@joshuafolkken/kit 1.3041.0 → 1.3092.0

package/scripts/test/test-related-imports.ts

@@ -0,0 +1,92 @@
+import { readFileSync } from 'node:fs'
+import path from 'node:path'
+import { change_base } from '#scripts/git/change-base'
+import { git_spawn } from '#scripts/git/git-spawn'
+import type ts from 'typescript'
+
+type TypeScript = typeof ts
+
+interface Comparison {
+	base: string
+	typescript: TypeScript
+}
+
+// A new import can break an indirect test's mock while every direct importer passes (#7453).
+// Only unchanged import declarations and targets may use the direct-only cap. Unknown history keeps reach.
+function is_loading(typescript: TypeScript, node: ts.Node, source: ts.SourceFile): boolean {
+	if (!typescript.isCallExpression(node)) return false
+
+	return (
+		node.expression.kind === typescript.SyntaxKind.ImportKeyword ||
+		node.expression.getText(source) === 'require'
+	)
+}
+
+function signature(typescript: TypeScript, file: string, content: string): string {
+	const source = typescript.createSourceFile(file, content, typescript.ScriptTarget.Latest)
+	const declarations: Array<string> = []
+
+	function visit(node: ts.Node): void {
+		if (
+			typescript.isImportDeclaration(node) ||
+			typescript.isExportDeclaration(node) ||
+			is_loading(typescript, node, source)
+		) {
+			declarations.push(node.getText(source))
+		}
+
+		typescript.forEachChild(node, visit)
+	}
+
+	visit(source)
+
+	return JSON.stringify(declarations)
+}
+
+async function is_stable(root: string, file: string, comparison: Comparison): Promise<boolean> {
+	if (path.extname(file) === '.svelte') return false
+
+	try {
+		const before = await git_spawn.read(['-C', root, 'show', `${comparison.base}:${file}`])
+		const current = readFileSync(path.join(root, file), 'utf8')
+
+		return (
+			signature(comparison.typescript, file, before) ===
+			signature(comparison.typescript, file, current)
+		)
+	} catch {
+		return false
+	}
+}
+
+async function compare(root: string, files: ReadonlyArray<string>): Promise<Array<boolean>> {
+	try {
+		const base = await change_base.resolved_through_merge()
+		if (base === undefined) return files.map(() => false)
+		const { default: typescript } = await import('typescript')
+
+		return await Promise.all(
+			files.map(async (file) => await is_stable(root, file, { base, typescript })),
+		)
+	} catch {
+		return files.map(() => false)
+	}
+}
+
+async function stable_files(root: string, files: ReadonlyArray<string>): Promise<Array<string>> {
+	if (files.length === 0) return []
+	const stable = await compare(root, files)
+	const retained = files.filter((_file, index) => stable[index] !== true)
+
+	if (retained.length > 0) {
+		process.stdout.write(
+			`josh test:related: keeping full reach (imports changed or unknown): ${retained.join(', ')}\n`,
+		)
+	}
+
+	return files.filter((_file, index) => stable[index] === true)
+}
+
+const test_related_imports = { stable_files }
+
+export { test_related_imports }

package/scripts/test/vitest-failure-summary.ts

@@ -16,6 +16,8 @@ const UNIT_LOG_PREFIX = 'josh-unit-log-'
 const UNIT_LOG_HEADER = 'vitest'
 const FAILED_LINE = /^FAIL\s+(?<name>\S.*)$/u
 const FAILED_HEADING = 'failed tests:'
+const IMPORT_FAILURE =
+	/^(?:Error|SyntaxError): (?:\[vitest\] No "[^"\r\n]+" export is defined on the "[^"\r\n]+" mock\.|The requested module '[^'\r\n]+' does not provide an export named|Cannot find (?:module|package) |Failed to resolve import )[^\r\n]*$/mu
 const NONE_NAMED = '  (none named in the output — read the full output)'
 const NONE_NAMED_VERDICT = 'none named'
 // A name is `<file> > <suite> > <test>` or `<file> [ <file> ]`, prefixed `|<project>| ` in a workspace —
@@ -46,6 +48,10 @@ function failed_tests(output: string): ReadonlyArray<string> {
 	return [...new Set(names.filter((name) => name !== undefined))]
 }
 
+function import_failure(output: string): string | undefined {
+	return IMPORT_FAILURE.exec(stripVTControlCharacters(output))?.[0]
+}
+
 // The files the failed names belong to, each once — what to run after a fix, before the whole related
 // set again (joshuafolkken/kit#5023).
 function failed_files(names: ReadonlyArray<string>): ReadonlyArray<string> {
@@ -103,6 +109,7 @@ const vitest_failure_summary = {
 	RERUN_PREFIX,
 	failed_files,
 	failed_tests,
+	import_failure,
 	format_failure_summary,
 	report,
 	unit_log_path,

package/scripts/version/npm-registry.ts

@@ -4,12 +4,14 @@ import { COMMAND_TIMEOUT_MS, FETCH_TIMEOUT_MS } from '#scripts/lib/timeouts'
 import { execaSync } from 'execa'
 import semver from 'semver'
 import { z } from 'zod'
+import { KIT_PACKAGE_NAME } from './kit-descriptor'
 import { release_age } from './release-age'
 
 // The public npm registry, read without credentials so a consumer who installed from public npm
 // can see the latest release without a `read:packages` GitHub token. The
-// GitHub Packages versions API stays the source for a scope routed there, and the fallback for a
-// package public npm does not carry.
+// GitHub Packages versions API stays the source for other packages whose scope is routed there.
+// Kit always checks npm; version-remote retains GitHub as a diagnostic/legacy lookup fallback,
+// while kit upgrades still require npm publication and never switch acquisition back to GitHub.
 const PUBLIC_REGISTRY = 'https://registry.npmjs.org'
 // The abbreviated packument carries `dist-tags` without every version's full manifest.
 const ABBREVIATED_ACCEPT = 'application/vnd.npm.install-v1+json'
@@ -37,7 +39,7 @@ interface ViewAnswer {
 const FETCH_SCRIPT = [
 	'const [url, accept] = process.argv.slice(1)',
 	'const response = await fetch(url, { headers: { accept } })',
-	'if (!response.ok) process.exit(1)',
+	'if (!response.ok) { console.error(`HTTP ${response.status}`); process.exit(1) }',
 	'process.stdout.write(await response.text())',
 ].join('\n')
 
@@ -45,6 +47,11 @@ const FETCH_SCRIPT = [
 // install command, so `1.0.0;curl…|sh` or any other text is refused at the source, not downstream.
 const version_schema = z.string().refine((value) => semver.valid(value) === value)
 const latest_schema = z.looseObject({ 'dist-tags': z.looseObject({ latest: version_schema }) })
+const public_version_schema = z.looseObject({
+	name: z.string(),
+	version: version_schema,
+	dist: z.looseObject({ tarball: z.url(), integrity: z.string() }),
+})
 const times_schema = z.looseObject({ time: release_age.release_times_schema })
 const name_schema = z.looseObject({ name: z.string().optional() })
 const PUBLISHING_SCOPE = '@joshuafolkken/'
@@ -55,13 +62,27 @@ function packument_url(package_name: string): string {
 	return `${PUBLIC_REGISTRY}/${package_name.replace(SCOPE_SEPARATOR, () => ENCODED_SCOPE_SEPARATOR)}`
 }
 
-function read_packument(package_name: string, accept: string): unknown {
+function read_packument(
+	package_name: string,
+	accept: string,
+	should_require = false,
+	version?: string,
+): unknown {
+	const base = packument_url(package_name)
+	const url = version === undefined ? base : `${base}/${version}`
 	const result = execaSync(
 		process.execPath,
-		['--input-type=module', '-e', FETCH_SCRIPT, packument_url(package_name), accept],
+		['--input-type=module', '-e', FETCH_SCRIPT, url, accept],
 		{ reject: false, timeout: FETCH_TIMEOUT_MS },
 	)
-	if (result.exitCode !== 0) return undefined
+
+	if (result.exitCode !== 0) {
+		if (should_require) {
+			throw new Error(`Public npm request failed: ${package_name}: ${result.stderr}`)
+		}
+
+		return undefined
+	}
 
 	return json_value.parse_or_undefined(result.stdout)
 }
@@ -81,7 +102,7 @@ function is_github_registry(value: string): boolean {
 // `pnpm config get` (project `.npmrc` over user `~/.npmrc`). The two
 // registries are published by parallel jobs and can drift, so a consumer routed to GitHub Packages
 // keeps reading it: public npm could otherwise offer a release its registry does not carry yet.
-// Memoized per scope — kit and app-kit share one, and one report asks for both packages.
+// Memoized per scope for the generic consumers; kit bypasses this legacy registry routing.
 function is_github_scope(scope: string): boolean {
 	const is_cached_github = github_scopes.get(scope)
 	if (is_cached_github !== undefined) return is_cached_github
@@ -97,6 +118,7 @@ function is_github_scope(scope: string): boolean {
 }
 
 function is_public_source(package_name: string): boolean {
+	if (package_name === KIT_PACKAGE_NAME) return true
 	const scope = SCOPE_PATTERN.exec(package_name)?.[0]
 
 	return scope === undefined || !is_github_scope(scope)
@@ -130,6 +152,21 @@ function has_public_version(package_name: string, version: string): boolean {
 	return parsed.success && parsed.data.time[version] !== undefined
 }
 
+// The destination artifact, regardless of the checkout's old scope registry mapping.
+function read_public_version(
+	package_name: string,
+	version: string,
+): z.infer<typeof public_version_schema> | undefined {
+	if (!version_schema.safeParse(version).success) return undefined
+	const selected = public_version_schema.safeParse(
+		read_packument(package_name, FULL_ACCEPT, true, version),
+	)
+	if (!selected.success) return undefined
+	const entry = selected.data
+
+	return entry.name === package_name && entry.version === version ? entry : undefined
+}
+
 // **The one answer to "does this repository publish to npm"**: its package name when public npm
 // already carries it under kit's scope, otherwise nothing. Neither GitHub visibility nor `private`
 // decides it — a forgotten `private: true` must not turn publishing on — and the scope keeps a
@@ -170,6 +207,7 @@ const npm_registry = {
 	packument_url,
 	published_package_name,
 	read_latest,
+	read_public_version,
 	read_release_times,
 	valid_version,
 	view,

package/scripts/version/upgrade-shell-command.ts

@@ -1,3 +1,8 @@
+import path from 'node:path'
+import { PACKAGE_DIR } from '#scripts/init/init-paths'
+import { shell_quote } from '#scripts/lib/shell-quote'
+import { npm_acquisition } from '#scripts/registry-migration/npm-acquisition'
+import { KIT_PACKAGE_NAME } from './kit-descriptor'
 import type { PackageVersionConfig } from './version-command-config'
 
 // One upgrade the version commands offer and run: `text` is the line printed after `Run:`, and
@@ -20,7 +25,18 @@ function update_argv(
 	is_local: boolean,
 	config: PackageVersionConfig,
 ): Array<string> {
-	return ['pnpm', 'add', update_scope_flag(is_local), `${config.package_name}@${latest}`]
+	const registry =
+		!is_local && config.package_name === KIT_PACKAGE_NAME
+			? ['--config.@joshuafolkken:registry=https://registry.npmjs.org/']
+			: []
+
+	return [
+		'pnpm',
+		'add',
+		update_scope_flag(is_local),
+		...registry,
+		`${config.package_name}@${latest}`,
+	]
 }
 
 // The bare `pnpm add` invocation that installs one package at an exact version, in the global or the
@@ -33,6 +49,11 @@ function format_update_command(
 	return update_argv(latest, is_local, config).join(' ')
 }
 
+function needs_migration(is_local: boolean, package_name: string, root: string): boolean {
+	return is_local && package_name === KIT_PACKAGE_NAME && !npm_acquisition.is_project_npm(root)
+}
+
+// A kit project before migration first verifies the whole scope through the transactional entry.
 // The upgrade for one target. A project-scope install is followed by kit's lockfile repair
 // (`fix-gh-packages`), which a global install does not need. The printed text is derived from the
 // steps, so the hint and what actually runs cannot drift apart.
@@ -40,11 +61,22 @@ function build_upgrade_command(
 	latest: string,
 	is_local: boolean,
 	config: PackageVersionConfig,
+	root: string = process.cwd(),
 ): UpgradeCommand {
 	const steps = [update_argv(latest, is_local, config)]
+
+	if (needs_migration(is_local, config.package_name, root)) {
+		steps.unshift(['node', path.join(PACKAGE_DIR, 'dist/registry-migrate.mjs'), latest])
+	}
+
 	if (is_local) steps.push(['node_modules/.bin/tsx', config.fix_gh_packages_path])
 
-	return { text: steps.map((step) => step.join(' ')).join(STEP_SEPARATOR), steps }
+	return {
+		text: steps
+			.map((step) => step.map((argument) => shell_quote.word(argument)).join(' '))
+			.join(STEP_SEPARATOR),
+		steps,
+	}
 }
 
 // The consumer's own configured command — `pnpm add -g …`, or a chain with `&&` — is inside the trust

package/templates/workflows/ci.yml

@@ -128,9 +128,6 @@ jobs:
         id: setup-node
         uses: ./.github/actions/setup-node
 
-      - name: Configure GitHub Packages authentication for existing projects
-        run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
-
       - name: Setup ESLint cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: eslint-cache
@@ -172,8 +169,6 @@ jobs:
 
       - name: Setup pnpm and install dependencies
         uses: ./.github/actions/setup-pnpm
-        with:
-          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # A `basic` project has no `prepare`, no build and no SvelteKit, so the ordered steps below
       # would fail on its first pull request (joshuafolkken/kit#2814). The profile is read from
@@ -274,13 +269,8 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
 
-      - name: Configure GitHub Packages authentication for existing projects
-        run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
-
       - name: Setup pnpm and install dependencies
         uses: ./.github/actions/setup-pnpm
-        with:
-          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Scan the changed files for secrets
         id: scan
@@ -425,9 +415,6 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
 
-      - name: Configure GitHub Packages authentication for existing projects
-        run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
-
       - name: Setup build cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: build-cache
@@ -441,8 +428,6 @@ jobs:
 
       - name: Setup pnpm and install dependencies
         uses: ./.github/actions/setup-pnpm
-        with:
-          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
 
       # --ignore-scripts suppresses the install-time `prepare`, so generated framework
       # files never appear. Playwright >= 1.62 hard-throws when a tsconfig `extends`

package/templates/workflows/github-release.yml

@@ -55,15 +55,10 @@ jobs:
         if: steps.release.outputs.tag != ''
         uses: ./.github/actions/setup-node
 
-      - name: Configure GitHub Packages authentication for existing projects
-        if: steps.release.outputs.tag != ''
-        run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
-
       - name: Setup pnpm and install dependencies
         if: steps.release.outputs.tag != ''
         uses: ./.github/actions/setup-pnpm
         with:
-          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
           cache: 'false'
 
       - name: Publish GitHub Release