vouchington-tooling 0.0.15 → 0.0.17

package/dist/pnpm-deploy/restore.mjs

@@ -0,0 +1,109 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { expandWorkspaceGlob } from '../workspace-glob.mjs';
+function packagePath(packageName) {
+    return path.join(...packageName.split('/'));
+}
+function linkTarget(fromDir, toPath) {
+    return path.relative(fromDir, toPath);
+}
+function readWorkspacePackageNames(backendDir) {
+    const backendPackage = JSON.parse(fs.readFileSync(path.join(backendDir, 'package.json'), 'utf8'));
+    const workspaces = Array.isArray(backendPackage.workspaces) ? backendPackage.workspaces : [];
+    const names = new Set();
+    for (const workspace of workspaces.flatMap((pattern) => expandWorkspaceGlob(backendDir, pattern))) {
+        const packageJson = path.join(workspace, 'package.json');
+        if (!fs.existsSync(packageJson))
+            continue;
+        const { name } = JSON.parse(fs.readFileSync(packageJson, 'utf8'));
+        if (name)
+            names.add(name);
+    }
+    return names;
+}
+function mergeSibling(backlink, storeModules, sibling) {
+    const siblingLink = path.join(backlink, sibling);
+    const source = path.join(storeModules, sibling);
+    const existing = fs.lstatSync(siblingLink, { throwIfNoEntry: false });
+    if (!existing) {
+        fs.symlinkSync(linkTarget(backlink, source), siblingLink, 'dir');
+        return;
+    }
+    if (existing.isSymbolicLink() || !existing.isDirectory())
+        return;
+    const sourceStats = fs.statSync(source, { throwIfNoEntry: false });
+    if (!sourceStats?.isDirectory())
+        return;
+    for (const child of fs.readdirSync(source))
+        mergeSibling(siblingLink, source, child);
+}
+/**
+ * Node's --experimental-strip-types refuses to load TypeScript whose real path
+ * contains a node_modules segment, but pnpm deploy places workspace packages
+ * (shipped as TypeScript source) inside the virtual store at
+ * node_modules/.pnpm/<store-dir>/node_modules/<name>.
+ *
+ * Relocate every workspace-package copy outside node_modules while preserving
+ * pnpm's resolution topology, without enumerating dependencies:
+ *
+ * - move the content dir to workspace-packages/<store-dir>/<name>
+ * - leave a relative symlink at the original virtual-store location, so every
+ *   pnpm-created link (top-level node_modules entries, sibling links from other
+ *   store dirs) keeps resolving through it
+ * - add a node_modules backlink inside the moved dir pointing at the package's
+ *   original virtual-store sibling directory, so the package's own imports
+ *   resolve exactly as pnpm laid them out
+ */
+export function restoreDeployedWorkspacePackages({ backendDir, prodDir, workspaceRoot, }) {
+    if (!prodDir)
+        throw new Error('prodDir is required');
+    if (!backendDir)
+        throw new Error('backendDir is required');
+    const resolvedWorkspaceRoot = workspaceRoot ?? path.join(prodDir, 'workspace-packages');
+    const workspacePackageNames = readWorkspacePackageNames(backendDir);
+    const pnpmRoot = path.join(prodDir, 'node_modules', '.pnpm');
+    if (!fs.existsSync(pnpmRoot))
+        return;
+    for (const storeEntry of fs.readdirSync(pnpmRoot, { withFileTypes: true })) {
+        if (!storeEntry.isDirectory() || storeEntry.name === 'node_modules')
+            continue;
+        const storeModules = path.join(pnpmRoot, storeEntry.name, 'node_modules');
+        for (const name of workspacePackageNames) {
+            const contentDir = path.join(storeModules, packagePath(name));
+            const stats = fs.lstatSync(contentDir, { throwIfNoEntry: false });
+            if (!stats?.isDirectory())
+                continue;
+            const relocated = path.join(resolvedWorkspaceRoot, storeEntry.name, packagePath(name));
+            fs.rmSync(relocated, { recursive: true, force: true });
+            fs.mkdirSync(path.dirname(relocated), { recursive: true });
+            // copy+delete, not rename: renaming a directory out of a lower Docker
+            // overlayfs layer fails with EXDEV
+            fs.cpSync(contentDir, relocated, { recursive: true, verbatimSymlinks: true });
+            fs.rmSync(contentDir, { recursive: true, force: true });
+            fs.symlinkSync(linkTarget(path.dirname(contentDir), relocated), contentDir, 'dir');
+            const backlink = path.join(relocated, 'node_modules');
+            const backlinkStats = fs.lstatSync(backlink, { throwIfNoEntry: false });
+            if (!backlinkStats) {
+                fs.symlinkSync(linkTarget(relocated, storeModules), backlink, 'dir');
+            }
+            else if (backlinkStats.isDirectory()) {
+                // pnpm deploy leaves a real node_modules (containing .bin) inside some
+                // injected packages; merge sibling links into it instead of replacing it
+                for (const sibling of fs.readdirSync(storeModules)) {
+                    mergeSibling(backlink, storeModules, sibling);
+                }
+            }
+        }
+    }
+}
+export function runRestoreDeployedWorkspacePackagesCli({ args, env, isMain, restore = restoreDeployedWorkspacePackages, }) {
+    if (!isMain)
+        return;
+    const prodDir = args[0] ?? env.PROD_DIR;
+    const backendDir = args[1] ?? env.BACKEND_DIR;
+    if (!prodDir)
+        throw new Error('PROD_DIR or a directory argument is required');
+    if (!backendDir)
+        throw new Error('BACKEND_DIR or a backend directory argument is required');
+    restore({ prodDir, backendDir });
+}

package/dist/scc-complexity/index.d.mts

@@ -0,0 +1,19 @@
+import type { SharedContext } from '../shared-context/index.mts';
+export declare const SCC_COMPLEXITY_LIMIT = 50;
+export interface SccComplexityOptions {
+    limit?: number;
+    includeExt?: string;
+    excludeDir?: string;
+    notMatch?: string;
+    tmpdirPrefix?: string;
+    command?: string;
+}
+export interface SccComplexityViolation {
+    file: string;
+    complexity: number;
+}
+export declare function buildSccArgs(options?: SccComplexityOptions): string[];
+export declare function checkSccComplexity(ctx: SharedContext, options?: SccComplexityOptions, runScc?: (outputPath: string) => Promise<string>): Promise<{
+    errors: string[];
+}>;
+export declare function parseSccComplexityViolations(json: string, trackedFileSet: ReadonlySet<string>, limit?: number): SccComplexityViolation[];

package/dist/scc-complexity/index.mjs

@@ -0,0 +1,91 @@
+import { execFile } from 'node:child_process';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+export const SCC_COMPLEXITY_LIMIT = 50;
+const DEFAULT_INCLUDE_EXT = 'js,mts,jsx,ts,tsx';
+const DEFAULT_EXCLUDE_DIR = '.git,fixtures,__tests__,test-helpers';
+const DEFAULT_NOT_MATCH = String.raw `\.(test|spec)\.`;
+const DEFAULT_TMPDIR_PREFIX = 'scc-complexity-';
+export function buildSccArgs(options = {}) {
+    return [
+        '--format',
+        'json',
+        '--include-ext',
+        options.includeExt ?? DEFAULT_INCLUDE_EXT,
+        '--by-file',
+        '--sort',
+        'complexity',
+        '--exclude-dir',
+        options.excludeDir ?? DEFAULT_EXCLUDE_DIR,
+        '--not-match',
+        options.notMatch ?? DEFAULT_NOT_MATCH,
+        '--no-cocomo',
+    ];
+}
+export async function checkSccComplexity(ctx, options = {}, runScc) {
+    if (!ctx.isInsideGitRepo) {
+        return { errors: [`::error::${ctx.repoRoot} is not inside a git repository`] };
+    }
+    const dir = await mkdtemp(join(tmpdir(), options.tmpdirPrefix ?? DEFAULT_TMPDIR_PREFIX));
+    const outputPath = join(dir, 'scc.json');
+    const limit = options.limit ?? SCC_COMPLEXITY_LIMIT;
+    try {
+        const resolve = runScc ?? ((path) => runSccJson(ctx.repoRoot, path, options));
+        const json = await resolve(outputPath);
+        const violations = parseSccComplexityViolations(json, ctx.trackedFileSet, limit);
+        return { errors: violations.map((violation) => formatViolation(violation, limit)) };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { errors: [`::error::scc-complexity failed: ${message}`] };
+    }
+    finally {
+        await rm(dir, { force: true, recursive: true });
+    }
+}
+export function parseSccComplexityViolations(json, trackedFileSet, limit = SCC_COMPLEXITY_LIMIT) {
+    const parsed = JSON.parse(json);
+    if (!Array.isArray(parsed))
+        throw new Error('scc JSON output must be an array');
+    const violations = [];
+    for (const language of parsed) {
+        if (!Array.isArray(language.Files))
+            continue;
+        for (const file of language.Files) {
+            if (typeof file.Location !== 'string')
+                continue;
+            if (!trackedFileSet.has(file.Location))
+                continue;
+            if (typeof file.Complexity !== 'number')
+                continue;
+            if (file.Complexity <= limit)
+                continue;
+            violations.push({ file: file.Location, complexity: file.Complexity });
+        }
+    }
+    return violations.toSorted((a, b) => b.complexity - a.complexity || a.file.localeCompare(b.file));
+}
+async function runSccJson(repoRoot, outputPath, options) {
+    try {
+        await execFileAsync(options.command ?? 'scc', [...buildSccArgs(options), '--output', outputPath], {
+            cwd: repoRoot,
+            maxBuffer: 1024 * 1024,
+        });
+    }
+    catch (error) {
+        if (isNodeSystemError(error) && error.code === 'ENOENT') {
+            throw new Error('scc executable not found; install with mise install', { cause: error });
+        }
+        throw error;
+    }
+    return readFile(outputPath, 'utf8');
+}
+function formatViolation({ file, complexity }, limit) {
+    return `::error file=${file}::${file}: scc complexity ${complexity} exceeds ${limit}; simplify or split this file`;
+}
+function isNodeSystemError(error) {
+    return error instanceof Error && 'code' in error;
+}

package/dist/swift-resolved-pin-delta/index.d.mts

@@ -0,0 +1,18 @@
+export type ResolvedPin = {
+    identity?: string;
+    kind?: string;
+    location?: string;
+    state?: {
+        revision?: string;
+        version?: string;
+    };
+};
+export type ResolvedDocument = {
+    originHash?: string;
+    pins?: ResolvedPin[];
+    version?: number;
+};
+export type ValidateResolvedPinDeltaOptions = {
+    requiredIdentity?: string;
+};
+export declare function validateResolvedPinDelta(trustedResolved: ResolvedDocument, candidateResolved: ResolvedDocument, options?: ValidateResolvedPinDeltaOptions): void;

package/dist/swift-resolved-pin-delta/index.mjs

@@ -0,0 +1,63 @@
+function isExactSemver(value) {
+    const match = value?.match(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?<prerelease>[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/);
+    return Boolean(match &&
+        !match.groups?.prerelease
+            ?.split('.')
+            .some((identifier) => /^\d+$/.test(identifier) && identifier.length > 1 && identifier[0] === '0'));
+}
+function exactPins(resolved) {
+    if (!Array.isArray(resolved.pins))
+        throw new Error('Package.resolved must contain pins');
+    const pins = new Map();
+    for (const pin of resolved.pins) {
+        const state = pin.state;
+        if (!pin.identity?.match(/^[a-z0-9][a-z0-9.-]*$/) ||
+            pin.kind !== 'remoteSourceControl' ||
+            !pin.location?.match(/^https:\/\/[^\s]+$/) ||
+            !state?.revision?.match(/^[a-f0-9]{40}$/) ||
+            !isExactSemver(state.version) ||
+            Object.keys(pin).toSorted().join(',') !== 'identity,kind,location,state' ||
+            Object.keys(state).toSorted().join(',') !== 'revision,version') {
+            throw new Error('Package.resolved pins must remain fully specified exact pins');
+        }
+        if (pins.has(pin.identity)) {
+            throw new Error('Package.resolved must contain unique pin identities');
+        }
+        pins.set(pin.identity, pin);
+    }
+    return pins;
+}
+function canonicalPin(pin) {
+    return JSON.stringify({
+        identity: pin.identity,
+        kind: pin.kind,
+        location: pin.location,
+        state: { revision: pin.state.revision, version: pin.state.version },
+    });
+}
+export function validateResolvedPinDelta(trustedResolved, candidateResolved, options = {}) {
+    const requiredIdentity = options.requiredIdentity ?? 'skip';
+    if (trustedResolved.version !== 3 ||
+        candidateResolved.version !== 3 ||
+        !candidateResolved.originHash?.match(/^[a-f0-9]{64}$/)) {
+        throw new Error('Package.resolved must remain a version 3 lock with an origin hash');
+    }
+    const trustedPins = exactPins(trustedResolved);
+    const candidatePins = exactPins(candidateResolved);
+    const trustedRequired = trustedPins.get(requiredIdentity);
+    const candidateRequired = candidatePins.get(requiredIdentity);
+    if (!trustedRequired ||
+        !candidateRequired ||
+        trustedRequired.kind !== candidateRequired.kind ||
+        trustedRequired.location !== candidateRequired.location) {
+        throw new Error(`Package.resolved must keep the trusted ${requiredIdentity} source`);
+    }
+    for (const [identity, trustedPin] of trustedPins) {
+        if (identity === requiredIdentity)
+            continue;
+        const candidatePin = candidatePins.get(identity);
+        if (!candidatePin || canonicalPin(candidatePin) !== canonicalPin(trustedPin)) {
+            throw new Error(`Package.resolved must keep every trusted non-${requiredIdentity} pin unchanged`);
+        }
+    }
+}

package/dist/swift-semantic-equal/cli.d.mts

@@ -0,0 +1,2 @@
+import { execFileSync } from 'node:child_process';
+export declare function runSwiftSemanticEqualCli(args: readonly string[], gitShow?: typeof execFileSync): number;

package/dist/swift-semantic-equal/cli.mjs

@@ -0,0 +1,26 @@
+import { execFileSync } from 'node:child_process';
+import { normalizeSwiftSource } from './normalize.mjs';
+export function runSwiftSemanticEqualCli(args, gitShow = execFileSync) {
+    const [base, head, file] = args;
+    if (!base || !head || !file || args.length !== 3 || !file.endsWith('.swift')) {
+        return 1;
+    }
+    try {
+        const baseSource = gitShow('git', ['show', `${base}:${file}`], {
+            encoding: 'utf8',
+            maxBuffer: 64 * 1024 * 1024,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const headSource = gitShow('git', ['show', `${head}:${file}`], {
+            encoding: 'utf8',
+            maxBuffer: 64 * 1024 * 1024,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return normalizeSwiftSource(String(baseSource)) === normalizeSwiftSource(String(headSource))
+            ? 0
+            : 1;
+    }
+    catch {
+        return 1;
+    }
+}

package/dist/swift-semantic-equal/index.d.mts

@@ -0,0 +1 @@
+export { normalizeSwiftSource } from './normalize.mts';

package/dist/swift-semantic-equal/index.mjs

@@ -0,0 +1 @@
+export { normalizeSwiftSource } from './normalize.mjs';

package/dist/swift-semantic-equal/normalize.d.mts

@@ -0,0 +1 @@
+export declare function normalizeSwiftSource(source: string): string;

package/dist/swift-semantic-equal/normalize.mjs

@@ -0,0 +1,108 @@
+export function normalizeSwiftSource(source) {
+    let normalized = '';
+    let index = 0;
+    while (index < source.length) {
+        const char = source[index];
+        if (char === undefined || /\s/u.test(char)) {
+            index += 1;
+            continue;
+        }
+        if (source.startsWith('//', index)) {
+            index = skipLineComment(source, index);
+            continue;
+        }
+        if (source.startsWith('/*', index)) {
+            index = skipBlockComment(source, index);
+            continue;
+        }
+        const hashCount = countLeadingHashes(source, index);
+        const afterHashes = source[index + hashCount];
+        if (afterHashes === '"') {
+            const literal = readSwiftStringLiteral(source, index, hashCount);
+            if (literal) {
+                normalized += literal.text;
+                index = literal.end;
+                continue;
+            }
+        }
+        if (afterHashes === '/') {
+            const literal = readSwiftRegexLiteral(source, index, hashCount, normalized);
+            if (literal) {
+                normalized += literal.text;
+                index = literal.end;
+                continue;
+            }
+        }
+        normalized += char;
+        index += 1;
+    }
+    return normalized;
+}
+function countLeadingHashes(source, start) {
+    let count = 0;
+    while (source[start + count] === '#')
+        count += 1;
+    return count;
+}
+function skipLineComment(source, start) {
+    const end = source.indexOf('\n', start + 2);
+    return end === -1 ? source.length : end + 1;
+}
+function skipBlockComment(source, start) {
+    let depth = 1;
+    let index = start + 2;
+    while (index < source.length && depth > 0) {
+        if (source.startsWith('/*', index)) {
+            depth += 1;
+            index += 2;
+        }
+        else if (source.startsWith('*/', index)) {
+            depth -= 1;
+            index += 2;
+        }
+        else {
+            index += 1;
+        }
+    }
+    return index;
+}
+function readSwiftStringLiteral(source, start, hashCount) {
+    const openingQuote = start + hashCount;
+    const isTripleQuoted = source.startsWith('"""', openingQuote);
+    const openerLength = hashCount + (isTripleQuoted ? 3 : 1);
+    const closer = `${isTripleQuoted ? '"""' : '"'}${'#'.repeat(hashCount)}`;
+    let index = start + openerLength;
+    while (index < source.length) {
+        if (!isTripleQuoted && hashCount === 0 && source[index] === '\\') {
+            index += 2;
+            continue;
+        }
+        if (source.startsWith(closer, index)) {
+            return { end: index + closer.length, text: source.slice(start, index + closer.length) };
+        }
+        index += 1;
+    }
+    return null;
+}
+function readSwiftRegexLiteral(source, start, hashCount, normalizedPrefix) {
+    if (hashCount === 0 && !canStartBareRegex(normalizedPrefix))
+        return null;
+    const closer = `/${'#'.repeat(hashCount)}`;
+    let index = start + hashCount + 1;
+    while (index < source.length) {
+        if (hashCount === 0 && source[index] === '\\') {
+            index += 2;
+            continue;
+        }
+        if (source.startsWith(closer, index)) {
+            return { end: index + closer.length, text: source.slice(start, index + closer.length) };
+        }
+        index += 1;
+    }
+    return null;
+}
+function canStartBareRegex(normalizedPrefix) {
+    if (normalizedPrefix.length === 0)
+        return true;
+    return /[({[=,:;!&|?]/u.test(normalizedPrefix.at(-1));
+}

package/dist/swift-source-offset/index.d.mts

@@ -0,0 +1,2 @@
+export declare function isSwiftCodeOffset(source: string, offset: number): boolean;
+export declare function parseUniqueSwiftBinaryTargetChecksum(source: string, targetName: string, expectedUrl: string): string | undefined;

package/dist/swift-source-offset/index.mjs

@@ -0,0 +1,68 @@
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+export function isSwiftCodeOffset(source, offset) {
+    let blockCommentDepth = 0;
+    let escaped = false;
+    let inLineComment = false;
+    let inMultilineString = false;
+    let inString = false;
+    for (let index = 0; index < offset; index += 1) {
+        const character = source[index];
+        const pair = source.slice(index, index + 2);
+        const triple = source.slice(index, index + 3);
+        if (inLineComment) {
+            if (character === '\n')
+                inLineComment = false;
+            continue;
+        }
+        if (blockCommentDepth > 0) {
+            if (pair === '/*') {
+                blockCommentDepth += 1;
+                index += 1;
+            }
+            else if (pair === '*/') {
+                blockCommentDepth -= 1;
+                index += 1;
+            }
+            continue;
+        }
+        if (inMultilineString) {
+            if (triple === '"""') {
+                inMultilineString = false;
+                index += 2;
+            }
+            continue;
+        }
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (character === '\\')
+                escaped = true;
+            else if (character === '"')
+                inString = false;
+            continue;
+        }
+        if (pair === '//') {
+            inLineComment = true;
+            index += 1;
+        }
+        else if (pair === '/*') {
+            blockCommentDepth = 1;
+            index += 1;
+        }
+        else if (triple === '"""') {
+            inMultilineString = true;
+            index += 2;
+        }
+        else if (character === '"') {
+            inString = true;
+        }
+    }
+    return !inLineComment && blockCommentDepth === 0 && !inMultilineString && !inString;
+}
+export function parseUniqueSwiftBinaryTargetChecksum(source, targetName, expectedUrl) {
+    const expression = new RegExp(`^\\s*package\\.targets\\s*\\+=\\s*\\[\\s*\\.binaryTarget\\(\\s*name:\\s*"${escapeRegExp(targetName)}"\\s*,\\s*url:\\s*"${escapeRegExp(expectedUrl)}"\\s*,\\s*checksum:\\s*"(?<checksum>[a-f0-9]{64})"\\s*\\)\\s*\\]\\s*$`, 'gm');
+    const matches = [...source.matchAll(expression)].filter((match) => match.index !== undefined && isSwiftCodeOffset(source, match.index));
+    return matches.length === 1 ? matches[0]?.groups?.checksum : undefined;
+}

package/dist/workspace-gates/dependabot.d.mts

@@ -0,0 +1,3 @@
+import type { ResolvedWorkspaceGatesOptions } from './options.mts';
+import type { AnyObj } from './yaml-loader.mts';
+export declare function checkDependabotCrosslist(dependabot: AnyObj, errors: string[], options: ResolvedWorkspaceGatesOptions): void;

package/dist/workspace-gates/dependabot.mjs

@@ -0,0 +1,26 @@
+import picomatch from 'picomatch';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function checkDependabotCrosslist(dependabot, errors, options) {
+    const updates = Array.isArray(dependabot['updates']) ? dependabot['updates'] : [];
+    const npmUpdate = updates.find((entry) => isRecord(entry) && entry['package-ecosystem'] === 'npm' && entry['directory'] === '/');
+    if (!npmUpdate)
+        return;
+    const cooldown = npmUpdate['cooldown'];
+    const rawExclude = isRecord(cooldown) && Array.isArray(cooldown['exclude'])
+        ? cooldown['exclude']
+        : [];
+    for (const entry of rawExclude) {
+        if (typeof entry !== 'string') {
+            errors.push(`::error file=${options.dependabotPath}::${options.dependabotPath}: npm cooldown.exclude entry ${JSON.stringify(entry)} must be a string glob pattern`);
+        }
+    }
+    const patterns = rawExclude.filter((entry) => typeof entry === 'string');
+    const matchers = patterns.map((pattern) => picomatch(pattern));
+    for (const name of options.firstPartyNames) {
+        if (!matchers.some((match) => match(name))) {
+            errors.push(`::error file=${options.dependabotPath}::${options.dependabotPath}: "${name}" is in ${options.workspaceYamlPath} minimumReleaseAgeExclude but not covered by npm cooldown.exclude — add it or a matching glob`);
+        }
+    }
+}

package/dist/workspace-gates/exclude-registry.d.mts

@@ -0,0 +1,3 @@
+import type { ResolvedWorkspaceGatesOptions } from './options.mts';
+import type { AnyObj } from './yaml-loader.mts';
+export declare function checkExcludeRegistry(workspace: AnyObj, errors: string[], options: ResolvedWorkspaceGatesOptions): void;

package/dist/workspace-gates/exclude-registry.mjs

@@ -0,0 +1,30 @@
+export function checkExcludeRegistry(workspace, errors, options) {
+    const raw = workspace['minimumReleaseAgeExclude'];
+    const yamlEntries = Array.isArray(raw)
+        ? raw.filter((entry) => typeof entry === 'string')
+        : [];
+    const yamlNames = new Set();
+    for (const name of yamlEntries) {
+        if (yamlNames.has(name)) {
+            errors.push(`::error file=${options.workspaceYamlPath}::${options.workspaceYamlPath}: minimumReleaseAgeExclude duplicates "${name}"`);
+        }
+        yamlNames.add(name);
+    }
+    const registryNames = new Set(options.firstPartyNames);
+    const temporarySelectors = new Set(options.temporarySelectors);
+    for (const name of yamlNames) {
+        if (!registryNames.has(name) && !temporarySelectors.has(name)) {
+            errors.push(`::error file=${options.workspaceYamlPath}::${options.workspaceYamlPath}: minimumReleaseAgeExclude contains "${name}" which is not in a release-age exemption registry`);
+        }
+    }
+    for (const name of registryNames) {
+        if (!yamlNames.has(name)) {
+            errors.push(`::error file=${options.workspaceYamlPath}::${options.workspaceYamlPath}: first-party package "${name}" is in the ${options.firstPartyRegistryLabel} but missing from minimumReleaseAgeExclude`);
+        }
+    }
+    for (const selector of temporarySelectors) {
+        if (!yamlNames.has(selector)) {
+            errors.push(`::error file=${options.workspaceYamlPath}::${options.workspaceYamlPath}: temporary release-age exemption "${selector}" is in the ${options.firstPartyRegistryLabel} but missing from minimumReleaseAgeExclude`);
+        }
+    }
+}

package/dist/workspace-gates/first-party-graph.d.mts

@@ -0,0 +1,4 @@
+import type { SharedContext } from '../shared-context/index.mts';
+import type { ResolvedWorkspaceGatesOptions } from './options.mts';
+export declare function checkActiveFirstPartyGraph(ctx: SharedContext, errors: string[], options: ResolvedWorkspaceGatesOptions): Promise<void>;
+export declare function checkTemporaryReleaseAgeSelectorsInLockfile(ctx: SharedContext, errors: string[], temporarySelectors: readonly string[], lockfilePath: string): Promise<void>;