@joshuafolkken/kit 1.1035.0 → 1.1094.0

package/scripts/test/unit-worker-share.ts

@@ -3,8 +3,9 @@ import { availableParallelism } from 'node:os'
 import path from 'node:path'
 import { PLATFORM_TEMP_ROOT } from '#scripts/josh/platform-temporary'
 import { process_identity } from '#scripts/josh/process-identity'
+import { process_owner_schema, type ProcessOwner } from '#scripts/josh/process-owner'
 import { stamp_file } from '#scripts/josh/stamp-file'
-import { z } from 'zod'
+import { json_value } from '#scripts/lib/json-value'
 
 // How wide one vitest run may fan out when it is not the only one on the machine
 // (joshuafolkken/kit#1515).
@@ -41,12 +42,9 @@ const MIN_WORKERS = 1
 // One run in flight is this run alone, which is the case that changes nothing.
 const SOLO_RUNS = 1
 
-// `process_start` is optional because a marker written before joshuafolkken/kit#1245, or on a platform
-// whose start time cannot be read, carries only the pid — and that case has an answer of its own
-// below rather than being rejected here.
-const run_marker_schema = z.object({ pid: z.number(), process_start: z.string().optional() })
-
-type RunMarker = z.infer<typeof run_marker_schema>
+// A marker is the writing process's identity and nothing else; a pid-only marker has an answer of its
+// own below (`is_running`) rather than being rejected here.
+type RunMarker = ProcessOwner
 
 function marker_path(pid: number = process.pid): string {
 	return stamp_file.stamp_path(RUN_PREFIX, String(pid))
@@ -82,13 +80,9 @@ function read_marker(source: string): RunMarker | undefined {
 
 	if (raw === undefined) return undefined
 
-	try {
-		const parsed = run_marker_schema.safeParse(JSON.parse(raw))
+	const parsed = process_owner_schema.safeParse(json_value.parse_or_undefined(raw))
 
-		return parsed.success ? parsed.data : undefined
-	} catch {
-		return undefined
-	}
+	return parsed.success ? parsed.data : undefined
 }
 
 // An unreadable temp directory answers "no other run", which is the direction that leaves behavior
@@ -235,12 +229,9 @@ const unit_worker_share = {
 	NESTED_KEY,
 	RUN_PREFIX,
 	SOLO_RUNS,
-	WORKER_FLAG,
 	current_share,
 	is_nested_run,
-	is_running,
 	live_run_count,
-	marker_files,
 	marker_path,
 	read_marker,
 	resolve_unit_workers,

package/scripts/time-runtime/time-batch-guard.ts

@@ -147,7 +147,7 @@ interface GuardedCall {
 //
 // **The dispatch it adds is measured, and it is not the figure the deleted text quoted.** One hook run
 // is **0.53 s** in this checkout and about 0.4 s in a consumer, essentially all of it process startup —
-// measured under `docs/josh-commands.md` → "`josh format:edited`", which is where that reading was
+// measured under `docs/josh-commands-automation.md` → "`josh format:edited`", which is where that reading was
 // taken. The "about 2.4 s" above was a `pnpm josh` dispatch measured before joshuafolkken/kit#1342 made
 // this command eligible for the in-process path. Against that, one recovered round trip is a whole
 // model turn.
@@ -509,7 +509,6 @@ const time_batch_guard = {
 	CONSECUTIVE_LIMIT,
 	GUARD_LABEL,
 	LANE_NOTICE,
-	NAMED_CANDIDATE_COUNT,
 	NOTICE,
 	NOTICE_REFIRE_EVERY,
 	NOTICE_STAMP_PREFIX,

package/scripts/time-runtime/time-bundle-call.ts

@@ -336,8 +336,8 @@ function josh_subcommand(command: string): string | undefined {
 }
 
 // Whether a shell line is one of the read-only `josh` bookkeeping commands, and nothing else. A chained
-// line falls through. An alias is resolved to its canonical name first — a run may type `josh ist` for
-// `issue:state` — so the allow-list holds canonical names alone. Everything not on the list falls
+// line falls through. An alias is resolved to its canonical name first, so the allow-list holds
+// canonical names alone. Everything not on the list falls
 // through to the read/mutation test, which is what keeps `josh gate` / `followup` / `git`
 // non-bundleable (joshuafolkken/kit#1875).
 function is_read_josh(command: string): boolean {
@@ -555,7 +555,6 @@ const time_bundle_call = {
 	tool_targets,
 	// Exported for the batching guard's own word scan (joshuafolkken/kit#1390), so the two scanners
 	// cannot come to disagree about where one word of a shell line ends and the next begins.
-	words_of,
 	// Exported for the read-fold notice (joshuafolkken/kit#2311), which offers `read:files <path>` only
 	// over file-shaped targets — a bare directory like `scripts/` is a target here but not something
 	// `read:files` can read, so the notice reuses this test rather than keep a second copy that could

package/scripts/time-runtime/time-bundles.ts

@@ -520,11 +520,7 @@ function bundle_lines(totals: BundleTotals, price: TripPrice): Array<string> {
 
 const time_bundles = {
 	HEADING,
-	SEQUENCE_LABEL,
-	RECOVERABLE_LABEL,
-	SAVING_LABEL,
 	BY_TOOL_LABEL,
-	MIN_SEQUENCE,
 	NO_BUNDLES,
 	build_bundles,
 	bundle_lines,

package/scripts/time-runtime/time-density-hook.ts

@@ -156,8 +156,6 @@ function density_notice(raw_payload: string, now_ms: number = Date.now()): strin
 }
 
 const time_density_hook = {
-	NOTICE_PREFIX,
-	TAIL_BYTES,
 	density_notice,
 	notice_path,
 	read_tail,

package/scripts/time-runtime/time-followup-stage.ts

@@ -1,4 +1,4 @@
-import { git_followup_stages, type FollowupStage } from '#scripts/git/git-followup-stages'
+import { git_followup_stages, type FollowupStage } from '#scripts/followup/git-followup-stages'
 
 // Reading `followup`'s own stage rows back out of what it printed (joshuafolkken/kit#1445).
 //

package/scripts/time-runtime/time-format.ts

@@ -31,21 +31,6 @@ const NOT_MEASURED = 'not measured'
 // than in `time-report.ts` because two blocks print it — the round-trip price and the bundling block —
 // and `time-bundles.ts` cannot import `time-report.ts`, which imports it (joshuafolkken/kit#1344).
 const NO_CALLS = 'no tool call to divide'
-// The word both the CI-cycle block and the gate-runtime block put in front of their naked-seconds
-// figure (joshuafolkken/kit#1812). Two renderers of the same report, and `time-cycles.ts` cannot
-// import `time-gate-runs.ts` nor the reverse, so it is written once here — the rule this file's header
-// states, and the reason `NO_CALLS` already sits beside it.
-const NAKED_PREFIX = 'naked '
-// The category labels, shared with the epic scope's table and with the round-trip block's price row
-// rather than spelled out in each. The tables answer the same question at three scales, so a label
-// renamed in one and not the others is a report that disagrees with itself — which is the defect
-// joshuafolkken/kit#1295 was filed for. They moved here from `time-report.ts` when the price row
-// became a third printer and its block a module that cannot import that file
-// (joshuafolkken/kit#1385).
-const MODEL_LABEL = 'model wait'
-const TOOL_LABEL = 'tool execution'
-const HUMAN_LABEL = 'human wait'
-const CI_LABEL = 'CI wait'
 // How many rows of a table any of these reports prints. Capped, because a long run touches thirty-odd
 // distinct leading commands and a table that long is read by nobody. `--json` carries every row the
 // report holds, so the display cap costs a caller nothing.
@@ -54,28 +39,6 @@ const CI_LABEL = 'CI wait'
 // need it** (joshuafolkken/kit#1311). Those two cannot import `time-report.ts`, which imports them —
 // and a second cap beside a second renderer is exactly the drift this file was split out to prevent.
 const MAX_ROWS = 15
-// What separates the facts inside one row's third column — a check's conclusion from its outcome
-// note, a distribution's range from its sample count. Written once so two renderers of the same
-// report cannot come to punctuate their suffixes differently (joshuafolkken/kit#1312).
-const SUFFIX_SEPARATOR = ' · '
-// What joins the two ends of an aggregated row's range, and the unit the sample behind it is counted
-// in. They sit here rather than beside one renderer because two of them print a spread now — the
-// duration tables of `--last` and the turn-count table both scopes share — and a private copy beside
-// the second is how one report would come to punctuate its ranges two ways
-// (joshuafolkken/kit#1763).
-const RANGE_SEPARATOR = ' – '
-const RUN_UNIT = 'run(s)'
-// The `HH:MM:SS` slice of an ISO instant, and what joins two of them into a window. UTC rather than
-// local time, because the report's own `started_at` / `ended_at` already are — a table in one zone
-// beside a header in another is a report that cannot be read against itself.
-//
-// **They moved here from `time-segments.ts` when the model-gap block became a second renderer of a
-// clock window** (joshuafolkken/kit#1386). A private copy beside the second block is the clone
-// `CLAUDE.md` prohibits, in the one place a drift would make two tables of the same report disagree
-// about which hour a stretch sat in.
-const CLOCK_START = 11
-const CLOCK_END = 19
-const WINDOW_ARROW = ' → '
 
 // **The parenthetical says "this report" rather than "them all"** (joshuafolkken/kit#1301): since
 // `--top` can cut the record itself before either rendering, a promise that `--json` carries every row
@@ -133,54 +96,18 @@ function unmeasured_row(label: string): string {
 	return format_columns(label, '', NOT_MEASURED)
 }
 
-// **The ends are handed over already formatted**, so one aggregated table can spell its range in
-// minutes and another in turns while both are punctuated identically. The sample count rides at the
-// end because it is the qualifier: two rows with the same spread are not the same evidence when one
-// was read from nine runs and the other from two.
-function format_spread(min: string, max: string, sample_count: number): string {
-	const range = `${min}${RANGE_SEPARATOR}${max}`
-
-	return `${range}${SUFFIX_SEPARATOR}${String(sample_count)} ${RUN_UNIT}`
-}
-
-function format_clock(timestamp_ms: number): string {
-	return new Date(timestamp_ms).toISOString().slice(CLOCK_START, CLOCK_END)
-}
-
-function format_window(started_ms: number, ended_ms: number): string {
-	return `${format_clock(started_ms)}${WINDOW_ARROW}${format_clock(ended_ms)}`
-}
-
-// The indent a report's notes sit under, beneath its heading. Written once because three renderers
-// print them — the run scope, the epic scope and the distribution — and a fourth copy is how two
-// tables of one command would come to indent the same sentence differently (joshuafolkken/kit#1312).
-function note_lines(notes: ReadonlyArray<string>): Array<string> {
-	return notes.map((note) => `  ${note}`)
-}
-
 const time_format = {
 	MAX_ROWS,
 	NO_CALLS,
-	NAKED_PREFIX,
-	SUFFIX_SEPARATOR,
-	NOT_MEASURED,
-	MODEL_LABEL,
-	TOOL_LABEL,
-	HUMAN_LABEL,
-	CI_LABEL,
 	overflow_line,
-	format_minutes,
 	format_seconds,
 	format_share,
 	usd,
 	format_columns,
 	format_row,
-	format_spread,
 	// `format_clock` stays private: `format_window` is its only caller, and a namespace that offers
 	// both invites a second renderer to join the two with its own arrow.
-	format_window,
 	unmeasured_row,
-	note_lines,
 }
 
 export { time_format }

package/scripts/time-runtime/time-round-trips.ts

@@ -269,11 +269,7 @@ const time_round_trips = {
 	// `time-model-gaps.ts` and needed the same predicates and the same opener test this walk uses. A
 	// private copy there would be the clone `CLAUDE.md` prohibits, in the one place a drift would have
 	// the distribution and the count disagreeing about what a round trip is.
-	is_call,
-	is_model,
-	opens_round_trip,
 	per_round_trip,
-	started_ms,
 }
 
 export { time_round_trips }

package/scripts/time-runtime/time-single-check.ts

@@ -60,6 +60,6 @@ function check_key(josh_command: string, command: string): string {
 	return [josh_command, ...argument_key(command)].join(KEY_SEPARATOR)
 }
 
-const time_single_check = { CHECK_COMMANDS, NO_CHECK, check_key }
+const time_single_check = { NO_CHECK, check_key }
 
 export { time_single_check }

package/scripts/time-runtime/time-spans.ts

@@ -1,5 +1,5 @@
 import { cost_blocks } from '#scripts/cost-runtime/cost-blocks'
-import type { FollowupStage } from '#scripts/git/git-followup-stages'
+import type { FollowupStage } from '#scripts/followup/git-followup-stages'
 import { time_background } from './time-background'
 import { time_bundle_call } from './time-bundle-call'
 import { time_followup_stage } from './time-followup-stage'

package/scripts/time-runtime/time-transcript-line.ts

@@ -1,4 +1,4 @@
-import type { FollowupStage } from '#scripts/git/git-followup-stages'
+import type { FollowupStage } from '#scripts/followup/git-followup-stages'
 import { json_value } from '#scripts/lib/json-value'
 import { z } from 'zod'
 import { time_background } from './time-background'
@@ -247,7 +247,6 @@ function parse_line(line: string): TranscriptLine | undefined {
 
 const time_transcript_line = {
 	ERROR_TEXT_LIMIT,
-	REFUSAL_MARKER,
 	NO_MESSAGE_ID,
 	guard_from_refusal,
 	parse_line,

package/scripts/ui/ui-routes-cli.ts

@@ -105,12 +105,7 @@ async function main(argv: ReadonlyArray<string>): Promise<void> {
 }
 
 const ui_routes_cli = {
-	build_find_importers,
-	main,
 	parse_staged,
-	print_routes,
-	route_files,
-	run,
 	USAGE,
 }
 

package/scripts/ui/ui-routes.ts

@@ -92,11 +92,6 @@ function derive_routes(
 
 const ui_routes = {
 	derive_routes,
-	is_route_file,
-	is_shared_svelte,
-	route_path_of,
-	ROUTES_PREFIX,
-	SVELTE_EXTENSION,
 }
 
 export { ui_routes }

package/scripts/version/effective-upstream.ts

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import path from 'node:path'
+import { json_value } from '#scripts/lib/json-value'
 import { package_named_version_schema } from '#scripts/lib/schemas'
-import { safe_json_parse } from './parse-json'
 
 const PACKAGE_JSON = 'package.json'
 // Node module paths never nest anywhere near this deep; the bound only guards against an unexpected
@@ -23,7 +23,7 @@ interface EffectiveUpstreamOptions {
 function read_matching_version(manifest_path: string, package_name: string): string | undefined {
 	if (!existsSync(manifest_path)) return undefined
 	const parsed = package_named_version_schema.safeParse(
-		safe_json_parse(readFileSync(manifest_path, 'utf8')),
+		json_value.parse_or_undefined(readFileSync(manifest_path, 'utf8')),
 	)
 	if (!parsed.success) return undefined
 	if (parsed.data.name !== package_name) return undefined

package/scripts/version/latest-corepack.ts

@@ -37,11 +37,11 @@
  */
 import { readFileSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
+import { json_value } from '#scripts/lib/json-value'
 import { execaSync } from 'execa'
 import semver from 'semver'
 import { z } from 'zod'
 import { package_manager_version } from './package-manager-version'
-import { safe_json_parse } from './parse-json'
 import { release_age } from './release-age'
 
 const PACKAGE_JSON_PATH = 'package.json'
@@ -59,7 +59,9 @@ const DEV_ENGINES_SCHEMA = z.object({ packageManager: PNPM_DEVELOPMENT_MANAGER_S
 const DEV_ENGINES_PNPM_SCHEMA = z.object({ devEngines: DEV_ENGINES_SCHEMA.optional() })
 
 function extract_development_engines_version(package_json_content: string): string | undefined {
-	const parsed = DEV_ENGINES_PNPM_SCHEMA.safeParse(safe_json_parse(package_json_content))
+	const parsed = DEV_ENGINES_PNPM_SCHEMA.safeParse(
+		json_value.parse_or_undefined(package_json_content),
+	)
 
 	return parsed.success ? parsed.data.devEngines?.packageManager.version : undefined
 }
@@ -108,7 +110,7 @@ function extract_times_json(stdout: string): Record<string, string> | undefined
 	const end = stdout.lastIndexOf('}')
 	if (start === -1 || end <= start) return undefined
 	const parsed = release_age.release_times_schema.safeParse(
-		safe_json_parse(stdout.slice(start, end + 1)),
+		json_value.parse_or_undefined(stdout.slice(start, end + 1)),
 	)
 
 	return parsed.success ? parsed.data : undefined
@@ -236,7 +238,7 @@ function decode_integrity(encoded: string): string | undefined {
 function extract_encoded_integrity(stdout: string): string | undefined {
 	const payload = /"sha512-[A-Za-z0-9+/]+={0,2}"/u.exec(stdout)?.[0]
 	if (payload === undefined) return undefined
-	const parsed: unknown = safe_json_parse(payload)
+	const parsed: unknown = json_value.parse_or_undefined(payload)
 	if (typeof parsed !== 'string') return undefined
 
 	return INTEGRITY_RE.exec(parsed)?.[1]
@@ -319,7 +321,7 @@ function restore_after_update(original: string, target: string, integrity: strin
 }
 
 function pin_unpinned_manifest(original: string, target: string, integrity: string): void {
-	const manifest = z.record(z.string(), z.unknown()).parse(safe_json_parse(original))
+	const manifest = z.record(z.string(), z.unknown()).parse(json_value.parse_or_undefined(original))
 	const pinned = JSON.stringify(
 		{ ...manifest, packageManager: `${target}+${integrity}` },
 		undefined,
@@ -386,18 +388,14 @@ const latest_corepack = {
 	is_target_not_newer_than_pin,
 	notify_skipped_bump,
 	extract_times_json,
-	query_release_times,
 	query_major_latest_version,
 	resolve_corepack_target,
-	warn_skip,
-	warn_unresolved,
 	run_pnpm_update,
 	query_integrity,
 	restore_integrity,
 	did_warn_skip,
 	sync_development_engines,
 	restore_package_json,
-	bump_package_manager,
 	main,
 }
 

package/scripts/version/latest-scope-cli.ts

@@ -130,9 +130,7 @@ function main(argv: ReadonlyArray<string>): void {
 
 const latest_scope_cli = {
 	decide,
-	describe_stamp,
 	JSON_KEY,
-	main,
 	NO_STAMP_REASON,
 	RECORD_FLAG,
 	REQUIRED_SCOPE,

package/scripts/version/latest-update.ts

@@ -190,10 +190,8 @@ const latest_update = {
 	main,
 	build_update_commands,
 	run_update_stages,
-	update_without_downgrading,
 	take_snapshot,
 	restore_snapshot,
-	report_lockfile_overrides,
 }
 
 export { latest_update }

package/scripts/version/npm-registry.ts

@@ -0,0 +1,97 @@
+import { json_value } from '#scripts/lib/json-value'
+import { migrate_logic } from '#scripts/registry-migration/migrate-logic'
+import { execaSync } from 'execa'
+import { z } from 'zod'
+import { release_age } from './release-age'
+
+// The public npm registry, read without credentials so a consumer who installed from public npm
+// can see the latest release without a `read:packages` GitHub token (joshuafolkken/kit#2882). The
+// GitHub Packages versions API stays the source for a scope routed there, and the fallback for a
+// package public npm does not carry.
+const PUBLIC_REGISTRY = 'https://registry.npmjs.org'
+// The abbreviated packument carries `dist-tags` without every version's full manifest.
+const ABBREVIATED_ACCEPT = 'application/vnd.npm.install-v1+json'
+const FULL_ACCEPT = 'application/json'
+const REQUEST_TIMEOUT_MS = 10_000
+const SCOPE_SEPARATOR = '/'
+const ENCODED_SCOPE_SEPARATOR = '%2f'
+const SCOPE_PATTERN = /^@[^/]+(?=\/)/u
+const SCOPE_REGISTRY_SUFFIX = ':registry'
+const github_scopes = new Map<string, boolean>()
+
+// The version commands are synchronous end to end and exported that way to consumers, so the
+// request runs in a child Node process rather than turning the whole chain async. Node's own
+// `fetch` needs no external binary, and a non-2xx answer exits non-zero so it reads as "no answer".
+const FETCH_SCRIPT = [
+	'const [url, accept] = process.argv.slice(1)',
+	'const response = await fetch(url, { headers: { accept } })',
+	'if (!response.ok) process.exit(1)',
+	'process.stdout.write(await response.text())',
+].join('\n')
+
+const latest_schema = z.looseObject({ 'dist-tags': z.looseObject({ latest: z.string() }) })
+const times_schema = z.looseObject({ time: release_age.release_times_schema })
+
+// The packument URL for a package name; a scoped name keeps its `@` and encodes the separator, the
+// form the registry documents for scoped packages.
+function packument_url(package_name: string): string {
+	return `${PUBLIC_REGISTRY}/${package_name.replace(SCOPE_SEPARATOR, () => ENCODED_SCOPE_SEPARATOR)}`
+}
+
+function read_packument(package_name: string, accept: string): unknown {
+	const result = execaSync(
+		process.execPath,
+		['--input-type=module', '-e', FETCH_SCRIPT, packument_url(package_name), accept],
+		{ reject: false, timeout: REQUEST_TIMEOUT_MS },
+	)
+	if (result.exitCode !== 0) return undefined
+
+	return json_value.parse_or_undefined(result.stdout)
+}
+
+// Whether this checkout installs the package's scope from GitHub Packages, read with the same
+// `pnpm config get` `josh registry:migrate` uses (project `.npmrc` over user `~/.npmrc`). The two
+// registries are published by parallel jobs and can drift, so a consumer routed to GitHub Packages
+// keeps reading it: public npm could otherwise offer a release its registry does not carry yet.
+// Memoized per scope — kit and app-kit share one, and one report asks for both packages.
+function is_github_scope(scope: string): boolean {
+	const is_cached_github = github_scopes.get(scope)
+	if (is_cached_github !== undefined) return is_cached_github
+	const result = execaSync('pnpm', ['config', 'get', `${scope}${SCOPE_REGISTRY_SUFFIX}`], {
+		reject: false,
+		timeout: REQUEST_TIMEOUT_MS,
+	})
+	const is_github = result.exitCode === 0 && migrate_logic.is_github_tarball(result.stdout.trim())
+
+	github_scopes.set(scope, is_github)
+
+	return is_github
+}
+
+function is_public_source(package_name: string): boolean {
+	const scope = SCOPE_PATTERN.exec(package_name)?.[0]
+
+	return scope === undefined || !is_github_scope(scope)
+}
+
+// The `latest` dist-tag on public npm, or nothing when the package is not installed from there or
+// the registry cannot answer for it (offline, timed out, or not published there).
+function read_latest(package_name: string): string | undefined {
+	if (!is_public_source(package_name)) return undefined
+	const parsed = latest_schema.safeParse(read_packument(package_name, ABBREVIATED_ACCEPT))
+
+	return parsed.success ? parsed.data['dist-tags'].latest : undefined
+}
+
+// The version → publish-date map from public npm, under the same source rule as `read_latest`. It
+// also carries `created` / `modified` keys, which the release-age selector skips as non-semver.
+function read_release_times(package_name: string): Record<string, string> | undefined {
+	if (!is_public_source(package_name)) return undefined
+	const parsed = times_schema.safeParse(read_packument(package_name, FULL_ACCEPT))
+
+	return parsed.success ? parsed.data.time : undefined
+}
+
+const npm_registry = { packument_url, read_latest, read_release_times }
+
+export { npm_registry }

package/scripts/version/publishable-range-check.ts

@@ -69,6 +69,6 @@ function main(): void {
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main()
 
-const publishable_range_check = { check, probe_range }
+const publishable_range_check = { check }
 
 export { publishable_range_check }

package/scripts/version/release-hold.ts

@@ -129,13 +129,9 @@ function build_release_hold_notes(
 }
 
 const release_hold = {
-	HOLD_LABEL,
-	is_at_or_above,
-	is_latest_withheld,
 	resolve_installable,
 	is_release_age_hold,
 	format_window,
-	format_release_hold_note,
 	build_release_hold_notes,
 }
 

package/scripts/version/running-binary.ts

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
+import { json_value } from '#scripts/lib/json-value'
 import { package_version_schema } from '#scripts/lib/schemas'
-import { safe_json_parse } from './parse-json'
 
 const PACKAGE_JSON = 'package.json'
 // Scripts live two levels under the package root (scripts/<group>/<file>.ts), so the running
@@ -27,7 +27,7 @@ function read_running_version(self_directory: string): string | undefined {
 	const package_path = resolve_self_package_path(self_directory)
 	if (!existsSync(package_path)) return undefined
 	const parsed = package_version_schema.safeParse(
-		safe_json_parse(readFileSync(package_path, 'utf8')),
+		json_value.parse_or_undefined(readFileSync(package_path, 'utf8')),
 	)
 
 	return parsed.success ? parsed.data.version : undefined

package/scripts/version/version-check-logic.ts

@@ -309,13 +309,11 @@ const version_check_logic = {
 	format_dual_version_output,
 	format_running_line,
 	format_upstream_lines,
-	format_upstream_global_line,
 	build_dual_upgrade_commands,
 	build_upstream_upgrade_commands,
 	build_upstream_upgrade_notes,
 	build_effective_upgrade_commands,
 	build_effective_upgrade_notes,
-	build_project_upgrade_commands,
 	format_update_command,
 	format_effective_outcome,
 	build_upgrade_shell_command,

package/scripts/version/version-commands.ts

@@ -13,6 +13,7 @@ import {
 	type VersionSnapshot,
 } from './version-check-logic'
 import type {
+	PackageVersionConfig,
 	UpstreamHookContext,
 	UpstreamVersionConfig,
 	VersionCommandConfig,
@@ -29,11 +30,11 @@ const NO_QUARANTINE_MINUTES = 0
 // whose `installable` is undefined when the timestamps cannot be read — the report then renders
 // exactly as it did before (joshuafolkken/kit#808).
 //
-// Skipped entirely unless some target is behind `latest`: the timestamps cost a second `gh api`
+// Skipped entirely unless some target is behind `latest`: the timestamps cost a second registry
 // round trip per package, and a package with nothing stale has no gap for a hold to explain. On the
 // common all-current run the report costs exactly what it did before this feature.
 function read_release_hold(
-	versions_endpoint: string | undefined,
+	package_config: PackageVersionConfig,
 	latest: string,
 	versions: ReadonlyArray<string | undefined>,
 ): ReleaseHold | undefined {
@@ -45,7 +46,7 @@ function read_release_hold(
 	// a registry round trip discovering that.
 	if (minimum_age_minutes <= NO_QUARANTINE_MINUTES) return undefined
 	const installable = release_hold.resolve_installable(
-		fetch_release_times(versions_endpoint),
+		fetch_release_times(package_config.versions_endpoint, package_config.package_name),
 		latest,
 		minimum_age_minutes,
 		Date.now(),
@@ -157,7 +158,7 @@ function read_upstream_report(
 	// After the effective install is attached, so its version counts toward the staleness gate.
 	// Only the effective install is peer-resolved, so it is the only target the window can hold back.
 	const hold = is_hold_wanted
-		? read_release_hold(upstream.versions_endpoint, latest, [report.effective?.version])
+		? read_release_hold(upstream, latest, [report.effective?.version])
 		: undefined
 	if (hold !== undefined) report.hold = hold