@bleedingdev/modern-js-create 3.5.0-ultramodern.6 → 3.5.0-ultramodern.75

package/dist/esm/ultramodern-tooling/commands/migrate-strict-effect/package-cohort.js

@@ -0,0 +1,156 @@
+import { ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES, ULTRAMODERN_WORKSPACE_MODERN_PACKAGES, modernPackageSpecifier } from "../../../ultramodern-package-source.js";
+import { ULTRAMODERN_PACKAGE_PINS } from "../../../ultramodern-workspace/policy.js";
+import { GENERATED_POSTINSTALL_SCRIPT, createWorkspaceAppPackageScripts, createWorkspaceRootPackageScripts } from "../../../ultramodern-workspace/workspace-script-plan.js";
+import { migratedWorkspaceScriptBasenames } from "../../../ultramodern-workspace/workspace-scripts.js";
+const modernPackageNames = new Set([
+    ...ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES,
+    ...ULTRAMODERN_WORKSPACE_MODERN_PACKAGES
+]);
+function updateModernDependencies(packageJson, packageSource) {
+    let changed = false;
+    for (const section of [
+        'dependencies',
+        'devDependencies',
+        'peerDependencies',
+        'optionalDependencies'
+    ]){
+        const dependencies = packageJson[section];
+        if (!(!dependencies || 'object' != typeof dependencies || Array.isArray(dependencies))) for (const packageName of Object.keys(dependencies)){
+            if (!modernPackageNames.has(packageName)) continue;
+            const nextSpecifier = modernPackageSpecifier(packageName, packageSource);
+            if (dependencies[packageName] !== nextSpecifier) {
+                dependencies[packageName] = nextSpecifier;
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
+const generatedToolingDependencyPins = new Map(Object.entries({
+    ...ULTRAMODERN_PACKAGE_PINS.appDependencies,
+    ...ULTRAMODERN_PACKAGE_PINS.appDevDependencies,
+    ...ULTRAMODERN_PACKAGE_PINS.rootDevDependencies
+}));
+function updateGeneratedToolingDependencies(packageJson) {
+    let changed = false;
+    for (const section of [
+        'dependencies',
+        'devDependencies',
+        'peerDependencies',
+        'optionalDependencies'
+    ]){
+        const dependencies = packageJson[section];
+        if (!(!dependencies || 'object' != typeof dependencies || Array.isArray(dependencies))) {
+            for (const [packageName, version] of generatedToolingDependencyPins)if (Object.prototype.hasOwnProperty.call(dependencies, packageName) && dependencies[packageName] !== version) {
+                dependencies[packageName] = version;
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
+const cloudflareModernDeployCommand = 'MODERNJS_DEPLOY=cloudflare modern deploy';
+const cloudflareModernDeploySkipBuildCommand = `${cloudflareModernDeployCommand} --skip-build`;
+const cloudflareWranglerDeployCommand = 'wrangler deploy --config .output/wrangler.json';
+const cloudflareWranglerDeployInvalidSkipBuildCommand = `${cloudflareWranglerDeployCommand} --skip-build`;
+function removeStaleBackendFederationCommandSegments(command) {
+    return command.replace(/\s+&&\s+node\s+\S*scripts\/generate-node-backend-federation\.m[ct]s(?:\s+--app\s+\S+)?(?:\s+--target\s+\S+)?(?=\s+&&|$)/gu, '');
+}
+const CONDITIONAL_FRAMEWORK_ROOT_SCRIPTS = [
+    'node:backend-federation:generate',
+    'node:proof',
+    'zerops:materialize'
+];
+const splitScriptSegments = (command)=>command.split('&&').map((segment)=>segment.trim()).filter((segment)=>segment.length > 0);
+const scriptSegmentTarget = (segment)=>segment.replace(/^pnpm\s+/u, '').split(/\s+/u)[0] ?? segment;
+const FRAMEWORK_CHECK_TARGETS = new Set([
+    'format:check',
+    'lint',
+    'typecheck',
+    'skills:check',
+    'i18n:boundaries',
+    'api:check',
+    'contract:check',
+    'node:backend-federation:generate',
+    'node:proof',
+    'performance:readiness',
+    'bridge:check'
+]);
+function mergeAggregateCheckScript(consumer, framework) {
+    const frameworkSegments = splitScriptSegments(framework);
+    const consumerExtras = splitScriptSegments(consumer).filter((segment)=>!FRAMEWORK_CHECK_TARGETS.has(scriptSegmentTarget(segment)));
+    return [
+        ...consumerExtras,
+        ...frameworkSegments
+    ].join(' && ');
+}
+function rewriteMigratedScriptReferences(scripts) {
+    let changed = false;
+    const pattern = new RegExp(`(scripts/(?:${migratedWorkspaceScriptBasenames.join('|')}))\\.mjs`, 'gu');
+    for (const [name, value] of Object.entries(scripts)){
+        if ('string' != typeof value) continue;
+        const next = value.replace(pattern, '$1.mts');
+        if (next !== value) {
+            scripts[name] = next;
+            changed = true;
+        }
+    }
+    return changed;
+}
+function updateGeneratedPackageScripts(packageJson, options = {}) {
+    const scripts = packageJson.scripts;
+    if (!scripts || 'object' != typeof scripts || Array.isArray(scripts)) return false;
+    let changed = false;
+    const apps = options.apps ?? [];
+    const app = apps.find((candidate)=>`${candidate.directory}/package.json` === options.relativePackageFile);
+    const isRootPackage = 'package.json' === options.relativePackageFile;
+    if (isRootPackage && scripts.postinstall !== GENERATED_POSTINSTALL_SCRIPT) {
+        scripts.postinstall = GENERATED_POSTINSTALL_SCRIPT;
+        changed = true;
+    }
+    const expectedScripts = isRootPackage ? createWorkspaceRootPackageScripts(apps.filter((candidate)=>'shell' !== candidate.kind), {
+        shells: apps.filter((candidate)=>'shell' === candidate.kind)
+    }) : app ? createWorkspaceAppPackageScripts(app) : void 0;
+    if (expectedScripts) {
+        if (isRootPackage) {
+            for (const name of CONDITIONAL_FRAMEWORK_ROOT_SCRIPTS)if (!(name in expectedScripts) && name in scripts) {
+                delete scripts[name];
+                changed = true;
+            }
+        }
+        for (const [name, value] of Object.entries(expectedScripts)){
+            if (void 0 === value) continue;
+            const existingScript = scripts[name];
+            const nextValue = 'check' === name && 'string' == typeof existingScript ? mergeAggregateCheckScript(existingScript, value) : value;
+            if (scripts[name] !== nextValue) {
+                scripts[name] = nextValue;
+                changed = true;
+            }
+        }
+    }
+    if (rewriteMigratedScriptReferences(scripts)) changed = true;
+    const build = scripts.build;
+    if ('string' == typeof build) {
+        const nextBuild = removeStaleBackendFederationCommandSegments(build);
+        if (nextBuild !== build) {
+            scripts.build = nextBuild;
+            changed = true;
+        }
+    }
+    const cloudflareBuild = scripts['cloudflare:build'];
+    if ('string' == typeof cloudflareBuild) {
+        let nextCloudflareBuild = removeStaleBackendFederationCommandSegments(cloudflareBuild);
+        if (nextCloudflareBuild.includes(cloudflareModernDeployCommand) && !nextCloudflareBuild.includes(cloudflareModernDeploySkipBuildCommand)) nextCloudflareBuild = nextCloudflareBuild.replace(cloudflareModernDeployCommand, cloudflareModernDeploySkipBuildCommand);
+        if (nextCloudflareBuild !== cloudflareBuild) {
+            scripts['cloudflare:build'] = nextCloudflareBuild;
+            changed = true;
+        }
+    }
+    const cloudflareDeploy = scripts['cloudflare:deploy'];
+    if ('string' == typeof cloudflareDeploy && cloudflareDeploy.includes(cloudflareWranglerDeployInvalidSkipBuildCommand)) {
+        scripts['cloudflare:deploy'] = cloudflareDeploy.replace(cloudflareWranglerDeployInvalidSkipBuildCommand, cloudflareWranglerDeployCommand);
+        changed = true;
+    }
+    return changed;
+}
+export { updateGeneratedPackageScripts, updateGeneratedToolingDependencies, updateModernDependencies };

package/dist/esm/ultramodern-tooling/commands/migrate-strict-effect/package-source.js

@@ -0,0 +1,51 @@
+import { BLEEDINGDEV_PACKAGE_NAME_PREFIX, BLEEDINGDEV_PACKAGE_SCOPE, WORKSPACE_PACKAGE_VERSION } from "../../../ultramodern-package-source.js";
+import { isCreatePackageSourceCheckout } from "../../../ultramodern-release-cohort.js";
+import { hasFlag, readOption } from "../options.js";
+function createMigrationPackageSource(args, current) {
+    const workspaceRequested = hasFlag(args, '--workspace');
+    const explicitInstallRequested = !workspaceRequested && (current.packageSource?.strategy === 'install' || [
+        '--version',
+        '--ultramodern-package-version',
+        '--registry',
+        '--ultramodern-package-registry',
+        '--alias-scope',
+        '--ultramodern-package-scope',
+        '--alias-package-name-prefix',
+        '--ultramodern-package-name-prefix'
+    ].some((option)=>void 0 !== readOption(args, option)));
+    if (isCreatePackageSourceCheckout() && explicitInstallRequested) throw new Error('A local @modern-js/create source checkout cannot migrate an explicit install package source. Use --workspace locally or run the packed published package with its authenticated release cohort projection.');
+    const strategy = workspaceRequested || isCreatePackageSourceCheckout() ? 'workspace' : 'install';
+    const registry = readOption(args, '--registry') ?? readOption(args, '--ultramodern-package-registry');
+    const explicitAliasScope = readOption(args, '--alias-scope') ?? readOption(args, '--ultramodern-package-scope');
+    const aliasScope = explicitAliasScope ?? ('install' === strategy && void 0 === registry ? current.packageSource?.aliasScope ?? BLEEDINGDEV_PACKAGE_SCOPE : current.packageSource?.aliasScope);
+    const aliasPackageNamePrefix = readOption(args, '--alias-package-name-prefix') ?? readOption(args, '--ultramodern-package-name-prefix') ?? current.packageSource?.aliasPackageNamePrefix ?? (aliasScope ? BLEEDINGDEV_PACKAGE_NAME_PREFIX : void 0);
+    if ('workspace' === strategy) return {
+        strategy,
+        modernPackageVersion: WORKSPACE_PACKAGE_VERSION,
+        ...registry ? {
+            registry
+        } : {},
+        ...aliasScope ? {
+            aliasScope
+        } : {},
+        ...aliasPackageNamePrefix ? {
+            aliasPackageNamePrefix
+        } : {}
+    };
+    const version = readOption(args, '--version') ?? readOption(args, '--ultramodern-package-version') ?? current.packageSource?.modernPackageVersion;
+    if (!version || version === WORKSPACE_PACKAGE_VERSION) throw new Error('migrate-strict-effect needs --version <published-ultramodern-version> for install package source.');
+    return {
+        strategy,
+        modernPackageVersion: version,
+        ...registry ? {
+            registry
+        } : {},
+        ...aliasScope ? {
+            aliasScope
+        } : {},
+        ...aliasPackageNamePrefix ? {
+            aliasPackageNamePrefix
+        } : {}
+    };
+}
+export { createMigrationPackageSource };

package/dist/esm/ultramodern-tooling/commands/migrate-strict-effect/pnpm-policy.js

@@ -0,0 +1,383 @@
+import node_crypto from "node:crypto";
+import node_fs from "node:fs";
+import node_path from "node:path";
+import { readWorkspaceReleaseCohort, releaseCohortSelectors } from "../../../ultramodern-release-cohort.js";
+import { resolveWorkspacePackageLinkingPolicy } from "../../../ultramodern-workspace/package-source.js";
+import { ULTRAMODERN_PACKAGE_PINS, ULTRAMODERN_WORKSPACE_POLICY, renderMinimumReleaseAgeExclude, resolveReleaseAgeApprovals } from "../../../ultramodern-workspace/policy.js";
+import { workspaceUsesDependency } from "./dependency-usage.js";
+import { discoverReachablePnpmLockReleaseAgeClosure, isYamlRecord, parsePnpmWorkspaceYaml, stringifyPnpmWorkspaceYaml } from "./pnpm-yaml.js";
+const exactVersionPattern = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
+const legacyBareReleaseAgePackages = new Set([
+    ...Object.keys(ULTRAMODERN_PACKAGE_PINS.appDependencies),
+    ...Object.keys(ULTRAMODERN_PACKAGE_PINS.appDevDependencies),
+    ...Object.keys(ULTRAMODERN_PACKAGE_PINS.transitiveDependencies),
+    '@module-federation/bridge-react-webpack-plugin',
+    '@module-federation/cli',
+    '@module-federation/dts-plugin',
+    '@module-federation/enhanced',
+    '@module-federation/error-codes',
+    '@module-federation/inject-external-runtime-core-plugin',
+    '@module-federation/managers',
+    '@module-federation/manifest',
+    '@module-federation/rsbuild-plugin',
+    '@module-federation/rspack',
+    '@module-federation/runtime-core',
+    '@module-federation/runtime-tools',
+    '@module-federation/sdk',
+    '@module-federation/third-party-dts-extractor',
+    '@module-federation/webpack-bundler-runtime',
+    '@rsbuild/core',
+    '@rsbuild/plugin-react',
+    '@rsbuild/plugin-type-check',
+    '@rspack/binding',
+    '@rspack/core',
+    '@rspack/plugin-react-refresh',
+    'ts-checker-rspack-plugin'
+]);
+const knownStaleReleaseAgeEntries = new Set([
+    '@effect/opentelemetry@4.0.0-beta.92',
+    '@effect/opentelemetry@4.0.0-beta.94',
+    "@typescript/native-preview@7.0.0-dev.20260628.1",
+    "@typescript/typescript6@6.0.2",
+    '@cloudflare/workers-types@5.20260708.1',
+    'effect@4.0.0-beta.92',
+    'effect@4.0.0-beta.94',
+    'i18next@26.3.1',
+    'miniflare@4.20260708.0',
+    'workerd@1.20260708.1',
+    'wrangler@4.109.0',
+    ...ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals.filter((approval)=>approval.packageName.startsWith('@module-federation/')).map((approval)=>`${approval.packageName}@2.6.0`)
+]);
+const canonicalReleaseAgeEntries = new Set(ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals.map((approval)=>`${approval.packageName}@${approval.version}`));
+const retiredTypescriptPeerOverrides = new Set([
+    "@module-federation/dts-plugin>typescript",
+    "@module-federation/enhanced>typescript",
+    "@module-federation/modern-js-v3>typescript",
+    "@module-federation/rspack>typescript",
+    "i18next>typescript"
+]);
+function ensureMap(document, key) {
+    const current = document[key];
+    if (void 0 === current) {
+        const created = {};
+        document[key] = created;
+        return created;
+    }
+    if (!isYamlRecord(current)) throw new Error(`pnpm-workspace.yaml ${key} must be a mapping.`);
+    return current;
+}
+function setOwnedScalar(document, key, value) {
+    const current = document[key];
+    if (void 0 !== current && 'object' == typeof current) throw new Error(`pnpm-workspace.yaml ${key} must be a scalar.`);
+    document[key] = value;
+}
+function reconcileOwnedMap(target, expected) {
+    for (const [key, value] of Object.entries(expected))target[key] = value;
+}
+function assertUniqueStringList(value, key) {
+    if (!Array.isArray(value) || value.some((item)=>'string' != typeof item)) throw new Error(`pnpm-workspace.yaml ${key} must be a string list.`);
+    const entries = value;
+    if (new Set(entries).size !== entries.length) throw new Error(`pnpm-workspace.yaml ${key} contains duplicate entries.`);
+    return entries;
+}
+function packageVersionParts(selector) {
+    const separator = selector.lastIndexOf('@');
+    if (separator <= 0) return;
+    return {
+        packageName: selector.slice(0, separator),
+        version: selector.slice(separator + 1)
+    };
+}
+function assertOwnedReleaseAgeList(current, expected) {
+    const entries = assertUniqueStringList(current, 'minimumReleaseAgeExclude');
+    const expectedSet = new Set(expected);
+    for (const entry of entries){
+        if (expectedSet.has(entry) || canonicalReleaseAgeEntries.has(entry) || knownStaleReleaseAgeEntries.has(entry)) continue;
+        if ('@bleedingdev/modern-js-*' === entry || '@module-federation/*' === entry || '@rspack/binding-*' === entry || legacyBareReleaseAgePackages.has(entry)) continue;
+        if (/^@bleedingdev\/modern-js-[^@]+@[^@]+$/u.test(entry)) continue;
+        const parts = packageVersionParts(entry);
+        if (!parts || !exactVersionPattern.test(parts.version)) throw new Error(`Unapproved release-age exclusion "${entry}" is not an exact package@version.`);
+        throw new Error(`Unapproved release-age exclusion "${entry}" has no canonical review evidence.`);
+    }
+}
+function assertOwnedTrustPolicyList(current, expected) {
+    const entries = assertUniqueStringList(current, 'trustPolicyExclude');
+    const expectedSet = new Set(expected);
+    for (const entry of entries)if (!expectedSet.has(entry) && 'effect@4.0.0-beta.92' !== entry && '@effect/opentelemetry@4.0.0-beta.92' !== entry && 'effect@4.0.0-beta.94' !== entry && '@effect/opentelemetry@4.0.0-beta.94' !== entry) throw new Error(`Unmatched trust-policy exclusion "${entry}" cannot be migrated safely.`);
+}
+function patchKey(patch) {
+    return `${patch.packageName}@${patch.version}`;
+}
+function reconcilePatchedDependencies(document, includeDrizzleOrmPatch) {
+    const policy = ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies;
+    const expectedPatches = [
+        ...policy.required,
+        ...includeDrizzleOrmPatch ? policy.conditional : []
+    ];
+    const expected = new Map(expectedPatches.map((patch)=>[
+            patchKey(patch),
+            patch.path
+        ]));
+    const stale = new Map(policy.stale.map((patch)=>[
+            patchKey(patch),
+            patch
+        ]));
+    const ownedPackageNames = new Set([
+        ...policy.required,
+        ...policy.conditional,
+        ...policy.stale
+    ].map((patch)=>patch.packageName));
+    const patchedDependencies = ensureMap(document, 'patchedDependencies');
+    for (const [selector, patchPath] of Object.entries(patchedDependencies)){
+        const stalePatch = stale.get(selector);
+        if (stalePatch) {
+            if (patchPath !== stalePatch.path) throw new Error(`Stale framework patch ${selector} uses an unrecognized path and cannot be removed safely.`);
+            delete patchedDependencies[selector];
+            continue;
+        }
+        const parts = packageVersionParts(selector);
+        if (parts && ownedPackageNames.has(parts.packageName) && !expected.has(selector)) {
+            const conditionalPatch = policy.conditional.find((patch)=>patchKey(patch) === selector);
+            if (conditionalPatch && !includeDrizzleOrmPatch && patchPath === conditionalPatch.path) {
+                delete patchedDependencies[selector];
+                continue;
+            }
+            throw new Error(`Framework-owned patch selector ${selector} has unknown provenance.`);
+        }
+    }
+    for (const [selector, patchPath] of expected)patchedDependencies[selector] = patchPath;
+}
+function reconcilePnpmPolicy(document, includeDrizzleOrmPatch, packageSource, releaseCohort, now) {
+    const policy = ULTRAMODERN_WORKSPACE_POLICY.pnpm;
+    const minimumReleaseAgeExclude = renderMinimumReleaseAgeExclude({
+        now,
+        packageSource,
+        releaseCohort
+    });
+    const workspacePackageLinkingPolicy = resolveWorkspacePackageLinkingPolicy(packageSource);
+    if (void 0 !== document.minimumReleaseAgeExclude) assertOwnedReleaseAgeList(document.minimumReleaseAgeExclude, minimumReleaseAgeExclude);
+    if (void 0 !== document.trustPolicyExclude) assertOwnedTrustPolicyList(document.trustPolicyExclude, policy.trustPolicyExclude);
+    for (const [key, value] of [
+        [
+            'minimumReleaseAge',
+            policy.minimumReleaseAge
+        ],
+        [
+            'minimumReleaseAgeStrict',
+            policy.minimumReleaseAgeStrict
+        ],
+        [
+            'minimumReleaseAgeIgnoreMissingTime',
+            policy.minimumReleaseAgeIgnoreMissingTime
+        ],
+        [
+            'trustPolicy',
+            policy.trustPolicy
+        ],
+        [
+            'trustPolicyIgnoreAfter',
+            policy.trustPolicyIgnoreAfter
+        ],
+        [
+            'blockExoticSubdeps',
+            policy.blockExoticSubdeps
+        ],
+        [
+            'engineStrict',
+            policy.engineStrict
+        ],
+        [
+            'pmOnFail',
+            policy.pmOnFail
+        ],
+        [
+            'verifyDepsBeforeRun',
+            policy.verifyDepsBeforeRun
+        ],
+        [
+            'strictDepBuilds',
+            policy.strictDepBuilds
+        ]
+    ])setOwnedScalar(document, key, value);
+    for (const key of [
+        'injectWorkspacePackages',
+        'linkWorkspacePackages'
+    ]){
+        const value = workspacePackageLinkingPolicy[key];
+        if (void 0 === value) delete document[key];
+        else setOwnedScalar(document, key, value);
+    }
+    document.minimumReleaseAgeExclude = minimumReleaseAgeExclude;
+    document.trustPolicyExclude = [
+        ...policy.trustPolicyExclude
+    ];
+    const peerDependencyRules = ensureMap(document, 'peerDependencyRules');
+    const allowedVersions = ensureMap(peerDependencyRules, 'allowedVersions');
+    for (const selector of retiredTypescriptPeerOverrides)delete allowedVersions[selector];
+    reconcileOwnedMap(allowedVersions, policy.peerDependencyRules.allowedVersions);
+    const overrides = ensureMap(document, 'overrides');
+    const ownedOverrideNames = new Set(Object.keys(policy.overrides));
+    for (const selector of Object.keys(overrides)){
+        const parts = packageVersionParts(selector);
+        if (parts && ownedOverrideNames.has(parts.packageName)) delete overrides[selector];
+    }
+    reconcileOwnedMap(overrides, policy.overrides);
+    const packageExtensions = document.packageExtensions;
+    if (void 0 !== packageExtensions) {
+        if (!isYamlRecord(packageExtensions)) throw new Error('pnpm-workspace.yaml packageExtensions must be a mapping.');
+        for (const selector of Object.keys(packageExtensions))if (packageVersionParts(selector)?.packageName === '@module-federation/dts-plugin') delete packageExtensions[selector];
+        if (0 === Object.keys(packageExtensions).length) delete document.packageExtensions;
+    }
+    reconcileOwnedMap(ensureMap(document, 'allowBuilds'), policy.allowBuilds);
+    reconcilePatchedDependencies(document, includeDrizzleOrmPatch);
+}
+function stalePatchFilesToRemove(workspaceRoot) {
+    const staleFiles = [];
+    for (const patch of ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies.stale){
+        const patchPath = node_path.join(workspaceRoot, patch.path);
+        if (!node_fs.existsSync(patchPath)) continue;
+        const digest = node_crypto.createHash('sha256').update(node_fs.readFileSync(patchPath)).digest('hex');
+        const acceptedDigests = new Set([
+            patch.sha256,
+            ...patch.acceptedLegacySha256 ?? []
+        ]);
+        if (!acceptedDigests.has(digest)) throw new Error(`Stale framework patch ${patch.path} was modified (expected a reviewed sha256, found ${digest}); refusing to delete it.`);
+        staleFiles.push(patchPath);
+    }
+    return staleFiles;
+}
+function updateGeneratedPnpmWorkspacePolicy(io, packageSource, options = {}) {
+    const workspaceFile = node_path.join(io.workspaceRoot, 'pnpm-workspace.yaml');
+    if (!node_fs.existsSync(workspaceFile)) return false;
+    const source = node_fs.readFileSync(workspaceFile, 'utf-8');
+    const { document, lineEnding } = parsePnpmWorkspaceYaml(source, workspaceFile);
+    const before = JSON.stringify(document);
+    reconcilePnpmPolicy(document, workspaceUsesDependency(io.workspaceRoot, 'drizzle-orm'), packageSource, options.releaseCohort, options.now);
+    const stalePatchFiles = stalePatchFilesToRemove(io.workspaceRoot);
+    let changed = false;
+    if (JSON.stringify(document) !== before) changed = io.write(workspaceFile, stringifyPnpmWorkspaceYaml(document, lineEnding)) || changed;
+    for (const stalePatchFile of stalePatchFiles)changed = io.remove(stalePatchFile) || changed;
+    return changed;
+}
+function packageRegistryUrl(registryUrl, packageName) {
+    let base;
+    try {
+        base = new URL(registryUrl);
+    } catch  {
+        throw new Error(`Registry URL is invalid: ${registryUrl}`);
+    }
+    if ('https:' !== base.protocol) throw new Error(`Registry URL must use HTTPS: ${registryUrl}`);
+    const encodedName = packageName.startsWith('@') ? packageName.replace('/', '%2f') : encodeURIComponent(packageName);
+    return new URL(encodedName, base);
+}
+function packageVersionKey(packageName, version) {
+    return `${packageName}@${version}`;
+}
+function isRegistryRecord(value) {
+    return Boolean(value) && 'object' == typeof value && !Array.isArray(value);
+}
+async function resolveRegistryCandidates(candidates, options) {
+    const nowTimestamp = options.now.getTime();
+    if (!Number.isFinite(nowTimestamp)) throw new Error('Release-age validation requires a valid current time.');
+    return Promise.all(candidates.map(async (candidate)=>{
+        const key = packageVersionKey(candidate.packageName, candidate.version);
+        let response;
+        try {
+            response = await options.fetchImpl(packageRegistryUrl(options.registryUrl, candidate.packageName), {
+                headers: {
+                    accept: 'application/json'
+                },
+                redirect: 'error'
+            });
+        } catch (error) {
+            throw new Error(`Registry metadata is uncertain for ${key} (${candidate.path.join(' -> ')}): ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!response.ok) throw new Error(`Registry metadata is uncertain for ${key} (${candidate.path.join(' -> ')}): HTTP ${response.status}`);
+        let packument;
+        try {
+            packument = await response.json();
+        } catch (error) {
+            throw new Error(`Registry metadata is invalid JSON for ${key}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!isRegistryRecord(packument)) throw new Error(`Registry metadata is invalid for ${key}.`);
+        const versions = packument.versions;
+        const time = packument.time;
+        const versionMetadata = isRegistryRecord(versions) ? versions[candidate.version] : void 0;
+        const dist = isRegistryRecord(versionMetadata) ? versionMetadata.dist : void 0;
+        const integrity = isRegistryRecord(dist) ? dist.integrity : void 0;
+        if (integrity !== candidate.registry.dist.integrity) throw new Error(`Registry metadata integrity mismatch for ${key}: lock has ${candidate.registry.dist.integrity}, registry has ${String(integrity)}`);
+        const publishedAt = isRegistryRecord(time) ? time[candidate.version] : void 0;
+        const publishedAtTimestamp = 'string' == typeof publishedAt ? Date.parse(publishedAt) : NaN;
+        if ('string' != typeof publishedAt || !Number.isFinite(publishedAtTimestamp) || publishedAtTimestamp > nowTimestamp) throw new Error(`Registry publication time is missing, invalid, or in the future for ${key}.`);
+        return {
+            ...candidate,
+            registry: {
+                ...candidate.registry,
+                publishedAt: new Date(publishedAtTimestamp).toISOString()
+            }
+        };
+    }));
+}
+async function validateGeneratedPnpmLockReleaseAgePolicy(workspaceRoot, packageSource, options = {}) {
+    const lockfilePath = node_path.join(workspaceRoot, 'pnpm-lock.yaml');
+    if (!node_fs.existsSync(lockfilePath)) throw new Error('Cannot validate release-age approvals without pnpm-lock.yaml.');
+    const now = options.now ?? new Date();
+    const releaseCohort = options.releaseCohort ?? ('install' === packageSource.strategy ? readWorkspaceReleaseCohort(workspaceRoot) : void 0);
+    const activeSelectors = renderMinimumReleaseAgeExclude({
+        now,
+        packageSource,
+        releaseCohort
+    });
+    const workspacePolicyPath = node_path.join(workspaceRoot, 'pnpm-workspace.yaml');
+    const { document: workspacePolicy } = parsePnpmWorkspaceYaml(node_fs.readFileSync(workspacePolicyPath, 'utf-8'), workspacePolicyPath);
+    const renderedSelectors = assertUniqueStringList(workspacePolicy.minimumReleaseAgeExclude, 'minimumReleaseAgeExclude');
+    if (JSON.stringify(renderedSelectors) !== JSON.stringify(activeSelectors)) throw new Error('pnpm-workspace.yaml release-age exclusions do not match canonical policy.');
+    const firstPartySelectors = new Set(releaseCohort ? releaseCohortSelectors(releaseCohort) : []);
+    const firstPartyTargetNames = new Set(releaseCohort?.packages.map((item)=>item.targetName) ?? []);
+    const { document: lockfile } = parsePnpmWorkspaceYaml(node_fs.readFileSync(lockfilePath, 'utf-8'), lockfilePath);
+    const closure = discoverReachablePnpmLockReleaseAgeClosure(lockfile);
+    if (closure.unresolved.length > 0) {
+        const unresolved = closure.unresolved.slice(0, 20).map((candidate)=>{
+            const packageName = candidate.package ?? 'unknown package';
+            return `- ${packageName}: ${candidate.reason}; path ${candidate.path.join(' -> ')}`;
+        }).join('\n');
+        throw new Error(`Dependency closure has unresolved candidates:\n${unresolved}`);
+    }
+    const closureKeys = new Set(closure.candidates.map((candidate)=>packageVersionKey(candidate.packageName, candidate.version)));
+    const approvals = ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals.filter((approval)=>closureKeys.has(`${approval.packageName}@${approval.version}`));
+    const isFirstPartyCandidate = (packageName, version)=>{
+        if (!firstPartyTargetNames.has(packageName)) return false;
+        const key = `${packageName}@${version}`;
+        if (!firstPartySelectors.has(key)) throw new Error(`First-party lock candidate ${key} is absent from the authenticated release cohort.`);
+        return true;
+    };
+    const thirdPartyCandidates = closure.candidates.filter((candidate)=>!isFirstPartyCandidate(candidate.packageName, candidate.version));
+    const activeCandidates = await resolveRegistryCandidates(thirdPartyCandidates, {
+        fetchImpl: options.fetchImpl ?? fetch,
+        now,
+        registryUrl: options.registryUrl ?? packageSource.registry ?? 'https://registry.npmjs.org/'
+    });
+    const resolved = resolveReleaseAgeApprovals(activeCandidates, {
+        approvals,
+        now
+    });
+    if (resolved.reviewCandidates.length > 0) {
+        const pathsByKey = new Map(thirdPartyCandidates.map((candidate)=>[
+                packageVersionKey(candidate.packageName, candidate.version),
+                candidate.path
+            ]));
+        throw new Error([
+            `Dependency closure contains ${resolved.reviewCandidates.length} immature package(s) without an exact, unexpired approval:`,
+            ...resolved.reviewCandidates.slice(0, 20).map((candidate)=>{
+                const key = packageVersionKey(candidate.packageName, candidate.version);
+                return `- ${key}; path ${pathsByKey.get(key)?.join(' -> ') ?? 'unknown'}`;
+            })
+        ].join('\n'));
+    }
+    return {
+        ...resolved,
+        minimumReleaseAgeExclude: activeSelectors
+    };
+}
+export { ensureGeneratedDeclarationPatches } from "./declaration-patches.js";
+export { updateGeneratedPnpmWorkspacePolicy, validateGeneratedPnpmLockReleaseAgePolicy, workspaceUsesDependency };