vouchington-tooling 0.20.0 → 0.22.0

package/dist/config-inventory/types.d.mts

@@ -0,0 +1,96 @@
+export type EnvClassification = string;
+export interface EnvVarInventoryRow {
+    name: string;
+    classifications: EnvClassification[];
+    reviewReason: string | null;
+    contractKey: string | null;
+    contractKeys: string[];
+    sourceOfTruth: string | null;
+    sensitivity: string | null;
+    runtimeSurfaces: string[];
+    readers: string[];
+    localSetup: string[];
+    docs: string[];
+    deployment: string[];
+    dockerBuildArgs: string[];
+    workflows: string[];
+    packageGates: string[];
+}
+export interface DynamicConfigInventoryRow {
+    namespace: string;
+    definitionFiles: string[];
+    registryFiles: string[];
+}
+export interface PackageGateInventoryRow {
+    name: string;
+    values: string[];
+    files: string[];
+}
+export interface ConfigInventory {
+    envVars: EnvVarInventoryRow[];
+    dynamicConfigs: DynamicConfigInventoryRow[];
+    packageGates: PackageGateInventoryRow[];
+}
+export interface EnvVarAccumulator {
+    name: string;
+    contractKey: string | null;
+    contractKeys: Set<string>;
+    sourceOfTruth: string | null;
+    sensitivity: string | null;
+    runtimeSurfaces: Set<string>;
+    readers: Set<string>;
+    localSetup: Set<string>;
+    docs: Set<string>;
+    deployment: Set<string>;
+    dockerBuildArgs: Set<string>;
+    workflows: Set<string>;
+    packageGates: Set<string>;
+}
+export type SourceBucket = keyof Omit<EnvVarAccumulator, 'name' | 'contractKey' | 'contractKeys' | 'sourceOfTruth' | 'sensitivity' | 'runtimeSurfaces'>;
+export interface EnvVarReferenceMatcher {
+    name: string;
+    pattern: RegExp;
+}
+export interface TypedEnvContractEntry {
+    name: string;
+    contractKey?: string;
+    sourceOfTruth?: string;
+    sensitivity?: string;
+    runtimeSurfaces?: string[];
+}
+/** Discovery is opt-in by file role; the caller owns paths and exclusions. */
+export interface ConfigSourceRules {
+    workerBindings?: boolean;
+    localAssignments?: boolean;
+    shellExports?: boolean;
+    jsonBindings?: boolean;
+    docker?: boolean;
+    workflow?: boolean;
+    markdown?: boolean;
+    packageManifest?: boolean;
+    packageManagerConfig?: boolean;
+    referenceBuckets?: readonly SourceBucket[];
+}
+export interface ConfigInventoryContext {
+    trackedFiles: readonly string[];
+    /** Return null for a missing/non-text file. Reader failures propagate. */
+    readTrackedFile(file: string): string | null;
+}
+export interface DynamicConfigReference {
+    namespace: string;
+    kind: 'definition' | 'registry';
+}
+export interface ConfigInventoryOptions {
+    /** Return null to exclude a file before it is read. */
+    describeFile(file: string): ConfigSourceRules | null;
+    envContract?: readonly TypedEnvContractEntry[];
+    envConstants?: ReadonlyMap<string, string>;
+    envHelperNames?: readonly string[];
+    /** Sensitivity labels from least to most sensitive. Defaults to internal, public, secret. */
+    sensitivityOrder?: readonly string[];
+    collectDynamicConfigs?(file: string, source: string): readonly DynamicConfigReference[];
+    annotateEnv?(row: Readonly<EnvVarInventoryRow>): {
+        classifications: string[];
+        reviewReason: string | null;
+    };
+}

package/dist/config-inventory/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/contract-schema/contract-schema-bounded-array.d.mts

@@ -0,0 +1,15 @@
+import ts from './typescript-api.mts';
+import type { ContractSchemaNode } from '../openapi-document/contract-schema-types.mts';
+import type { ExtractContractSchemaOptions } from './types.mts';
+export type ExtractionContext = {
+    checker: ts.TypeChecker;
+    definitions: Map<string, ContractSchemaNode>;
+    definitionTypes: Map<string, ts.Type>;
+    activeTypes: Map<ts.Type, string>;
+    options: ExtractContractSchemaOptions;
+};
+type SchemaForType = (type: ts.Type, context: ExtractionContext) => ContractSchemaNode;
+export declare function boundedArraySchema(type: ts.Type, context: ExtractionContext, schemaForType: SchemaForType): Extract<ContractSchemaNode, {
+    type: 'array';
+}> | undefined;
+export {};

package/dist/contract-schema/contract-schema-bounded-array.mjs

@@ -0,0 +1,32 @@
+import ts from './typescript-api.mjs';
+import { unsupportedType } from './contract-schema-type-utils.mjs';
+export function boundedArraySchema(type, context, schemaForType) {
+    const alias = context.options.boundedArrayAlias;
+    if (!alias || type.aliasSymbol?.name !== alias)
+        return undefined;
+    const [itemType, minItemsType, maxItemsType, uniqueItemsType] = type.aliasTypeArguments ?? [];
+    if (!itemType || !minItemsType || !maxItemsType || !uniqueItemsType) {
+        throw unsupportedType(type, context.checker, `${alias} requires four type arguments`);
+    }
+    const minItems = numberLiteralValue(minItemsType, type, context.checker, alias);
+    const maxItems = numberLiteralValue(maxItemsType, type, context.checker, alias);
+    if (minItems < 0 || maxItems < minItems) {
+        throw unsupportedType(type, context.checker, `${alias} has invalid item bounds`);
+    }
+    if (!(uniqueItemsType.flags & ts.TypeFlags.BooleanLiteral)) {
+        throw unsupportedType(type, context.checker, `${alias} uniqueness must be literal`);
+    }
+    return {
+        type: 'array',
+        items: schemaForType(itemType, context),
+        minItems,
+        maxItems,
+        uniqueItems: uniqueItemsType.intrinsicName === 'true',
+    };
+}
+function numberLiteralValue(type, owner, checker, alias) {
+    if (!(type.flags & ts.TypeFlags.NumberLiteral)) {
+        throw unsupportedType(owner, checker, `${alias} bounds must be numeric literals`);
+    }
+    return type.value;
+}

package/dist/contract-schema/contract-schema-type-extractor.d.mts

@@ -1,11 +1,5 @@
 import ts from './typescript-api.mts';
-import type { ContractSchemaNode } from '../openapi-document/contract-schema-types.mts';
+import { type ExtractionContext } from './contract-schema-bounded-array.mts';
 import type { ExtractContractSchemaOptions, ExtractedResponseContract } from './types.mts';
-export type ExtractionContext = {
-    checker: ts.TypeChecker;
-    definitions: Map<string, ContractSchemaNode>;
-    definitionTypes: Map<string, ts.Type>;
-    activeTypes: Map<ts.Type, string>;
-    options: ExtractContractSchemaOptions;
-};
+export type { ExtractionContext };
 export declare function extractContractSchema(type: ts.Type, checker: ts.TypeChecker, source: string, options?: ExtractContractSchemaOptions): ExtractedResponseContract;

package/dist/contract-schema/contract-schema-type-extractor.mjs

@@ -1,5 +1,6 @@
 import ts from './typescript-api.mjs';
 import { hashContractSchema } from '../openapi-document/contract-schema-canonical.mjs';
+import { boundedArraySchema } from './contract-schema-bounded-array.mjs';
 import { objectSchema, tupleSchema } from './contract-schema-object-tuple.mjs';
 import { assertNotClass, distinctNodes, jsonPromiseType, jsonSerializedType, namedObjectDefinition, unsupportedType, } from './contract-schema-type-utils.mjs';
 export function extractContractSchema(type, checker, source, options = {}) {
@@ -95,7 +96,7 @@ function schemaForType(type, context) {
         return schemaForType(promisedType, context);
     if (checker.isTupleType(type))
         return tupleSchema(type, context, schemaForType);
-    const constrainedArray = boundedArraySchema(type, context);
+    const constrainedArray = boundedArraySchema(type, context, schemaForType);
     if (constrainedArray)
         return constrainedArray;
     if (checker.isArrayType(type) || checker.isArrayLikeType(type)) {
@@ -118,36 +119,6 @@ function schemaForType(type, context) {
     }
     return objectSchema(type, context, schemaForType);
 }
-function boundedArraySchema(type, context) {
-    const alias = context.options.boundedArrayAlias;
-    if (!alias || type.aliasSymbol?.name !== alias)
-        return undefined;
-    const [itemType, minItemsType, maxItemsType, uniqueItemsType] = type.aliasTypeArguments ?? [];
-    if (!itemType || !minItemsType || !maxItemsType || !uniqueItemsType) {
-        throw unsupportedType(type, context.checker, `${alias} requires four type arguments`);
-    }
-    const minItems = numberLiteralValue(minItemsType, type, context.checker, alias);
-    const maxItems = numberLiteralValue(maxItemsType, type, context.checker, alias);
-    if (minItems < 0 || maxItems < minItems) {
-        throw unsupportedType(type, context.checker, `${alias} has invalid item bounds`);
-    }
-    if (!(uniqueItemsType.flags & ts.TypeFlags.BooleanLiteral)) {
-        throw unsupportedType(type, context.checker, `${alias} uniqueness must be literal`);
-    }
-    return {
-        type: 'array',
-        items: schemaForType(itemType, context),
-        minItems,
-        maxItems,
-        uniqueItems: uniqueItemsType.intrinsicName === 'true',
-    };
-}
-function numberLiteralValue(type, owner, checker, alias) {
-    if (!(type.flags & ts.TypeFlags.NumberLiteral)) {
-        throw unsupportedType(owner, checker, `${alias} bounds must be numeric literals`);
-    }
-    return type.value;
-}
 function schemaForNamedType(type, name, context, build) {
     const existingType = context.definitionTypes.get(name);
     /* v8 ignore start -- distinct checker types sharing a definition name */

package/dist/coverage-transport/control-v2-parse-object.d.mts

@@ -0,0 +1,12 @@
+import { type PrefixTransportIdentity } from './keys.mts';
+type DownloadedTransportObject = {
+    readonly key: string;
+    readonly url: string;
+    readonly attempt: number;
+    readonly byteLength: number;
+};
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function exactKeys(value: Record<string, unknown>, keys: readonly string[]): boolean;
+export declare function validUrl(value: unknown): value is string;
+export declare function parseObject(raw: unknown, expected: PrefixTransportIdentity, suite: string, kind: 'lcov' | 'manifest' | 'blob'): DownloadedTransportObject;
+export {};

package/dist/coverage-transport/control-v2-parse-object.mjs

@@ -0,0 +1,28 @@
+import { DEFAULT_MAX_BODY_BYTES } from './constants.mjs';
+import { parseTransportObjectKey } from './keys.mjs';
+export function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function exactKeys(value, keys) {
+    return Object.keys(value).toSorted().join('\0') === keys.toSorted().join('\0');
+}
+export function validUrl(value) {
+    return typeof value === 'string' && URL.canParse(value) && /^https?:/i.test(value);
+}
+export function parseObject(raw, expected, suite, kind) {
+    if (!isRecord(raw) ||
+        !exactKeys(raw, ['attempt', 'byteLength', 'key', 'url']) ||
+        !validUrl(raw.url) ||
+        typeof raw.key !== 'string' ||
+        typeof raw.attempt !== 'number' ||
+        typeof raw.byteLength !== 'number' ||
+        !Number.isSafeInteger(raw.attempt) ||
+        !Number.isSafeInteger(raw.byteLength) ||
+        raw.byteLength < 0 ||
+        raw.byteLength > DEFAULT_MAX_BODY_BYTES)
+        throw new Error('Discovered transport object is invalid');
+    const parsed = parseTransportObjectKey(raw.key, expected);
+    if (!parsed || parsed.suite !== suite || parsed.kind !== kind || parsed.attempt !== raw.attempt)
+        throw new Error('Discovered transport object key is invalid');
+    return raw;
+}

package/dist/coverage-transport/control-v2.mjs

@@ -1,15 +1,7 @@
 import { VITEST_SUITE_PATTERN } from '../vitest-blob-manifest/index.mjs';
 import { DEFAULT_MAX_BODY_BYTES } from './constants.mjs';
-import { assertPrefixTransportIdentity, parseTransportObjectKey, transportPrefix, } from './keys.mjs';
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function exactKeys(value, keys) {
-    return Object.keys(value).toSorted().join('\0') === keys.toSorted().join('\0');
-}
-function validUrl(value) {
-    return typeof value === 'string' && URL.canParse(value) && /^https?:/i.test(value);
-}
+import { exactKeys, isRecord, parseObject, validUrl } from './control-v2-parse-object.mjs';
+import { assertPrefixTransportIdentity, transportPrefix, } from './keys.mjs';
 function identity(raw) {
     if (!isRecord(raw.run) || !exactKeys(raw.run, ['id', 'controlAttempt']))
         return null;
@@ -32,23 +24,6 @@ function identity(raw) {
     }
     return result;
 }
-function parseObject(raw, expected, suite, kind) {
-    if (!isRecord(raw) ||
-        !exactKeys(raw, ['attempt', 'byteLength', 'key', 'url']) ||
-        !validUrl(raw.url) ||
-        typeof raw.key !== 'string' ||
-        typeof raw.attempt !== 'number' ||
-        typeof raw.byteLength !== 'number' ||
-        !Number.isSafeInteger(raw.attempt) ||
-        !Number.isSafeInteger(raw.byteLength) ||
-        raw.byteLength < 0 ||
-        raw.byteLength > DEFAULT_MAX_BODY_BYTES)
-        throw new Error('Discovered transport object is invalid');
-    const parsed = parseTransportObjectKey(raw.key, expected);
-    if (!parsed || parsed.suite !== suite || parsed.kind !== kind || parsed.attempt !== raw.attempt)
-        throw new Error('Discovered transport object key is invalid');
-    return raw;
-}
 function parseDownloadMap(raw, expected, kind) {
     if (!isRecord(raw))
         throw new Error('Discovered transport object map is invalid');

package/dist/dependency-license-policy/audit-directory.d.mts

@@ -0,0 +1,28 @@
+export declare const LICENSE_AUDIT_DIRECTORY_PREFIX = "dependency-license-audit-";
+export interface LicenseAuditReclaimOptions {
+    readonly graceMs?: number;
+    readonly isOwnerAlive?: (pid: number, directoryMtimeMs: number) => boolean;
+    readonly now?: number;
+}
+export interface LicenseAuditWorkspaceOptions extends LicenseAuditReclaimOptions {
+    readonly directory?: string;
+    readonly pid?: number;
+}
+interface OwnerAliveDependencies {
+    readonly isProcessAlive?: (pid: number) => boolean;
+    readonly readProcessStartMs?: (pid: number) => number | undefined;
+}
+/** Parses `ps -o lstart=` output. Exported for tests of unparseable dates. */
+export declare function parseProcessStart(stdout: string): number | undefined;
+export declare function readProcessStartMs(pid: number): number | undefined;
+export declare function isProcessAlive(pid: number): boolean;
+/**
+ * A directory still belongs to its creator when that PID is alive and the process started
+ * before the directory. A recycled PID belongs to a newer process and is not the owner.
+ */
+export declare function isAuditOwnerAlive(pid: number, directoryMtimeMs: number, dependencies?: OwnerAliveDependencies): boolean;
+export declare function writeAuditPid(directory: string, pid?: number): void;
+export declare function removeAuditDirectory(directory: string): void;
+/** Deletes leftover audit directories whose owner process is gone, including after SIGKILL. */
+export declare function reclaimStaleLicenseAuditDirectories(directory: string, options?: LicenseAuditReclaimOptions): void;
+export {};

package/dist/dependency-license-policy/audit-directory.mjs

@@ -0,0 +1,115 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, lstatSync, readdirSync, readFileSync, rmSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { join } from 'node:path';
+export const LICENSE_AUDIT_DIRECTORY_PREFIX = 'dependency-license-audit-';
+const LICENSE_AUDIT_PID_FILE = 'audit.pid';
+const STALE_AUDIT_GRACE_MS = 60_000;
+const OWNER_START_SLACK_MS = 1_000;
+const MAX_PID = 2_147_483_647;
+function hasCode(error, code) {
+    return Boolean(error && typeof error === 'object' && 'code' in error && error.code === code);
+}
+/** Parses `ps -o lstart=` output. Exported for tests of unparseable dates. */
+export function parseProcessStart(stdout) {
+    const parsed = Date.parse(stdout.trim());
+    if (Number.isNaN(parsed))
+        return undefined;
+    return parsed;
+}
+export function readProcessStartMs(pid) {
+    const result = spawnSync('ps', ['-p', String(pid), '-o', 'lstart='], { encoding: 'utf8' });
+    if (result.status !== 0)
+        return undefined;
+    return parseProcessStart(result.stdout);
+}
+export function isProcessAlive(pid) {
+    if (!Number.isSafeInteger(pid) || pid <= 0 || pid > MAX_PID)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return !hasCode(error, 'ESRCH');
+    }
+}
+/**
+ * A directory still belongs to its creator when that PID is alive and the process started
+ * before the directory. A recycled PID belongs to a newer process and is not the owner.
+ */
+export function isAuditOwnerAlive(pid, directoryMtimeMs, dependencies = {}) {
+    if (!(dependencies.isProcessAlive ?? isProcessAlive)(pid))
+        return false;
+    const started = (dependencies.readProcessStartMs ?? readProcessStartMs)(pid);
+    if (started === undefined)
+        return true;
+    return started <= directoryMtimeMs + OWNER_START_SLACK_MS;
+}
+export function writeAuditPid(directory, pid = process.pid) {
+    const path = join(directory, LICENSE_AUDIT_PID_FILE);
+    writeFileSync(path, `${String(pid)}\n`, { encoding: 'utf8', mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+function readAuditPid(directory) {
+    try {
+        const text = readFileSync(join(directory, LICENSE_AUDIT_PID_FILE), 'utf8').trim();
+        if (!/^[1-9]\d*$/.test(text))
+            return undefined;
+        const pid = Number.parseInt(text, 10);
+        return Number.isSafeInteger(pid) && pid <= MAX_PID ? pid : undefined;
+    }
+    catch (error) {
+        if (hasCode(error, 'ENOENT'))
+            return undefined;
+        throw error;
+    }
+}
+export function removeAuditDirectory(directory) {
+    const stat = lstatSync(directory, { throwIfNoEntry: false });
+    if (!stat)
+        return;
+    if (stat.isSymbolicLink()) {
+        unlinkSync(directory);
+        return;
+    }
+    if (!stat.isDirectory())
+        return;
+    rmSync(directory, { force: true, recursive: true });
+}
+function reclaimNames(directory) {
+    try {
+        return readdirSync(directory, { encoding: 'utf8' });
+    }
+    catch (error) {
+        if (hasCode(error, 'ENOENT'))
+            return [];
+        throw error;
+    }
+}
+function shouldRemoveAuditDirectory(directory, mtimeMs, now, graceMs, isOwnerAlive) {
+    const pid = readAuditPid(directory);
+    if (pid === undefined)
+        return now - mtimeMs >= graceMs;
+    return !isOwnerAlive(pid, mtimeMs);
+}
+/** Deletes leftover audit directories whose owner process is gone, including after SIGKILL. */
+export function reclaimStaleLicenseAuditDirectories(directory, options = {}) {
+    const now = options.now ?? Date.now();
+    const graceMs = options.graceMs ?? STALE_AUDIT_GRACE_MS;
+    const isOwnerAlive = options.isOwnerAlive ?? isAuditOwnerAlive;
+    for (const name of reclaimNames(directory)) {
+        if (!name.startsWith(LICENSE_AUDIT_DIRECTORY_PREFIX))
+            continue;
+        const path = join(directory, name);
+        const stat = lstatSync(path);
+        if (stat.isSymbolicLink()) {
+            unlinkSync(path);
+            continue;
+        }
+        if (!stat.isDirectory())
+            continue;
+        if (shouldRemoveAuditDirectory(path, stat.mtimeMs, now, graceMs, isOwnerAlive)) {
+            rmSync(path, { force: true, recursive: true });
+        }
+    }
+}

package/dist/dependency-license-policy/audit-signals.d.mts

@@ -0,0 +1,12 @@
+type SignalListener = () => void;
+export interface AuditSignalDependencies {
+    readonly raiseSignal?: (signal: NodeJS.Signals) => void;
+    readonly subscribe?: (signal: NodeJS.Signals, listener: SignalListener) => void;
+    readonly unsubscribe?: (signal: NodeJS.Signals, listener: SignalListener) => void;
+}
+/**
+ * Runs an audit while SIGINT, SIGTERM, and SIGHUP abort it, remove its workspace, and are raised
+ * again so the process still exits from that signal.
+ */
+export declare function withAuditSignalCleanup<T>(cleanup: () => void, run: (signal: AbortSignal) => Promise<T>, dependencies?: AuditSignalDependencies): Promise<T>;
+export {};

package/dist/dependency-license-policy/audit-signals.mjs

@@ -0,0 +1,44 @@
+const AUDIT_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+/**
+ * Runs an audit while SIGINT, SIGTERM, and SIGHUP abort it, remove its workspace, and are raised
+ * again so the process still exits from that signal.
+ */
+export async function withAuditSignalCleanup(cleanup, run, dependencies = {}) {
+    const controller = new AbortController();
+    let raised;
+    const handlers = AUDIT_SIGNALS.map((signal) => {
+        const listener = () => {
+            if (raised !== undefined)
+                return;
+            raised = signal;
+            controller.abort(signal);
+        };
+        if (dependencies.subscribe)
+            dependencies.subscribe(signal, listener);
+        else
+            process.on(signal, listener);
+        return { listener, signal };
+    });
+    try {
+        return await run(controller.signal);
+    }
+    finally {
+        for (const { listener, signal } of handlers) {
+            if (dependencies.unsubscribe)
+                dependencies.unsubscribe(signal, listener);
+            else
+                process.removeListener(signal, listener);
+        }
+        try {
+            cleanup();
+        }
+        finally {
+            if (raised !== undefined) {
+                if (dependencies.raiseSignal)
+                    dependencies.raiseSignal(raised);
+                else
+                    process.kill(process.pid, raised);
+            }
+        }
+    }
+}

package/dist/dependency-license-policy/audit-store.d.mts

@@ -0,0 +1,12 @@
+export interface DirectoryIdentity {
+    readonly isDirectory: () => boolean;
+    readonly isSymbolicLink: () => boolean;
+    readonly mode: number;
+    readonly uid: number;
+}
+/** pnpm's cache directory. The audit store stays beside it so it is not the developer store. */
+export declare function pnpmCacheDirectory(env?: NodeJS.ProcessEnv, home?: string, hostPlatform?: NodeJS.Platform): string;
+export declare function licenseAuditStoreDirectory(env?: NodeJS.ProcessEnv, home?: string, hostPlatform?: NodeJS.Platform): string;
+export declare function assertOwnedDirectory(stat: DirectoryIdentity, uid: number | undefined, directory: string): void;
+/** Creates the dedicated content-addressed store used by repeat license audits. */
+export declare function ensurePrivateLicenseAuditStore(directory: string): void;

package/dist/dependency-license-policy/audit-store.mjs

@@ -0,0 +1,32 @@
+import { chmodSync, lstatSync, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const STORE_DIRECTORY_NAME = 'dependency-license-audit-store';
+/** pnpm's cache directory. The audit store stays beside it so it is not the developer store. */
+export function pnpmCacheDirectory(env = process.env, home = homedir(), hostPlatform = process.platform) {
+    if (hostPlatform === 'darwin')
+        return join(home, 'Library', 'Caches', 'pnpm');
+    if (hostPlatform === 'win32') {
+        return join(env.LOCALAPPDATA ?? join(home, 'AppData', 'Local'), 'pnpm-cache');
+    }
+    return join(env.XDG_CACHE_HOME ?? join(home, '.cache'), 'pnpm');
+}
+export function licenseAuditStoreDirectory(env = process.env, home = homedir(), hostPlatform = process.platform) {
+    return join(pnpmCacheDirectory(env, home, hostPlatform), STORE_DIRECTORY_NAME);
+}
+export function assertOwnedDirectory(stat, uid, directory) {
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new Error(`dependency license audit store is not a real directory: ${directory}`);
+    }
+    if (uid !== undefined && stat.uid !== uid) {
+        throw new Error(`dependency license audit store is not owned by the current user: ${directory}`);
+    }
+}
+/** Creates the dedicated content-addressed store used by repeat license audits. */
+export function ensurePrivateLicenseAuditStore(directory) {
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(directory);
+    assertOwnedDirectory(stat, process.getuid?.(), directory);
+    if ((stat.mode & 0o077) !== 0)
+        chmodSync(directory, 0o700);
+}

package/dist/dependency-license-policy/collect.d.mts

@@ -1,9 +1,11 @@
 import type { PnpmExecutor, PnpmLicenseReport } from './types.mts';
 import { type PnpmLicenseAuditWorkspace } from './workspace.mts';
 export interface CollectPnpmLicenseReportOptions {
+    readonly ensureStore?: (directory: string) => void;
     readonly execute?: PnpmExecutor;
     readonly prepareWorkspace?: (repoRoot: string, lockfileSource: string, workspaceSource: string) => PnpmLicenseAuditWorkspace;
     readonly readFile?: (path: string, encoding: 'utf8') => string;
+    readonly storeDir?: string;
 }
 /** Collects licenses for every platform represented in a pnpm lockfile. */
-export declare function collectPnpmLicenseReport(repoRoot: string, options?: CollectPnpmLicenseReportOptions): PnpmLicenseReport;
+export declare function collectPnpmLicenseReport(repoRoot: string, options?: CollectPnpmLicenseReportOptions): Promise<PnpmLicenseReport>;

package/dist/dependency-license-policy/collect.mjs

@@ -1,10 +1,13 @@
-import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { withAuditSignalCleanup } from './audit-signals.mjs';
+import { ensurePrivateLicenseAuditStore, licenseAuditStoreDirectory } from './audit-store.mjs';
+import { executePnpm } from './execute-pnpm.mjs';
 import { parsePnpmLicenseReport } from './report.mjs';
 import { preparePnpmLicenseAuditWorkspace } from './workspace.mjs';
 const DEFAULT_OPTIONS = {
-    execute: spawnSync,
+    ensureStore: ensurePrivateLicenseAuditStore,
+    execute: executePnpm,
     prepareWorkspace: preparePnpmLicenseAuditWorkspace,
     readFile: readFileSync,
 };
@@ -19,22 +22,17 @@ function assertCommandSucceeded(label, result) {
     }
 }
 /** Collects licenses for every platform represented in a pnpm lockfile. */
-export function collectPnpmLicenseReport(repoRoot, options = {}) {
-    const { execute, prepareWorkspace, readFile } = { ...DEFAULT_OPTIONS, ...options };
-    const lockfilePath = join(repoRoot, 'pnpm-lock.yaml');
-    const workspacePath = join(repoRoot, 'pnpm-workspace.yaml');
-    const auditWorkspace = prepareWorkspace(repoRoot, readFile(lockfilePath, 'utf8'), readFile(workspacePath, 'utf8'));
-    try {
-        const storeConfig = `--config.store-dir=${join(auditWorkspace.cwd, '.pnpm-store')}`;
-        const fetchResult = execute('pnpm', [storeConfig, 'fetch', '--ignore-scripts'], {
-            cwd: auditWorkspace.cwd,
-            encoding: 'utf8',
-        });
+export async function collectPnpmLicenseReport(repoRoot, options = {}) {
+    const { ensureStore, execute, prepareWorkspace, readFile } = { ...DEFAULT_OPTIONS, ...options };
+    const auditWorkspace = prepareWorkspace(repoRoot, readFile(join(repoRoot, 'pnpm-lock.yaml'), 'utf8'), readFile(join(repoRoot, 'pnpm-workspace.yaml'), 'utf8'));
+    const storeDir = options.storeDir ?? licenseAuditStoreDirectory();
+    return withAuditSignalCleanup(auditWorkspace.cleanup, async (signal) => {
+        ensureStore(storeDir);
+        const storeConfig = `--config.store-dir=${storeDir}`;
+        const commandOptions = { cwd: auditWorkspace.cwd, encoding: 'utf8', signal };
+        const fetchResult = await execute('pnpm', [storeConfig, 'fetch', '--ignore-scripts'], commandOptions);
         assertCommandSucceeded('pnpm fetch', fetchResult);
-        const result = execute('pnpm', [storeConfig, 'licenses', 'list', '--json'], {
-            cwd: auditWorkspace.cwd,
-            encoding: 'utf8',
-        });
+        const result = await execute('pnpm', [storeConfig, 'licenses', 'list', '--json'], commandOptions);
         assertCommandSucceeded('pnpm licenses list --json', result);
         try {
             return parsePnpmLicenseReport(JSON.parse(result.stdout));
@@ -44,8 +42,5 @@ export function collectPnpmLicenseReport(repoRoot, options = {}) {
                 cause: error,
             });
         }
-    }
-    finally {
-        auditWorkspace.cleanup();
-    }
+    });
 }

package/dist/dependency-license-policy/execute-pnpm.d.mts

@@ -0,0 +1,10 @@
+import type { Readable } from 'node:stream';
+import type { PnpmExecutor } from './types.mts';
+export declare function signalFromAbort(signal: AbortSignal): NodeJS.Signals;
+export declare function stopChildProcess(child: {
+    kill: (signal?: NodeJS.Signals) => boolean;
+    pid?: number | undefined;
+}, signal: NodeJS.Signals): void;
+export declare function collectChildStream(stream: Readable | null, chunks: string[], onOverflow: () => void): void;
+/** Runs pnpm in its own process group so a signal can reach it and its children. */
+export declare const executePnpm: PnpmExecutor;