@pho9ubenaa/siro 0.3.0 → 0.4.1

package/dist/node-io-DIRcPNSN.mjs

@@ -0,0 +1,2211 @@
+import path from "node:path";
+import { accessSync, constants, readFileSync, statSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+import satisfies from "semver/functions/satisfies.js";
+import * as vb from "valibot";
+import pc from "picocolors";
+import ini from "ini";
+import { parse } from "smol-toml";
+import { parseDocument } from "yaml";
+import valid from "semver/functions/valid.js";
+//#region src/shared/errors.ts
+var SiroError = class extends Error {
+	exitCode;
+	constructor(message, exitCode) {
+		super(message);
+		this.name = "SiroError";
+		this.exitCode = exitCode;
+	}
+};
+var ConfigError = class extends SiroError {
+	constructor(message) {
+		super(message, 2);
+		this.name = "ConfigError";
+	}
+};
+var UsageError = class extends SiroError {
+	constructor(message) {
+		super(message, 2);
+		this.name = "UsageError";
+	}
+};
+/**
+* Run `fn` and wrap any non-`ConfigError` failure as a `ConfigError` prefixed
+* with `filePath`. A `ConfigError` that bubbles up from a nested call is re-thrown unchanged so
+* the original `path: message` framing is preserved.
+*/
+const wrapCodecError = (filePath, fn) => {
+	try {
+		return fn();
+	} catch (error) {
+		if (error instanceof ConfigError) throw error;
+		let msg = String(error);
+		if (error instanceof Error) msg = error.message;
+		throw new ConfigError(`${filePath}: ${msg}`);
+	}
+};
+//#endregion
+//#region src/shared/paths.ts
+const isAbsPath = (value) => typeof value === "string" && !value.includes("\0") && path.isAbsolute(value);
+const isRelPath = (value) => typeof value === "string" && value.length > 0 && !value.includes("\0") && !path.posix.isAbsolute(value) && !path.win32.isAbsolute(value) && !/^[a-z]:/iu.test(value) && !value.split(/[\\/]/u).includes("..");
+const asAbsPath = (value) => {
+	if (!isAbsPath(value)) throw new TypeError("Expected an absolute filesystem path.");
+	return value;
+};
+const asRelPath = (value) => {
+	if (!isRelPath(value)) throw new TypeError("Expected a repository-relative path without parent traversal.");
+	return value;
+};
+//#endregion
+//#region src/adapters/node-errors.ts
+/** Only the Error and code properties are established by this guard. */
+const isNodeError = (value) => value instanceof Error && "code" in value && typeof value.code === "string";
+//#endregion
+//#region src/adapters/node-file-system.ts
+const nodeFileSystem = {
+	exists(filePath) {
+		try {
+			accessSync(filePath, constants.F_OK);
+			return true;
+		} catch (error) {
+			if (isNodeError(error) && error.code === "ENOENT") return false;
+			throw error;
+		}
+	},
+	readText(filePath) {
+		try {
+			return readFileSync(filePath, "utf8");
+		} catch (error) {
+			if (isNodeError(error) && error.code === "ENOENT") return;
+			throw error;
+		}
+	}
+};
+const resolveIn = (root, relPath) => asAbsPath(path.join(root, asRelPath(relPath)));
+const assertDirectory = (root) => {
+	if (!statSync(root).isDirectory()) throw new UsageError("The lint target must be a directory.");
+};
+//#endregion
+//#region package.json
+var version$1 = "0.4.1";
+//#endregion
+//#region src/shared/node-version.ts
+const SUPPORTED_NODE_RANGE = { "node": "^22.18.0 || ^24.0.0" }.node;
+const isSupportedNodeVersion = (version) => satisfies(version, SUPPORTED_NODE_RANGE);
+//#endregion
+//#region src/domain/entities/pms.ts
+/**
+* Single source of truth for package managers and severities.
+* Types, runtime sets, and ordering are all derived from these tuples — add a
+* package manager here and the rest of the codebase follows.
+*/
+const PMS = [
+	"npm",
+	"pnpm",
+	"yarn",
+	"bun",
+	"deno",
+	"aube"
+];
+const SEVERITIES = [
+	"error",
+	"warn",
+	"info"
+];
+/**
+* Numeric ordering of severities for threshold comparisons. Co-located with
+* `Severity` so `filter`, `runLint`, and any future severity-aware code share
+* one source of truth — drifting the order in one place silently changes the
+* fail-on-threshold contract everywhere.
+*/
+const SEVERITY_RANK = {
+	error: 3,
+	info: 1,
+	warn: 2
+};
+const PM_SET = new Set(PMS);
+const SEVERITY_SET = new Set(SEVERITIES);
+const isPM = (value) => PM_SET.has(value);
+const isSeverity = (value) => SEVERITY_SET.has(value);
+const PACKAGE_MANAGER_FIELD = /^(?<pmName>[a-z]+)(?:@.+)?$/u;
+const parsePackageManagerField = (value) => {
+	const name = PACKAGE_MANAGER_FIELD.exec(value.trim())?.groups?.pmName;
+	if (typeof name !== "undefined" && isPM(name)) return name;
+};
+//#endregion
+//#region src/domain/entities/project-type.ts
+const PROJECT_TYPES = ["application", "package"];
+const isProjectType = (value) => PROJECT_TYPES.some((projectType) => projectType === value);
+//#endregion
+//#region src/shared/records.ts
+/** Configuration maps are ordinary objects or null-prototype dictionaries. */
+const isPlainRecord = (value) => {
+	if (typeof value !== "object" || value === null) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+};
+//#endregion
+//#region src/domain/ports/reporter.ts
+const isReporterShape = (value) => {
+	return isPlainRecord(value) && typeof value.name === "string" && typeof value.format === "function";
+};
+//#endregion
+//#region src/domain/entities/config-value.ts
+const CODEC_KINDS = [
+	"json",
+	"npmrc",
+	"toml",
+	"yaml"
+];
+/** Read an own key path; absent or non-mapping parents yield undefined. */
+const getByPath = (config, keyPath) => {
+	let current = config;
+	for (const key of keyPath) {
+		if (!isPlainRecord(current)) return;
+		if (!Object.hasOwn(current, key)) return;
+		current = current[key];
+	}
+	return current;
+};
+/** Accept only mapping roots while preserving unvalidated values inside them. */
+const toParsedConfig = (value) => {
+	if (isPlainRecord(value)) return value;
+	throw new TypeError("Config root must be a mapping.");
+};
+//#endregion
+//#region src/domain/entities/rule.ts
+const defineRule = (rule) => rule;
+const isOptionalString = (value) => typeof value === "undefined" || typeof value === "string";
+const CONFIG_FILE_KINDS = new Set(CODEC_KINDS);
+const isConfigFileRefShape = (value) => {
+	if (!isPlainRecord(value) || typeof value.kind !== "string" || !isRelPath(value.path)) return false;
+	return CONFIG_FILE_KINDS.has(value.kind);
+};
+const isConfigValueShape = (value) => typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
+const isDenseStringArray = (value) => Array.isArray(value) && Array.from(value).every((item) => typeof item === "string");
+const isCheckStatusShape = (value) => {
+	if (!isPlainRecord(value)) return false;
+	if (value.state === "ok" || value.state === "na") return true;
+	return value.state === "violation" && typeof value.message === "string" && (value.file === void 0 || isRelPath(value.file)) && (value.expected === void 0 || isConfigValueShape(value.expected)) && (value.severity === void 0 || typeof value.severity === "string" && isSeverity(value.severity)) && !("manualSteps" in value) && !("fix" in value) && !("fixable" in value) && (value.remediation === void 0 || isRemediationShape(value.remediation));
+};
+const isSetKeyOperation = (value) => isPlainRecord(value) && value.op === "setKey" && isConfigFileRefShape(value.file) && isDenseStringArray(value.keyPath) && value.keyPath.length > 0 && isConfigValueShape(value.value);
+const isRemediationShape = (value) => {
+	if (!isPlainRecord(value)) return false;
+	if (value.kind === "manual") return !("operations" in value) && isDenseStringArray(value.steps) && value.steps.length > 0;
+	return value.kind === "automatic" && !("steps" in value) && Array.isArray(value.operations) && value.operations.length > 0 && Array.from(value.operations).every(isSetKeyOperation);
+};
+const isVersionNoteShape = (value) => typeof value === "undefined" || isPlainRecord(value) && isOptionalString(value.configAvailableSince) && isOptionalString(value.defaultSafeSince) && isOptionalString(value.note);
+const isRuleBindingShape = (value) => {
+	if (!isPlainRecord(value)) return false;
+	return (value.file === void 0 || isConfigFileRefShape(value.file)) && !("fix" in value) && !("fixKind" in value) && !("fileGlob" in value) && isOptionalString(value.docs) && (typeof value.severity === "undefined" || typeof value.severity === "string" && isSeverity(value.severity)) && isVersionNoteShape(value.versionNote) && typeof value.check === "function";
+};
+const isBindingsShape = (value) => isPlainRecord(value) && Object.keys(value).every(isPM) && PMS.every((pm) => value[pm] === void 0 || isRuleBindingShape(value[pm]));
+const isProjectTypeValue = (value) => typeof value === "string" && isProjectType(value);
+const isProjectTypesShape = (value) => typeof value === "undefined" || Array.isArray(value) && Array.from(value).every((projectType) => isProjectTypeValue(projectType));
+const isRuleShape = (value) => {
+	if (!isPlainRecord(value)) return false;
+	return typeof value.id === "string" && typeof value.title === "string" && typeof value.description === "string" && typeof value.severity === "string" && isSeverity(value.severity) && isOptionalString(value.docs) && isProjectTypesShape(value.projectTypes) && isBindingsShape(value.bindings);
+};
+//#endregion
+//#region src/application/config.ts
+const RuleSettingSchema = vb.union([vb.picklist(SEVERITIES), vb.literal("off")]);
+const ConfigSchema = vb.strictObject({
+	customRules: vb.optional(vb.array(vb.custom(isRuleShape, "must be a structurally valid rule"))),
+	pms: vb.optional(vb.pipe(vb.array(vb.picklist(PMS)), vb.minLength(1, "must not be empty (omit the key to auto-detect, or list at least one PM)"))),
+	projectType: vb.optional(vb.picklist(PROJECT_TYPES)),
+	reporters: vb.optional(vb.array(vb.custom(isReporterShape, "must be a { name, format } reporter"))),
+	rules: vb.optional(vb.pipe(vb.custom(isPlainRecord, "must be an object of rule settings"), vb.rawTransform(({ dataset, addIssue }) => {
+		const entries = [];
+		for (const [key, value] of Object.entries(dataset.value)) {
+			const result = vb.safeParse(RuleSettingSchema, value);
+			if (result.success) entries.push([key, result.output]);
+			else addIssue({
+				message: result.issues[0].message,
+				path: [{
+					input: dataset.value,
+					key,
+					origin: "value",
+					type: "object",
+					value
+				}]
+			});
+		}
+		return Object.fromEntries(entries);
+	})))
+}, "unknown config key (check for a typo)");
+const formatIssues = (issues) => issues.map((issue) => {
+	const keyPath = (issue.path ?? []).map((seg) => seg.key).filter((key) => typeof key === "string" || typeof key === "number").join(".");
+	if (keyPath) return `${keyPath}: ${issue.message}`;
+	return issue.message;
+}).join("; ");
+const parseConfig = (candidate, name = "siro.config") => {
+	if (!isPlainRecord(candidate)) throw new ConfigError(`${name} must export a config object (got ${Array.isArray(candidate) ? "an array" : typeof candidate}).`);
+	const result = vb.safeParse(ConfigSchema, Object.fromEntries(Object.entries(candidate)));
+	if (!result.success) throw new ConfigError(`${name}: ${formatIssues(result.issues)}`);
+	return result.output;
+};
+//#endregion
+//#region src/adapters/config-loader.ts
+const CONFIG_NAMES = [
+	"siro.config.ts",
+	"siro.config.mjs",
+	"siro.config.js"
+];
+const describeError = (error) => error instanceof Error ? error.message : String(error);
+let loadCounter = 0;
+/** Load the first matching config; executable imports always use the real filesystem. */
+const loadConfig = async (cwd, nodeVersion = process.versions.node) => {
+	const name = CONFIG_NAMES.find((candidate) => nodeFileSystem.exists(asAbsPath(path.join(cwd, candidate))));
+	if (name === void 0) return;
+	if (name.endsWith(".ts") && !isSupportedNodeVersion(nodeVersion)) throw new ConfigError(`${name} requires Node.js with native type stripping (${SUPPORTED_NODE_RANGE}); current is v${nodeVersion}. Rename the config to siro.config.mjs (plain JS) or upgrade Node.js.`);
+	const url = pathToFileURL(path.join(cwd, name));
+	url.searchParams.set("siro-load", String(++loadCounter));
+	let mod;
+	try {
+		mod = await import(url.href);
+	} catch (error) {
+		throw new ConfigError(`Failed to load ${name}: ${describeError(error)}`);
+	}
+	return parseConfig(mod !== null && typeof mod === "object" && "default" in mod ? mod.default : mod, name);
+};
+//#endregion
+//#region src/domain/services/filter.ts
+const EXIT_SUCCESS = 0;
+const EXIT_FAILURE = 1;
+const meetsThreshold = (severity, threshold) => SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
+/** Keep only findings at or above `threshold`, recomputing the summary. */
+const filterBySeverity = (result, threshold) => {
+	const findings = [];
+	const summary = {
+		error: 0,
+		info: 0,
+		warn: 0
+	};
+	for (const finding of result.findings) if (meetsThreshold(finding.severity, threshold)) {
+		findings.push(finding);
+		summary[finding.severity] += 1;
+	}
+	return {
+		findings,
+		summary
+	};
+};
+/**
+* Exit code for a lint run. Non-zero when any finding meets `threshold`
+* (default: only `error` fails the run).
+*/
+const exitCodeForLint = (result, threshold = "error") => {
+	if (result.findings.some((finding) => meetsThreshold(finding.severity, threshold))) return EXIT_FAILURE;
+	return EXIT_SUCCESS;
+};
+//#endregion
+//#region src/adapters/reporters/github.ts
+const COMMAND = {
+	error: "error",
+	info: "notice",
+	warn: "warning"
+};
+const escapeData = (raw) => raw.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+const escapeProp = (raw) => escapeData(raw).replaceAll(":", "%3A").replaceAll(",", "%2C");
+/** Emit GitHub Actions workflow commands (annotations on PRs). */
+const githubReporter = {
+	format(result, io) {
+		for (const finding of result.findings) {
+			let file = "";
+			if (finding.file) file = `file=${escapeProp(finding.file)},`;
+			let body = `[${finding.pm}] ${finding.message}`;
+			if (finding.docs) body += ` (${finding.docs})`;
+			io.stdout(`::${COMMAND[finding.severity]} ${file}title=${escapeProp(finding.ruleId)}::${escapeData(body)}`);
+		}
+	},
+	name: "github"
+};
+//#endregion
+//#region src/version.ts
+const version = version$1;
+//#endregion
+//#region src/adapters/reporters/json.ts
+/**
+* Versioned machine-readable output — the public contract consumed by
+* external fixers (see docs/json-output.md). Bump `schemaVersion` on any
+* breaking shape change and update that doc in the same commit.
+*/
+const SCHEMA_VERSION = 2;
+const jsonReporter = {
+	format(result, io) {
+		io.stdout(JSON.stringify({
+			schemaVersion: SCHEMA_VERSION,
+			siroVersion: version,
+			findings: result.findings,
+			summary: result.summary
+		}, void 0, 2));
+	},
+	name: "json"
+};
+//#endregion
+//#region src/adapters/reporters/pretty.ts
+const GLYPH = {
+	error: "✖ error",
+	info: "ℹ info",
+	warn: "⚠ warn"
+};
+/**
+* Decide colour at call time, not at import time.
+*
+* picocolors snapshots `isColorSupported` when imported, so a later
+* `process.env.NO_COLOR = '1'` (or a different stdout) is ignored. The
+* reporter is invoked per `siro lint` run from many contexts (TTY, CI
+* with FORCE_COLOR, redirected output, …) — checking each call is the
+* only way NO_COLOR can truly win, as https://no-color.org/ requires.
+*/
+const colorSupportedNow = () => {
+	const { env } = process;
+	if (typeof env.NO_COLOR !== "undefined" && env.NO_COLOR !== "") return false;
+	if ("FORCE_COLOR" in env) return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "";
+	return pc.isColorSupported;
+};
+const renderFinding = (finding, ctx) => {
+	let where = "";
+	if (finding.file) where = ctx.colors.dim(` (${finding.file})`);
+	ctx.io.stdout(`${ctx.tag[finding.severity](GLYPH[finding.severity])}  [${finding.pm}] ${ctx.colors.bold(finding.ruleId)}${where}`);
+	ctx.io.stdout(`    ${finding.message}`);
+	for (const step of finding.remediation?.kind === "manual" ? finding.remediation.steps : []) ctx.io.stdout(`    ↳ ${step}`);
+	if (finding.docs) ctx.io.stdout(ctx.colors.dim(`    → ${finding.docs}`));
+};
+const buildRenderCtx = (io) => {
+	const colors = pc.createColors(colorSupportedNow());
+	return {
+		colors,
+		io,
+		tag: {
+			error: colors.red,
+			info: colors.cyan,
+			warn: colors.yellow
+		}
+	};
+};
+const prettyReporter = {
+	format(result, io) {
+		const ctx = buildRenderCtx(io);
+		if (result.findings.length === 0) {
+			io.stdout(ctx.colors.green("✔ No security best-practice issues found."));
+			return;
+		}
+		for (const finding of result.findings) renderFinding(finding, ctx);
+		const { error, warn, info } = result.summary;
+		io.stdout("");
+		io.stdout(`Summary: ${error} error, ${warn} warn, ${info} info`);
+	},
+	name: "pretty"
+};
+//#endregion
+//#region src/adapters/reporters/registry.ts
+const BUILTINS = [
+	prettyReporter,
+	jsonReporter,
+	githubReporter
+];
+const DEFAULT_REPORTER_NAME = prettyReporter.name;
+const JSON_REPORTER_NAME = jsonReporter.name;
+/** Names of every built-in reporter, in stable display order. */
+const BUILTIN_REPORTER_NAMES = BUILTINS.map((rep) => rep.name);
+/** Later registrations replace earlier reporters with the same name. */
+const createRegistry = (extras = []) => new Map([...BUILTINS, ...extras].map((reporter) => [reporter.name, reporter]));
+//#endregion
+//#region src/domain/schemas/package-json.ts
+const PackageJsonSchema = vb.looseObject({
+	files: vb.optional(vb.array(vb.string())),
+	name: vb.optional(vb.string()),
+	packageManager: vb.optional(vb.string()),
+	private: vb.optional(vb.boolean()),
+	publishConfig: vb.optional(vb.looseObject({ access: vb.optional(vb.picklist([
+		"public",
+		"restricted",
+		"private"
+	])) })),
+	trustedDependencies: vb.optional(vb.array(vb.string()))
+});
+const parsePackageJson = (value) => {
+	if (!isPlainRecord(value)) throw new ConfigError("package.json: expected an object at the root.");
+	const result = vb.safeParse(PackageJsonSchema, value);
+	if (result.success) return result.output;
+	const issue = result.issues[0];
+	const field = vb.getDotPath(issue);
+	throw new ConfigError(`package.json: ${field ? `${field}: ` : ""}${issue.message}`);
+};
+//#endregion
+//#region src/adapters/repo-context.ts
+const tryParseJson = (text) => {
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		let errMsg = String(error);
+		if (error instanceof Error) errMsg = error.message;
+		throw new ConfigError(`package.json: invalid JSON — ${errMsg}`);
+	}
+};
+const readPackageJson = (raw) => {
+	return parsePackageJson(tryParseJson(raw.trim()));
+};
+const createRepoContext = (root, fs = nodeFileSystem, projectType) => {
+	if (fs === nodeFileSystem) assertDirectory(root);
+	const readText = (relPath) => fs.readText(resolveIn(root, relPath));
+	const exists = (relPath) => fs.exists(resolveIn(root, relPath));
+	const raw = readText(asRelPath("package.json"));
+	let packageJson = void 0;
+	if (typeof raw !== "undefined") packageJson = readPackageJson(raw);
+	return {
+		exists,
+		packageJson,
+		projectType,
+		readText,
+		root
+	};
+};
+//#endregion
+//#region src/adapters/codecs/ini.ts
+const INTEGER_PATTERN = /^-?\d+$/u;
+const coerceBoolean = (str) => {
+	if (str === "true") return true;
+	if (str === "false") return false;
+};
+const coerceInteger = (str) => {
+	if (INTEGER_PATTERN.test(str)) return Number(str);
+};
+const coerce = (raw) => {
+	if (typeof raw !== "string") return raw;
+	return coerceBoolean(raw) ?? coerceInteger(raw) ?? raw;
+};
+//#endregion
+//#region src/adapters/codecs/store.ts
+const CODECS = {
+	json: { parse(text) {
+		const trimmed = text.trim();
+		return toParsedConfig(JSON.parse(trimmed));
+	} },
+	npmrc: { parse(text) {
+		const raw = toParsedConfig(ini.parse(text));
+		const config = {};
+		for (const [key, value] of Object.entries(raw)) if (Array.isArray(value)) config[key] = value.map((elem) => coerce(elem));
+		else if (typeof value === "object" && value !== null) config[key] = toParsedConfig(value);
+		else config[key] = coerce(value);
+		return config;
+	} },
+	toml: { parse(text) {
+		if (text.trim() === "") return {};
+		return toParsedConfig(parse(text.replace(/^\uFEFF/u, "")));
+	} },
+	yaml: { parse(text) {
+		if (text.trim() === "") return {};
+		const document = parseDocument(text);
+		if (document.errors.length > 0) throw document.errors[0];
+		if (document.contents === null) return {};
+		return toParsedConfig(document.toJS({ onAnchor: (value, count) => {
+			if (count > 1) JSON.stringify(value);
+		} }));
+	} }
+};
+/** Look up the codec for a parseable kind. Total — every CodecKind has one. */
+const codecFor = (kind) => CODECS[kind];
+//#endregion
+//#region src/domain/rules/remediation.ts
+/** Scalar writes must not discard an existing container or replace a non-object parent. */
+const proposeChanges = (config, operations) => {
+	for (const operation of operations) {
+		let current = config;
+		for (const key of operation.keyPath) {
+			if (current === void 0) break;
+			if (!isPlainRecord(current)) return {
+				kind: "manual",
+				steps: [`Review ${operation.file.path}: ${operation.keyPath.join(".")} has a non-object parent. Restructure it before setting the value to ${JSON.stringify(operation.value)}.`]
+			};
+			current = Object.hasOwn(current, key) ? current[key] : void 0;
+		}
+		if (current !== null && typeof current === "object") return {
+			kind: "manual",
+			steps: [`Review ${operation.file.path}: ${operation.keyPath.join(".")} contains nested settings. Preserve the required entries when correcting this value.`]
+		};
+	}
+	return {
+		kind: "automatic",
+		operations
+	};
+};
+//#endregion
+//#region src/domain/rules/builders/require-config-key.ts
+const overrideBindings = (rule, overrides) => ({
+	...rule,
+	bindings: {
+		...rule.bindings,
+		...overrides
+	}
+});
+const accepts = (spec, actual) => spec.accept ? spec.accept(actual) : actual === spec.value;
+const checkKeyValue = (spec, config) => {
+	const actual = getByPath(config, spec.keyPath);
+	const coveredByDefault = actual === void 0 && spec.documentedDefault !== void 0 && spec.versionNote?.defaultSafeSince === void 0 && accepts(spec, spec.documentedDefault);
+	if (!coveredByDefault && accepts(spec, actual)) return { state: "ok" };
+	const severity = coveredByDefault ? spec.defaultSatisfiedSeverity ?? "info" : void 0;
+	if (severity === "off") return { state: "ok" };
+	return {
+		state: "violation",
+		actual,
+		expected: spec.value,
+		message: spec.message,
+		...severity === void 0 ? {} : { severity },
+		remediation: proposeChanges(config, [{
+			file: spec.file,
+			keyPath: spec.keyPath,
+			op: "setKey",
+			value: spec.value
+		}])
+	};
+};
+const buildBinding = (spec, applies) => ({
+	check(ctx, config) {
+		if (typeof applies !== "undefined" && !applies(ctx)) return { state: "na" };
+		return checkKeyValue(spec, config);
+	},
+	docs: spec.docs,
+	file: spec.file,
+	severity: spec.severity,
+	versionNote: spec.versionNote
+});
+/** Build a Rule from a per-PM table of {file, keyPath, value, message}. */
+const requireConfigKey = (options) => {
+	const bindings = {};
+	for (const pm of PMS) {
+		const spec = options.bindings[pm];
+		if (typeof spec !== "undefined") {
+			if ("extraFix" in spec) throw new TypeError("extraFix is no longer supported; use a custom binding.");
+			bindings[pm] = buildBinding(spec, options.applies);
+		}
+	}
+	return {
+		bindings,
+		description: options.description,
+		docs: options.docs,
+		id: options.id,
+		projectTypes: options.projectTypes,
+		severity: options.severity,
+		title: options.title
+	};
+};
+//#endregion
+//#region src/domain/rules/builders/with-aube-paranoid.ts
+const withAubeParanoid = (rule) => {
+	const { aube } = rule.bindings;
+	if (!aube) return rule;
+	return overrideBindings(rule, { aube: {
+		...aube,
+		check(ctx, config) {
+			if (getByPath(config, ["paranoid"]) === true) return { state: "ok" };
+			return aube.check(ctx, config);
+		}
+	} });
+};
+//#endregion
+//#region src/domain/entities/config-files.ts
+/** Known configuration locations and their parsers. */
+const CONFIG_FILES = {
+	aubeWorkspace: {
+		kind: "yaml",
+		path: asRelPath("aube-workspace.yaml")
+	},
+	bunfig: {
+		kind: "toml",
+		path: asRelPath("bunfig.toml")
+	},
+	denoJson: {
+		kind: "json",
+		path: asRelPath("deno.json")
+	},
+	npmrc: {
+		kind: "npmrc",
+		path: asRelPath(".npmrc")
+	},
+	packageJson: {
+		kind: "json",
+		path: asRelPath("package.json")
+	},
+	pnpmWorkspace: {
+		kind: "yaml",
+		path: asRelPath("pnpm-workspace.yaml")
+	},
+	yarnrc: {
+		kind: "yaml",
+		path: asRelPath(".yarnrc.yml")
+	}
+};
+//#endregion
+//#region src/domain/rules/advisory-check.ts
+const { aubeWorkspace: aubeWorkspace$8 } = CONFIG_FILES;
+const advisoryCheck = withAubeParanoid(requireConfigKey({
+	bindings: { aube: {
+		accept: (value) => value === "on" || value === "required",
+		docs: "https://aube.jdx.dev/security.html",
+		documentedDefault: "on",
+		file: aubeWorkspace$8,
+		keyPath: ["advisoryCheck"],
+		message: "Set `advisoryCheck: on` (or `required`) in aube-workspace.yaml to check dependencies against known-malicious advisories.",
+		value: "on"
+	} },
+	description: "Query the OSV database for known-malicious packages during dependency resolution.",
+	docs: "https://aube.jdx.dev/security.html",
+	id: "advisory-check",
+	severity: "warn",
+	title: "Enable malicious-package advisory checks"
+}));
+//#endregion
+//#region src/domain/rules/config-predicates.ts
+const isNonBlankString = (value) => typeof value === "string" && value.trim().length > 0;
+const isStringList = (value) => Array.isArray(value) && Array.from(value).every(isNonBlankString);
+//#endregion
+//#region src/domain/rules/approved-git-repos.ts
+const { yarnrc: yarnrc$9 } = CONFIG_FILES;
+const message = "Set `approvedGitRepositories: []` in .yarnrc.yml to block all git: protocol dependencies (or list approved repository globs).";
+const approvedGitRepos = defineRule({
+	bindings: { yarn: {
+		check(_ctx, config) {
+			const value = getByPath(config, ["approvedGitRepositories"]);
+			if (isStringList(value)) return { state: "ok" };
+			return {
+				remediation: {
+					kind: "manual",
+					steps: ["Add `approvedGitRepositories: []` to .yarnrc.yml to block all git deps, or list specific approved repository URL globs."]
+				},
+				actual: value,
+				expected: "[]",
+				message,
+				state: "violation"
+			};
+		},
+		docs: "https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories",
+		file: yarnrc$9,
+		versionNote: { configAvailableSince: "yarn 4.14.0" }
+	} },
+	description: "Restrict git: protocol dependencies to an explicit allowlist of approved repository URL patterns.",
+	docs: "https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories",
+	id: "approved-git-repos",
+	severity: "warn",
+	title: "Approve git repository dependencies"
+});
+//#endregion
+//#region src/domain/rules/audit-suppression.ts
+const { yarnrc: yarnrc$8 } = CONFIG_FILES;
+const isNonEmptyArray = (value) => Array.isArray(value) && value.length > 0;
+const SUPPRESSION_KEYS = ["npmAuditIgnoreAdvisories", "npmAuditExcludePackages"];
+const checkSuppression = (config) => {
+	const present = SUPPRESSION_KEYS.filter((key) => isNonEmptyArray(getByPath(config, [key])));
+	const [first] = present;
+	if (typeof first === "undefined") return { state: "ok" };
+	return {
+		actual: getByPath(config, [first]),
+		message: `Review audit suppression in .yarnrc.yml (${present.join(", ")}). Broad glob patterns can silently hide future vulnerabilities.`,
+		state: "violation",
+		remediation: {
+			kind: "manual",
+			steps: ["Review entries in `npmAuditIgnoreAdvisories` and `npmAuditExcludePackages` — remove stale suppressions and overly broad glob patterns."]
+		}
+	};
+};
+const auditSuppression = defineRule({
+	bindings: { yarn: {
+		check(_ctx, config) {
+			return checkSuppression(config);
+		},
+		docs: "https://yarnpkg.com/configuration/yarnrc#npmAuditIgnoreAdvisories",
+		file: yarnrc$8
+	} },
+	description: "Flag audit advisory suppressions that may silently hide future vulnerabilities via broad glob patterns.",
+	docs: "https://yarnpkg.com/configuration/yarnrc#npmAuditIgnoreAdvisories",
+	id: "audit-suppression",
+	severity: "info",
+	title: "Review audit suppression entries"
+});
+//#endregion
+//#region src/domain/rules/block-auto-install.ts
+const { bunfig: bunfig$5 } = CONFIG_FILES;
+const blockAutoInstall = requireConfigKey({
+	bindings: { bun: {
+		docs: "https://bun.sh/docs/runtime/bunfig#install-auto",
+		file: bunfig$5,
+		keyPath: ["install", "auto"],
+		message: "Set `auto = \"disable\"` under [install] in bunfig.toml to prevent auto-install from bypassing security guards.",
+		value: "disable",
+		accept: (value) => value === "disable" || value === false
+	} },
+	description: "Disable auto-install so dependencies are only installed through an explicit install step where security guards apply.",
+	docs: "https://bun.sh/docs/runtime/bunfig#install-auto",
+	id: "block-auto-install",
+	severity: "warn",
+	title: "Block automatic package installation"
+});
+//#endregion
+//#region src/domain/rules/block-exotic-subdeps.ts
+const { aubeWorkspace: aubeWorkspace$7, npmrc: npmrc$6, pnpmWorkspace: pnpmWorkspace$10 } = CONFIG_FILES;
+const isRootOrNone = (value) => value === "root" || value === "none";
+const npmMessage = "Set `allow-git=none` and `allow-remote=none` in .npmrc to block git/tarball URLs; use `root` only when direct URL dependencies are required.";
+const npmBinding$2 = {
+	check(_ctx, config) {
+		const git = getByPath(config, ["allow-git"]);
+		const remote = getByPath(config, ["allow-remote"]);
+		const invalid = [git, remote].find((value) => value !== void 0 && !isRootOrNone(value));
+		if (invalid === void 0 && git !== void 0 && remote !== void 0) return { state: "ok" };
+		return {
+			state: "violation",
+			expected: "none",
+			...invalid === void 0 ? {} : { actual: invalid },
+			message: npmMessage,
+			remediation: proposeChanges(config, [{
+				file: npmrc$6,
+				keyPath: ["allow-git"],
+				op: "setKey",
+				value: "none"
+			}, {
+				file: npmrc$6,
+				keyPath: ["allow-remote"],
+				op: "setKey",
+				value: "none"
+			}])
+		};
+	},
+	docs: "https://docs.npmjs.com/cli/v12/using-npm/config#allow-git",
+	file: npmrc$6,
+	versionNote: { defaultSafeSince: "npm 12.0.0" }
+};
+const blockExoticSubdeps = overrideBindings(requireConfigKey({
+	bindings: {
+		aube: {
+			docs: "https://aube.jdx.dev/security.html",
+			documentedDefault: true,
+			file: aubeWorkspace$7,
+			keyPath: ["blockExoticSubdeps"],
+			message: "Set `blockExoticSubdeps: true` in aube-workspace.yaml to block git/tarball URLs in transitive dependencies.",
+			value: true
+		},
+		pnpm: {
+			docs: "https://pnpm.io/settings#blockexoticsubdeps",
+			documentedDefault: true,
+			file: pnpmWorkspace$10,
+			keyPath: ["blockExoticSubdeps"],
+			message: "Set `blockExoticSubdeps: true` in pnpm-workspace.yaml to block git/tarball URLs in transitive dependencies.",
+			value: true,
+			versionNote: {
+				configAvailableSince: "pnpm 10.26.0",
+				defaultSafeSince: "pnpm 10.26.0"
+			}
+		}
+	},
+	description: "Refuse to install transitive dependencies sourced from git or tarball URLs, which bypass registry integrity checking.",
+	docs: "https://pnpm.io/settings#blockexoticsubdeps",
+	id: "block-exotic-subdeps",
+	severity: "warn",
+	title: "Block exotic subdependencies"
+}), { npm: npmBinding$2 });
+//#endregion
+//#region src/domain/rules/bun-security-scanner.ts
+const { bunfig: bunfig$4 } = CONFIG_FILES;
+const bunSecurityScanner = defineRule({
+	bindings: { bun: {
+		check(_ctx, config) {
+			const scanner = getByPath(config, [
+				"install",
+				"security",
+				"scanner"
+			]);
+			if (isNonBlankString(scanner)) return { state: "ok" };
+			return {
+				remediation: {
+					kind: "manual",
+					steps: ["Add `[install.security] scanner = \"@socketsecurity/bun-security-scanner\"` (or another bun-compatible scanner) to bunfig.toml."]
+				},
+				actual: scanner,
+				message: "Configure `[install.security] scanner = \"...\"` in bunfig.toml (e.g. `@socketsecurity/bun-security-scanner`) to scan new packages on install.",
+				state: "violation"
+			};
+		},
+		docs: "https://bun.com/docs/pm/security-scanner-api",
+		file: bunfig$4,
+		versionNote: { configAvailableSince: "bun 1.3.0" }
+	} },
+	description: "Bun supports a Security Scanner API that intercepts new packages at install time (e.g. Socket Firewall).",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#preinstall-scanners",
+	id: "bun-security-scanner",
+	severity: "info",
+	title: "Enable a bun install-time security scanner"
+});
+//#endregion
+//#region src/domain/rules/checksum-verification.ts
+const { yarnrc: yarnrc$7 } = CONFIG_FILES;
+const checksumVerification = requireConfigKey({
+	bindings: { yarn: {
+		docs: "https://yarnpkg.com/configuration/yarnrc#checksumBehavior",
+		documentedDefault: "throw",
+		file: yarnrc$7,
+		keyPath: ["checksumBehavior"],
+		message: "Set `checksumBehavior: throw` in .yarnrc.yml to reject packages whose checksum does not match the lockfile.",
+		value: "throw"
+	} },
+	description: "Throw on checksum mismatches so tampered or corrupted packages are never silently installed.",
+	docs: "https://yarnpkg.com/configuration/yarnrc#checksumBehavior",
+	id: "checksum-verification",
+	severity: "warn",
+	title: "Verify package checksums"
+});
+//#endregion
+//#region src/domain/entities/signals.ts
+const PM_SIGNALS = {
+	aube: {
+		configs: [CONFIG_FILES.aubeWorkspace.path],
+		lockfiles: ["aube-lock.yaml"],
+		reusesLockfiles: [
+			"pnpm-lock.yaml",
+			"package-lock.json",
+			"npm-shrinkwrap.json",
+			"yarn.lock",
+			"bun.lock"
+		]
+	},
+	bun: {
+		configs: [CONFIG_FILES.bunfig.path],
+		lockfiles: ["bun.lock", "bun.lockb"]
+	},
+	deno: {
+		configs: [CONFIG_FILES.denoJson.path, "deno.jsonc"],
+		lockfiles: ["deno.lock"]
+	},
+	npm: {
+		configs: [],
+		lockfiles: ["package-lock.json", "npm-shrinkwrap.json"]
+	},
+	pnpm: {
+		configs: [CONFIG_FILES.pnpmWorkspace.path],
+		lockfiles: ["pnpm-lock.yaml"]
+	},
+	yarn: {
+		configs: [CONFIG_FILES.yarnrc.path],
+		lockfiles: ["yarn.lock"]
+	}
+};
+//#endregion
+//#region src/domain/rules/commit-lockfile.ts
+const LOCKFILE_DOCS = {
+	aube: "https://github.com/aubepkg/aube/blob/main/docs/package-manager/lockfiles.md",
+	bun: "https://bun.com/docs/install/lockfile",
+	deno: "https://docs.deno.com/runtime/fundamentals/modules/#integrity-checking-and-lock-files",
+	npm: "https://docs.npmjs.com/cli/v12/configuring-npm/package-lock-json",
+	pnpm: "https://pnpm.io/git#lockfiles",
+	yarn: "https://yarnpkg.com/getting-started/qa#should-lockfiles-be-committed-to-the-repository"
+};
+const LOCKFILE_VERSION_NOTES = { deno: { configAvailableSince: "deno 1.28.0" } };
+const lockfileBinding = (pm) => {
+	const { lockfiles, reusesLockfiles } = PM_SIGNALS[pm];
+	const [primary] = lockfiles;
+	const accepted = [...lockfiles, ...reusesLockfiles ?? []].filter((lockfile) => pm !== "npm" || lockfile === primary);
+	return {
+		check(ctx) {
+			if (pm === "aube" && ctx.exists(asRelPath("bun.lockb")) && !ctx.exists(asRelPath("bun.lock"))) return {
+				state: "violation",
+				message: "Aube cannot read bun.lockb, even when another lockfile exists.",
+				remediation: {
+					kind: "manual",
+					steps: ["Run `bun install --save-text-lockfile` to generate bun.lock, then commit it."]
+				}
+			};
+			if (accepted.some((lf) => ctx.exists(asRelPath(lf)))) return { state: "ok" };
+			return {
+				remediation: {
+					kind: "manual",
+					steps: [`Install dependencies to generate ${primary}, then commit it.`]
+				},
+				message: `No lockfile found. Generate and commit ${primary}.`,
+				state: "violation"
+			};
+		},
+		docs: LOCKFILE_DOCS[pm],
+		versionNote: LOCKFILE_VERSION_NOTES[pm]
+	};
+};
+const denoBinding$2 = {
+	file: CONFIG_FILES.denoJson,
+	docs: LOCKFILE_DOCS.deno,
+	versionNote: LOCKFILE_VERSION_NOTES.deno,
+	check(ctx, config) {
+		const lock = getByPath(config, ["lock"]);
+		if (lock != null && typeof lock !== "boolean" && typeof lock !== "string" && !(isPlainRecord(lock) && (lock.path == null || typeof lock.path === "string") && (lock.frozen == null || typeof lock.frozen === "boolean"))) return {
+			state: "violation",
+			message: "Invalid Deno lock setting.",
+			remediation: {
+				kind: "manual",
+				steps: ["Use a boolean, a lockfile path, or an object with optional path and frozen fields."]
+			}
+		};
+		const selected = typeof lock === "string" ? lock : getByPath(config, ["lock", "path"]);
+		const lockPath = selected == null ? asRelPath("deno.lock") : selected;
+		if (lock !== false && isRelPath(lockPath) && ctx.exists(lockPath)) return { state: "ok" };
+		return {
+			state: "violation",
+			message: lock === false ? "Enable the Deno lockfile; `lock: false` disables it even when deno.lock exists." : `No readable project lockfile found at ${String(lockPath)}.`,
+			remediation: {
+				kind: "manual",
+				steps: ["Enable lockfile use in deno.json and generate and commit the configured lockfile within the project."]
+			}
+		};
+	}
+};
+const commitLockfile = defineRule({
+	bindings: {
+		aube: lockfileBinding("aube"),
+		bun: lockfileBinding("bun"),
+		deno: denoBinding$2,
+		npm: lockfileBinding("npm"),
+		pnpm: lockfileBinding("pnpm"),
+		yarn: lockfileBinding("yarn")
+	},
+	description: "Lockfiles pin the full dependency tree and integrity hashes, enabling reproducible, verifiable installs (e.g. `npm ci`).",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-include-lockfiles",
+	id: "commit-lockfile",
+	severity: "error",
+	title: "Commit a lockfile"
+});
+//#endregion
+//#region src/domain/rules/dependency-overrides.ts
+const { aubeWorkspace: aubeWorkspace$6, pnpmWorkspace: pnpmWorkspace$9 } = CONFIG_FILES;
+const isNonEmptyObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
+const checkOverrides = (config, file) => {
+	const value = getByPath(config, ["overrides"]);
+	if (!isNonEmptyObject$2(value)) return { state: "ok" };
+	return {
+		actual: value,
+		message: `Review \`overrides\` in ${file}. Overrides can replace transitive dependencies with arbitrary versions or forks.`,
+		state: "violation",
+		remediation: {
+			kind: "manual",
+			steps: ["Review each entry in `overrides` — verify pinned versions address a known CVE and are not redirecting to untrusted packages."]
+		}
+	};
+};
+const makeBinding = (file, fileName, docs) => ({
+	check(_ctx, config) {
+		return checkOverrides(config, fileName);
+	},
+	docs,
+	file
+});
+const dependencyOverrides = defineRule({
+	bindings: {
+		aube: makeBinding(aubeWorkspace$6, "aube-workspace.yaml", "https://aube.sh/settings/"),
+		pnpm: makeBinding(pnpmWorkspace$9, "pnpm-workspace.yaml", "https://pnpm.io/settings#overrides")
+	},
+	description: "Flag dependency overrides that can replace transitive packages with arbitrary versions or forks — a supply-chain injection vector.",
+	docs: "https://pnpm.io/settings#overrides",
+	id: "dependency-overrides",
+	severity: "info",
+	title: "Review dependency overrides"
+});
+//#endregion
+//#region src/domain/rules/disable-lifecycle-scripts.ts
+const { npmrc: npmrc$5, pnpmWorkspace: pnpmWorkspace$8, yarnrc: yarnrc$6, aubeWorkspace: aubeWorkspace$5, bunfig: bunfig$3 } = CONFIG_FILES;
+const pnpmBinding$4 = {
+	check(_ctx, config) {
+		if (getByPath(config, ["ignoreScripts"]) === true) return { state: "ok" };
+		const bypass = getByPath(config, ["dangerouslyAllowAllBuilds"]);
+		if (bypass === true) return {
+			actual: bypass,
+			expected: false,
+			remediation: {
+				kind: "manual",
+				steps: ["Remove `dangerouslyAllowAllBuilds: true` from pnpm-workspace.yaml (or set it to `false`). Setting `strictDepBuilds: true` alone has no effect while the bypass remains."]
+			},
+			message: "`dangerouslyAllowAllBuilds: true` in pnpm-workspace.yaml bypasses strictDepBuilds — remove it (or set it to false) to restore lifecycle-script gating.",
+			state: "violation"
+		};
+		const strict = getByPath(config, ["strictDepBuilds"]);
+		if (strict === true) return { state: "ok" };
+		return {
+			state: "violation",
+			actual: strict,
+			expected: true,
+			message: strict === void 0 ? "Set `strictDepBuilds: true` in pnpm-workspace.yaml to pin lifecycle-script gating across versions." : "Set `strictDepBuilds: true` in pnpm-workspace.yaml to block silent skips of un-approved dep builds.",
+			remediation: proposeChanges(config, [{
+				file: pnpmWorkspace$8,
+				keyPath: ["strictDepBuilds"],
+				op: "setKey",
+				value: true
+			}])
+		};
+	},
+	docs: "https://pnpm.io/settings#strictdepbuilds",
+	file: pnpmWorkspace$8,
+	versionNote: {
+		configAvailableSince: "pnpm 10.3.0",
+		defaultSafeSince: "pnpm 11.0.0"
+	}
+};
+const aubeBinding$2 = {
+	check(ctx, config) {
+		const npmConfig = ctx.readConfig(npmrc$5);
+		const jail = getByPath(config, ["jailBuilds"]);
+		const strict = getByPath(npmConfig, ["strictDepBuilds"]);
+		if (jail === true && strict === true) return { state: "ok" };
+		const jailRemedy = proposeChanges(config, [{
+			file: aubeWorkspace$5,
+			keyPath: ["jailBuilds"],
+			op: "setKey",
+			value: true
+		}]);
+		const strictRemedy = proposeChanges(npmConfig, [{
+			file: npmrc$5,
+			keyPath: ["strictDepBuilds"],
+			op: "setKey",
+			value: true
+		}]);
+		return {
+			state: "violation",
+			file: jail !== true ? aubeWorkspace$5.path : npmrc$5.path,
+			actual: jail !== true ? jail : strict,
+			expected: true,
+			message: "Set `jailBuilds: true` in aube-workspace.yaml and `strictDepBuilds=true` in .npmrc to sandbox approved builds and reject unreviewed lifecycle scripts.",
+			remediation: jailRemedy.kind === "automatic" && strictRemedy.kind === "automatic" ? {
+				kind: "automatic",
+				operations: [...jailRemedy.operations, ...strictRemedy.operations]
+			} : {
+				kind: "manual",
+				steps: [...jailRemedy.kind === "manual" ? jailRemedy.steps : ["Set `jailBuilds: true` in aube-workspace.yaml."], ...strictRemedy.kind === "manual" ? strictRemedy.steps : ["Set `strictDepBuilds=true` in .npmrc."]]
+			}
+		};
+	},
+	docs: "https://aube.jdx.dev/security.html",
+	file: aubeWorkspace$5
+};
+const bunMessage = "Set `ignoreScripts = true` under [install] in bunfig.toml — or set `\"trustedDependencies\": []` in package.json — to opt out of the curated allow-list (postinstall is already blocked for untrusted packages by default).";
+const bunBinding = {
+	check(ctx, config) {
+		const ignoreScripts = getByPath(config, ["install", "ignoreScripts"]);
+		if (ignoreScripts === true) return { state: "ok" };
+		const trusted = ctx.packageJson?.trustedDependencies;
+		if (typeof trusted !== "undefined" && trusted.length === 0) return { state: "ok" };
+		return {
+			remediation: proposeChanges(config, [{
+				file: bunfig$3,
+				keyPath: ["install", "ignoreScripts"],
+				op: "setKey",
+				value: true
+			}]),
+			actual: ignoreScripts,
+			expected: true,
+			message: bunMessage,
+			state: "violation"
+		};
+	},
+	docs: "https://bun.com/docs/pm/lifecycle",
+	file: bunfig$3,
+	severity: "info",
+	versionNote: { configAvailableSince: "bun 1.2.0" }
+};
+const disableLifecycleScripts = withAubeParanoid(overrideBindings(requireConfigKey({
+	bindings: {
+		npm: {
+			docs: "https://docs.npmjs.com/cli/v11/using-npm/config#ignore-scripts",
+			file: npmrc$5,
+			keyPath: ["ignore-scripts"],
+			message: "Set `ignore-scripts=true` in .npmrc to block dependency lifecycle scripts.",
+			value: true
+		},
+		yarn: {
+			docs: "https://yarnpkg.com/configuration/yarnrc#enableScripts",
+			documentedDefault: false,
+			file: yarnrc$6,
+			keyPath: ["enableScripts"],
+			message: "Set `enableScripts: false` in .yarnrc.yml to pin the policy across versions.",
+			value: false,
+			versionNote: {
+				configAvailableSince: "yarn 2.0.0",
+				defaultSafeSince: "yarn 4.14.0"
+			}
+		}
+	},
+	description: "Malicious postinstall scripts are a primary supply-chain attack vector. Prevent automatic execution of dependency lifecycle scripts.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#3-disable-lifecycle-scripts",
+	id: "disable-lifecycle-scripts",
+	severity: "error",
+	title: "Disable dependency lifecycle scripts"
+}), {
+	aube: aubeBinding$2,
+	bun: bunBinding,
+	pnpm: pnpmBinding$4
+}));
+//#endregion
+//#region src/domain/rules/enforce-strict-ssl.ts
+const { npmrc: npmrc$4, yarnrc: yarnrc$5 } = CONFIG_FILES;
+const yarnMessage = "Set `enableStrictSsl: true` in .yarnrc.yml to enforce SSL certificate validation for registry connections.";
+const yarnBinding = {
+	check(_ctx, config) {
+		const strictSsl = getByPath(config, ["enableStrictSsl"]);
+		const whitelist = getByPath(config, ["unsafeHttpWhitelist"]);
+		if (Array.isArray(whitelist) && whitelist.length > 0) return {
+			actual: whitelist,
+			expected: "",
+			remediation: {
+				kind: "manual",
+				steps: ["Review and remove entries from `unsafeHttpWhitelist` in .yarnrc.yml. Each entry permits unencrypted HTTP to that hostname. Also set `enableStrictSsl: true`."]
+			},
+			message: "`unsafeHttpWhitelist` in .yarnrc.yml allows unencrypted HTTP connections — remove entries or clear the list to enforce HTTPS-only registry access.",
+			state: "violation"
+		};
+		if (strictSsl === true) return { state: "ok" };
+		return {
+			state: "violation",
+			actual: strictSsl,
+			expected: true,
+			message: yarnMessage,
+			...strictSsl === void 0 ? { severity: "info" } : {},
+			remediation: proposeChanges(config, [{
+				file: yarnrc$5,
+				keyPath: ["enableStrictSsl"],
+				op: "setKey",
+				value: true
+			}])
+		};
+	},
+	docs: "https://yarnpkg.com/configuration/yarnrc#enableStrictSsl",
+	file: yarnrc$5
+};
+const enforceStrictSsl = overrideBindings(requireConfigKey({
+	bindings: { npm: {
+		docs: "https://docs.npmjs.com/cli/v11/using-npm/config#strict-ssl",
+		documentedDefault: true,
+		file: npmrc$4,
+		keyPath: ["strict-ssl"],
+		message: "Set `strict-ssl=true` in .npmrc to enforce SSL certificate validation.",
+		value: true
+	} },
+	description: "Require SSL certificate validation so registry traffic cannot be intercepted or tampered with.",
+	docs: "https://docs.npmjs.com/cli/v11/using-npm/config#strict-ssl",
+	id: "enforce-strict-ssl",
+	severity: "warn",
+	title: "Enforce SSL for registry connections"
+}), { yarn: yarnBinding });
+//#endregion
+//#region src/domain/services/project-type.ts
+const isPublishableName = (value) => typeof value === "string" && value.trim().length > 0;
+const resolveProjectType = (selected, inferredPackage) => selected ?? (inferredPackage ? "package" : "application");
+const resolvePackageJsonProjectType = (ctx) => {
+	const pkg = ctx.packageJson;
+	const inferredPackage = pkg?.private !== true && isPublishableName(pkg?.name);
+	return resolveProjectType(ctx.projectType, inferredPackage);
+};
+const resolveDenoProjectType = (ctx, denoConfig) => resolveProjectType(ctx.projectType, isPublishableName(getByPath(denoConfig, ["name"])));
+//#endregion
+//#region src/domain/rules/publishable.ts
+const isPublishable = (ctx) => resolvePackageJsonProjectType(ctx) === "package";
+//#endregion
+//#region src/domain/rules/files-field.ts
+const { packageJson: packageJson$1, denoJson: denoJson$3 } = CONFIG_FILES;
+const packageJsonFilesBinding = {
+	check(ctx) {
+		if (!isPublishable(ctx)) return { state: "na" };
+		const files = ctx.packageJson?.files;
+		if (isStringList(files) && files.length > 0) return { state: "ok" };
+		return {
+			remediation: {
+				kind: "manual",
+				steps: ["Add a `files` array to package.json (e.g. [\"dist\"]) and verify with `npm pack --dry-run`."]
+			},
+			actual: files,
+			message: "Add a `files` allow-list to package.json to limit what gets published.",
+			state: "violation"
+		};
+	},
+	docs: "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#files",
+	file: packageJson$1
+};
+const filesField = defineRule({
+	bindings: {
+		aube: packageJsonFilesBinding,
+		bun: packageJsonFilesBinding,
+		deno: {
+			check(ctx, config) {
+				if (resolveDenoProjectType(ctx, config) !== "package") return { state: "na" };
+				const include = getByPath(config, ["publish", "include"]);
+				if (isStringList(include) && include.length > 0) return { state: "ok" };
+				return {
+					remediation: {
+						kind: "manual",
+						steps: ["Add a non-empty `publish.include` array to deno.json; use `publish.exclude` for additional exclusions."]
+					},
+					actual: include,
+					message: "Add `publish.include` to deno.json to limit what gets published.",
+					state: "violation"
+				};
+			},
+			docs: "https://docs.deno.com/runtime/reference/cli/publish/#how-publishing-works",
+			file: denoJson$3
+		},
+		npm: packageJsonFilesBinding,
+		pnpm: packageJsonFilesBinding,
+		yarn: packageJsonFilesBinding
+	},
+	description: "An explicit `files` array in package.json restricts what gets published, preventing accidental inclusion of secrets or local files.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#11-review-published-files",
+	id: "files-field",
+	projectTypes: ["package"],
+	severity: "info",
+	title: "Declare a published files allow-list"
+});
+//#endregion
+//#region src/domain/rules/frozen-lockfile.ts
+const { pnpmWorkspace: pnpmWorkspace$7, yarnrc: yarnrc$4, bunfig: bunfig$2, denoJson: denoJson$2 } = CONFIG_FILES;
+const aubeFrozenCommand = "Use `aube ci` or `aube install --frozen-lockfile` to fail when the lockfile would change.";
+const frozenLockfile = overrideBindings(requireConfigKey({
+	bindings: {
+		deno: {
+			docs: "https://docs.deno.com/runtime/fundamentals/configuration/#lock",
+			file: denoJson$2,
+			keyPath: ["lock", "frozen"],
+			message: "Set `lock.frozen: true` in deno.json for reproducible, verified installs.",
+			value: true
+		},
+		bun: {
+			docs: "https://bun.com/docs/runtime/bunfig#install-frozenlockfile",
+			file: bunfig$2,
+			keyPath: ["install", "frozenLockfile"],
+			message: "Set `frozenLockfile = true` under [install] in bunfig.toml so installs fail when the lockfile would change.",
+			value: true,
+			versionNote: { configAvailableSince: "bun 0.6.10" }
+		},
+		pnpm: {
+			docs: "https://pnpm.io/settings#frozenlockfile",
+			file: pnpmWorkspace$7,
+			keyPath: ["frozenLockfile"],
+			message: "pnpm defaults frozenLockfile to true in CI — set it explicitly in pnpm-workspace.yaml to pin the policy outside CI too.",
+			value: true
+		},
+		yarn: {
+			docs: "https://yarnpkg.com/configuration/yarnrc#enableImmutableInstalls",
+			documentedDefault: true,
+			file: yarnrc$4,
+			keyPath: ["enableImmutableInstalls"],
+			message: "Set `enableImmutableInstalls: true` in .yarnrc.yml to pin the policy outside CI too.",
+			value: true,
+			versionNote: {
+				configAvailableSince: "yarn 2.0.0",
+				defaultSafeSince: "yarn 3.0.0 in CI"
+			}
+		}
+	},
+	description: "Refuse to mutate the lockfile on install so unexpected dependency changes fail loudly.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-include-lockfiles",
+	id: "frozen-lockfile",
+	severity: "warn",
+	title: "Freeze the lockfile"
+}), { aube: {
+	check() {
+		return {
+			remediation: {
+				kind: "manual",
+				steps: [aubeFrozenCommand]
+			},
+			message: "`preferFrozenLockfile` only reuses an up-to-date lockfile; it does not prevent updates. Verify that install commands enforce a frozen lockfile.",
+			state: "violation"
+		};
+	},
+	docs: "https://github.com/aubepkg/aube/blob/main/docs/cli/ci.md",
+	severity: "info"
+} });
+//#endregion
+//#region src/domain/rules/frozen-store.ts
+const { pnpmWorkspace: pnpmWorkspace$6 } = CONFIG_FILES;
+const frozenStore = defineRule({
+	bindings: { pnpm: {
+		check(_ctx, config) {
+			const value = getByPath(config, ["frozenStore"]);
+			if (value === true) return { state: "ok" };
+			return {
+				remediation: {
+					kind: "manual",
+					steps: ["Populate the store before enabling `frozenStore: true`. Use it for read-only deployments; it is incompatible with --force and a configured pnpr server."]
+				},
+				actual: value,
+				message: "For a pre-populated read-only store, consider `frozenStore` in pnpm-workspace.yaml. Normal installs need a writable store.",
+				state: "violation"
+			};
+		},
+		docs: "https://pnpm.io/settings/store#frozenstore",
+		file: pnpmWorkspace$6,
+		versionNote: { configAvailableSince: "pnpm 11.7.0" }
+	} },
+	description: "Consider read-only store access for deployments whose dependencies are already present.",
+	docs: "https://pnpm.io/settings/store#frozenstore",
+	id: "frozen-store",
+	severity: "info",
+	title: "Consider a pre-populated read-only store"
+});
+//#endregion
+//#region src/domain/rules/hardened-mode.ts
+const { yarnrc: yarnrc$3 } = CONFIG_FILES;
+const hardenedMode = requireConfigKey({
+	bindings: { yarn: {
+		docs: "https://yarnpkg.com/configuration/yarnrc#enableHardenedMode",
+		documentedDefault: true,
+		file: yarnrc$3,
+		keyPath: ["enableHardenedMode"],
+		message: "yarn enables hardened mode automatically only for pull requests on public repositories — set `enableHardenedMode: true` in .yarnrc.yml to extend end-to-end install verification to every install.",
+		value: true,
+		versionNote: {
+			configAvailableSince: "yarn 4.0.0",
+			defaultSafeSince: "yarn 4.0.0 (conditional: auto-enabled for PRs on public repositories)"
+		}
+	} },
+	description: "Yarn 4's enableHardenedMode performs end-to-end checksum, lockfile, and version verification at install time.",
+	docs: "https://yarnpkg.com/configuration/yarnrc#enableHardenedMode",
+	id: "hardened-mode",
+	severity: "warn",
+	title: "Enable hardened mode (yarn)"
+});
+//#endregion
+//#region src/domain/rules/minimum-release-age.ts
+const HOURS_PER_DAY = 24;
+const MINUTES_PER_HOUR = 60;
+const SECONDS_PER_MINUTE = 60;
+const MINUTES_PER_DAY = HOURS_PER_DAY * MINUTES_PER_HOUR;
+const SECONDS_PER_DAY = MINUTES_PER_DAY * SECONDS_PER_MINUTE;
+const RECOMMENDED_RELEASE_AGE_DAYS = 3;
+const RECOMMENDED_RELEASE_AGE_MINUTES = RECOMMENDED_RELEASE_AGE_DAYS * MINUTES_PER_DAY;
+const RECOMMENDED_RELEASE_AGE_SECONDS = RECOMMENDED_RELEASE_AGE_DAYS * SECONDS_PER_DAY;
+const DOCUMENTED_DEFAULT_MINUTES = MINUTES_PER_DAY;
+const { npmrc: npmrc$3, pnpmWorkspace: pnpmWorkspace$5, yarnrc: yarnrc$2, bunfig: bunfig$1, denoJson: denoJson$1, aubeWorkspace: aubeWorkspace$4 } = CONFIG_FILES;
+const DENO_DURATION = /^\+?P(?:\+?\d+[Ww]|(?:\d+[Dd])*(?:T(?:\d+[HhMm]|\d+(?:\.\d+)?[Ss])+)?)$/u;
+const DENO_MIN_TIMESTAMP = Date.parse("-262143-01-01T00:00:00Z");
+const DENO_UNIT_SECONDS = {
+	w: 604800,
+	d: 86400,
+	h: 3600,
+	m: 60,
+	s: 1
+};
+const DENO_DATE = /^\d{4}-\d{2}-\d{2}$/u;
+const DENO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}[Tt ](?:[01]\d|2[0-3]):[0-5]\d:(?:[0-5]\d|60)(?:\.\d+)?(?:[Zz]|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/u;
+const DENO_OFFSET_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T(?:[01]\d|2[0-3]):[0-5]\d(?::(?:[0-5]\d|60))?[+-](?:[01]\d|2[0-3]):?[0-5]\d$/u;
+const isPositiveNumber = (value) => typeof value === "number" && Number.isFinite(value) && value > 0;
+const isPositiveYarnDuration = (value) => isPositiveNumber(value) || typeof value === "string" && /^\d*\.?\d+(?:ms|s|m|h|d|w)?$/u.test(value) && Number.isFinite(Number.parseFloat(value)) && Number.parseFloat(value) > 0;
+const isPositiveDenoSeconds = (seconds) => seconds > 0 && Number.isFinite(seconds) && Date.now() - seconds * 1e3 >= DENO_MIN_TIMESTAMP;
+const isActiveDenoAge = (value) => {
+	if (typeof value === "number") return Number.isSafeInteger(value) && isPositiveDenoSeconds(value * 60);
+	if (typeof value !== "string") return false;
+	if (/^\d+$/u.test(value)) return Number.isSafeInteger(Number(value)) && isPositiveDenoSeconds(Number(value) * 60);
+	if (DENO_DURATION.test(value)) {
+		let seconds = 0;
+		for (const [, integer, fraction, unit] of value.matchAll(/(\d+)(?:\.(\d+))?([WDHMS])/giu)) {
+			const amount = Number(integer) + Number(`0.${(fraction ?? "").slice(0, 9) || "0"}`);
+			seconds += amount * (DENO_UNIT_SECONDS[unit?.toLowerCase() ?? ""] ?? 0);
+		}
+		return isPositiveDenoSeconds(seconds);
+	}
+	if (!DENO_DATE.test(value) && !DENO_TIMESTAMP.test(value) && !DENO_OFFSET_TIMESTAMP.test(value)) return false;
+	const date = value.slice(0, 10);
+	const midnight = /* @__PURE__ */ new Date(`${date}T00:00:00Z`);
+	const leapSecond = /:60(?=\.|Z|z|[+-])/u.test(value);
+	const timestamp = Date.parse(value.replace(/:60(?=\.|Z|z|[+-])/u, ":59")) + (leapSecond ? 1e3 : 0);
+	return !Number.isNaN(midnight.valueOf()) && midnight.toISOString().slice(0, 10) === date && timestamp < Date.now();
+};
+const isNonDisabledDenoDuration = (value) => {
+	if (!isPlainRecord(value)) return isActiveDenoAge(value);
+	if (Object.keys(value).some((key) => key !== "age" && key !== "exclude")) return false;
+	if (value.exclude !== void 0 && !isStringList(value.exclude)) return false;
+	return value.age == null || isActiveDenoAge(value.age);
+};
+const minimumReleaseAge = overrideBindings(requireConfigKey({
+	bindings: {
+		aube: {
+			accept: isPositiveNumber,
+			docs: "https://aube.sh/settings/",
+			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
+			file: aubeWorkspace$4,
+			keyPath: ["minimumReleaseAge"],
+			message: `Set minimumReleaseAge (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in aube-workspace.yaml.`,
+			value: RECOMMENDED_RELEASE_AGE_MINUTES
+		},
+		bun: {
+			accept: isPositiveNumber,
+			docs: "https://bun.com/docs/runtime/bunfig#install-minimumreleaseage",
+			file: bunfig$1,
+			keyPath: ["install", "minimumReleaseAge"],
+			message: `Set install.minimumReleaseAge (bun) to ~${RECOMMENDED_RELEASE_AGE_SECONDS} seconds to quarantine brand-new releases.`,
+			value: RECOMMENDED_RELEASE_AGE_SECONDS,
+			versionNote: { configAvailableSince: "bun 1.3.0" }
+		},
+		pnpm: {
+			accept: isPositiveNumber,
+			docs: "https://pnpm.io/settings#minimumreleaseage",
+			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
+			file: pnpmWorkspace$5,
+			keyPath: ["minimumReleaseAge"],
+			message: `Set minimumReleaseAge (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in pnpm-workspace.yaml.`,
+			value: RECOMMENDED_RELEASE_AGE_MINUTES,
+			versionNote: {
+				configAvailableSince: "pnpm 10.16.0",
+				defaultSafeSince: "pnpm 11.0.0 (1440 minutes)"
+			}
+		},
+		yarn: {
+			accept: isPositiveYarnDuration,
+			docs: "https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate",
+			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
+			file: yarnrc$2,
+			keyPath: ["npmMinimalAgeGate"],
+			message: `Set npmMinimalAgeGate (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in .yarnrc.yml.`,
+			value: RECOMMENDED_RELEASE_AGE_MINUTES,
+			versionNote: {
+				configAvailableSince: "yarn 4.10.0",
+				defaultSafeSince: "yarn 4.15.0 (1440 minutes)"
+			}
+		}
+	},
+	description: "Refuse to install releases newer than a cooldown window so freshly published (possibly compromised) versions are skipped.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#set-minimal-release-age",
+	id: "minimum-release-age",
+	severity: "warn",
+	title: "Set a minimum release age"
+}), {
+	npm: {
+		file: npmrc$3,
+		docs: "https://docs.npmjs.com/cli/v12/using-npm/config#min-release-age",
+		versionNote: { note: "min-release-age available since npm 11.10.0" },
+		check(_ctx, config) {
+			const now = Date.now();
+			if (Object.hasOwn(config, "before")) {
+				const actual = config.before;
+				if ((typeof actual === "string" || typeof actual === "number") && Date.parse(String(actual)) < now) return { state: "ok" };
+				return {
+					state: "violation",
+					actual,
+					expected: "a date in the past",
+					message: "Use a valid past before cutoff, or remove before and set min-release-age.",
+					remediation: {
+						kind: "manual",
+						steps: [`In .npmrc, set before to a valid past date, or remove before and set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days. A future or disabled before overrides min-release-age in this file.`]
+					}
+				};
+			}
+			const actual = getByPath(config, ["min-release-age"]);
+			const age = typeof actual === "number" || typeof actual === "string" ? Number(actual) : NaN;
+			const cutoff = (/* @__PURE__ */ new Date(now - SECONDS_PER_DAY * 1e3 * age)).valueOf();
+			if (age > 0 && Number.isFinite(cutoff) && cutoff < now) return { state: "ok" };
+			return {
+				state: "violation",
+				actual,
+				expected: RECOMMENDED_RELEASE_AGE_DAYS,
+				message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days to quarantine brand-new releases.`,
+				remediation: proposeChanges(config, [{
+					file: npmrc$3,
+					op: "setKey",
+					keyPath: ["min-release-age"],
+					value: RECOMMENDED_RELEASE_AGE_DAYS
+				}])
+			};
+		}
+	},
+	deno: {
+		file: denoJson$1,
+		docs: "https://docs.deno.com/runtime/reference/deno_json/",
+		versionNote: {
+			defaultSafeSince: "deno 2.9.0 (1440 minutes)",
+			note: "object age may be omitted"
+		},
+		check(_ctx, config) {
+			const actual = getByPath(config, ["minimumDependencyAge"]);
+			if (isNonDisabledDenoDuration(actual)) return { state: "ok" };
+			const objectAge = isPlainRecord(actual);
+			const invalidObject = objectAge && (Object.keys(actual).some((key) => key !== "age" && key !== "exclude") || actual.exclude !== void 0 && !isStringList(actual.exclude));
+			return {
+				state: "violation",
+				actual,
+				expected: "P3D",
+				message: `Set minimumDependencyAge (e.g. "P3D" for a ${RECOMMENDED_RELEASE_AGE_DAYS}-day cooldown) in deno.json.`,
+				remediation: invalidObject ? {
+					kind: "manual",
+					steps: ["Use only age and exclude in minimumDependencyAge. Make exclude a list of package names and set age to a positive supported duration."]
+				} : proposeChanges(config, [{
+					file: denoJson$1,
+					op: "setKey",
+					keyPath: objectAge ? ["minimumDependencyAge", "age"] : ["minimumDependencyAge"],
+					value: "P3D"
+				}])
+			};
+		}
+	}
+});
+//#endregion
+//#region src/domain/rules/named-registries.ts
+const { pnpmWorkspace: pnpmWorkspace$4 } = CONFIG_FILES;
+const isNonEmptyObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
+const namedRegistries = defineRule({
+	bindings: { pnpm: {
+		check(_ctx, config) {
+			const value = getByPath(config, ["namedRegistries"]);
+			if (!isNonEmptyObject$1(value)) return { state: "ok" };
+			return {
+				remediation: {
+					kind: "manual",
+					steps: ["Verify each named registry points to a trusted source and that scoped packages cannot be hijacked via a public registry of the same name."]
+				},
+				actual: value,
+				message: "Review `namedRegistries` in pnpm-workspace.yaml. Custom registry mappings can redirect package resolution away from the public registry, enabling dependency confusion attacks.",
+				state: "violation"
+			};
+		},
+		docs: "https://pnpm.io/settings#namedregistries",
+		file: pnpmWorkspace$4
+	} },
+	description: "Flag named registry mappings that redirect package resolution to custom registries, which may enable dependency confusion attacks.",
+	docs: "https://pnpm.io/settings#namedregistries",
+	id: "named-registries",
+	severity: "info",
+	title: "Review named registry mappings"
+});
+//#endregion
+//#region src/domain/rules/paranoid-mode.ts
+const { aubeWorkspace: aubeWorkspace$3 } = CONFIG_FILES;
+const paranoidMode = requireConfigKey({
+	bindings: { aube: {
+		docs: "https://aube.jdx.dev/security.html",
+		file: aubeWorkspace$3,
+		keyPath: ["paranoid"],
+		message: "Set `paranoid: true` in aube-workspace.yaml to enable the strict-security bundle (trustPolicy, jailBuilds, minimumReleaseAgeStrict, strictStoreIntegrity, strictDepBuilds, advisoryCheck).",
+		value: true
+	} },
+	description: "Activate the strict-security setting bundle that forces trustPolicy, jailBuilds, minimumReleaseAgeStrict, strictStoreIntegrity, strictDepBuilds, and advisoryCheck on in one switch.",
+	docs: "https://aube.jdx.dev/security.html",
+	id: "paranoid-mode",
+	severity: "info",
+	title: "Enable paranoid security mode"
+});
+//#endregion
+//#region src/domain/rules/patched-dependencies.ts
+const { pnpmWorkspace: pnpmWorkspace$3 } = CONFIG_FILES;
+const isNonEmptyObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
+const patchedDependencies = defineRule({
+	bindings: { pnpm: {
+		check(_ctx, config) {
+			const value = getByPath(config, ["patchedDependencies"]);
+			if (!isNonEmptyObject(value)) return { state: "ok" };
+			return {
+				remediation: {
+					kind: "manual",
+					steps: ["Review each entry in `patchedDependencies` — verify patches address a known issue and have not been tampered with."]
+				},
+				actual: value,
+				message: "Review `patchedDependencies` in pnpm-workspace.yaml. Local patches modify dependency code after the registry artifact is verified; review the patch files separately.",
+				state: "violation"
+			};
+		},
+		docs: "https://pnpm.io/settings#patcheddependencies",
+		file: pnpmWorkspace$3
+	} },
+	description: "Review local patches separately from the registry artifacts they modify.",
+	docs: "https://pnpm.io/settings#patcheddependencies",
+	id: "patched-dependencies",
+	severity: "info",
+	title: "Review patched dependencies"
+});
+//#endregion
+//#region src/domain/rules/pin-exact-versions.ts
+const { npmrc: npmrc$2, pnpmWorkspace: pnpmWorkspace$2, yarnrc: yarnrc$1, bunfig, denoJson } = CONFIG_FILES;
+const REGISTRY_VERSION = /^(?:npm|jsr):(?:@[^/@]+\/)?[^/@]+@(?<version>[^/]*)/u;
+const isUnpinnedRegistryImport = (specifier) => {
+	if (!specifier.startsWith("npm:") && !specifier.startsWith("jsr:")) return false;
+	const version = REGISTRY_VERSION.exec(specifier)?.groups?.version;
+	return version === void 0 || valid(version.replace(/^=/u, "")) === null;
+};
+const collectUnpinnedImports = (imports) => {
+	const offenders = [];
+	for (const [name, value] of Object.entries(imports)) if (typeof value === "string" && isUnpinnedRegistryImport(value)) offenders.push(`${name}=${value}`);
+	return offenders;
+};
+const MAX_SAMPLE_COUNT = 3;
+const formatOffenders = (offenders) => {
+	const sample = offenders.slice(0, MAX_SAMPLE_COUNT).join(", ");
+	let more = "";
+	if (offenders.length > MAX_SAMPLE_COUNT) more = ` (and ${offenders.length - MAX_SAMPLE_COUNT} more)`;
+	return {
+		remediation: {
+			kind: "manual",
+			steps: ["Run `deno add --save-exact <pkg>` for each unpinned registry import in deno.json, or rewrite the `imports` entries to use exact versions."]
+		},
+		message: `${offenders.length} deno imports are not pinned: ${sample}${more}. Use \`deno add --save-exact\` or pin manually.`,
+		state: "violation"
+	};
+};
+const OK = { state: "ok" };
+const extractImportsRecord = (config) => {
+	const imports = getByPath(config, ["imports"]);
+	if (!isPlainRecord(imports)) return;
+	return imports;
+};
+const denoBinding = {
+	check(_ctx, config) {
+		const imports = extractImportsRecord(config);
+		if (!imports) return OK;
+		const offenders = collectUnpinnedImports(imports);
+		if (offenders.length === 0) return OK;
+		return formatOffenders(offenders);
+	},
+	docs: "https://docs.deno.com/runtime/reference/cli/add/",
+	file: denoJson,
+	versionNote: { configAvailableSince: "deno 1.30.0" }
+};
+const npmBinding = {
+	file: npmrc$2,
+	docs: "https://docs.npmjs.com/cli/v12/using-npm/config#save-exact",
+	check(_ctx, config) {
+		const exact = getByPath(config, ["save-exact"]);
+		const prefix = getByPath(config, ["save-prefix"]);
+		if (exact === true || prefix === "" || prefix === "=") return OK;
+		return {
+			remediation: proposeChanges(config, [{
+				op: "setKey",
+				file: npmrc$2,
+				keyPath: ["save-exact"],
+				value: true
+			}]),
+			state: "violation",
+			actual: exact,
+			expected: true,
+			message: "Set `save-exact=true` in .npmrc to save exact versions by default."
+		};
+	}
+};
+const aubeBinding = {
+	file: npmrc$2,
+	docs: "https://aube.jdx.dev/settings/#saveprefix",
+	check(_ctx, config) {
+		const prefixes = ["save-prefix", "savePrefix"].filter((key) => Object.hasOwn(config, key)).map((key) => config[key]);
+		if (prefixes.length > 0 && prefixes.every((value) => value === "")) return OK;
+		return {
+			remediation: {
+				kind: "manual",
+				steps: ["Use one `save-prefix=` entry in .npmrc. Aube resolves aliases by line order; reconcile conflicting entries before changing them."]
+			},
+			state: "violation",
+			message: "Set `save-prefix=` in .npmrc; remove any conflicting `savePrefix` alias."
+		};
+	}
+};
+const pinExactVersions = overrideBindings(requireConfigKey({
+	bindings: {
+		bun: {
+			docs: "https://bun.com/docs/runtime/bunfig#install-exact",
+			file: bunfig,
+			keyPath: ["install", "exact"],
+			message: "Set `exact = true` under [install] in bunfig.toml to pin exact versions.",
+			value: true,
+			versionNote: { note: "install.exact verified in bun 1.2.0" }
+		},
+		pnpm: {
+			accept: (value) => value === "" || value === "=",
+			docs: "https://pnpm.io/settings/other#saveprefix",
+			file: pnpmWorkspace$2,
+			keyPath: ["savePrefix"],
+			message: "Set `savePrefix: ''` in pnpm-workspace.yaml to pin exact versions.",
+			value: ""
+		},
+		yarn: {
+			docs: "https://yarnpkg.com/configuration/yarnrc#defaultSemverRangePrefix",
+			file: yarnrc$1,
+			keyPath: ["defaultSemverRangePrefix"],
+			message: "Set `defaultSemverRangePrefix: ''` in .yarnrc.yml to pin exact versions.",
+			value: "",
+			versionNote: { configAvailableSince: "yarn 2.0.0" }
+		}
+	},
+	description: "Semver ranges (^, ~) auto-adopt new releases, including compromised ones. Save exact versions by default.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#1-pin-dependency-versions",
+	id: "pin-exact-versions",
+	severity: "error",
+	title: "Pin exact dependency versions"
+}), {
+	aube: aubeBinding,
+	deno: denoBinding,
+	npm: npmBinding
+});
+//#endregion
+//#region src/domain/rules/provenance.ts
+const { npmrc: npmrc$1, yarnrc } = CONFIG_FILES;
+const npmrcProvenance = {
+	file: npmrc$1,
+	keyPath: ["provenance"],
+	message: "Set `provenance=true` (and publish from CI) to attest releases.",
+	value: true
+};
+const provenance = requireConfigKey({
+	applies: isPublishable,
+	bindings: {
+		bun: {
+			...npmrcProvenance,
+			docs: "https://github.com/oven-sh/bun/issues/15601",
+			message: "Set `provenance=true` in .npmrc and publish via `bunx npm publish` from CI — `bun publish` does not emit provenance attestations natively (tracking: oven-sh/bun#15601)."
+		},
+		npm: {
+			...npmrcProvenance,
+			docs: "https://docs.npmjs.com/cli/v11/using-npm/config#provenance",
+			versionNote: { configAvailableSince: "npm 9.5.0" }
+		},
+		pnpm: {
+			...npmrcProvenance,
+			docs: "https://pnpm.io/cli/publish"
+		},
+		yarn: {
+			docs: "https://yarnpkg.com/configuration/yarnrc#npmPublishProvenance",
+			file: yarnrc,
+			keyPath: ["npmPublishProvenance"],
+			message: "Set `npmPublishProvenance: true` (and publish from CI) to attest releases.",
+			value: true
+		}
+	},
+	description: "Provenance statements (via Sigstore) bind a published artifact to its recorded source and build.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#10-generate-provenance-statements",
+	id: "provenance",
+	projectTypes: ["package"],
+	severity: "warn",
+	title: "Publish with provenance"
+});
+//#endregion
+//#region src/domain/rules/publish-access.ts
+const { packageJson } = CONFIG_FILES;
+const publishAccessBinding = {
+	check(ctx) {
+		if (!isPublishable(ctx)) return { state: "na" };
+		const access = ctx.packageJson?.publishConfig?.access;
+		if (access === "public" || access === "restricted") return { state: "ok" };
+		return {
+			remediation: {
+				kind: "manual",
+				steps: ["Add `\"publishConfig\": { \"access\": \"public\" }` (or `\"restricted\"`) to package.json so publishes never default unexpectedly."]
+			},
+			actual: access,
+			message: "Set `publishConfig.access` in package.json to `public` or `restricted` to declare publish scope explicitly.",
+			state: "violation"
+		};
+	},
+	docs: "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#publishconfig",
+	file: packageJson
+};
+const publishAccess = defineRule({
+	bindings: {
+		aube: publishAccessBinding,
+		bun: publishAccessBinding,
+		npm: {
+			...publishAccessBinding,
+			docs: "https://docs.npmjs.com/cli/v12/using-npm/config#access",
+			check(ctx, config) {
+				if (isPublishable(ctx) && ctx.packageJson?.publishConfig?.access === "private") return { state: "ok" };
+				return publishAccessBinding.check(ctx, config);
+			}
+		},
+		pnpm: publishAccessBinding,
+		yarn: publishAccessBinding
+	},
+	description: "Set `publishConfig.access` so a misconfigured scope or registry never accidentally publishes an internal package publicly.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#for-maintainers",
+	id: "publish-access",
+	projectTypes: ["package"],
+	severity: "info",
+	title: "Declare publish access explicitly"
+});
+//#endregion
+//#region src/domain/rules/store-server.ts
+const { pnpmWorkspace: pnpmWorkspace$1 } = CONFIG_FILES;
+const storeServer = defineRule({
+	bindings: { pnpm: {
+		check(_ctx, config) {
+			const value = getByPath(config, ["useRunningStoreServer"]);
+			if (value !== true) return { state: "ok" };
+			return {
+				remediation: {
+					kind: "manual",
+					steps: ["Verify the store server is running in a trusted environment and that its communication channel is not exposed to untrusted networks."]
+				},
+				actual: value,
+				message: "Review `useRunningStoreServer` in pnpm-workspace.yaml. Delegating store operations to an external process introduces a trust boundary — the server process can serve tampered packages.",
+				state: "violation"
+			};
+		},
+		docs: "https://pnpm.io/settings#userunningStoreserver",
+		file: pnpmWorkspace$1
+	} },
+	description: "Flag use of an external store server process, which introduces a trust boundary where tampered packages could be served.",
+	docs: "https://pnpm.io/settings#userunningStoreserver",
+	id: "store-server",
+	severity: "info",
+	title: "Review store server usage"
+});
+//#endregion
+//#region src/domain/rules/strict-allow-scripts.ts
+const { npmrc } = CONFIG_FILES;
+const strictAllowScripts = defineRule({
+	bindings: { npm: {
+		check(_ctx, config) {
+			if (getByPath(config, ["ignore-scripts"]) === true) return { state: "ok" };
+			const bypass = getByPath(config, ["dangerously-allow-all-scripts"]);
+			if (bypass === true) return {
+				actual: bypass,
+				expected: false,
+				remediation: {
+					kind: "manual",
+					steps: ["Remove `dangerously-allow-all-scripts=true` from .npmrc (or set it to false), then set `strict-allow-scripts=true`. The bypass overrides strict script approval."]
+				},
+				message: "`dangerously-allow-all-scripts=true` bypasses script approval even when `strict-allow-scripts=true`.",
+				state: "violation"
+			};
+			const strict = getByPath(config, ["strict-allow-scripts"]);
+			if (strict === true) return { state: "ok" };
+			return {
+				remediation: proposeChanges(config, [{
+					file: npmrc,
+					keyPath: ["strict-allow-scripts"],
+					op: "setKey",
+					value: true
+				}]),
+				actual: strict,
+				expected: true,
+				message: "Set `strict-allow-scripts=true` in .npmrc to fail installation for unreviewed install scripts.",
+				state: "violation"
+			};
+		},
+		docs: "https://docs.npmjs.com/cli/v12/using-npm/config#strict-allow-scripts",
+		file: npmrc
+	} },
+	description: "Turn install-script policy warnings into hard errors so unapproved lifecycle scripts block installation.",
+	docs: "https://docs.npmjs.com/cli/v12/using-npm/config#strict-allow-scripts",
+	id: "strict-allow-scripts",
+	severity: "warn",
+	title: "Require explicit script allow-listing"
+});
+//#endregion
+//#region src/domain/rules/strict-release-age.ts
+const { aubeWorkspace: aubeWorkspace$2 } = CONFIG_FILES;
+const strictReleaseAge = withAubeParanoid(requireConfigKey({
+	bindings: { aube: {
+		docs: "https://aube.jdx.dev/settings/",
+		file: aubeWorkspace$2,
+		keyPath: ["minimumReleaseAgeStrict"],
+		message: "Set `minimumReleaseAgeStrict: true` in aube-workspace.yaml to make the release age gate a hard block.",
+		value: true
+	} },
+	description: "Fail when no satisfying version meets the release age, instead of falling back to the lowest satisfying version.",
+	docs: "https://aube.jdx.dev/security.html",
+	id: "strict-release-age",
+	severity: "info",
+	title: "Enforce strict release age gate"
+}));
+//#endregion
+//#region src/domain/rules/strict-store-integrity.ts
+const { aubeWorkspace: aubeWorkspace$1 } = CONFIG_FILES;
+const strictStoreIntegrity = defineRule({
+	bindings: { aube: {
+		check(_ctx, config) {
+			if (getByPath(config, ["verifyStoreIntegrity"]) === false) return {
+				actual: false,
+				expected: true,
+				remediation: {
+					kind: "manual",
+					steps: ["Set `verifyStoreIntegrity: true` (or remove `verifyStoreIntegrity: false`) in aube-workspace.yaml, and enable `strictStoreIntegrity: true` or `paranoid: true`."]
+				},
+				message: "`verifyStoreIntegrity: false` bypasses strict integrity checks, including when `paranoid: true`.",
+				state: "violation"
+			};
+			const strict = getByPath(config, ["strictStoreIntegrity"]);
+			if (strict === true || getByPath(config, ["paranoid"]) === true) return { state: "ok" };
+			return {
+				remediation: proposeChanges(config, [{
+					file: aubeWorkspace$1,
+					keyPath: ["strictStoreIntegrity"],
+					op: "setKey",
+					value: true
+				}]),
+				actual: strict,
+				expected: true,
+				message: "Set `strictStoreIntegrity: true` in aube-workspace.yaml to refuse tarballs that lack integrity metadata.",
+				state: "violation"
+			};
+		},
+		docs: "https://aube.jdx.dev/settings/",
+		file: aubeWorkspace$1
+	} },
+	description: "Refuse to import tarballs from the registry when the packument lacks a dist.integrity field, preventing silent integrity bypass.",
+	docs: "https://aube.jdx.dev/security.html",
+	id: "strict-store-integrity",
+	severity: "warn",
+	title: "Require tarball integrity metadata"
+});
+//#endregion
+//#region src/domain/rules/trust-policy.ts
+const { aubeWorkspace, pnpmWorkspace } = CONFIG_FILES;
+//#endregion
+//#region src/domain/builtin-rules.ts
+const rules = [
+	advisoryCheck,
+	approvedGitRepos,
+	auditSuppression,
+	blockAutoInstall,
+	blockExoticSubdeps,
+	bunSecurityScanner,
+	checksumVerification,
+	commitLockfile,
+	dependencyOverrides,
+	disableLifecycleScripts,
+	enforceStrictSsl,
+	filesField,
+	frozenLockfile,
+	frozenStore,
+	hardenedMode,
+	minimumReleaseAge,
+	namedRegistries,
+	paranoidMode,
+	patchedDependencies,
+	pinExactVersions,
+	provenance,
+	publishAccess,
+	storeServer,
+	strictAllowScripts,
+	strictReleaseAge,
+	strictStoreIntegrity,
+	withAubeParanoid(requireConfigKey({
+		bindings: {
+			aube: {
+				docs: "https://aube.jdx.dev/security.html",
+				documentedDefault: "no-downgrade",
+				file: aubeWorkspace,
+				keyPath: ["trustPolicy"],
+				message: "Set `trustPolicy: no-downgrade` in aube-workspace.yaml to block packages whose trust level has decreased.",
+				value: "no-downgrade"
+			},
+			pnpm: {
+				docs: "https://pnpm.io/settings#trustpolicy",
+				file: pnpmWorkspace,
+				keyPath: ["trustPolicy"],
+				message: "Set `trustPolicy: no-downgrade` in pnpm-workspace.yaml to block packages whose trust level has decreased.",
+				value: "no-downgrade",
+				versionNote: { configAvailableSince: "pnpm 10.21.0" }
+			}
+		},
+		description: "Fail installation when a package trust level has decreased compared to previous releases, catching publisher credential downgrades.",
+		docs: "https://pnpm.io/settings#trustpolicy",
+		id: "trust-policy",
+		severity: "warn",
+		title: "Enforce trust policy on dependency updates"
+	}))
+];
+//#endregion
+//#region src/domain/services/apply-config.ts
+/** Select active rules and keep user severity choices as explicit runtime data. */
+const applyConfig = (base, config) => {
+	const merged = [...base, ...config?.customRules ?? []];
+	const known = /* @__PURE__ */ new Set();
+	const duplicates = /* @__PURE__ */ new Set();
+	for (const rule of merged) {
+		if (known.has(rule.id)) duplicates.add(rule.id);
+		known.add(rule.id);
+	}
+	if (duplicates.size > 0) throw new ConfigError(`Duplicate rule ids: ${[...duplicates].map((id) => `'${id}'`).join(", ")}`);
+	const unknown = Object.keys(config?.rules ?? {}).filter((id) => !known.has(id));
+	if (unknown.length > 0) throw new ConfigError(`Unknown rule ids: ${unknown.map((id) => `'${id}'`).join(", ")}`);
+	const activeRules = [];
+	const severityOverrides = /* @__PURE__ */ new Map();
+	const overrides = config?.rules;
+	for (const rule of merged) {
+		const override = overrides && Object.hasOwn(overrides, rule.id) ? overrides[rule.id] : void 0;
+		if (override === "off") continue;
+		activeRules.push(rule);
+		if (override !== void 0) severityOverrides.set(rule.id, override);
+	}
+	return {
+		rules: activeRules,
+		severityOverrides
+	};
+};
+//#endregion
+//#region src/domain/services/detect-pms.ts
+const registerSignals = (signals, pm, owner) => {
+	for (const file of signals) {
+		const prior = owner.get(file);
+		if (typeof prior !== "undefined") throw new TypeError(`detection signal '${file}' is claimed by both '${prior}' and '${pm}'`);
+		owner.set(file, pm);
+	}
+};
+const buildDetectionSignals = () => {
+	const out = /* @__PURE__ */ new Map();
+	const owner = /* @__PURE__ */ new Map();
+	for (const pm of PMS) {
+		const { lockfiles, configs } = PM_SIGNALS[pm];
+		const signals = [...lockfiles, ...configs];
+		registerSignals(signals, pm, owner);
+		out.set(pm, signals);
+	}
+	return out;
+};
+const DETECTION_SIGNALS = buildDetectionSignals();
+const detectPMs = (ctx) => {
+	const found = /* @__PURE__ */ new Set();
+	const declared = ctx.packageJson?.packageManager;
+	const declaredPM = declared === void 0 ? void 0 : parsePackageManagerField(declared);
+	if (declaredPM !== void 0) found.add(declaredPM);
+	for (const pm of PMS) {
+		const signals = DETECTION_SIGNALS.get(pm);
+		if (signals && signals.some((file) => ctx.exists(asRelPath(file)))) found.add(pm);
+	}
+	return PMS.filter((pm) => found.has(pm));
+};
+//#endregion
+//#region src/domain/services/resolve-pms.ts
+/** Apply the explicit selection or detection, then the configured allow-list. */
+const resolvePMs = (ctx, opts) => {
+	const { pmOverride, allowed } = opts;
+	const detected = pmOverride ? [pmOverride] : detectPMs(ctx);
+	const pms = allowed ? detected.filter((pm) => allowed.includes(pm)) : detected;
+	if (pms.length > 0) return pms;
+	if (!allowed) throw new UsageError(`No package manager detected. Pass --pm <${PMS.join("|")}> to be explicit.`);
+	if (pmOverride) throw new UsageError(`--pm ${pmOverride} is not in siro.config.ts pms (${allowed.join(", ")}). Adjust the config or the flag.`);
+	if (detected.length > 0) throw new UsageError(`Detected PMs (${detected.join(", ")}) do not match siro.config.ts pms (${allowed.join(", ")}). Adjust the config or remove the restriction.`);
+	throw new UsageError(`No package manager detected, and siro.config.ts restricts pms to ${allowed.join(", ")}. Adjust the config or remove the restriction.`);
+};
+//#endregion
+//#region src/domain/services/decide-severity.ts
+/** Resolve the most specific severity signal for one finding. */
+const decideSeverity = (status, binding, rule, userOverride) => userOverride ?? status.severity ?? binding.severity ?? rule.severity;
+//#endregion
+//#region src/domain/services/parse-config-file.ts
+const EMPTY_FILE = Object.freeze({});
+/** Create a fresh parser and cache for one lint command. */
+const createConfigParser = (codecFor, ctx) => {
+	const cache = /* @__PURE__ */ new Map();
+	return (file) => {
+		if (file === void 0) return EMPTY_FILE;
+		const cacheKey = `${file.kind}:${file.path}`;
+		const cached = cache.get(cacheKey);
+		if (cached !== void 0) return cached;
+		const text = ctx.readText(file.path);
+		if (text === void 0) {
+			cache.set(cacheKey, EMPTY_FILE);
+			return EMPTY_FILE;
+		}
+		const parsed = wrapCodecError(file.path, () => codecFor(file.kind).parse(text));
+		cache.set(cacheKey, parsed);
+		return parsed;
+	};
+};
+//#endregion
+//#region src/domain/services/render-version-note.ts
+const buildVersionNoteParts = (versionNote) => {
+	const parts = [];
+	if (typeof versionNote.configAvailableSince !== "undefined") parts.push(`available since ${versionNote.configAvailableSince}`);
+	if (typeof versionNote.defaultSafeSince !== "undefined") parts.push(`default safe since ${versionNote.defaultSafeSince}`);
+	if (typeof versionNote.note !== "undefined") parts.push(versionNote.note);
+	return parts;
+};
+const renderVersionNoteMessage = (message, versionNote) => {
+	if (typeof versionNote === "undefined") return message;
+	const parts = buildVersionNoteParts(versionNote);
+	if (parts.length === 0) return message;
+	return `${message} (${parts.join("; ")})`;
+};
+//#endregion
+//#region src/application/run-lint.ts
+const resolveBindingProjectType = (ctx, pm, parseConfig) => {
+	if (ctx.projectType !== void 0) return ctx.projectType;
+	if (pm === "deno") return resolveDenoProjectType(ctx, parseConfig(CONFIG_FILES.denoJson));
+	return resolvePackageJsonProjectType(ctx);
+};
+/** Evaluate every applicable rule binding and collect violations. */
+const runLint = (opts) => {
+	const { ctx, pms, ruleSet, severityOverrides, codecFor } = opts;
+	const findings = [];
+	const summary = {
+		error: 0,
+		info: 0,
+		warn: 0
+	};
+	const parseConfig = createConfigParser(codecFor, ctx);
+	const ruleContext = {
+		...ctx,
+		readConfig: parseConfig
+	};
+	for (const rule of ruleSet) for (const pm of pms) {
+		const binding = rule.bindings[pm];
+		if (!binding || rule.projectTypes && !rule.projectTypes.includes(resolveBindingProjectType(ctx, pm, parseConfig))) continue;
+		const status = binding.check(ruleContext, parseConfig(binding.file));
+		if (!isCheckStatusShape(status)) throw new ConfigError(`Rule '${rule.id}' returned an invalid check result.`);
+		if (status.state !== "violation") continue;
+		const finding = {
+			ruleId: rule.id,
+			pm,
+			severity: decideSeverity(status, binding, rule, severityOverrides?.get(rule.id)),
+			message: renderVersionNoteMessage(status.message, binding.versionNote),
+			file: status.file ?? binding.file?.path,
+			docs: binding.docs ?? rule.docs,
+			actual: status.actual,
+			expected: status.expected,
+			remediation: status.remediation
+		};
+		findings.push(finding);
+		summary[finding.severity] += 1;
+	}
+	return {
+		findings,
+		summary
+	};
+};
+//#endregion
+//#region src/application/lint.ts
+/** Evaluate a repository without reporting or executing configuration files. */
+const prepareLint = (options) => {
+	if (!options || !isAbsPath(options.cwd)) throw new UsageError("cwd must be an absolute filesystem path.");
+	if ("customRules" in options || "reporters" in options) throw new UsageError("Pass customRules and reporters inside the config option.");
+	if (options.pm !== void 0 && !isPM(options.pm)) throw new UsageError(`Unknown package manager: ${String(options.pm)}`);
+	if (options.projectType !== void 0 && !isProjectType(options.projectType)) throw new UsageError(`Unknown project type: ${String(options.projectType)}`);
+	const config = options.config === void 0 ? void 0 : parseConfig(options.config);
+	const ctx = createRepoContext(options.cwd, options.fs, options.projectType ?? config?.projectType);
+	const pms = resolvePMs(ctx, {
+		allowed: config?.pms,
+		pmOverride: options.pm
+	});
+	if (pms.includes("deno") && !ctx.exists(asRelPath("deno.json")) && ctx.exists(asRelPath("deno.jsonc"))) throw new ConfigError("deno.jsonc is not supported. siro currently reads strict JSON from deno.json only.");
+	const configured = applyConfig(rules, config);
+	return {
+		ctx,
+		pms,
+		ruleSet: configured.rules,
+		severityOverrides: configured.severityOverrides,
+		codecFor,
+		reporters: config?.reporters ?? []
+	};
+};
+const lint = (options) => runLint(prepareLint(options));
+//#endregion
+//#region src/application/commands/lint.ts
+/** Evaluate and report. Executable config loading belongs to the CLI adapter. */
+const lintCommand = async (options, io) => {
+	if (!options) throw new UsageError("Lint options are required.");
+	if (options.severity !== void 0 && !isSeverity(options.severity)) throw new UsageError(`Invalid severity: ${String(options.severity)}`);
+	const prepared = prepareLint(options);
+	const registry = createRegistry(prepared.reporters);
+	const selection = options.reporter ?? DEFAULT_REPORTER_NAME;
+	const reporter = typeof selection === "string" ? registry.get(selection) : selection;
+	if (!isReporterShape(reporter)) throw new UsageError(`${typeof selection === "string" ? "Unknown" : "Invalid"} reporter: ${String(selection)} (available: ${[...registry.keys()].join(", ")})`);
+	const result = runLint(prepared);
+	const exitCode = exitCodeForLint(result, options.severity ?? "error");
+	reporter.format(filterBySeverity(result, options.severity ?? "info"), io);
+	return exitCode;
+};
+//#endregion
+//#region src/adapters/node-io.ts
+const nodeIO = {
+	stderr: (line) => process.stderr.write(`${line}\n`),
+	stdout: (line) => process.stdout.write(`${line}\n`)
+};
+//#endregion
+export { ConfigError as A, SUPPORTED_NODE_RANGE as C, isNodeError as D, nodeFileSystem as E, UsageError as M, asAbsPath as O, isSeverity as S, assertDirectory as T, PROJECT_TYPES as _, overrideBindings as a, SEVERITIES as b, DEFAULT_REPORTER_NAME as c, jsonReporter as d, version as f, getByPath as g, defineRule as h, CONFIG_FILES as i, SiroError as j, asRelPath as k, JSON_REPORTER_NAME as l, loadConfig as m, lintCommand as n, requireConfigKey as o, githubReporter as p, lint as r, BUILTIN_REPORTER_NAMES as s, nodeIO as t, prettyReporter as u, isProjectType as v, isSupportedNodeVersion as w, isPM as x, PMS as y };
+
+//# sourceMappingURL=node-io-DIRcPNSN.mjs.map