@stll/oxlint-config 1.3.1 → 1.5.0

package/dist/toolchain-guard.mjs

@@ -1,18 +1,22 @@
-import { C as nodeSelectorMatches, T as parseCloudSetup, _ as hasCloudAttribution, a as isPythonDependencyManifest, b as cloudSetupPath, c as pythonDependencyManifestKind, d as isComposeDefinitionPath, f as isKubernetesDefinitionPath, g as cloudSessionStartFix, h as cloudClaudeSettingsPath, i as isMiseConfigPath, l as toolchainInputKind, m as cloudAttributionFix, n as isDependabotGithubActionsPath, o as isShellScript, p as workspaceContains, r as isDockerDefinitionPath, s as javascriptDependencyLockfiles, t as githubAutomationFileKind, u as containerDocumentImages, v as hasCloudSessionStartHook, w as nodeSupportRangeMatches, x as generateCloudSetup } from "./toolchain-inputs.mjs";
+import { t as checkRepositoryQuarantine } from "./quarantine-policy2.mjs";
+import { E as parseCloudSetup, S as generateCloudSetup, T as nodeSupportRangeMatches, _ as cloudSessionStartFix, a as isMiseConfigPath, d as containerDocumentImages, f as isComposeDefinitionPath, g as cloudClaudeSettingsPath, h as cloudAttributionFix, i as isDockerDefinitionPath, m as workspaceContains, n as githubAutomationFileKind, p as isKubernetesDefinitionPath, s as isShellScript, u as toolchainInputKind, v as hasCloudAttribution, w as nodeSelectorMatches, x as cloudSetupPath, y as hasCloudSessionStartHook } from "./toolchain-inputs.mjs";
 import { t as readGitTrackedOutput } from "./git-tracked-output.mjs";
-import { _ as parseConsumerFixtures, d as consumerPackageClosure, g as discoverConsumerPackages, i as assertConsumerFixtureKind, n as assertConsumerNodeSupport, o as assertConsumerFixtureSelection } from "./toolchain-schema.mjs";
+import { a as assertConsumerFixtureSelection, g as parseConsumerFixtures, h as discoverConsumerPackages, m as discoverConsumerManifests, r as assertConsumerFixtureKind, t as assertConsumerNodeSupport, u as consumerPackageClosure } from "./consumer-node-support.mjs";
+import { n as dependabotRules, o as canonicalDockerRuntime, s as rustImageVersion, t as checkDependabot } from "./toolchain-dependabot.mjs";
+import "./toolchain-schema.mjs";
+import { createRequire } from "node:module";
+import path, { extname } from "node:path";
 import { closeSync, lstatSync, openSync, readFileSync, readSync, realpathSync } from "node:fs";
-import { execFileSync } from "node:child_process";
-import path from "node:path";
+import { parse } from "smol-toml";
+import { execFileSync, spawnSync } from "node:child_process";
 import { minVersion, satisfies, valid, validRange } from "semver";
-import { parse as parse$1 } from "smol-toml";
 import { LineCounter, isAlias, isMap, isNode, isScalar, isSeq, parseAllDocuments, parseDocument } from "yaml";
 import picomatch from "picomatch";
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "1.3.1";
+const consumerRunnerVersion = "1.5.0";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
-const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {
 	const code = character.charCodeAt(0);
 	return code < 32 || code === 127;
@@ -98,12 +102,12 @@ const validConsumerCron = (text) => {
 	});
 };
 const nightlySchedule = (value) => {
-	if (!record$7(value)) return false;
+	if (!record$10(value)) return false;
 	const schedule = value["schedule"];
 	if (!Array.isArray(schedule) || schedule.length === 0) return false;
 	const coveredDays = /* @__PURE__ */ new Set();
 	for (const entry of schedule) {
-		if (!record$7(entry) || typeof entry["cron"] !== "string" || !validConsumerCron(entry["cron"])) return false;
+		if (!record$10(entry) || typeof entry["cron"] !== "string" || !validConsumerCron(entry["cron"])) return false;
 		const fields = entry["cron"].trim().split(/\s+/);
 		const selections = cronFields.map((field, index) => {
 			const text = fields.at(index);
@@ -119,7 +123,7 @@ const parseConsumerChecks = (input) => {
 	if (!Array.isArray(input)) throw new Error("consumerChecks must be an array");
 	const targets = /* @__PURE__ */ new Set();
 	return input.map((entry) => {
-		if (!record$7(entry) || Object.keys(entry).some((key) => ![
+		if (!record$10(entry) || Object.keys(entry).some((key) => ![
 			"workflow",
 			"job",
 			"packages",
@@ -157,9 +161,9 @@ const checkConsumerChecks = ({ declarations, files, policy }) => {
 			});
 			if (document.errors.length > 0) throw new Error("invalid workflow YAML");
 			const source = document.toJS({ maxAliasCount: 100 });
-			if (!record$7(source) || !record$7(source["jobs"])) continue;
+			if (!record$10(source) || !record$10(source["jobs"])) continue;
 			for (const [jobName, job] of Object.entries(source["jobs"])) {
-				if (!record$7(job) || typeof job["uses"] !== "string") continue;
+				if (!record$10(job) || typeof job["uses"] !== "string") continue;
 				const [workflowPath, ref] = job["uses"].split("@");
 				if (workflowPath?.toLowerCase() !== "stella/.github/.github/workflows/package-consumer-compat.yml") continue;
 				const declaration = declarations.find((entry) => entry.workflow === workflow && entry.job === jobName);
@@ -173,7 +177,7 @@ const checkConsumerChecks = ({ declarations, files, policy }) => {
 				const approved = Object.entries(policy.actions).find(([name]) => name.toLowerCase() === consumerCheckWorkflow)?.[1];
 				if (job["uses"].split("@").length !== 2 || ref === void 0 || !/^[a-f0-9]{40}$/.test(ref) || approved === void 0 || ref !== approved.sha || "steps" in job || "runs-on" in job) throw new Error(`${workflow}:${jobName} must invoke the approved immutable consumer workflow as a reusable job`);
 				const inputs = job["with"];
-				if (!record$7(inputs)) throw new Error(`${workflow}:${jobName} requires consumer inputs`);
+				if (!record$10(inputs)) throw new Error(`${workflow}:${jobName} requires consumer inputs`);
 				const names = /* @__PURE__ */ new Set();
 				for (const key of Object.keys(inputs)) {
 					const normalized = key.toLowerCase();
@@ -237,367 +241,13 @@ const checkConsumerChecks = ({ declarations, files, policy }) => {
 	return diagnostics;
 };
 //#endregion
-//#region src/toolchain-images.ts
-/** Docker Hub spellings accepted by the shared runtime policy. */
-const dockerHubRegistries = [
-	"docker.io",
-	"index.docker.io",
-	"registry-1.docker.io"
-];
-/** Expand the full accepted repository alias class without parsing Dockerfile instructions. */
-const ownedDockerImageAliases = (images) => {
-	const aliases = /* @__PURE__ */ new Set();
-	for (const image of images) for (const repository of [image, `library/${image}`]) {
-		aliases.add(repository);
-		for (const registry of dockerHubRegistries) aliases.add(`${registry}/${repository}`);
-	}
-	return [...aliases].sort();
-};
-/** Preserve tag/digest spelling while normalizing registry and namespace aliases. */
-const canonicalDockerRuntime = (image) => {
-	const registry = dockerHubRegistries.find((entry) => image.toLowerCase().startsWith(`${entry}/`));
-	return (registry === void 0 ? image : image.slice(registry.length + 1)).replace(/^library\//i, "");
-};
-/** Preserve Rust release identity across official Debian slim and Alpine variants. */
-const rustImageVersion = (tag) => tag.replace(/-(?:alpine(?:\d+(?:\.\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim(?:-(?:bookworm|bullseye|trixie|buster))?)$/, "");
-//#endregion
-//#region src/toolchain-dependabot.ts
-const dependabotRules = ["dependabot-policy"];
-const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const strings = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
-const sameStrings = (value, expected) => {
-	if (!strings(value) || value.length !== expected.length) return false;
-	const sortedExpected = [...expected].sort();
-	return [...value].sort().every((entry, index) => entry === sortedExpected[index]);
-};
-const pinnedVersionUpdateTypes = [
-	"version-update:semver-major",
-	"version-update:semver-minor",
-	"version-update:semver-patch"
-];
-const versionOnlyIgnore = (entry) => record$6(entry) && Object.keys(entry).length === 2 && typeof entry["dependency-name"] === "string" && sameStrings(entry["update-types"], pinnedVersionUpdateTypes);
-const directoryOf = (file) => {
-	const directory = path.posix.dirname(file);
-	return directory === "." ? "/" : `/${directory}`;
-};
-const workspaceManifests = {
-	npm: "package.json",
-	cargo: "Cargo.toml",
-	uv: "pyproject.toml"
-};
-const workspaceTable = (parsed, ecosystem) => {
-	switch (ecosystem) {
-		case "npm": return parsed["workspaces"];
-		case "cargo": return parsed["workspace"];
-		case "uv": {
-			const tool = parsed["tool"];
-			const uv = record$6(tool) ? tool["uv"] : void 0;
-			return record$6(uv) ? uv["workspace"] : void 0;
-		}
-		default: throw new Error("unknown workspace ecosystem", { cause: ecosystem });
-	}
-};
-/** Installable workspace members share their update root; own-lock projects stay discoverable. */
-const workspaceRoots = (files, ecosystem) => {
-	const manifests = Object.keys(files).filter((file) => path.posix.basename(file) === workspaceManifests[ecosystem] || ecosystem === "npm" && path.posix.basename(file) === "pnpm-workspace.yaml");
-	const workspaces = /* @__PURE__ */ new Map();
-	const npmWorkspaceErrors = /* @__PURE__ */ new Map();
-	for (const file of manifests) {
-		if (ecosystem === "npm") {
-			const directory = path.posix.dirname(file);
-			const workspaceFile = path.posix.join(directory, "pnpm-workspace.yaml");
-			const text = files[workspaceFile];
-			if (text !== void 0) {
-				try {
-					const document = parseDocument(text);
-					if (document.errors.length > 0) throw new Error(`${workspaceFile}:1: invalid pnpm workspace YAML`);
-					const parsed = document.toJS({ maxAliasCount: 100 });
-					if (!record$6(parsed)) throw new Error(`${workspaceFile}:1: pnpm workspace must contain an object`);
-					const patterns = parsed["packages"] ?? [];
-					if (!strings(patterns)) throw new Error(`${workspaceFile}:1: pnpm packages must be a string array`);
-					workspaces.set(directory, patterns.map((pattern) => pattern.startsWith("!") ? `!${path.posix.normalize(pattern.slice(1))}` : path.posix.normalize(pattern)));
-				} catch (error) {
-					npmWorkspaceErrors.set(directory, error instanceof Error ? error : new Error(String(error)));
-				}
-				continue;
-			}
-		}
-		try {
-			const parsed = ecosystem === "npm" ? JSON.parse(files[file] ?? "") : parse$1(files[file] ?? "");
-			if (!record$6(parsed)) continue;
-			if (ecosystem === "npm" && typeof parsed["packageManager"] === "string" && parsed["packageManager"].startsWith("pnpm@")) continue;
-			const value = workspaceTable(parsed, ecosystem);
-			const patterns = record$6(value) ? value[ecosystem === "npm" ? "packages" : "members"] : value;
-			const members = ecosystem === "cargo" && record$6(value) && patterns === void 0 ? [] : patterns;
-			if (strings(members)) {
-				const excluded = ecosystem !== "npm" && record$6(value) && strings(value["exclude"]) ? value["exclude"].map((pattern) => `!${pattern}`) : [];
-				workspaces.set(path.posix.dirname(file), [...members, ...excluded]);
-			}
-		} catch {}
-	}
-	const implicitCargoMembers = /* @__PURE__ */ new Map();
-	const declaredMember = (root, patterns, directory) => {
-		const relative = path.posix.relative(root, directory);
-		if (relative === "" || relative === ".." || relative.startsWith("../")) return false;
-		return workspaceContains({
-			directory: root,
-			file: path.posix.join(directory, "package.json"),
-			patterns,
-			rootMembership: "patterns"
-		});
-	};
-	const installable = /* @__PURE__ */ new Set(["."]);
-	if (ecosystem === "npm") {
-		for (const file of manifests) {
-			const directory = path.posix.dirname(file);
-			if (javascriptDependencyLockfiles.some((name) => files[path.posix.join(directory, name)] !== void 0)) installable.add(directory);
-		}
-		let changed = true;
-		while (changed) {
-			changed = false;
-			for (const [root, patterns] of workspaces) {
-				if (!installable.has(root)) continue;
-				for (const file of manifests) {
-					const directory = path.posix.dirname(file);
-					if (installable.has(directory) || !declaredMember(root, patterns, directory)) continue;
-					installable.add(directory);
-					changed = true;
-				}
-			}
-		}
-	}
-	if (ecosystem === "npm") {
-		for (const [directory, error] of npmWorkspaceErrors) if (installable.has(directory)) throw error;
-	}
-	if (ecosystem === "cargo") for (const [root, patterns] of workspaces) {
-		const includes = patterns.filter((pattern) => !pattern.startsWith("!"));
-		const excludes = patterns.filter((pattern) => pattern.startsWith("!"));
-		const memberDirectories = /* @__PURE__ */ new Set([root]);
-		for (const file of manifests) {
-			const directory = path.posix.dirname(file);
-			const relative = path.posix.relative(root, directory);
-			if (includes.some((pattern) => picomatch.isMatch(relative, pattern)) && !excludes.some((pattern) => picomatch.isMatch(relative, pattern.slice(1)))) memberDirectories.add(directory);
-		}
-		for (const directory of memberDirectories) try {
-			const parsed = parse$1(files[path.posix.join(directory, "Cargo.toml")] ?? "");
-			const workspace = parse$1(files[path.posix.join(root, "Cargo.toml")] ?? "")["workspace"];
-			const inherited = record$6(workspace) ? workspace["dependencies"] : void 0;
-			const dependencyOwners = [parsed];
-			const targets = parsed["target"];
-			if (record$6(targets)) {
-				for (const target of Object.values(targets)) if (record$6(target)) dependencyOwners.push(target);
-			}
-			for (const owner of dependencyOwners) for (const key of [
-				"dependencies",
-				"dev-dependencies",
-				"build-dependencies"
-			]) {
-				const dependencies = owner[key];
-				if (!record$6(dependencies)) continue;
-				for (const [name, dependency] of Object.entries(dependencies)) {
-					if (!record$6(dependency)) continue;
-					const isInherited = dependency["workspace"] === true;
-					const resolved = isInherited && record$6(inherited) ? inherited[name] : dependency;
-					if (!record$6(resolved) || typeof resolved["path"] !== "string") continue;
-					if (path.posix.isAbsolute(resolved["path"]) || /\\|\$|^[A-Za-z]:/.test(resolved["path"])) continue;
-					const target = path.posix.normalize(path.posix.join(isInherited ? root : directory, resolved["path"]));
-					const relative = path.posix.relative(root, target);
-					if (relative.startsWith("../") || relative === ".." || files[path.posix.join(target, "Cargo.toml")] === void 0 || excludes.some((pattern) => picomatch.isMatch(relative, pattern.slice(1)))) continue;
-					memberDirectories.add(target);
-				}
-			}
-		} catch {}
-		implicitCargoMembers.set(root, memberDirectories);
-	}
-	return manifests.filter((file) => ecosystem !== "npm" || installable.has(path.posix.dirname(file))).filter((file) => {
-		const directory = path.posix.dirname(file);
-		return ![...workspaces].some(([root, patterns]) => {
-			if (ecosystem === "npm" && !installable.has(root)) return false;
-			const relative = path.posix.relative(root, directory);
-			if (relative === "" || relative.startsWith("../")) return false;
-			const includes = patterns.filter((pattern) => !pattern.startsWith("!"));
-			const excludes = patterns.filter((pattern) => pattern.startsWith("!"));
-			return (implicitCargoMembers.get(root)?.has(directory) === true || (ecosystem === "npm" ? declaredMember(root, patterns, directory) : includes.some((pattern) => picomatch.isMatch(relative, pattern)))) && !excludes.some((pattern) => picomatch.isMatch(relative, pattern.slice(1)));
-		});
-	}).map(directoryOf).filter((directory, index, values) => values.indexOf(directory) === index);
-};
-const javascriptEcosystem = (directory, files) => {
-	const root = directory === "/" ? "." : directory.slice(1);
-	if (files[path.posix.join(root, "bun.lock")] !== void 0) return "bun";
-	try {
-		const manifest = JSON.parse(files[path.posix.join(root, "package.json")] ?? "{}");
-		if (record$6(manifest) && typeof manifest["packageManager"] === "string" && manifest["packageManager"].startsWith("bun@")) return "bun";
-	} catch {}
-	return "npm";
-};
-const pythonEcosystem = (file, files) => {
-	const manifestKind = pythonDependencyManifestKind(file);
-	if (manifestKind === "pipfile" || manifestKind === "pipfile-lock" || manifestKind === "setup") return "pip";
-	const root = path.posix.dirname(file);
-	if (files[path.posix.join(root, "uv.lock")] !== void 0 || files[path.posix.join(root, "uv.toml")] !== void 0) return "uv";
-	const pyproject = files[path.posix.join(root, "pyproject.toml")];
-	if (pyproject !== void 0) try {
-		const tool = parse$1(pyproject)["tool"];
-		if (record$6(tool) && record$6(tool["uv"])) return "uv";
-	} catch {}
-	return "pip";
-};
-const ecosystemRoots = (files) => {
-	const roots = /* @__PURE__ */ new Map();
-	const requireRoot = (ecosystem, directory) => {
-		const directories = roots.get(ecosystem) ?? /* @__PURE__ */ new Set();
-		directories.add(directory);
-		roots.set(ecosystem, directories);
-	};
-	for (const directory of workspaceRoots(files, "npm")) requireRoot(javascriptEcosystem(directory, files), directory);
-	for (const directory of workspaceRoots(files, "cargo")) requireRoot("cargo", directory);
-	for (const directory of workspaceRoots(files, "uv")) {
-		const root = directory === "/" ? "." : directory.slice(1);
-		requireRoot(pythonEcosystem(path.posix.join(root, "pyproject.toml"), files), directory);
-	}
-	for (const file of Object.keys(files)) {
-		if (isDependabotGithubActionsPath(file)) requireRoot("github-actions", "/");
-		const name = path.posix.basename(file);
-		if (isDockerDefinitionPath(file)) requireRoot("docker", directoryOf(file));
-		if (isComposeDefinitionPath(file) || isKubernetesDefinitionPath(file)) for (const document of parseAllDocuments(files[file] ?? "", { merge: true })) {
-			if (document.errors.length > 0) continue;
-			try {
-				const classified = containerDocumentImages(document.toJS({ maxAliasCount: 100 }), file);
-				if (classified !== void 0) requireRoot(classified.ecosystem, directoryOf(file));
-			} catch {}
-		}
-		if (name === "uv.lock" || name === "uv.toml" || name !== "pyproject.toml" && isPythonDependencyManifest(file)) requireRoot(pythonEcosystem(file, files), directoryOf(file));
-	}
-	return roots;
-};
-const ignoredFor = (ecosystem, policy) => {
-	if (ecosystem === "npm" || ecosystem === "bun") return policy.ignoredPackages;
-	if (ecosystem === "github-actions") return policy.ignoredActions;
-	if (ecosystem === "docker" || ecosystem === "docker-compose") return ownedDockerImageAliases(policy.ignoredImages);
-	return [];
-};
-/** Validate the shared update policy against a hermetic tracked-file snapshot. */
-const checkDependabot = ({ files, policy }) => {
-	const roots = ecosystemRoots(files);
-	const paths = [".github/dependabot.yml", ".github/dependabot.yaml"].filter((file) => files[file] !== void 0);
-	if (roots.size === 0 && paths.length === 0) return [];
-	const file = paths.at(0) ?? ".github/dependabot.yml";
-	const diagnostics = [];
-	const add = (message, line = 1) => {
-		diagnostics.push({
-			rule: "dependabot-policy",
-			path: file,
-			line,
-			message
-		});
-	};
-	if (paths.length === 0) {
-		add("add a Dependabot configuration for the repository's package ecosystems");
-		return diagnostics;
-	}
-	if (paths.length > 1) add("keep one Dependabot configuration file");
-	const lineCounter = new LineCounter();
-	const document = parseDocument(files[file] ?? "", { lineCounter });
-	if (document.errors.length > 0) {
-		for (const error of document.errors) add(`invalid Dependabot YAML: ${error.message}`, lineCounter.linePos(error.pos[0]).line);
-		return diagnostics;
-	}
-	let parsed;
-	try {
-		parsed = document.toJS({ maxAliasCount: 100 });
-	} catch {
-		add("cannot resolve Dependabot YAML aliases");
-		return diagnostics;
-	}
-	if (!record$6(parsed) || parsed["version"] !== 2 || !Array.isArray(parsed["updates"])) {
-		add("Dependabot must declare version: 2 and an updates array");
-		return diagnostics;
-	}
-	const covered = /* @__PURE__ */ new Map();
-	let legacy;
-	try {
-		const legacyDocument = parseDocument(files[file] ?? "", {
-			version: "1.1",
-			schema: "yaml-1.1"
-		});
-		if (legacyDocument.errors.length === 0) legacy = legacyDocument.toJS({ maxAliasCount: 100 });
-	} catch {}
-	const legacyUpdates = record$6(legacy) && Array.isArray(legacy["updates"]) ? legacy["updates"] : [];
-	const rootClaims = /* @__PURE__ */ new Map();
-	const directoryClaims = /* @__PURE__ */ new Map();
-	for (const [index, update] of parsed["updates"].entries()) {
-		const lineOf = (key) => {
-			const node = document.getIn([
-				"updates",
-				index,
-				key
-			], true);
-			const offset = isNode(node) ? node.range?.[0] : void 0;
-			return offset === void 0 ? 1 : lineCounter.linePos(offset).line;
-		};
-		const report = (key, message) => add(message, lineOf(key));
-		if (!record$6(update) || typeof update["package-ecosystem"] !== "string") {
-			report("package-ecosystem", "each Dependabot update must declare a package ecosystem");
-			continue;
-		}
-		const ecosystem = update["package-ecosystem"];
-		if (update["target-branch"] !== void 0) report("target-branch", `${ecosystem}: shared updates must target the default branch`);
-		if (update["open-pull-requests-limit"] === 0) report("open-pull-requests-limit", `${ecosystem}: version updates must remain enabled`);
-		const single = update["directory"];
-		const multiple = update["directories"];
-		let directories = [];
-		if (typeof single === "string" && multiple === void 0) directories = [single];
-		else if (single === void 0 && strings(multiple)) directories = multiple;
-		const validDirectories = directories.filter((directory) => directory.startsWith("/") && !directory.split("/").includes(".."));
-		if (directories.length === 0 || validDirectories.length !== directories.length) report("directory", `${ecosystem}: declare directory or nonempty directories with absolute repository paths`);
-		const normalizedDirectories = Array.from(new Set(validDirectories.map((value) => path.posix.normalize(value).replace(/\/+$/, "") || "/")));
-		const matches = covered.get(ecosystem) ?? /* @__PURE__ */ new Set();
-		const claimedDirectories = directoryClaims.get(ecosystem) ?? /* @__PURE__ */ new Map();
-		for (const directory of normalizedDirectories) {
-			const previous = claimedDirectories.get(directory);
-			if (previous !== void 0) report(multiple === void 0 ? "directory" : "directories", `${ecosystem}: directory ${directory} overlaps update entry ${previous + 1}`);
-			else claimedDirectories.set(directory, index);
-		}
-		directoryClaims.set(ecosystem, claimedDirectories);
-		const claimedRoots = rootClaims.get(ecosystem) ?? /* @__PURE__ */ new Map();
-		for (const root of roots.get(ecosystem) ?? []) if (normalizedDirectories.some((directory) => directory === root || multiple !== void 0 && picomatch.isMatch(root, directory))) {
-			const previous = claimedRoots.get(root);
-			if (previous !== void 0) report(multiple === void 0 ? "directory" : "directories", `${ecosystem}: update root ${root} overlaps update entry ${previous + 1}`);
-			else claimedRoots.set(root, index);
-			matches.add(root);
-		}
-		rootClaims.set(ecosystem, claimedRoots);
-		covered.set(ecosystem, matches);
-		const schedule = update["schedule"];
-		const legacyUpdate = legacyUpdates.at(index);
-		const legacySchedule = record$6(legacyUpdate) ? legacyUpdate["schedule"] : void 0;
-		if (record$6(schedule) && schedule["time"] === policy.schedule.time && (!record$6(legacySchedule) || legacySchedule["time"] !== policy.schedule.time)) report("schedule", `${ecosystem}: quote schedule time to preserve its string value in YAML 1.1`);
-		if (!record$6(schedule) || Object.keys(schedule).length !== Object.keys(policy.schedule).length || Object.entries(policy.schedule).some(([key, value]) => schedule[key] !== value)) report("schedule", `${ecosystem}: schedule must match the shared policy`);
-		const cooldown = update["cooldown"];
-		if (!record$6(cooldown) || Object.keys(cooldown).length !== 1 || cooldown["default-days"] !== policy.cooldown.defaultDays) report("cooldown", `${ecosystem}: cooldown must contain only default-days: ${policy.cooldown.defaultDays}`);
-		const groups = update["groups"];
-		if (!record$6(groups) || Object.keys(groups).length !== Object.keys(policy.groups).length || Object.entries(policy.groups).some(([name, expected]) => {
-			const group = groups[name];
-			return !record$6(group) || Object.keys(group).length !== 2 || !sameStrings(group["patterns"], expected.patterns) || !sameStrings(group["update-types"], expected.updateTypes);
-		})) report("groups", `${ecosystem}: groups must match the shared policy`);
-		const ignored = ignoredFor(ecosystem, policy);
-		const ignore = update["ignore"];
-		if (ignore !== void 0 && (!Array.isArray(ignore) || ignore.length === 0)) report("ignore", `${ecosystem}: omit ignore or provide a nonempty array`);
-		if (Array.isArray(ignore) && ignore.some((entry) => !record$6(entry) || typeof entry["dependency-name"] !== "string" || !ignored.includes(entry["dependency-name"]))) report("ignore", `${ecosystem}: ignore only packages owned by the shared policy`);
-		if (Array.isArray(ignore) && ignore.some((entry) => !versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: each shared-pin ignore must contain only dependency-name and update-types for semver-major, semver-minor, and semver-patch version updates; security updates must remain enabled`);
-		for (const name of ignored) if (!Array.isArray(ignore) || !ignore.some((entry) => record$6(entry) && entry["dependency-name"] === name && versionOnlyIgnore(entry))) report("ignore", `${ecosystem}: ignore all version updates for shared pin ${name}`);
-	}
-	for (const [ecosystem, directories] of roots) for (const directory of directories) if (!covered.get(ecosystem)?.has(directory)) add(`add a ${ecosystem} update entry covering ${directory}`);
-	return diagnostics;
-};
-//#endregion
 //#region src/toolchain-dynamic-selectors.ts
 const locatorValidators = {
 	image: /^(?:jobs\.[\w-]+\.(?:container|services\.[\w-]+)|services\.[\w.-]+\.image)$/,
 	"bun-source": /^(?:jobs\.[\w-]+|runs)\.steps\.[\w-]+$/
 };
 const knownKind = (value) => typeof value === "string" && Object.hasOwn(locatorValidators, value);
-const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** One reviewed declaration identifies one unresolved selector, never a rule. */
 const parseDynamicSelectors = (input) => {
 	if (input === void 0) return [];
@@ -605,7 +255,7 @@ const parseDynamicSelectors = (input) => {
 	const result = [];
 	const keys = /* @__PURE__ */ new Set();
 	for (const entry of input) {
-		if (!record$5(entry) || Object.keys(entry).some((key) => ![
+		if (!record$9(entry) || Object.keys(entry).some((key) => ![
 			"path",
 			"kind",
 			"reason",
@@ -641,7 +291,7 @@ const parseDynamicSelectors = (input) => {
 };
 //#endregion
 //#region src/toolchain-engine-floors.ts
-const record$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryPath = (value) => typeof value === "string" && value !== "" && !/^[A-Za-z]:/.test(value) && !/[\\\s]/.test(value) && !Array.from(value).some((character) => character.charCodeAt(0) < 32) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
 const parseEngineFloors = (input) => {
 	if (input === void 0) return [];
@@ -649,7 +299,7 @@ const parseEngineFloors = (input) => {
 	const result = [];
 	const jobs = /* @__PURE__ */ new Set();
 	for (const entry of input) {
-		if (!record$4(entry) || Object.keys(entry).some((key) => ![
+		if (!record$8(entry) || Object.keys(entry).some((key) => ![
 			"package",
 			"workflow",
 			"job"
@@ -670,16 +320,16 @@ const resolveEngineFloor = (entry, files) => {
 	const workflowText = files[entry.workflow];
 	if (manifestText === void 0 || workflowText === void 0) throw new Error("engine floor package and workflow must be tracked");
 	const manifest = JSON.parse(manifestText);
-	if (!record$4(manifest) || manifest["private"] === true || typeof manifest["name"] !== "string" || manifest["name"].trim() === "" || !record$4(manifest["engines"]) || typeof manifest["engines"]["node"] !== "string") throw new Error("engine floor package must be published and declare engines.node");
+	if (!record$8(manifest) || manifest["private"] === true || typeof manifest["name"] !== "string" || manifest["name"].trim() === "" || !record$8(manifest["engines"]) || typeof manifest["engines"]["node"] !== "string") throw new Error("engine floor package must be published and declare engines.node");
 	const range = manifest["engines"]["node"];
 	const minimum = validRange(range) === null ? null : minVersion(range);
 	if (minimum === null || minimum.prerelease.length !== 0) throw new Error("engine floor engines.node must declare a stable minimum");
 	const document = parseDocument(workflowText, { merge: true });
 	if (document.errors.length !== 0) throw new Error("engine floor workflow must be valid YAML");
 	const workflow = document.toJS({ maxAliasCount: 100 });
-	if (!record$4(workflow) || !record$4(workflow["jobs"])) throw new Error("engine floor job must exist in its tracked workflow");
+	if (!record$8(workflow) || !record$8(workflow["jobs"])) throw new Error("engine floor job must exist in its tracked workflow");
 	const job = workflow["jobs"][entry.job];
-	if (!record$4(job)) throw new Error("engine floor job must exist in its tracked workflow");
+	if (!record$8(job)) throw new Error("engine floor job must exist in its tracked workflow");
 	if (!Array.isArray(job["steps"]) || Object.hasOwn(job, "uses")) throw new Error("engine floor job must declare steps and cannot reuse a workflow");
 	return {
 		...entry,
@@ -699,7 +349,7 @@ const packageRules = [
 	"typescript-layout",
 	"node-engine"
 ];
-const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const shellSubstitutions = (command) => {
 	const frames = [{
 		kind: "root",
@@ -1259,10 +909,10 @@ const checkPackageFiles = ({ files, policy }) => {
 			const document = pnpm ? parseDocument(text, { lineCounter }) : void 0;
 			if (document !== void 0 && document.errors.length > 0) throw new Error("invalid YAML");
 			const json = document === void 0 ? JSON.parse(text) : document.toJS();
-			if (!record$3(json)) throw new Error("manifest must be an object");
+			if (!record$7(json)) throw new Error("manifest must be an object");
 			if (pnpm) {
-				if (json["catalog"] !== void 0 && !record$3(json["catalog"])) throw new Error("catalog must be a mapping");
-				if (json["catalogs"] !== void 0 && (!record$3(json["catalogs"]) || Object.values(json["catalogs"]).some((catalog) => !record$3(catalog)))) throw new Error("named catalogs must be mappings");
+				if (json["catalog"] !== void 0 && !record$7(json["catalog"])) throw new Error("catalog must be a mapping");
+				if (json["catalogs"] !== void 0 && (!record$7(json["catalogs"]) || Object.values(json["catalogs"]).some((catalog) => !record$7(catalog)))) throw new Error("named catalogs must be mappings");
 				if (json["packages"] !== void 0 && (!Array.isArray(json["packages"]) || !json["packages"].every((pattern) => typeof pattern === "string"))) throw new Error("workspace packages must be patterns");
 			}
 			manifests.set(file, json);
@@ -1276,13 +926,13 @@ const checkPackageFiles = ({ files, policy }) => {
 					catalog: json["overrides"],
 					prefix: ["overrides"]
 				},
-				...record$3(json["catalogs"]) ? Object.entries(json["catalogs"]).map(([name, catalog]) => ({
+				...record$7(json["catalogs"]) ? Object.entries(json["catalogs"]).map(([name, catalog]) => ({
 					catalog,
 					prefix: ["catalogs", name]
 				})) : []
 			];
 			for (const { catalog, prefix } of catalogEntries) {
-				if (!record$3(catalog)) continue;
+				if (!record$7(catalog)) continue;
 				for (const [name, value] of Object.entries(catalog)) {
 					const node = document.getIn([...prefix, name], true);
 					if (!isNode(node) || node.range === void 0 || node.range === null) continue;
@@ -1301,7 +951,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			});
 		}
 	}
-	const catalogSources = (json) => [json, ...record$3(json["workspaces"]) ? [json["workspaces"]] : []];
+	const catalogSources = (json) => [json, ...record$7(json["workspaces"]) ? [json["workspaces"]] : []];
 	const pnpmWorkspaceFor = (file) => {
 		let directory = path.posix.dirname(file);
 		while (true) {
@@ -1324,8 +974,8 @@ const checkPackageFiles = ({ files, policy }) => {
 				patterns: workspace["packages"],
 				rootMembership: "implicit"
 			})) return void 0;
-			if (name === "" || name === "default") return workspace["catalog"] ?? (record$3(workspace["catalogs"]) ? workspace["catalogs"]["default"] : void 0);
-			return record$3(workspace["catalogs"]) ? workspace["catalogs"][name] : void 0;
+			if (name === "" || name === "default") return workspace["catalog"] ?? (record$7(workspace["catalogs"]) ? workspace["catalogs"]["default"] : void 0);
+			return record$7(workspace["catalogs"]) ? workspace["catalogs"][name] : void 0;
 		}
 		let directory = path.posix.dirname(file);
 		while (true) {
@@ -1333,7 +983,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			if (manifest !== void 0) {
 				for (const source of catalogSources(manifest)) {
 					if (name === "" && source["catalog"] !== void 0) return source["catalog"];
-					if (record$3(source["catalogs"]) && source["catalogs"][name] !== void 0) return source["catalogs"][name];
+					if (record$7(source["catalogs"]) && source["catalogs"][name] !== void 0) return source["catalogs"][name];
 				}
 				if (manifest["workspaces"] !== void 0) return void 0;
 			}
@@ -1347,7 +997,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			if (visited.has(value)) return void 0;
 			visited.add(value);
 			const catalog = catalogFor(file, value.slice(8));
-			value = record$3(catalog) ? catalog[name] : void 0;
+			value = record$7(catalog) ? catalog[name] : void 0;
 		}
 		return value;
 	};
@@ -1363,7 +1013,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			const workspaces = manifests.get(path.posix.join(directory, "package.json"))?.["workspaces"];
 			if (workspaces !== void 0) return {
 				directory,
-				patterns: record$3(workspaces) ? workspaces["packages"] : workspaces,
+				patterns: record$7(workspaces) ? workspaces["packages"] : workspaces,
 				source: "json"
 			};
 			if (directory === ".") return void 0;
@@ -1419,7 +1069,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			"peerDependencies"
 		]) {
 			const dependencies = json[section];
-			if (!record$3(dependencies)) continue;
+			if (!record$7(dependencies)) continue;
 			for (const [name, value] of Object.entries(dependencies)) {
 				if (!tsSpecifiers.has(name)) continue;
 				const resolved = resolve(file, name, value);
@@ -1481,7 +1131,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			message: `packageManager Bun version must be ${policy.bun}, found ${JSON.stringify(manager)}`
 		});
 		const checkEntries = (entries, location) => {
-			if (!record$3(entries)) return;
+			if (!record$7(entries)) return;
 			for (const [name, raw] of Object.entries(entries)) {
 				const value = resolve(file, name, raw);
 				const tsAllowed = tsSpecifiers.get(name);
@@ -1518,12 +1168,12 @@ const checkPackageFiles = ({ files, policy }) => {
 			"devDependencies",
 			"optionalDependencies"
 		]) checkEntries(json[key]);
-		if (record$3(json["peerDependencies"])) {
+		if (record$7(json["peerDependencies"])) {
 			for (const [name, value] of Object.entries(json["peerDependencies"])) if (tsSpecifiers.has(name) && !peerRange(resolve(file, name, value))) checkEntries({ [name]: value });
 		}
 		for (const source of catalogSources(json)) {
 			checkEntries(source["catalog"]);
-			if (!record$3(source["catalogs"])) continue;
+			if (!record$7(source["catalogs"])) continue;
 			for (const catalog of Object.values(source["catalogs"])) checkEntries(catalog);
 		}
 		const ownedNames = /* @__PURE__ */ new Set([...pins.keys(), ...tsSpecifiers.keys()]);
@@ -1535,7 +1185,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			"optionalDependencies"
 		]) {
 			const entries = resolutionRoot[section];
-			if (!record$3(entries)) continue;
+			if (!record$7(entries)) continue;
 			for (const [name, value] of Object.entries(entries)) resolutionDependencies[name] = resolve(file, name, value);
 		}
 		const affectedSpecifiers = /* @__PURE__ */ new Map();
@@ -1555,7 +1205,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				"optionalDependencies"
 			]) {
 				const entries = member[section];
-				if (!record$3(entries)) continue;
+				if (!record$7(entries)) continue;
 				for (const [name, value] of Object.entries(entries)) {
 					if (!tsSpecifiers.has(name)) continue;
 					const values = affectedSpecifiers.get(name) ?? /* @__PURE__ */ new Set();
@@ -1565,7 +1215,7 @@ const checkPackageFiles = ({ files, policy }) => {
 			}
 		}
 		const checkResolutionMap = (entries, parent) => {
-			if (!record$3(entries)) return;
+			if (!record$7(entries)) return;
 			for (const [selector, replacement] of Object.entries(entries)) {
 				const target = selector === "." ? parent : selector;
 				if (target === void 0) continue;
@@ -1588,7 +1238,7 @@ const checkPackageFiles = ({ files, policy }) => {
 					});
 					continue;
 				}
-				if (record$3(replacement)) {
+				if (record$7(replacement)) {
 					checkResolutionMap(replacement, target);
 					continue;
 				}
@@ -1623,7 +1273,7 @@ const checkPackageFiles = ({ files, policy }) => {
 		};
 		checkResolutionMap(json["overrides"]);
 		checkResolutionMap(json["resolutions"]);
-		if (record$3(json["pnpm"])) checkResolutionMap(json["pnpm"]["overrides"]);
+		if (record$7(json["pnpm"])) checkResolutionMap(json["pnpm"]["overrides"]);
 		const localEntries = toolchainEntries(file, json);
 		const usesCompiler = policy.typescriptInstallLayouts.some((layout) => localEntries.some(({ name }) => name === layout.compilerPackage));
 		let selectedLayout = layoutFor(specifierMap(localEntries));
@@ -1647,7 +1297,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				key: "dependencies",
 				message: "TypeScript compiler and compatibility packages must match one complete declared install layout"
 			});
-			const command = record$3(json["scripts"]) ? json["scripts"]["typecheck"] : void 0;
+			const command = record$7(json["scripts"]) ? json["scripts"]["typecheck"] : void 0;
 			if (selectedLayout !== void 0 && typeof command === "string") {
 				const normalizedExpected = selectedLayout.typecheckCommand.replace(/\s+/g, " ").trim();
 				for (const words of compilerCommandSegments(command)) {
@@ -1665,7 +1315,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				}
 			}
 		}
-		if (record$3(json["peerDependencies"])) {
+		if (record$7(json["peerDependencies"])) {
 			const peerLayout = selectedLayout ?? workspaceLayoutFor(file)?.layout;
 			for (const [name, raw] of Object.entries(json["peerDependencies"])) {
 				if (!tsSpecifiers.has(name)) continue;
@@ -1689,7 +1339,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				});
 			}
 		}
-		if (record$3(json["engines"]) && json["engines"]["node"] !== void 0 && (typeof json["engines"]["node"] !== "string" || !nodeSupportRangeMatches(policy.node, json["engines"]["node"]))) add({
+		if (record$7(json["engines"]) && json["engines"]["node"] !== void 0 && (typeof json["engines"]["node"] !== "string" || !nodeSupportRangeMatches(policy.node, json["engines"]["node"]))) add({
 			file,
 			rule: "node-engine",
 			key: "node",
@@ -1699,16 +1349,633 @@ const checkPackageFiles = ({ files, policy }) => {
 	}
 	return diagnostics;
 };
+const extensionKinds = new Map(Object.entries({
+	".js": "javascript",
+	".jsx": "javascript",
+	".mjs": "javascript",
+	".cjs": "javascript",
+	".ts": "typescript",
+	".tsx": "typescript",
+	".mts": "typescript",
+	".cts": "typescript"
+}));
+/** Share source classification between lint ownership and script command discovery. */
+const scriptSourceKind = (file) => extensionKinds.get(extname(file));
+//#endregion
+//#region src/toolchain-script-lifecycle.ts
+const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const declaredManager = (value) => typeof value === "string" ? /^(bun|npm|pnpm|yarn)@(\d+\.\d+\.\d+)(?:\+\S+)?$/u.exec(value) : null;
+const rootScriptManager = (manifest, context) => declaredManager(context.packageManager ?? (record$6(manifest) ? manifest["packageManager"] : void 0))?.at(1);
+const npmHooksEnabled = (file) => {
+	if (file?.type === "unknown") throw new Error("npm lifecycle configuration must be a tracked regular file");
+	if (file?.type !== "tracked") return true;
+	let enabled = true;
+	let section = false;
+	for (const raw of file.source.split(/\r?\n/u)) {
+		const line = raw.trim();
+		if (line.startsWith("[")) {
+			section = true;
+			continue;
+		}
+		if (section || !/^ignore-scripts(?:\s*=|\s*$)/iu.test(line)) continue;
+		if (!/^ignore-scripts(?:\s*=|\s*$)/u.test(line)) throw new Error("npm ignore-scripts must use its canonical lowercase key");
+		const value = line.slice(line.indexOf("=") + 1).trim();
+		if (value !== "true" && value !== "false") throw new Error("npm ignore-scripts must be a literal boolean for lifecycle discovery");
+		enabled = value === "false";
+	}
+	return enabled;
+};
+const yamlSettings = (file, manager) => {
+	if (file?.type === "unknown") throw new Error(`${manager} lifecycle configuration requires tracked regular root files without nested workspace overrides`);
+	if (file?.type !== "tracked") return {};
+	const document = parseDocument(file.source);
+	if (document.errors.length > 0) throw new Error(`Cannot parse ${manager} lifecycle configuration`);
+	let settings;
+	try {
+		settings = document.toJS();
+	} catch {
+		throw new Error(`Cannot parse ${manager} lifecycle configuration`);
+	}
+	if (!record$6(settings)) throw new Error(`${manager} lifecycle configuration must be a mapping`);
+	return settings;
+};
+const pnpmHooksEnabled = (manifest, context) => {
+	const declared = declaredManager(context.packageManager ?? manifest["packageManager"]);
+	const dependency = [manifest["dependencies"], manifest["devDependencies"]].flatMap((field) => record$6(field) ? [field["pnpm"]] : []).find((value) => typeof value === "string");
+	if ((declared?.at(1) === "pnpm" ? declared.at(2) : dependency) !== "12.9.1") throw new Error("pnpm lifecycle discovery requires declared pnpm@12.9.1");
+	const enabled = yamlSettings(context.pnpmWorkspace, "pnpm")["enablePrePostScripts"];
+	if (enabled === void 0) return true;
+	if (typeof enabled !== "boolean") throw new Error("pnpm enablePrePostScripts must be a literal boolean");
+	return enabled;
+};
+/** Automatic pre/post stages run their bodies directly, without pre-pre recursion. */
+const scriptLifecycleStages = ({ name, manager, manifest, scripts, context }) => {
+	const present = [`pre${name}`, `post${name}`].filter((hook) => scripts[hook] !== void 0 && scripts[hook] !== "");
+	if (present.length === 0) return [name];
+	if (present.some((hook) => typeof scripts[hook] !== "string")) throw new Error(`Lifecycle hooks for ${name} must be literal package scripts`);
+	let enabled;
+	switch (manager) {
+		case "npm":
+			enabled = npmHooksEnabled(context.npmrc);
+			break;
+		case "bun":
+			enabled = true;
+			break;
+		case "pnpm":
+			enabled = pnpmHooksEnabled(manifest, context);
+			break;
+		case "yarn": {
+			const declaration = declaredManager(context.packageManager ?? manifest["packageManager"]);
+			if (declaration?.at(1) !== "yarn" || !/^[234]\./u.test(declaration.at(2) ?? "")) throw new Error("Yarn lifecycle discovery requires a declared Berry version (2, 3 or 4)");
+			const settings = yamlSettings(context.yarnrc, "Yarn");
+			if (settings["yarnPath"] !== void 0 && settings["yarnPath"] !== null || settings["plugins"] !== void 0 && (!Array.isArray(settings["plugins"]) || settings["plugins"].length > 0)) throw new Error("Custom Yarn executables or plugins require explicit lifecycle discovery support");
+			enabled = false;
+			break;
+		}
+		default: throw new Error(`Cannot determine the package manager for lifecycle hooks of ${name}`);
+	}
+	if (!enabled) return [name];
+	const source = scripts[name];
+	const include = (hook) => present.includes(hook) && !(manager === "pnpm" && typeof source === "string" && source.includes(hook));
+	return [
+		...include(`pre${name}`) ? [`pre${name}`] : [],
+		name,
+		...include(`post${name}`) ? [`post${name}`] : []
+	];
+};
+//#endregion
+//#region src/toolchain-lint-command.ts
+const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const scriptManagers = /* @__PURE__ */ new Set([
+	"bun",
+	"npm",
+	"pnpm",
+	"yarn"
+]);
+const valueFlags = /* @__PURE__ */ new Set([
+	"-c",
+	"--config",
+	"--tsconfig",
+	"--ignore-path",
+	"--ignore-pattern",
+	"-A",
+	"--allow",
+	"-W",
+	"--warn",
+	"-D",
+	"--deny",
+	"-f",
+	"--format",
+	"--max-warnings",
+	"--threads",
+	"--report-unused-disable-directives-severity"
+]);
+const booleanFlags = /* @__PURE__ */ new Set([
+	"--no-ignore",
+	"--quiet",
+	"--deny-warnings",
+	"--silent",
+	"--no-error-on-unmatched-pattern",
+	"--disable-nested-config",
+	"--report-unused-disable-directives",
+	"--disable-unicorn-plugin",
+	"--disable-oxc-plugin",
+	"--disable-typescript-plugin",
+	"--import-plugin",
+	"--react-plugin",
+	"--jsdoc-plugin",
+	"--jest-plugin",
+	"--vitest-plugin",
+	"--jsx-a11y-plugin",
+	"--nextjs-plugin",
+	"--react-perf-plugin",
+	"--promise-plugin",
+	"--node-plugin",
+	"--vue-plugin"
+]);
+const literalWord = (raw) => {
+	let quote;
+	for (let index = 0; index < raw.length; index++) {
+		const character = raw.at(index);
+		if (character === "\\" && quote !== "'") {
+			index++;
+			continue;
+		}
+		if (character === quote) {
+			quote = void 0;
+			continue;
+		}
+		if (quote === void 0 && (character === "'" || character === "\"")) {
+			quote = character;
+			continue;
+		}
+		if (quote !== "'" && (character === "$" || character === "`")) return false;
+		if (quote === void 0 && character !== void 0 && /[*?[\]{}~]/.test(character)) return false;
+	}
+	return quote === void 0;
+};
+const inventoryArguments = (raw) => {
+	const args = [];
+	let threadsSeen = false;
+	for (let index = 0; index < raw.length; index++) {
+		const word = raw.at(index);
+		if (word === void 0) break;
+		if (!literalWord(word)) return { error: "oxlint arguments must be literal shell words" };
+		const value = decodeShellWord(word);
+		if (!value.startsWith("-")) {
+			args.push(value);
+			continue;
+		}
+		if (value === "--") return { error: "oxlint argument terminators are unsupported for inventory" };
+		if (value === "--type-aware" || value === "--type-check") continue;
+		const equals = value.indexOf("=");
+		const flag = equals < 0 ? value : value.slice(0, equals);
+		if (booleanFlags.has(flag)) {
+			if (equals >= 0) return { error: `unexpected value for oxlint flag ${flag}` };
+			args.push(value);
+			continue;
+		}
+		if (!valueFlags.has(flag)) return { error: `unsupported oxlint flag ${flag}` };
+		let argument;
+		if (equals >= 0) {
+			argument = value.slice(equals + 1);
+			if (argument === "") return { error: `missing value for oxlint flag ${flag}` };
+		} else {
+			const next = raw.at(++index);
+			if (next === void 0 || !literalWord(next) || decodeShellWord(next).startsWith("-")) return { error: `missing or nonliteral value for oxlint flag ${flag}` };
+			argument = decodeShellWord(next);
+		}
+		if (flag === "--threads") {
+			if (threadsSeen) return { error: "duplicate oxlint flag --threads" };
+			if (!/^\+?[0-9]+$/u.test(argument) || BigInt(argument) > 18446744073709551615n) return { error: "invalid integer value for oxlint flag --threads" };
+			threadsSeen = true;
+			continue;
+		}
+		if (equals >= 0) args.push(value);
+		else args.push(value, argument);
+	}
+	return { args };
+};
+/** Extract runtime and arguments for the pinned inventory binary; never execute package-script shell text. */
+const lintInventoryCommands = (manifest, forceEnabled = false, context = {}) => {
+	const commands = [];
+	const errors = [];
+	const workspaceTasks = /* @__PURE__ */ new Set();
+	const filteredBuilds = /* @__PURE__ */ new Set();
+	const declaresEngine = record$5(manifest) && [manifest["dependencies"], manifest["devDependencies"]].some((dependencies) => record$5(dependencies) && "oxlint-tsgolint" in dependencies);
+	const enabled = forceEnabled || declaresEngine;
+	if (!enabled) return {
+		commands,
+		errors,
+		enabled,
+		workspaceTask: false
+	};
+	if (!record$5(manifest)) return {
+		commands,
+		errors: ["lint inventory requires an object package manifest"],
+		enabled,
+		workspaceTask: false
+	};
+	const scripts = manifest["scripts"];
+	if (!record$5(scripts)) return {
+		commands,
+		errors: ["type-aware linting requires a root lint script"],
+		enabled,
+		workspaceTask: false
+	};
+	const active = /* @__PURE__ */ new Set();
+	const visited = /* @__PURE__ */ new Set();
+	const visit = (name) => {
+		if (active.has(name)) {
+			errors.push(`cyclic lint script alias: ${name}`);
+			return;
+		}
+		if (visited.has(name)) return;
+		const source = scripts[name];
+		if (typeof source !== "string") {
+			errors.push(`missing literal package script: ${name}`);
+			return;
+		}
+		active.add(name);
+		for (const raw of shellCommandSegments(source)) {
+			if (raw.length === 0) continue;
+			const words = raw.map(decodeShellWord);
+			const first = words.at(0);
+			if (first === "cd" || first === "pushd" || first === "popd") {
+				errors.push(`${name}: changing directories is unsupported for lint inventory`);
+				continue;
+			}
+			if (first === "echo" || first === "printf") continue;
+			if (first === "turbo") {
+				if (words.length === 3 && words.at(1) === "run" && words.at(2) === "lint" && raw.every(literalWord)) workspaceTasks.add(name);
+				else if (words.includes("lint") || !raw.every(literalWord)) errors.push(`${name}: workspace lint delegation requires literal turbo run lint without options`);
+				continue;
+			}
+			if (first === "bun" && words.length === 4 && words.at(1) === "--filter" && words.at(2) !== "" && !words.at(2)?.startsWith("-") && words.at(3) === "build" && raw.every(literalWord)) {
+				const selector = words.at(2);
+				try {
+					if (selector === void 0 || context.assertFilteredBunBuild === void 0) throw new Error("Filtered Bun builds require verified workspace lifecycle context");
+					context.assertFilteredBunBuild(selector);
+					filteredBuilds.add(selector);
+				} catch (error) {
+					errors.push(error instanceof Error ? error.message : "Cannot determine filtered build lifecycle stages");
+				}
+				continue;
+			}
+			if (first !== void 0 && scriptManagers.has(first) && words.at(1) === "run") {
+				const target = words.at(2);
+				if (target !== void 0 && first === "bun" && scriptSourceKind(target) !== void 0 && typeof scripts[target] !== "string") {
+					if (!raw.every(literalWord)) errors.push(`${name}: validation file commands require literal arguments`);
+					continue;
+				}
+				if (raw.length !== 3 || !raw.every(literalWord)) {
+					errors.push(`${name}: package script aliases must have one literal name`);
+					continue;
+				}
+				const alias = words.at(2);
+				if (alias !== void 0) invoke({
+					name: alias,
+					manager: first
+				});
+				continue;
+			}
+			let offset;
+			if (first === "oxlint" || first === "./node_modules/.bin/oxlint" || first === "node_modules/.bin/oxlint") offset = 1;
+			else if (first === "bun" && words.at(1) === "--bun" && words.at(2) === "oxlint") offset = 3;
+			else if (first === "bunx" && words.at(1) === "oxlint") offset = 2;
+			else if (first === "bunx" && words.at(1) === "--no-install" && words.at(2) === "oxlint") offset = 3;
+			if (offset === void 0) {
+				if (words.some((word) => /(?:^|\/)oxlint(?:@[^/]+)?$/.test(word)) || words.some((word, index) => scriptManagers.has(word) && words.slice(index + 1).includes("run")) || words.includes("turbo") && words.includes("lint") || first === "bun" && words.includes("--filter") || first !== void 0 && scriptManagers.has(first) && !(first === "bun" && [
+					"test",
+					"build",
+					"check",
+					"install",
+					"x"
+				].includes(words.at(1) ?? "")) && (words.slice(1).some((word) => typeof scripts[word] === "string") || !raw.every(literalWord)) || raw.at(0) !== void 0 && !literalWord(raw.at(0) ?? "")) errors.push(`${name}: unsupported or dynamic oxlint launcher`);
+				continue;
+			}
+			if (!raw.slice(0, offset).every(literalWord)) {
+				errors.push(`${name}: oxlint launcher must be literal`);
+				continue;
+			}
+			const inventory = inventoryArguments(raw.slice(offset));
+			if (inventory.error !== void 0) errors.push(`${name}: ${inventory.error}`);
+			else commands.push({
+				runtime: first === "bun" ? "bun" : "node",
+				args: inventory.args
+			});
+		}
+		active.delete(name);
+		visited.add(name);
+	};
+	const activeInvocations = /* @__PURE__ */ new Set();
+	const invoke = ({ name, manager }) => {
+		const key = `${manager ?? "unknown"}:${name}`;
+		if (activeInvocations.has(key)) {
+			errors.push(`cyclic lint script alias: ${name}`);
+			return;
+		}
+		activeInvocations.add(key);
+		try {
+			const stages = scriptLifecycleStages({
+				name,
+				manager,
+				manifest,
+				scripts,
+				context
+			});
+			for (const stage of stages) visit(stage);
+		} catch (error) {
+			errors.push(error instanceof Error ? error.message : "Cannot determine script lifecycle stages");
+		} finally {
+			activeInvocations.delete(key);
+		}
+	};
+	invoke({
+		name: context.entryScript ?? "lint",
+		manager: rootScriptManager(manifest, context)
+	});
+	const workspaceTask = workspaceTasks.size > 0;
+	if (!declaresEngine && commands.length === 0 && !workspaceTask && filteredBuilds.size === 0 && errors.length === 0) return {
+		commands,
+		errors,
+		enabled: false,
+		workspaceTask
+	};
+	if (commands.length === 0 && !workspaceTask && filteredBuilds.size === 0 && context.entryScript === void 0) errors.push("root lint scripts contain no supported oxlint invocation");
+	return {
+		commands: errors.length === 0 ? commands : [],
+		errors,
+		enabled,
+		workspaceTask: errors.length === 0 && workspaceTask
+	};
+};
+//#endregion
+//#region src/toolchain-node-projects.ts
+const nodeProjectRule = "type-aware-projects";
+const checkProjectOwnership = ({ trackedFiles, lintedFiles, projectFiles }) => [...new Set(lintedFiles)].filter((file) => scriptSourceKind(file) !== void 0 && trackedFiles.has(file) && !projectFiles.has(file)).sort((left, right) => left.localeCompare(right)).map((file) => ({
+	rule: nodeProjectRule,
+	path: file,
+	line: 1,
+	message: "type-aware lint would use an inferred project; include this file in a declared tsconfig project (for Node scripts, add scripts/tsconfig.json extending @stll/typescript-config/node.json; see the Node scripts recipe in stella/tooling README)"
+}));
+const record$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const stringList = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
+const readCommand = ({ root, executable, args, runtime }) => {
+	const result = spawnSync(runtime, [
+		...runtime === "bun" ? ["--bun"] : [],
+		executable,
+		...args
+	], {
+		cwd: root,
+		encoding: "utf8",
+		timeout: 3e4,
+		maxBuffer: 33554432
+	});
+	if (result.error !== void 0) throw result.error;
+	if (result.status !== 0) throw new Error(`configuration discovery failed: ${(result.stderr + result.stdout).trim()}`);
+	return result.stdout;
+};
+const relativePath = (root, file) => path.relative(root, path.resolve(root, file)).split(path.sep).join("/");
+const lifecycleFile = (root, file, tracked) => {
+	try {
+		const location = path.join(root, file);
+		const metadata = lstatSync(location);
+		if (!tracked.has(file) || !metadata.isFile()) return { type: "unknown" };
+		return {
+			type: "tracked",
+			source: readFileSync(location, "utf8")
+		};
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return { type: "absent" };
+		return { type: "unknown" };
+	}
+};
+/** Inventory and config expansion only: neither subprocess lints or typechecks. */
+const checkNodeProjects = ({ root, manifest, trackedFiles }) => {
+	const packageManager = record$4(manifest) ? manifest["packageManager"] : void 0;
+	const managerUsesPnpmWorkspace = packageManager === void 0 || typeof packageManager === "string" && packageManager.startsWith("pnpm@");
+	const discovered = /* @__PURE__ */ new Map();
+	const workspaceMembers = (pnpmMembership) => {
+		const cached = discovered.get(pnpmMembership);
+		if (cached !== void 0) return cached;
+		const files = { "package.json": JSON.stringify(manifest) };
+		for (const file of trackedFiles) {
+			const name = path.posix.basename(file);
+			if (file !== "package.json" && (name === "package.json" || pnpmMembership && name === "pnpm-workspace.yaml") && !file.split("/").includes("node_modules")) files[file] = readFileSync(path.join(root, file), "utf8");
+		}
+		const result = discoverConsumerManifests(files);
+		discovered.set(pnpmMembership, result);
+		return result;
+	};
+	const filteredCommands = [];
+	const activeBuilds = /* @__PURE__ */ new Set();
+	const workspaceLifecycle = (directory) => {
+		const nestedLifecycle = { ...lifecycle };
+		for (const [key, name] of [
+			["npmrc", ".npmrc"],
+			["pnpmWorkspace", "pnpm-workspace.yaml"],
+			["yarnrc", ".yarnrc.yml"]
+		]) {
+			let ancestor = directory;
+			while (ancestor !== ".") {
+				if (lifecycleFile(root, path.posix.join(ancestor, name), trackedFiles).type !== "absent") {
+					nestedLifecycle[key] = { type: "unknown" };
+					break;
+				}
+				ancestor = path.posix.dirname(ancestor);
+			}
+		}
+		return nestedLifecycle;
+	};
+	const lifecycle = {
+		packageManager: record$4(manifest) ? manifest["packageManager"] : void 0,
+		npmrc: lifecycleFile(root, ".npmrc", trackedFiles),
+		pnpmWorkspace: lifecycleFile(root, "pnpm-workspace.yaml", trackedFiles),
+		yarnrc: lifecycleFile(root, ".yarnrc.yml", trackedFiles),
+		assertFilteredBunBuild: (selector) => {
+			const selected = [...workspaceMembers(false).entries()].filter(([, pkg]) => pkg["name"] === selector);
+			if (selected.length !== 1) throw new Error("Filtered Bun build requires one declared workspace package");
+			const member = selected.at(0);
+			if (member === void 0) throw new Error("Missing selected workspace");
+			const [directory, pkg] = member;
+			const scripts = pkg["scripts"];
+			if (!record$4(scripts) || typeof scripts["build"] !== "string") throw new Error("Filtered Bun build requires a literal build script");
+			if (["prebuild", "postbuild"].some((name) => scripts[name] !== void 0 && scripts[name] !== "")) throw new Error("Filtered Bun build lifecycle hooks are unsupported for lint inventory; invoke lint scopes explicitly");
+			if (activeBuilds.has(directory)) throw new Error("Cyclic filtered Bun build delegation");
+			activeBuilds.add(directory);
+			try {
+				const nested = lintInventoryCommands(pkg, true, {
+					...workspaceLifecycle(directory),
+					entryScript: "build"
+				});
+				if (nested.workspaceTask) throw new Error("Nested workspace lint delegation is unsupported in filtered builds");
+				if (nested.errors.length > 0) throw new Error(`${directory}/package.json: ${nested.errors.join("; ")}`);
+				for (const command of nested.commands) filteredCommands.push({
+					cwd: path.join(root, directory),
+					...command
+				});
+			} finally {
+				activeBuilds.delete(directory);
+			}
+		}
+	};
+	const inventory = lintInventoryCommands(manifest, false, lifecycle);
+	if (!inventory.enabled) return [];
+	const diagnostics = [];
+	const addConfiguration = (file, message) => diagnostics.push({
+		rule: nodeProjectRule,
+		path: file,
+		line: 1,
+		message
+	});
+	for (const error of inventory.errors) addConfiguration("package.json", error);
+	if (inventory.errors.length !== 0) return diagnostics;
+	try {
+		const require = createRequire(path.join(root, "package.json"));
+		const oxlint = path.join(path.dirname(require.resolve("oxlint/package.json")), "bin/oxlint");
+		const compiler = path.join(path.dirname(require.resolve("typescript/package.json")), "bin/tsc");
+		const commands = inventory.commands.map((command) => ({
+			cwd: root,
+			...command
+		}));
+		if (inventory.workspaceTask) {
+			for (const [directory, workspace] of workspaceMembers(managerUsesPnpmWorkspace)) {
+				if (directory === ".") continue;
+				const file = `${directory}/package.json`;
+				if (!record$4(workspace["scripts"]) || workspace["scripts"]["lint"] === void 0) continue;
+				const nestedLifecycle = workspaceLifecycle(directory);
+				const nested = lintInventoryCommands(workspace, true, nestedLifecycle);
+				if (nested.workspaceTask) throw new Error(`nested workspace lint delegation is unsupported: ${file}`);
+				if (nested.errors.length > 0) throw new Error(`${file}: ${nested.errors.join("; ")}`);
+				for (const command of nested.commands) commands.push({
+					cwd: path.join(root, directory),
+					...command
+				});
+			}
+			if (commands.length === 0 && filteredCommands.length === 0) throw new Error("workspace lint task has no declared oxlint commands");
+		}
+		commands.push(...filteredCommands);
+		if (commands.length === 0) throw new Error("root lint scripts contain no supported oxlint invocation");
+		const lintedFiles = commands.flatMap(({ cwd, args, runtime }) => readCommand({
+			root: cwd,
+			executable: oxlint,
+			args: [
+				...args,
+				"--debug",
+				"files",
+				"--threads",
+				"1"
+			],
+			runtime
+		}).split(/\r?\n/).filter((file) => file !== "").map((file) => relativePath(root, path.resolve(cwd, file))));
+		const nearestProject = (start) => {
+			let directory = start;
+			while (true) {
+				const config = path.posix.join(directory, "tsconfig.json");
+				if (trackedFiles.has(config)) return config;
+				if (directory === ".") return void 0;
+				directory = path.posix.dirname(directory);
+			}
+		};
+		const groups = /* @__PURE__ */ new Map();
+		for (const file of new Set(lintedFiles)) {
+			if (!trackedFiles.has(file) || scriptSourceKind(file) === void 0) continue;
+			const config = nearestProject(path.posix.dirname(file));
+			if (config === void 0) continue;
+			const group = groups.get(config);
+			if (group === void 0) groups.set(config, [file]);
+			else group.push(file);
+		}
+		const projects = /* @__PURE__ */ new Map();
+		const readProject = (config) => {
+			const cached = projects.get(config);
+			if (cached !== void 0) return cached;
+			const result = {
+				files: /* @__PURE__ */ new Set(),
+				references: []
+			};
+			try {
+				const project = JSON.parse(readCommand({
+					root,
+					executable: compiler,
+					args: [
+						"--showConfig",
+						"--project",
+						config
+					],
+					runtime: "node"
+				}));
+				if (!record$4(project)) throw new Error("compiler configuration must be an object");
+				const references = project["references"] ?? [];
+				if (!Array.isArray(references)) throw new Error("compiler configuration references must be an array");
+				for (const reference of references) {
+					if (!record$4(reference) || typeof reference["path"] !== "string") throw new Error("compiler project reference requires a path");
+					const target = relativePath(root, path.resolve(root, path.dirname(config), reference["path"]));
+					const referencedConfig = target.endsWith(".json") ? target : path.posix.join(target, "tsconfig.json");
+					if (!trackedFiles.has(referencedConfig)) throw new Error(`project reference is not tracked: ${referencedConfig}`);
+					result.references.push(referencedConfig);
+				}
+				const sources = project["files"] ?? [];
+				if (!stringList(sources)) throw new Error("compiler configuration did not return a files array");
+				const options = project["compilerOptions"];
+				for (const file of sources) {
+					if (scriptSourceKind(file) === "javascript" && (!record$4(options) || options["allowJs"] !== true && options["checkJs"] !== true)) continue;
+					result.files.add(relativePath(root, path.resolve(root, path.dirname(config), file)));
+				}
+			} catch (error) {
+				result.files.clear();
+				result.references.length = 0;
+				addConfiguration(config, error instanceof Error ? error.message : String(error));
+			}
+			projects.set(config, result);
+			return result;
+		};
+		const projectFiles = /* @__PURE__ */ new Set();
+		for (const [nearest, sources] of groups) {
+			const remaining = new Set(sources);
+			const visited = /* @__PURE__ */ new Set();
+			let ancestor = nearest;
+			while (ancestor !== void 0 && remaining.size > 0) {
+				const pending = [ancestor];
+				let config = pending.pop();
+				while (config !== void 0 && remaining.size > 0) {
+					if (!visited.has(config)) {
+						visited.add(config);
+						const project = readProject(config);
+						for (const source of remaining) {
+							if (!project.files.has(source)) continue;
+							projectFiles.add(source);
+							remaining.delete(source);
+						}
+						pending.push(...project.references);
+					}
+					config = pending.pop();
+				}
+				const directory = path.posix.dirname(ancestor);
+				ancestor = directory === "." ? void 0 : nearestProject(path.posix.dirname(directory));
+			}
+		}
+		diagnostics.push(...checkProjectOwnership({
+			trackedFiles,
+			lintedFiles,
+			projectFiles
+		}));
+	} catch (error) {
+		addConfiguration("package.json", error instanceof Error ? error.message : String(error));
+	}
+	return diagnostics;
+};
 //#endregion
 //#region src/toolchain-rust.ts
-const record$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Exceptions authorize one immutable release, never a channel or an entire rule. */
 const parseRustExceptions = (input, today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10)) => {
 	if (input === void 0) return [];
 	if (!Array.isArray(input)) throw new Error("rustExceptions must be an array");
 	const pins = /* @__PURE__ */ new Set();
 	return input.map((entry) => {
-		if (!record$2(entry) || Object.keys(entry).length !== 4 || Object.keys(entry).some((key) => ![
+		if (!record$3(entry) || Object.keys(entry).length !== 4 || Object.keys(entry).some((key) => ![
 			"pin",
 			"reason",
 			"tracking",
@@ -1862,7 +2129,7 @@ const checkRustReferences = (options) => {
 	if (isShellScript(file, text)) shell(text);
 	if (/(?:^|\/)package\.json$/.test(file)) try {
 		const object = JSON.parse(text);
-		if (record$2(object) && record$2(object["scripts"])) {
+		if (record$3(object) && record$3(object["scripts"])) {
 			for (const [name, script] of Object.entries(object["scripts"])) if (typeof script === "string") shell(script, lineOf(`"${name}"`));
 		}
 	} catch {}
@@ -1873,7 +2140,7 @@ const checkRustReferences = (options) => {
 				const version = tag === void 0 ? void 0 : rustImageVersion(tag);
 				select(version, "Rust service image", lineOf(value));
 			} else if (Array.isArray(value)) value.forEach(images);
-			else if (record$2(value)) {
+			else if (record$3(value)) {
 				for (const [key, entry] of Object.entries(value)) if (key !== "name") images(entry);
 			}
 		};
@@ -1897,13 +2164,13 @@ const checkRustReferences = (options) => {
 				value.forEach(visit);
 				return;
 			}
-			if (!record$2(value)) return;
-			if (record$2(value["env"]) && value["env"]["RUSTUP_TOOLCHAIN"] !== void 0) select(value["env"]["RUSTUP_TOOLCHAIN"], "RUSTUP_TOOLCHAIN", lineOf("RUSTUP_TOOLCHAIN"));
+			if (!record$3(value)) return;
+			if (record$3(value["env"]) && value["env"]["RUSTUP_TOOLCHAIN"] !== void 0) select(value["env"]["RUSTUP_TOOLCHAIN"], "RUSTUP_TOOLCHAIN", lineOf("RUSTUP_TOOLCHAIN"));
 			if (typeof value["run"] === "string") shell(value["run"], lineOf("run:"));
 			const uses = value["uses"];
 			if (typeof uses === "string") {
 				const action = uses.split("@").at(0)?.toLowerCase();
-				const inputs = record$2(value["with"]) ? value["with"] : {};
+				const inputs = record$3(value["with"]) ? value["with"] : {};
 				if (action === "dtolnay/rust-toolchain" || action === "actions-rust-lang/setup-rust-toolchain") {
 					const entries = Object.entries(inputs).filter(([key]) => key.toLowerCase() === "toolchain");
 					if (entries.length !== 1) select(void 0, `${action} requires an explicit exact toolchain input`, lineOf(uses));
@@ -1917,8 +2184,8 @@ const checkRustReferences = (options) => {
 				}
 			}
 			for (const [key, child] of Object.entries(value)) {
-				if (key === "workflow_call" && record$2(child) && record$2(child["inputs"])) {
-					for (const [input, declaration] of Object.entries(child["inputs"])) if (["toolchain", "rust-toolchain"].includes(input) && record$2(declaration) && declaration["default"] !== void 0) select(declaration["default"], `reusable workflow default ${input}`, lineOf("default:"));
+				if (key === "workflow_call" && record$3(child) && record$3(child["inputs"])) {
+					for (const [input, declaration] of Object.entries(child["inputs"])) if (["toolchain", "rust-toolchain"].includes(input) && record$3(declaration) && declaration["default"] !== void 0) select(declaration["default"], `reusable workflow default ${input}`, lineOf("default:"));
 				}
 				visit(child);
 			}
@@ -1928,6 +2195,374 @@ const checkRustReferences = (options) => {
 	return diagnostics;
 };
 //#endregion
+//#region src/toolchain-workflow-trust.ts
+const record$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const booleanParts = (source, operator) => {
+	const parts = [];
+	let depth = 0;
+	let quoted = false;
+	let start = 0;
+	for (let index = 0; index < source.length; index++) {
+		const character = source[index];
+		if (character === "'") {
+			if (quoted && source[index + 1] === "'") index++;
+			else quoted = !quoted;
+		}
+		if (quoted) continue;
+		if (character === "(") depth++;
+		if (character === ")") depth--;
+		if (depth === 0 && source.slice(index, index + 2) === operator) {
+			parts.push(source.slice(start, index));
+			start = index + 2;
+			index++;
+		}
+	}
+	parts.push(source.slice(start));
+	return parts;
+};
+const withoutOuterParentheses = (source) => {
+	if (!source.startsWith("(") || !source.endsWith(")")) return source;
+	let depth = 0;
+	let quoted = false;
+	for (let index = 0; index < source.length; index++) {
+		const character = source[index];
+		if (character === "'") {
+			if (quoted && source[index + 1] === "'") index++;
+			else quoted = !quoted;
+		}
+		if (quoted) continue;
+		if (character === "(") depth++;
+		if (character === ")") depth--;
+		if (depth === 0 && index !== source.length - 1) return source;
+	}
+	return withoutOuterParentheses(source.slice(1, -1).trim());
+};
+const excludesUntrusted = ({ condition, event, allowTrust = true }) => {
+	if (condition === false) return true;
+	if (typeof condition !== "string") return false;
+	const source = withoutOuterParentheses(condition.trim().replace(/^\$\{\{([\s\S]*)\}\}$/u, "$1").trim());
+	const alternatives = booleanParts(source, "||");
+	if (alternatives.length > 1) return alternatives.every((part) => excludesUntrusted({
+		condition: part,
+		event,
+		allowTrust
+	}));
+	const conjuncts = booleanParts(source, "&&");
+	if (conjuncts.length > 1) return conjuncts.some((part) => excludesUntrusted({
+		condition: part,
+		event,
+		allowTrust
+	}));
+	const trustComparison = /^needs\.trust-check\.outputs\.trusted\s*==\s*'([^']*)'$/u.exec(source);
+	if (allowTrust && trustComparison?.at(1)?.toLowerCase() === "true") return true;
+	if (source === "false") return true;
+	const comparison = /^github\.event_name\s*(==|!=)\s*'([^']+)'$/u.exec(source);
+	if (comparison === null) return false;
+	const equal = comparison.at(2)?.toLowerCase() === event.toLowerCase();
+	return comparison.at(1) === "==" ? !equal : equal;
+};
+const staticData = (word) => !/[`$\\]/u.test(word) && !/[<>]/u.test(word);
+const metadataScript = (command) => {
+	const interpolation = /\$\{\{([\s\S]*?)\}\}/gu;
+	for (const match of command.matchAll(interpolation)) {
+		const expression = match.at(1);
+		if (expression === void 0 || ![
+			"github.sha",
+			"github.run_id",
+			"github.run_attempt",
+			"github.repository"
+		].includes(expression.trim())) return void 0;
+	}
+	const source = command.replace(interpolation, "stll-metadata");
+	return source.includes("${{") ? void 0 : source;
+};
+const metadataWord = (raw) => {
+	if (/^'[^']*'$/u.test(raw)) return true;
+	if ([
+		"[",
+		"]",
+		"[[",
+		"]]"
+	].includes(raw)) return true;
+	let quote;
+	for (const character of raw) {
+		if (quote === void 0 && "*?~[{$".includes(character)) return false;
+		if (character === quote) quote = void 0;
+		else if (quote === void 0 && (character === "'" || character === "\"")) quote = character;
+	}
+	if (quote !== void 0) return false;
+	const withoutKnownExpressions = raw.replace(/\$\{[A-Za-z_][A-Za-z_0-9]*\}|\$[A-Za-z_][A-Za-z_0-9]*/gu, "value");
+	return !/[`$\\]/u.test(withoutKnownExpressions);
+};
+const safeComparison = (words) => {
+	const first = words.at(0);
+	if (![
+		"test",
+		"[",
+		"[["
+	].includes(first ?? "")) return false;
+	let end;
+	if (first === "[[") end = "]]";
+	else if (first === "[") end = "]";
+	if (end !== void 0 && words.at(-1) !== end) return false;
+	const operands = words.slice(1, end === void 0 ? void 0 : -1);
+	if (operands.length === 1) return true;
+	if (operands.length === 2) return ["-n", "-z"].includes(operands.at(0) ?? "");
+	return operands.length === 3 && [
+		"=",
+		"==",
+		"!="
+	].includes(operands.at(1) ?? "");
+};
+const objectReference = (value) => /^(?:HEAD|[a-f0-9]{7,64}|(?:refs\/(?:heads|tags|remotes)\/|origin\/)[A-Za-z0-9][A-Za-z0-9._/-]*)(?:[~^][0-9]*)*$/u.test(value) && !value.includes("..") && !value.includes("//") && !value.endsWith("/");
+const workflowTrustBootstrapCatalog = {
+	commands: {
+		test: "comparison",
+		"[": "comparison",
+		"[[": "comparison",
+		true: "status",
+		false: "status",
+		exit: "exit",
+		echo: "output",
+		printf: "format",
+		git: "git",
+		gh: "github"
+	},
+	git: {
+		"rev-parse": {
+			flags: ["--short", "--verify"],
+			references: 1
+		},
+		"merge-base": {
+			flags: ["--all", "--is-ancestor"],
+			references: 2
+		}
+	},
+	github: ["api"],
+	actions: {
+		"actions/checkout": [
+			"fetch-depth",
+			"persist-credentials",
+			"ref",
+			"repository",
+			"submodules"
+		],
+		"oven-sh/setup-bun": ["bun-version", "no-cache"]
+	}
+};
+const safeGit = (words) => {
+	const selected = Object.entries(workflowTrustBootstrapCatalog.git).find(([name]) => name === words.at(1));
+	if (selected === void 0) return false;
+	const [, policy] = selected;
+	const references = [];
+	for (const argument of words.slice(2)) {
+		if (!staticData(argument)) return false;
+		if (!argument.startsWith("-")) {
+			references.push(argument);
+			continue;
+		}
+		if (!policy.flags.some((flag) => flag === argument)) return false;
+	}
+	return references.length === policy.references && references.every(objectReference);
+};
+const safeGh = (words) => {
+	if (!words.every(staticData)) return false;
+	if (workflowTrustBootstrapCatalog.github.some((name) => name === words.at(1))) {
+		const arguments_ = words.slice(2);
+		if (["--method", "-X"].includes(arguments_.at(0) ?? "") && arguments_.at(1) === "GET") arguments_.splice(0, 2);
+		if (!arguments_.at(0) || arguments_.at(0)?.startsWith("-")) return false;
+		for (let index = 1; index < arguments_.length; index++) {
+			const argument = arguments_.at(index);
+			if ((argument === "--method" || argument === "-X") && arguments_.at(index + 1) === "GET") index++;
+			else if (["--jq", "-q"].includes(argument ?? "") && /^\.[A-Za-z0-9_.[\]" -]*$/u.test(arguments_.at(index + 1) ?? "")) index++;
+			else return false;
+		}
+		return /^\/?repos\/[A-Za-z0-9_./-]+$/u.test(arguments_.at(0) ?? "");
+	}
+	return false;
+};
+const safeCommand = (raw) => {
+	if (raw.length === 0) return true;
+	if (!raw.every(metadataWord)) return false;
+	const words = raw.map(decodeShellWord);
+	const name = words.at(0);
+	if (raw.at(0) !== name) return false;
+	if (name === "if" || name === "elif") return safeComparison(words.slice(1));
+	if (["then", "else"].includes(name ?? "")) return safeCommand(raw.slice(1));
+	if (name === "fi") return words.length === 1;
+	const kind = Object.entries(workflowTrustBootstrapCatalog.commands).find(([command]) => command === name)?.[1];
+	if (kind === "comparison") return safeComparison(words);
+	if (kind === "status") return words.length === 1;
+	if (kind === "exit") return words.length === 1 || words.length === 2 && /^[0-9]+$/u.test(words.at(1) ?? "");
+	if (kind === "output") return true;
+	if (kind === "format") {
+		const format = words.at(1);
+		return format !== void 0 && !format.startsWith("-") && /^(?:[^%$`]|%%|%s)*$/u.test(format);
+	}
+	if (kind === "git") return safeGit(words);
+	if (kind === "github") return safeGh(words);
+	return false;
+};
+const invokesRepositoryCode = (command) => {
+	const source = metadataScript(command);
+	if (source === void 0) return true;
+	const tokens = shellTokens(source);
+	for (const [index, token] of tokens.entries()) {
+		if (token.kind !== "redirect") continue;
+		const target = tokens.at(index + 1);
+		if (![">", ">>"].includes(token.value) || target?.kind !== "word" || ![
+			"\"$GITHUB_OUTPUT\"",
+			"\"${GITHUB_OUTPUT}\"",
+			"/dev/null"
+		].includes(target.value)) return true;
+	}
+	const branches = [];
+	for (let words of shellCommandSegments(source, "tokens")) {
+		if (!safeCommand(words)) return true;
+		while (["then", "else"].includes(words.at(0) ?? "")) {
+			const keyword = words.at(0);
+			const previous = branches.pop();
+			if (keyword === "then" && previous === "condition") branches.push("then");
+			else if (keyword === "else" && previous === "then") branches.push("else");
+			else return true;
+			words = words.slice(1);
+		}
+		const keyword = words.at(0);
+		if (keyword === "if") branches.push("condition");
+		if (keyword === "elif") {
+			if (branches.pop() !== "then") return true;
+			branches.push("condition");
+		}
+		if (keyword === "fi") {
+			const previous = branches.pop();
+			if (previous !== "then" && previous !== "else") return true;
+		}
+	}
+	return branches.length !== 0;
+};
+const safeAction = (uses, inputs) => {
+	if (typeof uses !== "string" || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_./-]+@[a-f0-9]{40}$/u.test(uses)) return false;
+	const repository = uses.split("@").at(0);
+	const approved = Object.entries(workflowTrustBootstrapCatalog.actions).find(([name]) => name === repository);
+	if (approved === void 0) return false;
+	if (inputs === void 0) return repository === "actions/checkout";
+	if (!record$2(inputs)) return false;
+	if (repository !== "actions/checkout") {
+		const version = inputs["bun-version"];
+		if (typeof version !== "string" || !/^v?[0-9]+(?:\.(?:[0-9]+|x)){0,2}$/u.test(version)) return false;
+	}
+	const [, allowedInputs] = approved;
+	return Object.entries(inputs).every(([name, value]) => allowedInputs.some((allowed) => allowed === name) && [
+		"string",
+		"boolean",
+		"number"
+	].includes(typeof value) && (name !== "submodules" || value === false || value === "false"));
+};
+const safeShell = (shell) => shell === void 0 || shell === "bash" || shell === "sh";
+const safeEnvironment = (value) => value === void 0 || record$2(value) && Object.keys(value).every((name) => [
+	"HEAD_REPO",
+	"BASE_REPO",
+	"HAS_RUN_CI_LABEL",
+	"PR_TITLE",
+	"HEAD_REF",
+	"ISSUE_BODY",
+	"COMMENT_BODY",
+	"GH_TOKEN",
+	"GITHUB_TOKEN",
+	"HAWK_RUST_TOOLCHAIN",
+	"HAWK_VERSION",
+	"HAWK_X86_64_UNKNOWN_LINUX_GNU_SHA256"
+].includes(name));
+const configuredShell = (value) => record$2(value) && record$2(value["run"]) ? value["run"]["shell"] : void 0;
+const workflowTrustRules = ["workflow-trust"];
+const workflowEvents = (triggers) => {
+	if (typeof triggers === "string") return [triggers];
+	if (Array.isArray(triggers)) return triggers;
+	if (record$2(triggers)) return Object.keys(triggers);
+	return [];
+};
+/** Enforce a workflow's declared trust boundary before repository dependency execution. */
+const checkWorkflowTrust = (workflow) => {
+	const findings = [];
+	if (!record$2(workflow) || !record$2(workflow["jobs"])) return findings;
+	const jobs = workflow["jobs"];
+	if (!record$2(jobs["trust-check"])) return findings;
+	const triggers = workflow["on"];
+	const pullRequests = workflowEvents(triggers).filter((event) => event === "pull_request" || event === "pull_request_target");
+	if (pullRequests.length === 0) return findings;
+	for (const [name, job] of Object.entries(jobs)) {
+		if (!record$2(job)) continue;
+		const needs = job["needs"];
+		const ordered = name !== "trust-check" && (needs === "trust-check" || Array.isArray(needs) && needs.includes("trust-check"));
+		const permitsExecution = (stepCondition) => {
+			const guarded = pullRequests.every((event) => excludesUntrusted({
+				condition: job["if"],
+				event
+			}) || excludesUntrusted({
+				condition: stepCondition,
+				event
+			}));
+			if (ordered && guarded) return true;
+			return pullRequests.every((event) => excludesUntrusted({
+				condition: job["if"],
+				event,
+				allowTrust: false
+			}) || excludesUntrusted({
+				condition: stepCondition,
+				event,
+				allowTrust: false
+			}));
+		};
+		const message = `jobs.${name} repository commands require needs: trust-check and a condition requiring its trusted output on pull requests`;
+		if (job["uses"] !== void 0 && !permitsExecution(void 0)) findings.push({
+			type: "job",
+			property: "uses",
+			job: name,
+			message
+		});
+		if (!permitsExecution(void 0)) {
+			if (job["container"] !== void 0) findings.push({
+				type: "job",
+				property: "container",
+				job: name,
+				message
+			});
+			const services = job["services"];
+			if (services !== void 0 && (!record$2(services) || Object.keys(services).length > 0)) findings.push({
+				type: "job",
+				property: "services",
+				job: name,
+				message
+			});
+		}
+		if (!Array.isArray(job["steps"])) continue;
+		for (const [index, step] of job["steps"].entries()) {
+			if (!record$2(step)) continue;
+			const run = step["run"];
+			const uses = step["uses"];
+			const unsafeRun = typeof run === "string" && (invokesRepositoryCode(run) || !safeShell(step["shell"] ?? configuredShell(job["defaults"]) ?? configuredShell(workflow["defaults"])) || ![
+				workflow["env"],
+				job["env"],
+				step["env"]
+			].every(safeEnvironment));
+			const unsafeAction = uses !== void 0 && (!safeAction(uses, step["with"]) || ![
+				workflow["env"],
+				job["env"],
+				step["env"]
+			].every(safeEnvironment));
+			if (!unsafeRun && !unsafeAction) continue;
+			if (permitsExecution(unsafeAction ? void 0 : step["if"])) continue;
+			findings.push({
+				type: "step",
+				job: name,
+				step: index,
+				message
+			});
+		}
+	}
+	return findings;
+};
+//#endregion
 //#region src/toolchain-runtime.ts
 const runtimeRules = [
 	"bun-pins",
@@ -1937,7 +2572,8 @@ const runtimeRules = [
 	"runtime-manager",
 	"runtime-docker",
 	"runtime-workflow",
-	"action-pins"
+	"action-pins",
+	...workflowTrustRules
 ];
 const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const dockerEnvironmentAssignments = ({ source, escape }) => {
@@ -2113,7 +2749,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	};
 	const toml = (rule) => {
 		try {
-			return parse$1(text);
+			return parse(text);
 		} catch {
 			add({
 				rule,
@@ -2195,7 +2831,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			if (candidate === file) return parsed;
 			if (!trackedFiles.has(candidate)) return void 0;
 			try {
-				return parse$1(readFile(candidate) ?? "");
+				return parse(readFile(candidate) ?? "");
 			} catch {
 				return;
 			}
@@ -3171,8 +3807,29 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		}
 	};
 	try {
-		document.toJS({ maxAliasCount: 100 });
+		const workflow = document.toJS({ maxAliasCount: 100 });
 		if (automationKind === "workflow") {
+			for (const finding of checkWorkflowTrust(workflow)) {
+				const jobNode = getNode(getNode(document.contents, "jobs"), finding.job);
+				let source;
+				switch (finding.type) {
+					case "job":
+						source = getNode(jobNode, finding.property);
+						break;
+					case "step": {
+						const steps = resolveNode(getNode(jobNode, "steps"));
+						const step = isSeq(steps) ? steps.items.at(finding.step) : void 0;
+						source = getNode(step, "run") ?? getNode(step, "uses");
+						break;
+					}
+					default: throw new Error("unknown workflow finding", { cause: finding });
+				}
+				add({
+					rule: "workflow-trust",
+					line: nodeLine(source ?? jobNode),
+					message: finding.message
+				});
+			}
 			const jobs = getNode(document.contents, "jobs");
 			if (isMap(jobs)) for (const key of keysOf(jobs)) {
 				checkoutBindings = [];
@@ -3226,7 +3883,9 @@ const toolchainRules = [.../* @__PURE__ */ new Set([
 	...packageRules,
 	...runtimeRules,
 	...dependabotRules,
-	"cloud-setup-drift"
+	nodeProjectRule,
+	"cloud-setup-drift",
+	"quarantine-policy"
 ])];
 const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const array = (value) => Array.isArray(value);
@@ -3238,9 +3897,12 @@ const parseToolchainConfiguration = (input) => {
 	if (!array(optOuts)) throw new Error("optOuts must be an array");
 	for (const entry of optOuts) {
 		if (!record(entry) || Object.keys(entry).some((key) => key !== "rule" && key !== "reason") || typeof entry["rule"] !== "string" || !toolchainRules.some((rule) => rule === entry["rule"]) || typeof entry["reason"] !== "string" || entry["reason"].trim() === "" || disabled.has(entry["rule"])) throw new Error("each opt-out requires a unique known rule and a nonempty reason");
+		if (entry["rule"] === "quarantine-policy") throw new Error("quarantine-policy cannot be opted out; temporary third-party exclusions require expiry");
 		if (entry["rule"] === "rust-version") throw new Error("rust-version requires expiring exact-pin rustExceptions, not an opt-out");
 		if (entry["rule"] === "node-engine") throw new Error("node-engine cannot be opted out; engines.node must support the shared Node series");
+		if (entry["rule"] === "workflow-trust") throw new Error("workflow-trust cannot be opted out; repository commands must follow the declared trust decision");
 		if (entry["rule"] === "cloud-setup-drift") throw new Error("cloud-setup-drift cannot be opted out; generated setup must match shared policy");
+		if (entry["rule"] === "type-aware-projects") throw new Error("type-aware-projects cannot be opted out; linted files require declared TypeScript projects");
 		disabled.add(entry["rule"]);
 	}
 	return {
@@ -3252,8 +3914,8 @@ const parseToolchainConfiguration = (input) => {
 		consumerChecks: parseConsumerChecks(input["consumerChecks"])
 	};
 };
-/** Read one tracked configuration snapshot for guards and policy generation. */
-const readToolchainInputs = (root) => {
+/** Dependency graphs stay opaque unless a caller explicitly needs registry identities. */
+const readToolchainInputs = (root, { bunLock = "presence" } = {}) => {
 	const diagnostics = [];
 	const tracked = readGitTrackedOutput(root, "staged").split("\0").filter((entry) => entry !== "" && !entry.startsWith("160000 ")).map((entry) => entry.slice(entry.indexOf("	") + 1));
 	const files = {};
@@ -3263,12 +3925,13 @@ const readToolchainInputs = (root) => {
 		const kind = toolchainInputKind(file);
 		const shebangCandidate = kind === void 0 && path.posix.extname(file) === "" && !file.split("/").some((part) => part === "vendor" || part === "node_modules");
 		if (kind === void 0 && !shebangCandidate) continue;
-		if (kind === "presence") {
-			files[file] = "";
-			continue;
-		}
 		try {
 			const inputPath = path.join(resolvedRoot, file);
+			if (kind === "presence" && !(file === "bun.lock" && bunLock === "content")) {
+				lstatSync(inputPath);
+				files[file] = "";
+				continue;
+			}
 			if (shebangCandidate) {
 				const input = lstatSync(inputPath);
 				if (!input.isFile() && !input.isSymbolicLink()) continue;
@@ -3289,7 +3952,8 @@ const readToolchainInputs = (root) => {
 				if (toolchainInputKind(file, prefix.toString("utf8", 0, count)) === void 0) continue;
 			}
 			files[file] = readFileSync(resolvedFile, "utf8");
-		} catch {
+		} catch (error) {
+			if (kind === "presence" && error instanceof Error && "code" in error && error.code === "ENOENT") continue;
 			if (shebangCandidate) continue;
 			diagnostics.push({
 				rule: "configuration",
@@ -3305,8 +3969,8 @@ const readToolchainInputs = (root) => {
 		diagnostics
 	};
 };
-const checkToolchain = ({ root, policy, onDelegated }) => {
-	const { files, trackedFiles, diagnostics } = readToolchainInputs(root);
+const checkToolchain = ({ root, policy, onDelegated, onWarning, now }) => {
+	const { files, trackedFiles, diagnostics } = readToolchainInputs(root, { bunLock: "content" });
 	let repository;
 	try {
 		const origin = execFileSync("git", [
@@ -3396,6 +4060,53 @@ const checkToolchain = ({ root, policy, onDelegated }) => {
 		files,
 		policy
 	}));
+	if (Object.entries(files).some(([file, text]) => {
+		if (path.posix.basename(file) === "bun.lock") return true;
+		if (path.posix.basename(file) !== "package.json") return false;
+		try {
+			const manifest = JSON.parse(text);
+			return record(manifest) && typeof manifest["packageManager"] === "string" && /^bun(?:@|$)/u.test(manifest["packageManager"]);
+		} catch {
+			return false;
+		}
+	}) || files["bunfig.toml"] !== void 0) try {
+		if (files["bunfig.toml"] === void 0) throw new Error("Bun repositories require a tracked root bunfig.toml with the five-day quarantine policy; use the documented pinned bunx stll-quarantine --sync bootstrap, then commit bunfig.toml");
+		const result = checkRepositoryQuarantine({
+			files,
+			now,
+			npmrcPresent: trackedFiles.has(".npmrc")
+		});
+		for (const message of result.errors) diagnostics.push({
+			rule: "quarantine-policy",
+			path: "bunfig.toml",
+			line: 1,
+			message
+		});
+		for (const message of result.warnings) onWarning?.({
+			rule: "quarantine-policy",
+			path: "bunfig.toml",
+			line: 1,
+			message
+		});
+	} catch (error) {
+		diagnostics.push({
+			rule: "quarantine-policy",
+			path: "bunfig.toml",
+			line: 1,
+			message: error instanceof Error ? error.message : String(error)
+		});
+	}
+	if (files["package.json"] !== void 0) {
+		let manifest;
+		try {
+			manifest = JSON.parse(files["package.json"]);
+		} catch {}
+		diagnostics.push(...checkNodeProjects({
+			root,
+			manifest,
+			trackedFiles
+		}));
+	}
 	for (const [file, text] of Object.entries(files)) diagnostics.push(...checkRuntimeFile({
 		file,
 		text,