feat: CDDL-to-Zod generator, verified against wire-mesh's conformance vectors - #3

Mirrors wire-mesh's conformance/ package convention: pnpm + Node's native TS execution for scripts, tsdown for the dual ESM/CJS library build, attw verifying the published package surface, a split tsconfig (tightly scoped to the build entry vs. a looser one covering scripts/tests/configs), and underscore-prefixed turbo task names so the public package.json scripts don't recursively resolve to themselves.

emitModule walks the vendored parser's AST and produces a TypeScript module with one z.lazy()-wrapped schema plus one inferred type per rule, scoped to the CDDL subset wire-mesh's spec actually uses: maps (with at most one open key => value tail, resolving an arrow-syntax key to its literal wire value when it names a single-literal rule rather than the rule's own name), fixed and homogeneous arrays, socket unions (a rule's base definition plus every /= choice-addition, whatever mix of map/array/variable shapes they use), and the .size/.regexp/.cbor/.cborseq control operators. Anything outside that subset throws a clear, rule-named error rather than silently emitting something wrong.

cborDecodesAs (src/runtime.ts) validates a .cbor/.cborseq bstr field's embedded content against its referenced schema without transforming the field itself, so re-encoding a validated value reproduces the exact bytes that were decoded.

src/cli.ts is the thin script entry (node src/cli.ts <input.cddl> <output.ts>), run directly rather than through the packaged library surface.

For every vector in wire-mesh's frames/handshake/tokens conformance files (copied here as fixtures, alongside its real spec/protocol.cddl), decodes the recorded wire_hex, validates the result against the schema generated from protocol.cddl, and re-encodes it -- asserting the output matches wire_hex exactly. This is cddl.js's actual definition of done: not that the generator runs without throwing, but that its output round-trips real, previously-agreed wire bytes byte-for-byte.

The generated module is written to test/fixtures/generated/protocol.ts at test time (gitignored) rather than committed, since it's a deterministic function of the fixture .cddl; a sibling runtime.ts re-exports src/runtime.ts so the generated module's own "./runtime.js" import resolves without duplicating that file's content.

The generator's own definition of done -- conformance vectors round-trip byte-exactly through the generated schemas -- needs to actually run somewhere other than a developer's machine to mean anything.