@stll/oxlint-config 1.2.6 → 1.3.1

package/README.md

@@ -349,6 +349,15 @@ matching package is reused without network access.
 `wasm-bindgen-cli` requires the matching `wasm-bindgen` crate version in tracked
 root `Cargo.lock`. Regenerate after updating the lockfile or any tool pin.
 
+`cloud.prepare` (optional) names one root `package.json` script and a time bound,
+for example `{ "script": "generate:cloud", "seconds": 300 }`. The install phase
+runs it once after dependencies, as the invoking user, with stdin closed. At the
+bound (1 to 900 seconds) the script receives TERM and, 10 seconds later, KILL;
+when it ends, anything still running in its process group is killed. Use it
+for cheap derived sources that tasks need when `install` skips lifecycle scripts;
+it gets no network allowance. Generation fails when the script is not in the
+root `package.json`.
+
 Generation uses the installed policy's Bun, Node, PostgreSQL, and Valkey pins.
 PostgreSQL uses the PGDG major-version packages; minor updates within the pinned
 major are accepted for the disposable database. Before adding PGDG, provisioning

package/dist/toolchain-guard.cjs

@@ -13,7 +13,7 @@ let picomatch = require("picomatch");
 picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "1.2.6";
+const consumerRunnerVersion = "1.3.1";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
 const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {

package/dist/toolchain-guard.mjs

@@ -10,7 +10,7 @@ import { LineCounter, isAlias, isMap, isNode, isScalar, isSeq, parseAllDocuments
 import picomatch from "picomatch";
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "1.2.6";
+const consumerRunnerVersion = "1.3.1";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
 const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {

package/dist/toolchain-inputs.cjs

@@ -535,16 +535,32 @@ const parseEnvFile = (input) => {
 	if (envFile.startsWith("/") || /^[A-Za-z]:/.test(envFile) || envFile.includes("\\") || /\p{Cc}/u.test(envFile) || envFile.split("/").some((part) => part === "" || part === "." || part === "..")) throw new Error("cloud.envFile must be a canonical repository-relative path");
 	return envFile;
 };
+const cloudPrepareScript = /^[a-z0-9][a-z0-9:._-]*$/;
+const parsePrepare = (input) => {
+	if (input === void 0) return void 0;
+	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error("cloud.prepare must be an object");
+	for (const key of Object.keys(input)) if (key !== "script" && key !== "seconds") throw new Error(`unsupported cloud.prepare key: ${key}`);
+	const script = "script" in input ? input.script : void 0;
+	if (typeof script !== "string" || !cloudPrepareScript.test(script)) throw new Error("cloud.prepare.script must name a package script");
+	const seconds = "seconds" in input ? input.seconds : void 0;
+	if (typeof seconds !== "number" || !Number.isInteger(seconds) || seconds < 1 || seconds > 900) throw new Error(`cloud.prepare.seconds must be an integer from 1 to 900`);
+	return {
+		script,
+		seconds
+	};
+};
 /** Parse an explicit declaration without assuming services for undeclared repositories. */
 const parseCloudSetup = (input) => {
 	if (input === void 0) return void 0;
 	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error("cloud must be an object");
-	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile" && key !== "rust" && key !== "tools") throw new Error(`unsupported cloud key: ${key}`);
+	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile" && key !== "rust" && key !== "tools" && key !== "prepare") throw new Error(`unsupported cloud key: ${key}`);
 	const rust = parseRust("rust" in input ? input.rust : void 0);
 	const tools = parseTools("tools" in input ? input.tools : void 0);
+	const prepare = parsePrepare("prepare" in input ? input.prepare : void 0);
 	const extensions = {
 		...rust === void 0 ? {} : { rust },
-		...tools === void 0 ? {} : { tools }
+		...tools === void 0 ? {} : { tools },
+		...prepare === void 0 ? {} : { prepare }
 	};
 	const selected = "services" in input ? input.services : [];
 	if (!Array.isArray(selected)) throw new Error("cloud.services must be an array when provided");
@@ -599,7 +615,9 @@ service_process_matches() {
   owner="$(stat -c '%u' "/proc/$pid" 2>/dev/null)" || return 2
   [[ "$owner" =~ ^[0-9]+$ ]] || return 2
   [[ "$owner" == "$SERVICE_UID" ]] || return 1
-  actual="$(readlink -f "/proc/$pid/exe" 2>/dev/null)" || return 2
+  # Read the executable link as its verified owner: container root may lack the ptrace
+  # capability that reading another user's /proc/<pid>/exe requires.
+  actual="$(service_run readlink -f "/proc/$pid/exe" 2>/dev/null)" || return 2
   expected="$(readlink -f "$executable")" || return 2
   [[ -n "$actual" && -n "$expected" && "$actual" != *' (deleted)' ]] || return 2
   [[ "$actual" == "$expected" ]]
@@ -1071,7 +1089,15 @@ OUTPUT_USER="$(getent passwd "$OUTPUT_UID" | cut -d: -f1)"
 OUTPUT_HOME="$(getent passwd "$OUTPUT_UID" | cut -d: -f6)"
 [[ -n "$OUTPUT_USER" && "$OUTPUT_HOME" == /* && -d "$OUTPUT_HOME" ]] || fail 'Invoking user requires an existing home directory'
 root() { "$@"; }
-service_run() { runuser -u stll-cloud -- "$@" 9>&-; }
+# Service daemons outlive setup, so they inherit no descriptor beyond stdio: a cloud
+# runner can pass its terminal as extra descriptors and wait until every copy closes.
+service_run() (
+  for descriptor in "/proc/$BASHPID/fd/"*; do
+    descriptor="$(basename -- "$descriptor")"
+    if [[ "$descriptor" =~ ^[0-9]+$ ]] && (( descriptor > 2 )); then eval "exec $descriptor>&-"; fi
+  done
+  exec runuser -u stll-cloud -- "$@"
+)
 BUN_VERSION='@BUN@'
 NODE_VERSION='@NODE@'
 NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
@@ -1174,12 +1200,15 @@ process.stdout.write([...hosts].sort().join(","));
 
 @ENV_FUNCTIONS@
 
+@PREPARE_FUNCTION@
+
 if [[ "$MODE" == install ]]; then
   step runtimes install_runtimes
   step services install_services
   step tools install_tools
   step shell install_shell_environment
   step dependencies dependency_install
+@PREPARE_STEP@
   exit 0
 fi
 step runtime-check runtime_ready
@@ -1220,6 +1249,24 @@ write_environment() {
 }
 `;
 const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+const renderPrepare = (prepare, files) => {
+	if (prepare === void 0) return "";
+	const manifest = files["package.json"];
+	if (manifest === void 0) throw new Error("cloud.prepare requires a tracked root package.json");
+	const parsed = JSON.parse(manifest);
+	const scripts = typeof parsed === "object" && parsed !== null && "scripts" in parsed ? parsed.scripts : void 0;
+	if (typeof scripts !== "object" || scripts === null || !Object.hasOwn(scripts, prepare.script) || typeof Reflect.get(scripts, prepare.script) !== "string") throw new Error(`cloud.prepare.script ${prepare.script} is not a root package script`);
+	return [
+		"prepare_sources() {",
+		"  local leader status=0",
+		`  timeout --kill-after=10 ${prepare.seconds} runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" PATH="$PATH" "$BUN_DIR/bun" run ${shellQuote(prepare.script)} </dev/null &`,
+		"  leader=$!",
+		"  wait \"$leader\" || status=$?",
+		"  kill -KILL -- \"-$leader\" 2>/dev/null || true",
+		"  return \"$status\"",
+		"}"
+	].join("\n");
+};
 const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExceptions = [] }) => {
 	const selected = parseCloudSetup(cloud);
 	if (selected === void 0) throw new Error("cloud declaration is required");
@@ -1256,6 +1303,8 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 		["@ENV_FUNCTIONS@", selected.envFile === void 0 ? "" : environmentFunctions],
 		["@ENV_VALIDATE@", selected.envFile === void 0 ? "" : "DATABASE_URL=''\nREDIS_URL=''\nvalidate_environment"],
 		["@ENV_WRITE@", selected.envFile === void 0 ? "" : "write_environment"],
+		["@PREPARE_FUNCTION@", renderPrepare(selected.prepare, files)],
+		["@PREPARE_STEP@", selected.prepare === void 0 ? "" : "  step prepare prepare_sources"],
 		["@SERVICE_INSTALL@", renderCloudServiceInstall({
 			services,
 			postgres: policy.postgres,