@pho9ubenaa/siro 0.4.3 → 0.5.0

package/dist/{node-io-B3Hbcwyn.mjs → node-io-CaqobxYp.mjs}

@@ -1,12 +1,14 @@
 import path from "node:path";
-import { accessSync, constants, readFileSync, statSync } from "node:fs";
+import { lstatSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import satisfies from "semver/functions/satisfies.js";
 import * as vb from "valibot";
+import { lt, parse } from "semver";
 import pc from "picocolors";
 import ini from "ini";
-import { parse } from "smol-toml";
+import { parse as parse$1 } from "smol-toml";
 import { parseDocument } from "yaml";
+import { GLOBSTAR, Minimatch, braceExpand } from "minimatch";
 import valid from "semver/functions/valid.js";
 //#region src/shared/errors.ts
 var SiroError = class extends Error {
@@ -62,10 +64,34 @@ const asRelPath = (value) => {
 const isNodeError = (value) => value instanceof Error && "code" in value && typeof value.code === "string";
 //#endregion
 //#region src/adapters/node-file-system.ts
+const assertRegularFile = (filePath) => {
+	if (!statSync(filePath).isFile()) throw new ConfigError(`${filePath}: expected a regular file.`);
+};
 const nodeFileSystem = {
+	readDirectories(directory) {
+		return readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+	},
+	resolveDirectory(parent, name) {
+		let target;
+		try {
+			target = lstatSync(path.join(parent, name), { bigint: true });
+		} catch (error) {
+			if (isNodeError(error) && error.code === "ENOENT") return void 0;
+			throw error;
+		}
+		if (!target.isDirectory()) return void 0;
+		const names = readdirSync(parent, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+		if (names.includes(name)) return name;
+		const matches = names.filter((candidate) => {
+			const entry = lstatSync(path.join(parent, candidate), { bigint: true });
+			return entry.isDirectory() && entry.dev === target.dev && entry.ino === target.ino;
+		});
+		if (target.ino === 0n || matches.length !== 1) throw new ConfigError(`${parent}: cannot identify the resolved workspace directory ${name}.`);
+		return matches[0];
+	},
 	exists(filePath) {
 		try {
-			accessSync(filePath, constants.F_OK);
+			assertRegularFile(filePath);
 			return true;
 		} catch (error) {
 			if (isNodeError(error) && error.code === "ENOENT") return false;
@@ -74,6 +100,7 @@ const nodeFileSystem = {
 	},
 	readText(filePath) {
 		try {
+			assertRegularFile(filePath);
 			return readFileSync(filePath, "utf8");
 		} catch (error) {
 			if (isNodeError(error) && error.code === "ENOENT") return;
@@ -87,7 +114,7 @@ const assertDirectory = (root) => {
 };
 //#endregion
 //#region package.json
-var version$1 = "0.4.3";
+var version$1 = "0.5.0";
 //#endregion
 //#region src/shared/node-version.ts
 const SUPPORTED_NODE_RANGE = { "node": "^22.18.0 || ^24.0.0" }.node;
@@ -186,6 +213,11 @@ const isDenseStringArray = (value) => Array.isArray(value) && Array.from(value).
 const isCheckStatusShape = (value) => {
 	if (!isPlainRecord(value)) return false;
 	if (value.state === "ok" || value.state === "na") return true;
+	if (value.state === "violations") return Array.isArray(value.violations) && value.violations.length > 0 && Array.from(value.violations).every(isViolationStatusShape);
+	return isViolationStatusShape(value);
+};
+const isViolationStatusShape = (value) => {
+	if (!isPlainRecord(value)) return false;
 	return value.state === "violation" && typeof value.message === "string" && (value.file === void 0 || isRelPath(value.file)) && (value.expected === void 0 || isConfigValueShape(value.expected)) && (value.severity === void 0 || typeof value.severity === "string" && isSeverity(value.severity)) && !("manualSteps" in value) && !("fix" in value) && !("fixable" in value) && (value.remediation === void 0 || isRemediationShape(value.remediation));
 };
 const isSetKeyOperation = (value) => isPlainRecord(value) && value.op === "setKey" && isConfigFileRefShape(value.file) && isDenseStringArray(value.keyPath) && value.keyPath.length > 0 && isConfigValueShape(value.value);
@@ -207,12 +239,26 @@ const isRuleShape = (value) => {
 	return typeof value.id === "string" && typeof value.title === "string" && typeof value.description === "string" && typeof value.severity === "string" && isSeverity(value.severity) && isOptionalString(value.docs) && isProjectTypesShape(value.projectTypes) && isBindingsShape(value.bindings);
 };
 //#endregion
+//#region src/domain/services/pm-versions.ts
+/** Release history establishes stable versions, not ranges or prerelease builds. */
+const isStableVersion = (value) => {
+	if (typeof value !== "string" || !/^\d/u.test(value) || value.trim() !== value) return false;
+	const version = parse(value);
+	return version !== null && version.prerelease.length === 0;
+};
+/** Keep name-only detection independent from whether the declaration pins a version. */
+const declaredPMVersion = (declaration) => {
+	const [pm, version, ...extra] = declaration?.trim().split("@") ?? [];
+	return pm && isPM(pm) && isStableVersion(version) && extra.length === 0 ? { [pm]: version } : {};
+};
+//#endregion
 //#region src/application/config.ts
 const RuleSettingSchema = vb.union([vb.picklist(SEVERITIES), vb.literal("off")]);
 const ConfigSchema = vb.strictObject({
 	customRules: vb.optional(vb.array(vb.custom(isRuleShape, "must be a structurally valid rule"))),
 	pms: vb.optional(vb.pipe(vb.array(vb.picklist(PMS)), vb.minLength(1, "must not be empty (omit the key to auto-detect, or list at least one PM)"))),
 	projectType: vb.optional(vb.picklist(PROJECT_TYPES)),
+	pmVersions: vb.optional(vb.pipe(vb.custom(isPlainRecord, "must be an object of PM versions"), vb.check((value) => Object.keys(value).every(isPM), "unknown package manager in pmVersions"), vb.record(vb.picklist(PMS), vb.custom(isStableVersion, "must be an exact stable version such as 10.16.0")))),
 	reporters: vb.optional(vb.array(vb.custom(isReporterShape, "must be a { name, format } reporter"))),
 	rules: vb.optional(vb.pipe(vb.custom(isPlainRecord, "must be an object of rule settings"), vb.rawTransform(({ dataset, addIssue }) => {
 		const entries = [];
@@ -412,6 +458,105 @@ const BUILTIN_REPORTER_NAMES = BUILTINS.map((rep) => rep.name);
 /** Later registrations replace earlier reporters with the same name. */
 const createRegistry = (extras = []) => new Map([...BUILTINS, ...extras].map((reporter) => [reporter.name, reporter]));
 //#endregion
+//#region src/domain/entities/config-files.ts
+/** Known configuration locations and their parsers. */
+const CONFIG_FILES = {
+	aubeWorkspace: {
+		kind: "yaml",
+		path: asRelPath("aube-workspace.yaml")
+	},
+	bunfig: {
+		kind: "toml",
+		path: asRelPath("bunfig.toml")
+	},
+	denoJson: {
+		kind: "json",
+		path: asRelPath("deno.json")
+	},
+	npmrc: {
+		kind: "npmrc",
+		path: asRelPath(".npmrc")
+	},
+	packageJson: {
+		kind: "json",
+		path: asRelPath("package.json")
+	},
+	pnpmWorkspace: {
+		kind: "yaml",
+		path: asRelPath("pnpm-workspace.yaml")
+	},
+	yarnrc: {
+		kind: "yaml",
+		path: asRelPath(".yarnrc.yml")
+	}
+};
+//#endregion
+//#region src/domain/services/parse-config-file.ts
+const EMPTY_FILE = Object.freeze({});
+/** Create a fresh parser and cache for one lint command. */
+const createConfigParser = (codecFor, ctx) => {
+	const cache = /* @__PURE__ */ new Map();
+	return (file) => {
+		if (file === void 0) return EMPTY_FILE;
+		const cacheKey = `${file.kind}:${file.path}`;
+		const cached = cache.get(cacheKey);
+		if (cached !== void 0) return cached;
+		const text = ctx.readText(file.path);
+		if (text === void 0) {
+			cache.set(cacheKey, EMPTY_FILE);
+			return EMPTY_FILE;
+		}
+		const parsed = wrapCodecError(file.path, () => codecFor(file.kind).parse(text));
+		cache.set(cacheKey, parsed);
+		return parsed;
+	};
+};
+//#endregion
+//#region src/adapters/codecs/ini.ts
+const INTEGER_PATTERN = /^-?\d+$/u;
+const coerceBoolean = (str) => {
+	if (str === "true") return true;
+	if (str === "false") return false;
+};
+const coerceInteger = (str) => {
+	if (INTEGER_PATTERN.test(str)) return Number(str);
+};
+const coerce = (raw) => {
+	if (typeof raw !== "string") return raw;
+	return coerceBoolean(raw) ?? coerceInteger(raw) ?? raw;
+};
+//#endregion
+//#region src/adapters/codecs/store.ts
+const CODECS = {
+	json: { parse(text) {
+		const trimmed = text.trim();
+		return toParsedConfig(JSON.parse(trimmed));
+	} },
+	npmrc: { parse(text) {
+		const raw = toParsedConfig(ini.parse(text));
+		const config = {};
+		for (const [key, value] of Object.entries(raw)) if (Array.isArray(value)) config[key] = value.map((elem) => coerce(elem));
+		else if (typeof value === "object" && value !== null) config[key] = toParsedConfig(value);
+		else config[key] = coerce(value);
+		return config;
+	} },
+	toml: { parse(text) {
+		if (text.trim() === "") return {};
+		return toParsedConfig(parse$1(text.replace(/^\uFEFF/u, "")));
+	} },
+	yaml: { parse(text) {
+		if (text.trim() === "") return {};
+		const document = parseDocument(text);
+		if (document.errors.length > 0) throw document.errors[0];
+		if (document.contents === null) return {};
+		return toParsedConfig(document.toJS({ onAnchor: (value, count) => {
+			if (count > 1) JSON.stringify(value);
+		} }));
+	} }
+};
+/** Look up the codec for a parseable kind. Total — every CodecKind has one. */
+const codecFor = (kind) => CODECS[kind];
+//#endregion
 //#region src/domain/schemas/package-json.ts
 const PackageJsonSchema = vb.looseObject({
 	files: vb.optional(vb.array(vb.string())),
@@ -463,50 +608,530 @@ const createRepoContext = (root, fs = nodeFileSystem, projectType) => {
 	};
 };
 //#endregion
-//#region src/adapters/codecs/ini.ts
-const INTEGER_PATTERN = /^-?\d+$/u;
-const coerceBoolean = (str) => {
-	if (str === "true") return true;
-	if (str === "false") return false;
+//#region src/application/workspace-prefix.ts
+/** Anchor Deno's native literal prefix before applying its glob suffix. */
+const anchorWorkspacePrefix = (pattern, glob, resolveChild) => {
+	const parts = pattern.split("/");
+	const firstWildcard = parts.findIndex((part) => /[*?]/u.test(part));
+	const prefix = parts.slice(0, firstWildcard < 0 ? parts.length : firstWildcard);
+	if (prefix.length === 0 || pattern === ".") return glob;
+	const declared = prefix.join("/");
+	let resolved;
+	let attempted = false;
+	const resolve = () => {
+		if (!attempted) {
+			attempted = true;
+			let current = ".";
+			for (const part of prefix) {
+				const child = resolveChild(current, part);
+				if (child === void 0) return void 0;
+				current = current === "." ? child : `${current}/${child}`;
+			}
+			resolved = current;
+		}
+		return resolved;
+	};
+	const rewrite = (directory, actual) => directory === actual ? declared : directory.startsWith(`${actual}/`) ? declared + directory.slice(actual.length) : void 0;
+	return {
+		matches(directory) {
+			if (directory === ".") return false;
+			const actual = resolve();
+			const rewritten = actual === void 0 ? void 0 : rewrite(directory, actual);
+			return rewritten !== void 0 && glob.matches(rewritten);
+		},
+		canDescend(directory) {
+			const actual = resolve();
+			if (actual === void 0) return false;
+			if (directory === "." || actual.startsWith(`${directory}/`)) return true;
+			const rewritten = rewrite(directory, actual);
+			return rewritten !== void 0 && glob.canDescend(rewritten);
+		}
+	};
 };
-const coerceInteger = (str) => {
-	if (INTEGER_PATTERN.test(str)) return Number(str);
+//#endregion
+//#region src/application/workspace-globs.ts
+const MAX_WORKSPACE_GLOB_ALTERNATIVES = 8192;
+const BRACE_EXPANSION_PROBE_LIMIT = 8193;
+const defaultWorkspaceGlobOptions = {
+	platform: "linux",
+	nocase: process.platform === "darwin" || process.platform === "win32",
+	windowsPathsNoEscape: true,
+	nonegate: true,
+	nocomment: true,
+	optimizationLevel: 2
+};
+const boundedBraceExpand = (pattern) => {
+	const alternatives = braceExpand(pattern, { braceExpandMax: BRACE_EXPANSION_PROBE_LIMIT });
+	if (alternatives.length > MAX_WORKSPACE_GLOB_ALTERNATIVES) throw new ConfigError(`Workspace pattern expands beyond ${MAX_WORKSPACE_GLOB_ALTERNATIVES} alternatives.`);
+	return alternatives;
+};
+/** Expand with minimatch's own bounded brace semantics. */
+const expandWorkspaceGlob = (pattern) => {
+	try {
+		return boundedBraceExpand(pattern);
+	} catch (error) {
+		if (error instanceof TypeError) throw new ConfigError(`Invalid workspace pattern: ${error.message}.`);
+		throw error;
+	}
 };
-const coerce = (raw) => {
-	if (typeof raw !== "string") return raw;
-	return coerceBoolean(raw) ?? coerceInteger(raw) ?? raw;
+/** Compile once so membership, exclusions, and traversal share glob semantics. */
+const compileWorkspaceGlob = (pattern, options = defaultWorkspaceGlobOptions) => {
+	let matcher;
+	try {
+		if (!options.nobrace) boundedBraceExpand(pattern);
+		matcher = new Minimatch(pattern, {
+			...options,
+			braceExpandMax: BRACE_EXPANSION_PROBE_LIMIT
+		});
+	} catch (error) {
+		if (error instanceof TypeError) throw new ConfigError(`Invalid workspace pattern: ${error.message}.`);
+		throw error;
+	}
+	return {
+		matches: (directory) => matcher.match(directory),
+		canDescend(directory) {
+			const parts = directory.split("/");
+			return matcher.set.some((alternative) => (alternative.includes(GLOBSTAR) || parts.length < alternative.length) && matcher.matchOne(parts, alternative, true));
+		}
+	};
 };
 //#endregion
-//#region src/adapters/codecs/store.ts
-const CODECS = {
-	json: { parse(text) {
-		const trimmed = text.trim();
-		return toParsedConfig(JSON.parse(trimmed));
-	} },
-	npmrc: { parse(text) {
-		const raw = toParsedConfig(ini.parse(text));
-		const config = {};
-		for (const [key, value] of Object.entries(raw)) if (Array.isArray(value)) config[key] = value.map((elem) => coerce(elem));
-		else if (typeof value === "object" && value !== null) config[key] = toParsedConfig(value);
-		else config[key] = coerce(value);
-		return config;
-	} },
-	toml: { parse(text) {
-		if (text.trim() === "") return {};
-		return toParsedConfig(parse(text.replace(/^\uFEFF/u, "")));
-	} },
-	yaml: { parse(text) {
-		if (text.trim() === "") return {};
-		const document = parseDocument(text);
-		if (document.errors.length > 0) throw document.errors[0];
-		if (document.contents === null) return {};
-		return toParsedConfig(document.toJS({ onAnchor: (value, count) => {
-			if (count > 1) JSON.stringify(value);
-		} }));
-	} }
+//#region src/application/workspace-dialects.ts
+const matchesCrossPathGlob = (pattern, value) => {
+	const patternCharacters = [...pattern];
+	const valueCharacters = [...value];
+	let patternIndex = 0;
+	let valueIndex = 0;
+	let starIndex = -1;
+	let retryIndex = 0;
+	while (valueIndex < valueCharacters.length) {
+		const character = patternCharacters[patternIndex];
+		if (character === "?" || character === valueCharacters[valueIndex]) {
+			patternIndex += 1;
+			valueIndex += 1;
+		} else if (character === "*") {
+			starIndex = patternIndex;
+			retryIndex = valueIndex;
+			patternIndex += 1;
+		} else if (starIndex >= 0) {
+			patternIndex = starIndex + 1;
+			retryIndex += 1;
+			valueIndex = retryIndex;
+		} else return false;
+	}
+	while (patternCharacters[patternIndex] === "*") patternIndex += 1;
+	return patternIndex === patternCharacters.length;
+};
+/** The bounded glob subset verified against the recorded Deno/Aube sources. */
+const compileAdditionalWorkspaceGlob = (pattern, pm, excluded) => {
+	const parts = pattern.split("/");
+	if (parts.some((part) => part.includes("**") && part !== "**")) throw new ConfigError(`${pm}: ** must occupy an entire workspace path component.`);
+	if (pm === "aube" && (/[[\]{}()]/u.test(pattern) || pattern.includes("**") && (parts.at(-1) !== "**" || /[*?]/u.test(parts.slice(0, -1).join("/"))))) throw new ConfigError("Aube workspace inspection supports literals, * and ?, and a trailing ** after a literal prefix; other glob forms are not yet supported.");
+	const escaped = pm === "deno" ? pattern.replace(/[[\]]/gu, (character) => character === "[" ? "[[]" : "[]]") : pattern;
+	const matcher = compileWorkspaceGlob(escaped, {
+		platform: "linux",
+		windowsPathsNoEscape: true,
+		nonegate: true,
+		nocomment: true,
+		nobrace: true,
+		noext: true,
+		dot: pm === "aube",
+		nocase: pm === "deno" && (/[*?]/u.test(pattern) || process.platform === "darwin" || process.platform === "win32")
+	});
+	if (pm === "deno" && /[*?]/u.test(pattern)) {
+		const files = compileWorkspaceGlob(`${escaped}/package.json`, {
+			platform: "linux",
+			windowsPathsNoEscape: true,
+			nonegate: true,
+			nocomment: true,
+			nobrace: true,
+			noext: true,
+			nocase: true
+		});
+		return {
+			...matcher,
+			matches: (directory) => files.matches(directory === "." ? "package.json" : `${directory}/package.json`)
+		};
+	}
+	if (pm !== "aube" || !excluded) return matcher;
+	const self = pattern.endsWith("/**") ? pattern.slice(0, -3) : void 0;
+	return {
+		...matcher,
+		matches: (directory) => matchesCrossPathGlob(pattern, directory) || directory === self
+	};
+};
+//#endregion
+//#region src/application/workspaces.ts
+/** npm cancels an earlier exclusion when a later positive pattern matches it. */
+const splitNpmPattern = (raw) => {
+	const prefix = /^!+/u.exec(raw)?.[0] ?? "";
+	return {
+		excluded: prefix.length % 2 === 1,
+		pattern: raw.slice(prefix.length)
+	};
+};
+const npmPatterns = (patterns) => {
+	const positive = [];
+	let negative = [];
+	for (const raw of patterns) {
+		const parsed = splitNpmPattern(raw);
+		const pattern = parsed.pattern.replace(/^\.?\/+/u, "");
+		if (parsed.excluded) negative.push({
+			pattern,
+			glob: compileWorkspaceGlob(pattern, {})
+		});
+		else {
+			for (let index = 0; index < negative.length; index += 1) if (negative[index]?.glob.matches(pattern)) negative.splice(index, 1);
+			positive.push(pattern);
+		}
+	}
+	return [...positive, ...negative.map(({ pattern }) => `!${pattern}`)];
+};
+/** Read declaration sources separately so Deno's two manifest sets stay distinct. */
+const workspaceDefinitions = (ctx, pm) => {
+	const parse = createConfigParser(codecFor, ctx);
+	const validate = (value, source, denoManifests = false) => {
+		if (value === void 0) return {
+			patterns: [],
+			denoManifests
+		};
+		if (!Array.isArray(value) || !Array.from(value).every((item) => typeof item === "string")) throw new ConfigError(`${source}: expected an array of directory patterns.`);
+		for (const pattern of value) {
+			const positive = pm === "npm" ? splitNpmPattern(pattern).pattern : pattern.startsWith("!") ? pattern.slice(1) : pattern;
+			if ((pm === "deno" || pm === "aube" ? [positive] : expandWorkspaceGlob(positive)).some((alternative) => !isRelPath(alternative) || alternative.includes("\\") || alternative.startsWith("!"))) throw new ConfigError(`${source}: use relative directory patterns without parent traversal: ${JSON.stringify(pattern)}.`);
+			if (pm === "deno" && denoManifests && !pattern.startsWith("!") && path.posix.normalize(positive) === ".") throw new ConfigError(`${source}: a Deno workspace cannot contain itself.`);
+		}
+		return {
+			patterns: pm === "npm" ? npmPatterns(value) : value,
+			denoManifests
+		};
+	};
+	const packageDefinition = () => {
+		let value = ctx.packageJson?.workspaces;
+		if (isPlainRecord(value)) {
+			value = value.packages;
+			if (value === void 0) throw new ConfigError("package.json#workspaces: expected a packages array.");
+		}
+		return validate(value, "package.json#workspaces");
+	};
+	if (pm === "pnpm") return [validate(ctx.exists(CONFIG_FILES.pnpmWorkspace.path) ? parse(CONFIG_FILES.pnpmWorkspace).packages : void 0, "pnpm-workspace.yaml#packages")];
+	if (pm === "aube") {
+		const file = [CONFIG_FILES.aubeWorkspace, CONFIG_FILES.pnpmWorkspace].find((candidate) => ctx.exists(candidate.path));
+		return [file ? validate(parse(file).packages, `${file.path}#packages`) : packageDefinition()];
+	}
+	if (pm === "deno") return [validate(parse(CONFIG_FILES.denoJson).workspace, "deno.json#workspace", true), packageDefinition()];
+	return [packageDefinition()];
+};
+/** Traverse only ordinary directories that can fall under a positive pattern. */
+const workspaceDirectories = (ctx, fs, definition, pm) => {
+	const { patterns } = definition;
+	const skipVendor = pm === "deno" && createConfigParser(codecFor, ctx)(CONFIG_FILES.denoJson).vendor === true;
+	const positive = patterns.filter((pattern) => !pattern.startsWith("!")).map((pattern) => path.posix.normalize(pattern).replace(/\/+$/u, ""));
+	const negative = patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => path.posix.normalize(pattern.slice(1)).replace(/\/+$/u, ""));
+	const directoryCache = /* @__PURE__ */ new Map();
+	const readDirectories = (directory) => {
+		const cached = directoryCache.get(directory);
+		if (cached) return cached;
+		if (!fs.readDirectories) throw new UsageError("Workspace discovery requires FileSystem.readDirectories; no host filesystem fallback is used.");
+		const names = fs.readDirectories(resolveIn(ctx.root, asRelPath(directory)));
+		if (!Array.isArray(names)) throw new ConfigError("FileSystem.readDirectories must return an array of directory names.");
+		for (const name of Array.from(names)) if (!isRelPath(name) || name === "." || name === ".." || /[\\/]/u.test(name)) throw new ConfigError("FileSystem.readDirectories returned an invalid child directory name.");
+		const result = [...new Set(names)].sort();
+		directoryCache.set(directory, result);
+		return result;
+	};
+	const resolveChild = (parent, name) => {
+		if (name === ".git" || name === "node_modules") return void 0;
+		const names = readDirectories(parent);
+		const resolved = names.includes(name) ? name : fs.resolveDirectory?.(resolveIn(ctx.root, asRelPath(parent)), name);
+		if (resolved !== void 0 && !names.includes(resolved)) throw new ConfigError("FileSystem.resolveDirectory must return an enumerated ordinary child directory name.");
+		return resolved === ".git" || resolved === "node_modules" ? void 0 : resolved;
+	};
+	const compile = (pattern, excluded = false) => {
+		if (pm !== "deno" && pm !== "aube") return compileWorkspaceGlob(pattern, pm === "npm" ? {
+			...defaultWorkspaceGlobOptions,
+			nocomment: false
+		} : defaultWorkspaceGlobOptions);
+		const glob = compileAdditionalWorkspaceGlob(pattern, pm, excluded);
+		return pm === "deno" && !excluded ? anchorWorkspacePrefix(pattern, glob, resolveChild) : glob;
+	};
+	const included = positive.map((pattern) => compile(pattern));
+	const excluded = negative.map((pattern) => {
+		return {
+			glob: compile(pattern, true),
+			subtree: pm === "deno" || pm === "aube" || pm === "bun" ? void 0 : pattern === "**" ? { matches: () => true } : pattern.endsWith("/**") ? compile(pattern.slice(0, -3), true) : void 0
+		};
+	});
+	const declaredBase = (pattern) => {
+		const parts = pattern.split("/");
+		const wildcard = parts.findIndex((part) => /[*?]/u.test(part));
+		return parts.slice(0, wildcard < 0 ? parts.length : wildcard).join("/") || ".";
+	};
+	const relatedBases = (left, right) => left === "." || right === "." || left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
+	const denoPositive = pm === "deno" ? positive.filter((pattern) => /[*?]/u.test(pattern)).map((pattern) => ({
+		base: declaredBase(pattern),
+		scope: anchorWorkspacePrefix(declaredBase(pattern), {
+			matches: () => true,
+			canDescend: () => true
+		}, resolveChild)
+	})) : [];
+	const denoOrdered = pm === "deno" ? patterns.filter((pattern) => /[*?]/u.test(pattern) || pattern.startsWith("!")).map((raw) => {
+		const isExcluded = raw.startsWith("!");
+		const pattern = path.posix.normalize(raw.replace(/^!/u, "")).replace(/\/+$/u, "");
+		const glob = compile(pattern, isExcluded);
+		if (!isExcluded) return {
+			excluded: false,
+			glob
+		};
+		return {
+			excluded: true,
+			glob: {
+				...glob,
+				matches(directory) {
+					if (!/[*?]/u.test(pattern)) return directory === pattern;
+					if (!glob.matches(directory)) return false;
+					const applicable = denoPositive.filter((item) => item.scope.matches(directory)).map((item) => relatedBases(item.base, declaredBase(pattern)));
+					if (applicable.some(Boolean) && applicable.some((value) => !value)) throw new ConfigError("Deno workspace exclusion has ambiguous overlapping bases; use consistent prefix spelling or separate non-overlapping patterns.");
+					return applicable.some(Boolean);
+				}
+			}
+		};
+	}) : [];
+	const bunPatterns = pm === "bun" ? patterns.map((raw) => {
+		const isExcluded = raw.startsWith("!");
+		const pattern = path.posix.normalize(raw.replace(/^!/u, "")).replace(/\/+$/u, "");
+		const usesGlob = isExcluded || pattern.includes("*") || pattern.includes("?") || pattern.includes("{") || pattern.includes("[");
+		const glob = compileWorkspaceGlob(pattern, {
+			...defaultWorkspaceGlobOptions,
+			noext: true
+		});
+		const subtree = isExcluded && pattern.endsWith("/**") ? compileWorkspaceGlob(pattern.slice(0, -3), {
+			...defaultWorkspaceGlobOptions,
+			noext: true
+		}) : void 0;
+		return {
+			isExcluded,
+			usesGlob,
+			glob,
+			matches: (directory) => glob.matches(directory) || glob.matches(`${directory}/`) || subtree?.matches(directory) === true
+		};
+	}) : [];
+	const bunOrdered = bunPatterns.filter(({ usesGlob }) => usesGlob);
+	const bunLiterals = bunPatterns.filter(({ isExcluded, usesGlob }) => !isExcluded && !usesGlob);
+	const bunTraversal = bunPatterns.filter(({ isExcluded }) => !isExcluded).map(({ glob }) => glob);
+	const denoLiteral = pm === "deno" ? positive.filter((pattern) => !/[*?]/u.test(pattern)).map((pattern) => compile(pattern)) : [];
+	if (definition.denoManifests && denoOrdered.findLast(({ glob }) => glob.matches("."))?.excluded === false) throw new ConfigError("deno.json#workspace: a Deno workspace cannot contain itself.");
+	if (positive.length === 0 || positive.every((pattern) => pattern === ".")) return [];
+	if (!fs.readDirectories) throw new UsageError("Workspace discovery requires FileSystem.readDirectories; no host filesystem fallback is used.");
+	const result = [];
+	const pending = ["."];
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (current === void 0) break;
+		for (const name of readDirectories(current)) {
+			if (name === ".git" || name === "node_modules") continue;
+			const directory = asRelPath(current === "." ? name : `${current}/${name}`);
+			if (pm === "bun" && name === "CMakeFiles" && !bunLiterals.some(({ glob }) => glob.matches(directory) || glob.canDescend(directory))) continue;
+			const inVendor = skipVendor && (directory === "vendor" || directory.startsWith("vendor/"));
+			if (inVendor && !denoLiteral.some((pattern) => pattern.matches(directory) || pattern.canDescend(directory))) continue;
+			const isExcluded = pm !== "deno" && excluded.some(({ glob }) => glob.matches(directory) || glob.matches(`${directory}/`));
+			if (excluded.some(({ subtree }) => subtree?.matches(directory))) continue;
+			const lastDenoMatch = denoOrdered.findLast(({ glob }) => glob.matches(directory));
+			const lastBunMatch = bunOrdered.findLast(({ matches }) => matches(directory));
+			if (pm === "deno" ? denoLiteral.some((pattern) => pattern.matches(directory)) || !inVendor && lastDenoMatch?.excluded === false : pm === "bun" ? bunLiterals.some(({ glob }) => glob.matches(directory)) || lastBunMatch?.isExcluded === false : !isExcluded && included.some((pattern) => pattern.matches(directory))) result.push(directory);
+			if ((pm === "bun" ? bunTraversal : inVendor ? denoLiteral : included).some((pattern) => pattern.canDescend(directory))) pending.push(directory);
+		}
+	}
+	return result.sort();
+};
+//#endregion
+//#region src/application/workspace-contexts.ts
+/** Expand each manager's declarations into isolated publication contexts. */
+const collectWorkspaceMembers = (ctx, fs, pms, projectType) => pms.flatMap((pm) => {
+	const seen = /* @__PURE__ */ new Set();
+	return workspaceDefinitions(ctx, pm).flatMap((definition) => workspaceDirectories(ctx, fs, definition, pm).flatMap((directory) => {
+		const root = resolveIn(ctx.root, directory);
+		const manifest = resolveIn(root, asRelPath("package.json"));
+		const denoManifest = resolveIn(root, asRelPath("deno.json"));
+		const denoJsonc = resolveIn(root, asRelPath("deno.jsonc"));
+		const allowed = new Set(pm === "deno" ? [
+			manifest,
+			denoManifest,
+			denoJsonc
+		] : [manifest]);
+		const memberFs = {
+			exists: (file) => allowed.has(file) && fs.exists(file),
+			readText: (file) => allowed.has(file) ? fs.readText(file) : void 0
+		};
+		try {
+			const explicitMember = definition.patterns.some((pattern) => !pattern.startsWith("!") && !/[*?]/u.test(pattern) && path.posix.normalize(pattern).replace(/\/+$/u, "") === directory);
+			if (!definition.denoManifests && !fs.exists(manifest)) {
+				if (pm === "deno" && explicitMember) throw new ConfigError("Declared npm workspace member has no package.json.");
+				return [];
+			}
+			if (pm === "deno" && !fs.exists(denoManifest) && fs.exists(denoJsonc)) throw new ConfigError("deno.jsonc is not supported; use strict deno.json.");
+			const memberCtx = createRepoContext(root, memberFs, projectType);
+			if (!definition.denoManifests && !memberCtx.packageJson) return [];
+			if (!memberCtx.packageJson && !memberCtx.exists(asRelPath("deno.json"))) {
+				if (definition.denoManifests && explicitMember) throw new ConfigError("Declared Deno member has no deno.json or package.json.");
+				return [];
+			}
+			if (pm === "deno") {
+				if (createConfigParser(codecFor, memberCtx)(CONFIG_FILES.denoJson).workspace !== void 0 || memberCtx.packageJson?.workspaces !== void 0) throw new ConfigError("Nested workspace declarations are not supported by Deno.");
+			}
+			if (seen.has(directory)) return [];
+			seen.add(directory);
+			return [{
+				directory,
+				pm,
+				ctx: memberCtx
+			}];
+		} catch (error) {
+			if (error instanceof ConfigError) throw new ConfigError(`${directory}/${error.message}`);
+			throw error;
+		}
+	}));
+});
+//#endregion
+//#region src/domain/setting-availability.ts
+const { npmrc: npmrc$7, packageJson: packageJson$2, pnpmWorkspace: pnpmWorkspace$11, yarnrc: yarnrc$10, bunfig: bunfig$6 } = CONFIG_FILES;
+const settingAvailability = [
+	{
+		pm: "npm",
+		file: npmrc$7,
+		keyPath: ["provenance"],
+		since: "9.5.0",
+		source: "https://github.com/npm/cli/releases/tag/v9.5.0"
+	},
+	{
+		pm: "npm",
+		file: packageJson$2,
+		keyPath: ["publishConfig", "provenance"],
+		since: "9.5.0",
+		source: "https://github.com/npm/cli/releases/tag/v9.5.0"
+	},
+	{
+		pm: "npm",
+		file: npmrc$7,
+		keyPath: ["min-release-age"],
+		since: "11.10.0",
+		source: "https://github.com/npm/cli/releases/tag/v11.10.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["strictDepBuilds"],
+		since: "10.6.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.6.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["dangerouslyAllowAllBuilds"],
+		since: "10.9.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.9.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["minimumReleaseAge"],
+		since: "10.16.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.16.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["minimumReleaseAgeExclude"],
+		since: "10.16.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.16.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["trustPolicy"],
+		since: "10.21.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.21.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["blockExoticSubdeps"],
+		since: "10.26.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.26.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["frozenStore"],
+		since: "11.7.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v11.7.0"
+	},
+	{
+		pm: "yarn",
+		file: yarnrc$10,
+		keyPath: ["enableHardenedMode"],
+		since: "4.0.0",
+		source: "https://yarnpkg.com/blog/release/4.0"
+	},
+	{
+		pm: "yarn",
+		file: yarnrc$10,
+		keyPath: ["npmMinimalAgeGate"],
+		since: "4.10.0",
+		source: "https://github.com/yarnpkg/berry/releases/tag/@yarnpkg/cli/4.10.0"
+	},
+	{
+		pm: "yarn",
+		file: yarnrc$10,
+		keyPath: ["npmPreapprovedPackages"],
+		since: "4.10.0",
+		source: "https://github.com/yarnpkg/berry/releases/tag/@yarnpkg/cli/4.10.0"
+	},
+	{
+		pm: "bun",
+		file: bunfig$6,
+		keyPath: ["install", "minimumReleaseAge"],
+		since: "1.3.0",
+		source: "https://bun.com/blog/bun-v1.3#minimum-release-age"
+	},
+	{
+		pm: "bun",
+		file: bunfig$6,
+		keyPath: [
+			"install",
+			"security",
+			"scanner"
+		],
+		since: "1.2.21",
+		source: "https://bun.com/blog/bun-v1.2.21#security-scanner-api-for-bun-install"
+	},
+	{
+		pm: "deno",
+		file: npmrc$7,
+		keyPath: ["min-release-age"],
+		since: "2.8.1",
+		source: "https://github.com/denoland/deno/releases/tag/v2.8.1"
+	}
+];
+//#endregion
+//#region src/domain/services/remediation-availability.ts
+const sameSetting = (setting, target) => target.file.path === setting.file.path && target.file.kind === setting.file.kind && target.keyPath.length === setting.keyPath.length && target.keyPath.every((key, index) => key === setting.keyPath[index]);
+/** Undefined means the target version or the setting's introduction is unknown. */
+const settingSupportedByTarget = (pm, version, target) => {
+	if (version === void 0) return void 0;
+	const availability = settingAvailability.find((setting) => setting.pm === pm && sameSetting(setting, target));
+	return availability === void 0 ? void 0 : !lt(version, availability.since);
+};
+/** Keep a proposal atomic and make known version prerequisites explicit. */
+const guardRemediationAvailability = (pm, version, remediation, targets = remediation?.kind === "automatic" ? remediation.operations : []) => {
+	if (version === void 0 || remediation === void 0) return remediation;
+	const unsupported = settingAvailability.filter((setting) => setting.pm === pm && lt(version, setting.since) && targets.some((target) => sameSetting(setting, target)));
+	if (unsupported.length === 0) return remediation;
+	return {
+		kind: "manual",
+		steps: [`Target ${pm} ${version} does not support this proposal: ${unsupported.map((setting) => `${setting.file.path}#${setting.keyPath.join(".")} requires ${pm} >=${setting.since}`).join("; ")}. Verify and upgrade the target before applying the steps below, or choose a supported security control. Removing a setting alone does not provide its protection.`, ...remediation.kind === "manual" ? remediation.steps : remediation.operations.map((operation) => `After upgrading, set ${operation.file.path}#${operation.keyPath.join(".")} to ${JSON.stringify(operation.value)}.`)]
+	};
 };
-/** Look up the codec for a parseable kind. Total — every CodecKind has one. */
-const codecFor = (kind) => CODECS[kind];
 //#endregion
 //#region src/domain/rules/remediation.ts
 /** Scalar writes must not discard an existing container or replace a non-object parent. */
@@ -561,10 +1186,14 @@ const checkKeyValue = (spec, config) => {
 		}])
 	};
 };
-const buildBinding = (spec, applies) => ({
+const buildBinding = (spec, pm, applies) => ({
 	check(ctx, config) {
 		if (typeof applies !== "undefined" && !applies(ctx)) return { state: "na" };
-		return checkKeyValue(spec, config);
+		const status = checkKeyValue(spec, config);
+		return status.state === "violation" ? {
+			...status,
+			remediation: guardRemediationAvailability(pm, ctx.pmVersion, status.remediation, [spec])
+		} : status;
 	},
 	docs: spec.docs,
 	file: spec.file,
@@ -578,7 +1207,7 @@ const requireConfigKey = (options) => {
 		const spec = options.bindings[pm];
 		if (typeof spec !== "undefined") {
 			if ("extraFix" in spec) throw new TypeError("extraFix is no longer supported; use a custom binding.");
-			bindings[pm] = buildBinding(spec, options.applies);
+			bindings[pm] = buildBinding(spec, pm, options.applies);
 		}
 	}
 	return {
@@ -605,39 +1234,6 @@ const withAubeParanoid = (rule) => {
 	} });
 };
 //#endregion
-//#region src/domain/entities/config-files.ts
-/** Known configuration locations and their parsers. */
-const CONFIG_FILES = {
-	aubeWorkspace: {
-		kind: "yaml",
-		path: asRelPath("aube-workspace.yaml")
-	},
-	bunfig: {
-		kind: "toml",
-		path: asRelPath("bunfig.toml")
-	},
-	denoJson: {
-		kind: "json",
-		path: asRelPath("deno.json")
-	},
-	npmrc: {
-		kind: "npmrc",
-		path: asRelPath(".npmrc")
-	},
-	packageJson: {
-		kind: "json",
-		path: asRelPath("package.json")
-	},
-	pnpmWorkspace: {
-		kind: "yaml",
-		path: asRelPath("pnpm-workspace.yaml")
-	},
-	yarnrc: {
-		kind: "yaml",
-		path: asRelPath(".yarnrc.yml")
-	}
-};
-//#endregion
 //#region src/domain/rules/advisory-check.ts
 const { aubeWorkspace: aubeWorkspace$8 } = CONFIG_FILES;
 const advisoryCheck = withAubeParanoid(requireConfigKey({
@@ -808,7 +1404,7 @@ const blockExoticSubdeps = overrideBindings(requireConfigKey({
 const { bunfig: bunfig$4 } = CONFIG_FILES;
 const bunSecurityScanner = defineRule({
 	bindings: { bun: {
-		check(_ctx, config) {
+		check(ctx, config) {
 			const scanner = getByPath(config, [
 				"install",
 				"security",
@@ -816,10 +1412,17 @@ const bunSecurityScanner = defineRule({
 			]);
 			if (isNonBlankString(scanner)) return { state: "ok" };
 			return {
-				remediation: {
+				remediation: guardRemediationAvailability("bun", ctx.pmVersion, {
 					kind: "manual",
 					steps: ["Add `[install.security] scanner = \"@socketsecurity/bun-security-scanner\"` (or another bun-compatible scanner) to bunfig.toml."]
-				},
+				}, [{
+					file: bunfig$4,
+					keyPath: [
+						"install",
+						"security",
+						"scanner"
+					]
+				}]),
 				actual: scanner,
 				message: "Configure `[install.security] scanner = \"...\"` in bunfig.toml (e.g. `@socketsecurity/bun-security-scanner`) to scan new packages on install.",
 				state: "violation"
@@ -827,7 +1430,7 @@ const bunSecurityScanner = defineRule({
 		},
 		docs: "https://bun.com/docs/pm/security-scanner-api",
 		file: bunfig$4,
-		versionNote: { configAvailableSince: "bun 1.3.0" }
+		versionNote: { configAvailableSince: "bun 1.2.21" }
 	} },
 	description: "Bun supports a Security Scanner API that intercepts new packages at install time (e.g. Socket Firewall).",
 	docs: "https://github.com/bodadotsh/npm-security-best-practices#preinstall-scanners",
@@ -1008,31 +1611,74 @@ const dependencyOverrides = defineRule({
 //#region src/domain/rules/disable-lifecycle-scripts.ts
 const { npmrc: npmrc$5, pnpmWorkspace: pnpmWorkspace$8, yarnrc: yarnrc$6, aubeWorkspace: aubeWorkspace$5, bunfig: bunfig$3 } = CONFIG_FILES;
 const pnpmBinding$4 = {
-	check(_ctx, config) {
+	check(ctx, config) {
 		if (getByPath(config, ["ignoreScripts"]) === true) return { state: "ok" };
 		const bypass = getByPath(config, ["dangerouslyAllowAllBuilds"]);
-		if (bypass === true) return {
-			actual: bypass,
-			expected: false,
-			remediation: {
-				kind: "manual",
-				steps: ["Remove `dangerouslyAllowAllBuilds: true` from pnpm-workspace.yaml (or set it to `false`). Setting `strictDepBuilds: true` alone has no effect while the bypass remains."]
-			},
-			message: "`dangerouslyAllowAllBuilds: true` in pnpm-workspace.yaml bypasses strictDepBuilds — remove it (or set it to false) to restore lifecycle-script gating.",
-			state: "violation"
-		};
 		const strict = getByPath(config, ["strictDepBuilds"]);
+		if (bypass === true) {
+			const bypassTarget = {
+				file: pnpmWorkspace$8,
+				keyPath: ["dangerouslyAllowAllBuilds"]
+			};
+			if (settingSupportedByTarget("pnpm", ctx.pmVersion, bypassTarget) === false) {
+				const proposal = {
+					kind: "manual",
+					steps: ["Remove `dangerouslyAllowAllBuilds: true` before upgrading to pnpm 10.9.0 or newer; the declared target ignores it, but a later version would activate the bypass.", ...strict === true ? [] : ["Set `strictDepBuilds: true` in pnpm-workspace.yaml to enable lifecycle-script gating for the declared target."]]
+				};
+				return {
+					state: "violation",
+					actual: bypass,
+					expected: false,
+					message: "The declared target ignores this future-version bypass. Removing the ignored bypass alone does not provide protection against lifecycle scripts, and leaving it configured would disable gating after an upgrade.",
+					remediation: strict === true ? proposal : guardRemediationAvailability("pnpm", ctx.pmVersion, proposal, [{
+						file: pnpmWorkspace$8,
+						keyPath: ["strictDepBuilds"]
+					}])
+				};
+			}
+			const proposal = {
+				kind: "manual",
+				steps: ["After upgrading, remove `dangerouslyAllowAllBuilds: true` (or set it to false) and configure lifecycle-script gating."]
+			};
+			const guarded = guardRemediationAvailability("pnpm", ctx.pmVersion, proposal, [{
+				file: pnpmWorkspace$8,
+				keyPath: ["strictDepBuilds"]
+			}, {
+				file: pnpmWorkspace$8,
+				keyPath: ["dangerouslyAllowAllBuilds"]
+			}]);
+			if (guarded !== proposal) return {
+				state: "violation",
+				actual: bypass,
+				expected: false,
+				message: "The target cannot use the proposed YAML lifecycle-script controls. Removing an unsupported bypass alone does not provide protection.",
+				remediation: guarded
+			};
+			return {
+				actual: bypass,
+				expected: false,
+				remediation: {
+					kind: "manual",
+					steps: ["Remove `dangerouslyAllowAllBuilds: true` from pnpm-workspace.yaml (or set it to `false`). Setting `strictDepBuilds: true` alone has no effect while the bypass remains."]
+				},
+				message: "`dangerouslyAllowAllBuilds: true` in pnpm-workspace.yaml bypasses strictDepBuilds — remove it (or set it to false) to restore lifecycle-script gating.",
+				state: "violation"
+			};
+		}
 		if (strict === true) return { state: "ok" };
 		return {
 			state: "violation",
 			actual: strict,
 			expected: true,
 			message: strict === void 0 ? "Set `strictDepBuilds: true` in pnpm-workspace.yaml to pin lifecycle-script gating across versions." : "Set `strictDepBuilds: true` in pnpm-workspace.yaml to block silent skips of un-approved dep builds.",
-			remediation: proposeChanges(config, [{
+			remediation: guardRemediationAvailability("pnpm", ctx.pmVersion, proposeChanges(config, [{
 				file: pnpmWorkspace$8,
 				keyPath: ["strictDepBuilds"],
 				op: "setKey",
 				value: true
+			}]), [{
+				file: pnpmWorkspace$8,
+				keyPath: ["strictDepBuilds"]
 			}])
 		};
 	},
@@ -1040,6 +1686,7 @@ const pnpmBinding$4 = {
 	file: pnpmWorkspace$8,
 	versionNote: {
 		configAvailableSince: "pnpm 10.3.0",
+		note: "pnpm-workspace.yaml settings require pnpm 10.6.0",
 		defaultSafeSince: "pnpm 11.0.0"
 	}
 };
@@ -1049,31 +1696,37 @@ const aubeBinding$2 = {
 		const jail = getByPath(config, ["jailBuilds"]);
 		const strict = getByPath(npmConfig, ["strictDepBuilds"]);
 		if (jail === true && strict === true) return { state: "ok" };
-		const jailRemedy = proposeChanges(config, [{
-			file: aubeWorkspace$5,
-			keyPath: ["jailBuilds"],
-			op: "setKey",
-			value: true
-		}]);
-		const strictRemedy = proposeChanges(npmConfig, [{
-			file: npmrc$5,
-			keyPath: ["strictDepBuilds"],
-			op: "setKey",
-			value: true
-		}]);
-		return {
+		const violations = [];
+		if (jail !== true) violations.push({
 			state: "violation",
-			file: jail !== true ? aubeWorkspace$5.path : npmrc$5.path,
-			actual: jail !== true ? jail : strict,
+			file: aubeWorkspace$5.path,
+			actual: jail,
 			expected: true,
-			message: "Set `jailBuilds: true` in aube-workspace.yaml and `strictDepBuilds=true` in .npmrc to sandbox approved builds and reject unreviewed lifecycle scripts.",
-			remediation: jailRemedy.kind === "automatic" && strictRemedy.kind === "automatic" ? {
-				kind: "automatic",
-				operations: [...jailRemedy.operations, ...strictRemedy.operations]
-			} : {
-				kind: "manual",
-				steps: [...jailRemedy.kind === "manual" ? jailRemedy.steps : ["Set `jailBuilds: true` in aube-workspace.yaml."], ...strictRemedy.kind === "manual" ? strictRemedy.steps : ["Set `strictDepBuilds=true` in .npmrc."]]
-			}
+			message: "Set `jailBuilds: true` in aube-workspace.yaml to sandbox approved builds.",
+			remediation: proposeChanges(config, [{
+				file: aubeWorkspace$5,
+				keyPath: ["jailBuilds"],
+				op: "setKey",
+				value: true
+			}])
+		});
+		if (strict !== true) violations.push({
+			state: "violation",
+			file: npmrc$5.path,
+			actual: strict,
+			expected: true,
+			message: "Set `strictDepBuilds=true` in .npmrc to reject unreviewed lifecycle scripts.",
+			remediation: proposeChanges(npmConfig, [{
+				file: npmrc$5,
+				keyPath: ["strictDepBuilds"],
+				op: "setKey",
+				value: true
+			}])
+		});
+		const [first, ...rest] = violations;
+		return !first ? { state: "ok" } : rest.length === 0 ? first : {
+			state: "violations",
+			violations: [first, ...rest]
 		};
 	},
 	docs: "https://aube.jdx.dev/security.html",
@@ -1196,7 +1849,7 @@ const resolvePackageJsonProjectType = (ctx) => {
 	const inferredPackage = pkg?.private !== true && isPublishableName(pkg?.name);
 	return resolveProjectType(ctx.projectType, inferredPackage);
 };
-const resolveDenoProjectType = (ctx, denoConfig) => resolveProjectType(ctx.projectType, isPublishableName(getByPath(denoConfig, ["name"])));
+const resolveDenoProjectType = (ctx, denoConfig) => resolveProjectType(ctx.projectType, getByPath(denoConfig, ["publish"]) !== false && isPublishableName(getByPath(denoConfig, ["name"])));
 //#endregion
 //#region src/domain/rules/publishable.ts
 const isPublishable = (ctx) => resolvePackageJsonProjectType(ctx) === "package";
@@ -1319,14 +1972,17 @@ const frozenLockfile = overrideBindings(requireConfigKey({
 const { pnpmWorkspace: pnpmWorkspace$6 } = CONFIG_FILES;
 const frozenStore = defineRule({
 	bindings: { pnpm: {
-		check(_ctx, config) {
+		check(ctx, config) {
 			const value = getByPath(config, ["frozenStore"]);
 			if (value === true) return { state: "ok" };
 			return {
-				remediation: {
+				remediation: guardRemediationAvailability("pnpm", ctx.pmVersion, {
 					kind: "manual",
 					steps: ["Populate the store before enabling `frozenStore: true`. Use it for read-only deployments; it is incompatible with --force and a configured pnpr server."]
-				},
+				}, [{
+					file: pnpmWorkspace$6,
+					keyPath: ["frozenStore"]
+				}]),
 				actual: value,
 				message: "For a pre-populated read-only store, consider `frozenStore` in pnpm-workspace.yaml. Normal installs need a writable store.",
 				state: "violation"
@@ -1416,6 +2072,14 @@ const isNonDisabledDenoDuration = (value) => {
 	if (value.exclude !== void 0 && !isStringList(value.exclude)) return false;
 	return value.age == null || isActiveDenoAge(value.age);
 };
+const denoAgeUsesFallback = (value) => {
+	if (value === void 0 || value === null) return true;
+	if (!isPlainRecord(value)) return false;
+	if (Object.keys(value).some((key) => key !== "age" && key !== "exclude")) return false;
+	if (value.exclude !== void 0 && !isStringList(value.exclude)) return false;
+	return value.age == null;
+};
+const isPositiveDenoNpmrcDays = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
 const minimumReleaseAge = overrideBindings(requireConfigKey({
 	bindings: {
 		aube: {
@@ -1473,7 +2137,7 @@ const minimumReleaseAge = overrideBindings(requireConfigKey({
 		file: npmrc$3,
 		docs: "https://docs.npmjs.com/cli/v12/using-npm/config#min-release-age",
 		versionNote: { note: "min-release-age available since npm 11.10.0" },
-		check(_ctx, config) {
+		check(ctx, config) {
 			const now = Date.now();
 			if (Object.hasOwn(config, "before")) {
 				const actual = config.before;
@@ -1485,7 +2149,13 @@ const minimumReleaseAge = overrideBindings(requireConfigKey({
 					message: "Use a valid past before cutoff, or remove before and set min-release-age.",
 					remediation: {
 						kind: "manual",
-						steps: [`In .npmrc, set before to a valid past date, or remove before and set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days. A future or disabled before overrides min-release-age in this file.`]
+						steps: ["In .npmrc, set before to a valid past date. A future or disabled before overrides min-release-age in this file.", ...guardRemediationAvailability("npm", ctx.pmVersion, {
+							kind: "manual",
+							steps: [`Alternatively, remove before and set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days.`]
+						}, [{
+							file: npmrc$3,
+							keyPath: ["min-release-age"]
+						}])?.steps ?? []]
 					}
 				};
 			}
@@ -1498,11 +2168,14 @@ const minimumReleaseAge = overrideBindings(requireConfigKey({
 				actual,
 				expected: RECOMMENDED_RELEASE_AGE_DAYS,
 				message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days to quarantine brand-new releases.`,
-				remediation: proposeChanges(config, [{
+				remediation: guardRemediationAvailability("npm", ctx.pmVersion, proposeChanges(config, [{
 					file: npmrc$3,
 					op: "setKey",
 					keyPath: ["min-release-age"],
 					value: RECOMMENDED_RELEASE_AGE_DAYS
+				}]), [{
+					file: npmrc$3,
+					keyPath: ["min-release-age"]
 				}])
 			};
 		}
@@ -1512,10 +2185,28 @@ const minimumReleaseAge = overrideBindings(requireConfigKey({
 		docs: "https://docs.deno.com/runtime/reference/deno_json/",
 		versionNote: {
 			defaultSafeSince: "deno 2.9.0 (1440 minutes)",
-			note: "object age may be omitted"
+			note: "object age may be omitted; project .npmrc fallback available since deno 2.8.1"
 		},
-		check(_ctx, config) {
+		check(ctx, config) {
 			const actual = getByPath(config, ["minimumDependencyAge"]);
+			if (denoAgeUsesFallback(actual)) {
+				const npmrcConfig = ctx.readConfig(npmrc$3);
+				const npmrcAge = getByPath(npmrcConfig, ["min-release-age"]);
+				if (isPositiveDenoNpmrcDays(npmrcAge)) return { state: "ok" };
+				if (npmrcAge === 0) return {
+					state: "violation",
+					actual: npmrcAge,
+					expected: RECOMMENDED_RELEASE_AGE_DAYS,
+					file: npmrc$3.path,
+					message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days in .npmrc, or set minimumDependencyAge in deno.json.`,
+					remediation: proposeChanges(npmrcConfig, [{
+						file: npmrc$3,
+						op: "setKey",
+						keyPath: ["min-release-age"],
+						value: RECOMMENDED_RELEASE_AGE_DAYS
+					}])
+				};
+			}
 			if (isNonDisabledDenoDuration(actual)) return { state: "ok" };
 			const objectAge = isPlainRecord(actual);
 			const invalidObject = objectAge && (Object.keys(actual).some((key) => key !== "age" && key !== "exclude") || actual.exclude !== void 0 && !isStringList(actual.exclude));
@@ -1943,6 +2634,57 @@ const strictStoreIntegrity = defineRule({
 //#endregion
 //#region src/domain/rules/trust-policy.ts
 const { aubeWorkspace, pnpmWorkspace } = CONFIG_FILES;
+const trustPolicy = withAubeParanoid(requireConfigKey({
+	bindings: {
+		aube: {
+			docs: "https://aube.jdx.dev/security.html",
+			documentedDefault: "no-downgrade",
+			file: aubeWorkspace,
+			keyPath: ["trustPolicy"],
+			message: "Set `trustPolicy: no-downgrade` in aube-workspace.yaml to block packages whose trust level has decreased.",
+			value: "no-downgrade"
+		},
+		pnpm: {
+			docs: "https://pnpm.io/settings#trustpolicy",
+			file: pnpmWorkspace,
+			keyPath: ["trustPolicy"],
+			message: "Set `trustPolicy: no-downgrade` in pnpm-workspace.yaml to block packages whose trust level has decreased.",
+			value: "no-downgrade",
+			versionNote: { configAvailableSince: "pnpm 10.21.0" }
+		}
+	},
+	description: "Fail installation when a package trust level has decreased compared to previous releases, catching publisher credential downgrades.",
+	docs: "https://pnpm.io/settings#trustpolicy",
+	id: "trust-policy",
+	severity: "warn",
+	title: "Enforce trust policy on dependency updates"
+}));
+//#endregion
+//#region src/domain/rules/unsupported-settings.ts
+const bindingFor = (pm) => {
+	const settings = settingAvailability.filter((setting) => setting.pm === pm);
+	return { check(ctx) {
+		const version = ctx.pmVersion;
+		if (version === void 0) return { state: "na" };
+		const unsupported = settings.filter((setting) => lt(version, setting.since) && getByPath(ctx.readConfig(setting.file), setting.keyPath) !== void 0);
+		const [first, ...rest] = [...new Set(unsupported.map((setting) => setting.file.path))].map((file) => {
+			const fileSettings = unsupported.filter((setting) => setting.file.path === file);
+			return {
+				state: "violation",
+				file,
+				message: `Target ${pm} ${version} predates support for ${file}: ${fileSettings.map((setting) => `${setting.keyPath.join(".")} (requires ${pm} >=${setting.since})`).join("; ")}.`,
+				remediation: {
+					kind: "manual",
+					steps: ["Verify the PM version used by your install or publish command. If the declared target is accurate, upgrade the PM or use a security control supported by that target; removing a setting alone does not provide its protection.", ...fileSettings.map((setting) => `${setting.file.path}#${setting.keyPath.join(".")}: ${setting.source}`)]
+				}
+			};
+		});
+		return first ? {
+			state: "violations",
+			violations: [first, ...rest]
+		} : { state: "ok" };
+	} };
+};
 //#endregion
 //#region src/domain/builtin-rules.ts
 const rules = [
@@ -1972,31 +2714,21 @@ const rules = [
 	strictAllowScripts,
 	strictReleaseAge,
 	strictStoreIntegrity,
-	withAubeParanoid(requireConfigKey({
+	trustPolicy,
+	defineRule({
+		id: "unsupported-settings",
+		title: "Use settings available in the target PM version",
+		description: "Report configured settings whose recorded introduction version is newer than the declared or explicit stable PM target. Reports each affected file separately, grouping its unsupported keys. Workspace findings retain their member directory. Only the coverage table below is checked. Unknown targets and unlisted settings are not evaluated for availability.",
+		severity: "error",
+		docs: "https://github.com/pHo9UBenaA/siro/blob/main/docs/rules.md#unsupported-settings--error",
 		bindings: {
-			aube: {
-				docs: "https://aube.jdx.dev/security.html",
-				documentedDefault: "no-downgrade",
-				file: aubeWorkspace,
-				keyPath: ["trustPolicy"],
-				message: "Set `trustPolicy: no-downgrade` in aube-workspace.yaml to block packages whose trust level has decreased.",
-				value: "no-downgrade"
-			},
-			pnpm: {
-				docs: "https://pnpm.io/settings#trustpolicy",
-				file: pnpmWorkspace,
-				keyPath: ["trustPolicy"],
-				message: "Set `trustPolicy: no-downgrade` in pnpm-workspace.yaml to block packages whose trust level has decreased.",
-				value: "no-downgrade",
-				versionNote: { configAvailableSince: "pnpm 10.21.0" }
-			}
-		},
-		description: "Fail installation when a package trust level has decreased compared to previous releases, catching publisher credential downgrades.",
-		docs: "https://pnpm.io/settings#trustpolicy",
-		id: "trust-policy",
-		severity: "warn",
-		title: "Enforce trust policy on dependency updates"
-	}))
+			npm: bindingFor("npm"),
+			pnpm: bindingFor("pnpm"),
+			yarn: bindingFor("yarn"),
+			bun: bindingFor("bun"),
+			deno: bindingFor("deno")
+		}
+	})
 ];
 //#endregion
 //#region src/domain/services/apply-config.ts
@@ -2076,27 +2808,6 @@ const resolvePMs = (ctx, opts) => {
 /** Resolve the most specific severity signal for one finding. */
 const decideSeverity = (status, binding, rule, userOverride) => userOverride ?? status.severity ?? binding.severity ?? rule.severity;
 //#endregion
-//#region src/domain/services/parse-config-file.ts
-const EMPTY_FILE = Object.freeze({});
-/** Create a fresh parser and cache for one lint command. */
-const createConfigParser = (codecFor, ctx) => {
-	const cache = /* @__PURE__ */ new Map();
-	return (file) => {
-		if (file === void 0) return EMPTY_FILE;
-		const cacheKey = `${file.kind}:${file.path}`;
-		const cached = cache.get(cacheKey);
-		if (cached !== void 0) return cached;
-		const text = ctx.readText(file.path);
-		if (text === void 0) {
-			cache.set(cacheKey, EMPTY_FILE);
-			return EMPTY_FILE;
-		}
-		const parsed = wrapCodecError(file.path, () => codecFor(file.kind).parse(text));
-		cache.set(cacheKey, parsed);
-		return parsed;
-	};
-};
-//#endregion
 //#region src/domain/services/render-version-note.ts
 const buildVersionNoteParts = (versionNote) => {
 	const parts = [];
@@ -2128,29 +2839,33 @@ const runLint = (opts) => {
 		warn: 0
 	};
 	const parseConfig = createConfigParser(codecFor, ctx);
-	const ruleContext = {
-		...ctx,
-		readConfig: parseConfig
-	};
 	for (const rule of ruleSet) for (const pm of pms) {
 		const binding = rule.bindings[pm];
 		if (!binding || rule.projectTypes && !rule.projectTypes.includes(resolveBindingProjectType(ctx, pm, parseConfig))) continue;
-		const status = binding.check(ruleContext, parseConfig(binding.file));
-		if (!isCheckStatusShape(status)) throw new ConfigError(`Rule '${rule.id}' returned an invalid check result.`);
-		if (status.state !== "violation") continue;
-		const finding = {
-			ruleId: rule.id,
-			pm,
-			severity: decideSeverity(status, binding, rule, severityOverrides?.get(rule.id)),
-			message: renderVersionNoteMessage(status.message, binding.versionNote),
-			file: status.file ?? binding.file?.path,
-			docs: binding.docs ?? rule.docs,
-			actual: status.actual,
-			expected: status.expected,
-			remediation: status.remediation
+		const ruleContext = {
+			...ctx,
+			readConfig: parseConfig,
+			pmVersion: opts.pmVersions?.[pm]
 		};
-		findings.push(finding);
-		summary[finding.severity] += 1;
+		const response = binding.check(ruleContext, parseConfig(binding.file));
+		if (!isCheckStatusShape(response)) throw new ConfigError(`Rule '${rule.id}' returned an invalid check result.`);
+		const statuses = response.state === "violations" ? response.violations : [response];
+		for (const status of statuses) {
+			if (status.state !== "violation") continue;
+			const finding = {
+				ruleId: rule.id,
+				pm,
+				severity: decideSeverity(status, binding, rule, severityOverrides?.get(rule.id)),
+				message: renderVersionNoteMessage(status.message, binding.versionNote),
+				file: status.file ?? binding.file?.path,
+				docs: binding.docs ?? rule.docs,
+				actual: status.actual,
+				expected: status.expected,
+				remediation: guardRemediationAvailability(pm, ruleContext.pmVersion, status.remediation)
+			};
+			findings.push(finding);
+			summary[finding.severity] += 1;
+		}
 	}
 	return {
 		findings,
@@ -2165,6 +2880,8 @@ const prepareLint = (options) => {
 	if ("customRules" in options || "reporters" in options) throw new UsageError("Pass customRules and reporters inside the config option.");
 	if (options.pm !== void 0 && !isPM(options.pm)) throw new UsageError(`Unknown package manager: ${String(options.pm)}`);
 	if (options.projectType !== void 0 && !isProjectType(options.projectType)) throw new UsageError(`Unknown project type: ${String(options.projectType)}`);
+	if (options.pmVersion !== void 0 && (!options.pm || !isStableVersion(options.pmVersion))) throw new UsageError("pmVersion / --pm-version requires pm / --pm and an exact stable version such as 10.16.0.");
+	if (options.workspaces !== void 0 && typeof options.workspaces !== "boolean") throw new UsageError("workspaces must be a boolean.");
 	const config = options.config === void 0 ? void 0 : parseConfig(options.config);
 	const ctx = createRepoContext(options.cwd, options.fs, options.projectType ?? config?.projectType);
 	const pms = resolvePMs(ctx, {
@@ -2173,16 +2890,61 @@ const prepareLint = (options) => {
 	});
 	if (pms.includes("deno") && !ctx.exists(asRelPath("deno.json")) && ctx.exists(asRelPath("deno.jsonc"))) throw new ConfigError("deno.jsonc is not supported. siro currently reads strict JSON from deno.json only.");
 	const configured = applyConfig(rules, config);
+	const pmVersions = {
+		...declaredPMVersion(ctx.packageJson?.packageManager),
+		...config?.pmVersions,
+		...options.pm && options.pmVersion ? { [options.pm]: options.pmVersion } : {}
+	};
+	const fs = options.fs ?? nodeFileSystem;
 	return {
 		ctx,
 		pms,
+		pmVersions,
+		members: options.workspaces ? collectWorkspaceMembers(ctx, fs, pms, options.projectType ?? config?.projectType) : [],
 		ruleSet: configured.rules,
 		severityOverrides: configured.severityOverrides,
 		codecFor,
 		reporters: config?.reporters ?? []
 	};
 };
-const lint = (options) => runLint(prepareLint(options));
+/** Reuse the existing manifest checks; installation policy remains rooted at cwd. */
+const runPreparedLint = (prepared) => {
+	const result = runLint(prepared);
+	const findings = [...result.findings];
+	const summary = { ...result.summary };
+	const memberRules = prepared.ruleSet.filter((rule) => [
+		"files-field",
+		"publish-access",
+		"unsupported-settings"
+	].includes(rule.id));
+	for (const member of prepared.members) {
+		const child = runLint({
+			...prepared,
+			ctx: member.ctx,
+			pms: [member.pm],
+			ruleSet: memberRules
+		});
+		for (const finding of child.findings) findings.push({
+			...finding,
+			file: `${member.directory}/${finding.file ?? "package.json"}`,
+			message: `${member.directory}: ${finding.message}`,
+			remediation: finding.remediation?.kind === "manual" ? {
+				kind: "manual",
+				steps: [`Work in ${member.directory} for this finding.`, ...finding.remediation.steps]
+			} : finding.remediation
+		});
+		for (const level of [
+			"error",
+			"warn",
+			"info"
+		]) summary[level] += child.summary[level];
+	}
+	return {
+		findings,
+		summary
+	};
+};
+const lint = (options) => runPreparedLint(prepareLint(options));
 //#endregion
 //#region src/application/commands/lint.ts
 /** Evaluate and report. Executable config loading belongs to the CLI adapter. */
@@ -2194,9 +2956,9 @@ const lintCommand = async (options, io) => {
 	const selection = options.reporter ?? DEFAULT_REPORTER_NAME;
 	const reporter = typeof selection === "string" ? registry.get(selection) : selection;
 	if (!isReporterShape(reporter)) throw new UsageError(`${typeof selection === "string" ? "Unknown" : "Invalid"} reporter: ${String(selection)} (available: ${[...registry.keys()].join(", ")})`);
-	const result = runLint(prepared);
+	const result = runPreparedLint(prepared);
 	const exitCode = exitCodeForLint(result, options.severity ?? "error");
-	reporter.format(filterBySeverity(result, options.severity ?? "info"), io);
+	await reporter.format(filterBySeverity(result, options.severity ?? "info"), io);
 	return exitCode;
 };
 //#endregion
@@ -2206,6 +2968,6 @@ const nodeIO = {
 	stdout: (line) => process.stdout.write(`${line}\n`)
 };
 //#endregion
-export { ConfigError as A, SUPPORTED_NODE_RANGE as C, isNodeError as D, nodeFileSystem as E, UsageError as M, asAbsPath as O, isSeverity as S, assertDirectory as T, PROJECT_TYPES as _, overrideBindings as a, SEVERITIES as b, DEFAULT_REPORTER_NAME as c, jsonReporter as d, version as f, getByPath as g, defineRule as h, CONFIG_FILES as i, SiroError as j, asRelPath as k, JSON_REPORTER_NAME as l, loadConfig as m, lintCommand as n, requireConfigKey as o, githubReporter as p, lint as r, BUILTIN_REPORTER_NAMES as s, nodeIO as t, prettyReporter as u, isProjectType as v, isSupportedNodeVersion as w, isPM as x, PMS as y };
+export { ConfigError as A, SUPPORTED_NODE_RANGE as C, isNodeError as D, nodeFileSystem as E, UsageError as M, asAbsPath as O, isSeverity as S, assertDirectory as T, PROJECT_TYPES as _, requireConfigKey as a, SEVERITIES as b, DEFAULT_REPORTER_NAME as c, jsonReporter as d, version as f, getByPath as g, defineRule as h, overrideBindings as i, SiroError as j, asRelPath as k, JSON_REPORTER_NAME as l, loadConfig as m, lintCommand as n, CONFIG_FILES as o, githubReporter as p, lint as r, BUILTIN_REPORTER_NAMES as s, nodeIO as t, prettyReporter as u, isProjectType as v, isSupportedNodeVersion as w, isPM as x, PMS as y };
 
-//# sourceMappingURL=node-io-B3Hbcwyn.mjs.map
+//# sourceMappingURL=node-io-CaqobxYp.mjs.map