@pho9ubenaa/siro 0.2.0 → 0.3.0

package/dist/{node-io-Cb8nixgE.mjs → node-io-CUcMwlGH.mjs}

@@ -20,11 +20,6 @@ const asRelPath = (path) => path;
 * place so individual commands never have to think about exit semantics.
 * The exit-code table lives in docs/configuration.md S"Exit codes" and
 * src/cli/help.ts (HELP_LINT) -- not restated here.
-*
-* One mapping note that belongs at this altitude: filesystem errno errors
-* are routed to 2 by SHAPE (numeric `errno`) in cli run(), so an
-* errno-bearing throw from a user extension also lands on 2 rather than the
-* 70 crash path -- same remedy (fix the environment) either way.
 */
 var SiroError = class extends Error {
 	/** Recommended process exit code for this error. */
@@ -114,9 +109,7 @@ const isPM = (value) => PM_SET.has(value);
 const isSeverity = (value) => SEVERITY_SET.has(value);
 const PACKAGE_MANAGER_FIELD = /^(?<pmName>[a-z]+)(?:@.+)?$/u;
 const parsePackageManagerField = (value) => {
-	const match = PACKAGE_MANAGER_FIELD.exec(value.trim());
-	let name = void 0;
-	if (match && match.groups) name = match.groups.pmName;
+	const name = PACKAGE_MANAGER_FIELD.exec(value.trim())?.groups?.pmName;
 	if (typeof name !== "undefined" && isPM(name)) return name;
 };
 
@@ -160,7 +153,7 @@ const githubReporter = {
 
 //#endregion
 //#region src/version.ts
-const version = "0.2.0";
+const version = "0.3.0";
 
 //#endregion
 //#region src/adapters/reporters/json.ts
@@ -246,6 +239,8 @@ const BUILTINS = [
 	jsonReporter,
 	githubReporter
 ];
+const DEFAULT_REPORTER_NAME = prettyReporter.name;
+const JSON_REPORTER_NAME = jsonReporter.name;
 /** Names of every built-in reporter, in stable display order. */
 const BUILTIN_REPORTER_NAMES = BUILTINS.map((rep) => rep.name);
 /** Build a registry from the builtins plus any extras (later wins on collision). */
@@ -261,6 +256,29 @@ const createRegistry = (extras = []) => {
 	};
 };
 
+//#endregion
+//#region src/shared/node-version.ts
+const SUPPORTED_NODE_RANGE = "^22.18.0 || ^23.6.0 || >=24.0.0";
+const MAJOR_22 = 22;
+const MINOR_22 = 18;
+const MAJOR_23 = 23;
+const MINOR_23 = 6;
+const ALWAYS_SUPPORTED_SINCE = 24;
+const isSupportedNodeVersion = (version) => {
+	const [majorRaw = "", minorRaw = "0"] = version.replace(/^v/u, "").split(".");
+	const major = Number(majorRaw);
+	const minor = Number(minorRaw);
+	if (major >= ALWAYS_SUPPORTED_SINCE) return true;
+	if (major === MAJOR_23) return minor >= MINOR_23;
+	if (major === MAJOR_22) return minor >= MINOR_22;
+	return false;
+};
+
+//#endregion
+//#region src/domain/entities/project-type.ts
+const PROJECT_TYPES = ["application", "package"];
+const isProjectType = (value) => PROJECT_TYPES.some((projectType) => projectType === value);
+
 //#endregion
 //#region src/adapters/node-errors.ts
 /**
@@ -310,6 +328,12 @@ const exitCodeForLint = (result, threshold = "error") => {
 
 //#endregion
 //#region src/domain/entities/config-value.ts
+const CODEC_KINDS = [
+	"json",
+	"npmrc",
+	"toml",
+	"yaml"
+];
 const isParsedConfigObject = (value) => {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
 	const proto = Object.getPrototypeOf(value);
@@ -327,6 +351,7 @@ const getByPath = (config, keyPath) => {
 	let current = config;
 	for (const key of keyPath) {
 		if (!isParsedConfigObject(current)) return;
+		if (!Object.hasOwn(current, key)) return;
 		current = current[key];
 	}
 	return current;
@@ -347,6 +372,29 @@ const toParsedConfig = (value) => {
 	return {};
 };
 
+//#endregion
+//#region src/domain/entities/rule.ts
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isOptionalString = (value) => typeof value === "undefined" || typeof value === "string";
+const CONFIG_FILE_KINDS = new Set([...CODEC_KINDS, "fileGlob"]);
+const isConfigFileRefShape = (value) => {
+	if (!isRecord(value) || typeof value.kind !== "string" || typeof value.path !== "string") return false;
+	return CONFIG_FILE_KINDS.has(value.kind);
+};
+const isVersionNoteShape = (value) => typeof value === "undefined" || isRecord(value) && isOptionalString(value.configAvailableSince) && isOptionalString(value.defaultSafeSince) && isOptionalString(value.note);
+const isRuleBindingShape = (value) => {
+	if (!isRecord(value)) return false;
+	return isConfigFileRefShape(value.file) && (value.fixKind === "auto" || value.fixKind === "advisory") && isOptionalString(value.docs) && (typeof value.severity === "undefined" || typeof value.severity === "string" && isSeverity(value.severity)) && isVersionNoteShape(value.versionNote) && typeof value.check === "function" && typeof value.fix === "function";
+};
+const isBindingsShape = (value) => isRecord(value) && Object.entries(value).every(([pm, binding]) => isPM(pm) && isRuleBindingShape(binding));
+const isProjectTypeValue = (value) => typeof value === "string" && isProjectType(value);
+const isProjectTypesShape = (value) => typeof value === "undefined" || Array.isArray(value) && Array.from(value).every((projectType) => isProjectTypeValue(projectType));
+const isRuleShape = (value) => {
+	if (!isRecord(value)) return false;
+	return typeof value.id === "string" && typeof value.title === "string" && typeof value.description === "string" && typeof value.severity === "string" && isSeverity(value.severity) && isOptionalString(value.docs) && isProjectTypesShape(value.projectTypes) && isBindingsShape(value.bindings);
+};
+const defineRule = (rule) => rule;
+
 //#endregion
 //#region src/adapters/codecs/ini.ts
 const INTEGER_PATTERN = /^-?\d+$/u;
@@ -393,14 +441,18 @@ const jsonCodec = { parse(text) {
 //#region src/adapters/codecs/toml.ts
 const tomlCodec = { parse(text) {
 	if (text.trim() === "") return {};
-	return toParsedConfig(parse(text));
+	return toParsedConfig(parse(text.replace(/^\uFEFF/u, "")));
 } };
 
 //#endregion
 //#region src/adapters/codecs/yaml.ts
 const yamlCodec = { parse(text) {
 	if (text.trim() === "") return {};
-	return toParsedConfig(parseDocument(text).toJS());
+	const document = parseDocument(text);
+	if (document.errors.length > 0) throw document.errors[0];
+	return toParsedConfig(document.toJS({ onAnchor: (value) => {
+		JSON.stringify(value);
+	} }));
 } };
 
 //#endregion
@@ -461,14 +513,12 @@ const applyOverride = (rule, overrides, out) => {
 	else out.push(rewriteBindingsForSeverityOverride(rule, override));
 };
 const mergeBase = (base, config) => {
-	let customRules = void 0;
-	if (config) ({customRules} = config);
+	const customRules = config?.customRules;
 	return [...base, ...customRules ?? []];
 };
 const applyConfig = (base, config) => {
 	const merged = mergeBase(base, config);
-	let overrides = void 0;
-	if (config) overrides = config.rules;
+	const overrides = config?.rules;
 	if (typeof overrides === "undefined") return merged;
 	const out = [];
 	for (const rule of merged) applyOverride(rule, overrides, out);
@@ -534,28 +584,6 @@ const overrideBindings = (rule, overrides) => ({
 		...overrides
 	}
 });
-/**
-* Compose `message` with the structured suffix derived from {@link VersionNote}.
-* Exported for the two hand-written bindings that can't be expressed via
-* {@link requireConfigKey}: the pnpm slot of `disable-lifecycle-scripts`
-* (two-key gate+bypass) and `bun-security-scanner` (advisory shape).
-* New rules should grow `requireConfigKey` rather than reach for this
-* helper — every additional caller raises the cost of evolving the suffix
-* format.
-*/
-const buildVersionNoteParts = (versionNote) => {
-	const parts = [];
-	if (typeof versionNote.configAvailableSince !== "undefined") parts.push(`available since ${versionNote.configAvailableSince}`);
-	if (typeof versionNote.defaultSafeSince !== "undefined") parts.push(`default safe since ${versionNote.defaultSafeSince}`);
-	if (typeof versionNote.note !== "undefined") parts.push(versionNote.note);
-	return parts;
-};
-const renderVersionNoteMessage = (message, versionNote) => {
-	if (typeof versionNote === "undefined") return message;
-	const parts = buildVersionNoteParts(versionNote);
-	if (parts.length === 0) return message;
-	return `${message} (${parts.join("; ")})`;
-};
 const isDefaultOk = (spec) => {
 	if (spec.accept) return spec.accept(spec.documentedDefault);
 	return spec.documentedDefault === spec.value;
@@ -606,7 +634,7 @@ const checkKeyValue = (spec, config, message) => {
 const buildBinding = (spec, applies) => ({
 	check(ctx, config) {
 		if (typeof applies !== "undefined" && !applies(ctx)) return { state: "na" };
-		return checkKeyValue(spec, config, renderVersionNoteMessage(spec.message, spec.versionNote));
+		return checkKeyValue(spec, config, spec.message);
 	},
 	docs: spec.docs,
 	file: spec.file,
@@ -626,7 +654,8 @@ const buildBinding = (spec, applies) => ({
 		return ops;
 	},
 	fixKind: "auto",
-	severity: spec.severity
+	severity: spec.severity,
+	versionNote: spec.versionNote
 });
 /** Build a Rule from a per-PM table of {file, keyPath, value, message}. */
 const requireConfigKey = (options) => {
@@ -640,6 +669,7 @@ const requireConfigKey = (options) => {
 		description: options.description,
 		docs: options.docs,
 		id: options.id,
+		projectTypes: options.projectTypes,
 		severity: options.severity,
 		title: options.title
 	};
@@ -667,7 +697,7 @@ const advisoryCheck = requireConfigKey({
 //#endregion
 //#region src/domain/rules/approved-git-repos.ts
 const { yarnrc: yarnrc$9 } = CONFIG_FILES;
-const message = renderVersionNoteMessage("Set `approvedGitRepositories: []` in .yarnrc.yml to block all git: protocol dependencies (or list approved repository globs).", { configAvailableSince: "yarn 4.14.0" });
+const message = "Set `approvedGitRepositories: []` in .yarnrc.yml to block all git: protocol dependencies (or list approved repository globs).";
 const yarnBinding$2 = {
 	check(_ctx, config) {
 		const value = getByPath(config, ["approvedGitRepositories"]);
@@ -688,16 +718,17 @@ const yarnBinding$2 = {
 			op: "note"
 		}];
 	},
-	fixKind: "advisory"
+	fixKind: "advisory",
+	versionNote: { configAvailableSince: "yarn 4.14.0" }
 };
-const approvedGitRepos = {
+const approvedGitRepos = defineRule({
 	bindings: { yarn: yarnBinding$2 },
 	description: "Restrict git: protocol dependencies to an explicit allowlist of approved repository URL patterns.",
 	docs: "https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories",
 	id: "approved-git-repos",
 	severity: "warn",
 	title: "Approve git repository dependencies"
-};
+});
 
 //#endregion
 //#region src/domain/rules/audit-suppression.ts
@@ -729,14 +760,14 @@ const yarnBinding$1 = {
 	},
 	fixKind: "advisory"
 };
-const auditSuppression = {
+const auditSuppression = defineRule({
 	bindings: { yarn: yarnBinding$1 },
 	description: "Flag audit advisory suppressions that may silently hide future vulnerabilities via broad glob patterns.",
 	docs: "https://yarnpkg.com/configuration/yarnrc#npmAuditIgnoreAdvisories",
 	id: "audit-suppression",
 	severity: "info",
 	title: "Review audit suppression entries"
-};
+});
 
 //#endregion
 //#region src/domain/rules/block-auto-install.ts
@@ -813,7 +844,10 @@ const builtRule$3 = requireConfigKey({
 			keyPath: ["blockExoticSubdeps"],
 			message: "Set `blockExoticSubdeps: true` in pnpm-workspace.yaml to block git/tarball URLs in transitive dependencies.",
 			value: true,
-			versionNote: { configAvailableSince: "pnpm 10.26.0" }
+			versionNote: {
+				configAvailableSince: "pnpm 10.26.0",
+				defaultSafeSince: "pnpm 10.26.0"
+			}
 		}
 	},
 	description: "Refuse to install transitive dependencies sourced from git or tarball URLs, which bypass registry integrity checking.",
@@ -827,7 +861,6 @@ const blockExoticSubdeps = overrideBindings(builtRule$3, { npm: npmBinding });
 //#endregion
 //#region src/domain/rules/bun-security-scanner.ts
 const { bunfig: bunfig$4 } = CONFIG_FILES;
-const versionNote = { configAvailableSince: "bun 1.3.0" };
 const bunScannerBinding = {
 	check(_ctx, config) {
 		const scanner = getByPath(config, [
@@ -838,7 +871,7 @@ const bunScannerBinding = {
 		if (typeof scanner === "string" && scanner.length > 0) return { state: "ok" };
 		return {
 			actual: scanner,
-			message: renderVersionNoteMessage("Configure `[install.security] scanner = \"...\"` in bunfig.toml (e.g. `@socketsecurity/bun-security-scanner`) to scan new packages on install.", versionNote),
+			message: "Configure `[install.security] scanner = \"...\"` in bunfig.toml (e.g. `@socketsecurity/bun-security-scanner`) to scan new packages on install.",
 			state: "violation"
 		};
 	},
@@ -851,16 +884,17 @@ const bunScannerBinding = {
 			op: "note"
 		}];
 	},
-	fixKind: "advisory"
+	fixKind: "advisory",
+	versionNote: { configAvailableSince: "bun 1.3.0" }
 };
-const bunSecurityScanner = {
+const bunSecurityScanner = defineRule({
 	bindings: { bun: bunScannerBinding },
 	description: "Bun supports a Security Scanner API that intercepts new packages at install time (e.g. Socket Firewall).",
 	docs: "https://github.com/bodadotsh/npm-security-best-practices#preinstall-scanners",
 	id: "bun-security-scanner",
 	severity: "info",
 	title: "Enable a bun install-time security scanner"
-};
+});
 
 //#endregion
 //#region src/domain/rules/checksum-verification.ts
@@ -929,6 +963,7 @@ const LOCKFILE_DOCS = {
 	pnpm: "https://pnpm.io/git#lockfiles",
 	yarn: "https://yarnpkg.com/getting-started/qa#should-lockfiles-be-committed-to-the-repository"
 };
+const LOCKFILE_VERSION_NOTES = { deno: { configAvailableSince: "deno 1.28.0" } };
 const lockfileBinding = (pm) => {
 	const { lockfiles, reusesLockfiles } = PM_SIGNALS[pm];
 	const [primary] = lockfiles;
@@ -954,10 +989,11 @@ const lockfileBinding = (pm) => {
 				op: "ensureFileTracked"
 			}];
 		},
-		fixKind: "advisory"
+		fixKind: "advisory",
+		versionNote: LOCKFILE_VERSION_NOTES[pm]
 	};
 };
-const commitLockfile = {
+const commitLockfile = defineRule({
 	bindings: {
 		aube: lockfileBinding("aube"),
 		bun: lockfileBinding("bun"),
@@ -971,7 +1007,7 @@ const commitLockfile = {
 	id: "commit-lockfile",
 	severity: "error",
 	title: "Commit a lockfile"
-};
+});
 
 //#endregion
 //#region src/domain/rules/dependency-overrides.ts
@@ -1001,7 +1037,7 @@ const makeBinding = (file, fileName, docs) => ({
 	},
 	fixKind: "advisory"
 });
-const dependencyOverrides = {
+const dependencyOverrides = defineRule({
 	bindings: {
 		aube: makeBinding(aubeWorkspace$7, "aube-workspace.yaml", "https://aube.jdx.dev/settings.html"),
 		pnpm: makeBinding(pnpmWorkspace$9, "pnpm-workspace.yaml", "https://pnpm.io/settings#overrides")
@@ -1011,17 +1047,11 @@ const dependencyOverrides = {
 	id: "dependency-overrides",
 	severity: "info",
 	title: "Review dependency overrides"
-};
+});
 
 //#endregion
 //#region src/domain/rules/disable-lifecycle-scripts.ts
 const { npmrc: npmrc$5, pnpmWorkspace: pnpmWorkspace$8, yarnrc: yarnrc$6, aubeWorkspace: aubeWorkspace$6, bunfig: bunfig$3 } = CONFIG_FILES;
-const pnpmStrictDepBuildsDocs = "https://pnpm.io/settings#strictdepbuilds";
-const pnpmVersionNote = {
-	configAvailableSince: "pnpm 10.3.0",
-	defaultSafeSince: "pnpm 11.0.0"
-};
-const pnpmMsg = (body) => renderVersionNoteMessage(body, pnpmVersionNote);
 const pnpmBinding$4 = {
 	check(_ctx, config) {
 		const bypass = getByPath(config, ["dangerouslyAllowAllBuilds"]);
@@ -1029,7 +1059,7 @@ const pnpmBinding$4 = {
 			actual: bypass,
 			expected: false,
 			manualSteps: ["Remove `dangerouslyAllowAllBuilds: true` from pnpm-workspace.yaml (or set it to `false`). Setting `strictDepBuilds: true` alone has no effect while the bypass remains."],
-			message: pnpmMsg("`dangerouslyAllowAllBuilds: true` in pnpm-workspace.yaml bypasses strictDepBuilds — remove it (or set it to false) to restore lifecycle-script gating."),
+			message: "`dangerouslyAllowAllBuilds: true` in pnpm-workspace.yaml bypasses strictDepBuilds — remove it (or set it to false) to restore lifecycle-script gating.",
 			state: "violation"
 		};
 		const strict = getByPath(config, ["strictDepBuilds"]);
@@ -1037,18 +1067,18 @@ const pnpmBinding$4 = {
 		if (typeof strict === "undefined") return {
 			actual: strict,
 			expected: true,
-			message: pnpmMsg("Set `strictDepBuilds: true` in pnpm-workspace.yaml to pin lifecycle-script gating across versions."),
+			message: "Set `strictDepBuilds: true` in pnpm-workspace.yaml to pin lifecycle-script gating across versions.",
 			severity: "info",
 			state: "violation"
 		};
 		return {
 			actual: strict,
 			expected: true,
-			message: pnpmMsg("Set `strictDepBuilds: true` in pnpm-workspace.yaml to block silent skips of un-approved dep builds."),
+			message: "Set `strictDepBuilds: true` in pnpm-workspace.yaml to block silent skips of un-approved dep builds.",
 			state: "violation"
 		};
 	},
-	docs: pnpmStrictDepBuildsDocs,
+	docs: "https://pnpm.io/settings#strictdepbuilds",
 	file: pnpmWorkspace$8,
 	fix() {
 		return [{
@@ -1058,7 +1088,11 @@ const pnpmBinding$4 = {
 			value: true
 		}];
 	},
-	fixKind: "auto"
+	fixKind: "auto",
+	versionNote: {
+		configAvailableSince: "pnpm 10.3.0",
+		defaultSafeSince: "pnpm 11.0.0"
+	}
 };
 const aubeBinding = {
 	check(_ctx, config) {
@@ -1095,15 +1129,13 @@ const aubeBinding = {
 	},
 	fixKind: "auto"
 };
-const bunMessage = renderVersionNoteMessage("Set `ignoreScripts = true` under [install] in bunfig.toml — or set `\"trustedDependencies\": []` in package.json — to opt out of the curated allow-list (postinstall is already blocked for untrusted packages by default).", { configAvailableSince: "bun 1.2.0" });
+const bunMessage = "Set `ignoreScripts = true` under [install] in bunfig.toml — or set `\"trustedDependencies\": []` in package.json — to opt out of the curated allow-list (postinstall is already blocked for untrusted packages by default).";
 const bunBinding = {
 	check(ctx, config) {
 		const ignoreScripts = getByPath(config, ["install", "ignoreScripts"]);
 		if (ignoreScripts === true) return { state: "ok" };
-		const EMPTY = 0;
-		let trusted = void 0;
-		if (ctx.packageJson) trusted = ctx.packageJson.trustedDependencies;
-		if (typeof trusted !== "undefined" && trusted.length === EMPTY) return { state: "ok" };
+		const trusted = ctx.packageJson?.trustedDependencies;
+		if (typeof trusted !== "undefined" && trusted.length === 0) return { state: "ok" };
 		return {
 			actual: ignoreScripts,
 			expected: true,
@@ -1122,7 +1154,8 @@ const bunBinding = {
 		}];
 	},
 	fixKind: "auto",
-	severity: "info"
+	severity: "info",
+	versionNote: { configAvailableSince: "bun 1.2.0" }
 };
 const builtRule$2 = requireConfigKey({
 	bindings: {
@@ -1165,15 +1198,14 @@ const yarnMessage = "Set `enableStrictSsl: true` in .yarnrc.yml to enforce SSL c
 const yarnBinding = {
 	check(_ctx, config) {
 		const strictSsl = getByPath(config, ["enableStrictSsl"]);
-		if (strictSsl === false) return {
-			actual: false,
+		if (typeof strictSsl !== "undefined" && strictSsl !== true) return {
+			actual: strictSsl,
 			expected: true,
 			message: yarnMessage,
 			state: "violation"
 		};
-		const EMPTY = 0;
 		const whitelist = getByPath(config, ["unsafeHttpWhitelist"]);
-		if (Array.isArray(whitelist) && whitelist.length > EMPTY) return {
+		if (Array.isArray(whitelist) && whitelist.length > 0) return {
 			actual: whitelist,
 			expected: "",
 			manualSteps: ["Review and remove entries from `unsafeHttpWhitelist` in .yarnrc.yml. Each entry permits unencrypted HTTP to that hostname."],
@@ -1219,12 +1251,24 @@ const builtRule$1 = requireConfigKey({
 const enforceStrictSsl = overrideBindings(builtRule$1, { yarn: yarnBinding });
 
 //#endregion
-//#region src/domain/rules/publishable.ts
-const isPublishable = (ctx) => {
+//#region src/domain/services/project-type.ts
+const EMPTY$1 = 0;
+const isPublishableName = (value) => typeof value === "string" && value.trim().length > EMPTY$1;
+const resolveProjectType = (selected, inferredPackage) => {
+	if (typeof selected !== "undefined") return selected;
+	if (inferredPackage) return "package";
+	return "application";
+};
+const resolvePackageJsonProjectType = (ctx) => {
 	const pkg = ctx.packageJson;
-	if (typeof pkg === "undefined") return false;
-	return pkg.private !== true && typeof pkg.name === "string" && pkg.name.length > 0;
+	const inferredPackage = pkg?.private !== true && isPublishableName(pkg?.name);
+	return resolveProjectType(ctx.projectType, inferredPackage);
 };
+const resolveDenoProjectType = (ctx, denoConfig) => resolveProjectType(ctx.projectType, isPublishableName(getByPath(denoConfig, ["name"])));
+
+//#endregion
+//#region src/domain/rules/publishable.ts
+const isPublishable = (ctx) => resolvePackageJsonProjectType(ctx) === "package";
 
 //#endregion
 //#region src/domain/rules/files-field.ts
@@ -1232,8 +1276,7 @@ const { packageJson: packageJson$1, denoJson: denoJson$3 } = CONFIG_FILES;
 const packageJsonFilesBinding = {
 	check(ctx) {
 		if (!isPublishable(ctx)) return { state: "na" };
-		let files = void 0;
-		if (ctx.packageJson) ({files} = ctx.packageJson);
+		const files = ctx.packageJson?.files;
 		if (Array.isArray(files) && files.length > 0) return { state: "ok" };
 		return {
 			actual: files,
@@ -1253,8 +1296,8 @@ const packageJsonFilesBinding = {
 	fixKind: "advisory"
 };
 const denoPublishBinding = {
-	check(_ctx, config) {
-		if (typeof getByPath(config, ["name"]) !== "string") return { state: "na" };
+	check(ctx, config) {
+		if (resolveDenoProjectType(ctx, config) !== "package") return { state: "na" };
 		const include = getByPath(config, ["publish", "include"]);
 		if (Array.isArray(include) && include.length > 0) return { state: "ok" };
 		return {
@@ -1274,7 +1317,7 @@ const denoPublishBinding = {
 	},
 	fixKind: "advisory"
 };
-const filesField = {
+const filesField = defineRule({
 	bindings: {
 		aube: packageJsonFilesBinding,
 		bun: packageJsonFilesBinding,
@@ -1286,9 +1329,10 @@ const filesField = {
 	description: "An explicit `files` array in package.json restricts what gets published, preventing accidental inclusion of secrets or local files.",
 	docs: "https://github.com/bodadotsh/npm-security-best-practices#11-review-published-files",
 	id: "files-field",
+	projectTypes: ["package"],
 	severity: "info",
 	title: "Declare a published files allow-list"
-};
+});
 
 //#endregion
 //#region src/domain/rules/frozen-lockfile.ts
@@ -1394,14 +1438,14 @@ const pnpmBinding$3 = {
 	},
 	fixKind: "advisory"
 };
-const frozenStore = {
+const frozenStore = defineRule({
 	bindings: { pnpm: pnpmBinding$3 },
 	description: "Recommend enabling frozenStore to prevent mutations to the content-addressable store, strengthening supply-chain integrity in CI and deploy environments.",
 	docs: "https://pnpm.io/settings#frozenstore",
 	id: "frozen-store",
 	severity: "info",
 	title: "Enable frozen store"
-};
+});
 
 //#endregion
 //#region src/domain/rules/hardened-mode.ts
@@ -1438,12 +1482,22 @@ const RECOMMENDED_RELEASE_AGE_MINUTES = RECOMMENDED_RELEASE_AGE_DAYS * MINUTES_P
 const RECOMMENDED_RELEASE_AGE_SECONDS = RECOMMENDED_RELEASE_AGE_DAYS * SECONDS_PER_DAY;
 const DOCUMENTED_DEFAULT_MINUTES = MINUTES_PER_DAY;
 const { npmrc: npmrc$3, pnpmWorkspace: pnpmWorkspace$5, yarnrc: yarnrc$2, bunfig: bunfig$1, denoJson: denoJson$1, aubeWorkspace: aubeWorkspace$4 } = CONFIG_FILES;
-const ZERO = 0;
-const isPositiveNumber = (value) => typeof value === "number" && value > ZERO;
+const isPositiveNumber = (value) => typeof value === "number" && value > 0;
+const DENO_DURATION = /^P(?=.*\d)(?:\d+(?:[.,]\d+)?Y)?(?:\d+(?:[.,]\d+)?M)?(?:\d+(?:[.,]\d+)?W)?(?:\d+(?:[.,]\d+)?D)?(?:T(?=\d)(?:\d+(?:[.,]\d+)?H)?(?:\d+(?:[.,]\d+)?M)?(?:\d+(?:[.,]\d+)?S)?)?$/u;
+const DENO_ZERO_DURATION = /^P(?=.*\d)(?:0+(?:[.,]0+)?[YMWD])*(?:T(?:0+(?:[.,]0+)?[HMS])*)?$/u;
+const DENO_DATE = /^\d{4}-\d{2}-\d{2}$/u;
+const DENO_RFC3339_TIMESTAMP = /^\d{4}-\d{2}-\d{2}[Tt](?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:[Zz]|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/u;
+const DENO_DATE_LENGTH = 10;
 const isNonDisabledDenoDuration = (value) => {
-	if (typeof value === "number") return value > ZERO;
-	if (typeof value === "string") return value !== "" && value !== "0";
-	return typeof value === "object" && value !== null;
+	if (typeof value === "number") return value > 0;
+	if (typeof value === "string") {
+		const isDuration = DENO_DURATION.test(value);
+		const date = value.slice(0, DENO_DATE_LENGTH);
+		const dateTimestamp = Date.parse(`${date}T00:00:00Z`);
+		return isDuration && !DENO_ZERO_DURATION.test(value) || !isDuration && (DENO_DATE.test(value) || DENO_RFC3339_TIMESTAMP.test(value)) && !Number.isNaN(dateTimestamp) && new Date(dateTimestamp).toISOString().slice(0, date.length) === date && (DENO_DATE.test(value) || !Number.isNaN(Date.parse(value)));
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	return !("age" in value) || isNonDisabledDenoDuration(value.age);
 };
 const minimumReleaseAge = requireConfigKey({
 	bindings: {
@@ -1468,10 +1522,15 @@ const minimumReleaseAge = requireConfigKey({
 		deno: {
 			accept: isNonDisabledDenoDuration,
 			docs: "https://docs.deno.com/runtime/reference/deno_json/",
+			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
 			file: denoJson$1,
 			keyPath: ["minimumDependencyAge"],
 			message: `Set minimumDependencyAge (e.g. "P3D" for a ${RECOMMENDED_RELEASE_AGE_DAYS}-day cooldown) in deno.json.`,
-			value: "P3D"
+			value: "P3D",
+			versionNote: {
+				defaultSafeSince: "deno 2.9.0 (1440 minutes)",
+				note: "object age optional since deno 2.9.4"
+			}
 		},
 		npm: {
 			accept: isPositiveNumber,
@@ -1541,14 +1600,14 @@ const pnpmBinding$2 = {
 	},
 	fixKind: "advisory"
 };
-const namedRegistries = {
+const namedRegistries = defineRule({
 	bindings: { pnpm: pnpmBinding$2 },
 	description: "Flag named registry mappings that redirect package resolution to custom registries, which may enable dependency confusion attacks.",
 	docs: "https://pnpm.io/settings#namedregistries",
 	id: "named-registries",
 	severity: "info",
 	title: "Review named registry mappings"
-};
+});
 
 //#endregion
 //#region src/domain/rules/paranoid-mode.ts
@@ -1593,14 +1652,14 @@ const pnpmBinding$1 = {
 	},
 	fixKind: "advisory"
 };
-const patchedDependencies = {
+const patchedDependencies = defineRule({
 	bindings: { pnpm: pnpmBinding$1 },
 	description: "Flag patched dependencies whose source code is modified by local patch files, bypassing registry integrity verification.",
 	docs: "https://pnpm.io/settings#patcheddependencies",
 	id: "patched-dependencies",
 	severity: "info",
 	title: "Review patched dependencies"
-};
+});
 
 //#endregion
 //#region src/domain/rules/pin-exact-versions.ts
@@ -1614,18 +1673,18 @@ const isConfigObject = (value) => !Array.isArray(value);
 */
 /** Wildcard segments (`1.x`, `1.*`, `1.2.X`) are ranges too. */
 const SPLIT_LIMIT_FIRST = 1;
-const FIRST_ELEMENT = 0;
 const hasWildcardSegment = (spec) => {
-	return (spec.split("-", SPLIT_LIMIT_FIRST)[FIRST_ELEMENT] ?? spec).split(".").some((seg) => seg === "x" || seg === "X" || seg === "*");
+	const [core = spec] = spec.split("-", SPLIT_LIMIT_FIRST);
+	return core.split(".").some((seg) => seg === "x" || seg === "X" || seg === "*");
 };
 const RANGE_OPERATOR = /[\^~]|>=|<=|<|>|\|\||\s/u;
-const isRangeSpec = (spec) => spec === "" || spec === "*" || RANGE_OPERATOR.test(spec) || hasWildcardSegment(spec);
-const NO_AT_SIGN = 0;
+const INCOMPLETE_NUMERIC_VERSION = /^\d+(?:\.\d+)?(?:-|$)/u;
+const isRangeSpec = (spec) => spec === "" || spec === "*" || RANGE_OPERATOR.test(spec) || INCOMPLETE_NUMERIC_VERSION.test(spec) || hasWildcardSegment(spec);
 const AFTER_AT_SIGN = 1;
 const hasSemverRange = (specifier) => {
 	if (specifier.startsWith("http://") || specifier.startsWith("https://")) return false;
 	const at = specifier.lastIndexOf("@");
-	if (at <= NO_AT_SIGN) return false;
+	if (at <= 0) return false;
 	return isRangeSpec(specifier.slice(at + AFTER_AT_SIGN));
 };
 const collectRangedImports = (imports) => {
@@ -1634,9 +1693,8 @@ const collectRangedImports = (imports) => {
 	return offenders;
 };
 const MAX_SAMPLE_COUNT = 3;
-const EMPTY$2 = 0;
 const formatOffenders = (offenders) => {
-	const sample = offenders.slice(FIRST_ELEMENT, MAX_SAMPLE_COUNT).join(", ");
+	const sample = offenders.slice(0, MAX_SAMPLE_COUNT).join(", ");
 	let more = "";
 	if (offenders.length > MAX_SAMPLE_COUNT) more = ` (and ${offenders.length - MAX_SAMPLE_COUNT} more)`;
 	return {
@@ -1655,7 +1713,7 @@ const denoBinding = {
 		const imports = extractImportsRecord(config);
 		if (!imports) return OK;
 		const offenders = collectRangedImports(imports);
-		if (offenders.length === EMPTY$2) return OK;
+		if (offenders.length === 0) return OK;
 		return formatOffenders(offenders);
 	},
 	docs: "https://docs.deno.com/runtime/reference/cli/add/",
@@ -1667,7 +1725,8 @@ const denoBinding = {
 			op: "note"
 		}];
 	},
-	fixKind: "advisory"
+	fixKind: "advisory",
+	versionNote: { configAvailableSince: "deno 1.30.0" }
 };
 const baseRule = requireConfigKey({
 	bindings: {
@@ -1751,6 +1810,7 @@ const provenance = requireConfigKey({
 	description: "Provenance statements (via Sigstore) tie a release to its source and build, letting consumers verify it was not tampered with.",
 	docs: "https://github.com/bodadotsh/npm-security-best-practices#10-generate-provenance-statements",
 	id: "provenance",
+	projectTypes: ["package"],
 	severity: "warn",
 	title: "Publish with provenance"
 });
@@ -1761,8 +1821,7 @@ const { packageJson } = CONFIG_FILES;
 const publishAccessBinding = {
 	check(ctx) {
 		if (!isPublishable(ctx)) return { state: "na" };
-		let access = void 0;
-		if (ctx.packageJson && ctx.packageJson.publishConfig) ({access} = ctx.packageJson.publishConfig);
+		const access = ctx.packageJson?.publishConfig?.access;
 		if (access === "public" || access === "restricted") return { state: "ok" };
 		return {
 			actual: access,
@@ -1781,7 +1840,7 @@ const publishAccessBinding = {
 	},
 	fixKind: "advisory"
 };
-const publishAccess = {
+const publishAccess = defineRule({
 	bindings: {
 		aube: publishAccessBinding,
 		bun: publishAccessBinding,
@@ -1792,9 +1851,10 @@ const publishAccess = {
 	description: "Set `publishConfig.access` so a misconfigured scope or registry never accidentally publishes an internal package publicly.",
 	docs: "https://github.com/bodadotsh/npm-security-best-practices#for-maintainers",
 	id: "publish-access",
+	projectTypes: ["package"],
 	severity: "info",
 	title: "Declare publish access explicitly"
-};
+});
 
 //#endregion
 //#region src/domain/rules/store-server.ts
@@ -1820,14 +1880,14 @@ const pnpmBinding = {
 	},
 	fixKind: "advisory"
 };
-const storeServer = {
+const storeServer = defineRule({
 	bindings: { pnpm: pnpmBinding },
 	description: "Flag use of an external store server process, which introduces a trust boundary where tampered packages could be served.",
 	docs: "https://pnpm.io/settings#userunningStoreserver",
 	id: "store-server",
 	severity: "info",
 	title: "Review store server usage"
-};
+});
 
 //#endregion
 //#region src/domain/rules/strict-allow-scripts.ts
@@ -1913,48 +1973,39 @@ const trustPolicy = requireConfigKey({
 
 //#endregion
 //#region src/domain/builtin-rules.ts
-const RULE_REGISTRY = {
-	"advisory-check": advisoryCheck,
-	"approved-git-repos": approvedGitRepos,
-	"audit-suppression": auditSuppression,
-	"block-auto-install": blockAutoInstall,
-	"block-exotic-subdeps": blockExoticSubdeps,
-	"bun-security-scanner": bunSecurityScanner,
-	"checksum-verification": checksumVerification,
-	"commit-lockfile": commitLockfile,
-	"dependency-overrides": dependencyOverrides,
-	"disable-lifecycle-scripts": disableLifecycleScripts,
-	"enforce-strict-ssl": enforceStrictSsl,
-	"files-field": filesField,
-	"frozen-lockfile": frozenLockfile,
-	"frozen-store": frozenStore,
-	"hardened-mode": hardenedMode,
-	"minimum-release-age": minimumReleaseAge,
-	"named-registries": namedRegistries,
-	"paranoid-mode": paranoidMode,
-	"patched-dependencies": patchedDependencies,
-	"pin-exact-versions": pinExactVersions,
+const rules = [
+	advisoryCheck,
+	approvedGitRepos,
+	auditSuppression,
+	blockAutoInstall,
+	blockExoticSubdeps,
+	bunSecurityScanner,
+	checksumVerification,
+	commitLockfile,
+	dependencyOverrides,
+	disableLifecycleScripts,
+	enforceStrictSsl,
+	filesField,
+	frozenLockfile,
+	frozenStore,
+	hardenedMode,
+	minimumReleaseAge,
+	namedRegistries,
+	paranoidMode,
+	patchedDependencies,
+	pinExactVersions,
 	provenance,
-	"publish-access": publishAccess,
-	"store-server": storeServer,
-	"strict-allow-scripts": strictAllowScripts,
-	"strict-release-age": strictReleaseAge,
-	"strict-store-integrity": strictStoreIntegrity,
-	"trust-policy": trustPolicy
-};
-const rules = Object.values(RULE_REGISTRY);
+	publishAccess,
+	storeServer,
+	strictAllowScripts,
+	strictReleaseAge,
+	strictStoreIntegrity,
+	trustPolicy
+];
 
 //#endregion
 //#region src/domain/services/validate-rule-ids.ts
 /**
-* Cross-check a loaded SiroConfig against the registered builtin rules.
-*
-* Pure: no I/O, no globals, takes builtins as an argument so it stays
-* testable and so the domain layer doesn't reach for `builtin-rules.ts`
-* via a hidden static dependency. Callers (the adapters-layer loadConfig
-* and the application-layer assertConfigRuleIdsKnown) pass the builtin
-* list explicitly.
-*
 * Why both checks in one pass? `duplicates` must be detected against the
 * builtin set *before* `unknown` consults the merged (builtin ∪ custom)
 * set — otherwise a colliding customRule id silently widens the known
@@ -1989,7 +2040,6 @@ const validateRuleIds = (config, builtins, extraKnownIds = []) => {
 
 //#endregion
 //#region src/application/validate-config-rules.ts
-const EMPTY$1 = 0;
 const SINGLE = 1;
 const throwUnknownIds = (unknown) => {
 	let plural = "";
@@ -1999,7 +2049,7 @@ const throwUnknownIds = (unknown) => {
 const assertConfigRuleIdsKnown = (userConfig, programmaticRules) => {
 	if (typeof userConfig === "undefined") return;
 	const { unknown } = validateRuleIds(userConfig, rules, (programmaticRules ?? []).map((rule) => rule.id));
-	if (unknown.length > EMPTY$1) throwUnknownIds(unknown);
+	if (unknown.length > 0) throwUnknownIds(unknown);
 };
 
 //#endregion
@@ -2014,7 +2064,7 @@ const assertConfigRuleIdsKnown = (userConfig, programmaticRules) => {
 * A malformed value reads as "absent" — EXCEPT `private`, which falls back to
 * `true`: a security tool must never flip a broken `private` into publishable.
 */
-const [ABSENT] = [];
+const ABSENT = void 0;
 const optionalString = vb.fallback(vb.optional(vb.string()), ABSENT);
 const PackageJsonSchema = vb.looseObject({
 	files: vb.fallback(vb.optional(vb.array(vb.string())), ABSENT),
@@ -2066,7 +2116,7 @@ const tryParseJson = (text) => {
 const parsePackageJson = (raw) => {
 	return safeParsePackageJson(tryParseJson(raw.trim()));
 };
-const createRepoContext = (root, fs = nodeFileSystem) => {
+const createRepoContext = (root, fs = nodeFileSystem, projectType) => {
 	const readText = (relPath) => fs.readText(resolveIn(root, relPath));
 	const exists = (relPath) => fs.exists(resolveIn(root, relPath));
 	const raw = readText(asRelPath("package.json"));
@@ -2075,6 +2125,7 @@ const createRepoContext = (root, fs = nodeFileSystem) => {
 	return {
 		exists,
 		packageJson,
+		projectType,
 		readText,
 		root
 	};
@@ -2089,8 +2140,9 @@ const CONFIG_NAMES = [
 	"siro.config.js"
 ];
 const ConfigSchema = vb.strictObject({
-	customRules: vb.optional(vb.array(vb.custom(() => true))),
+	customRules: vb.optional(vb.array(vb.custom(isRuleShape, "must be a structurally valid rule"))),
 	pms: vb.optional(vb.pipe(vb.array(vb.picklist(PMS)), vb.minLength(MIN_PMS_LENGTH, "must not be empty (omit the key to auto-detect, or list at least one PM)"))),
+	projectType: vb.optional(vb.picklist(PROJECT_TYPES)),
 	reporters: vb.optional(vb.array(vb.custom(isReporterShape, "must be a { name, format } reporter"))),
 	rules: vb.optional(vb.record(vb.string(), vb.union([vb.picklist(SEVERITIES), vb.literal("off")])))
 }, "unknown config key (check for a typo)");
@@ -2103,21 +2155,6 @@ const formatIssues = (issues) => issues.map((issue) => {
 	if (keyPath) return `${keyPath}: ${issue.message}`;
 	return issue.message;
 }).join("; ");
-const TS_STRIPPING_MAJOR_22 = 22;
-const TS_STRIPPING_MINOR_22 = 18;
-const TS_STRIPPING_MAJOR_23 = 23;
-const TS_STRIPPING_MINOR_23 = 6;
-const TS_STRIPPING_ALWAYS_SINCE = 24;
-/** Whether a Node version imports .ts via native type stripping (unflagged since 22.18.0 / 23.6.0). */
-const hasNativeTypeStripping = (version) => {
-	const [majorRaw = "", minorRaw = "0"] = version.replace(/^v/u, "").split(".");
-	const major = Number(majorRaw);
-	const minor = Number(minorRaw);
-	if (major >= TS_STRIPPING_ALWAYS_SINCE) return true;
-	if (major === TS_STRIPPING_MAJOR_23) return minor >= TS_STRIPPING_MINOR_23;
-	if (major === TS_STRIPPING_MAJOR_22) return minor >= TS_STRIPPING_MINOR_22;
-	return false;
-};
 let loadCounter = 0;
 const INCREMENT = 1;
 const importConfig = (modulePath, name) => {
@@ -2146,10 +2183,9 @@ const validateSchema = (candidate, name) => {
 	return result.output;
 };
 const rejectDuplicateCustomRuleIds = (config, name) => {
-	const EMPTY = 0;
 	const SINGLE = 1;
 	const { duplicates } = validateRuleIds(config, rules);
-	if (duplicates.length > EMPTY) {
+	if (duplicates.length > 0) {
 		let plural = "";
 		if (duplicates.length > SINGLE) plural = "s";
 		throw new ConfigError(`${name}: duplicate customRule id${plural}: ${duplicates.map((id) => `'${id}'`).join(", ")}. Pick a unique id (or use 'rules' to override an existing rule's severity).`);
@@ -2167,7 +2203,7 @@ const parseCandidate = (configPath, name) => importConfig(configPath, name).then
 const loadConfig = (cwd, fs = nodeFileSystem, nodeVersion = process.versions.node) => {
 	const candidate = CONFIG_NAMES.find((name) => fs.exists(asAbsPath(path.join(cwd, name))));
 	if (typeof candidate === "undefined") return Promise.resolve(void 0);
-	if (candidate.endsWith(".ts") && !hasNativeTypeStripping(nodeVersion)) return Promise.reject(new ConfigError(`${candidate} requires Node.js with native type stripping (^22.18.0 || ^23.6.0 || >=24); current is v${nodeVersion}. Rename the config to siro.config.mjs (plain JS) or upgrade Node.js.`));
+	if (candidate.endsWith(".ts") && !isSupportedNodeVersion(nodeVersion)) return Promise.reject(new ConfigError(`${candidate} requires Node.js with native type stripping (${SUPPORTED_NODE_RANGE}); current is v${nodeVersion}. Rename the config to siro.config.mjs (plain JS) or upgrade Node.js.`));
 	return parseCandidate(asAbsPath(path.join(cwd, candidate)), candidate);
 };
 
@@ -2198,10 +2234,9 @@ const throwCollisionError = (collisions) => {
 	throw new ConfigError(`customRules: ${noun} with builtin, config, or another programmatic rule: ${ids.map((id) => `'${id}'`).join(", ")}. Pick a unique id (or use 'rules' to override an existing rule's severity).`);
 };
 const mergeProgrammaticRules = (builtins, programmatic, configCustom) => {
-	const EMPTY = 0;
-	if (typeof programmatic === "undefined" || programmatic.length === EMPTY) return builtins;
+	if (typeof programmatic === "undefined" || programmatic.length === 0) return builtins;
 	const collisions = detectCollisions(programmatic, new Set([...builtins.map((rule) => rule.id), ...(configCustom ?? []).map((rule) => rule.id)]));
-	if (collisions.size > EMPTY) throwCollisionError(collisions);
+	if (collisions.size > 0) throwCollisionError(collisions);
 	return [...builtins, ...programmatic];
 };
 
@@ -2235,19 +2270,8 @@ const buildDetectionSignals = () => {
 	return out;
 };
 const DETECTION_SIGNALS = buildDetectionSignals();
-/**
-* Detect the package managers in use, strongest signal first:
-*   1) `packageManager` in package.json,
-*   2) lockfiles + configs (see DETECTION_SIGNALS for the per-PM allow-list
-*      that skips filenames shared between PMs).
-* Returns every PM with evidence, in canonical `PMS` order. `ctx` carries
-* the repo signals — `packageJson` (already parsed) and `exists(relPath)`
-* for filename probing — so embedders can swap in a virtual FS without
-* touching the real disk.
-*/
 const addDeclaredPM = (ctx, found) => {
-	let declared = void 0;
-	if (ctx.packageJson) declared = ctx.packageJson.packageManager;
+	const declared = ctx.packageJson?.packageManager;
 	if (typeof declared === "string") {
 		const pm = parsePackageManagerField(declared);
 		if (typeof pm !== "undefined") found.add(pm);
@@ -2268,9 +2292,8 @@ const detectPMs = (ctx) => {
 const throwEmptyPMsError = (detected, opts, allowed) => {
 	if (allowed) {
 		if (opts.pmOverride) throw new UsageError(`--pm ${opts.pmOverride} is not in siro.config.ts pms (${allowed.join(", ")}). Adjust the config or the flag.`);
-		const EMPTY = 0;
 		let msg = `No package manager detected, and siro.config.ts restricts pms to ${allowed.join(", ")}. Adjust the config or remove the restriction.`;
-		if (detected.length > EMPTY) msg = `Detected PMs (${detected.join(", ")}) do not match siro.config.ts pms (${allowed.join(", ")}). Adjust the config or remove the restriction.`;
+		if (detected.length > 0) msg = `Detected PMs (${detected.join(", ")}) do not match siro.config.ts pms (${allowed.join(", ")}). Adjust the config or remove the restriction.`;
 		throw new UsageError(msg);
 	}
 	throw new UsageError(`No package manager detected. Pass --pm <${PMS.join("|")}> to be explicit.`);
@@ -2281,7 +2304,7 @@ const throwEmptyPMsError = (detected, opts, allowed) => {
 * needs. Throws `UsageError` for the two empty-set cases so the
 * caller never has to invent its own messaging.
 *
-* Empty-set branches are usage errors, not silent npm fallback: see DECISIONS.md D08.
+* Empty-set branches are usage errors, not a silent npm fallback.
 */
 const computePMs = (ctx, opts) => {
 	let detected = detectPMs(ctx);
@@ -2311,17 +2334,15 @@ const resolvePMs = (ctx, opts) => {
 * applyConfig protocol).
 */
 const resolveRuleSet = (userConfig, customRules) => {
-	let configCustomRules = void 0;
-	if (userConfig) configCustomRules = userConfig.customRules;
+	const configCustomRules = userConfig?.customRules;
 	const base = mergeProgrammaticRules(rules, customRules, configCustomRules);
 	assertConfigRuleIdsKnown(userConfig, customRules);
 	return applyConfig(base, userConfig);
 };
 const buildRunResult = (options, userConfig) => {
 	const { cwd, fs, pm, customRules } = options;
-	const ctx = createRepoContext(cwd, fs);
-	let allowedPms = void 0;
-	if (userConfig) allowedPms = userConfig.pms;
+	const ctx = createRepoContext(cwd, fs, options.projectType ?? userConfig?.projectType);
+	const allowedPms = userConfig?.pms;
 	return {
 		ctx,
 		pms: resolvePMs(ctx, {
@@ -2336,17 +2357,24 @@ const prepareRun = (options) => loadConfig(options.cwd, options.fs).then((userCo
 
 //#endregion
 //#region src/domain/services/evaluate-bindings.ts
-/**
-* Iterate every applicable `(rule, pm)` binding, run its check, and hand
-* each violation to `onViolation`. Folding the loop into one place keeps
-* the rule-evaluation contract (parse once, run check, gate on violation)
-* in a single location so the call site (`runLint`) stays declarative.
-*/
-const evaluateBindings = (opts) => {
-	const { ctx, pms, ruleSet, parseConfig, onViolation } = opts;
-	for (const rule of ruleSet) for (const pm of pms) {
+const appliesToProject = (rule, projectType) => typeof projectType === "undefined" || typeof rule.projectTypes === "undefined" || rule.projectTypes.some((candidate) => candidate === projectType);
+const resolveBindingProjectType = (ctx, pm, parseConfig) => {
+	if (typeof ctx.projectType !== "undefined") return ctx.projectType;
+	if (pm === "deno") {
+		const { parsed } = parseConfig(ctx, CONFIG_FILES.denoJson);
+		return resolveDenoProjectType(ctx, parsed);
+	}
+	return resolvePackageJsonProjectType(ctx);
+};
+const appliesToBinding = (rule, pm, opts) => {
+	const { ctx, parseConfig } = opts;
+	return typeof rule.projectTypes === "undefined" || appliesToProject(rule, resolveBindingProjectType(ctx, pm, parseConfig));
+};
+const evaluateRule = (rule, opts) => {
+	const { ctx, pms, parseConfig, onViolation } = opts;
+	for (const pm of pms) {
 		const binding = rule.bindings[pm];
-		if (typeof binding !== "undefined") {
+		if (typeof binding !== "undefined" && appliesToBinding(rule, pm, opts)) {
 			const { parsed } = parseConfig(ctx, binding.file);
 			const status = binding.check(ctx, parsed);
 			if (status.state === "violation") onViolation({
@@ -2358,6 +2386,16 @@ const evaluateBindings = (opts) => {
 		}
 	}
 };
+/**
+* Iterate every applicable `(rule, pm)` binding, run its check, and hand
+* each violation to `onViolation`. Folding the loop into one place keeps
+* the rule-evaluation contract (parse once, run check, gate on violation)
+* in a single location so the call site (`runLint`) stays declarative.
+*/
+const evaluateBindings = (opts) => {
+	const { ruleSet } = opts;
+	for (const rule of ruleSet) evaluateRule(rule, opts);
+};
 
 //#endregion
 //#region src/domain/services/parse-config-file.ts
@@ -2394,11 +2432,27 @@ const createConfigParser = (codecFor) => {
 */
 const decideSeverity = (status, binding, rule) => status.severity ?? binding.severity ?? rule.severity;
 
+//#endregion
+//#region src/domain/services/render-version-note.ts
+const buildVersionNoteParts = (versionNote) => {
+	const parts = [];
+	if (typeof versionNote.configAvailableSince !== "undefined") parts.push(`available since ${versionNote.configAvailableSince}`);
+	if (typeof versionNote.defaultSafeSince !== "undefined") parts.push(`default safe since ${versionNote.defaultSafeSince}`);
+	if (typeof versionNote.note !== "undefined") parts.push(versionNote.note);
+	return parts;
+};
+const renderVersionNoteMessage = (message, versionNote) => {
+	if (typeof versionNote === "undefined") return message;
+	const parts = buildVersionNoteParts(versionNote);
+	if (parts.length === 0) return message;
+	return `${message} (${parts.join("; ")})`;
+};
+
 //#endregion
 //#region src/application/run-lint.ts
 const EMPTY = 0;
 const resolveManualSteps = (raw) => {
-	if (typeof raw !== "undefined" && raw.length > EMPTY) return raw;
+	if (typeof raw !== "undefined" && raw.length > 0) return raw;
 };
 const buildFinding = (visit, ctx) => {
 	const { rule, pm, binding, status } = visit;
@@ -2414,9 +2468,9 @@ const buildFinding = (visit, ctx) => {
 		expected: status.expected,
 		file: filePath,
 		fix,
-		fixable: binding.fixKind === "auto" && typeof manualSteps === "undefined",
+		fixable: binding.fixKind === "auto" && typeof manualSteps === "undefined" && fix.length > EMPTY,
 		manualSteps,
-		message: status.message,
+		message: renderVersionNoteMessage(status.message, binding.versionNote),
 		pm,
 		ruleId: rule.id,
 		severity
@@ -2451,14 +2505,27 @@ const runLint = (opts) => {
 //#endregion
 //#region src/application/commands/lint.ts
 const resolveReporter = (value, registry) => {
-	if (typeof value === "undefined") return registry.get("pretty");
+	if (typeof value === "undefined") return registry.get(DEFAULT_REPORTER_NAME);
 	if (typeof value === "string") return registry.get(value);
 	if (!isReporterShape(value)) throw new UsageError("The 'reporter' option must be a name or a { name, format } object.");
 	return value;
 };
 const validateEmbedderReporters = (reporters) => {
+	if (typeof reporters !== "undefined" && !Array.isArray(reporters)) throw new UsageError("The 'reporters' option must be an array of reporter objects.");
 	for (const rep of reporters ?? []) if (!isReporterShape(rep)) throw new UsageError("A reporter in 'reporters' needs a string 'name' and a 'format' function.");
 };
+const validateSelection = (value, isValid, errorMessage) => {
+	if (typeof value !== "undefined" && (typeof value !== "string" || !isValid(value))) throw new UsageError(errorMessage);
+};
+const validateCustomRules = (customRules) => {
+	if (typeof customRules !== "undefined" && (!Array.isArray(customRules) || !Array.from(customRules).every((rule) => isRuleShape(rule)))) throw new UsageError("The 'customRules' option must contain structurally valid rules.");
+};
+const validateLintOptions = (options) => {
+	validateCustomRules(options.customRules);
+	validateSelection(options.projectType, isProjectType, `Unknown project type: ${String(options.projectType)} (expected ${PROJECT_TYPES.join("|")})`);
+	validateSelection(options.pm, isPM, `Unknown package manager: ${String(options.pm)} (expected one of: ${PMS.join(", ")})`);
+	validateSelection(options.severity, isSeverity, `Invalid severity: ${String(options.severity)} (expected ${SEVERITIES.join("|")})`);
+};
 const resolveAndValidateReporter = (value, registry) => {
 	const reporter = resolveReporter(value, registry);
 	if (typeof reporter === "undefined") throw new UsageError(`Unknown reporter: ${String(value)} (available: ${registry.list().join(", ")})`);
@@ -2477,15 +2544,17 @@ const formatAndExit = (args) => {
 	return exitCodeForLint(result, failThreshold);
 };
 /** `siro lint`: detect PMs, evaluate rules, report findings. */
-const lintCommand = (options, io) => prepareRun({
-	customRules: options.customRules,
-	cwd: options.cwd,
-	fs: options.fs,
-	pm: options.pm
-}).then(({ userConfig, ctx, pms, ruleSet }) => {
+const lintCommand = async (options, io) => {
+	validateLintOptions(options);
+	const { userConfig, ctx, pms, ruleSet } = await prepareRun({
+		customRules: options.customRules,
+		cwd: options.cwd,
+		fs: options.fs,
+		pm: options.pm,
+		projectType: options.projectType
+	});
 	validateEmbedderReporters(options.reporters);
-	let configReporters = [];
-	if (userConfig && userConfig.reporters) configReporters = userConfig.reporters;
+	const configReporters = userConfig?.reporters ?? [];
 	const registry = createRegistry([...options.reporters ?? [], ...configReporters]);
 	return formatAndExit({
 		ctx,
@@ -2495,7 +2564,7 @@ const lintCommand = (options, io) => prepareRun({
 		reporter: resolveAndValidateReporter(options.reporter, registry),
 		ruleSet
 	});
-});
+};
 
 //#endregion
 //#region src/adapters/node-io.ts
@@ -2505,5 +2574,5 @@ const nodeIO = {
 };
 
 //#endregion
-export { asRelPath as A, isPM as C, ConfigError as D, UsageError as E, SiroError as O, SEVERITIES as S, wrapCodecError as T, jsonReporter as _, PM_SIGNALS as a, isReporterShape as b, requireConfigKey as c, exitCodeForLint as d, filterBySeverity as f, prettyReporter as g, createRegistry as h, nodeFileSystem as i, asAbsPath as k, CONFIG_FILES as l, BUILTIN_REPORTER_NAMES as m, lintCommand as n, overrideBindings as o, isNodeError as p, detectPMs as r, renderVersionNoteMessage as s, nodeIO as t, getByPath as u, version as v, isSeverity as w, PMS as x, githubReporter as y };
-//# sourceMappingURL=node-io-Cb8nixgE.mjs.map
+export { isSeverity as A, jsonReporter as C, PMS as D, isReporterShape as E, asAbsPath as F, asRelPath as I, UsageError as M, ConfigError as N, SEVERITIES as O, SiroError as P, prettyReporter as S, githubReporter as T, isSupportedNodeVersion as _, nodeFileSystem as a, JSON_REPORTER_NAME as b, requireConfigKey as c, exitCodeForLint as d, filterBySeverity as f, SUPPORTED_NODE_RANGE as g, isProjectType as h, detectPMs as i, wrapCodecError as j, isPM as k, CONFIG_FILES as l, PROJECT_TYPES as m, lintCommand as n, PM_SIGNALS as o, isNodeError as p, renderVersionNoteMessage as r, overrideBindings as s, nodeIO as t, getByPath as u, BUILTIN_REPORTER_NAMES as v, version as w, createRegistry as x, DEFAULT_REPORTER_NAME as y };
+//# sourceMappingURL=node-io-CUcMwlGH.mjs.map