@stll/oxlint-config 1.9.0 → 2.1.0

package/README.md

@@ -236,11 +236,41 @@ The CLI checks tracked files, prints `path:line: [rule] message` diagnostics,
 and exits with status 1 on a mismatch. Updating the package updates the
 policy; update consumer pins and run the checker together.
 
-`typescriptInstallLayouts` declares the compiler package, exact specifier,
-and typecheck command for each supported layout. Prefer the direct layout.
-Use the split compatibility layout for the compiler-API consumers and peer
-blockers listed in `typescript6Compatibility`; it retains the current
-compiler for typechecking while providing the compatibility package.
+The `typescript-layout` rule keeps TypeScript out of manifests: type checking
+runs `bun check`, programs and checkers use tsrs, and syntax reads use
+oxc-parser. No manifest, catalog, override or resolution declares `typescript`,
+`@typescript/native` or an `npm:typescript@…` alias unless the repository
+allows it. A `typecheck` script that runs a compiler must run `bun check`.
+
+Each repository lists the TypeScript installs its own tools need in
+`typescriptAllowlist` in tracked root `stll-toolchain.json`; there is no shared
+list. An entry names the workspace directory (`.` for the root), the declared
+name, the exact spec the manifest resolves to, the dependency in that same
+workspace that needs it, and a reason:
+
+```json
+{
+  "typescriptAllowlist": [
+    {
+      "workspace": "apps/docs",
+      "name": "typescript",
+      "spec": "6.0.3",
+      "dependency": "@astrojs/check",
+      "reason": "astro check loads the TypeScript 6 language service."
+    }
+  ]
+}
+```
+
+The workspace's `dependencies`, `devDependencies` or `optionalDependencies`
+may declare the entry directly or through a catalog (`catalog:`,
+`catalog:ts6`); it must resolve to `spec`. A catalog holds a TypeScript entry
+only at the spec of an allowed install that references it. An undeclared
+install fails with the entry to add; an entry fails when its spec differs,
+when the workspace no longer declares the name, or when it no longer depends on
+`dependency`. Overrides and resolutions never declare TypeScript. To keep
+Dependabot from moving an allowed alias, declare it in `dependabotIgnores`;
+`typescript` and `@typescript/native` are already shared ignores.
 
 An exception requires a tracked root `stll-toolchain.json` with the named
 rule and a nonempty reason:
@@ -251,13 +281,8 @@ rule and a nonempty reason:
 }
 ```
 
-Workspace TypeScript toolchains combine the root and declared members' devDependencies.
-An included member may declare the exact TypeScript 6 compatibility API across
-dependencies, devDependencies, and peerDependencies when that shared install uses
-the complete split layout. Ambiguous or partial layouts do not grant this allowance.
-Peer ranges declare support: they must include the policy compiler release and the
-compatibility release when the selected layout uses it. Ranges do not contribute
-to the installed compiler inventory.
+Peer ranges, exact versions included, declare support: a `typescript` range
+must include the policy release. Ranges do not count as installs.
 
 JavaScript update roots include the repository root, declared workspace membership,
 and directories with their own `bun.lock`, `package-lock.json`, `yarn.lock`, or
@@ -276,23 +301,6 @@ rules, empty reasons, and malformed configuration fail validation. See the
 for the schema, rule list, runtime support ranges, and generated Dependabot
 template.
 
-## Typecheck parity project selection
-
-Run `stll-typecheck-parity` from the repository root. Without flags, it checks
-the root `tsconfig.json` and recursively discovers project references in build
-mode. Repeat `--project` to check exactly the selected configs:
-
-```sh
-stll-typecheck-parity --project packages/api/tsconfig.json --project packages/web/tsconfig.json
-```
-
-Selected configs run independently using the repository-root compiler
-installation; child packages need no compiler declaration and a root tsconfig
-is unnecessary. Their original reference metadata is preserved without
-discovering or building referenced projects. Missing, unreadable, and zero-input
-selected configs fail the check. `--help` prints usage and exits successfully;
-unknown arguments fail.
-
 ## Generate dependency update configuration
 
 Run `bunx --no-install stll-dependabot` from the repository root. It reads tracked
@@ -396,6 +404,7 @@ Add an explicit declaration to tracked root `stll-toolchain.json`:
   "cloud": {
     "services": ["postgres", "valkey"],
     "install": "bun install --frozen-lockfile",
+    "submodules": true,
     "envFile": ".env.cloud",
     "rust": {
       "components": ["clippy", "rustfmt"],
@@ -417,7 +426,13 @@ only. No `cloud` declaration means no cloud setup script. `envFile` is required
 with services and rejected without services; runtime-only scripts emit no
 environment file code. With services, `envFile` must be a canonical
 repository-relative path; its existing parent must be safe at runtime. Track an exact stable Node patch in root
-`.node-version` within the shared Node series. Generate and commit the script:
+`.node-version` within the shared Node series.
+
+Set `cloud.submodules` to `true` when workspace inputs are held in Git
+submodules. The networked install phase synchronizes and shallow-initializes
+submodules recursively before dependency installation; startup remains offline.
+
+Generate and commit the script:
 
 ```sh
 bunx --no-install stll-cloud-setup
@@ -477,6 +492,13 @@ it gets no network allowance. Generation fails when the script is not in the
 root `package.json`.
 
 Generation uses the installed policy's Bun, Node, PostgreSQL, and Valkey pins.
+Node and Bun archives are verified against SHA256 values recorded at generation
+time, in addition to the upstream checksum manifests. The shared policy records
+them for its own Node patch and Bun release. A repository that tracks another
+accepted Node patch or a newer Bun records that one release's amd64 and arm64
+values from the official `SHASUMS256.txt` in `cloud.runtimeArchiveSha256`, for
+example `{ "node": { "26.11.0": { "amd64": "…", "arm64": "…" } } }`; a release
+the shared policy pins must not be repeated there.
 PostgreSQL uses the PGDG major-version packages; minor updates within the pinned
 major are accepted for the disposable database. Before adding PGDG, provisioning
 reuses an existing source only after verifying its signing-key fingerprint;
@@ -954,25 +976,25 @@ aliases), oxlint, oxlint-tsgolint, and shared tooling pins. Lockfile
 resolutions determine installed package versions; manifest ranges alone do not.
 Resolution locations and importer bindings are retained: swapping compiler
 versions between workspaces cannot look unchanged. Compiler specifier changes
-run parity even when the resolved release version is unchanged. Unknown lock
-shapes and ambiguous resolutions report an unreadable snapshot. Supported text
-locks include Bun JSONC (schema 0/1), pnpm YAML (5.4/6/9), npm package-lock/
+report `typescript` even when the resolved release version is unchanged. Unknown
+lock shapes and ambiguous resolutions report an unreadable snapshot. Supported
+text locks include Bun JSONC (schema 0/1), pnpm YAML (5.4/6/9), npm package-lock/
 shrinkwrap (1/2/3), and bounded Yarn Classic/Berry shapes; a binary-only Bun lock
 cannot be compared without executing Bun.
 Workflow/action and Docker definition edits conservatively force full CI.
-Unrelated application dependency changes do not force compiler parity.
+Unrelated application dependency changes do not report a compiler change.
 Setup-action runtime selectors and their tracked version-file contents must
 identify an exact stable release. Floating selectors,
 ranges, expressions, empty
-values, or omitted runtime versions report an unreadable snapshot and run parity
-even when their committed text is unchanged.
+values, or omitted runtime versions report an unreadable snapshot even when
+their committed text is unchanged.
 
-On pull requests, run the repository's ordinary Bun typecheck and the probe,
-then select parity using the same detector:
+On pull requests, run the repository's ordinary Bun typecheck and the probe. The
+shared `rust-napi-ci.yml` workflow runs both when called with `typecheck: true`;
+elsewhere, run:
 
 ```sh
 stll-typecheck-probe --project packages/api/tsconfig.json --seed-dir packages/api/src -- bun run typecheck
-stll-typecheck-parity --changed-since origin/main --project packages/api/tsconfig.json
 ```
 
 The probe writes an exclusive temporary TypeScript file in the declared
@@ -983,35 +1005,31 @@ excluded seeds fail instead of producing a vacuous pass. Commands are argv,
 not shell expressions. Cleanup also runs on failure and handled termination.
 Repeat the probe for independently checked projects as needed.
 
-Conditional parity runs when Bun, TypeScript, or shared declarations change;
-otherwise it prints `parity skipped: toolchain unchanged since ...`. An unreadable
-reference runs full parity. Nightly jobs omit `--changed-since` to run full parity.
-Node and lint-tool changes still force full CI through the shared detector.
-
 Workflow, composite-action, Docker, mise, and tool-version declarations are
-conservatively fingerprinted for compiler parity, including referenced tracked
+conservatively fingerprinted as `shared` changes, including referenced tracked
 setup-action version files (Node, Bun, Python, Go, Java and other runtimes).
 Rust toolchain-file selectors and conventional runtime files are included;
 cache-dependency-path is not a runtime selector. Compose and Kubernetes image
-definitions are conservatively fingerprinted alongside Dockerfiles. Catalog and unresolved declaration changes also force parity;
-an unclassifiable reference runs full parity. This may run parity for unrelated
-edits to these declaration files. Active installed compiler comparisons still
-use the owning lockfile resolutions.
+definitions are conservatively fingerprinted alongside Dockerfiles. Catalog and
+unresolved declaration changes also report a change; an unclassifiable reference
+reports an unreadable snapshot. This may report a change for unrelated edits to
+these declaration files. Installed compiler comparisons use the owning lockfile
+resolutions.
 
 Compiler patch declarations, lockfile patch hashes, and their tracked patch files
 are included even when the compiler version is unchanged. Compiler patch-package
 files are included too. Missing referenced compiler patches fail closed; unrelated
-package patches do not trigger compiler parity.
+package patches do not report a compiler change.
 
 Compiler manifest specifiers and complete compiler lock entries form part of the
 change identity, including resolved URLs, integrity, commits, checksums and patch
-hashes. Changing a source at the same release version runs parity. Local compiler
-sources without an immutable byte identity fail closed; a version alone does not
-identify a local directory. Git compiler sources require a full commit identity.
-Supported text locks include Bun, npm, pnpm and bounded
-Yarn Classic/Berry shapes; unrecognized lock shapes run parity. Yarn compiler
-`patch:` protocols are unsupported and run parity because their patch bytes are
-not represented by the lock checksum alone.
+hashes. Changing a source at the same release version reports `typescript`. Local
+compiler sources without an immutable byte identity fail closed; a version alone
+does not identify a local directory. Git compiler sources require a full commit
+identity. Supported text locks include Bun, npm, pnpm and bounded
+Yarn Classic/Berry shapes; unrecognized lock shapes report an unreadable snapshot.
+Yarn compiler `patch:` protocols are unsupported and report an unreadable
+snapshot because their patch bytes are not represented by the lock checksum alone.
 
 ## Rust selectors
 
@@ -1023,8 +1041,10 @@ Cargo manifest `rust-version` remains an MSRV floor at or below the shared pin.
 
 Only `rustExceptions` in the consumer's root `stll-toolchain.json` can authorize
 another exact stable release. Each record contains exactly `pin`, `reason`,
-`tracking` (a GitHub issue URL) and `expires` (a future `YYYY-MM-DD` date).
-Channels, expired records and `rust-version` rule opt-outs fail validation.
+`tracking` (a GitHub issue URL) and `expires` (a `YYYY-MM-DD` date).
+Channels and `rust-version` rule opt-outs fail validation. A record expires on
+its date and then follows the same expiry scope as quarantine excludes (see
+[Quarantine preset and expiry checks](#quarantine-preset-and-expiry-checks)).
 See the [root policy guide](../../README.md) for a complete declaration.
 
 `stll-toolchain-check` requires tracked JavaScript and TypeScript files selected by type-aware lint to belong to declared TypeScript projects. See the [Node scripts project recipe](https://github.com/stella/tooling/blob/main/README.md) for scripts outside the library project. The check inventories Oxlint-selected files and expands compiler configurations; it does not run lint or type checking.
@@ -1048,16 +1068,33 @@ creation timestamps remain stable across runs; they are not expiries.
 
 Third-party entries require `# quarantine-expires: YYYY-MM-DDTHH:mm:ss.sssZ`.
 `stll-toolchain-check` warns 48 hours before expiry; warnings continue through
-the existing 24-hour removal grace, after which expired entries fail. The
-quarantine rule cannot be opted out. `stll-quarantine --check` is read-only;
+the existing 24-hour removal grace, after which expired entries fail where the
+run can act on them. The same scope applies to expired `rustExceptions`. The
+clock alone never fails a change that leaves an entry untouched:
+
+- `push`, `schedule`, `workflow_dispatch` and other GitHub Actions events, and
+  non-GitHub CI (`CI` set), fail every overdue entry, which prompts the removal
+  PR.
+- `pull_request`, `pull_request_target` and `merge_group` fail an overdue entry
+  only when the change adds it or edits its expiry, compared with the event's
+  base commit; inherited overdue entries warn. A shallow checkout that lacks the
+  base fetches exactly that commit from its remote
+  (`git fetch --no-tags --depth=1 origin <base>`, using the checkout's
+  credentials). Only if that also fails does an overdue entry fail, with the
+  reason. Entries that have not expired never need the base.
+- Local runs outside CI warn.
+
+The quarantine rule cannot be opted out. `stll-quarantine --check` is read-only;
 `--prune` removes expired third-party entries without removing first-party ones.
 `--help` lists modes. Linked output files are rejected.
 
 `@stll/oxlint-config/quarantine` exports the Node-compatible repository helpers
 `checkRepositoryQuarantine`, `synchronizeRepositoryQuarantine`, and
 `pruneRepositoryQuarantine`, accepting a tracked `files` snapshot and optional
-`now`. The toolchain API reports advisory expiry messages through `onWarning`;
-its returned diagnostics remain failures. Snapshot readers keep lockfiles
+`now`, plus an optional `expiry` scope (`{ kind: "enforce" }` by default). The
+toolchain API takes the same scope as `expiryScope`, reports advisory
+expiry messages through `onWarning`, and its returned diagnostics remain
+failures. Snapshot readers keep lockfiles
 opaque by default; `{ bunLock: "content" }` explicitly requests the root graph
 when quarantine identity checks need it.
 
@@ -1099,3 +1136,13 @@ closed and writes nothing unless both inputs normalize successfully.
 Use `stll-normalize-wasi-loaders --check <loader-1> <loader-2>` in CI. Check mode
 does not write files and exits non-zero if either loader differs from the normalized
 output.
+
+## Rust policy generation
+
+Run `bunx --no-install stll-rust-policy` at the repository root with
+`stll-rust-policy.json` containing `{ "kind": "single-crate" }`. Use
+`--check` in CI to report drift without writes and `--config <path>` to select
+another input. The published CLI embeds the canonical `rust/` templates and
+merges policy into Cargo, Cargo aliases, rustfmt, and Clippy configuration.
+Unrelated TOML values survive; comments and layout are canonicalized.
+See [Rust adoption](../../rust/README.md) for workspace members and exceptions.

package/dist/cloud-setup-cli.cjs

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_file = require("./generated-file.cjs");
 const require_toolchain_inputs = require("./toolchain-inputs.cjs");
-const require_toolchain_bun = require("./toolchain-bun.cjs");
 const require_toolchain_guard = require("./toolchain-guard.cjs");
 const require_toolchain_schema = require("./toolchain-schema.cjs");
 let node_fs_promises = require("node:fs/promises");
@@ -60,7 +59,7 @@ const main = async () => {
 	const sharedPolicy = require_toolchain_schema.parseToolchainPolicy(JSON.parse(await (0, node_fs_promises.readFile)(new URL("../toolchain.json", require("url").pathToFileURL(__filename).href), "utf8")));
 	const policy = {
 		...sharedPolicy,
-		bun: require_toolchain_bun.repositoryBun(sharedPolicy.bun, files["package.json"])
+		bun: require_toolchain_guard.repositoryBun(sharedPolicy.bun, files["package.json"])
 	};
 	const script = require_toolchain_inputs.generateCloudSetup({
 		policy,

package/dist/cloud-setup-cli.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-setup-cli.cjs","names":["checkGeneratedOutput","open","constants","cloudClaudeSettingsPath","cloudSessionStartFix","realpath","readToolchainInputs","join","cloudSetupPath","generationDiagnostics","parseToolchainConfiguration","parseToolchainPolicy","readFile","repositoryBun","generateCloudSetup","mergeCloudClaudeSettings","writeGeneratedFile"],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { open, readFile, realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  cloudClaudeSettingsPath,\n  cloudSessionStartFix,\n  mergeCloudClaudeSettings,\n} from \"./cloud-setup-claude\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport { repositoryBun } from \"./toolchain-bun\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst readClaudeSettings = async (destination: string) => {\n  try {\n    if ((await checkGeneratedOutput(destination)) === undefined)\n      return undefined;\n    const input = await open(\n      destination,\n      constants.O_RDONLY | constants.O_NOFOLLOW,\n    );\n    try {\n      const opened = await input.stat();\n      if (!opened.isFile() || opened.nlink !== 1)\n        throw new Error(\n          \"settings must be a single-link regular repository file\",\n        );\n      return { text: await input.readFile(\"utf8\"), mode: opened.mode & 0o777 };\n    } finally {\n      await input.close();\n    }\n  } catch (error) {\n    throw new Error(\n      `cannot safely merge ${cloudClaudeSettingsPath}: ${error instanceof Error ? error.message : String(error)}; ${cloudSessionStartFix}`,\n    );\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  const destination = join(root, cloudSetupPath);\n  const settingsDestination = join(root, cloudClaudeSettingsPath);\n  // Validate settings separately to retain actionable merge diagnostics.\n  const settings = await readClaudeSettings(settingsDestination);\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [\n      { relative: cloudSetupPath, destination },\n      { relative: cloudClaudeSettingsPath, destination: settingsDestination },\n    ],\n  });\n  if (remainingDiagnostics.length > 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(\n          ({ path, message }) =>\n            `${path}: ${message}${path === cloudClaudeSettingsPath ? `; ${cloudSessionStartFix}` : \"\"}`,\n        )\n        .join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud, rustExceptions } = parseToolchainConfiguration(\n    JSON.parse(text),\n  );\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const sharedPolicy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const policy = {\n    ...sharedPolicy,\n    bun: repositoryBun(sharedPolicy.bun, files[\"package.json\"]),\n  };\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n    files,\n    rustExceptions,\n  });\n  const mergedSettings = mergeCloudClaudeSettings(settings?.text);\n  await writeGeneratedFile({ destination, text: script, mode: 0o755 });\n  if (mergedSettings !== settings?.text)\n    await writeGeneratedFile({\n      destination: settingsDestination,\n      text: mergedSettings,\n      mode: settings?.mode ?? 0o644,\n    });\n  process.stdout.write(\n    `Generated ${cloudSetupPath} and ${cloudClaudeSettingsPath}\\n`,\n  );\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;;AAuBA,MAAM,QACJ;AACF,MAAM,qBAAqB,OAAO,gBAAwB;CACxD,IAAI;EACF,IAAK,MAAMA,uBAAAA,qBAAqB,WAAW,MAAO,KAAA,GAChD,OAAO,KAAA;EACT,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,KAAAA,CAClB,aACAC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UACjC;EACA,IAAI;GACF,MAAM,SAAS,MAAM,MAAM,KAAK;GAChC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,wDACF;GACF,OAAO;IAAE,MAAM,MAAM,MAAM,SAAS,MAAM;IAAG,MAAM,OAAO,OAAO;GAAM;EACzE,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF,SAAS,OAAO;EACd,MAAM,IAAI,MACR,uBAAuBC,yBAAAA,wBAAwB,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,IAAIC,yBAAAA,sBAChH;CACF;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgBC,wBAAAA,oBAAoB,IAAI;CACvD,MAAM,eAAA,GAAcC,UAAAA,KAAAA,CAAK,MAAMC,yBAAAA,cAAc;CAC7C,MAAM,uBAAA,GAAsBD,UAAAA,KAAAA,CAAK,MAAMJ,yBAAAA,uBAAuB;CAE9D,MAAM,WAAW,MAAM,mBAAmB,mBAAmB;CAC7D,MAAM,uBAAuB,MAAMM,uBAAAA,sBAAsB;EACvD;EACA,SAAS,CACP;GAAE,UAAUD,yBAAAA;GAAgB;EAAY,GACxC;GAAE,UAAUL,yBAAAA;GAAyB,aAAa;EAAoB,CACxE;CACF,CAAC;CACD,IAAI,qBAAqB,SAAS,GAChC,MAAM,IAAI,MACR,qBACG,KACE,EAAE,MAAM,cACP,GAAG,KAAK,IAAI,UAAU,SAAA,0BAAmC,KAAKC,yBAAAA,yBAAyB,IAC3F,CAAC,CACA,KAAK,IAAI,CACd;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,OAAO,mBAAmBM,wBAAAA,4BAChC,KAAK,MAAM,IAAI,CACjB;CACA,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CACvD,MAAM,eAAeC,yBAAAA,qBACnB,KAAK,MACH,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CACF;CACA,MAAM,SAAS;EACb,GAAG;EACH,KAAKC,sBAAAA,cAAc,aAAa,KAAK,MAAM,eAAe;CAC5D;CACA,MAAM,SAASC,yBAAAA,mBAAmB;EAChC;EACA;EACA,aAAa,YAAY,KAAK;EAC9B;EACA;CACF,CAAC;CACD,MAAM,iBAAiBC,yBAAAA,yBAAyB,UAAU,IAAI;CAC9D,MAAMC,uBAAAA,mBAAmB;EAAE;EAAa,MAAM;EAAQ,MAAM;CAAM,CAAC;CACnE,IAAI,mBAAmB,UAAU,MAC/B,MAAMA,uBAAAA,mBAAmB;EACvB,aAAa;EACb,MAAM;EACN,MAAM,UAAU,QAAQ;CAC1B,CAAC;CACH,QAAQ,OAAO,MACb,aAAaR,yBAAAA,eAAe,OAAOL,yBAAAA,wBAAwB,GAC7D;AACF;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"cloud-setup-cli.cjs","names":["checkGeneratedOutput","open","constants","cloudClaudeSettingsPath","cloudSessionStartFix","realpath","readToolchainInputs","join","cloudSetupPath","generationDiagnostics","parseToolchainConfiguration","parseToolchainPolicy","readFile","repositoryBun","generateCloudSetup","mergeCloudClaudeSettings","writeGeneratedFile"],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { open, readFile, realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  cloudClaudeSettingsPath,\n  cloudSessionStartFix,\n  mergeCloudClaudeSettings,\n} from \"./cloud-setup-claude\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport { repositoryBun } from \"./toolchain-bun\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst readClaudeSettings = async (destination: string) => {\n  try {\n    if ((await checkGeneratedOutput(destination)) === undefined)\n      return undefined;\n    const input = await open(\n      destination,\n      constants.O_RDONLY | constants.O_NOFOLLOW,\n    );\n    try {\n      const opened = await input.stat();\n      if (!opened.isFile() || opened.nlink !== 1)\n        throw new Error(\n          \"settings must be a single-link regular repository file\",\n        );\n      return { text: await input.readFile(\"utf8\"), mode: opened.mode & 0o777 };\n    } finally {\n      await input.close();\n    }\n  } catch (error) {\n    throw new Error(\n      `cannot safely merge ${cloudClaudeSettingsPath}: ${error instanceof Error ? error.message : String(error)}; ${cloudSessionStartFix}`,\n    );\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  const destination = join(root, cloudSetupPath);\n  const settingsDestination = join(root, cloudClaudeSettingsPath);\n  // Validate settings separately to retain actionable merge diagnostics.\n  const settings = await readClaudeSettings(settingsDestination);\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [\n      { relative: cloudSetupPath, destination },\n      { relative: cloudClaudeSettingsPath, destination: settingsDestination },\n    ],\n  });\n  if (remainingDiagnostics.length > 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(\n          ({ path, message }) =>\n            `${path}: ${message}${path === cloudClaudeSettingsPath ? `; ${cloudSessionStartFix}` : \"\"}`,\n        )\n        .join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud, rustExceptions } = parseToolchainConfiguration(\n    JSON.parse(text),\n  );\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const sharedPolicy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const policy = {\n    ...sharedPolicy,\n    bun: repositoryBun(sharedPolicy.bun, files[\"package.json\"]),\n  };\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n    files,\n    rustExceptions,\n  });\n  const mergedSettings = mergeCloudClaudeSettings(settings?.text);\n  await writeGeneratedFile({ destination, text: script, mode: 0o755 });\n  if (mergedSettings !== settings?.text)\n    await writeGeneratedFile({\n      destination: settingsDestination,\n      text: mergedSettings,\n      mode: settings?.mode ?? 0o644,\n    });\n  process.stdout.write(\n    `Generated ${cloudSetupPath} and ${cloudClaudeSettingsPath}\\n`,\n  );\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;AAuBA,MAAM,QACJ;AACF,MAAM,qBAAqB,OAAO,gBAAwB;CACxD,IAAI;EACF,IAAK,MAAMA,uBAAAA,qBAAqB,WAAW,MAAO,KAAA,GAChD,OAAO,KAAA;EACT,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,KAAAA,CAClB,aACAC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UACjC;EACA,IAAI;GACF,MAAM,SAAS,MAAM,MAAM,KAAK;GAChC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,wDACF;GACF,OAAO;IAAE,MAAM,MAAM,MAAM,SAAS,MAAM;IAAG,MAAM,OAAO,OAAO;GAAM;EACzE,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF,SAAS,OAAO;EACd,MAAM,IAAI,MACR,uBAAuBC,yBAAAA,wBAAwB,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,IAAIC,yBAAAA,sBAChH;CACF;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgBC,wBAAAA,oBAAoB,IAAI;CACvD,MAAM,eAAA,GAAcC,UAAAA,KAAAA,CAAK,MAAMC,yBAAAA,cAAc;CAC7C,MAAM,uBAAA,GAAsBD,UAAAA,KAAAA,CAAK,MAAMJ,yBAAAA,uBAAuB;CAE9D,MAAM,WAAW,MAAM,mBAAmB,mBAAmB;CAC7D,MAAM,uBAAuB,MAAMM,uBAAAA,sBAAsB;EACvD;EACA,SAAS,CACP;GAAE,UAAUD,yBAAAA;GAAgB;EAAY,GACxC;GAAE,UAAUL,yBAAAA;GAAyB,aAAa;EAAoB,CACxE;CACF,CAAC;CACD,IAAI,qBAAqB,SAAS,GAChC,MAAM,IAAI,MACR,qBACG,KACE,EAAE,MAAM,cACP,GAAG,KAAK,IAAI,UAAU,SAAA,0BAAmC,KAAKC,yBAAAA,yBAAyB,IAC3F,CAAC,CACA,KAAK,IAAI,CACd;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,OAAO,mBAAmBM,wBAAAA,4BAChC,KAAK,MAAM,IAAI,CACjB;CACA,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CACvD,MAAM,eAAeC,yBAAAA,qBACnB,KAAK,MACH,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CACF;CACA,MAAM,SAAS;EACb,GAAG;EACH,KAAKC,wBAAAA,cAAc,aAAa,KAAK,MAAM,eAAe;CAC5D;CACA,MAAM,SAASC,yBAAAA,mBAAmB;EAChC;EACA;EACA,aAAa,YAAY,KAAK;EAC9B;EACA;CACF,CAAC;CACD,MAAM,iBAAiBC,yBAAAA,yBAAyB,UAAU,IAAI;CAC9D,MAAMC,uBAAAA,mBAAmB;EAAE;EAAa,MAAM;EAAQ,MAAM;CAAM,CAAC;CACnE,IAAI,mBAAmB,UAAU,MAC/B,MAAMA,uBAAAA,mBAAmB;EACvB,aAAa;EACb,MAAM;EACN,MAAM,UAAU,QAAQ;CAC1B,CAAC;CACH,QAAQ,OAAO,MACb,aAAaR,yBAAAA,eAAe,OAAOL,yBAAAA,wBAAwB,GAC7D;AACF;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/cloud-setup-cli.mjs

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { n as generationDiagnostics, r as writeGeneratedFile, t as checkGeneratedOutput } from "./generated-file.mjs";
 import { C as cloudSetupPath, S as mergeCloudClaudeSettings, v as cloudClaudeSettingsPath, w as generateCloudSetup, y as cloudSessionStartFix } from "./toolchain-inputs.mjs";
-import { t as repositoryBun } from "./toolchain-bun.mjs";
-import { n as parseToolchainConfiguration, r as readToolchainInputs } from "./toolchain-guard.mjs";
+import { i as repositoryBun, n as parseToolchainConfiguration, r as readToolchainInputs } from "./toolchain-guard.mjs";
 import { t as parseToolchainPolicy } from "./toolchain-schema.mjs";
 import { open, readFile, realpath } from "node:fs/promises";
 import { join } from "node:path";

package/dist/cloud-setup-cli.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-setup-cli.mjs","names":[],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { open, readFile, realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  cloudClaudeSettingsPath,\n  cloudSessionStartFix,\n  mergeCloudClaudeSettings,\n} from \"./cloud-setup-claude\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport { repositoryBun } from \"./toolchain-bun\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst readClaudeSettings = async (destination: string) => {\n  try {\n    if ((await checkGeneratedOutput(destination)) === undefined)\n      return undefined;\n    const input = await open(\n      destination,\n      constants.O_RDONLY | constants.O_NOFOLLOW,\n    );\n    try {\n      const opened = await input.stat();\n      if (!opened.isFile() || opened.nlink !== 1)\n        throw new Error(\n          \"settings must be a single-link regular repository file\",\n        );\n      return { text: await input.readFile(\"utf8\"), mode: opened.mode & 0o777 };\n    } finally {\n      await input.close();\n    }\n  } catch (error) {\n    throw new Error(\n      `cannot safely merge ${cloudClaudeSettingsPath}: ${error instanceof Error ? error.message : String(error)}; ${cloudSessionStartFix}`,\n    );\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  const destination = join(root, cloudSetupPath);\n  const settingsDestination = join(root, cloudClaudeSettingsPath);\n  // Validate settings separately to retain actionable merge diagnostics.\n  const settings = await readClaudeSettings(settingsDestination);\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [\n      { relative: cloudSetupPath, destination },\n      { relative: cloudClaudeSettingsPath, destination: settingsDestination },\n    ],\n  });\n  if (remainingDiagnostics.length > 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(\n          ({ path, message }) =>\n            `${path}: ${message}${path === cloudClaudeSettingsPath ? `; ${cloudSessionStartFix}` : \"\"}`,\n        )\n        .join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud, rustExceptions } = parseToolchainConfiguration(\n    JSON.parse(text),\n  );\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const sharedPolicy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const policy = {\n    ...sharedPolicy,\n    bun: repositoryBun(sharedPolicy.bun, files[\"package.json\"]),\n  };\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n    files,\n    rustExceptions,\n  });\n  const mergedSettings = mergeCloudClaudeSettings(settings?.text);\n  await writeGeneratedFile({ destination, text: script, mode: 0o755 });\n  if (mergedSettings !== settings?.text)\n    await writeGeneratedFile({\n      destination: settingsDestination,\n      text: mergedSettings,\n      mode: settings?.mode ?? 0o644,\n    });\n  process.stdout.write(\n    `Generated ${cloudSetupPath} and ${cloudClaudeSettingsPath}\\n`,\n  );\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;AAuBA,MAAM,QACJ;AACF,MAAM,qBAAqB,OAAO,gBAAwB;CACxD,IAAI;EACF,IAAK,MAAM,qBAAqB,WAAW,MAAO,KAAA,GAChD,OAAO,KAAA;EACT,MAAM,QAAQ,MAAM,KAClB,aACA,UAAU,WAAW,UAAU,UACjC;EACA,IAAI;GACF,MAAM,SAAS,MAAM,MAAM,KAAK;GAChC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,wDACF;GACF,OAAO;IAAE,MAAM,MAAM,MAAM,SAAS,MAAM;IAAG,MAAM,OAAO,OAAO;GAAM;EACzE,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF,SAAS,OAAO;EACd,MAAM,IAAI,MACR,uBAAuB,wBAAwB,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,IAAI,sBAChH;CACF;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgB,oBAAoB,IAAI;CACvD,MAAM,cAAc,KAAK,MAAM,cAAc;CAC7C,MAAM,sBAAsB,KAAK,MAAM,uBAAuB;CAE9D,MAAM,WAAW,MAAM,mBAAmB,mBAAmB;CAC7D,MAAM,uBAAuB,MAAM,sBAAsB;EACvD;EACA,SAAS,CACP;GAAE,UAAU;GAAgB;EAAY,GACxC;GAAE,UAAU;GAAyB,aAAa;EAAoB,CACxE;CACF,CAAC;CACD,IAAI,qBAAqB,SAAS,GAChC,MAAM,IAAI,MACR,qBACG,KACE,EAAE,MAAM,cACP,GAAG,KAAK,IAAI,UAAU,SAAA,0BAAmC,KAAK,yBAAyB,IAC3F,CAAC,CACA,KAAK,IAAI,CACd;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,OAAO,mBAAmB,4BAChC,KAAK,MAAM,IAAI,CACjB;CACA,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CACvD,MAAM,eAAe,qBACnB,KAAK,MACH,MAAM,SAAS,IAAI,IAAI,qBAAqB,YAAY,GAAG,GAAG,MAAM,CACtE,CACF;CACA,MAAM,SAAS;EACb,GAAG;EACH,KAAK,cAAc,aAAa,KAAK,MAAM,eAAe;CAC5D;CACA,MAAM,SAAS,mBAAmB;EAChC;EACA;EACA,aAAa,YAAY,KAAK;EAC9B;EACA;CACF,CAAC;CACD,MAAM,iBAAiB,yBAAyB,UAAU,IAAI;CAC9D,MAAM,mBAAmB;EAAE;EAAa,MAAM;EAAQ,MAAM;CAAM,CAAC;CACnE,IAAI,mBAAmB,UAAU,MAC/B,MAAM,mBAAmB;EACvB,aAAa;EACb,MAAM;EACN,MAAM,UAAU,QAAQ;CAC1B,CAAC;CACH,QAAQ,OAAO,MACb,aAAa,eAAe,OAAO,wBAAwB,GAC7D;AACF;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"cloud-setup-cli.mjs","names":[],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { open, readFile, realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  cloudClaudeSettingsPath,\n  cloudSessionStartFix,\n  mergeCloudClaudeSettings,\n} from \"./cloud-setup-claude\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport { repositoryBun } from \"./toolchain-bun\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst readClaudeSettings = async (destination: string) => {\n  try {\n    if ((await checkGeneratedOutput(destination)) === undefined)\n      return undefined;\n    const input = await open(\n      destination,\n      constants.O_RDONLY | constants.O_NOFOLLOW,\n    );\n    try {\n      const opened = await input.stat();\n      if (!opened.isFile() || opened.nlink !== 1)\n        throw new Error(\n          \"settings must be a single-link regular repository file\",\n        );\n      return { text: await input.readFile(\"utf8\"), mode: opened.mode & 0o777 };\n    } finally {\n      await input.close();\n    }\n  } catch (error) {\n    throw new Error(\n      `cannot safely merge ${cloudClaudeSettingsPath}: ${error instanceof Error ? error.message : String(error)}; ${cloudSessionStartFix}`,\n    );\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  const destination = join(root, cloudSetupPath);\n  const settingsDestination = join(root, cloudClaudeSettingsPath);\n  // Validate settings separately to retain actionable merge diagnostics.\n  const settings = await readClaudeSettings(settingsDestination);\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [\n      { relative: cloudSetupPath, destination },\n      { relative: cloudClaudeSettingsPath, destination: settingsDestination },\n    ],\n  });\n  if (remainingDiagnostics.length > 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(\n          ({ path, message }) =>\n            `${path}: ${message}${path === cloudClaudeSettingsPath ? `; ${cloudSessionStartFix}` : \"\"}`,\n        )\n        .join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud, rustExceptions } = parseToolchainConfiguration(\n    JSON.parse(text),\n  );\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const sharedPolicy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const policy = {\n    ...sharedPolicy,\n    bun: repositoryBun(sharedPolicy.bun, files[\"package.json\"]),\n  };\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n    files,\n    rustExceptions,\n  });\n  const mergedSettings = mergeCloudClaudeSettings(settings?.text);\n  await writeGeneratedFile({ destination, text: script, mode: 0o755 });\n  if (mergedSettings !== settings?.text)\n    await writeGeneratedFile({\n      destination: settingsDestination,\n      text: mergedSettings,\n      mode: settings?.mode ?? 0o644,\n    });\n  process.stdout.write(\n    `Generated ${cloudSetupPath} and ${cloudClaudeSettingsPath}\\n`,\n  );\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;AAuBA,MAAM,QACJ;AACF,MAAM,qBAAqB,OAAO,gBAAwB;CACxD,IAAI;EACF,IAAK,MAAM,qBAAqB,WAAW,MAAO,KAAA,GAChD,OAAO,KAAA;EACT,MAAM,QAAQ,MAAM,KAClB,aACA,UAAU,WAAW,UAAU,UACjC;EACA,IAAI;GACF,MAAM,SAAS,MAAM,MAAM,KAAK;GAChC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,wDACF;GACF,OAAO;IAAE,MAAM,MAAM,MAAM,SAAS,MAAM;IAAG,MAAM,OAAO,OAAO;GAAM;EACzE,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF,SAAS,OAAO;EACd,MAAM,IAAI,MACR,uBAAuB,wBAAwB,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,IAAI,sBAChH;CACF;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgB,oBAAoB,IAAI;CACvD,MAAM,cAAc,KAAK,MAAM,cAAc;CAC7C,MAAM,sBAAsB,KAAK,MAAM,uBAAuB;CAE9D,MAAM,WAAW,MAAM,mBAAmB,mBAAmB;CAC7D,MAAM,uBAAuB,MAAM,sBAAsB;EACvD;EACA,SAAS,CACP;GAAE,UAAU;GAAgB;EAAY,GACxC;GAAE,UAAU;GAAyB,aAAa;EAAoB,CACxE;CACF,CAAC;CACD,IAAI,qBAAqB,SAAS,GAChC,MAAM,IAAI,MACR,qBACG,KACE,EAAE,MAAM,cACP,GAAG,KAAK,IAAI,UAAU,SAAA,0BAAmC,KAAK,yBAAyB,IAC3F,CAAC,CACA,KAAK,IAAI,CACd;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,OAAO,mBAAmB,4BAChC,KAAK,MAAM,IAAI,CACjB;CACA,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CACvD,MAAM,eAAe,qBACnB,KAAK,MACH,MAAM,SAAS,IAAI,IAAI,qBAAqB,YAAY,GAAG,GAAG,MAAM,CACtE,CACF;CACA,MAAM,SAAS;EACb,GAAG;EACH,KAAK,cAAc,aAAa,KAAK,MAAM,eAAe;CAC5D;CACA,MAAM,SAAS,mBAAmB;EAChC;EACA;EACA,aAAa,YAAY,KAAK;EAC9B;EACA;CACF,CAAC;CACD,MAAM,iBAAiB,yBAAyB,UAAU,IAAI;CAC9D,MAAM,mBAAmB;EAAE;EAAa,MAAM;EAAQ,MAAM;CAAM,CAAC;CACnE,IAAI,mBAAmB,UAAU,MAC/B,MAAM,mBAAmB;EACvB,aAAa;EACb,MAAM;EACN,MAAM,UAAU,QAAQ;CAC1B,CAAC;CACH,QAAQ,OAAO,MACb,aAAa,eAAe,OAAO,wBAAwB,GAC7D;AACF;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/consumer-node-support.cjs

@@ -2,11 +2,11 @@ const require_rolldown_runtime = require("./rolldown-runtime.cjs");
 const require_toolchain_inputs = require("./toolchain-inputs.cjs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let picomatch = require("picomatch");
+picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 let semver = require("semver");
 let node_util = require("node:util");
 let yaml = require("yaml");
-let picomatch = require("picomatch");
-picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 //#region src/consumer-catalogs.ts
 const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const catalogMapping = (value, field) => {

package/dist/consumer-node-support.mjs

@@ -1,9 +1,9 @@
 import { g as workspaceContains } from "./toolchain-inputs.mjs";
 import path from "node:path";
+import picomatch from "picomatch";
 import { satisfies, valid, validRange } from "semver";
 import { isDeepStrictEqual } from "node:util";
 import { parseDocument } from "yaml";
-import picomatch from "picomatch";
 //#region src/consumer-catalogs.ts
 const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const catalogMapping = (value, field) => {

package/dist/dependabot.d.cts

@@ -65,9 +65,17 @@ type FormatterPolicy = {
 /** Reject unsupported or incomplete installed policies before inspecting a consumer. */
 export declare const parseToolchainPolicy: (input: unknown) => {
   bun: string;
+  bunArchiveSha256: Readonly<Record<string, {
+    readonly amd64: string;
+    readonly arm64: string;
+  }>>;
   formatter: FormatterPolicy;
   typescript: string;
   node: string;
+  nodeArchiveSha256: Readonly<Record<string, {
+    readonly amd64: string;
+    readonly arm64: string;
+  }>>;
   postgres: string;
   valkey: string;
   valkeyArtifacts: {
@@ -103,25 +111,6 @@ export declare const parseToolchainPolicy: (input: unknown) => {
     sha: string;
     version: string;
   }>;
-  typescriptInstallLayouts: ({
-    readonly type: "direct";
-    readonly compilerPackage: "typescript";
-    readonly compilerSpecifier: string;
-    readonly typecheckCommand: string;
-    readonly compatibilityPackage?: never;
-    readonly compatibilitySpecifier?: never;
-  } | {
-    readonly type: "split-compatibility";
-    readonly compilerPackage: string;
-    readonly compilerSpecifier: string;
-    readonly compatibilityPackage: string;
-    readonly compatibilitySpecifier: string;
-    readonly typecheckCommand: string;
-  })[];
-  typescript6Compatibility: {
-    version: string;
-    packageAlias: string;
-  };
   dependabot: {
     schedule: {
       interval: string;

package/dist/dependabot.d.mts

@@ -65,9 +65,17 @@ type FormatterPolicy = {
 /** Reject unsupported or incomplete installed policies before inspecting a consumer. */
 export declare const parseToolchainPolicy: (input: unknown) => {
   bun: string;
+  bunArchiveSha256: Readonly<Record<string, {
+    readonly amd64: string;
+    readonly arm64: string;
+  }>>;
   formatter: FormatterPolicy;
   typescript: string;
   node: string;
+  nodeArchiveSha256: Readonly<Record<string, {
+    readonly amd64: string;
+    readonly arm64: string;
+  }>>;
   postgres: string;
   valkey: string;
   valkeyArtifacts: {
@@ -103,25 +111,6 @@ export declare const parseToolchainPolicy: (input: unknown) => {
     sha: string;
     version: string;
   }>;
-  typescriptInstallLayouts: ({
-    readonly type: "direct";
-    readonly compilerPackage: "typescript";
-    readonly compilerSpecifier: string;
-    readonly typecheckCommand: string;
-    readonly compatibilityPackage?: never;
-    readonly compatibilitySpecifier?: never;
-  } | {
-    readonly type: "split-compatibility";
-    readonly compilerPackage: string;
-    readonly compilerSpecifier: string;
-    readonly compatibilityPackage: string;
-    readonly compatibilitySpecifier: string;
-    readonly typecheckCommand: string;
-  })[];
-  typescript6Compatibility: {
-    version: string;
-    packageAlias: string;
-  };
   dependabot: {
     schedule: {
       interval: string;

package/dist/publish-artifact-syntax.cjs

@@ -11,8 +11,8 @@ let yaml = require("yaml");
 let node_os = require("node:os");
 let node_module = require("node:module");
 node_module = require_rolldown_runtime.__toESM(node_module, 1);
-let acorn = require("acorn");
 let node_url = require("node:url");
+let acorn = require("acorn");
 let node_events = require("node:events");
 let node_readline = require("node:readline");
 //#region src/consumer-release-pack.ts

package/dist/publish-artifact-syntax.mjs

@@ -8,8 +8,8 @@ import { lte, parse, satisfies } from "semver";
 import { isDeepStrictEqual, promisify } from "node:util";
 import { parseDocument } from "yaml";
 import { tmpdir } from "node:os";
-import { parse as parse$2 } from "acorn";
 import { fileURLToPath } from "node:url";
+import { parse as parse$2 } from "acorn";
 import { once } from "node:events";
 import { createInterface } from "node:readline";
 //#region src/consumer-release-pack.ts

package/dist/publish-contract-cli.cjs

@@ -13,8 +13,8 @@ let node_fs = require("node:fs");
 let node_child_process = require("node:child_process");
 let node_os = require("node:os");
 let node_module = require("node:module");
-let acorn = require("acorn");
 let node_url = require("node:url");
+let acorn = require("acorn");
 let esbuild = require("esbuild");
 //#region src/publish-build-target-nuxt.ts
 const supportedVersions = {

package/dist/publish-contract-cli.mjs

@@ -10,8 +10,8 @@ import path from "node:path";
 import { existsSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { execFileSync, spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
-import { parse } from "acorn";
 import { pathToFileURL } from "node:url";
+import { parse } from "acorn";
 import { transformSync } from "esbuild";
 //#region src/publish-build-target-nuxt.ts
 const supportedVersions = {

package/dist/quarantine-cli.cjs

@@ -41,7 +41,8 @@ const main = async () => {
 		});
 		const result = require_quarantine_policy.checkRepositoryQuarantine({
 			files,
-			npmrcPresent: npmrc !== void 0 || trackedFiles.has(".npmrc")
+			npmrcPresent: npmrc !== void 0 || trackedFiles.has(".npmrc"),
+			expiry: require_quarantine_policy.resolveExpiryScope(root)
 		});
 		for (const warning of result.warnings) process.stderr.write(`warning: ${warning}\n`);
 		if (result.errors.length > 0) throw new Error(result.errors.join("\n"));

package/dist/quarantine-cli.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"quarantine-cli.cjs","names":["realpath","readToolchainInputs","join","checkGeneratedOutput","readFile","generationDiagnostics","lstat","checkRepositoryQuarantine","synchronizeRepositoryQuarantine","pruneRepositoryQuarantine","writeGeneratedFile"],"sources":["../src/quarantine-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { lstat, readFile, realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport {\n  checkRepositoryQuarantine,\n  pruneRepositoryQuarantine,\n  synchronizeRepositoryQuarantine,\n} from \"./quarantine-policy\";\nimport { readToolchainInputs } from \"./toolchain-guard\";\n\nconst usage =\n  \"Usage: stll-quarantine [--check | --sync | --prune]\\nRun from the repository root; --check is the default.\";\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  const mode = args.at(0) ?? \"--check\";\n  if (args.length > 1 || ![\"--check\", \"--sync\", \"--prune\"].includes(mode))\n    throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root, {\n    bunLock: \"content\",\n  });\n  const destination = join(root, \"bunfig.toml\");\n  // These root inputs may be new outputs not yet staged in Git.\n  for (const file of [\"bunfig.toml\", \"bun.lock\"]) {\n    const source = join(root, file);\n    if ((await checkGeneratedOutput(source)) !== undefined)\n      files[file] = await readFile(source, \"utf8\");\n  }\n  const remaining = await generationDiagnostics({\n    diagnostics,\n    outputs: [{ relative: \"bunfig.toml\", destination }],\n  });\n  if (remaining.length > 0)\n    throw new Error(\n      remaining.map(({ path, message }) => `${path}: ${message}`).join(\"\\n\"),\n    );\n  if (mode === \"--check\") {\n    const npmrc = await lstat(join(root, \".npmrc\")).catch((error: unknown) => {\n      if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n        return undefined;\n      throw error;\n    });\n    const result = checkRepositoryQuarantine({\n      files,\n      npmrcPresent: npmrc !== undefined || trackedFiles.has(\".npmrc\"),\n    });\n    for (const warning of result.warnings)\n      process.stderr.write(`warning: ${warning}\\n`);\n    if (result.errors.length > 0) throw new Error(result.errors.join(\"\\n\"));\n    process.stdout.write(\"Verified bunfig.toml quarantine policy\\n\");\n    return;\n  }\n  const text =\n    mode === \"--sync\"\n      ? synchronizeRepositoryQuarantine({ files })\n      : pruneRepositoryQuarantine({ files }).bunfig;\n  const stat = await checkGeneratedOutput(destination);\n  if (text !== files[\"bunfig.toml\"])\n    await writeGeneratedFile({\n      destination,\n      text,\n      mode: stat === undefined ? 0o644 : stat.mode & 0o777,\n    });\n  process.stdout.write(\n    `${mode === \"--sync\" ? \"Synchronized\" : \"Pruned\"} bunfig.toml quarantine policy\\n`,\n  );\n};\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `quarantine: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;AAgBA,MAAM,QACJ;AACF,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,MAAM,OAAO,KAAK,GAAG,CAAC,KAAK;CAC3B,IAAI,KAAK,SAAS,KAAK,CAAC;EAAC;EAAW;EAAU;CAAS,CAAC,CAAC,SAAS,IAAI,GACpE,MAAM,IAAI,MAAM,KAAK;CACvB,MAAM,OAAO,OAAA,GAAMA,iBAAAA,SAAAA,CAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,cAAc,gBAAgBC,wBAAAA,oBAAoB,MAAM,EACrE,SAAS,UACX,CAAC;CACD,MAAM,eAAA,GAAcC,UAAAA,KAAAA,CAAK,MAAM,aAAa;CAE5C,KAAK,MAAM,QAAQ,CAAC,eAAe,UAAU,GAAG;EAC9C,MAAM,UAAA,GAASA,UAAAA,KAAAA,CAAK,MAAM,IAAI;EAC9B,IAAK,MAAMC,uBAAAA,qBAAqB,MAAM,MAAO,KAAA,GAC3C,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,QAAQ,MAAM;CAC/C;CACA,MAAM,YAAY,MAAMC,uBAAAA,sBAAsB;EAC5C;EACA,SAAS,CAAC;GAAE,UAAU;GAAe;EAAY,CAAC;CACpD,CAAC;CACD,IAAI,UAAU,SAAS,GACrB,MAAM,IAAI,MACR,UAAU,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,CACvE;CACF,IAAI,SAAS,WAAW;EACtB,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,MAAAA,EAAAA,GAAMJ,UAAAA,KAAAA,CAAK,MAAM,QAAQ,CAAC,CAAC,CAAC,OAAO,UAAmB;GACxE,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;GACT,MAAM;EACR,CAAC;EACD,MAAM,SAASK,0BAAAA,0BAA0B;GACvC;GACA,cAAc,UAAU,KAAA,KAAa,aAAa,IAAI,QAAQ;EAChE,CAAC;EACD,KAAK,MAAM,WAAW,OAAO,UAC3B,QAAQ,OAAO,MAAM,YAAY,QAAQ,GAAG;EAC9C,IAAI,OAAO,OAAO,SAAS,GAAG,MAAM,IAAI,MAAM,OAAO,OAAO,KAAK,IAAI,CAAC;EACtE,QAAQ,OAAO,MAAM,0CAA0C;EAC/D;CACF;CACA,MAAM,OACJ,SAAS,WACLC,0BAAAA,gCAAgC,EAAE,MAAM,CAAC,IACzCC,0BAAAA,0BAA0B,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3C,MAAM,OAAO,MAAMN,uBAAAA,qBAAqB,WAAW;CACnD,IAAI,SAAS,MAAM,gBACjB,MAAMO,uBAAAA,mBAAmB;EACvB;EACA;EACA,MAAM,SAAS,KAAA,IAAY,MAAQ,KAAK,OAAO;CACjD,CAAC;CACH,QAAQ,OAAO,MACb,GAAG,SAAS,WAAW,iBAAiB,SAAS,iCACnD;AACF;AACA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACxE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"quarantine-cli.cjs","names":["realpath","readToolchainInputs","join","checkGeneratedOutput","readFile","generationDiagnostics","lstat","checkRepositoryQuarantine","resolveExpiryScope","synchronizeRepositoryQuarantine","pruneRepositoryQuarantine","writeGeneratedFile"],"sources":["../src/quarantine-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { lstat, readFile, realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { resolveExpiryScope } from \"./dated-entry-scope\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport {\n  checkRepositoryQuarantine,\n  pruneRepositoryQuarantine,\n  synchronizeRepositoryQuarantine,\n} from \"./quarantine-policy\";\nimport { readToolchainInputs } from \"./toolchain-guard\";\n\nconst usage =\n  \"Usage: stll-quarantine [--check | --sync | --prune]\\nRun from the repository root; --check is the default.\";\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  const mode = args.at(0) ?? \"--check\";\n  if (args.length > 1 || ![\"--check\", \"--sync\", \"--prune\"].includes(mode))\n    throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root, {\n    bunLock: \"content\",\n  });\n  const destination = join(root, \"bunfig.toml\");\n  // These root inputs may be new outputs not yet staged in Git.\n  for (const file of [\"bunfig.toml\", \"bun.lock\"]) {\n    const source = join(root, file);\n    if ((await checkGeneratedOutput(source)) !== undefined)\n      files[file] = await readFile(source, \"utf8\");\n  }\n  const remaining = await generationDiagnostics({\n    diagnostics,\n    outputs: [{ relative: \"bunfig.toml\", destination }],\n  });\n  if (remaining.length > 0)\n    throw new Error(\n      remaining.map(({ path, message }) => `${path}: ${message}`).join(\"\\n\"),\n    );\n  if (mode === \"--check\") {\n    const npmrc = await lstat(join(root, \".npmrc\")).catch((error: unknown) => {\n      if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n        return undefined;\n      throw error;\n    });\n    const result = checkRepositoryQuarantine({\n      files,\n      npmrcPresent: npmrc !== undefined || trackedFiles.has(\".npmrc\"),\n      expiry: resolveExpiryScope(root),\n    });\n    for (const warning of result.warnings)\n      process.stderr.write(`warning: ${warning}\\n`);\n    if (result.errors.length > 0) throw new Error(result.errors.join(\"\\n\"));\n    process.stdout.write(\"Verified bunfig.toml quarantine policy\\n\");\n    return;\n  }\n  const text =\n    mode === \"--sync\"\n      ? synchronizeRepositoryQuarantine({ files })\n      : pruneRepositoryQuarantine({ files }).bunfig;\n  const stat = await checkGeneratedOutput(destination);\n  if (text !== files[\"bunfig.toml\"])\n    await writeGeneratedFile({\n      destination,\n      text,\n      mode: stat === undefined ? 0o644 : stat.mode & 0o777,\n    });\n  process.stdout.write(\n    `${mode === \"--sync\" ? \"Synchronized\" : \"Pruned\"} bunfig.toml quarantine policy\\n`,\n  );\n};\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `quarantine: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;AAiBA,MAAM,QACJ;AACF,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,MAAM,OAAO,KAAK,GAAG,CAAC,KAAK;CAC3B,IAAI,KAAK,SAAS,KAAK,CAAC;EAAC;EAAW;EAAU;CAAS,CAAC,CAAC,SAAS,IAAI,GACpE,MAAM,IAAI,MAAM,KAAK;CACvB,MAAM,OAAO,OAAA,GAAMA,iBAAAA,SAAAA,CAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,cAAc,gBAAgBC,wBAAAA,oBAAoB,MAAM,EACrE,SAAS,UACX,CAAC;CACD,MAAM,eAAA,GAAcC,UAAAA,KAAAA,CAAK,MAAM,aAAa;CAE5C,KAAK,MAAM,QAAQ,CAAC,eAAe,UAAU,GAAG;EAC9C,MAAM,UAAA,GAASA,UAAAA,KAAAA,CAAK,MAAM,IAAI;EAC9B,IAAK,MAAMC,uBAAAA,qBAAqB,MAAM,MAAO,KAAA,GAC3C,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,QAAQ,MAAM;CAC/C;CACA,MAAM,YAAY,MAAMC,uBAAAA,sBAAsB;EAC5C;EACA,SAAS,CAAC;GAAE,UAAU;GAAe;EAAY,CAAC;CACpD,CAAC;CACD,IAAI,UAAU,SAAS,GACrB,MAAM,IAAI,MACR,UAAU,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,CACvE;CACF,IAAI,SAAS,WAAW;EACtB,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,MAAAA,EAAAA,GAAMJ,UAAAA,KAAAA,CAAK,MAAM,QAAQ,CAAC,CAAC,CAAC,OAAO,UAAmB;GACxE,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;GACT,MAAM;EACR,CAAC;EACD,MAAM,SAASK,0BAAAA,0BAA0B;GACvC;GACA,cAAc,UAAU,KAAA,KAAa,aAAa,IAAI,QAAQ;GAC9D,QAAQC,0BAAAA,mBAAmB,IAAI;EACjC,CAAC;EACD,KAAK,MAAM,WAAW,OAAO,UAC3B,QAAQ,OAAO,MAAM,YAAY,QAAQ,GAAG;EAC9C,IAAI,OAAO,OAAO,SAAS,GAAG,MAAM,IAAI,MAAM,OAAO,OAAO,KAAK,IAAI,CAAC;EACtE,QAAQ,OAAO,MAAM,0CAA0C;EAC/D;CACF;CACA,MAAM,OACJ,SAAS,WACLC,0BAAAA,gCAAgC,EAAE,MAAM,CAAC,IACzCC,0BAAAA,0BAA0B,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3C,MAAM,OAAO,MAAMP,uBAAAA,qBAAqB,WAAW;CACnD,IAAI,SAAS,MAAM,gBACjB,MAAMQ,uBAAAA,mBAAmB;EACvB;EACA;EACA,MAAM,SAAS,KAAA,IAAY,MAAQ,KAAK,OAAO;CACjD,CAAC;CACH,QAAQ,OAAO,MACb,GAAG,SAAS,WAAW,iBAAiB,SAAS,iCACnD;AACF;AACA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACxE;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/quarantine-cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { n as generationDiagnostics, r as writeGeneratedFile, t as checkGeneratedOutput } from "./generated-file.mjs";
-import { i as synchronizeRepositoryQuarantine, r as pruneRepositoryQuarantine, t as checkRepositoryQuarantine } from "./quarantine-policy2.mjs";
+import { i as synchronizeRepositoryQuarantine, r as pruneRepositoryQuarantine, t as checkRepositoryQuarantine, u as resolveExpiryScope } from "./quarantine-policy2.mjs";
 import { r as readToolchainInputs } from "./toolchain-guard.mjs";
 import { lstat, readFile, realpath } from "node:fs/promises";
 import { join } from "node:path";
@@ -40,7 +40,8 @@ const main = async () => {
 		});
 		const result = checkRepositoryQuarantine({
 			files,
-			npmrcPresent: npmrc !== void 0 || trackedFiles.has(".npmrc")
+			npmrcPresent: npmrc !== void 0 || trackedFiles.has(".npmrc"),
+			expiry: resolveExpiryScope(root)
 		});
 		for (const warning of result.warnings) process.stderr.write(`warning: ${warning}\n`);
 		if (result.errors.length > 0) throw new Error(result.errors.join("\n"));

package/dist/quarantine-cli.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"quarantine-cli.mjs","names":[],"sources":["../src/quarantine-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { lstat, readFile, realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport {\n  checkRepositoryQuarantine,\n  pruneRepositoryQuarantine,\n  synchronizeRepositoryQuarantine,\n} from \"./quarantine-policy\";\nimport { readToolchainInputs } from \"./toolchain-guard\";\n\nconst usage =\n  \"Usage: stll-quarantine [--check | --sync | --prune]\\nRun from the repository root; --check is the default.\";\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  const mode = args.at(0) ?? \"--check\";\n  if (args.length > 1 || ![\"--check\", \"--sync\", \"--prune\"].includes(mode))\n    throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root, {\n    bunLock: \"content\",\n  });\n  const destination = join(root, \"bunfig.toml\");\n  // These root inputs may be new outputs not yet staged in Git.\n  for (const file of [\"bunfig.toml\", \"bun.lock\"]) {\n    const source = join(root, file);\n    if ((await checkGeneratedOutput(source)) !== undefined)\n      files[file] = await readFile(source, \"utf8\");\n  }\n  const remaining = await generationDiagnostics({\n    diagnostics,\n    outputs: [{ relative: \"bunfig.toml\", destination }],\n  });\n  if (remaining.length > 0)\n    throw new Error(\n      remaining.map(({ path, message }) => `${path}: ${message}`).join(\"\\n\"),\n    );\n  if (mode === \"--check\") {\n    const npmrc = await lstat(join(root, \".npmrc\")).catch((error: unknown) => {\n      if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n        return undefined;\n      throw error;\n    });\n    const result = checkRepositoryQuarantine({\n      files,\n      npmrcPresent: npmrc !== undefined || trackedFiles.has(\".npmrc\"),\n    });\n    for (const warning of result.warnings)\n      process.stderr.write(`warning: ${warning}\\n`);\n    if (result.errors.length > 0) throw new Error(result.errors.join(\"\\n\"));\n    process.stdout.write(\"Verified bunfig.toml quarantine policy\\n\");\n    return;\n  }\n  const text =\n    mode === \"--sync\"\n      ? synchronizeRepositoryQuarantine({ files })\n      : pruneRepositoryQuarantine({ files }).bunfig;\n  const stat = await checkGeneratedOutput(destination);\n  if (text !== files[\"bunfig.toml\"])\n    await writeGeneratedFile({\n      destination,\n      text,\n      mode: stat === undefined ? 0o644 : stat.mode & 0o777,\n    });\n  process.stdout.write(\n    `${mode === \"--sync\" ? \"Synchronized\" : \"Pruned\"} bunfig.toml quarantine policy\\n`,\n  );\n};\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `quarantine: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;AAgBA,MAAM,QACJ;AACF,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,MAAM,OAAO,KAAK,GAAG,CAAC,KAAK;CAC3B,IAAI,KAAK,SAAS,KAAK,CAAC;EAAC;EAAW;EAAU;CAAS,CAAC,CAAC,SAAS,IAAI,GACpE,MAAM,IAAI,MAAM,KAAK;CACvB,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,cAAc,gBAAgB,oBAAoB,MAAM,EACrE,SAAS,UACX,CAAC;CACD,MAAM,cAAc,KAAK,MAAM,aAAa;CAE5C,KAAK,MAAM,QAAQ,CAAC,eAAe,UAAU,GAAG;EAC9C,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,IAAK,MAAM,qBAAqB,MAAM,MAAO,KAAA,GAC3C,MAAM,QAAQ,MAAM,SAAS,QAAQ,MAAM;CAC/C;CACA,MAAM,YAAY,MAAM,sBAAsB;EAC5C;EACA,SAAS,CAAC;GAAE,UAAU;GAAe;EAAY,CAAC;CACpD,CAAC;CACD,IAAI,UAAU,SAAS,GACrB,MAAM,IAAI,MACR,UAAU,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,CACvE;CACF,IAAI,SAAS,WAAW;EACtB,MAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,QAAQ,CAAC,CAAC,CAAC,OAAO,UAAmB;GACxE,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;GACT,MAAM;EACR,CAAC;EACD,MAAM,SAAS,0BAA0B;GACvC;GACA,cAAc,UAAU,KAAA,KAAa,aAAa,IAAI,QAAQ;EAChE,CAAC;EACD,KAAK,MAAM,WAAW,OAAO,UAC3B,QAAQ,OAAO,MAAM,YAAY,QAAQ,GAAG;EAC9C,IAAI,OAAO,OAAO,SAAS,GAAG,MAAM,IAAI,MAAM,OAAO,OAAO,KAAK,IAAI,CAAC;EACtE,QAAQ,OAAO,MAAM,0CAA0C;EAC/D;CACF;CACA,MAAM,OACJ,SAAS,WACL,gCAAgC,EAAE,MAAM,CAAC,IACzC,0BAA0B,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3C,MAAM,OAAO,MAAM,qBAAqB,WAAW;CACnD,IAAI,SAAS,MAAM,gBACjB,MAAM,mBAAmB;EACvB;EACA;EACA,MAAM,SAAS,KAAA,IAAY,MAAQ,KAAK,OAAO;CACjD,CAAC;CACH,QAAQ,OAAO,MACb,GAAG,SAAS,WAAW,iBAAiB,SAAS,iCACnD;AACF;AACA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACxE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"quarantine-cli.mjs","names":[],"sources":["../src/quarantine-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { lstat, readFile, realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { resolveExpiryScope } from \"./dated-entry-scope\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport {\n  checkRepositoryQuarantine,\n  pruneRepositoryQuarantine,\n  synchronizeRepositoryQuarantine,\n} from \"./quarantine-policy\";\nimport { readToolchainInputs } from \"./toolchain-guard\";\n\nconst usage =\n  \"Usage: stll-quarantine [--check | --sync | --prune]\\nRun from the repository root; --check is the default.\";\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  const mode = args.at(0) ?? \"--check\";\n  if (args.length > 1 || ![\"--check\", \"--sync\", \"--prune\"].includes(mode))\n    throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, trackedFiles, diagnostics } = readToolchainInputs(root, {\n    bunLock: \"content\",\n  });\n  const destination = join(root, \"bunfig.toml\");\n  // These root inputs may be new outputs not yet staged in Git.\n  for (const file of [\"bunfig.toml\", \"bun.lock\"]) {\n    const source = join(root, file);\n    if ((await checkGeneratedOutput(source)) !== undefined)\n      files[file] = await readFile(source, \"utf8\");\n  }\n  const remaining = await generationDiagnostics({\n    diagnostics,\n    outputs: [{ relative: \"bunfig.toml\", destination }],\n  });\n  if (remaining.length > 0)\n    throw new Error(\n      remaining.map(({ path, message }) => `${path}: ${message}`).join(\"\\n\"),\n    );\n  if (mode === \"--check\") {\n    const npmrc = await lstat(join(root, \".npmrc\")).catch((error: unknown) => {\n      if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n        return undefined;\n      throw error;\n    });\n    const result = checkRepositoryQuarantine({\n      files,\n      npmrcPresent: npmrc !== undefined || trackedFiles.has(\".npmrc\"),\n      expiry: resolveExpiryScope(root),\n    });\n    for (const warning of result.warnings)\n      process.stderr.write(`warning: ${warning}\\n`);\n    if (result.errors.length > 0) throw new Error(result.errors.join(\"\\n\"));\n    process.stdout.write(\"Verified bunfig.toml quarantine policy\\n\");\n    return;\n  }\n  const text =\n    mode === \"--sync\"\n      ? synchronizeRepositoryQuarantine({ files })\n      : pruneRepositoryQuarantine({ files }).bunfig;\n  const stat = await checkGeneratedOutput(destination);\n  if (text !== files[\"bunfig.toml\"])\n    await writeGeneratedFile({\n      destination,\n      text,\n      mode: stat === undefined ? 0o644 : stat.mode & 0o777,\n    });\n  process.stdout.write(\n    `${mode === \"--sync\" ? \"Synchronized\" : \"Pruned\"} bunfig.toml quarantine policy\\n`,\n  );\n};\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `quarantine: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;AAiBA,MAAM,QACJ;AACF,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,MAAM,OAAO,KAAK,GAAG,CAAC,KAAK;CAC3B,IAAI,KAAK,SAAS,KAAK,CAAC;EAAC;EAAW;EAAU;CAAS,CAAC,CAAC,SAAS,IAAI,GACpE,MAAM,IAAI,MAAM,KAAK;CACvB,MAAM,OAAO,MAAM,SAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,cAAc,gBAAgB,oBAAoB,MAAM,EACrE,SAAS,UACX,CAAC;CACD,MAAM,cAAc,KAAK,MAAM,aAAa;CAE5C,KAAK,MAAM,QAAQ,CAAC,eAAe,UAAU,GAAG;EAC9C,MAAM,SAAS,KAAK,MAAM,IAAI;EAC9B,IAAK,MAAM,qBAAqB,MAAM,MAAO,KAAA,GAC3C,MAAM,QAAQ,MAAM,SAAS,QAAQ,MAAM;CAC/C;CACA,MAAM,YAAY,MAAM,sBAAsB;EAC5C;EACA,SAAS,CAAC;GAAE,UAAU;GAAe;EAAY,CAAC;CACpD,CAAC;CACD,IAAI,UAAU,SAAS,GACrB,MAAM,IAAI,MACR,UAAU,KAAK,EAAE,MAAM,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,KAAK,IAAI,CACvE;CACF,IAAI,SAAS,WAAW;EACtB,MAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,QAAQ,CAAC,CAAC,CAAC,OAAO,UAAmB;GACxE,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;GACT,MAAM;EACR,CAAC;EACD,MAAM,SAAS,0BAA0B;GACvC;GACA,cAAc,UAAU,KAAA,KAAa,aAAa,IAAI,QAAQ;GAC9D,QAAQ,mBAAmB,IAAI;EACjC,CAAC;EACD,KAAK,MAAM,WAAW,OAAO,UAC3B,QAAQ,OAAO,MAAM,YAAY,QAAQ,GAAG;EAC9C,IAAI,OAAO,OAAO,SAAS,GAAG,MAAM,IAAI,MAAM,OAAO,OAAO,KAAK,IAAI,CAAC;EACtE,QAAQ,OAAO,MAAM,0CAA0C;EAC/D;CACF;CACA,MAAM,OACJ,SAAS,WACL,gCAAgC,EAAE,MAAM,CAAC,IACzC,0BAA0B,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3C,MAAM,OAAO,MAAM,qBAAqB,WAAW;CACnD,IAAI,SAAS,MAAM,gBACjB,MAAM,mBAAmB;EACvB;EACA;EACA,MAAM,SAAS,KAAA,IAAY,MAAQ,KAAK,OAAO;CACjD,CAAC;CACH,QAAQ,OAAO,MACb,GAAG,SAAS,WAAW,iBAAiB,SAAS,iCACnD;AACF;AACA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACxE;CACA,QAAQ,WAAW;AACrB,CAAC"}