@pho9ubenaa/siro 0.1.3 → 0.2.0

package/dist/node-io-Cb8nixgE.mjs

@@ -0,0 +1,2509 @@
+import pc from "picocolors";
+import ini from "ini";
+import { parse } from "smol-toml";
+import { parseDocument } from "yaml";
+import * as vb from "valibot";
+import { accessSync, constants, readFileSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+//#region src/shared/paths.ts
+/** Tag a string as absolute. The caller vouches for the shape. */
+const asAbsPath = (path) => path;
+/** Tag a string as repo-root-relative. The caller vouches for the shape. */
+const asRelPath = (path) => path;
+
+//#endregion
+//#region src/shared/siro-error.ts
+/**
+* Structured errors used across siro. The CLI maps them to exit codes in one
+* place so individual commands never have to think about exit semantics.
+* The exit-code table lives in docs/configuration.md S"Exit codes" and
+* src/cli/help.ts (HELP_LINT) -- not restated here.
+*
+* One mapping note that belongs at this altitude: filesystem errno errors
+* are routed to 2 by SHAPE (numeric `errno`) in cli run(), so an
+* errno-bearing throw from a user extension also lands on 2 rather than the
+* 70 crash path -- same remedy (fix the environment) either way.
+*/
+var SiroError = class extends Error {
+	/** Recommended process exit code for this error. */
+	exitCode;
+	constructor(message, exitCode) {
+		super(message);
+		this.name = "SiroError";
+		this.exitCode = exitCode;
+	}
+};
+
+//#endregion
+//#region src/shared/config-error.ts
+const CONFIG_EXIT_CODE = 2;
+var ConfigError = class extends SiroError {
+	constructor(message) {
+		super(message, CONFIG_EXIT_CODE);
+		this.name = "ConfigError";
+	}
+};
+
+//#endregion
+//#region src/shared/usage-error.ts
+const USAGE_EXIT_CODE = 2;
+var UsageError = class extends SiroError {
+	constructor(message) {
+		super(message, USAGE_EXIT_CODE);
+		this.name = "UsageError";
+	}
+};
+
+//#endregion
+//#region src/shared/errors.ts
+/**
+* Run `fn` and wrap any non-`ConfigError` failure as a `ConfigError` prefixed
+* with `filePath`. Codec `parse` calls hit raw libraries that
+* throw bare `Error`s; without this wrap the CLI would surface those as
+* exit-1 internal errors and break CI that branches on exit codes. A
+* `ConfigError` that bubbles up from a nested call is re-thrown unchanged so
+* the original `path: message` framing is preserved.
+*/
+const wrapCodecError = (filePath, fn) => {
+	try {
+		return fn();
+	} catch (error) {
+		if (error instanceof ConfigError) throw error;
+		let msg = String(error);
+		if (error instanceof Error) msg = error.message;
+		throw new ConfigError(`${filePath}: ${msg}`);
+	}
+};
+
+//#endregion
+//#region src/domain/entities/pms.ts
+/**
+* Single source of truth for package managers and severities.
+* Types, runtime sets, and ordering are all derived from these tuples — add a
+* package manager here and the rest of the codebase follows.
+*/
+const PMS = [
+	"npm",
+	"pnpm",
+	"yarn",
+	"bun",
+	"deno",
+	"aube"
+];
+const SEVERITIES = [
+	"error",
+	"warn",
+	"info"
+];
+/**
+* Numeric ordering of severities for threshold comparisons. Co-located with
+* `Severity` so `filter`, `runLint`, and any future severity-aware code share
+* one source of truth — drifting the order in one place silently changes the
+* fail-on-threshold contract everywhere.
+*/
+const SEVERITY_RANK = {
+	error: 3,
+	info: 1,
+	warn: 2
+};
+const PM_SET = new Set(PMS);
+const SEVERITY_SET = new Set(SEVERITIES);
+const isPM = (value) => PM_SET.has(value);
+const isSeverity = (value) => SEVERITY_SET.has(value);
+const PACKAGE_MANAGER_FIELD = /^(?<pmName>[a-z]+)(?:@.+)?$/u;
+const parsePackageManagerField = (value) => {
+	const match = PACKAGE_MANAGER_FIELD.exec(value.trim());
+	let name = void 0;
+	if (match && match.groups) name = match.groups.pmName;
+	if (typeof name !== "undefined" && isPM(name)) return name;
+};
+
+//#endregion
+//#region src/domain/ports/reporter.ts
+/**
+* Structural guard for an embedder-supplied reporter. The `Reporter` contract
+* is compile-time only (`defineConfig` / typed options), so a hand-written JS
+* config or a dynamically-built object can still pass a malformed value; this
+* lets each boundary reject it with its own error type before `format` is
+* called on something that isn't a function.
+*/
+const isReporterShape = (value) => {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("name" in value) || typeof value.name !== "string") return false;
+	return "format" in value && typeof value.format === "function";
+};
+
+//#endregion
+//#region src/adapters/reporters/github.ts
+const COMMAND = {
+	error: "error",
+	info: "notice",
+	warn: "warning"
+};
+const escapeProp = (raw) => raw.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A").replaceAll(":", "%3A").replaceAll(",", "%2C");
+const escapeData = (raw) => raw.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+/** Emit GitHub Actions workflow commands (annotations on PRs). */
+const githubReporter = {
+	format(result, io) {
+		for (const finding of result.findings) {
+			let file = "";
+			if (finding.file) file = `file=${escapeProp(finding.file)},`;
+			let body = `[${finding.pm}] ${finding.message}`;
+			if (finding.docs) body = `[${finding.pm}] ${finding.message} (${finding.docs})`;
+			io.stdout(`::${COMMAND[finding.severity]} ${file}title=${escapeProp(finding.ruleId)}::${escapeData(body)}`);
+		}
+	},
+	name: "github"
+};
+
+//#endregion
+//#region src/version.ts
+const version = "0.2.0";
+
+//#endregion
+//#region src/adapters/reporters/json.ts
+/**
+* Versioned machine-readable output — the public contract consumed by
+* external fixers (see docs/json-output.md). Bump `schemaVersion` on any
+* breaking shape change and update that doc in the same commit.
+*/
+const SCHEMA_VERSION = 1;
+const JSON_INDENT = 2;
+const jsonReporter = {
+	format(result, io) {
+		io.stdout(JSON.stringify({
+			schemaVersion: 1,
+			siroVersion: version,
+			...result
+		}, void 0, JSON_INDENT));
+	},
+	name: "json"
+};
+
+//#endregion
+//#region src/adapters/reporters/pretty.ts
+const GLYPH = {
+	error: "✖ error",
+	info: "ℹ info",
+	warn: "⚠ warn"
+};
+/**
+* Decide colour at call time, not at import time.
+*
+* picocolors snapshots `isColorSupported` when imported, so a later
+* `process.env.NO_COLOR = '1'` (or a different stdout) is ignored. The
+* reporter is invoked per `siro lint` run from many contexts (TTY, CI
+* with FORCE_COLOR, redirected output, …) — checking each call is the
+* only way NO_COLOR can truly win, as https://no-color.org/ requires.
+*/
+const colorSupportedNow = () => {
+	const { env } = process;
+	if (typeof env.NO_COLOR !== "undefined" && env.NO_COLOR !== "") return false;
+	if ("FORCE_COLOR" in env) return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "";
+	return pc.isColorSupported;
+};
+const renderFinding = (finding, ctx) => {
+	let where = "";
+	if (finding.file) where = ctx.colors.dim(` (${finding.file})`);
+	ctx.io.stdout(`${ctx.tag[finding.severity](GLYPH[finding.severity])}  [${finding.pm}] ${ctx.colors.bold(finding.ruleId)}${where}`);
+	ctx.io.stdout(`    ${finding.message}`);
+	for (const step of finding.manualSteps ?? []) ctx.io.stdout(`    ↳ ${step}`);
+	if (finding.docs) ctx.io.stdout(ctx.colors.dim(`    → ${finding.docs}`));
+};
+const buildRenderCtx = (io) => {
+	const colors = pc.createColors(colorSupportedNow());
+	return {
+		colors,
+		io,
+		tag: {
+			error: colors.red,
+			info: colors.cyan,
+			warn: colors.yellow
+		}
+	};
+};
+const prettyReporter = {
+	format(result, io) {
+		const ctx = buildRenderCtx(io);
+		if (result.findings.length === 0) {
+			io.stdout(ctx.colors.green("✔ No security best-practice issues found."));
+			return;
+		}
+		for (const finding of result.findings) renderFinding(finding, ctx);
+		const { error, warn, info } = result.summary;
+		io.stdout("");
+		io.stdout(`Summary: ${error} error, ${warn} warn, ${info} info`);
+	},
+	name: "pretty"
+};
+
+//#endregion
+//#region src/adapters/reporters/registry.ts
+const BUILTINS = [
+	prettyReporter,
+	jsonReporter,
+	githubReporter
+];
+/** Names of every built-in reporter, in stable display order. */
+const BUILTIN_REPORTER_NAMES = BUILTINS.map((rep) => rep.name);
+/** Build a registry from the builtins plus any extras (later wins on collision). */
+const createRegistry = (extras = []) => {
+	const map = /* @__PURE__ */ new Map();
+	for (const rep of [...BUILTINS, ...extras]) {
+		if (!isReporterShape(rep)) throw new TypeError("createRegistry: each reporter needs a string 'name' and a 'format' function.");
+		map.set(rep.name, rep);
+	}
+	return {
+		get: (name) => map.get(name),
+		list: () => [...map.keys()]
+	};
+};
+
+//#endregion
+//#region src/adapters/node-errors.ts
+/**
+* Node-runtime error helpers. Lives in the adapters layer so the shared
+* module can stay runtime-agnostic — domain code transitively imports
+* `shared/errors.ts`, and pulling Node's global type namespace through that
+* path would couple every layer to `@types/node` for no reason beyond a
+* single type guard.
+*/
+/**
+* Type guard for Node FS / system errors. `catch` exposes `unknown`, so every
+* `errno`-aware branch needs to prove the shape before reading `code` —
+* centralized here so callers don't sprinkle `as NodeJS.ErrnoException`.
+*/
+const isNodeError = (value) => value instanceof Error && "code" in value && typeof value.code === "string";
+
+//#endregion
+//#region src/domain/services/filter.ts
+const EXIT_SUCCESS = 0;
+const EXIT_FAILURE = 1;
+const meetsThreshold = (severity, threshold) => SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
+/** Keep only findings at or above `threshold`, recomputing the summary. */
+const filterBySeverity = (result, threshold) => {
+	const findings = [];
+	const summary = {
+		error: 0,
+		info: 0,
+		warn: 0
+	};
+	for (const finding of result.findings) if (meetsThreshold(finding.severity, threshold)) {
+		findings.push(finding);
+		summary[finding.severity] += EXIT_FAILURE;
+	}
+	return {
+		findings,
+		summary
+	};
+};
+/**
+* Exit code for a lint run. Non-zero when any finding meets `threshold`
+* (default: only `error` fails the run).
+*/
+const exitCodeForLint = (result, threshold = "error") => {
+	if (result.findings.some((finding) => meetsThreshold(finding.severity, threshold))) return EXIT_FAILURE;
+	return EXIT_SUCCESS;
+};
+
+//#endregion
+//#region src/domain/entities/config-value.ts
+const isParsedConfigObject = (value) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === null || proto === Object.prototype;
+};
+/**
+* Look up a nested value by key path; `undefined` if any segment is missing.
+*
+* Part of the public surface (re-exported from `src/index.ts`): embedders
+* writing custom rules receive the same `config: ParsedConfig` shape that
+* built-in rules see, so they need the canonical traversal helper rather
+* than re-implementing `null`-vs-missing semantics per rule.
+*/
+const getByPath = (config, keyPath) => {
+	let current = config;
+	for (const key of keyPath) {
+		if (!isParsedConfigObject(current)) return;
+		current = current[key];
+	}
+	return current;
+};
+/**
+* Single trust boundary between an external parser and siro's types — the
+* `as ParsedConfig` cast lives here only, after a runtime shape check.
+* Casting in each codec would scatter the boundary and let runtime checks
+* drift out of sync. A deep sanitiser (recursing to keep only known scalars)
+* was rejected because YAML legitimately yields `Date` and other host values
+* that rules can inspect — silently dropping them would look like missing
+* config keys. Throwing on non-objects was rejected so a root-level array or
+* scalar behaves the same as an empty file: `{}`, letting `getByPath` return
+* `undefined` instead of crashing every rule.
+*/
+const toParsedConfig = (value) => {
+	if (isParsedConfigObject(value)) return value;
+	return {};
+};
+
+//#endregion
+//#region src/adapters/codecs/ini.ts
+const INTEGER_PATTERN = /^-?\d+$/u;
+const coerceBoolean = (str) => {
+	if (str === "true") return true;
+	if (str === "false") return false;
+};
+const coerceInteger = (str) => {
+	if (INTEGER_PATTERN.test(str)) return Number(str);
+};
+const coerce = (raw) => {
+	if (typeof raw === "boolean" || typeof raw === "number") return raw;
+	let str = String(raw ?? "");
+	if (typeof raw === "string") str = raw;
+	return coerceBoolean(str) ?? coerceInteger(str) ?? str;
+};
+/**
+* Coerces unquoted scalars on read so rule checks can match by typed
+* value (`true === true`, `7 === 7`). Strings whose lexeme matches
+* `true`/`false`/`-?\d+` lose their string-ness — this is by design for
+* the npm schema, where rule values are booleans / integers / the empty
+* string. Don't model a customRule around a string like `"0"` on this
+* codec; pick yaml/json if you need lossless arbitrary-string reads.
+*/
+const iniCodec = { parse(text) {
+	const raw = toParsedConfig(ini.parse(text));
+	const config = {};
+	for (const [key, value] of Object.entries(raw)) if (Array.isArray(value)) config[key] = value.map((elem) => coerce(elem));
+	else if (typeof value === "object" && value !== null) config[key] = toParsedConfig(value);
+	else config[key] = coerce(value);
+	return config;
+} };
+
+//#endregion
+//#region src/adapters/codecs/json.ts
+/** Codec for strict JSON (deno.json, package.json). Comments are not supported. */
+const jsonCodec = { parse(text) {
+	const trimmed = text.trim();
+	if (trimmed === "") return {};
+	return toParsedConfig(JSON.parse(trimmed));
+} };
+
+//#endregion
+//#region src/adapters/codecs/toml.ts
+const tomlCodec = { parse(text) {
+	if (text.trim() === "") return {};
+	return toParsedConfig(parse(text));
+} };
+
+//#endregion
+//#region src/adapters/codecs/yaml.ts
+const yamlCodec = { parse(text) {
+	if (text.trim() === "") return {};
+	return toParsedConfig(parseDocument(text).toJS());
+} };
+
+//#endregion
+//#region src/adapters/codecs/store.ts
+const CODECS = {
+	json: jsonCodec,
+	npmrc: iniCodec,
+	toml: tomlCodec,
+	yaml: yamlCodec
+};
+/** Look up the codec for a parseable kind. Total — every CodecKind has one. */
+const codecFor = (kind) => CODECS[kind];
+
+//#endregion
+//#region src/domain/services/apply-config.ts
+const stripDynamicSeverity = (check) => (ctx, config) => {
+	const status = check(ctx, config);
+	if (status.state === "violation" && typeof status.severity !== "undefined") return {
+		actual: status.actual,
+		expected: status.expected,
+		manualSteps: status.manualSteps,
+		message: status.message,
+		state: "violation"
+	};
+	return status;
+};
+/**
+* Rewrite all bindings of a rule to strip dynamic and per-binding severity,
+* so the user's config-level severity override is the sole authority.
+*/
+const rewriteBindingsForSeverityOverride = (rule, override) => {
+	const bindings = {};
+	for (const pm of PMS) {
+		const binding = rule.bindings[pm];
+		if (typeof binding !== "undefined") bindings[pm] = {
+			...binding,
+			check: stripDynamicSeverity(binding.check),
+			severity: void 0
+		};
+	}
+	return {
+		...rule,
+		bindings,
+		severity: override
+	};
+};
+/**
+* Merge a user `SiroConfig` into the base ruleset, returning a fresh array
+* (the inputs are not mutated). `base` is the already-resolved rule list —
+* typically builtins plus any programmatic `customRules` — and `config` is
+* the loaded `SiroConfig` whose `customRules` extend `base` and whose
+* `rules` map applies severity overrides (or `'off'` to drop).
+*/
+const applyOverride = (rule, overrides, out) => {
+	const override = overrides[rule.id];
+	if (override === "off") return;
+	if (typeof override === "undefined") out.push(rule);
+	else out.push(rewriteBindingsForSeverityOverride(rule, override));
+};
+const mergeBase = (base, config) => {
+	let customRules = void 0;
+	if (config) ({customRules} = config);
+	return [...base, ...customRules ?? []];
+};
+const applyConfig = (base, config) => {
+	const merged = mergeBase(base, config);
+	let overrides = void 0;
+	if (config) overrides = config.rules;
+	if (typeof overrides === "undefined") return merged;
+	const out = [];
+	for (const rule of merged) applyOverride(rule, overrides, out);
+	return out;
+};
+
+//#endregion
+//#region src/domain/entities/config-files.ts
+/**
+* Canonical {@link ConfigFileRef}s for every package-manager config file siro
+* knows how to read. Centralizing them keeps each rule module from hardcoding
+* `kind` / `path` pairs, so renaming a file (or fixing a typo in its path) is a
+* single-line change. This is also the one place `RelPath` is minted for a
+* config ref — every downstream binding inherits the brand, so no rule needs
+* an ad-hoc `asRelPath(ref.path)` cast at the FS boundary.
+*
+* Add a new entry here when introducing support for a new package manager.
+*/
+const CONFIG_FILES = {
+	aubeWorkspace: {
+		kind: "yaml",
+		path: asRelPath("aube-workspace.yaml")
+	},
+	bunfig: {
+		kind: "toml",
+		path: asRelPath("bunfig.toml")
+	},
+	denoJson: {
+		kind: "json",
+		path: asRelPath("deno.json")
+	},
+	npmrc: {
+		kind: "npmrc",
+		path: asRelPath(".npmrc")
+	},
+	packageJson: {
+		kind: "json",
+		path: asRelPath("package.json")
+	},
+	pnpmWorkspace: {
+		kind: "yaml",
+		path: asRelPath("pnpm-workspace.yaml")
+	},
+	yarnrc: {
+		kind: "yaml",
+		path: asRelPath(".yarnrc.yml")
+	}
+};
+
+//#endregion
+//#region src/domain/rules/builders/require-config-key.ts
+/**
+* Replace one or more bindings on an existing rule, returning a fresh Rule
+* object. Used by rules whose shape outgrows {@link requireConfigKey} for a
+* subset of PMs — they build the simple slots via the builder, then splice
+* the hand-written bindings in via this helper rather than rebuilding from
+* scratch or mutating the source rule.
+*/
+const overrideBindings = (rule, overrides) => ({
+	...rule,
+	bindings: {
+		...rule.bindings,
+		...overrides
+	}
+});
+/**
+* Compose `message` with the structured suffix derived from {@link VersionNote}.
+* Exported for the two hand-written bindings that can't be expressed via
+* {@link requireConfigKey}: the pnpm slot of `disable-lifecycle-scripts`
+* (two-key gate+bypass) and `bun-security-scanner` (advisory shape).
+* New rules should grow `requireConfigKey` rather than reach for this
+* helper — every additional caller raises the cost of evolving the suffix
+* format.
+*/
+const buildVersionNoteParts = (versionNote) => {
+	const parts = [];
+	if (typeof versionNote.configAvailableSince !== "undefined") parts.push(`available since ${versionNote.configAvailableSince}`);
+	if (typeof versionNote.defaultSafeSince !== "undefined") parts.push(`default safe since ${versionNote.defaultSafeSince}`);
+	if (typeof versionNote.note !== "undefined") parts.push(versionNote.note);
+	return parts;
+};
+const renderVersionNoteMessage = (message, versionNote) => {
+	if (typeof versionNote === "undefined") return message;
+	const parts = buildVersionNoteParts(versionNote);
+	if (parts.length === 0) return message;
+	return `${message} (${parts.join("; ")})`;
+};
+const isDefaultOk = (spec) => {
+	if (spec.accept) return spec.accept(spec.documentedDefault);
+	return spec.documentedDefault === spec.value;
+};
+const checkDocumentedDefault = (spec, actual, message) => {
+	if (typeof actual !== "undefined" || typeof spec.documentedDefault === "undefined") return;
+	if (!isDefaultOk(spec)) return;
+	const sev = spec.defaultSatisfiedSeverity ?? "info";
+	if (sev === "off") return { state: "ok" };
+	return {
+		actual,
+		expected: spec.value,
+		message,
+		severity: sev,
+		state: "violation"
+	};
+};
+const checkExtraFixes = (spec, config, message) => {
+	for (const extra of spec.extraFix ?? []) {
+		const extraActual = getByPath(config, extra.keyPath);
+		if (extraActual !== extra.value) return {
+			actual: extraActual,
+			expected: extra.value,
+			message,
+			state: "violation"
+		};
+	}
+};
+const checkPrimary = (spec, actual, message) => {
+	let primaryOk = actual === spec.value;
+	if (spec.accept) primaryOk = spec.accept(actual);
+	if (!primaryOk) return {
+		actual,
+		expected: spec.value,
+		message,
+		state: "violation"
+	};
+};
+const checkKeyValue = (spec, config, message) => {
+	const actual = getByPath(config, spec.keyPath);
+	const advisory = checkDocumentedDefault(spec, actual, message);
+	if (typeof advisory === "undefined") {
+		const primary = checkPrimary(spec, actual, message);
+		if (typeof primary !== "undefined") return primary;
+	}
+	return checkExtraFixes(spec, config, message) ?? advisory ?? { state: "ok" };
+};
+const buildBinding = (spec, applies) => ({
+	check(ctx, config) {
+		if (typeof applies !== "undefined" && !applies(ctx)) return { state: "na" };
+		return checkKeyValue(spec, config, renderVersionNoteMessage(spec.message, spec.versionNote));
+	},
+	docs: spec.docs,
+	file: spec.file,
+	fix() {
+		const ops = [{
+			file: spec.file,
+			keyPath: spec.keyPath,
+			op: "setKey",
+			value: spec.value
+		}];
+		for (const extra of spec.extraFix ?? []) ops.push({
+			file: spec.file,
+			keyPath: extra.keyPath,
+			op: "setKey",
+			value: extra.value
+		});
+		return ops;
+	},
+	fixKind: "auto",
+	severity: spec.severity
+});
+/** Build a Rule from a per-PM table of {file, keyPath, value, message}. */
+const requireConfigKey = (options) => {
+	const bindings = {};
+	for (const pm of PMS) {
+		const spec = options.bindings[pm];
+		if (typeof spec !== "undefined") bindings[pm] = buildBinding(spec, options.applies);
+	}
+	return {
+		bindings,
+		description: options.description,
+		docs: options.docs,
+		id: options.id,
+		severity: options.severity,
+		title: options.title
+	};
+};
+
+//#endregion
+//#region src/domain/rules/advisory-check.ts
+const { aubeWorkspace: aubeWorkspace$9 } = CONFIG_FILES;
+const advisoryCheck = requireConfigKey({
+	bindings: { aube: {
+		accept: (value) => value === "on" || value === "required",
+		docs: "https://aube.jdx.dev/security.html",
+		file: aubeWorkspace$9,
+		keyPath: ["advisoryCheck"],
+		message: "Set `advisoryCheck: on` (or `required`) in aube-workspace.yaml to check dependencies against known-malicious advisories.",
+		value: "on"
+	} },
+	description: "Query the OSV database for known-malicious packages during dependency resolution.",
+	docs: "https://aube.jdx.dev/security.html",
+	id: "advisory-check",
+	severity: "warn",
+	title: "Enable malicious-package advisory checks"
+});
+
+//#endregion
+//#region src/domain/rules/approved-git-repos.ts
+const { yarnrc: yarnrc$9 } = CONFIG_FILES;
+const message = renderVersionNoteMessage("Set `approvedGitRepositories: []` in .yarnrc.yml to block all git: protocol dependencies (or list approved repository globs).", { configAvailableSince: "yarn 4.14.0" });
+const yarnBinding$2 = {
+	check(_ctx, config) {
+		const value = getByPath(config, ["approvedGitRepositories"]);
+		if (Array.isArray(value)) return { state: "ok" };
+		return {
+			actual: value,
+			expected: "[]",
+			message,
+			state: "violation"
+		};
+	},
+	docs: "https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories",
+	file: yarnrc$9,
+	fix() {
+		return [{
+			file: yarnrc$9,
+			message: "Add `approvedGitRepositories: []` to .yarnrc.yml to block all git deps, or list specific approved repository URL globs.",
+			op: "note"
+		}];
+	},
+	fixKind: "advisory"
+};
+const approvedGitRepos = {
+	bindings: { yarn: yarnBinding$2 },
+	description: "Restrict git: protocol dependencies to an explicit allowlist of approved repository URL patterns.",
+	docs: "https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories",
+	id: "approved-git-repos",
+	severity: "warn",
+	title: "Approve git repository dependencies"
+};
+
+//#endregion
+//#region src/domain/rules/audit-suppression.ts
+const { yarnrc: yarnrc$8 } = CONFIG_FILES;
+const isNonEmptyArray = (value) => Array.isArray(value) && value.length > 0;
+const SUPPRESSION_KEYS = ["npmAuditIgnoreAdvisories", "npmAuditExcludePackages"];
+const checkSuppression = (config) => {
+	const present = SUPPRESSION_KEYS.filter((key) => isNonEmptyArray(getByPath(config, [key])));
+	const [first] = present;
+	if (typeof first === "undefined") return { state: "ok" };
+	return {
+		actual: getByPath(config, [first]),
+		message: `Review audit suppression in .yarnrc.yml (${present.join(", ")}). Broad glob patterns can silently hide future vulnerabilities.`,
+		state: "violation"
+	};
+};
+const yarnBinding$1 = {
+	check(_ctx, config) {
+		return checkSuppression(config);
+	},
+	docs: "https://yarnpkg.com/configuration/yarnrc#npmAuditIgnoreAdvisories",
+	file: yarnrc$8,
+	fix() {
+		return [{
+			file: yarnrc$8,
+			message: "Review entries in `npmAuditIgnoreAdvisories` and `npmAuditExcludePackages` — remove stale suppressions and overly broad glob patterns.",
+			op: "note"
+		}];
+	},
+	fixKind: "advisory"
+};
+const auditSuppression = {
+	bindings: { yarn: yarnBinding$1 },
+	description: "Flag audit advisory suppressions that may silently hide future vulnerabilities via broad glob patterns.",
+	docs: "https://yarnpkg.com/configuration/yarnrc#npmAuditIgnoreAdvisories",
+	id: "audit-suppression",
+	severity: "info",
+	title: "Review audit suppression entries"
+};
+
+//#endregion
+//#region src/domain/rules/block-auto-install.ts
+const { bunfig: bunfig$5 } = CONFIG_FILES;
+const blockAutoInstall = requireConfigKey({
+	bindings: { bun: {
+		docs: "https://bun.sh/docs/runtime/bunfig#install-auto",
+		file: bunfig$5,
+		keyPath: ["install", "auto"],
+		message: "Set `auto = \"disable\"` under [install] in bunfig.toml to prevent auto-install from bypassing security guards.",
+		value: "disable"
+	} },
+	description: "Disable auto-install so dependencies are only installed through an explicit install step where security guards apply.",
+	docs: "https://bun.sh/docs/runtime/bunfig#install-auto",
+	id: "block-auto-install",
+	severity: "warn",
+	title: "Block automatic package installation"
+});
+
+//#endregion
+//#region src/domain/rules/block-exotic-subdeps.ts
+const { aubeWorkspace: aubeWorkspace$8, npmrc: npmrc$6, pnpmWorkspace: pnpmWorkspace$10 } = CONFIG_FILES;
+const isRootOrNone = (value) => value === "root" || value === "none";
+const npmMessage = "Set `allow-git=root` and `allow-remote=root` in .npmrc to block git/tarball URLs in transitive dependencies.";
+const npmBinding = {
+	check(_ctx, config) {
+		const git = getByPath(config, ["allow-git"]);
+		if (!isRootOrNone(git)) return {
+			actual: git,
+			expected: "root",
+			message: npmMessage,
+			state: "violation"
+		};
+		const remote = getByPath(config, ["allow-remote"]);
+		if (!isRootOrNone(remote)) return {
+			actual: remote,
+			expected: "root",
+			message: npmMessage,
+			state: "violation"
+		};
+		return { state: "ok" };
+	},
+	docs: "https://docs.npmjs.com/cli/v11/using-npm/config#allow-git",
+	file: npmrc$6,
+	fix() {
+		return [{
+			file: npmrc$6,
+			keyPath: ["allow-git"],
+			op: "setKey",
+			value: "root"
+		}, {
+			file: npmrc$6,
+			keyPath: ["allow-remote"],
+			op: "setKey",
+			value: "root"
+		}];
+	},
+	fixKind: "auto"
+};
+const builtRule$3 = requireConfigKey({
+	bindings: {
+		aube: {
+			docs: "https://aube.jdx.dev/security.html",
+			documentedDefault: true,
+			file: aubeWorkspace$8,
+			keyPath: ["blockExoticSubdeps"],
+			message: "Set `blockExoticSubdeps: true` in aube-workspace.yaml to block git/tarball URLs in transitive dependencies.",
+			value: true
+		},
+		pnpm: {
+			docs: "https://pnpm.io/settings#blockexoticsubdeps",
+			documentedDefault: true,
+			file: pnpmWorkspace$10,
+			keyPath: ["blockExoticSubdeps"],
+			message: "Set `blockExoticSubdeps: true` in pnpm-workspace.yaml to block git/tarball URLs in transitive dependencies.",
+			value: true,
+			versionNote: { configAvailableSince: "pnpm 10.26.0" }
+		}
+	},
+	description: "Refuse to install transitive dependencies sourced from git or tarball URLs, which bypass registry integrity checking.",
+	docs: "https://pnpm.io/settings#blockexoticsubdeps",
+	id: "block-exotic-subdeps",
+	severity: "warn",
+	title: "Block exotic subdependencies"
+});
+const blockExoticSubdeps = overrideBindings(builtRule$3, { npm: npmBinding });
+
+//#endregion
+//#region src/domain/rules/bun-security-scanner.ts
+const { bunfig: bunfig$4 } = CONFIG_FILES;
+const versionNote = { configAvailableSince: "bun 1.3.0" };
+const bunScannerBinding = {
+	check(_ctx, config) {
+		const scanner = getByPath(config, [
+			"install",
+			"security",
+			"scanner"
+		]);
+		if (typeof scanner === "string" && scanner.length > 0) return { state: "ok" };
+		return {
+			actual: scanner,
+			message: renderVersionNoteMessage("Configure `[install.security] scanner = \"...\"` in bunfig.toml (e.g. `@socketsecurity/bun-security-scanner`) to scan new packages on install.", versionNote),
+			state: "violation"
+		};
+	},
+	docs: "https://bun.com/docs/pm/security-scanner-api",
+	file: bunfig$4,
+	fix() {
+		return [{
+			file: bunfig$4,
+			message: "Add `[install.security] scanner = \"@socketsecurity/bun-security-scanner\"` (or another bun-compatible scanner) to bunfig.toml.",
+			op: "note"
+		}];
+	},
+	fixKind: "advisory"
+};
+const bunSecurityScanner = {
+	bindings: { bun: bunScannerBinding },
+	description: "Bun supports a Security Scanner API that intercepts new packages at install time (e.g. Socket Firewall).",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#preinstall-scanners",
+	id: "bun-security-scanner",
+	severity: "info",
+	title: "Enable a bun install-time security scanner"
+};
+
+//#endregion
+//#region src/domain/rules/checksum-verification.ts
+const { yarnrc: yarnrc$7 } = CONFIG_FILES;
+const checksumVerification = requireConfigKey({
+	bindings: { yarn: {
+		docs: "https://yarnpkg.com/configuration/yarnrc#checksumBehavior",
+		documentedDefault: "throw",
+		file: yarnrc$7,
+		keyPath: ["checksumBehavior"],
+		message: "Set `checksumBehavior: throw` in .yarnrc.yml to reject packages whose checksum does not match the lockfile.",
+		value: "throw"
+	} },
+	description: "Throw on checksum mismatches so tampered or corrupted packages are never silently installed.",
+	docs: "https://yarnpkg.com/configuration/yarnrc#checksumBehavior",
+	id: "checksum-verification",
+	severity: "warn",
+	title: "Verify package checksums"
+});
+
+//#endregion
+//#region src/domain/entities/signals.ts
+const PM_SIGNALS = {
+	aube: {
+		configs: [CONFIG_FILES.aubeWorkspace.path],
+		lockfiles: ["aube-lock.yaml"],
+		reusesLockfiles: [
+			"pnpm-lock.yaml",
+			"package-lock.json",
+			"npm-shrinkwrap.json",
+			"yarn.lock",
+			"bun.lock",
+			"bun.lockb",
+			"deno.lock"
+		]
+	},
+	bun: {
+		configs: [CONFIG_FILES.bunfig.path],
+		lockfiles: ["bun.lock", "bun.lockb"]
+	},
+	deno: {
+		configs: [CONFIG_FILES.denoJson.path],
+		lockfiles: ["deno.lock"]
+	},
+	npm: {
+		configs: [],
+		lockfiles: ["package-lock.json", "npm-shrinkwrap.json"]
+	},
+	pnpm: {
+		configs: [CONFIG_FILES.pnpmWorkspace.path],
+		lockfiles: ["pnpm-lock.yaml"]
+	},
+	yarn: {
+		configs: [CONFIG_FILES.yarnrc.path],
+		lockfiles: ["yarn.lock"]
+	}
+};
+
+//#endregion
+//#region src/domain/rules/commit-lockfile.ts
+const LOCKFILE_DOCS = {
+	aube: "https://aube.en.dev/package-manager/lockfiles",
+	bun: "https://bun.com/docs/install/lockfile",
+	deno: "https://docs.deno.com/runtime/fundamentals/modules/#integrity-checking-and-lock-files",
+	npm: "https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json",
+	pnpm: "https://pnpm.io/git#lockfiles",
+	yarn: "https://yarnpkg.com/getting-started/qa#should-lockfiles-be-committed-to-the-repository"
+};
+const lockfileBinding = (pm) => {
+	const { lockfiles, reusesLockfiles } = PM_SIGNALS[pm];
+	const [primary] = lockfiles;
+	const primaryRef = {
+		kind: "fileGlob",
+		path: asRelPath(primary)
+	};
+	const accepted = [...lockfiles, ...reusesLockfiles ?? []];
+	return {
+		check(ctx) {
+			if (accepted.some((lf) => ctx.exists(asRelPath(lf)))) return { state: "ok" };
+			return {
+				message: `No lockfile found. Generate and commit ${primary}.`,
+				state: "violation"
+			};
+		},
+		docs: LOCKFILE_DOCS[pm],
+		file: primaryRef,
+		fix() {
+			return [{
+				file: primaryRef,
+				message: `Install dependencies to generate ${primary}, then commit it.`,
+				op: "ensureFileTracked"
+			}];
+		},
+		fixKind: "advisory"
+	};
+};
+const commitLockfile = {
+	bindings: {
+		aube: lockfileBinding("aube"),
+		bun: lockfileBinding("bun"),
+		deno: lockfileBinding("deno"),
+		npm: lockfileBinding("npm"),
+		pnpm: lockfileBinding("pnpm"),
+		yarn: lockfileBinding("yarn")
+	},
+	description: "Lockfiles pin the full dependency tree and integrity hashes, enabling reproducible, verifiable installs (e.g. `npm ci`).",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-include-lockfiles",
+	id: "commit-lockfile",
+	severity: "error",
+	title: "Commit a lockfile"
+};
+
+//#endregion
+//#region src/domain/rules/dependency-overrides.ts
+const { aubeWorkspace: aubeWorkspace$7, pnpmWorkspace: pnpmWorkspace$9 } = CONFIG_FILES;
+const isNonEmptyObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
+const checkOverrides = (config, file) => {
+	const value = getByPath(config, ["overrides"]);
+	if (!isNonEmptyObject$2(value)) return { state: "ok" };
+	return {
+		actual: value,
+		message: `Review \`overrides\` in ${file}. Overrides can replace transitive dependencies with arbitrary versions or forks.`,
+		state: "violation"
+	};
+};
+const makeBinding = (file, fileName, docs) => ({
+	check(_ctx, config) {
+		return checkOverrides(config, fileName);
+	},
+	docs,
+	file,
+	fix() {
+		return [{
+			file,
+			message: "Review each entry in `overrides` — verify pinned versions address a known CVE and are not redirecting to untrusted packages.",
+			op: "note"
+		}];
+	},
+	fixKind: "advisory"
+});
+const dependencyOverrides = {
+	bindings: {
+		aube: makeBinding(aubeWorkspace$7, "aube-workspace.yaml", "https://aube.jdx.dev/settings.html"),
+		pnpm: makeBinding(pnpmWorkspace$9, "pnpm-workspace.yaml", "https://pnpm.io/settings#overrides")
+	},
+	description: "Flag dependency overrides that can replace transitive packages with arbitrary versions or forks — a supply-chain injection vector.",
+	docs: "https://pnpm.io/settings#overrides",
+	id: "dependency-overrides",
+	severity: "info",
+	title: "Review dependency overrides"
+};
+
+//#endregion
+//#region src/domain/rules/disable-lifecycle-scripts.ts
+const { npmrc: npmrc$5, pnpmWorkspace: pnpmWorkspace$8, yarnrc: yarnrc$6, aubeWorkspace: aubeWorkspace$6, bunfig: bunfig$3 } = CONFIG_FILES;
+const pnpmStrictDepBuildsDocs = "https://pnpm.io/settings#strictdepbuilds";
+const pnpmVersionNote = {
+	configAvailableSince: "pnpm 10.3.0",
+	defaultSafeSince: "pnpm 11.0.0"
+};
+const pnpmMsg = (body) => renderVersionNoteMessage(body, pnpmVersionNote);
+const pnpmBinding$4 = {
+	check(_ctx, config) {
+		const bypass = getByPath(config, ["dangerouslyAllowAllBuilds"]);
+		if (bypass === true) return {
+			actual: bypass,
+			expected: false,
+			manualSteps: ["Remove `dangerouslyAllowAllBuilds: true` from pnpm-workspace.yaml (or set it to `false`). Setting `strictDepBuilds: true` alone has no effect while the bypass remains."],
+			message: pnpmMsg("`dangerouslyAllowAllBuilds: true` in pnpm-workspace.yaml bypasses strictDepBuilds — remove it (or set it to false) to restore lifecycle-script gating."),
+			state: "violation"
+		};
+		const strict = getByPath(config, ["strictDepBuilds"]);
+		if (strict === true) return { state: "ok" };
+		if (typeof strict === "undefined") return {
+			actual: strict,
+			expected: true,
+			message: pnpmMsg("Set `strictDepBuilds: true` in pnpm-workspace.yaml to pin lifecycle-script gating across versions."),
+			severity: "info",
+			state: "violation"
+		};
+		return {
+			actual: strict,
+			expected: true,
+			message: pnpmMsg("Set `strictDepBuilds: true` in pnpm-workspace.yaml to block silent skips of un-approved dep builds."),
+			state: "violation"
+		};
+	},
+	docs: pnpmStrictDepBuildsDocs,
+	file: pnpmWorkspace$8,
+	fix() {
+		return [{
+			file: pnpmWorkspace$8,
+			keyPath: ["strictDepBuilds"],
+			op: "setKey",
+			value: true
+		}];
+	},
+	fixKind: "auto"
+};
+const aubeBinding = {
+	check(_ctx, config) {
+		const jail = getByPath(config, ["jailBuilds"]);
+		if (jail !== true) return {
+			actual: jail,
+			expected: true,
+			message: "Set `jailBuilds: true` in aube-workspace.yaml to sandbox build scripts.",
+			state: "violation"
+		};
+		const strict = getByPath(config, ["strictDepBuilds"]);
+		if (strict !== true) return {
+			actual: strict,
+			expected: true,
+			message: "Set `strictDepBuilds: true` in aube-workspace.yaml to require explicit allow/deny for lifecycle scripts.",
+			state: "violation"
+		};
+		return { state: "ok" };
+	},
+	docs: "https://aube.jdx.dev/security.html",
+	file: aubeWorkspace$6,
+	fix() {
+		return [{
+			file: aubeWorkspace$6,
+			keyPath: ["jailBuilds"],
+			op: "setKey",
+			value: true
+		}, {
+			file: aubeWorkspace$6,
+			keyPath: ["strictDepBuilds"],
+			op: "setKey",
+			value: true
+		}];
+	},
+	fixKind: "auto"
+};
+const bunMessage = renderVersionNoteMessage("Set `ignoreScripts = true` under [install] in bunfig.toml — or set `\"trustedDependencies\": []` in package.json — to opt out of the curated allow-list (postinstall is already blocked for untrusted packages by default).", { configAvailableSince: "bun 1.2.0" });
+const bunBinding = {
+	check(ctx, config) {
+		const ignoreScripts = getByPath(config, ["install", "ignoreScripts"]);
+		if (ignoreScripts === true) return { state: "ok" };
+		const EMPTY = 0;
+		let trusted = void 0;
+		if (ctx.packageJson) trusted = ctx.packageJson.trustedDependencies;
+		if (typeof trusted !== "undefined" && trusted.length === EMPTY) return { state: "ok" };
+		return {
+			actual: ignoreScripts,
+			expected: true,
+			message: bunMessage,
+			state: "violation"
+		};
+	},
+	docs: "https://bun.com/docs/pm/lifecycle",
+	file: bunfig$3,
+	fix() {
+		return [{
+			file: bunfig$3,
+			keyPath: ["install", "ignoreScripts"],
+			op: "setKey",
+			value: true
+		}];
+	},
+	fixKind: "auto",
+	severity: "info"
+};
+const builtRule$2 = requireConfigKey({
+	bindings: {
+		npm: {
+			docs: "https://docs.npmjs.com/cli/v11/using-npm/config#ignore-scripts",
+			file: npmrc$5,
+			keyPath: ["ignore-scripts"],
+			message: "Set `ignore-scripts=true` in .npmrc to block dependency lifecycle scripts.",
+			value: true
+		},
+		yarn: {
+			docs: "https://yarnpkg.com/configuration/yarnrc#enableScripts",
+			documentedDefault: false,
+			file: yarnrc$6,
+			keyPath: ["enableScripts"],
+			message: "Set `enableScripts: false` in .yarnrc.yml to pin the policy across versions.",
+			value: false,
+			versionNote: {
+				configAvailableSince: "yarn 2.0.0",
+				defaultSafeSince: "yarn 4.14.0"
+			}
+		}
+	},
+	description: "Malicious postinstall scripts are a primary supply-chain attack vector. Prevent automatic execution of dependency lifecycle scripts.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#3-disable-lifecycle-scripts",
+	id: "disable-lifecycle-scripts",
+	severity: "error",
+	title: "Disable dependency lifecycle scripts"
+});
+const disableLifecycleScripts = overrideBindings(builtRule$2, {
+	aube: aubeBinding,
+	bun: bunBinding,
+	pnpm: pnpmBinding$4
+});
+
+//#endregion
+//#region src/domain/rules/enforce-strict-ssl.ts
+const { npmrc: npmrc$4, yarnrc: yarnrc$5 } = CONFIG_FILES;
+const yarnMessage = "Set `enableStrictSsl: true` in .yarnrc.yml to enforce SSL certificate validation for registry connections.";
+const yarnBinding = {
+	check(_ctx, config) {
+		const strictSsl = getByPath(config, ["enableStrictSsl"]);
+		if (strictSsl === false) return {
+			actual: false,
+			expected: true,
+			message: yarnMessage,
+			state: "violation"
+		};
+		const EMPTY = 0;
+		const whitelist = getByPath(config, ["unsafeHttpWhitelist"]);
+		if (Array.isArray(whitelist) && whitelist.length > EMPTY) return {
+			actual: whitelist,
+			expected: "",
+			manualSteps: ["Review and remove entries from `unsafeHttpWhitelist` in .yarnrc.yml. Each entry permits unencrypted HTTP to that hostname."],
+			message: "`unsafeHttpWhitelist` in .yarnrc.yml allows unencrypted HTTP connections — remove entries or clear the list to enforce HTTPS-only registry access.",
+			state: "violation"
+		};
+		if (typeof strictSsl === "undefined") return {
+			actual: strictSsl,
+			expected: true,
+			message: yarnMessage,
+			severity: "info",
+			state: "violation"
+		};
+		return { state: "ok" };
+	},
+	docs: "https://yarnpkg.com/configuration/yarnrc#enableStrictSsl",
+	file: yarnrc$5,
+	fix() {
+		return [{
+			file: yarnrc$5,
+			keyPath: ["enableStrictSsl"],
+			op: "setKey",
+			value: true
+		}];
+	},
+	fixKind: "auto"
+};
+const builtRule$1 = requireConfigKey({
+	bindings: { npm: {
+		docs: "https://docs.npmjs.com/cli/v11/using-npm/config#strict-ssl",
+		documentedDefault: true,
+		file: npmrc$4,
+		keyPath: ["strict-ssl"],
+		message: "Set `strict-ssl=true` in .npmrc to enforce SSL certificate validation.",
+		value: true
+	} },
+	description: "Require SSL certificate validation so registry traffic cannot be intercepted or tampered with.",
+	docs: "https://docs.npmjs.com/cli/v11/using-npm/config#strict-ssl",
+	id: "enforce-strict-ssl",
+	severity: "warn",
+	title: "Enforce SSL for registry connections"
+});
+const enforceStrictSsl = overrideBindings(builtRule$1, { yarn: yarnBinding });
+
+//#endregion
+//#region src/domain/rules/publishable.ts
+const isPublishable = (ctx) => {
+	const pkg = ctx.packageJson;
+	if (typeof pkg === "undefined") return false;
+	return pkg.private !== true && typeof pkg.name === "string" && pkg.name.length > 0;
+};
+
+//#endregion
+//#region src/domain/rules/files-field.ts
+const { packageJson: packageJson$1, denoJson: denoJson$3 } = CONFIG_FILES;
+const packageJsonFilesBinding = {
+	check(ctx) {
+		if (!isPublishable(ctx)) return { state: "na" };
+		let files = void 0;
+		if (ctx.packageJson) ({files} = ctx.packageJson);
+		if (Array.isArray(files) && files.length > 0) return { state: "ok" };
+		return {
+			actual: files,
+			message: "Add a `files` allow-list to package.json to limit what gets published.",
+			state: "violation"
+		};
+	},
+	docs: "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#files",
+	file: packageJson$1,
+	fix() {
+		return [{
+			file: packageJson$1,
+			message: "Add a `files` array to package.json (e.g. [\"dist\"]) and verify with `npm pack --dry-run`.",
+			op: "note"
+		}];
+	},
+	fixKind: "advisory"
+};
+const denoPublishBinding = {
+	check(_ctx, config) {
+		if (typeof getByPath(config, ["name"]) !== "string") return { state: "na" };
+		const include = getByPath(config, ["publish", "include"]);
+		if (Array.isArray(include) && include.length > 0) return { state: "ok" };
+		return {
+			actual: include,
+			message: "Add `publish.include` to deno.json to limit what gets published.",
+			state: "violation"
+		};
+	},
+	docs: "https://docs.deno.com/runtime/reference/cli/publish/#how-publishing-works",
+	file: denoJson$3,
+	fix() {
+		return [{
+			file: denoJson$3,
+			message: "Add `publish.include` (and/or `publish.exclude`) to deno.json.",
+			op: "note"
+		}];
+	},
+	fixKind: "advisory"
+};
+const filesField = {
+	bindings: {
+		aube: packageJsonFilesBinding,
+		bun: packageJsonFilesBinding,
+		deno: denoPublishBinding,
+		npm: packageJsonFilesBinding,
+		pnpm: packageJsonFilesBinding,
+		yarn: packageJsonFilesBinding
+	},
+	description: "An explicit `files` array in package.json restricts what gets published, preventing accidental inclusion of secrets or local files.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#11-review-published-files",
+	id: "files-field",
+	severity: "info",
+	title: "Declare a published files allow-list"
+};
+
+//#endregion
+//#region src/domain/rules/frozen-lockfile.ts
+const { pnpmWorkspace: pnpmWorkspace$7, yarnrc: yarnrc$4, bunfig: bunfig$2, denoJson: denoJson$2, aubeWorkspace: aubeWorkspace$5 } = CONFIG_FILES;
+const denoLockMessage = "Set `lock.frozen: true` in deno.json for reproducible, verified installs.";
+const denoBinding$1 = {
+	check(_ctx, config) {
+		if (getByPath(config, ["lock", "frozen"]) === true) return { state: "ok" };
+		const lock = getByPath(config, ["lock"]);
+		const lockIsScalar = typeof lock !== "undefined" && (typeof lock !== "object" || lock === null || Array.isArray(lock));
+		const base = {
+			actual: getByPath(config, ["lock", "frozen"]),
+			expected: true,
+			message: denoLockMessage,
+			state: "violation"
+		};
+		if (lockIsScalar) return {
+			...base,
+			manualSteps: ["deno.json `lock` is set to a non-object value; writing `lock.frozen: true` under it would overwrite that value. Set it yourself, or make `lock` an object first."]
+		};
+		return base;
+	},
+	docs: "https://docs.deno.com/runtime/fundamentals/configuration/#lock",
+	file: denoJson$2,
+	fix() {
+		return [{
+			file: denoJson$2,
+			keyPath: ["lock", "frozen"],
+			op: "setKey",
+			value: true
+		}];
+	},
+	fixKind: "auto"
+};
+const builtRule = requireConfigKey({
+	bindings: {
+		aube: {
+			docs: "https://aube.en.dev/settings/",
+			documentedDefault: true,
+			file: aubeWorkspace$5,
+			keyPath: ["preferFrozenLockfile"],
+			message: "aube defaults preferFrozenLockfile to true — set it explicitly in aube-workspace.yaml to pin the policy across versions.",
+			value: true
+		},
+		bun: {
+			docs: "https://bun.com/docs/runtime/bunfig#install-frozenlockfile",
+			file: bunfig$2,
+			keyPath: ["install", "frozenLockfile"],
+			message: "Set `frozenLockfile = true` under [install] in bunfig.toml so installs fail when the lockfile would change.",
+			value: true,
+			versionNote: { configAvailableSince: "bun 0.6.10" }
+		},
+		pnpm: {
+			docs: "https://pnpm.io/settings#frozenlockfile",
+			documentedDefault: true,
+			file: pnpmWorkspace$7,
+			keyPath: ["frozenLockfile"],
+			message: "pnpm defaults frozenLockfile to true in CI — set it explicitly in pnpm-workspace.yaml to pin the policy outside CI too.",
+			value: true
+		},
+		yarn: {
+			docs: "https://yarnpkg.com/configuration/yarnrc#enableImmutableInstalls",
+			documentedDefault: true,
+			file: yarnrc$4,
+			keyPath: ["enableImmutableInstalls"],
+			message: "Set `enableImmutableInstalls: true` in .yarnrc.yml to pin the policy outside CI too.",
+			value: true,
+			versionNote: {
+				configAvailableSince: "yarn 2.0.0",
+				defaultSafeSince: "yarn 3.0.0 in CI"
+			}
+		}
+	},
+	description: "Refuse to mutate the lockfile on install so unexpected dependency changes fail loudly.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-include-lockfiles",
+	id: "frozen-lockfile",
+	severity: "warn",
+	title: "Freeze the lockfile"
+});
+const frozenLockfile = overrideBindings(builtRule, { deno: denoBinding$1 });
+
+//#endregion
+//#region src/domain/rules/frozen-store.ts
+const { pnpmWorkspace: pnpmWorkspace$6 } = CONFIG_FILES;
+const pnpmBinding$3 = {
+	check(_ctx, config) {
+		const value = getByPath(config, ["frozenStore"]);
+		if (value === true) return { state: "ok" };
+		return {
+			actual: value,
+			message: "Consider enabling `frozenStore` in pnpm-workspace.yaml. Without it, the content-addressable store can be mutated after initial population, weakening integrity guarantees.",
+			state: "violation"
+		};
+	},
+	docs: "https://pnpm.io/settings#frozenstore",
+	file: pnpmWorkspace$6,
+	fix() {
+		return [{
+			file: pnpmWorkspace$6,
+			message: "Set `frozenStore: true` to prevent writes to the store after initial population — especially useful in CI and deployment pipelines.",
+			op: "note"
+		}];
+	},
+	fixKind: "advisory"
+};
+const frozenStore = {
+	bindings: { pnpm: pnpmBinding$3 },
+	description: "Recommend enabling frozenStore to prevent mutations to the content-addressable store, strengthening supply-chain integrity in CI and deploy environments.",
+	docs: "https://pnpm.io/settings#frozenstore",
+	id: "frozen-store",
+	severity: "info",
+	title: "Enable frozen store"
+};
+
+//#endregion
+//#region src/domain/rules/hardened-mode.ts
+const { yarnrc: yarnrc$3 } = CONFIG_FILES;
+const hardenedMode = requireConfigKey({
+	bindings: { yarn: {
+		docs: "https://yarnpkg.com/configuration/yarnrc#enableHardenedMode",
+		documentedDefault: true,
+		file: yarnrc$3,
+		keyPath: ["enableHardenedMode"],
+		message: "yarn enables hardened mode automatically only for pull requests on public repositories — set `enableHardenedMode: true` in .yarnrc.yml to extend end-to-end install verification to every install.",
+		value: true,
+		versionNote: {
+			configAvailableSince: "yarn 4.0.0",
+			defaultSafeSince: "yarn 4.0.0 (conditional: auto-enabled for PRs on public repositories)"
+		}
+	} },
+	description: "Yarn 4's enableHardenedMode performs end-to-end checksum, lockfile, and version verification at install time.",
+	docs: "https://yarnpkg.com/configuration/yarnrc#enableHardenedMode",
+	id: "hardened-mode",
+	severity: "warn",
+	title: "Enable hardened mode (yarn)"
+});
+
+//#endregion
+//#region src/domain/rules/minimum-release-age.ts
+const HOURS_PER_DAY = 24;
+const MINUTES_PER_HOUR = 60;
+const SECONDS_PER_MINUTE = 60;
+const MINUTES_PER_DAY = HOURS_PER_DAY * MINUTES_PER_HOUR;
+const SECONDS_PER_DAY = MINUTES_PER_DAY * SECONDS_PER_MINUTE;
+const RECOMMENDED_RELEASE_AGE_DAYS = 3;
+const RECOMMENDED_RELEASE_AGE_MINUTES = RECOMMENDED_RELEASE_AGE_DAYS * MINUTES_PER_DAY;
+const RECOMMENDED_RELEASE_AGE_SECONDS = RECOMMENDED_RELEASE_AGE_DAYS * SECONDS_PER_DAY;
+const DOCUMENTED_DEFAULT_MINUTES = MINUTES_PER_DAY;
+const { npmrc: npmrc$3, pnpmWorkspace: pnpmWorkspace$5, yarnrc: yarnrc$2, bunfig: bunfig$1, denoJson: denoJson$1, aubeWorkspace: aubeWorkspace$4 } = CONFIG_FILES;
+const ZERO = 0;
+const isPositiveNumber = (value) => typeof value === "number" && value > ZERO;
+const isNonDisabledDenoDuration = (value) => {
+	if (typeof value === "number") return value > ZERO;
+	if (typeof value === "string") return value !== "" && value !== "0";
+	return typeof value === "object" && value !== null;
+};
+const minimumReleaseAge = requireConfigKey({
+	bindings: {
+		aube: {
+			accept: isPositiveNumber,
+			docs: "https://aube.en.dev/settings/",
+			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
+			file: aubeWorkspace$4,
+			keyPath: ["minimumReleaseAge"],
+			message: `Set minimumReleaseAge (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in aube-workspace.yaml.`,
+			value: RECOMMENDED_RELEASE_AGE_MINUTES
+		},
+		bun: {
+			accept: isPositiveNumber,
+			docs: "https://bun.com/docs/runtime/bunfig#install-minimumreleaseage",
+			file: bunfig$1,
+			keyPath: ["install", "minimumReleaseAge"],
+			message: `Set install.minimumReleaseAge (bun) to ~${RECOMMENDED_RELEASE_AGE_SECONDS} seconds to quarantine brand-new releases.`,
+			value: RECOMMENDED_RELEASE_AGE_SECONDS,
+			versionNote: { configAvailableSince: "bun 1.3.0" }
+		},
+		deno: {
+			accept: isNonDisabledDenoDuration,
+			docs: "https://docs.deno.com/runtime/reference/deno_json/",
+			file: denoJson$1,
+			keyPath: ["minimumDependencyAge"],
+			message: `Set minimumDependencyAge (e.g. "P3D" for a ${RECOMMENDED_RELEASE_AGE_DAYS}-day cooldown) in deno.json.`,
+			value: "P3D"
+		},
+		npm: {
+			accept: isPositiveNumber,
+			docs: "https://docs.npmjs.com/cli/v11/using-npm/config#min-release-age",
+			file: npmrc$3,
+			keyPath: ["min-release-age"],
+			message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days to quarantine brand-new releases.`,
+			value: RECOMMENDED_RELEASE_AGE_DAYS,
+			versionNote: { configAvailableSince: "npm 11.10.0" }
+		},
+		pnpm: {
+			accept: isPositiveNumber,
+			docs: "https://pnpm.io/settings#minimumreleaseage",
+			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
+			file: pnpmWorkspace$5,
+			keyPath: ["minimumReleaseAge"],
+			message: `Set minimumReleaseAge (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in pnpm-workspace.yaml.`,
+			value: RECOMMENDED_RELEASE_AGE_MINUTES,
+			versionNote: {
+				configAvailableSince: "pnpm 10.16.0",
+				defaultSafeSince: "pnpm 11.0.0 (1440 minutes)"
+			}
+		},
+		yarn: {
+			accept: isPositiveNumber,
+			docs: "https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate",
+			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
+			file: yarnrc$2,
+			keyPath: ["npmMinimalAgeGate"],
+			message: `Set npmMinimalAgeGate (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in .yarnrc.yml.`,
+			value: RECOMMENDED_RELEASE_AGE_MINUTES,
+			versionNote: {
+				configAvailableSince: "yarn 4.10.0",
+				defaultSafeSince: "yarn 4.15.0 (1440 minutes)"
+			}
+		}
+	},
+	description: "Refuse to install releases newer than a cooldown window so freshly published (possibly compromised) versions are skipped.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#set-minimal-release-age",
+	id: "minimum-release-age",
+	severity: "warn",
+	title: "Set a minimum release age"
+});
+
+//#endregion
+//#region src/domain/rules/named-registries.ts
+const { pnpmWorkspace: pnpmWorkspace$4 } = CONFIG_FILES;
+const isNonEmptyObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
+const pnpmBinding$2 = {
+	check(_ctx, config) {
+		const value = getByPath(config, ["namedRegistries"]);
+		if (!isNonEmptyObject$1(value)) return { state: "ok" };
+		return {
+			actual: value,
+			message: "Review `namedRegistries` in pnpm-workspace.yaml. Custom registry mappings can redirect package resolution away from the public registry, enabling dependency confusion attacks.",
+			state: "violation"
+		};
+	},
+	docs: "https://pnpm.io/settings#namedregistries",
+	file: pnpmWorkspace$4,
+	fix() {
+		return [{
+			file: pnpmWorkspace$4,
+			message: "Verify each named registry points to a trusted source and that scoped packages cannot be hijacked via a public registry of the same name.",
+			op: "note"
+		}];
+	},
+	fixKind: "advisory"
+};
+const namedRegistries = {
+	bindings: { pnpm: pnpmBinding$2 },
+	description: "Flag named registry mappings that redirect package resolution to custom registries, which may enable dependency confusion attacks.",
+	docs: "https://pnpm.io/settings#namedregistries",
+	id: "named-registries",
+	severity: "info",
+	title: "Review named registry mappings"
+};
+
+//#endregion
+//#region src/domain/rules/paranoid-mode.ts
+const { aubeWorkspace: aubeWorkspace$3 } = CONFIG_FILES;
+const paranoidMode = requireConfigKey({
+	bindings: { aube: {
+		docs: "https://aube.jdx.dev/security.html",
+		file: aubeWorkspace$3,
+		keyPath: ["paranoid"],
+		message: "Set `paranoid: true` in aube-workspace.yaml to enable the strict-security bundle (trustPolicy, jailBuilds, minimumReleaseAgeStrict, strictStoreIntegrity, strictDepBuilds, advisoryCheck).",
+		value: true
+	} },
+	description: "Activate the strict-security setting bundle that forces trustPolicy, jailBuilds, minimumReleaseAgeStrict, strictStoreIntegrity, strictDepBuilds, and advisoryCheck on in one switch.",
+	docs: "https://aube.jdx.dev/security.html",
+	id: "paranoid-mode",
+	severity: "info",
+	title: "Enable paranoid security mode"
+});
+
+//#endregion
+//#region src/domain/rules/patched-dependencies.ts
+const { pnpmWorkspace: pnpmWorkspace$3 } = CONFIG_FILES;
+const isNonEmptyObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
+const pnpmBinding$1 = {
+	check(_ctx, config) {
+		const value = getByPath(config, ["patchedDependencies"]);
+		if (!isNonEmptyObject(value)) return { state: "ok" };
+		return {
+			actual: value,
+			message: "Review `patchedDependencies` in pnpm-workspace.yaml. Patches modify dependency source code directly and bypass registry integrity checks.",
+			state: "violation"
+		};
+	},
+	docs: "https://pnpm.io/settings#patcheddependencies",
+	file: pnpmWorkspace$3,
+	fix() {
+		return [{
+			file: pnpmWorkspace$3,
+			message: "Review each entry in `patchedDependencies` — verify patches address a known issue and have not been tampered with.",
+			op: "note"
+		}];
+	},
+	fixKind: "advisory"
+};
+const patchedDependencies = {
+	bindings: { pnpm: pnpmBinding$1 },
+	description: "Flag patched dependencies whose source code is modified by local patch files, bypassing registry integrity verification.",
+	docs: "https://pnpm.io/settings#patcheddependencies",
+	id: "patched-dependencies",
+	severity: "info",
+	title: "Review patched dependencies"
+};
+
+//#endregion
+//#region src/domain/rules/pin-exact-versions.ts
+const { npmrc: npmrc$2, pnpmWorkspace: pnpmWorkspace$2, yarnrc: yarnrc$1, bunfig, denoJson } = CONFIG_FILES;
+const isConfigObject = (value) => !Array.isArray(value);
+/**
+* Specifiers without any `@version` part fall into "no range" by design: this
+* is a deliberate, best-effort static-check stance. Treating "latest"-style
+* imports as violations would need a different mental model (and ideally
+* resolution against the lockfile), so we leave them alone here.
+*/
+/** Wildcard segments (`1.x`, `1.*`, `1.2.X`) are ranges too. */
+const SPLIT_LIMIT_FIRST = 1;
+const FIRST_ELEMENT = 0;
+const hasWildcardSegment = (spec) => {
+	return (spec.split("-", SPLIT_LIMIT_FIRST)[FIRST_ELEMENT] ?? spec).split(".").some((seg) => seg === "x" || seg === "X" || seg === "*");
+};
+const RANGE_OPERATOR = /[\^~]|>=|<=|<|>|\|\||\s/u;
+const isRangeSpec = (spec) => spec === "" || spec === "*" || RANGE_OPERATOR.test(spec) || hasWildcardSegment(spec);
+const NO_AT_SIGN = 0;
+const AFTER_AT_SIGN = 1;
+const hasSemverRange = (specifier) => {
+	if (specifier.startsWith("http://") || specifier.startsWith("https://")) return false;
+	const at = specifier.lastIndexOf("@");
+	if (at <= NO_AT_SIGN) return false;
+	return isRangeSpec(specifier.slice(at + AFTER_AT_SIGN));
+};
+const collectRangedImports = (imports) => {
+	const offenders = [];
+	for (const [name, value] of Object.entries(imports)) if (typeof value === "string" && hasSemverRange(value)) offenders.push(`${name}=${value}`);
+	return offenders;
+};
+const MAX_SAMPLE_COUNT = 3;
+const EMPTY$2 = 0;
+const formatOffenders = (offenders) => {
+	const sample = offenders.slice(FIRST_ELEMENT, MAX_SAMPLE_COUNT).join(", ");
+	let more = "";
+	if (offenders.length > MAX_SAMPLE_COUNT) more = ` (and ${offenders.length - MAX_SAMPLE_COUNT} more)`;
+	return {
+		message: `${offenders.length} deno imports use semver ranges: ${sample}${more}. Use \`deno add --save-exact\` or pin manually.`,
+		state: "violation"
+	};
+};
+const OK = { state: "ok" };
+const extractImportsRecord = (config) => {
+	const imports = getByPath(config, ["imports"]);
+	if (typeof imports !== "object" || imports === null || !isConfigObject(imports)) return;
+	return imports;
+};
+const denoBinding = {
+	check(_ctx, config) {
+		const imports = extractImportsRecord(config);
+		if (!imports) return OK;
+		const offenders = collectRangedImports(imports);
+		if (offenders.length === EMPTY$2) return OK;
+		return formatOffenders(offenders);
+	},
+	docs: "https://docs.deno.com/runtime/reference/cli/add/",
+	file: denoJson,
+	fix() {
+		return [{
+			file: denoJson,
+			message: "Run `deno add --save-exact <pkg>` for each ranged import in deno.json, or rewrite the `imports` entries to use exact versions.",
+			op: "note"
+		}];
+	},
+	fixKind: "advisory"
+};
+const baseRule = requireConfigKey({
+	bindings: {
+		bun: {
+			docs: "https://bun.com/docs/runtime/bunfig#install-exact",
+			file: bunfig,
+			keyPath: ["install", "exact"],
+			message: "Set `exact = true` under [install] in bunfig.toml to pin exact versions.",
+			value: true,
+			versionNote: { configAvailableSince: "bun 0.6.10" }
+		},
+		npm: {
+			docs: "https://docs.npmjs.com/cli/v11/using-npm/config#save-exact",
+			extraFix: [{
+				keyPath: ["save-prefix"],
+				value: ""
+			}],
+			file: npmrc$2,
+			keyPath: ["save-exact"],
+			message: "Set `save-exact=true` (and `save-prefix=`) in .npmrc to pin exact versions.",
+			value: true
+		},
+		pnpm: {
+			docs: "https://pnpm.io/settings#saveprefix",
+			file: pnpmWorkspace$2,
+			keyPath: ["savePrefix"],
+			message: "Set `savePrefix: ''` in pnpm-workspace.yaml to pin exact versions.",
+			value: ""
+		},
+		yarn: {
+			docs: "https://yarnpkg.com/configuration/yarnrc#defaultSemverRangePrefix",
+			file: yarnrc$1,
+			keyPath: ["defaultSemverRangePrefix"],
+			message: "Set `defaultSemverRangePrefix: ''` in .yarnrc.yml to pin exact versions.",
+			value: "",
+			versionNote: { configAvailableSince: "yarn 2.0.0" }
+		}
+	},
+	description: "Semver ranges (^, ~) auto-adopt new releases, including compromised ones. Save exact versions by default.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#1-pin-dependency-versions",
+	id: "pin-exact-versions",
+	severity: "error",
+	title: "Pin exact dependency versions"
+});
+const pinExactVersions = overrideBindings(baseRule, { deno: denoBinding });
+
+//#endregion
+//#region src/domain/rules/provenance.ts
+const { npmrc: npmrc$1, yarnrc } = CONFIG_FILES;
+const npmrcProvenance = {
+	file: npmrc$1,
+	keyPath: ["provenance"],
+	message: "Set `provenance=true` (and publish from CI) to attest releases.",
+	value: true
+};
+const provenance = requireConfigKey({
+	applies: isPublishable,
+	bindings: {
+		bun: {
+			...npmrcProvenance,
+			docs: "https://github.com/oven-sh/bun/issues/15601",
+			message: "Set `provenance=true` in .npmrc and publish via `bunx npm publish` from CI — `bun publish` does not emit provenance attestations natively (tracking: oven-sh/bun#15601)."
+		},
+		npm: {
+			...npmrcProvenance,
+			docs: "https://docs.npmjs.com/cli/v11/using-npm/config#provenance",
+			versionNote: { configAvailableSince: "npm 9.5.0" }
+		},
+		pnpm: {
+			...npmrcProvenance,
+			docs: "https://pnpm.io/cli/publish"
+		},
+		yarn: {
+			docs: "https://yarnpkg.com/configuration/yarnrc#npmPublishProvenance",
+			file: yarnrc,
+			keyPath: ["npmPublishProvenance"],
+			message: "Set `npmPublishProvenance: true` (and publish from CI) to attest releases.",
+			value: true
+		}
+	},
+	description: "Provenance statements (via Sigstore) tie a release to its source and build, letting consumers verify it was not tampered with.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#10-generate-provenance-statements",
+	id: "provenance",
+	severity: "warn",
+	title: "Publish with provenance"
+});
+
+//#endregion
+//#region src/domain/rules/publish-access.ts
+const { packageJson } = CONFIG_FILES;
+const publishAccessBinding = {
+	check(ctx) {
+		if (!isPublishable(ctx)) return { state: "na" };
+		let access = void 0;
+		if (ctx.packageJson && ctx.packageJson.publishConfig) ({access} = ctx.packageJson.publishConfig);
+		if (access === "public" || access === "restricted") return { state: "ok" };
+		return {
+			actual: access,
+			message: "Set `publishConfig.access` in package.json to `public` or `restricted` to declare publish scope explicitly.",
+			state: "violation"
+		};
+	},
+	docs: "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#publishconfig",
+	file: packageJson,
+	fix() {
+		return [{
+			file: packageJson,
+			message: "Add `\"publishConfig\": { \"access\": \"public\" }` (or `\"restricted\"`) to package.json so publishes never default unexpectedly.",
+			op: "note"
+		}];
+	},
+	fixKind: "advisory"
+};
+const publishAccess = {
+	bindings: {
+		aube: publishAccessBinding,
+		bun: publishAccessBinding,
+		npm: publishAccessBinding,
+		pnpm: publishAccessBinding,
+		yarn: publishAccessBinding
+	},
+	description: "Set `publishConfig.access` so a misconfigured scope or registry never accidentally publishes an internal package publicly.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#for-maintainers",
+	id: "publish-access",
+	severity: "info",
+	title: "Declare publish access explicitly"
+};
+
+//#endregion
+//#region src/domain/rules/store-server.ts
+const { pnpmWorkspace: pnpmWorkspace$1 } = CONFIG_FILES;
+const pnpmBinding = {
+	check(_ctx, config) {
+		const value = getByPath(config, ["useRunningStoreServer"]);
+		if (value !== true) return { state: "ok" };
+		return {
+			actual: value,
+			message: "Review `useRunningStoreServer` in pnpm-workspace.yaml. Delegating store operations to an external process introduces a trust boundary — the server process can serve tampered packages.",
+			state: "violation"
+		};
+	},
+	docs: "https://pnpm.io/settings#userunningStoreserver",
+	file: pnpmWorkspace$1,
+	fix() {
+		return [{
+			file: pnpmWorkspace$1,
+			message: "Verify the store server is running in a trusted environment and that its communication channel is not exposed to untrusted networks.",
+			op: "note"
+		}];
+	},
+	fixKind: "advisory"
+};
+const storeServer = {
+	bindings: { pnpm: pnpmBinding },
+	description: "Flag use of an external store server process, which introduces a trust boundary where tampered packages could be served.",
+	docs: "https://pnpm.io/settings#userunningStoreserver",
+	id: "store-server",
+	severity: "info",
+	title: "Review store server usage"
+};
+
+//#endregion
+//#region src/domain/rules/strict-allow-scripts.ts
+const { npmrc } = CONFIG_FILES;
+const strictAllowScripts = requireConfigKey({
+	bindings: { npm: {
+		docs: "https://docs.npmjs.com/cli/v11/using-npm/config#strict-allow-scripts",
+		file: npmrc,
+		keyPath: ["strict-allow-scripts"],
+		message: "Set `strict-allow-scripts=true` in .npmrc to block packages with unapproved install scripts.",
+		value: true
+	} },
+	description: "Turn install-script policy warnings into hard errors so unapproved lifecycle scripts block installation.",
+	docs: "https://docs.npmjs.com/cli/v11/using-npm/config#strict-allow-scripts",
+	id: "strict-allow-scripts",
+	severity: "warn",
+	title: "Require explicit script allow-listing"
+});
+
+//#endregion
+//#region src/domain/rules/strict-release-age.ts
+const { aubeWorkspace: aubeWorkspace$2 } = CONFIG_FILES;
+const strictReleaseAge = requireConfigKey({
+	bindings: { aube: {
+		docs: "https://aube.jdx.dev/settings/",
+		file: aubeWorkspace$2,
+		keyPath: ["minimumReleaseAgeStrict"],
+		message: "Set `minimumReleaseAgeStrict: true` in aube-workspace.yaml to make the release age gate a hard block.",
+		value: true
+	} },
+	description: "Make the minimum release age gate a hard failure instead of falling back to the next-oldest satisfying version.",
+	docs: "https://aube.jdx.dev/security.html",
+	id: "strict-release-age",
+	severity: "info",
+	title: "Enforce strict release age gate"
+});
+
+//#endregion
+//#region src/domain/rules/strict-store-integrity.ts
+const { aubeWorkspace: aubeWorkspace$1 } = CONFIG_FILES;
+const strictStoreIntegrity = requireConfigKey({
+	bindings: { aube: {
+		docs: "https://aube.jdx.dev/settings/",
+		file: aubeWorkspace$1,
+		keyPath: ["strictStoreIntegrity"],
+		message: "Set `strictStoreIntegrity: true` in aube-workspace.yaml to refuse tarballs that lack integrity metadata.",
+		value: true
+	} },
+	description: "Refuse to import tarballs from the registry when the packument lacks a dist.integrity field, preventing silent integrity bypass.",
+	docs: "https://aube.jdx.dev/security.html",
+	id: "strict-store-integrity",
+	severity: "warn",
+	title: "Require tarball integrity metadata"
+});
+
+//#endregion
+//#region src/domain/rules/trust-policy.ts
+const { aubeWorkspace, pnpmWorkspace } = CONFIG_FILES;
+const trustPolicy = requireConfigKey({
+	bindings: {
+		aube: {
+			docs: "https://aube.jdx.dev/security.html",
+			file: aubeWorkspace,
+			keyPath: ["trustPolicy"],
+			message: "Set `trustPolicy: no-downgrade` in aube-workspace.yaml to block packages whose trust level has decreased.",
+			value: "no-downgrade"
+		},
+		pnpm: {
+			docs: "https://pnpm.io/settings#trustpolicy",
+			file: pnpmWorkspace,
+			keyPath: ["trustPolicy"],
+			message: "Set `trustPolicy: no-downgrade` in pnpm-workspace.yaml to block packages whose trust level has decreased.",
+			value: "no-downgrade",
+			versionNote: { configAvailableSince: "pnpm 10.21.0" }
+		}
+	},
+	description: "Fail installation when a package trust level has decreased compared to previous releases, catching publisher credential downgrades.",
+	docs: "https://pnpm.io/settings#trustpolicy",
+	id: "trust-policy",
+	severity: "warn",
+	title: "Enforce trust policy on dependency updates"
+});
+
+//#endregion
+//#region src/domain/builtin-rules.ts
+const RULE_REGISTRY = {
+	"advisory-check": advisoryCheck,
+	"approved-git-repos": approvedGitRepos,
+	"audit-suppression": auditSuppression,
+	"block-auto-install": blockAutoInstall,
+	"block-exotic-subdeps": blockExoticSubdeps,
+	"bun-security-scanner": bunSecurityScanner,
+	"checksum-verification": checksumVerification,
+	"commit-lockfile": commitLockfile,
+	"dependency-overrides": dependencyOverrides,
+	"disable-lifecycle-scripts": disableLifecycleScripts,
+	"enforce-strict-ssl": enforceStrictSsl,
+	"files-field": filesField,
+	"frozen-lockfile": frozenLockfile,
+	"frozen-store": frozenStore,
+	"hardened-mode": hardenedMode,
+	"minimum-release-age": minimumReleaseAge,
+	"named-registries": namedRegistries,
+	"paranoid-mode": paranoidMode,
+	"patched-dependencies": patchedDependencies,
+	"pin-exact-versions": pinExactVersions,
+	provenance,
+	"publish-access": publishAccess,
+	"store-server": storeServer,
+	"strict-allow-scripts": strictAllowScripts,
+	"strict-release-age": strictReleaseAge,
+	"strict-store-integrity": strictStoreIntegrity,
+	"trust-policy": trustPolicy
+};
+const rules = Object.values(RULE_REGISTRY);
+
+//#endregion
+//#region src/domain/services/validate-rule-ids.ts
+/**
+* Cross-check a loaded SiroConfig against the registered builtin rules.
+*
+* Pure: no I/O, no globals, takes builtins as an argument so it stays
+* testable and so the domain layer doesn't reach for `builtin-rules.ts`
+* via a hidden static dependency. Callers (the adapters-layer loadConfig
+* and the application-layer assertConfigRuleIdsKnown) pass the builtin
+* list explicitly.
+*
+* Why both checks in one pass? `duplicates` must be detected against the
+* builtin set *before* `unknown` consults the merged (builtin ∪ custom)
+* set — otherwise a colliding customRule id silently widens the known
+* set and a typo in `rules` aimed at that id is no longer flagged.
+*/
+const detectDuplicates = (customRules, builtinIds) => {
+	const duplicateSet = /* @__PURE__ */ new Set();
+	const seen = /* @__PURE__ */ new Set();
+	for (const rule of customRules) {
+		if (builtinIds.has(rule.id) || seen.has(rule.id)) duplicateSet.add(rule.id);
+		seen.add(rule.id);
+	}
+	return [...duplicateSet];
+};
+const detectUnknown = (rules, known) => {
+	const unknown = [];
+	for (const id of Object.keys(rules)) if (!known.has(id)) unknown.push(id);
+	return unknown;
+};
+const validateRuleIds = (config, builtins, extraKnownIds = []) => {
+	const builtinIds = new Set(builtins.map((rule) => rule.id));
+	const customRules = config.customRules ?? [];
+	const duplicates = detectDuplicates(customRules, builtinIds);
+	const known = new Set(builtinIds);
+	for (const id of extraKnownIds) known.add(id);
+	for (const rule of customRules) known.add(rule.id);
+	return {
+		duplicates,
+		unknown: detectUnknown(config.rules ?? {}, known)
+	};
+};
+
+//#endregion
+//#region src/application/validate-config-rules.ts
+const EMPTY$1 = 0;
+const SINGLE = 1;
+const throwUnknownIds = (unknown) => {
+	let plural = "";
+	if (unknown.length > SINGLE) plural = "s";
+	throw new ConfigError(`siro.config: unknown rule id${plural} in rules: ${unknown.map((id) => `'${id}'`).join(", ")}`);
+};
+const assertConfigRuleIdsKnown = (userConfig, programmaticRules) => {
+	if (typeof userConfig === "undefined") return;
+	const { unknown } = validateRuleIds(userConfig, rules, (programmaticRules ?? []).map((rule) => rule.id));
+	if (unknown.length > EMPTY$1) throwUnknownIds(unknown);
+};
+
+//#endregion
+//#region src/domain/schemas/package-json.ts
+/**
+* Subset of `package.json` that siro actually reads. We keep the schema
+* intentionally narrow — every field rules consume is here, everything else
+* passes through unvalidated under `[key: string]: unknown` semantics.
+*
+* Every field is wrapped in `v.fallback` so one type-mismatched field can't
+* blank out the entire typed view (and silently N/A every publish rule).
+* A malformed value reads as "absent" — EXCEPT `private`, which falls back to
+* `true`: a security tool must never flip a broken `private` into publishable.
+*/
+const [ABSENT] = [];
+const optionalString = vb.fallback(vb.optional(vb.string()), ABSENT);
+const PackageJsonSchema = vb.looseObject({
+	files: vb.fallback(vb.optional(vb.array(vb.string())), ABSENT),
+	name: optionalString,
+	packageManager: optionalString,
+	private: vb.optional(vb.fallback(vb.boolean(), true)),
+	publishConfig: vb.fallback(vb.optional(vb.looseObject({ access: vb.fallback(vb.optional(vb.union([vb.literal("public"), vb.literal("restricted")])), ABSENT) })), ABSENT),
+	trustedDependencies: vb.fallback(vb.optional(vb.array(vb.string())), ABSENT)
+});
+const safeParsePackageJson = (value) => {
+	const result = vb.safeParse(PackageJsonSchema, value);
+	if (result.success) return result.output;
+};
+
+//#endregion
+//#region src/adapters/node-file-system.ts
+const nodeFileSystem = {
+	exists(filePath) {
+		try {
+			accessSync(filePath, constants.F_OK);
+			return true;
+		} catch (error) {
+			if (isNodeError(error) && error.code === "ENOENT") return false;
+			throw error;
+		}
+	},
+	readText(filePath) {
+		try {
+			return readFileSync(filePath, "utf8");
+		} catch (error) {
+			if (isNodeError(error) && error.code === "ENOENT") return;
+			throw error;
+		}
+	}
+};
+const resolveIn = (root, relPath) => asAbsPath(path.join(root, relPath));
+
+//#endregion
+//#region src/adapters/repo-context.ts
+const tryParseJson = (text) => {
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		let errMsg = String(error);
+		if (error instanceof Error) errMsg = error.message;
+		throw new ConfigError(`package.json: invalid JSON — ${errMsg}`);
+	}
+};
+const parsePackageJson = (raw) => {
+	return safeParsePackageJson(tryParseJson(raw.trim()));
+};
+const createRepoContext = (root, fs = nodeFileSystem) => {
+	const readText = (relPath) => fs.readText(resolveIn(root, relPath));
+	const exists = (relPath) => fs.exists(resolveIn(root, relPath));
+	const raw = readText(asRelPath("package.json"));
+	let packageJson = void 0;
+	if (typeof raw !== "undefined") packageJson = parsePackageJson(raw);
+	return {
+		exists,
+		packageJson,
+		readText,
+		root
+	};
+};
+
+//#endregion
+//#region src/adapters/config-loader.ts
+const MIN_PMS_LENGTH = 1;
+const CONFIG_NAMES = [
+	"siro.config.ts",
+	"siro.config.mjs",
+	"siro.config.js"
+];
+const ConfigSchema = vb.strictObject({
+	customRules: vb.optional(vb.array(vb.custom(() => true))),
+	pms: vb.optional(vb.pipe(vb.array(vb.picklist(PMS)), vb.minLength(MIN_PMS_LENGTH, "must not be empty (omit the key to auto-detect, or list at least one PM)"))),
+	reporters: vb.optional(vb.array(vb.custom(isReporterShape, "must be a { name, format } reporter"))),
+	rules: vb.optional(vb.record(vb.string(), vb.union([vb.picklist(SEVERITIES), vb.literal("off")])))
+}, "unknown config key (check for a typo)");
+const describeError = (err) => {
+	if (err instanceof Error) return err.message;
+	return String(err);
+};
+const formatIssues = (issues) => issues.map((issue) => {
+	const keyPath = (issue.path ?? []).map((seg) => seg.key).filter((key) => typeof key === "string" || typeof key === "number").join(".");
+	if (keyPath) return `${keyPath}: ${issue.message}`;
+	return issue.message;
+}).join("; ");
+const TS_STRIPPING_MAJOR_22 = 22;
+const TS_STRIPPING_MINOR_22 = 18;
+const TS_STRIPPING_MAJOR_23 = 23;
+const TS_STRIPPING_MINOR_23 = 6;
+const TS_STRIPPING_ALWAYS_SINCE = 24;
+/** Whether a Node version imports .ts via native type stripping (unflagged since 22.18.0 / 23.6.0). */
+const hasNativeTypeStripping = (version) => {
+	const [majorRaw = "", minorRaw = "0"] = version.replace(/^v/u, "").split(".");
+	const major = Number(majorRaw);
+	const minor = Number(minorRaw);
+	if (major >= TS_STRIPPING_ALWAYS_SINCE) return true;
+	if (major === TS_STRIPPING_MAJOR_23) return minor >= TS_STRIPPING_MINOR_23;
+	if (major === TS_STRIPPING_MAJOR_22) return minor >= TS_STRIPPING_MINOR_22;
+	return false;
+};
+let loadCounter = 0;
+const INCREMENT = 1;
+const importConfig = (modulePath, name) => {
+	const url = pathToFileURL(modulePath);
+	loadCounter += INCREMENT;
+	url.searchParams.set("siro-load", String(loadCounter));
+	return import(url.href).catch((error) => {
+		throw new ConfigError(`Failed to load ${name}: ${describeError(error)}`);
+	});
+};
+const extractDefault = (mod) => {
+	if (mod !== null && typeof mod === "object" && "default" in mod) return mod.default;
+	return mod;
+};
+const validateCandidateShape = (candidate, name) => {
+	if (typeof candidate === "undefined" || candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) {
+		let got = typeof candidate;
+		if (Array.isArray(candidate)) got = "an array";
+		throw new ConfigError(`${name} must export a config object (got ${got}).`);
+	}
+	return candidate;
+};
+const validateSchema = (candidate, name) => {
+	const result = vb.safeParse(ConfigSchema, candidate);
+	if (!result.success) throw new ConfigError(`${name}: ${formatIssues(result.issues)}`);
+	return result.output;
+};
+const rejectDuplicateCustomRuleIds = (config, name) => {
+	const EMPTY = 0;
+	const SINGLE = 1;
+	const { duplicates } = validateRuleIds(config, rules);
+	if (duplicates.length > EMPTY) {
+		let plural = "";
+		if (duplicates.length > SINGLE) plural = "s";
+		throw new ConfigError(`${name}: duplicate customRule id${plural}: ${duplicates.map((id) => `'${id}'`).join(", ")}. Pick a unique id (or use 'rules' to override an existing rule's severity).`);
+	}
+};
+const parseCandidate = (configPath, name) => importConfig(configPath, name).then((mod) => {
+	const config = validateSchema(validateCandidateShape(extractDefault(mod), name), name);
+	rejectDuplicateCustomRuleIds(config, name);
+	return config;
+});
+/**
+* Locate and load `siro.config.{ts,mjs,js}` under `cwd`. Returns undefined when
+* no config exists. Throws ConfigError on malformed exports.
+*/
+const loadConfig = (cwd, fs = nodeFileSystem, nodeVersion = process.versions.node) => {
+	const candidate = CONFIG_NAMES.find((name) => fs.exists(asAbsPath(path.join(cwd, name))));
+	if (typeof candidate === "undefined") return Promise.resolve(void 0);
+	if (candidate.endsWith(".ts") && !hasNativeTypeStripping(nodeVersion)) return Promise.reject(new ConfigError(`${candidate} requires Node.js with native type stripping (^22.18.0 || ^23.6.0 || >=24); current is v${nodeVersion}. Rename the config to siro.config.mjs (plain JS) or upgrade Node.js.`));
+	return parseCandidate(asAbsPath(path.join(cwd, candidate)), candidate);
+};
+
+//#endregion
+//#region src/domain/services/merge-programmatic-rules.ts
+/**
+* Compose builtin rules with embedder-supplied programmatic rules. Reject
+* any programmatic rule whose id collides with a builtin, a config-supplied
+* customRule, or another programmatic rule in the same call — embedders need
+* to hear about collisions explicitly, the same way loadConfig surfaces
+* intra-config duplicates (otherwise two rules with the same id race through
+* applyConfig and double-count findings).
+*/
+const detectCollisions = (programmatic, taken) => {
+	const seen = /* @__PURE__ */ new Set();
+	const collisions = /* @__PURE__ */ new Set();
+	for (const rule of programmatic) {
+		if (taken.has(rule.id) || seen.has(rule.id)) collisions.add(rule.id);
+		seen.add(rule.id);
+	}
+	return collisions;
+};
+const SINGLE_COLLISION = 1;
+const throwCollisionError = (collisions) => {
+	const ids = [...collisions];
+	let noun = "rule id collides";
+	if (ids.length > SINGLE_COLLISION) noun = "rule ids collide";
+	throw new ConfigError(`customRules: ${noun} with builtin, config, or another programmatic rule: ${ids.map((id) => `'${id}'`).join(", ")}. Pick a unique id (or use 'rules' to override an existing rule's severity).`);
+};
+const mergeProgrammaticRules = (builtins, programmatic, configCustom) => {
+	const EMPTY = 0;
+	if (typeof programmatic === "undefined" || programmatic.length === EMPTY) return builtins;
+	const collisions = detectCollisions(programmatic, new Set([...builtins.map((rule) => rule.id), ...(configCustom ?? []).map((rule) => rule.id)]));
+	if (collisions.size > EMPTY) throwCollisionError(collisions);
+	return [...builtins, ...programmatic];
+};
+
+//#endregion
+//#region src/domain/services/detect-pms.ts
+/**
+* Per-PM list of filenames whose presence identifies that PM: its own
+* `lockfiles` plus `configs`. `reusesLockfiles` is deliberately excluded —
+* those are other PMs' shapes (see PMSignals), so they must not count as
+* detection evidence. With reused lockfiles split out, every detection signal
+* is owned by exactly one PM; the IIFE asserts that invariant at module load
+* so a future signal collision fails loudly here rather than silently
+* mis-attributing a file.
+*/
+const registerSignals = (signals, pm, owner) => {
+	for (const file of signals) {
+		const prior = owner.get(file);
+		if (typeof prior !== "undefined") throw new TypeError(`detection signal '${file}' is claimed by both '${prior}' and '${pm}'`);
+		owner.set(file, pm);
+	}
+};
+const buildDetectionSignals = () => {
+	const out = /* @__PURE__ */ new Map();
+	const owner = /* @__PURE__ */ new Map();
+	for (const pm of PMS) {
+		const { lockfiles, configs } = PM_SIGNALS[pm];
+		const signals = [...lockfiles, ...configs];
+		registerSignals(signals, pm, owner);
+		out.set(pm, signals);
+	}
+	return out;
+};
+const DETECTION_SIGNALS = buildDetectionSignals();
+/**
+* Detect the package managers in use, strongest signal first:
+*   1) `packageManager` in package.json,
+*   2) lockfiles + configs (see DETECTION_SIGNALS for the per-PM allow-list
+*      that skips filenames shared between PMs).
+* Returns every PM with evidence, in canonical `PMS` order. `ctx` carries
+* the repo signals — `packageJson` (already parsed) and `exists(relPath)`
+* for filename probing — so embedders can swap in a virtual FS without
+* touching the real disk.
+*/
+const addDeclaredPM = (ctx, found) => {
+	let declared = void 0;
+	if (ctx.packageJson) declared = ctx.packageJson.packageManager;
+	if (typeof declared === "string") {
+		const pm = parsePackageManagerField(declared);
+		if (typeof pm !== "undefined") found.add(pm);
+	}
+};
+const detectPMs = (ctx) => {
+	const found = /* @__PURE__ */ new Set();
+	addDeclaredPM(ctx, found);
+	for (const pm of PMS) {
+		const signals = DETECTION_SIGNALS.get(pm);
+		if (signals && signals.some((file) => ctx.exists(asRelPath(file)))) found.add(pm);
+	}
+	return PMS.filter((pm) => found.has(pm));
+};
+
+//#endregion
+//#region src/domain/services/resolve-pms.ts
+const throwEmptyPMsError = (detected, opts, allowed) => {
+	if (allowed) {
+		if (opts.pmOverride) throw new UsageError(`--pm ${opts.pmOverride} is not in siro.config.ts pms (${allowed.join(", ")}). Adjust the config or the flag.`);
+		const EMPTY = 0;
+		let msg = `No package manager detected, and siro.config.ts restricts pms to ${allowed.join(", ")}. Adjust the config or remove the restriction.`;
+		if (detected.length > EMPTY) msg = `Detected PMs (${detected.join(", ")}) do not match siro.config.ts pms (${allowed.join(", ")}). Adjust the config or remove the restriction.`;
+		throw new UsageError(msg);
+	}
+	throw new UsageError(`No package manager detected. Pass --pm <${PMS.join("|")}> to be explicit.`);
+};
+/**
+* Pick the set of PMs to operate on for a single CLI command, applying the
+* same three-stage policy (`override → detect → restrict`) that `lint`
+* needs. Throws `UsageError` for the two empty-set cases so the
+* caller never has to invent its own messaging.
+*
+* Empty-set branches are usage errors, not silent npm fallback: see DECISIONS.md D08.
+*/
+const computePMs = (ctx, opts) => {
+	let detected = detectPMs(ctx);
+	if (opts.pmOverride) detected = [opts.pmOverride];
+	const { allowed } = opts;
+	let pms = detected;
+	if (allowed) {
+		const allowedSet = new Set(allowed);
+		pms = detected.filter((pm) => allowedSet.has(pm));
+	}
+	return {
+		detected,
+		pms
+	};
+};
+const resolvePMs = (ctx, opts) => {
+	const { detected, pms } = computePMs(ctx, opts);
+	if (pms.length > 0) return pms;
+	throw throwEmptyPMsError(detected, opts, opts.allowed);
+};
+
+//#endregion
+//#region src/application/prepare-context.ts
+/**
+* Shared composition-root preamble for `lint` (kept separate so a future
+* command cannot drift from the load → context → resolve → merge → validate →
+* applyConfig protocol).
+*/
+const resolveRuleSet = (userConfig, customRules) => {
+	let configCustomRules = void 0;
+	if (userConfig) configCustomRules = userConfig.customRules;
+	const base = mergeProgrammaticRules(rules, customRules, configCustomRules);
+	assertConfigRuleIdsKnown(userConfig, customRules);
+	return applyConfig(base, userConfig);
+};
+const buildRunResult = (options, userConfig) => {
+	const { cwd, fs, pm, customRules } = options;
+	const ctx = createRepoContext(cwd, fs);
+	let allowedPms = void 0;
+	if (userConfig) allowedPms = userConfig.pms;
+	return {
+		ctx,
+		pms: resolvePMs(ctx, {
+			allowed: allowedPms,
+			pmOverride: pm
+		}),
+		ruleSet: resolveRuleSet(userConfig, customRules),
+		userConfig
+	};
+};
+const prepareRun = (options) => loadConfig(options.cwd, options.fs).then((userConfig) => buildRunResult(options, userConfig));
+
+//#endregion
+//#region src/domain/services/evaluate-bindings.ts
+/**
+* Iterate every applicable `(rule, pm)` binding, run its check, and hand
+* each violation to `onViolation`. Folding the loop into one place keeps
+* the rule-evaluation contract (parse once, run check, gate on violation)
+* in a single location so the call site (`runLint`) stays declarative.
+*/
+const evaluateBindings = (opts) => {
+	const { ctx, pms, ruleSet, parseConfig, onViolation } = opts;
+	for (const rule of ruleSet) for (const pm of pms) {
+		const binding = rule.bindings[pm];
+		if (typeof binding !== "undefined") {
+			const { parsed } = parseConfig(ctx, binding.file);
+			const status = binding.check(ctx, parsed);
+			if (status.state === "violation") onViolation({
+				binding,
+				pm,
+				rule,
+				status
+			});
+		}
+	}
+};
+
+//#endregion
+//#region src/domain/services/parse-config-file.ts
+const EMPTY_FILE = Object.freeze({ parsed: Object.freeze({}) });
+const parseAndCache = (ctx, file, deps) => {
+	const text = ctx.readText(file.path) ?? "";
+	const entry = { parsed: wrapCodecError(file.path, () => deps.codecFor(file.kind).parse(text)) };
+	deps.cache.set(deps.cacheKey, entry);
+	return entry;
+};
+/** Create a fresh, command-scoped parser. Always call once per command. */
+const createConfigParser = (codecFor) => {
+	const cache = /* @__PURE__ */ new Map();
+	return (ctx, file) => {
+		if (file.kind === "fileGlob") return EMPTY_FILE;
+		const cacheKey = `${file.kind}:${file.path}`;
+		const hit = cache.get(cacheKey);
+		if (typeof hit !== "undefined") return hit;
+		return parseAndCache(ctx, file, {
+			cache,
+			cacheKey,
+			codecFor
+		});
+	};
+};
+
+//#endregion
+//#region src/domain/services/decide-severity.ts
+/**
+* A user `rules` override is NOT consulted here: `applyConfig` rewrites
+* `rule.severity` to the user's choice AND strips `binding.severity` +
+* dynamic `status.severity` before this function ever runs, so a single
+* three-source resolution suffices at the call site.
+*/
+const decideSeverity = (status, binding, rule) => status.severity ?? binding.severity ?? rule.severity;
+
+//#endregion
+//#region src/application/run-lint.ts
+const EMPTY = 0;
+const resolveManualSteps = (raw) => {
+	if (typeof raw !== "undefined" && raw.length > EMPTY) return raw;
+};
+const buildFinding = (visit, ctx) => {
+	const { rule, pm, binding, status } = visit;
+	const severity = decideSeverity(status, binding, rule);
+	const manualSteps = resolveManualSteps(status.manualSteps);
+	let filePath = void 0;
+	if (binding.file.kind !== "fileGlob") filePath = binding.file.path;
+	let fix = [];
+	if (typeof manualSteps === "undefined") fix = binding.fix(ctx);
+	return {
+		actual: status.actual,
+		docs: binding.docs ?? rule.docs,
+		expected: status.expected,
+		file: filePath,
+		fix,
+		fixable: binding.fixKind === "auto" && typeof manualSteps === "undefined",
+		manualSteps,
+		message: status.message,
+		pm,
+		ruleId: rule.id,
+		severity
+	};
+};
+/** Evaluate every rule binding for the given PMs and collect violations. */
+const runLint = (opts) => {
+	const { ctx, pms, ruleSet, codecFor } = opts;
+	const findings = [];
+	const summary = {
+		error: 0,
+		info: 0,
+		warn: 0
+	};
+	evaluateBindings({
+		ctx,
+		onViolation: (visit) => {
+			const finding = buildFinding(visit, ctx);
+			findings.push(finding);
+			summary[finding.severity] += 1;
+		},
+		parseConfig: createConfigParser(codecFor),
+		pms,
+		ruleSet
+	});
+	return {
+		findings,
+		summary
+	};
+};
+
+//#endregion
+//#region src/application/commands/lint.ts
+const resolveReporter = (value, registry) => {
+	if (typeof value === "undefined") return registry.get("pretty");
+	if (typeof value === "string") return registry.get(value);
+	if (!isReporterShape(value)) throw new UsageError("The 'reporter' option must be a name or a { name, format } object.");
+	return value;
+};
+const validateEmbedderReporters = (reporters) => {
+	for (const rep of reporters ?? []) if (!isReporterShape(rep)) throw new UsageError("A reporter in 'reporters' needs a string 'name' and a 'format' function.");
+};
+const resolveAndValidateReporter = (value, registry) => {
+	const reporter = resolveReporter(value, registry);
+	if (typeof reporter === "undefined") throw new UsageError(`Unknown reporter: ${String(value)} (available: ${registry.list().join(", ")})`);
+	return reporter;
+};
+const formatAndExit = (args) => {
+	const result = runLint({
+		codecFor,
+		ctx: args.ctx,
+		pms: args.pms,
+		ruleSet: args.ruleSet
+	});
+	const displayThreshold = args.options.severity ?? "info";
+	const failThreshold = args.options.severity ?? "error";
+	args.reporter.format(filterBySeverity(result, displayThreshold), args.io);
+	return exitCodeForLint(result, failThreshold);
+};
+/** `siro lint`: detect PMs, evaluate rules, report findings. */
+const lintCommand = (options, io) => prepareRun({
+	customRules: options.customRules,
+	cwd: options.cwd,
+	fs: options.fs,
+	pm: options.pm
+}).then(({ userConfig, ctx, pms, ruleSet }) => {
+	validateEmbedderReporters(options.reporters);
+	let configReporters = [];
+	if (userConfig && userConfig.reporters) configReporters = userConfig.reporters;
+	const registry = createRegistry([...options.reporters ?? [], ...configReporters]);
+	return formatAndExit({
+		ctx,
+		io,
+		options,
+		pms,
+		reporter: resolveAndValidateReporter(options.reporter, registry),
+		ruleSet
+	});
+});
+
+//#endregion
+//#region src/adapters/node-io.ts
+const nodeIO = {
+	stderr: (line) => process.stderr.write(`${line}\n`),
+	stdout: (line) => process.stdout.write(`${line}\n`)
+};
+
+//#endregion
+export { asRelPath as A, isPM as C, ConfigError as D, UsageError as E, SiroError as O, SEVERITIES as S, wrapCodecError as T, jsonReporter as _, PM_SIGNALS as a, isReporterShape as b, requireConfigKey as c, exitCodeForLint as d, filterBySeverity as f, prettyReporter as g, createRegistry as h, nodeFileSystem as i, asAbsPath as k, CONFIG_FILES as l, BUILTIN_REPORTER_NAMES as m, lintCommand as n, overrideBindings as o, isNodeError as p, detectPMs as r, renderVersionNoteMessage as s, nodeIO as t, getByPath as u, version as v, isSeverity as w, PMS as x, githubReporter as y };
+//# sourceMappingURL=node-io-Cb8nixgE.mjs.map