@joshuafolkken/kit 1.1240.0 → 1.1370.0

package/scripts/version/safe-chain-version-update.ts

@@ -6,7 +6,7 @@ import { execaSync } from 'execa'
 const SAFE_CHAIN_PKG = '@aikidosec/safe-chain'
 
 // The registry's answer is trusted only as an exact semver version: it ends up in workflow files and
-// in the installer URL (joshuafolkken/kit#3266).
+// in the installer URL.
 function fetch_latest_version(): string | undefined {
 	const result = execaSync('npm', ['view', SAFE_CHAIN_PKG, 'version'], {
 		reject: false,
@@ -18,8 +18,8 @@ function fetch_latest_version(): string | undefined {
 }
 
 // The hash-verified installer pinned in the workflows is the one place a safe-chain release is
-// recorded; `preinstall` no longer names one (joshuafolkken/kit#3269). Every repository moves the
-// files that carry the pin — app-kit's own `dast.yml` / `load.yml` included (joshuafolkken/kit#2830).
+// recorded; `preinstall` no longer names one. Every repository moves the
+// files that carry the pin — app-kit's own `dast.yml` / `load.yml` included.
 function sync(): void {
 	const latest = fetch_latest_version()
 

package/scripts/version/version-check-logic.ts

@@ -29,8 +29,7 @@ interface VersionSnapshot {
 // What the local minimum-release-age policy permits an unpinned resolve to reach. Carried only on an
 // upstream report, because only the effective install is peer-resolved — every other target is
 // upgraded by an explicitly pinned command the window does not block. Optional throughout: a package
-// whose publish timestamps could not be read keeps exactly the report it had before
-// (joshuafolkken/kit#808).
+// whose publish timestamps could not be read keeps exactly the report it had before.
 interface ReleaseHold {
 	installable: string
 	minimum_age_minutes: number
@@ -75,7 +74,7 @@ interface EffectiveUpgradeHint {
 // `installed_versions` is populated only when the consumer declared its global upgrade command
 // pin-only (`is_global_upgrade_command_pinned`). It lists the globally-resolved versions kit already
 // knows, so a command whose every pin is already installed can be proven dead and replaced with an
-// explanation instead of a `Run:` hint (#697). Absent, no command is ever suppressed.
+// explanation instead of a `Run:` hint. Absent, no command is ever suppressed.
 interface UpstreamReport {
 	config: PackageVersionConfig
 	project_version: string | undefined

package/scripts/version/version-check.ts

@@ -4,8 +4,7 @@ import { version_check_arguments } from './version-check-arguments'
 import { version_commands } from './version-commands'
 
 // `version` shows the installed versions; `version --upgrade` updates both the global and the project
-// @joshuafolkken/kit install. The upgrade was a separate `version:upgrade` command until
-// joshuafolkken/kit#1928 folded it into this flag, so the version surface is one command again.
+// @joshuafolkken/kit install, so the version surface is one command.
 const UPGRADE_FLAG = '--upgrade'
 const ARGUMENT_OFFSET = 2
 const version_arguments = process.argv.slice(ARGUMENT_OFFSET)

package/scripts/version/version-command-config.ts

@@ -44,7 +44,7 @@ interface UpstreamHookContext {
 //
 // `is_global_upgrade_command_pinned` declares that the command only pins versions and does not force
 // a fresh dependency resolve. Kit can then prove the command is a no-op once every version it pins is
-// already installed, and replaces the dead `Run:` hint with an explanation (#697). Leave it unset for
+// already installed, and replaces the dead `Run:` hint with an explanation. Leave it unset for
 // a command that re-resolves (e.g. `pnpm remove -g <pkg> && pnpm add -g <pkg>@<latest>`): such a
 // command changes the graph even when its pin is already installed, so it must never be suppressed.
 interface UpstreamEffectiveHooks {
@@ -140,7 +140,7 @@ function resolve_upstream(descriptor: UpstreamDescriptor): UpstreamVersionConfig
 // Resolve the config's versions endpoint: derive it from the package name when omitted, or reject an
 // explicitly-supplied blank endpoint up front. This fails fast at build time so a mis-built config
 // can never carry an empty endpoint down to `fetch_latest_version`, where it would surface as an
-// opaque `gh api` failure (see the game-kit#395 diagnosis behind this guard).
+// opaque `gh api` failure.
 function resolve_versions_endpoint(options: VersionCommandConfigOptions): string {
 	const { versions_endpoint, package_name } = options
 	if (versions_endpoint === undefined) return derive_versions_endpoint(package_name)

package/scripts/version/version-commands.ts

@@ -30,7 +30,7 @@ const NO_QUARANTINE_MINUTES = 0
 // What the local minimum-release-age policy permits for one package. Resolved per package because
 // the newest installable release is a property of that package's own publish history. Returns a hold
 // whose `installable` is undefined when the timestamps cannot be read — the report then renders
-// exactly as it did before (joshuafolkken/kit#808).
+// exactly as it did before.
 //
 // Skipped entirely unless some target is behind `latest`: the timestamps cost a second registry
 // round trip per package, and a package with nothing stale has no gap for a hold to explain. On the
@@ -113,7 +113,7 @@ function build_upstream_effective(
 // The globally-resolved versions kit already knows for one upstream: the primary package's global
 // install (what a `pnpm add -g <primary>@<v>` command would target) and the upstream's own effective
 // install. Attached to the report only when the consumer declared its global upgrade command
-// pin-only, so the no-op guard can prove a command that pins these exact versions is dead (#697).
+// pin-only, so the no-op guard can prove a command that pins these exact versions is dead.
 function build_installed_versions(
 	report: UpstreamReport,
 	config: VersionCommandConfig,
@@ -246,7 +246,7 @@ function run_all_upgrade_commands(commands: ReadonlyArray<UpgradeCommand>): numb
 }
 
 // What to print when nothing can be upgraded: either everything is current, or a stale effective
-// upstream's global command provably cannot change it and the explanation says so (#697).
+// upstream's global command provably cannot change it and the explanation says so.
 function build_idle_message(reports: ReadonlyArray<UpstreamReport>): string {
 	const notes = version_check_logic.build_upstream_upgrade_notes(reports)
 	if (notes.length === 0) return ALREADY_UP_TO_DATE

package/scripts/version/version-remote.ts

@@ -8,7 +8,7 @@ import { release_age } from './release-age'
 // The endpoint's default page is a single entry, so it is widened to the API's maximum rather than
 // paged through: a page that cannot span the window resolves no aged release at all, which silently
 // drops the explanation and leaves the unexplained `⚠` this exists to remove. At the maximum, a
-// week-long window still needs more than 14 releases a day to overflow (joshuafolkken/kit#808).
+// week-long window still needs more than 14 releases a day to overflow.
 const TIMES_PAGE_SIZE = 100
 // Reduce the endpoint's version objects to the version → publish-date map the selector expects.
 const TIMES_JQ = '[.[] | {(.name): .created_at}] | add'
@@ -43,7 +43,7 @@ function read_github_name(endpoint: string, package_name: string): string {
 }
 
 // Refused at the source, as public npm's answer is: the value goes into an install command, so
-// anything but a semver version is never passed on (joshuafolkken/kit#3266).
+// anything but a semver version is never passed on.
 function read_github_latest(endpoint: string, package_name: string): string {
 	const name = read_github_name(endpoint, package_name)
 	const version = npm_registry.valid_version(name)
@@ -55,7 +55,7 @@ function read_github_latest(endpoint: string, package_name: string): string {
 }
 
 // Fetch the latest published version: public npm's `latest` dist-tag first, which needs no
-// credentials (joshuafolkken/kit#2882), then the GitHub Packages versions endpoint for a package
+// credentials, then the GitHub Packages versions endpoint for a package
 // public npm does not answer for. The endpoint is supplied per package (e.g.
 // `/users/joshuafolkken/packages/npm/kit/versions?per_page=1`) so the same fetcher serves kit, jgame,
 // and app-kit. Guards an undefined/empty endpoint before either source is asked.
@@ -90,7 +90,7 @@ function read_github_release_times(versions_endpoint: string): Record<string, st
 
 // Publish timestamps for the package's recent releases, or nothing. Unlike `fetch_latest_version`
 // this never throws: the timestamps only enrich an explanation, so a package whose history cannot be
-// read keeps the report it had before (joshuafolkken/kit#808). Read in the same source order as
+// read keeps the report it had before. Read in the same source order as
 // the latest, so the hold is explained against the registry `latest` came from.
 function fetch_release_times(
 	versions_endpoint: string | undefined,

package/scripts/version/version-targets.ts

@@ -58,7 +58,7 @@ function read_workspace_version(cwd: string): string | undefined {
 }
 
 // `format_project_version_line` / `project_version_line` lived here and formatted
-// `📦 project version: <v>` for the end of a workflow. Both are gone (joshuafolkken/kit#1486): a
+// `📦 project version: <v>` for the end of a workflow. Both are gone: a
 // child no longer bumps, so the local manifest names the *previous* release rather than what the run
 // ships, and every caller now prints the count of unreleased merges instead
 // (`scripts/followup/git-followup-pending.ts`). Removed rather than left unused, so nothing reaches for
@@ -73,7 +73,7 @@ const version_targets = {
 	project_package_path,
 	read_workspace_version,
 	// The manifest's filename. Exported rather than re-declared in each of `josh release`'s two
-	// halves (joshuafolkken/kit#1169): the module that already owns "where the project's manifest is"
+	// halves: the module that already owns "where the project's manifest is"
 	// is where the name belongs.
 	PACKAGE_JSON,
 }

package/templates/gitignore

@@ -72,5 +72,12 @@ e2e/.auth/chrome-profile/
 
 # Claude Code runtime artifacts
 .claude/scheduled_tasks.lock
+.claude/tmp/
+
+# Run handoff notes (written for josh run:cut --handoff); they belong in .claude/tmp/, and the
+# names below are the ones that were once written beside the code and committed with it
+/.git-handoff-*.json
+/.josh-handoff-*.json
+.josh/handoff-*.json
 
 .pnpm-store