@stll/oxlint-config 1.0.2 → 1.1.0

package/dist/toolchain-inputs.cjs

@@ -1,7 +1,11 @@
 const require_rolldown_runtime = require("./rolldown-runtime.cjs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let node_crypto = require("node:crypto");
 let semver = require("semver");
+let smol_toml = require("smol-toml");
+let node_util = require("node:util");
+let yaml = require("yaml");
 let picomatch = require("picomatch");
 picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 //#region src/cloud-setup-install.ts
@@ -38,7 +42,7 @@ apt_install() (
   policy_state=installed
   printf '%s\n' '#!/bin/sh' 'exit 101' > /usr/sbin/policy-rc.d
   chmod 755 /usr/sbin/policy-rc.d
-  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$@"
+  DEBIAN_FRONTEND=noninteractive apt_network install -y --no-install-recommends "$@"
 )
 
 `;
@@ -162,7 +166,7 @@ const postgresInstall = String.raw`
     if [[ "$PGDG_SOURCE_STATE" == missing ]]; then
       local key key_fingerprint
       key="$(mktemp)"
-      curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 https://www.postgresql.org/media/keys/ACCC4CF8.asc -o "$key"
+      download_file https://www.postgresql.org/media/keys/ACCC4CF8.asc "$key" 45
       key_fingerprint="$(pgdg_key_fingerprint "$key")"
       [[ "$key_fingerprint" == @PGDG_FINGERPRINT@ ]] || fail 'PostgreSQL signing key mismatch'
       install -d -m 755 /usr/share/keyrings
@@ -170,7 +174,7 @@ const postgresInstall = String.raw`
       rm -- "$key"
       printf '%s\n' '@PGDG_SOURCE@' > /etc/apt/sources.list.d/stll-pgdg.list
     fi
-    apt-get update
+    apt_network update
     apt_install postgresql-@POSTGRES@ postgresql-client-@POSTGRES@
   fi
   postgres_ready || fail 'PostgreSQL toolchain is incomplete or differs from the policy major'
@@ -185,15 +189,15 @@ const valkeyInstall = String.raw`
       arm64) server_url='@ARM64_SERVER_URL@'; server_sha='@ARM64_SERVER_SHA@'; tools_url='@ARM64_TOOLS_URL@'; tools_sha='@ARM64_TOOLS_SHA@' ;;
       *) fail 'Unsupported Valkey architecture' ;;
     esac
-    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "$server_url" -o "$scratch/valkey-server.deb"
-    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "$tools_url" -o "$scratch/valkey-tools.deb"
+    download_file "$server_url" "$scratch/valkey-server.deb" 120
+    download_file "$tools_url" "$scratch/valkey-tools.deb" 120
     (cd "$scratch"; printf '%s  %s\n' "$server_sha" valkey-server.deb "$tools_sha" valkey-tools.deb | sha256sum --strict -c -)
     for package in valkey-server valkey-tools; do
       [[ "$(dpkg-deb -f "$scratch/$package.deb" Package)" == "$package" ]] || fail 'Valkey artifact package mismatch'
       [[ "$(dpkg-deb -f "$scratch/$package.deb" Version)" == '@VALKEY@-1.noble' ]] || fail 'Valkey artifact version mismatch'
       [[ "$(dpkg-deb -f "$scratch/$package.deb" Architecture)" == "$ARCH" ]] || fail 'Valkey artifact architecture mismatch'
     done
-    apt-get update
+    apt_network update
     apt_install "$scratch/valkey-server.deb" "$scratch/valkey-tools.deb"
     rm -rf -- "$scratch"
   fi
@@ -257,15 +261,235 @@ const renderCloudServiceInstall = ({ services, postgres, valkey, valkeyArtifacts
 	return `${packageInstall}\n${services.includes("postgres") ? postgresSources.replaceAll("@PGDG_FINGERPRINT@", postgresSigningFingerprint) : ""}\n${services.length === 0 ? "prepare_state() { :; }\n" : state}\ninstall_services() {\n${user}${parts.join("")}\n  :\n}\n`;
 };
 //#endregion
+//#region src/cloud-setup-network.ts
+/** Shared deadlines cover retries and package-manager subprocesses. */
+const renderCloudNetwork = () => String.raw`
+network_run() (
+  local host="$1" seconds="$2" status=0
+  shift 2
+  set -o pipefail
+  network_log="$(mktemp)" || return "$?"
+  trap 'rm -f -- "$network_log"' EXIT
+  trap 'exit 129' HUP
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+  if timeout --signal=TERM --kill-after=5s "$seconds"s "$@" 2>&1 | tee "$network_log"; then
+    return 0
+  else
+    # Scalar Bash array expansion reads PIPESTATUS[0] before assignment resets it.
+    status="$PIPESTATUS"
+  fi
+  [[ "$status" != 0 ]] || fail 'Cannot capture network command output'
+  if [[ "$status" == 124 || "$status" == 137 || "$status" == 28 ]] || grep -Eiq 'timed[[:space:]-]+out|time[[:space:]-]+out|timeout[[:space:]]+(was[[:space:]]+)?(reached|expired)|(connection|operation|socket)[[:space:]-]+timeout' "$network_log"; then
+    fail "download timed out: $host"
+  fi
+  return "$status"
+)
+download_file() {
+  local url="$1" destination="$2" seconds="$3" host
+  host="$(printf '%s\n' "$url" | cut -d/ -f3 | sed 's/.*@//')"
+  [[ "$url" == https://* && -n "$host" ]] || fail 'Downloads require an HTTPS host'
+  network_run "$host" "$seconds" curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 --connect-timeout 20 --max-time "$seconds" --retry 3 --retry-all-errors --retry-max-time "$seconds" "$url" -o "$destination"
+}
+apt_network() {
+  local hosts
+  # --print-uris reads configured indexes without contacting their servers.
+  hosts="$(set -o pipefail; apt-get --print-uris update | awk -F/ '/^\047https?:\/\// { host=$3; sub(/.*@/, "", host); if (!seen[host]++) { printf "%s%s", separator, host; separator="," } }')" || return "$?"
+  [[ -n "$hosts" ]] || hosts='configured APT hosts'
+  network_run "$hosts" 180 apt-get -o Acquire::http::Timeout=20 -o Acquire::https::Timeout=20 -o Acquire::Retries=3 -o APT::Update::Error-Mode=any "$@"
+}
+`;
+//#endregion
+//#region src/cloud-setup-artifacts.ts
+const wasmBindgen0126 = {
+	version: "0.2.126",
+	amd64: {
+		url: "https://github.com/wasm-bindgen/wasm-bindgen/releases/download/0.2.126/wasm-bindgen-0.2.126-x86_64-unknown-linux-musl.tar.gz",
+		sha256: "064948d58e2d6c0a745216477a639ba696216d6309aaa902939d1b865b1d869d",
+		archive: "tar.gz",
+		binaries: {
+			"wasm-bindgen-test-runner": "wasm-bindgen-0.2.126-x86_64-unknown-linux-musl/wasm-bindgen-test-runner",
+			wasm2es6js: "wasm-bindgen-0.2.126-x86_64-unknown-linux-musl/wasm2es6js",
+			"wasm-bindgen": "wasm-bindgen-0.2.126-x86_64-unknown-linux-musl/wasm-bindgen"
+		}
+	},
+	arm64: {
+		url: "https://github.com/wasm-bindgen/wasm-bindgen/releases/download/0.2.126/wasm-bindgen-0.2.126-aarch64-unknown-linux-musl.tar.gz",
+		sha256: "2245120254a9f6c9a9adf3601f3d52bb31309219e9ceab7696e74e24885c440a",
+		archive: "tar.gz",
+		binaries: {
+			"wasm-bindgen-test-runner": "wasm-bindgen-0.2.126-aarch64-unknown-linux-musl/wasm-bindgen-test-runner",
+			wasm2es6js: "wasm-bindgen-0.2.126-aarch64-unknown-linux-musl/wasm2es6js",
+			"wasm-bindgen": "wasm-bindgen-0.2.126-aarch64-unknown-linux-musl/wasm-bindgen"
+		}
+	}
+};
+/** Pinned upstream Linux artifacts, verified against their published SHA-256 sums. */
+const cloudSetupArtifacts = {
+	"rustup-init": {
+		version: "1.29.1",
+		amd64: {
+			url: "https://static.rust-lang.org/rustup/archive/1.29.1/x86_64-unknown-linux-gnu/rustup-init",
+			sha256: "dda7234360b7f578ca8b0ddcb80145646fa61a67c1720a5abc7051b35c9fcb71",
+			archive: "binary",
+			binaries: { "rustup-init": "rustup-init" }
+		},
+		arm64: {
+			url: "https://static.rust-lang.org/rustup/archive/1.29.1/aarch64-unknown-linux-gnu/rustup-init",
+			sha256: "15f6e4ce9f583b929c996c91562bad6d4454f3281de858b02cdfdef615fac433",
+			archive: "binary",
+			binaries: { "rustup-init": "rustup-init" }
+		}
+	},
+	"cargo-nextest": {
+		version: "0.9.148",
+		amd64: {
+			url: "https://github.com/nextest-rs/nextest/releases/download/cargo-nextest-0.9.148/cargo-nextest-0.9.148-x86_64-unknown-linux-musl.tar.gz",
+			sha256: "bf92cb81450872d960ffa13857a83084d557ec0cdc141663d263bb23ef756f97",
+			archive: "tar.gz",
+			binaries: { "cargo-nextest": "cargo-nextest" }
+		},
+		arm64: {
+			url: "https://github.com/nextest-rs/nextest/releases/download/cargo-nextest-0.9.148/cargo-nextest-0.9.148-aarch64-unknown-linux-musl.tar.gz",
+			sha256: "94676506ceaed01746d78cfe9ed124ee841b2932fd18d9d10f438a347bd9ba5e",
+			archive: "tar.gz",
+			binaries: { "cargo-nextest": "cargo-nextest" }
+		}
+	},
+	"wasm-bindgen-cli": {
+		version: "0.2.129",
+		amd64: {
+			url: "https://github.com/wasm-bindgen/wasm-bindgen/releases/download/0.2.129/wasm-bindgen-0.2.129-x86_64-unknown-linux-musl.tar.gz",
+			sha256: "82d12bb940e2d4e72e0d5605387fc1b8ca179044e012b620f0ce4e7440e8320e",
+			archive: "tar.gz",
+			binaries: {
+				"wasm-bindgen-test-runner": "wasm-bindgen-0.2.129-x86_64-unknown-linux-musl/wasm-bindgen-test-runner",
+				wasm2es6js: "wasm-bindgen-0.2.129-x86_64-unknown-linux-musl/wasm2es6js",
+				"wasm-bindgen": "wasm-bindgen-0.2.129-x86_64-unknown-linux-musl/wasm-bindgen"
+			}
+		},
+		arm64: {
+			url: "https://github.com/wasm-bindgen/wasm-bindgen/releases/download/0.2.129/wasm-bindgen-0.2.129-aarch64-unknown-linux-musl.tar.gz",
+			sha256: "2ed4351c35dd9440308bbb02767d47ea278efe851a52465300f3c94f5b6c2a87",
+			archive: "tar.gz",
+			binaries: {
+				"wasm-bindgen-test-runner": "wasm-bindgen-0.2.129-aarch64-unknown-linux-musl/wasm-bindgen-test-runner",
+				wasm2es6js: "wasm-bindgen-0.2.129-aarch64-unknown-linux-musl/wasm2es6js",
+				"wasm-bindgen": "wasm-bindgen-0.2.129-aarch64-unknown-linux-musl/wasm-bindgen"
+			}
+		}
+	},
+	uv: {
+		version: "0.13.1",
+		amd64: {
+			url: "https://github.com/astral-sh/uv/releases/download/0.13.1/uv-x86_64-unknown-linux-musl.tar.gz",
+			sha256: "6c86040a8f045ab9adc9e3ec4cdafa03fd00e9a988ed2bf28971c7fc2d0debd0",
+			archive: "tar.gz",
+			binaries: {
+				uv: "uv-x86_64-unknown-linux-musl/uv",
+				uvx: "uv-x86_64-unknown-linux-musl/uvx"
+			}
+		},
+		arm64: {
+			url: "https://github.com/astral-sh/uv/releases/download/0.13.1/uv-aarch64-unknown-linux-musl.tar.gz",
+			sha256: "345a8308e4d1835cdfaadf692836fd3137a6d45864773f05ad7bf59442b1ba16",
+			archive: "tar.gz",
+			binaries: {
+				uv: "uv-aarch64-unknown-linux-musl/uv",
+				uvx: "uv-aarch64-unknown-linux-musl/uvx"
+			}
+		}
+	}
+};
+/** Explicit releases whose CLI must match a project's wasm-bindgen crate exactly. */
+const wasmBindgenArtifactReleases = [wasmBindgen0126, cloudSetupArtifacts["wasm-bindgen-cli"]];
+/** Every supported version participates in lookup and catalog validation. */
+const cloudSetupArtifactVersions = {
+	"rustup-init": [cloudSetupArtifacts["rustup-init"]],
+	"cargo-nextest": [cloudSetupArtifacts["cargo-nextest"]],
+	"wasm-bindgen-cli": wasmBindgenArtifactReleases,
+	uv: [cloudSetupArtifacts.uv]
+};
+/** A new version requires an explicit, verified catalog entry; never build from source. */
+const getCloudSetupArtifact = (tool, version) => {
+	const releases = cloudSetupArtifactVersions[tool];
+	const artifact = releases.find((release) => release.version === version);
+	if (artifact === void 0) throw new Error(`Unsupported ${tool} version ${version}; supported versions: ${releases.map((release) => release.version).join(", ")}`);
+	return artifact;
+};
+//#endregion
 //#region src/cloud-setup-schema.ts
 const cloudServices = ["postgres", "valkey"];
+const cloudExtraTools = Object.keys(cloudSetupArtifacts).filter((tool) => tool !== "rustup-init" && Object.hasOwn(cloudSetupArtifacts, tool));
+const object = (input) => typeof input === "object" && input !== null && !Array.isArray(input);
+const exactPin = (input) => typeof input === "string" && /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(input);
+const cloudRustComponentBinaries = {
+	clippy: ["cargo-clippy", "clippy-driver"],
+	rustfmt: ["rustfmt", "cargo-fmt"],
+	"rust-src": [],
+	"rust-analyzer": ["rust-analyzer"]
+};
+const parseCloudRustNames = (input, kind) => {
+	const label = `cloud Rust ${kind}`;
+	if (input === void 0) return [];
+	if (!Array.isArray(input)) throw new Error(`${label} must be an array`);
+	const result = input.map((value) => {
+		if (typeof value !== "string" || !/^[a-z][a-z0-9_-]*$/.test(value)) throw new Error(`${label} requires canonical names`);
+		if (kind === "components" && !Object.hasOwn(cloudRustComponentBinaries, value)) throw new Error(`${label} contains an unsupported component: ${value}`);
+		return value;
+	});
+	if (new Set(result).size !== result.length) throw new Error(`${label} contains duplicates`);
+	return result;
+};
+const parseRust = (input) => {
+	if (input === void 0) return void 0;
+	if (!object(input) || Object.keys(input).some((key) => ![
+		"toolchain",
+		"components",
+		"targets"
+	].includes(key))) throw new Error("cloud.rust accepts only toolchain, components and targets");
+	const toolchain = input["toolchain"];
+	if (toolchain !== void 0 && !exactPin(toolchain)) throw new Error("cloud.rust.toolchain must be an exact stable release");
+	return {
+		...toolchain === void 0 ? {} : { toolchain },
+		components: parseCloudRustNames(input["components"], "components"),
+		targets: parseCloudRustNames(input["targets"], "targets")
+	};
+};
+const parseTools = (input) => {
+	if (input === void 0) return void 0;
+	if (!object(input) || Object.keys(input).some((key) => !cloudExtraTools.some((tool) => tool === key))) throw new Error(`cloud.tools accepts only ${cloudExtraTools.join(", ")}`);
+	const result = {};
+	for (const tool of cloudExtraTools) {
+		const pin = input[tool];
+		if (pin === void 0) {
+			if (Object.hasOwn(input, tool)) throw new Error(`cloud.tools.${tool} must be an exact stable release`);
+			continue;
+		}
+		if (!exactPin(pin)) throw new Error(`cloud.tools.${tool} must be an exact stable release`);
+		result[tool] = pin;
+	}
+	return result;
+};
 const cloudInstallCommand = "bun install --frozen-lockfile";
 const cloudService = (value) => cloudServices.some((service) => value === service);
+const parseEnvFile = (input) => {
+	if (!("envFile" in input) || typeof input.envFile !== "string") throw new Error("cloud.envFile must be a canonical repository-relative path");
+	const envFile = input.envFile;
+	if (envFile.startsWith("/") || /^[A-Za-z]:/.test(envFile) || envFile.includes("\\") || /\p{Cc}/u.test(envFile) || envFile.split("/").some((part) => part === "" || part === "." || part === "..")) throw new Error("cloud.envFile must be a canonical repository-relative path");
+	return envFile;
+};
 /** Parse an explicit declaration without assuming services for undeclared repositories. */
 const parseCloudSetup = (input) => {
 	if (input === void 0) return void 0;
 	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error("cloud must be an object");
-	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile") throw new Error(`unsupported cloud key: ${key}`);
+	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile" && key !== "rust" && key !== "tools") throw new Error(`unsupported cloud key: ${key}`);
+	const rust = parseRust("rust" in input ? input.rust : void 0);
+	const tools = parseTools("tools" in input ? input.tools : void 0);
+	const extensions = {
+		...rust === void 0 ? {} : { rust },
+		...tools === void 0 ? {} : { tools }
+	};
 	const selected = "services" in input ? input.services : [];
 	if (!Array.isArray(selected)) throw new Error("cloud.services must be an array when provided");
 	if (!("install" in input) || input.install !== "bun install --frozen-lockfile") throw new Error(`cloud.install must be exactly ${cloudInstallCommand}`);
@@ -276,20 +500,12 @@ const parseCloudSetup = (input) => {
 		seen.add(service);
 		return service;
 	});
-	if (services.length === 0) {
-		if ("envFile" in input) throw new Error("cloud.envFile is not allowed without services");
-		return {
-			services,
-			install: cloudInstallCommand
-		};
-	}
-	if (!("envFile" in input) || typeof input.envFile !== "string") throw new Error("cloud.envFile must be a canonical repository-relative path");
-	const envFile = input.envFile;
-	if (envFile.startsWith("/") || /^[A-Za-z]:/.test(envFile) || envFile.includes("\\") || /\p{Cc}/u.test(envFile) || envFile.split("/").some((part) => part === "" || part === "." || part === "..")) throw new Error("cloud.envFile must be a canonical repository-relative path");
+	if (services.length === 0 && "envFile" in input) throw new Error("cloud.envFile is not allowed without services");
 	return {
 		services,
 		install: cloudInstallCommand,
-		envFile
+		...extensions,
+		...services.length === 0 ? {} : { envFile: parseEnvFile(input) }
 	};
 };
 //#endregion
@@ -356,7 +572,7 @@ service_prune_pid() {
 }
 `;
 const postgresStart = String.raw`
-  local pg_bin='/usr/lib/postgresql/@POSTGRES@/bin' pg_data="$STATE/postgres" pg_password pg_details pg_pid pg_version
+  local pg_bin='/usr/lib/postgresql/@POSTGRES@/bin' pg_data="$STATE/postgres" pg_password pg_details pg_pid pg_version pg_state='already running'
   service_password "$STATE/postgres.password"
   pg_password="$(cat "$STATE/postgres.password")"
   service_directory "$pg_data"
@@ -375,6 +591,7 @@ const postgresStart = String.raw`
   service_prune_pid "$pg_data/postmaster.pid" "$pg_bin/postgres" postgres
   if ! service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/pg_ctl" -D "$pg_data" status >/dev/null 2>&1; then
     service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/pg_ctl" -D "$pg_data" -l "$pg_data/cloud.log" -o "-h 127.0.0.1 -p 55432 -c unix_socket_directories=" -t 10 -w start >/dev/null || fail "PostgreSQL start failed; port 55432 must be available"
+    pg_state=started
   fi
   pg_details="$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/psql" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c "SELECT current_setting('data_directory'), current_setting('listen_addresses'), current_setting('port'), current_setting('server_version_num'), current_setting('unix_socket_directories')")" || fail "PostgreSQL authenticated readiness failed"
   pg_version="$(printf '%s\n' "$pg_details" | cut -d '|' -f4)"
@@ -384,9 +601,10 @@ const postgresStart = String.raw`
   service_process "$pg_pid" "$pg_bin/postgres"
   [[ "$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/psql" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c "SELECT count(*) FROM pg_database WHERE datname = 'cloud_test'")" == 1 ]] || env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/createdb" -h 127.0.0.1 -p 55432 -U stll_cloud cloud_test || fail "PostgreSQL test database creation failed"
   DATABASE_URL="postgresql://stll_cloud:$pg_password@127.0.0.1:55432/cloud_test"
+  printf 'postgres: %s\n' "$pg_state"
 `;
 const valkeyStart = String.raw`
-  local vk_data="$STATE/valkey" vk_password vk_config vk_info vk_pid vk_expected ready=0
+  local vk_data="$STATE/valkey" vk_password vk_config vk_info vk_pid vk_expected ready=0 vk_state='already running'
   service_password "$STATE/valkey.password"
   vk_password="$(cat "$STATE/valkey.password")"
   service_directory "$vk_data"
@@ -406,7 +624,8 @@ const valkeyStart = String.raw`
   [[ "$(cat "$vk_config")" == "$vk_expected" ]] || fail "Valkey configuration differs from managed settings"
   service_prune_pid "$vk_data/valkey.pid" "$(command -v valkey-server)" valkey
   if [[ ! -e "$vk_data/valkey.pid" ]]; then
-    service_run valkey-server "$vk_config" || fail "Valkey start failed; port 56379 must be available"
+    service_run valkey-server "$vk_config" >/dev/null || fail "Valkey start failed; port 56379 must be available"
+    vk_state=started
   fi
   for ((attempt=0; attempt<20; attempt++)); do
     if vk_info="$(VALKEYCLI_AUTH="$vk_password" timeout 0.2 valkey-cli -h 127.0.0.1 -p 56379 --raw INFO server 2>/dev/null)"; then
@@ -422,6 +641,7 @@ const valkeyStart = String.raw`
   [[ "$(VALKEYCLI_AUTH="$vk_password" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET bind)" == $'bind\n127.0.0.1' ]] || fail "Valkey endpoint must bind only loopback"
   [[ "$(VALKEYCLI_AUTH="$vk_password" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET dir)" == "$(printf 'dir\n%s' "$vk_data")" ]] || fail "Valkey endpoint has a different data directory"
   REDIS_URL="redis://:$vk_password@127.0.0.1:56379/0"
+  printf 'valkey: %s\n' "$vk_state"
 `;
 /** Render only declared services; installation and environment-file ownership stay with the caller. */
 const renderCloudServiceStart = ({ services, postgres, valkey }) => {
@@ -437,6 +657,267 @@ const renderCloudServiceStart = ({ services, postgres, valkey }) => {
 	return `${common}\nstart_services() {\n  local SERVICE_UID file attempt\n  SERVICE_UID="$(id -u stll-cloud)"\n  [[ -d "$STATE" && ! -L "$STATE" && "$(stat -c '%u' "$STATE")" == 0 ]] || fail "Invalid cloud service state directory"\n${bodies.join("")}\n}\n`;
 };
 //#endregion
+//#region src/cloud-setup-shell.ts
+const cloudShellProfilePath = "/etc/profile.d/stll-cloud.sh";
+const cloudShellProfileSource = `. ${cloudShellProfilePath}`;
+const quote$1 = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+const renderCloudShellProfile = ({ nodeVersion, bunVersion, rust }) => {
+	const node = `/opt/stll-cloud/node/${nodeVersion}/bin`;
+	const bun = `/opt/stll-cloud/bun/${bunVersion}`;
+	return `# Generated by stll-cloud-setup; managed cloud shell environment.
+# Remove managed entries before prepending, including repeated shell startup.
+_stll_cloud_remaining="\${PATH-}"
+_stll_cloud_result=''
+_stll_cloud_separator=''
+while :; do
+  case "$_stll_cloud_remaining" in
+    *:*) _stll_cloud_part="\${_stll_cloud_remaining%%:*}"; _stll_cloud_remaining="\${_stll_cloud_remaining#*:}"; _stll_cloud_more=yes ;;
+    *) _stll_cloud_part="$_stll_cloud_remaining"; _stll_cloud_more=no ;;
+  esac
+  case "$_stll_cloud_part" in
+    ${quote$1(node)}|${quote$1(bun)}|/usr/local/bin) ;;
+    *) _stll_cloud_result="$_stll_cloud_result$_stll_cloud_separator$_stll_cloud_part"; _stll_cloud_separator=: ;;
+  esac
+  [ "$_stll_cloud_more" = yes ] || break
+done
+export PATH=${quote$1(`${node}:${bun}:/usr/local/bin`)}"\${_stll_cloud_separator:+:}$_stll_cloud_result"
+unset _stll_cloud_remaining _stll_cloud_result _stll_cloud_separator _stll_cloud_part _stll_cloud_more
+${rust === void 0 ? "" : `export RUSTUP_HOME=/opt/stll-cloud/rustup\nexport CARGO_HOME=/opt/stll-cloud/cargo\nexport RUSTUP_TOOLCHAIN=${quote$1(rust.channel)}\nexport RUSTUP_AUTO_INSTALL=0\n`}`;
+};
+const userStartup = String.raw`
+set -euo pipefail
+for name in .bashrc .profile .bash_profile .bash_login; do
+  file="$HOME/$name"
+  if [[ ! -e "$file" && ! -L "$file" && "$name" != .bashrc && "$name" != .profile ]]; then continue; fi
+  [[ ! -L "$file" ]] || { echo "cloud-setup: shell startup file must not be a symlink: $name" >&2; exit 1; }
+  if [[ -e "$file" ]]; then
+    [[ -f "$file" && "$(stat -c '%h:%u' "$file")" == "1:$(id -u)" ]] || { echo "cloud-setup: shell startup file must be owned and single-link: $name" >&2; exit 1; }
+  fi
+  temporary="$(mktemp "$HOME/.stll-cloud-shell.XXXXXX")"
+  trap 'rm -f -- "$temporary"' EXIT
+  if [[ "$name" == .bashrc ]]; then
+    printf '%s\n' '# stll-cloud: early environment' '@SOURCE@' > "$temporary"
+  fi
+  if [[ -f "$file" ]]; then
+    # Remove only exact managed blocks; preserve unrelated startup lines and permissions.
+    awk '
+      $0 == "# stll-cloud: early environment" || $0 == "# stll-cloud: session environment" {
+        if ((getline following) <= 0 || following != "@SOURCE@") exit 1
+        next
+      }
+      { print }
+    ' "$file" >> "$temporary" || { echo "cloud-setup: managed shell startup block differs: $name" >&2; exit 1; }
+  fi
+  printf '%s\n' '# stll-cloud: session environment' '@SOURCE@' >> "$temporary"
+  if [[ -f "$file" ]] && cmp -s "$temporary" "$file"; then rm -- "$temporary"; continue; fi
+  if [[ -f "$file" ]]; then chmod --reference="$file" "$temporary"; else chmod 644 "$temporary"; fi
+  mv -f -- "$temporary" "$file"
+done
+`;
+const renderCloudShellInstall = (options) => {
+	const profile = renderCloudShellProfile(options);
+	return `install_shell_environment() (
+  # Subshell scope retains temporary for EXIT cleanup after a failed command.
+  [[ ! -L ${quote$1(cloudShellProfilePath)} ]] || fail 'Managed shell profile must not be a symlink'
+  if [[ -e ${quote$1(cloudShellProfilePath)} ]]; then
+    [[ -f ${quote$1(cloudShellProfilePath)} && "$(stat -c '%h:%u' ${quote$1(cloudShellProfilePath)})" == 1:0 ]] || fail 'Managed shell profile must be a root-owned single-link file'
+  fi
+  temporary="$(mktemp)"
+  trap 'rm -f -- "$temporary"' EXIT
+  cat > "$temporary" <<'STLL_CLOUD_PROFILE'
+${profile}STLL_CLOUD_PROFILE
+  if ! cmp -s "$temporary" ${quote$1(cloudShellProfilePath)}; then install -m 644 "$temporary" ${quote$1(cloudShellProfilePath)}; fi
+  runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" bash -c ${quote$1(userStartup.replaceAll("@SOURCE@", cloudShellProfileSource))}
+)
+verify_shell_environment() {
+  [[ -f ${quote$1(cloudShellProfilePath)} && ! -L ${quote$1(cloudShellProfilePath)} && "$(stat -c '%h:%u' ${quote$1(cloudShellProfilePath)})" == 1:0 ]] || fail 'Managed shell environment is unavailable; run install'
+  [[ "$(sha256sum -- ${quote$1(cloudShellProfilePath)} | cut -d ' ' -f1)" == ${quote$1((0, node_crypto.createHash)("sha256").update(profile).digest("hex"))} ]] || fail 'Managed shell environment differs; run install'
+}
+`;
+};
+//#endregion
+//#region src/cloud-setup-toolchains.ts
+const record$2 = (input) => typeof input === "object" && input !== null && !Array.isArray(input);
+/** Resolve the same tracked snapshot for generation and the mandatory drift check. */
+const resolveCloudToolchains = ({ cloud, files, rust, rustExceptions }) => {
+	const source = files["rust-toolchain.toml"];
+	const selector = files["rust-toolchain"];
+	if (source !== void 0 && selector !== void 0) throw new Error("cloud Rust requires one root rust-toolchain.toml or rust-toolchain file");
+	let declared;
+	if (source !== void 0 || selector?.trimStart().startsWith("[")) {
+		const parsed = (0, smol_toml.parse)(source ?? selector ?? "");
+		if (!record$2(parsed["toolchain"])) throw new Error("cloud Rust requires [toolchain]");
+		declared = parsed["toolchain"];
+		if (Object.keys(declared).some((key) => ![
+			"channel",
+			"components",
+			"targets",
+			"profile"
+		].includes(key))) throw new Error("cloud Rust supports only channel, components, targets and profile");
+		if (declared["profile"] !== void 0 && declared["profile"] !== "minimal") throw new Error("cloud Rust requires profile = minimal; declare required components explicitly");
+	} else if (selector !== void 0) declared = { channel: selector.trim() };
+	const rustEnabled = declared !== void 0 || cloud.rust !== void 0;
+	const channel = declared === void 0 ? cloud.rust?.toolchain ?? rust : declared["channel"];
+	if (rustEnabled) {
+		if (typeof channel !== "string" || !/^\d+\.\d+\.\d+$/.test(channel)) throw new Error("cloud Rust requires an exact stable toolchain");
+		if (channel !== rust && !rustExceptions.some(({ pin }) => pin === channel)) throw new Error(`cloud Rust must use shared Rust ${rust} or a recorded rustExceptions pin`);
+		if (cloud.rust?.toolchain !== void 0 && cloud.rust.toolchain !== channel) throw new Error("cloud.rust.toolchain conflicts with root Rust toolchain");
+	}
+	const components = [.../* @__PURE__ */ new Set([...parseCloudRustNames(declared?.["components"], "components"), ...cloud.rust?.components ?? []])].sort();
+	const targets = [.../* @__PURE__ */ new Set([...parseCloudRustNames(declared?.["targets"], "targets"), ...cloud.rust?.targets ?? []])].sort();
+	const tools = cloudExtraTools.flatMap((tool) => {
+		const version = cloud.tools?.[tool];
+		if (version === void 0) return [];
+		if (tool === "cargo-nextest" && !rustEnabled) throw new Error("cloud.tools.cargo-nextest requires a Rust toolchain");
+		if (tool === "wasm-bindgen-cli") {
+			const lock = files["Cargo.lock"];
+			if (lock === void 0) throw new Error("wasm-bindgen-cli requires tracked root Cargo.lock");
+			const packages = (0, smol_toml.parse)(lock)["package"];
+			if (!Array.isArray(packages)) throw new Error("Cargo.lock requires package entries for wasm-bindgen-cli");
+			const versions = new Set(packages.flatMap((entry) => record$2(entry) && entry["name"] === "wasm-bindgen" ? [entry["version"]] : []));
+			if (versions.size !== 1 || !versions.has(version)) throw new Error(`cloud.tools.wasm-bindgen-cli ${version} must equal the unique wasm-bindgen crate version in Cargo.lock (found ${[...versions].join(", ") || "none"})`);
+		}
+		return [{
+			tool,
+			release: getCloudSetupArtifact(tool, version)
+		}];
+	});
+	return {
+		rust: rustEnabled && typeof channel === "string" ? {
+			channel,
+			components,
+			targets,
+			installer: cloudSetupArtifacts["rustup-init"]
+		} : void 0,
+		tools
+	};
+};
+//#endregion
+//#region src/cloud-setup-tools-install.ts
+const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+const artifactSelection = (release) => `case "$ARCH" in
+${["amd64", "arm64"].map((arch) => `  ${arch}) artifact_url=${quote(release[arch].url)}; artifact_sha=${quote(release[arch].sha256)} ;;`).join("\n")}
+esac`;
+const helpers = String.raw`
+fetch_verified() {
+  download_file "$1" "$3" 120
+  printf '%s  %s\n' "$2" "$3" | sha256sum --strict -c - >/dev/null
+}
+`;
+const rustInstall = (rust) => {
+	const args = [...rust.components.flatMap((name) => ["--component", name]), ...rust.targets.flatMap((name) => ["--target", name])].map(quote).join(" ");
+	return String.raw`
+export RUSTUP_HOME=/opt/stll-cloud/rustup
+export CARGO_HOME=/opt/stll-cloud/cargo
+export RUSTUP_TOOLCHAIN='@RUST@'
+export RUSTUP_AUTO_INSTALL=0
+rust_run() {
+  local mode="$1"
+  shift
+  set -- runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" RUSTUP_HOME="$RUSTUP_HOME" CARGO_HOME="$CARGO_HOME" RUSTUP_AUTO_INSTALL=0 RUSTUP_TOOLCHAIN=@RUST@ RUSTUP_DIST_SERVER=https://static.rust-lang.org RUSTUP_UPDATE_ROOT=https://static.rust-lang.org/rustup PATH="$PATH" "$@"
+  case "$mode" in
+    local) "$@" ;;
+    network) network_run static.rust-lang.org 180 "$@" ;;
+    *) fail 'Invalid Rust execution mode' ;;
+  esac
+}
+rust_ready() {
+  local directory
+  for directory in "$RUSTUP_HOME" "$CARGO_HOME"; do
+    [[ -d "$directory" && ! -L "$directory" && "$(stat -c '%u' "$directory")" == "$OUTPUT_UID" ]] || return 1
+  done
+  [[ -x "$CARGO_HOME/bin/rustup" ]] || return 1
+  [[ "$(rust_run local "$CARGO_HOME/bin/rustup" --version 2>/dev/null)" == 'rustup @RUSTUP@ '* ]] || return 1
+  [[ "$(rust_run local "$CARGO_HOME/bin/rustc" +@RUST@ --version)" == 'rustc @RUST@ '* ]] || return 1
+  local host
+  host="$(rust_run local "$CARGO_HOME/bin/rustc" +@RUST@ -vV | awk '$1 == "host:" { print $2 }')" || return 1
+  @VERIFY_COMPONENTS@
+  @VERIFY_TARGETS@
+  return 0
+}
+verify_rust() { rust_ready || fail 'Pinned Rust, components or targets are unavailable; run install'; }
+install_rust() (
+  if ! command -v cc >/dev/null || ! command -v ld >/dev/null || [[ ! -f /usr/include/stdlib.h ]]; then
+    apt_network update
+    apt_install build-essential
+  fi
+  local artifact_url artifact_sha
+  # Subshell scope retains scratch for EXIT cleanup after a failed command.
+  scratch="$(mktemp -d)"
+  trap 'rm -rf -- "$scratch"' EXIT
+  for directory in "$RUSTUP_HOME" "$CARGO_HOME"; do
+    [[ ! -L "$directory" ]] || fail 'Rust home must not be a symlink'
+    if [[ -e "$directory" ]]; then
+      [[ -d "$directory" && "$(stat -c '%u' "$directory")" == "$OUTPUT_UID" ]] || fail 'Rust home ownership differs from the invoking user'
+    else
+      install -d -m 755 -o "$OUTPUT_UID" -g "$OUTPUT_GID" "$directory"
+    fi
+  done
+  if [[ ! -x "$CARGO_HOME/bin/rustup" ]] || [[ "$(rust_run local "$CARGO_HOME/bin/rustup" --version 2>/dev/null)" != 'rustup @RUSTUP@ '* ]]; then
+    @RUSTUP_ARTIFACT@
+    fetch_verified "$artifact_url" "$artifact_sha" "$scratch/rustup-init"
+    chmod 755 "$scratch" "$scratch/rustup-init"
+    rust_run network "$scratch/rustup-init" -y --no-modify-path --default-toolchain none --profile minimal
+  fi
+  rust_run local "$CARGO_HOME/bin/rustup" set auto-self-update disable
+  if ! rust_ready; then
+    rust_run network "$CARGO_HOME/bin/rustup" toolchain install @RUST@ --profile minimal --no-self-update @RUST_ARGS@
+  fi
+  rust_run local "$CARGO_HOME/bin/rustup" default @RUST@
+  verify_rust
+  for tool in rustup cargo rustc rustdoc @RUST_PROXIES@; do
+    # Launchers persist the system homes in fresh shells without profile sourcing.
+    printf '%s\n' '#!/bin/sh' 'export RUSTUP_HOME=/opt/stll-cloud/rustup' 'export CARGO_HOME=/opt/stll-cloud/cargo' 'export RUSTUP_AUTO_INSTALL=0' 'export RUSTUP_TOOLCHAIN=@RUST@' "exec /opt/stll-cloud/cargo/bin/$tool \"\$@\"" > "$scratch/$tool"
+    if ! cmp -s "$scratch/$tool" "/usr/local/bin/$tool"; then
+      install -m 755 "$scratch/$tool" "/usr/local/bin/$tool"
+    fi
+  done
+)
+`.replaceAll("@RUSTUP@", rust.installer.version).replaceAll("@RUST@", rust.channel).replace("@RUSTUP_ARTIFACT@", artifactSelection(rust.installer)).replace("@RUST_ARGS@", args).replace("@RUST_PROXIES@", Object.entries(cloudRustComponentBinaries).flatMap(([component, binaries]) => rust.components.includes(component) ? Array.from(binaries) : []).join(" ")).replace("@VERIFY_COMPONENTS@", rust.components.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" component list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} -v host="$host" '$1 == name || $1 == name "-" host { found=1 } END { exit !found }' || return 1`).join("\n  ")).replace("@VERIFY_TARGETS@", rust.targets.map((name) => `rust_run local "$CARGO_HOME/bin/rustup" target list --toolchain ${quote(rust.channel)} --installed | awk -v name=${quote(name)} '$1 == name { found=1 } END { exit !found }' || return 1`).join("\n  "));
+};
+const renderCloudToolInstall = ({ rust, tools }) => {
+	const installs = tools.map(({ tool, release }) => {
+		const directory = `/opt/stll-cloud/tools/${tool}/${release.version}`;
+		const command = tool === "wasm-bindgen-cli" ? "wasm-bindgen" : tool;
+		const marker = `${tool === "cargo-nextest" ? "cargo-nextest" : command} ${release.version}`;
+		return {
+			name: tool.replaceAll("-", "_"),
+			text: `verify_${tool.replaceAll("-", "_")}() {
+  ${Object.keys(release.amd64.binaries).map((binary) => `[[ -x ${quote(`${directory}/${binary}`)} ]] || return 1`).join("\n  ")}
+  [[ "$( ${quote(`${directory}/${command}`)} --version)" == ${quote(marker)} || "$( ${quote(`${directory}/${command}`)} --version)" == ${quote(`${marker} `)}* ]]
+}
+install_${tool.replaceAll("-", "_")}() (
+  local artifact_url artifact_sha
+  # Subshell scope retains scratch for EXIT cleanup after a failed command.
+  if ! verify_${tool.replaceAll("-", "_")}; then
+    scratch="$(mktemp -d)"
+    trap 'rm -rf -- "$scratch"' EXIT
+    ${artifactSelection(release)}
+    fetch_verified "$artifact_url" "$artifact_sha" "$scratch/archive.tar.gz"
+    tar -xzf "$scratch/archive.tar.gz" -C "$scratch"
+    install -d -m 755 ${quote(directory)}
+    case "$ARCH" in
+${["amd64", "arm64"].map((arch) => `      ${arch})\n${Object.entries(release[arch].binaries).map(([binary, path]) => `        install -m 755 "$scratch/${path}" ${quote(`${directory}/${binary}`)}`).join("\n")}\n        ;;`).join("\n")}
+    esac
+    verify_${tool.replaceAll("-", "_")} || fail ${quote(`Installed ${tool} version differs from its pin`)}
+  fi
+${Object.keys(release.amd64.binaries).map((binary) => `  ln -sfnT -- ${quote(`${directory}/${binary}`)} ${quote(`/usr/local/bin/${binary}`)}`).join("\n")}
+)
+`
+		};
+	});
+	return `${helpers}${rust === void 0 ? "" : rustInstall(rust)}\n${installs.map(({ text }) => text).join("\n")}
+install_tools() {
+  ${rust === void 0 ? ":" : "install_rust"}
+  ${installs.map(({ name }) => `install_${name}`).join("\n  ")}
+}
+verify_tools() {
+  ${rust === void 0 ? ":" : "verify_rust"}
+  ${installs.map(({ name }) => `verify_${name} || fail 'Pinned ${name} is unavailable; run install'`).join("\n  ")}
+}
+`;
+};
+//#endregion
 //#region src/toolchain-node.ts
 const numericComponent = "(?:0|[1-9]\\d*)";
 const policyPattern = new RegExp(`^${numericComponent}\\.x$`);
@@ -509,22 +990,24 @@ case "$(uname -m)" in
   *) fail 'Only amd64 and arm64 are supported' ;;
 esac
 
+@NETWORK@
+
 runtime_ready() {
   [[ -x "$NODE_DIR/bin/node" && "$($NODE_DIR/bin/node --version)" == "v$NODE_VERSION" ]] || fail 'Pinned Node is unavailable; run install'
   [[ -x "$BUN_DIR/bun" && "$($BUN_DIR/bun --version)" == "$BUN_VERSION" ]] || fail 'Pinned Bun is unavailable; run install'
 }
 install_runtimes() {
-  if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null; then
-    apt-get update
-    DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux
+  if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null || ! ldconfig -p | awk '$1 == "libatomic.so.1" { found=1 } END { exit !found }'; then
+    apt_network update
+    DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux libatomic1
   fi
   local scratch node_archive bun_archive bun_folder
   scratch="$(mktemp -d)"
   trap 'rm -rf -- "$scratch"' RETURN
   if [[ ! -x "$NODE_DIR/bin/node" ]] || [[ "$($NODE_DIR/bin/node --version)" != "v$NODE_VERSION" ]]; then
     node_archive="node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz"
-    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" -o "$scratch/$node_archive"
-    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" -o "$scratch/node-sums"
+    download_file "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" "$scratch/$node_archive" 120
+    download_file "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" "$scratch/node-sums" 45
     (cd "$scratch"; awk -v name="$node_archive" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' node-sums | sha256sum --strict -c -)
     install -d -m 755 "$NODE_DIR"
     tar -xJf "$scratch/$node_archive" --strip-components=1 -C "$NODE_DIR"
@@ -532,8 +1015,8 @@ install_runtimes() {
   if [[ ! -x "$BUN_DIR/bun" ]] || [[ "$($BUN_DIR/bun --version)" != "$BUN_VERSION" ]]; then
     bun_folder="bun-linux-$BUN_ARCH"
     bun_archive="$bun_folder.zip"
-    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/$bun_archive" -o "$scratch/$bun_archive"
-    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/SHASUMS256.txt" -o "$scratch/bun-sums"
+    download_file "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/$bun_archive" "$scratch/$bun_archive" 120
+    download_file "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/SHASUMS256.txt" "$scratch/bun-sums" 45
     (cd "$scratch"; awk -v name="$bun_archive" '$2 == name || $2 == "*" name { print $1 "  " name; count++ } END { if (count != 1) exit 1 }' bun-sums | sha256sum --strict -c -)
     unzip -q "$scratch/$bun_archive" -d "$scratch/bun"
     install -d -m 755 "$BUN_DIR"
@@ -549,7 +1032,7 @@ install_runtimes() {
 }
 
 dependency_install() {
-  local directory
+  local directory download_hosts
   for directory in /var/cache/stll-cloud /var/cache/stll-cloud/bun; do
     [[ ! -L "$directory" ]] || fail 'Dependency cache parent must not be a symlink'
     if [[ -e "$directory" ]]; then
@@ -562,21 +1045,49 @@ dependency_install() {
     [[ -d "$BUN_CACHE" && "$(stat -c '%u' "$BUN_CACHE")" == "$OUTPUT_UID" ]] || fail 'Dependency cache ownership differs from the invoking user'
   fi
   install -d -m 700 -o "$OUTPUT_UID" -g "$OUTPUT_GID" "$BUN_CACHE"
-  runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" BUN_INSTALL_CACHE_DIR="$BUN_CACHE" PATH="$PATH" "$BUN_DIR/bun" install --frozen-lockfile
+  # Report hostnames only: lockfile/config URLs may contain credentials.
+  # These are known install hosts; lifecycle scripts can contact other hosts.
+  download_hosts="$(HOME="$OUTPUT_HOME" "$NODE_DIR/bin/node" -e '
+const fs = require("node:fs");
+const path = require("node:path");
+const hosts = new Set(["registry.npmjs.org"]);
+const inputs = [process.env.BUN_CONFIG_REGISTRY ?? "", process.env.NPM_CONFIG_REGISTRY ?? "", process.env.npm_config_registry ?? ""];
+for (const file of ["bun.lock", ".npmrc", "bunfig.toml", path.join(process.env.HOME, ".npmrc"), path.join(process.env.HOME, ".bunfig.toml"), path.join(process.env.XDG_CONFIG_HOME ?? process.env.HOME, ".bunfig.toml")]) {
+  if (fs.existsSync(file)) inputs.push(fs.readFileSync(file, "utf8"));
+}
+for (const input of inputs) {
+  for (const match of input.matchAll(/(?:git\+)?https?:\/\/[^\s"\x27<>\\]+/g)) {
+    try { hosts.add(new URL(match[0].replace(/^git\+/, "")).hostname); } catch {}
+  }
+  if (/github:/.test(input)) { hosts.add("github.com"); hosts.add("codeload.github.com"); }
+}
+process.stdout.write([...hosts].sort().join(","));
+')"
+  # Bun 1.4.3 socket inactivity timeout, in seconds; the outer bound includes scripts.
+  network_run "$download_hosts" 240 runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" BUN_INSTALL_CACHE_DIR="$BUN_CACHE" PATH="$PATH" BUN_CONFIG_HTTP_IDLE_TIMEOUT=20 "$BUN_DIR/bun" install --frozen-lockfile
 }
 
 @SERVICE_INSTALL@
 @SERVICE_START@
 
+@TOOL_INSTALL@
+
+@INPUT_VALIDATION@
+
 @ENV_FUNCTIONS@
 
 if [[ "$MODE" == install ]]; then
   install_runtimes
   install_services
+  install_tools
+  install_shell_environment
   dependency_install
   exit 0
 fi
 runtime_ready
+verify_tools
+install_shell_environment
+verify_shell_environment
 @ENV_VALIDATE@
 prepare_state
 start_services
@@ -611,13 +1122,35 @@ write_environment() {
 }
 `;
 const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
-const generateCloudSetup = ({ policy, cloud, nodeVersion }) => {
+const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExceptions = [] }) => {
 	const selected = parseCloudSetup(cloud);
 	if (selected === void 0) throw new Error("cloud declaration is required");
 	const exactNode = nodeVersion.trim();
 	if ((0, semver.valid)(exactNode) !== exactNode || !nodeSelectorMatches(exactNode, policy.node)) throw new Error("cloud requires a tracked exact .node-version within the shared Node series");
+	const toolchains = resolveCloudToolchains({
+		cloud: selected,
+		files,
+		rust: policy.rust,
+		rustExceptions
+	});
 	const services = cloudServices.filter((service) => selected.services.includes(service));
 	const replacements = /* @__PURE__ */ new Map([
+		["@NETWORK@", renderCloudNetwork()],
+		["@TOOL_INSTALL@", renderCloudToolInstall(toolchains) + renderCloudShellInstall({
+			nodeVersion: exactNode,
+			bunVersion: policy.bun,
+			rust: toolchains.rust
+		})],
+		["@INPUT_VALIDATION@", [
+			"rust-toolchain.toml",
+			"rust-toolchain",
+			...selected.tools?.["wasm-bindgen-cli"] === void 0 ? [] : ["Cargo.lock"]
+		].flatMap((file) => {
+			const content = files[file];
+			if (content === void 0) return [`[[ ! -e ${shellQuote(file)} && ! -L ${shellQuote(file)} ]] || fail ${shellQuote(`${file} appeared; regenerate cloud-setup.sh`)}`];
+			const hash = (0, node_crypto.createHash)("sha256").update(content).digest("hex");
+			return [`[[ -f ${shellQuote(file)} && ! -L ${shellQuote(file)} ]] && [[ "$(sha256sum -- ${shellQuote(file)} | cut -d ' ' -f1)" == ${shellQuote(hash)} ]] || fail ${shellQuote(`${file} changed; regenerate cloud-setup.sh`)}`];
+		}).join("\n")],
 		["@BUN@", policy.bun],
 		["@NODE@", exactNode],
 		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
@@ -643,6 +1176,87 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion }) => {
 	});
 };
 //#endregion
+//#region src/cloud-setup-claude.ts
+const cloudClaudeSettingsPath = ".claude/settings.json";
+const cloudSessionStartHook = {
+	matcher: "",
+	hooks: [{
+		type: "command",
+		command: `if [ "\${CLAUDE_CODE_REMOTE:-}" = "true" ]; then
+  bash ${cloudSetupPath} start || exit "$?"
+  if [ -n "\${CLAUDE_ENV_FILE:-}" ]; then
+    if [ ! -f ${cloudShellProfilePath} ]; then
+      printf '%s\\n' 'cloud-setup: cloud shell profile is unavailable; run install' >&2
+      exit 1
+    fi
+    printf '\\n' >> "$CLAUDE_ENV_FILE" || exit "$?"
+    cat ${cloudShellProfilePath} >> "$CLAUDE_ENV_FILE"
+  fi
+fi`
+	}]
+};
+const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const array = (value) => Array.isArray(value);
+const parseSettings = (text) => {
+	try {
+		return JSON.parse(text, (_key, value) => {
+			if (typeof value === "number" && (!Number.isFinite(value) || Number.isInteger(value) && !Number.isSafeInteger(value))) throw new Error("settings contains a number that cannot be safely preserved");
+			return value;
+		});
+	} catch (error) {
+		if (error instanceof SyntaxError) throw new Error("settings must contain valid JSON");
+		throw error;
+	}
+};
+const readSettings = (text) => {
+	const settings = text === void 0 ? {} : parseSettings(text);
+	if (text !== void 0 && (0, yaml.parseDocument)(text, { uniqueKeys: true }).errors.length > 0) throw new Error("settings contains duplicate or ambiguous JSON keys");
+	if (!record$1(settings)) throw new Error("settings must be a JSON object");
+	if (settings["disableAllHooks"] === true) throw new Error("disableAllHooks prevents SessionStart from running");
+	const hooks = settings["hooks"] === void 0 ? {} : settings["hooks"];
+	if (!record$1(hooks)) throw new Error("hooks must be a JSON object");
+	const sessionStart = hooks["SessionStart"] === void 0 ? [] : hooks["SessionStart"];
+	if (!array(sessionStart) || sessionStart.some((entry) => !record$1(entry) || !array(entry["hooks"]))) throw new Error("hooks.SessionStart must be an array of hook groups");
+	return {
+		settings,
+		hooks,
+		sessionStart
+	};
+};
+const cloudHookGroups = (sessionStart) => sessionStart.filter((entry) => record$1(entry) && array(entry["hooks"]) && entry["hooks"].some((hook) => record$1(hook) && typeof hook["command"] === "string" && hook["command"].includes(".agents/cloud-setup.sh")));
+const cloudSessionStartFix = `preserve unrelated settings in ${cloudClaudeSettingsPath}, repair its JSON/hooks structure and set disableAllHooks to false if needed, and ensure hooks.SessionStart contains exactly this cloud setup entry (replace conflicting cloud setup entries):\n` + JSON.stringify(cloudSessionStartHook, null, 2);
+/** Append only when the existing settings have no conflicting cloud startup. */
+const mergeCloudSessionStartHook = (text) => {
+	try {
+		const { settings, hooks, sessionStart } = readSettings(text);
+		const cloudGroups = cloudHookGroups(sessionStart);
+		if (cloudGroups.length !== 0) {
+			if (cloudGroups.length === 1 && (0, node_util.isDeepStrictEqual)(cloudGroups.at(0), cloudSessionStartHook) && text !== void 0) return text;
+			throw new Error("existing cloud setup SessionStart hook differs");
+		}
+		return `${JSON.stringify({
+			...settings,
+			hooks: {
+				...hooks,
+				SessionStart: [...sessionStart, cloudSessionStartHook]
+			}
+		}, null, 2)}\n`;
+	} catch (error) {
+		throw new Error(`cannot safely merge ${cloudClaudeSettingsPath}: ${error instanceof Error ? error.message : String(error)}; ${cloudSessionStartFix}`);
+	}
+};
+/** Settings formatting and unrelated hooks do not affect the generated contract. */
+const hasCloudSessionStartHook = (text) => {
+	if (text === void 0) return false;
+	try {
+		const { sessionStart } = readSettings(text);
+		const cloudGroups = cloudHookGroups(sessionStart);
+		return cloudGroups.length === 1 && (0, node_util.isDeepStrictEqual)(cloudGroups.at(0), cloudSessionStartHook);
+	} catch {
+		return false;
+	}
+};
+//#endregion
 //#region src/toolchain-workspaces.ts
 /** Match manifest directories with the same positive and negative workspace patterns. */
 const workspaceContains = ({ directory, file, patterns, rootMembership }) => {
@@ -809,13 +1423,25 @@ const isDockerDefinitionPath = (file) => {
 const isShellScript = (file, text = "") => !excludedInputPath(file) && (/\.(?:sh|bash|zsh)$/.test(file) || /^#![ \t]*(?:\/(?:[^ \t\r\n]+\/)*(?:bash|dash|ksh|zsh|sh)|\/usr\/bin\/env[ \t]+(?:-S[ \t]+)?(?:bash|dash|ksh|zsh|sh))(?=[ \t\r\n]|$)/.test(text));
 /** Lockfiles establish ecosystem presence without reading their dependency graphs. */
 const toolchainInputKind = (file, text = "") => {
-	if (file === ".agents/cloud-setup.sh") return "config";
+	if (file === ".agents/cloud-setup.sh" || file === ".claude/settings.json" || file === "Cargo.lock") return "config";
 	if (githubAutomationFileKind(file) !== void 0) return "config";
 	if (excludedInputPath(file)) return void 0;
 	if (pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
 	if (githubAutomationFileKind(file) !== void 0 || isShellScript(file, text) || /(?:^|\/)ci-service-images\.json$/.test(file) || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|consumer-compat\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
 };
 //#endregion
+Object.defineProperty(exports, "cloudClaudeSettingsPath", {
+	enumerable: true,
+	get: function() {
+		return cloudClaudeSettingsPath;
+	}
+});
+Object.defineProperty(exports, "cloudSessionStartFix", {
+	enumerable: true,
+	get: function() {
+		return cloudSessionStartFix;
+	}
+});
 Object.defineProperty(exports, "cloudSetupPath", {
 	enumerable: true,
 	get: function() {
@@ -840,6 +1466,12 @@ Object.defineProperty(exports, "githubAutomationFileKind", {
 		return githubAutomationFileKind;
 	}
 });
+Object.defineProperty(exports, "hasCloudSessionStartHook", {
+	enumerable: true,
+	get: function() {
+		return hasCloudSessionStartHook;
+	}
+});
 Object.defineProperty(exports, "isComposeDefinitionPath", {
 	enumerable: true,
 	get: function() {
@@ -888,6 +1520,12 @@ Object.defineProperty(exports, "javascriptDependencyLockfiles", {
 		return javascriptDependencyLockfiles;
 	}
 });
+Object.defineProperty(exports, "mergeCloudSessionStartHook", {
+	enumerable: true,
+	get: function() {
+		return mergeCloudSessionStartHook;
+	}
+});
 Object.defineProperty(exports, "nodePolicyValid", {
 	enumerable: true,
 	get: function() {