conformance/js: consume @polymorph/test from JSR, retiring the npm-git pin

.github/justfile

@@ -22,6 +22,7 @@ rust-checks:
 # conformance-aggregate job, where every target's results have joined.
 conformance-checks:
     @just gha::_step conformance-ct::deltic-pin-check
+    @just gha::_step conformance-ct::runner-js-pin-check
     @just gha::_step conformance-ct::all
     @just gha::_step deltic-module-check
 

.github/workflows/ci.yml

@@ -111,12 +111,6 @@ jobs:
         # install, and the pins gate; conformance-ct::_ct-tools
         # recognizes the stamped install and does not repeat it.
         uses: polymorph-components/polymorph-test/actions/setup@b4444a25a22106ad4128549bdc9e579552e62210
-        with:
-          js-locks: |
-            conformance/driver-ct/jco/package-lock.json
-            examples/jco-demo/package-lock.json
-            js/jco/package-lock.json
-            js/componentize/wpt/parity/package-lock.json
 
       - name: Install Node 24
         # Exact-pinned, like every engine here (Deno, the Playwright
@@ -494,12 +488,6 @@ jobs:
 
       - name: Install the component-test tools at the pinned revision
         uses: polymorph-components/polymorph-test/actions/setup@b4444a25a22106ad4128549bdc9e579552e62210
-        with:
-          js-locks: |
-            conformance/driver-ct/jco/package-lock.json
-            examples/jco-demo/package-lock.json
-            js/jco/package-lock.json
-            js/componentize/wpt/parity/package-lock.json
 
       - name: Download the ubuntu conformance results
         uses: actions/download-artifact@v4

AGENTS.md

@@ -370,15 +370,18 @@ absent an exceptional recorded ruling.
 Prerequisites: Rust via rustup (toolchain + wasm target pinned in
 `rust-toolchain.toml`), `wasm-tools`, `just`, Node 24+ with npm for the
 jco path. Run `./scripts/setup.sh` once (idempotent; `SKIP_NODE=1` to
-skip the npm install). The polymorph:test stack is a git dependency
-pinned by rev in the root `Cargo.toml` and enforced by `Cargo.lock`;
-cargo fetches it, and `conformance-ct::_ct-tools` cargo-installs the
-`component-test`/`ct-runner` binaries at the same locked rev. To bump
-the pin: `component-test pins bump <rev> --cargo-toml Cargo.toml
---package-json conformance/driver-ct/jco/package.json --workflow
-.github/workflows/ci.yml`, then the follow-ups it prints (`cargo
-update`, `npm install`); the `_ct-tools` pins gate and the actions'
-own ref checks fail on skew.
+skip the npm install). The polymorph:test stack arrives two ways, both
+naming one release: the crates are a git dependency pinned by rev in
+the root `Cargo.toml` (enforced by `Cargo.lock`; `conformance-ct::_ct-tools`
+cargo-installs the `component-test`/`ct-runner` binaries at the same
+locked rev), and the JS runner core is `jsr:@polymorph/test`'s
+npm-compat package as `@jsr/polymorph__test` dependencies (scoped to
+npm.jsr.io by each tree's .npmrc) in the five npm trees. To bump: `component-test pins bump <rev>
+--cargo-toml Cargo.toml --workflow .github/workflows/ci.yml` with the
+release-tag commit, then the follow-ups it prints (`cargo update`), and
+set the matching release version on each `@jsr/polymorph__test` dependency + `npm install`; the
+`_ct-tools` pins gate, `conformance-ct::runner-js-pin-check`, and the
+actions' own ref checks fail on skew.
 To develop against a local component-test checkout, add a temporary
 override to the root `Cargo.toml` (do not commit it):
 

Cargo.toml

@@ -15,16 +15,18 @@ members = [
 ]
 resolver = "2"
 
-# The polymorph:test stack, pinned by git rev (bump deliberately:
-# update the rev here, `cargo update -p component-test-sdk -p
-# component-test-runner`, `npm install --save-exact
-# github:polymorph-components/polymorph-test#<rev>` in
-# conformance/driver-ct/jco, and move the actions/aggregate refs in
-# .github/workflows/ci.yml — the pins gate and the CI ref guard fail
-# on skew; the CI tools cache and the ct/ct-runner binaries key off
-# the locked rev). To develop against a local checkout, add a `[patch]`
-# override — see AGENTS.md "Build & run". Publishing component-test
-# to a registry retires this arrangement.
+# The polymorph:test stack: the crates pinned by git rev, the JS runner
+# core from JSR (@jsr/polymorph__test, npm.jsr.io per-tree .npmrc). Both sides of a bump
+# name ONE polymorph-test release: `component-test pins bump <rev>
+# --cargo-toml Cargo.toml --workflow .github/workflows/ci.yml` with the
+# release-tag commit, `cargo update -p component-test-sdk -p
+# component-test-runner`, then set the matching release version on every
+# `@jsr/polymorph__test` dependency (conformance/driver-ct/{jco,
+# deltic}, examples/jco-demo, js/jco, js/componentize/wpt/parity) and
+# `npm install` in each — the cargo pins gate, the runner-js pin gate,
+# and the CI ref guard fail on skew; the CI tools cache and the
+# ct/ct-runner binaries key off the locked rev. To develop against a
+# local checkout, add a `[patch]` override — see AGENTS.md "Build & run".
 [workspace.dependencies]
 component-test-sdk = { git = "https://github.com/polymorph-components/polymorph-test", rev = "b4444a25a22106ad4128549bdc9e579552e62210" }
 component-test-runner = { git = "https://github.com/polymorph-components/polymorph-test", rev = "b4444a25a22106ad4128549bdc9e579552e62210" }

conformance/driver-ct/deltic/.npmrc

@@ -0,0 +1 @@
+@jsr:registry=https://npm.jsr.io

conformance/driver-ct/deltic/browser/worker-entry.ts

@@ -6,7 +6,7 @@
 // embedder module instance — which is what keeps `instanceof ComponentException`
 // true when the host module throws across the component boundary
 // (workers resolve no import maps, so bundling is the only sound shape;
-// see @polymorph/component-test-js's runner-deltic README).
+// see @jsr/polymorph__test's runner-deltic README).
 //
 // Built by `just conformance-ct::_deltic-browser-bundle` with
 // `deno bundle --platform browser` into target/deltic-browser/, and
@@ -17,7 +17,7 @@
 // configuration, so `suiteImports` is the plain record.
 
 import * as deltic from "../browser-bundle-entry.ts";
-import { workerMain } from "@polymorph/component-test-js/deltic-worker-main";
+import { workerMain } from "@polymorph/test/deltic-worker-main";
 import { setRsaPrivateKeyPolicy, webcryptoImports } from "../../../../js/deltic/src/mod.ts";
 
 // The browser posture, matching the jco-browser rows: a browser is an

conformance/driver-ct/deltic/deno.json

@@ -6,9 +6,9 @@
     "@deltic/runtime/shim": "jsr:@deltic/runtime@0.1.0/shim",
     "@deltic/wasi": "jsr:@deltic/wasi@0.1.0",
     "@deltic/translator": "jsr:@deltic/translator@0.1.0",
-    "@polymorph/component-test-js/deltic-worker-main": "./node_modules/@polymorph/component-test-js/js/runner-deltic/worker-main.mjs"
+    "@polymorph/test/deltic-worker-main": "jsr:@polymorph/test@0.1.1/deltic-worker-main"
   },
-  "minimumDependencyAge": { "age": "P1D", "exclude": ["jsr:@deltic/*"] },
+  "minimumDependencyAge": { "age": "P1D", "exclude": ["jsr:@deltic/*", "jsr:@polymorph/*"] },
   "tasks": {
     "check": "deno check run.ts browser/worker-entry.ts browser-bundle-entry.ts"
   }

conformance/driver-ct/deltic/package.json

@@ -4,7 +4,7 @@
   "type": "module",
   "description": "Node driver + bundled worker inputs for the deltic-browser conformance rows: both suites runtime-linked inside headless Chromium with this repo's deltic host module, through the upstream page driver and deltic worker-main.",
   "dependencies": {
-    "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210",
+    "@jsr/polymorph__test": "0.1.1",
     "playwright-core": "1.62.1"
   }
 }

conformance/driver-ct/deltic/run-browser.mjs

@@ -19,8 +19,8 @@ import {
   buildHarnessPage,
   findChrome,
   runPageHarness,
-} from "@polymorph/component-test-js/browser-driver";
-import { writeResultsFile } from "@polymorph/component-test-js/node-runner";
+} from "@jsr/polymorph__test/browser-driver";
+import { writeResultsFile } from "@jsr/polymorph__test/node-runner";
 
 const REPO_ROOT = fileURLToPath(new URL("../../../", import.meta.url));
 const RESULTS_DIR = fileURLToPath(new URL("../results/", import.meta.url));

conformance/driver-ct/jco/.npmrc

@@ -0,0 +1 @@
+@jsr:registry=https://npm.jsr.io

conformance/driver-ct/jco/host-imports.mjs

@@ -7,7 +7,7 @@
 // namespaces (Node or browser build). Relative specifiers only: module
 // Web Workers cannot see a page's import map.
 
-import { bindImports } from "./node_modules/@polymorph/component-test-js/js/viewer/imports.mjs";
+import { bindImports } from "./node_modules/@jsr/polymorph__test/viewer/imports.mjs";
 import * as webcrypto from "../../../js/jco/webcrypto.js";
 import { Context } from "../context.js";
 

conformance/driver-ct/jco/package.json

@@ -12,7 +12,7 @@
   "dependencies": {
     "@bytecodealliance/jco-transpile": "0.7.0",
     "@bytecodealliance/preview2-shim": "0.17.9",
-    "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210",
+    "@jsr/polymorph__test": "0.1.1",
     "playwright-core": "1.62.1"
   }
 }

conformance/driver-ct/jco/reuse-worker.mjs

@@ -28,8 +28,8 @@ import {
   inventoryLookup,
   resolveTestsExport,
   runCases,
-} from "/__component-test/js/viewer/harness.mjs";
-import { Context as DefaultContext } from "/__component-test/js/viewer/context.js";
+} from "/__component-test/viewer/harness.mjs";
+import { Context as DefaultContext } from "/__component-test/viewer/context.js";
 
 // A rejection escaping the awaited chain (e.g. a platform quirk
 // surfacing through the transpiled guest's async plumbing) would

conformance/driver-ct/jco/run-browser.mjs

@@ -2,7 +2,7 @@
 // invocation (`--engine chromium|firefox|webkit`), both suites' case
 // loops running inside the headless engine via the upstream page driver
 // — page, worker pool, stall watchdog, and Chrome ladder all live in
-// @polymorph/component-test-js — and writing results/<target>.jsonl +
+// @jsr/polymorph__test — and writing results/<target>.jsonl +
 // results/<target>-signing.jsonl plus a results/<target>.meta.json
 // provenance sidecar (engine + version, consumed by the compat page).
 // This file is the frame: engine selection, core-URL enumeration,
@@ -49,8 +49,8 @@ import {
   buildHarnessPage,
   findChrome,
   runPageHarness,
-} from "@polymorph/component-test-js/browser-driver";
-import { writeResultsFile } from "@polymorph/component-test-js/node-runner";
+} from "@jsr/polymorph__test/browser-driver";
+import { writeResultsFile } from "@jsr/polymorph__test/node-runner";
 
 const REPO_ROOT = fileURLToPath(new URL("../../../", import.meta.url));
 const RESULTS_DIR = fileURLToPath(new URL("../results/", import.meta.url));

conformance/driver-ct/jco/runner.mjs

@@ -7,11 +7,11 @@
 // and the Node counterpart of the browser driver's Web Worker pool
 // (run-browser.mjs). Workers interleave, so the rows are re-sorted
 // into suite order before emission. The inventory parsing and per-case
-// loop live in the upstream runner core (@polymorph/component-test-js, the rev-pinned git dependency — one harness for every runner, per polymorph-components/polymorph-test#5).
+// loop live in the upstream runner core (@jsr/polymorph__test, the rev-pinned git dependency — one harness for every runner, per polymorph-components/polymorph-test#5).
 import { availableParallelism } from "node:os";
 import { parseArgs } from "node:util";
 import { Worker } from "node:worker_threads";
-import { envelope, mergeCounts, workerCount } from "@polymorph/component-test-js/harness";
+import { envelope, mergeCounts, workerCount } from "@jsr/polymorph__test/harness";
 
 const { values } = parseArgs({
   options: {

conformance/driver-ct/jco/worker-node.mjs

@@ -7,8 +7,8 @@
 import { fileURLToPath } from "node:url";
 import { parentPort, workerData } from "node:worker_threads";
 import { cli, clocks, io, random, filesystem } from "@bytecodealliance/preview2-shim";
-import { inventoryLookup, runCases } from "@polymorph/component-test-js/harness";
-import { loadCoreModules } from "@polymorph/component-test-js/node-runner";
+import { inventoryLookup, runCases } from "@jsr/polymorph__test/harness";
+import { loadCoreModules } from "@jsr/polymorph__test/node-runner";
 import { Context } from "../context.js";
 import { instantiateSuite } from "./host-imports.mjs";
 

conformance/driver-ct/justfile

@@ -41,14 +41,36 @@ deltic-pin-check:
     set -euo pipefail
     v=$(jq -r '.jsr | keys[]' \
         {{root}}/js/deltic/deno.lock deltic/deno.lock \
-        | grep -v '^@deltic/protocol@' \
+        | grep '^@deltic/' | grep -v '^@deltic/protocol@' \
         | sed 's/.*@//' | sort -u)
     if [ "$(printf '%s\n' "$v" | wc -l)" != 1 ]; then
         echo "deltic pin drift: $v" >&2
         exit 1
     fi
     echo "deltic pin OK: $v"
 
+# The JS runner core's one-version gate: every npm tree consuming
+# @jsr/polymorph__test (jsr:@polymorph/test through JSR's npm-compat
+# registry, per each tree's .npmrc) must resolve the same
+# version — a skewed bump runs the JS harness against a Rust runner
+# from a different polymorph-test release, a subtle contract-mismatch
+# generator. Wired next to deltic-pin-check in the conformance CI job.
+runner-js-pin-check:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    v=$({ jq -r '.packages["node_modules/@jsr/polymorph__test"].version' \
+        jco/package-lock.json \
+        ../../examples/jco-demo/package-lock.json \
+        ../../js/jco/package-lock.json \
+        ../../js/componentize/wpt/parity/package-lock.json; \
+        jq -r '.jsr | keys[]' deltic/deno.lock \
+        | grep '^@polymorph/test@' | sed 's/.*@//'; } | sort -u)
+    if [ "$v" = "null" ] || [ "$(printf '%s\n' "$v" | wc -l)" != 1 ]; then
+        echo "runner-js pin drift: $v" >&2
+        exit 1
+    fi
+    echo "runner-js pin OK: @jsr/polymorph__test $v"
+
 # Build both suite components (rkyv corpus). CONFORMANCE_PREBUILT=1
 # skips cargo when the artifacts are already present — set by CI on an
 # exact-source-hash cache hit (see the conformance job's "Restore
@@ -115,18 +137,13 @@ _ct-tools:
         cargo install -q --locked --root "{{ct-tools}}" --git "$url" --rev "$rev" component-test-runner
         printf '%s' "$rev" > "{{ct-tools}}/.rev"
     fi
-    # One-rev-everywhere gate: the JS runner core (@polymorph/component-test-js,
-    # a git-sourced npm dependency) must pin the SAME component-test rev
-    # as the cargo side — a skewed bump runs the JS harness against a
-    # Rust runner from a different rev, a subtle contract-mismatch
-    # generator. Bump both together: the rev in Cargo.toml + `npm
-    # install --save-exact github:polymorph-components/polymorph-test#<rev>` in jco/.
+    # Cargo-side pin gate: every component-test-* git dependency in
+    # Cargo.lock names the expected rev. The JS runner core arrives from
+    # JSR (@jsr/polymorph__test npm aliases); its one-version gate is
+    # runner-js-pin-check below, and the rev<->version pairing is the
+    # bump procedure's job (both sides name one polymorph-test release —
+    # see the root Cargo.toml's bump comment).
     "{{ct-tools}}/bin/component-test" pins --cargo-lock "{{root}}/Cargo.lock" \
-        --js-lock jco/package-lock.json \
-        --js-lock deltic/package-lock.json \
-        --js-lock ../../examples/jco-demo/package-lock.json \
-        --js-lock ../../js/jco/package-lock.json \
-        --js-lock ../../js/componentize/wpt/parity/package-lock.json \
         --expect "$rev" > /dev/null
 
 # Enumerate each suite's full case census (ct-driver instantiates the
@@ -338,7 +355,7 @@ run-composed: build build-provider _ct-tools
 
 # The jco-browser target: the same transpiles and the same host module,
 # with the case loop running inside headless Chromium (browser WebCrypto)
-# via the upstream page driver (@polymorph/component-test-js). The
+# via the upstream page driver (@jsr/polymorph__test). The
 # --missing declarations mirror targets.toml / targets-signing.toml's
 # jco-browser entries, which the aggregate cross-checks: the browser
 # cannot serve sha1-checked, and the host fails the gated RSA

examples/jco-demo/.npmrc

@@ -0,0 +1 @@
+@jsr:registry=https://npm.jsr.io