chore(packages): organize package.json files#238
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThe PR updates repository and package metadata, adjusts package export maps, removes a refresh failure warning, and consolidates Aura authentication error handling in the router. ChangesRepository and package metadata
Core error handling
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/device/package.json`:
- Around line 36-39: Update publishConfig.registry to the npm registry base URL
https://registry.npmjs.org/ in packages/device/package.json (lines 36-39),
packages/next/package.json (lines 38-41), packages/rate-limiter/package.json
(lines 37-39), packages/react-router/package.json (lines 38-41), and
packages/react/package.json (lines 38-41), removing each package-specific path
while preserving the existing public access setting.
In `@packages/elysia/package.json`:
- Around line 38-41: Replace each package-specific publishConfig.registry value
with the npm registry base URL, matching packages/integration/package.json.
Apply this change in packages/elysia/package.json (lines 38-41),
packages/express/package.json (lines 38-41), packages/hono/package.json (lines
38-41), and packages/jose/package.json (lines 37-39); leave the access settings
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2b472829-d3bb-4f47-b97a-ba19bb19384e
⛔ Files ignored due to path filters (1)
deno.lockis excluded by!**/*.lock
📒 Files selected for processing (15)
docs/src/content/docs/(core)/contributing.mdxpackage.jsonpackages/core/package.jsonpackages/core/src/api/refreshUserInfo.tspackages/core/src/router/errorHandler.tspackages/device/package.jsonpackages/elysia/package.jsonpackages/express/package.jsonpackages/hono/package.jsonpackages/integration/package.jsonpackages/jose/package.jsonpackages/next/package.jsonpackages/rate-limiter/package.jsonpackages/react-router/package.jsonpackages/react/package.json
💤 Files with no reviewable changes (1)
- packages/core/src/api/refreshUserInfo.ts
| "publishConfig": { | ||
| "access": "public", | ||
| "registry": "https://registry.npmjs.org/@aura-stack/device" | ||
| }, |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== candidate package.json files =="
for f in packages/device/package.json packages/next/package.json packages/rate-limiter/package.json packages/react-router/package.json packages/react/package.json; do
if [ -f "$f" ]; then
echo "--- $f ---"
sed -n '1,80p' "$f" | grep -n -A4 -B2 'publishConfig\|registry' || true
else
echo "MISSING $f"
fi
done
echo
echo "== references to NPM_REGISTRY / registry settings =="
rg -n "NPM_REGISTRY|registry\.npmjs\.org|publishConfig|npm_package_publish" -S . --glob '!node_modules' --glob '!dist' --glob '!build' || trueRepository: aura-stack-ts/auth
Length of output: 3311
🌐 Web query:
npm publishConfig registry package.json registry base URL documentation
💡 Result:
In npm, the publishConfig field in package.json is a dictionary of configuration values that are applied specifically at publish-time [1][2]. This allows you to override default registry settings to ensure a package is published to a specific destination, such as an internal or private registry [1][2]. To specify a registry, you add the registry key within the publishConfig object in your package.json file [3][1]: "publishConfig": { "registry": "https://registry.example.com/" } For scoped packages, you can also define a registry for a specific scope by using the scope name as the key, formatted with a colon separator [4]: "publishConfig": { "@my-scope:registry": "https://registry.example.com/" } Key points regarding the registry configuration: - Purpose: It ensures that a package is not accidentally published to the global public registry when you intend for it to go to a private or internal registry [1][2]. - Precedence: publishConfig settings are applied only when the npm publish command is executed [1][5]. - Scope-specific configuration: Using the @scope:registry syntax allows for granular control, which is particularly useful in environments where different scopes must point to different registry endpoints [4]. For more comprehensive information on available configuration options that can be overridden via publishConfig, refer to the official npm documentation on configuration [1][5].
Citations:
- 1: https://docs.npmjs.com/cli/v11/configuring-npm/package-json/
- 2: https://docs.npmjs.com/cli/v9/configuring-npm/package-json/
- 3: https://docs.github.com/packages/working-with-a-github-packages-registry/working-with-the-npm-registry
- 4: [BUG]
publishConfig.registryinpackage.jsonshould take higher priority than project level.npmrcnpm/cli#7043 - 5: https://github.com/npm/cli/blob/latest/docs/lib/content/configuring-npm/package-json.md
Use the npm registry base URL in every package manifest.
publishConfig.registry overrides npm registry configuration, and it should be a registry base URL. Package-specific URLs such as https://registry.npmjs.org/@aura-stack/device are invalid publish targets and can break publishing. Set this to https://registry.npmjs.org/ across the scopes.
packages/device/package.json#L36-L39packages/next/package.json#L38-L41packages/rate-limiter/package.json#L37-L39packages/react-router/package.json#L38-L41packages/react/package.json#L38-L41
📍 Affects 5 files
packages/device/package.json#L36-L39(this comment)packages/next/package.json#L38-L41packages/rate-limiter/package.json#L37-L39packages/react-router/package.json#L38-L41packages/react/package.json#L38-L41
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/device/package.json` around lines 36 - 39, Update
publishConfig.registry to the npm registry base URL https://registry.npmjs.org/
in packages/device/package.json (lines 36-39), packages/next/package.json (lines
38-41), packages/rate-limiter/package.json (lines 37-39),
packages/react-router/package.json (lines 38-41), and
packages/react/package.json (lines 38-41), removing each package-specific path
while preserving the existing public access setting.
| "publishConfig": { | ||
| "access": "public", | ||
| "registry": "https://registry.npmjs.org/@aura-stack/elysia" | ||
| }, |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== matching package.json publishConfig.registry values =="
for f in packages/elysia/package.json packages/express/package.json packages/hono/package.json packages/jose/package.json packages/integration/package.json; do
if [ -f "$f" ]; then
echo "-- $f"
rg -n '"publishConfig"|"registry"|"name":|npm' "$f" || true
else
echo "-- missing $f"
fi
done
echo
echo "== package.json field context =="
python3 - <<'PY'
import json
from pathlib import Path
for p in ["packages/elysia/package.json","packages/express/package.json","packages/hono/package.json","packages/jose/package.json","packages/integration/package.json"]:
try:
data=json.loads(Path(p).read_text())
except Exception as e:
print(f"{p}: parse error {e}")
continue
print(f"{p}: name={data.get('name')!r} publishConfig={data.get('publishConfig')!r}")
PYRepository: aura-stack-ts/auth
Length of output: 2463
🌐 Web query:
npm publishConfig registry override package endpoint registry base URL documentation
💡 Result:
The publishConfig field in package.json is a dictionary of npm configuration values that are applied specifically at publish-time [1][2]. Its primary purpose is to ensure that a package is published to a specific registry, or with specific settings (like access level or distribution tags), overriding the default global or project-level configuration [1][3][2]. When publishing a package, npm utilizes these settings to determine the target registry endpoint [1][3]. For example, to force a package to be published to an internal or private registry, you can define the following in your package.json: "publishConfig": { "registry": "https://registry.example.com/" } Regarding configuration precedence and overrides: 1. CLI Flags: As of recent npm CLI versions (specifically addressing issues where publishConfig could not be overridden), command-line flags generally take precedence over settings defined in publishConfig [4][5]. This allows you to override the registry during a specific execution by using: npm publish --registry=https://custom-registry.url 2. publishConfig vs..npmrc: While both are project-level configurations, publishConfig is explicitly designed to handle settings during the publish lifecycle [1][6]. Historically, there has been nuance regarding how these are merged, but publishConfig in package.json is intended to be the definitive source of truth for publish-time behavior for that specific package [1][2]. 3. Scoped Registries: For scoped packages, you can also specify the registry for that specific scope within publishConfig (e.g., "publishConfig": { "@my-scope:registry": "https://registry.example.com/" }). This is often used in conjunction with.npmrc files that handle installation-time registry resolution [6]. Top results: [1][3][6][4][5][2][7]
Citations:
- 1: https://docs.npmjs.com/cli/v9/configuring-npm/package-json/
- 2: https://docs.npmjs.com/cli/v10/configuring-npm/package-json/
- 3: https://docs.npmjs.com/cli/v8/using-npm/registry/
- 4: fix: prioritize CLI flags over publishConfig settings npm/cli#7321
- 5: [BUG] no way to
npm publisha tarball whose package.json includes publishConfig.registry to a private registry npm/cli#6400 - 6: [BUG]
publishConfig.registryinpackage.jsonshould take higher priority than project level.npmrcnpm/cli#7043 - 7: https://docs.github.com/packages/working-with-a-github-packages-registry/working-with-the-npm-registry
🌐 Web query:
npm registry scoped packages publish URL registry/package-name version
💡 Result:
To publish a scoped package to a specific registry, you do not use a single URL string in the command line syntax [1][2][3]. Instead, the npm CLI determines the target registry based on your configuration [1][4][3]. There are three primary ways to define the registry for a scoped package: 1. Per-scope configuration in.npmrc: You can associate a specific scope with a registry URL in your.npmrc file [4]. This is the most common method for organization or private registries [5][4]. @your-scope:registry=https://registry.example.com/ 2. Using publishConfig in package.json: You can pin a package to a specific registry by adding a publishConfig block to your package.json [3]. This overrides other configurations for that specific package [3]. "publishConfig": { "registry": "https://registry.example.com/" } 3. Command-line flag (registry override): You can explicitly override the registry for a single publish command using the --registry flag [3]. npm publish --registry=https://registry.example.com/ Key Considerations for Scoped Packages: - Access Level: Scoped packages default to restricted (private) visibility [6][2][7]. To make a package public, you must explicitly include the --access public flag on your initial publish [8][6][2]. npm publish --access public - Authentication: When publishing to a private or custom registry, ensure your.npmrc contains the necessary authentication token for that specific registry URL [5][3]. //registry.example.com/:_authToken=YOUR_TOKEN The versioning and package name (e.g., @scope/package-name) are defined within your package.json, and the npm client automatically handles the request to the registry configured for that scope [4][3].
Citations:
- 1: https://docs.npmjs.com/cli/v11/commands/npm-publish/
- 2: https://docs.npmjs.com/cli/v8/commands/npm-publish/
- 3: https://pier.team/docs/registry/publish
- 4: https://docs.npmjs.com/cli/v8/using-npm/scope/
- 5: https://docs.gitlab.com/user/packages/npm_registry/?tab=For+an+instance
- 6: https://docs.npmjs.com/cli/v11/using-npm/scope/
- 7: https://docs.npmjs.com/creating-and-publishing-an-organization-scoped-package/
- 8: https://docs.npmjs.com/creating-and-publishing-scoped-public-packages/
Use the npm registry base URL in publishConfig.registry.
publishConfig.registry is treated as the registry base URL, not a package-specific endpoint. The current package endpoints (@aura-stack/elysia, @aura-stack/express, @aura-stack/hono, @aura-stack/jose) can make publish requests target invalid registry paths; keep them consistent with packages/integration/package.json.
Proposed fix
- "registry": "https://registry.npmjs.org/@aura-stack/elysia"
+ "registry": "https://registry.npmjs.org/"
- "registry": "https://registry.npmjs.org/@aura-stack/express"
+ "registry": "https://registry.npmjs.org/"
- "registry": "https://registry.npmjs.org/@aura-stack/hono"
+ "registry": "https://registry.npmjs.org/"
- "registry": "https://registry.npmjs.org/@aura-stack/jose"
+ "registry": "https://registry.npmjs.org/"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "publishConfig": { | |
| "access": "public", | |
| "registry": "https://registry.npmjs.org/@aura-stack/elysia" | |
| }, | |
| "publishConfig": { | |
| "access": "public", | |
| "registry": "https://registry.npmjs.org/" | |
| }, |
📍 Affects 4 files
packages/elysia/package.json#L38-L41(this comment)packages/express/package.json#L38-L41packages/hono/package.json#L38-L41packages/jose/package.json#L37-L39
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/elysia/package.json` around lines 38 - 41, Replace each
package-specific publishConfig.registry value with the npm registry base URL,
matching packages/integration/package.json. Apply this change in
packages/elysia/package.json (lines 38-41), packages/express/package.json (lines
38-41), packages/hono/package.json (lines 38-41), and packages/jose/package.json
(lines 37-39); leave the access settings unchanged.
1 participant
Summary by CodeRabbit
Documentation
Bug Fixes
Package Metadata
Breaking Changes
./typessubpath export from the React and React Router packages.