@davidvornholt/standards 0.7.0 → 0.9.0

package/README.md

@@ -12,13 +12,16 @@ standards github --check
 standards github --apply
 ```
 
-`github --check` compares the live GitHub repository (merge settings and rulesets) against the merged declaration in `.github/settings.json` + `.github/settings.local.json`; `github --apply` converges the live repository to exactly the declared state. `check` runs the same comparison whenever `.github/settings.json` is present.
+`github --check` compares the live GitHub repository (merge settings and rulesets) against the merged declaration in `.github/settings.json` + `.github/settings.local.json`; `github --apply` converges the live repository to exactly the declared state. `check` runs the same comparison whenever `.github/settings.json` is present. A repository whose GitHub plan cannot enforce rulesets can declare that in the seam (see `rulesetEnforcement` below); both commands then skip rulesets, still converge repository merge settings, and print an unprotected-branch notice on every run.
 
 `structure` enforces the canonical monorepo structure contract: workspace scripts (`check-types`, `lint`, `lint:fix`, `test`), root gate scripts, filtered Turbo convenience aliases, internal `0.0.0`/`workspace:*` versioning, package `exports`, shared tsconfig inheritance, and browser a11y wiring. Only a workspace containing an explicit `*.a11y.ts` suite must provide a `test:a11y` script and direct `@axe-core/playwright` and `@playwright/test` dependencies. `check` includes `structure`, so these rules gate every consumer PR.
 
+`structure --profile source` validates the standards source repository itself, which is deliberately not a consumer. The profile pins its intentional exceptions so they cannot drift silently: exact, ordered root gate scripts that run this CLI from the local checkout (`structure --profile source`, `github --check`, and the Turbo gate) instead of a recursive `standards check`, and a non-private published bin-only CLI workspace that carries a stable release SemVer and exactly maps the `standards` bin to `src/cli.ts` without `exports`. Every other consumer rule still applies.
+
 ## Configuration
 
 - **`sync-standards.local.json`** (optional) — consumer-owned sync policy at the repo root, validated by `doctor`/`check` and every `init`/`sync` even when an explicit ref or local source makes its `"ref"` irrelevant. All fields optional; a missing file means the defaults. `"ref"` is a non-empty single-line string that pins a tag, branch, or full commit sha to sync from instead of `main` (an explicit `--ref` overrides it; a local-path `--from` source is used as-is and ignores only the validated pin). `"autoSync": false` is read by the standards-sync workflow, not the CLI, and skips the weekly scheduled run. Version 0.7.0 removes the legacy `STANDARDS_AUTO_SYNC` and `STANDARDS_SYNC_REF` variable behavior; consumers must upgrade the package and lockfile before adopting a policy file.
+- **`.github/settings.local.json` `"rulesetEnforcement": "unavailable-on-plan"`** (optional) — declares that the repository's GitHub plan cannot enforce rulesets (private repositories on GitHub Free, both personal accounts and organizations). `github --check` and `--apply` then skip rulesets instead of comparing them, because a comparison cannot be trusted there: personal accounts answer ruleset reads with HTTP 403, and free-plan organizations report declared rulesets as active while silently not enforcing them. Repository merge settings are still checked and converged, and both commands print an unprotected-branch notice on every run. The only accepted value is `"unavailable-on-plan"` (enforcement is the default; omit the key on paid plans), and combining the opt-out with additional local rulesets is rejected. After upgrading the plan, remove the declaration and run `bun standards github --apply` to restore enforcement.
 - **`GH_TOKEN` / `GITHUB_TOKEN`** (optional) — GitHub API token for the `github` command and the GitHub portion of `check`. When neither is set, the token from the local `gh` CLI is used; with no token at all, reads still work on public repositories. `--apply` and private-repo reads need an authenticated token, and repo merge settings are only visible (and thus verifiable) to admin tokens — non-admin runs report them as unverifiable.
 
 See the standards repository README for the ownership model and adoption workflow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidvornholt/standards",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Bootstrap, synchronize, and validate davidvornholt/standards consumers",
   "license": "MIT",
   "repository": {
@@ -22,10 +22,14 @@
     "src/cli.ts",
     "src/github-api.ts",
     "src/github-apply.ts",
+    "src/github-command-shared.ts",
     "src/github-commands.ts",
     "src/github-diff.ts",
+    "src/github-settings-parse.ts",
     "src/github-settings.ts",
     "src/structure-check.ts",
+    "src/structure-profile.ts",
+    "src/structure-script.ts",
     "src/structure-workspace.ts"
   ],
   "scripts": {

package/src/cli.ts

@@ -36,7 +36,8 @@ import { CANONICAL_SETTINGS_FILE, LOCAL_SETTINGS_FILE } from './github-api';
 import { runGithubApply, runGithubCheck } from './github-commands';
 import { loadGithubSettings } from './github-settings';
 import { collectStructureProblems } from './structure-check';
-import { hasSafeCommand } from './structure-workspace';
+import type { StructureProfile } from './structure-profile';
+import { hasSafeCommand } from './structure-script';
 
 const { YAML: BunYaml } = await import('bun');
 
@@ -92,6 +93,7 @@ type CliOptions = {
   readonly from: string | undefined;
   readonly ref: string | undefined;
   readonly apply: boolean;
+  readonly profile: StructureProfile;
 };
 
 const sha256 = (buf: Buffer): string =>
@@ -491,7 +493,7 @@ const runCheck = async (consumer: string): Promise<boolean> => {
   const problems = results.filter((p): p is string => p !== null);
   if (problems.length > 0) {
     console.error(
-      `standards: ${problems.length} canonical file(s) drifted from upstream:`,
+      `standards: ${problems.length} canonical file(s) drifted from the last synced state:`,
     );
     console.error(problems.join('\n'));
     console.error(
@@ -500,7 +502,7 @@ const runCheck = async (consumer: string): Promise<boolean> => {
     return false;
   }
   console.log(
-    `standards: ${Object.keys(lock.files).length} canonical file(s) match upstream`,
+    `standards: ${Object.keys(lock.files).length} canonical file(s) match the last synced state`,
   );
   return true;
 };
@@ -781,6 +783,7 @@ Commands:
 
 Options:
   --dir <path>   Consumer directory to operate on (default: current directory)
+  --profile <p>  With structure: validate as a "consumer" (default) or as the standards "source" repository itself
   --from <src>   Upstream override for init/sync (GitHub repo or local path)
   --ref <ref>    Upstream tag, branch, or full commit sha for init/sync (remote Git/GitHub sources only; default: main)
   --dry-run      Preview a sync without writing anything
@@ -811,6 +814,13 @@ const setCommand = (current: Command | undefined, next: Command): Command => {
   return next;
 };
 
+const structureProfileOf = (value: string): StructureProfile => {
+  if (value === 'consumer' || value === 'source') {
+    return value;
+  }
+  throw new Error(`--profile must be "consumer" or "source": ${value}`);
+};
+
 const nextOptionValue = (
   argv: ReadonlyArray<string>,
   index: number,
@@ -830,6 +840,7 @@ const parseArgs = (argv: ReadonlyArray<string>): CliOptions => {
   let ref: string | undefined;
   let checkFlag = false;
   let apply = false;
+  let profile: StructureProfile | undefined;
 
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
@@ -851,6 +862,10 @@ const parseArgs = (argv: ReadonlyArray<string>): CliOptions => {
         from = nextOptionValue(argv, index);
         index += 1;
         break;
+      case '--profile':
+        profile = structureProfileOf(nextOptionValue(argv, index));
+        index += 1;
+        break;
       case '--ref':
         ref = nextOptionValue(argv, index);
         index += 1;
@@ -876,6 +891,9 @@ const parseArgs = (argv: ReadonlyArray<string>): CliOptions => {
   if (ref !== undefined && command !== 'init' && command !== 'sync') {
     throw new Error('--ref is only valid with the init and sync commands');
   }
+  if (profile !== undefined && command !== 'structure') {
+    throw new Error('--profile is only valid with the structure command');
+  }
 
   return {
     command,
@@ -884,13 +902,19 @@ const parseArgs = (argv: ReadonlyArray<string>): CliOptions => {
     from,
     ref,
     apply,
+    profile: profile ?? 'consumer',
   };
 };
 
 // Canonical monorepo structure gate: workspace and root script shapes,
 // internal versioning, `exports`, tsconfig inheritance, and a11y wiring.
-const runStructure = async (consumer: string): Promise<boolean> => {
-  const problems = await collectStructureProblems(consumer);
+// The `source` profile instead pins the standards template repository's own
+// deliberate exceptions to the consumer contract.
+const runStructure = async (
+  consumer: string,
+  profile: StructureProfile,
+): Promise<boolean> => {
+  const problems = await collectStructureProblems(consumer, profile);
   if (problems.length > 0) {
     console.error(
       `standards structure: ${problems.length} monorepo structure problem(s):`,
@@ -905,7 +929,7 @@ const runStructure = async (consumer: string): Promise<boolean> => {
 const runCheckCommand = async (consumer: string): Promise<boolean> => {
   const driftIsClean = await runCheck(consumer);
   const integrationIsValid = await runDoctor(consumer);
-  const structureIsValid = await runStructure(consumer);
+  const structureIsValid = await runStructure(consumer, 'consumer');
   // The GitHub gate activates with the synced declaration and then fails
   // closed: once .github/settings.json exists, an unreachable API or an
   // unreadable origin is a failure, not a skip.
@@ -1048,6 +1072,7 @@ const runGateCommand = (
   command: 'check' | 'doctor' | 'github' | 'structure',
   consumer: string,
   apply: boolean,
+  profile: StructureProfile,
 ): Promise<boolean> => {
   if (command === 'check') {
     return runCheckCommand(consumer);
@@ -1056,13 +1081,13 @@ const runGateCommand = (
     return runDoctor(consumer);
   }
   if (command === 'structure') {
-    return runStructure(consumer);
+    return runStructure(consumer, profile);
   }
   return apply ? runGithubApply(consumer) : runGithubCheck(consumer);
 };
 
 const main = async (): Promise<void> => {
-  const { command, consumer, dryRun, from, ref, apply } = parseArgs(
+  const { command, consumer, dryRun, from, ref, apply, profile } = parseArgs(
     process.argv.slice(2),
   );
 
@@ -1088,7 +1113,7 @@ const main = async (): Promise<void> => {
     return;
   }
 
-  if (!(await runGateCommand(command, consumer, apply))) {
+  if (!(await runGateCommand(command, consumer, apply, profile))) {
     process.exitCode = 1;
   }
 };

package/src/github-api.ts

@@ -8,10 +8,10 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import process from 'node:process';
 import {
-  isRecord,
   type LoadedGithubSettings,
   loadGithubSettings,
 } from './github-settings';
+import { isRecord } from './github-settings-parse';
 
 const API_ROOT = 'https://api.github.com';
 
@@ -32,6 +32,7 @@ const quietExec = (
   try {
     const out = execFileSync(file, [...args], {
       encoding: 'utf8',
+      env: process.env,
       stdio: ['ignore', 'pipe', 'ignore'],
     }).trim();
     return out.length > 0 ? out : null;

package/src/github-apply.ts

@@ -10,8 +10,40 @@ import {
   HTTP_OK,
   request,
 } from './github-api';
-import { diffRuleset } from './github-diff';
-import type { GithubSettings } from './github-settings';
+import { diffRepositorySettings, diffRuleset } from './github-diff';
+import type { GithubSettings } from './github-settings-parse';
+
+export const applyRepositorySettings = async (
+  token: string,
+  repo: string,
+  repository: Readonly<Record<string, unknown>>,
+  liveRepository: Readonly<Record<string, unknown>>,
+): Promise<ReadonlyArray<string>> => {
+  const diff = diffRepositorySettings(repository, liveRepository);
+  if (diff.drifted.length === 0 && diff.unverifiable.length === 0) {
+    return [];
+  }
+  const patched = await request(token, 'PATCH', `/repos/${repo}`, repository);
+  if (patched.status !== HTTP_OK) {
+    throw new Error(apiError('updating repository settings', patched));
+  }
+  return ['updated repository merge settings'];
+};
+
+export const applySummary = (
+  repo: string,
+  actions: ReadonlyArray<string>,
+  rulesetsSkipped: boolean,
+): string => {
+  if (rulesetsSkipped) {
+    return actions.length === 0
+      ? `standards github: repository settings already converged for ${repo}; rulesets skipped`
+      : `standards github: repository settings apply complete for ${repo}; rulesets skipped`;
+  }
+  return actions.length === 0
+    ? 'standards github: already converged; no changes'
+    : `standards github: apply complete for ${repo}`;
+};
 
 const reconcileRuleset = async (
   token: string,

package/src/github-command-shared.ts

@@ -0,0 +1,11 @@
+import type { GithubSettings } from './github-settings-parse';
+
+export const optOutEligibilityProblem = (
+  repo: string,
+  declared: GithubSettings,
+  liveRepository: Readonly<Record<string, unknown>>,
+): string | null =>
+  declared.rulesetEnforcement === 'unavailable-on-plan' &&
+  liveRepository.private !== true
+    ? `.github/settings.local.json "rulesetEnforcement" may only be declared for a private repository; ${repo} is public`
+    : null;

package/src/github-commands.ts

@@ -12,9 +12,19 @@ import {
   resolveGithubRepo,
   resolveToken,
 } from './github-api';
-import { applyRulesets } from './github-apply';
+import {
+  applyRepositorySettings,
+  applyRulesets,
+  applySummary,
+} from './github-apply';
+import { optOutEligibilityProblem } from './github-command-shared';
 import { diffRepositorySettings, diffRulesets } from './github-diff';
-import { type GithubSettings, isRecord } from './github-settings';
+import { type GithubSettings, isRecord } from './github-settings-parse';
+
+// Printed on every check and apply while the opt-out is declared: the skip
+// must stay louder than the comfort of a green gate.
+const UNENFORCEABLE_NOTICE =
+  'standards github: rulesets are declared unenforceable on this GitHub plan (.github/settings.local.json "rulesetEnforcement"); the default branch is NOT protected. After upgrading the plan, remove the declaration, then run `bun standards github --apply`.';
 
 const reportProblems = (problems: ReadonlyArray<string>): void => {
   console.error(
@@ -23,6 +33,53 @@ const reportProblems = (problems: ReadonlyArray<string>): void => {
   console.error(problems.map((problem) => `  - ${problem}`).join('\n'));
 };
 
+const repositoryDrift = async (
+  token: string | null,
+  repo: string,
+  declared: GithubSettings,
+): Promise<ReadonlyArray<string>> => {
+  const repoResponse = await request(token, 'GET', `/repos/${repo}`);
+  if (repoResponse.status !== HTTP_OK || !isRecord(repoResponse.body)) {
+    return [apiError(`reading repository ${repo}`, repoResponse)];
+  }
+  const eligibilityProblem = optOutEligibilityProblem(
+    repo,
+    declared,
+    repoResponse.body,
+  );
+  if (eligibilityProblem !== null) {
+    return [eligibilityProblem];
+  }
+  const diff = diffRepositorySettings(declared.repository, repoResponse.body);
+  if (diff.unverifiable.length > 0) {
+    console.log(
+      `standards github: repository setting(s) not visible to this token, verify with admin auth: ${diff.unverifiable.join(', ')}`,
+    );
+  }
+  return diff.drifted;
+};
+
+const rulesetDrift = async (
+  token: string | null,
+  repo: string,
+  declared: GithubSettings,
+): Promise<ReadonlyArray<string>> => {
+  if (declared.rulesetEnforcement === 'unavailable-on-plan') {
+    return [];
+  }
+  const live = await fetchLiveRulesets(token, repo);
+  if (live.rulesets === null) {
+    return [live.problem ?? 'unable to read rulesets'];
+  }
+  const diff = diffRulesets(declared.rulesets, live.rulesets);
+  if (diff.unverifiable.length > 0) {
+    console.log(
+      `standards github: ruleset field(s) not visible to this token, verify with admin auth: ${diff.unverifiable.join('; ')}`,
+    );
+  }
+  return diff.drifted;
+};
+
 const collectLiveDrift = async (
   consumer: string,
   declared: GithubSettings,
@@ -32,45 +89,23 @@ const collectLiveDrift = async (
     return ['cannot determine the GitHub repository from the origin remote'];
   }
   const token = resolveToken();
-  const problems: Array<string> = [];
   try {
-    const repoResponse = await request(token, 'GET', `/repos/${repo}`);
-    if (repoResponse.status !== HTTP_OK || !isRecord(repoResponse.body)) {
-      problems.push(apiError(`reading repository ${repo}`, repoResponse));
-    } else {
-      const diff = diffRepositorySettings(
-        declared.repository,
-        repoResponse.body,
-      );
-      problems.push(...diff.drifted);
-      if (diff.unverifiable.length > 0) {
-        console.log(
-          `standards github: repository setting(s) not visible to this token, verify with admin auth: ${diff.unverifiable.join(', ')}`,
-        );
-      }
-    }
-    const live = await fetchLiveRulesets(token, repo);
-    if (live.rulesets === null) {
-      problems.push(live.problem ?? 'unable to read rulesets');
-    } else {
-      const rulesetDiff = diffRulesets(declared.rulesets, live.rulesets);
-      problems.push(...rulesetDiff.drifted);
-      if (rulesetDiff.unverifiable.length > 0) {
-        console.log(
-          `standards github: ruleset field(s) not visible to this token, verify with admin auth: ${rulesetDiff.unverifiable.join('; ')}`,
-        );
-      }
-    }
+    return [
+      ...(await repositoryDrift(token, repo, declared)),
+      ...(await rulesetDrift(token, repo, declared)),
+    ];
   } catch (error) {
-    problems.push(
+    return [
       `GitHub API unreachable: ${error instanceof Error ? error.message : String(error)}`,
-    );
+    ];
   }
-  return problems;
 };
 
 export const runGithubCheck = async (consumer: string): Promise<boolean> => {
   const declared = await loadDeclared(consumer);
+  if (declared.merged?.rulesetEnforcement === 'unavailable-on-plan') {
+    console.log(UNENFORCEABLE_NOTICE);
+  }
   const problems = [...declared.problems];
   if (declared.merged !== null) {
     problems.push(...(await collectLiveDrift(consumer, declared.merged)));
@@ -83,13 +118,18 @@ export const runGithubCheck = async (consumer: string): Promise<boolean> => {
     return false;
   }
   console.log(
-    'standards github: live GitHub settings match the declared configuration',
+    declared.merged?.rulesetEnforcement === 'unavailable-on-plan'
+      ? 'standards github: live repository settings match the declared configuration (rulesets skipped)'
+      : 'standards github: live GitHub settings match the declared configuration',
   );
   return true;
 };
 
 export const runGithubApply = async (consumer: string): Promise<boolean> => {
   const declared = await loadDeclared(consumer);
+  if (declared.merged?.rulesetEnforcement === 'unavailable-on-plan') {
+    console.log(UNENFORCEABLE_NOTICE);
+  }
   if (declared.merged === null || declared.problems.length > 0) {
     reportProblems(declared.problems);
     return false;
@@ -109,36 +149,35 @@ export const runGithubApply = async (consumer: string): Promise<boolean> => {
     return false;
   }
   try {
-    const actions: Array<string> = [];
     const repoResponse = await request(token, 'GET', `/repos/${repo}`);
     if (repoResponse.status !== HTTP_OK || !isRecord(repoResponse.body)) {
       throw new Error(apiError(`reading repository ${repo}`, repoResponse));
     }
-    const diff = diffRepositorySettings(
-      declared.merged.repository,
+    const eligibilityProblem = optOutEligibilityProblem(
+      repo,
+      declared.merged,
       repoResponse.body,
     );
-    if (diff.drifted.length > 0 || diff.unverifiable.length > 0) {
-      const patched = await request(
+    if (eligibilityProblem !== null) {
+      throw new Error(eligibilityProblem);
+    }
+    const actions = [
+      ...(await applyRepositorySettings(
         token,
-        'PATCH',
-        `/repos/${repo}`,
+        repo,
         declared.merged.repository,
-      );
-      if (patched.status !== HTTP_OK) {
-        throw new Error(apiError('updating repository settings', patched));
-      }
-      actions.push('updated repository merge settings');
+        repoResponse.body,
+      )),
+    ];
+    const rulesetsSkipped =
+      declared.merged.rulesetEnforcement === 'unavailable-on-plan';
+    if (!rulesetsSkipped) {
+      actions.push(...(await applyRulesets(token, repo, declared.merged)));
     }
-    actions.push(...(await applyRulesets(token, repo, declared.merged)));
     for (const action of actions) {
       console.log(`  ${action}`);
     }
-    console.log(
-      actions.length === 0
-        ? 'standards github: already converged; no changes'
-        : `standards github: apply complete for ${repo}`,
-    );
+    console.log(applySummary(repo, actions, rulesetsSkipped));
     return true;
   } catch (error) {
     console.error(

package/src/github-diff.ts

@@ -1,7 +1,7 @@
 // Drift comparison between declared GitHub settings (github-settings.ts) and
 // the live state returned by the GitHub API. Pure logic; no network.
 
-import { isRecord } from './github-settings';
+import { isRecord } from './github-settings-parse';
 
 export type SettingsDiff = {
   readonly drifted: ReadonlyArray<string>;

package/src/github-settings-parse.ts

@@ -0,0 +1,120 @@
+// Shape parsing for a single declarative GitHub settings file: the canonical
+// `.github/settings.json` or the repo-owned `.github/settings.local.json`
+// extension. Seam merging lives in github-settings.ts, drift comparison in
+// github-diff.ts, and the API interaction in github-api.ts. Like cli.ts, this
+// module is zero-dependency so `bunx` can execute the published package.
+
+// GitHub only enforces rulesets on private repositories on paid plans. The
+// seam can declare that fact so the gate skips rulesets loudly instead of
+// failing closed forever (personal accounts) or trusting rulesets the API
+// reports as active but a free-plan organization silently does not enforce.
+export type RulesetEnforcement = 'enforced' | 'unavailable-on-plan';
+
+export type GithubSettings = {
+  readonly repository: Readonly<Record<string, unknown>>;
+  readonly rulesets: ReadonlyArray<Readonly<Record<string, unknown>>>;
+  readonly rulesetEnforcement: RulesetEnforcement;
+};
+
+export type ParsedGithubSettings = {
+  readonly repository: Readonly<Record<string, unknown>> | null;
+  readonly rulesets: ReadonlyArray<unknown> | null;
+  readonly rulesetEnforcement: RulesetEnforcement | null;
+};
+
+export const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value);
+
+export const isNamedRuleset = (
+  value: unknown,
+): value is Readonly<Record<string, unknown>> & { readonly name: string } =>
+  isRecord(value) && typeof value.name === 'string' && value.name.length > 0;
+
+export const SETTINGS_KEYS: ReadonlySet<string> = new Set([
+  'repository',
+  'rulesets',
+]);
+export const LOCAL_SETTINGS_KEYS: ReadonlySet<string> = new Set([
+  ...SETTINGS_KEYS,
+  'rulesetEnforcement',
+]);
+
+export const ENFORCEMENT_OPT_OUT = 'unavailable-on-plan';
+
+export type ParseResult = {
+  readonly settings: ParsedGithubSettings | null;
+  readonly problems: ReadonlyArray<string>;
+};
+
+const parseRulesetEnforcement = (value: unknown): RulesetEnforcement | null => {
+  if (value === undefined) {
+    return 'enforced';
+  }
+  return value === ENFORCEMENT_OPT_OUT ? ENFORCEMENT_OPT_OUT : null;
+};
+
+const rulesetListProblems = (
+  rulesets: ReadonlyArray<unknown>,
+  label: string,
+): ReadonlyArray<string> => {
+  const problems: Array<string> = [];
+  const names = new Set<string>();
+  for (const [index, ruleset] of rulesets.entries()) {
+    if (!isNamedRuleset(ruleset)) {
+      problems.push(
+        `${label} rulesets[${index}] must be an object with a non-empty "name"`,
+      );
+    } else if (names.has(ruleset.name)) {
+      problems.push(
+        `${label} declares ruleset "${ruleset.name}" more than once`,
+      );
+    } else {
+      names.add(ruleset.name);
+    }
+  }
+  return problems;
+};
+
+export const parseSettings = (
+  raw: unknown,
+  label: string,
+  allowedKeys: ReadonlySet<string>,
+): ParseResult => {
+  if (!isRecord(raw)) {
+    return { settings: null, problems: [`${label} must be a JSON object`] };
+  }
+  const problems: Array<string> = [];
+  for (const key of Object.keys(raw)) {
+    if (!allowedKeys.has(key)) {
+      problems.push(`${label} has unknown key "${key}"`);
+    }
+  }
+  const repository = raw.repository ?? {};
+  if (!isRecord(repository)) {
+    problems.push(`${label} "repository" must be an object`);
+  }
+  const rulesets = raw.rulesets ?? [];
+  if (Array.isArray(rulesets)) {
+    problems.push(...rulesetListProblems(rulesets, label));
+  } else {
+    problems.push(`${label} "rulesets" must be an array`);
+  }
+  // Only the opt-out value is accepted: enforcement is the default, and an
+  // explicit "enforced" would be a second way to spell the same state.
+  if (
+    raw.rulesetEnforcement !== undefined &&
+    raw.rulesetEnforcement !== ENFORCEMENT_OPT_OUT
+  ) {
+    problems.push(
+      `${label} "rulesetEnforcement" must be "${ENFORCEMENT_OPT_OUT}" when present; omit it on plans where GitHub enforces rulesets`,
+    );
+  }
+  return {
+    settings: {
+      repository: isRecord(repository) ? repository : null,
+      rulesets: Array.isArray(rulesets) ? rulesets : null,
+      rulesetEnforcement: parseRulesetEnforcement(raw.rulesetEnforcement),
+    },
+    problems,
+  };
+};

package/src/github-settings.ts

@@ -1,125 +1,134 @@
-// Declarative GitHub repository settings: parsing and seam merging for the
-// canonical `.github/settings.json` and the repo-owned
-// `.github/settings.local.json` extension. Pure logic only; drift comparison
-// lives in github-diff.ts and the API interaction in github-api.ts. Like
-// cli.ts, this module is zero-dependency so `bunx` can execute the published
-// package.
+// Merge canonical GitHub settings with the repo-owned extension. Parsing,
+// drift, and API work live in named modules; this stays dependency-free.
 
-export type GithubSettings = {
-  readonly repository: Readonly<Record<string, unknown>>;
-  readonly rulesets: ReadonlyArray<Readonly<Record<string, unknown>>>;
-};
+import {
+  ENFORCEMENT_OPT_OUT,
+  type GithubSettings,
+  isNamedRuleset,
+  LOCAL_SETTINGS_KEYS,
+  type ParsedGithubSettings,
+  parseSettings,
+  SETTINGS_KEYS,
+} from './github-settings-parse';
 
 export type LoadedGithubSettings = {
   readonly merged: GithubSettings | null;
   readonly problems: ReadonlyArray<string>;
 };
 
-export const isRecord = (value: unknown): value is Record<string, unknown> =>
-  typeof value === 'object' && value !== null && !Array.isArray(value);
-
-const SETTINGS_KEYS = new Set(['repository', 'rulesets']);
-
-type ParseResult = {
-  readonly settings: GithubSettings | null;
-  readonly problems: ReadonlyArray<string>;
+const completeSettings = (
+  parsed: ParsedGithubSettings | null,
+): GithubSettings | null => {
+  if (
+    parsed === null ||
+    parsed.repository === null ||
+    parsed.rulesets === null ||
+    parsed.rulesetEnforcement === null
+  ) {
+    return null;
+  }
+  const rulesets = parsed.rulesets.filter(isNamedRuleset);
+  if (rulesets.length !== parsed.rulesets.length) {
+    return null;
+  }
+  return {
+    repository: parsed.repository,
+    rulesets,
+    rulesetEnforcement: parsed.rulesetEnforcement,
+  };
 };
 
-const rulesetListProblems = (
-  rulesets: ReadonlyArray<unknown>,
-  label: string,
+const enforcementMergeProblems = (
+  local: ParsedGithubSettings | null,
 ): ReadonlyArray<string> => {
-  const problems: Array<string> = [];
-  const names = new Set<string>();
-  for (const [index, ruleset] of rulesets.entries()) {
-    if (
-      !(
-        isRecord(ruleset) &&
-        typeof ruleset.name === 'string' &&
-        ruleset.name.length > 0
-      )
-    ) {
-      problems.push(
-        `${label} rulesets[${index}] must be an object with a non-empty "name"`,
-      );
-    } else if (names.has(ruleset.name)) {
-      problems.push(
-        `${label} declares ruleset "${ruleset.name}" more than once`,
-      );
-    } else {
-      names.add(ruleset.name);
-    }
+  if (
+    local?.rulesetEnforcement !== ENFORCEMENT_OPT_OUT ||
+    local.rulesets === null ||
+    local.rulesets.length === 0
+  ) {
+    return [];
   }
-  return problems;
+  return [
+    `.github/settings.local.json declares additional rulesets while "rulesetEnforcement" is "${ENFORCEMENT_OPT_OUT}"; remove the rulesets or the opt-out`,
+  ];
 };
 
-const parseSettings = (raw: unknown, label: string): ParseResult => {
-  if (!isRecord(raw)) {
-    return { settings: null, problems: [`${label} must be a JSON object`] };
-  }
-  const problems: Array<string> = [];
-  for (const key of Object.keys(raw)) {
-    if (!SETTINGS_KEYS.has(key)) {
-      problems.push(`${label} has unknown key "${key}"`);
-    }
-  }
-  const repository = raw.repository ?? {};
-  if (!isRecord(repository)) {
-    problems.push(`${label} "repository" must be an object`);
-  }
-  const rulesets = raw.rulesets ?? [];
-  if (Array.isArray(rulesets)) {
-    problems.push(...rulesetListProblems(rulesets, label));
-  } else {
-    problems.push(`${label} "rulesets" must be an array`);
-  }
-  if (problems.length > 0) {
-    return { settings: null, problems };
+const repositoryMergeProblems = (
+  canonical: ParsedGithubSettings | null,
+  local: ParsedGithubSettings | null,
+): ReadonlyArray<string> => {
+  if (
+    canonical === null ||
+    canonical.repository === null ||
+    local === null ||
+    local.repository === null
+  ) {
+    return [];
   }
-  return {
-    settings: {
-      repository: repository as Record<string, unknown>,
-      rulesets: rulesets as ReadonlyArray<Record<string, unknown>>,
-    },
-    problems: [],
-  };
+  const canonicalRepository = canonical.repository;
+  return Object.keys(local.repository)
+    .filter((key) => key in canonicalRepository)
+    .map(
+      (key) =>
+        `.github/settings.local.json repository."${key}" would override a canonical value; canonical settings are read-only`,
+    );
 };
 
-type MergeResult = {
-  readonly merged: GithubSettings | null;
-  readonly problems: ReadonlyArray<string>;
+const rulesetMergeProblems = (
+  canonical: ParsedGithubSettings | null,
+  local: ParsedGithubSettings | null,
+): ReadonlyArray<string> => {
+  if (
+    canonical === null ||
+    canonical.rulesets === null ||
+    local === null ||
+    local.rulesets === null
+  ) {
+    return [];
+  }
+  const canonicalNames = new Set(
+    canonical.rulesets.filter(isNamedRuleset).map((ruleset) => ruleset.name),
+  );
+  return local.rulesets
+    .filter(isNamedRuleset)
+    .filter((ruleset) => canonicalNames.has(ruleset.name))
+    .map(
+      (ruleset) =>
+        `.github/settings.local.json ruleset "${ruleset.name}" collides with a canonical ruleset; add a separately named ruleset to tighten further`,
+    );
 };
 
 // The seam may only add. Overriding a canonical repository key or redefining a
 // canonical ruleset could weaken the canonical floor; GitHub layers multiple
-// rulesets strictest-wins, so adding a ruleset is always safe.
+// rulesets strictest-wins, so adding a ruleset is always safe. The one
+// subtractive declaration is the ruleset-enforcement opt-out, which skips the
+// ruleset gate entirely rather than weakening any single rule.
 const mergeSettings = (
-  canonical: GithubSettings,
-  local: GithubSettings,
-): MergeResult => {
-  const problems: Array<string> = [];
-  for (const key of Object.keys(local.repository)) {
-    if (key in canonical.repository) {
-      problems.push(
-        `.github/settings.local.json repository."${key}" would override a canonical value; canonical settings are read-only`,
-      );
-    }
-  }
-  const canonicalNames = new Set(canonical.rulesets.map((r) => r.name));
-  for (const ruleset of local.rulesets) {
-    if (canonicalNames.has(ruleset.name)) {
-      problems.push(
-        `.github/settings.local.json ruleset "${ruleset.name}" collides with a canonical ruleset; add a separately named ruleset to tighten further`,
-      );
-    }
-  }
-  if (problems.length > 0) {
+  canonical: ParsedGithubSettings | null,
+  local: ParsedGithubSettings | null,
+) => {
+  const problems = [
+    ...enforcementMergeProblems(local),
+    ...repositoryMergeProblems(canonical, local),
+    ...rulesetMergeProblems(canonical, local),
+  ];
+  const completeCanonical = completeSettings(canonical);
+  const completeLocal = completeSettings(local);
+  if (
+    problems.length > 0 ||
+    completeCanonical === null ||
+    completeLocal === null
+  ) {
     return { merged: null, problems };
   }
   return {
     merged: {
-      repository: { ...canonical.repository, ...local.repository },
-      rulesets: [...canonical.rulesets, ...local.rulesets],
+      repository: {
+        ...completeCanonical.repository,
+        ...completeLocal.repository,
+      },
+      rulesets: [...completeCanonical.rulesets, ...completeLocal.rulesets],
+      rulesetEnforcement: completeLocal.rulesetEnforcement,
     },
     problems: [],
   };
@@ -160,15 +169,32 @@ export const loadGithubSettings = (
   if (localJson !== null && localJson.problem !== null) {
     problems.push(localJson.problem);
   }
-  if (problems.length > 0) {
-    return { merged: null, problems };
+  const canonical =
+    canonicalJson.problem === null
+      ? parseSettings(
+          canonicalJson.value,
+          '.github/settings.json',
+          SETTINGS_KEYS,
+        )
+      : null;
+  const local =
+    localJson?.problem === null
+      ? parseSettings(
+          localJson.value,
+          '.github/settings.local.json',
+          LOCAL_SETTINGS_KEYS,
+        )
+      : null;
+  if (canonical !== null) {
+    problems.push(...canonical.problems);
   }
-  const canonical = parseSettings(canonicalJson.value, '.github/settings.json');
-  const local = parseSettings(localJson?.value, '.github/settings.local.json');
-  problems.push(...canonical.problems, ...local.problems);
-  if (canonical.settings === null || local.settings === null) {
-    return { merged: null, problems };
+  if (local !== null) {
+    problems.push(...local.problems);
   }
-  const merged = mergeSettings(canonical.settings, local.settings);
-  return { merged: merged.merged, problems: [...problems, ...merged.problems] };
+  const merged = mergeSettings(
+    canonical?.settings ?? null,
+    local?.settings ?? null,
+  );
+  problems.push(...merged.problems);
+  return { merged: problems.length === 0 ? merged.merged : null, problems };
 };

package/src/structure-check.ts

@@ -1,24 +1,18 @@
 import { existsSync } from 'node:fs';
 import { readdir, readFile } from 'node:fs/promises';
 import { isAbsolute, join } from 'node:path';
-import { isRecord } from './github-settings';
+import { isRecord } from './github-settings-parse';
 import {
-  hasSafeCommand,
-  inspectWorkspace,
-  isSafeFilteredTurboAlias,
-  type Workspace,
-} from './structure-workspace';
+  missingPublishedCliProblems,
+  rootScriptExpectations,
+  type StructureProfile,
+} from './structure-profile';
+import { hasSafeCommands, isSafeFilteredTurboAlias } from './structure-script';
+import { inspectWorkspace, type Workspace } from './structure-workspace';
 
-const ROOT_CHECK = 'turbo run lint check-types test build test:a11y';
-const ROOT_CHECK_FIX = 'turbo run lint:fix check-types test build test:a11y';
-const ROOT_A11Y = 'turbo run test:a11y';
-
-const ROOT_FIXED_SCRIPTS = new Set([
-  'standards',
-  'check',
-  'check:fix',
-  'test:a11y',
-]);
+const ROOT_FIXED_SCRIPTS = new Set(
+  'standards,check,check:fix,test:a11y'.split(','),
+);
 const GLOB_SUFFIX = '/*';
 const WORKSPACES_REQUIREMENT =
   'package.json: "workspaces" must be a non-empty array of literal paths or one-level "<dir>/*" patterns';
@@ -136,19 +130,20 @@ const loadWorkspace = async (
 };
 const inspectRootScripts = (
   root: Record<string, unknown>,
+  profile: StructureProfile,
   requireA11y: boolean,
 ): ReadonlyArray<string> => {
   const scripts = isRecord(root.scripts) ? root.scripts : {};
-  const expectations: ReadonlyArray<readonly [string, string]> = [
-    ['check', ROOT_CHECK],
-    ['check:fix', ROOT_CHECK_FIX],
-    ...(requireA11y ? [['test:a11y', ROOT_A11Y] as const] : []),
-  ];
-  const gateProblems = expectations.flatMap(([name, fragment]) => {
+  const expectations = rootScriptExpectations(profile, requireA11y);
+  const gateProblems = expectations.flatMap(({ name, commands, exact }) => {
     const { [name]: script } = scripts;
-    return typeof script === 'string' && hasSafeCommand(script, fragment)
+    const requirement = commands.join(' && ');
+    return typeof script === 'string' &&
+      hasSafeCommands(script, commands, exact)
       ? []
-      : [`package.json: root script "${name}" must run ${fragment}`];
+      : [
+          `package.json: root script "${name}" must run ${exact ? 'exactly ' : ''}${requirement}`,
+        ];
   });
   const aliasProblems = Object.entries(scripts).flatMap(([name, script]) =>
     ROOT_FIXED_SCRIPTS.has(name) ||
@@ -163,6 +158,7 @@ const inspectRootScripts = (
 };
 export const collectStructureProblems = async (
   consumer: string,
+  profile: StructureProfile,
 ): Promise<ReadonlyArray<string>> => {
   const root = await readJson(join(consumer, 'package.json'));
   if (root === null) {
@@ -185,14 +181,15 @@ export const collectStructureProblems = async (
       .filter((name): name is string => typeof name === 'string'),
   );
   const inspections = await Promise.all(
-    workspaces.map((ws) => inspectWorkspace(ws, workspaceNames)),
+    workspaces.map((ws) => inspectWorkspace(ws, workspaceNames, profile)),
   );
   const requireA11y = inspections.some((i) => i.hasA11ySuite);
   return [
     ...declaration.problems,
     ...resolved.flatMap((r) => (r.problem === null ? [] : [r.problem])),
     ...loaded.flatMap((l) => (l.problem === null ? [] : [l.problem])),
-    ...inspectRootScripts(root, requireA11y),
+    ...missingPublishedCliProblems(profile, workspaces),
+    ...inspectRootScripts(root, profile, requireA11y),
     ...inspections.flatMap((i) => [...i.problems]),
   ];
 };

package/src/structure-profile.ts

@@ -0,0 +1,129 @@
+import { isRecord } from './github-settings-parse';
+
+// Structure validation profiles. `consumer` is the contract every downstream
+// repo satisfies. `source` is the standards template repository itself, which
+// is deliberately not a consumer: its root gate runs the local CLI instead of
+// a recursive `standards check`, and it publishes the CLI workspace as a
+// released bin-only package. Pinning those exceptions here keeps them from
+// drifting silently while the normal quality gate stays green.
+export type StructureProfile = 'consumer' | 'source';
+
+const CONSUMER_CHECK = 'turbo run lint check-types test build test:a11y';
+const CONSUMER_CHECK_FIX =
+  'turbo run lint:fix check-types test build test:a11y';
+const ROOT_A11Y = 'turbo run test:a11y';
+
+export const PUBLISHED_CLI_WORKSPACE = 'packages/standards-cli';
+const PUBLISHED_CLI_PACKAGE = '@davidvornholt/standards';
+const SOURCE_CLI = `bun ${PUBLISHED_CLI_WORKSPACE}/src/cli.ts`;
+const RELEASE_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u;
+
+export type RootScriptExpectation = {
+  readonly name: string;
+  readonly commands: ReadonlyArray<string>;
+  readonly exact: boolean;
+};
+
+const SOURCE_ROOT_EXPECTATIONS: ReadonlyArray<RootScriptExpectation> = [
+  { name: 'standards', commands: [SOURCE_CLI], exact: true },
+  {
+    name: 'check',
+    commands: [
+      `${SOURCE_CLI} structure --profile source`,
+      `${SOURCE_CLI} github --check`,
+      'turbo run lint check-types test',
+    ],
+    exact: true,
+  },
+  {
+    name: 'check:fix',
+    commands: [
+      `${SOURCE_CLI} structure --profile source`,
+      `${SOURCE_CLI} github --check`,
+      'turbo run lint:fix check-types test',
+    ],
+    exact: true,
+  },
+];
+
+export const rootScriptExpectations = (
+  profile: StructureProfile,
+  requireA11y: boolean,
+): ReadonlyArray<RootScriptExpectation> => [
+  ...(profile === 'source'
+    ? SOURCE_ROOT_EXPECTATIONS
+    : [
+        { name: 'check', commands: [CONSUMER_CHECK], exact: false },
+        { name: 'check:fix', commands: [CONSUMER_CHECK_FIX], exact: false },
+      ]),
+  ...(requireA11y
+    ? [{ name: 'test:a11y', commands: [ROOT_A11Y], exact: false }]
+    : []),
+];
+
+// The published CLI ships as a released bin-only package: it carries a release
+// SemVer instead of the internal "0.0.0" and exposes its public API through
+// "bin" instead of "exports". Everything else follows the normal rules.
+const inspectPublishedCli = (
+  manifest: Record<string, unknown>,
+): ReadonlyArray<string> => [
+  ...(manifest.name === PUBLISHED_CLI_PACKAGE
+    ? []
+    : [
+        `${PUBLISHED_CLI_WORKSPACE}: published CLI package name must be "${PUBLISHED_CLI_PACKAGE}"`,
+      ]),
+  ...(typeof manifest.version === 'string' &&
+  manifest.version !== '0.0.0' &&
+  RELEASE_SEMVER.test(manifest.version)
+    ? []
+    : [
+        `${PUBLISHED_CLI_WORKSPACE}: published CLI version must be a stable release SemVer, not "0.0.0"`,
+      ]),
+  ...(isRecord(manifest.bin) &&
+  Object.keys(manifest.bin).length === 1 &&
+  manifest.bin.standards === 'src/cli.ts'
+    ? []
+    : [
+        `${PUBLISHED_CLI_WORKSPACE}: published CLI bin must be exactly { "standards": "src/cli.ts" }`,
+      ]),
+  ...(manifest.private === true
+    ? [`${PUBLISHED_CLI_WORKSPACE}: published CLI must not be private`]
+    : []),
+  ...(manifest.exports === undefined
+    ? []
+    : [
+        `${PUBLISHED_CLI_WORKSPACE}: published CLI must be bin-only and must not define "exports"`,
+      ]),
+];
+
+export const inspectVersionAndExports = (
+  profile: StructureProfile,
+  rel: string,
+  manifest: Record<string, unknown>,
+): ReadonlyArray<string> => {
+  if (profile === 'source' && rel === PUBLISHED_CLI_WORKSPACE) {
+    return inspectPublishedCli(manifest);
+  }
+  return [
+    ...(manifest.version === '0.0.0'
+      ? []
+      : [`${rel}: internal workspace version must be "0.0.0"`]),
+    ...(rel.startsWith('packages/') && manifest.exports === undefined
+      ? [`${rel}: package must define its public API with "exports"`]
+      : []),
+  ];
+};
+
+// The source profile only means anything in the repository that owns and
+// publishes the CLI; failing loudly when that workspace is absent keeps the
+// profile from being applied to the wrong repository shape.
+export const missingPublishedCliProblems = (
+  profile: StructureProfile,
+  workspaces: ReadonlyArray<{ readonly rel: string }>,
+): ReadonlyArray<string> =>
+  profile === 'source' &&
+  !workspaces.some((ws) => ws.rel === PUBLISHED_CLI_WORKSPACE)
+    ? [
+        `${PUBLISHED_CLI_WORKSPACE}: the source profile requires the published CLI workspace`,
+      ]
+    : [];

package/src/structure-script.ts

@@ -0,0 +1,63 @@
+const UNSAFE_SCRIPT_SYNTAX = /[|;#"'`\r\n]/u;
+const SCRIPT_WHITESPACE = /\s+/u;
+const NON_EXECUTING_TURBO_OPTION = /^(?:-h|-v|--(?:dry|help|version))(?:=|$)/u;
+
+export const parseSafeCommands = (
+  script: string | null,
+): ReadonlyArray<ReadonlyArray<string>> | null => {
+  if (
+    script === null ||
+    script.trim() === '' ||
+    UNSAFE_SCRIPT_SYNTAX.test(script) ||
+    script.includes('$(')
+  ) {
+    return null;
+  }
+  const commands = script.split('&&').map((command) => command.trim());
+  return commands.some((command) => command === '' || command.includes('&'))
+    ? null
+    : commands.map((command) => command.split(SCRIPT_WHITESPACE));
+};
+
+export const hasSafeCommands = (
+  script: string | null,
+  expected: ReadonlyArray<string>,
+  exact: boolean,
+): boolean => {
+  const commands = parseSafeCommands(script)?.map((tokens) => tokens.join(' '));
+  if (commands === undefined) {
+    return false;
+  }
+  return exact
+    ? commands.length === expected.length &&
+        commands.every((command, index) => command === expected[index])
+    : expected.every((command) => commands.includes(command));
+};
+
+export const hasSafeCommand = (
+  script: string | null,
+  expected: string,
+): boolean => hasSafeCommands(script, [expected], false);
+
+export const isSafeFilteredTurboAlias = (script: string): boolean => {
+  const commands = parseSafeCommands(script);
+  if (commands?.length !== 1) {
+    return false;
+  }
+  const [tokens] = commands;
+  const filterAt = tokens.findIndex(
+    (token) => token === '--filter' || token.startsWith('--filter='),
+  );
+  const filter = tokens[filterAt];
+  const filterValue =
+    filter === '--filter'
+      ? tokens[filterAt + 1]
+      : filter?.slice('--filter='.length);
+  return tokens[0] !== 'turbo' || tokens[1] !== 'run'
+    ? false
+    : tokens[2]?.startsWith('-') === false &&
+        !tokens.some((token) => NON_EXECUTING_TURBO_OPTION.test(token)) &&
+        filterValue !== undefined &&
+        filterValue !== '' &&
+        !filterValue.startsWith('-');
+};

package/src/structure-workspace.ts

@@ -1,6 +1,11 @@
 import { readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { isRecord } from './github-settings';
+import { isRecord } from './github-settings-parse';
+import {
+  inspectVersionAndExports,
+  type StructureProfile,
+} from './structure-profile';
+import { hasSafeCommand, parseSafeCommands } from './structure-script';
 export type Workspace = {
   readonly rel: string;
   readonly dir: string;
@@ -20,11 +25,8 @@ const DEPENDENCY_FIELDS =
 const SHARED_TSCONFIG_PACKAGE = '@davidvornholt/typescript-config';
 const SHARED_TSCONFIG_PATH =
   /^@davidvornholt\/typescript-config\/(?:base|next|react-library)$/u;
-const UNSAFE_SCRIPT_SYNTAX = /[|;#"'`\r\n]/u;
-const SCRIPT_WHITESPACE = /\s+/u;
 const NON_EXECUTING_A11Y_OPTION =
   /^(?:-h|-V|--(?:debug|help|last-failed|list|only-changed|ui|version))(?:=|$)/u;
-const NON_EXECUTING_TURBO_OPTION = /^(?:-h|-v|--(?:dry|help|version))(?:=|$)/u;
 const IGNORED_DIRS = new Set('.git,.next,.turbo,dist,node_modules'.split(','));
 const scriptOf = (
   manifest: Record<string, unknown>,
@@ -34,57 +36,13 @@ const scriptOf = (
   const script = scripts[name];
   return typeof script === 'string' ? script : null;
 };
-const safeCommands = (
-  script: string | null,
-): ReadonlyArray<ReadonlyArray<string>> | null => {
-  if (
-    script === null ||
-    script.trim() === '' ||
-    UNSAFE_SCRIPT_SYNTAX.test(script) ||
-    script.includes('$(')
-  ) {
-    return null;
-  }
-  const commands = script.split('&&').map((command) => command.trim());
-  return commands.some((command) => command === '' || command.includes('&'))
-    ? null
-    : commands.map((command) => command.split(SCRIPT_WHITESPACE));
-};
-export const hasSafeCommand = (
-  script: string | null,
-  expected: string,
-): boolean =>
-  safeCommands(script)?.some((tokens) => tokens.join(' ') === expected) ??
-  false;
 const hasSafeA11yCommand = (script: string | null): boolean =>
-  safeCommands(script)?.some(
+  parseSafeCommands(script)?.some(
     (tokens) =>
       tokens[0] === 'playwright' &&
       tokens[1] === 'test' &&
       tokens.slice(2).every((token) => !NON_EXECUTING_A11Y_OPTION.test(token)),
   ) ?? false;
-export const isSafeFilteredTurboAlias = (script: string): boolean => {
-  const commands = safeCommands(script);
-  if (commands?.length !== 1) {
-    return false;
-  }
-  const [tokens] = commands;
-  const filterAt = tokens.findIndex(
-    (token) => token === '--filter' || token.startsWith('--filter='),
-  );
-  const filter = tokens[filterAt];
-  const filterValue =
-    filter === '--filter'
-      ? tokens[filterAt + 1]
-      : filter?.slice('--filter='.length);
-  return tokens[0] !== 'turbo' || tokens[1] !== 'run'
-    ? false
-    : tokens[2]?.startsWith('-') === false &&
-        !tokens.some((token) => NON_EXECUTING_TURBO_OPTION.test(token)) &&
-        filterValue !== undefined &&
-        filterValue !== '' &&
-        !filterValue.startsWith('-');
-};
 const containsA11ySuite = async (dir: string): Promise<boolean> => {
   const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
   if (
@@ -179,6 +137,7 @@ const inspectA11y = async (
 export const inspectWorkspace = async (
   ws: Workspace,
   workspaceNames: ReadonlySet<string>,
+  profile: StructureProfile,
 ) => {
   const [tsconfigProblems, a11y] = await Promise.all([
     inspectTsconfig(ws),
@@ -186,13 +145,8 @@ export const inspectWorkspace = async (
   ]);
   const problems = [
     ...inspectScripts(ws),
-    ...(ws.manifest.version === '0.0.0'
-      ? []
-      : [`${ws.rel}: internal workspace version must be "0.0.0"`]),
+    ...inspectVersionAndExports(profile, ws.rel, ws.manifest),
     ...inspectInternalDeps(ws, workspaceNames),
-    ...(ws.rel.startsWith('packages/') && ws.manifest.exports === undefined
-      ? [`${ws.rel}: package must define its public API with "exports"`]
-      : []),
     ...tsconfigProblems,
     ...a11y.problems,
   ];