vouchington-tooling 0.11.1 → 0.12.0

package/README.md

@@ -215,6 +215,7 @@ import {
 import { runRetrospectiveTranscript } from 'vouchington-tooling/retrospective-transcript'
 import { appendJournal, probeBlackboard } from 'vouchington-tooling/agent-blackboard'
 import { buildSessionFrictionReport, recordFriction } from 'vouchington-tooling/session-friction'
+import { GITHUB_BODY_MAX_CHARACTERS, validateGitHubBodyLength } from 'vouchington-tooling'
 import { createPullRequest, getDiffAgainstBase, runGh, runGit } from 'vouchington-tooling/gh-cli'
 import {
   shellScriptViolations,
@@ -231,6 +232,10 @@ throws on a `run:` value that is a YAML alias or a multiline PLAIN scalar, shape
 scan safely. Both functions scan already-in-scope source text — deciding which files count as a
 shell script or a workflow/action YAML file is left to the caller.
 
+`validateGitHubBodyLength` measures an issue or pull-request body against GitHub's 65,536 Unicode
+code-point limit without altering it. Its result includes the UTF-8 byte count for diagnostics; that
+byte count is not a validation limit.
+
 `agent-harness-config` merges classifier-auto and sandbox keys into Claude, Codex, Grok, and Cursor
 config files. See [docs/agent-harness-config.md](./docs/agent-harness-config.md). `--global` updates
 home-directory configs; `--repo` updates a checkout. It does not copy allowlists, hooks, or plugins.

package/dist/gh-cli/body-length.d.mts

@@ -0,0 +1,15 @@
+/** GitHub's maximum issue or pull-request body length, counted in Unicode code points. */
+export declare const GITHUB_BODY_MAX_CHARACTERS = 65536;
+/** The measured GitHub body length and whether it fits within GitHub's character limit. */
+export interface GitHubBodyLengthValidation {
+    readonly ok: boolean;
+    readonly characterCount: number;
+    readonly utf8ByteCount: number;
+    readonly maxCharacterCount: number;
+}
+/**
+ * Measures a GitHub issue or pull-request body without altering its content.
+ *
+ * GitHub's limit is evaluated in Unicode code points. UTF-8 bytes are returned only for diagnostics.
+ */
+export declare function validateGitHubBodyLength(body: string): GitHubBodyLengthValidation;

package/dist/gh-cli/body-length.mjs

@@ -0,0 +1,16 @@
+/** GitHub's maximum issue or pull-request body length, counted in Unicode code points. */
+export const GITHUB_BODY_MAX_CHARACTERS = 65_536;
+/**
+ * Measures a GitHub issue or pull-request body without altering its content.
+ *
+ * GitHub's limit is evaluated in Unicode code points. UTF-8 bytes are returned only for diagnostics.
+ */
+export function validateGitHubBodyLength(body) {
+    const characterCount = Array.from(body).length;
+    return {
+        ok: characterCount <= GITHUB_BODY_MAX_CHARACTERS,
+        characterCount,
+        utf8ByteCount: Buffer.byteLength(body, 'utf8'),
+        maxCharacterCount: GITHUB_BODY_MAX_CHARACTERS,
+    };
+}

package/dist/gh-cli/index.d.mts

@@ -1,5 +1,7 @@
 export { createCommandRunner, runGh, runGit } from './exec.mts';
 export type { ExecFileText, RunTextCommand } from './exec.mts';
 export { getDiffAgainstBase } from './diff.mts';
+export { GITHUB_BODY_MAX_CHARACTERS, validateGitHubBodyLength } from './body-length.mts';
+export type { GitHubBodyLengthValidation } from './body-length.mts';
 export { assertHeadPushed, buildGhPrCreateArgs, createPullRequest, DetachedHeadError, HeadNotPushedError, HeadOutOfDateError, resolveHeadBranch, } from './pr-create.mts';
 export type { AssertHeadPushedOptions, BuildGhPrCreateArgsOptions, CreatePullRequestExecutors, CreatePullRequestOptions, } from './pr-create.mts';

package/dist/gh-cli/index.mjs

@@ -1,3 +1,4 @@
 export { createCommandRunner, runGh, runGit } from './exec.mjs';
 export { getDiffAgainstBase } from './diff.mjs';
+export { GITHUB_BODY_MAX_CHARACTERS, validateGitHubBodyLength } from './body-length.mjs';
 export { assertHeadPushed, buildGhPrCreateArgs, createPullRequest, DetachedHeadError, HeadNotPushedError, HeadOutOfDateError, resolveHeadBranch, } from './pr-create.mjs';

package/dist/index.d.mts

@@ -89,5 +89,7 @@ export type { DiagnosticReportLimitOptions, DiagnosticReportSummary, } from './v
 export { createCommandRunner, runGh, runGit } from './gh-cli/index.mts';
 export type { ExecFileText, RunTextCommand } from './gh-cli/index.mts';
 export { getDiffAgainstBase } from './gh-cli/index.mts';
+export { GITHUB_BODY_MAX_CHARACTERS, validateGitHubBodyLength } from './gh-cli/index.mts';
+export type { GitHubBodyLengthValidation } from './gh-cli/index.mts';
 export { assertHeadPushed, buildGhPrCreateArgs, createPullRequest, DetachedHeadError, HeadNotPushedError, HeadOutOfDateError, resolveHeadBranch, } from './gh-cli/index.mts';
 export type { AssertHeadPushedOptions, BuildGhPrCreateArgsOptions, CreatePullRequestExecutors, CreatePullRequestOptions, } from './gh-cli/index.mts';

package/dist/index.mjs

@@ -50,4 +50,5 @@ export { validateResolvedPinDelta } from './swift-resolved-pin-delta/index.mjs';
 export { DEFAULT_MAX_DIAGNOSTIC_REPORTS, DEFAULT_MAX_FORMATTED_DIAGNOSTIC_REPORTS, formatDiagnosticReportSummaries, HARD_MAX_DIAGNOSTIC_REPORTS, readDiagnosticReportSummaries, summarizeDiagnosticReport, } from './vitest-diagnostics/index.mjs';
 export { createCommandRunner, runGh, runGit } from './gh-cli/index.mjs';
 export { getDiffAgainstBase } from './gh-cli/index.mjs';
+export { GITHUB_BODY_MAX_CHARACTERS, validateGitHubBodyLength } from './gh-cli/index.mjs';
 export { assertHeadPushed, buildGhPrCreateArgs, createPullRequest, DetachedHeadError, HeadNotPushedError, HeadOutOfDateError, resolveHeadBranch, } from './gh-cli/index.mjs';

package/dist/pnpm-install/install-operations.d.mts

@@ -1,5 +1,6 @@
 import { type CommandResult, type InstallOptions } from './support.mts';
 export declare function withScriptPolicy(args: string[], installScripts: boolean): string[];
 export declare function install(args: string[], options: InstallOptions, label: string): Promise<void>;
-export declare function reconcileOrFail(options: InstallOptions, runCapture: (args: string[]) => Promise<CommandResult>): Promise<void>;
+export declare function reconcileOrFail(options: InstallOptions): Promise<void>;
+export declare function finalizePendingBuilds(options: InstallOptions, runCapture: (args: string[]) => Promise<CommandResult>, phase: string): Promise<import("./pending-builds.mts").PendingBuildState>;
 export declare function repairIsolatedNativeMismatch(options: InstallOptions, runCapture: (args: string[]) => Promise<CommandResult>, mismatchedNativePaths: string[]): Promise<boolean>;

package/dist/pnpm-install/install-operations.mjs

@@ -1,7 +1,7 @@
 import { scheduler } from 'node:timers/promises';
 import { runPnpm } from './exec.mjs';
 import { nativeBinariesMatchRuntime, repairedNativeBinariesMatchRuntime } from './native-health.mjs';
-import { buildLedgersAllowNativeRepair } from './pending-builds.mjs';
+import { buildLedgersAllowNativeRepair, pendingBuilds } from './pending-builds.mjs';
 import { INSTALL_TERMINATION_FAILED } from './process.mjs';
 import { formatReleaseAgeFailure, isReleaseAgeViolation } from './release-age.mjs';
 import { findWorkspaceLinkMismatches, forcedInstallArgs, logWorkspaceLinkMismatches, } from './support.mjs';
@@ -28,10 +28,9 @@ export async function install(args, options, label) {
     }
     fail(`${label} failed after ${options.maxAttempts} attempt${options.maxAttempts === 1 ? '' : 's'}`);
 }
-export async function reconcileOrFail(options, runCapture) {
+export async function reconcileOrFail(options) {
     await install([...forcedInstallArgs, '--ignore-scripts', '--ignore-pnpmfile'], options, 'script-free reconciliation');
-    await install(withScriptPolicy(forcedInstallArgs, options.installScripts), options, 'strict persistent reconciliation');
-    await verifyInstallHealth(runCapture, 'persistent reconciliation');
+    await install([...forcedInstallArgs, '--ignore-scripts'], options, 'second script-free persistent reconciliation');
 }
 async function verifyInstallHealth(runCapture, phase, repairedNativePaths = []) {
     const [nativesMatch, remaining] = await Promise.all([
@@ -47,6 +46,19 @@ async function verifyInstallHealth(runCapture, phase, repairedNativePaths = [])
         fail(`${phase} completed with invalid workspace links`);
     }
 }
+export async function finalizePendingBuilds(options, runCapture, phase) {
+    const before = await pendingBuilds();
+    if (options.installScripts && before.kind === 'unknown')
+        fail(`${phase} completed without a clear pending build ledger`);
+    if (options.installScripts && before.kind === 'pending') {
+        await install(['rebuild', '--pending', '--recursive'], options, 'pending scripts rebuild');
+        const after = await pendingBuilds();
+        if (after.kind !== 'clear')
+            fail(`${phase} completed without a clear pending build ledger`);
+    }
+    await verifyInstallHealth(runCapture, phase);
+    return options.installScripts ? { kind: 'clear' } : before;
+}
 export async function repairIsolatedNativeMismatch(options, runCapture, mismatchedNativePaths) {
     if (!(await buildLedgersAllowNativeRepair()))
         return false;

package/dist/pnpm-install/metadata.d.mts

@@ -3,7 +3,7 @@ import { type ProvenanceStatus } from './transition.mts';
 declare const componentNames: readonly ['lockfile', 'npm-config', 'pnpm', 'pnpmfiles', 'runtime', 'workspace-config', 'workspace-manifests'];
 type ComponentName = (typeof componentNames)[number];
 type StructuralProvenance = Record<ComponentName, string>;
-export declare function persistentMetadataFingerprintV4(runCapture: CaptureCommand): Promise<{
+export declare function persistentMetadataFingerprintV5(runCapture: CaptureCommand): Promise<{
     lockfile: string;
     'npm-config': string;
     pnpm: string;
@@ -12,7 +12,7 @@ export declare function persistentMetadataFingerprintV4(runCapture: CaptureComma
     'workspace-config': string;
     'workspace-manifests': string;
 }>;
-export declare function persistentMetadataStatusV4(provenance: StructuralProvenance): Promise<ProvenanceStatus>;
-export declare function writePersistentMetadataStampV4(provenance: StructuralProvenance, installScripts: boolean, resetScriptsEnabledCapability: boolean, pendingDependencyBuilds?: string[]): Promise<void>;
+export declare function persistentMetadataStatusV5(provenance: StructuralProvenance): Promise<ProvenanceStatus>;
+export declare function writePersistentMetadataStampV5(provenance: StructuralProvenance, installScripts: boolean, scriptsEnabledInstallVerified: boolean): Promise<void>;
 export declare function persistentDependencyTreeIsCold(): Promise<boolean>;
 export {};

package/dist/pnpm-install/metadata.mjs

@@ -47,7 +47,7 @@ function runtimePlatformIdentity() {
         platform: process.platform,
     });
 }
-export async function persistentMetadataFingerprintV4(runCapture) {
+export async function persistentMetadataFingerprintV5(runCapture) {
     const workspaces = (await listWorkspaces(runCapture)).toSorted((left, right) => left.path.localeCompare(right.path));
     const pnpmVersion = await runCapture(['--version']);
     if (pnpmVersion.code !== 0)
@@ -75,15 +75,12 @@ function validStamp(value) {
         return false;
     // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish the candidate stamp type before complete field validation
     const stamp = value;
-    return (stamp.version === 4 &&
+    return (stamp.version === 5 &&
         typeof stamp.lastInvocationInstallScripts === 'boolean' &&
-        typeof stamp.scriptsEnabledInstallSucceeded === 'boolean' &&
+        typeof stamp.scriptsEnabledInstallVerified === 'boolean' &&
         typeof stamp.provenance === 'object' &&
         stamp.provenance !== null &&
-        componentNames.every((name) => typeof stamp.provenance?.[name] === 'string') &&
-        (stamp.pendingDependencyBuilds === undefined ||
-            (Array.isArray(stamp.pendingDependencyBuilds) &&
-                stamp.pendingDependencyBuilds.every((id) => typeof id === 'string'))));
+        componentNames.every((name) => typeof stamp.provenance?.[name] === 'string'));
 }
 async function readPersistentMetadataState() {
     try {
@@ -98,11 +95,7 @@ async function readPersistentMetadataState() {
             : { kind: 'unsafe' };
     }
 }
-async function readPersistentMetadataStamp() {
-    const state = await readPersistentMetadataState();
-    return state.kind === 'stamp' ? state.stamp : undefined;
-}
-export async function persistentMetadataStatusV4(provenance) {
+export async function persistentMetadataStatusV5(provenance) {
     const state = await readPersistentMetadataState();
     if (state.kind === 'missing')
         return { kind: 'absent' };
@@ -115,23 +108,15 @@ export async function persistentMetadataStatusV4(provenance) {
         : {
             kind: 'matching',
             lastInvocationInstallScripts: stamp.lastInvocationInstallScripts,
-            pendingDependencyBuilds: stamp.pendingDependencyBuilds ?? [],
-            scriptsEnabledInstallSucceeded: stamp.scriptsEnabledInstallSucceeded,
+            scriptsEnabledInstallVerified: stamp.scriptsEnabledInstallVerified,
         };
 }
-export async function writePersistentMetadataStampV4(provenance, installScripts, resetScriptsEnabledCapability, pendingDependencyBuilds) {
-    const existing = await readPersistentMetadataStamp();
-    const existingMatches = existing && componentNames.every((name) => existing.provenance[name] === provenance[name]);
+export async function writePersistentMetadataStampV5(provenance, installScripts, scriptsEnabledInstallVerified) {
     const stamp = {
         lastInvocationInstallScripts: installScripts,
-        pendingDependencyBuilds: (pendingDependencyBuilds ??
-            (existingMatches ? existing.pendingDependencyBuilds : undefined) ??
-            []).toSorted(),
         provenance,
-        scriptsEnabledInstallSucceeded: installScripts ||
-            (!resetScriptsEnabledCapability &&
-                Boolean(existingMatches && existing.scriptsEnabledInstallSucceeded)),
-        version: 4,
+        scriptsEnabledInstallVerified,
+        version: 5,
     };
     const stampPath = persistentMetadataStampPath();
     const directory = path.dirname(stampPath);

package/dist/pnpm-install/pending-builds.d.mts

@@ -1,18 +1,10 @@
-export type PendingBuilds = {
-    kind: 'known';
-    ids: Set<string>;
+export type PendingBuildState = {
+    kind: 'clear';
 } | {
-    kind: 'unknown';
-};
-export type PendingBuildDelta = {
-    kind: 'unknown';
+    ids: string[];
+    kind: 'pending';
 } | {
-    kind: 'known';
-    dependencyIds: string[];
-    workspaceIds: string[];
+    kind: 'unknown';
 };
-export declare function pendingBuilds(): Promise<PendingBuilds>;
+export declare function pendingBuilds(): Promise<PendingBuildState>;
 export declare function buildLedgersAllowNativeRepair(): Promise<boolean>;
-export declare function validDependencyBuildIds(ids: [string, ...string[]]): Promise<[string, ...string[]] | undefined>;
-export declare function clearPendingDependencyBuilds(ids: string[]): Promise<boolean>;
-export declare function pendingBuildDelta(before: PendingBuilds, after: PendingBuilds): Promise<PendingBuildDelta>;

package/dist/pnpm-install/pending-builds.mjs

@@ -1,106 +1,36 @@
-import { readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { parse, stringify } from 'yaml';
-export async function pendingBuilds() {
-    try {
-        const value = parse(await readFile(path.join(process.cwd(), 'node_modules', '.modules.yaml'), 'utf8'));
-        if (typeof value !== 'object' || value === null || Array.isArray(value))
-            return { kind: 'unknown' };
-        const pending = value.pendingBuilds ?? [];
-        if (!Array.isArray(pending) || !pending.every((id) => typeof id === 'string'))
-            return { kind: 'unknown' };
-        return { kind: 'known', ids: new Set(pending) };
-    }
-    catch {
-        return { kind: 'unknown' };
-    }
-}
-export async function buildLedgersAllowNativeRepair() {
+import { parse } from 'yaml';
+async function buildLedgers() {
     try {
         const value = parse(await readFile(path.join(process.cwd(), 'node_modules', '.modules.yaml'), 'utf8'));
         if (typeof value !== 'object' || value === null || Array.isArray(value))
-            return false;
-        // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish a record view after validating the pnpm manifest object
-        const record = value;
-        const ignored = record.ignoredBuilds;
-        const pending = record.pendingBuilds ?? [];
-        return (Array.isArray(ignored) &&
-            ignored.length === 0 &&
-            Array.isArray(pending) &&
-            pending.length === 0);
-    }
-    catch {
-        return false;
-    }
-}
-async function lockfileDependencyIds() {
-    try {
-        const lockfile = parse(await readFile(path.join(process.cwd(), 'pnpm-lock.yaml'), 'utf8'));
-        if (typeof lockfile !== 'object' || lockfile === null || !('packages' in lockfile))
             return undefined;
-        const packages = lockfile.packages;
-        if (typeof packages !== 'object' || packages === null || Array.isArray(packages))
+        // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- validate the parsed YAML object before reading its fields
+        const record = value;
+        const ignored = Object.hasOwn(record, 'ignoredBuilds') ? record.ignoredBuilds : undefined;
+        const pending = Object.hasOwn(record, 'pendingBuilds') ? record.pendingBuilds : [];
+        if ((ignored !== undefined &&
+            (!Array.isArray(ignored) || !ignored.every((id) => typeof id === 'string'))) ||
+            !Array.isArray(pending) ||
+            !pending.every((id) => typeof id === 'string'))
             return undefined;
-        return new Set(Object.keys(packages));
+        return {
+            ignoredBuilds: ignored,
+            pendingBuilds: pending.length === 0 ? { kind: 'clear' } : { ids: pending.toSorted(), kind: 'pending' },
+        };
     }
     catch {
         return undefined;
     }
 }
-export async function validDependencyBuildIds(ids) {
-    const packages = await lockfileDependencyIds();
-    if (!packages || !ids.every((id) => packages.has(id)))
-        return undefined;
-    const [first, ...remaining] = ids.toSorted();
-    return [first, ...remaining];
-}
-export async function clearPendingDependencyBuilds(ids) {
-    const filename = path.join(process.cwd(), 'node_modules', '.modules.yaml');
-    try {
-        const value = parse(await readFile(filename, 'utf8'));
-        if (typeof value !== 'object' || value === null || Array.isArray(value))
-            return false;
-        // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish a record view after validating the pnpm manifest object
-        const record = value;
-        if (!Array.isArray(record.pendingBuilds) ||
-            !record.pendingBuilds.every((id) => typeof id === 'string'))
-            return false;
-        const ignored = record.ignoredBuilds ?? [];
-        if (!Array.isArray(ignored) ||
-            !ignored.every((id) => typeof id === 'string') ||
-            ids.some((id) => ignored.includes(id)))
-            return false;
-        record.pendingBuilds = record.pendingBuilds.filter((id) => !ids.includes(id));
-        const temporary = `${filename}.${process.pid}.tmp`;
-        try {
-            await writeFile(temporary, stringify(record));
-            await rename(temporary, filename);
-        }
-        finally {
-            await rm(temporary, { force: true });
-        }
-        return true;
-    }
-    catch {
-        return false;
-    }
+export async function pendingBuilds() {
+    return (await buildLedgers())?.pendingBuilds ?? { kind: 'unknown' };
 }
-export async function pendingBuildDelta(before, after) {
-    if (before.kind !== 'known' || after.kind !== 'known')
-        return { kind: 'unknown' };
-    const packages = await lockfileDependencyIds();
-    if (!packages)
-        return { kind: 'unknown' };
-    const dependencyIds = [];
-    const workspaceIds = [];
-    for (const id of after.ids) {
-        if (before.ids.has(id))
-            continue;
-        (packages.has(id) ? dependencyIds : workspaceIds).push(id);
-    }
-    return {
-        kind: 'known',
-        dependencyIds: dependencyIds.toSorted(),
-        workspaceIds: workspaceIds.toSorted(),
-    };
+export async function buildLedgersAllowNativeRepair() {
+    const ledgers = await buildLedgers();
+    return (ledgers !== undefined &&
+        ledgers.ignoredBuilds !== undefined &&
+        ledgers.ignoredBuilds.length === 0 &&
+        ledgers.pendingBuilds.kind === 'clear');
 }

package/dist/pnpm-install/pnpm-install-fake-pnpm.test-helpers.mjs

@@ -29,18 +29,32 @@ if [ "\${PNPM_FAIL_RELEASE_AGE_CALL:-0}" = "$calls" ]; then
   exit 1
 fi
 if [ -n "\${PNPM_SLEEP_SECONDS:-}" ]; then sleep "$PNPM_SLEEP_SECONDS"; fi
-if [ -n "\${PNPM_PENDING_BUILDS:-}" ]; then
+if [ "\${PNPM_INVALID_PENDING_BUILDS:-0}" = 1 ]; then
+  mkdir -p "$PNPM_NODE_MODULES"
+  printf 'pendingBuilds: invalid\n' > "$PNPM_NODE_MODULES/.modules.yaml"
+elif [ -n "\${PNPM_PENDING_BUILDS:-}" ]; then
   mkdir -p "$PNPM_NODE_MODULES"
   printf 'pendingBuilds: [%s]\\n' "$PNPM_PENDING_BUILDS" > "$PNPM_NODE_MODULES/.modules.yaml"
+elif [ ! -f "$PNPM_NODE_MODULES/.modules.yaml" ]; then
+  mkdir -p "$PNPM_NODE_MODULES"
+  printf 'pendingBuilds: []\\n' > "$PNPM_NODE_MODULES/.modules.yaml"
 fi
 case " $* " in
   *' rebuild '*)
+    if [ "\${PNPM_REPAIR_NATIVE_ON_REBUILD:-0}" = 1 ]; then
+      cp "$PNPM_NATIVE_REPLACEMENT" "$PNPM_NATIVE_ADDON"
+    fi
     if [ "\${PNPM_REBUILD_INVALID_LEDGER:-0}" = 1 ]; then
       printf 'pendingBuilds: invalid\n' > "$PNPM_NODE_MODULES/.modules.yaml"
+    else
+      printf 'pendingBuilds: []\n' > "$PNPM_NODE_MODULES/.modules.yaml"
     fi
     if [ "\${PNPM_REBUILD_BREAK_LINK:-0}" = 1 ]; then rm -f "$PNPM_DEPENDENCY_LINK"; fi
     ;;
   *' --force '*)
+    if [ -z "\${PNPM_PENDING_BUILDS:-}" ]; then
+      printf 'pendingBuilds: []\n' > "$PNPM_NODE_MODULES/.modules.yaml"
+    fi
     if [ "\${PNPM_DELETE_NATIVE:-0}" = 1 ]; then
       rm -f "$PNPM_NATIVE_ADDON"
     elif [ "\${PNPM_REPAIR_NATIVE:-0}" = 1 ]; then

package/dist/pnpm-install/runner.mjs

@@ -1,10 +1,10 @@
-import { persistentDependencyTreeIsCold, persistentMetadataFingerprintV4, persistentMetadataStatusV4, writePersistentMetadataStampV4, } from './metadata.mjs';
+import { persistentDependencyTreeIsCold, persistentMetadataFingerprintV5, persistentMetadataStatusV5, writePersistentMetadataStampV5, } from './metadata.mjs';
 import { runPnpm } from './exec.mjs';
 import { mismatchedNativeBinaries } from './native-health.mjs';
 // oxfmt-ignore
-import { clearPendingDependencyBuilds, pendingBuildDelta, pendingBuilds, validDependencyBuildIds } from './pending-builds.mjs';
+import { pendingBuilds } from './pending-builds.mjs';
 // oxfmt-ignore
-import { install, reconcileOrFail, repairIsolatedNativeMismatch, withScriptPolicy } from './install-operations.mjs';
+import { finalizePendingBuilds, install, reconcileOrFail, repairIsolatedNativeMismatch, withScriptPolicy } from './install-operations.mjs';
 // oxfmt-ignore
 import { baseInstallArgs, findWorkspaceLinkMismatches, logWorkspaceLinkMismatches } from './support.mjs';
 import { persistentInstallTransition, persistentProvenanceDiagnostic } from './transition.mjs';
@@ -14,33 +14,30 @@ async function persistent(options) {
     if (options.ephemeralWorkspaces.trim())
         fail('ephemeral-workspaces is only valid for ephemeral runners');
     const runCapture = (args) => runPnpm(args, options, true);
-    const fingerprint = await persistentMetadataFingerprintV4(runCapture);
-    const provenance = await persistentMetadataStatusV4(fingerprint);
+    const fingerprint = await persistentMetadataFingerprintV5(runCapture);
+    const provenance = await persistentMetadataStatusV5(fingerprint);
+    const pendingBefore = await pendingBuilds();
     const mismatchedNatives = await mismatchedNativeBinaries();
     const nativesMatch = mismatchedNatives.length === 0;
     const repairedNativeMismatch = !nativesMatch &&
         provenance.kind === 'matching' &&
         (await repairIsolatedNativeMismatch(options, runCapture, mismatchedNatives));
     if (repairedNativeMismatch) {
+        const pendingAfterRepair = await finalizePendingBuilds(options, runCapture, 'native health reconciliation');
         console.warn('persistent optional native binaries do not match this runtime; reconciled');
         console.warn(persistentProvenanceDiagnostic(provenance, options.installScripts, nativesMatch, {
             action: 'reconcile',
             reason: 'native-health-mismatch',
         }));
-        await writePersistentMetadataStampV4(fingerprint, options.installScripts, true, []);
+        await writePersistentMetadataStampV5(fingerprint, options.installScripts, options.installScripts || persistentStampRemainsVerified(provenance, pendingAfterRepair));
         return 'persistent native health reconciled';
     }
     const provisionalTransition = persistentInstallTransition(provenance, options.installScripts);
-    let transition = nativesMatch
-        ? provisionalTransition
-        : { action: 'reconcile', reason: 'native-health-mismatch' };
-    if (transition.action === 'upgrade-dependencies') {
-        const ids = await validDependencyBuildIds(transition.pendingDependencyBuilds);
-        if (!ids)
-            transition = { action: 'upgrade-scripts', reason: 'invalid-pending-dependency-builds' };
-        else
-            transition = { ...transition, pendingDependencyBuilds: ids };
-    }
+    const transition = !nativesMatch
+        ? { action: 'reconcile', reason: 'native-health-mismatch' }
+        : provenance.kind !== 'matching' || pendingBefore.kind === 'clear'
+            ? provisionalTransition
+            : { action: 'reconcile', reason: 'pending-build-ledger-unverified' };
     const provenanceOk = provenance.kind === 'matching' && transition.action !== 'reconcile' && nativesMatch;
     const cold = !provenanceOk && (await persistentDependencyTreeIsCold());
     if (!provenanceOk && !cold) {
@@ -51,54 +48,19 @@ async function persistent(options) {
         console.warn(provenance.kind === 'matching' && !nativesMatch
             ? 'persistent optional native binaries do not match this runtime; reconciling'
             : 'persistent dependency metadata provenance is missing or changed; reconciling');
-        await reconcileOrFail(options, runCapture);
-        await writePersistentMetadataStampV4(fingerprint, options.installScripts, true, []);
+        await reconcileOrFail(options);
+        const pendingAfterReconcile = await finalizePendingBuilds(options, runCapture, 'persistent reconciliation');
+        await writePersistentMetadataStampV5(fingerprint, options.installScripts, options.installScripts || persistentStampRemainsVerified(provenance, pendingAfterReconcile));
         return 'persistent metadata reconciled';
     }
     if (provenance.kind === 'absent')
         console.warn('persistent dependency tree is absent; installing cold');
-    const pendingBefore = transition.action === 'ordinary' && !options.installScripts ? await pendingBuilds() : undefined;
-    await install(withScriptPolicy([...baseInstallArgs], transition.action.startsWith('upgrade-') ? false : options.installScripts), options, 'ordinary persistent install');
+    await install(withScriptPolicy([...baseInstallArgs], options.installScripts), options, 'ordinary persistent install');
     const stale = await findWorkspaceLinkMismatches(runCapture);
     if (stale.length === 0) {
-        if (transition.action.startsWith('upgrade-')) {
-            const pendingDependencyBuilds = transition.action === 'upgrade-dependencies'
-                ? transition.pendingDependencyBuilds
-                : undefined;
-            const rebuild = pendingDependencyBuilds === undefined
-                ? ['rebuild', '--pending', '--recursive']
-                : ['rebuild', '--recursive', '--', ...pendingDependencyBuilds];
-            await install(rebuild, options, 'pending scripts rebuild');
-            const rebuiltStale = await findWorkspaceLinkMismatches(runCapture);
-            if (rebuiltStale.length > 0) {
-                logWorkspaceLinkMismatches(rebuiltStale);
-                await reconcileOrFail(options, runCapture);
-                console.warn(persistentProvenanceDiagnostic(provenance, options.installScripts, nativesMatch, {
-                    action: 'reconcile',
-                    reason: 'workspace-links-stale-after-rebuild',
-                }));
-                await writePersistentMetadataStampV4(fingerprint, options.installScripts, true, []);
-                return 'persistent reconciled';
-            }
-            if (pendingDependencyBuilds !== undefined &&
-                !(await clearPendingDependencyBuilds(pendingDependencyBuilds)))
-                fail('dependency rebuild completed but pending build ledger could not be updated safely');
-        }
+        const pendingAfterInstall = await finalizePendingBuilds(options, runCapture, 'persistent install');
         console.warn(persistentProvenanceDiagnostic(provenance, options.installScripts, nativesMatch, transition));
-        const pendingAfter = pendingBefore ? await pendingBuilds() : undefined;
-        const delta = pendingBefore && pendingAfter
-            ? await pendingBuildDelta(pendingBefore, pendingAfter)
-            : undefined;
-        const unsafePending = delta?.kind === 'unknown' || Boolean(delta?.workspaceIds.length);
-        const pendingDependencyBuilds = transition.action.startsWith('upgrade-') || unsafePending
-            ? []
-            : [
-                ...new Set([
-                    ...(provenance.kind === 'matching' ? provenance.pendingDependencyBuilds : []),
-                    ...(delta?.kind === 'known' ? delta.dependencyIds : []),
-                ]),
-            ].toSorted();
-        await writePersistentMetadataStampV4(fingerprint, options.installScripts, unsafePending, pendingDependencyBuilds);
+        await writePersistentMetadataStampV5(fingerprint, options.installScripts, options.installScripts || persistentStampRemainsVerified(provenance, pendingAfterInstall));
         return provenance.kind === 'absent' ? 'persistent cold' : 'persistent ordinary';
     }
     logWorkspaceLinkMismatches(stale);
@@ -106,10 +68,16 @@ async function persistent(options) {
         action: 'reconcile',
         reason: 'workspace-links-stale',
     }));
-    await reconcileOrFail(options, runCapture);
-    await writePersistentMetadataStampV4(fingerprint, options.installScripts, true, []);
+    await reconcileOrFail(options);
+    const pendingAfterReconcile = await finalizePendingBuilds(options, runCapture, 'persistent reconciliation');
+    await writePersistentMetadataStampV5(fingerprint, options.installScripts, options.installScripts || persistentStampRemainsVerified(provenance, pendingAfterReconcile));
     return 'persistent reconciled';
 }
+function persistentStampRemainsVerified(provenance, pending) {
+    return (provenance.kind === 'matching' &&
+        provenance.scriptsEnabledInstallVerified &&
+        pending.kind === 'clear');
+}
 function isUnbracedPathClosureSelector(selector) {
     return /^\.{0,2}\//.test(selector) && selector.endsWith('...') && !selector.startsWith('{');
 }

package/dist/pnpm-install/transition.d.mts

@@ -6,17 +6,12 @@ export type ProvenanceStatus = {
 } | {
     kind: 'matching';
     lastInvocationInstallScripts: boolean;
-    pendingDependencyBuilds: string[];
-    scriptsEnabledInstallSucceeded: boolean;
+    scriptsEnabledInstallVerified: boolean;
 } | {
     kind: 'unsafe';
 };
 export type PersistentInstallTransition = {
-    action: 'ordinary' | 'reconcile' | 'upgrade-scripts';
-    reason: string;
-} | {
-    action: 'upgrade-dependencies';
-    pendingDependencyBuilds: [string, ...string[]];
+    action: 'ordinary' | 'reconcile';
     reason: string;
 };
 export declare function persistentInstallTransition(provenance: ProvenanceStatus, installScripts: boolean): PersistentInstallTransition;

package/dist/pnpm-install/transition.mjs

@@ -2,15 +2,8 @@
 // evidence that this structural tree has already completed a scripts-enabled install.
 export function persistentInstallTransition(provenance, installScripts) {
     if (provenance.kind === 'matching') {
-        if (installScripts && !provenance.scriptsEnabledInstallSucceeded)
-            return { action: 'upgrade-scripts', reason: 'pending-scripts-rebuild' };
-        const [firstPendingDependencyBuild, ...remainingPendingDependencyBuilds] = provenance.pendingDependencyBuilds;
-        if (installScripts && firstPendingDependencyBuild !== undefined)
-            return {
-                action: 'upgrade-dependencies',
-                pendingDependencyBuilds: [firstPendingDependencyBuild, ...remainingPendingDependencyBuilds],
-                reason: 'pending-dependency-rebuild',
-            };
+        if (installScripts && !provenance.scriptsEnabledInstallVerified)
+            return { action: 'reconcile', reason: 'scripts-enabled-install-unverified' };
         return { action: 'ordinary', reason: 'matching-structural-provenance' };
     }
     if (provenance.kind === 'absent')
@@ -26,9 +19,8 @@ export function persistentProvenanceDiagnostic(provenance, installScripts, nativ
         changedComponents: provenance.kind === 'changed' ? provenance.components : [],
         event: 'pnpm-install-persistent-provenance',
         installScripts,
-        scriptsEnabledInstallSucceeded: provenance.kind === 'matching' ? provenance.scriptsEnabledInstallSucceeded : false,
+        scriptsEnabledInstallVerified: provenance.kind === 'matching' ? provenance.scriptsEnabledInstallVerified : false,
         lastInvocationInstallScripts: provenance.kind === 'matching' ? provenance.lastInvocationInstallScripts : null,
-        pendingDependencyBuildCount: provenance.kind === 'matching' ? provenance.pendingDependencyBuilds.length : 0,
         nativeBinariesMatchRuntime,
         reason: transition.reason,
         state: provenance.kind,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {