@joshuafolkken/kit 1.872.0 → 1.881.0

package/scripts/josh/josh-command-map.ts

@@ -54,6 +54,7 @@ const ALIASES: Record<string, string> = {
 	pt: 'port',
 	i: 'init',
 	sy: 'sync',
+	rmi: 'registry:migrate',
 	sys: 'sync:scope',
 	g: 'git',
 	gp: 'pr',

package/scripts/josh/josh-commands-project.ts

@@ -17,6 +17,12 @@ const PROJECT_COMMANDS: Record<string, CommandEntry> = {
 		category: 'Project',
 		reference: ['', 'developer', ['files']],
 	},
+	'registry:migrate': {
+		script: 'scripts/registry-migration/migrate.ts',
+		description: 'Migrate a kit-only project from GitHub Packages to public npm',
+		category: 'Project',
+		reference: ['', 'developer', ['files', 'network', 'processes']],
+	},
 	'sync:scope': {
 		script: 'scripts/sync/managed-config-scope-cli.ts',
 		description: 'Say whether this change touches a file josh sync distributes',

package/scripts/registry-migration/migrate-logic.ts

@@ -0,0 +1,229 @@
+import { fix_gh_packages_logic } from '#scripts/gh/fix-gh-packages-logic'
+
+const SCOPE = '@joshuafolkken'
+const REGISTRY_KEY = `${SCOPE}:registry`
+const PUBLIC_REGISTRY = 'https://registry.npmjs.org/'
+const GITHUB_REGISTRY = 'https://npm.pkg.github.com/'
+const MAPPING = `${REGISTRY_KEY}=${PUBLIC_REGISTRY}`
+const REGISTRY_VALUE_INDEX = 1
+const SPLIT_LIMIT = 2
+
+interface MigrationPlan {
+	content: string
+	packages: ReadonlyArray<string>
+	blocked: ReadonlyArray<string>
+	change: string
+}
+
+type IntegrityPair = readonly [string, string]
+
+function normalized_registry(value: string): string {
+	let normalized = value.trim()
+	while (normalized.endsWith('/')) normalized = normalized.slice(0, -1)
+
+	return `${normalized}/`
+}
+
+function mapping_lines(content: string): ReadonlyArray<string> {
+	return content.split(/\r?\n/u).filter((line) => line.trimStart().startsWith(`${REGISTRY_KEY}=`))
+}
+
+function registry_of(content: string): string | undefined {
+	const lines = mapping_lines(content)
+	if (lines.length !== 1) return undefined
+
+	return normalized_registry(lines[0]?.split('=', SPLIT_LIMIT)[REGISTRY_VALUE_INDEX] ?? '')
+}
+
+function scoped_packages(lockfile: string): ReadonlyArray<string> {
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile)
+
+	return Object.keys(packages)
+		.filter((key) => key.startsWith(`${SCOPE}/`))
+		.map((key) => fix_gh_packages_logic.package_path_from_key(key))
+		.filter((name, index, names) => names.indexOf(name) === index)
+}
+
+function scoped_versions(lockfile: string): ReadonlyArray<readonly [string, string]> {
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile)
+
+	return Object.keys(packages)
+		.filter((key) => key.startsWith(`${SCOPE}/`))
+		.map(
+			(key) =>
+				[
+					fix_gh_packages_logic.package_path_from_key(key),
+					fix_gh_packages_logic.package_version_from_key(key),
+				] as const,
+		)
+}
+
+function is_github_tarball(value: string): boolean {
+	try {
+		const url = new URL(value)
+
+		return url.protocol === 'https:' && url.hostname === 'npm.pkg.github.com'
+	} catch {
+		return false
+	}
+}
+
+function github_tarballs(lockfile: string): ReadonlyArray<string> {
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile)
+
+	return Object.entries(packages)
+		.filter(
+			([key, entry]) =>
+				key.startsWith(`${SCOPE}/`) &&
+				entry.resolution?.tarball !== undefined &&
+				is_github_tarball(entry.resolution.tarball),
+		)
+		.map(([key]) => key)
+}
+
+function remove_flow_tarball(line: string): string {
+	const marker = ', tarball: https://npm.pkg.github.com/'
+	const start = line.indexOf(marker)
+	if (start === -1) return line
+	const end = line.indexOf('}', start)
+	if (end === -1) return line
+
+	return `${line.slice(0, start)}${line.slice(end)}`
+}
+
+function is_package_entry(line: string): boolean {
+	return /^ {2}[^ ]/u.test(line)
+}
+
+function is_github_tarball_line(line: string): boolean {
+	return line.trimStart().startsWith('tarball: https://npm.pkg.github.com/')
+}
+
+function clean_kit_line(
+	line: string,
+	version: string,
+	integrities: ReadonlyMap<string, IntegrityPair>,
+): string | undefined {
+	if (!version) return line
+	if (is_github_tarball_line(line)) return undefined
+	const cleaned = remove_flow_tarball(line)
+	const pair = integrities.get(version)
+	if (pair === undefined) return cleaned
+
+	return cleaned.split(`integrity: ${pair[0]}`).join(`integrity: ${pair[1]}`)
+}
+
+function next_kit_version(line: string, version: string): string {
+	if (!is_package_entry(line)) return version
+	const prefix = "  '@joshuafolkken/kit@"
+
+	return line.startsWith(prefix) ? (line.slice(prefix.length).split("'", 1)[0] ?? '') : ''
+}
+
+function integrity_pair(
+	old_integrity: string | undefined,
+	npm_integrity: string | undefined,
+): IntegrityPair | undefined {
+	if (old_integrity === undefined || npm_integrity === undefined) return undefined
+
+	return [old_integrity, npm_integrity]
+}
+
+function lock_integrities(
+	lockfile: string,
+	npm_integrities: ReadonlyMap<string, string>,
+): Map<string, IntegrityPair> {
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile)
+	const pairs = new Map<string, IntegrityPair>()
+	const kit_entries = Object.entries(packages).filter(([key]) => key.startsWith(`${SCOPE}/kit@`))
+
+	for (const [key, entry] of kit_entries) {
+		const version = fix_gh_packages_logic.package_version_from_key(key)
+		const pair = integrity_pair(entry.resolution?.integrity, npm_integrities.get(version))
+		if (pair !== undefined) pairs.set(version, pair)
+	}
+
+	return pairs
+}
+
+function push_if_defined(lines: Array<string>, cleaned: string | undefined): void {
+	if (cleaned !== undefined) lines.push(cleaned)
+}
+
+function rewrite_kit_lockfile(
+	lockfile: string,
+	npm_integrities: ReadonlyMap<string, string>,
+): string {
+	let kit_version = ''
+	const lines: Array<string> = []
+	const integrities = lock_integrities(lockfile, npm_integrities)
+
+	for (const line of lockfile.split('\n')) {
+		kit_version = next_kit_version(line, kit_version)
+		const cleaned = clean_kit_line(line, kit_version, integrities)
+
+		push_if_defined(lines, cleaned)
+	}
+
+	return lines.join('\n')
+}
+
+function append_mapping(content: string, eol: string): string {
+	const separator = content && !content.endsWith('\n') ? eol : ''
+
+	return `${content}${separator}${MAPPING}${eol}`
+}
+
+function replace_mapping(content: string): string {
+	const lines = mapping_lines(content)
+	const eol = content.includes('\r\n') ? '\r\n' : '\n'
+
+	if (lines.length === 0) return append_mapping(content, eol)
+
+	return content
+		.split(/\r?\n/u)
+		.map((line) => (line === lines[0] ? MAPPING : line))
+		.join(eol)
+}
+
+function unsupported_registry(project_npmrc: string): string | undefined {
+	const registry = registry_of(project_npmrc)
+
+	if (registry === undefined || [GITHUB_REGISTRY, PUBLIC_REGISTRY].includes(registry)) {
+		return undefined
+	}
+
+	return `unsupported project registry: ${registry}`
+}
+
+function has_duplicate_mapping(project_npmrc: string, user_npmrc: string): boolean {
+	return mapping_lines(project_npmrc).length > 1 || mapping_lines(user_npmrc).length > 1
+}
+
+function previous_registry(project_npmrc: string, user_npmrc: string): string {
+	return registry_of(project_npmrc) ?? registry_of(user_npmrc) ?? 'default npm'
+}
+
+function plan(project_npmrc: string, user_npmrc: string, lockfile: string): MigrationPlan {
+	const packages = scoped_packages(lockfile)
+	const blocked = packages.filter((name) => name !== `${SCOPE}/kit`)
+	if (has_duplicate_mapping(project_npmrc, user_npmrc)) blocked.push('duplicate registry mappings')
+	const unsupported = unsupported_registry(project_npmrc)
+	if (unsupported !== undefined) blocked.push(unsupported)
+	const before = previous_registry(project_npmrc, user_npmrc)
+	const change = `${before} → ${PUBLIC_REGISTRY}`
+
+	return { content: replace_mapping(project_npmrc), packages, blocked, change }
+}
+
+const migrate_logic = {
+	plan,
+	github_tarballs,
+	rewrite_kit_lockfile,
+	registry_of,
+	scoped_packages,
+	scoped_versions,
+}
+
+export { migrate_logic }
+export type { MigrationPlan }

package/scripts/registry-migration/migrate.ts

@@ -0,0 +1,280 @@
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { execa } from 'execa'
+import { z } from 'zod'
+import { migrate_logic, type MigrationPlan } from './migrate-logic'
+import { user_npmrc } from './user-npmrc'
+
+const NPMRC = '.npmrc'
+const LOCKFILE = 'pnpm-lock.yaml'
+const WORKSPACE = 'pnpm-workspace.yaml'
+const PUBLIC_REGISTRY = 'https://registry.npmjs.org/'
+const FETCH_TIMEOUT_MS = 10_000
+const SCOPE = '@joshuafolkken/'
+const manifest_schema = z.looseObject({
+	dependencies: z.record(z.string(), z.string()).optional(),
+	devDependencies: z.record(z.string(), z.string()).optional(),
+	optionalDependencies: z.record(z.string(), z.string()).optional(),
+	peerDependencies: z.record(z.string(), z.string()).optional(),
+})
+const version_schema = z.looseObject({
+	dist: z.looseObject({ integrity: z.string(), tarball: z.string() }),
+})
+
+function is_public_npm_url(value: string): boolean {
+	try {
+		const url = new URL(value)
+
+		return url.origin === 'https://registry.npmjs.org' && url.username === '' && url.password === ''
+	} catch {
+		return false
+	}
+}
+
+interface VersionCheck {
+	missing: ReadonlyArray<string>
+	integrities: ReadonlyMap<string, string>
+}
+
+async function probe_integrity(
+	name: string,
+	version: string,
+	probe_version: MigrationDependencies['fetch_version'],
+): Promise<string | undefined> {
+	if (!version) return undefined
+
+	return await probe_version(name, version)
+}
+
+interface MigrationDependencies {
+	fetch_version: (name: string, version: string) => Promise<string | undefined>
+	install: (cwd: string) => Promise<void>
+	effective_registry: (cwd: string) => Promise<string>
+	user_npmrc: string
+	environment: NodeJS.ProcessEnv
+}
+
+interface MigrationContext {
+	cwd: string
+	npmrc_path: string
+	lockfile_path: string
+	workspace_path: string
+	original_npmrc: string
+	original_lockfile: string
+	original_workspace: string
+	has_npmrc: boolean
+	has_lockfile: boolean
+	has_workspace: boolean
+	plan: MigrationPlan
+}
+
+function read_file(file_path: string): string {
+	return existsSync(file_path) ? readFileSync(file_path, 'utf8') : ''
+}
+
+function has_registry_override(environment: NodeJS.ProcessEnv): boolean {
+	return Object.keys(environment).some((key) =>
+		/^(?:npm|pnpm)_config_.*(?:joshuafolkken.*registry|userconfig)/iu.test(key),
+	)
+}
+
+function manifest_packages(content: string): ReadonlyArray<string> {
+	const manifest = manifest_schema.parse(JSON.parse(content))
+	const sections = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']
+
+	return sections.flatMap((section) => {
+		const value: unknown = Reflect.get(manifest, section)
+		if (typeof value !== 'object' || value === null) return []
+
+		return Object.keys(value).filter((name) => name.startsWith(SCOPE))
+	})
+}
+
+function restore(context: MigrationContext): void {
+	if (context.has_npmrc) writeFileSync(context.npmrc_path, context.original_npmrc)
+	else rmSync(context.npmrc_path, { force: true })
+	writeFileSync(context.lockfile_path, context.original_lockfile)
+	if (context.has_workspace) writeFileSync(context.workspace_path, context.original_workspace)
+	else rmSync(context.workspace_path, { force: true })
+}
+
+async function verify_public_versions(
+	lockfile: string,
+	probe_version: MigrationDependencies['fetch_version'],
+): Promise<VersionCheck> {
+	const missing: Array<string> = []
+	const integrities = new Map<string, string>()
+
+	for (const [name, version] of migrate_logic.scoped_versions(lockfile)) {
+		const integrity = await probe_integrity(name, version, probe_version)
+		if (integrity === undefined) missing.push(`${name}@${version}`)
+		else integrities.set(version, integrity)
+	}
+
+	return { missing, integrities }
+}
+
+function report_context(context: MigrationContext): void {
+	console.info(`Current registry and planned change: ${context.plan.change}`)
+	console.info(`Installed scoped packages: ${context.plan.packages.join(', ') || '(none)'}`)
+}
+
+function create_context(cwd: string, dependencies: MigrationDependencies): MigrationContext {
+	const npmrc_path = path.join(cwd, NPMRC)
+	const lockfile_path = path.join(cwd, LOCKFILE)
+	const workspace_path = path.join(cwd, WORKSPACE)
+	const original_npmrc = read_file(npmrc_path)
+	const original_lockfile = read_file(lockfile_path)
+	const original_workspace = read_file(workspace_path)
+	const plan = migrate_logic.plan(original_npmrc, dependencies.user_npmrc, original_lockfile)
+
+	return {
+		cwd,
+		npmrc_path,
+		lockfile_path,
+		workspace_path,
+		original_npmrc,
+		original_lockfile,
+		original_workspace,
+		plan,
+		has_npmrc: existsSync(npmrc_path),
+		has_lockfile: existsSync(lockfile_path),
+		has_workspace: existsSync(workspace_path),
+	}
+}
+
+function initial_block(
+	context: MigrationContext,
+	dependencies: MigrationDependencies,
+): string | undefined {
+	if (!context.has_lockfile) return 'No lockfile; run pnpm install before migrating.'
+	const manifest = manifest_packages(read_file(path.join(context.cwd, 'package.json')))
+	const missing_lock = manifest.filter((name) => !context.plan.packages.includes(name))
+	const blocked = [...context.plan.blocked, ...missing_lock]
+	if (!context.plan.packages.includes(`${SCOPE}kit`)) blocked.push('kit is absent from lockfile')
+	if (has_registry_override(dependencies.environment)) blocked.push('registry environment override')
+	if (blocked.length === 0) return undefined
+
+	return `Migration blocked: ${blocked.join(', ')}. Keep GitHub Packages until every package is available on npm.`
+}
+
+async function verify_resolution(
+	context: MigrationContext,
+	dependencies: MigrationDependencies,
+	integrities: ReadonlyMap<string, string>,
+): Promise<void> {
+	await dependencies.install(context.cwd)
+
+	if (read_file(context.workspace_path) !== context.original_workspace) {
+		throw new Error('pnpm changed pnpm-workspace.yaml outside the migration')
+	}
+
+	const actual = await dependencies.effective_registry(context.cwd)
+	if (!is_public_npm_url(actual)) throw new Error(`effective registry is ${actual}`)
+	const lockfile = read_file(context.lockfile_path)
+	const old_tarballs = migrate_logic.github_tarballs(lockfile)
+	if (old_tarballs.length > 0) throw new Error(`GitHub tarballs remain: ${old_tarballs.join(', ')}`)
+
+	if (migrate_logic.rewrite_kit_lockfile(lockfile, integrities) !== lockfile) {
+		throw new Error('lockfile integrity does not match public npm')
+	}
+}
+
+async function apply(
+	context: MigrationContext,
+	dependencies: MigrationDependencies,
+	integrities: ReadonlyMap<string, string>,
+): Promise<string> {
+	try {
+		writeFileSync(context.npmrc_path, context.plan.content)
+		writeFileSync(
+			context.lockfile_path,
+			migrate_logic.rewrite_kit_lockfile(context.original_lockfile, integrities),
+		)
+		await verify_resolution(context, dependencies, integrities)
+	} catch (error) {
+		restore(context)
+
+		return `Migration blocked; original settings restored: ${String(error)}`
+	}
+
+	return 'Migrated to public npm. The project registry and lockfile now resolve from npm.'
+}
+
+function is_already_migrated(
+	context: MigrationContext,
+	integrities: ReadonlyMap<string, string>,
+): boolean {
+	return (
+		context.plan.content === context.original_npmrc &&
+		migrate_logic.rewrite_kit_lockfile(context.original_lockfile, integrities) ===
+			context.original_lockfile
+	)
+}
+
+async function migrate(cwd: string, dependencies: MigrationDependencies): Promise<string> {
+	const context = create_context(cwd, dependencies)
+
+	report_context(context)
+	const block = initial_block(context, dependencies)
+	if (block !== undefined) return block
+	const version_check = await verify_public_versions(
+		context.original_lockfile,
+		dependencies.fetch_version,
+	)
+
+	if (version_check.missing.length > 0) {
+		return `Migration blocked: unpublished on npm: ${version_check.missing.join(', ')}.`
+	}
+
+	if (is_already_migrated(context, version_check.integrities)) {
+		return 'Already using public npm; no changes made.'
+	}
+
+	return await apply(context, dependencies, version_check.integrities)
+}
+
+async function fetch_version(name: string, version: string): Promise<string | undefined> {
+	const encoded = encodeURIComponent(name)
+	const response = await fetch(`${PUBLIC_REGISTRY}${encoded}/${encodeURIComponent(version)}`, {
+		signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+	})
+
+	if (!response.ok) return undefined
+	const parsed = version_schema.safeParse(await response.json())
+	if (!parsed.success || !is_public_npm_url(parsed.data.dist.tarball)) return undefined
+
+	return parsed.data.dist.integrity
+}
+
+async function install(cwd: string): Promise<void> {
+	await execa('pnpm', ['install', '--lockfile-only', '--ignore-scripts', '--force'], { cwd })
+}
+
+async function effective_registry(cwd: string): Promise<string> {
+	const result = await execa('pnpm', ['config', 'get', '@joshuafolkken:registry'], { cwd })
+
+	return result.stdout.trim()
+}
+
+async function main(): Promise<void> {
+	const result = await migrate(process.cwd(), {
+		fetch_version,
+		install,
+		effective_registry,
+		user_npmrc: user_npmrc.read(),
+		environment: process.env,
+	})
+
+	console.info(result)
+
+	if (result.startsWith('Migration blocked') || result.startsWith('No lockfile')) process.exit(1)
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
+
+const registry_migration = { migrate }
+
+export { registry_migration }
+export type { MigrationDependencies }

package/scripts/registry-migration/user-npmrc.ts

@@ -0,0 +1,15 @@
+import { existsSync, readFileSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const NPMRC = '.npmrc'
+
+function read(home: string = os.homedir()): string {
+	const file = path.join(home, NPMRC)
+
+	return existsSync(file) ? readFileSync(file, 'utf8') : ''
+}
+
+const user_npmrc = { read }
+
+export { user_npmrc }

package/templates/workflows/ci.yml

@@ -118,7 +118,9 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24'
-          registry-url: 'https://npm.pkg.github.com'
+
+      - name: Configure GitHub Packages authentication for existing projects
+        run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
 
       - name: Resolve pnpm version
         id: pnpm-version
@@ -358,7 +360,9 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24'
-          registry-url: 'https://npm.pkg.github.com'
+
+      - name: Configure GitHub Packages authentication for existing projects
+        run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
 
       - name: Resolve pnpm version
         id: pnpm-version