@stll/oxlint-config 1.4.0 → 1.5.0

package/dist/toolchain-guard.mjs

@@ -1,19 +1,20 @@
+import { t as checkRepositoryQuarantine } from "./quarantine-policy2.mjs";
 import { E as parseCloudSetup, S as generateCloudSetup, T as nodeSupportRangeMatches, _ as cloudSessionStartFix, a as isMiseConfigPath, d as containerDocumentImages, f as isComposeDefinitionPath, g as cloudClaudeSettingsPath, h as cloudAttributionFix, i as isDockerDefinitionPath, m as workspaceContains, n as githubAutomationFileKind, p as isKubernetesDefinitionPath, s as isShellScript, u as toolchainInputKind, v as hasCloudAttribution, w as nodeSelectorMatches, x as cloudSetupPath, y as hasCloudSessionStartHook } from "./toolchain-inputs.mjs";
 import { t as readGitTrackedOutput } from "./git-tracked-output.mjs";
 import { a as assertConsumerFixtureSelection, g as parseConsumerFixtures, h as discoverConsumerPackages, m as discoverConsumerManifests, r as assertConsumerFixtureKind, t as assertConsumerNodeSupport, u as consumerPackageClosure } from "./consumer-node-support.mjs";
-import { a as rustImageVersion, i as canonicalDockerRuntime, n as dependabotRules, t as checkDependabot } from "./toolchain-dependabot.mjs";
+import { n as dependabotRules, o as canonicalDockerRuntime, s as rustImageVersion, t as checkDependabot } from "./toolchain-dependabot.mjs";
 import "./toolchain-schema.mjs";
 import { createRequire } from "node:module";
+import path, { extname } from "node:path";
 import { closeSync, lstatSync, openSync, readFileSync, readSync, realpathSync } from "node:fs";
+import { parse } from "smol-toml";
 import { execFileSync, spawnSync } from "node:child_process";
-import path, { extname } from "node:path";
 import { minVersion, satisfies, valid, validRange } from "semver";
-import { parse as parse$1 } from "smol-toml";
 import { LineCounter, isAlias, isMap, isNode, isScalar, isSeq, parseAllDocuments, parseDocument } from "yaml";
 import picomatch from "picomatch";
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "1.4.0";
+const consumerRunnerVersion = "1.5.0";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
 const record$10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {
@@ -2748,7 +2749,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	};
 	const toml = (rule) => {
 		try {
-			return parse$1(text);
+			return parse(text);
 		} catch {
 			add({
 				rule,
@@ -2830,7 +2831,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			if (candidate === file) return parsed;
 			if (!trackedFiles.has(candidate)) return void 0;
 			try {
-				return parse$1(readFile(candidate) ?? "");
+				return parse(readFile(candidate) ?? "");
 			} catch {
 				return;
 			}
@@ -3883,7 +3884,8 @@ const toolchainRules = [.../* @__PURE__ */ new Set([
 	...runtimeRules,
 	...dependabotRules,
 	nodeProjectRule,
-	"cloud-setup-drift"
+	"cloud-setup-drift",
+	"quarantine-policy"
 ])];
 const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const array = (value) => Array.isArray(value);
@@ -3895,6 +3897,7 @@ const parseToolchainConfiguration = (input) => {
 	if (!array(optOuts)) throw new Error("optOuts must be an array");
 	for (const entry of optOuts) {
 		if (!record(entry) || Object.keys(entry).some((key) => key !== "rule" && key !== "reason") || typeof entry["rule"] !== "string" || !toolchainRules.some((rule) => rule === entry["rule"]) || typeof entry["reason"] !== "string" || entry["reason"].trim() === "" || disabled.has(entry["rule"])) throw new Error("each opt-out requires a unique known rule and a nonempty reason");
+		if (entry["rule"] === "quarantine-policy") throw new Error("quarantine-policy cannot be opted out; temporary third-party exclusions require expiry");
 		if (entry["rule"] === "rust-version") throw new Error("rust-version requires expiring exact-pin rustExceptions, not an opt-out");
 		if (entry["rule"] === "node-engine") throw new Error("node-engine cannot be opted out; engines.node must support the shared Node series");
 		if (entry["rule"] === "workflow-trust") throw new Error("workflow-trust cannot be opted out; repository commands must follow the declared trust decision");
@@ -3911,8 +3914,8 @@ const parseToolchainConfiguration = (input) => {
 		consumerChecks: parseConsumerChecks(input["consumerChecks"])
 	};
 };
-/** Read one tracked configuration snapshot for guards and policy generation. */
-const readToolchainInputs = (root) => {
+/** Dependency graphs stay opaque unless a caller explicitly needs registry identities. */
+const readToolchainInputs = (root, { bunLock = "presence" } = {}) => {
 	const diagnostics = [];
 	const tracked = readGitTrackedOutput(root, "staged").split("\0").filter((entry) => entry !== "" && !entry.startsWith("160000 ")).map((entry) => entry.slice(entry.indexOf("	") + 1));
 	const files = {};
@@ -3924,7 +3927,7 @@ const readToolchainInputs = (root) => {
 		if (kind === void 0 && !shebangCandidate) continue;
 		try {
 			const inputPath = path.join(resolvedRoot, file);
-			if (kind === "presence") {
+			if (kind === "presence" && !(file === "bun.lock" && bunLock === "content")) {
 				lstatSync(inputPath);
 				files[file] = "";
 				continue;
@@ -3966,8 +3969,8 @@ const readToolchainInputs = (root) => {
 		diagnostics
 	};
 };
-const checkToolchain = ({ root, policy, onDelegated }) => {
-	const { files, trackedFiles, diagnostics } = readToolchainInputs(root);
+const checkToolchain = ({ root, policy, onDelegated, onWarning, now }) => {
+	const { files, trackedFiles, diagnostics } = readToolchainInputs(root, { bunLock: "content" });
 	let repository;
 	try {
 		const origin = execFileSync("git", [
@@ -4057,6 +4060,42 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 		files,
 		policy
 	}));
+	if (Object.entries(files).some(([file, text]) => {
+		if (path.posix.basename(file) === "bun.lock") return true;
+		if (path.posix.basename(file) !== "package.json") return false;
+		try {
+			const manifest = JSON.parse(text);
+			return record(manifest) && typeof manifest["packageManager"] === "string" && /^bun(?:@|$)/u.test(manifest["packageManager"]);
+		} catch {
+			return false;
+		}
+	}) || files["bunfig.toml"] !== void 0) try {
+		if (files["bunfig.toml"] === void 0) throw new Error("Bun repositories require a tracked root bunfig.toml with the five-day quarantine policy; use the documented pinned bunx stll-quarantine --sync bootstrap, then commit bunfig.toml");
+		const result = checkRepositoryQuarantine({
+			files,
+			now,
+			npmrcPresent: trackedFiles.has(".npmrc")
+		});
+		for (const message of result.errors) diagnostics.push({
+			rule: "quarantine-policy",
+			path: "bunfig.toml",
+			line: 1,
+			message
+		});
+		for (const message of result.warnings) onWarning?.({
+			rule: "quarantine-policy",
+			path: "bunfig.toml",
+			line: 1,
+			message
+		});
+	} catch (error) {
+		diagnostics.push({
+			rule: "quarantine-policy",
+			path: "bunfig.toml",
+			line: 1,
+			message: error instanceof Error ? error.message : String(error)
+		});
+	}
 	if (files["package.json"] !== void 0) {
 		let manifest;
 		try {