@joshuafolkken/kit 1.3044.0 → 1.3092.0

package/scripts/registry-migration/migrate-lock.ts

@@ -0,0 +1,147 @@
+import path from 'node:path'
+import { isDeepStrictEqual } from 'node:util'
+import { fix_gh_packages_logic } from '#scripts/gh/fix-gh-packages-logic'
+import { yaml_document } from '#scripts/lib/yaml-document'
+import { dump } from 'js-yaml'
+
+const SCOPE = '@joshuafolkken/'
+const KIT = `${SCOPE}kit`
+const REGISTRY = 'https://registry.npmjs.org/'
+const PNPM_VERSION = '12.17.0'
+
+interface LockedArtifact {
+	name: string
+	version: string
+	integrity: string | undefined
+}
+
+function scoped_artifacts(content: string): Array<LockedArtifact> {
+	return Object.entries(fix_gh_packages_logic.parse_lockfile_packages(content))
+		.filter(([key]) => key.startsWith(SCOPE))
+		.map(([key, entry]) => ({
+			name: fix_gh_packages_logic.package_path_from_key(key),
+			version: fix_gh_packages_logic.package_version_from_key(key),
+			integrity: entry.resolution?.integrity,
+		}))
+}
+
+function importer_manifests(content: string): Array<string> {
+	return yaml_document
+		.parse_yaml_documents(content)
+		.flatMap((document) =>
+			yaml_document.is_mapping_document(document['importers'])
+				? Object.keys(document['importers'])
+				: [],
+		)
+		.map((importer) => path.join(importer, 'package.json'))
+}
+
+function non_npm_resolution(content: string): string | undefined {
+	const entries = Object.entries(fix_gh_packages_logic.parse_lockfile_packages(content)).filter(
+		([key]) => key.startsWith(SCOPE),
+	)
+
+	for (const [key, entry] of entries) {
+		const tarball = entry.resolution?.tarball
+
+		if (tarball !== undefined && !tarball.startsWith(REGISTRY)) return key
+	}
+
+	return undefined
+}
+
+function has_npm_sources(content: string): boolean {
+	return non_npm_resolution(content) === undefined
+}
+
+function assert_npm_sources(content: string): void {
+	const key = non_npm_resolution(content)
+	if (key !== undefined) throw new Error(`Non-npm resolution remains: ${key}`)
+}
+
+function npmrc(content: string): string {
+	const newline = content.includes('\r\n') ? '\r\n' : '\n'
+	const lines = content
+		.split(/\r?\n/u)
+		.filter((line) => !/^\s*@joshuafolkken:registry\s*=/u.test(line))
+
+	while (lines.at(-1) === '') lines.pop()
+	lines.push(`@joshuafolkken:registry=${REGISTRY}`, '')
+
+	return lines.join(newline)
+}
+
+function strip_tarball(resolution: unknown): void {
+	if (yaml_document.is_mapping_document(resolution)) delete resolution['tarball']
+}
+
+function strip_resolutions(document: Record<string, unknown>): void {
+	if (!yaml_document.is_mapping_document(document['packages'])) return
+	const scoped = Object.entries(document['packages']).filter(([key]) => key.startsWith(SCOPE))
+
+	for (const [, entry] of scoped) {
+		if (yaml_document.is_mapping_document(entry)) strip_tarball(entry['resolution'])
+	}
+}
+
+// Compare every document, importer, snapshot and unrelated resolution. The resolver may only
+// replace this scope's tarball locations; integrity and unrelated metadata must stay unchanged.
+function graph(content: string): Array<Record<string, unknown>> {
+	const documents = yaml_document.parse_yaml_documents(content)
+
+	for (const document of documents) strip_resolutions(document)
+
+	return documents
+}
+
+function assert_preserved(before: string, after: string): void {
+	if (before === '') return
+
+	if (!isDeepStrictEqual(graph(before), graph(after))) {
+		throw new Error(
+			'Resolution changed the dependency graph or unrelated metadata; no files changed',
+		)
+	}
+}
+
+// --ignore-pnpmfile omits this checksum. Restore only a missing value before the full
+// comparison, so changed checksums and all unrelated metadata still fail validation.
+function restore_checksum(
+	original: Record<string, unknown>,
+	resolved: Record<string, unknown>,
+): boolean {
+	const checksum = original['pnpmfileChecksum']
+	if (checksum === undefined || resolved['pnpmfileChecksum'] !== undefined) return false
+	resolved['pnpmfileChecksum'] = checksum
+
+	return true
+}
+
+function restore_pnpmfile_checksum(before: string, after: string): string {
+	const originals = yaml_document.parse_yaml_documents(before)
+	const resolved = yaml_document.parse_yaml_documents(after)
+	const restored = resolved.map((document, index) =>
+		restore_checksum(originals[index] ?? {}, document),
+	)
+	const prefix = after.startsWith('---') ? '---\n' : ''
+
+	return restored.includes(true)
+		? prefix + resolved.map((document) => dump(document)).join('---\n')
+		: after
+}
+
+const migrate_lock = {
+	SCOPE,
+	KIT,
+	REGISTRY,
+	PNPM_VERSION,
+	scoped_artifacts,
+	npmrc,
+	assert_preserved,
+	restore_pnpmfile_checksum,
+	assert_npm_sources,
+	has_npm_sources,
+	importer_manifests,
+}
+export { migrate_lock }
+export type { LockedArtifact }

package/scripts/registry-migration/migrate.ts

@@ -0,0 +1,235 @@
+import { createHash } from 'node:crypto'
+import { existsSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { error_text } from '#scripts/lib/error-message'
+import { timed_fetch } from '#scripts/lib/timed-fetch'
+import { COMMAND_TIMEOUT_MS } from '#scripts/lib/timeouts'
+import { npm_registry } from '#scripts/version/npm-registry'
+import { execaSync } from 'execa'
+import { migrate_files } from './migrate-files'
+import { migrate_lock, type LockedArtifact } from './migrate-lock'
+
+interface PublicArtifact {
+	name: string
+	version: string
+	dist: { tarball: string; integrity: string }
+}
+
+interface MigrationDependencies {
+	publication: (name: string, version: string) => PublicArtifact | undefined
+	download: (url: string) => Promise<Uint8Array>
+	resolve: (directory: string) => void
+	pnpm_version: () => string
+}
+
+async function download(url: string): Promise<Uint8Array> {
+	if (!url.startsWith(migrate_lock.REGISTRY)) throw new Error(`Non-npm artifact refused: ${url}`)
+	const response = await timed_fetch(url, {
+		redirect: 'error',
+	})
+
+	if (!response.ok) {
+		throw new Error(`npm artifact request failed: ${String(response.status)} ${url}`)
+	}
+
+	return new Uint8Array(await response.arrayBuffer())
+}
+
+function resolve(directory: string): void {
+	execaSync(
+		'pnpm',
+		[
+			'update',
+			'--patches',
+			'--lockfile-only',
+			'--ignore-scripts',
+			'--ignore-pnpmfile',
+			'--lockfile-dir',
+			realpathSync(directory),
+		],
+		{
+			cwd: directory,
+			timeout: COMMAND_TIMEOUT_MS,
+			stdio: 'pipe',
+		},
+	)
+}
+
+function pnpm_version(): string {
+	return execaSync('pnpm', ['--version'], { timeout: COMMAND_TIMEOUT_MS }).stdout.trim()
+}
+
+function assert_lockfile_directory(root: string): void {
+	const directory = execaSync('pnpm', ['config', 'get', 'lockfile-dir'], {
+		cwd: root,
+		timeout: COMMAND_TIMEOUT_MS,
+	}).stdout.trim()
+	if (directory === 'undefined') return
+	const configured = path.resolve(root, directory)
+
+	if (!existsSync(configured) || realpathSync(configured) !== realpathSync(root)) {
+		throw new Error('Nonstandard lockfile directory refused; no files changed')
+	}
+}
+
+const defaults: MigrationDependencies = {
+	publication: npm_registry.read_public_version,
+	download,
+	resolve,
+	pnpm_version,
+}
+const LOCKFILE = 'pnpm-lock.yaml'
+const WORKSPACE = 'pnpm-workspace.yaml'
+const MANIFEST = 'package.json'
+
+function assert_workspace_root(root: string): void {
+	for (
+		let parent = path.dirname(root);
+		parent !== path.dirname(parent);
+		parent = path.dirname(parent)
+	) {
+		if (existsSync(path.join(parent, WORKSPACE))) {
+			throw new Error('Run from the pnpm workspace root; no files changed')
+		}
+	}
+}
+
+function assert_inputs(root: string, staged: string): void {
+	const lock = migrate_files.read(staged, LOCKFILE).content ?? ''
+	const files = new Set([MANIFEST, WORKSPACE, ...migrate_lock.importer_manifests(lock)])
+
+	for (const file of files) {
+		if (migrate_files.read(root, file).content !== migrate_files.read(staged, file).content) {
+			throw new Error(`Resolution input changed: ${file}; no files changed`)
+		}
+	}
+}
+
+function sha512(bytes: Uint8Array): string {
+	return `sha512-${createHash('sha512').update(bytes).digest('base64')}`
+}
+
+async function verify(locked: LockedArtifact, dependencies: MigrationDependencies): Promise<void> {
+	const spec = `${locked.name}@${locked.version}`
+	const publication = dependencies.publication(locked.name, locked.version)
+	if (publication === undefined) throw new Error(`npm publication missing or unreachable: ${spec}`)
+	const integrity = sha512(await dependencies.download(publication.dist.tarball))
+
+	if (integrity !== publication.dist.integrity) {
+		throw new Error(`npm artifact integrity mismatch: ${spec}`)
+	}
+
+	if (locked.integrity !== undefined && integrity !== locked.integrity) {
+		throw new Error(
+			`Artifact differs from locked bytes: ${spec}; independently verify both distributions before migrating`,
+		)
+	}
+}
+
+async function verification_error(
+	artifact: LockedArtifact,
+	dependencies: MigrationDependencies,
+): Promise<string | undefined> {
+	try {
+		await verify(artifact, dependencies)
+
+		return undefined
+	} catch (error) {
+		return `${artifact.name}@${artifact.version}: ${error_text.message_of(error)}`
+	}
+}
+
+async function verify_all(
+	content: string,
+	version: string,
+	dependencies: MigrationDependencies,
+): Promise<void> {
+	const artifacts = migrate_lock.scoped_artifacts(content)
+	const missing = artifacts.find((artifact) => artifact.integrity === undefined)
+
+	if (missing !== undefined) {
+		throw new Error(`Missing locked integrity: ${missing.name}@${missing.version}`)
+	}
+
+	artifacts.push({ name: migrate_lock.KIT, version, integrity: undefined })
+	const results = await Promise.all(
+		artifacts.map(async (artifact) => await verification_error(artifact, dependencies)),
+	)
+	const failures = results.filter((result) => result !== undefined)
+	if (failures.length > 0) throw new Error(failures.join('\n'))
+}
+
+function validate(root: string, version: string, dependencies: MigrationDependencies): void {
+	assert_workspace_root(root)
+
+	if (npm_registry.valid_version(version) === undefined) {
+		throw new Error('Supply an exact target kit version')
+	}
+
+	if (!existsSync(path.join(root, MANIFEST))) {
+		throw new Error('Run from the project root containing package.json')
+	}
+
+	const actual = dependencies.pnpm_version()
+
+	if (actual !== migrate_lock.PNPM_VERSION) {
+		throw new Error(
+			`Verified pnpm version: ${migrate_lock.PNPM_VERSION}; actual: ${actual}; no files changed`,
+		)
+	}
+
+	assert_lockfile_directory(root)
+}
+
+async function prepare(
+	root: string,
+	version: string,
+	dependencies: MigrationDependencies,
+): Promise<void> {
+	const before = migrate_files.read(root, LOCKFILE).content ?? ''
+
+	await verify_all(before, version, dependencies)
+	writeFileSync(
+		path.join(root, '.npmrc'),
+		migrate_lock.npmrc(migrate_files.read(root, '.npmrc').content ?? ''),
+	)
+	dependencies.resolve(root)
+	const after = migrate_lock.restore_pnpmfile_checksum(
+		before,
+		readFileSync(path.join(root, LOCKFILE), 'utf8'),
+	)
+
+	migrate_lock.assert_preserved(before, after)
+	migrate_lock.assert_npm_sources(after)
+	await verify_all(after, version, dependencies)
+	writeFileSync(path.join(root, LOCKFILE), after)
+}
+
+async function migrate(
+	root: string,
+	version: string,
+	is_dry_run = false,
+	dependencies: MigrationDependencies = defaults,
+): Promise<Array<string>> {
+	validate(root, version, dependencies)
+	const originals = migrate_files.snapshot(root)
+	const staged = migrate_files.stage(root)
+
+	try {
+		await prepare(staged, version, dependencies)
+		assert_inputs(root, staged)
+
+		if (is_dry_run) {
+			return originals
+				.filter((file) => migrate_files.read(staged, file.name).content !== file.content)
+				.map((file) => file.name)
+		}
+
+		return migrate_files.commit(root, originals, staged)
+	} finally {
+		rmSync(staged, { recursive: true, force: true })
+	}
+}
+
+export { download, migrate, pnpm_version, resolve, sha512 }
+export type { MigrationDependencies }

package/scripts/registry-migration/npm-acquisition.ts

@@ -0,0 +1,118 @@
+import path from 'node:path'
+import { parse_jsonc } from '#scripts/config-merge/parse-jsonc'
+import { fix_gh_packages_logic } from '#scripts/gh/fix-gh-packages-logic'
+import { init_logic_json_merge } from '#scripts/init/init-logic-json-merge'
+import { file_reader } from '#scripts/lib/read-file'
+import { z } from 'zod'
+import { migrate_lock } from './migrate-lock'
+
+const NPM = 'https://registry.npmjs.org/'
+const SCOPE = '@joshuafolkken'
+const LOCKFILE = 'pnpm-lock.yaml'
+const SCRIPTS = ['prepare', 'postinstall']
+const dependency_schema = z.record(z.string(), z.string()).optional()
+const manifest_schema = z.object({
+	dependencies: dependency_schema,
+	devDependencies: dependency_schema,
+	optionalDependencies: dependency_schema,
+	peerDependencies: dependency_schema,
+})
+const scripts_schema = z.looseObject({ scripts: z.record(z.string(), z.string()).optional() })
+
+function read(root: string, name: string): string {
+	return file_reader.read_file_or_empty(path.join(root, name))
+}
+
+// The migration entry commits this mapping after verifying every scoped artifact. An absent
+// mapping is not evidence of migration: a user's registry may still point at GitHub.
+function is_npm(content: string): boolean {
+	const registry = fix_gh_packages_logic.parse_scope_registries(content).get(SCOPE)
+
+	return registry === NPM || registry === NPM.slice(0, -1)
+}
+
+function is_project_npm(root: string = process.cwd()): boolean {
+	return is_npm(read(root, '.npmrc')) && migrate_lock.has_npm_sources(read(root, LOCKFILE))
+}
+
+function is_npm_only(root: string): boolean {
+	const npmrc = read(root, '.npmrc')
+
+	return is_project_npm(root) && fix_gh_packages_logic.parse_gh_scopes(npmrc).size === 0
+}
+
+function has_scoped_name(dependencies: Record<string, string> | undefined): boolean {
+	return Object.keys(dependencies ?? {}).some((name) => name.startsWith(migrate_lock.SCOPE))
+}
+
+function has_scoped_dependencies(content: string): boolean {
+	const manifest = manifest_schema.parse(parse_jsonc(content || '{}'))
+
+	return Object.values(manifest).some((dependencies) => has_scoped_name(dependencies))
+}
+
+// Existing scoped dependencies require the transactional entry, never a partial sync migration.
+function can_initialize(root: string): boolean {
+	return (
+		read(root, 'pnpm-workspace.yaml') === '' &&
+		!has_scoped_dependencies(read(root, 'package.json')) &&
+		migrate_lock.scoped_artifacts(read(root, LOCKFILE)).length === 0
+	)
+}
+
+function can_manage(root: string): boolean {
+	const content = read(root, '.npmrc')
+
+	return (
+		is_npm(content) ||
+		(!fix_gh_packages_logic.parse_scope_registries(content).has(SCOPE) && can_initialize(root))
+	)
+}
+
+function merge_npmrc(content: string, root: string): string {
+	if (is_npm(content)) return migrate_lock.npmrc(content)
+	if (fix_gh_packages_logic.parse_scope_registries(content).has(SCOPE)) return content
+	if (can_initialize(root)) return migrate_lock.npmrc(content)
+
+	return content
+}
+
+function is_script_value(content: string, key: string, value: string): boolean {
+	return scripts_schema.parse(parse_jsonc(content)).scripts?.[key] === value
+}
+
+function strip_script(content: string, key: string, command: string): string {
+	const script = scripts_schema.parse(parse_jsonc(content)).scripts?.[key]
+	if (script === undefined) return content
+	const suffix = ` && (${command} || true)`
+	if (!script.endsWith(suffix)) return content
+
+	return init_logic_json_merge.replace_in_package_script(
+		content,
+		key,
+		script,
+		script.slice(0, -suffix.length),
+	)
+}
+
+// Only the exact trailing clause kit generated is owned here. Other GitHub scopes still need
+// the public repair API, and custom commands (including mere name matches) stay byte-identical.
+function merge_lifecycle(content: string, root: string, command: string): string {
+	if (!is_npm_only(root)) return content
+
+	let merged = content
+	for (const key of SCRIPTS) merged = strip_script(merged, key, command)
+
+	return merged
+}
+
+const npm_acquisition = {
+	is_npm,
+	is_project_npm,
+	is_npm_only,
+	is_script_value,
+	can_manage,
+	merge_npmrc,
+	merge_lifecycle,
+}
+export { npm_acquisition }

package/scripts/review/review-record-cli.ts

@@ -295,7 +295,6 @@ interface AppendedRound {
 	lines: ReadonlyArray<string>
 	root: string
 	kind: LineKind
-	findings: ReadonlyArray<Finding>
 	date: string
 }
 
@@ -308,25 +307,28 @@ function ledger_lines({ issue, lines, kind, date }: AppendedRound): ReadonlyArra
 
 // A code round goes on to what its tree means for the ship (`review-record-code-round.ts`).
 async function append_round(round: AppendedRound): Promise<number> {
-	const { issue, lines, root, kind, findings } = round
+	const { issue, lines, root } = round
 	const ledger_path = observation_ledger_home.issue_path(issue, root)
 
 	await observation_ledger_home.append(ledger_path, ledger_lines(round))
 	console.info(confirmation(lines.length, ledger_path))
 	await review_comment_carry.carry_from_record(root)
 
-	if (kind === 'code') await review_record_code_round.follow(issue, root, findings)
-
 	return 0
 }
 
+interface WrittenRound {
+	code: number
+	is_ledger: boolean
+}
+
 // A code round recorded after the push goes to the issue unasked (`review-record-comment.ts`).
 async function write_round(
 	parsed: Parsed,
 	request: Request,
 	now: Date,
 	root: string,
-): Promise<number> {
+): Promise<WrittenRound> {
 	const kind = kind_of(parsed)
 	const date = observation_ledger_home.ledger_date(now)
 	const lines = [
@@ -335,13 +337,23 @@ async function write_round(
 	]
 	const { issue, findings } = request
 
-	if (parsed.comment) return await review_record_comment.post(issue, lines)
+	if (parsed.comment) {
+		return { code: await review_record_comment.post(issue, lines), is_ledger: false }
+	}
 
 	if (kind === 'code' && (await review_record_comment.is_after_push())) {
-		return await review_record_comment.post_after_push({ issue, lines, root, findings })
+		const code = await review_record_comment.post_after_push({ issue, lines, root, findings })
+
+		return { code, is_ledger: false }
 	}
 
-	return await append_round({ issue, lines, root, kind, findings, date })
+	return { code: await append_round({ issue, lines, root, kind, date }), is_ledger: true }
+}
+
+function finish_record(request: Request, is_interaction: boolean, root: string): void {
+	if (!is_interaction) review_final_record.record(request.issue, request.findings, root)
+	review_fix_round.record_reasons(request.issue, request.findings)
+	if (request.round !== undefined) review_fix_round.save(request.round, root)
 }
 
 async function record_prepared(
@@ -353,15 +365,17 @@ async function record_prepared(
 	request.round = parsed.interaction
 		? undefined
 		: review_fix_round.prepare(request.issue, request.findings, root)
-	const code = await write_round(parsed, request, now, root)
+	const { code, is_ledger } = await write_round(parsed, request, now, root)
 
 	if (code !== 0) return code
 
-	if (!parsed.interaction) review_final_record.record(request.issue, request.findings, root)
-	review_fix_round.record_reasons(request.issue, request.findings)
-	if (request.round !== undefined) review_fix_round.save(request.round, root)
+	finish_record(request, parsed.interaction, root)
+
+	if (is_ledger && !parsed.interaction) {
+		await review_record_code_round.follow(request.issue, root, request.findings)
+	}
 
-	return code
+	return 0
 }
 
 async function run_record(parsed: Parsed, now: Date, root: string): Promise<number> {

package/scripts/review/review-record-pinned.ts

@@ -5,6 +5,7 @@ import { error_text } from '#scripts/lib/error-message'
 import { observation_ledger_home } from '#scripts/observations/observation-ledger-home'
 import { run_review_join_read, type JoinVerdict } from '#scripts/run/review/run-review-join-read'
 import { run_review_pinned_join } from '#scripts/run/review/run-review-pinned-join'
+import { run_review_pinned_steps } from '#scripts/run/review/run-review-pinned-steps'
 import { run_ship_detach } from '#scripts/run/ship/run-ship-detach'
 import { test_pinned_logic } from '#scripts/test/test-pinned-logic'
 import { review_finding_ledger } from './review-finding-ledger'
@@ -15,7 +16,7 @@ import { review_finding_ledger } from './review-finding-ledger'
 // tree, and its join closed before the fix. The ship's pre-detach was then the first to name the fixed
 // tree's unpinned places, and stopped on them. A recorded code round compares the fixed tree with the
 // launch's and, where they differ, starts the check again with the launch's `--unpinned-ok` reason and
-// says who reads its answer. **Nothing waits on it in the foreground** (joshuafolkken/kit#4895): the
+// says who reads its answer. **The fresh round-1 check is not waited on** (joshuafolkken/kit#4895): the
 // ship's pre-detach reads that same check's answer on that tree rather than running its own
 // (`run-review-pinned-join.ts`). A foreground read stalled the lane for minutes, and pinning what it
 // named moved the tree again under the next probe.
@@ -49,19 +50,27 @@ async function restart_if_moved(root: string = PROJECT_ROOT): Promise<boolean> {
 
 // **A join the lane skipped is read here** (joshuafolkken/kit#5212): `josh run:review --join` was never
 // run, so the unpinned places would surface only as the ship's pre-detach failure. It reads only an
-// answer already left on this tree, so nothing waits on it either. A read that stops nothing prints
-// nothing, and a join already read changes nothing.
+// answer already left on this tree. A cut collects the existing continuation; a ship's remaining
+// probe is collected even when the original join was read. Incomplete results remain explicit.
 const CHOICE_LINE =
 	'Unpinned before the ship: pin each place above with a test that turns red without it, or ship with `--unpinned-ok "<reason>"`.\n'
 
 function show_stop(joined: JoinVerdict | undefined): void {
-	if (joined?.is_stop !== true) return
-	console.info(test_pinned_logic.report_text(joined.summary, CHOICE_LINE).trimEnd())
+	if (joined === undefined) return
+	const text = joined.is_stop
+		? test_pinned_logic.report_text(joined.summary, CHOICE_LINE)
+		: joined.text
+
+	if (joined.is_stop || [joined.summary.is_unchecked, joined.summary.is_partial].includes(true)) {
+		console.info(text.trimEnd())
+	}
 }
 
 async function read_skipped_join(root: string = PROJECT_ROOT): Promise<void> {
 	try {
-		if (run_review_join_read.is_due(root)) show_stop(await run_review_join_read.read_finished(root))
+		if (run_review_join_read.is_due(root) || run_review_pinned_steps.is_remaining(root)) {
+			show_stop(await run_review_join_read.read_finished(root))
+		}
 	} catch (error) {
 		error_text.trace_swallowed('review_record_pinned.read_skipped_join', error)
 	}