@stll/oxlint-config 1.9.0 → 2.1.0

package/dist/toolchain-inputs.cjs

@@ -2,12 +2,12 @@ const require_rolldown_runtime = require("./rolldown-runtime.cjs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let smol_toml = require("smol-toml");
+let picomatch = require("picomatch");
+picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 let node_crypto = require("node:crypto");
 let semver = require("semver");
 let node_util = require("node:util");
 let yaml = require("yaml");
-let picomatch = require("picomatch");
-picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 //#region src/cloud-setup-install.ts
 const packageInstall = String.raw`
 # Prevent package maintainer scripts from starting unmanaged system services.
@@ -42,20 +42,20 @@ apt_install() (
   policy_state=installed
   printf '%s\n' '#!/bin/sh' 'exit 101' > /usr/sbin/policy-rc.d
   chmod 755 /usr/sbin/policy-rc.d
-  local package
+  # The network deadline covers downloads only; unpacking and maintainer scripts
+  # (for example locale generation or cluster creation) run offline afterwards.
+  DEBIAN_FRONTEND=noninteractive apt_network install -y --no-install-recommends --download-only "$@"
+  local package pending
   for package in "$@"; do
     if [[ "$package" == */* ]]; then
-      # apt cannot fetch local archives with --download-only, so their installs
-      # stay one call. Package triggers can be slow on cloud filesystems; the
-      # longer whole-call deadline covers them while Acquire timeouts still
-      # bound each network request.
-      APT_DEADLINE=600 DEBIAN_FRONTEND=noninteractive apt_network install -y --no-install-recommends "$@"
+      # apt rejects --no-download for local archives, so prove instead that
+      # only local file: archives remain; --print-uris reads local state only.
+      pending="$(set -o pipefail; DEBIAN_FRONTEND=noninteractive apt-get --print-uris -qq -y --no-install-recommends install "$@" | awk '$1 !~ /^\047file:/')"
+      [[ -z "$pending" ]] || fail "Package downloads remain after the bounded download step: $pending"
+      DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$@"
       return
     fi
   done
-  # The network deadline covers downloads only; unpacking and maintainer scripts
-  # (for example locale generation or cluster creation) run offline afterwards.
-  DEBIAN_FRONTEND=noninteractive apt_network install -y --no-install-recommends --download-only "$@"
   DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends --no-download "$@"
 )
 
@@ -337,6 +337,28 @@ apt_refresh_for() {
 }
 `;
 //#endregion
+//#region src/archive-pins.ts
+const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Parse a map from exact releases to their amd64 and arm64 archive SHA256 values. */
+const parseArchiveSha256 = (input, label) => {
+	if (input === void 0) return {};
+	if (!record$3(input)) throw new Error(`${label} must be a version map`);
+	const releases = {};
+	for (const [version, value] of Object.entries(input)) {
+		if ((0, semver.valid)(version) !== version || !record$3(value)) throw new Error(`${label} requires exact release keys`);
+		const keys = Object.keys(value);
+		if (keys.length !== 2 || !keys.includes("amd64") || !keys.includes("arm64")) throw new Error(`${label} ${version} requires amd64 and arm64 pins`);
+		const amd64 = value["amd64"];
+		const arm64 = value["arm64"];
+		if (typeof amd64 !== "string" || typeof arm64 !== "string" || !/^[a-f0-9]{64}$/.test(amd64) || !/^[a-f0-9]{64}$/.test(arm64)) throw new Error(`${label} ${version} requires lowercase SHA256 pins`);
+		releases[version] = {
+			amd64,
+			arm64
+		};
+	}
+	return releases;
+};
+//#endregion
 //#region src/cloud-setup-artifacts.ts
 const wasmBindgen0126 = {
 	version: "0.2.126",
@@ -550,6 +572,20 @@ const parseTools = (input) => {
 	}
 	return result;
 };
+const cloudRuntimes = ["node", "bun"];
+const parseRuntimeArchives = (input) => {
+	if (input === void 0) return void 0;
+	if (!object(input) || Object.keys(input).some((key) => !cloudRuntimes.some((runtime) => runtime === key))) throw new Error("cloud.runtimeArchiveSha256 accepts only node and bun");
+	const result = {};
+	for (const runtime of cloudRuntimes) {
+		if (!Object.hasOwn(input, runtime)) continue;
+		const label = `cloud.runtimeArchiveSha256.${runtime}`;
+		const pins = parseArchiveSha256(input[runtime], label);
+		if (Object.keys(pins).length !== 1) throw new Error(`${label} pins exactly one release`);
+		result[runtime] = pins;
+	}
+	return result;
+};
 const cloudInstallCommand = "bun install --frozen-lockfile";
 const cloudInstallCommands = [cloudInstallCommand, `${cloudInstallCommand} --ignore-scripts`];
 const cloudInstall = (value) => cloudInstallCommands.some((command) => value === command);
@@ -578,14 +614,18 @@ const parsePrepare = (input) => {
 const parseCloudSetup = (input) => {
 	if (input === void 0) return void 0;
 	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error("cloud must be an object");
-	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile" && key !== "rust" && key !== "tools" && key !== "prepare") throw new Error(`unsupported cloud key: ${key}`);
+	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile" && key !== "rust" && key !== "tools" && key !== "prepare" && key !== "submodules" && key !== "runtimeArchiveSha256") throw new Error(`unsupported cloud key: ${key}`);
 	const rust = parseRust("rust" in input ? input.rust : void 0);
 	const tools = parseTools("tools" in input ? input.tools : void 0);
 	const prepare = parsePrepare("prepare" in input ? input.prepare : void 0);
+	const runtimeArchiveSha256 = parseRuntimeArchives("runtimeArchiveSha256" in input ? input.runtimeArchiveSha256 : void 0);
+	const submodules = "submodules" in input ? input.submodules : false;
+	if (typeof submodules !== "boolean") throw new Error("cloud.submodules must be a boolean when provided");
 	const extensions = {
 		...rust === void 0 ? {} : { rust },
 		...tools === void 0 ? {} : { tools },
-		...prepare === void 0 ? {} : { prepare }
+		...prepare === void 0 ? {} : { prepare },
+		...runtimeArchiveSha256 === void 0 ? {} : { runtimeArchiveSha256 }
 	};
 	const selected = "services" in input ? input.services : [];
 	if (!Array.isArray(selected)) throw new Error("cloud.services must be an array when provided");
@@ -602,6 +642,7 @@ const parseCloudSetup = (input) => {
 	return {
 		services,
 		install,
+		...submodules ? { submodules } : {},
 		...extensions,
 		...services.length === 0 ? {} : { envFile: parseEnvFile(input) }
 	};
@@ -1147,15 +1188,13 @@ NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
 BUN_DIR="/opt/stll-cloud/bun/$BUN_VERSION"
 export PATH="$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 BUN_CACHE="/var/cache/stll-cloud/bun/$OUTPUT_UID"
-DEPENDENCY_STATE_ROOT=/var/lib/stll-cloud
-DEPENDENCY_STAMP="$DEPENDENCY_STATE_ROOT/dependencies-$(printf '%s' "$REPO_ROOT" | sha256sum | cut -d' ' -f1).sha256"
 @ENV_ASSIGNMENTS@
 [[ -f "$REPO_ROOT/.node-version" && ! -L "$REPO_ROOT/.node-version" ]] || fail 'A regular root .node-version is required'
 [[ "$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' "$REPO_ROOT/.node-version")" == "$NODE_VERSION" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'
 cd -- "$REPO_ROOT"
 case "$(uname -m)" in
-  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64 ;;
-  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64 ;;
+  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64; NODE_SHA256='@NODE_AMD64_SHA@'; BUN_SHA256='@BUN_AMD64_SHA@' ;;
+  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64; NODE_SHA256='@NODE_ARM64_SHA@'; BUN_SHA256='@BUN_ARM64_SHA@' ;;
   *) fail 'Only amd64 and arm64 are supported' ;;
 esac
 
@@ -1249,6 +1288,7 @@ install_runtimes() (
   if ! node_ready; then
     node_archive="node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz"
     download_file "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" "$scratch/$node_archive" 120
+    (cd "$scratch"; printf '%s  %s\n' "$NODE_SHA256" "$node_archive" | sha256sum --strict -c -)
     download_file "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" "$scratch/node-sums" 45
     (cd "$scratch"; awk -v name="$node_archive" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' node-sums | sha256sum --strict -c -)
     install -d -m 755 "$NODE_DIR"
@@ -1258,6 +1298,7 @@ install_runtimes() (
     bun_folder="bun-linux-$BUN_ARCH"
     bun_archive="$bun_folder.zip"
     download_file "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/$bun_archive" "$scratch/$bun_archive" 120
+    (cd "$scratch"; printf '%s  %s\n' "$BUN_SHA256" "$bun_archive" | sha256sum --strict -c -)
     download_file "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/SHASUMS256.txt" "$scratch/bun-sums" 45
     (cd "$scratch"; awk -v name="$bun_archive" '$2 == name || $2 == "*" name { print $1 "  " name; count++ } END { if (count != 1) exit 1 }' bun-sums | sha256sum --strict -c -)
     unzip -q "$scratch/$bun_archive" -d "$scratch/bun"
@@ -1308,49 +1349,16 @@ process.stdout.write([...hosts].sort().join(","));
   network_run "$download_hosts" 240 runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" BUN_INSTALL_CACHE_DIR="$BUN_CACHE" PATH="$PATH" BUN_CONFIG_HTTP_IDLE_TIMEOUT=20 "$BUN_DIR/bun" @INSTALL_ARGS@
 }
 
-dependency_hash() {
-  [[ -f bun.lock && ! -L bun.lock ]] || fail 'A regular root bun.lock is required'
-  sha256sum -- bun.lock | cut -d ' ' -f1
-}
-prepare_dependency_state() {
-  [[ ! -L "$DEPENDENCY_STATE_ROOT" ]] || fail 'Dependency state root must not be a symlink'
-  if [[ -e "$DEPENDENCY_STATE_ROOT" ]]; then
-    [[ -d "$DEPENDENCY_STATE_ROOT" && "$(stat -c '%u:%a' "$DEPENDENCY_STATE_ROOT")" == 0:755 ]] || fail 'Invalid dependency state root'
-  else
-    install -d -m 755 -o root -g root "$DEPENDENCY_STATE_ROOT"
-  fi
-  [[ ! -L "$DEPENDENCY_STAMP" ]] || fail 'Dependency stamp must not be a symlink'
-  if [[ -e "$DEPENDENCY_STAMP" ]]; then
-    [[ -f "$DEPENDENCY_STAMP" && "$(stat -c '%u:%a' "$DEPENDENCY_STAMP")" == 0:644 ]] || fail 'Invalid dependency stamp'
-  fi
-}
-write_dependency_stamp() {
-  local temporary
-  prepare_dependency_state
-  temporary="$(mktemp "$DEPENDENCY_STATE_ROOT/.dependencies.XXXXXX")"
-  chmod 644 "$temporary"
-  dependency_hash > "$temporary"
-  mv -f -- "$temporary" "$DEPENDENCY_STAMP"
-}
+# The frozen install is the check: it reads every input the package manager
+# uses and changes nothing on a current tree, so no stamp stands in for it.
 install_dependencies() {
-  prepare_dependency_state
-  rm -f -- "$DEPENDENCY_STAMP"
   dependency_install
-  write_dependency_stamp
 }
 sync_dependencies() {
-  local expected installed=''
-  prepare_dependency_state
-  expected="$(dependency_hash)"
-  if [[ -f "$DEPENDENCY_STAMP" ]]; then IFS= read -r installed < "$DEPENDENCY_STAMP" || true; fi
-  # The stamp describes an installation; without node_modules there is none.
-  [[ "$installed" == "$expected" && -d "$REPO_ROOT/node_modules" ]] && return
-  rm -f -- "$DEPENDENCY_STAMP"
   dependency_install || fail 'bun.lock mismatch; dependency installation failed'
-  write_dependency_stamp
 }
 
-@SERVICE_INSTALL@
+@SUBMODULE_FUNCTION@@SERVICE_INSTALL@
 @SERVICE_START@
 
 @TOOL_INSTALL@
@@ -1370,7 +1378,7 @@ if [[ "$MODE" == install ]]; then
   step shell install_shell_environment
   # Login routes read the installed profile, so they are checked after it.
   step routes verify_bun_routes
-  step dependencies install_dependencies
+@SUBMODULE_STEP@  step dependencies install_dependencies
 @PREPARE_STEP@
   exit 0
 fi
@@ -1494,11 +1502,40 @@ const renderPrepare = (prepare, files) => {
 		"}"
 	].join("\n");
 };
+const runtimeArchiveManifests = {
+	node: (version) => `https://nodejs.org/dist/v${version}/SHASUMS256.txt`,
+	bun: (version) => `https://github.com/oven-sh/bun/releases/download/bun-v${version}/SHASUMS256.txt`
+};
+const runtimeArchivePins = ({ runtime, version, shared, declared }) => {
+	const key = `cloud.runtimeArchiveSha256.${runtime}`;
+	const sharedPins = shared[version];
+	if (declared !== void 0) {
+		if (sharedPins !== void 0) throw new Error(`the shared policy pins ${runtime} ${version} archives; remove ${key}`);
+		const pins = declared[version];
+		if (pins === void 0) throw new Error(`${key} pins ${Object.keys(declared).join(", ")}, but the repository selects ${runtime} ${version}; update it with the amd64 and arm64 values from ${runtimeArchiveManifests[runtime](version)}`);
+		return pins;
+	}
+	if (sharedPins === void 0) throw new Error(`the shared policy has no ${runtime} ${version} archive SHA256 pins; declare ${key} for ${version} with the amd64 and arm64 values from ${runtimeArchiveManifests[runtime](version)}`);
+	return sharedPins;
+};
 const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExceptions = [] }) => {
 	const selected = parseCloudSetup(cloud);
 	if (selected === void 0) throw new Error("cloud declaration is required");
 	const exactNode = nodeVersion.trim();
 	if ((0, semver.valid)(exactNode) !== exactNode || !nodeSelectorMatches(exactNode, policy.node)) throw new Error("cloud requires a tracked exact .node-version within the shared Node series");
+	const bunVersion = policy.bun;
+	const nodeArchiveSha256 = runtimeArchivePins({
+		runtime: "node",
+		version: exactNode,
+		shared: policy.nodeArchiveSha256,
+		declared: selected.runtimeArchiveSha256?.node
+	});
+	const bunArchiveSha256 = runtimeArchivePins({
+		runtime: "bun",
+		version: bunVersion,
+		shared: policy.bunArchiveSha256,
+		declared: selected.runtimeArchiveSha256?.bun
+	});
 	const toolchains = resolveCloudToolchains({
 		cloud: selected,
 		files,
@@ -1511,7 +1548,7 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 		["@NETWORK@", renderCloudNetwork()],
 		["@TOOL_INSTALL@", renderCloudToolInstall(toolchains) + renderCloudShellInstall({
 			nodeVersion: exactNode,
-			bunVersion: policy.bun,
+			bunVersion,
 			rust: toolchains.rust
 		})],
 		["@INPUT_VALIDATION@", ["rust-toolchain.toml", "rust-toolchain"].flatMap((file) => {
@@ -1520,8 +1557,12 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 			const hash = (0, node_crypto.createHash)("sha256").update(content).digest("hex");
 			return [`[[ -f ${shellQuote(file)} && ! -L ${shellQuote(file)} ]] && [[ "$(sha256sum -- ${shellQuote(file)} | cut -d ' ' -f1)" == ${shellQuote(hash)} ]] || fail ${shellQuote(`${file} changed; regenerate cloud-setup.sh`)}`];
 		}).concat(selected.tools?.["wasm-bindgen-cli"] === void 0 ? [] : [renderWasmBindgenLockValidation(selected.tools["wasm-bindgen-cli"])]).join("\n")],
-		["@BUN@", policy.bun],
+		["@BUN@", bunVersion],
 		["@NODE@", exactNode],
+		["@NODE_AMD64_SHA@", nodeArchiveSha256.amd64],
+		["@NODE_ARM64_SHA@", nodeArchiveSha256.arm64],
+		["@BUN_AMD64_SHA@", bunArchiveSha256.amd64],
+		["@BUN_ARM64_SHA@", bunArchiveSha256.arm64],
 		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
 		["@ENV_FUNCTIONS@", selected.envFile === void 0 ? "" : environmentFunctions],
 		["@ENVIRONMENT_VALUES@", selected.services.length === 0 ? "" : environmentValuesFunction],
@@ -1531,6 +1572,11 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 		["@SESSION_ENVIRONMENT_CALL@", selected.services.length === 0 ? "" : "if [[ \"$MODE\" == session ]]; then emit_session_environment; fi"],
 		["@ENV_WRITE@", selected.envFile === void 0 ? "" : "write_environment"],
 		["@PREPARE_FUNCTION@", renderPrepare(selected.prepare, files)],
+		["@SUBMODULE_FUNCTION@", selected.submodules ? String.raw`install_submodules() {
+  network_run github.com 240 runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" git submodule sync --recursive
+  network_run github.com 240 runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" git submodule update --init --recursive --depth 1
+}`.concat("\n\n") : ""],
+		["@SUBMODULE_STEP@", selected.submodules ? "  step submodules install_submodules\n" : ""],
 		["@PREPARE_STEP@", selected.prepare === void 0 ? "" : "  step prepare prepare_sources"],
 		["@SERVICE_INSTALL@", renderCloudServiceInstall({
 			services,
@@ -2122,6 +2168,12 @@ Object.defineProperty(exports, "nodeSupportRangeMatches", {
 		return nodeSupportRangeMatches;
 	}
 });
+Object.defineProperty(exports, "parseArchiveSha256", {
+	enumerable: true,
+	get: function() {
+		return parseArchiveSha256;
+	}
+});
 Object.defineProperty(exports, "parseCloudSetup", {
 	enumerable: true,
 	get: function() {