@joshuafolkken/kit 1.872.0

package/scripts/gh/fix-gh-packages-logic.ts

@@ -0,0 +1,232 @@
+import { loadAll } from 'js-yaml'
+import { z } from 'zod'
+
+const GH_PACKAGES_HOST = 'npm.pkg.github.com'
+const RESOLUTION_BLOCK = '\n    resolution:\n'
+const INTEGRITY_PREFIX = '      integrity: '
+const TARBALL_PREFIX = '      tarball: '
+const FLOW_RESOLUTION_LINE_START = '\n    resolution: {'
+const FLOW_TARBALL_KEY = ', tarball: '
+const NPMRC_AUTH_TOKEN_PREFIX = `//${GH_PACKAGES_HOST}/:_authToken=`
+const REGISTRY_KEY = ':registry='
+
+interface PackageResolution {
+	integrity?: string | undefined
+	tarball?: string | undefined
+}
+
+interface LockfilePackage {
+	resolution?: PackageResolution | undefined
+}
+
+const lockfile_resolution_schema = z.looseObject({
+	integrity: z.string().optional(),
+	tarball: z.string().optional(),
+})
+const lockfile_package_schema = z.looseObject({
+	resolution: lockfile_resolution_schema.optional(),
+})
+const lockfile_document_schema = z.looseObject({
+	packages: z.record(z.string(), lockfile_package_schema).optional(),
+})
+
+// pnpm 11 and 12 write pnpm-lock.yaml as a multi-document YAML stream (the pnpm
+// self-management document precedes the project document). load() only accepts a
+// single document and throws, so parse every document and merge their packages.
+function parse_lockfile_packages(raw: string): Record<string, LockfilePackage> {
+	const merged: Record<string, LockfilePackage> = {}
+
+	for (const document of loadAll(raw)) {
+		const { packages } = lockfile_document_schema.parse(document)
+		if (packages !== undefined) Object.assign(merged, packages)
+	}
+
+	return merged
+}
+
+function extract_gh_registry_scope(line: string): string | undefined {
+	const trimmed = line.trim()
+	if (!trimmed.startsWith('@')) return undefined
+	const eq_index = trimmed.indexOf(REGISTRY_KEY)
+	if (eq_index === -1) return undefined
+	const registry = trimmed
+		.slice(eq_index + REGISTRY_KEY.length)
+		.trim()
+		.replace(/\/$/u, '')
+	if (registry !== `https://${GH_PACKAGES_HOST}`) return undefined
+
+	return trimmed.slice(0, eq_index)
+}
+
+function parse_gh_scopes(npmrc: string): Set<string> {
+	const scopes = new Set<string>()
+
+	for (const line of npmrc.split('\n')) {
+		const scope = extract_gh_registry_scope(line)
+		if (scope !== undefined) scopes.add(scope)
+	}
+
+	return scopes
+}
+
+function extract_auth_token_from_line(line: string): string | undefined {
+	const trimmed = line.trim()
+	if (!trimmed.startsWith(NPMRC_AUTH_TOKEN_PREFIX)) return undefined
+	const value = trimmed.slice(NPMRC_AUTH_TOKEN_PREFIX.length)
+	if (value.startsWith('${') || value.length === 0) return undefined
+
+	return value
+}
+
+function parse_npmrc_auth_token(npmrc: string): string | undefined {
+	for (const line of npmrc.split('\n')) {
+		const token = extract_auth_token_from_line(line)
+		if (token !== undefined) return token
+	}
+
+	return undefined
+}
+
+function scope_from_key(key: string): string {
+	return key.startsWith('@') ? (key.split('/', 1)[0] ?? '') : ''
+}
+
+function has_tarball(entry: LockfilePackage): boolean {
+	return entry.resolution?.tarball !== undefined
+}
+
+function package_path_from_key(key: string): string {
+	const start = key.startsWith('@') ? 1 : 0
+	const at_index = key.indexOf('@', start)
+
+	return at_index === -1 ? key : key.slice(0, at_index)
+}
+
+function package_version_from_key(key: string): string {
+	const start = key.startsWith('@') ? 1 : 0
+	const at_index = key.indexOf('@', start)
+	if (at_index === -1) return ''
+
+	return key.slice(at_index + 1).split('(', 1)[0] ?? ''
+}
+
+function should_fix_tarball(key: string, entry: LockfilePackage, scopes: Set<string>): boolean {
+	if (has_tarball(entry)) return false
+	const scope = scope_from_key(key)
+
+	return scope.length > 0 && scopes.has(scope)
+}
+
+function find_entry_start(content: string, package_key: string): number {
+	const single = content.indexOf(`\n  '${package_key}':\n`)
+	if (single !== -1) return single
+
+	return content.indexOf(`\n  "${package_key}":\n`)
+}
+
+function find_entry_end(content: string, entry_start: number): number {
+	const next_match = /\n {2}['"]/u.exec(content.slice(entry_start + 1))
+
+	return next_match === null ? content.length : entry_start + 1 + next_match.index
+}
+
+function find_integrity_eol_in_entry(entry_content: string): number {
+	const resolution_pos = entry_content.indexOf(RESOLUTION_BLOCK)
+	if (resolution_pos === -1) return -1
+	const integrity_pos = entry_content.indexOf(INTEGRITY_PREFIX, resolution_pos)
+	if (integrity_pos === -1) return -1
+
+	return entry_content.indexOf('\n', integrity_pos)
+}
+
+function find_flow_resolution_brace(entry_content: string): number {
+	const pos = entry_content.indexOf(FLOW_RESOLUTION_LINE_START)
+	if (pos === -1) return -1
+	const line_end = entry_content.indexOf('\n', pos + 1)
+	const search_end = line_end === -1 ? entry_content.length : line_end
+	const brace = entry_content.lastIndexOf('}', search_end)
+	if (brace <= pos) return -1
+
+	return brace
+}
+
+function insert_expanded_tarball(
+	content: string,
+	entry_start: number,
+	entry_end: number,
+	tarball: string,
+): string | undefined {
+	const entry_content = content.slice(entry_start, entry_end)
+	const integrity_eol = find_integrity_eol_in_entry(entry_content)
+	if (integrity_eol === -1) return undefined
+	if (entry_content.slice(integrity_eol + 1).startsWith(TARBALL_PREFIX)) return content
+	const patched = `${entry_content.slice(0, integrity_eol + 1)}${TARBALL_PREFIX}${tarball}\n${entry_content.slice(integrity_eol + 1)}`
+
+	return content.slice(0, entry_start) + patched + content.slice(entry_end)
+}
+
+function insert_flow_tarball(
+	content: string,
+	entry_start: number,
+	entry_end: number,
+	tarball: string,
+): string | undefined {
+	const entry_content = content.slice(entry_start, entry_end)
+	const brace_pos = find_flow_resolution_brace(entry_content)
+	if (brace_pos === -1) return undefined
+	const open_brace = entry_content.lastIndexOf('{', brace_pos)
+	if (open_brace === -1) return undefined
+	const flow_body = entry_content.slice(open_brace + 1, brace_pos)
+	if (/\btarball\s*:/u.test(flow_body)) return content
+	const patched = `${entry_content.slice(0, brace_pos)}${FLOW_TARBALL_KEY}${tarball}${entry_content.slice(brace_pos)}`
+
+	return content.slice(0, entry_start) + patched + content.slice(entry_end)
+}
+
+function insert_tarball_for_key(content: string, package_key: string, tarball: string): string {
+	const entry_start = find_entry_start(content, package_key)
+	if (entry_start === -1) return content
+	const entry_end = find_entry_end(content, entry_start)
+
+	return (
+		insert_expanded_tarball(content, entry_start, entry_end, tarball) ??
+		insert_flow_tarball(content, entry_start, entry_end, tarball) ??
+		content
+	)
+}
+
+function patch_lockfile(content: string, patches: Map<string, string>): string {
+	let result = content
+
+	for (const [key, tarball] of patches) {
+		result = insert_tarball_for_key(result, key, tarball)
+	}
+
+	return result
+}
+
+function resolve_token(
+	environment_token: string | undefined,
+	npmrc_token: string | undefined,
+	get_fallback_token: () => string | undefined,
+): string | undefined {
+	if (environment_token !== undefined && environment_token.length > 0) return environment_token
+	if (npmrc_token !== undefined) return npmrc_token
+
+	return get_fallback_token()
+}
+
+const fix_gh_packages_logic = {
+	parse_gh_scopes,
+	parse_npmrc_auth_token,
+	parse_lockfile_packages,
+	package_path_from_key,
+	package_version_from_key,
+	needs_tarball_fix: should_fix_tarball,
+	insert_tarball_for_key,
+	patch_lockfile,
+	resolve_token,
+}
+
+export { fix_gh_packages_logic }
+export type { LockfilePackage, PackageResolution }

package/scripts/gh/fix-gh-packages.ts

@@ -0,0 +1,129 @@
+import { existsSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { z } from 'zod'
+import { fix_gh_packages_logic, type LockfilePackage } from './fix-gh-packages-logic'
+import { gh_cli_token } from './gh-cli-token'
+
+const LOCKFILE = 'pnpm-lock.yaml'
+const NPMRC = '.npmrc'
+const GH_PACKAGES_HOST = 'npm.pkg.github.com'
+const FETCH_TIMEOUT_MS = 10_000
+
+const npm_distribution_schema = z.looseObject({ tarball: z.string().optional() })
+const npm_version_schema = z.looseObject({ dist: npm_distribution_schema.optional() })
+const npm_packument_schema = z.looseObject({
+	versions: z.record(z.string(), npm_version_schema).optional(),
+})
+
+type ParsedPackages = Record<string, LockfilePackage>
+
+function read_file(file_path: string): string {
+	return existsSync(file_path) ? readFileSync(file_path, 'utf8') : ''
+}
+
+// Resolution order: NODE_AUTH_TOKEN → a literal token in the project .npmrc → `gh auth token`.
+// The kit does not distribute the `_authToken=${NODE_AUTH_TOKEN}` line, and a consumer that
+// keeps one (see docs/authentication.md §4(d)) is unaffected: parse_npmrc_auth_token skips the
+// placeholder form, and the env var it expands to is already first in the order above. The
+// user-level ~/.npmrc is deliberately NOT read: no kit script resolves the home directory
+// (see no-global-shim-write.test.ts), and the gh CLI fallback covers the same setups.
+function get_effective_auth_token(npmrc: string): string | undefined {
+	const environment_token = process.env['NODE_AUTH_TOKEN']?.trim()
+	const npmrc_token = fix_gh_packages_logic.parse_npmrc_auth_token(npmrc)
+
+	return fix_gh_packages_logic.resolve_token(environment_token, npmrc_token, gh_cli_token.get)
+}
+
+async function fetch_tarball_url(
+	package_path: string,
+	version: string,
+	token: string,
+): Promise<string | undefined> {
+	const url = `https://${GH_PACKAGES_HOST}/${package_path}`
+	const response = await fetch(url, {
+		headers: { Authorization: `Bearer ${token}` },
+		signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+	})
+
+	if (!response.ok) {
+		console.warn(`fix-gh-packages: fetch failed for ${package_path} (${String(response.status)})`)
+
+		return undefined
+	}
+
+	const packument = npm_packument_schema.parse(await response.json())
+
+	return packument.versions?.[version]?.dist?.tarball
+}
+
+async function process_package_entry(
+	key: string,
+	entry: LockfilePackage,
+	scopes: Set<string>,
+	token: string,
+): Promise<[string, string] | undefined> {
+	if (!fix_gh_packages_logic.needs_tarball_fix(key, entry, scopes)) return undefined
+	const tarball = await fetch_tarball_url(
+		fix_gh_packages_logic.package_path_from_key(key),
+		fix_gh_packages_logic.package_version_from_key(key),
+		token,
+	)
+
+	return tarball === undefined ? undefined : [key, tarball]
+}
+
+async function collect_fixes(
+	packages: ParsedPackages,
+	scopes: Set<string>,
+	token: string,
+): Promise<Map<string, string>> {
+	const fixes = new Map<string, string>()
+
+	for (const [key, entry] of Object.entries(packages)) {
+		const pair = await process_package_entry(key, entry, scopes, token)
+		if (pair !== undefined) fixes.set(pair[0], pair[1])
+	}
+
+	return fixes
+}
+
+async function apply_fixes(cwd: string, scopes: Set<string>, token: string): Promise<void> {
+	const lockfile_path = path.join(cwd, LOCKFILE)
+	if (!existsSync(lockfile_path)) return
+	const raw = readFileSync(lockfile_path, 'utf8')
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(raw)
+	if (Object.keys(packages).length === 0) return
+	const fixes = await collect_fixes(packages, scopes, token)
+	if (fixes.size === 0) return
+	writeFileSync(lockfile_path, fix_gh_packages_logic.patch_lockfile(raw, fixes))
+	console.info('fix-gh-packages: restored GitHub Packages tarball URLs in pnpm-lock.yaml')
+}
+
+async function run_main(cwd: string): Promise<void> {
+	const npmrc = read_file(path.join(cwd, NPMRC))
+	const scopes = fix_gh_packages_logic.parse_gh_scopes(npmrc)
+	if (scopes.size === 0) return
+	const token = get_effective_auth_token(npmrc)
+
+	if (token === undefined) {
+		console.warn(
+			'fix-gh-packages: no auth token found — run `gh auth login` or set NODE_AUTH_TOKEN',
+		)
+
+		return
+	}
+
+	await apply_fixes(cwd, scopes, token)
+}
+
+async function main(): Promise<void> {
+	try {
+		await run_main(process.cwd())
+	} catch (error) {
+		console.warn(`fix-gh-packages: skipped due to error: ${String(error)}`)
+	}
+}
+
+const [, argv1] = process.argv
+if (argv1 !== undefined && realpathSync(argv1) === fileURLToPath(import.meta.url)) await main()

package/scripts/gh/gh-cli-token.ts

@@ -0,0 +1,18 @@
+import { execaSync } from 'execa'
+
+const GH_CLI_TIMEOUT_MS = 5000
+
+function get(): string | undefined {
+	try {
+		const { stdout } = execaSync('gh', ['auth', 'token'], { timeout: GH_CLI_TIMEOUT_MS })
+		const token = stdout.trim()
+
+		return token.length > 0 ? token : undefined
+	} catch {
+		return undefined
+	}
+}
+
+const gh_cli_token = { get }
+
+export { gh_cli_token }

package/scripts/gh/gh-spawn.ts

@@ -0,0 +1,44 @@
+import { git_gh_api_path } from '#scripts/git/git-gh-api-path'
+import { git_gh_exec } from '#scripts/git/git-gh-exec'
+import { PROJECT_ROOT } from '#scripts/init/init-paths'
+import { execaSync } from 'execa'
+
+// The synchronous twin of `git_gh_repo.repo_get_name_with_owner`: same fact, read the same way, but
+// through `execaSync` because `josh init` / `josh sync` / `josh doctor` decide before they can await.
+// It asks REST for the same reason — `gh repo view` goes through GraphQL, which a cloud session is
+// refused (403), and a repository that reads as unresolved makes `init` / `sync` skip
+// `sonar-project.properties` outright (joshuafolkken/kit#1023). The path comes from the shared
+// builder rather than being spelled out again here.
+//
+// `timeout` is spread in rather than passed as `undefined`: execa's options type does not admit an
+// undefined value for it, and an explicit `undefined` would not mean "no timeout" anyway.
+function fetch_repo_name(timeout_ms: number | undefined): string | undefined {
+	const result = execaSync('gh', ['api', git_gh_api_path.repo_api_path(), '--jq', '.full_name'], {
+		...git_gh_exec.direct_environment(),
+		cwd: PROJECT_ROOT,
+		reject: false,
+		...(timeout_ms !== undefined && { timeout: timeout_ms }),
+	})
+	if (result.exitCode !== 0 || !result.stdout) return undefined
+
+	return result.stdout.trim() || undefined
+}
+
+// The unbounded lookup, for callers whose *writes* depend on the answer. A timeout would surface as
+// an unresolved repository, and `josh init` / `josh sync` react to that by skipping
+// `sonar-project.properties` entirely — so a latency spike would silently leave a consumer's Sonar
+// config stale. Waiting is the safer failure mode there (joshuafolkken/kit#805).
+function get_repo_name_with_owner(): string | undefined {
+	return fetch_repo_name(undefined)
+}
+
+// The bounded lookup, for callers that only report. Offered as a separate function rather than an
+// optional argument so the choice is visible at every call site: waiting is the safer failure mode
+// for `init` / `sync`, and returning promptly is the safer one for `doctor`, which writes nothing.
+function get_repo_name_with_owner_within(timeout_ms: number): string | undefined {
+	return fetch_repo_name(timeout_ms)
+}
+
+const gh_spawn = { get_repo_name_with_owner, get_repo_name_with_owner_within }
+
+export { gh_spawn }

package/scripts/git/animation-helpers.ts

@@ -0,0 +1,81 @@
+import { git_animation } from './git-animation'
+
+interface AnimationOptions<T> {
+	icon_selector?: (result: T) => string | undefined
+	error_message?: string
+	result_formatter?: (result: T) => string
+}
+
+function get_error_message(error_message: string | undefined): string {
+	return error_message ?? 'Operation failed'
+}
+
+function get_display_result<T>(result: T, formatter?: (result: T) => string): string {
+	return formatter?.(result) ?? String(result)
+}
+
+function handle_animation_success<T>(
+	animation: { stop: (result: string, icon?: string) => void },
+	result: T,
+	options?: AnimationOptions<T>,
+): void {
+	const icon = options?.icon_selector?.(result)
+	const display_result = get_display_result(result, options?.result_formatter)
+
+	animation.stop(display_result, icon)
+}
+
+function handle_animation_error(
+	animation: { stop: () => void },
+	error: unknown,
+	error_message: string | undefined,
+): never {
+	animation.stop()
+
+	if (error_message === undefined || error_message.length === 0) {
+		if (error instanceof Error) {
+			throw error
+		}
+
+		throw new Error(String(error), { cause: error })
+	}
+
+	throw new Error(get_error_message(error_message), { cause: error })
+}
+
+type CommandExecutor<T> = (pause_animation?: () => void) => Promise<T>
+
+async function execute_with_animation<T>(
+	message: string,
+	command_executor: CommandExecutor<T>,
+	options?: AnimationOptions<T>,
+): Promise<T> {
+	const animation = git_animation.create_animation(message)
+
+	try {
+		const result = await command_executor(() => {
+			animation.pause()
+		})
+
+		handle_animation_success(animation, result, options)
+
+		return result
+	} catch (error) {
+		return handle_animation_error(animation, error, options?.error_message)
+	}
+}
+
+function create_git_operation_config(error_message: string): AnimationOptions<string> {
+	return {
+		error_message,
+		icon_selector: () => '✅',
+		result_formatter: (message) => message,
+	}
+}
+
+const animation_helpers = {
+	execute_with_animation,
+}
+
+export type { AnimationOptions }
+export { animation_helpers, create_git_operation_config }

package/scripts/git/change-base.ts

@@ -0,0 +1,26 @@
+import { git_command } from './git-command'
+
+// **The change base as a commit, or nothing — never a ref name** (joshuafolkken/kit#1537).
+//
+// `git_command.change_base` degrades to the default-branch *name* when `merge-base` cannot answer,
+// and a name moves. Any reader that stores one reading and compares it against a later one — the
+// gate's green record, and the round-1 review snapshot — would then compare that identical string
+// while the tree under it is replaced, so the guard fails **open**: the one direction a guard built
+// to catch a moved base must not fail in. `undefined` makes the comparison fail closed instead, and
+// every caller answers it by widening its round or re-running its checks.
+//
+// It sits beside `git-command.ts` rather than inside it because that file is at its line limit, and
+// it is one module rather than two copies of this `try` — the gate already had one — because that
+// duplication is the clone `CLAUDE.md` prohibits. Keeping the `try` on this side also means a caller
+// whose suite mocks `git_command` degrades to `undefined` exactly as it did before.
+async function resolved(): Promise<string | undefined> {
+	try {
+		return await git_command.change_base_commit()
+	} catch {
+		return undefined
+	}
+}
+
+const change_base = { resolved }
+
+export { change_base }