chore: enforce local ByteLyst package resolution

README.md

@@ -142,19 +142,17 @@ uses redacted URL helpers for any future FMP log output.
 Package resolution is controlled by `BYTELYST_PACKAGE_SOURCE` through
 `.pnpmfile.cjs`.
 
-- `vendor` (default): prefer `vendor/bytelyst/*`, then fall back to a local
-  `learning_ai_common_plat` checkout if present, then registry versions.
-- `common-plat`: resolve `@bytelyst/*` directly from
-  `/opt/bytelyst/learning_ai_common_plat/packages/*`.
-- `gitea`: resolve `@bytelyst/*` from the Gitea npm registry using
-  `GITEA_NPM_TOKEN`.
+- `common-plat` (default): resolve `@bytelyst/*` directly from the sibling
+  `learning_ai_common_plat` checkout, or from `BYTELYST_COMMON_PLAT_ROOT`.
+- `vendor`: prefer `vendor/bytelyst/*`, then fall back to the sibling
+  `learning_ai_common_plat` checkout.
 
 Examples:
 
 ```bash
 pnpm run install:common-plat
-pnpm run install:gitea
 pnpm run install:vendor
+pnpm run check:packages
 ```
 
 Override the sibling repo location with `BYTELYST_COMMON_PLAT_ROOT=/path/to/learning_ai_common_plat`.

backend/Dockerfile

@@ -1,6 +1,4 @@
 # Build context: learning_ai_invt_trdg/ (monorepo root)
-# docker-compose passes GITEA_NPM_TOKEN as a build arg for the private @bytelyst registry
-#
 # --- Stage 1: Build ---
 FROM node:20-alpine AS builder
 
@@ -8,9 +6,7 @@ RUN corepack enable && corepack prepare pnpm@10.6.5 --activate
 
 WORKDIR /app
 
-ARG GITEA_NPM_TOKEN
 ARG BYTELYST_PACKAGE_SOURCE=vendor
-ENV GITEA_NPM_TOKEN=${GITEA_NPM_TOKEN}
 ENV BYTELYST_PACKAGE_SOURCE=${BYTELYST_PACKAGE_SOURCE}
 
 # Copy workspace root files first (layer cache)
@@ -39,9 +35,7 @@ RUN corepack enable && corepack prepare pnpm@10.6.5 --activate
 
 WORKDIR /app
 
-ARG GITEA_NPM_TOKEN
 ARG BYTELYST_PACKAGE_SOURCE=vendor
-ENV GITEA_NPM_TOKEN=${GITEA_NPM_TOKEN}
 ENV BYTELYST_PACKAGE_SOURCE=${BYTELYST_PACKAGE_SOURCE}
 
 COPY .npmrc .pnpmfile.cjs pnpm-workspace.yaml pnpm-lock.yaml* ./

docker-compose.yml

@@ -4,7 +4,6 @@
 #
 # Requires:
 #   - backend/.env populated (copy from backend/.env.example)
-#   - GITEA_NPM_TOKEN env var set when BYTELYST_PACKAGE_SOURCE=gitea
 #
 # For hot-reload dev mode use:
 #   docker compose -f docker-compose.yml -f docker-compose.dev.yml up
@@ -22,7 +21,6 @@ services:
       dockerfile: backend/Dockerfile
       args:
         BYTELYST_PACKAGE_SOURCE: ${BYTELYST_PACKAGE_SOURCE:-vendor}
-        GITEA_NPM_TOKEN: ${GITEA_NPM_TOKEN:-}
     container_name: invttrdg-backend
     env_file:
       - backend/.env
@@ -48,7 +46,6 @@ services:
       dockerfile: web/Dockerfile
       args:
         BYTELYST_PACKAGE_SOURCE: ${BYTELYST_PACKAGE_SOURCE:-vendor}
-        GITEA_NPM_TOKEN: ${GITEA_NPM_TOKEN:-}
         VITE_PRODUCT_ID: ${VITE_PRODUCT_ID:-invttrdg}
         # Public web builds must use the hosted APIs even if local .env contains dev localhost values.
         VITE_PLATFORM_URL: https://api.bytelyst.com/platform/api

docs/OPERATIONS.md

@@ -34,8 +34,11 @@ cp .env.example .env
 pnpm verify
 ```
 
-If you need the registry path instead, use `pnpm run install:gitea`. The active
-resolver is controlled by `BYTELYST_PACKAGE_SOURCE` in `.pnpmfile.cjs`.
+The active resolver is controlled by `BYTELYST_PACKAGE_SOURCE` in
+`.pnpmfile.cjs`. Local development should use the sibling
+`learning_ai_common_plat` checkout by default. Use
+`BYTELYST_COMMON_PLAT_ROOT=/path/to/learning_ai_common_plat` only when your
+checkout is not in the standard sibling layout.
 
 ### Core commands
 
@@ -63,13 +66,12 @@ pnpm docker:down
 
 Prerequisites for Docker:
 - `.env` at repo root filled in (copy from `.env.example`)
-- `GITEA_NPM_TOKEN` set when `BYTELYST_PACKAGE_SOURCE=gitea`
 - `VITE_PLATFORM_URL` and `VITE_TRADING_API_URL` set if not using localhost defaults
 - For dev mode: run the matching local install first (for example `pnpm run install:common-plat`)
 
 Docker note: `common-plat` mode targets `/opt/bytelyst/learning_ai_common_plat`
-on the host, so container builds should stay on `vendor` or `gitea` unless the
-build context is expanded to include the sibling repo.
+on the host, so container builds should stay on `vendor` unless the build
+context is expanded to include the sibling repo.
 
 ### Surface-specific commands
 

package.json

@@ -6,6 +6,7 @@
   "type": "module",
   "scripts": {
     "build": "pnpm --filter @bytelyst/trading-backend build && pnpm --filter @bytelyst/trading-web build && pnpm --filter @bytelyst/trading-mobile typecheck",
+    "check:packages": "node ./scripts/check-local-packages.cjs",
     "audit:ui": "sh ./scripts/ui-drift-audit.sh",
     "audit:ui:strict": "sh ./scripts/ui-drift-audit.sh strict",
     "install:common-plat": "BYTELYST_PACKAGE_SOURCE=common-plat pnpm install -r",

scripts/check-local-packages.cjs

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+const fs = require('node:fs');
+const path = require('node:path');
+
+const repoRoot = path.resolve(__dirname, '..');
+const commonPlatRoot =
+  process.env.BYTELYST_COMMON_PLAT_ROOT ||
+  path.resolve(repoRoot, '..', 'learning_ai_common_plat');
+const commonPackagesRoot = path.join(commonPlatRoot, 'packages');
+
+const manifests = [
+  path.join(repoRoot, 'package.json'),
+  path.join(repoRoot, 'web', 'package.json'),
+  path.join(repoRoot, 'backend', 'package.json'),
+  path.join(repoRoot, 'mobile', 'package.json'),
+];
+
+function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+}
+
+function bytelystDependencies(manifestPath) {
+  const manifest = readJson(manifestPath);
+  const sections = [
+    manifest.dependencies,
+    manifest.devDependencies,
+    manifest.optionalDependencies,
+  ];
+
+  return sections
+    .flatMap((section) => Object.keys(section || {}))
+    .filter((name) => name.startsWith('@bytelyst/'));
+}
+
+if (!fs.existsSync(commonPackagesRoot)) {
+  console.error(`Missing common platform packages directory: ${commonPackagesRoot}`);
+  console.error('Set BYTELYST_COMMON_PLAT_ROOT if your sibling checkout lives elsewhere.');
+  process.exit(1);
+}
+
+const missing = new Set();
+
+for (const manifestPath of manifests) {
+  if (!fs.existsSync(manifestPath)) continue;
+
+  for (const packageName of bytelystDependencies(manifestPath)) {
+    const packageDir = packageName.replace('@bytelyst/', '');
+    const packageJsonPath = path.join(commonPackagesRoot, packageDir, 'package.json');
+    if (!fs.existsSync(packageJsonPath)) {
+      missing.add(`${packageName} -> ${packageJsonPath}`);
+    }
+  }
+}
+
+if (missing.size > 0) {
+  console.error('Missing local ByteLyst package checkouts:');
+  for (const item of missing) {
+    console.error(`- ${item}`);
+  }
+  process.exit(1);
+}
+
+console.log(`Local ByteLyst packages resolved from ${commonPackagesRoot}`);

scripts/verify.sh

@@ -2,8 +2,8 @@
 set -eu
 
 echo "Running root verification for learning_ai_invt_trdg"
+pnpm check:packages
 pnpm typecheck
 pnpm test
 pnpm audit:ui:strict
 pnpm build
-

web/Dockerfile

@@ -6,9 +6,7 @@ RUN corepack enable && corepack prepare pnpm@10.6.5 --activate
 
 WORKDIR /app
 
-ARG GITEA_NPM_TOKEN
 ARG BYTELYST_PACKAGE_SOURCE=vendor
-ENV GITEA_NPM_TOKEN=${GITEA_NPM_TOKEN}
 ENV BYTELYST_PACKAGE_SOURCE=${BYTELYST_PACKAGE_SOURCE}
 
 COPY .npmrc .pnpmfile.cjs pnpm-workspace.yaml pnpm-lock.yaml* ./