@pho9ubenaa/siro 0.4.2 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,61 @@
 # Changelog
 
+## [0.5.0]
+
+### Features
+
+- Allow custom checks to return a nonempty `violations` group. Report unsupported settings separately per file and Aube lifecycle controls separately per missing file. JSON schema 2 is unchanged; exhaustive `CheckStatus` consumers must handle the new variant.
+- Add optional `FileSystem.resolveDirectory` for Deno's native positive literal-prefix lookup, retaining minimatch and existing dependencies. Virtual filesystems without this port resolve exact child names. Negative patterns retain lexical applicability; conflicting overlapping bases fail explicitly.
+
+- Add `unsupported-settings` to report configured settings introduced after a declared or explicit stable PM version. Cover 16 setting/file pairs across npm, pnpm, Yarn, Bun, and Deno, with a generated table of release sources.
+- Resolve each manager's target from `package.json#packageManager`, `config.pmVersions`, or the higher-priority `--pm-version` / API `pmVersion` option (which requires `--pm` / `pm`). Expose the resolved target as `RuleContext.pmVersion` for custom rules.
+- Preserve name detection when a declaration has no exact stable version. Reject ranges, tags, partial versions, and prereleases in explicit targets; accept build metadata such as Corepack hashes.
+- Add opt-in `--workspaces` / API `workspaces: true` to inspect declared npm, pnpm, Yarn, Bun, Deno, and Aube members' publication metadata. Reuse existing rules, identify member file paths, and aggregate severity counts and CLI exit status.
+- Add optional `FileSystem.readDirectories` for workspace discovery in virtual repositories, without falling back to host IO.
+
+### Behavior and scope
+
+- The new rule defaults to `error`; projects with previously accepted unsupported settings may now exit 1. Existing security checks, severity overrides, and JSON schema 2 remain in effect.
+- Availability checks cover recorded introductions in the listed files, not whole PM schemas, runtime discovery, removals, backports, version-specific value syntax, or effective defaults. Deno coverage is limited to `.npmrc#min-release-age`; Aube retains its existing checks without introduction coverage in this release.
+- Distinguish pnpm's strict-build setting introduction (10.3.0) from general workspace YAML support (10.6.0), and correct Bun's scanner introduction note to 1.2.21.
+- Keep shared installation and lockfile checks at the root. Members infer their own publication status and use the root's PM target; child executable configs are not loaded. Workspace discovery requires explicit declarations, excludes directory symlinks, and does not cover effective configuration inheritance. Deno/Aube use bounded, source-derived declaration semantics.
+
+### Fixes
+
+- Update `smol-toml` to 1.8.0 and Vitest to 4.1.11 to include upstream security fixes.
+- Honor Deno 2.8.1+'s project `.npmrc#min-release-age` fallback when `deno.json` does not provide an age, while retaining `deno.json` precedence and reporting an explicit zero opt-out.
+- For pnpm targets before 10.9.0, recommend supported `strictDepBuilds` gating without claiming that the ignored future-version bypass requires pnpm 10.9.0.
+- Keep nested workspace candidates visible when only their ancestor candidate is excluded. Prune traversal only when a trailing `/**` exclusion covers the subtree.
+- Reject workspace patterns whose brace-expanded alternatives contain parent traversal or exceed 8,192 entries before compilation, and avoid backtracking in Aube exclusion matching.
+- Match npm's odd/even interpretation of repeated leading `!` characters.
+- Match Bun's workspace ordering and syntax classification: explicit members remain included, later positive globs can re-include earlier exclusions, and extglob punctuation stays literal.
+- Exclude `CMakeFiles` from Bun glob traversal while retaining explicitly named members below it, matching Bun's walker and literal-member path.
+- Honor npm's ordered cancellation of workspace exclusions, including its handling of adjacent repeated exclusions.
+- Match npm's leading-`#` comment behavior while retaining `#` in nested path segments.
+- Permit colons in ordinary relative workspace segments while continuing to reject absolute and drive-letter paths.
+- Report rejected workspace glob patterns as configuration errors (exit 2) instead of internal crashes (exit 70).
+- Reject non-file manifest inputs before reading, preventing root and workspace FIFO manifests from blocking the scan.
+- Match literal workspace path segments and exclusions case-insensitively on macOS and Windows, so declaration casing does not silently omit members.
+- Use minimatch consistently for workspace membership, exclusions, and traversal. Remove custom brace expansion and globstar matching.
+- Limit workspace traversal using each applicable pattern's own depth, preserving errors from required directory reads.
+- Wait for asynchronous reporters and propagate their failures through the command's error handling.
+- Reject non-file entries at configuration and lockfile paths instead of accepting directories as existing files.
+
+### Verification
+
+- Exercise version boundaries, selection precedence, multi-manager isolation, invalid targets, CLI exit codes, custom-rule context, and the installed package's API and strict types.
+- Exercise workspace patterns, exclusions, duplicate matches, malformed child manifests, private roots with public children, injected IO, and installed CLI/API member inspection.
+
+## [0.4.3]
+
+### Maintenance
+
+- Verify the packed package from an isolated consumer on both supported Node majors in CI. Check distributed files, installed CLI exit codes, package exports, custom rules, JSON output, and strict TypeScript declaration resolution without development dependency types.
+- Verify the same tarball before staging it for npm publication, preferring cached dependencies with install scripts disabled.
+- Centralize packing, verification, and temporary-file cleanup in `pnpm test:package`; retain the verified artifact on request for publication.
+- Move the release tag/version check into a standalone script while preserving the rejection of private packages and mismatched tags before installation and publication.
+- Allow bounded startup headroom for audit subprocess tests on shared runners and report process failures before reading their output records.
+
 ## [0.4.2]
 
 ### Fixes

package/README.md

@@ -38,7 +38,7 @@ The CLI reads `siro.config.*` as executable code. Review repository configuratio
 
 ## Features
 
-- **Rules across six managers.** 27 rules covering lifecycle scripts, version pinning, lockfiles
+- **Rules across six managers.** 28 rules covering lifecycle scripts, version pinning, lockfiles
   (`commit`/`frozen`), release age, publish provenance, `files`/`publishConfig`, SSL enforcement,
   checksum verification, exotic subdependency blocking, audit suppression review, store integrity,
   Bun's security scanner API, and Yarn 4's hardened-mode — each mapped to the right setting per
@@ -50,6 +50,12 @@ The CLI reads `siro.config.*` as executable code. Review repository configuratio
 - **Machine-readable remediation.** A finding can carry automatic key operations or manual
   instructions. Review proposed changes and rerun the linter after editing.
   See [docs/json-output.md](docs/json-output.md).
+- **Target PM versions.** Flag settings introduced after the declared or explicit stable PM
+  version. See [checked settings and sources](docs/rules.md#checked-introduction-versions)
+  for the npm, pnpm, Yarn, Bun, and Deno coverage.
+- **Workspace members.** `--workspaces` adds publication-metadata checks for declared npm,
+  pnpm, Yarn, Bun, Deno, and Aube members, including public packages under a private root.
+  See [workspace inspection](docs/configuration.md#workspace-members) for scope and exclusions.
 - **Lint with severities.** `error` fails CI by default; `--severity warn` tightens the gate.
 - **Reporters.** `pretty` (default), `json` for CI, `github` for PR annotations; register your own.
 - **Configurable.** Drop a `siro.config.ts` to disable rules, override severities, restrict PMs,
@@ -61,8 +67,10 @@ See the [rule reference](docs/rules.md) for what each check does and why, and th
 ## Versioning policy
 
 siro evaluates the recorded policy snapshot in [docs/policy-sources.md](docs/policy-sources.md).
-It detects package-manager names, not effective runtime versions. Version annotations describe
-verified upstream facts. A version-dependent safe-default annotation prevents an unverified
+It detects package-manager names and reads exact stable targets from `packageManager`,
+`config.pmVersions`, or `--pm-version`. It does not inspect installed binaries. The
+`unsupported-settings` rule checks recorded introduction versions; unlisted settings and
+unknown targets are not evaluated for availability. A version-dependent safe-default annotation prevents an unverified
 severity downgrade; it does not prove that the current version satisfies the rule. See
 [configuration](docs/configuration.md) for defaults, applicability, and limits.
 
@@ -72,6 +80,8 @@ severity downgrade; it does not prove that the current version satisfies the rul
 siro <lint|check> [path] [options]
 
   --pm <npm|pnpm|yarn|bun|deno|aube>   Target a specific package manager (auto-detected; required if detection finds nothing)
+  --pm-version <x.y.z>                Exact stable target version (requires --pm)
+  --workspaces                       Also inspect workspace members' publication metadata
   --project-type <application|package> Select application or published-package policy (default auto)
   --reporter <pretty|json|github>      Output format (default pretty)
   --severity <error|warn|info>         Show and fail on findings at or above this level

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as SUPPORTED_NODE_RANGE, D as isNodeError, M as UsageError, O as asAbsPath, S as isSeverity, T as assertDirectory, _ as PROJECT_TYPES, b as SEVERITIES, c as DEFAULT_REPORTER_NAME, f as version, j as SiroError, l as JSON_REPORTER_NAME, m as loadConfig, n as lintCommand, s as BUILTIN_REPORTER_NAMES, t as nodeIO, v as isProjectType, w as isSupportedNodeVersion, x as isPM, y as PMS } from "./node-io-BN34YwoL.mjs";
+import { C as SUPPORTED_NODE_RANGE, D as isNodeError, M as UsageError, O as asAbsPath, S as isSeverity, T as assertDirectory, _ as PROJECT_TYPES, b as SEVERITIES, c as DEFAULT_REPORTER_NAME, f as version, j as SiroError, l as JSON_REPORTER_NAME, m as loadConfig, n as lintCommand, s as BUILTIN_REPORTER_NAMES, t as nodeIO, v as isProjectType, w as isSupportedNodeVersion, x as isPM, y as PMS } from "./node-io-CaqobxYp.mjs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
@@ -33,6 +33,7 @@ const isCommandName = (value) => COMMANDS.some((cmd) => cmd === value);
 //#region src/cli/parse-args.ts
 const VALUE_FLAGS = new Set([
 	"pm",
+	"pm-version",
 	"project-type",
 	"reporter",
 	"severity"
@@ -40,7 +41,8 @@ const VALUE_FLAGS = new Set([
 const BOOLEAN_FLAGS = new Set([
 	"help",
 	"version",
-	"json"
+	"json",
+	"workspaces"
 ]);
 const parseCommand = (argv) => {
 	const { tokens } = parseArgs({
@@ -110,10 +112,13 @@ const parseCommand = (argv) => {
 	if (extra.length > 0) throw new UsageError(`Unexpected extra argument: ${extra.join(" ")}`);
 	if (flags.has("reporter") && flags.has("json")) throw new UsageError("Invalid reporter selection: use either --reporter or --json.");
 	const reporter = flags.get("reporter");
+	const pmVersion = flags.get("pm-version");
 	return {
 		kind: "lint",
 		cwd: asAbsPath(path.resolve(cwd ?? process.cwd())),
 		pm: parsePmFlag(flags.get("pm")),
+		pmVersion: typeof pmVersion === "string" ? pmVersion : void 0,
+		workspaces: flags.has("workspaces") || void 0,
 		projectType: parseProjectTypeFlag(flags.get("project-type")),
 		severity: parseSeverityFlag(flags.get("severity")),
 		reporter: typeof reporter === "string" ? reporter : flags.has("json") ? JSON_REPORTER_NAME : DEFAULT_REPORTER_NAME
@@ -128,6 +133,8 @@ const SEVERITIES_LIST = SEVERITIES.join("|");
 const FLAG_LINES = {
 	json: "  --json               Shortcut for --reporter json",
 	pm: `  --pm <name>          Target a specific package manager (${PMS_LIST})`,
+	pmVersion: "  --pm-version <x.y.z>  Target an exact stable PM version (requires --pm)",
+	workspaces: "  --workspaces         Also check workspace members' publication metadata",
 	projectType: `  --project-type <type>  Project type (${PROJECT_TYPES_LIST}; default auto)`,
 	reporter: `  --reporter <name>    Reporter (${REPORTERS_LIST}; additional reporters can be registered via siro.config.ts)`,
 	severity: `  --severity <level>   Show + fail on findings at or above this level (${SEVERITIES_LIST})`
@@ -143,6 +150,8 @@ const HELP_ROOT = [
 	"",
 	"GLOBAL FLAGS",
 	FLAG_LINES.pm,
+	FLAG_LINES.pmVersion,
+	FLAG_LINES.workspaces,
 	FLAG_LINES.projectType,
 	"  --version            Print the siro version",
 	"  --help               Show help for siro or a command",
@@ -171,6 +180,8 @@ const HELP_LINT = [
 	"",
 	"FLAGS",
 	FLAG_LINES.pm,
+	FLAG_LINES.pmVersion,
+	FLAG_LINES.workspaces,
 	FLAG_LINES.projectType,
 	FLAG_LINES.reporter,
 	FLAG_LINES.json,

package/dist/index.d.mts

@@ -1,5 +1,17 @@
 import * as vb from "valibot";
 
+//#region src/shared/paths.d.ts
+declare const AbsPathBrand: unique symbol;
+declare const RelPathBrand: unique symbol;
+type AbsPath = string & {
+  readonly [AbsPathBrand]: true;
+};
+type RelPath = string & {
+  readonly [RelPathBrand]: true;
+};
+declare const asAbsPath: (value: string) => AbsPath;
+declare const asRelPath: (value: string) => RelPath;
+//#endregion
 //#region src/domain/entities/config-value.d.ts
 declare const CODEC_KINDS: readonly ["json", "npmrc", "toml", "yaml"];
 type CodecKind = (typeof CODEC_KINDS)[number];
@@ -16,22 +28,16 @@ type ConfigReadValue = unknown;
 /** Read an own key path; absent or non-mapping parents yield undefined. */
 declare const getByPath: (config: ParsedConfig, keyPath: KeyPath) => ConfigReadValue;
 //#endregion
-//#region src/shared/paths.d.ts
-declare const AbsPathBrand: unique symbol;
-declare const RelPathBrand: unique symbol;
-type AbsPath = string & {
-  readonly [AbsPathBrand]: true;
-};
-type RelPath = string & {
-  readonly [RelPathBrand]: true;
-};
-declare const asAbsPath: (value: string) => AbsPath;
-declare const asRelPath: (value: string) => RelPath;
-//#endregion
 //#region src/domain/ports/file-system.d.ts
 /** IO boundary: swap in memfs (or any other backend) for tests. */
 interface FileSystem {
+  /** Ordinary child directory names, excluding symlinks. Required only for workspace discovery. Errors must propagate. */
+  readDirectories?: (path: AbsPath) => readonly string[];
+  /** Resolve one ordinary child using this filesystem's native name semantics, returning its enumerated name. No symlinks. Undefined for absence; other errors propagate. Without this optional port, Deno literal prefixes use exact names from readDirectories. */
+  resolveDirectory?: (parent: AbsPath, name: string) => string | undefined;
+  /** Read a regular file (including a symlink to one); undefined only for ENOENT. Other errors and non-file entries must throw. */
   readText: (path: AbsPath) => string | undefined;
+  /** True for a regular file (including a symlink to one); false only for ENOENT. Other errors and non-file entries must throw. */
   exists: (path: AbsPath) => boolean;
 }
 //#endregion
@@ -76,6 +82,8 @@ interface RepoContext {
 }
 /** Settings read during one evaluation share its parser and cache. */
 interface RuleContext extends RepoContext {
+  /** Declared or explicit stable version of this binding's manager, if known. */
+  readonly pmVersion?: string;
   readConfig: (file: ConfigFileRef) => ParsedConfig;
 }
 //#endregion
@@ -100,18 +108,24 @@ type Remediation = {
   readonly steps: readonly [string, ...string[]];
   readonly operations?: never;
 };
-type CheckStatus = {
-  readonly state: 'ok';
-} | {
-  readonly state: 'na';
-} | {
+interface ViolationStatus {
   readonly state: 'violation';
-  readonly message: string; /** Override the primary file when the violation concerns another input. */
+  readonly message: string;
+  /** File responsible for this individual violation. */
   readonly file?: RelPath;
   readonly expected?: ConfigValue;
-  readonly actual?: ConfigReadValue; /** User configuration takes precedence over this per-result severity. */
+  readonly actual?: ConfigReadValue;
+  /** User configuration takes precedence over this per-result severity. */
   readonly severity?: Severity;
   readonly remediation?: Remediation;
+}
+type CheckStatus = {
+  readonly state: 'ok';
+} | {
+  readonly state: 'na';
+} | ViolationStatus | {
+  readonly state: 'violations'; /** Independent findings; a rule chooses its own grouping granularity. */
+  readonly violations: readonly [ViolationStatus, ...ViolationStatus[]];
 };
 /** Display-only package-manager version metadata. */
 interface VersionNote {
@@ -141,7 +155,7 @@ interface Rule<Id extends string = string> {
 declare const defineRule: <const Id extends string>(rule: Rule<Id>) => Rule<Id>;
 //#endregion
 //#region src/domain/builtin-rules.d.ts
-declare const rules: readonly [Rule<"advisory-check">, Rule<"approved-git-repos">, Rule<"audit-suppression">, Rule<"block-auto-install">, Rule<"block-exotic-subdeps">, Rule<"bun-security-scanner">, Rule<"checksum-verification">, Rule<"commit-lockfile">, Rule<"dependency-overrides">, Rule<"disable-lifecycle-scripts">, Rule<"enforce-strict-ssl">, Rule<"files-field">, Rule<"frozen-lockfile">, Rule<"frozen-store">, Rule<"hardened-mode">, Rule<"minimum-release-age">, Rule<"named-registries">, Rule<"paranoid-mode">, Rule<"patched-dependencies">, Rule<"pin-exact-versions">, Rule<"provenance">, Rule<"publish-access">, Rule<"store-server">, Rule<"strict-allow-scripts">, Rule<"strict-release-age">, Rule<"strict-store-integrity">, Rule<"trust-policy">];
+declare const rules: readonly [Rule<"advisory-check">, Rule<"approved-git-repos">, Rule<"audit-suppression">, Rule<"block-auto-install">, Rule<"block-exotic-subdeps">, Rule<"bun-security-scanner">, Rule<"checksum-verification">, Rule<"commit-lockfile">, Rule<"dependency-overrides">, Rule<"disable-lifecycle-scripts">, Rule<"enforce-strict-ssl">, Rule<"files-field">, Rule<"frozen-lockfile">, Rule<"frozen-store">, Rule<"hardened-mode">, Rule<"minimum-release-age">, Rule<"named-registries">, Rule<"paranoid-mode">, Rule<"patched-dependencies">, Rule<"pin-exact-versions">, Rule<"provenance">, Rule<"publish-access">, Rule<"store-server">, Rule<"strict-allow-scripts">, Rule<"strict-release-age">, Rule<"strict-store-integrity">, Rule<"trust-policy">, Rule<"unsupported-settings">];
 type BuiltinRuleId = (typeof rules)[number]['id'];
 //#endregion
 //#region src/domain/ports/io.d.ts
@@ -172,7 +186,7 @@ interface LintResult {
 //#region src/domain/ports/reporter.d.ts
 interface Reporter<Name extends string = string> {
   readonly name: Name;
-  format: (result: LintResult, io: IO) => void;
+  format: (result: LintResult, io: IO) => void | Promise<void>;
 }
 //#endregion
 //#region src/domain/entities/siro-config.d.ts
@@ -190,6 +204,8 @@ type RuleSetting = Severity | 'off';
  */
 interface SiroConfig {
   readonly pms?: readonly PM[];
+  /** Exact stable target versions; does not select managers or inspect installed binaries. */
+  readonly pmVersions?: Readonly<Partial<Record<PM, string>>>;
   readonly projectType?: ProjectType;
   readonly rules?: Readonly<Partial<Record<BuiltinRuleId | (string & Record<never, never>), RuleSetting>>>;
   readonly customRules?: readonly Rule[];
@@ -203,6 +219,10 @@ interface LintOptions {
   readonly cwd: AbsPath;
   readonly fs?: FileSystem;
   readonly pm?: PM;
+  /** Exact stable version for `pm`; overrides config.pmVersions and packageManager. */
+  readonly pmVersion?: string;
+  /** Also inspect declared workspace members' publication settings. */
+  readonly workspaces?: boolean;
   readonly projectType?: ProjectType;
   /** Explicit configuration; the library never imports files from the target repository. */
   readonly config?: SiroConfig;
@@ -330,5 +350,5 @@ declare class UsageError extends SiroError {
 //#region src/version.d.ts
 declare const version: string;
 //#endregion
-export { type AbsPath, BUILTIN_REPORTER_NAMES, type BuiltinReporterName, CONFIG_FILES, type CheckStatus, ConfigError, type ConfigFileRef, type ConfigReadValue, type ConfigValue, type FileSystem, type Finding, type IO, type KeyPath, type LintCommandOptions, type LintOptions, type LintResult, type PM, PMS, PROJECT_TYPES, type ParsedConfig, type ProjectType, type RelPath, type Remediation, type RepoContext, type Reporter, type RequireConfigKeyOptions, type Rule, type RuleBinding, type RuleContext, type RuleSetting, SEVERITIES, type SetKeyOperation, type Severity, type SiroConfig, SiroError, UsageError, type VersionNote, asAbsPath, asRelPath, defineConfig, defineRule, getByPath, githubReporter, isPM, isSeverity, jsonReporter, lint, lintCommand, loadConfig, nodeFileSystem, nodeIO, overrideBindings, prettyReporter, requireConfigKey, version };
+export { type AbsPath, BUILTIN_REPORTER_NAMES, type BuiltinReporterName, CONFIG_FILES, type CheckStatus, ConfigError, type ConfigFileRef, type ConfigReadValue, type ConfigValue, type FileSystem, type Finding, type IO, type KeyPath, type LintCommandOptions, type LintOptions, type LintResult, type PM, PMS, PROJECT_TYPES, type ParsedConfig, type ProjectType, type RelPath, type Remediation, type RepoContext, type Reporter, type RequireConfigKeyOptions, type Rule, type RuleBinding, type RuleContext, type RuleSetting, SEVERITIES, type SetKeyOperation, type Severity, type SiroConfig, SiroError, UsageError, type VersionNote, type ViolationStatus, asAbsPath, asRelPath, defineConfig, defineRule, getByPath, githubReporter, isPM, isSeverity, jsonReporter, lint, lintCommand, loadConfig, nodeFileSystem, nodeIO, overrideBindings, prettyReporter, requireConfigKey, version };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { A as ConfigError, E as nodeFileSystem, M as UsageError, O as asAbsPath, S as isSeverity, _ as PROJECT_TYPES, a as overrideBindings, b as SEVERITIES, d as jsonReporter, f as version, g as getByPath, h as defineRule, i as CONFIG_FILES, j as SiroError, k as asRelPath, m as loadConfig, n as lintCommand, o as requireConfigKey, p as githubReporter, r as lint, s as BUILTIN_REPORTER_NAMES, t as nodeIO, u as prettyReporter, x as isPM, y as PMS } from "./node-io-BN34YwoL.mjs";
+import { A as ConfigError, E as nodeFileSystem, M as UsageError, O as asAbsPath, S as isSeverity, _ as PROJECT_TYPES, a as requireConfigKey, b as SEVERITIES, d as jsonReporter, f as version, g as getByPath, h as defineRule, i as overrideBindings, j as SiroError, k as asRelPath, m as loadConfig, n as lintCommand, o as CONFIG_FILES, p as githubReporter, r as lint, s as BUILTIN_REPORTER_NAMES, t as nodeIO, u as prettyReporter, x as isPM, y as PMS } from "./node-io-CaqobxYp.mjs";
 //#region src/domain/entities/siro-config.ts
 /** Identity helper for type-checked config files. */
 const defineConfig = (config) => config;