@joshuafolkken/kit 1.1035.0 → 1.1094.0

package/dist/version/index.js

@@ -66,6 +66,19 @@ import { existsSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
 
+// scripts/lib/json-value.ts
+function parse_or_undefined(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function is_record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var json_value = { parse_or_undefined, is_record };
+
 // scripts/lib/schemas.ts
 import { z } from "zod";
 var overrides_snapshot_schema = z.record(z.string(), z.string());
@@ -98,22 +111,13 @@ var json_object_schema = z.record(z.string(), z.unknown());
 var string_array_schema = z.array(z.string());
 var string_record_schema = z.record(z.string(), z.string());
 
-// scripts/version/parse-json.ts
-function safe_json_parse(raw) {
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return void 0;
-  }
-}
-
 // scripts/version/effective-upstream.ts
 var PACKAGE_JSON = "package.json";
 var MAX_WALK_DEPTH = 64;
 function read_matching_version(manifest_path, package_name) {
   if (!existsSync(manifest_path)) return void 0;
   const parsed = package_named_version_schema.safeParse(
-    safe_json_parse(readFileSync(manifest_path, "utf8"))
+    json_value.parse_or_undefined(readFileSync(manifest_path, "utf8"))
   );
   if (!parsed.success) return void 0;
   if (parsed.data.name !== package_name) return void 0;
@@ -151,7 +155,7 @@ function resolve_effective_upstream_version(base_url, package_name, options = {}
 }
 
 // scripts/version/version-commands.ts
-import { execaSync as execaSync3 } from "execa";
+import { execaSync as execaSync4 } from "execa";
 
 // scripts/version/release-age.ts
 import { readFileSync as readFileSync2 } from "node:fs";
@@ -258,13 +262,9 @@ function build_release_hold_notes(version, latest, installable, minimum_age_minu
   return [format_release_hold_note(version, latest, installable, minimum_age_minutes)];
 }
 var release_hold = {
-  HOLD_LABEL,
-  is_at_or_above,
-  is_latest_withheld,
   resolve_installable,
   is_release_age_hold,
   format_window,
-  format_release_hold_note,
   build_release_hold_notes
 };
 
@@ -283,7 +283,7 @@ function read_running_version(self_directory) {
   const package_path = resolve_self_package_path(self_directory);
   if (!existsSync2(package_path)) return void 0;
   const parsed = package_version_schema.safeParse(
-    safe_json_parse(readFileSync3(package_path, "utf8"))
+    json_value.parse_or_undefined(readFileSync3(package_path, "utf8"))
   );
   return parsed.success ? parsed.data.version : void 0;
 }
@@ -463,19 +463,23 @@ var version_check_logic = {
   format_dual_version_output,
   format_running_line,
   format_upstream_lines,
-  format_upstream_global_line,
   build_dual_upgrade_commands,
   build_upstream_upgrade_commands,
   build_upstream_upgrade_notes,
   build_effective_upgrade_commands,
   build_effective_upgrade_notes,
-  build_project_upgrade_commands,
   format_update_command,
   format_effective_outcome,
   build_upgrade_shell_command,
   unique_upgrade_commands
 };
 
+// scripts/git/git-execa-error.ts
+function has_timed_out(error) {
+  if (typeof error !== "object" || error === null || !("timedOut" in error)) return false;
+  return error.timedOut === true;
+}
+
 // scripts/josh/agent-session-environment.ts
 var SESSION_ID_KEY = "CLAUDE_CODE_SESSION_ID";
 var PARENT_SESSION_KEYS = [
@@ -563,22 +567,19 @@ function message_of(error) {
 }
 var error_text = { message_of };
 
-// scripts/git/git-gh-exec.ts
+// scripts/gh/git-gh-exec.ts
 import { execa as execa2, execaSync } from "execa";
 
-// scripts/git/git-execa-error.ts
-function has_timed_out(error) {
-  if (typeof error !== "object" || error === null || !("timedOut" in error)) return false;
-  return error.timedOut === true;
-}
+// scripts/lib/timeouts.ts
+var COMMAND_TIMEOUT_MS = 3e4;
 
-// scripts/git/git-gh-check.ts
+// scripts/gh/git-gh-check.ts
 import { execa } from "execa";
 var GH_NOT_INSTALLED_MSG = "gh CLI is not installed. Install it from https://cli.github.com/";
 var gh_check = {};
 async function run_gh_check() {
   try {
-    await execa("gh", ["--version"]);
+    await execa("gh", ["--version"], { timeout: COMMAND_TIMEOUT_MS });
   } catch {
     delete gh_check.promise;
     throw new Error(GH_NOT_INSTALLED_MSG);
@@ -589,9 +590,6 @@ async function check_gh_installed() {
   await gh_check.promise;
 }
 
-// scripts/git/git-gh-failure.ts
-import { z as z3 } from "zod";
-
 // scripts/git/parse-json-array.ts
 var MALFORMED_JSON = /* @__PURE__ */ Symbol("malformed-json");
 function parse_json_loose(raw_json) {
@@ -602,37 +600,17 @@ function parse_json_loose(raw_json) {
     throw error;
   }
 }
-function parse_json_array_or_undefined(raw_json, element_schema) {
-  const value = parse_json_loose(raw_json);
-  if (value === MALFORMED_JSON || !Array.isArray(value)) return void 0;
-  return element_schema.array().parse(value);
-}
-function read_json_listing(raw_json, element_schema) {
-  try {
-    const rows = parse_json_array_or_undefined(raw_json, element_schema);
-    return rows === void 0 ? { kind: "unreadable" } : { kind: "read", rows };
-  } catch {
-    return { kind: "unexpected_shape" };
-  }
-}
-function parse_json_array_safe(raw_json, element_schema) {
-  const value = parse_json_loose(raw_json);
-  if (value === MALFORMED_JSON) return [];
-  return element_schema.array().parse(value);
-}
 function parse_json_object_safe(raw_json, schema) {
   const value = parse_json_loose(raw_json);
   if (value === MALFORMED_JSON) return void 0;
   return schema.parse(value);
 }
 var parse_json = {
-  parse_json_array_safe,
-  parse_json_array_or_undefined,
-  parse_json_object_safe,
-  read_json_listing
+  parse_json_object_safe
 };
 
-// scripts/git/git-gh-failure.ts
+// scripts/gh/git-gh-failure.ts
+import { z as z3 } from "zod";
 var error_document_schema = z3.object({ status: z3.union([z3.string(), z3.number()]).optional() }).catch({});
 var GH_FAILURE_FIELD = "gh_failure";
 function has_gh_failure(error) {
@@ -660,7 +638,7 @@ function failure_of(error) {
 }
 var gh_failure = { attach, classify_stdout, failure_of, parse_response_status };
 
-// scripts/git/git-gh-exec.ts
+// scripts/gh/git-gh-exec.ts
 var BODY_FROM_STDIN = "-";
 var GH_REQUEST_TIMEOUT_MS = 6e4;
 function to_timeout_option(timeout_ms) {
@@ -808,6 +786,371 @@ var git_gh_exec = {
   parse_status_line
 };
 
+// scripts/gh/fix-gh-packages-logic.ts
+import { loadAll } from "js-yaml";
+import { z as z4 } from "zod";
+var GH_PACKAGES_HOST = "npm.pkg.github.com";
+var RESOLUTION_BLOCK = "\n    resolution:\n";
+var INTEGRITY_PREFIX = "      integrity: ";
+var TARBALL_PREFIX = "      tarball: ";
+var FLOW_RESOLUTION_LINE_START = "\n    resolution: {";
+var FLOW_TARBALL_KEY = ", tarball: ";
+var NPMRC_AUTH_TOKEN_PREFIX = `//${GH_PACKAGES_HOST}/:_authToken=`;
+var REGISTRY_KEY = ":registry=";
+var lockfile_resolution_schema = z4.looseObject({
+  integrity: z4.string().optional(),
+  tarball: z4.string().optional()
+});
+var lockfile_package_schema = z4.looseObject({
+  resolution: lockfile_resolution_schema.optional()
+});
+var lockfile_document_schema = z4.looseObject({
+  packages: z4.record(z4.string(), lockfile_package_schema).optional()
+});
+function parse_lockfile_packages(raw) {
+  const merged = {};
+  for (const document of loadAll(raw)) {
+    const { packages } = lockfile_document_schema.parse(document);
+    if (packages !== void 0) Object.assign(merged, packages);
+  }
+  return merged;
+}
+function extract_gh_registry_scope(line) {
+  const trimmed = line.trim();
+  if (!trimmed.startsWith("@")) return void 0;
+  const eq_index = trimmed.indexOf(REGISTRY_KEY);
+  if (eq_index === -1) return void 0;
+  const registry = trimmed.slice(eq_index + REGISTRY_KEY.length).trim().replace(/\/$/u, "");
+  if (registry !== `https://${GH_PACKAGES_HOST}`) return void 0;
+  return trimmed.slice(0, eq_index);
+}
+function parse_gh_scopes(npmrc) {
+  const scopes = /* @__PURE__ */ new Set();
+  for (const line of npmrc.split("\n")) {
+    const scope = extract_gh_registry_scope(line);
+    if (scope !== void 0) scopes.add(scope);
+  }
+  return scopes;
+}
+function extract_auth_token_from_line(line) {
+  const trimmed = line.trim();
+  if (!trimmed.startsWith(NPMRC_AUTH_TOKEN_PREFIX)) return void 0;
+  const value = trimmed.slice(NPMRC_AUTH_TOKEN_PREFIX.length);
+  if (value.startsWith("${") || value.length === 0) return void 0;
+  return value;
+}
+function parse_npmrc_auth_token(npmrc) {
+  for (const line of npmrc.split("\n")) {
+    const token = extract_auth_token_from_line(line);
+    if (token !== void 0) return token;
+  }
+  return void 0;
+}
+function scope_from_key(key) {
+  return key.startsWith("@") ? key.split("/", 1)[0] ?? "" : "";
+}
+function has_tarball(entry) {
+  return entry.resolution?.tarball !== void 0;
+}
+function package_path_from_key(key) {
+  const start = key.startsWith("@") ? 1 : 0;
+  const at_index = key.indexOf("@", start);
+  return at_index === -1 ? key : key.slice(0, at_index);
+}
+function package_version_from_key(key) {
+  const start = key.startsWith("@") ? 1 : 0;
+  const at_index = key.indexOf("@", start);
+  if (at_index === -1) return "";
+  return key.slice(at_index + 1).split("(", 1)[0] ?? "";
+}
+function should_fix_tarball(key, entry, scopes) {
+  if (has_tarball(entry)) return false;
+  const scope = scope_from_key(key);
+  return scope.length > 0 && scopes.has(scope);
+}
+function find_entry_start(content, package_key) {
+  const single = content.indexOf(`
+  '${package_key}':
+`);
+  if (single !== -1) return single;
+  return content.indexOf(`
+  "${package_key}":
+`);
+}
+function find_entry_end(content, entry_start) {
+  const next_match = /\n {2}['"]/u.exec(content.slice(entry_start + 1));
+  return next_match === null ? content.length : entry_start + 1 + next_match.index;
+}
+function find_integrity_eol_in_entry(entry_content) {
+  const resolution_pos = entry_content.indexOf(RESOLUTION_BLOCK);
+  if (resolution_pos === -1) return -1;
+  const integrity_pos = entry_content.indexOf(INTEGRITY_PREFIX, resolution_pos);
+  if (integrity_pos === -1) return -1;
+  return entry_content.indexOf("\n", integrity_pos);
+}
+function find_flow_resolution_brace(entry_content) {
+  const pos = entry_content.indexOf(FLOW_RESOLUTION_LINE_START);
+  if (pos === -1) return -1;
+  const line_end = entry_content.indexOf("\n", pos + 1);
+  const search_end = line_end === -1 ? entry_content.length : line_end;
+  const brace = entry_content.lastIndexOf("}", search_end);
+  if (brace <= pos) return -1;
+  return brace;
+}
+function insert_expanded_tarball(content, entry_start, entry_end, tarball) {
+  const entry_content = content.slice(entry_start, entry_end);
+  const integrity_eol = find_integrity_eol_in_entry(entry_content);
+  if (integrity_eol === -1) return void 0;
+  if (entry_content.slice(integrity_eol + 1).startsWith(TARBALL_PREFIX)) return content;
+  const patched = `${entry_content.slice(0, integrity_eol + 1)}${TARBALL_PREFIX}${tarball}
+${entry_content.slice(integrity_eol + 1)}`;
+  return content.slice(0, entry_start) + patched + content.slice(entry_end);
+}
+function insert_flow_tarball(content, entry_start, entry_end, tarball) {
+  const entry_content = content.slice(entry_start, entry_end);
+  const brace_pos = find_flow_resolution_brace(entry_content);
+  if (brace_pos === -1) return void 0;
+  const open_brace = entry_content.lastIndexOf("{", brace_pos);
+  if (open_brace === -1) return void 0;
+  const flow_body = entry_content.slice(open_brace + 1, brace_pos);
+  if (/\btarball\s*:/u.test(flow_body)) return content;
+  const patched = `${entry_content.slice(0, brace_pos)}${FLOW_TARBALL_KEY}${tarball}${entry_content.slice(brace_pos)}`;
+  return content.slice(0, entry_start) + patched + content.slice(entry_end);
+}
+function insert_tarball_for_key(content, package_key, tarball) {
+  const entry_start = find_entry_start(content, package_key);
+  if (entry_start === -1) return content;
+  const entry_end = find_entry_end(content, entry_start);
+  return insert_expanded_tarball(content, entry_start, entry_end, tarball) ?? insert_flow_tarball(content, entry_start, entry_end, tarball) ?? content;
+}
+function patch_lockfile(content, patches) {
+  let result = content;
+  for (const [key, tarball] of patches) {
+    result = insert_tarball_for_key(result, key, tarball);
+  }
+  return result;
+}
+function resolve_token(environment_token, npmrc_token, get_fallback_token) {
+  if (environment_token !== void 0 && environment_token.length > 0) return environment_token;
+  if (npmrc_token !== void 0) return npmrc_token;
+  return get_fallback_token();
+}
+var fix_gh_packages_logic = {
+  parse_gh_scopes,
+  parse_npmrc_auth_token,
+  parse_lockfile_packages,
+  package_path_from_key,
+  package_version_from_key,
+  needs_tarball_fix: should_fix_tarball,
+  insert_tarball_for_key,
+  patch_lockfile,
+  resolve_token
+};
+
+// scripts/registry-migration/migrate-logic.ts
+var SCOPE = "@joshuafolkken";
+var REGISTRY_KEY2 = `${SCOPE}:registry`;
+var PUBLIC_REGISTRY = "https://registry.npmjs.org/";
+var GITHUB_REGISTRY = "https://npm.pkg.github.com/";
+var MAPPING = `${REGISTRY_KEY2}=${PUBLIC_REGISTRY}`;
+var REGISTRY_VALUE_INDEX = 1;
+var SPLIT_LIMIT = 2;
+function normalized_registry(value) {
+  let normalized = value.trim();
+  while (normalized.endsWith("/")) normalized = normalized.slice(0, -1);
+  return `${normalized}/`;
+}
+function mapping_lines(content) {
+  return content.split(/\r?\n/u).filter((line) => line.trimStart().startsWith(`${REGISTRY_KEY2}=`));
+}
+function registry_of(content) {
+  const lines = mapping_lines(content);
+  if (lines.length !== 1) return void 0;
+  return normalized_registry(lines[0]?.split("=", SPLIT_LIMIT)[REGISTRY_VALUE_INDEX] ?? "");
+}
+function scoped_packages(lockfile) {
+  const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile);
+  return Object.keys(packages).filter((key) => key.startsWith(`${SCOPE}/`)).map((key) => fix_gh_packages_logic.package_path_from_key(key)).filter((name, index, names) => names.indexOf(name) === index);
+}
+function scoped_versions(lockfile) {
+  const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile);
+  return Object.keys(packages).filter((key) => key.startsWith(`${SCOPE}/`)).map(
+    (key) => [
+      fix_gh_packages_logic.package_path_from_key(key),
+      fix_gh_packages_logic.package_version_from_key(key)
+    ]
+  );
+}
+function is_github_tarball(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.hostname === "npm.pkg.github.com";
+  } catch {
+    return false;
+  }
+}
+function github_tarballs(lockfile) {
+  const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile);
+  return Object.entries(packages).filter(
+    ([key, entry]) => key.startsWith(`${SCOPE}/`) && entry.resolution?.tarball !== void 0 && is_github_tarball(entry.resolution.tarball)
+  ).map(([key]) => key);
+}
+function remove_flow_tarball(line) {
+  const marker = ", tarball: https://npm.pkg.github.com/";
+  const start = line.indexOf(marker);
+  if (start === -1) return line;
+  const end = line.indexOf("}", start);
+  if (end === -1) return line;
+  return `${line.slice(0, start)}${line.slice(end)}`;
+}
+function is_package_entry(line) {
+  return /^ {2}[^ ]/u.test(line);
+}
+function is_github_tarball_line(line) {
+  return line.trimStart().startsWith("tarball: https://npm.pkg.github.com/");
+}
+function clean_kit_line(line, version, integrities) {
+  if (!version) return line;
+  if (is_github_tarball_line(line)) return void 0;
+  const cleaned = remove_flow_tarball(line);
+  const pair = integrities.get(version);
+  if (pair === void 0) return cleaned;
+  return cleaned.split(`integrity: ${pair[0]}`).join(`integrity: ${pair[1]}`);
+}
+function next_kit_version(line, version) {
+  if (!is_package_entry(line)) return version;
+  const prefix = "  '@joshuafolkken/kit@";
+  return line.startsWith(prefix) ? line.slice(prefix.length).split("'", 1)[0] ?? "" : "";
+}
+function integrity_pair(old_integrity, npm_integrity) {
+  if (old_integrity === void 0 || npm_integrity === void 0) return void 0;
+  return [old_integrity, npm_integrity];
+}
+function lock_integrities(lockfile, npm_integrities) {
+  const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile);
+  const pairs = /* @__PURE__ */ new Map();
+  const kit_entries = Object.entries(packages).filter(([key]) => key.startsWith(`${SCOPE}/kit@`));
+  for (const [key, entry] of kit_entries) {
+    const version = fix_gh_packages_logic.package_version_from_key(key);
+    const pair = integrity_pair(entry.resolution?.integrity, npm_integrities.get(version));
+    if (pair !== void 0) pairs.set(version, pair);
+  }
+  return pairs;
+}
+function push_if_defined(lines, cleaned) {
+  if (cleaned !== void 0) lines.push(cleaned);
+}
+function rewrite_kit_lockfile(lockfile, npm_integrities) {
+  let kit_version = "";
+  const lines = [];
+  const integrities = lock_integrities(lockfile, npm_integrities);
+  for (const line of lockfile.split("\n")) {
+    kit_version = next_kit_version(line, kit_version);
+    const cleaned = clean_kit_line(line, kit_version, integrities);
+    push_if_defined(lines, cleaned);
+  }
+  return lines.join("\n");
+}
+function append_mapping(content, eol) {
+  const separator = content && !content.endsWith("\n") ? eol : "";
+  return `${content}${separator}${MAPPING}${eol}`;
+}
+function replace_mapping(content) {
+  const lines = mapping_lines(content);
+  const eol = content.includes("\r\n") ? "\r\n" : "\n";
+  if (lines.length === 0) return append_mapping(content, eol);
+  return content.split(/\r?\n/u).map((line) => line === lines[0] ? MAPPING : line).join(eol);
+}
+function unsupported_registry(project_npmrc) {
+  const registry = registry_of(project_npmrc);
+  if (registry === void 0 || [GITHUB_REGISTRY, PUBLIC_REGISTRY].includes(registry)) {
+    return void 0;
+  }
+  return `unsupported project registry: ${registry}`;
+}
+function has_duplicate_mapping(project_npmrc, user_npmrc) {
+  return mapping_lines(project_npmrc).length > 1 || mapping_lines(user_npmrc).length > 1;
+}
+function previous_registry(project_npmrc, user_npmrc) {
+  return registry_of(project_npmrc) ?? registry_of(user_npmrc) ?? "default npm";
+}
+function plan(project_npmrc, user_npmrc, lockfile) {
+  const packages = scoped_packages(lockfile);
+  const blocked = packages.filter((name) => name !== `${SCOPE}/kit`);
+  if (has_duplicate_mapping(project_npmrc, user_npmrc)) blocked.push("duplicate registry mappings");
+  const unsupported = unsupported_registry(project_npmrc);
+  if (unsupported !== void 0) blocked.push(unsupported);
+  const before = previous_registry(project_npmrc, user_npmrc);
+  const change = `${before} \u2192 ${PUBLIC_REGISTRY}`;
+  return { content: replace_mapping(project_npmrc), packages, blocked, change };
+}
+var migrate_logic = {
+  plan,
+  github_tarballs,
+  is_github_tarball,
+  rewrite_kit_lockfile,
+  scoped_versions
+};
+
+// scripts/version/npm-registry.ts
+import { execaSync as execaSync2 } from "execa";
+import { z as z5 } from "zod";
+var PUBLIC_REGISTRY2 = "https://registry.npmjs.org";
+var ABBREVIATED_ACCEPT = "application/vnd.npm.install-v1+json";
+var FULL_ACCEPT = "application/json";
+var REQUEST_TIMEOUT_MS = 1e4;
+var SCOPE_SEPARATOR = "/";
+var ENCODED_SCOPE_SEPARATOR = "%2f";
+var SCOPE_PATTERN = /^@[^/]+(?=\/)/u;
+var SCOPE_REGISTRY_SUFFIX = ":registry";
+var github_scopes = /* @__PURE__ */ new Map();
+var FETCH_SCRIPT = [
+  "const [url, accept] = process.argv.slice(1)",
+  "const response = await fetch(url, { headers: { accept } })",
+  "if (!response.ok) process.exit(1)",
+  "process.stdout.write(await response.text())"
+].join("\n");
+var latest_schema = z5.looseObject({ "dist-tags": z5.looseObject({ latest: z5.string() }) });
+var times_schema = z5.looseObject({ time: release_age.release_times_schema });
+function packument_url(package_name) {
+  return `${PUBLIC_REGISTRY2}/${package_name.replace(SCOPE_SEPARATOR, () => ENCODED_SCOPE_SEPARATOR)}`;
+}
+function read_packument(package_name, accept) {
+  const result = execaSync2(
+    process.execPath,
+    ["--input-type=module", "-e", FETCH_SCRIPT, packument_url(package_name), accept],
+    { reject: false, timeout: REQUEST_TIMEOUT_MS }
+  );
+  if (result.exitCode !== 0) return void 0;
+  return json_value.parse_or_undefined(result.stdout);
+}
+function is_github_scope(scope) {
+  const is_cached_github = github_scopes.get(scope);
+  if (is_cached_github !== void 0) return is_cached_github;
+  const result = execaSync2("pnpm", ["config", "get", `${scope}${SCOPE_REGISTRY_SUFFIX}`], {
+    reject: false,
+    timeout: REQUEST_TIMEOUT_MS
+  });
+  const is_github = result.exitCode === 0 && migrate_logic.is_github_tarball(result.stdout.trim());
+  github_scopes.set(scope, is_github);
+  return is_github;
+}
+function is_public_source(package_name) {
+  const scope = SCOPE_PATTERN.exec(package_name)?.[0];
+  return scope === void 0 || !is_github_scope(scope);
+}
+function read_latest(package_name) {
+  if (!is_public_source(package_name)) return void 0;
+  const parsed = latest_schema.safeParse(read_packument(package_name, ABBREVIATED_ACCEPT));
+  return parsed.success ? parsed.data["dist-tags"].latest : void 0;
+}
+function read_release_times(package_name) {
+  if (!is_public_source(package_name)) return void 0;
+  const parsed = times_schema.safeParse(read_packument(package_name, FULL_ACCEPT));
+  return parsed.success ? parsed.data.time : void 0;
+}
+var npm_registry = { packument_url, read_latest, read_release_times };
+
 // scripts/version/version-remote.ts
 var TIMES_PAGE_SIZE = 100;
 var TIMES_JQ = "[.[] | {(.name): .created_at}] | add";
@@ -819,6 +1162,8 @@ function require_endpoint(versions_endpoint, package_name) {
 }
 function fetch_latest_version(versions_endpoint, package_name) {
   const endpoint = require_endpoint(versions_endpoint, package_name);
+  const public_latest = npm_registry.read_latest(package_name);
+  if (public_latest !== void 0) return public_latest;
   try {
     return git_gh_exec.exec_gh_api_sync({ path: endpoint, jq_filter: ".[0].name" }).trim();
   } catch (error) {
@@ -838,14 +1183,17 @@ function with_page_size(endpoint, page_size) {
   query.set("per_page", String(page_size));
   return `${path_part}?${query.toString()}`;
 }
-function fetch_release_times(versions_endpoint) {
-  if (versions_endpoint === void 0 || versions_endpoint.trim() === "") return void 0;
+function read_github_release_times(versions_endpoint) {
   const endpoint = with_page_size(versions_endpoint, TIMES_PAGE_SIZE);
   const stdout = git_gh_exec.read_gh_api_sync({ path: endpoint, jq_filter: TIMES_JQ });
   if (stdout === void 0) return void 0;
-  const parsed = release_age.release_times_schema.safeParse(safe_json_parse(stdout));
+  const parsed = release_age.release_times_schema.safeParse(json_value.parse_or_undefined(stdout));
   return parsed.success ? parsed.data : void 0;
 }
+function fetch_release_times(versions_endpoint, package_name) {
+  if (versions_endpoint === void 0 || versions_endpoint.trim() === "") return void 0;
+  return npm_registry.read_release_times(package_name) ?? read_github_release_times(versions_endpoint);
+}
 
 // scripts/version/version-targets.ts
 import path4 from "node:path";
@@ -877,24 +1225,24 @@ function read_if_readable(path5) {
 var file_reader = { read_optional, read_file_or_empty, read_if_readable };
 
 // scripts/version/version-targets.ts
-import { execaSync as execaSync2 } from "execa";
+import { execaSync as execaSync3 } from "execa";
 var NODE_MODULES2 = "node_modules";
 var PACKAGE_JSON3 = "package.json";
 function build_pnpm_ls_arguments(package_name) {
   return ["ls", "-g", "--json", package_name];
 }
 function parse_global_version(stdout, package_name) {
-  const parsed = pnpm_ls_global_schema.safeParse(safe_json_parse(stdout));
+  const parsed = pnpm_ls_global_schema.safeParse(json_value.parse_or_undefined(stdout));
   if (!parsed.success) return void 0;
   return parsed.data[0]?.dependencies?.[package_name]?.version;
 }
 function parse_project_version(raw) {
   if (raw === void 0) return void 0;
-  const parsed = package_version_schema.safeParse(safe_json_parse(raw));
+  const parsed = package_version_schema.safeParse(json_value.parse_or_undefined(raw));
   return parsed.success ? parsed.data.version : void 0;
 }
 function read_global_version(package_name) {
-  const result = execaSync2("pnpm", build_pnpm_ls_arguments(package_name), { reject: false });
+  const result = execaSync3("pnpm", build_pnpm_ls_arguments(package_name), { reject: false });
   return parse_global_version(result.stdout, package_name);
 }
 function project_package_path(cwd, package_name) {
@@ -928,12 +1276,12 @@ var version_targets = {
 var FAILURE_EXIT_CODE = 1;
 var ALREADY_UP_TO_DATE = "Already up to date";
 var NO_QUARANTINE_MINUTES2 = 0;
-function read_release_hold(versions_endpoint, latest, versions) {
+function read_release_hold(package_config, latest, versions) {
   if (versions.every((version) => version === void 0 || version === latest)) return void 0;
   const minimum_age_minutes = release_age.read_nearest_minimum_release_age(process.cwd());
   if (minimum_age_minutes <= NO_QUARANTINE_MINUTES2) return void 0;
   const installable = release_hold.resolve_installable(
-    fetch_release_times(versions_endpoint),
+    fetch_release_times(package_config.versions_endpoint, package_config.package_name),
     latest,
     minimum_age_minutes,
     Date.now()
@@ -990,7 +1338,7 @@ function read_upstream_report(upstream, config, snapshot, is_hold_wanted) {
   const project_version = version_targets.read_project_version(process.cwd(), upstream.package_name);
   const report = { config: upstream, project_version, latest };
   attach_upstream_effective(report, config, snapshot, upstream);
-  const hold = is_hold_wanted ? read_release_hold(upstream.versions_endpoint, latest, [report.effective?.version]) : void 0;
+  const hold = is_hold_wanted ? read_release_hold(upstream, latest, [report.effective?.version]) : void 0;
   if (hold !== void 0) report.hold = hold;
   return report;
 }
@@ -1012,7 +1360,7 @@ function run_check(config) {
   );
 }
 function run_upgrade_command(command) {
-  const result = execaSync3("sh", ["-c", command], { stdio: "inherit", reject: false });
+  const result = execaSync4("sh", ["-c", command], { stdio: "inherit", reject: false });
   return result.exitCode ?? FAILURE_EXIT_CODE;
 }
 function run_all_upgrade_commands(commands) {

package/eslint/rules/promise.js

@@ -5,6 +5,11 @@ export const promise_rules = {
 	'promise/param-names': 'error',
 	'promise/no-nesting': 'error',
 
+	// ループ内で 1 つずつ await すると、独立した処理まで直列になる。Sonar の S9382 と同じ指摘を
+	// ローカルのゲートで先に出す。ポーリングや順序が意味を持つ処理など意図的な逐次は、
+	// `// eslint-disable-next-line no-await-in-loop -- <理由>` で理由を残して抑止する。
+	'no-await-in-loop': 'error',
+
 	// `promise-function-async` を有効にしている以上、`require-await` は同時に満たせない。
 	// Promise を返す契約の関数（execa モックなど）は async である必要がある一方、
 	// 実際に await する対象を持たないため `require-await` が必ず発火する。