@stll/oxlint-config 0.12.2 → 0.14.1

package/dist/toolchain-inputs.mjs

@@ -0,0 +1,816 @@
+import path from "node:path";
+import { subset, valid, validRange } from "semver";
+import picomatch from "picomatch";
+//#region src/cloud-setup-install.ts
+const packageInstall = String.raw`
+# Prevent package maintainer scripts from starting unmanaged system services.
+apt_install() (
+  # EXIT runs after function locals expire; this subshell owns the trap state.
+  backup=''
+  policy_state=untouched
+  [[ ! -L /var/lock/stll-cloud-apt.lock ]] || fail 'Invalid package install lock'
+  exec 8>/var/lock/stll-cloud-apt.lock
+  flock -x -w 120 8 || fail 'Another package installation is active'
+  [[ ! -L /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy symlink'
+  [[ ! -e /usr/sbin/policy-rc.d || -f /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy file'
+  backup="$(mktemp -d)"
+  cleanup_package_policy() {
+    local status=$?
+    trap - EXIT HUP INT TERM
+    if [[ "$policy_state" == installed ]]; then
+      if [[ -f "$backup/original" ]]; then
+        if ! cp -p "$backup/original" /usr/sbin/policy-rc.d; then status=1; fi
+      else
+        if ! rm -f /usr/sbin/policy-rc.d; then status=1; fi
+      fi
+    fi
+    rm -rf -- "$backup"
+    exit "$status"
+  }
+  trap cleanup_package_policy EXIT
+  trap 'exit 129' HUP
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+  if [[ -e /usr/sbin/policy-rc.d ]]; then cp -p /usr/sbin/policy-rc.d "$backup/original"; fi
+  policy_state=installed
+  printf '%s\n' '#!/bin/sh' 'exit 101' > /usr/sbin/policy-rc.d
+  chmod 755 /usr/sbin/policy-rc.d
+  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$@"
+)
+
+`;
+const postgresSourceLine = "deb [signed-by=/usr/share/keyrings/stll-pgdg.asc] https://apt.postgresql.org/pub/repos/apt noble-pgdg main";
+const postgresSigningFingerprint = "B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8";
+const postgresSources = String.raw`
+pgdg_key_fingerprint() {
+  gpg --batch --show-keys --with-colons "$1" | awk -F: '$1 == "pub" { primary = 1 } $1 == "sub" { primary = 0 } $1 == "fpr" && primary { print toupper($10); primary = 0 }'
+}
+pgdg_sources_ready() {
+  local managed="$1" file mode records suite keyring override fingerprint selected_keyring=''
+  shift
+  PGDG_SOURCE_STATE=missing
+  [[ ! -L "$managed" ]] || fail "Managed PGDG source must not be a symlink: $managed"
+  for file in "$@"; do
+    [[ -e "$file" ]] || continue
+    [[ -f "$file" ]] || fail "APT source must be a regular file: $file"
+    case "$file" in *.sources) mode=sources ;; *) mode=list ;; esac
+    records="$(awk -v mode="$mode" '
+      function trim(value) { gsub(/^[[:space:]]+|[[:space:]]+$/, "", value); return value }
+      function pgdg_uri(uri) {
+        uri = tolower(uri)
+        if (uri !~ /^[a-z][a-z0-9+.-]*:\/\//) return 0
+        sub(/^[a-z][a-z0-9+.-]*:\/\//, "", uri)
+        sub(/[\/?#].*$/, "", uri)
+        sub(/^.*@/, "", uri)
+        sub(/:.*$/, "", uri)
+        return uri == "apt.postgresql.org" || uri == "apt.postgresql.org."
+      }
+      function contains_pgdg(value, tokens, count, token_index) {
+        count = split(value, tokens, /[[:space:]]+/)
+        for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) return 1
+        return 0
+      }
+      function unsafe_field(name) {
+        return name ~ /^(trusted|allow-insecure|allow-weak|allow-downgrade-to-insecure)$/
+      }
+      function disabled_override(value) {
+        value = tolower(trim(value))
+        gsub(/^["\047]|["\047]$/, "", value)
+        return value ~ /^(no|false|without|off|disable|0)$/
+      }
+      function stanza(override_index) {
+        override = 0
+        for (override_index = 1; override_index <= override_count; override_index++) {
+          if (!disabled_override(override_values[override_index])) override = 1
+          delete override_values[override_index]
+        }
+        if (tolower(trim(enabled)) != "no" && pgdg) print (trim(suites) == "" ? "-" : trim(suites)) "\t" (trim(keyring) == "" ? "-" : trim(keyring)) "\t" (override ? "unsafe" : "safe")
+        enabled = ""; pgdg = 0; field = ""; suites = ""; keyring = ""; override = 0; override_count = 0
+      }
+      /^[[:space:]]*#/ { if (mode == "list" || $0 ~ /^#/) next }
+      {
+        line = $0
+        if (mode == "list") {
+          sub(/[[:space:]]*#.*$/, "", line)
+          if (line !~ /^[[:space:]]*deb(-src)?[[:space:]]/ || !contains_pgdg(line)) next
+          keyring = ""; override = 0
+          if (match(line, /\[[^]]*\]/)) {
+            options = substr(line, RSTART + 1, RLENGTH - 2)
+            count = split(options, tokens, /[[:space:]]+/)
+            for (token_index = 1; token_index <= count; token_index++) {
+              if (tolower(tokens[token_index]) ~ /^signed-by=/) { keyring = tokens[token_index]; sub(/^[^=]*=/, "", keyring) }
+              option_name = tolower(tokens[token_index]); sub(/=.*/, "", option_name)
+              option_value = tokens[token_index]; sub(/^[^=]*=/, "", option_value)
+              if (unsafe_field(option_name) && !disabled_override(option_value)) override = 1
+            }
+            sub(/\[[^]]*\]/, "", line)
+          }
+          count = split(line, tokens, /[[:space:]]+/)
+          for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) print (tokens[token_index + 1] == "" ? "-" : tokens[token_index + 1]) "\t" (keyring == "" ? "-" : keyring) "\t" (override ? "unsafe" : "safe")
+          next
+        }
+        if (line ~ /^[[:space:]]*$/) { stanza(); next }
+        if (line ~ /^[[:space:]]/) {
+          if (field == "uris" && contains_pgdg(line)) pgdg = 1
+          if (field == "enabled") enabled = enabled " " line
+          if (field == "suites") suites = suites " " line
+          if (field == "signed-by") keyring = keyring " " line
+          if (unsafe_field(field)) override_values[override_count] = override_values[override_count] " " line
+          next
+        }
+        field = tolower(line)
+        sub(/:.*/, "", field)
+        value = line
+        sub(/^[^:]*:[[:space:]]*/, "", value)
+        if (field == "uris" && contains_pgdg(value)) pgdg = 1
+        if (field == "enabled") enabled = value
+        if (field == "suites") suites = value
+        if (field == "signed-by") keyring = value
+        if (unsafe_field(field)) override_values[++override_count] = value
+      }
+      END { if (mode == "sources") stanza() }
+    ' "$file")" || fail "Cannot inspect APT source: $file"
+    if [[ "$file" == "$managed" && -z "$records" ]]; then
+      fail "Managed PGDG source has no active PGDG entry: $file"
+    fi
+    while IFS=$'\t' read -r suite keyring override; do
+      [[ -n "$suite" ]] || continue
+      [[ "$override" == safe ]] || fail "PGDG source enables an unsafe trust override: $file"
+      [[ "$suite" == noble-pgdg && "$keyring" == /* && ! "$keyring" =~ [[:space:],] ]] || fail "PGDG source requires noble-pgdg and one Signed-By keyring: $file"
+      [[ -z "$selected_keyring" || "$selected_keyring" == "$keyring" ]] || fail "Conflicting PGDG Signed-By keyrings: $file"
+      fingerprint="$(pgdg_key_fingerprint "$keyring")" || fail "Cannot verify PGDG Signed-By keyring: $file"
+      [[ "$fingerprint" == @PGDG_FINGERPRINT@ ]] || fail "PGDG Signed-By fingerprint mismatch: $file"
+      selected_keyring="$keyring"
+      PGDG_SOURCE_STATE=reuse
+    done <<< "$records"
+  done
+}
+`;
+const postgresInstall = String.raw`
+  postgres_ready() {
+    local binary
+    for binary in postgres initdb pg_ctl psql createdb; do
+      [[ -x "/usr/lib/postgresql/@POSTGRES@/bin/$binary" ]] || return 1
+    done
+    /usr/lib/postgresql/@POSTGRES@/bin/postgres --version | grep -Eq '^postgres \(PostgreSQL\) @POSTGRES@\.'
+  }
+  if ! postgres_ready; then
+    pgdg_sources_ready /etc/apt/sources.list.d/stll-pgdg.list /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources
+    if [[ "$PGDG_SOURCE_STATE" == missing ]]; then
+      local key key_fingerprint
+      key="$(mktemp)"
+      curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 https://www.postgresql.org/media/keys/ACCC4CF8.asc -o "$key"
+      key_fingerprint="$(pgdg_key_fingerprint "$key")"
+      [[ "$key_fingerprint" == @PGDG_FINGERPRINT@ ]] || fail 'PostgreSQL signing key mismatch'
+      install -d -m 755 /usr/share/keyrings
+      install -m 644 "$key" /usr/share/keyrings/stll-pgdg.asc
+      rm -- "$key"
+      printf '%s\n' '@PGDG_SOURCE@' > /etc/apt/sources.list.d/stll-pgdg.list
+    fi
+    apt-get update
+    apt_install postgresql-@POSTGRES@ postgresql-client-@POSTGRES@
+  fi
+  postgres_ready || fail 'PostgreSQL toolchain is incomplete or differs from the policy major'
+`;
+const valkeyInstall = String.raw`
+  if ! command -v valkey-server >/dev/null || [[ "$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\1/p')" != '@VALKEY@' ]] || ! command -v valkey-cli >/dev/null || [[ "$(valkey-cli --version)" != 'valkey-cli @VALKEY@' ]]; then
+    local scratch server_url server_sha tools_url tools_sha package
+    scratch="$(mktemp -d)"
+    chmod 755 "$scratch"
+    case "$ARCH" in
+      amd64) server_url='@AMD64_SERVER_URL@'; server_sha='@AMD64_SERVER_SHA@'; tools_url='@AMD64_TOOLS_URL@'; tools_sha='@AMD64_TOOLS_SHA@' ;;
+      arm64) server_url='@ARM64_SERVER_URL@'; server_sha='@ARM64_SERVER_SHA@'; tools_url='@ARM64_TOOLS_URL@'; tools_sha='@ARM64_TOOLS_SHA@' ;;
+      *) fail 'Unsupported Valkey architecture' ;;
+    esac
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "$server_url" -o "$scratch/valkey-server.deb"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "$tools_url" -o "$scratch/valkey-tools.deb"
+    (cd "$scratch"; printf '%s  %s\n' "$server_sha" valkey-server.deb "$tools_sha" valkey-tools.deb | sha256sum --strict -c -)
+    for package in valkey-server valkey-tools; do
+      [[ "$(dpkg-deb -f "$scratch/$package.deb" Package)" == "$package" ]] || fail 'Valkey artifact package mismatch'
+      [[ "$(dpkg-deb -f "$scratch/$package.deb" Version)" == '@VALKEY@-1.noble' ]] || fail 'Valkey artifact version mismatch'
+      [[ "$(dpkg-deb -f "$scratch/$package.deb" Architecture)" == "$ARCH" ]] || fail 'Valkey artifact architecture mismatch'
+    done
+    apt-get update
+    apt_install "$scratch/valkey-server.deb" "$scratch/valkey-tools.deb"
+    rm -rf -- "$scratch"
+  fi
+  [[ "$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\1/p')" == '@VALKEY@' ]] || fail 'Valkey version differs from policy'
+  [[ "$(valkey-cli --version)" == 'valkey-cli @VALKEY@' ]] || fail 'Valkey client version differs from policy'
+`;
+const state = String.raw`
+service_account_ready() {
+  local uid gid shell
+  uid="$(id -u stll-cloud)" || fail 'Service user is unavailable; run install'
+  gid="$(id -g stll-cloud)"
+  shell="$(getent passwd stll-cloud | cut -d: -f7)"
+  [[ "$uid" =~ ^[1-9][0-9]*$ && "$gid" =~ ^[1-9][0-9]*$ && "$shell" == /usr/sbin/nologin ]] || fail 'Service user must be unprivileged with no login shell'
+}
+prepare_state() {
+  service_account_ready
+  [[ ! -L /var/lib/stll-cloud ]] || fail 'Service state root must not be a symlink'
+  if [[ -e /var/lib/stll-cloud ]]; then
+    [[ -d /var/lib/stll-cloud && "$(stat -c '%u:%a' /var/lib/stll-cloud)" == 0:755 ]] || fail 'Invalid service state root'
+  else
+    install -d -m 755 -o root -g root /var/lib/stll-cloud
+  fi
+  STATE="/var/lib/stll-cloud/$(printf '%s' "$REPO_ROOT" | sha256sum | cut -d' ' -f1)"
+  [[ ! -L "$STATE" ]] || fail 'Service state must not be a symlink'
+  if [[ -e "$STATE" ]]; then
+    [[ -d "$STATE" && "$(stat -c '%u:%a' "$STATE")" == 0:710 && "$(stat -c '%g' "$STATE")" == "$(id -g stll-cloud)" ]] || fail 'Invalid service state ownership'
+  else
+    install -d -m 710 -o root -g stll-cloud "$STATE"
+  fi
+  [[ ! -L "$STATE/lock" ]] || fail 'Service lock must not be a symlink'
+  exec 9>"$STATE/lock"
+  flock -x -w 10 9 || fail 'Another setup process owns the service state'
+}
+`;
+const renderCloudServiceInstall = ({ services, postgres, valkey, valkeyArtifacts }) => {
+	const parts = services.map((service) => {
+		switch (service) {
+			case "postgres": return postgresInstall.replaceAll("@POSTGRES@", postgres).replaceAll("@PGDG_SOURCE@", postgresSourceLine).replaceAll("@PGDG_FINGERPRINT@", postgresSigningFingerprint);
+			case "valkey": {
+				const replacements = /* @__PURE__ */ new Map([
+					["@VALKEY@", valkey],
+					["@AMD64_SERVER_URL@", valkeyArtifacts.amd64.server.url],
+					["@AMD64_SERVER_SHA@", valkeyArtifacts.amd64.server.sha256],
+					["@AMD64_TOOLS_URL@", valkeyArtifacts.amd64.tools.url],
+					["@AMD64_TOOLS_SHA@", valkeyArtifacts.amd64.tools.sha256],
+					["@ARM64_SERVER_URL@", valkeyArtifacts.arm64.server.url],
+					["@ARM64_SERVER_SHA@", valkeyArtifacts.arm64.server.sha256],
+					["@ARM64_TOOLS_URL@", valkeyArtifacts.arm64.tools.url],
+					["@ARM64_TOOLS_SHA@", valkeyArtifacts.arm64.tools.sha256]
+				]);
+				return valkeyInstall.replace(/@[A-Z0-9_]+@/g, (token) => {
+					const value = replacements.get(token);
+					if (value === void 0) throw new Error(`Missing Valkey artifact field: ${token}`);
+					return value;
+				});
+			}
+			default: throw new Error(`Unsupported service: ${String(service)}`);
+		}
+	});
+	const user = services.length === 0 ? "" : "  if ! id stll-cloud >/dev/null 2>&1; then useradd --system --user-group --no-create-home --shell /usr/sbin/nologin stll-cloud; fi\n  service_account_ready\n";
+	return `${packageInstall}\n${services.includes("postgres") ? postgresSources.replaceAll("@PGDG_FINGERPRINT@", postgresSigningFingerprint) : ""}\n${services.length === 0 ? "prepare_state() { :; }\n" : state}\ninstall_services() {\n${user}${parts.join("")}\n  :\n}\n`;
+};
+//#endregion
+//#region src/cloud-setup-schema.ts
+const cloudServices = ["postgres", "valkey"];
+const cloudInstallCommand = "bun install --frozen-lockfile";
+const cloudService = (value) => cloudServices.some((service) => value === service);
+/** Parse an explicit declaration without assuming services for undeclared repositories. */
+const parseCloudSetup = (input) => {
+	if (input === void 0) return void 0;
+	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error("cloud must be an object");
+	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile") throw new Error(`unsupported cloud key: ${key}`);
+	const selected = "services" in input ? input.services : [];
+	if (!Array.isArray(selected)) throw new Error("cloud.services must be an array when provided");
+	if (!("install" in input) || input.install !== "bun install --frozen-lockfile") throw new Error(`cloud.install must be exactly ${cloudInstallCommand}`);
+	const seen = /* @__PURE__ */ new Set();
+	const services = Array.from(selected, (service) => {
+		if (!cloudService(service)) throw new Error("cloud.services contains an unsupported service");
+		if (seen.has(service)) throw new Error(`cloud.services contains duplicate service: ${service}`);
+		seen.add(service);
+		return service;
+	});
+	if (services.length === 0) {
+		if ("envFile" in input) throw new Error("cloud.envFile is not allowed without services");
+		return {
+			services,
+			install: cloudInstallCommand
+		};
+	}
+	if (!("envFile" in input) || typeof input.envFile !== "string") throw new Error("cloud.envFile must be a canonical repository-relative path");
+	const envFile = input.envFile;
+	if (envFile.startsWith("/") || /^[A-Za-z]:/.test(envFile) || envFile.includes("\\") || /\p{Cc}/u.test(envFile) || envFile.split("/").some((part) => part === "" || part === "." || part === "..")) throw new Error("cloud.envFile must be a canonical repository-relative path");
+	return {
+		services,
+		install: cloudInstallCommand,
+		envFile
+	};
+};
+//#endregion
+//#region src/cloud-setup-services.ts
+const common = String.raw`
+service_file() {
+  local file="$1" owner="$2"
+  [[ ! -L "$file" ]] || fail "Service state must not contain symbolic links"
+  if [[ -e "$file" ]]; then
+    [[ -f "$file" && "$(stat -c '%u:%a' "$file")" == "$owner:600" ]] || fail "Invalid service state file"
+  fi
+}
+service_directory() {
+  local directory="$1"
+  [[ ! -L "$directory" ]] || fail "Service directory must not be a symbolic link"
+  if [[ -e "$directory" ]]; then
+    [[ -d "$directory" && "$(stat -c '%u:%a' "$directory")" == "$SERVICE_UID:700" ]] || fail "Invalid service directory"
+  else
+    root install -d -m 700 -o stll-cloud -g stll-cloud "$directory"
+  fi
+}
+service_password() {
+  local file="$1"
+  service_file "$file" 0
+  if [[ ! -e "$file" ]]; then
+    (umask 077; openssl rand -hex 32 > "$file")
+    root chown root:root "$file"
+  fi
+  [[ "$(cat "$file")" =~ ^[0-9a-f]{64}$ ]] || fail "Invalid service credential state"
+}
+service_process_matches() {
+  local pid="$1" executable="$2" owner actual expected
+  [[ "$pid" =~ ^[1-9][0-9]*$ && -d "/proc/$pid" ]] || return 1
+  owner="$(stat -c '%u' "/proc/$pid" 2>/dev/null)" || return 2
+  [[ "$owner" =~ ^[0-9]+$ ]] || return 2
+  [[ "$owner" == "$SERVICE_UID" ]] || return 1
+  actual="$(readlink -f "/proc/$pid/exe" 2>/dev/null)" || return 2
+  expected="$(readlink -f "$executable")" || return 2
+  [[ -n "$actual" && -n "$expected" && "$actual" != *' (deleted)' ]] || return 2
+  [[ "$actual" == "$expected" ]]
+}
+service_process() {
+  service_process_matches "$1" "$2" || fail "Managed service process identity differs from the recorded state"
+}
+service_prune_pid() {
+  local file="$1" executable="$2" service="$3" pid identity
+  [[ -e "$file" ]] || return 0
+  pid="$(head -n 1 "$file")"
+  # PostgreSQL encodes a standalone backend with a negative PID.
+  if [[ "$service" == postgres ]]; then pid="$(printf '%s' "$pid" | sed 's/^-//')"; fi
+  if service_process_matches "$pid" "$executable"; then return 0; else identity=$?; fi
+  [[ "$identity" != 2 ]] || fail "Cannot verify recorded live service process; retaining its PID file"
+  # Let PostgreSQL check orphan shared memory before removing a dead-PID lock.
+  if [[ "$service" == postgres && "$pid" =~ ^[1-9][0-9]*$ && ! -d "/proc/$pid" ]]; then return 0; fi
+  if [[ "$service" == postgres ]]; then
+    [[ "$pid" =~ ^[1-9][0-9]*$ && "$SERVICE_UID" != 0 ]] || fail "Cannot safely recover PostgreSQL PID state"
+    # The root controller is not our nonroot postgres. Preserve the remaining
+    # lock rows so PostgreSQL's EPERM/ancestor path still checks orphan memory.
+    root sed -i "1s/.*/$$/" "$file"
+    return 0
+  fi
+  # Restored state can name an unrelated live process; never signal that PID.
+  root rm -- "$file"
+}
+`;
+const postgresStart = String.raw`
+  local pg_bin='/usr/lib/postgresql/@POSTGRES@/bin' pg_data="$STATE/postgres" pg_password pg_details pg_pid pg_version
+  service_password "$STATE/postgres.password"
+  pg_password="$(cat "$STATE/postgres.password")"
+  service_directory "$pg_data"
+  for file in PG_VERSION postmaster.pid postgresql.conf pg_hba.conf pg_ident.conf postgresql.auto.conf; do
+    service_file "$pg_data/$file" "$SERVICE_UID"
+  done
+  if [[ ! -e "$pg_data/PG_VERSION" ]]; then
+    [[ -z "$(ls -A "$pg_data")" ]] || fail "PostgreSQL data directory is not initialized"
+    service_file "$STATE/postgres.init-password" "$SERVICE_UID"
+    (umask 077; printf '%s\n' "$pg_password" > "$STATE/postgres.init-password")
+    root chown stll-cloud:stll-cloud "$STATE/postgres.init-password"
+    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/initdb" -D "$pg_data" --username=stll_cloud --auth-host=scram-sha-256 --auth-local=scram-sha-256 --pwfile="$STATE/postgres.init-password" --encoding=UTF8 --locale=C --set=unix_socket_directories= >/dev/null || fail "PostgreSQL initialization failed"
+    root rm "$STATE/postgres.init-password"
+  fi
+  [[ -f "$pg_data/PG_VERSION" && "$(cat "$pg_data/PG_VERSION")" == '@POSTGRES@' ]] || fail "PostgreSQL data has a different major version"
+  service_prune_pid "$pg_data/postmaster.pid" "$pg_bin/postgres" postgres
+  if ! service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/pg_ctl" -D "$pg_data" status >/dev/null 2>&1; then
+    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/pg_ctl" -D "$pg_data" -l "$pg_data/cloud.log" -o "-h 127.0.0.1 -p 55432 -c unix_socket_directories=" -t 10 -w start >/dev/null || fail "PostgreSQL start failed; port 55432 must be available"
+  fi
+  pg_details="$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/psql" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c "SELECT current_setting('data_directory'), current_setting('listen_addresses'), current_setting('port'), current_setting('server_version_num'), current_setting('unix_socket_directories')")" || fail "PostgreSQL authenticated readiness failed"
+  pg_version="$(printf '%s\n' "$pg_details" | cut -d '|' -f4)"
+  [[ "$pg_details" == "$pg_data|127.0.0.1|55432|$pg_version|" && "$pg_version" =~ ^[0-9]{6}$ ]] || fail "PostgreSQL endpoint does not match managed data and listener"
+  (( pg_version / 10000 == @POSTGRES@ )) || fail "PostgreSQL endpoint has a different major version"
+  pg_pid="$(head -n 1 "$pg_data/postmaster.pid")"
+  service_process "$pg_pid" "$pg_bin/postgres"
+  [[ "$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/psql" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c "SELECT count(*) FROM pg_database WHERE datname = 'cloud_test'")" == 1 ]] || env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/createdb" -h 127.0.0.1 -p 55432 -U stll_cloud cloud_test || fail "PostgreSQL test database creation failed"
+  DATABASE_URL="postgresql://stll_cloud:$pg_password@127.0.0.1:55432/cloud_test"
+`;
+const valkeyStart = String.raw`
+  local vk_data="$STATE/valkey" vk_password vk_config vk_info vk_pid vk_expected ready=0
+  service_password "$STATE/valkey.password"
+  vk_password="$(cat "$STATE/valkey.password")"
+  service_directory "$vk_data"
+  vk_config="$vk_data/valkey.conf"
+  service_file "$vk_config" "$SERVICE_UID"
+  for file in valkey.pid valkey.log dump.rdb; do
+    [[ ! -L "$vk_data/$file" ]] || fail "Valkey state must not contain symbolic links"
+    if [[ -e "$vk_data/$file" ]]; then
+      [[ -f "$vk_data/$file" && "$(stat -c '%u' "$vk_data/$file")" == "$SERVICE_UID" ]] || fail "Invalid Valkey state file"
+    fi
+  done
+  vk_expected="$(printf '%s\n' 'bind 127.0.0.1' 'port 56379' 'protected-mode yes' 'daemonize yes' "requirepass $vk_password" "dir $vk_data" "pidfile $vk_data/valkey.pid" "logfile $vk_data/valkey.log" 'save ""' 'appendonly no')"
+  if [[ ! -e "$vk_config" ]]; then
+    (umask 077; printf '%s\n' "$vk_expected" > "$vk_config")
+    root chown stll-cloud:stll-cloud "$vk_config"
+  fi
+  [[ "$(cat "$vk_config")" == "$vk_expected" ]] || fail "Valkey configuration differs from managed settings"
+  service_prune_pid "$vk_data/valkey.pid" "$(command -v valkey-server)" valkey
+  if [[ ! -e "$vk_data/valkey.pid" ]]; then
+    service_run valkey-server "$vk_config" || fail "Valkey start failed; port 56379 must be available"
+  fi
+  for ((attempt=0; attempt<20; attempt++)); do
+    if vk_info="$(VALKEYCLI_AUTH="$vk_password" timeout 0.2 valkey-cli -h 127.0.0.1 -p 56379 --raw INFO server 2>/dev/null)"; then
+      if [[ "$vk_info" == *$'valkey_version:@VALKEY@\r\n'* && "$vk_info" == *"config_file:$vk_config"$'\r\n'* ]]; then ready=1; break; fi
+    fi
+    sleep 0.25
+  done
+  [[ "$ready" == 1 ]] || fail "Valkey authenticated readiness or managed version/configuration check failed"
+  [[ -f "$vk_data/valkey.pid" ]] || fail "Valkey managed process identifier is unavailable"
+  vk_pid="$(cat "$vk_data/valkey.pid")"
+  service_process "$vk_pid" "$(command -v valkey-server)"
+  [[ "$vk_info" == *"process_id:$vk_pid"$'\r\n'* ]] || fail "Valkey endpoint has a different process identifier"
+  [[ "$(VALKEYCLI_AUTH="$vk_password" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET bind)" == $'bind\n127.0.0.1' ]] || fail "Valkey endpoint must bind only loopback"
+  [[ "$(VALKEYCLI_AUTH="$vk_password" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET dir)" == "$(printf 'dir\n%s' "$vk_data")" ]] || fail "Valkey endpoint has a different data directory"
+  REDIS_URL="redis://:$vk_password@127.0.0.1:56379/0"
+`;
+/** Render only declared services; installation and environment-file ownership stay with the caller. */
+const renderCloudServiceStart = ({ services, postgres, valkey }) => {
+	if (!/^[1-9][0-9]*$/.test(postgres) || !/^\d+\.\d+\.\d+$/.test(valkey)) throw new Error("Invalid cloud service runtime policy");
+	if (services.length === 0) return "start_services() { :; }\n";
+	const bodies = services.map((service) => {
+		switch (service) {
+			case "postgres": return postgresStart.replaceAll("@POSTGRES@", postgres);
+			case "valkey": return valkeyStart.replaceAll("@VALKEY@", valkey);
+			default: throw new Error(`Unsupported cloud service: ${String(service)}`);
+		}
+	});
+	return `${common}\nstart_services() {\n  local SERVICE_UID file attempt\n  SERVICE_UID="$(id -u stll-cloud)"\n  [[ -d "$STATE" && ! -L "$STATE" && "$(stat -c '%u' "$STATE")" == 0 ]] || fail "Invalid cloud service state directory"\n${bodies.join("")}\n}\n`;
+};
+//#endregion
+//#region src/toolchain-node.ts
+const numericComponent = "(?:0|[1-9]\\d*)";
+const policyPattern = new RegExp(`^${numericComponent}\\.x$`);
+const selectorPattern = new RegExp(`^(${numericComponent})(?:\\.(?:x|${numericComponent}(?:\\.${numericComponent})?))?$`);
+/** A Node policy selects the complete stable release series of one major. */
+const nodePolicyValid = (value) => policyPattern.test(value) && validRange(value) !== null;
+/** Static selectors may narrow that series, but cannot float across majors. */
+const nodeSelectorMatches = (value, policy) => {
+	if (!nodePolicyValid(policy) || typeof value !== "string") return false;
+	const major = selectorPattern.exec(value)?.[1];
+	return major !== void 0 && major === policy.slice(0, -2) && validRange(value) !== null;
+};
+/** Engines must support every stable release in the approved major series. */
+const nodeSupportRangeMatches = (policy, range) => {
+	if (!nodePolicyValid(policy)) return false;
+	try {
+		return subset(policy, range);
+	} catch {
+		return false;
+	}
+};
+//#endregion
+//#region src/cloud-setup.ts
+const cloudSetupPath = ".agents/cloud-setup.sh";
+const cloudEnvironmentMarker = "# Generated by stll-cloud-setup; disposable local test services.";
+const script = String.raw`#!/usr/bin/env bash
+# Generated by stll-cloud-setup. Regenerate with stll-cloud-setup.
+# Networked installation and offline service startup are separate lifecycle steps.
+# Cached filesystems may not preserve processes; run start at every session start.
+# Supported platform: Ubuntu 24.04 (noble), amd64/arm64, root or passwordless sudo.
+set -euo pipefail
+
+usage() { echo 'Usage: cloud-setup.sh install|start' >&2; exit 2; }
+[[ "$#" == 1 ]] || usage
+case "$1" in install|start) MODE="$1" ;; *) usage ;; esac
+fail() { echo "cloud-setup: $*" >&2; exit 1; }
+trap 'echo "cloud-setup: command failed at line $LINENO" >&2' ERR
+[[ -f /etc/os-release ]] || fail 'Ubuntu 24.04 is required'
+. /etc/os-release
+[[ "$ID" == ubuntu && "$VERSION_ID" == 24.04 && "$VERSION_CODENAME" == noble ]] || fail 'Only Ubuntu 24.04 (noble) is supported'
+SCRIPT="$(realpath -- "$0")"
+REPO_ROOT="$(cd -- "$(dirname -- "$SCRIPT")/.." && pwd -P)"
+[[ "$SCRIPT" == "$REPO_ROOT/.agents/cloud-setup.sh" ]] || fail 'Run the generated repository script'
+if [[ "$(id -u)" != 0 ]]; then
+  command -v sudo >/dev/null && sudo -n true || fail 'Root or passwordless sudo is required'
+  exec sudo -n -- bash "$SCRIPT" "$MODE"
+fi
+OUTPUT_UID="$(printenv SUDO_UID || id -u)"
+[[ "$OUTPUT_UID" =~ ^[0-9]+$ ]] || fail 'Invalid invoking user'
+OUTPUT_GID="$(getent passwd "$OUTPUT_UID" | cut -d: -f4)"
+[[ "$OUTPUT_GID" =~ ^[0-9]+$ ]] || fail 'Invoking user is unavailable'
+OUTPUT_USER="$(getent passwd "$OUTPUT_UID" | cut -d: -f1)"
+OUTPUT_HOME="$(getent passwd "$OUTPUT_UID" | cut -d: -f6)"
+[[ -n "$OUTPUT_USER" && "$OUTPUT_HOME" == /* && -d "$OUTPUT_HOME" ]] || fail 'Invoking user requires an existing home directory'
+root() { "$@"; }
+service_run() { runuser -u stll-cloud -- "$@" 9>&-; }
+BUN_VERSION='@BUN@'
+NODE_VERSION='@NODE@'
+NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
+BUN_DIR="/opt/stll-cloud/bun/$BUN_VERSION"
+export PATH="$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+BUN_CACHE="/var/cache/stll-cloud/bun/$OUTPUT_UID"
+@ENV_ASSIGNMENTS@
+[[ -f "$REPO_ROOT/.node-version" && ! -L "$REPO_ROOT/.node-version" ]] || fail 'A regular root .node-version is required'
+[[ "$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' "$REPO_ROOT/.node-version")" == "$NODE_VERSION" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'
+cd -- "$REPO_ROOT"
+case "$(uname -m)" in
+  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64 ;;
+  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64 ;;
+  *) fail 'Only amd64 and arm64 are supported' ;;
+esac
+
+runtime_ready() {
+  [[ -x "$NODE_DIR/bin/node" && "$($NODE_DIR/bin/node --version)" == "v$NODE_VERSION" ]] || fail 'Pinned Node is unavailable; run install'
+  [[ -x "$BUN_DIR/bun" && "$($BUN_DIR/bun --version)" == "$BUN_VERSION" ]] || fail 'Pinned Bun is unavailable; run install'
+}
+install_runtimes() {
+  if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null; then
+    apt-get update
+    DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux
+  fi
+  local scratch node_archive bun_archive bun_folder
+  scratch="$(mktemp -d)"
+  trap 'rm -rf -- "$scratch"' RETURN
+  if [[ ! -x "$NODE_DIR/bin/node" ]] || [[ "$($NODE_DIR/bin/node --version)" != "v$NODE_VERSION" ]]; then
+    node_archive="node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" -o "$scratch/$node_archive"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" -o "$scratch/node-sums"
+    (cd "$scratch"; awk -v name="$node_archive" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' node-sums | sha256sum --strict -c -)
+    install -d -m 755 "$NODE_DIR"
+    tar -xJf "$scratch/$node_archive" --strip-components=1 -C "$NODE_DIR"
+  fi
+  if [[ ! -x "$BUN_DIR/bun" ]] || [[ "$($BUN_DIR/bun --version)" != "$BUN_VERSION" ]]; then
+    bun_folder="bun-linux-$BUN_ARCH"
+    bun_archive="$bun_folder.zip"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/$bun_archive" -o "$scratch/$bun_archive"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/SHASUMS256.txt" -o "$scratch/bun-sums"
+    (cd "$scratch"; awk -v name="$bun_archive" '$2 == name || $2 == "*" name { print $1 "  " name; count++ } END { if (count != 1) exit 1 }' bun-sums | sha256sum --strict -c -)
+    unzip -q "$scratch/$bun_archive" -d "$scratch/bun"
+    install -d -m 755 "$BUN_DIR"
+    install -m 755 "$scratch/bun/$bun_folder/bun" "$BUN_DIR/bun"
+  fi
+  runtime_ready
+  ln -sfnT -- "$NODE_DIR/bin/node" /usr/local/bin/node
+  ln -sfnT -- "$NODE_DIR/bin/npm" /usr/local/bin/npm
+  ln -sfnT -- "$NODE_DIR/bin/npx" /usr/local/bin/npx
+  ln -sfnT -- "$BUN_DIR/bun" /usr/local/bin/bun
+  rm -rf -- "$scratch"
+  trap - RETURN
+}
+
+dependency_install() {
+  local directory
+  for directory in /var/cache/stll-cloud /var/cache/stll-cloud/bun; do
+    [[ ! -L "$directory" ]] || fail 'Dependency cache parent must not be a symlink'
+    if [[ -e "$directory" ]]; then
+      [[ -d "$directory" && "$(stat -c '%u' "$directory")" == 0 ]] || fail 'Dependency cache parent must be root-owned'
+    fi
+    install -d -m 755 -o root -g root "$directory"
+  done
+  [[ ! -L "$BUN_CACHE" ]] || fail 'Dependency cache must not be a symlink'
+  if [[ -e "$BUN_CACHE" ]]; then
+    [[ -d "$BUN_CACHE" && "$(stat -c '%u' "$BUN_CACHE")" == "$OUTPUT_UID" ]] || fail 'Dependency cache ownership differs from the invoking user'
+  fi
+  install -d -m 700 -o "$OUTPUT_UID" -g "$OUTPUT_GID" "$BUN_CACHE"
+  runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" BUN_INSTALL_CACHE_DIR="$BUN_CACHE" PATH="$PATH" "$BUN_DIR/bun" install --frozen-lockfile
+}
+
+@SERVICE_INSTALL@
+@SERVICE_START@
+
+@ENV_FUNCTIONS@
+
+if [[ "$MODE" == install ]]; then
+  install_runtimes
+  install_services
+  dependency_install
+  exit 0
+fi
+runtime_ready
+@ENV_VALIDATE@
+prepare_state
+start_services
+@ENV_WRITE@
+`;
+const environmentFunctions = String.raw`
+validate_environment() {
+  local part target="$REPO_ROOT" env_path="$REPO_ROOT/$ENV_FILE" first_line temporary
+  while IFS= read -r part; do
+    target="$target/$part"
+    [[ ! -L "$target" ]] || fail 'Environment path must not contain symbolic links'
+  done < <(printf '%s\n' "$ENV_FILE" | tr '/' '\n')
+  [[ -d "$(dirname -- "$env_path")" ]] || fail 'Environment parent directory is missing'
+  if [[ -e "$env_path" ]]; then
+    [[ -f "$env_path" ]] || fail 'Environment target must be a regular file'
+    IFS= read -r first_line < "$env_path" || fail 'Refusing to overwrite an unowned environment file'
+    [[ "$first_line" == "$ENV_MARKER" ]] || fail 'Refusing to overwrite an unowned environment file'
+  fi
+}
+write_environment() {
+  validate_environment
+  local env_path="$REPO_ROOT/$ENV_FILE" temporary
+  temporary="$(mktemp "$(dirname -- "$env_path")/.stll-cloud-env.XXXXXX")"
+  chmod 600 "$temporary"
+  {
+    printf '%s\n' "$ENV_MARKER" 'NODE_ENV=test'
+    if [[ -n "$DATABASE_URL" ]]; then printf 'DATABASE_URL=%s\n' "$DATABASE_URL"; fi
+    if [[ -n "$REDIS_URL" ]]; then printf 'REDIS_URL=%s\n' "$REDIS_URL"; fi
+  } > "$temporary"
+  chown "$OUTPUT_UID:$OUTPUT_GID" "$temporary"
+  mv -f -- "$temporary" "$env_path"
+}
+`;
+const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+const generateCloudSetup = ({ policy, cloud, nodeVersion }) => {
+	const selected = parseCloudSetup(cloud);
+	if (selected === void 0) throw new Error("cloud declaration is required");
+	const exactNode = nodeVersion.trim();
+	if (valid(exactNode) !== exactNode || !nodeSelectorMatches(exactNode, policy.node)) throw new Error("cloud requires a tracked exact .node-version within the shared Node series");
+	const services = cloudServices.filter((service) => selected.services.includes(service));
+	const replacements = /* @__PURE__ */ new Map([
+		["@BUN@", policy.bun],
+		["@NODE@", exactNode],
+		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
+		["@ENV_FUNCTIONS@", selected.envFile === void 0 ? "" : environmentFunctions],
+		["@ENV_VALIDATE@", selected.envFile === void 0 ? "" : "DATABASE_URL=''\nREDIS_URL=''\nvalidate_environment"],
+		["@ENV_WRITE@", selected.envFile === void 0 ? "" : "write_environment"],
+		["@SERVICE_INSTALL@", renderCloudServiceInstall({
+			services,
+			postgres: policy.postgres,
+			valkey: policy.valkey,
+			valkeyArtifacts: policy.valkeyArtifacts
+		})],
+		["@SERVICE_START@", renderCloudServiceStart({
+			services,
+			postgres: policy.postgres,
+			valkey: policy.valkey
+		})]
+	]);
+	return script.replace(/@[A-Z0-9_]+@/g, (token) => {
+		const value = replacements.get(token);
+		if (value === void 0) throw new Error(`Missing cloud setup field: ${token}`);
+		return value;
+	});
+};
+//#endregion
+//#region src/toolchain-workspaces.ts
+/** Match manifest directories with the same positive and negative workspace patterns. */
+const workspaceContains = ({ directory, file, patterns, rootMembership }) => {
+	const relative = path.posix.relative(directory, path.posix.dirname(file));
+	if (relative === "" && rootMembership === "implicit") return true;
+	if (relative === ".." || relative.startsWith("../")) return false;
+	if (!Array.isArray(patterns)) return false;
+	const normalize = (pattern) => path.posix.normalize(pattern);
+	const selected = patterns.filter((value) => typeof value === "string");
+	return picomatch(selected.filter((pattern) => !pattern.startsWith("!")).map(normalize))(relative) && !picomatch(selected.filter((pattern) => pattern.startsWith("!")).map((pattern) => normalize(pattern.slice(1))))(relative);
+};
+//#endregion
+//#region src/toolchain-container-inputs.ts
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Filename class recognized by Dependabot's Docker Compose fetcher. */
+const isComposeDefinitionPath = (file) => /^\.?(?:docker-)?compose(?:-[\w]+)?(?:\.[\w-]+)?\.ya?ml$/i.test(file.split("/").at(-1) ?? "");
+/** Candidate YAML files are classified by their document shape after reading. */
+const isKubernetesDefinitionPath = (file) => /^[^.].*\.ya?ml$/i.test(file.split("/").at(-1) ?? "");
+const kubernetesPodSpecPaths = {
+	Pod: ["spec"],
+	Deployment: [
+		"spec",
+		"template",
+		"spec"
+	],
+	DaemonSet: [
+		"spec",
+		"template",
+		"spec"
+	],
+	StatefulSet: [
+		"spec",
+		"template",
+		"spec"
+	],
+	ReplicaSet: [
+		"spec",
+		"template",
+		"spec"
+	],
+	ReplicationController: [
+		"spec",
+		"template",
+		"spec"
+	],
+	Job: [
+		"spec",
+		"template",
+		"spec"
+	],
+	CronJob: [
+		"spec",
+		"jobTemplate",
+		"spec",
+		"template",
+		"spec"
+	]
+};
+/** Shared semantic image enumeration for runtime checks and update-root generation. */
+const containerDocumentImages = (document, file) => {
+	if (!record(document)) return void 0;
+	const services = document["services"];
+	if (isComposeDefinitionPath(file) && record(services)) {
+		const images = [];
+		for (const [name, service] of Object.entries(services)) if (record(service) && service["image"] !== void 0) images.push({
+			image: service["image"],
+			path: [
+				"services",
+				name,
+				"image"
+			]
+		});
+		return {
+			ecosystem: "docker-compose",
+			images
+		};
+	}
+	if (typeof document["apiVersion"] !== "string" || typeof document["kind"] !== "string") return void 0;
+	const images = [];
+	const visited = /* @__PURE__ */ new Set();
+	const walkResource = (resource, prefix) => {
+		if (visited.has(resource)) return;
+		visited.add(resource);
+		if (typeof resource["apiVersion"] !== "string" || typeof resource["kind"] !== "string") return;
+		if (resource["kind"] === "List" && Array.isArray(resource["items"])) {
+			for (const [index, item] of resource["items"].entries()) if (record(item)) walkResource(item, [
+				...prefix,
+				"items",
+				index
+			]);
+			return;
+		}
+		const specPath = Object.entries(kubernetesPodSpecPaths).find(([kind]) => kind === resource["kind"])?.[1];
+		if (specPath === void 0) return;
+		let spec = resource;
+		for (const key of specPath) spec = record(spec) ? spec[key] : void 0;
+		if (!record(spec)) return;
+		for (const key of [
+			"containers",
+			"initContainers",
+			"ephemeralContainers"
+		]) {
+			const containers = spec[key];
+			if (!Array.isArray(containers)) continue;
+			for (const [index, container] of containers.entries()) if (record(container) && container["image"] !== void 0) images.push({
+				image: container["image"],
+				path: [
+					...prefix,
+					...specPath,
+					key,
+					index,
+					"image"
+				]
+			});
+		}
+	};
+	walkResource(document, []);
+	return images.length === 0 ? void 0 : {
+		ecosystem: "docker",
+		images
+	};
+};
+//#endregion
+//#region src/toolchain-inputs.ts
+const excludedInputPath = (file) => file === "" || file.split("/").some((part) => part === "node_modules" || part === "vendor");
+const javascriptDependencyLockfiles = [
+	"bun.lock",
+	"package-lock.json",
+	"yarn.lock",
+	"pnpm-lock.yaml"
+];
+/** Match project, environment, local, and fragment filenames recognized by mise. */
+const isMiseConfigPath = (file) => !excludedInputPath(file) && (/(?:^|\/)\.?mise(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/config(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/conf\.d\/[^./][^/]*\.toml$/.test(file));
+/** GitHub action metadata may live at the repository root or in any directory. */
+const githubAutomationFileKind = (file) => {
+	if (file === "") return void 0;
+	if (/^\.github\/workflows\/[^/]+\.ya?ml$/.test(file)) return "workflow";
+	if (/(?:^|\/)action\.ya?ml$/.test(file)) return "action";
+};
+/** Dependabot updates workflows and repository-root action metadata. */
+const isDependabotGithubActionsPath = (file) => {
+	const kind = githubAutomationFileKind(file);
+	return kind === "workflow" || kind === "action" && !file.includes("/");
+};
+/** Use one filename discriminator for reader selection and Python ecosystem decisions. */
+const pythonDependencyManifestKind = (file) => {
+	if (excludedInputPath(file)) return void 0;
+	const name = file.split("/").at(-1);
+	if (name === "pyproject.toml") return "project";
+	if (name === "Pipfile") return "pipfile";
+	if (name === "Pipfile.lock") return "pipfile-lock";
+	if (name === "setup.py" || name === "setup.cfg") return "setup";
+	if (name !== void 0 && /^requirements[^/]*\.(?:txt|in)$/.test(name)) return "requirements";
+};
+const isPythonDependencyManifest = (file) => pythonDependencyManifestKind(file) !== void 0;
+/** Docker definition names use dot-delimited variants, excluding source and documentation. */
+const isDockerDefinitionPath = (file) => {
+	if (excludedInputPath(file)) return false;
+	const name = file.split("/").at(-1) ?? "";
+	if (/\.(?:[cm]?[jt]sx?|mdx?|rst|txt|html?|py|rs|go|java|sh|c|cc|cpp|cxx|h|hpp|cs|rb|php|swift|kt|css|scss)$/i.test(name)) return false;
+	return /^(?:[^./]+\.)*(?:dockerfile|containerfile)(?:\.[^./]+)*$/i.test(name);
+};
+/** Lockfiles establish ecosystem presence without reading their dependency graphs. */
+const toolchainInputKind = (file) => {
+	if (file === ".agents/cloud-setup.sh") return "config";
+	if (githubAutomationFileKind(file) !== void 0) return "config";
+	if (excludedInputPath(file)) return void 0;
+	if (pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
+	if (githubAutomationFileKind(file) !== void 0 || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|consumer-compat\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
+};
+//#endregion
+export { nodeSupportRangeMatches as _, isPythonDependencyManifest as a, toolchainInputKind as c, isKubernetesDefinitionPath as d, workspaceContains as f, nodeSelectorMatches as g, nodePolicyValid as h, isMiseConfigPath as i, containerDocumentImages as l, generateCloudSetup as m, isDependabotGithubActionsPath as n, javascriptDependencyLockfiles as o, cloudSetupPath as p, isDockerDefinitionPath as r, pythonDependencyManifestKind as s, githubAutomationFileKind as t, isComposeDefinitionPath as u, parseCloudSetup as v };
+
+//# sourceMappingURL=toolchain-inputs.mjs.map