@stll/oxlint-config 2.0.0 → 2.1.1

package/README.md

@@ -492,6 +492,13 @@ it gets no network allowance. Generation fails when the script is not in the
 root `package.json`.
 
 Generation uses the installed policy's Bun, Node, PostgreSQL, and Valkey pins.
+Node and Bun archives are verified against SHA256 values recorded at generation
+time, in addition to the upstream checksum manifests. The shared policy records
+them for its own Node patch and Bun release. A repository that tracks another
+accepted Node patch or a newer Bun records that one release's amd64 and arm64
+values from the official `SHASUMS256.txt` in `cloud.runtimeArchiveSha256`, for
+example `{ "node": { "26.11.0": { "amd64": "…", "arm64": "…" } } }`; a release
+the shared policy pins must not be repeated there.
 PostgreSQL uses the PGDG major-version packages; minor updates within the pinned
 major are accepted for the disposable database. Before adding PGDG, provisioning
 reuses an existing source only after verifying its signing-key fingerprint;
@@ -703,7 +710,7 @@ including `engines`, are rejected. Real npm and pnpm pack tests compare the
 modeled contract with each tarball manifest.
 
 Build adapters use the installed configuration loaders and bind their behavior to
-tsdown 0.23.1, Vite 8.3.4, or @nuxt/module-builder 1.0.3 (unbuild 3.6.1 and
+tsdown 0.23.1, Vite 8.3.5, or @nuxt/module-builder 1.0.3 (unbuild 3.6.1 and
 mkdist 2.4.1). They record final transform targets, including separate Nuxt module
 and runtime entries. No syntax lowering records `esnext`.
 Only exact single build invocations (`tsdown`, `vite build`, or
@@ -1129,3 +1136,13 @@ closed and writes nothing unless both inputs normalize successfully.
 Use `stll-normalize-wasi-loaders --check <loader-1> <loader-2>` in CI. Check mode
 does not write files and exits non-zero if either loader differs from the normalized
 output.
+
+## Rust policy generation
+
+Run `bunx --no-install stll-rust-policy` at the repository root with
+`stll-rust-policy.json` containing `{ "kind": "single-crate" }`. Use
+`--check` in CI to report drift without writes and `--config <path>` to select
+another input. The published CLI embeds the canonical `rust/` templates and
+merges policy into Cargo, Cargo aliases, rustfmt, and Clippy configuration.
+Unrelated TOML values survive; comments and layout are canonicalized.
+See [Rust adoption](../../rust/README.md) for workspace members and exceptions.

package/dist/consumer-node-support.cjs

@@ -2,11 +2,11 @@ const require_rolldown_runtime = require("./rolldown-runtime.cjs");
 const require_toolchain_inputs = require("./toolchain-inputs.cjs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let picomatch = require("picomatch");
+picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 let semver = require("semver");
 let node_util = require("node:util");
 let yaml = require("yaml");
-let picomatch = require("picomatch");
-picomatch = require_rolldown_runtime.__toESM(picomatch, 1);
 //#region src/consumer-catalogs.ts
 const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const catalogMapping = (value, field) => {

package/dist/consumer-node-support.mjs

@@ -1,9 +1,9 @@
 import { g as workspaceContains } from "./toolchain-inputs.mjs";
 import path from "node:path";
+import picomatch from "picomatch";
 import { satisfies, valid, validRange } from "semver";
 import { isDeepStrictEqual } from "node:util";
 import { parseDocument } from "yaml";
-import picomatch from "picomatch";
 //#region src/consumer-catalogs.ts
 const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const catalogMapping = (value, field) => {

package/dist/dependabot.d.cts

@@ -65,9 +65,17 @@ type FormatterPolicy = {
 /** Reject unsupported or incomplete installed policies before inspecting a consumer. */
 export declare const parseToolchainPolicy: (input: unknown) => {
   bun: string;
+  bunArchiveSha256: Readonly<Record<string, {
+    readonly amd64: string;
+    readonly arm64: string;
+  }>>;
   formatter: FormatterPolicy;
   typescript: string;
   node: string;
+  nodeArchiveSha256: Readonly<Record<string, {
+    readonly amd64: string;
+    readonly arm64: string;
+  }>>;
   postgres: string;
   valkey: string;
   valkeyArtifacts: {

package/dist/dependabot.d.mts

@@ -65,9 +65,17 @@ type FormatterPolicy = {
 /** Reject unsupported or incomplete installed policies before inspecting a consumer. */
 export declare const parseToolchainPolicy: (input: unknown) => {
   bun: string;
+  bunArchiveSha256: Readonly<Record<string, {
+    readonly amd64: string;
+    readonly arm64: string;
+  }>>;
   formatter: FormatterPolicy;
   typescript: string;
   node: string;
+  nodeArchiveSha256: Readonly<Record<string, {
+    readonly amd64: string;
+    readonly arm64: string;
+  }>>;
   postgres: string;
   valkey: string;
   valkeyArtifacts: {

package/dist/git-tracked-output.cjs

@@ -1,8 +1,8 @@
 const require_rolldown_runtime = require("./rolldown-runtime.cjs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
-let node_child_process = require("node:child_process");
 let node_fs = require("node:fs");
+let node_child_process = require("node:child_process");
 let node_os = require("node:os");
 //#region src/git-tracked-output.ts
 /** Stream Git's file list to disk so consumer size cannot exhaust maxBuffer. */

package/dist/git-tracked-output.mjs

@@ -1,6 +1,6 @@
 import path from "node:path";
-import { execFileSync } from "node:child_process";
 import { closeSync, mkdtempSync, openSync, readFileSync, rmSync } from "node:fs";
+import { execFileSync } from "node:child_process";
 import { tmpdir } from "node:os";
 //#region src/git-tracked-output.ts
 /** Stream Git's file list to disk so consumer size cannot exhaust maxBuffer. */

package/dist/publish-contract-cli.cjs

@@ -9,8 +9,8 @@ const require_publish_artifact_syntax = require("./publish-artifact-syntax.cjs")
 const require_publish_build_target_vite_dts_helper = require("./publish-build-target-vite-dts-helper2.cjs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
-let node_child_process = require("node:child_process");
 let node_fs = require("node:fs");
+let node_child_process = require("node:child_process");
 let node_os = require("node:os");
 let node_module = require("node:module");
 let node_url = require("node:url");
@@ -244,7 +244,7 @@ export const resolve=(specifier,context,next)=>{
 };
 //#endregion
 //#region src/publish-build-target-vite.ts
-const supportedViteVersion = "8.3.4";
+const supportedViteVersion = "8.3.5";
 const declarationHelperImport = "@stll/oxlint-config/declaration-only-dts";
 const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const walkAst = ({ value, visit, parent }) => {