@stll/oxlint-config 0.12.1 → 0.14.1

package/README.md

@@ -64,15 +64,41 @@ The checkout must omit both `if` and `continue-on-error`, and its normalized
 path must be unique among every checkout in that job, including later steps.
 Unknown checkout destinations prevent mapped selectors from proving provenance.
 Sparse checkouts must explicitly list the selected repository-relative file,
-without the checkout prefix, in `sparse-checkout`. This applies in either cone
-mode and to delegated sources. Dynamic, empty, glob, negation, or unsupported
-sparse configurations fail; a cone-mode input alone is insufficient. Directory
-entries cannot substitute for the selected file.
+without the checkout prefix, in `sparse-checkout`; a root-anchored entry such as
+`/package.json` is accepted. This applies in either cone mode and to delegated
+sources. Empty, glob, negation, or unsupported sparse configurations fail; a
+cone-mode input alone is insufficient. Directory entries cannot substitute for
+the selected file. A scoped Bun-source declaration can acknowledge a dynamic
+sparse expression, but cannot waive a literal omission or invalid pattern,
+including literal patterns mixed with expression lines or literal fragments
+adjoining an expression. The deepest checkout destination containing a static selected file supplies that
+file. Sparse validation checks that provider, including every writer at the same
+destination, before expression acknowledgement; ancestor sparse settings do not
+constrain an independent nested checkout. Checkout writes are processed in step
+order: any later ancestor checkout invalidates earlier descendants, regardless of
+its clean input. Checkout may clear a destination without a matching Git repository
+even when clean is false. Unresolved clean values remain untrusted. Unknown
+selectors remain fail closed. Mixed literal/expression sparse
+configurations retain their literal paths: those paths must explicitly include a
+static selected manifest. A declaration acknowledges only expression additions.
+For every static manifest selector from the inspected source, the manifest pin
+is validated after sparse acknowledgement, including fully dynamic sparse inputs.
 Other nonempty, nonconstant GitHub expression refs on same-repository checkouts
 (including `${{ job.workflow_repository }}`) delegate a safe static version-file selector
 to that checkout. The CLI reports delegation on stdout without validating the
-current source's version file. Literal refs and unpaired `${{ github.sha }}` /
-`${{ job.workflow_sha }}` remain rejected.
+current source's version file. Current-source checkouts also accept
+`${{ github.sha }}` on the same repository, except reusable `workflow_call`
+workflows whose GitHub context belongs to the caller. Reusable workflows must
+use the exact workflow repository/SHA pair to authorize local actions. A default
+reusable-workflow checkout delegates the caller manifest just like an explicit
+caller repository/SHA binding. This default applies only when the repository is
+omitted or exactly `${{ github.repository }}`; a literal workflow-repository
+checkout without a ref does not identify the caller snapshot. Mutable `${{ github.ref }}` bindings delegate
+on every event; only the event SHA establishes the inspected snapshot. PR-head
+SHA/ref expressions and their fallbacks are delegated: they cannot establish
+local-action provenance or validate the inspected source's manifest. Local
+actions require current-source bindings. Literal refs, foreign repositories and
+unpaired `${{ job.workflow_sha }}` remain rejected.
 For snapshot-bound sources, the guard maps the selector to its tracked source
 file. Literal commit SHAs,
 branches, tags, unpaired snapshot contexts, foreign repositories, and traversal
@@ -128,6 +154,44 @@ Missing packages or jobs, private packages, absent setup-node selectors and
 floor mismatches fail configuration validation. `optOuts` is optional when
 only `engineFloors` is declared.
 
+A runtime image or Bun source selected by an expression can have a scoped,
+reviewed `dynamicSelectors` declaration instead of a whole-rule opt-out:
+
+```json
+{
+  "dynamicSelectors": [
+    {
+      "path": ".github/workflows/example.yml",
+      "at": "jobs.example.services.database",
+      "kind": "image",
+      "reason": "The scoped image producer validates the selected image."
+    },
+    {
+      "path": ".github/workflows/example.yml",
+      "at": "jobs.example.steps.setup",
+      "kind": "bun-source",
+      "reason": "The manifest producer selects the owned source snapshot."
+    }
+  ]
+}
+```
+
+`at` identifies a job container (`jobs.<job>.container`), job service
+(`jobs.<job>.services.<service>`), Compose image (`services.<service>.image`),
+or setup step ID (`jobs.<job>.steps.<id>`; `runs.steps.<id>` in a composite
+action). If a step has no ID, replace `at` with a positive `line` number
+pointing at its version-file selector. Images without an ID locator (including
+unresolved Dockerfile `FROM` arguments) can also use a line number. Prefer IDs so unrelated edits do not
+move the declaration. Each declaration requires an exact tracked path, one
+locator, a known kind and a nonempty reason. It must match exactly one unresolved
+selector; missing, static or ambiguous locations fail configuration validation.
+An image declaration applies only to an expression, never a literal runtime pin.
+A Bun declaration acknowledges an unresolved manifest expression or same-source
+dynamic checkout ambiguity; it does not verify the selected version. Foreign or
+literal-ref checkouts, incorrect action pins and conditional/error-tolerant
+checkouts still fail. Local-action provenance is independent of these declarations.
+Review the producer named in the reason whenever the selector changes.
+
 Run the installed checker from the repository root in CI:
 
 ```sh
@@ -256,3 +320,236 @@ commands and repository adoption are separate configuration steps.
 Environments may cache filesystems without preserving service processes.
 Run `start` at every session start, including sessions that reuse installed files.
 The supported OS, privileges, and pinned runtime requirements are checked explicitly.
+
+## Published package contracts
+
+Run `stll-publish-contract` in PR CI. Every published root or declared workspace
+package commits `publish-contract.json`, recording engines, peer support ranges,
+resolved JavaScript targets, and entry points. `stll-publish-contract --write`
+records an explicit contract decision as a reviewable diff; it also validates
+consumer support and cannot accept development-only requirements.
+
+The consumer policy pins Node 22.23.3, npm 12.2.0, pnpm 12.9.1, and TypeScript
+6.0.3 independently of the development toolchain. Published engines and TypeScript
+peers must support the consumer versions; ranges may include newer versions.
+Bun runtime/compiler requirements are rejected. JSON and declaration-only packages
+record `{"type":"types-only"}` explicitly.
+
+The static guard follows the packer declared in the tracked release workflow.
+With pnpm, it models `publishConfig` overrides for `exports`, `main`, `module`,
+`types`, `typings`, `bin`, and `typesVersions`. npm does not apply these overrides,
+so differing values fail; move the published entry into the source manifest.
+`access` and `registry` are allowed publication metadata. Other overrides,
+including `engines`, are rejected. Real npm and pnpm pack tests compare the
+modeled contract with each tarball manifest.
+
+Build adapters use the installed configuration loaders and bind their behavior to
+tsdown 0.22.9, Vite 8.1.5, or @nuxt/module-builder 1.0.3 (unbuild 3.6.1 and
+mkdist 2.4.1). They record final transform targets, including separate Nuxt module
+and runtime entries. No syntax lowering records `esnext`.
+Only exact single build invocations (`tsdown`, `vite build`, or
+`nuxt-module-build build`) are supported. Shell composition, environment prefixes,
+launchers, directory changes, workspace filters, CLI overrides, and pre/post build
+lifecycle scripts fail.
+Vite accepts its version-bound default plugin pipeline and the default
+`@vitejs/plugin-vue` 6.0.8 factory; custom Vue compiler, template, script, and feature
+options are unsupported. Nuxt accepts the version-bound builder and immutable target
+marker; foreign branded callbacks are replaced with the installed canonical hook before execution. Unapproved plugins, output transforms, and execution-order changes fail. The static guard validates the supported configuration; the nightly runner validates the actual packed JavaScript. Add a reviewed adapter when adopting another build tool.
+
+Vite libraries can generate declarations through the reviewed helper:
+
+```ts
+import { declarationOnlyDts } from "@stll/oxlint-config/declaration-only-dts";
+
+export default {
+  plugins: [
+    declarationOnlyDts({
+      directory: import.meta.dirname,
+      include: ["src/**/*"],
+      entryRoot: "src",
+    }),
+  ],
+  build: { target: "es2022", lib: { entry: "src/index.ts", formats: ["es"] } },
+};
+```
+
+This adapter requires consumer-installed `vite-plugin-dts` 5.0.3 and its
+`unplugin-dts` 1.0.3 implementation. Its dependency scope must provide TypeScript
+6.0.3 as `typescript` or the plugin's `@typescript/typescript6` fallback.
+Unsupported versions fail explicitly.
+The resolver proves a direct helper import and call in a literal plugin array;
+raw declaration plugins, opaque plugin arrays, and additional emitters fail.
+Options are closed and static: include/exclude, entryRoot, pathsToAliases,
+compilerOptions.declarationMap=false, strictOutput=true, and declarationOnly=false. Hooks may
+emit only `.d.ts`, `.d.mts`, `.d.cts`, and their maps. Bundle and on-disk non-declaration
+bytes must remain unchanged across each declaration hook; this is checked during
+the actual build, without a comparison build.
+
+Nuxt modules can set both emitted targets without replacing the builder's entries:
+
+```ts
+import { nuxtModuleTarget } from "@stll/oxlint-config/build-target";
+
+export default { hooks: { "build:before": nuxtModuleTarget("es2022") } };
+```
+
+The Nuxt adapter recognizes the immutable marker across module formats without executing a foreign callback. It captures the normalized configuration before cleanup or output writes. The built
+publish-contract CLI is also checked against a TypeScript configuration and relative
+TypeScript import on the package's minimum supported Node release.
+
+Packed-artifact checks run nightly, while the static contract check runs per PR.
+Every packed `.js`, `.mjs`, and `.cjs` file is checked, including non-entry chunks
+and executables. The actual packed manifest must match the committed contract.
+Acorn 8.15.0 applies the strictest declared ECMAScript target (`es5`, `es2015`
+through `es2025`); the provisioned consumer Node also parses every file with
+`--check`, without executing artifact code. `esnext` and supported Node targets use the native consumer Node bound.
+Node target identifiers follow the same grammar and compatibility rule as the
+static contract; no older Node-to-ECMAScript mapping is inferred. Browser targets
+are unsupported here: declare an explicit ECMAScript year. Types-only contracts reject any packed JavaScript. Nested
+package manifests and explicit module extensions determine parsing mode.
+Linked syntax inputs and unsafe archive paths fail before staging.
+
+The reusable consumer job declares its exact scope in `stll-toolchain.json`:
+
+```json
+{
+  "consumerChecks": [
+    {
+      "workflow": ".github/workflows/consumer-compat.yml",
+      "job": "consumer",
+      "packages": ["packages/library"],
+      "toolingVersion": "<installed tooling version>",
+      "fixturePath": "tests/consumer"
+    }
+  ]
+}
+```
+
+The reusable consumer job must be stand-alone and unconditional (no `needs`, `if`, or `strategy`), so a job condition
+cannot skip its scheduled execution.
+The declared workflow requires a nonempty `on.schedule` with validated five-field cron (field bounds, lists, ranges, and positive steps);
+Day of week is 0–6 (SUN–SAT), matching the [GitHub Actions schedule contract](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#schedule); numeric 7 is unsupported. The combined schedules must cover every weekday with unrestricted month and date fields, so weekly or seasonal schedules cannot satisfy the daily contract. Public packages require a semver-valid version. Published workspace packages under a `vendor` directory are unsupported; the contract CLI reports them rather than omitting them. `bundleDependencies` and `bundledDependencies` are unsupported because artifact staging does not install a bundled dependency tree; remove these fields before declaring consumer checks.
+`workflow_dispatch` may also be enabled. That job calls the shared
+`package-consumer-compat.yml` workflow at its approved immutable policy pin, with
+`packages` as the same JSON array and `consumer-node` equal to the consumer policy
+pin. Required `tooling-version` and `fixture-path` inputs equal the declared exact
+`toolingVersion` and repository-relative `fixturePath`; its `consumer-compat.json` must
+be tracked, parse with the runner’s fixture schema, and select exactly the declared package set. Replace `<installed tooling version>` with the exact installed
+`@stll/oxlint-config` release that provides the consumer runner; the guard binds the
+declaration to that package version. Every named package and its transitive workspace closure must be tracked,
+published, and have valid manifests. Each selected package must support that Node version.
+Unknown jobs, stale entries, undeclared consumer calls, and inconsistent inputs fail.
+This declaration applies to consumer checks; `engineFloors` retains its separate
+minimum-supported-major contract.
+
+`stll-consumer-compat --packages '["packages/library"]' --consumer-node 22.23.3
+--fixture-path tests/consumer` tests final tarballs in isolated projects with both
+npm and pnpm. The repository builds once with its development toolchain first.
+The runner reads the exact packer version and pack flags from a single tracked
+release workflow and packs directly with that manager. Missing, ambiguous, or
+unsupported pack configuration fails. Both consumers install the same release
+artifacts; the runner does not rewrite workspace or catalog protocols through a
+different manager. Fixture installs disable scripts, reject reserved runtime/manager bins throughout nested lifecycle paths, then approve only directly declared dependencies at their resolved lock identities. npm rebuilds those identities; pnpm runs its built-in pending rebuild. Both use the pinned consumer runtime before typecheck, build and smoke. Undeclared transitive build scripts receive no approval. Catalog entries that resolve to a local workspace
+package are unsupported: use `workspace:` for that dependency. Registry catalog declarations are staged intact; the release packer must resolve
+publication protocols. pnpm workspace owners require an adjacent tracked
+`package.json`; manifestless owners are unsupported. Public package names must be
+canonical lowercase, URL-safe npm names (at most 214 characters), with no traversal components. The runner verifies
+the official Node archive checksum and exact runtime/package-manager versions,
+uses the oldest published React satisfying the package peer range and, when ReactDOM is required, its compatible renderer peer range, typechecks with
+the consumer TypeScript, and runs each fixture's build and usage smoke.
+
+The fixture directory contains `consumer-compat.json`:
+
+```json
+{
+  "packages": [
+    {
+      "package": "packages/library",
+      "fixture": "library",
+      "kind": "node",
+      "build": ["npm", "run", "build"],
+      "smoke": ["npm", "run", "smoke"]
+    }
+  ]
+}
+```
+
+Each fixture is a standalone project with its own source, package manifest, and
+TypeScript configuration. Use `react` for a React peer and a render smoke; use
+`node` for an import and representative call. Dependency bindings, runtime tools,
+and caches belong to the runner. A nightly failure must open or update one issue
+in the consuming repository and use its existing failure notification.
+
+## Toolchain changes and typecheck probes
+
+`stll-toolchain-changed --since <git-ref>` compares committed snapshots at the
+reference and `HEAD`. Fetch the reference and its history before running it.
+It prints one JSON object with `changed`, `tools`, and `status`; the detector
+exits successfully even when history is unreadable, reporting `changed: true`
+and `status: "unreadable"`. Use `changed` to force the full CI depth on both
+pull requests and merge-queue runs. An unreadable snapshot never skips checks.
+
+The comparison includes Bun declarations, Node selectors and support ranges,
+resolved TypeScript compiler versions (including workspace and compatibility
+aliases), oxlint, oxlint-tsgolint, oxfmt, and shared tooling pins. Lockfile
+resolutions determine installed package versions; manifest ranges alone do not.
+Resolution locations and importer bindings are retained: swapping compiler
+versions between workspaces cannot look unchanged. Compiler specifier changes
+run parity even when the resolved release version is unchanged. Unknown lock
+shapes and ambiguous resolutions report an unreadable snapshot. Supported text
+locks include Bun JSONC (schema 0/1), pnpm YAML (5.4/6/9), npm package-lock/
+shrinkwrap (1/2/3), and bounded Yarn Classic/Berry shapes; a binary-only Bun lock
+cannot be compared without executing Bun.
+Workflow/action and Docker definition edits conservatively force full CI.
+Unrelated application dependency changes do not force compiler parity.
+Setup-action runtime selectors and their tracked version-file contents must
+identify an exact stable release (or a dated Rust nightly). Floating selectors,
+ranges, expressions, empty
+values, or omitted runtime versions report an unreadable snapshot and run parity
+even when their committed text is unchanged.
+
+On pull requests, run the repository's ordinary Bun typecheck and the probe,
+then select parity using the same detector:
+
+```sh
+stll-typecheck-probe --project packages/api/tsconfig.json --seed-dir packages/api/src -- bun run typecheck
+stll-typecheck-parity --changed-since origin/main --project packages/api/tsconfig.json
+```
+
+The probe writes an exclusive temporary TypeScript file in the declared
+project, requires the command to fail with TS2322 attributed to that file, removes
+it, and requires the clean command to pass. Use `--seed-dir` to select a repository-relative directory inside the project;
+the default is the config directory. The config must include the seed directory;
+excluded seeds fail instead of producing a vacuous pass. Commands are argv,
+not shell expressions. Cleanup also runs on failure and handled termination.
+Repeat the probe for independently checked projects as needed.
+
+Conditional parity runs when Bun, TypeScript, or shared declarations change;
+otherwise it prints `parity skipped: toolchain unchanged since ...`. An unreadable
+reference runs full parity. Nightly jobs omit `--changed-since` to run full parity.
+Node and lint-tool changes still force full CI through the shared detector.
+
+Workflow, composite-action, Docker, mise, and tool-version declarations are
+conservatively fingerprinted for compiler parity, including referenced tracked
+setup-action version files (Node, Bun, Python, Go, Java and other runtimes).
+Rust toolchain-file selectors and conventional runtime files are included;
+cache-dependency-path is not a runtime selector. Compose and Kubernetes image
+definitions are conservatively fingerprinted alongside Dockerfiles. Catalog and unresolved declaration changes also force parity;
+an unclassifiable reference runs full parity. This may run parity for unrelated
+edits to these declaration files. Active installed compiler comparisons still
+use the owning lockfile resolutions.
+
+Compiler patch declarations, lockfile patch hashes, and their tracked patch files
+are included even when the compiler version is unchanged. Compiler patch-package
+files are included too. Missing referenced compiler patches fail closed; unrelated
+package patches do not trigger compiler parity.
+
+Compiler manifest specifiers and complete compiler lock entries form part of the
+change identity, including resolved URLs, integrity, commits, checksums and patch
+hashes. Changing a source at the same release version runs parity. Local compiler
+sources without an immutable byte identity fail closed; a version alone does not
+identify a local directory. Git compiler sources require a full commit identity.
+Supported text locks include Bun, npm, pnpm and bounded
+Yarn Classic/Berry shapes; unrecognized lock shapes run parity. Yarn compiler
+`patch:` protocols are unsupported and run parity because their patch bytes are
+not represented by the lock checksum alone.

package/dist/cloud-setup-cli.cjs

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_toolchain_inputs = require("./toolchain-inputs.cjs");
 const require_toolchain_guard = require("./toolchain-guard.cjs");
+const require_toolchain_schema = require("./toolchain-schema.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 let node_fs_promises = require("node:fs/promises");
@@ -30,12 +32,12 @@ const main = async () => {
 	if (cloud === void 0) throw new Error("requires an explicit cloud declaration");
 	const nodeVersion = files[".node-version"];
 	if (nodeVersion === void 0) throw new Error("requires tracked root .node-version");
-	const script = require_toolchain_guard.generateCloudSetup({
-		policy: require_toolchain_guard.parseToolchainPolicy(JSON.parse(await (0, node_fs_promises.readFile)(new URL("../toolchain.json", require("url").pathToFileURL(__filename).href), "utf8"))),
+	const script = require_toolchain_inputs.generateCloudSetup({
+		policy: require_toolchain_schema.parseToolchainPolicy(JSON.parse(await (0, node_fs_promises.readFile)(new URL("../toolchain.json", require("url").pathToFileURL(__filename).href), "utf8"))),
 		cloud,
 		nodeVersion: nodeVersion.trim()
 	});
-	const destination = (0, node_path.join)(root, require_toolchain_guard.cloudSetupPath);
+	const destination = (0, node_path.join)(root, require_toolchain_inputs.cloudSetupPath);
 	const parent = (0, node_path.dirname)(destination);
 	const parentStat = await optionalStat(parent);
 	if (parentStat === void 0) await (0, node_fs_promises.mkdir)(parent);
@@ -52,7 +54,7 @@ const main = async () => {
 	} finally {
 		await output.close();
 	}
-	process.stdout.write(`Generated ${require_toolchain_guard.cloudSetupPath}\n`);
+	process.stdout.write(`Generated ${require_toolchain_inputs.cloudSetupPath}\n`);
 };
 main().catch((error) => {
 	process.stderr.write(`cloud-setup: ${error instanceof Error ? error.message : String(error)}\n`);

package/dist/cloud-setup-cli.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-setup-cli.cjs","names":["readToolchainInputs","parseToolchainConfiguration","generateCloudSetup","parseToolchainPolicy","cloudSetupPath","constants"],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { lstat, mkdir, open, readFile, realpath } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst optionalStat = async (path: string) => {\n  try {\n    return await lstat(path);\n  } catch (error) {\n    if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n      return undefined;\n    throw error;\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  if (diagnostics.length > 0)\n    throw new Error(\n      diagnostics.map(({ path, message }) => `${path}: ${message}`).join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud } = parseToolchainConfiguration(JSON.parse(text));\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n  });\n  const destination = join(root, cloudSetupPath);\n  const parent = dirname(destination);\n  const parentStat = await optionalStat(parent);\n  if (parentStat === undefined) await mkdir(parent);\n  else if (parentStat.isSymbolicLink() || !parentStat.isDirectory())\n    throw new Error(\"cloud setup parent must be a real repository directory\");\n  const destinationStat = await optionalStat(destination);\n  if (\n    destinationStat !== undefined &&\n    (destinationStat.isSymbolicLink() ||\n      !destinationStat.isFile() ||\n      destinationStat.nlink !== 1)\n  )\n    throw new Error(\n      \"cloud setup destination must be a single-link regular repository file\",\n    );\n  const output = await open(\n    destination,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW,\n    0o755,\n  );\n  try {\n    const opened = await output.stat();\n    if (!opened.isFile() || opened.nlink !== 1)\n      throw new Error(\n        \"cloud setup destination must be a single-link regular repository file\",\n      );\n    await output.truncate(0);\n    await output.writeFile(script, \"utf8\");\n    await output.chmod(0o755);\n  } finally {\n    await output.close();\n  }\n  process.stdout.write(`Generated ${cloudSetupPath}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;AAYA,MAAM,QACJ;AACF,MAAM,eAAe,OAAO,SAAiB;CAC3C,IAAI;EACF,OAAO,OAAA,GAAA,iBAAA,MAAA,CAAY,IAAI;CACzB,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;EACT,MAAM;CACR;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,OAAA,GAAA,iBAAA,SAAA,CAAe,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgBA,wBAAAA,oBAAoB,IAAI;CACvD,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,YAAY,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,CACzE;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,UAAUC,wBAAAA,4BAA4B,KAAK,MAAM,IAAI,CAAC;CAC9D,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CAMvD,MAAM,SAASC,wBAAAA,mBAAmB;EAChC,QANaC,wBAAAA,qBACb,KAAK,MACH,OAAA,GAAA,iBAAA,SAAA,CAAe,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CAGK;EACL;EACA,aAAa,YAAY,KAAK;CAChC,CAAC;CACD,MAAM,eAAA,GAAA,UAAA,KAAA,CAAmB,MAAMC,wBAAAA,cAAc;CAC7C,MAAM,UAAA,GAAA,UAAA,QAAA,CAAiB,WAAW;CAClC,MAAM,aAAa,MAAM,aAAa,MAAM;CAC5C,IAAI,eAAe,KAAA,GAAW,OAAA,GAAA,iBAAA,MAAA,CAAY,MAAM;MAC3C,IAAI,WAAW,eAAe,KAAK,CAAC,WAAW,YAAY,GAC9D,MAAM,IAAI,MAAM,wDAAwD;CAC1E,MAAM,kBAAkB,MAAM,aAAa,WAAW;CACtD,IACE,oBAAoB,KAAA,MACnB,gBAAgB,eAAe,KAC9B,CAAC,gBAAgB,OAAO,KACxB,gBAAgB,UAAU,IAE5B,MAAM,IAAI,MACR,uEACF;CACF,MAAM,SAAS,OAAA,GAAA,iBAAA,KAAA,CACb,aACAC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UAAUA,QAAAA,UAAU,YACnD,GACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,KAAK;EACjC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,uEACF;EACF,MAAM,OAAO,SAAS,CAAC;EACvB,MAAM,OAAO,UAAU,QAAQ,MAAM;EACrC,MAAM,OAAO,MAAM,GAAK;CAC1B,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;CACA,QAAQ,OAAO,MAAM,aAAaD,wBAAAA,eAAe,GAAG;AACtD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"cloud-setup-cli.cjs","names":["readToolchainInputs","parseToolchainConfiguration","generateCloudSetup","parseToolchainPolicy","cloudSetupPath","constants"],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { lstat, mkdir, open, readFile, realpath } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst optionalStat = async (path: string) => {\n  try {\n    return await lstat(path);\n  } catch (error) {\n    if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n      return undefined;\n    throw error;\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  if (diagnostics.length > 0)\n    throw new Error(\n      diagnostics.map(({ path, message }) => `${path}: ${message}`).join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud } = parseToolchainConfiguration(JSON.parse(text));\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n  });\n  const destination = join(root, cloudSetupPath);\n  const parent = dirname(destination);\n  const parentStat = await optionalStat(parent);\n  if (parentStat === undefined) await mkdir(parent);\n  else if (parentStat.isSymbolicLink() || !parentStat.isDirectory())\n    throw new Error(\"cloud setup parent must be a real repository directory\");\n  const destinationStat = await optionalStat(destination);\n  if (\n    destinationStat !== undefined &&\n    (destinationStat.isSymbolicLink() ||\n      !destinationStat.isFile() ||\n      destinationStat.nlink !== 1)\n  )\n    throw new Error(\n      \"cloud setup destination must be a single-link regular repository file\",\n    );\n  const output = await open(\n    destination,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW,\n    0o755,\n  );\n  try {\n    const opened = await output.stat();\n    if (!opened.isFile() || opened.nlink !== 1)\n      throw new Error(\n        \"cloud setup destination must be a single-link regular repository file\",\n      );\n    await output.truncate(0);\n    await output.writeFile(script, \"utf8\");\n    await output.chmod(0o755);\n  } finally {\n    await output.close();\n  }\n  process.stdout.write(`Generated ${cloudSetupPath}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;AAYA,MAAM,QACJ;AACF,MAAM,eAAe,OAAO,SAAiB;CAC3C,IAAI;EACF,OAAO,OAAA,GAAA,iBAAA,MAAA,CAAY,IAAI;CACzB,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;EACT,MAAM;CACR;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,OAAA,GAAA,iBAAA,SAAA,CAAe,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgBA,wBAAAA,oBAAoB,IAAI;CACvD,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,YAAY,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,CACzE;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,UAAUC,wBAAAA,4BAA4B,KAAK,MAAM,IAAI,CAAC;CAC9D,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CAMvD,MAAM,SAASC,yBAAAA,mBAAmB;EAChC,QANaC,yBAAAA,qBACb,KAAK,MACH,OAAA,GAAA,iBAAA,SAAA,CAAe,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CAGK;EACL;EACA,aAAa,YAAY,KAAK;CAChC,CAAC;CACD,MAAM,eAAA,GAAA,UAAA,KAAA,CAAmB,MAAMC,yBAAAA,cAAc;CAC7C,MAAM,UAAA,GAAA,UAAA,QAAA,CAAiB,WAAW;CAClC,MAAM,aAAa,MAAM,aAAa,MAAM;CAC5C,IAAI,eAAe,KAAA,GAAW,OAAA,GAAA,iBAAA,MAAA,CAAY,MAAM;MAC3C,IAAI,WAAW,eAAe,KAAK,CAAC,WAAW,YAAY,GAC9D,MAAM,IAAI,MAAM,wDAAwD;CAC1E,MAAM,kBAAkB,MAAM,aAAa,WAAW;CACtD,IACE,oBAAoB,KAAA,MACnB,gBAAgB,eAAe,KAC9B,CAAC,gBAAgB,OAAO,KACxB,gBAAgB,UAAU,IAE5B,MAAM,IAAI,MACR,uEACF;CACF,MAAM,SAAS,OAAA,GAAA,iBAAA,KAAA,CACb,aACAC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UAAUA,QAAAA,UAAU,YACnD,GACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,KAAK;EACjC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,uEACF;EACF,MAAM,OAAO,SAAS,CAAC;EACvB,MAAM,OAAO,UAAU,QAAQ,MAAM;EACrC,MAAM,OAAO,MAAM,GAAK;CAC1B,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;CACA,QAAQ,OAAO,MAAM,aAAaD,yBAAAA,eAAe,GAAG;AACtD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/cloud-setup-cli.mjs

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
-import { a as cloudSetupPath, i as parseToolchainPolicy, n as parseToolchainConfiguration, o as generateCloudSetup, r as readToolchainInputs } from "./toolchain-guard.mjs";
+import { m as generateCloudSetup, p as cloudSetupPath } from "./toolchain-inputs.mjs";
+import { n as parseToolchainConfiguration, r as readToolchainInputs } from "./toolchain-guard.mjs";
+import { t as parseToolchainPolicy } from "./toolchain-schema.mjs";
 import { constants } from "node:fs";
 import { dirname, join } from "node:path";
 import { lstat, mkdir, open, readFile, realpath } from "node:fs/promises";

package/dist/cloud-setup-cli.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-setup-cli.mjs","names":[],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { lstat, mkdir, open, readFile, realpath } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst optionalStat = async (path: string) => {\n  try {\n    return await lstat(path);\n  } catch (error) {\n    if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n      return undefined;\n    throw error;\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  if (diagnostics.length > 0)\n    throw new Error(\n      diagnostics.map(({ path, message }) => `${path}: ${message}`).join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud } = parseToolchainConfiguration(JSON.parse(text));\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n  });\n  const destination = join(root, cloudSetupPath);\n  const parent = dirname(destination);\n  const parentStat = await optionalStat(parent);\n  if (parentStat === undefined) await mkdir(parent);\n  else if (parentStat.isSymbolicLink() || !parentStat.isDirectory())\n    throw new Error(\"cloud setup parent must be a real repository directory\");\n  const destinationStat = await optionalStat(destination);\n  if (\n    destinationStat !== undefined &&\n    (destinationStat.isSymbolicLink() ||\n      !destinationStat.isFile() ||\n      destinationStat.nlink !== 1)\n  )\n    throw new Error(\n      \"cloud setup destination must be a single-link regular repository file\",\n    );\n  const output = await open(\n    destination,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW,\n    0o755,\n  );\n  try {\n    const opened = await output.stat();\n    if (!opened.isFile() || opened.nlink !== 1)\n      throw new Error(\n        \"cloud setup destination must be a single-link regular repository file\",\n      );\n    await output.truncate(0);\n    await output.writeFile(script, \"utf8\");\n    await output.chmod(0o755);\n  } finally {\n    await output.close();\n  }\n  process.stdout.write(`Generated ${cloudSetupPath}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;AAYA,MAAM,QACJ;AACF,MAAM,eAAe,OAAO,SAAiB;CAC3C,IAAI;EACF,OAAO,MAAM,MAAM,IAAI;CACzB,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;EACT,MAAM;CACR;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgB,oBAAoB,IAAI;CACvD,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,YAAY,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,CACzE;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,UAAU,4BAA4B,KAAK,MAAM,IAAI,CAAC;CAC9D,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CAMvD,MAAM,SAAS,mBAAmB;EAChC,QANa,qBACb,KAAK,MACH,MAAM,SAAS,IAAI,IAAI,qBAAqB,OAAO,KAAK,GAAG,GAAG,MAAM,CACtE,CAGK;EACL;EACA,aAAa,YAAY,KAAK;CAChC,CAAC;CACD,MAAM,cAAc,KAAK,MAAM,cAAc;CAC7C,MAAM,SAAS,QAAQ,WAAW;CAClC,MAAM,aAAa,MAAM,aAAa,MAAM;CAC5C,IAAI,eAAe,KAAA,GAAW,MAAM,MAAM,MAAM;MAC3C,IAAI,WAAW,eAAe,KAAK,CAAC,WAAW,YAAY,GAC9D,MAAM,IAAI,MAAM,wDAAwD;CAC1E,MAAM,kBAAkB,MAAM,aAAa,WAAW;CACtD,IACE,oBAAoB,KAAA,MACnB,gBAAgB,eAAe,KAC9B,CAAC,gBAAgB,OAAO,KACxB,gBAAgB,UAAU,IAE5B,MAAM,IAAI,MACR,uEACF;CACF,MAAM,SAAS,MAAM,KACnB,aACA,UAAU,WAAW,UAAU,UAAU,UAAU,YACnD,GACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,KAAK;EACjC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,uEACF;EACF,MAAM,OAAO,SAAS,CAAC;EACvB,MAAM,OAAO,UAAU,QAAQ,MAAM;EACrC,MAAM,OAAO,MAAM,GAAK;CAC1B,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;CACA,QAAQ,OAAO,MAAM,aAAa,eAAe,GAAG;AACtD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"cloud-setup-cli.mjs","names":[],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { lstat, mkdir, open, readFile, realpath } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst optionalStat = async (path: string) => {\n  try {\n    return await lstat(path);\n  } catch (error) {\n    if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n      return undefined;\n    throw error;\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  if (diagnostics.length > 0)\n    throw new Error(\n      diagnostics.map(({ path, message }) => `${path}: ${message}`).join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud } = parseToolchainConfiguration(JSON.parse(text));\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n  });\n  const destination = join(root, cloudSetupPath);\n  const parent = dirname(destination);\n  const parentStat = await optionalStat(parent);\n  if (parentStat === undefined) await mkdir(parent);\n  else if (parentStat.isSymbolicLink() || !parentStat.isDirectory())\n    throw new Error(\"cloud setup parent must be a real repository directory\");\n  const destinationStat = await optionalStat(destination);\n  if (\n    destinationStat !== undefined &&\n    (destinationStat.isSymbolicLink() ||\n      !destinationStat.isFile() ||\n      destinationStat.nlink !== 1)\n  )\n    throw new Error(\n      \"cloud setup destination must be a single-link regular repository file\",\n    );\n  const output = await open(\n    destination,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW,\n    0o755,\n  );\n  try {\n    const opened = await output.stat();\n    if (!opened.isFile() || opened.nlink !== 1)\n      throw new Error(\n        \"cloud setup destination must be a single-link regular repository file\",\n      );\n    await output.truncate(0);\n    await output.writeFile(script, \"utf8\");\n    await output.chmod(0o755);\n  } finally {\n    await output.close();\n  }\n  process.stdout.write(`Generated ${cloudSetupPath}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;AAYA,MAAM,QACJ;AACF,MAAM,eAAe,OAAO,SAAiB;CAC3C,IAAI;EACF,OAAO,MAAM,MAAM,IAAI;CACzB,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;EACT,MAAM;CACR;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgB,oBAAoB,IAAI;CACvD,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,YAAY,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,CACzE;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,UAAU,4BAA4B,KAAK,MAAM,IAAI,CAAC;CAC9D,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CAMvD,MAAM,SAAS,mBAAmB;EAChC,QANa,qBACb,KAAK,MACH,MAAM,SAAS,IAAI,IAAI,qBAAqB,OAAO,KAAK,GAAG,GAAG,MAAM,CACtE,CAGK;EACL;EACA,aAAa,YAAY,KAAK;CAChC,CAAC;CACD,MAAM,cAAc,KAAK,MAAM,cAAc;CAC7C,MAAM,SAAS,QAAQ,WAAW;CAClC,MAAM,aAAa,MAAM,aAAa,MAAM;CAC5C,IAAI,eAAe,KAAA,GAAW,MAAM,MAAM,MAAM;MAC3C,IAAI,WAAW,eAAe,KAAK,CAAC,WAAW,YAAY,GAC9D,MAAM,IAAI,MAAM,wDAAwD;CAC1E,MAAM,kBAAkB,MAAM,aAAa,WAAW;CACtD,IACE,oBAAoB,KAAA,MACnB,gBAAgB,eAAe,KAC9B,CAAC,gBAAgB,OAAO,KACxB,gBAAgB,UAAU,IAE5B,MAAM,IAAI,MACR,uEACF;CACF,MAAM,SAAS,MAAM,KACnB,aACA,UAAU,WAAW,UAAU,UAAU,UAAU,YACnD,GACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,KAAK;EACjC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,uEACF;EACF,MAAM,OAAO,SAAS,CAAC;EACvB,MAAM,OAAO,UAAU,QAAQ,MAAM;EACrC,MAAM,OAAO,MAAM,GAAK;CAC1B,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;CACA,QAAQ,OAAO,MAAM,aAAa,eAAe,GAAG;AACtD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/compiler-packages.cjs

@@ -0,0 +1,28 @@
+//#region src/compiler-packages.ts
+const compilerPackages = {
+	typescript: "typescript",
+	typescriptCompatibility: "@typescript/typescript6",
+	native: "@typescript/native",
+	nativePreview: "@typescript/native-preview",
+	typescriptCompatibilityAlias: "typescript-compat",
+	bunTypes: "bun-types",
+	typesBun: "@types/bun",
+	tsgo: "tsgo",
+	typescriptTsgo: "@typescript/tsgo"
+};
+const isCompilerPackage = (name) => Object.values(compilerPackages).some((identifier) => identifier === name) || name.startsWith("@typescript/native-");
+//#endregion
+Object.defineProperty(exports, "compilerPackages", {
+	enumerable: true,
+	get: function() {
+		return compilerPackages;
+	}
+});
+Object.defineProperty(exports, "isCompilerPackage", {
+	enumerable: true,
+	get: function() {
+		return isCompilerPackage;
+	}
+});
+
+//# sourceMappingURL=compiler-packages.cjs.map

package/dist/compiler-packages.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"compiler-packages.cjs","names":[],"sources":["../src/compiler-packages.ts"],"sourcesContent":["export const compilerPackages = {\n  typescript: \"typescript\",\n  typescriptCompatibility: \"@typescript/typescript6\",\n  native: \"@typescript/native\",\n  nativePreview: \"@typescript/native-preview\",\n  typescriptCompatibilityAlias: \"typescript-compat\",\n  bunTypes: \"bun-types\",\n  typesBun: \"@types/bun\",\n  tsgo: \"tsgo\",\n  typescriptTsgo: \"@typescript/tsgo\",\n} as const;\n\nexport const isCompilerPackage = (name: string) =>\n  Object.values(compilerPackages).some((identifier) => identifier === name) ||\n  name.startsWith(\"@typescript/native-\");\n"],"mappings":";AAAA,MAAa,mBAAmB;CAC9B,YAAY;CACZ,yBAAyB;CACzB,QAAQ;CACR,eAAe;CACf,8BAA8B;CAC9B,UAAU;CACV,UAAU;CACV,MAAM;CACN,gBAAgB;AAClB;AAEA,MAAa,qBAAqB,SAChC,OAAO,OAAO,gBAAgB,CAAC,CAAC,MAAM,eAAe,eAAe,IAAI,KACxE,KAAK,WAAW,qBAAqB"}

package/dist/compiler-packages.mjs

@@ -0,0 +1,17 @@
+//#region src/compiler-packages.ts
+const compilerPackages = {
+	typescript: "typescript",
+	typescriptCompatibility: "@typescript/typescript6",
+	native: "@typescript/native",
+	nativePreview: "@typescript/native-preview",
+	typescriptCompatibilityAlias: "typescript-compat",
+	bunTypes: "bun-types",
+	typesBun: "@types/bun",
+	tsgo: "tsgo",
+	typescriptTsgo: "@typescript/tsgo"
+};
+const isCompilerPackage = (name) => Object.values(compilerPackages).some((identifier) => identifier === name) || name.startsWith("@typescript/native-");
+//#endregion
+export { isCompilerPackage as n, compilerPackages as t };
+
+//# sourceMappingURL=compiler-packages.mjs.map

package/dist/compiler-packages.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"compiler-packages.mjs","names":[],"sources":["../src/compiler-packages.ts"],"sourcesContent":["export const compilerPackages = {\n  typescript: \"typescript\",\n  typescriptCompatibility: \"@typescript/typescript6\",\n  native: \"@typescript/native\",\n  nativePreview: \"@typescript/native-preview\",\n  typescriptCompatibilityAlias: \"typescript-compat\",\n  bunTypes: \"bun-types\",\n  typesBun: \"@types/bun\",\n  tsgo: \"tsgo\",\n  typescriptTsgo: \"@typescript/tsgo\",\n} as const;\n\nexport const isCompilerPackage = (name: string) =>\n  Object.values(compilerPackages).some((identifier) => identifier === name) ||\n  name.startsWith(\"@typescript/native-\");\n"],"mappings":";AAAA,MAAa,mBAAmB;CAC9B,YAAY;CACZ,yBAAyB;CACzB,QAAQ;CACR,eAAe;CACf,8BAA8B;CAC9B,UAAU;CACV,UAAU;CACV,MAAM;CACN,gBAAgB;AAClB;AAEA,MAAa,qBAAqB,SAChC,OAAO,OAAO,gBAAgB,CAAC,CAAC,MAAM,eAAe,eAAe,IAAI,KACxE,KAAK,WAAW,qBAAqB"}