@stll/oxlint-config 2.0.0 → 2.1.1

package/dist/toolchain-inputs.mjs

@@ -1,10 +1,10 @@
 import path from "node:path";
 import { parse } from "smol-toml";
+import picomatch from "picomatch";
 import { createHash } from "node:crypto";
 import { subset, valid, validRange } from "semver";
 import { isDeepStrictEqual } from "node:util";
 import { parseDocument } from "yaml";
-import picomatch from "picomatch";
 //#region src/cloud-setup-install.ts
 const packageInstall = String.raw`
 # Prevent package maintainer scripts from starting unmanaged system services.
@@ -39,20 +39,20 @@ apt_install() (
   policy_state=installed
   printf '%s\n' '#!/bin/sh' 'exit 101' > /usr/sbin/policy-rc.d
   chmod 755 /usr/sbin/policy-rc.d
-  local package
+  # The network deadline covers downloads only; unpacking and maintainer scripts
+  # (for example locale generation or cluster creation) run offline afterwards.
+  DEBIAN_FRONTEND=noninteractive apt_network install -y --no-install-recommends --download-only "$@"
+  local package pending
   for package in "$@"; do
     if [[ "$package" == */* ]]; then
-      # apt cannot fetch local archives with --download-only, so their installs
-      # stay one call. Package triggers can be slow on cloud filesystems; the
-      # longer whole-call deadline covers them while Acquire timeouts still
-      # bound each network request.
-      APT_DEADLINE=600 DEBIAN_FRONTEND=noninteractive apt_network install -y --no-install-recommends "$@"
+      # apt rejects --no-download for local archives, so prove instead that
+      # only local file: archives remain; --print-uris reads local state only.
+      pending="$(set -o pipefail; DEBIAN_FRONTEND=noninteractive apt-get --print-uris -qq -y --no-install-recommends install "$@" | awk '$1 !~ /^\047file:/')"
+      [[ -z "$pending" ]] || fail "Package downloads remain after the bounded download step: $pending"
+      DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$@"
       return
     fi
   done
-  # The network deadline covers downloads only; unpacking and maintainer scripts
-  # (for example locale generation or cluster creation) run offline afterwards.
-  DEBIAN_FRONTEND=noninteractive apt_network install -y --no-install-recommends --download-only "$@"
   DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends --no-download "$@"
 )
 
@@ -334,6 +334,28 @@ apt_refresh_for() {
 }
 `;
 //#endregion
+//#region src/archive-pins.ts
+const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Parse a map from exact releases to their amd64 and arm64 archive SHA256 values. */
+const parseArchiveSha256 = (input, label) => {
+	if (input === void 0) return {};
+	if (!record$3(input)) throw new Error(`${label} must be a version map`);
+	const releases = {};
+	for (const [version, value] of Object.entries(input)) {
+		if (valid(version) !== version || !record$3(value)) throw new Error(`${label} requires exact release keys`);
+		const keys = Object.keys(value);
+		if (keys.length !== 2 || !keys.includes("amd64") || !keys.includes("arm64")) throw new Error(`${label} ${version} requires amd64 and arm64 pins`);
+		const amd64 = value["amd64"];
+		const arm64 = value["arm64"];
+		if (typeof amd64 !== "string" || typeof arm64 !== "string" || !/^[a-f0-9]{64}$/.test(amd64) || !/^[a-f0-9]{64}$/.test(arm64)) throw new Error(`${label} ${version} requires lowercase SHA256 pins`);
+		releases[version] = {
+			amd64,
+			arm64
+		};
+	}
+	return releases;
+};
+//#endregion
 //#region src/cloud-setup-artifacts.ts
 const wasmBindgen0126 = {
 	version: "0.2.126",
@@ -547,6 +569,20 @@ const parseTools = (input) => {
 	}
 	return result;
 };
+const cloudRuntimes = ["node", "bun"];
+const parseRuntimeArchives = (input) => {
+	if (input === void 0) return void 0;
+	if (!object(input) || Object.keys(input).some((key) => !cloudRuntimes.some((runtime) => runtime === key))) throw new Error("cloud.runtimeArchiveSha256 accepts only node and bun");
+	const result = {};
+	for (const runtime of cloudRuntimes) {
+		if (!Object.hasOwn(input, runtime)) continue;
+		const label = `cloud.runtimeArchiveSha256.${runtime}`;
+		const pins = parseArchiveSha256(input[runtime], label);
+		if (Object.keys(pins).length !== 1) throw new Error(`${label} pins exactly one release`);
+		result[runtime] = pins;
+	}
+	return result;
+};
 const cloudInstallCommand = "bun install --frozen-lockfile";
 const cloudInstallCommands = [cloudInstallCommand, `${cloudInstallCommand} --ignore-scripts`];
 const cloudInstall = (value) => cloudInstallCommands.some((command) => value === command);
@@ -575,16 +611,18 @@ const parsePrepare = (input) => {
 const parseCloudSetup = (input) => {
 	if (input === void 0) return void 0;
 	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error("cloud must be an object");
-	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile" && key !== "rust" && key !== "tools" && key !== "prepare" && key !== "submodules") throw new Error(`unsupported cloud key: ${key}`);
+	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile" && key !== "rust" && key !== "tools" && key !== "prepare" && key !== "submodules" && key !== "runtimeArchiveSha256") throw new Error(`unsupported cloud key: ${key}`);
 	const rust = parseRust("rust" in input ? input.rust : void 0);
 	const tools = parseTools("tools" in input ? input.tools : void 0);
 	const prepare = parsePrepare("prepare" in input ? input.prepare : void 0);
+	const runtimeArchiveSha256 = parseRuntimeArchives("runtimeArchiveSha256" in input ? input.runtimeArchiveSha256 : void 0);
 	const submodules = "submodules" in input ? input.submodules : false;
 	if (typeof submodules !== "boolean") throw new Error("cloud.submodules must be a boolean when provided");
 	const extensions = {
 		...rust === void 0 ? {} : { rust },
 		...tools === void 0 ? {} : { tools },
-		...prepare === void 0 ? {} : { prepare }
+		...prepare === void 0 ? {} : { prepare },
+		...runtimeArchiveSha256 === void 0 ? {} : { runtimeArchiveSha256 }
 	};
 	const selected = "services" in input ? input.services : [];
 	if (!Array.isArray(selected)) throw new Error("cloud.services must be an array when provided");
@@ -1152,8 +1190,8 @@ BUN_CACHE="/var/cache/stll-cloud/bun/$OUTPUT_UID"
 [[ "$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' "$REPO_ROOT/.node-version")" == "$NODE_VERSION" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'
 cd -- "$REPO_ROOT"
 case "$(uname -m)" in
-  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64 ;;
-  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64 ;;
+  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64; NODE_SHA256='@NODE_AMD64_SHA@'; BUN_SHA256='@BUN_AMD64_SHA@' ;;
+  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64; NODE_SHA256='@NODE_ARM64_SHA@'; BUN_SHA256='@BUN_ARM64_SHA@' ;;
   *) fail 'Only amd64 and arm64 are supported' ;;
 esac
 
@@ -1247,6 +1285,7 @@ install_runtimes() (
   if ! node_ready; then
     node_archive="node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz"
     download_file "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" "$scratch/$node_archive" 120
+    (cd "$scratch"; printf '%s  %s\n' "$NODE_SHA256" "$node_archive" | sha256sum --strict -c -)
     download_file "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" "$scratch/node-sums" 45
     (cd "$scratch"; awk -v name="$node_archive" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' node-sums | sha256sum --strict -c -)
     install -d -m 755 "$NODE_DIR"
@@ -1256,6 +1295,7 @@ install_runtimes() (
     bun_folder="bun-linux-$BUN_ARCH"
     bun_archive="$bun_folder.zip"
     download_file "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/$bun_archive" "$scratch/$bun_archive" 120
+    (cd "$scratch"; printf '%s  %s\n' "$BUN_SHA256" "$bun_archive" | sha256sum --strict -c -)
     download_file "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/SHASUMS256.txt" "$scratch/bun-sums" 45
     (cd "$scratch"; awk -v name="$bun_archive" '$2 == name || $2 == "*" name { print $1 "  " name; count++ } END { if (count != 1) exit 1 }' bun-sums | sha256sum --strict -c -)
     unzip -q "$scratch/$bun_archive" -d "$scratch/bun"
@@ -1459,11 +1499,40 @@ const renderPrepare = (prepare, files) => {
 		"}"
 	].join("\n");
 };
+const runtimeArchiveManifests = {
+	node: (version) => `https://nodejs.org/dist/v${version}/SHASUMS256.txt`,
+	bun: (version) => `https://github.com/oven-sh/bun/releases/download/bun-v${version}/SHASUMS256.txt`
+};
+const runtimeArchivePins = ({ runtime, version, shared, declared }) => {
+	const key = `cloud.runtimeArchiveSha256.${runtime}`;
+	const sharedPins = shared[version];
+	if (declared !== void 0) {
+		if (sharedPins !== void 0) throw new Error(`the shared policy pins ${runtime} ${version} archives; remove ${key}`);
+		const pins = declared[version];
+		if (pins === void 0) throw new Error(`${key} pins ${Object.keys(declared).join(", ")}, but the repository selects ${runtime} ${version}; update it with the amd64 and arm64 values from ${runtimeArchiveManifests[runtime](version)}`);
+		return pins;
+	}
+	if (sharedPins === void 0) throw new Error(`the shared policy has no ${runtime} ${version} archive SHA256 pins; declare ${key} for ${version} with the amd64 and arm64 values from ${runtimeArchiveManifests[runtime](version)}`);
+	return sharedPins;
+};
 const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExceptions = [] }) => {
 	const selected = parseCloudSetup(cloud);
 	if (selected === void 0) throw new Error("cloud declaration is required");
 	const exactNode = nodeVersion.trim();
 	if (valid(exactNode) !== exactNode || !nodeSelectorMatches(exactNode, policy.node)) throw new Error("cloud requires a tracked exact .node-version within the shared Node series");
+	const bunVersion = policy.bun;
+	const nodeArchiveSha256 = runtimeArchivePins({
+		runtime: "node",
+		version: exactNode,
+		shared: policy.nodeArchiveSha256,
+		declared: selected.runtimeArchiveSha256?.node
+	});
+	const bunArchiveSha256 = runtimeArchivePins({
+		runtime: "bun",
+		version: bunVersion,
+		shared: policy.bunArchiveSha256,
+		declared: selected.runtimeArchiveSha256?.bun
+	});
 	const toolchains = resolveCloudToolchains({
 		cloud: selected,
 		files,
@@ -1476,7 +1545,7 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 		["@NETWORK@", renderCloudNetwork()],
 		["@TOOL_INSTALL@", renderCloudToolInstall(toolchains) + renderCloudShellInstall({
 			nodeVersion: exactNode,
-			bunVersion: policy.bun,
+			bunVersion,
 			rust: toolchains.rust
 		})],
 		["@INPUT_VALIDATION@", ["rust-toolchain.toml", "rust-toolchain"].flatMap((file) => {
@@ -1485,8 +1554,12 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion, files = {}, rustExcept
 			const hash = createHash("sha256").update(content).digest("hex");
 			return [`[[ -f ${shellQuote(file)} && ! -L ${shellQuote(file)} ]] && [[ "$(sha256sum -- ${shellQuote(file)} | cut -d ' ' -f1)" == ${shellQuote(hash)} ]] || fail ${shellQuote(`${file} changed; regenerate cloud-setup.sh`)}`];
 		}).concat(selected.tools?.["wasm-bindgen-cli"] === void 0 ? [] : [renderWasmBindgenLockValidation(selected.tools["wasm-bindgen-cli"])]).join("\n")],
-		["@BUN@", policy.bun],
+		["@BUN@", bunVersion],
 		["@NODE@", exactNode],
+		["@NODE_AMD64_SHA@", nodeArchiveSha256.amd64],
+		["@NODE_ARM64_SHA@", nodeArchiveSha256.arm64],
+		["@BUN_AMD64_SHA@", bunArchiveSha256.amd64],
+		["@BUN_ARM64_SHA@", bunArchiveSha256.arm64],
 		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
 		["@ENV_FUNCTIONS@", selected.envFile === void 0 ? "" : environmentFunctions],
 		["@ENVIRONMENT_VALUES@", selected.services.length === 0 ? "" : environmentValuesFunction],
@@ -1948,6 +2021,6 @@ const toolchainInputKind = (file, text = "") => {
 	if (githubAutomationFileKind(file) !== void 0 || isShellScript(file, text) || /(?:^|\/)ci-service-images\.json$/.test(file) || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|consumer-compat\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
 };
 //#endregion
-export { cloudSetupPath as C, nodeSupportRangeMatches as D, nodeSelectorMatches as E, parseCloudSetup as O, mergeCloudClaudeSettings as S, nodePolicyValid as T, cloudAttributionFix as _, isFormatterConfigPath as a, hasCloudAttribution as b, isPythonDependencyManifest as c, pythonDependencyManifestKind as d, toolchainInputKind as f, workspaceContains as g, isKubernetesDefinitionPath as h, isDockerDefinitionPath as i, isShellScript as l, isComposeDefinitionPath as m, githubAutomationFileKind as n, isLefthookConfigPath as o, containerDocumentImages as p, isDependabotGithubActionsPath as r, isMiseConfigPath as s, dependabotManifestEcosystem as t, javascriptDependencyLockfiles as u, cloudClaudeSettingsPath as v, generateCloudSetup as w, hasCloudSessionStartHook as x, cloudSessionStartFix as y };
+export { cloudSetupPath as C, nodeSupportRangeMatches as D, nodeSelectorMatches as E, parseCloudSetup as O, mergeCloudClaudeSettings as S, nodePolicyValid as T, cloudAttributionFix as _, isFormatterConfigPath as a, hasCloudAttribution as b, isPythonDependencyManifest as c, pythonDependencyManifestKind as d, toolchainInputKind as f, workspaceContains as g, isKubernetesDefinitionPath as h, isDockerDefinitionPath as i, parseArchiveSha256 as k, isShellScript as l, isComposeDefinitionPath as m, githubAutomationFileKind as n, isLefthookConfigPath as o, containerDocumentImages as p, isDependabotGithubActionsPath as r, isMiseConfigPath as s, dependabotManifestEcosystem as t, javascriptDependencyLockfiles as u, cloudClaudeSettingsPath as v, generateCloudSetup as w, hasCloudSessionStartHook as x, cloudSessionStartFix as y };
 
 //# sourceMappingURL=toolchain-inputs.mjs.map