Install the shared CAIL packages from public npm

.github/workflows/ci.yml

@@ -8,7 +8,6 @@ on:
 
 permissions:
   contents: read
-  packages: read
 
 concurrency:
   group: slide-maker-ci-${{ github.workflow }}-${{ github.ref }}
@@ -35,13 +34,9 @@ jobs:
         with:
           node-version: '22.23.1'
           cache: pnpm
-          registry-url: https://npm.pkg.github.com
-          scope: "@cuny-ai-lab"
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Check frontend types
         run: pnpm --filter @slide-maker/web check

.github/workflows/deploy.yml

@@ -10,7 +10,6 @@ permissions:
   contents: read
   actions: read
   deployments: read
-  packages: read
 concurrency:
   group: slide-maker-production
   cancel-in-progress: false

.npmrc

@@ -1 +1 @@
-@cuny-ai-lab:registry=https://npm.pkg.github.com
+@cuny-ai-lab:registry=https://registry.npmjs.org

README.md

@@ -24,7 +24,7 @@ Open http://localhost:5173, log in with a seeded admin account, create a deck, a
 
 1. **Install dependencies**
 
-   The pinned CAIL packages require authorized GitHub Packages read access. The checked-in `.npmrc` contains registry resolution only; supply credentials through your user configuration or CI environment.
+   The pinned CAIL packages install from public npm with no token. The checked-in `.npmrc` maps the `@cuny-ai-lab` scope to `registry.npmjs.org`, so a user configuration that still points it at GitHub Packages does not redirect the install.
 
    ```bash
    pnpm install

scripts/release/contract.mjs

@@ -20,7 +20,7 @@ export function validateConfiguration(env) {
   if (env.CAIL_IDENTITY_ISSUER !== 'https://tools.ailab.gc.cuny.edu/cail-sso' ||
       env.CAIL_GATEWAY_URL !== 'https://tools.ailab.gc.cuny.edu' ||
       env.PUBLIC_URL !== 'https://tools.ailab.gc.cuny.edu/slide-maker') throw new Error('Production identity, Gateway or public URL is not canonical.');
-  for (const key of ['NODE_OPTIONS', 'NODE_PATH', 'NODE_AUTH_TOKEN', 'GITHUB_TOKEN', 'NPM_CONFIG_USERCONFIG', 'PM2_HOME']) {
+  for (const key of ['NODE_OPTIONS', 'NODE_PATH', 'GITHUB_TOKEN', 'NPM_CONFIG_USERCONFIG', 'PM2_HOME']) {
     if (env[key]) throw new Error(`Remove deployment-only or runtime-override setting ${key} from the application environment.`);
   }
   const database = env.DATABASE_URL?.startsWith('file:') ? env.DATABASE_URL.slice(5) : '';

scripts/release/contract.test.mjs

@@ -23,7 +23,7 @@ test('state paths must be explicit, separate and outside deployment storage', ()
 test('application configuration cannot silently replace fleet endpoints or retain CI credentials', () => {
   for (const patch of [
     { CAIL_GATEWAY_URL: 'https://tools.ailab.gc.cuny.edu/v1' }, { CAIL_IDENTITY_ISSUER: 'https://wrong.test' },
-    { PUBLIC_URL: 'http://localhost:4173' }, { READINESS_TOKEN: '' }, { GITHUB_TOKEN: 'fixture' }, { NODE_AUTH_TOKEN: 'fixture' }, { NODE_OPTIONS: '--inspect=0.0.0.0' },
+    { PUBLIC_URL: 'http://localhost:4173' }, { READINESS_TOKEN: '' }, { GITHUB_TOKEN: 'fixture' }, { NODE_OPTIONS: '--inspect=0.0.0.0' },
   ]) assert.throws(() => validateConfiguration({ ...environment, ...patch }));
 });
 test('rollback captures exactly one online process per component and preserves existing arguments and environment', () => {

scripts/release/host.mjs

@@ -1,5 +1,5 @@
 import { execFileSync } from 'node:child_process';
-import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { parseEnv } from 'node:util';
 import { pathToFileURL } from 'node:url';
@@ -46,13 +46,10 @@ export async function main() {
   if (command('pm2', ['--version']).trim() !== '7.0.4') throw new Error('Release host requires the tested PM2 CLI 7.0.4.');
   command('lsof', ['-v']);
   await verifySource();
-  // Install output stays private. The temporary credential is never written or
-  // included in PM2 environment; the only config file contains a placeholder.
-  if (readFileSync(join(root, '.npmrc'), 'utf8').trim() !== '@cuny-ai-lab:registry=https://npm.pkg.github.com') throw new Error('Unexpected tracked npm configuration.');
-  const npmrc = join(root, '.release-npmrc');
-  writeFileSync(npmrc, '@cuny-ai-lab:registry=https://npm.pkg.github.com\n//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n', { mode: 0o600, flag: 'wx' });
-  try { command('pnpm', ['install', '--frozen-lockfile'], { timeout: 600000, env: { ...baseEnv, NODE_AUTH_TOKEN: sourceToken, NPM_CONFIG_USERCONFIG: npmrc } }); }
-  finally { rmSync(npmrc, { force: true }); }
+  // Install output stays private. The CAIL packages come from public npm, so
+  // the install needs no credential; the tracked .npmrc pins their scope there.
+  if (readFileSync(join(root, '.npmrc'), 'utf8').trim() !== '@cuny-ai-lab:registry=https://registry.npmjs.org') throw new Error('Unexpected tracked npm configuration.');
+  command('pnpm', ['install', '--frozen-lockfile'], { timeout: 600000 });
   command('pnpm', ['build'], { timeout: 600000, env: { ...baseEnv, NODE_ENV: 'production' } });
   const apiDir = join(root, 'apps/api');
   const node = (args, extraEnv = {}) => command(process.execPath, ['--import', 'tsx', ...args], { cwd: apiDir, env: { ...appEnv, ...extraEnv } });