@stll/oxlint-config 0.15.0 → 1.0.1

package/dist/toolchain-guard.mjs

@@ -1,6 +1,6 @@
-import { _ as nodeSupportRangeMatches, a as isPythonDependencyManifest, c as toolchainInputKind, d as isKubernetesDefinitionPath, f as workspaceContains, g as nodeSelectorMatches, i as isMiseConfigPath, l as containerDocumentImages, m as generateCloudSetup, n as isDependabotGithubActionsPath, o as javascriptDependencyLockfiles, p as cloudSetupPath, r as isDockerDefinitionPath, s as pythonDependencyManifestKind, t as githubAutomationFileKind, u as isComposeDefinitionPath, v as parseCloudSetup } from "./toolchain-inputs.mjs";
+import { _ as nodeSelectorMatches, a as isPythonDependencyManifest, c as pythonDependencyManifestKind, d as isComposeDefinitionPath, f as isKubernetesDefinitionPath, h as generateCloudSetup, i as isMiseConfigPath, l as toolchainInputKind, m as cloudSetupPath, n as isDependabotGithubActionsPath, o as isShellScript, p as workspaceContains, r as isDockerDefinitionPath, s as javascriptDependencyLockfiles, t as githubAutomationFileKind, u as containerDocumentImages, v as nodeSupportRangeMatches, y as parseCloudSetup } from "./toolchain-inputs.mjs";
 import { _ as parseConsumerFixtures, d as consumerPackageClosure, g as discoverConsumerPackages, i as assertConsumerFixtureKind, n as assertConsumerNodeSupport, o as assertConsumerFixtureSelection } from "./toolchain-schema.mjs";
-import { readFileSync, realpathSync } from "node:fs";
+import { closeSync, lstatSync, openSync, readFileSync, readSync, realpathSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { minVersion, satisfies, valid, validRange } from "semver";
@@ -9,9 +9,9 @@ import picomatch from "picomatch";
 import { parse as parse$2 } from "smol-toml";
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "0.15.0";
+const consumerRunnerVersion = "1.0.1";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
-const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {
 	const code = character.charCodeAt(0);
 	return code < 32 || code === 127;
@@ -97,12 +97,12 @@ const validConsumerCron = (text) => {
 	});
 };
 const nightlySchedule = (value) => {
-	if (!record$6(value)) return false;
+	if (!record$7(value)) return false;
 	const schedule = value["schedule"];
 	if (!Array.isArray(schedule) || schedule.length === 0) return false;
 	const coveredDays = /* @__PURE__ */ new Set();
 	for (const entry of schedule) {
-		if (!record$6(entry) || typeof entry["cron"] !== "string" || !validConsumerCron(entry["cron"])) return false;
+		if (!record$7(entry) || typeof entry["cron"] !== "string" || !validConsumerCron(entry["cron"])) return false;
 		const fields = entry["cron"].trim().split(/\s+/);
 		const selections = cronFields.map((field, index) => {
 			const text = fields.at(index);
@@ -118,7 +118,7 @@ const parseConsumerChecks = (input) => {
 	if (!Array.isArray(input)) throw new Error("consumerChecks must be an array");
 	const targets = /* @__PURE__ */ new Set();
 	return input.map((entry) => {
-		if (!record$6(entry) || Object.keys(entry).some((key) => ![
+		if (!record$7(entry) || Object.keys(entry).some((key) => ![
 			"workflow",
 			"job",
 			"packages",
@@ -156,9 +156,9 @@ const checkConsumerChecks = ({ declarations, files, policy }) => {
 			});
 			if (document.errors.length > 0) throw new Error("invalid workflow YAML");
 			const source = document.toJS({ maxAliasCount: 100 });
-			if (!record$6(source) || !record$6(source["jobs"])) continue;
+			if (!record$7(source) || !record$7(source["jobs"])) continue;
 			for (const [jobName, job] of Object.entries(source["jobs"])) {
-				if (!record$6(job) || typeof job["uses"] !== "string") continue;
+				if (!record$7(job) || typeof job["uses"] !== "string") continue;
 				const [workflowPath, ref] = job["uses"].split("@");
 				if (workflowPath?.toLowerCase() !== "stella/.github/.github/workflows/package-consumer-compat.yml") continue;
 				const declaration = declarations.find((entry) => entry.workflow === workflow && entry.job === jobName);
@@ -172,7 +172,7 @@ const checkConsumerChecks = ({ declarations, files, policy }) => {
 				const approved = Object.entries(policy.actions).find(([name]) => name.toLowerCase() === consumerCheckWorkflow)?.[1];
 				if (job["uses"].split("@").length !== 2 || ref === void 0 || !/^[a-f0-9]{40}$/.test(ref) || approved === void 0 || ref !== approved.sha || "steps" in job || "runs-on" in job) throw new Error(`${workflow}:${jobName} must invoke the approved immutable consumer workflow as a reusable job`);
 				const inputs = job["with"];
-				if (!record$6(inputs)) throw new Error(`${workflow}:${jobName} requires consumer inputs`);
+				if (!record$7(inputs)) throw new Error(`${workflow}:${jobName} requires consumer inputs`);
 				const names = /* @__PURE__ */ new Set();
 				for (const key of Object.keys(inputs)) {
 					const normalized = key.toLowerCase();
@@ -256,16 +256,24 @@ const canonicalDockerRuntime = (image) => {
 	const registry = dockerHubRegistries.find((entry) => image.toLowerCase().startsWith(`${entry}/`));
 	return (registry === void 0 ? image : image.slice(registry.length + 1)).replace(/^library\//i, "");
 };
+/** Preserve Rust release identity across official Debian slim and Alpine variants. */
+const rustImageVersion = (tag) => tag.replace(/-(?:alpine(?:\d+(?:\.\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim(?:-(?:bookworm|bullseye|trixie|buster))?)$/, "");
 //#endregion
 //#region src/toolchain-dependabot.ts
 const dependabotRules = ["dependabot-policy"];
-const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const strings = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
 const sameStrings = (value, expected) => {
 	if (!strings(value) || value.length !== expected.length) return false;
 	const sortedExpected = [...expected].sort();
 	return [...value].sort().every((entry, index) => entry === sortedExpected[index]);
 };
+const pinnedVersionUpdateTypes = [
+	"version-update:semver-major",
+	"version-update:semver-minor",
+	"version-update:semver-patch"
+];
+const versionOnlyIgnore = (entry) => record$6(entry) && Object.keys(entry).length === 2 && typeof entry["dependency-name"] === "string" && sameStrings(entry["update-types"], pinnedVersionUpdateTypes);
 const directoryOf = (file) => {
 	const directory = path.posix.dirname(file);
 	return directory === "." ? "/" : `/${directory}`;
@@ -281,8 +289,8 @@ const workspaceTable = (parsed, ecosystem) => {
 		case "cargo": return parsed["workspace"];
 		case "uv": {
 			const tool = parsed["tool"];
-			const uv = record$5(tool) ? tool["uv"] : void 0;
-			return record$5(uv) ? uv["workspace"] : void 0;
+			const uv = record$6(tool) ? tool["uv"] : void 0;
+			return record$6(uv) ? uv["workspace"] : void 0;
 		}
 		default: throw new Error("unknown workspace ecosystem", { cause: ecosystem });
 	}
@@ -302,7 +310,7 @@ const workspaceRoots = (files, ecosystem) => {
 					const document = parseDocument(text);
 					if (document.errors.length > 0) throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);
 					const parsed = document.toJS({ maxAliasCount: 100 });
-					if (!record$5(parsed)) throw new Error(`${workspaceFile}:1: pnpm workspace must contain an object`);
+					if (!record$6(parsed)) throw new Error(`${workspaceFile}:1: pnpm workspace must contain an object`);
 					const patterns = parsed["packages"] ?? [];
 					if (!strings(patterns)) throw new Error(`${workspaceFile}:1: pnpm packages must be a string array`);
 					workspaces.set(directory, patterns.map((pattern) => pattern.startsWith("!") ? `!${path.posix.normalize(pattern.slice(1))}` : path.posix.normalize(pattern)));
@@ -314,13 +322,13 @@ const workspaceRoots = (files, ecosystem) => {
 		}
 		try {
 			const parsed = ecosystem === "npm" ? JSON.parse(files[file] ?? "") : parse$2(files[file] ?? "");
-			if (!record$5(parsed)) continue;
+			if (!record$6(parsed)) continue;
 			if (ecosystem === "npm" && typeof parsed["packageManager"] === "string" && parsed["packageManager"].startsWith("pnpm@")) continue;
 			const value = workspaceTable(parsed, ecosystem);
-			const patterns = record$5(value) ? value[ecosystem === "npm" ? "packages" : "members"] : value;
-			const members = ecosystem === "cargo" && record$5(value) && patterns === void 0 ? [] : patterns;
+			const patterns = record$6(value) ? value[ecosystem === "npm" ? "packages" : "members"] : value;
+			const members = ecosystem === "cargo" && record$6(value) && patterns === void 0 ? [] : patterns;
 			if (strings(members)) {
-				const excluded = ecosystem !== "npm" && record$5(value) && strings(value["exclude"]) ? value["exclude"].map((pattern) => `!${pattern}`) : [];
+				const excluded = ecosystem !== "npm" && record$6(value) && strings(value["exclude"]) ? value["exclude"].map((pattern) => `!${pattern}`) : [];
 				workspaces.set(path.posix.dirname(file), [...members, ...excluded]);
 			}
 		} catch {}
@@ -371,11 +379,11 @@ const workspaceRoots = (files, ecosystem) => {
 		for (const directory of memberDirectories) try {
 			const parsed = parse$2(files[path.posix.join(directory, "Cargo.toml")] ?? "");
 			const workspace = parse$2(files[path.posix.join(root, "Cargo.toml")] ?? "")["workspace"];
-			const inherited = record$5(workspace) ? workspace["dependencies"] : void 0;
+			const inherited = record$6(workspace) ? workspace["dependencies"] : void 0;
 			const dependencyOwners = [parsed];
 			const targets = parsed["target"];
-			if (record$5(targets)) {
-				for (const target of Object.values(targets)) if (record$5(target)) dependencyOwners.push(target);
+			if (record$6(targets)) {
+				for (const target of Object.values(targets)) if (record$6(target)) dependencyOwners.push(target);
 			}
 			for (const owner of dependencyOwners) for (const key of [
 				"dependencies",
@@ -383,12 +391,12 @@ const workspaceRoots = (files, ecosystem) => {
 				"build-dependencies"
 			]) {
 				const dependencies = owner[key];
-				if (!record$5(dependencies)) continue;
+				if (!record$6(dependencies)) continue;
 				for (const [name, dependency] of Object.entries(dependencies)) {
-					if (!record$5(dependency)) continue;
+					if (!record$6(dependency)) continue;
 					const isInherited = dependency["workspace"] === true;
-					const resolved = isInherited && record$5(inherited) ? inherited[name] : dependency;
-					if (!record$5(resolved) || typeof resolved["path"] !== "string") continue;
+					const resolved = isInherited && record$6(inherited) ? inherited[name] : dependency;
+					if (!record$6(resolved) || typeof resolved["path"] !== "string") continue;
 					if (path.posix.isAbsolute(resolved["path"]) || /\\|\$|^[A-Za-z]:/.test(resolved["path"])) continue;
 					const target = path.posix.normalize(path.posix.join(isInherited ? root : directory, resolved["path"]));
 					const relative = path.posix.relative(root, target);
@@ -416,7 +424,7 @@ const javascriptEcosystem = (directory, files) => {
 	if (files[path.posix.join(root, "bun.lock")] !== void 0) return "bun";
 	try {
 		const manifest = JSON.parse(files[path.posix.join(root, "package.json")] ?? "{}");
-		if (record$5(manifest) && typeof manifest["packageManager"] === "string" && manifest["packageManager"].startsWith("bun@")) return "bun";
+		if (record$6(manifest) && typeof manifest["packageManager"] === "string" && manifest["packageManager"].startsWith("bun@")) return "bun";
 	} catch {}
 	return "npm";
 };
@@ -428,7 +436,7 @@ const pythonEcosystem = (file, files) => {
 	const pyproject = files[path.posix.join(root, "pyproject.toml")];
 	if (pyproject !== void 0) try {
 		const tool = parse$2(pyproject)["tool"];
-		if (record$5(tool) && record$5(tool["uv"])) return "uv";
+		if (record$6(tool) && record$6(tool["uv"])) return "uv";
 	} catch {}
 	return "pip";
 };
@@ -499,7 +507,7 @@ const checkDependabot = ({ files, policy }) => {
 		add("cannot resolve Dependabot YAML aliases");
 		return diagnostics;
 	}
-	if (!record$5(parsed) || parsed["version"] !== 2 || !Array.isArray(parsed["updates"])) {
+	if (!record$6(parsed) || parsed["version"] !== 2 || !Array.isArray(parsed["updates"])) {
 		add("Dependabot must declare version: 2 and an updates array");
 		return diagnostics;
 	}
@@ -512,7 +520,7 @@ const checkDependabot = ({ files, policy }) => {
 		});
 		if (legacyDocument.errors.length === 0) legacy = legacyDocument.toJS({ maxAliasCount: 100 });
 	} catch {}
-	const legacyUpdates = record$5(legacy) && Array.isArray(legacy["updates"]) ? legacy["updates"] : [];
+	const legacyUpdates = record$6(legacy) && Array.isArray(legacy["updates"]) ? legacy["updates"] : [];
 	const rootClaims = /* @__PURE__ */ new Map();
 	const directoryClaims = /* @__PURE__ */ new Map();
 	for (const [index, update] of parsed["updates"].entries()) {
@@ -526,7 +534,7 @@ const checkDependabot = ({ files, policy }) => {
 			return offset === void 0 ? 1 : lineCounter.linePos(offset).line;
 		};
 		const report = (key, message) => add(message, lineOf(key));
-		if (!record$5(update) || typeof update["package-ecosystem"] !== "string") {
+		if (!record$6(update) || typeof update["package-ecosystem"] !== "string") {
 			report("package-ecosystem", "each Dependabot update must declare a package ecosystem");
 			continue;
 		}
@@ -560,21 +568,22 @@ const checkDependabot = ({ files, policy }) => {
 		covered.set(ecosystem, matches);
 		const schedule = update["schedule"];
 		const legacyUpdate = legacyUpdates.at(index);
-		const legacySchedule = record$5(legacyUpdate) ? legacyUpdate["schedule"] : void 0;
-		if (record$5(schedule) && schedule["time"] === policy.schedule.time && (!record$5(legacySchedule) || legacySchedule["time"] !== policy.schedule.time)) report("schedule", `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`);
-		if (!record$5(schedule) || Object.keys(schedule).length !== Object.keys(policy.schedule).length || Object.entries(policy.schedule).some(([key, value]) => schedule[key] !== value)) report("schedule", `${ecosystem}: schedule must match the shared policy`);
+		const legacySchedule = record$6(legacyUpdate) ? legacyUpdate["schedule"] : void 0;
+		if (record$6(schedule) && schedule["time"] === policy.schedule.time && (!record$6(legacySchedule) || legacySchedule["time"] !== policy.schedule.time)) report("schedule", `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`);
+		if (!record$6(schedule) || Object.keys(schedule).length !== Object.keys(policy.schedule).length || Object.entries(policy.schedule).some(([key, value]) => schedule[key] !== value)) report("schedule", `${ecosystem}: schedule must match the shared policy`);
 		const cooldown = update["cooldown"];
-		if (!record$5(cooldown) || Object.keys(cooldown).length !== 1 || cooldown["default-days"] !== policy.cooldown.defaultDays) report("cooldown", `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`);
+		if (!record$6(cooldown) || Object.keys(cooldown).length !== 1 || cooldown["default-days"] !== policy.cooldown.defaultDays) report("cooldown", `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`);
 		const groups = update["groups"];
-		if (!record$5(groups) || Object.keys(groups).length !== Object.keys(policy.groups).length || Object.entries(policy.groups).some(([name, expected]) => {
+		if (!record$6(groups) || Object.keys(groups).length !== Object.keys(policy.groups).length || Object.entries(policy.groups).some(([name, expected]) => {
 			const group = groups[name];
-			return !record$5(group) || Object.keys(group).length !== 2 || !sameStrings(group["patterns"], expected.patterns) || !sameStrings(group["update-types"], expected.updateTypes);
+			return !record$6(group) || Object.keys(group).length !== 2 || !sameStrings(group["patterns"], expected.patterns) || !sameStrings(group["update-types"], expected.updateTypes);
 		})) report("groups", `${ecosystem}: groups must match the shared policy`);
 		const ignored = ignoredFor(ecosystem, policy);
 		const ignore = update["ignore"];
 		if (ignore !== void 0 && (!Array.isArray(ignore) || ignore.length === 0)) report("ignore", `${ecosystem}: omit ignore or provide a nonempty array`);
-		if (Array.isArray(ignore) && ignore.some((entry) => !record$5(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
-		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$5(entry) && entry["dependency-name"] === name && Object.keys(entry).length === 1)) report("ignore", `${ecosystem}: ignore all updates for shared pin ${name}`);
+		if (Array.isArray(ignore) && ignore.some((entry) => !record$6(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
+		if (Array.isArray(ignore) && ignore.some((entry) => !versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`);
+		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$6(entry) && entry["dependency-name"] === name && versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: ignore all version updates for shared pin ${name}`);
 	}
 	for (const [ecosystem, directories] of roots) for (const directory of directories) if (!covered.get(ecosystem)?.has(directory)) add(`add a ${ecosystem} update entry covering ${directory}`);
 	return diagnostics;
@@ -586,7 +595,7 @@ const locatorValidators = {
 	"bun-source": /^(?:jobs\.[\w-]+|runs)\.steps\.[\w-]+$/
 };
 const knownKind = (value) => typeof value === "string" && Object.hasOwn(locatorValidators, value);
-const record$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** One reviewed declaration identifies one unresolved selector, never a rule. */
 const parseDynamicSelectors = (input) => {
 	if (input === void 0) return [];
@@ -594,7 +603,7 @@ const parseDynamicSelectors = (input) => {
 	const result = [];
 	const keys = /* @__PURE__ */ new Set();
 	for (const entry of input) {
-		if (!record$4(entry) || Object.keys(entry).some((key) => ![
+		if (!record$5(entry) || Object.keys(entry).some((key) => ![
 			"path",
 			"kind",
 			"reason",
@@ -630,7 +639,7 @@ const parseDynamicSelectors = (input) => {
 };
 //#endregion
 //#region src/toolchain-engine-floors.ts
-const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryPath = (value) => typeof value === "string" && value !== "" && !/^[A-Za-z]:/.test(value) && !/[\\\s]/.test(value) && !Array.from(value).some((character) => character.charCodeAt(0) < 32) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
 const parseEngineFloors = (input) => {
 	if (input === void 0) return [];
@@ -638,7 +647,7 @@ const parseEngineFloors = (input) => {
 	const result = [];
 	const jobs = /* @__PURE__ */ new Set();
 	for (const entry of input) {
-		if (!record$3(entry) || Object.keys(entry).some((key) => ![
+		if (!record$4(entry) || Object.keys(entry).some((key) => ![
 			"package",
 			"workflow",
 			"job"
@@ -659,16 +668,16 @@ const resolveEngineFloor = (entry, files) => {
 	const workflowText = files[entry.workflow];
 	if (manifestText === void 0 || workflowText === void 0) throw new Error("engine floor package and workflow must be tracked");
 	const manifest = JSON.parse(manifestText);
-	if (!record$3(manifest) || manifest["private"] === true || typeof manifest["name"] !== "string" || manifest["name"].trim() === "" || !record$3(manifest["engines"]) || typeof manifest["engines"]["node"] !== "string") throw new Error("engine floor package must be published and declare engines.node");
+	if (!record$4(manifest) || manifest["private"] === true || typeof manifest["name"] !== "string" || manifest["name"].trim() === "" || !record$4(manifest["engines"]) || typeof manifest["engines"]["node"] !== "string") throw new Error("engine floor package must be published and declare engines.node");
 	const range = manifest["engines"]["node"];
 	const minimum = validRange(range) === null ? null : minVersion(range);
 	if (minimum === null || minimum.prerelease.length !== 0) throw new Error("engine floor engines.node must declare a stable minimum");
 	const document = parseDocument(workflowText, { merge: true });
 	if (document.errors.length !== 0) throw new Error("engine floor workflow must be valid YAML");
 	const workflow = document.toJS({ maxAliasCount: 100 });
-	if (!record$3(workflow) || !record$3(workflow["jobs"])) throw new Error("engine floor job must exist in its tracked workflow");
+	if (!record$4(workflow) || !record$4(workflow["jobs"])) throw new Error("engine floor job must exist in its tracked workflow");
 	const job = workflow["jobs"][entry.job];
-	if (!record$3(job)) throw new Error("engine floor job must exist in its tracked workflow");
+	if (!record$4(job)) throw new Error("engine floor job must exist in its tracked workflow");
 	if (!Array.isArray(job["steps"]) || Object.hasOwn(job, "uses")) throw new Error("engine floor job must declare steps and cannot reuse a workflow");
 	return {
 		...entry,
@@ -688,7 +697,7 @@ const packageRules = [
 	"typescript-layout",
 	"node-engine"
 ];
-const record$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const shellSubstitutions = (command) => {
 	const frames = [{
 		kind: "root",
@@ -749,43 +758,371 @@ const shellSubstitutions = (command) => {
 	for (const frame of frames.slice(1)) bodies.push(command.slice(frame.start));
 	return bodies;
 };
-const compilerCommandSegments = (command) => {
-	const segments = [[]];
-	for (const source of [command, ...shellSubstitutions(command)]) {
-		segments.push([]);
-		const shellWords = source.match(/(?:[^\s"'\\;&|()]|\\[\s\S]|"(?:[^"\\]|\\[\s\S])*"|'[^']*')+|&&|\|\||[();&|\n]/g);
-		for (const word of shellWords ?? []) if (/^(?:&&|\|\||[;&|\n])$/.test(word)) segments.push([]);
-		else segments.at(-1)?.push(word);
+const shellValueOptions = /* @__PURE__ */ new Set([
+	"--rcfile",
+	"--init-file",
+	"-o",
+	"+o",
+	"-O",
+	"+O"
+]);
+const shellExecutable = /^(?:\/(?:[^/]+\/)*)?(?:bash|dash|ksh|zsh|sh)$/;
+const shellTokens = (source) => {
+	const tokens = [];
+	for (let index = 0; index < source.length;) {
+		const character = source.at(index);
+		if (character === void 0) break;
+		if (character === "\n") {
+			tokens.push({
+				kind: "boundary",
+				value: character,
+				index: index++
+			});
+			continue;
+		}
+		if (/\s/.test(character)) {
+			index++;
+			continue;
+		}
+		if (character === "#") {
+			const end = source.indexOf("\n", index);
+			const stop = end < 0 ? source.length : end;
+			tokens.push({
+				kind: "comment",
+				value: source.slice(index, stop),
+				index
+			});
+			index = stop;
+			continue;
+		}
+		const redirect = /^(?:\d*)(?:&>>|&>|<<<|<<-|<<|>>|>\||>&|<&|<>|>|<)/.exec(source.slice(index));
+		if (redirect !== null) {
+			tokens.push({
+				kind: "redirect",
+				value: redirect[0],
+				index
+			});
+			index += redirect[0].length;
+			continue;
+		}
+		const boundary = /^(?:&&|\|\||[();&|])/.exec(source.slice(index));
+		if (boundary !== null) {
+			tokens.push({
+				kind: "boundary",
+				value: boundary[0],
+				index
+			});
+			index += boundary[0].length;
+			continue;
+		}
+		const start = index;
+		const frames = [{
+			kind: "word",
+			quote: void 0,
+			depth: 0
+		}];
+		while (index < source.length) {
+			const frame = frames.at(-1);
+			const current = source.at(index);
+			if (frame === void 0 || current === void 0) break;
+			if (current === "\\" && frame.quote !== "'") {
+				index += 2;
+				continue;
+			}
+			if (current === "`" && frame.kind === "backticks") {
+				frames.pop();
+				index++;
+				continue;
+			}
+			if (current === frame.quote) {
+				frame.quote = void 0;
+				index++;
+				continue;
+			}
+			if (frame.quote === "'") {
+				index++;
+				continue;
+			}
+			if (current === "$" && source.at(index + 1) === "(") {
+				frames.push({
+					kind: "parentheses",
+					quote: void 0,
+					depth: 1
+				});
+				index += 2;
+				continue;
+			}
+			if (current === "`") {
+				frames.push({
+					kind: "backticks",
+					quote: void 0,
+					depth: 0
+				});
+				index++;
+				continue;
+			}
+			if (frame.quote !== void 0) {
+				index++;
+				continue;
+			}
+			if (current === "'" || current === "\"") {
+				frame.quote = current;
+				index++;
+				continue;
+			}
+			if (frame.kind === "parentheses") {
+				if (current === "(") frame.depth++;
+				if (current === ")" && --frame.depth === 0) frames.pop();
+				index++;
+				continue;
+			}
+			if (frame.kind === "word" && /[\s<>;&|()]/.test(current)) break;
+			index++;
+		}
+		const value = source.slice(start, index);
+		tokens.push({
+			kind: "word",
+			value,
+			index: start
+		});
 	}
-	return segments.map((words) => {
-		let start = 0;
-		const skipAssignments = () => {
-			while (/^[A-Za-z_][A-Za-z\d_]*=/.test(words.at(start) ?? "")) start += 1;
-		};
-		skipAssignments();
-		while (/^(?:\/usr\/bin\/|\/bin\/)?env$/.test(words.at(start) ?? "")) {
-			start += 1;
-			while (start < words.length) {
-				const option = words.at(start);
-				if (option === "--") {
-					start += 1;
-					break;
-				}
-				if (option === "-u" || option === "--unset") {
+	let groupDepth = 0;
+	let redirectTarget = false;
+	const commandWords = [];
+	for (const token of tokens) {
+		if (token.kind === "comment") continue;
+		if (token.kind === "redirect") {
+			redirectTarget = true;
+			continue;
+		}
+		if (redirectTarget) {
+			redirectTarget = false;
+			if (token.kind === "word") continue;
+		}
+		if (token.kind === "boundary") {
+			commandWords.length = 0;
+			continue;
+		}
+		const functionBody = commandWords.length === 2 && commandWords.at(0) === "function";
+		const opensGroup = token.value === "{" && (commandWords.length === 0 || functionBody);
+		const closesGroup = token.value === "}" && groupDepth > 0 && commandWords.length === 0;
+		if (opensGroup || closesGroup) {
+			token.kind = "boundary";
+			groupDepth += opensGroup ? 1 : -1;
+			commandWords.length = 0;
+			continue;
+		}
+		if (commandWords.length === 0 && [
+			"if",
+			"then",
+			"elif",
+			"else",
+			"do",
+			"!",
+			"time"
+		].includes(token.value)) continue;
+		commandWords.push(token.value);
+	}
+	return tokens;
+};
+const shellArgumentTokens = (tokens) => {
+	const arguments_ = [];
+	let redirectTarget = false;
+	for (const token of tokens) {
+		if (token.kind === "comment") continue;
+		if (token.kind === "redirect") {
+			redirectTarget = true;
+			continue;
+		}
+		if (redirectTarget) {
+			redirectTarget = false;
+			if (token.kind === "word") continue;
+		}
+		arguments_.push(token);
+	}
+	return arguments_;
+};
+const shellReadsProgramStdin = (tokens) => {
+	const words = executableShellWords(shellArgumentTokens(tokens).map(({ value }) => value)).map(decodeShellWord);
+	if (!shellExecutable.test(words.at(0) ?? "")) return false;
+	let stdin = false;
+	let script = false;
+	for (let index = 1; index < words.length; index++) {
+		const option = words.at(index) ?? "";
+		if (option === "--" || option === "-") {
+			script = index + 1 < words.length;
+			break;
+		}
+		if (!/^[+-]/.test(option)) {
+			script = true;
+			break;
+		}
+		if (shellValueOptions.has(option)) {
+			index++;
+			continue;
+		}
+		if (/^-[^-]*c/.test(option)) return false;
+		if (/^-[^-]*s/.test(option)) stdin = true;
+	}
+	return stdin || !script;
+};
+const shellStdinHeredoc = (tokens) => {
+	const descriptors = /* @__PURE__ */ new Map();
+	for (let index = 0; index < tokens.length; index++) {
+		const token = tokens.at(index);
+		if (token?.kind !== "redirect") continue;
+		const declaration = /^(\d*)(.+)$/.exec(token.value);
+		const operator = declaration?.[2];
+		if (operator === void 0) continue;
+		const descriptor = String(Number(declaration?.[1] || (operator.startsWith("<") ? "0" : "1")));
+		const target = tokens.at(++index);
+		if (operator === "<<" || operator === "<<-") {
+			descriptors.set(descriptor, token);
+			continue;
+		}
+		if (operator === "<&" || operator === ">&") {
+			const copy = /^(\d+)(-?)$/.exec(decodeShellWord(target?.value ?? ""));
+			const sourceDescriptor = copy?.[1] === void 0 ? void 0 : String(Number(copy[1]));
+			const source = sourceDescriptor === void 0 ? void 0 : descriptors.get(sourceDescriptor);
+			if (source === void 0) descriptors.delete(descriptor);
+			else descriptors.set(descriptor, source);
+			if (copy?.[2] === "-" && sourceDescriptor !== void 0) descriptors.delete(sourceDescriptor);
+			continue;
+		}
+		descriptors.delete(descriptor);
+		if (operator === "&>" || operator === "&>>") descriptors.delete("2");
+	}
+	return descriptors.get("0");
+};
+const shellExecutableSource = (command) => {
+	const pending = [];
+	return command.split(/\r?\n/).map((line) => {
+		const here = pending.at(0);
+		if (here !== void 0) {
+			if ((here.stripTabs ? line.replace(/^\t+/, "") : line) === here.delimiter) {
+				pending.shift();
+				return "";
+			}
+			if (here.execute) return line;
+			if (here.literal) return "";
+			return shellSubstitutions(line).join("\n");
+		}
+		const words = shellTokens(line);
+		let commandStart = 0;
+		for (let index = 0; index < words.length; index++) {
+			const match = words.at(index);
+			const word = match?.value;
+			if (word === void 0) continue;
+			if (match?.kind === "comment") return line.slice(0, match.index);
+			if (match?.kind === "boundary") {
+				commandStart = index + 1;
+				continue;
+			}
+			const declaration = match?.kind === "redirect" ? /^(?:\d*)<<(-?)(.*)$/.exec(word) : null;
+			let delimiter = declaration?.[2];
+			if (delimiter === "") delimiter = words.at(++index)?.value;
+			if (declaration !== null && delimiter !== void 0 && !delimiter.startsWith("<")) {
+				const commandEnd = words.findIndex((entry, position) => position > index && (entry.kind === "boundary" || entry.kind === "comment"));
+				const invocation = words.slice(commandStart, commandEnd < 0 ? void 0 : commandEnd);
+				pending.push({
+					delimiter: decodeShellWord(delimiter),
+					stripTabs: declaration[1] === "-",
+					literal: /['"\\]/.test(delimiter),
+					execute: shellReadsProgramStdin(invocation) && shellStdinHeredoc(invocation) === match
+				});
+			}
+		}
+		return line;
+	}).join("\n");
+};
+const executableShellWords = (words) => {
+	let start = 0;
+	const skipAssignments = () => {
+		while (/^[A-Za-z_][A-Za-z\d_]*=/.test(decodeShellWord(words.at(start) ?? ""))) start += 1;
+	};
+	skipAssignments();
+	while (/^(?:\/usr\/bin\/|\/bin\/)?env$/.test(decodeShellWord(words.at(start) ?? ""))) {
+		start += 1;
+		while (start < words.length) {
+			const option = decodeShellWord(words.at(start) ?? "");
+			if (option === "--") {
+				start += 1;
+				break;
+			}
+			if ([
+				"-u",
+				"--unset",
+				"-C",
+				"--chdir"
+			].includes(option)) {
+				start += 2;
+				continue;
+			}
+			if (option === "-S" || option === "--split-string" || option.startsWith("--split-string=") || option.startsWith("-S") && option.length > 2) {
+				let source;
+				if (option === "-S" || option === "--split-string") {
+					source = decodeShellWord(words.at(start + 1) ?? "");
 					start += 2;
-					continue;
+				} else {
+					source = option.startsWith("-S") ? option.slice(2) : option.slice(15);
+					start++;
 				}
-				if (option === "-" || option === "-i" || option === "--ignore-environment" || /^--unset=.+|^-u.+/.test(option ?? "")) {
-					start += 1;
-					continue;
-				}
-				break;
+				return executableShellWords([
+					"env",
+					...shellTokens(source).map(({ value }) => value),
+					...words.slice(start)
+				]);
 			}
-			skipAssignments();
+			if (option === "-" || option === "-i" || option === "--ignore-environment" || /^--(?:unset|chdir)=.+|^-[uC].+/.test(option)) {
+				start += 1;
+				continue;
+			}
+			break;
 		}
-		return words.slice(start);
-	});
+		skipAssignments();
+	}
+	return words.slice(start);
 };
+const shellCommandBody = (rawWords) => {
+	const words = executableShellWords(rawWords.filter((word) => word !== "(" && word !== ")")).map(decodeShellWord);
+	if (!shellExecutable.test(words.at(0) ?? "")) return void 0;
+	for (let index = 1; index < words.length; index++) {
+		const option = words.at(index);
+		if (option === void 0 || option === "--" || !/^[+-]/.test(option)) return void 0;
+		if (shellValueOptions.has(option)) {
+			index++;
+			continue;
+		}
+		if (/^-[^-]*c/.test(option)) return words.at(index + 1);
+	}
+};
+/** Shared executable shell words preserve assignments for runtime selectors. */
+const shellCommandSegments = (command, grouping = "boundaries") => {
+	const segments = [[]];
+	const executableSource = shellExecutableSource(command);
+	const sources = /* @__PURE__ */ new Set([executableSource, ...shellSubstitutions(executableSource)]);
+	for (const source of sources) {
+		const firstSegment = segments.length;
+		segments.push([]);
+		for (const { kind, value: word } of shellArgumentTokens(shellTokens(source))) if (kind === "boundary") if ([
+			"(",
+			")",
+			"{",
+			"}"
+		].includes(word) && grouping === "tokens") segments.at(-1)?.push(word);
+		else segments.push([]);
+		else segments.at(-1)?.push(word);
+		for (const words of segments.slice(firstSegment)) {
+			const body = shellCommandBody(words);
+			if (body === void 0) continue;
+			const executableBody = shellExecutableSource(body);
+			sources.add(executableBody);
+			for (const substitution of shellSubstitutions(executableBody)) sources.add(substitution);
+		}
+	}
+	return segments;
+};
+const compilerCommandSegments = (command) => shellCommandSegments(command, "tokens").map(executableShellWords);
 const launcherValueOptions = new Map(Object.entries({
 	npx: [
 		"-p",
@@ -919,10 +1256,10 @@ const checkPackageFiles = ({ files, policy }) => {
 			const document = pnpm ? parseDocument(text, { lineCounter }) : void 0;
 			if (document !== void 0 && document.errors.length > 0) throw new Error("invalid YAML");
 			const json = document === void 0 ? JSON.parse(text) : document.toJS();
-			if (!record$2(json)) throw new Error("manifest must be an object");
+			if (!record$3(json)) throw new Error("manifest must be an object");
 			if (pnpm) {
-				if (json["catalog"] !== void 0 && !record$2(json["catalog"])) throw new Error("catalog must be a mapping");
-				if (json["catalogs"] !== void 0 && (!record$2(json["catalogs"]) || Object.values(json["catalogs"]).some((catalog) => !record$2(catalog)))) throw new Error("named catalogs must be mappings");
+				if (json["catalog"] !== void 0 && !record$3(json["catalog"])) throw new Error("catalog must be a mapping");
+				if (json["catalogs"] !== void 0 && (!record$3(json["catalogs"]) || Object.values(json["catalogs"]).some((catalog) => !record$3(catalog)))) throw new Error("named catalogs must be mappings");
 				if (json["packages"] !== void 0 && (!Array.isArray(json["packages"]) || !json["packages"].every((pattern) => typeof pattern === "string"))) throw new Error("workspace packages must be patterns");
 			}
 			manifests.set(file, json);
@@ -936,13 +1273,13 @@ const checkPackageFiles = ({ files, policy }) => {
 					catalog: json["overrides"],
 					prefix: ["overrides"]
 				},
-				...record$2(json["catalogs"]) ? Object.entries(json["catalogs"]).map(([name, catalog]) => ({
+				...record$3(json["catalogs"]) ? Object.entries(json["catalogs"]).map(([name, catalog]) => ({
 					catalog,
 					prefix: ["catalogs", name]
 				})) : []
 			];
 			for (const { catalog, prefix } of catalogEntries) {
-				if (!record$2(catalog)) continue;
+				if (!record$3(catalog)) continue;
 				for (const [name, value] of Object.entries(catalog)) {
 					const node = document.getIn([...prefix, name], true);
 					if (!isNode(node) || node.range === void 0 || node.range === null) continue;
@@ -961,7 +1298,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			});
 		}
 	}
-	const catalogSources = (json) => [json, ...record$2(json["workspaces"]) ? [json["workspaces"]] : []];
+	const catalogSources = (json) => [json, ...record$3(json["workspaces"]) ? [json["workspaces"]] : []];
 	const pnpmWorkspaceFor = (file) => {
 		let directory = path.posix.dirname(file);
 		while (true) {
@@ -984,8 +1321,8 @@ const checkPackageFiles = ({ files, policy }) => {
 				patterns: workspace["packages"],
 				rootMembership: "implicit"
 			})) return void 0;
-			if (name === "" || name === "default") return workspace["catalog"] ?? (record$2(workspace["catalogs"]) ? workspace["catalogs"]["default"] : void 0);
-			return record$2(workspace["catalogs"]) ? workspace["catalogs"][name] : void 0;
+			if (name === "" || name === "default") return workspace["catalog"] ?? (record$3(workspace["catalogs"]) ? workspace["catalogs"]["default"] : void 0);
+			return record$3(workspace["catalogs"]) ? workspace["catalogs"][name] : void 0;
 		}
 		let directory = path.posix.dirname(file);
 		while (true) {
@@ -993,7 +1330,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			if (manifest !== void 0) {
 				for (const source of catalogSources(manifest)) {
 					if (name === "" && source["catalog"] !== void 0) return source["catalog"];
-					if (record$2(source["catalogs"]) && source["catalogs"][name] !== void 0) return source["catalogs"][name];
+					if (record$3(source["catalogs"]) && source["catalogs"][name] !== void 0) return source["catalogs"][name];
 				}
 				if (manifest["workspaces"] !== void 0) return void 0;
 			}
@@ -1007,7 +1344,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			if (visited.has(value)) return void 0;
 			visited.add(value);
 			const catalog = catalogFor(file, value.slice(8));
-			value = record$2(catalog) ? catalog[name] : void 0;
+			value = record$3(catalog) ? catalog[name] : void 0;
 		}
 		return value;
 	};
@@ -1023,7 +1360,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			const workspaces = manifests.get(path.posix.join(directory, "package.json"))?.["workspaces"];
 			if (workspaces !== void 0) return {
 				directory,
-				patterns: record$2(workspaces) ? workspaces["packages"] : workspaces,
+				patterns: record$3(workspaces) ? workspaces["packages"] : workspaces,
 				source: "json"
 			};
 			if (directory === ".") return void 0;
@@ -1079,7 +1416,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			"peerDependencies"
 		]) {
 			const dependencies = json[section];
-			if (!record$2(dependencies)) continue;
+			if (!record$3(dependencies)) continue;
 			for (const [name, value] of Object.entries(dependencies)) {
 				if (!tsSpecifiers.has(name)) continue;
 				const resolved = resolve(file, name, value);
@@ -1141,7 +1478,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			message: `packageManager Bun version must be ${policy.bun}, found ${JSON.stringify(manager)}`
 		});
 		const checkEntries = (entries, location) => {
-			if (!record$2(entries)) return;
+			if (!record$3(entries)) return;
 			for (const [name, raw] of Object.entries(entries)) {
 				const value = resolve(file, name, raw);
 				const tsAllowed = tsSpecifiers.get(name);
@@ -1178,12 +1515,12 @@ const checkPackageFiles = ({ files, policy }) => {
 			"devDependencies",
 			"optionalDependencies"
 		]) checkEntries(json[key]);
-		if (record$2(json["peerDependencies"])) {
+		if (record$3(json["peerDependencies"])) {
 			for (const [name, value] of Object.entries(json["peerDependencies"])) if (tsSpecifiers.has(name) && !peerRange(resolve(file, name, value))) checkEntries({ [name]: value });
 		}
 		for (const source of catalogSources(json)) {
 			checkEntries(source["catalog"]);
-			if (!record$2(source["catalogs"])) continue;
+			if (!record$3(source["catalogs"])) continue;
 			for (const catalog of Object.values(source["catalogs"])) checkEntries(catalog);
 		}
 		const ownedNames = /* @__PURE__ */ new Set([...pins.keys(), ...tsSpecifiers.keys()]);
@@ -1195,7 +1532,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			"optionalDependencies"
 		]) {
 			const entries = resolutionRoot[section];
-			if (!record$2(entries)) continue;
+			if (!record$3(entries)) continue;
 			for (const [name, value] of Object.entries(entries)) resolutionDependencies[name] = resolve(file, name, value);
 		}
 		const affectedSpecifiers = /* @__PURE__ */ new Map();
@@ -1215,7 +1552,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				"optionalDependencies"
 			]) {
 				const entries = member[section];
-				if (!record$2(entries)) continue;
+				if (!record$3(entries)) continue;
 				for (const [name, value] of Object.entries(entries)) {
 					if (!tsSpecifiers.has(name)) continue;
 					const values = affectedSpecifiers.get(name) ?? /* @__PURE__ */ new Set();
@@ -1225,7 +1562,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			}
 		}
 		const checkResolutionMap = (entries, parent) => {
-			if (!record$2(entries)) return;
+			if (!record$3(entries)) return;
 			for (const [selector, replacement] of Object.entries(entries)) {
 				const target = selector === "." ? parent : selector;
 				if (target === void 0) continue;
@@ -1248,7 +1585,7 @@ const checkPackageFiles = ({ files, policy }) => {
 					});
 					continue;
 				}
-				if (record$2(replacement)) {
+				if (record$3(replacement)) {
 					checkResolutionMap(replacement, target);
 					continue;
 				}
@@ -1282,7 +1619,7 @@ const checkPackageFiles = ({ files, policy }) => {
 		};
 		checkResolutionMap(json["overrides"]);
 		checkResolutionMap(json["resolutions"]);
-		if (record$2(json["pnpm"])) checkResolutionMap(json["pnpm"]["overrides"]);
+		if (record$3(json["pnpm"])) checkResolutionMap(json["pnpm"]["overrides"]);
 		const localEntries = toolchainEntries(file, json);
 		const usesCompiler = policy.typescriptInstallLayouts.some((layout) => localEntries.some(({ name }) => name === layout.compilerPackage));
 		let selectedLayout = layoutFor(specifierMap(localEntries));
@@ -1306,7 +1643,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				key: "dependencies",
 				message: "TypeScript compiler and compatibility packages must match one complete declared install layout"
 			});
-			const command = record$2(json["scripts"]) ? json["scripts"]["typecheck"] : void 0;
+			const command = record$3(json["scripts"]) ? json["scripts"]["typecheck"] : void 0;
 			if (selectedLayout !== void 0 && typeof command === "string") {
 				const normalizedExpected = selectedLayout.typecheckCommand.replace(/\s+/g, " ").trim();
 				for (const words of compilerCommandSegments(command)) {
@@ -1324,7 +1661,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				}
 			}
 		}
-		if (record$2(json["peerDependencies"])) {
+		if (record$3(json["peerDependencies"])) {
 			const peerLayout = selectedLayout ?? workspaceLayoutFor(file)?.layout;
 			for (const [name, raw] of Object.entries(json["peerDependencies"])) {
 				if (!tsSpecifiers.has(name)) continue;
@@ -1348,7 +1685,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				});
 			}
 		}
-		if (record$2(json["engines"]) && json["engines"]["node"] !== void 0 && (typeof json["engines"]["node"] !== "string" || !nodeSupportRangeMatches(policy.node, json["engines"]["node"]))) add({
+		if (record$3(json["engines"]) && json["engines"]["node"] !== void 0 && (typeof json["engines"]["node"] !== "string" || !nodeSupportRangeMatches(policy.node, json["engines"]["node"]))) add({
 			file,
 			rule: "node-engine",
 			key: "node",
@@ -1359,6 +1696,232 @@ const checkPackageFiles = ({ files, policy }) => {
 	return diagnostics;
 };
 //#endregion
+//#region src/toolchain-rust.ts
+const record$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Exceptions authorize one immutable release, never a channel or an entire rule. */
+const parseRustExceptions = (input, today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10)) => {
+	if (input === void 0) return [];
+	if (!Array.isArray(input)) throw new Error("rustExceptions must be an array");
+	const pins = /* @__PURE__ */ new Set();
+	return input.map((entry) => {
+		if (!record$2(entry) || Object.keys(entry).length !== 4 || Object.keys(entry).some((key) => ![
+			"pin",
+			"reason",
+			"tracking",
+			"expires"
+		].includes(key)) || typeof entry["pin"] !== "string" || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(entry["pin"]) || typeof entry["reason"] !== "string" || entry["reason"].trim() === "" || typeof entry["tracking"] !== "string" || !/^https:\/\/github\.com\/[^/\s]+\/[^/\s]+\/issues\/[1-9]\d*$/.test(entry["tracking"]) || typeof entry["expires"] !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(entry["expires"]) || !Number.isFinite(Date.parse(entry["expires"])) || new Date(entry["expires"]).toISOString().slice(0, 10) !== entry["expires"] || entry["expires"] <= today || pins.has(entry["pin"])) throw new Error("each Rust exception requires a unique exact stable pin, reason, GitHub issue and future valid expiry date");
+		pins.add(entry["pin"]);
+		return {
+			pin: entry["pin"],
+			reason: entry["reason"],
+			tracking: entry["tracking"],
+			expires: entry["expires"]
+		};
+	});
+};
+/** Only executable fields are inspected: unrelated action inputs are not Rust selectors. */
+const checkRustReferences = (options) => {
+	const { file, rust, exceptions } = options;
+	const text = options.type === "file" ? options.text : "";
+	const diagnostics = [];
+	const select = (value, label, line = 1) => {
+		if (value === rust || exceptions.some(({ pin }) => pin === value)) return;
+		diagnostics.push({
+			rule: "rust-version",
+			path: file,
+			line,
+			message: `${label} must be Rust ${rust}, found ${String(value)}`
+		});
+	};
+	const shell = (source, firstLine = 1) => {
+		const commands = shellCommandSegments(source).map((words) => words.map((word) => ({
+			value: decodeShellWord(word),
+			line: firstLine
+		})));
+		for (const command of commands) {
+			let position = 0;
+			const prefixes = /* @__PURE__ */ new Set([
+				"if",
+				"then",
+				"do",
+				"elif",
+				"!",
+				"env",
+				"sudo",
+				"command",
+				"exec",
+				"time",
+				"export",
+				"readonly",
+				"/usr/bin/env",
+				"/bin/env"
+			]);
+			while (position < command.length) {
+				const value = command.at(position)?.value;
+				if (value?.startsWith("RUSTUP_TOOLCHAIN=")) select(value.slice(17), "RUSTUP_TOOLCHAIN", firstLine);
+				if (value === "-u" || value === "--unset") {
+					position += 2;
+					continue;
+				}
+				if (value?.startsWith("--unset=") || value === "-i" || value === "--ignore-environment") {
+					position++;
+					continue;
+				}
+				if (value !== void 0 && (prefixes.has(value) || /^[A-Za-z_][A-Za-z_\d]*=/.test(value))) position++;
+				else break;
+			}
+			const executable = command.at(position)?.value;
+			const arguments_ = command.slice(position + 1);
+			if (executable === "cargo" && arguments_.at(0)?.value.startsWith("+")) {
+				const selector = arguments_.at(0);
+				select(selector?.value.slice(1), "cargo toolchain", selector?.line);
+			}
+			if (executable !== "rustup") continue;
+			let subcommandPosition = 0;
+			while (subcommandPosition < arguments_.length) {
+				const token = arguments_.at(subcommandPosition);
+				if (token === void 0) break;
+				if (token.value === "--") {
+					subcommandPosition++;
+					break;
+				}
+				if (token.value.startsWith("+")) select(token.value.slice(1), "rustup toolchain", token.line);
+				else if (!token.value.startsWith("-")) break;
+				subcommandPosition++;
+			}
+			const invocation = arguments_.slice(subcommandPosition);
+			const subcommand = invocation.at(0)?.value;
+			if (subcommand === "target" || subcommand === "component") {
+				for (let index = 1; index < invocation.length; index++) {
+					const token = invocation.at(index);
+					if (token?.value === "--toolchain") select(invocation.at(++index)?.value, "rustup --toolchain", token.line);
+					else if (token?.value.startsWith("--toolchain=")) select(token.value.slice(12), "rustup --toolchain", token.line);
+				}
+				continue;
+			}
+			let selectors;
+			let requiresSelector = true;
+			let firstSelectorOnly = false;
+			if (subcommand === "default" || subcommand === "install" || subcommand === "add" || subcommand === "update") {
+				selectors = invocation.slice(1);
+				requiresSelector = subcommand !== "update";
+			} else if (subcommand === "toolchain" && [
+				"install",
+				"add",
+				"update"
+			].includes(invocation.at(1)?.value ?? "")) {
+				selectors = invocation.slice(2);
+				requiresSelector = invocation.at(1)?.value !== "update";
+			} else if (subcommand === "run") {
+				selectors = invocation.slice(1);
+				firstSelectorOnly = true;
+			} else if (subcommand === "override" && invocation.at(1)?.value === "set") {
+				selectors = invocation.slice(2);
+				firstSelectorOnly = true;
+			} else continue;
+			let selected = 0;
+			const optionArguments = /* @__PURE__ */ new Set([
+				"--path",
+				"--profile",
+				"--component",
+				"-c",
+				"--target",
+				"-t"
+			]);
+			for (let index = 0; index < selectors.length; index++) {
+				const token = selectors.at(index);
+				if (token === void 0) continue;
+				if (optionArguments.has(token.value)) {
+					index++;
+					continue;
+				}
+				if (token.value.startsWith("-")) continue;
+				selected++;
+				select(token.value, "rustup toolchain", token.line);
+				if (firstSelectorOnly) break;
+			}
+			if (selected === 0 && requiresSelector) select(void 0, "rustup toolchain", firstLine);
+		}
+	};
+	if (options.type === "environment") {
+		for (const { key, value } of options.assignments) if (key === "RUSTUP_TOOLCHAIN") select(value, key, options.line);
+		return diagnostics;
+	}
+	if (options.type === "command") {
+		shell(options.source, options.line);
+		return diagnostics;
+	}
+	const lineOf = (token) => {
+		const index = text.split(/\r?\n/).findIndex((line) => line.includes(token));
+		return index < 0 ? 1 : index + 1;
+	};
+	if (isShellScript(file, text)) shell(text);
+	if (/(?:^|\/)package\.json$/.test(file)) try {
+		const object = JSON.parse(text);
+		if (record$2(object) && record$2(object["scripts"])) {
+			for (const [name, script] of Object.entries(object["scripts"])) if (typeof script === "string") shell(script, lineOf(`"${name}"`));
+		}
+	} catch {}
+	if (/(?:^|\/)ci-service-images\.json$/.test(file)) {
+		const images = (value) => {
+			if (typeof value === "string" && /^rust(?=:|@|$)/.test(canonicalDockerRuntime(value))) {
+				const tag = canonicalDockerRuntime(value).replace(/^rust:?/, "").split("@").at(0);
+				const version = tag === void 0 ? void 0 : rustImageVersion(tag);
+				select(version, "Rust service image", lineOf(value));
+			} else if (Array.isArray(value)) value.forEach(images);
+			else if (record$2(value)) Object.values(value).forEach(images);
+		};
+		try {
+			images(JSON.parse(text));
+		} catch {
+			diagnostics.push({
+				rule: "rust-version",
+				path: file,
+				line: 1,
+				message: "invalid service image JSON"
+			});
+		}
+	}
+	if (githubAutomationFileKind(file) === void 0) return diagnostics;
+	const document = parseDocument(text);
+	if (document.errors.length > 0) return diagnostics;
+	try {
+		const visit = (value) => {
+			if (Array.isArray(value)) {
+				value.forEach(visit);
+				return;
+			}
+			if (!record$2(value)) return;
+			if (record$2(value["env"]) && value["env"]["RUSTUP_TOOLCHAIN"] !== void 0) select(value["env"]["RUSTUP_TOOLCHAIN"], "RUSTUP_TOOLCHAIN", lineOf("RUSTUP_TOOLCHAIN"));
+			if (typeof value["run"] === "string") shell(value["run"], lineOf("run:"));
+			const uses = value["uses"];
+			if (typeof uses === "string") {
+				const action = uses.split("@").at(0)?.toLowerCase();
+				const inputs = record$2(value["with"]) ? value["with"] : {};
+				if (action === "dtolnay/rust-toolchain" || action === "actions-rust-lang/setup-rust-toolchain") {
+					const entries = Object.entries(inputs).filter(([key]) => key.toLowerCase() === "toolchain");
+					if (entries.length !== 1) select(void 0, `${action} requires an explicit exact toolchain input`, lineOf(uses));
+					else {
+						const selected = entries.at(0)?.at(1);
+						const selectors = action === "actions-rust-lang/setup-rust-toolchain" && typeof selected === "string" ? selected.split(",").map((pin) => pin.trim()) : [selected];
+						for (const selector of selectors) select(selector, `${action} toolchain`, lineOf("toolchain:"));
+					}
+				} else if (/(?:^|\/)\.github\/workflows\/[^@]+\.ya?ml(?:@|$)/.test(uses)) {
+					for (const [key, selected] of Object.entries(inputs)) if (["toolchain", "rust-toolchain"].includes(key.toLowerCase())) select(selected, `reusable workflow ${key}`, lineOf(`${key}:`));
+				}
+			}
+			for (const [key, child] of Object.entries(value)) {
+				if (key === "workflow_call" && record$2(child) && record$2(child["inputs"])) {
+					for (const [input, declaration] of Object.entries(child["inputs"])) if (["toolchain", "rust-toolchain"].includes(input) && record$2(declaration) && declaration["default"] !== void 0) select(declaration["default"], `reusable workflow default ${input}`, lineOf("default:"));
+				}
+				visit(child);
+			}
+		};
+		visit(document.toJS({ maxAliasCount: 100 }));
+	} catch {}
+	return diagnostics;
+};
+//#endregion
 //#region src/toolchain-runtime.ts
 const runtimeRules = [
 	"bun-pins",
@@ -1371,6 +1934,69 @@ const runtimeRules = [
 	"action-pins"
 ];
 const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const dockerEnvironmentAssignments = ({ source, escape }) => {
+	const words = [];
+	let word = "";
+	let quote;
+	for (let index = 0; index < source.length; index++) {
+		const character = source.at(index) ?? "";
+		if (character === escape && quote !== "'") {
+			word += character + (source.at(++index) ?? "");
+			continue;
+		}
+		if (character === quote) quote = void 0;
+		else if (quote === void 0 && (character === "'" || character === "\"")) quote = character;
+		else if (quote === void 0 && /\s/.test(character)) {
+			if (word !== "") words.push(word);
+			word = "";
+			continue;
+		}
+		word += character;
+	}
+	if (quote !== void 0) return void 0;
+	if (word !== "") words.push(word);
+	const decode = (raw) => {
+		let value = "";
+		let quoted;
+		for (let index = 0; index < raw.length; index++) {
+			const character = raw.at(index) ?? "";
+			if (character === quoted) {
+				quoted = void 0;
+				continue;
+			}
+			if (quoted === void 0 && (character === "'" || character === "\"")) {
+				quoted = character;
+				continue;
+			}
+			const next = raw.at(index + 1);
+			if (character === escape && quoted !== "'" && next !== void 0 && (quoted === void 0 || next === "\"" || next === "$" || next === escape)) {
+				value += next;
+				index++;
+			} else value += character;
+		}
+		return value;
+	};
+	const first = words.at(0);
+	if (first === void 0) return void 0;
+	if (!first.includes("=")) {
+		const legacy = /^(\S+)\s+([\s\S]*)$/.exec(source);
+		if (legacy === null) return void 0;
+		return [{
+			key: decode(legacy[1] ?? ""),
+			value: decode(legacy[2] ?? "")
+		}];
+	}
+	const assignments = [];
+	for (const raw of words) {
+		const separator = raw.indexOf("=");
+		if (separator < 1) return void 0;
+		assignments.push({
+			key: decode(raw.slice(0, separator)),
+			value: decode(raw.slice(separator + 1))
+		});
+	}
+	return assignments;
+};
 const pythonSelectorMatches = (value, expected) => value === expected || typeof value === "string" && /^\d+\.\d+$/.test(expected) && value.startsWith(`${expected}.`) && /^\d+\.\d+\.\d+$/.test(value);
 const compareRelease = (left, right) => {
 	for (let index = 0; index < Math.max(left.length, right.length); index++) {
@@ -1440,8 +2066,14 @@ const pythonRequirementMatches = (requirement, version) => {
 	});
 };
 /** Check runtime declarations only in the files that declare or configure them. */
-const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, repository, onDelegated, dynamicSelectors = [], onDynamicSelector, engineFloors = [], onEngineFloor }) => {
-	const diagnostics = [];
+const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, repository, onDelegated, dynamicSelectors = [], onDynamicSelector, rustExceptions = [], engineFloors = [], onEngineFloor }) => {
+	const diagnostics = checkRustReferences({
+		type: "file",
+		file,
+		text,
+		rust: policy.rust,
+		exceptions: rustExceptions
+	});
 	const name = path.posix.basename(file);
 	const lines = text.split(/\r?\n/);
 	const add = ({ rule, line, message }) => {
@@ -1464,7 +2096,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	};
 	const lineOf = (key) => Math.max(1, lines.findIndex((line) => line.includes(key)) + 1);
 	const pin = ({ rule, value, expected, label, line = 1, selector }) => {
-		let matches = value === expected;
+		let matches = value === expected || rule === "rust-version" && rustExceptions.some((entry) => entry.pin === value);
 		if (selector === "node") matches = nodeSelectorMatches(value, expected);
 		else if (label.includes("python")) matches = pythonSelectorMatches(value, expected);
 		if (!matches) add({
@@ -1534,12 +2166,10 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		const parsed = toml("rust-version");
 		if (parsed !== void 0) {
 			const toolchain = parsed["toolchain"];
-			const components = record$1(toolchain) ? toolchain["components"] : void 0;
-			const expected = Array.isArray(components) && components.includes("rustc-dev") ? policy.rustCompilerDevelopment : policy.rust;
 			pin({
 				rule: "rust-version",
 				value: record$1(toolchain) ? toolchain["channel"] : void 0,
-				expected,
+				expected: policy.rust,
 				label: "Rust channel",
 				line: lineOf("channel")
 			});
@@ -1640,7 +2270,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		if (record$1(tools)) for (const [tool, expected] of Object.entries(versions)) {
 			const configured = tools[tool];
 			if (configured !== void 0) pin({
-				rule: "runtime-manager",
+				rule: tool === "rust" || tool === "core:rust" ? "rust-version" : "runtime-manager",
 				value: record$1(configured) ? configured["version"] : configured,
 				expected,
 				selector: nodeTools.has(tool) ? "node" : void 0,
@@ -1655,7 +2285,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		if (tool === void 0 || !(tool in versions)) return;
 		const expected = Object.entries(versions).find(([key]) => key === tool)?.[1];
 		if (expected !== void 0) pin({
-			rule: "runtime-manager",
+			rule: tool === "rust" || tool === "core:rust" ? "rust-version" : "runtime-manager",
 			value: fields.slice(1).join(" "),
 			expected,
 			selector: nodeTools.has(tool) ? "node" : void 0,
@@ -1665,11 +2295,12 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	});
 	const checkRuntimeImage = ({ image, line, label, at }) => {
 		const unknownRuntime = () => {
-			if (dynamic(image) && authorizeDynamic("image", line, at)) return;
+			const rustImage = typeof image === "string" && /^rust(?=:|@|$)/i.test(canonicalDockerRuntime(image));
+			if (!rustImage && dynamic(image) && authorizeDynamic("image", line, at)) return;
 			add({
-				rule: "runtime-docker",
+				rule: rustImage ? "rust-version" : "runtime-docker",
 				line,
-				message: `cannot determine ${label} runtime; use a static image or a scoped dynamicSelectors declaration`
+				message: rustImage ? `cannot determine ${label} Rust release; use a static exact pin` : `cannot determine ${label} runtime; use a static image or a scoped dynamicSelectors declaration`
 			});
 		};
 		if (typeof image !== "string") {
@@ -1681,7 +2312,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		const digestSeparator = structuralImage.indexOf("@");
 		const reference = digestSeparator < 0 ? canonical : canonical.slice(0, digestSeparator);
 		const structuralReference = digestSeparator < 0 ? structuralImage : structuralImage.slice(0, digestSeparator);
-		const managedFamily = /^(node|python|oven\/bun)(?=:|$)/i.exec(structuralReference)?.[1];
+		const managedFamily = /^(node|python|rust|oven\/bun)(?=:|$)/i.exec(structuralReference)?.[1];
 		const tagSeparator = managedFamily === void 0 ? structuralReference.lastIndexOf(":") : structuralReference.indexOf(":", managedFamily.length);
 		const hasTag = managedFamily === void 0 ? tagSeparator > structuralReference.lastIndexOf("/") : tagSeparator !== -1;
 		const imageRepository = hasTag ? reference.slice(0, tagSeparator) : reference;
@@ -1689,8 +2320,11 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			unknownRuntime();
 			return;
 		}
-		if (!/^(node|python|oven\/bun)$/i.test(imageRepository)) return;
+		if (!/^(node|python|rust|oven\/bun)$/i.test(imageRepository)) return;
 		const tool = imageRepository.toLowerCase();
+		let imageRule = "runtime-docker";
+		if (tool === "rust") imageRule = "rust-version";
+		else if (tool === "oven/bun") imageRule = "bun-pins";
 		if (image.includes("$")) {
 			unknownRuntime();
 			return;
@@ -1698,7 +2332,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		const digest = digestSeparator < 0 ? void 0 : canonical.slice(digestSeparator + 1);
 		if (digest !== void 0 && !/^sha256:[a-fA-F\d]{64}$/.test(digest)) {
 			add({
-				rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
+				rule: imageRule,
 				line,
 				message: `${label} ${tool} digest must be sha256 followed by 64 hexadecimal characters`
 			});
@@ -1706,14 +2340,15 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		}
 		const tag = hasTag ? reference.slice(tagSeparator + 1) : void 0;
 		const variantSuffix = tool === "oven/bun" ? /-(?:alpine|slim|debian)$/ : /-(?:alpine(?:\d+(?:\.\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim)$/;
-		const version = tag?.replace(variantSuffix, "");
+		const version = tool === "rust" && tag !== void 0 ? rustImageVersion(tag) : tag?.replace(variantSuffix, "");
 		let expected = policy.bun;
 		if (tool === "node") expected = policy.node;
 		else if (tool === "python") expected = policy.python;
+		else if (tool === "rust") expected = policy.rust;
 		if (digest !== void 0) {
 			if (version === void 0 || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(version)) {
 				add({
-					rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
+					rule: imageRule,
 					line,
 					message: `${label} ${tool} digest requires an exact stable patch tag matching ${expected}`
 				});
@@ -1731,7 +2366,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			}
 		}
 		pin({
-			rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
+			rule: imageRule,
 			value: version,
 			expected,
 			selector: tool === "node" ? "node" : void 0,
@@ -1748,6 +2383,17 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		const heredocs = [];
 		let instruction = "";
 		let startLine = 1;
+		let pendingRustRun;
+		const checkRustCommand = (source, line) => {
+			diagnostics.push(...checkRustReferences({
+				type: "command",
+				file,
+				source,
+				line,
+				rust: policy.rust,
+				exceptions: rustExceptions
+			}));
+		};
 		const expand = (value) => {
 			for (let count = 0; count <= variables.size; count++) {
 				const next = value.replace(/\$(?:\{([A-Za-z_][A-Za-z_\d]*)\}|([A-Za-z_][A-Za-z_\d]*))/g, (reference, braced, plain) => variables.get(braced ?? plain ?? "") ?? reference);
@@ -1834,7 +2480,49 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 				if (key !== void 0 && value !== void 0) variables.set(key, expand(value.replace(/^(["'])(.*)\1$/, "$2")));
 				return;
 			}
-			if (/^\s*(?:RUN|COPY)\s+/i.test(content)) {
+			const run = /^\s*RUN\s+(.+)$/i.exec(content);
+			if (run !== null) {
+				let source = run[1] ?? "";
+				source = source.replace(/^(?:--\S+\s+)*/, "");
+				if (source.startsWith("[")) try {
+					const words = JSON.parse(source);
+					if (Array.isArray(words) && words.every((word) => typeof word === "string")) source = words.map((word) => `'${word.replaceAll("'", "'\\''")}'`).join(" ");
+				} catch {}
+				const implicit = /^(<<-?(?:'[^']+'|"[^"]+"|\S+))(?:\s+(.+))?$/.exec(source);
+				if (implicit !== null && implicit[2] === void 0) source = `sh ${source}`;
+				collectHeredocs(content, line);
+				if (heredocs.length > 0) pendingRustRun = {
+					source,
+					line
+				};
+				else checkRustCommand(source, line);
+				return;
+			}
+			const environment = /^\s*ENV\s+(.+)$/i.exec(content);
+			if (environment !== null) {
+				const assignments = dockerEnvironmentAssignments({
+					source: environment[1] ?? "",
+					escape
+				});
+				if (assignments === void 0) {
+					add({
+						rule: "runtime-docker",
+						line,
+						message: "invalid Docker ENV assignments"
+					});
+					return;
+				}
+				diagnostics.push(...checkRustReferences({
+					type: "environment",
+					file,
+					assignments,
+					line,
+					rust: policy.rust,
+					exceptions: rustExceptions
+				}));
+				return;
+			}
+			if (/^\s*COPY\s+/i.test(content)) {
 				collectHeredocs(content, line);
 				return;
 			}
@@ -1855,7 +2543,12 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		lines.forEach((line, index) => {
 			const heredoc = heredocs.at(0);
 			if (heredoc !== void 0) {
+				if (pendingRustRun !== void 0) pendingRustRun.source += `\n${line}`;
 				if ((heredoc.stripTabs ? line.replace(/^\t+/, "") : line) === heredoc.delimiter) heredocs.shift();
+				if (heredocs.length === 0 && pendingRustRun !== void 0) {
+					checkRustCommand(pendingRustRun.source, pendingRustRun.line);
+					pendingRustRun = void 0;
+				}
 				return;
 			}
 			if (line.trimStart().startsWith("#")) return;
@@ -2530,18 +3223,20 @@ const record = (value) => typeof value === "object" && value !== null && !Array.
 const array = (value) => Array.isArray(value);
 /** Repository-owned declarations are explicit; malformed decisions fail closed. */
 const parseToolchainConfiguration = (input) => {
-	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors" && key !== "dynamicSelectors" && key !== "consumerChecks") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud, engineFloors, dynamicSelectors and consumerChecks declarations");
+	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors" && key !== "dynamicSelectors" && key !== "consumerChecks" && key !== "rustExceptions") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud, engineFloors, dynamicSelectors consumerChecks and rustExceptions declarations");
 	const disabled = /* @__PURE__ */ new Set();
 	const optOuts = input["optOuts"] ?? [];
 	if (!array(optOuts)) throw new Error("optOuts must be an array");
 	for (const entry of optOuts) {
 		if (!record(entry) || Object.keys(entry).some((key) => key !== "rule" && key !== "reason") || typeof entry["rule"] !== "string" || !toolchainRules.some((rule) => rule === entry["rule"]) || typeof entry["reason"] !== "string" || entry["reason"].trim() === "" || disabled.has(entry["rule"])) throw new Error("each opt-out requires a unique known rule and a nonempty reason");
+		if (entry["rule"] === "rust-version") throw new Error("rust-version requires expiring exact-pin rustExceptions, not an opt-out");
 		if (entry["rule"] === "node-engine") throw new Error("node-engine cannot be opted out; engines.node must support the shared Node series");
 		if (entry["rule"] === "cloud-setup-drift") throw new Error("cloud-setup-drift cannot be opted out; generated setup must match shared policy");
 		disabled.add(entry["rule"]);
 	}
 	return {
 		disabled,
+		rustExceptions: parseRustExceptions(input["rustExceptions"]),
 		cloud: parseCloudSetup(input["cloud"]),
 		engineFloors: parseEngineFloors(input["engineFloors"]),
 		dynamicSelectors: parseDynamicSelectors(input["dynamicSelectors"]),
@@ -2554,27 +3249,47 @@ const readToolchainInputs = (root) => {
 	const tracked = execFileSync("git", [
 		"ls-files",
 		"-z",
-		"--cached"
+		"--cached",
+		"--stage"
 	], {
 		cwd: root,
 		encoding: "utf8"
-	}).split("\0").filter((file) => file !== "");
+	}).split("\0").filter((entry) => entry !== "" && !entry.startsWith("160000 ")).map((entry) => entry.slice(entry.indexOf("	") + 1));
 	const files = {};
 	const trackedFiles = new Set(tracked);
 	const resolvedRoot = realpathSync(root);
 	for (const file of tracked) {
 		const kind = toolchainInputKind(file);
-		if (kind === void 0) continue;
+		const shebangCandidate = kind === void 0 && path.posix.extname(file) === "" && !file.split("/").some((part) => part === "vendor" || part === "node_modules");
+		if (kind === void 0 && !shebangCandidate) continue;
 		if (kind === "presence") {
 			files[file] = "";
 			continue;
 		}
 		try {
-			const resolvedFile = realpathSync(path.join(resolvedRoot, file));
+			const inputPath = path.join(resolvedRoot, file);
+			if (shebangCandidate) {
+				const input = lstatSync(inputPath);
+				if (!input.isFile() && !input.isSymbolicLink()) continue;
+			}
+			const resolvedFile = realpathSync(inputPath);
 			const relative = path.relative(resolvedRoot, resolvedFile);
 			if (path.isAbsolute(relative) || relative.split(path.sep).at(0) === ".." || !trackedFiles.has(relative.split(path.sep).join("/"))) throw new Error("Configuration target is outside the tracked tree");
+			if (shebangCandidate) {
+				if (!lstatSync(resolvedFile).isFile()) continue;
+				const descriptor = openSync(resolvedFile, "r");
+				const prefix = Buffer.alloc(512);
+				let count;
+				try {
+					count = readSync(descriptor, prefix, 0, prefix.length, 0);
+				} finally {
+					closeSync(descriptor);
+				}
+				if (toolchainInputKind(file, prefix.toString("utf8", 0, count)) === void 0) continue;
+			}
 			files[file] = readFileSync(resolvedFile, "utf8");
 		} catch {
+			if (shebangCandidate) continue;
 			diagnostics.push({
 				rule: "configuration",
 				path: file,
@@ -2675,6 +3390,7 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 			}
 		},
 		trackedFiles,
+		rustExceptions: configuration.rustExceptions,
 		dynamicSelectors: dynamicSelectors.filter((entry) => entry.path === file),
 		onDynamicSelector: (entry) => selectorMatches.set(entry, (selectorMatches.get(entry) ?? 0) + 1),
 		repository,