vouchington-tooling 0.3.6 → 0.4.0

package/README.md

@@ -30,6 +30,9 @@ vouchington prepare-trivy-db
 vouchington gha-artifacts-cleanup run --run-id 123 --keep-pattern 'plan-*' --delete-pattern 'coverage-*'
 vouchington http-origin --field cdn_origin https://images.example.com
 vouchington vitest-blob-manifest <suite> [reports-directory]
+vouchington vitest-report-attempt write <directory> <suite>
+vouchington vitest-report-attempt read <root>
+vouchington prepare-vitest-reports [primary-directory] [fallback-directory] [output-directory]
 vouchington pnpm-install --runner-lifecycle persistent --install-scripts true
 vouchington check-cache-size /tmp/cache 1048576 node-modules
 vouchington make-shard-matrix 4
@@ -63,6 +66,10 @@ For persistent `pnpm-install`, v4 metadata tracks structural inputs separately f
 uses one script-suppressed verification install followed by `pnpm rebuild --pending --recursive`.
 When only newly pending dependency package IDs remain, it instead rebuilds those exact IDs without
 rerunning first-party workspace hooks.
+An isolated native-binary mismatch uses one strict forced install only when structural provenance
+matches, workspace links are valid, and pnpm records empty `ignoredBuilds` and `pendingBuilds` ledgers;
+otherwise it retains the script-free then strict reconciliation. Native and workspace-link health
+are verified before its metadata stamp is refreshed.
 The command emits a structured non-secret provenance diagnostic identifying changed structural
 categories, the last script policy, script capability, and native-binary health.
 
@@ -183,6 +190,10 @@ import { appendJournal, probeBlackboard } from 'vouchington-tooling/agent-blackb
 import { buildSessionFrictionReport, recordFriction } from 'vouchington-tooling/session-friction'
 ```
 
+`checkWorkspaceGatesPolicy` rejects tracked test assertions that hard-code the exact version of a
+dependency declared by a non-fixture package manifest. Assert dependency membership or placement,
+or derive a configuration or documentation package spec from that manifest instead.
+
 `session-friction` is an opt-in capture and reporting library. Callers supply the session id,
 absolute log directory, host-independent observation, and journal loader; it does not inspect host
 environment variables, install hooks, or connect to a journal service by itself. Invoking

package/dist/cli/commands/prepare-vitest-reports.d.mts

@@ -0,0 +1,2 @@
+import { runPrepareVitestReportsCli } from '../../vitest-blob-manifest/reports-cli.mts';
+export declare function runPrepareVitestReportsCommand(args: readonly string[], run?: typeof runPrepareVitestReportsCli): number;

package/dist/cli/commands/prepare-vitest-reports.mjs

@@ -0,0 +1,11 @@
+import { runPrepareVitestReportsCli } from '../../vitest-blob-manifest/reports-cli.mjs';
+export function runPrepareVitestReportsCommand(args, run = runPrepareVitestReportsCli) {
+    try {
+        run(args);
+        return 0;
+    }
+    catch (error) {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
+    }
+}

package/dist/cli/commands/vitest-report-attempt.d.mts

@@ -0,0 +1,2 @@
+import { runVitestReportAttemptCli } from '../../vitest-blob-manifest/report-attempt-cli.mts';
+export declare function runVitestReportAttemptCommand(args: readonly string[], run?: typeof runVitestReportAttemptCli): number;

package/dist/cli/commands/vitest-report-attempt.mjs

@@ -0,0 +1,11 @@
+import { runVitestReportAttemptCli } from '../../vitest-blob-manifest/report-attempt-cli.mjs';
+export function runVitestReportAttemptCommand(args, run = runVitestReportAttemptCli) {
+    try {
+        run(args);
+        return 0;
+    }
+    catch (error) {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
+    }
+}

package/dist/cli/index.mjs

@@ -14,6 +14,8 @@ import { runPostReviewCommand } from './commands/post-review.mjs';
 import { runStageReviewPayloadCommand } from './commands/stage-review-payload.mjs';
 import { runSwiftSemanticEqualCommand } from './commands/swift-semantic-equal.mjs';
 import { runVitestBlobManifestCommand } from './commands/vitest-blob-manifest.mjs';
+import { runVitestReportAttemptCommand } from './commands/vitest-report-attempt.mjs';
+import { runPrepareVitestReportsCommand } from './commands/prepare-vitest-reports.mjs';
 import { runRetrospectiveTranscriptCommand } from './commands/retrospective-transcript.mjs';
 import { runLinkSkill } from './commands/link-skill.mjs';
 import { runRetrospectiveFactsCommand } from './commands/retrospective-facts.mjs';
@@ -93,6 +95,10 @@ export function runCli(argv = process.argv) {
             return runPnpmInstallCli(parsed.args);
         case 'vitest-blob-manifest':
             return runVitestBlobManifestCommand(parsed.args);
+        case 'vitest-report-attempt':
+            return runVitestReportAttemptCommand(parsed.args);
+        case 'prepare-vitest-reports':
+            return runPrepareVitestReportsCommand(parsed.args);
         case 'nuget-central-version':
             return runNugetCentralVersionCommand(parsed.args);
         case 'swift-semantic-equal':

package/dist/cli/parse.d.mts

@@ -24,6 +24,12 @@ export type ParsedCli = {
 } | {
     kind: 'vitest-blob-manifest';
     args: string[];
+} | {
+    kind: 'vitest-report-attempt';
+    args: string[];
+} | {
+    kind: 'prepare-vitest-reports';
+    args: string[];
 } | {
     kind: 'nuget-central-version';
     args: string[];

package/dist/cli/parse.mjs

@@ -40,6 +40,10 @@ export function parseCli(argv) {
         return { kind: 'pnpm-install', args: rest };
     if (command === 'vitest-blob-manifest')
         return { kind: 'vitest-blob-manifest', args: rest };
+    if (command === 'vitest-report-attempt')
+        return { kind: 'vitest-report-attempt', args: rest };
+    if (command === 'prepare-vitest-reports')
+        return { kind: 'prepare-vitest-reports', args: rest };
     if (command === 'nuget-central-version')
         return { kind: 'nuget-central-version', args: rest };
     if (command === 'swift-semantic-equal')

package/dist/cli/usage.d.mts

@@ -1,2 +1,2 @@
-export declare const USAGE = "Usage: vouchington <command> [options]\n\nCommands:\n  runner-port-policy   Print or validate a runner port policy\n  with-host-lock       Run a command under a host-wide lock\n  gha-runtime-audit             Audit successful GitHub Actions job runtimes\n  gha-output                    Write a collision-safe multiline GITHUB_OUTPUT record\n  gha-needs-results             Fail if required GitHub Actions job results failed\n  download-with-diagnostics     Download a URL and report HTTP status on failure\n  download-optional-run-artifacts  Download optional artifacts from the current run\n  host-pressure-diagnostics     Print a bounded host memory/OOM/PSI snapshot\n  allocate-browser-safe-ports   Allocate Fetch-safe localhost ports\n  diagnose-port-collision       Capture bounded localhost port diagnostics\n  prepare-trivy-db              Download the Trivy vulnerability database\n  gha-artifacts-cleanup         Delete classified GitHub Actions artifacts\n  http-origin                   Validate an optional HTTP(S) origin\n  vitest-blob-manifest          Stamp a vitest-blob-manifest:v1 identity file\n  pnpm-install                  Install a pnpm workspace with retry and release-age fail-fast\n  check-cache-size              Measure a path and decide whether to save a GHA cache\n  make-shard-matrix             Emit a [1..N] GitHub Actions shard matrix\n  load-runner-env               Overlay a runner env file onto GITHUB_ENV with injection guards\n  clean-workspace               Reset a persistent-runner workspace with a fork-PR trust gate\n  install-github-release        Download a checksum-verified GitHub Release binary\n  run-with-timeout              Run a command with GNU timeout or a Perl fallback\n  lint-links                    Two-pass lychee: internal links fail, external warn\n  materialize-pr-context        Dump PR title/body/files/diff/comments and #N crawl\n  wait-for-apt-locks            Wait until apt/dpkg lock files are free\n  install-playwright-chromium-arm64  Install Playwright Chromium from browsers.json\n  ghcr-package-retention        Delete old GHCR package versions past KEEP_MIN\n  harness-admission-lane        Compute a GITHUB_RUN_ID admission lane for fleet fan-out\n  harness-assert-gates          Fail if any named HARNESS_*_ENABLED gate is enabled\n  nuget-central-version         Validate a Directory.Packages.props PackageVersion delta\n  swift-semantic-equal          Compare Swift sources ignoring comments and whitespace\n  post-review                   Post one COMMENT review from a staged payload file\n  stage-review-payload          Validate a review payload file into a staging directory\n  retrospective-transcript      Format facts from Claude-compatible, Codex, or Grok transcripts\n  link-skill                    Link one packaged skill into an explicit consumer directory\n  retrospective-facts           Gather immutable facts for a retrospective\n  agent-blackboard              Probe and journal an Agent Blackboard deployment\n\nOptions:\n  -h, --help       Show this help\n  -v, --version    Print the package version\n\nrunner-port-policy\n  (no args)              Print the shipped policy as JSON\n  --file <path>          Validate and print a policy file\n  --reserved <port>      Print true if the port is reserved\n\nwith-host-lock\n  --name <family>\n  [--slots <n>]\n  --timeout-seconds <n>\n  [--command-timeout-seconds <n>]\n  [--failure-diagnostics <absolute-script>]\n  [--on-acquire-timeout fail|run-unlocked]\n  -- <command> [args...]\n\ngha-runtime-audit\n  [--repository owner/name]   Default GITHUB_REPOSITORY\n  [--branch main]\n  --pr-workflow <name|/regex/>     Repeatable\n  --push-workflow <name|/regex/>   Repeatable\n\ngha-output <name>\ngha-needs-results [label]\ndownload-with-diagnostics <url> <destination> [-- curl-args...]\ndownload-optional-run-artifacts (--name <name> | --pattern <pattern>) --dir <directory>\nhost-pressure-diagnostics\nallocate-browser-safe-ports [count] [--policy path] [--forbidden-ports path]\ndiagnose-port-collision [--ports \"2200 2216\"] [--output-dir PATH]\nprepare-trivy-db\ngha-artifacts-cleanup run --run-id <id> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\ngha-artifacts-cleanup sweep --older-than-hours <n> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\nhttp-origin [--field NAME] [value]\nvitest-blob-manifest <suite> [reports-directory]\npnpm-install --runner-lifecycle persistent|ephemeral|ephemeral-full --install-scripts true|false\ncheck-cache-size <path> <max-bytes> <label>\nmake-shard-matrix <total>\nload-runner-env\nclean-workspace\ninstall-github-release --repo owner/name --version X --asset 'name-{platform}.tar.gz' --bin name [--tag-prefix PREFIX] [--expected-sha256 SHA256] [--no-checksum] [--checksums-asset NAME] [--version-flag FLAG] [--bin-dir DIR]\nrun-with-timeout <timeout-seconds> <kill-after-seconds> <command...>\nlint-links [--offline] [--config PATH] [--glob PATTERN] [files...]\nmaterialize-pr-context\nwait-for-apt-locks\ninstall-playwright-chromium-arm64 [name:archive...]\nghcr-package-retention <url-encoded-package>...\nharness-admission-lane <lanes>\nharness-assert-gates <gate>...\nnuget-central-version <trusted-props> <candidate-props> <metadata-json> <output-props>\nswift-semantic-equal <base> <head> <file.swift>\npost-review\nstage-review-payload optional|required <source> <destination>\nretrospective-transcript [--session-id ID] [--jsonl PATH] [--projects-dir PATH] [--codex-sessions-dir PATH] [--grok-sessions-dir PATH]\nlink-skill <name> --source-root <skills-dir> --target-root <consumer-skills-dir>  Link a packaged or repository-local skill\nretrospective-facts (--pr NUMBER | --branch NAME | --no-pr) [--repo OWNER/NAME] [--raw]\nagent-blackboard probe\nagent-blackboard journal append --session-id UUID --agent NAME --version VERSION --file PATH [--parent-session-id UUID] [--timestamp ISO8601]\nagent-blackboard journal entries --session-id UUID\nagent-blackboard snapshot partition --snapshot PATH --checksum SHA256 --counts '{\"sessions\":N,\"entries\":N,\"records\":N,\"bytes\":N}'\nagent-blackboard snapshot cleanup [--snapshot PATH] [--partition-directory PATH --receipt JSON]\n";
+export declare const USAGE = "Usage: vouchington <command> [options]\n\nCommands:\n  runner-port-policy   Print or validate a runner port policy\n  with-host-lock       Run a command under a host-wide lock\n  gha-runtime-audit             Audit successful GitHub Actions job runtimes\n  gha-output                    Write a collision-safe multiline GITHUB_OUTPUT record\n  gha-needs-results             Fail if required GitHub Actions job results failed\n  download-with-diagnostics     Download a URL and report HTTP status on failure\n  download-optional-run-artifacts  Download optional artifacts from the current run\n  host-pressure-diagnostics     Print a bounded host memory/OOM/PSI snapshot\n  allocate-browser-safe-ports   Allocate Fetch-safe localhost ports\n  diagnose-port-collision       Capture bounded localhost port diagnostics\n  prepare-trivy-db              Download the Trivy vulnerability database\n  gha-artifacts-cleanup         Delete classified GitHub Actions artifacts\n  http-origin                   Validate an optional HTTP(S) origin\n  vitest-blob-manifest          Stamp a vitest-blob-manifest:v1 identity file\n  vitest-report-attempt         Write or read a Vitest report-attempt marker\n  prepare-vitest-reports        Validate and select Vitest report JSON files\n  pnpm-install                  Install a pnpm workspace with retry and release-age fail-fast\n  check-cache-size              Measure a path and decide whether to save a GHA cache\n  make-shard-matrix             Emit a [1..N] GitHub Actions shard matrix\n  load-runner-env               Overlay a runner env file onto GITHUB_ENV with injection guards\n  clean-workspace               Reset a persistent-runner workspace with a fork-PR trust gate\n  install-github-release        Download a checksum-verified GitHub Release binary\n  run-with-timeout              Run a command with GNU timeout or a Perl fallback\n  lint-links                    Two-pass lychee: internal links fail, external warn\n  materialize-pr-context        Dump PR title/body/files/diff/comments and #N crawl\n  wait-for-apt-locks            Wait until apt/dpkg lock files are free\n  install-playwright-chromium-arm64  Install Playwright Chromium from browsers.json\n  ghcr-package-retention        Delete old GHCR package versions past KEEP_MIN\n  harness-admission-lane        Compute a GITHUB_RUN_ID admission lane for fleet fan-out\n  harness-assert-gates          Fail if any named HARNESS_*_ENABLED gate is enabled\n  nuget-central-version         Validate a Directory.Packages.props PackageVersion delta\n  swift-semantic-equal          Compare Swift sources ignoring comments and whitespace\n  post-review                   Post one COMMENT review from a staged payload file\n  stage-review-payload          Validate a review payload file into a staging directory\n  retrospective-transcript      Format facts from Claude-compatible, Codex, or Grok transcripts\n  link-skill                    Link one packaged skill into an explicit consumer directory\n  retrospective-facts           Gather immutable facts for a retrospective\n  agent-blackboard              Probe and journal an Agent Blackboard deployment\n\nOptions:\n  -h, --help       Show this help\n  -v, --version    Print the package version\n\nrunner-port-policy\n  (no args)              Print the shipped policy as JSON\n  --file <path>          Validate and print a policy file\n  --reserved <port>      Print true if the port is reserved\n\nwith-host-lock\n  --name <family>\n  [--slots <n>]\n  --timeout-seconds <n>\n  [--command-timeout-seconds <n>]\n  [--failure-diagnostics <absolute-script>]\n  [--on-acquire-timeout fail|run-unlocked]\n  -- <command> [args...]\n\ngha-runtime-audit\n  [--repository owner/name]   Default GITHUB_REPOSITORY\n  [--branch main]\n  --pr-workflow <name|/regex/>     Repeatable\n  --push-workflow <name|/regex/>   Repeatable\n\ngha-output <name>\ngha-needs-results [label]\ndownload-with-diagnostics <url> <destination> [-- curl-args...]\ndownload-optional-run-artifacts (--name <name> | --pattern <pattern>) --dir <directory>\nhost-pressure-diagnostics\nallocate-browser-safe-ports [count] [--policy path] [--forbidden-ports path]\ndiagnose-port-collision [--ports \"2200 2216\"] [--output-dir PATH]\nprepare-trivy-db\ngha-artifacts-cleanup run --run-id <id> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\ngha-artifacts-cleanup sweep --older-than-hours <n> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]\nhttp-origin [--field NAME] [value]\nvitest-blob-manifest <suite> [reports-directory]\nvitest-report-attempt <write DIRECTORY SUITE|read ROOT>\nprepare-vitest-reports [primary-directory] [fallback-directory] [output-directory]\npnpm-install --runner-lifecycle persistent|ephemeral|ephemeral-full --install-scripts true|false\ncheck-cache-size <path> <max-bytes> <label>\nmake-shard-matrix <total>\nload-runner-env\nclean-workspace\ninstall-github-release --repo owner/name --version X --asset 'name-{platform}.tar.gz' --bin name [--tag-prefix PREFIX] [--expected-sha256 SHA256] [--no-checksum] [--checksums-asset NAME] [--version-flag FLAG] [--bin-dir DIR]\nrun-with-timeout <timeout-seconds> <kill-after-seconds> <command...>\nlint-links [--offline] [--config PATH] [--glob PATTERN] [files...]\nmaterialize-pr-context\nwait-for-apt-locks\ninstall-playwright-chromium-arm64 [name:archive...]\nghcr-package-retention <url-encoded-package>...\nharness-admission-lane <lanes>\nharness-assert-gates <gate>...\nnuget-central-version <trusted-props> <candidate-props> <metadata-json> <output-props>\nswift-semantic-equal <base> <head> <file.swift>\npost-review\nstage-review-payload optional|required <source> <destination>\nretrospective-transcript [--session-id ID] [--jsonl PATH] [--projects-dir PATH] [--codex-sessions-dir PATH] [--grok-sessions-dir PATH]\nlink-skill <name> --source-root <skills-dir> --target-root <consumer-skills-dir>  Link a packaged or repository-local skill\nretrospective-facts (--pr NUMBER | --branch NAME | --no-pr) [--repo OWNER/NAME] [--raw]\nagent-blackboard probe\nagent-blackboard journal append --session-id UUID --agent NAME --version VERSION --file PATH [--parent-session-id UUID] [--timestamp ISO8601]\nagent-blackboard journal entries --session-id UUID\nagent-blackboard snapshot partition --snapshot PATH --checksum SHA256 --counts '{\"sessions\":N,\"entries\":N,\"records\":N,\"bytes\":N}'\nagent-blackboard snapshot cleanup [--snapshot PATH] [--partition-directory PATH --receipt JSON]\n";
 export declare function printUsage(stream?: NodeJS.WritableStream): void;

package/dist/cli/usage.mjs

@@ -15,6 +15,8 @@ Commands:
   gha-artifacts-cleanup         Delete classified GitHub Actions artifacts
   http-origin                   Validate an optional HTTP(S) origin
   vitest-blob-manifest          Stamp a vitest-blob-manifest:v1 identity file
+  vitest-report-attempt         Write or read a Vitest report-attempt marker
+  prepare-vitest-reports        Validate and select Vitest report JSON files
   pnpm-install                  Install a pnpm workspace with retry and release-age fail-fast
   check-cache-size              Measure a path and decide whether to save a GHA cache
   make-shard-matrix             Emit a [1..N] GitHub Actions shard matrix
@@ -74,6 +76,8 @@ gha-artifacts-cleanup run --run-id <id> [--keep-pattern glob] [--delete-pattern
 gha-artifacts-cleanup sweep --older-than-hours <n> [--keep-pattern glob] [--delete-pattern glob] [--patterns-file json]
 http-origin [--field NAME] [value]
 vitest-blob-manifest <suite> [reports-directory]
+vitest-report-attempt <write DIRECTORY SUITE|read ROOT>
+prepare-vitest-reports [primary-directory] [fallback-directory] [output-directory]
 pnpm-install --runner-lifecycle persistent|ephemeral|ephemeral-full --install-scripts true|false
 check-cache-size <path> <max-bytes> <label>
 make-shard-matrix <total>

package/dist/pnpm-install/install-operations.d.mts

@@ -2,3 +2,4 @@ import { type CommandResult, type InstallOptions } from './support.mts';
 export declare function withScriptPolicy(args: string[], installScripts: boolean): string[];
 export declare function install(args: string[], options: InstallOptions, label: string): Promise<void>;
 export declare function reconcileOrFail(options: InstallOptions, runCapture: (args: string[]) => Promise<CommandResult>): Promise<void>;
+export declare function repairIsolatedNativeMismatch(options: InstallOptions, runCapture: (args: string[]) => Promise<CommandResult>, mismatchedNativePaths: string[]): Promise<boolean>;

package/dist/pnpm-install/install-operations.mjs

@@ -1,8 +1,10 @@
 import { scheduler } from 'node:timers/promises';
 import { runPnpm } from './exec.mjs';
+import { nativeBinariesMatchRuntime, repairedNativeBinariesMatchRuntime } from './native-health.mjs';
+import { buildLedgersAllowNativeRepair } from './pending-builds.mjs';
 import { INSTALL_TERMINATION_FAILED } from './process.mjs';
 import { formatReleaseAgeFailure, isReleaseAgeViolation } from './release-age.mjs';
-import { baseInstallArgs, findWorkspaceLinkMismatches, logWorkspaceLinkMismatches, } from './support.mjs';
+import { findWorkspaceLinkMismatches, forcedInstallArgs, logWorkspaceLinkMismatches, } from './support.mjs';
 function fail(message) {
     throw new Error(message);
 }
@@ -27,12 +29,30 @@ export async function install(args, options, label) {
     fail(`${label} failed after ${options.maxAttempts} attempt${options.maxAttempts === 1 ? '' : 's'}`);
 }
 export async function reconcileOrFail(options, runCapture) {
-    const forced = ['install', '--frozen-lockfile', '--force', ...baseInstallArgs.slice(2)];
-    await install([...forced, '--ignore-scripts', '--ignore-pnpmfile'], options, 'script-free reconciliation');
-    await install(withScriptPolicy(forced, options.installScripts), options, 'strict persistent reconciliation');
-    const remaining = await findWorkspaceLinkMismatches(runCapture);
+    await install([...forcedInstallArgs, '--ignore-scripts', '--ignore-pnpmfile'], options, 'script-free reconciliation');
+    await install(withScriptPolicy(forcedInstallArgs, options.installScripts), options, 'strict persistent reconciliation');
+    await verifyInstallHealth(runCapture, 'persistent reconciliation');
+}
+async function verifyInstallHealth(runCapture, phase, repairedNativePaths = []) {
+    const [nativesMatch, remaining] = await Promise.all([
+        repairedNativePaths.length > 0
+            ? repairedNativeBinariesMatchRuntime(repairedNativePaths)
+            : nativeBinariesMatchRuntime(),
+        findWorkspaceLinkMismatches(runCapture),
+    ]);
+    if (!nativesMatch)
+        fail(`${phase} completed with mismatched native binaries`);
     if (remaining.length > 0) {
         logWorkspaceLinkMismatches(remaining);
-        fail('persistent reconciliation completed with invalid workspace links');
+        fail(`${phase} completed with invalid workspace links`);
     }
 }
+export async function repairIsolatedNativeMismatch(options, runCapture, mismatchedNativePaths) {
+    if (!(await buildLedgersAllowNativeRepair()))
+        return false;
+    if ((await findWorkspaceLinkMismatches(runCapture)).length > 0)
+        return false;
+    await install(withScriptPolicy(forcedInstallArgs, options.installScripts), options, 'native health reconciliation');
+    await verifyInstallHealth(runCapture, 'native health reconciliation', mismatchedNativePaths);
+    return true;
+}

package/dist/pnpm-install/native-health.d.mts

@@ -1,4 +1,6 @@
 export type NativeFamily = 'elf' | 'macho' | 'pe';
 export declare function nativeFamilyFromMagic(buffer: Buffer): NativeFamily | undefined;
 export declare function expectedNativeFamily(platform?: NodeJS.Platform): NativeFamily | undefined;
+export declare function mismatchedNativeBinaries(root?: string, platform?: NodeJS.Platform): Promise<string[]>;
 export declare function nativeBinariesMatchRuntime(root?: string, platform?: NodeJS.Platform): Promise<boolean>;
+export declare function repairedNativeBinariesMatchRuntime(paths: string[], platform?: NodeJS.Platform): Promise<boolean>;

package/dist/pnpm-install/native-health.mjs

@@ -58,27 +58,43 @@ async function searchRoot(nodeModules) {
         return nodeModules;
     }
 }
-export async function nativeBinariesMatchRuntime(root = process.cwd(), platform = process.platform) {
+export async function mismatchedNativeBinaries(root = process.cwd(), platform = process.platform) {
     const expected = expectedNativeFamily(platform);
     if (expected === undefined)
-        return true;
+        return [];
     const nodeModules = path.join(root, 'node_modules');
     try {
         const info = await stat(nodeModules);
         if (!info.isDirectory())
-            return true;
+            return [];
     }
     catch {
-        return true;
+        return [];
     }
     const cwd = await searchRoot(nodeModules);
+    const mismatches = [];
     for await (const relative of glob('**/*.{node,bin}', { cwd })) {
-        const magic = await readMagic(path.join(cwd, relative));
+        const pathname = path.join(cwd, relative);
+        const magic = await readMagic(pathname);
         if (magic === undefined)
             continue;
         const family = nativeFamilyFromMagic(magic);
         if (family !== undefined && family !== expected)
+            mismatches.push(pathname);
+    }
+    return mismatches;
+}
+export async function nativeBinariesMatchRuntime(root = process.cwd(), platform = process.platform) {
+    return (await mismatchedNativeBinaries(root, platform)).length === 0;
+}
+export async function repairedNativeBinariesMatchRuntime(paths, platform = process.platform) {
+    const expected = expectedNativeFamily(platform);
+    if (expected === undefined)
+        return true;
+    for (const pathname of paths) {
+        const magic = await readMagic(pathname);
+        if (magic === undefined || nativeFamilyFromMagic(magic) !== expected)
             return false;
     }
-    return true;
+    return nativeBinariesMatchRuntime();
 }

package/dist/pnpm-install/pending-builds.d.mts

@@ -12,6 +12,7 @@ export type PendingBuildDelta = {
     workspaceIds: string[];
 };
 export declare function pendingBuilds(): Promise<PendingBuilds>;
+export declare function buildLedgersAllowNativeRepair(): Promise<boolean>;
 export declare function validDependencyBuildIds(ids: [string, ...string[]]): Promise<[string, ...string[]] | undefined>;
 export declare function clearPendingDependencyBuilds(ids: string[]): Promise<boolean>;
 export declare function pendingBuildDelta(before: PendingBuilds, after: PendingBuilds): Promise<PendingBuildDelta>;

package/dist/pnpm-install/pending-builds.mjs

@@ -15,6 +15,23 @@ export async function pendingBuilds() {
         return { kind: 'unknown' };
     }
 }
+export async function buildLedgersAllowNativeRepair() {
+    try {
+        const value = parse(await readFile(path.join(process.cwd(), 'node_modules', '.modules.yaml'), 'utf8'));
+        if (typeof value !== 'object' || value === null || Array.isArray(value))
+            return false;
+        const record = value;
+        const ignored = record.ignoredBuilds;
+        const pending = record.pendingBuilds ?? [];
+        return (Array.isArray(ignored) &&
+            ignored.length === 0 &&
+            Array.isArray(pending) &&
+            pending.length === 0);
+    }
+    catch {
+        return false;
+    }
+}
 async function lockfileDependencyIds() {
     try {
         const lockfile = parse(await readFile(path.join(process.cwd(), 'pnpm-lock.yaml'), 'utf8'));

package/dist/pnpm-install/pnpm-install-fake-pnpm.test-helpers.mjs

@@ -41,6 +41,12 @@ case " $* " in
     if [ "\${PNPM_REBUILD_BREAK_LINK:-0}" = 1 ]; then rm -f "$PNPM_DEPENDENCY_LINK"; fi
     ;;
   *' --force '*)
+    if [ "\${PNPM_DELETE_NATIVE:-0}" = 1 ]; then
+      rm -f "$PNPM_NATIVE_ADDON"
+    elif [ "\${PNPM_REPAIR_NATIVE:-0}" = 1 ]; then
+      cp "$PNPM_NATIVE_REPLACEMENT" "$PNPM_NATIVE_ADDON"
+    fi
+    if [ "\${PNPM_FORCE_BREAK_LINK:-0}" = 1 ]; then rm -f "$PNPM_DEPENDENCY_LINK"; fi
     if [ "\${PNPM_REPAIR_LINK:-0}" = 1 ]; then
       mkdir -p "$(dirname "$PNPM_DEPENDENCY_LINK")"
       rm -f "$PNPM_DEPENDENCY_LINK"

package/dist/pnpm-install/pnpm-install-fixture.test-helpers.d.mts

@@ -14,6 +14,7 @@ export declare function makeFixture(): Promise<{
     root: string;
     summary: string;
 }>;
+export declare function configureNativeRepair(fixture: Awaited<ReturnType<typeof makeFixture>>, addon: string): Promise<void>;
 export declare function runInstaller(fixture: Awaited<ReturnType<typeof makeFixture>>, options?: FixtureOptions): Promise<{
     stdout: string;
     stderr: string;

package/dist/pnpm-install/pnpm-install-fixture.test-helpers.mjs

@@ -45,9 +45,14 @@ export async function makeFixture() {
         PNPM_CALLS: join(root, 'pnpm.calls'),
         PNPM_DEPENDENCY: dependency,
         PNPM_DEPENDENCY_LINK: dependencyLink,
+        PNPM_DELETE_NATIVE: '0',
         PNPM_LOG: pnpmLog,
         PNPM_NODE_MODULES: join(root, 'node_modules'),
+        PNPM_NATIVE_ADDON: '',
+        PNPM_NATIVE_REPLACEMENT: '',
         PNPM_PENDING_BUILDS: '',
+        PNPM_FORCE_BREAK_LINK: '0',
+        PNPM_REPAIR_NATIVE: '0',
         PNPM_REPAIR_LINK: '0',
         PNPM_REBUILD_BREAK_LINK: '0',
         PNPM_WORKSPACES_JSON: JSON.stringify(workspaces),
@@ -62,6 +67,18 @@ export async function makeFixture() {
         summary,
     };
 }
+export async function configureNativeRepair(fixture, addon) {
+    const replacement = join(fixture.root, 'native-replacement.node');
+    const magic = process.platform === 'darwin'
+        ? Buffer.from([0xcf, 0xfa, 0xed, 0xfe])
+        : process.platform === 'win32'
+            ? Buffer.from([0x4d, 0x5a])
+            : Buffer.from([0x7f, 0x45, 0x4c, 0x46]);
+    await writeFile(replacement, magic);
+    fixture.env.PNPM_NATIVE_ADDON = addon;
+    fixture.env.PNPM_NATIVE_REPLACEMENT = replacement;
+    fixture.env.PNPM_REPAIR_NATIVE = '1';
+}
 export async function runInstaller(fixture, options = {}) {
     const lifecycle = options.lifecycle ?? 'persistent';
     const installScripts = options.installScripts ?? true;

package/dist/pnpm-install/runner.mjs

@@ -1,9 +1,12 @@
 import { persistentDependencyTreeIsCold, persistentMetadataFingerprintV4, persistentMetadataStatusV4, writePersistentMetadataStampV4, } from './metadata.mjs';
 import { runPnpm } from './exec.mjs';
-import { nativeBinariesMatchRuntime } from './native-health.mjs';
-import { clearPendingDependencyBuilds, pendingBuildDelta, pendingBuilds, validDependencyBuildIds, } from './pending-builds.mjs';
-import { install, reconcileOrFail, withScriptPolicy } from './install-operations.mjs';
-import { baseInstallArgs, findWorkspaceLinkMismatches, logWorkspaceLinkMismatches, } from './support.mjs';
+import { mismatchedNativeBinaries } from './native-health.mjs';
+// oxfmt-ignore
+import { clearPendingDependencyBuilds, pendingBuildDelta, pendingBuilds, validDependencyBuildIds } from './pending-builds.mjs';
+// oxfmt-ignore
+import { install, reconcileOrFail, repairIsolatedNativeMismatch, withScriptPolicy } from './install-operations.mjs';
+// oxfmt-ignore
+import { baseInstallArgs, findWorkspaceLinkMismatches, logWorkspaceLinkMismatches } from './support.mjs';
 import { persistentInstallTransition, persistentProvenanceDiagnostic } from './transition.mjs';
 // oxfmt-ignore
 const fail = (message) => { throw new Error(message); };
@@ -13,7 +16,20 @@ async function persistent(options) {
     const runCapture = (args) => runPnpm(args, options, true);
     const fingerprint = await persistentMetadataFingerprintV4(runCapture);
     const provenance = await persistentMetadataStatusV4(fingerprint);
-    const nativesMatch = await nativeBinariesMatchRuntime();
+    const mismatchedNatives = await mismatchedNativeBinaries();
+    const nativesMatch = mismatchedNatives.length === 0;
+    const repairedNativeMismatch = !nativesMatch &&
+        provenance.kind === 'matching' &&
+        (await repairIsolatedNativeMismatch(options, runCapture, mismatchedNatives));
+    if (repairedNativeMismatch) {
+        console.warn('persistent optional native binaries do not match this runtime; reconciled');
+        console.warn(persistentProvenanceDiagnostic(provenance, options.installScripts, nativesMatch, {
+            action: 'reconcile',
+            reason: 'native-health-mismatch',
+        }));
+        await writePersistentMetadataStampV4(fingerprint, options.installScripts, true, []);
+        return 'persistent native health reconciled';
+    }
     const provisionalTransition = persistentInstallTransition(provenance, options.installScripts);
     let transition = nativesMatch
         ? provisionalTransition

package/dist/pnpm-install/support.d.mts

@@ -23,6 +23,7 @@ export type Workspace = {
     path: string;
 };
 export declare const baseInstallArgs: string[];
+export declare const forcedInstallArgs: string[];
 export declare function parseInstallOptions(argv: string[]): InstallOptions;
 export declare function listWorkspaces(runCapture: CaptureCommand): Promise<Workspace[]>;
 export declare function findWorkspaceLinkMismatches(runCapture: CaptureCommand): Promise<WorkspaceLinkMismatch[]>;

package/dist/pnpm-install/support.mjs

@@ -1,12 +1,12 @@
 import { readFile, realpath } from 'node:fs/promises';
 import path from 'node:path';
-export const baseInstallArgs = [
-    'install',
-    '--frozen-lockfile',
+const commonInstallArgs = [
     '--prefer-offline',
     '--prod=false',
     '--config.disallow-workspace-cycles=false',
 ];
+export const baseInstallArgs = ['install', '--frozen-lockfile', ...commonInstallArgs];
+export const forcedInstallArgs = ['install', '--frozen-lockfile', '--force', ...commonInstallArgs];
 const usage = 'usage: vouchington pnpm-install --runner-lifecycle persistent|ephemeral|ephemeral-full --install-scripts true|false [--ephemeral-workspaces <newline-separated selectors>] [--command-timeout-seconds <nonnegative integer>] [--max-attempts <positive integer>]';
 const MAX_COMMAND_TIMEOUT_SECONDS = 3600;
 const MAX_ATTEMPTS = 10;

package/dist/vitest-blob-manifest/cli.mjs

@@ -2,6 +2,7 @@
 import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { writeVitestBlobManifest } from './index.mjs';
+import { parseGitHubRunAttempt } from './run-attempt.mjs';
 function failRepository() {
     throw new Error('GITHUB_REPOSITORY is required');
 }
@@ -15,10 +16,7 @@ export function runVitestBlobManifestCli(args, env = process.env, revision = exe
     if (!suite || extra.length > 0 || !runId || !rawAttempt) {
         throw new Error('Usage: vouchington vitest-blob-manifest <suite> [reports-directory]');
     }
-    const runAttempt = Number(rawAttempt);
-    if (!Number.isSafeInteger(runAttempt) || runAttempt < 1) {
-        throw new Error('GITHUB_RUN_ATTEMPT must be a positive integer');
-    }
+    const runAttempt = parseGitHubRunAttempt(rawAttempt);
     writeVitestBlobManifest(directory, {
         suite,
         repository: env.GITHUB_REPOSITORY || failRepository(),

package/dist/vitest-blob-manifest/report-attempt-cli.d.mts

@@ -0,0 +1,2 @@
+/** Writes or reads authenticated-for-run Vitest report-attempt markers. */
+export declare function runVitestReportAttemptCli(args: readonly string[], env?: NodeJS.ProcessEnv, log?: (line: string) => void): void;

package/dist/vitest-blob-manifest/report-attempt-cli.mjs

@@ -0,0 +1,32 @@
+import { readVitestReportAttempts, writeVitestReportAttempt, } from './report-attempt.mjs';
+import { parseGitHubRunAttempt } from './run-attempt.mjs';
+function required(env, name) {
+    const value = env[name];
+    if (!value)
+        throw new Error(`${name} is required`);
+    return value;
+}
+function identity(env) {
+    return {
+        repository: required(env, 'GITHUB_REPOSITORY'),
+        revision: required(env, 'GITHUB_SHA'),
+        runId: required(env, 'GITHUB_RUN_ID'),
+        attempt: parseGitHubRunAttempt(env.GITHUB_RUN_ATTEMPT),
+    };
+}
+/** Writes or reads authenticated-for-run Vitest report-attempt markers. */
+export function runVitestReportAttemptCli(args, env = process.env, log = (line) => process.stdout.write(`${line}\n`)) {
+    const [command, path, suite, ...extra] = args;
+    if (extra.length > 0 || !path || (command !== 'write' && command !== 'read'))
+        throw new Error('Usage: vouchington vitest-report-attempt <write DIRECTORY SUITE|read ROOT>');
+    const current = identity(env);
+    if (command === 'write') {
+        if (!suite)
+            throw new Error('Usage: vouchington vitest-report-attempt <write DIRECTORY SUITE|read ROOT>');
+        writeVitestReportAttempt(path, suite, current);
+        return;
+    }
+    if (suite)
+        throw new Error('Usage: vouchington vitest-report-attempt <write DIRECTORY SUITE|read ROOT>');
+    log(JSON.stringify(readVitestReportAttempts(path, current)));
+}

package/dist/vitest-blob-manifest/reports-cli.d.mts

@@ -0,0 +1,2 @@
+/** Validates GitHub run context, then prepares the selected report JSON files. */
+export declare function runPrepareVitestReportsCli(args: readonly string[], env?: NodeJS.ProcessEnv, log?: (line: string) => void): void;

package/dist/vitest-blob-manifest/reports-cli.mjs

@@ -0,0 +1,55 @@
+import { VITEST_SUITE_PATTERN } from './constants.mjs';
+import { prepareVitestReports } from './reports.mjs';
+import { parseGitHubRunAttempt } from './run-attempt.mjs';
+function required(env, name) {
+    const value = env[name];
+    if (!value)
+        throw new Error(`${name} is required`);
+    return value;
+}
+function parseContext(raw, attempt) {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        throw new Error('Vitest report expectation context must be an object');
+    const context = parsed;
+    if (Object.keys(context).toSorted().join('\0') !== ['attempt', 'suites', 'version'].join('\0') ||
+        context.version !== 'vitest-report-expectations:v2' ||
+        context.attempt !== attempt ||
+        !Array.isArray(context.suites) ||
+        context.suites.some((expectation) => typeof expectation !== 'object' ||
+            expectation === null ||
+            Array.isArray(expectation) ||
+            Object.keys(expectation).toSorted().join('\0') !== ['minimumAttempt', 'suite'].join('\0') ||
+            typeof expectation.suite !== 'string' ||
+            !VITEST_SUITE_PATTERN.test(expectation.suite) ||
+            !Number.isSafeInteger(expectation.minimumAttempt) ||
+            Number(expectation.minimumAttempt) < 1 ||
+            Number(expectation.minimumAttempt) > attempt))
+        throw new Error('Vitest report expectation context has an invalid schema');
+    const typed = context;
+    const suites = typed.suites.map((expectation) => expectation.suite);
+    if (new Set(suites).size !== suites.length || suites.join('\0') !== suites.toSorted().join('\0'))
+        throw new Error('Vitest report expectation suites must be unique and sorted');
+    return typed;
+}
+/** Validates GitHub run context, then prepares the selected report JSON files. */
+export function runPrepareVitestReportsCli(args, env = process.env, log = (line) => process.stdout.write(`${line}\n`)) {
+    const [primaryDir = './vitest-blob-primary', fallbackDir = './vitest-blob-fallback', outputDir = './vitest-blob-reports/merge-input', ...extra] = args;
+    if (extra.length > 0)
+        throw new Error('Expected at most three Vitest report directories');
+    const currentAttempt = parseGitHubRunAttempt(env.GITHUB_RUN_ATTEMPT);
+    const result = prepareVitestReports({
+        primaryDir,
+        fallbackDir,
+        outputDir,
+        expectedSuites: parseContext(required(env, 'VITEST_REPORT_EXPECTATIONS'), currentAttempt)
+            .suites,
+        repository: required(env, 'GITHUB_REPOSITORY'),
+        revision: required(env, 'GITHUB_SHA'),
+        run: { id: required(env, 'GITHUB_RUN_ID'), currentAttempt },
+    });
+    for (const rejected of result.rejectedSources)
+        log(`::warning::Rejected Vitest ${rejected.source} report source: ${rejected.reason}`);
+    for (const selected of result.selected)
+        log(`Selected Vitest report ${selected.suite} from attempt ${selected.attempt} (${selected.sources.join('+')})`);
+}

package/dist/vitest-blob-manifest/run-attempt.d.mts

@@ -0,0 +1,2 @@
+/** Reads a GitHub Actions attempt as a canonical, positive decimal integer. */
+export declare function parseGitHubRunAttempt(rawAttempt: string | undefined): number;

package/dist/vitest-blob-manifest/run-attempt.mjs

@@ -0,0 +1,11 @@
+/** Reads a GitHub Actions attempt as a canonical, positive decimal integer. */
+export function parseGitHubRunAttempt(rawAttempt) {
+    if (!rawAttempt)
+        throw new Error('GITHUB_RUN_ATTEMPT is required');
+    if (!/^[1-9][0-9]*$/.test(rawAttempt))
+        throw new Error('GITHUB_RUN_ATTEMPT must be a positive integer');
+    const attempt = Number(rawAttempt);
+    if (!Number.isSafeInteger(attempt))
+        throw new Error('GITHUB_RUN_ATTEMPT must be a positive integer');
+    return attempt;
+}

package/dist/workspace-gates/manifest-version-assertions.d.mts

@@ -0,0 +1,3 @@
+import type { SharedContext } from '../shared-context/index.mts';
+/** Keeps Dependabot updates independent from literal dependency-version test assertions. */
+export declare function checkManifestDependencyVersionAssertions(ctx: SharedContext, errors: string[]): void;

package/dist/workspace-gates/manifest-version-assertions.mjs

@@ -0,0 +1,100 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { findExpectations } from './manifest-version-parser.mjs';
+import { buildDependencyMatchers, SEMVER_LITERAL } from './manifest-version-patterns.mjs';
+const TEST_SOURCE_FILE = /(?:^|\/)[^/]+\.(?:test|spec)\.[cm]?[jt]sx?$/u;
+const PACKAGE_JSON_FILE = /(?:^|\/)package\.json$/u;
+const TEST_OR_FIXTURE_DIRECTORY = /(?:^|\/)(?:test|tests|__tests__|fixture|fixtures|__fixtures__)(?:\/|$)/u;
+const DEPENDENCY_FIELD = /\b(?:dependencies|devDependencies|optionalDependencies|peerDependencies)\b/u;
+const STRING_LITERAL = /'([^'\\]*(?:\\.[^'\\]*)*)'|"([^"\\]*(?:\\.[^"\\]*)*)"|`([^`\\$]*(?:\\.[^`\\$]*)*)`/gu;
+function readTrackedSource(ctx, file) {
+    try {
+        return ctx.readTrackedFile
+            ? ctx.readTrackedFile(file)
+            : readFileSync(join(ctx.repoRoot, file), 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function dependencyNames(ctx) {
+    const names = new Set();
+    for (const file of ctx.trackedFiles) {
+        if (!PACKAGE_JSON_FILE.test(file) || TEST_OR_FIXTURE_DIRECTORY.test(file))
+            continue;
+        const source = readTrackedSource(ctx, file);
+        if (source === null)
+            continue;
+        let manifest;
+        try {
+            manifest = JSON.parse(source);
+        }
+        catch {
+            continue;
+        }
+        if (typeof manifest !== 'object' || manifest === null || Array.isArray(manifest))
+            continue;
+        for (const field of [
+            'dependencies',
+            'devDependencies',
+            'optionalDependencies',
+            'peerDependencies',
+        ]) {
+            const dependencies = manifest[field];
+            if (typeof dependencies !== 'object' || dependencies === null || Array.isArray(dependencies))
+                continue;
+            for (const name of Object.keys(dependencies))
+                names.add(name);
+        }
+    }
+    return names;
+}
+function literalValues(source) {
+    return [...source.matchAll(STRING_LITERAL)].map((match) => (match[1] ?? match[2] ?? match[3]));
+}
+function expectedDependencyNames(values, names) {
+    return values.some((value) => SEMVER_LITERAL.test(value))
+        ? values.filter((value) => names.has(value))
+        : [];
+}
+/** Keeps Dependabot updates independent from literal dependency-version test assertions. */
+export function checkManifestDependencyVersionAssertions(ctx, errors) {
+    const names = dependencyNames(ctx);
+    if (names.size === 0)
+        return;
+    const matchers = buildDependencyMatchers(names);
+    for (const file of ctx.trackedFiles) {
+        if (!TEST_SOURCE_FILE.test(file))
+            continue;
+        const source = readTrackedSource(ctx, file);
+        if (source === null) {
+            errors.push(`::error file=${file}::${file}: failed to read test source for manifest dependency version assertions`);
+            continue;
+        }
+        for (const expectation of findExpectations(source)) {
+            const asserted = new Set();
+            if (DEPENDENCY_FIELD.test(expectation.expression)) {
+                const values = literalValues(expectation.expected);
+                if (values.length === 1 && SEMVER_LITERAL.test(values[0])) {
+                    for (const matcher of matchers)
+                        if (matcher.member.test(expectation.expression))
+                            asserted.add(matcher.name);
+                }
+                for (const name of expectedDependencyNames(values, names))
+                    asserted.add(name);
+                for (const matcher of matchers)
+                    if (matcher.objectValue.test(expectation.expected))
+                        asserted.add(matcher.name);
+            }
+            for (const value of literalValues(expectation.expected)) {
+                for (const matcher of matchers)
+                    if (matcher.packageSpec.test(value))
+                        asserted.add(matcher.name);
+            }
+            for (const name of asserted) {
+                const line = source.slice(0, expectation.index).split('\n').length;
+                errors.push(`::error file=${file},line=${line}::${file}:${line}: tests must not assert the exact version of declared dependency "${name}"; assert dependency membership or derive the value from the manifest instead`);
+            }
+        }
+    }
+}

package/dist/workspace-gates/manifest-version-parser.d.mts

@@ -0,0 +1,6 @@
+export type Expectation = {
+    expression: string;
+    expected: string;
+    index: number;
+};
+export declare function findExpectations(source: string): Expectation[];

package/dist/workspace-gates/manifest-version-parser.mjs

@@ -0,0 +1,104 @@
+const EXPECTATION_MATCHER = /^\s*(?:\.|\?\.)\s*(?:not\s*\.\s*)?to(?:Be|Equal|StrictEqual|MatchObject|Contain|ContainEqual|HaveProperty)\s*\(/u;
+function previousToken(source, index) {
+    for (let cursor = index - 1; cursor >= 0; cursor -= 1) {
+        if (!/\s/u.test(source[cursor]))
+            return source[cursor];
+    }
+    return undefined;
+}
+function skipRegex(source, index) {
+    const previous = previousToken(source, index);
+    if (previous && /[\w$)\]]/u.test(previous))
+        return index;
+    let characterClass = false;
+    for (let cursor = index + 1; cursor < source.length; cursor += 1) {
+        if (source[cursor] === '\\') {
+            cursor += 1;
+            continue;
+        }
+        if (source[cursor] === '[')
+            characterClass = true;
+        if (source[cursor] === ']')
+            characterClass = false;
+        if (source[cursor] === '/' && !characterClass)
+            return cursor + 1;
+        if (source[cursor] === '\n')
+            return index;
+    }
+    return index;
+}
+function skipLiteralOrComment(source, index) {
+    const marker = source[index];
+    if (marker === '/' && source[index + 1] === '/') {
+        const end = source.indexOf('\n', index + 2);
+        return end === -1 ? source.length : end;
+    }
+    if (marker === '/' && source[index + 1] === '*') {
+        const end = source.indexOf('*/', index + 2);
+        return end === -1 ? source.length : end + 2;
+    }
+    if (marker === '/')
+        return skipRegex(source, index);
+    if (marker !== "'" && marker !== '"' && marker !== '`')
+        return index;
+    for (let cursor = index + 1; cursor < source.length; cursor += 1) {
+        if (source[cursor] === '\\') {
+            cursor += 1;
+            continue;
+        }
+        if (source[cursor] === marker)
+            return cursor + 1;
+    }
+    return source.length;
+}
+function closingParenthesis(source, open) {
+    let depth = 1;
+    for (let cursor = open + 1; cursor < source.length; cursor += 1) {
+        const skipped = skipLiteralOrComment(source, cursor);
+        if (skipped !== cursor) {
+            cursor = skipped - 1;
+            continue;
+        }
+        if (source[cursor] === '(')
+            depth += 1;
+        if (source[cursor] === ')')
+            depth -= 1;
+        if (depth === 0)
+            return cursor;
+    }
+    return -1;
+}
+export function findExpectations(source) {
+    const found = [];
+    for (let cursor = 0; cursor < source.length; cursor += 1) {
+        const skipped = skipLiteralOrComment(source, cursor);
+        if (skipped !== cursor) {
+            cursor = skipped - 1;
+            continue;
+        }
+        if (!source.startsWith('expect', cursor) || /[\w$]/u.test(source[cursor - 1] ?? ''))
+            continue;
+        let open = cursor + 'expect'.length;
+        while (/\s/u.test(source[open]))
+            open += 1;
+        if (source[open] !== '(')
+            continue;
+        const expressionEnd = closingParenthesis(source, open);
+        if (expressionEnd === -1)
+            continue;
+        const matcher = source.slice(expressionEnd + 1).match(EXPECTATION_MATCHER);
+        if (!matcher)
+            continue;
+        const expectedOpen = expressionEnd + 1 + matcher[0].length - 1;
+        const expectedEnd = closingParenthesis(source, expectedOpen);
+        if (expectedEnd === -1)
+            continue;
+        found.push({
+            expression: source.slice(open + 1, expressionEnd),
+            expected: source.slice(expectedOpen + 1, expectedEnd),
+            index: cursor,
+        });
+        cursor = expectedEnd;
+    }
+    return found;
+}

package/dist/workspace-gates/manifest-version-patterns.d.mts

@@ -0,0 +1,9 @@
+export declare const SEMVER_SOURCE = "[~^<>=*v\\s]*\\d+\\.\\d+(?:\\.\\d+)?(?:[-+][0-9A-Za-z.-]+)?";
+export declare const SEMVER_LITERAL: RegExp;
+export type DependencyMatcher = {
+    readonly name: string;
+    readonly member: RegExp;
+    readonly objectValue: RegExp;
+    readonly packageSpec: RegExp;
+};
+export declare function buildDependencyMatchers(names: ReadonlySet<string>): DependencyMatcher[];

package/dist/workspace-gates/manifest-version-patterns.mjs

@@ -0,0 +1,21 @@
+export const SEMVER_SOURCE = '[~^<>=*v\\s]*\\d+\\.\\d+(?:\\.\\d+)?(?:[-+][0-9A-Za-z.-]+)?';
+export const SEMVER_LITERAL = new RegExp(`^${SEMVER_SOURCE}$`, 'u');
+function escapeRegex(value) {
+    return value.replaceAll(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+}
+export function buildDependencyMatchers(names) {
+    return [...names].map((name) => {
+        const escaped = escapeRegex(name);
+        const plainName = /^[A-Za-z_$][\w$]*$/u.test(name);
+        const member = plainName
+            ? `(?:\\[\\s*['"]${escaped}['"]\\s*\\]|\\.\\s*${escaped})`
+            : `\\[\\s*['"]${escaped}['"]\\s*\\]`;
+        const key = plainName ? `(?:${escaped}|['"]${escaped}['"])` : `['"]${escaped}['"]`;
+        return {
+            name,
+            member: new RegExp(member, 'u'),
+            objectValue: new RegExp(`${key}\\s*:\\s*(['"])${SEMVER_SOURCE}\\1`, 'u'),
+            packageSpec: new RegExp(`^${escaped}@${SEMVER_SOURCE}$`, 'u'),
+        };
+    });
+}

package/dist/workspace-gates/policy.mjs

@@ -1,12 +1,14 @@
 import { validateReleaseAgeExemptionGroups } from '../pnpm-install/index.mjs';
 import { checkDependabotCrosslist } from './dependabot.mjs';
 import { checkExcludeRegistry } from './exclude-registry.mjs';
+import { checkManifestDependencyVersionAssertions } from './manifest-version-assertions.mjs';
 import { checkActiveFirstPartyGraph, checkTemporaryReleaseAgeSelectorsInLockfile, } from './first-party-graph.mjs';
 import { resolveWorkspaceGatesOptions, shouldValidateTemporaryGroups, } from './options.mjs';
 import { loadYaml } from './yaml-loader.mjs';
 export async function checkWorkspaceGatesPolicy(ctx, options) {
     const errors = [];
     const resolved = resolveWorkspaceGatesOptions(options);
+    checkManifestDependencyVersionAssertions(ctx, errors);
     if (shouldValidateTemporaryGroups(options) && options.temporaryGroups !== undefined) {
         for (const error of validateReleaseAgeExemptionGroups(options.temporaryGroups)) {
             errors.push(`::error::${error}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.3.6",
+  "version": "0.4.0",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {
@@ -255,7 +255,7 @@
     "csv-parse": "7.0.2",
     "csv-stringify": "6.8.3",
     "dockerfile-ast": "0.7.1",
-    "picomatch": "4.0.5",
+    "picomatch": "4.0.7",
     "yaml": "2.9.0"
   },
   "devDependencies": {