vouchington-tooling 0.0.15 → 0.0.16

package/dist/gha-pr-checkpoint/index.mjs

@@ -0,0 +1,100 @@
+export const CHECKPOINT_MARKER = 'pr-checkpoint:v1';
+/**
+ * Anti-forgery predicate: a checkpoint HTML comment is plain text any PR commenter can paste,
+ * so `parseCheckpoint` alone proves shape, not provenance. This proves the comment itself was
+ * authored by the expected App identity.
+ */
+export function isTrustedCheckpointComment(comment, context) {
+    return (comment.user?.login === context.actor &&
+        comment.user?.type === (context.userType ?? 'Bot') &&
+        comment.performed_via_github_app?.slug === (context.appSlug ?? 'github-actions'));
+}
+export function renderCheckpoint(checkpoint, options = {}) {
+    const marker = options.marker ?? checkpoint.marker;
+    const payload = Buffer.from(JSON.stringify({ ...checkpoint, marker }), 'utf8').toString('base64url');
+    const session = checkpoint.sessionUrl
+        ? `[${checkpoint.sessionId}](${checkpoint.sessionUrl})`
+        : `\`${checkpoint.sessionId || 'pending'}\``;
+    return [
+        `👀 [View the automation workflow run](${checkpoint.runUrl}).`,
+        '',
+        `Status: \`${checkpoint.status}\` · Session: ${session}`,
+        '',
+        `<!-- ${marker} ${payload} -->`,
+    ].join('\n');
+}
+export function parseCheckpoint(body, options = {}) {
+    const marker = options.marker ?? CHECKPOINT_MARKER;
+    const match = body.match(new RegExp(`<!-- ${escapeRegExp(marker)} ([A-Za-z0-9_-]+) -->`, 'u'));
+    if (!match?.[1])
+        return undefined;
+    try {
+        return validateCheckpoint(JSON.parse(Buffer.from(match[1], 'base64url').toString('utf8')), options);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function validateCheckpoint(value, options = {}) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const checkpoint = value;
+    const marker = options.marker ?? CHECKPOINT_MARKER;
+    if (checkpoint.marker !== marker ||
+        !Number.isInteger(checkpoint.pr) ||
+        (checkpoint.triggerCommentId !== undefined && !Number.isInteger(checkpoint.triggerCommentId)) ||
+        typeof checkpoint.startSha !== 'string' ||
+        !/^[0-9a-f]{40}$/u.test(checkpoint.startSha) ||
+        typeof checkpoint.sessionStartSha !== 'string' ||
+        !/^[0-9a-f]{40}$/u.test(checkpoint.sessionStartSha) ||
+        typeof checkpoint.runId !== 'string' ||
+        !/^[0-9]+$/u.test(checkpoint.runId) ||
+        typeof checkpoint.resumeSourceRunId !== 'string' ||
+        (checkpoint.resumeSourceRunId !== '' && !/^[0-9]+$/u.test(checkpoint.resumeSourceRunId)) ||
+        typeof checkpoint.repository !== 'string' ||
+        typeof checkpoint.headRef !== 'string' ||
+        typeof checkpoint.runUrl !== 'string' ||
+        typeof checkpoint.actor !== 'string' ||
+        typeof checkpoint.sessionId !== 'string' ||
+        typeof checkpoint.createdAt !== 'string' ||
+        !Number.isFinite(Date.parse(checkpoint.createdAt)) ||
+        typeof checkpoint.updatedAt !== 'string' ||
+        !Number.isFinite(Date.parse(checkpoint.updatedAt)) ||
+        typeof checkpoint.status !== 'string' ||
+        ![
+            'queued',
+            'running',
+            'awaiting_verification',
+            'failed',
+            'deadline',
+            'unresumable',
+            'complete',
+        ].includes(checkpoint.status)) {
+        return undefined;
+    }
+    if (checkpoint.sessionId &&
+        options.sessionIdPattern &&
+        !matchesPattern(options.sessionIdPattern, checkpoint.sessionId)) {
+        return undefined;
+    }
+    if (checkpoint.sessionUrl !== undefined &&
+        (!URL.canParse(checkpoint.sessionUrl) || !checkpoint.sessionUrl.startsWith('https:'))) {
+        return undefined;
+    }
+    return checkpoint;
+}
+export function sortedCheckpointCandidates(comments, options = {}) {
+    return comments
+        .map((comment) => ({ comment, checkpoint: parseCheckpoint(comment.body ?? '', options) }))
+        .filter((candidate) => candidate.checkpoint !== undefined)
+        .toSorted((left, right) => {
+        const timestampOrder = String(right.comment.created_at ?? '').localeCompare(String(left.comment.created_at ?? ''));
+        return timestampOrder || right.comment.id - left.comment.id;
+    });
+}
+function matchesPattern(pattern, value) {
+    return new RegExp(pattern.source, pattern.flags.replaceAll(/[gy]/g, '')).test(value);
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}

package/dist/gha-rate-limit/index.d.mts

@@ -0,0 +1,15 @@
+export declare const MAX_RATE_LIMIT_WAIT_MS = 120000;
+export declare class GitHubRateLimitError extends Error {
+    readonly code: string;
+    readonly httpStatus?: number | undefined;
+    readonly retryAfter?: string | undefined;
+    readonly rateLimitRemaining?: string | undefined;
+    readonly rateLimitReset?: string | undefined;
+    constructor(code: string, message: string, httpStatus?: number, retryAfter?: string, rateLimitRemaining?: string, rateLimitReset?: string);
+}
+export declare function isRetryableCancellationError(error: unknown): boolean;
+export declare function rateLimitDelay(error: GitHubRateLimitError): number;
+export declare function isRateLimited(error: unknown): error is GitHubRateLimitError;
+export declare function reserveRateLimitDelay(used: {
+    milliseconds: number;
+}, delay: number): void;

package/dist/gha-rate-limit/index.mjs

@@ -0,0 +1,69 @@
+const MAX_DELAY_MS = 60_000;
+export const MAX_RATE_LIMIT_WAIT_MS = 120_000;
+export class GitHubRateLimitError extends Error {
+    code;
+    httpStatus;
+    retryAfter;
+    rateLimitRemaining;
+    rateLimitReset;
+    constructor(code, message, httpStatus, retryAfter, rateLimitRemaining, rateLimitReset) {
+        super(message);
+        this.code = code;
+        this.httpStatus = httpStatus;
+        this.retryAfter = retryAfter;
+        this.rateLimitRemaining = rateLimitRemaining;
+        this.rateLimitReset = rateLimitReset;
+        this.name = 'GitHubRateLimitError';
+    }
+}
+function invalid() {
+    throw new GitHubRateLimitError('INVALID_RESPONSE', 'GitHub rate-limit response is invalid');
+}
+function rateLimit403(error) {
+    return (error.httpStatus === 403 && (error.retryAfter !== undefined || error.rateLimitRemaining === '0'));
+}
+export function isRetryableCancellationError(error) {
+    return (error instanceof GitHubRateLimitError &&
+        (error.code === 'REQUEST_FAILED' ||
+            (error.code === 'HTTP_STATUS' &&
+                (error.httpStatus === 429 ||
+                    rateLimit403(error) ||
+                    ((error.httpStatus ?? 0) >= 500 && (error.httpStatus ?? 0) <= 599)))));
+}
+export function rateLimitDelay(error) {
+    if (error.retryAfter !== undefined) {
+        if (!/^\d+$/u.test(error.retryAfter))
+            invalid();
+        const milliseconds = Number(error.retryAfter) * 1000;
+        if (!Number.isSafeInteger(milliseconds) || milliseconds > MAX_DELAY_MS)
+            invalid();
+        return milliseconds;
+    }
+    if (error.rateLimitRemaining !== undefined && !/^\d+$/u.test(error.rateLimitRemaining))
+        invalid();
+    if (error.rateLimitRemaining !== '0') {
+        if (error.httpStatus !== 429)
+            invalid();
+        return MAX_DELAY_MS;
+    }
+    if (!error.rateLimitReset || !/^\d+$/u.test(error.rateLimitReset))
+        invalid();
+    const reset = Number(error.rateLimitReset);
+    if (!Number.isSafeInteger(reset))
+        invalid();
+    const milliseconds = Math.max(0, reset * 1000 - Date.now());
+    if (milliseconds > MAX_DELAY_MS)
+        invalid();
+    return milliseconds;
+}
+export function isRateLimited(error) {
+    return (error instanceof GitHubRateLimitError &&
+        error.code === 'HTTP_STATUS' &&
+        (error.httpStatus === 429 || rateLimit403(error)));
+}
+export function reserveRateLimitDelay(used, delay) {
+    if (used.milliseconds + delay > MAX_RATE_LIMIT_WAIT_MS) {
+        throw new GitHubRateLimitError('RATE_LIMIT_WAIT_EXHAUSTED', 'GitHub rate-limit wait budget is exhausted');
+    }
+    used.milliseconds += delay;
+}

package/dist/index.d.mts

@@ -36,3 +36,16 @@ export type { CommentableIndex, CommentableLine, LineKind, PayloadRequirement, R
 export { nextPageCursorFromLinkHeader, nextPageUrlFromLinkHeader, validatePaginationRequestUrl, } from './http-link-pagination/index.mts';
 export { cmdDownloadCoverage, cmdDownloadVitestBlobs, cmdUpload, mintPresignedControl, transportObjectKeys, } from './coverage-transport/index.mts';
 export type { ExpectedTransportIdentity, ObjectSigner, PresignIdentity, TransportControl, } from './coverage-transport/index.mts';
+export { EPOCH_PRUNED_AT, normalizeDeployedLayer, pruneDeployedRuntimeDeps, restoreDeployedWorkspacePackages, } from './pnpm-deploy/index.mts';
+export type { NormalizeDeployedLayerResult, PruneResult, RestoreWorkspacePackagesOptions, } from './pnpm-deploy/index.mts';
+export { parseDockerfilePrewarmStages, parseDockerfileRuntimeImages, } from './dockerfile-parse/index.mts';
+export type { DockerfilePrewarmStage, DockerfileRuntimeImage, ParseDockerfilePrewarmOptions, ParseDockerfileRuntimeImagesOptions, } from './dockerfile-parse/index.mts';
+export { buildSccArgs, checkSccComplexity, parseSccComplexityViolations, SCC_COMPLEXITY_LIMIT, } from './scc-complexity/index.mts';
+export type { SccComplexityOptions, SccComplexityViolation } from './scc-complexity/index.mts';
+export { assertWorkflowCommandDrift, parseCiLocalArgs, runCiLocal } from './ci-local/index.mts';
+export type { CiLocalCommand, CiLocalSpawn, CiLocalSpawnOptions, CiLocalSpawnResult, CiLocalTarget, RunCiLocalOptions, } from './ci-local/index.mts';
+export { GitHubRateLimitError, isRateLimited, isRetryableCancellationError, MAX_RATE_LIMIT_WAIT_MS, rateLimitDelay, reserveRateLimitDelay, } from './gha-rate-limit/index.mts';
+export { CHECKPOINT_MARKER, isTrustedCheckpointComment, parseCheckpoint, renderCheckpoint, sortedCheckpointCandidates, validateCheckpoint, } from './gha-pr-checkpoint/index.mts';
+export type { Checkpoint, CheckpointCodecOptions, GitHubComment, } from './gha-pr-checkpoint/index.mts';
+export { checkWorkspaceGatesPolicy } from './workspace-gates/index.mts';
+export type { WorkspaceGatesOptions } from './workspace-gates/index.mts';

package/dist/index.mjs

@@ -21,3 +21,10 @@ export { parseAstGrepRuleArgs, runAstGrepRule } from './ast-grep-rule/index.mjs'
 export { bodyOnlyReviewFallback, indexReviewFiles, MAX_REVIEW_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES, nearestReviewLine, parsePatchCommentable, parseReviewFilesJson, parseReviewPayload, readRegularReviewPayload, remapReviewComments, ReviewPayloadError, reviewCommentSubject, rewriteSnappedSuggestion, snapReviewNote, stageReviewPayload, writeStagedOutput, } from './gha-review-payload/index.mjs';
 export { nextPageCursorFromLinkHeader, nextPageUrlFromLinkHeader, validatePaginationRequestUrl, } from './http-link-pagination/index.mjs';
 export { cmdDownloadCoverage, cmdDownloadVitestBlobs, cmdUpload, mintPresignedControl, transportObjectKeys, } from './coverage-transport/index.mjs';
+export { EPOCH_PRUNED_AT, normalizeDeployedLayer, pruneDeployedRuntimeDeps, restoreDeployedWorkspacePackages, } from './pnpm-deploy/index.mjs';
+export { parseDockerfilePrewarmStages, parseDockerfileRuntimeImages, } from './dockerfile-parse/index.mjs';
+export { buildSccArgs, checkSccComplexity, parseSccComplexityViolations, SCC_COMPLEXITY_LIMIT, } from './scc-complexity/index.mjs';
+export { assertWorkflowCommandDrift, parseCiLocalArgs, runCiLocal } from './ci-local/index.mjs';
+export { GitHubRateLimitError, isRateLimited, isRetryableCancellationError, MAX_RATE_LIMIT_WAIT_MS, rateLimitDelay, reserveRateLimitDelay, } from './gha-rate-limit/index.mjs';
+export { CHECKPOINT_MARKER, isTrustedCheckpointComment, parseCheckpoint, renderCheckpoint, sortedCheckpointCandidates, validateCheckpoint, } from './gha-pr-checkpoint/index.mjs';
+export { checkWorkspaceGatesPolicy } from './workspace-gates/index.mjs';

package/dist/pnpm-deploy/index.d.mts

@@ -0,0 +1,6 @@
+export { pruneDeployedRuntimeDeps, runPruneDeployedRuntimeDepsCli } from './prune.mts';
+export type { PruneResult } from './prune.mts';
+export { EPOCH_PRUNED_AT, normalizeDeployedLayer, runNormalizeDeployedLayerCli, } from './normalize.mts';
+export type { NormalizeDeployedLayerResult } from './normalize.mts';
+export { restoreDeployedWorkspacePackages, runRestoreDeployedWorkspacePackagesCli, } from './restore.mts';
+export type { RestoreWorkspacePackagesOptions } from './restore.mts';

package/dist/pnpm-deploy/index.mjs

@@ -0,0 +1,3 @@
+export { pruneDeployedRuntimeDeps, runPruneDeployedRuntimeDepsCli } from './prune.mjs';
+export { EPOCH_PRUNED_AT, normalizeDeployedLayer, runNormalizeDeployedLayerCli, } from './normalize.mjs';
+export { restoreDeployedWorkspacePackages, runRestoreDeployedWorkspacePackagesCli, } from './restore.mjs';

package/dist/pnpm-deploy/normalize.d.mts

@@ -0,0 +1,15 @@
+export declare const EPOCH_PRUNED_AT = "Thu, 01 Jan 1970 00:00:00 GMT";
+export interface NormalizeDeployedLayerResult {
+    prunedAtPinned: boolean;
+    entriesTouched: number;
+}
+export declare function normalizeDeployedLayer(prodDir: string): NormalizeDeployedLayerResult;
+interface NormalizeCliOptions {
+    args: readonly string[];
+    env: NodeJS.ProcessEnv;
+    isMain: boolean;
+    normalize?: typeof normalizeDeployedLayer;
+    stdout: (message: string) => void;
+}
+export declare function runNormalizeDeployedLayerCli({ args, env, isMain, normalize, stdout, }: NormalizeCliOptions): void;
+export {};

package/dist/pnpm-deploy/normalize.mjs

@@ -0,0 +1,64 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export const EPOCH_PRUNED_AT = 'Thu, 01 Jan 1970 00:00:00 GMT';
+export function normalizeDeployedLayer(prodDir) {
+    return {
+        prunedAtPinned: pinPrunedAt(prodDir),
+        entriesTouched: clampTreeMtimes(prodDir),
+    };
+}
+function pinPrunedAt(prodDir) {
+    const modulesPath = path.join(prodDir, 'node_modules', '.modules.yaml');
+    if (!fs.existsSync(modulesPath)) {
+        throw new Error(`${modulesPath} is missing; expected pnpm deploy to write it`);
+    }
+    // pnpm 11.13.1 writeModulesManifest serializes this file with JSON.stringify
+    // despite the .yaml name. A pnpm bump that switches to YAML must update this parse.
+    const parsed = JSON.parse(fs.readFileSync(modulesPath, 'utf8'));
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`${modulesPath} is not a JSON object`);
+    }
+    const manifest = parsed;
+    manifest.prunedAt = EPOCH_PRUNED_AT;
+    fs.writeFileSync(modulesPath, `${JSON.stringify(manifest, null, 2)}\n`);
+    return true;
+}
+function clampTreeMtimes(root) {
+    let entriesTouched = 0;
+    function visit(entryPath, isDirectory) {
+        if (isDirectory) {
+            for (const entry of fs.readdirSync(entryPath, { withFileTypes: true })) {
+                visit(path.join(entryPath, entry.name), entry.isDirectory());
+            }
+        }
+        else {
+            const stats = fs.lstatSync(entryPath);
+            if (stats.isFile() && stats.nlink > 1) {
+                const copyPath = `${entryPath}.${process.pid}.copy`;
+                fs.copyFileSync(entryPath, copyPath);
+                fs.renameSync(copyPath, entryPath);
+            }
+        }
+        fs.lutimesSync(entryPath, 0, 0);
+        entriesTouched += 1;
+    }
+    visit(root, fs.lstatSync(root).isDirectory());
+    return entriesTouched;
+}
+function resolveCliProdDirs(args, env) {
+    if (args.length > 0)
+        return [...args];
+    const prodDir = env.PROD_DIR;
+    if (!prodDir)
+        throw new Error('PROD_DIR or a directory argument is required');
+    return [prodDir];
+}
+export function runNormalizeDeployedLayerCli({ args, env, isMain, normalize = normalizeDeployedLayer, stdout, }) {
+    if (!isMain)
+        return;
+    for (const prodDir of resolveCliProdDirs(args, env)) {
+        const result = normalize(prodDir);
+        const prunedAt = result.prunedAtPinned ? 'prunedAt pinned' : 'prunedAt absent';
+        stdout(`Normalized deployed layer at ${prodDir} (${prunedAt}, ${result.entriesTouched} entries)`);
+    }
+}

package/dist/pnpm-deploy/prune.d.mts

@@ -0,0 +1,14 @@
+export interface PruneResult {
+    bytesRemoved: number;
+    filesRemoved: number;
+}
+export declare function pruneDeployedRuntimeDeps(prodDir: string): PruneResult;
+interface PruneCliOptions {
+    args: readonly string[];
+    env: NodeJS.ProcessEnv;
+    isMain: boolean;
+    prune?: typeof pruneDeployedRuntimeDeps;
+    stdout: (message: string) => void;
+}
+export declare function runPruneDeployedRuntimeDepsCli({ args, env, isMain, prune, stdout, }: PruneCliOptions): void;
+export {};

package/dist/pnpm-deploy/prune.mjs

@@ -0,0 +1,48 @@
+import fs from 'node:fs';
+import path from 'node:path';
+const DECLARATION_SUFFIXES = ['.d.ts', '.d.mts', '.d.cts', '.d.ts.map', '.d.mts.map', '.d.cts.map'];
+function shouldPruneRuntimeDependencyFile(filePath) {
+    return (DECLARATION_SUFFIXES.some((suffix) => filePath.endsWith(suffix)) ||
+        filePath.endsWith('.tsbuildinfo'));
+}
+function pruneDirectory(dir) {
+    const result = { bytesRemoved: 0, filesRemoved: 0 };
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const entryPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            const child = pruneDirectory(entryPath);
+            result.bytesRemoved += child.bytesRemoved;
+            result.filesRemoved += child.filesRemoved;
+            continue;
+        }
+        if (!entry.isFile() || !shouldPruneRuntimeDependencyFile(entryPath))
+            continue;
+        const { size } = fs.statSync(entryPath);
+        fs.rmSync(entryPath, { force: true });
+        result.bytesRemoved += size;
+        result.filesRemoved += 1;
+    }
+    return result;
+}
+export function pruneDeployedRuntimeDeps(prodDir) {
+    const pnpmStore = path.join(prodDir, 'node_modules', '.pnpm');
+    if (!fs.existsSync(pnpmStore))
+        return { bytesRemoved: 0, filesRemoved: 0 };
+    return pruneDirectory(pnpmStore);
+}
+function resolveCliProdDirs(args, env) {
+    if (args.length > 0)
+        return [...args];
+    const prodDir = env.PROD_DIR;
+    if (!prodDir)
+        throw new Error('PROD_DIR or a directory argument is required');
+    return [prodDir];
+}
+export function runPruneDeployedRuntimeDepsCli({ args, env, isMain, prune = pruneDeployedRuntimeDeps, stdout, }) {
+    if (!isMain)
+        return;
+    for (const prodDir of resolveCliProdDirs(args, env)) {
+        const result = prune(prodDir);
+        stdout(`Pruned ${result.filesRemoved} runtime dependency artifact(s) from ${prodDir} (${result.bytesRemoved} bytes)`);
+    }
+}

package/dist/pnpm-deploy/restore.d.mts

@@ -0,0 +1,31 @@
+export interface RestoreWorkspacePackagesOptions {
+    backendDir?: string;
+    prodDir: string;
+    workspaceRoot?: string;
+}
+/**
+ * Node's --experimental-strip-types refuses to load TypeScript whose real path
+ * contains a node_modules segment, but pnpm deploy places workspace packages
+ * (shipped as TypeScript source) inside the virtual store at
+ * node_modules/.pnpm/<store-dir>/node_modules/<name>.
+ *
+ * Relocate every workspace-package copy outside node_modules while preserving
+ * pnpm's resolution topology, without enumerating dependencies:
+ *
+ * - move the content dir to workspace-packages/<store-dir>/<name>
+ * - leave a relative symlink at the original virtual-store location, so every
+ *   pnpm-created link (top-level node_modules entries, sibling links from other
+ *   store dirs) keeps resolving through it
+ * - add a node_modules backlink inside the moved dir pointing at the package's
+ *   original virtual-store sibling directory, so the package's own imports
+ *   resolve exactly as pnpm laid them out
+ */
+export declare function restoreDeployedWorkspacePackages({ backendDir, prodDir, workspaceRoot, }: RestoreWorkspacePackagesOptions): void;
+interface RestoreCliOptions {
+    args: readonly string[];
+    env: NodeJS.ProcessEnv;
+    isMain: boolean;
+    restore?: typeof restoreDeployedWorkspacePackages;
+}
+export declare function runRestoreDeployedWorkspacePackagesCli({ args, env, isMain, restore, }: RestoreCliOptions): void;
+export {};

package/dist/pnpm-deploy/restore.mjs

@@ -0,0 +1,109 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { expandWorkspaceGlob } from '../workspace-glob.mjs';
+function packagePath(packageName) {
+    return path.join(...packageName.split('/'));
+}
+function linkTarget(fromDir, toPath) {
+    return path.relative(fromDir, toPath);
+}
+function readWorkspacePackageNames(backendDir) {
+    const backendPackage = JSON.parse(fs.readFileSync(path.join(backendDir, 'package.json'), 'utf8'));
+    const workspaces = Array.isArray(backendPackage.workspaces) ? backendPackage.workspaces : [];
+    const names = new Set();
+    for (const workspace of workspaces.flatMap((pattern) => expandWorkspaceGlob(backendDir, pattern))) {
+        const packageJson = path.join(workspace, 'package.json');
+        if (!fs.existsSync(packageJson))
+            continue;
+        const { name } = JSON.parse(fs.readFileSync(packageJson, 'utf8'));
+        if (name)
+            names.add(name);
+    }
+    return names;
+}
+function mergeSibling(backlink, storeModules, sibling) {
+    const siblingLink = path.join(backlink, sibling);
+    const source = path.join(storeModules, sibling);
+    const existing = fs.lstatSync(siblingLink, { throwIfNoEntry: false });
+    if (!existing) {
+        fs.symlinkSync(linkTarget(backlink, source), siblingLink, 'dir');
+        return;
+    }
+    if (existing.isSymbolicLink() || !existing.isDirectory())
+        return;
+    const sourceStats = fs.statSync(source, { throwIfNoEntry: false });
+    if (!sourceStats?.isDirectory())
+        return;
+    for (const child of fs.readdirSync(source))
+        mergeSibling(siblingLink, source, child);
+}
+/**
+ * Node's --experimental-strip-types refuses to load TypeScript whose real path
+ * contains a node_modules segment, but pnpm deploy places workspace packages
+ * (shipped as TypeScript source) inside the virtual store at
+ * node_modules/.pnpm/<store-dir>/node_modules/<name>.
+ *
+ * Relocate every workspace-package copy outside node_modules while preserving
+ * pnpm's resolution topology, without enumerating dependencies:
+ *
+ * - move the content dir to workspace-packages/<store-dir>/<name>
+ * - leave a relative symlink at the original virtual-store location, so every
+ *   pnpm-created link (top-level node_modules entries, sibling links from other
+ *   store dirs) keeps resolving through it
+ * - add a node_modules backlink inside the moved dir pointing at the package's
+ *   original virtual-store sibling directory, so the package's own imports
+ *   resolve exactly as pnpm laid them out
+ */
+export function restoreDeployedWorkspacePackages({ backendDir, prodDir, workspaceRoot, }) {
+    if (!prodDir)
+        throw new Error('prodDir is required');
+    if (!backendDir)
+        throw new Error('backendDir is required');
+    const resolvedWorkspaceRoot = workspaceRoot ?? path.join(prodDir, 'workspace-packages');
+    const workspacePackageNames = readWorkspacePackageNames(backendDir);
+    const pnpmRoot = path.join(prodDir, 'node_modules', '.pnpm');
+    if (!fs.existsSync(pnpmRoot))
+        return;
+    for (const storeEntry of fs.readdirSync(pnpmRoot, { withFileTypes: true })) {
+        if (!storeEntry.isDirectory() || storeEntry.name === 'node_modules')
+            continue;
+        const storeModules = path.join(pnpmRoot, storeEntry.name, 'node_modules');
+        for (const name of workspacePackageNames) {
+            const contentDir = path.join(storeModules, packagePath(name));
+            const stats = fs.lstatSync(contentDir, { throwIfNoEntry: false });
+            if (!stats?.isDirectory())
+                continue;
+            const relocated = path.join(resolvedWorkspaceRoot, storeEntry.name, packagePath(name));
+            fs.rmSync(relocated, { recursive: true, force: true });
+            fs.mkdirSync(path.dirname(relocated), { recursive: true });
+            // copy+delete, not rename: renaming a directory out of a lower Docker
+            // overlayfs layer fails with EXDEV
+            fs.cpSync(contentDir, relocated, { recursive: true, verbatimSymlinks: true });
+            fs.rmSync(contentDir, { recursive: true, force: true });
+            fs.symlinkSync(linkTarget(path.dirname(contentDir), relocated), contentDir, 'dir');
+            const backlink = path.join(relocated, 'node_modules');
+            const backlinkStats = fs.lstatSync(backlink, { throwIfNoEntry: false });
+            if (!backlinkStats) {
+                fs.symlinkSync(linkTarget(relocated, storeModules), backlink, 'dir');
+            }
+            else if (backlinkStats.isDirectory()) {
+                // pnpm deploy leaves a real node_modules (containing .bin) inside some
+                // injected packages; merge sibling links into it instead of replacing it
+                for (const sibling of fs.readdirSync(storeModules)) {
+                    mergeSibling(backlink, storeModules, sibling);
+                }
+            }
+        }
+    }
+}
+export function runRestoreDeployedWorkspacePackagesCli({ args, env, isMain, restore = restoreDeployedWorkspacePackages, }) {
+    if (!isMain)
+        return;
+    const prodDir = args[0] ?? env.PROD_DIR;
+    const backendDir = args[1] ?? env.BACKEND_DIR;
+    if (!prodDir)
+        throw new Error('PROD_DIR or a directory argument is required');
+    if (!backendDir)
+        throw new Error('BACKEND_DIR or a backend directory argument is required');
+    restore({ prodDir, backendDir });
+}

package/dist/scc-complexity/index.d.mts

@@ -0,0 +1,19 @@
+import type { SharedContext } from '../shared-context/index.mts';
+export declare const SCC_COMPLEXITY_LIMIT = 50;
+export interface SccComplexityOptions {
+    limit?: number;
+    includeExt?: string;
+    excludeDir?: string;
+    notMatch?: string;
+    tmpdirPrefix?: string;
+    command?: string;
+}
+export interface SccComplexityViolation {
+    file: string;
+    complexity: number;
+}
+export declare function buildSccArgs(options?: SccComplexityOptions): string[];
+export declare function checkSccComplexity(ctx: SharedContext, options?: SccComplexityOptions, runScc?: (outputPath: string) => Promise<string>): Promise<{
+    errors: string[];
+}>;
+export declare function parseSccComplexityViolations(json: string, trackedFileSet: ReadonlySet<string>, limit?: number): SccComplexityViolation[];

package/dist/scc-complexity/index.mjs

@@ -0,0 +1,91 @@
+import { execFile } from 'node:child_process';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+export const SCC_COMPLEXITY_LIMIT = 50;
+const DEFAULT_INCLUDE_EXT = 'js,mts,jsx,ts,tsx';
+const DEFAULT_EXCLUDE_DIR = '.git,fixtures,__tests__,test-helpers';
+const DEFAULT_NOT_MATCH = String.raw `\.(test|spec)\.`;
+const DEFAULT_TMPDIR_PREFIX = 'scc-complexity-';
+export function buildSccArgs(options = {}) {
+    return [
+        '--format',
+        'json',
+        '--include-ext',
+        options.includeExt ?? DEFAULT_INCLUDE_EXT,
+        '--by-file',
+        '--sort',
+        'complexity',
+        '--exclude-dir',
+        options.excludeDir ?? DEFAULT_EXCLUDE_DIR,
+        '--not-match',
+        options.notMatch ?? DEFAULT_NOT_MATCH,
+        '--no-cocomo',
+    ];
+}
+export async function checkSccComplexity(ctx, options = {}, runScc) {
+    if (!ctx.isInsideGitRepo) {
+        return { errors: [`::error::${ctx.repoRoot} is not inside a git repository`] };
+    }
+    const dir = await mkdtemp(join(tmpdir(), options.tmpdirPrefix ?? DEFAULT_TMPDIR_PREFIX));
+    const outputPath = join(dir, 'scc.json');
+    const limit = options.limit ?? SCC_COMPLEXITY_LIMIT;
+    try {
+        const resolve = runScc ?? ((path) => runSccJson(ctx.repoRoot, path, options));
+        const json = await resolve(outputPath);
+        const violations = parseSccComplexityViolations(json, ctx.trackedFileSet, limit);
+        return { errors: violations.map((violation) => formatViolation(violation, limit)) };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { errors: [`::error::scc-complexity failed: ${message}`] };
+    }
+    finally {
+        await rm(dir, { force: true, recursive: true });
+    }
+}
+export function parseSccComplexityViolations(json, trackedFileSet, limit = SCC_COMPLEXITY_LIMIT) {
+    const parsed = JSON.parse(json);
+    if (!Array.isArray(parsed))
+        throw new Error('scc JSON output must be an array');
+    const violations = [];
+    for (const language of parsed) {
+        if (!Array.isArray(language.Files))
+            continue;
+        for (const file of language.Files) {
+            if (typeof file.Location !== 'string')
+                continue;
+            if (!trackedFileSet.has(file.Location))
+                continue;
+            if (typeof file.Complexity !== 'number')
+                continue;
+            if (file.Complexity <= limit)
+                continue;
+            violations.push({ file: file.Location, complexity: file.Complexity });
+        }
+    }
+    return violations.toSorted((a, b) => b.complexity - a.complexity || a.file.localeCompare(b.file));
+}
+async function runSccJson(repoRoot, outputPath, options) {
+    try {
+        await execFileAsync(options.command ?? 'scc', [...buildSccArgs(options), '--output', outputPath], {
+            cwd: repoRoot,
+            maxBuffer: 1024 * 1024,
+        });
+    }
+    catch (error) {
+        if (isNodeSystemError(error) && error.code === 'ENOENT') {
+            throw new Error('scc executable not found; install with mise install', { cause: error });
+        }
+        throw error;
+    }
+    return readFile(outputPath, 'utf8');
+}
+function formatViolation({ file, complexity }, limit) {
+    return `::error file=${file}::${file}: scc complexity ${complexity} exceeds ${limit}; simplify or split this file`;
+}
+function isNodeSystemError(error) {
+    return error instanceof Error && 'code' in error;
+}

package/dist/workspace-gates/dependabot.d.mts

@@ -0,0 +1,3 @@
+import type { ResolvedWorkspaceGatesOptions } from './options.mts';
+import type { AnyObj } from './yaml-loader.mts';
+export declare function checkDependabotCrosslist(dependabot: AnyObj, errors: string[], options: ResolvedWorkspaceGatesOptions): void;

package/dist/workspace-gates/dependabot.mjs

@@ -0,0 +1,26 @@
+import picomatch from 'picomatch';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function checkDependabotCrosslist(dependabot, errors, options) {
+    const updates = Array.isArray(dependabot['updates']) ? dependabot['updates'] : [];
+    const npmUpdate = updates.find((entry) => isRecord(entry) && entry['package-ecosystem'] === 'npm' && entry['directory'] === '/');
+    if (!npmUpdate)
+        return;
+    const cooldown = npmUpdate['cooldown'];
+    const rawExclude = isRecord(cooldown) && Array.isArray(cooldown['exclude'])
+        ? cooldown['exclude']
+        : [];
+    for (const entry of rawExclude) {
+        if (typeof entry !== 'string') {
+            errors.push(`::error file=${options.dependabotPath}::${options.dependabotPath}: npm cooldown.exclude entry ${JSON.stringify(entry)} must be a string glob pattern`);
+        }
+    }
+    const patterns = rawExclude.filter((entry) => typeof entry === 'string');
+    const matchers = patterns.map((pattern) => picomatch(pattern));
+    for (const name of options.firstPartyNames) {
+        if (!matchers.some((match) => match(name))) {
+            errors.push(`::error file=${options.dependabotPath}::${options.dependabotPath}: "${name}" is in ${options.workspaceYamlPath} minimumReleaseAgeExclude but not covered by npm cooldown.exclude — add it or a matching glob`);
+        }
+    }
+}