@@ -0,0 +1,34 @@
+name: Regenerate JavaScript lockfile
+
+on:
+  workflow_dispatch:
+
+jobs:
+  regenerate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        with:
+          node-version: "latest"
+
+      - name: Regenerate lockfile from public registry
+        working-directory: src/wasm_sandbox/guests/javascript
+        run: |
+          rm package-lock.json
+          npm install --package-lock-only --ignore-scripts \
+            --registry=https://registry.npmjs.org/ \
+            --replace-registry-host=always
+
+      - name: Validate registry URLs
+        working-directory: src/wasm_sandbox/guests/javascript
+        run: |
+          test "$(grep -c 'ms-feed-' package-lock.json || true)" -eq 0
+          test "$(grep -c '"resolved":' package-lock.json)" -eq \
+            "$(grep -c '"resolved": "https://registry.npmjs.org/' package-lock.json)"
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: javascript-package-lock
+          path: src/wasm_sandbox/guests/javascript/package-lock.json