build(deps): install the shared config from GitHub Packages instead of a git URL

Last consumer on "@max-health/config": "github:max-health-inc/config". That form carries no
version range and no integrity entry, so the lockfile silently freezes one commit — here
2.4.0 at 47dec406, which happened to be current, but nothing recorded that and nothing would
have surfaced it drifting. dry.codes was two majors behind the same way.

Now "@max-health-inc/config": "^3.1.0" from GitHub Packages with an integrity hash. The
package was RENAMED for this: GitHub Packages resolves an npm scope to the owner hosting it,
so @max-health/* cannot be served from Max-Health-Inc at all. Content is unchanged from
2.4.0, so the tsconfig/eslint/vitest baselines this repo inherits are identical.

Eleven specifier sites moved with the dep: tsconfig.json extends, eslint.config.mjs
(eslint/rules), vitest.config.ts, vitest.parity.config.ts, and the vitest.config.ts in each
of the six generated client packages.

This repo needed more than a dep swap, unlike the other nine:

- Added .npmrc. There was none, so @max-health-inc/* would have resolved against
  registry.npmjs.org and 404'd. Only that scope is redirected; everything else, including
  what this repo PUBLISHES to npmjs.org, is untouched.
- Every `npm ci` needs a token, because npm.pkg.github.com requires one even for a public
  package. Set NODE_AUTH_TOKEN at workflow level in the seven workflows that do not publish,
  which covers all of them including the install inside packages/zod.
- release.yml and _release.yml get it STEP-scoped instead. setup-node there writes
  //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}, so a workflow-level value would be
  sent to npmjs.org by `npm publish --provenance` and would override OIDC trusted publishing.
- pipeline-parity-{develop,main}.yml now pass `secrets: inherit` to _parity-tests.yml. A
  called workflow sees no secrets otherwise, and an unset secret expands to an EMPTY string
  that fails with a 401 indistinguishable from a bad token.

bun.lock is gitignored here, so only package-lock.json is committed.

tsc --noEmit clean, eslint clean, 773 tests pass (the one cliEntrypoint failure was a
missing out/ from running vitest without pretest's rimraf; it passes after a build).

Author: quotentiroler

.github/workflows/_parity-tests.yml

@@ -27,6 +27,14 @@ on:
 # In local dev, babelfhir-ts defaults to ~/.fhir/packages/ (shared with HL7 Validator).
 env:
   FHIR_CACHE_ROOT: .cache
+  # @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a
+  # token even though the package is public. Set at workflow level so every `npm ci` in
+  # every job below is covered, including the one that installs inside packages/zod.
+  # Callers MUST pass `secrets: inherit` — a reusable workflow sees no secrets otherwise,
+  # and an unset secret expands to an EMPTY string that fails with a 401 identical to a bad
+  # token. Nothing here publishes, so a repo-wide NODE_AUTH_TOKEN is safe; the release
+  # workflows scope theirs to the install step so it cannot reach `npm publish`.
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
 
 jobs:
   # ── Resolve validator versions ─────────────────────────────────────────────

.github/workflows/_release.yml

@@ -50,6 +50,14 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
+        # Scoped to THIS step on purpose. setup-node above wrote
+        # `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` into the project .npmrc, so a
+        # workflow-level NODE_AUTH_TOKEN would be sent to npmjs.org by `npm publish` below —
+        # a GitHub token is not valid there, and it would override the OIDC trusted publishing
+        # this workflow relies on. Here it only authenticates the @max-health-inc scope in the
+        # committed .npmrc (GitHub Packages needs a token even for a public package).
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
         run: npm ci
 
       - name: Update npm to latest (required for OIDC)

.github/workflows/ci.yml

@@ -6,6 +6,13 @@ on:
   pull_request:
     branches: [develop, main]
 
+# @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a token
+# even though the package is public. Set at workflow level so every `npm ci` below is covered.
+# An unset secret expands to an EMPTY string and fails with a 401 identical to a bad token.
+# Nothing in this workflow publishes, so a workflow-wide NODE_AUTH_TOKEN is safe here.
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/deploy-docs.yml

@@ -10,6 +10,13 @@ on:
       - 'package.json'
   workflow_dispatch:
 
+# @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a token
+# even though the package is public. Set at workflow level so every `npm ci` below is covered.
+# An unset secret expands to an EMPTY string and fails with a 401 identical to a bad token.
+# Nothing in this workflow publishes, so a workflow-wide NODE_AUTH_TOKEN is safe here.
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+
 jobs:
   deploy-docs:
     runs-on: ubuntu-latest

.github/workflows/pipeline-parity-develop.yml

@@ -23,10 +23,20 @@ concurrency:
   group: parity-develop-${{ github.ref }}
   cancel-in-progress: false
 
+# @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a token
+# even though the package is public. Set at workflow level so every `npm ci` below is covered.
+# An unset secret expands to an EMPTY string and fails with a 401 identical to a bad token.
+# Nothing in this workflow publishes, so a workflow-wide NODE_AUTH_TOKEN is safe here.
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+
 jobs:
   # ── Run both validators in parallel (reusable workflow) ────────────────────
   parity-tests:
     uses: ./.github/workflows/_parity-tests.yml
+    # Required: the reusable workflow's `npm ci` needs GH_PACKAGES_TOKEN to fetch
+    # @max-health-inc/config, and a called workflow sees NO secrets without this.
+    secrets: inherit
     with:
       packages: ${{ github.event.inputs.packages || 'all' }}
       validator_version: ${{ github.event.inputs.validator_version || 'latest' }}

.github/workflows/pipeline-parity-main.yml

@@ -19,10 +19,20 @@ on:
         required: false
         default: 'latest'
 
+# @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a token
+# even though the package is public. Set at workflow level so every `npm ci` below is covered.
+# An unset secret expands to an EMPTY string and fails with a 401 identical to a bad token.
+# Nothing in this workflow publishes, so a workflow-wide NODE_AUTH_TOKEN is safe here.
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+
 jobs:
   # ── Run both validators in parallel (reusable workflow) ────────────────────
   parity-tests:
     uses: ./.github/workflows/_parity-tests.yml
+    # Required: the reusable workflow's `npm ci` needs GH_PACKAGES_TOKEN to fetch
+    # @max-health-inc/config, and a called workflow sees NO secrets without this.
+    secrets: inherit
     with:
       packages: ${{ github.event.inputs.packages || 'all' }}
       validator_version: ${{ github.event.inputs.validator_version || 'latest' }}

.github/workflows/prerelease-develop.yml

@@ -6,6 +6,13 @@ on:
       - develop
   workflow_dispatch:
 
+# @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a token
+# even though the package is public. Set at workflow level so every `npm ci` below is covered.
+# An unset secret expands to an EMPTY string and fails with a 401 identical to a bad token.
+# Nothing in this workflow publishes, so a workflow-wide NODE_AUTH_TOKEN is safe here.
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+
 jobs:
   prerelease:
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -56,6 +56,14 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
+        # Scoped to THIS step on purpose. setup-node above wrote
+        # `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` into the project .npmrc, so a
+        # workflow-level NODE_AUTH_TOKEN would be sent to npmjs.org by `npm publish` below —
+        # a GitHub token is not valid there, and it would override the OIDC trusted publishing
+        # this workflow relies on. Here it only authenticates the @max-health-inc scope in the
+        # committed .npmrc (GitHub Packages needs a token even for a public package).
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
         run: npm ci
 
       - name: Update npm to latest (required for OIDC)

.github/workflows/self-heal.yml

@@ -25,6 +25,13 @@ permissions:
   contents: write
   actions: read
 
+# @max-health-inc/config is installed from GitHub Packages (see .npmrc), which needs a token
+# even though the package is public. Set at workflow level so every `npm ci` below is covered.
+# An unset secret expands to an EMPTY string and fails with a 401 identical to a bad token.
+# Nothing in this workflow publishes, so a workflow-wide NODE_AUTH_TOKEN is safe here.
+env:
+  NODE_AUTH_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN }}
+
 jobs:
   self-heal:
     name: Auto-Fix Test Failures

.npmrc

@@ -0,0 +1,13 @@
+# @max-health-inc/config comes from the GitHub Packages npm registry, not npmjs.org. A
+# GitHub Packages scope resolves to the OWNER hosting it, so the scope must be mapped
+# explicitly — without this line npm resolves @max-health-inc/* against registry.npmjs.org
+# and 404s.
+#
+# npm substitutes ${NODE_AUTH_TOKEN} at install time, so no token is committed. CI supplies
+# it as GH_PACKAGES_TOKEN on every `npm ci` step; locally, `gh auth token` works. The
+# registry requires a token even though the package is PUBLIC.
+#
+# Everything else this repo installs, and everything it PUBLISHES (@babelfhir-ts/* ->
+# registry.npmjs.org, see _release.yml), is unaffected: only this one scope is redirected.
+@max-health-inc:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}