vouchington-tooling 0.19.1 → 0.19.2

package/README.md

@@ -328,7 +328,10 @@ or derive a configuration or documentation package spec from that manifest inste
 
 `dependency-license-policy` keeps legal policy in the consumer. `collectPnpmLicenseReport` creates
 an isolated, script-free temporary workspace and store, expands pnpm's supported architectures to
-every `os`, `cpu`, and `libc` selector represented in the lockfile, and validates the JSON report.
+every `os`, `cpu`, and `libc` selector represented in the lockfile, drops every `engines` constraint
+from the audit copy of the lockfile, and validates the JSON report. Dropping `engines` keeps
+`pnpm fetch` from skipping optional packages that exclude the running Node.js; pnpm 12's `fetch`
+ignores `force`, so their licenses would otherwise report as Unknown.
 Pass explicit denied SPDX IDs and prefixes, exact aliases, and justified allowlist scopes to
 `evaluatePnpmLicenseReport`. Unknown, malformed, and custom SPDX references fail closed. Allowlist
 scopes are either intentionally global or an exact package-name set; the library returns structured

package/dist/dependency-license-policy/collect.mjs

@@ -26,7 +26,10 @@ export function collectPnpmLicenseReport(repoRoot, options = {}) {
     const auditWorkspace = prepareWorkspace(repoRoot, readFile(lockfilePath, 'utf8'), readFile(workspacePath, 'utf8'));
     try {
         const storeConfig = `--config.store-dir=${join(auditWorkspace.cwd, '.pnpm-store')}`;
-        const fetchResult = execute('pnpm', [storeConfig, '--config.force=true', 'fetch', '--ignore-scripts'], { cwd: auditWorkspace.cwd, encoding: 'utf8' });
+        const fetchResult = execute('pnpm', [storeConfig, 'fetch', '--ignore-scripts'], {
+            cwd: auditWorkspace.cwd,
+            encoding: 'utf8',
+        });
         assertCommandSucceeded('pnpm fetch', fetchResult);
         const result = execute('pnpm', [storeConfig, 'licenses', 'list', '--json'], {
             cwd: auditWorkspace.cwd,

package/dist/dependency-license-policy/workspace.d.mts

@@ -2,8 +2,21 @@ export interface PnpmLicenseAuditWorkspace {
     readonly cleanup: () => void;
     readonly cwd: string;
 }
-export declare function renderPnpmLicenseAuditWorkspace(lockfileSource: string, workspaceSource: string, paths: {
+/** The rendered `pnpm-lock.yaml` and `pnpm-workspace.yaml` of a license audit workspace. */
+export interface PnpmLicenseAuditFiles {
+    readonly lockfile: string;
+    readonly workspace: string;
+}
+/**
+ * Renders the audit copies of `pnpm-lock.yaml` and `pnpm-workspace.yaml` so `pnpm fetch` downloads
+ * every package in the lockfile, including optional ones that don't match the host.
+ *
+ * The workspace supports every `os`, `cpu`, and `libc` in the lockfile. The lockfile drops every
+ * `engines` constraint because pnpm 12's `fetch` ignores `force` and skips an optional package whose
+ * `engines` exclude the running Node.js, which would leave that package's license Unknown.
+ */
+export declare function renderPnpmLicenseAuditFiles(lockfileSource: string, workspaceSource: string, paths: {
     lockfile: string;
     workspace: string;
-}): string;
+}): PnpmLicenseAuditFiles;
 export declare function preparePnpmLicenseAuditWorkspace(repoRoot: string, lockfileSource: string, workspaceSource: string): PnpmLicenseAuditWorkspace;

package/dist/dependency-license-policy/workspace.mjs

@@ -1,20 +1,20 @@
 import { copyFileSync, existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
+import { isMap, parseDocument, stringify as stringifyYaml } from 'yaml';
 const PLATFORM_KEYS = ['os', 'cpu', 'libc'];
-function parseYamlObject(source, path) {
-    let parsed;
-    try {
-        parsed = parseYaml(source);
-    }
-    catch (error) {
+function parseYamlDocument(source, path) {
+    const document = parseDocument(source);
+    const [error] = document.errors;
+    if (error)
         throw new Error(`failed to parse ${path}: ${String(error)}`, { cause: error });
-    }
-    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    return document;
+}
+function assertYamlObject(value, path) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
         throw new Error(`expected ${path} to contain a YAML object`);
     }
-    return parsed;
+    return value;
 }
 function getStringList(value, path) {
     if (typeof value === 'string')
@@ -24,13 +24,7 @@ function getStringList(value, path) {
     }
     return value;
 }
-export function renderPnpmLicenseAuditWorkspace(lockfileSource, workspaceSource, paths) {
-    const lockfile = parseYamlObject(lockfileSource, paths.lockfile);
-    const workspace = parseYamlObject(workspaceSource, paths.workspace);
-    const packages = lockfile.packages;
-    if (typeof packages !== 'object' || packages === null || Array.isArray(packages)) {
-        throw new Error(`expected ${paths.lockfile} to contain a packages object`);
-    }
+function collectSupportedArchitectures(packages, lockfilePath) {
     const supportedArchitectures = {
         cpu: ['current'],
         libc: ['current'],
@@ -44,27 +38,52 @@ export function renderPnpmLicenseAuditWorkspace(lockfileSource, workspaceSource,
             const value = snapshot[key];
             if (value === undefined)
                 continue;
-            for (const platform of getStringList(value, `${paths.lockfile} packages.*.${key}`)) {
+            for (const platform of getStringList(value, `${lockfilePath} packages.*.${key}`)) {
                 values.add(platform);
             }
         }
         supportedArchitectures[key].push(...[...values].filter((value) => value !== 'current').sort());
     }
-    return stringifyYaml({ ...workspace, packages: [], supportedArchitectures });
+    return supportedArchitectures;
+}
+/**
+ * Renders the audit copies of `pnpm-lock.yaml` and `pnpm-workspace.yaml` so `pnpm fetch` downloads
+ * every package in the lockfile, including optional ones that don't match the host.
+ *
+ * The workspace supports every `os`, `cpu`, and `libc` in the lockfile. The lockfile drops every
+ * `engines` constraint because pnpm 12's `fetch` ignores `force` and skips an optional package whose
+ * `engines` exclude the running Node.js, which would leave that package's license Unknown.
+ */
+export function renderPnpmLicenseAuditFiles(lockfileSource, workspaceSource, paths) {
+    const lockfileDocument = parseYamlDocument(lockfileSource, paths.lockfile);
+    const lockfile = assertYamlObject(lockfileDocument.toJS(), paths.lockfile);
+    const workspace = assertYamlObject(parseYamlDocument(workspaceSource, paths.workspace).toJS(), paths.workspace);
+    const packageNodes = lockfileDocument.get('packages');
+    if (!isMap(packageNodes)) {
+        throw new Error(`expected ${paths.lockfile} to contain a packages object`);
+    }
+    const supportedArchitectures = collectSupportedArchitectures(lockfile.packages, paths.lockfile);
+    for (const { value } of packageNodes.items)
+        if (isMap(value))
+            value.delete('engines');
+    return {
+        lockfile: lockfileDocument.toString({ lineWidth: 0 }),
+        workspace: stringifyYaml({ ...workspace, packages: [], supportedArchitectures }),
+    };
 }
 export function preparePnpmLicenseAuditWorkspace(repoRoot, lockfileSource, workspaceSource) {
     const auditRoot = mkdtempSync(join(tmpdir(), 'dependency-license-audit-'));
     try {
-        for (const filename of ['package.json', 'pnpm-lock.yaml']) {
-            copyFileSync(join(repoRoot, filename), join(auditRoot, filename));
-        }
+        copyFileSync(join(repoRoot, 'package.json'), join(auditRoot, 'package.json'));
         const npmrc = join(repoRoot, '.npmrc');
         if (existsSync(npmrc))
             copyFileSync(npmrc, join(auditRoot, '.npmrc'));
-        writeFileSync(join(auditRoot, 'pnpm-workspace.yaml'), renderPnpmLicenseAuditWorkspace(lockfileSource, workspaceSource, {
+        const files = renderPnpmLicenseAuditFiles(lockfileSource, workspaceSource, {
             lockfile: join(repoRoot, 'pnpm-lock.yaml'),
             workspace: join(repoRoot, 'pnpm-workspace.yaml'),
-        }), 'utf8');
+        });
+        writeFileSync(join(auditRoot, 'pnpm-lock.yaml'), files.lockfile, 'utf8');
+        writeFileSync(join(auditRoot, 'pnpm-workspace.yaml'), files.workspace, 'utf8');
     }
     catch (error) {
         rmSync(auditRoot, { force: true, recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.19.1",
+  "version": "0.19.2",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {