@stll/oxlint-config 0.12.2 → 0.15.0

package/dist/toolchain-schema.cjs

@@ -0,0 +1,702 @@
+const require_rolldown_runtime = require("./rolldown-runtime.cjs");
+const require_toolchain_inputs = require("./toolchain-inputs.cjs");
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let semver = require("semver");
+let yaml = require("yaml");
+let picomatch = require("picomatch");
+picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
+let node_util = require("node:util");
+//#region src/consumer-catalogs.ts
+const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const catalogMapping = (value, field) => {
+	if (!record$1(value)) throw new Error(`${field} must be a mapping`);
+	const entries = /* @__PURE__ */ new Map();
+	for (const [name, specifier] of Object.entries(value)) {
+		if (name === "" || typeof specifier !== "string" || specifier.trim() === "") throw new Error(`${field} must contain nonempty package specifiers`);
+		entries.set(name, specifier);
+	}
+	return Object.fromEntries(entries);
+};
+const catalogState = (source, file) => {
+	const result = {};
+	if (Object.hasOwn(source, "catalog")) result.catalog = catalogMapping(source["catalog"], `${file}: catalog`);
+	if (Object.hasOwn(source, "catalogs")) {
+		if (!record$1(source["catalogs"])) throw new Error(`${file}: catalogs must be a mapping`);
+		const named = /* @__PURE__ */ new Map();
+		for (const [name, entries] of Object.entries(source["catalogs"])) {
+			if (name === "") throw new Error(`${file}: catalog names must be nonempty`);
+			named.set(name, catalogMapping(entries, `${file}: catalogs.${name}`));
+		}
+		result.catalogs = Object.fromEntries(named);
+	}
+	return result;
+};
+const bunCatalogState = (manifest) => {
+	const sources = [manifest];
+	if (record$1(manifest["workspaces"])) sources.push(manifest["workspaces"]);
+	const merged = {};
+	for (const source of sources) {
+		const state = catalogState(source, "package.json");
+		for (const [field, value] of Object.entries(state)) {
+			if (Object.hasOwn(merged, field) && !(0, node_util.isDeepStrictEqual)(merged[field], value)) throw new Error(`conflicting Bun ${field} definitions in package.json`);
+			merged[field] = value;
+		}
+	}
+	return catalogState(merged, "package.json");
+};
+const pnpmWorkspaceState = (source, file) => {
+	const document = (0, yaml.parseDocument)(source, { uniqueKeys: true });
+	if (document.errors.length !== 0) throw new Error(`invalid pnpm workspace: ${file}`);
+	const workspace = document.toJS({ maxAliasCount: 100 });
+	if (!record$1(workspace)) throw new Error(`invalid pnpm workspace: ${file}`);
+	const packages = workspace["packages"];
+	if (packages !== void 0 && (!Array.isArray(packages) || !packages.every((entry) => typeof entry === "string"))) throw new Error(`invalid pnpm workspace packages: ${file}`);
+	return {
+		packages: packages ?? [],
+		...catalogState(workspace, file)
+	};
+};
+const resolveConsumerCatalog = ({ directory: inputDirectory, name, specifier, files }) => {
+	let directory = inputDirectory;
+	while (true) {
+		const yamlFile = node_path.default.posix.join(directory, "pnpm-workspace.yaml");
+		const yaml$1 = files[yamlFile];
+		const manifestFile = node_path.default.posix.join(directory, "package.json");
+		const json = files[manifestFile];
+		let state;
+		let patterns = [];
+		if (yaml$1 !== void 0) {
+			const workspace = pnpmWorkspaceState(yaml$1, yamlFile);
+			state = catalogState(workspace, yamlFile);
+			patterns = workspace.packages;
+		} else if (json !== void 0) {
+			const manifest = JSON.parse(json);
+			if (!record$1(manifest)) throw new Error(`invalid catalog owner: ${manifestFile}`);
+			const declaration = manifest["workspaces"];
+			if (directory === "." || declaration !== void 0) {
+				state = bunCatalogState(manifest);
+				const packages = record$1(declaration) ? declaration["packages"] : declaration;
+				if (packages !== void 0 && (!Array.isArray(packages) || !packages.every((entry) => typeof entry === "string"))) throw new Error(`invalid catalog owner packages: ${manifestFile}`);
+				patterns = packages ?? [];
+			}
+		}
+		if (state !== void 0) {
+			if (!require_toolchain_inputs.workspaceContains({
+				directory,
+				file: node_path.default.posix.join(inputDirectory, "package.json"),
+				patterns,
+				rootMembership: "implicit"
+			})) throw new Error(`catalog dependency ${name} is outside nearest workspace owner ${directory}`);
+			const catalogName = specifier.slice(8) || "default";
+			const named = state.catalogs;
+			const namedEntries = named !== void 0 && Object.hasOwn(named, catalogName) ? named[catalogName] : void 0;
+			const entries = catalogName === "default" ? state.catalog ?? namedEntries : namedEntries;
+			const resolved = entries !== void 0 && Object.hasOwn(entries, name) ? entries[name] : void 0;
+			if (resolved === void 0) throw new Error(`unresolved catalog dependency ${name} in workspace ${directory}`);
+			return resolved;
+		}
+		if (directory === ".") break;
+		directory = node_path.default.posix.dirname(directory);
+	}
+	throw new Error(`unresolved catalog dependency ${name}: no tracked workspace owner`);
+};
+//#endregion
+//#region src/consumer-compat-config.ts
+const consumerRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const consumerRelativePath = (value, field) => {
+	if (typeof value !== "string" || value === "" || value.includes("\\") || value.includes("\0") || node_path.default.posix.isAbsolute(value) || value.split("/").some((part) => part === ".." || part === "")) throw new Error(`${field} must be a repository-relative path`);
+	return node_path.default.posix.normalize(value);
+};
+const command = (value, field) => {
+	if (!Array.isArray(value) || value.length === 0 || !value.every((part) => typeof part === "string" && part !== "" && !part.includes("\0"))) throw new Error(`${field} must be a nonempty command argument array`);
+	return value.map((part) => part);
+};
+const parseConsumerFixtures = (input) => {
+	if (!consumerRecord(input) || Object.keys(input).some((key) => key !== "packages") || !Array.isArray(input["packages"])) throw new Error("consumer fixtures must contain only a packages array");
+	const seen = /* @__PURE__ */ new Set();
+	return input["packages"].map((entry) => {
+		if (!consumerRecord(entry) || Object.keys(entry).some((key) => ![
+			"package",
+			"fixture",
+			"kind",
+			"build",
+			"smoke"
+		].includes(key))) throw new Error("invalid consumer fixture declaration");
+		const packagePath = consumerRelativePath(entry["package"], "package");
+		const fixture = consumerRelativePath(entry["fixture"], "fixture");
+		const kind = entry["kind"];
+		if (kind !== "node" && kind !== "react") throw new Error("fixture kind must be node or react");
+		if (seen.has(packagePath)) throw new Error(`duplicate consumer fixture: ${packagePath}`);
+		seen.add(packagePath);
+		return {
+			package: packagePath,
+			fixture,
+			kind,
+			build: command(entry["build"], "build"),
+			smoke: command(entry["smoke"], "smoke")
+		};
+	});
+};
+const assertConsumerFixtureSelection = ({ selected, fixtures }) => {
+	const directories = selected.map((entry) => consumerRelativePath(entry, "selected package"));
+	const declared = new Set(fixtures.map((entry) => entry.package));
+	if (new Set(directories).size !== directories.length) throw new Error("duplicate selected consumer package");
+	if (directories.length !== declared.size || directories.some((entry) => !declared.has(entry))) throw new Error("selected consumer packages must exactly match declared fixtures");
+};
+const consumerBundledDependencyFields = ["bundleDependencies", "bundledDependencies"];
+const consumerPackageNameValid = (value) => {
+	if (typeof value !== "string" || value.length === 0 || value.length > 214) return false;
+	const components = value.startsWith("@") ? value.slice(1).split("/") : [value];
+	if (value.startsWith("@") && components.length !== 2) return false;
+	if (!value.startsWith("@") && !/^[a-z0-9]/.test(value)) return false;
+	if (components.some((component) => !/^[a-z0-9._-]+$/.test(component) || component === "." || component === "..")) return false;
+	const packageName = components.at(-1);
+	return packageName !== "node_modules" && packageName !== "favicon.ico";
+};
+const assertConsumerPublishableManifest = ({ manifest, directory }) => {
+	const version = manifest["version"];
+	if (manifest["private"] !== true && (typeof version !== "string" || (0, semver.valid)(version) === null)) throw new Error(`public consumer package requires a semver-valid version: ${directory}`);
+	if (manifest["private"] !== true && !consumerPackageNameValid(manifest["name"])) throw new Error(`public consumer package requires a valid npm name: ${directory}`);
+	for (const field of consumerBundledDependencyFields) if (Object.hasOwn(manifest, field)) throw new Error(`consumer packaging does not support ${field}: ${directory}`);
+};
+const assertConsumerFixtureKind = ({ fixture, pkg }) => {
+	const peers = pkg.manifest["peerDependencies"];
+	if (peers !== void 0 && !consumerRecord(peers)) throw new Error(`invalid published peerDependencies: ${pkg.name}`);
+	const react = consumerRecord(peers) ? peers["react"] : void 0;
+	if (react !== void 0 && (typeof react !== "string" || react.trim() === "" || (0, semver.validRange)(react) === null)) throw new Error(`invalid published React peer: ${pkg.name}`);
+	const kind = react === void 0 ? "node" : "react";
+	if (fixture.kind !== kind) throw new Error(`${pkg.name} requires fixture kind ${kind} from its published peers`);
+};
+const consumerStagingPaths = (packages) => {
+	const paths = /* @__PURE__ */ new Map();
+	for (const [name, pkg] of packages) paths.set(name, consumerRelativePath(pkg.directory, "workspace package directory"));
+	return paths;
+};
+const consumerPackRootManifest = (packages, files) => {
+	const source = files["package.json"];
+	if (source !== void 0) {
+		const manifest = JSON.parse(source);
+		if (!consumerRecord(manifest)) throw new Error("root package manifest must be an object");
+		return manifest;
+	}
+	return [...packages.values()].find((pkg) => pkg.directory === ".")?.manifest ?? { private: true };
+};
+const consumerDependencyConfigFiles = [
+	".npmrc",
+	".pnpmfile.cjs",
+	"pnpm-workspace.yaml",
+	".yarnrc",
+	".yarnrc.yml"
+];
+const assertConsumerFixtureManifest = (manifest) => {
+	for (const field of [
+		"pnpm",
+		"overrides",
+		"resolutions",
+		"workspaces",
+		"packageManager",
+		"allowScripts"
+	]) if (manifest[field] !== void 0) throw new Error(`consumer fixture must not supply dependency-manager setting: ${field}`);
+};
+const bindConsumerManifest = ({ manifest, artifacts, typescript, react, manager }) => {
+	assertConsumerFixtureManifest(manifest);
+	const artifactBindings = Object.fromEntries([...artifacts].map(([name, file]) => [name, `file:${file}`]));
+	const owned = {
+		...artifactBindings,
+		typescript,
+		...react
+	};
+	const result = { ...manifest };
+	for (const field of [
+		"dependencies",
+		"devDependencies",
+		"optionalDependencies",
+		"peerDependencies"
+	]) {
+		const entries = manifest[field];
+		if (entries === void 0) continue;
+		if (!consumerRecord(entries)) throw new Error(`fixture ${field} must be an object`);
+		for (const specifier of Object.values(entries)) if (typeof specifier !== "string" || /^(?:workspace:|file:|link:|\.\.?\/|\/)/.test(specifier)) throw new Error("fixture dependencies must resolve from registry or generated artifact bindings");
+		result[field] = Object.fromEntries(Object.entries(entries).filter(([name]) => !Object.hasOwn(owned, name)));
+	}
+	result["dependencies"] = {
+		...consumerRecord(result["dependencies"]) ? result["dependencies"] : {},
+		...artifactBindings,
+		...react
+	};
+	result["devDependencies"] = {
+		...consumerRecord(result["devDependencies"]) ? result["devDependencies"] : {},
+		typescript
+	};
+	if (manager === "npm") {
+		result["overrides"] = owned;
+		return {
+			manager,
+			manifest: result
+		};
+	}
+	return {
+		manager,
+		manifest: result,
+		workspace: {
+			packages: ["."],
+			overrides: owned
+		}
+	};
+};
+const workspacePatterns = (manifest) => {
+	const workspace = manifest["workspaces"];
+	const patterns = consumerRecord(workspace) ? workspace["packages"] : workspace;
+	if (patterns === void 0) return [];
+	if (!Array.isArray(patterns) || !patterns.every((entry) => typeof entry === "string")) throw new Error("package workspaces must be string patterns");
+	return patterns.map((entry) => entry);
+};
+const discoverConsumerManifests = (files) => {
+	const manifests = /* @__PURE__ */ new Map();
+	const manifestSources = /* @__PURE__ */ new Map();
+	const pnpmSources = /* @__PURE__ */ new Map();
+	const pnpmWorkspaces = /* @__PURE__ */ new Map();
+	for (const [file, content] of Object.entries(files)) if (node_path.default.posix.basename(file) === "pnpm-workspace.yaml") pnpmSources.set(node_path.default.posix.dirname(file), content);
+	else if (node_path.default.posix.basename(file) === "package.json") manifestSources.set(node_path.default.posix.dirname(file), content);
+	const assertWorkspaceOwner = (directory) => {
+		if (pnpmSources.has(directory) && !manifestSources.has(directory)) throw new Error(`consumer pnpm workspace requires an adjacent tracked package.json: ${node_path.default.posix.join(directory, "pnpm-workspace.yaml")}`);
+	};
+	const candidates = /* @__PURE__ */ new Set([...manifestSources.keys(), ...pnpmSources.keys()]);
+	const manifestAt = (directory) => {
+		const cached = manifests.get(directory);
+		if (cached) return cached;
+		const source = manifestSources.get(directory);
+		if (source === void 0) return void 0;
+		const json = JSON.parse(source);
+		if (!consumerRecord(json)) throw new Error(`invalid package manifest: ${directory}/package.json`);
+		manifests.set(directory, json);
+		return json;
+	};
+	const patternsAt = (directory, manifest) => {
+		const source = pnpmSources.get(directory);
+		if (source !== void 0 && !pnpmWorkspaces.has(directory)) {
+			const file = `${directory}/pnpm-workspace.yaml`;
+			const document = (0, yaml.parseDocument)(source, { uniqueKeys: true });
+			if (document.errors.length) throw new Error(`invalid pnpm workspace: ${file}`);
+			const json = document.toJS({ maxAliasCount: 100 });
+			if (!consumerRecord(json)) throw new Error(`invalid pnpm workspace: ${file}`);
+			const patterns = json["packages"] ?? [];
+			if (!Array.isArray(patterns) || !patterns.every((entry) => typeof entry === "string")) throw new Error(`invalid pnpm workspace packages: ${file}`);
+			pnpmWorkspaces.set(directory, patterns.map((entry) => entry));
+		}
+		return pnpmWorkspaces.get(directory) ?? workspacePatterns(manifest ?? {});
+	};
+	const roots = /* @__PURE__ */ new Set(["."]);
+	for (;;) {
+		const before = roots.size;
+		for (const directory of roots) {
+			assertWorkspaceOwner(directory);
+			const patterns = patternsAt(directory, manifestAt(directory));
+			for (const candidate of candidates) {
+				const relative = node_path.default.posix.relative(directory, candidate);
+				if (relative === "" || relative.startsWith("../")) continue;
+				const positives = patterns.filter((pattern) => !pattern.startsWith("!"));
+				const negatives = patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => pattern.slice(1));
+				if (positives.some((pattern) => picomatch.default.isMatch(relative, pattern)) && !negatives.some((pattern) => picomatch.default.isMatch(relative, pattern))) roots.add(candidate);
+			}
+		}
+		if (before === roots.size) break;
+	}
+	const discovered = /* @__PURE__ */ new Map();
+	for (const directory of roots) {
+		for (let owner = directory;; owner = node_path.default.posix.dirname(owner)) {
+			assertWorkspaceOwner(owner);
+			if (owner === ".") break;
+		}
+		const manifest = manifestAt(directory);
+		if (manifest) discovered.set(directory, manifest);
+	}
+	return discovered;
+};
+const discoverConsumerPackages = (files) => {
+	const packages = /* @__PURE__ */ new Map();
+	for (const [directory, manifest] of discoverConsumerManifests(files)) {
+		const name = manifest["name"];
+		if (typeof name !== "string" || name === "") continue;
+		if (packages.has(name)) throw new Error(`duplicate workspace package: ${name}`);
+		packages.set(name, {
+			directory,
+			name,
+			manifest
+		});
+	}
+	return packages;
+};
+const consumerPublishedDependencyFields = [
+	"dependencies",
+	"optionalDependencies",
+	"peerDependencies"
+];
+const consumerPackageClosure = ({ selected, packages, files }) => {
+	const closure = /* @__PURE__ */ new Map();
+	const visit = (pkg) => {
+		if (closure.has(pkg.name)) return;
+		assertConsumerPublishableManifest(pkg);
+		closure.set(pkg.name, pkg);
+		for (const field of consumerPublishedDependencyFields) {
+			const dependencies = pkg.manifest[field];
+			if (!consumerRecord(dependencies)) continue;
+			for (const [name, specifier] of Object.entries(dependencies)) {
+				const local = packages.get(name);
+				if (typeof specifier !== "string") throw new Error(`invalid package dependency: ${pkg.name} -> ${name}`);
+				if (specifier.startsWith("catalog:") && local !== void 0) {
+					const resolved = resolveConsumerCatalog({
+						directory: pkg.directory,
+						name,
+						specifier,
+						files
+					});
+					const version = local.manifest["version"];
+					if (resolved.startsWith("workspace:") || typeof version === "string" && (0, semver.validRange)(resolved) !== null && (0, semver.satisfies)(version, resolved)) throw new Error(`catalog dependency ${name} resolves to workspace package ${local.name}; use workspace:`);
+				}
+				if (/^workspace:(?:@[^/@]+\/)?[^/@]+@/.test(specifier)) throw new Error(`workspace alias specifiers are not supported by consumer-compat: ${name} -> ${specifier}; use the package name as the dependency key`);
+				if (/^(?:file:|link:)/.test(specifier)) throw new Error(`published local dependencies must use workspace protocol: ${pkg.name} -> ${name}`);
+				if (local && (specifier.startsWith("workspace:") || typeof local.manifest["version"] === "string" && (0, semver.validRange)(specifier) && (0, semver.satisfies)(local.manifest["version"], specifier))) {
+					if (local.manifest["private"] === true) throw new Error(`published package depends on private workspace package: ${pkg.name} -> ${name}`);
+					visit(local);
+				} else if (typeof specifier === "string" && specifier.startsWith("workspace:")) throw new Error(`unresolved workspace dependency: ${pkg.name} -> ${name}`);
+			}
+		}
+	};
+	visit(selected);
+	return closure;
+};
+//#endregion
+//#region src/consumer-node-support.ts
+const consumerNodeSupportMatches = ({ range, node }) => range === void 0 || typeof range === "string" && range.trim() !== "" && (0, semver.validRange)(range) !== null && (0, semver.satisfies)(node, range);
+const assertConsumerNodeSupport = ({ manifest, node, label }) => {
+	const engines = manifest["engines"];
+	const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+	if (engines !== void 0 && !record(engines) || !consumerNodeSupportMatches({
+		range: record(engines) ? engines["node"] : void 0,
+		node
+	})) throw new Error(`${label} engines.node must support consumer Node ${node}`);
+};
+//#endregion
+//#region src/toolchain-schema.ts
+const packagePinKeys = [
+	"oxlint",
+	"oxlint-tsgolint",
+	"@oxlint/plugins",
+	"@stll/oxlint-plugin",
+	"oxfmt",
+	"lefthook"
+];
+const valkeyArchitectures = ["amd64", "arm64"];
+const valkeyArtifactPackages = {
+	server: "valkey-server",
+	tools: "valkey-tools"
+};
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const artifactRecord = (value, keys) => {
+	if (!record(value) || Object.keys(value).some((key) => !keys.includes(key)) || keys.some((key) => !Object.hasOwn(value, key))) throw new Error("valkeyArtifacts requires complete, closed artifact objects");
+	return value;
+};
+const parseValkeyArtifacts = (input, version) => {
+	const architectures = artifactRecord(input, valkeyArchitectures);
+	const line = version.split(".").slice(0, 2).join(".");
+	const parseArchitecture = (architecture) => {
+		const packages = artifactRecord(architectures[architecture], Object.keys(valkeyArtifactPackages));
+		const parseArtifact = (kind) => {
+			const artifact = artifactRecord(packages[kind], ["url", "sha256"]);
+			const url = artifact["url"];
+			const sha256 = artifact["sha256"];
+			const expected = `https://download.valkey.io/packaging/valkey-${line}/deb/ubuntu2404/${architecture}/${valkeyArtifactPackages[kind]}_${version}-1.noble_${architecture}.deb`;
+			if (typeof url !== "string" || url !== expected) throw new Error("valkeyArtifacts URL must select the exact official versioned Ubuntu artifact");
+			if (typeof sha256 !== "string" || !/^[a-f0-9]{64}$/.test(sha256)) throw new Error("valkeyArtifacts requires a lowercase SHA256 pin");
+			return {
+				url,
+				sha256
+			};
+		};
+		return {
+			server: parseArtifact("server"),
+			tools: parseArtifact("tools")
+		};
+	};
+	return {
+		amd64: parseArchitecture("amd64"),
+		arm64: parseArchitecture("arm64")
+	};
+};
+/** Reject unsupported or incomplete installed policies before inspecting a consumer. */
+const parseToolchainPolicy = (input) => {
+	if (!record(input) || input["schemaVersion"] !== 1) throw new Error("toolchain.json must use schemaVersion 1");
+	const string = (object, key) => {
+		const value = object[key];
+		if (typeof value !== "string" || value.trim() === "") throw new Error(`toolchain.json requires a nonempty ${key}`);
+		return value;
+	};
+	const packages = {};
+	for (const key of packagePinKeys) packages[key] = string(input, key);
+	const bun = string(input, "bun");
+	const typescript = string(input, "typescript");
+	const node = string(input, "node");
+	const consumerNode = string(input, "consumerNode");
+	const consumerNpm = string(input, "consumerNpm");
+	const consumerPnpm = string(input, "consumerPnpm");
+	const consumerTypescript = string(input, "consumerTypescript");
+	const python = string(input, "python");
+	const postgres = string(input, "postgres");
+	const valkey = string(input, "valkey");
+	const rust = string(input, "rust");
+	const rustCompilerDevelopment = string(input, "rustCompilerDevelopment");
+	for (const [name, value] of Object.entries({
+		...packages,
+		bun,
+		typescript,
+		consumerNpm,
+		consumerPnpm,
+		consumerTypescript
+	})) if ((0, semver.valid)(value) !== value) throw new Error(`toolchain.json ${name} must be an exact release`);
+	if (!/^[1-9]\d*$/.test(postgres) || !Number.isSafeInteger(Number(postgres))) throw new Error("PostgreSQL must be a canonical positive major");
+	if ((0, semver.valid)(valkey) !== valkey || !/^\d+\.\d+\.\d+$/.test(valkey)) throw new Error("Valkey must be an exact stable release");
+	const valkeyArtifacts = parseValkeyArtifacts(input["valkeyArtifacts"], valkey);
+	if (!require_toolchain_inputs.nodePolicyValid(node)) throw new Error("Node must be a canonical major N.x series");
+	if ((0, semver.valid)(consumerNode) !== consumerNode || !consumerNode.startsWith("22.") || consumerNode.includes("-") || consumerNode.includes("+")) throw new Error("consumerNode must be an exact stable Node 22 release");
+	if (!/^\d+\.\d+(?:\.\d+)?$/.test(python)) throw new Error("Python must be an exact minor or patch release");
+	if (!/^\d+\.\d+\.\d+$/.test(rust)) throw new Error("Rust must be an exact stable release");
+	if (!/^nightly-\d{4}-\d{2}-\d{2}$/.test(rustCompilerDevelopment)) throw new Error("Rust compiler development must be a dated nightly");
+	if (!consumerTypescript.startsWith("6.") || consumerTypescript.includes("-") || consumerTypescript.includes("+")) throw new Error("consumerTypescript must be an exact stable TypeScript 6 release");
+	const compatibility = input["typescript6Compatibility"];
+	if (!record(compatibility)) throw new Error("missing TypeScript compatibility policy");
+	const version = string(compatibility, "version");
+	const packageAlias = string(compatibility, "packageAlias");
+	if ((0, semver.valid)(version) !== version) throw new Error("TypeScript compatibility must be an exact release");
+	const layouts = input["typescriptInstallLayouts"];
+	if (!Array.isArray(layouts) || layouts.length === 0) throw new Error("missing TypeScript install layouts");
+	const typescriptInstallLayouts = layouts.map((layout) => {
+		if (!record(layout)) throw new Error("invalid TypeScript install layout");
+		const compilerPackage = string(layout, "compilerPackage");
+		const compilerSpecifier = string(layout, "compilerSpecifier");
+		const typecheckCommand = string(layout, "typecheckCommand");
+		switch (layout["type"]) {
+			case "direct":
+				if (compilerSpecifier !== typescript || compilerPackage !== "typescript") throw new Error("direct TypeScript layout differs from shared version");
+				return {
+					type: "direct",
+					compilerPackage,
+					compilerSpecifier,
+					typecheckCommand
+				};
+			case "split-compatibility": {
+				const compatibilityPackage = string(layout, "compatibilityPackage");
+				const compatibilitySpecifier = string(layout, "compatibilitySpecifier");
+				if (compilerSpecifier !== `npm:typescript@${typescript}` || compatibilitySpecifier !== version) throw new Error("split TypeScript layout differs from shared versions");
+				return {
+					type: "split-compatibility",
+					compilerPackage,
+					compilerSpecifier,
+					compatibilityPackage,
+					compatibilitySpecifier,
+					typecheckCommand
+				};
+			}
+			default: throw new Error("unsupported TypeScript install layout");
+		}
+	});
+	const actionsInput = input["actions"];
+	if (!record(actionsInput) || Object.keys(actionsInput).length === 0) throw new Error("missing approved actions");
+	const actions = {};
+	for (const [name, action] of Object.entries(actionsInput)) {
+		if (!record(action)) throw new Error(`invalid action policy: ${name}`);
+		const sha = string(action, "sha");
+		const actionVersion = string(action, "version");
+		if (!/^[a-f0-9]{40}$/.test(sha) || !/^v\d+(?:\.\d+)*$/.test(actionVersion)) throw new Error(`invalid action SHA/version: ${name}`);
+		actions[name] = {
+			sha,
+			version: actionVersion
+		};
+	}
+	const dependabotInput = input["dependabot"];
+	if (!record(dependabotInput) || !record(dependabotInput["schedule"]) || !record(dependabotInput["cooldown"]) || !record(dependabotInput["groups"])) throw new Error("missing Dependabot policy");
+	const scheduleInput = dependabotInput["schedule"];
+	const schedule = {
+		interval: string(scheduleInput, "interval"),
+		day: string(scheduleInput, "day"),
+		time: string(scheduleInput, "time"),
+		timezone: string(scheduleInput, "timezone")
+	};
+	const defaultDays = dependabotInput["cooldown"]["defaultDays"];
+	if (typeof defaultDays !== "number" || !Number.isInteger(defaultDays) || defaultDays < 5) throw new Error("Dependabot cooldown must be at least five days");
+	const strings = (value) => {
+		if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string")) throw new Error("Dependabot group values must be string arrays");
+		return value;
+	};
+	const groups = {};
+	for (const [name, group] of Object.entries(dependabotInput["groups"])) {
+		if (!record(group)) throw new Error(`invalid Dependabot group: ${name}`);
+		groups[name] = {
+			patterns: strings(group["patterns"]),
+			updateTypes: strings(group["updateTypes"])
+		};
+	}
+	return {
+		bun,
+		typescript,
+		node,
+		postgres,
+		valkey,
+		valkeyArtifacts,
+		consumerNode,
+		consumerNpm,
+		consumerPnpm,
+		consumerTypescript,
+		python,
+		rust,
+		rustCompilerDevelopment,
+		packages,
+		actions,
+		typescriptInstallLayouts,
+		typescript6Compatibility: {
+			version,
+			packageAlias
+		},
+		dependabot: {
+			schedule,
+			cooldown: { defaultDays },
+			groups,
+			ignoredPackages: [.../* @__PURE__ */ new Set([
+				...Object.keys(packages),
+				...typescriptInstallLayouts.flatMap((layout) => layout.type === "direct" ? [layout.compilerPackage] : [layout.compilerPackage, layout.compatibilityPackage]),
+				packageAlias,
+				"bun-types"
+			])],
+			ignoredActions: Object.keys(actions),
+			ignoredImages: [
+				"node",
+				"python",
+				"oven/bun"
+			]
+		}
+	};
+};
+//#endregion
+Object.defineProperty(exports, "assertConsumerFixtureKind", {
+	enumerable: true,
+	get: function() {
+		return assertConsumerFixtureKind;
+	}
+});
+Object.defineProperty(exports, "assertConsumerFixtureManifest", {
+	enumerable: true,
+	get: function() {
+		return assertConsumerFixtureManifest;
+	}
+});
+Object.defineProperty(exports, "assertConsumerFixtureSelection", {
+	enumerable: true,
+	get: function() {
+		return assertConsumerFixtureSelection;
+	}
+});
+Object.defineProperty(exports, "assertConsumerNodeSupport", {
+	enumerable: true,
+	get: function() {
+		return assertConsumerNodeSupport;
+	}
+});
+Object.defineProperty(exports, "assertConsumerPublishableManifest", {
+	enumerable: true,
+	get: function() {
+		return assertConsumerPublishableManifest;
+	}
+});
+Object.defineProperty(exports, "bindConsumerManifest", {
+	enumerable: true,
+	get: function() {
+		return bindConsumerManifest;
+	}
+});
+Object.defineProperty(exports, "bunCatalogState", {
+	enumerable: true,
+	get: function() {
+		return bunCatalogState;
+	}
+});
+Object.defineProperty(exports, "catalogState", {
+	enumerable: true,
+	get: function() {
+		return catalogState;
+	}
+});
+Object.defineProperty(exports, "consumerDependencyConfigFiles", {
+	enumerable: true,
+	get: function() {
+		return consumerDependencyConfigFiles;
+	}
+});
+Object.defineProperty(exports, "consumerNodeSupportMatches", {
+	enumerable: true,
+	get: function() {
+		return consumerNodeSupportMatches;
+	}
+});
+Object.defineProperty(exports, "consumerPackRootManifest", {
+	enumerable: true,
+	get: function() {
+		return consumerPackRootManifest;
+	}
+});
+Object.defineProperty(exports, "consumerPackageClosure", {
+	enumerable: true,
+	get: function() {
+		return consumerPackageClosure;
+	}
+});
+Object.defineProperty(exports, "consumerRecord", {
+	enumerable: true,
+	get: function() {
+		return consumerRecord;
+	}
+});
+Object.defineProperty(exports, "consumerRelativePath", {
+	enumerable: true,
+	get: function() {
+		return consumerRelativePath;
+	}
+});
+Object.defineProperty(exports, "consumerStagingPaths", {
+	enumerable: true,
+	get: function() {
+		return consumerStagingPaths;
+	}
+});
+Object.defineProperty(exports, "discoverConsumerManifests", {
+	enumerable: true,
+	get: function() {
+		return discoverConsumerManifests;
+	}
+});
+Object.defineProperty(exports, "discoverConsumerPackages", {
+	enumerable: true,
+	get: function() {
+		return discoverConsumerPackages;
+	}
+});
+Object.defineProperty(exports, "parseConsumerFixtures", {
+	enumerable: true,
+	get: function() {
+		return parseConsumerFixtures;
+	}
+});
+Object.defineProperty(exports, "parseToolchainPolicy", {
+	enumerable: true,
+	get: function() {
+		return parseToolchainPolicy;
+	}
+});
+Object.defineProperty(exports, "pnpmWorkspaceState", {
+	enumerable: true,
+	get: function() {
+		return pnpmWorkspaceState;
+	}
+});
+
+//# sourceMappingURL=toolchain-schema.cjs.map