@celljs/cli 3.8.0 → 4.0.0

package/src/deploy/request-signer.ts

@@ -0,0 +1,155 @@
+import { createHash, createHmac, randomBytes } from 'node:crypto';
+
+export interface SignableRequest {
+    method: string;
+    host: string;
+    /** Path without the query, e.g. `/2023-03-30/functions/app`. */
+    path: string;
+    query?: Record<string, string>;
+    headers?: Record<string, string>;
+    body?: string;
+}
+
+const sha256 = (data: string | Buffer) => createHash('sha256').update(data).digest('hex');
+const hmac = (key: string | Buffer, data: string) => createHmac('sha256', key).update(data).digest();
+
+/** RFC 3986 encoding, as the three clouds canonicalise paths and queries. */
+export function rfc3986(value: string): string {
+    return encodeURIComponent(value).replace(/[!'()*]/g, c => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+
+function canonicalQuery(query: Record<string, string> = {}): string {
+    return Object.keys(query)
+        .sort()
+        .map(key => `${rfc3986(key)}=${rfc3986(query[key])}`)
+        .join('&');
+}
+
+function canonicalPath(path: string): string {
+    return path
+        .split('/')
+        .map(segment => rfc3986(decodeURIComponent(segment)))
+        .join('/');
+}
+
+/** Lowercased headers, sorted, as `name:value` lines and the list of their names. */
+function canonicalHeaders(headers: Record<string, string>): { lines: string; names: string } {
+    const entries = Object.entries(headers)
+        .map(([k, v]) => [k.toLowerCase(), String(v).trim()] as const)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return { lines: entries.map(([k, v]) => `${k}:${v}\n`).join(''), names: entries.map(([k]) => k).join(';') };
+}
+
+/**
+ * The request signatures of the cloud APIs Cell deploys to, written against their published
+ * algorithms (no SDKs): Alibaba Cloud ACS3-HMAC-SHA256, Tencent Cloud TC3-HMAC-SHA256 and AWS
+ * Signature Version 4. Each returns the headers to send, `Authorization` included.
+ */
+export namespace RequestSigner {
+    export interface AlibabaCredentials {
+        accessKeyId: string;
+        accessKeySecret: string;
+        securityToken?: string;
+    }
+
+    export function acs3(
+        request: SignableRequest & { action: string; version: string },
+        credentials: AlibabaCredentials,
+        now = new Date(),
+        nonce = randomBytes(16).toString('hex'),
+    ): Record<string, string> {
+        const body = request.body ?? '';
+        const headers: Record<string, string> = {
+            host: request.host,
+            'x-acs-action': request.action,
+            'x-acs-content-sha256': sha256(body),
+            'x-acs-date': now.toISOString().replace(/\.\d{3}Z$/, 'Z'),
+            'x-acs-signature-nonce': nonce,
+            'x-acs-version': request.version,
+            ...(credentials.securityToken ? { 'x-acs-security-token': credentials.securityToken } : {}),
+            ...(request.headers ?? {}),
+        };
+        const signed = canonicalHeaders(
+            Object.fromEntries(Object.entries(headers).filter(([k]) => k === 'host' || k === 'content-type' || k.startsWith('x-acs-'))),
+        );
+        const canonical = [
+            request.method,
+            canonicalPath(request.path),
+            canonicalQuery(request.query),
+            signed.lines,
+            signed.names,
+            headers['x-acs-content-sha256'],
+        ].join('\n');
+        const signature = createHmac('sha256', credentials.accessKeySecret)
+            .update(`ACS3-HMAC-SHA256\n${sha256(canonical)}`)
+            .digest('hex');
+        return {
+            ...headers,
+            authorization: `ACS3-HMAC-SHA256 Credential=${credentials.accessKeyId},SignedHeaders=${signed.names},Signature=${signature}`,
+        };
+    }
+
+    export interface TencentCredentials {
+        secretId: string;
+        secretKey: string;
+        token?: string;
+    }
+
+    /** A Tencent Cloud API 3.0 call: POST of JSON to `<service>.tencentcloudapi.com`. */
+    export function tc3(
+        request: { service: string; host: string; action: string; version: string; region?: string; body: string },
+        credentials: TencentCredentials,
+        now = new Date(),
+    ): Record<string, string> {
+        const timestamp = Math.floor(now.getTime() / 1000);
+        const date = new Date(timestamp * 1000).toISOString().slice(0, 10);
+        const contentType = 'application/json; charset=utf-8';
+        const canonical = ['POST', '/', '', `content-type:${contentType}\nhost:${request.host}\n`, 'content-type;host', sha256(request.body)].join('\n');
+        const scope = `${date}/${request.service}/tc3_request`;
+        const toSign = ['TC3-HMAC-SHA256', String(timestamp), scope, sha256(canonical)].join('\n');
+        const key = hmac(hmac(hmac(`TC3${credentials.secretKey}`, date), request.service), 'tc3_request');
+        const signature = createHmac('sha256', key).update(toSign).digest('hex');
+        return {
+            authorization: `TC3-HMAC-SHA256 Credential=${credentials.secretId}/${scope}, SignedHeaders=content-type;host, Signature=${signature}`,
+            'content-type': contentType,
+            host: request.host,
+            'x-tc-action': request.action,
+            'x-tc-timestamp': String(timestamp),
+            'x-tc-version': request.version,
+            ...(request.region ? { 'x-tc-region': request.region } : {}),
+            ...(credentials.token ? { 'x-tc-token': credentials.token } : {}),
+        };
+    }
+
+    export interface AwsCredentials {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken?: string;
+    }
+
+    export function sigv4(
+        request: SignableRequest & { service: string; region: string },
+        credentials: AwsCredentials,
+        now = new Date(),
+    ): Record<string, string> {
+        const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, '');
+        const date = amzDate.slice(0, 8);
+        const body = request.body ?? '';
+        const headers: Record<string, string> = {
+            host: request.host,
+            'x-amz-date': amzDate,
+            ...(credentials.sessionToken ? { 'x-amz-security-token': credentials.sessionToken } : {}),
+            ...(request.headers ?? {}),
+        };
+        const signed = canonicalHeaders(headers);
+        const canonical = [request.method, canonicalPath(request.path), canonicalQuery(request.query), signed.lines, signed.names, sha256(body)].join('\n');
+        const scope = `${date}/${request.region}/${request.service}/aws4_request`;
+        const toSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256(canonical)].join('\n');
+        const key = hmac(hmac(hmac(hmac(`AWS4${credentials.secretAccessKey}`, date), request.region), request.service), 'aws4_request');
+        const signature = createHmac('sha256', key).update(toSign).digest('hex');
+        return {
+            ...headers,
+            authorization: `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signed.names}, Signature=${signature}`,
+        };
+    }
+}

package/src/deploy/zip-writer.ts

@@ -0,0 +1,132 @@
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, sep } from 'node:path';
+import { deflateRawSync } from 'node:zlib';
+
+interface ZipEntry {
+    name: Buffer;
+    crc: number;
+    size: number;
+    compressed: Buffer;
+    method: 0 | 8;
+    mode: number;
+    offset: number;
+}
+
+/**
+ * Writes zip archives (the code packages of FC, SCF and Lambda) without a dependency: deflate from
+ * node:zlib, Unix permissions in the external attributes so start scripts stay executable, a fixed
+ * timestamp so the same output gives the same archive.
+ */
+export class ZipWriter {
+    /** 1980-01-01 00:00, the earliest DOS date. */
+    static readonly DOS_DATE = (0 << 9) | (1 << 5) | 1;
+    protected static readonly CRC_TABLE = ZipWriter.crcTable();
+
+    protected readonly entries: ZipEntry[] = [];
+    protected readonly chunks: Buffer[] = [];
+    protected offset = 0;
+
+    /** Adds every file under `dir`, sorted, at `prefix` (`a/b` style) in the archive. */
+    addDirectory(dir: string, prefix = ''): this {
+        for (const name of (readdirSync(dir, { recursive: true }) as string[]).sort()) {
+            const file = join(dir, name);
+            const stat = statSync(file);
+            if (stat.isFile()) {
+                this.add(`${prefix}${name.split(sep).join('/')}`, readFileSync(file), stat.mode & 0o777);
+            }
+        }
+        return this;
+    }
+
+    add(name: string, content: Buffer | string, mode = 0o644): this {
+        const data = typeof content === 'string' ? Buffer.from(content) : content;
+        const deflated = deflateRawSync(data, { level: 9 });
+        const stored = deflated.length >= data.length;
+        const entry: ZipEntry = {
+            name: Buffer.from(name),
+            crc: ZipWriter.crc32(data),
+            size: data.length,
+            compressed: stored ? data : deflated,
+            method: stored ? 0 : 8,
+            mode,
+            offset: this.offset,
+        };
+        const header = Buffer.alloc(30);
+        header.writeUInt32LE(0x04034b50, 0);
+        header.writeUInt16LE(20, 4);
+        header.writeUInt16LE(0x0800, 6);
+        header.writeUInt16LE(entry.method, 8);
+        header.writeUInt16LE(0, 10);
+        header.writeUInt16LE(ZipWriter.DOS_DATE, 12);
+        header.writeUInt32LE(entry.crc, 14);
+        header.writeUInt32LE(entry.compressed.length, 18);
+        header.writeUInt32LE(entry.size, 22);
+        header.writeUInt16LE(entry.name.length, 26);
+        header.writeUInt16LE(0, 28);
+        this.push(header, entry.name, entry.compressed);
+        this.entries.push(entry);
+        return this;
+    }
+
+    toBuffer(): Buffer {
+        const start = this.offset;
+        const central: Buffer[] = [];
+        for (const entry of this.entries) {
+            const header = Buffer.alloc(46);
+            header.writeUInt32LE(0x02014b50, 0);
+            // Made by Unix (3), so the external attributes carry the file mode.
+            header.writeUInt16LE((3 << 8) | 20, 4);
+            header.writeUInt16LE(20, 6);
+            header.writeUInt16LE(0x0800, 8);
+            header.writeUInt16LE(entry.method, 10);
+            header.writeUInt16LE(0, 12);
+            header.writeUInt16LE(ZipWriter.DOS_DATE, 14);
+            header.writeUInt32LE(entry.crc, 16);
+            header.writeUInt32LE(entry.compressed.length, 20);
+            header.writeUInt32LE(entry.size, 24);
+            header.writeUInt16LE(entry.name.length, 28);
+            header.writeUInt32LE(((0o100000 | entry.mode) << 16) >>> 0, 38);
+            header.writeUInt32LE(entry.offset, 42);
+            central.push(header, entry.name);
+        }
+        const size = central.reduce((n, b) => n + b.length, 0);
+        const end = Buffer.alloc(22);
+        end.writeUInt32LE(0x06054b50, 0);
+        end.writeUInt16LE(this.entries.length, 8);
+        end.writeUInt16LE(this.entries.length, 10);
+        end.writeUInt32LE(size, 12);
+        end.writeUInt32LE(start, 16);
+        return Buffer.concat([...this.chunks, ...central, end]);
+    }
+
+    get files(): number {
+        return this.entries.length;
+    }
+
+    protected push(...buffers: Buffer[]): void {
+        for (const buffer of buffers) {
+            this.chunks.push(buffer);
+            this.offset += buffer.length;
+        }
+    }
+
+    static crc32(data: Buffer): number {
+        let crc = 0xffffffff;
+        for (let i = 0; i < data.length; i++) {
+            crc = ZipWriter.CRC_TABLE[(crc ^ data[i]) & 0xff] ^ (crc >>> 8);
+        }
+        return (crc ^ 0xffffffff) >>> 0;
+    }
+
+    protected static crcTable(): Uint32Array {
+        const table = new Uint32Array(256);
+        for (let n = 0; n < 256; n++) {
+            let c = n;
+            for (let k = 0; k < 8; k++) {
+                c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+            }
+            table[n] = c >>> 0;
+        }
+        return table;
+    }
+}

package/src/docs/docs-index.ts

@@ -0,0 +1,174 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+
+/** Where documentation is read from: a directory of Markdown or one file, and who provides it. */
+export interface DocsSource {
+    path: string;
+    /** Component or toolchain module that provides it. */
+    source: string;
+}
+
+/** A section of a Markdown file: from one heading to the next. */
+export interface DocsSection {
+    /** Relative to the project root. */
+    file: string;
+    line: number;
+    title: string;
+    source: string;
+    text: string;
+}
+
+export interface DocsHit extends Omit<DocsSection, 'text'> {
+    score: number;
+    text: string;
+    /** The section was longer than the text. */
+    truncated?: true;
+}
+
+/**
+ * Searches the Markdown that ships with the installed components and toolchain modules (README.md
+ * and `docs/` of each component, `cell.addDocs()` directories), so agents read the docs of the
+ * versions the project uses (docs/design/agent-first.md R7). Sections are ranked by how many query
+ * words they contain, headings counting more.
+ */
+export class DocsIndex {
+    static readonly MAX_TEXT = 1500;
+    static readonly MAX_FILES = 2000;
+
+    protected sections?: DocsSection[];
+    protected fileCount = 0;
+
+    constructor(
+        protected readonly root: string,
+        protected readonly sources: DocsSource[],
+    ) {}
+
+    /** README.md and docs/ of each component directory, then the modules' docs directories. */
+    static sourcesOf(components: readonly { name: string; dir: string }[], moduleDocs: readonly { source: string; value: string }[]): DocsSource[] {
+        return [
+            ...components.flatMap(c => [
+                { path: join(c.dir, 'README.md'), source: c.name },
+                { path: join(c.dir, 'docs'), source: c.name },
+            ]),
+            ...moduleDocs.map(d => ({ path: d.value, source: d.source })),
+        ].filter(s => existsSync(s.path));
+    }
+
+    get files(): number {
+        this.load();
+        return this.fileCount;
+    }
+
+    search(query: string, limit = 5): DocsHit[] {
+        const terms = DocsIndex.terms(query);
+        if (terms.length === 0) {
+            return [];
+        }
+        const hits: DocsHit[] = [];
+        for (const section of this.load()) {
+            const title = section.title.toLowerCase();
+            const body = section.text.toLowerCase();
+            let score = 0;
+            let matched = 0;
+            for (const term of terms) {
+                const inTitle = DocsIndex.count(title, term);
+                const inBody = Math.min(DocsIndex.count(body, term), 10);
+                if (inTitle + inBody > 0) {
+                    matched++;
+                    score += inTitle * 5 + inBody;
+                }
+            }
+            if (matched > 0) {
+                // Sections with every word come first.
+                score = Math.round(score * (matched / terms.length) ** 2 * 100) / 100;
+                const truncated = section.text.length > DocsIndex.MAX_TEXT;
+                hits.push({
+                    ...section,
+                    score,
+                    text: truncated ? `${section.text.slice(0, DocsIndex.MAX_TEXT)}…` : section.text,
+                    ...(truncated ? { truncated: true as const } : {}),
+                });
+            }
+        }
+        return hits.sort((a, b) => b.score - a.score || a.file.localeCompare(b.file) || a.line - b.line).slice(0, limit);
+    }
+
+    /** Lowercased words of the query; words of two characters or fewer only when nothing else is left. */
+    static terms(query: string): string[] {
+        const words = [
+            ...new Set(
+                query
+                    .toLowerCase()
+                    .split(/[\s,;:!?()[\]{}"'\x60]+/)
+                    .filter(Boolean),
+            ),
+        ];
+        const long = words.filter(w => w.length > 2);
+        return long.length > 0 ? long : words;
+    }
+
+    protected static count(text: string, term: string): number {
+        let n = 0;
+        for (let i = text.indexOf(term); i !== -1; i = text.indexOf(term, i + term.length)) {
+            n++;
+        }
+        return n;
+    }
+
+    protected load(): DocsSection[] {
+        if (!this.sections) {
+            this.sections = [];
+            const seen = new Set<string>();
+            for (const { path, source } of this.sources) {
+                for (const file of this.markdownFiles(path)) {
+                    if (seen.has(file) || seen.size >= DocsIndex.MAX_FILES) {
+                        continue;
+                    }
+                    seen.add(file);
+                    this.sections.push(...DocsIndex.split(readFileSync(file, 'utf8'), relative(this.root, file) || file, source));
+                }
+            }
+            this.fileCount = seen.size;
+        }
+        return this.sections;
+    }
+
+    protected markdownFiles(path: string): string[] {
+        if (statSync(path).isFile()) {
+            return /\.mdx?$/i.test(path) ? [path] : [];
+        }
+        return (readdirSync(path, { recursive: true }) as string[])
+            .filter(name => /\.mdx?$/i.test(name) && !name.split(/[\\/]/).includes('node_modules'))
+            .map(name => join(path, name))
+            .filter(file => statSync(file).isFile())
+            .sort();
+    }
+
+    /** Splits Markdown at headings, ignoring `#` lines inside fenced code. */
+    static split(markdown: string, file: string, source: string): DocsSection[] {
+        const sections: DocsSection[] = [];
+        let current: DocsSection = { file, line: 1, title: file, source, text: '' };
+        const lines: string[] = [];
+        let fence = false;
+        const flush = () => {
+            current.text = lines.join('\n').trim();
+            if (current.text || current.title !== file) {
+                sections.push(current);
+            }
+            lines.length = 0;
+        };
+        markdown.split(/\r?\n/).forEach((line, i) => {
+            if (/^\s*(\x60\x60\x60|~~~)/.test(line)) {
+                fence = !fence;
+            }
+            const heading = fence ? null : /^#{1,6}\s+(.+?)\s*#*\s*$/.exec(line);
+            if (heading) {
+                flush();
+                current = { file, line: i + 1, title: heading[1], source, text: '' };
+            }
+            lines.push(line);
+        });
+        flush();
+        return sections;
+    }
+}

package/src/events/event-bus.ts

@@ -0,0 +1,94 @@
+import { CellError, type CellEventName, EVENT_RULES, type GateResult } from '@celljs/kit';
+
+export type EventHandler = (event: any) => unknown;
+
+interface Subscription {
+    handler: EventHandler;
+    /** Who registered the handler: a module name or `hooks`; reported when it fails. */
+    source: string;
+}
+
+/**
+ * Dispatches toolchain events by the fixed rule of each event (docs/design/modules.md §3.2). Handlers
+ * run one after another in registration order; a dispatch works on a snapshot of the handlers.
+ */
+export class EventBus {
+    protected readonly handlers = new Map<CellEventName, Subscription[]>();
+
+    /**
+     * @param onNotifyError where failures of notification handlers go instead of failing the dispatch:
+     * `cell dev` keeps running (docs/design/modules.md §3.4); builds leave it unset and fail.
+     */
+    constructor(protected readonly onNotifyError?: (error: CellError) => void) {}
+
+    on(event: CellEventName, handler: EventHandler, source = 'unknown'): () => void {
+        const list = this.handlers.get(event) ?? [];
+        const subscription = { handler, source };
+        this.handlers.set(event, [...list, subscription]);
+        return () =>
+            this.handlers.set(
+                event,
+                (this.handlers.get(event) ?? []).filter(s => s !== subscription),
+            );
+    }
+
+    /** Notification and mutation events: every handler runs; the first failure stops the dispatch. */
+    async emit<E extends object>(event: CellEventName, payload: E): Promise<E> {
+        if (EVENT_RULES[event] === 'gate') {
+            throw new Error(`${event} is a gate event; dispatch it with gate().`);
+        }
+        for (const { handler, source } of this.snapshot(event)) {
+            try {
+                await handler(payload);
+            } catch (error) {
+                const failure = EventBus.handlerError(event, source, error);
+                if (this.onNotifyError && EVENT_RULES[event] === 'notify') {
+                    this.onNotifyError(failure);
+                    continue;
+                }
+                throw failure;
+            }
+        }
+        return payload;
+    }
+
+    /** Gate events: the first handler returning `{ cancel: true }` or throwing (fail closed) stops the operation. */
+    async gate(event: CellEventName, payload: object): Promise<GateResult | undefined> {
+        if (EVENT_RULES[event] !== 'gate') {
+            throw new Error(`${event} is not a gate event; dispatch it with emit().`);
+        }
+        for (const { handler, source } of this.snapshot(event)) {
+            let result: unknown;
+            try {
+                result = await handler(payload);
+            } catch (error) {
+                return {
+                    cancel: true,
+                    reason: `${source} failed on ${event}: ${CellError.is(error) ? error.message : String((error as Error)?.message ?? error)}`,
+                };
+            }
+            const gate = result as Partial<GateResult> | undefined;
+            if (gate?.cancel === true) {
+                return { cancel: true, reason: gate.reason ?? `cancelled by ${source}` };
+            }
+        }
+        return undefined;
+    }
+
+    protected snapshot(event: CellEventName): Subscription[] {
+        return [...(this.handlers.get(event) ?? [])];
+    }
+
+    /** Cell errors keep their code; anything else becomes `CELL_MODULE_ERROR` naming the source. */
+    static handlerError(event: CellEventName, source: string, error: unknown): CellError {
+        if (CellError.is(error)) {
+            return error;
+        }
+        return new CellError({
+            code: 'CELL_MODULE_ERROR',
+            message: `${source} failed on ${event}: ${(error as Error)?.message ?? String(error)}`,
+            hint: `Fix the ${event} handler of ${source}.`,
+            cause: error,
+        });
+    }
+}

package/src/events/hook-runner.ts

@@ -0,0 +1,78 @@
+import { spawn } from 'node:child_process';
+import { delimiter, dirname, join } from 'node:path';
+import { CellError, EVENT_RULES, type HookableEventName } from '@celljs/kit';
+import type { EventBus } from './event-bus.js';
+
+export interface HookRunnerOptions {
+    root: string;
+    preset: string;
+    mode: string[];
+    /** Absolute output directory, passed to commands as `CELL_OUT_DIR`. */
+    outDir: string;
+    /** Send command output to stderr, keeping stdout for the JSON result. */
+    quiet?: boolean;
+    env?: NodeJS.ProcessEnv;
+}
+
+/**
+ * Runs the shell commands of cell.config.ts `hooks` on their events: in the project root, without
+ * standard input, with `CELL_EVENT`, `CELL_PRESET`, `CELL_MODE` and `CELL_OUT_DIR` set. A failing command cancels a
+ * gate event and fails a notification event.
+ */
+export class HookRunner {
+    constructor(protected readonly options: HookRunnerOptions) {}
+
+    register(bus: EventBus, hooks: Partial<Record<HookableEventName, string>>): void {
+        for (const [event, command] of Object.entries(hooks) as [HookableEventName, string][]) {
+            bus.on(event, () => this.handle(event, command), 'hooks');
+        }
+    }
+
+    protected async handle(event: HookableEventName, command: string): Promise<unknown> {
+        const code = await this.exec(event, command);
+        if (code === 0) {
+            return undefined;
+        }
+        if (EVENT_RULES[event] === 'gate') {
+            return { cancel: true, reason: `hooks['${event}'] (${command}) exited with code ${code}` };
+        }
+        throw new CellError({
+            code: 'CELL_HOOK_FAILED',
+            message: `hooks['${event}'] (${command}) exited with code ${code}.`,
+            hint: 'Fix the command, or run it by hand in the project root to see the failure.',
+        });
+    }
+
+    /** Like package.json scripts: `node_modules/.bin` of the project and its ancestors come first on PATH. */
+    static withLocalBins(env: NodeJS.ProcessEnv, root: string): NodeJS.ProcessEnv {
+        const key = Object.keys(env).find(k => k.toUpperCase() === 'PATH') ?? 'PATH';
+        const bins: string[] = [];
+        for (let dir = root; ; dir = dirname(dir)) {
+            bins.push(join(dir, 'node_modules', '.bin'));
+            if (dirname(dir) === dir) {
+                break;
+            }
+        }
+        return { ...env, [key]: [...bins, env[key]].filter(Boolean).join(delimiter) };
+    }
+
+    exec(event: HookableEventName, command: string): Promise<number> {
+        const { root, preset, mode, outDir, quiet, env } = this.options;
+        return new Promise((resolve, reject) => {
+            const child = spawn(command, {
+                shell: true,
+                cwd: root,
+                env: {
+                    ...HookRunner.withLocalBins(env ?? process.env, root),
+                    CELL_EVENT: event,
+                    CELL_PRESET: preset,
+                    CELL_MODE: mode.join(','),
+                    CELL_OUT_DIR: outDir,
+                },
+                stdio: ['ignore', quiet ? 2 : 'inherit', 'inherit'],
+            });
+            child.on('error', reject);
+            child.on('close', (code, signal) => resolve(code ?? (signal ? 128 : 1)));
+        });
+    }
+}