSync;
-	const writeFile = options.writeFileSync ?? writeFileSync;
-	const spawn = options.spawnSync ?? spawnSync;
-	const tmp = options.tmpdir ?? tmpdir;
-	const sleep = options.sleep ?? sleepSync;
-	const attempts = options.attempts ?? 20;
-	const intervalMs = options.intervalMs ?? 15_000;
-
-	const workDir = mkdtemp(join(tmp(), "decohere-create-smoke-"));
-	const npmrc = join(workDir, ".npmrc");
-	writeFile(npmrc, "@decohere:registry=https://registry.npmjs.org/\n");
-
-	const env = { ...process.env, NPM_CONFIG_USERCONFIG: npmrc };
-	const spec = `@decohere/create@${version}`;
-
-	for (let attempt = 1; ; attempt++) {
-		const view = spawn("npm", ["view", spec, "version"], { cwd: workDir, env, stdio: "pipe" });
-		if (view.status === 0) break;
-		if (attempt >= attempts) {
-			console.error(`${spec} is still not served by npm after ${attempts} tries`);
-			return { workDir, status: 1 };
-		}
-		console.log(`${spec} not served by npm yet (try ${attempt} of ${attempts}); waiting`);
-		sleep(intervalMs);
-	}
-
-	const result = spawn("npx", ["--yes", spec, "--help"], {
-		cwd: workDir,
-		env,
-		stdio: options.stdio ?? "inherit",
-	});
-
-	return {
-		workDir,
-		status: result.status ?? 1,
-	};
-}
-
-/** @param {number} ms */
-function sleepSync(ms) {
-	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-
-const isCli =
-	process.argv[1] != null && import.meta.url === pathToFileURL(resolve(process.argv[1])).href;
-
-if (isCli) {
-	const { status } = runCreateLauncherSmoke({
-		createVersion: process.env.CREATE_VERSION ?? "",
-	});
-	process.exit(status);
-}

package/src/release/capture-version.mjs

@@ -1,27 +0,0 @@
-#!/usr/bin/env node
-/**
- * Capture final version metadata from package.json
- * Outputs version and is_prerelease flags for GitHub Actions
- */
-
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-try {
-	const packageJson = JSON.parse(readFileSync(join(process.cwd(), "package.json"), "utf8"));
-	const version = packageJson.version;
-
-	if (!version) {
-		console.error("No version found in package.json");
-		process.exit(1);
-	}
-
-	console.log(`version=${version}`);
-
-	// Check if prerelease (has hyphen in version)
-	const isPrerelease = version.includes("-");
-	console.log(`is_prerelease=${isPrerelease}`);
-} catch (e) {
-	console.error(`Failed to capture version: ${e.message}`);
-	process.exit(1);
-}

package/src/release/npm-links.mjs

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-/**
- * Generate npm package links for all @decohere packages
- * Outputs markdown formatted links for GitHub release notes
- */
-
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import { listProjectDirs } from "../lib/workspace-packages.mjs";
-
-const VERSION = process.argv[2] || process.env.VERSION;
-
-if (!VERSION) {
-	console.error("VERSION not provided as argument or env var");
-	process.exit(1);
-}
-
-let links = "## Published Packages\n\n";
-
-try {
-	for (const projectDir of listProjectDirs(process.cwd())) {
-		const pkg = JSON.parse(readFileSync(join(projectDir, "package.json"), "utf8"));
-		if (pkg.name?.startsWith("@decohere/")) {
-			links += `- [\`${pkg.name}@${VERSION}\`](https://www.npmjs.com/package/${pkg.name}/v/${VERSION})\n`;
-		}
-	}
-
-	console.log(links);
-} catch (e) {
-	console.error(`Failed to generate npm links: ${e.message}`);
-	process.exit(1);
-}

package/src/release/push-prerelease-commit.mjs

@@ -1,85 +0,0 @@
-#!/usr/bin/env node
-/**
- * Publish prerelease version commit via PR
- * Validates working tree, pushes prerelease commit to a release branch,
- * and creates/updates a PR targeting the protected base branch.
- */
-
-import { execSync } from "node:child_process";
-
-function run(command) {
-	return execSync(command, { encoding: "utf8" }).trim();
-}
-
-function runInherit(command, env) {
-	execSync(command, { stdio: "inherit", env });
-}
-
-try {
-	// Check if working tree is dirty
-	const status = run("git status --porcelain");
-	if (status.trim().length > 0) {
-		console.error(
-			"::error::Working tree is dirty after version/dependency sync; refusing to publish with uncommitted changes.",
-		);
-		console.log(status);
-		process.exit(1);
-	}
-
-	// Compare HEAD with origin and create a PR branch targeting an explicit base branch.
-	const head = run("git rev-parse HEAD");
-	const sourceBranch = process.env.GITHUB_REF_NAME || run("git rev-parse --abbrev-ref HEAD");
-	const channel = process.env.RELEASE_CHANNEL ?? "beta";
-	const baseBranch = process.env.RELEASE_BASE_BRANCH || sourceBranch;
-	const releasePrBranch = `release/${channel}-${sourceBranch}-to-${baseBranch}`;
-	const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN;
-
-	try {
-		const origin = run(`git rev-parse origin/${sourceBranch}`);
-
-		if (head !== origin) {
-			console.log(
-				`Publishing release commit via PR branch origin/${releasePrBranch} (base: origin/${baseBranch})`,
-			);
-			runInherit(`git push origin HEAD:${releasePrBranch} --force`, process.env);
-
-			if (token == null || token.length === 0) {
-				throw new Error("Missing GITHUB_TOKEN/GH_TOKEN for PR upsert");
-			}
-
-			const version = process.env.RELEASE_VERSION ?? "(unknown)";
-			const ownerRepo = run("git config --get remote.origin.url")
-				.replace(/^.*github\.com[:/]/, "")
-				.replace(/\.git$/, "");
-
-			runInherit(
-				[
-					"node projects/ci-tools/src/github/create-or-update-pr.mjs",
-					`--title "chore(release): ${channel} ${version}"`,
-					`--base "${baseBranch}"`,
-					`--head "${releasePrBranch}"`,
-					`--body "Automated ${channel} version bump and dependency sync.\\n\\n- Channel: ${channel}\\n- Version: ${version}\\n- Source branch: ${sourceBranch}\\n- Base branch: ${baseBranch}\\n- Source commit: ${head}\\n\\nGenerated by pull-request workflow."`,
-					`--owner "${ownerRepo.split("/")[0]}"`,
-					`--repo "${ownerRepo.split("/")[1]}"`,
-				].join(" "),
-				{ ...process.env, GITHUB_TOKEN: token },
-			);
-		} else {
-			console.log("No prerelease version commit to push.");
-		}
-	} catch (err) {
-		const message = err?.message ?? "";
-		if (
-			message.includes(`origin/${sourceBranch}`) &&
-			message.includes("Needed a single revision")
-		) {
-			console.log(`Remote branch origin/${sourceBranch} not found, skipping push.`);
-		} else {
-			console.error("::error::Failed to publish release commit via PR branch.");
-			throw err;
-		}
-	}
-} catch (e) {
-	console.error(`Push failed: ${e.message}`);
-	process.exit(1);
-}

package/src/release/sync-dependencies.mjs

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-/**
- * Sync cross-library dependency versions
- * Conditionally runs sync with or without commit based on DRY_RUN flag
- */
-
-import { execSync } from "node:child_process";
-
-const DRY_RUN = process.env.DRY_RUN === "true";
-const DECOHERE_CONFIG = process.env.DECOHERE_CONFIG || ".decohere.js";
-
-const baseCmd = `pnpm forge --log-level info --config-file "${DECOHERE_CONFIG}" dependencies --configuration release sync`;
-
-try {
-	if (DRY_RUN) {
-		console.log(`[DRY RUN] ${baseCmd}`);
-		execSync(baseCmd, { stdio: "inherit" });
-	} else {
-		const commitCmd = `${baseCmd} --commit --message "chore: version packages and sync cross-library dependencies [skip ci]"`;
-		console.log(`Syncing with commit...`);
-		execSync(commitCmd, { stdio: "inherit" });
-	}
-} catch (e) {
-	console.error(`Dependency sync failed: ${e.message}`);
-	process.exit(1);
-}

package/tests/github/smoke-create-launcher.test.mjs

@@ -1,132 +0,0 @@
-import { fileURLToPath } from "node:url";
-import { describe, expect, it, vi } from "vitest";
-import { runCreateLauncherSmoke } from "../../src/github/smoke-create-launcher.mjs";
-
-const fs = await vi.importActual("node:fs");
-const PUBLISH_YML = fileURLToPath(
-	new URL("../../../../.github/workflows/publish.yml", import.meta.url),
-);
-
-describe("runCreateLauncherSmoke", () => {
-	it("execs npx from a temp directory, not the repo root", () => {
-		/** @type {{ cmd: string, args: string[], opts: { cwd?: string } }[]} */
-		const calls = [];
-		const written = [];
-
-		const result = runCreateLauncherSmoke({
-			createVersion: "0.0.1-dev.80",
-			tmpdir: () => "/tmp",
-			mkdtempSync: (prefix) => `${prefix}abc`,
-			writeFileSync: (path, body) => {
-				written.push({ path, body });
-			},
-			spawnSync: (cmd, args, opts) => {
-				calls.push({ cmd, args, opts });
-				return { status: 0 };
-			},
-			stdio: "pipe",
-		});
-
-		expect(result.workDir).toBe("/tmp/decohere-create-smoke-abc");
-		expect(result.workDir).not.toBe(process.cwd());
-		const npx = calls.at(-1);
-		expect(npx.cmd).toBe("npx");
-		expect(npx.args).toEqual(["--yes", "@decohere/create@0.0.1-dev.80", "--help"]);
-		expect(npx.opts.cwd).toBe("/tmp/decohere-create-smoke-abc");
-		expect(npx.opts.cwd).not.toBe(process.cwd());
-		expect(written).toEqual([
-			{
-				path: "/tmp/decohere-create-smoke-abc/.npmrc",
-				body: "@decohere:registry=https://registry.npmjs.org/\n",
-			},
-		]);
-		// The packages are public: the smoke installs them the way a user does, with no token.
-		expect(npx.opts.env.NODE_AUTH_TOKEN).toBeUndefined();
-	});
-
-	// npm's public cache can lag minutes behind a publish: the first token-free Publish ran npx
-	// 90 seconds after publishing and got ETARGET for a version the registry already had.
-	it("waits until npm serves the new version before running npx", () => {
-		/** @type {{ cmd: string, args: string[] }[]} */
-		const calls = [];
-		const sleeps = [];
-		let views = 0;
-
-		const result = runCreateLauncherSmoke({
-			createVersion: "0.0.1-dev.127",
-			tmpdir: () => "/tmp",
-			mkdtempSync: (prefix) => `${prefix}abc`,
-			writeFileSync: () => {},
-			spawnSync: (cmd, args) => {
-				calls.push({ cmd, args });
-				if (cmd === "npm") return { status: ++views < 3 ? 1 : 0 };
-				return { status: 0 };
-			},
-			sleep: (ms) => sleeps.push(ms),
-			stdio: "pipe",
-		});
-
-		expect(result.status).toBe(0);
-		expect(calls.map((call) => call.cmd)).toEqual(["npm", "npm", "npm", "npx"]);
-		expect(calls[0].args).toEqual(["view", "@decohere/create@0.0.1-dev.127", "version"]);
-		expect(sleeps).toHaveLength(2);
-	});
-
-	it("fails without running npx when npm never serves the version", () => {
-		/** @type {string[]} */
-		const commands = [];
-
-		const result = runCreateLauncherSmoke({
-			createVersion: "0.0.1-dev.127",
-			tmpdir: () => "/tmp",
-			mkdtempSync: (prefix) => `${prefix}abc`,
-			writeFileSync: () => {},
-			spawnSync: (cmd) => {
-				commands.push(cmd);
-				return { status: 1 };
-			},
-			sleep: () => {},
-			attempts: 3,
-			stdio: "pipe",
-		});
-
-		expect(result.status).toBe(1);
-		expect(commands).toEqual(["npm", "npm", "npm"]);
-	});
-
-	it("fails closed without a version", () => {
-		expect(() => runCreateLauncherSmoke({ createVersion: "" })).toThrow(
-			"CREATE_VERSION is required",
-		);
-	});
-});
-
-describe("publish.yml create smoke + tag", () => {
-	const yml = fs.readFileSync(PUBLISH_YML, "utf8");
-
-	it("wires create smoke through the isolated launcher", () => {
-		expect(yml).toContain("node projects/ci-tools/src/github/smoke-create-launcher.mjs");
-		expect(yml).toContain("CREATE_VERSION:");
-		expect(yml).not.toContain("npx --yes");
-	});
-
-	it("reads npm without a token: the packages are public and publishing is OIDC", () => {
-		const workflows = fileURLToPath(new URL("../../../../.github/", import.meta.url));
-		const files = fs
-			.readdirSync(workflows, { recursive: true })
-			.filter((file) => /\.ya?ml$/.test(file));
-		expect(files.length).toBeGreaterThan(0);
-		for (const file of files) {
-			expect(fs.readFileSync(`${workflows}${file}`, "utf8"), file).not.toMatch(
-				/NODE_AUTH_TOKEN|_authToken/,
-			);
-		}
-	});
-
-	it("grants the tag job actions:read so publish-prepare can download CI artifacts", () => {
-		const tag = yml.slice(yml.indexOf("\n  tag:"));
-		const perms = tag.slice(tag.indexOf("permissions:"), tag.indexOf("steps:"));
-		expect(perms).toMatch(/contents:\s*write/);
-		expect(perms).toMatch(/actions:\s*read/);
-	});
-});