@joshuafolkken/kit 1.879.0 → 1.881.0

package/dist/hooks/batch-guard.js

@@ -9,10 +9,10 @@ import {
   load_environment_file,
   notice_refusal_path,
   refusal_path
-} from "./chunk-B2LIXYFL.js";
-import "./chunk-B4YNCUGB.js";
-import "./chunk-GXKKK23T.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-FRJKVSK3.js";
+import "./chunk-36UE53LS.js";
+import "./chunk-FNFOLFFV.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 export {

package/dist/hooks/{chunk-KABG6AEW.js → chunk-264QY6KS.js}

@@ -1016,6 +1016,12 @@ var PROJECT_COMMANDS = {
     category: "Project",
     reference: ["", "developer", ["files"]]
   },
+  "registry:migrate": {
+    script: "scripts/registry-migration/migrate.ts",
+    description: "Migrate a kit-only project from GitHub Packages to public npm",
+    category: "Project",
+    reference: ["", "developer", ["files", "network", "processes"]]
+  },
   "sync:scope": {
     script: "scripts/sync/managed-config-scope-cli.ts",
     description: "Say whether this change touches a file josh sync distributes",
@@ -1237,6 +1243,7 @@ var ALIASES = {
   pt: "port",
   i: "init",
   sy: "sync",
+  rmi: "registry:migrate",
   sys: "sync:scope",
   g: "git",
   gp: "pr",

package/dist/hooks/{chunk-B4YNCUGB.js → chunk-36UE53LS.js}

@@ -1,13 +1,13 @@
 import {
   lane_child_marker
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   time_bundle_call,
   time_format,
   time_round_trips,
   time_spans,
   time_transcript_line
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/lane/lane-guard-policy.ts
 var DEFAULT_MODE = "refuse";

package/dist/hooks/{chunk-WCYPBPJC.js → chunk-4OXFU3MK.js}

@@ -29,28 +29,28 @@ import {
   run_watcher_guard,
   shell_segments,
   tail_commands
-} from "./chunk-2XIGZQMQ.js";
+} from "./chunk-VGYSA2NT.js";
 import {
   batch_outcome
-} from "./chunk-B2LIXYFL.js";
+} from "./chunk-FRJKVSK3.js";
 import {
   investigation_refusal
-} from "./chunk-E55NKX5F.js";
+} from "./chunk-ZBK4XRAS.js";
 import {
   duplicate_read_outcome
-} from "./chunk-2RUPMGGV.js";
+} from "./chunk-PRDCNGA6.js";
 import {
   investigation_reads
-} from "./chunk-QNNWYQ2R.js";
+} from "./chunk-Y5OYCU2F.js";
 import {
   lane_guard_policy,
   time_batch_guard
-} from "./chunk-B4YNCUGB.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision,
   lane_child_marker,
   run_issue_number
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   PLATFORM_TEMP_ROOT,
   cost_attribute,
@@ -61,7 +61,7 @@ import {
   lane_paths,
   stamp_file,
   time_shell
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/hooks/pretool-guard.ts
 import { text } from "node:stream/consumers";

package/dist/hooks/{chunk-BIWLABFK.js → chunk-6MQCXEEA.js}

@@ -1,7 +1,7 @@
 import {
   ESLINT_EDIT_CACHE_FLAGS,
   time_density_hook
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/hooks/format-edited-file.ts
 import { existsSync as existsSync3 } from "node:fs";

package/dist/hooks/{chunk-GXKKK23T.js → chunk-FNFOLFFV.js}

@@ -3,7 +3,7 @@ import {
   stamp_file,
   time_density_hook,
   time_hook_transcript
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 import {
   josh_environment_file
 } from "./chunk-FXAKJKTB.js";

package/dist/hooks/{chunk-B2LIXYFL.js → chunk-FRJKVSK3.js}

@@ -1,10 +1,10 @@
 import {
   lane_guard_policy,
   time_batch_guard
-} from "./chunk-B4YNCUGB.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 
 // scripts/hooks/batch-guard.ts
 import { text } from "node:stream/consumers";

package/dist/hooks/{chunk-2RUPMGGV.js → chunk-PRDCNGA6.js}

@@ -1,16 +1,16 @@
 import {
   investigation_reads
-} from "./chunk-QNNWYQ2R.js";
+} from "./chunk-Y5OYCU2F.js";
 import {
   lane_guard_policy
-} from "./chunk-B4YNCUGB.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   json_value,
   time_spans
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/delegation/duplicate-read-guard.ts
 import { statSync } from "node:fs";

package/dist/hooks/{chunk-2XIGZQMQ.js → chunk-VGYSA2NT.js}

@@ -1,7 +1,7 @@
 import {
   lane_child_marker,
   run_issue_number
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   PLATFORM_TEMP_ROOT,
   cost_blocks,
@@ -11,7 +11,7 @@ import {
   time_density_hook,
   time_shell,
   time_transcript_line
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 import {
   ENV_FILE_NAME,
   LANE_SEAT_KEY,

package/dist/hooks/{chunk-QNNWYQ2R.js → chunk-Y5OYCU2F.js}

@@ -1,16 +1,16 @@
 import {
   time_batch_guard
-} from "./chunk-B4YNCUGB.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   cost_blocks,
   cost_transcript,
   time_bundle_call,
   time_shell,
   time_spans
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/delegation/investigation-reads.ts
 import path from "node:path";

package/dist/hooks/{chunk-E55NKX5F.js → chunk-ZBK4XRAS.js}

@@ -1,12 +1,12 @@
 import {
   investigation_reads
-} from "./chunk-QNNWYQ2R.js";
+} from "./chunk-Y5OYCU2F.js";
 import {
   lane_guard_policy
-} from "./chunk-B4YNCUGB.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 
 // scripts/delegation/investigation-guard.ts
 import { text } from "node:stream/consumers";

package/dist/hooks/codex-hook-adapter.js

@@ -1,24 +1,24 @@
 #!/usr/bin/env tsx
 import {
   pretool_guard
-} from "./chunk-WCYPBPJC.js";
-import "./chunk-2XIGZQMQ.js";
+} from "./chunk-4OXFU3MK.js";
+import "./chunk-VGYSA2NT.js";
 import {
   build_envelope,
   compose_context,
   format_edited_payload
-} from "./chunk-BIWLABFK.js";
-import "./chunk-B2LIXYFL.js";
-import "./chunk-E55NKX5F.js";
-import "./chunk-2RUPMGGV.js";
-import "./chunk-QNNWYQ2R.js";
-import "./chunk-B4YNCUGB.js";
+} from "./chunk-6MQCXEEA.js";
+import "./chunk-FRJKVSK3.js";
+import "./chunk-ZBK4XRAS.js";
+import "./chunk-PRDCNGA6.js";
+import "./chunk-Y5OYCU2F.js";
+import "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   time_density_hook
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 

package/dist/hooks/duplicate-read-guard.js

@@ -9,11 +9,11 @@ import {
   is_enabled,
   notice_refusal_path,
   refusal_path
-} from "./chunk-2RUPMGGV.js";
-import "./chunk-QNNWYQ2R.js";
-import "./chunk-B4YNCUGB.js";
-import "./chunk-GXKKK23T.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-PRDCNGA6.js";
+import "./chunk-Y5OYCU2F.js";
+import "./chunk-36UE53LS.js";
+import "./chunk-FNFOLFFV.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 export {

package/dist/hooks/format-edited.js

@@ -15,8 +15,8 @@ import {
   relative_to_root,
   resolve_invocations,
   select_invocation
-} from "./chunk-BIWLABFK.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-6MQCXEEA.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-SSX23SJ2.js";
 export {
   ESLINT_DAEMON,

package/dist/hooks/investigation-guard.js

@@ -10,11 +10,11 @@ import {
   is_enabled,
   load_environment_file,
   refusal_path
-} from "./chunk-E55NKX5F.js";
-import "./chunk-QNNWYQ2R.js";
-import "./chunk-B4YNCUGB.js";
-import "./chunk-GXKKK23T.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-ZBK4XRAS.js";
+import "./chunk-Y5OYCU2F.js";
+import "./chunk-36UE53LS.js";
+import "./chunk-FNFOLFFV.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 export {

package/dist/hooks/pretool-guard.js

@@ -3,15 +3,15 @@ import {
   pretool_guard,
   pretool_outcome,
   pretool_outcome_async
-} from "./chunk-WCYPBPJC.js";
-import "./chunk-2XIGZQMQ.js";
-import "./chunk-B2LIXYFL.js";
-import "./chunk-E55NKX5F.js";
-import "./chunk-2RUPMGGV.js";
-import "./chunk-QNNWYQ2R.js";
-import "./chunk-B4YNCUGB.js";
-import "./chunk-GXKKK23T.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-4OXFU3MK.js";
+import "./chunk-VGYSA2NT.js";
+import "./chunk-FRJKVSK3.js";
+import "./chunk-ZBK4XRAS.js";
+import "./chunk-PRDCNGA6.js";
+import "./chunk-Y5OYCU2F.js";
+import "./chunk-36UE53LS.js";
+import "./chunk-FNFOLFFV.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 export {

package/dist/hooks/stop-guard.js

@@ -15,20 +15,20 @@ import {
   run_hold,
   run_invocation,
   run_watcher_guard
-} from "./chunk-2XIGZQMQ.js";
+} from "./chunk-VGYSA2NT.js";
 import {
   session_language
 } from "./chunk-6V5OPIUU.js";
 import {
   hook_decision,
   lane_child_marker
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   PROJECT_ROOT,
   stamp_file,
   time_density_hook,
   time_hook_transcript
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 

package/dist/josh.js

@@ -1173,6 +1173,12 @@ var PROJECT_COMMANDS = {
     category: "Project",
     reference: ["", "developer", ["files"]]
   },
+  "registry:migrate": {
+    script: "scripts/registry-migration/migrate.ts",
+    description: "Migrate a kit-only project from GitHub Packages to public npm",
+    category: "Project",
+    reference: ["", "developer", ["files", "network", "processes"]]
+  },
   "sync:scope": {
     script: "scripts/sync/managed-config-scope-cli.ts",
     description: "Say whether this change touches a file josh sync distributes",
@@ -1403,6 +1409,7 @@ var ALIASES = {
   pt: "port",
   i: "init",
   sy: "sync",
+  rmi: "registry:migrate",
   sys: "sync:scope",
   g: "git",
   gp: "pr",

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.879.0",
+  "version": "1.881.0",
   "name": "@joshuafolkken/kit",
   "type": "module",
   "license": "MIT",

package/scripts/josh/__snapshots__/josh-command-map.test.ts.snap

@@ -102,6 +102,7 @@ exports[`COMMAND_MAP — reference metadata > keeps every canonical command and
     "rh": "run:hold",
     "rl": "report:lint",
     "rmg": "run:merge",
+    "rmi": "registry:migrate",
     "rn": "run:next",
     "rp": "run:prep",
     "rpy": "repo:party",
@@ -787,6 +788,15 @@ exports[`COMMAND_MAP — reference metadata > keeps every canonical command and
         "processes",
       ],
     ],
+    "registry:migrate": [
+      "",
+      "developer",
+      [
+        "files",
+        "network",
+        "processes",
+      ],
+    ],
     "release": [
       "[version]",
       "maintainer",

package/scripts/josh/josh-command-map.ts

@@ -54,6 +54,7 @@ const ALIASES: Record<string, string> = {
 	pt: 'port',
 	i: 'init',
 	sy: 'sync',
+	rmi: 'registry:migrate',
 	sys: 'sync:scope',
 	g: 'git',
 	gp: 'pr',

package/scripts/josh/josh-commands-project.ts

@@ -17,6 +17,12 @@ const PROJECT_COMMANDS: Record<string, CommandEntry> = {
 		category: 'Project',
 		reference: ['', 'developer', ['files']],
 	},
+	'registry:migrate': {
+		script: 'scripts/registry-migration/migrate.ts',
+		description: 'Migrate a kit-only project from GitHub Packages to public npm',
+		category: 'Project',
+		reference: ['', 'developer', ['files', 'network', 'processes']],
+	},
 	'sync:scope': {
 		script: 'scripts/sync/managed-config-scope-cli.ts',
 		description: 'Say whether this change touches a file josh sync distributes',

package/scripts/registry-migration/migrate-logic.ts

@@ -0,0 +1,229 @@
+import { fix_gh_packages_logic } from '#scripts/gh/fix-gh-packages-logic'
+
+const SCOPE = '@joshuafolkken'
+const REGISTRY_KEY = `${SCOPE}:registry`
+const PUBLIC_REGISTRY = 'https://registry.npmjs.org/'
+const GITHUB_REGISTRY = 'https://npm.pkg.github.com/'
+const MAPPING = `${REGISTRY_KEY}=${PUBLIC_REGISTRY}`
+const REGISTRY_VALUE_INDEX = 1
+const SPLIT_LIMIT = 2
+
+interface MigrationPlan {
+	content: string
+	packages: ReadonlyArray<string>
+	blocked: ReadonlyArray<string>
+	change: string
+}
+
+type IntegrityPair = readonly [string, string]
+
+function normalized_registry(value: string): string {
+	let normalized = value.trim()
+	while (normalized.endsWith('/')) normalized = normalized.slice(0, -1)
+
+	return `${normalized}/`
+}
+
+function mapping_lines(content: string): ReadonlyArray<string> {
+	return content.split(/\r?\n/u).filter((line) => line.trimStart().startsWith(`${REGISTRY_KEY}=`))
+}
+
+function registry_of(content: string): string | undefined {
+	const lines = mapping_lines(content)
+	if (lines.length !== 1) return undefined
+
+	return normalized_registry(lines[0]?.split('=', SPLIT_LIMIT)[REGISTRY_VALUE_INDEX] ?? '')
+}
+
+function scoped_packages(lockfile: string): ReadonlyArray<string> {
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile)
+
+	return Object.keys(packages)
+		.filter((key) => key.startsWith(`${SCOPE}/`))
+		.map((key) => fix_gh_packages_logic.package_path_from_key(key))
+		.filter((name, index, names) => names.indexOf(name) === index)
+}
+
+function scoped_versions(lockfile: string): ReadonlyArray<readonly [string, string]> {
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile)
+
+	return Object.keys(packages)
+		.filter((key) => key.startsWith(`${SCOPE}/`))
+		.map(
+			(key) =>
+				[
+					fix_gh_packages_logic.package_path_from_key(key),
+					fix_gh_packages_logic.package_version_from_key(key),
+				] as const,
+		)
+}
+
+function is_github_tarball(value: string): boolean {
+	try {
+		const url = new URL(value)
+
+		return url.protocol === 'https:' && url.hostname === 'npm.pkg.github.com'
+	} catch {
+		return false
+	}
+}
+
+function github_tarballs(lockfile: string): ReadonlyArray<string> {
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile)
+
+	return Object.entries(packages)
+		.filter(
+			([key, entry]) =>
+				key.startsWith(`${SCOPE}/`) &&
+				entry.resolution?.tarball !== undefined &&
+				is_github_tarball(entry.resolution.tarball),
+		)
+		.map(([key]) => key)
+}
+
+function remove_flow_tarball(line: string): string {
+	const marker = ', tarball: https://npm.pkg.github.com/'
+	const start = line.indexOf(marker)
+	if (start === -1) return line
+	const end = line.indexOf('}', start)
+	if (end === -1) return line
+
+	return `${line.slice(0, start)}${line.slice(end)}`
+}
+
+function is_package_entry(line: string): boolean {
+	return /^ {2}[^ ]/u.test(line)
+}
+
+function is_github_tarball_line(line: string): boolean {
+	return line.trimStart().startsWith('tarball: https://npm.pkg.github.com/')
+}
+
+function clean_kit_line(
+	line: string,
+	version: string,
+	integrities: ReadonlyMap<string, IntegrityPair>,
+): string | undefined {
+	if (!version) return line
+	if (is_github_tarball_line(line)) return undefined
+	const cleaned = remove_flow_tarball(line)
+	const pair = integrities.get(version)
+	if (pair === undefined) return cleaned
+
+	return cleaned.split(`integrity: ${pair[0]}`).join(`integrity: ${pair[1]}`)
+}
+
+function next_kit_version(line: string, version: string): string {
+	if (!is_package_entry(line)) return version
+	const prefix = "  '@joshuafolkken/kit@"
+
+	return line.startsWith(prefix) ? (line.slice(prefix.length).split("'", 1)[0] ?? '') : ''
+}
+
+function integrity_pair(
+	old_integrity: string | undefined,
+	npm_integrity: string | undefined,
+): IntegrityPair | undefined {
+	if (old_integrity === undefined || npm_integrity === undefined) return undefined
+
+	return [old_integrity, npm_integrity]
+}
+
+function lock_integrities(
+	lockfile: string,
+	npm_integrities: ReadonlyMap<string, string>,
+): Map<string, IntegrityPair> {
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile)
+	const pairs = new Map<string, IntegrityPair>()
+	const kit_entries = Object.entries(packages).filter(([key]) => key.startsWith(`${SCOPE}/kit@`))
+
+	for (const [key, entry] of kit_entries) {
+		const version = fix_gh_packages_logic.package_version_from_key(key)
+		const pair = integrity_pair(entry.resolution?.integrity, npm_integrities.get(version))
+		if (pair !== undefined) pairs.set(version, pair)
+	}
+
+	return pairs
+}
+
+function push_if_defined(lines: Array<string>, cleaned: string | undefined): void {
+	if (cleaned !== undefined) lines.push(cleaned)
+}
+
+function rewrite_kit_lockfile(
+	lockfile: string,
+	npm_integrities: ReadonlyMap<string, string>,
+): string {
+	let kit_version = ''
+	const lines: Array<string> = []
+	const integrities = lock_integrities(lockfile, npm_integrities)
+
+	for (const line of lockfile.split('\n')) {
+		kit_version = next_kit_version(line, kit_version)
+		const cleaned = clean_kit_line(line, kit_version, integrities)
+
+		push_if_defined(lines, cleaned)
+	}
+
+	return lines.join('\n')
+}
+
+function append_mapping(content: string, eol: string): string {
+	const separator = content && !content.endsWith('\n') ? eol : ''
+
+	return `${content}${separator}${MAPPING}${eol}`
+}
+
+function replace_mapping(content: string): string {
+	const lines = mapping_lines(content)
+	const eol = content.includes('\r\n') ? '\r\n' : '\n'
+
+	if (lines.length === 0) return append_mapping(content, eol)
+
+	return content
+		.split(/\r?\n/u)
+		.map((line) => (line === lines[0] ? MAPPING : line))
+		.join(eol)
+}
+
+function unsupported_registry(project_npmrc: string): string | undefined {
+	const registry = registry_of(project_npmrc)
+
+	if (registry === undefined || [GITHUB_REGISTRY, PUBLIC_REGISTRY].includes(registry)) {
+		return undefined
+	}
+
+	return `unsupported project registry: ${registry}`
+}
+
+function has_duplicate_mapping(project_npmrc: string, user_npmrc: string): boolean {
+	return mapping_lines(project_npmrc).length > 1 || mapping_lines(user_npmrc).length > 1
+}
+
+function previous_registry(project_npmrc: string, user_npmrc: string): string {
+	return registry_of(project_npmrc) ?? registry_of(user_npmrc) ?? 'default npm'
+}
+
+function plan(project_npmrc: string, user_npmrc: string, lockfile: string): MigrationPlan {
+	const packages = scoped_packages(lockfile)
+	const blocked = packages.filter((name) => name !== `${SCOPE}/kit`)
+	if (has_duplicate_mapping(project_npmrc, user_npmrc)) blocked.push('duplicate registry mappings')
+	const unsupported = unsupported_registry(project_npmrc)
+	if (unsupported !== undefined) blocked.push(unsupported)
+	const before = previous_registry(project_npmrc, user_npmrc)
+	const change = `${before} → ${PUBLIC_REGISTRY}`
+
+	return { content: replace_mapping(project_npmrc), packages, blocked, change }
+}
+
+const migrate_logic = {
+	plan,
+	github_tarballs,
+	rewrite_kit_lockfile,
+	registry_of,
+	scoped_packages,
+	scoped_versions,
+}
+
+export { migrate_logic }
+export type { MigrationPlan }

package/scripts/registry-migration/migrate.ts

@@ -0,0 +1,280 @@
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { execa } from 'execa'
+import { z } from 'zod'
+import { migrate_logic, type MigrationPlan } from './migrate-logic'
+import { user_npmrc } from './user-npmrc'
+
+const NPMRC = '.npmrc'
+const LOCKFILE = 'pnpm-lock.yaml'
+const WORKSPACE = 'pnpm-workspace.yaml'
+const PUBLIC_REGISTRY = 'https://registry.npmjs.org/'
+const FETCH_TIMEOUT_MS = 10_000
+const SCOPE = '@joshuafolkken/'
+const manifest_schema = z.looseObject({
+	dependencies: z.record(z.string(), z.string()).optional(),
+	devDependencies: z.record(z.string(), z.string()).optional(),
+	optionalDependencies: z.record(z.string(), z.string()).optional(),
+	peerDependencies: z.record(z.string(), z.string()).optional(),
+})
+const version_schema = z.looseObject({
+	dist: z.looseObject({ integrity: z.string(), tarball: z.string() }),
+})
+
+function is_public_npm_url(value: string): boolean {
+	try {
+		const url = new URL(value)
+
+		return url.origin === 'https://registry.npmjs.org' && url.username === '' && url.password === ''
+	} catch {
+		return false
+	}
+}
+
+interface VersionCheck {
+	missing: ReadonlyArray<string>
+	integrities: ReadonlyMap<string, string>
+}
+
+async function probe_integrity(
+	name: string,
+	version: string,
+	probe_version: MigrationDependencies['fetch_version'],
+): Promise<string | undefined> {
+	if (!version) return undefined
+
+	return await probe_version(name, version)
+}
+
+interface MigrationDependencies {
+	fetch_version: (name: string, version: string) => Promise<string | undefined>
+	install: (cwd: string) => Promise<void>
+	effective_registry: (cwd: string) => Promise<string>
+	user_npmrc: string
+	environment: NodeJS.ProcessEnv
+}
+
+interface MigrationContext {
+	cwd: string
+	npmrc_path: string
+	lockfile_path: string
+	workspace_path: string
+	original_npmrc: string
+	original_lockfile: string
+	original_workspace: string
+	has_npmrc: boolean
+	has_lockfile: boolean
+	has_workspace: boolean
+	plan: MigrationPlan
+}
+
+function read_file(file_path: string): string {
+	return existsSync(file_path) ? readFileSync(file_path, 'utf8') : ''
+}
+
+function has_registry_override(environment: NodeJS.ProcessEnv): boolean {
+	return Object.keys(environment).some((key) =>
+		/^(?:npm|pnpm)_config_.*(?:joshuafolkken.*registry|userconfig)/iu.test(key),
+	)
+}
+
+function manifest_packages(content: string): ReadonlyArray<string> {
+	const manifest = manifest_schema.parse(JSON.parse(content))
+	const sections = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']
+
+	return sections.flatMap((section) => {
+		const value: unknown = Reflect.get(manifest, section)
+		if (typeof value !== 'object' || value === null) return []
+
+		return Object.keys(value).filter((name) => name.startsWith(SCOPE))
+	})
+}
+
+function restore(context: MigrationContext): void {
+	if (context.has_npmrc) writeFileSync(context.npmrc_path, context.original_npmrc)
+	else rmSync(context.npmrc_path, { force: true })
+	writeFileSync(context.lockfile_path, context.original_lockfile)
+	if (context.has_workspace) writeFileSync(context.workspace_path, context.original_workspace)
+	else rmSync(context.workspace_path, { force: true })
+}
+
+async function verify_public_versions(
+	lockfile: string,
+	probe_version: MigrationDependencies['fetch_version'],
+): Promise<VersionCheck> {
+	const missing: Array<string> = []
+	const integrities = new Map<string, string>()
+
+	for (const [name, version] of migrate_logic.scoped_versions(lockfile)) {
+		const integrity = await probe_integrity(name, version, probe_version)
+		if (integrity === undefined) missing.push(`${name}@${version}`)
+		else integrities.set(version, integrity)
+	}
+
+	return { missing, integrities }
+}
+
+function report_context(context: MigrationContext): void {
+	console.info(`Current registry and planned change: ${context.plan.change}`)
+	console.info(`Installed scoped packages: ${context.plan.packages.join(', ') || '(none)'}`)
+}
+
+function create_context(cwd: string, dependencies: MigrationDependencies): MigrationContext {
+	const npmrc_path = path.join(cwd, NPMRC)
+	const lockfile_path = path.join(cwd, LOCKFILE)
+	const workspace_path = path.join(cwd, WORKSPACE)
+	const original_npmrc = read_file(npmrc_path)
+	const original_lockfile = read_file(lockfile_path)
+	const original_workspace = read_file(workspace_path)
+	const plan = migrate_logic.plan(original_npmrc, dependencies.user_npmrc, original_lockfile)
+
+	return {
+		cwd,
+		npmrc_path,
+		lockfile_path,
+		workspace_path,
+		original_npmrc,
+		original_lockfile,
+		original_workspace,
+		plan,
+		has_npmrc: existsSync(npmrc_path),
+		has_lockfile: existsSync(lockfile_path),
+		has_workspace: existsSync(workspace_path),
+	}
+}
+
+function initial_block(
+	context: MigrationContext,
+	dependencies: MigrationDependencies,
+): string | undefined {
+	if (!context.has_lockfile) return 'No lockfile; run pnpm install before migrating.'
+	const manifest = manifest_packages(read_file(path.join(context.cwd, 'package.json')))
+	const missing_lock = manifest.filter((name) => !context.plan.packages.includes(name))
+	const blocked = [...context.plan.blocked, ...missing_lock]
+	if (!context.plan.packages.includes(`${SCOPE}kit`)) blocked.push('kit is absent from lockfile')
+	if (has_registry_override(dependencies.environment)) blocked.push('registry environment override')
+	if (blocked.length === 0) return undefined
+
+	return `Migration blocked: ${blocked.join(', ')}. Keep GitHub Packages until every package is available on npm.`
+}
+
+async function verify_resolution(
+	context: MigrationContext,
+	dependencies: MigrationDependencies,
+	integrities: ReadonlyMap<string, string>,
+): Promise<void> {
+	await dependencies.install(context.cwd)
+
+	if (read_file(context.workspace_path) !== context.original_workspace) {
+		throw new Error('pnpm changed pnpm-workspace.yaml outside the migration')
+	}
+
+	const actual = await dependencies.effective_registry(context.cwd)
+	if (!is_public_npm_url(actual)) throw new Error(`effective registry is ${actual}`)
+	const lockfile = read_file(context.lockfile_path)
+	const old_tarballs = migrate_logic.github_tarballs(lockfile)
+	if (old_tarballs.length > 0) throw new Error(`GitHub tarballs remain: ${old_tarballs.join(', ')}`)
+
+	if (migrate_logic.rewrite_kit_lockfile(lockfile, integrities) !== lockfile) {
+		throw new Error('lockfile integrity does not match public npm')
+	}
+}
+
+async function apply(
+	context: MigrationContext,
+	dependencies: MigrationDependencies,
+	integrities: ReadonlyMap<string, string>,
+): Promise<string> {
+	try {
+		writeFileSync(context.npmrc_path, context.plan.content)
+		writeFileSync(
+			context.lockfile_path,
+			migrate_logic.rewrite_kit_lockfile(context.original_lockfile, integrities),
+		)
+		await verify_resolution(context, dependencies, integrities)
+	} catch (error) {
+		restore(context)
+
+		return `Migration blocked; original settings restored: ${String(error)}`
+	}
+
+	return 'Migrated to public npm. The project registry and lockfile now resolve from npm.'
+}
+
+function is_already_migrated(
+	context: MigrationContext,
+	integrities: ReadonlyMap<string, string>,
+): boolean {
+	return (
+		context.plan.content === context.original_npmrc &&
+		migrate_logic.rewrite_kit_lockfile(context.original_lockfile, integrities) ===
+			context.original_lockfile
+	)
+}
+
+async function migrate(cwd: string, dependencies: MigrationDependencies): Promise<string> {
+	const context = create_context(cwd, dependencies)
+
+	report_context(context)
+	const block = initial_block(context, dependencies)
+	if (block !== undefined) return block
+	const version_check = await verify_public_versions(
+		context.original_lockfile,
+		dependencies.fetch_version,
+	)
+
+	if (version_check.missing.length > 0) {
+		return `Migration blocked: unpublished on npm: ${version_check.missing.join(', ')}.`
+	}
+
+	if (is_already_migrated(context, version_check.integrities)) {
+		return 'Already using public npm; no changes made.'
+	}
+
+	return await apply(context, dependencies, version_check.integrities)
+}
+
+async function fetch_version(name: string, version: string): Promise<string | undefined> {
+	const encoded = encodeURIComponent(name)
+	const response = await fetch(`${PUBLIC_REGISTRY}${encoded}/${encodeURIComponent(version)}`, {
+		signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+	})
+
+	if (!response.ok) return undefined
+	const parsed = version_schema.safeParse(await response.json())
+	if (!parsed.success || !is_public_npm_url(parsed.data.dist.tarball)) return undefined
+
+	return parsed.data.dist.integrity
+}
+
+async function install(cwd: string): Promise<void> {
+	await execa('pnpm', ['install', '--lockfile-only', '--ignore-scripts', '--force'], { cwd })
+}
+
+async function effective_registry(cwd: string): Promise<string> {
+	const result = await execa('pnpm', ['config', 'get', '@joshuafolkken:registry'], { cwd })
+
+	return result.stdout.trim()
+}
+
+async function main(): Promise<void> {
+	const result = await migrate(process.cwd(), {
+		fetch_version,
+		install,
+		effective_registry,
+		user_npmrc: user_npmrc.read(),
+		environment: process.env,
+	})
+
+	console.info(result)
+
+	if (result.startsWith('Migration blocked') || result.startsWith('No lockfile')) process.exit(1)
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
+
+const registry_migration = { migrate }
+
+export { registry_migration }
+export type { MigrationDependencies }

package/scripts/registry-migration/user-npmrc.ts

@@ -0,0 +1,15 @@
+import { existsSync, readFileSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const NPMRC = '.npmrc'
+
+function read(home: string = os.homedir()): string {
+	const file = path.join(home, NPMRC)
+
+	return existsSync(file) ? readFileSync(file, 'utf8') : ''
+}
+
+const user_npmrc = { read }
+
+export { user_npmrc }