@joshuafolkken/kit 1.1178.0 → 1.1240.0

package/scripts/version/publishable-range-check.ts

@@ -6,6 +6,7 @@
  */
 import { readFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
+import { COMMAND_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execaSync } from 'execa'
 import {
 	publishable_range,
@@ -15,7 +16,6 @@ import {
 } from './publishable-range'
 
 const PACKAGE_JSON_PATH = 'package.json'
-const VIEW_TIMEOUT_MS = 30_000
 const FAILURE_EXIT_CODE = 1
 
 // A registry query rather than a direct fetch: safe-chain installs shims ahead of the package
@@ -29,7 +29,7 @@ const FAILURE_EXIT_CODE = 1
 function probe_range(name: string, range: string): ProbeResult {
 	const result = execaSync('pnpm', ['view', `${name}@${range}`, 'version'], {
 		reject: false,
-		timeout: VIEW_TIMEOUT_MS,
+		timeout: COMMAND_TIMEOUT_MS,
 	})
 
 	return { exit_code: result.exitCode ?? FAILURE_EXIT_CODE, stdout: result.stdout }

package/scripts/version/publishable-range.ts

@@ -1,4 +1,4 @@
-import { package_with_deps_schema } from '#scripts/overrides/schemas'
+import { package_with_deps_schema } from '#scripts/overrides/overrides-schemas'
 import semver from 'semver'
 
 // kit ships a `preinstall` hook that installs @aikidosec/safe-chain, whose minimum-age policy hides

package/scripts/version/release-age.ts

@@ -1,5 +1,6 @@
 import { readFileSync } from 'node:fs'
 import path from 'node:path'
+import { yaml_document } from '#scripts/lib/yaml-document'
 import semver from 'semver'
 import { z } from 'zod'
 
@@ -7,30 +8,41 @@ import { z } from 'zod'
 // safe-chain's interception. safe-chain filters the registry only when the process tree was
 // started through one of its six wrapped shell commands, so `josh latest` and
 // `pnpm josh latest` used to resolve different "newest release" answers. These functions
-// make the resolution deterministic: the policy comes from the repo-managed `.npmrc`, the
-// publish timestamps from the registry, and the selection is a pure computation over both.
+// make the resolution deterministic: the policy comes from the repo-managed `pnpm-workspace.yaml`,
+// the publish timestamps from the registry, and the selection is a pure computation over both.
+// pnpm 12 reads its settings from `pnpm-workspace.yaml` — a `minimum-release-age` line in `.npmrc`
+// is ignored there, so reading it would report a window pnpm does not apply (kit#3267).
 
-const MINIMUM_RELEASE_AGE_RE = /^minimum-release-age\s*=\s*(\d+)\s*$/mu
 const NO_QUARANTINE_MINUTES = 0
-const NPMRC_PATH = '.npmrc'
+const WORKSPACE_PATH = 'pnpm-workspace.yaml'
+const workspace_age_schema = z.object({ minimumReleaseAge: z.number().int().nonnegative() })
 
 // A version → ISO publish date map, the shape both the registry and the GitHub Packages API are
 // reduced to before the aged-version selection runs.
 const release_times_schema = z.record(z.string(), z.string())
 const MS_PER_MINUTE = 60_000
 
-// The window `.npmrc` content declares, or nothing when it does not declare one — an explicit
-// `minimum-release-age=0` stays 0 rather than collapsing into "not declared".
-function parse_declared_minimum_release_age(npmrc_content: string): number | undefined {
-	const raw = MINIMUM_RELEASE_AGE_RE.exec(npmrc_content)?.[1]
+function parse_workspace(workspace_content: string): unknown {
+	try {
+		return yaml_document.parse_yaml(workspace_content)
+	} catch {
+		return undefined
+	}
+}
+
+// The window `pnpm-workspace.yaml` content declares, or nothing when it does not declare one or the
+// document is malformed — an explicit `minimumReleaseAge: 0` stays 0 rather than collapsing into
+// "not declared".
+function parse_declared_minimum_release_age(workspace_content: string): number | undefined {
+	const parsed = workspace_age_schema.safeParse(parse_workspace(workspace_content))
 
-	return raw === undefined ? undefined : Number(raw)
+	return parsed.success ? parsed.data.minimumReleaseAge : undefined
 }
 
-// The quarantine window in minutes from `.npmrc`; a missing or malformed entry means no
-// quarantine, matching pnpm's own default for the setting.
-function parse_minimum_release_age(npmrc_content: string): number {
-	return parse_declared_minimum_release_age(npmrc_content) ?? NO_QUARANTINE_MINUTES
+// The quarantine window in minutes from `pnpm-workspace.yaml`; a missing or malformed entry means
+// no quarantine, matching pnpm's own default for the setting.
+function parse_minimum_release_age(workspace_content: string): number {
+	return parse_declared_minimum_release_age(workspace_content) ?? NO_QUARANTINE_MINUTES
 }
 
 // Stable releases only, on the requested major, published at or before the cutoff. The
@@ -83,49 +95,47 @@ function select_aged_version(
 	return eligible[0]
 }
 
-// The window declared in one `.npmrc`, or nothing when the file is absent, unreadable, or does not
-// declare the setting. Distinguishing "not declared" from "declared as 0" is what lets an explicit
-// `minimum-release-age=0` opt-out stop the walk instead of falling through to an ancestor's policy.
-function read_declared_minimum_release_age(npmrc_path: string): number | undefined {
+// The window declared in one `pnpm-workspace.yaml`, or nothing when the file is absent, unreadable,
+// or does not declare the setting. Distinguishing "not declared" from "declared as 0" is what lets an
+// explicit `minimumReleaseAge: 0` opt-out stop the walk instead of falling through to an ancestor's.
+function read_declared_minimum_release_age(workspace_path: string): number | undefined {
 	try {
-		return parse_declared_minimum_release_age(readFileSync(npmrc_path, 'utf8'))
+		return parse_declared_minimum_release_age(readFileSync(workspace_path, 'utf8'))
 	} catch {
 		return undefined
 	}
 }
 
-// The quarantine window declared by one specific `.npmrc`, defaulting to the project's own. An
-// absent, unreadable, or undeclared setting means no quarantine — the policy is advisory, and a
-// project without one is not held back.
+// The quarantine window declared by one specific `pnpm-workspace.yaml`, defaulting to the project's
+// own. An absent, unreadable, or undeclared setting means no quarantine — the policy is advisory,
+// and a project without one is not held back.
 //
 // Deliberately not the upward walk below: `josh latest` resolves this against the working directory
-// it also writes `corepack use` into, and honouring a user-level policy there could freeze pnpm
+// it also writes `corepack use` into, and honouring an ancestor's policy there could freeze pnpm
 // bumps in a project that declares none (joshuafolkken/kit#808).
-function read_minimum_release_age(npmrc_path: string = NPMRC_PATH): number {
-	return read_declared_minimum_release_age(npmrc_path) ?? NO_QUARANTINE_MINUTES
+function read_minimum_release_age(workspace_path: string = WORKSPACE_PATH): number {
+	return read_declared_minimum_release_age(workspace_path) ?? NO_QUARANTINE_MINUTES
 }
 
-// The window declared by the nearest `.npmrc` at or above `start`, or nothing.
+// The window declared by the nearest `pnpm-workspace.yaml` at or above `start`, or nothing.
 //
-// Two reasons this walks rather than reading one path. `josh version` and `josh latest` both run
-// from anywhere inside a project — and from outside one — so resolving against the working directory
-// alone would silently read "no quarantine" in every subdirectory. And pnpm merges config per key
-// across project, workspace and user levels, so a project `.npmrc` that only sets a registry must
-// not mask a `~/.npmrc` carrying the policy (joshuafolkken/kit#808).
+// This walks rather than reading one path because `josh version` and `josh latest` both run from
+// anywhere inside a project — and from outside one — so resolving against the working directory
+// alone would silently read "no quarantine" in every subdirectory (joshuafolkken/kit#808). pnpm
+// finds its workspace root the same way, by walking up to the nearest `pnpm-workspace.yaml`.
 //
-// `boundary` stops the walk at a known root. Production passes none — a user-level `~/.npmrc` is a
-// legitimate source — while tests bound the search so it cannot depend on the machine's real home.
+// `boundary` stops the walk at a known root. Production passes none, while tests bound the search
+// so it cannot depend on the directories above the machine's temp root.
 //
-// Simplification: the walk visits every ancestor, whereas pnpm consults only the project, the
-// workspace root, `~/.npmrc` and its global config. A stray `.npmrc` in an intermediate directory
-// would therefore be honoured here and not by pnpm. The consequence is one informational `Held:`
-// line — the value never suppresses a command — so the faithful four-level model is not worth its
-// complexity here.
+// Simplification: a nearer workspace file that does not declare the window falls through to an
+// ancestor's, and pnpm's user-level `config.yaml` is not consulted. The consequence is one
+// informational `Held:` line — the value never suppresses a command — so modelling pnpm's exact
+// lookup is not worth its complexity here.
 function find_declared_minimum_release_age(
 	start: string,
 	boundary: string | undefined,
 ): number | undefined {
-	const declared = read_declared_minimum_release_age(path.join(start, NPMRC_PATH))
+	const declared = read_declared_minimum_release_age(path.join(start, WORKSPACE_PATH))
 	if (declared !== undefined) return declared
 	if (start === boundary) return undefined
 	const parent = path.dirname(start)

package/scripts/version/release-hold.ts

@@ -8,7 +8,7 @@ import { release_age } from './release-age'
 // is by definition the youngest (joshuafolkken/kit#808).
 //
 // **The window binds unpinned resolution only.** Measured on pnpm 11.22.0 with
-// `minimum-release-age=1440` and a release published 3.5 h earlier:
+// `minimumReleaseAge: 1440` and a release published 3.5 h earlier:
 //
 //   pnpm add pkg@1.80.0   ->  1.80.0   (pnpm records a `minimumReleaseAgeExclude` entry)
 //   pnpm add pkg          ->  1.78.0   (the newest release past the window)

package/scripts/version/safe-chain-version-update.ts

@@ -0,0 +1,40 @@
+import { COMMAND_TIMEOUT_MS } from '#scripts/lib/timeouts'
+import { ci_installer_pin } from '#scripts/safe-chain/ci-installer-pin'
+import { npm_registry } from '#scripts/version/npm-registry'
+import { execaSync } from 'execa'
+
+const SAFE_CHAIN_PKG = '@aikidosec/safe-chain'
+
+// The registry's answer is trusted only as an exact semver version: it ends up in workflow files and
+// in the installer URL (joshuafolkken/kit#3266).
+function fetch_latest_version(): string | undefined {
+	const result = execaSync('npm', ['view', SAFE_CHAIN_PKG, 'version'], {
+		reject: false,
+		timeout: COMMAND_TIMEOUT_MS,
+	})
+	if (result.exitCode !== 0 || !result.stdout) return undefined
+
+	return npm_registry.valid_version(result.stdout.trim())
+}
+
+// The hash-verified installer pinned in the workflows is the one place a safe-chain release is
+// recorded; `preinstall` no longer names one (joshuafolkken/kit#3269). Every repository moves the
+// files that carry the pin — app-kit's own `dast.yml` / `load.yml` included (joshuafolkken/kit#2830).
+function sync(): void {
+	const latest = fetch_latest_version()
+
+	if (latest === undefined) {
+		console.warn(`\n⚠ Could not fetch a valid latest version of ${SAFE_CHAIN_PKG}; skipping`)
+
+		return
+	}
+
+	ci_installer_pin.sync(latest)
+}
+
+const safe_chain_version_update = {
+	sync,
+	fetch_latest_version,
+}
+
+export { safe_chain_version_update }

package/scripts/version/upgrade-shell-command.ts

@@ -1,9 +1,28 @@
 import type { PackageVersionConfig } from './version-command-config'
 
+// One upgrade the version commands offer and run: `text` is the line printed after `Run:`, and
+// `steps` are the argument vectors executed in order, each only after the one before it succeeded.
+// A command kit builds itself is spawned without a shell, so a registry-supplied version is never
+// parsed by one; only the consumer's own configured command goes through `sh -c`.
+interface UpgradeCommand {
+	text: string
+	steps: ReadonlyArray<ReadonlyArray<string>>
+}
+
+const STEP_SEPARATOR = ' && '
+
 function update_scope_flag(is_local: boolean): string {
 	return is_local ? '-D' : '-g'
 }
 
+function update_argv(
+	latest: string,
+	is_local: boolean,
+	config: PackageVersionConfig,
+): Array<string> {
+	return ['pnpm', 'add', update_scope_flag(is_local), `${config.package_name}@${latest}`]
+}
+
 // The bare `pnpm add` invocation that installs one package at an exact version, in the global or the
 // project (dev-dependency) scope.
 function format_update_command(
@@ -11,20 +30,41 @@ function format_update_command(
 	is_local: boolean,
 	config: PackageVersionConfig,
 ): string {
-	return `pnpm add ${update_scope_flag(is_local)} ${config.package_name}@${latest}`
+	return update_argv(latest, is_local, config).join(' ')
+}
+
+// The upgrade for one target. A project-scope install is followed by kit's lockfile repair
+// (`fix-gh-packages`), which a global install does not need. The printed text is derived from the
+// steps, so the hint and what actually runs cannot drift apart.
+function build_upgrade_command(
+	latest: string,
+	is_local: boolean,
+	config: PackageVersionConfig,
+): UpgradeCommand {
+	const steps = [update_argv(latest, is_local, config)]
+	if (is_local) steps.push(['node_modules/.bin/tsx', config.fix_gh_packages_path])
+
+	return { text: steps.map((step) => step.join(' ')).join(STEP_SEPARATOR), steps }
+}
+
+// The consumer's own configured command — `pnpm add -g …`, or a chain with `&&` — is inside the trust
+// boundary and needs a shell to mean what it says.
+function shell_upgrade_command(command: string): UpgradeCommand {
+	return { text: command, steps: [['sh', '-c', command]] }
 }
 
-// The full shell command for one upgrade target. A project-scope install is chained with kit's
-// lockfile repair (`fix-gh-packages`), which a global install does not need.
 function build_upgrade_shell_command(
 	latest: string,
 	is_local: boolean,
 	config: PackageVersionConfig,
 ): string {
-	const add_command = format_update_command(latest, is_local, config)
-	if (!is_local) return add_command
-
-	return `${add_command} && node_modules/.bin/tsx ${config.fix_gh_packages_path}`
+	return build_upgrade_command(latest, is_local, config).text
 }
 
-export { build_upgrade_shell_command, format_update_command }
+export type { UpgradeCommand }
+export {
+	build_upgrade_command,
+	build_upgrade_shell_command,
+	format_update_command,
+	shell_upgrade_command,
+}

package/scripts/version/version-check-logic.ts

@@ -1,6 +1,12 @@
 import { release_hold } from './release-hold'
 import { is_no_op_upgrade_command, type InstalledVersions } from './upgrade-command-guard'
-import { build_upgrade_shell_command, format_update_command } from './upgrade-shell-command'
+import {
+	build_upgrade_command,
+	build_upgrade_shell_command,
+	format_update_command,
+	shell_upgrade_command,
+	type UpgradeCommand,
+} from './upgrade-shell-command'
 import type { PackageVersionConfig } from './version-command-config'
 
 const NOT_INSTALLED = 'not installed'
@@ -161,11 +167,11 @@ function resolve_effective_upgrade_hint(report: UpstreamReport): EffectiveUpgrad
 // The consumer-supplied global upgrade command for a stale effective upstream, or nothing. Skipped
 // when the consumer did not opt in, the effective install is up to date / unresolved, or the command
 // provably cannot change the effective version it was meant to fix (see the note line instead).
-function build_effective_upgrade_commands(report: UpstreamReport): Array<string> {
+function build_effective_upgrade_commands(report: UpstreamReport): Array<UpgradeCommand> {
 	const hint = resolve_effective_upgrade_hint(report)
 	if (hint === undefined || hint.is_no_op) return []
 
-	return [hint.command]
+	return [shell_upgrade_command(hint.command)]
 }
 
 // The explanation that replaces a suppressed `Run:` hint, so a stale effective install is never left
@@ -202,8 +208,9 @@ function format_upstream_lines(report: UpstreamReport): Array<string> {
 // Drop repeated commands while preserving first-seen order. A consumer with several upstreams can
 // return the same chain-pinning global command from each of them (game-kit returns one command for
 // both app-kit and kit), which would otherwise print an identical `Run:` line once per upstream.
-function unique_upgrade_commands(commands: ReadonlyArray<string>): Array<string> {
-	return [...new Set(commands)]
+// Keyed on the printed text, which the steps are derived from or carried verbatim inside.
+function unique_upgrade_commands(commands: ReadonlyArray<UpgradeCommand>): Array<UpgradeCommand> {
+	return [...new Map(commands.map((command) => [command.text, command])).values()]
 }
 
 // The outcome line for an effective install the upgrade command left exactly where it was.
@@ -235,37 +242,39 @@ function format_effective_outcome(report: UpstreamReport, after: string | undefi
 
 // The project-scope upgrade command when the upstream's project dependency is installed and stale.
 // Always local (with lockfile repair), since the project path is the only scope kit resolves.
-function build_project_upgrade_commands(report: UpstreamReport): Array<string> {
+function build_project_upgrade_commands(report: UpstreamReport): Array<UpgradeCommand> {
 	if (!is_target_stale(report.project_version, report.latest)) return []
 
-	return [build_upgrade_shell_command(report.latest, true, report.config)]
+	return [build_upgrade_command(report.latest, true, report.config)]
 }
 
 // Build the upgrade commands for every upstream: the consumer's global command for a stale effective
 // install first, then the project-scope command, mirroring the main report's global-before-project
 // order. Upstreams without either stale target contribute nothing.
-function build_upstream_upgrade_commands(reports: ReadonlyArray<UpstreamReport>): Array<string> {
+function build_upstream_upgrade_commands(
+	reports: ReadonlyArray<UpstreamReport>,
+): Array<UpgradeCommand> {
 	return reports.flatMap((report) => [
 		...build_effective_upgrade_commands(report),
 		...build_project_upgrade_commands(report),
 	])
 }
 
-// Build the shell upgrade commands for whichever of the two targets are installed and stale.
+// Build the upgrade commands for whichever of the two targets are installed and stale.
 // Order: global first, then project (mirrors the display order).
 function build_dual_upgrade_commands(
 	snapshot: VersionSnapshot,
 	config: PackageVersionConfig,
-): Array<string> {
+): Array<UpgradeCommand> {
 	const { global_version, project_version, latest } = snapshot
-	const commands: Array<string> = []
+	const commands: Array<UpgradeCommand> = []
 
 	if (is_target_stale(global_version, latest)) {
-		commands.push(build_upgrade_shell_command(latest, false, config))
+		commands.push(build_upgrade_command(latest, false, config))
 	}
 
 	if (is_target_stale(project_version, latest)) {
-		commands.push(build_upgrade_shell_command(latest, true, config))
+		commands.push(build_upgrade_command(latest, true, config))
 	}
 
 	return commands
@@ -298,7 +307,7 @@ function format_dual_version_output(
 	const hints = unique_upgrade_commands([
 		...build_dual_upgrade_commands(snapshot, config),
 		...build_upstream_upgrade_commands(upstreams),
-	]).map((command) => `Run: ${command}`)
+	]).map((command) => `Run: ${command.text}`)
 	if (hints.length > 0) lines.push('', ...hints)
 	if (extras.warning !== undefined) lines.push('', extras.warning)
 

package/scripts/version/version-commands.ts

@@ -1,8 +1,10 @@
+import { INSTALL_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execaSync } from 'execa'
 import { release_age } from './release-age'
 import { release_hold } from './release-hold'
 import { running_binary } from './running-binary'
 import type { InstalledVersions } from './upgrade-command-guard'
+import type { UpgradeCommand } from './upgrade-shell-command'
 import {
 	version_check_logic,
 	type ReleaseHold,
@@ -24,8 +26,6 @@ import { version_targets } from './version-targets'
 const FAILURE_EXIT_CODE = 1
 const ALREADY_UP_TO_DATE = 'Already up to date'
 const NO_QUARANTINE_MINUTES = 0
-// A global install that goes to the network — the same ten minutes `lane-install.ts` gives one.
-const UPGRADE_TIMEOUT_MS = 600_000
 
 // What the local minimum-release-age policy permits for one package. Resolved per package because
 // the newest installable release is a property of that package's own publish history. Returns a hold
@@ -197,23 +197,35 @@ function run_check(config: VersionCommandConfig): void {
 	)
 }
 
-// Through `sh -c` because an upgrade command is the user's own configured string — `pnpm add -g …`,
-// or a chain with `&&` — so it is inside the trust boundary and needs a shell to mean what it says.
-// The bound keeps a registry that never answers from holding `josh version` open forever; a timed-out
-// run has no exit code, so it falls through to the failure code like any other failed step.
-function run_upgrade_command(command: string): number {
-	const result = execaSync('sh', ['-c', command], {
+// One step as an argument vector — no shell unless the step itself is the consumer's `sh -c`
+// (`shell_upgrade_command`). The bound keeps a registry that never answers from holding `josh
+// version` open forever; a timed-out run has no exit code, so it falls through to the failure code
+// like any other failed step.
+function run_upgrade_step(step: ReadonlyArray<string>): number {
+	const [executable = '', ...rest] = step
+	const result = execaSync(executable, rest, {
 		stdio: 'inherit',
 		reject: false,
-		timeout: UPGRADE_TIMEOUT_MS,
+		timeout: INSTALL_TIMEOUT_MS,
 	})
 
 	return result.exitCode ?? FAILURE_EXIT_CODE
 }
 
+// Run one command's steps in order, stopping at the first failure — what the `&&` in its printed
+// text says.
+function run_upgrade_command(command: UpgradeCommand): number {
+	for (const step of command.steps) {
+		const code = run_upgrade_step(step)
+		if (code !== 0) return code
+	}
+
+	return 0
+}
+
 // Run every upgrade command in order, returning the last non-zero exit code (or 0 when all
 // succeed) so a failure on either target is surfaced without aborting the remaining upgrades.
-function run_all_upgrade_commands(commands: ReadonlyArray<string>): number {
+function run_all_upgrade_commands(commands: ReadonlyArray<UpgradeCommand>): number {
 	let exit_code = 0
 	const failed_commands: Array<string> = []
 
@@ -221,7 +233,7 @@ function run_all_upgrade_commands(commands: ReadonlyArray<string>): number {
 		const code = run_upgrade_command(command)
 		if (code === 0) continue
 		exit_code = code
-		failed_commands.push(command)
+		failed_commands.push(command.text)
 	}
 
 	if (failed_commands.length > 0) {

package/scripts/version/version-remote.ts

@@ -23,19 +23,11 @@ function require_endpoint(versions_endpoint: string | undefined, package_name: s
 	)
 }
 
-// Fetch the latest published version: public npm's `latest` dist-tag first, which needs no
-// credentials (joshuafolkken/kit#2882), then the GitHub Packages versions endpoint for a package
-// public npm does not answer for. The endpoint is supplied per package (e.g.
-// `/users/joshuafolkken/packages/npm/kit/versions?per_page=1`) so the same fetcher serves kit, jgame,
-// and app-kit. Guards an undefined/empty endpoint and wraps `gh api` failures with an actionable
-// message instead of a raw ExecaSyncError stack. The detail is the shared layer's failure text: gh's
-// own stderr (e.g. "gh: Not Found (HTTP 404)") when it wrote one, execa's message otherwise, followed
-// by any JSON error body gh wrote to stdout.
-function fetch_latest_version(versions_endpoint: string | undefined, package_name: string): string {
-	const endpoint = require_endpoint(versions_endpoint, package_name)
-	const public_latest = npm_registry.read_latest(package_name)
-	if (public_latest !== undefined) return public_latest
-
+// The newest version name on the GitHub Packages versions endpoint. Wraps `gh api` failures with an
+// actionable message instead of a raw ExecaSyncError stack. The detail is the shared layer's failure
+// text: gh's own stderr (e.g. "gh: Not Found (HTTP 404)") when it wrote one, execa's message
+// otherwise, followed by any JSON error body gh wrote to stdout.
+function read_github_name(endpoint: string, package_name: string): string {
 	try {
 		return git_gh_exec.exec_gh_api_sync({ path: endpoint, jq_filter: '.[0].name' }).trim()
 	} catch (error) {
@@ -50,6 +42,29 @@ function fetch_latest_version(versions_endpoint: string | undefined, package_nam
 	}
 }
 
+// Refused at the source, as public npm's answer is: the value goes into an install command, so
+// anything but a semver version is never passed on (joshuafolkken/kit#3266).
+function read_github_latest(endpoint: string, package_name: string): string {
+	const name = read_github_name(endpoint, package_name)
+	const version = npm_registry.valid_version(name)
+	if (version !== undefined) return version
+
+	throw new Error(
+		`Refused latest version for ${package_name} via ${endpoint}: ${JSON.stringify(name)} is not a semver version`,
+	)
+}
+
+// Fetch the latest published version: public npm's `latest` dist-tag first, which needs no
+// credentials (joshuafolkken/kit#2882), then the GitHub Packages versions endpoint for a package
+// public npm does not answer for. The endpoint is supplied per package (e.g.
+// `/users/joshuafolkken/packages/npm/kit/versions?per_page=1`) so the same fetcher serves kit, jgame,
+// and app-kit. Guards an undefined/empty endpoint before either source is asked.
+function fetch_latest_version(versions_endpoint: string | undefined, package_name: string): string {
+	const endpoint = require_endpoint(versions_endpoint, package_name)
+
+	return npm_registry.read_latest(package_name) ?? read_github_latest(endpoint, package_name)
+}
+
 // Rewrite the endpoint's page size. The endpoint is consumer-overridable, so `per_page` is set
 // through a query parser rather than by substituting the literal the default happens to carry.
 function with_page_size(endpoint: string, page_size: number): string {

package/templates/pnpm-workspace.basic.yaml

@@ -4,3 +4,7 @@
 allowBuilds:
   esbuild: true
   unrs-resolver: true
+
+# pnpm 12 reads these settings from this file only; the same lines in .npmrc are ignored (kit #3267).
+minimumReleaseAge: 1440
+engineStrict: true

package/templates/workflows/dependabot-auto-merge.yml

@@ -13,10 +13,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   # Gated on who opened the pull request, not on who triggered this run. `github.actor` names the
   # latter, so a push by anyone other than Dependabot — a maintainer rebasing the branch by hand, or
@@ -24,11 +20,15 @@ jobs:
   # `gh pr merge --auto` is state on the pull request, so a run that never happens cannot withdraw an
   # auto-merge an earlier run armed, and the bump merges itself the moment the checks go green
   # (joshuafolkken/kit#838). The author is the stable fact about a Dependabot pull request; arming is
-  # what stays restricted to Dependabot's own events, on the step below.
+  # what stays restricted to Dependabot's own events, on the step below. The write rights are granted
+  # to this job alone (joshuafolkken/kit#3268).
   auto-merge:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     if: github.event.pull_request.user.login == 'dependabot[bot]'
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       # Whether the pull request touches a workflow some upstream package overwrites. Decided from
       # the changed files because Dependabot's metadata cannot answer it: for the github-actions

package/templates/workflows/github-release.yml

@@ -7,6 +7,9 @@ name: GitHub Release
 # started by the GITHUB_TOKEN never fires one (joshuafolkken/kit#3138). kit's own release is the
 # `create-release` job of its publish.yml, which runs the same `josh release:github`, so this file is
 # distributed but never runs in kit.
+# The title names the tag, so a later tag's release can tell this run is still at work on it.
+run-name: GitHub Release ${{ github.event.client_payload.tag }}
+
 on:
   repository_dispatch:
     types: [new-tag-created]
@@ -17,6 +20,8 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    # `josh release:github` waits up to 60 minutes (120 polls, 30 seconds apart) for the Publish run
+    # and lower tags' releases; the extra 5 minutes cover the setup before it.
     timeout-minutes: 65
     permissions:
       actions: read
@@ -65,3 +70,4 @@ jobs:
           RELEASE_TAG: ${{ steps.release.outputs.tag }}
           RELEASE_WORKFLOW: ${{ steps.release.outputs.workflow }}
           RELEASE_AWAIT_PUBLISH: ${{ steps.release.outputs.await }}
+          RELEASE_RUN_WORKFLOW: github-release.yml

package/scripts/build/build-config-merge.ts

@@ -1,27 +0,0 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
-import { error_text } from '#scripts/lib/error-message'
-import { build_library, library_paths } from './build-library'
-
-const CONFIG_MERGE_LIBRARY = 'config-merge'
-const { outfile: CONFIG_MERGE_OUTFILE, dts_file: CONFIG_MERGE_DTS_FILE } =
-	library_paths(CONFIG_MERGE_LIBRARY)
-
-async function build_config_merge_library(): Promise<void> {
-	await build_library(CONFIG_MERGE_LIBRARY)
-}
-
-async function main(): Promise<void> {
-	try {
-		await build_config_merge_library()
-		console.info(`  ✔ ${CONFIG_MERGE_OUTFILE} built`)
-		console.info(`  ✔ ${CONFIG_MERGE_DTS_FILE} built`)
-	} catch (error) {
-		console.error(error_text.message_of(error))
-		process.exit(1)
-	}
-}
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { build_config_merge_library, CONFIG_MERGE_OUTFILE, CONFIG_MERGE_DTS_FILE }

package/scripts/build/build-managed-marker.ts

@@ -1,27 +0,0 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
-import { error_text } from '#scripts/lib/error-message'
-import { build_library, library_paths } from './build-library'
-
-const MANAGED_MARKER_LIBRARY = 'managed-marker'
-const { outfile: MANAGED_MARKER_OUTFILE, dts_file: MANAGED_MARKER_DTS_FILE } =
-	library_paths(MANAGED_MARKER_LIBRARY)
-
-async function build_managed_marker_library(): Promise<void> {
-	await build_library(MANAGED_MARKER_LIBRARY)
-}
-
-async function main(): Promise<void> {
-	try {
-		await build_managed_marker_library()
-		console.info(`  ✔ ${MANAGED_MARKER_OUTFILE} built`)
-		console.info(`  ✔ ${MANAGED_MARKER_DTS_FILE} built`)
-	} catch (error) {
-		console.error(error_text.message_of(error))
-		process.exit(1)
-	}
-}
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
-
-export { build_managed_marker_library, MANAGED_MARKER_OUTFILE, MANAGED_MARKER_DTS_FILE }