@stll/oxlint-config 3.0.0 → 3.2.0

package/dist/toolchain-guard.mjs

@@ -13,6 +13,8 @@ import { execFileSync, spawnSync } from "node:child_process";
 import { gte, minVersion, satisfies, valid, validRange } from "semver";
 import { LineCounter, isAlias, isMap, isNode, isScalar, isSeq, parseAllDocuments, parseDocument } from "yaml";
 import { pathToFileURL } from "node:url";
+import { parse as parse$3 } from "acorn";
+import { transformSync } from "esbuild";
 //#region src/toolchain-bun.ts
 const STABLE_RELEASE = /^\d+\.\d+\.\d+$/u;
 /**
@@ -31,9 +33,9 @@ const repositoryBun = (floor, manifest) => {
 };
 //#endregion
 //#region src/toolchain-consumer-checks.ts
-const consumerRunnerVersion = "3.0.0";
+const consumerRunnerVersion = "3.2.0";
 const consumerCheckWorkflow = "stella/.github/.github/workflows/package-consumer-compat.yml";
-const record$10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$11 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryDirectory = (value) => typeof value === "string" && value !== "" && !value.includes("\\") && !value.includes("${{") && !value.split("").some((character) => {
 	const code = character.charCodeAt(0);
 	return code < 32 || code === 127;
@@ -119,12 +121,12 @@ const validConsumerCron = (text) => {
 	});
 };
 const nightlySchedule = (value) => {
-	if (!record$10(value)) return false;
+	if (!record$11(value)) return false;
 	const schedule = value["schedule"];
 	if (!Array.isArray(schedule) || schedule.length === 0) return false;
 	const coveredDays = /* @__PURE__ */ new Set();
 	for (const entry of schedule) {
-		if (!record$10(entry) || typeof entry["cron"] !== "string" || !validConsumerCron(entry["cron"])) return false;
+		if (!record$11(entry) || typeof entry["cron"] !== "string" || !validConsumerCron(entry["cron"])) return false;
 		const fields = entry["cron"].trim().split(/\s+/);
 		const selections = cronFields.map((field, index) => {
 			const text = fields.at(index);
@@ -140,7 +142,7 @@ const parseConsumerChecks = (input) => {
 	if (!Array.isArray(input)) throw new Error("consumerChecks must be an array");
 	const targets = /* @__PURE__ */ new Set();
 	return input.map((entry) => {
-		if (!record$10(entry) || Object.keys(entry).some((key) => ![
+		if (!record$11(entry) || Object.keys(entry).some((key) => ![
 			"workflow",
 			"job",
 			"packages",
@@ -178,9 +180,9 @@ const checkConsumerChecks = ({ declarations, files, policy }) => {
 			});
 			if (document.errors.length > 0) throw new Error("invalid workflow YAML");
 			const source = document.toJS({ maxAliasCount: 100 });
-			if (!record$10(source) || !record$10(source["jobs"])) continue;
+			if (!record$11(source) || !record$11(source["jobs"])) continue;
 			for (const [jobName, job] of Object.entries(source["jobs"])) {
-				if (!record$10(job) || typeof job["uses"] !== "string") continue;
+				if (!record$11(job) || typeof job["uses"] !== "string") continue;
 				const [workflowPath, ref] = job["uses"].split("@");
 				if (workflowPath?.toLowerCase() !== "stella/.github/.github/workflows/package-consumer-compat.yml") continue;
 				const declaration = declarations.find((entry) => entry.workflow === workflow && entry.job === jobName);
@@ -194,7 +196,7 @@ const checkConsumerChecks = ({ declarations, files, policy }) => {
 				const approved = Object.entries(policy.actions).find(([name]) => name.toLowerCase() === consumerCheckWorkflow)?.[1];
 				if (job["uses"].split("@").length !== 2 || ref === void 0 || !/^[a-f0-9]{40}$/.test(ref) || approved === void 0 || ref !== approved.sha || "steps" in job || "runs-on" in job) throw new Error(`${workflow}:${jobName} must invoke the approved immutable consumer workflow as a reusable job`);
 				const inputs = job["with"];
-				if (!record$10(inputs)) throw new Error(`${workflow}:${jobName} requires consumer inputs`);
+				if (!record$11(inputs)) throw new Error(`${workflow}:${jobName} requires consumer inputs`);
 				const names = /* @__PURE__ */ new Set();
 				for (const key of Object.keys(inputs)) {
 					const normalized = key.toLowerCase();
@@ -264,7 +266,7 @@ const locatorValidators = {
 	"bun-source": /^(?:jobs\.[\w-]+|runs)\.steps\.[\w-]+$/
 };
 const knownKind = (value) => typeof value === "string" && Object.hasOwn(locatorValidators, value);
-const record$9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$10 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** One reviewed declaration identifies one unresolved selector, never a rule. */
 const parseDynamicSelectors = (input) => {
 	if (input === void 0) return [];
@@ -272,7 +274,7 @@ const parseDynamicSelectors = (input) => {
 	const result = [];
 	const keys = /* @__PURE__ */ new Set();
 	for (const entry of input) {
-		if (!record$9(entry) || Object.keys(entry).some((key) => ![
+		if (!record$10(entry) || Object.keys(entry).some((key) => ![
 			"path",
 			"kind",
 			"reason",
@@ -308,7 +310,7 @@ const parseDynamicSelectors = (input) => {
 };
 //#endregion
 //#region src/toolchain-engine-floors.ts
-const record$8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const repositoryPath = (value) => typeof value === "string" && value !== "" && !/^[A-Za-z]:/.test(value) && !/[\\\s]/.test(value) && !Array.from(value).some((character) => character.charCodeAt(0) < 32) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
 const parseEngineFloors = (input) => {
 	if (input === void 0) return [];
@@ -316,7 +318,7 @@ const parseEngineFloors = (input) => {
 	const result = [];
 	const jobs = /* @__PURE__ */ new Set();
 	for (const entry of input) {
-		if (!record$8(entry) || Object.keys(entry).some((key) => ![
+		if (!record$9(entry) || Object.keys(entry).some((key) => ![
 			"package",
 			"workflow",
 			"job"
@@ -337,16 +339,16 @@ const resolveEngineFloor = (entry, files) => {
 	const workflowText = files[entry.workflow];
 	if (manifestText === void 0 || workflowText === void 0) throw new Error("engine floor package and workflow must be tracked");
 	const manifest = JSON.parse(manifestText);
-	if (!record$8(manifest) || manifest["private"] === true || typeof manifest["name"] !== "string" || manifest["name"].trim() === "" || !record$8(manifest["engines"]) || typeof manifest["engines"]["node"] !== "string") throw new Error("engine floor package must be published and declare engines.node");
+	if (!record$9(manifest) || manifest["private"] === true || typeof manifest["name"] !== "string" || manifest["name"].trim() === "" || !record$9(manifest["engines"]) || typeof manifest["engines"]["node"] !== "string") throw new Error("engine floor package must be published and declare engines.node");
 	const range = manifest["engines"]["node"];
 	const minimum = validRange(range) === null ? null : minVersion(range);
 	if (minimum === null || minimum.prerelease.length !== 0) throw new Error("engine floor engines.node must declare a stable minimum");
 	const document = parseDocument(workflowText, { merge: true });
 	if (document.errors.length !== 0) throw new Error("engine floor workflow must be valid YAML");
 	const workflow = document.toJS({ maxAliasCount: 100 });
-	if (!record$8(workflow) || !record$8(workflow["jobs"])) throw new Error("engine floor job must exist in its tracked workflow");
+	if (!record$9(workflow) || !record$9(workflow["jobs"])) throw new Error("engine floor job must exist in its tracked workflow");
 	const job = workflow["jobs"][entry.job];
-	if (!record$8(job)) throw new Error("engine floor job must exist in its tracked workflow");
+	if (!record$9(job)) throw new Error("engine floor job must exist in its tracked workflow");
 	if (!Array.isArray(job["steps"]) || Object.hasOwn(job, "uses")) throw new Error("engine floor job must declare steps and cannot reuse a workflow");
 	return {
 		...entry,
@@ -359,6 +361,38 @@ const engineFloorSelectorMatches = (value, floor) => {
 	return Number(value.split(".").at(0)) === floor.major && satisfies(value, floor.range);
 };
 //#endregion
+//#region src/toolchain-typescript-source-api.ts
+const readSourceApiInput = ({ root, source, tracked }) => {
+	if (!tracked.has(source)) return void 0;
+	const resolvedRoot = realpathSync(root);
+	const input = path.resolve(resolvedRoot, source);
+	try {
+		if (realpathSync(input) !== input || !lstatSync(input).isFile()) return void 0;
+		return readFileSync(input, "utf8");
+	} catch {
+		return;
+	}
+};
+const sourceApiImportProblem = ({ source, content, name }) => {
+	if (content === void 0) return "must be a tracked, readable regular source file without symlinks";
+	try {
+		const { code } = transformSync(content, {
+			sourcefile: source,
+			loader: source.endsWith("x") ? "tsx" : "ts",
+			format: "esm",
+			tsconfigRaw: { compilerOptions: { verbatimModuleSyntax: true } },
+			logLevel: "silent"
+		});
+		if (parse$3(code, {
+			ecmaVersion: "latest",
+			sourceType: "module"
+		}).body.some((node) => node.type === "ImportDeclaration" && node.source.value === name && node.specifiers.length > 0)) return void 0;
+		return `no longer has a static value import from ${name}; remove the declaration or name its current importer`;
+	} catch {
+		return "cannot parse the declared compiler API importer";
+	}
+};
+//#endregion
 //#region src/toolchain-packages.ts
 const packageRules = [
 	"bun-pins",
@@ -376,7 +410,7 @@ const installSections = [
 	"optionalDependencies"
 ];
 const allowlistFile = "stll-toolchain.json";
-const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** `npm:typescript@7.0.2` installs a compiler under another name; returns its version. */
 const typescriptAliasVersion = (spec) => {
 	if (typeof spec !== "string") return void 0;
@@ -406,22 +440,44 @@ const parseTypescriptAllowlist = (input) => {
 	return input.map((entry) => {
 		const shown = JSON.stringify(entry);
 		const text = (key) => {
-			const value = record$7(entry) ? entry[key] : void 0;
+			const value = record$8(entry) ? entry[key] : void 0;
 			return typeof value === "string" && value.trim() !== "" ? value : void 0;
 		};
 		const workspace = text("workspace");
 		const name = text("name");
 		const spec = text("spec");
 		const dependency = text("dependency");
+		const sourceApi = record$8(entry) && entry["kind"] === "source-api";
+		const keys = sourceApi ? [
+			"workspace",
+			"name",
+			"spec",
+			"reason",
+			"kind",
+			"sources"
+		] : [...allowlistKeys, ...record$8(entry) && entry["kind"] === "dependency" ? ["kind"] : []];
 		const reason = text("reason");
-		if (!record$7(entry) || Object.keys(entry).length !== allowlistKeys.length || workspace === void 0 || name === void 0 || spec === void 0 || dependency === void 0 || reason === void 0) throw new Error(`typescriptAllowlist entry ${shown} must have exactly workspace, name, spec, dependency and reason as nonempty strings: ${allowlistFormat}`);
+		if (!record$8(entry) || Object.keys(entry).length !== keys.length || Object.keys(entry).some((key) => !keys.includes(key)) || workspace === void 0 || name === void 0 || spec === void 0 || !sourceApi && dependency === void 0 || reason === void 0) throw new Error(`typescriptAllowlist entry ${shown} must have exactly workspace, name, spec, dependency and reason as nonempty strings: ${allowlistFormat}`);
 		if (workspace !== "." && (path.posix.normalize(workspace) !== workspace || workspace.startsWith("/") || workspace.endsWith("/") || workspace === ".." || workspace.startsWith("../"))) throw new Error(`typescriptAllowlist entry ${shown}: workspace must be "." for the root or a normalized relative package directory such as "apps/web"`);
 		if (!exactTypescriptSpec(spec)) throw new Error(`typescriptAllowlist entry ${shown}: spec must be the exact spec the manifest resolves to, such as "6.0.3" or "npm:typescript@6.0.3", not a range or catalog reference`);
 		if (!isTypescriptInstall(name, spec)) throw new Error(`typescriptAllowlist entry ${shown}: name must be typescript or @typescript/native, or an alias whose spec is npm:typescript@<version> or npm:@typescript/native@<version>`);
-		if (typescriptPackages.has(dependency) || dependency === name) throw new Error(`typescriptAllowlist entry ${shown}: dependency must name the package in that workspace that needs ${name}, not a TypeScript package`);
+		if (dependency !== void 0 && (typescriptPackages.has(dependency) || dependency === name)) throw new Error(`typescriptAllowlist entry ${shown}: dependency must name the package in that workspace that needs ${name}, not a TypeScript package`);
 		const key = `${workspace}\0${name}`;
 		if (seen.has(key)) throw new Error(`typescriptAllowlist declares ${name} for ${workspace} more than once; keep one entry`);
 		seen.add(key);
+		if (sourceApi) {
+			const sources = entry["sources"];
+			if (!Array.isArray(sources) || sources.length === 0 || !sources.every((source) => typeof source === "string" && path.posix.normalize(source) === source && !source.startsWith("/") && source !== ".." && !source.startsWith("../") && !source.includes("\\") && !/[?*{}[\]]/.test(source) && /\.[cm]?[jt]sx?$/.test(source) && !/\.d\.[cm]?ts$/.test(source) && !source.split("/").some((part) => ["node_modules", "vendor"].includes(part))) || new Set(sources).size !== sources.length) throw new Error(`typescriptAllowlist source-api entry ${shown} requires unique normalized source file paths`);
+			return {
+				kind: "source-api",
+				workspace,
+				name,
+				spec,
+				reason,
+				sources
+			};
+		}
+		if (dependency === void 0) throw new Error("Missing TypeScript dependency owner");
 		return {
 			workspace,
 			name,
@@ -990,10 +1046,10 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 			const document = pnpm ? parseDocument(text, { lineCounter }) : void 0;
 			if (document !== void 0 && document.errors.length > 0) throw new Error("invalid YAML");
 			const json = document === void 0 ? JSON.parse(text) : document.toJS();
-			if (!record$7(json)) throw new Error("manifest must be an object");
+			if (!record$8(json)) throw new Error("manifest must be an object");
 			if (pnpm) {
-				if (json["catalog"] !== void 0 && !record$7(json["catalog"])) throw new Error("catalog must be a mapping");
-				if (json["catalogs"] !== void 0 && (!record$7(json["catalogs"]) || Object.values(json["catalogs"]).some((catalog) => !record$7(catalog)))) throw new Error("named catalogs must be mappings");
+				if (json["catalog"] !== void 0 && !record$8(json["catalog"])) throw new Error("catalog must be a mapping");
+				if (json["catalogs"] !== void 0 && (!record$8(json["catalogs"]) || Object.values(json["catalogs"]).some((catalog) => !record$8(catalog)))) throw new Error("named catalogs must be mappings");
 				if (json["packages"] !== void 0 && (!Array.isArray(json["packages"]) || !json["packages"].every((pattern) => typeof pattern === "string"))) throw new Error("workspace packages must be patterns");
 			}
 			manifests.set(file, json);
@@ -1007,13 +1063,13 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 					catalog: json["overrides"],
 					prefix: ["overrides"]
 				},
-				...record$7(json["catalogs"]) ? Object.entries(json["catalogs"]).map(([name, catalog]) => ({
+				...record$8(json["catalogs"]) ? Object.entries(json["catalogs"]).map(([name, catalog]) => ({
 					catalog,
 					prefix: ["catalogs", name]
 				})) : []
 			];
 			for (const { catalog, prefix } of catalogEntries) {
-				if (!record$7(catalog)) continue;
+				if (!record$8(catalog)) continue;
 				for (const [name, value] of Object.entries(catalog)) {
 					const node = document.getIn([...prefix, name], true);
 					if (!isNode(node) || node.range === void 0 || node.range === null) continue;
@@ -1032,7 +1088,7 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 			});
 		}
 	}
-	const catalogSources = (json) => [json, ...record$7(json["workspaces"]) ? [json["workspaces"]] : []];
+	const catalogSources = (json) => [json, ...record$8(json["workspaces"]) ? [json["workspaces"]] : []];
 	const pnpmWorkspaceFor = (file) => {
 		let directory = path.posix.dirname(file);
 		while (true) {
@@ -1055,8 +1111,8 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 				patterns: workspace["packages"],
 				rootMembership: "implicit"
 			})) return void 0;
-			if (name === "" || name === "default") return workspace["catalog"] ?? (record$7(workspace["catalogs"]) ? workspace["catalogs"]["default"] : void 0);
-			return record$7(workspace["catalogs"]) ? workspace["catalogs"][name] : void 0;
+			if (name === "" || name === "default") return workspace["catalog"] ?? (record$8(workspace["catalogs"]) ? workspace["catalogs"]["default"] : void 0);
+			return record$8(workspace["catalogs"]) ? workspace["catalogs"][name] : void 0;
 		}
 		let directory = path.posix.dirname(file);
 		while (true) {
@@ -1064,7 +1120,7 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 			if (manifest !== void 0) {
 				for (const source of catalogSources(manifest)) {
 					if (name === "" && source["catalog"] !== void 0) return source["catalog"];
-					if (record$7(source["catalogs"]) && source["catalogs"][name] !== void 0) return source["catalogs"][name];
+					if (record$8(source["catalogs"]) && source["catalogs"][name] !== void 0) return source["catalogs"][name];
 				}
 				if (manifest["workspaces"] !== void 0) return void 0;
 			}
@@ -1082,7 +1138,7 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 			};
 			visited.add(value);
 			const catalog = catalogFor(file, value.slice(8));
-			if (!record$7(catalog)) return {
+			if (!record$8(catalog)) return {
 				value: void 0,
 				catalogs
 			};
@@ -1107,7 +1163,7 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 			const workspaces = manifests.get(path.posix.join(directory, "package.json"))?.["workspaces"];
 			if (workspaces !== void 0) return {
 				directory,
-				patterns: record$7(workspaces) ? workspaces["packages"] : workspaces,
+				patterns: record$8(workspaces) ? workspaces["packages"] : workspaces,
 				source: "json"
 			};
 			if (directory === ".") return void 0;
@@ -1141,7 +1197,7 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 		if (json === void 0) continue;
 		for (const section of installSections) {
 			const entries = json[section];
-			if (!record$7(entries) || !Object.hasOwn(entries, entry.name)) continue;
+			if (!record$8(entries) || !Object.hasOwn(entries, entry.name)) continue;
 			const { value, catalogs } = resolveThrough(file, entry.name, entries[entry.name]);
 			if (value !== entry.spec) continue;
 			for (const catalog of catalogs) {
@@ -1173,7 +1229,7 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 			});
 			return `${name} ${shown} in ${file} is not allowed: ${typescriptGuidance}; if a dependency of this workspace needs it, add ${suggestion} to typescriptAllowlist in ${allowlistFile}`;
 		}
-		return value === entry.spec ? void 0 : `${name} in ${file} resolves to ${shown}, but typescriptAllowlist in ${allowlistFile} allows ${entry.spec} for ${entry.dependency}; declare ${entry.spec} or update the entry's spec`;
+		return value === entry.spec ? void 0 : `${name} in ${file} resolves to ${shown}, but typescriptAllowlist in ${allowlistFile} allows ${entry.spec} for ${entry.kind === "source-api" ? "source API imports" : entry.dependency}; declare ${entry.spec} or update the entry's spec`;
 	};
 	const peerRange = (value) => typeof value === "string" && validRange(value) !== null;
 	for (const [file, json] of manifests) {
@@ -1186,7 +1242,7 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 			message: `packageManager Bun version must be ${policy.bun} (one exact release at or above the shared minimum, the same in every manifest), found ${JSON.stringify(manager)}`
 		});
 		const checkEntries = (entries, scope, location) => {
-			if (!record$7(entries)) return;
+			if (!record$8(entries)) return;
 			for (const [name, raw] of Object.entries(entries)) {
 				const value = resolve(file, name, raw);
 				if (isTypescriptInstall(name, value)) {
@@ -1226,13 +1282,13 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 			}
 		};
 		for (const key of installSections) checkEntries(json[key], "install");
-		if (record$7(json["peerDependencies"])) for (const [name, value] of Object.entries(json["peerDependencies"])) {
+		if (record$8(json["peerDependencies"])) for (const [name, value] of Object.entries(json["peerDependencies"])) {
 			const resolved = resolve(file, name, value);
 			if (isTypescriptInstall(name, resolved) && !peerRange(resolved)) checkEntries({ [name]: value }, "peer");
 		}
 		for (const source of catalogSources(json)) {
 			checkEntries(source["catalog"], "catalog");
-			if (!record$7(source["catalogs"])) continue;
+			if (!record$8(source["catalogs"])) continue;
 			for (const catalog of Object.values(source["catalogs"])) checkEntries(catalog, "catalog");
 		}
 		const ownedNames = /* @__PURE__ */ new Set([...pins.keys(), ...typescriptPackages]);
@@ -1244,11 +1300,11 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 			"optionalDependencies"
 		]) {
 			const entries = resolutionRoot[section];
-			if (!record$7(entries)) continue;
+			if (!record$8(entries)) continue;
 			for (const [name, value] of Object.entries(entries)) resolutionDependencies[name] = resolve(file, name, value);
 		}
 		const checkResolutionMap = (entries, parent) => {
-			if (!record$7(entries)) return;
+			if (!record$8(entries)) return;
 			for (const [selector, replacement] of Object.entries(entries)) {
 				const target = selector === "." ? parent : selector;
 				if (target === void 0) continue;
@@ -1267,7 +1323,7 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 					});
 					continue;
 				}
-				if (record$7(replacement)) {
+				if (record$8(replacement)) {
 					checkResolutionMap(replacement, target);
 					continue;
 				}
@@ -1287,8 +1343,8 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 		};
 		checkResolutionMap(json["overrides"]);
 		checkResolutionMap(json["resolutions"]);
-		if (record$7(json["pnpm"])) checkResolutionMap(json["pnpm"]["overrides"]);
-		const command = record$7(json["scripts"]) ? json["scripts"]["typecheck"] : void 0;
+		if (record$8(json["pnpm"])) checkResolutionMap(json["pnpm"]["overrides"]);
+		const command = record$8(json["scripts"]) ? json["scripts"]["typecheck"] : void 0;
 		if (typeof command === "string") for (const words of compilerCommandSegments(command)) {
 			if (!invokesCompiler(words)) continue;
 			const normalized = words.join(" ");
@@ -1302,7 +1358,7 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 			});
 			break;
 		}
-		if (record$7(json["peerDependencies"])) for (const [name, raw] of Object.entries(json["peerDependencies"])) {
+		if (record$8(json["peerDependencies"])) for (const [name, raw] of Object.entries(json["peerDependencies"])) {
 			if (!typescriptPackages.has(name)) continue;
 			const range = resolve(file, name, raw);
 			if (!peerRange(range)) continue;
@@ -1326,7 +1382,7 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 				message: `${name} peer support range must include ${release}, found ${range}`
 			});
 		}
-		if (record$7(json["engines"]) && json["engines"]["node"] !== void 0 && (typeof json["engines"]["node"] !== "string" || !nodeSupportRangeMatches(policy.node, json["engines"]["node"]))) add({
+		if (record$8(json["engines"]) && json["engines"]["node"] !== void 0 && (typeof json["engines"]["node"] !== "string" || !nodeSupportRangeMatches(policy.node, json["engines"]["node"]))) add({
 			file,
 			rule: "node-engine",
 			key: "node",
@@ -1340,9 +1396,23 @@ const checkPackageFiles = ({ files, policy, typescriptAllowlist }) => {
 		if (json === void 0) return `${file} is missing or invalid; remove the entry`;
 		const declares = (name) => installSections.some((section) => {
 			const entries = json[section];
-			return record$7(entries) && Object.hasOwn(entries, name);
+			return record$8(entries) && Object.hasOwn(entries, name);
 		});
 		if (!declares(entry.name)) return `${file} no longer declares ${entry.name} in dependencies, devDependencies or optionalDependencies; remove the entry`;
+		if (entry.kind === "source-api") {
+			for (const source of entry.sources) {
+				let owner = path.posix.dirname(source);
+				while (owner !== "." && !manifests.has(`${owner}/package.json`)) owner = path.posix.dirname(owner);
+				if (owner !== entry.workspace) return `${source} belongs to workspace ${owner}, not ${entry.workspace}`;
+				const problem = sourceApiImportProblem({
+					source,
+					content: files[source],
+					name: entry.name
+				});
+				if (problem !== void 0) return `${source}: ${problem}`;
+			}
+			return;
+		}
 		if (!declares(entry.dependency)) return `${file} no longer depends on ${entry.dependency}; remove the entry and the ${entry.name} declaration, or name the dependency that still needs it`;
 	};
 	for (const entry of typescriptAllowlist) {
@@ -1379,9 +1449,9 @@ const extensionKinds = new Map(Object.entries({
 const scriptSourceKind = (file) => extensionKinds.get(extname(file));
 //#endregion
 //#region src/toolchain-script-lifecycle.ts
-const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const declaredManager = (value) => typeof value === "string" ? /^(bun|npm|pnpm|yarn)@(\d+\.\d+\.\d+)(?:\+\S+)?$/u.exec(value) : null;
-const rootScriptManager = (manifest, context) => declaredManager(context.packageManager ?? (record$6(manifest) ? manifest["packageManager"] : void 0))?.at(1);
+const rootScriptManager = (manifest, context) => declaredManager(context.packageManager ?? (record$7(manifest) ? manifest["packageManager"] : void 0))?.at(1);
 const npmHooksEnabled = (file) => {
 	if (file?.type === "unknown") throw new Error("npm lifecycle configuration must be a tracked regular file");
 	if (file?.type !== "tracked") return true;
@@ -1412,14 +1482,18 @@ const yamlSettings = (file, manager) => {
 	} catch {
 		throw new Error(`Cannot parse ${manager} lifecycle configuration`);
 	}
-	if (!record$6(settings)) throw new Error(`${manager} lifecycle configuration must be a mapping`);
+	if (!record$7(settings)) throw new Error(`${manager} lifecycle configuration must be a mapping`);
 	return settings;
 };
+const pnpmLifecycleVersions = ["12.9.1", "12.15.0"];
 const pnpmHooksEnabled = (manifest, context) => {
 	const declared = declaredManager(context.packageManager ?? manifest["packageManager"]);
-	const dependency = [manifest["dependencies"], manifest["devDependencies"]].flatMap((field) => record$6(field) ? [field["pnpm"]] : []).find((value) => typeof value === "string");
-	if ((declared?.at(1) === "pnpm" ? declared.at(2) : dependency) !== "12.9.1") throw new Error("pnpm lifecycle discovery requires declared pnpm@12.9.1");
-	const enabled = yamlSettings(context.pnpmWorkspace, "pnpm")["enablePrePostScripts"];
+	const dependency = [manifest["dependencies"], manifest["devDependencies"]].flatMap((field) => record$7(field) ? [field["pnpm"]] : []).find((value) => typeof value === "string");
+	const version = declared?.at(1) === "pnpm" ? declared.at(2) : dependency;
+	if (!pnpmLifecycleVersions.some((supported) => version === supported)) throw new Error(`pnpm lifecycle discovery requires declared pnpm@${pnpmLifecycleVersions.join(" or pnpm@")}`);
+	const settings = yamlSettings(context.pnpmWorkspace, "pnpm");
+	if ("include" in settings) throw new Error("Delegated pnpm settings require explicit lifecycle discovery support");
+	const enabled = settings["enablePrePostScripts"];
 	if (enabled === void 0) return true;
 	if (typeof enabled !== "boolean") throw new Error("pnpm enablePrePostScripts must be a literal boolean");
 	return enabled;
@@ -1461,7 +1535,7 @@ const scriptLifecycleStages = ({ name, manager, manifest, scripts, context }) =>
 };
 //#endregion
 //#region src/toolchain-lint-command.ts
-const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const scriptManagers = /* @__PURE__ */ new Set([
 	"bun",
 	"npm",
@@ -1578,7 +1652,7 @@ const lintInventoryCommands = (manifest, forceEnabled = false, context = {}) =>
 	const errors = [];
 	const workspaceTasks = /* @__PURE__ */ new Set();
 	const filteredBuilds = /* @__PURE__ */ new Set();
-	const declaresEngine = record$5(manifest) && [manifest["dependencies"], manifest["devDependencies"]].some((dependencies) => record$5(dependencies) && "oxlint-tsgolint" in dependencies);
+	const declaresEngine = record$6(manifest) && [manifest["dependencies"], manifest["devDependencies"]].some((dependencies) => record$6(dependencies) && "oxlint-tsgolint" in dependencies);
 	const enabled = forceEnabled || declaresEngine;
 	if (!enabled) return {
 		commands,
@@ -1586,14 +1660,14 @@ const lintInventoryCommands = (manifest, forceEnabled = false, context = {}) =>
 		enabled,
 		workspaceTask: false
 	};
-	if (!record$5(manifest)) return {
+	if (!record$6(manifest)) return {
 		commands,
 		errors: ["lint inventory requires an object package manifest"],
 		enabled,
 		workspaceTask: false
 	};
 	const scripts = manifest["scripts"];
-	if (!record$5(scripts)) return {
+	if (!record$6(scripts)) return {
 		commands,
 		errors: ["type-aware linting requires a root lint script"],
 		enabled,
@@ -1735,7 +1809,7 @@ const checkProjectOwnership = ({ trackedFiles, lintedFiles, projectFiles }) => [
 	line: 1,
 	message: "type-aware lint would use an inferred project; include this file in a declared tsconfig project (for Node scripts, add scripts/tsconfig.json extending @stll/typescript-config/node.json; see the Node scripts recipe in stella/tooling README)"
 }));
-const record$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const stringList = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
 const readCommand = ({ root, executable, args, runtime }) => {
 	const result = spawnSync(runtime, [
@@ -1779,7 +1853,7 @@ const resolveProjectApi = (root) => {
 	for (const base of [import.meta.url, path.join(root, "package.json")]) try {
 		return pathToFileURL(createRequire(base).resolve("tsrs/unstable/async")).href;
 	} catch (error) {
-		const code = record$4(error) ? error["code"] : void 0;
+		const code = record$5(error) ? error["code"] : void 0;
 		if (code !== "MODULE_NOT_FOUND" && code !== "ERR_MODULE_NOT_FOUND") throw error;
 	}
 	throw new Error("configuration discovery needs tsrs: reinstall @stll/oxlint-config, which depends on it");
@@ -1802,7 +1876,7 @@ const readProjectConfig = (root, config) => {
 	if (result.error !== void 0) throw result.error;
 	if (result.status !== 0) throw new Error(`configuration discovery failed: ${(result.stderr + result.stdout).trim()}`);
 	const parsed = JSON.parse(result.stdout);
-	if (!record$4(parsed) || !stringList(parsed["files"]) || !stringList(parsed["references"]) || typeof parsed["allowJs"] !== "boolean" || typeof parsed["checkJs"] !== "boolean") throw new Error("compiler configuration must list files and references");
+	if (!record$5(parsed) || !stringList(parsed["files"]) || !stringList(parsed["references"]) || typeof parsed["allowJs"] !== "boolean" || typeof parsed["checkJs"] !== "boolean") throw new Error("compiler configuration must list files and references");
 	return {
 		files: parsed["files"],
 		references: parsed["references"],
@@ -1827,7 +1901,7 @@ const lifecycleFile = (root, file, tracked) => {
 };
 /** Inventory and config expansion only: neither subprocess lints or typechecks. */
 const checkNodeProjects = ({ root, manifest, trackedFiles }) => {
-	const packageManager = record$4(manifest) ? manifest["packageManager"] : void 0;
+	const packageManager = record$5(manifest) ? manifest["packageManager"] : void 0;
 	const managerUsesPnpmWorkspace = packageManager === void 0 || typeof packageManager === "string" && packageManager.startsWith("pnpm@");
 	const discovered = /* @__PURE__ */ new Map();
 	const workspaceMembers = (pnpmMembership) => {
@@ -1863,7 +1937,7 @@ const checkNodeProjects = ({ root, manifest, trackedFiles }) => {
 		return nestedLifecycle;
 	};
 	const lifecycle = {
-		packageManager: record$4(manifest) ? manifest["packageManager"] : void 0,
+		packageManager: record$5(manifest) ? manifest["packageManager"] : void 0,
 		npmrc: lifecycleFile(root, ".npmrc", trackedFiles),
 		pnpmWorkspace: lifecycleFile(root, "pnpm-workspace.yaml", trackedFiles),
 		yarnrc: lifecycleFile(root, ".yarnrc.yml", trackedFiles),
@@ -1874,7 +1948,7 @@ const checkNodeProjects = ({ root, manifest, trackedFiles }) => {
 			if (member === void 0) throw new Error("Missing selected workspace");
 			const [directory, pkg] = member;
 			const scripts = pkg["scripts"];
-			if (!record$4(scripts) || typeof scripts["build"] !== "string") throw new Error("Filtered Bun build requires a literal build script");
+			if (!record$5(scripts) || typeof scripts["build"] !== "string") throw new Error("Filtered Bun build requires a literal build script");
 			if (["prebuild", "postbuild"].some((name) => scripts[name] !== void 0 && scripts[name] !== "")) throw new Error("Filtered Bun build lifecycle hooks are unsupported for lint inventory; invoke lint scopes explicitly");
 			if (activeBuilds.has(directory)) throw new Error("Cyclic filtered Bun build delegation");
 			activeBuilds.add(directory);
@@ -1916,7 +1990,7 @@ const checkNodeProjects = ({ root, manifest, trackedFiles }) => {
 			for (const [directory, workspace] of workspaceMembers(managerUsesPnpmWorkspace)) {
 				if (directory === ".") continue;
 				const file = `${directory}/package.json`;
-				if (!record$4(workspace["scripts"]) || workspace["scripts"]["lint"] === void 0) continue;
+				if (!record$5(workspace["scripts"]) || workspace["scripts"]["lint"] === void 0) continue;
 				const nestedLifecycle = workspaceLifecycle(directory);
 				const nested = lintInventoryCommands(workspace, true, nestedLifecycle);
 				if (nested.workspaceTask) throw new Error(`nested workspace lint delegation is unsupported: ${file}`);
@@ -2025,7 +2099,7 @@ const checkNodeProjects = ({ root, manifest, trackedFiles }) => {
 };
 //#endregion
 //#region src/toolchain-rust.ts
-const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /**
 * Exceptions authorize one immutable release, never a channel or an entire
 * rule. Expiry is scoped separately by checkRustExceptionExpiry.
@@ -2035,7 +2109,7 @@ const parseRustExceptions = (input) => {
 	if (!Array.isArray(input)) throw new Error("rustExceptions must be an array");
 	const pins = /* @__PURE__ */ new Set();
 	return input.map((entry) => {
-		if (!record$3(entry) || Object.keys(entry).length !== 4 || Object.keys(entry).some((key) => ![
+		if (!record$4(entry) || Object.keys(entry).length !== 4 || Object.keys(entry).some((key) => ![
 			"pin",
 			"reason",
 			"tracking",
@@ -2053,8 +2127,8 @@ const parseRustExceptions = (input) => {
 /** Whether the base stll-toolchain.json declares this exception with the same expiry. */
 const declaresException = (baseText, { pin, expires }) => {
 	const base = JSON.parse(baseText);
-	const exceptions = record$3(base) ? base["rustExceptions"] : void 0;
-	return Array.isArray(exceptions) && exceptions.some((entry) => record$3(entry) && entry["pin"] === pin && entry["expires"] === expires);
+	const exceptions = record$4(base) ? base["rustExceptions"] : void 0;
+	return Array.isArray(exceptions) && exceptions.some((entry) => record$4(entry) && entry["pin"] === pin && entry["expires"] === expires);
 };
 /** An exception expires on its date; the scope decides whether that fails this run. */
 const checkRustExceptionExpiry = ({ exceptions, now = /* @__PURE__ */ new Date(), scope }) => {
@@ -2192,7 +2266,9 @@ const checkRustReferences = (options) => {
 				}
 				if (token.value.startsWith("-")) continue;
 				selected++;
-				select(token.value, "rustup toolchain", token.line);
+				const installFixture = options.type === "file" && isShellScript(file, text) && subcommand === "toolchain" && invocation.at(1)?.value === "install" && !invocation.some((word) => word.value === "--default") ? options.installFixtures?.find((entry) => entry.path === file && entry.pin === token.value) : void 0;
+				if (installFixture !== void 0) options.onInstallFixture?.(installFixture);
+				else select(token.value, "rustup toolchain", token.line);
 				if (firstSelectorOnly) break;
 			}
 			if (selected === 0 && requiresSelector) select(void 0, "rustup toolchain", firstLine);
@@ -2213,7 +2289,7 @@ const checkRustReferences = (options) => {
 	if (isShellScript(file, text)) shell(text);
 	if (/(?:^|\/)package\.json$/.test(file)) try {
 		const object = JSON.parse(text);
-		if (record$3(object) && record$3(object["scripts"])) {
+		if (record$4(object) && record$4(object["scripts"])) {
 			for (const [name, script] of Object.entries(object["scripts"])) if (typeof script === "string") shell(script, lineOf(`"${name}"`));
 		}
 	} catch {}
@@ -2224,7 +2300,7 @@ const checkRustReferences = (options) => {
 				const version = tag === void 0 ? void 0 : rustImageVersion(tag);
 				select(version, "Rust service image", lineOf(value));
 			} else if (Array.isArray(value)) value.forEach(images);
-			else if (record$3(value)) {
+			else if (record$4(value)) {
 				for (const [key, entry] of Object.entries(value)) if (key !== "name") images(entry);
 			}
 		};
@@ -2248,13 +2324,13 @@ const checkRustReferences = (options) => {
 				value.forEach(visit);
 				return;
 			}
-			if (!record$3(value)) return;
-			if (record$3(value["env"]) && value["env"]["RUSTUP_TOOLCHAIN"] !== void 0) select(value["env"]["RUSTUP_TOOLCHAIN"], "RUSTUP_TOOLCHAIN", lineOf("RUSTUP_TOOLCHAIN"));
+			if (!record$4(value)) return;
+			if (record$4(value["env"]) && value["env"]["RUSTUP_TOOLCHAIN"] !== void 0) select(value["env"]["RUSTUP_TOOLCHAIN"], "RUSTUP_TOOLCHAIN", lineOf("RUSTUP_TOOLCHAIN"));
 			if (typeof value["run"] === "string") shell(value["run"], lineOf("run:"));
 			const uses = value["uses"];
 			if (typeof uses === "string") {
 				const action = uses.split("@").at(0)?.toLowerCase();
-				const inputs = record$3(value["with"]) ? value["with"] : {};
+				const inputs = record$4(value["with"]) ? value["with"] : {};
 				if (action === "dtolnay/rust-toolchain" || action === "actions-rust-lang/setup-rust-toolchain") {
 					const entries = Object.entries(inputs).filter(([key]) => key.toLowerCase() === "toolchain");
 					if (entries.length !== 1) select(void 0, `${action} requires an explicit exact toolchain input`, lineOf(uses));
@@ -2268,8 +2344,8 @@ const checkRustReferences = (options) => {
 				}
 			}
 			for (const [key, child] of Object.entries(value)) {
-				if (key === "workflow_call" && record$3(child) && record$3(child["inputs"])) {
-					for (const [input, declaration] of Object.entries(child["inputs"])) if (["toolchain", "rust-toolchain"].includes(input) && record$3(declaration) && declaration["default"] !== void 0) select(declaration["default"], `reusable workflow default ${input}`, lineOf("default:"));
+				if (key === "workflow_call" && record$4(child) && record$4(child["inputs"])) {
+					for (const [input, declaration] of Object.entries(child["inputs"])) if (["toolchain", "rust-toolchain"].includes(input) && record$4(declaration) && declaration["default"] !== void 0) select(declaration["default"], `reusable workflow default ${input}`, lineOf("default:"));
 				}
 				visit(child);
 			}
@@ -2280,7 +2356,7 @@ const checkRustReferences = (options) => {
 };
 //#endregion
 //#region src/toolchain-workflow-trust.ts
-const record$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const booleanParts = (source, operator) => {
 	const parts = [];
 	let depth = 0;
@@ -2530,7 +2606,7 @@ const safeAction = (uses, inputs) => {
 	const approved = Object.entries(workflowTrustBootstrapCatalog.actions).find(([name]) => name === repository);
 	if (approved === void 0) return false;
 	if (inputs === void 0) return repository === "actions/checkout";
-	if (!record$2(inputs)) return false;
+	if (!record$3(inputs)) return false;
 	if (repository !== "actions/checkout") {
 		const version = inputs["bun-version"];
 		if (typeof version !== "string" || !/^v?[0-9]+(?:\.(?:[0-9]+|x)){0,2}$/u.test(version)) return false;
@@ -2543,7 +2619,7 @@ const safeAction = (uses, inputs) => {
 	].includes(typeof value) && (name !== "submodules" || value === false || value === "false"));
 };
 const safeShell = (shell) => shell === void 0 || shell === "bash" || shell === "sh";
-const safeEnvironment = (value) => value === void 0 || record$2(value) && Object.keys(value).every((name) => [
+const safeEnvironment = (value) => value === void 0 || record$3(value) && Object.keys(value).every((name) => [
 	"HEAD_REPO",
 	"BASE_REPO",
 	"HAS_RUN_CI_LABEL",
@@ -2557,25 +2633,25 @@ const safeEnvironment = (value) => value === void 0 || record$2(value) && Object
 	"HAWK_VERSION",
 	"HAWK_X86_64_UNKNOWN_LINUX_GNU_SHA256"
 ].includes(name));
-const configuredShell = (value) => record$2(value) && record$2(value["run"]) ? value["run"]["shell"] : void 0;
+const configuredShell = (value) => record$3(value) && record$3(value["run"]) ? value["run"]["shell"] : void 0;
 const workflowTrustRules = ["workflow-trust"];
 const workflowEvents = (triggers) => {
 	if (typeof triggers === "string") return [triggers];
 	if (Array.isArray(triggers)) return triggers;
-	if (record$2(triggers)) return Object.keys(triggers);
+	if (record$3(triggers)) return Object.keys(triggers);
 	return [];
 };
 /** Enforce a workflow's declared trust boundary before repository dependency execution. */
 const checkWorkflowTrust = (workflow) => {
 	const findings = [];
-	if (!record$2(workflow) || !record$2(workflow["jobs"])) return findings;
+	if (!record$3(workflow) || !record$3(workflow["jobs"])) return findings;
 	const jobs = workflow["jobs"];
-	if (!record$2(jobs["trust-check"])) return findings;
+	if (!record$3(jobs["trust-check"])) return findings;
 	const triggers = workflow["on"];
 	const pullRequests = workflowEvents(triggers).filter((event) => event === "pull_request" || event === "pull_request_target");
 	if (pullRequests.length === 0) return findings;
 	for (const [name, job] of Object.entries(jobs)) {
-		if (!record$2(job)) continue;
+		if (!record$3(job)) continue;
 		const needs = job["needs"];
 		const ordered = name !== "trust-check" && (needs === "trust-check" || Array.isArray(needs) && needs.includes("trust-check"));
 		const permitsExecution = (stepCondition) => {
@@ -2612,7 +2688,7 @@ const checkWorkflowTrust = (workflow) => {
 				message
 			});
 			const services = job["services"];
-			if (services !== void 0 && (!record$2(services) || Object.keys(services).length > 0)) findings.push({
+			if (services !== void 0 && (!record$3(services) || Object.keys(services).length > 0)) findings.push({
 				type: "job",
 				property: "services",
 				job: name,
@@ -2621,7 +2697,7 @@ const checkWorkflowTrust = (workflow) => {
 		}
 		if (!Array.isArray(job["steps"])) continue;
 		for (const [index, step] of job["steps"].entries()) {
-			if (!record$2(step)) continue;
+			if (!record$3(step)) continue;
 			const run = step["run"];
 			const uses = step["uses"];
 			const unsafeRun = typeof run === "string" && (invokesRepositoryCode(run) || !safeShell(step["shell"] ?? configuredShell(job["defaults"]) ?? configuredShell(workflow["defaults"])) || ![
@@ -2659,7 +2735,7 @@ const runtimeRules = [
 	"action-pins",
 	...workflowTrustRules
 ];
-const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const record$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const dockerEnvironmentAssignments = ({ source, escape }) => {
 	const words = [];
 	let word = "";
@@ -2792,13 +2868,15 @@ const pythonRequirementMatches = (requirement, version) => {
 	});
 };
 /** Check runtime declarations only in the files that declare or configure them. */
-const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, repository, onDelegated, dynamicSelectors = [], onDynamicSelector, rustExceptions = [], engineFloors = [], onEngineFloor }) => {
+const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, repository, onDelegated, dynamicSelectors = [], onDynamicSelector, rustExceptions = [], rustInstallFixtures = [], onRustInstallFixture, engineFloors = [], onEngineFloor }) => {
 	const diagnostics = checkRustReferences({
 		type: "file",
 		file,
 		text,
 		rust: policy.rust,
-		exceptions: rustExceptions
+		exceptions: rustExceptions,
+		installFixtures: rustInstallFixtures,
+		onInstallFixture: onRustInstallFixture
 	});
 	const name = path.posix.basename(file);
 	const lines = text.split(/\r?\n/);
@@ -2894,7 +2972,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			const toolchain = parsed["toolchain"];
 			pin({
 				rule: "rust-version",
-				value: record$1(toolchain) ? toolchain["channel"] : void 0,
+				value: record$2(toolchain) ? toolchain["channel"] : void 0,
 				expected: policy.rust,
 				label: "Rust channel",
 				line: lineOf("channel")
@@ -2922,15 +3000,15 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		};
 		if (parsed !== void 0) {
 			const workspace = parsed["workspace"];
-			const defaults = record$1(workspace) ? workspace["package"] : void 0;
-			if (record$1(defaults) && defaults["rust-version"] !== void 0) rustFloor(defaults["rust-version"]);
+			const defaults = record$2(workspace) ? workspace["package"] : void 0;
+			if (record$2(defaults) && defaults["rust-version"] !== void 0) rustFloor(defaults["rust-version"]);
 			const pkg = parsed["package"];
-			const version = record$1(pkg) ? pkg["rust-version"] : void 0;
+			const version = record$2(pkg) ? pkg["rust-version"] : void 0;
 			if (version !== void 0) {
-				if (!record$1(version)) rustFloor(version);
+				if (!record$2(version)) rustFloor(version);
 				else {
 					let inherited;
-					if (version["workspace"] === true && record$1(pkg)) {
+					if (version["workspace"] === true && record$2(pkg)) {
 						const explicit = pkg["workspace"];
 						let directory = path.posix.dirname(file);
 						const explicitPath = typeof explicit === "string" && !explicit.includes("\\") && !explicit.includes(":") && !explicit.includes("${{") && !path.posix.isAbsolute(explicit) ? path.posix.normalize(path.posix.join(directory, explicit)) : void 0;
@@ -2938,9 +3016,9 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 							if (explicitPath !== void 0) directory = explicitPath;
 							while (true) {
 								const table = readManifest(path.posix.join(directory, "Cargo.toml"))?.["workspace"];
-								if (record$1(table)) {
+								if (record$2(table)) {
 									const fields = table["package"];
-									inherited = record$1(fields) ? fields["rust-version"] : void 0;
+									inherited = record$2(fields) ? fields["rust-version"] : void 0;
 									break;
 								}
 								if (explicit !== void 0 || directory === ".") break;
@@ -2955,7 +3033,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	}
 	if (name === "Pipfile") {
 		const requires = toml("python-version")?.["requires"];
-		if (record$1(requires)) {
+		if (record$2(requires)) {
 			const minor = requires["python_version"];
 			if (minor !== void 0 && minor !== policy.python.split(".").slice(0, 2).join(".")) add({
 				rule: "python-version",
@@ -2974,7 +3052,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		const parsed = toml("python-version");
 		if (parsed !== void 0) {
 			const project = parsed["project"];
-			if (record$1(project) && project["requires-python"] !== void 0) {
+			if (record$2(project) && project["requires-python"] !== void 0) {
 				if (!pythonRequirementMatches(project["requires-python"], policy.python)) add({
 					rule: "python-version",
 					line: lineOf("requires-python"),
@@ -2982,9 +3060,9 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 				});
 			}
 			const tool = parsed["tool"];
-			const configuredUv = record$1(tool) ? tool["uv"] : void 0;
+			const configuredUv = record$2(tool) ? tool["uv"] : void 0;
 			const uv = name === "uv.toml" ? parsed : configuredUv;
-			if (record$1(uv) && uv["python"] !== void 0) pin({
+			if (record$2(uv) && uv["python"] !== void 0) pin({
 				rule: "python-version",
 				value: uv["python"],
 				expected: policy.python,
@@ -2995,11 +3073,11 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	}
 	if (isMiseConfigPath(file)) {
 		const tools = toml("runtime-manager")?.["tools"];
-		if (record$1(tools)) for (const [tool, expected] of Object.entries(versions)) {
+		if (record$2(tools)) for (const [tool, expected] of Object.entries(versions)) {
 			const configured = tools[tool];
 			if (configured !== void 0) pin({
 				rule: tool === "rust" || tool === "core:rust" ? "rust-version" : "runtime-manager",
-				value: record$1(configured) ? configured["version"] : configured,
+				value: record$2(configured) ? configured["version"] : configured,
 				expected,
 				selector: nodeTools.has(tool) ? "node" : void 0,
 				label: `mise ${tool}`,
@@ -3347,7 +3425,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		return diagnostics;
 	}
 	const nodeLine = (node) => {
-		if (!record$1(node) || !Array.isArray(node["range"])) return 1;
+		if (!record$2(node) || !Array.isArray(node["range"])) return 1;
 		const offset = node["range"].at(0);
 		return typeof offset === "number" ? text.slice(0, offset).split("\n").length : 1;
 	};
@@ -3461,7 +3539,7 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 				const manifest = JSON.parse(content ?? "");
 				pin({
 					rule,
-					value: record$1(manifest) ? manifest["packageManager"] : void 0,
+					value: record$2(manifest) ? manifest["packageManager"] : void 0,
 					expected: `bun@${policy.bun}`,
 					label: "setup-bun version file packageManager",
 					line
@@ -3661,10 +3739,21 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			const selector = staticRepositoryPath(value) ? path.posix.normalize(value) : void 0;
 			const providers = checkoutProvidersFor(selector);
 			const binding = selector === void 0 ? void 0 : providers.at(-1);
-			if (selector === void 0 || unknownCheckoutDestination || binding !== void 0 && binding.source !== "tracked" || hasAmbiguousCheckoutWriters(selector, providers)) add({
-				rule: "action-pins",
+			if (selector === void 0 || unknownCheckoutDestination || binding?.source === "untrusted" || binding?.source === "delegated" && !/^(?:inputs\.[A-Za-z_][A-Za-z0-9_]*|github\.event\.workflow_run\.head_sha)$/.test(dynamicRefBody(binding.ref) ?? "") || hasAmbiguousCheckoutWriters(selector, providers)) {
+				add({
+					rule: "action-pins",
+					line,
+					message: "local actions require an unambiguous checkout of the current source snapshot"
+				});
+				return;
+			}
+			if (binding?.source === "delegated") onDelegated?.({
+				path: file,
 				line,
-				message: "local actions require an unambiguous checkout of the current source snapshot"
+				tool: "action",
+				selector,
+				checkoutPath: binding.path,
+				ref: binding.ref
 			});
 			return;
 		}
@@ -3962,6 +4051,54 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 	return diagnostics;
 };
 //#endregion
+//#region src/toolchain-rust-fixtures.ts
+const record$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const date = (value) => /^\d{4}-\d{2}-\d{2}$/.test(value) && Number.isFinite(Date.parse(value)) && new Date(value).toISOString().slice(0, 10) === value;
+/** Historical install probes do not authorize using an older compiler. */
+const parseRustInstallFixtures = (input) => {
+	if (input === void 0) return [];
+	if (!Array.isArray(input)) throw new Error("rustInstallFixtures must be an array");
+	const identities = /* @__PURE__ */ new Set();
+	return input.map((entry) => {
+		if (!record$1(entry) || Object.keys(entry).length !== 5 || Object.keys(entry).some((key) => ![
+			"path",
+			"pin",
+			"reason",
+			"tracking",
+			"expires"
+		].includes(key)) || typeof entry["path"] !== "string" || !/^(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]+\.sh$/.test(entry["path"]) || typeof entry["pin"] !== "string" || !(/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(entry["pin"]) || entry["pin"].startsWith("nightly-") && date(entry["pin"].slice(8))) || typeof entry["reason"] !== "string" || entry["reason"].trim() === "" || typeof entry["tracking"] !== "string" || !/^https:\/\/github\.com\/[^/\s]+\/[^/\s]+\/(?:issues|pull)\/[1-9]\d*$/.test(entry["tracking"]) || typeof entry["expires"] !== "string" || !date(entry["expires"])) throw new Error("each Rust install fixture requires an exact shell path, stable or dated nightly pin, reason, GitHub tracking URL and valid expiry date");
+		const identity = `${entry["path"]}:${entry["pin"]}`;
+		if (identities.has(identity)) throw new Error("Rust install fixture path/pin pairs must be unique");
+		identities.add(identity);
+		return {
+			path: entry["path"],
+			pin: entry["pin"],
+			reason: entry["reason"],
+			tracking: entry["tracking"],
+			expires: entry["expires"]
+		};
+	});
+};
+const checkRustInstallFixtureExpiry = ({ fixtures, scope, now = /* @__PURE__ */ new Date() }) => {
+	const errors = [];
+	const warnings = [];
+	for (const fixture of fixtures) {
+		if (fixture.expires > now.toISOString().slice(0, 10)) continue;
+		const verdict = overdueVerdict(scope, "stll-toolchain.json", (text) => {
+			const base = JSON.parse(text);
+			const declarations = record$1(base) ? base["rustInstallFixtures"] : void 0;
+			return Array.isArray(declarations) && declarations.some((entry) => record$1(entry) && entry["path"] === fixture.path && entry["pin"] === fixture.pin && entry["expires"] === fixture.expires);
+		});
+		const message = `Rust install fixture ${fixture.path}:${fixture.pin} expired on ${fixture.expires}; remove it or renew the documented fixture boundary`;
+		if (!verdict.fail) warnings.push(message);
+		else errors.push(verdict.unavailable === void 0 ? message : `${message}; cannot determine whether this change adds it: ${verdict.unavailable}`);
+	}
+	return {
+		errors,
+		warnings
+	};
+};
+//#endregion
 //#region src/toolchain-guard.ts
 const toolchainRules = [.../* @__PURE__ */ new Set([
 	...packageRules,
@@ -3976,7 +4113,7 @@ const record = (value) => typeof value === "object" && value !== null && !Array.
 const array = (value) => Array.isArray(value);
 /** Repository-owned declarations are explicit; malformed decisions fail closed. */
 const parseToolchainConfiguration = (input) => {
-	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors" && key !== "dynamicSelectors" && key !== "consumerChecks" && key !== "rustExceptions" && key !== "dependabotIgnores" && key !== "typescriptAllowlist") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud, engineFloors, dynamicSelectors, consumerChecks, rustExceptions, dependabotIgnores and typescriptAllowlist declarations");
+	if (!record(input) || Object.keys(input).some((key) => key !== "optOuts" && key !== "cloud" && key !== "engineFloors" && key !== "dynamicSelectors" && key !== "consumerChecks" && key !== "rustExceptions" && key !== "rustInstallFixtures" && key !== "dependabotIgnores" && key !== "typescriptAllowlist") || input["optOuts"] !== void 0 && !array(input["optOuts"])) throw new Error("stll-toolchain.json accepts only optOuts, cloud, engineFloors, dynamicSelectors, consumerChecks, rustExceptions, rustInstallFixtures, dependabotIgnores and typescriptAllowlist declarations");
 	const disabled = /* @__PURE__ */ new Set();
 	const optOuts = input["optOuts"] ?? [];
 	if (!array(optOuts)) throw new Error("optOuts must be an array");
@@ -3993,6 +4130,7 @@ const parseToolchainConfiguration = (input) => {
 	return {
 		disabled,
 		rustExceptions: parseRustExceptions(input["rustExceptions"]),
+		rustInstallFixtures: parseRustInstallFixtures(input["rustInstallFixtures"]),
 		cloud: parseCloudSetup(input["cloud"]),
 		engineFloors: parseEngineFloors(input["engineFloors"]),
 		dynamicSelectors: parseDynamicSelectors(input["dynamicSelectors"]),
@@ -4085,11 +4223,20 @@ const checkToolchain = ({ root, policy: sharedPolicy, onDelegated, onWarning, no
 	if (files["stll-toolchain.json"] !== void 0) try {
 		configuration = parseToolchainConfiguration(JSON.parse(files["stll-toolchain.json"]));
 		dynamicSelectors = configuration.dynamicSelectors;
-		const expiry = checkRustExceptionExpiry({
+		const rustExpiry = checkRustExceptionExpiry({
 			exceptions: configuration.rustExceptions,
 			now,
 			scope: expiryScope
 		});
+		const fixtureExpiry = checkRustInstallFixtureExpiry({
+			fixtures: configuration.rustInstallFixtures,
+			now,
+			scope: expiryScope
+		});
+		const expiry = {
+			errors: [...rustExpiry.errors, ...fixtureExpiry.errors],
+			warnings: [...rustExpiry.warnings, ...fixtureExpiry.warnings]
+		};
 		for (const message of expiry.errors) diagnostics.push({
 			rule: "configuration",
 			path: "stll-toolchain.json",
@@ -4111,6 +4258,23 @@ const checkToolchain = ({ root, policy: sharedPolicy, onDelegated, onWarning, no
 			message: error instanceof Error ? error.message : String(error)
 		});
 	}
+	for (const entry of configuration.typescriptAllowlist) {
+		if (entry.kind !== "source-api") continue;
+		for (const source of entry.sources) {
+			const content = readSourceApiInput({
+				root,
+				source,
+				tracked: trackedFiles
+			});
+			if (content !== void 0) files[source] = content;
+			else diagnostics.push({
+				rule: "configuration",
+				path: source,
+				line: 1,
+				message: "TypeScript source API evidence must be tracked, readable, regular and free of symlinks"
+			});
+		}
+	}
 	const cloud = configuration.cloud;
 	const script = files[cloudSetupPath];
 	if (cloud === void 0 && trackedFiles.has(".agents/cloud-setup.sh")) diagnostics.push({
@@ -4223,6 +4387,7 @@ const checkToolchain = ({ root, policy: sharedPolicy, onDelegated, onWarning, no
 			trackedFiles
 		}));
 	}
+	const usedRustFixtures = /* @__PURE__ */ new Set();
 	for (const [file, text] of Object.entries(files)) diagnostics.push(...checkRuntimeFile({
 		file,
 		text,
@@ -4235,6 +4400,8 @@ const checkToolchain = ({ root, policy: sharedPolicy, onDelegated, onWarning, no
 		},
 		trackedFiles,
 		rustExceptions: configuration.rustExceptions,
+		rustInstallFixtures: configuration.rustInstallFixtures,
+		onRustInstallFixture: (entry) => usedRustFixtures.add(entry),
 		dynamicSelectors: dynamicSelectors.filter((entry) => entry.path === file),
 		onDynamicSelector: (entry) => selectorMatches.set(entry, (selectorMatches.get(entry) ?? 0) + 1),
 		repository,
@@ -4246,6 +4413,12 @@ const checkToolchain = ({ root, policy: sharedPolicy, onDelegated, onWarning, no
 		},
 		readFile: (target) => files[target]
 	}));
+	for (const entry of configuration.rustInstallFixtures) if (!usedRustFixtures.has(entry)) diagnostics.push({
+		rule: "configuration",
+		path: "stll-toolchain.json",
+		line: 1,
+		message: `Rust install fixture ${entry.path}:${entry.pin} must match a tracked rustup toolchain install probe`
+	});
 	for (const entry of engineFloors) if (!exercisedFloors.has(entry) || mismatchedFloors.has(entry)) diagnostics.push({
 		rule: "configuration",
 		path: "stll-toolchain.json",