@venn-lang/project 0.1.0

package/src/model/project.types.ts

@@ -0,0 +1,55 @@
+import type { BuildTarget, Manifest } from "@venn-lang/contracts";
+
+/**
+ * A package on disk: one `venn.toml`, and what it turned out to describe.
+ *
+ * `targets` is what the manifest declared plus what the conventions filled in.
+ * The difference between the two matters to whoever writes a manifest and to
+ * nobody downstream, so it is settled here rather than carried further.
+ */
+export interface Package {
+  /** The directory holding the `venn.toml`, with no trailing separator. */
+  dir: string;
+  manifest: Manifest;
+  targets: readonly BuildTarget[];
+}
+
+/**
+ * What a command is acting on: one root, and every package under it.
+ *
+ * A lone package is a workspace of one, so nothing downstream has to ask which
+ * it is. `isWorkspace` is for the two places that genuinely differ: where
+ * `target/` goes, and what a bare command means.
+ */
+export interface Project {
+  /** The workspace root, or the package's own directory when there is none. */
+  root: string;
+  isWorkspace: boolean;
+  /**
+   * The manifest at the root, carried whether or not the root is a package.
+   *
+   * A workspace root often declares no `[package]` at all and still carries the
+   * `[env]` tables and path aliases everything under it uses, so it cannot be
+   * inferred from the member list.
+   */
+  rootManifest: Manifest;
+  /** Every member, in the order the globs found them. A lone package is one. */
+  packages: readonly Package[];
+  /** What a command with no target acts on: `default-members`, or all of them. */
+  defaultPackages: readonly Package[];
+}
+
+/** Reading a project failed, and why. Never a raw error from the disk. */
+export interface ProjectProblem {
+  code: string;
+  title: string;
+  /** The path the problem is about, when there is one. */
+  path?: string;
+}
+
+/** The result of a lookup: the project, or why there is none. */
+export interface FoundProject {
+  /** Absent when no manifest was found, in which case `problems` says so. */
+  project?: Project;
+  problems: readonly ProjectProblem[];
+}

package/src/npm/hash-package.ts

@@ -0,0 +1,65 @@
+import type { FileSystem } from "@venn-lang/contracts";
+import { join } from "../paths/index.js";
+
+/** Directories inside a package that are not part of it. */
+const SKIP = new Set(["node_modules", ".git", ".bin"]);
+
+/**
+ * A hash of everything a package installed.
+ *
+ * Not the registry's integrity hash, which lives in each manager's own lock in
+ * each manager's format. This is computed from what landed on disk, which every
+ * manager produces the same way. The guarantee differs: the registry's hash
+ * says "this is the tarball that was served", this one says "this is the tree
+ * that was installed when the lock was written". Trust on first use, and any
+ * divergence after that is caught.
+ *
+ * A hash of hashes rather than of the concatenated bytes, because a package can
+ * hold tens of megabytes and digesting it in one buffer costs more than the
+ * answer is worth.
+ *
+ * @param args.dir The installed package directory.
+ * @returns `sha256-…` over every file under `dir`, sorted by path, with
+ * `node_modules`, `.git` and `.bin` skipped. A file that cannot be read is left
+ * out rather than raising.
+ */
+export async function hashPackage(args: { fs: FileSystem; dir: string }): Promise<string> {
+  const files = (await filesUnder(args.fs, args.dir, "")).sort();
+  const lines: string[] = [];
+  for (const path of files) {
+    // Deliberately unguarded: the walk above already found this file, so a read
+    // that fails is a real fault. Skipping it would hash a subset of the tree
+    // and call it the tree, which is the one answer this function must not give.
+    const bytes = await args.fs.read(join(args.dir, path));
+    lines.push(`${path}\t${await digest(bytes)}`);
+  }
+  return `sha256-${await digest(new TextEncoder().encode(lines.join("\n")))}`;
+}
+
+async function filesUnder(fs: FileSystem, root: string, at: string): Promise<string[]> {
+  const found: string[] = [];
+  for (const entry of await fs.list(join(root, at))) {
+    const path = at === "" ? entry.name : `${at}/${entry.name}`;
+    if (!entry.directory) found.push(path);
+    else if (!SKIP.has(entry.name)) found.push(...(await filesUnder(fs, root, path)));
+  }
+  return found;
+}
+
+/**
+ * Web Crypto, so this runs wherever the rest of this package runs.
+ *
+ * The assertion narrows which buffer backs the array rather than claiming the
+ * array is a buffer: `BufferSource` wants a view onto an `ArrayBuffer`, and
+ * these come from a file read and from `TextEncoder`, both of which give one.
+ */
+async function digest(bytes: Uint8Array): Promise<string> {
+  const hashed = await crypto.subtle.digest("SHA-256", bytes as Uint8Array<ArrayBuffer>);
+  return base64(new Uint8Array(hashed));
+}
+
+function base64(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}

package/src/npm/index.ts

@@ -0,0 +1,12 @@
+export { hashPackage } from "./hash-package.js";
+export { readLockfile, writeLockfile } from "./lockfile.js";
+export { LOCK_FILE, LOCK_VERSION, type LockedPackage, type Lockfile } from "./lockfile.types.js";
+export {
+  isSafeSpec,
+  type ManagerCommand,
+  managerCommand,
+  type ProxiedVerb,
+} from "./manager-command.js";
+export { packageJsonFor } from "./package-json.js";
+export { readInstalled } from "./read-installed.js";
+export { type Drift, describeDrift, verifyLock } from "./verify-lock.js";

package/src/npm/lockfile.ts

@@ -0,0 +1,49 @@
+import type { FileSystem } from "@venn-lang/contracts";
+import { join } from "../paths/index.js";
+import { LOCK_FILE, LOCK_VERSION, type Lockfile } from "./lockfile.types.js";
+import { readInstalled } from "./read-installed.js";
+
+/**
+ * Writes `venn.lock` from what is installed.
+ *
+ * It goes at the project root, beside the manifest, and is meant to be
+ * committed. The manager's own lock stays inside `target/`, which is derived
+ * and thrown away.
+ *
+ * @param args.manager Which tool did the resolving, recorded in the file.
+ * @returns The lock as written.
+ * @throws Whatever the file system raises when the write fails.
+ */
+export async function writeLockfile(args: {
+  fs: FileSystem;
+  root: string;
+  manager: string;
+}): Promise<Lockfile> {
+  const lock: Lockfile = {
+    version: LOCK_VERSION,
+    manager: args.manager,
+    packages: await readInstalled({ fs: args.fs, root: args.root }),
+  };
+  const text = `${JSON.stringify(lock, null, 2)}\n`;
+  await args.fs.write(join(args.root, LOCK_FILE), new TextEncoder().encode(text));
+  return lock;
+}
+
+/**
+ * Reads the lock this project committed.
+ *
+ * @returns The lock, or `undefined` when the file is absent or will not parse.
+ * A lock nobody can read is a project without one, which `install` can fix.
+ */
+export async function readLockfile(args: {
+  fs: FileSystem;
+  root: string;
+}): Promise<Lockfile | undefined> {
+  const bytes = await args.fs.read(join(args.root, LOCK_FILE)).catch(() => undefined);
+  if (!bytes) return undefined;
+  try {
+    return JSON.parse(new TextDecoder().decode(bytes)) as Lockfile;
+  } catch {
+    return undefined;
+  }
+}

package/src/npm/lockfile.types.ts

@@ -0,0 +1,42 @@
+/** One package that ended up installed. */
+export interface LockedPackage {
+  name: string;
+  version: string;
+  /**
+   * `sha256-…` over the files this package installed.
+   *
+   * Not the registry's integrity hash, which lives in each manager's own lock
+   * in each manager's format. This is computed from what landed on disk and
+   * catches any divergence from the moment the lock was written. Absent in a
+   * lock written before hashes existed. See `hashPackage`.
+   */
+  integrity?: string;
+  /** What it says it needs, so the graph can be read without the disk. */
+  dependencies?: Record<string, string>;
+}
+
+/**
+ * `venn.lock`: what this project resolved to, in a form no tool owns.
+ *
+ * Read from what is actually installed rather than translated out of whichever
+ * manager's lock produced it, because tracking three formats that change
+ * without asking would mean two machines building different things the day the
+ * translation drifts.
+ *
+ * It pins the exact version of every package and a hash of the files each one
+ * installed, so `venn install --frozen` can refuse a tree that has drifted,
+ * whether a registry answered differently or something was changed by hand.
+ */
+export interface Lockfile {
+  version: 1;
+  /** Which tool did the resolving. The answer can differ between them. */
+  manager: string;
+  /** Every package installed, in name order. */
+  packages: readonly LockedPackage[];
+}
+
+/** The lock file's name, at the project root beside the manifest. */
+export const LOCK_FILE = "venn.lock";
+
+/** The format version written into every lock. */
+export const LOCK_VERSION = 1;

package/src/npm/manager-command.ts

@@ -0,0 +1,85 @@
+import type { PackageManagerName } from "@venn-lang/contracts";
+
+/** The four verbs Venn proxies to whichever package manager the project chose. */
+export type ProxiedVerb = "add" | "remove" | "update" | "install";
+
+/** A package manager invocation, ready to spawn. */
+export interface ManagerCommand {
+  command: string;
+  args: readonly string[];
+  /**
+   * Whether it has to go through a shell.
+   *
+   * Every one of these managers ships as a script, and on Windows that means a
+   * `.cmd`, which Node refuses to spawn directly because `.cmd` files were used
+   * to slip arguments past programs that believed they were spawning an
+   * executable. So a shell it is, and because a shell re-reads what it is
+   * handed, what goes in is checked first. See {@link isSafeSpec}.
+   */
+  shell: boolean;
+}
+
+/**
+ * The command a verb becomes, in the manager this project chose.
+ *
+ * The interface is ours, the resolution is not: working out which versions
+ * satisfy which ranges is years of work against three moving targets, so the
+ * four verbs are spelled once here and handed to the tool the project named.
+ *
+ * @param args.packages Specifiers to act on. Pass each through
+ * {@link isSafeSpec} first when `shell` comes back `true`.
+ * @returns The command, its arguments, and whether a shell is required.
+ */
+export function managerCommand(args: {
+  manager: PackageManagerName;
+  verb: ProxiedVerb;
+  packages?: readonly string[];
+  dev?: boolean;
+  /** `process.platform`. It decides whether a shell is needed. */
+  platform: string;
+}): ManagerCommand {
+  // `-D` means "a development dependency" in every one of them.
+  const dev = args.dev ? ["-D"] : [];
+  return {
+    command: args.manager,
+    args: [verbFor(args), ...dev, ...(args.packages ?? [])],
+    shell: args.platform === "win32",
+  };
+}
+
+/** npm spells `add` and `remove` its own way; every other manager agrees. */
+function verbFor(args: { manager: PackageManagerName; verb: ProxiedVerb }): string {
+  return args.manager === "npm" ? NPM[args.verb] : NON_NPM[args.verb];
+}
+
+const NON_NPM: Record<ProxiedVerb, string> = {
+  add: "add",
+  remove: "remove",
+  update: "update",
+  install: "install",
+};
+
+const NPM: Record<ProxiedVerb, string> = {
+  add: "install",
+  remove: "uninstall",
+  update: "update",
+  install: "install",
+};
+
+/** A package name, optionally scoped, optionally with a version range. */
+const SPEC = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*(@[A-Za-z0-9.^~><=*-]+)?$/;
+
+/**
+ * Whether a string is a package specifier and nothing else.
+ *
+ * The command goes through a shell on Windows, and a shell reads `&`, `|` and
+ * `>` as instructions rather than text, so `venn add "x & del /q ."` would
+ * delete a directory while looking like an install. A real package name holds
+ * none of those characters, so checking costs nothing and closes the hole
+ * instead of documenting it.
+ *
+ * @returns `true` when the string is safe to hand to a shell.
+ */
+export function isSafeSpec(spec: string): boolean {
+  return SPEC.test(spec);
+}

package/src/npm/package-json.ts

@@ -0,0 +1,59 @@
+import type { Dependency, Manifest } from "@venn-lang/contracts";
+
+/**
+ * The `package.json` a package manager is shown, generated from `venn.toml`.
+ *
+ * Nobody edits it and nobody commits it: the manifest is the source, this is
+ * what the tool underneath happens to read. It is written into `target/`, and
+ * that placement is the whole trick: a manager writes `node_modules` beside the
+ * `package.json` it was pointed at, so the modules land in
+ * `target/node_modules` with nothing fighting anything.
+ *
+ * @param args.members Their dependencies are merged in too, when the root is a
+ * workspace.
+ * @returns The file's text, marked private, with path dependencies left out and
+ * `[patch]` turned into `overrides`.
+ */
+export function packageJsonFor(args: {
+  manifest: Manifest;
+  /** Every member's dependencies as well, when the root is a workspace. */
+  members?: readonly Manifest[];
+}): string {
+  const all = [args.manifest, ...(args.members ?? [])];
+  const body = {
+    name: `${args.manifest.name || "venn-project"}-target`,
+    private: true,
+    type: "module",
+    dependencies: merged(all.flatMap((one) => one.dependencies)),
+    devDependencies: merged(all.flatMap((one) => one.devDependencies)),
+    ...overrides(args.manifest.patch),
+  };
+  return `${JSON.stringify(body, null, 2)}\n`;
+}
+
+/**
+ * The versions asked for, by name.
+ *
+ * A dependency on a path is not the package manager's business: it is another
+ * package in this workspace, resolved by the language, and handing it over as a
+ * version range would send the tool looking for it in the registry.
+ */
+function merged(deps: readonly Dependency[]): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const dep of deps) {
+    if (dep.path !== undefined) continue;
+    out[dep.name] = dep.version ?? "*";
+  }
+  return sorted(out);
+}
+
+/** `[patch]`: the version this project insists on, wherever it is asked for. */
+function overrides(patch: readonly Dependency[]): { overrides?: Record<string, string> } {
+  const found = merged(patch);
+  return Object.keys(found).length > 0 ? { overrides: found } : {};
+}
+
+/** Written in name order, so regenerating it produces no diff of its own. */
+function sorted(entries: Record<string, string>): Record<string, string> {
+  return Object.fromEntries(Object.entries(entries).sort(([a], [b]) => a.localeCompare(b)));
+}

package/src/npm/read-installed.ts

@@ -0,0 +1,72 @@
+import type { FileSystem } from "@venn-lang/contracts";
+import { join } from "../paths/index.js";
+import { modulesDir } from "../target/index.js";
+import { hashPackage } from "./hash-package.js";
+import type { LockedPackage } from "./lockfile.types.js";
+
+/**
+ * Every package installed, read from `target/node_modules`.
+ *
+ * The installed tree is the strongest statement there is about what a project
+ * resolved to: it is what will actually be imported, whichever tool put it
+ * there and whatever that tool's own lock says. One walk, the same for every
+ * manager. A scope is a directory of packages rather than a package, so
+ * `@types/node` is found one level further down.
+ *
+ * @param args.root The project root, not the modules directory.
+ * @returns Every package with its version and content hash, in name order.
+ * Dot-directories and anything without a readable `package.json` are skipped,
+ * because a directory that is not a package is not a package.
+ */
+export async function readInstalled(args: {
+  fs: FileSystem;
+  root: string;
+}): Promise<LockedPackage[]> {
+  const modules = modulesDir(args.root);
+  const found: LockedPackage[] = [];
+  for (const entry of await args.fs.list(modules)) {
+    if (!entry.directory || entry.name.startsWith(".")) continue;
+    if (entry.name.startsWith("@")) found.push(...(await scoped(args.fs, modules, entry.name)));
+    else pushIf(found, await readPackage(args.fs, join(modules, entry.name)));
+  }
+  return found.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+async function scoped(fs: FileSystem, modules: string, scope: string): Promise<LockedPackage[]> {
+  const found: LockedPackage[] = [];
+  for (const entry of await fs.list(join(modules, scope))) {
+    if (entry.directory) pushIf(found, await readPackage(fs, join(modules, scope, entry.name)));
+  }
+  return found;
+}
+
+function pushIf(into: LockedPackage[], one: LockedPackage | undefined): void {
+  if (one) into.push(one);
+}
+
+async function readPackage(fs: FileSystem, dir: string): Promise<LockedPackage | undefined> {
+  const bytes = await fs.read(join(dir, "package.json")).catch(() => undefined);
+  if (!bytes) return undefined;
+  const data = parse(new TextDecoder().decode(bytes));
+  if (typeof data?.name !== "string" || typeof data.version !== "string") return undefined;
+  return {
+    name: data.name,
+    version: data.version,
+    integrity: await hashPackage({ fs, dir }),
+    ...deps(data.dependencies),
+  };
+}
+
+function deps(value: unknown): { dependencies?: Record<string, string> } {
+  if (typeof value !== "object" || value === null) return {};
+  const entries = Object.entries(value as Record<string, unknown>).map(([k, v]) => [k, String(v)]);
+  return entries.length > 0 ? { dependencies: Object.fromEntries(entries) } : {};
+}
+
+function parse(text: string): Record<string, unknown> | undefined {
+  try {
+    return JSON.parse(text) as Record<string, unknown>;
+  } catch {
+    return undefined;
+  }
+}

package/src/npm/verify-lock.ts

@@ -0,0 +1,78 @@
+import type { FileSystem } from "@venn-lang/contracts";
+import type { Lockfile } from "./lockfile.types.js";
+import { readInstalled } from "./read-installed.js";
+
+/** How one package differs from what the lock recorded. */
+export interface Drift {
+  name: string;
+  /**
+   * In the lock but absent, installed but not locked, a different version, or
+   * the same version with different files.
+   */
+  kind: "missing" | "unexpected" | "version" | "contents";
+  /** What the lock recorded: a version, or an `integrity` hash. */
+  expected?: string;
+  /** What is on disk, when the two can be compared side by side. */
+  found?: string;
+}
+
+/**
+ * Checks what is installed against what the lock says should be.
+ *
+ * This is what the hashes are for. Checked, they turn a registry that answered
+ * differently today, or a file edited by hand inside `node_modules`, into
+ * something a build refuses to start with rather than something found in
+ * production.
+ *
+ * @returns One `Drift` per difference, empty when the tree matches. A lock
+ * entry carrying no `integrity` is not checked for contents, so a lock written
+ * before hashes existed still passes.
+ */
+export async function verifyLock(args: {
+  fs: FileSystem;
+  root: string;
+  lock: Lockfile;
+}): Promise<Drift[]> {
+  const installed = await readInstalled({ fs: args.fs, root: args.root });
+  const byName = new Map(installed.map((one) => [one.name, one]));
+  const drift = args.lock.packages.flatMap((locked) => compare(locked, byName.get(locked.name)));
+  const expected = new Set(args.lock.packages.map((one) => one.name));
+  const extra = installed.filter((one) => !expected.has(one.name));
+  return [...drift, ...extra.map((one) => ({ name: one.name, kind: "unexpected" as const }))];
+}
+
+type Locked = Lockfile["packages"][number];
+
+function compare(locked: Locked, found: Locked | undefined): Drift[] {
+  if (!found) return [{ name: locked.name, kind: "missing", expected: locked.version }];
+  if (found.version !== locked.version) {
+    return [{ name: locked.name, kind: "version", expected: locked.version, found: found.version }];
+  }
+  // Only when the lock carried one. A lock written before hashes existed is
+  // still a lock, and refusing it would break a project for being older.
+  if (locked.integrity && found.integrity !== locked.integrity) {
+    return [{ name: locked.name, kind: "contents", expected: locked.integrity }];
+  }
+  return [];
+}
+
+/**
+ * Renders drift for a person to read.
+ *
+ * @returns One indented line per package that differs, in the voice of what
+ * went wrong. Empty for an empty list.
+ */
+export function describeDrift(drift: readonly Drift[]): string {
+  return drift.map(lineFor).join("\n");
+}
+
+const LINES: Record<Drift["kind"], (drift: Drift) => string> = {
+  missing: (one) => `  ${one.name}@${one.expected} is in the lock but not installed`,
+  unexpected: (one) => `  ${one.name} is installed but not in the lock`,
+  version: (one) => `  ${one.name}: lock says ${one.expected}, installed is ${one.found}`,
+  contents: (one) => `  ${one.name}: installed files differ from what was locked`,
+};
+
+function lineFor(one: Drift): string {
+  return LINES[one.kind](one);
+}

package/src/paths/index.ts

@@ -0,0 +1,10 @@
+export {
+  ancestors,
+  baseName,
+  isInside,
+  join,
+  normalise,
+  parentOf,
+  reanchor,
+  relativeTo,
+} from "./paths.js";

package/src/paths/paths.ts

@@ -0,0 +1,103 @@
+/**
+ * Path arithmetic on manifest paths, with no `node:path`.
+ *
+ * This package runs in a Web Worker as well as in the CLI, so paths are handled
+ * as text with forward slashes. A Windows path arrives with backslashes and is
+ * normalised on the way in, which is the one place the difference is allowed to
+ * exist.
+ */
+
+/**
+ * One path, written the one way the rest of this package understands.
+ *
+ * @returns The path with backslashes turned into forward slashes, runs of
+ * separators collapsed, and any trailing separator dropped. `"/"` stays `"/"`.
+ */
+export function normalise(path: string): string {
+  const flat = path.replaceAll("\\", "/").replace(/\/+/g, "/");
+  return flat.length > 1 ? flat.replace(/\/$/, "") : flat;
+}
+
+/**
+ * Joins path segments, ignoring empty ones.
+ *
+ * @returns The joined path, normalised. No `..` is resolved: these are manifest
+ * paths, and what a manifest wrote is what gets written down.
+ */
+export function join(...parts: readonly string[]): string {
+  const joined = parts.filter((part) => part !== "").join("/");
+  return normalise(joined);
+}
+
+/**
+ * The directory holding this path.
+ *
+ * @returns The parent, or `undefined` when there is nothing above. A relative
+ * path with one segment has the empty string as its parent, which is the
+ * directory it was written against; stopping short of it would leave a walk up
+ * from `packages/api` never reaching the workspace root beside it.
+ */
+export function parentOf(path: string): string | undefined {
+  const flat = normalise(path);
+  if (flat === "" || flat === "/") return undefined;
+  const slash = flat.lastIndexOf("/");
+  if (slash < 0) return "";
+  return slash === 0 ? "/" : flat.slice(0, slash);
+}
+
+/** The last segment of a path, which is the file or directory's own name. */
+export function baseName(path: string): string {
+  const flat = normalise(path);
+  return flat.slice(flat.lastIndexOf("/") + 1);
+}
+
+/**
+ * Every directory from `path` up to the top, `path` itself first.
+ *
+ * @returns The chain, ending in `""` for a relative path and `"/"` for an
+ * absolute one.
+ */
+export function ancestors(path: string): string[] {
+  const found: string[] = [];
+  // Tested against undefined, not for truth: the top of a relative walk is the
+  // empty string, which is falsy but is still a directory to look in.
+  for (let at: string | undefined = normalise(path); at !== undefined; at = parentOf(at)) {
+    found.push(at);
+  }
+  return found;
+}
+
+/** Whether `path` is `base` or sits inside it. */
+export function isInside(path: string, base: string): boolean {
+  const one = normalise(path);
+  const other = normalise(base);
+  return one === other || one.startsWith(`${other}/`);
+}
+
+/** `path` written relative to `base`, or the path itself when it is not inside. */
+export function relativeTo(path: string, base: string): string {
+  const one = normalise(path);
+  const other = normalise(base);
+  return one.startsWith(`${other}/`) ? one.slice(other.length + 1) : one;
+}
+
+/**
+ * A relative path written in one directory, rewritten to mean the same thing
+ * from another inside it.
+ *
+ * A workspace root writes `"#shared" = "./shared"` once and every member uses
+ * it, but a member reads it from further down, where `./shared` is somewhere
+ * else entirely.
+ *
+ * @param args.declaredIn Where the path was written.
+ * @param args.usedIn Where it will be read.
+ * @returns The path with one `../` per directory of depth. An absolute path is
+ * returned unchanged: it already means the same thing everywhere.
+ */
+export function reanchor(args: { path: string; declaredIn: string; usedIn: string }): string {
+  if (!args.path.startsWith(".")) return args.path;
+  const down = relativeTo(args.usedIn, args.declaredIn);
+  const depth = down === normalise(args.usedIn) ? 0 : down.split("/").filter(Boolean).length;
+  if (depth === 0) return args.path;
+  return `${"../".repeat(depth)}${args.path.replace(/^\.\//, "")}`;
+}

package/src/scaffold/index.ts

@@ -0,0 +1,2 @@
+export { scaffold } from "./scaffold.js";
+export type { ScaffoldFile, ScaffoldKind, ScaffoldRequest } from "./scaffold.types.js";