vouchington-tooling 0.0.14 → 0.0.16

package/dist/scc-complexity/index.mjs

@@ -0,0 +1,91 @@
+import { execFile } from 'node:child_process';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+export const SCC_COMPLEXITY_LIMIT = 50;
+const DEFAULT_INCLUDE_EXT = 'js,mts,jsx,ts,tsx';
+const DEFAULT_EXCLUDE_DIR = '.git,fixtures,__tests__,test-helpers';
+const DEFAULT_NOT_MATCH = String.raw `\.(test|spec)\.`;
+const DEFAULT_TMPDIR_PREFIX = 'scc-complexity-';
+export function buildSccArgs(options = {}) {
+    return [
+        '--format',
+        'json',
+        '--include-ext',
+        options.includeExt ?? DEFAULT_INCLUDE_EXT,
+        '--by-file',
+        '--sort',
+        'complexity',
+        '--exclude-dir',
+        options.excludeDir ?? DEFAULT_EXCLUDE_DIR,
+        '--not-match',
+        options.notMatch ?? DEFAULT_NOT_MATCH,
+        '--no-cocomo',
+    ];
+}
+export async function checkSccComplexity(ctx, options = {}, runScc) {
+    if (!ctx.isInsideGitRepo) {
+        return { errors: [`::error::${ctx.repoRoot} is not inside a git repository`] };
+    }
+    const dir = await mkdtemp(join(tmpdir(), options.tmpdirPrefix ?? DEFAULT_TMPDIR_PREFIX));
+    const outputPath = join(dir, 'scc.json');
+    const limit = options.limit ?? SCC_COMPLEXITY_LIMIT;
+    try {
+        const resolve = runScc ?? ((path) => runSccJson(ctx.repoRoot, path, options));
+        const json = await resolve(outputPath);
+        const violations = parseSccComplexityViolations(json, ctx.trackedFileSet, limit);
+        return { errors: violations.map((violation) => formatViolation(violation, limit)) };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { errors: [`::error::scc-complexity failed: ${message}`] };
+    }
+    finally {
+        await rm(dir, { force: true, recursive: true });
+    }
+}
+export function parseSccComplexityViolations(json, trackedFileSet, limit = SCC_COMPLEXITY_LIMIT) {
+    const parsed = JSON.parse(json);
+    if (!Array.isArray(parsed))
+        throw new Error('scc JSON output must be an array');
+    const violations = [];
+    for (const language of parsed) {
+        if (!Array.isArray(language.Files))
+            continue;
+        for (const file of language.Files) {
+            if (typeof file.Location !== 'string')
+                continue;
+            if (!trackedFileSet.has(file.Location))
+                continue;
+            if (typeof file.Complexity !== 'number')
+                continue;
+            if (file.Complexity <= limit)
+                continue;
+            violations.push({ file: file.Location, complexity: file.Complexity });
+        }
+    }
+    return violations.toSorted((a, b) => b.complexity - a.complexity || a.file.localeCompare(b.file));
+}
+async function runSccJson(repoRoot, outputPath, options) {
+    try {
+        await execFileAsync(options.command ?? 'scc', [...buildSccArgs(options), '--output', outputPath], {
+            cwd: repoRoot,
+            maxBuffer: 1024 * 1024,
+        });
+    }
+    catch (error) {
+        if (isNodeSystemError(error) && error.code === 'ENOENT') {
+            throw new Error('scc executable not found; install with mise install', { cause: error });
+        }
+        throw error;
+    }
+    return readFile(outputPath, 'utf8');
+}
+function formatViolation({ file, complexity }, limit) {
+    return `::error file=${file}::${file}: scc complexity ${complexity} exceeds ${limit}; simplify or split this file`;
+}
+function isNodeSystemError(error) {
+    return error instanceof Error && 'code' in error;
+}

package/dist/transient-retry/decision-evaluator.d.mts

@@ -14,5 +14,7 @@ export type DecisionResult = {
 };
 export interface EvaluateRulesOptions {
     afterRuleEvaluated?: (context: RetryContext, rule: RetryRule) => Promise<void> | void;
+    /** Defaults to `no-match`. Use `dispatch` when unmatched work should leave the retry engine. */
+    unmatchedDecision?: 'no-match' | 'dispatch';
 }
 export declare function decide(context: RetryContext, rules: readonly RetryRule[], options?: EvaluateRulesOptions): Promise<DecisionResult>;

package/dist/transient-retry/decision-evaluator.mjs

@@ -46,11 +46,17 @@ export async function decide(context, rules, options = {}) {
         if (rule.decision !== undefined && rule.decision !== 'rerun') {
             return { decision: rule.decision, matchedRule: rule.id };
         }
+        if (rule.retryTarget === undefined) {
+            return { decision: 'rerun', matchedRule: rule.id, targetName: '' };
+        }
         const resolved = resolveTargetName(rule.retryTarget, context);
         if (resolved.targetName === undefined) {
             return { decision: 'no-match', matchedRule: rule.id, reason: resolved.reason };
         }
         return { decision: 'rerun', matchedRule: rule.id, targetName: resolved.targetName };
     }
+    if (options.unmatchedDecision === 'dispatch') {
+        return { decision: 'dispatch', matchedRule: '' };
+    }
     return { decision: 'no-match', matchedRule: '', reason: 'no-rule' };
 }

package/dist/transient-retry/types.d.mts

@@ -9,7 +9,7 @@ export interface RetryContext {
     /** Targets that the provider resolved for this run. */
     targetNames?: ReadonlySet<string>;
 }
-export type RetryDecision = 'rerun' | 'ignore' | 'fresh-plan' | 'reap-lock';
+export type RetryDecision = 'rerun' | 'ignore' | 'fresh-plan' | 'reap-lock' | 'dispatch';
 export type RetryTarget = {
     targetName: string;
     targetFamily?: never;
@@ -30,8 +30,8 @@ interface RetryRuleBase {
 }
 export type RetryRule = (RetryRuleBase & {
     decision?: 'rerun';
-    /** Reruns must name a resolved target; full-provider reruns stay private. */
-    retryTarget: RetryTarget;
+    /** When omitted, the match is an untargeted provider-level rerun. */
+    retryTarget?: RetryTarget;
 }) | (RetryRuleBase & {
     decision: Exclude<RetryDecision, 'rerun'>;
     retryTarget?: never;

package/dist/workspace-gates/dependabot.d.mts

@@ -0,0 +1,3 @@
+import type { ResolvedWorkspaceGatesOptions } from './options.mts';
+import type { AnyObj } from './yaml-loader.mts';
+export declare function checkDependabotCrosslist(dependabot: AnyObj, errors: string[], options: ResolvedWorkspaceGatesOptions): void;

package/dist/workspace-gates/dependabot.mjs

@@ -0,0 +1,26 @@
+import picomatch from 'picomatch';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function checkDependabotCrosslist(dependabot, errors, options) {
+    const updates = Array.isArray(dependabot['updates']) ? dependabot['updates'] : [];
+    const npmUpdate = updates.find((entry) => isRecord(entry) && entry['package-ecosystem'] === 'npm' && entry['directory'] === '/');
+    if (!npmUpdate)
+        return;
+    const cooldown = npmUpdate['cooldown'];
+    const rawExclude = isRecord(cooldown) && Array.isArray(cooldown['exclude'])
+        ? cooldown['exclude']
+        : [];
+    for (const entry of rawExclude) {
+        if (typeof entry !== 'string') {
+            errors.push(`::error file=${options.dependabotPath}::${options.dependabotPath}: npm cooldown.exclude entry ${JSON.stringify(entry)} must be a string glob pattern`);
+        }
+    }
+    const patterns = rawExclude.filter((entry) => typeof entry === 'string');
+    const matchers = patterns.map((pattern) => picomatch(pattern));
+    for (const name of options.firstPartyNames) {
+        if (!matchers.some((match) => match(name))) {
+            errors.push(`::error file=${options.dependabotPath}::${options.dependabotPath}: "${name}" is in ${options.workspaceYamlPath} minimumReleaseAgeExclude but not covered by npm cooldown.exclude — add it or a matching glob`);
+        }
+    }
+}

package/dist/workspace-gates/exclude-registry.d.mts

@@ -0,0 +1,3 @@
+import type { ResolvedWorkspaceGatesOptions } from './options.mts';
+import type { AnyObj } from './yaml-loader.mts';
+export declare function checkExcludeRegistry(workspace: AnyObj, errors: string[], options: ResolvedWorkspaceGatesOptions): void;

package/dist/workspace-gates/exclude-registry.mjs

@@ -0,0 +1,30 @@
+export function checkExcludeRegistry(workspace, errors, options) {
+    const raw = workspace['minimumReleaseAgeExclude'];
+    const yamlEntries = Array.isArray(raw)
+        ? raw.filter((entry) => typeof entry === 'string')
+        : [];
+    const yamlNames = new Set();
+    for (const name of yamlEntries) {
+        if (yamlNames.has(name)) {
+            errors.push(`::error file=${options.workspaceYamlPath}::${options.workspaceYamlPath}: minimumReleaseAgeExclude duplicates "${name}"`);
+        }
+        yamlNames.add(name);
+    }
+    const registryNames = new Set(options.firstPartyNames);
+    const temporarySelectors = new Set(options.temporarySelectors);
+    for (const name of yamlNames) {
+        if (!registryNames.has(name) && !temporarySelectors.has(name)) {
+            errors.push(`::error file=${options.workspaceYamlPath}::${options.workspaceYamlPath}: minimumReleaseAgeExclude contains "${name}" which is not in a release-age exemption registry`);
+        }
+    }
+    for (const name of registryNames) {
+        if (!yamlNames.has(name)) {
+            errors.push(`::error file=${options.workspaceYamlPath}::${options.workspaceYamlPath}: first-party package "${name}" is in the ${options.firstPartyRegistryLabel} but missing from minimumReleaseAgeExclude`);
+        }
+    }
+    for (const selector of temporarySelectors) {
+        if (!yamlNames.has(selector)) {
+            errors.push(`::error file=${options.workspaceYamlPath}::${options.workspaceYamlPath}: temporary release-age exemption "${selector}" is in the ${options.firstPartyRegistryLabel} but missing from minimumReleaseAgeExclude`);
+        }
+    }
+}

package/dist/workspace-gates/first-party-graph.d.mts

@@ -0,0 +1,4 @@
+import type { SharedContext } from '../shared-context/index.mts';
+import type { ResolvedWorkspaceGatesOptions } from './options.mts';
+export declare function checkActiveFirstPartyGraph(ctx: SharedContext, errors: string[], options: ResolvedWorkspaceGatesOptions): Promise<void>;
+export declare function checkTemporaryReleaseAgeSelectorsInLockfile(ctx: SharedContext, errors: string[], temporarySelectors: readonly string[], lockfilePath: string): Promise<void>;

package/dist/workspace-gates/first-party-graph.mjs

@@ -0,0 +1,87 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { packageNameFromPnpmLockKey, pnpmLockPackageKeyMatchesSelector, } from '../pnpm-install/index.mjs';
+import { loadYaml } from './yaml-loader.mjs';
+const PACKAGE_DEPENDENCY_FIELDS = [
+    'dependencies',
+    'devDependencies',
+    'optionalDependencies',
+    'peerDependencies',
+];
+async function collectManifestDependencyNames(ctx, errors) {
+    const names = new Set();
+    const packageJsonFiles = ctx.trackedFiles.filter((file) => file === 'package.json' || file.endsWith('/package.json'));
+    for (const relPath of packageJsonFiles) {
+        let parsed;
+        try {
+            parsed = JSON.parse(await readFile(join(ctx.repoRoot, relPath), 'utf8'));
+        }
+        catch (error) {
+            const code = typeof error === 'object' && error !== null && 'code' in error
+                ? String(error.code)
+                : undefined;
+            const reason = code === undefined ? 'parse' : 'read';
+            errors.push(`::error file=${relPath}::${relPath}: failed to ${reason} package.json`);
+            continue;
+        }
+        if (typeof parsed !== 'object' || parsed === null)
+            continue;
+        for (const field of PACKAGE_DEPENDENCY_FIELDS) {
+            const dependencies = parsed[field];
+            if (typeof dependencies !== 'object' ||
+                dependencies === null ||
+                Array.isArray(dependencies)) {
+                continue;
+            }
+            for (const name of Object.keys(dependencies))
+                names.add(name);
+        }
+    }
+    return names;
+}
+async function collectLockfilePackageKeys(ctx, errors, lockfilePath) {
+    if (!ctx.trackedFileSet.has(lockfilePath))
+        return [];
+    const lockfile = await loadYaml(ctx.repoRoot, lockfilePath, errors);
+    const packages = lockfile?.['packages'];
+    if (typeof packages !== 'object' || packages === null || Array.isArray(packages))
+        return [];
+    return Object.keys(packages);
+}
+function collectLockfilePackageNames(packageKeys) {
+    const names = new Set();
+    for (const key of packageKeys) {
+        const packageName = packageNameFromPnpmLockKey(key);
+        if (packageName)
+            names.add(packageName);
+    }
+    return names;
+}
+export async function checkActiveFirstPartyGraph(ctx, errors, options) {
+    const registryNames = new Set(options.firstPartyNames);
+    const manifestDependencyNames = await collectManifestDependencyNames(ctx, errors);
+    const lockfilePackageKeys = await collectLockfilePackageKeys(ctx, errors, options.lockfilePath);
+    const lockfilePackageNames = collectLockfilePackageNames(lockfilePackageKeys);
+    const activeNames = new Set([...manifestDependencyNames, ...lockfilePackageNames]);
+    if (options.scopedPrefixes.length > 0) {
+        for (const name of activeNames) {
+            if (options.scopedPrefixes.some((prefix) => name.startsWith(prefix)) &&
+                !registryNames.has(name)) {
+                errors.push(`::error::active first-party package "${name}" appears in tracked package manifests or ${options.lockfilePath} but is missing from the ${options.firstPartyRegistryLabel}`);
+            }
+        }
+    }
+    for (const name of registryNames) {
+        if (!activeNames.has(name)) {
+            errors.push(`::error::first-party package "${name}" is registered but absent from tracked package manifests and ${options.lockfilePath}`);
+        }
+    }
+}
+export async function checkTemporaryReleaseAgeSelectorsInLockfile(ctx, errors, temporarySelectors, lockfilePath) {
+    const lockfilePackageKeys = await collectLockfilePackageKeys(ctx, errors, lockfilePath);
+    for (const selector of temporarySelectors) {
+        if (!lockfilePackageKeys.some((key) => pnpmLockPackageKeyMatchesSelector(key, selector))) {
+            errors.push(`::error file=${lockfilePath}::temporary release-age exemption "${selector}" is absent from tracked ${lockfilePath} packages`);
+        }
+    }
+}

package/dist/workspace-gates/index.d.mts

@@ -0,0 +1,2 @@
+export { checkWorkspaceGatesPolicy } from './policy.mts';
+export type { WorkspaceGatesOptions } from './options.mts';

package/dist/workspace-gates/index.mjs

@@ -0,0 +1 @@
+export { checkWorkspaceGatesPolicy } from './policy.mjs';

package/dist/workspace-gates/options.d.mts

@@ -0,0 +1,27 @@
+import { type ReleaseAgeExemptionGroup } from '../pnpm-install/index.mts';
+export interface WorkspaceGatesOptions {
+    firstPartyNames: readonly string[];
+    temporarySelectors?: readonly string[];
+    temporaryGroups?: ReadonlyArray<ReleaseAgeExemptionGroup>;
+    /** Empty or omitted skips scoped-prefix discovery. */
+    scopedPrefixes?: readonly string[];
+    /** Default `pnpm-workspace.yaml`. */
+    workspaceYamlPath?: string;
+    /** Default `.github/dependabot.yml`. */
+    dependabotPath?: string;
+    /** Default `pnpm-lock.yaml`. */
+    lockfilePath?: string;
+    /** Used in error messages. Default `first-party registry`. */
+    firstPartyRegistryLabel?: string;
+}
+export interface ResolvedWorkspaceGatesOptions {
+    firstPartyNames: readonly string[];
+    temporarySelectors: readonly string[];
+    scopedPrefixes: readonly string[];
+    workspaceYamlPath: string;
+    dependabotPath: string;
+    lockfilePath: string;
+    firstPartyRegistryLabel: string;
+}
+export declare function resolveWorkspaceGatesOptions(options: WorkspaceGatesOptions): ResolvedWorkspaceGatesOptions;
+export declare function shouldValidateTemporaryGroups(options: WorkspaceGatesOptions): boolean;

package/dist/workspace-gates/options.mjs

@@ -0,0 +1,15 @@
+import { flattenReleaseAgeSelectors, } from '../pnpm-install/index.mjs';
+export function resolveWorkspaceGatesOptions(options) {
+    return {
+        firstPartyNames: options.firstPartyNames,
+        temporarySelectors: options.temporarySelectors ?? flattenReleaseAgeSelectors(options.temporaryGroups ?? []),
+        scopedPrefixes: options.scopedPrefixes ?? [],
+        workspaceYamlPath: options.workspaceYamlPath ?? 'pnpm-workspace.yaml',
+        dependabotPath: options.dependabotPath ?? '.github/dependabot.yml',
+        lockfilePath: options.lockfilePath ?? 'pnpm-lock.yaml',
+        firstPartyRegistryLabel: options.firstPartyRegistryLabel ?? 'first-party registry',
+    };
+}
+export function shouldValidateTemporaryGroups(options) {
+    return options.temporaryGroups !== undefined && options.temporarySelectors === undefined;
+}

package/dist/workspace-gates/policy.d.mts

@@ -0,0 +1,5 @@
+import type { SharedContext } from '../shared-context/index.mts';
+import { type WorkspaceGatesOptions } from './options.mts';
+export declare function checkWorkspaceGatesPolicy(ctx: SharedContext, options: WorkspaceGatesOptions): Promise<{
+    errors: string[];
+}>;

package/dist/workspace-gates/policy.mjs

@@ -0,0 +1,27 @@
+import { validateReleaseAgeExemptionGroups } from '../pnpm-install/index.mjs';
+import { checkDependabotCrosslist } from './dependabot.mjs';
+import { checkExcludeRegistry } from './exclude-registry.mjs';
+import { checkActiveFirstPartyGraph, checkTemporaryReleaseAgeSelectorsInLockfile, } from './first-party-graph.mjs';
+import { resolveWorkspaceGatesOptions, shouldValidateTemporaryGroups, } from './options.mjs';
+import { loadYaml } from './yaml-loader.mjs';
+export async function checkWorkspaceGatesPolicy(ctx, options) {
+    const errors = [];
+    const resolved = resolveWorkspaceGatesOptions(options);
+    if (shouldValidateTemporaryGroups(options) && options.temporaryGroups !== undefined) {
+        for (const error of validateReleaseAgeExemptionGroups(options.temporaryGroups)) {
+            errors.push(`::error::${error}`);
+        }
+    }
+    const workspace = await loadYaml(ctx.repoRoot, resolved.workspaceYamlPath, errors);
+    if (!workspace)
+        return { errors };
+    checkExcludeRegistry(workspace, errors, resolved);
+    const [, , dependabot] = await Promise.all([
+        checkActiveFirstPartyGraph(ctx, errors, resolved),
+        checkTemporaryReleaseAgeSelectorsInLockfile(ctx, errors, resolved.temporarySelectors, resolved.lockfilePath),
+        loadYaml(ctx.repoRoot, resolved.dependabotPath, errors),
+    ]);
+    if (dependabot)
+        checkDependabotCrosslist(dependabot, errors, resolved);
+    return { errors };
+}

package/dist/workspace-gates/test-helpers.d.mts

@@ -0,0 +1,21 @@
+import type { SharedContext } from '../shared-context/index.mts';
+import type { WorkspaceGatesOptions } from './options.mts';
+export declare const FIRST_PARTY_NAMES: readonly ['acme-lib', '@acme/core'];
+export declare const SCOPED_PREFIXES: readonly ['@acme/'];
+export declare const TEMPORARY_SELECTOR = "demo-temporary-package@9.9.9";
+export declare function defaultOptions(overrides?: Partial<WorkspaceGatesOptions>): WorkspaceGatesOptions;
+export declare function stubCtx(repoRoot: string, trackedFiles: readonly string[]): SharedContext;
+export declare function buildWorkspaceYaml(names?: readonly string[]): string;
+export declare function buildDependabotYaml(patterns?: readonly string[]): string;
+export declare function buildPackageJson(names?: readonly string[]): string;
+export declare function buildPnpmLock(keys?: readonly string[]): string;
+export declare function makeTmpDir(testDirs: string[]): Promise<string>;
+export declare function writeTracked(repoRoot: string, files: Record<string, string>): Promise<string[]>;
+export declare function makeCompliantFixture(testDirs: string[], opts?: {
+    names?: readonly string[];
+    lockKeys?: readonly string[];
+    extraFiles?: Record<string, string>;
+}): Promise<{
+    dir: string;
+    files: string[];
+}>;

package/dist/workspace-gates/test-helpers.mjs

@@ -0,0 +1,69 @@
+import { mkdir, mkdtemp, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+export const FIRST_PARTY_NAMES = ['acme-lib', '@acme/core'];
+export const SCOPED_PREFIXES = ['@acme/'];
+export const TEMPORARY_SELECTOR = 'demo-temporary-package@9.9.9';
+export function defaultOptions(overrides = {}) {
+    return {
+        firstPartyNames: FIRST_PARTY_NAMES,
+        scopedPrefixes: SCOPED_PREFIXES,
+        ...overrides,
+    };
+}
+export function stubCtx(repoRoot, trackedFiles) {
+    return {
+        repoRoot,
+        isInsideGitRepo: true,
+        trackedFiles,
+        trackedFileSet: new Set(trackedFiles),
+    };
+}
+export function buildWorkspaceYaml(names = FIRST_PARTY_NAMES) {
+    return `minimumReleaseAgeExclude:\n${names.map((name) => `  - '${name}'`).join('\n')}\n`;
+}
+export function buildDependabotYaml(patterns = [...FIRST_PARTY_NAMES]) {
+    return [
+        'updates:',
+        "  - package-ecosystem: 'npm'",
+        "    directory: '/'",
+        '    cooldown:',
+        '      exclude:',
+        ...patterns.map((pattern) => `        - '${pattern}'`),
+        '',
+    ].join('\n');
+}
+export function buildPackageJson(names = FIRST_PARTY_NAMES) {
+    return `${JSON.stringify({ dependencies: Object.fromEntries(names.map((name) => [name, '^1.0.0'])) }, null, 2)}\n`;
+}
+export function buildPnpmLock(keys = ['acme-lib@1.0.0', '@acme/core@1.0.0']) {
+    const packages = keys.map((key) => `  '${key}':\n    resolution: {}\n`);
+    return `lockfileVersion: '9.0'\npackages:\n${packages.join('')}`;
+}
+export async function makeTmpDir(testDirs) {
+    const dir = await mkdtemp(join(tmpdir(), 'workspace-gates-'));
+    testDirs.push(dir);
+    return dir;
+}
+export async function writeTracked(repoRoot, files) {
+    const relPaths = [];
+    for (const [relPath, contents] of Object.entries(files)) {
+        const abs = join(repoRoot, relPath);
+        await mkdir(dirname(abs), { recursive: true });
+        await writeFile(abs, contents);
+        relPaths.push(relPath);
+    }
+    return relPaths;
+}
+export async function makeCompliantFixture(testDirs, opts) {
+    const names = opts?.names ?? FIRST_PARTY_NAMES;
+    const dir = await makeTmpDir(testDirs);
+    const files = await writeTracked(dir, {
+        'pnpm-workspace.yaml': buildWorkspaceYaml(names),
+        '.github/dependabot.yml': buildDependabotYaml(names),
+        'package.json': buildPackageJson(names),
+        'pnpm-lock.yaml': buildPnpmLock(opts?.lockKeys),
+        ...opts?.extraFiles,
+    });
+    return { dir, files };
+}

package/dist/workspace-gates/yaml-loader.d.mts

@@ -0,0 +1,2 @@
+export type AnyObj = Record<string, unknown>;
+export declare function loadYaml(repoRoot: string, relPath: string, errors: string[]): Promise<AnyObj | null>;

package/dist/workspace-gates/yaml-loader.mjs

@@ -0,0 +1,28 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { parse as load } from 'yaml';
+function isNodeError(error) {
+    return typeof error === 'object' && error !== null && 'code' in error;
+}
+export async function loadYaml(repoRoot, relPath, errors) {
+    let content;
+    try {
+        content = await readFile(join(repoRoot, relPath), 'utf8');
+    }
+    catch (error) {
+        if (!isNodeError(error) || error.code !== 'ENOENT') {
+            errors.push(`::error file=${relPath}::${relPath}: failed to read YAML`);
+        }
+        return null;
+    }
+    try {
+        const parsed = load(content);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        errors.push(`::error file=${relPath}::${relPath}: failed to parse YAML`);
+        return null;
+    }
+}

package/dist/workspace-glob.d.mts

@@ -0,0 +1 @@
+export declare function expandWorkspaceGlob(root: string, pattern: string): string[];

package/dist/workspace-glob.mjs

@@ -0,0 +1,46 @@
+import { readdirSync } from 'node:fs';
+import path from 'node:path';
+export function expandWorkspaceGlob(root, pattern) {
+    let currents = [root];
+    for (const part of pattern.split('/')) {
+        const next = [];
+        const star = part.indexOf('*');
+        for (const current of currents) {
+            if (star === -1) {
+                next.push(path.join(current, part));
+                continue;
+            }
+            if (part === '**') {
+                next.push(current, ...descendantDirs(current));
+                continue;
+            }
+            const suffix = part.slice(star + 1);
+            if (suffix.includes('*'))
+                continue;
+            const prefix = part.slice(0, star);
+            for (const entry of readDirs(current)) {
+                if (entry.name.startsWith(prefix) && entry.name.endsWith(suffix)) {
+                    next.push(path.join(current, entry.name));
+                }
+            }
+        }
+        currents = next;
+    }
+    return currents;
+}
+function descendantDirs(dir) {
+    const found = [];
+    for (const entry of readDirs(dir)) {
+        const child = path.join(dir, entry.name);
+        found.push(child, ...descendantDirs(child));
+    }
+    return found;
+}
+function readDirs(dir) {
+    try {
+        return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name !== 'node_modules' && entry.name !== '.git');
+    }
+    catch {
+        return [];
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.0.14",
+  "version": "0.0.16",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {
@@ -130,6 +130,46 @@
       "import": "./dist/http-link-pagination/index.mjs",
       "default": "./dist/http-link-pagination/index.mjs"
     },
+    "./coverage-transport": {
+      "types": "./dist/coverage-transport/index.d.mts",
+      "import": "./dist/coverage-transport/index.mjs",
+      "default": "./dist/coverage-transport/index.mjs"
+    },
+    "./pnpm-deploy": {
+      "types": "./dist/pnpm-deploy/index.d.mts",
+      "import": "./dist/pnpm-deploy/index.mjs",
+      "default": "./dist/pnpm-deploy/index.mjs"
+    },
+    "./dockerfile-parse": {
+      "types": "./dist/dockerfile-parse/index.d.mts",
+      "import": "./dist/dockerfile-parse/index.mjs",
+      "default": "./dist/dockerfile-parse/index.mjs"
+    },
+    "./scc-complexity": {
+      "types": "./dist/scc-complexity/index.d.mts",
+      "import": "./dist/scc-complexity/index.mjs",
+      "default": "./dist/scc-complexity/index.mjs"
+    },
+    "./ci-local": {
+      "types": "./dist/ci-local/index.d.mts",
+      "import": "./dist/ci-local/index.mjs",
+      "default": "./dist/ci-local/index.mjs"
+    },
+    "./gha-rate-limit": {
+      "types": "./dist/gha-rate-limit/index.d.mts",
+      "import": "./dist/gha-rate-limit/index.mjs",
+      "default": "./dist/gha-rate-limit/index.mjs"
+    },
+    "./gha-pr-checkpoint": {
+      "types": "./dist/gha-pr-checkpoint/index.d.mts",
+      "import": "./dist/gha-pr-checkpoint/index.mjs",
+      "default": "./dist/gha-pr-checkpoint/index.mjs"
+    },
+    "./workspace-gates": {
+      "types": "./dist/workspace-gates/index.d.mts",
+      "import": "./dist/workspace-gates/index.mjs",
+      "default": "./dist/workspace-gates/index.mjs"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
@@ -143,7 +183,9 @@
   "dependencies": {
     "csv-parse": "7.0.2",
     "csv-stringify": "6.8.2",
-    "picomatch": "4.0.5"
+    "dockerfile-ast": "0.7.1",
+    "picomatch": "4.0.5",
+    "yaml": "2.9.0"
   },
   "devDependencies": {
     "@types/picomatch": "^4.0.3"