@stll/oxlint-config 0.10.0 → 0.12.0

package/dist/toolchain-guard.cjs

@@ -0,0 +1,3302 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+let node_fs = require("node:fs");
+let node_child_process = require("node:child_process");
+let node_path = require("node:path");
+node_path = __toESM(node_path, 1);
+let semver = require("semver");
+let picomatch = require("picomatch");
+picomatch = __toESM(picomatch, 1);
+let smol_toml = require("smol-toml");
+let yaml = require("yaml");
+//#region src/cloud-setup-install.ts
+const packageInstall = String.raw`
+# Prevent package maintainer scripts from starting unmanaged system services.
+apt_install() (
+  # EXIT runs after function locals expire; this subshell owns the trap state.
+  backup=''
+  policy_state=untouched
+  [[ ! -L /var/lock/stll-cloud-apt.lock ]] || fail 'Invalid package install lock'
+  exec 8>/var/lock/stll-cloud-apt.lock
+  flock -x -w 120 8 || fail 'Another package installation is active'
+  [[ ! -L /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy symlink'
+  [[ ! -e /usr/sbin/policy-rc.d || -f /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy file'
+  backup="$(mktemp -d)"
+  cleanup_package_policy() {
+    local status=$?
+    trap - EXIT HUP INT TERM
+    if [[ "$policy_state" == installed ]]; then
+      if [[ -f "$backup/original" ]]; then
+        if ! cp -p "$backup/original" /usr/sbin/policy-rc.d; then status=1; fi
+      else
+        if ! rm -f /usr/sbin/policy-rc.d; then status=1; fi
+      fi
+    fi
+    rm -rf -- "$backup"
+    exit "$status"
+  }
+  trap cleanup_package_policy EXIT
+  trap 'exit 129' HUP
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+  if [[ -e /usr/sbin/policy-rc.d ]]; then cp -p /usr/sbin/policy-rc.d "$backup/original"; fi
+  policy_state=installed
+  printf '%s\n' '#!/bin/sh' 'exit 101' > /usr/sbin/policy-rc.d
+  chmod 755 /usr/sbin/policy-rc.d
+  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$@"
+)
+
+`;
+const postgresSourceLine = "deb [signed-by=/usr/share/keyrings/stll-pgdg.asc] https://apt.postgresql.org/pub/repos/apt noble-pgdg main";
+const postgresSigningFingerprint = "B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8";
+const postgresSources = String.raw`
+pgdg_key_fingerprint() {
+  gpg --batch --show-keys --with-colons "$1" | awk -F: '$1 == "pub" { primary = 1 } $1 == "sub" { primary = 0 } $1 == "fpr" && primary { print toupper($10); primary = 0 }'
+}
+pgdg_sources_ready() {
+  local managed="$1" file mode records suite keyring override fingerprint selected_keyring=''
+  shift
+  PGDG_SOURCE_STATE=missing
+  [[ ! -L "$managed" ]] || fail "Managed PGDG source must not be a symlink: $managed"
+  for file in "$@"; do
+    [[ -e "$file" ]] || continue
+    [[ -f "$file" ]] || fail "APT source must be a regular file: $file"
+    case "$file" in *.sources) mode=sources ;; *) mode=list ;; esac
+    records="$(awk -v mode="$mode" '
+      function trim(value) { gsub(/^[[:space:]]+|[[:space:]]+$/, "", value); return value }
+      function pgdg_uri(uri) {
+        uri = tolower(uri)
+        if (uri !~ /^[a-z][a-z0-9+.-]*:\/\//) return 0
+        sub(/^[a-z][a-z0-9+.-]*:\/\//, "", uri)
+        sub(/[\/?#].*$/, "", uri)
+        sub(/^.*@/, "", uri)
+        sub(/:.*$/, "", uri)
+        return uri == "apt.postgresql.org" || uri == "apt.postgresql.org."
+      }
+      function contains_pgdg(value, tokens, count, token_index) {
+        count = split(value, tokens, /[[:space:]]+/)
+        for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) return 1
+        return 0
+      }
+      function unsafe_field(name) {
+        return name ~ /^(trusted|allow-insecure|allow-weak|allow-downgrade-to-insecure)$/
+      }
+      function disabled_override(value) {
+        value = tolower(trim(value))
+        gsub(/^["\047]|["\047]$/, "", value)
+        return value ~ /^(no|false|without|off|disable|0)$/
+      }
+      function stanza(override_index) {
+        override = 0
+        for (override_index = 1; override_index <= override_count; override_index++) {
+          if (!disabled_override(override_values[override_index])) override = 1
+          delete override_values[override_index]
+        }
+        if (tolower(trim(enabled)) != "no" && pgdg) print (trim(suites) == "" ? "-" : trim(suites)) "\t" (trim(keyring) == "" ? "-" : trim(keyring)) "\t" (override ? "unsafe" : "safe")
+        enabled = ""; pgdg = 0; field = ""; suites = ""; keyring = ""; override = 0; override_count = 0
+      }
+      /^[[:space:]]*#/ { if (mode == "list" || $0 ~ /^#/) next }
+      {
+        line = $0
+        if (mode == "list") {
+          sub(/[[:space:]]*#.*$/, "", line)
+          if (line !~ /^[[:space:]]*deb(-src)?[[:space:]]/ || !contains_pgdg(line)) next
+          keyring = ""; override = 0
+          if (match(line, /\[[^]]*\]/)) {
+            options = substr(line, RSTART + 1, RLENGTH - 2)
+            count = split(options, tokens, /[[:space:]]+/)
+            for (token_index = 1; token_index <= count; token_index++) {
+              if (tolower(tokens[token_index]) ~ /^signed-by=/) { keyring = tokens[token_index]; sub(/^[^=]*=/, "", keyring) }
+              option_name = tolower(tokens[token_index]); sub(/=.*/, "", option_name)
+              option_value = tokens[token_index]; sub(/^[^=]*=/, "", option_value)
+              if (unsafe_field(option_name) && !disabled_override(option_value)) override = 1
+            }
+            sub(/\[[^]]*\]/, "", line)
+          }
+          count = split(line, tokens, /[[:space:]]+/)
+          for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) print (tokens[token_index + 1] == "" ? "-" : tokens[token_index + 1]) "\t" (keyring == "" ? "-" : keyring) "\t" (override ? "unsafe" : "safe")
+          next
+        }
+        if (line ~ /^[[:space:]]*$/) { stanza(); next }
+        if (line ~ /^[[:space:]]/) {
+          if (field == "uris" && contains_pgdg(line)) pgdg = 1
+          if (field == "enabled") enabled = enabled " " line
+          if (field == "suites") suites = suites " " line
+          if (field == "signed-by") keyring = keyring " " line
+          if (unsafe_field(field)) override_values[override_count] = override_values[override_count] " " line
+          next
+        }
+        field = tolower(line)
+        sub(/:.*/, "", field)
+        value = line
+        sub(/^[^:]*:[[:space:]]*/, "", value)
+        if (field == "uris" && contains_pgdg(value)) pgdg = 1
+        if (field == "enabled") enabled = value
+        if (field == "suites") suites = value
+        if (field == "signed-by") keyring = value
+        if (unsafe_field(field)) override_values[++override_count] = value
+      }
+      END { if (mode == "sources") stanza() }
+    ' "$file")" || fail "Cannot inspect APT source: $file"
+    if [[ "$file" == "$managed" && -z "$records" ]]; then
+      fail "Managed PGDG source has no active PGDG entry: $file"
+    fi
+    while IFS=$'\t' read -r suite keyring override; do
+      [[ -n "$suite" ]] || continue
+      [[ "$override" == safe ]] || fail "PGDG source enables an unsafe trust override: $file"
+      [[ "$suite" == noble-pgdg && "$keyring" == /* && ! "$keyring" =~ [[:space:],] ]] || fail "PGDG source requires noble-pgdg and one Signed-By keyring: $file"
+      [[ -z "$selected_keyring" || "$selected_keyring" == "$keyring" ]] || fail "Conflicting PGDG Signed-By keyrings: $file"
+      fingerprint="$(pgdg_key_fingerprint "$keyring")" || fail "Cannot verify PGDG Signed-By keyring: $file"
+      [[ "$fingerprint" == @PGDG_FINGERPRINT@ ]] || fail "PGDG Signed-By fingerprint mismatch: $file"
+      selected_keyring="$keyring"
+      PGDG_SOURCE_STATE=reuse
+    done <<< "$records"
+  done
+}
+`;
+const postgresInstall = String.raw`
+  postgres_ready() {
+    local binary
+    for binary in postgres initdb pg_ctl psql createdb; do
+      [[ -x "/usr/lib/postgresql/@POSTGRES@/bin/$binary" ]] || return 1
+    done
+    /usr/lib/postgresql/@POSTGRES@/bin/postgres --version | grep -Eq '^postgres \(PostgreSQL\) @POSTGRES@\.'
+  }
+  if ! postgres_ready; then
+    pgdg_sources_ready /etc/apt/sources.list.d/stll-pgdg.list /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources
+    if [[ "$PGDG_SOURCE_STATE" == missing ]]; then
+      local key key_fingerprint
+      key="$(mktemp)"
+      curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 https://www.postgresql.org/media/keys/ACCC4CF8.asc -o "$key"
+      key_fingerprint="$(pgdg_key_fingerprint "$key")"
+      [[ "$key_fingerprint" == @PGDG_FINGERPRINT@ ]] || fail 'PostgreSQL signing key mismatch'
+      install -d -m 755 /usr/share/keyrings
+      install -m 644 "$key" /usr/share/keyrings/stll-pgdg.asc
+      rm -- "$key"
+      printf '%s\n' '@PGDG_SOURCE@' > /etc/apt/sources.list.d/stll-pgdg.list
+    fi
+    apt-get update
+    apt_install postgresql-@POSTGRES@ postgresql-client-@POSTGRES@
+  fi
+  postgres_ready || fail 'PostgreSQL toolchain is incomplete or differs from the policy major'
+`;
+const valkeyInstall = String.raw`
+  if ! command -v valkey-server >/dev/null || [[ "$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\1/p')" != '@VALKEY@' ]] || ! command -v valkey-cli >/dev/null || [[ "$(valkey-cli --version)" != 'valkey-cli @VALKEY@' ]]; then
+    local scratch server_url server_sha tools_url tools_sha package
+    scratch="$(mktemp -d)"
+    chmod 755 "$scratch"
+    case "$ARCH" in
+      amd64) server_url='@AMD64_SERVER_URL@'; server_sha='@AMD64_SERVER_SHA@'; tools_url='@AMD64_TOOLS_URL@'; tools_sha='@AMD64_TOOLS_SHA@' ;;
+      arm64) server_url='@ARM64_SERVER_URL@'; server_sha='@ARM64_SERVER_SHA@'; tools_url='@ARM64_TOOLS_URL@'; tools_sha='@ARM64_TOOLS_SHA@' ;;
+      *) fail 'Unsupported Valkey architecture' ;;
+    esac
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "$server_url" -o "$scratch/valkey-server.deb"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "$tools_url" -o "$scratch/valkey-tools.deb"
+    (cd "$scratch"; printf '%s  %s\n' "$server_sha" valkey-server.deb "$tools_sha" valkey-tools.deb | sha256sum --strict -c -)
+    for package in valkey-server valkey-tools; do
+      [[ "$(dpkg-deb -f "$scratch/$package.deb" Package)" == "$package" ]] || fail 'Valkey artifact package mismatch'
+      [[ "$(dpkg-deb -f "$scratch/$package.deb" Version)" == '@VALKEY@-1.noble' ]] || fail 'Valkey artifact version mismatch'
+      [[ "$(dpkg-deb -f "$scratch/$package.deb" Architecture)" == "$ARCH" ]] || fail 'Valkey artifact architecture mismatch'
+    done
+    apt-get update
+    apt_install "$scratch/valkey-server.deb" "$scratch/valkey-tools.deb"
+    rm -rf -- "$scratch"
+  fi
+  [[ "$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\1/p')" == '@VALKEY@' ]] || fail 'Valkey version differs from policy'
+  [[ "$(valkey-cli --version)" == 'valkey-cli @VALKEY@' ]] || fail 'Valkey client version differs from policy'
+`;
+const state = String.raw`
+service_account_ready() {
+  local uid gid shell
+  uid="$(id -u stll-cloud)" || fail 'Service user is unavailable; run install'
+  gid="$(id -g stll-cloud)"
+  shell="$(getent passwd stll-cloud | cut -d: -f7)"
+  [[ "$uid" =~ ^[1-9][0-9]*$ && "$gid" =~ ^[1-9][0-9]*$ && "$shell" == /usr/sbin/nologin ]] || fail 'Service user must be unprivileged with no login shell'
+}
+prepare_state() {
+  service_account_ready
+  [[ ! -L /var/lib/stll-cloud ]] || fail 'Service state root must not be a symlink'
+  if [[ -e /var/lib/stll-cloud ]]; then
+    [[ -d /var/lib/stll-cloud && "$(stat -c '%u:%a' /var/lib/stll-cloud)" == 0:755 ]] || fail 'Invalid service state root'
+  else
+    install -d -m 755 -o root -g root /var/lib/stll-cloud
+  fi
+  STATE="/var/lib/stll-cloud/$(printf '%s' "$REPO_ROOT" | sha256sum | cut -d' ' -f1)"
+  [[ ! -L "$STATE" ]] || fail 'Service state must not be a symlink'
+  if [[ -e "$STATE" ]]; then
+    [[ -d "$STATE" && "$(stat -c '%u:%a' "$STATE")" == 0:710 && "$(stat -c '%g' "$STATE")" == "$(id -g stll-cloud)" ]] || fail 'Invalid service state ownership'
+  else
+    install -d -m 710 -o root -g stll-cloud "$STATE"
+  fi
+  [[ ! -L "$STATE/lock" ]] || fail 'Service lock must not be a symlink'
+  exec 9>"$STATE/lock"
+  flock -x -w 10 9 || fail 'Another setup process owns the service state'
+}
+`;
+const renderCloudServiceInstall = ({ services, postgres, valkey, valkeyArtifacts }) => {
+	const parts = services.map((service) => {
+		switch (service) {
+			case "postgres": return postgresInstall.replaceAll("@POSTGRES@", postgres).replaceAll("@PGDG_SOURCE@", postgresSourceLine).replaceAll("@PGDG_FINGERPRINT@", postgresSigningFingerprint);
+			case "valkey": {
+				const replacements = /* @__PURE__ */ new Map([
+					["@VALKEY@", valkey],
+					["@AMD64_SERVER_URL@", valkeyArtifacts.amd64.server.url],
+					["@AMD64_SERVER_SHA@", valkeyArtifacts.amd64.server.sha256],
+					["@AMD64_TOOLS_URL@", valkeyArtifacts.amd64.tools.url],
+					["@AMD64_TOOLS_SHA@", valkeyArtifacts.amd64.tools.sha256],
+					["@ARM64_SERVER_URL@", valkeyArtifacts.arm64.server.url],
+					["@ARM64_SERVER_SHA@", valkeyArtifacts.arm64.server.sha256],
+					["@ARM64_TOOLS_URL@", valkeyArtifacts.arm64.tools.url],
+					["@ARM64_TOOLS_SHA@", valkeyArtifacts.arm64.tools.sha256]
+				]);
+				return valkeyInstall.replace(/@[A-Z0-9_]+@/g, (token) => {
+					const value = replacements.get(token);
+					if (value === void 0) throw new Error(`Missing Valkey artifact field: ${token}`);
+					return value;
+				});
+			}
+			default: throw new Error(`Unsupported service: ${String(service)}`);
+		}
+	});
+	const user = services.length === 0 ? "" : "  if ! id stll-cloud >/dev/null 2>&1; then useradd --system --user-group --no-create-home --shell /usr/sbin/nologin stll-cloud; fi\n  service_account_ready\n";
+	return `${packageInstall}\n${services.includes("postgres") ? postgresSources.replaceAll("@PGDG_FINGERPRINT@", postgresSigningFingerprint) : ""}\n${services.length === 0 ? "prepare_state() { :; }\n" : state}\ninstall_services() {\n${user}${parts.join("")}\n  :\n}\n`;
+};
+//#endregion
+//#region src/cloud-setup-schema.ts
+const cloudServices = ["postgres", "valkey"];
+const cloudInstallCommand = "bun install --frozen-lockfile";
+const cloudService = (value) => cloudServices.some((service) => value === service);
+/** Parse an explicit declaration without assuming services for undeclared repositories. */
+const parseCloudSetup = (input) => {
+	if (input === void 0) return void 0;
+	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error("cloud must be an object");
+	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile") throw new Error(`unsupported cloud key: ${key}`);
+	if (!("services" in input) || !Array.isArray(input.services)) throw new Error("cloud.services must be an explicit array");
+	if (!("install" in input) || input.install !== "bun install --frozen-lockfile") throw new Error(`cloud.install must be exactly ${cloudInstallCommand}`);
+	if (!("envFile" in input) || typeof input.envFile !== "string") throw new Error("cloud.envFile must be a canonical repository-relative path");
+	const envFile = input.envFile;
+	if (envFile.startsWith("/") || /^[A-Za-z]:/.test(envFile) || envFile.includes("\\") || /\p{Cc}/u.test(envFile) || envFile.split("/").some((part) => part === "" || part === "." || part === "..")) throw new Error("cloud.envFile must be a canonical repository-relative path");
+	const seen = /* @__PURE__ */ new Set();
+	return {
+		services: Array.from(input.services, (service) => {
+			if (!cloudService(service)) throw new Error("cloud.services contains an unsupported service");
+			if (seen.has(service)) throw new Error(`cloud.services contains duplicate service: ${service}`);
+			seen.add(service);
+			return service;
+		}),
+		install: cloudInstallCommand,
+		envFile
+	};
+};
+//#endregion
+//#region src/cloud-setup-services.ts
+const common = String.raw`
+service_file() {
+  local file="$1" owner="$2"
+  [[ ! -L "$file" ]] || fail "Service state must not contain symbolic links"
+  if [[ -e "$file" ]]; then
+    [[ -f "$file" && "$(stat -c '%u:%a' "$file")" == "$owner:600" ]] || fail "Invalid service state file"
+  fi
+}
+service_directory() {
+  local directory="$1"
+  [[ ! -L "$directory" ]] || fail "Service directory must not be a symbolic link"
+  if [[ -e "$directory" ]]; then
+    [[ -d "$directory" && "$(stat -c '%u:%a' "$directory")" == "$SERVICE_UID:700" ]] || fail "Invalid service directory"
+  else
+    root install -d -m 700 -o stll-cloud -g stll-cloud "$directory"
+  fi
+}
+service_password() {
+  local file="$1"
+  service_file "$file" 0
+  if [[ ! -e "$file" ]]; then
+    (umask 077; openssl rand -hex 32 > "$file")
+    root chown root:root "$file"
+  fi
+  [[ "$(cat "$file")" =~ ^[0-9a-f]{64}$ ]] || fail "Invalid service credential state"
+}
+service_process_matches() {
+  local pid="$1" executable="$2" owner actual expected
+  [[ "$pid" =~ ^[1-9][0-9]*$ && -d "/proc/$pid" ]] || return 1
+  owner="$(stat -c '%u' "/proc/$pid" 2>/dev/null)" || return 2
+  [[ "$owner" =~ ^[0-9]+$ ]] || return 2
+  [[ "$owner" == "$SERVICE_UID" ]] || return 1
+  actual="$(readlink -f "/proc/$pid/exe" 2>/dev/null)" || return 2
+  expected="$(readlink -f "$executable")" || return 2
+  [[ -n "$actual" && -n "$expected" && "$actual" != *' (deleted)' ]] || return 2
+  [[ "$actual" == "$expected" ]]
+}
+service_process() {
+  service_process_matches "$1" "$2" || fail "Managed service process identity differs from the recorded state"
+}
+service_prune_pid() {
+  local file="$1" executable="$2" service="$3" pid identity
+  [[ -e "$file" ]] || return 0
+  pid="$(head -n 1 "$file")"
+  # PostgreSQL encodes a standalone backend with a negative PID.
+  if [[ "$service" == postgres ]]; then pid="$(printf '%s' "$pid" | sed 's/^-//')"; fi
+  if service_process_matches "$pid" "$executable"; then return 0; else identity=$?; fi
+  [[ "$identity" != 2 ]] || fail "Cannot verify recorded live service process; retaining its PID file"
+  # Let PostgreSQL check orphan shared memory before removing a dead-PID lock.
+  if [[ "$service" == postgres && "$pid" =~ ^[1-9][0-9]*$ && ! -d "/proc/$pid" ]]; then return 0; fi
+  if [[ "$service" == postgres ]]; then
+    [[ "$pid" =~ ^[1-9][0-9]*$ && "$SERVICE_UID" != 0 ]] || fail "Cannot safely recover PostgreSQL PID state"
+    # The root controller is not our nonroot postgres. Preserve the remaining
+    # lock rows so PostgreSQL's EPERM/ancestor path still checks orphan memory.
+    root sed -i "1s/.*/$$/" "$file"
+    return 0
+  fi
+  # Restored state can name an unrelated live process; never signal that PID.
+  root rm -- "$file"
+}
+`;
+const postgresStart = String.raw`
+  local pg_bin='/usr/lib/postgresql/@POSTGRES@/bin' pg_data="$STATE/postgres" pg_password pg_details pg_pid pg_version
+  service_password "$STATE/postgres.password"
+  pg_password="$(cat "$STATE/postgres.password")"
+  service_directory "$pg_data"
+  for file in PG_VERSION postmaster.pid postgresql.conf pg_hba.conf pg_ident.conf postgresql.auto.conf; do
+    service_file "$pg_data/$file" "$SERVICE_UID"
+  done
+  if [[ ! -e "$pg_data/PG_VERSION" ]]; then
+    [[ -z "$(ls -A "$pg_data")" ]] || fail "PostgreSQL data directory is not initialized"
+    service_file "$STATE/postgres.init-password" "$SERVICE_UID"
+    (umask 077; printf '%s\n' "$pg_password" > "$STATE/postgres.init-password")
+    root chown stll-cloud:stll-cloud "$STATE/postgres.init-password"
+    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/initdb" -D "$pg_data" --username=stll_cloud --auth-host=scram-sha-256 --auth-local=scram-sha-256 --pwfile="$STATE/postgres.init-password" --encoding=UTF8 --locale=C --set=unix_socket_directories= >/dev/null || fail "PostgreSQL initialization failed"
+    root rm "$STATE/postgres.init-password"
+  fi
+  [[ -f "$pg_data/PG_VERSION" && "$(cat "$pg_data/PG_VERSION")" == '@POSTGRES@' ]] || fail "PostgreSQL data has a different major version"
+  service_prune_pid "$pg_data/postmaster.pid" "$pg_bin/postgres" postgres
+  if ! service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/pg_ctl" -D "$pg_data" status >/dev/null 2>&1; then
+    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/pg_ctl" -D "$pg_data" -l "$pg_data/cloud.log" -o "-h 127.0.0.1 -p 55432 -c unix_socket_directories=" -t 10 -w start >/dev/null || fail "PostgreSQL start failed; port 55432 must be available"
+  fi
+  pg_details="$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/psql" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c "SELECT current_setting('data_directory'), current_setting('listen_addresses'), current_setting('port'), current_setting('server_version_num'), current_setting('unix_socket_directories')")" || fail "PostgreSQL authenticated readiness failed"
+  pg_version="$(printf '%s\n' "$pg_details" | cut -d '|' -f4)"
+  [[ "$pg_details" == "$pg_data|127.0.0.1|55432|$pg_version|" && "$pg_version" =~ ^[0-9]{6}$ ]] || fail "PostgreSQL endpoint does not match managed data and listener"
+  (( pg_version / 10000 == @POSTGRES@ )) || fail "PostgreSQL endpoint has a different major version"
+  pg_pid="$(head -n 1 "$pg_data/postmaster.pid")"
+  service_process "$pg_pid" "$pg_bin/postgres"
+  [[ "$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/psql" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c "SELECT count(*) FROM pg_database WHERE datname = 'cloud_test'")" == 1 ]] || env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/createdb" -h 127.0.0.1 -p 55432 -U stll_cloud cloud_test || fail "PostgreSQL test database creation failed"
+  DATABASE_URL="postgresql://stll_cloud:$pg_password@127.0.0.1:55432/cloud_test"
+`;
+const valkeyStart = String.raw`
+  local vk_data="$STATE/valkey" vk_password vk_config vk_info vk_pid vk_expected ready=0
+  service_password "$STATE/valkey.password"
+  vk_password="$(cat "$STATE/valkey.password")"
+  service_directory "$vk_data"
+  vk_config="$vk_data/valkey.conf"
+  service_file "$vk_config" "$SERVICE_UID"
+  for file in valkey.pid valkey.log dump.rdb; do
+    [[ ! -L "$vk_data/$file" ]] || fail "Valkey state must not contain symbolic links"
+    if [[ -e "$vk_data/$file" ]]; then
+      [[ -f "$vk_data/$file" && "$(stat -c '%u' "$vk_data/$file")" == "$SERVICE_UID" ]] || fail "Invalid Valkey state file"
+    fi
+  done
+  vk_expected="$(printf '%s\n' 'bind 127.0.0.1' 'port 56379' 'protected-mode yes' 'daemonize yes' "requirepass $vk_password" "dir $vk_data" "pidfile $vk_data/valkey.pid" "logfile $vk_data/valkey.log" 'save ""' 'appendonly no')"
+  if [[ ! -e "$vk_config" ]]; then
+    (umask 077; printf '%s\n' "$vk_expected" > "$vk_config")
+    root chown stll-cloud:stll-cloud "$vk_config"
+  fi
+  [[ "$(cat "$vk_config")" == "$vk_expected" ]] || fail "Valkey configuration differs from managed settings"
+  service_prune_pid "$vk_data/valkey.pid" "$(command -v valkey-server)" valkey
+  if [[ ! -e "$vk_data/valkey.pid" ]]; then
+    service_run valkey-server "$vk_config" || fail "Valkey start failed; port 56379 must be available"
+  fi
+  for ((attempt=0; attempt<20; attempt++)); do
+    if vk_info="$(VALKEYCLI_AUTH="$vk_password" timeout 0.2 valkey-cli -h 127.0.0.1 -p 56379 --raw INFO server 2>/dev/null)"; then
+      if [[ "$vk_info" == *$'valkey_version:@VALKEY@\r\n'* && "$vk_info" == *"config_file:$vk_config"$'\r\n'* ]]; then ready=1; break; fi
+    fi
+    sleep 0.25
+  done
+  [[ "$ready" == 1 ]] || fail "Valkey authenticated readiness or managed version/configuration check failed"
+  [[ -f "$vk_data/valkey.pid" ]] || fail "Valkey managed process identifier is unavailable"
+  vk_pid="$(cat "$vk_data/valkey.pid")"
+  service_process "$vk_pid" "$(command -v valkey-server)"
+  [[ "$vk_info" == *"process_id:$vk_pid"$'\r\n'* ]] || fail "Valkey endpoint has a different process identifier"
+  [[ "$(VALKEYCLI_AUTH="$vk_password" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET bind)" == $'bind\n127.0.0.1' ]] || fail "Valkey endpoint must bind only loopback"
+  [[ "$(VALKEYCLI_AUTH="$vk_password" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET dir)" == "$(printf 'dir\n%s' "$vk_data")" ]] || fail "Valkey endpoint has a different data directory"
+  REDIS_URL="redis://:$vk_password@127.0.0.1:56379/0"
+`;
+/** Render only declared services; installation and environment-file ownership stay with the caller. */
+const renderCloudServiceStart = ({ services, postgres, valkey }) => {
+	if (!/^[1-9][0-9]*$/.test(postgres) || !/^\d+\.\d+\.\d+$/.test(valkey)) throw new Error("Invalid cloud service runtime policy");
+	if (services.length === 0) return "start_services() { :; }\n";
+	const bodies = services.map((service) => {
+		switch (service) {
+			case "postgres": return postgresStart.replaceAll("@POSTGRES@", postgres);
+			case "valkey": return valkeyStart.replaceAll("@VALKEY@", valkey);
+			default: throw new Error(`Unsupported cloud service: ${String(service)}`);
+		}
+	});
+	return `${common}\nstart_services() {\n  local SERVICE_UID file attempt\n  SERVICE_UID="$(id -u stll-cloud)"\n  [[ -d "$STATE" && ! -L "$STATE" && "$(stat -c '%u' "$STATE")" == 0 ]] || fail "Invalid cloud service state directory"\n${bodies.join("")}\n}\n`;
+};
+//#endregion
+//#region src/toolchain-node.ts
+const numericComponent = "(?:0|[1-9]\\d*)";
+const policyPattern = new RegExp(`^${numericComponent}\\.x$`);
+const selectorPattern = new RegExp(`^(${numericComponent})(?:\\.(?:x|${numericComponent}(?:\\.${numericComponent})?))?$`);
+/** A Node policy selects the complete stable release series of one major. */
+const nodePolicyValid = (value) => policyPattern.test(value) && (0, semver.validRange)(value) !== null;
+/** Static selectors may narrow that series, but cannot float across majors. */
+const nodeSelectorMatches = (value, policy) => {
+	if (!nodePolicyValid(policy) || typeof value !== "string") return false;
+	const major = selectorPattern.exec(value)?.[1];
+	return major !== void 0 && major === policy.slice(0, -2) && (0, semver.validRange)(value) !== null;
+};
+/** Engines must support every stable release in the approved major series. */
+const nodeSupportRangeMatches = (policy, range) => {
+	if (!nodePolicyValid(policy)) return false;
+	try {
+		return (0, semver.subset)(policy, range);
+	} catch {
+		return false;
+	}
+};
+//#endregion
+//#region src/cloud-setup.ts
+const cloudSetupPath = ".agents/cloud-setup.sh";
+const cloudEnvironmentMarker = "# Generated by stll-cloud-setup; disposable local test services.";
+const script = String.raw`#!/usr/bin/env bash
+# Generated by stll-cloud-setup. Regenerate with stll-cloud-setup.
+# Networked installation and offline service startup are separate lifecycle steps.
+# Cached filesystems may not preserve processes; run start at every session start.
+# Supported platform: Ubuntu 24.04 (noble), amd64/arm64, root or passwordless sudo.
+set -euo pipefail
+
+usage() { echo 'Usage: cloud-setup.sh install|start' >&2; exit 2; }
+[[ "$#" == 1 ]] || usage
+case "$1" in install|start) MODE="$1" ;; *) usage ;; esac
+fail() { echo "cloud-setup: $*" >&2; exit 1; }
+trap 'echo "cloud-setup: command failed at line $LINENO" >&2' ERR
+[[ -f /etc/os-release ]] || fail 'Ubuntu 24.04 is required'
+. /etc/os-release
+[[ "$ID" == ubuntu && "$VERSION_ID" == 24.04 && "$VERSION_CODENAME" == noble ]] || fail 'Only Ubuntu 24.04 (noble) is supported'
+SCRIPT="$(realpath -- "$0")"
+REPO_ROOT="$(cd -- "$(dirname -- "$SCRIPT")/.." && pwd -P)"
+[[ "$SCRIPT" == "$REPO_ROOT/.agents/cloud-setup.sh" ]] || fail 'Run the generated repository script'
+if [[ "$(id -u)" != 0 ]]; then
+  command -v sudo >/dev/null && sudo -n true || fail 'Root or passwordless sudo is required'
+  exec sudo -n -- bash "$SCRIPT" "$MODE"
+fi
+OUTPUT_UID="$(printenv SUDO_UID || id -u)"
+[[ "$OUTPUT_UID" =~ ^[0-9]+$ ]] || fail 'Invalid invoking user'
+OUTPUT_GID="$(getent passwd "$OUTPUT_UID" | cut -d: -f4)"
+[[ "$OUTPUT_GID" =~ ^[0-9]+$ ]] || fail 'Invoking user is unavailable'
+OUTPUT_USER="$(getent passwd "$OUTPUT_UID" | cut -d: -f1)"
+OUTPUT_HOME="$(getent passwd "$OUTPUT_UID" | cut -d: -f6)"
+[[ -n "$OUTPUT_USER" && "$OUTPUT_HOME" == /* && -d "$OUTPUT_HOME" ]] || fail 'Invoking user requires an existing home directory'
+root() { "$@"; }
+service_run() { runuser -u stll-cloud -- "$@" 9>&-; }
+BUN_VERSION='@BUN@'
+NODE_VERSION='@NODE@'
+NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
+BUN_DIR="/opt/stll-cloud/bun/$BUN_VERSION"
+export PATH="$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+BUN_CACHE="/var/cache/stll-cloud/bun/$OUTPUT_UID"
+ENV_FILE=@ENV_FILE@
+ENV_MARKER='@ENV_MARKER@'
+[[ -f "$REPO_ROOT/.node-version" && ! -L "$REPO_ROOT/.node-version" ]] || fail 'A regular root .node-version is required'
+[[ "$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' "$REPO_ROOT/.node-version")" == "$NODE_VERSION" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'
+cd -- "$REPO_ROOT"
+case "$(uname -m)" in
+  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64 ;;
+  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64 ;;
+  *) fail 'Only amd64 and arm64 are supported' ;;
+esac
+
+runtime_ready() {
+  [[ -x "$NODE_DIR/bin/node" && "$($NODE_DIR/bin/node --version)" == "v$NODE_VERSION" ]] || fail 'Pinned Node is unavailable; run install'
+  [[ -x "$BUN_DIR/bun" && "$($BUN_DIR/bun --version)" == "$BUN_VERSION" ]] || fail 'Pinned Bun is unavailable; run install'
+}
+install_runtimes() {
+  if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null; then
+    apt-get update
+    DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux
+  fi
+  local scratch node_archive bun_archive bun_folder
+  scratch="$(mktemp -d)"
+  trap 'rm -rf -- "$scratch"' RETURN
+  if [[ ! -x "$NODE_DIR/bin/node" ]] || [[ "$($NODE_DIR/bin/node --version)" != "v$NODE_VERSION" ]]; then
+    node_archive="node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" -o "$scratch/$node_archive"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" -o "$scratch/node-sums"
+    (cd "$scratch"; awk -v name="$node_archive" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' node-sums | sha256sum --strict -c -)
+    install -d -m 755 "$NODE_DIR"
+    tar -xJf "$scratch/$node_archive" --strip-components=1 -C "$NODE_DIR"
+  fi
+  if [[ ! -x "$BUN_DIR/bun" ]] || [[ "$($BUN_DIR/bun --version)" != "$BUN_VERSION" ]]; then
+    bun_folder="bun-linux-$BUN_ARCH"
+    bun_archive="$bun_folder.zip"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/$bun_archive" -o "$scratch/$bun_archive"
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/SHASUMS256.txt" -o "$scratch/bun-sums"
+    (cd "$scratch"; awk -v name="$bun_archive" '$2 == name || $2 == "*" name { print $1 "  " name; count++ } END { if (count != 1) exit 1 }' bun-sums | sha256sum --strict -c -)
+    unzip -q "$scratch/$bun_archive" -d "$scratch/bun"
+    install -d -m 755 "$BUN_DIR"
+    install -m 755 "$scratch/bun/$bun_folder/bun" "$BUN_DIR/bun"
+  fi
+  runtime_ready
+  ln -sfnT -- "$NODE_DIR/bin/node" /usr/local/bin/node
+  ln -sfnT -- "$NODE_DIR/bin/npm" /usr/local/bin/npm
+  ln -sfnT -- "$NODE_DIR/bin/npx" /usr/local/bin/npx
+  ln -sfnT -- "$BUN_DIR/bun" /usr/local/bin/bun
+  rm -rf -- "$scratch"
+  trap - RETURN
+}
+
+dependency_install() {
+  local directory
+  for directory in /var/cache/stll-cloud /var/cache/stll-cloud/bun; do
+    [[ ! -L "$directory" ]] || fail 'Dependency cache parent must not be a symlink'
+    if [[ -e "$directory" ]]; then
+      [[ -d "$directory" && "$(stat -c '%u' "$directory")" == 0 ]] || fail 'Dependency cache parent must be root-owned'
+    fi
+    install -d -m 755 -o root -g root "$directory"
+  done
+  [[ ! -L "$BUN_CACHE" ]] || fail 'Dependency cache must not be a symlink'
+  if [[ -e "$BUN_CACHE" ]]; then
+    [[ -d "$BUN_CACHE" && "$(stat -c '%u' "$BUN_CACHE")" == "$OUTPUT_UID" ]] || fail 'Dependency cache ownership differs from the invoking user'
+  fi
+  install -d -m 700 -o "$OUTPUT_UID" -g "$OUTPUT_GID" "$BUN_CACHE"
+  runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" BUN_INSTALL_CACHE_DIR="$BUN_CACHE" PATH="$PATH" "$BUN_DIR/bun" install --frozen-lockfile
+}
+
+@SERVICE_INSTALL@
+@SERVICE_START@
+
+validate_environment() {
+  local part target="$REPO_ROOT" env_path="$REPO_ROOT/$ENV_FILE" first_line temporary
+  while IFS= read -r part; do
+    target="$target/$part"
+    [[ ! -L "$target" ]] || fail 'Environment path must not contain symbolic links'
+  done < <(printf '%s\n' "$ENV_FILE" | tr '/' '\n')
+  [[ -d "$(dirname -- "$env_path")" ]] || fail 'Environment parent directory is missing'
+  if [[ -e "$env_path" ]]; then
+    [[ -f "$env_path" ]] || fail 'Environment target must be a regular file'
+    IFS= read -r first_line < "$env_path" || fail 'Refusing to overwrite an unowned environment file'
+    [[ "$first_line" == "$ENV_MARKER" ]] || fail 'Refusing to overwrite an unowned environment file'
+  fi
+}
+write_environment() {
+  validate_environment
+  local env_path="$REPO_ROOT/$ENV_FILE" temporary
+  temporary="$(mktemp "$(dirname -- "$env_path")/.stll-cloud-env.XXXXXX")"
+  chmod 600 "$temporary"
+  {
+    printf '%s\n' "$ENV_MARKER" 'NODE_ENV=test'
+    if [[ -n "$DATABASE_URL" ]]; then printf 'DATABASE_URL=%s\n' "$DATABASE_URL"; fi
+    if [[ -n "$REDIS_URL" ]]; then printf 'REDIS_URL=%s\n' "$REDIS_URL"; fi
+  } > "$temporary"
+  chown "$OUTPUT_UID:$OUTPUT_GID" "$temporary"
+  mv -f -- "$temporary" "$env_path"
+}
+
+if [[ "$MODE" == install ]]; then
+  install_runtimes
+  install_services
+  dependency_install
+  exit 0
+fi
+runtime_ready
+DATABASE_URL=''
+REDIS_URL=''
+validate_environment
+prepare_state
+start_services
+write_environment
+`;
+const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+const generateCloudSetup = ({ policy, cloud, nodeVersion }) => {
+	const selected = parseCloudSetup(cloud);
+	if (selected === void 0) throw new Error("cloud declaration is required");
+	const exactNode = nodeVersion.trim();
+	if ((0, semver.valid)(exactNode) !== exactNode || !nodeSelectorMatches(exactNode, policy.node)) throw new Error("cloud requires a tracked exact .node-version within the shared Node series");
+	const services = cloudServices.filter((service) => selected.services.includes(service));
+	const replacements = /* @__PURE__ */ new Map([
+		["@BUN@", policy.bun],
+		["@NODE@", exactNode],
+		["@ENV_FILE@", shellQuote(selected.envFile)],
+		["@ENV_MARKER@", cloudEnvironmentMarker],
+		["@SERVICE_INSTALL@", renderCloudServiceInstall({
+			services,
+			postgres: policy.postgres,
+			valkey: policy.valkey,
+			valkeyArtifacts: policy.valkeyArtifacts
+		})],
+		["@SERVICE_START@", renderCloudServiceStart({
+			services,
+			postgres: policy.postgres,
+			valkey: policy.valkey
+		})]
+	]);
+	return script.replace(/@[A-Z0-9_]+@/g, (token) => {
+		const value = replacements.get(token);
+		if (value === void 0) throw new Error(`Missing cloud setup field: ${token}`);
+		return value;
+	});
+};
+//#endregion
+//#region src/toolchain-container-inputs.ts
+const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Filename class recognized by Dependabot's Docker Compose fetcher. */
+const isComposeDefinitionPath = (file) => /^\.?(?:docker-)?compose(?:-[\w]+)?(?:\.[\w-]+)?\.ya?ml$/i.test(file.split("/").at(-1) ?? "");
+/** Candidate YAML files are classified by their document shape after reading. */
+const isKubernetesDefinitionPath = (file) => /^[^.].*\.ya?ml$/i.test(file.split("/").at(-1) ?? "");
+const kubernetesPodSpecPaths = {
+	Pod: ["spec"],
+	Deployment: [
+		"spec",
+		"template",
+		"spec"
+	],
+	DaemonSet: [
+		"spec",
+		"template",
+		"spec"
+	],
+	StatefulSet: [
+		"spec",
+		"template",
+		"spec"
+	],
+	ReplicaSet: [
+		"spec",
+		"template",
+		"spec"
+	],
+	ReplicationController: [
+		"spec",
+		"template",
+		"spec"
+	],
+	Job: [
+		"spec",
+		"template",
+		"spec"
+	],
+	CronJob: [
+		"spec",
+		"jobTemplate",
+		"spec",
+		"template",
+		"spec"
+	]
+};
+/** Shared semantic image enumeration for runtime checks and update-root generation. */
+const containerDocumentImages = (document, file) => {
+	if (!record$6(document)) return void 0;
+	const services = document["services"];
+	if (isComposeDefinitionPath(file) && record$6(services)) {
+		const images = [];
+		for (const [name, service] of Object.entries(services)) if (record$6(service) && service["image"] !== void 0) images.push({
+			image: service["image"],
+			path: [
+				"services",
+				name,
+				"image"
+			]
+		});
+		return {
+			ecosystem: "docker-compose",
+			images
+		};
+	}
+	if (typeof document["apiVersion"] !== "string" || typeof document["kind"] !== "string") return void 0;
+	const images = [];
+	const visited = /* @__PURE__ */ new Set();
+	const walkResource = (resource, prefix) => {
+		if (visited.has(resource)) return;
+		visited.add(resource);
+		if (typeof resource["apiVersion"] !== "string" || typeof resource["kind"] !== "string") return;
+		if (resource["kind"] === "List" && Array.isArray(resource["items"])) {
+			for (const [index, item] of resource["items"].entries()) if (record$6(item)) walkResource(item, [
+				...prefix,
+				"items",
+				index
+			]);
+			return;
+		}
+		const specPath = Object.entries(kubernetesPodSpecPaths).find(([kind]) => kind === resource["kind"])?.[1];
+		if (specPath === void 0) return;
+		let spec = resource;
+		for (const key of specPath) spec = record$6(spec) ? spec[key] : void 0;
+		if (!record$6(spec)) return;
+		for (const key of [
+			"containers",
+			"initContainers",
+			"ephemeralContainers"
+		]) {
+			const containers = spec[key];
+			if (!Array.isArray(containers)) continue;
+			for (const [index, container] of containers.entries()) if (record$6(container) && container["image"] !== void 0) images.push({
+				image: container["image"],
+				path: [
+					...prefix,
+					...specPath,
+					key,
+					index,
+					"image"
+				]
+			});
+		}
+	};
+	walkResource(document, []);
+	return images.length === 0 ? void 0 : {
+		ecosystem: "docker",
+		images
+	};
+};
+//#endregion
+//#region src/toolchain-images.ts
+/** Docker Hub spellings accepted by the shared runtime policy. */
+const dockerHubRegistries = [
+	"docker.io",
+	"index.docker.io",
+	"registry-1.docker.io"
+];
+/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */
+const ownedDockerImageAliases = (images) => {
+	const aliases = /* @__PURE__ */ new Set();
+	for (const image of images) for (const repository of [image, `library/${image}`]) {
+		aliases.add(repository);
+		for (const registry of dockerHubRegistries) aliases.add(`${registry}/${repository}`);
+	}
+	return [...aliases].sort();
+};
+/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */
+const canonicalDockerRuntime = (image) => {
+	const registry = dockerHubRegistries.find((entry) => image.toLowerCase().startsWith(`${entry}/`));
+	return (registry === void 0 ? image : image.slice(registry.length + 1)).replace(/^library\//i, "");
+};
+//#endregion
+//#region src/toolchain-inputs.ts
+const excludedInputPath = (file) => file === "" || file.split("/").some((part) => part === "node_modules" || part === "vendor");
+const javascriptDependencyLockfiles = [
+	"bun.lock",
+	"package-lock.json",
+	"yarn.lock",
+	"pnpm-lock.yaml"
+];
+/** Match project, environment, local, and fragment filenames recognized by mise. */
+const isMiseConfigPath = (file) => !excludedInputPath(file) && (/(?:^|\/)\.?mise(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/config(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/conf\.d\/[^./][^/]*\.toml$/.test(file));
+/** GitHub action metadata may live at the repository root or in any directory. */
+const githubAutomationFileKind = (file) => {
+	if (file === "") return void 0;
+	if (/^\.github\/workflows\/[^/]+\.ya?ml$/.test(file)) return "workflow";
+	if (/(?:^|\/)action\.ya?ml$/.test(file)) return "action";
+};
+/** Dependabot updates workflows and repository-root action metadata. */
+const isDependabotGithubActionsPath = (file) => {
+	const kind = githubAutomationFileKind(file);
+	return kind === "workflow" || kind === "action" && !file.includes("/");
+};
+/** Use one filename discriminator for reader selection and Python ecosystem decisions. */
+const pythonDependencyManifestKind = (file) => {
+	if (excludedInputPath(file)) return void 0;
+	const name = file.split("/").at(-1);
+	if (name === "pyproject.toml") return "project";
+	if (name === "Pipfile") return "pipfile";
+	if (name === "Pipfile.lock") return "pipfile-lock";
+	if (name === "setup.py" || name === "setup.cfg") return "setup";
+	if (name !== void 0 && /^requirements[^/]*\.(?:txt|in)$/.test(name)) return "requirements";
+};
+const isPythonDependencyManifest = (file) => pythonDependencyManifestKind(file) !== void 0;
+/** Docker definition names use dot-delimited variants, excluding source and documentation. */
+const isDockerDefinitionPath = (file) => {
+	if (excludedInputPath(file)) return false;
+	const name = file.split("/").at(-1) ?? "";
+	if (/\.(?:[cm]?[jt]sx?|mdx?|rst|txt|html?|py|rs|go|java|sh|c|cc|cpp|cxx|h|hpp|cs|rb|php|swift|kt|css|scss)$/i.test(name)) return false;
+	return /^(?:[^./]+\.)*(?:dockerfile|containerfile)(?:\.[^./]+)*$/i.test(name);
+};
+/** Lockfiles establish ecosystem presence without reading their dependency graphs. */
+const toolchainInputKind = (file) => {
+	if (file === ".agents/cloud-setup.sh") return "config";
+	if (githubAutomationFileKind(file) !== void 0) return "config";
+	if (excludedInputPath(file)) return void 0;
+	if (pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
+	if (githubAutomationFileKind(file) !== void 0 || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
+};
+//#endregion
+//#region src/toolchain-workspaces.ts
+/** Match manifest directories with the same positive and negative workspace patterns. */
+const workspaceContains = ({ directory, file, patterns, rootMembership }) => {
+	const relative = node_path.default.posix.relative(directory, node_path.default.posix.dirname(file));
+	if (relative === "" && rootMembership === "implicit") return true;
+	if (relative === ".." || relative.startsWith("../")) return false;
+	if (!Array.isArray(patterns)) return false;
+	const normalize = (pattern) => node_path.default.posix.normalize(pattern);
+	const selected = patterns.filter((value) => typeof value === "string");
+	return (0, picomatch.default)(selected.filter((pattern) => !pattern.startsWith("!")).map(normalize))(relative) && !(0, picomatch.default)(selected.filter((pattern) => pattern.startsWith("!")).map((pattern) => normalize(pattern.slice(1))))(relative);
+};
+//#endregion
+//#region src/toolchain-dependabot.ts
+const dependabotRules = ["dependabot-policy"];
+const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const strings = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
+const sameStrings = (value, expected) => {
+	if (!strings(value) || value.length !== expected.length) return false;
+	const sortedExpected = [...expected].sort();
+	return [...value].sort().every((entry, index) => entry === sortedExpected[index]);
+};
+const directoryOf = (file) => {
+	const directory = node_path.default.posix.dirname(file);
+	return directory === "." ? "/" : `/${directory}`;
+};
+const workspaceManifests = {
+	npm: "package.json",
+	cargo: "Cargo.toml",
+	uv: "pyproject.toml"
+};
+const workspaceTable = (parsed, ecosystem) => {
+	switch (ecosystem) {
+		case "npm": return parsed["workspaces"];
+		case "cargo": return parsed["workspace"];
+		case "uv": {
+			const tool = parsed["tool"];
+			const uv = record$5(tool) ? tool["uv"] : void 0;
+			return record$5(uv) ? uv["workspace"] : void 0;
+		}
+		default: throw new Error("unknown workspace ecosystem", { cause: ecosystem });
+	}
+};
+/** Installable workspace members share their update root; own-lock projects stay discoverable. */
+const workspaceRoots = (files, ecosystem) => {
+	const manifests = Object.keys(files).filter((file) => node_path.default.posix.basename(file) === workspaceManifests[ecosystem] || ecosystem === "npm" && node_path.default.posix.basename(file) === "pnpm-workspace.yaml");
+	const workspaces = /* @__PURE__ */ new Map();
+	const npmWorkspaceErrors = /* @__PURE__ */ new Map();
+	for (const file of manifests) {
+		if (ecosystem === "npm") {
+			const directory = node_path.default.posix.dirname(file);
+			const workspaceFile = node_path.default.posix.join(directory, "pnpm-workspace.yaml");
+			const text = files[workspaceFile];
+			if (text !== void 0) {
+				try {
+					const document = (0, yaml.parseDocument)(text);
+					if (document.errors.length > 0) throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);
+					const parsed = document.toJS({ maxAliasCount: 100 });
+					if (!record$5(parsed)) throw new Error(`${workspaceFile}:1: pnpm workspace must contain an object`);
+					const patterns = parsed["packages"] ?? [];
+					if (!strings(patterns)) throw new Error(`${workspaceFile}:1: pnpm packages must be a string array`);
+					workspaces.set(directory, patterns.map((pattern) => pattern.startsWith("!") ? `!${node_path.default.posix.normalize(pattern.slice(1))}` : node_path.default.posix.normalize(pattern)));
+				} catch (error) {
+					npmWorkspaceErrors.set(directory, error instanceof Error ? error : new Error(String(error)));
+				}
+				continue;
+			}
+		}
+		try {
+			const parsed = ecosystem === "npm" ? JSON.parse(files[file] ?? "") : (0, smol_toml.parse)(files[file] ?? "");
+			if (!record$5(parsed)) continue;
+			if (ecosystem === "npm" && typeof parsed["packageManager"] === "string" && parsed["packageManager"].startsWith("pnpm@")) continue;
+			const value = workspaceTable(parsed, ecosystem);
+			const patterns = record$5(value) ? value[ecosystem === "npm" ? "packages" : "members"] : value;
+			const members = ecosystem === "cargo" && record$5(value) && patterns === void 0 ? [] : patterns;
+			if (strings(members)) {
+				const excluded = ecosystem !== "npm" && record$5(value) && strings(value["exclude"]) ? value["exclude"].map((pattern) => `!${pattern}`) : [];
+				workspaces.set(node_path.default.posix.dirname(file), [...members, ...excluded]);
+			}
+		} catch {}
+	}
+	const implicitCargoMembers = /* @__PURE__ */ new Map();
+	const declaredMember = (root, patterns, directory) => {
+		const relative = node_path.default.posix.relative(root, directory);
+		if (relative === "" || relative === ".." || relative.startsWith("../")) return false;
+		return workspaceContains({
+			directory: root,
+			file: node_path.default.posix.join(directory, "package.json"),
+			patterns,
+			rootMembership: "patterns"
+		});
+	};
+	const installable = /* @__PURE__ */ new Set(["."]);
+	if (ecosystem === "npm") {
+		for (const file of manifests) {
+			const directory = node_path.default.posix.dirname(file);
+			if (javascriptDependencyLockfiles.some((name) => files[node_path.default.posix.join(directory, name)] !== void 0)) installable.add(directory);
+		}
+		let changed = true;
+		while (changed) {
+			changed = false;
+			for (const [root, patterns] of workspaces) {
+				if (!installable.has(root)) continue;
+				for (const file of manifests) {
+					const directory = node_path.default.posix.dirname(file);
+					if (installable.has(directory) || !declaredMember(root, patterns, directory)) continue;
+					installable.add(directory);
+					changed = true;
+				}
+			}
+		}
+	}
+	if (ecosystem === "npm") {
+		for (const [directory, error] of npmWorkspaceErrors) if (installable.has(directory)) throw error;
+	}
+	if (ecosystem === "cargo") for (const [root, patterns] of workspaces) {
+		const includes = patterns.filter((pattern) => !pattern.startsWith("!"));
+		const excludes = patterns.filter((pattern) => pattern.startsWith("!"));
+		const memberDirectories = /* @__PURE__ */ new Set([root]);
+		for (const file of manifests) {
+			const directory = node_path.default.posix.dirname(file);
+			const relative = node_path.default.posix.relative(root, directory);
+			if (includes.some((pattern) => picomatch.default.isMatch(relative, pattern)) && !excludes.some((pattern) => picomatch.default.isMatch(relative, pattern.slice(1)))) memberDirectories.add(directory);
+		}
+		for (const directory of memberDirectories) try {
+			const parsed = (0, smol_toml.parse)(files[node_path.default.posix.join(directory, "Cargo.toml")] ?? "");
+			const workspace = (0, smol_toml.parse)(files[node_path.default.posix.join(root, "Cargo.toml")] ?? "")["workspace"];
+			const inherited = record$5(workspace) ? workspace["dependencies"] : void 0;
+			const dependencyOwners = [parsed];
+			const targets = parsed["target"];
+			if (record$5(targets)) {
+				for (const target of Object.values(targets)) if (record$5(target)) dependencyOwners.push(target);
+			}
+			for (const owner of dependencyOwners) for (const key of [
+				"dependencies",
+				"dev-dependencies",
+				"build-dependencies"
+			]) {
+				const dependencies = owner[key];
+				if (!record$5(dependencies)) continue;
+				for (const [name, dependency] of Object.entries(dependencies)) {
+					if (!record$5(dependency)) continue;
+					const isInherited = dependency["workspace"] === true;
+					const resolved = isInherited && record$5(inherited) ? inherited[name] : dependency;
+					if (!record$5(resolved) || typeof resolved["path"] !== "string") continue;
+					if (node_path.default.posix.isAbsolute(resolved["path"]) || /\\|\$|^[A-Za-z]:/.test(resolved["path"])) continue;
+					const target = node_path.default.posix.normalize(node_path.default.posix.join(isInherited ? root : directory, resolved["path"]));
+					const relative = node_path.default.posix.relative(root, target);
+					if (relative.startsWith("../") || relative === ".." || files[node_path.default.posix.join(target, "Cargo.toml")] === void 0 || excludes.some((pattern) => picomatch.default.isMatch(relative, pattern.slice(1)))) continue;
+					memberDirectories.add(target);
+				}
+			}
+		} catch {}
+		implicitCargoMembers.set(root, memberDirectories);
+	}
+	return manifests.filter((file) => ecosystem !== "npm" || installable.has(node_path.default.posix.dirname(file))).filter((file) => {
+		const directory = node_path.default.posix.dirname(file);
+		return ![...workspaces].some(([root, patterns]) => {
+			if (ecosystem === "npm" && !installable.has(root)) return false;
+			const relative = node_path.default.posix.relative(root, directory);
+			if (relative === "" || relative.startsWith("../")) return false;
+			const includes = patterns.filter((pattern) => !pattern.startsWith("!"));
+			const excludes = patterns.filter((pattern) => pattern.startsWith("!"));
+			return (implicitCargoMembers.get(root)?.has(directory) === true || (ecosystem === "npm" ? declaredMember(root, patterns, directory) : includes.some((pattern) => picomatch.default.isMatch(relative, pattern)))) && !excludes.some((pattern) => picomatch.default.isMatch(relative, pattern.slice(1)));
+		});
+	}).map(directoryOf).filter((directory, index, values) => values.indexOf(directory) === index);
+};
+const javascriptEcosystem = (directory, files) => {
+	const root = directory === "/" ? "." : directory.slice(1);
+	if (files[node_path.default.posix.join(root, "bun.lock")] !== void 0) return "bun";
+	try {
+		const manifest = JSON.parse(files[node_path.default.posix.join(root, "package.json")] ?? "{}");
+		if (record$5(manifest) && typeof manifest["packageManager"] === "string" && manifest["packageManager"].startsWith("bun@")) return "bun";
+	} catch {}
+	return "npm";
+};
+const pythonEcosystem = (file, files) => {
+	const manifestKind = pythonDependencyManifestKind(file);
+	if (manifestKind === "pipfile" || manifestKind === "pipfile-lock" || manifestKind === "setup") return "pip";
+	const root = node_path.default.posix.dirname(file);
+	if (files[node_path.default.posix.join(root, "uv.lock")] !== void 0 || files[node_path.default.posix.join(root, "uv.toml")] !== void 0) return "uv";
+	const pyproject = files[node_path.default.posix.join(root, "pyproject.toml")];
+	if (pyproject !== void 0) try {
+		const tool = (0, smol_toml.parse)(pyproject)["tool"];
+		if (record$5(tool) && record$5(tool["uv"])) return "uv";
+	} catch {}
+	return "pip";
+};
+const ecosystemRoots = (files) => {
+	const roots = /* @__PURE__ */ new Map();
+	const requireRoot = (ecosystem, directory) => {
+		const directories = roots.get(ecosystem) ?? /* @__PURE__ */ new Set();
+		directories.add(directory);
+		roots.set(ecosystem, directories);
+	};
+	for (const directory of workspaceRoots(files, "npm")) requireRoot(javascriptEcosystem(directory, files), directory);
+	for (const directory of workspaceRoots(files, "cargo")) requireRoot("cargo", directory);
+	for (const directory of workspaceRoots(files, "uv")) {
+		const root = directory === "/" ? "." : directory.slice(1);
+		requireRoot(pythonEcosystem(node_path.default.posix.join(root, "pyproject.toml"), files), directory);
+	}
+	for (const file of Object.keys(files)) {
+		if (isDependabotGithubActionsPath(file)) requireRoot("github-actions", "/");
+		const name = node_path.default.posix.basename(file);
+		if (isDockerDefinitionPath(file)) requireRoot("docker", directoryOf(file));
+		if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) for (const document of (0, yaml.parseAllDocuments)(files[file] ?? "", { merge: true })) {
+			if (document.errors.length > 0) continue;
+			try {
+				const classified = containerDocumentImages(document.toJS({ maxAliasCount: 100 }), file);
+				if (classified !== void 0) requireRoot(classified.ecosystem, directoryOf(file));
+			} catch {}
+		}
+		if (name === "uv.lock" || name === "uv.toml" || name !== "pyproject.toml" && isPythonDependencyManifest(file)) requireRoot(pythonEcosystem(file, files), directoryOf(file));
+	}
+	return roots;
+};
+const ignoredFor = (ecosystem, policy) => {
+	if (ecosystem === "npm" || ecosystem === "bun") return policy.ignoredPackages;
+	if (ecosystem === "github-actions") return policy.ignoredActions;
+	if (ecosystem === "docker" || ecosystem === "docker-compose") return ownedDockerImageAliases(policy.ignoredImages);
+	return [];
+};
+/** Validate the shared update policy against a hermetic tracked-file snapshot. */
+const checkDependabot = ({ files, policy }) => {
+	const roots = ecosystemRoots(files);
+	const paths = [".github/dependabot.yml", ".github/dependabot.yaml"].filter((file) => files[file] !== void 0);
+	if (roots.size === 0 && paths.length === 0) return [];
+	const file = paths.at(0) ?? ".github/dependabot.yml";
+	const diagnostics = [];
+	const add = (message, line = 1) => {
+		diagnostics.push({
+			rule: "dependabot-policy",
+			path: file,
+			line,
+			message
+		});
+	};
+	if (paths.length === 0) {
+		add("add a Dependabot configuration for the repository's package ecosystems");
+		return diagnostics;
+	}
+	if (paths.length > 1) add("keep one Dependabot configuration file");
+	const lineCounter = new yaml.LineCounter();
+	const document = (0, yaml.parseDocument)(files[file] ?? "", { lineCounter });
+	if (document.errors.length > 0) {
+		for (const error of document.errors) add(`invalid Dependabot YAML: ${error.message}`, lineCounter.linePos(error.pos[0]).line);
+		return diagnostics;
+	}
+	let parsed;
+	try {
+		parsed = document.toJS({ maxAliasCount: 100 });
+	} catch {
+		add("cannot resolve Dependabot YAML aliases");
+		return diagnostics;
+	}
+	if (!record$5(parsed) || parsed["version"] !== 2 || !Array.isArray(parsed["updates"])) {
+		add("Dependabot must declare version: 2 and an updates array");
+		return diagnostics;
+	}
+	const covered = /* @__PURE__ */ new Map();
+	let legacy;
+	try {
+		const legacyDocument = (0, yaml.parseDocument)(files[file] ?? "", {
+			version: "1.1",
+			schema: "yaml-1.1"
+		});
+		if (legacyDocument.errors.length === 0) legacy = legacyDocument.toJS({ maxAliasCount: 100 });
+	} catch {}
+	const legacyUpdates = record$5(legacy) && Array.isArray(legacy["updates"]) ? legacy["updates"] : [];
+	const rootClaims = /* @__PURE__ */ new Map();
+	const directoryClaims = /* @__PURE__ */ new Map();
+	for (const [index, update] of parsed["updates"].entries()) {
+		const lineOf = (key) => {
+			const node = document.getIn([
+				"updates",
+				index,
+				key
+			], true);
+			const offset = (0, yaml.isNode)(node) ? node.range?.[0] : void 0;
+			return offset === void 0 ? 1 : lineCounter.linePos(offset).line;
+		};
+		const report = (key, message) => add(message, lineOf(key));
+		if (!record$5(update) || typeof update["package-ecosystem"] !== "string") {
+			report("package-ecosystem", "each Dependabot update must declare a package ecosystem");
+			continue;
+		}
+		const ecosystem = update["package-ecosystem"];
+		if (update["target-branch"] !== void 0) report("target-branch", `${ecosystem}: shared updates must target the default branch`);
+		if (update["open-pull-requests-limit"] === 0) report("open-pull-requests-limit", `${ecosystem}: version updates must remain enabled`);
+		const single = update["directory"];
+		const multiple = update["directories"];
+		let directories = [];
+		if (typeof single === "string" && multiple === void 0) directories = [single];
+		else if (single === void 0 && strings(multiple)) directories = multiple;
+		const validDirectories = directories.filter((directory) => directory.startsWith("/") && !directory.split("/").includes(".."));
+		if (directories.length === 0 || validDirectories.length !== directories.length) report("directory", `${ecosystem}: declare directory or nonempty directories with absolute repository paths`);
+		const normalizedDirectories = Array.from(new Set(validDirectories.map((value) => node_path.default.posix.normalize(value).replace(/\/+$/, "") || "/")));
+		const matches = covered.get(ecosystem) ?? /* @__PURE__ */ new Set();
+		const claimedDirectories = directoryClaims.get(ecosystem) ?? /* @__PURE__ */ new Map();
+		for (const directory of normalizedDirectories) {
+			const previous = claimedDirectories.get(directory);
+			if (previous !== void 0) report(multiple === void 0 ? "directory" : "directories", `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`);
+			else claimedDirectories.set(directory, index);
+		}
+		directoryClaims.set(ecosystem, claimedDirectories);
+		const claimedRoots = rootClaims.get(ecosystem) ?? /* @__PURE__ */ new Map();
+		for (const root of roots.get(ecosystem) ?? []) if (normalizedDirectories.some((directory) => directory === root || multiple !== void 0 && picomatch.default.isMatch(root, directory))) {
+			const previous = claimedRoots.get(root);
+			if (previous !== void 0) report(multiple === void 0 ? "directory" : "directories", `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`);
+			else claimedRoots.set(root, index);
+			matches.add(root);
+		}
+		rootClaims.set(ecosystem, claimedRoots);
+		covered.set(ecosystem, matches);
+		const schedule = update["schedule"];
+		const legacyUpdate = legacyUpdates.at(index);
+		const legacySchedule = record$5(legacyUpdate) ? legacyUpdate["schedule"] : void 0;
+		if (record$5(schedule) && schedule["time"] === policy.schedule.time && (!record$5(legacySchedule) || legacySchedule["time"] !== policy.schedule.time)) report("schedule", `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`);
+		if (!record$5(schedule) || Object.keys(schedule).length !== Object.keys(policy.schedule).length || Object.entries(policy.schedule).some(([key, value]) => schedule[key] !== value)) report("schedule", `${ecosystem}: schedule must match the shared policy`);
+		const cooldown = update["cooldown"];
+		if (!record$5(cooldown) || Object.keys(cooldown).length !== 1 || cooldown["default-days"] !== policy.cooldown.defaultDays) report("cooldown", `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`);
+		const groups = update["groups"];
+		if (!record$5(groups) || Object.keys(groups).length !== Object.keys(policy.groups).length || Object.entries(policy.groups).some(([name, expected]) => {
+			const group = groups[name];
+			return !record$5(group) || Object.keys(group).length !== 2 || !sameStrings(group["patterns"], expected.patterns) || !sameStrings(group["update-types"], expected.updateTypes);
+		})) report("groups", `${ecosystem}: groups must match the shared policy`);
+		const ignored = ignoredFor(ecosystem, policy);
+		const ignore = update["ignore"];
+		if (ignore !== void 0 && (!Array.isArray(ignore) || ignore.length === 0)) report("ignore", `${ecosystem}: omit ignore or provide a nonempty array`);
+		if (Array.isArray(ignore) && ignore.some((entry) => !record$5(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
+		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$5(entry) && entry["dependency-name"] === name && Object.keys(entry).length === 1)) report("ignore", `${ecosystem}: ignore all updates for shared pin ${name}`);
+	}
+	for (const [ecosystem, directories] of roots) for (const directory of directories) if (!covered.get(ecosystem)?.has(directory)) add(`add a ${ecosystem} update entry covering ${directory}`);
+	return diagnostics;
+};
+//#endregion
+//#region src/toolchain-engine-floors.ts
+const record$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const repositoryPath = (value) => typeof value === "string" && value !== "" && !/^[A-Za-z]:/.test(value) && !/[\\\s]/.test(value) && !Array.from(value).some((character) => character.charCodeAt(0) < 32) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
+const parseEngineFloors = (input) => {
+	if (input === void 0) return [];
+	if (!Array.isArray(input)) throw new Error("engineFloors must be an array");
+	const result = [];
+	const jobs = /* @__PURE__ */ new Set();
+	for (const entry of input) {
+		if (!record$4(entry) || Object.keys(entry).some((key) => ![
+			"package",
+			"workflow",
+			"job"
+		].includes(key)) || entry["package"] !== "." && !repositoryPath(entry["package"]) || !repositoryPath(entry["workflow"]) || !/^\.github\/workflows\/[^/]+\.ya?ml$/.test(entry["workflow"]) || typeof entry["job"] !== "string" || entry["job"].trim() === "") throw new Error("each engine floor requires a repository package directory, workflow path and job");
+		const key = `${entry["workflow"]}:${entry["job"]}`;
+		if (jobs.has(key)) throw new Error("engine floor workflow jobs must be unique");
+		jobs.add(key);
+		result.push({
+			package: entry["package"],
+			workflow: entry["workflow"],
+			job: entry["job"]
+		});
+	}
+	return result;
+};
+const resolveEngineFloor = (entry, files) => {
+	const manifestText = files[node_path.default.posix.join(entry.package, "package.json")];
+	const workflowText = files[entry.workflow];
+	if (manifestText === void 0 || workflowText === void 0) throw new Error("engine floor package and workflow must be tracked");
+	const manifest = JSON.parse(manifestText);
+	if (!record$4(manifest) || manifest["private"] === true || typeof manifest["name"] !== "string" || manifest["name"].trim() === "" || !record$4(manifest["engines"]) || typeof manifest["engines"]["node"] !== "string") throw new Error("engine floor package must be published and declare engines.node");
+	const range = manifest["engines"]["node"];
+	const minimum = (0, semver.validRange)(range) === null ? null : (0, semver.minVersion)(range);
+	if (minimum === null || minimum.prerelease.length !== 0) throw new Error("engine floor engines.node must declare a stable minimum");
+	const document = (0, yaml.parseDocument)(workflowText, { merge: true });
+	if (document.errors.length !== 0) throw new Error("engine floor workflow must be valid YAML");
+	const workflow = document.toJS({ maxAliasCount: 100 });
+	if (!record$4(workflow) || !record$4(workflow["jobs"])) throw new Error("engine floor job must exist in its tracked workflow");
+	const job = workflow["jobs"][entry.job];
+	if (!record$4(job)) throw new Error("engine floor job must exist in its tracked workflow");
+	if (!Array.isArray(job["steps"]) || Object.hasOwn(job, "uses")) throw new Error("engine floor job must declare steps and cannot reuse a workflow");
+	return {
+		...entry,
+		range,
+		major: minimum.major
+	};
+};
+const engineFloorSelectorMatches = (value, floor) => {
+	if (typeof value !== "string" || !/^\d+\.\d+\.\d+$/.test(value) || (0, semver.valid)(value) !== value) return false;
+	return Number(value.split(".").at(0)) === floor.major && (0, semver.satisfies)(value, floor.range);
+};
+//#endregion
+//#region src/toolchain-packages.ts
+const packageRules = [
+	"bun-pins",
+	"package-pins",
+	"typescript-layout",
+	"node-engine"
+];
+const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const shellSubstitutions = (command) => {
+	const frames = [{
+		kind: "root",
+		start: 0,
+		depth: 0,
+		quote: void 0
+	}];
+	const bodies = [];
+	for (let index = 0; index < command.length; index += 1) {
+		const frame = frames.at(-1);
+		if (frame === void 0) break;
+		const character = command.at(index);
+		if (character === "\\" && frame.quote !== "'") {
+			index += 1;
+			continue;
+		}
+		if (character === "`" && frame.kind === "backticks") {
+			bodies.push(command.slice(frame.start, index));
+			frames.pop();
+			continue;
+		}
+		if (character === frame.quote) {
+			frame.quote = void 0;
+			continue;
+		}
+		if (frame.quote === "'") continue;
+		if (character === "$" && command.at(index + 1) === "(") {
+			frames.push({
+				kind: "parentheses",
+				start: index + 2,
+				depth: 1,
+				quote: void 0
+			});
+			index += 1;
+			continue;
+		}
+		if (character === "`") {
+			frames.push({
+				kind: "backticks",
+				start: index + 1,
+				depth: 0,
+				quote: void 0
+			});
+			continue;
+		}
+		if (frame.quote !== void 0) continue;
+		if (character === "'" || character === "\"") {
+			frame.quote = character;
+			continue;
+		}
+		if (frame.kind !== "parentheses") continue;
+		if (character === "(") frame.depth += 1;
+		if (character === ")" && --frame.depth === 0) {
+			bodies.push(command.slice(frame.start, index));
+			frames.pop();
+		}
+	}
+	for (const frame of frames.slice(1)) bodies.push(command.slice(frame.start));
+	return bodies;
+};
+const compilerCommandSegments = (command) => {
+	const segments = [[]];
+	for (const source of [command, ...shellSubstitutions(command)]) {
+		segments.push([]);
+		const shellWords = source.match(/(?:[^\s"'\\;&|()]|\\[^\n]|"(?:[^"\\]|\\.)*"|'[^']*')+|&&|\|\||[();&|\n]/g);
+		for (const word of shellWords ?? []) if (/^(?:&&|\|\||[;&|\n])$/.test(word)) segments.push([]);
+		else segments.at(-1)?.push(word);
+	}
+	return segments.map((words) => {
+		let start = 0;
+		const skipAssignments = () => {
+			while (/^[A-Za-z_][A-Za-z\d_]*=/.test(words.at(start) ?? "")) start += 1;
+		};
+		skipAssignments();
+		while (/^(?:\/usr\/bin\/|\/bin\/)?env$/.test(words.at(start) ?? "")) {
+			start += 1;
+			while (start < words.length) {
+				const option = words.at(start);
+				if (option === "--") {
+					start += 1;
+					break;
+				}
+				if (option === "-u" || option === "--unset") {
+					start += 2;
+					continue;
+				}
+				if (option === "-" || option === "-i" || option === "--ignore-environment" || /^--unset=.+|^-u.+/.test(option ?? "")) {
+					start += 1;
+					continue;
+				}
+				break;
+			}
+			skipAssignments();
+		}
+		return words.slice(start);
+	});
+};
+const launcherValueOptions = new Map(Object.entries({
+	npx: [
+		"-p",
+		"--package",
+		"-c",
+		"--call",
+		"--cache",
+		"--registry",
+		"--userconfig"
+	],
+	bunx: ["-p", "--package"],
+	pnpm: [
+		"--filter",
+		"-F",
+		"--dir",
+		"-C",
+		"--package"
+	],
+	yarn: [
+		"--cwd",
+		"--cache-folder",
+		"--mutex",
+		"--use-yarnrc",
+		"--modules-folder",
+		"--registry"
+	],
+	bun: [
+		"--cwd",
+		"--filter",
+		"-F",
+		"--config",
+		"-c",
+		"--env-file",
+		"-e",
+		"--eval",
+		"-p",
+		"--print"
+	],
+	node: [
+		"-e",
+		"--eval",
+		"-p",
+		"--print",
+		"--conditions",
+		"-C",
+		"--inspect-port",
+		"--max-old-space-size",
+		"--stack-size",
+		"--title",
+		"--icu-data-dir",
+		"--openssl-config",
+		"--input-type"
+	]
+}).map(([launcher, options]) => [launcher, new Set(options)]));
+const invokesCompiler = (words) => {
+	const literal = (word) => {
+		let result = "";
+		let quote;
+		for (let index = 0; index < word.length; index += 1) {
+			const character = word.at(index);
+			if (character === quote) {
+				quote = void 0;
+				continue;
+			}
+			if (quote === void 0 && (character === "'" || character === "\"")) {
+				quote = character;
+				continue;
+			}
+			const next = word.at(index + 1);
+			if (character === "\\" && next !== void 0 && quote !== "'" && (quote === void 0 || /[$`"\\\n]/.test(next))) {
+				result += next;
+				index += 1;
+			} else result += character;
+		}
+		return result;
+	};
+	const tokens = words.map(literal);
+	const compiler = (word) => /(?:^|\/)(?:tsc|tsgo)(?:\.js)?$/.test(word);
+	let start = 0;
+	const skipOptions = (index, launcher) => {
+		while (tokens.at(index)?.startsWith("-")) {
+			const option = tokens.at(index);
+			index += 1;
+			if (option === "--") break;
+			if (option !== void 0 && launcherValueOptions.get(launcher)?.has(option)) index += 1;
+		}
+		return index;
+	};
+	while (start < tokens.length) {
+		const launcher = tokens.at(start);
+		if (launcher === void 0 || !launcherValueOptions.has(launcher)) break;
+		start = skipOptions(start + 1, launcher);
+		if (launcher === "bun" && tokens.at(start) === "check") return true;
+		const subcommand = tokens.at(start);
+		if (launcher === "bun" && (subcommand === "x" || subcommand === "run") || launcher === "pnpm" && (subcommand === "exec" || subcommand === "dlx") || launcher === "yarn" && (subcommand === "exec" || subcommand === "dlx" || subcommand === "run")) start = skipOptions(start + 1, launcher);
+	}
+	return tokens.slice(start).some((word, index) => compiler(word) || word === "bun" && tokens.at(skipOptions(start + index + 1, "bun")) === "check");
+};
+/** Validate manifests and catalog resolutions from a tracked-file snapshot. */
+const checkPackageFiles = ({ files, policy }) => {
+	const sources = new Map(Object.entries(files));
+	const diagnostics = [];
+	const pins = new Map(Object.entries({
+		...policy.packages,
+		"bun-types": policy.bun
+	}));
+	const manifests = /* @__PURE__ */ new Map();
+	const yamlLocations = /* @__PURE__ */ new Map();
+	const reportedLines = /* @__PURE__ */ new Map();
+	const add = ({ file, rule, key, value, message }) => {
+		const source = sources.get(file);
+		if (source === void 0) throw new Error(`Missing package diagnostic source: ${file}`);
+		const serialized = value === void 0 ? void 0 : JSON.stringify(value);
+		const locationKey = `${file}:${key}:${serialized ?? ""}`;
+		const previous = reportedLines.get(locationKey) ?? -1;
+		const yamlLine = yamlLocations.get(locationKey)?.shift();
+		const index = source.split(/\r?\n/).findIndex((line, lineIndex) => lineIndex > previous && line.includes(JSON.stringify(key)) && (serialized === void 0 || line.includes(serialized)));
+		if (index >= 0) reportedLines.set(locationKey, index);
+		diagnostics.push({
+			rule,
+			path: file,
+			line: yamlLine ?? Math.max(1, index + 1),
+			message
+		});
+	};
+	for (const [file, text] of sources) {
+		const pnpm = node_path.default.posix.basename(file) === "pnpm-workspace.yaml";
+		if (!pnpm && node_path.default.posix.basename(file) !== "package.json") continue;
+		try {
+			const lineCounter = new yaml.LineCounter();
+			const document = pnpm ? (0, yaml.parseDocument)(text, { lineCounter }) : void 0;
+			if (document !== void 0 && document.errors.length > 0) throw new Error("invalid YAML");
+			const json = document === void 0 ? JSON.parse(text) : document.toJS();
+			if (!record$3(json)) throw new Error("manifest must be an object");
+			if (pnpm) {
+				if (json["catalog"] !== void 0 && !record$3(json["catalog"])) throw new Error("catalog must be a mapping");
+				if (json["catalogs"] !== void 0 && (!record$3(json["catalogs"]) || Object.values(json["catalogs"]).some((catalog) => !record$3(catalog)))) throw new Error("named catalogs must be mappings");
+				if (json["packages"] !== void 0 && (!Array.isArray(json["packages"]) || !json["packages"].every((pattern) => typeof pattern === "string"))) throw new Error("workspace packages must be patterns");
+			}
+			manifests.set(file, json);
+			if (document === void 0) continue;
+			const catalogEntries = [
+				{
+					catalog: json["catalog"],
+					prefix: ["catalog"]
+				},
+				{
+					catalog: json["overrides"],
+					prefix: ["overrides"]
+				},
+				...record$3(json["catalogs"]) ? Object.entries(json["catalogs"]).map(([name, catalog]) => ({
+					catalog,
+					prefix: ["catalogs", name]
+				})) : []
+			];
+			for (const { catalog, prefix } of catalogEntries) {
+				if (!record$3(catalog)) continue;
+				for (const [name, value] of Object.entries(catalog)) {
+					const node = document.getIn([...prefix, name], true);
+					if (!(0, yaml.isNode)(node) || node.range === void 0 || node.range === null) continue;
+					const key = `${file}:${name}:${JSON.stringify(value)}`;
+					const lines = yamlLocations.get(key) ?? [];
+					lines.push(lineCounter.linePos(node.range[0]).line);
+					yamlLocations.set(key, lines);
+				}
+			}
+		} catch {
+			add({
+				file,
+				rule: "package-pins",
+				key: "",
+				message: pnpm ? "invalid pnpm-workspace.yaml object" : "invalid package.json object"
+			});
+		}
+	}
+	const catalogSources = (json) => [json, ...record$3(json["workspaces"]) ? [json["workspaces"]] : []];
+	const pnpmWorkspaceFor = (file) => {
+		let directory = node_path.default.posix.dirname(file);
+		while (true) {
+			const workspace = manifests.get(node_path.default.posix.join(directory, "pnpm-workspace.yaml"));
+			if (workspace !== void 0) return {
+				directory,
+				workspace
+			};
+			if (directory === ".") return void 0;
+			directory = node_path.default.posix.dirname(directory);
+		}
+	};
+	const catalogFor = (file, name) => {
+		const owner = pnpmWorkspaceFor(file);
+		if (owner !== void 0) {
+			const { directory, workspace } = owner;
+			if (node_path.default.posix.basename(file) === "package.json" && !workspaceContains({
+				directory,
+				file,
+				patterns: workspace["packages"],
+				rootMembership: "implicit"
+			})) return void 0;
+			if (name === "" || name === "default") return workspace["catalog"] ?? (record$3(workspace["catalogs"]) ? workspace["catalogs"]["default"] : void 0);
+			return record$3(workspace["catalogs"]) ? workspace["catalogs"][name] : void 0;
+		}
+		let directory = node_path.default.posix.dirname(file);
+		while (true) {
+			const manifest = manifests.get(node_path.default.posix.join(directory, "package.json"));
+			if (manifest !== void 0) {
+				for (const source of catalogSources(manifest)) {
+					if (name === "" && source["catalog"] !== void 0) return source["catalog"];
+					if (record$3(source["catalogs"]) && source["catalogs"][name] !== void 0) return source["catalogs"][name];
+				}
+				if (manifest["workspaces"] !== void 0) return void 0;
+			}
+			if (directory === ".") return void 0;
+			directory = node_path.default.posix.dirname(directory);
+		}
+	};
+	const resolve = (file, name, value) => {
+		const visited = /* @__PURE__ */ new Set();
+		while (typeof value === "string" && value.startsWith("catalog:")) {
+			if (visited.has(value)) return void 0;
+			visited.add(value);
+			const catalog = catalogFor(file, value.slice(8));
+			value = record$3(catalog) ? catalog[name] : void 0;
+		}
+		return value;
+	};
+	const workspaceOwnerFor = (file) => {
+		const pnpm = pnpmWorkspaceFor(file);
+		if (pnpm !== void 0) return {
+			directory: pnpm.directory,
+			patterns: pnpm.workspace["packages"],
+			source: "pnpm"
+		};
+		let directory = node_path.default.posix.dirname(file);
+		while (true) {
+			const workspaces = manifests.get(node_path.default.posix.join(directory, "package.json"))?.["workspaces"];
+			if (workspaces !== void 0) return {
+				directory,
+				patterns: record$3(workspaces) ? workspaces["packages"] : workspaces,
+				source: "json"
+			};
+			if (directory === ".") return void 0;
+			directory = node_path.default.posix.dirname(directory);
+		}
+	};
+	const workspaceResolution = ({ file, name, pin }) => {
+		const owner = workspaceOwnerFor(file);
+		if (owner === void 0) return "nonmember";
+		const { directory, patterns, source } = owner;
+		if (source === "json" && !Array.isArray(patterns)) return "mismatch";
+		if (!workspaceContains({
+			directory,
+			file,
+			patterns,
+			rootMembership: "implicit"
+		})) return "nonmember";
+		const candidates = [...manifests.entries()].filter(([candidate, json]) => node_path.default.posix.basename(candidate) === "package.json" && json["name"] === name && workspaceContains({
+			directory,
+			file: candidate,
+			patterns,
+			rootMembership: source === "json" ? "patterns" : "implicit"
+		}));
+		return candidates.length === 1 && candidates.every(([, json]) => json["version"] === pin) ? "matched" : "mismatch";
+	};
+	const tsSpecifiers = /* @__PURE__ */ new Map();
+	for (const layout of policy.typescriptInstallLayouts) {
+		const values = tsSpecifiers.get(layout.compilerPackage) ?? /* @__PURE__ */ new Set();
+		values.add(layout.compilerSpecifier);
+		tsSpecifiers.set(layout.compilerPackage, values);
+		if (layout.type !== "split-compatibility") continue;
+		const compatibility = tsSpecifiers.get(layout.compatibilityPackage) ?? /* @__PURE__ */ new Set();
+		compatibility.add(layout.compatibilitySpecifier);
+		tsSpecifiers.set(layout.compatibilityPackage, compatibility);
+	}
+	tsSpecifiers.set(policy.typescript6Compatibility.packageAlias, /* @__PURE__ */ new Set([`npm:typescript@${policy.typescript6Compatibility.version}`]));
+	const layoutFor = (specifiers) => policy.typescriptInstallLayouts.find((layout) => {
+		const compiler = specifiers.get(layout.compilerPackage);
+		if (compiler?.size !== 1 || !compiler.has(layout.compilerSpecifier)) return false;
+		if (layout.type === "split-compatibility") {
+			const compatibility = specifiers.get(layout.compatibilityPackage);
+			return compatibility?.size === 1 && compatibility.has(layout.compatibilitySpecifier);
+		}
+		return policy.typescriptInstallLayouts.every((other) => other.compilerPackage === layout.compilerPackage || !specifiers.has(other.compilerPackage));
+	});
+	const peerRange = (value) => typeof value === "string" && (0, semver.valid)(value) === null && (0, semver.validRange)(value) !== null;
+	const toolchainEntries = (file, json) => {
+		const entries = [];
+		for (const section of [
+			"dependencies",
+			"devDependencies",
+			"optionalDependencies",
+			"peerDependencies"
+		]) {
+			const dependencies = json[section];
+			if (!record$3(dependencies)) continue;
+			for (const [name, value] of Object.entries(dependencies)) {
+				if (!tsSpecifiers.has(name)) continue;
+				const resolved = resolve(file, name, value);
+				if (section === "peerDependencies" && peerRange(resolved)) continue;
+				entries.push({
+					section,
+					name,
+					value: resolved
+				});
+			}
+		}
+		return entries;
+	};
+	const specifierMap = (entries) => {
+		const specifiers = /* @__PURE__ */ new Map();
+		for (const { name, value } of entries) {
+			const values = specifiers.get(name) ?? /* @__PURE__ */ new Set();
+			values.add(value);
+			specifiers.set(name, values);
+		}
+		return specifiers;
+	};
+	const workspaceLayouts = /* @__PURE__ */ new Map();
+	const workspaceLayoutFor = (file) => {
+		const owner = workspaceOwnerFor(file);
+		if (owner === void 0 || !workspaceContains({
+			...owner,
+			file,
+			rootMembership: "implicit"
+		})) return void 0;
+		const key = `${owner.source}:${owner.directory}`;
+		const cached = workspaceLayouts.get(key);
+		if (cached !== void 0) return cached;
+		const entries = [];
+		for (const [candidate, member] of manifests) {
+			if (node_path.default.posix.basename(candidate) !== "package.json") continue;
+			const memberOwner = workspaceOwnerFor(candidate);
+			if (memberOwner?.directory !== owner.directory || memberOwner.source !== owner.source || !workspaceContains({
+				...owner,
+				file: candidate,
+				rootMembership: "implicit"
+			})) continue;
+			entries.push(...toolchainEntries(candidate, member).filter(({ section }) => section === "devDependencies"));
+		}
+		const result = {
+			layout: layoutFor(specifierMap(entries)),
+			directory: owner.directory
+		};
+		workspaceLayouts.set(key, result);
+		return result;
+	};
+	for (const [file, json] of manifests) {
+		const manager = json["packageManager"];
+		if (manager !== void 0 && manager !== `bun@${policy.bun}`) add({
+			file,
+			rule: "bun-pins",
+			key: "packageManager",
+			value: manager,
+			message: `packageManager Bun version must be ${policy.bun}, found ${JSON.stringify(manager)}`
+		});
+		const checkEntries = (entries, location) => {
+			if (!record$3(entries)) return;
+			for (const [name, raw] of Object.entries(entries)) {
+				const value = resolve(file, name, raw);
+				const tsAllowed = tsSpecifiers.get(name);
+				if (tsAllowed !== void 0) {
+					if (typeof value !== "string" || !tsAllowed.has(value)) add({
+						file,
+						rule: "typescript-layout",
+						key: location?.key ?? name,
+						value: location === void 0 ? raw : location.value,
+						message: `${name} must use a declared TypeScript specifier, found ${String(value)}`
+					});
+					continue;
+				}
+				const pin = pins.get(name);
+				if (pin === void 0) continue;
+				if (value === pin) continue;
+				const workspace = value === "workspace:*" ? workspaceResolution({
+					file,
+					name,
+					pin
+				}) : void 0;
+				if (workspace === "matched") continue;
+				add({
+					file,
+					rule: name === "bun-types" ? "bun-pins" : "package-pins",
+					key: location?.key ?? name,
+					value: location === void 0 ? raw : location.value,
+					message: workspace === "nonmember" ? `${name} workspace:* consumer is not a member of its nearest workspace` : `${name} must be ${pin}, found ${String(value)}`
+				});
+			}
+		};
+		for (const key of [
+			"dependencies",
+			"devDependencies",
+			"optionalDependencies"
+		]) checkEntries(json[key]);
+		if (record$3(json["peerDependencies"])) {
+			for (const [name, value] of Object.entries(json["peerDependencies"])) if (tsSpecifiers.has(name) && !peerRange(resolve(file, name, value))) checkEntries({ [name]: value });
+		}
+		for (const source of catalogSources(json)) {
+			checkEntries(source["catalog"]);
+			if (!record$3(source["catalogs"])) continue;
+			for (const catalog of Object.values(source["catalogs"])) checkEntries(catalog);
+		}
+		const ownedNames = /* @__PURE__ */ new Set([...pins.keys(), ...tsSpecifiers.keys()]);
+		const resolutionDependencies = {};
+		const resolutionRoot = manifests.get(node_path.default.posix.join(node_path.default.posix.dirname(file), "package.json"));
+		if (resolutionRoot !== void 0) for (const section of [
+			"dependencies",
+			"devDependencies",
+			"optionalDependencies"
+		]) {
+			const entries = resolutionRoot[section];
+			if (!record$3(entries)) continue;
+			for (const [name, value] of Object.entries(entries)) resolutionDependencies[name] = resolve(file, name, value);
+		}
+		const affectedSpecifiers = /* @__PURE__ */ new Map();
+		const owner = workspaceOwnerFor(file);
+		for (const [candidate, member] of manifests) {
+			if (node_path.default.posix.basename(candidate) !== "package.json") continue;
+			const memberOwner = workspaceOwnerFor(candidate);
+			if (!(candidate === node_path.default.posix.join(node_path.default.posix.dirname(file), "package.json")) && !(owner !== void 0 && owner.directory === node_path.default.posix.dirname(file) && memberOwner?.directory === owner.directory && memberOwner.source === owner.source && workspaceContains({
+				directory: owner.directory,
+				file: candidate,
+				patterns: owner.patterns,
+				rootMembership: "implicit"
+			}))) continue;
+			for (const section of [
+				"dependencies",
+				"devDependencies",
+				"optionalDependencies"
+			]) {
+				const entries = member[section];
+				if (!record$3(entries)) continue;
+				for (const [name, value] of Object.entries(entries)) {
+					if (!tsSpecifiers.has(name)) continue;
+					const values = affectedSpecifiers.get(name) ?? /* @__PURE__ */ new Set();
+					values.add(resolve(candidate, name, value));
+					affectedSpecifiers.set(name, values);
+				}
+			}
+		}
+		const checkResolutionMap = (entries, parent) => {
+			if (!record$3(entries)) return;
+			for (const [selector, replacement] of Object.entries(entries)) {
+				const target = selector === "." ? parent : selector;
+				if (target === void 0) continue;
+				let pattern = target.split(/>\s*(?=[@A-Za-z_*]|$)/).at(-1)?.trim() ?? "";
+				const version = pattern.lastIndexOf("@");
+				let qualifier;
+				if (version > pattern.lastIndexOf("/")) {
+					qualifier = pattern.slice(version + 1).replace(/^npm:/, "");
+					pattern = pattern.slice(0, version);
+				}
+				const parts = pattern.split("/");
+				pattern = parts.at(-2)?.startsWith("@") ? parts.slice(-2).join("/") : parts.at(-1) ?? "";
+				if (pattern === "") {
+					add({
+						file,
+						rule: "package-pins",
+						key: selector,
+						value: replacement,
+						message: "resolution selector must name a package"
+					});
+					continue;
+				}
+				if (record$3(replacement)) {
+					checkResolutionMap(replacement, target);
+					continue;
+				}
+				for (const name of ownedNames) {
+					if (!(0, picomatch.default)(pattern)(name)) continue;
+					let value = replacement;
+					if (typeof replacement === "string" && replacement.startsWith("$")) {
+						const reference = replacement.slice(1);
+						value = resolutionDependencies[reference];
+					}
+					const resolved = resolve(file, name, value);
+					checkEntries({ [name]: value }, {
+						key: selector,
+						value: replacement
+					});
+					if (tsSpecifiers.has(name) && [...affectedSpecifiers.get(name) ?? []].some((specifier) => {
+						if (resolved === specifier) return false;
+						if (qualifier === void 0 || (0, semver.validRange)(qualifier) === null) return true;
+						if (typeof specifier !== "string") return false;
+						const release = (0, semver.valid)(specifier.startsWith("npm:") ? specifier.slice(specifier.lastIndexOf("@") + 1) : specifier);
+						return release !== null && (0, semver.satisfies)(release, qualifier);
+					}) && typeof resolved === "string" && tsSpecifiers.get(name)?.has(resolved)) add({
+						file,
+						rule: "typescript-layout",
+						key: selector,
+						value: replacement,
+						message: `${name} resolution must preserve its declared TypeScript install specifier`
+					});
+				}
+			}
+		};
+		checkResolutionMap(json["overrides"]);
+		checkResolutionMap(json["resolutions"]);
+		if (record$3(json["pnpm"])) checkResolutionMap(json["pnpm"]["overrides"]);
+		const localEntries = toolchainEntries(file, json);
+		const usesCompiler = policy.typescriptInstallLayouts.some((layout) => localEntries.some(({ name }) => name === layout.compilerPackage));
+		let selectedLayout = layoutFor(specifierMap(localEntries));
+		if (usesCompiler) {
+			if (layoutFor(specifierMap(localEntries.filter(({ section }) => section !== "peerDependencies"))) === void 0) selectedLayout = void 0;
+			if (selectedLayout === void 0) {
+				const workspace = workspaceLayoutFor(file);
+				const layout = workspace?.layout;
+				if (workspace !== void 0 && layout !== void 0) {
+					const expected = /* @__PURE__ */ new Map([[layout.compilerPackage, layout.compilerSpecifier]]);
+					if (layout.type === "split-compatibility") expected.set(layout.compatibilityPackage, layout.compatibilitySpecifier);
+					expected.set(policy.typescript6Compatibility.packageAlias, `npm:typescript@${policy.typescript6Compatibility.version}`);
+					const developmentOnly = localEntries.every(({ section, name, value }) => section === "devDependencies" && expected.get(name) === value);
+					const runtimeCompatibilityOnly = layout.type === "split-compatibility" && node_path.default.posix.dirname(file) !== workspace.directory && localEntries.every(({ section, name, value }) => (section === "dependencies" || section === "devDependencies" || section === "peerDependencies") && name === layout.compatibilityPackage && value === layout.compatibilitySpecifier);
+					if (developmentOnly || runtimeCompatibilityOnly) selectedLayout = layout;
+				}
+			}
+			if (selectedLayout === void 0) add({
+				file,
+				rule: "typescript-layout",
+				key: "dependencies",
+				message: "TypeScript compiler and compatibility packages must match one complete declared install layout"
+			});
+			const command = record$3(json["scripts"]) ? json["scripts"]["typecheck"] : void 0;
+			if (selectedLayout !== void 0 && typeof command === "string") {
+				const normalizedExpected = selectedLayout.typecheckCommand.replace(/\s+/g, " ").trim();
+				for (const words of compilerCommandSegments(command)) {
+					if (!invokesCompiler(words)) continue;
+					const normalized = words.join(" ");
+					if (!words.some((word) => word === "(" || word === ")") && shellSubstitutions(normalized).length === 0 && (normalized === normalizedExpected || normalized.startsWith(`${normalizedExpected} `))) continue;
+					add({
+						file,
+						rule: "typescript-layout",
+						key: "typecheck",
+						value: command,
+						message: `typecheck compiler invocation must use ${selectedLayout.typecheckCommand}`
+					});
+					break;
+				}
+			}
+		}
+		if (record$3(json["peerDependencies"])) {
+			const peerLayout = selectedLayout ?? workspaceLayoutFor(file)?.layout;
+			for (const [name, raw] of Object.entries(json["peerDependencies"])) {
+				if (!tsSpecifiers.has(name)) continue;
+				const range = resolve(file, name, raw);
+				if (!peerRange(range)) continue;
+				const releases = /* @__PURE__ */ new Set();
+				for (const layout of policy.typescriptInstallLayouts) {
+					if (layout.compilerPackage !== name && !(layout.type === "split-compatibility" && layout.compatibilityPackage === name)) continue;
+					const specifier = layout.compilerSpecifier;
+					releases.add(specifier.startsWith("npm:") ? specifier.slice(specifier.lastIndexOf("@") + 1) : specifier);
+				}
+				if (name === policy.typescript6Compatibility.packageAlias) releases.add(policy.typescript6Compatibility.version);
+				if (peerLayout?.type === "split-compatibility" && name === peerLayout.compatibilityPackage) releases.add(peerLayout.compatibilitySpecifier);
+				if ([...releases].every((release) => (0, semver.satisfies)(release, range))) continue;
+				add({
+					file,
+					rule: "typescript-layout",
+					key: name,
+					value: raw,
+					message: `${name} peer support range must include ${[...releases].join(" and ")}, found ${range}`
+				});
+			}
+		}
+		if (record$3(json["engines"]) && json["engines"]["node"] !== void 0 && (typeof json["engines"]["node"] !== "string" || !nodeSupportRangeMatches(policy.node, json["engines"]["node"]))) add({
+			file,
+			rule: "node-engine",
+			key: "node",
+			value: json["engines"]["node"],
+			message: `engines.node must support ${policy.node}, found ${JSON.stringify(json["engines"]["node"])}`
+		});
+	}
+	return diagnostics;
+};
+//#endregion
+//#region src/toolchain-runtime.ts
+const runtimeRules = [
+	"bun-pins",
+	"node-version",
+	"python-version",
+	"rust-version",
+	"runtime-manager",
+	"runtime-docker",
+	"runtime-workflow",
+	"action-pins"
+];
+const record$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const pythonSelectorMatches = (value, expected) => value === expected || typeof value === "string" && /^\d+\.\d+$/.test(expected) && value.startsWith(`${expected}.`) && /^\d+\.\d+\.\d+$/.test(value);
+const compareRelease = (left, right) => {
+	for (let index = 0; index < Math.max(left.length, right.length); index++) {
+		const difference = (left.at(index) ?? 0) - (right.at(index) ?? 0);
+		if (difference !== 0) return Math.sign(difference);
+	}
+	return 0;
+};
+const pythonSeriesRequirementMatches = ({ current, operator, target, wildcard }) => {
+	const prefixCovers = (prefix) => prefix.length <= 2 && prefix.every((part, index) => current.at(index) === part);
+	const prefixOverlaps = target.slice(0, 2).every((part, index) => current.at(index) === part) && target.slice(3).every((part) => part === 0);
+	if (wildcard) {
+		if (operator === "==") return prefixCovers(target);
+		if (operator === "!=") return !prefixOverlaps;
+		return false;
+	}
+	const minimumComparison = compareRelease(current, target);
+	const seriesComparison = compareRelease(current.slice(0, 2), target.slice(0, 2));
+	switch (operator) {
+		case "==": return false;
+		case "!=": return !(seriesComparison === 0 && target.slice(3).every((part) => part === 0));
+		case ">=": return minimumComparison >= 0;
+		case ">": return minimumComparison > 0;
+		case "<=":
+		case "<": return seriesComparison < 0;
+		case "~=": return target.length >= 2 && minimumComparison >= 0 && prefixCovers(target.slice(0, -1));
+		default: return false;
+	}
+};
+/** Evaluate final-release Python constraints against the complete selected version set. */
+const pythonRequirementMatches = (requirement, version) => {
+	if (typeof requirement !== "string" || requirement.trim() === "") return false;
+	const current = version.split(".").map(Number);
+	return requirement.split(",").every((clause) => {
+		const match = /^(~=|==|!=|<=|>=|<|>)\s*(\d+(?:\.\d+)*)(\.\*)?$/.exec(clause.trim());
+		if (match === null) return false;
+		const operator = match[1];
+		const release = match[2];
+		if (release === void 0 || operator === void 0) return false;
+		const target = release.split(".").map(Number);
+		if (current.length === 2) return pythonSeriesRequirementMatches({
+			current,
+			operator,
+			target,
+			wildcard: match[3] !== void 0
+		});
+		const comparison = compareRelease(current, target);
+		if (match[3] !== void 0) {
+			if (operator !== "==" && operator !== "!=") return false;
+			const prefix = target.every((part, index) => (current.at(index) ?? 0) === part);
+			return operator === "==" ? prefix : !prefix;
+		}
+		switch (operator) {
+			case "==": return comparison === 0;
+			case "!=": return comparison !== 0;
+			case "<=": return comparison <= 0;
+			case ">=": return comparison >= 0;
+			case "<": return comparison < 0;
+			case ">": return comparison > 0;
+			case "~=": {
+				if (target.length < 2) return false;
+				const prefix = target.slice(0, -1);
+				return comparison >= 0 && prefix.every((part, index) => (current.at(index) ?? 0) === part);
+			}
+			default: return false;
+		}
+	});
+};
+/** Check runtime declarations only in the files that declare or configure them. */
+const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, repository, onDelegated, engineFloors = [], onEngineFloor }) => {
+	const diagnostics = [];
+	const name = node_path.default.posix.basename(file);
+	const lines = text.split(/\r?\n/);
+	const add = ({ rule, line, message }) => {
+		diagnostics.push({
+			rule,
+			path: file,
+			line,
+			message
+		});
+	};
+	const lineOf = (key) => Math.max(1, lines.findIndex((line) => line.includes(key)) + 1);
+	const pin = ({ rule, value, expected, label, line = 1, selector }) => {
+		let matches = value === expected;
+		if (selector === "node") matches = nodeSelectorMatches(value, expected);
+		else if (label.includes("python")) matches = pythonSelectorMatches(value, expected);
+		if (!matches) add({
+			rule,
+			line,
+			message: `${label} must be ${expected}, found ${String(value)}`
+		});
+	};
+	const toml = (rule) => {
+		try {
+			return (0, smol_toml.parse)(text);
+		} catch {
+			add({
+				rule,
+				line: 1,
+				message: "invalid TOML"
+			});
+			return;
+		}
+	};
+	const versions = {
+		...policy.packages,
+		...Object.fromEntries(Object.entries(policy.packages).map(([tool, version]) => [`npm:${tool}`, version])),
+		bun: policy.bun,
+		node: policy.node,
+		nodejs: policy.node,
+		python: policy.python,
+		rust: policy.rust,
+		"core:node": policy.node,
+		"core:python": policy.python,
+		"core:rust": policy.rust,
+		"core:bun": policy.bun
+	};
+	const nodeTools = /* @__PURE__ */ new Set([
+		"node",
+		"nodejs",
+		"core:node"
+	]);
+	if (name === ".bun-version") pin({
+		rule: "bun-pins",
+		value: text.trim(),
+		expected: policy.bun,
+		label: name
+	});
+	if (name === ".node-version" || name === ".nvmrc") pin({
+		rule: "node-version",
+		selector: "node",
+		value: text.trim(),
+		expected: policy.node,
+		label: name
+	});
+	if (name === ".python-version") pin({
+		rule: "python-version",
+		value: text.trim(),
+		expected: policy.python,
+		label: name
+	});
+	const firstContent = lines.find((line) => line.trim() !== "" && !line.trimStart().startsWith("#"));
+	const rustToml = name === "rust-toolchain.toml" || name === "rust-toolchain" && firstContent?.trimStart().startsWith("[");
+	if (name === "rust-toolchain" && !rustToml) pin({
+		rule: "rust-version",
+		value: text.trim(),
+		expected: policy.rust,
+		label: name
+	});
+	if (rustToml) {
+		const parsed = toml("rust-version");
+		if (parsed !== void 0) {
+			const toolchain = parsed["toolchain"];
+			const components = record$2(toolchain) ? toolchain["components"] : void 0;
+			const expected = Array.isArray(components) && components.includes("rustc-dev") ? policy.rustCompilerDevelopment : policy.rust;
+			pin({
+				rule: "rust-version",
+				value: record$2(toolchain) ? toolchain["channel"] : void 0,
+				expected,
+				label: "Rust channel",
+				line: lineOf("channel")
+			});
+		}
+	}
+	if (name === "Cargo.toml") {
+		const parsed = toml("rust-version");
+		const rustFloor = (value) => {
+			const parts = typeof value === "string" && /^(?:0|[1-9]\d*)(?:\.(?:0|[1-9]\d*)){0,2}$/.test(value) ? value.split(".").map(Number) : void 0;
+			if (parts === void 0 || !parts.every(Number.isSafeInteger) || compareRelease(parts, policy.rust.split(".").map(Number)) > 0) add({
+				rule: "rust-version",
+				line: lineOf("rust-version"),
+				message: `Cargo rust-version must be a bare support floor at or below Rust ${policy.rust}`
+			});
+		};
+		const readManifest = (candidate) => {
+			if (candidate === file) return parsed;
+			if (!trackedFiles.has(candidate)) return void 0;
+			try {
+				return (0, smol_toml.parse)(readFile(candidate) ?? "");
+			} catch {
+				return;
+			}
+		};
+		if (parsed !== void 0) {
+			const workspace = parsed["workspace"];
+			const defaults = record$2(workspace) ? workspace["package"] : void 0;
+			if (record$2(defaults) && defaults["rust-version"] !== void 0) rustFloor(defaults["rust-version"]);
+			const pkg = parsed["package"];
+			const version = record$2(pkg) ? pkg["rust-version"] : void 0;
+			if (version !== void 0) if (!record$2(version)) rustFloor(version);
+			else {
+				let inherited;
+				if (version["workspace"] === true && record$2(pkg)) {
+					const explicit = pkg["workspace"];
+					let directory = node_path.default.posix.dirname(file);
+					const explicitPath = typeof explicit === "string" && !explicit.includes("\\") && !explicit.includes(":") && !explicit.includes("${{") && !node_path.default.posix.isAbsolute(explicit) ? node_path.default.posix.normalize(node_path.default.posix.join(directory, explicit)) : void 0;
+					if (explicit === void 0 || explicitPath !== void 0 && explicitPath !== ".." && !explicitPath.startsWith("../")) {
+						if (explicitPath !== void 0) directory = explicitPath;
+						while (true) {
+							const table = readManifest(node_path.default.posix.join(directory, "Cargo.toml"))?.["workspace"];
+							if (record$2(table)) {
+								const fields = table["package"];
+								inherited = record$2(fields) ? fields["rust-version"] : void 0;
+								break;
+							}
+							if (explicit !== void 0 || directory === ".") break;
+							directory = node_path.default.posix.dirname(directory);
+						}
+					}
+				}
+				rustFloor(inherited);
+			}
+		}
+	}
+	if (name === "Pipfile") {
+		const requires = toml("python-version")?.["requires"];
+		if (record$2(requires)) {
+			const minor = requires["python_version"];
+			if (minor !== void 0 && minor !== policy.python.split(".").slice(0, 2).join(".")) add({
+				rule: "python-version",
+				line: lineOf("python_version"),
+				message: `Pipfile python_version must select Python ${policy.python}`
+			});
+			const full = requires["python_full_version"];
+			if (full !== void 0 && !(typeof full === "string" && /^\d+\.\d+\.\d+$/.test(full) && pythonSelectorMatches(full, policy.python))) add({
+				rule: "python-version",
+				line: lineOf("python_full_version"),
+				message: `Pipfile python_full_version must select Python ${policy.python}`
+			});
+		}
+	}
+	if (name === "pyproject.toml" || name === "uv.toml") {
+		const parsed = toml("python-version");
+		if (parsed !== void 0) {
+			const project = parsed["project"];
+			if (record$2(project) && project["requires-python"] !== void 0) {
+				if (!pythonRequirementMatches(project["requires-python"], policy.python)) add({
+					rule: "python-version",
+					line: lineOf("requires-python"),
+					message: `requires-python must include Python ${policy.python}; unsupported constraints must use final-release version specifiers`
+				});
+			}
+			const tool = parsed["tool"];
+			const configuredUv = record$2(tool) ? tool["uv"] : void 0;
+			const uv = name === "uv.toml" ? parsed : configuredUv;
+			if (record$2(uv) && uv["python"] !== void 0) pin({
+				rule: "python-version",
+				value: uv["python"],
+				expected: policy.python,
+				label: "uv python",
+				line: lineOf("python")
+			});
+		}
+	}
+	if (isMiseConfigPath(file)) {
+		const tools = toml("runtime-manager")?.["tools"];
+		if (record$2(tools)) for (const [tool, expected] of Object.entries(versions)) {
+			const configured = tools[tool];
+			if (configured !== void 0) pin({
+				rule: "runtime-manager",
+				value: record$2(configured) ? configured["version"] : configured,
+				expected,
+				selector: nodeTools.has(tool) ? "node" : void 0,
+				label: `mise ${tool}`,
+				line: lineOf(tool)
+			});
+		}
+	}
+	if (name === ".tool-versions") lines.forEach((line, index) => {
+		const fields = line.replace(/#.*$/, "").trim().split(/\s+/);
+		const tool = fields.at(0);
+		if (tool === void 0 || !(tool in versions)) return;
+		const expected = Object.entries(versions).find(([key]) => key === tool)?.[1];
+		if (expected !== void 0) pin({
+			rule: "runtime-manager",
+			value: fields.slice(1).join(" "),
+			expected,
+			selector: nodeTools.has(tool) ? "node" : void 0,
+			label: `.tool-versions ${tool}`,
+			line: index + 1
+		});
+	});
+	const checkRuntimeImage = ({ image, line, label }) => {
+		if (typeof image !== "string" || image.includes("$")) {
+			add({
+				rule: "runtime-docker",
+				line,
+				message: `cannot determine ${label} runtime; use a static image or a reasoned runtime-docker opt-out`
+			});
+			return;
+		}
+		const runtime = /^(node|python|oven\/bun)(?::([^@]+))?(?:@.*)?$/i.exec(canonicalDockerRuntime(image));
+		if (runtime === null) return;
+		const tool = runtime[1]?.toLowerCase();
+		if (image.includes("@")) {
+			add({
+				rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
+				line,
+				message: `${label} ${tool} digest requires an approved digest policy; use a tag-only runtime image`
+			});
+			return;
+		}
+		const tag = runtime[2];
+		const variantSuffix = tool === "oven/bun" ? /-(?:alpine|slim|debian)$/ : /-(?:alpine(?:\d+(?:\.\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim)$/;
+		const version = tag?.replace(variantSuffix, "");
+		let expected = policy.bun;
+		if (tool === "node") expected = policy.node;
+		else if (tool === "python") expected = policy.python;
+		pin({
+			rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
+			value: version,
+			expected,
+			selector: tool === "node" ? "node" : void 0,
+			label: `${label} ${tool}`,
+			line
+		});
+	};
+	if (isDockerDefinitionPath(file)) {
+		const variables = /* @__PURE__ */ new Map();
+		const escape = /^\s*#\s*escape\s*=\s*([\\`])\s*$/m.exec(text)?.[1] ?? "\\";
+		const continuation = new RegExp(`${escape === "`" ? "`" : "\\\\"}\\s*$`);
+		const stages = /* @__PURE__ */ new Set();
+		let argumentScope = "global";
+		const heredocs = [];
+		let instruction = "";
+		let startLine = 1;
+		const expand = (value) => {
+			for (let count = 0; count <= variables.size; count++) {
+				const next = value.replace(/\$(?:\{([A-Za-z_][A-Za-z_\d]*)\}|([A-Za-z_][A-Za-z_\d]*))/g, (reference, braced, plain) => variables.get(braced ?? plain ?? "") ?? reference);
+				if (next === value) return next;
+				value = next;
+			}
+			return value;
+		};
+		const collectHeredocs = (content, line) => {
+			let quote;
+			for (let index = 0; index < content.length; index++) {
+				const character = content.at(index);
+				if (quote !== void 0) {
+					if (character === quote) quote = void 0;
+					else if (quote === "\"" && character === "\\") index++;
+					continue;
+				}
+				if (character === "\\") {
+					index++;
+					continue;
+				}
+				if (character === "'" || character === "\"") {
+					quote = character;
+					continue;
+				}
+				if (character === "#" && (index === 0 || /[\s;&|()]/.test(content.at(index - 1) ?? ""))) break;
+				if (character !== "<" || content.at(index + 1) !== "<") continue;
+				if (content.at(index + 2) === "<") {
+					index += 2;
+					continue;
+				}
+				index += 2;
+				const stripTabs = content.at(index) === "-";
+				if (stripTabs) index++;
+				while (/\s/.test(content.at(index) ?? "")) index++;
+				if (content.at(index) === "#") {
+					add({
+						rule: "runtime-docker",
+						line,
+						message: "invalid Docker heredoc delimiter"
+					});
+					break;
+				}
+				let delimiter = "";
+				let delimiterQuote;
+				for (; index < content.length; index++) {
+					const part = content.at(index);
+					if (delimiterQuote !== void 0) {
+						if (part === delimiterQuote) delimiterQuote = void 0;
+						else if (delimiterQuote === "\"" && part === "\\" && /[$"\\]/.test(content.at(index + 1) ?? "")) delimiter += content.at(++index);
+						else delimiter += part;
+						continue;
+					}
+					if (part === "'" || part === "\"") {
+						delimiterQuote = part;
+						continue;
+					}
+					if (part === "\\" && content.at(index + 1) !== void 0) {
+						delimiter += content.at(++index);
+						continue;
+					}
+					if (/[\s;&|<>()]/.test(part ?? "")) break;
+					delimiter += part;
+				}
+				if (delimiter !== "" && delimiterQuote === void 0) heredocs.push({
+					delimiter,
+					stripTabs,
+					line
+				});
+				else add({
+					rule: "runtime-docker",
+					line,
+					message: "invalid Docker heredoc delimiter"
+				});
+				index--;
+			}
+		};
+		const checkInstruction = (content, line) => {
+			const argument = /^\s*ARG\s+([A-Za-z_][A-Za-z_\d]*)(?:=(.*))?$/i.exec(content);
+			if (argument !== null) {
+				if (argumentScope === "stage") return;
+				const key = argument[1];
+				const value = argument[2];
+				if (key !== void 0 && value !== void 0) variables.set(key, expand(value.replace(/^(["'])(.*)\1$/, "$2")));
+				return;
+			}
+			if (/^\s*(?:RUN|COPY)\s+/i.test(content)) {
+				collectHeredocs(content, line);
+				return;
+			}
+			const from = /^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)(?:\s+AS\s+(\S+))?/i.exec(content);
+			if (from === null || from[1] === void 0) return;
+			argumentScope = "stage";
+			const image = expand(from[1]);
+			if (image.includes("$")) {
+				add({
+					rule: "runtime-docker",
+					line,
+					message: "cannot determine FROM runtime; declare an image ARG default or a reasoned runtime-docker opt-out"
+				});
+				return;
+			}
+			const stage = from[2]?.toLowerCase();
+			const previousStage = stages.has(image.toLowerCase());
+			if (stage !== void 0) stages.add(stage);
+			if (previousStage) return;
+			checkRuntimeImage({
+				image,
+				line,
+				label: "FROM"
+			});
+		};
+		lines.forEach((line, index) => {
+			const heredoc = heredocs.at(0);
+			if (heredoc !== void 0) {
+				if ((heredoc.stripTabs ? line.replace(/^\t+/, "") : line) === heredoc.delimiter) heredocs.shift();
+				return;
+			}
+			if (line.trimStart().startsWith("#")) return;
+			if (instruction === "") startLine = index + 1;
+			instruction += line.replace(continuation, " ");
+			if (continuation.test(line)) return;
+			checkInstruction(instruction, startLine);
+			instruction = "";
+		});
+		if (instruction !== "") checkInstruction(instruction, startLine);
+		for (const heredoc of heredocs) add({
+			rule: "runtime-docker",
+			line: heredoc.line,
+			message: `unterminated Docker heredoc ${heredoc.delimiter}`
+		});
+	}
+	if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {
+		const lineCounter = new yaml.LineCounter();
+		for (const containerDocument of (0, yaml.parseAllDocuments)(text, {
+			lineCounter,
+			merge: true,
+			uniqueKeys: true
+		})) {
+			const contents = containerDocument.contents;
+			const declaredResource = (0, yaml.isMap)(contents) && (0, yaml.isScalar)(contents.get("apiVersion", true)) && (0, yaml.isScalar)(contents.get("kind", true));
+			const recognizedContainer = isComposeDefinitionPath(file) || declaredResource;
+			if (containerDocument.errors.length > 0) {
+				if (recognizedContainer) add({
+					rule: "runtime-docker",
+					line: 1,
+					message: "invalid container YAML"
+				});
+				continue;
+			}
+			try {
+				const classified = containerDocumentImages(containerDocument.toJS({ maxAliasCount: 100 }), file);
+				for (const entry of classified?.images ?? []) {
+					const node = containerDocument.getIn(entry.path, true);
+					const line = ((0, yaml.isMap)(node) || (0, yaml.isScalar)(node) || (0, yaml.isSeq)(node) || (0, yaml.isAlias)(node)) && node.range !== void 0 && node.range !== null ? lineCounter.linePos(node.range[0]).line : 1;
+					checkRuntimeImage({
+						image: entry.image,
+						line,
+						label: classified?.ecosystem === "docker-compose" ? "Compose image" : "Kubernetes image"
+					});
+				}
+			} catch {
+				if (recognizedContainer) add({
+					rule: "runtime-docker",
+					line: 1,
+					message: "invalid container YAML aliases"
+				});
+			}
+		}
+	}
+	const automationKind = githubAutomationFileKind(file);
+	if (automationKind === void 0) return diagnostics;
+	const document = (0, yaml.parseDocument)(text, {
+		uniqueKeys: true,
+		merge: true
+	});
+	if (document.errors.length > 0) {
+		add({
+			rule: "runtime-workflow",
+			line: 1,
+			message: "invalid workflow YAML"
+		});
+		return diagnostics;
+	}
+	const nodeLine = (node) => {
+		if (!record$2(node) || !Array.isArray(node["range"])) return 1;
+		const offset = node["range"].at(0);
+		return typeof offset === "number" ? text.slice(0, offset).split("\n").length : 1;
+	};
+	let checkoutBindings = [];
+	let checkoutDestinations = /* @__PURE__ */ new Map();
+	let unknownCheckoutDestination = false;
+	const staticRepositoryPath = (value) => typeof value === "string" && value !== "" && !value.includes("${{") && !value.includes("\\") && !value.includes(":") && !node_path.default.posix.isAbsolute(value) && !value.split("/").includes("..");
+	const normalizeCheckoutPath = (prefix) => node_path.default.posix.normalize(prefix).replace(/\/$/, "") || ".";
+	const checkReference = ({ value, tool, line }) => {
+		const allowed = {
+			node: [".node-version", ".nvmrc"],
+			python: [".python-version"],
+			bun: ["package.json"]
+		}[tool];
+		const rule = tool === "bun" ? "bun-pins" : "runtime-workflow";
+		const selector = staticRepositoryPath(value) ? node_path.default.posix.normalize(value) : void 0;
+		const binding = selector === void 0 ? void 0 : checkoutBindings.findLast((entry) => entry.path === "." || selector === entry.path || selector.startsWith(`${entry.path}/`));
+		if (selector === void 0) {
+			add({
+				rule,
+				line,
+				message: `setup-${tool} must reference a tracked ${allowed.join(" or ")}`
+			});
+			return;
+		}
+		if (unknownCheckoutDestination || [...checkoutDestinations].some(([prefix, count]) => count > 1 && (prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`)))) {
+			add({
+				rule,
+				line,
+				message: `setup-${tool} version-file selector has untrusted checkout provenance: checkout destinations must be static and have exactly one writer`
+			});
+			return;
+		}
+		if (binding?.source === "untrusted") {
+			add({
+				rule,
+				line: binding.line,
+				message: `setup-${tool} version-file selector cannot use this checkout: ${binding.reason}`
+			});
+			return;
+		}
+		const target = binding === void 0 || binding.path === "." ? selector : node_path.default.posix.relative(binding.path, selector);
+		if (!allowed.includes(node_path.default.posix.basename(target)) || binding?.source !== "delegated" && !trackedFiles.has(target)) {
+			add({
+				rule,
+				line,
+				message: `setup-${tool} must reference a tracked ${allowed.join(" or ")}`
+			});
+			return;
+		}
+		if (binding !== void 0 && (binding.sparse.mode === "invalid" || binding.sparse.mode === "files" && !binding.sparse.paths.has(target))) {
+			add({
+				rule,
+				line,
+				message: `checkout sparse-checkout must explicitly list ${target} without dynamic, glob, or negation patterns`
+			});
+			return;
+		}
+		if (binding?.source === "delegated") {
+			onDelegated?.({
+				path: file,
+				line,
+				tool,
+				selector,
+				checkoutPath: binding.path,
+				ref: binding.ref
+			});
+			return;
+		}
+		const content = readFile(target);
+		if (tool === "bun") {
+			try {
+				const manifest = JSON.parse(content ?? "");
+				pin({
+					rule,
+					value: record$2(manifest) ? manifest["packageManager"] : void 0,
+					expected: `bun@${policy.bun}`,
+					label: "setup-bun version file packageManager",
+					line
+				});
+			} catch {
+				add({
+					rule,
+					line,
+					message: "bun-version-file must reference a readable package.json object"
+				});
+			}
+			return;
+		}
+		pin({
+			rule,
+			value: content?.trim(),
+			expected: policy[tool],
+			selector: tool === "node" ? "node" : void 0,
+			label: `setup-${tool} version file`,
+			line
+		});
+	};
+	const resolveNode = (node) => {
+		const visited = /* @__PURE__ */ new Set();
+		while ((0, yaml.isAlias)(node)) {
+			if (visited.has(node)) throw new Error("cyclic YAML alias");
+			visited.add(node);
+			node = node.resolve(document);
+		}
+		return node;
+	};
+	const approvedActions = new Map(Object.entries(policy.actions).map(([action, approved]) => [action.toLowerCase(), approved]));
+	const mergedMaps = (node) => {
+		node = resolveNode(node);
+		if (!(0, yaml.isMap)(node)) return [];
+		const maps = [];
+		for (const pair of node.items) {
+			if (!(0, yaml.isScalar)(pair.key) || typeof pair.key.value !== "symbol" || pair.key.source !== "<<") continue;
+			const merge = resolveNode(pair.value);
+			maps.push(...(0, yaml.isSeq)(merge) ? merge.items : [merge]);
+		}
+		return maps;
+	};
+	const keysOf = (node, visited = /* @__PURE__ */ new Set()) => {
+		node = resolveNode(node);
+		if (!(0, yaml.isMap)(node)) return /* @__PURE__ */ new Set();
+		if (visited.has(node)) throw new Error("cyclic YAML merge");
+		const next = new Set(visited);
+		next.add(node);
+		const keys = new Set(node.items.flatMap((pair) => (0, yaml.isScalar)(pair.key) && typeof pair.key.value === "string" ? [pair.key.value] : []));
+		for (const merged of mergedMaps(node)) for (const key of keysOf(merged, next)) keys.add(key);
+		return keys;
+	};
+	const sourceMap = ({ node, key, visited = /* @__PURE__ */ new Set() }) => {
+		node = resolveNode(node);
+		if (!(0, yaml.isMap)(node)) return void 0;
+		if (node.has(key)) return node;
+		if (visited.has(node)) throw new Error("cyclic YAML merge");
+		const next = new Set(visited);
+		next.add(node);
+		for (const merged of mergedMaps(node)) {
+			const source = sourceMap({
+				node: merged,
+				key,
+				visited: next
+			});
+			if (source !== void 0) return source;
+		}
+	};
+	const getNode = (node, key) => {
+		const source = sourceMap({
+			node,
+			key
+		});
+		return (0, yaml.isMap)(source) ? resolveNode(source.get(key, true)) : void 0;
+	};
+	const actionInputs = /* @__PURE__ */ new Map();
+	const inputsOf = (node) => {
+		node = resolveNode(node);
+		const cached = actionInputs.get(node);
+		if (cached !== void 0) return cached;
+		const options = getNode(node, "with");
+		const inputs = /* @__PURE__ */ new Map();
+		for (const key of keysOf(options)) {
+			const folded = key.toUpperCase();
+			const value = getNode(options, key);
+			if (inputs.has(folded)) add({
+				rule: "action-pins",
+				line: nodeLine(value),
+				message: `action input ${key} collides after case-folding`
+			});
+			if (/(?:^|-)VERSION(?:-FILE)?$/.test(folded) && key !== folded.toLowerCase()) add({
+				rule: "action-pins",
+				line: nodeLine(value),
+				message: `selector input ${key} must use canonical lowercase casing`
+			});
+			inputs.set(folded, value);
+		}
+		actionInputs.set(node, inputs);
+		return inputs;
+	};
+	const getInput = (node, key) => inputsOf(node).get(key.toUpperCase());
+	const dynamicRefBody = (value) => {
+		if (typeof value !== "string" || !value.startsWith("${{")) return void 0;
+		let quote;
+		for (let index = 3; index < value.length; index++) {
+			const character = value.at(index);
+			if (quote !== void 0) {
+				if (character === quote) if (quote === "'" && value.at(index + 1) === "'") index++;
+				else quote = void 0;
+				else if (quote === "\"" && character === "\\") index++;
+				continue;
+			}
+			if (character === "'" || character === "\"") quote = character;
+			else if (value.startsWith("${{", index)) return void 0;
+			else if (character === "}" && value.at(index + 1) === "}") return index === value.length - 2 ? value.slice(3, index).trim() : void 0;
+		}
+	};
+	const checkoutPrefixOf = (node) => {
+		const destination = getInput(node, "path");
+		if (destination === void 0) return ".";
+		return (0, yaml.isScalar)(destination) ? destination.value : void 0;
+	};
+	const sparseCheckoutOf = (node) => {
+		const sparseKeys = [...inputsOf(node).keys()].filter((key) => key.startsWith("SPARSE-CHECKOUT"));
+		if (sparseKeys.length === 0) return { mode: "all" };
+		if (sparseKeys.some((key) => key !== "SPARSE-CHECKOUT" && key !== "SPARSE-CHECKOUT-CONE-MODE")) return { mode: "invalid" };
+		const value = getInput(node, "sparse-checkout");
+		const cone = getInput(node, "sparse-checkout-cone-mode");
+		if (!(0, yaml.isScalar)(value) || typeof value.value !== "string" || cone !== void 0 && (!(0, yaml.isScalar)(cone) || cone.value !== true && cone.value !== false && cone.value !== "true" && cone.value !== "false")) return { mode: "invalid" };
+		const paths = value.value.split(/\r?\n/).map((entry) => entry.trim()).filter((entry) => entry !== "");
+		if (paths.length === 0 || paths.some((entry) => !staticRepositoryPath(entry) || entry.startsWith("!") || /[*?[\]]/.test(entry))) return { mode: "invalid" };
+		return {
+			mode: "files",
+			paths: new Set(paths)
+		};
+	};
+	let currentEngineFloor;
+	const checkAction = (node) => {
+		node = resolveNode(node);
+		if (!(0, yaml.isMap)(node)) return;
+		inputsOf(node);
+		const uses = getNode(node, "uses");
+		if (uses === void 0) return;
+		const line = nodeLine(uses);
+		if (!(0, yaml.isScalar)(uses) || typeof uses.value !== "string") {
+			add({
+				rule: "action-pins",
+				line,
+				message: "action uses must be a string containing a full commit SHA"
+			});
+			return;
+		}
+		const value = uses.value;
+		if (value.startsWith("$/")) {
+			if (value.length === 2 || /\s/.test(value) || value.includes("@") || value.includes("${{") || value.includes("\\") || value.split("/").includes("..")) add({
+				rule: "action-pins",
+				line,
+				message: "self-repository actions must use a static repository path without a ref suffix"
+			});
+			return;
+		}
+		if (value.startsWith("./")) {
+			const selector = staticRepositoryPath(value) ? node_path.default.posix.normalize(value) : void 0;
+			const binding = selector === void 0 ? void 0 : checkoutBindings.findLast((entry) => entry.path === "." || selector === entry.path || selector.startsWith(`${entry.path}/`));
+			if (selector === void 0 || unknownCheckoutDestination || binding !== void 0 && binding.source !== "tracked" || [...checkoutDestinations].some(([prefix, count]) => count > 1 && (prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`)))) add({
+				rule: "action-pins",
+				line,
+				message: "local actions require an unambiguous checkout of the current source snapshot"
+			});
+			return;
+		}
+		if (value.startsWith("docker://")) {
+			add({
+				rule: "action-pins",
+				line,
+				message: "Docker image actions require a reasoned action-pins opt-out"
+			});
+			checkRuntimeImage({
+				image: value.slice(9),
+				line,
+				label: "Docker action image"
+			});
+			return;
+		}
+		const remote = /^([^./][^\s@]*\/[^\s@]+)@([^\s]+)$/.exec(value);
+		if (remote === null) {
+			add({
+				rule: "action-pins",
+				line,
+				message: "remote actions must use a full commit SHA"
+			});
+			return;
+		}
+		const action = remote[1]?.toLowerCase();
+		const ref = remote[2];
+		const approved = action === void 0 ? void 0 : approvedActions.get(action) ?? approvedActions.get(action.split("/").slice(0, 2).join("/"));
+		if (ref === void 0 || !/^[a-f0-9]{40}$/.test(ref)) add({
+			rule: "action-pins",
+			line,
+			message: "remote actions must use a full commit SHA"
+		});
+		else if (approved !== void 0 && ref !== approved.sha) add({
+			rule: "action-pins",
+			line,
+			message: `${action} must use ${approved.sha}`
+		});
+		const declaration = sourceMap({
+			node,
+			key: "uses"
+		});
+		const comment = uses.comment ?? ((0, yaml.isMap)(declaration) ? declaration.comment : void 0) ?? "";
+		if (approved !== void 0 && !comment.trim().split(/\s+/).includes(approved.version)) add({
+			rule: "action-pins",
+			line,
+			message: `${action} requires a # ${approved.version} version comment`
+		});
+		if (action === "actions/checkout") {
+			const checkoutRepository = getInput(node, "repository");
+			const checkoutRef = getInput(node, "ref");
+			const prefix = checkoutPrefixOf(node);
+			let repo;
+			if (checkoutRepository !== void 0) repo = (0, yaml.isScalar)(checkoutRepository) ? checkoutRepository.value : null;
+			const self = repo === void 0 || repo === "${{ github.repository }}" || typeof repo === "string" && repository !== void 0 && repo.toLowerCase() === repository.toLowerCase();
+			const workflowSource = repo === "${{ job.workflow_repository }}" && (0, yaml.isScalar)(checkoutRef) && checkoutRef.value === "${{ job.workflow_sha }}";
+			const currentSource = self && checkoutRef === void 0;
+			const refValue = (0, yaml.isScalar)(checkoutRef) ? checkoutRef.value : void 0;
+			const dynamicRef = dynamicRefBody(refValue);
+			const delegatedSource = (self || repo === "${{ job.workflow_repository }}") && dynamicRef !== void 0 && dynamicRef !== "" && !/^(?:'(?:[^']|'')*'|"(?:[^"\\]|\\.)*"|(?:true|false|null)|-?(?:0x[\da-f]+|(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?))$/i.test(dynamicRef) && !/^(?:github\s*(?:\.\s*sha|\[\s*['"]sha['"]\s*\])|job\s*(?:\.\s*workflow_sha|\[\s*['"]workflow_sha['"]\s*\]))$/i.test(dynamicRef);
+			if (!staticRepositoryPath(prefix)) checkoutBindings.push({
+				path: ".",
+				source: "untrusted",
+				reason: "checkout destination must be a static repository path",
+				line,
+				sparse: { mode: "invalid" }
+			});
+			else {
+				const destination = normalizeCheckoutPath(prefix);
+				const trustedWriter = ref === approved?.sha && sourceMap({
+					node,
+					key: "if"
+				}) === void 0 && sourceMap({
+					node,
+					key: "continue-on-error"
+				}) === void 0 && checkoutDestinations.get(destination) === 1 && !unknownCheckoutDestination;
+				if (trustedWriter && delegatedSource && typeof refValue === "string") checkoutBindings.push({
+					path: destination,
+					sparse: sparseCheckoutOf(node),
+					source: "delegated",
+					ref: refValue
+				});
+				else if (trustedWriter && (workflowSource || currentSource)) checkoutBindings.push({
+					path: destination,
+					sparse: sparseCheckoutOf(node),
+					source: "tracked"
+				});
+				else {
+					let reason = "checkout does not select a trusted repository source snapshot";
+					if (ref !== approved?.sha) reason = "actions/checkout must use the approved action SHA";
+					else if (sourceMap({
+						node,
+						key: "if"
+					}) !== void 0 || sourceMap({
+						node,
+						key: "continue-on-error"
+					}) !== void 0) reason = "checkout must be unconditional and omit continue-on-error";
+					else if (checkoutDestinations.get(destination) !== 1 || unknownCheckoutDestination) reason = "checkout destination must have exactly one static writer";
+					checkoutBindings.push({
+						path: destination,
+						sparse: sparseCheckoutOf(node),
+						source: "untrusted",
+						reason,
+						line
+					});
+				}
+			}
+		}
+		let tool;
+		switch (action) {
+			case "actions/setup-node":
+				tool = "node";
+				break;
+			case "actions/setup-python":
+				tool = "python";
+				break;
+			case "oven-sh/setup-bun":
+				tool = "bun";
+				break;
+			default: return;
+		}
+		const literal = getInput(node, `${tool}-version`);
+		if (tool === "node" && currentEngineFloor !== void 0) {
+			const reference = getInput(node, "node-version-file");
+			if (reference === void 0 && (0, yaml.isScalar)(literal) && engineFloorSelectorMatches(literal.value, currentEngineFloor)) {
+				onEngineFloor?.(currentEngineFloor, "matched");
+				return;
+			}
+			onEngineFloor?.(currentEngineFloor, "mismatch");
+			add({
+				rule: "runtime-workflow",
+				line: nodeLine(literal ?? reference ?? uses),
+				message: `engine floor job must select an exact Node patch satisfying ${currentEngineFloor.range} with minimum major ${currentEngineFloor.major}`
+			});
+			return;
+		}
+		if (literal !== void 0) add({
+			rule: tool === "bun" ? "bun-pins" : "runtime-workflow",
+			line: nodeLine(literal),
+			message: `setup-${tool} must use ${tool}-version-file`
+		});
+		const reference = getInput(node, `${tool}-version-file`);
+		checkReference({
+			value: (0, yaml.isScalar)(reference) ? reference.value : void 0,
+			tool,
+			line: reference === void 0 ? line : nodeLine(reference)
+		});
+	};
+	const checkContainer = (node) => {
+		node = resolveNode(node);
+		if (node === void 0) return;
+		const image = (0, yaml.isMap)(node) ? getNode(node, "image") : node;
+		checkRuntimeImage({
+			image: (0, yaml.isScalar)(image) ? image.value : void 0,
+			line: nodeLine(image ?? node),
+			label: "container image"
+		});
+	};
+	const checkSteps = (node, floor) => {
+		currentEngineFloor = void 0;
+		checkoutBindings = [];
+		checkoutDestinations = /* @__PURE__ */ new Map();
+		unknownCheckoutDestination = false;
+		node = resolveNode(node);
+		if (!(0, yaml.isSeq)(node)) return;
+		for (const step of node.items) {
+			const uses = getNode(step, "uses");
+			if (!(0, yaml.isScalar)(uses) || typeof uses.value !== "string" || !uses.value.toLowerCase().startsWith("actions/checkout@")) continue;
+			const prefix = checkoutPrefixOf(step);
+			if (!staticRepositoryPath(prefix)) {
+				unknownCheckoutDestination = true;
+				continue;
+			}
+			const destination = normalizeCheckoutPath(prefix);
+			checkoutDestinations.set(destination, (checkoutDestinations.get(destination) ?? 0) + 1);
+		}
+		currentEngineFloor = floor;
+		try {
+			for (const step of node.items) checkAction(step);
+		} finally {
+			currentEngineFloor = void 0;
+		}
+	};
+	try {
+		document.toJS({ maxAliasCount: 100 });
+		if (automationKind === "workflow") {
+			const jobs = getNode(document.contents, "jobs");
+			if ((0, yaml.isMap)(jobs)) for (const key of keysOf(jobs)) {
+				checkoutBindings = [];
+				checkoutDestinations = /* @__PURE__ */ new Map();
+				unknownCheckoutDestination = false;
+				currentEngineFloor = void 0;
+				const job = getNode(jobs, key);
+				checkAction(job);
+				checkContainer(getNode(job, "container"));
+				const services = getNode(job, "services");
+				if ((0, yaml.isMap)(services)) for (const service of keysOf(services)) checkContainer(getNode(services, service));
+				checkSteps(getNode(job, "steps"), engineFloors.find((entry) => entry.job === key));
+			}
+		} else {
+			const runs = getNode(document.contents, "runs");
+			const using = getNode(runs, "using");
+			if ((0, yaml.isScalar)(using) && using.value === "composite") checkSteps(getNode(runs, "steps"));
+			if ((0, yaml.isScalar)(using) && using.value === "docker") {
+				const image = getNode(runs, "image");
+				const value = (0, yaml.isScalar)(image) ? image.value : void 0;
+				if (typeof value === "string" && value.startsWith("docker://")) {
+					add({
+						rule: "action-pins",
+						line: nodeLine(image),
+						message: "Docker image actions require a reasoned action-pins opt-out"
+					});
+					checkRuntimeImage({
+						image: value.slice(9),
+						line: nodeLine(image),
+						label: "Docker action image"
+					});
+				} else if (typeof value !== "string" || value.includes("${{") || value.includes("\\") || value.includes(":") || node_path.default.posix.isAbsolute(value) || node_path.default.posix.normalize(node_path.default.posix.join(node_path.default.posix.dirname(file), value)).split("/").at(0) === ".." || node_path.default.posix.basename(value) !== "Dockerfile") add({
+					rule: "action-pins",
+					line: nodeLine(image),
+					message: "Docker actions must reference a local Dockerfile or declare a reasoned action-pins opt-out for an external image"
+				});
+			}
+		}
+	} catch {
+		add({
+			rule: "runtime-workflow",
+			line: 1,
+			message: "cannot resolve workflow YAML aliases"
+		});
+	}
+	return diagnostics;
+};
+//#endregion
+//#region src/toolchain-schema.ts
+const packagePinKeys = [
+	"oxlint",
+	"oxlint-tsgolint",
+	"@oxlint/plugins",
+	"@stll/oxlint-plugin",
+	"oxfmt",
+	"lefthook"
+];
+const valkeyArchitectures = ["amd64", "arm64"];
+const valkeyArtifactPackages = {
+	server: "valkey-server",
+	tools: "valkey-tools"
+};
+const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const artifactRecord = (value, keys) => {
+	if (!record$1(value) || Object.keys(value).some((key) => !keys.includes(key)) || keys.some((key) => !Object.hasOwn(value, key))) throw new Error("valkeyArtifacts requires complete, closed artifact objects");
+	return value;
+};
+const parseValkeyArtifacts = (input, version) => {
+	const architectures = artifactRecord(input, valkeyArchitectures);
+	const line = version.split(".").slice(0, 2).join(".");
+	const parseArchitecture = (architecture) => {
+		const packages = artifactRecord(architectures[architecture], Object.keys(valkeyArtifactPackages));
+		const parseArtifact = (kind) => {
+			const artifact = artifactRecord(packages[kind], ["url", "sha256"]);
+			const url = artifact["url"];
+			const sha256 = artifact["sha256"];
+			const expected = `https://download.valkey.io/packaging/valkey-${line}/deb/ubuntu2404/${architecture}/${valkeyArtifactPackages[kind]}_${version}-1.noble_${architecture}.deb`;
+			if (typeof url !== "string" || url !== expected) throw new Error("valkeyArtifacts URL must select the exact official versioned Ubuntu artifact");
+			if (typeof sha256 !== "string" || !/^[a-f0-9]{64}$/.test(sha256)) throw new Error("valkeyArtifacts requires a lowercase SHA256 pin");
+			return {
+				url,
+				sha256
+			};
+		};
+		return {
+			server: parseArtifact("server"),
+			tools: parseArtifact("tools")
+		};
+	};
+	return {
+		amd64: parseArchitecture("amd64"),
+		arm64: parseArchitecture("arm64")
+	};
+};
+/** Reject unsupported or incomplete installed policies before inspecting a consumer. */
+const parseToolchainPolicy = (input) => {
+	if (!record$1(input) || input["schemaVersion"] !== 1) throw new Error("toolchain.json must use schemaVersion 1");
+	const string = (object, key) => {
+		const value = object[key];
+		if (typeof value !== "string" || value.trim() === "") throw new Error(`toolchain.json requires a nonempty ${key}`);
+		return value;
+	};
+	const packages = {};
+	for (const key of packagePinKeys) packages[key] = string(input, key);
+	const bun = string(input, "bun");
+	const typescript = string(input, "typescript");
+	const node = string(input, "node");
+	const python = string(input, "python");
+	const postgres = string(input, "postgres");
+	const valkey = string(input, "valkey");
+	const rust = string(input, "rust");
+	const rustCompilerDevelopment = string(input, "rustCompilerDevelopment");
+	for (const [name, value] of Object.entries({
+		...packages,
+		bun,
+		typescript
+	})) if ((0, semver.valid)(value) !== value) throw new Error(`toolchain.json ${name} must be an exact release`);
+	if (!/^[1-9]\d*$/.test(postgres) || !Number.isSafeInteger(Number(postgres))) throw new Error("PostgreSQL must be a canonical positive major");
+	if ((0, semver.valid)(valkey) !== valkey || !/^\d+\.\d+\.\d+$/.test(valkey)) throw new Error("Valkey must be an exact stable release");
+	const valkeyArtifacts = parseValkeyArtifacts(input["valkeyArtifacts"], valkey);
+	if (!nodePolicyValid(node)) throw new Error("Node must be a canonical major N.x series");
+	if (!/^\d+\.\d+(?:\.\d+)?$/.test(python)) throw new Error("Python must be an exact minor or patch release");
+	if (!/^\d+\.\d+\.\d+$/.test(rust)) throw new Error("Rust must be an exact stable release");
+	if (!/^nightly-\d{4}-\d{2}-\d{2}$/.test(rustCompilerDevelopment)) throw new Error("Rust compiler development must be a dated nightly");
+	const compatibility = input["typescript6Compatibility"];
+	if (!record$1(compatibility)) throw new Error("missing TypeScript compatibility policy");
+	const version = string(compatibility, "version");
+	const packageAlias = string(compatibility, "packageAlias");
+	if ((0, semver.valid)(version) !== version) throw new Error("TypeScript compatibility must be an exact release");
+	const layouts = input["typescriptInstallLayouts"];
+	if (!Array.isArray(layouts) || layouts.length === 0) throw new Error("missing TypeScript install layouts");
+	const typescriptInstallLayouts = layouts.map((layout) => {
+		if (!record$1(layout)) throw new Error("invalid TypeScript install layout");
+		const compilerPackage = string(layout, "compilerPackage");
+		const compilerSpecifier = string(layout, "compilerSpecifier");
+		const typecheckCommand = string(layout, "typecheckCommand");
+		switch (layout["type"]) {
+			case "direct":
+				if (compilerSpecifier !== typescript || compilerPackage !== "typescript") throw new Error("direct TypeScript layout differs from shared version");
+				return {
+					type: "direct",
+					compilerPackage,
+					compilerSpecifier,
+					typecheckCommand
+				};
+			case "split-compatibility": {
+				const compatibilityPackage = string(layout, "compatibilityPackage");
+				const compatibilitySpecifier = string(layout, "compatibilitySpecifier");
+				if (compilerSpecifier !== `npm:typescript@${typescript}` || compatibilitySpecifier !== version) throw new Error("split TypeScript layout differs from shared versions");
+				return {
+					type: "split-compatibility",
+					compilerPackage,
+					compilerSpecifier,
+					compatibilityPackage,
+					compatibilitySpecifier,
+					typecheckCommand
+				};
+			}
+			default: throw new Error("unsupported TypeScript install layout");
+		}
+	});
+	const actionsInput = input["actions"];
+	if (!record$1(actionsInput) || Object.keys(actionsInput).length === 0) throw new Error("missing approved actions");
+	const actions = {};
+	for (const [name, action] of Object.entries(actionsInput)) {
+		if (!record$1(action)) throw new Error(`invalid action policy: ${name}`);
+		const sha = string(action, "sha");
+		const actionVersion = string(action, "version");
+		if (!/^[a-f0-9]{40}$/.test(sha) || !/^v\d+(?:\.\d+)*$/.test(actionVersion)) throw new Error(`invalid action SHA/version: ${name}`);
+		actions[name] = {
+			sha,
+			version: actionVersion
+		};
+	}
+	const dependabotInput = input["dependabot"];
+	if (!record$1(dependabotInput) || !record$1(dependabotInput["schedule"]) || !record$1(dependabotInput["cooldown"]) || !record$1(dependabotInput["groups"])) throw new Error("missing Dependabot policy");
+	const scheduleInput = dependabotInput["schedule"];
+	const schedule = {
+		interval: string(scheduleInput, "interval"),
+		day: string(scheduleInput, "day"),
+		time: string(scheduleInput, "time"),
+		timezone: string(scheduleInput, "timezone")
+	};
+	const defaultDays = dependabotInput["cooldown"]["defaultDays"];
+	if (typeof defaultDays !== "number" || !Number.isInteger(defaultDays) || defaultDays < 5) throw new Error("Dependabot cooldown must be at least five days");
+	const strings = (value) => {
+		if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string")) throw new Error("Dependabot group values must be string arrays");
+		return value;
+	};
+	const groups = {};
+	for (const [name, group] of Object.entries(dependabotInput["groups"])) {
+		if (!record$1(group)) throw new Error(`invalid Dependabot group: ${name}`);
+		groups[name] = {
+			patterns: strings(group["patterns"]),
+			updateTypes: strings(group["updateTypes"])
+		};
+	}
+	return {
+		bun,
+		typescript,
+		node,
+		postgres,
+		valkey,
+		valkeyArtifacts,
+		python,
+		rust,
+		rustCompilerDevelopment,
+		packages,
+		actions,
+		typescriptInstallLayouts,
+		typescript6Compatibility: {
+			version,
+			packageAlias
+		},
+		dependabot: {
+			schedule,
+			cooldown: { defaultDays },
+			groups,
+			ignoredPackages: [.../* @__PURE__ */ new Set([
+				...Object.keys(packages),
+				...typescriptInstallLayouts.flatMap((layout) => layout.type === "direct" ? [layout.compilerPackage] : [layout.compilerPackage, layout.compatibilityPackage]),
+				packageAlias,
+				"bun-types"
+			])],
+			ignoredActions: Object.keys(actions),
+			ignoredImages: [
+				"node",
+				"python",
+				"oven/bun"
+			]
+		}
+	};
+};
+//#endregion
+//#region src/toolchain-guard.ts
+const toolchainRules = [.../* @__PURE__ */ new Set([
+	...packageRules,
+	...runtimeRules,
+	...dependabotRules,
+	"cloud-setup-drift"
+])];
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const array = (value) => Array.isArray(value);
+/** Repository-owned declarations are explicit; malformed decisions fail closed. */
+const parseToolchainConfiguration = (input) => {
+	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud and engineFloors declarations");
+	const disabled = /* @__PURE__ */ new Set();
+	const optOuts = input["optOuts"] ?? [];
+	if (!array(optOuts)) throw new Error("optOuts must be an array");
+	for (const entry of optOuts) {
+		if (!record(entry) || Object.keys(entry).some((key) => key !== "rule" && key !== "reason") || typeof entry["rule"] !== "string" || !toolchainRules.some((rule) => rule === entry["rule"]) || typeof entry["reason"] !== "string" || entry["reason"].trim() === "" || disabled.has(entry["rule"])) throw new Error("each opt-out requires a unique known rule and a nonempty reason");
+		if (entry["rule"] === "node-engine") throw new Error("node-engine cannot be opted out; engines.node must support the shared Node series");
+		if (entry["rule"] === "cloud-setup-drift") throw new Error("cloud-setup-drift cannot be opted out; generated setup must match shared policy");
+		disabled.add(entry["rule"]);
+	}
+	return {
+		disabled,
+		cloud: parseCloudSetup(input["cloud"]),
+		engineFloors: parseEngineFloors(input["engineFloors"])
+	};
+};
+/** Read one tracked configuration snapshot for guards and policy generation. */
+const readToolchainInputs = (root) => {
+	const diagnostics = [];
+	const tracked = (0, node_child_process.execFileSync)("git", [
+		"ls-files",
+		"-z",
+		"--cached"
+	], {
+		cwd: root,
+		encoding: "utf8"
+	}).split("\0").filter((file) => file !== "");
+	const files = {};
+	const trackedFiles = new Set(tracked);
+	const resolvedRoot = (0, node_fs.realpathSync)(root);
+	for (const file of tracked) {
+		const kind = toolchainInputKind(file);
+		if (kind === void 0) continue;
+		if (kind === "presence") {
+			files[file] = "";
+			continue;
+		}
+		try {
+			const resolvedFile = (0, node_fs.realpathSync)(node_path.default.join(resolvedRoot, file));
+			const relative = node_path.default.relative(resolvedRoot, resolvedFile);
+			if (node_path.default.isAbsolute(relative) || relative.split(node_path.default.sep).at(0) === ".." || !trackedFiles.has(relative.split(node_path.default.sep).join("/"))) throw new Error("Configuration target is outside the tracked tree");
+			files[file] = (0, node_fs.readFileSync)(resolvedFile, "utf8");
+		} catch {
+			diagnostics.push({
+				rule: "configuration",
+				path: file,
+				line: 1,
+				message: "cannot read tracked configuration file"
+			});
+		}
+	}
+	return {
+		files,
+		trackedFiles,
+		diagnostics
+	};
+};
+const checkToolchain = ({ root, policy, onDelegated }) => {
+	const { files, trackedFiles, diagnostics } = readToolchainInputs(root);
+	let repository;
+	try {
+		const origin = (0, node_child_process.execFileSync)("git", [
+			"remote",
+			"get-url",
+			"origin"
+		], {
+			cwd: root,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+		repository = /^(?:https?:\/\/github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)([^/]+\/[^/]+?)(?:\.git)?\/?$/.exec(origin)?.[1];
+	} catch {}
+	let disabled = /* @__PURE__ */ new Set();
+	let cloud;
+	const engineFloors = [];
+	if (files["stll-toolchain.json"] !== void 0) try {
+		const configuration = parseToolchainConfiguration(JSON.parse(files["stll-toolchain.json"]));
+		disabled = configuration.disabled;
+		cloud = configuration.cloud;
+		for (const entry of configuration.engineFloors) engineFloors.push(resolveEngineFloor(entry, files));
+	} catch (error) {
+		diagnostics.push({
+			rule: "configuration",
+			path: "stll-toolchain.json",
+			line: 1,
+			message: error instanceof Error ? error.message : String(error)
+		});
+	}
+	const script = files[cloudSetupPath];
+	if (cloud === void 0 && trackedFiles.has(".agents/cloud-setup.sh")) diagnostics.push({
+		rule: "cloud-setup-drift",
+		path: cloudSetupPath,
+		line: 1,
+		message: "cloud setup script requires an explicit cloud declaration in stll-toolchain.json"
+	});
+	if (cloud !== void 0) try {
+		const nodeVersion = files[".node-version"];
+		if (nodeVersion === void 0) throw new Error("cloud setup requires a tracked root .node-version with an exact stable release");
+		if (script !== generateCloudSetup({
+			policy,
+			cloud,
+			nodeVersion: nodeVersion.trim()
+		})) diagnostics.push({
+			rule: "cloud-setup-drift",
+			path: cloudSetupPath,
+			line: 1,
+			message: "cloud setup script is missing or differs from shared policy; run stll-cloud-setup"
+		});
+	} catch (error) {
+		diagnostics.push({
+			rule: "cloud-setup-drift",
+			path: cloudSetupPath,
+			line: 1,
+			message: error instanceof Error ? error.message : String(error)
+		});
+	}
+	const exercisedFloors = /* @__PURE__ */ new Set();
+	const mismatchedFloors = /* @__PURE__ */ new Set();
+	diagnostics.push(...checkPackageFiles({
+		files,
+		policy
+	}));
+	for (const [file, text] of Object.entries(files)) diagnostics.push(...checkRuntimeFile({
+		file,
+		text,
+		policy: {
+			...policy,
+			packages: {
+				...policy.packages,
+				typescript: policy.typescript
+			}
+		},
+		trackedFiles,
+		repository,
+		onDelegated,
+		engineFloors: engineFloors.filter((entry) => entry.workflow === file),
+		onEngineFloor: (entry, status) => {
+			if (status === "mismatch") mismatchedFloors.add(entry);
+			else exercisedFloors.add(entry);
+		},
+		readFile: (target) => files[target]
+	}));
+	for (const entry of engineFloors) if (!exercisedFloors.has(entry) || mismatchedFloors.has(entry)) diagnostics.push({
+		rule: "configuration",
+		path: "stll-toolchain.json",
+		line: 1,
+		message: `engine floor ${entry.workflow}:${entry.job} requires a setup-node exact patch satisfying ${entry.package} engines.node minimum major ${entry.major}`
+	});
+	diagnostics.push(...checkDependabot({
+		files,
+		policy: policy.dependabot
+	}));
+	return diagnostics.filter((diagnostic) => !disabled.has(diagnostic.rule));
+};
+//#endregion
+Object.defineProperty(exports, "checkToolchain", {
+	enumerable: true,
+	get: function() {
+		return checkToolchain;
+	}
+});
+Object.defineProperty(exports, "cloudSetupPath", {
+	enumerable: true,
+	get: function() {
+		return cloudSetupPath;
+	}
+});
+Object.defineProperty(exports, "generateCloudSetup", {
+	enumerable: true,
+	get: function() {
+		return generateCloudSetup;
+	}
+});
+Object.defineProperty(exports, "parseToolchainConfiguration", {
+	enumerable: true,
+	get: function() {
+		return parseToolchainConfiguration;
+	}
+});
+Object.defineProperty(exports, "parseToolchainPolicy", {
+	enumerable: true,
+	get: function() {
+		return parseToolchainPolicy;
+	}
+});
+Object.defineProperty(exports, "readToolchainInputs", {
+	enumerable: true,
+	get: function() {
+		return readToolchainInputs;
+	}
+});
+
+//# sourceMappingURL=toolchain-guard.cjs.map