@stll/oxlint-config 0.12.2 → 0.14.1

package/dist/toolchain-inputs.cjs

@@ -0,0 +1,926 @@
+const require_rolldown_runtime = require("./rolldown-runtime.cjs");
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let semver = require("semver");
+let picomatch = require("picomatch");
+picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
+//#region src/cloud-setup-install.ts
+const packageInstall = String.raw`
+# Prevent package maintainer scripts from starting unmanaged system services.
+apt_install() (
+  # EXIT runs after function locals expire; this subshell owns the trap state.
+  backup=''
+  policy_state=untouched
+  [[ ! -L /var/lock/stll-cloud-apt.lock ]] || fail 'Invalid package install lock'
+  exec 8>/var/lock/stll-cloud-apt.lock
+  flock -x -w 120 8 || fail 'Another package installation is active'
+  [[ ! -L /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy symlink'
+  [[ ! -e /usr/sbin/policy-rc.d || -f /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy file'
+  backup="$(mktemp -d)"
+  cleanup_package_policy() {
+    local status=$?
+    trap - EXIT HUP INT TERM
+    if [[ "$policy_state" == installed ]]; then
+      if [[ -f "$backup/original" ]]; then
+        if ! cp -p "$backup/original" /usr/sbin/policy-rc.d; then status=1; fi
+      else
+        if ! rm -f /usr/sbin/policy-rc.d; then status=1; fi
+      fi
+    fi
+    rm -rf -- "$backup"
+    exit "$status"
+  }
+  trap cleanup_package_policy EXIT
+  trap 'exit 129' HUP
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+  if [[ -e /usr/sbin/policy-rc.d ]]; then cp -p /usr/sbin/policy-rc.d "$backup/original"; fi
+  policy_state=installed
+  printf '%s\n' '#!/bin/sh' 'exit 101' > /usr/sbin/policy-rc.d
+  chmod 755 /usr/sbin/policy-rc.d
+  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$@"
+)
+
+`;
+const postgresSourceLine = "deb [signed-by=/usr/share/keyrings/stll-pgdg.asc] https://apt.postgresql.org/pub/repos/apt noble-pgdg main";
+const postgresSigningFingerprint = "B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8";
+const postgresSources = String.raw`
+pgdg_key_fingerprint() {
+  gpg --batch --show-keys --with-colons "$1" | awk -F: '$1 == "pub" { primary = 1 } $1 == "sub" { primary = 0 } $1 == "fpr" && primary { print toupper($10); primary = 0 }'
+}
+pgdg_sources_ready() {
+  local managed="$1" file mode records suite keyring override fingerprint selected_keyring=''
+  shift
+  PGDG_SOURCE_STATE=missing
+  [[ ! -L "$managed" ]] || fail "Managed PGDG source must not be a symlink: $managed"
+  for file in "$@"; do
+    [[ -e "$file" ]] || continue
+    [[ -f "$file" ]] || fail "APT source must be a regular file: $file"
+    case "$file" in *.sources) mode=sources ;; *) mode=list ;; esac
+    records="$(awk -v mode="$mode" '
+      function trim(value) { gsub(/^[[:space:]]+|[[:space:]]+$/, "", value); return value }
+      function pgdg_uri(uri) {
+        uri = tolower(uri)
+        if (uri !~ /^[a-z][a-z0-9+.-]*:\/\//) return 0
+        sub(/^[a-z][a-z0-9+.-]*:\/\//, "", uri)
+        sub(/[\/?#].*$/, "", uri)
+        sub(/^.*@/, "", uri)
+        sub(/:.*$/, "", uri)
+        return uri == "apt.postgresql.org" || uri == "apt.postgresql.org."
+      }
+      function contains_pgdg(value, tokens, count, token_index) {
+        count = split(value, tokens, /[[:space:]]+/)
+        for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) return 1
+        return 0
+      }
+      function unsafe_field(name) {
+        return name ~ /^(trusted|allow-insecure|allow-weak|allow-downgrade-to-insecure)$/
+      }
+      function disabled_override(value) {
+        value = tolower(trim(value))
+        gsub(/^["\047]|["\047]$/, "", value)
+        return value ~ /^(no|false|without|off|disable|0)$/
+      }
+      function stanza(override_index) {
+        override = 0
+        for (override_index = 1; override_index <= override_count; override_index++) {
+          if (!disabled_override(override_values[override_index])) override = 1
+          delete override_values[override_index]
+        }
+        if (tolower(trim(enabled)) != "no" && pgdg) print (trim(suites) == "" ? "-" : trim(suites)) "\t" (trim(keyring) == "" ? "-" : trim(keyring)) "\t" (override ? "unsafe" : "safe")
+        enabled = ""; pgdg = 0; field = ""; suites = ""; keyring = ""; override = 0; override_count = 0
+      }
+      /^[[:space:]]*#/ { if (mode == "list" || $0 ~ /^#/) next }
+      {
+        line = $0
+        if (mode == "list") {
+          sub(/[[:space:]]*#.*$/, "", line)
+          if (line !~ /^[[:space:]]*deb(-src)?[[:space:]]/ || !contains_pgdg(line)) next
+          keyring = ""; override = 0
+          if (match(line, /\[[^]]*\]/)) {
+            options = substr(line, RSTART + 1, RLENGTH - 2)
+            count = split(options, tokens, /[[:space:]]+/)
+            for (token_index = 1; token_index <= count; token_index++) {
+              if (tolower(tokens[token_index]) ~ /^signed-by=/) { keyring = tokens[token_index]; sub(/^[^=]*=/, "", keyring) }
+              option_name = tolower(tokens[token_index]); sub(/=.*/, "", option_name)
+              option_value = tokens[token_index]; sub(/^[^=]*=/, "", option_value)
+              if (unsafe_field(option_name) && !disabled_override(option_value)) override = 1
+            }
+            sub(/\[[^]]*\]/, "", line)
+          }
+          count = split(line, tokens, /[[:space:]]+/)
+          for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) print (tokens[token_index + 1] == "" ? "-" : tokens[token_index + 1]) "\t" (keyring == "" ? "-" : keyring) "\t" (override ? "unsafe" : "safe")
+          next
+        }
+        if (line ~ /^[[:space:]]*$/) { stanza(); next }
+        if (line ~ /^[[:space:]]/) {
+          if (field == "uris" && contains_pgdg(line)) pgdg = 1
+          if (field == "enabled") enabled = enabled " " line
+          if (field == "suites") suites = suites " " line
+          if (field == "signed-by") keyring = keyring " " line
+          if (unsafe_field(field)) override_values[override_count] = override_values[override_count] " " line
+          next
+        }
+        field = tolower(line)
+        sub(/:.*/, "", field)
+        value = line
+        sub(/^[^:]*:[[:space:]]*/, "", value)
+        if (field == "uris" && contains_pgdg(value)) pgdg = 1
+        if (field == "enabled") enabled = value
+        if (field == "suites") suites = value
+        if (field == "signed-by") keyring = value
+        if (unsafe_field(field)) override_values[++override_count] = value
+      }
+      END { if (mode == "sources") stanza() }
+    ' "$file")" || fail "Cannot inspect APT source: $file"
+    if [[ "$file" == "$managed" && -z "$records" ]]; then
+      fail "Managed PGDG source has no active PGDG entry: $file"
+    fi
+    while IFS=$'\t' read -r suite keyring override; do
+      [[ -n "$suite" ]] || continue
+      [[ "$override" == safe ]] || fail "PGDG source enables an unsafe trust override: $file"
+      [[ "$suite" == noble-pgdg && "$keyring" == /* && ! "$keyring" =~ [[:space:],] ]] || fail "PGDG source requires noble-pgdg and one Signed-By keyring: $file"
+      [[ -z "$selected_keyring" || "$selected_keyring" == "$keyring" ]] || fail "Conflicting PGDG Signed-By keyrings: $file"
+      fingerprint="$(pgdg_key_fingerprint "$keyring")" || fail "Cannot verify PGDG Signed-By keyring: $file"
+      [[ "$fingerprint" == @PGDG_FINGERPRINT@ ]] || fail "PGDG Signed-By fingerprint mismatch: $file"
+      selected_keyring="$keyring"
+      PGDG_SOURCE_STATE=reuse
+    done <<< "$records"
+  done
+}
+`;
+const postgresInstall = String.raw`
+  postgres_ready() {
+    local binary
+    for binary in postgres initdb pg_ctl psql createdb; do
+      [[ -x "/usr/lib/postgresql/@POSTGRES@/bin/$binary" ]] || return 1
+    done
+    /usr/lib/postgresql/@POSTGRES@/bin/postgres --version | grep -Eq '^postgres \(PostgreSQL\) @POSTGRES@\.'
+  }
+  if ! postgres_ready; then
+    pgdg_sources_ready /etc/apt/sources.list.d/stll-pgdg.list /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources
+    if [[ "$PGDG_SOURCE_STATE" == missing ]]; then
+      local key key_fingerprint
+      key="$(mktemp)"
+      curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 https://www.postgresql.org/media/keys/ACCC4CF8.asc -o "$key"
+      key_fingerprint="$(pgdg_key_fingerprint "$key")"
+      [[ "$key_fingerprint" == @PGDG_FINGERPRINT@ ]] || fail 'PostgreSQL signing key mismatch'
+      install -d -m 755 /usr/share/keyrings
+      install -m 644 "$key" /usr/share/keyrings/stll-pgdg.asc
+      rm -- "$key"
+      printf '%s\n' '@PGDG_SOURCE@' > /etc/apt/sources.list.d/stll-pgdg.list
+    fi
+    apt-get update
+    apt_install postgresql-@POSTGRES@ postgresql-client-@POSTGRES@
+  fi
+  postgres_ready || fail 'PostgreSQL toolchain is incomplete or differs from the policy major'
+`;
+const valkeyInstall = String.raw`
+  if ! command -v valkey-server >/dev/null || [[ "$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\1/p')" != '@VALKEY@' ]] || ! command -v valkey-cli >/dev/null || [[ "$(valkey-cli --version)" != 'valkey-cli @VALKEY@' ]]; then
+    local scratch server_url server_sha tools_url tools_sha package
+    scratch="$(mktemp -d)"
+    chmod 755 "$scratch"
+    case "$ARCH" in
+      amd64) server_url='@AMD64_SERVER_URL@'; server_sha='@AMD64_SERVER_SHA@'; tools_url='@AMD64_TOOLS_URL@'; tools_sha='@AMD64_TOOLS_SHA@' ;;
+      arm64) server_url='@ARM64_SERVER_URL@'; server_sha='@ARM64_SERVER_SHA@'; tools_url='@ARM64_TOOLS_URL@'; tools_sha='@ARM64_TOOLS_SHA@' ;;
+      *) fail 'Unsupported Valkey architecture' ;;
+    esac
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "$server_url" -o "$scratch/valkey-server.deb"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "$tools_url" -o "$scratch/valkey-tools.deb"
+    (cd "$scratch"; printf '%s  %s\n' "$server_sha" valkey-server.deb "$tools_sha" valkey-tools.deb | sha256sum --strict -c -)
+    for package in valkey-server valkey-tools; do
+      [[ "$(dpkg-deb -f "$scratch/$package.deb" Package)" == "$package" ]] || fail 'Valkey artifact package mismatch'
+      [[ "$(dpkg-deb -f "$scratch/$package.deb" Version)" == '@VALKEY@-1.noble' ]] || fail 'Valkey artifact version mismatch'
+      [[ "$(dpkg-deb -f "$scratch/$package.deb" Architecture)" == "$ARCH" ]] || fail 'Valkey artifact architecture mismatch'
+    done
+    apt-get update
+    apt_install "$scratch/valkey-server.deb" "$scratch/valkey-tools.deb"
+    rm -rf -- "$scratch"
+  fi
+  [[ "$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\1/p')" == '@VALKEY@' ]] || fail 'Valkey version differs from policy'
+  [[ "$(valkey-cli --version)" == 'valkey-cli @VALKEY@' ]] || fail 'Valkey client version differs from policy'
+`;
+const state = String.raw`
+service_account_ready() {
+  local uid gid shell
+  uid="$(id -u stll-cloud)" || fail 'Service user is unavailable; run install'
+  gid="$(id -g stll-cloud)"
+  shell="$(getent passwd stll-cloud | cut -d: -f7)"
+  [[ "$uid" =~ ^[1-9][0-9]*$ && "$gid" =~ ^[1-9][0-9]*$ && "$shell" == /usr/sbin/nologin ]] || fail 'Service user must be unprivileged with no login shell'
+}
+prepare_state() {
+  service_account_ready
+  [[ ! -L /var/lib/stll-cloud ]] || fail 'Service state root must not be a symlink'
+  if [[ -e /var/lib/stll-cloud ]]; then
+    [[ -d /var/lib/stll-cloud && "$(stat -c '%u:%a' /var/lib/stll-cloud)" == 0:755 ]] || fail 'Invalid service state root'
+  else
+    install -d -m 755 -o root -g root /var/lib/stll-cloud
+  fi
+  STATE="/var/lib/stll-cloud/$(printf '%s' "$REPO_ROOT" | sha256sum | cut -d' ' -f1)"
+  [[ ! -L "$STATE" ]] || fail 'Service state must not be a symlink'
+  if [[ -e "$STATE" ]]; then
+    [[ -d "$STATE" && "$(stat -c '%u:%a' "$STATE")" == 0:710 && "$(stat -c '%g' "$STATE")" == "$(id -g stll-cloud)" ]] || fail 'Invalid service state ownership'
+  else
+    install -d -m 710 -o root -g stll-cloud "$STATE"
+  fi
+  [[ ! -L "$STATE/lock" ]] || fail 'Service lock must not be a symlink'
+  exec 9>"$STATE/lock"
+  flock -x -w 10 9 || fail 'Another setup process owns the service state'
+}
+`;
+const renderCloudServiceInstall = ({ services, postgres, valkey, valkeyArtifacts }) => {
+	const parts = services.map((service) => {
+		switch (service) {
+			case "postgres": return postgresInstall.replaceAll("@POSTGRES@", postgres).replaceAll("@PGDG_SOURCE@", postgresSourceLine).replaceAll("@PGDG_FINGERPRINT@", postgresSigningFingerprint);
+			case "valkey": {
+				const replacements = /* @__PURE__ */ new Map([
+					["@VALKEY@", valkey],
+					["@AMD64_SERVER_URL@", valkeyArtifacts.amd64.server.url],
+					["@AMD64_SERVER_SHA@", valkeyArtifacts.amd64.server.sha256],
+					["@AMD64_TOOLS_URL@", valkeyArtifacts.amd64.tools.url],
+					["@AMD64_TOOLS_SHA@", valkeyArtifacts.amd64.tools.sha256],
+					["@ARM64_SERVER_URL@", valkeyArtifacts.arm64.server.url],
+					["@ARM64_SERVER_SHA@", valkeyArtifacts.arm64.server.sha256],
+					["@ARM64_TOOLS_URL@", valkeyArtifacts.arm64.tools.url],
+					["@ARM64_TOOLS_SHA@", valkeyArtifacts.arm64.tools.sha256]
+				]);
+				return valkeyInstall.replace(/@[A-Z0-9_]+@/g, (token) => {
+					const value = replacements.get(token);
+					if (value === void 0) throw new Error(`Missing Valkey artifact field: ${token}`);
+					return value;
+				});
+			}
+			default: throw new Error(`Unsupported service: ${String(service)}`);
+		}
+	});
+	const user = services.length === 0 ? "" : "  if ! id stll-cloud >/dev/null 2>&1; then useradd --system --user-group --no-create-home --shell /usr/sbin/nologin stll-cloud; fi\n  service_account_ready\n";
+	return `${packageInstall}\n${services.includes("postgres") ? postgresSources.replaceAll("@PGDG_FINGERPRINT@", postgresSigningFingerprint) : ""}\n${services.length === 0 ? "prepare_state() { :; }\n" : state}\ninstall_services() {\n${user}${parts.join("")}\n  :\n}\n`;
+};
+//#endregion
+//#region src/cloud-setup-schema.ts
+const cloudServices = ["postgres", "valkey"];
+const cloudInstallCommand = "bun install --frozen-lockfile";
+const cloudService = (value) => cloudServices.some((service) => value === service);
+/** Parse an explicit declaration without assuming services for undeclared repositories. */
+const parseCloudSetup = (input) => {
+	if (input === void 0) return void 0;
+	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error("cloud must be an object");
+	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile") throw new Error(`unsupported cloud key: ${key}`);
+	const selected = "services" in input ? input.services : [];
+	if (!Array.isArray(selected)) throw new Error("cloud.services must be an array when provided");
+	if (!("install" in input) || input.install !== "bun install --frozen-lockfile") throw new Error(`cloud.install must be exactly ${cloudInstallCommand}`);
+	const seen = /* @__PURE__ */ new Set();
+	const services = Array.from(selected, (service) => {
+		if (!cloudService(service)) throw new Error("cloud.services contains an unsupported service");
+		if (seen.has(service)) throw new Error(`cloud.services contains duplicate service: ${service}`);
+		seen.add(service);
+		return service;
+	});
+	if (services.length === 0) {
+		if ("envFile" in input) throw new Error("cloud.envFile is not allowed without services");
+		return {
+			services,
+			install: cloudInstallCommand
+		};
+	}
+	if (!("envFile" in input) || typeof input.envFile !== "string") throw new Error("cloud.envFile must be a canonical repository-relative path");
+	const envFile = input.envFile;
+	if (envFile.startsWith("/") || /^[A-Za-z]:/.test(envFile) || envFile.includes("\\") || /\p{Cc}/u.test(envFile) || envFile.split("/").some((part) => part === "" || part === "." || part === "..")) throw new Error("cloud.envFile must be a canonical repository-relative path");
+	return {
+		services,
+		install: cloudInstallCommand,
+		envFile
+	};
+};
+//#endregion
+//#region src/cloud-setup-services.ts
+const common = String.raw`
+service_file() {
+  local file="$1" owner="$2"
+  [[ ! -L "$file" ]] || fail "Service state must not contain symbolic links"
+  if [[ -e "$file" ]]; then
+    [[ -f "$file" && "$(stat -c '%u:%a' "$file")" == "$owner:600" ]] || fail "Invalid service state file"
+  fi
+}
+service_directory() {
+  local directory="$1"
+  [[ ! -L "$directory" ]] || fail "Service directory must not be a symbolic link"
+  if [[ -e "$directory" ]]; then
+    [[ -d "$directory" && "$(stat -c '%u:%a' "$directory")" == "$SERVICE_UID:700" ]] || fail "Invalid service directory"
+  else
+    root install -d -m 700 -o stll-cloud -g stll-cloud "$directory"
+  fi
+}
+service_password() {
+  local file="$1"
+  service_file "$file" 0
+  if [[ ! -e "$file" ]]; then
+    (umask 077; openssl rand -hex 32 > "$file")
+    root chown root:root "$file"
+  fi
+  [[ "$(cat "$file")" =~ ^[0-9a-f]{64}$ ]] || fail "Invalid service credential state"
+}
+service_process_matches() {
+  local pid="$1" executable="$2" owner actual expected
+  [[ "$pid" =~ ^[1-9][0-9]*$ && -d "/proc/$pid" ]] || return 1
+  owner="$(stat -c '%u' "/proc/$pid" 2>/dev/null)" || return 2
+  [[ "$owner" =~ ^[0-9]+$ ]] || return 2
+  [[ "$owner" == "$SERVICE_UID" ]] || return 1
+  actual="$(readlink -f "/proc/$pid/exe" 2>/dev/null)" || return 2
+  expected="$(readlink -f "$executable")" || return 2
+  [[ -n "$actual" && -n "$expected" && "$actual" != *' (deleted)' ]] || return 2
+  [[ "$actual" == "$expected" ]]
+}
+service_process() {
+  service_process_matches "$1" "$2" || fail "Managed service process identity differs from the recorded state"
+}
+service_prune_pid() {
+  local file="$1" executable="$2" service="$3" pid identity
+  [[ -e "$file" ]] || return 0
+  pid="$(head -n 1 "$file")"
+  # PostgreSQL encodes a standalone backend with a negative PID.
+  if [[ "$service" == postgres ]]; then pid="$(printf '%s' "$pid" | sed 's/^-//')"; fi
+  if service_process_matches "$pid" "$executable"; then return 0; else identity=$?; fi
+  [[ "$identity" != 2 ]] || fail "Cannot verify recorded live service process; retaining its PID file"
+  # Let PostgreSQL check orphan shared memory before removing a dead-PID lock.
+  if [[ "$service" == postgres && "$pid" =~ ^[1-9][0-9]*$ && ! -d "/proc/$pid" ]]; then return 0; fi
+  if [[ "$service" == postgres ]]; then
+    [[ "$pid" =~ ^[1-9][0-9]*$ && "$SERVICE_UID" != 0 ]] || fail "Cannot safely recover PostgreSQL PID state"
+    # The root controller is not our nonroot postgres. Preserve the remaining
+    # lock rows so PostgreSQL's EPERM/ancestor path still checks orphan memory.
+    root sed -i "1s/.*/$$/" "$file"
+    return 0
+  fi
+  # Restored state can name an unrelated live process; never signal that PID.
+  root rm -- "$file"
+}
+`;
+const postgresStart = String.raw`
+  local pg_bin='/usr/lib/postgresql/@POSTGRES@/bin' pg_data="$STATE/postgres" pg_password pg_details pg_pid pg_version
+  service_password "$STATE/postgres.password"
+  pg_password="$(cat "$STATE/postgres.password")"
+  service_directory "$pg_data"
+  for file in PG_VERSION postmaster.pid postgresql.conf pg_hba.conf pg_ident.conf postgresql.auto.conf; do
+    service_file "$pg_data/$file" "$SERVICE_UID"
+  done
+  if [[ ! -e "$pg_data/PG_VERSION" ]]; then
+    [[ -z "$(ls -A "$pg_data")" ]] || fail "PostgreSQL data directory is not initialized"
+    service_file "$STATE/postgres.init-password" "$SERVICE_UID"
+    (umask 077; printf '%s\n' "$pg_password" > "$STATE/postgres.init-password")
+    root chown stll-cloud:stll-cloud "$STATE/postgres.init-password"
+    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/initdb" -D "$pg_data" --username=stll_cloud --auth-host=scram-sha-256 --auth-local=scram-sha-256 --pwfile="$STATE/postgres.init-password" --encoding=UTF8 --locale=C --set=unix_socket_directories= >/dev/null || fail "PostgreSQL initialization failed"
+    root rm "$STATE/postgres.init-password"
+  fi
+  [[ -f "$pg_data/PG_VERSION" && "$(cat "$pg_data/PG_VERSION")" == '@POSTGRES@' ]] || fail "PostgreSQL data has a different major version"
+  service_prune_pid "$pg_data/postmaster.pid" "$pg_bin/postgres" postgres
+  if ! service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/pg_ctl" -D "$pg_data" status >/dev/null 2>&1; then
+    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/pg_ctl" -D "$pg_data" -l "$pg_data/cloud.log" -o "-h 127.0.0.1 -p 55432 -c unix_socket_directories=" -t 10 -w start >/dev/null || fail "PostgreSQL start failed; port 55432 must be available"
+  fi
+  pg_details="$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/psql" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c "SELECT current_setting('data_directory'), current_setting('listen_addresses'), current_setting('port'), current_setting('server_version_num'), current_setting('unix_socket_directories')")" || fail "PostgreSQL authenticated readiness failed"
+  pg_version="$(printf '%s\n' "$pg_details" | cut -d '|' -f4)"
+  [[ "$pg_details" == "$pg_data|127.0.0.1|55432|$pg_version|" && "$pg_version" =~ ^[0-9]{6}$ ]] || fail "PostgreSQL endpoint does not match managed data and listener"
+  (( pg_version / 10000 == @POSTGRES@ )) || fail "PostgreSQL endpoint has a different major version"
+  pg_pid="$(head -n 1 "$pg_data/postmaster.pid")"
+  service_process "$pg_pid" "$pg_bin/postgres"
+  [[ "$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/psql" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c "SELECT count(*) FROM pg_database WHERE datname = 'cloud_test'")" == 1 ]] || env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/createdb" -h 127.0.0.1 -p 55432 -U stll_cloud cloud_test || fail "PostgreSQL test database creation failed"
+  DATABASE_URL="postgresql://stll_cloud:$pg_password@127.0.0.1:55432/cloud_test"
+`;
+const valkeyStart = String.raw`
+  local vk_data="$STATE/valkey" vk_password vk_config vk_info vk_pid vk_expected ready=0
+  service_password "$STATE/valkey.password"
+  vk_password="$(cat "$STATE/valkey.password")"
+  service_directory "$vk_data"
+  vk_config="$vk_data/valkey.conf"
+  service_file "$vk_config" "$SERVICE_UID"
+  for file in valkey.pid valkey.log dump.rdb; do
+    [[ ! -L "$vk_data/$file" ]] || fail "Valkey state must not contain symbolic links"
+    if [[ -e "$vk_data/$file" ]]; then
+      [[ -f "$vk_data/$file" && "$(stat -c '%u' "$vk_data/$file")" == "$SERVICE_UID" ]] || fail "Invalid Valkey state file"
+    fi
+  done
+  vk_expected="$(printf '%s\n' 'bind 127.0.0.1' 'port 56379' 'protected-mode yes' 'daemonize yes' "requirepass $vk_password" "dir $vk_data" "pidfile $vk_data/valkey.pid" "logfile $vk_data/valkey.log" 'save ""' 'appendonly no')"
+  if [[ ! -e "$vk_config" ]]; then
+    (umask 077; printf '%s\n' "$vk_expected" > "$vk_config")
+    root chown stll-cloud:stll-cloud "$vk_config"
+  fi
+  [[ "$(cat "$vk_config")" == "$vk_expected" ]] || fail "Valkey configuration differs from managed settings"
+  service_prune_pid "$vk_data/valkey.pid" "$(command -v valkey-server)" valkey
+  if [[ ! -e "$vk_data/valkey.pid" ]]; then
+    service_run valkey-server "$vk_config" || fail "Valkey start failed; port 56379 must be available"
+  fi
+  for ((attempt=0; attempt<20; attempt++)); do
+    if vk_info="$(VALKEYCLI_AUTH="$vk_password" timeout 0.2 valkey-cli -h 127.0.0.1 -p 56379 --raw INFO server 2>/dev/null)"; then
+      if [[ "$vk_info" == *$'valkey_version:@VALKEY@\r\n'* && "$vk_info" == *"config_file:$vk_config"$'\r\n'* ]]; then ready=1; break; fi
+    fi
+    sleep 0.25
+  done
+  [[ "$ready" == 1 ]] || fail "Valkey authenticated readiness or managed version/configuration check failed"
+  [[ -f "$vk_data/valkey.pid" ]] || fail "Valkey managed process identifier is unavailable"
+  vk_pid="$(cat "$vk_data/valkey.pid")"
+  service_process "$vk_pid" "$(command -v valkey-server)"
+  [[ "$vk_info" == *"process_id:$vk_pid"$'\r\n'* ]] || fail "Valkey endpoint has a different process identifier"
+  [[ "$(VALKEYCLI_AUTH="$vk_password" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET bind)" == $'bind\n127.0.0.1' ]] || fail "Valkey endpoint must bind only loopback"
+  [[ "$(VALKEYCLI_AUTH="$vk_password" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET dir)" == "$(printf 'dir\n%s' "$vk_data")" ]] || fail "Valkey endpoint has a different data directory"
+  REDIS_URL="redis://:$vk_password@127.0.0.1:56379/0"
+`;
+/** Render only declared services; installation and environment-file ownership stay with the caller. */
+const renderCloudServiceStart = ({ services, postgres, valkey }) => {
+	if (!/^[1-9][0-9]*$/.test(postgres) || !/^\d+\.\d+\.\d+$/.test(valkey)) throw new Error("Invalid cloud service runtime policy");
+	if (services.length === 0) return "start_services() { :; }\n";
+	const bodies = services.map((service) => {
+		switch (service) {
+			case "postgres": return postgresStart.replaceAll("@POSTGRES@", postgres);
+			case "valkey": return valkeyStart.replaceAll("@VALKEY@", valkey);
+			default: throw new Error(`Unsupported cloud service: ${String(service)}`);
+		}
+	});
+	return `${common}\nstart_services() {\n  local SERVICE_UID file attempt\n  SERVICE_UID="$(id -u stll-cloud)"\n  [[ -d "$STATE" && ! -L "$STATE" && "$(stat -c '%u' "$STATE")" == 0 ]] || fail "Invalid cloud service state directory"\n${bodies.join("")}\n}\n`;
+};
+//#endregion
+//#region src/toolchain-node.ts
+const numericComponent = "(?:0|[1-9]\\d*)";
+const policyPattern = new RegExp(`^${numericComponent}\\.x$`);
+const selectorPattern = new RegExp(`^(${numericComponent})(?:\\.(?:x|${numericComponent}(?:\\.${numericComponent})?))?$`);
+/** A Node policy selects the complete stable release series of one major. */
+const nodePolicyValid = (value) => policyPattern.test(value) && (0, semver.validRange)(value) !== null;
+/** Static selectors may narrow that series, but cannot float across majors. */
+const nodeSelectorMatches = (value, policy) => {
+	if (!nodePolicyValid(policy) || typeof value !== "string") return false;
+	const major = selectorPattern.exec(value)?.[1];
+	return major !== void 0 && major === policy.slice(0, -2) && (0, semver.validRange)(value) !== null;
+};
+/** Engines must support every stable release in the approved major series. */
+const nodeSupportRangeMatches = (policy, range) => {
+	if (!nodePolicyValid(policy)) return false;
+	try {
+		return (0, semver.subset)(policy, range);
+	} catch {
+		return false;
+	}
+};
+//#endregion
+//#region src/cloud-setup.ts
+const cloudSetupPath = ".agents/cloud-setup.sh";
+const cloudEnvironmentMarker = "# Generated by stll-cloud-setup; disposable local test services.";
+const script = String.raw`#!/usr/bin/env bash
+# Generated by stll-cloud-setup. Regenerate with stll-cloud-setup.
+# Networked installation and offline service startup are separate lifecycle steps.
+# Cached filesystems may not preserve processes; run start at every session start.
+# Supported platform: Ubuntu 24.04 (noble), amd64/arm64, root or passwordless sudo.
+set -euo pipefail
+
+usage() { echo 'Usage: cloud-setup.sh install|start' >&2; exit 2; }
+[[ "$#" == 1 ]] || usage
+case "$1" in install|start) MODE="$1" ;; *) usage ;; esac
+fail() { echo "cloud-setup: $*" >&2; exit 1; }
+trap 'echo "cloud-setup: command failed at line $LINENO" >&2' ERR
+[[ -f /etc/os-release ]] || fail 'Ubuntu 24.04 is required'
+. /etc/os-release
+[[ "$ID" == ubuntu && "$VERSION_ID" == 24.04 && "$VERSION_CODENAME" == noble ]] || fail 'Only Ubuntu 24.04 (noble) is supported'
+SCRIPT="$(realpath -- "$0")"
+REPO_ROOT="$(cd -- "$(dirname -- "$SCRIPT")/.." && pwd -P)"
+[[ "$SCRIPT" == "$REPO_ROOT/.agents/cloud-setup.sh" ]] || fail 'Run the generated repository script'
+if [[ "$(id -u)" != 0 ]]; then
+  command -v sudo >/dev/null && sudo -n true || fail 'Root or passwordless sudo is required'
+  exec sudo -n -- bash "$SCRIPT" "$MODE"
+fi
+OUTPUT_UID="$(printenv SUDO_UID || id -u)"
+[[ "$OUTPUT_UID" =~ ^[0-9]+$ ]] || fail 'Invalid invoking user'
+OUTPUT_GID="$(getent passwd "$OUTPUT_UID" | cut -d: -f4)"
+[[ "$OUTPUT_GID" =~ ^[0-9]+$ ]] || fail 'Invoking user is unavailable'
+OUTPUT_USER="$(getent passwd "$OUTPUT_UID" | cut -d: -f1)"
+OUTPUT_HOME="$(getent passwd "$OUTPUT_UID" | cut -d: -f6)"
+[[ -n "$OUTPUT_USER" && "$OUTPUT_HOME" == /* && -d "$OUTPUT_HOME" ]] || fail 'Invoking user requires an existing home directory'
+root() { "$@"; }
+service_run() { runuser -u stll-cloud -- "$@" 9>&-; }
+BUN_VERSION='@BUN@'
+NODE_VERSION='@NODE@'
+NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
+BUN_DIR="/opt/stll-cloud/bun/$BUN_VERSION"
+export PATH="$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+BUN_CACHE="/var/cache/stll-cloud/bun/$OUTPUT_UID"
+@ENV_ASSIGNMENTS@
+[[ -f "$REPO_ROOT/.node-version" && ! -L "$REPO_ROOT/.node-version" ]] || fail 'A regular root .node-version is required'
+[[ "$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' "$REPO_ROOT/.node-version")" == "$NODE_VERSION" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'
+cd -- "$REPO_ROOT"
+case "$(uname -m)" in
+  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64 ;;
+  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64 ;;
+  *) fail 'Only amd64 and arm64 are supported' ;;
+esac
+
+runtime_ready() {
+  [[ -x "$NODE_DIR/bin/node" && "$($NODE_DIR/bin/node --version)" == "v$NODE_VERSION" ]] || fail 'Pinned Node is unavailable; run install'
+  [[ -x "$BUN_DIR/bun" && "$($BUN_DIR/bun --version)" == "$BUN_VERSION" ]] || fail 'Pinned Bun is unavailable; run install'
+}
+install_runtimes() {
+  if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null; then
+    apt-get update
+    DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux
+  fi
+  local scratch node_archive bun_archive bun_folder
+  scratch="$(mktemp -d)"
+  trap 'rm -rf -- "$scratch"' RETURN
+  if [[ ! -x "$NODE_DIR/bin/node" ]] || [[ "$($NODE_DIR/bin/node --version)" != "v$NODE_VERSION" ]]; then
+    node_archive="node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" -o "$scratch/$node_archive"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" -o "$scratch/node-sums"
+    (cd "$scratch"; awk -v name="$node_archive" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' node-sums | sha256sum --strict -c -)
+    install -d -m 755 "$NODE_DIR"
+    tar -xJf "$scratch/$node_archive" --strip-components=1 -C "$NODE_DIR"
+  fi
+  if [[ ! -x "$BUN_DIR/bun" ]] || [[ "$($BUN_DIR/bun --version)" != "$BUN_VERSION" ]]; then
+    bun_folder="bun-linux-$BUN_ARCH"
+    bun_archive="$bun_folder.zip"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/$bun_archive" -o "$scratch/$bun_archive"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/SHASUMS256.txt" -o "$scratch/bun-sums"
+    (cd "$scratch"; awk -v name="$bun_archive" '$2 == name || $2 == "*" name { print $1 "  " name; count++ } END { if (count != 1) exit 1 }' bun-sums | sha256sum --strict -c -)
+    unzip -q "$scratch/$bun_archive" -d "$scratch/bun"
+    install -d -m 755 "$BUN_DIR"
+    install -m 755 "$scratch/bun/$bun_folder/bun" "$BUN_DIR/bun"
+  fi
+  runtime_ready
+  ln -sfnT -- "$NODE_DIR/bin/node" /usr/local/bin/node
+  ln -sfnT -- "$NODE_DIR/bin/npm" /usr/local/bin/npm
+  ln -sfnT -- "$NODE_DIR/bin/npx" /usr/local/bin/npx
+  ln -sfnT -- "$BUN_DIR/bun" /usr/local/bin/bun
+  rm -rf -- "$scratch"
+  trap - RETURN
+}
+
+dependency_install() {
+  local directory
+  for directory in /var/cache/stll-cloud /var/cache/stll-cloud/bun; do
+    [[ ! -L "$directory" ]] || fail 'Dependency cache parent must not be a symlink'
+    if [[ -e "$directory" ]]; then
+      [[ -d "$directory" && "$(stat -c '%u' "$directory")" == 0 ]] || fail 'Dependency cache parent must be root-owned'
+    fi
+    install -d -m 755 -o root -g root "$directory"
+  done
+  [[ ! -L "$BUN_CACHE" ]] || fail 'Dependency cache must not be a symlink'
+  if [[ -e "$BUN_CACHE" ]]; then
+    [[ -d "$BUN_CACHE" && "$(stat -c '%u' "$BUN_CACHE")" == "$OUTPUT_UID" ]] || fail 'Dependency cache ownership differs from the invoking user'
+  fi
+  install -d -m 700 -o "$OUTPUT_UID" -g "$OUTPUT_GID" "$BUN_CACHE"
+  runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" BUN_INSTALL_CACHE_DIR="$BUN_CACHE" PATH="$PATH" "$BUN_DIR/bun" install --frozen-lockfile
+}
+
+@SERVICE_INSTALL@
+@SERVICE_START@
+
+@ENV_FUNCTIONS@
+
+if [[ "$MODE" == install ]]; then
+  install_runtimes
+  install_services
+  dependency_install
+  exit 0
+fi
+runtime_ready
+@ENV_VALIDATE@
+prepare_state
+start_services
+@ENV_WRITE@
+`;
+const environmentFunctions = String.raw`
+validate_environment() {
+  local part target="$REPO_ROOT" env_path="$REPO_ROOT/$ENV_FILE" first_line temporary
+  while IFS= read -r part; do
+    target="$target/$part"
+    [[ ! -L "$target" ]] || fail 'Environment path must not contain symbolic links'
+  done < <(printf '%s\n' "$ENV_FILE" | tr '/' '\n')
+  [[ -d "$(dirname -- "$env_path")" ]] || fail 'Environment parent directory is missing'
+  if [[ -e "$env_path" ]]; then
+    [[ -f "$env_path" ]] || fail 'Environment target must be a regular file'
+    IFS= read -r first_line < "$env_path" || fail 'Refusing to overwrite an unowned environment file'
+    [[ "$first_line" == "$ENV_MARKER" ]] || fail 'Refusing to overwrite an unowned environment file'
+  fi
+}
+write_environment() {
+  validate_environment
+  local env_path="$REPO_ROOT/$ENV_FILE" temporary
+  temporary="$(mktemp "$(dirname -- "$env_path")/.stll-cloud-env.XXXXXX")"
+  chmod 600 "$temporary"
+  {
+    printf '%s\n' "$ENV_MARKER" 'NODE_ENV=test'
+    if [[ -n "$DATABASE_URL" ]]; then printf 'DATABASE_URL=%s\n' "$DATABASE_URL"; fi
+    if [[ -n "$REDIS_URL" ]]; then printf 'REDIS_URL=%s\n' "$REDIS_URL"; fi
+  } > "$temporary"
+  chown "$OUTPUT_UID:$OUTPUT_GID" "$temporary"
+  mv -f -- "$temporary" "$env_path"
+}
+`;
+const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+const generateCloudSetup = ({ policy, cloud, nodeVersion }) => {
+	const selected = parseCloudSetup(cloud);
+	if (selected === void 0) throw new Error("cloud declaration is required");
+	const exactNode = nodeVersion.trim();
+	if ((0, semver.valid)(exactNode) !== exactNode || !nodeSelectorMatches(exactNode, policy.node)) throw new Error("cloud requires a tracked exact .node-version within the shared Node series");
+	const services = cloudServices.filter((service) => selected.services.includes(service));
+	const replacements = /* @__PURE__ */ new Map([
+		["@BUN@", policy.bun],
+		["@NODE@", exactNode],
+		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
+		["@ENV_FUNCTIONS@", selected.envFile === void 0 ? "" : environmentFunctions],
+		["@ENV_VALIDATE@", selected.envFile === void 0 ? "" : "DATABASE_URL=''\nREDIS_URL=''\nvalidate_environment"],
+		["@ENV_WRITE@", selected.envFile === void 0 ? "" : "write_environment"],
+		["@SERVICE_INSTALL@", renderCloudServiceInstall({
+			services,
+			postgres: policy.postgres,
+			valkey: policy.valkey,
+			valkeyArtifacts: policy.valkeyArtifacts
+		})],
+		["@SERVICE_START@", renderCloudServiceStart({
+			services,
+			postgres: policy.postgres,
+			valkey: policy.valkey
+		})]
+	]);
+	return script.replace(/@[A-Z0-9_]+@/g, (token) => {
+		const value = replacements.get(token);
+		if (value === void 0) throw new Error(`Missing cloud setup field: ${token}`);
+		return value;
+	});
+};
+//#endregion
+//#region src/toolchain-workspaces.ts
+/** Match manifest directories with the same positive and negative workspace patterns. */
+const workspaceContains = ({ directory, file, patterns, rootMembership }) => {
+	const relative = node_path.default.posix.relative(directory, node_path.default.posix.dirname(file));
+	if (relative === "" && rootMembership === "implicit") return true;
+	if (relative === ".." || relative.startsWith("../")) return false;
+	if (!Array.isArray(patterns)) return false;
+	const normalize = (pattern) => node_path.default.posix.normalize(pattern);
+	const selected = patterns.filter((value) => typeof value === "string");
+	return (0, picomatch.default)(selected.filter((pattern) => !pattern.startsWith("!")).map(normalize))(relative) && !(0, picomatch.default)(selected.filter((pattern) => pattern.startsWith("!")).map((pattern) => normalize(pattern.slice(1))))(relative);
+};
+//#endregion
+//#region src/toolchain-container-inputs.ts
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Filename class recognized by Dependabot's Docker Compose fetcher. */
+const isComposeDefinitionPath = (file) => /^\.?(?:docker-)?compose(?:-[\w]+)?(?:\.[\w-]+)?\.ya?ml$/i.test(file.split("/").at(-1) ?? "");
+/** Candidate YAML files are classified by their document shape after reading. */
+const isKubernetesDefinitionPath = (file) => /^[^.].*\.ya?ml$/i.test(file.split("/").at(-1) ?? "");
+const kubernetesPodSpecPaths = {
+	Pod: ["spec"],
+	Deployment: [
+		"spec",
+		"template",
+		"spec"
+	],
+	DaemonSet: [
+		"spec",
+		"template",
+		"spec"
+	],
+	StatefulSet: [
+		"spec",
+		"template",
+		"spec"
+	],
+	ReplicaSet: [
+		"spec",
+		"template",
+		"spec"
+	],
+	ReplicationController: [
+		"spec",
+		"template",
+		"spec"
+	],
+	Job: [
+		"spec",
+		"template",
+		"spec"
+	],
+	CronJob: [
+		"spec",
+		"jobTemplate",
+		"spec",
+		"template",
+		"spec"
+	]
+};
+/** Shared semantic image enumeration for runtime checks and update-root generation. */
+const containerDocumentImages = (document, file) => {
+	if (!record(document)) return void 0;
+	const services = document["services"];
+	if (isComposeDefinitionPath(file) && record(services)) {
+		const images = [];
+		for (const [name, service] of Object.entries(services)) if (record(service) && service["image"] !== void 0) images.push({
+			image: service["image"],
+			path: [
+				"services",
+				name,
+				"image"
+			]
+		});
+		return {
+			ecosystem: "docker-compose",
+			images
+		};
+	}
+	if (typeof document["apiVersion"] !== "string" || typeof document["kind"] !== "string") return void 0;
+	const images = [];
+	const visited = /* @__PURE__ */ new Set();
+	const walkResource = (resource, prefix) => {
+		if (visited.has(resource)) return;
+		visited.add(resource);
+		if (typeof resource["apiVersion"] !== "string" || typeof resource["kind"] !== "string") return;
+		if (resource["kind"] === "List" && Array.isArray(resource["items"])) {
+			for (const [index, item] of resource["items"].entries()) if (record(item)) walkResource(item, [
+				...prefix,
+				"items",
+				index
+			]);
+			return;
+		}
+		const specPath = Object.entries(kubernetesPodSpecPaths).find(([kind]) => kind === resource["kind"])?.[1];
+		if (specPath === void 0) return;
+		let spec = resource;
+		for (const key of specPath) spec = record(spec) ? spec[key] : void 0;
+		if (!record(spec)) return;
+		for (const key of [
+			"containers",
+			"initContainers",
+			"ephemeralContainers"
+		]) {
+			const containers = spec[key];
+			if (!Array.isArray(containers)) continue;
+			for (const [index, container] of containers.entries()) if (record(container) && container["image"] !== void 0) images.push({
+				image: container["image"],
+				path: [
+					...prefix,
+					...specPath,
+					key,
+					index,
+					"image"
+				]
+			});
+		}
+	};
+	walkResource(document, []);
+	return images.length === 0 ? void 0 : {
+		ecosystem: "docker",
+		images
+	};
+};
+//#endregion
+//#region src/toolchain-inputs.ts
+const excludedInputPath = (file) => file === "" || file.split("/").some((part) => part === "node_modules" || part === "vendor");
+const javascriptDependencyLockfiles = [
+	"bun.lock",
+	"package-lock.json",
+	"yarn.lock",
+	"pnpm-lock.yaml"
+];
+/** Match project, environment, local, and fragment filenames recognized by mise. */
+const isMiseConfigPath = (file) => !excludedInputPath(file) && (/(?:^|\/)\.?mise(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/config(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/conf\.d\/[^./][^/]*\.toml$/.test(file));
+/** GitHub action metadata may live at the repository root or in any directory. */
+const githubAutomationFileKind = (file) => {
+	if (file === "") return void 0;
+	if (/^\.github\/workflows\/[^/]+\.ya?ml$/.test(file)) return "workflow";
+	if (/(?:^|\/)action\.ya?ml$/.test(file)) return "action";
+};
+/** Dependabot updates workflows and repository-root action metadata. */
+const isDependabotGithubActionsPath = (file) => {
+	const kind = githubAutomationFileKind(file);
+	return kind === "workflow" || kind === "action" && !file.includes("/");
+};
+/** Use one filename discriminator for reader selection and Python ecosystem decisions. */
+const pythonDependencyManifestKind = (file) => {
+	if (excludedInputPath(file)) return void 0;
+	const name = file.split("/").at(-1);
+	if (name === "pyproject.toml") return "project";
+	if (name === "Pipfile") return "pipfile";
+	if (name === "Pipfile.lock") return "pipfile-lock";
+	if (name === "setup.py" || name === "setup.cfg") return "setup";
+	if (name !== void 0 && /^requirements[^/]*\.(?:txt|in)$/.test(name)) return "requirements";
+};
+const isPythonDependencyManifest = (file) => pythonDependencyManifestKind(file) !== void 0;
+/** Docker definition names use dot-delimited variants, excluding source and documentation. */
+const isDockerDefinitionPath = (file) => {
+	if (excludedInputPath(file)) return false;
+	const name = file.split("/").at(-1) ?? "";
+	if (/\.(?:[cm]?[jt]sx?|mdx?|rst|txt|html?|py|rs|go|java|sh|c|cc|cpp|cxx|h|hpp|cs|rb|php|swift|kt|css|scss)$/i.test(name)) return false;
+	return /^(?:[^./]+\.)*(?:dockerfile|containerfile)(?:\.[^./]+)*$/i.test(name);
+};
+/** Lockfiles establish ecosystem presence without reading their dependency graphs. */
+const toolchainInputKind = (file) => {
+	if (file === ".agents/cloud-setup.sh") return "config";
+	if (githubAutomationFileKind(file) !== void 0) return "config";
+	if (excludedInputPath(file)) return void 0;
+	if (pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
+	if (githubAutomationFileKind(file) !== void 0 || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|consumer-compat\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
+};
+//#endregion
+Object.defineProperty(exports, "cloudSetupPath", {
+	enumerable: true,
+	get: function() {
+		return cloudSetupPath;
+	}
+});
+Object.defineProperty(exports, "containerDocumentImages", {
+	enumerable: true,
+	get: function() {
+		return containerDocumentImages;
+	}
+});
+Object.defineProperty(exports, "generateCloudSetup", {
+	enumerable: true,
+	get: function() {
+		return generateCloudSetup;
+	}
+});
+Object.defineProperty(exports, "githubAutomationFileKind", {
+	enumerable: true,
+	get: function() {
+		return githubAutomationFileKind;
+	}
+});
+Object.defineProperty(exports, "isComposeDefinitionPath", {
+	enumerable: true,
+	get: function() {
+		return isComposeDefinitionPath;
+	}
+});
+Object.defineProperty(exports, "isDependabotGithubActionsPath", {
+	enumerable: true,
+	get: function() {
+		return isDependabotGithubActionsPath;
+	}
+});
+Object.defineProperty(exports, "isDockerDefinitionPath", {
+	enumerable: true,
+	get: function() {
+		return isDockerDefinitionPath;
+	}
+});
+Object.defineProperty(exports, "isKubernetesDefinitionPath", {
+	enumerable: true,
+	get: function() {
+		return isKubernetesDefinitionPath;
+	}
+});
+Object.defineProperty(exports, "isMiseConfigPath", {
+	enumerable: true,
+	get: function() {
+		return isMiseConfigPath;
+	}
+});
+Object.defineProperty(exports, "isPythonDependencyManifest", {
+	enumerable: true,
+	get: function() {
+		return isPythonDependencyManifest;
+	}
+});
+Object.defineProperty(exports, "javascriptDependencyLockfiles", {
+	enumerable: true,
+	get: function() {
+		return javascriptDependencyLockfiles;
+	}
+});
+Object.defineProperty(exports, "nodePolicyValid", {
+	enumerable: true,
+	get: function() {
+		return nodePolicyValid;
+	}
+});
+Object.defineProperty(exports, "nodeSelectorMatches", {
+	enumerable: true,
+	get: function() {
+		return nodeSelectorMatches;
+	}
+});
+Object.defineProperty(exports, "nodeSupportRangeMatches", {
+	enumerable: true,
+	get: function() {
+		return nodeSupportRangeMatches;
+	}
+});
+Object.defineProperty(exports, "parseCloudSetup", {
+	enumerable: true,
+	get: function() {
+		return parseCloudSetup;
+	}
+});
+Object.defineProperty(exports, "pythonDependencyManifestKind", {
+	enumerable: true,
+	get: function() {
+		return pythonDependencyManifestKind;
+	}
+});
+Object.defineProperty(exports, "toolchainInputKind", {
+	enumerable: true,
+	get: function() {
+		return toolchainInputKind;
+	}
+});
+Object.defineProperty(exports, "workspaceContains", {
+	enumerable: true,
+	get: function() {
+		return workspaceContains;
+	}
+});
+
+//# sourceMappingURL=toolchain-inputs.cjs.map