crossbind 0.0.1 → 2.0.0-beta.51

package/src/utils/rustMt.js

@@ -0,0 +1,76 @@
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+
+// One argv per flag: runCargo joins these with cargo's 0x1F separator, so a flag must not
+// contain a space of its own.
+const MT_RUSTFLAGS = ['-Ctarget-feature=+atomics,+bulk-memory,+mutable-globals'];
+
+// mt (shared-memory) wasm needs every Rust object built with the atomics/bulk-memory features,
+// std included - and rustup ships only a featureless std. The nightly-only -Zbuild-std rebuild
+// below is the same recipe wasm-bindgen-rayon uses; probing first turns a cryptic wasm-ld error
+// into an actionable install instruction. Shared by every cargo entry point (app-local super
+// crate and cargo-type packages).
+export function isMtWasm(target) {
+    return target.platform === 'wasm' && target.runtime === 'mt';
+}
+
+export function assertMtRustToolchain() {
+    const probe = spawnSync('rustup', ['component', 'list', '--toolchain', 'nightly', '--installed'], { encoding: 'utf8' });
+    if (probe.status !== 0 || !String(probe.stdout ?? '').includes('rust-src')) {
+        throw new Error(
+            "crossbind: Rust on the wasm 'mt' runtime needs the Rust std rebuilt with "
+            + 'atomics (nightly -Zbuild-std). Run `rustup toolchain install nightly '
+            + "--component rust-src` and rebuild, or build with runtime 'st'.",
+        );
+    }
+}
+
+// st and mt share a cargo triple, so they must not share a target dir: cargo would happily
+// serve featureless objects to a shared-memory link (or atomics objects to an st one).
+export function cargoTargetDirFor(baseDir, target) {
+    return `${baseDir}/${isMtWasm(target) ? 'target-mt' : 'target'}`;
+}
+
+// The wasm sysroots the image ships, each a COMPLETE sysroot (see web.Dockerfile): --sysroot is
+// global, so build scripts and proc-macros compiled for the host resolve there too. `current`
+// points at whatever version that image pinned, so the CLI carries no version of its own.
+const CONTAINER_SYSROOT = '/opt/crossbind/rust/current';
+
+export function cargoBuildInvocation({
+    target, triple, targetDir, manifestPath, sysroot = false,
+}) {
+    const isMt = isMtWasm(target);
+    // With a prebuilt sysroot there is nothing to rebuild and nothing unstable to ask for: stable
+    // rustc links the std that was compiled with the same features. Without one - no pinned
+    // artifact, or a host on a different rustc - mt still rebuilds std the nightly way.
+    const buildStd = isMt && !sysroot;
+    const args = [
+        ...(buildStd ? ['+nightly'] : []),
+        'build', '--release', '--target', triple,
+        ...(buildStd ? ['-Zbuild-std=std,panic_abort'] : []),
+        '--target-dir', targetDir, '--manifest-path', manifestPath,
+    ];
+    // Flags travel as data, not as an environment patch: cargo ignores RUSTFLAGS outright when
+    // CARGO_ENCODED_RUSTFLAGS is set, so inheriting the caller's environment here used to let a
+    // developer who has that variable exported silently link a featureless std into an mt module.
+    // panic is the other half of the same contract - the std being linked is built with abort.
+    // `true` is the image tree at a path only the container has; a string is a downloaded
+    // artifact on this machine (RUNNER=LOCAL). Same layout either way: <root>/<variant>.
+    const variant = isMt ? 'mt' : 'st';
+    let wasmSysroot = null;
+    if (sysroot && target.platform === 'wasm') {
+        wasmSysroot = sysroot === true ? `${CONTAINER_SYSROOT}/${variant}` : path.join(sysroot, variant);
+    }
+    return {
+        args,
+        rustflags: [
+            ...(wasmSysroot ? ['--sysroot', wasmSysroot] : []),
+            ...(isMt ? MT_RUSTFLAGS : []),
+        ],
+        panic: target.platform === 'wasm' ? 'abort' : undefined,
+        // Only the nightly build-std rebuild needs unstable flags; where a sysroot answers, stable
+        // is enough and the pin stays on.
+        allowUnstable: buildStd,
+        isMt,
+    };
+}

package/src/utils/rustSysroot.js

@@ -0,0 +1,171 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import withDirLock from './dirLock.js';
+import fetchOciLayer from './ociArtifact.js';
+import { cargoRunner } from './runCargo.js';
+import { isMtWasm } from './rustMt.js';
+import PIN from './rustSysrootPin.js';
+
+// The second consumption channel for the Rust sysroots. A containerized build gets them as an image
+// layer; a host build (RUNNER=LOCAL) reads that SAME layer straight out of the registry over plain
+// HTTPS. Not a repackaged copy hosted somewhere else - the same object, so the two channels cannot
+// drift, and there is no second artifact to publish, verify or forget to delete.
+//
+// Everything hangs off one pinned index digest. Verify before unpacking, never let the archive
+// choose where its files land, and key the cache by digest so two versions coexist.
+
+const SCHEMA = 1;
+
+export function sysrootRoot() {
+    return path.join(os.homedir(), '.crossbind', 'rust-sysroot');
+}
+
+// The rlibs carry the producing compiler's metadata hash: a sysroot is only consumable by the
+// exact rustc that built it, so the manifest is checked against the host before anything links.
+export function hostRustc() {
+    const probe = spawnSync('rustc', ['-vV'], { encoding: 'utf8' });
+    if (probe.status !== 0) {
+        throw new Error('crossbind: rustc not found on PATH - install Rust (https://rustup.rs) to build Rust packages.');
+    }
+    const read = (key) => probe.stdout.match(new RegExp(`^${key}: (.+)$`, 'm'))?.[1]?.trim();
+    return { version: read('release'), commit: read('commit-hash') };
+}
+
+export function assertManifest(manifest, host = hostRustc()) {
+    if (manifest?.schema !== SCHEMA) {
+        throw new Error(`crossbind: rust sysroot manifest schema ${manifest?.schema ?? '(missing)'} is not supported (expected ${SCHEMA}).`);
+    }
+    for (const variant of ['st', 'mt']) {
+        if (!manifest.variants?.[variant]) {
+            throw new Error(`crossbind: rust sysroot artifact is missing the '${variant}' variant.`);
+        }
+    }
+    if (manifest.rustc !== host.version || manifest.rustcCommit !== host.commit) {
+        throw new Error(
+            'crossbind: the rust sysroot artifact was built by a different compiler than the one on PATH.\n'
+            + `  artifact: rustc ${manifest.rustc} (${String(manifest.rustcCommit).slice(0, 12)})\n`
+            + `  host:     rustc ${host.version} (${String(host.commit).slice(0, 12)})\n`
+            + 'Prebuilt rlibs are only consumable by the exact compiler that produced them - install the pinned toolchain.',
+        );
+    }
+    return manifest;
+}
+
+function readManifest(dir) {
+    return JSON.parse(fs.readFileSync(path.join(dir, 'manifest.json'), 'utf8'));
+}
+
+// The archive is an image filesystem export, so the tree sits at opt/crossbind/rust/<version>.
+function findSysrootTree(extracted) {
+    const versions = path.join(extracted, 'opt', 'crossbind', 'rust');
+    const entries = fs.existsSync(versions) ? fs.readdirSync(versions) : [];
+    const found = entries
+        .map((version) => path.join(versions, version))
+        .find((dir) => fs.existsSync(path.join(dir, 'manifest.json')));
+    if (!found) {
+        throw new Error('crossbind: the rust sysroot archive contains no opt/crossbind/rust/<version>/manifest.json.');
+    }
+    return found;
+}
+
+// An archive is untrusted input even when its digest checks out: the digest says "these are the
+// bytes that were published", not "these bytes are harmless". Entries are listed first and anything
+// that could write outside the staging directory is refused before a single file is created.
+function extractTo(archive, work) {
+    const list = spawnSync('tar', ['-tzf', archive], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    if (list.status !== 0) {
+        throw new Error(`crossbind: cannot read the sysroot archive: ${(list.stderr || '').trim() || `tar exited ${list.status}`}`);
+    }
+    const escaping = list.stdout.split('\n').map((e) => e.trim()).filter(Boolean)
+        .filter((entry) => entry.startsWith('/') || entry.split('/').includes('..'));
+    if (escaping.length) {
+        throw new Error(`crossbind: the sysroot archive contains entries that escape the extraction directory: ${escaping.slice(0, 3).join(', ')}`);
+    }
+    fs.mkdirSync(work, { recursive: true });
+    const tar = spawnSync('tar', ['-xzf', archive, '-C', work], { encoding: 'utf8' });
+    if (tar.error) throw new Error(`crossbind: cannot run tar to extract ${archive}: ${tar.error.message}`);
+    if (tar.status !== 0) {
+        throw new Error(`crossbind: extracting the rust sysroot layer failed: ${(tar.stderr || '').trim() || `tar exited ${tar.status}`}`);
+    }
+}
+
+// The architecture whose leaf to pull. The trees hold wasm rlibs either way, but they were produced
+// by a host-arch rustc and the manifest records which - so take the leaf built for this machine.
+const hostArch = () => (process.arch === 'arm64' ? 'arm64' : 'amd64');
+
+// Returns the directory holding {st,mt,manifest.json}, fetched once per pinned index digest.
+export default async function ensureRustSysroot({
+    image, index, root = sysrootRoot(), host, arch = hostArch(),
+}) {
+    if (!image || !index) throw new Error('crossbind: a rust sysroot must be pinned by image and index digest.');
+    const check = (manifest) => assertManifest(manifest, host ?? hostRustc());
+    const dest = path.join(root, index.replace(':', '-'));
+    if (fs.existsSync(path.join(dest, 'manifest.json'))) {
+        check(readManifest(dest));
+        return dest;
+    }
+
+    fs.mkdirSync(root, { recursive: true });
+    return withDirLock(`${dest}.lock`, async () => {
+        // Another build may have finished it while this one waited for the lock.
+        if (fs.existsSync(path.join(dest, 'manifest.json'))) {
+            check(readManifest(dest));
+            return dest;
+        }
+        const work = fs.mkdtempSync(path.join(root, '.staging-'));
+        try {
+            const archive = path.join(work, 'layer.tar.gz');
+            await fetchOciLayer({ image, index, arch, dest: archive });
+            const extracted = path.join(work, 'extract');
+            extractTo(archive, extracted);
+            const tree = findSysrootTree(extracted);
+            check(readManifest(tree));
+            // Atomic: a reader either sees no directory at all or a complete, verified one.
+            fs.renameSync(tree, dest);
+        } finally {
+            fs.rmSync(work, { recursive: true, force: true });
+        }
+        return dest;
+    });
+}
+
+// The directory rustc's --sysroot is pointed at for a given runtime.
+export function sysrootPath(dir, variant) {
+    const target = path.join(dir, variant);
+    if (!fs.existsSync(target)) {
+        throw new Error(`crossbind: the rust sysroot at ${dir} has no '${variant}' variant.`);
+    }
+    return target;
+}
+
+// Resolved once per process. The download has to happen in an async step, but every consumer of
+// the result - createLib, buildCargo, the bundler plugins - is synchronous, and threading a
+// promise through them would mean making createLib and four plugins async for a case that only
+// arises on RUNNER=LOCAL. So: prepare here, read synchronously below.
+let resolved = null;
+
+// Called from buildDependencies, the one async step every build path awaits before the sync work
+// starts. Only downloads when a target will actually consume it.
+export async function prepareRustSysroot(targets, log = console.log) {
+    if (resolved || !PIN) return resolved;
+    if (!targets.some((target) => isMtWasm(target) && cargoRunner(target) === 'LOCAL')) return null;
+    try {
+        resolved = await ensureRustSysroot({ image: PIN.image, index: PIN.index });
+    } catch (e) {
+        // A host on a different rustc, or a release that cannot be reached: mt still builds, the
+        // slow way. Refusing here would take away a build that works today.
+        log(`crossbind: prebuilt rust sysroot unavailable, falling back to the nightly std rebuild - ${e.message}`);
+    }
+    return resolved;
+}
+
+// What cargoBuildInvocation takes for `sysroot`: true where the image carries the trees, an
+// absolute path where a downloaded artifact answers, false where mt must rebuild std on nightly.
+// st needs nothing - rustup's stock std is already correct for it.
+export function sysrootFor(target) {
+    if (cargoRunner(target) !== 'LOCAL') return true;
+    if (!isMtWasm(target)) return false;
+    return resolved ?? false;
+}

package/src/utils/rustSysrootPin.js

@@ -0,0 +1,11 @@
+// Generated by scripts/pin-rust-sysroot.js - do not edit by hand.
+//
+// The published sysroot image a host build (RUNNER=LOCAL) reads its Rust sysroots out of - the same
+// object the web image embeds, not a repackaged copy, so the two channels cannot drift. The index
+// digest is the whole contract: the loader verifies the index body against it, then each descriptor
+// inside a verified body authenticates the next fetch, down to the layer.
+export default {
+    version: '1.0.2',
+    image: 'ghcr.io/crossbind/rust-sysroot',
+    index: 'sha256:0ab2e522b1b09b2af7f312d4b940ab92ee470e8165df4b563e274a4eb2fdb903',
+};

package/src/utils/systemKeys.js

@@ -0,0 +1,29 @@
+const systemKeys = {
+    XCODE_DEVELOPMENT_TEAM: {
+        description: 'The unique identifier of the development team used for code signing and app distribution in Xcode.',
+        default: '',
+    },
+    RUNNER: {
+        description: 'The execution environment for running the application.',
+        options: ['DOCKER_RUN', 'DOCKER_EXEC', 'LOCAL'],
+        default: 'DOCKER_RUN',
+    },
+    WASI_SDK_PATH: {
+        description: 'Path to an extracted wasi-sdk (>= 34, wasm32-wasip3 sysroot) used by platform:\'wasi\' builds. The CROSSBIND_WASI_SDK_PATH environment variable overrides it.',
+        default: '',
+    },
+    DOCKER_REGISTRY_MIRROR: {
+        description: 'Registry prefix to pull the build images from, e.g. registry.example.dev/crossbind. crossbind appends the release digest itself, so reproducibility is preserved. The CROSSBIND_REGISTRY_MIRROR environment variable overrides it.',
+        default: '',
+    },
+    DOCKER_IMAGE_WEB: {
+        description: 'Image reference used for wasm and wasi builds instead of the pinned one. A reference without the release digest disables the reproducibility guarantee. The CROSSBIND_IMAGE_WEB environment variable overrides it.',
+        default: '',
+    },
+    DOCKER_IMAGE_ANDROID: {
+        description: 'Image reference used for android builds instead of the pinned one. A reference without the release digest disables the reproducibility guarantee. The CROSSBIND_IMAGE_ANDROID environment variable overrides it.',
+        default: '',
+    },
+};
+
+export default systemKeys;

package/src/utils/targets.js

@@ -0,0 +1,109 @@
+// Single source for the build-target matrix and its naming; state/ copies (and then
+// decorates) these entries, and consumer runtimes read them without touching CLI state.
+
+export const TARGETS = [
+    {
+        platform: 'wasm', arch: 'wasm32', runtime: 'st', buildType: 'release', runtimeEnv: 'browser',
+    },
+    {
+        platform: 'wasm', arch: 'wasm32', runtime: 'st', buildType: 'release', runtimeEnv: 'edge',
+    },
+    {
+        platform: 'wasm', arch: 'wasm32', runtime: 'st', buildType: 'release', runtimeEnv: 'node',
+    },
+    {
+        platform: 'wasm', arch: 'wasm32', runtime: 'st', buildType: 'debug', runtimeEnv: 'browser',
+    },
+    {
+        platform: 'wasm', arch: 'wasm32', runtime: 'st', buildType: 'debug', runtimeEnv: 'edge',
+    },
+    {
+        platform: 'wasm', arch: 'wasm32', runtime: 'st', buildType: 'debug', runtimeEnv: 'node',
+    },
+    {
+        platform: 'wasm', arch: 'wasm32', runtime: 'mt', buildType: 'release', runtimeEnv: 'browser',
+    },
+    {
+        platform: 'wasm', arch: 'wasm32', runtime: 'mt', buildType: 'release', runtimeEnv: 'node',
+    },
+    {
+        platform: 'wasm', arch: 'wasm32', runtime: 'mt', buildType: 'debug', runtimeEnv: 'browser',
+    },
+    {
+        platform: 'wasm', arch: 'wasm32', runtime: 'mt', buildType: 'debug', runtimeEnv: 'node',
+    },
+    {
+        platform: 'wasm', arch: 'wasm64', runtime: 'st', buildType: 'release', runtimeEnv: 'browser',
+    },
+    {
+        platform: 'wasm', arch: 'wasm64', runtime: 'st', buildType: 'release', runtimeEnv: 'edge',
+    },
+    {
+        platform: 'wasm', arch: 'wasm64', runtime: 'st', buildType: 'release', runtimeEnv: 'node',
+    },
+    {
+        platform: 'wasm', arch: 'wasm64', runtime: 'st', buildType: 'debug', runtimeEnv: 'browser',
+    },
+    {
+        platform: 'wasm', arch: 'wasm64', runtime: 'st', buildType: 'debug', runtimeEnv: 'edge',
+    },
+    {
+        platform: 'wasm', arch: 'wasm64', runtime: 'st', buildType: 'debug', runtimeEnv: 'node',
+    },
+    {
+        platform: 'wasm', arch: 'wasm64', runtime: 'mt', buildType: 'release', runtimeEnv: 'browser',
+    },
+    {
+        platform: 'wasm', arch: 'wasm64', runtime: 'mt', buildType: 'release', runtimeEnv: 'node',
+    },
+    {
+        platform: 'wasm', arch: 'wasm64', runtime: 'mt', buildType: 'debug', runtimeEnv: 'browser',
+    },
+    {
+        platform: 'wasm', arch: 'wasm64', runtime: 'mt', buildType: 'debug', runtimeEnv: 'node',
+    },
+    {
+        platform: 'wasi', arch: 'wasm32', runtime: 'st', buildType: 'release',
+    },
+    {
+        platform: 'wasi', arch: 'wasm32', runtime: 'st', buildType: 'debug',
+    },
+    {
+        platform: 'android', arch: 'arm64-v8a', runtime: 'mt', buildType: 'release',
+    },
+    {
+        platform: 'android', arch: 'arm64-v8a', runtime: 'mt', buildType: 'debug',
+    },
+    {
+        platform: 'android', arch: 'x86_64', runtime: 'mt', buildType: 'release',
+    },
+    {
+        platform: 'android', arch: 'x86_64', runtime: 'mt', buildType: 'debug',
+    },
+    {
+        platform: 'ios', arch: 'iphoneos', runtime: 'mt', buildType: 'release',
+    },
+    {
+        platform: 'ios', arch: 'iphoneos', runtime: 'mt', buildType: 'debug',
+    },
+    {
+        platform: 'ios', arch: 'iphonesimulator', runtime: 'mt', buildType: 'release',
+    },
+    {
+        platform: 'ios', arch: 'iphonesimulator', runtime: 'mt', buildType: 'debug',
+    },
+];
+
+export function targetPathOf(target) {
+    return `${target.platform}-${target.arch}-${target.runtime}-${target.buildType}`;
+}
+
+export function filterTargetSpecs(targetSpecs, target) {
+    return targetSpecs?.filter(t => (
+        (!t.platform || t.platform === target.platform)
+        && (!t.arch || t.arch === target.arch)
+        && (!t.runtime || t.runtime === target.runtime)
+        && (!t.buildType || t.buildType === target.buildType)
+        && (!t.runtimeEnv || t.runtimeEnv === target.runtimeEnv)
+    ))?.map(t => t?.specs)?.filter(t => t) || [];
+}

package/src/utils/wasiToolchain.js

@@ -0,0 +1,47 @@
+// Toolchain surface for platform:'wasi' (wasm32-wasip3, wasi-sdk >= 34; run under `wasmtime`).
+
+export const WASI_TARGET_TRIPLE = 'wasm32-wasip3';
+// The sdk's clang still defaults to wasip1, so every compile/link carries --target explicitly.
+export const WASI_TARGET_FLAGS = [`--target=${WASI_TARGET_TRIPLE}`];
+
+export const WASI_COMPILE_DEFINES = [
+    '-D_WASI_EMULATED_SIGNAL',
+    '-D_WASI_EMULATED_PROCESS_CLOCKS',
+    '-D_WASI_EMULATED_MMAN',
+    '-D_WASI_EMULATED_GETPID',
+];
+
+// -mexception-handling unlocks wasi-libc's setjmp.h (-mllvm flags are invisible to the preprocessor); engines only run standard Wasm 3.0 EH, hence legacy-eh=false.
+export const WASI_EH_CFLAGS = [
+    '-mexception-handling',
+    '-mllvm', '-wasm-enable-sjlj',
+    '-mllvm', '-wasm-use-legacy-eh=false',
+];
+
+// Back the _WASI_EMULATED_* defines; safe in configure-probe LIBS.
+export const WASI_EMULATION_LIBS = [
+    '-lwasi-emulated-signal',
+    '-lwasi-emulated-process-clocks',
+    '-lwasi-emulated-mman',
+    '-lwasi-emulated-getpid',
+];
+
+// Must trail every archive; -lunwind/-lsetjmp resolve only under -fwasm-exceptions' eh/ sysroot, so keep them out of C-mode probes.
+export const WASI_LINK_LIBS = [
+    '-lunwind',
+    '-lsetjmp',
+    ...WASI_EMULATION_LIBS,
+];
+
+export function wasiCFlags() {
+    return [...WASI_TARGET_FLAGS, ...WASI_COMPILE_DEFINES, ...WASI_EH_CFLAGS];
+}
+
+export function wasiCxxFlags() {
+    return [...WASI_TARGET_FLAGS, ...WASI_COMPILE_DEFINES, '-fwasm-exceptions', ...WASI_EH_CFLAGS];
+}
+
+// Env override first, then persistent ~/.crossbind.json; null when unset.
+export function resolveWasiSdkPath(system, env = process.env) {
+    return env.CROSSBIND_WASI_SDK_PATH || system?.WASI_SDK_PATH || null;
+}

package/src/utils/writeIfChanged.js

@@ -0,0 +1,8 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+export default function writeIfChanged(file, content) {
+    if (fs.existsSync(file) && fs.readFileSync(file, 'utf8') === content) return;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, content);
+}

package/src/utils/writeJson.js

@@ -0,0 +1,9 @@
+import fs from 'node:fs';
+
+export default function writeJson(filePath, data) {
+    try {
+        fs.writeFileSync(filePath, JSON.stringify(data, null, 4));
+    } catch (e) {
+        console.error(e);
+    }
+}

package/vitest.config.js

@@ -0,0 +1,46 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+    // loadJs/loadConfig dynamically import config files written to os.tmpdir()
+    // during tests. Vite 6 tightened server.fs.allow and rejects those out-of-root
+    // paths ("Does the file exist?"); relax the fs check for the test runner.
+    server: {
+        fs: {
+            strict: false,
+        },
+    },
+    test: {
+        include: ['test/**/*.test.js'],
+        environment: 'node',
+        coverage: {
+            provider: 'v8',
+            reporter: ['text', 'html'],
+            // src/actions/ used to be excluded on the grounds that it only shells out to
+            // docker/emcc/cargo, so a test there would pin a command line rather than behaviour,
+            // and that the e2e suites already covered it. 2.0.0-beta.50 disproved the second half:
+            // one call site asked docker for an image ref that does not exist on arm64, no e2e
+            // exercised a machine without that image already cached, and android builds shipped
+            // broken to every Apple Silicon user. Which command line these actions build IS the
+            // behaviour, so the layer is measured.
+            include: ['src/utils/**/*.js', 'src/state/**/*.js', 'src/assets/**/*.js', 'src/actions/**/*.js'],
+            all: true,
+            // A floor with a one-point band, not a ratchet. Coverage is not identical across
+            // environments - resolveEmbindRust walks the real node_modules layout, so which of its
+            // catch branches run differs between a dev machine and a fresh CI install - and the
+            // totals land a few hundredths apart. Auto-raising these locally while enforcing them
+            // exactly on CI therefore fails on that difference rather than on a regression: CI
+            // measured 81.67/76.66/84.31/82.72 against floors written from a local run. The
+            // figures below are a local run of the widened surface (62.18/55.64/65.96/62.09) minus
+            // about a point. They read lower than the numbers they replace because they now count
+            // src/actions/, not because anything regressed - the old floors simply were not
+            // measuring the layer that broke. Raise them deliberately when a gain is worth
+            // locking in.
+            thresholds: {
+                statements: 61.2,
+                branches: 54.6,
+                functions: 65.0,
+                lines: 61.1,
+            },
+        },
+    },
+});