functionalscript 0.43.1 → 0.44.0

package/fjs/ci/nix/proof.f.mjs

@@ -0,0 +1,146 @@
+/**
+ * Proofs for generated CI flakes.
+ *
+ * @module
+ */
+
+/** @import { NixJob } from './types.ts' */
+
+import { assert, assertEq } from '../../asserts/module.f.mjs'
+import { step } from '../../effects/module.f.mjs'
+import { readUtf8File } from '../../effects/node/module.f.mjs'
+import { emptyState, virtual } from '../../effects/node/virtual/module.f.mjs'
+import { nixpkgs } from '../config/module.f.mjs'
+import { nodeNixJobs } from '../node/module.f.mjs'
+import {
+    flakePath,
+    flakeText,
+    generatedDirectory,
+    nixDevelop,
+    nixDevelopAll,
+    nixFlakes,
+    nixInstall,
+} from './module.f.mjs'
+
+const { commit } = nixpkgs
+
+/** @type {NixJob} */
+const plain = {
+    id: 'node24',
+    system: 'aarch64-linux',
+    packages: ['nodejs_24'],
+}
+
+/** @type {NixJob} */
+const withShellHook = {
+    ...plain,
+    id: 'node22',
+    packages: ['nodejs_22'],
+    shellHook: `export NPM_CONFIG_PREFIX="$HOME/.npm-global"`,
+}
+
+const plainFlake = `{
+    inputs.nixpkgs.url = "github:NixOS/nixpkgs/${commit}";
+    outputs = { nixpkgs, ... }: {
+        devShells.aarch64-linux.default = let
+            pkgs = import nixpkgs {
+                system = "aarch64-linux";
+            };
+        in
+        pkgs.mkShell {
+            packages = [ pkgs.nodejs_24 ];
+        };
+    };
+}
+`
+
+const shellHookFlake = `{
+    inputs.nixpkgs.url = "github:NixOS/nixpkgs/${commit}";
+    outputs = { nixpkgs, ... }: {
+        devShells.aarch64-linux.default = let
+            pkgs = import nixpkgs {
+                system = "aarch64-linux";
+            };
+        in
+        pkgs.mkShell {
+            packages = [ pkgs.nodejs_22 ];
+            shellHook = ''
+                export NPM_CONFIG_PREFIX="$HOME/.npm-global"
+            '';
+        };
+    };
+}
+`
+
+/** @type {(jobs: readonly NixJob[], id: string) => string} */
+const generated = (jobs, id) => {
+    const written = step(
+        nixFlakes(jobs),
+        () => readUtf8File(`${generatedDirectory}/${id}/flake.nix`))
+    const [, [tag, result]] = virtual(emptyState)(written)
+    assert(tag === 'ok', result)
+    return result
+}
+
+export const proof = {
+    flakeText: {
+        plain: () => assertEq(flakeText(plain), plainFlake),
+        shellHook: () => assertEq(flakeText(withShellHook), shellHookFlake),
+    },
+    nixFlakes: {
+        write: () => assertEq(generated([plain], plain.id), plainFlake),
+        every: () => {
+            for (const job of nodeNixJobs) {
+                assertEq(generated(nodeNixJobs, job.id), flakeText(job))
+            }
+        },
+        nodeShellHook: () => {
+            const [node22] = nodeNixJobs
+            assert(node22.shellHook !== undefined, 'expected a Node 22 shell hook')
+            assert(
+                generated(nodeNixJobs, node22.id).includes('$HOME/.npm-global'),
+                'expected the Node 22 global installation prefix')
+        },
+        packages: () => {
+            for (const { id, packages } of nodeNixJobs) {
+                assertEq(packages.length, 1)
+                assertEq(packages[0], `nodejs_${id.slice('node'.length)}`)
+            }
+        },
+        // Job data only ever reaches quotable positions, so an unusual package
+        // name is escaped rather than rejected.
+        quotedPackage: () => assert(
+            flakeText({ ...plain, packages: ['not an identifier'] })
+                .includes('pkgs."not an identifier"'),
+            'expected a quoted attribute name'),
+        multiplePackages: () => assert(
+            flakeText({ ...plain, packages: ['nodejs_24', 'git'] })
+                .includes('[ pkgs.nodejs_24 pkgs.git ]'),
+            'expected both packages in the shell'),
+    },
+    workflow: {
+        // The path a workflow passes to `nix develop` must be the directory the
+        // generator wrote the flake into.
+        flakePath: () => assertEq(flakePath(plain.id), `./${generatedDirectory}/node24`),
+        nixDevelop: () => assertEq(
+            nixDevelop(plain.id, 'node --version'),
+            'nix develop ./nix/generated/node24 --command node --version'),
+        nixDevelopAll: {
+            sequence: () => assertEq(
+                nixDevelopAll(plain.id, ['npm ci', 'node --test']),
+                `nix develop ./nix/generated/node24 --command bash -euo pipefail -c 'npm ci && node --test'`),
+            // A command carrying its own quote must not end the outer one: the
+            // shell has to see the script back exactly as it was written.
+            quote: () => assertEq(
+                nixDevelopAll(plain.id, [`printf '%s' 'a b'`]),
+                `nix develop ./nix/generated/node24 --command bash -euo pipefail -c 'printf '\\''%s'\\'' '\\''a b'\\'''`),
+        },
+        nixInstall: () => {
+            assertEq(nixInstall.type, 'install')
+            assert(
+                nixInstall.type === 'install'
+                && nixInstall.step.uses?.startsWith('cachix/install-nix-action@') === true,
+                'expected the pinned Nix installer action')
+        },
+    },
+}

package/fjs/ci/nix/types.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Types for generated CI Nix flakes.
+ *
+ * @module
+ */
+/** A CI job's development environment, one generated flake each. */
+export type NixJob = {
+    /** Generated directory name under `nix/generated`, matching the CI job id. */
+    readonly id: string;
+    /** Nix system of the job's runner, e.g. `aarch64-linux`. */
+    readonly system: string;
+    /** Nixpkgs attribute names made available in the job's shell. */
+    readonly packages: readonly string[];
+    /** Job-local shell initialization, when the job needs one. */
+    readonly shellHook?: string;
+};

package/fjs/ci/nix/types.js

@@ -0,0 +1,6 @@
+/**
+ * Types for generated CI Nix flakes.
+ *
+ * @module
+ */
+export {};

package/fjs/ci/node/module.f.d.mts

@@ -0,0 +1,48 @@
+/**
+ * CI step builders for Node.js: setup-node installation, platform smoke tests,
+ * per-version canonical jobs.
+ *
+ * @module
+ *
+ * @import { Job, Jobs, MetaStep, Step } from '../common/types.ts'
+ * @import { NixJob } from '../nix/types.ts'
+ */
+import type { Job, Jobs, MetaStep } from '../common/types.ts';
+import type { NixJob } from '../nix/types.ts';
+/** @type {(v: string) => string} */
+export declare const major: (v: string) => string;
+/** @type {(version: string) => (extra: readonly MetaStep[]) => readonly MetaStep[]} */
+export declare const basicNode: (version: string) => (extra: readonly MetaStep[]) => readonly MetaStep[];
+/** @type {(version: string) => readonly MetaStep[]} */
+export declare const platformNodeSteps: (version: string) => readonly MetaStep[];
+/** @type {(version: string) => Jobs} */
+export declare const nodeVersionJobs: (version: string) => Jobs;
+export declare const nixSystem: 'aarch64-linux';
+/** Generated development environments for the canonical Node jobs.
+ *
+ * @type {readonly NixJob[]}
+ */
+export declare const nodeNixJobs: readonly NixJob[];
+/**
+ * Version-check steps for the canonical Node jobs' generated flakes, one per
+ * job. Collected into the shared temporary `nix-flakes` job in
+ * `fjs/ci/module.f.mjs`.
+ *
+ * @type {readonly MetaStep[]}
+ */
+export declare const nodeNixVersionSteps: readonly MetaStep[];
+/**
+ * Temporary job that instantiates every generated flake.
+ *
+ * Nothing else in CI evaluates the generated files, so a broken flake — or one
+ * whose snapshot moved to a different Node — would only surface once a real job
+ * started using it. It deliberately stays separate from the canonical Node jobs:
+ * those keep their current `setup-node` runtime until they are migrated one at a
+ * time. When the last one migrates and this job goes away, each migrated job
+ * must check its own Node version inside the `nix develop` invocation, or the
+ * guarantee is lost.
+ *
+ * @type {Job}
+ */
+export declare const nodeNixFlakeJob: Job;
+export declare const nodeMainSteps: (version: string) => readonly MetaStep[];

package/fjs/ci/node/module.f.mjs

@@ -0,0 +1,139 @@
+/**
+ * CI step builders for Node.js: setup-node installation, platform smoke tests,
+ * per-version canonical jobs.
+ *
+ * @module
+ *
+ * @import { Job, Jobs, MetaStep, Step } from '../common/types.ts'
+ * @import { NixJob } from '../nix/types.ts'
+ */
+
+import { node } from '../config/module.f.mjs'
+import { install, test, ubuntuArm, uses } from '../common/module.f.mjs'
+import { nixInstall, nixVersionCheckStep } from '../nix/module.f.mjs'
+
+/** @type {(v: string) => string} */
+export const major = v => v.split('.')[0]
+
+/** @type {(version: string) => string} */
+const jobId = version => `node${major(version)}`
+
+/** @type {(v: string) => Step} */
+const installNode = v =>
+    uses('actions/setup-node', { 'node-version': v })
+
+/** @type {(v: string) => readonly MetaStep[]} */
+const nodeInstall = v => [
+    install(installNode(v)),
+    test({ run: 'npm ci' }),
+]
+
+/** @type {(version: string) => (extra: readonly MetaStep[]) => readonly MetaStep[]} */
+export const basicNode = version => extra => [
+    ...nodeInstall(version),
+    ...extra,
+]
+
+/** @type {(version: string) => MetaStep} */
+const fjsGlobalInstall = version =>
+    install({ run: `npm install -g functionalscript@${version}` })
+
+/** @type {(version: string) => readonly MetaStep[]} */
+export const platformNodeSteps = version => [
+    ...nodeInstall(node.default),
+    fjsGlobalInstall(version),
+    test({ run: 'fjs test' }),
+]
+
+/** @type {(version: string) => readonly MetaStep[]} */
+const node22Steps = version => [
+    ...nodeInstall(node.node22),
+    fjsGlobalInstall(version),
+    test({ run: 'fjs test' }),
+    test({ run: 'node --test' }),
+]
+
+/** @type {readonly MetaStep[]} */
+const node24Steps = [
+    ...nodeInstall(node.node24),
+    test({ run: 'node --test' }),
+]
+
+/** @type {readonly MetaStep[]} */
+const node26Steps = [
+    ...nodeInstall(node.default),
+    test({ run: 'npm run ci-update' }),
+    test({ run: 'git add -A && git diff --cached --exit-code' }),
+    test({ run: 'npx tsc' }),
+    test({ run: 'npm run cov' }),
+    test({ run: 'npm pack' }),
+]
+
+/** @type {(steps: readonly MetaStep[]) => Job} */
+const nodeJob = steps => ubuntuArm(steps)
+
+/** @type {(version: string) => Jobs} */
+export const nodeVersionJobs = version => ({
+    [jobId(node.node22)]: nodeJob(node22Steps(version)),
+    [jobId(node.node24)]: nodeJob(node24Steps),
+    [jobId(node.default)]: nodeJob(node26Steps),
+})
+
+// The canonical Node jobs run on the Ubuntu ARM runner.
+export const nixSystem = /** @type {const} */ ('aarch64-linux')
+
+// Keeps `npm install -g functionalscript` writable and puts the installed `fjs`
+// on `PATH` for the rest of the same `nix develop` invocation.
+const npmGlobalShellHook = /** @type {const} */ (`export NPM_CONFIG_PREFIX="$HOME/.npm-global"
+export PATH="$NPM_CONFIG_PREFIX/bin:$PATH"
+mkdir -p "$NPM_CONFIG_PREFIX"`)
+
+// Versions of the canonical Node jobs, in job order.
+const nixVersions = /** @type {const} */ ([node.node22, node.node24, node.default])
+
+/** @type {(version: string) => NixJob} */
+const nixJob = version => ({
+    id: jobId(version),
+    system: nixSystem,
+    packages: [`nodejs_${major(version)}`],
+})
+
+/** Generated development environments for the canonical Node jobs.
+ *
+ * @type {readonly NixJob[]}
+ */
+export const nodeNixJobs = [
+    { ...nixJob(node.node22), shellHook: npmGlobalShellHook },
+    nixJob(node.node24),
+    nixJob(node.default),
+]
+
+/**
+ * Version-check steps for the canonical Node jobs' generated flakes, one per
+ * job. Collected into the shared temporary `nix-flakes` job in
+ * `fjs/ci/module.f.mjs`.
+ *
+ * @type {readonly MetaStep[]}
+ */
+export const nodeNixVersionSteps =
+    nixVersions.map(version => nixVersionCheckStep(jobId(version), version))
+
+/**
+ * Temporary job that instantiates every generated flake.
+ *
+ * Nothing else in CI evaluates the generated files, so a broken flake — or one
+ * whose snapshot moved to a different Node — would only surface once a real job
+ * started using it. It deliberately stays separate from the canonical Node jobs:
+ * those keep their current `setup-node` runtime until they are migrated one at a
+ * time. When the last one migrates and this job goes away, each migrated job
+ * must check its own Node version inside the `nix develop` invocation, or the
+ * guarantee is lost.
+ *
+ * @type {Job}
+ */
+export const nodeNixFlakeJob = ubuntuArm([
+    nixInstall,
+    ...nodeNixVersionSteps,
+])
+
+export const nodeMainSteps = platformNodeSteps

package/fjs/ci/node/proof.f.mjs

@@ -0,0 +1,18 @@
+import { basicNode } from './module.f.mjs'
+import { test } from '../common/module.f.mjs'
+import { assertEq } from '../../asserts/module.f.mjs'
+
+export const proof = {
+    basicNode: () => {
+        const extra = [test({ run: 'echo extra' })]
+        const steps = basicNode('22.0.0')(extra)
+        assertEq(steps.length, 3)
+        const [setupNode, npmCi, extraStep] = steps
+        assertEq(setupNode.type, 'install')
+        assertEq(setupNode.type === 'install' ? setupNode.step.uses : undefined, 'actions/setup-node@v7.0.0')
+        assertEq(setupNode.type === 'install' ? setupNode.step.with?.['node-version'] : undefined, '22.0.0')
+        assertEq(npmCi.type, 'test')
+        assertEq(npmCi.type === 'test' ? npmCi.step.run : undefined, 'npm ci')
+        assertEq(extraStep, extra[0])
+    },
+}

package/fjs/ci/proof.f.d.mts

@@ -0,0 +1,20 @@
+/** @import { MetaStep, Os, GitHubAction } from './common/types.ts' */
+/** @import { Dir, State } from '../effects/node/virtual/types.ts' */
+export declare const proof: {
+    matrixShape: () => void;
+    rust: () => void;
+    noRust: () => void;
+    extra: {
+        allOs: () => void;
+        osSpecific: () => void;
+    };
+    defaultSetup: {
+        functionalscriptPackage: () => void;
+        otherPackage: () => void;
+        configuredPackageVersion: () => void;
+        missingPackageJson: () => void;
+    };
+    nixFlakes: () => void;
+    nixFlakeJob: () => void;
+    ubuntu: () => void;
+};

package/fjs/ci/proof.f.mjs

@@ -0,0 +1,219 @@
+/** @import { MetaStep, Os, GitHubAction } from './common/types.ts' */
+/** @import { Dir, State } from '../effects/node/virtual/types.ts' */
+
+import { ci, main } from './module.f.mjs'
+import { functionalscript, node } from './config/module.f.mjs'
+import { nodeNixJobs } from './node/module.f.mjs'
+import { utf8, utf8ToString } from '../text/module.f.mjs'
+import { empty as emptyVec } from '../types/bit_vec/module.f.mjs'
+import { test, ubuntu, parseGitHubAction } from './common/module.f.mjs'
+import { assert, assertEq } from '../asserts/module.f.mjs'
+import { emptyState, virtual } from '../effects/node/virtual/module.f.mjs'
+import { unwrap } from '../types/result/module.f.mjs'
+import { definedValues } from '../types/object/module.f.mjs'
+
+import { parse as jsonParse } from '../media/json/module.f.mjs'
+
+/** @type {(cmd: string) => (gha: GitHubAction) => boolean} */
+const hasRun = cmd => gha =>
+    definedValues(gha.jobs).some(job => job.steps.some(step => step.run?.includes(cmd)))
+
+/** @type {(jobId: string, cmd: string) => (gha: GitHubAction) => boolean} */
+const hasRunInJob = (jobId, cmd) => gha =>
+    gha.jobs[jobId]?.steps.some(step => step.run?.includes(cmd)) ?? false
+
+/** @type {(jobId: string, cmd: string) => (gha: GitHubAction) => boolean} */
+const hasExactRunInJob = (jobId, cmd) => gha =>
+    gha.jobs[jobId]?.steps.some(step => step.run === cmd) ?? false
+
+const makeState = (/** @type {boolean} */ rust, /** @type {string | undefined} */ packageJson) => ({
+    ...emptyState,
+    root: {
+        '.github': { workflows: {} },
+        ...(packageJson !== undefined ? { 'package.json': [utf8(packageJson)] } : {}),
+        ...(rust ? { 'Cargo.toml': [emptyVec] } : {}),
+    },
+})
+
+/** @type {(dir: Dir, name: string) => Dir} */
+const subDir = (dir, name) => {
+    const entity = dir[name]
+    assert(typeof entity === 'object' && !Array.isArray(entity), entity)
+    return /** @type {Dir} */ (entity)
+}
+
+/** @type {(dir: Dir, name: string) => string} */
+const text = (dir, name) => {
+    const file = dir[name]
+    assert(!(!Array.isArray(file) || file.length === 0), file)
+    return utf8ToString(file[0])
+}
+
+/** @type {(dir: Dir, names: readonly string[]) => Dir} */
+const path = (dir, names) => names.reduce(subDir, dir)
+
+/** @type {(state: State) => GitHubAction} */
+const workflow = state => {
+    const workflows = path(state.root, ['.github', 'workflows'])
+    return unwrap(parseGitHubAction(unwrap(jsonParse(text(workflows, 'ci.yml')))))
+}
+
+/** @type {(state: State, id: string) => string} */
+const flake = (state, id) =>
+    text(path(state.root, ['nix', 'generated', id]), 'flake.nix')
+
+/** @type {(rust: boolean, nodeExtra?: (o: Os) => readonly MetaStep[]) => GitHubAction} */
+const run = (rust, nodeExtra = () => []) => {
+    const [state, result] = virtual(makeState(rust, undefined))(ci({ nodeExtra }))
+    assertEq(result, 0)
+    return workflow(state)
+}
+
+/** @type {(packageJson?: string) => GitHubAction} */
+const runDefault = packageJson => {
+    const [state, result] = virtual(makeState(false, packageJson))(main())
+    assertEq(result, 0)
+    return workflow(state)
+}
+
+export const proof = {
+    matrixShape: () => {
+        const gha = run(true)
+        assertEq(Object.keys(gha.jobs).length, 13, 'expected 13 CI jobs')
+        assertEq(gha.permissions.contents, 'read', 'expected read-only contents permission')
+        assertEq(Object.keys(gha.permissions).length, 1, 'expected least-privilege workflow permissions')
+        assert(hasRunInJob('ubuntu-intel', 'cargo test --target i686-unknown-linux-gnu')(gha), 'expected Ubuntu Intel i686 check')
+        assert(hasRunInJob('ubuntu-intel', 'cargo test --target i686-unknown-linux-gnu --release')(gha), 'expected Ubuntu Intel i686 release check')
+        assert(hasRunInJob('ubuntu-intel', 'cargo clippy --target i686-unknown-linux-gnu -- -D warnings')(gha), 'expected Ubuntu Intel i686 lint')
+        assert(hasRunInJob('ubuntu-intel', 'cargo clippy --target i686-unknown-linux-gnu --release -- -D warnings')(gha), 'expected Ubuntu Intel i686 release lint')
+        assert(hasRunInJob('ubuntu-arm', 'cargo test --release')(gha), 'expected native platform Rust release check')
+        assert(hasRunInJob('ubuntu-arm', 'cargo clippy -- -D warnings')(gha), 'expected native platform Rust lint')
+        assert(hasRunInJob('ubuntu-arm', 'cargo clippy --release -- -D warnings')(gha), 'expected native platform Rust release lint')
+        assert(hasRunInJob('wasm', 'cargo test --target wasm32-wasip1 --release')(gha), 'expected target-specific WASM release check')
+        assert(hasRunInJob('wasm', 'cargo clippy --target wasm32-wasip1 -- -D warnings')(gha), 'expected target-specific WASM Rust lint')
+        assert(hasRunInJob('wasm', 'cargo clippy --target wasm32-wasip1 --release -- -D warnings')(gha), 'expected target-specific WASM release lint')
+        // Wasmtime 47 removed wasi-threads: the threads target must run under
+        // Wasmer only, while Clippy (no runner) stays.
+        assert(hasRunInJob('wasm', 'cargo test --target wasm32-wasip1-threads --config .cargo/config.wasmer.toml')(gha), 'expected Wasmer WASM threads check')
+        assert(hasRunInJob('wasm', 'cargo clippy --target wasm32-wasip1-threads -- -D warnings')(gha), 'expected WASM threads lint')
+        assert(!hasExactRunInJob('wasm', 'cargo test --target wasm32-wasip1-threads')(gha), 'unexpected Wasmtime WASM threads check')
+        assert(!hasExactRunInJob('wasm', 'cargo test --target wasm32-wasip1-threads --release')(gha), 'unexpected Wasmtime WASM threads release check')
+        assert(hasRunInJob('node22', 'fjs test')(gha), 'expected Node 22 FunctionalScript smoke test')
+        assert(hasRunInJob('node26', 'npm pack')(gha), 'expected Node 26 package check')
+        assert(hasRunInJob('node26', 'npm run ci-update')(gha), 'expected Node 26 workflow regeneration')
+        assert(hasRunInJob('node26', 'git add -A && git diff --cached --exit-code')(gha), 'expected Node 26 generated-file drift check')
+        assert(!hasRun('npm publish --dry-run')(gha), 'unexpected npm publish dry-run')
+        for (const id of /** @type {const} */ ([
+            'ubuntu-intel',
+            'ubuntu-arm',
+            'macos-intel',
+            'macos-arm',
+            'windows-intel',
+            'windows-arm',
+            'node22',
+            'node24',
+            'node26',
+        ])) {
+            assert(hasRunInJob(id, 'npm ci')(gha), `expected npm ci in ${id}`)
+        }
+        assert(!hasRunInJob('deno', 'npm ci')(gha), 'unexpected npm ci in deno job')
+        assert(!hasRunInJob('bun', 'npm ci')(gha), 'unexpected npm ci in bun job')
+    },
+    rust: () => {
+        assert(hasRun('cargo')(run(true)), 'expected Rust steps')
+    },
+    noRust: () => {
+        assert(!hasRun('cargo')(run(false)), 'unexpected Rust steps')
+    },
+    extra: {
+        allOs: () => {
+            const cmd = 'echo hello'
+            const gha = run(false, () => [test({ run: cmd })])
+            for (const o of /** @type {const} */ (['ubuntu', 'macos', 'windows'])) {
+                for (const a of /** @type {const} */ (['intel', 'arm'])) {
+                    assert(hasRunInJob(`${o}-${a}`, cmd)(gha), `missing extra step in ${o}-${a}`)
+                }
+            }
+        },
+        osSpecific: () => {
+            const gha = run(false, o => o === 'ubuntu' ? [test({ run: 'echo ubuntu-only' })] : [])
+            for (const a of /** @type {const} */ (['intel', 'arm'])) {
+                assert(hasRunInJob(`ubuntu-${a}`, 'echo ubuntu-only')(gha), `missing step in ubuntu-${a}`)
+                assert(!hasRunInJob(`macos-${a}`, 'echo ubuntu-only')(gha), `unexpected step in macos-${a}`)
+                assert(!hasRunInJob(`windows-${a}`, 'echo ubuntu-only')(gha), `unexpected step in windows-${a}`)
+            }
+        },
+    },
+    defaultSetup: {
+        functionalscriptPackage: () => {
+            const gha = runDefault('{"name":"functionalscript"}')
+            assert(hasRun('fjs test')(gha), 'expected fjs self-test')
+            assert(hasRun(`deno run -A --minimum-dependency-age=0 npm:functionalscript@${functionalscript} test`)(gha), 'expected deno self-test')
+            assert(hasRun(`bunx functionalscript@${functionalscript} test`)(gha), 'expected bun self-test')
+        },
+        otherPackage: () => {
+            const gha = runDefault('{"name":"other-package"}')
+            assert(hasRun(`deno run -A --minimum-dependency-age=0 npm:functionalscript@${functionalscript} test`)(gha), 'expected canonical deno self-test')
+            assert(hasRun(`bunx functionalscript@${functionalscript} test`)(gha), 'expected canonical bun self-test')
+        },
+        configuredPackageVersion: () => {
+            const gha = runDefault('{"name":"other-package","version":"1.2.3"}')
+            assert(hasRun(`npm install -g functionalscript@${functionalscript}`)(gha), 'expected configured-version platform install')
+            assert(hasRun(`deno install -g -A --minimum-dependency-age=0 npm:functionalscript@${functionalscript}`)(gha), 'expected configured-version deno install cache')
+            assert(hasRun('deno install --frozen')(gha), 'expected deno lock install')
+            assert(hasRun(`deno run -A --minimum-dependency-age=0 npm:functionalscript@${functionalscript} test`)(gha), 'expected configured-version deno install')
+            assert(hasRun('deno task cov')(gha), 'expected deno coverage task')
+            assert(hasRun(`bun install -g functionalscript@${functionalscript}`)(gha), 'expected configured-version bun cache')
+            assert(hasRun('bun install --frozen-lockfile')(gha), 'expected bun lock install')
+            assert(hasRun(`bunx functionalscript@${functionalscript} test`)(gha), 'expected configured-version bun install')
+        },
+        missingPackageJson: () => {
+            const gha = runDefault()
+            assert(hasRun(`npm install -g functionalscript@${functionalscript}`)(gha), 'expected configured-version install')
+        },
+    },
+    nixFlakes: () => {
+        const [state, result] = virtual(makeState(false, undefined))(main())
+        assertEq(result, 0)
+        for (const { id, packages } of nodeNixJobs) {
+            const [nodePackage] = packages
+            assert(
+                flake(state, id).includes(`pkgs.${nodePackage}`),
+                `expected ${nodePackage} in the ${id} flake`)
+        }
+    },
+    nixFlakeJob: () => {
+        const gha = run(false)
+        const job = gha.jobs['nix-flakes']
+        assert(job !== undefined, 'expected the temporary flake job')
+        assert(
+            job.steps.some(step => step.uses?.startsWith('cachix/install-nix-action@') === true),
+            'expected a pinned Nix installer')
+        // Exactly one check per unmigrated flake: none goes unchecked, and no
+        // check outlives the flake it was written for. A migrated job checks its
+        // own flake by running through it, so it is not covered here.
+        assertEq(job.steps.filter(step => step.run !== undefined).length, nodeNixJobs.length)
+        for (const { id } of nodeNixJobs) {
+            assert(
+                hasRunInJob('nix-flakes', `nix develop ./nix/generated/${id} --command node --version`)(gha),
+                `expected the ${id} flake to be instantiated`)
+        }
+        // Since the flakes no longer assert their own version, this job is the
+        // only place the Nix runtime is tied to the version `setup-node` installs.
+        for (const version of [node.node22, node.node24, node.default]) {
+            assert(
+                hasRunInJob('nix-flakes', `= v${version}`)(gha),
+                `expected the flake job to check Node ${version}`)
+        }
+        // The canonical Node jobs keep their current runtime setup until they
+        // are migrated one at a time.
+        for (const { id } of nodeNixJobs) {
+            assert(!hasRunInJob(id, 'nix develop')(gha), `unexpected nix develop in ${id}`)
+        }
+    },
+    ubuntu: () => {
+        const job = ubuntu([test({ run: 'echo hi' })])
+        assert(job['runs-on'] !== undefined, 'expected runs-on')
+        assert(job.steps.length > 0, 'expected steps')
+    },
+}

package/fjs/ci/rust/module.f.d.mts

@@ -0,0 +1,15 @@
+/**
+ * CI step builder for the Rust crate: platform compatibility jobs run native
+ * tests and Clippy, Intel jobs also run 32-bit target tests and Clippy, and the
+ * canonical WASM job installs Wasmtime and Wasmer before exercising every WASM
+ * target.
+ *
+ * @module
+ *
+ * @import { Architecture, MetaStep, Os } from '../common/types.ts'
+ */
+import type { Architecture, MetaStep, Os } from '../common/types.ts';
+/** @type {(v: Os, a: Architecture) => readonly MetaStep[]} */
+export declare const rustPlatformSteps: (v: Os, a: Architecture) => readonly MetaStep[];
+/** @type {readonly MetaStep[]} */
+export declare const rustWasmSteps: readonly MetaStep[];