@jigging/jig 0.0.0 → 0.1.0-alpha.2

package/libexec/preparation/bun-native-preparation-worker.js

@@ -0,0 +1,388 @@
+// @bun
+// src/internal/bun-native-preparation-worker.ts
+import { spawn } from "child_process";
+import {
+  copyFile,
+  lstat,
+  mkdir,
+  opendir,
+  readFile,
+  rm,
+  writeFile
+} from "fs/promises";
+import { dirname, join } from "path";
+
+// src/internal/bun-native-lock-policy.ts
+function requirePrivateBunLockPolicy(value) {
+  const lock = ordinaryRecord(value);
+  const workspaces = ordinaryRecord(lock?.workspaces);
+  const rootWorkspace = ordinaryRecord(workspaces?.[""]);
+  const packages = ordinaryRecord(lock?.packages);
+  if (lock?.lockfileVersion !== 1 || workspaces === undefined || rootWorkspace === undefined || packages === undefined || Object.keys(workspaces).length !== 1 || lock.patchedDependencies !== undefined) {
+    throw new TypeError("unsupported Bun lock source");
+  }
+  for (const resolution of Object.values(packages)) {
+    if (!Array.isArray(resolution) || resolution.length !== 4 || !isExactRegistryResolution(resolution[0]) || typeof resolution[1] !== "string" || resolution[1] !== "" && resolution[1] !== "https://registry.npmjs.org" && resolution[1] !== "https://registry.npmjs.org/" || ordinaryRecord(resolution[2]) === undefined || !isExactIntegrity(resolution[3])) {
+      throw new TypeError("unsupported Bun lock source");
+    }
+  }
+}
+function isExactRegistryResolution(value) {
+  if (typeof value !== "string")
+    return false;
+  const separator = value.lastIndexOf("@");
+  if (separator < 1)
+    return false;
+  const name = value.slice(0, separator);
+  const version = value.slice(separator + 1);
+  const packageName = name.startsWith("@") ? /^@[a-z0-9][a-z0-9._~-]*\/[a-z0-9][a-z0-9._~-]*$/.test(name) : /^[a-z0-9][a-z0-9._~-]*$/.test(name);
+  return packageName && Buffer.byteLength(name) <= 214 && /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(version);
+}
+function isExactIntegrity(value) {
+  if (typeof value !== "string")
+    return false;
+  const match = /^(sha256|sha512)-([A-Za-z0-9+/]+={0,2})$/.exec(value);
+  if (match === null)
+    return false;
+  const bytes = Buffer.from(match[2], "base64");
+  const expectedBytes = match[1] === "sha256" ? 32 : 64;
+  return bytes.byteLength === expectedBytes && bytes.toString("base64") === match[2];
+}
+function ordinaryRecord(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype)
+    return;
+  return value;
+}
+
+// src/package/paths.ts
+var encoder = new TextEncoder;
+var PACKAGE_1_MAX_PATH_BYTES = 1024;
+
+// src/internal/bun-native-preparation-protocol.ts
+var MIB = 1024 * 1024;
+var MAX_JSON_BYTES_PER_PATH_BYTE = 6;
+var PRIVATE_BUN_PREPARATION_LIMITS = Object.freeze({
+  sourceFiles: 4096,
+  sourceBytes: 16 * MIB,
+  preparedFiles: 4096,
+  preparedBytes: 32 * MIB
+});
+function maximumPrivateBunFileMessageBytes(type, maximumFiles, maximumContentBytes) {
+  requireNonnegativeInteger(maximumFiles, "file count");
+  requireNonnegativeInteger(maximumContentBytes, "content bytes");
+  const emptyMessageBytes = Buffer.byteLength(JSON.stringify({ type, files: [] }));
+  const emptyFileBytes = Buffer.byteLength(JSON.stringify({ path: "", content: "" }));
+  const pathBytes = maximumFiles * PACKAGE_1_MAX_PATH_BYTES * MAX_JSON_BYTES_PER_PATH_BYTE;
+  const contentBytes = 4 * (Math.ceil(maximumContentBytes / 3) + maximumFiles);
+  const separators = Math.max(0, maximumFiles - 1);
+  const result = emptyMessageBytes + maximumFiles * emptyFileBytes + pathBytes + contentBytes + separators;
+  if (!Number.isSafeInteger(result))
+    throw new RangeError("Bun preparation message bound is too large");
+  return result;
+}
+var PRIVATE_BUN_SOURCE_MESSAGE_BYTES = maximumPrivateBunFileMessageBytes("source", PRIVATE_BUN_PREPARATION_LIMITS.sourceFiles, PRIVATE_BUN_PREPARATION_LIMITS.sourceBytes);
+var PRIVATE_BUN_PREPARED_MESSAGE_BYTES = maximumPrivateBunFileMessageBytes("prepared", PRIVATE_BUN_PREPARATION_LIMITS.preparedFiles, PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes);
+function privateBunMessageFits(bytes, maximum) {
+  return Number.isSafeInteger(bytes) && bytes >= 0 && bytes <= maximum;
+}
+function encodePrivateBunMessage(value) {
+  const json = JSON.stringify(value);
+  if (json === undefined)
+    throw new TypeError("Bun preparation message is not JSON-serializable");
+  return new TextEncoder().encode(`${json}
+`);
+}
+function requireNonnegativeInteger(value, label) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new TypeError(`${label} must be a nonnegative safe integer`);
+  }
+}
+
+// src/internal/bun-native-preparation-worker.ts
+var PACKAGE_ROOT = "/work/package";
+var CACHE_ROOT = "/work/cache";
+var PATH = /^(?!\/)(?!.*(?:^|\/)\.\.?(?:\/|$))(?!.*\/\/)[^\0]+$/;
+
+class WorkerFailure extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+var outputQueue = Promise.resolve();
+try {
+  const iterator = jsonLines(process.stdin, PRIVATE_BUN_SOURCE_MESSAGE_BYTES)[Symbol.asyncIterator]();
+  const first = await iterator.next();
+  if (first.done)
+    throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source is missing");
+  const source = requireSource(first.value);
+  if (!(await iterator.next()).done) {
+    throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source has trailing data");
+  }
+  await materializeSource(source.files);
+  await requireSupportedLock();
+  await install();
+  await verifySource(source.files);
+  const prepared = await capturePrepared();
+  await sendPrepared(prepared);
+  await outputQueue;
+} catch (error) {
+  const failure = error instanceof WorkerFailure ? error : new WorkerFailure("PACKAGE_BUN_PREPARATION_FAILED", "locked Bun dependency preparation failed");
+  await send({ type: "failure", code: failure.code, message: failure.message }).catch(() => {
+    return;
+  });
+  await outputQueue.catch(() => {
+    return;
+  });
+  process.exitCode = 1;
+}
+async function materializeSource(files) {
+  await mkdir(PACKAGE_ROOT, { recursive: true, mode: 448 });
+  for (const file of files) {
+    const bytes = decodeBase64(file.content, file.path);
+    const destination = join(PACKAGE_ROOT, ...file.path.split("/"));
+    await mkdir(dirname(destination), { recursive: true, mode: 448 });
+    await writeFile(destination, bytes, { mode: 384, flag: "wx" });
+  }
+}
+async function verifySource(files) {
+  for (const file of files) {
+    const expected = decodeBase64(file.content, file.path);
+    const actual = new Uint8Array(await readFile(join(PACKAGE_ROOT, ...file.path.split("/"))));
+    if (!Buffer.from(actual).equals(Buffer.from(expected))) {
+      throw new WorkerFailure("PACKAGE_BUN_SOURCE_CHANGED", "Bun preparation changed authored package bytes");
+    }
+  }
+}
+async function requireSupportedLock() {
+  const lockCopy = "/work/bun-lock.jsonc";
+  await copyFile(join(PACKAGE_ROOT, "bun.lock"), lockCopy);
+  let value;
+  try {
+    const result = await runChild([
+      "--no-env-file",
+      "--no-install",
+      "--config=/dev/null",
+      "-e",
+      "const value=(await import(process.argv[1])).default;process.stdout.write(JSON.stringify(value));",
+      lockCopy
+    ], {
+      cwd: "/work",
+      env: { LD_LIBRARY_PATH: "/jig-runtime/lib" }
+    }, 2 * 1024 * 1024, 64 * 1024);
+    if (result.exit !== 0 || result.stderr !== "")
+      throw new Error("lock parser failed");
+    value = JSON.parse(result.stdout);
+  } catch {
+    throw new WorkerFailure("PACKAGE_BUN_LOCK_INVALID", "bun.lock is not valid for the pinned Bun runtime");
+  }
+  try {
+    requirePrivateBunLockPolicy(value);
+  } catch {
+    unsupportedSource();
+  }
+}
+function unsupportedSource() {
+  throw new WorkerFailure("PACKAGE_BUN_SOURCE_UNSUPPORTED", "bun.lock contains a dependency source unsupported by this Jig alpha; only the default npm registry is supported");
+}
+async function install() {
+  const result = await runChild([
+    "--no-env-file",
+    "--config=/dev/null",
+    "install",
+    "--frozen-lockfile",
+    "--production",
+    "--ignore-scripts",
+    "--backend=copyfile",
+    "--linker=hoisted",
+    `--cache-dir=${CACHE_ROOT}`,
+    "--registry=https://registry.npmjs.org",
+    "--no-progress",
+    "--no-summary"
+  ], {
+    cwd: PACKAGE_ROOT,
+    env: {
+      LD_LIBRARY_PATH: "/jig-runtime/lib"
+    }
+  }, 64 * 1024, 64 * 1024);
+  if (result.exit !== 0) {
+    const output = `${result.stdout}
+${result.stderr}`;
+    if (/lockfile|frozen|package\.json/i.test(output)) {
+      throw new WorkerFailure("PACKAGE_BUN_LOCK_STALE", "package.json and bun.lock disagree; regenerate bun.lock with bun install --lockfile-only");
+    }
+    throw new WorkerFailure("PACKAGE_BUN_PREPARATION_FAILED", "the locked production dependencies could not be prepared by the pinned Bun runtime");
+  }
+  await rm(join(PACKAGE_ROOT, "node_modules", ".bin"), { recursive: true, force: true });
+}
+async function capturePrepared() {
+  const files = [];
+  let total = 0;
+  const visit = async (root, prefix) => {
+    const directory = await opendir(root);
+    const names = [];
+    for await (const entry of directory)
+      names.push(entry.name);
+    names.sort((left, right) => Buffer.from(left).compare(Buffer.from(right)));
+    for (const name of names) {
+      const path = prefix === "" ? name : `${prefix}/${name}`;
+      requirePath(path);
+      const physical = join(root, name);
+      const information = await lstat(physical);
+      if (information.isDirectory() && !information.isSymbolicLink()) {
+        await visit(physical, path);
+        continue;
+      }
+      if (!information.isFile() || information.isSymbolicLink() || information.nlink !== 1) {
+        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_UNSUPPORTED", "prepared dependencies contain a link or special file");
+      }
+      if (files.length >= PRIVATE_BUN_PREPARATION_LIMITS.preparedFiles) {
+        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree has too many files");
+      }
+      const bytes = new Uint8Array(await readFile(physical));
+      total += bytes.byteLength;
+      if (total > PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes) {
+        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree is too large");
+      }
+      files.push(Object.freeze({ path, content: Buffer.from(bytes).toString("base64") }));
+    }
+  };
+  await visit(PACKAGE_ROOT, "");
+  files.sort((left, right) => Buffer.from(left.path).compare(Buffer.from(right.path)));
+  return Object.freeze(files);
+}
+function requireSource(value) {
+  const root = ordinaryRecord2(value);
+  if (root?.type !== "source" || !Array.isArray(root.files) || root.files.length > PRIVATE_BUN_PREPARATION_LIMITS.sourceFiles) {
+    throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source is invalid");
+  }
+  const files = [];
+  let total = 0;
+  let prior;
+  for (const raw of root.files) {
+    const file = ordinaryRecord2(raw);
+    if (file === undefined || typeof file.path !== "string" || typeof file.content !== "string") {
+      throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source file is invalid");
+    }
+    requirePath(file.path);
+    if (prior !== undefined && Buffer.from(prior).compare(Buffer.from(file.path)) >= 0) {
+      throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source paths are not canonical");
+    }
+    prior = file.path;
+    const bytes = decodeBase64(file.content, file.path);
+    total += bytes.byteLength;
+    if (total > PRIVATE_BUN_PREPARATION_LIMITS.sourceBytes) {
+      throw new WorkerFailure("PACKAGE_BUN_INPUT_LIMIT", "locked Bun package is too large to prepare");
+    }
+    files.push(Object.freeze({ path: file.path, content: file.content }));
+  }
+  if (!files.some(({ path }) => path === "package.json") || !files.some(({ path }) => path === "bun.lock")) {
+    throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "locked Bun source is incomplete");
+  }
+  return Object.freeze({ files: Object.freeze(files) });
+}
+function requirePath(path) {
+  if (!PATH.test(path) || Buffer.byteLength(path) > 1024) {
+    throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source path is invalid");
+  }
+}
+function decodeBase64(value, label) {
+  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+    throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", `${label} has invalid encoded bytes`);
+  }
+  return new Uint8Array(Buffer.from(value, "base64"));
+}
+function ordinaryRecord2(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype)
+    return;
+  return value;
+}
+function send(value) {
+  return enqueue(encodePrivateBunMessage(value));
+}
+function enqueue(bytes) {
+  outputQueue = outputQueue.then(async () => {
+    if (!process.stdout.write(bytes))
+      await new Promise((resolve) => process.stdout.once("drain", resolve));
+  });
+  return outputQueue;
+}
+function sendPrepared(files) {
+  const bytes = encodePrivateBunMessage({ type: "prepared", files });
+  if (!privateBunMessageFits(bytes.byteLength - 1, PRIVATE_BUN_PREPARED_MESSAGE_BYTES)) {
+    throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree is too large");
+  }
+  return enqueue(bytes);
+}
+async function* jsonLines(source, maximum) {
+  let pending = [];
+  let pendingBytes = 0;
+  for await (const chunk of source) {
+    const bytes = Buffer.from(chunk);
+    let start = 0;
+    for (;; ) {
+      const end = bytes.indexOf(10, start);
+      if (end === -1)
+        break;
+      pending.push(bytes.subarray(start, end));
+      pendingBytes += end - start;
+      if (pendingBytes > maximum)
+        throw new Error("protocol line exceeds bound");
+      const line = pending.length === 1 ? pending[0] : Buffer.concat(pending, pendingBytes);
+      pending = [];
+      pendingBytes = 0;
+      yield JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(line));
+      start = end + 1;
+    }
+    if (start < bytes.byteLength) {
+      pending.push(bytes.subarray(start));
+      pendingBytes += bytes.byteLength - start;
+      if (pendingBytes > maximum)
+        throw new Error("protocol line exceeds bound");
+    }
+  }
+  if (pendingBytes !== 0)
+    throw new Error("protocol ended with a partial line");
+}
+async function collect(stream, maximum) {
+  if (stream === null)
+    return "";
+  let bytes = Buffer.alloc(0);
+  for await (const chunk of stream) {
+    bytes = Buffer.concat([bytes, Buffer.from(chunk)]);
+    if (bytes.byteLength > maximum)
+      throw new Error("preparation child diagnostic exceeds bound");
+  }
+  return bytes.toString("utf8");
+}
+async function runChild(arguments_, options, maximumStdout, maximumStderr) {
+  const child = spawn(process.execPath, [...arguments_], {
+    ...options,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const exit = childExit(child);
+  let settled = false;
+  try {
+    const [stdout, stderr, code] = await Promise.all([
+      collect(child.stdout, maximumStdout),
+      collect(child.stderr, maximumStderr),
+      exit
+    ]);
+    settled = true;
+    return Object.freeze({ stdout, stderr, exit: code });
+  } finally {
+    if (!settled) {
+      child.kill("SIGKILL");
+      await exit.catch(() => {
+        return;
+      });
+    }
+  }
+}
+function childExit(child) {
+  return new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("close", (code) => resolve(code));
+  });
+}

package/package.json

@@ -1,12 +1,74 @@
 {
   "name": "@jigging/jig",
-"version": "0.0.0",
-  "module": "index.ts",
+  "version": "0.1.0-alpha.2",
+  "description": "A local, secure host for admitted FLOW packages",
+  "license": "MPL-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jigmd/jig.git",
+    "directory": "packages/jig"
+  },
+  "homepage": "https://jig.md/",
+  "bugs": {
+    "url": "https://github.com/jigmd/jig/issues"
+  },
+  "os": [
+    "linux"
+  ],
+  "cpu": [
+    "x64"
+  ],
+  "libc": [
+    "glibc"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
   "type": "module",
-  "devDependencies": {
-    "@types/bun": "latest"
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
   },
-  "peerDependencies": {
-    "typescript": "^5"
+  "bin": {
+    "jig": "./bin/jig"
+  },
+  "files": [
+    "bin/jig",
+    "dist/index.js",
+    "dist/index.d.ts",
+    "dist/project/author.d.ts",
+    "dist/json.d.ts",
+    "libexec/installed-cli.js",
+    "libexec/linux-rootless-supervisor.js",
+    "libexec/evaluator/project-evaluator-worker.js",
+    "libexec/evaluator/project-evaluator-sdk.bundle.js",
+    "libexec/evaluator/project-authoring-1.schema.json",
+    "libexec/preparation/bun-native-preparation-worker.js",
+    "README.md",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES"
+  ],
+  "scripts": {
+    "verify:build-bun": "bun -e \"if (Bun.version !== '1.3.3' || Bun.revision !== '274e01c737e85f8142070a9745b43a2ba09fce4c') throw new Error('Jig must be built with exact Bun 1.3.3 revision 274e01c737e85f8142070a9745b43a2ba09fce4c')\"",
+    "build": "bun run verify:build-bun && bun run clean && mkdir -p bin libexec/evaluator libexec/preparation && cp scripts/installed-jig.sh bin/jig && chmod 755 bin/jig && bun node_modules/typescript/bin/tsc -p tsconfig.json && bun build src/index.ts --target=bun --format=esm --outfile=dist/index.js && bun build src/installed-cli.ts --target=bun --format=esm --outfile=libexec/installed-cli.js && bun build src/internal/linux-rootless-supervisor.ts --target=bun --format=esm --outfile=libexec/linux-rootless-supervisor.js && bun build src/internal/project-evaluator-worker.ts --target=bun --format=esm --outfile=libexec/evaluator/project-evaluator-worker.js && bun build src/internal/bun-native-preparation-worker.ts --target=bun --format=esm --outfile=libexec/preparation/bun-native-preparation-worker.js && bun build src/project/evaluator-sdk-entry.ts --target=bun --format=esm --outfile=libexec/evaluator/project-evaluator-sdk.bundle.js && cp ../../docs/jig/spec/machine/project-authoring-1.schema.json libexec/evaluator/project-authoring-1.schema.json",
+    "clean": "bun -e \"import { rm } from 'node:fs/promises'; for (const path of ['dist', 'bin', 'libexec']) await rm(path, { recursive: true, force: true })\"",
+    "prepack": "bun run build",
+    "test": "bun test",
+    "test:package": "bun run build && bun test/package-smoke.ts",
+    "test:linux-rootless:proof-host": "bun run build && JIG_LINUX_ROOTLESS_HOSTILE=1 bun test test/linux-rootless-delegation-hostile.test.ts --timeout 30000 && JIG_LINUX_ROOTLESS_HOSTILE=1 bun test test/linux-rootless-run.test.ts --timeout 30000 && JIG_LINUX_ROOTLESS_HOSTILE=1 bun test test/bun-native-preparation.test.ts --timeout 120000 && JIG_LINUX_ROOTLESS_HOSTILE=1 bun test test/private-foreground.test.ts --timeout 30000",
+    "check": "bun run build && bun test"
+  },
+  "dependencies": {
+    "@oven/bun-linux-x64-baseline": "1.3.3"
+  },
+  "devDependencies": {
+    "@types/node": "24.13.3",
+    "typescript": "7.0.2",
+    "yaml": "2.9.0"
   }
 }

package/bun.lock

@@ -1,26 +0,0 @@
-{
-  "lockfileVersion": 1,
-  "configVersion": 1,
-  "workspaces": {
-    "": {
-      "name": "jig",
-      "devDependencies": {
-        "@types/bun": "latest",
-      },
-      "peerDependencies": {
-        "typescript": "^5",
-      },
-    },
-  },
-  "packages": {
-    "@types/bun": ["@types/bun@1.4.0", "", { "dependencies": { "bun-types": "1.4.0" } }, "sha512-K+lZULY23vRgK/CfTjFIV+tyifaNdSMlPh9j+6mQ/cLfpOznLyAuzgV/JQysyECpkBQLVMSyvjlr2fBUSA9wFQ=="],
-
-    "@types/node": ["@types/node@26.4.1", "", { "dependencies": { "undici-types": "~8.3.0" } }, "sha512-k97ENvZWtvA6yqz5/FS6a7duDgOPEeOQOc2iKS/nY6mX6qJUKtLnWzQS+Xj6tXweyj6ZcTAK2Qecetnvi9nCLA=="],
-
-    "bun-types": ["bun-types@1.4.0", "", { "dependencies": { "@types/node": "*" } }, "sha512-iIKw23BspnQQYd3prITOBxeUsxBHnwzX6YJfGMuNOZzeNcMmVqzIIVGRm1l69ogaPQmb4wB6BN8mA5bE9YuC5Q=="],
-
-    "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
-
-    "undici-types": ["undici-types@8.3.0", "", {}, "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ=="],
-  }
-}

package/index.ts

@@ -1 +0,0 @@
-console.log("Hello via Bun!");

package/tsconfig.json

@@ -1,30 +0,0 @@
-{
-  "compilerOptions": {
-    // Environment setup & latest features
-    "lib": ["ESNext"],
-    "target": "ESNext",
-    "module": "Preserve",
-    "moduleDetection": "force",
-    "jsx": "react-jsx",
-    "allowJs": true,
-    "types": ["bun"],
-
-    // Bundler mode
-    "moduleResolution": "bundler",
-    "allowImportingTsExtensions": true,
-    "verbatimModuleSyntax": true,
-    "noEmit": true,
-
-    // Best practices
-    "strict": true,
-    "skipLibCheck": true,
-    "noFallthroughCasesInSwitch": true,
-    "noUncheckedIndexedAccess": true,
-    "noImplicitOverride": true,
-
-    // Some stricter flags (disabled by default)
-    "noUnusedLocals": false,
-    "noUnusedParameters": false,
-    "noPropertyAccessFromIndexSignature": false
-  }
-}