vouchington-tooling 0.11.0 → 0.11.2

package/dist/pnpm-install/metadata.mjs

@@ -47,7 +47,7 @@ function runtimePlatformIdentity() {
         platform: process.platform,
     });
 }
-export async function persistentMetadataFingerprintV4(runCapture) {
+export async function persistentMetadataFingerprintV5(runCapture) {
     const workspaces = (await listWorkspaces(runCapture)).toSorted((left, right) => left.path.localeCompare(right.path));
     const pnpmVersion = await runCapture(['--version']);
     if (pnpmVersion.code !== 0)
@@ -73,16 +73,14 @@ export async function persistentMetadataFingerprintV4(runCapture) {
 function validStamp(value) {
     if (typeof value !== 'object' || value === null)
         return false;
+    // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish the candidate stamp type before complete field validation
     const stamp = value;
-    return (stamp.version === 4 &&
+    return (stamp.version === 5 &&
         typeof stamp.lastInvocationInstallScripts === 'boolean' &&
-        typeof stamp.scriptsEnabledInstallSucceeded === 'boolean' &&
+        typeof stamp.scriptsEnabledInstallVerified === 'boolean' &&
         typeof stamp.provenance === 'object' &&
         stamp.provenance !== null &&
-        componentNames.every((name) => typeof stamp.provenance?.[name] === 'string') &&
-        (stamp.pendingDependencyBuilds === undefined ||
-            (Array.isArray(stamp.pendingDependencyBuilds) &&
-                stamp.pendingDependencyBuilds.every((id) => typeof id === 'string'))));
+        componentNames.every((name) => typeof stamp.provenance?.[name] === 'string'));
 }
 async function readPersistentMetadataState() {
     try {
@@ -97,11 +95,7 @@ async function readPersistentMetadataState() {
             : { kind: 'unsafe' };
     }
 }
-async function readPersistentMetadataStamp() {
-    const state = await readPersistentMetadataState();
-    return state.kind === 'stamp' ? state.stamp : undefined;
-}
-export async function persistentMetadataStatusV4(provenance) {
+export async function persistentMetadataStatusV5(provenance) {
     const state = await readPersistentMetadataState();
     if (state.kind === 'missing')
         return { kind: 'absent' };
@@ -114,23 +108,15 @@ export async function persistentMetadataStatusV4(provenance) {
         : {
             kind: 'matching',
             lastInvocationInstallScripts: stamp.lastInvocationInstallScripts,
-            pendingDependencyBuilds: stamp.pendingDependencyBuilds ?? [],
-            scriptsEnabledInstallSucceeded: stamp.scriptsEnabledInstallSucceeded,
+            scriptsEnabledInstallVerified: stamp.scriptsEnabledInstallVerified,
         };
 }
-export async function writePersistentMetadataStampV4(provenance, installScripts, resetScriptsEnabledCapability, pendingDependencyBuilds) {
-    const existing = await readPersistentMetadataStamp();
-    const existingMatches = existing && componentNames.every((name) => existing.provenance[name] === provenance[name]);
+export async function writePersistentMetadataStampV5(provenance, installScripts, scriptsEnabledInstallVerified) {
     const stamp = {
         lastInvocationInstallScripts: installScripts,
-        pendingDependencyBuilds: (pendingDependencyBuilds ??
-            (existingMatches ? existing.pendingDependencyBuilds : undefined) ??
-            []).toSorted(),
         provenance,
-        scriptsEnabledInstallSucceeded: installScripts ||
-            (!resetScriptsEnabledCapability &&
-                Boolean(existingMatches && existing.scriptsEnabledInstallSucceeded)),
-        version: 4,
+        scriptsEnabledInstallVerified,
+        version: 5,
     };
     const stampPath = persistentMetadataStampPath();
     const directory = path.dirname(stampPath);

package/dist/pnpm-install/pending-builds.d.mts

@@ -1,18 +1,10 @@
-export type PendingBuilds = {
-    kind: 'known';
-    ids: Set<string>;
+export type PendingBuildState = {
+    kind: 'clear';
 } | {
-    kind: 'unknown';
-};
-export type PendingBuildDelta = {
-    kind: 'unknown';
+    ids: string[];
+    kind: 'pending';
 } | {
-    kind: 'known';
-    dependencyIds: string[];
-    workspaceIds: string[];
+    kind: 'unknown';
 };
-export declare function pendingBuilds(): Promise<PendingBuilds>;
+export declare function pendingBuilds(): Promise<PendingBuildState>;
 export declare function buildLedgersAllowNativeRepair(): Promise<boolean>;
-export declare function validDependencyBuildIds(ids: [string, ...string[]]): Promise<[string, ...string[]] | undefined>;
-export declare function clearPendingDependencyBuilds(ids: string[]): Promise<boolean>;
-export declare function pendingBuildDelta(before: PendingBuilds, after: PendingBuilds): Promise<PendingBuildDelta>;

package/dist/pnpm-install/pending-builds.mjs

@@ -1,104 +1,36 @@
-import { readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { parse, stringify } from 'yaml';
-export async function pendingBuilds() {
-    try {
-        const value = parse(await readFile(path.join(process.cwd(), 'node_modules', '.modules.yaml'), 'utf8'));
-        if (typeof value !== 'object' || value === null || Array.isArray(value))
-            return { kind: 'unknown' };
-        const pending = value.pendingBuilds ?? [];
-        if (!Array.isArray(pending) || !pending.every((id) => typeof id === 'string'))
-            return { kind: 'unknown' };
-        return { kind: 'known', ids: new Set(pending) };
-    }
-    catch {
-        return { kind: 'unknown' };
-    }
-}
-export async function buildLedgersAllowNativeRepair() {
+import { parse } from 'yaml';
+async function buildLedgers() {
     try {
         const value = parse(await readFile(path.join(process.cwd(), 'node_modules', '.modules.yaml'), 'utf8'));
         if (typeof value !== 'object' || value === null || Array.isArray(value))
-            return false;
-        const record = value;
-        const ignored = record.ignoredBuilds;
-        const pending = record.pendingBuilds ?? [];
-        return (Array.isArray(ignored) &&
-            ignored.length === 0 &&
-            Array.isArray(pending) &&
-            pending.length === 0);
-    }
-    catch {
-        return false;
-    }
-}
-async function lockfileDependencyIds() {
-    try {
-        const lockfile = parse(await readFile(path.join(process.cwd(), 'pnpm-lock.yaml'), 'utf8'));
-        if (typeof lockfile !== 'object' || lockfile === null || !('packages' in lockfile))
             return undefined;
-        const packages = lockfile.packages;
-        if (typeof packages !== 'object' || packages === null || Array.isArray(packages))
+        // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- validate the parsed YAML object before reading its fields
+        const record = value;
+        const ignored = Object.hasOwn(record, 'ignoredBuilds') ? record.ignoredBuilds : undefined;
+        const pending = Object.hasOwn(record, 'pendingBuilds') ? record.pendingBuilds : [];
+        if ((ignored !== undefined &&
+            (!Array.isArray(ignored) || !ignored.every((id) => typeof id === 'string'))) ||
+            !Array.isArray(pending) ||
+            !pending.every((id) => typeof id === 'string'))
             return undefined;
-        return new Set(Object.keys(packages));
+        return {
+            ignoredBuilds: ignored,
+            pendingBuilds: pending.length === 0 ? { kind: 'clear' } : { ids: pending.toSorted(), kind: 'pending' },
+        };
     }
     catch {
         return undefined;
     }
 }
-export async function validDependencyBuildIds(ids) {
-    const packages = await lockfileDependencyIds();
-    if (!packages || !ids.every((id) => packages.has(id)))
-        return undefined;
-    const [first, ...remaining] = ids.toSorted();
-    return [first, ...remaining];
-}
-export async function clearPendingDependencyBuilds(ids) {
-    const filename = path.join(process.cwd(), 'node_modules', '.modules.yaml');
-    try {
-        const value = parse(await readFile(filename, 'utf8'));
-        if (typeof value !== 'object' || value === null || Array.isArray(value))
-            return false;
-        const record = value;
-        if (!Array.isArray(record.pendingBuilds) ||
-            !record.pendingBuilds.every((id) => typeof id === 'string'))
-            return false;
-        const ignored = record.ignoredBuilds ?? [];
-        if (!Array.isArray(ignored) ||
-            !ignored.every((id) => typeof id === 'string') ||
-            ids.some((id) => ignored.includes(id)))
-            return false;
-        record.pendingBuilds = record.pendingBuilds.filter((id) => !ids.includes(id));
-        const temporary = `${filename}.${process.pid}.tmp`;
-        try {
-            await writeFile(temporary, stringify(record));
-            await rename(temporary, filename);
-        }
-        finally {
-            await rm(temporary, { force: true });
-        }
-        return true;
-    }
-    catch {
-        return false;
-    }
+export async function pendingBuilds() {
+    return (await buildLedgers())?.pendingBuilds ?? { kind: 'unknown' };
 }
-export async function pendingBuildDelta(before, after) {
-    if (before.kind !== 'known' || after.kind !== 'known')
-        return { kind: 'unknown' };
-    const packages = await lockfileDependencyIds();
-    if (!packages)
-        return { kind: 'unknown' };
-    const dependencyIds = [];
-    const workspaceIds = [];
-    for (const id of after.ids) {
-        if (before.ids.has(id))
-            continue;
-        (packages.has(id) ? dependencyIds : workspaceIds).push(id);
-    }
-    return {
-        kind: 'known',
-        dependencyIds: dependencyIds.toSorted(),
-        workspaceIds: workspaceIds.toSorted(),
-    };
+export async function buildLedgersAllowNativeRepair() {
+    const ledgers = await buildLedgers();
+    return (ledgers !== undefined &&
+        ledgers.ignoredBuilds !== undefined &&
+        ledgers.ignoredBuilds.length === 0 &&
+        ledgers.pendingBuilds.kind === 'clear');
 }

package/dist/pnpm-install/pnpm-install-fake-pnpm.test-helpers.mjs

@@ -29,18 +29,32 @@ if [ "\${PNPM_FAIL_RELEASE_AGE_CALL:-0}" = "$calls" ]; then
   exit 1
 fi
 if [ -n "\${PNPM_SLEEP_SECONDS:-}" ]; then sleep "$PNPM_SLEEP_SECONDS"; fi
-if [ -n "\${PNPM_PENDING_BUILDS:-}" ]; then
+if [ "\${PNPM_INVALID_PENDING_BUILDS:-0}" = 1 ]; then
+  mkdir -p "$PNPM_NODE_MODULES"
+  printf 'pendingBuilds: invalid\n' > "$PNPM_NODE_MODULES/.modules.yaml"
+elif [ -n "\${PNPM_PENDING_BUILDS:-}" ]; then
   mkdir -p "$PNPM_NODE_MODULES"
   printf 'pendingBuilds: [%s]\\n' "$PNPM_PENDING_BUILDS" > "$PNPM_NODE_MODULES/.modules.yaml"
+elif [ ! -f "$PNPM_NODE_MODULES/.modules.yaml" ]; then
+  mkdir -p "$PNPM_NODE_MODULES"
+  printf 'pendingBuilds: []\\n' > "$PNPM_NODE_MODULES/.modules.yaml"
 fi
 case " $* " in
   *' rebuild '*)
+    if [ "\${PNPM_REPAIR_NATIVE_ON_REBUILD:-0}" = 1 ]; then
+      cp "$PNPM_NATIVE_REPLACEMENT" "$PNPM_NATIVE_ADDON"
+    fi
     if [ "\${PNPM_REBUILD_INVALID_LEDGER:-0}" = 1 ]; then
       printf 'pendingBuilds: invalid\n' > "$PNPM_NODE_MODULES/.modules.yaml"
+    else
+      printf 'pendingBuilds: []\n' > "$PNPM_NODE_MODULES/.modules.yaml"
     fi
     if [ "\${PNPM_REBUILD_BREAK_LINK:-0}" = 1 ]; then rm -f "$PNPM_DEPENDENCY_LINK"; fi
     ;;
   *' --force '*)
+    if [ -z "\${PNPM_PENDING_BUILDS:-}" ]; then
+      printf 'pendingBuilds: []\n' > "$PNPM_NODE_MODULES/.modules.yaml"
+    fi
     if [ "\${PNPM_DELETE_NATIVE:-0}" = 1 ]; then
       rm -f "$PNPM_NATIVE_ADDON"
     elif [ "\${PNPM_REPAIR_NATIVE:-0}" = 1 ]; then

package/dist/pnpm-install/runner.mjs

@@ -1,10 +1,10 @@
-import { persistentDependencyTreeIsCold, persistentMetadataFingerprintV4, persistentMetadataStatusV4, writePersistentMetadataStampV4, } from './metadata.mjs';
+import { persistentDependencyTreeIsCold, persistentMetadataFingerprintV5, persistentMetadataStatusV5, writePersistentMetadataStampV5, } from './metadata.mjs';
 import { runPnpm } from './exec.mjs';
 import { mismatchedNativeBinaries } from './native-health.mjs';
 // oxfmt-ignore
-import { clearPendingDependencyBuilds, pendingBuildDelta, pendingBuilds, validDependencyBuildIds } from './pending-builds.mjs';
+import { pendingBuilds } from './pending-builds.mjs';
 // oxfmt-ignore
-import { install, reconcileOrFail, repairIsolatedNativeMismatch, withScriptPolicy } from './install-operations.mjs';
+import { finalizePendingBuilds, install, reconcileOrFail, repairIsolatedNativeMismatch, withScriptPolicy } from './install-operations.mjs';
 // oxfmt-ignore
 import { baseInstallArgs, findWorkspaceLinkMismatches, logWorkspaceLinkMismatches } from './support.mjs';
 import { persistentInstallTransition, persistentProvenanceDiagnostic } from './transition.mjs';
@@ -14,33 +14,30 @@ async function persistent(options) {
     if (options.ephemeralWorkspaces.trim())
         fail('ephemeral-workspaces is only valid for ephemeral runners');
     const runCapture = (args) => runPnpm(args, options, true);
-    const fingerprint = await persistentMetadataFingerprintV4(runCapture);
-    const provenance = await persistentMetadataStatusV4(fingerprint);
+    const fingerprint = await persistentMetadataFingerprintV5(runCapture);
+    const provenance = await persistentMetadataStatusV5(fingerprint);
+    const pendingBefore = await pendingBuilds();
     const mismatchedNatives = await mismatchedNativeBinaries();
     const nativesMatch = mismatchedNatives.length === 0;
     const repairedNativeMismatch = !nativesMatch &&
         provenance.kind === 'matching' &&
         (await repairIsolatedNativeMismatch(options, runCapture, mismatchedNatives));
     if (repairedNativeMismatch) {
+        const pendingAfterRepair = await finalizePendingBuilds(options, runCapture, 'native health reconciliation');
         console.warn('persistent optional native binaries do not match this runtime; reconciled');
         console.warn(persistentProvenanceDiagnostic(provenance, options.installScripts, nativesMatch, {
             action: 'reconcile',
             reason: 'native-health-mismatch',
         }));
-        await writePersistentMetadataStampV4(fingerprint, options.installScripts, true, []);
+        await writePersistentMetadataStampV5(fingerprint, options.installScripts, options.installScripts || persistentStampRemainsVerified(provenance, pendingAfterRepair));
         return 'persistent native health reconciled';
     }
     const provisionalTransition = persistentInstallTransition(provenance, options.installScripts);
-    let transition = nativesMatch
-        ? provisionalTransition
-        : { action: 'reconcile', reason: 'native-health-mismatch' };
-    if (transition.action === 'upgrade-dependencies') {
-        const ids = await validDependencyBuildIds(transition.pendingDependencyBuilds);
-        if (!ids)
-            transition = { action: 'upgrade-scripts', reason: 'invalid-pending-dependency-builds' };
-        else
-            transition = { ...transition, pendingDependencyBuilds: ids };
-    }
+    const transition = !nativesMatch
+        ? { action: 'reconcile', reason: 'native-health-mismatch' }
+        : provenance.kind !== 'matching' || pendingBefore.kind === 'clear'
+            ? provisionalTransition
+            : { action: 'reconcile', reason: 'pending-build-ledger-unverified' };
     const provenanceOk = provenance.kind === 'matching' && transition.action !== 'reconcile' && nativesMatch;
     const cold = !provenanceOk && (await persistentDependencyTreeIsCold());
     if (!provenanceOk && !cold) {
@@ -51,54 +48,19 @@ async function persistent(options) {
         console.warn(provenance.kind === 'matching' && !nativesMatch
             ? 'persistent optional native binaries do not match this runtime; reconciling'
             : 'persistent dependency metadata provenance is missing or changed; reconciling');
-        await reconcileOrFail(options, runCapture);
-        await writePersistentMetadataStampV4(fingerprint, options.installScripts, true, []);
+        await reconcileOrFail(options);
+        const pendingAfterReconcile = await finalizePendingBuilds(options, runCapture, 'persistent reconciliation');
+        await writePersistentMetadataStampV5(fingerprint, options.installScripts, options.installScripts || persistentStampRemainsVerified(provenance, pendingAfterReconcile));
         return 'persistent metadata reconciled';
     }
     if (provenance.kind === 'absent')
         console.warn('persistent dependency tree is absent; installing cold');
-    const pendingBefore = transition.action === 'ordinary' && !options.installScripts ? await pendingBuilds() : undefined;
-    await install(withScriptPolicy([...baseInstallArgs], transition.action.startsWith('upgrade-') ? false : options.installScripts), options, 'ordinary persistent install');
+    await install(withScriptPolicy([...baseInstallArgs], options.installScripts), options, 'ordinary persistent install');
     const stale = await findWorkspaceLinkMismatches(runCapture);
     if (stale.length === 0) {
-        if (transition.action.startsWith('upgrade-')) {
-            const pendingDependencyBuilds = transition.action === 'upgrade-dependencies'
-                ? transition.pendingDependencyBuilds
-                : undefined;
-            const rebuild = pendingDependencyBuilds === undefined
-                ? ['rebuild', '--pending', '--recursive']
-                : ['rebuild', '--recursive', '--', ...pendingDependencyBuilds];
-            await install(rebuild, options, 'pending scripts rebuild');
-            const rebuiltStale = await findWorkspaceLinkMismatches(runCapture);
-            if (rebuiltStale.length > 0) {
-                logWorkspaceLinkMismatches(rebuiltStale);
-                await reconcileOrFail(options, runCapture);
-                console.warn(persistentProvenanceDiagnostic(provenance, options.installScripts, nativesMatch, {
-                    action: 'reconcile',
-                    reason: 'workspace-links-stale-after-rebuild',
-                }));
-                await writePersistentMetadataStampV4(fingerprint, options.installScripts, true, []);
-                return 'persistent reconciled';
-            }
-            if (pendingDependencyBuilds !== undefined &&
-                !(await clearPendingDependencyBuilds(pendingDependencyBuilds)))
-                fail('dependency rebuild completed but pending build ledger could not be updated safely');
-        }
+        const pendingAfterInstall = await finalizePendingBuilds(options, runCapture, 'persistent install');
         console.warn(persistentProvenanceDiagnostic(provenance, options.installScripts, nativesMatch, transition));
-        const pendingAfter = pendingBefore ? await pendingBuilds() : undefined;
-        const delta = pendingBefore && pendingAfter
-            ? await pendingBuildDelta(pendingBefore, pendingAfter)
-            : undefined;
-        const unsafePending = delta?.kind === 'unknown' || Boolean(delta?.workspaceIds.length);
-        const pendingDependencyBuilds = transition.action.startsWith('upgrade-') || unsafePending
-            ? []
-            : [
-                ...new Set([
-                    ...(provenance.kind === 'matching' ? provenance.pendingDependencyBuilds : []),
-                    ...(delta?.kind === 'known' ? delta.dependencyIds : []),
-                ]),
-            ].toSorted();
-        await writePersistentMetadataStampV4(fingerprint, options.installScripts, unsafePending, pendingDependencyBuilds);
+        await writePersistentMetadataStampV5(fingerprint, options.installScripts, options.installScripts || persistentStampRemainsVerified(provenance, pendingAfterInstall));
         return provenance.kind === 'absent' ? 'persistent cold' : 'persistent ordinary';
     }
     logWorkspaceLinkMismatches(stale);
@@ -106,10 +68,16 @@ async function persistent(options) {
         action: 'reconcile',
         reason: 'workspace-links-stale',
     }));
-    await reconcileOrFail(options, runCapture);
-    await writePersistentMetadataStampV4(fingerprint, options.installScripts, true, []);
+    await reconcileOrFail(options);
+    const pendingAfterReconcile = await finalizePendingBuilds(options, runCapture, 'persistent reconciliation');
+    await writePersistentMetadataStampV5(fingerprint, options.installScripts, options.installScripts || persistentStampRemainsVerified(provenance, pendingAfterReconcile));
     return 'persistent reconciled';
 }
+function persistentStampRemainsVerified(provenance, pending) {
+    return (provenance.kind === 'matching' &&
+        provenance.scriptsEnabledInstallVerified &&
+        pending.kind === 'clear');
+}
 function isUnbracedPathClosureSelector(selector) {
     return /^\.{0,2}\//.test(selector) && selector.endsWith('...') && !selector.startsWith('{');
 }

package/dist/pnpm-install/transition.d.mts

@@ -6,17 +6,12 @@ export type ProvenanceStatus = {
 } | {
     kind: 'matching';
     lastInvocationInstallScripts: boolean;
-    pendingDependencyBuilds: string[];
-    scriptsEnabledInstallSucceeded: boolean;
+    scriptsEnabledInstallVerified: boolean;
 } | {
     kind: 'unsafe';
 };
 export type PersistentInstallTransition = {
-    action: 'ordinary' | 'reconcile' | 'upgrade-scripts';
-    reason: string;
-} | {
-    action: 'upgrade-dependencies';
-    pendingDependencyBuilds: [string, ...string[]];
+    action: 'ordinary' | 'reconcile';
     reason: string;
 };
 export declare function persistentInstallTransition(provenance: ProvenanceStatus, installScripts: boolean): PersistentInstallTransition;

package/dist/pnpm-install/transition.mjs

@@ -2,15 +2,8 @@
 // evidence that this structural tree has already completed a scripts-enabled install.
 export function persistentInstallTransition(provenance, installScripts) {
     if (provenance.kind === 'matching') {
-        if (installScripts && !provenance.scriptsEnabledInstallSucceeded)
-            return { action: 'upgrade-scripts', reason: 'pending-scripts-rebuild' };
-        const [firstPendingDependencyBuild, ...remainingPendingDependencyBuilds] = provenance.pendingDependencyBuilds;
-        if (installScripts && firstPendingDependencyBuild !== undefined)
-            return {
-                action: 'upgrade-dependencies',
-                pendingDependencyBuilds: [firstPendingDependencyBuild, ...remainingPendingDependencyBuilds],
-                reason: 'pending-dependency-rebuild',
-            };
+        if (installScripts && !provenance.scriptsEnabledInstallVerified)
+            return { action: 'reconcile', reason: 'scripts-enabled-install-unverified' };
         return { action: 'ordinary', reason: 'matching-structural-provenance' };
     }
     if (provenance.kind === 'absent')
@@ -26,9 +19,8 @@ export function persistentProvenanceDiagnostic(provenance, installScripts, nativ
         changedComponents: provenance.kind === 'changed' ? provenance.components : [],
         event: 'pnpm-install-persistent-provenance',
         installScripts,
-        scriptsEnabledInstallSucceeded: provenance.kind === 'matching' ? provenance.scriptsEnabledInstallSucceeded : false,
+        scriptsEnabledInstallVerified: provenance.kind === 'matching' ? provenance.scriptsEnabledInstallVerified : false,
         lastInvocationInstallScripts: provenance.kind === 'matching' ? provenance.lastInvocationInstallScripts : null,
-        pendingDependencyBuildCount: provenance.kind === 'matching' ? provenance.pendingDependencyBuilds.length : 0,
         nativeBinariesMatchRuntime,
         reason: transition.reason,
         state: provenance.kind,

package/dist/runner-port-policy/index.mjs

@@ -33,6 +33,7 @@ export function validateRunnerPortPolicy(parsedPolicy, policyUrl) {
     if (typeof parsedPolicy !== 'object' || parsedPolicy === null || Array.isArray(parsedPolicy)) {
         throwInvalidPolicy(policyUrl);
     }
+    // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish a record view after validating the untrusted policy object
     const policy = parsedPolicy;
     const requiredKeys = [
         'reservedPortStart',
@@ -45,6 +46,7 @@ export function validateRunnerPortPolicy(parsedPolicy, policyUrl) {
         requiredKeys.some((key) => !Number.isInteger(policy[key]))) {
         throwInvalidPolicy(policyUrl);
     }
+    // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- retain the validated policy type after the complete key and value checks
     const validatedPolicy = policy;
     const { reservedPortStart: start, reservedPortEnd: end, portsPerRunner, minimumRunnerSlot, maximumRunnerSlot, } = validatedPolicy;
     if (start < 1 ||

package/dist/session-friction/log.mjs

@@ -30,6 +30,7 @@ function logPath(sessionId, directory) {
 function validEvent(value) {
     if (!value || typeof value !== 'object')
         return false;
+    // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish a record view after the runtime object check
     const record = value;
     return ((record.kind === 'sandbox-escalation' || record.kind === 'sandbox-failure') &&
         isSafeAuditText(record.timestamp) &&

package/dist/skill-discovery/manifest.mjs

@@ -71,12 +71,14 @@ async function validateManifestEntries(root, entries) {
 function isManifest(value) {
     if (value === null || typeof value !== 'object')
         return false;
+    // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish the candidate schema type after the runtime object check
     const manifest = value;
     return manifest.version === 1 && Array.isArray(manifest.skills) && manifest.skills.every(isEntry);
 }
 function isEntry(value) {
     if (value === null || typeof value !== 'object')
         return false;
+    // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish the candidate schema type after the runtime object check
     const entry = value;
     return ([entry.name, entry.plugin, entry.pluginVersion, entry.path].every((field) => typeof field === 'string' && field.length > 0) &&
         (entry.prerequisites === undefined ||

package/dist/sql-ast/constraint-do-block.mjs

@@ -33,6 +33,7 @@ export function processAlterTableStmt(statement, baseOffset, result, trackConstr
         if (!constraint)
             continue;
         if (constraint.contype === 'CONSTR_FOREIGN') {
+            // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- isolate the generated AST type escape at the foreign-key adapter boundary
             const constraintRecord = constraint;
             result.foreignKeys.push(foreignKeyFromConstraint(constraintRecord, tableName, fkAttrNames(constraintRecord), baseOffset));
         }

package/dist/sql-ast/drop-index.mjs

@@ -9,6 +9,7 @@ export function extractDropIndexMetadata(content) {
         if (!node || !('DropStmt' in node) || node.DropStmt.removeType !== 'OBJECT_INDEX')
             continue;
         for (const object of node.DropStmt.objects ?? []) {
+            // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish an unknown boundary before runtime shape validation
             const objectValue = object;
             const items = isRecord(objectValue) && isRecord(objectValue['List'])
                 ? objectValue['List']['items']
@@ -16,6 +17,7 @@ export function extractDropIndexMetadata(content) {
             if (!Array.isArray(items))
                 continue;
             const names = items.flatMap((item) => {
+                // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish an unknown boundary before runtime shape validation
                 const itemValue = item;
                 const value = isRecord(itemValue) && isRecord(itemValue['String'])
                     ? itemValue['String']['sval']

package/dist/vitest-blob-manifest/reports-cli.mjs

@@ -11,6 +11,7 @@ function parseContext(raw, attempt) {
     const parsed = JSON.parse(raw);
     if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
         throw new Error('Vitest report expectation context must be an object');
+    // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish a record view after validating the untrusted JSON object
     const context = parsed;
     if (Object.keys(context).toSorted().join('\0') !== ['attempt', 'suites', 'version'].join('\0') ||
         context.version !== 'vitest-report-expectations:v2' ||
@@ -26,6 +27,7 @@ function parseContext(raw, attempt) {
             Number(expectation.minimumAttempt) < 1 ||
             Number(expectation.minimumAttempt) > attempt))
         throw new Error('Vitest report expectation context has an invalid schema');
+    // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- retain the validated expectation type after the complete schema check
     const typed = context;
     const suites = typed.suites.map((expectation) => expectation.suite);
     if (new Set(suites).size !== suites.length || suites.join('\0') !== suites.toSorted().join('\0'))