@stll/oxlint-config 1.9.0 → 2.1.0

package/dist/toolchain-inputs.mjs

@@ -1,10 +1,10 @@
 import path from "node:path";
 import { parse } from "smol-toml";
+import picomatch from "picomatch";
 import { createHash } from "node:crypto";
 import { subset, valid, validRange } from "semver";
 import { isDeepStrictEqual } from "node:util";
 import { parseDocument } from "yaml";
-import picomatch from "picomatch";
 //#region src/cloud-setup-install.ts
 const packageInstall = String.raw`
 # Prevent package maintainer scripts from starting unmanaged system services.
@@ -39,20 +39,20 @@ apt_install() (
   policy_state=installed
   printf '%s\n' '#!/bin/sh' 'exit 101' > /usr/sbin/policy-rc.d
   chmod 755 /usr/sbin/policy-rc.d
-  local package
+  # The network deadline covers downloads only; unpacking and maintainer scripts
+  # (for example locale generation or cluster creation) run offline afterwards.
+  DEBIAN_FRONTEND=noninteractive apt_network install -y --no-install-recommends --download-only "$@"
+  local package pending
   for package in "$@"; do
     if [[ "$package" == */* ]]; then
-      # apt cannot fetch local archives with --download-only, so their installs
-      # stay one call. Package triggers can be slow on cloud filesystems; the
-      # longer whole-call deadline covers them while Acquire timeouts still
-      # bound each network request.
-      APT_DEADLINE=600 DEBIAN_FRONTEND=noninteractive apt_network install -y --no-install-recommends "$@"
+      # apt rejects --no-download for local archives, so prove instead that
+      # only local file: archives remain; --print-uris reads local state only.
+      pending="$(set -o pipefail; DEBIAN_FRONTEND=noninteractive apt-get --print-uris -qq -y --no-install-recommends install "$@" | awk '$1 !~ /^\047file:/')"
+      [[ -z "$pending" ]] || fail "Package downloads remain after the bounded download step: $pending"
+      DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$@"
       return
     fi
   done
-  # The network deadline covers downloads only; unpacking and maintainer scripts
-  # (for example locale generation or cluster creation) run offline afterwards.
-  DEBIAN_FRONTEND=noninteractive apt_network install -y --no-install-recommends --download-only "$@"
   DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends --no-download "$@"
 )
 
@@ -334,6 +334,28 @@ apt_refresh_for() {
 }
 `;
 //#endregion
+//#region src/archive-pins.ts
+const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Parse a map from exact releases to their amd64 and arm64 archive SHA256 values. */
+const parseArchiveSha256 = (input, label) => {
+	if (input === void 0) return {};
+	if (!record$3(input)) throw new Error(`${label} must be a version map`);
+	const releases = {};
+	for (const [version, value] of Object.entries(input)) {
+		if (valid(version) !== version || !record$3(value)) throw new Error(`${label} requires exact release keys`);
+		const keys = Object.keys(value);
+		if (keys.length !== 2 || !keys.includes("amd64") || !keys.includes("arm64")) throw new Error(`${label} ${version} requires amd64 and arm64 pins`);
+		const amd64 = value["amd64"];
+		const arm64 = value["arm64"];
+		if (typeof amd64 !== "string" || typeof arm64 !== "string" || !/^[a-f0-9]{64}$/.test(amd64) || !/^[a-f0-9]{64}$/.test(arm64)) throw new Error(`${label} ${version} requires lowercase SHA256 pins`);
+		releases[version] = {
+			amd64,
+			arm64
+		};
+	}
+	return releases;
+};
+//#endregion
 //#region src/cloud-setup-artifacts.ts
 const wasmBindgen0126 = {
 	version: "0.2.126",
@@ -547,6 +569,20 @@ const parseTools = (input) => {
 	}
 	return result;
 };
+const cloudRuntimes = ["node", "bun"];
+const parseRuntimeArchives = (input) => {
+	if (input === void 0) return void 0;
+	if (!object(input) || Object.keys(input).some((key) => !cloudRuntimes.some((runtime) => runtime === key))) throw new Error("cloud.runtimeArchiveSha256 accepts only node and bun");
+	const result = {};
+	for (const runtime of cloudRuntimes) {
+		if (!Object.hasOwn(input, runtime)) continue;
+		const label = `cloud.runtimeArchiveSha256.${runtime}`;
+		const pins = parseArchiveSha256(input[runtime], label);
+		if (Object.keys(pins).length !== 1) throw new Error(`${label} pins exactly one release`);
+		result[runtime] = pins;
+	}
+	return result;
+};
 const cloudInstallCommand = "bun install --frozen-lockfile";
 const cloudInstallCommands = [cloudInstallCommand, `${cloudInstallCommand} --ignore-scripts`];
 const cloudInstall = (value) => cloudInstallCommands.some((command) => value === command);
@@ -575,14 +611,18 @@ const parsePrepare = (input) => {
 const parseCloudSetup = (input) => {
 	if (input === void 0) return void 0;
 	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error("cloud must be an object");
-	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile" && key !== "rust" && key !== "tools" && key !== "prepare") throw new Error(`unsupported cloud key: ${key}`);
+	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile" && key !== "rust" && key !== "tools" && key !== "prepare" && key !== "submodules" && key !== "runtimeArchiveSha256") throw new Error(`unsupported cloud key: ${key}`);
 	const rust = parseRust("rust" in input ? input.rust : void 0);
 	const tools = parseTools("tools" in input ? input.tools : void 0);
 	const prepare = parsePrepare("prepare" in input ? input.prepare : void 0);
+	const runtimeArchiveSha256 = parseRuntimeArchives("runtimeArchiveSha256" in input ? input.runtimeArchiveSha256 : void 0);
+	const submodules = "submodules" in input ? input.submodules : false;
+	if (typeof submodules !== "boolean") throw new Error("cloud.submodules must be a boolean when provided");
 	const extensions = {
 		...rust === void 0 ? {} : { rust },
 		...tools === void 0 ? {} : { tools },
-		...prepare === void 0 ? {} : { prepare }
+		...prepare === void 0 ? {} : { prepare },
+		...runtimeArchiveSha256 === void 0 ? {} : { runtimeArchiveSha256 }
 	};
 	const selected = "services" in input ? input.services : [];
 	if (!Array.isArray(selected)) throw new Error("cloud.services must be an array when provided");
@@ -599,6 +639,7 @@ const parseCloudSetup = (input) => {
 	return {
 		services,
 		install,
+		...submodules ? { submodules } : {},
 		...extensions,
 		...services.length === 0 ? {} : { envFile: parseEnvFile(input) }
 	};
@@ -1144,15 +1185,13 @@ NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
 BUN_DIR="/opt/stll-cloud/bun/$BUN_VERSION"
 export PATH="$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 BUN_CACHE="/var/cache/stll-cloud/bun/$OUTPUT_UID"
-DEPENDENCY_STATE_ROOT=/var/lib/stll-cloud
-DEPENDENCY_STAMP="$DEPENDENCY_STATE_ROOT/dependencies-$(printf '%s' "$REPO_ROOT" | sha256sum | cut -d' ' -f1).sha256"
 @ENV_ASSIGNMENTS@
 [[ -f "$REPO_ROOT/.node-version" && ! -L "$REPO_ROOT/.node-version" ]] || fail 'A regular root .node-version is required'
 [[ "$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' "$REPO_ROOT/.node-version")" == "$NODE_VERSION" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'
 cd -- "$REPO_ROOT"
 case "$(uname -m)" in
-  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64 ;;
-  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64 ;;
+  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64; NODE_SHA256='@NODE_AMD64_SHA@'; BUN_SHA256='@BUN_AMD64_SHA@' ;;
+  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64; NODE_SHA256='@NODE_ARM64_SHA@'; BUN_SHA256='@BUN_ARM64_SHA@' ;;
   *) fail 'Only amd64 and arm64 are supported' ;;
 esac
 
@@ -1246,6 +1285,7 @@ install_runtimes() (
   if ! node_ready; then
     node_archive="node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz"
     download_file "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" "$scratch/$node_archive" 120
+    (cd "$scratch"; printf '%s  %s\n' "$NODE_SHA256" "$node_archive" | sha256sum --strict -c -)
     download_file "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" "$scratch/node-sums" 45
     (cd "$scratch"; awk -v name="$node_archive" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' node-sums | sha256sum --strict -c -)
     install -d -m 755 "$NODE_DIR"
@@ -1255,6 +1295,7 @@ install_runtimes() (
     bun_folder="bun-linux-$BUN_ARCH"
     bun_archive="$bun_folder.zip"
     download_file "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/$bun_archive" "$scratch/$bun_archive" 120
+    (cd "$scratch"; printf '%s  %s\n' "$BUN_SHA256" "$bun_archive" | sha256sum --strict -c -)
     download_file "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/SHASUMS256.txt" "$scratch/bun-sums" 45
     (cd "$scratch"; awk -v name="$bun_archive" '$2 == name || $2 == "*" name { print $1 "  " name; count++ } END { if (count != 1) exit 1 }' bun-sums | sha256sum --strict -c -)
     unzip -q "$scratch/$bun_archive" -d "$scratch/bun"
@@ -1305,49 +1346,16 @@ process.stdout.write([...hosts].sort().join(","));
   network_run "$download_hosts" 240 runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" BUN_INSTALL_CACHE_DIR="$BUN_CACHE" PATH="$PATH" BUN_CONFIG_HTTP_IDLE_TIMEOUT=20 "$BUN_DIR/bun" @INSTALL_ARGS@
 }
 
-dependency_hash() {
-  [[ -f bun.lock && ! -L bun.lock ]] || fail 'A regular root bun.lock is required'
-  sha256sum -- bun.lock | cut -d ' ' -f1
-}
-prepare_dependency_state() {
-  [[ ! -L "$DEPENDENCY_STATE_ROOT" ]] || fail 'Dependency state root must not be a symlink'
-  if [[ -e "$DEPENDENCY_STATE_ROOT" ]]; then
-    [[ -d "$DEPENDENCY_STATE_ROOT" && "$(stat -c '%u:%a' "$DEPENDENCY_STATE_ROOT")" == 0:755 ]] || fail 'Invalid dependency state root'
-  else
-    install -d -m 755 -o root -g root "$DEPENDENCY_STATE_ROOT"
-  fi
-  [[ ! -L "$DEPENDENCY_STAMP" ]] || fail 'Dependency stamp must not be a symlink'
-  if [[ -e "$DEPENDENCY_STAMP" ]]; then
-    [[ -f "$DEPENDENCY_STAMP" && "$(stat -c '%u:%a' "$DEPENDENCY_STAMP")" == 0:644 ]] || fail 'Invalid dependency stamp'
-  fi
-}
-write_dependency_stamp() {
-  local temporary
-  prepare_dependency_state
-  temporary="$(mktemp "$DEPENDENCY_STATE_ROOT/.dependencies.XXXXXX")"
-  chmod 644 "$temporary"
-  dependency_hash > "$temporary"
-  mv -f -- "$temporary" "$DEPENDENCY_STAMP"
-}
+# The frozen install is the check: it reads every input the package manager
+# uses and changes nothing on a current tree, so no stamp stands in for it.
 install_dependencies() {
-  prepare_dependency_state
-  rm -f -- "$DEPENDENCY_STAMP"
   dependency_install
-  write_dependency_stamp
 }
 sync_dependencies() {
-  local expected installed=''
-  prepare_dependency_state
-  expected="$(dependency_hash)"
-  if [[ -f "$DEPENDENCY_STAMP" ]]; then IFS= read -r installed < "$DEPENDENCY_STAMP" || true; fi
-  # The stamp describes an installation; without node_modules there is none.
-  [[ "$installed" == "$expected" && -d "$REPO_ROOT/node_modules" ]] && return
-  rm -f -- "$DEPENDENCY_STAMP"
   dependency_install || fail 'bun.lock mismatch; dependency installation failed'
-  write_dependency_stamp
 }
 
-@SERVICE_INSTALL@
+@SUBMODULE_FUNCTION@@SERVICE_INSTALL@
 @SERVICE_START@
 
 @TOOL_INSTALL@
@@ -1367,7 +1375,7 @@ if [[ "$MODE" == install ]]; then
   step shell install_shell_environment
   # Login routes read the installed profile, so they are checked after it.
   step routes verify_bun_routes
-  step dependencies install_dependencies
+@SUBMODULE_STEP@  step dependencies install_dependencies
 @PREPARE_STEP@
   exit 0
 fi
@@ -1491,11 +1499,40 @@ const renderPrepare = (prepare, files) => {
 		"}"
 	].join("\n");
 };
+const runtimeArchiveManifests = {
+	node: (version) => `https://nodejs.org/dist/v${version}/SHASUMS256.txt`,
+	bun: (version) => `https://github.com/oven-sh/bun/releases/download/bun-v${version}/SHASUMS256.txt`
+};
+const runtimeArchivePins = ({ runtime, version, shared, declared }) => {
+	const key = `cloud.runtimeArchiveSha256.${runtime}`;
+	const sharedPins = shared[version];
+	if (declared !== void 0) {
+		if (sharedPins !== void 0) throw new Error(`the shared policy pins ${runtime} ${version} archives; remove ${key}`);
+		const pins = declared[version];
+		if (pins === void 0) throw new Error(`${key} pins ${Object.keys(declared).join(", ")}, but the repository selects ${runtime} ${version}; update it with the amd64 and arm64 values from ${runtimeArchiveManifests[runtime](version)}`);
+		return pins;
+	}
+	if (sharedPins === void 0) throw new Error(`the shared policy has no ${runtime} ${version} archive SHA256 pins; declare ${key} for ${version} with the amd64 and arm64 values from ${runtimeArchiveManifests[runtime](version)}`);
+	return sharedPins;
+};
 const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExceptions = [] }) => {
 	const selected = parseCloudSetup(cloud);
 	if (selected === void 0) throw new Error("cloud declaration is required");
 	const exactNode = nodeVersion.trim();
 	if (valid(exactNode) !== exactNode || !nodeSelectorMatches(exactNode, policy.node)) throw new Error("cloud requires a tracked exact .node-version within the shared Node series");
+	const bunVersion = policy.bun;
+	const nodeArchiveSha256 = runtimeArchivePins({
+		runtime: "node",
+		version: exactNode,
+		shared: policy.nodeArchiveSha256,
+		declared: selected.runtimeArchiveSha256?.node
+	});
+	const bunArchiveSha256 = runtimeArchivePins({
+		runtime: "bun",
+		version: bunVersion,
+		shared: policy.bunArchiveSha256,
+		declared: selected.runtimeArchiveSha256?.bun
+	});
 	const toolchains = resolveCloudToolchains({
 		cloud: selected,
 		files,
@@ -1508,7 +1545,7 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 		["@NETWORK@", renderCloudNetwork()],
 		["@TOOL_INSTALL@", renderCloudToolInstall(toolchains) + renderCloudShellInstall({
 			nodeVersion: exactNode,
-			bunVersion: policy.bun,
+			bunVersion,
 			rust: toolchains.rust
 		})],
 		["@INPUT_VALIDATION@", ["rust-toolchain.toml", "rust-toolchain"].flatMap((file) => {
@@ -1517,8 +1554,12 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 			const hash = createHash("sha256").update(content).digest("hex");
 			return [`[[ -f ${shellQuote(file)} && ! -L ${shellQuote(file)} ]] && [[ "$(sha256sum -- ${shellQuote(file)} | cut -d ' ' -f1)" == ${shellQuote(hash)} ]] || fail ${shellQuote(`${file} changed; regenerate cloud-setup.sh`)}`];
 		}).concat(selected.tools?.["wasm-bindgen-cli"] === void 0 ? [] : [renderWasmBindgenLockValidation(selected.tools["wasm-bindgen-cli"])]).join("\n")],
-		["@BUN@", policy.bun],
+		["@BUN@", bunVersion],
 		["@NODE@", exactNode],
+		["@NODE_AMD64_SHA@", nodeArchiveSha256.amd64],
+		["@NODE_ARM64_SHA@", nodeArchiveSha256.arm64],
+		["@BUN_AMD64_SHA@", bunArchiveSha256.amd64],
+		["@BUN_ARM64_SHA@", bunArchiveSha256.arm64],
 		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
 		["@ENV_FUNCTIONS@", selected.envFile === void 0 ? "" : environmentFunctions],
 		["@ENVIRONMENT_VALUES@", selected.services.length === 0 ? "" : environmentValuesFunction],
@@ -1528,6 +1569,11 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 		["@SESSION_ENVIRONMENT_CALL@", selected.services.length === 0 ? "" : "if [[ \"$MODE\" == session ]]; then emit_session_environment; fi"],
 		["@ENV_WRITE@", selected.envFile === void 0 ? "" : "write_environment"],
 		["@PREPARE_FUNCTION@", renderPrepare(selected.prepare, files)],
+		["@SUBMODULE_FUNCTION@", selected.submodules ? String.raw`install_submodules() {
+  network_run github.com 240 runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" git submodule sync --recursive
+  network_run github.com 240 runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" git submodule update --init --recursive --depth 1
+}`.concat("\n\n") : ""],
+		["@SUBMODULE_STEP@", selected.submodules ? "  step submodules install_submodules\n" : ""],
 		["@PREPARE_STEP@", selected.prepare === void 0 ? "" : "  step prepare prepare_sources"],
 		["@SERVICE_INSTALL@", renderCloudServiceInstall({
 			services,
@@ -1975,6 +2021,6 @@ const toolchainInputKind = (file, text = "") => {
 	if (githubAutomationFileKind(file) !== void 0 || isShellScript(file, text) || /(?:^|\/)ci-service-images\.json$/.test(file) || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|consumer-compat\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
 };
 //#endregion
-export { cloudSetupPath as C, nodeSupportRangeMatches as D, nodeSelectorMatches as E, parseCloudSetup as O, mergeCloudClaudeSettings as S, nodePolicyValid as T, cloudAttributionFix as _, isFormatterConfigPath as a, hasCloudAttribution as b, isPythonDependencyManifest as c, pythonDependencyManifestKind as d, toolchainInputKind as f, workspaceContains as g, isKubernetesDefinitionPath as h, isDockerDefinitionPath as i, isShellScript as l, isComposeDefinitionPath as m, githubAutomationFileKind as n, isLefthookConfigPath as o, containerDocumentImages as p, isDependabotGithubActionsPath as r, isMiseConfigPath as s, dependabotManifestEcosystem as t, javascriptDependencyLockfiles as u, cloudClaudeSettingsPath as v, generateCloudSetup as w, hasCloudSessionStartHook as x, cloudSessionStartFix as y };
+export { cloudSetupPath as C, nodeSupportRangeMatches as D, nodeSelectorMatches as E, parseCloudSetup as O, mergeCloudClaudeSettings as S, nodePolicyValid as T, cloudAttributionFix as _, isFormatterConfigPath as a, hasCloudAttribution as b, isPythonDependencyManifest as c, pythonDependencyManifestKind as d, toolchainInputKind as f, workspaceContains as g, isKubernetesDefinitionPath as h, isDockerDefinitionPath as i, parseArchiveSha256 as k, isShellScript as l, isComposeDefinitionPath as m, githubAutomationFileKind as n, isLefthookConfigPath as o, containerDocumentImages as p, isDependabotGithubActionsPath as r, isMiseConfigPath as s, dependabotManifestEcosystem as t, javascriptDependencyLockfiles as u, cloudClaudeSettingsPath as v, generateCloudSetup as w, hasCloudSessionStartHook as x, cloudSessionStartFix as y };
 
 //# sourceMappingURL=toolchain-inputs.mjs.map