@stll/oxlint-config 2.0.0 → 2.1.0

package/README.md

@@ -492,6 +492,13 @@ it gets no network allowance. Generation fails when the script is not in the
 root `package.json`.
 
 Generation uses the installed policy's Bun, Node, PostgreSQL, and Valkey pins.
+Node and Bun archives are verified against SHA256 values recorded at generation
+time, in addition to the upstream checksum manifests. The shared policy records
+them for its own Node patch and Bun release. A repository that tracks another
+accepted Node patch or a newer Bun records that one release's amd64 and arm64
+values from the official `SHASUMS256.txt` in `cloud.runtimeArchiveSha256`, for
+example `{ "node": { "26.11.0": { "amd64": "…", "arm64": "…" } } }`; a release
+the shared policy pins must not be repeated there.
 PostgreSQL uses the PGDG major-version packages; minor updates within the pinned
 major are accepted for the disposable database. Before adding PGDG, provisioning
 reuses an existing source only after verifying its signing-key fingerprint;
@@ -1129,3 +1136,13 @@ closed and writes nothing unless both inputs normalize successfully.
 Use `stll-normalize-wasi-loaders --check <loader-1> <loader-2>` in CI. Check mode
 does not write files and exits non-zero if either loader differs from the normalized
 output.
+
+## Rust policy generation
+
+Run `bunx --no-install stll-rust-policy` at the repository root with
+`stll-rust-policy.json` containing `{ "kind": "single-crate" }`. Use
+`--check` in CI to report drift without writes and `--config <path>` to select
+another input. The published CLI embeds the canonical `rust/` templates and
+merges policy into Cargo, Cargo aliases, rustfmt, and Clippy configuration.
+Unrelated TOML values survive; comments and layout are canonicalized.
+See [Rust adoption](../../rust/README.md) for workspace members and exceptions.

package/dist/consumer-node-support.cjs

@@ -2,11 +2,11 @@ const require_rolldown_runtime = require("./rolldown-runtime.cjs");
 const require_toolchain_inputs = require("./toolchain-inputs.cjs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let picomatch = require("picomatch");
+picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 let semver = require("semver");
 let node_util = require("node:util");
 let yaml = require("yaml");
-let picomatch = require("picomatch");
-picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 //#region src/consumer-catalogs.ts
 const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const catalogMapping = (value, field) => {

package/dist/consumer-node-support.mjs

@@ -1,9 +1,9 @@
 import { g as workspaceContains } from "./toolchain-inputs.mjs";
 import path from "node:path";
+import picomatch from "picomatch";
 import { satisfies, valid, validRange } from "semver";
 import { isDeepStrictEqual } from "node:util";
 import { parseDocument } from "yaml";
-import picomatch from "picomatch";
 //#region src/consumer-catalogs.ts
 const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const catalogMapping = (value, field) => {

package/dist/dependabot.d.cts

@@ -65,9 +65,17 @@ type FormatterPolicy = {
 /** Reject unsupported or incomplete installed policies before inspecting a consumer. */
 export declare const parseToolchainPolicy: (input: unknown) => {
   bun: string;
+  bunArchiveSha256: Readonly<Record<string, {
+    readonly amd64: string;
+    readonly arm64: string;
+  }>>;
   formatter: FormatterPolicy;
   typescript: string;
   node: string;
+  nodeArchiveSha256: Readonly<Record<string, {
+    readonly amd64: string;
+    readonly arm64: string;
+  }>>;
   postgres: string;
   valkey: string;
   valkeyArtifacts: {

package/dist/dependabot.d.mts

@@ -65,9 +65,17 @@ type FormatterPolicy = {
 /** Reject unsupported or incomplete installed policies before inspecting a consumer. */
 export declare const parseToolchainPolicy: (input: unknown) => {
   bun: string;
+  bunArchiveSha256: Readonly<Record<string, {
+    readonly amd64: string;
+    readonly arm64: string;
+  }>>;
   formatter: FormatterPolicy;
   typescript: string;
   node: string;
+  nodeArchiveSha256: Readonly<Record<string, {
+    readonly amd64: string;
+    readonly arm64: string;
+  }>>;
   postgres: string;
   valkey: string;
   valkeyArtifacts: {

package/dist/git-tracked-output.cjs

@@ -1,8 +1,8 @@
 const require_rolldown_runtime = require("./rolldown-runtime.cjs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
-let node_child_process = require("node:child_process");
 let node_fs = require("node:fs");
+let node_child_process = require("node:child_process");
 let node_os = require("node:os");
 //#region src/git-tracked-output.ts
 /** Stream Git's file list to disk so consumer size cannot exhaust maxBuffer. */

package/dist/git-tracked-output.mjs

@@ -1,6 +1,6 @@
 import path from "node:path";
-import { execFileSync } from "node:child_process";
 import { closeSync, mkdtempSync, openSync, readFileSync, rmSync } from "node:fs";
+import { execFileSync } from "node:child_process";
 import { tmpdir } from "node:os";
 //#region src/git-tracked-output.ts
 /** Stream Git's file list to disk so consumer size cannot exhaust maxBuffer. */

package/dist/publish-contract-cli.cjs

@@ -9,8 +9,8 @@ const require_publish_artifact_syntax = require("./publish-artifact-syntax.cjs")
 const require_publish_build_target_vite_dts_helper = require("./publish-build-target-vite-dts-helper2.cjs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
-let node_child_process = require("node:child_process");
 let node_fs = require("node:fs");
+let node_child_process = require("node:child_process");
 let node_os = require("node:os");
 let node_module = require("node:module");
 let node_url = require("node:url");

package/dist/publish-contract-cli.mjs

@@ -7,8 +7,8 @@ import { a as resolveManifestContract, n as readPackedSyntaxFiles, r as checkPub
 import { n as reviewedViteDtsOptions, t as declarationOnlyDts } from "./publish-build-target-vite-dts-helper2.mjs";
 import { createRequire } from "node:module";
 import path from "node:path";
-import { execFileSync, spawnSync } from "node:child_process";
 import { existsSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { execFileSync, spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
 import { pathToFileURL } from "node:url";
 import { parse } from "acorn";

package/dist/quarantine-cli.cjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_quarantine_policy = require("./quarantine-policy2.cjs");
 const require_generated_file = require("./generated-file.cjs");
+const require_quarantine_policy = require("./quarantine-policy2.cjs");
 const require_toolchain_guard = require("./toolchain-guard.cjs");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/quarantine-cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { i as synchronizeRepositoryQuarantine, r as pruneRepositoryQuarantine, t as checkRepositoryQuarantine, u as resolveExpiryScope } from "./quarantine-policy2.mjs";
 import { n as generationDiagnostics, r as writeGeneratedFile, t as checkGeneratedOutput } from "./generated-file.mjs";
+import { i as synchronizeRepositoryQuarantine, r as pruneRepositoryQuarantine, t as checkRepositoryQuarantine, u as resolveExpiryScope } from "./quarantine-policy2.mjs";
 import { r as readToolchainInputs } from "./toolchain-guard.mjs";
 import { lstat, readFile, realpath } from "node:fs/promises";
 import { join } from "node:path";

package/dist/quarantine-policy2.cjs

@@ -1,7 +1,7 @@
 const require_jsonc = require("./jsonc.cjs");
-let node_child_process = require("node:child_process");
-let node_fs = require("node:fs");
 let smol_toml = require("smol-toml");
+let node_fs = require("node:fs");
+let node_child_process = require("node:child_process");
 //#region src/dated-entry-scope.ts
 /**
 * Decide one overdue entry. `unchangedAt` reports whether the base file text

package/dist/quarantine-policy2.mjs

@@ -1,7 +1,7 @@
 import { t as parseJsonc } from "./jsonc.mjs";
-import { execFileSync } from "node:child_process";
-import { readFileSync } from "node:fs";
 import { parse } from "smol-toml";
+import { readFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
 //#region src/dated-entry-scope.ts
 /**
 * Decide one overdue entry. `unchangedAt` reports whether the base file text