@pho9ubenaa/siro 0.3.0 → 0.4.0

package/dist/index.d.mts

@@ -1,18 +1,22 @@
 import * as vb from "valibot";
 
+//#region src/domain/entities/config-value.d.ts
+declare const CODEC_KINDS: readonly ["json", "npmrc", "toml", "yaml"];
+type CodecKind = (typeof CODEC_KINDS)[number];
+/** Scalar value that can be written back to a config file. */
+type ConfigValue = string | number | boolean;
+/** Parsed keys are unvalidated; each rule narrows the values it reads. */
+interface ParsedConfig {
+  readonly [key: string]: unknown;
+}
+/** A (possibly nested) key path, guaranteed to have at least one segment. */
+type KeyPath = readonly [string, ...string[]];
+/** Parser values may include nested arrays and TOML dates. */
+type ConfigReadValue = unknown;
+/** Read an own key path; absent or non-mapping parents yield undefined. */
+declare const getByPath: (config: ParsedConfig, keyPath: KeyPath) => ConfigReadValue;
+//#endregion
 //#region src/shared/paths.d.ts
-/**
- * Branded path types. Surface the distinction between
- *   - `AbsPath`: absolute filesystem paths handed to the FS boundary
- *     (`FileSystem.readText` etc.), and
- *   - `RelPath`: paths relative to a repo root, accepted by
- *     `RepoContext` and resolved via `resolveIn`.
- *
- * The brand is a structural tag with no runtime footprint — the cast in
- * `asAbsPath` / `asRelPath` is the only place either type is minted, so
- * passing a raw `string` to an FS or repo API now requires the caller to
- * declare intent rather than silently mixing the two flavours.
- */
 declare const AbsPathBrand: unique symbol;
 declare const RelPathBrand: unique symbol;
 type AbsPath = string & {
@@ -21,10 +25,8 @@ type AbsPath = string & {
 type RelPath = string & {
   readonly [RelPathBrand]: true;
 };
-/** Tag a string as absolute. The caller vouches for the shape. */
-declare const asAbsPath: (path: string) => AbsPath;
-/** Tag a string as repo-root-relative. The caller vouches for the shape. */
-declare const asRelPath: (path: string) => RelPath;
+declare const asAbsPath: (value: string) => AbsPath;
+declare const asRelPath: (value: string) => RelPath;
 //#endregion
 //#region src/domain/ports/file-system.d.ts
 /** IO boundary: swap in memfs (or any other backend) for tests. */
@@ -33,54 +35,6 @@ interface FileSystem {
   exists: (path: AbsPath) => boolean;
 }
 //#endregion
-//#region src/adapters/node-file-system.d.ts
-declare const nodeFileSystem: FileSystem;
-//#endregion
-//#region src/domain/ports/io.d.ts
-/** Output sink for commands; injectable so tests can drive a string buffer. */
-interface IO {
-  stdout: (line: string) => void;
-  stderr: (line: string) => void;
-}
-//#endregion
-//#region src/adapters/node-io.d.ts
-declare const nodeIO: IO;
-//#endregion
-//#region src/domain/entities/config-value.d.ts
-declare const CODEC_KINDS: readonly ["json", "npmrc", "toml", "yaml"];
-type CodecKind = (typeof CODEC_KINDS)[number];
-/** Scalar value that can be written back to a config file. */
-type ConfigValue = string | number | boolean;
-/** Scalar value as it appears when reading (codecs may produce `null`). */
-type ConfigScalar = ConfigValue | null;
-/** Recursive, structurally typed view of a parsed config file. */
-interface ParsedConfig {
-  readonly [key: string]: ConfigScalar | readonly ConfigScalar[] | ParsedConfig;
-}
-/** A (possibly nested) key path, guaranteed to have at least one segment. */
-type KeyPath = readonly [string, ...string[]];
-/** A single key to set. */
-interface KeyAssignment {
-  readonly keyPath: KeyPath;
-  readonly value: ConfigValue;
-}
-/**
- * Value a rule's `check` saw at the target key, as returned by `getByPath`.
- * Runtime caveat: YAML/TOML parsers can yield host values (e.g. `Date`)
- * nested inside `ParsedConfig` even though the type does not name them —
- * compare timestamps by `valueOf()`, not by type narrowing on this union.
- */
-type ConfigReadValue = ConfigScalar | readonly ConfigScalar[] | ParsedConfig | undefined;
-/**
- * Look up a nested value by key path; `undefined` if any segment is missing.
- *
- * Part of the public surface (re-exported from `src/index.ts`): embedders
- * writing custom rules receive the same `config: ParsedConfig` shape that
- * built-in rules see, so they need the canonical traversal helper rather
- * than re-implementing `null`-vs-missing semantics per rule.
- */
-declare const getByPath: (config: ParsedConfig, keyPath: KeyPath) => ConfigScalar | readonly ConfigScalar[] | ParsedConfig | undefined;
-//#endregion
 //#region src/domain/entities/pms.d.ts
 /**
  * Single source of truth for package managers and severities.
@@ -94,25 +48,25 @@ type Severity = (typeof SEVERITIES)[number];
 declare const isPM: (value: string) => value is PM;
 declare const isSeverity: (value: string) => value is Severity;
 //#endregion
+//#region src/domain/entities/project-type.d.ts
+declare const PROJECT_TYPES: readonly ["application", "package"];
+type ProjectType = (typeof PROJECT_TYPES)[number];
+//#endregion
 //#region src/domain/schemas/package-json.d.ts
 declare const PackageJsonSchema: vb.LooseObjectSchema<{
-  readonly files: vb.SchemaWithFallback<vb.OptionalSchema<vb.ArraySchema<vb.StringSchema<undefined>, undefined>, undefined>, undefined>;
-  readonly name: vb.SchemaWithFallback<vb.OptionalSchema<vb.StringSchema<undefined>, undefined>, undefined>;
-  readonly packageManager: vb.SchemaWithFallback<vb.OptionalSchema<vb.StringSchema<undefined>, undefined>, undefined>;
-  readonly private: vb.OptionalSchema<vb.SchemaWithFallback<vb.BooleanSchema<undefined>, true>, undefined>;
-  readonly publishConfig: vb.SchemaWithFallback<vb.OptionalSchema<vb.LooseObjectSchema<{
-    readonly access: vb.SchemaWithFallback<vb.OptionalSchema<vb.UnionSchema<[vb.LiteralSchema<"public", undefined>, vb.LiteralSchema<"restricted", undefined>], undefined>, undefined>, undefined>;
-  }, undefined>, undefined>, undefined>;
-  readonly trustedDependencies: vb.SchemaWithFallback<vb.OptionalSchema<vb.ArraySchema<vb.StringSchema<undefined>, undefined>, undefined>, undefined>;
+  readonly files: vb.OptionalSchema<vb.ArraySchema<vb.StringSchema<undefined>, undefined>, undefined>;
+  readonly name: vb.OptionalSchema<vb.StringSchema<undefined>, undefined>;
+  readonly packageManager: vb.OptionalSchema<vb.StringSchema<undefined>, undefined>;
+  readonly private: vb.OptionalSchema<vb.BooleanSchema<undefined>, undefined>;
+  readonly publishConfig: vb.OptionalSchema<vb.LooseObjectSchema<{
+    readonly access: vb.OptionalSchema<vb.PicklistSchema<["public", "restricted", "private"], undefined>, undefined>;
+  }, undefined>, undefined>;
+  readonly trustedDependencies: vb.OptionalSchema<vb.ArraySchema<vb.StringSchema<undefined>, undefined>, undefined>;
 }, undefined>;
 type PackageJson = vb.InferOutput<typeof PackageJsonSchema>;
 //#endregion
-//#region src/domain/entities/project-type.d.ts
-declare const PROJECT_TYPES: readonly ["application", "package"];
-type ProjectType = (typeof PROJECT_TYPES)[number];
-//#endregion
 //#region src/domain/ports/repo-context.d.ts
-/** Read-only view of a repository, passed to every rule's `check` and `fix`. */
+/** Read-only view of a repository, passed to every rule's `check`. */
 interface RepoContext {
   readonly root: AbsPath;
   exists: (relPath: RelPath) => boolean;
@@ -120,111 +74,58 @@ interface RepoContext {
   readonly packageJson: PackageJson | undefined;
   readonly projectType?: ProjectType;
 }
+/** Settings read during one evaluation share its parser and cache. */
+interface RuleContext extends RepoContext {
+  readConfig: (file: ConfigFileRef) => ParsedConfig;
+}
 //#endregion
 //#region src/domain/entities/rule.d.ts
-/**
- * What a rule binding points at on disk: a parsed config file or an existence
- * check (e.g. "a lockfile is committed"). `path` is a branded `RelPath` minted
- * once at the ref's definition (CONFIG_FILES), so the readText boundary is
- * type-checked and a stray absolute path can't slip in as a string.
- */
-type ConfigFileRef = {
+interface ConfigFileRef {
   readonly kind: CodecKind;
   readonly path: RelPath;
+}
+interface SetKeyOperation {
+  readonly op: 'setKey';
+  readonly file: ConfigFileRef;
+  readonly keyPath: KeyPath;
+  readonly value: ConfigValue;
+}
+/** A check chooses one remedy for the state it observed. siro does not apply it. */
+type Remediation = {
+  readonly kind: 'automatic';
+  readonly operations: readonly [SetKeyOperation, ...SetKeyOperation[]];
+  readonly steps?: never;
 } | {
-  readonly kind: 'fileGlob';
-  readonly path: RelPath;
+  readonly kind: 'manual';
+  readonly steps: readonly [string, ...string[]];
+  readonly operations?: never;
 };
-/** Result of evaluating a single rule binding against a repo. */
 type CheckStatus = {
   readonly state: 'ok';
+} | {
+  readonly state: 'na';
 } | {
   readonly state: 'violation';
-  readonly message: string;
+  readonly message: string; /** Override the primary file when the violation concerns another input. */
+  readonly file?: RelPath;
   readonly expected?: ConfigValue;
-  readonly actual?: ConfigReadValue;
-  /**
-   * Dynamic severity for this specific violation, overriding both
-   * {@link AutoRuleBinding.severity} and {@link Rule.severity}. Lets a
-   * `check` distinguish "unset but PM-default safe" (advisory) from
-   * "explicitly weakened" (full severity). A user `rules` override in
-   * config still wins (see `applyConfig`).
-   */
+  readonly actual?: ConfigReadValue; /** User configuration takes precedence over this per-result severity. */
   readonly severity?: Severity;
-  /**
-   * Manual remediation steps surfaced verbatim on the finding. Lets a
-   * `check` signal "the setKey fix ops cannot resolve this state; the
-   * user has to intervene" — e.g. when an explicit user override would
-   * have to be deleted first. When non-empty, `Finding.fix` is emitted
-   * empty so an external fixer never writes ops the user's existing
-   * config would defeat.
-   */
-  readonly manualSteps?: readonly string[];
-} | {
-  readonly state: 'na';
-};
-/** A remediation step produced by a rule's `fix`. */
-type FixOp = {
-  readonly op: 'setKey';
-  readonly file: ConfigFileRef;
-  readonly keyPath: KeyPath;
-  readonly value: ConfigValue;
-} | {
-  readonly op: 'ensureFileTracked';
-  readonly file: ConfigFileRef;
-  readonly message: string;
-} | {
-  readonly op: 'note';
-  readonly message: string;
-  readonly file?: ConfigFileRef;
+  readonly remediation?: Remediation;
 };
-/**
- * - `auto`: `fix` produces setKey ops an external fixer can apply
- *   mechanically (surfaced via `Finding.fix`; see docs/json-output.md).
- * - `advisory`: `fix` only produces notes/ensureFileTracked hints.
- */
-type FixKind = 'auto' | 'advisory';
 /** Display-only package-manager version metadata. */
 interface VersionNote {
   readonly configAvailableSince?: string;
   readonly defaultSafeSince?: string;
   readonly note?: string;
 }
-type SetKeyOp = Extract<FixOp, {
-  op: 'setKey';
-}>;
-type AdvisoryOp = Extract<FixOp, {
-  op: 'note' | 'ensureFileTracked';
-}>;
-interface AutoRuleBinding {
-  readonly file: ConfigFileRef;
-  readonly fixKind: 'auto';
-  /** Official package-manager doc URL for the setting this binding writes. */
-  readonly docs?: string;
-  /**
-   * Per-binding severity. When set, it shadows {@link Rule.severity} for this
-   * PM only — used when a package manager's safe default already mitigates
-   * the threat (so the binding is informational) while another PM with the
-   * same rule still warrants the rule-wide level. A user config `rules`
-   * override always wins over both.
-   */
-  readonly severity?: Severity;
-  readonly versionNote?: VersionNote;
-  check: (ctx: RepoContext, config: ParsedConfig) => CheckStatus;
-  fix: (ctx: RepoContext) => readonly SetKeyOp[];
-}
-interface AdvisoryRuleBinding {
-  readonly file: ConfigFileRef;
-  readonly fixKind: 'advisory';
-  /** Official package-manager doc URL for the setting this binding describes. */
+interface RuleBinding {
+  readonly file?: ConfigFileRef;
   readonly docs?: string;
-  /** See {@link AutoRuleBinding.severity}. */
   readonly severity?: Severity;
   readonly versionNote?: VersionNote;
-  check: (ctx: RepoContext, config: ParsedConfig) => CheckStatus;
-  fix: (ctx: RepoContext) => readonly AdvisoryOp[];
+  check: (ctx: RuleContext, config: ParsedConfig) => CheckStatus;
 }
-type RuleBinding = AutoRuleBinding | AdvisoryRuleBinding;
 /** A package-manager-agnostic security intent, realized per PM via `bindings`. */
 interface Rule<Id extends string = string> {
   readonly id: Id;
@@ -237,6 +138,18 @@ interface Rule<Id extends string = string> {
   /** Absence of a PM key means the rule does not apply (N/A) to that PM. */
   readonly bindings: Partial<Record<PM, RuleBinding>>;
 }
+declare const defineRule: <const Id extends string>(rule: Rule<Id>) => Rule<Id>;
+//#endregion
+//#region src/domain/builtin-rules.d.ts
+declare const rules: readonly [Rule<"advisory-check">, Rule<"approved-git-repos">, Rule<"audit-suppression">, Rule<"block-auto-install">, Rule<"block-exotic-subdeps">, Rule<"bun-security-scanner">, Rule<"checksum-verification">, Rule<"commit-lockfile">, Rule<"dependency-overrides">, Rule<"disable-lifecycle-scripts">, Rule<"enforce-strict-ssl">, Rule<"files-field">, Rule<"frozen-lockfile">, Rule<"frozen-store">, Rule<"hardened-mode">, Rule<"minimum-release-age">, Rule<"named-registries">, Rule<"paranoid-mode">, Rule<"patched-dependencies">, Rule<"pin-exact-versions">, Rule<"provenance">, Rule<"publish-access">, Rule<"store-server">, Rule<"strict-allow-scripts">, Rule<"strict-release-age">, Rule<"strict-store-integrity">, Rule<"trust-policy">];
+type BuiltinRuleId = (typeof rules)[number]['id'];
+//#endregion
+//#region src/domain/ports/io.d.ts
+/** Output sink for commands; injectable so tests can drive a string buffer. */
+interface IO {
+  stdout: (line: string) => void;
+  stderr: (line: string) => void;
+}
 //#endregion
 //#region src/domain/entities/lint-result.d.ts
 interface Finding {
@@ -245,22 +158,7 @@ interface Finding {
   readonly severity: Severity;
   readonly message: string;
   readonly file?: string;
-  readonly fixable: boolean;
-  /**
-   * Machine-readable remediation: the binding's fix ops, verbatim. Empty
-   * when `manualSteps` is present (writing the ops would be defeated by the
-   * user state that produced the steps). Advisory bindings contribute their
-   * `note` / `ensureFileTracked` ops here so external fixers can surface
-   * them. Part of the json output contract — see docs/json-output.md.
-   */
-  readonly fix: readonly FixOp[];
-  /** Manual remediation steps, verbatim from the check (see CheckStatus). */
-  readonly manualSteps?: readonly string[];
-  /**
-   * Pinned to {@link ConfigValue} (no `null`) so it stays in lockstep with
-   * `CheckStatus.violation.expected`. Widening to ConfigScalar would have
-   * advertised a `null` outcome that no current rule can produce.
-   */
+  readonly remediation?: Remediation;
   readonly expected?: ConfigValue;
   readonly actual?: ConfigReadValue;
   /** Official PM doc anchor for the setting this finding is about, if any. */
@@ -272,32 +170,54 @@ interface LintResult {
 }
 //#endregion
 //#region src/domain/ports/reporter.d.ts
-/**
- * Renderer from `LintResult` to user-facing output.
- *
- * Reporters never touch the filesystem and never spawn processes — every
- * output byte flows through the injected `IO` port. They MAY however
- * consult `process.env` for environmental shape (TTY colour support,
- * NO_COLOR / FORCE_COLOR, CI detection) because that information has no
- * `IO`-port equivalent and treating it as I/O would force the application
- * layer to thread a snapshot through every call site for a value the
- * adapter can read in a single line.
- *
- * Implementations live in the adapter layer (src/adapters/reporters/),
- * so the env access stays out of the domain.
- */
 interface Reporter<Name extends string = string> {
   readonly name: Name;
   format: (result: LintResult, io: IO) => void;
 }
+//#endregion
+//#region src/domain/entities/siro-config.d.ts
+/** Per-rule setting. `'off'` disables; a Severity overrides the default level. */
+type RuleSetting = Severity | 'off';
 /**
- * Structural guard for an embedder-supplied reporter. The `Reporter` contract
- * is compile-time only (`defineConfig` / typed options), so a hand-written JS
- * config or a dynamically-built object can still pass a malformed value; this
- * lets each boundary reject it with its own error type before `format` is
- * called on something that isn't a function.
+ * User-facing config returned by `defineConfig` in `siro.config.{ts,mjs,js}`.
+ *
+ *   defineConfig({
+ *     pms: ['npm', 'pnpm'],            // restrict detection
+ *     rules: { provenance: 'off' },    // disable / override severity
+ *     customRules: [myRule],           // extend
+ *     reporters: [mySarifReporter],    // extend
+ *   })
  */
-declare const isReporterShape: (value: unknown) => value is Reporter;
+interface SiroConfig {
+  readonly pms?: readonly PM[];
+  readonly projectType?: ProjectType;
+  readonly rules?: Readonly<Partial<Record<BuiltinRuleId | (string & Record<never, never>), RuleSetting>>>;
+  readonly customRules?: readonly Rule[];
+  readonly reporters?: readonly Reporter[];
+}
+/** Identity helper for type-checked config files. */
+declare const defineConfig: (config: SiroConfig) => SiroConfig;
+//#endregion
+//#region src/application/lint.d.ts
+interface LintOptions {
+  readonly cwd: AbsPath;
+  readonly fs?: FileSystem;
+  readonly pm?: PM;
+  readonly projectType?: ProjectType;
+  /** Explicit configuration; the library never imports files from the target repository. */
+  readonly config?: SiroConfig;
+}
+declare const lint: (options: LintOptions) => LintResult;
+//#endregion
+//#region src/adapters/config-loader.d.ts
+/** Load the first matching config; executable imports always use the real filesystem. */
+declare const loadConfig: (cwd: AbsPath, nodeVersion?: string) => Promise<SiroConfig | undefined>;
+//#endregion
+//#region src/adapters/node-file-system.d.ts
+declare const nodeFileSystem: FileSystem;
+//#endregion
+//#region src/adapters/node-io.d.ts
+declare const nodeIO: IO;
 //#endregion
 //#region src/adapters/reporters/github.d.ts
 /** Emit GitHub Actions workflow commands (annotations on PRs). */
@@ -315,62 +235,17 @@ declare const BUILTINS: readonly [Reporter<"pretty">, Reporter<"json">, Reporter
 declare const BUILTIN_REPORTER_NAMES: readonly BuiltinReporterName[];
 /** Literal union of every built-in reporter name. */
 type BuiltinReporterName = (typeof BUILTINS)[number]['name'];
-/** Reporter lookup table — pass an explicit value to keep calls hermetic. */
-interface ReporterRegistry {
-  get: (name: string) => Reporter | undefined;
-  list: () => readonly string[];
-}
-/** Build a registry from the builtins plus any extras (later wins on collision). */
-declare const createRegistry: (extras?: readonly Reporter[]) => ReporterRegistry;
 //#endregion
 //#region src/application/commands/lint.d.ts
-interface LintOptions {
-  /**
-   * Absolute repo root. Callers are responsible for resolving any relative
-   * path before branding it; siro's CLI does this in `cli.ts`. Keeping the
-   * brand here lets the application layer stay free of `node:path`.
-   */
-  cwd: AbsPath;
-  /** Restrict to a single PM; otherwise PMs are auto-detected. */
-  pm?: PM;
-  /** Select application or published-package policy; otherwise infer it. */
-  projectType?: ProjectType;
-  /** Reporter name or instance; defaults to `pretty`. */
-  reporter?: string | Reporter;
-  /** Extra reporters to make available by name (merged with the user config). */
-  reporters?: readonly Reporter[];
-  /**
-   * Programmatic custom rules to evaluate alongside the builtins and any
-   * `customRules` from the user config. Mirrors `SiroConfig.customRules`
-   * but is supplied at the call site, so embedders can compose rulesets
-   * without writing a config file. Ids must be unique across builtins,
-   * config-supplied custom rules, and this list — collisions throw a
-   * `ConfigError` (exit 2), matching how `loadConfig` rejects them.
-   */
-  customRules?: readonly Rule[];
-  /** Show (and fail on) findings at or above this severity. */
-  severity?: Severity;
-  /**
-   * Inject a non-default FS (e.g. memfs in tests). Caveat: `siro.config.{ts,mjs,js}`
-   * is imported from the REAL disk — only the config's existence is probed
-   * through this FS. A config that lives solely in an injected FS won't load.
-   */
-  fs?: FileSystem;
+interface LintCommandOptions extends LintOptions {
+  readonly reporter?: string | Reporter;
+  readonly severity?: Severity;
 }
-/** `siro lint`: detect PMs, evaluate rules, report findings. */
-declare const lintCommand: (options: LintOptions, io: IO) => Promise<number>;
+/** Evaluate and report. Executable config loading belongs to the CLI adapter. */
+declare const lintCommand: (options: LintCommandOptions, io: IO) => Promise<number>;
 //#endregion
 //#region src/domain/entities/config-files.d.ts
-/**
- * Canonical {@link ConfigFileRef}s for every package-manager config file siro
- * knows how to read. Centralizing them keeps each rule module from hardcoding
- * `kind` / `path` pairs, so renaming a file (or fixing a typo in its path) is a
- * single-line change. This is also the one place `RelPath` is minted for a
- * config ref — every downstream binding inherits the brand, so no rule needs
- * an ad-hoc `asRelPath(ref.path)` cast at the FS boundary.
- *
- * Add a new entry here when introducing support for a new package manager.
- */
+/** Known configuration locations and their parsers. */
 declare const CONFIG_FILES: {
   readonly aubeWorkspace: {
     readonly kind: "yaml";
@@ -402,119 +277,19 @@ declare const CONFIG_FILES: {
   };
 };
 //#endregion
-//#region src/domain/entities/signals.d.ts
-/**
- * Filenames that identify a package manager. `lockfiles[0]` is the
- * canonical/preferred one (used by lint messages and error
- * messages); the rest are legacy/alternative forms the PM writes itself.
- *
- * `lockfiles` and `configs` are **detection evidence** — their presence means
- * the PM is in use. `reusesLockfiles` is NOT evidence: it lists other PMs'
- * lockfile shapes that this PM will reuse rather than writing its own (aube),
- * so `commit-lockfile` accepts them but `detectPMs` ignores them — otherwise a
- * plain pnpm/npm repo would false-positive as aube. Keeping the two lists
- * separate is what lets detection stay a simple "any signal present?" check.
- */
-interface PMSignals {
-  readonly lockfiles: readonly [string, ...string[]];
-  readonly configs: readonly string[];
-  /** Other PMs' lockfiles this PM reuses; satisfies commit-lockfile, not detection. */
-  readonly reusesLockfiles?: readonly string[];
-}
-declare const PM_SIGNALS: {
-  readonly aube: {
-    readonly configs: readonly [RelPath];
-    readonly lockfiles: readonly ["aube-lock.yaml"];
-    readonly reusesLockfiles: readonly ["pnpm-lock.yaml", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "bun.lock", "bun.lockb", "deno.lock"];
-  };
-  readonly bun: {
-    readonly configs: readonly [RelPath];
-    readonly lockfiles: readonly ["bun.lock", "bun.lockb"];
-  };
-  readonly deno: {
-    readonly configs: readonly [RelPath];
-    readonly lockfiles: readonly ["deno.lock"];
-  };
-  readonly npm: {
-    readonly configs: readonly [];
-    readonly lockfiles: readonly ["package-lock.json", "npm-shrinkwrap.json"];
-  };
-  readonly pnpm: {
-    readonly configs: readonly [RelPath];
-    readonly lockfiles: readonly ["pnpm-lock.yaml"];
-  };
-  readonly yarn: {
-    readonly configs: readonly [RelPath];
-    readonly lockfiles: readonly ["yarn.lock"];
-  };
-};
-//#endregion
-//#region src/domain/builtin-rules.d.ts
-declare const rules: readonly [Rule<"advisory-check">, Rule<"approved-git-repos">, Rule<"audit-suppression">, Rule<"block-auto-install">, Rule<"block-exotic-subdeps">, Rule<"bun-security-scanner">, Rule<"checksum-verification">, Rule<"commit-lockfile">, Rule<"dependency-overrides">, Rule<"disable-lifecycle-scripts">, Rule<"enforce-strict-ssl">, Rule<"files-field">, Rule<"frozen-lockfile">, Rule<"frozen-store">, Rule<"hardened-mode">, Rule<"minimum-release-age">, Rule<"named-registries">, Rule<"paranoid-mode">, Rule<"patched-dependencies">, Rule<"pin-exact-versions">, Rule<"provenance">, Rule<"publish-access">, Rule<"store-server">, Rule<"strict-allow-scripts">, Rule<"strict-release-age">, Rule<"strict-store-integrity">, Rule<"trust-policy">];
-type BuiltinRuleId = (typeof rules)[number]['id'];
-//#endregion
-//#region src/domain/entities/siro-config.d.ts
-/** Per-rule setting. `'off'` disables; a Severity overrides the default level. */
-type RuleSetting = Severity | 'off';
-/**
- * User-facing config returned by `defineConfig` in `siro.config.{ts,mjs,js}`.
- *
- *   defineConfig({
- *     pms: ['npm', 'pnpm'],            // restrict detection
- *     rules: { provenance: 'off' },    // disable / override severity
- *     customRules: [myRule],           // extend
- *     reporters: [mySarifReporter],    // extend
- *   })
- */
-interface SiroConfig {
-  readonly pms?: readonly PM[];
-  readonly projectType?: ProjectType;
-  readonly rules?: Readonly<Partial<Record<BuiltinRuleId | (string & Record<never, never>), RuleSetting>>>;
-  readonly customRules?: readonly Rule[];
-  readonly reporters?: readonly Reporter[];
-}
-/** Identity helper for type-checked config files. */
-declare const defineConfig: (config: SiroConfig) => SiroConfig;
-//#endregion
-//#region src/domain/ports/config-codec.d.ts
-/** Reads a single config-file format into siro's structural view. */
-interface ConfigCodec {
-  parse: (text: string) => ParsedConfig;
-}
-/** Resolve the codec for a given file kind. Total over `CodecKind`. */
-type CodecFor = (kind: CodecKind) => ConfigCodec;
-//#endregion
 //#region src/domain/rules/builders/require-config-key.d.ts
 interface RequireConfigKeySpec {
   readonly file: ConfigFileRef;
   readonly keyPath: KeyPath;
-  /** Value `fix` will write and (when no `accept` predicate is given) the value `check` expects. */
+  /** Expected value and proposed replacement; `accept` may allow other values. */
   readonly value: ConfigValue;
   readonly message: string;
   readonly docs?: string;
   readonly severity?: Severity;
   accept?: (actual: unknown) => boolean;
   /**
-   * Extra key writes appended after the auto-generated one (e.g. clearing
-   * save-prefix alongside save-exact on the same .npmrc). The target file
-   * is implicitly `spec.file` — extras can't redirect to a different file
-   * because `check` would then never validate them, leaving the fix ops
-   * and `lint` permanently out of step. A rule that legitimately needs to write
-   * across multiple files belongs in a hand-written binding (see
-   * `disable-lifecycle-scripts` → `overrideBindings`).
-   */
-  readonly extraFix?: readonly KeyAssignment[];
-  /**
-   * PM-documented default for this key. When the user has not set the key
-   * AND this default would satisfy `accept`/`value`, the finding is
-   * downgraded to {@link defaultSatisfiedSeverity} (default `'info'`) — the
-   * threat is mitigated by the PM but explicit pinning is still recommended.
-   * - unset: no PM-default protection (legacy behaviour).
-   *
-   * A CONDITIONAL default (e.g. CI-only: pnpm `frozenLockfile`, aube
-   * `preferFrozenLockfile`) may use this field, but the binding's `message`
-   * MUST name the condition — the downgrade then reads "covered where it
-   * matters most", not "covered unconditionally".
+   * An omitted value that is safe across every supported version and target
+   * environment emits info. Version-dependent defaults retain full severity.
    */
   readonly documentedDefault?: ConfigValue;
   /**
@@ -536,68 +311,24 @@ interface RequireConfigKeyOptions<Id extends string = string> {
   /** Return false to short-circuit `check` as N/A (e.g. private packages). */
   applies?: (ctx: RepoContext) => boolean;
 }
-/**
- * Replace one or more bindings on an existing rule, returning a fresh Rule
- * object. Used by rules whose shape outgrows {@link requireConfigKey} for a
- * subset of PMs — they build the simple slots via the builder, then splice
- * the hand-written bindings in via this helper rather than rebuilding from
- * scratch or mutating the source rule.
- */
 declare const overrideBindings: <Id extends string>(rule: Rule<Id>, overrides: Partial<Rule["bindings"]>) => Rule<Id>;
 /** Build a Rule from a per-PM table of {file, keyPath, value, message}. */
 declare const requireConfigKey: <const Id extends string>(options: RequireConfigKeyOptions<Id>) => Rule<Id>;
 //#endregion
-//#region src/domain/services/render-version-note.d.ts
-declare const renderVersionNoteMessage: (message: string, versionNote: VersionNote | undefined) => string;
-//#endregion
-//#region src/domain/services/detect-pms.d.ts
-declare const detectPMs: (ctx: RepoContext) => PM[];
-//#endregion
-//#region src/domain/services/filter.d.ts
-/** Keep only findings at or above `threshold`, recomputing the summary. */
-declare const filterBySeverity: (result: LintResult, threshold: Severity) => LintResult;
-/**
- * Exit code for a lint run. Non-zero when any finding meets `threshold`
- * (default: only `error` fails the run).
- */
-declare const exitCodeForLint: (result: LintResult, threshold?: Severity) => number;
-//#endregion
-//#region src/shared/siro-error.d.ts
-/**
- * Structured errors used across siro. The CLI maps them to exit codes in one
- * place so individual commands never have to think about exit semantics.
- * The exit-code table lives in docs/configuration.md S"Exit codes" and
- * src/cli/help.ts (HELP_LINT) -- not restated here.
- */
+//#region src/shared/errors.d.ts
 declare class SiroError extends Error {
-  /** Recommended process exit code for this error. */
   readonly exitCode: number;
   constructor(message: string, exitCode: number);
 }
-//#endregion
-//#region src/shared/config-error.d.ts
 declare class ConfigError extends SiroError {
   constructor(message: string);
 }
-//#endregion
-//#region src/shared/usage-error.d.ts
 declare class UsageError extends SiroError {
   constructor(message: string);
 }
 //#endregion
-//#region src/shared/errors.d.ts
-/**
- * Run `fn` and wrap any non-`ConfigError` failure as a `ConfigError` prefixed
- * with `filePath`. Codec `parse` calls hit raw libraries that
- * throw bare `Error`s; without this wrap the CLI would surface those as
- * exit-1 internal errors and break CI that branches on exit codes. A
- * `ConfigError` that bubbles up from a nested call is re-thrown unchanged so
- * the original `path: message` framing is preserved.
- */
-declare const wrapCodecError: <TResult>(filePath: string, fn: () => TResult) => TResult;
-//#endregion
 //#region src/version.d.ts
-declare const version = "0.3.0";
+declare const version: string;
 //#endregion
-export { type AbsPath, type AdvisoryRuleBinding, type AutoRuleBinding, BUILTIN_REPORTER_NAMES, type BuiltinReporterName, CONFIG_FILES, type CheckStatus, type CodecFor, type ConfigCodec, ConfigError, type ConfigFileRef, type ConfigReadValue, type ConfigScalar, type ConfigValue, type FileSystem, type Finding, type FixKind, type FixOp, type IO, type KeyAssignment, type KeyPath, type LintOptions, type LintResult, type PM, PMS, type PMSignals, PM_SIGNALS, PROJECT_TYPES, type PackageJson, type ParsedConfig, type ProjectType, type RelPath, type RepoContext, type Reporter, type ReporterRegistry, type RequireConfigKeyOptions, type Rule, type RuleBinding, type RuleSetting, SEVERITIES, type Severity, type SiroConfig, SiroError, UsageError, type VersionNote, asAbsPath, asRelPath, createRegistry, defineConfig, detectPMs, exitCodeForLint, filterBySeverity, getByPath, githubReporter, isPM, isReporterShape, isSeverity, jsonReporter, lintCommand, nodeFileSystem, nodeIO, overrideBindings, prettyReporter, renderVersionNoteMessage, requireConfigKey, version, wrapCodecError };
+export { type AbsPath, BUILTIN_REPORTER_NAMES, type BuiltinReporterName, CONFIG_FILES, type CheckStatus, ConfigError, type ConfigFileRef, type ConfigReadValue, type ConfigValue, type FileSystem, type Finding, type IO, type KeyPath, type LintCommandOptions, type LintOptions, type LintResult, type PM, PMS, PROJECT_TYPES, type ParsedConfig, type ProjectType, type RelPath, type Remediation, type RepoContext, type Reporter, type RequireConfigKeyOptions, type Rule, type RuleBinding, type RuleContext, type RuleSetting, SEVERITIES, type SetKeyOperation, type Severity, type SiroConfig, SiroError, UsageError, type VersionNote, asAbsPath, asRelPath, defineConfig, defineRule, getByPath, githubReporter, isPM, isSeverity, jsonReporter, lint, lintCommand, loadConfig, nodeFileSystem, nodeIO, overrideBindings, prettyReporter, requireConfigKey, version };
 //# sourceMappingURL=index.d.mts.map