@joshuafolkken/kit 1.1514.0 → 1.2114.0

package/scripts/version/development-engines-verdict.ts

@@ -0,0 +1,124 @@
+import { readFileSync } from 'node:fs'
+import { isDeepStrictEqual } from 'node:util'
+import { git_spawn_sync } from '#scripts/git/git-spawn-sync'
+import { PACKAGE_JSON } from '#scripts/lib/package-manifest'
+import { z } from 'zod'
+import { package_manager_version } from './package-manager-version'
+
+// The `devEngines` verdict a dependency update is judged by (`.claude/skills/dependency-update`):
+// the committed manifest against the working tree, printed as one line so nobody compares the two
+// strings by eye. `kept` is the lockstep pnpm bump — the version equal to the `packageManager` pin,
+// integrity suffix included — and `josh sync`'s `onFail` move from `error` to `download`; any other
+// change is `restore`, with the reason in brackets.
+const HEAD_PACKAGE_JSON = `HEAD:./${PACKAGE_JSON}`
+const NOT_JUDGED = `devEngines: not judged (no ${PACKAGE_JSON} at HEAD to compare against)`
+const PACKAGE_MANAGER_KEY = 'packageManager'
+const VERSION_KEY = 'version'
+const ON_FAIL_KEY = 'onFail'
+const ON_FAIL_FROM = 'error'
+const ON_FAIL_TO = 'download'
+const UNCHANGED = 'devEngines: unchanged'
+const KEPT = 'devEngines: kept'
+const SUFFIX_MISSING = 'integrity suffix missing'
+const NO_PIN = 'no pnpm@ packageManager pin to match'
+
+type Entries = Record<string, unknown>
+
+const entries_schema = z.record(z.string(), z.unknown())
+const manifest_schema = z.looseObject({
+	packageManager: z.string().default(''),
+	devEngines: entries_schema.default({}),
+})
+
+type Manifest = z.infer<typeof manifest_schema>
+
+function read_manifest(content: string): Manifest {
+	return manifest_schema.parse(JSON.parse(content))
+}
+
+function is_entries(value: unknown): value is Entries {
+	return entries_schema.safeParse(value).success
+}
+
+function read_package_manager(development_engines: Entries): Entries {
+	const value = development_engines[PACKAGE_MANAGER_KEY]
+
+	return is_entries(value) ? value : {}
+}
+
+// `packageManager` is compared key by key only when both sides are objects; the npm array form, or
+// a block added or removed whole, is a structural change in itself.
+function is_compared_inside(key: string, before: Entries, after: Entries): boolean {
+	return key === PACKAGE_MANAGER_KEY && is_entries(before[key]) && is_entries(after[key])
+}
+
+function changed_keys(before: Entries, after: Entries): Array<string> {
+	const keys = new Set([...Object.keys(before), ...Object.keys(after)])
+
+	return [...keys].filter((key) => !isDeepStrictEqual(before[key], after[key]))
+}
+
+// The version is judged against the pin below, so only its presence counts here.
+function is_expected_change(key: string, before: Entries, after: Entries): boolean {
+	if (key === VERSION_KEY) return typeof after[key] === 'string'
+
+	return key === ON_FAIL_KEY && before[key] === ON_FAIL_FROM && after[key] === ON_FAIL_TO
+}
+
+function find_structure_change(before: Entries, after: Entries): string | undefined {
+	const outer = changed_keys(before, after).filter((key) => !is_compared_inside(key, before, after))
+	const pm_before = read_package_manager(before)
+	const pm_after = read_package_manager(after)
+	const inner = changed_keys(pm_before, pm_after).filter(
+		(key) => !is_expected_change(key, pm_before, pm_after),
+	)
+	const keys = [...outer, ...inner.map((key) => `${PACKAGE_MANAGER_KEY}.${key}`)]
+
+	return keys.length === 0 ? undefined : `structure changed: ${keys.join(', ')}`
+}
+
+// Without a `pnpm@` pin there is nothing the version could be kept in lockstep with.
+function find_version_mismatch(after: Manifest): string | undefined {
+	const pin = package_manager_version.extract_pnpm_pin(after.packageManager)
+	if (pin === undefined) return NO_PIN
+	const current = String(read_package_manager(after.devEngines)[VERSION_KEY])
+	if (current === pin) return undefined
+	if (pin.startsWith(`${current}+`)) return SUFFIX_MISSING
+
+	return `version ${current} is not the packageManager pin ${pin}`
+}
+
+function judge(before_content: string, after_content: string): string {
+	const before = read_manifest(before_content).devEngines
+	const after = read_manifest(after_content)
+	if (isDeepStrictEqual(before, after.devEngines)) return UNCHANGED
+	const reason = find_structure_change(before, after.devEngines) ?? find_version_mismatch(after)
+
+	return reason === undefined ? KEPT : `devEngines: restore (${reason})`
+}
+
+// A manifest that does not parse is answered apart from every verdict rather than thrown, so the
+// overrides check that follows still runs.
+function judge_or_explain(head: string, current: string): string {
+	try {
+		return judge(head, current)
+	} catch (error) {
+		return `devEngines: not judged (${PACKAGE_JSON} unreadable: ${String(error)})`
+	}
+}
+
+function describe(head: string | undefined, current: string): string {
+	return head === undefined ? NOT_JUDGED : judge_or_explain(head, current)
+}
+
+// A `git show` that fails — no commit yet, no repository — answers apart from every verdict, so it
+// never reads as a `devEngines` block the update added.
+function report(): void {
+	const head = git_spawn_sync.read(['show', HEAD_PACKAGE_JSON])
+
+	console.info(describe(head, readFileSync(PACKAGE_JSON, 'utf8')))
+}
+
+const development_engines_verdict = { judge, describe, report }
+
+export { development_engines_verdict }

package/scripts/version/effective-upstream.ts

@@ -1,12 +1,9 @@
-import { existsSync, readFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import path from 'node:path'
 import { ancestor_directories } from '#scripts/lib/ancestor-directories'
-import { json_value } from '#scripts/lib/json-value'
+import { package_manifest } from '#scripts/lib/package-manifest'
 import { package_named_version_schema } from '#scripts/lib/schemas'
 
-const PACKAGE_JSON = 'package.json'
-
 // Options for `resolve_effective_upstream_version`. `resolve_marker` is a subpath specifier used for
 // `createRequire().resolve()` when the package root itself is not directly resolvable — e.g. kit does
 // not list `package.json` (nor a `.` entry) in `exports`, so a subpath like
@@ -18,21 +15,18 @@ interface EffectiveUpstreamOptions {
 // Read the `version` from a package.json only when its `name` matches the target package — undefined
 // when the file is missing, malformed, or belongs to a different (e.g. nested) package. Matching by
 // name is what lets the walk-up skip intermediate package.json files and land on the true root.
-function read_matching_version(manifest_path: string, package_name: string): string | undefined {
-	if (!existsSync(manifest_path)) return undefined
-	const parsed = package_named_version_schema.safeParse(
-		json_value.parse_or_undefined(readFileSync(manifest_path, 'utf8')),
-	)
-	if (!parsed.success || parsed.data.name !== package_name) return undefined
+function read_matching_version(directory: string, package_name: string): string | undefined {
+	const manifest = package_manifest.read_manifest_if_valid(directory, package_named_version_schema)
+	if (manifest?.name !== package_name) return undefined
 
-	return parsed.data.version
+	return manifest.version
 }
 
 // Walk up from a resolved file's directory to the package root, returning the version of the first
 // ancestor package.json whose `name` matches the target — or undefined when no matching root exists.
 function walk_up_for_version(start_directory: string, package_name: string): string | undefined {
 	for (const directory of ancestor_directories.list(start_directory)) {
-		const version = read_matching_version(path.join(directory, PACKAGE_JSON), package_name)
+		const version = read_matching_version(directory, package_name)
 		if (version !== undefined) return version
 	}
 

package/scripts/version/latest-corepack.ts

@@ -42,14 +42,15 @@
 import { readFileSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { json_value } from '#scripts/lib/json-value'
-import { COMMAND_TIMEOUT_MS } from '#scripts/lib/timeouts'
+import { PACKAGE_JSON } from '#scripts/lib/package-manifest'
 import { execaSync } from 'execa'
 import semver from 'semver'
 import { z } from 'zod'
+import { development_engines_verdict } from './development-engines-verdict'
+import { npm_registry } from './npm-registry'
 import { package_manager_version } from './package-manager-version'
 import { release_age } from './release-age'
 
-const PACKAGE_JSON_PATH = 'package.json'
 const PACKAGE_MANAGER_RE = /"packageManager"\s*:\s*"pnpm@(\d+)(?:[^\d]|$)/u
 const PINNED_VERSION_RE = /"packageManager"\s*:\s*"pnpm@([^"+]+)/u
 const TARGET_PREFIX = 'pnpm@'
@@ -133,13 +134,10 @@ function extract_times_json(stdout: string): Record<string, string> | undefined
 // The registry's publish timestamps for every pnpm release (version → ISO date, plus the
 // created/modified bookkeeping keys the selector ignores).
 function query_release_times(): Record<string, string> | undefined {
-	const result = execaSync('pnpm', ['view', 'pnpm', 'time', '--json'], {
-		reject: false,
-		timeout: COMMAND_TIMEOUT_MS,
-	})
-	if ((result.exitCode ?? FAILURE_EXIT_CODE) !== 0) return undefined
+	const answer = npm_registry.view('pnpm', 'time', 'json')
+	if (answer.exit_code !== 0) return undefined
 
-	return extract_times_json(result.stdout)
+	return extract_times_json(answer.stdout)
 }
 
 function to_resolution(
@@ -179,13 +177,10 @@ function parse_latest_version(stdout: string): string | undefined {
 }
 
 function query_latest_version(): string | undefined {
-	const result = execaSync('pnpm', ['view', 'pnpm', 'version', '--json'], {
-		reject: false,
-		timeout: COMMAND_TIMEOUT_MS,
-	})
-	if ((result.exitCode ?? FAILURE_EXIT_CODE) !== 0) return undefined
+	const answer = npm_registry.view('pnpm', 'version', 'json')
+	if (answer.exit_code !== 0) return undefined
 
-	return parse_latest_version(result.stdout)
+	return parse_latest_version(answer.stdout)
 }
 
 // The target handed to pnpm self-update: an exact registry-resolved version on the pinned major, or
@@ -239,7 +234,7 @@ function run_pnpm_update(target: string): number {
 // match). Runs on every path, not just after a successful bump: a repository that arrives
 // with the two fields already out of step sits in the no-bump steady state forever, so an
 // alignment gated on a bump would never repair it.
-function sync_development_engines(package_json_path: string = PACKAGE_JSON_PATH): void {
+function sync_development_engines(package_json_path: string = PACKAGE_JSON): void {
 	const content = readFileSync(package_json_path, 'utf8')
 	const aligned = package_manager_version.align_development_engines_version(content)
 	if (aligned === content) return
@@ -249,10 +244,7 @@ function sync_development_engines(package_json_path: string = PACKAGE_JSON_PATH)
 }
 
 // Restore the pre-run manifest if self-update fails after changing it.
-function restore_package_json(
-	content: string,
-	package_json_path: string = PACKAGE_JSON_PATH,
-): void {
+function restore_package_json(content: string, package_json_path: string = PACKAGE_JSON): void {
 	writeFileSync(package_json_path, content)
 	console.info('✔ Restored package.json pin (pnpm bump failed)')
 }
@@ -274,20 +266,17 @@ function extract_encoded_integrity(stdout: string): string | undefined {
 }
 
 function query_integrity(target: string): string | undefined {
-	const result = execaSync('pnpm', ['view', target, 'dist.integrity', '--json'], {
-		reject: false,
-		timeout: COMMAND_TIMEOUT_MS,
-	})
-	if ((result.exitCode ?? FAILURE_EXIT_CODE) !== 0) return undefined
+	const answer = npm_registry.view(target, 'dist.integrity', 'json')
+	if (answer.exit_code !== 0) return undefined
 
-	const encoded = extract_encoded_integrity(result.stdout)
+	const encoded = extract_encoded_integrity(answer.stdout)
 	if (encoded === undefined) return undefined
 
 	return decode_integrity(encoded)
 }
 
 function restore_integrity(target: string, integrity: string): void {
-	const content = readFileSync(PACKAGE_JSON_PATH, 'utf8')
+	const content = readFileSync(PACKAGE_JSON, 'utf8')
 	const version = target.slice(TARGET_PREFIX.length)
 	const expected = `pnpm@${version}`
 	const current = PACKAGE_MANAGER_VALUE_RE.exec(content)?.[0]
@@ -303,10 +292,7 @@ function restore_integrity(target: string, integrity: string): void {
 		},
 	)
 
-	writeFileSync(
-		PACKAGE_JSON_PATH,
-		package_manager_version.align_development_engines_version(pinned),
-	)
+	writeFileSync(PACKAGE_JSON, package_manager_version.align_development_engines_version(pinned))
 }
 
 // The equal case is the steady state of every up-to-date run, so it logs as success; only
@@ -342,7 +328,7 @@ function pin_unpinned_manifest(original: string, target: string, integrity: stri
 	)
 
 	writeFileSync(
-		PACKAGE_JSON_PATH,
+		PACKAGE_JSON,
 		package_manager_version.align_development_engines_version(`${pinned}\n`),
 	)
 
@@ -403,10 +389,11 @@ function bump_to_registry_target(original: string, major: string | undefined): n
 }
 
 function main(): number {
-	const original = readFileSync(PACKAGE_JSON_PATH, 'utf8')
+	const original = readFileSync(PACKAGE_JSON, 'utf8')
 	const status = bump_to_registry_target(original, extract_pnpm_major(original))
 
 	sync_development_engines()
+	development_engines_verdict.report()
 
 	return status
 }

package/scripts/version/latest-if-required-cli.ts

@@ -0,0 +1,93 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { git_stash } from '#scripts/git/stash/git-stash'
+import { stash_pop_cli } from '#scripts/git/stash/stash-pop-cli'
+import { stash_push_cli } from '#scripts/git/stash/stash-push-cli'
+import { resolve_spawn_exit } from '#scripts/lib/spawn-exit'
+import { execaSync } from 'execa'
+import { latest_scope_cli } from './latest-scope-cli'
+
+// `josh latest:if-required` — the dependency update a run owes, in one call.
+//
+// `latest:scope` decides; on `required` the tree is set aside, `josh latest` runs, and the stash is
+// popped by its message. Four procedures used to spell that sequence out, and each copy was one more
+// place to drift from the others. `josh latest` itself stays a fixed `sh -c` chain that takes no
+// arguments, so the conditional form is its own command rather than a flag on it.
+//
+// **Every failure leaves the stash where it is.** A failed update can leave `package.json` half
+// rewritten, and a conflicted pop is a stash git keeps — popping onto either would bury the work
+// under conflicts, so the command stops with the message to pop it by.
+
+const ARGV_OFFSET = 2
+const USAGE = 'Usage: josh latest:if-required'
+const STASH_MESSAGE = 'josh latest'
+const LATEST_COMMAND: ReadonlyArray<string> = ['josh', 'latest']
+const PNPM = 'pnpm'
+const SUCCESS_EXIT_CODE = 0
+const FAILURE_EXIT_CODE = 1
+const KEPT_STASH_HINT = `the stash is kept — pop it with \`pnpm josh stash:pop "${STASH_MESSAGE}"\``
+// A conflicted pop has already applied the stash, so popping it again would apply it twice.
+const CONFLICTED_STASH_HINT = `the stash "${STASH_MESSAGE}" is applied and still kept — resolve the conflicts, then drop it`
+
+function run_latest(): number {
+	const result = execaSync(PNPM, LATEST_COMMAND, { stdio: 'inherit', reject: false })
+
+	return resolve_spawn_exit(PNPM, result)
+}
+
+function stop(reason: string): number {
+	console.error(`latest:if-required stopped: ${reason}`)
+
+	return FAILURE_EXIT_CODE
+}
+
+function refuse(): number {
+	console.error(USAGE)
+
+	return FAILURE_EXIT_CODE
+}
+
+async function restore(): Promise<number> {
+	const code = await stash_pop_cli.run([STASH_MESSAGE])
+
+	if (code !== SUCCESS_EXIT_CODE) return stop(`the pop failed — ${KEPT_STASH_HINT}`)
+	if (await git_stash.has_conflict()) return stop(`the pop conflicted — ${CONFLICTED_STASH_HINT}`)
+
+	return SUCCESS_EXIT_CODE
+}
+
+async function update(): Promise<number> {
+	const verdict = await stash_push_cli.set_aside({ message: STASH_MESSAGE, dir: undefined })
+	const is_stashed = verdict === stash_push_cli.STASHED_VERDICT
+	const code = run_latest()
+
+	if (code !== SUCCESS_EXIT_CODE) {
+		return stop(is_stashed ? `josh latest failed — ${KEPT_STASH_HINT}` : 'josh latest failed')
+	}
+
+	return is_stashed ? await restore() : SUCCESS_EXIT_CODE
+}
+
+// The scope on stdout and its reason on stderr, the split `latest:scope` prints in, so the log
+// says why the update ran or did not.
+async function run(argv: ReadonlyArray<string>): Promise<number> {
+	if (argv.length > 0) return refuse()
+
+	const decision = latest_scope_cli.scope_decision()
+
+	console.info(decision.scope)
+	console.error(decision.reason)
+	if (decision.scope === latest_scope_cli.SKIPPED_SCOPE) return SUCCESS_EXIT_CODE
+
+	return await update()
+}
+
+async function main(argv: ReadonlyArray<string>): Promise<void> {
+	process.exitCode = await run(argv)
+}
+
+const latest_if_required_cli = { run, STASH_MESSAGE }
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
+
+export { latest_if_required_cli }

package/scripts/version/latest-lane-guard-main.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { latest_lane_guard } from './latest-lane-guard'
+
+// The `josh latest:guard` entry, kept apart from `latest-lane-guard.ts` because `latest:scope` imports
+// that one: a bundle is one file, so a main guard there would fire for every command that carries it
+// (joshuafolkken/kit#4186). The guard takes no arguments and sets its own exit code.
+if (process.argv[1] === fileURLToPath(import.meta.url)) latest_lane_guard.main()

package/scripts/version/latest-lane-guard.ts

@@ -1,5 +1,3 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
 import { lane_paths, type LaneEnvironment } from '#scripts/lane/lane-paths'
 
 // Refuse a dependency update inside a lane.
@@ -44,6 +42,4 @@ const latest_lane_guard = {
 	main,
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) main()
-
 export { latest_lane_guard }

package/scripts/version/latest-scope-cli.ts

@@ -1,5 +1,3 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
 import { latest_lane_guard } from './latest-lane-guard'
 import { latest_stamp, type LatestStamp } from './latest-stamp'
 
@@ -14,7 +12,6 @@ import { latest_stamp, type LatestStamp } from './latest-stamp'
 // paths*, and this decides from *when the last run happened*. The flag parsing and the printing are the small half;
 // the read of the diff is what that module exists for, and this command never makes one.
 
-const ARGV_OFFSET = 2
 const USAGE = 'Usage: josh latest:scope [--record] [--json]'
 const JSON_KEY = 'scope'
 const JSON_FLAG = '--json'
@@ -124,10 +121,6 @@ function run(argv: ReadonlyArray<string>): number {
 	return 0
 }
 
-function main(argv: ReadonlyArray<string>): void {
-	process.exitCode = run(argv)
-}
-
 const latest_scope_cli = {
 	decide,
 	JSON_KEY,
@@ -140,6 +133,4 @@ const latest_scope_cli = {
 	USAGE,
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(ARGV_OFFSET))
-
 export { latest_scope_cli }

package/scripts/version/latest-scope-main.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { latest_scope_cli } from './latest-scope-cli'
+
+// The `josh latest:scope` entry, kept apart from `latest-scope-cli.ts` because other modules import
+// that one: a bundle is one file, so a main guard there would fire for every command that carries it
+// (joshuafolkken/kit#4186).
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+	const ARGV_OFFSET = 2
+
+	process.exitCode = latest_scope_cli.run(process.argv.slice(ARGV_OFFSET))
+}

package/scripts/version/latest-update.ts

@@ -6,6 +6,7 @@
  */
 import { readFileSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
+import { PACKAGE_JSON } from '#scripts/lib/package-manifest'
 import { file_reader } from '#scripts/lib/read-file'
 import { lockfile_overrides } from '#scripts/overrides/lockfile-overrides'
 import { overrides_files } from '#scripts/overrides/overrides-files'
@@ -16,7 +17,6 @@ import { latest_regression, type VersionRegression } from './latest-regression'
 import { playwright_browsers } from './playwright-browsers'
 import { safe_chain_version_update } from './safe-chain-version-update'
 
-const PACKAGE_JSON_PATH = 'package.json'
 const LOCKFILE_PATH = 'pnpm-lock.yaml'
 
 interface TreeSnapshot {
@@ -44,7 +44,7 @@ function run_update_stages(stages: Array<Array<string>>): number {
 
 function take_snapshot(): TreeSnapshot {
 	return {
-		package_json: readFileSync(PACKAGE_JSON_PATH, 'utf8'),
+		package_json: readFileSync(PACKAGE_JSON, 'utf8'),
 		lockfile: file_reader.read_file_or_empty(LOCKFILE_PATH),
 	}
 }
@@ -54,7 +54,7 @@ function take_snapshot(): TreeSnapshot {
 // "the latest release is <older>". The captured lockfile still carries the resolved URL and
 // integrity, which installs fine.
 function restore_snapshot(snapshot: TreeSnapshot): void {
-	writeFileSync(PACKAGE_JSON_PATH, snapshot.package_json)
+	writeFileSync(PACKAGE_JSON, snapshot.package_json)
 	if (snapshot.lockfile.length > 0) writeFileSync(LOCKFILE_PATH, snapshot.lockfile)
 }
 
@@ -71,7 +71,7 @@ function report_kept_back(regressions: ReadonlyArray<VersionRegression>): void {
 const PNPM_UPDATE_ALL_TIERS = ['pnpm', 'update']
 
 function build_update_commands(): Array<Array<string>> {
-	const content = readFileSync(PACKAGE_JSON_PATH, 'utf8')
+	const content = readFileSync(PACKAGE_JSON, 'utf8')
 	const latest = overrides_check.build_update_command(
 		overrides_files.read_current_overrides(),
 		content,
@@ -87,7 +87,7 @@ interface UpdateOutcome {
 }
 
 function find_regressions_after_update(snapshot: TreeSnapshot): Array<VersionRegression> {
-	const after = readFileSync(PACKAGE_JSON_PATH, 'utf8')
+	const after = readFileSync(PACKAGE_JSON, 'utf8')
 
 	return latest_regression.find_regressions(snapshot.package_json, after)
 }

package/scripts/version/npm-registry.ts

@@ -1,6 +1,5 @@
 import { json_value } from '#scripts/lib/json-value'
-import { FETCH_TIMEOUT_MS } from '#scripts/lib/timeouts'
-import { migrate_logic } from '#scripts/registry-migration/migrate-logic'
+import { COMMAND_TIMEOUT_MS, FETCH_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execaSync } from 'execa'
 import semver from 'semver'
 import { z } from 'zod'
@@ -18,8 +17,19 @@ const SCOPE_SEPARATOR = '/'
 const ENCODED_SCOPE_SEPARATOR = '%2f'
 const SCOPE_PATTERN = /^@[^/]+(?=\/)/u
 const SCOPE_REGISTRY_SUFFIX = ':registry'
+const GITHUB_REGISTRY_HOST = 'npm.pkg.github.com'
+const PNPM = 'pnpm'
+const JSON_FLAG = '--json'
+const FAILURE_EXIT_CODE = 1
 const github_scopes = new Map<string, boolean>()
 
+type ViewFormat = 'json' | 'text'
+
+interface ViewAnswer {
+	exit_code: number
+	stdout: string
+}
+
 // The version commands are synchronous end to end and exported that way to consumers, so the
 // request runs in a child Node process rather than turning the whole chain async. Node's own
 // `fetch` needs no external binary, and a non-2xx answer exits non-zero so it reads as "no answer".
@@ -53,19 +63,30 @@ function read_packument(package_name: string, accept: string): unknown {
 	return json_value.parse_or_undefined(result.stdout)
 }
 
-// Whether this checkout installs the package's scope from GitHub Packages, read with the same
-// `pnpm config get` `josh registry:migrate` uses (project `.npmrc` over user `~/.npmrc`). The two
+// The host is compared, not searched for, so a registry carrying it only in its path is not GitHub.
+function is_github_registry(value: string): boolean {
+	try {
+		const url = new URL(value)
+
+		return url.protocol === 'https:' && url.hostname === GITHUB_REGISTRY_HOST
+	} catch {
+		return false
+	}
+}
+
+// Whether this checkout installs the package's scope from GitHub Packages, read with
+// `pnpm config get` (project `.npmrc` over user `~/.npmrc`). The two
 // registries are published by parallel jobs and can drift, so a consumer routed to GitHub Packages
 // keeps reading it: public npm could otherwise offer a release its registry does not carry yet.
 // Memoized per scope — kit and app-kit share one, and one report asks for both packages.
 function is_github_scope(scope: string): boolean {
 	const is_cached_github = github_scopes.get(scope)
 	if (is_cached_github !== undefined) return is_cached_github
-	const result = execaSync('pnpm', ['config', 'get', `${scope}${SCOPE_REGISTRY_SUFFIX}`], {
+	const result = execaSync(PNPM, ['config', 'get', `${scope}${SCOPE_REGISTRY_SUFFIX}`], {
 		reject: false,
 		timeout: FETCH_TIMEOUT_MS,
 	})
-	const is_github = result.exitCode === 0 && migrate_logic.is_github_tarball(result.stdout.trim())
+	const is_github = result.exitCode === 0 && is_github_registry(result.stdout.trim())
 
 	github_scopes.set(scope, is_github)
 
@@ -106,6 +127,21 @@ function has_public_version(package_name: string, version: string): boolean {
 	return parsed.success && parsed.data.time[version] !== undefined
 }
 
+// A `pnpm view` answer, for a question that has to see what the package manager sees: the
+// checkout's own registry routing, and safe-chain's minimum-age filter when it is shimmed on PATH.
+// `pnpm` rather than `npm`, because npm refuses to run at all inside a project whose
+// `devEngines.packageManager` names pnpm with an `onFail` other than `"warn"` / `"ignore"` (kit
+// ships `"download"`), failing with EBADDEVENGINES instead of answering.
+function view(spec: string, field: string, format: ViewFormat = 'text'): ViewAnswer {
+	const format_arguments = format === 'json' ? [JSON_FLAG] : []
+	const result = execaSync(PNPM, ['view', spec, field, ...format_arguments], {
+		reject: false,
+		timeout: COMMAND_TIMEOUT_MS,
+	})
+
+	return { exit_code: result.exitCode ?? FAILURE_EXIT_CODE, stdout: result.stdout }
+}
+
 // The version itself, or nothing when it is not exactly a semver version.
 function valid_version(value: string): string | undefined {
 	return version_schema.safeParse(value).success ? value : undefined
@@ -117,6 +153,8 @@ const npm_registry = {
 	read_latest,
 	read_release_times,
 	valid_version,
+	view,
 }
 
 export { npm_registry }
+export type { ViewAnswer }

package/scripts/version/publishable-range-check.ts

@@ -9,8 +9,8 @@ import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { adopt_toolkits } from '#scripts/adopt/adopt-toolkits'
-import { COMMAND_TIMEOUT_MS } from '#scripts/lib/timeouts'
-import { execaSync } from 'execa'
+import { PACKAGE_JSON } from '#scripts/lib/package-manifest'
+import { npm_registry } from './npm-registry'
 import { peer_floor } from './peer-floor'
 import {
 	publishable_range,
@@ -19,7 +19,6 @@ import {
 	type RangeProbe,
 } from './publishable-range'
 
-const PACKAGE_JSON_PATH = 'package.json'
 const FAILURE_EXIT_CODE = 1
 const NODE_MODULES = 'node_modules'
 
@@ -27,18 +26,8 @@ const NODE_MODULES = 'node_modules'
 // managers on PATH, so the answer comes back already filtered by the same minimum-age policy a
 // consumer installs under. A plain fetch would read the unfiltered registry and pass a range no
 // consumer can resolve — the exact blind spot this guard exists to close.
-//
-// `pnpm view` rather than `npm view` because npm refuses to run at all inside a project whose
-// `devEngines.packageManager` names pnpm with an `onFail` other than `"warn"` / `"ignore"` (kit
-// ships `"download"`, which npm refuses on just the same), failing every probe with
-// EBADDEVENGINES instead of answering. Both are shimmed, so the filtered view is preserved.
 function probe_range(name: string, range: string): ProbeResult {
-	const result = execaSync('pnpm', ['view', `${name}@${range}`, 'version'], {
-		reject: false,
-		timeout: COMMAND_TIMEOUT_MS,
-	})
-
-	return { exit_code: result.exitCode ?? FAILURE_EXIT_CODE, stdout: result.stdout }
+	return npm_registry.view(`${name}@${range}`, 'version')
 }
 
 function report(violations: ReadonlyArray<PublishedRange>, total: number): number {
@@ -90,14 +79,14 @@ function check_peer_floors(
 function read_installed_toolkit_manifests(project_root: string): Array<string> {
 	return adopt_toolkits
 		.all_declared_toolkits(project_root)
-		.map((package_name) => path.join(project_root, NODE_MODULES, package_name, PACKAGE_JSON_PATH))
+		.map((package_name) => path.join(project_root, NODE_MODULES, package_name, PACKAGE_JSON))
 		.filter((manifest_path) => existsSync(manifest_path))
 		.map((manifest_path) => readFileSync(manifest_path, 'utf8'))
 }
 
 // Both checks always run, so one invocation reports everything there is to fix.
 function main(): void {
-	const package_json_content = readFileSync(PACKAGE_JSON_PATH, 'utf8')
+	const package_json_content = readFileSync(PACKAGE_JSON, 'utf8')
 	const range_exit_code = check(package_json_content, probe_range)
 	const toolkit_json_contents = read_installed_toolkit_manifests(process.cwd())
 	const peer_exit_code = check_peer_floors(package_json_content, toolkit_json_contents)