@bleedingdev/modern-js-ultramodern-create 3.9.0-ultramodern.2 → 3.9.0-ultramodern.21

package/dist/esm-node/ultramodern-tooling/commands/migrate-strict-effect/package-source.js

@@ -1,50 +0,0 @@
-import "node:module";
-import { BLEEDINGDEV_PACKAGE_NAME_PREFIX, BLEEDINGDEV_PACKAGE_SCOPE, WORKSPACE_PACKAGE_VERSION } from "../../../ultramodern-package-source.js";
-import { isCreatePackageSourceCheckout } from "../../../ultramodern-release-cohort.js";
-import { hasFlag, readOption } from "../options.js";
-function createMigrationPackageSource(args, current) {
-    const workspaceRequested = hasFlag(args, '--workspace');
-    const explicitInstallRequested = !workspaceRequested && (current.packageSource?.strategy === 'install' || [
-        '--version',
-        '--ultramodern-package-version',
-        '--registry',
-        '--ultramodern-package-registry',
-        '--ultramodern-package-scope',
-        '--ultramodern-package-name-prefix'
-    ].some((option)=>void 0 !== readOption(args, option)));
-    if (isCreatePackageSourceCheckout() && explicitInstallRequested) throw new Error('A local @modern-js/ultramodern-create source checkout cannot migrate an explicit install package source. Use --workspace locally or run the packed published package with its authenticated release cohort projection.');
-    const strategy = workspaceRequested || isCreatePackageSourceCheckout() ? 'workspace' : 'install';
-    const registry = readOption(args, '--registry') ?? readOption(args, '--ultramodern-package-registry') ?? current.packageSource?.registry;
-    const explicitAliasScope = readOption(args, '--ultramodern-package-scope');
-    const aliasScope = explicitAliasScope ?? ('install' === strategy && void 0 === registry ? current.packageSource?.aliasScope ?? BLEEDINGDEV_PACKAGE_SCOPE : current.packageSource?.aliasScope);
-    const aliasPackageNamePrefix = readOption(args, '--ultramodern-package-name-prefix') ?? current.packageSource?.aliasPackageNamePrefix ?? (aliasScope ? BLEEDINGDEV_PACKAGE_NAME_PREFIX : void 0);
-    if ('workspace' === strategy) return {
-        strategy,
-        modernPackageVersion: WORKSPACE_PACKAGE_VERSION,
-        ...registry ? {
-            registry
-        } : {},
-        ...aliasScope ? {
-            aliasScope
-        } : {},
-        ...aliasPackageNamePrefix ? {
-            aliasPackageNamePrefix
-        } : {}
-    };
-    const version = readOption(args, '--version') ?? readOption(args, '--ultramodern-package-version') ?? current.packageSource?.modernPackageVersion;
-    if (!version || version === WORKSPACE_PACKAGE_VERSION) throw new Error('migrate-strict-effect needs --version <published-ultramodern-version> for install package source.');
-    return {
-        strategy,
-        modernPackageVersion: version,
-        ...registry ? {
-            registry
-        } : {},
-        ...aliasScope ? {
-            aliasScope
-        } : {},
-        ...aliasPackageNamePrefix ? {
-            aliasPackageNamePrefix
-        } : {}
-    };
-}
-export { createMigrationPackageSource };

package/dist/esm-node/ultramodern-tooling/commands/migrate-strict-effect/pnpm-policy.js

@@ -1,560 +0,0 @@
-import "node:module";
-import node_crypto from "node:crypto";
-import node_fs from "node:fs";
-import node_path from "node:path";
-import { readWorkspaceReleaseCohort, releaseCohortSelectors } from "../../../ultramodern-release-cohort.js";
-import { resolveWorkspacePackageLinkingPolicy } from "../../../ultramodern-workspace/package-source.js";
-import { ULTRAMODERN_PACKAGE_PINS, ULTRAMODERN_WORKSPACE_POLICY, renderMinimumReleaseAgeExclude, resolveReleaseAgeApprovals } from "../../../ultramodern-workspace/policy.js";
-import { workspaceUsesDependency } from "./dependency-usage.js";
-import { discoverReachablePnpmLockReleaseAgeClosure, isYamlRecord, parsePnpmWorkspaceYaml, stringifyPnpmWorkspaceYaml } from "./pnpm-yaml.js";
-const legacyBareReleaseAgePackages = new Set([
-    ...Object.keys(ULTRAMODERN_PACKAGE_PINS.appDependencies),
-    ...Object.keys(ULTRAMODERN_PACKAGE_PINS.appDevDependencies),
-    ...Object.keys(ULTRAMODERN_PACKAGE_PINS.transitiveDependencies),
-    '@module-federation/bridge-react-webpack-plugin',
-    '@module-federation/cli',
-    '@module-federation/dts-plugin',
-    '@module-federation/enhanced',
-    '@module-federation/error-codes',
-    '@module-federation/inject-external-runtime-core-plugin',
-    '@module-federation/managers',
-    '@module-federation/manifest',
-    '@module-federation/rsbuild-plugin',
-    '@module-federation/rspack',
-    '@module-federation/runtime-core',
-    '@module-federation/runtime-tools',
-    '@module-federation/sdk',
-    '@module-federation/third-party-dts-extractor',
-    '@module-federation/webpack-bundler-runtime',
-    '@rsbuild/core',
-    '@rsbuild/plugin-react',
-    '@rsbuild/plugin-type-check',
-    '@rspack/binding',
-    '@rspack/core',
-    '@rspack/plugin-react-refresh',
-    'ts-checker-rspack-plugin'
-]);
-const staleOxcBindingTargets = [
-    'android-arm-eabi',
-    'android-arm64',
-    'darwin-arm64',
-    'darwin-x64',
-    'freebsd-x64',
-    'linux-arm-gnueabihf',
-    'linux-arm-musleabihf',
-    'linux-arm64-gnu',
-    'linux-arm64-musl',
-    'linux-ppc64-gnu',
-    'linux-riscv64-gnu',
-    'linux-riscv64-musl',
-    'linux-s390x-gnu',
-    'linux-x64-gnu',
-    'linux-x64-musl',
-    'openharmony-arm64',
-    'win32-arm64-msvc',
-    'win32-ia32-msvc',
-    'win32-x64-msvc'
-];
-const reviewedAugust10EffectTsgoPackages = [
-    '@effect/tsgo',
-    '@effect/tsgo-win32-x64',
-    '@effect/tsgo-win32-arm64',
-    '@effect/tsgo-linux-x64',
-    '@effect/tsgo-linux-arm64',
-    '@effect/tsgo-linux-arm',
-    '@effect/tsgo-darwin-x64',
-    '@effect/tsgo-darwin-arm64'
-];
-const reviewedAugust10StaleReleaseAgeEntries = [
-    'effect@4.0.0-beta.107',
-    '@effect/opentelemetry@4.0.0-beta.107',
-    '@effect/vitest@4.0.0-beta.107',
-    ...reviewedAugust10EffectTsgoPackages.map((packageName)=>`${packageName}@0.36.2`),
-    'oxlint@1.78.0',
-    ...staleOxcBindingTargets.map((target)=>`@oxlint/binding-${target}@1.78.0`),
-    'oxfmt@0.63.0',
-    ...staleOxcBindingTargets.map((target)=>`@oxfmt/binding-${target}@0.63.0`)
-];
-const reviewedAugust24And25StaleReleaseAgeEntries = [
-    '@rsbuild/core@2.2.0-rc.0',
-    'baseline-browser-mapping@2.11.19',
-    'electron-to-chromium@1.5.413',
-    'caniuse-lite@1.0.30001810',
-    'electron-to-chromium@1.5.414'
-];
-const reviewedAugust26StaleReleaseAgeEntries = [
-    '@rsbuild/core@2.2.0',
-    '@rspack/binding-darwin-arm64@2.2.0',
-    '@rspack/binding-darwin-x64@2.2.0',
-    '@rspack/binding-linux-arm64-gnu@2.2.0',
-    '@rspack/binding-linux-arm64-musl@2.2.0',
-    '@rspack/binding-linux-ppc64-gnu@2.2.0',
-    '@rspack/binding-linux-riscv64-gnu@2.2.0',
-    '@rspack/binding-linux-riscv64-musl@2.2.0',
-    '@rspack/binding-linux-s390x-gnu@2.2.0',
-    '@rspack/binding-linux-x64-gnu@2.2.0',
-    '@rspack/binding-linux-x64-musl@2.2.0',
-    '@rspack/binding-wasm32-wasi@2.2.0',
-    '@rspack/binding-win32-arm64-msvc@2.2.0',
-    '@rspack/binding-win32-ia32-msvc@2.2.0',
-    '@rspack/binding-win32-x64-msvc@2.2.0',
-    '@rspack/binding@2.2.0',
-    '@rspack/core@2.2.0'
-];
-const knownStaleReleaseAgeEntries = new Set([
-    '@effect/opentelemetry@4.0.0-beta.92',
-    '@effect/opentelemetry@4.0.0-beta.94',
-    '@effect/opentelemetry@4.0.0-beta.97',
-    '@effect/vitest@4.0.0-beta.97',
-    "@typescript/native-preview@7.0.0-dev.20260628.1",
-    "@typescript/typescript6@6.0.2",
-    '@cloudflare/workers-types@5.20260708.1',
-    'effect@4.0.0-beta.92',
-    'effect@4.0.0-beta.94',
-    'effect@4.0.0-beta.97',
-    'i18next@26.3.1',
-    'miniflare@4.20260708.0',
-    'workerd@1.20260708.1',
-    'wrangler@4.109.0',
-    'ultracite@7.10.2',
-    'ultracite@7.10.5',
-    'oxfmt@0.64.0',
-    'oxlint@1.79.0',
-    ...staleOxcBindingTargets.map((target)=>`@oxfmt/binding-${target}@0.64.0`),
-    ...staleOxcBindingTargets.map((target)=>`@oxlint/binding-${target}@1.79.0`),
-    ...reviewedAugust10StaleReleaseAgeEntries,
-    ...reviewedAugust24And25StaleReleaseAgeEntries,
-    ...reviewedAugust26StaleReleaseAgeEntries,
-    ...ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals.filter((approval)=>approval.packageName.startsWith('@module-federation/')).map((approval)=>`${approval.packageName}@2.6.0`)
-]);
-const canonicalReleaseAgeEntries = new Set(ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals.map((approval)=>`${approval.packageName}@${approval.version}`));
-const retiredTypescriptPeerOverrides = new Set([
-    "@module-federation/dts-plugin>typescript",
-    "@module-federation/enhanced>typescript",
-    "@module-federation/modern-js-v3>typescript",
-    "@module-federation/rspack>typescript",
-    "i18next>typescript"
-]);
-function ensureMap(document, key) {
-    const current = document[key];
-    if (void 0 === current) {
-        const created = {};
-        document[key] = created;
-        return created;
-    }
-    if (!isYamlRecord(current)) throw new Error(`pnpm-workspace.yaml ${key} must be a mapping.`);
-    return current;
-}
-function setOwnedScalar(document, key, value) {
-    const current = document[key];
-    if (void 0 !== current && 'object' == typeof current) throw new Error(`pnpm-workspace.yaml ${key} must be a scalar.`);
-    document[key] = value;
-}
-function reconcileOwnedMap(target, expected) {
-    for (const [key, value] of Object.entries(expected))target[key] = value;
-}
-function assertUniqueStringList(value, key) {
-    if (!Array.isArray(value) || value.some((item)=>'string' != typeof item)) throw new Error(`pnpm-workspace.yaml ${key} must be a string list.`);
-    const entries = value;
-    if (new Set(entries).size !== entries.length) throw new Error(`pnpm-workspace.yaml ${key} contains duplicate entries.`);
-    return entries;
-}
-function packageVersionParts(selector) {
-    const separator = selector.lastIndexOf('@');
-    if (separator <= 0) return;
-    return {
-        packageName: selector.slice(0, separator),
-        version: selector.slice(separator + 1)
-    };
-}
-function assertOwnedReleaseAgeList(current, expected) {
-    const entries = assertUniqueStringList(current, 'minimumReleaseAgeExclude');
-    const expectedSet = new Set(expected);
-    for (const entry of entries){
-        if (!(expectedSet.has(entry) || canonicalReleaseAgeEntries.has(entry) || knownStaleReleaseAgeEntries.has(entry))) {
-            if (!('@bleedingdev/modern-js-*' === entry || '@module-federation/*' === entry || '@rspack/binding-*' === entry || legacyBareReleaseAgePackages.has(entry))) {
-                if (!/^@bleedingdev\/modern-js-[^@]+@[^@]+$/u.test(entry)) throw new Error(`Unapproved release-age exclusion "${entry}" has no canonical review evidence.`);
-            }
-        }
-    }
-}
-function assertOwnedTrustPolicyList(current, expected) {
-    const entries = assertUniqueStringList(current, 'trustPolicyExclude');
-    const expectedSet = new Set(expected);
-    for (const entry of entries)if (!expectedSet.has(entry) && 'effect@4.0.0-beta.92' !== entry && '@effect/opentelemetry@4.0.0-beta.92' !== entry && 'effect@4.0.0-beta.94' !== entry && '@effect/opentelemetry@4.0.0-beta.94' !== entry && 'effect@4.0.0-beta.97' !== entry && '@effect/opentelemetry@4.0.0-beta.97' !== entry && 'effect@4.0.0-beta.102' !== entry && '@effect/opentelemetry@4.0.0-beta.102' !== entry && 'effect@4.0.0-beta.107' !== entry && '@effect/opentelemetry@4.0.0-beta.107' !== entry) throw new Error(`Unmatched trust-policy exclusion "${entry}" cannot be migrated safely.`);
-}
-function patchKey(patch) {
-    return `${patch.packageName}@${patch.version}`;
-}
-function reconcilePatchedDependencies(document, includeDrizzleOrmPatch) {
-    const policy = ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies;
-    const expectedPatches = [
-        ...policy.required,
-        ...includeDrizzleOrmPatch ? policy.conditional : []
-    ];
-    const expected = new Map(expectedPatches.map((patch)=>[
-            patchKey(patch),
-            patch.path
-        ]));
-    const stale = new Map(policy.stale.map((patch)=>[
-            patchKey(patch),
-            patch
-        ]));
-    const ownedPackageNames = new Set([
-        ...policy.required,
-        ...policy.conditional,
-        ...policy.stale
-    ].map((patch)=>patch.packageName));
-    const patchedDependencies = ensureMap(document, 'patchedDependencies');
-    for (const [selector, patchPath] of Object.entries(patchedDependencies)){
-        const stalePatch = stale.get(selector);
-        if (stalePatch) {
-            if (patchPath !== stalePatch.path) throw new Error(`Stale framework patch ${selector} uses an unrecognized path and cannot be removed safely.`);
-            delete patchedDependencies[selector];
-            continue;
-        }
-        const parts = packageVersionParts(selector);
-        if (parts && ownedPackageNames.has(parts.packageName) && !expected.has(selector)) {
-            const conditionalPatch = policy.conditional.find((patch)=>patchKey(patch) === selector);
-            if (conditionalPatch && !includeDrizzleOrmPatch && patchPath === conditionalPatch.path) {
-                delete patchedDependencies[selector];
-                continue;
-            }
-            throw new Error(`Framework-owned patch selector ${selector} has unknown provenance.`);
-        }
-    }
-    for (const [selector, patchPath] of expected)patchedDependencies[selector] = patchPath;
-}
-function reconcilePnpmPolicy(document, includeDrizzleOrmPatch, packageSource, releaseCohort, now) {
-    const policy = ULTRAMODERN_WORKSPACE_POLICY.pnpm;
-    const minimumReleaseAgeExclude = renderMinimumReleaseAgeExclude({
-        now,
-        packageSource,
-        releaseCohort
-    });
-    const workspacePackageLinkingPolicy = resolveWorkspacePackageLinkingPolicy(packageSource);
-    if (void 0 !== document.minimumReleaseAgeExclude) assertOwnedReleaseAgeList(document.minimumReleaseAgeExclude, minimumReleaseAgeExclude);
-    if (void 0 !== document.trustPolicyExclude) assertOwnedTrustPolicyList(document.trustPolicyExclude, policy.trustPolicyExclude);
-    for (const [key, value] of [
-        [
-            'minimumReleaseAge',
-            policy.minimumReleaseAge
-        ],
-        [
-            'minimumReleaseAgeStrict',
-            policy.minimumReleaseAgeStrict
-        ],
-        [
-            'minimumReleaseAgeIgnoreMissingTime',
-            policy.minimumReleaseAgeIgnoreMissingTime
-        ],
-        [
-            'trustPolicy',
-            policy.trustPolicy
-        ],
-        [
-            'trustPolicyIgnoreAfter',
-            policy.trustPolicyIgnoreAfter
-        ],
-        [
-            'blockExoticSubdeps',
-            policy.blockExoticSubdeps
-        ],
-        [
-            'engineStrict',
-            policy.engineStrict
-        ],
-        [
-            'pmOnFail',
-            policy.pmOnFail
-        ],
-        [
-            'verifyDepsBeforeRun',
-            policy.verifyDepsBeforeRun
-        ],
-        [
-            'strictDepBuilds',
-            policy.strictDepBuilds
-        ]
-    ])setOwnedScalar(document, key, value);
-    for (const key of [
-        'injectWorkspacePackages',
-        'linkWorkspacePackages'
-    ]){
-        const value = workspacePackageLinkingPolicy[key];
-        if (void 0 === value) delete document[key];
-        else setOwnedScalar(document, key, value);
-    }
-    document.minimumReleaseAgeExclude = minimumReleaseAgeExclude;
-    document.trustPolicyExclude = [
-        ...policy.trustPolicyExclude
-    ];
-    const peerDependencyRules = ensureMap(document, 'peerDependencyRules');
-    const allowedVersions = ensureMap(peerDependencyRules, 'allowedVersions');
-    for (const selector of retiredTypescriptPeerOverrides)delete allowedVersions[selector];
-    reconcileOwnedMap(allowedVersions, policy.peerDependencyRules.allowedVersions);
-    const overrides = ensureMap(document, 'overrides');
-    const ownedOverrideNames = new Set(Object.keys(policy.overrides));
-    for (const selector of Object.keys(overrides)){
-        const parts = packageVersionParts(selector);
-        if (parts && ownedOverrideNames.has(parts.packageName)) delete overrides[selector];
-    }
-    reconcileOwnedMap(overrides, policy.overrides);
-    const packageExtensions = document.packageExtensions;
-    if (void 0 !== packageExtensions) {
-        if (!isYamlRecord(packageExtensions)) throw new Error('pnpm-workspace.yaml packageExtensions must be a mapping.');
-        for (const selector of Object.keys(packageExtensions))if (packageVersionParts(selector)?.packageName === '@module-federation/dts-plugin') delete packageExtensions[selector];
-        if (0 === Object.keys(packageExtensions).length) delete document.packageExtensions;
-    }
-    reconcileOwnedMap(ensureMap(document, 'allowBuilds'), policy.allowBuilds);
-    reconcilePatchedDependencies(document, includeDrizzleOrmPatch);
-}
-function stalePatchFilesToRemove(workspaceRoot, document) {
-    const staleFiles = [];
-    const patchedDependencies = ensureMap(document, 'patchedDependencies');
-    const lexicalWorkspaceRoot = node_path.resolve(workspaceRoot);
-    const physicalWorkspaceRoot = node_fs.realpathSync.native(lexicalWorkspaceRoot);
-    const isOutsideRoot = (root, candidate)=>{
-        const relativePath = node_path.relative(root, candidate);
-        return '' === relativePath || '..' === relativePath || relativePath.startsWith(`..${node_path.sep}`) || node_path.isAbsolute(relativePath);
-    };
-    const resolvePhysicalPath = (absolutePath)=>{
-        const missingSegments = [];
-        let existingAncestor = absolutePath;
-        while(!node_fs.existsSync(existingAncestor)){
-            const parent = node_path.dirname(existingAncestor);
-            if (parent === existingAncestor) break;
-            missingSegments.unshift(node_path.basename(existingAncestor));
-            existingAncestor = parent;
-        }
-        return node_path.resolve(node_fs.realpathSync.native(existingAncestor), ...missingSegments);
-    };
-    const resolvePatchPath = (selector, patchPath)=>{
-        if ('string' != typeof patchPath || 0 === patchPath.length) throw new Error(`Patched dependency ${selector} must reference a non-empty path string.`);
-        const absolutePath = node_path.resolve(lexicalWorkspaceRoot, patchPath.replaceAll('\\', '/'));
-        if (isOutsideRoot(lexicalWorkspaceRoot, absolutePath)) throw new Error(`Patched dependency ${selector} references a path outside the workspace: ${patchPath}`);
-        const physicalPath = resolvePhysicalPath(absolutePath);
-        if (isOutsideRoot(physicalWorkspaceRoot, physicalPath)) throw new Error(`Patched dependency ${selector} resolves outside the workspace: ${patchPath}`);
-        return {
-            absolutePath,
-            identity: 'win32' === process.platform ? physicalPath.toLowerCase() : physicalPath
-        };
-    };
-    const resolvedPatchedDependencies = Object.entries(patchedDependencies).map(([selector, patchPath])=>({
-            ...resolvePatchPath(selector, patchPath),
-            selector
-        }));
-    const resolvedBySelector = new Map(resolvedPatchedDependencies.map((resolved)=>[
-            resolved.selector,
-            resolved
-        ]));
-    const activeFrameworkPatchIdentities = new Set([
-        ...ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies.required,
-        ...ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies.conditional
-    ].map((patch)=>({
-            actual: resolvedBySelector.get(patchKey(patch)),
-            expected: resolvePatchPath(patchKey(patch), patch.path)
-        })).filter(({ actual, expected })=>actual?.identity === expected.identity).map(({ expected })=>expected.identity));
-    const stalePatchesByIdentity = new Map();
-    for (const patch of ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies.stale){
-        const stalePath = resolvePatchPath(patchKey(patch), patch.path);
-        const existing = stalePatchesByIdentity.get(stalePath.identity);
-        const acceptedDigests = [
-            patch.sha256,
-            ...patch.acceptedLegacySha256 ?? []
-        ];
-        if (existing) {
-            for (const digest of acceptedDigests)existing.acceptedDigests.add(digest);
-            continue;
-        }
-        stalePatchesByIdentity.set(stalePath.identity, {
-            acceptedDigests: new Set(acceptedDigests),
-            absolutePath: stalePath.absolutePath,
-            policyPath: patch.path
-        });
-    }
-    for (const [identity, stalePatch] of stalePatchesByIdentity){
-        if (activeFrameworkPatchIdentities.has(identity)) continue;
-        const survivingSelectors = resolvedPatchedDependencies.filter((resolved)=>resolved.identity === identity).map((resolved)=>resolved.selector);
-        if (survivingSelectors.length > 0) throw new Error(`Stale framework patch ${stalePatch.policyPath} is still referenced by consumer-owned selector(s): ${survivingSelectors.join(', ')}; refusing to mutate the workspace.`);
-        const patchPath = stalePatch.absolutePath;
-        if (!node_fs.existsSync(patchPath)) continue;
-        const digest = node_crypto.createHash('sha256').update(node_fs.readFileSync(patchPath)).digest('hex');
-        if (!stalePatch.acceptedDigests.has(digest)) throw new Error(`Stale framework patch ${stalePatch.policyPath} was modified (expected a reviewed sha256, found ${digest}); refusing to delete it.`);
-        staleFiles.push(patchPath);
-    }
-    return staleFiles;
-}
-function updateGeneratedPnpmWorkspacePolicy(io, packageSource, options = {}) {
-    const workspaceFile = node_path.join(io.workspaceRoot, 'pnpm-workspace.yaml');
-    if (!node_fs.existsSync(workspaceFile)) return false;
-    const source = node_fs.readFileSync(workspaceFile, 'utf-8');
-    const { document, lineEnding } = parsePnpmWorkspaceYaml(source, workspaceFile);
-    const before = JSON.stringify(document);
-    const drizzleOrmPatch = ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies.conditional.find((patch)=>'drizzle-orm' === patch.packageName);
-    reconcilePnpmPolicy(document, void 0 !== drizzleOrmPatch && workspaceUsesDependency(io.workspaceRoot, drizzleOrmPatch.packageName, drizzleOrmPatch.version), packageSource, options.releaseCohort, options.now);
-    const stalePatchFiles = stalePatchFilesToRemove(io.workspaceRoot, document);
-    let changed = false;
-    if (JSON.stringify(document) !== before) changed = io.write(workspaceFile, stringifyPnpmWorkspaceYaml(document, lineEnding)) || changed;
-    for (const stalePatchFile of stalePatchFiles)changed = io.remove(stalePatchFile) || changed;
-    return changed;
-}
-const NPM_REGISTRY_URL = 'https://registry.npmjs.org/';
-const LOOPBACK_REGISTRY_HOST = '127.0.0.1';
-function packageRegistryUrl(registryUrl, packageName) {
-    let base;
-    try {
-        base = new URL(registryUrl);
-    } catch  {
-        throw new Error(`Registry URL is invalid: ${registryUrl}`);
-    }
-    if ('https:' !== base.protocol && !('http:' === base.protocol && base.hostname === LOOPBACK_REGISTRY_HOST)) throw new Error(`Registry URL must use HTTPS: ${registryUrl}`);
-    const encodedName = packageName.startsWith('@') ? packageName.replace('/', '%2f') : encodeURIComponent(packageName);
-    return new URL(encodedName, base);
-}
-function packageVersionKey(packageName, version) {
-    return `${packageName}@${version}`;
-}
-function isRegistryRecord(value) {
-    return Boolean(value) && 'object' == typeof value && !Array.isArray(value);
-}
-const registryFetchConcurrency = 16;
-const registryFetchAttempts = 3;
-const registryFetchRetryDelayMs = 250;
-function isTransientRegistryStatus(status) {
-    return 429 === status || status >= 500;
-}
-async function fetchRegistryResponse(fetchImpl, url) {
-    let lastError;
-    for(let attempt = 0; attempt < registryFetchAttempts; attempt += 1){
-        try {
-            const response = await fetchImpl(url, {
-                headers: {
-                    accept: 'application/json'
-                },
-                redirect: 'error'
-            });
-            if (response.ok || !isTransientRegistryStatus(response.status) || attempt === registryFetchAttempts - 1) return response;
-            lastError = new Error(`HTTP ${response.status}`);
-        } catch (error) {
-            lastError = error;
-            if (attempt === registryFetchAttempts - 1) throw error;
-        }
-        await new Promise((resolve)=>setTimeout(resolve, registryFetchRetryDelayMs * 2 ** attempt));
-    }
-    throw lastError;
-}
-async function resolveRegistryCandidates(candidates, options) {
-    const nowTimestamp = options.now.getTime();
-    if (!Number.isFinite(nowTimestamp)) throw new Error('Release-age validation requires a valid current time.');
-    async function resolveCandidate(candidate) {
-        const key = packageVersionKey(candidate.packageName, candidate.version);
-        let response;
-        try {
-            response = await fetchRegistryResponse(options.fetchImpl, packageRegistryUrl(options.registryUrlFor(candidate.packageName), candidate.packageName));
-        } catch (error) {
-            throw new Error(`Registry metadata is uncertain for ${key} (${candidate.path.join(' -> ')}): ${error instanceof Error ? error.message : String(error)}`);
-        }
-        if (!response.ok) throw new Error(`Registry metadata is uncertain for ${key} (${candidate.path.join(' -> ')}): HTTP ${response.status}`);
-        let packument;
-        try {
-            packument = await response.json();
-        } catch (error) {
-            throw new Error(`Registry metadata is invalid JSON for ${key}: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        if (!isRegistryRecord(packument)) throw new Error(`Registry metadata is invalid for ${key}.`);
-        const versions = packument.versions;
-        const time = packument.time;
-        const versionMetadata = isRegistryRecord(versions) ? versions[candidate.version] : void 0;
-        const dist = isRegistryRecord(versionMetadata) ? versionMetadata.dist : void 0;
-        const integrity = isRegistryRecord(dist) ? dist.integrity : void 0;
-        if (integrity !== candidate.registry.dist.integrity) throw new Error(`Registry metadata integrity mismatch for ${key}: lock has ${candidate.registry.dist.integrity}, registry has ${String(integrity)}`);
-        const publishedAt = isRegistryRecord(time) ? time[candidate.version] : void 0;
-        const publishedAtTimestamp = 'string' == typeof publishedAt ? Date.parse(publishedAt) : 0 / 0;
-        if ('string' != typeof publishedAt || !Number.isFinite(publishedAtTimestamp) || publishedAtTimestamp > nowTimestamp) throw new Error(`Registry publication time is missing, invalid, or in the future for ${key}.`);
-        return {
-            ...candidate,
-            registry: {
-                ...candidate.registry,
-                publishedAt: new Date(publishedAtTimestamp).toISOString()
-            }
-        };
-    }
-    const results = new Array(candidates.length);
-    let nextIndex = 0;
-    async function worker() {
-        while(nextIndex < candidates.length){
-            const index = nextIndex;
-            nextIndex += 1;
-            results[index] = await resolveCandidate(candidates[index]);
-        }
-    }
-    await Promise.all(Array.from({
-        length: Math.min(registryFetchConcurrency, candidates.length)
-    }, ()=>worker()));
-    return results;
-}
-async function validateGeneratedPnpmLockReleaseAgePolicy(workspaceRoot, packageSource, options = {}) {
-    const lockfilePath = node_path.join(workspaceRoot, 'pnpm-lock.yaml');
-    if (!node_fs.existsSync(lockfilePath)) throw new Error('Cannot validate release-age approvals without pnpm-lock.yaml.');
-    const now = options.now ?? new Date();
-    const releaseCohort = options.releaseCohort ?? ('install' === packageSource.strategy ? readWorkspaceReleaseCohort(workspaceRoot) : void 0);
-    const activeSelectors = renderMinimumReleaseAgeExclude({
-        now,
-        packageSource,
-        releaseCohort
-    });
-    const workspacePolicyPath = node_path.join(workspaceRoot, 'pnpm-workspace.yaml');
-    const { document: workspacePolicy } = parsePnpmWorkspaceYaml(node_fs.readFileSync(workspacePolicyPath, 'utf-8'), workspacePolicyPath);
-    const renderedSelectors = assertUniqueStringList(workspacePolicy.minimumReleaseAgeExclude, 'minimumReleaseAgeExclude');
-    if (JSON.stringify(renderedSelectors) !== JSON.stringify(activeSelectors)) throw new Error('pnpm-workspace.yaml release-age exclusions do not match canonical policy.');
-    const firstPartySelectors = new Set(releaseCohort ? releaseCohortSelectors(releaseCohort) : []);
-    const firstPartyTargetNames = new Set(releaseCohort?.packages.map((item)=>item.targetName) ?? []);
-    const { document: lockfile } = parsePnpmWorkspaceYaml(node_fs.readFileSync(lockfilePath, 'utf-8'), lockfilePath);
-    const closure = discoverReachablePnpmLockReleaseAgeClosure(lockfile);
-    if (closure.unresolved.length > 0) {
-        const unresolved = closure.unresolved.slice(0, 20).map((candidate)=>{
-            const packageName = candidate.package ?? 'unknown package';
-            return `- ${packageName}: ${candidate.reason}; path ${candidate.path.join(' -> ')}`;
-        }).join('\n');
-        throw new Error(`Dependency closure has unresolved candidates:\n${unresolved}`);
-    }
-    const closureKeys = new Set(closure.candidates.map((candidate)=>packageVersionKey(candidate.packageName, candidate.version)));
-    const approvals = ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals.filter((approval)=>closureKeys.has(`${approval.packageName}@${approval.version}`));
-    const isFirstPartyCandidate = (packageName, version)=>{
-        if (!firstPartyTargetNames.has(packageName)) return false;
-        const key = `${packageName}@${version}`;
-        if (!firstPartySelectors.has(key)) throw new Error(`First-party lock candidate ${key} is absent from the authenticated release cohort.`);
-        return true;
-    };
-    const thirdPartyCandidates = closure.candidates.filter((candidate)=>!isFirstPartyCandidate(candidate.packageName, candidate.version));
-    const scopeRegistryUrl = options.registryUrl ?? packageSource.registry ?? NPM_REGISTRY_URL;
-    const scopePrefix = packageSource.aliasScope ? `@${packageSource.aliasScope.replace(/^@/u, '')}/` : void 0;
-    const activeCandidates = await resolveRegistryCandidates(thirdPartyCandidates, {
-        fetchImpl: options.fetchImpl ?? fetch,
-        now,
-        registryUrlFor: (packageName)=>void 0 !== scopePrefix && packageName.startsWith(scopePrefix) ? scopeRegistryUrl : NPM_REGISTRY_URL
-    });
-    const resolved = resolveReleaseAgeApprovals(activeCandidates, {
-        approvals,
-        now
-    });
-    if (resolved.reviewCandidates.length > 0) {
-        const pathsByKey = new Map(thirdPartyCandidates.map((candidate)=>[
-                packageVersionKey(candidate.packageName, candidate.version),
-                candidate.path
-            ]));
-        throw new Error([
-            `Dependency closure contains ${resolved.reviewCandidates.length} immature package(s) without an exact, unexpired approval:`,
-            ...resolved.reviewCandidates.slice(0, 20).map((candidate)=>{
-                const key = packageVersionKey(candidate.packageName, candidate.version);
-                return `- ${key}; path ${pathsByKey.get(key)?.join(' -> ') ?? 'unknown'}`;
-            })
-        ].join('\n'));
-    }
-    return {
-        ...resolved,
-        minimumReleaseAgeExclude: activeSelectors
-    };
-}
-export { updateGeneratedPnpmWorkspacePolicy, validateGeneratedPnpmLockReleaseAgePolicy };