vouchington-tooling 0.3.5 → 0.4.0

package/dist/gha-workspace-policy/sparse-checkout.mjs

@@ -0,0 +1,28 @@
+import { visitRunSteps } from './shared.mjs';
+const SPARSE_CHECKOUT_KEYS = ['sparse-checkout', 'sparse-checkout-cone-mode'];
+const SPARSE_CHECKOUT_COMMANDS = [
+    /\bgit\b[^\n;&|]*\bsparse-checkout\s+(?:init|set|add|reapply)\b/iu,
+    /\bgit\b[^\n;&|]*\bconfig\b[^\n;&|]*\bcore\.sparseCheckout(?:Cone)?(?:\s*=\s*|\s+)(?:"|')?(?:true|yes|on|1)(?:"|')?(?=\s|;|$)/iu,
+];
+export function checkNoSparseCheckoutDocument(file, document, kind, errors) {
+    visitRunSteps(document, kind === 'action', (scope, index, step) => {
+        const run = step.run;
+        const normalizedRun = typeof run === 'string' ? run.replace(/\\\r?\n\s*/gu, ' ') : '';
+        if (SPARSE_CHECKOUT_COMMANDS.some((pattern) => pattern.test(normalizedRun))) {
+            errors.push(`::error file=${file}::${file}: ${scope} step ${index} enables sparse checkout. ` +
+                'Use a full checkout; commands that disable or unset sparse-checkout state remain allowed.');
+        }
+        if (typeof step.uses !== 'string' || !step.uses.startsWith('actions/checkout@'))
+            return;
+        const withValue = step.with;
+        if (!withValue || typeof withValue !== 'object')
+            return;
+        for (const key of SPARSE_CHECKOUT_KEYS) {
+            if (!(key in withValue))
+                continue;
+            errors.push(`::error file=${file}::${file}: ${scope} step ${index} passes "${key}" to ` +
+                'actions/checkout. Persistent runners reuse workspace directories, so leaked ' +
+                'sparse-checkout state can silently narrow a later checkout. Check out the full tree.');
+        }
+    });
+}

package/dist/index.d.mts

@@ -15,6 +15,8 @@ export type { ForeignKey, SqlCreateIndexMetadata, SqlCreateTableColumn, SqlCreat
 export { dollarQuoteEnd, lineOf, maskSqlQuotedText, readDollarQuoteDelimiter, readStringLiteral, splitSqlStatements, sqlFragments, stripSqlComments, } from './sql-scanner/index.mts';
 export { auditCiJobRuntime, parseWorkflowNameMatch } from './gha-runtime-audit/index.mts';
 export type { GhApiExecutor, RuntimeAuditOptions, RuntimeAuditResult, RuntimeAuditWorkflowFilter, RuntimeJobResult, RuntimeSample, } from './gha-runtime-audit/index.mts';
+export { checkGhaWorkspacePolicy } from './gha-workspace-policy/index.mts';
+export type { GhaWorkspacePolicyOptions } from './gha-workspace-policy/index.mts';
 export { createVitestBlobManifest, createVitestReportAttempt, inspectVitestBlobBundle, parseVitestBlobManifest, parseVitestReportAttempt, readVitestReportAttempts, serializeVitestBlobManifest, serializeVitestReportAttempt, VITEST_BLOB_MANIFEST_FILENAME, VITEST_BLOB_MANIFEST_VERSION, VITEST_REPORT_ATTEMPT_PREFIX, VITEST_REPORT_ATTEMPT_VERSION, vitestBlobBundlePaths, writeVitestBlobManifest, writeVitestReportAttempt, } from './vitest-blob-manifest/index.mts';
 export type { InspectedVitestBlobBundle, VitestBlobIdentity, VitestBlobManifest, VitestReportAttempt, VitestReportAttemptIdentity, } from './vitest-blob-manifest/index.mts';
 export { prepareVitestReports } from './vitest-blob-manifest/reports.mts';
@@ -45,8 +47,12 @@ export { parseAstGrepRuleArgs, runAstGrepRule } from './ast-grep-rule/index.mts'
 export type { AstGrepRuleInvocation, RunAstGrepRuleOptions } from './ast-grep-rule/index.mts';
 export { indexReviewFiles, MAX_REVIEW_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES, nearestReviewLine, parsePatchCommentable, parseReviewFilesJson, parseReviewPayload, readRegularReviewPayload, remapReviewComments, ReviewPayloadError, reviewCommentSubject, rewriteSnappedSuggestion, snapReviewNote, stageReviewPayload, writeStagedOutput, } from './gha-review-payload/index.mts';
 export type { CommentableIndex, CommentableLine, LineKind, PayloadRequirement, ReviewComment, ReviewFile, ReviewSide, SanitizedReview, } from './gha-review-payload/index.mts';
-export { CLAUDE_OIDC_AUDIENCE, createActionsClaudeTokenIo, mintClaudeAppToken, PostReviewError, requireEnv, resolveReviewPostToken, revokeClaudeAppToken, runPostReview, runPostReviewCli, withClaudeAppToken, } from './gha-post-review/index.mts';
-export type { ClaudeTokenIo, PostResult, PostReviewIo, PullFile, ReviewPostToken, } from './gha-post-review/index.mts';
+export { PostReviewError, requireEnv, runPostReview, runPostReviewCli, postReviewWithTokenFromEnv, } from './gha-post-review/index.mts';
+export type { PostResult, PostReviewIo, PullFile } from './gha-post-review/index.mts';
+/** @deprecated Import Claude helpers from vouchington-tooling/gha-claude-post-review. */
+export { CLAUDE_OIDC_AUDIENCE, createActionsClaudeTokenIo, mintClaudeAppToken, resolveReviewPostToken, revokeClaudeAppToken, withClaudeAppToken, } from './gha-post-review/index.mts';
+/** @deprecated Import Claude helpers from vouchington-tooling/gha-claude-post-review. */
+export type { ClaudeTokenIo, ReviewPostToken } from './gha-post-review/index.mts';
 export { nextPageCursorFromLinkHeader, nextPageUrlFromLinkHeader, validatePaginationRequestUrl, } from './http-link-pagination/index.mts';
 export { cmdDownloadCoverage, cmdDownloadVitestBlobs, cmdUpload, mintPresignedControl, transportObjectKeys, } from './coverage-transport/index.mts';
 export type { ExpectedTransportIdentity, ObjectSigner, PresignIdentity, TransportControl, } from './coverage-transport/index.mts';

package/dist/index.mjs

@@ -8,6 +8,7 @@ export { EphemeralListenerAttemptsExhaustedError, isRunnerReservedPort, listenOn
 export { extractAlterTableAddColumnLocations, extractCreateIndexMetadata, extractCreateTableMetadata, extractDefaultFunction, extractDropIndexMetadata, extractFuncCallArgColumnNames, extractMigrationConstraintMetadata, initSqlAst, lineOfUtf8ByteOffset, MissingSqlAstParserError, parseSql, } from './sql-ast/index.mjs';
 export { dollarQuoteEnd, lineOf, maskSqlQuotedText, readDollarQuoteDelimiter, readStringLiteral, splitSqlStatements, sqlFragments, stripSqlComments, } from './sql-scanner/index.mjs';
 export { auditCiJobRuntime, parseWorkflowNameMatch } from './gha-runtime-audit/index.mjs';
+export { checkGhaWorkspacePolicy } from './gha-workspace-policy/index.mjs';
 export { createVitestBlobManifest, createVitestReportAttempt, inspectVitestBlobBundle, parseVitestBlobManifest, parseVitestReportAttempt, readVitestReportAttempts, serializeVitestBlobManifest, serializeVitestReportAttempt, VITEST_BLOB_MANIFEST_FILENAME, VITEST_BLOB_MANIFEST_VERSION, VITEST_REPORT_ATTEMPT_PREFIX, VITEST_REPORT_ATTEMPT_VERSION, vitestBlobBundlePaths, writeVitestBlobManifest, writeVitestReportAttempt, } from './vitest-blob-manifest/index.mjs';
 export { prepareVitestReports } from './vitest-blob-manifest/reports.mjs';
 export { findWorkspaceLinkMismatches, formatReleaseAgeFailure, INSTALL_TERMINATION_FAILED, isReleaseAgeViolation, parseInstallOptions, parseReleaseAgeViolations, runInstallLifecycle, } from './pnpm-install/index.mjs';
@@ -25,7 +26,9 @@ export { escapeSpreadsheetFormula, parseCsvRows, streamCsvRows, stripCsvBom } fr
 export { MissingResponseBodyError, readResponseBody, readResponseBodyAsBuffer, ResponseBodyTooLargeError, } from './http-body/index.mjs';
 export { parseAstGrepRuleArgs, runAstGrepRule } from './ast-grep-rule/index.mjs';
 export { indexReviewFiles, MAX_REVIEW_COMMENTS, MAX_REVIEW_PAYLOAD_BYTES, nearestReviewLine, parsePatchCommentable, parseReviewFilesJson, parseReviewPayload, readRegularReviewPayload, remapReviewComments, ReviewPayloadError, reviewCommentSubject, rewriteSnappedSuggestion, snapReviewNote, stageReviewPayload, writeStagedOutput, } from './gha-review-payload/index.mjs';
-export { CLAUDE_OIDC_AUDIENCE, createActionsClaudeTokenIo, mintClaudeAppToken, PostReviewError, requireEnv, resolveReviewPostToken, revokeClaudeAppToken, runPostReview, runPostReviewCli, withClaudeAppToken, } from './gha-post-review/index.mjs';
+export { PostReviewError, requireEnv, runPostReview, runPostReviewCli, postReviewWithTokenFromEnv, } from './gha-post-review/index.mjs';
+/** @deprecated Import Claude helpers from vouchington-tooling/gha-claude-post-review. */
+export { CLAUDE_OIDC_AUDIENCE, createActionsClaudeTokenIo, mintClaudeAppToken, resolveReviewPostToken, revokeClaudeAppToken, withClaudeAppToken, } from './gha-post-review/index.mjs';
 export { nextPageCursorFromLinkHeader, nextPageUrlFromLinkHeader, validatePaginationRequestUrl, } from './http-link-pagination/index.mjs';
 export { cmdDownloadCoverage, cmdDownloadVitestBlobs, cmdUpload, mintPresignedControl, transportObjectKeys, } from './coverage-transport/index.mjs';
 export { EPOCH_PRUNED_AT, normalizeDeployedLayer, pruneDeployedRuntimeDeps, restoreDeployedWorkspacePackages, } from './pnpm-deploy/index.mjs';

package/dist/pnpm-install/install-operations.d.mts

@@ -2,3 +2,4 @@ import { type CommandResult, type InstallOptions } from './support.mts';
 export declare function withScriptPolicy(args: string[], installScripts: boolean): string[];
 export declare function install(args: string[], options: InstallOptions, label: string): Promise<void>;
 export declare function reconcileOrFail(options: InstallOptions, runCapture: (args: string[]) => Promise<CommandResult>): Promise<void>;
+export declare function repairIsolatedNativeMismatch(options: InstallOptions, runCapture: (args: string[]) => Promise<CommandResult>, mismatchedNativePaths: string[]): Promise<boolean>;

package/dist/pnpm-install/install-operations.mjs

@@ -1,8 +1,10 @@
 import { scheduler } from 'node:timers/promises';
 import { runPnpm } from './exec.mjs';
+import { nativeBinariesMatchRuntime, repairedNativeBinariesMatchRuntime } from './native-health.mjs';
+import { buildLedgersAllowNativeRepair } from './pending-builds.mjs';
 import { INSTALL_TERMINATION_FAILED } from './process.mjs';
 import { formatReleaseAgeFailure, isReleaseAgeViolation } from './release-age.mjs';
-import { baseInstallArgs, findWorkspaceLinkMismatches, logWorkspaceLinkMismatches, } from './support.mjs';
+import { findWorkspaceLinkMismatches, forcedInstallArgs, logWorkspaceLinkMismatches, } from './support.mjs';
 function fail(message) {
     throw new Error(message);
 }
@@ -27,12 +29,30 @@ export async function install(args, options, label) {
     fail(`${label} failed after ${options.maxAttempts} attempt${options.maxAttempts === 1 ? '' : 's'}`);
 }
 export async function reconcileOrFail(options, runCapture) {
-    const forced = ['install', '--frozen-lockfile', '--force', ...baseInstallArgs.slice(2)];
-    await install([...forced, '--ignore-scripts', '--ignore-pnpmfile'], options, 'script-free reconciliation');
-    await install(withScriptPolicy(forced, options.installScripts), options, 'strict persistent reconciliation');
-    const remaining = await findWorkspaceLinkMismatches(runCapture);
+    await install([...forcedInstallArgs, '--ignore-scripts', '--ignore-pnpmfile'], options, 'script-free reconciliation');
+    await install(withScriptPolicy(forcedInstallArgs, options.installScripts), options, 'strict persistent reconciliation');
+    await verifyInstallHealth(runCapture, 'persistent reconciliation');
+}
+async function verifyInstallHealth(runCapture, phase, repairedNativePaths = []) {
+    const [nativesMatch, remaining] = await Promise.all([
+        repairedNativePaths.length > 0
+            ? repairedNativeBinariesMatchRuntime(repairedNativePaths)
+            : nativeBinariesMatchRuntime(),
+        findWorkspaceLinkMismatches(runCapture),
+    ]);
+    if (!nativesMatch)
+        fail(`${phase} completed with mismatched native binaries`);
     if (remaining.length > 0) {
         logWorkspaceLinkMismatches(remaining);
-        fail('persistent reconciliation completed with invalid workspace links');
+        fail(`${phase} completed with invalid workspace links`);
     }
 }
+export async function repairIsolatedNativeMismatch(options, runCapture, mismatchedNativePaths) {
+    if (!(await buildLedgersAllowNativeRepair()))
+        return false;
+    if ((await findWorkspaceLinkMismatches(runCapture)).length > 0)
+        return false;
+    await install(withScriptPolicy(forcedInstallArgs, options.installScripts), options, 'native health reconciliation');
+    await verifyInstallHealth(runCapture, 'native health reconciliation', mismatchedNativePaths);
+    return true;
+}

package/dist/pnpm-install/native-health.d.mts

@@ -1,4 +1,6 @@
 export type NativeFamily = 'elf' | 'macho' | 'pe';
 export declare function nativeFamilyFromMagic(buffer: Buffer): NativeFamily | undefined;
 export declare function expectedNativeFamily(platform?: NodeJS.Platform): NativeFamily | undefined;
+export declare function mismatchedNativeBinaries(root?: string, platform?: NodeJS.Platform): Promise<string[]>;
 export declare function nativeBinariesMatchRuntime(root?: string, platform?: NodeJS.Platform): Promise<boolean>;
+export declare function repairedNativeBinariesMatchRuntime(paths: string[], platform?: NodeJS.Platform): Promise<boolean>;

package/dist/pnpm-install/native-health.mjs

@@ -58,27 +58,43 @@ async function searchRoot(nodeModules) {
         return nodeModules;
     }
 }
-export async function nativeBinariesMatchRuntime(root = process.cwd(), platform = process.platform) {
+export async function mismatchedNativeBinaries(root = process.cwd(), platform = process.platform) {
     const expected = expectedNativeFamily(platform);
     if (expected === undefined)
-        return true;
+        return [];
     const nodeModules = path.join(root, 'node_modules');
     try {
         const info = await stat(nodeModules);
         if (!info.isDirectory())
-            return true;
+            return [];
     }
     catch {
-        return true;
+        return [];
     }
     const cwd = await searchRoot(nodeModules);
+    const mismatches = [];
     for await (const relative of glob('**/*.{node,bin}', { cwd })) {
-        const magic = await readMagic(path.join(cwd, relative));
+        const pathname = path.join(cwd, relative);
+        const magic = await readMagic(pathname);
         if (magic === undefined)
             continue;
         const family = nativeFamilyFromMagic(magic);
         if (family !== undefined && family !== expected)
+            mismatches.push(pathname);
+    }
+    return mismatches;
+}
+export async function nativeBinariesMatchRuntime(root = process.cwd(), platform = process.platform) {
+    return (await mismatchedNativeBinaries(root, platform)).length === 0;
+}
+export async function repairedNativeBinariesMatchRuntime(paths, platform = process.platform) {
+    const expected = expectedNativeFamily(platform);
+    if (expected === undefined)
+        return true;
+    for (const pathname of paths) {
+        const magic = await readMagic(pathname);
+        if (magic === undefined || nativeFamilyFromMagic(magic) !== expected)
             return false;
     }
-    return true;
+    return nativeBinariesMatchRuntime();
 }

package/dist/pnpm-install/pending-builds.d.mts

@@ -12,6 +12,7 @@ export type PendingBuildDelta = {
     workspaceIds: string[];
 };
 export declare function pendingBuilds(): Promise<PendingBuilds>;
+export declare function buildLedgersAllowNativeRepair(): Promise<boolean>;
 export declare function validDependencyBuildIds(ids: [string, ...string[]]): Promise<[string, ...string[]] | undefined>;
 export declare function clearPendingDependencyBuilds(ids: string[]): Promise<boolean>;
 export declare function pendingBuildDelta(before: PendingBuilds, after: PendingBuilds): Promise<PendingBuildDelta>;

package/dist/pnpm-install/pending-builds.mjs

@@ -15,6 +15,23 @@ export async function pendingBuilds() {
         return { kind: 'unknown' };
     }
 }
+export async function buildLedgersAllowNativeRepair() {
+    try {
+        const value = parse(await readFile(path.join(process.cwd(), 'node_modules', '.modules.yaml'), 'utf8'));
+        if (typeof value !== 'object' || value === null || Array.isArray(value))
+            return false;
+        const record = value;
+        const ignored = record.ignoredBuilds;
+        const pending = record.pendingBuilds ?? [];
+        return (Array.isArray(ignored) &&
+            ignored.length === 0 &&
+            Array.isArray(pending) &&
+            pending.length === 0);
+    }
+    catch {
+        return false;
+    }
+}
 async function lockfileDependencyIds() {
     try {
         const lockfile = parse(await readFile(path.join(process.cwd(), 'pnpm-lock.yaml'), 'utf8'));

package/dist/pnpm-install/pnpm-install-fake-pnpm.test-helpers.mjs

@@ -41,6 +41,12 @@ case " $* " in
     if [ "\${PNPM_REBUILD_BREAK_LINK:-0}" = 1 ]; then rm -f "$PNPM_DEPENDENCY_LINK"; fi
     ;;
   *' --force '*)
+    if [ "\${PNPM_DELETE_NATIVE:-0}" = 1 ]; then
+      rm -f "$PNPM_NATIVE_ADDON"
+    elif [ "\${PNPM_REPAIR_NATIVE:-0}" = 1 ]; then
+      cp "$PNPM_NATIVE_REPLACEMENT" "$PNPM_NATIVE_ADDON"
+    fi
+    if [ "\${PNPM_FORCE_BREAK_LINK:-0}" = 1 ]; then rm -f "$PNPM_DEPENDENCY_LINK"; fi
     if [ "\${PNPM_REPAIR_LINK:-0}" = 1 ]; then
       mkdir -p "$(dirname "$PNPM_DEPENDENCY_LINK")"
       rm -f "$PNPM_DEPENDENCY_LINK"

package/dist/pnpm-install/pnpm-install-fixture.test-helpers.d.mts

@@ -14,6 +14,7 @@ export declare function makeFixture(): Promise<{
     root: string;
     summary: string;
 }>;
+export declare function configureNativeRepair(fixture: Awaited<ReturnType<typeof makeFixture>>, addon: string): Promise<void>;
 export declare function runInstaller(fixture: Awaited<ReturnType<typeof makeFixture>>, options?: FixtureOptions): Promise<{
     stdout: string;
     stderr: string;

package/dist/pnpm-install/pnpm-install-fixture.test-helpers.mjs

@@ -45,9 +45,14 @@ export async function makeFixture() {
         PNPM_CALLS: join(root, 'pnpm.calls'),
         PNPM_DEPENDENCY: dependency,
         PNPM_DEPENDENCY_LINK: dependencyLink,
+        PNPM_DELETE_NATIVE: '0',
         PNPM_LOG: pnpmLog,
         PNPM_NODE_MODULES: join(root, 'node_modules'),
+        PNPM_NATIVE_ADDON: '',
+        PNPM_NATIVE_REPLACEMENT: '',
         PNPM_PENDING_BUILDS: '',
+        PNPM_FORCE_BREAK_LINK: '0',
+        PNPM_REPAIR_NATIVE: '0',
         PNPM_REPAIR_LINK: '0',
         PNPM_REBUILD_BREAK_LINK: '0',
         PNPM_WORKSPACES_JSON: JSON.stringify(workspaces),
@@ -62,6 +67,18 @@ export async function makeFixture() {
         summary,
     };
 }
+export async function configureNativeRepair(fixture, addon) {
+    const replacement = join(fixture.root, 'native-replacement.node');
+    const magic = process.platform === 'darwin'
+        ? Buffer.from([0xcf, 0xfa, 0xed, 0xfe])
+        : process.platform === 'win32'
+            ? Buffer.from([0x4d, 0x5a])
+            : Buffer.from([0x7f, 0x45, 0x4c, 0x46]);
+    await writeFile(replacement, magic);
+    fixture.env.PNPM_NATIVE_ADDON = addon;
+    fixture.env.PNPM_NATIVE_REPLACEMENT = replacement;
+    fixture.env.PNPM_REPAIR_NATIVE = '1';
+}
 export async function runInstaller(fixture, options = {}) {
     const lifecycle = options.lifecycle ?? 'persistent';
     const installScripts = options.installScripts ?? true;

package/dist/pnpm-install/runner.mjs

@@ -1,9 +1,12 @@
 import { persistentDependencyTreeIsCold, persistentMetadataFingerprintV4, persistentMetadataStatusV4, writePersistentMetadataStampV4, } from './metadata.mjs';
 import { runPnpm } from './exec.mjs';
-import { nativeBinariesMatchRuntime } from './native-health.mjs';
-import { clearPendingDependencyBuilds, pendingBuildDelta, pendingBuilds, validDependencyBuildIds, } from './pending-builds.mjs';
-import { install, reconcileOrFail, withScriptPolicy } from './install-operations.mjs';
-import { baseInstallArgs, findWorkspaceLinkMismatches, logWorkspaceLinkMismatches, } from './support.mjs';
+import { mismatchedNativeBinaries } from './native-health.mjs';
+// oxfmt-ignore
+import { clearPendingDependencyBuilds, pendingBuildDelta, pendingBuilds, validDependencyBuildIds } from './pending-builds.mjs';
+// oxfmt-ignore
+import { install, reconcileOrFail, repairIsolatedNativeMismatch, withScriptPolicy } from './install-operations.mjs';
+// oxfmt-ignore
+import { baseInstallArgs, findWorkspaceLinkMismatches, logWorkspaceLinkMismatches } from './support.mjs';
 import { persistentInstallTransition, persistentProvenanceDiagnostic } from './transition.mjs';
 // oxfmt-ignore
 const fail = (message) => { throw new Error(message); };
@@ -13,7 +16,20 @@ async function persistent(options) {
     const runCapture = (args) => runPnpm(args, options, true);
     const fingerprint = await persistentMetadataFingerprintV4(runCapture);
     const provenance = await persistentMetadataStatusV4(fingerprint);
-    const nativesMatch = await nativeBinariesMatchRuntime();
+    const mismatchedNatives = await mismatchedNativeBinaries();
+    const nativesMatch = mismatchedNatives.length === 0;
+    const repairedNativeMismatch = !nativesMatch &&
+        provenance.kind === 'matching' &&
+        (await repairIsolatedNativeMismatch(options, runCapture, mismatchedNatives));
+    if (repairedNativeMismatch) {
+        console.warn('persistent optional native binaries do not match this runtime; reconciled');
+        console.warn(persistentProvenanceDiagnostic(provenance, options.installScripts, nativesMatch, {
+            action: 'reconcile',
+            reason: 'native-health-mismatch',
+        }));
+        await writePersistentMetadataStampV4(fingerprint, options.installScripts, true, []);
+        return 'persistent native health reconciled';
+    }
     const provisionalTransition = persistentInstallTransition(provenance, options.installScripts);
     let transition = nativesMatch
         ? provisionalTransition

package/dist/pnpm-install/support.d.mts

@@ -23,6 +23,7 @@ export type Workspace = {
     path: string;
 };
 export declare const baseInstallArgs: string[];
+export declare const forcedInstallArgs: string[];
 export declare function parseInstallOptions(argv: string[]): InstallOptions;
 export declare function listWorkspaces(runCapture: CaptureCommand): Promise<Workspace[]>;
 export declare function findWorkspaceLinkMismatches(runCapture: CaptureCommand): Promise<WorkspaceLinkMismatch[]>;

package/dist/pnpm-install/support.mjs

@@ -1,12 +1,12 @@
 import { readFile, realpath } from 'node:fs/promises';
 import path from 'node:path';
-export const baseInstallArgs = [
-    'install',
-    '--frozen-lockfile',
+const commonInstallArgs = [
     '--prefer-offline',
     '--prod=false',
     '--config.disallow-workspace-cycles=false',
 ];
+export const baseInstallArgs = ['install', '--frozen-lockfile', ...commonInstallArgs];
+export const forcedInstallArgs = ['install', '--frozen-lockfile', '--force', ...commonInstallArgs];
 const usage = 'usage: vouchington pnpm-install --runner-lifecycle persistent|ephemeral|ephemeral-full --install-scripts true|false [--ephemeral-workspaces <newline-separated selectors>] [--command-timeout-seconds <nonnegative integer>] [--max-attempts <positive integer>]';
 const MAX_COMMAND_TIMEOUT_SECONDS = 3600;
 const MAX_ATTEMPTS = 10;

package/dist/vitest-blob-manifest/cli.mjs

@@ -2,6 +2,7 @@
 import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { writeVitestBlobManifest } from './index.mjs';
+import { parseGitHubRunAttempt } from './run-attempt.mjs';
 function failRepository() {
     throw new Error('GITHUB_REPOSITORY is required');
 }
@@ -15,10 +16,7 @@ export function runVitestBlobManifestCli(args, env = process.env, revision = exe
     if (!suite || extra.length > 0 || !runId || !rawAttempt) {
         throw new Error('Usage: vouchington vitest-blob-manifest <suite> [reports-directory]');
     }
-    const runAttempt = Number(rawAttempt);
-    if (!Number.isSafeInteger(runAttempt) || runAttempt < 1) {
-        throw new Error('GITHUB_RUN_ATTEMPT must be a positive integer');
-    }
+    const runAttempt = parseGitHubRunAttempt(rawAttempt);
     writeVitestBlobManifest(directory, {
         suite,
         repository: env.GITHUB_REPOSITORY || failRepository(),

package/dist/vitest-blob-manifest/report-attempt-cli.d.mts

@@ -0,0 +1,2 @@
+/** Writes or reads authenticated-for-run Vitest report-attempt markers. */
+export declare function runVitestReportAttemptCli(args: readonly string[], env?: NodeJS.ProcessEnv, log?: (line: string) => void): void;

package/dist/vitest-blob-manifest/report-attempt-cli.mjs

@@ -0,0 +1,32 @@
+import { readVitestReportAttempts, writeVitestReportAttempt, } from './report-attempt.mjs';
+import { parseGitHubRunAttempt } from './run-attempt.mjs';
+function required(env, name) {
+    const value = env[name];
+    if (!value)
+        throw new Error(`${name} is required`);
+    return value;
+}
+function identity(env) {
+    return {
+        repository: required(env, 'GITHUB_REPOSITORY'),
+        revision: required(env, 'GITHUB_SHA'),
+        runId: required(env, 'GITHUB_RUN_ID'),
+        attempt: parseGitHubRunAttempt(env.GITHUB_RUN_ATTEMPT),
+    };
+}
+/** Writes or reads authenticated-for-run Vitest report-attempt markers. */
+export function runVitestReportAttemptCli(args, env = process.env, log = (line) => process.stdout.write(`${line}\n`)) {
+    const [command, path, suite, ...extra] = args;
+    if (extra.length > 0 || !path || (command !== 'write' && command !== 'read'))
+        throw new Error('Usage: vouchington vitest-report-attempt <write DIRECTORY SUITE|read ROOT>');
+    const current = identity(env);
+    if (command === 'write') {
+        if (!suite)
+            throw new Error('Usage: vouchington vitest-report-attempt <write DIRECTORY SUITE|read ROOT>');
+        writeVitestReportAttempt(path, suite, current);
+        return;
+    }
+    if (suite)
+        throw new Error('Usage: vouchington vitest-report-attempt <write DIRECTORY SUITE|read ROOT>');
+    log(JSON.stringify(readVitestReportAttempts(path, current)));
+}

package/dist/vitest-blob-manifest/reports-cli.d.mts

@@ -0,0 +1,2 @@
+/** Validates GitHub run context, then prepares the selected report JSON files. */
+export declare function runPrepareVitestReportsCli(args: readonly string[], env?: NodeJS.ProcessEnv, log?: (line: string) => void): void;

package/dist/vitest-blob-manifest/reports-cli.mjs

@@ -0,0 +1,55 @@
+import { VITEST_SUITE_PATTERN } from './constants.mjs';
+import { prepareVitestReports } from './reports.mjs';
+import { parseGitHubRunAttempt } from './run-attempt.mjs';
+function required(env, name) {
+    const value = env[name];
+    if (!value)
+        throw new Error(`${name} is required`);
+    return value;
+}
+function parseContext(raw, attempt) {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        throw new Error('Vitest report expectation context must be an object');
+    const context = parsed;
+    if (Object.keys(context).toSorted().join('\0') !== ['attempt', 'suites', 'version'].join('\0') ||
+        context.version !== 'vitest-report-expectations:v2' ||
+        context.attempt !== attempt ||
+        !Array.isArray(context.suites) ||
+        context.suites.some((expectation) => typeof expectation !== 'object' ||
+            expectation === null ||
+            Array.isArray(expectation) ||
+            Object.keys(expectation).toSorted().join('\0') !== ['minimumAttempt', 'suite'].join('\0') ||
+            typeof expectation.suite !== 'string' ||
+            !VITEST_SUITE_PATTERN.test(expectation.suite) ||
+            !Number.isSafeInteger(expectation.minimumAttempt) ||
+            Number(expectation.minimumAttempt) < 1 ||
+            Number(expectation.minimumAttempt) > attempt))
+        throw new Error('Vitest report expectation context has an invalid schema');
+    const typed = context;
+    const suites = typed.suites.map((expectation) => expectation.suite);
+    if (new Set(suites).size !== suites.length || suites.join('\0') !== suites.toSorted().join('\0'))
+        throw new Error('Vitest report expectation suites must be unique and sorted');
+    return typed;
+}
+/** Validates GitHub run context, then prepares the selected report JSON files. */
+export function runPrepareVitestReportsCli(args, env = process.env, log = (line) => process.stdout.write(`${line}\n`)) {
+    const [primaryDir = './vitest-blob-primary', fallbackDir = './vitest-blob-fallback', outputDir = './vitest-blob-reports/merge-input', ...extra] = args;
+    if (extra.length > 0)
+        throw new Error('Expected at most three Vitest report directories');
+    const currentAttempt = parseGitHubRunAttempt(env.GITHUB_RUN_ATTEMPT);
+    const result = prepareVitestReports({
+        primaryDir,
+        fallbackDir,
+        outputDir,
+        expectedSuites: parseContext(required(env, 'VITEST_REPORT_EXPECTATIONS'), currentAttempt)
+            .suites,
+        repository: required(env, 'GITHUB_REPOSITORY'),
+        revision: required(env, 'GITHUB_SHA'),
+        run: { id: required(env, 'GITHUB_RUN_ID'), currentAttempt },
+    });
+    for (const rejected of result.rejectedSources)
+        log(`::warning::Rejected Vitest ${rejected.source} report source: ${rejected.reason}`);
+    for (const selected of result.selected)
+        log(`Selected Vitest report ${selected.suite} from attempt ${selected.attempt} (${selected.sources.join('+')})`);
+}

package/dist/vitest-blob-manifest/run-attempt.d.mts

@@ -0,0 +1,2 @@
+/** Reads a GitHub Actions attempt as a canonical, positive decimal integer. */
+export declare function parseGitHubRunAttempt(rawAttempt: string | undefined): number;

package/dist/vitest-blob-manifest/run-attempt.mjs

@@ -0,0 +1,11 @@
+/** Reads a GitHub Actions attempt as a canonical, positive decimal integer. */
+export function parseGitHubRunAttempt(rawAttempt) {
+    if (!rawAttempt)
+        throw new Error('GITHUB_RUN_ATTEMPT is required');
+    if (!/^[1-9][0-9]*$/.test(rawAttempt))
+        throw new Error('GITHUB_RUN_ATTEMPT must be a positive integer');
+    const attempt = Number(rawAttempt);
+    if (!Number.isSafeInteger(attempt))
+        throw new Error('GITHUB_RUN_ATTEMPT must be a positive integer');
+    return attempt;
+}

package/dist/workspace-gates/manifest-version-assertions.d.mts

@@ -0,0 +1,3 @@
+import type { SharedContext } from '../shared-context/index.mts';
+/** Keeps Dependabot updates independent from literal dependency-version test assertions. */
+export declare function checkManifestDependencyVersionAssertions(ctx: SharedContext, errors: string[]): void;

package/dist/workspace-gates/manifest-version-assertions.mjs

@@ -0,0 +1,100 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { findExpectations } from './manifest-version-parser.mjs';
+import { buildDependencyMatchers, SEMVER_LITERAL } from './manifest-version-patterns.mjs';
+const TEST_SOURCE_FILE = /(?:^|\/)[^/]+\.(?:test|spec)\.[cm]?[jt]sx?$/u;
+const PACKAGE_JSON_FILE = /(?:^|\/)package\.json$/u;
+const TEST_OR_FIXTURE_DIRECTORY = /(?:^|\/)(?:test|tests|__tests__|fixture|fixtures|__fixtures__)(?:\/|$)/u;
+const DEPENDENCY_FIELD = /\b(?:dependencies|devDependencies|optionalDependencies|peerDependencies)\b/u;
+const STRING_LITERAL = /'([^'\\]*(?:\\.[^'\\]*)*)'|"([^"\\]*(?:\\.[^"\\]*)*)"|`([^`\\$]*(?:\\.[^`\\$]*)*)`/gu;
+function readTrackedSource(ctx, file) {
+    try {
+        return ctx.readTrackedFile
+            ? ctx.readTrackedFile(file)
+            : readFileSync(join(ctx.repoRoot, file), 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function dependencyNames(ctx) {
+    const names = new Set();
+    for (const file of ctx.trackedFiles) {
+        if (!PACKAGE_JSON_FILE.test(file) || TEST_OR_FIXTURE_DIRECTORY.test(file))
+            continue;
+        const source = readTrackedSource(ctx, file);
+        if (source === null)
+            continue;
+        let manifest;
+        try {
+            manifest = JSON.parse(source);
+        }
+        catch {
+            continue;
+        }
+        if (typeof manifest !== 'object' || manifest === null || Array.isArray(manifest))
+            continue;
+        for (const field of [
+            'dependencies',
+            'devDependencies',
+            'optionalDependencies',
+            'peerDependencies',
+        ]) {
+            const dependencies = manifest[field];
+            if (typeof dependencies !== 'object' || dependencies === null || Array.isArray(dependencies))
+                continue;
+            for (const name of Object.keys(dependencies))
+                names.add(name);
+        }
+    }
+    return names;
+}
+function literalValues(source) {
+    return [...source.matchAll(STRING_LITERAL)].map((match) => (match[1] ?? match[2] ?? match[3]));
+}
+function expectedDependencyNames(values, names) {
+    return values.some((value) => SEMVER_LITERAL.test(value))
+        ? values.filter((value) => names.has(value))
+        : [];
+}
+/** Keeps Dependabot updates independent from literal dependency-version test assertions. */
+export function checkManifestDependencyVersionAssertions(ctx, errors) {
+    const names = dependencyNames(ctx);
+    if (names.size === 0)
+        return;
+    const matchers = buildDependencyMatchers(names);
+    for (const file of ctx.trackedFiles) {
+        if (!TEST_SOURCE_FILE.test(file))
+            continue;
+        const source = readTrackedSource(ctx, file);
+        if (source === null) {
+            errors.push(`::error file=${file}::${file}: failed to read test source for manifest dependency version assertions`);
+            continue;
+        }
+        for (const expectation of findExpectations(source)) {
+            const asserted = new Set();
+            if (DEPENDENCY_FIELD.test(expectation.expression)) {
+                const values = literalValues(expectation.expected);
+                if (values.length === 1 && SEMVER_LITERAL.test(values[0])) {
+                    for (const matcher of matchers)
+                        if (matcher.member.test(expectation.expression))
+                            asserted.add(matcher.name);
+                }
+                for (const name of expectedDependencyNames(values, names))
+                    asserted.add(name);
+                for (const matcher of matchers)
+                    if (matcher.objectValue.test(expectation.expected))
+                        asserted.add(matcher.name);
+            }
+            for (const value of literalValues(expectation.expected)) {
+                for (const matcher of matchers)
+                    if (matcher.packageSpec.test(value))
+                        asserted.add(matcher.name);
+            }
+            for (const name of asserted) {
+                const line = source.slice(0, expectation.index).split('\n').length;
+                errors.push(`::error file=${file},line=${line}::${file}:${line}: tests must not assert the exact version of declared dependency "${name}"; assert dependency membership or derive the value from the manifest instead`);
+            }
+        }
+    }
+}

package/dist/workspace-gates/manifest-version-parser.d.mts

@@ -0,0 +1,6 @@
+export type Expectation = {
+    expression: string;
+    expected: string;
+    index: number;
+};
+export declare function findExpectations(source: string): Expectation[];