@stll/oxlint-config 0.11.0 → 0.12.1

package/README.md

@@ -92,9 +92,42 @@ part of major 26 fail.
 Release and publish workflows use exact patch version-file selectors for
 reproducible builds; this repository pins `.node-version` to `26.10.0`.
 The series policy accepts that patch without weakening release validation.
+Runtime images may retain a full SHA256 digest alongside an exact stable patch
+tag: Node must be inside its policy series and match tracked root `.node-version`
+when present; Python must be a patch in its policy series; Bun must equal its
+policy version. Supported image variants remain allowed.
+Digest validation is declaration-only: the guard enforces the exact policy tag
+and a full SHA256 digest, but does not verify that the digest belongs to the tag.
+Dependabot refreshes digests per repository; a shared tag-to-digest map would
+require a tooling release for every base-image digest bump across repositories,
+which costs more than it buys.
 GitHub JavaScript action host runtimes (`runs.using`) are platform-managed
 and do not select the project toolchain Node version.
 
+A published package can test the minimum Node major in its `engines.node`
+support range in one declared workflow job. Add a scoped `engineFloors` entry
+to tracked root `stll-toolchain.json`:
+
+```json
+{
+  "engineFloors": [
+    {
+      "package": "packages/library",
+      "workflow": ".github/workflows/ci.yml",
+      "job": "node-floor"
+    }
+  ]
+}
+```
+
+That job may use a literal exact stable patch in setup-node's `node-version`
+whose major matches the range's minimum major and whose release satisfies
+the range (for example, `20.10.0` for `>=20.10.0`). The approved action SHA, version comment and input validation
+also apply. Other jobs and runtime files follow the shared Node series.
+Missing packages or jobs, private packages, absent setup-node selectors and
+floor mismatches fail configuration validation. `optOuts` is optional when
+only `engineFloors` is declared.
+
 Run the installed checker from the repository root in CI:
 
 ```sh
@@ -120,7 +153,21 @@ rule and a nonempty reason:
 }
 ```
 
-`node-engine` is mandatory: an opt-out cannot bypass the shared Node support range.
+Workspace TypeScript toolchains combine the root and declared members' devDependencies.
+An included member may declare the exact TypeScript 6 compatibility API across
+dependencies, devDependencies, and peerDependencies when that shared install uses
+the complete split layout. Ambiguous or partial layouts do not grant this allowance.
+Peer ranges declare support: they must include the policy compiler release and the
+compatibility release when the selected layout uses it. Ranges do not contribute
+to the installed compiler inventory.
+
+JavaScript update roots come from the repository root, declared workspace membership,
+and directories with their own `bun.lock`, `package-lock.json`, `yarn.lock`, or
+`pnpm-lock.yaml`. Other package manifests do not create update roots; directory names
+have no special meaning. Workspace members share their owner's update entry.
+
+`node-engine` and `cloud-setup-drift` are mandatory: opt-outs cannot bypass the
+shared Node support range or generated cloud setup requirements.
 
 Opt-outs apply to the entire repository for that rule. Unknown or duplicate
 rules, empty reasons, and malformed configuration fail validation. See the
@@ -144,3 +191,68 @@ is unnecessary. Their original reference metadata is preserved without
 discovering or building referenced projects. Missing, unreadable, and zero-input
 selected configs fail the check. `--help` prints usage and exits successfully;
 unknown arguments fail.
+
+## Shared cloud setup
+
+Add an explicit declaration to tracked root `stll-toolchain.json`:
+
+```json
+{
+  "optOuts": [],
+  "cloud": {
+    "services": ["postgres", "valkey"],
+    "install": "bun install --frozen-lockfile",
+    "envFile": ".env.cloud"
+  }
+}
+```
+
+Services are optional: omit `services` or use `[]` for runtimes and dependencies
+only. No `cloud` declaration means no cloud setup script. `envFile` is required
+with services and rejected without services; runtime-only scripts emit no
+environment file code. With services, `envFile` must be a canonical
+repository-relative path; its existing parent must be safe at runtime. Track an exact stable Node patch in root
+`.node-version` within the shared Node series. Generate and commit the script:
+
+```sh
+bunx --no-install stll-cloud-setup
+```
+
+Generation uses the installed policy's Bun, Node, PostgreSQL, and Valkey pins.
+PostgreSQL uses the PGDG major-version packages; minor updates within the pinned
+major are accepted for the disposable database. Before adding PGDG, provisioning
+reuses an existing source only after verifying its signing-key fingerprint;
+conflicts identify the source file. Existing matching-major binaries are reused. Valkey uses official versioned
+binary DEBs for the declared release and architecture, verifies the policy's
+SHA256 pins, and installs those local files with apt. It does not resolve Valkey
+from a mutable package index.
+The command writes `.agents/cloud-setup.sh` with executable permissions and
+refuses symlink parents or destinations and hard-linked destinations. `stll-toolchain-check` rejects missing,
+drifted, or undeclared tracked scripts with mandatory `cloud-setup-drift`.
+Regenerate after changing the policy or declaration. `stll-cloud-setup --help`
+prints usage without reading repository configuration.
+
+| Environment phase       | Command                               |
+| ----------------------- | ------------------------------------- |
+| Networked install       | `bash .agents/cloud-setup.sh install` |
+| Offline session startup | `bash .agents/cloud-setup.sh start`   |
+
+Both commands can be rerun. Missing or unknown subcommands print usage and
+exit 2; there is no implicit lifecycle mode. The script supports Ubuntu 24.04
+with root access or passwordless sudo and fails when required capabilities
+or pinned installations are unavailable. `install` provisions runtimes,
+dependencies, and declared services; `start` restores local services after
+cached environments lose running processes. Services bind only to localhost.
+System provisioning runs as root; frozen dependencies run as the invoking user
+with that user's home and a private, user-owned Bun cache. Package installation
+does not permit automatic downgrades.
+If a newer Valkey package is already installed, provisioning fails rather than
+downgrading it; use an environment compatible with the pinned release.
+The environment file contains `NODE_ENV=test` and declared local connection
+URLs, carries a generated ownership marker, and refuses an unowned file or
+symlink. Configure the repository's test runner to load that file; migration
+commands and repository adoption are separate configuration steps.
+
+Environments may cache filesystems without preserving service processes.
+Run `start` at every session start, including sessions that reuse installed files.
+The supported OS, privileges, and pinned runtime requirements are checked explicitly.

package/dist/cloud-setup-cli.cjs

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_toolchain_guard = require("./toolchain-guard.cjs");
+let node_fs = require("node:fs");
+let node_path = require("node:path");
+let node_fs_promises = require("node:fs/promises");
+//#region src/cloud-setup-cli.ts
+const usage = "Usage: stll-cloud-setup (run from repository root)\n       stll-cloud-setup --help";
+const optionalStat = async (path) => {
+	try {
+		return await (0, node_fs_promises.lstat)(path);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return void 0;
+		throw error;
+	}
+};
+const main = async () => {
+	const args = process.argv.slice(2);
+	if (args.length === 1 && args.at(0) === "--help") {
+		process.stdout.write(`${usage}\n`);
+		return;
+	}
+	if (args.length !== 0) throw new Error(usage);
+	const root = await (0, node_fs_promises.realpath)(process.cwd());
+	const { files, diagnostics } = require_toolchain_guard.readToolchainInputs(root);
+	if (diagnostics.length > 0) throw new Error(diagnostics.map(({ path, message }) => `${path}: ${message}`).join("\n"));
+	const text = files["stll-toolchain.json"];
+	if (text === void 0) throw new Error("requires tracked stll-toolchain.json");
+	const { cloud } = require_toolchain_guard.parseToolchainConfiguration(JSON.parse(text));
+	if (cloud === void 0) throw new Error("requires an explicit cloud declaration");
+	const nodeVersion = files[".node-version"];
+	if (nodeVersion === void 0) throw new Error("requires tracked root .node-version");
+	const script = require_toolchain_guard.generateCloudSetup({
+		policy: require_toolchain_guard.parseToolchainPolicy(JSON.parse(await (0, node_fs_promises.readFile)(new URL("../toolchain.json", require("url").pathToFileURL(__filename).href), "utf8"))),
+		cloud,
+		nodeVersion: nodeVersion.trim()
+	});
+	const destination = (0, node_path.join)(root, require_toolchain_guard.cloudSetupPath);
+	const parent = (0, node_path.dirname)(destination);
+	const parentStat = await optionalStat(parent);
+	if (parentStat === void 0) await (0, node_fs_promises.mkdir)(parent);
+	else if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) throw new Error("cloud setup parent must be a real repository directory");
+	const destinationStat = await optionalStat(destination);
+	if (destinationStat !== void 0 && (destinationStat.isSymbolicLink() || !destinationStat.isFile() || destinationStat.nlink !== 1)) throw new Error("cloud setup destination must be a single-link regular repository file");
+	const output = await (0, node_fs_promises.open)(destination, node_fs.constants.O_WRONLY | node_fs.constants.O_CREAT | node_fs.constants.O_NOFOLLOW, 493);
+	try {
+		const opened = await output.stat();
+		if (!opened.isFile() || opened.nlink !== 1) throw new Error("cloud setup destination must be a single-link regular repository file");
+		await output.truncate(0);
+		await output.writeFile(script, "utf8");
+		await output.chmod(493);
+	} finally {
+		await output.close();
+	}
+	process.stdout.write(`Generated ${require_toolchain_guard.cloudSetupPath}\n`);
+};
+main().catch((error) => {
+	process.stderr.write(`cloud-setup: ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exitCode = 1;
+});
+//#endregion
+
+//# sourceMappingURL=cloud-setup-cli.cjs.map

package/dist/cloud-setup-cli.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-setup-cli.cjs","names":["readToolchainInputs","parseToolchainConfiguration","generateCloudSetup","parseToolchainPolicy","cloudSetupPath","constants"],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { lstat, mkdir, open, readFile, realpath } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst optionalStat = async (path: string) => {\n  try {\n    return await lstat(path);\n  } catch (error) {\n    if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n      return undefined;\n    throw error;\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  if (diagnostics.length > 0)\n    throw new Error(\n      diagnostics.map(({ path, message }) => `${path}: ${message}`).join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud } = parseToolchainConfiguration(JSON.parse(text));\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n  });\n  const destination = join(root, cloudSetupPath);\n  const parent = dirname(destination);\n  const parentStat = await optionalStat(parent);\n  if (parentStat === undefined) await mkdir(parent);\n  else if (parentStat.isSymbolicLink() || !parentStat.isDirectory())\n    throw new Error(\"cloud setup parent must be a real repository directory\");\n  const destinationStat = await optionalStat(destination);\n  if (\n    destinationStat !== undefined &&\n    (destinationStat.isSymbolicLink() ||\n      !destinationStat.isFile() ||\n      destinationStat.nlink !== 1)\n  )\n    throw new Error(\n      \"cloud setup destination must be a single-link regular repository file\",\n    );\n  const output = await open(\n    destination,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW,\n    0o755,\n  );\n  try {\n    const opened = await output.stat();\n    if (!opened.isFile() || opened.nlink !== 1)\n      throw new Error(\n        \"cloud setup destination must be a single-link regular repository file\",\n      );\n    await output.truncate(0);\n    await output.writeFile(script, \"utf8\");\n    await output.chmod(0o755);\n  } finally {\n    await output.close();\n  }\n  process.stdout.write(`Generated ${cloudSetupPath}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;AAYA,MAAM,QACJ;AACF,MAAM,eAAe,OAAO,SAAiB;CAC3C,IAAI;EACF,OAAO,OAAA,GAAA,iBAAA,MAAA,CAAY,IAAI;CACzB,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;EACT,MAAM;CACR;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,OAAA,GAAA,iBAAA,SAAA,CAAe,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgBA,wBAAAA,oBAAoB,IAAI;CACvD,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,YAAY,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,CACzE;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,UAAUC,wBAAAA,4BAA4B,KAAK,MAAM,IAAI,CAAC;CAC9D,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CAMvD,MAAM,SAASC,wBAAAA,mBAAmB;EAChC,QANaC,wBAAAA,qBACb,KAAK,MACH,OAAA,GAAA,iBAAA,SAAA,CAAe,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CAGK;EACL;EACA,aAAa,YAAY,KAAK;CAChC,CAAC;CACD,MAAM,eAAA,GAAA,UAAA,KAAA,CAAmB,MAAMC,wBAAAA,cAAc;CAC7C,MAAM,UAAA,GAAA,UAAA,QAAA,CAAiB,WAAW;CAClC,MAAM,aAAa,MAAM,aAAa,MAAM;CAC5C,IAAI,eAAe,KAAA,GAAW,OAAA,GAAA,iBAAA,MAAA,CAAY,MAAM;MAC3C,IAAI,WAAW,eAAe,KAAK,CAAC,WAAW,YAAY,GAC9D,MAAM,IAAI,MAAM,wDAAwD;CAC1E,MAAM,kBAAkB,MAAM,aAAa,WAAW;CACtD,IACE,oBAAoB,KAAA,MACnB,gBAAgB,eAAe,KAC9B,CAAC,gBAAgB,OAAO,KACxB,gBAAgB,UAAU,IAE5B,MAAM,IAAI,MACR,uEACF;CACF,MAAM,SAAS,OAAA,GAAA,iBAAA,KAAA,CACb,aACAC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UAAUA,QAAAA,UAAU,YACnD,GACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,KAAK;EACjC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,uEACF;EACF,MAAM,OAAO,SAAS,CAAC;EACvB,MAAM,OAAO,UAAU,QAAQ,MAAM;EACrC,MAAM,OAAO,MAAM,GAAK;CAC1B,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;CACA,QAAQ,OAAO,MAAM,aAAaD,wBAAAA,eAAe,GAAG;AACtD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/cloud-setup-cli.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/cloud-setup-cli.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/cloud-setup-cli.mjs

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+import { a as cloudSetupPath, i as parseToolchainPolicy, n as parseToolchainConfiguration, o as generateCloudSetup, r as readToolchainInputs } from "./toolchain-guard.mjs";
+import { constants } from "node:fs";
+import { dirname, join } from "node:path";
+import { lstat, mkdir, open, readFile, realpath } from "node:fs/promises";
+//#region src/cloud-setup-cli.ts
+const usage = "Usage: stll-cloud-setup (run from repository root)\n       stll-cloud-setup --help";
+const optionalStat = async (path) => {
+	try {
+		return await lstat(path);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return void 0;
+		throw error;
+	}
+};
+const main = async () => {
+	const args = process.argv.slice(2);
+	if (args.length === 1 && args.at(0) === "--help") {
+		process.stdout.write(`${usage}\n`);
+		return;
+	}
+	if (args.length !== 0) throw new Error(usage);
+	const root = await realpath(process.cwd());
+	const { files, diagnostics } = readToolchainInputs(root);
+	if (diagnostics.length > 0) throw new Error(diagnostics.map(({ path, message }) => `${path}: ${message}`).join("\n"));
+	const text = files["stll-toolchain.json"];
+	if (text === void 0) throw new Error("requires tracked stll-toolchain.json");
+	const { cloud } = parseToolchainConfiguration(JSON.parse(text));
+	if (cloud === void 0) throw new Error("requires an explicit cloud declaration");
+	const nodeVersion = files[".node-version"];
+	if (nodeVersion === void 0) throw new Error("requires tracked root .node-version");
+	const script = generateCloudSetup({
+		policy: parseToolchainPolicy(JSON.parse(await readFile(new URL("../toolchain.json", import.meta.url), "utf8"))),
+		cloud,
+		nodeVersion: nodeVersion.trim()
+	});
+	const destination = join(root, cloudSetupPath);
+	const parent = dirname(destination);
+	const parentStat = await optionalStat(parent);
+	if (parentStat === void 0) await mkdir(parent);
+	else if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) throw new Error("cloud setup parent must be a real repository directory");
+	const destinationStat = await optionalStat(destination);
+	if (destinationStat !== void 0 && (destinationStat.isSymbolicLink() || !destinationStat.isFile() || destinationStat.nlink !== 1)) throw new Error("cloud setup destination must be a single-link regular repository file");
+	const output = await open(destination, constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW, 493);
+	try {
+		const opened = await output.stat();
+		if (!opened.isFile() || opened.nlink !== 1) throw new Error("cloud setup destination must be a single-link regular repository file");
+		await output.truncate(0);
+		await output.writeFile(script, "utf8");
+		await output.chmod(493);
+	} finally {
+		await output.close();
+	}
+	process.stdout.write(`Generated ${cloudSetupPath}\n`);
+};
+main().catch((error) => {
+	process.stderr.write(`cloud-setup: ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exitCode = 1;
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=cloud-setup-cli.mjs.map

package/dist/cloud-setup-cli.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-setup-cli.mjs","names":[],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { lstat, mkdir, open, readFile, realpath } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst optionalStat = async (path: string) => {\n  try {\n    return await lstat(path);\n  } catch (error) {\n    if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n      return undefined;\n    throw error;\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  if (diagnostics.length > 0)\n    throw new Error(\n      diagnostics.map(({ path, message }) => `${path}: ${message}`).join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud } = parseToolchainConfiguration(JSON.parse(text));\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n  });\n  const destination = join(root, cloudSetupPath);\n  const parent = dirname(destination);\n  const parentStat = await optionalStat(parent);\n  if (parentStat === undefined) await mkdir(parent);\n  else if (parentStat.isSymbolicLink() || !parentStat.isDirectory())\n    throw new Error(\"cloud setup parent must be a real repository directory\");\n  const destinationStat = await optionalStat(destination);\n  if (\n    destinationStat !== undefined &&\n    (destinationStat.isSymbolicLink() ||\n      !destinationStat.isFile() ||\n      destinationStat.nlink !== 1)\n  )\n    throw new Error(\n      \"cloud setup destination must be a single-link regular repository file\",\n    );\n  const output = await open(\n    destination,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW,\n    0o755,\n  );\n  try {\n    const opened = await output.stat();\n    if (!opened.isFile() || opened.nlink !== 1)\n      throw new Error(\n        \"cloud setup destination must be a single-link regular repository file\",\n      );\n    await output.truncate(0);\n    await output.writeFile(script, \"utf8\");\n    await output.chmod(0o755);\n  } finally {\n    await output.close();\n  }\n  process.stdout.write(`Generated ${cloudSetupPath}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;AAYA,MAAM,QACJ;AACF,MAAM,eAAe,OAAO,SAAiB;CAC3C,IAAI;EACF,OAAO,MAAM,MAAM,IAAI;CACzB,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;EACT,MAAM;CACR;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgB,oBAAoB,IAAI;CACvD,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,YAAY,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,CACzE;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,UAAU,4BAA4B,KAAK,MAAM,IAAI,CAAC;CAC9D,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CAMvD,MAAM,SAAS,mBAAmB;EAChC,QANa,qBACb,KAAK,MACH,MAAM,SAAS,IAAI,IAAI,qBAAqB,OAAO,KAAK,GAAG,GAAG,MAAM,CACtE,CAGK;EACL;EACA,aAAa,YAAY,KAAK;CAChC,CAAC;CACD,MAAM,cAAc,KAAK,MAAM,cAAc;CAC7C,MAAM,SAAS,QAAQ,WAAW;CAClC,MAAM,aAAa,MAAM,aAAa,MAAM;CAC5C,IAAI,eAAe,KAAA,GAAW,MAAM,MAAM,MAAM;MAC3C,IAAI,WAAW,eAAe,KAAK,CAAC,WAAW,YAAY,GAC9D,MAAM,IAAI,MAAM,wDAAwD;CAC1E,MAAM,kBAAkB,MAAM,aAAa,WAAW;CACtD,IACE,oBAAoB,KAAA,MACnB,gBAAgB,eAAe,KAC9B,CAAC,gBAAgB,OAAO,KACxB,gBAAgB,UAAU,IAE5B,MAAM,IAAI,MACR,uEACF;CACF,MAAM,SAAS,MAAM,KACnB,aACA,UAAU,WAAW,UAAU,UAAU,UAAU,YACnD,GACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,KAAK;EACjC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,uEACF;EACF,MAAM,OAAO,SAAS,CAAC;EACvB,MAAM,OAAO,UAAU,QAAQ,MAAM;EACrC,MAAM,OAAO,MAAM,GAAK;CAC1B,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;CACA,QAAQ,OAAO,MAAM,aAAa,eAAe,GAAG;AACtD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}