@joshuafolkken/kit 1.1035.0 → 1.1050.0

package/scripts/run/run-ship-preflight.ts

@@ -0,0 +1,87 @@
+import { readFile } from 'node:fs/promises'
+import { changed_paths } from '#scripts/git/changed-paths'
+import { git_branch } from '#scripts/git/git-branch'
+import { git_gh_command } from '#scripts/git/git-gh-command'
+import { git_preflight } from '#scripts/git/git-preflight'
+import type { JoshResult } from '#scripts/josh/josh-run'
+import { error_text } from '#scripts/lib/error-message'
+import { live_evidence } from '#scripts/review/live-evidence'
+import { run_ship_scoped } from './run-ship-scoped'
+
+// `josh ship`'s first stage (joshuafolkken/kit#2946). A detached ship used to meet the pull request's
+// preconditions only at the commit stage — `git -y`'s preflight — or at the merge — `followup`'s
+// live-evidence refusal — each after the review and the gate had already run, so every such stop
+// relaunched a session to repeat them. **Every precondition decidable before the review is asked here,
+// and all of them are reported at once.** No check is new: the classification, issue and branch answers
+// are `git_preflight.problems_of`, and the evidence answer is `live_evidence.verdict_for` over the same
+// changed paths and the body this ship will deliver — `--body-file` when given, else the open PR's.
+//
+// The scoped pair runs last, met rather than stopped on (`run-ship-scoped.ts`), so the review and the
+// gate start on a tree both checks are green on.
+
+const SUCCESS_EXIT_CODE = 0
+const FAILURE_EXIT_CODE = 1
+const EVIDENCE_PROBLEM = `This change touches runtime code, but the PR body has no ${live_evidence.EVIDENCE_HEADING} section: run the acceptance criteria for real and pass the body with --body-file <path>.`
+
+interface PreflightRequest {
+	title: string
+	body_path: string | undefined
+}
+
+async function body_text(body_path: string | undefined): Promise<string | undefined> {
+	if (body_path !== undefined) return await readFile(body_path, 'utf8')
+
+	return await git_gh_command.pr_get_body(await git_branch.current())
+}
+
+async function evidence_problems(body_path: string | undefined): Promise<Array<string>> {
+	const [paths, body] = await Promise.all([
+		changed_paths.read_changed_paths(false),
+		body_text(body_path),
+	])
+
+	return live_evidence.verdict_for(paths, body) === 'required' ? [EVIDENCE_PROBLEM] : []
+}
+
+function refusal(problems: ReadonlyArray<string>): JoshResult {
+	const lines = problems.map((problem) => `  - ${problem}`)
+	const head = `${String(problems.length)} pull-request precondition(s) unmet before the review and the gate:`
+
+	return { code: FAILURE_EXIT_CODE, out: [head, ...lines].join('\n') }
+}
+
+// The reads here run in the ship's own process, where the commit stage's ran in a `git -y` child: a
+// throw — a `--body-file` path that does not exist, a git read that failed — would escape `ship()`
+// past the stop a supervised ship hands back on, so it is reported as one more unmet precondition.
+// Each side is caught on its own, so one side's failed read never hides what the other side found.
+async function caught(problems: Promise<Array<string>>): Promise<Array<string>> {
+	try {
+		return await problems
+	} catch (error) {
+		return [error_text.message_of(error)]
+	}
+}
+
+async function asked_problems(request: PreflightRequest): Promise<Array<string>> {
+	const [preflight, evidence] = await Promise.all([
+		caught(git_preflight.problems_of({ cli_input: request.title, will_open_pr: true })),
+		caught(evidence_problems(request.body_path)),
+	])
+
+	return [...preflight, ...evidence]
+}
+
+async function stage(request: PreflightRequest): Promise<JoshResult> {
+	const problems = await asked_problems(request)
+
+	if (problems.length > 0) return refusal(problems)
+
+	const scoped = await run_ship_scoped.scoped_pair()
+
+	return scoped.code === SUCCESS_EXIT_CODE ? { code: SUCCESS_EXIT_CODE, out: 'ready' } : scoped
+}
+
+const run_ship_preflight = { EVIDENCE_PROBLEM, stage }
+
+export type { PreflightRequest }
+export { run_ship_preflight }

package/scripts/run/run-ship-review-steps.ts

@@ -1,7 +1,5 @@
 import { agent_argv, type AgentArgv } from '#scripts/agent/agent-argv'
 import { agent_role_profile, type AgentProfile } from '#scripts/agent/agent-role-profile'
-import { gate_tree } from '#scripts/gate/gate-tree'
-import { scoped_green } from '#scripts/gate/scoped-green'
 import { PROJECT_ROOT } from '#scripts/init/init-paths'
 import { josh_command, type JoshResult } from '#scripts/josh/josh-run'
 import { stamp_file } from '#scripts/josh/stamp-file'
@@ -9,6 +7,7 @@ import { lane_child_marker } from '#scripts/lane/lane-child-marker'
 import { openai_review_broker } from '#scripts/lane/openai-review-broker'
 import { detached_launch } from './detached-launch'
 import { run_ship_review, type RoundOutcome, type ScoredVerdict } from './run-ship-review'
+import { run_ship_scoped, type Phase } from './run-ship-scoped'
 
 // The side effects of `josh ship --review` (joshuafolkken/kit#2427): the round-1 review the chain used
 // to open, launch, join, attest and record across five agent turns, run by the supervisor beside the
@@ -47,7 +46,10 @@ const FIXED_JOIN_NOTE =
 	'the round-1 gate read the tree before the review fixes — drained, not judged; the gate stage re-runs it.'
 const ROUND_TWO_SKIPPED_NOTE = 'round 2 not due — nothing left to verify; shipping on.'
 
-type Phase = () => Promise<JoshResult>
+// The scoped pair's precondition, met by the supervisor itself rather than stopped on
+// (joshuafolkken/kit#2500), single-sourced with the preflight and gate stages (joshuafolkken/kit#2946).
+const { run_phases, scoped_pair } = run_ship_scoped
+
 type PromptOf = (brief_path: string, findings_path: string) => string
 
 function failure(out: string): JoshResult {
@@ -153,17 +155,6 @@ async function record_and_route(
 	return outcome.is_passing ? { code: SUCCESS_EXIT_CODE, out } : failure(out)
 }
 
-async function run_phases(phases: ReadonlyArray<Phase>): Promise<JoshResult> {
-	let last: JoshResult = { code: SUCCESS_EXIT_CODE, out: '' }
-
-	for (const phase of phases) {
-		last = await phase()
-		if (last.code !== SUCCESS_EXIT_CODE) return last
-	}
-
-	return last
-}
-
 // A brief-minting command, then a reviewer handed what it printed.
 function reviewed(
 	open: ReadonlyArray<string>,
@@ -185,18 +176,6 @@ function reviewed(
 	]
 }
 
-// The scoped pair's precondition, met by the supervisor itself rather than stopped on
-// (joshuafolkken/kit#2500): only the checks with no green record for this tree run — the same
-// question `review:brief` and the local gate refuse on — so a fresh record costs nothing and a stale
-// or absent one costs a scoped run instead of a stop and a relaunched session. A check that genuinely
-// fails still stops the ship, its output forwarded to the ship log.
-async function scoped_pair(): Promise<JoshResult> {
-	const tree = await gate_tree.read_gate_tree()
-	const scripts = scoped_green.missing_scripts(tree.files, tree.base)
-
-	return await run_phases(scripts.map((script) => async () => await josh([script])))
-}
-
 // Fixes made in place are counted only once the scoped pair is green on the fixed tree. The reviewer is
 // asked to leave it green; this is the check that it did, and a fix it could not get green is routed as
 // the finding it still is — recorded, then stopped before the gate and the commit take it in.

package/scripts/run/run-ship-review.ts

@@ -154,6 +154,14 @@ function round_one_outcome(verdict: ScoredVerdict): RoundOutcome {
 	return { is_passing: true, note: verdict.kind === VERDICT.FIXED ? FIXED_NOTE : CLEAN_NOTE }
 }
 
+// Whether a findings file records a clean round 1 (joshuafolkken/kit#2945). A resumed round 1 narrows to
+// the delta only past a review that found nothing to fix. A blocking one has a finding in a file the
+// delta may not touch. A fixed one approved its own edits, not the briefed tree the delta is measured
+// from, so a file reverted to that tree would drop out of the delta with its finding back in it.
+function is_clean_round_one(text: string | undefined): boolean {
+	return read_verdict(text).kind === VERDICT.CLEAN
+}
+
 // Round 2 is final and reads only, so it passes clean or Low-only alone — a fix it made would itself be
 // unreviewed.
 function round_two_outcome(verdict: ScoredVerdict): RoundOutcome {
@@ -166,6 +174,7 @@ const run_ship_review = {
 	FIXED_PREFIX,
 	UNVERIFIED_OUTCOME,
 	VERDICT,
+	is_clean_round_one,
 	read_verdict,
 	reviewer_prompt,
 	round_one_outcome,

package/scripts/run/run-ship-scoped.ts

@@ -0,0 +1,44 @@
+import { gate_tree } from '#scripts/gate/gate-tree'
+import { scoped_green } from '#scripts/gate/scoped-green'
+import { josh_command, type JoshResult } from '#scripts/josh/josh-run'
+
+// The scoped pair `josh ship` meets itself rather than stops on (joshuafolkken/kit#2500), shared by
+// every stage that needs a green record for this tree (joshuafolkken/kit#2946): the preflight stage at
+// the start, the review rounds, and the gate stage — a reviewer may have edited the tree after round
+// 1's pair ran, and `josh gate` refuses a tree with no green record.
+
+const SUCCESS_EXIT_CODE = 0
+const should_forward_stderr = true
+
+type Phase = () => Promise<JoshResult>
+
+async function run_phases(phases: ReadonlyArray<Phase>): Promise<JoshResult> {
+	let last: JoshResult = { code: SUCCESS_EXIT_CODE, out: '' }
+
+	for (const phase of phases) {
+		last = await phase()
+		if (last.code !== SUCCESS_EXIT_CODE) return last
+	}
+
+	return last
+}
+
+// Only the checks with no green record for this tree run — the same question `review:brief` and the
+// local gate refuse on — so a fresh record costs nothing and a stale or absent one costs a scoped run
+// instead of a stop and a relaunched session. A check that genuinely fails still stops the ship, its
+// output forwarded to the ship log.
+async function scoped_pair(): Promise<JoshResult> {
+	const tree = await gate_tree.read_gate_tree()
+	const scripts = scoped_green.missing_scripts(tree.files, tree.base)
+
+	return await run_phases(
+		scripts.map(
+			(script) => async () => await josh_command.josh_run([script], should_forward_stderr),
+		),
+	)
+}
+
+const run_ship_scoped = { run_phases, scoped_pair }
+
+export type { Phase }
+export { run_ship_scoped }

package/scripts/run/run-ship-stage.ts

@@ -17,6 +17,7 @@ import { z } from 'zod'
 // re-run on an unchanged tree a reuse rather than a second execution. No quality gate is folded away.
 
 const STAGE = {
+	PREFLIGHT: 'preflight',
 	REVIEW: 'review',
 	GATE: 'gate',
 	COMMIT: 'commit',
@@ -78,7 +79,7 @@ function mark_done(target: string, stage: Stage): void {
 	stamp_file.replace_stamp(target, { done: [...done] })
 }
 
-// Removed once the report stage completes, so a later ship of the same issue starts from the gate.
+// Removed once the report stage completes, so a later ship of the same issue starts from the preflight.
 function clear(target: string): void {
 	stamp_file.remove_stamp(target)
 }
@@ -90,6 +91,9 @@ function is_shipped(state: ShipState): boolean {
 }
 
 const DONE_BY: Record<Stage, (done: ReadonlySet<string>, state: ShipState) => boolean> = {
+	// The preflight (joshuafolkken/kit#2946) asks what the commit stage would refuse on, so a commit is
+	// its output as it is the gate's; a resumed commit stage still asks `git -y`'s own preflight.
+	[STAGE.PREFLIGHT]: (_done, state) => state.is_merged || state.is_committed,
 	// The `--review` round (joshuafolkken/kit#2427) precedes the commit, so a commit is its output as it
 	// is the gate's. A record alone is not honored: before a commit the tree may have been edited since
 	// the recorded round, and only a commit pins the tree that round read.

package/scripts/run/run-ship-steps.ts

@@ -0,0 +1,105 @@
+import { josh_command, type JoshResult } from '#scripts/josh/josh-run'
+import { run_ship } from './run-ship'
+import { run_ship_preflight } from './run-ship-preflight'
+import { run_ship_review_steps } from './run-ship-review-steps'
+import { run_ship_scoped } from './run-ship-scoped'
+import { run_ship_stage, type ShipState, type Stage } from './run-ship-stage'
+
+// The stages `josh ship` runs, in the order a change ships (joshuafolkken/kit#2398), kept apart from the
+// chaining CLI so the order is read in one place.
+
+const should_forward_stderr = true
+
+interface ShipArguments {
+	title: string
+	number: string
+	notify: ReadonlyArray<string>
+	body: ReadonlyArray<string>
+	body_path: string | undefined
+	cites: ReadonlyArray<string>
+	is_review: boolean
+	is_detach: boolean
+}
+
+interface Step {
+	stage: Stage
+	header: string
+	run: (args: ShipArguments, state: ShipState) => Promise<JoshResult>
+}
+
+const { STAGE } = run_ship_stage
+
+async function josh(argv: ReadonlyArray<string>): Promise<JoshResult> {
+	return await josh_command.josh_run(argv, should_forward_stderr)
+}
+
+// joshuafolkken/kit#2946: the pull request's preconditions and the scoped pair are asked first, so a
+// stop they would cause lands before the review and the gate rather than after them.
+const PREFLIGHT_STEP: Step = {
+	stage: STAGE.PREFLIGHT,
+	header: run_ship.PREFLIGHT_HEADER,
+	run: async (args) =>
+		await run_ship_preflight.stage({ title: args.title, body_path: args.body_path }),
+}
+
+// The gate before the commit, the commit/push/PR before the merge. The gate meets the scoped pair
+// first: a round-1 reviewer may have edited the tree since the preflight, and `josh gate` refuses a tree
+// with no green record (joshuafolkken/kit#2946). The commit step carries the `--skip-*` flags a resumed
+// ship needs, so an existing commit or push is never made twice.
+const COMMIT_STEPS: ReadonlyArray<Step> = [
+	{
+		stage: STAGE.GATE,
+		header: run_ship.GATE_HEADER,
+		run: async () =>
+			await run_ship_scoped.run_phases([
+				run_ship_scoped.scoped_pair,
+				async () => await josh(['gate']),
+			]),
+	},
+	{
+		stage: STAGE.COMMIT,
+		header: run_ship.COMMIT_HEADER,
+		run: async (args, state) =>
+			await josh(['git', '-y', ...run_ship_stage.commit_flags(state), ...args.body, args.title]),
+	},
+]
+
+// The merge before the report bookkeeping.
+const MERGE_STEPS: ReadonlyArray<Step> = [
+	{
+		stage: STAGE.FOLLOWUP,
+		header: run_ship.FOLLOWUP_HEADER,
+		run: async (args) => await josh(['followup', args.title, ...args.notify]),
+	},
+	{
+		stage: STAGE.REPORT,
+		header: run_ship.REPORT_HEADER,
+		run: async (args) => await josh(['run:tail', args.number, ...args.cites]),
+	},
+]
+
+// `--review` (joshuafolkken/kit#2427) puts the supervised round-1 review in front of the gate: it
+// launches the gate itself, so the gate stage that follows reuses that tree's green record. It also
+// puts the round-2 pass between the commit and the followup (joshuafolkken/kit#2489), so the PR opens
+// between the rounds and round 2 runs beside CI — a no-op when round 1 left no fix delta.
+const REVIEW_STEP: Step = {
+	stage: STAGE.REVIEW,
+	header: run_ship.REVIEW_HEADER,
+	run: async (args) => await run_ship_review_steps.review_stage(args.number),
+}
+const ROUND_TWO_STEP: Step = {
+	stage: STAGE.ROUND_TWO,
+	header: run_ship.ROUND_TWO_HEADER,
+	run: async (args) => await run_ship_review_steps.round_two_stage(args.number),
+}
+
+function steps(args: ShipArguments): ReadonlyArray<Step> {
+	if (!args.is_review) return [PREFLIGHT_STEP, ...COMMIT_STEPS, ...MERGE_STEPS]
+
+	return [PREFLIGHT_STEP, REVIEW_STEP, ...COMMIT_STEPS, ROUND_TWO_STEP, ...MERGE_STEPS]
+}
+
+const run_ship_steps = { steps }
+
+export type { ShipArguments, Step }
+export { run_ship_steps }

package/scripts/run/run-ship.ts

@@ -9,6 +9,7 @@
 // `run:tail`, ship stops at the first failed step: a red gate must never reach the commit, so the
 // composite ends at the failure, and the report names the step that failed so the run reads only it.
 
+const PREFLIGHT_HEADER = '=== preflight ==='
 const REVIEW_HEADER = '=== review ==='
 const GATE_HEADER = '=== gate ==='
 const COMMIT_HEADER = '=== commit/push/PR ==='
@@ -63,6 +64,7 @@ const run_ship = {
 	COMMIT_HEADER,
 	FOLLOWUP_HEADER,
 	GATE_HEADER,
+	PREFLIGHT_HEADER,
 	REPORT_HEADER,
 	REVIEW_HEADER,
 	ROUND_TWO_HEADER,

package/scripts/run/run-wake-cli.ts

@@ -290,7 +290,7 @@ function start(context: WakeContext, interval: string | undefined): number {
 	const existing = run_wake.read_wake(context.wake_target)
 
 	if (existing !== undefined && run_wake.is_supervisor_live(existing)) {
-		console.error(run_wake_describe.describe_wake(existing, context))
+		console.error(run_wake_describe.describe_wake_cited(existing, context))
 
 		return report(RUNNING_VERDICT)
 	}
@@ -342,7 +342,7 @@ function list(context: WakeContext): number {
 
 	if (wake === undefined) return report(NONE_VERDICT)
 
-	console.error(run_wake_describe.describe_wake(wake, context))
+	console.error(run_wake_describe.describe_wake_cited(wake, context))
 
 	return report(run_wake.is_supervisor_live(wake) ? SUPERVISING_VERDICT : STALE_VERDICT)
 }

package/scripts/run/run-wake-describe.ts

@@ -1,4 +1,6 @@
 import { agent_role_profile } from '#scripts/agent/agent-role-profile'
+import { gh_spawn } from '#scripts/gh/gh-spawn'
+import { issue_citation } from '#scripts/rules/issue-citation'
 import { run_carry, type CarryRead } from './run-carry'
 import { run_event_stream } from './run-event-stream'
 import { run_liveness } from './run-liveness'
@@ -9,6 +11,7 @@ import { run_wake, type RunWake } from './run-wake'
 // record reads back to a person lives here, one cohesive block.
 
 const UNKNOWN_CUTS = 'an unreadable number of'
+const REPO_LOOKUP_TIMEOUT_MS = 10_000
 const STOP_COMMAND = 'pnpm josh run:wake --stop'
 
 // The three paths every verb needs: the carry record it reads, its own record, and the work tree a
@@ -91,7 +94,22 @@ function describe_wake(wake: RunWake, context: WakeContext): string {
 		.join('\n')
 }
 
-const run_wake_describe = { STOP_COMMAND, describe_wake }
+// The description as a person reads it, every issue on it a number-link (joshuafolkken/kit#2943). The
+// invocation and the newest event both name issues (`backlogrun #1 #2`, `#1904 merged`), and a report
+// that copies them bare is what the Stop guard sends back. The repository is asked here, bounded, rather
+// than in the context every verb resolves: only the two describing verbs print it, and a lookup that
+// does not answer leaves the description as it was rather than withholding it.
+function cite_description(description: string, repo: string | undefined): string {
+	return repo === undefined ? description : issue_citation.linkify(description, repo)
+}
+
+function describe_wake_cited(wake: RunWake, context: WakeContext): string {
+	const repo = gh_spawn.get_repo_name_with_owner_within(REPO_LOOKUP_TIMEOUT_MS)
+
+	return cite_description(describe_wake(wake, context), repo)
+}
+
+const run_wake_describe = { STOP_COMMAND, cite_description, describe_wake, describe_wake_cited }
 
 export type { WakeContext }
 export { run_wake_describe }

package/scripts/run/run-watcher-hook.ts

@@ -81,6 +81,6 @@ async function watcher_hook_reason(
 	return await stale_reason(transcript, now_ms)
 }
 
-const run_watcher_hook = { SWITCH_ENV_KEY, STAMP_PREFIX, watcher_hook_reason }
+const run_watcher_hook = { SWITCH_ENV_KEY, STAMP_PREFIX, transcript_of, watcher_hook_reason }
 
 export { run_watcher_hook }

package/scripts/time-runtime/time-bundle-call.ts

@@ -336,8 +336,8 @@ function josh_subcommand(command: string): string | undefined {
 }
 
 // Whether a shell line is one of the read-only `josh` bookkeeping commands, and nothing else. A chained
-// line falls through. An alias is resolved to its canonical name first — a run may type `josh ist` for
-// `issue:state` — so the allow-list holds canonical names alone. Everything not on the list falls
+// line falls through. An alias is resolved to its canonical name first, so the allow-list holds
+// canonical names alone. Everything not on the list falls
 // through to the read/mutation test, which is what keeps `josh gate` / `followup` / `git`
 // non-bundleable (joshuafolkken/kit#1875).
 function is_read_josh(command: string): boolean {

package/scripts/version/npm-registry.ts

@@ -0,0 +1,97 @@
+import { migrate_logic } from '#scripts/registry-migration/migrate-logic'
+import { execaSync } from 'execa'
+import { z } from 'zod'
+import { safe_json_parse } from './parse-json'
+import { release_age } from './release-age'
+
+// The public npm registry, read without credentials so a consumer who installed from public npm
+// can see the latest release without a `read:packages` GitHub token (joshuafolkken/kit#2882). The
+// GitHub Packages versions API stays the source for a scope routed there, and the fallback for a
+// package public npm does not carry.
+const PUBLIC_REGISTRY = 'https://registry.npmjs.org'
+// The abbreviated packument carries `dist-tags` without every version's full manifest.
+const ABBREVIATED_ACCEPT = 'application/vnd.npm.install-v1+json'
+const FULL_ACCEPT = 'application/json'
+const REQUEST_TIMEOUT_MS = 10_000
+const SCOPE_SEPARATOR = '/'
+const ENCODED_SCOPE_SEPARATOR = '%2f'
+const SCOPE_PATTERN = /^@[^/]+(?=\/)/u
+const SCOPE_REGISTRY_SUFFIX = ':registry'
+const github_scopes = new Map<string, boolean>()
+
+// The version commands are synchronous end to end and exported that way to consumers, so the
+// request runs in a child Node process rather than turning the whole chain async. Node's own
+// `fetch` needs no external binary, and a non-2xx answer exits non-zero so it reads as "no answer".
+const FETCH_SCRIPT = [
+	'const [url, accept] = process.argv.slice(1)',
+	'const response = await fetch(url, { headers: { accept } })',
+	'if (!response.ok) process.exit(1)',
+	'process.stdout.write(await response.text())',
+].join('\n')
+
+const latest_schema = z.looseObject({ 'dist-tags': z.looseObject({ latest: z.string() }) })
+const times_schema = z.looseObject({ time: release_age.release_times_schema })
+
+// The packument URL for a package name; a scoped name keeps its `@` and encodes the separator, the
+// form the registry documents for scoped packages.
+function packument_url(package_name: string): string {
+	return `${PUBLIC_REGISTRY}/${package_name.replace(SCOPE_SEPARATOR, () => ENCODED_SCOPE_SEPARATOR)}`
+}
+
+function read_packument(package_name: string, accept: string): unknown {
+	const result = execaSync(
+		process.execPath,
+		['--input-type=module', '-e', FETCH_SCRIPT, packument_url(package_name), accept],
+		{ reject: false, timeout: REQUEST_TIMEOUT_MS },
+	)
+	if (result.exitCode !== 0) return undefined
+
+	return safe_json_parse(result.stdout)
+}
+
+// Whether this checkout installs the package's scope from GitHub Packages, read with the same
+// `pnpm config get` `josh registry:migrate` uses (project `.npmrc` over user `~/.npmrc`). The two
+// registries are published by parallel jobs and can drift, so a consumer routed to GitHub Packages
+// keeps reading it: public npm could otherwise offer a release its registry does not carry yet.
+// Memoized per scope — kit and app-kit share one, and one report asks for both packages.
+function is_github_scope(scope: string): boolean {
+	const is_cached_github = github_scopes.get(scope)
+	if (is_cached_github !== undefined) return is_cached_github
+	const result = execaSync('pnpm', ['config', 'get', `${scope}${SCOPE_REGISTRY_SUFFIX}`], {
+		reject: false,
+		timeout: REQUEST_TIMEOUT_MS,
+	})
+	const is_github = result.exitCode === 0 && migrate_logic.is_github_tarball(result.stdout.trim())
+
+	github_scopes.set(scope, is_github)
+
+	return is_github
+}
+
+function is_public_source(package_name: string): boolean {
+	const scope = SCOPE_PATTERN.exec(package_name)?.[0]
+
+	return scope === undefined || !is_github_scope(scope)
+}
+
+// The `latest` dist-tag on public npm, or nothing when the package is not installed from there or
+// the registry cannot answer for it (offline, timed out, or not published there).
+function read_latest(package_name: string): string | undefined {
+	if (!is_public_source(package_name)) return undefined
+	const parsed = latest_schema.safeParse(read_packument(package_name, ABBREVIATED_ACCEPT))
+
+	return parsed.success ? parsed.data['dist-tags'].latest : undefined
+}
+
+// The version → publish-date map from public npm, under the same source rule as `read_latest`. It
+// also carries `created` / `modified` keys, which the release-age selector skips as non-semver.
+function read_release_times(package_name: string): Record<string, string> | undefined {
+	if (!is_public_source(package_name)) return undefined
+	const parsed = times_schema.safeParse(read_packument(package_name, FULL_ACCEPT))
+
+	return parsed.success ? parsed.data.time : undefined
+}
+
+const npm_registry = { packument_url, read_latest, read_release_times }
+
+export { npm_registry }

package/scripts/version/version-commands.ts

@@ -13,6 +13,7 @@ import {
 	type VersionSnapshot,
 } from './version-check-logic'
 import type {
+	PackageVersionConfig,
 	UpstreamHookContext,
 	UpstreamVersionConfig,
 	VersionCommandConfig,
@@ -29,11 +30,11 @@ const NO_QUARANTINE_MINUTES = 0
 // whose `installable` is undefined when the timestamps cannot be read — the report then renders
 // exactly as it did before (joshuafolkken/kit#808).
 //
-// Skipped entirely unless some target is behind `latest`: the timestamps cost a second `gh api`
+// Skipped entirely unless some target is behind `latest`: the timestamps cost a second registry
 // round trip per package, and a package with nothing stale has no gap for a hold to explain. On the
 // common all-current run the report costs exactly what it did before this feature.
 function read_release_hold(
-	versions_endpoint: string | undefined,
+	package_config: PackageVersionConfig,
 	latest: string,
 	versions: ReadonlyArray<string | undefined>,
 ): ReleaseHold | undefined {
@@ -45,7 +46,7 @@ function read_release_hold(
 	// a registry round trip discovering that.
 	if (minimum_age_minutes <= NO_QUARANTINE_MINUTES) return undefined
 	const installable = release_hold.resolve_installable(
-		fetch_release_times(versions_endpoint),
+		fetch_release_times(package_config.versions_endpoint, package_config.package_name),
 		latest,
 		minimum_age_minutes,
 		Date.now(),
@@ -157,7 +158,7 @@ function read_upstream_report(
 	// After the effective install is attached, so its version counts toward the staleness gate.
 	// Only the effective install is peer-resolved, so it is the only target the window can hold back.
 	const hold = is_hold_wanted
-		? read_release_hold(upstream.versions_endpoint, latest, [report.effective?.version])
+		? read_release_hold(upstream, latest, [report.effective?.version])
 		: undefined
 	if (hold !== undefined) report.hold = hold
 

package/scripts/version/version-remote.ts

@@ -1,5 +1,6 @@
 import { git_gh_exec } from '#scripts/git/git-gh-exec'
 import { error_text } from '#scripts/lib/error-message'
+import { npm_registry } from './npm-registry'
 import { safe_json_parse } from './parse-json'
 import { release_age } from './release-age'
 
@@ -22,14 +23,18 @@ function require_endpoint(versions_endpoint: string | undefined, package_name: s
 	)
 }
 
-// Fetch the latest published version from a GitHub Packages versions endpoint. The endpoint is
-// supplied per package (e.g. `/users/joshuafolkken/packages/npm/kit/versions?per_page=1`) so the
-// same fetcher serves kit, jgame, and app-kit. Guards an undefined/empty endpoint and wraps
-// `gh api` failures with an actionable message instead of a raw ExecaSyncError stack. The detail is
-// the shared layer's failure text: gh's own stderr (e.g. "gh: Not Found (HTTP 404)") when it wrote
-// one, execa's message otherwise, followed by any JSON error body gh wrote to stdout.
+// Fetch the latest published version: public npm's `latest` dist-tag first, which needs no
+// credentials (joshuafolkken/kit#2882), then the GitHub Packages versions endpoint for a package
+// public npm does not answer for. The endpoint is supplied per package (e.g.
+// `/users/joshuafolkken/packages/npm/kit/versions?per_page=1`) so the same fetcher serves kit, jgame,
+// and app-kit. Guards an undefined/empty endpoint and wraps `gh api` failures with an actionable
+// message instead of a raw ExecaSyncError stack. The detail is the shared layer's failure text: gh's
+// own stderr (e.g. "gh: Not Found (HTTP 404)") when it wrote one, execa's message otherwise, followed
+// by any JSON error body gh wrote to stdout.
 function fetch_latest_version(versions_endpoint: string | undefined, package_name: string): string {
 	const endpoint = require_endpoint(versions_endpoint, package_name)
+	const public_latest = npm_registry.read_latest(package_name)
+	if (public_latest !== undefined) return public_latest
 
 	try {
 		return git_gh_exec.exec_gh_api_sync({ path: endpoint, jq_filter: '.[0].name' }).trim()
@@ -59,19 +64,28 @@ function with_page_size(endpoint: string, page_size: number): string {
 	return `${path_part}?${query.toString()}`
 }
 
+function read_github_release_times(versions_endpoint: string): Record<string, string> | undefined {
+	const endpoint = with_page_size(versions_endpoint, TIMES_PAGE_SIZE)
+	const stdout = git_gh_exec.read_gh_api_sync({ path: endpoint, jq_filter: TIMES_JQ })
+	if (stdout === undefined) return undefined
+	const parsed = release_age.release_times_schema.safeParse(safe_json_parse(stdout))
+
+	return parsed.success ? parsed.data : undefined
+}
+
 // Publish timestamps for the package's recent releases, or nothing. Unlike `fetch_latest_version`
 // this never throws: the timestamps only enrich an explanation, so a package whose history cannot be
-// read keeps the report it had before (joshuafolkken/kit#808).
+// read keeps the report it had before (joshuafolkken/kit#808). Read in the same source order as
+// the latest, so the hold is explained against the registry `latest` came from.
 function fetch_release_times(
 	versions_endpoint: string | undefined,
+	package_name: string,
 ): Record<string, string> | undefined {
 	if (versions_endpoint === undefined || versions_endpoint.trim() === '') return undefined
-	const endpoint = with_page_size(versions_endpoint, TIMES_PAGE_SIZE)
-	const stdout = git_gh_exec.read_gh_api_sync({ path: endpoint, jq_filter: TIMES_JQ })
-	if (stdout === undefined) return undefined
-	const parsed = release_age.release_times_schema.safeParse(safe_json_parse(stdout))
 
-	return parsed.success ? parsed.data : undefined
+	return (
+		npm_registry.read_release_times(package_name) ?? read_github_release_times(versions_endpoint)
+	)
 }
 
 export { fetch_latest_version, fetch_release_times, with_page_size }