@stll/oxlint-config 1.8.0 → 2.0.0

package/dist/toolchain-guard.mjs

@@ -1,4 +1,4 @@
-import { t as checkRepositoryQuarantine } from "./quarantine-policy2.mjs";
+import { l as overdueVerdict, t as checkRepositoryQuarantine } from "./quarantine-policy2.mjs";
 import { C as cloudSetupPath, D as nodeSupportRangeMatches, E as nodeSelectorMatches, O as parseCloudSetup, _ as cloudAttributionFix, b as hasCloudAttribution, f as toolchainInputKind, g as workspaceContains, h as isKubernetesDefinitionPath, i as isDockerDefinitionPath, l as isShellScript, m as isComposeDefinitionPath, n as githubAutomationFileKind, p as containerDocumentImages, s as isMiseConfigPath, v as cloudClaudeSettingsPath, w as generateCloudSetup, x as hasCloudSessionStartHook, y as cloudSessionStartFix } from "./toolchain-inputs.mjs";
 import { t as readGitTrackedOutput } from "./git-tracked-output.mjs";
 import { a as assertConsumerFixtureSelection, g as parseConsumerFixtures, h as discoverConsumerPackages, m as discoverConsumerManifests, r as assertConsumerFixtureKind, t as assertConsumerNodeSupport, u as consumerPackageClosure } from "./consumer-node-support.mjs";
@@ -6,15 +6,32 @@ import { d as rustImageVersion, i as dependabotRules, n as declaredIgnoreConflic
 import { n as checkFormatter, r as formatterRule } from "./toolchain-schema.mjs";
 import { createRequire } from "node:module";
 import path, { extname } from "node:path";
+import { execFileSync, spawnSync } from "node:child_process";
 import { closeSync, lstatSync, openSync, readFileSync, readSync, realpathSync } from "node:fs";
 import { parse } from "smol-toml";
-import { execFileSync, spawnSync } from "node:child_process";
-import { minVersion, satisfies, valid, validRange } from "semver";
+import { gte, minVersion, satisfies, valid, validRange } from "semver";
 import { LineCounter, isAlias, isMap, isNode, isScalar, isSeq, parseAllDocuments, parseDocument } from "yaml";
 import picomatch from "picomatch";
+import { pathToFileURL } from "node:url";
+//#region src/toolchain-bun.ts
+const STABLE_RELEASE = /^\d+\.\d+\.\d+$/u;
+/**
+* The shared policy names the minimum Bun. A repository pins one exact
+* release at or above it in its root packageManager, and every other Bun
+* reference in the repository must equal that release.
+*/
+const repositoryBun = (floor, manifest) => {
+	let packageManager;
+	try {
+		const parsed = JSON.parse(manifest ?? "");
+		if (typeof parsed === "object" && parsed !== null) packageManager = Reflect.get(parsed, "packageManager");
+	} catch {}
+	const version = typeof packageManager === "string" ? /^bun@(.+)$/.exec(packageManager)?.[1] : void 0;
+	return version !== void 0 && STABLE_RELEASE.test(version) && valid(version) === version && gte(version, floor) ? version : floor;
+};
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "1.8.0";
+const consumerRunnerVersion = "2.0.0";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
 const record$10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {
@@ -349,7 +366,71 @@ const packageRules = [
 	"typescript-layout",
 	"node-engine"
 ];
+/** Compiler packages `bun check` replaces; an install needs a repository allowlist entry. */
+const typescriptPackages = /* @__PURE__ */ new Set(["typescript", "@typescript/native"]);
+const typecheckCommand = "bun check";
+const typescriptGuidance = "type check with `bun check --no-pretty --all --project=<tsconfig>`, use tsrs for programs and type checkers, and oxc-parser for syntax-only reads";
+const installSections = [
+	"dependencies",
+	"devDependencies",
+	"optionalDependencies"
+];
+const allowlistFile = "stll-toolchain.json";
 const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** `npm:typescript@7.0.2` installs a compiler under another name; returns its version. */
+const typescriptAliasVersion = (spec) => {
+	if (typeof spec !== "string") return void 0;
+	const match = /^npm:(?:typescript|@typescript\/native)(?:@(.*))?$/.exec(spec);
+	return match === null ? void 0 : match[1] ?? "";
+};
+const exactTypescriptSpec = (spec) => {
+	if (typeof spec !== "string") return false;
+	const version = typescriptAliasVersion(spec) ?? spec;
+	return valid(version) === version;
+};
+const isTypescriptInstall = (name, value) => typescriptPackages.has(name) || typescriptAliasVersion(value) !== void 0;
+const allowlistKeys = [
+	"workspace",
+	"name",
+	"spec",
+	"dependency",
+	"reason"
+];
+const allowlistFormat = "{\"workspace\": \"<package directory or .>\", \"name\": \"typescript\", \"spec\": \"<exact version>\", \"dependency\": \"<package that needs it>\", \"reason\": \"<why>\"}";
+const workspaceManifest = (workspace) => workspace === "." ? "package.json" : `${workspace}/package.json`;
+/** Each repository declares its own TypeScript installs; there is no shared list. */
+const parseTypescriptAllowlist = (input) => {
+	if (input === void 0) return [];
+	if (!Array.isArray(input)) throw new Error(`typescriptAllowlist must be an array of entries like ${allowlistFormat}`);
+	const seen = /* @__PURE__ */ new Set();
+	return input.map((entry) => {
+		const shown = JSON.stringify(entry);
+		const text = (key) => {
+			const value = record$7(entry) ? entry[key] : void 0;
+			return typeof value === "string" && value.trim() !== "" ? value : void 0;
+		};
+		const workspace = text("workspace");
+		const name = text("name");
+		const spec = text("spec");
+		const dependency = text("dependency");
+		const reason = text("reason");
+		if (!record$7(entry) || Object.keys(entry).length !== allowlistKeys.length || workspace === void 0 || name === void 0 || spec === void 0 || dependency === void 0 || reason === void 0) throw new Error(`typescriptAllowlist entry ${shown} must have exactly workspace, name, spec, dependency and reason as nonempty strings: ${allowlistFormat}`);
+		if (workspace !== "." && (path.posix.normalize(workspace) !== workspace || workspace.startsWith("/") || workspace.endsWith("/") || workspace === ".." || workspace.startsWith("../"))) throw new Error(`typescriptAllowlist entry ${shown}: workspace must be "." for the root or a normalized relative package directory such as "apps/web"`);
+		if (!exactTypescriptSpec(spec)) throw new Error(`typescriptAllowlist entry ${shown}: spec must be the exact spec the manifest resolves to, such as "6.0.3" or "npm:typescript@6.0.3", not a range or catalog reference`);
+		if (!isTypescriptInstall(name, spec)) throw new Error(`typescriptAllowlist entry ${shown}: name must be typescript or @typescript/native, or an alias whose spec is npm:typescript@<version> or npm:@typescript/native@<version>`);
+		if (typescriptPackages.has(dependency) || dependency === name) throw new Error(`typescriptAllowlist entry ${shown}: dependency must name the package in that workspace that needs ${name}, not a TypeScript package`);
+		const key = `${workspace}\0${name}`;
+		if (seen.has(key)) throw new Error(`typescriptAllowlist declares ${name} for ${workspace} more than once; keep one entry`);
+		seen.add(key);
+		return {
+			workspace,
+			name,
+			spec,
+			dependency,
+			reason
+		};
+	});
+};
 const shellSubstitutions = (command) => {
 	const frames = [{
 		kind: "root",
@@ -875,7 +956,7 @@ const invokesCompiler = (words) => {
 	return tokens.slice(start).some((word, index) => compiler(word) || word === "bun" && tokens.at(skipOptions(start + index + 1, "bun")) === "check");
 };
 /** Validate manifests and catalog resolutions from a tracked-file snapshot. */
-const checkPackageFiles = ({ files, policy }) => {
+const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 	const sources = new Map(Object.entries(files));
 	const diagnostics = [];
 	const pins = new Map(Object.entries({
@@ -991,16 +1072,29 @@ const checkPackageFiles = ({ files, policy }) => {
 			directory = path.posix.dirname(directory);
 		}
 	};
-	const resolve = (file, name, value) => {
+	const resolveThrough = (file, name, value) => {
 		const visited = /* @__PURE__ */ new Set();
+		const catalogs = [];
 		while (typeof value === "string" && value.startsWith("catalog:")) {
-			if (visited.has(value)) return void 0;
+			if (visited.has(value)) return {
+				value: void 0,
+				catalogs
+			};
 			visited.add(value);
 			const catalog = catalogFor(file, value.slice(8));
-			value = record$7(catalog) ? catalog[name] : void 0;
+			if (!record$7(catalog)) return {
+				value: void 0,
+				catalogs
+			};
+			catalogs.push(catalog);
+			value = catalog[name];
 		}
-		return value;
+		return {
+			value,
+			catalogs
+		};
 	};
+	const resolve = (file, name, value) => resolveThrough(file, name, value).value;
 	const workspaceOwnerFor = (file) => {
 		const pnpm = pnpmWorkspaceFor(file);
 		if (pnpm !== void 0) return {
@@ -1039,88 +1133,49 @@ const checkPackageFiles = ({ files, policy }) => {
 		}));
 		return candidates.length === 1 && candidates.every(([, json]) => json["version"] === pin) ? "matched" : "mismatch";
 	};
-	const tsSpecifiers = /* @__PURE__ */ new Map();
-	for (const layout of policy.typescriptInstallLayouts) {
-		const values = tsSpecifiers.get(layout.compilerPackage) ?? /* @__PURE__ */ new Set();
-		values.add(layout.compilerSpecifier);
-		tsSpecifiers.set(layout.compilerPackage, values);
-		if (layout.type !== "split-compatibility") continue;
-		const compatibility = tsSpecifiers.get(layout.compatibilityPackage) ?? /* @__PURE__ */ new Set();
-		compatibility.add(layout.compatibilitySpecifier);
-		tsSpecifiers.set(layout.compatibilityPackage, compatibility);
-	}
-	tsSpecifiers.set(policy.typescript6Compatibility.packageAlias, /* @__PURE__ */ new Set([`npm:typescript@${policy.typescript6Compatibility.version}`]));
-	const layoutFor = (specifiers) => policy.typescriptInstallLayouts.find((layout) => {
-		const compiler = specifiers.get(layout.compilerPackage);
-		if (compiler?.size !== 1 || !compiler.has(layout.compilerSpecifier)) return false;
-		if (layout.type === "split-compatibility") {
-			const compatibility = specifiers.get(layout.compatibilityPackage);
-			return compatibility?.size === 1 && compatibility.has(layout.compatibilitySpecifier);
-		}
-		return policy.typescriptInstallLayouts.every((other) => other.compilerPackage === layout.compilerPackage || !specifiers.has(other.compilerPackage));
-	});
-	const peerRange = (value) => typeof value === "string" && valid(value) === null && validRange(value) !== null;
-	const toolchainEntries = (file, json) => {
-		const entries = [];
-		for (const section of [
-			"dependencies",
-			"devDependencies",
-			"optionalDependencies",
-			"peerDependencies"
-		]) {
-			const dependencies = json[section];
-			if (!record$7(dependencies)) continue;
-			for (const [name, value] of Object.entries(dependencies)) {
-				if (!tsSpecifiers.has(name)) continue;
-				const resolved = resolve(file, name, value);
-				if (section === "peerDependencies" && peerRange(resolved)) continue;
-				entries.push({
-					section,
-					name,
-					value: resolved
-				});
+	const allowed = new Map(typescriptAllowlist.map((entry) => [`${workspaceManifest(entry.workspace)}\0${entry.name}`, entry]));
+	const allowedCatalogEntries = /* @__PURE__ */ new Map();
+	for (const entry of typescriptAllowlist) {
+		const file = workspaceManifest(entry.workspace);
+		const json = manifests.get(file);
+		if (json === void 0) continue;
+		for (const section of installSections) {
+			const entries = json[section];
+			if (!record$7(entries) || !Object.hasOwn(entries, entry.name)) continue;
+			const { value, catalogs } = resolveThrough(file, entry.name, entries[entry.name]);
+			if (value !== entry.spec) continue;
+			for (const catalog of catalogs) {
+				const names = allowedCatalogEntries.get(catalog) ?? /* @__PURE__ */ new Set();
+				names.add(entry.name);
+				allowedCatalogEntries.set(catalog, names);
 			}
 		}
-		return entries;
-	};
-	const specifierMap = (entries) => {
-		const specifiers = /* @__PURE__ */ new Map();
-		for (const { name, value } of entries) {
-			const values = specifiers.get(name) ?? /* @__PURE__ */ new Set();
-			values.add(value);
-			specifiers.set(name, values);
-		}
-		return specifiers;
+	}
+	const shownSpec = (raw, value) => {
+		if (typeof value !== "string") return `${String(raw)} (unresolved)`;
+		return raw === value ? value : `${value} (from ${String(raw)})`;
 	};
-	const workspaceLayouts = /* @__PURE__ */ new Map();
-	const workspaceLayoutFor = (file) => {
-		const owner = workspaceOwnerFor(file);
-		if (owner === void 0 || !workspaceContains({
-			...owner,
-			file,
-			rootMembership: "implicit"
-		})) return void 0;
-		const key = `${owner.source}:${owner.directory}`;
-		const cached = workspaceLayouts.get(key);
-		if (cached !== void 0) return cached;
-		const entries = [];
-		for (const [candidate, member] of manifests) {
-			if (path.posix.basename(candidate) !== "package.json") continue;
-			const memberOwner = workspaceOwnerFor(candidate);
-			if (memberOwner?.directory !== owner.directory || memberOwner.source !== owner.source || !workspaceContains({
-				...owner,
-				file: candidate,
-				rootMembership: "implicit"
-			})) continue;
-			entries.push(...toolchainEntries(candidate, member).filter(({ section }) => section === "devDependencies"));
+	const typescriptMessage = (name, value) => `${name} ${String(value)} is not needed: ${typescriptGuidance}`;
+	const typescriptEntryMessage = ({ file, entries, name, raw, value, scope }) => {
+		const shown = shownSpec(raw, value);
+		if (scope === "catalog") return allowedCatalogEntries.get(entries)?.has(name) === true ? void 0 : `${name} ${shown} in a catalog of ${file} serves no allowed install: ${typescriptGuidance}; a catalog may hold ${name} only at the spec of a workspace entry in typescriptAllowlist in ${allowlistFile}`;
+		if (scope === "resolution") return `${name} must not be overridden or resolved (${shown}): ${typescriptGuidance}; declare it in the workspace whose dependency needs it and add a typescriptAllowlist entry in ${allowlistFile}`;
+		if (scope === "peer") return `${name} peer ${shown} is not a version range: ${typescriptGuidance}`;
+		const entry = path.posix.basename(file) === "package.json" ? allowed.get(`${file}\0${name}`) : void 0;
+		if (entry === void 0) {
+			const workspace = path.posix.dirname(file);
+			const suggestion = JSON.stringify({
+				workspace,
+				name,
+				spec: exactTypescriptSpec(value) ? value : "<exact version>",
+				dependency: "<package that needs it>",
+				reason: "<why it needs this TypeScript>"
+			});
+			return `${name} ${shown} in ${file} is not allowed: ${typescriptGuidance}; if a dependency of this workspace needs it, add ${suggestion} to typescriptAllowlist in ${allowlistFile}`;
 		}
-		const result = {
-			layout: layoutFor(specifierMap(entries)),
-			directory: owner.directory
-		};
-		workspaceLayouts.set(key, result);
-		return result;
+		return value === entry.spec ? void 0 : `${name} in ${file} resolves to ${shown}, but typescriptAllowlist in ${allowlistFile} allows ${entry.spec} for ${entry.dependency}; declare ${entry.spec} or update the entry's spec`;
 	};
+	const peerRange = (value) => typeof value === "string" && validRange(value) !== null;
 	for (const [file, json] of manifests) {
 		const manager = json["packageManager"];
 		if (manager !== void 0 && manager !== `bun@${policy.bun}`) add({
@@ -1128,20 +1183,27 @@ const checkPackageFiles = ({ files, policy }) => {
 			rule: "bun-pins",
 			key: "packageManager",
 			value: manager,
-			message: `packageManager Bun version must be ${policy.bun}, found ${JSON.stringify(manager)}`
+			message: `packageManager Bun version must be ${policy.bun} (one exact release at or above the shared minimum, the same in every manifest), found ${JSON.stringify(manager)}`
 		});
-		const checkEntries = (entries, location) => {
+		const checkEntries = (entries, scope, location) => {
 			if (!record$7(entries)) return;
 			for (const [name, raw] of Object.entries(entries)) {
 				const value = resolve(file, name, raw);
-				const tsAllowed = tsSpecifiers.get(name);
-				if (tsAllowed !== void 0) {
-					if (typeof value !== "string" || !tsAllowed.has(value)) add({
+				if (isTypescriptInstall(name, value)) {
+					const message = typescriptEntryMessage({
+						file,
+						entries,
+						name,
+						raw,
+						value,
+						scope
+					});
+					if (message !== void 0) add({
 						file,
 						rule: "typescript-layout",
 						key: location?.key ?? name,
 						value: location === void 0 ? raw : location.value,
-						message: `${name} must use a declared TypeScript specifier, found ${String(value)}`
+						message
 					});
 					continue;
 				}
@@ -1163,20 +1225,17 @@ const checkPackageFiles = ({ files, policy }) => {
 				});
 			}
 		};
-		for (const key of [
-			"dependencies",
-			"devDependencies",
-			"optionalDependencies"
-		]) checkEntries(json[key]);
-		if (record$7(json["peerDependencies"])) {
-			for (const [name, value] of Object.entries(json["peerDependencies"])) if (tsSpecifiers.has(name) && !peerRange(resolve(file, name, value))) checkEntries({ [name]: value });
+		for (const key of installSections) checkEntries(json[key], "install");
+		if (record$7(json["peerDependencies"])) for (const [name, value] of Object.entries(json["peerDependencies"])) {
+			const resolved = resolve(file, name, value);
+			if (isTypescriptInstall(name, resolved) && !peerRange(resolved)) checkEntries({ [name]: value }, "peer");
 		}
 		for (const source of catalogSources(json)) {
-			checkEntries(source["catalog"]);
+			checkEntries(source["catalog"], "catalog");
 			if (!record$7(source["catalogs"])) continue;
-			for (const catalog of Object.values(source["catalogs"])) checkEntries(catalog);
+			for (const catalog of Object.values(source["catalogs"])) checkEntries(catalog, "catalog");
 		}
-		const ownedNames = /* @__PURE__ */ new Set([...pins.keys(), ...tsSpecifiers.keys()]);
+		const ownedNames = /* @__PURE__ */ new Set([...pins.keys(), ...typescriptPackages]);
 		const resolutionDependencies = {};
 		const resolutionRoot = manifests.get(path.posix.join(path.posix.dirname(file), "package.json"));
 		if (resolutionRoot !== void 0) for (const section of [
@@ -1188,32 +1247,6 @@ const checkPackageFiles = ({ files, policy }) => {
 			if (!record$7(entries)) continue;
 			for (const [name, value] of Object.entries(entries)) resolutionDependencies[name] = resolve(file, name, value);
 		}
-		const affectedSpecifiers = /* @__PURE__ */ new Map();
-		const owner = workspaceOwnerFor(file);
-		for (const [candidate, member] of manifests) {
-			if (path.posix.basename(candidate) !== "package.json") continue;
-			const memberOwner = workspaceOwnerFor(candidate);
-			if (!(candidate === path.posix.join(path.posix.dirname(file), "package.json")) && !(owner !== void 0 && owner.directory === path.posix.dirname(file) && memberOwner?.directory === owner.directory && memberOwner.source === owner.source && workspaceContains({
-				directory: owner.directory,
-				file: candidate,
-				patterns: owner.patterns,
-				rootMembership: "implicit"
-			}))) continue;
-			for (const section of [
-				"dependencies",
-				"devDependencies",
-				"optionalDependencies"
-			]) {
-				const entries = member[section];
-				if (!record$7(entries)) continue;
-				for (const [name, value] of Object.entries(entries)) {
-					if (!tsSpecifiers.has(name)) continue;
-					const values = affectedSpecifiers.get(name) ?? /* @__PURE__ */ new Set();
-					values.add(resolve(candidate, name, value));
-					affectedSpecifiers.set(name, values);
-				}
-			}
-		}
 		const checkResolutionMap = (entries, parent) => {
 			if (!record$7(entries)) return;
 			for (const [selector, replacement] of Object.entries(entries)) {
@@ -1221,11 +1254,7 @@ const checkPackageFiles = ({ files, policy }) => {
 				if (target === void 0) continue;
 				let pattern = target.split(/>\s*(?=[@A-Za-z_*]|$)/).at(-1)?.trim() ?? "";
 				const version = pattern.lastIndexOf("@");
-				let qualifier;
-				if (version > pattern.lastIndexOf("/")) {
-					qualifier = pattern.slice(version + 1).replace(/^npm:/, "");
-					pattern = pattern.slice(0, version);
-				}
+				if (version > pattern.lastIndexOf("/")) pattern = pattern.slice(0, version);
 				const parts = pattern.split("/");
 				pattern = parts.at(-2)?.startsWith("@") ? parts.slice(-2).join("/") : parts.at(-1) ?? "";
 				if (pattern === "") {
@@ -1242,102 +1271,60 @@ const checkPackageFiles = ({ files, policy }) => {
 					checkResolutionMap(replacement, target);
 					continue;
 				}
-				for (const name of ownedNames) {
-					if (!picomatch(pattern)(name)) continue;
-					let value = replacement;
-					if (typeof replacement === "string" && replacement.startsWith("$")) {
-						const reference = replacement.slice(1);
-						value = resolutionDependencies[reference];
-					}
-					const resolved = resolve(file, name, value);
-					checkEntries({ [name]: value }, {
-						key: selector,
-						value: replacement
-					});
-					if (tsSpecifiers.has(name) && [...affectedSpecifiers.get(name) ?? []].some((specifier) => {
-						if (resolved === specifier) return false;
-						if (qualifier === void 0 || validRange(qualifier) === null) return true;
-						if (typeof specifier !== "string") return false;
-						const versionSpecifier = specifier.startsWith("npm:") ? specifier.slice(specifier.lastIndexOf("@") + 1) : specifier;
-						const release = valid(versionSpecifier);
-						return release !== null && satisfies(release, qualifier);
-					}) && typeof resolved === "string" && tsSpecifiers.get(name)?.has(resolved)) add({
-						file,
-						rule: "typescript-layout",
-						key: selector,
-						value: replacement,
-						message: `${name} resolution must preserve its declared TypeScript install specifier`
-					});
+				let value = replacement;
+				if (typeof replacement === "string" && replacement.startsWith("$")) {
+					const reference = replacement.slice(1);
+					value = resolutionDependencies[reference];
 				}
+				const location = {
+					key: selector,
+					value: replacement
+				};
+				const targets = [...ownedNames].filter((name) => picomatch(pattern)(name));
+				for (const name of targets) checkEntries({ [name]: value }, "resolution", location);
+				if (typescriptAliasVersion(value) !== void 0 && !targets.some((name) => isTypescriptInstall(name, value))) checkEntries({ [pattern]: value }, "resolution", location);
 			}
 		};
 		checkResolutionMap(json["overrides"]);
 		checkResolutionMap(json["resolutions"]);
 		if (record$7(json["pnpm"])) checkResolutionMap(json["pnpm"]["overrides"]);
-		const localEntries = toolchainEntries(file, json);
-		const usesCompiler = policy.typescriptInstallLayouts.some((layout) => localEntries.some(({ name }) => name === layout.compilerPackage));
-		let selectedLayout = layoutFor(specifierMap(localEntries));
-		if (usesCompiler) {
-			if (layoutFor(specifierMap(localEntries.filter(({ section }) => section !== "peerDependencies"))) === void 0) selectedLayout = void 0;
-			if (selectedLayout === void 0) {
-				const workspace = workspaceLayoutFor(file);
-				const layout = workspace?.layout;
-				if (workspace !== void 0 && layout !== void 0) {
-					const expected = /* @__PURE__ */ new Map([[layout.compilerPackage, layout.compilerSpecifier]]);
-					if (layout.type === "split-compatibility") expected.set(layout.compatibilityPackage, layout.compatibilitySpecifier);
-					expected.set(policy.typescript6Compatibility.packageAlias, `npm:typescript@${policy.typescript6Compatibility.version}`);
-					const developmentOnly = localEntries.every(({ section, name, value }) => section === "devDependencies" && expected.get(name) === value);
-					const runtimeCompatibilityOnly = layout.type === "split-compatibility" && path.posix.dirname(file) !== workspace.directory && localEntries.every(({ section, name, value }) => (section === "dependencies" || section === "devDependencies" || section === "peerDependencies") && name === layout.compatibilityPackage && value === layout.compatibilitySpecifier);
-					if (developmentOnly || runtimeCompatibilityOnly) selectedLayout = layout;
-				}
-			}
-			if (selectedLayout === void 0) add({
+		const command = record$7(json["scripts"]) ? json["scripts"]["typecheck"] : void 0;
+		if (typeof command === "string") for (const words of compilerCommandSegments(command)) {
+			if (!invokesCompiler(words)) continue;
+			const normalized = words.join(" ");
+			if (!words.some((word) => word === "(" || word === ")") && shellSubstitutions(normalized).length === 0 && (normalized === typecheckCommand || normalized.startsWith(`${typecheckCommand} `))) continue;
+			add({
 				file,
 				rule: "typescript-layout",
-				key: "dependencies",
-				message: "TypeScript compiler and compatibility packages must match one complete declared install layout"
+				key: "typecheck",
+				value: command,
+				message: `typecheck must run \`${typecheckCommand} --no-pretty --all --project=<tsconfig>\`, not a TypeScript compiler package`
 			});
-			const command = record$7(json["scripts"]) ? json["scripts"]["typecheck"] : void 0;
-			if (selectedLayout !== void 0 && typeof command === "string") {
-				const normalizedExpected = selectedLayout.typecheckCommand.replace(/\s+/g, " ").trim();
-				for (const words of compilerCommandSegments(command)) {
-					if (!invokesCompiler(words)) continue;
-					const normalized = words.join(" ");
-					if (!words.some((word) => word === "(" || word === ")") && shellSubstitutions(normalized).length === 0 && (normalized === normalizedExpected || normalized.startsWith(`${normalizedExpected} `))) continue;
-					add({
-						file,
-						rule: "typescript-layout",
-						key: "typecheck",
-						value: command,
-						message: `typecheck compiler invocation must use ${selectedLayout.typecheckCommand}`
-					});
-					break;
-				}
-			}
+			break;
 		}
-		if (record$7(json["peerDependencies"])) {
-			const peerLayout = selectedLayout ?? workspaceLayoutFor(file)?.layout;
-			for (const [name, raw] of Object.entries(json["peerDependencies"])) {
-				if (!tsSpecifiers.has(name)) continue;
-				const range = resolve(file, name, raw);
-				if (!peerRange(range)) continue;
-				const releases = /* @__PURE__ */ new Set();
-				for (const layout of policy.typescriptInstallLayouts) {
-					if (layout.compilerPackage !== name && !(layout.type === "split-compatibility" && layout.compatibilityPackage === name)) continue;
-					const specifier = layout.compilerSpecifier;
-					releases.add(specifier.startsWith("npm:") ? specifier.slice(specifier.lastIndexOf("@") + 1) : specifier);
-				}
-				if (name === policy.typescript6Compatibility.packageAlias) releases.add(policy.typescript6Compatibility.version);
-				if (peerLayout?.type === "split-compatibility" && name === peerLayout.compatibilityPackage) releases.add(peerLayout.compatibilitySpecifier);
-				if ([...releases].every((release) => satisfies(release, range))) continue;
+		if (record$7(json["peerDependencies"])) for (const [name, raw] of Object.entries(json["peerDependencies"])) {
+			if (!typescriptPackages.has(name)) continue;
+			const range = resolve(file, name, raw);
+			if (!peerRange(range)) continue;
+			const release = name === "typescript" ? policy.typescript : void 0;
+			if (release === void 0) {
 				add({
 					file,
 					rule: "typescript-layout",
 					key: name,
 					value: raw,
-					message: `${name} peer support range must include ${[...releases].join(" and ")}, found ${range}`
+					message: typescriptMessage(name, range)
 				});
+				continue;
 			}
+			if (satisfies(release, range)) continue;
+			add({
+				file,
+				rule: "typescript-layout",
+				key: name,
+				value: raw,
+				message: `${name} peer support range must include ${release}, found ${range}`
+			});
 		}
 		if (record$7(json["engines"]) && json["engines"]["node"] !== void 0 && (typeof json["engines"]["node"] !== "string" || !nodeSupportRangeMatches(policy.node, json["engines"]["node"]))) add({
 			file,
@@ -1347,6 +1334,35 @@ const checkPackageFiles = ({ files, policy }) => {
 			message: `engines.node must support ${policy.node}, found ${JSON.stringify(json["engines"]["node"])}`
 		});
 	}
+	const staleness = (entry) => {
+		const file = workspaceManifest(entry.workspace);
+		const json = manifests.get(file);
+		if (json === void 0) return `${file} is missing or invalid; remove the entry`;
+		const declares = (name) => installSections.some((section) => {
+			const entries = json[section];
+			return record$7(entries) && Object.hasOwn(entries, name);
+		});
+		if (!declares(entry.name)) return `${file} no longer declares ${entry.name} in dependencies, devDependencies or optionalDependencies; remove the entry`;
+		if (!declares(entry.dependency)) return `${file} no longer depends on ${entry.dependency}; remove the entry and the ${entry.name} declaration, or name the dependency that still needs it`;
+	};
+	for (const entry of typescriptAllowlist) {
+		const stale = staleness(entry);
+		if (stale === void 0) continue;
+		const message = `typescriptAllowlist entry ${entry.name} ${entry.spec} for ${entry.workspace} is stale: ${stale}`;
+		if (sources.has(allowlistFile)) add({
+			file: allowlistFile,
+			rule: "typescript-layout",
+			key: "workspace",
+			value: entry.workspace,
+			message
+		});
+		else diagnostics.push({
+			rule: "typescript-layout",
+			path: allowlistFile,
+			line: 1,
+			message
+		});
+	}
 	return diagnostics;
 };
 const extensionKinds = new Map(Object.entries({
@@ -1736,6 +1752,64 @@ const readCommand = ({ root, executable, args, runtime }) => {
 	if (result.status !== 0) throw new Error(`configuration discovery failed: ${(result.stderr + result.stdout).trim()}`);
 	return result.stdout;
 };
+const projectConfigScript = `
+const [moduleUrl, root, config] = process.argv.slice(1);
+const { API } = await import(moduleUrl);
+const api = new API({ cwd: root });
+try {
+  const parsed = await api.parseConfigFile(config);
+  // An empty files list (TS18002) or no inputs (TS18003) leaves a project
+  // without roots; only unreadable configuration fails discovery.
+  const errors = parsed.errors.filter((error) => error.code !== 18002 && error.code !== 18003);
+  if (errors.length > 0) {
+    process.stderr.write(errors.map((error) => "TS" + error.code + ": " + (error.text ?? error.messageText ?? "")).join("\\n"));
+    process.exitCode = 1;
+  } else
+    process.stdout.write(JSON.stringify({
+      files: parsed.fileNames,
+      references: (parsed.projectReferences ?? []).map((reference) => reference.path),
+      allowJs: parsed.options.allowJs === true,
+      checkJs: parsed.options.checkJs === true,
+    }));
+} finally {
+  await api.close();
+}
+`;
+const resolveProjectApi = (root) => {
+	for (const base of [import.meta.url, path.join(root, "package.json")]) try {
+		return pathToFileURL(createRequire(base).resolve("tsrs/unstable/async")).href;
+	} catch (error) {
+		const code = record$4(error) ? error["code"] : void 0;
+		if (code !== "MODULE_NOT_FOUND" && code !== "ERR_MODULE_NOT_FOUND") throw error;
+	}
+	throw new Error("configuration discovery needs tsrs: reinstall @stll/oxlint-config, which depends on it");
+};
+const readProjectConfig = (root, config) => {
+	const api = resolveProjectApi(root);
+	const result = spawnSync("node", [
+		"--input-type=module",
+		"-e",
+		projectConfigScript,
+		api,
+		root,
+		path.resolve(root, config)
+	], {
+		cwd: root,
+		encoding: "utf8",
+		timeout: 3e4,
+		maxBuffer: 33554432
+	});
+	if (result.error !== void 0) throw result.error;
+	if (result.status !== 0) throw new Error(`configuration discovery failed: ${(result.stderr + result.stdout).trim()}`);
+	const parsed = JSON.parse(result.stdout);
+	if (!record$4(parsed) || !stringList(parsed["files"]) || !stringList(parsed["references"]) || typeof parsed["allowJs"] !== "boolean" || typeof parsed["checkJs"] !== "boolean") throw new Error("compiler configuration must list files and references");
+	return {
+		files: parsed["files"],
+		references: parsed["references"],
+		allowJs: parsed["allowJs"],
+		checkJs: parsed["checkJs"]
+	};
+};
 const relativePath = (root, file) => path.relative(root, path.resolve(root, file)).split(path.sep).join("/");
 const lifecycleFile = (root, file, tracked) => {
 	try {
@@ -1834,7 +1908,6 @@ const checkNodeProjects = ({ root, manifest, trackedFiles }) => {
 	try {
 		const require = createRequire(path.join(root, "package.json"));
 		const oxlint = path.join(path.dirname(require.resolve("oxlint/package.json")), "bin/oxlint");
-		const compiler = path.join(path.dirname(require.resolve("typescript/package.json")), "bin/tsc");
 		const commands = inventory.commands.map((command) => ({
 			cwd: root,
 			...command
@@ -1896,32 +1969,16 @@ const checkNodeProjects = ({ root, manifest, trackedFiles }) => {
 				references: []
 			};
 			try {
-				const project = JSON.parse(readCommand({
-					root,
-					executable: compiler,
-					args: [
-						"--showConfig",
-						"--project",
-						config
-					],
-					runtime: "node"
-				}));
-				if (!record$4(project)) throw new Error("compiler configuration must be an object");
-				const references = project["references"] ?? [];
-				if (!Array.isArray(references)) throw new Error("compiler configuration references must be an array");
-				for (const reference of references) {
-					if (!record$4(reference) || typeof reference["path"] !== "string") throw new Error("compiler project reference requires a path");
-					const target = relativePath(root, path.resolve(root, path.dirname(config), reference["path"]));
+				const project = readProjectConfig(root, config);
+				for (const reference of project.references) {
+					const target = relativePath(root, reference);
 					const referencedConfig = target.endsWith(".json") ? target : path.posix.join(target, "tsconfig.json");
 					if (!trackedFiles.has(referencedConfig)) throw new Error(`project reference is not tracked: ${referencedConfig}`);
 					result.references.push(referencedConfig);
 				}
-				const sources = project["files"] ?? [];
-				if (!stringList(sources)) throw new Error("compiler configuration did not return a files array");
-				const options = project["compilerOptions"];
-				for (const file of sources) {
-					if (scriptSourceKind(file) === "javascript" && (!record$4(options) || options["allowJs"] !== true && options["checkJs"] !== true)) continue;
-					result.files.add(relativePath(root, path.resolve(root, path.dirname(config), file)));
+				for (const file of project.files) {
+					if (scriptSourceKind(file) === "javascript" && !project.allowJs && !project.checkJs) continue;
+					result.files.add(relativePath(root, file));
 				}
 			} catch (error) {
 				result.files.clear();
@@ -1969,8 +2026,11 @@ const checkNodeProjects = ({ root, manifest, trackedFiles }) => {
 //#endregion
 //#region src/toolchain-rust.ts
 const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** Exceptions authorize one immutable release, never a channel or an entire rule. */
-const parseRustExceptions = (input, today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10)) => {
+/**
+* Exceptions authorize one immutable release, never a channel or an entire
+* rule. Expiry is scoped separately by checkRustExceptionExpiry.
+*/
+const parseRustExceptions = (input) => {
 	if (input === void 0) return [];
 	if (!Array.isArray(input)) throw new Error("rustExceptions must be an array");
 	const pins = /* @__PURE__ */ new Set();
@@ -1980,7 +2040,7 @@ const parseRustExceptions = (input, today = (/* @__PURE__ */ new Date()).toISOSt
 			"reason",
 			"tracking",
 			"expires"
-		].includes(key)) || typeof entry["pin"] !== "string" || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(entry["pin"]) || typeof entry["reason"] !== "string" || entry["reason"].trim() === "" || typeof entry["tracking"] !== "string" || !/^https:\/\/github\.com\/[^/\s]+\/[^/\s]+\/issues\/[1-9]\d*$/.test(entry["tracking"]) || typeof entry["expires"] !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(entry["expires"]) || !Number.isFinite(Date.parse(entry["expires"])) || new Date(entry["expires"]).toISOString().slice(0, 10) !== entry["expires"] || entry["expires"] <= today || pins.has(entry["pin"])) throw new Error("each Rust exception requires a unique exact stable pin, reason, GitHub issue and future valid expiry date");
+		].includes(key)) || typeof entry["pin"] !== "string" || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(entry["pin"]) || typeof entry["reason"] !== "string" || entry["reason"].trim() === "" || typeof entry["tracking"] !== "string" || !/^https:\/\/github\.com\/[^/\s]+\/[^/\s]+\/issues\/[1-9]\d*$/.test(entry["tracking"]) || typeof entry["expires"] !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(entry["expires"]) || !Number.isFinite(Date.parse(entry["expires"])) || new Date(entry["expires"]).toISOString().slice(0, 10) !== entry["expires"] || pins.has(entry["pin"])) throw new Error("each Rust exception requires a unique exact stable pin, reason, GitHub issue and valid expiry date");
 		pins.add(entry["pin"]);
 		return {
 			pin: entry["pin"],
@@ -1990,6 +2050,30 @@ const parseRustExceptions = (input, today = (/* @__PURE__ */ new Date()).toISOSt
 		};
 	});
 };
+/** Whether the base stll-toolchain.json declares this exception with the same expiry. */
+const declaresException = (baseText, { pin, expires }) => {
+	const base = JSON.parse(baseText);
+	const exceptions = record$3(base) ? base["rustExceptions"] : void 0;
+	return Array.isArray(exceptions) && exceptions.some((entry) => record$3(entry) && entry["pin"] === pin && entry["expires"] === expires);
+};
+/** An exception expires on its date; the scope decides whether that fails this run. */
+const checkRustExceptionExpiry = ({ exceptions, now = /* @__PURE__ */ new Date(), scope }) => {
+	const today = now.toISOString().slice(0, 10);
+	const errors = [];
+	const warnings = [];
+	for (const exception of exceptions) {
+		if (exception.expires > today) continue;
+		const overdue = `stll-toolchain.json Rust exception ${exception.pin} expired on ${exception.expires}`;
+		const verdict = overdueVerdict(scope, "stll-toolchain.json", (base) => declaresException(base, exception));
+		if (!verdict.fail) warnings.push(`${overdue}; remove it or move to the shared Rust pin (default-branch and scheduled runs fail, as do changes that add or edit it)`);
+		else if (verdict.unavailable === void 0) errors.push(`${overdue}; remove it or move to the shared Rust pin`);
+		else errors.push(`${overdue}; cannot tell whether this change adds it: ${verdict.unavailable}`);
+	}
+	return {
+		errors,
+		warnings
+	};
+};
 /** Only executable fields are inspected: unrelated action inputs are not Rust selectors. */
 const checkRustReferences = (options) => {
 	const { file, rust, exceptions } = options;
@@ -3892,7 +3976,7 @@ const record = (value) => typeof value === "object" && value !== null && !Array.
 const array = (value) => Array.isArray(value);
 /** Repository-owned declarations are explicit; malformed decisions fail closed. */
 const parseToolchainConfiguration = (input) => {
-	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors" && key !== "dynamicSelectors" && key !== "consumerChecks" && key !== "rustExceptions" && key !== "dependabotIgnores") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud, engineFloors, dynamicSelectors, consumerChecks, rustExceptions and dependabotIgnores declarations");
+	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors" && key !== "dynamicSelectors" && key !== "consumerChecks" && key !== "rustExceptions" && key !== "dependabotIgnores" && key !== "typescriptAllowlist") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud, engineFloors, dynamicSelectors, consumerChecks, rustExceptions, dependabotIgnores and typescriptAllowlist declarations");
 	const disabled = /* @__PURE__ */ new Set();
 	const optOuts = input["optOuts"] ?? [];
 	if (!array(optOuts)) throw new Error("optOuts must be an array");
@@ -3913,7 +3997,8 @@ const parseToolchainConfiguration = (input) => {
 		engineFloors: parseEngineFloors(input["engineFloors"]),
 		dynamicSelectors: parseDynamicSelectors(input["dynamicSelectors"]),
 		consumerChecks: parseConsumerChecks(input["consumerChecks"]),
-		dependabotIgnores: parseDependabotIgnores(input["dependabotIgnores"])
+		dependabotIgnores: parseDependabotIgnores(input["dependabotIgnores"]),
+		typescriptAllowlist: parseTypescriptAllowlist(input["typescriptAllowlist"])
 	};
 };
 /** Dependency graphs stay opaque unless a caller explicitly needs registry identities. */
@@ -3971,8 +4056,12 @@ const readToolchainInputs = (root, { bunLock = "presence" } = {}) => {
 		diagnostics
 	};
 };
-const checkToolchain = ({ root, policy, onDelegated, onWarning, now }) => {
+const checkToolchain = ({ root, policy: sharedPolicy, onDelegated, onWarning, now, expiryScope = { kind: "enforce" } }) => {
 	const { files, trackedFiles, diagnostics } = readToolchainInputs(root, { bunLock: "content" });
+	const policy = {
+		...sharedPolicy,
+		bun: repositoryBun(sharedPolicy.bun, files["package.json"])
+	};
 	let repository;
 	try {
 		const origin = execFileSync("git", [
@@ -3996,6 +4085,23 @@ const checkToolchain = ({ root, policy, onDelegated, onWarning, now }) => {
 	if (files["stll-toolchain.json"] !== void 0) try {
 		configuration = parseToolchainConfiguration(JSON.parse(files["stll-toolchain.json"]));
 		dynamicSelectors = configuration.dynamicSelectors;
+		const expiry = checkRustExceptionExpiry({
+			exceptions: configuration.rustExceptions,
+			now,
+			scope: expiryScope
+		});
+		for (const message of expiry.errors) diagnostics.push({
+			rule: "configuration",
+			path: "stll-toolchain.json",
+			line: 1,
+			message
+		});
+		for (const message of expiry.warnings) onWarning?.({
+			rule: "configuration",
+			path: "stll-toolchain.json",
+			line: 1,
+			message
+		});
 		for (const entry of configuration.engineFloors) engineFloors.push(resolveEngineFloor(entry, files));
 	} catch (error) {
 		diagnostics.push({
@@ -4060,7 +4166,8 @@ const checkToolchain = ({ root, policy, onDelegated, onWarning, now }) => {
 	}));
 	diagnostics.push(...checkPackageFiles({
 		files,
-		policy
+		policy,
+		typescriptAllowlist: configuration.typescriptAllowlist
 	}));
 	const usesBun = Object.entries(files).some(([file, text]) => {
 		if (path.posix.basename(file) === "bun.lock") return true;
@@ -4082,7 +4189,8 @@ const checkToolchain = ({ root, policy, onDelegated, onWarning, now }) => {
 		const result = checkRepositoryQuarantine({
 			files,
 			now,
-			npmrcPresent: trackedFiles.has(".npmrc")
+			npmrcPresent: trackedFiles.has(".npmrc"),
+			expiry: expiryScope
 		});
 		for (const message of result.errors) diagnostics.push({
 			rule: "quarantine-policy",
@@ -4168,6 +4276,6 @@ const checkToolchain = ({ root, policy, onDelegated, onWarning, now }) => {
 	return diagnostics.filter((diagnostic) => !configuration.disabled.has(diagnostic.rule));
 };
 //#endregion
-export { parseToolchainConfiguration as n, readToolchainInputs as r, checkToolchain as t };
+export { repositoryBun as i, parseToolchainConfiguration as n, readToolchainInputs as r, checkToolchain as t };
 
 //# sourceMappingURL=toolchain-guard.mjs.map