@bleedingdev/modern-js-create 3.5.0-ultramodern.9 → 3.5.0-ultramodern.90

package/dist/esm/ultramodern-tooling/commands/migrate-strict-effect/pnpm-policy.js

@@ -0,0 +1,417 @@
+import node_crypto from "node:crypto";
+import node_fs from "node:fs";
+import node_path from "node:path";
+import { readWorkspaceReleaseCohort, releaseCohortSelectors } from "../../../ultramodern-release-cohort.js";
+import { resolveWorkspacePackageLinkingPolicy } from "../../../ultramodern-workspace/package-source.js";
+import { ULTRAMODERN_PACKAGE_PINS, ULTRAMODERN_WORKSPACE_POLICY, renderMinimumReleaseAgeExclude, resolveReleaseAgeApprovals } from "../../../ultramodern-workspace/policy.js";
+import { workspaceUsesDependency } from "./dependency-usage.js";
+import { discoverReachablePnpmLockReleaseAgeClosure, isYamlRecord, parsePnpmWorkspaceYaml, stringifyPnpmWorkspaceYaml } from "./pnpm-yaml.js";
+const exactVersionPattern = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
+const legacyBareReleaseAgePackages = new Set([
+    ...Object.keys(ULTRAMODERN_PACKAGE_PINS.appDependencies),
+    ...Object.keys(ULTRAMODERN_PACKAGE_PINS.appDevDependencies),
+    ...Object.keys(ULTRAMODERN_PACKAGE_PINS.transitiveDependencies),
+    '@module-federation/bridge-react-webpack-plugin',
+    '@module-federation/cli',
+    '@module-federation/dts-plugin',
+    '@module-federation/enhanced',
+    '@module-federation/error-codes',
+    '@module-federation/inject-external-runtime-core-plugin',
+    '@module-federation/managers',
+    '@module-federation/manifest',
+    '@module-federation/rsbuild-plugin',
+    '@module-federation/rspack',
+    '@module-federation/runtime-core',
+    '@module-federation/runtime-tools',
+    '@module-federation/sdk',
+    '@module-federation/third-party-dts-extractor',
+    '@module-federation/webpack-bundler-runtime',
+    '@rsbuild/core',
+    '@rsbuild/plugin-react',
+    '@rsbuild/plugin-type-check',
+    '@rspack/binding',
+    '@rspack/core',
+    '@rspack/plugin-react-refresh',
+    'ts-checker-rspack-plugin'
+]);
+const knownStaleReleaseAgeEntries = new Set([
+    '@effect/opentelemetry@4.0.0-beta.92',
+    '@effect/opentelemetry@4.0.0-beta.94',
+    "@typescript/native-preview@7.0.0-dev.20260628.1",
+    "@typescript/typescript6@6.0.2",
+    '@cloudflare/workers-types@5.20260708.1',
+    'effect@4.0.0-beta.92',
+    'effect@4.0.0-beta.94',
+    'i18next@26.3.1',
+    'miniflare@4.20260708.0',
+    'workerd@1.20260708.1',
+    'wrangler@4.109.0',
+    ...ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals.filter((approval)=>approval.packageName.startsWith('@module-federation/')).map((approval)=>`${approval.packageName}@2.6.0`)
+]);
+const canonicalReleaseAgeEntries = new Set(ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals.map((approval)=>`${approval.packageName}@${approval.version}`));
+const retiredTypescriptPeerOverrides = new Set([
+    "@module-federation/dts-plugin>typescript",
+    "@module-federation/enhanced>typescript",
+    "@module-federation/modern-js-v3>typescript",
+    "@module-federation/rspack>typescript",
+    "i18next>typescript"
+]);
+function ensureMap(document, key) {
+    const current = document[key];
+    if (void 0 === current) {
+        const created = {};
+        document[key] = created;
+        return created;
+    }
+    if (!isYamlRecord(current)) throw new Error(`pnpm-workspace.yaml ${key} must be a mapping.`);
+    return current;
+}
+function setOwnedScalar(document, key, value) {
+    const current = document[key];
+    if (void 0 !== current && 'object' == typeof current) throw new Error(`pnpm-workspace.yaml ${key} must be a scalar.`);
+    document[key] = value;
+}
+function reconcileOwnedMap(target, expected) {
+    for (const [key, value] of Object.entries(expected))target[key] = value;
+}
+function assertUniqueStringList(value, key) {
+    if (!Array.isArray(value) || value.some((item)=>'string' != typeof item)) throw new Error(`pnpm-workspace.yaml ${key} must be a string list.`);
+    const entries = value;
+    if (new Set(entries).size !== entries.length) throw new Error(`pnpm-workspace.yaml ${key} contains duplicate entries.`);
+    return entries;
+}
+function packageVersionParts(selector) {
+    const separator = selector.lastIndexOf('@');
+    if (separator <= 0) return;
+    return {
+        packageName: selector.slice(0, separator),
+        version: selector.slice(separator + 1)
+    };
+}
+function assertOwnedReleaseAgeList(current, expected) {
+    const entries = assertUniqueStringList(current, 'minimumReleaseAgeExclude');
+    const expectedSet = new Set(expected);
+    for (const entry of entries){
+        if (expectedSet.has(entry) || canonicalReleaseAgeEntries.has(entry) || knownStaleReleaseAgeEntries.has(entry)) continue;
+        if ('@bleedingdev/modern-js-*' === entry || '@module-federation/*' === entry || '@rspack/binding-*' === entry || legacyBareReleaseAgePackages.has(entry)) continue;
+        if (/^@bleedingdev\/modern-js-[^@]+@[^@]+$/u.test(entry)) continue;
+        const parts = packageVersionParts(entry);
+        if (!parts || !exactVersionPattern.test(parts.version)) throw new Error(`Unapproved release-age exclusion "${entry}" is not an exact package@version.`);
+        throw new Error(`Unapproved release-age exclusion "${entry}" has no canonical review evidence.`);
+    }
+}
+function assertOwnedTrustPolicyList(current, expected) {
+    const entries = assertUniqueStringList(current, 'trustPolicyExclude');
+    const expectedSet = new Set(expected);
+    for (const entry of entries)if (!expectedSet.has(entry) && 'effect@4.0.0-beta.92' !== entry && '@effect/opentelemetry@4.0.0-beta.92' !== entry && 'effect@4.0.0-beta.94' !== entry && '@effect/opentelemetry@4.0.0-beta.94' !== entry) throw new Error(`Unmatched trust-policy exclusion "${entry}" cannot be migrated safely.`);
+}
+function patchKey(patch) {
+    return `${patch.packageName}@${patch.version}`;
+}
+function reconcilePatchedDependencies(document, includeDrizzleOrmPatch) {
+    const policy = ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies;
+    const expectedPatches = [
+        ...policy.required,
+        ...includeDrizzleOrmPatch ? policy.conditional : []
+    ];
+    const expected = new Map(expectedPatches.map((patch)=>[
+            patchKey(patch),
+            patch.path
+        ]));
+    const stale = new Map(policy.stale.map((patch)=>[
+            patchKey(patch),
+            patch
+        ]));
+    const ownedPackageNames = new Set([
+        ...policy.required,
+        ...policy.conditional,
+        ...policy.stale
+    ].map((patch)=>patch.packageName));
+    const patchedDependencies = ensureMap(document, 'patchedDependencies');
+    for (const [selector, patchPath] of Object.entries(patchedDependencies)){
+        const stalePatch = stale.get(selector);
+        if (stalePatch) {
+            if (patchPath !== stalePatch.path) throw new Error(`Stale framework patch ${selector} uses an unrecognized path and cannot be removed safely.`);
+            delete patchedDependencies[selector];
+            continue;
+        }
+        const parts = packageVersionParts(selector);
+        if (parts && ownedPackageNames.has(parts.packageName) && !expected.has(selector)) {
+            const conditionalPatch = policy.conditional.find((patch)=>patchKey(patch) === selector);
+            if (conditionalPatch && !includeDrizzleOrmPatch && patchPath === conditionalPatch.path) {
+                delete patchedDependencies[selector];
+                continue;
+            }
+            throw new Error(`Framework-owned patch selector ${selector} has unknown provenance.`);
+        }
+    }
+    for (const [selector, patchPath] of expected)patchedDependencies[selector] = patchPath;
+}
+function reconcilePnpmPolicy(document, includeDrizzleOrmPatch, packageSource, releaseCohort, now) {
+    const policy = ULTRAMODERN_WORKSPACE_POLICY.pnpm;
+    const minimumReleaseAgeExclude = renderMinimumReleaseAgeExclude({
+        now,
+        packageSource,
+        releaseCohort
+    });
+    const workspacePackageLinkingPolicy = resolveWorkspacePackageLinkingPolicy(packageSource);
+    if (void 0 !== document.minimumReleaseAgeExclude) assertOwnedReleaseAgeList(document.minimumReleaseAgeExclude, minimumReleaseAgeExclude);
+    if (void 0 !== document.trustPolicyExclude) assertOwnedTrustPolicyList(document.trustPolicyExclude, policy.trustPolicyExclude);
+    for (const [key, value] of [
+        [
+            'minimumReleaseAge',
+            policy.minimumReleaseAge
+        ],
+        [
+            'minimumReleaseAgeStrict',
+            policy.minimumReleaseAgeStrict
+        ],
+        [
+            'minimumReleaseAgeIgnoreMissingTime',
+            policy.minimumReleaseAgeIgnoreMissingTime
+        ],
+        [
+            'trustPolicy',
+            policy.trustPolicy
+        ],
+        [
+            'trustPolicyIgnoreAfter',
+            policy.trustPolicyIgnoreAfter
+        ],
+        [
+            'blockExoticSubdeps',
+            policy.blockExoticSubdeps
+        ],
+        [
+            'engineStrict',
+            policy.engineStrict
+        ],
+        [
+            'pmOnFail',
+            policy.pmOnFail
+        ],
+        [
+            'verifyDepsBeforeRun',
+            policy.verifyDepsBeforeRun
+        ],
+        [
+            'strictDepBuilds',
+            policy.strictDepBuilds
+        ]
+    ])setOwnedScalar(document, key, value);
+    for (const key of [
+        'injectWorkspacePackages',
+        'linkWorkspacePackages'
+    ]){
+        const value = workspacePackageLinkingPolicy[key];
+        if (void 0 === value) delete document[key];
+        else setOwnedScalar(document, key, value);
+    }
+    document.minimumReleaseAgeExclude = minimumReleaseAgeExclude;
+    document.trustPolicyExclude = [
+        ...policy.trustPolicyExclude
+    ];
+    const peerDependencyRules = ensureMap(document, 'peerDependencyRules');
+    const allowedVersions = ensureMap(peerDependencyRules, 'allowedVersions');
+    for (const selector of retiredTypescriptPeerOverrides)delete allowedVersions[selector];
+    reconcileOwnedMap(allowedVersions, policy.peerDependencyRules.allowedVersions);
+    const overrides = ensureMap(document, 'overrides');
+    const ownedOverrideNames = new Set(Object.keys(policy.overrides));
+    for (const selector of Object.keys(overrides)){
+        const parts = packageVersionParts(selector);
+        if (parts && ownedOverrideNames.has(parts.packageName)) delete overrides[selector];
+    }
+    reconcileOwnedMap(overrides, policy.overrides);
+    const packageExtensions = document.packageExtensions;
+    if (void 0 !== packageExtensions) {
+        if (!isYamlRecord(packageExtensions)) throw new Error('pnpm-workspace.yaml packageExtensions must be a mapping.');
+        for (const selector of Object.keys(packageExtensions))if (packageVersionParts(selector)?.packageName === '@module-federation/dts-plugin') delete packageExtensions[selector];
+        if (0 === Object.keys(packageExtensions).length) delete document.packageExtensions;
+    }
+    reconcileOwnedMap(ensureMap(document, 'allowBuilds'), policy.allowBuilds);
+    reconcilePatchedDependencies(document, includeDrizzleOrmPatch);
+}
+function stalePatchFilesToRemove(workspaceRoot) {
+    const staleFiles = [];
+    for (const patch of ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies.stale){
+        const patchPath = node_path.join(workspaceRoot, patch.path);
+        if (!node_fs.existsSync(patchPath)) continue;
+        const digest = node_crypto.createHash('sha256').update(node_fs.readFileSync(patchPath)).digest('hex');
+        const acceptedDigests = new Set([
+            patch.sha256,
+            ...patch.acceptedLegacySha256 ?? []
+        ]);
+        if (!acceptedDigests.has(digest)) throw new Error(`Stale framework patch ${patch.path} was modified (expected a reviewed sha256, found ${digest}); refusing to delete it.`);
+        staleFiles.push(patchPath);
+    }
+    return staleFiles;
+}
+function updateGeneratedPnpmWorkspacePolicy(io, packageSource, options = {}) {
+    const workspaceFile = node_path.join(io.workspaceRoot, 'pnpm-workspace.yaml');
+    if (!node_fs.existsSync(workspaceFile)) return false;
+    const source = node_fs.readFileSync(workspaceFile, 'utf-8');
+    const { document, lineEnding } = parsePnpmWorkspaceYaml(source, workspaceFile);
+    const before = JSON.stringify(document);
+    reconcilePnpmPolicy(document, workspaceUsesDependency(io.workspaceRoot, 'drizzle-orm'), packageSource, options.releaseCohort, options.now);
+    const stalePatchFiles = stalePatchFilesToRemove(io.workspaceRoot);
+    let changed = false;
+    if (JSON.stringify(document) !== before) changed = io.write(workspaceFile, stringifyPnpmWorkspaceYaml(document, lineEnding)) || changed;
+    for (const stalePatchFile of stalePatchFiles)changed = io.remove(stalePatchFile) || changed;
+    return changed;
+}
+function packageRegistryUrl(registryUrl, packageName) {
+    let base;
+    try {
+        base = new URL(registryUrl);
+    } catch  {
+        throw new Error(`Registry URL is invalid: ${registryUrl}`);
+    }
+    if ('https:' !== base.protocol) throw new Error(`Registry URL must use HTTPS: ${registryUrl}`);
+    const encodedName = packageName.startsWith('@') ? packageName.replace('/', '%2f') : encodeURIComponent(packageName);
+    return new URL(encodedName, base);
+}
+function packageVersionKey(packageName, version) {
+    return `${packageName}@${version}`;
+}
+function isRegistryRecord(value) {
+    return Boolean(value) && 'object' == typeof value && !Array.isArray(value);
+}
+const registryFetchConcurrency = 16;
+const registryFetchAttempts = 3;
+const registryFetchRetryDelayMs = 250;
+function isTransientRegistryStatus(status) {
+    return 429 === status || status >= 500;
+}
+async function fetchRegistryResponse(fetchImpl, url) {
+    let lastError;
+    for(let attempt = 0; attempt < registryFetchAttempts; attempt += 1){
+        try {
+            const response = await fetchImpl(url, {
+                headers: {
+                    accept: 'application/json'
+                },
+                redirect: 'error'
+            });
+            if (response.ok || !isTransientRegistryStatus(response.status) || attempt === registryFetchAttempts - 1) return response;
+            lastError = new Error(`HTTP ${response.status}`);
+        } catch (error) {
+            lastError = error;
+            if (attempt === registryFetchAttempts - 1) throw error;
+        }
+        await new Promise((resolve)=>setTimeout(resolve, registryFetchRetryDelayMs * 2 ** attempt));
+    }
+    throw lastError;
+}
+async function resolveRegistryCandidates(candidates, options) {
+    const nowTimestamp = options.now.getTime();
+    if (!Number.isFinite(nowTimestamp)) throw new Error('Release-age validation requires a valid current time.');
+    async function resolveCandidate(candidate) {
+        const key = packageVersionKey(candidate.packageName, candidate.version);
+        let response;
+        try {
+            response = await fetchRegistryResponse(options.fetchImpl, packageRegistryUrl(options.registryUrl, candidate.packageName));
+        } catch (error) {
+            throw new Error(`Registry metadata is uncertain for ${key} (${candidate.path.join(' -> ')}): ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!response.ok) throw new Error(`Registry metadata is uncertain for ${key} (${candidate.path.join(' -> ')}): HTTP ${response.status}`);
+        let packument;
+        try {
+            packument = await response.json();
+        } catch (error) {
+            throw new Error(`Registry metadata is invalid JSON for ${key}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!isRegistryRecord(packument)) throw new Error(`Registry metadata is invalid for ${key}.`);
+        const versions = packument.versions;
+        const time = packument.time;
+        const versionMetadata = isRegistryRecord(versions) ? versions[candidate.version] : void 0;
+        const dist = isRegistryRecord(versionMetadata) ? versionMetadata.dist : void 0;
+        const integrity = isRegistryRecord(dist) ? dist.integrity : void 0;
+        if (integrity !== candidate.registry.dist.integrity) throw new Error(`Registry metadata integrity mismatch for ${key}: lock has ${candidate.registry.dist.integrity}, registry has ${String(integrity)}`);
+        const publishedAt = isRegistryRecord(time) ? time[candidate.version] : void 0;
+        const publishedAtTimestamp = 'string' == typeof publishedAt ? Date.parse(publishedAt) : NaN;
+        if ('string' != typeof publishedAt || !Number.isFinite(publishedAtTimestamp) || publishedAtTimestamp > nowTimestamp) throw new Error(`Registry publication time is missing, invalid, or in the future for ${key}.`);
+        return {
+            ...candidate,
+            registry: {
+                ...candidate.registry,
+                publishedAt: new Date(publishedAtTimestamp).toISOString()
+            }
+        };
+    }
+    const results = new Array(candidates.length);
+    let nextIndex = 0;
+    async function worker() {
+        while(nextIndex < candidates.length){
+            const index = nextIndex;
+            nextIndex += 1;
+            results[index] = await resolveCandidate(candidates[index]);
+        }
+    }
+    await Promise.all(Array.from({
+        length: Math.min(registryFetchConcurrency, candidates.length)
+    }, ()=>worker()));
+    return results;
+}
+async function validateGeneratedPnpmLockReleaseAgePolicy(workspaceRoot, packageSource, options = {}) {
+    const lockfilePath = node_path.join(workspaceRoot, 'pnpm-lock.yaml');
+    if (!node_fs.existsSync(lockfilePath)) throw new Error('Cannot validate release-age approvals without pnpm-lock.yaml.');
+    const now = options.now ?? new Date();
+    const releaseCohort = options.releaseCohort ?? ('install' === packageSource.strategy ? readWorkspaceReleaseCohort(workspaceRoot) : void 0);
+    const activeSelectors = renderMinimumReleaseAgeExclude({
+        now,
+        packageSource,
+        releaseCohort
+    });
+    const workspacePolicyPath = node_path.join(workspaceRoot, 'pnpm-workspace.yaml');
+    const { document: workspacePolicy } = parsePnpmWorkspaceYaml(node_fs.readFileSync(workspacePolicyPath, 'utf-8'), workspacePolicyPath);
+    const renderedSelectors = assertUniqueStringList(workspacePolicy.minimumReleaseAgeExclude, 'minimumReleaseAgeExclude');
+    if (JSON.stringify(renderedSelectors) !== JSON.stringify(activeSelectors)) throw new Error('pnpm-workspace.yaml release-age exclusions do not match canonical policy.');
+    const firstPartySelectors = new Set(releaseCohort ? releaseCohortSelectors(releaseCohort) : []);
+    const firstPartyTargetNames = new Set(releaseCohort?.packages.map((item)=>item.targetName) ?? []);
+    const { document: lockfile } = parsePnpmWorkspaceYaml(node_fs.readFileSync(lockfilePath, 'utf-8'), lockfilePath);
+    const closure = discoverReachablePnpmLockReleaseAgeClosure(lockfile);
+    if (closure.unresolved.length > 0) {
+        const unresolved = closure.unresolved.slice(0, 20).map((candidate)=>{
+            const packageName = candidate.package ?? 'unknown package';
+            return `- ${packageName}: ${candidate.reason}; path ${candidate.path.join(' -> ')}`;
+        }).join('\n');
+        throw new Error(`Dependency closure has unresolved candidates:\n${unresolved}`);
+    }
+    const closureKeys = new Set(closure.candidates.map((candidate)=>packageVersionKey(candidate.packageName, candidate.version)));
+    const approvals = ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals.filter((approval)=>closureKeys.has(`${approval.packageName}@${approval.version}`));
+    const isFirstPartyCandidate = (packageName, version)=>{
+        if (!firstPartyTargetNames.has(packageName)) return false;
+        const key = `${packageName}@${version}`;
+        if (!firstPartySelectors.has(key)) throw new Error(`First-party lock candidate ${key} is absent from the authenticated release cohort.`);
+        return true;
+    };
+    const thirdPartyCandidates = closure.candidates.filter((candidate)=>!isFirstPartyCandidate(candidate.packageName, candidate.version));
+    const activeCandidates = await resolveRegistryCandidates(thirdPartyCandidates, {
+        fetchImpl: options.fetchImpl ?? fetch,
+        now,
+        registryUrl: options.registryUrl ?? packageSource.registry ?? 'https://registry.npmjs.org/'
+    });
+    const resolved = resolveReleaseAgeApprovals(activeCandidates, {
+        approvals,
+        now
+    });
+    if (resolved.reviewCandidates.length > 0) {
+        const pathsByKey = new Map(thirdPartyCandidates.map((candidate)=>[
+                packageVersionKey(candidate.packageName, candidate.version),
+                candidate.path
+            ]));
+        throw new Error([
+            `Dependency closure contains ${resolved.reviewCandidates.length} immature package(s) without an exact, unexpired approval:`,
+            ...resolved.reviewCandidates.slice(0, 20).map((candidate)=>{
+                const key = packageVersionKey(candidate.packageName, candidate.version);
+                return `- ${key}; path ${pathsByKey.get(key)?.join(' -> ') ?? 'unknown'}`;
+            })
+        ].join('\n'));
+    }
+    return {
+        ...resolved,
+        minimumReleaseAgeExclude: activeSelectors
+    };
+}
+export { ensureGeneratedDeclarationPatches } from "./declaration-patches.js";
+export { updateGeneratedPnpmWorkspacePolicy, validateGeneratedPnpmLockReleaseAgePolicy, workspaceUsesDependency };