@bleedingdev/modern-js-ultramodern-create 3.8.3-ultramodern.2

package/dist/esm-node/ultramodern-tooling/commands/migrate-strict-effect/pnpm-policy.js

@@ -0,0 +1,536 @@
+import "node:module";
+import node_crypto from "node:crypto";
+import node_fs from "node:fs";
+import node_path from "node:path";
+import { readWorkspaceReleaseCohort, releaseCohortSelectors } from "../../../ultramodern-release-cohort.js";
+import { resolveWorkspacePackageLinkingPolicy } from "../../../ultramodern-workspace/package-source.js";
+import { ULTRAMODERN_PACKAGE_PINS, ULTRAMODERN_WORKSPACE_POLICY, renderMinimumReleaseAgeExclude, resolveReleaseAgeApprovals } from "../../../ultramodern-workspace/policy.js";
+import { workspaceUsesDependency } from "./dependency-usage.js";
+import { discoverReachablePnpmLockReleaseAgeClosure, isYamlRecord, parsePnpmWorkspaceYaml, stringifyPnpmWorkspaceYaml } from "./pnpm-yaml.js";
+const legacyBareReleaseAgePackages = new Set([
+    ...Object.keys(ULTRAMODERN_PACKAGE_PINS.appDependencies),
+    ...Object.keys(ULTRAMODERN_PACKAGE_PINS.appDevDependencies),
+    ...Object.keys(ULTRAMODERN_PACKAGE_PINS.transitiveDependencies),
+    '@module-federation/bridge-react-webpack-plugin',
+    '@module-federation/cli',
+    '@module-federation/dts-plugin',
+    '@module-federation/enhanced',
+    '@module-federation/error-codes',
+    '@module-federation/inject-external-runtime-core-plugin',
+    '@module-federation/managers',
+    '@module-federation/manifest',
+    '@module-federation/rsbuild-plugin',
+    '@module-federation/rspack',
+    '@module-federation/runtime-core',
+    '@module-federation/runtime-tools',
+    '@module-federation/sdk',
+    '@module-federation/third-party-dts-extractor',
+    '@module-federation/webpack-bundler-runtime',
+    '@rsbuild/core',
+    '@rsbuild/plugin-react',
+    '@rsbuild/plugin-type-check',
+    '@rspack/binding',
+    '@rspack/core',
+    '@rspack/plugin-react-refresh',
+    'ts-checker-rspack-plugin'
+]);
+const staleOxcBindingTargets = [
+    'android-arm-eabi',
+    'android-arm64',
+    'darwin-arm64',
+    'darwin-x64',
+    'freebsd-x64',
+    'linux-arm-gnueabihf',
+    'linux-arm-musleabihf',
+    'linux-arm64-gnu',
+    'linux-arm64-musl',
+    'linux-ppc64-gnu',
+    'linux-riscv64-gnu',
+    'linux-riscv64-musl',
+    'linux-s390x-gnu',
+    'linux-x64-gnu',
+    'linux-x64-musl',
+    'openharmony-arm64',
+    'win32-arm64-msvc',
+    'win32-ia32-msvc',
+    'win32-x64-msvc'
+];
+const reviewedAugust10EffectTsgoPackages = [
+    '@effect/tsgo',
+    '@effect/tsgo-win32-x64',
+    '@effect/tsgo-win32-arm64',
+    '@effect/tsgo-linux-x64',
+    '@effect/tsgo-linux-arm64',
+    '@effect/tsgo-linux-arm',
+    '@effect/tsgo-darwin-x64',
+    '@effect/tsgo-darwin-arm64'
+];
+const reviewedAugust10StaleReleaseAgeEntries = [
+    'effect@4.0.0-beta.107',
+    '@effect/opentelemetry@4.0.0-beta.107',
+    '@effect/vitest@4.0.0-beta.107',
+    ...reviewedAugust10EffectTsgoPackages.map((packageName)=>`${packageName}@0.36.2`),
+    'oxlint@1.78.0',
+    ...staleOxcBindingTargets.map((target)=>`@oxlint/binding-${target}@1.78.0`),
+    'oxfmt@0.63.0',
+    ...staleOxcBindingTargets.map((target)=>`@oxfmt/binding-${target}@0.63.0`)
+];
+const reviewedAugust24And25StaleReleaseAgeEntries = [
+    '@rsbuild/core@2.2.0-rc.0',
+    'baseline-browser-mapping@2.11.19',
+    'electron-to-chromium@1.5.413',
+    'caniuse-lite@1.0.30001810',
+    'electron-to-chromium@1.5.414'
+];
+const knownStaleReleaseAgeEntries = new Set([
+    '@effect/opentelemetry@4.0.0-beta.92',
+    '@effect/opentelemetry@4.0.0-beta.94',
+    '@effect/opentelemetry@4.0.0-beta.97',
+    '@effect/vitest@4.0.0-beta.97',
+    "@typescript/native-preview@7.0.0-dev.20260628.1",
+    "@typescript/typescript6@6.0.2",
+    '@cloudflare/workers-types@5.20260708.1',
+    'effect@4.0.0-beta.92',
+    'effect@4.0.0-beta.94',
+    'effect@4.0.0-beta.97',
+    'i18next@26.3.1',
+    'miniflare@4.20260708.0',
+    'workerd@1.20260708.1',
+    'wrangler@4.109.0',
+    'ultracite@7.10.2',
+    'ultracite@7.10.5',
+    'oxfmt@0.64.0',
+    'oxlint@1.79.0',
+    ...staleOxcBindingTargets.map((target)=>`@oxfmt/binding-${target}@0.64.0`),
+    ...staleOxcBindingTargets.map((target)=>`@oxlint/binding-${target}@1.79.0`),
+    ...reviewedAugust10StaleReleaseAgeEntries,
+    ...reviewedAugust24And25StaleReleaseAgeEntries,
+    ...ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals.filter((approval)=>approval.packageName.startsWith('@module-federation/')).map((approval)=>`${approval.packageName}@2.6.0`)
+]);
+const canonicalReleaseAgeEntries = new Set(ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals.map((approval)=>`${approval.packageName}@${approval.version}`));
+const retiredTypescriptPeerOverrides = new Set([
+    "@module-federation/dts-plugin>typescript",
+    "@module-federation/enhanced>typescript",
+    "@module-federation/modern-js-v3>typescript",
+    "@module-federation/rspack>typescript",
+    "i18next>typescript"
+]);
+function ensureMap(document, key) {
+    const current = document[key];
+    if (void 0 === current) {
+        const created = {};
+        document[key] = created;
+        return created;
+    }
+    if (!isYamlRecord(current)) throw new Error(`pnpm-workspace.yaml ${key} must be a mapping.`);
+    return current;
+}
+function setOwnedScalar(document, key, value) {
+    const current = document[key];
+    if (void 0 !== current && 'object' == typeof current) throw new Error(`pnpm-workspace.yaml ${key} must be a scalar.`);
+    document[key] = value;
+}
+function reconcileOwnedMap(target, expected) {
+    for (const [key, value] of Object.entries(expected))target[key] = value;
+}
+function assertUniqueStringList(value, key) {
+    if (!Array.isArray(value) || value.some((item)=>'string' != typeof item)) throw new Error(`pnpm-workspace.yaml ${key} must be a string list.`);
+    const entries = value;
+    if (new Set(entries).size !== entries.length) throw new Error(`pnpm-workspace.yaml ${key} contains duplicate entries.`);
+    return entries;
+}
+function packageVersionParts(selector) {
+    const separator = selector.lastIndexOf('@');
+    if (separator <= 0) return;
+    return {
+        packageName: selector.slice(0, separator),
+        version: selector.slice(separator + 1)
+    };
+}
+function assertOwnedReleaseAgeList(current, expected) {
+    const entries = assertUniqueStringList(current, 'minimumReleaseAgeExclude');
+    const expectedSet = new Set(expected);
+    for (const entry of entries){
+        if (!(expectedSet.has(entry) || canonicalReleaseAgeEntries.has(entry) || knownStaleReleaseAgeEntries.has(entry))) {
+            if (!('@bleedingdev/modern-js-*' === entry || '@module-federation/*' === entry || '@rspack/binding-*' === entry || legacyBareReleaseAgePackages.has(entry))) {
+                if (!/^@bleedingdev\/modern-js-[^@]+@[^@]+$/u.test(entry)) throw new Error(`Unapproved release-age exclusion "${entry}" has no canonical review evidence.`);
+            }
+        }
+    }
+}
+function assertOwnedTrustPolicyList(current, expected) {
+    const entries = assertUniqueStringList(current, 'trustPolicyExclude');
+    const expectedSet = new Set(expected);
+    for (const entry of entries)if (!expectedSet.has(entry) && 'effect@4.0.0-beta.92' !== entry && '@effect/opentelemetry@4.0.0-beta.92' !== entry && 'effect@4.0.0-beta.94' !== entry && '@effect/opentelemetry@4.0.0-beta.94' !== entry && 'effect@4.0.0-beta.97' !== entry && '@effect/opentelemetry@4.0.0-beta.97' !== entry && 'effect@4.0.0-beta.102' !== entry && '@effect/opentelemetry@4.0.0-beta.102' !== entry && 'effect@4.0.0-beta.107' !== entry && '@effect/opentelemetry@4.0.0-beta.107' !== entry) throw new Error(`Unmatched trust-policy exclusion "${entry}" cannot be migrated safely.`);
+}
+function patchKey(patch) {
+    return `${patch.packageName}@${patch.version}`;
+}
+function reconcilePatchedDependencies(document, includeDrizzleOrmPatch) {
+    const policy = ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies;
+    const expectedPatches = [
+        ...policy.required,
+        ...includeDrizzleOrmPatch ? policy.conditional : []
+    ];
+    const expected = new Map(expectedPatches.map((patch)=>[
+            patchKey(patch),
+            patch.path
+        ]));
+    const stale = new Map(policy.stale.map((patch)=>[
+            patchKey(patch),
+            patch
+        ]));
+    const ownedPackageNames = new Set([
+        ...policy.required,
+        ...policy.conditional,
+        ...policy.stale
+    ].map((patch)=>patch.packageName));
+    const patchedDependencies = ensureMap(document, 'patchedDependencies');
+    for (const [selector, patchPath] of Object.entries(patchedDependencies)){
+        const stalePatch = stale.get(selector);
+        if (stalePatch) {
+            if (patchPath !== stalePatch.path) throw new Error(`Stale framework patch ${selector} uses an unrecognized path and cannot be removed safely.`);
+            delete patchedDependencies[selector];
+            continue;
+        }
+        const parts = packageVersionParts(selector);
+        if (parts && ownedPackageNames.has(parts.packageName) && !expected.has(selector)) {
+            const conditionalPatch = policy.conditional.find((patch)=>patchKey(patch) === selector);
+            if (conditionalPatch && !includeDrizzleOrmPatch && patchPath === conditionalPatch.path) {
+                delete patchedDependencies[selector];
+                continue;
+            }
+            throw new Error(`Framework-owned patch selector ${selector} has unknown provenance.`);
+        }
+    }
+    for (const [selector, patchPath] of expected)patchedDependencies[selector] = patchPath;
+}
+function reconcilePnpmPolicy(document, includeDrizzleOrmPatch, packageSource, releaseCohort, now) {
+    const policy = ULTRAMODERN_WORKSPACE_POLICY.pnpm;
+    const minimumReleaseAgeExclude = renderMinimumReleaseAgeExclude({
+        now,
+        packageSource,
+        releaseCohort
+    });
+    const workspacePackageLinkingPolicy = resolveWorkspacePackageLinkingPolicy(packageSource);
+    if (void 0 !== document.minimumReleaseAgeExclude) assertOwnedReleaseAgeList(document.minimumReleaseAgeExclude, minimumReleaseAgeExclude);
+    if (void 0 !== document.trustPolicyExclude) assertOwnedTrustPolicyList(document.trustPolicyExclude, policy.trustPolicyExclude);
+    for (const [key, value] of [
+        [
+            'minimumReleaseAge',
+            policy.minimumReleaseAge
+        ],
+        [
+            'minimumReleaseAgeStrict',
+            policy.minimumReleaseAgeStrict
+        ],
+        [
+            'minimumReleaseAgeIgnoreMissingTime',
+            policy.minimumReleaseAgeIgnoreMissingTime
+        ],
+        [
+            'trustPolicy',
+            policy.trustPolicy
+        ],
+        [
+            'trustPolicyIgnoreAfter',
+            policy.trustPolicyIgnoreAfter
+        ],
+        [
+            'blockExoticSubdeps',
+            policy.blockExoticSubdeps
+        ],
+        [
+            'engineStrict',
+            policy.engineStrict
+        ],
+        [
+            'pmOnFail',
+            policy.pmOnFail
+        ],
+        [
+            'verifyDepsBeforeRun',
+            policy.verifyDepsBeforeRun
+        ],
+        [
+            'strictDepBuilds',
+            policy.strictDepBuilds
+        ]
+    ])setOwnedScalar(document, key, value);
+    for (const key of [
+        'injectWorkspacePackages',
+        'linkWorkspacePackages'
+    ]){
+        const value = workspacePackageLinkingPolicy[key];
+        if (void 0 === value) delete document[key];
+        else setOwnedScalar(document, key, value);
+    }
+    document.minimumReleaseAgeExclude = minimumReleaseAgeExclude;
+    document.trustPolicyExclude = [
+        ...policy.trustPolicyExclude
+    ];
+    const peerDependencyRules = ensureMap(document, 'peerDependencyRules');
+    const allowedVersions = ensureMap(peerDependencyRules, 'allowedVersions');
+    for (const selector of retiredTypescriptPeerOverrides)delete allowedVersions[selector];
+    reconcileOwnedMap(allowedVersions, policy.peerDependencyRules.allowedVersions);
+    const overrides = ensureMap(document, 'overrides');
+    const ownedOverrideNames = new Set(Object.keys(policy.overrides));
+    for (const selector of Object.keys(overrides)){
+        const parts = packageVersionParts(selector);
+        if (parts && ownedOverrideNames.has(parts.packageName)) delete overrides[selector];
+    }
+    reconcileOwnedMap(overrides, policy.overrides);
+    const packageExtensions = document.packageExtensions;
+    if (void 0 !== packageExtensions) {
+        if (!isYamlRecord(packageExtensions)) throw new Error('pnpm-workspace.yaml packageExtensions must be a mapping.');
+        for (const selector of Object.keys(packageExtensions))if (packageVersionParts(selector)?.packageName === '@module-federation/dts-plugin') delete packageExtensions[selector];
+        if (0 === Object.keys(packageExtensions).length) delete document.packageExtensions;
+    }
+    reconcileOwnedMap(ensureMap(document, 'allowBuilds'), policy.allowBuilds);
+    reconcilePatchedDependencies(document, includeDrizzleOrmPatch);
+}
+function stalePatchFilesToRemove(workspaceRoot, document) {
+    const staleFiles = [];
+    const patchedDependencies = ensureMap(document, 'patchedDependencies');
+    const lexicalWorkspaceRoot = node_path.resolve(workspaceRoot);
+    const physicalWorkspaceRoot = node_fs.realpathSync.native(lexicalWorkspaceRoot);
+    const isOutsideRoot = (root, candidate)=>{
+        const relativePath = node_path.relative(root, candidate);
+        return '' === relativePath || '..' === relativePath || relativePath.startsWith(`..${node_path.sep}`) || node_path.isAbsolute(relativePath);
+    };
+    const resolvePhysicalPath = (absolutePath)=>{
+        const missingSegments = [];
+        let existingAncestor = absolutePath;
+        while(!node_fs.existsSync(existingAncestor)){
+            const parent = node_path.dirname(existingAncestor);
+            if (parent === existingAncestor) break;
+            missingSegments.unshift(node_path.basename(existingAncestor));
+            existingAncestor = parent;
+        }
+        return node_path.resolve(node_fs.realpathSync.native(existingAncestor), ...missingSegments);
+    };
+    const resolvePatchPath = (selector, patchPath)=>{
+        if ('string' != typeof patchPath || 0 === patchPath.length) throw new Error(`Patched dependency ${selector} must reference a non-empty path string.`);
+        const absolutePath = node_path.resolve(lexicalWorkspaceRoot, patchPath.replaceAll('\\', '/'));
+        if (isOutsideRoot(lexicalWorkspaceRoot, absolutePath)) throw new Error(`Patched dependency ${selector} references a path outside the workspace: ${patchPath}`);
+        const physicalPath = resolvePhysicalPath(absolutePath);
+        if (isOutsideRoot(physicalWorkspaceRoot, physicalPath)) throw new Error(`Patched dependency ${selector} resolves outside the workspace: ${patchPath}`);
+        return {
+            absolutePath,
+            identity: 'win32' === process.platform ? physicalPath.toLowerCase() : physicalPath
+        };
+    };
+    const resolvedPatchedDependencies = Object.entries(patchedDependencies).map(([selector, patchPath])=>({
+            ...resolvePatchPath(selector, patchPath),
+            selector
+        }));
+    const resolvedBySelector = new Map(resolvedPatchedDependencies.map((resolved)=>[
+            resolved.selector,
+            resolved
+        ]));
+    const activeFrameworkPatchIdentities = new Set([
+        ...ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies.required,
+        ...ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies.conditional
+    ].map((patch)=>({
+            actual: resolvedBySelector.get(patchKey(patch)),
+            expected: resolvePatchPath(patchKey(patch), patch.path)
+        })).filter(({ actual, expected })=>actual?.identity === expected.identity).map(({ expected })=>expected.identity));
+    const stalePatchesByIdentity = new Map();
+    for (const patch of ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies.stale){
+        const stalePath = resolvePatchPath(patchKey(patch), patch.path);
+        const existing = stalePatchesByIdentity.get(stalePath.identity);
+        const acceptedDigests = [
+            patch.sha256,
+            ...patch.acceptedLegacySha256 ?? []
+        ];
+        if (existing) {
+            for (const digest of acceptedDigests)existing.acceptedDigests.add(digest);
+            continue;
+        }
+        stalePatchesByIdentity.set(stalePath.identity, {
+            acceptedDigests: new Set(acceptedDigests),
+            absolutePath: stalePath.absolutePath,
+            policyPath: patch.path
+        });
+    }
+    for (const [identity, stalePatch] of stalePatchesByIdentity){
+        if (activeFrameworkPatchIdentities.has(identity)) continue;
+        const survivingSelectors = resolvedPatchedDependencies.filter((resolved)=>resolved.identity === identity).map((resolved)=>resolved.selector);
+        if (survivingSelectors.length > 0) throw new Error(`Stale framework patch ${stalePatch.policyPath} is still referenced by consumer-owned selector(s): ${survivingSelectors.join(', ')}; refusing to mutate the workspace.`);
+        const patchPath = stalePatch.absolutePath;
+        if (!node_fs.existsSync(patchPath)) continue;
+        const digest = node_crypto.createHash('sha256').update(node_fs.readFileSync(patchPath)).digest('hex');
+        if (!stalePatch.acceptedDigests.has(digest)) throw new Error(`Stale framework patch ${stalePatch.policyPath} was modified (expected a reviewed sha256, found ${digest}); refusing to delete it.`);
+        staleFiles.push(patchPath);
+    }
+    return staleFiles;
+}
+function updateGeneratedPnpmWorkspacePolicy(io, packageSource, options = {}) {
+    const workspaceFile = node_path.join(io.workspaceRoot, 'pnpm-workspace.yaml');
+    if (!node_fs.existsSync(workspaceFile)) return false;
+    const source = node_fs.readFileSync(workspaceFile, 'utf-8');
+    const { document, lineEnding } = parsePnpmWorkspaceYaml(source, workspaceFile);
+    const before = JSON.stringify(document);
+    const drizzleOrmPatch = ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies.conditional.find((patch)=>'drizzle-orm' === patch.packageName);
+    reconcilePnpmPolicy(document, void 0 !== drizzleOrmPatch && workspaceUsesDependency(io.workspaceRoot, drizzleOrmPatch.packageName, drizzleOrmPatch.version), packageSource, options.releaseCohort, options.now);
+    const stalePatchFiles = stalePatchFilesToRemove(io.workspaceRoot, document);
+    let changed = false;
+    if (JSON.stringify(document) !== before) changed = io.write(workspaceFile, stringifyPnpmWorkspaceYaml(document, lineEnding)) || changed;
+    for (const stalePatchFile of stalePatchFiles)changed = io.remove(stalePatchFile) || changed;
+    return changed;
+}
+function packageRegistryUrl(registryUrl, packageName) {
+    let base;
+    try {
+        base = new URL(registryUrl);
+    } catch  {
+        throw new Error(`Registry URL is invalid: ${registryUrl}`);
+    }
+    if ('https:' !== base.protocol) throw new Error(`Registry URL must use HTTPS: ${registryUrl}`);
+    const encodedName = packageName.startsWith('@') ? packageName.replace('/', '%2f') : encodeURIComponent(packageName);
+    return new URL(encodedName, base);
+}
+function packageVersionKey(packageName, version) {
+    return `${packageName}@${version}`;
+}
+function isRegistryRecord(value) {
+    return Boolean(value) && 'object' == typeof value && !Array.isArray(value);
+}
+const registryFetchConcurrency = 16;
+const registryFetchAttempts = 3;
+const registryFetchRetryDelayMs = 250;
+function isTransientRegistryStatus(status) {
+    return 429 === status || status >= 500;
+}
+async function fetchRegistryResponse(fetchImpl, url) {
+    let lastError;
+    for(let attempt = 0; attempt < registryFetchAttempts; attempt += 1){
+        try {
+            const response = await fetchImpl(url, {
+                headers: {
+                    accept: 'application/json'
+                },
+                redirect: 'error'
+            });
+            if (response.ok || !isTransientRegistryStatus(response.status) || attempt === registryFetchAttempts - 1) return response;
+            lastError = new Error(`HTTP ${response.status}`);
+        } catch (error) {
+            lastError = error;
+            if (attempt === registryFetchAttempts - 1) throw error;
+        }
+        await new Promise((resolve)=>setTimeout(resolve, registryFetchRetryDelayMs * 2 ** attempt));
+    }
+    throw lastError;
+}
+async function resolveRegistryCandidates(candidates, options) {
+    const nowTimestamp = options.now.getTime();
+    if (!Number.isFinite(nowTimestamp)) throw new Error('Release-age validation requires a valid current time.');
+    async function resolveCandidate(candidate) {
+        const key = packageVersionKey(candidate.packageName, candidate.version);
+        let response;
+        try {
+            response = await fetchRegistryResponse(options.fetchImpl, packageRegistryUrl(options.registryUrl, candidate.packageName));
+        } catch (error) {
+            throw new Error(`Registry metadata is uncertain for ${key} (${candidate.path.join(' -> ')}): ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!response.ok) throw new Error(`Registry metadata is uncertain for ${key} (${candidate.path.join(' -> ')}): HTTP ${response.status}`);
+        let packument;
+        try {
+            packument = await response.json();
+        } catch (error) {
+            throw new Error(`Registry metadata is invalid JSON for ${key}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!isRegistryRecord(packument)) throw new Error(`Registry metadata is invalid for ${key}.`);
+        const versions = packument.versions;
+        const time = packument.time;
+        const versionMetadata = isRegistryRecord(versions) ? versions[candidate.version] : void 0;
+        const dist = isRegistryRecord(versionMetadata) ? versionMetadata.dist : void 0;
+        const integrity = isRegistryRecord(dist) ? dist.integrity : void 0;
+        if (integrity !== candidate.registry.dist.integrity) throw new Error(`Registry metadata integrity mismatch for ${key}: lock has ${candidate.registry.dist.integrity}, registry has ${String(integrity)}`);
+        const publishedAt = isRegistryRecord(time) ? time[candidate.version] : void 0;
+        const publishedAtTimestamp = 'string' == typeof publishedAt ? Date.parse(publishedAt) : 0 / 0;
+        if ('string' != typeof publishedAt || !Number.isFinite(publishedAtTimestamp) || publishedAtTimestamp > nowTimestamp) throw new Error(`Registry publication time is missing, invalid, or in the future for ${key}.`);
+        return {
+            ...candidate,
+            registry: {
+                ...candidate.registry,
+                publishedAt: new Date(publishedAtTimestamp).toISOString()
+            }
+        };
+    }
+    const results = new Array(candidates.length);
+    let nextIndex = 0;
+    async function worker() {
+        while(nextIndex < candidates.length){
+            const index = nextIndex;
+            nextIndex += 1;
+            results[index] = await resolveCandidate(candidates[index]);
+        }
+    }
+    await Promise.all(Array.from({
+        length: Math.min(registryFetchConcurrency, candidates.length)
+    }, ()=>worker()));
+    return results;
+}
+async function validateGeneratedPnpmLockReleaseAgePolicy(workspaceRoot, packageSource, options = {}) {
+    const lockfilePath = node_path.join(workspaceRoot, 'pnpm-lock.yaml');
+    if (!node_fs.existsSync(lockfilePath)) throw new Error('Cannot validate release-age approvals without pnpm-lock.yaml.');
+    const now = options.now ?? new Date();
+    const releaseCohort = options.releaseCohort ?? ('install' === packageSource.strategy ? readWorkspaceReleaseCohort(workspaceRoot) : void 0);
+    const activeSelectors = renderMinimumReleaseAgeExclude({
+        now,
+        packageSource,
+        releaseCohort
+    });
+    const workspacePolicyPath = node_path.join(workspaceRoot, 'pnpm-workspace.yaml');
+    const { document: workspacePolicy } = parsePnpmWorkspaceYaml(node_fs.readFileSync(workspacePolicyPath, 'utf-8'), workspacePolicyPath);
+    const renderedSelectors = assertUniqueStringList(workspacePolicy.minimumReleaseAgeExclude, 'minimumReleaseAgeExclude');
+    if (JSON.stringify(renderedSelectors) !== JSON.stringify(activeSelectors)) throw new Error('pnpm-workspace.yaml release-age exclusions do not match canonical policy.');
+    const firstPartySelectors = new Set(releaseCohort ? releaseCohortSelectors(releaseCohort) : []);
+    const firstPartyTargetNames = new Set(releaseCohort?.packages.map((item)=>item.targetName) ?? []);
+    const { document: lockfile } = parsePnpmWorkspaceYaml(node_fs.readFileSync(lockfilePath, 'utf-8'), lockfilePath);
+    const closure = discoverReachablePnpmLockReleaseAgeClosure(lockfile);
+    if (closure.unresolved.length > 0) {
+        const unresolved = closure.unresolved.slice(0, 20).map((candidate)=>{
+            const packageName = candidate.package ?? 'unknown package';
+            return `- ${packageName}: ${candidate.reason}; path ${candidate.path.join(' -> ')}`;
+        }).join('\n');
+        throw new Error(`Dependency closure has unresolved candidates:\n${unresolved}`);
+    }
+    const closureKeys = new Set(closure.candidates.map((candidate)=>packageVersionKey(candidate.packageName, candidate.version)));
+    const approvals = ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals.filter((approval)=>closureKeys.has(`${approval.packageName}@${approval.version}`));
+    const isFirstPartyCandidate = (packageName, version)=>{
+        if (!firstPartyTargetNames.has(packageName)) return false;
+        const key = `${packageName}@${version}`;
+        if (!firstPartySelectors.has(key)) throw new Error(`First-party lock candidate ${key} is absent from the authenticated release cohort.`);
+        return true;
+    };
+    const thirdPartyCandidates = closure.candidates.filter((candidate)=>!isFirstPartyCandidate(candidate.packageName, candidate.version));
+    const activeCandidates = await resolveRegistryCandidates(thirdPartyCandidates, {
+        fetchImpl: options.fetchImpl ?? fetch,
+        now,
+        registryUrl: options.registryUrl ?? packageSource.registry ?? 'https://registry.npmjs.org/'
+    });
+    const resolved = resolveReleaseAgeApprovals(activeCandidates, {
+        approvals,
+        now
+    });
+    if (resolved.reviewCandidates.length > 0) {
+        const pathsByKey = new Map(thirdPartyCandidates.map((candidate)=>[
+                packageVersionKey(candidate.packageName, candidate.version),
+                candidate.path
+            ]));
+        throw new Error([
+            `Dependency closure contains ${resolved.reviewCandidates.length} immature package(s) without an exact, unexpired approval:`,
+            ...resolved.reviewCandidates.slice(0, 20).map((candidate)=>{
+                const key = packageVersionKey(candidate.packageName, candidate.version);
+                return `- ${key}; path ${pathsByKey.get(key)?.join(' -> ') ?? 'unknown'}`;
+            })
+        ].join('\n'));
+    }
+    return {
+        ...resolved,
+        minimumReleaseAgeExclude: activeSelectors
+    };
+}
+export { updateGeneratedPnpmWorkspacePolicy, validateGeneratedPnpmLockReleaseAgePolicy };