build: depend on @celados/argc, ship a bundled CLI artifact

.github/workflows/ci.yml

@@ -28,6 +28,13 @@ jobs:
         with:
           bun-version: 1.3.10
 
+      - name: Configure Celados npm registry
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          printf '%s\n' '@celados:registry=https://npm.celados.com' > .npmrc
+          printf '%s\n' "//npm.celados.com/:_authToken=${NODE_AUTH_TOKEN}" >> .npmrc
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 

.github/workflows/release.yml

@@ -58,6 +58,14 @@ jobs:
           fi
           bun run ./packages/gkit/scripts/release-preflight.ts "${args[@]}"
 
+      - name: Configure Celados npm registry
+        if: steps.preflight.outputs.release == 'true'
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          printf '%s\n' '@celados:registry=https://npm.celados.com' > .npmrc
+          printf '%s\n' "//npm.celados.com/:_authToken=${NODE_AUTH_TOKEN}" >> .npmrc
+
       - name: Install frozen dependencies
         if: steps.preflight.outputs.release == 'true'
         run: bun install --frozen-lockfile

README.md

@@ -248,6 +248,8 @@ aliases or deprecated binaries. Historical behavior evidence remains under
 
 ## Verification
 
+Development dependencies include `@celados/argc` from the private team registry `npm.celados.com`. Before `bun install`, write a gitignored `.npmrc` that maps `@celados` to that registry with the team token (template: `.npmrc.tpl` in `celados/argc`, rendered with `latch render`). CI does the same from the `NPM_TOKEN` secret. The release artifact is a bundle and needs no registry access.
+
 ```bash
 bun run eval
 bun run check-types

package.json

@@ -10,7 +10,7 @@
       "@types/node": "^25.6.0",
       "@valibot/to-json-schema": "^1.6.0",
       "ajv": "^8.20.0",
-      "argc": "github:ethan-huo/argc#v7.11.1",
+      "@celados/argc": "^7.11.3",
       "bun-types": "^1.3.13",
       "dataforseo-client": "^2.0.25",
       "dotenv": "^17.2.2",

packages/gkit/package.json

@@ -1,22 +1,21 @@
 {
   "name": "gkit",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "private": true,
   "description": "Profile-bound, agent-first growth provider CLI.",
   "bin": {
-    "gkit": "bin/gkit.js"
+    "gkit": "dist/gkit.js"
   },
   "files": [
-    "bin",
+    "dist",
     "docs",
-    "generated",
-    "src",
-    "!**/*.test.ts"
+    "generated"
   ],
   "type": "module",
   "sideEffects": false,
   "scripts": {
     "cli": "bun run ./src/cli.ts",
+    "build": "bun build ./bin/gkit.js --target=bun --outfile=dist/gkit.js",
     "check-types": "tsc --noEmit",
     "generate:dataforseo": "bun run ./scripts/generate-dataforseo.ts",
     "generate:dataforseo:check": "bun run ./scripts/generate-dataforseo.ts --check",
@@ -35,24 +34,22 @@
     "test:once": "vitest run && bun run test:site",
     "test:site": "bun run ./scripts/test-site-snapshot.ts"
   },
-  "dependencies": {
+  "devDependencies": {
+    "@celados/argc": "^7.11.3",
     "@standard-schema/spec": "^1.0.0",
+    "@types/bun": "^1.3.10",
+    "@types/node": "^25.6.0",
     "@valibot/to-json-schema": "^1.6.0",
     "ajv": "^8.20.0",
-    "argc": "github:ethan-huo/argc#v7.11.1",
+    "bun-types": "^1.3.13",
     "cheerio": "^1.2.0",
     "dotenv": "^17.2.2",
     "google-auth-library": "^10.9.0",
     "robots-parser": "3.0.1",
     "saxes": "6.0.0",
+    "typescript": "^5",
     "valibot": "^1.2.0",
+    "vitest": "^4.0.18",
     "yaml": "^2.9.0"
-  },
-  "devDependencies": {
-    "@types/bun": "^1.3.10",
-    "@types/node": "^25.6.0",
-    "bun-types": "^1.3.13",
-    "typescript": "^5",
-    "vitest": "^4.0.18"
   }
 }

packages/gkit/scripts/verify-package-artifact.ts

@@ -15,7 +15,7 @@ type PackageJson = Readonly<{
   private?: unknown;
 }>;
 
-const allowedTopLevelEntries = new Set(["bin", "docs", "generated", "package.json", "src"]);
+const allowedTopLevelEntries = new Set(["dist", "docs", "generated", "package.json"]);
 const forbiddenPathPattern =
   /(^|\/)(?:\.env(?:\..*)?|\.npmrc|bunfig\.toml|[^/]*\.test\.[^/]+|__tests__|evals?|scripts?|sources?|policy)(?:\/|$)/i;
 const secretMaterialPatterns = [
@@ -45,6 +45,9 @@ try {
     throw new Error("The gkit package must remain private to prevent registry publication.");
   }
 
+  // The artifact ships a Bun bundle: runtime deps (incl. the private @celados/argc)
+  // are inlined, so public consumers install with no registry auth.
+  await runCommand(["bun", "run", "build"], packageRoot);
   const packed = await runCommand(
     ["npm", "pack", "--json", "--pack-destination", packDirectory, packageRoot],
     temporaryRoot,
@@ -154,7 +157,7 @@ function parseOutputDirectory(arguments_: readonly string[]): string | undefined
 }
 
 async function verifyPackageContents(paths: readonly string[]): Promise<void> {
-  if (!paths.includes("bin/gkit.js") || !paths.includes("package.json")) {
+  if (!paths.includes("dist/gkit.js") || !paths.includes("package.json")) {
     throw new Error("The package is missing its binary or package manifest.");
   }
   if (!paths.some((path) => path.startsWith("generated/"))) {

packages/gkit/src/cli.ts

@@ -1,6 +1,6 @@
 import { fileURLToPath } from "node:url";
 
-import { ensureTrailingNewline, formatBareSkill } from "argc/skill";
+import { ensureTrailingNewline, formatBareSkill } from "@celados/argc/skill";
 
 import { parseArgs, renderHelp } from "./args";
 import { embedSkill } from "./skill.embed";

packages/gkit/src/schema.ts

@@ -1,6 +1,6 @@
 import { siteRouter } from "./site/schema";
 import { toStandardJsonSchema } from "@valibot/to-json-schema";
-import { c, generateSchema, group, selectSchema, type Router } from "argc";
+import { c, generateSchema, group, selectSchema, type Router } from "@celados/argc";
 import * as v from "valibot";
 
 import { GkitFailure } from "./envelope";

packages/gkit/src/site/schema.ts

@@ -1,4 +1,4 @@
-import { c, group } from "argc";
+import { c, group } from "@celados/argc";
 import { toStandardJsonSchema as s } from "@valibot/to-json-schema";
 import * as v from "valibot";
 const command = (description: string, input: v.GenericSchema) =>

packages/gkit/src/skill.embed.ts

@@ -1,6 +1,6 @@
-// Runtime read, not a Bun macro: gkit ships as a source tarball installed
-// into node_modules, and Bun refuses to run macros from there.
+// Text import: inlined into the bundled release artifact, read from disk in dev.
+import skill from "./index.md" with { type: "text" };
+
 export async function embedSkill(): Promise<Record<string, string>> {
-  const text = await Bun.file(new URL("./index.md", import.meta.url)).text();
-  return { "SKILL.md": text };
+  return { "SKILL.md": skill };
 }

packages/gkit/src/text-modules.d.ts

@@ -0,0 +1,5 @@
+// Bun text imports (`with { type: "text" }`) resolve markdown to its contents.
+declare module "*.md" {
+  const text: string;
+  export default text;
+}