@stll/oxlint-config 1.9.0 → 2.0.0

package/dist/toolchain-changed-cli.cjs

@@ -1,6 +1,1481 @@
 #!/usr/bin/env node
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_toolchain_changed = require("./toolchain-changed.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime.cjs");
+const require_jsonc = require("./jsonc.cjs");
+const require_toolchain_inputs = require("./toolchain-inputs.cjs");
+const require_compiler_packages = require("./compiler-packages.cjs");
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let node_child_process = require("node:child_process");
+let smol_toml = require("smol-toml");
+let semver = require("semver");
+let node_util = require("node:util");
+let yaml = require("yaml");
+//#region src/toolchain-changed-locks.ts
+const toolchainChangedTools = [
+	"bun",
+	"node",
+	"typescript",
+	"oxlint",
+	"oxlint-tsgolint",
+	"shared"
+];
+const changedRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const changedPackageTool = (name) => {
+	if (require_compiler_packages.isCompilerPackage(name)) return "typescript";
+	if (name === "oxlint" || name === "oxlint-tsgolint") return name;
+	if (name.startsWith("@stll/") || name === "@oxlint/plugins" || name === "lefthook") return "shared";
+};
+/** Compiler patch declarations retain hashes as well as referenced source paths. */
+const changedCompilerPatches = ({ value, stringsArePaths, compilerNames }) => {
+	const patches = [];
+	if (!changedRecord(value)) return patches;
+	const declarations = value["patchedDependencies"];
+	if (declarations === void 0) return patches;
+	if (!changedRecord(declarations)) throw new Error("Unclassifiable patchedDependencies declaration");
+	for (const [descriptor, metadata] of Object.entries(declarations)) {
+		const name = /^(@[^/]+\/[^@]+|[^@]+)(?:@.*)?$/.exec(descriptor)?.[1];
+		if (!name || changedPackageTool(name) !== "typescript" && !compilerNames.has(name)) continue;
+		let reference;
+		if (typeof metadata === "string") {
+			if (metadata.trim() === "") throw new Error(`Empty compiler patch metadata: ${descriptor}`);
+			if (stringsArePaths) reference = metadata;
+		} else if (changedRecord(metadata)) {
+			const declaredPath = metadata["path"];
+			if (declaredPath !== void 0) {
+				if (typeof declaredPath !== "string") throw new Error(`Invalid compiler patch path: ${descriptor}`);
+				reference = declaredPath;
+			}
+		} else throw new Error(`Invalid compiler patch metadata: ${descriptor}`);
+		if (stringsArePaths && reference === void 0) throw new Error(`Missing compiler patch path: ${descriptor}`);
+		if (reference === void 0) patches.push({
+			name: descriptor,
+			metadata
+		});
+		else patches.push({
+			name: descriptor,
+			metadata,
+			reference
+		});
+	}
+	return patches;
+};
+const changedYarnSelectors = (location) => location.replace(/"/g, "").split(/,\s*/).map((selector) => selector.trim());
+const packageDescriptor = (descriptor) => {
+	const match = /^(@[^/]+\/[^@]+|[^@]+)@(.+)$/.exec(descriptor.replace(/^\//, ""));
+	const name = match?.[1];
+	const version = match?.[2];
+	if (!name || !version) return void 0;
+	return {
+		name,
+		version
+	};
+};
+const dependencyName = (location) => {
+	const parts = location.split("/");
+	const last = parts.at(-1);
+	const scope = parts.at(-2);
+	return scope?.startsWith("@") ? `${scope}/${last}` : last ?? location;
+};
+const exactVersion = (value) => {
+	const version = value.split("(")[0];
+	if (version && (0, semver.valid)(version) === version) return version;
+	throw new Error(`Unresolved toolchain lock version: ${value}`);
+};
+const stableIdentity = (value) => {
+	if (Array.isArray(value)) return JSON.stringify(value.map(stableIdentity));
+	if (changedRecord(value)) return JSON.stringify(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => [key, stableIdentity(entry)]));
+	if (value === void 0) return "undefined";
+	return JSON.stringify(value);
+};
+const validIntegrity = (value) => value.split(/\s+/).some((item) => {
+	const match = /^(sha1|sha256|sha384|sha512)-([A-Za-z0-9+/]+={0,2})$/.exec(item);
+	const algorithm = match?.[1];
+	const encoded = match?.[2];
+	if (!algorithm || !encoded) return false;
+	const bytes = Buffer.from(encoded, "base64");
+	if (bytes.toString("base64") !== encoded) return false;
+	switch (algorithm) {
+		case "sha1": return bytes.length === 20;
+		case "sha256": return bytes.length === 32;
+		case "sha384": return bytes.length === 48;
+		case "sha512": return bytes.length === 64;
+		default: return false;
+	}
+});
+const lockSourceProof = (raw) => {
+	const sources = [];
+	const evidence = [];
+	const commits = [];
+	const source = (value) => {
+		if (typeof value !== "string") return;
+		sources.push(value);
+		const commit = /#(?:commit=)?([a-f0-9]{40}|[a-f0-9]{64})(?:[&#]|$)/i.exec(value)?.[1];
+		if (commit) commits.push(`commit:${commit.toLowerCase()}`);
+	};
+	const digest = (key, value) => {
+		if (typeof value !== "string") return;
+		if (key === "integrity" && validIntegrity(value) || key === "checksum" && /^(?:[a-f0-9]+\/)?[a-f0-9]{128}$/i.test(value) || key === "shasum" && /^[a-f0-9]{40}$/i.test(value)) evidence.push(`${key}:${value}`);
+		if (key === "commit" && /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i.test(value)) commits.push(`commit:${value.toLowerCase()}`);
+	};
+	const metadata = (value) => {
+		if (!changedRecord(value)) return;
+		for (const key of [
+			"resolved",
+			"resolution",
+			"tarball",
+			"repo",
+			"version"
+		]) source(value[key]);
+		for (const key of [
+			"integrity",
+			"checksum",
+			"shasum",
+			"commit"
+		]) digest(key, value[key]);
+		if (changedRecord(value["resolution"])) {
+			const resolution = value["resolution"];
+			for (const key of [
+				"tarball",
+				"repo",
+				"directory"
+			]) source(resolution[key]);
+			for (const key of ["integrity", "commit"]) digest(key, resolution[key]);
+			if (resolution["type"] === "directory" || typeof resolution["directory"] === "string") sources.push("file:");
+			if (resolution["type"] === "git") sources.push("git:");
+		}
+		if (value["link"] === true) sources.push("link:");
+	};
+	if (Array.isArray(raw)) {
+		source(raw[0]);
+		source(raw[1]);
+		digest("integrity", raw[3]);
+	} else if (changedRecord(raw)) {
+		if (changedRecord(raw["metadata"])) {
+			metadata(raw["metadata"]);
+			const descriptor = raw["descriptor"];
+			source(typeof descriptor === "string" ? descriptor.replace(/^\//, "") : descriptor);
+		} else metadata(raw);
+	}
+	if (sources.some((value) => {
+		if (/(?:^|@)(?:link:|portal:|workspace:)/i.test(value)) return true;
+		const local = /(?:^|@)file:(.*)$/i.exec(value)?.[1];
+		if (local !== void 0) return !/\.(?:tgz|tar\.gz)(?:[?#].*)?$/i.test(local);
+		return /^(?:\.{1,2}\/|\/)/.test(value) && !/\.(?:tgz|tar\.gz)(?:[?#].*)?$/i.test(value);
+	})) return { type: "unidentified" };
+	if (sources.some((value) => /(?:^|@)(?:git(?:\+[^:]+)?:|github:|gitlab:|bitbucket:|ssh:)|(?:github\.com|gitlab\.com)[:/]|(?:^|@)git@|^[\w.-]+@(?!(?:npm|patch|file|link|portal|workspace|https?|git(?:\+[^:]+)?|github|gitlab|bitbucket|ssh):)[^/:]+:|\.git(?:#|$)/i.test(value))) {
+		const proof = commits;
+		return proof.length > 0 ? {
+			type: "immutable",
+			identity: stableIdentity(proof.sort())
+		} : { type: "unidentified" };
+	}
+	if (sources.some((value) => /(?:^|@)file:/i.test(value) || /(?:^|@)https?:/i.test(value) && !/(?:^|@)https:\/\/(?:registry\.npmjs\.org|registry\.yarnpkg\.com)\//i.test(value)) && evidence.length === 0) return { type: "unidentified" };
+	if (evidence.length > 0) return {
+		type: "immutable",
+		identity: stableIdentity(evidence.sort())
+	};
+	return { type: "registry" };
+};
+const addResolution = ({ raw, resolutions, name, version, dependency, location }) => {
+	const tool = changedPackageTool(name) ?? changedPackageTool(dependency);
+	if (tool === void 0) return;
+	const sourceProof = lockSourceProof(raw);
+	if (tool === "typescript" && sourceProof.type === "unidentified") throw new Error(`Compiler source has no immutable identity: ${name}`);
+	const identity = stableIdentity(raw);
+	if (version.startsWith("workspace:") || version.startsWith("link:")) {
+		if (tool !== "shared") throw new Error(`Unresolved compiler workspace lock version: ${name}`);
+		resolutions.push({
+			tool,
+			name,
+			version,
+			dependency,
+			location,
+			identity,
+			sourceProof
+		});
+		return;
+	}
+	resolutions.push({
+		tool,
+		name,
+		version: exactVersion(version),
+		identity,
+		sourceProof,
+		dependency,
+		location
+	});
+};
+const dependencyFields = [
+	"dependencies",
+	"devDependencies",
+	"optionalDependencies"
+];
+const importerDependencies = (value) => {
+	if (!changedRecord(value)) throw new Error("Invalid lockfile importer");
+	const result = {};
+	for (const field of dependencyFields) {
+		const dependencies = value[field];
+		if (dependencies === void 0) continue;
+		if (!changedRecord(dependencies)) throw new Error("Invalid lockfile dependency table");
+		for (const [name, metadata] of Object.entries(dependencies)) if (typeof metadata === "string") result[name] = metadata;
+		else if (changedRecord(metadata) && typeof metadata["version"] === "string") result[name] = metadata["version"];
+		else if (changedPackageTool(name) !== void 0) throw new Error(`Unresolved lockfile importer dependency: ${name}`);
+	}
+	return result;
+};
+const BUN_TEXT_LOCKFILE_VERSIONS = /* @__PURE__ */ new Set([
+	0,
+	1,
+	2
+]);
+const parseChangedLock = ({ file, text }) => {
+	const resolutions = [];
+	const importers = {};
+	if (file.endsWith("bun.lock")) {
+		const parsed = require_jsonc.parseJsonc(text);
+		if (!changedRecord(parsed) || !BUN_TEXT_LOCKFILE_VERSIONS.has(Number(parsed["lockfileVersion"])) || !changedRecord(parsed["packages"]) || !changedRecord(parsed["workspaces"])) throw new Error("Unsupported Bun lockfile shape");
+		for (const [directory, workspace] of Object.entries(parsed["workspaces"])) importers[directory || "."] = importerDependencies(workspace);
+		for (const [location, value] of Object.entries(parsed["packages"])) {
+			const dependency = dependencyName(location);
+			const first = Array.isArray(value) ? value.at(0) : void 0;
+			const descriptor = typeof first === "string" ? packageDescriptor(first) : void 0;
+			if (descriptor !== void 0) addResolution({
+				resolutions,
+				...descriptor,
+				dependency,
+				location,
+				raw: value
+			});
+			else if (changedPackageTool(dependency) !== void 0) throw new Error(`Invalid Bun toolchain lock entry: ${location}`);
+		}
+	} else if (file.endsWith("pnpm-lock.yaml")) {
+		const document = (0, yaml.parseDocument)(text);
+		if (document.errors.length > 0) throw new Error("Invalid pnpm lockfile YAML");
+		const parsed = document.toJS({ maxAliasCount: 100 });
+		if (!changedRecord(parsed) || ![
+			5.4,
+			6,
+			9
+		].includes(Number(parsed["lockfileVersion"]))) throw new Error("Unsupported pnpm lockfile shape");
+		const sourceImporters = changedRecord(parsed["importers"]) ? parsed["importers"] : { ".": parsed };
+		for (const [directory, importer] of Object.entries(sourceImporters)) importers[directory] = importerDependencies(importer);
+		const packages = parsed["packages"] ?? {};
+		if (!changedRecord(packages)) throw new Error("Invalid pnpm lockfile packages");
+		for (const [location, metadata] of Object.entries(packages)) {
+			let descriptor = packageDescriptor(location);
+			if (descriptor === void 0) {
+				const legacy = /^(.*)\/([^/]+)$/.exec(location.replace(/^\//, ""));
+				if (legacy?.[1] && legacy[2]) descriptor = {
+					name: legacy[1],
+					version: legacy[2]
+				};
+			}
+			if (!descriptor) continue;
+			const version = changedRecord(metadata) && typeof metadata["version"] === "string" ? metadata["version"] : descriptor.version;
+			const baseDescriptor = location.split("(").at(0);
+			const snapshots = changedRecord(parsed["snapshots"]) ? Object.fromEntries(Object.entries(parsed["snapshots"]).filter(([key]) => key.split("(").at(0) === baseDescriptor)) : {};
+			addResolution({
+				resolutions,
+				name: descriptor.name,
+				raw: {
+					descriptor: location,
+					metadata,
+					snapshots
+				},
+				version,
+				dependency: descriptor.name,
+				location
+			});
+		}
+	} else if (file.endsWith("yarn.lock")) {
+		const classic = /^# yarn lockfile v1\s*$/m.test(text);
+		let yaml$1 = text;
+		if (classic) yaml$1 = text.split(/\r?\n/).map((line) => {
+			if (line === "" || /^\s*#/.test(line)) return line;
+			if (!/^\s/.test(line) && line.endsWith(":")) return `${JSON.stringify(line.slice(0, -1))}:`;
+			const field = /^(\s+)([A-Za-z][\w-]*|"(?:[^"\\]|\\.)*") (.+)$/.exec(line);
+			if (field) return `${field[1]}${field[2]}: ${field[3]}`;
+			return line;
+		}).join("\n");
+		const document = (0, yaml.parseDocument)(yaml$1);
+		if (document.errors.length > 0) throw new Error("Invalid Yarn lockfile");
+		const parsed = document.toJS({ maxAliasCount: 100 });
+		if (!changedRecord(parsed) || !classic && !changedRecord(parsed["__metadata"])) throw new Error("Unsupported Yarn lockfile shape");
+		for (const [location, metadata] of Object.entries(parsed)) {
+			if (location === "__metadata") continue;
+			const selectors = changedYarnSelectors(location);
+			const descriptors = selectors.map(packageDescriptor).filter((item) => item !== void 0);
+			for (const descriptor of descriptors) {
+				const alias = descriptor.version.startsWith("npm:") ? packageDescriptor(descriptor.version.slice(4)) : void 0;
+				const dependency = descriptor.name;
+				const resolution = changedRecord(metadata) && typeof metadata["resolution"] === "string" ? packageDescriptor(metadata["resolution"]) : void 0;
+				let name = (resolution?.version.startsWith("npm:") ? packageDescriptor(resolution.version.slice(4)) : void 0)?.name ?? resolution?.name ?? dependency;
+				if (alias && !require_compiler_packages.isCompilerPackage(name)) name = alias.name;
+				const patchDescriptor = descriptor.version.startsWith("patch:") ? packageDescriptor(descriptor.version.slice(6)) : void 0;
+				if ((require_compiler_packages.isCompilerPackage(name) || require_compiler_packages.isCompilerPackage(dependency) || patchDescriptor !== void 0 && require_compiler_packages.isCompilerPackage(patchDescriptor.name)) && (descriptor.version.startsWith("patch:") || resolution?.version.startsWith("patch:"))) throw new Error(`Yarn compiler patch identity requires tracked patch bytes: ${location}`);
+				if (changedPackageTool(name) === void 0 && changedPackageTool(dependency) === void 0) continue;
+				if (!changedRecord(metadata) || typeof metadata["version"] !== "string") throw new Error(`Missing Yarn toolchain version: ${location}`);
+				if (!classic && typeof metadata["resolution"] !== "string") throw new Error(`Missing Yarn compiler resolution: ${location}`);
+				addResolution({
+					resolutions,
+					name,
+					version: metadata["version"],
+					dependency,
+					location: selectors.join(", "),
+					raw: {
+						selectors,
+						metadata
+					}
+				});
+			}
+		}
+	} else {
+		const parsed = require_jsonc.parseJsonc(text);
+		if (!changedRecord(parsed) || ![
+			1,
+			2,
+			3
+		].includes(Number(parsed["lockfileVersion"]))) throw new Error("Unsupported npm lockfile shape");
+		if (changedRecord(parsed["packages"])) for (const [location, metadata] of Object.entries(parsed["packages"])) {
+			if (!changedRecord(metadata)) throw new Error("Invalid npm lockfile package");
+			if (!location.includes("node_modules/")) {
+				const ownName = metadata["name"];
+				if (typeof ownName === "string" && require_compiler_packages.isCompilerPackage(ownName)) throw new Error(`Compiler directory lock entry has no tracked byte identity: ${location || "."}`);
+				importers[location || "."] = importerDependencies(metadata);
+				continue;
+			}
+			const dependency = dependencyName(location);
+			const name = typeof metadata["name"] === "string" ? metadata["name"] : dependency;
+			if (metadata["link"] === true) {
+				addResolution({
+					resolutions,
+					name,
+					raw: metadata,
+					version: `link:${String(metadata["resolved"])}`,
+					dependency,
+					location
+				});
+				continue;
+			}
+			if (typeof metadata["version"] === "string") addResolution({
+				resolutions,
+				name,
+				raw: metadata,
+				version: metadata["version"],
+				dependency,
+				location
+			});
+			else if (changedPackageTool(name) !== void 0 || changedPackageTool(dependency) !== void 0) throw new Error(`Missing npm toolchain version: ${name}`);
+		}
+		else if (changedRecord(parsed["dependencies"])) {
+			const visit = ({ dependencies, parent }) => {
+				for (const [dependency, metadata] of Object.entries(dependencies)) {
+					if (!changedRecord(metadata)) throw new Error("Invalid npm lockfile dependency");
+					const location = `${parent}node_modules/${dependency}`;
+					const version = metadata["version"];
+					const alias = typeof version === "string" && version.startsWith("npm:") ? packageDescriptor(version.slice(4)) : void 0;
+					if (typeof version === "string") addResolution({
+						resolutions,
+						name: alias?.name ?? dependency,
+						raw: metadata,
+						version: alias?.version ?? version,
+						dependency,
+						location
+					});
+					else if (changedPackageTool(dependency) !== void 0) throw new Error(`Missing npm toolchain version: ${dependency}`);
+					if (changedRecord(metadata["dependencies"])) visit({
+						dependencies: metadata["dependencies"],
+						parent: `${location}/`
+					});
+				}
+			};
+			visit({
+				dependencies: parsed["dependencies"],
+				parent: ""
+			});
+		} else throw new Error("Missing npm lockfile dependency resolutions");
+	}
+	return {
+		resolutions,
+		importers
+	};
+};
+//#endregion
+//#region src/toolchain-changed.ts
+const git = (0, node_util.promisify)(node_child_process.execFile);
+const otherRuntimeFiles = /* @__PURE__ */ new Set([
+	".python-version",
+	"rust-toolchain",
+	"rust-toolchain.toml",
+	".go-version",
+	"go.mod",
+	"go.work",
+	".java-version",
+	".ruby-version",
+	".sdkmanrc",
+	".dotnet-version",
+	"global.json",
+	".terraform-version",
+	".deno-version"
+]);
+const containerDefinition = (file) => require_toolchain_inputs.isDockerDefinitionPath(file) || require_toolchain_inputs.isComposeDefinitionPath(file) || require_toolchain_inputs.isKubernetesDefinitionPath(file);
+const compilerPatchPackageFile = (file, compilerNames) => {
+	if (!file.endsWith(".patch")) return false;
+	const target = node_path.default.posix.basename(file).split("++").at(-1);
+	if (target === void 0) return false;
+	const encoded = /^(@[^+]+\+[^+]+|[^+]+)\+/.exec(target)?.[1];
+	return encoded !== void 0 && (changedPackageTool(encoded.replace("+", "/")) === "typescript" || compilerNames.has(encoded.replace("+", "/")));
+};
+const trackedInput = (file) => {
+	if (file.split("/").some((part) => part === "node_modules" || part === "vendor")) return false;
+	const name = node_path.default.posix.basename(file);
+	return [
+		"package.json",
+		"bun.lock",
+		"bun.lockb",
+		"pnpm-lock.yaml",
+		"package-lock.json",
+		"npm-shrinkwrap.json",
+		"yarn.lock",
+		"pnpm-workspace.yaml",
+		".node-version",
+		".nvmrc",
+		".bun-version",
+		".tool-versions",
+		"toolchain.json",
+		".npmrc"
+	].includes(name) || file.endsWith(".patch") || otherRuntimeFiles.has(name) || require_toolchain_inputs.isMiseConfigPath(file) || require_toolchain_inputs.githubAutomationFileKind(file) !== void 0 || containerDefinition(file);
+};
+const readTree = async ({ repo, ref }) => {
+	const { stdout } = await git("git", [
+		"ls-tree",
+		"-rz",
+		"--full-tree",
+		ref
+	], {
+		cwd: repo,
+		encoding: "utf8",
+		maxBuffer: 33554432
+	});
+	const entries = /* @__PURE__ */ new Map();
+	for (const entry of stdout.split("\0")) {
+		if (entry === "") continue;
+		const tab = entry.indexOf("	");
+		if (tab < 0) throw new Error("Invalid Git tree response");
+		const file = entry.slice(tab + 1);
+		const [mode, type, oid] = entry.slice(0, tab).split(" ");
+		if (type !== "blob" && !trackedInput(file)) continue;
+		if (type !== "blob" || !mode || !oid || !/^[a-f0-9]{40,64}$/.test(oid)) throw new Error("Unreadable tracked toolchain input");
+		entries.set(file, {
+			mode,
+			oid
+		});
+	}
+	return entries;
+};
+const readBlobs = async ({ repo, oids }) => {
+	if (oids.length === 0) return /* @__PURE__ */ new Map();
+	const data = await new Promise((resolve, reject) => {
+		const child = (0, node_child_process.spawn)("git", ["cat-file", "--batch"], {
+			cwd: repo,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+		const chunks = [];
+		let size = 0;
+		child.stdout.on("data", (chunk) => {
+			size += chunk.length;
+			if (size > 134217728) {
+				child.kill();
+				reject(/* @__PURE__ */ new Error("Toolchain Git snapshot exceeds the read limit"));
+				return;
+			}
+			chunks.push(chunk);
+		});
+		child.stderr.resume();
+		child.on("error", reject);
+		child.on("close", (code) => code === 0 ? resolve(Buffer.concat(chunks)) : reject(/* @__PURE__ */ new Error("Unable to read Git snapshot blobs")));
+		child.stdin.on("error", reject);
+		child.stdin.end(`${oids.join("\n")}\n`);
+	});
+	const blobs = /* @__PURE__ */ new Map();
+	let offset = 0;
+	for (const oid of oids) {
+		const end = data.indexOf(10, offset);
+		if (end < 0) throw new Error("Invalid Git blob response");
+		const [actual, type, length] = data.subarray(offset, end).toString("utf8").split(" ");
+		const size = Number(length);
+		if (actual !== oid || type !== "blob" || !Number.isSafeInteger(size) || size < 0 || end + size + 1 >= data.length) throw new Error("Unreadable Git blob response");
+		offset = end + 1;
+		blobs.set(oid, data.subarray(offset, offset + size).toString("utf8"));
+		offset += size + 1;
+	}
+	if (offset !== data.length) throw new Error("Unexpected Git blob response");
+	return blobs;
+};
+const snapshotText = ({ snapshot, file, visited = /* @__PURE__ */ new Set() }) => {
+	if (visited.has(file)) throw new Error("Cyclic tracked toolchain file reference");
+	visited.add(file);
+	const entry = snapshot.entries.get(file);
+	const text = entry && snapshot.blobs.get(entry.oid);
+	if (!entry || text === void 0) throw new Error(`Missing tracked toolchain input: ${file}`);
+	if (entry.mode !== "120000") return text;
+	const target = node_path.default.posix.normalize(node_path.default.posix.join(node_path.default.posix.dirname(file), text));
+	if (node_path.default.posix.isAbsolute(text) || target === ".." || target.startsWith("../")) throw new Error("Toolchain file reference leaves the tracked snapshot");
+	return snapshotText({
+		snapshot,
+		file: target,
+		visited
+	});
+};
+/**
+* What one `actions/checkout` step puts where, or `undefined` for any other step.
+*
+* A selector such as `base/package.json` after a checkout of this repository
+* with `path: base` names the repository's own `package.json` at another ref,
+* so it is read as that tracked file. A path built from an expression could
+* replace any directory, so it is `unknown`.
+*/
+const checkoutStep = (step) => {
+	if (!changedRecord(step)) return void 0;
+	const uses = step["uses"];
+	if (typeof uses !== "string" || !uses.startsWith("actions/checkout@")) return void 0;
+	const options = changedRecord(step["with"]) ? step["with"] : {};
+	const repository = options["repository"];
+	const sameRepository = repository === void 0 || repository === "${{ github.repository }}";
+	const checkoutPath = options["path"];
+	if (checkoutPath === void 0) return {
+		kind: "root",
+		sameRepository
+	};
+	if (typeof checkoutPath !== "string" || checkoutPath.includes("${{") || node_path.default.posix.isAbsolute(checkoutPath)) return { kind: "unknown" };
+	const normalized = node_path.default.posix.normalize(checkoutPath).replace(/\/+$/, "");
+	if (normalized === "" || normalized === ".") return {
+		kind: "root",
+		sameRepository
+	};
+	if (normalized.split("/").includes("..")) return { kind: "unknown" };
+	return {
+		kind: "path",
+		path: normalized,
+		sameRepository
+	};
+};
+/**
+* The tracked file a declared selector names under the checkouts preceding
+* its step. The most specific checkout directory decides; a selector inside
+* another repository's checkout is not a tracked file, whatever this
+* repository tracks at the same path.
+*/
+const resolveCheckoutSelector = (declared, checkouts) => {
+	const file = node_path.default.posix.normalize(declared);
+	let owner;
+	for (const directory of checkouts.keys()) if ((directory === "" || file.startsWith(`${directory}/`)) && (owner === void 0 || directory.length > owner.length)) owner = directory;
+	if (owner === void 0) return file;
+	if (checkouts.get(owner) !== true) throw new Error(`Setup version-file names a file outside this repository: ${declared}`);
+	return owner === "" ? file : file.slice(owner.length + 1);
+};
+/** Visit each step with only the checkouts that precede it. */
+const visitStepsInOrder = (steps, checkouts, visitStep) => {
+	const scope = new Map(checkouts);
+	for (const step of steps) {
+		visitStep(step, scope);
+		const checkout = checkoutStep(step);
+		if (checkout === void 0) continue;
+		if (checkout.kind !== "path") {
+			scope.clear();
+			scope.set("", checkout.kind === "root" && checkout.sameRepository);
+			continue;
+		}
+		for (const directory of scope.keys()) if (directory === checkout.path || directory.startsWith(`${checkout.path}/`)) scope.delete(directory);
+		scope.set(checkout.path, checkout.sameRepository);
+	}
+};
+const selectorFiles = (snapshot) => {
+	const files = /* @__PURE__ */ new Map();
+	const visit = (value, checkouts = /* @__PURE__ */ new Map()) => {
+		if (Array.isArray(value)) {
+			for (const entry of value) visit(entry, checkouts);
+			return;
+		}
+		if (!changedRecord(value)) return;
+		for (const [key, entry] of Object.entries(value)) {
+			if (key === "steps" && Array.isArray(entry)) {
+				visitStepsInOrder(entry, checkouts, visit);
+				continue;
+			}
+			const input = key.toLowerCase();
+			if (!/(?:^|-)version-file$/.test(input) && ![
+				"toolchain-file",
+				"rust-toolchain-file",
+				"global-json-file"
+			].includes(input)) {
+				visit(entry, checkouts);
+				continue;
+			}
+			if (typeof entry !== "string" || entry.trim() === "" || entry.includes("${{") || node_path.default.posix.isAbsolute(entry) || entry.split("/").includes("..")) throw new Error("Unclassifiable setup version-file declaration");
+			const file = resolveCheckoutSelector(entry, checkouts);
+			if (file === "." || file.split("/").some((part) => part === "vendor" || part === "node_modules")) throw new Error("Setup version-file leaves the tracked toolchain scope");
+			let tool = "shared";
+			if (input === "node-version-file") tool = "node";
+			else if (input === "bun-version-file") tool = "bun";
+			const selected = files.get(file) ?? /* @__PURE__ */ new Set();
+			selected.add(tool);
+			files.set(file, selected);
+		}
+	};
+	for (const file of snapshot.entries.keys()) {
+		if (require_toolchain_inputs.githubAutomationFileKind(file) === void 0) continue;
+		const document = (0, yaml.parseDocument)(snapshotText({
+			snapshot,
+			file
+		}));
+		if (document.errors.length > 0) throw new Error("Unreadable workflow declaration");
+		visit(document.toJS({ maxAliasCount: 100 }));
+	}
+	return files;
+};
+const compilerInstallationNames = (snapshot) => {
+	const names = /* @__PURE__ */ new Set();
+	const collectCatalogs = (value) => {
+		if (!changedRecord(value)) return;
+		const visit = (entry) => {
+			if (!changedRecord(entry)) return;
+			for (const [name, specifier] of Object.entries(entry)) if (typeof specifier === "string" && changedPackageTool(packageTarget({
+				name,
+				specifier
+			})) === "typescript") names.add(name);
+			else visit(specifier);
+		};
+		visit(value["catalog"]);
+		visit(value["catalogs"]);
+	};
+	for (const file of snapshot.entries.keys()) {
+		const basename = node_path.default.posix.basename(file);
+		if (basename === "package.json") {
+			const manifest = require_jsonc.parseJsonc(snapshotText({
+				snapshot,
+				file
+			}));
+			if (!changedRecord(manifest)) throw new Error(`Invalid tracked manifest: ${file}`);
+			if (typeof manifest["name"] === "string" && changedPackageTool(manifest["name"]) === "typescript") throw new Error(`Tracked compiler source has no immutable artifact identity: ${file}`);
+			collectCatalogs(manifest);
+			collectCatalogs(manifest["workspaces"]);
+			for (const field of installedFields) {
+				const dependencies = manifest[field];
+				if (!changedRecord(dependencies)) continue;
+				for (const [name, specifier] of Object.entries(dependencies)) if (typeof specifier === "string" && changedPackageTool(packageTarget({
+					name,
+					specifier
+				})) === "typescript") names.add(name);
+			}
+		} else if (basename === "pnpm-workspace.yaml") {
+			const document = (0, yaml.parseDocument)(snapshotText({
+				snapshot,
+				file
+			}));
+			if (document.errors.length > 0) throw new Error(`Invalid catalog YAML: ${file}`);
+			collectCatalogs(document.toJS({ maxAliasCount: 100 }));
+		} else if ([
+			"bun.lock",
+			"pnpm-lock.yaml",
+			"package-lock.json",
+			"npm-shrinkwrap.json",
+			"yarn.lock"
+		].includes(basename)) {
+			const lock = parseChangedLock({
+				file,
+				text: snapshotText({
+					snapshot,
+					file
+				})
+			});
+			for (const resolution of lock.resolutions) if (resolution.tool === "typescript") names.add(resolution.dependency);
+			for (const dependencies of Object.values(lock.importers)) for (const [name, version] of Object.entries(dependencies)) if (changedPackageTool(importerRegistryName({
+				dependency: name,
+				version
+			}) ?? name) === "typescript") names.add(name);
+		}
+	}
+	return names;
+};
+const effectiveCatalogSpecifier = ({ snapshot, file, dependency, specifier }) => {
+	if (!specifier.startsWith("catalog:")) return specifier;
+	const catalog = specifier.slice(8);
+	const owners = [...snapshot.entries.keys()].filter((candidate) => ["package.json", "pnpm-workspace.yaml"].includes(node_path.default.posix.basename(candidate)) && isAncestor(node_path.default.posix.dirname(candidate), node_path.default.posix.dirname(file))).sort((a, b) => directoryDepth(node_path.default.posix.dirname(b)) - directoryDepth(node_path.default.posix.dirname(a)) || Number(b.endsWith("pnpm-workspace.yaml")) - Number(a.endsWith("pnpm-workspace.yaml")));
+	for (const owner of owners) {
+		const text = snapshotText({
+			snapshot,
+			file: owner
+		});
+		let value;
+		if (owner.endsWith(".yaml")) {
+			const document = (0, yaml.parseDocument)(text);
+			if (document.errors.length > 0) throw new Error(`Invalid catalog YAML: ${owner}`);
+			value = document.toJS({ maxAliasCount: 100 });
+		} else value = require_jsonc.parseJsonc(text);
+		if (!changedRecord(value)) continue;
+		const sources = [value];
+		if (changedRecord(value["workspaces"])) sources.push(value["workspaces"]);
+		for (const source of sources) {
+			let declarations;
+			if (catalog === "") declarations = source["catalog"];
+			else if (changedRecord(source["catalogs"])) declarations = source["catalogs"][catalog];
+			if (declarations === void 0) continue;
+			if (!changedRecord(declarations) || typeof declarations[dependency] !== "string") throw new Error(`Missing effective catalog dependency: ${file}:${dependency}`);
+			const effective = declarations[dependency];
+			if (effective.startsWith("catalog:")) throw new Error(`Recursive compiler catalog: ${file}:${dependency}`);
+			return effective;
+		}
+	}
+	throw new Error(`Missing effective catalog: ${file}:${dependency}`);
+};
+const compilerPatches = (snapshot) => {
+	const compilerNames = compilerInstallationNames(snapshot);
+	const result = [];
+	for (const file of snapshot.entries.keys()) {
+		const name = node_path.default.posix.basename(file);
+		if (![
+			"package.json",
+			"pnpm-workspace.yaml",
+			"pnpm-lock.yaml",
+			"bun.lock"
+		].includes(name)) continue;
+		const text = snapshotText({
+			snapshot,
+			file
+		});
+		let value;
+		if (name.endsWith(".yaml")) {
+			const document = (0, yaml.parseDocument)(text);
+			if (document.errors.length > 0) throw new Error(`Invalid compiler patch YAML: ${file}`);
+			value = document.toJS({ maxAliasCount: 100 });
+		} else value = require_jsonc.parseJsonc(text);
+		const sources = [value];
+		if (name === "package.json" && changedRecord(value)) sources.push(value["pnpm"]);
+		for (const source of sources) for (const patch of changedCompilerPatches({
+			value: source,
+			compilerNames,
+			stringsArePaths: name === "package.json" || name === "pnpm-workspace.yaml"
+		})) {
+			if (patch.reference === void 0) {
+				result.push({
+					file,
+					name: patch.name,
+					metadata: patch.metadata
+				});
+				continue;
+			}
+			const reference = node_path.default.posix.normalize(node_path.default.posix.join(node_path.default.posix.dirname(file), patch.reference));
+			if (patch.reference.trim() === "" || node_path.default.posix.isAbsolute(patch.reference) || patch.reference.includes("\\") || patch.reference.split("").some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127) || reference === ".." || reference.startsWith("../")) throw new Error(`Compiler patch reference leaves the tracked snapshot: ${file}:${patch.name}`);
+			result.push({
+				file,
+				name: patch.name,
+				metadata: patch.metadata,
+				reference
+			});
+		}
+		if (name === "pnpm-lock.yaml" && changedRecord(value) && changedRecord(value["snapshots"])) for (const descriptor of Object.keys(value["snapshots"])) {
+			const packageName = /^(@[^/]+\/[^@]+|[^@]+)@/.exec(descriptor)?.[1];
+			if (packageName && (changedPackageTool(packageName) === "typescript" || compilerNames.has(packageName)) && descriptor.includes("patch_hash=")) result.push({
+				file,
+				name: descriptor,
+				metadata: descriptor
+			});
+		}
+	}
+	return result;
+};
+const readSnapshots = async ({ repo, trees }) => {
+	const selected = trees.map((tree) => new Map([...tree].filter(([file]) => trackedInput(file))));
+	const blobs = /* @__PURE__ */ new Map();
+	for (;;) {
+		const pending = [...new Set(selected.flatMap((entries) => [...entries.values()].map((entry) => entry.oid)))].filter((oid) => !blobs.has(oid));
+		for (const [oid, text] of await readBlobs({
+			repo,
+			oids: pending
+		})) blobs.set(oid, text);
+		let expanded = false;
+		for (let index = 0; index < selected.length; index += 1) {
+			const entries = selected.at(index);
+			const tree = trees.at(index);
+			if (!entries || !tree) throw new Error("Missing Git tree");
+			const required = /* @__PURE__ */ new Set();
+			const requiredPatches = /* @__PURE__ */ new Set();
+			for (const [file, entry] of entries) {
+				if (entry.mode !== "120000") continue;
+				const text = blobs.get(entry.oid);
+				if (text === void 0) throw new Error("Missing tracked symlink");
+				const target = node_path.default.posix.normalize(node_path.default.posix.join(node_path.default.posix.dirname(file), text));
+				if (node_path.default.posix.isAbsolute(text) || target === ".." || target.startsWith("../")) throw new Error("Toolchain symlink leaves the tracked tree");
+				required.add(target);
+			}
+			if (![...required].some((file) => !entries.has(file))) {
+				const snapshot = {
+					entries,
+					blobs
+				};
+				for (const file of selectorFiles(snapshot).keys()) required.add(file);
+				for (const patch of compilerPatches(snapshot)) if (patch.reference !== void 0) {
+					required.add(patch.reference);
+					requiredPatches.add(patch.reference);
+				}
+			}
+			for (const file of required) {
+				if (entries.has(file)) continue;
+				const entry = tree.get(file);
+				if (!entry) throw new Error(requiredPatches.has(file) ? `Missing tracked compiler patch: ${file}` : `Missing tracked toolchain selector file: ${file}`);
+				entries.set(file, entry);
+				expanded = true;
+			}
+		}
+		if (!expanded) return selected.map((entries) => ({
+			entries,
+			blobs
+		}));
+	}
+};
+const stableJson = (value) => {
+	if (Array.isArray(value)) return JSON.stringify(value.map(stableJson));
+	if (changedRecord(value)) return JSON.stringify(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, stableJson(item)]));
+	if (value === void 0) return "undefined";
+	return JSON.stringify(value);
+};
+const inventory = () => ({
+	bun: /* @__PURE__ */ new Set(),
+	node: /* @__PURE__ */ new Set(),
+	typescript: /* @__PURE__ */ new Set(),
+	oxlint: /* @__PURE__ */ new Set(),
+	"oxlint-tsgolint": /* @__PURE__ */ new Set(),
+	shared: /* @__PURE__ */ new Set()
+});
+const installedFields = [
+	"dependencies",
+	"devDependencies",
+	"optionalDependencies"
+];
+const exactBun = (value) => stableVersion(value);
+const nonRegistryResolution = (specifier) => /^(?:link:|workspace:|file:|portal:|catalog:|git:|github:|gitlab:|bitbucket:|git\+|https?:|ssh:|git@)/i.test(specifier);
+const packageTarget = ({ name, specifier }) => {
+	if (!specifier.startsWith("npm:")) return name;
+	const target = /^npm:((?:@[^/@\s]+\/)?[^/@\s]+)(?:@.*)?$/.exec(specifier)?.[1];
+	if (target === void 0) throw new Error("Unclassifiable npm alias declaration");
+	return target;
+};
+/** Importers contain resolved descriptors, not declarations; classify protocols first. */
+const importerRegistryName = ({ dependency, version }) => {
+	if (nonRegistryResolution(version)) return dependency;
+	if (version.startsWith("npm:")) return packageTarget({
+		name: dependency,
+		specifier: version
+	});
+	const descriptor = version.split("(").at(0) ?? "";
+	return /^((?:@[^/@\s]+\/)?[^/@\s]+)@/.exec(descriptor)?.[1];
+};
+const directoryDepth = (directory) => directory.split("/").filter((part) => part !== "." && part !== "").length;
+const isAncestor = (directory, child) => {
+	const relative = node_path.default.posix.relative(directory, child);
+	return relative !== ".." && !relative.startsWith("../") && !node_path.default.posix.isAbsolute(relative);
+};
+const boundResolution = ({ lockFile, lock, file, manifest, dependency, name }) => {
+	const directory = node_path.default.posix.relative(node_path.default.posix.dirname(lockFile), node_path.default.posix.dirname(file)) || ".";
+	const importerVersion = lock.importers[directory]?.[dependency];
+	const importerName = node_path.default.posix.basename(lockFile) === "pnpm-lock.yaml" && importerVersion !== void 0 ? importerRegistryName({
+		dependency,
+		version: importerVersion
+	}) : void 0;
+	const candidates = lock.resolutions.filter((item) => item.name === (importerName ?? name) || item.dependency === dependency);
+	if (node_path.default.posix.basename(lockFile) === "pnpm-lock.yaml") {
+		const value = lock.importers[directory]?.[dependency];
+		if (value === void 0) throw new Error(`Missing resolved importer: ${file}:${dependency}`);
+		const descriptor = value.replace(/^npm:/, "");
+		const resolvedVersion = (descriptor.startsWith(`${importerName ?? name}@`) ? descriptor.slice((importerName ?? name).length + 1) : descriptor).split("(").at(0);
+		const matched = candidates.filter((item) => item.version === resolvedVersion);
+		if (new Set(matched.map((item) => `${item.name}@${item.version}`)).size === 1) return matched;
+		throw new Error(`Ambiguous resolved importer: ${file}:${dependency}`);
+	}
+	if (node_path.default.posix.basename(lockFile) === "yarn.lock") {
+		const declarations = installedFields.flatMap((field) => {
+			const source = manifest[field];
+			return changedRecord(source) && typeof source[dependency] === "string" ? [source[dependency]] : [];
+		});
+		const declaredSelectors = new Set(declarations.flatMap((specifier) => [`${dependency}@${specifier}`, `${dependency}@npm:${specifier}`].flatMap(changedYarnSelectors)));
+		const matched = candidates.filter((item) => changedYarnSelectors(item.location).some((selector) => declaredSelectors.has(selector)));
+		if (matched.length > 0) return matched;
+		throw new Error(`Missing resolved Yarn compiler declaration: ${file}:${dependency}`);
+	}
+	const locations = [];
+	if (node_path.default.posix.basename(lockFile) === "bun.lock") {
+		if (directory !== "." && typeof manifest["name"] !== "string" && candidates.length > 1) throw new Error(`Ambiguous Bun workspace resolution: ${file}:${dependency}`);
+		if (directory !== "." && typeof manifest["name"] === "string") locations.push(`${manifest["name"]}/${dependency}`);
+		locations.push(dependency);
+	} else {
+		let current = directory;
+		for (;;) {
+			locations.push(node_path.default.posix.join(current, "node_modules", dependency));
+			if (current === ".") break;
+			current = node_path.default.posix.dirname(current);
+		}
+	}
+	for (const location of locations) {
+		const matched = candidates.filter((item) => item.location === location);
+		if (matched.length === 1) return matched;
+		if (matched.length > 1) throw new Error(`Ambiguous lock location: ${file}:${dependency}`);
+	}
+	throw new Error(`Missing resolved toolchain dependency: ${file}:${dependency}`);
+};
+const stableVersion = (value) => {
+	if (typeof value !== "string") throw new Error("Runtime selector is not an exact stable version");
+	const version = value.trim().replace(/^v/, "");
+	if (!/^\d+\.\d+\.\d+$/.test(version) || (0, semver.valid)(version) !== version) throw new Error("Runtime selector is not an exact stable version");
+	return version;
+};
+const setupRuntimeVersion = (value) => {
+	if (typeof value !== "string" && typeof value !== "number") throw new Error("Unclassifiable setup runtime selector");
+	const selector = String(value).trim();
+	return stableVersion(selector);
+};
+const setupRuntimeFileVersion = ({ snapshot, file, runtime }) => {
+	const text = snapshotText({
+		snapshot,
+		file
+	}).trim();
+	if (runtime === "bun" && file.endsWith(".json")) {
+		const manifest = require_jsonc.parseJsonc(text);
+		const manager = changedRecord(manifest) ? manifest["packageManager"] : void 0;
+		if (typeof manager !== "string" || !manager.startsWith("bun@")) throw new Error("Bun selector manifest lacks an exact Bun packageManager");
+		return stableVersion(manager.slice(4));
+	}
+	if (runtime === "go" && node_path.default.posix.basename(file) === "go.mod") {
+		const goLines = text.split(/\r?\n/).filter((line) => /^\s*go\b/.test(line));
+		const toolchainLines = text.split(/\r?\n/).filter((line) => /^\s*toolchain\b/.test(line));
+		if (goLines.length !== 1 || toolchainLines.length > 1) throw new Error("Unclassifiable Go runtime directives");
+		const version = /^\s*go\s+(\S+)\s*(?:\/\/.*)?$/.exec(goLines.at(0) ?? "")?.[1];
+		const go = stableVersion(version);
+		if (toolchainLines.length === 0) return go;
+		const toolchain = /^\s*toolchain\s+(\S+)\s*(?:\/\/.*)?$/.exec(toolchainLines.at(0) ?? "")?.[1];
+		if (toolchain === void 0) throw new Error("Unclassifiable Go toolchain directive");
+		if (!toolchain.startsWith("go")) throw new Error("Unclassifiable Go toolchain directive");
+		return stableVersion(toolchain.slice(2));
+	}
+	if (file.endsWith(".toml")) {
+		const value = (0, smol_toml.parse)(text);
+		if (!changedRecord(value)) throw new Error("Unclassifiable setup runtime TOML");
+		if (runtime === "rust" && changedRecord(value["toolchain"])) return setupRuntimeVersion(value["toolchain"]["channel"]);
+		if (runtime === "python") return setupRuntimeVersion(value["python-version"]);
+		throw new Error("Unclassifiable setup runtime TOML");
+	}
+	return setupRuntimeVersion(text);
+};
+const setupRuntimeVersions = (snapshot) => {
+	const versions = [];
+	const step = (value, file, checkouts) => {
+		if (!changedRecord(value) || typeof value["uses"] !== "string") return;
+		const action = value["uses"].split("@").at(0)?.toLowerCase();
+		let runtime = /(?:^|\/)setup-([^/]+)$/.exec(action ?? "")?.[1];
+		const wrapped = [
+			"bun",
+			"node",
+			"python",
+			"go",
+			"java"
+		].find((candidate) => runtime?.startsWith(`${candidate}-`));
+		if (wrapped !== void 0) runtime = wrapped;
+		if (action === "dtolnay/rust-toolchain") runtime = "rust";
+		if (runtime === void 0) return;
+		const raw = value["with"];
+		if (!changedRecord(raw)) throw new Error(`Missing setup runtime selector: ${file}:${runtime}`);
+		const inputs = /* @__PURE__ */ new Map();
+		for (const [key, input] of Object.entries(raw)) {
+			const folded = key.toLowerCase();
+			if (inputs.has(folded)) throw new Error(`Duplicate setup input: ${file}:${folded}`);
+			inputs.set(folded, input);
+		}
+		let selected = false;
+		for (const [key, input] of inputs) {
+			if (!/(?:^|-)version(?:-file)?$/.test(key) && ![
+				"toolchain",
+				"toolchain-file",
+				"rust-toolchain-file"
+			].includes(key)) continue;
+			if ([
+				"bun",
+				"node",
+				"python",
+				"go",
+				"java"
+			].includes(runtime)) {
+				if (key === `${runtime}-version` || key === `${runtime}-version-file`) selected = true;
+			} else if (runtime === "rust") {
+				if ([
+					"toolchain",
+					"toolchain-file",
+					"rust-toolchain-file",
+					"rust-version",
+					"rust-version-file"
+				].includes(key)) selected = true;
+			} else if (key === "version" || key === "version-file" || key === `${runtime}-version` || key === `${runtime}-version-file`) selected = true;
+			const inputRuntime = [
+				"bun",
+				"node",
+				"python",
+				"go",
+				"java",
+				"rust"
+			].find((candidate) => key.startsWith(`${candidate}-`)) ?? runtime;
+			let version;
+			if (key.endsWith("-file")) {
+				if (typeof input !== "string" || input.trim() === "" || input.includes("${{")) throw new Error("Unclassifiable setup version-file declaration");
+				version = setupRuntimeFileVersion({
+					snapshot,
+					file: resolveCheckoutSelector(input, checkouts),
+					runtime: inputRuntime
+				});
+			} else version = setupRuntimeVersion(input);
+			versions.push({
+				file,
+				runtime: inputRuntime,
+				version
+			});
+		}
+		if (!selected) throw new Error(`Missing setup runtime selector: ${file}:${runtime}`);
+	};
+	const visit = (value, file) => {
+		if (Array.isArray(value)) {
+			for (const entry of value) visit(entry, file);
+			return;
+		}
+		if (!changedRecord(value)) return;
+		for (const [key, entry] of Object.entries(value)) if (key === "steps" && Array.isArray(entry)) visitStepsInOrder(entry, /* @__PURE__ */ new Map(), (child, checkouts) => step(child, file, checkouts));
+		else visit(entry, file);
+	};
+	for (const file of snapshot.entries.keys()) {
+		if (require_toolchain_inputs.githubAutomationFileKind(file) === void 0) continue;
+		const document = (0, yaml.parseDocument)(snapshotText({
+			snapshot,
+			file
+		}));
+		if (document.errors.length > 0) throw new Error("Unreadable workflow declaration");
+		visit(document.toJS({ maxAliasCount: 100 }), file);
+	}
+	return versions;
+};
+const stableBunImageVersion = (image) => {
+	const match = /^oven\/bun(?::([^@]+))?(?:@[^\s]+)?$/.exec(image);
+	if (match === null) return void 0;
+	const version = match[1]?.replace(/-(?:alpine|slim|debian|distroless)$/, "");
+	return stableVersion(version);
+};
+const assertLiteralDockerImages = (text) => {
+	const defaults = /* @__PURE__ */ new Map();
+	for (const line of text.replace(/\\\r?\n/g, " ").split(/\r?\n/)) {
+		const arg = /^\s*ARG\s+([A-Za-z_]\w*)(?:=(\S+))?\s*(?:#.*)?$/i.exec(line);
+		if (arg?.[1]) {
+			const value = arg[2];
+			if (value !== void 0 && /^[A-Za-z0-9_.:/@+-]+$/.test(value)) defaults.set(arg[1], value);
+			else defaults.delete(arg[1]);
+		}
+		const image = /^\s*FROM\s+(?:--[^\s]+\s+)*(\S+)/i.exec(line)?.[1];
+		if (image === void 0) continue;
+		const expanded = image.replace(/\$\{([A-Za-z_]\w*)\}|\$([A-Za-z_]\w*)/g, (original, braced, plain) => defaults.get(braced ?? plain ?? "") ?? original);
+		if (expanded.includes("$")) throw new Error("Unclassifiable Docker image selector");
+		stableBunImageVersion(expanded);
+	}
+};
+const parseSnapshot = (snapshot) => {
+	const tools = inventory();
+	const bunVersions = /* @__PURE__ */ new Set();
+	const bunRanges = [];
+	const manifests = /* @__PURE__ */ new Map();
+	const locks = /* @__PURE__ */ new Map();
+	const workspacePatterns = /* @__PURE__ */ new Map();
+	const typescript = /* @__PURE__ */ new Set();
+	const selectedFiles = selectorFiles(snapshot);
+	for (const { file, runtime, version } of setupRuntimeVersions(snapshot)) {
+		let tool = "shared";
+		if (runtime === "bun") tool = "bun";
+		else if (runtime === "node") tool = "node";
+		tools[tool].add(`setup-runtime:${file}:${runtime}:${version}`);
+	}
+	const compilerNames = compilerInstallationNames(snapshot);
+	for (const patch of compilerPatches(snapshot)) {
+		tools.typescript.add(`compiler-patch:${patch.file}:${patch.name}:${stableJson(patch.metadata)}`);
+		if (patch.reference !== void 0) tools.typescript.add(`compiler-patch-source:${patch.reference}:${snapshotText({
+			snapshot,
+			file: patch.reference
+		})}`);
+	}
+	const addBun = (value) => {
+		const version = exactBun(value);
+		bunVersions.add(version);
+		tools.bun.add(version);
+	};
+	const catalogs = (file, value) => {
+		for (const field of ["catalog", "catalogs"]) {
+			if (value[field] === void 0) continue;
+			tools.shared.add(`${file}:${field}:${stableJson(value[field])}`);
+			const visit = (entry, at) => {
+				if (!changedRecord(entry)) return;
+				for (const [name, specifier] of Object.entries(entry)) {
+					const target = typeof specifier === "string" ? packageTarget({
+						name,
+						specifier
+					}) : name;
+					if (changedPackageTool(target) === "typescript") tools.typescript.add(`${file}:${at}:${name}:${stableJson(specifier)}`);
+					visit(specifier, `${at}:${name}`);
+				}
+			};
+			visit(value[field], field);
+		}
+	};
+	for (const file of snapshot.entries.keys()) {
+		const text = snapshotText({
+			snapshot,
+			file
+		});
+		const name = node_path.default.posix.basename(file);
+		if (compilerPatchPackageFile(file, compilerNames)) tools.typescript.add(`patch-package:${file}:${text}`);
+		for (const tool of selectedFiles.get(file) ?? []) tools[tool].add(`selector-file:${file}:${text}`);
+		if (name === "package.json") {
+			const manifest = require_jsonc.parseJsonc(text);
+			if (!changedRecord(manifest)) throw new Error(`Invalid tracked manifest: ${file}`);
+			if (typeof manifest["name"] === "string" && changedPackageTool(manifest["name"]) === "typescript") throw new Error(`Tracked compiler source has no immutable artifact identity: ${file}`);
+			manifests.set(file, manifest);
+			catalogs(file, manifest);
+			if (changedRecord(manifest["workspaces"])) catalogs(`${file}:workspaces`, manifest["workspaces"]);
+		} else if (name === ".npmrc") for (const line of text.split(/\r?\n/)) {
+			if (!/^\s*(?:use-node-version|node-version)\s*=/i.test(line)) continue;
+			if (/\$\{/.test(line)) throw new Error("Unclassifiable npm Node selector");
+			const selector = /^\s*(?:use-node-version|node-version)\s*=\s*(.*?)\s*$/i.exec(line)?.[1];
+			tools.node.add(`${file}:${stableVersion(selector)}`);
+		}
+		else if (name === "pnpm-workspace.yaml") {
+			const document = (0, yaml.parseDocument)(text);
+			if (document.errors.length > 0) throw new Error("Invalid pnpm workspace YAML");
+			const workspace = document.toJS({ maxAliasCount: 100 });
+			if (!changedRecord(workspace)) throw new Error("Invalid pnpm workspace configuration");
+			workspacePatterns.set(node_path.default.posix.dirname(file), workspace["packages"]);
+			catalogs(file, workspace);
+			for (const key of ["useNodeVersion", "nodeVersion"]) if (workspace[key] !== void 0) tools.node.add(`${file}:${key}:${stableVersion(workspace[key])}`);
+		} else if ([
+			"bun.lock",
+			"pnpm-lock.yaml",
+			"package-lock.json",
+			"npm-shrinkwrap.json",
+			"yarn.lock"
+		].includes(name)) locks.set(file, parseChangedLock({
+			file,
+			text
+		}));
+		else if (name === "bun.lockb") {
+			if (!snapshot.entries.has(node_path.default.posix.join(node_path.default.posix.dirname(file), "bun.lock"))) throw new Error("Binary Bun lockfile cannot be resolved without executing Bun");
+		} else if (name === ".bun-version") addBun(text.trim());
+		else if (otherRuntimeFiles.has(name)) tools.shared.add(`${file}:${text}`);
+		else if (name === ".node-version" || name === ".nvmrc") tools.node.add(`${file}:${stableVersion(text)}`);
+		else if (name === "toolchain.json") {
+			const policy = require_jsonc.parseJsonc(text);
+			if (!changedRecord(policy)) throw new Error("Invalid shared toolchain policy");
+			tools.shared.add(`${file}:${stableJson(policy)}`);
+			if (typeof policy["bun"] === "string") addBun(policy["bun"]);
+		} else if (name === ".tool-versions") {
+			tools.bun.add(`${file}:${text}`);
+			tools.typescript.add(`${file}:${text}`);
+			for (const line of text.split(/\r?\n/)) {
+				const [tool, ...versions] = line.trim().split(/\s+/);
+				const value = versions.join(" ").split("#")[0]?.trim();
+				if (tool === "bun" && value) addBun(value);
+				if (tool === "node" || tool === "nodejs") tools.node.add(`${file}:${stableVersion(value)}`);
+			}
+		} else if (require_toolchain_inputs.isMiseConfigPath(file)) {
+			tools.bun.add(`${file}:${text}`);
+			tools.typescript.add(`${file}:${text}`);
+			const parsed = (0, smol_toml.parse)(text);
+			if (changedRecord(parsed) && changedRecord(parsed["tools"])) for (const [tool, selector] of Object.entries(parsed["tools"])) {
+				const value = changedRecord(selector) ? selector["version"] : selector;
+				const values = Array.isArray(value) ? value : [value];
+				if (tool === "bun" || tool === "core:bun") for (const version of values) {
+					if (typeof version !== "string") throw new Error("Unresolved mise Bun selector");
+					addBun(version);
+				}
+				if ([
+					"node",
+					"nodejs",
+					"core:node"
+				].includes(tool)) {
+					if (values.length === 0) throw new Error("Unresolved mise Node selector");
+					for (const version of values) tools.node.add(`${file}:${stableVersion(version)}`);
+				}
+			}
+		} else if (require_toolchain_inputs.githubAutomationFileKind(file) !== void 0) {
+			tools.shared.add(`${file}:${text}`);
+			tools.bun.add(`${file}:${text}`);
+			tools.typescript.add(`${file}:${text}`);
+		} else if (require_toolchain_inputs.isDockerDefinitionPath(file)) {
+			assertLiteralDockerImages(text);
+			tools.shared.add(`${file}:${text}`);
+			tools.node.add(`${file}:${text}`);
+			tools.bun.add(`${file}:${text}`);
+			tools.typescript.add(`${file}:${text}`);
+			for (const match of text.matchAll(/^\s*FROM\s+(?:--[^\s]+\s+)*oven\/bun:([\w.+-]+)/gim)) {
+				const tag = match[1];
+				if (tag !== void 0) {
+					const version = stableBunImageVersion(`oven/bun:${tag}`);
+					if (version !== void 0) addBun(version);
+				}
+			}
+		} else if (containerDefinition(file)) for (const document of (0, yaml.parseAllDocuments)(text)) {
+			if (document.errors.length > 0) {
+				if (require_toolchain_inputs.isComposeDefinitionPath(file) || /(?:^|\n)\s*(?:apiVersion|kind)\s*:/.test(text)) throw new Error(`Unreadable container declaration: ${file}`);
+				continue;
+			}
+			const value = document.toJS({ maxAliasCount: 100 });
+			const container = require_toolchain_inputs.containerDocumentImages(value, file);
+			if (container === void 0) {
+				if (require_toolchain_inputs.isComposeDefinitionPath(file)) throw new Error(`Unclassifiable Compose declaration: ${file}`);
+				continue;
+			}
+			for (const { image } of container.images) {
+				if (typeof image !== "string" || image.includes("$")) throw new Error(`Unclassifiable container image selector: ${file}`);
+				stableBunImageVersion(image);
+			}
+			for (const tool of [
+				"bun",
+				"node",
+				"typescript",
+				"shared"
+			]) tools[tool].add(`${file}:${text}`);
+		}
+	}
+	const activeManifest = (file) => {
+		if (file === "package.json") return true;
+		const directory = node_path.default.posix.dirname(file);
+		if ([
+			"bun.lock",
+			"pnpm-lock.yaml",
+			"package-lock.json",
+			"npm-shrinkwrap.json",
+			"yarn.lock"
+		].some((name) => locks.has(node_path.default.posix.join(directory, name)))) return true;
+		const owners = [...manifests].filter(([ownerFile, owner]) => owner["workspaces"] !== void 0 && isAncestor(node_path.default.posix.dirname(ownerFile), directory)).map(([ownerFile, owner]) => ({
+			directory: node_path.default.posix.dirname(ownerFile),
+			patterns: changedRecord(owner["workspaces"]) ? owner["workspaces"]["packages"] : owner["workspaces"]
+		}));
+		const pnpmOwner = [...workspacePatterns].filter(([ownerDirectory]) => isAncestor(ownerDirectory, directory)).sort(([a], [b]) => directoryDepth(b) - directoryDepth(a)).at(0);
+		if (pnpmOwner) return require_toolchain_inputs.workspaceContains({
+			directory: pnpmOwner[0],
+			file,
+			patterns: pnpmOwner[1],
+			rootMembership: "implicit"
+		});
+		const owner = owners.sort((a, b) => directoryDepth(b.directory) - directoryDepth(a.directory)).at(0);
+		if (owner) return require_toolchain_inputs.workspaceContains({
+			directory: owner.directory,
+			file,
+			patterns: owner.patterns,
+			rootMembership: "implicit"
+		});
+		for (const [lockFile, lock] of locks) {
+			const relative = node_path.default.posix.relative(node_path.default.posix.dirname(lockFile), directory) || ".";
+			if (Object.hasOwn(lock.importers, relative)) return true;
+		}
+		return false;
+	};
+	for (const [file, manifest] of manifests) {
+		const active = activeManifest(file);
+		const manager = manifest["packageManager"];
+		if (manager !== void 0) {
+			if (typeof manager !== "string") throw new Error(`Unclassifiable package manager: ${file}`);
+			if (manager.startsWith("bun@")) addBun(manager.slice(4));
+			else tools.shared.add(`${file}:packageManager:${manager}`);
+		}
+		for (const field of ["volta", "devEngines"]) {
+			if (manifest[field] === void 0) continue;
+			for (const tool of [
+				"bun",
+				"node",
+				"typescript",
+				"shared"
+			]) tools[tool].add(`${file}:${field}:${stableJson(manifest[field])}`);
+		}
+		const engines = manifest["engines"];
+		if (changedRecord(engines)) {
+			if (typeof engines["node"] === "string") tools.node.add(`${file}:${engines["node"]}`);
+			if (typeof engines["bun"] === "string") {
+				if (!(0, semver.validRange)(engines["bun"])) throw new Error("Invalid Bun engine selector");
+				bunRanges.push(engines["bun"]);
+				tools.bun.add(`${file}:engines.bun:${engines["bun"]}`);
+				if ((0, semver.valid)(engines["bun"]) !== null) addBun(engines["bun"]);
+			}
+		}
+		for (const field of active ? ["peerDependencies"] : [...installedFields, "peerDependencies"]) {
+			const declarations = manifest[field];
+			if (declarations === void 0) continue;
+			if (!changedRecord(declarations)) throw new Error(`Invalid toolchain declarations: ${file}:${field}`);
+			for (const [dependency, specifier] of Object.entries(declarations)) {
+				if (typeof specifier !== "string") throw new Error(`Unclassifiable toolchain declaration: ${file}:${dependency}`);
+				const tool = changedPackageTool(packageTarget({
+					name: dependency,
+					specifier
+				})) ?? changedPackageTool(dependency) ?? (compilerNames.has(dependency) ? "typescript" : void 0);
+				if (tool !== void 0) tools[tool].add(`${file}:${field}:${dependency}:${specifier}`);
+			}
+		}
+		if (!active) continue;
+		const ownName = manifest["name"];
+		const ownVersion = manifest["version"];
+		if (typeof ownName === "string" && changedPackageTool(ownName) === "shared" && typeof ownVersion === "string") tools.shared.add(`${ownName}@${ownVersion}`);
+		for (const field of installedFields) {
+			const dependencies = manifest[field];
+			if (dependencies === void 0) continue;
+			if (!changedRecord(dependencies)) throw new Error(`Invalid manifest dependency table: ${file}`);
+			for (const [dependency, specifier] of Object.entries(dependencies)) {
+				if (typeof specifier !== "string") throw new Error(`Invalid dependency specifier: ${file}`);
+				const declaredTarget = packageTarget({
+					name: dependency,
+					specifier
+				});
+				if (changedPackageTool(declaredTarget) === void 0 && changedPackageTool(dependency) === void 0 && !compilerNames.has(dependency)) continue;
+				const effectiveSpecifier = effectiveCatalogSpecifier({
+					snapshot,
+					file,
+					dependency,
+					specifier
+				});
+				const name = packageTarget({
+					name: dependency,
+					specifier: effectiveSpecifier
+				});
+				const tool = changedPackageTool(name) ?? changedPackageTool(dependency) ?? (compilerNames.has(dependency) ? "typescript" : void 0);
+				if (tool === void 0) continue;
+				const sourceSpecifier = effectiveSpecifier.startsWith("npm:") ? effectiveSpecifier.slice(4 + name.length + 1) : effectiveSpecifier;
+				if (tool === "typescript" && (/^(?:link:|portal:|workspace:)/i.test(sourceSpecifier) || /^(?:file:|\.{1,2}\/|\/)/i.test(sourceSpecifier) && !/\.(?:tgz|tar\.gz)(?:[?#].*)?$/i.test(sourceSpecifier))) throw new Error(`Compiler source has no immutable identity: ${file}:${dependency}`);
+				if (tool === "typescript") tools.typescript.add(`${file}:${field}:${dependency}:specifier:${specifier}`);
+				const candidates = [...locks].filter(([lockFile]) => {
+					const relative = node_path.default.posix.relative(node_path.default.posix.dirname(lockFile), node_path.default.posix.dirname(file));
+					return relative !== ".." && !relative.startsWith("../");
+				}).sort(([a], [b]) => directoryDepth(node_path.default.posix.dirname(b)) - directoryDepth(node_path.default.posix.dirname(a)));
+				const nearest = candidates.at(0);
+				if (!nearest) throw new Error(`Missing toolchain lockfile: ${file}:${dependency}`);
+				const lockDirectory = node_path.default.posix.dirname(nearest[0]);
+				const ownerManager = [...manifests].filter(([ownerFile, ownerManifest]) => typeof ownerManifest["packageManager"] === "string" && isAncestor(node_path.default.posix.dirname(ownerFile), node_path.default.posix.dirname(file))).sort(([a], [b]) => directoryDepth(node_path.default.posix.dirname(b)) - directoryDepth(node_path.default.posix.dirname(a))).at(0)?.[1]["packageManager"];
+				const selectedLocks = candidates.filter(([candidate]) => node_path.default.posix.dirname(candidate) === lockDirectory).filter(([candidate]) => {
+					if (typeof ownerManager !== "string") return true;
+					const lockName = node_path.default.posix.basename(candidate);
+					if (ownerManager.startsWith("bun@")) return lockName === "bun.lock";
+					if (ownerManager.startsWith("pnpm@")) return lockName === "pnpm-lock.yaml";
+					if (ownerManager.startsWith("yarn@")) return lockName === "yarn.lock";
+					if (ownerManager.startsWith("npm@")) return lockName === "package-lock.json" || lockName === "npm-shrinkwrap.json";
+					return false;
+				});
+				const selected = selectedLocks.at(0);
+				if (selectedLocks.length !== 1 || !selected) throw new Error(`Ambiguous or missing effective lockfile: ${file}:${dependency}`);
+				const [lockFile, lock] = selected;
+				const resolved = boundResolution({
+					lockFile,
+					lock,
+					file,
+					manifest,
+					dependency,
+					name
+				});
+				if (tool === "typescript" && resolved.some((item) => item.name !== name)) throw new Error(`Compiler lock name does not match effective declaration: ${file}:${dependency}`);
+				if (tool === "typescript" && nonRegistryResolution(sourceSpecifier) && resolved.some((item) => item.sourceProof.type !== "immutable")) throw new Error(`Compiler source has no immutable identity: ${file}:${dependency}`);
+				if (tool === "typescript" && /^(?:git(?:\+[^:]+)?:|github:|gitlab:|bitbucket:|ssh:|git@)/i.test(sourceSpecifier) && resolved.some((item) => !/(?:git(?:\+[^:]+)?:|github:|gitlab:|bitbucket:|ssh:|git@|\.git(?:#|["\\]))/i.test(item.identity))) throw new Error(`Compiler Git source has no matching immutable identity: ${file}:${dependency}`);
+				const range = effectiveSpecifier.startsWith("npm:") ? effectiveSpecifier.slice(effectiveSpecifier.lastIndexOf("@") + 1) : effectiveSpecifier;
+				const resolvedVersion = (version) => version.startsWith("workspace:") ? manifests.get(node_path.default.posix.join(lockDirectory, version.slice(10), "package.json"))?.["version"] : version;
+				if ((0, semver.validRange)(range) && !resolved.some((item) => {
+					const version = resolvedVersion(item.version);
+					return typeof version === "string" && (0, semver.valid)(version) !== null && (0, semver.satisfies)(version, range);
+				})) throw new Error(`Toolchain lock resolution does not satisfy manifest: ${file}:${dependency}`);
+				for (const item of resolved) tools[tool].add(`${file}:${dependency}=>${item.location}:${item.name}@${item.version}:${item.identity}`);
+			}
+		}
+	}
+	for (const [lockFile, lock] of locks) {
+		for (const item of lock.resolutions) {
+			tools[item.tool].add(`${lockFile}:${item.location}:${item.dependency}=>${item.name}@${item.version}:${item.identity}`);
+			if (item.tool === "typescript") typescript.add(`${item.name}@${item.version}`);
+		}
+		if (node_path.default.posix.basename(lockFile) !== "pnpm-lock.yaml") continue;
+		for (const [directory, dependencies] of Object.entries(lock.importers)) for (const [dependency, version] of Object.entries(dependencies)) {
+			const namedTool = changedPackageTool(dependency);
+			const nonRegistry = nonRegistryResolution(version);
+			const registryName = importerRegistryName({
+				dependency,
+				version
+			});
+			const tool = (registryName === void 0 ? void 0 : changedPackageTool(registryName)) ?? namedTool ?? (nonRegistry ? void 0 : lock.resolutions.find((item) => item.dependency === dependency)?.tool);
+			if (tool !== void 0) tools[tool].add(`${lockFile}:importer:${directory}:${dependency}:${version}`);
+		}
+	}
+	if (bunVersions.size > 1) throw new Error("Conflicting Bun runtime versions in tracked declarations");
+	const bun = [...bunVersions].sort();
+	if (bunRanges.length > 0 && bun.length === 0) throw new Error("Bun engine range has no exact runtime declaration");
+	for (const range of bunRanges) if (!bun.every((version) => (0, semver.satisfies)(version, range))) throw new Error("Bun runtime does not satisfy tracked engine range");
+	return {
+		tools,
+		current: {
+			bun,
+			typescript: [...typescript].sort()
+		}
+	};
+};
+const detectToolchainChanges = async ({ repo, since }) => {
+	try {
+		const refs = await Promise.all([since, "HEAD"].map(async (ref) => {
+			const { stdout } = await git("git", [
+				"rev-parse",
+				"--verify",
+				"--end-of-options",
+				`${ref}^{commit}`
+			], {
+				cwd: repo,
+				encoding: "utf8"
+			});
+			const oid = stdout.trim();
+			if (!/^[a-f0-9]{40,64}$/.test(oid)) throw new Error("Invalid Git commit response");
+			return oid;
+		}));
+		const previousRef = refs.at(0);
+		const currentRef = refs.at(1);
+		if (!previousRef || !currentRef) throw new Error("Missing Git comparison snapshot");
+		const [previousEntries, currentEntries] = await Promise.all([readTree({
+			repo,
+			ref: previousRef
+		}), readTree({
+			repo,
+			ref: currentRef
+		})]);
+		const snapshots = await readSnapshots({
+			repo,
+			trees: [previousEntries, currentEntries]
+		});
+		const previousSnapshot = snapshots.at(0);
+		const currentSnapshot = snapshots.at(1);
+		if (!previousSnapshot || !currentSnapshot) throw new Error("Missing toolchain snapshot");
+		const previous = parseSnapshot(previousSnapshot);
+		const current = parseSnapshot(currentSnapshot);
+		const tools = toolchainChangedTools.filter((tool) => stableJson([...previous.tools[tool]].sort()) !== stableJson([...current.tools[tool]].sort()));
+		return {
+			status: "compared",
+			changed: tools.length > 0,
+			tools,
+			current: current.current
+		};
+	} catch (error) {
+		return {
+			status: "unreadable",
+			changed: true,
+			tools: [...toolchainChangedTools],
+			error: error instanceof Error ? error.message : "Unreadable toolchain Git snapshot"
+		};
+	}
+};
+//#endregion
 //#region src/toolchain-changed-args.ts
 const changedUsage = "Usage: stll-toolchain-changed --since <git-ref>\n       stll-toolchain-changed --help";
 const parseChangedArguments = (args) => {
@@ -20,7 +1495,7 @@ const main = async () => {
 		process.stdout.write(`${changedUsage}\n`);
 		return;
 	}
-	process.stdout.write(`${JSON.stringify(await require_toolchain_changed.detectToolchainChanges({
+	process.stdout.write(`${JSON.stringify(await detectToolchainChanges({
 		repo: process.cwd(),
 		since: args.since
 	}))}\n`);