@crustjs/crust-linux-arm64-musl 0.3.6 → 0.4.0

package/bin/dist/index.js

@@ -0,0 +1,3163 @@
+import { accessSync, constants, copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmod, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
+import { pathToFileURL } from "node:url";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { once } from "node:events";
+import { text } from "node:stream/consumers";
+//#region ../utils/dist/artifacts.js
+/**
+* Set by `crust build` while it prepares the Command Snapshot: the absolute
+* entry-isolated directory Extension build hooks write into. Core reads it
+* to run the hooks; `resolveArtifactDir` reads it so sections evaluated during
+* that run see the artifacts being built instead of the wiped `.crust/root`.
+*/
+const BUILD_OUT_DIR_ENV = "CRUST_INTERNAL_BUILD_OUT_DIR";
+//#endregion
+//#region ../core/dist/invocation-ka-BNJKZ.js
+/**
+* A typed error for runtime recipe, Extension, Context, documentation, argv, and validation failures.
+*
+* Every `CrustError` carries a {@link CrustErrorCode} that identifies the specific
+* failure, enabling programmatic error handling without fragile message parsing.
+*
+* @example
+* ```ts
+* import { CrustError } from "@crustjs/core";
+*
+* const outcome = await app.run(["deploy"], { args: { target: "prod" } });
+* if (outcome.status === "failed") {
+*   const err = outcome.error;
+*   if (err instanceof CrustError) {
+*     console.error(`[${err.code}] ${err.message}`);
+*   }
+* }
+* ```
+*/
+var CrustError = class extends Error {
+	/** Machine-readable error code for programmatic handling */
+	code;
+	/** Structured payload for programmatic handling */
+	details;
+	/** Optional wrapped original error/value */
+	cause;
+	constructor(code, message, ...details) {
+		super(message);
+		this.name = "CrustError";
+		this.code = code;
+		this.details = details[0];
+	}
+	is(code) {
+		return Object.is(this.code, code);
+	}
+	withCause(cause) {
+		this.cause = cause;
+		return this;
+	}
+	toJSON() {
+		return {
+			code: this.code,
+			message: this.message,
+			details: this.details
+		};
+	}
+};
+globalThis.AsyncDisposableStack;
+Object.freeze({ [Symbol("crust.finished")]: true });
+function invalidSections({ subject, name }) {
+	return new CrustError("DEFINITION", `${subject === "command" ? "Command" : "Extension"} "${name}" contains invalid documentation sections`, {
+		subject,
+		name,
+		reason: "invalid-sections"
+	});
+}
+function normalizeSection(section, owner) {
+	const { title, body, only, except } = section;
+	if (!title.trim() || /[\r\n]/.test(title) || !body.trim() || only?.length === 0 || except?.length === 0 || only !== void 0 && except !== void 0) throw invalidSections(owner);
+	const audience = (ids) => {
+		return Object.freeze(ids.map((consumer) => typeof consumer === "string" ? consumer : consumer.id));
+	};
+	return Object.freeze({
+		title,
+		body,
+		...only ? { only: audience(only) } : except ? { except: audience(except) } : {}
+	});
+}
+function validateCommandSections(name, sections) {
+	return sections.map((section) => normalizeSection(section, {
+		subject: "command",
+		name
+	}));
+}
+/**
+* Snapshot subprocess protocol used by first-party build tooling.
+*
+* When set to a non-empty file path, `.execute()` prepares the command tree,
+* validates its documentation sections, optionally runs Extension build hooks when the
+* build output directory is set, writes its final JSON snapshot and Build Report, and exits
+* without dispatching a Command Action. In-process callers use `Crust.snapshot()`.
+*
+* Only source entries run by `crust build` honor it: finished Bun/Node bundles carry
+* `process.env.CRUST_INTERNAL_BUILD === "1"` as a literal and compile the protocol out.
+*/
+const SNAPSHOT_PATH_ENV = "CRUST_INTERNAL_SNAPSHOT_PATH";
+//#endregion
+//#region ../core/dist/index.js
+/** Mint an Extension identity from any non-blank, trimmed string. */
+function defineExtensionId(id) {
+	if (!id.trim() || id !== id.trim()) throw new CrustError("DEFINITION", "Extension id must be a non-empty, trimmed string", {
+		subject: "extension",
+		reason: "empty-id"
+	});
+	return id;
+}
+const commandDefinitionInternal = Symbol.for("crust.commandDefinition");
+function resolveCommandName(name, aliases = []) {
+	if (name.trim() === "") throw new CrustError("DEFINITION", "Command name must be a non-empty string", {
+		subject: "command",
+		name,
+		reason: "empty-name"
+	});
+	if (name === "__proto__") throw new CrustError("DEFINITION", "Command name \"__proto__\" is reserved", {
+		subject: "command",
+		name,
+		reason: "reserved-name"
+	});
+	if (aliases.includes(name)) throw new CrustError("DEFINITION", `Command "${name}" must not list its own canonical name as an alias`, {
+		subject: "command",
+		name,
+		reason: "alias-collision"
+	});
+	return name;
+}
+function isCommandRecipe(value) {
+	return typeof value === "function";
+}
+function defineCommand(nameInput, configOrRecipe, maybeRecipe) {
+	const hasConfig = !isCommandRecipe(configOrRecipe);
+	const config = hasConfig ? configOrRecipe : {};
+	const recipe = hasConfig ? maybeRecipe : configOrRecipe;
+	const name = resolveCommandName(nameInput, config.aliases);
+	for (const alias of config.aliases ?? []) if (alias === "" || /[ \t\n\r\v\f]/.test(alias) || alias.startsWith("-")) throw new CrustError("DEFINITION", `Command "${name}" has an invalid alias "${alias}"`);
+	const { sections, version: _rootVersion, ...metaRest } = config;
+	const meta = {
+		...metaRest,
+		...config.aliases ? { aliases: [...config.aliases] } : {},
+		...sections ? { sections: validateCommandSections(name, sections) } : {}
+	};
+	const internal = {
+		name,
+		recipe,
+		meta
+	};
+	const named = (defName) => {
+		return Object.freeze({
+			name: defName,
+			as: (newName) => named(resolveCommandName(newName, meta.aliases)),
+			[commandDefinitionInternal]: Object.freeze({
+				...internal,
+				name: defName
+			})
+		});
+	};
+	return named(name);
+}
+//#endregion
+//#region ../style/dist/index.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+new Intl.Segmenter(void 0, { granularity: "grapheme" });
+new RegExp([
+	String.raw`(?:\x1b\[|\x9b)[^\x1b\x18\x1a\x9c\x40-\x7e]*[\x40-\x7e\x18\x1a\x9c]?`,
+	String.raw`(?:\x1b\]|\x9d)[^\x07\x1b\x18\x1a\x9c]*(?:\x07|\x1b\\|[\x18\x1a\x9c])?`,
+	String.raw`(?:\x1b[PX^_]|[\x90\x98\x9e\x9f])[^\x1b\x18\x1a\x9c]*(?:\x1b\\|[\x18\x1a\x9c])?`,
+	String.raw`\x1b[\x20-\x2f][^\x1b]?`,
+	String.raw`\x1b[\x18\x1a\x9c\x30-\x7e]?`
+].join("|"), "g");
+var ansiCodes_exports = /* @__PURE__ */ __exportAll({
+	bgBlack: () => bgBlack$1,
+	bgBlue: () => bgBlue$1,
+	bgBrightBlack: () => bgBrightBlack$1,
+	bgBrightBlue: () => bgBrightBlue$1,
+	bgBrightCyan: () => bgBrightCyan$1,
+	bgBrightGreen: () => bgBrightGreen$1,
+	bgBrightMagenta: () => bgBrightMagenta$1,
+	bgBrightRed: () => bgBrightRed$1,
+	bgBrightWhite: () => bgBrightWhite$1,
+	bgBrightYellow: () => bgBrightYellow$1,
+	bgCyan: () => bgCyan$1,
+	bgGreen: () => bgGreen$1,
+	bgMagenta: () => bgMagenta$1,
+	bgRed: () => bgRed$1,
+	bgWhite: () => bgWhite$1,
+	bgYellow: () => bgYellow$1,
+	black: () => black$1,
+	blue: () => blue$1,
+	bold: () => bold$1,
+	brightBlue: () => brightBlue$1,
+	brightCyan: () => brightCyan$1,
+	brightGreen: () => brightGreen$1,
+	brightMagenta: () => brightMagenta$1,
+	brightRed: () => brightRed$1,
+	brightWhite: () => brightWhite$1,
+	brightYellow: () => brightYellow$1,
+	cyan: () => cyan$1,
+	dim: () => dim$1,
+	gray: () => gray$1,
+	green: () => green$1,
+	hidden: () => hidden$1,
+	inverse: () => inverse$1,
+	isModifierName: () => isModifierName,
+	italic: () => italic$1,
+	magenta: () => magenta$1,
+	red: () => red$1,
+	strikethrough: () => strikethrough$1,
+	styleMethodNames: () => styleMethodNames,
+	underline: () => underline$1,
+	white: () => white$1,
+	yellow: () => yellow$1
+});
+function pair(open, close) {
+	return {
+		open: `\x1b[${open}m`,
+		close: `\x1b[${close}m`
+	};
+}
+/** Bold / increased intensity. */
+const bold$1 = pair(1, 22);
+/** Dim / decreased intensity. */
+const dim$1 = pair(2, 22);
+/** Italic. */
+const italic$1 = pair(3, 23);
+/** Underline. */
+const underline$1 = pair(4, 24);
+/** Inverse / reverse video. */
+const inverse$1 = pair(7, 27);
+/** Hidden / conceal. */
+const hidden$1 = pair(8, 28);
+/** Strikethrough / crossed out. */
+const strikethrough$1 = pair(9, 29);
+const black$1 = pair(30, 39);
+const red$1 = pair(31, 39);
+const green$1 = pair(32, 39);
+const yellow$1 = pair(33, 39);
+const blue$1 = pair(34, 39);
+const magenta$1 = pair(35, 39);
+const cyan$1 = pair(36, 39);
+const white$1 = pair(37, 39);
+/** Bright black (gray). */
+const gray$1 = pair(90, 39);
+const brightRed$1 = pair(91, 39);
+const brightGreen$1 = pair(92, 39);
+const brightYellow$1 = pair(93, 39);
+const brightBlue$1 = pair(94, 39);
+const brightMagenta$1 = pair(95, 39);
+const brightCyan$1 = pair(96, 39);
+const brightWhite$1 = pair(97, 39);
+const bgBlack$1 = pair(40, 49);
+const bgRed$1 = pair(41, 49);
+const bgGreen$1 = pair(42, 49);
+const bgYellow$1 = pair(43, 49);
+const bgBlue$1 = pair(44, 49);
+const bgMagenta$1 = pair(45, 49);
+const bgCyan$1 = pair(46, 49);
+const bgWhite$1 = pair(47, 49);
+const bgBrightBlack$1 = pair(100, 49);
+const bgBrightRed$1 = pair(101, 49);
+const bgBrightGreen$1 = pair(102, 49);
+const bgBrightYellow$1 = pair(103, 49);
+const bgBrightBlue$1 = pair(104, 49);
+const bgBrightMagenta$1 = pair(105, 49);
+const bgBrightCyan$1 = pair(106, 49);
+const bgBrightWhite$1 = pair(107, 49);
+const styleMethodNames = Object.freeze([
+	"bold",
+	"dim",
+	"italic",
+	"underline",
+	"inverse",
+	"hidden",
+	"strikethrough",
+	"black",
+	"red",
+	"green",
+	"yellow",
+	"blue",
+	"magenta",
+	"cyan",
+	"white",
+	"gray",
+	"brightRed",
+	"brightGreen",
+	"brightYellow",
+	"brightBlue",
+	"brightMagenta",
+	"brightCyan",
+	"brightWhite",
+	"bgBlack",
+	"bgRed",
+	"bgGreen",
+	"bgYellow",
+	"bgBlue",
+	"bgMagenta",
+	"bgCyan",
+	"bgWhite",
+	"bgBrightBlack",
+	"bgBrightRed",
+	"bgBrightGreen",
+	"bgBrightYellow",
+	"bgBrightBlue",
+	"bgBrightMagenta",
+	"bgBrightCyan",
+	"bgBrightWhite"
+]);
+const modifierNameSet = /* @__PURE__ */ new Set([
+	"bold",
+	"dim",
+	"italic",
+	"underline",
+	"inverse",
+	"hidden",
+	"strikethrough"
+]);
+function isModifierName(name) {
+	return modifierNameSet.has(name);
+}
+function read(overrides, key, environment) {
+	return overrides !== void 0 && key in overrides ? overrides[key] : environment;
+}
+function readTTY(overrides) {
+	return read(overrides, "isTTY", process.stdout?.isTTY) ?? false;
+}
+function readForceColor(overrides) {
+	return read(overrides, "forceColor", process.env.FORCE_COLOR);
+}
+/** `FORCE_COLOR=0` / `FORCE_COLOR=false` mean "force off"; any other value forces on. */
+function forceColorDisables(forceColor) {
+	return forceColor === "0" || forceColor === "false";
+}
+function isTrueColorTerm(term) {
+	const lower = term.toLowerCase();
+	return lower.includes("24bit") || lower.includes("truecolor") || lower.endsWith("-direct");
+}
+function detectsTruecolor(colorTerm, term) {
+	if (colorTerm !== void 0) {
+		const lower = colorTerm.toLowerCase();
+		if (lower === "truecolor" || lower === "24bit") return true;
+	}
+	return term !== void 0 && isTrueColorTerm(term);
+}
+function detectDepth(colorTerm, term) {
+	if (detectsTruecolor(colorTerm, term)) return "truecolor";
+	if (term !== void 0 && term.toLowerCase().includes("256color")) return "256";
+	return "16";
+}
+/**
+* Resolve the color depth a terminal can emit.
+*
+* Resolution rules:
+* - `"never"` → `"none"`.
+* - `"always"` → `"truecolor"`.
+* - `"auto"`:
+*   1. `FORCE_COLOR` set → decides unconditionally (overrides TTY and
+*      `NO_COLOR`, chalk convention): `0` / `false` → `"none"`; `1` →
+*      `"16"`; `2` → `"256"`; `3` → `"truecolor"`; any other value
+*      (including empty) → forced on at the `COLORTERM` / `TERM`
+*      detected depth.
+*   2. Not a TTY OR `NO_COLOR` set non-empty → `"none"`.
+*   3. `COLORTERM` is `"truecolor"` or `"24bit"` (case-insensitive) →
+*      `"truecolor"`.
+*   4. `TERM` ends with `-direct` OR contains `truecolor` / `24bit` →
+*      `"truecolor"`.
+*   5. `TERM === "dumb"` → `"none"`.
+*   6. `TERM` contains `256color` → `"256"`.
+*   7. Any other TTY value → `"16"`.
+*
+* Detection follows the ecosystem `FORCE_COLOR` / `NO_COLOR` / `COLORTERM`
+* / `TERM` conventions; no bespoke environment variables are introduced.
+*
+* @param mode - The color emission mode.
+* @param overrides - Optional overrides for deterministic testing.
+* @returns The resolved {@link ColorDepth} tier.
+*
+* @example
+* ```ts
+* resolveColorDepth("always"); // "truecolor"
+* resolveColorDepth("never"); // "none"
+* resolveColorDepth("auto", {
+*   isTTY: true,
+*   noColor: undefined,
+*   colorTerm: "truecolor",
+* }); // "truecolor"
+* resolveColorDepth("auto", {
+*   isTTY: true,
+*   noColor: undefined,
+*   colorTerm: undefined,
+*   term: "xterm-256color",
+* }); // "256"
+* ```
+*/
+function resolveColorDepth(mode, overrides) {
+	if (mode === "never") return "none";
+	if (mode === "always") return "truecolor";
+	const colorTerm = read(overrides, "colorTerm", process.env.COLORTERM);
+	const term = read(overrides, "term", process.env.TERM);
+	const forceColor = readForceColor(overrides);
+	if (forceColor !== void 0) {
+		if (forceColorDisables(forceColor)) return "none";
+		if (forceColor === "1") return "16";
+		if (forceColor === "2") return "256";
+		if (forceColor === "3") return "truecolor";
+		return detectDepth(colorTerm, term);
+	}
+	if (!readTTY(overrides)) return "none";
+	const noColor = read(overrides, "noColor", process.env.NO_COLOR);
+	if (noColor !== void 0 && noColor !== "") return "none";
+	if (term !== void 0 && term.toLowerCase() === "dumb" && !detectsTruecolor(colorTerm, term)) return "none";
+	return detectDepth(colorTerm, term);
+}
+/**
+* Resolve whether non-color ANSI modifiers should be emitted.
+*
+* In `"auto"` mode, modifiers are enabled when stdout is a TTY, but are
+* **not** affected by `NO_COLOR` (which only controls color output).
+* `FORCE_COLOR`, when set, decides unconditionally — it is the all-ANSI
+* switch, while `NO_COLOR` is the colors-only switch.
+*
+* @internal Exported only for use by {@link createStyle}; not part of the
+* public surface of `@crustjs/style`.
+*/
+function resolveModifierCapability(mode, overrides) {
+	if (mode === "always") return true;
+	if (mode === "never") return false;
+	const forceColor = readForceColor(overrides);
+	if (forceColor !== void 0) return !forceColorDisables(forceColor);
+	return readTTY(overrides);
+}
+const namedColorValues = {
+	aliceblue: [
+		240,
+		248,
+		255
+	],
+	antiquewhite: [
+		250,
+		235,
+		215
+	],
+	aqua: [
+		0,
+		255,
+		255
+	],
+	aquamarine: [
+		127,
+		255,
+		212
+	],
+	azure: [
+		240,
+		255,
+		255
+	],
+	beige: [
+		245,
+		245,
+		220
+	],
+	bisque: [
+		255,
+		228,
+		196
+	],
+	black: [
+		0,
+		0,
+		0
+	],
+	blanchedalmond: [
+		255,
+		235,
+		205
+	],
+	blue: [
+		0,
+		0,
+		255
+	],
+	blueviolet: [
+		138,
+		43,
+		226
+	],
+	brown: [
+		165,
+		42,
+		42
+	],
+	burlywood: [
+		222,
+		184,
+		135
+	],
+	cadetblue: [
+		95,
+		158,
+		160
+	],
+	chartreuse: [
+		127,
+		255,
+		0
+	],
+	chocolate: [
+		210,
+		105,
+		30
+	],
+	coral: [
+		255,
+		127,
+		80
+	],
+	cornflowerblue: [
+		100,
+		149,
+		237
+	],
+	cornsilk: [
+		255,
+		248,
+		220
+	],
+	crimson: [
+		220,
+		20,
+		60
+	],
+	cyan: [
+		0,
+		255,
+		255
+	],
+	darkblue: [
+		0,
+		0,
+		139
+	],
+	darkcyan: [
+		0,
+		139,
+		139
+	],
+	darkgoldenrod: [
+		184,
+		134,
+		11
+	],
+	darkgray: [
+		169,
+		169,
+		169
+	],
+	darkgreen: [
+		0,
+		100,
+		0
+	],
+	darkgrey: [
+		169,
+		169,
+		169
+	],
+	darkkhaki: [
+		189,
+		183,
+		107
+	],
+	darkmagenta: [
+		139,
+		0,
+		139
+	],
+	darkolivegreen: [
+		85,
+		107,
+		47
+	],
+	darkorange: [
+		255,
+		140,
+		0
+	],
+	darkorchid: [
+		153,
+		50,
+		204
+	],
+	darkred: [
+		139,
+		0,
+		0
+	],
+	darksalmon: [
+		233,
+		150,
+		122
+	],
+	darkseagreen: [
+		143,
+		188,
+		143
+	],
+	darkslateblue: [
+		72,
+		61,
+		139
+	],
+	darkslategray: [
+		47,
+		79,
+		79
+	],
+	darkslategrey: [
+		47,
+		79,
+		79
+	],
+	darkturquoise: [
+		0,
+		206,
+		209
+	],
+	darkviolet: [
+		148,
+		0,
+		211
+	],
+	deeppink: [
+		255,
+		20,
+		147
+	],
+	deepskyblue: [
+		0,
+		191,
+		255
+	],
+	dimgray: [
+		105,
+		105,
+		105
+	],
+	dimgrey: [
+		105,
+		105,
+		105
+	],
+	dodgerblue: [
+		30,
+		144,
+		255
+	],
+	firebrick: [
+		178,
+		34,
+		34
+	],
+	floralwhite: [
+		255,
+		250,
+		240
+	],
+	forestgreen: [
+		34,
+		139,
+		34
+	],
+	fuchsia: [
+		255,
+		0,
+		255
+	],
+	gainsboro: [
+		220,
+		220,
+		220
+	],
+	ghostwhite: [
+		248,
+		248,
+		255
+	],
+	gold: [
+		255,
+		215,
+		0
+	],
+	goldenrod: [
+		218,
+		165,
+		32
+	],
+	gray: [
+		128,
+		128,
+		128
+	],
+	green: [
+		0,
+		128,
+		0
+	],
+	greenyellow: [
+		173,
+		255,
+		47
+	],
+	grey: [
+		128,
+		128,
+		128
+	],
+	honeydew: [
+		240,
+		255,
+		240
+	],
+	hotpink: [
+		255,
+		105,
+		180
+	],
+	indianred: [
+		205,
+		92,
+		92
+	],
+	indigo: [
+		75,
+		0,
+		130
+	],
+	ivory: [
+		255,
+		255,
+		240
+	],
+	khaki: [
+		240,
+		230,
+		140
+	],
+	lavender: [
+		230,
+		230,
+		250
+	],
+	lavenderblush: [
+		255,
+		240,
+		245
+	],
+	lawngreen: [
+		124,
+		252,
+		0
+	],
+	lemonchiffon: [
+		255,
+		250,
+		205
+	],
+	lightblue: [
+		173,
+		216,
+		230
+	],
+	lightcoral: [
+		240,
+		128,
+		128
+	],
+	lightcyan: [
+		224,
+		255,
+		255
+	],
+	lightgoldenrodyellow: [
+		250,
+		250,
+		210
+	],
+	lightgray: [
+		211,
+		211,
+		211
+	],
+	lightgreen: [
+		144,
+		238,
+		144
+	],
+	lightgrey: [
+		211,
+		211,
+		211
+	],
+	lightpink: [
+		255,
+		182,
+		193
+	],
+	lightsalmon: [
+		255,
+		160,
+		122
+	],
+	lightseagreen: [
+		32,
+		178,
+		170
+	],
+	lightskyblue: [
+		135,
+		206,
+		250
+	],
+	lightslategray: [
+		119,
+		136,
+		153
+	],
+	lightslategrey: [
+		119,
+		136,
+		153
+	],
+	lightsteelblue: [
+		176,
+		196,
+		222
+	],
+	lightyellow: [
+		255,
+		255,
+		224
+	],
+	lime: [
+		0,
+		255,
+		0
+	],
+	limegreen: [
+		50,
+		205,
+		50
+	],
+	linen: [
+		250,
+		240,
+		230
+	],
+	magenta: [
+		255,
+		0,
+		255
+	],
+	maroon: [
+		128,
+		0,
+		0
+	],
+	mediumaquamarine: [
+		102,
+		205,
+		170
+	],
+	mediumblue: [
+		0,
+		0,
+		205
+	],
+	mediumorchid: [
+		186,
+		85,
+		211
+	],
+	mediumpurple: [
+		147,
+		112,
+		219
+	],
+	mediumseagreen: [
+		60,
+		179,
+		113
+	],
+	mediumslateblue: [
+		123,
+		104,
+		238
+	],
+	mediumspringgreen: [
+		0,
+		250,
+		154
+	],
+	mediumturquoise: [
+		72,
+		209,
+		204
+	],
+	mediumvioletred: [
+		199,
+		21,
+		133
+	],
+	midnightblue: [
+		25,
+		25,
+		112
+	],
+	mintcream: [
+		245,
+		255,
+		250
+	],
+	mistyrose: [
+		255,
+		228,
+		225
+	],
+	moccasin: [
+		255,
+		228,
+		181
+	],
+	navajowhite: [
+		255,
+		222,
+		173
+	],
+	navy: [
+		0,
+		0,
+		128
+	],
+	oldlace: [
+		253,
+		245,
+		230
+	],
+	olive: [
+		128,
+		128,
+		0
+	],
+	olivedrab: [
+		107,
+		142,
+		35
+	],
+	orange: [
+		255,
+		165,
+		0
+	],
+	orangered: [
+		255,
+		69,
+		0
+	],
+	orchid: [
+		218,
+		112,
+		214
+	],
+	palegoldenrod: [
+		238,
+		232,
+		170
+	],
+	palegreen: [
+		152,
+		251,
+		152
+	],
+	paleturquoise: [
+		175,
+		238,
+		238
+	],
+	palevioletred: [
+		219,
+		112,
+		147
+	],
+	papayawhip: [
+		255,
+		239,
+		213
+	],
+	peachpuff: [
+		255,
+		218,
+		185
+	],
+	peru: [
+		205,
+		133,
+		63
+	],
+	pink: [
+		255,
+		192,
+		203
+	],
+	plum: [
+		221,
+		160,
+		221
+	],
+	powderblue: [
+		176,
+		224,
+		230
+	],
+	purple: [
+		128,
+		0,
+		128
+	],
+	rebeccapurple: [
+		102,
+		51,
+		153
+	],
+	red: [
+		255,
+		0,
+		0
+	],
+	rosybrown: [
+		188,
+		143,
+		143
+	],
+	royalblue: [
+		65,
+		105,
+		225
+	],
+	saddlebrown: [
+		139,
+		69,
+		19
+	],
+	salmon: [
+		250,
+		128,
+		114
+	],
+	sandybrown: [
+		244,
+		164,
+		96
+	],
+	seagreen: [
+		46,
+		139,
+		87
+	],
+	seashell: [
+		255,
+		245,
+		238
+	],
+	sienna: [
+		160,
+		82,
+		45
+	],
+	silver: [
+		192,
+		192,
+		192
+	],
+	skyblue: [
+		135,
+		206,
+		235
+	],
+	slateblue: [
+		106,
+		90,
+		205
+	],
+	slategray: [
+		112,
+		128,
+		144
+	],
+	slategrey: [
+		112,
+		128,
+		144
+	],
+	snow: [
+		255,
+		250,
+		250
+	],
+	springgreen: [
+		0,
+		255,
+		127
+	],
+	steelblue: [
+		70,
+		130,
+		180
+	],
+	tan: [
+		210,
+		180,
+		140
+	],
+	teal: [
+		0,
+		128,
+		128
+	],
+	thistle: [
+		216,
+		191,
+		216
+	],
+	tomato: [
+		255,
+		99,
+		71
+	],
+	turquoise: [
+		64,
+		224,
+		208
+	],
+	violet: [
+		238,
+		130,
+		238
+	],
+	wheat: [
+		245,
+		222,
+		179
+	],
+	white: [
+		255,
+		255,
+		255
+	],
+	whitesmoke: [
+		245,
+		245,
+		245
+	],
+	yellow: [
+		255,
+		255,
+		0
+	],
+	yellowgreen: [
+		154,
+		205,
+		50
+	]
+};
+/**
+* Apply an ANSI style pair to a string with nesting-safe composition.
+*
+* When the input already contains the close sequence for the applied style
+* (e.g. from a nested style call that shares the same close code), the engine
+* reopens the outer style after each inner close to prevent style bleed.
+*
+* @param text - The string to style.
+* @param style - The ANSI pair to apply.
+* @returns The styled string, or the original string if empty.
+*
+* @example
+* ```ts
+* import { applyStyle } from "./styleEngine.ts";
+* import { bold, red } from "./ansiCodes.ts";
+*
+* // Simple usage
+* applyStyle("hello", bold); // "\x1b[1mhello\x1b[22m"
+*
+* // Nesting: bold wraps a red segment — bold reopens after red's close
+* const inner = applyStyle("world", red);
+* applyStyle(`hello ${inner}!`, bold);
+* ```
+*/
+function applyStyle(text, style) {
+	if (text == null) return "";
+	let result = String(text);
+	if (result === "") return "";
+	const { open, close } = style;
+	if (result.includes(close)) result = result.replaceAll(close, close + open);
+	return open + result + close;
+}
+/** Foreground close: matches the close of every static fg color (`\x1b[39m`). */
+const FG_CLOSE = "\x1B[39m";
+/** Background close: matches the close of every static bg color (`\x1b[49m`). */
+const BG_CLOSE = "\x1B[49m";
+/** Foreground/background extended-color SGR introducers. */
+const FG_INTRODUCER = "\x1B[38;";
+const BG_INTRODUCER = "\x1B[48;";
+/** Quote supported inputs, falling back to `String()` for hostile runtime values. */
+function describeInput(input) {
+	try {
+		return JSON.stringify(input) ?? String(input);
+	} catch {
+		return String(input);
+	}
+}
+function isNamedColor(value) {
+	return Object.hasOwn(namedColorValues, value);
+}
+/** Parse a supported color into an RGB triple. */
+function parseRgb(input) {
+	if (Array.isArray(input)) {
+		if (input.length === 3 && input.every((channel) => Number.isInteger(channel) && channel >= 0 && channel <= 255)) return [
+			input[0],
+			input[1],
+			input[2]
+		];
+	} else if (typeof input === "string") {
+		const value = input.toLowerCase();
+		if (isNamedColor(value)) return namedColorValues[value];
+		const hex = /^#([0-9a-f]{3}|[0-9a-f]{6})$/i.exec(value)?.[1];
+		if (hex) {
+			const expanded = hex.length === 3 ? hex.split("").map((digit) => digit + digit).join("") : hex;
+			return [
+				Number.parseInt(expanded.slice(0, 2), 16),
+				Number.parseInt(expanded.slice(2, 4), 16),
+				Number.parseInt(expanded.slice(4, 6), 16)
+			];
+		}
+		const rgb = /^rgb\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*\)$/.exec(value) ?? /^rgb\(\s*(\d{1,3})\s+(\d{1,3})\s+(\d{1,3})\s*\)$/.exec(value);
+		if (rgb) {
+			const channels = [
+				Number(rgb[1]),
+				Number(rgb[2]),
+				Number(rgb[3])
+			];
+			if (channels.every((channel) => channel <= 255)) return channels;
+		}
+	}
+	throw new TypeError(`Invalid color input: ${describeInput(input)}`);
+}
+function rgbToAnsi256(r, g, b) {
+	const levels = [
+		0,
+		95,
+		135,
+		175,
+		215,
+		255
+	];
+	const nearest = (channel) => levels.reduce((best, value, index) => Math.abs(value - channel) < Math.abs(levels[best] - channel) ? index : best, 0);
+	const [ir, ig, ib] = [
+		nearest(r),
+		nearest(g),
+		nearest(b)
+	];
+	const grayIndex = Math.min(23, Math.max(0, Math.round(((r + g + b) / 3 - 8) / 10)));
+	const gray = 8 + grayIndex * 10;
+	const distance = (cr, cg, cb) => (r - cr) ** 2 + (g - cg) ** 2 + (b - cb) ** 2;
+	return distance(gray, gray, gray) < distance(levels[ir], levels[ig], levels[ib]) ? 232 + grayIndex : 16 + 36 * ir + 6 * ig + ib;
+}
+/**
+* Quantize `[r, g, b]` to a foreground SGR parameter (`30`–`37`, `90`–`97`).
+* Same algorithm as `ansi-styles` / `chalk`: bucket each channel at 50%,
+* pack into a 3-bit base color, then add 60 for bright when the max
+* channel rounds up. Call sites add `+10` for backgrounds.
+*
+* @internal
+*/
+function rgbToAnsi16Param(r, g, b) {
+	const brightnessBucket = Math.round(Math.max(r, g, b) / 127.5);
+	if (brightnessBucket === 0) return 30;
+	let ansi = 30 + ((Math.round(b / 255) << 2 | Math.round(g / 255) << 1 | Math.round(r / 255)) & 7);
+	if (brightnessBucket === 2) ansi += 60;
+	return ansi;
+}
+/**
+* Foreground SGR open sequence at `depth`.
+*
+* @internal
+*/
+function fgOpen(input, depth) {
+	const [r, g, b] = parseRgb(input);
+	if (depth === "16") return `\x1b[${rgbToAnsi16Param(r, g, b)}m`;
+	if (depth === "256") return `\x1b[38;5;${rgbToAnsi256(r, g, b)}m`;
+	return `\x1b[38;2;${r};${g};${b}m`;
+}
+/**
+* Background SGR open sequence at `depth`. For `truecolor` / `256`,
+* derived from {@link fgOpen} by swapping the `\x1b[38;` introducer for
+* `\x1b[48;` (both the truecolor and 256-color forms use it). For `16`,
+* quantized directly to a real background SGR.
+*
+* @internal
+*/
+function bgOpen(input, depth) {
+	if (depth === "16") {
+		const [r, g, b] = parseRgb(input);
+		return `\x1b[${rgbToAnsi16Param(r, g, b) + 10}m`;
+	}
+	return fgOpen(input, depth).replace(FG_INTRODUCER, BG_INTRODUCER);
+}
+function colorPair(kind, input, depth) {
+	if (depth === "none") {
+		parseRgb(input);
+		return {
+			open: "",
+			close: ""
+		};
+	}
+	return {
+		open: kind === "fg" ? fgOpen(input, depth) : bgOpen(input, depth),
+		close: kind === "fg" ? FG_CLOSE : BG_CLOSE
+	};
+}
+/**
+* Depth-aware foreground `AnsiPair` for chain composition. `depth: "none"`
+* returns an empty pair (still validates input). Used by `createStyle()`
+* to back `chainable.fg(input)`.
+*
+* @throws {TypeError} If `input` is not a recognized color.
+* @internal
+*/
+function fgPairAtDepth(input, depth) {
+	return colorPair("fg", input, depth);
+}
+/**
+* Depth-aware background `AnsiPair` for chain composition. Mirrors
+* {@link fgPairAtDepth}.
+*
+* @throws {TypeError} If `input` is not a recognized color.
+* @internal
+*/
+function bgPairAtDepth(input, depth) {
+	return colorPair("bg", input, depth);
+}
+function paint(kind, text, input, depth) {
+	const pair = colorPair(kind, input, depth);
+	return depth === "none" ? text : applyStyle(text, pair);
+}
+/**
+* Apply a foreground color to `text` from any {@link ColorInput}. `depth`
+* selects the output format (`"truecolor"` default, `"256"`, `"16"`, or
+* `"none"`). `"none"` returns `text` unchanged but still validates
+* `input`. Empty `text` short-circuits to `""`.
+*
+* @throws {TypeError} If `input` is not a recognized color.
+*
+* @example
+* ```ts
+* fg("error", "#ff0000");
+* fg("ocean", "rgb(0, 128, 255)");
+* fg("custom", [255, 127, 80]);
+* fg("256-only", "#ff0000", "256"); // \x1b[38;5;196m...
+* ```
+*/
+function fg$1(text, input, depth = "truecolor") {
+	return paint("fg", text, input, depth);
+}
+/**
+* Apply a background color to `text`. Mirrors {@link fg}.
+*
+* @throws {TypeError} If `input` is not a recognized color.
+*
+* @example
+* ```ts
+* bg("warning", "#ff8800");
+* bg("info", "rgb(0, 128, 255)");
+* ```
+*/
+function bg$1(text, input, depth = "truecolor") {
+	return paint("bg", text, input, depth);
+}
+const OSC = "\x1B]";
+const ST = "\x1B\\";
+const HYPERLINK_CLOSE = `${OSC}8;;${ST}`;
+function assertMatches(value, label, pattern, suffix = "") {
+	if (!pattern.test(value)) throw new TypeError(`Invalid ${label}: ${JSON.stringify(value)} must contain only printable ASCII characters${suffix}.`);
+}
+function serializeParams(options) {
+	const id = options?.id;
+	if (id === void 0 || id === "") return "";
+	assertMatches(id, "hyperlink id", /^[\x20-\x7e]*$/);
+	if (id.includes(":") || id.includes(";")) throw new TypeError("Invalid hyperlink id: \":\" and \";\" are reserved by the OSC 8 format.");
+	return `id=${id}`;
+}
+/**
+* Create an OSC 8 hyperlink escape pair for `url`. Backs {@link link} and
+* the `link` method on style instances; also used to validate URLs when
+* hyperlink emission is disabled.
+*
+* @param url - Target URL. Must contain only printable ASCII characters
+*   and no spaces (per the OSC 8 spec). URL-encode characters outside
+*   that range before passing.
+* @param options - Optional {@link HyperlinkOptions} — currently just
+*   `id` for grouping multi-segment links.
+* @returns An {@link AnsiPair} whose `open` carries the URL and `close`
+*   terminates the hyperlink.
+* @throws {TypeError} If `url` contains spaces or non-printable ASCII,
+*   or if `options.id` contains `":"` / `";"` (reserved by OSC 8) or
+*   non-printable characters.
+*
+* @internal
+*/
+function linkCode(url, options) {
+	assertMatches(url, "hyperlink URL", /^[\x21-\x7e]*$/, " without spaces");
+	const params = serializeParams(options);
+	return {
+		open: `${OSC}8;${params};${url}${ST}`,
+		close: HYPERLINK_CLOSE
+	};
+}
+/**
+* Wrap `text` in OSC 8 hyperlink escape sequences.
+*
+* @param text - The visible label.
+* @param url - Target URL. Must contain only printable ASCII characters
+*   and no spaces (per the OSC 8 spec); URL-encode anything outside that
+*   range before passing.
+* @param options - Optional {@link HyperlinkOptions}.
+* @returns The styled string.
+* @throws {TypeError} If `url` contains spaces or non-printable ASCII,
+*   or if `options.id` contains `":"` / `";"` (reserved by OSC 8) or
+*   non-printable characters.
+*
+* @example
+* ```ts
+* import { link } from "@crustjs/style";
+*
+* console.log(link("docs", "https://crustjs.dev"));
+* console.log(link("page 1", "https://example.com/p1", { id: "intro" }));
+* ```
+*/
+function link$1(text, url, options) {
+	return applyStyle(text, linkCode(url, options));
+}
+const dynamicColorKinds = [[
+	"fg",
+	fgPairAtDepth,
+	fg$1
+], [
+	"bg",
+	bgPairAtDepth,
+	bg$1
+]];
+const styleMethodPairs = ansiCodes_exports;
+function stepIsModifier(step) {
+	return step.kind === "named" && isModifierName(step.name);
+}
+function stepPair(step, colorDepth) {
+	if (step.kind === "named") return styleMethodPairs[step.name];
+	return step.kind === "fg" ? fgPairAtDepth(step.input, colorDepth) : bgPairAtDepth(step.input, colorDepth);
+}
+function applyChain(text, steps, resolveCapabilities) {
+	if (text == null) return "";
+	let result = String(text);
+	if (result === "") return result;
+	const capabilities = resolveCapabilities();
+	const { modifiersEnabled, colorsEnabled } = capabilities;
+	for (let i = steps.length - 1; i >= 0; i--) {
+		const step = steps[i];
+		if (step === void 0) continue;
+		if (stepIsModifier(step) ? !modifiersEnabled : !colorsEnabled) continue;
+		result = applyStyle(result, stepPair(step, capabilities.colorDepth));
+	}
+	return result;
+}
+function isTemplateStringsArray(value) {
+	return Array.isArray(value) && "raw" in value && Array.isArray(value.raw);
+}
+function buildChainableStyleFactory(resolveCapabilities, runtime) {
+	const cache = /* @__PURE__ */ new Map();
+	const pairDepth = runtime ? "truecolor" : resolveCapabilities().colorDepth;
+	function createChainableStyle(steps) {
+		const key = steps.map((step) => step.kind === "named" ? step.name : `~${stepPair(step, "truecolor").open}`).join("|");
+		const cached = cache.get(key);
+		if (cached) return cached;
+		const styleFn = ((first, ...rest) => {
+			if (isTemplateStringsArray(first)) {
+				let text = "";
+				for (let i = 0; i < first.length; i++) {
+					text += first[i] ?? "";
+					if (i < rest.length) text += String(rest[i]);
+				}
+				return applyChain(text, steps, resolveCapabilities);
+			}
+			return applyChain(first, steps, resolveCapabilities);
+		});
+		if (cache.size >= 1024) cache.delete(cache.keys().next().value);
+		cache.set(key, styleFn);
+		for (const name of styleMethodNames) Object.defineProperty(styleFn, name, {
+			configurable: false,
+			enumerable: true,
+			get() {
+				return createChainableStyle([...steps, {
+					kind: "named",
+					name
+				}]);
+			}
+		});
+		for (const [kind, pairAtDepth] of dynamicColorKinds) Object.defineProperty(styleFn, kind, {
+			configurable: false,
+			enumerable: true,
+			value: (input) => {
+				pairAtDepth(input, "truecolor");
+				return createChainableStyle([...steps, {
+					kind,
+					input
+				}]);
+			},
+			writable: false
+		});
+		let open = "";
+		let close = "";
+		for (const step of steps) {
+			const pair = stepPair(step, pairDepth);
+			open += pair.open;
+			close = pair.close + close;
+		}
+		Object.defineProperty(styleFn, "open", {
+			value: open,
+			writable: false,
+			configurable: false,
+			enumerable: true
+		});
+		Object.defineProperty(styleFn, "close", {
+			value: close,
+			writable: false,
+			configurable: false,
+			enumerable: true
+		});
+		return Object.freeze(styleFn);
+	}
+	return createChainableStyle;
+}
+function buildStyleMethods(createChainableStyle) {
+	const methods = {};
+	for (const methodName of styleMethodNames) methods[methodName] = createChainableStyle([{
+		kind: "named",
+		name: methodName
+	}]);
+	return methods;
+}
+/**
+* Create a configured style instance with mode-aware styling functions.
+*
+* The returned instance provides the full set of modifier, foreground color,
+* and background color functions. In `"never"` mode, all functions return
+* plain text without ANSI codes. In `"always"` mode, ANSI codes are always
+* emitted. In `"auto"` mode, color methods respect `stdout.isTTY` and
+* `NO_COLOR`, non-color modifiers (bold, italic, etc.) follow TTY only,
+* and `FORCE_COLOR`, when set, decides unconditionally for both.
+*
+* @param options - Configuration options. Defaults to `{ mode: "auto" }`.
+* @returns A frozen {@link StyleInstance} with all styling functions.
+*
+* @example
+* ```ts
+* // Auto-detect terminal capabilities
+* const s = createStyle();
+* console.log(s.bold("hello"));
+*
+* // Force color output
+* const color = createStyle({ mode: "always" });
+* console.log(color.red("error"));
+* console.log(color.bold.red("critical"));
+*
+* // Disable all styling
+* const plain = createStyle({ mode: "never" });
+* console.log(plain.red("error")); // "error"
+*
+* // Deterministic testing
+* const test = createStyle({
+*   mode: "auto",
+*   overrides: { isTTY: true, noColor: undefined },
+* });
+* ```
+*/
+function resolveStyleCapabilities(options) {
+	const mode = options?.mode ?? "auto";
+	const modifiersEnabled = resolveModifierCapability(mode, options?.overrides);
+	const colorDepth = resolveColorDepth(mode, options?.overrides);
+	return {
+		modifiersEnabled,
+		colorDepth,
+		colorsEnabled: colorDepth !== "none",
+		trueColorEnabled: colorDepth === "truecolor"
+	};
+}
+function createStyleInstance(options, runtime) {
+	const resolveCapabilities = runtime ? resolveStyleCapabilities : (() => {
+		const capabilities = resolveStyleCapabilities(options);
+		return () => capabilities;
+	})();
+	const createChainableStyle = buildChainableStyleFactory(resolveCapabilities, runtime);
+	const methods = buildStyleMethods(createChainableStyle);
+	const instance = {
+		get enabled() {
+			const { modifiersEnabled, colorsEnabled } = resolveCapabilities();
+			return modifiersEnabled || colorsEnabled;
+		},
+		get colorsEnabled() {
+			return resolveCapabilities().colorsEnabled;
+		},
+		get trueColorEnabled() {
+			return resolveCapabilities().trueColorEnabled;
+		},
+		get colorDepth() {
+			return resolveCapabilities().colorDepth;
+		},
+		link(text, url, hyperlinkOptions) {
+			if (resolveCapabilities().modifiersEnabled) return link$1(text, url, hyperlinkOptions);
+			linkCode(url, hyperlinkOptions);
+			return text;
+		},
+		...Object.fromEntries(dynamicColorKinds.map(([kind, pairAtDepth, paint]) => [kind, (...args) => {
+			const resolved = resolveCapabilities();
+			if (args.length === 1) {
+				pairAtDepth(args[0], "truecolor");
+				return createChainableStyle([{
+					kind,
+					input: args[0]
+				}]);
+			}
+			return paint(args[0], args[1], resolved.colorDepth);
+		}])),
+		...methods
+	};
+	return Object.freeze(instance);
+}
+/**
+* Default style instance using `"auto"` mode.
+*
+* Emits color ANSI codes when stdout is a TTY and `NO_COLOR` is not set.
+* Non-color modifiers (bold, italic, etc.) follow TTY only; `FORCE_COLOR`,
+* when set, decides unconditionally for both.
+* Import this for convenient access without explicit configuration.
+*
+* @example
+* ```ts
+* import { style } from "@crustjs/style";
+*
+* console.log(style.bold("hello"));
+* console.log(style.red("error"));
+* ```
+*/
+const style = createStyleInstance(void 0, true);
+style.black;
+style.red;
+const green = style.green;
+const yellow = style.yellow;
+style.blue;
+style.magenta;
+const cyan = style.cyan;
+style.white;
+style.gray;
+style.brightRed;
+style.brightGreen;
+style.brightYellow;
+style.brightBlue;
+style.brightMagenta;
+style.brightCyan;
+style.brightWhite;
+style.bgBlack;
+style.bgRed;
+style.bgGreen;
+style.bgYellow;
+style.bgBlue;
+style.bgMagenta;
+style.bgCyan;
+style.bgWhite;
+style.bgBrightBlack;
+style.bgBrightRed;
+style.bgBrightGreen;
+style.bgBrightYellow;
+style.bgBrightBlue;
+style.bgBrightMagenta;
+style.bgBrightCyan;
+style.bgBrightWhite;
+const bold = style.bold;
+const dim = style.dim;
+style.italic;
+style.underline;
+style.inverse;
+style.hidden;
+style.strikethrough;
+style.link;
+style.fg;
+style.bg;
+//#endregion
+//#region ../utils/dist/json.js
+/** Narrow a JSON document root to an object (not array/scalar/null). */
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region ../utils/dist/path.js
+/** Returns whether child is parent itself or lies below it. */
+function isWithin(parent, child) {
+	const path = relative(parent, child);
+	return path === "" || !isAbsolute(path) && path !== ".." && !path.startsWith(`..${sep}`);
+}
+//#endregion
+//#region ../utils/dist/error.js
+/** Narrows a caught Node.js system error to its stable errno contract. */
+function isErrnoException(error) {
+	return error instanceof Error && "code" in error && typeof error.code === "string";
+}
+//#endregion
+//#region ../utils/dist/process.js
+const WINDOWS_SHELL_UNSAFE = /[\0\r\n"%!^`<>&|]/;
+const WINDOWS_SHELL_META = /([()\][%!^"`<>&|;, *?])/g;
+function escapeWindowsShellArgument(value) {
+	let escaped = value.replace(/(?=(\\+?)?)\1"/g, "$1$1\\\"");
+	escaped = escaped.replace(/(?=(\\+?)?)\1$/g, "$1$1");
+	escaped = `"${escaped}"`.replace(WINDOWS_SHELL_META, "^$1");
+	return escaped.replace(WINDOWS_SHELL_META, "^$1");
+}
+/** @internal Build Node's escaped Windows command-shim workaround. */
+function getWindowsShimCommand(command, args, shell, platform = process.platform) {
+	if (shell || platform !== "win32" || !/\.(cmd|bat)$/i.test(command)) return null;
+	const shimCommand = win32.normalize(command);
+	for (const [index, value] of [shimCommand, ...args].entries()) if (WINDOWS_SHELL_UNSAFE.test(value)) {
+		const label = index === 0 ? "command" : `argument ${index}`;
+		throw new Error(`Windows command shim ${label} ${JSON.stringify(value)} contains unsafe shell characters`);
+	}
+	const commandLine = [shimCommand.replace(WINDOWS_SHELL_META, "^$1"), ...args.map(escapeWindowsShellArgument)].join(" ");
+	return {
+		command: process.env.ComSpec ?? "cmd.exe",
+		args: [
+			"/d",
+			"/s",
+			"/c",
+			`"${commandLine}"`
+		],
+		windowsVerbatimArguments: true
+	};
+}
+/**
+* Spawn a process and wait for it to exit without imposing an error policy.
+*
+* On Windows, the automatic `.cmd`/`.bat` workaround escapes arguments for
+* `cmd.exe`; unsafe shell-expansion characters throw before spawning. Explicit
+* `shell: true` calls are passed through unchanged and own their shell escaping.
+*/
+async function runProcess(command, args = [], options = {}) {
+	const windowsShimCommand = getWindowsShimCommand(command, args, options.shell);
+	const collect = (options.stdio ?? "collect") === "collect";
+	const collectStdout = collect && options.stdout !== "ignore";
+	const proc = spawn(windowsShimCommand?.command ?? command, windowsShimCommand?.args ?? args, {
+		cwd: options.cwd,
+		env: options.env,
+		shell: options.shell,
+		stdio: collect ? [
+			"ignore",
+			collectStdout ? "pipe" : "ignore",
+			"pipe"
+		] : "inherit",
+		windowsVerbatimArguments: windowsShimCommand?.windowsVerbatimArguments
+	});
+	const [stdout, stderr, [exitCode]] = await Promise.all([
+		collectStdout ? text(proc.stdout) : "",
+		collect ? text(proc.stderr) : "",
+		once(proc, "close")
+	]);
+	return {
+		exitCode,
+		stdout,
+		stderr
+	};
+}
+/** Resolve a bare executable name from PATH (and PATHEXT on Windows). */
+function which(command) {
+	if (command.includes(sep) || command.includes("/")) {
+		try {
+			accessSync(command, constants.X_OK);
+			if (statSync(command).isFile()) return command;
+		} catch {}
+		return null;
+	}
+	const extensions = process.platform === "win32" && !extname(command) ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";") : [""];
+	for (const directory of process.env.PATH?.split(delimiter) ?? []) for (const extension of extensions) {
+		const candidate = resolve(join(directory, command + extension));
+		try {
+			accessSync(candidate, constants.X_OK);
+			if (statSync(candidate).isFile()) return candidate;
+		} catch {}
+	}
+	return null;
+}
+//#endregion
+//#region src/utils/build-helpers.ts
+const BUILD_RUNTIMES = [
+	"bun",
+	"deno",
+	"node"
+];
+const BUN_TARGETS = {
+	runtime: "Bun",
+	targets: [
+		"bun-linux-x64",
+		"bun-linux-arm64",
+		"bun-linux-x64-musl",
+		"bun-linux-arm64-musl",
+		"bun-darwin-x64",
+		"bun-darwin-arm64",
+		"bun-windows-x64",
+		"bun-windows-arm64"
+	],
+	info: {
+		"bun-linux-x64": {
+			alias: "linux-x64",
+			platformKey: "linux-x64",
+			os: "linux",
+			cpu: "x64",
+			libc: "glibc"
+		},
+		"bun-linux-arm64": {
+			alias: "linux-arm64",
+			platformKey: "linux-arm64",
+			os: "linux",
+			cpu: "arm64",
+			libc: "glibc"
+		},
+		"bun-linux-x64-musl": {
+			alias: "linux-x64-musl",
+			platformKey: "linux-x64-musl",
+			os: "linux",
+			cpu: "x64",
+			libc: "musl"
+		},
+		"bun-linux-arm64-musl": {
+			alias: "linux-arm64-musl",
+			platformKey: "linux-arm64-musl",
+			os: "linux",
+			cpu: "arm64",
+			libc: "musl"
+		},
+		"bun-darwin-x64": {
+			alias: "darwin-x64",
+			platformKey: "darwin-x64",
+			os: "darwin",
+			cpu: "x64"
+		},
+		"bun-darwin-arm64": {
+			alias: "darwin-arm64",
+			platformKey: "darwin-arm64",
+			os: "darwin",
+			cpu: "arm64"
+		},
+		"bun-windows-x64": {
+			alias: "windows-x64",
+			platformKey: "win32-x64",
+			os: "win32",
+			cpu: "x64"
+		},
+		"bun-windows-arm64": {
+			alias: "windows-arm64",
+			platformKey: "win32-arm64",
+			os: "win32",
+			cpu: "arm64"
+		}
+	}
+};
+const DENO_TARGETS = {
+	runtime: "Deno",
+	targets: [
+		"x86_64-unknown-linux-gnu",
+		"aarch64-unknown-linux-gnu",
+		"x86_64-apple-darwin",
+		"aarch64-apple-darwin",
+		"x86_64-pc-windows-msvc",
+		"aarch64-pc-windows-msvc"
+	],
+	info: {
+		"x86_64-unknown-linux-gnu": {
+			alias: "linux-x64",
+			platformKey: "linux-x64",
+			os: "linux",
+			cpu: "x64",
+			libc: "glibc"
+		},
+		"aarch64-unknown-linux-gnu": {
+			alias: "linux-arm64",
+			platformKey: "linux-arm64",
+			os: "linux",
+			cpu: "arm64",
+			libc: "glibc"
+		},
+		"x86_64-apple-darwin": {
+			alias: "darwin-x64",
+			platformKey: "darwin-x64",
+			os: "darwin",
+			cpu: "x64"
+		},
+		"aarch64-apple-darwin": {
+			alias: "darwin-arm64",
+			platformKey: "darwin-arm64",
+			os: "darwin",
+			cpu: "arm64"
+		},
+		"x86_64-pc-windows-msvc": {
+			alias: "windows-x64",
+			platformKey: "win32-x64",
+			os: "win32",
+			cpu: "x64"
+		},
+		"aarch64-pc-windows-msvc": {
+			alias: "windows-arm64",
+			platformKey: "win32-arm64",
+			os: "win32",
+			cpu: "arm64"
+		}
+	}
+};
+/** `--target` value that stands for this machine's canonical target. */
+const HOST_TARGET = "host";
+/**
+* Canonical targets for `--target` inputs, deduplicated in input order. No
+* inputs means every target of the table; `host` means this machine's target.
+*/
+function resolveTargets(table, targetFlags) {
+	if (!targetFlags?.length) return [...table.targets];
+	const targets = targetFlags.map((input) => {
+		if (input === "host") {
+			const host = hostTarget(table);
+			if (host === null) throw new Error(`No ${table.runtime} target matches this machine (${hostPlatformKey()}).\n  Valid targets: ${table.targets.join(", ")}`);
+			return host;
+		}
+		const exact = table.targets.find((target) => target === input);
+		if (exact) return exact;
+		const canonical = table.targets.find((target) => table.info[target].alias === input);
+		const hint = canonical ? ` Did you mean "${canonical}"?` : "";
+		const runtime = table.runtime === "Bun" ? "" : `${table.runtime} `;
+		throw new Error(`Unknown ${runtime}target "${input}". Targets must use canonical ${table.runtime} names.${hint}\n  Valid targets: ${table.targets.join(", ")}`);
+	});
+	return [...new Set(targets)];
+}
+/** True on musl-based Linux (Alpine, Void, …). Mirrors the check in Bun's own npm installer. */
+function isMuslHost() {
+	if (process.platform !== "linux") return false;
+	try {
+		const report = process.report?.getReport();
+		if (report?.header) return report.header.glibcVersionRuntime === void 0;
+	} catch {}
+	return existsSync("/etc/alpine-release");
+}
+function hostPlatformKey() {
+	return `${process.platform}-${process.arch}${isMuslHost() ? "-musl" : ""}`;
+}
+function hostTarget(table) {
+	const platformKey = hostPlatformKey();
+	return table.targets.find((target) => table.info[target].platformKey === platformKey) ?? null;
+}
+function readUserPackageJson(cwd) {
+	const packageJsonPath = join(cwd, "package.json");
+	if (!existsSync(packageJsonPath)) return void 0;
+	try {
+		return JSON.parse(readFileSync(packageJsonPath, "utf8"));
+	} catch (error) {
+		throw new Error(`Failed to parse package.json in ${cwd}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+	}
+}
+function toBunEnvFileArgs(envFiles) {
+	return envFiles.flatMap((envFile) => ["--env-file", envFile]);
+}
+/**
+* Resolve the safest executable to run `bun build`.
+*
+* Prefer the real Bun binary when it is available on PATH, because invoking
+* standalone compilation from inside a compiled Crust executable can trigger
+* Bun runtime bugs on some host/target combinations.
+*
+* Fall back to the current executable with `BUN_BE_BUN=1` so packaged Crust
+* binaries still work in environments without a separate Bun install. Only a
+* Bun process can stand in for bun: the library `build()` may run under Node,
+* where the fallback would spawn node with Bun flags, so that case is an error.
+*/
+function resolveBunBuildRunner(runningUnderBun = process.versions.bun !== void 0) {
+	const bunPath = which("bun");
+	if (bunPath) return {
+		command: bunPath,
+		env: { ...process.env }
+	};
+	if (!runningUnderBun) throw new Error("bun was not found on PATH.\n  crust build compiles with the Bun bundler and prepares Command Snapshots with bun; install Bun (https://bun.sh) or run the build under bun.");
+	return {
+		command: process.execPath,
+		env: {
+			...process.env,
+			BUN_BE_BUN: "1"
+		}
+	};
+}
+/**
+* Bun's `-baseline` spelling of an x64 target, or null for arm64.
+*
+* Bun 1.4 ships one x64 build, so the alias yields the same executable (Bun
+* 1.4.2 downloads a `bun-<target>-baseline-v1.4.2` base that is byte-identical
+* to the plain one; checked for linux-x64-musl and darwin-x64), but `baseline:
+* true` is never Bun's compiled-in default, so it is never the self-copy target.
+* arm64 spellings with the suffix resolve to the plain aarch64 base instead.
+*/
+function bunBaselineAlias(target) {
+	return BUN_TARGETS.info[target].cpu === "x64" ? `${target}-baseline` : null;
+}
+/**
+* Target string passed to Bun: the `-baseline` alias when the `BUN_BE_BUN`
+* fallback runner would otherwise compile `target` by copying itself.
+*/
+function bunCompileTarget(target, runner, host = hostTarget(BUN_TARGETS)) {
+	if (target !== host || runner.env.BUN_BE_BUN !== "1") return target;
+	return bunBaselineAlias(target) ?? target;
+}
+/**
+* Refuse the host target when only the `BUN_BE_BUN` fallback runner is
+* available and no `-baseline` alias can stand in for it (arm64 hosts).
+*/
+function assertTargetsBuildableWithoutBun(targets, host = hostTarget(BUN_TARGETS)) {
+	if (host === null || !targets.includes(host) || bunBaselineAlias(host) !== null || which("bun") !== null) return;
+	const others = targets.filter((target) => target !== host);
+	const alternative = others.length > 0 ? `pass --target with the other targets (e.g. ${others.map((target) => `--target ${target}`).join(" ")})` : "build a different target";
+	throw new Error(`Cannot build ${host} without a separate bun executable on PATH.\n  Bun reuses the running crust executable as the base for its own platform, which yields a binary that crashes on start.
+  Install Bun (https://bun.sh), or ${alternative}.`);
+}
+/**
+* Module source the generated driver imports for a `crust.bunPlugins` specifier.
+*
+* Paths become file URLs resolved against the project; bare specifiers are
+* imported as written so they resolve from the project's own node_modules.
+*/
+function resolveBunPluginSource(specifier, cwd) {
+	return specifier.startsWith(".") || isAbsolute(specifier) ? pathToFileURL(resolve(cwd, specifier)).href : specifier;
+}
+/**
+* Marks every Bun/Node bundle crust produces so `resolveArtifactDir` (core)
+* can tell a staged bundle from source at runtime. Not a `PUBLIC_*` variable:
+* it is internal to crust, never user-set. Deno compile has no define, but
+* standalone Deno binaries are detected directly.
+*/
+const CRUST_BUILD_DEFINE = { "process.env.CRUST_INTERNAL_BUILD": "\"1\"" };
+const CRUST_BUILD_DEFINE_ARG = "process.env.CRUST_INTERNAL_BUILD=\"1\"";
+/**
+* Script that runs `Bun.build` with the project's bundler plugins.
+*
+* `bun build` has no plugin flag, so plugins are loaded by a generated script
+* placed in the project root (project module resolution) and run with the
+* same runner as the CLI path. Every value is embedded via JSON.stringify.
+*/
+function createBunPluginDriverScript(options) {
+	return `// Generated by crust build for crust.bunPlugins; deleted when the build finishes.
+const options = ${JSON.stringify(options)};
+const plugins = [];
+for (const { specifier, source } of options.plugins) {
+	let plugin;
+	try {
+		plugin = (await import(source)).default;
+	} catch (error) {
+		// Bun names this (soon deleted) driver as the importer; the project root is the useful location.
+		const message = (error instanceof Error ? error.message : String(error)).replace(\` imported from \${import.meta.path}\`, "");
+		console.error(\`crust.bunPlugins entry \${specifier} could not be imported from \${process.cwd()}: \${message}\`);
+		process.exit(1);
+	}
+	if (typeof plugin !== "object" || plugin === null || typeof plugin.name !== "string" || typeof plugin.setup !== "function") {
+		console.error(\`crust.bunPlugins entry \${specifier} must default-export a Bun bundler plugin ({ name, setup }). Wrap a plugin factory in a module that default-exports the created plugin.\`);
+		process.exit(1);
+	}
+	plugins.push(plugin);
+}
+const result = await Bun.build({ ...options.build, define: ${JSON.stringify(CRUST_BUILD_DEFINE)}, plugins, throw: false });
+if (!result.success) {
+	for (const log of result.logs) console.error(log);
+	process.exit(1);
+}
+if (options.build.target === "node") {
+	if (result.outputs.length !== 1) {
+		// Same refusal as \`bun build --outfile\`: a file-type asset import yields entry + asset.
+		console.error("error: cannot write multiple output files without an output directory");
+		process.exit(1);
+	}
+	await Bun.write(options.outfile, result.outputs[0]);
+}
+`;
+}
+async function runBunPluginDriver(build, outfilePath, bunPlugins, envFiles, cwd) {
+	const driverPath = join(cwd, `.crust-build-${randomBytes(6).toString("hex")}.ts`);
+	await writeFile(driverPath, createBunPluginDriverScript({
+		plugins: bunPlugins.map((specifier) => ({
+			specifier,
+			source: resolveBunPluginSource(specifier, cwd)
+		})),
+		build,
+		outfile: outfilePath
+	}));
+	try {
+		await runBuildProcess(resolveBunBuildRunner(), [...toBunEnvFileArgs(envFiles), driverPath], outfilePath, cwd);
+	} finally {
+		await rm(driverPath, { force: true });
+	}
+}
+/**
+* Compile a single entry file to a standalone executable.
+*
+* Uses `bun build --compile` as a subprocess so the standalone compiler runs
+* in Bun's CLI process rather than inside the current Crust runtime.
+* This avoids in-process compiler issues seen on some host/target
+* combinations while still supporting env-file loading natively.
+*
+* @param entryPath - Absolute path to the entry file
+* @param outfilePath - Absolute path to the output binary
+* @param minify - Whether to enable minification
+* @param target - Bun compile target
+* @param envFiles - Optional env files to load during build
+* @param bunPlugins - Bun bundler plugin specifiers; when present the build
+*   runs through the generated `Bun.build` driver instead of `bun build`
+* @throws {Error} If the build fails
+*/
+async function execBuild(entryPath, outfilePath, minify, target, envFiles, cwd, bunPlugins = []) {
+	const runner = resolveBunBuildRunner();
+	const compileTarget = bunCompileTarget(target, runner);
+	if (bunPlugins.length > 0) {
+		await runBunPluginDriver({
+			entrypoints: [entryPath],
+			minify,
+			env: "PUBLIC_*",
+			target: "bun",
+			compile: {
+				target: compileTarget,
+				outfile: outfilePath,
+				autoloadBunfig: false
+			}
+		}, outfilePath, bunPlugins, envFiles, cwd);
+		return;
+	}
+	await runBuildProcess(runner, createBunCompileArgs(entryPath, outfilePath, minify, compileTarget, envFiles), outfilePath, cwd);
+}
+function createBunCompileArgs(entryPath, outfilePath, minify, target, envFiles = []) {
+	return [
+		"build",
+		"--compile",
+		"--no-compile-autoload-bunfig",
+		...toBunEnvFileArgs(envFiles),
+		"--env=PUBLIC_*",
+		"--define",
+		CRUST_BUILD_DEFINE_ARG,
+		"--outfile",
+		outfilePath,
+		...minify ? ["--minify"] : [],
+		"--target",
+		target,
+		entryPath
+	];
+}
+function createDenoCompileArgs(entryPath, outfilePath, target) {
+	return [
+		"compile",
+		"-A",
+		"--output",
+		outfilePath,
+		"--target",
+		target,
+		entryPath
+	];
+}
+async function runBuildProcess(runner, args, outfilePath, cwd) {
+	const { exitCode, stdout, stderr } = await runProcess(runner.command, args, {
+		env: runner.env,
+		cwd,
+		stdio: "collect"
+	});
+	if (exitCode !== 0) {
+		const output = [stderr.trim(), stdout.trim()].filter(Boolean).join("\n");
+		throw new Error(`Build failed for ${outfilePath}${output ? `:\n${output}` : ""}`);
+	}
+}
+async function execNodeBuild(entryPath, outfilePath, minify, envFiles, cwd, bunPlugins = []) {
+	if (bunPlugins.length > 0) await runBunPluginDriver({
+		entrypoints: [entryPath],
+		minify,
+		env: "PUBLIC_*",
+		target: "node",
+		format: "esm"
+	}, outfilePath, bunPlugins, envFiles, cwd);
+	else await runBuildProcess(resolveBunBuildRunner(), [
+		"build",
+		...toBunEnvFileArgs(envFiles),
+		"--env=PUBLIC_*",
+		"--define",
+		CRUST_BUILD_DEFINE_ARG,
+		"--target",
+		"node",
+		"--format",
+		"esm",
+		"--outfile",
+		outfilePath,
+		...minify ? ["--minify"] : [],
+		entryPath
+	], outfilePath, cwd);
+	const output = await readFile(outfilePath, "utf8");
+	await writeFile(outfilePath, "#!/usr/bin/env node\n" + output.replace(/^#![^\n]*(?:\n|$)/, ""));
+	if (process.platform !== "win32") await chmod(outfilePath, 493);
+}
+async function execDenoBuild(entryPath, outfilePath, target, cwd) {
+	const denoPath = which("deno");
+	if (!denoPath) throw new Error("Deno is required for the deno runtime but was not found on PATH.\n  Install Deno from https://deno.com/ and try again.");
+	await runBuildProcess({
+		command: denoPath,
+		env: { ...process.env }
+	}, createDenoCompileArgs(entryPath, outfilePath, target), outfilePath, cwd);
+}
+/**
+* Prepare a CLI entry's Command Snapshot in the user's project context.
+*
+* The entry runs as a subprocess with `CRUST_INTERNAL_SNAPSHOT_PATH` pointing
+* to a temporary file. `.execute()` validates and writes the command graph and
+* adjacent Build Report, then exits before any following entrypoint code can run.
+*
+* Runs with the same bun as compilation (`resolveBunBuildRunner`): bun on
+* PATH, or a compiled standalone crust executable as `BUN_BE_BUN=1`, so
+* arbitrary `.ts` entries run without a separate `bun` install.
+*/
+const SNAPSHOT_TIMEOUT_MS = 3e4;
+function isBuildReport(value) {
+	return isJsonObject(value) && Array.isArray(value.extensions) && value.extensions.every((extension) => isJsonObject(extension) && typeof extension.id === "string" && Array.isArray(extension.files) && extension.files.every((file) => typeof file === "string"));
+}
+async function buildEntrypoint(entryPath, outDir, envFiles, io, cwd) {
+	const absoluteEntry = resolve(entryPath);
+	const snapshotDir = await mkdtemp(join(tmpdir(), "crust-snapshot-"));
+	const snapshotPath = join(snapshotDir, "command.json");
+	const buildReportPath = join(snapshotDir, "build-report.json");
+	try {
+		const runner = resolveBunBuildRunner();
+		const spawnedAt = Date.now();
+		const proc = spawn(runner.command, [...toBunEnvFileArgs(envFiles), absoluteEntry], {
+			env: {
+				...runner.env,
+				[SNAPSHOT_PATH_ENV]: snapshotPath,
+				[BUILD_OUT_DIR_ENV]: resolve(outDir)
+			},
+			cwd,
+			stdio: [
+				"ignore",
+				"ignore",
+				"pipe"
+			],
+			timeout: SNAPSHOT_TIMEOUT_MS
+		});
+		const stderrPromise = text(proc.stderr);
+		const [exitCode] = await once(proc, "close");
+		const stderr = (await stderrPromise).trim();
+		if (proc.signalCode !== null) {
+			if (Date.now() - spawnedAt >= SNAPSHOT_TIMEOUT_MS) throw new Error(`Command Snapshot preparation timed out after ${SNAPSHOT_TIMEOUT_MS / 1e3}s.\n  An Extension build hook may be hanging. Use --no-validate to skip entry preparation and build hooks.`);
+			throw new Error(`Command Snapshot preparation was killed by ${proc.signalCode}.${stderr ? `\n${stderr}` : ""}`);
+		}
+		if (exitCode !== 0) throw new Error(stderr || "Command Snapshot preparation failed");
+		if (stderr) {
+			const styled = stderr.split("\n").map((line) => line.startsWith("Warning:") ? `${yellow("Warning:")}${line.slice(8)}` : line).join("\n");
+			io.stderr(styled);
+		}
+		let serialized;
+		try {
+			serialized = await readFile(snapshotPath, "utf8");
+		} catch (error) {
+			if (isErrnoException(error) && error.code === "ENOENT") throw new Error(`Entry exited without producing a Command Snapshot.\n  Ensure ${absoluteEntry} calls await app.execute() and uses a compatible @crustjs/core version.`, { cause: error });
+			throw error;
+		}
+		let snapshot;
+		try {
+			snapshot = JSON.parse(serialized);
+		} catch (error) {
+			throw new Error(`Entry produced an invalid Command Snapshot.\n  Ensure ${absoluteEntry} uses a compatible @crustjs/core version.`, { cause: error });
+		}
+		let serializedBuild;
+		try {
+			serializedBuild = await readFile(buildReportPath, "utf8");
+		} catch (error) {
+			if (isErrnoException(error) && error.code === "ENOENT") throw new Error(`Entry produced a Command Snapshot without a Build Report.\n  Ensure ${absoluteEntry} uses a compatible @crustjs/core version.`, { cause: error });
+			throw error;
+		}
+		try {
+			const build = JSON.parse(serializedBuild);
+			if (!isBuildReport(build)) throw new Error("Expected extensions with string ids and files arrays.");
+			for (const extension of build.extensions) {
+				defineExtensionId(extension.id);
+				for (const file of extension.files) {
+					const path = resolve(outDir, file);
+					if (file === "." || file.includes("\\") || posix.normalize(file) !== file || win32.isAbsolute(file) || /^[A-Za-z]:/.test(file) || !isWithin(resolve(outDir), path) || !isWithin(realpathSync(outDir), realpathSync(path)) || !lstatSync(path).isFile()) throw new Error(`Reported artifact must be a normalized, contained regular file: ${file}`);
+				}
+			}
+			return {
+				snapshot,
+				build
+			};
+		} catch (error) {
+			throw new Error(`Entry produced an invalid Build Report.\n  Ensure ${absoluteEntry} uses a compatible @crustjs/core version; upgrade Core, @crustjs/crust, and build-hook Extensions together to the pure-return build API.`, { cause: error });
+		}
+	} finally {
+		await rm(snapshotDir, {
+			recursive: true,
+			force: true,
+			maxRetries: 3,
+			retryDelay: 100
+		});
+	}
+}
+//#endregion
+//#region src/utils/distribute.ts
+/** Project-relative directory that `crust build` owns: wiped per build, read by `crust publish`. */
+const CRUST_DIR = ".crust";
+const MAX_PACKAGE_NAME_LENGTH = 214;
+const METADATA_KEYS = [
+	"description",
+	"license",
+	"author",
+	"homepage",
+	"bugs",
+	"repository",
+	"keywords",
+	"publishConfig",
+	"funding",
+	"engines"
+];
+function readPackageJson(cwd, packageJson) {
+	if (packageJson === void 0) throw new Error(`package.json not found in ${cwd}\n  crust build requires a package.json with name and version fields.`);
+	if (!isJsonObject(packageJson)) throw new Error(`package.json in ${cwd} must contain a JSON object.`);
+	validatePackageIdentity(packageJson, "package.json");
+	return packageJson;
+}
+/** Only identity is interpreted here; this is not a complete npm schema validator. */
+function validatePackageIdentity(value, source) {
+	if (value === void 0 || !isJsonObject(value)) throw new Error(`${source} must contain a JSON object.`);
+	if (typeof value.name !== "string" || value.name.trim() === "") throw new Error(`${source} name field must be a non-empty string.`);
+	if (typeof value.version !== "string" || value.version.trim() === "") throw new Error(`${source} version field must be a non-empty string.`);
+}
+function isString$1(value) {
+	return typeof value === "string";
+}
+function derivePlatformPackageName(rootPackageName, targetAlias) {
+	const [scope, name] = rootPackageName.startsWith("@") ? rootPackageName.split("/") : [void 0, rootPackageName];
+	const suffixedName = `${name}-${targetAlias}`;
+	return scope ? `${scope}/${suffixedName}` : suffixedName;
+}
+function getPackagePathSegment(packageName) {
+	return packageName.startsWith("@") ? packageName.split("/")[1] ?? packageName : packageName;
+}
+/** Platform binary filename: `<command>-<target>`, `.exe` on Windows. */
+function binaryFilename(command, target) {
+	return `${command}-${target.target}${target.os === "win32" ? ".exe" : ""}`;
+}
+function platformBinMap(commands, target) {
+	return Object.fromEntries(commands.map((command) => [command, `bin/${binaryFilename(command, target)}`]));
+}
+function buildDistributionRootPackageJson(metadata, commands, targets, { artifactDirs, manPages }) {
+	return {
+		...metadata.rootPackageJson,
+		name: metadata.rootPackageName,
+		version: metadata.version,
+		type: "module",
+		files: ["bin", ...artifactDirs],
+		bin: Object.fromEntries(commands.map((command) => [command, `bin/${command}.js`])),
+		...targets.length > 0 ? { optionalDependencies: Object.fromEntries(targets.map((target) => [target.packageName, metadata.version])) } : {},
+		...manPages.length > 0 ? { man: manPages.map((page) => `./man/${page}`) } : {},
+		exports: metadata.exports,
+		peerDependencies: metadata.peerDependencies,
+		peerDependenciesMeta: metadata.peerDependenciesMeta
+	};
+}
+/**
+* Node rejects export targets whose segments are `.`, `..`, `node_modules`, or
+* empty (`ERR_INVALID_PACKAGE_TARGET`), also percent-encoded, even when the path
+* normalizes to a staged file, so filesystem checks alone would pass a target
+* consumers cannot import.
+*/
+function hasNodeInvalidSegment(target) {
+	return target.slice(2).split(/[\\/]/).some((segment) => {
+		let decoded = segment;
+		try {
+			decoded = decodeURIComponent(segment);
+		} catch {}
+		return /^(\.\.?|node_modules|)$/i.test(decoded);
+	});
+}
+/**
+* Checks a package.json `exports` map against the staged root package: every
+* target must be a `./`-relative path to a file that staging copied there (a
+* `crust.include` directory or Extension artifact), so the published root
+* package resolves exactly what the project's own `exports` promises. `null`
+* targets (blocked subpaths) and nested condition objects are allowed;
+* fallback arrays and `*` patterns are rejected rather than half-checked.
+*/
+function validateStagedExports(exports, rootDir, sourceType) {
+	const fail = (detail) => {
+		throw new Error(`package.json exports ${detail}\n  crust build stages only bin/, Extension artifacts, and crust.include directories into the root package; point exports at a crust.include directory or remove the field.`);
+	};
+	const checkTarget = (target, at) => {
+		if (target === null) return;
+		if (isString$1(target)) {
+			const staged = resolve(rootDir, target);
+			if (!target.startsWith("./") || !isWithin(rootDir, staged)) fail(`target ${JSON.stringify(target)} (${at}) must be a ./-relative path inside the package.`);
+			if (target.includes("*")) fail(`target ${JSON.stringify(target)} (${at}) uses a pattern, which crust build does not support.`);
+			if (hasNodeInvalidSegment(target)) fail(`target ${JSON.stringify(target)} (${at}) contains a path segment Node rejects (".", "..", "node_modules", or empty).`);
+			if (!existsSync(staged) || !statSync(staged).isFile()) fail(`target ${JSON.stringify(target)} (${at}) is not a staged file: ${staged}`);
+			if (sourceType !== "module" && (target.endsWith(".js") || target.endsWith(".d.ts"))) {
+				let scope = dirname(staged);
+				while (scope !== rootDir && !existsSync(join(scope, "package.json"))) scope = dirname(scope);
+				if (scope === rootDir) fail(`target ${JSON.stringify(target)} (${at}) would change module format under the staged root's type: "module". Use .cjs/.d.cts for CommonJS, or include a nested package.json declaring the library's type.`);
+			}
+			return;
+		}
+		if (!isJsonObject(target)) fail(`${at} must be a path, null, or a conditions object, not ${JSON.stringify(target)}.`);
+		for (const [condition, value] of Object.entries(target)) {
+			if (condition.startsWith(".")) fail(`${at} mixes subpath ${JSON.stringify(condition)} into a conditions object.`);
+			checkTarget(value, `${at} -> ${condition}`);
+		}
+	};
+	if (isJsonObject(exports) && Object.keys(exports).some((key) => key.startsWith("."))) {
+		for (const [subpath, target] of Object.entries(exports)) {
+			if (!subpath.startsWith(".")) fail(`mixes condition ${JSON.stringify(subpath)} with subpath keys.`);
+			checkTarget(target, subpath);
+		}
+		return;
+	}
+	checkTarget(exports, "\".\"");
+}
+/**
+* Carries `peerDependencies` (and `peerDependenciesMeta`) into the root package
+* so a library `exports` entry can declare what its published types import.
+* Ranges must be publishable as written: the staged manifests go to npm
+* directly, so `workspace:` and `catalog:` ranges would leak into the registry.
+*/
+function validatePeerDependencies(peerDependencies, peerDependenciesMeta) {
+	if (!isJsonObject(peerDependencies)) throw new Error("package.json peerDependencies must be an object of package names to ranges.");
+	const ranges = {};
+	for (const [name, range] of Object.entries(peerDependencies)) {
+		if (!isString$1(range) || /^(workspace|catalog):/.test(range)) throw new Error(`package.json peerDependencies[${JSON.stringify(name)}] must be a publishable range, not ${JSON.stringify(range)}.\n  crust build publishes the staged root package as written; workspace: and catalog: ranges are never rewritten.`);
+		ranges[name] = range;
+	}
+	if (peerDependenciesMeta === void 0) return { peerDependencies: ranges };
+	if (!isJsonObject(peerDependenciesMeta)) throw new Error("package.json peerDependenciesMeta must be an object keyed by peer name.");
+	for (const name of Object.keys(peerDependenciesMeta)) if (!Object.hasOwn(ranges, name)) throw new Error(`package.json peerDependenciesMeta[${JSON.stringify(name)}] has no matching peerDependencies entry.`);
+	return {
+		peerDependencies: ranges,
+		peerDependenciesMeta
+	};
+}
+function buildDistributionPlatformPackageJson(metadata, commands, target) {
+	return {
+		...metadata.rootPackageJson,
+		name: target.packageName,
+		version: metadata.version,
+		files: ["bin"],
+		bin: platformBinMap(commands, target),
+		os: [target.os],
+		cpu: [target.cpu],
+		...target.libc ? { libc: [target.libc] } : {}
+	};
+}
+function pickRootMetadata(pkgJson) {
+	const metadata = {
+		name: pkgJson.name,
+		version: pkgJson.version
+	};
+	for (const key of METADATA_KEYS) {
+		const value = pkgJson[key];
+		if (value !== void 0) Object.assign(metadata, { [key]: value });
+	}
+	return metadata;
+}
+function validatePackageNameLength(packageName) {
+	if (packageName.length > MAX_PACKAGE_NAME_LENGTH) throw new Error(`Generated package name is too long for npm: ${packageName}\n  Keep package names at or below ${MAX_PACKAGE_NAME_LENGTH} characters after the platform suffix is added.`);
+}
+function resolveDistributionMetadata(cwd, userPackageJson) {
+	const pkgJson = readPackageJson(cwd, userPackageJson);
+	validatePackageNameLength(pkgJson.name);
+	return {
+		rootPackageName: pkgJson.name,
+		version: pkgJson.version,
+		rootPackageJson: pickRootMetadata(pkgJson),
+		sourceType: pkgJson.type,
+		...pkgJson.exports !== void 0 ? { exports: pkgJson.exports } : {},
+		...pkgJson.peerDependencies !== void 0 ? validatePeerDependencies(pkgJson.peerDependencies, pkgJson.peerDependenciesMeta) : {}
+	};
+}
+function resolveDistributionTarget(table, stageDir, rootPackageName, target) {
+	const info = table.info[target];
+	const packageName = derivePlatformPackageName(rootPackageName, info.alias);
+	validatePackageNameLength(packageName);
+	return {
+		target,
+		platformKey: info.platformKey,
+		targetAlias: info.alias,
+		packageName,
+		packagePathSegment: getPackagePathSegment(packageName),
+		packageDir: resolve(stageDir, info.alias),
+		os: info.os,
+		cpu: info.cpu,
+		...info.libc ? { libc: info.libc } : {}
+	};
+}
+function generateDistributionJsResolver(command, targets) {
+	const targetMap = Object.fromEntries(targets.map((target) => [target.platformKey, {
+		packagePathSegment: target.packagePathSegment,
+		packageName: target.packageName,
+		targetAlias: target.targetAlias,
+		binaryFilename: binaryFilename(command, target)
+	}]));
+	const supportedPlatforms = targets.map((target) => target.targetAlias).join(", ");
+	return `#!/usr/bin/env node
+// Auto-generated by crust build -- do not edit
+import { spawn } from "node:child_process";
+import { chmodSync, existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const NAME = ${JSON.stringify(command)};
+const PLATFORMS = ${JSON.stringify(targetMap, null, "	")};
+const dir = dirname(fileURLToPath(import.meta.url));
+
+// Same check as Bun's own npm installer: glibc reports its version, musl does not.
+function isMusl() {
+	try {
+		const report = process.report?.getReport();
+		if (report?.header) return report.header.glibcVersionRuntime === undefined;
+	} catch {}
+	return existsSync("/etc/alpine-release");
+}
+
+const platformKey =
+	\`\${process.platform}-\${process.arch}\` + (process.platform === "linux" && isMusl() ? "-musl" : "");
+const target = PLATFORMS[platformKey];
+
+if (!target) {
+\tconsole.error("[" + NAME + "] Unsupported platform: " + platformKey);
+\tconsole.error("[" + NAME + "] Supported platforms: ${supportedPlatforms}");
+\tprocess.exit(1);
+}
+
+const candidates = [
+\t// Hoisted install: the platform package beside this one in node_modules.
+\tresolve(dir, "..", "..", target.packagePathSegment, "bin", target.binaryFilename),
+\t// Nested install: the platform package under this package's node_modules.
+\tresolve(dir, "..", "node_modules", target.packageName, "bin", target.binaryFilename),
+\t// In place: the .crust/ tree crust build staged, before any install.
+\tresolve(dir, "..", "..", target.targetAlias, "bin", target.binaryFilename),
+];
+const binPath = candidates.find((candidate) => existsSync(candidate));
+
+if (!binPath) {
+\tconsole.error("[" + NAME + "] Missing platform package for " + platformKey);
+\tconsole.error("[" + NAME + "] Tried:");
+\tfor (const candidate of candidates) console.error("  " + candidate);
+\tconsole.error(
+\t\t"[" + NAME + "] Reinstall dependencies on this platform and ensure optional dependencies are enabled.",
+\t);
+\tprocess.exit(1);
+}
+
+if (process.platform !== "win32") {
+\ttry {
+\t\tchmodSync(binPath, 0o755);
+\t} catch {
+\t\t// Ignore permission adjustment failures and let spawn surface real errors.
+\t}
+}
+
+const child = spawn(binPath, process.argv.slice(2), {
+\tstdio: "inherit",
+});
+
+child.on("error", (error) => {
+\tconsole.error("[" + NAME + "] Failed to launch binary: " + error.message);
+\tprocess.exit(1);
+});
+
+child.on("exit", (code, signal) => {
+\tif (signal) {
+\t\ttry {
+\t\t\tprocess.kill(process.pid, signal);
+\t\t} catch {
+\t\t\tprocess.exit(1);
+\t\t}
+\t\treturn;
+\t}
+
+\tprocess.exit(code ?? 0);
+});
+`;
+}
+function writeJson(path, value) {
+	writeFileSync(path, `${JSON.stringify(value, null, "	")}\n`);
+}
+function copyRootReadme(cwd, rootDir) {
+	const readmePath = join(cwd, "README.md");
+	if (existsSync(readmePath)) copyFileSync(readmePath, join(rootDir, "README.md"));
+}
+function copyLicense(cwd, packageDirs) {
+	const licenseName = [
+		"LICENSE",
+		"LICENSE.md",
+		"LICENCE",
+		"LICENCE.md"
+	].find((name) => existsSync(join(cwd, name)));
+	if (!licenseName) return;
+	const licensePath = join(cwd, licenseName);
+	for (const packageDir of packageDirs) copyFileSync(licensePath, join(packageDir, licenseName));
+}
+function writeDistributionManifest(stageDir, metadata, commands, targets, build) {
+	const manifest = {
+		version: metadata.version,
+		root: {
+			name: metadata.rootPackageName,
+			dir: "root",
+			bins: [...commands]
+		},
+		packages: targets.map((target) => ({
+			target: target.targetAlias,
+			name: target.packageName,
+			dir: target.targetAlias,
+			os: target.os,
+			cpu: target.cpu,
+			...target.libc ? { libc: target.libc } : {},
+			bins: platformBinMap(commands, target)
+		})),
+		publishOrder: [...targets.map((target) => target.targetAlias), "root"],
+		...build ? { build } : {}
+	};
+	writeJson(join(stageDir, "manifest.json"), manifest);
+	return manifest;
+}
+function stageDistributionPackages(cwd, stageDir, metadata, commands, targets, options) {
+	const rootDir = join(stageDir, "root");
+	const rootBinDir = join(rootDir, "bin");
+	mkdirSync(rootBinDir, { recursive: true });
+	writeJson(join(rootDir, "package.json"), buildDistributionRootPackageJson(metadata, commands, targets, options));
+	copyRootReadme(cwd, rootDir);
+	for (const target of targets) {
+		mkdirSync(join(target.packageDir, "bin"), { recursive: true });
+		writeJson(join(target.packageDir, "package.json"), buildDistributionPlatformPackageJson(metadata, commands, target));
+	}
+	copyLicense(cwd, [rootDir, ...targets.map((target) => target.packageDir)]);
+}
+/**
+* Stages the npm tree in `plan.stageDir`. `build` is each command's Extension
+* build hook report, recorded in `manifest.json`; omit it when the hooks did not run.
+* Returns every generated package.json, launcher, and compiled command in staging order.
+*/
+async function runDistributeBuild(plan, distribution, io, build) {
+	const metadata = resolveDistributionMetadata(plan.cwd, plan.userPackageJson);
+	const commands = plan.entries.map((entry) => entry.command);
+	const table = distribution.table;
+	const distributionTargets = table ? distribution.targets.map((target) => resolveDistributionTarget(table, plan.stageDir, metadata.rootPackageName, target)) : [];
+	io.stdout(table ? `Staging ${bold(`${distributionTargets.length}`)} distribution target(s) in ${dim(plan.stageDir)}...` : `Staging a root-only npm package in ${dim(plan.stageDir)}...`);
+	const artifactOutDir = plan.validate ? plan.outDir : void 0;
+	const artifacts = collectArtifacts(artifactOutDir);
+	const includeDirs = collectIncludeDirs(plan.cwd, plan.stageDir, plan.include, artifacts.names);
+	stageDistributionPackages(plan.cwd, plan.stageDir, metadata, commands, distributionTargets, {
+		artifactDirs: [...artifacts.names, ...includeDirs],
+		manPages: artifacts.manPages
+	});
+	const rootDir = join(plan.stageDir, "root");
+	const produced = [{
+		kind: "package-json",
+		path: join(rootDir, "package.json")
+	}, ...distributionTargets.map((targetPackage) => ({
+		kind: "package-json",
+		path: join(targetPackage.packageDir, "package.json"),
+		target: targetPackage.target
+	}))];
+	const copies = [...artifactOutDir ? artifacts.names.map((name) => ({
+		name,
+		sourceDir: join(artifactOutDir, name),
+		dereference: false
+	})) : [], ...includeDirs.map((name) => ({
+		name,
+		sourceDir: join(plan.cwd, name),
+		dereference: true
+	}))];
+	for (const { name, sourceDir, dereference } of copies) {
+		const options = {
+			recursive: true,
+			dereference,
+			verbatimSymlinks: !dereference
+		};
+		cpSync(sourceDir, join(rootDir, name), options);
+		for (const targetPackage of distributionTargets) cpSync(sourceDir, join(targetPackage.packageDir, "bin", name), options);
+	}
+	if (metadata.exports !== void 0) validateStagedExports(metadata.exports, rootDir, metadata.sourceType);
+	const rootBinDir = join(rootDir, "bin");
+	if (table) {
+		for (const { command } of plan.entries) {
+			const launcherPath = join(rootBinDir, `${command}.js`);
+			writeFileSync(launcherPath, generateDistributionJsResolver(command, distributionTargets), { mode: 493 });
+			produced.push({
+				kind: "launcher",
+				path: launcherPath,
+				command
+			});
+		}
+		for (const targetPackage of distributionTargets) for (const { command, entryPath } of plan.entries) {
+			const outfilePath = join(targetPackage.packageDir, "bin", binaryFilename(command, targetPackage));
+			io.stdout(`  ${cyan("→")} ${bold(targetPackage.targetAlias)}: ${dim(outfilePath)}`);
+			await distribution.execute(entryPath, outfilePath, targetPackage.target);
+			produced.push({
+				kind: "executable",
+				path: outfilePath,
+				command,
+				target: targetPackage.target
+			});
+		}
+	} else for (const { command, entryPath } of plan.entries) {
+		const rootBinPath = join(rootBinDir, `${command}.js`);
+		io.stdout(`  ${cyan("→")} ${bold("root")}: ${dim(rootBinPath)}`);
+		await distribution.execute(entryPath, rootBinPath);
+		produced.push({
+			kind: "bundle",
+			path: rootBinPath,
+			command
+		});
+	}
+	writeDistributionManifest(plan.stageDir, metadata, commands, distributionTargets, build);
+	const manifestPath = join(plan.stageDir, "manifest.json");
+	io.stdout(`\n${green("✓")} Staged ${bold(`${distributionTargets.length + 1}`)} npm package(s) successfully:`);
+	io.stdout(`  ${rootDir}`);
+	for (const targetPackage of distributionTargets) io.stdout(`  ${targetPackage.packageDir}`);
+	io.stdout(`\n${dim("Manifest:")} ${manifestPath}`);
+	return produced;
+}
+/**
+* `crust.include` directories normalized to cwd-relative POSIX names. They are
+* staged exactly like Extension artifacts.
+*/
+function collectIncludeDirs(cwd, stageDir, include, artifactNames) {
+	const names = [...artifactNames];
+	const includeDirs = [];
+	for (const entry of include) {
+		const dir = resolve(cwd, entry);
+		const name = relative(cwd, dir);
+		if (isAbsolute(entry) || name === "" || !isWithin(cwd, dir)) throw new Error(`package.json crust.include entry ${JSON.stringify(entry)} must be a directory inside the project root ${cwd}.`);
+		if (!existsSync(dir) || !statSync(dir).isDirectory()) throw new Error(`package.json crust.include entry ${JSON.stringify(entry)} is not a directory: ${dir}`);
+		assertResolvesInsideProject(cwd, entry, dir);
+		if (isWithin(stageDir, dir) || isWithin(dir, stageDir)) throw new Error(`package.json crust.include entry ${JSON.stringify(entry)} overlaps the build output directory ${stageDir}, which crust build replaces.`);
+		if (name.split(sep)[0] === "bin") throw new Error(`package.json crust.include entry ${JSON.stringify(entry)} conflicts with the generated npm bin directory.\n  Include a directory with a different top-level name.`);
+		const posixName = name.replaceAll(sep, "/");
+		const overlap = names.find((staged) => staged === posixName || staged.startsWith(`${posixName}/`) || posixName.startsWith(`${staged}/`));
+		if (overlap !== void 0) throw new Error(`package.json crust.include entry ${JSON.stringify(entry)} overlaps "${overlap}", which is already staged (duplicate include or Extension artifact directory).`);
+		names.push(posixName);
+		includeDirs.push(posixName);
+	}
+	return includeDirs;
+}
+/**
+* Walks `dir` the way the dereferencing copy will (through symlinked
+* directories) and rejects any path whose real location leaves the project.
+*/
+function assertResolvesInsideProject(cwd, entry, dir) {
+	const realCwd = realpathSync(cwd);
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (path) => {
+		const real = realpathSync(path);
+		if (!isWithin(realCwd, real)) throw new Error(`package.json crust.include entry ${JSON.stringify(entry)} resolves outside the project root: ${relative(cwd, path)} -> ${real}`);
+		if (seen.has(real) || !statSync(path).isDirectory()) return;
+		seen.add(real);
+		for (const child of readdirSync(path)) walk(join(path, child));
+	};
+	walk(dir);
+}
+/**
+* Copies one entry's Extension build hook output into the shared artifact
+* directory. Identically spelled directories merge; case-only directory aliases
+* and a file or file/directory mismatch at a path
+* another entry already produced is an error, so no entry's hooks can replace
+* another's output. `owners` tracks case-folded POSIX-relative paths across
+* entries, including directories so file/ancestor conflicts are portable.
+*/
+function mergeEntryArtifacts(entryOutDir, artifactDir, command, owners) {
+	const merge = (relativeDir) => {
+		for (const dirent of readdirSync(join(entryOutDir, relativeDir), { withFileTypes: true })) {
+			const relativePath = relativeDir ? `${relativeDir}/${dirent.name}` : dirent.name;
+			if (!dirent.isDirectory() && !dirent.isFile()) throw new Error(`Build artifact "${relativePath}" from bin ${JSON.stringify(command)} must use regular files and directories, not symlinks or other file types.`);
+			const source = join(entryOutDir, relativePath);
+			const destination = join(artifactDir, relativePath);
+			const key = relativePath.toLowerCase();
+			const owner = owners.get(key);
+			const existing = lstatSync(destination, { throwIfNoEntry: false });
+			if (owner && !(dirent.isDirectory() && owner.directory && owner.path === relativePath) || existing && !(dirent.isDirectory() && existing.isDirectory())) throw new Error(`Build artifact "${relativePath}" is written by both bin ${JSON.stringify(owner?.command ?? "an earlier bin")} and ${JSON.stringify(command)}.\n  Extension build hooks of different commands must write distinct paths under ${artifactDir}.`);
+			if (!owner) owners.set(key, {
+				command,
+				directory: dirent.isDirectory(),
+				path: relativePath
+			});
+			if (dirent.isDirectory()) {
+				mkdirSync(destination, { recursive: true });
+				merge(relativePath);
+			} else {
+				mkdirSync(dirname(destination), { recursive: true });
+				copyFileSync(source, destination);
+			}
+		}
+	};
+	const root = lstatSync(entryOutDir, { throwIfNoEntry: false });
+	if (root === void 0) return;
+	if (!root.isDirectory()) throw new Error(`Build artifact directory for bin ${JSON.stringify(command)} must be a directory, not a symlink or other file type: ${entryOutDir}`);
+	merge("");
+}
+function collectArtifacts(artifactOutDir) {
+	if (!artifactOutDir || !existsSync(artifactOutDir)) return {
+		names: [],
+		manPages: []
+	};
+	const names = readdirSync(artifactOutDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
+	if (names.includes("bin")) throw new Error(`Artifact directory "bin" in ${artifactOutDir} conflicts with the generated npm bin directory.\n  Emit build artifacts under a different top-level name.`);
+	return {
+		names,
+		manPages: names.includes("man") ? readdirSync(join(artifactOutDir, "man"), { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name).sort() : []
+	};
+}
+//#endregion
+//#region src/commands/build.ts
+/** Also mirrored by `schema/package.json`; build.test.ts guards against drift. */
+const CRUST_CONFIG_KEYS = [
+	"runtime",
+	"targets",
+	"bunPlugins",
+	"include"
+];
+function isBuildRuntime(value) {
+	return typeof value === "string" && BUILD_RUNTIMES.some((runtime) => runtime === value);
+}
+function isString(value) {
+	return typeof value === "string";
+}
+function isStringArray(value) {
+	return Array.isArray(value) && value.every(isString);
+}
+function readCrustConfig(pkg) {
+	if (pkg === void 0 || !isJsonObject(pkg) || pkg.crust === void 0) return {};
+	const crust = pkg.crust;
+	const allowed = `Allowed keys: ${CRUST_CONFIG_KEYS.join(", ")}`;
+	if (!isJsonObject(crust)) throw new Error(`package.json crust must be an object. ${allowed}`);
+	const unknown = Object.keys(crust).find((key) => !CRUST_CONFIG_KEYS.some((allowedKey) => allowedKey === key));
+	if (unknown !== void 0) throw new Error(`Unknown package.json crust key ${JSON.stringify(unknown)}. ${allowed}`);
+	const config = {};
+	if (crust.runtime !== void 0) {
+		if (!isBuildRuntime(crust.runtime)) throw new Error(`Invalid package.json crust.runtime ${JSON.stringify(crust.runtime)}. Valid runtimes: ${BUILD_RUNTIMES.join(", ")}`);
+		config.runtime = crust.runtime;
+	}
+	if (crust.targets !== void 0) {
+		if (!isStringArray(crust.targets) || crust.targets.length === 0) throw new Error("package.json crust.targets must be a non-empty array of canonical compiler targets, e.g. [\"bun-linux-x64\", \"bun-darwin-arm64\"].");
+		config.targets = crust.targets;
+	}
+	if (crust.bunPlugins !== void 0) {
+		if (!isStringArray(crust.bunPlugins)) throw new Error("package.json crust.bunPlugins must be an array of Bun plugin module specifiers, e.g. [\"@opentui/solid/bun-plugin\", \"./build/plugin.ts\"].");
+		config.bunPlugins = crust.bunPlugins;
+	}
+	if (crust.include !== void 0) {
+		if (!isStringArray(crust.include)) throw new Error("package.json crust.include must be an array of directory names relative to the project root, e.g. [\"templates\"].");
+		config.include = crust.include;
+	}
+	return config;
+}
+function hasDependency(pkg, name) {
+	if (!isJsonObject(pkg)) return false;
+	return [pkg.dependencies, pkg.devDependencies].some((deps) => deps !== void 0 && isJsonObject(deps) && name in deps);
+}
+const DENO_CONFIG_FILES = ["deno.json", "deno.jsonc"];
+/**
+* package.json `crust.runtime` > inference > Bun. Inference uses only
+* unambiguous signals: a Deno config file, or `@types/node` without
+* `@types/bun`. Lockfiles say which package manager installed dependencies,
+* not which runtime runs the CLI, so they are not consulted.
+*/
+function resolveBuildRuntime(pkg, config, cwd) {
+	if (config.runtime !== void 0) return {
+		runtime: config.runtime,
+		source: "from package.json"
+	};
+	const denoConfig = DENO_CONFIG_FILES.find((file) => existsSync(join(cwd, file)));
+	if (denoConfig) return {
+		runtime: "deno",
+		source: `inferred from ${denoConfig}`
+	};
+	if (pkg !== void 0 && hasDependency(pkg, "@types/node") && !hasDependency(pkg, "@types/bun")) return {
+		runtime: "node",
+		source: "inferred from @types/node"
+	};
+	return {
+		runtime: "bun",
+		source: "default"
+	};
+}
+function printBuildReport(command, report, stdout) {
+	if (report.extensions.length === 0) return;
+	stdout(`Preparing Command Snapshot for ${command}...`);
+	const fileCount = (files) => `${files.length} ${files.length === 1 ? "file" : "files"}`;
+	const idWidth = Math.max(...report.extensions.map(({ id }) => id.length));
+	const countWidth = Math.max(...report.extensions.map(({ files }) => fileCount(files).length));
+	for (const { id, files } of report.extensions) {
+		const paths = [...files.slice(0, 3), ...files.length > 3 ? [`+${files.length - 3} more`] : []].join(", ");
+		stdout(`  ${id.padEnd(idWidth)}  ${fileCount(files).padEnd(countWidth)}${paths ? `  ${paths}` : ""}`);
+	}
+}
+function resolveEnvFilePaths(cwd, envFiles) {
+	if (!envFiles || envFiles.length === 0) return [];
+	return envFiles.map((envFile) => {
+		const envPath = resolve(cwd, envFile);
+		if (!existsSync(envPath)) throw new Error(`Env file not found: ${envPath}\n  Specify a valid env file with --env-file <path>`);
+		return envPath;
+	});
+}
+/** Entry built when package.json has no `bin`. */
+const DEFAULT_ENTRY = "src/cli.ts";
+/**
+* Command names become `bin/<command>.js`, `<command>-<target>` binary
+* filenames, and launcher text, so they are restricted to a filename-safe
+* subset of what npm accepts: no separators, dots-only names, or leading `.`/`-`.
+*/
+const COMMAND_NAME_PATTERN = /^[A-Za-z0-9_~][A-Za-z0-9._~-]*$/;
+const BIN_EXAMPLE = `{ "my-cli": ${JSON.stringify(DEFAULT_ENTRY)} }`;
+/**
+* A `bin` value as an absolute path. The path must be relative and lexically
+* inside the project (a symlink may point elsewhere, as for `crust.include`),
+* and must name an existing file, not a directory.
+*/
+function resolveEntryPath(cwd, command, source) {
+	const entryPath = resolve(cwd, source);
+	if (isAbsolute(source) || entryPath === cwd || !isWithin(cwd, entryPath)) throw new Error(`package.json bin ${JSON.stringify(command)} entry ${JSON.stringify(source)} must be a file inside the project root ${cwd}.`);
+	if (!existsSync(entryPath)) throw new Error(`Entry file not found: ${entryPath}\n  Point package.json bin ${JSON.stringify(command)} at your CLI source entry (default ${DEFAULT_ENTRY}).`);
+	if (!statSync(entryPath).isFile()) throw new Error(`package.json bin ${JSON.stringify(command)} entry ${JSON.stringify(source)} is not a file: ${entryPath}`);
+	return entryPath;
+}
+/**
+* package.json `bin` as build entries, in declaration order. Object values are
+* source files built for the command named by their key; a string `bin` is the
+* source of a command named after the unscoped package name, and no `bin` builds
+* `src/cli.ts` under that name.
+*
+* Two commands cannot share one entry file: entries are compared by real path,
+* so `./src/cli.ts`, `src/../src/cli.ts`, and a symlink to `src/cli.ts` all
+* collide. Command names are compared case-insensitively, because `Tool` and
+* `tool` would be the same `bin/` file on a case-insensitive filesystem.
+*/
+function resolveBinEntries(cwd, pkg) {
+	const packageJson = pkg !== void 0 && isJsonObject(pkg) ? pkg : {};
+	const bin = packageJson.bin;
+	let declared;
+	if (bin === void 0 || isString(bin)) {
+		const name = packageJson.name;
+		if (name === void 0 || !isString(name) || name === "") throw new Error(`package.json is missing a name field.\n  Without an object bin, the unscoped package name is the command name, e.g. "bin": ${BIN_EXAMPLE}.`);
+		declared = [[name.replace(/^@[^/]+\//, ""), bin ?? "src/cli.ts"]];
+	} else if (isJsonObject(bin) && Object.keys(bin).length > 0) declared = Object.entries(bin);
+	else throw new Error(`package.json bin must be a source entry path or a non-empty object mapping command names to source entries, e.g. ${BIN_EXAMPLE}.`);
+	const commandByLowerName = /* @__PURE__ */ new Map();
+	const commandByRealPath = /* @__PURE__ */ new Map();
+	return declared.map(([command, source]) => {
+		if (!COMMAND_NAME_PATTERN.test(command)) throw new Error(`package.json bin key ${JSON.stringify(command)} is not a valid command name.\n  Use letters, digits, ".", "_", "~", and "-", not starting with "." or "-".`);
+		const sameName = commandByLowerName.get(command.toLowerCase());
+		if (sameName !== void 0) throw new Error(`package.json bin keys ${JSON.stringify(sameName)} and ${JSON.stringify(command)} differ only by case.\n  Command names become bin/ file names, which collide on case-insensitive filesystems; rename one of them.`);
+		commandByLowerName.set(command.toLowerCase(), command);
+		if (!isString(source)) throw new Error(`package.json bin ${JSON.stringify(command)} must be a project-relative source entry path, e.g. ${JSON.stringify(DEFAULT_ENTRY)}.`);
+		const entryPath = resolveEntryPath(cwd, command, source);
+		const realPath = realpathSync(entryPath);
+		const other = commandByRealPath.get(realPath);
+		if (other !== void 0) throw new Error(`package.json bin ${JSON.stringify(other)} and ${JSON.stringify(command)} both build ${realPath}.\n  Each command needs its own entry file; aliases of one entry are not supported.`);
+		commandByRealPath.set(realPath, command);
+		return {
+			command,
+			entryPath
+		};
+	});
+}
+function planBuild(options, cwd) {
+	const userPackageJson = readUserPackageJson(cwd);
+	const config = readCrustConfig(userPackageJson);
+	const { runtime, source: runtimeSource } = resolveBuildRuntime(userPackageJson, config, cwd);
+	const entries = resolveBinEntries(cwd, userPackageJson);
+	validatePackageIdentity(userPackageJson, "package.json");
+	const envFiles = resolveEnvFilePaths(cwd, options.envFiles);
+	const bunPlugins = config.bunPlugins ?? [];
+	if (runtime === "node" && options.targets?.length) throw new Error("--target cannot be used with the node runtime.\n  Node builds produce one portable JavaScript artifact.");
+	if (runtime === "node" && config.targets !== void 0) throw new Error("package.json crust.targets is not supported with the node runtime.\n  Node builds produce one portable JavaScript artifact; remove crust.targets or set crust.runtime to bun or deno.");
+	if (runtime === "deno" && options.minify) throw new Error("--minify is not supported with the deno runtime.\n  deno compile has no minification step; drop the flag.");
+	if (runtime === "deno" && envFiles.length > 0) throw new Error("--env-file is not supported with the deno runtime.\n  deno compile embeds every variable from the file into the binary — secrets included —\n  with no PUBLIC_* filter. Load configuration at runtime instead (e.g. deno run --env-file).");
+	if (runtime === "deno" && bunPlugins.length > 0) throw new Error("package.json crust.bunPlugins is not supported with the deno runtime.\n  deno compile has no Bun bundler; remove crust.bunPlugins or set crust.runtime to bun.");
+	const stageDir = resolve(cwd, CRUST_DIR);
+	const common = {
+		cwd,
+		userPackageJson,
+		runtimeSource,
+		entries,
+		envFiles,
+		bunPlugins,
+		include: config.include ?? [],
+		outDir: join(stageDir, "artifacts"),
+		stageDir,
+		validate: options.validate ?? true,
+		minify: runtime === "deno" ? false : options.minify ?? true
+	};
+	if (runtime === "node") return {
+		...common,
+		runtime
+	};
+	const targetInputs = options.targets?.length ? options.targets : config.targets;
+	if (runtime === "bun") {
+		const targets = resolveTargets(BUN_TARGETS, targetInputs);
+		assertTargetsBuildableWithoutBun(targets);
+		return {
+			...common,
+			runtime,
+			targets
+		};
+	}
+	return {
+		...common,
+		runtime,
+		targets: resolveTargets(DENO_TARGETS, targetInputs)
+	};
+}
+/** Bun and Deno stage platform packages behind a Node launcher; Node stages a root-only bundle. */
+async function runStagedBuild(plan, io, reports) {
+	if (plan.runtime === "bun") return runDistributeBuild(plan, {
+		table: BUN_TARGETS,
+		targets: plan.targets,
+		execute: (entry, outfile, target) => execBuild(entry, outfile, plan.minify, target, plan.envFiles, plan.cwd, plan.bunPlugins)
+	}, io, reports);
+	if (plan.runtime === "deno") return runDistributeBuild(plan, {
+		table: DENO_TARGETS,
+		targets: plan.targets,
+		execute: (entry, outfile, target) => execDenoBuild(entry, outfile, target, plan.cwd)
+	}, io, reports);
+	return runDistributeBuild(plan, { execute: (entry, outfile) => execNodeBuild(entry, outfile, plan.minify, plan.envFiles, plan.cwd, plan.bunPlugins) }, io, reports);
+}
+/**
+* Prepares every entry's Command Snapshot and checks that its root command is
+* named after the bin key, then merges the Extension build hook output into
+* `plan.outDir`. Each entry's hooks write into their own temporary directory;
+* the merge fails on any path two entries both write. Returns each command's
+* Build Report.
+*/
+async function prepareEntries(plan, io) {
+	const owners = /* @__PURE__ */ new Map();
+	const reports = {};
+	for (const { command, entryPath } of plan.entries) {
+		const entryOutDir = await mkdtemp(join(tmpdir(), "crust-artifacts-"));
+		try {
+			const { snapshot, build: report } = await buildEntrypoint(entryPath, entryOutDir, plan.envFiles, io, plan.cwd);
+			if (snapshot.meta.name !== command) throw new Error(`package.json bin ${JSON.stringify(command)} builds ${entryPath}, whose root command is named ${JSON.stringify(snapshot.meta.name)}.\n  The installed command, help, man pages, and skills use the root command name, so new Crust(name) must match the bin key; rename one of them.`);
+			printBuildReport(command, report, io.stdout);
+			mergeEntryArtifacts(entryOutDir, plan.outDir, command, owners);
+			reports[command] = report;
+		} finally {
+			rmSync(entryOutDir, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	return reports;
+}
+const activeBuilds = /* @__PURE__ */ new Set();
+/**
+* Stages the publishable npm tree in `<cwd>/.crust`: a root package with one
+* `bin/<command>.js` per package.json `bin` entry, each a Node launcher (Bun,
+* Deno) or the bundle itself (Node), plus one platform package per target for
+* Bun and Deno holding one binary per command. Command names and source
+* entries come from `bin`; the runtime, Bun plugins, and extra directories
+* from package.json `crust`. Compilation and Command Snapshots run in bun
+* subprocesses (bun on PATH, or the running Bun executable), so this works
+* under Node as well when Bun is installed.
+*
+* Throws on any failure. Planning failures (bad options or package.json) leave
+* the previous `.crust/` stage untouched; failures after planning leave a
+* wiped stage without a completion `manifest.json`. Overlapping calls for the
+* same real project directory in this process are rejected before staging.
+*/
+async function build(options = {}) {
+	const cwd = resolve(options.cwd ?? process.cwd());
+	const project = realpathSync(cwd);
+	if (activeBuilds.has(project)) throw new Error(`crust build is already building ${project}`);
+	activeBuilds.add(project);
+	try {
+		const onLog = options.onLog ?? (() => {});
+		const io = {
+			stdout: (line) => onLog(line, "stdout"),
+			stderr: (line) => onLog(line, "stderr")
+		};
+		const plan = planBuild(options, cwd);
+		io.stdout(`${dim("Runtime:")} ${plan.runtime} ${dim(`(${plan.runtimeSource})`)}`);
+		rmSync(plan.stageDir, {
+			recursive: true,
+			force: true
+		});
+		const reports = plan.validate ? await prepareEntries(plan, io) : void 0;
+		const artifacts = await runStagedBuild(plan, io, reports);
+		return {
+			stageDir: plan.stageDir,
+			artifacts,
+			...reports ? { reports } : {}
+		};
+	} finally {
+		activeBuilds.delete(project);
+	}
+}
+defineCommand("build", { description: "Build your CLI for Bun, Deno, or Node" }, (command) => command.flags({
+	name: "target",
+	type: "string",
+	multiple: true,
+	description: `Canonical compiler target(s), or "${HOST_TARGET}" for this machine; repeatable. Omit to stage package.json crust.targets, or every Bun/Deno target`,
+	short: "t"
+}, {
+	name: "env-file",
+	type: "string",
+	multiple: true,
+	description: "Explicit env file(s) used for build-time constants; repeatable"
+}, {
+	name: "validate",
+	type: "boolean",
+	description: "Materialize command definitions before compiling; --no-validate also skips Extension build hooks",
+	default: true
+}, {
+	name: "minify",
+	type: "boolean",
+	description: "Minify the output (default for bun and node; unsupported for deno)"
+}).action(async ({ flags, stdout, stderr }) => {
+	await build({
+		cwd: process.cwd(),
+		targets: flags.target,
+		envFiles: flags["env-file"],
+		minify: flags.minify,
+		validate: flags.validate,
+		onLog: (line, stream) => (stream === "stderr" ? stderr : stdout)(line)
+	});
+}));
+//#endregion
+export { build };