@kitschpatrol/shared-config 8.12.1 → 8.13.1

package/skills/ksc-update/scripts/consumer-ranges.mjs

@@ -0,0 +1,127 @@
+/**
+ * Builds the consumer-range table for step 3: for every runtime dependency of
+ * every published workspace package, the declared range, the locked version,
+ * and the newest stable version the range allows with its publish time. Rows
+ * flag `ahead` when consumers can resolve something newer than the lockfile and
+ * `young` when that newest version is under 24 hours old at the run start, so
+ * it cannot be installed here and must be reviewed as consumer exposure.
+ *
+ * Range matching uses `pnpm view <name>@<range>`, so it honors the repository's
+ * registry settings. `catalog:` specifiers are reported with
+ * `needsManualReview` instead of being resolved.
+ *
+ * Usage: `node consumer-ranges.mjs [--run-start <iso-time>] >
+ * consumer-ranges.json`, run from the workspace root. A human-readable summary
+ * goes to stderr.
+ */
+import { join } from 'node:path'
+import process from 'node:process'
+import {
+	asString,
+	isRecord,
+	mapLimit,
+	MATURITY_MS,
+	pnpmJson,
+	pnpmView,
+	publishTimes,
+	readJson,
+} from './lib.mjs'
+
+const runStartIndex = process.argv.indexOf('--run-start')
+const runStartText = runStartIndex === -1 ? undefined : process.argv[runStartIndex + 1]
+const runStart = runStartText === undefined ? Date.now() : Date.parse(runStartText)
+if (Number.isNaN(runStart)) {
+	throw new TypeError(`Invalid --run-start value: ${runStartText}`)
+}
+
+/**
+ * @typedef {object} Task
+ * @property {string} package - Published workspace package name.
+ * @property {string} name - Dependency name as declared.
+ * @property {string} range - Declared specifier.
+ * @property {string | undefined} locked - Version in the lockfile.
+ */
+
+/** @type {Task[]} */
+const tasks = []
+const projects = pnpmJson(['-r', 'ls', '--depth', '0', '--prod', '--json'])
+if (!Array.isArray(projects)) {
+	throw new TypeError('Expected a JSON array from pnpm -r ls')
+}
+
+for (const project of projects) {
+	if (!isRecord(project) || project.private === true) {
+		continue
+	}
+
+	const projectPath = asString(project.path)
+	if (projectPath === undefined) {
+		continue
+	}
+
+	const manifest = readJson(join(projectPath, 'package.json'))
+	if (!isRecord(manifest) || manifest.private === true) {
+		continue
+	}
+
+	const packageName = asString(manifest.name) ?? projectPath
+	const declared = isRecord(manifest.dependencies) ? manifest.dependencies : {}
+	const installed = isRecord(project.dependencies) ? project.dependencies : {}
+	for (const [name, rangeValue] of Object.entries(declared)) {
+		const range = asString(rangeValue)
+		if (range === undefined || /^(?:workspace|link|file):/v.test(range)) {
+			continue
+		}
+
+		const entry = installed[name]
+		tasks.push({
+			locked: isRecord(entry) ? asString(entry.version) : undefined,
+			name,
+			package: packageName,
+			range,
+		})
+	}
+}
+
+const NPM_ALIAS_PATTERN = /^npm:(.+)@([^@]+)$/v
+
+const rows = await mapLimit(tasks, 8, async (task) => {
+	if (task.range.startsWith('catalog:')) {
+		return { ...task, needsManualReview: 'catalog specifier' }
+	}
+
+	const alias = NPM_ALIAS_PATTERN.exec(task.range)
+	const target = alias?.[1] ?? task.name
+	const range = alias?.[2] ?? task.range
+	const matched = await pnpmView([`${target}@${range}`, 'version'])
+	const versions = Array.isArray(matched) ? matched.map(String) : [asString(matched)]
+	const stable = versions.filter((version) => version !== undefined && !version.includes('-'))
+	const newestAllowed = stable.at(-1)
+	if (newestAllowed === undefined) {
+		return { ...task, needsManualReview: 'no stable version satisfies the range' }
+	}
+
+	const times = await publishTimes(target)
+	const time = times[newestAllowed]
+	const young = time === undefined ? undefined : Date.parse(time) > runStart - MATURITY_MS
+	return {
+		...task,
+		ahead: task.locked !== newestAllowed,
+		newestAllowed,
+		newestAllowedTime: time,
+		target: target === task.name ? undefined : target,
+		young,
+	}
+})
+
+process.stdout.write(`${JSON.stringify(rows, undefined, 2)}\n`)
+
+const flagged = rows.filter((row) => 'needsManualReview' in row || row.ahead)
+process.stderr.write(`${rows.length} runtime dependency entries checked\n`)
+for (const row of flagged) {
+	const detail =
+		'needsManualReview' in row
+			? `needs manual review: ${row.needsManualReview}`
+			: `locked ${row.locked ?? '?'} < newest allowed ${row.newestAllowed} (${row.newestAllowedTime ?? 'time unknown'}${row.young ? ', YOUNG' : ''})`
+	process.stderr.write(`  ${row.package} > ${row.name} ${row.range}: ${detail}\n`)
+}

package/skills/ksc-update/scripts/lib.mjs

@@ -0,0 +1,307 @@
+/**
+ * Shared helpers for the ksc-update scripts. Everything here uses only Node.js
+ * built-ins and the pnpm CLI so the scripts run in any repository without
+ * installing anything.
+ */
+import { execFile, execFileSync } from 'node:child_process'
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { isAbsolute, join } from 'node:path'
+import process from 'node:process'
+
+const NOT_FOUND_PATTERN = /E404|ERR_PNPM_NO_MATCHING_VERSION|not found/iv
+const TOP_LEVEL_LINE_PATTERN = /^\S/v
+const QUOTES_PATTERN = /^['"]|['"]$/gv
+const LOCKFILE_KEY_PATTERN = /^ {2}'?([^\s']+?)'?:$/v
+
+/** Milliseconds in the 24-hour maturity window. */
+export const MATURITY_MS = 24 * 60 * 60 * 1000
+
+/**
+ * Narrows an unknown JSON value to a plain object.
+ *
+ * @param {unknown} value - Any parsed JSON value.
+ *
+ * @returns {value is Record<string, unknown>} Whether the value is a non-array
+ *   object.
+ */
+export function isRecord(value) {
+	return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+/**
+ * Returns the value when it is a string.
+ *
+ * @param {unknown} value - Any parsed JSON value.
+ *
+ * @returns {string | undefined} The string, or undefined for any other type.
+ */
+export function asString(value) {
+	return typeof value === 'string' ? value : undefined
+}
+
+/**
+ * Resolves the run directory the skill uses for logs and state, creating it.
+ *
+ * @returns {string} The absolute path in `KSC_UPDATE_RUN_DIR`.
+ */
+export function runDirectory() {
+	const directory = process.env.KSC_UPDATE_RUN_DIR
+	if (directory === undefined || !isAbsolute(directory)) {
+		throw new Error('Set KSC_UPDATE_RUN_DIR to the absolute run directory created during Setup')
+	}
+
+	mkdirSync(directory, { recursive: true })
+	return directory
+}
+
+/**
+ * Reads and parses a JSON file, failing with the path in the message.
+ *
+ * @param {string} path - File to read.
+ *
+ * @returns {unknown} The parsed value.
+ */
+export function readJson(path) {
+	try {
+		return JSON.parse(readFileSync(path, 'utf8'))
+	} catch (error) {
+		throw new Error(`Could not read JSON from ${path}`, { cause: error })
+	}
+}
+
+/**
+ * Runs pnpm synchronously and parses its JSON stdout, dropping `[WARN]` lines
+ * that pnpm prints to stdout.
+ *
+ * @param {string[]} args - Arguments for pnpm.
+ * @param {string} [cwd] - Working directory.
+ *
+ * @returns {unknown} Parsed JSON output.
+ */
+export function pnpmJson(args, cwd) {
+	const stdout = execFileSync('pnpm', args, {
+		cwd,
+		encoding: 'utf8',
+		maxBuffer: 1024 ** 3,
+		stdio: ['ignore', 'pipe', 'pipe'],
+	})
+	return parsePnpmJson(stdout, args)
+}
+
+/**
+ * Parses pnpm stdout as JSON after removing `[WARN]` lines.
+ *
+ * @param {string} stdout - Raw pnpm output.
+ * @param {string[]} args - The pnpm arguments, for error messages.
+ *
+ * @returns {unknown} Parsed JSON, or undefined for empty output.
+ */
+function parsePnpmJson(stdout, args) {
+	const text = stdout
+		.split('\n')
+		.filter((line) => !line.startsWith('[WARN]'))
+		.join('\n')
+		.trim()
+	try {
+		return text === '' ? undefined : JSON.parse(text)
+	} catch (error) {
+		throw new Error(`pnpm ${args.join(' ')} did not print valid JSON`, { cause: error })
+	}
+}
+
+/**
+ * Runs `pnpm view` asynchronously and parses its JSON output. A missing package
+ * or an unsatisfiable range resolves to undefined instead of throwing.
+ *
+ * @param {string[]} args - Arguments after `pnpm view`.
+ *
+ * @returns {Promise<unknown>} Parsed JSON, or undefined when nothing matched.
+ */
+export async function pnpmView(args) {
+	const fullArgs = ['view', ...args, '--json']
+	/** @type {{ error: Error | null; stderr: string; stdout: string }} */
+	const { error, stderr, stdout } = await new Promise((resolve) => {
+		execFile('pnpm', fullArgs, { maxBuffer: 1024 ** 3 }, (failure, out, errorOutput) => {
+			resolve({ error: failure, stderr: errorOutput, stdout: out })
+		})
+	})
+	if (error === null) {
+		return parsePnpmJson(stdout, fullArgs)
+	}
+
+	if (NOT_FOUND_PATTERN.test(stderr)) {
+		return
+	}
+
+	throw new Error(`pnpm ${fullArgs.join(' ')} failed: ${stderr.trim()}`, { cause: error })
+}
+
+/**
+ * Returns a package's publish times from the registry, cached as JSON under
+ * `<run directory>/meta/` so reviewers and scripts share one fetch.
+ *
+ * @param {string} name - Package name.
+ *
+ * @returns {Promise<Record<string, string>>} Version to ISO publish time.
+ */
+export async function publishTimes(name) {
+	const directory = join(runDirectory(), 'meta')
+	mkdirSync(directory, { recursive: true })
+	const file = join(directory, `${name.replaceAll('/', '_')}.time.json`)
+	if (existsSync(file)) {
+		const cached = readJson(file)
+		if (isRecord(cached)) {
+			return toStringRecord(cached)
+		}
+	}
+
+	const times = await pnpmView([name, 'time'])
+	const record = isRecord(times) ? toStringRecord(times) : {}
+	writeFileSync(file, JSON.stringify(record))
+	return record
+}
+
+/**
+ * Keeps only the string-valued entries of an object.
+ *
+ * @param {Record<string, unknown>} value - Object to filter.
+ *
+ * @returns {Record<string, string>} The string entries.
+ */
+function toStringRecord(value) {
+	/** @type {Record<string, string>} */
+	const result = {}
+	for (const [key, entry] of Object.entries(value)) {
+		const text = asString(entry)
+		if (text !== undefined) {
+			result[key] = text
+		}
+	}
+
+	return result
+}
+
+/**
+ * Maps items through an async function with bounded concurrency, preserving
+ * order.
+ *
+ * @template T, R
+ * @param {T[]} items - Inputs.
+ * @param {number} limit - Maximum concurrent calls.
+ * @param {(item: T) => Promise<R>} worker - Async mapper.
+ *
+ * @returns {Promise<R[]>} Results in input order.
+ */
+export async function mapLimit(items, limit, worker) {
+	/** @type {R[]} */
+	const results = Array.from({ length: items.length })
+	let next = 0
+	const runners = Array.from({ length: Math.min(limit, items.length) }, async () => {
+		while (next < items.length) {
+			const index = next++
+
+			results[index] = await worker(/** @type {T} */ (items[index]))
+		}
+	})
+	await Promise.all(runners)
+	return results
+}
+
+/**
+ * Splits a `name@version` string, keeping the leading `@` of scoped names.
+ *
+ * @param {string} spec - A `name@version` string.
+ *
+ * @returns {{ name: string; version: string } | undefined} The parts, or
+ *   undefined when there is no version.
+ */
+export function splitSpec(spec) {
+	const at = spec.lastIndexOf('@')
+	return at <= 0 ? undefined : { name: spec.slice(0, at), version: spec.slice(at + 1) }
+}
+
+/**
+ * Lists the `name@version` keys of every `packages` section in a pnpm lockfile.
+ * Recent pnpm lockfiles hold several YAML documents, including one for the
+ * package manager's own dependencies, so all sections are read.
+ *
+ * @param {string} lockfilePath - Path to `pnpm-lock.yaml`.
+ *
+ * @returns {Set<string>} Package keys without quotes, excluding non-registry
+ *   entries such as `file:` and `link:` specifiers.
+ */
+export function lockedPackages(lockfilePath) {
+	const lines = readFileSync(lockfilePath, 'utf8').split('\n')
+	/** @type {Set<string>} */
+	const keys = new Set()
+	let inPackages = false
+	for (const line of lines) {
+		if (TOP_LEVEL_LINE_PATTERN.test(line)) {
+			inPackages = line === 'packages:'
+			continue
+		}
+
+		if (!inPackages) {
+			continue
+		}
+
+		const match = LOCKFILE_KEY_PATTERN.exec(line)
+		if (match?.[1] !== undefined && !match[1].includes(':')) {
+			keys.add(match[1])
+		}
+	}
+
+	if (keys.size === 0) {
+		throw new Error(`No package entries found in ${lockfilePath}`)
+	}
+
+	return keys
+}
+
+/**
+ * Reads a top-level string list from a YAML file without a YAML parser. Handles
+ * the block style pnpm and its fixers write: `key:` followed by ` - item`
+ * lines, with optional quotes and comments.
+ *
+ * @param {string} path - YAML file.
+ * @param {string} key - Top-level key.
+ *
+ * @returns {string[]} The list items, empty when the key is absent.
+ */
+export function readYamlList(path, key) {
+	if (!existsSync(path)) {
+		return []
+	}
+
+	const lines = readFileSync(path, 'utf8').split('\n')
+	const start = lines.indexOf(`${key}:`)
+	if (start === -1) {
+		if (lines.some((line) => line.startsWith(`${key}:`))) {
+			throw new Error(`${key} in ${path} is not a block list; read it by hand`)
+		}
+
+		return []
+	}
+
+	/** @type {string[]} */
+	const items = []
+	const following = lines.slice(start + 1)
+	for (const line of following) {
+		if (TOP_LEVEL_LINE_PATTERN.test(line)) {
+			break
+		}
+
+		const trimmed = line.trim()
+		if (!trimmed.startsWith('- ')) {
+			continue
+		}
+
+		const [value = ''] = trimmed.slice(2).split(' #', 1)
+		const item = value.trim().replaceAll(QUOTES_PATTERN, '')
+		if (item !== '') {
+			items.push(item)
+		}
+	}
+
+	return items
+}

package/skills/ksc-update/scripts/packed-fixture.mjs

@@ -0,0 +1,247 @@
+/**
+ * Creates an isolated consumer fixture for the packed-build checks in
+ * verification.md and installs it. It only sets up and installs; run the
+ * repository's representative CLI and API checks inside the printed fixture
+ * directory afterwards.
+ *
+ * Packed mode (default) runs `pnpm pack` for every published workspace package,
+ * depends on the requested packages through `file:` tarballs, and adds an
+ * `overrides` entry for every packed package. Packing rewrites `workspace:`
+ * ranges to registry versions, so without the overrides sibling packages would
+ * silently come from the registry instead of this build.
+ *
+ * Published mode (`--published`) depends on the given `name@version` specs from
+ * the registry instead, for the fresh-install check of the current release.
+ *
+ * `--before-install <command>` runs a shell command in the fixture before the
+ * install, for consumer setup that must exist first, such as an init command
+ * that writes hoisting settings. It receives `FIXTURE_TARBALLS`, the path of a
+ * JSON file mapping package names to tarball paths. If the command writes
+ * `pnpm-workspace.yaml`, the script appends its `overrides` and `allowBuilds`
+ * blocks only when those keys are absent, and fails otherwise.
+ *
+ * Usage, from the workspace root:
+ *
+ * ```
+ * node packed-fixture.mjs <state> [package...] [--before-install <command>]
+ * node packed-fixture.mjs <state> --published <name@version>... [--before-install <command>]
+ * ```
+ *
+ * Results go to `<run directory>/<state>/`: `fixture/`, `tarballs/`,
+ * `tarballs.json`, `packed-manifests.json`, `install.log`, and `install.exit`.
+ * Packages default to every published workspace package.
+ */
+import { execFileSync, spawnSync } from 'node:child_process'
+import {
+	appendFileSync,
+	existsSync,
+	mkdirSync,
+	readdirSync,
+	readFileSync,
+	realpathSync,
+	rmSync,
+	writeFileSync,
+} from 'node:fs'
+import { join, relative, resolve } from 'node:path'
+import process from 'node:process'
+import { asString, isRecord, pnpmJson, readJson, runDirectory } from './lib.mjs'
+
+const argv = process.argv.slice(2)
+const state = argv.shift()
+if (state === undefined || state.startsWith('--') || !/^[\w.\-]+$/v.test(state)) {
+	throw new Error(
+		'Usage: node packed-fixture.mjs <state> [package...] [--published] [--before-install <command>]',
+	)
+}
+
+let published = false
+/** @type {string | undefined} */
+let beforeInstall
+/** @type {string[]} */
+const requested = []
+for (let index = 0; index < argv.length; index++) {
+	const argument = argv[index] ?? ''
+	if (argument === '--published') {
+		published = true
+	} else if (argument === '--before-install') {
+		beforeInstall = argv[++index]
+	} else {
+		requested.push(argument)
+	}
+}
+
+const run = runDirectory()
+const stateDirectory = resolve(run, state)
+if (relative(run, stateDirectory).startsWith('..')) {
+	throw new Error(`State directory ${stateDirectory} escapes the run directory ${run}`)
+}
+
+const fixture = join(stateDirectory, 'fixture')
+const tarballDirectory = join(stateDirectory, 'tarballs')
+rmSync(fixture, { force: true, recursive: true })
+rmSync(tarballDirectory, { force: true, recursive: true })
+mkdirSync(fixture, { recursive: true })
+mkdirSync(tarballDirectory, { recursive: true })
+
+/** @type {Record<string, string>} */
+const tarballs = {}
+/** @type {Record<string, string>} */
+const dependencies = {}
+/** @type {Record<string, unknown>[]} */
+const manifests = []
+
+if (published) {
+	if (requested.length === 0) {
+		throw new Error('--published needs at least one name@version spec')
+	}
+
+	for (const spec of requested) {
+		const at = spec.lastIndexOf('@')
+		if (at <= 0) {
+			throw new Error(`Expected name@version, got ${spec}`)
+		}
+
+		dependencies[spec.slice(0, at)] = spec.slice(at + 1)
+	}
+} else {
+	const projects = pnpmJson(['-r', 'ls', '--depth', '-1', '--json'])
+	if (!Array.isArray(projects)) {
+		throw new TypeError('Expected a JSON array from pnpm -r ls')
+	}
+
+	for (const project of projects) {
+		const projectPath = isRecord(project) ? asString(project.path) : undefined
+		if (projectPath === undefined) {
+			continue
+		}
+
+		const manifest = readJson(join(projectPath, 'package.json'))
+		if (!isRecord(manifest) || manifest.private === true) {
+			continue
+		}
+
+		const name = asString(manifest.name)
+		if (name === undefined) {
+			continue
+		}
+
+		const before = new Set(readdirSync(tarballDirectory))
+		execFileSync('pnpm', ['pack', '--pack-destination', tarballDirectory], {
+			cwd: projectPath,
+			stdio: ['ignore', 'ignore', 'inherit'],
+		})
+		const created = readdirSync(tarballDirectory).find((file) => !before.has(file))
+		if (created === undefined) {
+			throw new Error(`pnpm pack produced no tarball for ${name}`)
+		}
+
+		tarballs[name] = join(tarballDirectory, created)
+		const packedManifest = execFileSync('tar', ['-xzOf', tarballs[name], 'package/package.json'], {
+			encoding: 'utf8',
+		})
+		const parsed = /** @type {unknown} */ (JSON.parse(packedManifest))
+		if (isRecord(parsed)) {
+			manifests.push({
+				bin: parsed.bin,
+				dependencies: parsed.dependencies,
+				engines: parsed.engines,
+				exports: parsed.exports,
+				files: execFileSync('tar', ['-tzf', tarballs[name]], { encoding: 'utf8' })
+					.split('\n')
+					.filter(Boolean)
+					.toSorted(),
+				name,
+				peerDependencies: parsed.peerDependencies,
+				sideEffects: parsed.sideEffects,
+				version: parsed.version,
+			})
+		}
+	}
+
+	const targets = requested.length > 0 ? requested : Object.keys(tarballs)
+	for (const name of targets) {
+		const tarball = tarballs[name]
+		if (tarball === undefined) {
+			throw new Error(`${name} is not a published workspace package`)
+		}
+
+		dependencies[name] = `file:${tarball}`
+	}
+}
+
+const tarballsJson = join(stateDirectory, 'tarballs.json')
+writeFileSync(tarballsJson, `${JSON.stringify(tarballs, undefined, 2)}\n`)
+writeFileSync(
+	join(stateDirectory, 'packed-manifests.json'),
+	`${JSON.stringify(manifests, undefined, 2)}\n`,
+)
+writeFileSync(
+	join(fixture, 'package.json'),
+	`${JSON.stringify({ dependencies, name: 'ksc-update-fixture', private: true, type: 'module', version: '0.0.0' }, undefined, 2)}\n`,
+)
+execFileSync('git', ['init', '-q'], { cwd: fixture })
+
+if (beforeInstall !== undefined) {
+	// eslint-disable-next-line ts/naming-convention -- Environment variable names are uppercase.
+	const fixtureEnvironment = { ...process.env, FIXTURE_TARBALLS: tarballsJson }
+	const result = spawnSync(beforeInstall, {
+		cwd: fixture,
+		env: fixtureEnvironment,
+		shell: true,
+		stdio: 'inherit',
+	})
+	if (result.status !== 0) {
+		throw new Error(`--before-install command exited with ${result.status ?? result.signal}`)
+	}
+}
+
+const workspaceFile = join(fixture, 'pnpm-workspace.yaml')
+const existing = existsSync(workspaceFile) ? readFileSync(workspaceFile, 'utf8') : ''
+/** @type {string[]} */
+const blocks = []
+const overrideLines = Object.entries(tarballs).map(([name, path]) => `  '${name}': file:${path}`)
+if (overrideLines.length > 0) {
+	if (/^overrides:/mv.test(existing)) {
+		throw new Error(`${workspaceFile} already has overrides; merge the tarball overrides by hand`)
+	}
+
+	blocks.push(['overrides:', ...overrideLines].join('\n'))
+}
+
+const repositoryWorkspace = existsSync('pnpm-workspace.yaml')
+	? readFileSync('pnpm-workspace.yaml', 'utf8')
+	: ''
+const allowBuilds = /^allowBuilds:\n((?: {2}.+\n)+)/mv.exec(repositoryWorkspace)?.[1]
+if (allowBuilds !== undefined && !/^allowBuilds:/mv.test(existing)) {
+	blocks.push(`allowBuilds:\n${allowBuilds.trimEnd()}`)
+}
+
+if (blocks.length > 0) {
+	appendFileSync(
+		workspaceFile,
+		`${existing === '' || existing.endsWith('\n') ? '' : '\n'}${blocks.join('\n')}\n`,
+	)
+}
+
+const install = spawnSync('pnpm', ['install'], { cwd: fixture, encoding: 'utf8' })
+writeFileSync(join(stateDirectory, 'install.log'), `${install.stdout}${install.stderr}`)
+writeFileSync(join(stateDirectory, 'install.exit'), `${install.status}\n`)
+
+/** @type {Record<string, string | undefined>} */
+const resolved = {}
+for (const name of Object.keys(dependencies)) {
+	const manifestPath = join(fixture, 'node_modules', name, 'package.json')
+	resolved[name] = existsSync(manifestPath)
+		? `${asString(/** @type {Record<string, unknown>} */ (readJson(manifestPath)).version)} at ${realpathSync(join(fixture, 'node_modules', name))}`
+		: undefined
+}
+
+process.stdout.write(
+	`${JSON.stringify({ fixture, installExit: install.status, resolved, stateDirectory }, undefined, 2)}\n`,
+)
+if (install.status !== 0) {
+	process.stderr.write(
+		`pnpm install failed in ${fixture}; see ${join(stateDirectory, 'install.log')}\n`,
+	)
+	process.exitCode = 1
+}