@stll/oxlint-config 0.12.0 → 0.12.2

package/dist/toolchain-guard.mjs

@@ -267,19 +267,28 @@ const parseCloudSetup = (input) => {
 	if (input === void 0) return void 0;
 	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error("cloud must be an object");
 	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile") throw new Error(`unsupported cloud key: ${key}`);
-	if (!("services" in input) || !Array.isArray(input.services)) throw new Error("cloud.services must be an explicit array");
+	const selected = "services" in input ? input.services : [];
+	if (!Array.isArray(selected)) throw new Error("cloud.services must be an array when provided");
 	if (!("install" in input) || input.install !== "bun install --frozen-lockfile") throw new Error(`cloud.install must be exactly ${cloudInstallCommand}`);
+	const seen = /* @__PURE__ */ new Set();
+	const services = Array.from(selected, (service) => {
+		if (!cloudService(service)) throw new Error("cloud.services contains an unsupported service");
+		if (seen.has(service)) throw new Error(`cloud.services contains duplicate service: ${service}`);
+		seen.add(service);
+		return service;
+	});
+	if (services.length === 0) {
+		if ("envFile" in input) throw new Error("cloud.envFile is not allowed without services");
+		return {
+			services,
+			install: cloudInstallCommand
+		};
+	}
 	if (!("envFile" in input) || typeof input.envFile !== "string") throw new Error("cloud.envFile must be a canonical repository-relative path");
 	const envFile = input.envFile;
 	if (envFile.startsWith("/") || /^[A-Za-z]:/.test(envFile) || envFile.includes("\\") || /\p{Cc}/u.test(envFile) || envFile.split("/").some((part) => part === "" || part === "." || part === "..")) throw new Error("cloud.envFile must be a canonical repository-relative path");
-	const seen = /* @__PURE__ */ new Set();
 	return {
-		services: Array.from(input.services, (service) => {
-			if (!cloudService(service)) throw new Error("cloud.services contains an unsupported service");
-			if (seen.has(service)) throw new Error(`cloud.services contains duplicate service: ${service}`);
-			seen.add(service);
-			return service;
-		}),
+		services,
 		install: cloudInstallCommand,
 		envFile
 	};
@@ -491,8 +500,7 @@ NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
 BUN_DIR="/opt/stll-cloud/bun/$BUN_VERSION"
 export PATH="$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 BUN_CACHE="/var/cache/stll-cloud/bun/$OUTPUT_UID"
-ENV_FILE=@ENV_FILE@
-ENV_MARKER='@ENV_MARKER@'
+@ENV_ASSIGNMENTS@
 [[ -f "$REPO_ROOT/.node-version" && ! -L "$REPO_ROOT/.node-version" ]] || fail 'A regular root .node-version is required'
 [[ "$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' "$REPO_ROOT/.node-version")" == "$NODE_VERSION" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'
 cd -- "$REPO_ROOT"
@@ -561,6 +569,21 @@ dependency_install() {
 @SERVICE_INSTALL@
 @SERVICE_START@
 
+@ENV_FUNCTIONS@
+
+if [[ "$MODE" == install ]]; then
+  install_runtimes
+  install_services
+  dependency_install
+  exit 0
+fi
+runtime_ready
+@ENV_VALIDATE@
+prepare_state
+start_services
+@ENV_WRITE@
+`;
+const environmentFunctions = String.raw`
 validate_environment() {
   local part target="$REPO_ROOT" env_path="$REPO_ROOT/$ENV_FILE" first_line temporary
   while IFS= read -r part; do
@@ -587,20 +610,6 @@ write_environment() {
   chown "$OUTPUT_UID:$OUTPUT_GID" "$temporary"
   mv -f -- "$temporary" "$env_path"
 }
-
-if [[ "$MODE" == install ]]; then
-  install_runtimes
-  install_services
-  dependency_install
-  exit 0
-fi
-runtime_ready
-DATABASE_URL=''
-REDIS_URL=''
-validate_environment
-prepare_state
-start_services
-write_environment
 `;
 const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
 const generateCloudSetup = ({ policy, cloud, nodeVersion }) => {
@@ -612,8 +621,10 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion }) => {
 	const replacements = /* @__PURE__ */ new Map([
 		["@BUN@", policy.bun],
 		["@NODE@", exactNode],
-		["@ENV_FILE@", shellQuote(selected.envFile)],
-		["@ENV_MARKER@", cloudEnvironmentMarker],
+		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
+		["@ENV_FUNCTIONS@", selected.envFile === void 0 ? "" : environmentFunctions],
+		["@ENV_VALIDATE@", selected.envFile === void 0 ? "" : "DATABASE_URL=''\nREDIS_URL=''\nvalidate_environment"],
+		["@ENV_WRITE@", selected.envFile === void 0 ? "" : "write_environment"],
 		["@SERVICE_INSTALL@", renderCloudServiceInstall({
 			services,
 			postgres: policy.postgres,
@@ -634,7 +645,7 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion }) => {
 };
 //#endregion
 //#region src/toolchain-container-inputs.ts
-const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Filename class recognized by Dependabot's Docker Compose fetcher. */
 const isComposeDefinitionPath = (file) => /^\.?(?:docker-)?compose(?:-[\w]+)?(?:\.[\w-]+)?\.ya?ml$/i.test(file.split("/").at(-1) ?? "");
 /** Candidate YAML files are classified by their document shape after reading. */
@@ -681,11 +692,11 @@ const kubernetesPodSpecPaths = {
 };
 /** Shared semantic image enumeration for runtime checks and update-root generation. */
 const containerDocumentImages = (document, file) => {
-	if (!record$6(document)) return void 0;
+	if (!record$7(document)) return void 0;
 	const services = document["services"];
-	if (isComposeDefinitionPath(file) && record$6(services)) {
+	if (isComposeDefinitionPath(file) && record$7(services)) {
 		const images = [];
-		for (const [name, service] of Object.entries(services)) if (record$6(service) && service["image"] !== void 0) images.push({
+		for (const [name, service] of Object.entries(services)) if (record$7(service) && service["image"] !== void 0) images.push({
 			image: service["image"],
 			path: [
 				"services",
@@ -706,7 +717,7 @@ const containerDocumentImages = (document, file) => {
 		visited.add(resource);
 		if (typeof resource["apiVersion"] !== "string" || typeof resource["kind"] !== "string") return;
 		if (resource["kind"] === "List" && Array.isArray(resource["items"])) {
-			for (const [index, item] of resource["items"].entries()) if (record$6(item)) walkResource(item, [
+			for (const [index, item] of resource["items"].entries()) if (record$7(item)) walkResource(item, [
 				...prefix,
 				"items",
 				index
@@ -716,8 +727,8 @@ const containerDocumentImages = (document, file) => {
 		const specPath = Object.entries(kubernetesPodSpecPaths).find(([kind]) => kind === resource["kind"])?.[1];
 		if (specPath === void 0) return;
 		let spec = resource;
-		for (const key of specPath) spec = record$6(spec) ? spec[key] : void 0;
-		if (!record$6(spec)) return;
+		for (const key of specPath) spec = record$7(spec) ? spec[key] : void 0;
+		if (!record$7(spec)) return;
 		for (const key of [
 			"containers",
 			"initContainers",
@@ -725,7 +736,7 @@ const containerDocumentImages = (document, file) => {
 		]) {
 			const containers = spec[key];
 			if (!Array.isArray(containers)) continue;
-			for (const [index, container] of containers.entries()) if (record$6(container) && container["image"] !== void 0) images.push({
+			for (const [index, container] of containers.entries()) if (record$7(container) && container["image"] !== void 0) images.push({
 				image: container["image"],
 				path: [
 					...prefix,
@@ -828,7 +839,7 @@ const workspaceContains = ({ directory, file, patterns, rootMembership }) => {
 //#endregion
 //#region src/toolchain-dependabot.ts
 const dependabotRules = ["dependabot-policy"];
-const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const strings = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
 const sameStrings = (value, expected) => {
 	if (!strings(value) || value.length !== expected.length) return false;
@@ -850,8 +861,8 @@ const workspaceTable = (parsed, ecosystem) => {
 		case "cargo": return parsed["workspace"];
 		case "uv": {
 			const tool = parsed["tool"];
-			const uv = record$5(tool) ? tool["uv"] : void 0;
-			return record$5(uv) ? uv["workspace"] : void 0;
+			const uv = record$6(tool) ? tool["uv"] : void 0;
+			return record$6(uv) ? uv["workspace"] : void 0;
 		}
 		default: throw new Error("unknown workspace ecosystem", { cause: ecosystem });
 	}
@@ -871,7 +882,7 @@ const workspaceRoots = (files, ecosystem) => {
 					const document = parseDocument(text);
 					if (document.errors.length > 0) throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);
 					const parsed = document.toJS({ maxAliasCount: 100 });
-					if (!record$5(parsed)) throw new Error(`${workspaceFile}:1: pnpm workspace must contain an object`);
+					if (!record$6(parsed)) throw new Error(`${workspaceFile}:1: pnpm workspace must contain an object`);
 					const patterns = parsed["packages"] ?? [];
 					if (!strings(patterns)) throw new Error(`${workspaceFile}:1: pnpm packages must be a string array`);
 					workspaces.set(directory, patterns.map((pattern) => pattern.startsWith("!") ? `!${path.posix.normalize(pattern.slice(1))}` : path.posix.normalize(pattern)));
@@ -883,13 +894,13 @@ const workspaceRoots = (files, ecosystem) => {
 		}
 		try {
 			const parsed = ecosystem === "npm" ? JSON.parse(files[file] ?? "") : parse(files[file] ?? "");
-			if (!record$5(parsed)) continue;
+			if (!record$6(parsed)) continue;
 			if (ecosystem === "npm" && typeof parsed["packageManager"] === "string" && parsed["packageManager"].startsWith("pnpm@")) continue;
 			const value = workspaceTable(parsed, ecosystem);
-			const patterns = record$5(value) ? value[ecosystem === "npm" ? "packages" : "members"] : value;
-			const members = ecosystem === "cargo" && record$5(value) && patterns === void 0 ? [] : patterns;
+			const patterns = record$6(value) ? value[ecosystem === "npm" ? "packages" : "members"] : value;
+			const members = ecosystem === "cargo" && record$6(value) && patterns === void 0 ? [] : patterns;
 			if (strings(members)) {
-				const excluded = ecosystem !== "npm" && record$5(value) && strings(value["exclude"]) ? value["exclude"].map((pattern) => `!${pattern}`) : [];
+				const excluded = ecosystem !== "npm" && record$6(value) && strings(value["exclude"]) ? value["exclude"].map((pattern) => `!${pattern}`) : [];
 				workspaces.set(path.posix.dirname(file), [...members, ...excluded]);
 			}
 		} catch {}
@@ -940,11 +951,11 @@ const workspaceRoots = (files, ecosystem) => {
 		for (const directory of memberDirectories) try {
 			const parsed = parse(files[path.posix.join(directory, "Cargo.toml")] ?? "");
 			const workspace = parse(files[path.posix.join(root, "Cargo.toml")] ?? "")["workspace"];
-			const inherited = record$5(workspace) ? workspace["dependencies"] : void 0;
+			const inherited = record$6(workspace) ? workspace["dependencies"] : void 0;
 			const dependencyOwners = [parsed];
 			const targets = parsed["target"];
-			if (record$5(targets)) {
-				for (const target of Object.values(targets)) if (record$5(target)) dependencyOwners.push(target);
+			if (record$6(targets)) {
+				for (const target of Object.values(targets)) if (record$6(target)) dependencyOwners.push(target);
 			}
 			for (const owner of dependencyOwners) for (const key of [
 				"dependencies",
@@ -952,12 +963,12 @@ const workspaceRoots = (files, ecosystem) => {
 				"build-dependencies"
 			]) {
 				const dependencies = owner[key];
-				if (!record$5(dependencies)) continue;
+				if (!record$6(dependencies)) continue;
 				for (const [name, dependency] of Object.entries(dependencies)) {
-					if (!record$5(dependency)) continue;
+					if (!record$6(dependency)) continue;
 					const isInherited = dependency["workspace"] === true;
-					const resolved = isInherited && record$5(inherited) ? inherited[name] : dependency;
-					if (!record$5(resolved) || typeof resolved["path"] !== "string") continue;
+					const resolved = isInherited && record$6(inherited) ? inherited[name] : dependency;
+					if (!record$6(resolved) || typeof resolved["path"] !== "string") continue;
 					if (path.posix.isAbsolute(resolved["path"]) || /\\|\$|^[A-Za-z]:/.test(resolved["path"])) continue;
 					const target = path.posix.normalize(path.posix.join(isInherited ? root : directory, resolved["path"]));
 					const relative = path.posix.relative(root, target);
@@ -985,7 +996,7 @@ const javascriptEcosystem = (directory, files) => {
 	if (files[path.posix.join(root, "bun.lock")] !== void 0) return "bun";
 	try {
 		const manifest = JSON.parse(files[path.posix.join(root, "package.json")] ?? "{}");
-		if (record$5(manifest) && typeof manifest["packageManager"] === "string" && manifest["packageManager"].startsWith("bun@")) return "bun";
+		if (record$6(manifest) && typeof manifest["packageManager"] === "string" && manifest["packageManager"].startsWith("bun@")) return "bun";
 	} catch {}
 	return "npm";
 };
@@ -997,7 +1008,7 @@ const pythonEcosystem = (file, files) => {
 	const pyproject = files[path.posix.join(root, "pyproject.toml")];
 	if (pyproject !== void 0) try {
 		const tool = parse(pyproject)["tool"];
-		if (record$5(tool) && record$5(tool["uv"])) return "uv";
+		if (record$6(tool) && record$6(tool["uv"])) return "uv";
 	} catch {}
 	return "pip";
 };
@@ -1068,7 +1079,7 @@ const checkDependabot = ({ files, policy }) => {
 		add("cannot resolve Dependabot YAML aliases");
 		return diagnostics;
 	}
-	if (!record$5(parsed) || parsed["version"] !== 2 || !Array.isArray(parsed["updates"])) {
+	if (!record$6(parsed) || parsed["version"] !== 2 || !Array.isArray(parsed["updates"])) {
 		add("Dependabot must declare version: 2 and an updates array");
 		return diagnostics;
 	}
@@ -1081,7 +1092,7 @@ const checkDependabot = ({ files, policy }) => {
 		});
 		if (legacyDocument.errors.length === 0) legacy = legacyDocument.toJS({ maxAliasCount: 100 });
 	} catch {}
-	const legacyUpdates = record$5(legacy) && Array.isArray(legacy["updates"]) ? legacy["updates"] : [];
+	const legacyUpdates = record$6(legacy) && Array.isArray(legacy["updates"]) ? legacy["updates"] : [];
 	const rootClaims = /* @__PURE__ */ new Map();
 	const directoryClaims = /* @__PURE__ */ new Map();
 	for (const [index, update] of parsed["updates"].entries()) {
@@ -1095,7 +1106,7 @@ const checkDependabot = ({ files, policy }) => {
 			return offset === void 0 ? 1 : lineCounter.linePos(offset).line;
 		};
 		const report = (key, message) => add(message, lineOf(key));
-		if (!record$5(update) || typeof update["package-ecosystem"] !== "string") {
+		if (!record$6(update) || typeof update["package-ecosystem"] !== "string") {
 			report("package-ecosystem", "each Dependabot update must declare a package ecosystem");
 			continue;
 		}
@@ -1129,26 +1140,75 @@ const checkDependabot = ({ files, policy }) => {
 		covered.set(ecosystem, matches);
 		const schedule = update["schedule"];
 		const legacyUpdate = legacyUpdates.at(index);
-		const legacySchedule = record$5(legacyUpdate) ? legacyUpdate["schedule"] : void 0;
-		if (record$5(schedule) && schedule["time"] === policy.schedule.time && (!record$5(legacySchedule) || legacySchedule["time"] !== policy.schedule.time)) report("schedule", `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`);
-		if (!record$5(schedule) || Object.keys(schedule).length !== Object.keys(policy.schedule).length || Object.entries(policy.schedule).some(([key, value]) => schedule[key] !== value)) report("schedule", `${ecosystem}: schedule must match the shared policy`);
+		const legacySchedule = record$6(legacyUpdate) ? legacyUpdate["schedule"] : void 0;
+		if (record$6(schedule) && schedule["time"] === policy.schedule.time && (!record$6(legacySchedule) || legacySchedule["time"] !== policy.schedule.time)) report("schedule", `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`);
+		if (!record$6(schedule) || Object.keys(schedule).length !== Object.keys(policy.schedule).length || Object.entries(policy.schedule).some(([key, value]) => schedule[key] !== value)) report("schedule", `${ecosystem}: schedule must match the shared policy`);
 		const cooldown = update["cooldown"];
-		if (!record$5(cooldown) || Object.keys(cooldown).length !== 1 || cooldown["default-days"] !== policy.cooldown.defaultDays) report("cooldown", `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`);
+		if (!record$6(cooldown) || Object.keys(cooldown).length !== 1 || cooldown["default-days"] !== policy.cooldown.defaultDays) report("cooldown", `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`);
 		const groups = update["groups"];
-		if (!record$5(groups) || Object.keys(groups).length !== Object.keys(policy.groups).length || Object.entries(policy.groups).some(([name, expected]) => {
+		if (!record$6(groups) || Object.keys(groups).length !== Object.keys(policy.groups).length || Object.entries(policy.groups).some(([name, expected]) => {
 			const group = groups[name];
-			return !record$5(group) || Object.keys(group).length !== 2 || !sameStrings(group["patterns"], expected.patterns) || !sameStrings(group["update-types"], expected.updateTypes);
+			return !record$6(group) || Object.keys(group).length !== 2 || !sameStrings(group["patterns"], expected.patterns) || !sameStrings(group["update-types"], expected.updateTypes);
 		})) report("groups", `${ecosystem}: groups must match the shared policy`);
 		const ignored = ignoredFor(ecosystem, policy);
 		const ignore = update["ignore"];
 		if (ignore !== void 0 && (!Array.isArray(ignore) || ignore.length === 0)) report("ignore", `${ecosystem}: omit ignore or provide a nonempty array`);
-		if (Array.isArray(ignore) && ignore.some((entry) => !record$5(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
-		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$5(entry) && entry["dependency-name"] === name && Object.keys(entry).length === 1)) report("ignore", `${ecosystem}: ignore all updates for shared pin ${name}`);
+		if (Array.isArray(ignore) && ignore.some((entry) => !record$6(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
+		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$6(entry) && entry["dependency-name"] === name && Object.keys(entry).length === 1)) report("ignore", `${ecosystem}: ignore all updates for shared pin ${name}`);
 	}
 	for (const [ecosystem, directories] of roots) for (const directory of directories) if (!covered.get(ecosystem)?.has(directory)) add(`add a ${ecosystem} update entry covering ${directory}`);
 	return diagnostics;
 };
 //#endregion
+//#region src/toolchain-dynamic-selectors.ts
+const locatorValidators = {
+	image: /^(?:jobs\.[\w-]+\.(?:container|services\.[\w-]+)|services\.[\w.-]+\.image)$/,
+	"bun-source": /^(?:jobs\.[\w-]+|runs)\.steps\.[\w-]+$/
+};
+const knownKind = (value) => typeof value === "string" && Object.hasOwn(locatorValidators, value);
+const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** One reviewed declaration identifies one unresolved selector, never a rule. */
+const parseDynamicSelectors = (input) => {
+	if (input === void 0) return [];
+	if (!Array.isArray(input)) throw new Error("dynamicSelectors must be an array");
+	const result = [];
+	const keys = /* @__PURE__ */ new Set();
+	for (const entry of input) {
+		if (!record$5(entry) || Object.keys(entry).some((key) => ![
+			"path",
+			"kind",
+			"reason",
+			"at",
+			"line"
+		].includes(key)) || typeof entry["path"] !== "string" || entry["path"] === "" || /[\\:$*?]|[^\S ]/.test(entry["path"]) || entry["path"].split("/").some((part) => part === "" || part === "." || part === "..") || typeof entry["reason"] !== "string" || entry["reason"].trim() === "") throw new Error("each dynamic selector requires an exact repository path, known kind and nonempty reason");
+		const kind = entry["kind"];
+		if (!knownKind(kind)) throw new Error("unknown dynamic selector kind");
+		let selector;
+		if (Object.hasOwn(entry, "line") && !Object.hasOwn(entry, "at") && typeof entry["line"] === "number" && Number.isSafeInteger(entry["line"]) && entry["line"] > 0) selector = {
+			path: entry["path"],
+			kind,
+			reason: entry["reason"],
+			line: entry["line"]
+		};
+		else if (!Object.hasOwn(entry, "line") && typeof entry["at"] === "string" && locatorValidators[kind].test(entry["at"])) selector = {
+			path: entry["path"],
+			kind,
+			reason: entry["reason"],
+			at: entry["at"]
+		};
+		else throw new Error("dynamic selector requires one positive line or a kind-specific job/service/step ID locator");
+		const key = JSON.stringify([
+			selector.path,
+			selector.kind,
+			selector.at ?? selector.line
+		]);
+		if (keys.has(key)) throw new Error("dynamic selector locations must be unique");
+		keys.add(key);
+		result.push(selector);
+	}
+	return result;
+};
+//#endregion
 //#region src/toolchain-engine-floors.ts
 const record$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryPath = (value) => typeof value === "string" && value !== "" && !/^[A-Za-z]:/.test(value) && !/[\\\s]/.test(value) && !Array.from(value).some((character) => character.charCodeAt(0) < 32) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
@@ -1960,7 +2020,7 @@ const pythonRequirementMatches = (requirement, version) => {
 	});
 };
 /** Check runtime declarations only in the files that declare or configure them. */
-const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, repository, onDelegated, engineFloors = [], onEngineFloor }) => {
+const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, repository, onDelegated, dynamicSelectors = [], onDynamicSelector, engineFloors = [], onEngineFloor }) => {
 	const diagnostics = [];
 	const name = path.posix.basename(file);
 	const lines = text.split(/\r?\n/);
@@ -1972,6 +2032,16 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			message
 		});
 	};
+	let currentLocation;
+	const dynamic = (value) => typeof value === "string" && value.includes("$");
+	const authorizeDynamic = (kind, line, at = currentLocation) => {
+		const matches = dynamicSelectors.filter((entry) => entry.path === file && entry.kind === kind && (entry.at !== void 0 ? entry.at === at : entry.line === line));
+		if (matches.length !== 1) return false;
+		const entry = matches.at(0);
+		if (entry === void 0) return false;
+		onDynamicSelector?.(entry);
+		return true;
+	};
 	const lineOf = (key) => Math.max(1, lines.findIndex((line) => line.includes(key)) + 1);
 	const pin = ({ rule, value, expected, label, line = 1, selector }) => {
 		let matches = value === expected;
@@ -2173,32 +2243,73 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			line: index + 1
 		});
 	});
-	const checkRuntimeImage = ({ image, line, label }) => {
-		if (typeof image !== "string" || image.includes("$")) {
+	const checkRuntimeImage = ({ image, line, label, at }) => {
+		const unknownRuntime = () => {
+			if (dynamic(image) && authorizeDynamic("image", line, at)) return;
 			add({
 				rule: "runtime-docker",
 				line,
-				message: `cannot determine ${label} runtime; use a static image or a reasoned runtime-docker opt-out`
+				message: `cannot determine ${label} runtime; use a static image or a scoped dynamicSelectors declaration`
 			});
+		};
+		if (typeof image !== "string") {
+			unknownRuntime();
+			return;
+		}
+		const canonical = canonicalDockerRuntime(image);
+		const structuralImage = canonical.replace(/\$\{[^}]*\}|\$[A-Za-z_][A-Za-z_\d]*/g, (variable) => "x".repeat(variable.length));
+		const digestSeparator = structuralImage.indexOf("@");
+		const reference = digestSeparator < 0 ? canonical : canonical.slice(0, digestSeparator);
+		const structuralReference = digestSeparator < 0 ? structuralImage : structuralImage.slice(0, digestSeparator);
+		const managedFamily = /^(node|python|oven\/bun)(?=:|$)/i.exec(structuralReference)?.[1];
+		const tagSeparator = managedFamily === void 0 ? structuralReference.lastIndexOf(":") : structuralReference.indexOf(":", managedFamily.length);
+		const hasTag = managedFamily === void 0 ? tagSeparator > structuralReference.lastIndexOf("/") : tagSeparator !== -1;
+		const imageRepository = hasTag ? reference.slice(0, tagSeparator) : reference;
+		if (imageRepository.length === 0 || imageRepository.includes("$")) {
+			unknownRuntime();
+			return;
+		}
+		if (!/^(node|python|oven\/bun)$/i.test(imageRepository)) return;
+		const tool = imageRepository.toLowerCase();
+		if (image.includes("$")) {
+			unknownRuntime();
 			return;
 		}
-		const runtime = /^(node|python|oven\/bun)(?::([^@]+))?(?:@.*)?$/i.exec(canonicalDockerRuntime(image));
-		if (runtime === null) return;
-		const tool = runtime[1]?.toLowerCase();
-		if (image.includes("@")) {
+		const digest = digestSeparator < 0 ? void 0 : canonical.slice(digestSeparator + 1);
+		if (digest !== void 0 && !/^sha256:[a-fA-F\d]{64}$/.test(digest)) {
 			add({
 				rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
 				line,
-				message: `${label} ${tool} digest requires an approved digest policy; use a tag-only runtime image`
+				message: `${label} ${tool} digest must be sha256 followed by 64 hexadecimal characters`
 			});
 			return;
 		}
-		const tag = runtime[2];
+		const tag = hasTag ? reference.slice(tagSeparator + 1) : void 0;
 		const variantSuffix = tool === "oven/bun" ? /-(?:alpine|slim|debian)$/ : /-(?:alpine(?:\d+(?:\.\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim)$/;
 		const version = tag?.replace(variantSuffix, "");
 		let expected = policy.bun;
 		if (tool === "node") expected = policy.node;
 		else if (tool === "python") expected = policy.python;
+		if (digest !== void 0) {
+			if (version === void 0 || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(version)) {
+				add({
+					rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
+					line,
+					message: `${label} ${tool} digest requires an exact stable patch tag matching ${expected}`
+				});
+				return;
+			}
+			if (tool === "node" && trackedFiles.has(".node-version")) {
+				if (readFile(".node-version")?.trim() !== version) {
+					add({
+						rule: "runtime-docker",
+						line,
+						message: `${label} node digest tag must match tracked .node-version, found ${version}`
+					});
+					return;
+				}
+			}
+		}
 		pin({
 			rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
 			value: version,
@@ -2311,14 +2422,6 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			if (from === null || from[1] === void 0) return;
 			argumentScope = "stage";
 			const image = expand(from[1]);
-			if (image.includes("$")) {
-				add({
-					rule: "runtime-docker",
-					line,
-					message: "cannot determine FROM runtime; declare an image ARG default or a reasoned runtime-docker opt-out"
-				});
-				return;
-			}
 			const stage = from[2]?.toLowerCase();
 			const previousStage = stages.has(image.toLowerCase());
 			if (stage !== void 0) stages.add(stage);
@@ -2375,6 +2478,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 					checkRuntimeImage({
 						image: entry.image,
 						line,
+						at: entry.path.join("."),
 						label: classified?.ecosystem === "docker-compose" ? "Compose image" : "Kubernetes image"
 					});
 				}
@@ -2409,8 +2513,22 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	let checkoutBindings = [];
 	let checkoutDestinations = /* @__PURE__ */ new Map();
 	let unknownCheckoutDestination = false;
+	let unreviewableCheckoutSource = false;
 	const staticRepositoryPath = (value) => typeof value === "string" && value !== "" && !value.includes("${{") && !value.includes("\\") && !value.includes(":") && !path.posix.isAbsolute(value) && !value.split("/").includes("..");
 	const normalizeCheckoutPath = (prefix) => path.posix.normalize(prefix).replace(/\/$/, "") || ".";
+	const checkoutProvidersFor = (selector) => {
+		if (selector === void 0) return checkoutBindings;
+		let deepest;
+		for (const entry of checkoutBindings) {
+			if (entry.path !== "." && selector !== entry.path && !selector.startsWith(`${entry.path}/`)) continue;
+			if (deepest === void 0 || entry.path !== "." && (deepest.path === "." || entry.path.length > deepest.path.length)) deepest = entry;
+		}
+		return checkoutBindings.filter((entry) => entry.path === deepest?.path);
+	};
+	const hasAmbiguousCheckoutWriters = (selector, providers) => {
+		if (providers.length > 0) return providers.some((entry) => (checkoutDestinations.get(entry.path) ?? 0) > 1);
+		return [...checkoutDestinations].some(([prefix, count]) => count > 1 && (selector === void 0 || prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`)));
+	};
 	const checkReference = ({ value, tool, line }) => {
 		const allowed = {
 			node: [".node-version", ".nvmrc"],
@@ -2419,8 +2537,28 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		}[tool];
 		const rule = tool === "bun" ? "bun-pins" : "runtime-workflow";
 		const selector = staticRepositoryPath(value) ? path.posix.normalize(value) : void 0;
-		const binding = selector === void 0 ? void 0 : checkoutBindings.findLast((entry) => entry.path === "." || selector === entry.path || selector.startsWith(`${entry.path}/`));
+		const providers = checkoutProvidersFor(selector);
+		const binding = selector === void 0 ? void 0 : providers.at(-1);
+		const dynamicSource = providers.some((entry) => entry.dynamicSource);
+		const sparseFailure = providers.find((entry) => {
+			if (entry.sparse.mode === "invalid") return true;
+			if (entry.sparse.mode !== "files" && entry.sparse.mode !== "mixed") return false;
+			if (selector === void 0) return true;
+			const selectedFile = entry.path === "." ? selector : path.posix.relative(entry.path, selector);
+			return !entry.sparse.paths.has(selectedFile);
+		});
+		if (sparseFailure !== void 0) {
+			let missingFile = "the selected version file";
+			if (selector !== void 0) missingFile = sparseFailure.path === "." ? selector : path.posix.relative(sparseFailure.path, selector);
+			add({
+				rule,
+				line,
+				message: `checkout sparse-checkout must explicitly list ${missingFile} without invalid literal patterns`
+			});
+			return;
+		}
 		if (selector === void 0) {
+			if (tool === "bun" && dynamic(value) && !unreviewableCheckoutSource && authorizeDynamic("bun-source", line)) return;
 			add({
 				rule,
 				line,
@@ -2428,7 +2566,8 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			});
 			return;
 		}
-		if (unknownCheckoutDestination || [...checkoutDestinations].some(([prefix, count]) => count > 1 && (prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`)))) {
+		if (unknownCheckoutDestination || hasAmbiguousCheckoutWriters(selector, providers)) {
+			if (tool === "bun" && dynamicSource && !unreviewableCheckoutSource && authorizeDynamic("bun-source", line)) return;
 			add({
 				rule,
 				line,
@@ -2437,6 +2576,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			return;
 		}
 		if (binding?.source === "untrusted") {
+			if (tool === "bun" && dynamicSource && !unreviewableCheckoutSource && authorizeDynamic("bun-source", line)) return;
 			add({
 				rule,
 				line: binding.line,
@@ -2453,13 +2593,15 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			});
 			return;
 		}
-		if (binding !== void 0 && (binding.sparse.mode === "invalid" || binding.sparse.mode === "files" && !binding.sparse.paths.has(target))) {
-			add({
-				rule,
-				line,
-				message: `checkout sparse-checkout must explicitly list ${target} without dynamic, glob, or negation patterns`
-			});
-			return;
+		if (binding !== void 0 && (binding.sparse.mode === "dynamic" || binding.sparse.mode === "mixed")) {
+			if (tool !== "bun" || unreviewableCheckoutSource || !authorizeDynamic("bun-source", line)) {
+				add({
+					rule,
+					line,
+					message: `checkout sparse-checkout must explicitly list ${target} without dynamic, glob, or negation patterns`
+				});
+				return;
+			}
 		}
 		if (binding?.source === "delegated") {
 			onDelegated?.({
@@ -2581,10 +2723,10 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		return inputs;
 	};
 	const getInput = (node, key) => inputsOf(node).get(key.toUpperCase());
-	const dynamicRefBody = (value) => {
-		if (typeof value !== "string" || !value.startsWith("${{")) return void 0;
+	const expressionAt = (value, start) => {
+		if (!value.startsWith("${{", start)) return void 0;
 		let quote;
-		for (let index = 3; index < value.length; index++) {
+		for (let index = start + 3; index < value.length; index++) {
 			const character = value.at(index);
 			if (quote !== void 0) {
 				if (character === quote) if (quote === "'" && value.at(index + 1) === "'") index++;
@@ -2594,9 +2736,33 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			}
 			if (character === "'" || character === "\"") quote = character;
 			else if (value.startsWith("${{", index)) return void 0;
-			else if (character === "}" && value.at(index + 1) === "}") return index === value.length - 2 ? value.slice(3, index).trim() : void 0;
+			else if (character === "}" && value.at(index + 1) === "}") return {
+				body: value.slice(start + 3, index).trim(),
+				end: index + 2
+			};
 		}
 	};
+	const dynamicRefBody = (value) => {
+		if (typeof value !== "string") return void 0;
+		const expression = expressionAt(value, 0);
+		return expression?.end === value.length ? expression.body : void 0;
+	};
+	const sparseEntryIsValid = (entry) => {
+		let literalPath = "";
+		let position = 0;
+		while (position < entry.length) {
+			const start = entry.indexOf("${{", position);
+			const literal = entry.slice(position, start < 0 ? entry.length : start);
+			if (/[!$*?[\]\\:]/.test(literal) || literal.split("/").includes("..")) return false;
+			literalPath += literal;
+			if (start < 0) break;
+			const expression = expressionAt(entry, start);
+			if (expression === void 0 || expression.body === "") return false;
+			literalPath += "expression";
+			position = expression.end;
+		}
+		return staticRepositoryPath(literalPath);
+	};
 	const checkoutPrefixOf = (node) => {
 		const destination = getInput(node, "path");
 		if (destination === void 0) return ".";
@@ -2609,11 +2775,19 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		const value = getInput(node, "sparse-checkout");
 		const cone = getInput(node, "sparse-checkout-cone-mode");
 		if (!isScalar(value) || typeof value.value !== "string" || cone !== void 0 && (!isScalar(cone) || cone.value !== true && cone.value !== false && cone.value !== "true" && cone.value !== "false")) return { mode: "invalid" };
-		const paths = value.value.split(/\r?\n/).map((entry) => entry.trim()).filter((entry) => entry !== "");
-		if (paths.length === 0 || paths.some((entry) => !staticRepositoryPath(entry) || entry.startsWith("!") || /[*?[\]]/.test(entry))) return { mode: "invalid" };
+		const paths = value.value.split(/\r?\n/).map((entry) => entry.trim().replace(/^\//, "")).filter((entry) => entry !== "");
+		if (paths.length === 0 || paths.some((entry) => !sparseEntryIsValid(entry))) return { mode: "invalid" };
+		const literalPaths = new Set(paths.filter((entry) => !dynamic(entry)));
+		if (paths.some(dynamic)) {
+			if (literalPaths.size === 0) return { mode: "dynamic" };
+			return {
+				mode: "mixed",
+				paths: literalPaths
+			};
+		}
 		return {
 			mode: "files",
-			paths: new Set(paths)
+			paths: literalPaths
 		};
 	};
 	let currentEngineFloor;
@@ -2643,8 +2817,9 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		}
 		if (value.startsWith("./")) {
 			const selector = staticRepositoryPath(value) ? path.posix.normalize(value) : void 0;
-			const binding = selector === void 0 ? void 0 : checkoutBindings.findLast((entry) => entry.path === "." || selector === entry.path || selector.startsWith(`${entry.path}/`));
-			if (selector === void 0 || unknownCheckoutDestination || binding !== void 0 && binding.source !== "tracked" || [...checkoutDestinations].some(([prefix, count]) => count > 1 && (prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`)))) add({
+			const providers = checkoutProvidersFor(selector);
+			const binding = selector === void 0 ? void 0 : providers.at(-1);
+			if (selector === void 0 || unknownCheckoutDestination || binding !== void 0 && binding.source !== "tracked" || hasAmbiguousCheckoutWriters(selector, providers)) add({
 				rule: "action-pins",
 				line,
 				message: "local actions require an unambiguous checkout of the current source snapshot"
@@ -2700,24 +2875,55 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			const checkoutRepository = getInput(node, "repository");
 			const checkoutRef = getInput(node, "ref");
 			const prefix = checkoutPrefixOf(node);
+			const clean = getInput(node, "clean");
+			const cleanIsResolved = clean === void 0 || isScalar(clean) && !dynamic(clean.value);
 			let repo;
 			if (checkoutRepository !== void 0) repo = isScalar(checkoutRepository) ? checkoutRepository.value : null;
 			const self = repo === void 0 || repo === "${{ github.repository }}" || typeof repo === "string" && repository !== void 0 && repo.toLowerCase() === repository.toLowerCase();
 			const workflowSource = repo === "${{ job.workflow_repository }}" && isScalar(checkoutRef) && checkoutRef.value === "${{ job.workflow_sha }}";
-			const currentSource = self && checkoutRef === void 0;
-			const refValue = isScalar(checkoutRef) ? checkoutRef.value : void 0;
+			const triggers = getNode(document.contents, "on");
+			const callerContext = (() => {
+				if (isMap(triggers)) return [...keysOf(triggers)];
+				if (isSeq(triggers)) return triggers.items.map((event) => isScalar(event) ? event.value : void 0);
+				if (isScalar(triggers)) return [triggers.value];
+				return [];
+			})().includes("workflow_call");
+			let refValue = isScalar(checkoutRef) ? checkoutRef.value : void 0;
+			if (callerContext && (repo === void 0 || repo === "${{ github.repository }}") && checkoutRef === void 0) refValue = "${{ github.sha }}";
+			const currentRef = dynamicRefBody(refValue);
+			const currentSource = self && !callerContext && (checkoutRef === void 0 || currentRef === "github.sha");
 			const dynamicRef = dynamicRefBody(refValue);
-			const delegatedSource = (self || repo === "${{ job.workflow_repository }}") && dynamicRef !== void 0 && dynamicRef !== "" && !/^(?:'(?:[^']|'')*'|"(?:[^"\\]|\\.)*"|(?:true|false|null)|-?(?:0x[\da-f]+|(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?))$/i.test(dynamicRef) && !/^(?:github\s*(?:\.\s*sha|\[\s*['"]sha['"]\s*\])|job\s*(?:\.\s*workflow_sha|\[\s*['"]workflow_sha['"]\s*\]))$/i.test(dynamicRef);
+			const delegatedSource = !currentSource && (self || repo === "${{ job.workflow_repository }}") && dynamicRef !== void 0 && dynamicRef !== "" && !/^(?:'(?:[^']|'')*'|"(?:[^"\\]|\\.)*"|(?:true|false|null)|-?(?:0x[\da-f]+|(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?))$/i.test(dynamicRef) && (!/^(?:github\s*(?:\.\s*sha|\[\s*['"]sha['"]\s*\])|job\s*(?:\.\s*workflow_sha|\[\s*['"]workflow_sha['"]\s*\]))$/i.test(dynamicRef) || callerContext && currentRef === "github.sha");
+			const validSource = cleanIsResolved && ref === approved?.sha && sourceMap({
+				node,
+				key: "if"
+			}) === void 0 && sourceMap({
+				node,
+				key: "continue-on-error"
+			}) === void 0 && (currentSource || workflowSource || delegatedSource);
+			if (!validSource) unreviewableCheckoutSource = true;
 			if (!staticRepositoryPath(prefix)) checkoutBindings.push({
 				path: ".",
+				dynamicSource: validSource && dynamic(prefix),
 				source: "untrusted",
 				reason: "checkout destination must be a static repository path",
 				line,
-				sparse: { mode: "invalid" }
+				sparse: sparseCheckoutOf(node)
 			});
 			else {
 				const destination = normalizeCheckoutPath(prefix);
-				const trustedWriter = ref === approved?.sha && sourceMap({
+				checkoutBindings = checkoutBindings.map((entry) => {
+					if (entry.path === destination || destination !== "." && !entry.path.startsWith(`${destination}/`)) return entry;
+					return {
+						path: entry.path,
+						sparse: { mode: "all" },
+						dynamicSource: false,
+						source: "untrusted",
+						reason: "a later ancestor checkout invalidates this descendant destination",
+						line
+					};
+				});
+				const trustedWriter = cleanIsResolved && ref === approved?.sha && sourceMap({
 					node,
 					key: "if"
 				}) === void 0 && sourceMap({
@@ -2726,18 +2932,21 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 				}) === void 0 && checkoutDestinations.get(destination) === 1 && !unknownCheckoutDestination;
 				if (trustedWriter && delegatedSource && typeof refValue === "string") checkoutBindings.push({
 					path: destination,
+					dynamicSource: validSource && delegatedSource,
 					sparse: sparseCheckoutOf(node),
 					source: "delegated",
 					ref: refValue
 				});
 				else if (trustedWriter && (workflowSource || currentSource)) checkoutBindings.push({
 					path: destination,
+					dynamicSource: validSource && delegatedSource,
 					sparse: sparseCheckoutOf(node),
 					source: "tracked"
 				});
 				else {
 					let reason = "checkout does not select a trusted repository source snapshot";
-					if (ref !== approved?.sha) reason = "actions/checkout must use the approved action SHA";
+					if (!cleanIsResolved) reason = "checkout clean must be statically resolved";
+					else if (ref !== approved?.sha) reason = "actions/checkout must use the approved action SHA";
 					else if (sourceMap({
 						node,
 						key: "if"
@@ -2748,6 +2957,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 					else if (checkoutDestinations.get(destination) !== 1 || unknownCheckoutDestination) reason = "checkout destination must have exactly one static writer";
 					checkoutBindings.push({
 						path: destination,
+						dynamicSource: validSource && delegatedSource,
 						sparse: sparseCheckoutOf(node),
 						source: "untrusted",
 						reason,
@@ -2796,21 +3006,23 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			line: reference === void 0 ? line : nodeLine(reference)
 		});
 	};
-	const checkContainer = (node) => {
+	const checkContainer = (node, at) => {
 		node = resolveNode(node);
 		if (node === void 0) return;
 		const image = isMap(node) ? getNode(node, "image") : node;
 		checkRuntimeImage({
 			image: isScalar(image) ? image.value : void 0,
 			line: nodeLine(image ?? node),
-			label: "container image"
+			label: "container image",
+			at
 		});
 	};
-	const checkSteps = (node, floor) => {
+	const checkSteps = (node, locationPrefix, floor) => {
 		currentEngineFloor = void 0;
 		checkoutBindings = [];
 		checkoutDestinations = /* @__PURE__ */ new Map();
 		unknownCheckoutDestination = false;
+		unreviewableCheckoutSource = false;
 		node = resolveNode(node);
 		if (!isSeq(node)) return;
 		for (const step of node.items) {
@@ -2826,9 +3038,14 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		}
 		currentEngineFloor = floor;
 		try {
-			for (const step of node.items) checkAction(step);
+			for (const step of node.items) {
+				const id = getNode(step, "id");
+				currentLocation = isScalar(id) && typeof id.value === "string" ? `${locationPrefix}.steps.${id.value}` : void 0;
+				checkAction(step);
+			}
 		} finally {
 			currentEngineFloor = void 0;
+			currentLocation = void 0;
 		}
 	};
 	try {
@@ -2842,15 +3059,15 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 				currentEngineFloor = void 0;
 				const job = getNode(jobs, key);
 				checkAction(job);
-				checkContainer(getNode(job, "container"));
+				checkContainer(getNode(job, "container"), `jobs.${key}.container`);
 				const services = getNode(job, "services");
-				if (isMap(services)) for (const service of keysOf(services)) checkContainer(getNode(services, service));
-				checkSteps(getNode(job, "steps"), engineFloors.find((entry) => entry.job === key));
+				if (isMap(services)) for (const service of keysOf(services)) checkContainer(getNode(services, service), `jobs.${key}.services.${service}`);
+				checkSteps(getNode(job, "steps"), `jobs.${key}`, engineFloors.find((entry) => entry.job === key));
 			}
 		} else {
 			const runs = getNode(document.contents, "runs");
 			const using = getNode(runs, "using");
-			if (isScalar(using) && using.value === "composite") checkSteps(getNode(runs, "steps"));
+			if (isScalar(using) && using.value === "composite") checkSteps(getNode(runs, "steps"), "runs");
 			if (isScalar(using) && using.value === "docker") {
 				const image = getNode(runs, "image");
 				const value = isScalar(image) ? image.value : void 0;
@@ -3079,7 +3296,7 @@ const record = (value) => typeof value === "object" && value !== null && !Array.
 const array = (value) => Array.isArray(value);
 /** Repository-owned declarations are explicit; malformed decisions fail closed. */
 const parseToolchainConfiguration = (input) => {
-	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud and engineFloors declarations");
+	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors" && key !== "dynamicSelectors") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud, engineFloors and dynamicSelectors declarations");
 	const disabled = /* @__PURE__ */ new Set();
 	const optOuts = input["optOuts"] ?? [];
 	if (!array(optOuts)) throw new Error("optOuts must be an array");
@@ -3092,7 +3309,8 @@ const parseToolchainConfiguration = (input) => {
 	return {
 		disabled,
 		cloud: parseCloudSetup(input["cloud"]),
-		engineFloors: parseEngineFloors(input["engineFloors"])
+		engineFloors: parseEngineFloors(input["engineFloors"]),
+		dynamicSelectors: parseDynamicSelectors(input["dynamicSelectors"])
 	};
 };
 /** Read one tracked configuration snapshot for guards and policy generation. */
@@ -3158,10 +3376,12 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 	let disabled = /* @__PURE__ */ new Set();
 	let cloud;
 	const engineFloors = [];
+	let dynamicSelectors = [];
 	if (files["stll-toolchain.json"] !== void 0) try {
 		const configuration = parseToolchainConfiguration(JSON.parse(files["stll-toolchain.json"]));
 		disabled = configuration.disabled;
 		cloud = configuration.cloud;
+		dynamicSelectors = configuration.dynamicSelectors;
 		for (const entry of configuration.engineFloors) engineFloors.push(resolveEngineFloor(entry, files));
 	} catch (error) {
 		diagnostics.push({
@@ -3201,6 +3421,7 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 	}
 	const exercisedFloors = /* @__PURE__ */ new Set();
 	const mismatchedFloors = /* @__PURE__ */ new Set();
+	const selectorMatches = /* @__PURE__ */ new Map();
 	diagnostics.push(...checkPackageFiles({
 		files,
 		policy
@@ -3216,6 +3437,8 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 			}
 		},
 		trackedFiles,
+		dynamicSelectors: dynamicSelectors.filter((entry) => entry.path === file),
+		onDynamicSelector: (entry) => selectorMatches.set(entry, (selectorMatches.get(entry) ?? 0) + 1),
 		repository,
 		onDelegated,
 		engineFloors: engineFloors.filter((entry) => entry.workflow === file),
@@ -3231,6 +3454,12 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 		line: 1,
 		message: `engine floor ${entry.workflow}:${entry.job} requires a setup-node exact patch satisfying ${entry.package} engines.node minimum major ${entry.major}`
 	});
+	for (const entry of dynamicSelectors) if (selectorMatches.get(entry) !== 1) diagnostics.push({
+		rule: "configuration",
+		path: "stll-toolchain.json",
+		line: 1,
+		message: `dynamic selector ${entry.path}:${entry.at ?? entry.line} must match exactly one unresolved ${entry.kind} selector`
+	});
 	diagnostics.push(...checkDependabot({
 		files,
 		policy: policy.dependabot