@stll/oxlint-config 0.11.0 → 0.12.0

package/dist/toolchain-check-cli.cjs

@@ -1,2291 +1,7 @@
 #!/usr/bin/env node
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-//#endregion
+const require_toolchain_guard = require("./toolchain-guard.cjs");
 let node_fs = require("node:fs");
-let node_child_process = require("node:child_process");
-let node_path = require("node:path");
-node_path = __toESM(node_path, 1);
-let picomatch = require("picomatch");
-picomatch = __toESM(picomatch, 1);
-let smol_toml = require("smol-toml");
-let yaml = require("yaml");
-let semver = require("semver");
-//#region src/toolchain-container-inputs.ts
-const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** Filename class recognized by Dependabot's Docker Compose fetcher. */
-const isComposeDefinitionPath = (file) => /^\.?(?:docker-)?compose(?:-[\w]+)?(?:\.[\w-]+)?\.ya?ml$/i.test(file.split("/").at(-1) ?? "");
-/** Candidate YAML files are classified by their document shape after reading. */
-const isKubernetesDefinitionPath = (file) => /^[^.].*\.ya?ml$/i.test(file.split("/").at(-1) ?? "");
-const kubernetesPodSpecPaths = {
-	Pod: ["spec"],
-	Deployment: [
-		"spec",
-		"template",
-		"spec"
-	],
-	DaemonSet: [
-		"spec",
-		"template",
-		"spec"
-	],
-	StatefulSet: [
-		"spec",
-		"template",
-		"spec"
-	],
-	ReplicaSet: [
-		"spec",
-		"template",
-		"spec"
-	],
-	ReplicationController: [
-		"spec",
-		"template",
-		"spec"
-	],
-	Job: [
-		"spec",
-		"template",
-		"spec"
-	],
-	CronJob: [
-		"spec",
-		"jobTemplate",
-		"spec",
-		"template",
-		"spec"
-	]
-};
-/** Shared semantic image enumeration for runtime checks and update-root generation. */
-const containerDocumentImages = (document, file) => {
-	if (!record$5(document)) return void 0;
-	const services = document["services"];
-	if (isComposeDefinitionPath(file) && record$5(services)) {
-		const images = [];
-		for (const [name, service] of Object.entries(services)) if (record$5(service) && service["image"] !== void 0) images.push({
-			image: service["image"],
-			path: [
-				"services",
-				name,
-				"image"
-			]
-		});
-		return {
-			ecosystem: "docker-compose",
-			images
-		};
-	}
-	if (typeof document["apiVersion"] !== "string" || typeof document["kind"] !== "string") return void 0;
-	const images = [];
-	const visited = /* @__PURE__ */ new Set();
-	const walkResource = (resource, prefix) => {
-		if (visited.has(resource)) return;
-		visited.add(resource);
-		if (typeof resource["apiVersion"] !== "string" || typeof resource["kind"] !== "string") return;
-		if (resource["kind"] === "List" && Array.isArray(resource["items"])) {
-			for (const [index, item] of resource["items"].entries()) if (record$5(item)) walkResource(item, [
-				...prefix,
-				"items",
-				index
-			]);
-			return;
-		}
-		const specPath = Object.entries(kubernetesPodSpecPaths).find(([kind]) => kind === resource["kind"])?.[1];
-		if (specPath === void 0) return;
-		let spec = resource;
-		for (const key of specPath) spec = record$5(spec) ? spec[key] : void 0;
-		if (!record$5(spec)) return;
-		for (const key of [
-			"containers",
-			"initContainers",
-			"ephemeralContainers"
-		]) {
-			const containers = spec[key];
-			if (!Array.isArray(containers)) continue;
-			for (const [index, container] of containers.entries()) if (record$5(container) && container["image"] !== void 0) images.push({
-				image: container["image"],
-				path: [
-					...prefix,
-					...specPath,
-					key,
-					index,
-					"image"
-				]
-			});
-		}
-	};
-	walkResource(document, []);
-	return images.length === 0 ? void 0 : {
-		ecosystem: "docker",
-		images
-	};
-};
-//#endregion
-//#region src/toolchain-images.ts
-/** Docker Hub spellings accepted by the shared runtime policy. */
-const dockerHubRegistries = [
-	"docker.io",
-	"index.docker.io",
-	"registry-1.docker.io"
-];
-/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */
-const ownedDockerImageAliases = (images) => {
-	const aliases = /* @__PURE__ */ new Set();
-	for (const image of images) for (const repository of [image, `library/${image}`]) {
-		aliases.add(repository);
-		for (const registry of dockerHubRegistries) aliases.add(`${registry}/${repository}`);
-	}
-	return [...aliases].sort();
-};
-/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */
-const canonicalDockerRuntime = (image) => {
-	const registry = dockerHubRegistries.find((entry) => image.toLowerCase().startsWith(`${entry}/`));
-	return (registry === void 0 ? image : image.slice(registry.length + 1)).replace(/^library\//i, "");
-};
-//#endregion
-//#region src/toolchain-inputs.ts
-const excludedInputPath = (file) => file === "" || file.split("/").some((part) => part === "node_modules" || part === "vendor");
-/** Match project, environment, local, and fragment filenames recognized by mise. */
-const isMiseConfigPath = (file) => !excludedInputPath(file) && (/(?:^|\/)\.?mise(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/config(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/conf\.d\/[^./][^/]*\.toml$/.test(file));
-/** GitHub action metadata may live at the repository root or in any directory. */
-const githubAutomationFileKind = (file) => {
-	if (file === "") return void 0;
-	if (/^\.github\/workflows\/[^/]+\.ya?ml$/.test(file)) return "workflow";
-	if (/(?:^|\/)action\.ya?ml$/.test(file)) return "action";
-};
-/** Dependabot updates workflows and repository-root action metadata. */
-const isDependabotGithubActionsPath = (file) => {
-	const kind = githubAutomationFileKind(file);
-	return kind === "workflow" || kind === "action" && !file.includes("/");
-};
-/** Use one filename discriminator for reader selection and Python ecosystem decisions. */
-const pythonDependencyManifestKind = (file) => {
-	if (excludedInputPath(file)) return void 0;
-	const name = file.split("/").at(-1);
-	if (name === "pyproject.toml") return "project";
-	if (name === "Pipfile") return "pipfile";
-	if (name === "Pipfile.lock") return "pipfile-lock";
-	if (name === "setup.py" || name === "setup.cfg") return "setup";
-	if (name !== void 0 && /^requirements[^/]*\.(?:txt|in)$/.test(name)) return "requirements";
-};
-const isPythonDependencyManifest = (file) => pythonDependencyManifestKind(file) !== void 0;
-/** Docker definition names use dot-delimited variants, excluding source and documentation. */
-const isDockerDefinitionPath = (file) => {
-	if (excludedInputPath(file)) return false;
-	const name = file.split("/").at(-1) ?? "";
-	if (/\.(?:[cm]?[jt]sx?|mdx?|rst|txt|html?|py|rs|go|java|sh|c|cc|cpp|cxx|h|hpp|cs|rb|php|swift|kt|css|scss)$/i.test(name)) return false;
-	return /^(?:[^./]+\.)*(?:dockerfile|containerfile)(?:\.[^./]+)*$/i.test(name);
-};
-/** Lockfiles establish ecosystem presence without reading their dependency graphs. */
-const toolchainInputKind = (file) => {
-	if (githubAutomationFileKind(file) !== void 0) return "config";
-	if (excludedInputPath(file)) return void 0;
-	if (pythonDependencyManifestKind(file) === "pipfile-lock" || /(?:^|\/)(?:bun\.lock|uv\.lock)$/.test(file)) return "presence";
-	if (githubAutomationFileKind(file) !== void 0 || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
-};
-//#endregion
-//#region src/toolchain-dependabot.ts
-const dependabotRules = ["dependabot-policy"];
-const record$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const strings = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
-const sameStrings = (value, expected) => {
-	if (!strings(value) || value.length !== expected.length) return false;
-	const sortedExpected = [...expected].sort();
-	return [...value].sort().every((entry, index) => entry === sortedExpected[index]);
-};
-const directoryOf = (file) => {
-	const directory = node_path.default.posix.dirname(file);
-	return directory === "." ? "/" : `/${directory}`;
-};
-const workspaceManifests = {
-	npm: "package.json",
-	cargo: "Cargo.toml",
-	uv: "pyproject.toml"
-};
-const workspaceTable = (parsed, ecosystem) => {
-	switch (ecosystem) {
-		case "npm": return parsed["workspaces"];
-		case "cargo": return parsed["workspace"];
-		case "uv": {
-			const tool = parsed["tool"];
-			const uv = record$4(tool) ? tool["uv"] : void 0;
-			return record$4(uv) ? uv["workspace"] : void 0;
-		}
-		default: throw new Error("unknown workspace ecosystem", { cause: ecosystem });
-	}
-};
-/** Workspace members share their update root; independent manifests keep their own. */
-const workspaceRoots = (files, ecosystem) => {
-	const manifests = Object.keys(files).filter((file) => node_path.default.posix.basename(file) === workspaceManifests[ecosystem] || ecosystem === "npm" && node_path.default.posix.basename(file) === "pnpm-workspace.yaml");
-	const workspaces = /* @__PURE__ */ new Map();
-	for (const file of manifests) {
-		if (ecosystem === "npm") {
-			const directory = node_path.default.posix.dirname(file);
-			const workspaceFile = node_path.default.posix.join(directory, "pnpm-workspace.yaml");
-			const text = files[workspaceFile];
-			if (text !== void 0) {
-				const document = (0, yaml.parseDocument)(text);
-				if (document.errors.length > 0) throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);
-				const parsed = document.toJS({ maxAliasCount: 100 });
-				if (!record$4(parsed)) throw new Error(`${workspaceFile}:1: pnpm workspace must contain an object`);
-				const patterns = parsed["packages"] ?? [];
-				if (!strings(patterns)) throw new Error(`${workspaceFile}:1: pnpm packages must be a string array`);
-				workspaces.set(directory, patterns.map((pattern) => pattern.startsWith("!") ? `!${node_path.default.posix.normalize(pattern.slice(1))}` : node_path.default.posix.normalize(pattern)));
-				continue;
-			}
-		}
-		try {
-			const parsed = ecosystem === "npm" ? JSON.parse(files[file] ?? "") : (0, smol_toml.parse)(files[file] ?? "");
-			if (!record$4(parsed)) continue;
-			if (ecosystem === "npm" && typeof parsed["packageManager"] === "string" && parsed["packageManager"].startsWith("pnpm@")) continue;
-			const value = workspaceTable(parsed, ecosystem);
-			const patterns = record$4(value) ? value[ecosystem === "npm" ? "packages" : "members"] : value;
-			const members = ecosystem === "cargo" && record$4(value) && patterns === void 0 ? [] : patterns;
-			if (strings(members)) {
-				const excluded = ecosystem !== "npm" && record$4(value) && strings(value["exclude"]) ? value["exclude"].map((pattern) => `!${pattern}`) : [];
-				workspaces.set(node_path.default.posix.dirname(file), [...members, ...excluded]);
-			}
-		} catch {}
-	}
-	const implicitCargoMembers = /* @__PURE__ */ new Map();
-	if (ecosystem === "cargo") for (const [root, patterns] of workspaces) {
-		const includes = patterns.filter((pattern) => !pattern.startsWith("!"));
-		const excludes = patterns.filter((pattern) => pattern.startsWith("!"));
-		const memberDirectories = /* @__PURE__ */ new Set([root]);
-		for (const file of manifests) {
-			const directory = node_path.default.posix.dirname(file);
-			const relative = node_path.default.posix.relative(root, directory);
-			if (includes.some((pattern) => picomatch.default.isMatch(relative, pattern)) && !excludes.some((pattern) => picomatch.default.isMatch(relative, pattern.slice(1)))) memberDirectories.add(directory);
-		}
-		for (const directory of memberDirectories) try {
-			const parsed = (0, smol_toml.parse)(files[node_path.default.posix.join(directory, "Cargo.toml")] ?? "");
-			const workspace = (0, smol_toml.parse)(files[node_path.default.posix.join(root, "Cargo.toml")] ?? "")["workspace"];
-			const inherited = record$4(workspace) ? workspace["dependencies"] : void 0;
-			const dependencyOwners = [parsed];
-			const targets = parsed["target"];
-			if (record$4(targets)) {
-				for (const target of Object.values(targets)) if (record$4(target)) dependencyOwners.push(target);
-			}
-			for (const owner of dependencyOwners) for (const key of [
-				"dependencies",
-				"dev-dependencies",
-				"build-dependencies"
-			]) {
-				const dependencies = owner[key];
-				if (!record$4(dependencies)) continue;
-				for (const [name, dependency] of Object.entries(dependencies)) {
-					if (!record$4(dependency)) continue;
-					const isInherited = dependency["workspace"] === true;
-					const resolved = isInherited && record$4(inherited) ? inherited[name] : dependency;
-					if (!record$4(resolved) || typeof resolved["path"] !== "string") continue;
-					if (node_path.default.posix.isAbsolute(resolved["path"]) || /\\|\$|^[A-Za-z]:/.test(resolved["path"])) continue;
-					const target = node_path.default.posix.normalize(node_path.default.posix.join(isInherited ? root : directory, resolved["path"]));
-					const relative = node_path.default.posix.relative(root, target);
-					if (relative.startsWith("../") || relative === ".." || files[node_path.default.posix.join(target, "Cargo.toml")] === void 0 || excludes.some((pattern) => picomatch.default.isMatch(relative, pattern.slice(1)))) continue;
-					memberDirectories.add(target);
-				}
-			}
-		} catch {}
-		implicitCargoMembers.set(root, memberDirectories);
-	}
-	return manifests.filter((file) => {
-		const directory = node_path.default.posix.dirname(file);
-		return ![...workspaces].some(([root, patterns]) => {
-			const relative = node_path.default.posix.relative(root, directory);
-			if (relative === "" || relative.startsWith("../")) return false;
-			const includes = patterns.filter((pattern) => !pattern.startsWith("!"));
-			const excludes = patterns.filter((pattern) => pattern.startsWith("!"));
-			return (implicitCargoMembers.get(root)?.has(directory) === true || includes.some((pattern) => picomatch.default.isMatch(relative, pattern))) && !excludes.some((pattern) => picomatch.default.isMatch(relative, pattern.slice(1)));
-		});
-	}).map(directoryOf).filter((directory, index, values) => values.indexOf(directory) === index);
-};
-const javascriptEcosystem = (directory, files) => {
-	const root = directory === "/" ? "." : directory.slice(1);
-	if (files[node_path.default.posix.join(root, "bun.lock")] !== void 0) return "bun";
-	try {
-		const manifest = JSON.parse(files[node_path.default.posix.join(root, "package.json")] ?? "{}");
-		if (record$4(manifest) && typeof manifest["packageManager"] === "string" && manifest["packageManager"].startsWith("bun@")) return "bun";
-	} catch {}
-	return "npm";
-};
-const pythonEcosystem = (file, files) => {
-	const manifestKind = pythonDependencyManifestKind(file);
-	if (manifestKind === "pipfile" || manifestKind === "pipfile-lock" || manifestKind === "setup") return "pip";
-	const root = node_path.default.posix.dirname(file);
-	if (files[node_path.default.posix.join(root, "uv.lock")] !== void 0 || files[node_path.default.posix.join(root, "uv.toml")] !== void 0) return "uv";
-	const pyproject = files[node_path.default.posix.join(root, "pyproject.toml")];
-	if (pyproject !== void 0) try {
-		const tool = (0, smol_toml.parse)(pyproject)["tool"];
-		if (record$4(tool) && record$4(tool["uv"])) return "uv";
-	} catch {}
-	return "pip";
-};
-const ecosystemRoots = (files) => {
-	const roots = /* @__PURE__ */ new Map();
-	const requireRoot = (ecosystem, directory) => {
-		const directories = roots.get(ecosystem) ?? /* @__PURE__ */ new Set();
-		directories.add(directory);
-		roots.set(ecosystem, directories);
-	};
-	for (const directory of workspaceRoots(files, "npm")) requireRoot(javascriptEcosystem(directory, files), directory);
-	for (const directory of workspaceRoots(files, "cargo")) requireRoot("cargo", directory);
-	for (const directory of workspaceRoots(files, "uv")) {
-		const root = directory === "/" ? "." : directory.slice(1);
-		requireRoot(pythonEcosystem(node_path.default.posix.join(root, "pyproject.toml"), files), directory);
-	}
-	for (const file of Object.keys(files)) {
-		if (isDependabotGithubActionsPath(file)) requireRoot("github-actions", "/");
-		const name = node_path.default.posix.basename(file);
-		if (isDockerDefinitionPath(file)) requireRoot("docker", directoryOf(file));
-		if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) for (const document of (0, yaml.parseAllDocuments)(files[file] ?? "", { merge: true })) {
-			if (document.errors.length > 0) continue;
-			try {
-				const classified = containerDocumentImages(document.toJS({ maxAliasCount: 100 }), file);
-				if (classified !== void 0) requireRoot(classified.ecosystem, directoryOf(file));
-			} catch {}
-		}
-		if (name === "uv.lock" || name === "uv.toml" || name !== "pyproject.toml" && isPythonDependencyManifest(file)) requireRoot(pythonEcosystem(file, files), directoryOf(file));
-	}
-	return roots;
-};
-const ignoredFor = (ecosystem, policy) => {
-	if (ecosystem === "npm" || ecosystem === "bun") return policy.ignoredPackages;
-	if (ecosystem === "github-actions") return policy.ignoredActions;
-	if (ecosystem === "docker" || ecosystem === "docker-compose") return ownedDockerImageAliases(policy.ignoredImages);
-	return [];
-};
-/** Validate the shared update policy against a hermetic tracked-file snapshot. */
-const checkDependabot = ({ files, policy }) => {
-	const roots = ecosystemRoots(files);
-	const paths = [".github/dependabot.yml", ".github/dependabot.yaml"].filter((file) => files[file] !== void 0);
-	if (roots.size === 0 && paths.length === 0) return [];
-	const file = paths.at(0) ?? ".github/dependabot.yml";
-	const diagnostics = [];
-	const add = (message, line = 1) => {
-		diagnostics.push({
-			rule: "dependabot-policy",
-			path: file,
-			line,
-			message
-		});
-	};
-	if (paths.length === 0) {
-		add("add a Dependabot configuration for the repository's package ecosystems");
-		return diagnostics;
-	}
-	if (paths.length > 1) add("keep one Dependabot configuration file");
-	const lineCounter = new yaml.LineCounter();
-	const document = (0, yaml.parseDocument)(files[file] ?? "", { lineCounter });
-	if (document.errors.length > 0) {
-		for (const error of document.errors) add(`invalid Dependabot YAML: ${error.message}`, lineCounter.linePos(error.pos[0]).line);
-		return diagnostics;
-	}
-	let parsed;
-	try {
-		parsed = document.toJS({ maxAliasCount: 100 });
-	} catch {
-		add("cannot resolve Dependabot YAML aliases");
-		return diagnostics;
-	}
-	if (!record$4(parsed) || parsed["version"] !== 2 || !Array.isArray(parsed["updates"])) {
-		add("Dependabot must declare version: 2 and an updates array");
-		return diagnostics;
-	}
-	const covered = /* @__PURE__ */ new Map();
-	let legacy;
-	try {
-		const legacyDocument = (0, yaml.parseDocument)(files[file] ?? "", {
-			version: "1.1",
-			schema: "yaml-1.1"
-		});
-		if (legacyDocument.errors.length === 0) legacy = legacyDocument.toJS({ maxAliasCount: 100 });
-	} catch {}
-	const legacyUpdates = record$4(legacy) && Array.isArray(legacy["updates"]) ? legacy["updates"] : [];
-	const rootClaims = /* @__PURE__ */ new Map();
-	const directoryClaims = /* @__PURE__ */ new Map();
-	for (const [index, update] of parsed["updates"].entries()) {
-		const lineOf = (key) => {
-			const node = document.getIn([
-				"updates",
-				index,
-				key
-			], true);
-			const offset = (0, yaml.isNode)(node) ? node.range?.[0] : void 0;
-			return offset === void 0 ? 1 : lineCounter.linePos(offset).line;
-		};
-		const report = (key, message) => add(message, lineOf(key));
-		if (!record$4(update) || typeof update["package-ecosystem"] !== "string") {
-			report("package-ecosystem", "each Dependabot update must declare a package ecosystem");
-			continue;
-		}
-		const ecosystem = update["package-ecosystem"];
-		if (update["target-branch"] !== void 0) report("target-branch", `${ecosystem}: shared updates must target the default branch`);
-		if (update["open-pull-requests-limit"] === 0) report("open-pull-requests-limit", `${ecosystem}: version updates must remain enabled`);
-		const single = update["directory"];
-		const multiple = update["directories"];
-		let directories = [];
-		if (typeof single === "string" && multiple === void 0) directories = [single];
-		else if (single === void 0 && strings(multiple)) directories = multiple;
-		const validDirectories = directories.filter((directory) => directory.startsWith("/") && !directory.split("/").includes(".."));
-		if (directories.length === 0 || validDirectories.length !== directories.length) report("directory", `${ecosystem}: declare directory or nonempty directories with absolute repository paths`);
-		const normalizedDirectories = Array.from(new Set(validDirectories.map((value) => node_path.default.posix.normalize(value).replace(/\/+$/, "") || "/")));
-		const matches = covered.get(ecosystem) ?? /* @__PURE__ */ new Set();
-		const claimedDirectories = directoryClaims.get(ecosystem) ?? /* @__PURE__ */ new Map();
-		for (const directory of normalizedDirectories) {
-			const previous = claimedDirectories.get(directory);
-			if (previous !== void 0) report(multiple === void 0 ? "directory" : "directories", `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`);
-			else claimedDirectories.set(directory, index);
-		}
-		directoryClaims.set(ecosystem, claimedDirectories);
-		const claimedRoots = rootClaims.get(ecosystem) ?? /* @__PURE__ */ new Map();
-		for (const root of roots.get(ecosystem) ?? []) if (normalizedDirectories.some((directory) => directory === root || multiple !== void 0 && picomatch.default.isMatch(root, directory))) {
-			const previous = claimedRoots.get(root);
-			if (previous !== void 0) report(multiple === void 0 ? "directory" : "directories", `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`);
-			else claimedRoots.set(root, index);
-			matches.add(root);
-		}
-		rootClaims.set(ecosystem, claimedRoots);
-		covered.set(ecosystem, matches);
-		const schedule = update["schedule"];
-		const legacyUpdate = legacyUpdates.at(index);
-		const legacySchedule = record$4(legacyUpdate) ? legacyUpdate["schedule"] : void 0;
-		if (record$4(schedule) && schedule["time"] === policy.schedule.time && (!record$4(legacySchedule) || legacySchedule["time"] !== policy.schedule.time)) report("schedule", `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`);
-		if (!record$4(schedule) || Object.keys(schedule).length !== Object.keys(policy.schedule).length || Object.entries(policy.schedule).some(([key, value]) => schedule[key] !== value)) report("schedule", `${ecosystem}: schedule must match the shared policy`);
-		const cooldown = update["cooldown"];
-		if (!record$4(cooldown) || Object.keys(cooldown).length !== 1 || cooldown["default-days"] !== policy.cooldown.defaultDays) report("cooldown", `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`);
-		const groups = update["groups"];
-		if (!record$4(groups) || Object.keys(groups).length !== Object.keys(policy.groups).length || Object.entries(policy.groups).some(([name, expected]) => {
-			const group = groups[name];
-			return !record$4(group) || Object.keys(group).length !== 2 || !sameStrings(group["patterns"], expected.patterns) || !sameStrings(group["update-types"], expected.updateTypes);
-		})) report("groups", `${ecosystem}: groups must match the shared policy`);
-		const ignored = ignoredFor(ecosystem, policy);
-		const ignore = update["ignore"];
-		if (ignore !== void 0 && (!Array.isArray(ignore) || ignore.length === 0)) report("ignore", `${ecosystem}: omit ignore or provide a nonempty array`);
-		if (Array.isArray(ignore) && ignore.some((entry) => !record$4(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
-		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$4(entry) && entry["dependency-name"] === name && Object.keys(entry).length === 1)) report("ignore", `${ecosystem}: ignore all updates for shared pin ${name}`);
-	}
-	for (const [ecosystem, directories] of roots) for (const directory of directories) if (!covered.get(ecosystem)?.has(directory)) add(`add a ${ecosystem} update entry covering ${directory}`);
-	return diagnostics;
-};
-//#endregion
-//#region src/toolchain-node.ts
-const numericComponent = "(?:0|[1-9]\\d*)";
-const policyPattern = new RegExp(`^${numericComponent}\\.x$`);
-const selectorPattern = new RegExp(`^(${numericComponent})(?:\\.(?:x|${numericComponent}(?:\\.${numericComponent})?))?$`);
-/** A Node policy selects the complete stable release series of one major. */
-const nodePolicyValid = (value) => policyPattern.test(value) && (0, semver.validRange)(value) !== null;
-/** Static selectors may narrow that series, but cannot float across majors. */
-const nodeSelectorMatches = (value, policy) => {
-	if (!nodePolicyValid(policy) || typeof value !== "string") return false;
-	const major = selectorPattern.exec(value)?.[1];
-	return major !== void 0 && major === policy.slice(0, -2) && (0, semver.validRange)(value) !== null;
-};
-/** Engines must support every stable release in the approved major series. */
-const nodeSupportRangeMatches = (policy, range) => {
-	if (!nodePolicyValid(policy)) return false;
-	try {
-		return (0, semver.subset)(policy, range);
-	} catch {
-		return false;
-	}
-};
-//#endregion
-//#region src/toolchain-packages.ts
-const packageRules = [
-	"bun-pins",
-	"package-pins",
-	"typescript-layout",
-	"node-engine"
-];
-const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const shellSubstitutions = (command) => {
-	const frames = [{
-		kind: "root",
-		start: 0,
-		depth: 0,
-		quote: void 0
-	}];
-	const bodies = [];
-	for (let index = 0; index < command.length; index += 1) {
-		const frame = frames.at(-1);
-		if (frame === void 0) break;
-		const character = command.at(index);
-		if (character === "\\" && frame.quote !== "'") {
-			index += 1;
-			continue;
-		}
-		if (character === "`" && frame.kind === "backticks") {
-			bodies.push(command.slice(frame.start, index));
-			frames.pop();
-			continue;
-		}
-		if (character === frame.quote) {
-			frame.quote = void 0;
-			continue;
-		}
-		if (frame.quote === "'") continue;
-		if (character === "$" && command.at(index + 1) === "(") {
-			frames.push({
-				kind: "parentheses",
-				start: index + 2,
-				depth: 1,
-				quote: void 0
-			});
-			index += 1;
-			continue;
-		}
-		if (character === "`") {
-			frames.push({
-				kind: "backticks",
-				start: index + 1,
-				depth: 0,
-				quote: void 0
-			});
-			continue;
-		}
-		if (frame.quote !== void 0) continue;
-		if (character === "'" || character === "\"") {
-			frame.quote = character;
-			continue;
-		}
-		if (frame.kind !== "parentheses") continue;
-		if (character === "(") frame.depth += 1;
-		if (character === ")" && --frame.depth === 0) {
-			bodies.push(command.slice(frame.start, index));
-			frames.pop();
-		}
-	}
-	for (const frame of frames.slice(1)) bodies.push(command.slice(frame.start));
-	return bodies;
-};
-const compilerCommandSegments = (command) => {
-	const segments = [[]];
-	for (const source of [command, ...shellSubstitutions(command)]) {
-		segments.push([]);
-		const shellWords = source.match(/(?:[^\s"'\\;&|()]|\\[^\n]|"(?:[^"\\]|\\.)*"|'[^']*')+|&&|\|\||[();&|\n]/g);
-		for (const word of shellWords ?? []) if (/^(?:&&|\|\||[;&|\n])$/.test(word)) segments.push([]);
-		else segments.at(-1)?.push(word);
-	}
-	return segments.map((words) => {
-		let start = 0;
-		const skipAssignments = () => {
-			while (/^[A-Za-z_][A-Za-z\d_]*=/.test(words.at(start) ?? "")) start += 1;
-		};
-		skipAssignments();
-		while (/^(?:\/usr\/bin\/|\/bin\/)?env$/.test(words.at(start) ?? "")) {
-			start += 1;
-			while (start < words.length) {
-				const option = words.at(start);
-				if (option === "--") {
-					start += 1;
-					break;
-				}
-				if (option === "-u" || option === "--unset") {
-					start += 2;
-					continue;
-				}
-				if (option === "-" || option === "-i" || option === "--ignore-environment" || /^--unset=.+|^-u.+/.test(option ?? "")) {
-					start += 1;
-					continue;
-				}
-				break;
-			}
-			skipAssignments();
-		}
-		return words.slice(start);
-	});
-};
-const launcherValueOptions = new Map(Object.entries({
-	npx: [
-		"-p",
-		"--package",
-		"-c",
-		"--call",
-		"--cache",
-		"--registry",
-		"--userconfig"
-	],
-	bunx: ["-p", "--package"],
-	pnpm: [
-		"--filter",
-		"-F",
-		"--dir",
-		"-C",
-		"--package"
-	],
-	yarn: [
-		"--cwd",
-		"--cache-folder",
-		"--mutex",
-		"--use-yarnrc",
-		"--modules-folder",
-		"--registry"
-	],
-	bun: [
-		"--cwd",
-		"--filter",
-		"-F",
-		"--config",
-		"-c",
-		"--env-file",
-		"-e",
-		"--eval",
-		"-p",
-		"--print"
-	],
-	node: [
-		"-e",
-		"--eval",
-		"-p",
-		"--print",
-		"--conditions",
-		"-C",
-		"--inspect-port",
-		"--max-old-space-size",
-		"--stack-size",
-		"--title",
-		"--icu-data-dir",
-		"--openssl-config",
-		"--input-type"
-	]
-}).map(([launcher, options]) => [launcher, new Set(options)]));
-const invokesCompiler = (words) => {
-	const literal = (word) => {
-		let result = "";
-		let quote;
-		for (let index = 0; index < word.length; index += 1) {
-			const character = word.at(index);
-			if (character === quote) {
-				quote = void 0;
-				continue;
-			}
-			if (quote === void 0 && (character === "'" || character === "\"")) {
-				quote = character;
-				continue;
-			}
-			const next = word.at(index + 1);
-			if (character === "\\" && next !== void 0 && quote !== "'" && (quote === void 0 || /[$`"\\\n]/.test(next))) {
-				result += next;
-				index += 1;
-			} else result += character;
-		}
-		return result;
-	};
-	const tokens = words.map(literal);
-	const compiler = (word) => /(?:^|\/)(?:tsc|tsgo)(?:\.js)?$/.test(word);
-	let start = 0;
-	const skipOptions = (index, launcher) => {
-		while (tokens.at(index)?.startsWith("-")) {
-			const option = tokens.at(index);
-			index += 1;
-			if (option === "--") break;
-			if (option !== void 0 && launcherValueOptions.get(launcher)?.has(option)) index += 1;
-		}
-		return index;
-	};
-	while (start < tokens.length) {
-		const launcher = tokens.at(start);
-		if (launcher === void 0 || !launcherValueOptions.has(launcher)) break;
-		start = skipOptions(start + 1, launcher);
-		if (launcher === "bun" && tokens.at(start) === "check") return true;
-		const subcommand = tokens.at(start);
-		if (launcher === "bun" && (subcommand === "x" || subcommand === "run") || launcher === "pnpm" && (subcommand === "exec" || subcommand === "dlx") || launcher === "yarn" && (subcommand === "exec" || subcommand === "dlx" || subcommand === "run")) start = skipOptions(start + 1, launcher);
-	}
-	return tokens.slice(start).some((word, index) => compiler(word) || word === "bun" && tokens.at(skipOptions(start + index + 1, "bun")) === "check");
-};
-/** Validate manifests and catalog resolutions from a tracked-file snapshot. */
-const checkPackageFiles = ({ files, policy }) => {
-	const sources = new Map(Object.entries(files));
-	const diagnostics = [];
-	const pins = new Map(Object.entries({
-		...policy.packages,
-		"bun-types": policy.bun
-	}));
-	const manifests = /* @__PURE__ */ new Map();
-	const yamlLocations = /* @__PURE__ */ new Map();
-	const reportedLines = /* @__PURE__ */ new Map();
-	const add = ({ file, rule, key, value, message }) => {
-		const source = sources.get(file);
-		if (source === void 0) throw new Error(`Missing package diagnostic source: ${file}`);
-		const serialized = value === void 0 ? void 0 : JSON.stringify(value);
-		const locationKey = `${file}:${key}:${serialized ?? ""}`;
-		const previous = reportedLines.get(locationKey) ?? -1;
-		const yamlLine = yamlLocations.get(locationKey)?.shift();
-		const index = source.split(/\r?\n/).findIndex((line, lineIndex) => lineIndex > previous && line.includes(JSON.stringify(key)) && (serialized === void 0 || line.includes(serialized)));
-		if (index >= 0) reportedLines.set(locationKey, index);
-		diagnostics.push({
-			rule,
-			path: file,
-			line: yamlLine ?? Math.max(1, index + 1),
-			message
-		});
-	};
-	for (const [file, text] of sources) {
-		const pnpm = node_path.default.posix.basename(file) === "pnpm-workspace.yaml";
-		if (!pnpm && node_path.default.posix.basename(file) !== "package.json") continue;
-		try {
-			const lineCounter = new yaml.LineCounter();
-			const document = pnpm ? (0, yaml.parseDocument)(text, { lineCounter }) : void 0;
-			if (document !== void 0 && document.errors.length > 0) throw new Error("invalid YAML");
-			const json = document === void 0 ? JSON.parse(text) : document.toJS();
-			if (!record$3(json)) throw new Error("manifest must be an object");
-			if (pnpm) {
-				if (json["catalog"] !== void 0 && !record$3(json["catalog"])) throw new Error("catalog must be a mapping");
-				if (json["catalogs"] !== void 0 && (!record$3(json["catalogs"]) || Object.values(json["catalogs"]).some((catalog) => !record$3(catalog)))) throw new Error("named catalogs must be mappings");
-				if (json["packages"] !== void 0 && (!Array.isArray(json["packages"]) || !json["packages"].every((pattern) => typeof pattern === "string"))) throw new Error("workspace packages must be patterns");
-			}
-			manifests.set(file, json);
-			if (document === void 0) continue;
-			const catalogEntries = [
-				{
-					catalog: json["catalog"],
-					prefix: ["catalog"]
-				},
-				{
-					catalog: json["overrides"],
-					prefix: ["overrides"]
-				},
-				...record$3(json["catalogs"]) ? Object.entries(json["catalogs"]).map(([name, catalog]) => ({
-					catalog,
-					prefix: ["catalogs", name]
-				})) : []
-			];
-			for (const { catalog, prefix } of catalogEntries) {
-				if (!record$3(catalog)) continue;
-				for (const [name, value] of Object.entries(catalog)) {
-					const node = document.getIn([...prefix, name], true);
-					if (!(0, yaml.isNode)(node) || node.range === void 0 || node.range === null) continue;
-					const key = `${file}:${name}:${JSON.stringify(value)}`;
-					const lines = yamlLocations.get(key) ?? [];
-					lines.push(lineCounter.linePos(node.range[0]).line);
-					yamlLocations.set(key, lines);
-				}
-			}
-		} catch {
-			add({
-				file,
-				rule: "package-pins",
-				key: "",
-				message: pnpm ? "invalid pnpm-workspace.yaml object" : "invalid package.json object"
-			});
-		}
-	}
-	const catalogSources = (json) => [json, ...record$3(json["workspaces"]) ? [json["workspaces"]] : []];
-	const pnpmWorkspaceFor = (file) => {
-		let directory = node_path.default.posix.dirname(file);
-		while (true) {
-			const workspace = manifests.get(node_path.default.posix.join(directory, "pnpm-workspace.yaml"));
-			if (workspace !== void 0) return {
-				directory,
-				workspace
-			};
-			if (directory === ".") return void 0;
-			directory = node_path.default.posix.dirname(directory);
-		}
-	};
-	const catalogFor = (file, name) => {
-		const owner = pnpmWorkspaceFor(file);
-		if (owner !== void 0) {
-			const { directory, workspace } = owner;
-			if (node_path.default.posix.basename(file) === "package.json" && !workspaceContains({
-				directory,
-				file,
-				patterns: workspace["packages"],
-				rootMembership: "implicit"
-			})) return void 0;
-			if (name === "" || name === "default") return workspace["catalog"] ?? (record$3(workspace["catalogs"]) ? workspace["catalogs"]["default"] : void 0);
-			return record$3(workspace["catalogs"]) ? workspace["catalogs"][name] : void 0;
-		}
-		let directory = node_path.default.posix.dirname(file);
-		while (true) {
-			const manifest = manifests.get(node_path.default.posix.join(directory, "package.json"));
-			if (manifest !== void 0) {
-				for (const source of catalogSources(manifest)) {
-					if (name === "" && source["catalog"] !== void 0) return source["catalog"];
-					if (record$3(source["catalogs"]) && source["catalogs"][name] !== void 0) return source["catalogs"][name];
-				}
-				if (manifest["workspaces"] !== void 0) return void 0;
-			}
-			if (directory === ".") return void 0;
-			directory = node_path.default.posix.dirname(directory);
-		}
-	};
-	const workspaceContains = ({ directory, file, patterns, rootMembership }) => {
-		const relative = node_path.default.posix.relative(directory, node_path.default.posix.dirname(file));
-		if (relative === "" && rootMembership === "implicit") return true;
-		if (relative === ".." || relative.startsWith("../")) return false;
-		if (!Array.isArray(patterns)) return false;
-		const normalize = (pattern) => node_path.default.posix.normalize(pattern);
-		const selected = patterns.filter((value) => typeof value === "string");
-		return (0, picomatch.default)(selected.filter((pattern) => !pattern.startsWith("!")).map(normalize))(relative) && !(0, picomatch.default)(selected.filter((pattern) => pattern.startsWith("!")).map((pattern) => normalize(pattern.slice(1))))(relative);
-	};
-	const resolve = (file, name, value) => {
-		const visited = /* @__PURE__ */ new Set();
-		while (typeof value === "string" && value.startsWith("catalog:")) {
-			if (visited.has(value)) return void 0;
-			visited.add(value);
-			const catalog = catalogFor(file, value.slice(8));
-			value = record$3(catalog) ? catalog[name] : void 0;
-		}
-		return value;
-	};
-	const workspaceOwnerFor = (file) => {
-		const pnpm = pnpmWorkspaceFor(file);
-		if (pnpm !== void 0) return {
-			directory: pnpm.directory,
-			patterns: pnpm.workspace["packages"],
-			source: "pnpm"
-		};
-		let directory = node_path.default.posix.dirname(file);
-		while (true) {
-			const workspaces = manifests.get(node_path.default.posix.join(directory, "package.json"))?.["workspaces"];
-			if (workspaces !== void 0) return {
-				directory,
-				patterns: record$3(workspaces) ? workspaces["packages"] : workspaces,
-				source: "json"
-			};
-			if (directory === ".") return void 0;
-			directory = node_path.default.posix.dirname(directory);
-		}
-	};
-	const workspaceResolution = ({ file, name, pin }) => {
-		const owner = workspaceOwnerFor(file);
-		if (owner === void 0) return "nonmember";
-		const { directory, patterns, source } = owner;
-		if (source === "json" && !Array.isArray(patterns)) return "mismatch";
-		if (!workspaceContains({
-			directory,
-			file,
-			patterns,
-			rootMembership: "implicit"
-		})) return "nonmember";
-		const candidates = [...manifests.entries()].filter(([candidate, json]) => node_path.default.posix.basename(candidate) === "package.json" && json["name"] === name && workspaceContains({
-			directory,
-			file: candidate,
-			patterns,
-			rootMembership: source === "json" ? "patterns" : "implicit"
-		}));
-		return candidates.length === 1 && candidates.every(([, json]) => json["version"] === pin) ? "matched" : "mismatch";
-	};
-	const tsSpecifiers = /* @__PURE__ */ new Map();
-	for (const layout of policy.typescriptInstallLayouts) {
-		const values = tsSpecifiers.get(layout.compilerPackage) ?? /* @__PURE__ */ new Set();
-		values.add(layout.compilerSpecifier);
-		tsSpecifiers.set(layout.compilerPackage, values);
-		if (layout.type !== "split-compatibility") continue;
-		const compatibility = tsSpecifiers.get(layout.compatibilityPackage) ?? /* @__PURE__ */ new Set();
-		compatibility.add(layout.compatibilitySpecifier);
-		tsSpecifiers.set(layout.compatibilityPackage, compatibility);
-	}
-	tsSpecifiers.set(policy.typescript6Compatibility.packageAlias, /* @__PURE__ */ new Set([`npm:typescript@${policy.typescript6Compatibility.version}`]));
-	for (const [file, json] of manifests) {
-		const manager = json["packageManager"];
-		if (manager !== void 0 && manager !== `bun@${policy.bun}`) add({
-			file,
-			rule: "bun-pins",
-			key: "packageManager",
-			value: manager,
-			message: `packageManager Bun version must be ${policy.bun}, found ${JSON.stringify(manager)}`
-		});
-		const dependencies = {};
-		const checkEntries = (entries, installed, location) => {
-			if (!record$3(entries)) return;
-			for (const [name, raw] of Object.entries(entries)) {
-				const value = resolve(file, name, raw);
-				if (installed) dependencies[name] = value;
-				const tsAllowed = tsSpecifiers.get(name);
-				if (tsAllowed !== void 0) {
-					if (typeof value !== "string" || !tsAllowed.has(value)) add({
-						file,
-						rule: "typescript-layout",
-						key: location?.key ?? name,
-						value: location === void 0 ? raw : location.value,
-						message: `${name} must use a declared TypeScript specifier, found ${String(value)}`
-					});
-					continue;
-				}
-				const pin = pins.get(name);
-				if (pin === void 0) continue;
-				if (value === pin) continue;
-				const workspace = value === "workspace:*" ? workspaceResolution({
-					file,
-					name,
-					pin
-				}) : void 0;
-				if (workspace === "matched") continue;
-				add({
-					file,
-					rule: name === "bun-types" ? "bun-pins" : "package-pins",
-					key: location?.key ?? name,
-					value: location === void 0 ? raw : location.value,
-					message: workspace === "nonmember" ? `${name} workspace:* consumer is not a member of its nearest workspace` : `${name} must be ${pin}, found ${String(value)}`
-				});
-			}
-		};
-		for (const key of [
-			"dependencies",
-			"devDependencies",
-			"optionalDependencies"
-		]) checkEntries(json[key], true);
-		for (const source of catalogSources(json)) {
-			checkEntries(source["catalog"], false);
-			if (!record$3(source["catalogs"])) continue;
-			for (const catalog of Object.values(source["catalogs"])) checkEntries(catalog, false);
-		}
-		const ownedNames = /* @__PURE__ */ new Set([...pins.keys(), ...tsSpecifiers.keys()]);
-		const resolutionDependencies = {};
-		const resolutionRoot = manifests.get(node_path.default.posix.join(node_path.default.posix.dirname(file), "package.json"));
-		if (resolutionRoot !== void 0) for (const section of [
-			"dependencies",
-			"devDependencies",
-			"optionalDependencies"
-		]) {
-			const entries = resolutionRoot[section];
-			if (!record$3(entries)) continue;
-			for (const [name, value] of Object.entries(entries)) resolutionDependencies[name] = resolve(file, name, value);
-		}
-		const affectedSpecifiers = /* @__PURE__ */ new Map();
-		const owner = workspaceOwnerFor(file);
-		for (const [candidate, member] of manifests) {
-			if (node_path.default.posix.basename(candidate) !== "package.json") continue;
-			const memberOwner = workspaceOwnerFor(candidate);
-			if (!(candidate === node_path.default.posix.join(node_path.default.posix.dirname(file), "package.json")) && !(owner !== void 0 && owner.directory === node_path.default.posix.dirname(file) && memberOwner?.directory === owner.directory && memberOwner.source === owner.source && workspaceContains({
-				directory: owner.directory,
-				file: candidate,
-				patterns: owner.patterns,
-				rootMembership: "implicit"
-			}))) continue;
-			for (const section of [
-				"dependencies",
-				"devDependencies",
-				"optionalDependencies"
-			]) {
-				const entries = member[section];
-				if (!record$3(entries)) continue;
-				for (const [name, value] of Object.entries(entries)) {
-					if (!tsSpecifiers.has(name)) continue;
-					const values = affectedSpecifiers.get(name) ?? /* @__PURE__ */ new Set();
-					values.add(resolve(candidate, name, value));
-					affectedSpecifiers.set(name, values);
-				}
-			}
-		}
-		const checkResolutionMap = (entries, parent) => {
-			if (!record$3(entries)) return;
-			for (const [selector, replacement] of Object.entries(entries)) {
-				const target = selector === "." ? parent : selector;
-				if (target === void 0) continue;
-				let pattern = target.split(/>\s*(?=[@A-Za-z_*]|$)/).at(-1)?.trim() ?? "";
-				const version = pattern.lastIndexOf("@");
-				let qualifier;
-				if (version > pattern.lastIndexOf("/")) {
-					qualifier = pattern.slice(version + 1).replace(/^npm:/, "");
-					pattern = pattern.slice(0, version);
-				}
-				const parts = pattern.split("/");
-				pattern = parts.at(-2)?.startsWith("@") ? parts.slice(-2).join("/") : parts.at(-1) ?? "";
-				if (pattern === "") {
-					add({
-						file,
-						rule: "package-pins",
-						key: selector,
-						value: replacement,
-						message: "resolution selector must name a package"
-					});
-					continue;
-				}
-				if (record$3(replacement)) {
-					checkResolutionMap(replacement, target);
-					continue;
-				}
-				for (const name of ownedNames) {
-					if (!(0, picomatch.default)(pattern)(name)) continue;
-					let value = replacement;
-					if (typeof replacement === "string" && replacement.startsWith("$")) {
-						const reference = replacement.slice(1);
-						value = resolutionDependencies[reference];
-					}
-					const resolved = resolve(file, name, value);
-					checkEntries({ [name]: value }, false, {
-						key: selector,
-						value: replacement
-					});
-					if (tsSpecifiers.has(name) && [...affectedSpecifiers.get(name) ?? []].some((specifier) => {
-						if (resolved === specifier) return false;
-						if (qualifier === void 0 || (0, semver.validRange)(qualifier) === null) return true;
-						if (typeof specifier !== "string") return false;
-						const release = (0, semver.valid)(specifier.startsWith("npm:") ? specifier.slice(specifier.lastIndexOf("@") + 1) : specifier);
-						return release !== null && (0, semver.satisfies)(release, qualifier);
-					}) && typeof resolved === "string" && tsSpecifiers.get(name)?.has(resolved)) add({
-						file,
-						rule: "typescript-layout",
-						key: selector,
-						value: replacement,
-						message: `${name} resolution must preserve its declared TypeScript install specifier`
-					});
-				}
-			}
-		};
-		checkResolutionMap(json["overrides"]);
-		checkResolutionMap(json["resolutions"]);
-		if (record$3(json["pnpm"])) checkResolutionMap(json["pnpm"]["overrides"]);
-		if (policy.typescriptInstallLayouts.some((layout) => dependencies[layout.compilerPackage] !== void 0)) {
-			const selectedLayout = policy.typescriptInstallLayouts.find((layout) => {
-				if (dependencies[layout.compilerPackage] !== layout.compilerSpecifier) return false;
-				if (layout.type === "split-compatibility") return dependencies[layout.compatibilityPackage] === layout.compatibilitySpecifier;
-				return policy.typescriptInstallLayouts.every((other) => other.compilerPackage === layout.compilerPackage || dependencies[other.compilerPackage] === void 0);
-			});
-			if (selectedLayout === void 0) add({
-				file,
-				rule: "typescript-layout",
-				key: "dependencies",
-				message: "TypeScript compiler and compatibility packages must match one complete declared install layout"
-			});
-			const command = record$3(json["scripts"]) ? json["scripts"]["typecheck"] : void 0;
-			if (selectedLayout !== void 0 && typeof command === "string") {
-				const normalizedExpected = selectedLayout.typecheckCommand.replace(/\s+/g, " ").trim();
-				for (const words of compilerCommandSegments(command)) {
-					if (!invokesCompiler(words)) continue;
-					const normalized = words.join(" ");
-					if (!words.some((word) => word === "(" || word === ")") && shellSubstitutions(normalized).length === 0 && (normalized === normalizedExpected || normalized.startsWith(`${normalizedExpected} `))) continue;
-					add({
-						file,
-						rule: "typescript-layout",
-						key: "typecheck",
-						value: command,
-						message: `typecheck compiler invocation must use ${selectedLayout.typecheckCommand}`
-					});
-					break;
-				}
-			}
-		}
-		if (record$3(json["engines"]) && json["engines"]["node"] !== void 0 && (typeof json["engines"]["node"] !== "string" || !nodeSupportRangeMatches(policy.node, json["engines"]["node"]))) add({
-			file,
-			rule: "node-engine",
-			key: "node",
-			value: json["engines"]["node"],
-			message: `engines.node must support ${policy.node}, found ${JSON.stringify(json["engines"]["node"])}`
-		});
-	}
-	return diagnostics;
-};
-//#endregion
-//#region src/toolchain-runtime.ts
-const runtimeRules = [
-	"bun-pins",
-	"node-version",
-	"python-version",
-	"rust-version",
-	"runtime-manager",
-	"runtime-docker",
-	"runtime-workflow",
-	"action-pins"
-];
-const record$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const pythonSelectorMatches = (value, expected) => value === expected || typeof value === "string" && /^\d+\.\d+$/.test(expected) && value.startsWith(`${expected}.`) && /^\d+\.\d+\.\d+$/.test(value);
-const compareRelease = (left, right) => {
-	for (let index = 0; index < Math.max(left.length, right.length); index++) {
-		const difference = (left.at(index) ?? 0) - (right.at(index) ?? 0);
-		if (difference !== 0) return Math.sign(difference);
-	}
-	return 0;
-};
-const pythonSeriesRequirementMatches = ({ current, operator, target, wildcard }) => {
-	const prefixCovers = (prefix) => prefix.length <= 2 && prefix.every((part, index) => current.at(index) === part);
-	const prefixOverlaps = target.slice(0, 2).every((part, index) => current.at(index) === part) && target.slice(3).every((part) => part === 0);
-	if (wildcard) {
-		if (operator === "==") return prefixCovers(target);
-		if (operator === "!=") return !prefixOverlaps;
-		return false;
-	}
-	const minimumComparison = compareRelease(current, target);
-	const seriesComparison = compareRelease(current.slice(0, 2), target.slice(0, 2));
-	switch (operator) {
-		case "==": return false;
-		case "!=": return !(seriesComparison === 0 && target.slice(3).every((part) => part === 0));
-		case ">=": return minimumComparison >= 0;
-		case ">": return minimumComparison > 0;
-		case "<=":
-		case "<": return seriesComparison < 0;
-		case "~=": return target.length >= 2 && minimumComparison >= 0 && prefixCovers(target.slice(0, -1));
-		default: return false;
-	}
-};
-/** Evaluate final-release Python constraints against the complete selected version set. */
-const pythonRequirementMatches = (requirement, version) => {
-	if (typeof requirement !== "string" || requirement.trim() === "") return false;
-	const current = version.split(".").map(Number);
-	return requirement.split(",").every((clause) => {
-		const match = /^(~=|==|!=|<=|>=|<|>)\s*(\d+(?:\.\d+)*)(\.\*)?$/.exec(clause.trim());
-		if (match === null) return false;
-		const operator = match[1];
-		const release = match[2];
-		if (release === void 0 || operator === void 0) return false;
-		const target = release.split(".").map(Number);
-		if (current.length === 2) return pythonSeriesRequirementMatches({
-			current,
-			operator,
-			target,
-			wildcard: match[3] !== void 0
-		});
-		const comparison = compareRelease(current, target);
-		if (match[3] !== void 0) {
-			if (operator !== "==" && operator !== "!=") return false;
-			const prefix = target.every((part, index) => (current.at(index) ?? 0) === part);
-			return operator === "==" ? prefix : !prefix;
-		}
-		switch (operator) {
-			case "==": return comparison === 0;
-			case "!=": return comparison !== 0;
-			case "<=": return comparison <= 0;
-			case ">=": return comparison >= 0;
-			case "<": return comparison < 0;
-			case ">": return comparison > 0;
-			case "~=": {
-				if (target.length < 2) return false;
-				const prefix = target.slice(0, -1);
-				return comparison >= 0 && prefix.every((part, index) => (current.at(index) ?? 0) === part);
-			}
-			default: return false;
-		}
-	});
-};
-/** Check runtime declarations only in the files that declare or configure them. */
-const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, repository, onDelegated }) => {
-	const diagnostics = [];
-	const name = node_path.default.posix.basename(file);
-	const lines = text.split(/\r?\n/);
-	const add = ({ rule, line, message }) => {
-		diagnostics.push({
-			rule,
-			path: file,
-			line,
-			message
-		});
-	};
-	const lineOf = (key) => Math.max(1, lines.findIndex((line) => line.includes(key)) + 1);
-	const pin = ({ rule, value, expected, label, line = 1, selector }) => {
-		let matches = value === expected;
-		if (selector === "node") matches = nodeSelectorMatches(value, expected);
-		else if (label.includes("python")) matches = pythonSelectorMatches(value, expected);
-		if (!matches) add({
-			rule,
-			line,
-			message: `${label} must be ${expected}, found ${String(value)}`
-		});
-	};
-	const toml = (rule) => {
-		try {
-			return (0, smol_toml.parse)(text);
-		} catch {
-			add({
-				rule,
-				line: 1,
-				message: "invalid TOML"
-			});
-			return;
-		}
-	};
-	const versions = {
-		...policy.packages,
-		...Object.fromEntries(Object.entries(policy.packages).map(([tool, version]) => [`npm:${tool}`, version])),
-		bun: policy.bun,
-		node: policy.node,
-		nodejs: policy.node,
-		python: policy.python,
-		rust: policy.rust,
-		"core:node": policy.node,
-		"core:python": policy.python,
-		"core:rust": policy.rust,
-		"core:bun": policy.bun
-	};
-	const nodeTools = /* @__PURE__ */ new Set([
-		"node",
-		"nodejs",
-		"core:node"
-	]);
-	if (name === ".bun-version") pin({
-		rule: "bun-pins",
-		value: text.trim(),
-		expected: policy.bun,
-		label: name
-	});
-	if (name === ".node-version" || name === ".nvmrc") pin({
-		rule: "node-version",
-		selector: "node",
-		value: text.trim(),
-		expected: policy.node,
-		label: name
-	});
-	if (name === ".python-version") pin({
-		rule: "python-version",
-		value: text.trim(),
-		expected: policy.python,
-		label: name
-	});
-	const firstContent = lines.find((line) => line.trim() !== "" && !line.trimStart().startsWith("#"));
-	const rustToml = name === "rust-toolchain.toml" || name === "rust-toolchain" && firstContent?.trimStart().startsWith("[");
-	if (name === "rust-toolchain" && !rustToml) pin({
-		rule: "rust-version",
-		value: text.trim(),
-		expected: policy.rust,
-		label: name
-	});
-	if (rustToml) {
-		const parsed = toml("rust-version");
-		if (parsed !== void 0) {
-			const toolchain = parsed["toolchain"];
-			const components = record$2(toolchain) ? toolchain["components"] : void 0;
-			const expected = Array.isArray(components) && components.includes("rustc-dev") ? policy.rustCompilerDevelopment : policy.rust;
-			pin({
-				rule: "rust-version",
-				value: record$2(toolchain) ? toolchain["channel"] : void 0,
-				expected,
-				label: "Rust channel",
-				line: lineOf("channel")
-			});
-		}
-	}
-	if (name === "Cargo.toml") {
-		const parsed = toml("rust-version");
-		const rustFloor = (value) => {
-			const parts = typeof value === "string" && /^(?:0|[1-9]\d*)(?:\.(?:0|[1-9]\d*)){0,2}$/.test(value) ? value.split(".").map(Number) : void 0;
-			if (parts === void 0 || !parts.every(Number.isSafeInteger) || compareRelease(parts, policy.rust.split(".").map(Number)) > 0) add({
-				rule: "rust-version",
-				line: lineOf("rust-version"),
-				message: `Cargo rust-version must be a bare support floor at or below Rust ${policy.rust}`
-			});
-		};
-		const readManifest = (candidate) => {
-			if (candidate === file) return parsed;
-			if (!trackedFiles.has(candidate)) return void 0;
-			try {
-				return (0, smol_toml.parse)(readFile(candidate) ?? "");
-			} catch {
-				return;
-			}
-		};
-		if (parsed !== void 0) {
-			const workspace = parsed["workspace"];
-			const defaults = record$2(workspace) ? workspace["package"] : void 0;
-			if (record$2(defaults) && defaults["rust-version"] !== void 0) rustFloor(defaults["rust-version"]);
-			const pkg = parsed["package"];
-			const version = record$2(pkg) ? pkg["rust-version"] : void 0;
-			if (version !== void 0) if (!record$2(version)) rustFloor(version);
-			else {
-				let inherited;
-				if (version["workspace"] === true && record$2(pkg)) {
-					const explicit = pkg["workspace"];
-					let directory = node_path.default.posix.dirname(file);
-					const explicitPath = typeof explicit === "string" && !explicit.includes("\\") && !explicit.includes(":") && !explicit.includes("${{") && !node_path.default.posix.isAbsolute(explicit) ? node_path.default.posix.normalize(node_path.default.posix.join(directory, explicit)) : void 0;
-					if (explicit === void 0 || explicitPath !== void 0 && explicitPath !== ".." && !explicitPath.startsWith("../")) {
-						if (explicitPath !== void 0) directory = explicitPath;
-						while (true) {
-							const table = readManifest(node_path.default.posix.join(directory, "Cargo.toml"))?.["workspace"];
-							if (record$2(table)) {
-								const fields = table["package"];
-								inherited = record$2(fields) ? fields["rust-version"] : void 0;
-								break;
-							}
-							if (explicit !== void 0 || directory === ".") break;
-							directory = node_path.default.posix.dirname(directory);
-						}
-					}
-				}
-				rustFloor(inherited);
-			}
-		}
-	}
-	if (name === "Pipfile") {
-		const requires = toml("python-version")?.["requires"];
-		if (record$2(requires)) {
-			const minor = requires["python_version"];
-			if (minor !== void 0 && minor !== policy.python.split(".").slice(0, 2).join(".")) add({
-				rule: "python-version",
-				line: lineOf("python_version"),
-				message: `Pipfile python_version must select Python ${policy.python}`
-			});
-			const full = requires["python_full_version"];
-			if (full !== void 0 && !(typeof full === "string" && /^\d+\.\d+\.\d+$/.test(full) && pythonSelectorMatches(full, policy.python))) add({
-				rule: "python-version",
-				line: lineOf("python_full_version"),
-				message: `Pipfile python_full_version must select Python ${policy.python}`
-			});
-		}
-	}
-	if (name === "pyproject.toml" || name === "uv.toml") {
-		const parsed = toml("python-version");
-		if (parsed !== void 0) {
-			const project = parsed["project"];
-			if (record$2(project) && project["requires-python"] !== void 0) {
-				if (!pythonRequirementMatches(project["requires-python"], policy.python)) add({
-					rule: "python-version",
-					line: lineOf("requires-python"),
-					message: `requires-python must include Python ${policy.python}; unsupported constraints must use final-release version specifiers`
-				});
-			}
-			const tool = parsed["tool"];
-			const configuredUv = record$2(tool) ? tool["uv"] : void 0;
-			const uv = name === "uv.toml" ? parsed : configuredUv;
-			if (record$2(uv) && uv["python"] !== void 0) pin({
-				rule: "python-version",
-				value: uv["python"],
-				expected: policy.python,
-				label: "uv python",
-				line: lineOf("python")
-			});
-		}
-	}
-	if (isMiseConfigPath(file)) {
-		const tools = toml("runtime-manager")?.["tools"];
-		if (record$2(tools)) for (const [tool, expected] of Object.entries(versions)) {
-			const configured = tools[tool];
-			if (configured !== void 0) pin({
-				rule: "runtime-manager",
-				value: record$2(configured) ? configured["version"] : configured,
-				expected,
-				selector: nodeTools.has(tool) ? "node" : void 0,
-				label: `mise ${tool}`,
-				line: lineOf(tool)
-			});
-		}
-	}
-	if (name === ".tool-versions") lines.forEach((line, index) => {
-		const fields = line.replace(/#.*$/, "").trim().split(/\s+/);
-		const tool = fields.at(0);
-		if (tool === void 0 || !(tool in versions)) return;
-		const expected = Object.entries(versions).find(([key]) => key === tool)?.[1];
-		if (expected !== void 0) pin({
-			rule: "runtime-manager",
-			value: fields.slice(1).join(" "),
-			expected,
-			selector: nodeTools.has(tool) ? "node" : void 0,
-			label: `.tool-versions ${tool}`,
-			line: index + 1
-		});
-	});
-	const checkRuntimeImage = ({ image, line, label }) => {
-		if (typeof image !== "string" || image.includes("$")) {
-			add({
-				rule: "runtime-docker",
-				line,
-				message: `cannot determine ${label} runtime; use a static image or a reasoned runtime-docker opt-out`
-			});
-			return;
-		}
-		const runtime = /^(node|python|oven\/bun)(?::([^@]+))?(?:@.*)?$/i.exec(canonicalDockerRuntime(image));
-		if (runtime === null) return;
-		const tool = runtime[1]?.toLowerCase();
-		if (image.includes("@")) {
-			add({
-				rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
-				line,
-				message: `${label} ${tool} digest requires an approved digest policy; use a tag-only runtime image`
-			});
-			return;
-		}
-		const tag = runtime[2];
-		const variantSuffix = tool === "oven/bun" ? /-(?:alpine|slim|debian)$/ : /-(?:alpine(?:\d+(?:\.\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim)$/;
-		const version = tag?.replace(variantSuffix, "");
-		let expected = policy.bun;
-		if (tool === "node") expected = policy.node;
-		else if (tool === "python") expected = policy.python;
-		pin({
-			rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
-			value: version,
-			expected,
-			selector: tool === "node" ? "node" : void 0,
-			label: `${label} ${tool}`,
-			line
-		});
-	};
-	if (isDockerDefinitionPath(file)) {
-		const variables = /* @__PURE__ */ new Map();
-		const escape = /^\s*#\s*escape\s*=\s*([\\`])\s*$/m.exec(text)?.[1] ?? "\\";
-		const continuation = new RegExp(`${escape === "`" ? "`" : "\\\\"}\\s*$`);
-		const stages = /* @__PURE__ */ new Set();
-		let argumentScope = "global";
-		const heredocs = [];
-		let instruction = "";
-		let startLine = 1;
-		const expand = (value) => {
-			for (let count = 0; count <= variables.size; count++) {
-				const next = value.replace(/\$(?:\{([A-Za-z_][A-Za-z_\d]*)\}|([A-Za-z_][A-Za-z_\d]*))/g, (reference, braced, plain) => variables.get(braced ?? plain ?? "") ?? reference);
-				if (next === value) return next;
-				value = next;
-			}
-			return value;
-		};
-		const collectHeredocs = (content, line) => {
-			let quote;
-			for (let index = 0; index < content.length; index++) {
-				const character = content.at(index);
-				if (quote !== void 0) {
-					if (character === quote) quote = void 0;
-					else if (quote === "\"" && character === "\\") index++;
-					continue;
-				}
-				if (character === "\\") {
-					index++;
-					continue;
-				}
-				if (character === "'" || character === "\"") {
-					quote = character;
-					continue;
-				}
-				if (character === "#" && (index === 0 || /[\s;&|()]/.test(content.at(index - 1) ?? ""))) break;
-				if (character !== "<" || content.at(index + 1) !== "<") continue;
-				if (content.at(index + 2) === "<") {
-					index += 2;
-					continue;
-				}
-				index += 2;
-				const stripTabs = content.at(index) === "-";
-				if (stripTabs) index++;
-				while (/\s/.test(content.at(index) ?? "")) index++;
-				if (content.at(index) === "#") {
-					add({
-						rule: "runtime-docker",
-						line,
-						message: "invalid Docker heredoc delimiter"
-					});
-					break;
-				}
-				let delimiter = "";
-				let delimiterQuote;
-				for (; index < content.length; index++) {
-					const part = content.at(index);
-					if (delimiterQuote !== void 0) {
-						if (part === delimiterQuote) delimiterQuote = void 0;
-						else if (delimiterQuote === "\"" && part === "\\" && /[$"\\]/.test(content.at(index + 1) ?? "")) delimiter += content.at(++index);
-						else delimiter += part;
-						continue;
-					}
-					if (part === "'" || part === "\"") {
-						delimiterQuote = part;
-						continue;
-					}
-					if (part === "\\" && content.at(index + 1) !== void 0) {
-						delimiter += content.at(++index);
-						continue;
-					}
-					if (/[\s;&|<>()]/.test(part ?? "")) break;
-					delimiter += part;
-				}
-				if (delimiter !== "" && delimiterQuote === void 0) heredocs.push({
-					delimiter,
-					stripTabs,
-					line
-				});
-				else add({
-					rule: "runtime-docker",
-					line,
-					message: "invalid Docker heredoc delimiter"
-				});
-				index--;
-			}
-		};
-		const checkInstruction = (content, line) => {
-			const argument = /^\s*ARG\s+([A-Za-z_][A-Za-z_\d]*)(?:=(.*))?$/i.exec(content);
-			if (argument !== null) {
-				if (argumentScope === "stage") return;
-				const key = argument[1];
-				const value = argument[2];
-				if (key !== void 0 && value !== void 0) variables.set(key, expand(value.replace(/^(["'])(.*)\1$/, "$2")));
-				return;
-			}
-			if (/^\s*(?:RUN|COPY)\s+/i.test(content)) {
-				collectHeredocs(content, line);
-				return;
-			}
-			const from = /^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)(?:\s+AS\s+(\S+))?/i.exec(content);
-			if (from === null || from[1] === void 0) return;
-			argumentScope = "stage";
-			const image = expand(from[1]);
-			if (image.includes("$")) {
-				add({
-					rule: "runtime-docker",
-					line,
-					message: "cannot determine FROM runtime; declare an image ARG default or a reasoned runtime-docker opt-out"
-				});
-				return;
-			}
-			const stage = from[2]?.toLowerCase();
-			const previousStage = stages.has(image.toLowerCase());
-			if (stage !== void 0) stages.add(stage);
-			if (previousStage) return;
-			checkRuntimeImage({
-				image,
-				line,
-				label: "FROM"
-			});
-		};
-		lines.forEach((line, index) => {
-			const heredoc = heredocs.at(0);
-			if (heredoc !== void 0) {
-				if ((heredoc.stripTabs ? line.replace(/^\t+/, "") : line) === heredoc.delimiter) heredocs.shift();
-				return;
-			}
-			if (line.trimStart().startsWith("#")) return;
-			if (instruction === "") startLine = index + 1;
-			instruction += line.replace(continuation, " ");
-			if (continuation.test(line)) return;
-			checkInstruction(instruction, startLine);
-			instruction = "";
-		});
-		if (instruction !== "") checkInstruction(instruction, startLine);
-		for (const heredoc of heredocs) add({
-			rule: "runtime-docker",
-			line: heredoc.line,
-			message: `unterminated Docker heredoc ${heredoc.delimiter}`
-		});
-	}
-	if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) {
-		const lineCounter = new yaml.LineCounter();
-		for (const containerDocument of (0, yaml.parseAllDocuments)(text, {
-			lineCounter,
-			merge: true,
-			uniqueKeys: true
-		})) {
-			const contents = containerDocument.contents;
-			const declaredResource = (0, yaml.isMap)(contents) && (0, yaml.isScalar)(contents.get("apiVersion", true)) && (0, yaml.isScalar)(contents.get("kind", true));
-			const recognizedContainer = isComposeDefinitionPath(file) || declaredResource;
-			if (containerDocument.errors.length > 0) {
-				if (recognizedContainer) add({
-					rule: "runtime-docker",
-					line: 1,
-					message: "invalid container YAML"
-				});
-				continue;
-			}
-			try {
-				const classified = containerDocumentImages(containerDocument.toJS({ maxAliasCount: 100 }), file);
-				for (const entry of classified?.images ?? []) {
-					const node = containerDocument.getIn(entry.path, true);
-					const line = ((0, yaml.isMap)(node) || (0, yaml.isScalar)(node) || (0, yaml.isSeq)(node) || (0, yaml.isAlias)(node)) && node.range !== void 0 && node.range !== null ? lineCounter.linePos(node.range[0]).line : 1;
-					checkRuntimeImage({
-						image: entry.image,
-						line,
-						label: classified?.ecosystem === "docker-compose" ? "Compose image" : "Kubernetes image"
-					});
-				}
-			} catch {
-				if (recognizedContainer) add({
-					rule: "runtime-docker",
-					line: 1,
-					message: "invalid container YAML aliases"
-				});
-			}
-		}
-	}
-	const automationKind = githubAutomationFileKind(file);
-	if (automationKind === void 0) return diagnostics;
-	const document = (0, yaml.parseDocument)(text, {
-		uniqueKeys: true,
-		merge: true
-	});
-	if (document.errors.length > 0) {
-		add({
-			rule: "runtime-workflow",
-			line: 1,
-			message: "invalid workflow YAML"
-		});
-		return diagnostics;
-	}
-	const nodeLine = (node) => {
-		if (!record$2(node) || !Array.isArray(node["range"])) return 1;
-		const offset = node["range"].at(0);
-		return typeof offset === "number" ? text.slice(0, offset).split("\n").length : 1;
-	};
-	let checkoutBindings = [];
-	let checkoutDestinations = /* @__PURE__ */ new Map();
-	let unknownCheckoutDestination = false;
-	const staticRepositoryPath = (value) => typeof value === "string" && value !== "" && !value.includes("${{") && !value.includes("\\") && !value.includes(":") && !node_path.default.posix.isAbsolute(value) && !value.split("/").includes("..");
-	const normalizeCheckoutPath = (prefix) => node_path.default.posix.normalize(prefix).replace(/\/$/, "") || ".";
-	const checkReference = ({ value, tool, line }) => {
-		const allowed = {
-			node: [".node-version", ".nvmrc"],
-			python: [".python-version"],
-			bun: ["package.json"]
-		}[tool];
-		const rule = tool === "bun" ? "bun-pins" : "runtime-workflow";
-		const selector = staticRepositoryPath(value) ? node_path.default.posix.normalize(value) : void 0;
-		const binding = selector === void 0 ? void 0 : checkoutBindings.findLast((entry) => entry.path === "." || selector === entry.path || selector.startsWith(`${entry.path}/`));
-		let target;
-		if (!(selector === void 0 || unknownCheckoutDestination || binding?.source === "untrusted" || [...checkoutDestinations].some(([prefix, count]) => count > 1 && (prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`))))) target = binding === void 0 || binding.path === "." ? selector : node_path.default.posix.relative(binding.path, selector);
-		if (target === void 0 || !allowed.includes(node_path.default.posix.basename(target)) || binding?.source !== "delegated" && !trackedFiles.has(target)) {
-			add({
-				rule,
-				line,
-				message: `setup-${tool} must reference a tracked ${allowed.join(" or ")}`
-			});
-			return;
-		}
-		if (binding !== void 0 && (binding.sparse.mode === "invalid" || binding.sparse.mode === "files" && !binding.sparse.paths.has(target))) {
-			add({
-				rule,
-				line,
-				message: `checkout sparse-checkout must explicitly list ${target} without dynamic, glob, or negation patterns`
-			});
-			return;
-		}
-		if (binding?.source === "delegated" && selector !== void 0) {
-			onDelegated?.({
-				path: file,
-				line,
-				tool,
-				selector,
-				checkoutPath: binding.path,
-				ref: binding.ref
-			});
-			return;
-		}
-		const content = readFile(target);
-		if (tool === "bun") {
-			try {
-				const manifest = JSON.parse(content ?? "");
-				pin({
-					rule,
-					value: record$2(manifest) ? manifest["packageManager"] : void 0,
-					expected: `bun@${policy.bun}`,
-					label: "setup-bun version file packageManager",
-					line
-				});
-			} catch {
-				add({
-					rule,
-					line,
-					message: "bun-version-file must reference a readable package.json object"
-				});
-			}
-			return;
-		}
-		pin({
-			rule,
-			value: content?.trim(),
-			expected: policy[tool],
-			selector: tool === "node" ? "node" : void 0,
-			label: `setup-${tool} version file`,
-			line
-		});
-	};
-	const resolveNode = (node) => {
-		const visited = /* @__PURE__ */ new Set();
-		while ((0, yaml.isAlias)(node)) {
-			if (visited.has(node)) throw new Error("cyclic YAML alias");
-			visited.add(node);
-			node = node.resolve(document);
-		}
-		return node;
-	};
-	const approvedActions = new Map(Object.entries(policy.actions).map(([action, approved]) => [action.toLowerCase(), approved]));
-	const mergedMaps = (node) => {
-		node = resolveNode(node);
-		if (!(0, yaml.isMap)(node)) return [];
-		const maps = [];
-		for (const pair of node.items) {
-			if (!(0, yaml.isScalar)(pair.key) || typeof pair.key.value !== "symbol" || pair.key.source !== "<<") continue;
-			const merge = resolveNode(pair.value);
-			maps.push(...(0, yaml.isSeq)(merge) ? merge.items : [merge]);
-		}
-		return maps;
-	};
-	const keysOf = (node, visited = /* @__PURE__ */ new Set()) => {
-		node = resolveNode(node);
-		if (!(0, yaml.isMap)(node)) return /* @__PURE__ */ new Set();
-		if (visited.has(node)) throw new Error("cyclic YAML merge");
-		const next = new Set(visited);
-		next.add(node);
-		const keys = new Set(node.items.flatMap((pair) => (0, yaml.isScalar)(pair.key) && typeof pair.key.value === "string" ? [pair.key.value] : []));
-		for (const merged of mergedMaps(node)) for (const key of keysOf(merged, next)) keys.add(key);
-		return keys;
-	};
-	const sourceMap = ({ node, key, visited = /* @__PURE__ */ new Set() }) => {
-		node = resolveNode(node);
-		if (!(0, yaml.isMap)(node)) return void 0;
-		if (node.has(key)) return node;
-		if (visited.has(node)) throw new Error("cyclic YAML merge");
-		const next = new Set(visited);
-		next.add(node);
-		for (const merged of mergedMaps(node)) {
-			const source = sourceMap({
-				node: merged,
-				key,
-				visited: next
-			});
-			if (source !== void 0) return source;
-		}
-	};
-	const getNode = (node, key) => {
-		const source = sourceMap({
-			node,
-			key
-		});
-		return (0, yaml.isMap)(source) ? resolveNode(source.get(key, true)) : void 0;
-	};
-	const actionInputs = /* @__PURE__ */ new Map();
-	const inputsOf = (node) => {
-		node = resolveNode(node);
-		const cached = actionInputs.get(node);
-		if (cached !== void 0) return cached;
-		const options = getNode(node, "with");
-		const inputs = /* @__PURE__ */ new Map();
-		for (const key of keysOf(options)) {
-			const folded = key.toUpperCase();
-			const value = getNode(options, key);
-			if (inputs.has(folded)) add({
-				rule: "action-pins",
-				line: nodeLine(value),
-				message: `action input ${key} collides after case-folding`
-			});
-			if (/(?:^|-)VERSION(?:-FILE)?$/.test(folded) && key !== folded.toLowerCase()) add({
-				rule: "action-pins",
-				line: nodeLine(value),
-				message: `selector input ${key} must use canonical lowercase casing`
-			});
-			inputs.set(folded, value);
-		}
-		actionInputs.set(node, inputs);
-		return inputs;
-	};
-	const getInput = (node, key) => inputsOf(node).get(key.toUpperCase());
-	const dynamicRefBody = (value) => {
-		if (typeof value !== "string" || !value.startsWith("${{")) return void 0;
-		let quote;
-		for (let index = 3; index < value.length; index++) {
-			const character = value.at(index);
-			if (quote !== void 0) {
-				if (character === quote) if (quote === "'" && value.at(index + 1) === "'") index++;
-				else quote = void 0;
-				else if (quote === "\"" && character === "\\") index++;
-				continue;
-			}
-			if (character === "'" || character === "\"") quote = character;
-			else if (value.startsWith("${{", index)) return void 0;
-			else if (character === "}" && value.at(index + 1) === "}") return index === value.length - 2 ? value.slice(3, index).trim() : void 0;
-		}
-	};
-	const checkoutPrefixOf = (node) => {
-		const destination = getInput(node, "path");
-		if (destination === void 0) return ".";
-		return (0, yaml.isScalar)(destination) ? destination.value : void 0;
-	};
-	const sparseCheckoutOf = (node) => {
-		const sparseKeys = [...inputsOf(node).keys()].filter((key) => key.startsWith("SPARSE-CHECKOUT"));
-		if (sparseKeys.length === 0) return { mode: "all" };
-		if (sparseKeys.some((key) => key !== "SPARSE-CHECKOUT" && key !== "SPARSE-CHECKOUT-CONE-MODE")) return { mode: "invalid" };
-		const value = getInput(node, "sparse-checkout");
-		const cone = getInput(node, "sparse-checkout-cone-mode");
-		if (!(0, yaml.isScalar)(value) || typeof value.value !== "string" || cone !== void 0 && (!(0, yaml.isScalar)(cone) || cone.value !== true && cone.value !== false && cone.value !== "true" && cone.value !== "false")) return { mode: "invalid" };
-		const paths = value.value.split(/\r?\n/).map((entry) => entry.trim()).filter((entry) => entry !== "");
-		if (paths.length === 0 || paths.some((entry) => !staticRepositoryPath(entry) || entry.startsWith("!") || /[*?[\]]/.test(entry))) return { mode: "invalid" };
-		return {
-			mode: "files",
-			paths: new Set(paths)
-		};
-	};
-	const checkAction = (node) => {
-		node = resolveNode(node);
-		if (!(0, yaml.isMap)(node)) return;
-		inputsOf(node);
-		const uses = getNode(node, "uses");
-		if (uses === void 0) return;
-		const line = nodeLine(uses);
-		if (!(0, yaml.isScalar)(uses) || typeof uses.value !== "string") {
-			add({
-				rule: "action-pins",
-				line,
-				message: "action uses must be a string containing a full commit SHA"
-			});
-			return;
-		}
-		const value = uses.value;
-		if (value.startsWith("$/")) {
-			if (value.length === 2 || /\s/.test(value) || value.includes("@") || value.includes("${{") || value.includes("\\") || value.split("/").includes("..")) add({
-				rule: "action-pins",
-				line,
-				message: "self-repository actions must use a static repository path without a ref suffix"
-			});
-			return;
-		}
-		if (value.startsWith("./")) {
-			const selector = staticRepositoryPath(value) ? node_path.default.posix.normalize(value) : void 0;
-			const binding = selector === void 0 ? void 0 : checkoutBindings.findLast((entry) => entry.path === "." || selector === entry.path || selector.startsWith(`${entry.path}/`));
-			if (selector === void 0 || unknownCheckoutDestination || binding !== void 0 && binding.source !== "tracked" || [...checkoutDestinations].some(([prefix, count]) => count > 1 && (prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`)))) add({
-				rule: "action-pins",
-				line,
-				message: "local actions require an unambiguous checkout of the current source snapshot"
-			});
-			return;
-		}
-		if (value.startsWith("docker://")) {
-			add({
-				rule: "action-pins",
-				line,
-				message: "Docker image actions require a reasoned action-pins opt-out"
-			});
-			checkRuntimeImage({
-				image: value.slice(9),
-				line,
-				label: "Docker action image"
-			});
-			return;
-		}
-		const remote = /^([^./][^\s@]*\/[^\s@]+)@([^\s]+)$/.exec(value);
-		if (remote === null) {
-			add({
-				rule: "action-pins",
-				line,
-				message: "remote actions must use a full commit SHA"
-			});
-			return;
-		}
-		const action = remote[1]?.toLowerCase();
-		const ref = remote[2];
-		const approved = action === void 0 ? void 0 : approvedActions.get(action) ?? approvedActions.get(action.split("/").slice(0, 2).join("/"));
-		if (ref === void 0 || !/^[a-f0-9]{40}$/.test(ref)) add({
-			rule: "action-pins",
-			line,
-			message: "remote actions must use a full commit SHA"
-		});
-		else if (approved !== void 0 && ref !== approved.sha) add({
-			rule: "action-pins",
-			line,
-			message: `${action} must use ${approved.sha}`
-		});
-		const declaration = sourceMap({
-			node,
-			key: "uses"
-		});
-		const comment = uses.comment ?? ((0, yaml.isMap)(declaration) ? declaration.comment : void 0) ?? "";
-		if (approved !== void 0 && !comment.trim().split(/\s+/).includes(approved.version)) add({
-			rule: "action-pins",
-			line,
-			message: `${action} requires a # ${approved.version} version comment`
-		});
-		if (action === "actions/checkout") {
-			const checkoutRepository = getInput(node, "repository");
-			const checkoutRef = getInput(node, "ref");
-			const prefix = checkoutPrefixOf(node);
-			let repo;
-			if (checkoutRepository !== void 0) repo = (0, yaml.isScalar)(checkoutRepository) ? checkoutRepository.value : null;
-			const self = repo === void 0 || repo === "${{ github.repository }}" || typeof repo === "string" && repository !== void 0 && repo.toLowerCase() === repository.toLowerCase();
-			const workflowSource = repo === "${{ job.workflow_repository }}" && (0, yaml.isScalar)(checkoutRef) && checkoutRef.value === "${{ job.workflow_sha }}";
-			const currentSource = self && checkoutRef === void 0;
-			const refValue = (0, yaml.isScalar)(checkoutRef) ? checkoutRef.value : void 0;
-			const dynamicRef = dynamicRefBody(refValue);
-			const delegatedSource = (self || repo === "${{ job.workflow_repository }}") && dynamicRef !== void 0 && dynamicRef !== "" && !/^(?:'(?:[^']|'')*'|"(?:[^"\\]|\\.)*"|(?:true|false|null)|-?(?:0x[\da-f]+|(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?))$/i.test(dynamicRef) && !/^(?:github\s*(?:\.\s*sha|\[\s*['"]sha['"]\s*\])|job\s*(?:\.\s*workflow_sha|\[\s*['"]workflow_sha['"]\s*\]))$/i.test(dynamicRef);
-			if (!staticRepositoryPath(prefix)) checkoutBindings.push({
-				path: ".",
-				source: "untrusted",
-				sparse: { mode: "invalid" }
-			});
-			else {
-				const destination = normalizeCheckoutPath(prefix);
-				const trustedWriter = ref === approved?.sha && sourceMap({
-					node,
-					key: "if"
-				}) === void 0 && sourceMap({
-					node,
-					key: "continue-on-error"
-				}) === void 0 && checkoutDestinations.get(destination) === 1 && !unknownCheckoutDestination;
-				if (trustedWriter && delegatedSource && typeof refValue === "string") checkoutBindings.push({
-					path: destination,
-					sparse: sparseCheckoutOf(node),
-					source: "delegated",
-					ref: refValue
-				});
-				else checkoutBindings.push({
-					path: destination,
-					sparse: sparseCheckoutOf(node),
-					source: trustedWriter && (workflowSource || currentSource) ? "tracked" : "untrusted"
-				});
-			}
-		}
-		let tool;
-		switch (action) {
-			case "actions/setup-node":
-				tool = "node";
-				break;
-			case "actions/setup-python":
-				tool = "python";
-				break;
-			case "oven-sh/setup-bun":
-				tool = "bun";
-				break;
-			default: return;
-		}
-		const literal = getInput(node, `${tool}-version`);
-		if (literal !== void 0) add({
-			rule: tool === "bun" ? "bun-pins" : "runtime-workflow",
-			line: nodeLine(literal),
-			message: `setup-${tool} must use ${tool}-version-file`
-		});
-		const reference = getInput(node, `${tool}-version-file`);
-		checkReference({
-			value: (0, yaml.isScalar)(reference) ? reference.value : void 0,
-			tool,
-			line: reference === void 0 ? line : nodeLine(reference)
-		});
-	};
-	const checkContainer = (node) => {
-		node = resolveNode(node);
-		if (node === void 0) return;
-		const image = (0, yaml.isMap)(node) ? getNode(node, "image") : node;
-		checkRuntimeImage({
-			image: (0, yaml.isScalar)(image) ? image.value : void 0,
-			line: nodeLine(image ?? node),
-			label: "container image"
-		});
-	};
-	const checkSteps = (node) => {
-		checkoutBindings = [];
-		checkoutDestinations = /* @__PURE__ */ new Map();
-		unknownCheckoutDestination = false;
-		node = resolveNode(node);
-		if (!(0, yaml.isSeq)(node)) return;
-		for (const step of node.items) {
-			const uses = getNode(step, "uses");
-			if (!(0, yaml.isScalar)(uses) || typeof uses.value !== "string" || !uses.value.toLowerCase().startsWith("actions/checkout@")) continue;
-			const prefix = checkoutPrefixOf(step);
-			if (!staticRepositoryPath(prefix)) {
-				unknownCheckoutDestination = true;
-				continue;
-			}
-			const destination = normalizeCheckoutPath(prefix);
-			checkoutDestinations.set(destination, (checkoutDestinations.get(destination) ?? 0) + 1);
-		}
-		for (const step of node.items) checkAction(step);
-	};
-	try {
-		document.toJS({ maxAliasCount: 100 });
-		if (automationKind === "workflow") {
-			const jobs = getNode(document.contents, "jobs");
-			if ((0, yaml.isMap)(jobs)) for (const key of keysOf(jobs)) {
-				checkoutBindings = [];
-				checkoutDestinations = /* @__PURE__ */ new Map();
-				unknownCheckoutDestination = false;
-				const job = getNode(jobs, key);
-				checkAction(job);
-				checkContainer(getNode(job, "container"));
-				const services = getNode(job, "services");
-				if ((0, yaml.isMap)(services)) for (const service of keysOf(services)) checkContainer(getNode(services, service));
-				checkSteps(getNode(job, "steps"));
-			}
-		} else {
-			const runs = getNode(document.contents, "runs");
-			const using = getNode(runs, "using");
-			if ((0, yaml.isScalar)(using) && using.value === "composite") checkSteps(getNode(runs, "steps"));
-			if ((0, yaml.isScalar)(using) && using.value === "docker") {
-				const image = getNode(runs, "image");
-				const value = (0, yaml.isScalar)(image) ? image.value : void 0;
-				if (typeof value === "string" && value.startsWith("docker://")) {
-					add({
-						rule: "action-pins",
-						line: nodeLine(image),
-						message: "Docker image actions require a reasoned action-pins opt-out"
-					});
-					checkRuntimeImage({
-						image: value.slice(9),
-						line: nodeLine(image),
-						label: "Docker action image"
-					});
-				} else if (typeof value !== "string" || value.includes("${{") || value.includes("\\") || value.includes(":") || node_path.default.posix.isAbsolute(value) || node_path.default.posix.normalize(node_path.default.posix.join(node_path.default.posix.dirname(file), value)).split("/").at(0) === ".." || node_path.default.posix.basename(value) !== "Dockerfile") add({
-					rule: "action-pins",
-					line: nodeLine(image),
-					message: "Docker actions must reference a local Dockerfile or declare a reasoned action-pins opt-out for an external image"
-				});
-			}
-		}
-	} catch {
-		add({
-			rule: "runtime-workflow",
-			line: 1,
-			message: "cannot resolve workflow YAML aliases"
-		});
-	}
-	return diagnostics;
-};
-//#endregion
-//#region src/toolchain-schema.ts
-const packagePinKeys = [
-	"oxlint",
-	"oxlint-tsgolint",
-	"@oxlint/plugins",
-	"@stll/oxlint-plugin",
-	"oxfmt",
-	"lefthook"
-];
-const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** Reject unsupported or incomplete installed policies before inspecting a consumer. */
-const parseToolchainPolicy = (input) => {
-	if (!record$1(input) || input["schemaVersion"] !== 1) throw new Error("toolchain.json must use schemaVersion 1");
-	const string = (object, key) => {
-		const value = object[key];
-		if (typeof value !== "string" || value.trim() === "") throw new Error(`toolchain.json requires a nonempty ${key}`);
-		return value;
-	};
-	const packages = {};
-	for (const key of packagePinKeys) packages[key] = string(input, key);
-	const bun = string(input, "bun");
-	const typescript = string(input, "typescript");
-	const node = string(input, "node");
-	const python = string(input, "python");
-	const rust = string(input, "rust");
-	const rustCompilerDevelopment = string(input, "rustCompilerDevelopment");
-	for (const [name, value] of Object.entries({
-		...packages,
-		bun,
-		typescript
-	})) if ((0, semver.valid)(value) !== value) throw new Error(`toolchain.json ${name} must be an exact release`);
-	if (!nodePolicyValid(node)) throw new Error("Node must be a canonical major N.x series");
-	if (!/^\d+\.\d+(?:\.\d+)?$/.test(python)) throw new Error("Python must be an exact minor or patch release");
-	if (!/^\d+\.\d+\.\d+$/.test(rust)) throw new Error("Rust must be an exact stable release");
-	if (!/^nightly-\d{4}-\d{2}-\d{2}$/.test(rustCompilerDevelopment)) throw new Error("Rust compiler development must be a dated nightly");
-	const compatibility = input["typescript6Compatibility"];
-	if (!record$1(compatibility)) throw new Error("missing TypeScript compatibility policy");
-	const version = string(compatibility, "version");
-	const packageAlias = string(compatibility, "packageAlias");
-	if ((0, semver.valid)(version) !== version) throw new Error("TypeScript compatibility must be an exact release");
-	const layouts = input["typescriptInstallLayouts"];
-	if (!Array.isArray(layouts) || layouts.length === 0) throw new Error("missing TypeScript install layouts");
-	const typescriptInstallLayouts = layouts.map((layout) => {
-		if (!record$1(layout)) throw new Error("invalid TypeScript install layout");
-		const compilerPackage = string(layout, "compilerPackage");
-		const compilerSpecifier = string(layout, "compilerSpecifier");
-		const typecheckCommand = string(layout, "typecheckCommand");
-		switch (layout["type"]) {
-			case "direct":
-				if (compilerSpecifier !== typescript || compilerPackage !== "typescript") throw new Error("direct TypeScript layout differs from shared version");
-				return {
-					type: "direct",
-					compilerPackage,
-					compilerSpecifier,
-					typecheckCommand
-				};
-			case "split-compatibility": {
-				const compatibilityPackage = string(layout, "compatibilityPackage");
-				const compatibilitySpecifier = string(layout, "compatibilitySpecifier");
-				if (compilerSpecifier !== `npm:typescript@${typescript}` || compatibilitySpecifier !== version) throw new Error("split TypeScript layout differs from shared versions");
-				return {
-					type: "split-compatibility",
-					compilerPackage,
-					compilerSpecifier,
-					compatibilityPackage,
-					compatibilitySpecifier,
-					typecheckCommand
-				};
-			}
-			default: throw new Error("unsupported TypeScript install layout");
-		}
-	});
-	const actionsInput = input["actions"];
-	if (!record$1(actionsInput) || Object.keys(actionsInput).length === 0) throw new Error("missing approved actions");
-	const actions = {};
-	for (const [name, action] of Object.entries(actionsInput)) {
-		if (!record$1(action)) throw new Error(`invalid action policy: ${name}`);
-		const sha = string(action, "sha");
-		const actionVersion = string(action, "version");
-		if (!/^[a-f0-9]{40}$/.test(sha) || !/^v\d+(?:\.\d+)*$/.test(actionVersion)) throw new Error(`invalid action SHA/version: ${name}`);
-		actions[name] = {
-			sha,
-			version: actionVersion
-		};
-	}
-	const dependabotInput = input["dependabot"];
-	if (!record$1(dependabotInput) || !record$1(dependabotInput["schedule"]) || !record$1(dependabotInput["cooldown"]) || !record$1(dependabotInput["groups"])) throw new Error("missing Dependabot policy");
-	const scheduleInput = dependabotInput["schedule"];
-	const schedule = {
-		interval: string(scheduleInput, "interval"),
-		day: string(scheduleInput, "day"),
-		time: string(scheduleInput, "time"),
-		timezone: string(scheduleInput, "timezone")
-	};
-	const defaultDays = dependabotInput["cooldown"]["defaultDays"];
-	if (typeof defaultDays !== "number" || !Number.isInteger(defaultDays) || defaultDays < 5) throw new Error("Dependabot cooldown must be at least five days");
-	const strings = (value) => {
-		if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string")) throw new Error("Dependabot group values must be string arrays");
-		return value;
-	};
-	const groups = {};
-	for (const [name, group] of Object.entries(dependabotInput["groups"])) {
-		if (!record$1(group)) throw new Error(`invalid Dependabot group: ${name}`);
-		groups[name] = {
-			patterns: strings(group["patterns"]),
-			updateTypes: strings(group["updateTypes"])
-		};
-	}
-	return {
-		bun,
-		typescript,
-		node,
-		python,
-		rust,
-		rustCompilerDevelopment,
-		packages,
-		actions,
-		typescriptInstallLayouts,
-		typescript6Compatibility: {
-			version,
-			packageAlias
-		},
-		dependabot: {
-			schedule,
-			cooldown: { defaultDays },
-			groups,
-			ignoredPackages: [.../* @__PURE__ */ new Set([
-				...Object.keys(packages),
-				...typescriptInstallLayouts.flatMap((layout) => layout.type === "direct" ? [layout.compilerPackage] : [layout.compilerPackage, layout.compatibilityPackage]),
-				packageAlias,
-				"bun-types"
-			])],
-			ignoredActions: Object.keys(actions),
-			ignoredImages: [
-				"node",
-				"python",
-				"oven/bun"
-			]
-		}
-	};
-};
-//#endregion
-//#region src/toolchain-guard.ts
-const toolchainRules = [.../* @__PURE__ */ new Set([
-	...packageRules,
-	...runtimeRules,
-	...dependabotRules
-])];
-const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const array = (value) => Array.isArray(value);
-/** Opt-outs are repository-owned, tracked decisions; malformed decisions fail closed. */
-const parseToolchainOptOuts = (input) => {
-	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts") || !array(input["optOuts"])) throw new Error("stll-toolchain.json must contain only an \"optOuts\" array");
-	const disabled = /* @__PURE__ */ new Set();
-	for (const entry of input["optOuts"]) {
-		if (!record(entry) || Object.keys(entry).some((key) => key !== "rule" && key !== "reason") || typeof entry["rule"] !== "string" || !toolchainRules.some((rule) => rule === entry["rule"]) || typeof entry["reason"] !== "string" || entry["reason"].trim() === "" || disabled.has(entry["rule"])) throw new Error("each opt-out requires a unique known rule and a nonempty reason");
-		if (entry["rule"] === "node-engine") throw new Error("node-engine cannot be opted out; engines.node must support the shared Node series");
-		disabled.add(entry["rule"]);
-	}
-	return disabled;
-};
-/** Read one tracked configuration snapshot for guards and policy generation. */
-const readToolchainInputs = (root) => {
-	const diagnostics = [];
-	const tracked = (0, node_child_process.execFileSync)("git", [
-		"ls-files",
-		"-z",
-		"--cached"
-	], {
-		cwd: root,
-		encoding: "utf8"
-	}).split("\0").filter((file) => file !== "");
-	const files = {};
-	const trackedFiles = new Set(tracked);
-	const resolvedRoot = (0, node_fs.realpathSync)(root);
-	for (const file of tracked) {
-		const kind = toolchainInputKind(file);
-		if (kind === void 0) continue;
-		if (kind === "presence") {
-			files[file] = "";
-			continue;
-		}
-		try {
-			const resolvedFile = (0, node_fs.realpathSync)(node_path.default.join(resolvedRoot, file));
-			const relative = node_path.default.relative(resolvedRoot, resolvedFile);
-			if (node_path.default.isAbsolute(relative) || relative.split(node_path.default.sep).at(0) === ".." || !trackedFiles.has(relative.split(node_path.default.sep).join("/"))) throw new Error("Configuration target is outside the tracked tree");
-			files[file] = (0, node_fs.readFileSync)(resolvedFile, "utf8");
-		} catch {
-			diagnostics.push({
-				rule: "configuration",
-				path: file,
-				line: 1,
-				message: "cannot read tracked configuration file"
-			});
-		}
-	}
-	return {
-		files,
-		trackedFiles,
-		diagnostics
-	};
-};
-const checkToolchain = ({ root, policy, onDelegated }) => {
-	const { files, trackedFiles, diagnostics } = readToolchainInputs(root);
-	let repository;
-	try {
-		const origin = (0, node_child_process.execFileSync)("git", [
-			"remote",
-			"get-url",
-			"origin"
-		], {
-			cwd: root,
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
-		repository = /^(?:https?:\/\/github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)([^/]+\/[^/]+?)(?:\.git)?\/?$/.exec(origin)?.[1];
-	} catch {}
-	let disabled = /* @__PURE__ */ new Set();
-	if (files["stll-toolchain.json"] !== void 0) try {
-		disabled = parseToolchainOptOuts(JSON.parse(files["stll-toolchain.json"]));
-	} catch (error) {
-		diagnostics.push({
-			rule: "configuration",
-			path: "stll-toolchain.json",
-			line: 1,
-			message: error instanceof Error ? error.message : String(error)
-		});
-	}
-	diagnostics.push(...checkPackageFiles({
-		files,
-		policy
-	}));
-	for (const [file, text] of Object.entries(files)) diagnostics.push(...checkRuntimeFile({
-		file,
-		text,
-		policy: {
-			...policy,
-			packages: {
-				...policy.packages,
-				typescript: policy.typescript
-			}
-		},
-		trackedFiles,
-		repository,
-		onDelegated,
-		readFile: (target) => files[target]
-	}));
-	diagnostics.push(...checkDependabot({
-		files,
-		policy: policy.dependabot
-	}));
-	return diagnostics.filter((diagnostic) => !disabled.has(diagnostic.rule));
-};
-//#endregion
 //#region src/toolchain-check-cli.ts
 try {
 	const args = process.argv.slice(2);
@@ -2294,8 +10,8 @@ try {
 		process.exit(0);
 	}
 	if (args.length !== 0) throw new Error(`unexpected argument: ${args.at(0)}`);
-	const policy = parseToolchainPolicy(JSON.parse((0, node_fs.readFileSync)(new URL("../toolchain.json", require("url").pathToFileURL(__filename).href), "utf8")));
-	const diagnostics = checkToolchain({
+	const policy = require_toolchain_guard.parseToolchainPolicy(JSON.parse((0, node_fs.readFileSync)(new URL("../toolchain.json", require("url").pathToFileURL(__filename).href), "utf8")));
+	const diagnostics = require_toolchain_guard.checkToolchain({
 		root: process.cwd(),
 		policy,
 		onDelegated: ({ path, line, tool, selector, ref }) => process.stdout.write(`${path}:${line}: [runtime-delegated] setup-${tool} ${selector} delegates its version to checkout ref ${ref}\n`)