vouchington-tooling 0.20.0 → 0.21.0

package/README.md

@@ -326,19 +326,24 @@ policy out of this package.
 dependency declared by a non-fixture package manifest. Assert dependency membership or placement,
 or derive a configuration or documentation package spec from that manifest instead.
 
-`dependency-license-policy` keeps legal policy in the consumer. `collectPnpmLicenseReport` creates
-an isolated, script-free temporary workspace and store, expands pnpm's supported architectures to
-every `os`, `cpu`, and `libc` selector represented in the lockfile, drops every `engines` constraint
-from the audit copy of the lockfile, and validates the JSON report. Dropping `engines` keeps
-`pnpm fetch` from skipping optional packages that exclude the running Node.js; pnpm 12's `fetch`
-ignores `force`, so their licenses would otherwise report as Unknown.
+`dependency-license-policy` keeps legal policy in the consumer. `collectPnpmLicenseReport` returns
+a promise. It creates an isolated, script-free temporary workspace, expands pnpm's supported
+architectures to every `os`, `cpu`, and `libc` selector represented in the lockfile, drops every
+`engines` constraint from the audit copy of the lockfile, and validates the JSON report. Dropping
+`engines` keeps `pnpm fetch` from skipping optional packages that exclude the running Node.js;
+pnpm 12's `fetch` ignores `force`, so their licenses would otherwise report as Unknown.
+Packages are fetched into a dedicated owner-only store under the pnpm cache
+(`dependency-license-audit-store`) so a later audit reuses content-addressed packages instead of
+downloading every platform again, without writing those packages into the developer store.
 Pass explicit denied SPDX IDs and prefixes, exact aliases, and justified allowlist scopes to
 `evaluatePnpmLicenseReport`. Unknown, malformed, and custom SPDX references fail closed. Allowlist
 scopes are either intentionally global or an exact package-name set; the library returns structured
 violations and does not format CI-provider diagnostics.
-When present, the repository `.npmrc` is copied into the owner-private temporary directory so pnpm
-can authenticate to the same registries; normal cleanup removes the copy, and the caller remains
-responsible for terminating the process normally rather than abandoning temporary audit state.
+When present, the repository `.npmrc` is copied into the owner-private temporary workspace so pnpm
+can authenticate to the same registries. The workspace is removed when the audit finishes, when the
+process receives SIGINT, SIGTERM, or SIGHUP, and on the next audit if the previous process died
+first, including SIGKILL. Each workspace records its owner's PID so a later audit can delete
+directories whose owner is gone.
 
 `session-friction` is an opt-in capture and reporting library. Callers supply the session id,
 absolute log directory, host-independent observation, and journal loader; it does not inspect host

package/dist/dependency-license-policy/audit-directory.d.mts

@@ -0,0 +1,28 @@
+export declare const LICENSE_AUDIT_DIRECTORY_PREFIX = "dependency-license-audit-";
+export interface LicenseAuditReclaimOptions {
+    readonly graceMs?: number;
+    readonly isOwnerAlive?: (pid: number, directoryMtimeMs: number) => boolean;
+    readonly now?: number;
+}
+export interface LicenseAuditWorkspaceOptions extends LicenseAuditReclaimOptions {
+    readonly directory?: string;
+    readonly pid?: number;
+}
+interface OwnerAliveDependencies {
+    readonly isProcessAlive?: (pid: number) => boolean;
+    readonly readProcessStartMs?: (pid: number) => number | undefined;
+}
+/** Parses `ps -o lstart=` output. Exported for tests of unparseable dates. */
+export declare function parseProcessStart(stdout: string): number | undefined;
+export declare function readProcessStartMs(pid: number): number | undefined;
+export declare function isProcessAlive(pid: number): boolean;
+/**
+ * A directory still belongs to its creator when that PID is alive and the process started
+ * before the directory. A recycled PID belongs to a newer process and is not the owner.
+ */
+export declare function isAuditOwnerAlive(pid: number, directoryMtimeMs: number, dependencies?: OwnerAliveDependencies): boolean;
+export declare function writeAuditPid(directory: string, pid?: number): void;
+export declare function removeAuditDirectory(directory: string): void;
+/** Deletes leftover audit directories whose owner process is gone, including after SIGKILL. */
+export declare function reclaimStaleLicenseAuditDirectories(directory: string, options?: LicenseAuditReclaimOptions): void;
+export {};

package/dist/dependency-license-policy/audit-directory.mjs

@@ -0,0 +1,115 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, lstatSync, readdirSync, readFileSync, rmSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { join } from 'node:path';
+export const LICENSE_AUDIT_DIRECTORY_PREFIX = 'dependency-license-audit-';
+const LICENSE_AUDIT_PID_FILE = 'audit.pid';
+const STALE_AUDIT_GRACE_MS = 60_000;
+const OWNER_START_SLACK_MS = 1_000;
+const MAX_PID = 2_147_483_647;
+function hasCode(error, code) {
+    return Boolean(error && typeof error === 'object' && 'code' in error && error.code === code);
+}
+/** Parses `ps -o lstart=` output. Exported for tests of unparseable dates. */
+export function parseProcessStart(stdout) {
+    const parsed = Date.parse(stdout.trim());
+    if (Number.isNaN(parsed))
+        return undefined;
+    return parsed;
+}
+export function readProcessStartMs(pid) {
+    const result = spawnSync('ps', ['-p', String(pid), '-o', 'lstart='], { encoding: 'utf8' });
+    if (result.status !== 0)
+        return undefined;
+    return parseProcessStart(result.stdout);
+}
+export function isProcessAlive(pid) {
+    if (!Number.isSafeInteger(pid) || pid <= 0 || pid > MAX_PID)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return !hasCode(error, 'ESRCH');
+    }
+}
+/**
+ * A directory still belongs to its creator when that PID is alive and the process started
+ * before the directory. A recycled PID belongs to a newer process and is not the owner.
+ */
+export function isAuditOwnerAlive(pid, directoryMtimeMs, dependencies = {}) {
+    if (!(dependencies.isProcessAlive ?? isProcessAlive)(pid))
+        return false;
+    const started = (dependencies.readProcessStartMs ?? readProcessStartMs)(pid);
+    if (started === undefined)
+        return true;
+    return started <= directoryMtimeMs + OWNER_START_SLACK_MS;
+}
+export function writeAuditPid(directory, pid = process.pid) {
+    const path = join(directory, LICENSE_AUDIT_PID_FILE);
+    writeFileSync(path, `${String(pid)}\n`, { encoding: 'utf8', mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+function readAuditPid(directory) {
+    try {
+        const text = readFileSync(join(directory, LICENSE_AUDIT_PID_FILE), 'utf8').trim();
+        if (!/^[1-9]\d*$/.test(text))
+            return undefined;
+        const pid = Number.parseInt(text, 10);
+        return Number.isSafeInteger(pid) && pid <= MAX_PID ? pid : undefined;
+    }
+    catch (error) {
+        if (hasCode(error, 'ENOENT'))
+            return undefined;
+        throw error;
+    }
+}
+export function removeAuditDirectory(directory) {
+    const stat = lstatSync(directory, { throwIfNoEntry: false });
+    if (!stat)
+        return;
+    if (stat.isSymbolicLink()) {
+        unlinkSync(directory);
+        return;
+    }
+    if (!stat.isDirectory())
+        return;
+    rmSync(directory, { force: true, recursive: true });
+}
+function reclaimNames(directory) {
+    try {
+        return readdirSync(directory, { encoding: 'utf8' });
+    }
+    catch (error) {
+        if (hasCode(error, 'ENOENT'))
+            return [];
+        throw error;
+    }
+}
+function shouldRemoveAuditDirectory(directory, mtimeMs, now, graceMs, isOwnerAlive) {
+    const pid = readAuditPid(directory);
+    if (pid === undefined)
+        return now - mtimeMs >= graceMs;
+    return !isOwnerAlive(pid, mtimeMs);
+}
+/** Deletes leftover audit directories whose owner process is gone, including after SIGKILL. */
+export function reclaimStaleLicenseAuditDirectories(directory, options = {}) {
+    const now = options.now ?? Date.now();
+    const graceMs = options.graceMs ?? STALE_AUDIT_GRACE_MS;
+    const isOwnerAlive = options.isOwnerAlive ?? isAuditOwnerAlive;
+    for (const name of reclaimNames(directory)) {
+        if (!name.startsWith(LICENSE_AUDIT_DIRECTORY_PREFIX))
+            continue;
+        const path = join(directory, name);
+        const stat = lstatSync(path);
+        if (stat.isSymbolicLink()) {
+            unlinkSync(path);
+            continue;
+        }
+        if (!stat.isDirectory())
+            continue;
+        if (shouldRemoveAuditDirectory(path, stat.mtimeMs, now, graceMs, isOwnerAlive)) {
+            rmSync(path, { force: true, recursive: true });
+        }
+    }
+}

package/dist/dependency-license-policy/audit-signals.d.mts

@@ -0,0 +1,12 @@
+type SignalListener = () => void;
+export interface AuditSignalDependencies {
+    readonly raiseSignal?: (signal: NodeJS.Signals) => void;
+    readonly subscribe?: (signal: NodeJS.Signals, listener: SignalListener) => void;
+    readonly unsubscribe?: (signal: NodeJS.Signals, listener: SignalListener) => void;
+}
+/**
+ * Runs an audit while SIGINT, SIGTERM, and SIGHUP abort it, remove its workspace, and are raised
+ * again so the process still exits from that signal.
+ */
+export declare function withAuditSignalCleanup<T>(cleanup: () => void, run: (signal: AbortSignal) => Promise<T>, dependencies?: AuditSignalDependencies): Promise<T>;
+export {};

package/dist/dependency-license-policy/audit-signals.mjs

@@ -0,0 +1,44 @@
+const AUDIT_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+/**
+ * Runs an audit while SIGINT, SIGTERM, and SIGHUP abort it, remove its workspace, and are raised
+ * again so the process still exits from that signal.
+ */
+export async function withAuditSignalCleanup(cleanup, run, dependencies = {}) {
+    const controller = new AbortController();
+    let raised;
+    const handlers = AUDIT_SIGNALS.map((signal) => {
+        const listener = () => {
+            if (raised !== undefined)
+                return;
+            raised = signal;
+            controller.abort(signal);
+        };
+        if (dependencies.subscribe)
+            dependencies.subscribe(signal, listener);
+        else
+            process.on(signal, listener);
+        return { listener, signal };
+    });
+    try {
+        return await run(controller.signal);
+    }
+    finally {
+        for (const { listener, signal } of handlers) {
+            if (dependencies.unsubscribe)
+                dependencies.unsubscribe(signal, listener);
+            else
+                process.removeListener(signal, listener);
+        }
+        try {
+            cleanup();
+        }
+        finally {
+            if (raised !== undefined) {
+                if (dependencies.raiseSignal)
+                    dependencies.raiseSignal(raised);
+                else
+                    process.kill(process.pid, raised);
+            }
+        }
+    }
+}

package/dist/dependency-license-policy/audit-store.d.mts

@@ -0,0 +1,12 @@
+export interface DirectoryIdentity {
+    readonly isDirectory: () => boolean;
+    readonly isSymbolicLink: () => boolean;
+    readonly mode: number;
+    readonly uid: number;
+}
+/** pnpm's cache directory. The audit store stays beside it so it is not the developer store. */
+export declare function pnpmCacheDirectory(env?: NodeJS.ProcessEnv, home?: string, hostPlatform?: NodeJS.Platform): string;
+export declare function licenseAuditStoreDirectory(env?: NodeJS.ProcessEnv, home?: string, hostPlatform?: NodeJS.Platform): string;
+export declare function assertOwnedDirectory(stat: DirectoryIdentity, uid: number | undefined, directory: string): void;
+/** Creates the dedicated content-addressed store used by repeat license audits. */
+export declare function ensurePrivateLicenseAuditStore(directory: string): void;

package/dist/dependency-license-policy/audit-store.mjs

@@ -0,0 +1,32 @@
+import { chmodSync, lstatSync, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const STORE_DIRECTORY_NAME = 'dependency-license-audit-store';
+/** pnpm's cache directory. The audit store stays beside it so it is not the developer store. */
+export function pnpmCacheDirectory(env = process.env, home = homedir(), hostPlatform = process.platform) {
+    if (hostPlatform === 'darwin')
+        return join(home, 'Library', 'Caches', 'pnpm');
+    if (hostPlatform === 'win32') {
+        return join(env.LOCALAPPDATA ?? join(home, 'AppData', 'Local'), 'pnpm-cache');
+    }
+    return join(env.XDG_CACHE_HOME ?? join(home, '.cache'), 'pnpm');
+}
+export function licenseAuditStoreDirectory(env = process.env, home = homedir(), hostPlatform = process.platform) {
+    return join(pnpmCacheDirectory(env, home, hostPlatform), STORE_DIRECTORY_NAME);
+}
+export function assertOwnedDirectory(stat, uid, directory) {
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new Error(`dependency license audit store is not a real directory: ${directory}`);
+    }
+    if (uid !== undefined && stat.uid !== uid) {
+        throw new Error(`dependency license audit store is not owned by the current user: ${directory}`);
+    }
+}
+/** Creates the dedicated content-addressed store used by repeat license audits. */
+export function ensurePrivateLicenseAuditStore(directory) {
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(directory);
+    assertOwnedDirectory(stat, process.getuid?.(), directory);
+    if ((stat.mode & 0o077) !== 0)
+        chmodSync(directory, 0o700);
+}

package/dist/dependency-license-policy/collect.d.mts

@@ -1,9 +1,11 @@
 import type { PnpmExecutor, PnpmLicenseReport } from './types.mts';
 import { type PnpmLicenseAuditWorkspace } from './workspace.mts';
 export interface CollectPnpmLicenseReportOptions {
+    readonly ensureStore?: (directory: string) => void;
     readonly execute?: PnpmExecutor;
     readonly prepareWorkspace?: (repoRoot: string, lockfileSource: string, workspaceSource: string) => PnpmLicenseAuditWorkspace;
     readonly readFile?: (path: string, encoding: 'utf8') => string;
+    readonly storeDir?: string;
 }
 /** Collects licenses for every platform represented in a pnpm lockfile. */
-export declare function collectPnpmLicenseReport(repoRoot: string, options?: CollectPnpmLicenseReportOptions): PnpmLicenseReport;
+export declare function collectPnpmLicenseReport(repoRoot: string, options?: CollectPnpmLicenseReportOptions): Promise<PnpmLicenseReport>;

package/dist/dependency-license-policy/collect.mjs

@@ -1,10 +1,13 @@
-import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { withAuditSignalCleanup } from './audit-signals.mjs';
+import { ensurePrivateLicenseAuditStore, licenseAuditStoreDirectory } from './audit-store.mjs';
+import { executePnpm } from './execute-pnpm.mjs';
 import { parsePnpmLicenseReport } from './report.mjs';
 import { preparePnpmLicenseAuditWorkspace } from './workspace.mjs';
 const DEFAULT_OPTIONS = {
-    execute: spawnSync,
+    ensureStore: ensurePrivateLicenseAuditStore,
+    execute: executePnpm,
     prepareWorkspace: preparePnpmLicenseAuditWorkspace,
     readFile: readFileSync,
 };
@@ -19,22 +22,17 @@ function assertCommandSucceeded(label, result) {
     }
 }
 /** Collects licenses for every platform represented in a pnpm lockfile. */
-export function collectPnpmLicenseReport(repoRoot, options = {}) {
-    const { execute, prepareWorkspace, readFile } = { ...DEFAULT_OPTIONS, ...options };
-    const lockfilePath = join(repoRoot, 'pnpm-lock.yaml');
-    const workspacePath = join(repoRoot, 'pnpm-workspace.yaml');
-    const auditWorkspace = prepareWorkspace(repoRoot, readFile(lockfilePath, 'utf8'), readFile(workspacePath, 'utf8'));
-    try {
-        const storeConfig = `--config.store-dir=${join(auditWorkspace.cwd, '.pnpm-store')}`;
-        const fetchResult = execute('pnpm', [storeConfig, 'fetch', '--ignore-scripts'], {
-            cwd: auditWorkspace.cwd,
-            encoding: 'utf8',
-        });
+export async function collectPnpmLicenseReport(repoRoot, options = {}) {
+    const { ensureStore, execute, prepareWorkspace, readFile } = { ...DEFAULT_OPTIONS, ...options };
+    const auditWorkspace = prepareWorkspace(repoRoot, readFile(join(repoRoot, 'pnpm-lock.yaml'), 'utf8'), readFile(join(repoRoot, 'pnpm-workspace.yaml'), 'utf8'));
+    const storeDir = options.storeDir ?? licenseAuditStoreDirectory();
+    return withAuditSignalCleanup(auditWorkspace.cleanup, async (signal) => {
+        ensureStore(storeDir);
+        const storeConfig = `--config.store-dir=${storeDir}`;
+        const commandOptions = { cwd: auditWorkspace.cwd, encoding: 'utf8', signal };
+        const fetchResult = await execute('pnpm', [storeConfig, 'fetch', '--ignore-scripts'], commandOptions);
         assertCommandSucceeded('pnpm fetch', fetchResult);
-        const result = execute('pnpm', [storeConfig, 'licenses', 'list', '--json'], {
-            cwd: auditWorkspace.cwd,
-            encoding: 'utf8',
-        });
+        const result = await execute('pnpm', [storeConfig, 'licenses', 'list', '--json'], commandOptions);
         assertCommandSucceeded('pnpm licenses list --json', result);
         try {
             return parsePnpmLicenseReport(JSON.parse(result.stdout));
@@ -44,8 +42,5 @@ export function collectPnpmLicenseReport(repoRoot, options = {}) {
                 cause: error,
             });
         }
-    }
-    finally {
-        auditWorkspace.cleanup();
-    }
+    });
 }

package/dist/dependency-license-policy/execute-pnpm.d.mts

@@ -0,0 +1,10 @@
+import type { Readable } from 'node:stream';
+import type { PnpmExecutor } from './types.mts';
+export declare function signalFromAbort(signal: AbortSignal): NodeJS.Signals;
+export declare function stopChildProcess(child: {
+    kill: (signal?: NodeJS.Signals) => boolean;
+    pid?: number | undefined;
+}, signal: NodeJS.Signals): void;
+export declare function collectChildStream(stream: Readable | null, chunks: string[], onOverflow: () => void): void;
+/** Runs pnpm in its own process group so a signal can reach it and its children. */
+export declare const executePnpm: PnpmExecutor;

package/dist/dependency-license-policy/execute-pnpm.mjs

@@ -0,0 +1,83 @@
+import { spawn } from 'node:child_process';
+const MAX_BUFFER_BYTES = 1024 * 1024;
+export function signalFromAbort(signal) {
+    if (signal.reason === 'SIGINT' || signal.reason === 'SIGTERM' || signal.reason === 'SIGHUP') {
+        return signal.reason;
+    }
+    return 'SIGTERM';
+}
+export function stopChildProcess(child, signal) {
+    if (child.pid === undefined) {
+        child.kill(signal);
+        return;
+    }
+    try {
+        process.kill(-child.pid, signal);
+    }
+    catch {
+        child.kill(signal);
+    }
+}
+export function collectChildStream(stream, chunks, onOverflow) {
+    if (stream === null)
+        throw new Error('license audit child is missing a stdio pipe');
+    stream.setEncoding('utf8');
+    stream.on('data', (chunk) => {
+        chunks.push(chunk);
+        if (Buffer.byteLength(chunks.join('')) > MAX_BUFFER_BYTES)
+            onOverflow();
+    });
+}
+function finishOnce(settle) {
+    let settled = false;
+    return (result) => {
+        if (settled)
+            return;
+        settled = true;
+        settle(result);
+    };
+}
+/** Runs pnpm in its own process group so a signal can reach it and its children. */
+export const executePnpm = (command, args, options) => new Promise((resolve) => {
+    const child = spawn(command, args, {
+        cwd: options.cwd,
+        detached: true,
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const stdout = [];
+    const stderr = [];
+    let overflow = false;
+    const stop = () => {
+        stopChildProcess(child, overflow ? 'SIGKILL' : signalFromAbort(options.signal));
+    };
+    if (options.signal.aborted)
+        stop();
+    else
+        options.signal.addEventListener('abort', stop, { once: true });
+    const markOverflow = () => {
+        overflow = true;
+        stop();
+    };
+    collectChildStream(child.stdout, stdout, markOverflow);
+    collectChildStream(child.stderr, stderr, markOverflow);
+    const finish = finishOnce((result) => {
+        options.signal.removeEventListener('abort', stop);
+        resolve(result);
+    });
+    child.once('error', (error) => {
+        finish({ error, status: null, stderr: stderr.join(''), stdout: stdout.join('') });
+    });
+    child.once('close', (status) => {
+        const result = { status, stderr: stderr.join(''), stdout: stdout.join('') };
+        if (!overflow) {
+            finish(result);
+            return;
+        }
+        finish({
+            ...result,
+            error: Object.assign(new Error('child output maxBuffer exceeded'), {
+                code: 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER',
+            }),
+        });
+    });
+});

package/dist/dependency-license-policy/types.d.mts

@@ -4,15 +4,17 @@ export interface PnpmLicenseReportEntry {
 }
 /** Shape emitted by `pnpm licenses list --json`. */
 export type PnpmLicenseReport = Record<string, PnpmLicenseReportEntry[]>;
-export type PnpmExecutor = (command: string, args: string[], options: {
-    cwd: string;
-    encoding: 'utf8';
-}) => {
-    error?: Error;
-    status: number | null;
-    stderr: string;
-    stdout: string;
-};
+export interface PnpmCommandResult {
+    readonly error?: Error;
+    readonly status: number | null;
+    readonly stderr: string;
+    readonly stdout: string;
+}
+export type PnpmExecutor = (command: string, args: readonly string[], options: {
+    readonly cwd: string;
+    readonly encoding: 'utf8';
+    readonly signal: AbortSignal;
+}) => PnpmCommandResult | Promise<PnpmCommandResult>;
 export interface DependencyLicenseAllowlistEntry {
     /** Exact SPDX atom allowed by this entry. */
     readonly licenseId: string;

package/dist/dependency-license-policy/workspace.d.mts

@@ -1,3 +1,4 @@
+import { type LicenseAuditWorkspaceOptions } from './audit-directory.mts';
 export interface PnpmLicenseAuditWorkspace {
     readonly cleanup: () => void;
     readonly cwd: string;
@@ -19,4 +20,5 @@ export declare function renderPnpmLicenseAuditFiles(lockfileSource: string, work
     lockfile: string;
     workspace: string;
 }): PnpmLicenseAuditFiles;
-export declare function preparePnpmLicenseAuditWorkspace(repoRoot: string, lockfileSource: string, workspaceSource: string): PnpmLicenseAuditWorkspace;
+export declare function licenseAuditParentDirectory(directory?: string): string;
+export declare function preparePnpmLicenseAuditWorkspace(repoRoot: string, lockfileSource: string, workspaceSource: string, options?: LicenseAuditWorkspaceOptions): PnpmLicenseAuditWorkspace;

package/dist/dependency-license-policy/workspace.mjs

@@ -1,7 +1,8 @@
-import { copyFileSync, existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdtempSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { isMap, parseDocument, stringify as stringifyYaml } from 'yaml';
+import { LICENSE_AUDIT_DIRECTORY_PREFIX, reclaimStaleLicenseAuditDirectories, removeAuditDirectory, writeAuditPid, } from './audit-directory.mjs';
 const PLATFORM_KEYS = ['os', 'cpu', 'libc'];
 function parseYamlDocument(source, path) {
     const document = parseDocument(source);
@@ -71,9 +72,15 @@ export function renderPnpmLicenseAuditFiles(lockfileSource, workspaceSource, pat
         workspace: stringifyYaml({ ...workspace, packages: [], supportedArchitectures }),
     };
 }
-export function preparePnpmLicenseAuditWorkspace(repoRoot, lockfileSource, workspaceSource) {
-    const auditRoot = mkdtempSync(join(tmpdir(), 'dependency-license-audit-'));
+export function licenseAuditParentDirectory(directory) {
+    return directory ?? tmpdir();
+}
+export function preparePnpmLicenseAuditWorkspace(repoRoot, lockfileSource, workspaceSource, options = {}) {
+    const directory = licenseAuditParentDirectory(options.directory);
+    reclaimStaleLicenseAuditDirectories(directory, options);
+    const auditRoot = mkdtempSync(join(directory, LICENSE_AUDIT_DIRECTORY_PREFIX));
     try {
+        writeAuditPid(auditRoot, options.pid);
         copyFileSync(join(repoRoot, 'package.json'), join(auditRoot, 'package.json'));
         const npmrc = join(repoRoot, '.npmrc');
         if (existsSync(npmrc))
@@ -86,11 +93,11 @@ export function preparePnpmLicenseAuditWorkspace(repoRoot, lockfileSource, works
         writeFileSync(join(auditRoot, 'pnpm-workspace.yaml'), files.workspace, 'utf8');
     }
     catch (error) {
-        rmSync(auditRoot, { force: true, recursive: true });
+        removeAuditDirectory(auditRoot);
         throw error;
     }
     return {
         cwd: auditRoot,
-        cleanup: () => rmSync(auditRoot, { force: true, recursive: true }),
+        cleanup: () => removeAuditDirectory(auditRoot),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {