@skuba-lib/api 2.3.0 → 2.3.1-clanker-migrate-20260901033953

package/lib/buildkite/index.cjs

@@ -1,4 +1,4 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_buildkite = require("../buildkite-CM-xlOq5.cjs");
+const require_buildkite = require("../buildkite-z4owathk.cjs");
 exports.annotate = require_buildkite.annotate;
 exports.md = require_buildkite.md;

package/lib/buildkite/index.mjs

@@ -1,2 +1,2 @@
-import { n as md, r as annotate } from "../buildkite-B0gyBRNS.mjs";
+import { n as md, r as annotate } from "../buildkite-C7bwlxiU.mjs";
 export { annotate, md };

package/lib/{buildkite-B0gyBRNS.mjs → buildkite-C7bwlxiU.mjs}

@@ -1,9 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { t as log } from "./logging-BQNEupxh.mjs";
-import { n as exec, r as hasCommand } from "./exec-Dp89sakg.mjs";
+import { n as exec, r as hasCommand } from "./exec-Csi1HI7c.mjs";
 //#region src/buildkite/annotate.ts
 const isAnnotationEnabled = async () => Boolean(process.env.BUILDKITE && process.env.BUILDKITE_AGENT_ACCESS_TOKEN && process.env.BUILDKITE_JOB_ID && await hasCommand("buildkite-agent"));
-const MAX_SIZE = 1024 * 1024;
 const TRUNCATION_WARNING = "... [Truncated due to size limit]";
 /**
 * Asynchronously uploads a Buildkite annotation.
@@ -21,8 +20,7 @@ const annotate = async (markdown, opts = {}) => {
 	if (!await isAnnotationEnabled()) return;
 	let truncatedMarkdown = markdown;
 	if (markdown.length > 1048576) {
-		const remainingSpace = MAX_SIZE - 33;
-		truncatedMarkdown = markdown.slice(0, remainingSpace) + TRUNCATION_WARNING;
+		truncatedMarkdown = markdown.slice(0, 1048543) + TRUNCATION_WARNING;
 		log.warn(`Annotation truncated, full message is: ${markdown}`);
 	}
 	const context = [opts.scopeContextToStep && process.env.BUILDKITE_STEP_ID, opts.context].filter(Boolean).join("|");

package/lib/{buildkite-CM-xlOq5.cjs → buildkite-z4owathk.cjs}

@@ -1,9 +1,8 @@
-const require_rolldown_runtime = require("./rolldown-runtime-DakpK96I.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_logging = require("./logging-BqpzZfsF.cjs");
-const require_exec = require("./exec-BGMWpmZ7.cjs");
+const require_exec = require("./exec-DCUB5Shx.cjs");
 //#region src/buildkite/annotate.ts
 const isAnnotationEnabled = async () => Boolean(process.env.BUILDKITE && process.env.BUILDKITE_AGENT_ACCESS_TOKEN && process.env.BUILDKITE_JOB_ID && await require_exec.hasCommand("buildkite-agent"));
-const MAX_SIZE = 1024 * 1024;
 const TRUNCATION_WARNING = "... [Truncated due to size limit]";
 /**
 * Asynchronously uploads a Buildkite annotation.
@@ -21,8 +20,7 @@ const annotate = async (markdown, opts = {}) => {
 	if (!await isAnnotationEnabled()) return;
 	let truncatedMarkdown = markdown;
 	if (markdown.length > 1048576) {
-		const remainingSpace = MAX_SIZE - 33;
-		truncatedMarkdown = markdown.slice(0, remainingSpace) + TRUNCATION_WARNING;
+		truncatedMarkdown = markdown.slice(0, 1048543) + TRUNCATION_WARNING;
 		require_logging.log.warn(`Annotation truncated, full message is: ${markdown}`);
 	}
 	const context = [opts.scopeContextToStep && process.env.BUILDKITE_STEP_ID, opts.context].filter(Boolean).join("|");

package/lib/cdk/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region src/cdk/index.ts
-var cdk_exports = /* @__PURE__ */ require("../rolldown-runtime-DakpK96I.cjs").__exportAll({ normaliseTemplate: () => normaliseTemplate });
-const normaliseTemplateJsonString = (json) => json.replace(/"S3Key":"([0-9a-f]+)\.zip"/g, (_, hash) => `"S3Key":"${"x".repeat(hash.length)}.zip"`).replace(/workerCurrentVersion([0-9a-zA-Z]+)"/g, (_, hash) => `workerCurrentVersion${"x".repeat(hash.length)}"`).replaceAll(/"Value":"\d+\.\d+\.\d+-([^"]+)"/g, (_, hash) => `"Value": "x.x.x-${"x".repeat(hash.length)}"`).replaceAll(/"Value":"v\d+\.\d+\.\d+"/g, (_) => "\"Value\": \"vx.x.x\"").replace(/"DD_TAGS":"git.commit.sha:([0-9a-f]+),git.repository_url:([^\"]+)",/g, "").replaceAll(/(layer:Datadog-[^-]+-.+?:)\d+/g, (_, layer) => `${layer}x`);
+var cdk_exports = /* @__PURE__ */ require("../rolldown-runtime-C0BPl7ul.cjs").__exportAll({ normaliseTemplate: () => normaliseTemplate });
+const normaliseTemplateJsonString = (json) => json.replace(/"S3Key":"([0-9a-f]+)\.zip"/g, (_, hash) => `"S3Key":"${"x".repeat(hash.length)}.zip"`).replace(/CurrentVersion([0-9a-zA-Z]+)"/g, (_, hash) => `CurrentVersion${"x".repeat(hash.length)}"`).replaceAll(/"Value":"\d+\.\d+\.\d+-([^"]+)"/g, (_, hash) => `"Value": "x.x.x-${"x".repeat(hash.length)}"`).replaceAll(/"Value":"v\d+\.\d+\.\d+"/g, (_) => "\"Value\": \"vx.x.x\"").replace(/"DD_TAGS":"git.commit.sha:([0-9a-f]+),git.repository_url:([^\"]+)",/g, "").replaceAll(/(layer:Datadog-[^-]+-.+?:)\d+/g, (_, layer) => `${layer}x`);
 const normaliseTemplate = (template) => JSON.parse(normaliseTemplateJsonString(JSON.stringify(template)));
 //#endregion
 Object.defineProperty(exports, "cdk_exports", {

package/lib/cdk/index.mjs

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
 //#region src/cdk/index.ts
 var cdk_exports = /* @__PURE__ */ __exportAll({ normaliseTemplate: () => normaliseTemplate });
-const normaliseTemplateJsonString = (json) => json.replace(/"S3Key":"([0-9a-f]+)\.zip"/g, (_, hash) => `"S3Key":"${"x".repeat(hash.length)}.zip"`).replace(/workerCurrentVersion([0-9a-zA-Z]+)"/g, (_, hash) => `workerCurrentVersion${"x".repeat(hash.length)}"`).replaceAll(/"Value":"\d+\.\d+\.\d+-([^"]+)"/g, (_, hash) => `"Value": "x.x.x-${"x".repeat(hash.length)}"`).replaceAll(/"Value":"v\d+\.\d+\.\d+"/g, (_) => "\"Value\": \"vx.x.x\"").replace(/"DD_TAGS":"git.commit.sha:([0-9a-f]+),git.repository_url:([^\"]+)",/g, "").replaceAll(/(layer:Datadog-[^-]+-.+?:)\d+/g, (_, layer) => `${layer}x`);
+const normaliseTemplateJsonString = (json) => json.replace(/"S3Key":"([0-9a-f]+)\.zip"/g, (_, hash) => `"S3Key":"${"x".repeat(hash.length)}.zip"`).replace(/CurrentVersion([0-9a-zA-Z]+)"/g, (_, hash) => `CurrentVersion${"x".repeat(hash.length)}"`).replaceAll(/"Value":"\d+\.\d+\.\d+-([^"]+)"/g, (_, hash) => `"Value": "x.x.x-${"x".repeat(hash.length)}"`).replaceAll(/"Value":"v\d+\.\d+\.\d+"/g, (_) => "\"Value\": \"vx.x.x\"").replace(/"DD_TAGS":"git.commit.sha:([0-9a-f]+),git.repository_url:([^\"]+)",/g, "").replaceAll(/(layer:Datadog-[^-]+-.+?:)\d+/g, (_, layer) => `${layer}x`);
 const normaliseTemplate = (template) => JSON.parse(normaliseTemplateJsonString(JSON.stringify(template)));
 //#endregion
 export { normaliseTemplate, cdk_exports as t };

package/lib/{error-BSBcaHO0.cjs → error-CzNs0bXO.cjs}

@@ -1,4 +1,4 @@
-const require_rolldown_runtime = require("./rolldown-runtime-DakpK96I.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 require("util");
 let zod_v4 = require("zod/v4");
 zod_v4 = require_rolldown_runtime.__toESM(zod_v4, 1);

package/lib/{exec-Dp89sakg.mjs → exec-Csi1HI7c.mjs}

@@ -40,7 +40,6 @@ const runCommand = (command, args, { streamStdio, ...execaOptions } = {}) => {
 		case true:
 			subprocess.stderr?.pipe(process.stderr);
 			subprocess.stdout?.pipe(process.stdout);
-			break;
 	}
 	return subprocess;
 };

package/lib/{exec-BGMWpmZ7.cjs → exec-DCUB5Shx.cjs}

@@ -1,5 +1,5 @@
-const require_rolldown_runtime = require("./rolldown-runtime-DakpK96I.cjs");
-const require_error = require("./error-BSBcaHO0.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_error = require("./error-CzNs0bXO.cjs");
 let stream = require("stream");
 stream = require_rolldown_runtime.__toESM(stream, 1);
 let util = require("util");
@@ -44,7 +44,6 @@ const runCommand = (command, args, { streamStdio, ...execaOptions } = {}) => {
 		case true:
 			subprocess.stderr?.pipe(process.stderr);
 			subprocess.stdout?.pipe(process.stdout);
-			break;
 	}
 	return subprocess;
 };

package/lib/fs-BrQNZY8y.mjs

@@ -0,0 +1,14 @@
+import { t as isErrorWithCode } from "./error-CxiNRw9A.mjs";
+import fs from "fs-extra";
+//#region ../../src/utils/fs.ts
+const pathExists = async (filePath) => {
+	try {
+		await fs.promises.access(filePath);
+		return true;
+	} catch (error) {
+		if (isErrorWithCode(error, "ENOENT")) return false;
+		throw error;
+	}
+};
+//#endregion
+export { pathExists as t };

package/lib/fs-DS2eIMxA.cjs

@@ -0,0 +1,21 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_error = require("./error-CzNs0bXO.cjs");
+let fs_extra = require("fs-extra");
+fs_extra = require_rolldown_runtime.__toESM(fs_extra, 1);
+//#region ../../src/utils/fs.ts
+const pathExists = async (filePath) => {
+	try {
+		await fs_extra.default.promises.access(filePath);
+		return true;
+	} catch (error) {
+		if (require_error.isErrorWithCode(error, "ENOENT")) return false;
+		throw error;
+	}
+};
+//#endregion
+Object.defineProperty(exports, "pathExists", {
+	enumerable: true,
+	get: function() {
+		return pathExists;
+	}
+});

package/lib/git/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_git = require("../git-BeGqD0KV.cjs");
+const require_git = require("../git-DMONyZI2.cjs");
 exports.commit = require_git.commit;
 exports.commitAllChanges = require_git.commitAllChanges;
 exports.currentBranch = require_git.currentBranch;

package/lib/git/index.mjs

@@ -1,2 +1,2 @@
-import { a as push, d as getHeadCommitMessage, f as currentBranch, g as commit, h as findRoot, i as fastForwardBranch, l as getOwnerAndRepo, m as getChangedFiles, n as isFileGitIgnored, p as commitAllChanges, r as reset, u as getHeadCommitId } from "../git-DyhV01cl.mjs";
+import { a as push, d as getHeadCommitMessage, f as currentBranch, g as commit, h as findRoot, i as fastForwardBranch, l as getOwnerAndRepo, m as getChangedFiles, n as isFileGitIgnored, p as commitAllChanges, r as reset, u as getHeadCommitId } from "../git-DKqd7R1V.mjs";
 export { commit, commitAllChanges, currentBranch, fastForwardBranch, findRoot, getChangedFiles, getHeadCommitId, getHeadCommitMessage, getOwnerAndRepo, isFileGitIgnored, push, reset };

package/lib/{git-DyhV01cl.mjs → git-DKqd7R1V.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { t as isErrorWithCode } from "./error-CxiNRw9A.mjs";
+import { t as pathExists } from "./fs-BrQNZY8y.mjs";
 import fs from "fs-extra";
 import git, { findRoot } from "isomorphic-git";
 import path from "path";
@@ -34,17 +34,6 @@ const findRoot$1 = async ({ dir }) => {
 	}
 };
 //#endregion
-//#region ../../src/utils/fs.ts
-const pathExists = async (filePath) => {
-	try {
-		await fs.promises.access(filePath);
-		return true;
-	} catch (error) {
-		if (isErrorWithCode(error, "ENOENT")) return false;
-		throw error;
-	}
-};
-//#endregion
 //#region src/git/getChangedFiles.ts
 const mapState = (row) => {
 	if (row[1] === 0) return "added";

package/lib/{git-BeGqD0KV.cjs → git-DMONyZI2.cjs}

@@ -1,5 +1,5 @@
-const require_rolldown_runtime = require("./rolldown-runtime-DakpK96I.cjs");
-const require_error = require("./error-BSBcaHO0.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_fs = require("./fs-DS2eIMxA.cjs");
 let fs_extra = require("fs-extra");
 fs_extra = require_rolldown_runtime.__toESM(fs_extra, 1);
 let isomorphic_git = require("isomorphic-git");
@@ -39,17 +39,6 @@ const findRoot$1 = async ({ dir }) => {
 	}
 };
 //#endregion
-//#region ../../src/utils/fs.ts
-const pathExists = async (filePath) => {
-	try {
-		await fs_extra.default.promises.access(filePath);
-		return true;
-	} catch (error) {
-		if (require_error.isErrorWithCode(error, "ENOENT")) return false;
-		throw error;
-	}
-};
-//#endregion
 //#region src/git/getChangedFiles.ts
 const mapState = (row) => {
 	if (row[1] === 0) return "added";
@@ -140,7 +129,7 @@ const getChangedFilesFromRefs = async ({ dir, src, dst }) => {
 const createIsLfsFilter = async (gitRoot) => {
 	if (!gitRoot) return () => false;
 	const lfsFile = `${gitRoot}/.gitattributes`;
-	if (!await pathExists(lfsFile)) return () => false;
+	if (!await require_fs.pathExists(lfsFile)) return () => false;
 	const filter = (0, ignore.default)().add((await fs_extra.default.promises.readFile(lfsFile, "utf8")).split("\n").map((l) => l.trim()).filter((l) => !l.startsWith("#") && l.includes("filter=lfs")).map((l) => l.split(/\s+/)[0]).flatMap((l) => l ? [l] : []));
 	return (pathname) => filter.ignores(pathname);
 };

package/lib/github/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_git = require("../git-BeGqD0KV.cjs");
-const require_github = require("../github-C91l-j0Z.cjs");
+const require_git = require("../git-DMONyZI2.cjs");
+const require_github = require("../github-AhCiyYZt.cjs");
 exports.apiTokenFromEnvironment = require_git.apiTokenFromEnvironment;
 exports.buildNameFromEnvironment = require_git.buildNameFromEnvironment;
 exports.createCheckRun = require_github.createCheckRun;

package/lib/github/index.mjs

@@ -1,3 +1,3 @@
-import { c as enabledFromEnvironment, o as apiTokenFromEnvironment, s as buildNameFromEnvironment } from "../git-DyhV01cl.mjs";
-import { a as putIssueComment, i as uploadFileChanges, n as readFileChanges, o as getPullRequestNumber, r as uploadAllFileChanges, s as createCheckRun } from "../github-CmHDTIHw.mjs";
+import { c as enabledFromEnvironment, o as apiTokenFromEnvironment, s as buildNameFromEnvironment } from "../git-DKqd7R1V.mjs";
+import { a as putIssueComment, i as uploadFileChanges, n as readFileChanges, o as getPullRequestNumber, r as uploadAllFileChanges, s as createCheckRun } from "../github-DsrERrG3.mjs";
 export { apiTokenFromEnvironment, buildNameFromEnvironment, createCheckRun, enabledFromEnvironment, getPullRequestNumber, putIssueComment, readFileChanges, uploadAllFileChanges, uploadFileChanges };

package/lib/{github-C91l-j0Z.cjs → github-AhCiyYZt.cjs}

@@ -1,6 +1,6 @@
-const require_rolldown_runtime = require("./rolldown-runtime-DakpK96I.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_logging = require("./logging-BqpzZfsF.cjs");
-const require_git = require("./git-BeGqD0KV.cjs");
+const require_git = require("./git-DMONyZI2.cjs");
 let fs_extra = require("fs-extra");
 fs_extra = require_rolldown_runtime.__toESM(fs_extra, 1);
 let path = require("path");
@@ -213,6 +213,19 @@ const uploadFileChanges = async ({ dir, branch, messageHeadline, messageBody, fi
 	const authToken = require_git.apiTokenFromEnvironment();
 	if (!authToken) throw new Error("Could not read a GitHub API token from the environment. Please set GITHUB_API_TOKEN or GITHUB_TOKEN.");
 	const [{ owner, repo }, headCommitId] = await Promise.all([require_git.getOwnerAndRepo({ dir }), require_git.getHeadCommitId({ dir })]);
+	const input = {
+		branch: {
+			repositoryNameWithOwner: `${owner}/${repo}`,
+			branchName: branch
+		},
+		message: {
+			headline: messageHeadline,
+			body: messageBody
+		},
+		expectedHeadOid: headCommitId,
+		clientMutationId: "skuba",
+		fileChanges
+	};
 	return (await graphql(`
       mutation Mutation($input: CreateCommitOnBranchInput!) {
         createCommitOnBranch(input: $input) {
@@ -222,19 +235,7 @@ const uploadFileChanges = async ({ dir, branch, messageHeadline, messageBody, fi
         }
       }
     `, {
-		input: {
-			branch: {
-				repositoryNameWithOwner: `${owner}/${repo}`,
-				branchName: branch
-			},
-			message: {
-				headline: messageHeadline,
-				body: messageBody
-			},
-			expectedHeadOid: headCommitId,
-			clientMutationId: "skuba",
-			fileChanges
-		},
+		input,
 		headers: { authorization: `Bearer ${authToken}` }
 	})).createCommitOnBranch.commit.oid;
 };

package/lib/{github-CmHDTIHw.mjs → github-DsrERrG3.mjs}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { n as pluralise } from "./logging-BQNEupxh.mjs";
-import { c as enabledFromEnvironment, h as findRoot, i as fastForwardBranch, l as getOwnerAndRepo, m as getChangedFiles, o as apiTokenFromEnvironment, s as buildNameFromEnvironment, u as getHeadCommitId } from "./git-DyhV01cl.mjs";
+import { c as enabledFromEnvironment, h as findRoot, i as fastForwardBranch, l as getOwnerAndRepo, m as getChangedFiles, o as apiTokenFromEnvironment, s as buildNameFromEnvironment, u as getHeadCommitId } from "./git-DKqd7R1V.mjs";
 import fs from "fs-extra";
 import path from "path";
 //#region src/github/octokit.ts
@@ -96,7 +96,8 @@ const getUserId = async (client) => {
 const putIssueComment = async (params) => {
 	if (params.body === null && !params.internalId) throw new Error("Cannot remove comment without an internalId");
 	const env = params.env ?? process.env;
-	const { owner, repo } = await getOwnerAndRepo({ dir: process.cwd() });
+	const dir = process.cwd();
+	const { owner, repo } = await getOwnerAndRepo({ dir });
 	const client = await createRestClient({ auth: apiTokenFromEnvironment() });
 	const issueNumber = params.issueNumber ?? await getPullRequestNumber({
 		client,
@@ -210,6 +211,19 @@ const uploadFileChanges = async ({ dir, branch, messageHeadline, messageBody, fi
 	const authToken = apiTokenFromEnvironment();
 	if (!authToken) throw new Error("Could not read a GitHub API token from the environment. Please set GITHUB_API_TOKEN or GITHUB_TOKEN.");
 	const [{ owner, repo }, headCommitId] = await Promise.all([getOwnerAndRepo({ dir }), getHeadCommitId({ dir })]);
+	const input = {
+		branch: {
+			repositoryNameWithOwner: `${owner}/${repo}`,
+			branchName: branch
+		},
+		message: {
+			headline: messageHeadline,
+			body: messageBody
+		},
+		expectedHeadOid: headCommitId,
+		clientMutationId: "skuba",
+		fileChanges
+	};
 	return (await graphql(`
       mutation Mutation($input: CreateCommitOnBranchInput!) {
         createCommitOnBranch(input: $input) {
@@ -219,19 +233,7 @@ const uploadFileChanges = async ({ dir, branch, messageHeadline, messageBody, fi
         }
       }
     `, {
-		input: {
-			branch: {
-				repositoryNameWithOwner: `${owner}/${repo}`,
-				branchName: branch
-			},
-			message: {
-				headline: messageHeadline,
-				body: messageBody
-			},
-			expectedHeadOid: headCommitId,
-			clientMutationId: "skuba",
-			fileChanges
-		},
+		input,
 		headers: { authorization: `Bearer ${authToken}` }
 	})).createCommitOnBranch.commit.oid;
 };

package/lib/index-BKHTGdUP.d.cts

@@ -0,0 +1,97 @@
+import { Plugin } from "rolldown";
+//#region src/rolldown/lambdaAsset.d.ts
+interface LambdaAssetFile {
+  /**
+   * Path to the file or directory to copy, resolved relative to `projectRoot`.
+   */
+  from: string;
+  /**
+   * Destination path relative to the output directory.
+   *
+   * Defaults to the basename of `from`, placing it at the top of the output
+   * directory.
+   */
+  to?: string;
+}
+interface LambdaAssetOptions {
+  /**
+   * npm packages to install into the output directory rather than embed in the
+   * bundle.
+   *
+   * Versions are resolved from the copy installed under `projectRoot`. Mark
+   * these packages `external` in your rolldown config too, otherwise they will
+   * be bundled _and_ installed.
+   *
+   * Packages with native binaries (e.g. `sharp`) are the usual candidates.
+   */
+  nodeModules?: string[];
+  /**
+   * Extra files or directories to copy into the output directory alongside the
+   * bundle, e.g. static assets or configuration the handler reads at runtime.
+   *
+   * Each `from` is resolved relative to `projectRoot`; each `to` defaults to
+   * the basename of `from` and is resolved relative to the output directory.
+   */
+  assets?: LambdaAssetFile[];
+  /**
+   * Directory that `nodeModules` versions are resolved from, and that `assets`
+   * are copied from.
+   *
+   * This is the directory holding the `package.json` that depends on them; in a
+   * workspace, that is the individual package rather than the workspace root.
+   *
+   * Relative paths resolve against rolldown's `cwd`, which defaults to
+   * `process.cwd()`.
+   */
+  projectRoot?: string;
+  /**
+   * Path to the `pnpm-lock.yaml` to install against.
+   *
+   * pnpm keeps this at the workspace root, so its directory is also where the
+   * workspace config and patches are staged from.
+   *
+   * Defaults to the nearest lock file, walking up from rolldown's `cwd`, which
+   * defaults to `process.cwd()`. A relative path resolves against that `cwd`.
+   */
+  depsLockFilePath?: string;
+}
+/**
+ * Prepares a rolldown output directory for deployment as a Lambda asset.
+ *
+ * The plugin supports ESM output and pnpm only. It makes no assumptions about
+ * how you bundle; it only augments what rolldown has already written:
+ *
+ * 1. Emits any extra `assets` into the build output alongside the bundle, via
+ *    rolldown's `emitFile`.
+ * 2. Writes a `package.json` of `type: 'module'`.
+ * 3. Installs `nodeModules` into the output directory with pnpm, staging the
+ *    workspace config, `.npmrc`, lock file and patches to do so.
+ * 4. Strips those install-only files back out, leaving the bundle, the
+ *    generated `package.json` and `node_modules`.
+ *
+ * The result can be handed to CDK as `aws_lambda.Code.fromAsset(outputDir)`.
+ *
+ * @example
+ * ```js
+ * // rolldown.config.mjs
+ * import { Rolldown } from 'skuba';
+ *
+ * export default {
+ *   input: { index: 'src/lambda.ts' },
+ *   output: { dir: 'lib' },
+ *   external: ['sharp'],
+ *   plugins: [
+ *     Rolldown.lambdaAsset({
+ *       nodeModules: ['sharp'],
+ *       assets: [{ from: 'src/config.json' }],
+ *     }),
+ *   ],
+ * };
+ * ```
+ */
+declare const lambdaAsset: ({ nodeModules, assets, projectRoot: projectRootOption, depsLockFilePath: depsLockFilePathOption }?: LambdaAssetOptions) => Plugin;
+declare namespace index_d_exports {
+  export { LambdaAssetFile, LambdaAssetOptions, lambdaAsset };
+}
+//#endregion
+export { lambdaAsset as i, LambdaAssetFile as n, LambdaAssetOptions as r, index_d_exports as t };

package/lib/index-BKHTGdUP.d.mts

@@ -0,0 +1,97 @@
+import { Plugin } from "rolldown";
+//#region src/rolldown/lambdaAsset.d.ts
+interface LambdaAssetFile {
+  /**
+   * Path to the file or directory to copy, resolved relative to `projectRoot`.
+   */
+  from: string;
+  /**
+   * Destination path relative to the output directory.
+   *
+   * Defaults to the basename of `from`, placing it at the top of the output
+   * directory.
+   */
+  to?: string;
+}
+interface LambdaAssetOptions {
+  /**
+   * npm packages to install into the output directory rather than embed in the
+   * bundle.
+   *
+   * Versions are resolved from the copy installed under `projectRoot`. Mark
+   * these packages `external` in your rolldown config too, otherwise they will
+   * be bundled _and_ installed.
+   *
+   * Packages with native binaries (e.g. `sharp`) are the usual candidates.
+   */
+  nodeModules?: string[];
+  /**
+   * Extra files or directories to copy into the output directory alongside the
+   * bundle, e.g. static assets or configuration the handler reads at runtime.
+   *
+   * Each `from` is resolved relative to `projectRoot`; each `to` defaults to
+   * the basename of `from` and is resolved relative to the output directory.
+   */
+  assets?: LambdaAssetFile[];
+  /**
+   * Directory that `nodeModules` versions are resolved from, and that `assets`
+   * are copied from.
+   *
+   * This is the directory holding the `package.json` that depends on them; in a
+   * workspace, that is the individual package rather than the workspace root.
+   *
+   * Relative paths resolve against rolldown's `cwd`, which defaults to
+   * `process.cwd()`.
+   */
+  projectRoot?: string;
+  /**
+   * Path to the `pnpm-lock.yaml` to install against.
+   *
+   * pnpm keeps this at the workspace root, so its directory is also where the
+   * workspace config and patches are staged from.
+   *
+   * Defaults to the nearest lock file, walking up from rolldown's `cwd`, which
+   * defaults to `process.cwd()`. A relative path resolves against that `cwd`.
+   */
+  depsLockFilePath?: string;
+}
+/**
+ * Prepares a rolldown output directory for deployment as a Lambda asset.
+ *
+ * The plugin supports ESM output and pnpm only. It makes no assumptions about
+ * how you bundle; it only augments what rolldown has already written:
+ *
+ * 1. Emits any extra `assets` into the build output alongside the bundle, via
+ *    rolldown's `emitFile`.
+ * 2. Writes a `package.json` of `type: 'module'`.
+ * 3. Installs `nodeModules` into the output directory with pnpm, staging the
+ *    workspace config, `.npmrc`, lock file and patches to do so.
+ * 4. Strips those install-only files back out, leaving the bundle, the
+ *    generated `package.json` and `node_modules`.
+ *
+ * The result can be handed to CDK as `aws_lambda.Code.fromAsset(outputDir)`.
+ *
+ * @example
+ * ```js
+ * // rolldown.config.mjs
+ * import { Rolldown } from 'skuba';
+ *
+ * export default {
+ *   input: { index: 'src/lambda.ts' },
+ *   output: { dir: 'lib' },
+ *   external: ['sharp'],
+ *   plugins: [
+ *     Rolldown.lambdaAsset({
+ *       nodeModules: ['sharp'],
+ *       assets: [{ from: 'src/config.json' }],
+ *     }),
+ *   ],
+ * };
+ * ```
+ */
+declare const lambdaAsset: ({ nodeModules, assets, projectRoot: projectRootOption, depsLockFilePath: depsLockFilePathOption }?: LambdaAssetOptions) => Plugin;
+declare namespace index_d_exports {
+  export { LambdaAssetFile, LambdaAssetOptions, lambdaAsset };
+}
+//#endregion
+export { lambdaAsset as i, LambdaAssetFile as n, LambdaAssetOptions as r, index_d_exports as t };

package/lib/index.cjs

@@ -1,9 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_buildkite = require("./buildkite-CM-xlOq5.cjs");
+const require_buildkite = require("./buildkite-z4owathk.cjs");
 const require_cdk_index = require("./cdk/index.cjs");
-const require_git = require("./git-BeGqD0KV.cjs");
-const require_github = require("./github-C91l-j0Z.cjs");
-const require_net = require("./net-zrteIHld.cjs");
+const require_git = require("./git-DMONyZI2.cjs");
+const require_github = require("./github-AhCiyYZt.cjs");
+const require_net = require("./net-HILKQTAq.cjs");
+const require_rolldown = require("./rolldown-CV08omMx.cjs");
 Object.defineProperty(exports, "Buildkite", {
 	enumerable: true,
 	get: function() {
@@ -34,3 +35,9 @@ Object.defineProperty(exports, "Net", {
 		return require_net.net_exports;
 	}
 });
+Object.defineProperty(exports, "Rolldown", {
+	enumerable: true,
+	get: function() {
+		return require_rolldown.rolldown_exports;
+	}
+});

package/lib/index.d.cts

@@ -3,4 +3,5 @@ import { t as index_d_exports$1 } from "./cdk/index.cjs";
 import { t as index_d_exports$2 } from "./index-CLEYcnJY.cjs";
 import { t as index_d_exports$3 } from "./index-CPm5rAMy.cjs";
 import { t as index_d_exports$4 } from "./index-C9lVo3vU.cjs";
-export { index_d_exports as Buildkite, index_d_exports$1 as Cdk, index_d_exports$2 as Git, index_d_exports$3 as GitHub, index_d_exports$4 as Net };
+import { t as index_d_exports$5 } from "./index-BKHTGdUP.cjs";
+export { index_d_exports as Buildkite, index_d_exports$1 as Cdk, index_d_exports$2 as Git, index_d_exports$3 as GitHub, index_d_exports$4 as Net, index_d_exports$5 as Rolldown };

package/lib/index.d.mts

@@ -3,4 +3,5 @@ import { t as index_d_exports$1 } from "./cdk/index.mjs";
 import { t as index_d_exports$2 } from "./index-CLEYcnJY.mjs";
 import { t as index_d_exports$3 } from "./index-CwdiFn_m.mjs";
 import { t as index_d_exports$4 } from "./index-C9lVo3vU.mjs";
-export { index_d_exports as Buildkite, index_d_exports$1 as Cdk, index_d_exports$2 as Git, index_d_exports$3 as GitHub, index_d_exports$4 as Net };
+import { t as index_d_exports$5 } from "./index-BKHTGdUP.mjs";
+export { index_d_exports as Buildkite, index_d_exports$1 as Cdk, index_d_exports$2 as Git, index_d_exports$3 as GitHub, index_d_exports$4 as Net, index_d_exports$5 as Rolldown };

package/lib/index.mjs

@@ -1,6 +1,7 @@
-import { t as buildkite_exports } from "./buildkite-B0gyBRNS.mjs";
+import { t as buildkite_exports } from "./buildkite-C7bwlxiU.mjs";
 import { t as cdk_exports } from "./cdk/index.mjs";
-import { t as git_exports } from "./git-DyhV01cl.mjs";
-import { t as github_exports } from "./github-CmHDTIHw.mjs";
-import { t as net_exports } from "./net-97EvMPiP.mjs";
-export { buildkite_exports as Buildkite, cdk_exports as Cdk, git_exports as Git, github_exports as GitHub, net_exports as Net };
+import { t as git_exports } from "./git-DKqd7R1V.mjs";
+import { t as github_exports } from "./github-DsrERrG3.mjs";
+import { t as net_exports } from "./net-Bf2HV_vG.mjs";
+import { t as rolldown_exports } from "./rolldown-CH9krqYt.mjs";
+export { buildkite_exports as Buildkite, cdk_exports as Cdk, git_exports as Git, github_exports as GitHub, net_exports as Net, rolldown_exports as Rolldown };

package/lib/net/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_net = require("../net-zrteIHld.cjs");
+const require_net = require("../net-HILKQTAq.cjs");
 exports.waitFor = require_net.waitFor;

package/lib/net/index.mjs

@@ -1,2 +1,2 @@
-import { n as waitFor } from "../net-97EvMPiP.mjs";
+import { n as waitFor } from "../net-Bf2HV_vG.mjs";
 export { waitFor };

package/lib/{net-97EvMPiP.mjs → net-Bf2HV_vG.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { t as createExec } from "./exec-Dp89sakg.mjs";
+import { t as createExec } from "./exec-Csi1HI7c.mjs";
 import net from "net";
 //#region src/net/compose.ts
 const portStringToNumber = (portString) => {

package/lib/{net-zrteIHld.cjs → net-HILKQTAq.cjs}

@@ -1,5 +1,5 @@
-const require_rolldown_runtime = require("./rolldown-runtime-DakpK96I.cjs");
-const require_exec = require("./exec-BGMWpmZ7.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_exec = require("./exec-DCUB5Shx.cjs");
 let net = require("net");
 net = require_rolldown_runtime.__toESM(net, 1);
 //#region src/net/compose.ts

package/lib/rolldown/index.cjs

@@ -0,0 +1,3 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown = require("../rolldown-CV08omMx.cjs");
+exports.lambdaAsset = require_rolldown.lambdaAsset;

package/lib/rolldown/index.d.cts

@@ -0,0 +1,2 @@
+import { i as lambdaAsset, n as LambdaAssetFile, r as LambdaAssetOptions } from "../index-BKHTGdUP.cjs";
+export { type LambdaAssetFile, type LambdaAssetOptions, lambdaAsset };

package/lib/rolldown/index.d.mts

@@ -0,0 +1,2 @@
+import { i as lambdaAsset, n as LambdaAssetFile, r as LambdaAssetOptions } from "../index-BKHTGdUP.mjs";
+export { type LambdaAssetFile, type LambdaAssetOptions, lambdaAsset };

package/lib/rolldown/index.mjs

@@ -0,0 +1,2 @@
+import { n as lambdaAsset } from "../rolldown-CH9krqYt.mjs";
+export { lambdaAsset };

package/lib/rolldown-CH9krqYt.mjs

@@ -0,0 +1,265 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { t as log } from "./logging-BQNEupxh.mjs";
+import { t as createExec } from "./exec-Csi1HI7c.mjs";
+import { t as pathExists } from "./fs-BrQNZY8y.mjs";
+import { findPackageJSON } from "node:module";
+import fs from "fs-extra";
+import * as path from "node:path";
+import { findUp } from "find-up";
+import { pathToFileURL } from "node:url";
+import { isMap, parseDocument } from "yaml";
+//#region src/rolldown/pnpm.ts
+const PNPM_LOCK = "pnpm-lock.yaml";
+const PNPM_WORKSPACE_YAML = "pnpm-workspace.yaml";
+const PNPM_PATCHES_DIR = "patches";
+const PNPM_WORKSPACE_FILES = [
+	PNPM_WORKSPACE_YAML,
+	".npmrc",
+	".pnpmfile.cjs",
+	".pnpmfile.mjs"
+];
+const PNPM_METADATA_FILES = [path.join("node_modules", ".modules.yaml"), path.join("node_modules", ".pnpm-workspace-state-v1.json")];
+const PNPM_INSTALL_COMMAND = [
+	"pnpm",
+	"install",
+	"--config.node-linker=hoisted",
+	"--config.package-import-method=clone-or-copy",
+	"--no-frozen-lockfile",
+	"--prefer-offline"
+];
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const readJsonFile = async (filePath) => {
+	try {
+		return await fs.readJson(filePath);
+	} catch (err) {
+		throw new Error(`Failed to parse ${filePath} as JSON: ${err.message}`);
+	}
+};
+const PACKAGE_MANAGER_FIELDS = ["packageManager", "devEngines"];
+/**
+* Reads the package manager pin from the workspace root manifest.
+*
+* Forwarding it to the output directory keeps the staged install on the same
+* pnpm version as the project.
+*/
+const readPackageManagerFields = async (workspaceRoot) => {
+	const pkgPath = path.join(workspaceRoot, "package.json");
+	if (!await pathExists(pkgPath)) return {};
+	const parsed = await readJsonFile(pkgPath);
+	if (!isRecord(parsed)) return {};
+	return Object.fromEntries(PACKAGE_MANAGER_FIELDS.flatMap((field) => parsed[field] === void 0 ? [] : [[field, parsed[field]]]));
+};
+/**
+* The output directory installs a subset of the workspace's dependencies, so
+* most `patchedDependencies` entries have nothing to apply to. pnpm fails the
+* install on an unused patch unless this is set.
+*/
+const allowUnusedPatches = (content) => {
+	const doc = parseDocument(content);
+	const [error] = doc.errors;
+	if (error) throw new Error(`Failed to parse ${PNPM_WORKSPACE_YAML}: ${error.message}`);
+	if (!isMap(doc.contents)) return content;
+	doc.set("allowUnusedPatches", true);
+	return doc.toString();
+};
+/**
+* Stages the pnpm config that an install in `outputDir` needs.
+*
+* Patch files are staged from `patches`, where `pnpm patch-commit` writes them.
+*
+* Every path written is appended to `stagedFiles` so the caller can strip it
+* back out once the install is done; `.npmrc` in particular may hold registry
+* credentials that must not ship in the asset.
+*/
+const stageWorkspaceFiles = async (workspaceRoot, outputDir, stagedFiles = []) => {
+	const present = (await Promise.all(PNPM_WORKSPACE_FILES.map(async (file) => {
+		const src = path.join(workspaceRoot, file);
+		return await pathExists(src) ? {
+			file,
+			src
+		} : void 0;
+	}))).filter((entry) => entry !== void 0);
+	for (const { file } of present) stagedFiles.push(path.join(outputDir, file));
+	await Promise.all(present.map(async ({ file, src }) => {
+		const dest = path.join(outputDir, file);
+		if (file === PNPM_WORKSPACE_YAML) await fs.promises.writeFile(dest, allowUnusedPatches(await fs.promises.readFile(src, "utf8")));
+		else await fs.promises.copyFile(src, dest);
+	}));
+	const patchesSrc = path.join(workspaceRoot, PNPM_PATCHES_DIR);
+	if (await pathExists(patchesSrc)) {
+		const patchesDest = path.join(outputDir, PNPM_PATCHES_DIR);
+		stagedFiles.push(patchesDest);
+		await fs.copy(patchesSrc, patchesDest);
+	}
+	return stagedFiles;
+};
+/**
+* Resolves the installed version of each module, as seen from `resolveFrom`.
+*/
+const extractDependencies = async (resolveFrom, modules) => {
+	const result = {};
+	const base = pathToFileURL(resolveFrom);
+	for (const mod of modules) {
+		let modPkgPath;
+		try {
+			modPkgPath = findPackageJSON(mod, base);
+		} catch {
+			modPkgPath = void 0;
+		}
+		const parsed = modPkgPath ? await readJsonFile(modPkgPath) : void 0;
+		const version = isRecord(parsed) && typeof parsed.version === "string" ? parsed.version.trim() : void 0;
+		if (!version) throw new Error(`Cannot extract version for module '${mod}'. Check that it's referenced in your package.json or installed.`);
+		result[mod] = version;
+	}
+	return result;
+};
+//#endregion
+//#region src/rolldown/lambdaAsset.ts
+const PLUGIN_NAME = "skuba:lambda-asset";
+const resolveOutputDir = ({ dir, file }, cwd) => {
+	if (!dir) throw new Error(`${PLUGIN_NAME} requires \`output.dir\`; it prepares a deployable directory, so a single \`output.file\`${file ? ` (${file})` : ""} has nowhere to install into.`);
+	return path.resolve(cwd, dir);
+};
+const resolveLockFile = async (depsLockFilePath, cwd) => {
+	if (!depsLockFilePath) return findUp(PNPM_LOCK, { cwd });
+	const resolved = path.resolve(cwd, depsLockFilePath);
+	if (!await pathExists(resolved)) throw new Error(`${PLUGIN_NAME} cannot find a ${PNPM_LOCK} at '${depsLockFilePath}'.`);
+	return resolved;
+};
+const toPosix = (p) => p.split(path.sep).join("/");
+/**
+* Emits extra `assets` into the build output alongside the bundle.
+*
+* `from` is resolved relative to `projectRoot`; `to` becomes the emitted
+* `fileName`, which rolldown writes relative to the output directory, creating
+* parent directories as needed. Directories are emitted recursively, one asset
+* per file. `originalFileName` points rolldown at each source file so watch mode
+* rebuilds when it changes.
+*/
+const emitAssets = async (emit, projectRoot, assets) => {
+	await Promise.all(assets.map(async (asset) => {
+		const from = path.resolve(projectRoot, asset.from);
+		const to = asset.to ?? path.basename(asset.from);
+		const normalized = path.normalize(to);
+		if (path.isAbsolute(normalized) || normalized === "." || normalized === ".." || normalized.startsWith(`..${path.sep}`)) throw new Error(`${PLUGIN_NAME} refuses to copy asset '${asset.from}' to '${asset.to}': it escapes the output directory.`);
+		const files = (await fs.promises.stat(from)).isDirectory() ? (await fs.promises.readdir(from, {
+			recursive: true,
+			withFileTypes: true
+		})).filter((entry) => entry.isFile()).map((entry) => path.join(entry.parentPath, entry.name)) : [from];
+		await Promise.all(files.map(async (absFile) => {
+			const rel = path.relative(from, absFile);
+			emit({
+				type: "asset",
+				fileName: toPosix(rel ? path.join(to, rel) : to),
+				originalFileName: absFile,
+				source: await fs.promises.readFile(absFile)
+			});
+		}));
+	}));
+};
+const writeOutputPackageJson = (outputDir, fields = {}) => fs.promises.writeFile(path.join(outputDir, "package.json"), JSON.stringify({
+	type: "module",
+	...fields
+}, null, 2));
+/**
+* Strips the install-only files back out of the output directory.
+*
+* `.npmrc` may hold registry credentials, so one path failing to remove must
+* not skip the rest, and the caller must hear about it.
+*/
+const stripInstallFiles = async (outputDir, stagedFiles, cause) => {
+	const reasons = (await Promise.allSettled([...stagedFiles, ...PNPM_METADATA_FILES.map((file) => path.join(outputDir, file))].map((file) => fs.remove(file)))).flatMap((result) => result.status === "rejected" ? [String(result.reason)] : []);
+	if (reasons.length) throw new Error(`${PLUGIN_NAME} could not strip install-only files from '${outputDir}'; these may include registry credentials and must not be deployed. ${reasons.join("; ")}`, { cause });
+};
+/**
+* Prepares a rolldown output directory for deployment as a Lambda asset.
+*
+* The plugin supports ESM output and pnpm only. It makes no assumptions about
+* how you bundle; it only augments what rolldown has already written:
+*
+* 1. Emits any extra `assets` into the build output alongside the bundle, via
+*    rolldown's `emitFile`.
+* 2. Writes a `package.json` of `type: 'module'`.
+* 3. Installs `nodeModules` into the output directory with pnpm, staging the
+*    workspace config, `.npmrc`, lock file and patches to do so.
+* 4. Strips those install-only files back out, leaving the bundle, the
+*    generated `package.json` and `node_modules`.
+*
+* The result can be handed to CDK as `aws_lambda.Code.fromAsset(outputDir)`.
+*
+* @example
+* ```js
+* // rolldown.config.mjs
+* import { Rolldown } from 'skuba';
+*
+* export default {
+*   input: { index: 'src/lambda.ts' },
+*   output: { dir: 'lib' },
+*   external: ['sharp'],
+*   plugins: [
+*     Rolldown.lambdaAsset({
+*       nodeModules: ['sharp'],
+*       assets: [{ from: 'src/config.json' }],
+*     }),
+*   ],
+* };
+* ```
+*/
+const lambdaAsset = ({ nodeModules = [], assets = [], projectRoot: projectRootOption, depsLockFilePath: depsLockFilePathOption } = {}) => {
+	const prepared = /* @__PURE__ */ new Set();
+	let cwd = process.cwd();
+	return {
+		name: PLUGIN_NAME,
+		async buildStart(options) {
+			cwd = options.cwd;
+			prepared.clear();
+			if (assets.length) {
+				const projectRoot = path.resolve(cwd, projectRootOption ?? ".");
+				await emitAssets((file) => this.emitFile(file), projectRoot, assets);
+			}
+		},
+		async writeBundle(outputOptions) {
+			const outputDir = resolveOutputDir(outputOptions, cwd);
+			if (prepared.has(outputDir)) return;
+			prepared.add(outputDir);
+			const projectRoot = path.resolve(cwd, projectRootOption ?? ".");
+			if (!nodeModules.length) {
+				await writeOutputPackageJson(outputDir);
+				return;
+			}
+			const depsLockFilePath = await resolveLockFile(depsLockFilePathOption, cwd);
+			if (!depsLockFilePath) throw new Error(`${PLUGIN_NAME} cannot find a ${PNPM_LOCK}, which \`nodeModules\` requires. Specify one with \`depsLockFilePath\`.`);
+			const workspaceRoot = path.dirname(depsLockFilePath);
+			const projectPackageJson = path.join(projectRoot, "package.json");
+			if (!await pathExists(projectPackageJson)) throw new Error(`${PLUGIN_NAME} cannot find a package.json in '${projectRoot}', which \`nodeModules\` requires. Specify the directory with \`projectRoot\`.`);
+			const [dependencies, packageManagerFields] = await Promise.all([extractDependencies(projectPackageJson, nodeModules), readPackageManagerFields(workspaceRoot)]);
+			await writeOutputPackageJson(outputDir, {
+				dependencies,
+				...packageManagerFields
+			});
+			const stagedFiles = [];
+			try {
+				await stageWorkspaceFiles(workspaceRoot, outputDir, stagedFiles);
+				const lockDest = path.join(outputDir, PNPM_LOCK);
+				stagedFiles.push(lockDest);
+				await fs.promises.copyFile(depsLockFilePath, lockDest);
+				log.plain(log.bold(PLUGIN_NAME), "installing", log.bold(nodeModules.join(", ")));
+				const [bin, ...args] = PNPM_INSTALL_COMMAND;
+				await createExec({ cwd: outputDir })(bin, ...args);
+			} catch (err) {
+				await stripInstallFiles(outputDir, [
+					...stagedFiles,
+					path.join(outputDir, "package.json"),
+					path.join(outputDir, "node_modules")
+				], err);
+				throw err;
+			}
+			await stripInstallFiles(outputDir, stagedFiles);
+		}
+	};
+};
+//#endregion
+//#region src/rolldown/index.ts
+var rolldown_exports = /* @__PURE__ */ __exportAll({ lambdaAsset: () => lambdaAsset });
+//#endregion
+export { lambdaAsset as n, rolldown_exports as t };

package/lib/rolldown-CV08omMx.cjs

@@ -0,0 +1,278 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_logging = require("./logging-BqpzZfsF.cjs");
+const require_exec = require("./exec-DCUB5Shx.cjs");
+const require_fs = require("./fs-DS2eIMxA.cjs");
+let fs_extra = require("fs-extra");
+fs_extra = require_rolldown_runtime.__toESM(fs_extra, 1);
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let find_up = require("find-up");
+let node_module = require("node:module");
+let node_url = require("node:url");
+let yaml = require("yaml");
+//#region src/rolldown/pnpm.ts
+const PNPM_LOCK = "pnpm-lock.yaml";
+const PNPM_WORKSPACE_YAML = "pnpm-workspace.yaml";
+const PNPM_PATCHES_DIR = "patches";
+const PNPM_WORKSPACE_FILES = [
+	PNPM_WORKSPACE_YAML,
+	".npmrc",
+	".pnpmfile.cjs",
+	".pnpmfile.mjs"
+];
+const PNPM_METADATA_FILES = [node_path.join("node_modules", ".modules.yaml"), node_path.join("node_modules", ".pnpm-workspace-state-v1.json")];
+const PNPM_INSTALL_COMMAND = [
+	"pnpm",
+	"install",
+	"--config.node-linker=hoisted",
+	"--config.package-import-method=clone-or-copy",
+	"--no-frozen-lockfile",
+	"--prefer-offline"
+];
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const readJsonFile = async (filePath) => {
+	try {
+		return await fs_extra.default.readJson(filePath);
+	} catch (err) {
+		throw new Error(`Failed to parse ${filePath} as JSON: ${err.message}`);
+	}
+};
+const PACKAGE_MANAGER_FIELDS = ["packageManager", "devEngines"];
+/**
+* Reads the package manager pin from the workspace root manifest.
+*
+* Forwarding it to the output directory keeps the staged install on the same
+* pnpm version as the project.
+*/
+const readPackageManagerFields = async (workspaceRoot) => {
+	const pkgPath = node_path.join(workspaceRoot, "package.json");
+	if (!await require_fs.pathExists(pkgPath)) return {};
+	const parsed = await readJsonFile(pkgPath);
+	if (!isRecord(parsed)) return {};
+	return Object.fromEntries(PACKAGE_MANAGER_FIELDS.flatMap((field) => parsed[field] === void 0 ? [] : [[field, parsed[field]]]));
+};
+/**
+* The output directory installs a subset of the workspace's dependencies, so
+* most `patchedDependencies` entries have nothing to apply to. pnpm fails the
+* install on an unused patch unless this is set.
+*/
+const allowUnusedPatches = (content) => {
+	const doc = (0, yaml.parseDocument)(content);
+	const [error] = doc.errors;
+	if (error) throw new Error(`Failed to parse ${PNPM_WORKSPACE_YAML}: ${error.message}`);
+	if (!(0, yaml.isMap)(doc.contents)) return content;
+	doc.set("allowUnusedPatches", true);
+	return doc.toString();
+};
+/**
+* Stages the pnpm config that an install in `outputDir` needs.
+*
+* Patch files are staged from `patches`, where `pnpm patch-commit` writes them.
+*
+* Every path written is appended to `stagedFiles` so the caller can strip it
+* back out once the install is done; `.npmrc` in particular may hold registry
+* credentials that must not ship in the asset.
+*/
+const stageWorkspaceFiles = async (workspaceRoot, outputDir, stagedFiles = []) => {
+	const present = (await Promise.all(PNPM_WORKSPACE_FILES.map(async (file) => {
+		const src = node_path.join(workspaceRoot, file);
+		return await require_fs.pathExists(src) ? {
+			file,
+			src
+		} : void 0;
+	}))).filter((entry) => entry !== void 0);
+	for (const { file } of present) stagedFiles.push(node_path.join(outputDir, file));
+	await Promise.all(present.map(async ({ file, src }) => {
+		const dest = node_path.join(outputDir, file);
+		if (file === PNPM_WORKSPACE_YAML) await fs_extra.default.promises.writeFile(dest, allowUnusedPatches(await fs_extra.default.promises.readFile(src, "utf8")));
+		else await fs_extra.default.promises.copyFile(src, dest);
+	}));
+	const patchesSrc = node_path.join(workspaceRoot, PNPM_PATCHES_DIR);
+	if (await require_fs.pathExists(patchesSrc)) {
+		const patchesDest = node_path.join(outputDir, PNPM_PATCHES_DIR);
+		stagedFiles.push(patchesDest);
+		await fs_extra.default.copy(patchesSrc, patchesDest);
+	}
+	return stagedFiles;
+};
+/**
+* Resolves the installed version of each module, as seen from `resolveFrom`.
+*/
+const extractDependencies = async (resolveFrom, modules) => {
+	const result = {};
+	const base = (0, node_url.pathToFileURL)(resolveFrom);
+	for (const mod of modules) {
+		let modPkgPath;
+		try {
+			modPkgPath = (0, node_module.findPackageJSON)(mod, base);
+		} catch {
+			modPkgPath = void 0;
+		}
+		const parsed = modPkgPath ? await readJsonFile(modPkgPath) : void 0;
+		const version = isRecord(parsed) && typeof parsed.version === "string" ? parsed.version.trim() : void 0;
+		if (!version) throw new Error(`Cannot extract version for module '${mod}'. Check that it's referenced in your package.json or installed.`);
+		result[mod] = version;
+	}
+	return result;
+};
+//#endregion
+//#region src/rolldown/lambdaAsset.ts
+const PLUGIN_NAME = "skuba:lambda-asset";
+const resolveOutputDir = ({ dir, file }, cwd) => {
+	if (!dir) throw new Error(`${PLUGIN_NAME} requires \`output.dir\`; it prepares a deployable directory, so a single \`output.file\`${file ? ` (${file})` : ""} has nowhere to install into.`);
+	return node_path.resolve(cwd, dir);
+};
+const resolveLockFile = async (depsLockFilePath, cwd) => {
+	if (!depsLockFilePath) return (0, find_up.findUp)(PNPM_LOCK, { cwd });
+	const resolved = node_path.resolve(cwd, depsLockFilePath);
+	if (!await require_fs.pathExists(resolved)) throw new Error(`${PLUGIN_NAME} cannot find a ${PNPM_LOCK} at '${depsLockFilePath}'.`);
+	return resolved;
+};
+const toPosix = (p) => p.split(node_path.sep).join("/");
+/**
+* Emits extra `assets` into the build output alongside the bundle.
+*
+* `from` is resolved relative to `projectRoot`; `to` becomes the emitted
+* `fileName`, which rolldown writes relative to the output directory, creating
+* parent directories as needed. Directories are emitted recursively, one asset
+* per file. `originalFileName` points rolldown at each source file so watch mode
+* rebuilds when it changes.
+*/
+const emitAssets = async (emit, projectRoot, assets) => {
+	await Promise.all(assets.map(async (asset) => {
+		const from = node_path.resolve(projectRoot, asset.from);
+		const to = asset.to ?? node_path.basename(asset.from);
+		const normalized = node_path.normalize(to);
+		if (node_path.isAbsolute(normalized) || normalized === "." || normalized === ".." || normalized.startsWith(`..${node_path.sep}`)) throw new Error(`${PLUGIN_NAME} refuses to copy asset '${asset.from}' to '${asset.to}': it escapes the output directory.`);
+		const files = (await fs_extra.default.promises.stat(from)).isDirectory() ? (await fs_extra.default.promises.readdir(from, {
+			recursive: true,
+			withFileTypes: true
+		})).filter((entry) => entry.isFile()).map((entry) => node_path.join(entry.parentPath, entry.name)) : [from];
+		await Promise.all(files.map(async (absFile) => {
+			const rel = node_path.relative(from, absFile);
+			emit({
+				type: "asset",
+				fileName: toPosix(rel ? node_path.join(to, rel) : to),
+				originalFileName: absFile,
+				source: await fs_extra.default.promises.readFile(absFile)
+			});
+		}));
+	}));
+};
+const writeOutputPackageJson = (outputDir, fields = {}) => fs_extra.default.promises.writeFile(node_path.join(outputDir, "package.json"), JSON.stringify({
+	type: "module",
+	...fields
+}, null, 2));
+/**
+* Strips the install-only files back out of the output directory.
+*
+* `.npmrc` may hold registry credentials, so one path failing to remove must
+* not skip the rest, and the caller must hear about it.
+*/
+const stripInstallFiles = async (outputDir, stagedFiles, cause) => {
+	const reasons = (await Promise.allSettled([...stagedFiles, ...PNPM_METADATA_FILES.map((file) => node_path.join(outputDir, file))].map((file) => fs_extra.default.remove(file)))).flatMap((result) => result.status === "rejected" ? [String(result.reason)] : []);
+	if (reasons.length) throw new Error(`${PLUGIN_NAME} could not strip install-only files from '${outputDir}'; these may include registry credentials and must not be deployed. ${reasons.join("; ")}`, { cause });
+};
+/**
+* Prepares a rolldown output directory for deployment as a Lambda asset.
+*
+* The plugin supports ESM output and pnpm only. It makes no assumptions about
+* how you bundle; it only augments what rolldown has already written:
+*
+* 1. Emits any extra `assets` into the build output alongside the bundle, via
+*    rolldown's `emitFile`.
+* 2. Writes a `package.json` of `type: 'module'`.
+* 3. Installs `nodeModules` into the output directory with pnpm, staging the
+*    workspace config, `.npmrc`, lock file and patches to do so.
+* 4. Strips those install-only files back out, leaving the bundle, the
+*    generated `package.json` and `node_modules`.
+*
+* The result can be handed to CDK as `aws_lambda.Code.fromAsset(outputDir)`.
+*
+* @example
+* ```js
+* // rolldown.config.mjs
+* import { Rolldown } from 'skuba';
+*
+* export default {
+*   input: { index: 'src/lambda.ts' },
+*   output: { dir: 'lib' },
+*   external: ['sharp'],
+*   plugins: [
+*     Rolldown.lambdaAsset({
+*       nodeModules: ['sharp'],
+*       assets: [{ from: 'src/config.json' }],
+*     }),
+*   ],
+* };
+* ```
+*/
+const lambdaAsset = ({ nodeModules = [], assets = [], projectRoot: projectRootOption, depsLockFilePath: depsLockFilePathOption } = {}) => {
+	const prepared = /* @__PURE__ */ new Set();
+	let cwd = process.cwd();
+	return {
+		name: PLUGIN_NAME,
+		async buildStart(options) {
+			cwd = options.cwd;
+			prepared.clear();
+			if (assets.length) {
+				const projectRoot = node_path.resolve(cwd, projectRootOption ?? ".");
+				await emitAssets((file) => this.emitFile(file), projectRoot, assets);
+			}
+		},
+		async writeBundle(outputOptions) {
+			const outputDir = resolveOutputDir(outputOptions, cwd);
+			if (prepared.has(outputDir)) return;
+			prepared.add(outputDir);
+			const projectRoot = node_path.resolve(cwd, projectRootOption ?? ".");
+			if (!nodeModules.length) {
+				await writeOutputPackageJson(outputDir);
+				return;
+			}
+			const depsLockFilePath = await resolveLockFile(depsLockFilePathOption, cwd);
+			if (!depsLockFilePath) throw new Error(`${PLUGIN_NAME} cannot find a ${PNPM_LOCK}, which \`nodeModules\` requires. Specify one with \`depsLockFilePath\`.`);
+			const workspaceRoot = node_path.dirname(depsLockFilePath);
+			const projectPackageJson = node_path.join(projectRoot, "package.json");
+			if (!await require_fs.pathExists(projectPackageJson)) throw new Error(`${PLUGIN_NAME} cannot find a package.json in '${projectRoot}', which \`nodeModules\` requires. Specify the directory with \`projectRoot\`.`);
+			const [dependencies, packageManagerFields] = await Promise.all([extractDependencies(projectPackageJson, nodeModules), readPackageManagerFields(workspaceRoot)]);
+			await writeOutputPackageJson(outputDir, {
+				dependencies,
+				...packageManagerFields
+			});
+			const stagedFiles = [];
+			try {
+				await stageWorkspaceFiles(workspaceRoot, outputDir, stagedFiles);
+				const lockDest = node_path.join(outputDir, PNPM_LOCK);
+				stagedFiles.push(lockDest);
+				await fs_extra.default.promises.copyFile(depsLockFilePath, lockDest);
+				require_logging.log.plain(require_logging.log.bold(PLUGIN_NAME), "installing", require_logging.log.bold(nodeModules.join(", ")));
+				const [bin, ...args] = PNPM_INSTALL_COMMAND;
+				await require_exec.createExec({ cwd: outputDir })(bin, ...args);
+			} catch (err) {
+				await stripInstallFiles(outputDir, [
+					...stagedFiles,
+					node_path.join(outputDir, "package.json"),
+					node_path.join(outputDir, "node_modules")
+				], err);
+				throw err;
+			}
+			await stripInstallFiles(outputDir, stagedFiles);
+		}
+	};
+};
+//#endregion
+//#region src/rolldown/index.ts
+var rolldown_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ lambdaAsset: () => lambdaAsset });
+//#endregion
+Object.defineProperty(exports, "lambdaAsset", {
+	enumerable: true,
+	get: function() {
+		return lambdaAsset;
+	}
+});
+Object.defineProperty(exports, "rolldown_exports", {
+	enumerable: true,
+	get: function() {
+		return rolldown_exports;
+	}
+});

package/lib/{rolldown-runtime-DakpK96I.cjs → rolldown-runtime-C0BPl7ul.cjs}

@@ -24,7 +24,7 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skuba-lib/api",
-  "version": "2.3.0",
+  "version": "2.3.1-clanker-migrate-20260901033953",
   "description": "Node.js development API for skuba",
   "homepage": "https://github.com/seek-oss/skuba#readme",
   "bugs": {
@@ -39,6 +39,10 @@
       "import": "./lib/net/index.mjs",
       "require": "./lib/net/index.cjs"
     },
+    "./rolldown": {
+      "import": "./lib/rolldown/index.mjs",
+      "require": "./lib/rolldown/index.cjs"
+    },
     "./package.json": "./package.json"
   },
   "main": "./lib/index.cjs",
@@ -50,21 +54,32 @@
     "cdk",
     "git",
     "github",
-    "net"
+    "net",
+    "rolldown"
   ],
   "dependencies": {
     "@octokit/graphql": "^9.0.0",
     "@octokit/rest": "^22.0.0",
-    "@octokit/types": "^16.0.0",
+    "@octokit/types": "^17.0.0",
     "concurrently": "^10.0.0",
     "execa": "^9.6.1",
+    "find-up": "^8.0.0",
     "fs-extra": "^11.0.0",
     "ignore": "^7.0.0",
     "isomorphic-git": "^1.37.6",
     "npm-run-path": "^6.0.0",
     "npm-which": "^3.0.1",
+    "yaml": "^2.9.0",
     "zod": "^4.3.5"
   },
+  "peerDependencies": {
+    "rolldown": "^1.1.0"
+  },
+  "peerDependenciesMeta": {
+    "rolldown": {
+      "optional": true
+    }
+  },
   "engines": {
     "node": ">=22.14.0"
   },

package/rolldown/package.json

@@ -0,0 +1,6 @@
+{
+  "type": "module",
+  "main": "../lib/rolldown/index.cjs",
+  "module": "../lib/rolldown/index.mjs",
+  "types": "../lib/rolldown/index.d.cts"
+}