@stll/oxlint-config 0.12.2 → 0.15.0

package/dist/consumer-compat-cli.cjs

@@ -0,0 +1,1091 @@
+#!/usr/bin/env node
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("./rolldown-runtime.cjs");
+const require_toolchain_schema = require("./toolchain-schema.cjs");
+const require_publish_contract = require("./publish-contract.cjs");
+let node_child_process = require("node:child_process");
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let semver = require("semver");
+let yaml = require("yaml");
+let node_util = require("node:util");
+let node_fs_promises = require("node:fs/promises");
+let node_module = require("node:module");
+let node_os = require("node:os");
+let acorn = require("acorn");
+let node_crypto = require("node:crypto");
+//#region src/consumer-build-approvals.ts
+const consumerBuildApprovals = async ({ manifest, lock, manager, directory }) => {
+	if (!require_toolchain_schema.consumerRecord(lock)) throw new Error("invalid consumer dependency lock");
+	const approvals = {};
+	const rebuildTargets = /* @__PURE__ */ new Set();
+	for (const field of [
+		"dependencies",
+		"devDependencies",
+		"optionalDependencies"
+	]) {
+		const entries = manifest[field];
+		if (entries === void 0) continue;
+		if (!require_toolchain_schema.consumerRecord(entries)) throw new Error(`invalid fixture ${field}`);
+		for (const key of Object.keys(entries)) {
+			const packages = lock["packages"];
+			const importers = lock["importers"];
+			const importer = require_toolchain_schema.consumerRecord(importers) ? importers["."] : void 0;
+			const dependencies = require_toolchain_schema.consumerRecord(importer) ? importer[field] : void 0;
+			const dependencyTable = manager === "npm" ? packages : dependencies;
+			const installedKey = manager === "npm" ? `node_modules/${key}` : key;
+			const dependency = require_toolchain_schema.consumerRecord(dependencyTable) ? dependencyTable[installedKey] : void 0;
+			if (!require_toolchain_schema.consumerRecord(dependency)) {
+				if (field === "optionalDependencies") continue;
+				throw new Error(`missing resolved fixture dependency identity: ${key}`);
+			}
+			const installedDirectory = node_path.default.join(directory, "node_modules", key);
+			if (field === "optionalDependencies") try {
+				await (0, node_fs_promises.lstat)(installedDirectory);
+			} catch (error) {
+				if (error instanceof Error && "code" in error && error.code === "ENOENT") continue;
+				throw error;
+			}
+			const installed = JSON.parse(await (0, node_fs_promises.readFile)(node_path.default.join(installedDirectory, "package.json"), "utf8"));
+			if (!require_toolchain_schema.consumerRecord(installed) || typeof installed["name"] !== "string" || installed["name"] === "" || typeof installed["version"] !== "string" || (0, semver.valid)(installed["version"]) === null) throw new Error(`invalid installed fixture dependency identity: ${key}`);
+			const identity = `${installed["name"]}@${installed["version"]}`;
+			rebuildTargets.add(await (0, node_fs_promises.realpath)(installedDirectory));
+			const resolved = dependency["resolved"];
+			if (manager === "npm" && typeof resolved === "string" && !resolved.startsWith("https://registry.npmjs.org/")) approvals[resolved.startsWith("file:") ? resolved : `file:${resolved}`] = true;
+			else {
+				const version = dependency["version"];
+				const source = manager === "pnpm" && typeof version === "string" && version.startsWith("file:") ? version.replace(/\([^)]*\)/g, "") : void 0;
+				approvals[source === void 0 ? identity : `${installed["name"]}@${source}`] = true;
+			}
+		}
+	}
+	return {
+		approvals,
+		rebuildTargets: [...rebuildTargets]
+	};
+};
+//#endregion
+//#region src/consumer-installed-bins.ts
+const consumerReservedToolBins = [
+	"node",
+	"npm",
+	"npx",
+	"pnpm"
+];
+const missing = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
+/** Dependency lifecycle PATHs include nested and virtual-store node_modules bins. */
+const assertConsumerInstalledToolBins = async (directory) => {
+	const root = await (0, node_fs_promises.realpath)(directory);
+	const visited = /* @__PURE__ */ new Set();
+	const assertContained = (canonical) => {
+		const relative = node_path.default.relative(root, canonical);
+		if (relative === ".." || relative.startsWith(`..${node_path.default.sep}`) || node_path.default.isAbsolute(relative)) throw new Error("installed consumer dependency path must stay within the fixture");
+	};
+	const visit = async (location) => {
+		const canonical = await (0, node_fs_promises.realpath)(location);
+		assertContained(canonical);
+		if (node_path.default.basename(location) === ".bin" && node_path.default.basename(node_path.default.dirname(location)) === "node_modules") for (const name of consumerReservedToolBins) {
+			try {
+				await (0, node_fs_promises.lstat)(node_path.default.join(location, name));
+			} catch (error) {
+				if (missing(error)) continue;
+				throw error;
+			}
+			throw new Error(`installed consumer binary ${name} conflicts with the pinned tool before lifecycle scripts`);
+		}
+		if (visited.has(canonical)) return;
+		visited.add(canonical);
+		for (const entry of await (0, node_fs_promises.readdir)(canonical, { withFileTypes: true })) if (entry.isDirectory()) await visit(node_path.default.join(canonical, entry.name));
+		else if (entry.isSymbolicLink()) {
+			const target = await (0, node_fs_promises.realpath)(node_path.default.join(canonical, entry.name));
+			assertContained(target);
+			if ((await (0, node_fs_promises.lstat)(target)).isDirectory()) await visit(node_path.default.join(canonical, entry.name));
+		}
+	};
+	const modules = node_path.default.join(root, "node_modules");
+	try {
+		await (0, node_fs_promises.lstat)(modules);
+	} catch (error) {
+		if (missing(error)) return;
+		throw error;
+	}
+	await visit(modules);
+};
+//#endregion
+//#region src/consumer-react.ts
+const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const publishedVersions = ({ versions, range }) => {
+	if (!(0, semver.validRange)(range)) throw new Error(`invalid consumer peer range: ${range}`);
+	const candidates = Object.keys(versions).filter((version) => (0, semver.valid)(version) !== null && (0, semver.satisfies)(version, range)).sort(semver.compare);
+	if (candidates.length === 0) throw new Error(`no published consumer version satisfies ${range}`);
+	return candidates;
+};
+/** Select the oldest published React with a compatible allowed renderer when required. */
+const selectConsumerReactVersions = ({ reactRange, reactVersions, dom }) => {
+	const reactCandidates = publishedVersions({
+		versions: reactVersions,
+		range: reactRange
+	});
+	if (dom === void 0) {
+		const react = reactCandidates.at(0);
+		if (react === void 0) throw new Error("Missing React version candidate");
+		return { react };
+	}
+	const domRange = dom.range ?? "*";
+	const domCandidates = publishedVersions({
+		versions: dom.versions,
+		range: domRange
+	});
+	for (const react of reactCandidates) {
+		const renderer = domCandidates.find((version) => {
+			const metadata = dom.versions[version];
+			if (!record$1(metadata) || !record$1(metadata["peerDependencies"])) return false;
+			const range = metadata["peerDependencies"]["react"];
+			return typeof range === "string" && (0, semver.validRange)(range) !== null && (0, semver.satisfies)(react, range);
+		});
+		if (renderer !== void 0) return {
+			react,
+			"react-dom": renderer
+		};
+	}
+	throw new Error(`no published React/ReactDOM pair satisfies React ${reactRange} and ReactDOM ${domRange}`);
+};
+//#endregion
+//#region src/publish-artifact-syntax.ts
+const command = (0, node_util.promisify)(node_child_process.execFile);
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const javascript = /\.(?:js|mjs|cjs)$/i;
+const syntaxYears = new Map(Object.entries({
+	es5: 5,
+	es2015: 2015,
+	es2016: 2016,
+	es2017: 2017,
+	es2018: 2018,
+	es2019: 2019,
+	es2020: 2020,
+	es2021: 2021,
+	es2022: 2022,
+	es2023: 2023,
+	es2024: 2024,
+	es2025: 2025
+}));
+/** Explicit ECMAScript targets bound syntax; unbounded targets use native Node. */
+const artifactEcmaVersion = ({ target, node }) => {
+	if (target.type === "types-only") return "latest";
+	if (target.targets.length === 0) throw new Error("Packed JavaScript requires a declared target");
+	let version = "latest";
+	for (const identifier of target.targets) {
+		if (identifier === "esnext") continue;
+		const year = syntaxYears.get(identifier);
+		if (year !== void 0) {
+			if (version === "latest" || year < version) version = year;
+			continue;
+		}
+		if (require_publish_contract.publishedNodeTargetSupportsConsumer({
+			target: identifier,
+			node
+		})) continue;
+		throw new Error(`Unsupported packed JavaScript syntax target ${identifier}; use an explicit ECMAScript year or a supported Node target`);
+	}
+	return version;
+};
+const packedBinFiles = (files) => {
+	const result = /* @__PURE__ */ new Set();
+	for (const [file, source] of files) {
+		if (node_path.default.posix.basename(file) !== "package.json") continue;
+		const manifest = JSON.parse(source);
+		if (!record(manifest)) throw new Error(`Invalid packed manifest: ${file}`);
+		const bin = manifest["bin"];
+		if (bin === void 0) continue;
+		let entries;
+		if (typeof bin === "string") entries = [bin];
+		else if (record(bin)) entries = Object.values(bin);
+		if (entries === void 0) throw new Error(`Unsupported packed bin declaration: ${file}`);
+		for (const entry of entries) {
+			if (typeof entry !== "string" || entry === "" || node_path.default.posix.isAbsolute(entry) || entry.includes("\\") || entry.split("/").includes("..")) throw new Error(`Unsafe packed bin declaration: ${file}`);
+			result.add(node_path.default.posix.join(node_path.default.posix.dirname(file), entry));
+		}
+	}
+	return result;
+};
+const syntaxFiles = (files) => {
+	const bins = packedBinFiles(files);
+	for (const file of bins) {
+		const source = files.get(file);
+		if (source === void 0) throw new Error(`Missing packed executable: ${file}`);
+		if (!javascript.test(file) && !/^#!(?:[^\n]*\/node|\/usr\/bin\/env(?: -S)? node)(?:[ \r\n]|$)/.test(source)) throw new Error(`Unsupported packed executable language: ${file}`);
+	}
+	return [...new Set([...files.keys()].filter((file) => javascript.test(file)).concat([...bins]))];
+};
+const packageMode = (files, file) => {
+	let directory = node_path.default.posix.dirname(file);
+	while (directory !== ".") {
+		const source = files.get(`${directory}/package.json`);
+		if (source !== void 0) {
+			const manifest = JSON.parse(source);
+			if (!record(manifest)) throw new Error(`Invalid packed manifest: ${directory}`);
+			if (manifest["type"] === "module") return "module";
+			if (manifest["type"] === "commonjs") return "script";
+			if (manifest["type"] !== void 0) throw new Error(`Invalid packed package type: ${directory}`);
+			return "detect";
+		}
+		directory = node_path.default.posix.dirname(directory);
+	}
+	return "detect";
+};
+const parseArtifactSource = (source, options) => {
+	const script = options.sourceType === "script";
+	const content = script ? source.replace(/^\uFEFF/, "").replace(/^#![^\r\n]*/, "") : source;
+	try {
+		return (0, acorn.parse)(script ? (0, node_module.wrap)(content) : content, options);
+	} catch (error) {
+		if (!script || !(error instanceof SyntaxError) || !record(error) || typeof error["pos"] !== "number") throw error;
+		const prefixLength = (0, node_module.wrap)("\0").indexOf("\0");
+		const position = Math.max(0, Math.min(source.length, error["pos"] - prefixLength + source.length - content.length));
+		const lines = source.slice(0, position).split(/\r\n|[\n\r\u2028\u2029]/);
+		const location = `(${lines.length}:${lines.at(-1)?.length ?? 0})`;
+		throw new SyntaxError(error.message.replace(/\(\d+:\d+\)$/, location));
+	}
+};
+/** Enumerate all chunks and bins, including JavaScript outside declared exports. */
+const assertPackedArtifactSyntax = ({ files, target, node }) => {
+	const ecmaVersion = artifactEcmaVersion({
+		target,
+		node
+	});
+	const selected = syntaxFiles(files);
+	if (target.type === "types-only" && selected.length > 0) throw new Error(`Types-only artifact contains JavaScript: ${selected[0]}`);
+	for (const file of selected) {
+		const source = files.get(file);
+		if (source === void 0) throw new Error(`Missing packed JavaScript: ${file}`);
+		let mode = packageMode(files, file);
+		if (/\.mjs$/i.test(file)) mode = "module";
+		if (/\.cjs$/i.test(file)) mode = "script";
+		const parseMode = (sourceType) => {
+			const tree = parseArtifactSource(source, {
+				ecmaVersion,
+				sourceType,
+				allowHashBang: true,
+				allowReturnOutsideFunction: sourceType === "script"
+			});
+			if (ecmaVersion === 5 && tree.body.some((item) => /^(?:Import|Export)/.test(item.type))) throw new Error("Module declarations exceed ES5");
+		};
+		try {
+			if (mode === "detect") try {
+				parseMode("script");
+			} catch {
+				parseMode("module");
+			}
+			else parseMode(mode);
+		} catch (error) {
+			throw new Error(`Packed JavaScript ${file} exceeds its declared syntax target: ${String(error)}`);
+		}
+	}
+};
+const archiveMembers = (members) => {
+	const seen = /* @__PURE__ */ new Set();
+	for (const file of members) {
+		const parts = file.split("/");
+		if (!file.startsWith("package/") || file.includes("\\") || file.split("").some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) || parts.some((part) => part === ".." || part === ".") || parts.slice(0, -1).some((part) => part === "") || seen.has(file)) throw new Error(`Unsupported packed artifact member: ${file}`);
+		seen.add(file);
+	}
+	return members;
+};
+const checkPackedJavaScriptWithNode = async ({ files, target, node, executable }) => {
+	assertPackedArtifactSyntax({
+		files,
+		target,
+		node
+	});
+	archiveMembers([...files.keys()]);
+	const scratch = await (0, node_fs_promises.mkdtemp)(node_path.default.join((0, node_os.tmpdir)(), "stll-artifact-syntax-"));
+	try {
+		for (const [file, source] of files) {
+			const destination = node_path.default.join(scratch, file);
+			await (0, node_fs_promises.mkdir)(node_path.default.dirname(destination), { recursive: true });
+			await (0, node_fs_promises.writeFile)(destination, source);
+		}
+		for (const file of syntaxFiles(files)) try {
+			await command(executable, ["--check", node_path.default.join(scratch, file)], {
+				cwd: scratch,
+				env: {
+					PATH: "/usr/bin:/bin",
+					HOME: scratch
+				}
+			});
+		} catch (error) {
+			throw new Error(`Packed JavaScript ${file} is incompatible with consumer Node ${node}: ${String(error)}`);
+		}
+	} finally {
+		await (0, node_fs_promises.rm)(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+};
+/** Read bytes without extracting archive-controlled paths or links. */
+const readPackedSyntaxFiles = async (archive) => {
+	const { stdout: listing } = await command("tar", ["-tzf", archive], { maxBuffer: 16 * 1024 * 1024 });
+	const files = /* @__PURE__ */ new Map();
+	const members = archiveMembers(listing.split("\n").filter((entry) => entry !== ""));
+	const read = async (file) => {
+		if (!members.includes(file)) throw new Error(`Missing packed syntax input: ${file}`);
+		const { stdout: metadata } = await command("tar", [
+			"-tvzf",
+			archive,
+			file
+		]);
+		if (!metadata.startsWith("-") || metadata.trimEnd().split("\n").length !== 1) throw new Error(`Packed syntax input must be a regular file: ${file}`);
+		const { stdout } = await command("tar", [
+			"-xOf",
+			archive,
+			file
+		], { maxBuffer: 16 * 1024 * 1024 });
+		files.set(file, stdout);
+	};
+	for (const file of members) if (javascript.test(file) || node_path.default.posix.basename(file) === "package.json") await read(file);
+	for (const file of packedBinFiles(files)) if (!files.has(file)) await read(file);
+	return files;
+};
+//#endregion
+//#region src/consumer-compat.ts
+const execute = (executable, args, { cwd, env = process.env }) => new Promise((resolve, reject) => {
+	const child = (0, node_child_process.spawn)(executable, args, {
+		cwd,
+		env,
+		stdio: [
+			"ignore",
+			"pipe",
+			"inherit"
+		]
+	});
+	const chunks = [];
+	child.stdout.on("data", (chunk) => chunks.push(chunk));
+	child.on("error", reject);
+	child.on("close", (code, signal) => {
+		const output = Buffer.concat(chunks).toString("utf8");
+		if (code !== 0) reject(/* @__PURE__ */ new Error(`${executable} failed (${signal ?? String(code)}): ${output.trim()}`));
+		else resolve(output);
+	});
+});
+const jsonFile = async (file) => {
+	const value = JSON.parse(await (0, node_fs_promises.readFile)(file, "utf8"));
+	if (!require_toolchain_schema.consumerRecord(value)) throw new Error(`expected JSON object: ${file}`);
+	return value;
+};
+const containedDirectory = async (root, relative) => {
+	const location = await (0, node_fs_promises.realpath)(node_path.default.resolve(root, relative));
+	const difference = node_path.default.relative(root, location);
+	if (difference.startsWith(`..${node_path.default.sep}`) || difference === ".." || node_path.default.isAbsolute(difference)) throw new Error(`path leaves repository: ${relative}`);
+	if (!(await (0, node_fs_promises.lstat)(location)).isDirectory()) throw new Error(`not a directory: ${relative}`);
+	return location;
+};
+const fetchBytes = async (url) => {
+	const response = await fetch(url);
+	if (!response.ok) throw new Error(`download failed (${response.status}): ${url}`);
+	if (new URL(response.url).hostname !== new URL(url).hostname) throw new Error(`download redirected to another host: ${url}`);
+	return Buffer.from(await response.arrayBuffer());
+};
+const verifyConsumerNodeArchive = ({ filename, checksums, archive }) => {
+	const hashes = checksums.split(/\r?\n/).flatMap((line) => {
+		const match = /^([a-f0-9]{64})\s+\*?(\S+)$/.exec(line);
+		return match?.[2] === filename && match[1] ? [match[1]] : [];
+	});
+	if (hashes.length !== 1 || hashes[0] !== (0, node_crypto.createHash)("sha256").update(archive).digest("hex")) throw new Error(`Node archive checksum mismatch: ${filename}`);
+};
+const resolveInstalledManagerBin = async ({ directory, name }) => {
+	const bin = (await jsonFile(node_path.default.join(directory, "package.json")))["bin"];
+	const selector = require_toolchain_schema.consumerRecord(bin) ? bin[name] : bin;
+	if (typeof selector !== "string" || selector.length === 0) throw new Error(`Installed ${name} package must declare its ${name} bin`);
+	const root = await (0, node_fs_promises.realpath)(directory);
+	const resolved = node_path.default.resolve(root, selector);
+	const relative = node_path.default.relative(root, resolved);
+	if (relative === ".." || relative.startsWith(`..${node_path.default.sep}`) || node_path.default.isAbsolute(relative)) throw new Error(`Installed ${name} bin leaves its package`);
+	const cli = await (0, node_fs_promises.realpath)(resolved);
+	const actualRelative = node_path.default.relative(root, cli);
+	if (actualRelative === ".." || actualRelative.startsWith(`..${node_path.default.sep}`) || node_path.default.isAbsolute(actualRelative)) throw new Error(`Installed ${name} bin leaves its package`);
+	if (!(await (0, node_fs_promises.lstat)(cli)).isFile()) throw new Error(`Installed ${name} bin must be a file`);
+	return cli;
+};
+const writeConsumerToolWrappers = async ({ node, npm, pnpm, directory }) => {
+	const wrappers = directory;
+	await (0, node_fs_promises.mkdir)(wrappers);
+	const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+	await (0, node_fs_promises.writeFile)(node_path.default.join(wrappers, "node"), `#!/bin/sh\nexec ${quote(node)} "$@"\n`, { mode: 493 });
+	for (const [name, cli] of [
+		["npm", npm],
+		["npx", node_path.default.join(node_path.default.dirname(npm), "npx-cli.js")],
+		["pnpm", pnpm]
+	]) {
+		if (!name || !cli) throw new Error("missing package manager binding");
+		await (0, node_fs_promises.writeFile)(node_path.default.join(wrappers, name), `#!/bin/sh\nexec ${quote(node)} ${quote(cli)} "$@"\n`, { mode: 493 });
+	}
+	return {
+		node,
+		npm,
+		pnpm,
+		bin: wrappers
+	};
+};
+const provisionConsumerTools = async (scratch, policy) => {
+	if (process.platform !== "linux" || process.arch !== "x64" && process.arch !== "arm64") throw new Error("consumer compatibility requires Linux x64 or arm64");
+	const filename = `node-v${policy.consumerNode}-linux-${process.arch}.tar.xz`;
+	const base = `https://nodejs.org/dist/v${policy.consumerNode}/`;
+	const [archive, checksums] = await Promise.all([fetchBytes(`${base}${filename}`), fetchBytes(`${base}SHASUMS256.txt`)]);
+	verifyConsumerNodeArchive({
+		filename,
+		archive,
+		checksums: checksums.toString("utf8")
+	});
+	const archivePath = node_path.default.join(scratch, filename);
+	await (0, node_fs_promises.writeFile)(archivePath, archive);
+	await execute("tar", [
+		"-xJf",
+		archivePath,
+		"-C",
+		scratch,
+		"--no-same-owner"
+	], { cwd: scratch });
+	const installation = node_path.default.join(scratch, filename.slice(0, -7));
+	const bin = node_path.default.join(installation, "bin");
+	const node = node_path.default.join(bin, "node");
+	const home = node_path.default.join(scratch, "tools-home");
+	await (0, node_fs_promises.mkdir)(home);
+	await (0, node_fs_promises.writeFile)(node_path.default.join(home, "npmrc"), "");
+	const env = consumerCommandEnvironment({
+		tools: { bin },
+		directory: scratch,
+		home
+	});
+	const actual = (await execute(node, ["--version"], {
+		cwd: scratch,
+		env
+	})).trim();
+	if (actual !== `v${policy.consumerNode}`) throw new Error(`consumer Node version mismatch: ${actual}`);
+	const prefix = node_path.default.join(scratch, "tools");
+	const npmBootstrap = node_path.default.join(installation, "lib/node_modules/npm/bin/npm-cli.js");
+	await execute(node, [
+		npmBootstrap,
+		"install",
+		"--prefix",
+		prefix,
+		"--ignore-scripts",
+		"--no-audit",
+		"--no-fund",
+		"--package-lock=false",
+		`npm@${policy.consumerNpm}`,
+		`pnpm@${policy.consumerPnpm}`
+	], {
+		cwd: scratch,
+		env
+	});
+	const npm = await resolveInstalledManagerBin({
+		directory: node_path.default.join(prefix, "node_modules/npm"),
+		name: "npm"
+	});
+	const pnpm = await resolveInstalledManagerBin({
+		directory: node_path.default.join(prefix, "node_modules/pnpm"),
+		name: "pnpm"
+	});
+	for (const [cli, expected] of [[npm, policy.consumerNpm], [pnpm, policy.consumerPnpm]]) if (!cli || !expected || (await execute(node, [cli, "--version"], {
+		cwd: scratch,
+		env
+	})).trim() !== expected) throw new Error("consumer package manager version mismatch");
+	return writeConsumerToolWrappers({
+		node,
+		npm,
+		pnpm,
+		directory: node_path.default.join(scratch, "consumer-bin")
+	});
+};
+const trackedManifests = async (root) => {
+	const listed = await execute("git", [
+		"ls-files",
+		"-z",
+		"--",
+		"package.json",
+		"**/package.json",
+		"pnpm-workspace.yaml",
+		"**/pnpm-workspace.yaml",
+		"publish-contract.json",
+		"**/publish-contract.json",
+		".github/workflows/*.yml",
+		".github/workflows/*.yaml"
+	], { cwd: root });
+	const files = {};
+	for (const file of listed.split("\0").filter(Boolean)) {
+		if (file.split("/").some((part) => part === "node_modules" || part === "vendor")) continue;
+		const location = await (0, node_fs_promises.realpath)(node_path.default.join(root, file));
+		const relative = node_path.default.relative(root, location);
+		if (relative.startsWith(`..${node_path.default.sep}`) || relative === ".." || node_path.default.isAbsolute(relative)) throw new Error(`tracked manifest leaves repository: ${file}`);
+		files[file] = await (0, node_fs_promises.readFile)(location, "utf8");
+	}
+	return files;
+};
+const packFilename = async (directory) => {
+	const files = (await (0, node_fs_promises.readdir)(directory)).filter((file) => file.endsWith(".tgz"));
+	if (files.length !== 1) throw new Error(`expected exactly one package tarball: ${directory}`);
+	const filename = files.at(0);
+	if (!filename) throw new Error("missing package tarball");
+	return node_path.default.join(directory, filename);
+};
+const copyWithoutDependencies = async (source, destination) => {
+	await (0, node_fs_promises.cp)(source, destination, {
+		recursive: true,
+		filter: async (file) => {
+			if ([
+				"node_modules",
+				".git",
+				"pnpm-workspace.yaml"
+			].includes(node_path.default.basename(file))) return false;
+			if ((await (0, node_fs_promises.lstat)(file)).isSymbolicLink()) throw new Error(`consumer staging does not accept symlinks: ${file}`);
+			return true;
+		}
+	});
+};
+const stageConsumerWorkspace = async ({ files, root, staging, packages }) => {
+	const directories = /* @__PURE__ */ new Map();
+	const paths = require_toolchain_schema.consumerStagingPaths(packages);
+	const ordered = [...packages.values()].sort((left, right) => left.directory.length - right.directory.length);
+	for (const pkg of ordered) {
+		const relative = paths.get(pkg.name);
+		if (!relative) throw new Error(`missing staging path: ${pkg.name}`);
+		const destination = node_path.default.join(staging, relative);
+		if (pkg.directory !== "." || pkg.manifest["private"] !== true) await copyWithoutDependencies(await containedDirectory(root, pkg.directory), destination);
+		directories.set(pkg.name, destination);
+	}
+	const rootManifest = require_toolchain_schema.consumerPackRootManifest(packages, files);
+	await (0, node_fs_promises.writeFile)(node_path.default.join(staging, "package.json"), JSON.stringify(rootManifest));
+	const rootSource = files["pnpm-workspace.yaml"];
+	const rootCatalogs = rootSource === void 0 ? require_toolchain_schema.bunCatalogState(rootManifest) : require_toolchain_schema.catalogState(require_toolchain_schema.pnpmWorkspaceState(rootSource, "pnpm-workspace.yaml"), "pnpm-workspace.yaml");
+	await (0, node_fs_promises.writeFile)(node_path.default.join(staging, "pnpm-workspace.yaml"), (0, yaml.stringify)({
+		packages: [...directories.values()].map((directory) => node_path.default.relative(staging, directory).split(node_path.default.sep).join("/") || "."),
+		...rootCatalogs
+	}));
+	for (const [directory, manifest] of require_toolchain_schema.discoverConsumerManifests(files)) {
+		if (directory === ".") continue;
+		const file = `${directory}/pnpm-workspace.yaml`;
+		const source = files[file];
+		let workspace;
+		if (source !== void 0) workspace = require_toolchain_schema.pnpmWorkspaceState(source, file);
+		else {
+			const catalogs = require_toolchain_schema.bunCatalogState(manifest);
+			if (Object.keys(catalogs).length === 0) continue;
+			const declaration = manifest["workspaces"];
+			const patterns = require_toolchain_schema.consumerRecord(declaration) ? declaration["packages"] : declaration;
+			if (!Array.isArray(patterns) || !patterns.every((entry) => typeof entry === "string")) throw new Error(`catalog owner requires declared workspace packages: ${directory}`);
+			workspace = {
+				packages: patterns,
+				...catalogs
+			};
+		}
+		const destination = node_path.default.join(staging, directory);
+		await (0, node_fs_promises.mkdir)(destination, { recursive: true });
+		await (0, node_fs_promises.writeFile)(node_path.default.join(destination, "package.json"), JSON.stringify(manifest));
+		await (0, node_fs_promises.writeFile)(node_path.default.join(destination, "pnpm-workspace.yaml"), (0, yaml.stringify)(workspace));
+	}
+	return directories;
+};
+const assertConsumerFixtureFiles = async (directory) => {
+	const visit = async (location) => {
+		for (const entry of await (0, node_fs_promises.readdir)(location, { withFileTypes: true })) {
+			if (require_toolchain_schema.consumerDependencyConfigFiles.some((name) => name === entry.name)) throw new Error(`consumer fixture must not supply dependency-manager configuration: ${entry.name}`);
+			if (entry.isDirectory() && entry.name !== "node_modules" && entry.name !== ".git") await visit(node_path.default.join(location, entry.name));
+		}
+	};
+	await visit(directory);
+	require_toolchain_schema.assertConsumerFixtureManifest(await jsonFile(node_path.default.join(directory, "package.json")));
+};
+const provisionConsumerReleasePacker = async ({ tools, scratch, release }) => {
+	const prefix = node_path.default.join(scratch, "release-packer");
+	const home = node_path.default.join(scratch, "release-packer-home");
+	await (0, node_fs_promises.mkdir)(home);
+	await (0, node_fs_promises.writeFile)(node_path.default.join(home, "npmrc"), "");
+	const env = consumerCommandEnvironment({
+		tools,
+		directory: scratch,
+		home
+	});
+	await execute(tools.node, [
+		tools.npm,
+		"install",
+		"--prefix",
+		prefix,
+		"--ignore-scripts",
+		"--no-audit",
+		"--no-fund",
+		"--package-lock=false",
+		`${release.manager}@${release.version}`
+	], {
+		cwd: scratch,
+		env
+	});
+	const cli = await resolveInstalledManagerBin({
+		directory: node_path.default.join(prefix, "node_modules", release.manager),
+		name: release.manager
+	});
+	const actual = (await execute(tools.node, [cli, "--version"], {
+		cwd: scratch,
+		env
+	})).trim();
+	if (actual !== release.version) throw new Error(`release packer version mismatch: expected ${release.version}, got ${actual}`);
+	return cli;
+};
+const packConsumerArtifacts = async ({ files, root, scratch, tools, packages, workspacePackages }) => {
+	const release = require_publish_contract.resolveConsumerReleasePack(files);
+	const releaseCli = await provisionConsumerReleasePacker({
+		tools,
+		scratch,
+		release
+	});
+	const artifacts = /* @__PURE__ */ new Map();
+	const staging = node_path.default.join(scratch, "pack-workspace");
+	await (0, node_fs_promises.mkdir)(staging);
+	const stagedDirectories = await stageConsumerWorkspace({
+		files,
+		root,
+		staging,
+		packages: workspacePackages
+	});
+	const packHome = node_path.default.join(scratch, "pack-home");
+	await (0, node_fs_promises.mkdir)(packHome);
+	await (0, node_fs_promises.writeFile)(node_path.default.join(packHome, "npmrc"), "");
+	for (const [index, pkg] of [...packages.values()].entries()) {
+		const packed = node_path.default.join(scratch, `packed-${index}`);
+		await (0, node_fs_promises.mkdir)(packed);
+		const directory = stagedDirectories.get(pkg.name);
+		if (!directory) throw new Error(`missing pack workspace member: ${pkg.name}`);
+		await execute(tools.node, [releaseCli, ...require_publish_contract.consumerReleasePackArguments({
+			packer: release,
+			directory: packed
+		})], {
+			cwd: directory,
+			env: consumerCommandEnvironment({
+				tools,
+				directory,
+				home: packHome
+			})
+		});
+		const artifact = await packFilename(packed);
+		artifacts.set(pkg.name, artifact);
+	}
+	return artifacts;
+};
+const registryMetadata = async (name) => {
+	const value = JSON.parse((await fetchBytes(`https://registry.npmjs.org/${encodeURIComponent(name)}`)).toString("utf8"));
+	if (!require_toolchain_schema.consumerRecord(value) || !require_toolchain_schema.consumerRecord(value["versions"])) throw new Error(`invalid registry response: ${name}`);
+	return value["versions"];
+};
+const consumerCommandEnvironment = ({ tools, directory, home, environment = process.env }) => {
+	const env = Object.fromEntries(Object.entries(environment).filter(([key]) => !/^(?:npm_config_|pnpm_|yarn_|corepack_)/i.test(key) && key !== "NODE_PATH" && key !== "NODE_OPTIONS"));
+	Object.assign(env, {
+		PATH: `${tools.bin}${node_path.default.delimiter}${node_path.default.join(directory, "node_modules/.bin")}${node_path.default.delimiter}/usr/bin${node_path.default.delimiter}/bin`,
+		HOME: home,
+		npm_config_cache: node_path.default.join(home, "npm-cache"),
+		npm_config_userconfig: node_path.default.join(home, "npmrc"),
+		npm_config_registry: "https://registry.npmjs.org/",
+		pnpm_config_pm_on_fail: "ignore",
+		npm_config_manage_package_manager_versions: "false",
+		COREPACK_ENABLE_PROJECT_SPEC: "0",
+		COREPACK_ENABLE_STRICT: "0",
+		COREPACK_ENABLE_AUTO_PIN: "0",
+		COREPACK_ENABLE_NETWORK: "0",
+		COREPACK_ENV_FILE: "0",
+		CI: "true",
+		NODE_ENV: "development",
+		XDG_CONFIG_HOME: node_path.default.join(home, "config"),
+		XDG_CACHE_HOME: node_path.default.join(home, "cache"),
+		XDG_DATA_HOME: node_path.default.join(home, "data")
+	});
+	return env;
+};
+const fixtureCommand = (argv, tools) => {
+	const executable = argv.at(0);
+	if (argv.slice(1).some((argument) => node_path.default.posix.isAbsolute(argument) || /(?:^|\/)\.\.(?:\/|$)/.test(argument))) throw new Error("consumer fixture command arguments must stay within the fixture");
+	if (executable === "node") return [tools.node, ...argv.slice(1)];
+	if (argv[1] === "run" && executable === "npm") return [
+		tools.node,
+		tools.npm,
+		...argv.slice(1)
+	];
+	if (argv[1] === "run" && executable === "pnpm") return [
+		tools.node,
+		tools.pnpm,
+		...argv.slice(1)
+	];
+	throw new Error("consumer fixture commands must use node or a declared npm/pnpm run script");
+};
+const consumerFixtureCommands = ({ manager, tools, directory, home, fixture }) => {
+	return [
+		manager === "npm" ? [
+			tools.node,
+			tools.npm,
+			"install",
+			"--ignore-scripts",
+			"--no-audit",
+			"--no-fund"
+		] : [
+			tools.node,
+			tools.pnpm,
+			"pm",
+			"install",
+			"--ignore-scripts",
+			"--no-frozen-lockfile",
+			"--store-dir",
+			node_path.default.join(home, "pnpm-store")
+		],
+		manager === "pnpm" ? [
+			tools.node,
+			tools.pnpm,
+			"pm",
+			"rebuild",
+			"--pending"
+		] : [
+			tools.node,
+			tools.npm,
+			"rebuild"
+		],
+		[
+			tools.node,
+			node_path.default.join(directory, "node_modules/typescript/bin/tsc"),
+			"--noEmit"
+		],
+		fixtureCommand(fixture.build, tools),
+		fixtureCommand(fixture.smoke, tools)
+	];
+};
+const installConsumerFixtureDependencies = async (options) => {
+	const env = consumerCommandEnvironment(options);
+	const commands = consumerFixtureCommands(options);
+	for (const [index, argv] of commands.slice(0, 2).entries()) {
+		const executable = argv.at(0);
+		if (!executable) throw new Error("missing consumer dependency command");
+		process.stdout.write(await execute(executable, argv.slice(1), {
+			cwd: options.directory,
+			env
+		}));
+		await assertConsumerInstalledToolBins(options.directory);
+		if (index !== 0) continue;
+		const manifestFile = node_path.default.join(options.directory, "package.json");
+		const manifest = JSON.parse(await (0, node_fs_promises.readFile)(manifestFile, "utf8"));
+		if (!require_toolchain_schema.consumerRecord(manifest)) throw new Error("invalid consumer fixture manifest");
+		const lockSource = await (0, node_fs_promises.readFile)(node_path.default.join(options.directory, options.manager === "npm" ? "package-lock.json" : "pnpm-lock.yaml"), "utf8");
+		const { approvals, rebuildTargets } = await consumerBuildApprovals({
+			manifest,
+			lock: options.manager === "npm" ? JSON.parse(lockSource) : (0, yaml.parse)(lockSource),
+			manager: options.manager,
+			directory: options.directory
+		});
+		if (options.manager === "npm") {
+			const rebuild = commands.at(1);
+			if (!rebuild) throw new Error("missing consumer rebuild command");
+			rebuild.push(...rebuildTargets);
+			if (Object.keys(approvals).length === 0) break;
+			await (0, node_fs_promises.writeFile)(manifestFile, `${JSON.stringify({
+				...manifest,
+				allowScripts: approvals
+			}, null, 2)}\n`);
+		} else {
+			const workspaceFile = node_path.default.join(options.directory, "pnpm-workspace.yaml");
+			const workspace = (0, yaml.parse)(await (0, node_fs_promises.readFile)(workspaceFile, "utf8"));
+			if (!require_toolchain_schema.consumerRecord(workspace)) throw new Error("invalid generated consumer workspace");
+			await (0, node_fs_promises.writeFile)(workspaceFile, (0, yaml.stringify)({
+				...workspace,
+				allowBuilds: approvals
+			}));
+		}
+	}
+};
+const runFixture = async ({ fixtureRoot, fixture, pkg, closure, artifacts, scratch, tools, policy, manager }) => {
+	const selectedArtifact = artifacts.get(pkg.name);
+	if (!selectedArtifact) throw new Error(`missing consumer artifact: ${pkg.name}`);
+	const published = JSON.parse(await execute("tar", [
+		"-xOf",
+		selectedArtifact,
+		"package/package.json"
+	], { cwd: scratch }));
+	if (!require_toolchain_schema.consumerRecord(published)) throw new Error(`invalid packed package manifest: ${pkg.name}`);
+	require_toolchain_schema.assertConsumerFixtureKind({
+		fixture,
+		pkg: {
+			directory: pkg.directory,
+			name: pkg.name,
+			manifest: published
+		}
+	});
+	const source = await containedDirectory(fixtureRoot, fixture.fixture);
+	const directory = node_path.default.join(scratch, `fixture-${manager}-${(0, node_crypto.createHash)("sha256").update(pkg.name).digest("hex").slice(0, 16)}`);
+	await assertConsumerFixtureFiles(source);
+	await copyWithoutDependencies(source, directory);
+	const manifest = await jsonFile(node_path.default.join(directory, "package.json"));
+	const needsReactDom = [
+		"dependencies",
+		"devDependencies",
+		"optionalDependencies"
+	].some((field) => {
+		const entries = manifest[field];
+		return require_toolchain_schema.consumerRecord(entries) && typeof entries["react-dom"] === "string";
+	});
+	const reactBindings = {};
+	if (fixture.kind === "react") {
+		const peers = published["peerDependencies"];
+		if (!require_toolchain_schema.consumerRecord(peers) || typeof peers["react"] !== "string") throw new Error(`React fixture requires a React peer: ${pkg.name}`);
+		const needsDom = typeof peers["react-dom"] === "string" || needsReactDom;
+		const bindings = selectConsumerReactVersions({
+			reactRange: peers["react"],
+			reactVersions: await registryMetadata("react"),
+			dom: needsDom ? {
+				range: typeof peers["react-dom"] === "string" ? peers["react-dom"] : void 0,
+				versions: await registryMetadata("react-dom")
+			} : void 0
+		});
+		Object.assign(reactBindings, bindings);
+		process.stdout.write(`${pkg.name}: ${manager} React ${bindings.react}${bindings["react-dom"] === void 0 ? "" : ` / ReactDOM ${bindings["react-dom"]}`}\n`);
+	}
+	const closureArtifacts = /* @__PURE__ */ new Map();
+	for (const name of closure.keys()) {
+		const artifact = artifacts.get(name);
+		if (!artifact) throw new Error(`missing consumer artifact: ${name}`);
+		closureArtifacts.set(name, artifact);
+	}
+	const boundManifest = require_toolchain_schema.bindConsumerManifest({
+		manifest,
+		artifacts: closureArtifacts,
+		typescript: policy.consumerTypescript,
+		react: reactBindings,
+		manager
+	});
+	await (0, node_fs_promises.writeFile)(node_path.default.join(directory, "package.json"), `${JSON.stringify(boundManifest.manifest, null, 2)}\n`);
+	if (boundManifest.manager === "pnpm") await (0, node_fs_promises.writeFile)(node_path.default.join(directory, "pnpm-workspace.yaml"), (0, yaml.stringify)(boundManifest.workspace));
+	for (const lockfile of [
+		"package-lock.json",
+		"npm-shrinkwrap.json",
+		"pnpm-lock.yaml",
+		"yarn.lock",
+		"bun.lock",
+		"bun.lockb"
+	]) await (0, node_fs_promises.rm)(node_path.default.join(directory, lockfile), { force: true });
+	const home = node_path.default.join(directory, ".consumer-home");
+	await (0, node_fs_promises.mkdir)(home);
+	await (0, node_fs_promises.writeFile)(node_path.default.join(home, "npmrc"), "");
+	const options = {
+		manager,
+		tools,
+		directory,
+		home,
+		fixture
+	};
+	await installConsumerFixtureDependencies(options);
+	if ((await jsonFile(node_path.default.join(directory, "node_modules/typescript/package.json")))["version"] !== policy.consumerTypescript) throw new Error("installed consumer TypeScript does not match policy");
+	const env = consumerCommandEnvironment(options);
+	for (const argv of consumerFixtureCommands(options).slice(2)) {
+		await assertConsumerInstalledToolBins(directory);
+		const executable = argv.at(0);
+		if (!executable) throw new Error("missing consumer command");
+		process.stdout.write(await execute(executable, argv.slice(1), {
+			cwd: directory,
+			env
+		}));
+	}
+	process.stdout.write(`${pkg.name}: ${manager} consumer build/types/smoke passed\n`);
+};
+const assertConsumerPackedNodeSupport = async ({ artifacts, node, directory }) => {
+	for (const [name, artifact] of artifacts) {
+		const manifest = JSON.parse(await execute("tar", [
+			"-xOf",
+			artifact,
+			"package/package.json"
+		], { cwd: directory }));
+		if (!require_toolchain_schema.consumerRecord(manifest)) throw new Error(`invalid packed package manifest: ${name}`);
+		require_toolchain_schema.assertConsumerNodeSupport({
+			manifest,
+			node,
+			label: `packed ${name}`
+		});
+	}
+};
+const assertConsumerPackedSyntax = async ({ artifacts, packages, files, node, typescript, executable }) => {
+	const packer = require_publish_contract.resolveConsumerReleasePack(files).manager;
+	for (const [name, archive] of artifacts) {
+		const pkg = packages.get(name);
+		if (pkg === void 0) throw new Error(`Missing packed package: ${name}`);
+		const declaration = node_path.default.posix.join(pkg.directory, "publish-contract.json");
+		const source = files[declaration];
+		if (source === void 0) throw new Error(`Missing tracked publish contract: ${declaration}`);
+		const contract = require_publish_contract.parsePublishContract(JSON.parse(source));
+		const packed = await readPackedSyntaxFiles(archive);
+		const manifest = packed.get("package/package.json");
+		if (manifest === void 0) throw new Error(`Missing packed manifest: ${name}`);
+		const diagnostics = require_publish_contract.checkPublishContract({
+			manifest: JSON.parse(manifest),
+			target: contract.target,
+			contract,
+			packer,
+			policy: {
+				node,
+				typescript
+			}
+		});
+		if (diagnostics.length > 0) throw new Error(`Packed publish contract differs for ${name}: ${diagnostics.map((entry) => entry.message).join("; ")}`);
+		await checkPackedJavaScriptWithNode({
+			files: packed,
+			target: contract.target,
+			node,
+			executable
+		});
+	}
+};
+const runConsumerCompat = async ({ root: inputRoot, packages: selected, consumerNode, fixturePath, policy: inputPolicy }) => {
+	const policy = require_toolchain_schema.parseToolchainPolicy(inputPolicy);
+	if (consumerNode !== policy.consumerNode) throw new Error("consumer Node must match the published toolchain policy");
+	if (selected.length === 0) throw new Error("consumer compatibility requires at least one package");
+	const root = await (0, node_fs_promises.realpath)(inputRoot);
+	const fixtureRoot = await containedDirectory(root, require_toolchain_schema.consumerRelativePath(fixturePath, "fixture-path"));
+	const fixtures = require_toolchain_schema.parseConsumerFixtures(await jsonFile(node_path.default.join(fixtureRoot, "consumer-compat.json")));
+	require_toolchain_schema.assertConsumerFixtureSelection({
+		selected,
+		fixtures
+	});
+	const files = await trackedManifests(root);
+	const packages = require_toolchain_schema.discoverConsumerPackages(files);
+	const selections = [];
+	const all = /* @__PURE__ */ new Map();
+	const seen = /* @__PURE__ */ new Set();
+	for (const input of selected) {
+		const directory = require_toolchain_schema.consumerRelativePath(input, "selected package");
+		if (seen.has(directory)) throw new Error(`duplicate selected package: ${directory}`);
+		seen.add(directory);
+		const pkg = [...packages.values()].find((candidate) => candidate.directory === directory);
+		if (!pkg || pkg.manifest["private"] === true) throw new Error(`selected package is not a public root or declared workspace package: ${directory}`);
+		const fixture = fixtures.find((candidate) => candidate.package === directory);
+		if (!fixture) throw new Error(`missing declared consumer fixture: ${directory}`);
+		require_toolchain_schema.assertConsumerFixtureKind({
+			fixture,
+			pkg
+		});
+		await assertConsumerFixtureFiles(await containedDirectory(fixtureRoot, fixture.fixture));
+		fixtureCommand(fixture.build, {
+			node: "node",
+			npm: "npm",
+			pnpm: "pnpm",
+			bin: ""
+		});
+		fixtureCommand(fixture.smoke, {
+			node: "node",
+			npm: "npm",
+			pnpm: "pnpm",
+			bin: ""
+		});
+		const closure = require_toolchain_schema.consumerPackageClosure({
+			selected: pkg,
+			packages,
+			files
+		});
+		for (const [name, member] of closure) {
+			require_toolchain_schema.assertConsumerNodeSupport({
+				manifest: member.manifest,
+				node: policy.consumerNode,
+				label: node_path.default.posix.join(member.directory, "package.json")
+			});
+			all.set(name, member);
+		}
+		selections.push({
+			pkg,
+			fixture,
+			closure
+		});
+	}
+	require_publish_contract.resolveConsumerReleasePack(files);
+	const scratch = await (0, node_fs_promises.mkdtemp)(node_path.default.join((0, node_os.tmpdir)(), "stll-consumer-compat-"));
+	try {
+		const tools = await provisionConsumerTools(scratch, policy);
+		const artifacts = await packConsumerArtifacts({
+			files,
+			root,
+			scratch,
+			tools,
+			packages: all,
+			workspacePackages: packages
+		});
+		await assertConsumerPackedNodeSupport({
+			artifacts,
+			node: policy.consumerNode,
+			directory: scratch
+		});
+		await assertConsumerPackedSyntax({
+			artifacts,
+			packages: all,
+			files,
+			node: policy.consumerNode,
+			typescript: policy.consumerTypescript,
+			executable: tools.node
+		});
+		for (const selection of selections) for (const manager of ["npm", "pnpm"]) await runFixture({
+			fixtureRoot,
+			...selection,
+			artifacts,
+			scratch,
+			tools,
+			policy,
+			manager
+		});
+	} finally {
+		await (0, node_fs_promises.rm)(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+};
+//#endregion
+//#region src/consumer-compat-arguments.ts
+const consumerCompatUsage = "Usage: stll-consumer-compat --packages '[\"packages/example\"]' --consumer-node <exact-patch> --fixture-path <directory>";
+const parseConsumerCompatArguments = (args) => {
+	if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) return { mode: "help" };
+	const options = /* @__PURE__ */ new Map();
+	for (let index = 0; index < args.length; index += 2) {
+		const flag = args[index];
+		const value = args[index + 1];
+		if (!flag || ![
+			"--packages",
+			"--consumer-node",
+			"--fixture-path"
+		].includes(flag) || !value || options.has(flag)) throw new Error(consumerCompatUsage);
+		options.set(flag, value);
+	}
+	const encoded = options.get("--packages");
+	const consumerNode = options.get("--consumer-node");
+	const fixturePath = options.get("--fixture-path");
+	if (!encoded || !consumerNode || !fixturePath) throw new Error(consumerCompatUsage);
+	const packages = JSON.parse(encoded);
+	if (!Array.isArray(packages) || packages.length === 0) throw new Error("--packages must be a nonempty JSON array");
+	return {
+		mode: "run",
+		packages: packages.map((entry) => require_toolchain_schema.consumerRelativePath(entry, "--packages")),
+		consumerNode,
+		fixturePath: require_toolchain_schema.consumerRelativePath(fixturePath, "--fixture-path")
+	};
+};
+//#endregion
+//#region src/consumer-compat-cli.ts
+const main = async () => {
+	const argumentsResult = parseConsumerCompatArguments(process.argv.slice(2));
+	if (argumentsResult.mode === "help") {
+		process.stdout.write(`${consumerCompatUsage}\n`);
+		return;
+	}
+	const policy = JSON.parse(await (0, node_fs_promises.readFile)(new URL("../toolchain.json", require("url").pathToFileURL(__filename).href), "utf8"));
+	await runConsumerCompat({
+		root: process.cwd(),
+		packages: argumentsResult.packages,
+		consumerNode: argumentsResult.consumerNode,
+		fixturePath: argumentsResult.fixturePath,
+		policy
+	});
+};
+main().catch((error) => {
+	process.stderr.write(`consumer-compat: ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exitCode = 1;
+});
+//#endregion
+
+//# sourceMappingURL=consumer-compat-cli.cjs.map