vouchington-tooling 0.0.13 → 0.0.14

package/dist/http-body/index.mjs

@@ -0,0 +1,86 @@
+export class MissingResponseBodyError extends Error {
+    url;
+    constructor(url) {
+        super(`HTTP response from ${url} has no body`);
+        this.name = 'MissingResponseBodyError';
+        this.url = url;
+    }
+}
+export class ResponseBodyTooLargeError extends Error {
+    url;
+    sizeBytes;
+    maxSizeBytes;
+    constructor(url, sizeBytes, maxSizeBytes) {
+        super(`HTTP response from ${url} exceeded ${maxSizeBytes} bytes (read ${sizeBytes})`);
+        this.name = 'ResponseBodyTooLargeError';
+        this.url = url;
+        this.sizeBytes = sizeBytes;
+        this.maxSizeBytes = maxSizeBytes;
+    }
+}
+function abortReason(signal) {
+    if (signal.reason instanceof Error)
+        return signal.reason;
+    if (signal.reason !== undefined)
+        return new Error(String(signal.reason));
+    return new Error('HTTP response body read aborted');
+}
+function validateMaxSize(maxSizeBytes) {
+    if (!Number.isSafeInteger(maxSizeBytes) || maxSizeBytes < 0) {
+        throw new RangeError('maxSizeBytes must be a non-negative safe integer');
+    }
+}
+export async function readResponseBodyAsBuffer({ response, url, maxSizeBytes, signal, }) {
+    validateMaxSize(maxSizeBytes);
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new MissingResponseBodyError(url);
+    let abortListener;
+    let abortPromise;
+    if (signal) {
+        abortPromise = new Promise((_resolve, reject) => {
+            abortListener = () => {
+                const reason = abortReason(signal);
+                void reader.cancel(reason).catch(() => undefined);
+                reject(reason);
+            };
+            if (signal.aborted)
+                abortListener();
+            else
+                signal.addEventListener('abort', abortListener, { once: true });
+        });
+        void abortPromise.catch(() => undefined);
+    }
+    const chunks = [];
+    let totalSize = 0;
+    try {
+        for (;;) {
+            const result = await (abortPromise
+                ? Promise.race([reader.read(), abortPromise])
+                : reader.read());
+            if (signal?.aborted)
+                throw abortReason(signal);
+            if (result.done)
+                return Buffer.concat(chunks, totalSize);
+            totalSize += result.value.byteLength;
+            if (totalSize > maxSizeBytes) {
+                const error = new ResponseBodyTooLargeError(url, totalSize, maxSizeBytes);
+                await reader.cancel(error).catch(() => undefined);
+                throw error;
+            }
+            chunks.push(result.value);
+        }
+    }
+    catch (error) {
+        await reader.cancel(error).catch(() => undefined);
+        throw error;
+    }
+    finally {
+        if (signal && abortListener)
+            signal.removeEventListener('abort', abortListener);
+        reader.releaseLock();
+    }
+}
+export async function readResponseBody(options) {
+    return (await readResponseBodyAsBuffer(options)).toString('utf8');
+}

package/dist/http-link-pagination/index.d.mts

@@ -0,0 +1,19 @@
+/**
+ * Resolve the `rel=next` target in an RFC 8288 Link header without permitting a
+ * response to redirect an authenticated pagination client to another origin.
+ *
+ * A malformed or unsafe Link header is treated as having no next page. Callers
+ * can therefore stop safely without having to distinguish an exhausted list
+ * from a provider that returned an unusable continuation.
+ */
+export declare function nextPageUrlFromLinkHeader(linkHeader: string | null | undefined, requestUrl: string | URL): URL | null;
+/**
+ * Return an unambiguous next-page cursor from a safe Link header target.
+ *
+ * A missing, empty, or repeated query parameter is rejected. This prevents a
+ * caller from accidentally advancing with a cursor whose interpretation
+ * depends on a provider's duplicate-query-parameter semantics.
+ */
+export declare function nextPageCursorFromLinkHeader(linkHeader: string | null | undefined, requestUrl: string | URL, cursorParameter?: string): string | null;
+/** Validate a pagination request URL before it is used as a Link resolution base. */
+export declare function validatePaginationRequestUrl(requestUrl: string | URL): URL;

package/dist/http-link-pagination/index.mjs

@@ -0,0 +1,149 @@
+/**
+ * Resolve the `rel=next` target in an RFC 8288 Link header without permitting a
+ * response to redirect an authenticated pagination client to another origin.
+ *
+ * A malformed or unsafe Link header is treated as having no next page. Callers
+ * can therefore stop safely without having to distinguish an exhausted list
+ * from a provider that returned an unusable continuation.
+ */
+export function nextPageUrlFromLinkHeader(linkHeader, requestUrl) {
+    const baseUrl = validatePaginationRequestUrl(requestUrl);
+    // Preserve the public fail-closed result for an empty header while letting the
+    // parser own the empty-input case.
+    if (linkHeader == null)
+        return null;
+    const links = parseLinkHeader(linkHeader);
+    if (!links)
+        return null;
+    const nextLinks = links.filter((link) => link.relations.includes('next'));
+    if (nextLinks.length !== 1)
+        return null;
+    let nextUrl;
+    try {
+        nextUrl = new URL(nextLinks[0].target, baseUrl);
+    }
+    catch {
+        return null;
+    }
+    if (nextUrl.origin !== baseUrl.origin ||
+        nextUrl.username !== '' ||
+        nextUrl.password !== '' ||
+        nextUrl.hash !== '') {
+        return null;
+    }
+    return nextUrl;
+}
+/**
+ * Return an unambiguous next-page cursor from a safe Link header target.
+ *
+ * A missing, empty, or repeated query parameter is rejected. This prevents a
+ * caller from accidentally advancing with a cursor whose interpretation
+ * depends on a provider's duplicate-query-parameter semantics.
+ */
+export function nextPageCursorFromLinkHeader(linkHeader, requestUrl, cursorParameter = 'page') {
+    const nextUrl = nextPageUrlFromLinkHeader(linkHeader, requestUrl);
+    if (!nextUrl)
+        return null;
+    const values = nextUrl.searchParams.getAll(cursorParameter);
+    return values.length === 1 && values[0] !== '' ? values[0] : null;
+}
+/** Validate a pagination request URL before it is used as a Link resolution base. */
+export function validatePaginationRequestUrl(requestUrl) {
+    let url;
+    try {
+        url = new URL(requestUrl);
+    }
+    catch {
+        throw new Error('pagination request URL must be an absolute HTTP(S) URL without credentials');
+    }
+    if (!['http:', 'https:'].includes(url.protocol) ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.hash !== '') {
+        throw new Error('pagination request URL must be an absolute HTTP(S) URL without credentials');
+    }
+    return url;
+}
+function parseLinkHeader(header) {
+    const links = [];
+    let index = 0;
+    while (index < header.length) {
+        index = skipWhitespace(header, index);
+        if (header[index] !== '<')
+            return null;
+        const targetEnd = header.indexOf('>', index + 1);
+        if (targetEnd === -1)
+            return null;
+        const target = header.slice(index + 1, targetEnd);
+        if (target === '')
+            return null;
+        index = targetEnd + 1;
+        const relations = [];
+        while (true) {
+            index = skipWhitespace(header, index);
+            if (index === header.length || header[index] === ',')
+                break;
+            if (header[index] !== ';')
+                return null;
+            index = skipWhitespace(header, index + 1);
+            const name = readToken(header, index);
+            if (!name)
+                return null;
+            index = name.end;
+            index = skipWhitespace(header, index);
+            if (header[index] !== '=')
+                return null;
+            index = skipWhitespace(header, index + 1);
+            const value = readParameterValue(header, index);
+            if (!value)
+                return null;
+            index = value.end;
+            if (name.value.toLowerCase() === 'rel') {
+                relations.push(...value.value.toLowerCase().split(/\s+/).filter(Boolean));
+            }
+        }
+        links.push({ target, relations });
+        if (index === header.length)
+            return links;
+        index += 1;
+        if (index === header.length)
+            return null;
+    }
+    return null;
+}
+function skipWhitespace(value, index) {
+    while (value[index] === ' ' || value[index] === '\t')
+        index += 1;
+    return index;
+}
+function readToken(value, index) {
+    const start = index;
+    while (index < value.length && isTokenCharacter(value[index]))
+        index += 1;
+    return index === start ? null : { value: value.slice(start, index), end: index };
+}
+function isTokenCharacter(value) {
+    return /^[!#$%&'*+\-.^_`|~0-9A-Za-z]$/.test(value);
+}
+function readParameterValue(value, index) {
+    if (value[index] !== '"')
+        return readToken(value, index);
+    let parsed = '';
+    index += 1;
+    while (index < value.length) {
+        const character = value[index];
+        if (character === '"')
+            return { value: parsed, end: index + 1 };
+        if (character === '\\') {
+            const escaped = value[index + 1];
+            if (!escaped)
+                return null;
+            parsed += escaped;
+            index += 2;
+            continue;
+        }
+        parsed += character;
+        index += 1;
+    }
+    return null;
+}

package/dist/index.d.mts

@@ -5,10 +5,14 @@ export type { ForeignKey, SqlCreateIndexMetadata, SqlCreateTableColumn, SqlCreat
 export { dollarQuoteEnd, lineOf, maskSqlQuotedText, readDollarQuoteDelimiter, readStringLiteral, splitSqlStatements, sqlFragments, stripSqlComments, } from './sql-scanner/index.mts';
 export { auditCiJobRuntime, parseWorkflowNameMatch } from './gha-runtime-audit/index.mts';
 export type { GhApiExecutor, RuntimeAuditOptions, RuntimeAuditResult, RuntimeAuditWorkflowFilter, RuntimeJobResult, RuntimeSample, } from './gha-runtime-audit/index.mts';
-export { createVitestBlobManifest, inspectVitestBlobBundle, parseVitestBlobManifest, serializeVitestBlobManifest, VITEST_BLOB_MANIFEST_FILENAME, VITEST_BLOB_MANIFEST_VERSION, vitestBlobBundlePaths, writeVitestBlobManifest, } from './vitest-blob-manifest/index.mts';
-export type { InspectedVitestBlobBundle, VitestBlobIdentity, VitestBlobManifest, } from './vitest-blob-manifest/index.mts';
+export { createVitestBlobManifest, createVitestReportAttempt, inspectVitestBlobBundle, parseVitestBlobManifest, parseVitestReportAttempt, readVitestReportAttempts, serializeVitestBlobManifest, serializeVitestReportAttempt, VITEST_BLOB_MANIFEST_FILENAME, VITEST_BLOB_MANIFEST_VERSION, VITEST_REPORT_ATTEMPT_PREFIX, VITEST_REPORT_ATTEMPT_VERSION, vitestBlobBundlePaths, writeVitestBlobManifest, writeVitestReportAttempt, } from './vitest-blob-manifest/index.mts';
+export type { InspectedVitestBlobBundle, VitestBlobIdentity, VitestBlobManifest, VitestReportAttempt, VitestReportAttemptIdentity, } from './vitest-blob-manifest/index.mts';
+export { prepareVitestReports } from './vitest-blob-manifest/reports.mts';
+export type { PrepareVitestReportsOptions, SelectedVitestReport, VitestReportExpectation, } from './vitest-blob-manifest/reports.mts';
 export { findWorkspaceLinkMismatches, formatReleaseAgeFailure, INSTALL_TERMINATION_FAILED, isReleaseAgeViolation, parseInstallOptions, parseReleaseAgeViolations, runInstallLifecycle, } from './pnpm-install/index.mts';
 export type { InstallOptions, Lifecycle } from './pnpm-install/index.mts';
+export { flattenReleaseAgeSelectors, packageNameFromPnpmLockKey, pnpmLockPackageKeyMatchesSelector, validateReleaseAgeExemptionGroups, validateReleaseAgePolicy, } from './pnpm-install/index.mts';
+export type { ReleaseAgeExemptionGroup, ReleaseAgePermanentExemption, ReleaseAgePolicyConfig, ReleaseAgePolicySnapshot, } from './pnpm-install/index.mts';
 export { buildContextFromTrackedFiles, buildSharedContext, clearFakeGitEnv, gitEnv, installFakeGit, runNamedChecks, setFakeGitTrackedFiles, } from './shared-context/index.mts';
 export type { FakeGitOptions, NamedCheck, SharedContext } from './shared-context/index.mts';
 export { decodeSelectedFiles, encodeSelectedFiles, formatMultilineOutput, SELECTED_FILES_ENV_MAX_BYTES, selectedFilesExceedEnvBudget, writeSelectedFilesOutput, } from './gha-selected-files/index.mts';
@@ -20,3 +24,13 @@ export { buildSchemaSnapshot, detectRenamedIndexes, generateSchemaSnapshot, inde
 export type { CatalogQuery, PartitionPolicy, SchemaCatalog, SchemaGrowthMaps, SchemaSnapshot, SchemaTableSnapshot, } from './pg-schema-snapshot/index.mts';
 export { buildOpenApiDocument, hashContractSchema, nodeToOpenApi, writeOpenApi, } from './openapi-document/index.mts';
 export type { BuildOpenApiDocumentInput, ContractSchema, OpenApiDocument, RequestContract, ResponseContract, } from './openapi-document/index.mts';
+export { decide, deriveRetryAttempt } from './transient-retry/index.mts';
+export type { DecisionResult, EvaluateRulesOptions, NoMatchReason, RetryContext, RetryDecision, RetryRule, RetryTarget, } from './transient-retry/index.mts';
+export { escapeSpreadsheetFormula, parseCsvRows, streamCsvRows, stripCsvBom } from './csv/index.mts';
+export { MissingResponseBodyError, readResponseBody, readResponseBodyAsBuffer, ResponseBodyTooLargeError, } from './http-body/index.mts';
+export type { ReadResponseBodyOptions } from './http-body/index.mts';
+export { parseAstGrepRuleArgs, runAstGrepRule } from './ast-grep-rule/index.mts';
+export type { AstGrepRuleInvocation, RunAstGrepRuleOptions } from './ast-grep-rule/index.mts';
+export { bodyOnlyReviewFallback, indexReviewFiles, MAX_REVIEW_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES, nearestReviewLine, parsePatchCommentable, parseReviewFilesJson, parseReviewPayload, readRegularReviewPayload, remapReviewComments, ReviewPayloadError, reviewCommentSubject, rewriteSnappedSuggestion, snapReviewNote, stageReviewPayload, writeStagedOutput, } from './gha-review-payload/index.mts';
+export type { CommentableIndex, CommentableLine, LineKind, PayloadRequirement, ReviewComment, ReviewFile, ReviewSide, SanitizedReview, } from './gha-review-payload/index.mts';
+export { nextPageCursorFromLinkHeader, nextPageUrlFromLinkHeader, validatePaginationRequestUrl, } from './http-link-pagination/index.mts';

package/dist/index.mjs

@@ -1,9 +1,12 @@
+/* eslint-disable max-lines -- package entry point enumerates the supported public API. */
 export { EphemeralListenerAttemptsExhaustedError, isRunnerReservedPort, listenOnRunnerUnreservedEphemeralPort, loadRunnerPortPolicy, runnerPortPolicy, validateRunnerPortPolicy, } from './runner-port-policy/index.mjs';
 export { extractAlterTableAddColumnLocations, extractCreateIndexMetadata, extractCreateTableMetadata, extractDefaultFunction, extractDropIndexMetadata, extractFuncCallArgColumnNames, extractMigrationConstraintMetadata, initSqlAst, lineOfUtf8ByteOffset, MissingSqlAstParserError, parseSql, } from './sql-ast/index.mjs';
 export { dollarQuoteEnd, lineOf, maskSqlQuotedText, readDollarQuoteDelimiter, readStringLiteral, splitSqlStatements, sqlFragments, stripSqlComments, } from './sql-scanner/index.mjs';
 export { auditCiJobRuntime, parseWorkflowNameMatch } from './gha-runtime-audit/index.mjs';
-export { createVitestBlobManifest, inspectVitestBlobBundle, parseVitestBlobManifest, serializeVitestBlobManifest, VITEST_BLOB_MANIFEST_FILENAME, VITEST_BLOB_MANIFEST_VERSION, vitestBlobBundlePaths, writeVitestBlobManifest, } from './vitest-blob-manifest/index.mjs';
+export { createVitestBlobManifest, createVitestReportAttempt, inspectVitestBlobBundle, parseVitestBlobManifest, parseVitestReportAttempt, readVitestReportAttempts, serializeVitestBlobManifest, serializeVitestReportAttempt, VITEST_BLOB_MANIFEST_FILENAME, VITEST_BLOB_MANIFEST_VERSION, VITEST_REPORT_ATTEMPT_PREFIX, VITEST_REPORT_ATTEMPT_VERSION, vitestBlobBundlePaths, writeVitestBlobManifest, writeVitestReportAttempt, } from './vitest-blob-manifest/index.mjs';
+export { prepareVitestReports } from './vitest-blob-manifest/reports.mjs';
 export { findWorkspaceLinkMismatches, formatReleaseAgeFailure, INSTALL_TERMINATION_FAILED, isReleaseAgeViolation, parseInstallOptions, parseReleaseAgeViolations, runInstallLifecycle, } from './pnpm-install/index.mjs';
+export { flattenReleaseAgeSelectors, packageNameFromPnpmLockKey, pnpmLockPackageKeyMatchesSelector, validateReleaseAgeExemptionGroups, validateReleaseAgePolicy, } from './pnpm-install/index.mjs';
 export { buildContextFromTrackedFiles, buildSharedContext, clearFakeGitEnv, gitEnv, installFakeGit, runNamedChecks, setFakeGitTrackedFiles, } from './shared-context/index.mjs';
 export { decodeSelectedFiles, encodeSelectedFiles, formatMultilineOutput, SELECTED_FILES_ENV_MAX_BYTES, selectedFilesExceedEnvBudget, writeSelectedFilesOutput, } from './gha-selected-files/index.mjs';
 export { createArtifactClassifier, parseArtifactPatternsJson, planRunDeletions, runCleanup, sweepCleanup, } from './gha-artifacts-cleanup/index.mjs';
@@ -11,3 +14,9 @@ export { validateOptionalHttpOrigin } from './http-origin/index.mjs';
 export { boundPendingLine, DEFAULT_MAX_PENDING_LINE_LENGTH, DEFAULT_TRUNCATED_LINE_MARKER, splitCompleteLines, } from './process-line-buffer/index.mjs';
 export { buildSchemaSnapshot, detectRenamedIndexes, generateSchemaSnapshot, indexShapeKey, readSchemaCatalog, renderSchemaMarkdown, stableStringify, writeSchemaSnapshot, } from './pg-schema-snapshot/index.mjs';
 export { buildOpenApiDocument, hashContractSchema, nodeToOpenApi, writeOpenApi, } from './openapi-document/index.mjs';
+export { decide, deriveRetryAttempt } from './transient-retry/index.mjs';
+export { escapeSpreadsheetFormula, parseCsvRows, streamCsvRows, stripCsvBom } from './csv/index.mjs';
+export { MissingResponseBodyError, readResponseBody, readResponseBodyAsBuffer, ResponseBodyTooLargeError, } from './http-body/index.mjs';
+export { parseAstGrepRuleArgs, runAstGrepRule } from './ast-grep-rule/index.mjs';
+export { bodyOnlyReviewFallback, indexReviewFiles, MAX_REVIEW_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES, nearestReviewLine, parsePatchCommentable, parseReviewFilesJson, parseReviewPayload, readRegularReviewPayload, remapReviewComments, ReviewPayloadError, reviewCommentSubject, rewriteSnappedSuggestion, snapReviewNote, stageReviewPayload, writeStagedOutput, } from './gha-review-payload/index.mjs';
+export { nextPageCursorFromLinkHeader, nextPageUrlFromLinkHeader, validatePaginationRequestUrl, } from './http-link-pagination/index.mjs';

package/dist/pnpm-install/index.d.mts

@@ -3,5 +3,7 @@ export { runPnpm } from './exec.mts';
 export { baseInstallArgs, findWorkspaceLinkMismatches, listWorkspaces, logWorkspaceLinkMismatches, parseInstallOptions, reportGlibcVersionRuntime, } from './support.mts';
 export type { CaptureCommand, CommandResult, InstallOptions, Lifecycle, Workspace, WorkspaceLinkMismatch, } from './support.mts';
 export { formatReleaseAgeFailure, isReleaseAgeViolation, parseReleaseAgeViolations, } from './release-age.mts';
+export { flattenReleaseAgeSelectors, packageNameFromPnpmLockKey, pnpmLockPackageKeyMatchesSelector, validateReleaseAgeExemptionGroups, validateReleaseAgePolicy, } from './release-age-policy.mts';
+export type { ReleaseAgeExemptionGroup, ReleaseAgePermanentExemption, ReleaseAgePolicyConfig, ReleaseAgePolicySnapshot, } from './release-age-policy.mts';
 export { INSTALL_TERMINATION_FAILED, installExitCode, safeProcessGroup, startInstallHeartbeat, terminateProcessGroup, terminateSafeProcessGroup, } from './process.mts';
 export { persistentDependencyTreeIsCold, persistentMetadataFingerprint, persistentMetadataMatches, writePersistentMetadataStamp, } from './metadata.mts';

package/dist/pnpm-install/index.mjs

@@ -2,5 +2,6 @@ export { runInstallLifecycle } from './runner.mjs';
 export { runPnpm } from './exec.mjs';
 export { baseInstallArgs, findWorkspaceLinkMismatches, listWorkspaces, logWorkspaceLinkMismatches, parseInstallOptions, reportGlibcVersionRuntime, } from './support.mjs';
 export { formatReleaseAgeFailure, isReleaseAgeViolation, parseReleaseAgeViolations, } from './release-age.mjs';
+export { flattenReleaseAgeSelectors, packageNameFromPnpmLockKey, pnpmLockPackageKeyMatchesSelector, validateReleaseAgeExemptionGroups, validateReleaseAgePolicy, } from './release-age-policy.mjs';
 export { INSTALL_TERMINATION_FAILED, installExitCode, safeProcessGroup, startInstallHeartbeat, terminateProcessGroup, terminateSafeProcessGroup, } from './process.mjs';
 export { persistentDependencyTreeIsCold, persistentMetadataFingerprint, persistentMetadataMatches, writePersistentMetadataStamp, } from './metadata.mjs';

package/dist/pnpm-install/release-age-policy-types.d.mts

@@ -0,0 +1,34 @@
+/** A group of exact package versions temporarily exempted from the age gate. */
+export interface ReleaseAgeExemptionGroup {
+    /** Exact package@version selectors accepted by pnpm's minimumReleaseAgeExclude. */
+    selectors: readonly [string, ...string[]];
+    /** Why these releases must bypass the normal supply-chain delay. */
+    reason: string;
+    /** Canonical UTC time at which this group becomes eligible for removal. */
+    eligibleForRemovalAt: string;
+}
+/** A package permanently exempted from the age gate, usually because it is first-party. */
+export interface ReleaseAgePermanentExemption {
+    name: string;
+    reason: string;
+}
+/** Repository-specific release-age policy. All package names and scopes are caller supplied. */
+export interface ReleaseAgePolicyConfig {
+    /** Permanent package exemptions. */
+    permanentExemptions?: readonly ReleaseAgePermanentExemption[];
+    /** Temporary exact-version exemptions. */
+    temporaryExemptionGroups?: readonly ReleaseAgeExemptionGroup[];
+    /** Prefixes that identify packages expected to be present in the permanent registry. */
+    firstPartyPackagePrefixes?: readonly string[];
+    /** Whether every permanent exemption must occur in the active package graph. */
+    requirePermanentExemptionsActive?: boolean;
+}
+/** Parsed repository state passed to the release-age policy validator. */
+export interface ReleaseAgePolicySnapshot {
+    /** Raw entries from pnpm-workspace.yaml minimumReleaseAgeExclude. */
+    workspaceExcludes: readonly unknown[];
+    /** Package names found in manifests and/or the lockfile. */
+    activePackageNames?: readonly string[];
+    /** Keys from the lockfile `packages` map, used to check temporary selectors. */
+    lockfilePackageKeys?: readonly string[];
+}

package/dist/pnpm-install/release-age-policy-types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/pnpm-install/release-age-policy.d.mts

@@ -0,0 +1,31 @@
+/**
+ * Configuration-driven validation for pnpm's `minimumReleaseAgeExclude` list.
+ *
+ * This module intentionally does not read repository files or parse YAML. A repository-specific
+ * adapter can parse its workspace and lockfile once, then pass the resulting values here. Keeping
+ * the policy engine pure makes its public contract safe to share with other repositories and keeps
+ * private package names, scopes, and documentation out of this package.
+ */
+import type { ReleaseAgeExemptionGroup, ReleaseAgePolicyConfig, ReleaseAgePolicySnapshot } from './release-age-policy-types.mts';
+export type { ReleaseAgeExemptionGroup, ReleaseAgePermanentExemption, ReleaseAgePolicyConfig, ReleaseAgePolicySnapshot, } from './release-age-policy-types.mts';
+/** Returns a flat list of temporary selectors, preserving declaration order. */
+export declare function flattenReleaseAgeSelectors(groups: ReadonlyArray<ReleaseAgeExemptionGroup>): string[];
+/**
+ * Validates temporary exemption shape without applying repository-specific policy.
+ *
+ * The returned messages are deliberately path-free so a caller can attach its own CI annotation
+ * location. The function reports every independent error rather than throwing on malformed input.
+ */
+export declare function validateReleaseAgeExemptionGroups(groups: ReadonlyArray<ReleaseAgeExemptionGroup>): string[];
+/** Extracts an npm package name from a pnpm lockfile package key. */
+export declare function packageNameFromPnpmLockKey(key: string): string | null;
+/** Tests whether a lockfile key represents an exact package@version selector. */
+export declare function pnpmLockPackageKeyMatchesSelector(key: string, selector: string): boolean;
+/**
+ * Validates registry/workspace/graph consistency for a configured release-age policy.
+ *
+ * `activePackageNames` should be the union of dependency names discovered in tracked manifests and
+ * the lockfile. If `lockfilePackageKeys` is supplied, every temporary selector must match a key;
+ * omitting it lets adapters that do not track lockfiles use the shape and registry checks alone.
+ */
+export declare function validateReleaseAgePolicy(config: ReleaseAgePolicyConfig, snapshot: ReleaseAgePolicySnapshot): string[];

package/dist/pnpm-install/release-age-policy.mjs

@@ -0,0 +1,136 @@
+/**
+ * Configuration-driven validation for pnpm's `minimumReleaseAgeExclude` list.
+ *
+ * This module intentionally does not read repository files or parse YAML. A repository-specific
+ * adapter can parse its workspace and lockfile once, then pass the resulting values here. Keeping
+ * the policy engine pure makes its public contract safe to share with other repositories and keeps
+ * private package names, scopes, and documentation out of this package.
+ */
+const EXACT_PACKAGE_VERSION_SELECTOR = /^(?:@[a-z0-9][a-z0-9._~-]*\/[a-z0-9][a-z0-9._~-]*|[a-z0-9][a-z0-9._~-]*)@(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+const CANONICAL_UTC_INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/;
+function isCanonicalUtcInstant(value) {
+    if (!CANONICAL_UTC_INSTANT.test(value))
+        return false;
+    const timestamp = Date.parse(value);
+    return (Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value.replace('Z', '.000Z'));
+}
+/** Returns a flat list of temporary selectors, preserving declaration order. */
+export function flattenReleaseAgeSelectors(groups) {
+    return groups.flatMap((group) => group.selectors);
+}
+/**
+ * Validates temporary exemption shape without applying repository-specific policy.
+ *
+ * The returned messages are deliberately path-free so a caller can attach its own CI annotation
+ * location. The function reports every independent error rather than throwing on malformed input.
+ */
+export function validateReleaseAgeExemptionGroups(groups) {
+    const errors = [];
+    const selectors = new Set();
+    for (const group of groups) {
+        if (group.selectors.length === 0) {
+            errors.push('release-age exemption group must contain at least one exact selector');
+        }
+        for (const selector of group.selectors) {
+            if (!EXACT_PACKAGE_VERSION_SELECTOR.test(selector)) {
+                errors.push(`release-age exemption "${selector}" must be an exact package@version selector`);
+            }
+            if (selectors.has(selector))
+                errors.push(`duplicate release-age exemption "${selector}"`);
+            selectors.add(selector);
+        }
+        if (group.reason.trim().length === 0) {
+            errors.push('release-age exemption group must have a nonblank reason');
+        }
+        if (!isCanonicalUtcInstant(group.eligibleForRemovalAt)) {
+            errors.push('release-age exemption group eligibleForRemovalAt must be a canonical UTC instant (YYYY-MM-DDTHH:mm:ssZ)');
+        }
+    }
+    return errors;
+}
+/** Extracts an npm package name from a pnpm lockfile package key. */
+export function packageNameFromPnpmLockKey(key) {
+    const normalized = key.startsWith('/') ? key.slice(1) : key;
+    if (normalized.startsWith('@')) {
+        const packageSeparator = normalized.indexOf('/', 1);
+        if (packageSeparator === -1)
+            return null;
+        const versionSeparator = normalized.indexOf('@', packageSeparator + 1);
+        return versionSeparator === -1 ? null : normalized.slice(0, versionSeparator);
+    }
+    const versionSeparator = normalized.indexOf('@');
+    return versionSeparator === -1 ? null : normalized.slice(0, versionSeparator);
+}
+/** Tests whether a lockfile key represents an exact package@version selector. */
+export function pnpmLockPackageKeyMatchesSelector(key, selector) {
+    const normalized = key.startsWith('/') ? key.slice(1) : key;
+    return (normalized === selector ||
+        normalized.startsWith(`${selector}(`) ||
+        normalized.startsWith(`${selector}_`));
+}
+/**
+ * Validates registry/workspace/graph consistency for a configured release-age policy.
+ *
+ * `activePackageNames` should be the union of dependency names discovered in tracked manifests and
+ * the lockfile. If `lockfilePackageKeys` is supplied, every temporary selector must match a key;
+ * omitting it lets adapters that do not track lockfiles use the shape and registry checks alone.
+ */
+export function validateReleaseAgePolicy(config, snapshot) {
+    const permanentExemptions = config.permanentExemptions ?? [];
+    const temporaryGroups = config.temporaryExemptionGroups ?? [];
+    const prefixes = config.firstPartyPackagePrefixes ?? [];
+    const activeNames = new Set(snapshot.activePackageNames ?? []);
+    const errors = validateReleaseAgeExemptionGroups(temporaryGroups);
+    const permanentNames = new Set();
+    for (const exemption of permanentExemptions) {
+        if (exemption.name.trim().length === 0)
+            errors.push('permanent release-age exemption name must be nonblank');
+        if (permanentNames.has(exemption.name)) {
+            errors.push(`duplicate permanent release-age exemption "${exemption.name}"`);
+        }
+        permanentNames.add(exemption.name);
+        if (exemption.reason.trim().length === 0) {
+            errors.push(`permanent release-age exemption "${exemption.name}" must have a nonblank reason`);
+        }
+    }
+    const temporarySelectors = new Set(flattenReleaseAgeSelectors(temporaryGroups));
+    const registryNames = new Set([...permanentNames, ...temporarySelectors]);
+    const workspaceNames = new Set();
+    for (const entry of snapshot.workspaceExcludes) {
+        if (typeof entry !== 'string') {
+            errors.push(`minimumReleaseAgeExclude entry ${JSON.stringify(entry)} must be a string`);
+            continue;
+        }
+        if (workspaceNames.has(entry)) {
+            errors.push(`minimumReleaseAgeExclude duplicates "${entry}"`);
+        }
+        workspaceNames.add(entry);
+        if (!registryNames.has(entry)) {
+            errors.push(`minimumReleaseAgeExclude contains unregistered entry "${entry}"`);
+        }
+    }
+    for (const name of registryNames) {
+        if (!workspaceNames.has(name))
+            errors.push(`registered release-age exemption "${name}" is missing from minimumReleaseAgeExclude`);
+    }
+    for (const name of activeNames) {
+        if (prefixes.some((prefix) => name.startsWith(prefix)) && !permanentNames.has(name)) {
+            errors.push(`active first-party package "${name}" is missing from permanent release-age exemptions`);
+        }
+    }
+    if (config.requirePermanentExemptionsActive ?? true) {
+        for (const name of permanentNames) {
+            if (!activeNames.has(name)) {
+                errors.push(`permanent release-age exemption "${name}" is absent from the active package graph`);
+            }
+        }
+    }
+    if (snapshot.lockfilePackageKeys !== undefined) {
+        for (const selector of temporarySelectors) {
+            if (!snapshot.lockfilePackageKeys.some((key) => pnpmLockPackageKeyMatchesSelector(key, selector))) {
+                errors.push(`temporary release-age exemption "${selector}" is absent from lockfile packages`);
+            }
+        }
+    }
+    return errors;
+}

package/dist/transient-retry/attempts.d.mts

@@ -0,0 +1,5 @@
+/**
+ * Normalizes a provider's attempt count when earlier attempts produced no targets.
+ * Provider API fetching and parsing intentionally remain outside this package.
+ */
+export declare function deriveRetryAttempt(runAttempt: number, priorTargetCounts: readonly number[]): number;

package/dist/transient-retry/attempts.mjs

@@ -0,0 +1,8 @@
+/**
+ * Normalizes a provider's attempt count when earlier attempts produced no targets.
+ * Provider API fetching and parsing intentionally remain outside this package.
+ */
+export function deriveRetryAttempt(runAttempt, priorTargetCounts) {
+    const emptyPriorAttempts = priorTargetCounts.filter((count) => count === 0).length;
+    return Math.max(1, runAttempt - emptyPriorAttempts);
+}

package/dist/transient-retry/decision-evaluator.d.mts

@@ -0,0 +1,18 @@
+import type { RetryContext, RetryDecision, RetryRule } from './types.mts';
+export type NoMatchReason = 'no-rule' | 'invalid-rule' | 'invalid-target' | 'missing-target';
+export type DecisionResult = {
+    decision: Exclude<RetryDecision, 'rerun'>;
+    matchedRule: string;
+} | {
+    decision: 'rerun';
+    matchedRule: string;
+    targetName: string;
+} | {
+    decision: 'no-match';
+    matchedRule: string;
+    reason: NoMatchReason;
+};
+export interface EvaluateRulesOptions {
+    afterRuleEvaluated?: (context: RetryContext, rule: RetryRule) => Promise<void> | void;
+}
+export declare function decide(context: RetryContext, rules: readonly RetryRule[], options?: EvaluateRulesOptions): Promise<DecisionResult>;

package/dist/transient-retry/decision-evaluator.mjs

@@ -0,0 +1,56 @@
+function normalizedAttempt(context, rule) {
+    const sharedAttempt = context.retryAttempt ?? context.runAttempt;
+    return rule.decision === undefined || rule.decision === 'rerun'
+        ? (context.retryAttempts?.get(rule.id) ?? sharedAttempt)
+        : sharedAttempt;
+}
+function resolveTargetName(target, context) {
+    if (target == null || typeof target !== 'object')
+        return { reason: 'invalid-target' };
+    let targetName;
+    try {
+        targetName = 'targetName' in target ? target.targetName : target.resolveTargetName(context);
+    }
+    catch {
+        return { reason: 'invalid-target' };
+    }
+    if (typeof targetName !== 'string') {
+        return { reason: targetName == null ? 'missing-target' : 'invalid-target' };
+    }
+    if ('targetFamily' in target) {
+        if (typeof target.targetFamily !== 'string' || target.targetFamily.length === 0) {
+            return { reason: 'invalid-target' };
+        }
+        if (!targetName.startsWith(target.targetFamily)) {
+            return { reason: 'invalid-target' };
+        }
+    }
+    if (targetName.length === 0)
+        return { reason: 'missing-target' };
+    if (!context.targetNames?.has(targetName))
+        return { reason: 'missing-target' };
+    return { targetName };
+}
+export async function decide(context, rules, options = {}) {
+    for (const rule of rules) {
+        const attempt = normalizedAttempt(context, rule);
+        if (!Number.isSafeInteger(attempt) || attempt < 1 || !Number.isSafeInteger(rule.maxAttempts)) {
+            return { decision: 'no-match', matchedRule: rule.id, reason: 'invalid-rule' };
+        }
+        if (rule.maxAttempts < attempt)
+            continue;
+        const matched = await rule.match(context);
+        await options.afterRuleEvaluated?.(context, rule);
+        if (!matched)
+            continue;
+        if (rule.decision !== undefined && rule.decision !== 'rerun') {
+            return { decision: rule.decision, matchedRule: rule.id };
+        }
+        const resolved = resolveTargetName(rule.retryTarget, context);
+        if (resolved.targetName === undefined) {
+            return { decision: 'no-match', matchedRule: rule.id, reason: resolved.reason };
+        }
+        return { decision: 'rerun', matchedRule: rule.id, targetName: resolved.targetName };
+    }
+    return { decision: 'no-match', matchedRule: '', reason: 'no-rule' };
+}

package/dist/transient-retry/index.d.mts

@@ -0,0 +1,4 @@
+export { deriveRetryAttempt } from './attempts.mts';
+export { decide } from './decision-evaluator.mts';
+export type { DecisionResult, EvaluateRulesOptions, NoMatchReason } from './decision-evaluator.mts';
+export type { RetryContext, RetryDecision, RetryRule, RetryTarget } from './types.mts';

package/dist/transient-retry/index.mjs

@@ -0,0 +1,2 @@
+export { deriveRetryAttempt } from './attempts.mjs';
+export { decide } from './decision-evaluator.mjs';