@joshuafolkken/kit 1.879.0 → 1.883.0

package/.github/workflows/ci.yml

@@ -307,7 +307,7 @@ jobs:
             ${{ runner.os }}-cspell-cache-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.1 setup-ci
+        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
 
       - name: Install dependencies
         env:
@@ -406,7 +406,7 @@ jobs:
             ${{ runner.os }}-pnpm-store-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.1 setup-ci
+        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
 
       - name: Install dependencies
         env:
@@ -615,7 +615,7 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.1 setup-ci
+        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
 
       - name: Install dependencies
         env:

package/dist/hooks/batch-guard.js

@@ -9,10 +9,10 @@ import {
   load_environment_file,
   notice_refusal_path,
   refusal_path
-} from "./chunk-B2LIXYFL.js";
-import "./chunk-B4YNCUGB.js";
-import "./chunk-GXKKK23T.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-FRJKVSK3.js";
+import "./chunk-36UE53LS.js";
+import "./chunk-FNFOLFFV.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 export {

package/dist/hooks/{chunk-KABG6AEW.js → chunk-264QY6KS.js}

@@ -1016,6 +1016,12 @@ var PROJECT_COMMANDS = {
     category: "Project",
     reference: ["", "developer", ["files"]]
   },
+  "registry:migrate": {
+    script: "scripts/registry-migration/migrate.ts",
+    description: "Migrate a kit-only project from GitHub Packages to public npm",
+    category: "Project",
+    reference: ["", "developer", ["files", "network", "processes"]]
+  },
   "sync:scope": {
     script: "scripts/sync/managed-config-scope-cli.ts",
     description: "Say whether this change touches a file josh sync distributes",
@@ -1237,6 +1243,7 @@ var ALIASES = {
   pt: "port",
   i: "init",
   sy: "sync",
+  rmi: "registry:migrate",
   sys: "sync:scope",
   g: "git",
   gp: "pr",

package/dist/hooks/{chunk-B4YNCUGB.js → chunk-36UE53LS.js}

@@ -1,13 +1,13 @@
 import {
   lane_child_marker
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   time_bundle_call,
   time_format,
   time_round_trips,
   time_spans,
   time_transcript_line
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/lane/lane-guard-policy.ts
 var DEFAULT_MODE = "refuse";

package/dist/hooks/{chunk-WCYPBPJC.js → chunk-4OXFU3MK.js}

@@ -29,28 +29,28 @@ import {
   run_watcher_guard,
   shell_segments,
   tail_commands
-} from "./chunk-2XIGZQMQ.js";
+} from "./chunk-VGYSA2NT.js";
 import {
   batch_outcome
-} from "./chunk-B2LIXYFL.js";
+} from "./chunk-FRJKVSK3.js";
 import {
   investigation_refusal
-} from "./chunk-E55NKX5F.js";
+} from "./chunk-ZBK4XRAS.js";
 import {
   duplicate_read_outcome
-} from "./chunk-2RUPMGGV.js";
+} from "./chunk-PRDCNGA6.js";
 import {
   investigation_reads
-} from "./chunk-QNNWYQ2R.js";
+} from "./chunk-Y5OYCU2F.js";
 import {
   lane_guard_policy,
   time_batch_guard
-} from "./chunk-B4YNCUGB.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision,
   lane_child_marker,
   run_issue_number
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   PLATFORM_TEMP_ROOT,
   cost_attribute,
@@ -61,7 +61,7 @@ import {
   lane_paths,
   stamp_file,
   time_shell
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/hooks/pretool-guard.ts
 import { text } from "node:stream/consumers";

package/dist/hooks/{chunk-BIWLABFK.js → chunk-6MQCXEEA.js}

@@ -1,7 +1,7 @@
 import {
   ESLINT_EDIT_CACHE_FLAGS,
   time_density_hook
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/hooks/format-edited-file.ts
 import { existsSync as existsSync3 } from "node:fs";

package/dist/hooks/{chunk-GXKKK23T.js → chunk-FNFOLFFV.js}

@@ -3,7 +3,7 @@ import {
   stamp_file,
   time_density_hook,
   time_hook_transcript
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 import {
   josh_environment_file
 } from "./chunk-FXAKJKTB.js";

package/dist/hooks/{chunk-B2LIXYFL.js → chunk-FRJKVSK3.js}

@@ -1,10 +1,10 @@
 import {
   lane_guard_policy,
   time_batch_guard
-} from "./chunk-B4YNCUGB.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 
 // scripts/hooks/batch-guard.ts
 import { text } from "node:stream/consumers";

package/dist/hooks/{chunk-2RUPMGGV.js → chunk-PRDCNGA6.js}

@@ -1,16 +1,16 @@
 import {
   investigation_reads
-} from "./chunk-QNNWYQ2R.js";
+} from "./chunk-Y5OYCU2F.js";
 import {
   lane_guard_policy
-} from "./chunk-B4YNCUGB.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   json_value,
   time_spans
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/delegation/duplicate-read-guard.ts
 import { statSync } from "node:fs";

package/dist/hooks/{chunk-2XIGZQMQ.js → chunk-VGYSA2NT.js}

@@ -1,7 +1,7 @@
 import {
   lane_child_marker,
   run_issue_number
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   PLATFORM_TEMP_ROOT,
   cost_blocks,
@@ -11,7 +11,7 @@ import {
   time_density_hook,
   time_shell,
   time_transcript_line
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 import {
   ENV_FILE_NAME,
   LANE_SEAT_KEY,

package/dist/hooks/{chunk-QNNWYQ2R.js → chunk-Y5OYCU2F.js}

@@ -1,16 +1,16 @@
 import {
   time_batch_guard
-} from "./chunk-B4YNCUGB.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   cost_blocks,
   cost_transcript,
   time_bundle_call,
   time_shell,
   time_spans
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 
 // scripts/delegation/investigation-reads.ts
 import path from "node:path";

package/dist/hooks/{chunk-E55NKX5F.js → chunk-ZBK4XRAS.js}

@@ -1,12 +1,12 @@
 import {
   investigation_reads
-} from "./chunk-QNNWYQ2R.js";
+} from "./chunk-Y5OYCU2F.js";
 import {
   lane_guard_policy
-} from "./chunk-B4YNCUGB.js";
+} from "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 
 // scripts/delegation/investigation-guard.ts
 import { text } from "node:stream/consumers";

package/dist/hooks/codex-hook-adapter.js

@@ -1,24 +1,24 @@
 #!/usr/bin/env tsx
 import {
   pretool_guard
-} from "./chunk-WCYPBPJC.js";
-import "./chunk-2XIGZQMQ.js";
+} from "./chunk-4OXFU3MK.js";
+import "./chunk-VGYSA2NT.js";
 import {
   build_envelope,
   compose_context,
   format_edited_payload
-} from "./chunk-BIWLABFK.js";
-import "./chunk-B2LIXYFL.js";
-import "./chunk-E55NKX5F.js";
-import "./chunk-2RUPMGGV.js";
-import "./chunk-QNNWYQ2R.js";
-import "./chunk-B4YNCUGB.js";
+} from "./chunk-6MQCXEEA.js";
+import "./chunk-FRJKVSK3.js";
+import "./chunk-ZBK4XRAS.js";
+import "./chunk-PRDCNGA6.js";
+import "./chunk-Y5OYCU2F.js";
+import "./chunk-36UE53LS.js";
 import {
   hook_decision
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   time_density_hook
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 

package/dist/hooks/duplicate-read-guard.js

@@ -9,11 +9,11 @@ import {
   is_enabled,
   notice_refusal_path,
   refusal_path
-} from "./chunk-2RUPMGGV.js";
-import "./chunk-QNNWYQ2R.js";
-import "./chunk-B4YNCUGB.js";
-import "./chunk-GXKKK23T.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-PRDCNGA6.js";
+import "./chunk-Y5OYCU2F.js";
+import "./chunk-36UE53LS.js";
+import "./chunk-FNFOLFFV.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 export {

package/dist/hooks/format-edited.js

@@ -15,8 +15,8 @@ import {
   relative_to_root,
   resolve_invocations,
   select_invocation
-} from "./chunk-BIWLABFK.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-6MQCXEEA.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-SSX23SJ2.js";
 export {
   ESLINT_DAEMON,

package/dist/hooks/investigation-guard.js

@@ -10,11 +10,11 @@ import {
   is_enabled,
   load_environment_file,
   refusal_path
-} from "./chunk-E55NKX5F.js";
-import "./chunk-QNNWYQ2R.js";
-import "./chunk-B4YNCUGB.js";
-import "./chunk-GXKKK23T.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-ZBK4XRAS.js";
+import "./chunk-Y5OYCU2F.js";
+import "./chunk-36UE53LS.js";
+import "./chunk-FNFOLFFV.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 export {

package/dist/hooks/pretool-guard.js

@@ -3,15 +3,15 @@ import {
   pretool_guard,
   pretool_outcome,
   pretool_outcome_async
-} from "./chunk-WCYPBPJC.js";
-import "./chunk-2XIGZQMQ.js";
-import "./chunk-B2LIXYFL.js";
-import "./chunk-E55NKX5F.js";
-import "./chunk-2RUPMGGV.js";
-import "./chunk-QNNWYQ2R.js";
-import "./chunk-B4YNCUGB.js";
-import "./chunk-GXKKK23T.js";
-import "./chunk-KABG6AEW.js";
+} from "./chunk-4OXFU3MK.js";
+import "./chunk-VGYSA2NT.js";
+import "./chunk-FRJKVSK3.js";
+import "./chunk-ZBK4XRAS.js";
+import "./chunk-PRDCNGA6.js";
+import "./chunk-Y5OYCU2F.js";
+import "./chunk-36UE53LS.js";
+import "./chunk-FNFOLFFV.js";
+import "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 export {

package/dist/hooks/stop-guard.js

@@ -15,20 +15,20 @@ import {
   run_hold,
   run_invocation,
   run_watcher_guard
-} from "./chunk-2XIGZQMQ.js";
+} from "./chunk-VGYSA2NT.js";
 import {
   session_language
 } from "./chunk-6V5OPIUU.js";
 import {
   hook_decision,
   lane_child_marker
-} from "./chunk-GXKKK23T.js";
+} from "./chunk-FNFOLFFV.js";
 import {
   PROJECT_ROOT,
   stamp_file,
   time_density_hook,
   time_hook_transcript
-} from "./chunk-KABG6AEW.js";
+} from "./chunk-264QY6KS.js";
 import "./chunk-FXAKJKTB.js";
 import "./chunk-SSX23SJ2.js";
 

package/dist/josh.js

@@ -1173,6 +1173,12 @@ var PROJECT_COMMANDS = {
     category: "Project",
     reference: ["", "developer", ["files"]]
   },
+  "registry:migrate": {
+    script: "scripts/registry-migration/migrate.ts",
+    description: "Migrate a kit-only project from GitHub Packages to public npm",
+    category: "Project",
+    reference: ["", "developer", ["files", "network", "processes"]]
+  },
   "sync:scope": {
     script: "scripts/sync/managed-config-scope-cli.ts",
     description: "Say whether this change touches a file josh sync distributes",
@@ -1403,6 +1409,7 @@ var ALIASES = {
   pt: "port",
   i: "init",
   sy: "sync",
+  rmi: "registry:migrate",
   sys: "sync:scope",
   g: "git",
   gp: "pr",

package/dist/version/index.js

@@ -962,9 +962,17 @@ function run_upgrade_command(command) {
 }
 function run_all_upgrade_commands(commands) {
   let exit_code = 0;
+  const failed_commands = [];
   for (const command of commands) {
     const code = run_upgrade_command(command);
-    if (code !== 0) exit_code = code;
+    if (code === 0) continue;
+    exit_code = code;
+    failed_commands.push(command);
+  }
+  if (failed_commands.length > 0) {
+    console.error(
+      `Upgrade incomplete; successful steps remain applied. Failed: ${failed_commands.join(", ")}`
+    );
   }
   return exit_code;
 }

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.879.0",
+  "version": "1.883.0",
   "name": "@joshuafolkken/kit",
   "type": "module",
   "license": "MIT",
@@ -166,7 +166,7 @@
     }
   },
   "scripts": {
-    "preinstall": "pnpm dlx @aikidosec/safe-chain@1.5.1 setup-ci",
+    "preinstall": "pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci",
     "build": "tsx scripts/build/build-bin.ts && tsx scripts/build/build-hooks.ts && tsx scripts/build/build-version.ts && tsx scripts/build/build-config-merge.ts && tsx scripts/build/build-managed-marker.ts && tsx scripts/build/build-self-sync-guard.ts && tsx scripts/build/build-claude-md.ts",
     "josh": "tsx scripts/josh/josh.ts"
   }

package/pnpm-workspace.yaml

@@ -18,12 +18,9 @@ trustLockfile: true
 # `@types/node` and `tsx` are also excluded so routine Dependabot-style bumps are not
 # delayed by the minimum-release-age window.
 #
-# This list governs **pnpm's** `minimum-release-age` only. The `preinstall` hook installs
-# @aikidosec/safe-chain, which applies its own age policy and has no knowledge of these entries — a
-# package listed here is still hidden by safe-chain until it ages in. Pinning a dependency floor to
-# a release that safe-chain still withholds publishes a range no consumer can resolve (kit #742), so
-# `josh ranges` checks every published range against that filtered view — from `josh latest` right
-# after the ranges are rewritten, and again from `prepack` as the last gate before a publish.
+# `josh init` / `josh sync` mirror this list to Safe Chain's .aikido project config (kit #2618).
+# Older Safe Chain shims ignore .aikido and can still hide an excluded release. `josh ranges`
+# checks published dependency ranges through that filtered view before a release (kit #742).
 minimumReleaseAgeExclude:
   - vite
   - '@types/node'

package/scripts/init/init.ts

@@ -6,6 +6,7 @@ import { resolve_local_bin } from '#scripts/build/local-bin'
 import { doctor_io } from '#scripts/doctor/doctor-io'
 import { package_version_schema, with_package_manager_schema } from '#scripts/lib/schemas'
 import { auto_merge_setting } from '#scripts/repo/auto-merge-setting'
+import { project_config } from '#scripts/safe-chain/project-config'
 import { security_updates } from '#scripts/security/security-updates'
 import { did_refuse_self_run } from '#scripts/self-sync-guard/self-sync-refusal'
 import { sync } from '#scripts/sync/sync'
@@ -203,6 +204,7 @@ function main(): void {
 	merge_project_package_json()
 
 	run_ai_file_actions()
+	project_config.sync_project_config(PROJECT_ROOT)
 	console.info('\n✅ Done.\n')
 }
 

package/scripts/josh/__snapshots__/josh-command-map.test.ts.snap

@@ -102,6 +102,7 @@ exports[`COMMAND_MAP — reference metadata > keeps every canonical command and
     "rh": "run:hold",
     "rl": "report:lint",
     "rmg": "run:merge",
+    "rmi": "registry:migrate",
     "rn": "run:next",
     "rp": "run:prep",
     "rpy": "repo:party",
@@ -787,6 +788,15 @@ exports[`COMMAND_MAP — reference metadata > keeps every canonical command and
         "processes",
       ],
     ],
+    "registry:migrate": [
+      "",
+      "developer",
+      [
+        "files",
+        "network",
+        "processes",
+      ],
+    ],
     "release": [
       "[version]",
       "maintainer",

package/scripts/josh/josh-command-map.ts

@@ -54,6 +54,7 @@ const ALIASES: Record<string, string> = {
 	pt: 'port',
 	i: 'init',
 	sy: 'sync',
+	rmi: 'registry:migrate',
 	sys: 'sync:scope',
 	g: 'git',
 	gp: 'pr',

package/scripts/josh/josh-commands-project.ts

@@ -17,6 +17,12 @@ const PROJECT_COMMANDS: Record<string, CommandEntry> = {
 		category: 'Project',
 		reference: ['', 'developer', ['files']],
 	},
+	'registry:migrate': {
+		script: 'scripts/registry-migration/migrate.ts',
+		description: 'Migrate a kit-only project from GitHub Packages to public npm',
+		category: 'Project',
+		reference: ['', 'developer', ['files', 'network', 'processes']],
+	},
 	'sync:scope': {
 		script: 'scripts/sync/managed-config-scope-cli.ts',
 		description: 'Say whether this change touches a file josh sync distributes',

package/scripts/registry-migration/migrate-logic.ts

@@ -0,0 +1,229 @@
+import { fix_gh_packages_logic } from '#scripts/gh/fix-gh-packages-logic'
+
+const SCOPE = '@joshuafolkken'
+const REGISTRY_KEY = `${SCOPE}:registry`
+const PUBLIC_REGISTRY = 'https://registry.npmjs.org/'
+const GITHUB_REGISTRY = 'https://npm.pkg.github.com/'
+const MAPPING = `${REGISTRY_KEY}=${PUBLIC_REGISTRY}`
+const REGISTRY_VALUE_INDEX = 1
+const SPLIT_LIMIT = 2
+
+interface MigrationPlan {
+	content: string
+	packages: ReadonlyArray<string>
+	blocked: ReadonlyArray<string>
+	change: string
+}
+
+type IntegrityPair = readonly [string, string]
+
+function normalized_registry(value: string): string {
+	let normalized = value.trim()
+	while (normalized.endsWith('/')) normalized = normalized.slice(0, -1)
+
+	return `${normalized}/`
+}
+
+function mapping_lines(content: string): ReadonlyArray<string> {
+	return content.split(/\r?\n/u).filter((line) => line.trimStart().startsWith(`${REGISTRY_KEY}=`))
+}
+
+function registry_of(content: string): string | undefined {
+	const lines = mapping_lines(content)
+	if (lines.length !== 1) return undefined
+
+	return normalized_registry(lines[0]?.split('=', SPLIT_LIMIT)[REGISTRY_VALUE_INDEX] ?? '')
+}
+
+function scoped_packages(lockfile: string): ReadonlyArray<string> {
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile)
+
+	return Object.keys(packages)
+		.filter((key) => key.startsWith(`${SCOPE}/`))
+		.map((key) => fix_gh_packages_logic.package_path_from_key(key))
+		.filter((name, index, names) => names.indexOf(name) === index)
+}
+
+function scoped_versions(lockfile: string): ReadonlyArray<readonly [string, string]> {
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile)
+
+	return Object.keys(packages)
+		.filter((key) => key.startsWith(`${SCOPE}/`))
+		.map(
+			(key) =>
+				[
+					fix_gh_packages_logic.package_path_from_key(key),
+					fix_gh_packages_logic.package_version_from_key(key),
+				] as const,
+		)
+}
+
+function is_github_tarball(value: string): boolean {
+	try {
+		const url = new URL(value)
+
+		return url.protocol === 'https:' && url.hostname === 'npm.pkg.github.com'
+	} catch {
+		return false
+	}
+}
+
+function github_tarballs(lockfile: string): ReadonlyArray<string> {
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile)
+
+	return Object.entries(packages)
+		.filter(
+			([key, entry]) =>
+				key.startsWith(`${SCOPE}/`) &&
+				entry.resolution?.tarball !== undefined &&
+				is_github_tarball(entry.resolution.tarball),
+		)
+		.map(([key]) => key)
+}
+
+function remove_flow_tarball(line: string): string {
+	const marker = ', tarball: https://npm.pkg.github.com/'
+	const start = line.indexOf(marker)
+	if (start === -1) return line
+	const end = line.indexOf('}', start)
+	if (end === -1) return line
+
+	return `${line.slice(0, start)}${line.slice(end)}`
+}
+
+function is_package_entry(line: string): boolean {
+	return /^ {2}[^ ]/u.test(line)
+}
+
+function is_github_tarball_line(line: string): boolean {
+	return line.trimStart().startsWith('tarball: https://npm.pkg.github.com/')
+}
+
+function clean_kit_line(
+	line: string,
+	version: string,
+	integrities: ReadonlyMap<string, IntegrityPair>,
+): string | undefined {
+	if (!version) return line
+	if (is_github_tarball_line(line)) return undefined
+	const cleaned = remove_flow_tarball(line)
+	const pair = integrities.get(version)
+	if (pair === undefined) return cleaned
+
+	return cleaned.split(`integrity: ${pair[0]}`).join(`integrity: ${pair[1]}`)
+}
+
+function next_kit_version(line: string, version: string): string {
+	if (!is_package_entry(line)) return version
+	const prefix = "  '@joshuafolkken/kit@"
+
+	return line.startsWith(prefix) ? (line.slice(prefix.length).split("'", 1)[0] ?? '') : ''
+}
+
+function integrity_pair(
+	old_integrity: string | undefined,
+	npm_integrity: string | undefined,
+): IntegrityPair | undefined {
+	if (old_integrity === undefined || npm_integrity === undefined) return undefined
+
+	return [old_integrity, npm_integrity]
+}
+
+function lock_integrities(
+	lockfile: string,
+	npm_integrities: ReadonlyMap<string, string>,
+): Map<string, IntegrityPair> {
+	const packages = fix_gh_packages_logic.parse_lockfile_packages(lockfile)
+	const pairs = new Map<string, IntegrityPair>()
+	const kit_entries = Object.entries(packages).filter(([key]) => key.startsWith(`${SCOPE}/kit@`))
+
+	for (const [key, entry] of kit_entries) {
+		const version = fix_gh_packages_logic.package_version_from_key(key)
+		const pair = integrity_pair(entry.resolution?.integrity, npm_integrities.get(version))
+		if (pair !== undefined) pairs.set(version, pair)
+	}
+
+	return pairs
+}
+
+function push_if_defined(lines: Array<string>, cleaned: string | undefined): void {
+	if (cleaned !== undefined) lines.push(cleaned)
+}
+
+function rewrite_kit_lockfile(
+	lockfile: string,
+	npm_integrities: ReadonlyMap<string, string>,
+): string {
+	let kit_version = ''
+	const lines: Array<string> = []
+	const integrities = lock_integrities(lockfile, npm_integrities)
+
+	for (const line of lockfile.split('\n')) {
+		kit_version = next_kit_version(line, kit_version)
+		const cleaned = clean_kit_line(line, kit_version, integrities)
+
+		push_if_defined(lines, cleaned)
+	}
+
+	return lines.join('\n')
+}
+
+function append_mapping(content: string, eol: string): string {
+	const separator = content && !content.endsWith('\n') ? eol : ''
+
+	return `${content}${separator}${MAPPING}${eol}`
+}
+
+function replace_mapping(content: string): string {
+	const lines = mapping_lines(content)
+	const eol = content.includes('\r\n') ? '\r\n' : '\n'
+
+	if (lines.length === 0) return append_mapping(content, eol)
+
+	return content
+		.split(/\r?\n/u)
+		.map((line) => (line === lines[0] ? MAPPING : line))
+		.join(eol)
+}
+
+function unsupported_registry(project_npmrc: string): string | undefined {
+	const registry = registry_of(project_npmrc)
+
+	if (registry === undefined || [GITHUB_REGISTRY, PUBLIC_REGISTRY].includes(registry)) {
+		return undefined
+	}
+
+	return `unsupported project registry: ${registry}`
+}
+
+function has_duplicate_mapping(project_npmrc: string, user_npmrc: string): boolean {
+	return mapping_lines(project_npmrc).length > 1 || mapping_lines(user_npmrc).length > 1
+}
+
+function previous_registry(project_npmrc: string, user_npmrc: string): string {
+	return registry_of(project_npmrc) ?? registry_of(user_npmrc) ?? 'default npm'
+}
+
+function plan(project_npmrc: string, user_npmrc: string, lockfile: string): MigrationPlan {
+	const packages = scoped_packages(lockfile)
+	const blocked = packages.filter((name) => name !== `${SCOPE}/kit`)
+	if (has_duplicate_mapping(project_npmrc, user_npmrc)) blocked.push('duplicate registry mappings')
+	const unsupported = unsupported_registry(project_npmrc)
+	if (unsupported !== undefined) blocked.push(unsupported)
+	const before = previous_registry(project_npmrc, user_npmrc)
+	const change = `${before} → ${PUBLIC_REGISTRY}`
+
+	return { content: replace_mapping(project_npmrc), packages, blocked, change }
+}
+
+const migrate_logic = {
+	plan,
+	github_tarballs,
+	rewrite_kit_lockfile,
+	registry_of,
+	scoped_packages,
+	scoped_versions,
+}
+
+export { migrate_logic }
+export type { MigrationPlan }

package/scripts/registry-migration/migrate.ts

@@ -0,0 +1,280 @@
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { execa } from 'execa'
+import { z } from 'zod'
+import { migrate_logic, type MigrationPlan } from './migrate-logic'
+import { user_npmrc } from './user-npmrc'
+
+const NPMRC = '.npmrc'
+const LOCKFILE = 'pnpm-lock.yaml'
+const WORKSPACE = 'pnpm-workspace.yaml'
+const PUBLIC_REGISTRY = 'https://registry.npmjs.org/'
+const FETCH_TIMEOUT_MS = 10_000
+const SCOPE = '@joshuafolkken/'
+const manifest_schema = z.looseObject({
+	dependencies: z.record(z.string(), z.string()).optional(),
+	devDependencies: z.record(z.string(), z.string()).optional(),
+	optionalDependencies: z.record(z.string(), z.string()).optional(),
+	peerDependencies: z.record(z.string(), z.string()).optional(),
+})
+const version_schema = z.looseObject({
+	dist: z.looseObject({ integrity: z.string(), tarball: z.string() }),
+})
+
+function is_public_npm_url(value: string): boolean {
+	try {
+		const url = new URL(value)
+
+		return url.origin === 'https://registry.npmjs.org' && url.username === '' && url.password === ''
+	} catch {
+		return false
+	}
+}
+
+interface VersionCheck {
+	missing: ReadonlyArray<string>
+	integrities: ReadonlyMap<string, string>
+}
+
+async function probe_integrity(
+	name: string,
+	version: string,
+	probe_version: MigrationDependencies['fetch_version'],
+): Promise<string | undefined> {
+	if (!version) return undefined
+
+	return await probe_version(name, version)
+}
+
+interface MigrationDependencies {
+	fetch_version: (name: string, version: string) => Promise<string | undefined>
+	install: (cwd: string) => Promise<void>
+	effective_registry: (cwd: string) => Promise<string>
+	user_npmrc: string
+	environment: NodeJS.ProcessEnv
+}
+
+interface MigrationContext {
+	cwd: string
+	npmrc_path: string
+	lockfile_path: string
+	workspace_path: string
+	original_npmrc: string
+	original_lockfile: string
+	original_workspace: string
+	has_npmrc: boolean
+	has_lockfile: boolean
+	has_workspace: boolean
+	plan: MigrationPlan
+}
+
+function read_file(file_path: string): string {
+	return existsSync(file_path) ? readFileSync(file_path, 'utf8') : ''
+}
+
+function has_registry_override(environment: NodeJS.ProcessEnv): boolean {
+	return Object.keys(environment).some((key) =>
+		/^(?:npm|pnpm)_config_.*(?:joshuafolkken.*registry|userconfig)/iu.test(key),
+	)
+}
+
+function manifest_packages(content: string): ReadonlyArray<string> {
+	const manifest = manifest_schema.parse(JSON.parse(content))
+	const sections = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']
+
+	return sections.flatMap((section) => {
+		const value: unknown = Reflect.get(manifest, section)
+		if (typeof value !== 'object' || value === null) return []
+
+		return Object.keys(value).filter((name) => name.startsWith(SCOPE))
+	})
+}
+
+function restore(context: MigrationContext): void {
+	if (context.has_npmrc) writeFileSync(context.npmrc_path, context.original_npmrc)
+	else rmSync(context.npmrc_path, { force: true })
+	writeFileSync(context.lockfile_path, context.original_lockfile)
+	if (context.has_workspace) writeFileSync(context.workspace_path, context.original_workspace)
+	else rmSync(context.workspace_path, { force: true })
+}
+
+async function verify_public_versions(
+	lockfile: string,
+	probe_version: MigrationDependencies['fetch_version'],
+): Promise<VersionCheck> {
+	const missing: Array<string> = []
+	const integrities = new Map<string, string>()
+
+	for (const [name, version] of migrate_logic.scoped_versions(lockfile)) {
+		const integrity = await probe_integrity(name, version, probe_version)
+		if (integrity === undefined) missing.push(`${name}@${version}`)
+		else integrities.set(version, integrity)
+	}
+
+	return { missing, integrities }
+}
+
+function report_context(context: MigrationContext): void {
+	console.info(`Current registry and planned change: ${context.plan.change}`)
+	console.info(`Installed scoped packages: ${context.plan.packages.join(', ') || '(none)'}`)
+}
+
+function create_context(cwd: string, dependencies: MigrationDependencies): MigrationContext {
+	const npmrc_path = path.join(cwd, NPMRC)
+	const lockfile_path = path.join(cwd, LOCKFILE)
+	const workspace_path = path.join(cwd, WORKSPACE)
+	const original_npmrc = read_file(npmrc_path)
+	const original_lockfile = read_file(lockfile_path)
+	const original_workspace = read_file(workspace_path)
+	const plan = migrate_logic.plan(original_npmrc, dependencies.user_npmrc, original_lockfile)
+
+	return {
+		cwd,
+		npmrc_path,
+		lockfile_path,
+		workspace_path,
+		original_npmrc,
+		original_lockfile,
+		original_workspace,
+		plan,
+		has_npmrc: existsSync(npmrc_path),
+		has_lockfile: existsSync(lockfile_path),
+		has_workspace: existsSync(workspace_path),
+	}
+}
+
+function initial_block(
+	context: MigrationContext,
+	dependencies: MigrationDependencies,
+): string | undefined {
+	if (!context.has_lockfile) return 'No lockfile; run pnpm install before migrating.'
+	const manifest = manifest_packages(read_file(path.join(context.cwd, 'package.json')))
+	const missing_lock = manifest.filter((name) => !context.plan.packages.includes(name))
+	const blocked = [...context.plan.blocked, ...missing_lock]
+	if (!context.plan.packages.includes(`${SCOPE}kit`)) blocked.push('kit is absent from lockfile')
+	if (has_registry_override(dependencies.environment)) blocked.push('registry environment override')
+	if (blocked.length === 0) return undefined
+
+	return `Migration blocked: ${blocked.join(', ')}. Keep GitHub Packages until every package is available on npm.`
+}
+
+async function verify_resolution(
+	context: MigrationContext,
+	dependencies: MigrationDependencies,
+	integrities: ReadonlyMap<string, string>,
+): Promise<void> {
+	await dependencies.install(context.cwd)
+
+	if (read_file(context.workspace_path) !== context.original_workspace) {
+		throw new Error('pnpm changed pnpm-workspace.yaml outside the migration')
+	}
+
+	const actual = await dependencies.effective_registry(context.cwd)
+	if (!is_public_npm_url(actual)) throw new Error(`effective registry is ${actual}`)
+	const lockfile = read_file(context.lockfile_path)
+	const old_tarballs = migrate_logic.github_tarballs(lockfile)
+	if (old_tarballs.length > 0) throw new Error(`GitHub tarballs remain: ${old_tarballs.join(', ')}`)
+
+	if (migrate_logic.rewrite_kit_lockfile(lockfile, integrities) !== lockfile) {
+		throw new Error('lockfile integrity does not match public npm')
+	}
+}
+
+async function apply(
+	context: MigrationContext,
+	dependencies: MigrationDependencies,
+	integrities: ReadonlyMap<string, string>,
+): Promise<string> {
+	try {
+		writeFileSync(context.npmrc_path, context.plan.content)
+		writeFileSync(
+			context.lockfile_path,
+			migrate_logic.rewrite_kit_lockfile(context.original_lockfile, integrities),
+		)
+		await verify_resolution(context, dependencies, integrities)
+	} catch (error) {
+		restore(context)
+
+		return `Migration blocked; original settings restored: ${String(error)}`
+	}
+
+	return 'Migrated to public npm. The project registry and lockfile now resolve from npm.'
+}
+
+function is_already_migrated(
+	context: MigrationContext,
+	integrities: ReadonlyMap<string, string>,
+): boolean {
+	return (
+		context.plan.content === context.original_npmrc &&
+		migrate_logic.rewrite_kit_lockfile(context.original_lockfile, integrities) ===
+			context.original_lockfile
+	)
+}
+
+async function migrate(cwd: string, dependencies: MigrationDependencies): Promise<string> {
+	const context = create_context(cwd, dependencies)
+
+	report_context(context)
+	const block = initial_block(context, dependencies)
+	if (block !== undefined) return block
+	const version_check = await verify_public_versions(
+		context.original_lockfile,
+		dependencies.fetch_version,
+	)
+
+	if (version_check.missing.length > 0) {
+		return `Migration blocked: unpublished on npm: ${version_check.missing.join(', ')}.`
+	}
+
+	if (is_already_migrated(context, version_check.integrities)) {
+		return 'Already using public npm; no changes made.'
+	}
+
+	return await apply(context, dependencies, version_check.integrities)
+}
+
+async function fetch_version(name: string, version: string): Promise<string | undefined> {
+	const encoded = encodeURIComponent(name)
+	const response = await fetch(`${PUBLIC_REGISTRY}${encoded}/${encodeURIComponent(version)}`, {
+		signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+	})
+
+	if (!response.ok) return undefined
+	const parsed = version_schema.safeParse(await response.json())
+	if (!parsed.success || !is_public_npm_url(parsed.data.dist.tarball)) return undefined
+
+	return parsed.data.dist.integrity
+}
+
+async function install(cwd: string): Promise<void> {
+	await execa('pnpm', ['install', '--lockfile-only', '--ignore-scripts', '--force'], { cwd })
+}
+
+async function effective_registry(cwd: string): Promise<string> {
+	const result = await execa('pnpm', ['config', 'get', '@joshuafolkken:registry'], { cwd })
+
+	return result.stdout.trim()
+}
+
+async function main(): Promise<void> {
+	const result = await migrate(process.cwd(), {
+		fetch_version,
+		install,
+		effective_registry,
+		user_npmrc: user_npmrc.read(),
+		environment: process.env,
+	})
+
+	console.info(result)
+
+	if (result.startsWith('Migration blocked') || result.startsWith('No lockfile')) process.exit(1)
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
+
+const registry_migration = { migrate }
+
+export { registry_migration }
+export type { MigrationDependencies }

package/scripts/registry-migration/user-npmrc.ts

@@ -0,0 +1,15 @@
+import { existsSync, readFileSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const NPMRC = '.npmrc'
+
+function read(home: string = os.homedir()): string {
+	const file = path.join(home, NPMRC)
+
+	return existsSync(file) ? readFileSync(file, 'utf8') : ''
+}
+
+const user_npmrc = { read }
+
+export { user_npmrc }

package/scripts/safe-chain/project-config.ts

@@ -0,0 +1,104 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { yaml_document } from '#scripts/yaml/yaml-document'
+import { dump } from 'js-yaml'
+import { z } from 'zod'
+
+const WORKSPACE_FILE = 'pnpm-workspace.yaml'
+const PROJECT_CONFIG_FILE = '.aikido'
+const EXCLUSIONS_FIELD = 'minimumPackageAgeExclusions'
+const workspace_schema = z.object({ minimumReleaseAgeExclude: z.array(z.string()).optional() })
+
+function read_mapping(value: unknown, label: string): Record<string, unknown> {
+	if (value === undefined) return {}
+	if (yaml_document.is_mapping_document(value)) return value
+	throw new Error(`${label} must be a YAML mapping`)
+}
+
+function is_block_line(line: string): boolean {
+	return line.trim() === '' || line.startsWith(' ') || line.startsWith('\t')
+}
+
+function trim_block_end(lines: ReadonlyArray<string>, start: number, end: number): number {
+	let trimmed = end
+	while (trimmed > start + 1 && lines[trimmed - 1]?.trim() === '') trimmed -= 1
+
+	return trimmed
+}
+
+function find_block_end(lines: ReadonlyArray<string>, start: number): number {
+	const remaining = lines.slice(start + 1)
+	const relative = remaining.findIndex((line, index) => {
+		if (is_block_line(line)) return false
+		if (!line.startsWith('#')) return true
+		const next = remaining
+			.slice(index + 1)
+			.find((candidate) => candidate.trim() !== '' && !candidate.startsWith('#'))
+
+		return next === undefined || !is_block_line(next)
+	})
+	const end = relative === -1 ? lines.length : start + 1 + relative
+
+	return trim_block_end(lines, start, end)
+}
+
+function append_block(existing: string, block: string): string {
+	if (existing.length === 0) return block
+	const prefix = existing.endsWith('\n') ? existing : `${existing}\n`
+
+	return `${prefix}\n${block}`
+}
+
+function preserve_anchor(block: string, key_line: string): string {
+	const anchor = /(?:^|\s)(&[^\s#]+)/u.exec(key_line)?.[1]
+	if (!anchor) return block
+	const header = 'safe-chain:'
+
+	return `${header} ${anchor}${block.slice(header.length)}`
+}
+
+function replace_safe_chain_block(existing: string, safe_chain: Record<string, unknown>): string {
+	const block = dump({ 'safe-chain': safe_chain }, { lineWidth: -1 })
+	const lines = existing.split('\n')
+	const start = lines.findIndex((line) =>
+		/^(?:safe-chain|'safe-chain'|"safe-chain")\s*:/u.test(line),
+	)
+	if (start === -1) return append_block(existing, block)
+	const replacement = preserve_anchor(block, lines[start] ?? '')
+	const end = find_block_end(lines, start)
+	const prefix = lines.slice(0, start).join('\n')
+	const suffix = lines.slice(end).join('\n')
+
+	return `${prefix}${prefix ? '\n' : ''}${replacement}${suffix}`
+}
+
+function merge_project_config(existing: string, workspace: string): string {
+	const source = workspace_schema.parse(yaml_document.parse_yaml(workspace))
+	const exclusions = source.minimumReleaseAgeExclude ?? []
+	const aikido = yaml_document.parse_yaml(existing)
+	const safe_chain = read_mapping(aikido['safe-chain'], 'safe-chain')
+	const npm = read_mapping(safe_chain['npm'], 'safe-chain.npm')
+	if (JSON.stringify(npm[EXCLUSIONS_FIELD]) === JSON.stringify(exclusions)) return existing
+	if (exclusions.length === 0 && existing.length === 0) return existing
+
+	const merged = { ...safe_chain, npm: { ...npm, [EXCLUSIONS_FIELD]: exclusions } }
+
+	return replace_safe_chain_block(existing, merged)
+}
+
+function sync_project_config(root: string): boolean {
+	const workspace_path = path.join(root, WORKSPACE_FILE)
+	if (!existsSync(workspace_path)) return false
+	const config_path = path.join(root, PROJECT_CONFIG_FILE)
+	const existing = existsSync(config_path) ? readFileSync(config_path, 'utf8') : ''
+	const workspace = readFileSync(workspace_path, 'utf8')
+	const merged = merge_project_config(existing, workspace)
+	if (merged === existing) return false
+	writeFileSync(config_path, merged)
+
+	return true
+}
+
+const project_config = { merge_project_config, sync_project_config }
+
+export { project_config }

package/scripts/sync/sync.ts

@@ -8,6 +8,7 @@ import { init_logic } from '#scripts/init/init-logic'
 import { PACKAGE_DIR, PROJECT_ROOT } from '#scripts/init/init-paths'
 import { plugin_install_hint_module } from '#scripts/init/plugin-install-hint'
 import { auto_merge_setting } from '#scripts/repo/auto-merge-setting'
+import { project_config } from '#scripts/safe-chain/project-config'
 import { security_updates } from '#scripts/security/security-updates'
 import { sonar_file } from '#scripts/security/sonar-file'
 import { did_refuse_self_run } from '#scripts/self-sync-guard/self-sync-refusal'
@@ -367,6 +368,7 @@ function report_repository_settings(name_with_owner: string | undefined): void {
 
 function sync_project_artifacts(is_force: boolean): void {
 	sync_ai_copy_all(is_force)
+	project_config.sync_project_config(PROJECT_ROOT)
 	sync_prettier_config(path.join(PROJECT_ROOT, 'prettier.config.js'))
 	sync_playwright_config(path.join(PROJECT_ROOT, 'playwright.config.ts'))
 	sync_deploy_vps(path.join(PROJECT_ROOT, '.github/workflows/deploy-vps.yml'))

package/scripts/version/publishable-range.ts

@@ -9,9 +9,9 @@ import semver from 'semver'
 // The check asks the registry through that same filtered view instead of modelling the policy:
 // `pnpm view <name>@<range> version` prints no version and exits non-zero
 // (ERR_PNPM_PACKAGE_NOT_FOUND) exactly when nothing visible satisfies the range. Modelling would
-// mean guessing safe-chain's threshold, and `minimumReleaseAgeExclude` cannot stand in for it —
-// that list governs pnpm's own `minimum-release-age`, and safe-chain has no knowledge of it, which
-// is precisely what made the original failure surprising.
+// mean guessing safe-chain's threshold. `josh init` / `josh sync` now mirror
+// `minimumReleaseAgeExclude` into Safe Chain's .aikido project config (kit #2618), but older
+// installed shims ignore it and published ranges must still be checked against their filtered view.
 
 interface PublishedRange {
 	name: string

package/scripts/version/version-commands.ts

@@ -204,10 +204,19 @@ function run_upgrade_command(command: string): number {
 // succeed) so a failure on either target is surfaced without aborting the remaining upgrades.
 function run_all_upgrade_commands(commands: ReadonlyArray<string>): number {
 	let exit_code = 0
+	const failed_commands: Array<string> = []
 
 	for (const command of commands) {
 		const code = run_upgrade_command(command)
-		if (code !== 0) exit_code = code
+		if (code === 0) continue
+		exit_code = code
+		failed_commands.push(command)
+	}
+
+	if (failed_commands.length > 0) {
+		console.error(
+			`Upgrade incomplete; successful steps remain applied. Failed: ${failed_commands.join(', ')}`,
+		)
 	}
 
 	return exit_code

package/templates/workflows/ci.yml

@@ -178,7 +178,7 @@ jobs:
             ${{ runner.os }}-cspell-cache-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.1 setup-ci
+        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
 
       - name: Install dependencies
         env:
@@ -400,7 +400,7 @@ jobs:
             ${{ runner.os }}-build-cache-e2e-
 
       - name: Setup safe-chain
-        run: pnpm dlx @aikidosec/safe-chain@1.5.1 setup-ci
+        run: pnpm dlx @aikidosec/safe-chain@1.5.20 setup-ci
 
       - name: Install dependencies
         env: