@stll/oxlint-config 1.3.0 → 1.4.0

package/dist/publish-artifact-syntax.cjs

@@ -0,0 +1,1309 @@
+const require_rolldown_runtime = require("./rolldown-runtime.cjs");
+const require_toolchain_inputs = require("./toolchain-inputs.cjs");
+const require_consumer_node_support = require("./consumer-node-support.cjs");
+let node_child_process = require("node:child_process");
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let semver = require("semver");
+let node_util = require("node:util");
+let yaml = require("yaml");
+let node_os = require("node:os");
+let node_module = require("node:module");
+node_module = require_rolldown_runtime.__toESM(node_module, 1);
+let node_fs_promises = require("node:fs/promises");
+let acorn = require("acorn");
+let node_url = require("node:url");
+let node_events = require("node:events");
+let node_readline = require("node:readline");
+//#region src/consumer-release-pack.ts
+const record$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const exactVersion = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
+const outputDirectory = "<consumer-release-pack-output>";
+const packerSetupExpression = /^npm\s+install\s+((?:(?:--global|-g|--ignore-scripts)\s+)+)(npm|pnpm)@([^\s]+)$/;
+const defaultRunShell = (defaults) => {
+	if (!record$4(defaults) || !record$4(defaults["run"])) return void 0;
+	return defaults["run"]["shell"];
+};
+const packArguments = (line) => {
+	const command = /^(npm|pnpm)\s+pack(?:\s+(.*))?$/.exec(line);
+	const manager = command?.[1];
+	if (manager !== "npm" && manager !== "pnpm") throw new Error("Unsupported release pack command");
+	const tokens = (command?.[2] ?? "").match(/"[^"\n]*"|'[^'\n]*'|[^\s]+/g) ?? [];
+	const args = [];
+	let destination = false;
+	for (let index = 0; index < tokens.length; index++) {
+		const token = tokens.at(index);
+		if (token === "--pack-destination") {
+			if (destination) throw new Error("Repeated release pack destination");
+			const value = tokens.at(++index);
+			if (value === void 0 || !/^(?:"\$GITHUB_WORKSPACE\/[A-Za-z0-9_/-]+"|[A-Za-z0-9_/-]+)$/.test(value) || value.split("/").includes("..")) throw new Error("Unsupported release pack destination");
+			destination = true;
+			args.push(token, outputDirectory);
+			continue;
+		}
+		if (token !== "--ignore-scripts" && !(manager === "pnpm" && token === "--config.ignore-scripts=true") && token !== "--json" && token !== "--silent") throw new Error("Unsupported release pack arguments");
+		if (args.includes(token)) throw new Error("Repeated release pack flag");
+		args.push(token);
+	}
+	if (!destination || !args.includes("--ignore-scripts") && !args.includes("--config.ignore-scripts=true")) throw new Error("Release pack requires scripts disabled and --pack-destination");
+	return {
+		manager,
+		arguments: args
+	};
+};
+/** Both setup provenance and packing require unconditional shell commands. */
+const assertReleaseShellContext = ({ step, kind, location, inheritedShell }) => {
+	const run = step["run"];
+	if (typeof run !== "string") throw new Error(`Unsupported release ${kind} shell context: ${location}`);
+	const shell = step["shell"] === void 0 ? inheritedShell : step["shell"];
+	if (shell !== void 0 && shell !== "bash" && shell !== "sh") throw new Error(`Unsupported release ${kind} shell context: ${location}`);
+	let quote;
+	let code = "";
+	for (let index = 0; index < run.length; index += 1) {
+		const char = run[index];
+		if (char === "\n") {
+			if (quote !== void 0) throw new Error(`Unsupported release ${kind} shell context: ${location}`);
+			code += "\n";
+			continue;
+		}
+		if (quote !== "single" && char === "\\") {
+			if (run[index + 1] === "\n" || run[index + 1] === "\r" && run[index + 2] === "\n") throw new Error(`Unsupported release ${kind} shell context: ${location}`);
+			index += 1;
+			code += " ";
+			continue;
+		}
+		if (quote !== "single" && (char === "`" || char === "$" && run[index + 1] === "(")) throw new Error(`Unsupported release ${kind} shell context: ${location}`);
+		if (quote === "single") {
+			if (char === "'") quote = void 0;
+			code += " ";
+			continue;
+		}
+		if (quote === "double") {
+			if (char === "\"") quote = void 0;
+			code += " ";
+			continue;
+		}
+		if (char === "'") {
+			quote = "single";
+			code += " ";
+			continue;
+		}
+		if (char === "\"") {
+			quote = "double";
+			code += " ";
+			continue;
+		}
+		if (char === "#" && (index === 0 || /\s/.test(run[index - 1] ?? ""))) {
+			while (index + 1 < run.length && run[index + 1] !== "\n") index += 1;
+			continue;
+		}
+		code += char;
+	}
+	if (quote !== void 0 || /[;&|<>]/.test(code) || code.split("\n").some((line) => /^\s*(?:if|then|elif|else|fi|for|do|done|while|until|case|esac|function|select|exit|return|exec|break|continue|trap|eval|source|hash|alias|unalias)\b/.test(line)) || /(?:^|\n)\s*\.(?:\s|$)/.test(code) || /(?:^|\n)\s*[A-Za-z_]\w*\s*\(\s*\)\s*[{(]/.test(code) || kind === "setup" && /[(){}]/.test(code)) throw new Error(`Unsupported release ${kind} shell context: ${location}`);
+	if (kind !== "setup") return;
+	for (const line of run.split("\n")) {
+		const command = line.trim();
+		if (command === "" || command.startsWith("#")) continue;
+		if (packerSetupExpression.test(command) || /^(?:npm|pnpm)\s+pack(?:\s|$)/.test(command) || [
+			"set -e",
+			"set -eu",
+			"set -euo pipefail"
+		].includes(command)) continue;
+		throw new Error(`Unsupported release setup command context: ${location}`);
+	}
+};
+/** Resolve the repository's release packer without substituting another manager. */
+const resolveConsumerReleasePack = (files) => {
+	const candidates = [];
+	for (const [file, text] of Object.entries(files)) {
+		if (require_toolchain_inputs.githubAutomationFileKind(file) !== "workflow") continue;
+		const document = (0, yaml.parseDocument)(text, {
+			uniqueKeys: true,
+			merge: true
+		});
+		if (document.errors.length > 0) throw new Error(`Invalid release workflow YAML: ${file}`);
+		const source = document.toJS({ maxAliasCount: 100 });
+		if (!record$4(source) || !record$4(source["jobs"])) continue;
+		for (const [jobName, job] of Object.entries(source["jobs"])) {
+			if (!record$4(job) || !Array.isArray(job["steps"])) continue;
+			if (!job["steps"].some((step) => record$4(step) && typeof step["run"] === "string" && step["run"].split("\n").some((line) => !line.trimStart().startsWith("#") && /\b(?:npm|pnpm)\s+pack\b/.test(line)))) continue;
+			const jobShell = defaultRunShell(job["defaults"]);
+			const inheritedShell = jobShell === void 0 ? defaultRunShell(source["defaults"]) : jobShell;
+			const versions = /* @__PURE__ */ new Map();
+			let packed;
+			for (const step of job["steps"]) {
+				if (!record$4(step)) continue;
+				if (typeof step["uses"] === "string" && step["uses"].startsWith("pnpm/action-setup@")) {
+					if (step["if"] !== void 0 || step["continue-on-error"] !== void 0) throw new Error(`Conditional release packer setup: ${file}:${jobName}`);
+					const inputs = step["with"];
+					const version = record$4(inputs) ? inputs["version"] : void 0;
+					if (typeof version !== "string" || !exactVersion.test(version)) throw new Error(`Release pnpm setup requires an exact version: ${file}:${jobName}`);
+					const values = versions.get("pnpm") ?? [];
+					values.push(version);
+					versions.set("pnpm", values);
+				}
+				if (typeof step["run"] !== "string") continue;
+				for (const rawLine of step["run"].split("\n")) {
+					const line = rawLine.trim();
+					if (line.startsWith("#")) continue;
+					const setupCommand = /\bnpm\s+(?:install|i)\b[^\n]*\b(?:npm|pnpm)@/.test(line);
+					if (setupCommand) assertReleaseShellContext({
+						step,
+						kind: "setup",
+						location: `${file}:${jobName}`,
+						inheritedShell
+					});
+					const setup = packerSetupExpression.exec(line);
+					if (setupCommand && setup === null) throw new Error(`Unsupported release packer setup command: ${file}:${jobName}`);
+					if (setup !== null && /(?:^|\s)(?:--global|-g)(?:\s|$)/.test(setup[1] ?? "")) {
+						if (step["if"] !== void 0 || step["continue-on-error"] !== void 0) throw new Error(`Conditional release packer setup: ${file}:${jobName}`);
+						const manager = setup[2];
+						const version = setup[3];
+						if (manager === void 0 || version === void 0 || !exactVersion.test(version)) throw new Error(`Release packer setup requires an exact version: ${file}:${jobName}`);
+						const values = versions.get(manager) ?? [];
+						values.push(version);
+						versions.set(manager, values);
+					}
+					if (!/\b(?:npm|pnpm)\s+pack\b/.test(line)) continue;
+					if (job["if"] !== void 0 || step["if"] !== void 0 || step["continue-on-error"] !== void 0 || packed !== void 0) throw new Error(`Ambiguous release pack command: ${file}:${jobName}`);
+					assertReleaseShellContext({
+						step,
+						kind: "pack",
+						location: `${file}:${jobName}`,
+						inheritedShell
+					});
+					const command = packArguments(line);
+					const selected = versions.get(command.manager);
+					const version = selected?.at(0);
+					if (selected?.length !== 1 || version === void 0) throw new Error(`Missing or ambiguous exact release packer version: ${file}:${jobName}`);
+					packed = {
+						manager: command.manager,
+						version,
+						arguments: command.arguments
+					};
+				}
+			}
+			if (packed !== void 0) candidates.push(packed);
+		}
+	}
+	const selected = candidates.at(0);
+	if (candidates.length !== 1 || selected === void 0) throw new Error("Require exactly one identifiable release pack job");
+	return selected;
+};
+const consumerReleasePackArguments = ({ packer, directory }) => {
+	if (directory.length === 0) throw new Error("Release pack output directory is required");
+	return ["pack", ...packer.arguments.map((argument) => argument === outputDirectory ? directory : argument)];
+};
+//#endregion
+//#region src/publish-artifact-parser.ts
+const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const packageMode = (files, file) => {
+	let directory = node_path.default.posix.dirname(file);
+	while (directory !== ".") {
+		const source = files.get(`${directory}/package.json`);
+		if (source !== void 0) {
+			const manifest = JSON.parse(source);
+			if (!record$3(manifest)) throw new Error(`Invalid packed manifest: ${directory}`);
+			if (manifest["type"] === "module") return "module";
+			if (manifest["type"] === "commonjs") return "script";
+			if (manifest["type"] !== void 0) throw new Error(`Invalid packed package type: ${directory}`);
+			return "detect";
+		}
+		directory = node_path.default.posix.dirname(directory);
+	}
+	return "detect";
+};
+const parseArtifactSource = (source, options) => {
+	const script = options.sourceType === "script";
+	const content = script ? source.replace(/^\uFEFF/, "").replace(/^#![^\r\n]*/, "") : source;
+	try {
+		return (0, acorn.parse)(script ? node_module.default.wrap(content) : content, options);
+	} catch (error) {
+		if (!script || !(error instanceof SyntaxError) || !record$3(error) || typeof error["pos"] !== "number") throw error;
+		const prefixLength = node_module.default.wrap("\0").indexOf("\0");
+		const position = Math.max(0, Math.min(source.length, error["pos"] - prefixLength + source.length - content.length));
+		const lines = source.slice(0, position).split(/\r\n|[\n\r\u2028\u2029]/);
+		const location = `(${lines.length}:${lines.at(-1)?.length ?? 0})`;
+		throw new SyntaxError(error.message.replace(/\(\d+:\d+\)$/, location));
+	}
+};
+//#endregion
+//#region src/publish-contract.ts
+const record$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const object = (value, field) => {
+	if (!record$2(value)) throw new Error(`${field} must be an object`);
+	return value;
+};
+const closedKeys = (value, allowed, field) => {
+	for (const key of Object.keys(value)) if (!allowed.includes(key)) throw new Error(`${field}.${key} is unsupported`);
+};
+const text = (value, field) => {
+	if (typeof value !== "string" || value.trim() === "") throw new Error(`${field} must be a nonempty string`);
+	return value;
+};
+const stringMap = (value, field) => {
+	const result = /* @__PURE__ */ new Map();
+	for (const [key, entry] of Object.entries(object(value, field))) result.set(text(key, field), text(entry, `${field}.${key}`));
+	return Object.fromEntries(result);
+};
+const exportTarget = (value, field) => {
+	if (value === null) return null;
+	if (typeof value === "string") return text(value, field);
+	if (Array.isArray(value)) return value.map((entry, index) => exportTarget(entry, `${field}[${index}]`));
+	const result = /* @__PURE__ */ new Map();
+	for (const [key, entry] of Object.entries(object(value, field))) result.set(text(key, field), exportTarget(entry, `${field}.${key}`));
+	return Object.fromEntries(result);
+};
+const typesVersions = (value) => {
+	const result = /* @__PURE__ */ new Map();
+	for (const [range, paths] of Object.entries(object(value, "typesVersions"))) {
+		const mappings = /* @__PURE__ */ new Map();
+		for (const [pattern, entries] of Object.entries(object(paths, `typesVersions.${range}`))) {
+			if (!Array.isArray(entries)) throw new Error(`typesVersions.${range}.${pattern} must be an array`);
+			mappings.set(text(pattern, "typesVersions pattern"), entries.map((entry) => text(entry, "typesVersions path")));
+		}
+		result.set(text(range, "typesVersions range"), Object.fromEntries(mappings));
+	}
+	return Object.fromEntries(result);
+};
+const entryPointKeys = [
+	"type",
+	"exports",
+	"main",
+	"module",
+	"types",
+	"typings",
+	"bin",
+	"typesVersions"
+];
+const publishConfigOverrideKeys = entryPointKeys.filter((key) => key !== "type");
+const entryPoints = (value) => {
+	const source = object(value, "entryPoints");
+	closedKeys(source, entryPointKeys, "entryPoints");
+	const result = {};
+	if ("type" in source) {
+		if (source["type"] !== "module" && source["type"] !== "commonjs") throw new Error("entryPoints.type must be module or commonjs");
+		result.type = source["type"];
+	}
+	if ("exports" in source) result.exports = exportTarget(source["exports"], "entryPoints.exports");
+	for (const key of [
+		"main",
+		"module",
+		"types",
+		"typings"
+	]) if (key in source) result[key] = text(source[key], `entryPoints.${key}`);
+	if ("bin" in source) result.bin = typeof source["bin"] === "string" ? text(source["bin"], "entryPoints.bin") : stringMap(source["bin"], "entryPoints.bin");
+	if ("typesVersions" in source) result.typesVersions = typesVersions(source["typesVersions"]);
+	return result;
+};
+const publishTarget = (value) => {
+	const source = object(value, "target");
+	if (source["type"] === "types-only") {
+		closedKeys(source, ["type"], "target");
+		return { type: "types-only" };
+	}
+	if (source["type"] !== "javascript") throw new Error("target.type must be javascript or types-only");
+	closedKeys(source, ["type", "targets"], "target");
+	if (!Array.isArray(source["targets"]) || source["targets"].length === 0) throw new Error("target.targets must be a nonempty array");
+	const targets = Array.from(source["targets"]).map((entry) => {
+		const target = text(entry, "target.targets");
+		if (/[\s,]/.test(target) || Array.from(target).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) throw new Error("target.targets must contain resolved target identifiers");
+		return target;
+	});
+	return {
+		type: "javascript",
+		targets: [...new Set(targets)].sort()
+	};
+};
+const parsePublishContract = (value) => {
+	const source = object(value, "publish contract");
+	closedKeys(source, [
+		"engines",
+		"peerDependencies",
+		"target",
+		"entryPoints"
+	], "publish contract");
+	return {
+		engines: stringMap(source["engines"], "engines"),
+		peerDependencies: stringMap(source["peerDependencies"], "peerDependencies"),
+		target: publishTarget(source["target"]),
+		entryPoints: entryPoints(source["entryPoints"])
+	};
+};
+const publishPackers = ["npm", "pnpm"];
+const resolveManifestContract = ({ packer, manifest, target }) => {
+	if (!publishPackers.includes(packer)) throw new Error("publish packer must be npm or pnpm");
+	const source = object(manifest, "package manifest");
+	const config = "publishConfig" in source ? object(source["publishConfig"], "publishConfig") : {};
+	closedKeys(config, [
+		...publishConfigOverrideKeys,
+		"access",
+		"registry"
+	], "publishConfig");
+	if (packer === "npm") {
+		for (const key of publishConfigOverrideKeys) if (Object.hasOwn(config, key) && !(key === "exports" || key === "typesVersions" ? JSON.stringify(config[key]) === JSON.stringify(source[key]) : (0, node_util.isDeepStrictEqual)(config[key], source[key]))) throw new Error(`npm pack does not apply differing publishConfig.${key}; move the published entry to package.json or use pnpm`);
+	}
+	for (const field of [
+		"browser",
+		"esnext",
+		"es2015",
+		"unpkg",
+		"umd:main"
+	]) if (Object.hasOwn(source, field) || Object.hasOwn(config, field)) throw new Error(`published entry field ${field} is unsupported`);
+	const published = {};
+	for (const key of entryPointKeys) if (packer === "pnpm" && key !== "type" && key in config) published[key] = config[key];
+	else if (key in source) published[key] = source[key];
+	if (typeof published["bin"] === "string") {
+		const command = text(source["name"], "package name for bin").split("/").at(-1);
+		if (command === void 0 || command === "") throw new Error("package name must determine its bin command");
+		published["bin"] = { [command]: published["bin"] };
+	}
+	let engines = {};
+	if (Object.hasOwn(source, "engines")) engines = source["engines"];
+	return parsePublishContract({
+		engines,
+		peerDependencies: Object.hasOwn(source, "peerDependencies") ? source["peerDependencies"] : {},
+		target,
+		entryPoints: published
+	});
+};
+const consumerPolicy = (policy) => {
+	closedKeys(object(policy, "consumer policy"), ["node", "typescript"], "consumer policy");
+	for (const [field, major] of [["node", 22], ["typescript", 6]]) {
+		const version = (0, semver.parse)(policy[field]);
+		if (version === null || version.version !== policy[field] || version.major !== major || version.prerelease.length !== 0) throw new Error(`consumer policy ${field} must pin an exact stable ${major}.x release`);
+	}
+};
+/** Share the accepted Node target grammar between static and packed checks. */
+const publishedNodeTargetSupportsConsumer = ({ target, node }) => {
+	const match = /^node([1-9]\d*)(?:\.(0|[1-9]\d*))?(?:\.(0|[1-9]\d*))?$/i.exec(target);
+	const version = match === null ? null : (0, semver.parse)(`${match[1]}.${match[2] ?? "0"}.${match[3] ?? "0"}`);
+	return version !== null && (0, semver.lte)(version, node);
+};
+const checkPublishContract = ({ packer, manifest, target, contract, policy }) => {
+	consumerPolicy(policy);
+	const current = resolveManifestContract({
+		packer,
+		manifest,
+		target
+	});
+	const committed = parsePublishContract(contract);
+	const diagnostics = [];
+	const add = (field, message) => diagnostics.push({
+		field,
+		message
+	});
+	const compare = (field, expected, actual) => {
+		if (field !== "entryPoints.exports" && field !== "entryPoints.typesVersions" && record$2(expected) && record$2(actual)) {
+			for (const key of /* @__PURE__ */ new Set([...Object.keys(expected), ...Object.keys(actual)])) compare(`${field}.${key}`, Object.hasOwn(expected, key) ? expected[key] : void 0, Object.hasOwn(actual, key) ? actual[key] : void 0);
+			return;
+		}
+		if (JSON.stringify(expected) !== JSON.stringify(actual)) add(field, `published ${field} differs from the committed contract`);
+	};
+	for (const field of [
+		"engines",
+		"peerDependencies",
+		"target",
+		"entryPoints"
+	]) compare(field, committed[field], current[field]);
+	const support = (field, range, version) => {
+		if (range !== void 0 && !(0, semver.satisfies)(version, range)) add(field, `${field} must support consumer version ${version}`);
+	};
+	if (!require_consumer_node_support.consumerNodeSupportMatches({
+		range: current.engines["node"],
+		node: policy.node
+	})) add("engines.node", `engines.node must support consumer version ${policy.node}`);
+	support("engines.typescript", current.engines["typescript"], policy.typescript);
+	support("peerDependencies.typescript", current.peerDependencies["typescript"], policy.typescript);
+	if ("bun" in current.engines) add("engines.bun", "published packages must not require Bun");
+	for (const peer of [
+		"bun",
+		"bun-types",
+		"@types/bun",
+		"@typescript/native"
+	]) if (Object.hasOwn(current.peerDependencies, peer)) add(`peerDependencies.${peer}`, "published packages must not require development runtime or compiler packages");
+	if (current.target.type === "javascript") for (const selected of current.target.targets) {
+		if (/^bun(?:$|[0-9])/i.test(selected)) {
+			add("target", "published JavaScript must not require Bun");
+			continue;
+		}
+		if (!/^node/i.test(selected)) continue;
+		if (!publishedNodeTargetSupportsConsumer({
+			target: selected,
+			node: policy.node
+		})) add("target", `JavaScript target ${selected} must support consumer Node ${policy.node}`);
+	}
+	return diagnostics;
+};
+//#endregion
+//#region src/publish-node-resolver.ts
+const worker = String.raw`
+import {createRequire, isBuiltin} from 'node:module';
+import {readFileSync, existsSync} from 'node:fs';
+import path from 'node:path';
+import {pathToFileURL} from 'node:url';
+import {createInterface} from 'node:readline';
+const selfReference = (specifier, file) => {
+  let directory = path.dirname(file);
+  while (true) {
+    const manifest = path.join(directory, 'package.json');
+    if (existsSync(manifest)) {
+      const {name} = JSON.parse(readFileSync(manifest, 'utf8'));
+      return typeof name === 'string' &&
+        (specifier === name || specifier.startsWith(name + '/'));
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory) return false;
+    directory = parent;
+  }
+};
+const bare = specifier => typeof specifier === 'string' &&
+  !specifier.startsWith('.') && !specifier.startsWith('/') &&
+  !specifier.startsWith('#') && !specifier.includes(':');
+for await (const line of createInterface({input: process.stdin})) {
+  const {specifier, file, mode} = JSON.parse(line);
+  try {
+    const resolved = mode === 'require'
+      ? createRequire(file).resolve(specifier)
+      : import.meta.resolve(specifier, pathToFileURL(file).href);
+    console.log(JSON.stringify({url: isBuiltin(resolved) ||
+      (bare(specifier) && !selfReference(specifier, file)) ? null :
+      mode === 'require' ? pathToFileURL(resolved).href : resolved}));
+  } catch (error) {
+    // Node reports the selected missing dependency, including external #imports
+    // targets. Never reinterpret its exports/imports selection ourselves.
+    const missing = /^Cannot find (?:package|module) '([^']+)'/.exec(error.message)?.[1];
+    if (bare(missing) && !selfReference(missing, file) &&
+      ['MODULE_NOT_FOUND', 'ERR_MODULE_NOT_FOUND'].includes(error.code))
+      console.log(JSON.stringify({url: null}));
+    else console.log(JSON.stringify({error: String(error)}));
+  }
+}
+`;
+/** One metadata-only Node process per archive, with default import/require conditions. */
+const createPackedNodeResolver = () => {
+	const child = (0, node_child_process.spawn)("node", [
+		"--experimental-import-meta-resolve",
+		"--input-type=module",
+		"--eval",
+		worker
+	], {
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		env: {
+			...process.env,
+			NODE_OPTIONS: void 0,
+			NODE_PATH: void 0
+		}
+	});
+	let stderr = "";
+	child.stderr.setEncoding("utf8");
+	child.stderr.on("data", (chunk) => {
+		if (stderr.length < 16384) stderr += chunk;
+	});
+	child.on("error", (error) => child.stdout.destroy(error));
+	const output = (0, node_readline.createInterface)({ input: child.stdout });
+	const lines = output[Symbol.asyncIterator]();
+	return {
+		resolve: async (request) => {
+			const timeout = setTimeout(() => child.kill(), 1e4);
+			try {
+				child.stdin.write(`${JSON.stringify(request)}\n`);
+				const line = await lines.next();
+				if (line.done === true) throw new Error(`Node resolver stopped: ${stderr}`);
+				const response = JSON.parse(line.value);
+				if (typeof response !== "object" || response === null) throw new Error("Invalid Node resolver response");
+				if ("error" in response && typeof response.error === "string") throw new Error(response.error);
+				if (!("url" in response) || response.url !== null && typeof response.url !== "string") throw new Error("Invalid Node resolver URL");
+				return response.url;
+			} finally {
+				clearTimeout(timeout);
+			}
+		},
+		close: async () => {
+			output.close();
+			if (child.pid !== void 0 && child.exitCode === null && child.signalCode === null) {
+				const exited = (0, node_events.once)(child, "exit");
+				child.kill();
+				await exited;
+			}
+		}
+	};
+};
+//#endregion
+//#region src/publish-runtime-imports.ts
+const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const javascript$1 = /\.(?:js|mjs|cjs)$/iu;
+const opaque = /\.(?:json|node)$/u;
+const declarationFile = /\.d\.[cm]?ts$/iu;
+const packagePath = (file) => {
+	const normalized = node_path.default.posix.normalize(file);
+	if (normalized !== "package" && !normalized.startsWith("package/") || file.includes("\\")) throw new Error(`Runtime import escapes the packed package: ${file}`);
+	return normalized;
+};
+const targets = (value) => {
+	if (typeof value === "string") return [value];
+	if (value === void 0 || value === null) return [];
+	if (Array.isArray(value)) return value.flatMap(targets);
+	if (!record$1(value)) throw new Error("Invalid packed runtime entry target");
+	return Object.entries(value).flatMap(([key, entry]) => key === "types" || key === "typings" ? [] : targets(entry));
+};
+const identifier = (value) => record$1(value) && value["type"] === "Identifier" && typeof value["name"] === "string" ? value["name"] : void 0;
+const literal = (value) => record$1(value) && value["type"] === "Literal" && typeof value["value"] === "string" ? value["value"] : void 0;
+const nodes = (value) => {
+	if (Array.isArray(value)) return value.flatMap(nodes);
+	return record$1(value) && typeof value["type"] === "string" ? [value] : [];
+};
+const children = (node) => Object.values(node).flatMap(nodes);
+const patternNames = (value) => {
+	const name = identifier(value);
+	if (name !== void 0) return [name];
+	if (!record$1(value)) return [];
+	switch (value["type"]) {
+		case "ObjectPattern": return nodes(value["properties"]).flatMap((property) => patternNames(property["type"] === "RestElement" ? property["argument"] : property["value"]));
+		case "ArrayPattern": return nodes(value["elements"]).flatMap(patternNames);
+		case "RestElement": return patternNames(value["argument"]);
+		case "AssignmentPattern": return patternNames(value["left"]);
+		default: return [];
+	}
+};
+const bindingScope = (scopes, name) => scopes.findLast((scope) => scope.has(name));
+const binding = (scopes, name) => bindingScope(scopes, name)?.get(name);
+const memberName = (value) => value["computed"] === true ? literal(value["property"]) : identifier(value["property"]);
+const loaderBinding = (value, scopes) => {
+	const name = identifier(value);
+	if (name !== void 0) {
+		const resolved = binding(scopes, name);
+		return resolved === "filename" ? "other" : resolved;
+	}
+	if (!record$1(value) || value["type"] !== "MemberExpression") return void 0;
+	const owner = identifier(value["object"]);
+	if (owner === void 0) return void 0;
+	const kind = binding(scopes, owner);
+	const property = memberName(value);
+	if (kind === "module-api" && property === "createRequire") return "factory";
+	if (kind === "module" && property === "require") return "require";
+	if (kind === "require" && property === "resolve") return "require";
+};
+const scopeDeclarations = (node) => {
+	if ((node["type"] === "ExportNamedDeclaration" || node["type"] === "ExportDefaultDeclaration") && record$1(node["declaration"])) return scopeDeclarations(node["declaration"]);
+	return [node];
+};
+const functionNode = (node) => [
+	"FunctionDeclaration",
+	"FunctionExpression",
+	"ArrowFunctionExpression"
+].includes(String(node["type"]));
+/** Read syntax only; known loaders must have statically resolvable bindings. */
+const staticImports = (tree, mode) => {
+	const result = [];
+	const functionScopes = /* @__PURE__ */ new WeakMap();
+	const resolvedFactories = /* @__PURE__ */ new Set();
+	const resolvedNamespaces = /* @__PURE__ */ new Set();
+	const allowedLoaderReferences = /* @__PURE__ */ new Set();
+	const allowReference = (value) => {
+		for (const node of nodes(value)) {
+			allowedLoaderReferences.add(node);
+			for (const child of children(node)) allowReference(child);
+		}
+	};
+	const allowPattern = (value) => {
+		if (!record$1(value)) return;
+		if (value["type"] === "Identifier") allowedLoaderReferences.add(value);
+		else if (value["type"] === "Property") allowPattern(value["value"]);
+		else if (value["type"] === "AssignmentPattern") allowPattern(value["left"]);
+		else if (value["type"] === "RestElement") allowPattern(value["argument"]);
+		else if (["ObjectPattern", "ArrayPattern"].includes(String(value["type"]))) for (const child of children(value)) allowPattern(child);
+	};
+	const unresolvable = (description) => /* @__PURE__ */ new Error(`Unresolvable dynamic loader: ${description}`);
+	const loaderName = (name, scopes) => {
+		const previous = binding(scopes, name);
+		return mode === "script" && [
+			"require",
+			"module",
+			"createRequire"
+		].includes(name) || previous !== void 0 && previous !== "other" && previous !== "filename";
+	};
+	const loaderValue = (value, scopes) => {
+		if (!record$1(value)) return false;
+		const kind = loaderBinding(value, scopes);
+		if (kind !== void 0 && kind !== "other") return true;
+		if (functionNode(value) || [
+			"CallExpression",
+			"MemberExpression",
+			"UnaryExpression",
+			"BinaryExpression",
+			"TemplateLiteral"
+		].includes(String(value["type"]))) return false;
+		if (value["type"] === "Property") return loaderValue(value["value"], scopes);
+		return children(value).some((child) => loaderValue(child, scopes));
+	};
+	const exportedLoader = (value, scopes) => {
+		if (!record$1(value) || functionNode(value)) return false;
+		if (loaderValue(value, scopes)) return true;
+		if (value["type"] === "CallExpression") {
+			const callee = loaderBinding(value["callee"], scopes);
+			return callee === "factory" || callee === "require" && ["node:module", "module"].includes(literal(nodes(value["arguments"]).at(0)) ?? "");
+		}
+		if (value["type"] === "Property") return exportedLoader(value["value"], scopes);
+		if ([
+			"ObjectExpression",
+			"ArrayExpression",
+			"ConditionalExpression",
+			"LogicalExpression",
+			"SequenceExpression"
+		].includes(String(value["type"]))) return children(value).some((child) => exportedLoader(child, scopes));
+		return false;
+	};
+	const unsupportedPropagation = () => unresolvable("unsupported loader propagation across module exports");
+	const walk = (node, scopes, parent) => {
+		const kind = node["type"];
+		if (kind === "Program" || kind === "BlockStatement" || functionNode(node) || kind === "CatchClause" || kind === "ForStatement" || kind === "ForOfStatement" || kind === "ForInStatement") {
+			const local = /* @__PURE__ */ new Map();
+			const bind = (pattern) => {
+				allowPattern(pattern);
+				for (const name of patternNames(pattern)) {
+					if (loaderName(name, scopes)) throw unresolvable(`unsupported loader binding: ${name}`);
+					local.set(name, "other");
+				}
+			};
+			const bindVariable = (entry, declarationKind) => {
+				if (declarationKind === "var" && node["type"] === "BlockStatement" && node !== root) return;
+				allowPattern(entry["id"]);
+				for (const name of patternNames(entry["id"])) {
+					if (mode === "script" && node === root && declarationKind === "var" && entry["init"] === null && (name === "require" || name === "module")) continue;
+					local.set(name, "other");
+				}
+			};
+			if (functionNode(node)) {
+				if (kind !== "ArrowFunctionExpression") functionScopes.set(local, "function");
+				bind(node["id"]);
+				for (const parameter of nodes(node["params"])) bind(parameter);
+			}
+			if (kind === "CatchClause") bind(node["param"]);
+			if (kind === "ArrowFunctionExpression" && record$1(node["body"]) && node["body"]["type"] !== "BlockStatement" && loaderValue(node["body"], [...scopes, local])) throw unresolvable("loader returned through an unsupported function");
+			const statements = kind === "Program" || kind === "BlockStatement" ? nodes(node["body"]).flatMap(scopeDeclarations) : children(node).flatMap(scopeDeclarations);
+			const declarations = [];
+			for (const statement of statements) if (statement["type"] === "VariableDeclaration") for (const entry of nodes(statement["declarations"])) {
+				bindVariable(entry, statement["kind"]);
+				declarations.push(entry);
+			}
+			else if (statement["type"] === "FunctionDeclaration" || statement["type"] === "ClassDeclaration") bind(statement["id"]);
+			else if (statement["type"] === "ImportDeclaration") {
+				allowReference(statement["specifiers"]);
+				const moduleImport = ["node:module", "module"].includes(literal(statement["source"]) ?? "");
+				const specifiers = nodes(statement["specifiers"]);
+				if (moduleImport && specifiers.length === 0) throw unresolvable("module import needs recognized static bindings");
+				for (const specifier of specifiers) {
+					const name = identifier(specifier["local"]);
+					if (name === void 0) throw unresolvable("import binding cannot be resolved statically");
+					if (!moduleImport) {
+						local.set(name, "other");
+						continue;
+					}
+					const imported = identifier(specifier["imported"]) ?? literal(specifier["imported"]);
+					if (imported === "createRequire") local.set(name, "factory");
+					else if (["ImportDefaultSpecifier", "ImportNamespaceSpecifier"].includes(String(specifier["type"])) || imported === "Module" || imported === "default") local.set(name, "module-api");
+					else throw unresolvable("unsupported node:module import binding");
+				}
+			}
+			if (functionNode(node) || kind === "Program" || node === root) {
+				const hoisted = (entry) => {
+					if (functionNode(entry)) return;
+					if (entry["type"] === "VariableDeclaration" && entry["kind"] === "var") for (const declaration of nodes(entry["declarations"])) {
+						bindVariable(declaration, "var");
+						if (!declarations.includes(declaration)) declarations.push(declaration);
+					}
+					for (const child of children(entry)) hoisted(child);
+				};
+				for (const statement of statements) hoisted(statement);
+			}
+			const nested = [...scopes, local];
+			let changed = true;
+			const assign = (name, value) => {
+				const owner = bindingScope(nested, name);
+				if (owner === void 0) throw unresolvable("loader declaration has no owning scope");
+				if (owner.get(name) === value) return;
+				if (owner.get(name) !== "other") throw unresolvable("conflicting loader binding declarations");
+				owner.set(name, value);
+				changed = true;
+			};
+			while (changed) {
+				changed = false;
+				for (const entry of declarations) {
+					const name = identifier(entry["id"]);
+					const initial = entry["init"];
+					if (!record$1(initial)) continue;
+					const alias = loaderBinding(initial, nested);
+					const nodeModule = initial["type"] === "CallExpression" && loaderBinding(initial["callee"], nested) === "require" && ["node:module", "module"].includes(literal(nodes(initial["arguments"]).at(0)) ?? "");
+					if ((nodeModule || alias === "module-api") && record$1(entry["id"]) && entry["id"]["type"] === "ObjectPattern") for (const property of nodes(entry["id"]["properties"])) {
+						const key = property["computed"] === true ? literal(property["key"]) : identifier(property["key"]) ?? literal(property["key"]);
+						if (property["type"] === "RestElement" || key === void 0) throw unresolvable("module loader destructuring cannot be resolved statically");
+						const factoryName = identifier(property["value"]);
+						if (key === "createRequire" || key === "Module" || key === "default") {
+							if (factoryName === void 0) throw unresolvable("module loader binding pattern cannot be resolved statically");
+							assign(factoryName, key === "createRequire" ? "factory" : "module-api");
+						} else throw unresolvable("unsupported module namespace destructuring");
+					}
+					else if (name === void 0 && alias !== void 0 && alias !== "other") throw unresolvable("loader destructuring cannot be resolved statically");
+					if (nodeModule) resolvedNamespaces.add(initial);
+					if (alias !== void 0 && alias !== "other") allowReference(initial);
+					if (name === void 0) continue;
+					if (alias !== void 0 && alias !== "other") assign(name, alias);
+					if (nodeModule) assign(name, "module-api");
+					if (initial["type"] === "CallExpression" && loaderBinding(initial["callee"], nested) === "factory") {
+						const argument = nodes(initial["arguments"]).at(0);
+						const object = argument?.["object"];
+						const importMeta = record$1(object) && object["type"] === "MetaProperty" && identifier(object["meta"]) === "import" && identifier(object["property"]) === "meta";
+						if (nodes(initial["arguments"]).length !== 1 || !(identifier(argument) === "__filename" && binding(nested, "__filename") === "filename" || argument?.["type"] === "MemberExpression" && argument["computed"] === false && importMeta && identifier(argument["property"]) === "url")) throw unresolvable("createRequire needs import.meta.url or __filename");
+						assign(name, "require");
+						resolvedFactories.add(initial);
+					}
+				}
+			}
+			for (const entry of declarations) {
+				const initial = entry["init"];
+				for (const name of patternNames(entry["id"])) {
+					if (loaderName(name, scopes) && binding(nested, name) === "other") throw unresolvable(`unknown loader declaration: ${name}`);
+					const resolved = binding(nested, name);
+					const source = loaderBinding(initial, nested);
+					if (initial !== null && resolved !== void 0 && resolved !== "other" && (source === void 0 || source === "other") && (!record$1(initial) || !resolvedFactories.has(initial) && !resolvedNamespaces.has(initial))) throw unresolvable(`unknown loader initializer: ${name}`);
+				}
+				if (loaderBinding(initial, nested) === void 0 && loaderValue(initial, nested)) throw unresolvable("binding initializer cannot be resolved statically");
+			}
+			for (const child of children(node)) walk(child, nested, node);
+			return;
+		}
+		if (kind === "ExportDefaultDeclaration" && exportedLoader(node["declaration"], scopes)) throw unsupportedPropagation();
+		if (kind === "ExportNamedDeclaration") {
+			const declaration = node["declaration"];
+			if (record$1(declaration) && declaration["type"] === "VariableDeclaration") {
+				for (const entry of nodes(declaration["declarations"])) if (patternNames(entry["id"]).some((name) => {
+					const resolved = binding(scopes, name);
+					return resolved !== void 0 && resolved !== "other" && resolved !== "filename";
+				}) || exportedLoader(entry["init"], scopes)) throw unsupportedPropagation();
+			}
+			if (literal(node["source"]) === void 0) {
+				for (const specifier of nodes(node["specifiers"])) if (exportedLoader(specifier["local"], scopes)) throw unsupportedPropagation();
+			}
+			allowReference(node["specifiers"]);
+		}
+		if (kind === "ImportDeclaration" || kind === "ExportNamedDeclaration" || kind === "ExportAllDeclaration") {
+			const specifier = literal(node["source"]);
+			if (kind !== "ImportDeclaration" && ["node:module", "module"].includes(specifier ?? "")) throw unsupportedPropagation();
+			if (specifier !== void 0) result.push({
+				specifier,
+				mode: "import"
+			});
+		}
+		if (kind === "ImportExpression") {
+			const specifier = literal(node["source"]);
+			if (specifier === void 0) throw unresolvable("dynamic import needs a literal module specifier");
+			if (["node:module", "module"].includes(specifier)) throw unresolvable("dynamic module namespace imports are unsupported");
+			result.push({
+				specifier,
+				mode: "import"
+			});
+		}
+		if (kind === "CallExpression") {
+			const callee = node["callee"];
+			const resolved = loaderBinding(callee, scopes);
+			const specifier = literal(nodes(node["arguments"]).at(0));
+			if (resolved === "require") {
+				if (specifier === void 0 || nodes(node["arguments"]).length !== 1) throw unresolvable("require/resolve needs one literal module specifier");
+				allowReference(callee);
+				if (["node:module", "module"].includes(specifier) && !resolvedNamespaces.has(node)) throw unresolvable("module namespace needs a resolvable local binding");
+				result.push({
+					specifier,
+					mode: "require"
+				});
+			}
+			if (resolved === "factory") {
+				if (!resolvedFactories.has(node)) throw unresolvable("createRequire result needs a resolvable local binding");
+				allowReference(callee);
+			}
+			if (record$1(callee) && callee["type"] === "MemberExpression" && ["require", "factory"].includes(loaderBinding(callee["object"], scopes) ?? "") && resolved === void 0) throw unresolvable("loader method cannot be resolved statically");
+			if (resolved !== "require" && resolved !== "factory" && nodes(node["arguments"]).some((argument) => loaderValue(argument, scopes))) throw unresolvable("loader passed through an unsupported call");
+		}
+		if (kind === "AssignmentExpression") {
+			const assigned = loaderBinding(node["right"], scopes);
+			if (exportedLoader(node["right"], scopes) && (node["operator"] !== "=" || loaderBinding(node["left"], scopes) !== assigned || assigned === void 0)) throw unsupportedPropagation();
+			for (const name of patternNames(node["left"])) {
+				const previous = binding(scopes, name);
+				if (loaderName(name, scopes) && (previous === void 0 || previous === "other")) throw unresolvable(`unknown loader assignment: ${name}`);
+				if (previous !== void 0 && previous !== "other" && (node["operator"] !== "=" || loaderBinding(node["right"], scopes) !== previous)) throw unresolvable("loader reassignment cannot be resolved statically");
+			}
+		}
+		if (kind === "ReturnStatement" && loaderValue(node["argument"], scopes)) throw unresolvable("loader returned through an unsupported function");
+		const nonReference = parent !== void 0 && (parent["type"] === "MemberExpression" && parent["computed"] === false && parent["property"] === node || [
+			"Property",
+			"MethodDefinition",
+			"PropertyDefinition"
+		].includes(String(parent["type"])) && parent["computed"] === false && parent["key"] === node && parent["value"] !== node);
+		const reference = loaderBinding(node, scopes);
+		const name = identifier(node);
+		if (!nonReference && !allowedLoaderReferences.has(node)) {
+			const owner = scopes.findLast((scope) => functionScopes.has(scope));
+			if (name === "arguments" && owner !== void 0 && functionScopes.get(owner) === "wrapper" || name === "eval" || name === "Function") throw unresolvable(`unsupported dynamic loader escape: ${name}`);
+		}
+		if (kind === "MemberExpression") {
+			const owner = identifier(node["object"]);
+			const property = memberName(node);
+			const ownerBinding = loaderBinding(node["object"], scopes);
+			if (ownerBinding === "module" && (property === "constructor" || property === "require") || ownerBinding === "require" && [
+				"cache",
+				"extensions",
+				"main"
+			].includes(property ?? "") || owner === "process" && property === "mainModule" || (owner === "globalThis" || owner === "global") && [
+				"require",
+				"eval",
+				"Function"
+			].includes(property ?? "")) throw unresolvable("unsupported dynamic loader escape property");
+		}
+		if (name !== void 0 && loaderName(name, scopes) && (reference === void 0 || reference === "other") && !nonReference && !allowedLoaderReferences.has(node)) throw unresolvable(`unknown loader reference: ${name}`);
+		const moduleExports = reference === "module" && parent?.["type"] === "MemberExpression" && parent["object"] === node && memberName(parent) === "exports";
+		if (reference !== void 0 && reference !== "other" && !moduleExports && !nonReference && !allowedLoaderReferences.has(node)) throw unresolvable("loader reference is not a recognized static form");
+		for (const child of children(node)) walk(child, scopes, node);
+	};
+	const root = nodes(tree).at(0);
+	if (root !== void 0) {
+		const wrapper = /* @__PURE__ */ new Map();
+		if (mode === "script") {
+			wrapper.set("require", "require");
+			wrapper.set("module", "module");
+			wrapper.set("__filename", "filename");
+			functionScopes.set(wrapper, "wrapper");
+		}
+		walk(root, [wrapper]);
+	}
+	return result;
+};
+/** Validate the static local runtime closure against regular packed members. */
+const assertPackedRuntimeImports = async ({ members, readSource, assertRegular }) => {
+	const files = /* @__PURE__ */ new Map();
+	const read = async (file) => {
+		if (!members.has(file)) throw new Error(`Missing packed runtime file: ${file}`);
+		await assertRegular(file);
+		const cached = files.get(file);
+		if (cached !== void 0) return cached;
+		const source = await readSource(file);
+		files.set(file, source);
+		return source;
+	};
+	const manifest = async (file) => {
+		const value = JSON.parse(await read(file));
+		if (!record$1(value)) throw new Error(`Invalid packed manifest: ${file}`);
+		return value;
+	};
+	const scratch = await (0, node_fs_promises.realpath)(await (0, node_fs_promises.mkdtemp)(node_path.default.join((0, node_os.tmpdir)(), "packed-node-resolution-")));
+	const resolver = createPackedNodeResolver();
+	try {
+		for (const file of members) {
+			const directory = file.endsWith("/");
+			const member = directory ? file.slice(0, -1) : file;
+			if (packagePath(member) !== member) throw new Error(`Invalid packed member path: ${file}`);
+			const destination = node_path.default.join(scratch, member);
+			if (directory) {
+				await (0, node_fs_promises.mkdir)(destination, { recursive: true });
+				continue;
+			}
+			await (0, node_fs_promises.mkdir)(node_path.default.dirname(destination), { recursive: true });
+			await (0, node_fs_promises.writeFile)(destination, node_path.default.posix.basename(file) === "package.json" ? await read(file) : "");
+		}
+		const externalFiles = /* @__PURE__ */ new Set();
+		for (const file of members) {
+			if (node_path.default.posix.basename(file) !== "package.json") continue;
+			const owner = await manifest(file);
+			for (const target of targets(owner["imports"])) {
+				if (target.startsWith(".") || target.startsWith("#") || target.includes(":")) continue;
+				const parts = target.split("/");
+				const name = target.startsWith("@") ? parts.slice(0, 2).join("/") : parts.at(0);
+				if (name === void 0 || !/^(?:@[a-z0-9._~-]+\/)?[a-z0-9._~-]+$/iu.test(name) || name.split("/").some((part) => part === "." || part === "..")) throw new Error(`Unsupported external import mapping: ${target}`);
+				if (name === owner["name"]) continue;
+				const directory = node_path.default.join(scratch, "node_modules", name);
+				await (0, node_fs_promises.mkdir)(directory, { recursive: true });
+				await (0, node_fs_promises.writeFile)(node_path.default.join(directory, "package.json"), JSON.stringify({
+					name,
+					exports: {
+						".": "./external.cjs",
+						"./*": "./external.cjs"
+					}
+				}));
+				const entry = node_path.default.join(directory, "external.cjs");
+				await (0, node_fs_promises.writeFile)(entry, "");
+				externalFiles.add(entry);
+			}
+		}
+		const resolveImport = async ({ specifier, mode, importer }) => {
+			let resolved;
+			try {
+				resolved = await resolver.resolve({
+					specifier,
+					mode,
+					file: node_path.default.join(scratch, importer)
+				});
+			} catch (error) {
+				throw new Error(`Missing packed runtime import: ${importer} -> ${specifier}: ${String(error)}`, { cause: error });
+			}
+			if (resolved === null) return [];
+			const url = new URL(resolved);
+			if (url.protocol !== "file:") throw new Error(`Unsupported packed runtime URL: ${resolved}`);
+			const destination = (0, node_url.fileURLToPath)(url);
+			if (externalFiles.has(destination)) return [];
+			const file = packagePath(node_path.default.relative(scratch, destination).split(node_path.default.sep).join("/"));
+			if (!members.has(file)) throw new Error(`Missing packed runtime import: ${importer} -> ${specifier} (${file})`);
+			return [file];
+		};
+		for (const file of members) if (node_path.default.posix.basename(file) === "package.json") await manifest(file);
+		const root = await manifest("package/package.json");
+		const pending = [...members].filter((file) => javascript$1.test(file));
+		const scripts = new Set(pending);
+		const bin = root["bin"];
+		const bins = [];
+		if (typeof bin === "string") bins.push(bin);
+		else if (record$1(bin)) bins.push(...Object.values(bin));
+		else if (bin !== void 0) throw new Error("Invalid packed bin declaration");
+		for (const entry of bins) {
+			if (typeof entry !== "string" || entry === "" || node_path.default.posix.isAbsolute(entry) || entry.includes("\\")) throw new Error("Invalid packed bin entry");
+			const file = packagePath(node_path.default.posix.join("package", entry));
+			scripts.add(file);
+			pending.push(file);
+		}
+		const addEntry = (entry, mode) => {
+			if (declarationFile.test(entry)) return;
+			if (node_path.default.posix.isAbsolute(entry) || entry.includes("\\")) throw new Error(`Runtime entry escapes the packed package: ${entry}`);
+			if (mode === "url" && /%2f|%5c/iu.test(entry)) throw new Error(`Invalid packed entry URL: ${entry}`);
+			const file = packagePath(mode === "url" ? (0, node_url.fileURLToPath)(new URL(entry, "file:///package/package.json")).slice(1) : node_path.default.posix.join("package", entry));
+			if (!file.includes("*")) {
+				if (javascript$1.test(file) || node_path.default.posix.extname(file) === "") scripts.add(file);
+				pending.push(file);
+				return;
+			}
+			const [prefix, suffix] = file.split("*");
+			if (prefix === void 0 || suffix === void 0 || file.split("*").length !== 2) throw new Error(`Unsupported packed entry pattern: ${entry}`);
+			const matches = [...members].filter((candidate) => !candidate.endsWith("/") && candidate.length >= prefix.length + suffix.length && candidate.startsWith(prefix) && candidate.endsWith(suffix));
+			if (matches.length === 0) throw new Error(`Missing packed runtime entry pattern: ${entry}`);
+			for (const match of matches) if (javascript$1.test(match)) scripts.add(match);
+			pending.push(...matches);
+		};
+		for (const target of targets(root["module"])) addEntry(target, "file");
+		for (const target of targets(root["exports"])) addEntry(target, "url");
+		if (root["main"] !== void 0) {
+			const entry = root["main"];
+			if (typeof entry !== "string" || node_path.default.posix.isAbsolute(entry) || entry.includes("\\")) throw new Error("Invalid packed main entry");
+			if (!declarationFile.test(entry)) {
+				const resolved = (await resolveImport({
+					specifier: "./package",
+					mode: "require",
+					importer: "entry.cjs"
+				})).at(0);
+				if (resolved === void 0) throw new Error(`Missing packed runtime main: ${entry}`);
+				if (!opaque.test(resolved)) scripts.add(resolved);
+				pending.push(resolved);
+			}
+		}
+		const validated = /* @__PURE__ */ new Set();
+		const traversed = /* @__PURE__ */ new Set();
+		while (pending.length > 0) {
+			const file = pending.pop();
+			if (file === void 0) continue;
+			if (!validated.has(file)) {
+				if (!members.has(file)) throw new Error(`Missing packed runtime file: ${file}`);
+				await assertRegular(file);
+				validated.add(file);
+			}
+			if (!scripts.has(file) || traversed.has(file)) continue;
+			traversed.add(file);
+			const source = await read(file);
+			let mode;
+			if (/\.mjs$/iu.test(file)) mode = "module";
+			else if (/\.cjs$/iu.test(file)) mode = "script";
+			else mode = packageMode(files, file);
+			const parse = (sourceType) => {
+				try {
+					const tree = parseArtifactSource(source, {
+						ecmaVersion: "latest",
+						sourceType,
+						allowHashBang: true,
+						allowReturnOutsideFunction: sourceType === "script"
+					});
+					if (sourceType === "script") {
+						const statement = tree.body.at(0);
+						if (statement?.type === "ExpressionStatement" && statement.expression.type === "FunctionExpression") return {
+							tree: statement.expression.body,
+							mode: sourceType
+						};
+					}
+					return {
+						tree,
+						mode: sourceType
+					};
+				} catch (error) {
+					if (!(error instanceof SyntaxError)) throw error;
+					throw new SyntaxError(`Packed runtime import syntax ${file}: ${error.message}`, { cause: error });
+				}
+			};
+			let parsed;
+			if (mode === "detect") try {
+				parsed = parse("script");
+			} catch {
+				parsed = parse("module");
+			}
+			else parsed = parse(mode);
+			let dependencies;
+			try {
+				dependencies = staticImports(parsed.tree, parsed.mode);
+			} catch (error) {
+				throw new Error(`Packed runtime imports ${file}: ${String(error)}`, { cause: error });
+			}
+			for (const dependency of dependencies) {
+				const resolved = await resolveImport({
+					...dependency,
+					importer: file
+				});
+				for (const target of resolved) {
+					if (javascript$1.test(target) || node_path.default.posix.extname(target) === "" || dependency.mode === "require" && !opaque.test(target)) scripts.add(target);
+					pending.push(target);
+				}
+			}
+		}
+	} finally {
+		try {
+			await resolver.close();
+		} finally {
+			await (0, node_fs_promises.rm)(scratch, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+};
+//#endregion
+//#region src/publish-artifact-syntax.ts
+const command = (0, node_util.promisify)(node_child_process.execFile);
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const javascript = /\.(?:js|mjs|cjs)$/i;
+const syntaxYears = new Map(Object.entries({
+	es5: 5,
+	es2015: 2015,
+	es2016: 2016,
+	es2017: 2017,
+	es2018: 2018,
+	es2019: 2019,
+	es2020: 2020,
+	es2021: 2021,
+	es2022: 2022,
+	es2023: 2023,
+	es2024: 2024,
+	es2025: 2025
+}));
+/** Explicit ECMAScript targets bound syntax; unbounded targets use native Node. */
+const artifactEcmaVersion = ({ target, node }) => {
+	if (target.type === "types-only") return "latest";
+	if (target.targets.length === 0) throw new Error("Packed JavaScript requires a declared target");
+	let version = "latest";
+	for (const identifier of target.targets) {
+		if (identifier === "esnext") continue;
+		const year = syntaxYears.get(identifier);
+		if (year !== void 0) {
+			if (version === "latest" || year < version) version = year;
+			continue;
+		}
+		if (publishedNodeTargetSupportsConsumer({
+			target: identifier,
+			node
+		})) continue;
+		throw new Error(`Unsupported packed JavaScript syntax target ${identifier}; use an explicit ECMAScript year or a supported Node target`);
+	}
+	return version;
+};
+const packedBinFiles = (files) => {
+	const result = /* @__PURE__ */ new Set();
+	for (const [file, source] of files) {
+		if (node_path.default.posix.basename(file) !== "package.json") continue;
+		const manifest = JSON.parse(source);
+		if (!record(manifest)) throw new Error(`Invalid packed manifest: ${file}`);
+		const bin = manifest["bin"];
+		if (bin === void 0) continue;
+		let entries;
+		if (typeof bin === "string") entries = [bin];
+		else if (record(bin)) entries = Object.values(bin);
+		if (entries === void 0) throw new Error(`Unsupported packed bin declaration: ${file}`);
+		for (const entry of entries) {
+			if (typeof entry !== "string" || entry === "" || node_path.default.posix.isAbsolute(entry) || entry.includes("\\") || entry.split("/").includes("..")) throw new Error(`Unsafe packed bin declaration: ${file}`);
+			result.add(node_path.default.posix.join(node_path.default.posix.dirname(file), entry));
+		}
+	}
+	return result;
+};
+const syntaxFiles = (files) => {
+	const bins = packedBinFiles(files);
+	for (const file of bins) {
+		const source = files.get(file);
+		if (source === void 0) throw new Error(`Missing packed executable: ${file}`);
+		if (!javascript.test(file) && !/^#!(?:[^\n]*\/node|\/usr\/bin\/env(?: -S)? node)(?:[ \r\n]|$)/.test(source)) throw new Error(`Unsupported packed executable language: ${file}`);
+	}
+	return [...new Set([...files.keys()].filter((file) => javascript.test(file)).concat([...bins]))];
+};
+/** Enumerate all chunks and bins, including JavaScript outside declared exports. */
+const assertPackedArtifactSyntax = ({ files, target, node }) => {
+	const ecmaVersion = artifactEcmaVersion({
+		target,
+		node
+	});
+	const selected = syntaxFiles(files);
+	if (target.type === "types-only" && selected.length > 0) throw new Error(`Types-only artifact contains JavaScript: ${selected[0]}`);
+	for (const file of selected) {
+		const source = files.get(file);
+		if (source === void 0) throw new Error(`Missing packed JavaScript: ${file}`);
+		let mode = packageMode(files, file);
+		if (/\.mjs$/i.test(file)) mode = "module";
+		if (/\.cjs$/i.test(file)) mode = "script";
+		const parseMode = (sourceType) => {
+			const tree = parseArtifactSource(source, {
+				ecmaVersion,
+				sourceType,
+				allowHashBang: true,
+				allowReturnOutsideFunction: sourceType === "script"
+			});
+			if (ecmaVersion === 5 && tree.body.some((item) => /^(?:Import|Export)/.test(item.type))) throw new Error("Module declarations exceed ES5");
+		};
+		try {
+			if (mode === "detect") try {
+				parseMode("script");
+			} catch {
+				parseMode("module");
+			}
+			else parseMode(mode);
+		} catch (error) {
+			throw new Error(`Packed JavaScript ${file} exceeds its declared syntax target: ${String(error)}`);
+		}
+	}
+};
+const archiveMembers = (members) => {
+	const seen = /* @__PURE__ */ new Set();
+	for (const file of members) {
+		const parts = file.split("/");
+		if (!file.startsWith("package/") || file.includes("\\") || file.split("").some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) || parts.some((part) => part === ".." || part === ".") || parts.slice(0, -1).some((part) => part === "") || seen.has(file)) throw new Error(`Unsupported packed artifact member: ${file}`);
+		seen.add(file);
+	}
+	return members;
+};
+const checkPackedJavaScriptWithNode = async ({ files, target, node, executable }) => {
+	assertPackedArtifactSyntax({
+		files,
+		target,
+		node
+	});
+	archiveMembers([...files.keys()]);
+	const scratch = await (0, node_fs_promises.mkdtemp)(node_path.default.join((0, node_os.tmpdir)(), "stll-artifact-syntax-"));
+	try {
+		for (const [file, source] of files) {
+			const destination = node_path.default.join(scratch, file);
+			await (0, node_fs_promises.mkdir)(node_path.default.dirname(destination), { recursive: true });
+			await (0, node_fs_promises.writeFile)(destination, source);
+		}
+		for (const file of syntaxFiles(files)) try {
+			await command(executable, ["--check", node_path.default.join(scratch, file)], {
+				cwd: scratch,
+				env: {
+					PATH: "/usr/bin:/bin",
+					HOME: scratch
+				}
+			});
+		} catch (error) {
+			throw new Error(`Packed JavaScript ${file} is incompatible with consumer Node ${node}: ${String(error)}`);
+		}
+	} finally {
+		await (0, node_fs_promises.rm)(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+};
+/** Read bytes without extracting archive-controlled paths or links. */
+const readPackedSyntaxFiles = async (archive) => {
+	const { stdout: listing } = await command("tar", ["-tzf", archive], { maxBuffer: 16777216 });
+	const files = /* @__PURE__ */ new Map();
+	const members = new Set(archiveMembers(listing.split("\n").filter((entry) => entry !== "")));
+	const regularFiles = /* @__PURE__ */ new Set();
+	const assertRegular = async (file) => {
+		if (!members.has(file)) throw new Error(`Missing packed syntax input: ${file}`);
+		if (regularFiles.has(file)) return;
+		const { stdout: metadata } = await command("tar", [
+			"-tvzf",
+			archive,
+			file
+		]);
+		if (!metadata.startsWith("-") || metadata.trimEnd().split("\n").length !== 1) throw new Error(`Packed syntax input must be a regular file: ${file}`);
+		regularFiles.add(file);
+	};
+	const readSource = async (file) => {
+		const cached = files.get(file);
+		if (cached !== void 0) return cached;
+		await assertRegular(file);
+		const { stdout } = await command("tar", [
+			"-xOf",
+			archive,
+			file
+		], { maxBuffer: 16777216 });
+		files.set(file, stdout);
+		return stdout;
+	};
+	for (const file of members) if (javascript.test(file) || node_path.default.posix.basename(file) === "package.json") await readSource(file);
+	for (const file of packedBinFiles(files)) if (!files.has(file)) await readSource(file);
+	await assertPackedRuntimeImports({
+		members,
+		readSource,
+		assertRegular
+	});
+	return files;
+};
+//#endregion
+Object.defineProperty(exports, "checkPackedJavaScriptWithNode", {
+	enumerable: true,
+	get: function() {
+		return checkPackedJavaScriptWithNode;
+	}
+});
+Object.defineProperty(exports, "checkPublishContract", {
+	enumerable: true,
+	get: function() {
+		return checkPublishContract;
+	}
+});
+Object.defineProperty(exports, "consumerReleasePackArguments", {
+	enumerable: true,
+	get: function() {
+		return consumerReleasePackArguments;
+	}
+});
+Object.defineProperty(exports, "parsePublishContract", {
+	enumerable: true,
+	get: function() {
+		return parsePublishContract;
+	}
+});
+Object.defineProperty(exports, "readPackedSyntaxFiles", {
+	enumerable: true,
+	get: function() {
+		return readPackedSyntaxFiles;
+	}
+});
+Object.defineProperty(exports, "resolveConsumerReleasePack", {
+	enumerable: true,
+	get: function() {
+		return resolveConsumerReleasePack;
+	}
+});
+Object.defineProperty(exports, "resolveManifestContract", {
+	enumerable: true,
+	get: function() {
+		return resolveManifestContract;
+	}
+});
+
+//# sourceMappingURL=publish-artifact-syntax.cjs.map