@stll/oxlint-config 1.0.2 → 1.2.0

package/README.md

@@ -298,7 +298,17 @@ Add an explicit declaration to tracked root `stll-toolchain.json`:
   "cloud": {
     "services": ["postgres", "valkey"],
     "install": "bun install --frozen-lockfile",
-    "envFile": ".env.cloud"
+    "envFile": ".env.cloud",
+    "rust": {
+      "components": ["clippy", "rustfmt"],
+      "targets": ["wasm32-unknown-unknown"]
+    },
+    "tools": {
+      "cargo-nextest": "0.9.148",
+      "wasm-bindgen-cli": "0.2.126",
+      "uv": "0.13.1",
+      "time": "1.9"
+    }
   }
 }
 ```
@@ -314,6 +324,31 @@ repository-relative path; its existing parent must be safe at runtime. Track an
 bunx --no-install stll-cloud-setup
 ```
 
+Rust is optional. A tracked root `rust-toolchain.toml` enables it automatically;
+otherwise declare `cloud.rust` to enable it. `cloud.rust.toolchain`, when given,
+must be an exact stable Rust patch. The root toolchain file supplies the pin when
+present; without either pin, the installed shared policy supplies it. Conflicting
+pins fail generation. The selected pin must match the shared policy or a recorded
+`rustExceptions` pin. `components` and `targets` select additional rustup
+components and compilation targets; the root toolchain file also contributes
+its selections. A declared root profile must be `minimal`. Rust installation uses
+the minimal profile and a pinned, checksum-verified rustup installer. Rust-enabled
+setup also provisions Ubuntu's `build-essential` package for native compilation
+and linking.
+
+`cloud.tools` is a closed object: the supported keys are `cargo-nextest`,
+`wasm-bindgen-cli`, `uv`, and `time`. Each value must be an exact release supported by
+the installed tooling package. Unknown tools and unsupported versions fail
+generation. `cargo-nextest`, `wasm-bindgen-cli`, and `uv` use versioned upstream Linux binaries with committed
+SHA256 pins for amd64 and arm64; setup does not build them with `cargo install`.
+`time` installs GNU time (`/usr/bin/time`, needed for `/usr/bin/time -v`) from
+Ubuntu's `time` package with bounded apt; its value is the upstream release
+(`1.9` on Ubuntu 24.04). GNU time reports its version as `UNKNOWN`, so setup
+verifies the binary's GNU identity and the installed package release. A present,
+matching package is reused without network access.
+`wasm-bindgen-cli` requires the matching `wasm-bindgen` crate version in tracked
+root `Cargo.lock`. Regenerate after updating the lockfile or any tool pin.
+
 Generation uses the installed policy's Bun, Node, PostgreSQL, and Valkey pins.
 PostgreSQL uses the PGDG major-version packages; minor updates within the pinned
 major are accepted for the disposable database. Before adding PGDG, provisioning
@@ -323,8 +358,23 @@ binary DEBs for the declared release and architecture, verifies the policy's
 SHA256 pins, and installs those local files with apt. It does not resolve Valkey
 from a mutable package index.
 The command writes `.agents/cloud-setup.sh` with executable permissions and
-refuses symlink parents or destinations and hard-linked destinations. `stll-toolchain-check` rejects missing,
-drifted, or undeclared tracked scripts with mandatory `cloud-setup-drift`.
+merges a `SessionStart` hook into `.claude/settings.json`. The hook runs
+`bash "$CLAUDE_PROJECT_DIR/.agents/cloud-setup.sh" start` only when
+`CLAUDE_CODE_REMOTE=true`, including sessions that reuse cached filesystems and
+sessions started from a repository subdirectory. Generation replaces the
+relative-path hook written by 1.1.0 in place. After successful startup, it appends the
+managed shell profile's literal exports to `CLAUDE_ENV_FILE` when available, so
+subsequent Claude commands select pinned runtimes and tools before preinstalled
+versions while retaining their inherited `PATH`. The settings also set
+`"attribution": {"commit": "", "pr": ""}`, so cloud sessions add no tool
+attribution to commits or pull requests. Existing environment-file
+content, unrelated settings, and hooks are preserved. Invalid JSON, disabled
+hooks, conflicting cloud startup entries, or a different `attribution` value stop
+generation with a repair instruction. Commit both generated files.
+Generation refuses symlink parents or destinations and hard-linked destinations.
+`stll-toolchain-check` rejects missing, drifted, or undeclared tracked scripts,
+missing or conflicting startup hooks, and missing or different attribution
+settings with mandatory `cloud-setup-drift`.
 Regenerate after changing the policy or declaration. `stll-cloud-setup --help`
 prints usage without reading repository configuration.
 
@@ -337,11 +387,19 @@ Both commands can be rerun. Missing or unknown subcommands print usage and
 exit 2; there is no implicit lifecycle mode. The script supports Ubuntu 24.04
 with root access or passwordless sudo and fails when required capabilities
 or pinned installations are unavailable. `install` provisions runtimes,
-dependencies, and declared services; `start` restores local services after
+dependencies, and declared services; `start` refreshes the managed shell environment
+and restores local services after
 cached environments lose running processes. Services bind only to localhost.
 System provisioning runs as root; frozen dependencies run as the invoking user
 with that user's home and a private, user-owned Bun cache. Package installation
 does not permit automatic downgrades.
+Runtime commands and declared tools are exposed through `/usr/local/bin`, so a
+fresh shell can use Bun, Node, Rust, and the tools without sourcing `.cargo/env`
+or changing `PATH`. Rust proxies select the provisioned system toolchain.
+Installation also writes `/etc/profile.d/stll-cloud.sh` and sources it from the
+invoking user's Bash startup files. The profile puts pinned Node and Bun ahead
+of inherited runtime directories while preserving unrelated paths and existing
+startup settings. Rerunning installation does not duplicate these source entries.
 If a newer Valkey package is already installed, provisioning fails rather than
 downgrading it; use an environment compatible with the pinned release.
 The environment file contains `NODE_ENV=test` and declared local connection
@@ -353,6 +411,41 @@ Environments may cache filesystems without preserving service processes.
 Run `start` at every session start, including sessions that reuse installed files.
 The supported OS, privileges, and pinned runtime requirements are checked explicitly.
 
+### Network hosts
+
+Downloads use a 20-second connection timeout, three retries, and a total deadline
+(45 seconds for manifests and keys; 120 seconds for binary archives). APT uses
+20-second Acquire timeouts, three retries, and a 180-second command deadline.
+Rust provisioning commands have a 180-second deadline. Frozen dependency
+installation uses a 20-second Bun HTTP idle timeout and a 240-second overall
+deadline, including lifecycle scripts. Timeout failures name the download host
+or the configured package hosts; a redirected download names its original host.
+
+Allow these direct download hosts for the generated installer:
+
+| Host                   | Downloads                                                                |
+| ---------------------- | ------------------------------------------------------------------------ |
+| `nodejs.org`           | Node archives and SHA256 manifests                                       |
+| `github.com`           | Bun archives and checksums; pinned nextest, wasm-bindgen and uv releases |
+| `static.rust-lang.org` | Pinned rustup-init, Rust manifests, toolchains, components and targets   |
+| `www.postgresql.org`   | PostgreSQL repository signing key                                        |
+| `apt.postgresql.org`   | PostgreSQL packages and repository metadata                              |
+| `download.valkey.io`   | Pinned Valkey binary packages                                            |
+
+GitHub release downloads redirect to `release-assets.githubusercontent.com`;
+allow that host as well. This includes Bun and the optional prebuilt tools.
+Rust provisioning uses `static.rust-lang.org` for both distribution and update endpoints.
+
+System prerequisites and the optional `time` package use the image's configured
+Ubuntu apt repositories:
+standard Ubuntu 24.04 images use `archive.ubuntu.com`, `security.ubuntu.com`,
+or `ports.ubuntu.com`, depending on architecture. Images configured with a
+mirror need that mirror's host instead. Frozen Bun installation also needs
+the package registry (normally `registry.npmjs.org`) and any download hosts
+referenced by that repository's lockfile or dependency lifecycle scripts.
+Those repository-specific hosts are not chosen by this generator. `start`
+performs no downloads.
+
 ## Published package contracts
 
 Run `stll-publish-contract` in PR CI. Every published root or declared workspace

package/dist/cloud-setup-cli.cjs

@@ -16,6 +16,46 @@ const optionalStat = async (path) => {
 		throw error;
 	}
 };
+const checkOutput = async (destination) => {
+	const parent = (0, node_path.dirname)(destination);
+	const parentStat = await optionalStat(parent);
+	if (parentStat !== void 0 && (parentStat.isSymbolicLink() || !parentStat.isDirectory())) throw new Error("cloud setup parent must be a real repository directory");
+	const destinationStat = await optionalStat(destination);
+	if (destinationStat !== void 0 && (destinationStat.isSymbolicLink() || !destinationStat.isFile() || destinationStat.nlink !== 1)) throw new Error("cloud setup destination must be a single-link regular repository file");
+	return destinationStat;
+};
+const writeOutput = async ({ destination, text, mode }) => {
+	await checkOutput(destination);
+	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(destination), { recursive: true });
+	const output = await (0, node_fs_promises.open)(destination, node_fs.constants.O_WRONLY | node_fs.constants.O_CREAT | node_fs.constants.O_NOFOLLOW, mode);
+	try {
+		const opened = await output.stat();
+		if (!opened.isFile() || opened.nlink !== 1) throw new Error("cloud setup destination must be a single-link regular repository file");
+		await output.truncate(0);
+		await output.writeFile(text, "utf8");
+		await output.chmod(mode);
+	} finally {
+		await output.close();
+	}
+};
+const readClaudeSettings = async (destination) => {
+	try {
+		if (await checkOutput(destination) === void 0) return void 0;
+		const input = await (0, node_fs_promises.open)(destination, node_fs.constants.O_RDONLY | node_fs.constants.O_NOFOLLOW);
+		try {
+			const opened = await input.stat();
+			if (!opened.isFile() || opened.nlink !== 1) throw new Error("settings must be a single-link regular repository file");
+			return {
+				text: await input.readFile("utf8"),
+				mode: opened.mode & 511
+			};
+		} finally {
+			await input.close();
+		}
+	} catch (error) {
+		throw new Error(`cannot safely merge ${require_toolchain_inputs.cloudClaudeSettingsPath}: ${error instanceof Error ? error.message : String(error)}; ${require_toolchain_inputs.cloudSessionStartFix}`);
+	}
+};
 const main = async () => {
 	const args = process.argv.slice(2);
 	if (args.length === 1 && args.at(0) === "--help") {
@@ -25,36 +65,37 @@ const main = async () => {
 	if (args.length !== 0) throw new Error(usage);
 	const root = await (0, node_fs_promises.realpath)(process.cwd());
 	const { files, diagnostics } = require_toolchain_guard.readToolchainInputs(root);
-	if (diagnostics.length > 0) throw new Error(diagnostics.map(({ path, message }) => `${path}: ${message}`).join("\n"));
+	if (diagnostics.length > 0) throw new Error(diagnostics.map(({ path, message }) => `${path}: ${message}${path === ".claude/settings.json" ? `; ${require_toolchain_inputs.cloudSessionStartFix}` : ""}`).join("\n"));
 	const text = files["stll-toolchain.json"];
 	if (text === void 0) throw new Error("requires tracked stll-toolchain.json");
-	const { cloud } = require_toolchain_guard.parseToolchainConfiguration(JSON.parse(text));
+	const { cloud, rustExceptions } = require_toolchain_guard.parseToolchainConfiguration(JSON.parse(text));
 	if (cloud === void 0) throw new Error("requires an explicit cloud declaration");
 	const nodeVersion = files[".node-version"];
 	if (nodeVersion === void 0) throw new Error("requires tracked root .node-version");
+	const policy = require_toolchain_schema.parseToolchainPolicy(JSON.parse(await (0, node_fs_promises.readFile)(new URL("../toolchain.json", require("url").pathToFileURL(__filename).href), "utf8")));
 	const script = require_toolchain_inputs.generateCloudSetup({
-		policy: require_toolchain_schema.parseToolchainPolicy(JSON.parse(await (0, node_fs_promises.readFile)(new URL("../toolchain.json", require("url").pathToFileURL(__filename).href), "utf8"))),
+		policy,
 		cloud,
-		nodeVersion: nodeVersion.trim()
+		nodeVersion: nodeVersion.trim(),
+		files,
+		rustExceptions
 	});
 	const destination = (0, node_path.join)(root, require_toolchain_inputs.cloudSetupPath);
-	const parent = (0, node_path.dirname)(destination);
-	const parentStat = await optionalStat(parent);
-	if (parentStat === void 0) await (0, node_fs_promises.mkdir)(parent);
-	else if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) throw new Error("cloud setup parent must be a real repository directory");
-	const destinationStat = await optionalStat(destination);
-	if (destinationStat !== void 0 && (destinationStat.isSymbolicLink() || !destinationStat.isFile() || destinationStat.nlink !== 1)) throw new Error("cloud setup destination must be a single-link regular repository file");
-	const output = await (0, node_fs_promises.open)(destination, node_fs.constants.O_WRONLY | node_fs.constants.O_CREAT | node_fs.constants.O_NOFOLLOW, 493);
-	try {
-		const opened = await output.stat();
-		if (!opened.isFile() || opened.nlink !== 1) throw new Error("cloud setup destination must be a single-link regular repository file");
-		await output.truncate(0);
-		await output.writeFile(script, "utf8");
-		await output.chmod(493);
-	} finally {
-		await output.close();
-	}
-	process.stdout.write(`Generated ${require_toolchain_inputs.cloudSetupPath}\n`);
+	await checkOutput(destination);
+	const settingsDestination = (0, node_path.join)(root, require_toolchain_inputs.cloudClaudeSettingsPath);
+	const settings = await readClaudeSettings(settingsDestination);
+	const mergedSettings = require_toolchain_inputs.mergeCloudClaudeSettings(settings?.text);
+	await writeOutput({
+		destination,
+		text: script,
+		mode: 493
+	});
+	if (mergedSettings !== settings?.text) await writeOutput({
+		destination: settingsDestination,
+		text: mergedSettings,
+		mode: settings?.mode ?? 420
+	});
+	process.stdout.write(`Generated ${require_toolchain_inputs.cloudSetupPath} and ${require_toolchain_inputs.cloudClaudeSettingsPath}\n`);
 };
 main().catch((error) => {
 	process.stderr.write(`cloud-setup: ${error instanceof Error ? error.message : String(error)}\n`);

package/dist/cloud-setup-cli.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-setup-cli.cjs","names":["readToolchainInputs","parseToolchainConfiguration","generateCloudSetup","parseToolchainPolicy","cloudSetupPath","constants"],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { lstat, mkdir, open, readFile, realpath } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst optionalStat = async (path: string) => {\n  try {\n    return await lstat(path);\n  } catch (error) {\n    if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n      return undefined;\n    throw error;\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  if (diagnostics.length > 0)\n    throw new Error(\n      diagnostics.map(({ path, message }) => `${path}: ${message}`).join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud } = parseToolchainConfiguration(JSON.parse(text));\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n  });\n  const destination = join(root, cloudSetupPath);\n  const parent = dirname(destination);\n  const parentStat = await optionalStat(parent);\n  if (parentStat === undefined) await mkdir(parent);\n  else if (parentStat.isSymbolicLink() || !parentStat.isDirectory())\n    throw new Error(\"cloud setup parent must be a real repository directory\");\n  const destinationStat = await optionalStat(destination);\n  if (\n    destinationStat !== undefined &&\n    (destinationStat.isSymbolicLink() ||\n      !destinationStat.isFile() ||\n      destinationStat.nlink !== 1)\n  )\n    throw new Error(\n      \"cloud setup destination must be a single-link regular repository file\",\n    );\n  const output = await open(\n    destination,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW,\n    0o755,\n  );\n  try {\n    const opened = await output.stat();\n    if (!opened.isFile() || opened.nlink !== 1)\n      throw new Error(\n        \"cloud setup destination must be a single-link regular repository file\",\n      );\n    await output.truncate(0);\n    await output.writeFile(script, \"utf8\");\n    await output.chmod(0o755);\n  } finally {\n    await output.close();\n  }\n  process.stdout.write(`Generated ${cloudSetupPath}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;AAYA,MAAM,QACJ;AACF,MAAM,eAAe,OAAO,SAAiB;CAC3C,IAAI;EACF,OAAO,OAAA,GAAA,iBAAA,MAAA,CAAY,IAAI;CACzB,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;EACT,MAAM;CACR;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,OAAA,GAAA,iBAAA,SAAA,CAAe,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgBA,wBAAAA,oBAAoB,IAAI;CACvD,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,YAAY,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,CACzE;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,UAAUC,wBAAAA,4BAA4B,KAAK,MAAM,IAAI,CAAC;CAC9D,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CAMvD,MAAM,SAASC,yBAAAA,mBAAmB;EAChC,QANaC,yBAAAA,qBACb,KAAK,MACH,OAAA,GAAA,iBAAA,SAAA,CAAe,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CAGK;EACL;EACA,aAAa,YAAY,KAAK;CAChC,CAAC;CACD,MAAM,eAAA,GAAA,UAAA,KAAA,CAAmB,MAAMC,yBAAAA,cAAc;CAC7C,MAAM,UAAA,GAAA,UAAA,QAAA,CAAiB,WAAW;CAClC,MAAM,aAAa,MAAM,aAAa,MAAM;CAC5C,IAAI,eAAe,KAAA,GAAW,OAAA,GAAA,iBAAA,MAAA,CAAY,MAAM;MAC3C,IAAI,WAAW,eAAe,KAAK,CAAC,WAAW,YAAY,GAC9D,MAAM,IAAI,MAAM,wDAAwD;CAC1E,MAAM,kBAAkB,MAAM,aAAa,WAAW;CACtD,IACE,oBAAoB,KAAA,MACnB,gBAAgB,eAAe,KAC9B,CAAC,gBAAgB,OAAO,KACxB,gBAAgB,UAAU,IAE5B,MAAM,IAAI,MACR,uEACF;CACF,MAAM,SAAS,OAAA,GAAA,iBAAA,KAAA,CACb,aACAC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UAAUA,QAAAA,UAAU,YACnD,GACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,KAAK;EACjC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,uEACF;EACF,MAAM,OAAO,SAAS,CAAC;EACvB,MAAM,OAAO,UAAU,QAAQ,MAAM;EACrC,MAAM,OAAO,MAAM,GAAK;CAC1B,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;CACA,QAAQ,OAAO,MAAM,aAAaD,yBAAAA,eAAe,GAAG;AACtD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"cloud-setup-cli.cjs","names":["lstat","dirname","mkdir","open","constants","cloudClaudeSettingsPath","cloudSessionStartFix","realpath","readToolchainInputs","parseToolchainConfiguration","parseToolchainPolicy","readFile","generateCloudSetup","join","cloudSetupPath","mergeCloudClaudeSettings"],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { lstat, mkdir, open, readFile, realpath } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  cloudClaudeSettingsPath,\n  cloudSessionStartFix,\n  mergeCloudClaudeSettings,\n} from \"./cloud-setup-claude\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst optionalStat = async (path: string) => {\n  try {\n    return await lstat(path);\n  } catch (error) {\n    if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n      return undefined;\n    throw error;\n  }\n};\n\nconst checkOutput = async (destination: string) => {\n  const parent = dirname(destination);\n  const parentStat = await optionalStat(parent);\n  if (\n    parentStat !== undefined &&\n    (parentStat.isSymbolicLink() || !parentStat.isDirectory())\n  )\n    throw new Error(\"cloud setup parent must be a real repository directory\");\n  const destinationStat = await optionalStat(destination);\n  if (\n    destinationStat !== undefined &&\n    (destinationStat.isSymbolicLink() ||\n      !destinationStat.isFile() ||\n      destinationStat.nlink !== 1)\n  )\n    throw new Error(\n      \"cloud setup destination must be a single-link regular repository file\",\n    );\n  return destinationStat;\n};\n\ntype WriteOutputOptions = {\n  destination: string;\n  text: string;\n  mode: number;\n};\n\nconst writeOutput = async ({ destination, text, mode }: WriteOutputOptions) => {\n  await checkOutput(destination);\n  await mkdir(dirname(destination), { recursive: true });\n  const output = await open(\n    destination,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW,\n    mode,\n  );\n  try {\n    const opened = await output.stat();\n    if (!opened.isFile() || opened.nlink !== 1)\n      throw new Error(\n        \"cloud setup destination must be a single-link regular repository file\",\n      );\n    await output.truncate(0);\n    await output.writeFile(text, \"utf8\");\n    await output.chmod(mode);\n  } finally {\n    await output.close();\n  }\n};\n\nconst readClaudeSettings = async (destination: string) => {\n  try {\n    if ((await checkOutput(destination)) === undefined) return undefined;\n    const input = await open(\n      destination,\n      constants.O_RDONLY | constants.O_NOFOLLOW,\n    );\n    try {\n      const opened = await input.stat();\n      if (!opened.isFile() || opened.nlink !== 1)\n        throw new Error(\n          \"settings must be a single-link regular repository file\",\n        );\n      return { text: await input.readFile(\"utf8\"), mode: opened.mode & 0o777 };\n    } finally {\n      await input.close();\n    }\n  } catch (error) {\n    throw new Error(\n      `cannot safely merge ${cloudClaudeSettingsPath}: ${error instanceof Error ? error.message : String(error)}; ${cloudSessionStartFix}`,\n    );\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  if (diagnostics.length > 0)\n    throw new Error(\n      diagnostics\n        .map(\n          ({ path, message }) =>\n            `${path}: ${message}${path === cloudClaudeSettingsPath ? `; ${cloudSessionStartFix}` : \"\"}`,\n        )\n        .join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud, rustExceptions } = parseToolchainConfiguration(\n    JSON.parse(text),\n  );\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n    files,\n    rustExceptions,\n  });\n  const destination = join(root, cloudSetupPath);\n  await checkOutput(destination);\n  const settingsDestination = join(root, cloudClaudeSettingsPath);\n  const settings = await readClaudeSettings(settingsDestination);\n  const mergedSettings = mergeCloudClaudeSettings(settings?.text);\n  await writeOutput({ destination, text: script, mode: 0o755 });\n  if (mergedSettings !== settings?.text)\n    await writeOutput({\n      destination: settingsDestination,\n      text: mergedSettings,\n      mode: settings?.mode ?? 0o644,\n    });\n  process.stdout.write(\n    `Generated ${cloudSetupPath} and ${cloudClaudeSettingsPath}\\n`,\n  );\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;AAiBA,MAAM,QACJ;AACF,MAAM,eAAe,OAAO,SAAiB;CAC3C,IAAI;EACF,OAAO,OAAA,GAAMA,iBAAAA,MAAAA,CAAM,IAAI;CACzB,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;EACT,MAAM;CACR;AACF;AAEA,MAAM,cAAc,OAAO,gBAAwB;CACjD,MAAM,UAAA,GAASC,UAAAA,QAAAA,CAAQ,WAAW;CAClC,MAAM,aAAa,MAAM,aAAa,MAAM;CAC5C,IACE,eAAe,KAAA,MACd,WAAW,eAAe,KAAK,CAAC,WAAW,YAAY,IAExD,MAAM,IAAI,MAAM,wDAAwD;CAC1E,MAAM,kBAAkB,MAAM,aAAa,WAAW;CACtD,IACE,oBAAoB,KAAA,MACnB,gBAAgB,eAAe,KAC9B,CAAC,gBAAgB,OAAO,KACxB,gBAAgB,UAAU,IAE5B,MAAM,IAAI,MACR,uEACF;CACF,OAAO;AACT;AAQA,MAAM,cAAc,OAAO,EAAE,aAAa,MAAM,WAA+B;CAC7E,MAAM,YAAY,WAAW;CAC7B,OAAA,GAAMC,iBAAAA,MAAAA,EAAAA,GAAMD,UAAAA,QAAAA,CAAQ,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;CACrD,MAAM,SAAS,OAAA,GAAME,iBAAAA,KAAAA,CACnB,aACAC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UAAUA,QAAAA,UAAU,YACnD,IACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,KAAK;EACjC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,uEACF;EACF,MAAM,OAAO,SAAS,CAAC;EACvB,MAAM,OAAO,UAAU,MAAM,MAAM;EACnC,MAAM,OAAO,MAAM,IAAI;CACzB,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;AACF;AAEA,MAAM,qBAAqB,OAAO,gBAAwB;CACxD,IAAI;EACF,IAAK,MAAM,YAAY,WAAW,MAAO,KAAA,GAAW,OAAO,KAAA;EAC3D,MAAM,QAAQ,OAAA,GAAMD,iBAAAA,KAAAA,CAClB,aACAC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UACjC;EACA,IAAI;GACF,MAAM,SAAS,MAAM,MAAM,KAAK;GAChC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,wDACF;GACF,OAAO;IAAE,MAAM,MAAM,MAAM,SAAS,MAAM;IAAG,MAAM,OAAO,OAAO;GAAM;EACzE,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF,SAAS,OAAO;EACd,MAAM,IAAI,MACR,uBAAuBC,yBAAAA,wBAAwB,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,IAAIC,yBAAAA,sBAChH;CACF;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgBC,wBAAAA,oBAAoB,IAAI;CACvD,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,YACG,KACE,EAAE,MAAM,cACP,GAAG,KAAK,IAAI,UAAU,SAAA,0BAAmC,KAAKF,yBAAAA,yBAAyB,IAC3F,CAAC,CACA,KAAK,IAAI,CACd;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,OAAO,mBAAmBG,wBAAAA,4BAChC,KAAK,MAAM,IAAI,CACjB;CACA,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CACvD,MAAM,SAASC,yBAAAA,qBACb,KAAK,MACH,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CACF;CACA,MAAM,SAASC,yBAAAA,mBAAmB;EAChC;EACA;EACA,aAAa,YAAY,KAAK;EAC9B;EACA;CACF,CAAC;CACD,MAAM,eAAA,GAAcC,UAAAA,KAAAA,CAAK,MAAMC,yBAAAA,cAAc;CAC7C,MAAM,YAAY,WAAW;CAC7B,MAAM,uBAAA,GAAsBD,UAAAA,KAAAA,CAAK,MAAMR,yBAAAA,uBAAuB;CAC9D,MAAM,WAAW,MAAM,mBAAmB,mBAAmB;CAC7D,MAAM,iBAAiBU,yBAAAA,yBAAyB,UAAU,IAAI;CAC9D,MAAM,YAAY;EAAE;EAAa,MAAM;EAAQ,MAAM;CAAM,CAAC;CAC5D,IAAI,mBAAmB,UAAU,MAC/B,MAAM,YAAY;EAChB,aAAa;EACb,MAAM;EACN,MAAM,UAAU,QAAQ;CAC1B,CAAC;CACH,QAAQ,OAAO,MACb,aAAaD,yBAAAA,eAAe,OAAOT,yBAAAA,wBAAwB,GAC7D;AACF;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/cloud-setup-cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { h as generateCloudSetup, m as cloudSetupPath } from "./toolchain-inputs.mjs";
+import { b as cloudSetupPath, g as cloudSessionStartFix, h as cloudClaudeSettingsPath, x as generateCloudSetup, y as mergeCloudClaudeSettings } from "./toolchain-inputs.mjs";
 import { n as parseToolchainConfiguration, r as readToolchainInputs } from "./toolchain-guard.mjs";
 import { t as parseToolchainPolicy } from "./toolchain-schema.mjs";
 import { constants } from "node:fs";
@@ -15,6 +15,46 @@ const optionalStat = async (path) => {
 		throw error;
 	}
 };
+const checkOutput = async (destination) => {
+	const parent = dirname(destination);
+	const parentStat = await optionalStat(parent);
+	if (parentStat !== void 0 && (parentStat.isSymbolicLink() || !parentStat.isDirectory())) throw new Error("cloud setup parent must be a real repository directory");
+	const destinationStat = await optionalStat(destination);
+	if (destinationStat !== void 0 && (destinationStat.isSymbolicLink() || !destinationStat.isFile() || destinationStat.nlink !== 1)) throw new Error("cloud setup destination must be a single-link regular repository file");
+	return destinationStat;
+};
+const writeOutput = async ({ destination, text, mode }) => {
+	await checkOutput(destination);
+	await mkdir(dirname(destination), { recursive: true });
+	const output = await open(destination, constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW, mode);
+	try {
+		const opened = await output.stat();
+		if (!opened.isFile() || opened.nlink !== 1) throw new Error("cloud setup destination must be a single-link regular repository file");
+		await output.truncate(0);
+		await output.writeFile(text, "utf8");
+		await output.chmod(mode);
+	} finally {
+		await output.close();
+	}
+};
+const readClaudeSettings = async (destination) => {
+	try {
+		if (await checkOutput(destination) === void 0) return void 0;
+		const input = await open(destination, constants.O_RDONLY | constants.O_NOFOLLOW);
+		try {
+			const opened = await input.stat();
+			if (!opened.isFile() || opened.nlink !== 1) throw new Error("settings must be a single-link regular repository file");
+			return {
+				text: await input.readFile("utf8"),
+				mode: opened.mode & 511
+			};
+		} finally {
+			await input.close();
+		}
+	} catch (error) {
+		throw new Error(`cannot safely merge ${cloudClaudeSettingsPath}: ${error instanceof Error ? error.message : String(error)}; ${cloudSessionStartFix}`);
+	}
+};
 const main = async () => {
 	const args = process.argv.slice(2);
 	if (args.length === 1 && args.at(0) === "--help") {
@@ -24,36 +64,37 @@ const main = async () => {
 	if (args.length !== 0) throw new Error(usage);
 	const root = await realpath(process.cwd());
 	const { files, diagnostics } = readToolchainInputs(root);
-	if (diagnostics.length > 0) throw new Error(diagnostics.map(({ path, message }) => `${path}: ${message}`).join("\n"));
+	if (diagnostics.length > 0) throw new Error(diagnostics.map(({ path, message }) => `${path}: ${message}${path === ".claude/settings.json" ? `; ${cloudSessionStartFix}` : ""}`).join("\n"));
 	const text = files["stll-toolchain.json"];
 	if (text === void 0) throw new Error("requires tracked stll-toolchain.json");
-	const { cloud } = parseToolchainConfiguration(JSON.parse(text));
+	const { cloud, rustExceptions } = parseToolchainConfiguration(JSON.parse(text));
 	if (cloud === void 0) throw new Error("requires an explicit cloud declaration");
 	const nodeVersion = files[".node-version"];
 	if (nodeVersion === void 0) throw new Error("requires tracked root .node-version");
+	const policy = parseToolchainPolicy(JSON.parse(await readFile(new URL("../toolchain.json", import.meta.url), "utf8")));
 	const script = generateCloudSetup({
-		policy: parseToolchainPolicy(JSON.parse(await readFile(new URL("../toolchain.json", import.meta.url), "utf8"))),
+		policy,
 		cloud,
-		nodeVersion: nodeVersion.trim()
+		nodeVersion: nodeVersion.trim(),
+		files,
+		rustExceptions
 	});
 	const destination = join(root, cloudSetupPath);
-	const parent = dirname(destination);
-	const parentStat = await optionalStat(parent);
-	if (parentStat === void 0) await mkdir(parent);
-	else if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) throw new Error("cloud setup parent must be a real repository directory");
-	const destinationStat = await optionalStat(destination);
-	if (destinationStat !== void 0 && (destinationStat.isSymbolicLink() || !destinationStat.isFile() || destinationStat.nlink !== 1)) throw new Error("cloud setup destination must be a single-link regular repository file");
-	const output = await open(destination, constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW, 493);
-	try {
-		const opened = await output.stat();
-		if (!opened.isFile() || opened.nlink !== 1) throw new Error("cloud setup destination must be a single-link regular repository file");
-		await output.truncate(0);
-		await output.writeFile(script, "utf8");
-		await output.chmod(493);
-	} finally {
-		await output.close();
-	}
-	process.stdout.write(`Generated ${cloudSetupPath}\n`);
+	await checkOutput(destination);
+	const settingsDestination = join(root, cloudClaudeSettingsPath);
+	const settings = await readClaudeSettings(settingsDestination);
+	const mergedSettings = mergeCloudClaudeSettings(settings?.text);
+	await writeOutput({
+		destination,
+		text: script,
+		mode: 493
+	});
+	if (mergedSettings !== settings?.text) await writeOutput({
+		destination: settingsDestination,
+		text: mergedSettings,
+		mode: settings?.mode ?? 420
+	});
+	process.stdout.write(`Generated ${cloudSetupPath} and ${cloudClaudeSettingsPath}\n`);
 };
 main().catch((error) => {
 	process.stderr.write(`cloud-setup: ${error instanceof Error ? error.message : String(error)}\n`);

package/dist/cloud-setup-cli.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-setup-cli.mjs","names":[],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { lstat, mkdir, open, readFile, realpath } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst optionalStat = async (path: string) => {\n  try {\n    return await lstat(path);\n  } catch (error) {\n    if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n      return undefined;\n    throw error;\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  if (diagnostics.length > 0)\n    throw new Error(\n      diagnostics.map(({ path, message }) => `${path}: ${message}`).join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud } = parseToolchainConfiguration(JSON.parse(text));\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n  });\n  const destination = join(root, cloudSetupPath);\n  const parent = dirname(destination);\n  const parentStat = await optionalStat(parent);\n  if (parentStat === undefined) await mkdir(parent);\n  else if (parentStat.isSymbolicLink() || !parentStat.isDirectory())\n    throw new Error(\"cloud setup parent must be a real repository directory\");\n  const destinationStat = await optionalStat(destination);\n  if (\n    destinationStat !== undefined &&\n    (destinationStat.isSymbolicLink() ||\n      !destinationStat.isFile() ||\n      destinationStat.nlink !== 1)\n  )\n    throw new Error(\n      \"cloud setup destination must be a single-link regular repository file\",\n    );\n  const output = await open(\n    destination,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW,\n    0o755,\n  );\n  try {\n    const opened = await output.stat();\n    if (!opened.isFile() || opened.nlink !== 1)\n      throw new Error(\n        \"cloud setup destination must be a single-link regular repository file\",\n      );\n    await output.truncate(0);\n    await output.writeFile(script, \"utf8\");\n    await output.chmod(0o755);\n  } finally {\n    await output.close();\n  }\n  process.stdout.write(`Generated ${cloudSetupPath}\\n`);\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;AAYA,MAAM,QACJ;AACF,MAAM,eAAe,OAAO,SAAiB;CAC3C,IAAI;EACF,OAAO,MAAM,MAAM,IAAI;CACzB,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;EACT,MAAM;CACR;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgB,oBAAoB,IAAI;CACvD,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,YAAY,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,CACzE;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,UAAU,4BAA4B,KAAK,MAAM,IAAI,CAAC;CAC9D,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CAMvD,MAAM,SAAS,mBAAmB;EAChC,QANa,qBACb,KAAK,MACH,MAAM,SAAS,IAAI,IAAI,qBAAqB,OAAO,KAAK,GAAG,GAAG,MAAM,CACtE,CAGK;EACL;EACA,aAAa,YAAY,KAAK;CAChC,CAAC;CACD,MAAM,cAAc,KAAK,MAAM,cAAc;CAC7C,MAAM,SAAS,QAAQ,WAAW;CAClC,MAAM,aAAa,MAAM,aAAa,MAAM;CAC5C,IAAI,eAAe,KAAA,GAAW,MAAM,MAAM,MAAM;MAC3C,IAAI,WAAW,eAAe,KAAK,CAAC,WAAW,YAAY,GAC9D,MAAM,IAAI,MAAM,wDAAwD;CAC1E,MAAM,kBAAkB,MAAM,aAAa,WAAW;CACtD,IACE,oBAAoB,KAAA,MACnB,gBAAgB,eAAe,KAC9B,CAAC,gBAAgB,OAAO,KACxB,gBAAgB,UAAU,IAE5B,MAAM,IAAI,MACR,uEACF;CACF,MAAM,SAAS,MAAM,KACnB,aACA,UAAU,WAAW,UAAU,UAAU,UAAU,YACnD,GACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,KAAK;EACjC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,uEACF;EACF,MAAM,OAAO,SAAS,CAAC;EACvB,MAAM,OAAO,UAAU,QAAQ,MAAM;EACrC,MAAM,OAAO,MAAM,GAAK;CAC1B,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;CACA,QAAQ,OAAO,MAAM,aAAa,eAAe,GAAG;AACtD;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"cloud-setup-cli.mjs","names":[],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { lstat, mkdir, open, readFile, realpath } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  cloudClaudeSettingsPath,\n  cloudSessionStartFix,\n  mergeCloudClaudeSettings,\n} from \"./cloud-setup-claude\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst optionalStat = async (path: string) => {\n  try {\n    return await lstat(path);\n  } catch (error) {\n    if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n      return undefined;\n    throw error;\n  }\n};\n\nconst checkOutput = async (destination: string) => {\n  const parent = dirname(destination);\n  const parentStat = await optionalStat(parent);\n  if (\n    parentStat !== undefined &&\n    (parentStat.isSymbolicLink() || !parentStat.isDirectory())\n  )\n    throw new Error(\"cloud setup parent must be a real repository directory\");\n  const destinationStat = await optionalStat(destination);\n  if (\n    destinationStat !== undefined &&\n    (destinationStat.isSymbolicLink() ||\n      !destinationStat.isFile() ||\n      destinationStat.nlink !== 1)\n  )\n    throw new Error(\n      \"cloud setup destination must be a single-link regular repository file\",\n    );\n  return destinationStat;\n};\n\ntype WriteOutputOptions = {\n  destination: string;\n  text: string;\n  mode: number;\n};\n\nconst writeOutput = async ({ destination, text, mode }: WriteOutputOptions) => {\n  await checkOutput(destination);\n  await mkdir(dirname(destination), { recursive: true });\n  const output = await open(\n    destination,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW,\n    mode,\n  );\n  try {\n    const opened = await output.stat();\n    if (!opened.isFile() || opened.nlink !== 1)\n      throw new Error(\n        \"cloud setup destination must be a single-link regular repository file\",\n      );\n    await output.truncate(0);\n    await output.writeFile(text, \"utf8\");\n    await output.chmod(mode);\n  } finally {\n    await output.close();\n  }\n};\n\nconst readClaudeSettings = async (destination: string) => {\n  try {\n    if ((await checkOutput(destination)) === undefined) return undefined;\n    const input = await open(\n      destination,\n      constants.O_RDONLY | constants.O_NOFOLLOW,\n    );\n    try {\n      const opened = await input.stat();\n      if (!opened.isFile() || opened.nlink !== 1)\n        throw new Error(\n          \"settings must be a single-link regular repository file\",\n        );\n      return { text: await input.readFile(\"utf8\"), mode: opened.mode & 0o777 };\n    } finally {\n      await input.close();\n    }\n  } catch (error) {\n    throw new Error(\n      `cannot safely merge ${cloudClaudeSettingsPath}: ${error instanceof Error ? error.message : String(error)}; ${cloudSessionStartFix}`,\n    );\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  if (diagnostics.length > 0)\n    throw new Error(\n      diagnostics\n        .map(\n          ({ path, message }) =>\n            `${path}: ${message}${path === cloudClaudeSettingsPath ? `; ${cloudSessionStartFix}` : \"\"}`,\n        )\n        .join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud, rustExceptions } = parseToolchainConfiguration(\n    JSON.parse(text),\n  );\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n    files,\n    rustExceptions,\n  });\n  const destination = join(root, cloudSetupPath);\n  await checkOutput(destination);\n  const settingsDestination = join(root, cloudClaudeSettingsPath);\n  const settings = await readClaudeSettings(settingsDestination);\n  const mergedSettings = mergeCloudClaudeSettings(settings?.text);\n  await writeOutput({ destination, text: script, mode: 0o755 });\n  if (mergedSettings !== settings?.text)\n    await writeOutput({\n      destination: settingsDestination,\n      text: mergedSettings,\n      mode: settings?.mode ?? 0o644,\n    });\n  process.stdout.write(\n    `Generated ${cloudSetupPath} and ${cloudClaudeSettingsPath}\\n`,\n  );\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;AAiBA,MAAM,QACJ;AACF,MAAM,eAAe,OAAO,SAAiB;CAC3C,IAAI;EACF,OAAO,MAAM,MAAM,IAAI;CACzB,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;EACT,MAAM;CACR;AACF;AAEA,MAAM,cAAc,OAAO,gBAAwB;CACjD,MAAM,SAAS,QAAQ,WAAW;CAClC,MAAM,aAAa,MAAM,aAAa,MAAM;CAC5C,IACE,eAAe,KAAA,MACd,WAAW,eAAe,KAAK,CAAC,WAAW,YAAY,IAExD,MAAM,IAAI,MAAM,wDAAwD;CAC1E,MAAM,kBAAkB,MAAM,aAAa,WAAW;CACtD,IACE,oBAAoB,KAAA,MACnB,gBAAgB,eAAe,KAC9B,CAAC,gBAAgB,OAAO,KACxB,gBAAgB,UAAU,IAE5B,MAAM,IAAI,MACR,uEACF;CACF,OAAO;AACT;AAQA,MAAM,cAAc,OAAO,EAAE,aAAa,MAAM,WAA+B;CAC7E,MAAM,YAAY,WAAW;CAC7B,MAAM,MAAM,QAAQ,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;CACrD,MAAM,SAAS,MAAM,KACnB,aACA,UAAU,WAAW,UAAU,UAAU,UAAU,YACnD,IACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,KAAK;EACjC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,uEACF;EACF,MAAM,OAAO,SAAS,CAAC;EACvB,MAAM,OAAO,UAAU,MAAM,MAAM;EACnC,MAAM,OAAO,MAAM,IAAI;CACzB,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;AACF;AAEA,MAAM,qBAAqB,OAAO,gBAAwB;CACxD,IAAI;EACF,IAAK,MAAM,YAAY,WAAW,MAAO,KAAA,GAAW,OAAO,KAAA;EAC3D,MAAM,QAAQ,MAAM,KAClB,aACA,UAAU,WAAW,UAAU,UACjC;EACA,IAAI;GACF,MAAM,SAAS,MAAM,MAAM,KAAK;GAChC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,wDACF;GACF,OAAO;IAAE,MAAM,MAAM,MAAM,SAAS,MAAM;IAAG,MAAM,OAAO,OAAO;GAAM;EACzE,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF,SAAS,OAAO;EACd,MAAM,IAAI,MACR,uBAAuB,wBAAwB,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,IAAI,sBAChH;CACF;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgB,oBAAoB,IAAI;CACvD,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,YACG,KACE,EAAE,MAAM,cACP,GAAG,KAAK,IAAI,UAAU,SAAA,0BAAmC,KAAK,yBAAyB,IAC3F,CAAC,CACA,KAAK,IAAI,CACd;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,OAAO,mBAAmB,4BAChC,KAAK,MAAM,IAAI,CACjB;CACA,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CACvD,MAAM,SAAS,qBACb,KAAK,MACH,MAAM,SAAS,IAAI,IAAI,qBAAqB,YAAY,GAAG,GAAG,MAAM,CACtE,CACF;CACA,MAAM,SAAS,mBAAmB;EAChC;EACA;EACA,aAAa,YAAY,KAAK;EAC9B;EACA;CACF,CAAC;CACD,MAAM,cAAc,KAAK,MAAM,cAAc;CAC7C,MAAM,YAAY,WAAW;CAC7B,MAAM,sBAAsB,KAAK,MAAM,uBAAuB;CAC9D,MAAM,WAAW,MAAM,mBAAmB,mBAAmB;CAC7D,MAAM,iBAAiB,yBAAyB,UAAU,IAAI;CAC9D,MAAM,YAAY;EAAE;EAAa,MAAM;EAAQ,MAAM;CAAM,CAAC;CAC5D,IAAI,mBAAmB,UAAU,MAC/B,MAAM,YAAY;EAChB,aAAa;EACb,MAAM;EACN,MAAM,UAAU,QAAQ;CAC1B,CAAC;CACH,QAAQ,OAAO,MACb,aAAa,eAAe,OAAO,wBAAwB,GAC7D;AACF;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/consumer-compat-cli.cjs

@@ -6,14 +6,14 @@ const require_publish_contract = require("./publish-contract.cjs");
 let node_child_process = require("node:child_process");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let node_crypto = require("node:crypto");
 let semver = require("semver");
-let node_os = require("node:os");
-let yaml = require("yaml");
 let node_util = require("node:util");
+let yaml = require("yaml");
+let node_os = require("node:os");
 let node_fs_promises = require("node:fs/promises");
 let node_module = require("node:module");
 let acorn = require("acorn");
-let node_crypto = require("node:crypto");
 //#region src/consumer-build-approvals.ts
 const consumerBuildApprovals = async ({ manifest, lock, manager, directory }) => {
 	if (!require_toolchain_schema.consumerRecord(lock)) throw new Error("invalid consumer dependency lock");
@@ -325,7 +325,7 @@ const checkPackedJavaScriptWithNode = async ({ files, target, node, executable }
 };
 /** Read bytes without extracting archive-controlled paths or links. */
 const readPackedSyntaxFiles = async (archive) => {
-	const { stdout: listing } = await command("tar", ["-tzf", archive], { maxBuffer: 16 * 1024 * 1024 });
+	const { stdout: listing } = await command("tar", ["-tzf", archive], { maxBuffer: 16777216 });
 	const files = /* @__PURE__ */ new Map();
 	const members = archiveMembers(listing.split("\n").filter((entry) => entry !== ""));
 	const read = async (file) => {
@@ -340,7 +340,7 @@ const readPackedSyntaxFiles = async (archive) => {
 			"-xOf",
 			archive,
 			file
-		], { maxBuffer: 16 * 1024 * 1024 });
+		], { maxBuffer: 16777216 });
 		files.set(file, stdout);
 	};
 	for (const file of members) if (javascript.test(file) || node_path.default.posix.basename(file) === "package.json") await read(file);
@@ -770,9 +770,10 @@ const installConsumerFixtureDependencies = async (options) => {
 		const manifest = JSON.parse(await (0, node_fs_promises.readFile)(manifestFile, "utf8"));
 		if (!require_toolchain_schema.consumerRecord(manifest)) throw new Error("invalid consumer fixture manifest");
 		const lockSource = await (0, node_fs_promises.readFile)(node_path.default.join(options.directory, options.manager === "npm" ? "package-lock.json" : "pnpm-lock.yaml"), "utf8");
+		const lock = options.manager === "npm" ? JSON.parse(lockSource) : (0, yaml.parse)(lockSource);
 		const { approvals, rebuildTargets } = await consumerBuildApprovals({
 			manifest,
-			lock: options.manager === "npm" ? JSON.parse(lockSource) : (0, yaml.parse)(lockSource),
+			lock,
 			manager: options.manager,
 			directory: options.directory
 		});