@stll/oxlint-config 0.12.1 → 0.14.1

package/dist/toolchain-guard.mjs

@@ -1,758 +1,238 @@
+import { _ as nodeSupportRangeMatches, a as isPythonDependencyManifest, c as toolchainInputKind, d as isKubernetesDefinitionPath, f as workspaceContains, g as nodeSelectorMatches, i as isMiseConfigPath, l as containerDocumentImages, m as generateCloudSetup, n as isDependabotGithubActionsPath, o as javascriptDependencyLockfiles, p as cloudSetupPath, r as isDockerDefinitionPath, s as pythonDependencyManifestKind, t as githubAutomationFileKind, u as isComposeDefinitionPath, v as parseCloudSetup } from "./toolchain-inputs.mjs";
+import { _ as parseConsumerFixtures, d as consumerPackageClosure, g as discoverConsumerPackages, i as assertConsumerFixtureKind, n as assertConsumerNodeSupport, o as assertConsumerFixtureSelection } from "./toolchain-schema.mjs";
 import { readFileSync, realpathSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import path from "node:path";
-import { minVersion, satisfies, subset, valid, validRange } from "semver";
-import picomatch from "picomatch";
-import { parse } from "smol-toml";
+import { minVersion, satisfies, valid, validRange } from "semver";
 import { LineCounter, isAlias, isMap, isNode, isScalar, isSeq, parseAllDocuments, parseDocument } from "yaml";
-//#region src/cloud-setup-install.ts
-const packageInstall = String.raw`
-# Prevent package maintainer scripts from starting unmanaged system services.
-apt_install() (
-  # EXIT runs after function locals expire; this subshell owns the trap state.
-  backup=''
-  policy_state=untouched
-  [[ ! -L /var/lock/stll-cloud-apt.lock ]] || fail 'Invalid package install lock'
-  exec 8>/var/lock/stll-cloud-apt.lock
-  flock -x -w 120 8 || fail 'Another package installation is active'
-  [[ ! -L /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy symlink'
-  [[ ! -e /usr/sbin/policy-rc.d || -f /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy file'
-  backup="$(mktemp -d)"
-  cleanup_package_policy() {
-    local status=$?
-    trap - EXIT HUP INT TERM
-    if [[ "$policy_state" == installed ]]; then
-      if [[ -f "$backup/original" ]]; then
-        if ! cp -p "$backup/original" /usr/sbin/policy-rc.d; then status=1; fi
-      else
-        if ! rm -f /usr/sbin/policy-rc.d; then status=1; fi
-      fi
-    fi
-    rm -rf -- "$backup"
-    exit "$status"
-  }
-  trap cleanup_package_policy EXIT
-  trap 'exit 129' HUP
-  trap 'exit 130' INT
-  trap 'exit 143' TERM
-  if [[ -e /usr/sbin/policy-rc.d ]]; then cp -p /usr/sbin/policy-rc.d "$backup/original"; fi
-  policy_state=installed
-  printf '%s\n' '#!/bin/sh' 'exit 101' > /usr/sbin/policy-rc.d
-  chmod 755 /usr/sbin/policy-rc.d
-  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$@"
-)
-
-`;
-const postgresSourceLine = "deb [signed-by=/usr/share/keyrings/stll-pgdg.asc] https://apt.postgresql.org/pub/repos/apt noble-pgdg main";
-const postgresSigningFingerprint = "B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8";
-const postgresSources = String.raw`
-pgdg_key_fingerprint() {
-  gpg --batch --show-keys --with-colons "$1" | awk -F: '$1 == "pub" { primary = 1 } $1 == "sub" { primary = 0 } $1 == "fpr" && primary { print toupper($10); primary = 0 }'
-}
-pgdg_sources_ready() {
-  local managed="$1" file mode records suite keyring override fingerprint selected_keyring=''
-  shift
-  PGDG_SOURCE_STATE=missing
-  [[ ! -L "$managed" ]] || fail "Managed PGDG source must not be a symlink: $managed"
-  for file in "$@"; do
-    [[ -e "$file" ]] || continue
-    [[ -f "$file" ]] || fail "APT source must be a regular file: $file"
-    case "$file" in *.sources) mode=sources ;; *) mode=list ;; esac
-    records="$(awk -v mode="$mode" '
-      function trim(value) { gsub(/^[[:space:]]+|[[:space:]]+$/, "", value); return value }
-      function pgdg_uri(uri) {
-        uri = tolower(uri)
-        if (uri !~ /^[a-z][a-z0-9+.-]*:\/\//) return 0
-        sub(/^[a-z][a-z0-9+.-]*:\/\//, "", uri)
-        sub(/[\/?#].*$/, "", uri)
-        sub(/^.*@/, "", uri)
-        sub(/:.*$/, "", uri)
-        return uri == "apt.postgresql.org" || uri == "apt.postgresql.org."
-      }
-      function contains_pgdg(value, tokens, count, token_index) {
-        count = split(value, tokens, /[[:space:]]+/)
-        for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) return 1
-        return 0
-      }
-      function unsafe_field(name) {
-        return name ~ /^(trusted|allow-insecure|allow-weak|allow-downgrade-to-insecure)$/
-      }
-      function disabled_override(value) {
-        value = tolower(trim(value))
-        gsub(/^["\047]|["\047]$/, "", value)
-        return value ~ /^(no|false|without|off|disable|0)$/
-      }
-      function stanza(override_index) {
-        override = 0
-        for (override_index = 1; override_index <= override_count; override_index++) {
-          if (!disabled_override(override_values[override_index])) override = 1
-          delete override_values[override_index]
-        }
-        if (tolower(trim(enabled)) != "no" && pgdg) print (trim(suites) == "" ? "-" : trim(suites)) "\t" (trim(keyring) == "" ? "-" : trim(keyring)) "\t" (override ? "unsafe" : "safe")
-        enabled = ""; pgdg = 0; field = ""; suites = ""; keyring = ""; override = 0; override_count = 0
-      }
-      /^[[:space:]]*#/ { if (mode == "list" || $0 ~ /^#/) next }
-      {
-        line = $0
-        if (mode == "list") {
-          sub(/[[:space:]]*#.*$/, "", line)
-          if (line !~ /^[[:space:]]*deb(-src)?[[:space:]]/ || !contains_pgdg(line)) next
-          keyring = ""; override = 0
-          if (match(line, /\[[^]]*\]/)) {
-            options = substr(line, RSTART + 1, RLENGTH - 2)
-            count = split(options, tokens, /[[:space:]]+/)
-            for (token_index = 1; token_index <= count; token_index++) {
-              if (tolower(tokens[token_index]) ~ /^signed-by=/) { keyring = tokens[token_index]; sub(/^[^=]*=/, "", keyring) }
-              option_name = tolower(tokens[token_index]); sub(/=.*/, "", option_name)
-              option_value = tokens[token_index]; sub(/^[^=]*=/, "", option_value)
-              if (unsafe_field(option_name) && !disabled_override(option_value)) override = 1
-            }
-            sub(/\[[^]]*\]/, "", line)
-          }
-          count = split(line, tokens, /[[:space:]]+/)
-          for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) print (tokens[token_index + 1] == "" ? "-" : tokens[token_index + 1]) "\t" (keyring == "" ? "-" : keyring) "\t" (override ? "unsafe" : "safe")
-          next
-        }
-        if (line ~ /^[[:space:]]*$/) { stanza(); next }
-        if (line ~ /^[[:space:]]/) {
-          if (field == "uris" && contains_pgdg(line)) pgdg = 1
-          if (field == "enabled") enabled = enabled " " line
-          if (field == "suites") suites = suites " " line
-          if (field == "signed-by") keyring = keyring " " line
-          if (unsafe_field(field)) override_values[override_count] = override_values[override_count] " " line
-          next
-        }
-        field = tolower(line)
-        sub(/:.*/, "", field)
-        value = line
-        sub(/^[^:]*:[[:space:]]*/, "", value)
-        if (field == "uris" && contains_pgdg(value)) pgdg = 1
-        if (field == "enabled") enabled = value
-        if (field == "suites") suites = value
-        if (field == "signed-by") keyring = value
-        if (unsafe_field(field)) override_values[++override_count] = value
-      }
-      END { if (mode == "sources") stanza() }
-    ' "$file")" || fail "Cannot inspect APT source: $file"
-    if [[ "$file" == "$managed" && -z "$records" ]]; then
-      fail "Managed PGDG source has no active PGDG entry: $file"
-    fi
-    while IFS=$'\t' read -r suite keyring override; do
-      [[ -n "$suite" ]] || continue
-      [[ "$override" == safe ]] || fail "PGDG source enables an unsafe trust override: $file"
-      [[ "$suite" == noble-pgdg && "$keyring" == /* && ! "$keyring" =~ [[:space:],] ]] || fail "PGDG source requires noble-pgdg and one Signed-By keyring: $file"
-      [[ -z "$selected_keyring" || "$selected_keyring" == "$keyring" ]] || fail "Conflicting PGDG Signed-By keyrings: $file"
-      fingerprint="$(pgdg_key_fingerprint "$keyring")" || fail "Cannot verify PGDG Signed-By keyring: $file"
-      [[ "$fingerprint" == @PGDG_FINGERPRINT@ ]] || fail "PGDG Signed-By fingerprint mismatch: $file"
-      selected_keyring="$keyring"
-      PGDG_SOURCE_STATE=reuse
-    done <<< "$records"
-  done
-}
-`;
-const postgresInstall = String.raw`
-  postgres_ready() {
-    local binary
-    for binary in postgres initdb pg_ctl psql createdb; do
-      [[ -x "/usr/lib/postgresql/@POSTGRES@/bin/$binary" ]] || return 1
-    done
-    /usr/lib/postgresql/@POSTGRES@/bin/postgres --version | grep -Eq '^postgres \(PostgreSQL\) @POSTGRES@\.'
-  }
-  if ! postgres_ready; then
-    pgdg_sources_ready /etc/apt/sources.list.d/stll-pgdg.list /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources
-    if [[ "$PGDG_SOURCE_STATE" == missing ]]; then
-      local key key_fingerprint
-      key="$(mktemp)"
-      curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 https://www.postgresql.org/media/keys/ACCC4CF8.asc -o "$key"
-      key_fingerprint="$(pgdg_key_fingerprint "$key")"
-      [[ "$key_fingerprint" == @PGDG_FINGERPRINT@ ]] || fail 'PostgreSQL signing key mismatch'
-      install -d -m 755 /usr/share/keyrings
-      install -m 644 "$key" /usr/share/keyrings/stll-pgdg.asc
-      rm -- "$key"
-      printf '%s\n' '@PGDG_SOURCE@' > /etc/apt/sources.list.d/stll-pgdg.list
-    fi
-    apt-get update
-    apt_install postgresql-@POSTGRES@ postgresql-client-@POSTGRES@
-  fi
-  postgres_ready || fail 'PostgreSQL toolchain is incomplete or differs from the policy major'
-`;
-const valkeyInstall = String.raw`
-  if ! command -v valkey-server >/dev/null || [[ "$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\1/p')" != '@VALKEY@' ]] || ! command -v valkey-cli >/dev/null || [[ "$(valkey-cli --version)" != 'valkey-cli @VALKEY@' ]]; then
-    local scratch server_url server_sha tools_url tools_sha package
-    scratch="$(mktemp -d)"
-    chmod 755 "$scratch"
-    case "$ARCH" in
-      amd64) server_url='@AMD64_SERVER_URL@'; server_sha='@AMD64_SERVER_SHA@'; tools_url='@AMD64_TOOLS_URL@'; tools_sha='@AMD64_TOOLS_SHA@' ;;
-      arm64) server_url='@ARM64_SERVER_URL@'; server_sha='@ARM64_SERVER_SHA@'; tools_url='@ARM64_TOOLS_URL@'; tools_sha='@ARM64_TOOLS_SHA@' ;;
-      *) fail 'Unsupported Valkey architecture' ;;
-    esac
-    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "$server_url" -o "$scratch/valkey-server.deb"
-    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "$tools_url" -o "$scratch/valkey-tools.deb"
-    (cd "$scratch"; printf '%s  %s\n' "$server_sha" valkey-server.deb "$tools_sha" valkey-tools.deb | sha256sum --strict -c -)
-    for package in valkey-server valkey-tools; do
-      [[ "$(dpkg-deb -f "$scratch/$package.deb" Package)" == "$package" ]] || fail 'Valkey artifact package mismatch'
-      [[ "$(dpkg-deb -f "$scratch/$package.deb" Version)" == '@VALKEY@-1.noble' ]] || fail 'Valkey artifact version mismatch'
-      [[ "$(dpkg-deb -f "$scratch/$package.deb" Architecture)" == "$ARCH" ]] || fail 'Valkey artifact architecture mismatch'
-    done
-    apt-get update
-    apt_install "$scratch/valkey-server.deb" "$scratch/valkey-tools.deb"
-    rm -rf -- "$scratch"
-  fi
-  [[ "$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\1/p')" == '@VALKEY@' ]] || fail 'Valkey version differs from policy'
-  [[ "$(valkey-cli --version)" == 'valkey-cli @VALKEY@' ]] || fail 'Valkey client version differs from policy'
-`;
-const state = String.raw`
-service_account_ready() {
-  local uid gid shell
-  uid="$(id -u stll-cloud)" || fail 'Service user is unavailable; run install'
-  gid="$(id -g stll-cloud)"
-  shell="$(getent passwd stll-cloud | cut -d: -f7)"
-  [[ "$uid" =~ ^[1-9][0-9]*$ && "$gid" =~ ^[1-9][0-9]*$ && "$shell" == /usr/sbin/nologin ]] || fail 'Service user must be unprivileged with no login shell'
-}
-prepare_state() {
-  service_account_ready
-  [[ ! -L /var/lib/stll-cloud ]] || fail 'Service state root must not be a symlink'
-  if [[ -e /var/lib/stll-cloud ]]; then
-    [[ -d /var/lib/stll-cloud && "$(stat -c '%u:%a' /var/lib/stll-cloud)" == 0:755 ]] || fail 'Invalid service state root'
-  else
-    install -d -m 755 -o root -g root /var/lib/stll-cloud
-  fi
-  STATE="/var/lib/stll-cloud/$(printf '%s' "$REPO_ROOT" | sha256sum | cut -d' ' -f1)"
-  [[ ! -L "$STATE" ]] || fail 'Service state must not be a symlink'
-  if [[ -e "$STATE" ]]; then
-    [[ -d "$STATE" && "$(stat -c '%u:%a' "$STATE")" == 0:710 && "$(stat -c '%g' "$STATE")" == "$(id -g stll-cloud)" ]] || fail 'Invalid service state ownership'
-  else
-    install -d -m 710 -o root -g stll-cloud "$STATE"
-  fi
-  [[ ! -L "$STATE/lock" ]] || fail 'Service lock must not be a symlink'
-  exec 9>"$STATE/lock"
-  flock -x -w 10 9 || fail 'Another setup process owns the service state'
-}
-`;
-const renderCloudServiceInstall = ({ services, postgres, valkey, valkeyArtifacts }) => {
-	const parts = services.map((service) => {
-		switch (service) {
-			case "postgres": return postgresInstall.replaceAll("@POSTGRES@", postgres).replaceAll("@PGDG_SOURCE@", postgresSourceLine).replaceAll("@PGDG_FINGERPRINT@", postgresSigningFingerprint);
-			case "valkey": {
-				const replacements = /* @__PURE__ */ new Map([
-					["@VALKEY@", valkey],
-					["@AMD64_SERVER_URL@", valkeyArtifacts.amd64.server.url],
-					["@AMD64_SERVER_SHA@", valkeyArtifacts.amd64.server.sha256],
-					["@AMD64_TOOLS_URL@", valkeyArtifacts.amd64.tools.url],
-					["@AMD64_TOOLS_SHA@", valkeyArtifacts.amd64.tools.sha256],
-					["@ARM64_SERVER_URL@", valkeyArtifacts.arm64.server.url],
-					["@ARM64_SERVER_SHA@", valkeyArtifacts.arm64.server.sha256],
-					["@ARM64_TOOLS_URL@", valkeyArtifacts.arm64.tools.url],
-					["@ARM64_TOOLS_SHA@", valkeyArtifacts.arm64.tools.sha256]
-				]);
-				return valkeyInstall.replace(/@[A-Z0-9_]+@/g, (token) => {
-					const value = replacements.get(token);
-					if (value === void 0) throw new Error(`Missing Valkey artifact field: ${token}`);
-					return value;
-				});
-			}
-			default: throw new Error(`Unsupported service: ${String(service)}`);
-		}
-	});
-	const user = services.length === 0 ? "" : "  if ! id stll-cloud >/dev/null 2>&1; then useradd --system --user-group --no-create-home --shell /usr/sbin/nologin stll-cloud; fi\n  service_account_ready\n";
-	return `${packageInstall}\n${services.includes("postgres") ? postgresSources.replaceAll("@PGDG_FINGERPRINT@", postgresSigningFingerprint) : ""}\n${services.length === 0 ? "prepare_state() { :; }\n" : state}\ninstall_services() {\n${user}${parts.join("")}\n  :\n}\n`;
-};
+import picomatch from "picomatch";
+import { parse as parse$2 } from "smol-toml";
 //#endregion
-//#region src/cloud-setup-schema.ts
-const cloudServices = ["postgres", "valkey"];
-const cloudInstallCommand = "bun install --frozen-lockfile";
-const cloudService = (value) => cloudServices.some((service) => value === service);
-/** Parse an explicit declaration without assuming services for undeclared repositories. */
-const parseCloudSetup = (input) => {
-	if (input === void 0) return void 0;
-	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error("cloud must be an object");
-	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile") throw new Error(`unsupported cloud key: ${key}`);
-	const selected = "services" in input ? input.services : [];
-	if (!Array.isArray(selected)) throw new Error("cloud.services must be an array when provided");
-	if (!("install" in input) || input.install !== "bun install --frozen-lockfile") throw new Error(`cloud.install must be exactly ${cloudInstallCommand}`);
-	const seen = /* @__PURE__ */ new Set();
-	const services = Array.from(selected, (service) => {
-		if (!cloudService(service)) throw new Error("cloud.services contains an unsupported service");
-		if (seen.has(service)) throw new Error(`cloud.services contains duplicate service: ${service}`);
-		seen.add(service);
-		return service;
-	});
-	if (services.length === 0) {
-		if ("envFile" in input) throw new Error("cloud.envFile is not allowed without services");
-		return {
-			services,
-			install: cloudInstallCommand
-		};
+//#region src/toolchain-consumer-checks.ts
+const consumerRunnerVersion = "0.14.1";
+const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
+const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {
+	const code = character.charCodeAt(0);
+	return code < 32 || code === 127;
+}) && !/^[A-Za-z]:/.test(value) && !path.posix.isAbsolute(value) && (value === "." || value.split("/").every((part) => part !== "" && part !== "." && part !== ".."));
+const packageDirectories = (value) => Array.isArray(value) && value.length > 0 && value.every(repositoryDirectory) && new Set(value).size === value.length;
+const cronFields = [
+	{
+		minimum: 0,
+		maximum: 59
+	},
+	{
+		minimum: 0,
+		maximum: 23
+	},
+	{
+		minimum: 1,
+		maximum: 31
+	},
+	{
+		minimum: 1,
+		maximum: 12,
+		names: Object.fromEntries([
+			"JAN",
+			"FEB",
+			"MAR",
+			"APR",
+			"MAY",
+			"JUN",
+			"JUL",
+			"AUG",
+			"SEP",
+			"OCT",
+			"NOV",
+			"DEC"
+		].map((name, index) => [name, index + 1]))
+	},
+	{
+		minimum: 0,
+		maximum: 6,
+		names: Object.fromEntries([
+			"SUN",
+			"MON",
+			"TUE",
+			"WED",
+			"THU",
+			"FRI",
+			"SAT"
+		].map((name, index) => [name, index]))
 	}
-	if (!("envFile" in input) || typeof input.envFile !== "string") throw new Error("cloud.envFile must be a canonical repository-relative path");
-	const envFile = input.envFile;
-	if (envFile.startsWith("/") || /^[A-Za-z]:/.test(envFile) || envFile.includes("\\") || /\p{Cc}/u.test(envFile) || envFile.split("/").some((part) => part === "" || part === "." || part === "..")) throw new Error("cloud.envFile must be a canonical repository-relative path");
-	return {
-		services,
-		install: cloudInstallCommand,
-		envFile
+];
+const cronFieldValues = (text, field) => {
+	const value = (token) => {
+		const number = /^\d+$/.test(token) ? Number(token) : field.names?.[token.toUpperCase()];
+		return number !== void 0 && Number.isSafeInteger(number) && number >= field.minimum && number <= field.maximum ? number : void 0;
 	};
-};
-//#endregion
-//#region src/cloud-setup-services.ts
-const common = String.raw`
-service_file() {
-  local file="$1" owner="$2"
-  [[ ! -L "$file" ]] || fail "Service state must not contain symbolic links"
-  if [[ -e "$file" ]]; then
-    [[ -f "$file" && "$(stat -c '%u:%a' "$file")" == "$owner:600" ]] || fail "Invalid service state file"
-  fi
-}
-service_directory() {
-  local directory="$1"
-  [[ ! -L "$directory" ]] || fail "Service directory must not be a symbolic link"
-  if [[ -e "$directory" ]]; then
-    [[ -d "$directory" && "$(stat -c '%u:%a' "$directory")" == "$SERVICE_UID:700" ]] || fail "Invalid service directory"
-  else
-    root install -d -m 700 -o stll-cloud -g stll-cloud "$directory"
-  fi
-}
-service_password() {
-  local file="$1"
-  service_file "$file" 0
-  if [[ ! -e "$file" ]]; then
-    (umask 077; openssl rand -hex 32 > "$file")
-    root chown root:root "$file"
-  fi
-  [[ "$(cat "$file")" =~ ^[0-9a-f]{64}$ ]] || fail "Invalid service credential state"
-}
-service_process_matches() {
-  local pid="$1" executable="$2" owner actual expected
-  [[ "$pid" =~ ^[1-9][0-9]*$ && -d "/proc/$pid" ]] || return 1
-  owner="$(stat -c '%u' "/proc/$pid" 2>/dev/null)" || return 2
-  [[ "$owner" =~ ^[0-9]+$ ]] || return 2
-  [[ "$owner" == "$SERVICE_UID" ]] || return 1
-  actual="$(readlink -f "/proc/$pid/exe" 2>/dev/null)" || return 2
-  expected="$(readlink -f "$executable")" || return 2
-  [[ -n "$actual" && -n "$expected" && "$actual" != *' (deleted)' ]] || return 2
-  [[ "$actual" == "$expected" ]]
-}
-service_process() {
-  service_process_matches "$1" "$2" || fail "Managed service process identity differs from the recorded state"
-}
-service_prune_pid() {
-  local file="$1" executable="$2" service="$3" pid identity
-  [[ -e "$file" ]] || return 0
-  pid="$(head -n 1 "$file")"
-  # PostgreSQL encodes a standalone backend with a negative PID.
-  if [[ "$service" == postgres ]]; then pid="$(printf '%s' "$pid" | sed 's/^-//')"; fi
-  if service_process_matches "$pid" "$executable"; then return 0; else identity=$?; fi
-  [[ "$identity" != 2 ]] || fail "Cannot verify recorded live service process; retaining its PID file"
-  # Let PostgreSQL check orphan shared memory before removing a dead-PID lock.
-  if [[ "$service" == postgres && "$pid" =~ ^[1-9][0-9]*$ && ! -d "/proc/$pid" ]]; then return 0; fi
-  if [[ "$service" == postgres ]]; then
-    [[ "$pid" =~ ^[1-9][0-9]*$ && "$SERVICE_UID" != 0 ]] || fail "Cannot safely recover PostgreSQL PID state"
-    # The root controller is not our nonroot postgres. Preserve the remaining
-    # lock rows so PostgreSQL's EPERM/ancestor path still checks orphan memory.
-    root sed -i "1s/.*/$$/" "$file"
-    return 0
-  fi
-  # Restored state can name an unrelated live process; never signal that PID.
-  root rm -- "$file"
-}
-`;
-const postgresStart = String.raw`
-  local pg_bin='/usr/lib/postgresql/@POSTGRES@/bin' pg_data="$STATE/postgres" pg_password pg_details pg_pid pg_version
-  service_password "$STATE/postgres.password"
-  pg_password="$(cat "$STATE/postgres.password")"
-  service_directory "$pg_data"
-  for file in PG_VERSION postmaster.pid postgresql.conf pg_hba.conf pg_ident.conf postgresql.auto.conf; do
-    service_file "$pg_data/$file" "$SERVICE_UID"
-  done
-  if [[ ! -e "$pg_data/PG_VERSION" ]]; then
-    [[ -z "$(ls -A "$pg_data")" ]] || fail "PostgreSQL data directory is not initialized"
-    service_file "$STATE/postgres.init-password" "$SERVICE_UID"
-    (umask 077; printf '%s\n' "$pg_password" > "$STATE/postgres.init-password")
-    root chown stll-cloud:stll-cloud "$STATE/postgres.init-password"
-    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/initdb" -D "$pg_data" --username=stll_cloud --auth-host=scram-sha-256 --auth-local=scram-sha-256 --pwfile="$STATE/postgres.init-password" --encoding=UTF8 --locale=C --set=unix_socket_directories= >/dev/null || fail "PostgreSQL initialization failed"
-    root rm "$STATE/postgres.init-password"
-  fi
-  [[ -f "$pg_data/PG_VERSION" && "$(cat "$pg_data/PG_VERSION")" == '@POSTGRES@' ]] || fail "PostgreSQL data has a different major version"
-  service_prune_pid "$pg_data/postmaster.pid" "$pg_bin/postgres" postgres
-  if ! service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/pg_ctl" -D "$pg_data" status >/dev/null 2>&1; then
-    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 "$pg_bin/pg_ctl" -D "$pg_data" -l "$pg_data/cloud.log" -o "-h 127.0.0.1 -p 55432 -c unix_socket_directories=" -t 10 -w start >/dev/null || fail "PostgreSQL start failed; port 55432 must be available"
-  fi
-  pg_details="$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/psql" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c "SELECT current_setting('data_directory'), current_setting('listen_addresses'), current_setting('port'), current_setting('server_version_num'), current_setting('unix_socket_directories')")" || fail "PostgreSQL authenticated readiness failed"
-  pg_version="$(printf '%s\n' "$pg_details" | cut -d '|' -f4)"
-  [[ "$pg_details" == "$pg_data|127.0.0.1|55432|$pg_version|" && "$pg_version" =~ ^[0-9]{6}$ ]] || fail "PostgreSQL endpoint does not match managed data and listener"
-  (( pg_version / 10000 == @POSTGRES@ )) || fail "PostgreSQL endpoint has a different major version"
-  pg_pid="$(head -n 1 "$pg_data/postmaster.pid")"
-  service_process "$pg_pid" "$pg_bin/postgres"
-  [[ "$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/psql" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c "SELECT count(*) FROM pg_database WHERE datname = 'cloud_test'")" == 1 ]] || env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD="$pg_password" PGCONNECT_TIMEOUT=2 "$pg_bin/createdb" -h 127.0.0.1 -p 55432 -U stll_cloud cloud_test || fail "PostgreSQL test database creation failed"
-  DATABASE_URL="postgresql://stll_cloud:$pg_password@127.0.0.1:55432/cloud_test"
-`;
-const valkeyStart = String.raw`
-  local vk_data="$STATE/valkey" vk_password vk_config vk_info vk_pid vk_expected ready=0
-  service_password "$STATE/valkey.password"
-  vk_password="$(cat "$STATE/valkey.password")"
-  service_directory "$vk_data"
-  vk_config="$vk_data/valkey.conf"
-  service_file "$vk_config" "$SERVICE_UID"
-  for file in valkey.pid valkey.log dump.rdb; do
-    [[ ! -L "$vk_data/$file" ]] || fail "Valkey state must not contain symbolic links"
-    if [[ -e "$vk_data/$file" ]]; then
-      [[ -f "$vk_data/$file" && "$(stat -c '%u' "$vk_data/$file")" == "$SERVICE_UID" ]] || fail "Invalid Valkey state file"
-    fi
-  done
-  vk_expected="$(printf '%s\n' 'bind 127.0.0.1' 'port 56379' 'protected-mode yes' 'daemonize yes' "requirepass $vk_password" "dir $vk_data" "pidfile $vk_data/valkey.pid" "logfile $vk_data/valkey.log" 'save ""' 'appendonly no')"
-  if [[ ! -e "$vk_config" ]]; then
-    (umask 077; printf '%s\n' "$vk_expected" > "$vk_config")
-    root chown stll-cloud:stll-cloud "$vk_config"
-  fi
-  [[ "$(cat "$vk_config")" == "$vk_expected" ]] || fail "Valkey configuration differs from managed settings"
-  service_prune_pid "$vk_data/valkey.pid" "$(command -v valkey-server)" valkey
-  if [[ ! -e "$vk_data/valkey.pid" ]]; then
-    service_run valkey-server "$vk_config" || fail "Valkey start failed; port 56379 must be available"
-  fi
-  for ((attempt=0; attempt<20; attempt++)); do
-    if vk_info="$(VALKEYCLI_AUTH="$vk_password" timeout 0.2 valkey-cli -h 127.0.0.1 -p 56379 --raw INFO server 2>/dev/null)"; then
-      if [[ "$vk_info" == *$'valkey_version:@VALKEY@\r\n'* && "$vk_info" == *"config_file:$vk_config"$'\r\n'* ]]; then ready=1; break; fi
-    fi
-    sleep 0.25
-  done
-  [[ "$ready" == 1 ]] || fail "Valkey authenticated readiness or managed version/configuration check failed"
-  [[ -f "$vk_data/valkey.pid" ]] || fail "Valkey managed process identifier is unavailable"
-  vk_pid="$(cat "$vk_data/valkey.pid")"
-  service_process "$vk_pid" "$(command -v valkey-server)"
-  [[ "$vk_info" == *"process_id:$vk_pid"$'\r\n'* ]] || fail "Valkey endpoint has a different process identifier"
-  [[ "$(VALKEYCLI_AUTH="$vk_password" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET bind)" == $'bind\n127.0.0.1' ]] || fail "Valkey endpoint must bind only loopback"
-  [[ "$(VALKEYCLI_AUTH="$vk_password" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET dir)" == "$(printf 'dir\n%s' "$vk_data")" ]] || fail "Valkey endpoint has a different data directory"
-  REDIS_URL="redis://:$vk_password@127.0.0.1:56379/0"
-`;
-/** Render only declared services; installation and environment-file ownership stay with the caller. */
-const renderCloudServiceStart = ({ services, postgres, valkey }) => {
-	if (!/^[1-9][0-9]*$/.test(postgres) || !/^\d+\.\d+\.\d+$/.test(valkey)) throw new Error("Invalid cloud service runtime policy");
-	if (services.length === 0) return "start_services() { :; }\n";
-	const bodies = services.map((service) => {
-		switch (service) {
-			case "postgres": return postgresStart.replaceAll("@POSTGRES@", postgres);
-			case "valkey": return valkeyStart.replaceAll("@VALKEY@", valkey);
-			default: throw new Error(`Unsupported cloud service: ${String(service)}`);
-		}
-	});
-	return `${common}\nstart_services() {\n  local SERVICE_UID file attempt\n  SERVICE_UID="$(id -u stll-cloud)"\n  [[ -d "$STATE" && ! -L "$STATE" && "$(stat -c '%u' "$STATE")" == 0 ]] || fail "Invalid cloud service state directory"\n${bodies.join("")}\n}\n`;
-};
-//#endregion
-//#region src/toolchain-node.ts
-const numericComponent = "(?:0|[1-9]\\d*)";
-const policyPattern = new RegExp(`^${numericComponent}\\.x$`);
-const selectorPattern = new RegExp(`^(${numericComponent})(?:\\.(?:x|${numericComponent}(?:\\.${numericComponent})?))?$`);
-/** A Node policy selects the complete stable release series of one major. */
-const nodePolicyValid = (value) => policyPattern.test(value) && validRange(value) !== null;
-/** Static selectors may narrow that series, but cannot float across majors. */
-const nodeSelectorMatches = (value, policy) => {
-	if (!nodePolicyValid(policy) || typeof value !== "string") return false;
-	const major = selectorPattern.exec(value)?.[1];
-	return major !== void 0 && major === policy.slice(0, -2) && validRange(value) !== null;
-};
-/** Engines must support every stable release in the approved major series. */
-const nodeSupportRangeMatches = (policy, range) => {
-	if (!nodePolicyValid(policy)) return false;
-	try {
-		return subset(policy, range);
-	} catch {
-		return false;
+	const values = /* @__PURE__ */ new Set();
+	for (const part of text.split(",")) {
+		const split = part.split("/");
+		if (split.length > 2) return void 0;
+		const [base, stepText] = split;
+		const step = stepText === void 0 ? 1 : Number(stepText);
+		if (stepText !== void 0 && !/^\d+$/.test(stepText)) return void 0;
+		if (!Number.isSafeInteger(step) || step <= 0 || base === void 0) return void 0;
+		const bounds = base.split("-");
+		if (bounds.length > 2) return void 0;
+		const lower = bounds.at(0);
+		if (lower === void 0) return void 0;
+		const start = base === "*" ? field.minimum : value(lower);
+		const upper = bounds.at(1);
+		let end = start;
+		if (base === "*" || bounds.length === 1 && stepText !== void 0) end = field.maximum;
+		else if (upper !== void 0) end = value(upper);
+		if (start === void 0 || end === void 0 || start > end) return void 0;
+		for (let selected = start; selected <= end; selected += step) values.add(selected);
 	}
+	return values;
 };
-//#endregion
-//#region src/cloud-setup.ts
-const cloudSetupPath = ".agents/cloud-setup.sh";
-const cloudEnvironmentMarker = "# Generated by stll-cloud-setup; disposable local test services.";
-const script = String.raw`#!/usr/bin/env bash
-# Generated by stll-cloud-setup. Regenerate with stll-cloud-setup.
-# Networked installation and offline service startup are separate lifecycle steps.
-# Cached filesystems may not preserve processes; run start at every session start.
-# Supported platform: Ubuntu 24.04 (noble), amd64/arm64, root or passwordless sudo.
-set -euo pipefail
-
-usage() { echo 'Usage: cloud-setup.sh install|start' >&2; exit 2; }
-[[ "$#" == 1 ]] || usage
-case "$1" in install|start) MODE="$1" ;; *) usage ;; esac
-fail() { echo "cloud-setup: $*" >&2; exit 1; }
-trap 'echo "cloud-setup: command failed at line $LINENO" >&2' ERR
-[[ -f /etc/os-release ]] || fail 'Ubuntu 24.04 is required'
-. /etc/os-release
-[[ "$ID" == ubuntu && "$VERSION_ID" == 24.04 && "$VERSION_CODENAME" == noble ]] || fail 'Only Ubuntu 24.04 (noble) is supported'
-SCRIPT="$(realpath -- "$0")"
-REPO_ROOT="$(cd -- "$(dirname -- "$SCRIPT")/.." && pwd -P)"
-[[ "$SCRIPT" == "$REPO_ROOT/.agents/cloud-setup.sh" ]] || fail 'Run the generated repository script'
-if [[ "$(id -u)" != 0 ]]; then
-  command -v sudo >/dev/null && sudo -n true || fail 'Root or passwordless sudo is required'
-  exec sudo -n -- bash "$SCRIPT" "$MODE"
-fi
-OUTPUT_UID="$(printenv SUDO_UID || id -u)"
-[[ "$OUTPUT_UID" =~ ^[0-9]+$ ]] || fail 'Invalid invoking user'
-OUTPUT_GID="$(getent passwd "$OUTPUT_UID" | cut -d: -f4)"
-[[ "$OUTPUT_GID" =~ ^[0-9]+$ ]] || fail 'Invoking user is unavailable'
-OUTPUT_USER="$(getent passwd "$OUTPUT_UID" | cut -d: -f1)"
-OUTPUT_HOME="$(getent passwd "$OUTPUT_UID" | cut -d: -f6)"
-[[ -n "$OUTPUT_USER" && "$OUTPUT_HOME" == /* && -d "$OUTPUT_HOME" ]] || fail 'Invoking user requires an existing home directory'
-root() { "$@"; }
-service_run() { runuser -u stll-cloud -- "$@" 9>&-; }
-BUN_VERSION='@BUN@'
-NODE_VERSION='@NODE@'
-NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
-BUN_DIR="/opt/stll-cloud/bun/$BUN_VERSION"
-export PATH="$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-BUN_CACHE="/var/cache/stll-cloud/bun/$OUTPUT_UID"
-@ENV_ASSIGNMENTS@
-[[ -f "$REPO_ROOT/.node-version" && ! -L "$REPO_ROOT/.node-version" ]] || fail 'A regular root .node-version is required'
-[[ "$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' "$REPO_ROOT/.node-version")" == "$NODE_VERSION" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'
-cd -- "$REPO_ROOT"
-case "$(uname -m)" in
-  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64 ;;
-  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64 ;;
-  *) fail 'Only amd64 and arm64 are supported' ;;
-esac
-
-runtime_ready() {
-  [[ -x "$NODE_DIR/bin/node" && "$($NODE_DIR/bin/node --version)" == "v$NODE_VERSION" ]] || fail 'Pinned Node is unavailable; run install'
-  [[ -x "$BUN_DIR/bun" && "$($BUN_DIR/bun --version)" == "$BUN_VERSION" ]] || fail 'Pinned Bun is unavailable; run install'
-}
-install_runtimes() {
-  if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null; then
-    apt-get update
-    DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux
-  fi
-  local scratch node_archive bun_archive bun_folder
-  scratch="$(mktemp -d)"
-  trap 'rm -rf -- "$scratch"' RETURN
-  if [[ ! -x "$NODE_DIR/bin/node" ]] || [[ "$($NODE_DIR/bin/node --version)" != "v$NODE_VERSION" ]]; then
-    node_archive="node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz"
-    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://nodejs.org/dist/v$NODE_VERSION/$node_archive" -o "$scratch/$node_archive"
-    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt" -o "$scratch/node-sums"
-    (cd "$scratch"; awk -v name="$node_archive" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' node-sums | sha256sum --strict -c -)
-    install -d -m 755 "$NODE_DIR"
-    tar -xJf "$scratch/$node_archive" --strip-components=1 -C "$NODE_DIR"
-  fi
-  if [[ ! -x "$BUN_DIR/bun" ]] || [[ "$($BUN_DIR/bun --version)" != "$BUN_VERSION" ]]; then
-    bun_folder="bun-linux-$BUN_ARCH"
-    bun_archive="$bun_folder.zip"
-    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/$bun_archive" -o "$scratch/$bun_archive"
-    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/SHASUMS256.txt" -o "$scratch/bun-sums"
-    (cd "$scratch"; awk -v name="$bun_archive" '$2 == name || $2 == "*" name { print $1 "  " name; count++ } END { if (count != 1) exit 1 }' bun-sums | sha256sum --strict -c -)
-    unzip -q "$scratch/$bun_archive" -d "$scratch/bun"
-    install -d -m 755 "$BUN_DIR"
-    install -m 755 "$scratch/bun/$bun_folder/bun" "$BUN_DIR/bun"
-  fi
-  runtime_ready
-  ln -sfnT -- "$NODE_DIR/bin/node" /usr/local/bin/node
-  ln -sfnT -- "$NODE_DIR/bin/npm" /usr/local/bin/npm
-  ln -sfnT -- "$NODE_DIR/bin/npx" /usr/local/bin/npx
-  ln -sfnT -- "$BUN_DIR/bun" /usr/local/bin/bun
-  rm -rf -- "$scratch"
-  trap - RETURN
-}
-
-dependency_install() {
-  local directory
-  for directory in /var/cache/stll-cloud /var/cache/stll-cloud/bun; do
-    [[ ! -L "$directory" ]] || fail 'Dependency cache parent must not be a symlink'
-    if [[ -e "$directory" ]]; then
-      [[ -d "$directory" && "$(stat -c '%u' "$directory")" == 0 ]] || fail 'Dependency cache parent must be root-owned'
-    fi
-    install -d -m 755 -o root -g root "$directory"
-  done
-  [[ ! -L "$BUN_CACHE" ]] || fail 'Dependency cache must not be a symlink'
-  if [[ -e "$BUN_CACHE" ]]; then
-    [[ -d "$BUN_CACHE" && "$(stat -c '%u' "$BUN_CACHE")" == "$OUTPUT_UID" ]] || fail 'Dependency cache ownership differs from the invoking user'
-  fi
-  install -d -m 700 -o "$OUTPUT_UID" -g "$OUTPUT_GID" "$BUN_CACHE"
-  runuser -u "$OUTPUT_USER" -- env HOME="$OUTPUT_HOME" BUN_INSTALL_CACHE_DIR="$BUN_CACHE" PATH="$PATH" "$BUN_DIR/bun" install --frozen-lockfile
-}
-
-@SERVICE_INSTALL@
-@SERVICE_START@
-
-@ENV_FUNCTIONS@
-
-if [[ "$MODE" == install ]]; then
-  install_runtimes
-  install_services
-  dependency_install
-  exit 0
-fi
-runtime_ready
-@ENV_VALIDATE@
-prepare_state
-start_services
-@ENV_WRITE@
-`;
-const environmentFunctions = String.raw`
-validate_environment() {
-  local part target="$REPO_ROOT" env_path="$REPO_ROOT/$ENV_FILE" first_line temporary
-  while IFS= read -r part; do
-    target="$target/$part"
-    [[ ! -L "$target" ]] || fail 'Environment path must not contain symbolic links'
-  done < <(printf '%s\n' "$ENV_FILE" | tr '/' '\n')
-  [[ -d "$(dirname -- "$env_path")" ]] || fail 'Environment parent directory is missing'
-  if [[ -e "$env_path" ]]; then
-    [[ -f "$env_path" ]] || fail 'Environment target must be a regular file'
-    IFS= read -r first_line < "$env_path" || fail 'Refusing to overwrite an unowned environment file'
-    [[ "$first_line" == "$ENV_MARKER" ]] || fail 'Refusing to overwrite an unowned environment file'
-  fi
-}
-write_environment() {
-  validate_environment
-  local env_path="$REPO_ROOT/$ENV_FILE" temporary
-  temporary="$(mktemp "$(dirname -- "$env_path")/.stll-cloud-env.XXXXXX")"
-  chmod 600 "$temporary"
-  {
-    printf '%s\n' "$ENV_MARKER" 'NODE_ENV=test'
-    if [[ -n "$DATABASE_URL" ]]; then printf 'DATABASE_URL=%s\n' "$DATABASE_URL"; fi
-    if [[ -n "$REDIS_URL" ]]; then printf 'REDIS_URL=%s\n' "$REDIS_URL"; fi
-  } > "$temporary"
-  chown "$OUTPUT_UID:$OUTPUT_GID" "$temporary"
-  mv -f -- "$temporary" "$env_path"
-}
-`;
-const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
-const generateCloudSetup = ({ policy, cloud, nodeVersion }) => {
-	const selected = parseCloudSetup(cloud);
-	if (selected === void 0) throw new Error("cloud declaration is required");
-	const exactNode = nodeVersion.trim();
-	if (valid(exactNode) !== exactNode || !nodeSelectorMatches(exactNode, policy.node)) throw new Error("cloud requires a tracked exact .node-version within the shared Node series");
-	const services = cloudServices.filter((service) => selected.services.includes(service));
-	const replacements = /* @__PURE__ */ new Map([
-		["@BUN@", policy.bun],
-		["@NODE@", exactNode],
-		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
-		["@ENV_FUNCTIONS@", selected.envFile === void 0 ? "" : environmentFunctions],
-		["@ENV_VALIDATE@", selected.envFile === void 0 ? "" : "DATABASE_URL=''\nREDIS_URL=''\nvalidate_environment"],
-		["@ENV_WRITE@", selected.envFile === void 0 ? "" : "write_environment"],
-		["@SERVICE_INSTALL@", renderCloudServiceInstall({
-			services,
-			postgres: policy.postgres,
-			valkey: policy.valkey,
-			valkeyArtifacts: policy.valkeyArtifacts
-		})],
-		["@SERVICE_START@", renderCloudServiceStart({
-			services,
-			postgres: policy.postgres,
-			valkey: policy.valkey
-		})]
-	]);
-	return script.replace(/@[A-Z0-9_]+@/g, (token) => {
-		const value = replacements.get(token);
-		if (value === void 0) throw new Error(`Missing cloud setup field: ${token}`);
-		return value;
+const validConsumerCron = (text) => {
+	const fields = text.trim().split(/\s+/);
+	return fields.length === cronFields.length && cronFields.every((field, index) => {
+		const fieldText = fields.at(index);
+		return fieldText !== void 0 && cronFieldValues(fieldText, field) !== void 0;
 	});
 };
-//#endregion
-//#region src/toolchain-container-inputs.ts
-const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** Filename class recognized by Dependabot's Docker Compose fetcher. */
-const isComposeDefinitionPath = (file) => /^\.?(?:docker-)?compose(?:-[\w]+)?(?:\.[\w-]+)?\.ya?ml$/i.test(file.split("/").at(-1) ?? "");
-/** Candidate YAML files are classified by their document shape after reading. */
-const isKubernetesDefinitionPath = (file) => /^[^.].*\.ya?ml$/i.test(file.split("/").at(-1) ?? "");
-const kubernetesPodSpecPaths = {
-	Pod: ["spec"],
-	Deployment: [
-		"spec",
-		"template",
-		"spec"
-	],
-	DaemonSet: [
-		"spec",
-		"template",
-		"spec"
-	],
-	StatefulSet: [
-		"spec",
-		"template",
-		"spec"
-	],
-	ReplicaSet: [
-		"spec",
-		"template",
-		"spec"
-	],
-	ReplicationController: [
-		"spec",
-		"template",
-		"spec"
-	],
-	Job: [
-		"spec",
-		"template",
-		"spec"
-	],
-	CronJob: [
-		"spec",
-		"jobTemplate",
-		"spec",
-		"template",
-		"spec"
-	]
-};
-/** Shared semantic image enumeration for runtime checks and update-root generation. */
-const containerDocumentImages = (document, file) => {
-	if (!record$6(document)) return void 0;
-	const services = document["services"];
-	if (isComposeDefinitionPath(file) && record$6(services)) {
-		const images = [];
-		for (const [name, service] of Object.entries(services)) if (record$6(service) && service["image"] !== void 0) images.push({
-			image: service["image"],
-			path: [
-				"services",
-				name,
-				"image"
-			]
+const nightlySchedule = (value) => {
+	if (!record$6(value)) return false;
+	const schedule = value["schedule"];
+	if (!Array.isArray(schedule) || schedule.length === 0) return false;
+	const coveredDays = /* @__PURE__ */ new Set();
+	for (const entry of schedule) {
+		if (!record$6(entry) || typeof entry["cron"] !== "string" || !validConsumerCron(entry["cron"])) return false;
+		const fields = entry["cron"].trim().split(/\s+/);
+		const selections = cronFields.map((field, index) => {
+			const text = fields.at(index);
+			return text === void 0 ? void 0 : cronFieldValues(text, field);
 		});
+		if (selections.at(2)?.size !== 31 || selections.at(3)?.size !== 12) continue;
+		for (const day of selections.at(4) ?? []) coveredDays.add(day);
+	}
+	return coveredDays.size === 7;
+};
+const parseConsumerChecks = (input) => {
+	if (input === void 0) return [];
+	if (!Array.isArray(input)) throw new Error("consumerChecks must be an array");
+	const targets = /* @__PURE__ */ new Set();
+	return input.map((entry) => {
+		if (!record$6(entry) || Object.keys(entry).some((key) => ![
+			"workflow",
+			"job",
+			"packages",
+			"toolingVersion",
+			"fixturePath"
+		].includes(key)) || typeof entry["workflow"] !== "string" || githubAutomationFileKind(entry["workflow"]) !== "workflow" || !/^\.github\/workflows\/[^/]+\.ya?ml$/.test(entry["workflow"]) || typeof entry["job"] !== "string" || !/^[A-Za-z_][A-Za-z0-9_-]*$/.test(entry["job"]) || !packageDirectories(entry["packages"]) || typeof entry["toolingVersion"] !== "string" || !/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/.test(entry["toolingVersion"]) || !repositoryDirectory(entry["fixturePath"])) throw new Error("consumerChecks requires canonical workflow, job, unique package directories, exact toolingVersion and repository-relative fixturePath");
+		const target = `${entry["workflow"]}:${entry["job"]}`;
+		if (targets.has(target)) throw new Error("consumerChecks targets must be unique");
+		targets.add(target);
 		return {
-			ecosystem: "docker-compose",
-			images
+			workflow: entry["workflow"],
+			job: entry["job"],
+			packages: entry["packages"],
+			toolingVersion: entry["toolingVersion"],
+			fixturePath: entry["fixturePath"]
 		};
-	}
-	if (typeof document["apiVersion"] !== "string" || typeof document["kind"] !== "string") return void 0;
-	const images = [];
-	const visited = /* @__PURE__ */ new Set();
-	const walkResource = (resource, prefix) => {
-		if (visited.has(resource)) return;
-		visited.add(resource);
-		if (typeof resource["apiVersion"] !== "string" || typeof resource["kind"] !== "string") return;
-		if (resource["kind"] === "List" && Array.isArray(resource["items"])) {
-			for (const [index, item] of resource["items"].entries()) if (record$6(item)) walkResource(item, [
-				...prefix,
-				"items",
-				index
-			]);
-			return;
-		}
-		const specPath = Object.entries(kubernetesPodSpecPaths).find(([kind]) => kind === resource["kind"])?.[1];
-		if (specPath === void 0) return;
-		let spec = resource;
-		for (const key of specPath) spec = record$6(spec) ? spec[key] : void 0;
-		if (!record$6(spec)) return;
-		for (const key of [
-			"containers",
-			"initContainers",
-			"ephemeralContainers"
-		]) {
-			const containers = spec[key];
-			if (!Array.isArray(containers)) continue;
-			for (const [index, container] of containers.entries()) if (record$6(container) && container["image"] !== void 0) images.push({
-				image: container["image"],
-				path: [
-					...prefix,
-					...specPath,
-					key,
-					index,
-					"image"
-				]
+	});
+};
+/** Consumer checks are scoped declarations, never general runtime exceptions. */
+const checkConsumerChecks = ({ declarations, files, policy }) => {
+	const diagnostics = [];
+	const exercised = /* @__PURE__ */ new Set();
+	const add = (message) => diagnostics.push({
+		rule: "configuration",
+		path: "stll-toolchain.json",
+		line: 1,
+		message
+	});
+	for (const [workflow, text] of Object.entries(files)) {
+		if (githubAutomationFileKind(workflow) !== "workflow") continue;
+		try {
+			const document = parseDocument(text, {
+				uniqueKeys: true,
+				merge: true
 			});
+			if (document.errors.length > 0) throw new Error("invalid workflow YAML");
+			const source = document.toJS({ maxAliasCount: 100 });
+			if (!record$6(source) || !record$6(source["jobs"])) continue;
+			for (const [jobName, job] of Object.entries(source["jobs"])) {
+				if (!record$6(job) || typeof job["uses"] !== "string") continue;
+				const [workflowPath, ref] = job["uses"].split("@");
+				if (workflowPath?.toLowerCase() !== "stella/.github/.github/workflows/package-consumer-compat.yml") continue;
+				const declaration = declarations.find((entry) => entry.workflow === workflow && entry.job === jobName);
+				if (declaration === void 0) {
+					add(`${workflow}:${jobName} requires a consumerChecks declaration`);
+					continue;
+				}
+				if (!nightlySchedule(source["on"])) throw new Error(`${workflow} consumer checks require a nonempty valid on.schedule covering every day`);
+				if ("if" in job || "needs" in job || "strategy" in job) throw new Error(`${workflow}:${jobName} consumer checks require a stand-alone unconditional reusable job without if or needs or strategy`);
+				exercised.add(declaration);
+				const approved = Object.entries(policy.actions).find(([name]) => name.toLowerCase() === consumerCheckWorkflow)?.[1];
+				if (job["uses"].split("@").length !== 2 || ref === void 0 || !/^[a-f0-9]{40}$/.test(ref) || approved === void 0 || ref !== approved.sha || "steps" in job || "runs-on" in job) throw new Error(`${workflow}:${jobName} must invoke the approved immutable consumer workflow as a reusable job`);
+				const inputs = job["with"];
+				if (!record$6(inputs)) throw new Error(`${workflow}:${jobName} requires consumer inputs`);
+				const names = /* @__PURE__ */ new Set();
+				for (const key of Object.keys(inputs)) {
+					const normalized = key.toLowerCase();
+					if (names.has(normalized) || ![
+						"packages",
+						"consumer-node",
+						"tooling-version",
+						"fixture-path"
+					].includes(normalized) || normalized !== key) throw new Error(`${workflow}:${jobName} requires unique canonical consumer input names`);
+					names.add(normalized);
+				}
+				if (inputs["consumer-node"] !== policy.consumerNode) throw new Error(`${workflow}:${jobName} consumer-node must be ${policy.consumerNode}`);
+				if (declaration.toolingVersion !== consumerRunnerVersion) throw new Error(`${workflow}:${jobName} toolingVersion must match installed @stll/oxlint-config ${consumerRunnerVersion}`);
+				if (inputs["tooling-version"] !== declaration.toolingVersion) throw new Error(`${workflow}:${jobName} tooling-version must match consumerChecks.toolingVersion`);
+				if (inputs["fixture-path"] !== declaration.fixturePath) throw new Error(`${workflow}:${jobName} fixture-path must match consumerChecks.fixturePath`);
+				const fixtureManifest = path.posix.join(declaration.fixturePath, "consumer-compat.json");
+				const fixtureSource = files[fixtureManifest];
+				if (fixtureSource === void 0) throw new Error(`consumerChecks fixture configuration must be tracked: ${fixtureManifest}`);
+				const fixtures = parseConsumerFixtures(JSON.parse(fixtureSource));
+				assertConsumerFixtureSelection({
+					selected: declaration.packages,
+					fixtures
+				});
+				const rawPackages = inputs["packages"];
+				if (typeof rawPackages !== "string") throw new Error(`${workflow}:${jobName} packages must be a static JSON array`);
+				const selected = JSON.parse(rawPackages);
+				if (!packageDirectories(selected) || selected.length !== declaration.packages.length || !selected.every((directory) => declaration.packages.includes(directory))) throw new Error(`${workflow}:${jobName} packages must exactly match consumerChecks`);
+				const workspacePackages = discoverConsumerPackages(files);
+				const packagesByDirectory = new Map([...workspacePackages.values()].map((entry) => [entry.directory, entry]));
+				for (const directory of declaration.packages) {
+					const manifestPath = path.posix.join(directory, "package.json");
+					if (files[manifestPath] === void 0) throw new Error(`consumerChecks package manifest must be tracked: ${manifestPath}`);
+					const selectedPackage = packagesByDirectory.get(directory);
+					if (selectedPackage === void 0) throw new Error(`consumerChecks package must be a discovered workspace member: ${manifestPath}`);
+					const fixture = fixtures.find((candidate) => candidate.package === directory);
+					if (fixture === void 0) throw new Error(`missing declared consumer fixture: ${directory}`);
+					assertConsumerFixtureKind({
+						fixture,
+						pkg: selectedPackage
+					});
+					const manifest = selectedPackage.manifest;
+					if (manifest["private"] === true || typeof manifest["name"] !== "string" || manifest["name"].trim() === "") throw new Error(`consumerChecks requires a named published package: ${manifestPath}`);
+					const closure = consumerPackageClosure({
+						selected: selectedPackage,
+						packages: workspacePackages,
+						files
+					});
+					for (const member of closure.values()) assertConsumerNodeSupport({
+						manifest: member.manifest,
+						node: policy.consumerNode,
+						label: path.posix.join(member.directory, "package.json")
+					});
+				}
+			}
+		} catch (error) {
+			if (declarations.some((entry) => entry.workflow === workflow) || text.toLowerCase().includes("stella/.github/.github/workflows/package-consumer-compat.yml")) add(error instanceof Error ? error.message : String(error));
 		}
-	};
-	walkResource(document, []);
-	return images.length === 0 ? void 0 : {
-		ecosystem: "docker",
-		images
-	};
+	}
+	for (const declaration of declarations) if (!exercised.has(declaration)) add(`${declaration.workflow}:${declaration.job} consumerChecks declaration has no matching reusable invocation`);
+	return diagnostics;
 };
 //#endregion
 //#region src/toolchain-images.ts
@@ -777,66 +257,6 @@ const canonicalDockerRuntime = (image) => {
 	return (registry === void 0 ? image : image.slice(registry.length + 1)).replace(/^library\//i, "");
 };
 //#endregion
-//#region src/toolchain-inputs.ts
-const excludedInputPath = (file) => file === "" || file.split("/").some((part) => part === "node_modules" || part === "vendor");
-const javascriptDependencyLockfiles = [
-	"bun.lock",
-	"package-lock.json",
-	"yarn.lock",
-	"pnpm-lock.yaml"
-];
-/** Match project, environment, local, and fragment filenames recognized by mise. */
-const isMiseConfigPath = (file) => !excludedInputPath(file) && (/(?:^|\/)\.?mise(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/config(?:\.[^./][^/]*)?\.toml$/.test(file) || /(?:^|\/)(?:\.?mise|\.config\/mise)\/conf\.d\/[^./][^/]*\.toml$/.test(file));
-/** GitHub action metadata may live at the repository root or in any directory. */
-const githubAutomationFileKind = (file) => {
-	if (file === "") return void 0;
-	if (/^\.github\/workflows\/[^/]+\.ya?ml$/.test(file)) return "workflow";
-	if (/(?:^|\/)action\.ya?ml$/.test(file)) return "action";
-};
-/** Dependabot updates workflows and repository-root action metadata. */
-const isDependabotGithubActionsPath = (file) => {
-	const kind = githubAutomationFileKind(file);
-	return kind === "workflow" || kind === "action" && !file.includes("/");
-};
-/** Use one filename discriminator for reader selection and Python ecosystem decisions. */
-const pythonDependencyManifestKind = (file) => {
-	if (excludedInputPath(file)) return void 0;
-	const name = file.split("/").at(-1);
-	if (name === "pyproject.toml") return "project";
-	if (name === "Pipfile") return "pipfile";
-	if (name === "Pipfile.lock") return "pipfile-lock";
-	if (name === "setup.py" || name === "setup.cfg") return "setup";
-	if (name !== void 0 && /^requirements[^/]*\.(?:txt|in)$/.test(name)) return "requirements";
-};
-const isPythonDependencyManifest = (file) => pythonDependencyManifestKind(file) !== void 0;
-/** Docker definition names use dot-delimited variants, excluding source and documentation. */
-const isDockerDefinitionPath = (file) => {
-	if (excludedInputPath(file)) return false;
-	const name = file.split("/").at(-1) ?? "";
-	if (/\.(?:[cm]?[jt]sx?|mdx?|rst|txt|html?|py|rs|go|java|sh|c|cc|cpp|cxx|h|hpp|cs|rb|php|swift|kt|css|scss)$/i.test(name)) return false;
-	return /^(?:[^./]+\.)*(?:dockerfile|containerfile)(?:\.[^./]+)*$/i.test(name);
-};
-/** Lockfiles establish ecosystem presence without reading their dependency graphs. */
-const toolchainInputKind = (file) => {
-	if (file === ".agents/cloud-setup.sh") return "config";
-	if (githubAutomationFileKind(file) !== void 0) return "config";
-	if (excludedInputPath(file)) return void 0;
-	if (pythonDependencyManifestKind(file) === "pipfile-lock" || javascriptDependencyLockfiles.some((name) => file.split("/").at(-1) === name) || /(?:^|\/)uv\.lock$/.test(file)) return "presence";
-	if (githubAutomationFileKind(file) !== void 0 || isMiseConfigPath(file) || isPythonDependencyManifest(file) || isDockerDefinitionPath(file) || isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file) || /(?:^|\/)(?:package\.json|pnpm-workspace\.yaml|stll-toolchain\.json|\.bun-version|\.node-version|\.nvmrc|\.python-version|rust-toolchain(?:\.toml)?|\.tool-versions|\.?mise\.toml|uv\.toml|\.uv\.toml|\.github\/dependabot\.ya?ml|Cargo\.toml)$/.test(file)) return "config";
-};
-//#endregion
-//#region src/toolchain-workspaces.ts
-/** Match manifest directories with the same positive and negative workspace patterns. */
-const workspaceContains = ({ directory, file, patterns, rootMembership }) => {
-	const relative = path.posix.relative(directory, path.posix.dirname(file));
-	if (relative === "" && rootMembership === "implicit") return true;
-	if (relative === ".." || relative.startsWith("../")) return false;
-	if (!Array.isArray(patterns)) return false;
-	const normalize = (pattern) => path.posix.normalize(pattern);
-	const selected = patterns.filter((value) => typeof value === "string");
-	return picomatch(selected.filter((pattern) => !pattern.startsWith("!")).map(normalize))(relative) && !picomatch(selected.filter((pattern) => pattern.startsWith("!")).map((pattern) => normalize(pattern.slice(1))))(relative);
-};
-//#endregion
 //#region src/toolchain-dependabot.ts
 const dependabotRules = ["dependabot-policy"];
 const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -893,7 +313,7 @@ const workspaceRoots = (files, ecosystem) => {
 			}
 		}
 		try {
-			const parsed = ecosystem === "npm" ? JSON.parse(files[file] ?? "") : parse(files[file] ?? "");
+			const parsed = ecosystem === "npm" ? JSON.parse(files[file] ?? "") : parse$2(files[file] ?? "");
 			if (!record$5(parsed)) continue;
 			if (ecosystem === "npm" && typeof parsed["packageManager"] === "string" && parsed["packageManager"].startsWith("pnpm@")) continue;
 			const value = workspaceTable(parsed, ecosystem);
@@ -949,8 +369,8 @@ const workspaceRoots = (files, ecosystem) => {
 			if (includes.some((pattern) => picomatch.isMatch(relative, pattern)) && !excludes.some((pattern) => picomatch.isMatch(relative, pattern.slice(1)))) memberDirectories.add(directory);
 		}
 		for (const directory of memberDirectories) try {
-			const parsed = parse(files[path.posix.join(directory, "Cargo.toml")] ?? "");
-			const workspace = parse(files[path.posix.join(root, "Cargo.toml")] ?? "")["workspace"];
+			const parsed = parse$2(files[path.posix.join(directory, "Cargo.toml")] ?? "");
+			const workspace = parse$2(files[path.posix.join(root, "Cargo.toml")] ?? "")["workspace"];
 			const inherited = record$5(workspace) ? workspace["dependencies"] : void 0;
 			const dependencyOwners = [parsed];
 			const targets = parsed["target"];
@@ -1007,7 +427,7 @@ const pythonEcosystem = (file, files) => {
 	if (files[path.posix.join(root, "uv.lock")] !== void 0 || files[path.posix.join(root, "uv.toml")] !== void 0) return "uv";
 	const pyproject = files[path.posix.join(root, "pyproject.toml")];
 	if (pyproject !== void 0) try {
-		const tool = parse(pyproject)["tool"];
+		const tool = parse$2(pyproject)["tool"];
 		if (record$5(tool) && record$5(tool["uv"])) return "uv";
 	} catch {}
 	return "pip";
@@ -1160,8 +580,57 @@ const checkDependabot = ({ files, policy }) => {
 	return diagnostics;
 };
 //#endregion
-//#region src/toolchain-engine-floors.ts
+//#region src/toolchain-dynamic-selectors.ts
+const locatorValidators = {
+	image: /^(?:jobs\.[\w-]+\.(?:container|services\.[\w-]+)|services\.[\w.-]+\.image)$/,
+	"bun-source": /^(?:jobs\.[\w-]+|runs)\.steps\.[\w-]+$/
+};
+const knownKind = (value) => typeof value === "string" && Object.hasOwn(locatorValidators, value);
 const record$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** One reviewed declaration identifies one unresolved selector, never a rule. */
+const parseDynamicSelectors = (input) => {
+	if (input === void 0) return [];
+	if (!Array.isArray(input)) throw new Error("dynamicSelectors must be an array");
+	const result = [];
+	const keys = /* @__PURE__ */ new Set();
+	for (const entry of input) {
+		if (!record$4(entry) || Object.keys(entry).some((key) => ![
+			"path",
+			"kind",
+			"reason",
+			"at",
+			"line"
+		].includes(key)) || typeof entry["path"] !== "string" || entry["path"] === "" || /[\\:$*?]|[^\S ]/.test(entry["path"]) || entry["path"].split("/").some((part) => part === "" || part === "." || part === "..") || typeof entry["reason"] !== "string" || entry["reason"].trim() === "") throw new Error("each dynamic selector requires an exact repository path, known kind and nonempty reason");
+		const kind = entry["kind"];
+		if (!knownKind(kind)) throw new Error("unknown dynamic selector kind");
+		let selector;
+		if (Object.hasOwn(entry, "line") && !Object.hasOwn(entry, "at") && typeof entry["line"] === "number" && Number.isSafeInteger(entry["line"]) && entry["line"] > 0) selector = {
+			path: entry["path"],
+			kind,
+			reason: entry["reason"],
+			line: entry["line"]
+		};
+		else if (!Object.hasOwn(entry, "line") && typeof entry["at"] === "string" && locatorValidators[kind].test(entry["at"])) selector = {
+			path: entry["path"],
+			kind,
+			reason: entry["reason"],
+			at: entry["at"]
+		};
+		else throw new Error("dynamic selector requires one positive line or a kind-specific job/service/step ID locator");
+		const key = JSON.stringify([
+			selector.path,
+			selector.kind,
+			selector.at ?? selector.line
+		]);
+		if (keys.has(key)) throw new Error("dynamic selector locations must be unique");
+		keys.add(key);
+		result.push(selector);
+	}
+	return result;
+};
+//#endregion
+//#region src/toolchain-engine-floors.ts
+const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryPath = (value) => typeof value === "string" && value !== "" && !/^[A-Za-z]:/.test(value) && !/[\\\s]/.test(value) && !Array.from(value).some((character) => character.charCodeAt(0) < 32) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
 const parseEngineFloors = (input) => {
 	if (input === void 0) return [];
@@ -1169,7 +638,7 @@ const parseEngineFloors = (input) => {
 	const result = [];
 	const jobs = /* @__PURE__ */ new Set();
 	for (const entry of input) {
-		if (!record$4(entry) || Object.keys(entry).some((key) => ![
+		if (!record$3(entry) || Object.keys(entry).some((key) => ![
 			"package",
 			"workflow",
 			"job"
@@ -1190,16 +659,16 @@ const resolveEngineFloor = (entry, files) => {
 	const workflowText = files[entry.workflow];
 	if (manifestText === void 0 || workflowText === void 0) throw new Error("engine floor package and workflow must be tracked");
 	const manifest = JSON.parse(manifestText);
-	if (!record$4(manifest) || manifest["private"] === true || typeof manifest["name"] !== "string" || manifest["name"].trim() === "" || !record$4(manifest["engines"]) || typeof manifest["engines"]["node"] !== "string") throw new Error("engine floor package must be published and declare engines.node");
+	if (!record$3(manifest) || manifest["private"] === true || typeof manifest["name"] !== "string" || manifest["name"].trim() === "" || !record$3(manifest["engines"]) || typeof manifest["engines"]["node"] !== "string") throw new Error("engine floor package must be published and declare engines.node");
 	const range = manifest["engines"]["node"];
 	const minimum = validRange(range) === null ? null : minVersion(range);
 	if (minimum === null || minimum.prerelease.length !== 0) throw new Error("engine floor engines.node must declare a stable minimum");
 	const document = parseDocument(workflowText, { merge: true });
 	if (document.errors.length !== 0) throw new Error("engine floor workflow must be valid YAML");
 	const workflow = document.toJS({ maxAliasCount: 100 });
-	if (!record$4(workflow) || !record$4(workflow["jobs"])) throw new Error("engine floor job must exist in its tracked workflow");
+	if (!record$3(workflow) || !record$3(workflow["jobs"])) throw new Error("engine floor job must exist in its tracked workflow");
 	const job = workflow["jobs"][entry.job];
-	if (!record$4(job)) throw new Error("engine floor job must exist in its tracked workflow");
+	if (!record$3(job)) throw new Error("engine floor job must exist in its tracked workflow");
 	if (!Array.isArray(job["steps"]) || Object.hasOwn(job, "uses")) throw new Error("engine floor job must declare steps and cannot reuse a workflow");
 	return {
 		...entry,
@@ -1219,7 +688,7 @@ const packageRules = [
 	"typescript-layout",
 	"node-engine"
 ];
-const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const shellSubstitutions = (command) => {
 	const frames = [{
 		kind: "root",
@@ -1284,7 +753,7 @@ const compilerCommandSegments = (command) => {
 	const segments = [[]];
 	for (const source of [command, ...shellSubstitutions(command)]) {
 		segments.push([]);
-		const shellWords = source.match(/(?:[^\s"'\\;&|()]|\\[^\n]|"(?:[^"\\]|\\.)*"|'[^']*')+|&&|\|\||[();&|\n]/g);
+		const shellWords = source.match(/(?:[^\s"'\\;&|()]|\\[\s\S]|"(?:[^"\\]|\\[\s\S])*"|'[^']*')+|&&|\|\||[();&|\n]/g);
 		for (const word of shellWords ?? []) if (/^(?:&&|\|\||[;&|\n])$/.test(word)) segments.push([]);
 		else segments.at(-1)?.push(word);
 	}
@@ -1371,29 +840,29 @@ const launcherValueOptions = new Map(Object.entries({
 		"--input-type"
 	]
 }).map(([launcher, options]) => [launcher, new Set(options)]));
-const invokesCompiler = (words) => {
-	const literal = (word) => {
-		let result = "";
-		let quote;
-		for (let index = 0; index < word.length; index += 1) {
-			const character = word.at(index);
-			if (character === quote) {
-				quote = void 0;
-				continue;
-			}
-			if (quote === void 0 && (character === "'" || character === "\"")) {
-				quote = character;
-				continue;
-			}
-			const next = word.at(index + 1);
-			if (character === "\\" && next !== void 0 && quote !== "'" && (quote === void 0 || /[$`"\\\n]/.test(next))) {
-				result += next;
-				index += 1;
-			} else result += character;
+const decodeShellWord = (word) => {
+	let result = "";
+	let quote;
+	for (let index = 0; index < word.length; index += 1) {
+		const character = word.at(index);
+		if (character === quote) {
+			quote = void 0;
+			continue;
 		}
-		return result;
-	};
-	const tokens = words.map(literal);
+		if (quote === void 0 && (character === "'" || character === "\"")) {
+			quote = character;
+			continue;
+		}
+		const next = word.at(index + 1);
+		if (character === "\\" && next !== void 0 && quote !== "'" && (quote === void 0 || /[$`"\\\n]/.test(next))) {
+			if (next !== "\n") result += next;
+			index += 1;
+		} else result += character;
+	}
+	return result;
+};
+const invokesCompiler = (words) => {
+	const tokens = words.map(decodeShellWord);
 	const compiler = (word) => /(?:^|\/)(?:tsc|tsgo)(?:\.js)?$/.test(word);
 	let start = 0;
 	const skipOptions = (index, launcher) => {
@@ -1450,10 +919,10 @@ const checkPackageFiles = ({ files, policy }) => {
 			const document = pnpm ? parseDocument(text, { lineCounter }) : void 0;
 			if (document !== void 0 && document.errors.length > 0) throw new Error("invalid YAML");
 			const json = document === void 0 ? JSON.parse(text) : document.toJS();
-			if (!record$3(json)) throw new Error("manifest must be an object");
+			if (!record$2(json)) throw new Error("manifest must be an object");
 			if (pnpm) {
-				if (json["catalog"] !== void 0 && !record$3(json["catalog"])) throw new Error("catalog must be a mapping");
-				if (json["catalogs"] !== void 0 && (!record$3(json["catalogs"]) || Object.values(json["catalogs"]).some((catalog) => !record$3(catalog)))) throw new Error("named catalogs must be mappings");
+				if (json["catalog"] !== void 0 && !record$2(json["catalog"])) throw new Error("catalog must be a mapping");
+				if (json["catalogs"] !== void 0 && (!record$2(json["catalogs"]) || Object.values(json["catalogs"]).some((catalog) => !record$2(catalog)))) throw new Error("named catalogs must be mappings");
 				if (json["packages"] !== void 0 && (!Array.isArray(json["packages"]) || !json["packages"].every((pattern) => typeof pattern === "string"))) throw new Error("workspace packages must be patterns");
 			}
 			manifests.set(file, json);
@@ -1467,13 +936,13 @@ const checkPackageFiles = ({ files, policy }) => {
 					catalog: json["overrides"],
 					prefix: ["overrides"]
 				},
-				...record$3(json["catalogs"]) ? Object.entries(json["catalogs"]).map(([name, catalog]) => ({
+				...record$2(json["catalogs"]) ? Object.entries(json["catalogs"]).map(([name, catalog]) => ({
 					catalog,
 					prefix: ["catalogs", name]
 				})) : []
 			];
 			for (const { catalog, prefix } of catalogEntries) {
-				if (!record$3(catalog)) continue;
+				if (!record$2(catalog)) continue;
 				for (const [name, value] of Object.entries(catalog)) {
 					const node = document.getIn([...prefix, name], true);
 					if (!isNode(node) || node.range === void 0 || node.range === null) continue;
@@ -1492,7 +961,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			});
 		}
 	}
-	const catalogSources = (json) => [json, ...record$3(json["workspaces"]) ? [json["workspaces"]] : []];
+	const catalogSources = (json) => [json, ...record$2(json["workspaces"]) ? [json["workspaces"]] : []];
 	const pnpmWorkspaceFor = (file) => {
 		let directory = path.posix.dirname(file);
 		while (true) {
@@ -1515,8 +984,8 @@ const checkPackageFiles = ({ files, policy }) => {
 				patterns: workspace["packages"],
 				rootMembership: "implicit"
 			})) return void 0;
-			if (name === "" || name === "default") return workspace["catalog"] ?? (record$3(workspace["catalogs"]) ? workspace["catalogs"]["default"] : void 0);
-			return record$3(workspace["catalogs"]) ? workspace["catalogs"][name] : void 0;
+			if (name === "" || name === "default") return workspace["catalog"] ?? (record$2(workspace["catalogs"]) ? workspace["catalogs"]["default"] : void 0);
+			return record$2(workspace["catalogs"]) ? workspace["catalogs"][name] : void 0;
 		}
 		let directory = path.posix.dirname(file);
 		while (true) {
@@ -1524,7 +993,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			if (manifest !== void 0) {
 				for (const source of catalogSources(manifest)) {
 					if (name === "" && source["catalog"] !== void 0) return source["catalog"];
-					if (record$3(source["catalogs"]) && source["catalogs"][name] !== void 0) return source["catalogs"][name];
+					if (record$2(source["catalogs"]) && source["catalogs"][name] !== void 0) return source["catalogs"][name];
 				}
 				if (manifest["workspaces"] !== void 0) return void 0;
 			}
@@ -1538,7 +1007,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			if (visited.has(value)) return void 0;
 			visited.add(value);
 			const catalog = catalogFor(file, value.slice(8));
-			value = record$3(catalog) ? catalog[name] : void 0;
+			value = record$2(catalog) ? catalog[name] : void 0;
 		}
 		return value;
 	};
@@ -1554,7 +1023,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			const workspaces = manifests.get(path.posix.join(directory, "package.json"))?.["workspaces"];
 			if (workspaces !== void 0) return {
 				directory,
-				patterns: record$3(workspaces) ? workspaces["packages"] : workspaces,
+				patterns: record$2(workspaces) ? workspaces["packages"] : workspaces,
 				source: "json"
 			};
 			if (directory === ".") return void 0;
@@ -1610,7 +1079,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			"peerDependencies"
 		]) {
 			const dependencies = json[section];
-			if (!record$3(dependencies)) continue;
+			if (!record$2(dependencies)) continue;
 			for (const [name, value] of Object.entries(dependencies)) {
 				if (!tsSpecifiers.has(name)) continue;
 				const resolved = resolve(file, name, value);
@@ -1672,7 +1141,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			message: `packageManager Bun version must be ${policy.bun}, found ${JSON.stringify(manager)}`
 		});
 		const checkEntries = (entries, location) => {
-			if (!record$3(entries)) return;
+			if (!record$2(entries)) return;
 			for (const [name, raw] of Object.entries(entries)) {
 				const value = resolve(file, name, raw);
 				const tsAllowed = tsSpecifiers.get(name);
@@ -1709,12 +1178,12 @@ const checkPackageFiles = ({ files, policy }) => {
 			"devDependencies",
 			"optionalDependencies"
 		]) checkEntries(json[key]);
-		if (record$3(json["peerDependencies"])) {
+		if (record$2(json["peerDependencies"])) {
 			for (const [name, value] of Object.entries(json["peerDependencies"])) if (tsSpecifiers.has(name) && !peerRange(resolve(file, name, value))) checkEntries({ [name]: value });
 		}
 		for (const source of catalogSources(json)) {
 			checkEntries(source["catalog"]);
-			if (!record$3(source["catalogs"])) continue;
+			if (!record$2(source["catalogs"])) continue;
 			for (const catalog of Object.values(source["catalogs"])) checkEntries(catalog);
 		}
 		const ownedNames = /* @__PURE__ */ new Set([...pins.keys(), ...tsSpecifiers.keys()]);
@@ -1726,7 +1195,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			"optionalDependencies"
 		]) {
 			const entries = resolutionRoot[section];
-			if (!record$3(entries)) continue;
+			if (!record$2(entries)) continue;
 			for (const [name, value] of Object.entries(entries)) resolutionDependencies[name] = resolve(file, name, value);
 		}
 		const affectedSpecifiers = /* @__PURE__ */ new Map();
@@ -1746,7 +1215,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				"optionalDependencies"
 			]) {
 				const entries = member[section];
-				if (!record$3(entries)) continue;
+				if (!record$2(entries)) continue;
 				for (const [name, value] of Object.entries(entries)) {
 					if (!tsSpecifiers.has(name)) continue;
 					const values = affectedSpecifiers.get(name) ?? /* @__PURE__ */ new Set();
@@ -1756,7 +1225,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			}
 		}
 		const checkResolutionMap = (entries, parent) => {
-			if (!record$3(entries)) return;
+			if (!record$2(entries)) return;
 			for (const [selector, replacement] of Object.entries(entries)) {
 				const target = selector === "." ? parent : selector;
 				if (target === void 0) continue;
@@ -1779,7 +1248,7 @@ const checkPackageFiles = ({ files, policy }) => {
 					});
 					continue;
 				}
-				if (record$3(replacement)) {
+				if (record$2(replacement)) {
 					checkResolutionMap(replacement, target);
 					continue;
 				}
@@ -1813,7 +1282,7 @@ const checkPackageFiles = ({ files, policy }) => {
 		};
 		checkResolutionMap(json["overrides"]);
 		checkResolutionMap(json["resolutions"]);
-		if (record$3(json["pnpm"])) checkResolutionMap(json["pnpm"]["overrides"]);
+		if (record$2(json["pnpm"])) checkResolutionMap(json["pnpm"]["overrides"]);
 		const localEntries = toolchainEntries(file, json);
 		const usesCompiler = policy.typescriptInstallLayouts.some((layout) => localEntries.some(({ name }) => name === layout.compilerPackage));
 		let selectedLayout = layoutFor(specifierMap(localEntries));
@@ -1837,7 +1306,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				key: "dependencies",
 				message: "TypeScript compiler and compatibility packages must match one complete declared install layout"
 			});
-			const command = record$3(json["scripts"]) ? json["scripts"]["typecheck"] : void 0;
+			const command = record$2(json["scripts"]) ? json["scripts"]["typecheck"] : void 0;
 			if (selectedLayout !== void 0 && typeof command === "string") {
 				const normalizedExpected = selectedLayout.typecheckCommand.replace(/\s+/g, " ").trim();
 				for (const words of compilerCommandSegments(command)) {
@@ -1855,7 +1324,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				}
 			}
 		}
-		if (record$3(json["peerDependencies"])) {
+		if (record$2(json["peerDependencies"])) {
 			const peerLayout = selectedLayout ?? workspaceLayoutFor(file)?.layout;
 			for (const [name, raw] of Object.entries(json["peerDependencies"])) {
 				if (!tsSpecifiers.has(name)) continue;
@@ -1879,7 +1348,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				});
 			}
 		}
-		if (record$3(json["engines"]) && json["engines"]["node"] !== void 0 && (typeof json["engines"]["node"] !== "string" || !nodeSupportRangeMatches(policy.node, json["engines"]["node"]))) add({
+		if (record$2(json["engines"]) && json["engines"]["node"] !== void 0 && (typeof json["engines"]["node"] !== "string" || !nodeSupportRangeMatches(policy.node, json["engines"]["node"]))) add({
 			file,
 			rule: "node-engine",
 			key: "node",
@@ -1901,7 +1370,7 @@ const runtimeRules = [
 	"runtime-workflow",
 	"action-pins"
 ];
-const record$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const pythonSelectorMatches = (value, expected) => value === expected || typeof value === "string" && /^\d+\.\d+$/.test(expected) && value.startsWith(`${expected}.`) && /^\d+\.\d+\.\d+$/.test(value);
 const compareRelease = (left, right) => {
 	for (let index = 0; index < Math.max(left.length, right.length); index++) {
@@ -1971,7 +1440,7 @@ const pythonRequirementMatches = (requirement, version) => {
 	});
 };
 /** Check runtime declarations only in the files that declare or configure them. */
-const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, repository, onDelegated, engineFloors = [], onEngineFloor }) => {
+const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, repository, onDelegated, dynamicSelectors = [], onDynamicSelector, engineFloors = [], onEngineFloor }) => {
 	const diagnostics = [];
 	const name = path.posix.basename(file);
 	const lines = text.split(/\r?\n/);
@@ -1983,6 +1452,16 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			message
 		});
 	};
+	let currentLocation;
+	const dynamic = (value) => typeof value === "string" && value.includes("$");
+	const authorizeDynamic = (kind, line, at = currentLocation) => {
+		const matches = dynamicSelectors.filter((entry) => entry.path === file && entry.kind === kind && (entry.at !== void 0 ? entry.at === at : entry.line === line));
+		if (matches.length !== 1) return false;
+		const entry = matches.at(0);
+		if (entry === void 0) return false;
+		onDynamicSelector?.(entry);
+		return true;
+	};
 	const lineOf = (key) => Math.max(1, lines.findIndex((line) => line.includes(key)) + 1);
 	const pin = ({ rule, value, expected, label, line = 1, selector }) => {
 		let matches = value === expected;
@@ -1996,7 +1475,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	};
 	const toml = (rule) => {
 		try {
-			return parse(text);
+			return parse$2(text);
 		} catch {
 			add({
 				rule,
@@ -2055,11 +1534,11 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		const parsed = toml("rust-version");
 		if (parsed !== void 0) {
 			const toolchain = parsed["toolchain"];
-			const components = record$2(toolchain) ? toolchain["components"] : void 0;
+			const components = record$1(toolchain) ? toolchain["components"] : void 0;
 			const expected = Array.isArray(components) && components.includes("rustc-dev") ? policy.rustCompilerDevelopment : policy.rust;
 			pin({
 				rule: "rust-version",
-				value: record$2(toolchain) ? toolchain["channel"] : void 0,
+				value: record$1(toolchain) ? toolchain["channel"] : void 0,
 				expected,
 				label: "Rust channel",
 				line: lineOf("channel")
@@ -2080,21 +1559,21 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			if (candidate === file) return parsed;
 			if (!trackedFiles.has(candidate)) return void 0;
 			try {
-				return parse(readFile(candidate) ?? "");
+				return parse$2(readFile(candidate) ?? "");
 			} catch {
 				return;
 			}
 		};
 		if (parsed !== void 0) {
 			const workspace = parsed["workspace"];
-			const defaults = record$2(workspace) ? workspace["package"] : void 0;
-			if (record$2(defaults) && defaults["rust-version"] !== void 0) rustFloor(defaults["rust-version"]);
+			const defaults = record$1(workspace) ? workspace["package"] : void 0;
+			if (record$1(defaults) && defaults["rust-version"] !== void 0) rustFloor(defaults["rust-version"]);
 			const pkg = parsed["package"];
-			const version = record$2(pkg) ? pkg["rust-version"] : void 0;
-			if (version !== void 0) if (!record$2(version)) rustFloor(version);
+			const version = record$1(pkg) ? pkg["rust-version"] : void 0;
+			if (version !== void 0) if (!record$1(version)) rustFloor(version);
 			else {
 				let inherited;
-				if (version["workspace"] === true && record$2(pkg)) {
+				if (version["workspace"] === true && record$1(pkg)) {
 					const explicit = pkg["workspace"];
 					let directory = path.posix.dirname(file);
 					const explicitPath = typeof explicit === "string" && !explicit.includes("\\") && !explicit.includes(":") && !explicit.includes("${{") && !path.posix.isAbsolute(explicit) ? path.posix.normalize(path.posix.join(directory, explicit)) : void 0;
@@ -2102,9 +1581,9 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 						if (explicitPath !== void 0) directory = explicitPath;
 						while (true) {
 							const table = readManifest(path.posix.join(directory, "Cargo.toml"))?.["workspace"];
-							if (record$2(table)) {
+							if (record$1(table)) {
 								const fields = table["package"];
-								inherited = record$2(fields) ? fields["rust-version"] : void 0;
+								inherited = record$1(fields) ? fields["rust-version"] : void 0;
 								break;
 							}
 							if (explicit !== void 0 || directory === ".") break;
@@ -2118,7 +1597,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	}
 	if (name === "Pipfile") {
 		const requires = toml("python-version")?.["requires"];
-		if (record$2(requires)) {
+		if (record$1(requires)) {
 			const minor = requires["python_version"];
 			if (minor !== void 0 && minor !== policy.python.split(".").slice(0, 2).join(".")) add({
 				rule: "python-version",
@@ -2137,7 +1616,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		const parsed = toml("python-version");
 		if (parsed !== void 0) {
 			const project = parsed["project"];
-			if (record$2(project) && project["requires-python"] !== void 0) {
+			if (record$1(project) && project["requires-python"] !== void 0) {
 				if (!pythonRequirementMatches(project["requires-python"], policy.python)) add({
 					rule: "python-version",
 					line: lineOf("requires-python"),
@@ -2145,9 +1624,9 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 				});
 			}
 			const tool = parsed["tool"];
-			const configuredUv = record$2(tool) ? tool["uv"] : void 0;
+			const configuredUv = record$1(tool) ? tool["uv"] : void 0;
 			const uv = name === "uv.toml" ? parsed : configuredUv;
-			if (record$2(uv) && uv["python"] !== void 0) pin({
+			if (record$1(uv) && uv["python"] !== void 0) pin({
 				rule: "python-version",
 				value: uv["python"],
 				expected: policy.python,
@@ -2158,11 +1637,11 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	}
 	if (isMiseConfigPath(file)) {
 		const tools = toml("runtime-manager")?.["tools"];
-		if (record$2(tools)) for (const [tool, expected] of Object.entries(versions)) {
+		if (record$1(tools)) for (const [tool, expected] of Object.entries(versions)) {
 			const configured = tools[tool];
 			if (configured !== void 0) pin({
 				rule: "runtime-manager",
-				value: record$2(configured) ? configured["version"] : configured,
+				value: record$1(configured) ? configured["version"] : configured,
 				expected,
 				selector: nodeTools.has(tool) ? "node" : void 0,
 				label: `mise ${tool}`,
@@ -2184,12 +1663,13 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			line: index + 1
 		});
 	});
-	const checkRuntimeImage = ({ image, line, label }) => {
+	const checkRuntimeImage = ({ image, line, label, at }) => {
 		const unknownRuntime = () => {
+			if (dynamic(image) && authorizeDynamic("image", line, at)) return;
 			add({
 				rule: "runtime-docker",
 				line,
-				message: `cannot determine ${label} runtime; use a static image or a reasoned runtime-docker opt-out`
+				message: `cannot determine ${label} runtime; use a static image or a scoped dynamicSelectors declaration`
 			});
 		};
 		if (typeof image !== "string") {
@@ -2418,6 +1898,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 					checkRuntimeImage({
 						image: entry.image,
 						line,
+						at: entry.path.join("."),
 						label: classified?.ecosystem === "docker-compose" ? "Compose image" : "Kubernetes image"
 					});
 				}
@@ -2445,15 +1926,29 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		return diagnostics;
 	}
 	const nodeLine = (node) => {
-		if (!record$2(node) || !Array.isArray(node["range"])) return 1;
+		if (!record$1(node) || !Array.isArray(node["range"])) return 1;
 		const offset = node["range"].at(0);
 		return typeof offset === "number" ? text.slice(0, offset).split("\n").length : 1;
 	};
 	let checkoutBindings = [];
 	let checkoutDestinations = /* @__PURE__ */ new Map();
 	let unknownCheckoutDestination = false;
+	let unreviewableCheckoutSource = false;
 	const staticRepositoryPath = (value) => typeof value === "string" && value !== "" && !value.includes("${{") && !value.includes("\\") && !value.includes(":") && !path.posix.isAbsolute(value) && !value.split("/").includes("..");
 	const normalizeCheckoutPath = (prefix) => path.posix.normalize(prefix).replace(/\/$/, "") || ".";
+	const checkoutProvidersFor = (selector) => {
+		if (selector === void 0) return checkoutBindings;
+		let deepest;
+		for (const entry of checkoutBindings) {
+			if (entry.path !== "." && selector !== entry.path && !selector.startsWith(`${entry.path}/`)) continue;
+			if (deepest === void 0 || entry.path !== "." && (deepest.path === "." || entry.path.length > deepest.path.length)) deepest = entry;
+		}
+		return checkoutBindings.filter((entry) => entry.path === deepest?.path);
+	};
+	const hasAmbiguousCheckoutWriters = (selector, providers) => {
+		if (providers.length > 0) return providers.some((entry) => (checkoutDestinations.get(entry.path) ?? 0) > 1);
+		return [...checkoutDestinations].some(([prefix, count]) => count > 1 && (selector === void 0 || prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`)));
+	};
 	const checkReference = ({ value, tool, line }) => {
 		const allowed = {
 			node: [".node-version", ".nvmrc"],
@@ -2462,8 +1957,28 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		}[tool];
 		const rule = tool === "bun" ? "bun-pins" : "runtime-workflow";
 		const selector = staticRepositoryPath(value) ? path.posix.normalize(value) : void 0;
-		const binding = selector === void 0 ? void 0 : checkoutBindings.findLast((entry) => entry.path === "." || selector === entry.path || selector.startsWith(`${entry.path}/`));
+		const providers = checkoutProvidersFor(selector);
+		const binding = selector === void 0 ? void 0 : providers.at(-1);
+		const dynamicSource = providers.some((entry) => entry.dynamicSource);
+		const sparseFailure = providers.find((entry) => {
+			if (entry.sparse.mode === "invalid") return true;
+			if (entry.sparse.mode !== "files" && entry.sparse.mode !== "mixed") return false;
+			if (selector === void 0) return true;
+			const selectedFile = entry.path === "." ? selector : path.posix.relative(entry.path, selector);
+			return !entry.sparse.paths.has(selectedFile);
+		});
+		if (sparseFailure !== void 0) {
+			let missingFile = "the selected version file";
+			if (selector !== void 0) missingFile = sparseFailure.path === "." ? selector : path.posix.relative(sparseFailure.path, selector);
+			add({
+				rule,
+				line,
+				message: `checkout sparse-checkout must explicitly list ${missingFile} without invalid literal patterns`
+			});
+			return;
+		}
 		if (selector === void 0) {
+			if (tool === "bun" && dynamic(value) && !unreviewableCheckoutSource && authorizeDynamic("bun-source", line)) return;
 			add({
 				rule,
 				line,
@@ -2471,7 +1986,8 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			});
 			return;
 		}
-		if (unknownCheckoutDestination || [...checkoutDestinations].some(([prefix, count]) => count > 1 && (prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`)))) {
+		if (unknownCheckoutDestination || hasAmbiguousCheckoutWriters(selector, providers)) {
+			if (tool === "bun" && dynamicSource && !unreviewableCheckoutSource && authorizeDynamic("bun-source", line)) return;
 			add({
 				rule,
 				line,
@@ -2480,6 +1996,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			return;
 		}
 		if (binding?.source === "untrusted") {
+			if (tool === "bun" && dynamicSource && !unreviewableCheckoutSource && authorizeDynamic("bun-source", line)) return;
 			add({
 				rule,
 				line: binding.line,
@@ -2496,13 +2013,15 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			});
 			return;
 		}
-		if (binding !== void 0 && (binding.sparse.mode === "invalid" || binding.sparse.mode === "files" && !binding.sparse.paths.has(target))) {
-			add({
-				rule,
-				line,
-				message: `checkout sparse-checkout must explicitly list ${target} without dynamic, glob, or negation patterns`
-			});
-			return;
+		if (binding !== void 0 && (binding.sparse.mode === "dynamic" || binding.sparse.mode === "mixed")) {
+			if (tool !== "bun" || unreviewableCheckoutSource || !authorizeDynamic("bun-source", line)) {
+				add({
+					rule,
+					line,
+					message: `checkout sparse-checkout must explicitly list ${target} without dynamic, glob, or negation patterns`
+				});
+				return;
+			}
 		}
 		if (binding?.source === "delegated") {
 			onDelegated?.({
@@ -2521,7 +2040,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 				const manifest = JSON.parse(content ?? "");
 				pin({
 					rule,
-					value: record$2(manifest) ? manifest["packageManager"] : void 0,
+					value: record$1(manifest) ? manifest["packageManager"] : void 0,
 					expected: `bun@${policy.bun}`,
 					label: "setup-bun version file packageManager",
 					line
@@ -2624,10 +2143,10 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		return inputs;
 	};
 	const getInput = (node, key) => inputsOf(node).get(key.toUpperCase());
-	const dynamicRefBody = (value) => {
-		if (typeof value !== "string" || !value.startsWith("${{")) return void 0;
+	const expressionAt = (value, start) => {
+		if (!value.startsWith("${{", start)) return void 0;
 		let quote;
-		for (let index = 3; index < value.length; index++) {
+		for (let index = start + 3; index < value.length; index++) {
 			const character = value.at(index);
 			if (quote !== void 0) {
 				if (character === quote) if (quote === "'" && value.at(index + 1) === "'") index++;
@@ -2637,9 +2156,33 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			}
 			if (character === "'" || character === "\"") quote = character;
 			else if (value.startsWith("${{", index)) return void 0;
-			else if (character === "}" && value.at(index + 1) === "}") return index === value.length - 2 ? value.slice(3, index).trim() : void 0;
+			else if (character === "}" && value.at(index + 1) === "}") return {
+				body: value.slice(start + 3, index).trim(),
+				end: index + 2
+			};
 		}
 	};
+	const dynamicRefBody = (value) => {
+		if (typeof value !== "string") return void 0;
+		const expression = expressionAt(value, 0);
+		return expression?.end === value.length ? expression.body : void 0;
+	};
+	const sparseEntryIsValid = (entry) => {
+		let literalPath = "";
+		let position = 0;
+		while (position < entry.length) {
+			const start = entry.indexOf("${{", position);
+			const literal = entry.slice(position, start < 0 ? entry.length : start);
+			if (/[!$*?[\]\\:]/.test(literal) || literal.split("/").includes("..")) return false;
+			literalPath += literal;
+			if (start < 0) break;
+			const expression = expressionAt(entry, start);
+			if (expression === void 0 || expression.body === "") return false;
+			literalPath += "expression";
+			position = expression.end;
+		}
+		return staticRepositoryPath(literalPath);
+	};
 	const checkoutPrefixOf = (node) => {
 		const destination = getInput(node, "path");
 		if (destination === void 0) return ".";
@@ -2652,11 +2195,19 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		const value = getInput(node, "sparse-checkout");
 		const cone = getInput(node, "sparse-checkout-cone-mode");
 		if (!isScalar(value) || typeof value.value !== "string" || cone !== void 0 && (!isScalar(cone) || cone.value !== true && cone.value !== false && cone.value !== "true" && cone.value !== "false")) return { mode: "invalid" };
-		const paths = value.value.split(/\r?\n/).map((entry) => entry.trim()).filter((entry) => entry !== "");
-		if (paths.length === 0 || paths.some((entry) => !staticRepositoryPath(entry) || entry.startsWith("!") || /[*?[\]]/.test(entry))) return { mode: "invalid" };
+		const paths = value.value.split(/\r?\n/).map((entry) => entry.trim().replace(/^\//, "")).filter((entry) => entry !== "");
+		if (paths.length === 0 || paths.some((entry) => !sparseEntryIsValid(entry))) return { mode: "invalid" };
+		const literalPaths = new Set(paths.filter((entry) => !dynamic(entry)));
+		if (paths.some(dynamic)) {
+			if (literalPaths.size === 0) return { mode: "dynamic" };
+			return {
+				mode: "mixed",
+				paths: literalPaths
+			};
+		}
 		return {
 			mode: "files",
-			paths: new Set(paths)
+			paths: literalPaths
 		};
 	};
 	let currentEngineFloor;
@@ -2686,8 +2237,9 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		}
 		if (value.startsWith("./")) {
 			const selector = staticRepositoryPath(value) ? path.posix.normalize(value) : void 0;
-			const binding = selector === void 0 ? void 0 : checkoutBindings.findLast((entry) => entry.path === "." || selector === entry.path || selector.startsWith(`${entry.path}/`));
-			if (selector === void 0 || unknownCheckoutDestination || binding !== void 0 && binding.source !== "tracked" || [...checkoutDestinations].some(([prefix, count]) => count > 1 && (prefix === "." || selector === prefix || selector.startsWith(`${prefix}/`)))) add({
+			const providers = checkoutProvidersFor(selector);
+			const binding = selector === void 0 ? void 0 : providers.at(-1);
+			if (selector === void 0 || unknownCheckoutDestination || binding !== void 0 && binding.source !== "tracked" || hasAmbiguousCheckoutWriters(selector, providers)) add({
 				rule: "action-pins",
 				line,
 				message: "local actions require an unambiguous checkout of the current source snapshot"
@@ -2743,24 +2295,55 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			const checkoutRepository = getInput(node, "repository");
 			const checkoutRef = getInput(node, "ref");
 			const prefix = checkoutPrefixOf(node);
+			const clean = getInput(node, "clean");
+			const cleanIsResolved = clean === void 0 || isScalar(clean) && !dynamic(clean.value);
 			let repo;
 			if (checkoutRepository !== void 0) repo = isScalar(checkoutRepository) ? checkoutRepository.value : null;
 			const self = repo === void 0 || repo === "${{ github.repository }}" || typeof repo === "string" && repository !== void 0 && repo.toLowerCase() === repository.toLowerCase();
 			const workflowSource = repo === "${{ job.workflow_repository }}" && isScalar(checkoutRef) && checkoutRef.value === "${{ job.workflow_sha }}";
-			const currentSource = self && checkoutRef === void 0;
-			const refValue = isScalar(checkoutRef) ? checkoutRef.value : void 0;
+			const triggers = getNode(document.contents, "on");
+			const callerContext = (() => {
+				if (isMap(triggers)) return [...keysOf(triggers)];
+				if (isSeq(triggers)) return triggers.items.map((event) => isScalar(event) ? event.value : void 0);
+				if (isScalar(triggers)) return [triggers.value];
+				return [];
+			})().includes("workflow_call");
+			let refValue = isScalar(checkoutRef) ? checkoutRef.value : void 0;
+			if (callerContext && (repo === void 0 || repo === "${{ github.repository }}") && checkoutRef === void 0) refValue = "${{ github.sha }}";
+			const currentRef = dynamicRefBody(refValue);
+			const currentSource = self && !callerContext && (checkoutRef === void 0 || currentRef === "github.sha");
 			const dynamicRef = dynamicRefBody(refValue);
-			const delegatedSource = (self || repo === "${{ job.workflow_repository }}") && dynamicRef !== void 0 && dynamicRef !== "" && !/^(?:'(?:[^']|'')*'|"(?:[^"\\]|\\.)*"|(?:true|false|null)|-?(?:0x[\da-f]+|(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?))$/i.test(dynamicRef) && !/^(?:github\s*(?:\.\s*sha|\[\s*['"]sha['"]\s*\])|job\s*(?:\.\s*workflow_sha|\[\s*['"]workflow_sha['"]\s*\]))$/i.test(dynamicRef);
+			const delegatedSource = !currentSource && (self || repo === "${{ job.workflow_repository }}") && dynamicRef !== void 0 && dynamicRef !== "" && !/^(?:'(?:[^']|'')*'|"(?:[^"\\]|\\.)*"|(?:true|false|null)|-?(?:0x[\da-f]+|(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?))$/i.test(dynamicRef) && (!/^(?:github\s*(?:\.\s*sha|\[\s*['"]sha['"]\s*\])|job\s*(?:\.\s*workflow_sha|\[\s*['"]workflow_sha['"]\s*\]))$/i.test(dynamicRef) || callerContext && currentRef === "github.sha");
+			const validSource = cleanIsResolved && ref === approved?.sha && sourceMap({
+				node,
+				key: "if"
+			}) === void 0 && sourceMap({
+				node,
+				key: "continue-on-error"
+			}) === void 0 && (currentSource || workflowSource || delegatedSource);
+			if (!validSource) unreviewableCheckoutSource = true;
 			if (!staticRepositoryPath(prefix)) checkoutBindings.push({
 				path: ".",
+				dynamicSource: validSource && dynamic(prefix),
 				source: "untrusted",
 				reason: "checkout destination must be a static repository path",
 				line,
-				sparse: { mode: "invalid" }
+				sparse: sparseCheckoutOf(node)
 			});
 			else {
 				const destination = normalizeCheckoutPath(prefix);
-				const trustedWriter = ref === approved?.sha && sourceMap({
+				checkoutBindings = checkoutBindings.map((entry) => {
+					if (entry.path === destination || destination !== "." && !entry.path.startsWith(`${destination}/`)) return entry;
+					return {
+						path: entry.path,
+						sparse: { mode: "all" },
+						dynamicSource: false,
+						source: "untrusted",
+						reason: "a later ancestor checkout invalidates this descendant destination",
+						line
+					};
+				});
+				const trustedWriter = cleanIsResolved && ref === approved?.sha && sourceMap({
 					node,
 					key: "if"
 				}) === void 0 && sourceMap({
@@ -2769,18 +2352,21 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 				}) === void 0 && checkoutDestinations.get(destination) === 1 && !unknownCheckoutDestination;
 				if (trustedWriter && delegatedSource && typeof refValue === "string") checkoutBindings.push({
 					path: destination,
+					dynamicSource: validSource && delegatedSource,
 					sparse: sparseCheckoutOf(node),
 					source: "delegated",
 					ref: refValue
 				});
 				else if (trustedWriter && (workflowSource || currentSource)) checkoutBindings.push({
 					path: destination,
+					dynamicSource: validSource && delegatedSource,
 					sparse: sparseCheckoutOf(node),
 					source: "tracked"
 				});
 				else {
 					let reason = "checkout does not select a trusted repository source snapshot";
-					if (ref !== approved?.sha) reason = "actions/checkout must use the approved action SHA";
+					if (!cleanIsResolved) reason = "checkout clean must be statically resolved";
+					else if (ref !== approved?.sha) reason = "actions/checkout must use the approved action SHA";
 					else if (sourceMap({
 						node,
 						key: "if"
@@ -2791,6 +2377,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 					else if (checkoutDestinations.get(destination) !== 1 || unknownCheckoutDestination) reason = "checkout destination must have exactly one static writer";
 					checkoutBindings.push({
 						path: destination,
+						dynamicSource: validSource && delegatedSource,
 						sparse: sparseCheckoutOf(node),
 						source: "untrusted",
 						reason,
@@ -2839,21 +2426,23 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			line: reference === void 0 ? line : nodeLine(reference)
 		});
 	};
-	const checkContainer = (node) => {
+	const checkContainer = (node, at) => {
 		node = resolveNode(node);
 		if (node === void 0) return;
 		const image = isMap(node) ? getNode(node, "image") : node;
 		checkRuntimeImage({
 			image: isScalar(image) ? image.value : void 0,
 			line: nodeLine(image ?? node),
-			label: "container image"
+			label: "container image",
+			at
 		});
 	};
-	const checkSteps = (node, floor) => {
+	const checkSteps = (node, locationPrefix, floor) => {
 		currentEngineFloor = void 0;
 		checkoutBindings = [];
 		checkoutDestinations = /* @__PURE__ */ new Map();
 		unknownCheckoutDestination = false;
+		unreviewableCheckoutSource = false;
 		node = resolveNode(node);
 		if (!isSeq(node)) return;
 		for (const step of node.items) {
@@ -2869,9 +2458,14 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		}
 		currentEngineFloor = floor;
 		try {
-			for (const step of node.items) checkAction(step);
+			for (const step of node.items) {
+				const id = getNode(step, "id");
+				currentLocation = isScalar(id) && typeof id.value === "string" ? `${locationPrefix}.steps.${id.value}` : void 0;
+				checkAction(step);
+			}
 		} finally {
 			currentEngineFloor = void 0;
+			currentLocation = void 0;
 		}
 	};
 	try {
@@ -2885,15 +2479,15 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 				currentEngineFloor = void 0;
 				const job = getNode(jobs, key);
 				checkAction(job);
-				checkContainer(getNode(job, "container"));
+				checkContainer(getNode(job, "container"), `jobs.${key}.container`);
 				const services = getNode(job, "services");
-				if (isMap(services)) for (const service of keysOf(services)) checkContainer(getNode(services, service));
-				checkSteps(getNode(job, "steps"), engineFloors.find((entry) => entry.job === key));
+				if (isMap(services)) for (const service of keysOf(services)) checkContainer(getNode(services, service), `jobs.${key}.services.${service}`);
+				checkSteps(getNode(job, "steps"), `jobs.${key}`, engineFloors.find((entry) => entry.job === key));
 			}
 		} else {
 			const runs = getNode(document.contents, "runs");
 			const using = getNode(runs, "using");
-			if (isScalar(using) && using.value === "composite") checkSteps(getNode(runs, "steps"));
+			if (isScalar(using) && using.value === "composite") checkSteps(getNode(runs, "steps"), "runs");
 			if (isScalar(using) && using.value === "docker") {
 				const image = getNode(runs, "image");
 				const value = isScalar(image) ? image.value : void 0;
@@ -2925,192 +2519,6 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	return diagnostics;
 };
 //#endregion
-//#region src/toolchain-schema.ts
-const packagePinKeys = [
-	"oxlint",
-	"oxlint-tsgolint",
-	"@oxlint/plugins",
-	"@stll/oxlint-plugin",
-	"oxfmt",
-	"lefthook"
-];
-const valkeyArchitectures = ["amd64", "arm64"];
-const valkeyArtifactPackages = {
-	server: "valkey-server",
-	tools: "valkey-tools"
-};
-const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const artifactRecord = (value, keys) => {
-	if (!record$1(value) || Object.keys(value).some((key) => !keys.includes(key)) || keys.some((key) => !Object.hasOwn(value, key))) throw new Error("valkeyArtifacts requires complete, closed artifact objects");
-	return value;
-};
-const parseValkeyArtifacts = (input, version) => {
-	const architectures = artifactRecord(input, valkeyArchitectures);
-	const line = version.split(".").slice(0, 2).join(".");
-	const parseArchitecture = (architecture) => {
-		const packages = artifactRecord(architectures[architecture], Object.keys(valkeyArtifactPackages));
-		const parseArtifact = (kind) => {
-			const artifact = artifactRecord(packages[kind], ["url", "sha256"]);
-			const url = artifact["url"];
-			const sha256 = artifact["sha256"];
-			const expected = `https://download.valkey.io/packaging/valkey-${line}/deb/ubuntu2404/${architecture}/${valkeyArtifactPackages[kind]}_${version}-1.noble_${architecture}.deb`;
-			if (typeof url !== "string" || url !== expected) throw new Error("valkeyArtifacts URL must select the exact official versioned Ubuntu artifact");
-			if (typeof sha256 !== "string" || !/^[a-f0-9]{64}$/.test(sha256)) throw new Error("valkeyArtifacts requires a lowercase SHA256 pin");
-			return {
-				url,
-				sha256
-			};
-		};
-		return {
-			server: parseArtifact("server"),
-			tools: parseArtifact("tools")
-		};
-	};
-	return {
-		amd64: parseArchitecture("amd64"),
-		arm64: parseArchitecture("arm64")
-	};
-};
-/** Reject unsupported or incomplete installed policies before inspecting a consumer. */
-const parseToolchainPolicy = (input) => {
-	if (!record$1(input) || input["schemaVersion"] !== 1) throw new Error("toolchain.json must use schemaVersion 1");
-	const string = (object, key) => {
-		const value = object[key];
-		if (typeof value !== "string" || value.trim() === "") throw new Error(`toolchain.json requires a nonempty ${key}`);
-		return value;
-	};
-	const packages = {};
-	for (const key of packagePinKeys) packages[key] = string(input, key);
-	const bun = string(input, "bun");
-	const typescript = string(input, "typescript");
-	const node = string(input, "node");
-	const python = string(input, "python");
-	const postgres = string(input, "postgres");
-	const valkey = string(input, "valkey");
-	const rust = string(input, "rust");
-	const rustCompilerDevelopment = string(input, "rustCompilerDevelopment");
-	for (const [name, value] of Object.entries({
-		...packages,
-		bun,
-		typescript
-	})) if (valid(value) !== value) throw new Error(`toolchain.json ${name} must be an exact release`);
-	if (!/^[1-9]\d*$/.test(postgres) || !Number.isSafeInteger(Number(postgres))) throw new Error("PostgreSQL must be a canonical positive major");
-	if (valid(valkey) !== valkey || !/^\d+\.\d+\.\d+$/.test(valkey)) throw new Error("Valkey must be an exact stable release");
-	const valkeyArtifacts = parseValkeyArtifacts(input["valkeyArtifacts"], valkey);
-	if (!nodePolicyValid(node)) throw new Error("Node must be a canonical major N.x series");
-	if (!/^\d+\.\d+(?:\.\d+)?$/.test(python)) throw new Error("Python must be an exact minor or patch release");
-	if (!/^\d+\.\d+\.\d+$/.test(rust)) throw new Error("Rust must be an exact stable release");
-	if (!/^nightly-\d{4}-\d{2}-\d{2}$/.test(rustCompilerDevelopment)) throw new Error("Rust compiler development must be a dated nightly");
-	const compatibility = input["typescript6Compatibility"];
-	if (!record$1(compatibility)) throw new Error("missing TypeScript compatibility policy");
-	const version = string(compatibility, "version");
-	const packageAlias = string(compatibility, "packageAlias");
-	if (valid(version) !== version) throw new Error("TypeScript compatibility must be an exact release");
-	const layouts = input["typescriptInstallLayouts"];
-	if (!Array.isArray(layouts) || layouts.length === 0) throw new Error("missing TypeScript install layouts");
-	const typescriptInstallLayouts = layouts.map((layout) => {
-		if (!record$1(layout)) throw new Error("invalid TypeScript install layout");
-		const compilerPackage = string(layout, "compilerPackage");
-		const compilerSpecifier = string(layout, "compilerSpecifier");
-		const typecheckCommand = string(layout, "typecheckCommand");
-		switch (layout["type"]) {
-			case "direct":
-				if (compilerSpecifier !== typescript || compilerPackage !== "typescript") throw new Error("direct TypeScript layout differs from shared version");
-				return {
-					type: "direct",
-					compilerPackage,
-					compilerSpecifier,
-					typecheckCommand
-				};
-			case "split-compatibility": {
-				const compatibilityPackage = string(layout, "compatibilityPackage");
-				const compatibilitySpecifier = string(layout, "compatibilitySpecifier");
-				if (compilerSpecifier !== `npm:typescript@${typescript}` || compatibilitySpecifier !== version) throw new Error("split TypeScript layout differs from shared versions");
-				return {
-					type: "split-compatibility",
-					compilerPackage,
-					compilerSpecifier,
-					compatibilityPackage,
-					compatibilitySpecifier,
-					typecheckCommand
-				};
-			}
-			default: throw new Error("unsupported TypeScript install layout");
-		}
-	});
-	const actionsInput = input["actions"];
-	if (!record$1(actionsInput) || Object.keys(actionsInput).length === 0) throw new Error("missing approved actions");
-	const actions = {};
-	for (const [name, action] of Object.entries(actionsInput)) {
-		if (!record$1(action)) throw new Error(`invalid action policy: ${name}`);
-		const sha = string(action, "sha");
-		const actionVersion = string(action, "version");
-		if (!/^[a-f0-9]{40}$/.test(sha) || !/^v\d+(?:\.\d+)*$/.test(actionVersion)) throw new Error(`invalid action SHA/version: ${name}`);
-		actions[name] = {
-			sha,
-			version: actionVersion
-		};
-	}
-	const dependabotInput = input["dependabot"];
-	if (!record$1(dependabotInput) || !record$1(dependabotInput["schedule"]) || !record$1(dependabotInput["cooldown"]) || !record$1(dependabotInput["groups"])) throw new Error("missing Dependabot policy");
-	const scheduleInput = dependabotInput["schedule"];
-	const schedule = {
-		interval: string(scheduleInput, "interval"),
-		day: string(scheduleInput, "day"),
-		time: string(scheduleInput, "time"),
-		timezone: string(scheduleInput, "timezone")
-	};
-	const defaultDays = dependabotInput["cooldown"]["defaultDays"];
-	if (typeof defaultDays !== "number" || !Number.isInteger(defaultDays) || defaultDays < 5) throw new Error("Dependabot cooldown must be at least five days");
-	const strings = (value) => {
-		if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string")) throw new Error("Dependabot group values must be string arrays");
-		return value;
-	};
-	const groups = {};
-	for (const [name, group] of Object.entries(dependabotInput["groups"])) {
-		if (!record$1(group)) throw new Error(`invalid Dependabot group: ${name}`);
-		groups[name] = {
-			patterns: strings(group["patterns"]),
-			updateTypes: strings(group["updateTypes"])
-		};
-	}
-	return {
-		bun,
-		typescript,
-		node,
-		postgres,
-		valkey,
-		valkeyArtifacts,
-		python,
-		rust,
-		rustCompilerDevelopment,
-		packages,
-		actions,
-		typescriptInstallLayouts,
-		typescript6Compatibility: {
-			version,
-			packageAlias
-		},
-		dependabot: {
-			schedule,
-			cooldown: { defaultDays },
-			groups,
-			ignoredPackages: [.../* @__PURE__ */ new Set([
-				...Object.keys(packages),
-				...typescriptInstallLayouts.flatMap((layout) => layout.type === "direct" ? [layout.compilerPackage] : [layout.compilerPackage, layout.compatibilityPackage]),
-				packageAlias,
-				"bun-types"
-			])],
-			ignoredActions: Object.keys(actions),
-			ignoredImages: [
-				"node",
-				"python",
-				"oven/bun"
-			]
-		}
-	};
-};
-//#endregion
 //#region src/toolchain-guard.ts
 const toolchainRules = [.../* @__PURE__ */ new Set([
 	...packageRules,
@@ -3122,7 +2530,7 @@ const record = (value) => typeof value === "object" && value !== null && !Array.
 const array = (value) => Array.isArray(value);
 /** Repository-owned declarations are explicit; malformed decisions fail closed. */
 const parseToolchainConfiguration = (input) => {
-	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud and engineFloors declarations");
+	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors" && key !== "dynamicSelectors" && key !== "consumerChecks") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud, engineFloors, dynamicSelectors and consumerChecks declarations");
 	const disabled = /* @__PURE__ */ new Set();
 	const optOuts = input["optOuts"] ?? [];
 	if (!array(optOuts)) throw new Error("optOuts must be an array");
@@ -3135,7 +2543,9 @@ const parseToolchainConfiguration = (input) => {
 	return {
 		disabled,
 		cloud: parseCloudSetup(input["cloud"]),
-		engineFloors: parseEngineFloors(input["engineFloors"])
+		engineFloors: parseEngineFloors(input["engineFloors"]),
+		dynamicSelectors: parseDynamicSelectors(input["dynamicSelectors"]),
+		consumerChecks: parseConsumerChecks(input["consumerChecks"])
 	};
 };
 /** Read one tracked configuration snapshot for guards and policy generation. */
@@ -3198,13 +2608,12 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 		}).trim();
 		repository = /^(?:https?:\/\/github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)([^/]+\/[^/]+?)(?:\.git)?\/?$/.exec(origin)?.[1];
 	} catch {}
-	let disabled = /* @__PURE__ */ new Set();
-	let cloud;
+	let configuration = parseToolchainConfiguration({});
 	const engineFloors = [];
+	let dynamicSelectors = [];
 	if (files["stll-toolchain.json"] !== void 0) try {
-		const configuration = parseToolchainConfiguration(JSON.parse(files["stll-toolchain.json"]));
-		disabled = configuration.disabled;
-		cloud = configuration.cloud;
+		configuration = parseToolchainConfiguration(JSON.parse(files["stll-toolchain.json"]));
+		dynamicSelectors = configuration.dynamicSelectors;
 		for (const entry of configuration.engineFloors) engineFloors.push(resolveEngineFloor(entry, files));
 	} catch (error) {
 		diagnostics.push({
@@ -3214,6 +2623,7 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 			message: error instanceof Error ? error.message : String(error)
 		});
 	}
+	const cloud = configuration.cloud;
 	const script = files[cloudSetupPath];
 	if (cloud === void 0 && trackedFiles.has(".agents/cloud-setup.sh")) diagnostics.push({
 		rule: "cloud-setup-drift",
@@ -3244,6 +2654,12 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 	}
 	const exercisedFloors = /* @__PURE__ */ new Set();
 	const mismatchedFloors = /* @__PURE__ */ new Set();
+	const selectorMatches = /* @__PURE__ */ new Map();
+	diagnostics.push(...checkConsumerChecks({
+		declarations: configuration.consumerChecks,
+		files,
+		policy
+	}));
 	diagnostics.push(...checkPackageFiles({
 		files,
 		policy
@@ -3259,6 +2675,8 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 			}
 		},
 		trackedFiles,
+		dynamicSelectors: dynamicSelectors.filter((entry) => entry.path === file),
+		onDynamicSelector: (entry) => selectorMatches.set(entry, (selectorMatches.get(entry) ?? 0) + 1),
 		repository,
 		onDelegated,
 		engineFloors: engineFloors.filter((entry) => entry.workflow === file),
@@ -3274,13 +2692,19 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 		line: 1,
 		message: `engine floor ${entry.workflow}:${entry.job} requires a setup-node exact patch satisfying ${entry.package} engines.node minimum major ${entry.major}`
 	});
+	for (const entry of dynamicSelectors) if (selectorMatches.get(entry) !== 1) diagnostics.push({
+		rule: "configuration",
+		path: "stll-toolchain.json",
+		line: 1,
+		message: `dynamic selector ${entry.path}:${entry.at ?? entry.line} must match exactly one unresolved ${entry.kind} selector`
+	});
 	diagnostics.push(...checkDependabot({
 		files,
 		policy: policy.dependabot
 	}));
-	return diagnostics.filter((diagnostic) => !disabled.has(diagnostic.rule));
+	return diagnostics.filter((diagnostic) => !configuration.disabled.has(diagnostic.rule));
 };
 //#endregion
-export { cloudSetupPath as a, parseToolchainPolicy as i, parseToolchainConfiguration as n, generateCloudSetup as o, readToolchainInputs as r, checkToolchain as t };
+export { parseToolchainConfiguration as n, readToolchainInputs as r, checkToolchain as t };
 
 //# sourceMappingURL=toolchain-guard.mjs.map