@pho9ubenaa/siro 0.4.3 → 0.5.1

package/CHANGELOG.md

@@ -1,5 +1,70 @@
 # Changelog
 
+## [0.5.1]
+
+### Refactoring
+
+- Reorganize runtime code around explicit domain and application ports, concrete adapters, and outer composition while preserving the public API, CLI, JSON schema, package-manager policy, and error behavior.
+- Make the source dependency graph acyclic and enforce inward dependencies with TypeScript module resolution, including type imports, re-exports, host globals, and unresolved local modules.
+- Move filesystem, path, glob, configuration loading, reporting, and clock behavior behind focused boundaries. Keep JavaScript date parsing in the adapter and inject the current time into release-age policy.
+- Centralize workspace pattern classification and Deno release-age parsing, replacing incidental regular expressions and string rewrites where direct string operations are clearer.
+
+### Maintenance
+
+- Consolidate tests around observable decisions, failures, public wiring, CLI behavior, and installed-package contracts. Remove duplicate, implementation-coupled, mock-self-verifying, and library-guarantee cases.
+- Add architecture and maintainer documentation for dependency direction, composition, ports, adapters, and behavioral contracts.
+- Invite real-world feedback through GitHub Issues and explain how GitHub Stars inform time spent on future features and maintenance.
+
+### Compatibility
+
+- This release changes internal structure and test coverage only. Existing public exports, synchronous `lint`, asynchronous `lintCommand`, CLI flags and exit codes, JSON schema 2, supported package-manager behavior, and Node.js range remain unchanged.
+
+## [0.5.0]
+
+### Features
+
+- Allow custom checks to return a nonempty `violations` group. Report unsupported settings separately per file and Aube lifecycle controls separately per missing file. JSON schema 2 is unchanged; exhaustive `CheckStatus` consumers must handle the new variant.
+- Add optional `FileSystem.resolveDirectory` for Deno's native positive literal-prefix lookup, retaining minimatch and existing dependencies. Virtual filesystems without this port resolve exact child names. Negative patterns retain lexical applicability; conflicting overlapping bases fail explicitly.
+
+- Add `unsupported-settings` to report configured settings introduced after a declared or explicit stable PM version. Cover 16 setting/file pairs across npm, pnpm, Yarn, Bun, and Deno, with a generated table of release sources.
+- Resolve each manager's target from `package.json#packageManager`, `config.pmVersions`, or the higher-priority `--pm-version` / API `pmVersion` option (which requires `--pm` / `pm`). Expose the resolved target as `RuleContext.pmVersion` for custom rules.
+- Preserve name detection when a declaration has no exact stable version. Reject ranges, tags, partial versions, and prereleases in explicit targets; accept build metadata such as Corepack hashes.
+- Add opt-in `--workspaces` / API `workspaces: true` to inspect declared npm, pnpm, Yarn, Bun, Deno, and Aube members' publication metadata. Reuse existing rules, identify member file paths, and aggregate severity counts and CLI exit status.
+- Add optional `FileSystem.readDirectories` for workspace discovery in virtual repositories, without falling back to host IO.
+
+### Behavior and scope
+
+- The new rule defaults to `error`; projects with previously accepted unsupported settings may now exit 1. Existing security checks, severity overrides, and JSON schema 2 remain in effect.
+- Availability checks cover recorded introductions in the listed files, not whole PM schemas, runtime discovery, removals, backports, version-specific value syntax, or effective defaults. Deno coverage is limited to `.npmrc#min-release-age`; Aube retains its existing checks without introduction coverage in this release.
+- Distinguish pnpm's strict-build setting introduction (10.3.0) from general workspace YAML support (10.6.0), and correct Bun's scanner introduction note to 1.2.21.
+- Keep shared installation and lockfile checks at the root. Members infer their own publication status and use the root's PM target; child executable configs are not loaded. Workspace discovery requires explicit declarations, excludes directory symlinks, and does not cover effective configuration inheritance. Deno/Aube use bounded, source-derived declaration semantics.
+
+### Fixes
+
+- Update `smol-toml` to 1.8.0 and Vitest to 4.1.11 to include upstream security fixes.
+- Honor Deno 2.8.1+'s project `.npmrc#min-release-age` fallback when `deno.json` does not provide an age, while retaining `deno.json` precedence and reporting an explicit zero opt-out.
+- For pnpm targets before 10.9.0, recommend supported `strictDepBuilds` gating without claiming that the ignored future-version bypass requires pnpm 10.9.0.
+- Keep nested workspace candidates visible when only their ancestor candidate is excluded. Prune traversal only when a trailing `/**` exclusion covers the subtree.
+- Reject workspace patterns whose brace-expanded alternatives contain parent traversal or exceed 8,192 entries before compilation, and avoid backtracking in Aube exclusion matching.
+- Match npm's odd/even interpretation of repeated leading `!` characters.
+- Match Bun's workspace ordering and syntax classification: explicit members remain included, later positive globs can re-include earlier exclusions, and extglob punctuation stays literal.
+- Exclude `CMakeFiles` from Bun glob traversal while retaining explicitly named members below it, matching Bun's walker and literal-member path.
+- Honor npm's ordered cancellation of workspace exclusions, including its handling of adjacent repeated exclusions.
+- Match npm's leading-`#` comment behavior while retaining `#` in nested path segments.
+- Permit colons in ordinary relative workspace segments while continuing to reject absolute and drive-letter paths.
+- Report rejected workspace glob patterns as configuration errors (exit 2) instead of internal crashes (exit 70).
+- Reject non-file manifest inputs before reading, preventing root and workspace FIFO manifests from blocking the scan.
+- Match literal workspace path segments and exclusions case-insensitively on macOS and Windows, so declaration casing does not silently omit members.
+- Use minimatch consistently for workspace membership, exclusions, and traversal. Remove custom brace expansion and globstar matching.
+- Limit workspace traversal using each applicable pattern's own depth, preserving errors from required directory reads.
+- Wait for asynchronous reporters and propagate their failures through the command's error handling.
+- Reject non-file entries at configuration and lockfile paths instead of accepting directories as existing files.
+
+### Verification
+
+- Exercise version boundaries, selection precedence, multi-manager isolation, invalid targets, CLI exit codes, custom-rule context, and the installed package's API and strict types.
+- Exercise workspace patterns, exclusions, duplicate matches, malformed child manifests, private roots with public children, injected IO, and installed CLI/API member inspection.
+
 ## [0.4.3]
 
 ### Maintenance

package/README.md

@@ -38,7 +38,7 @@ The CLI reads `siro.config.*` as executable code. Review repository configuratio
 
 ## Features
 
-- **Rules across six managers.** 27 rules covering lifecycle scripts, version pinning, lockfiles
+- **Rules across six managers.** 28 rules covering lifecycle scripts, version pinning, lockfiles
   (`commit`/`frozen`), release age, publish provenance, `files`/`publishConfig`, SSL enforcement,
   checksum verification, exotic subdependency blocking, audit suppression review, store integrity,
   Bun's security scanner API, and Yarn 4's hardened-mode — each mapped to the right setting per
@@ -50,6 +50,12 @@ The CLI reads `siro.config.*` as executable code. Review repository configuratio
 - **Machine-readable remediation.** A finding can carry automatic key operations or manual
   instructions. Review proposed changes and rerun the linter after editing.
   See [docs/json-output.md](docs/json-output.md).
+- **Target PM versions.** Flag settings introduced after the declared or explicit stable PM
+  version. See [checked settings and sources](docs/rules.md#checked-introduction-versions)
+  for the npm, pnpm, Yarn, Bun, and Deno coverage.
+- **Workspace members.** `--workspaces` adds publication-metadata checks for declared npm,
+  pnpm, Yarn, Bun, Deno, and Aube members, including public packages under a private root.
+  See [workspace inspection](docs/configuration.md#workspace-members) for scope and exclusions.
 - **Lint with severities.** `error` fails CI by default; `--severity warn` tightens the gate.
 - **Reporters.** `pretty` (default), `json` for CI, `github` for PR annotations; register your own.
 - **Configurable.** Drop a `siro.config.ts` to disable rules, override severities, restrict PMs,
@@ -61,8 +67,10 @@ See the [rule reference](docs/rules.md) for what each check does and why, and th
 ## Versioning policy
 
 siro evaluates the recorded policy snapshot in [docs/policy-sources.md](docs/policy-sources.md).
-It detects package-manager names, not effective runtime versions. Version annotations describe
-verified upstream facts. A version-dependent safe-default annotation prevents an unverified
+It detects package-manager names and reads exact stable targets from `packageManager`,
+`config.pmVersions`, or `--pm-version`. It does not inspect installed binaries. The
+`unsupported-settings` rule checks recorded introduction versions; unlisted settings and
+unknown targets are not evaluated for availability. A version-dependent safe-default annotation prevents an unverified
 severity downgrade; it does not prove that the current version satisfies the rule. See
 [configuration](docs/configuration.md) for defaults, applicability, and limits.
 
@@ -72,6 +80,8 @@ severity downgrade; it does not prove that the current version satisfies the rul
 siro <lint|check> [path] [options]
 
   --pm <npm|pnpm|yarn|bun|deno|aube>   Target a specific package manager (auto-detected; required if detection finds nothing)
+  --pm-version <x.y.z>                Exact stable target version (requires --pm)
+  --workspaces                       Also inspect workspace members' publication metadata
   --project-type <application|package> Select application or published-package policy (default auto)
   --reporter <pretty|json|github>      Output format (default pretty)
   --severity <error|warn|info>         Show and fail on findings at or above this level
@@ -99,6 +109,11 @@ Different layer of the supply-chain pipeline; you want both.
 Adding a rule or a package manager is a localized change — see
 [docs/contributing.md](docs/contributing.md).
 
+If siro is useful to you, a [GitHub Star](https://github.com/pHo9UBenaA/siro) would be appreciated.
+Stars help me decide how much time to devote to future features and maintenance.
+Please share feedback from real-world use and feature requests in
+[GitHub Issues](https://github.com/pHo9UBenaA/siro/issues).
+
 ## License
 
 MIT

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as SUPPORTED_NODE_RANGE, D as isNodeError, M as UsageError, O as asAbsPath, S as isSeverity, T as assertDirectory, _ as PROJECT_TYPES, b as SEVERITIES, c as DEFAULT_REPORTER_NAME, f as version, j as SiroError, l as JSON_REPORTER_NAME, m as loadConfig, n as lintCommand, s as BUILTIN_REPORTER_NAMES, t as nodeIO, v as isProjectType, w as isSupportedNodeVersion, x as isPM, y as PMS } from "./node-io-B3Hbcwyn.mjs";
+import { C as SUPPORTED_NODE_RANGE, D as isNodeError, M as UsageError, O as asAbsPath, S as isSupportedNodeVersion, T as assertDirectory, _ as isProjectType, a as DEFAULT_REPORTER_NAME, b as isPM, g as PROJECT_TYPES, i as BUILTIN_REPORTER_NAMES, j as SiroError, o as JSON_REPORTER_NAME, p as loadConfig, r as lintCommand, t as nodeIO, v as PMS, w as version, x as isSeverity, y as SEVERITIES } from "./node-io-BDHg4J2w.mjs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
@@ -33,6 +33,7 @@ const isCommandName = (value) => COMMANDS.some((cmd) => cmd === value);
 //#region src/cli/parse-args.ts
 const VALUE_FLAGS = new Set([
 	"pm",
+	"pm-version",
 	"project-type",
 	"reporter",
 	"severity"
@@ -40,7 +41,8 @@ const VALUE_FLAGS = new Set([
 const BOOLEAN_FLAGS = new Set([
 	"help",
 	"version",
-	"json"
+	"json",
+	"workspaces"
 ]);
 const parseCommand = (argv) => {
 	const { tokens } = parseArgs({
@@ -110,10 +112,13 @@ const parseCommand = (argv) => {
 	if (extra.length > 0) throw new UsageError(`Unexpected extra argument: ${extra.join(" ")}`);
 	if (flags.has("reporter") && flags.has("json")) throw new UsageError("Invalid reporter selection: use either --reporter or --json.");
 	const reporter = flags.get("reporter");
+	const pmVersion = flags.get("pm-version");
 	return {
 		kind: "lint",
 		cwd: asAbsPath(path.resolve(cwd ?? process.cwd())),
 		pm: parsePmFlag(flags.get("pm")),
+		pmVersion: typeof pmVersion === "string" ? pmVersion : void 0,
+		workspaces: flags.has("workspaces") || void 0,
 		projectType: parseProjectTypeFlag(flags.get("project-type")),
 		severity: parseSeverityFlag(flags.get("severity")),
 		reporter: typeof reporter === "string" ? reporter : flags.has("json") ? JSON_REPORTER_NAME : DEFAULT_REPORTER_NAME
@@ -128,6 +133,8 @@ const SEVERITIES_LIST = SEVERITIES.join("|");
 const FLAG_LINES = {
 	json: "  --json               Shortcut for --reporter json",
 	pm: `  --pm <name>          Target a specific package manager (${PMS_LIST})`,
+	pmVersion: "  --pm-version <x.y.z>  Target an exact stable PM version (requires --pm)",
+	workspaces: "  --workspaces         Also check workspace members' publication metadata",
 	projectType: `  --project-type <type>  Project type (${PROJECT_TYPES_LIST}; default auto)`,
 	reporter: `  --reporter <name>    Reporter (${REPORTERS_LIST}; additional reporters can be registered via siro.config.ts)`,
 	severity: `  --severity <level>   Show + fail on findings at or above this level (${SEVERITIES_LIST})`
@@ -143,6 +150,8 @@ const HELP_ROOT = [
 	"",
 	"GLOBAL FLAGS",
 	FLAG_LINES.pm,
+	FLAG_LINES.pmVersion,
+	FLAG_LINES.workspaces,
 	FLAG_LINES.projectType,
 	"  --version            Print the siro version",
 	"  --help               Show help for siro or a command",
@@ -171,6 +180,8 @@ const HELP_LINT = [
 	"",
 	"FLAGS",
 	FLAG_LINES.pm,
+	FLAG_LINES.pmVersion,
+	FLAG_LINES.workspaces,
 	FLAG_LINES.projectType,
 	FLAG_LINES.reporter,
 	FLAG_LINES.json,

package/dist/index.d.mts

@@ -1,5 +1,16 @@
 import * as vb from "valibot";
 
+//#region src/shared/paths.d.ts
+declare const AbsPathBrand: unique symbol;
+declare const RelPathBrand: unique symbol;
+type AbsPath = string & {
+  readonly [AbsPathBrand]: true;
+};
+type RelPath = string & {
+  readonly [RelPathBrand]: true;
+};
+declare const asRelPath: (value: string) => RelPath;
+//#endregion
 //#region src/domain/entities/config-value.d.ts
 declare const CODEC_KINDS: readonly ["json", "npmrc", "toml", "yaml"];
 type CodecKind = (typeof CODEC_KINDS)[number];
@@ -16,23 +27,11 @@ type ConfigReadValue = unknown;
 /** Read an own key path; absent or non-mapping parents yield undefined. */
 declare const getByPath: (config: ParsedConfig, keyPath: KeyPath) => ConfigReadValue;
 //#endregion
-//#region src/shared/paths.d.ts
-declare const AbsPathBrand: unique symbol;
-declare const RelPathBrand: unique symbol;
-type AbsPath = string & {
-  readonly [AbsPathBrand]: true;
-};
-type RelPath = string & {
-  readonly [RelPathBrand]: true;
-};
-declare const asAbsPath: (value: string) => AbsPath;
-declare const asRelPath: (value: string) => RelPath;
-//#endregion
-//#region src/domain/ports/file-system.d.ts
-/** IO boundary: swap in memfs (or any other backend) for tests. */
-interface FileSystem {
-  readText: (path: AbsPath) => string | undefined;
-  exists: (path: AbsPath) => boolean;
+//#region src/domain/entities/config-file-ref.d.ts
+/** A repository-relative configuration location, independent of any rule. */
+interface ConfigFileRef {
+  readonly kind: CodecKind;
+  readonly path: RelPath;
 }
 //#endregion
 //#region src/domain/entities/pms.d.ts
@@ -48,10 +47,6 @@ type Severity = (typeof SEVERITIES)[number];
 declare const isPM: (value: string) => value is PM;
 declare const isSeverity: (value: string) => value is Severity;
 //#endregion
-//#region src/domain/entities/project-type.d.ts
-declare const PROJECT_TYPES: readonly ["application", "package"];
-type ProjectType = (typeof PROJECT_TYPES)[number];
-//#endregion
 //#region src/domain/schemas/package-json.d.ts
 declare const PackageJsonSchema: vb.LooseObjectSchema<{
   readonly files: vb.OptionalSchema<vb.ArraySchema<vb.StringSchema<undefined>, undefined>, undefined>;
@@ -65,6 +60,10 @@ declare const PackageJsonSchema: vb.LooseObjectSchema<{
 }, undefined>;
 type PackageJson = vb.InferOutput<typeof PackageJsonSchema>;
 //#endregion
+//#region src/domain/entities/project-type.d.ts
+declare const PROJECT_TYPES: readonly ["application", "package"];
+type ProjectType = (typeof PROJECT_TYPES)[number];
+//#endregion
 //#region src/domain/ports/repo-context.d.ts
 /** Read-only view of a repository, passed to every rule's `check`. */
 interface RepoContext {
@@ -76,14 +75,12 @@ interface RepoContext {
 }
 /** Settings read during one evaluation share its parser and cache. */
 interface RuleContext extends RepoContext {
+  /** Declared or explicit stable version of this binding's manager, if known. */
+  readonly pmVersion?: string;
   readConfig: (file: ConfigFileRef) => ParsedConfig;
 }
 //#endregion
 //#region src/domain/entities/rule.d.ts
-interface ConfigFileRef {
-  readonly kind: CodecKind;
-  readonly path: RelPath;
-}
 interface SetKeyOperation {
   readonly op: 'setKey';
   readonly file: ConfigFileRef;
@@ -100,18 +97,24 @@ type Remediation = {
   readonly steps: readonly [string, ...string[]];
   readonly operations?: never;
 };
-type CheckStatus = {
-  readonly state: 'ok';
-} | {
-  readonly state: 'na';
-} | {
+interface ViolationStatus {
   readonly state: 'violation';
-  readonly message: string; /** Override the primary file when the violation concerns another input. */
+  readonly message: string;
+  /** File responsible for this individual violation. */
   readonly file?: RelPath;
   readonly expected?: ConfigValue;
-  readonly actual?: ConfigReadValue; /** User configuration takes precedence over this per-result severity. */
+  readonly actual?: ConfigReadValue;
+  /** User configuration takes precedence over this per-result severity. */
   readonly severity?: Severity;
   readonly remediation?: Remediation;
+}
+type CheckStatus = {
+  readonly state: 'ok';
+} | {
+  readonly state: 'na';
+} | ViolationStatus | {
+  readonly state: 'violations'; /** Independent findings; a rule chooses its own grouping granularity. */
+  readonly violations: readonly [ViolationStatus, ...ViolationStatus[]];
 };
 /** Display-only package-manager version metadata. */
 interface VersionNote {
@@ -140,9 +143,29 @@ interface Rule<Id extends string = string> {
 }
 declare const defineRule: <const Id extends string>(rule: Rule<Id>) => Rule<Id>;
 //#endregion
+//#region src/domain/ports/file-system.d.ts
+/** IO boundary: swap in memfs (or any other backend) for tests. */
+interface FileSystem {
+  /** Ordinary child directory names, excluding symlinks. Required only for workspace discovery. Errors must propagate. */
+  readDirectories?: (path: AbsPath) => readonly string[];
+  /** Resolve one ordinary child using this filesystem's native name semantics, returning its enumerated name. No symlinks. Undefined for absence; other errors propagate. Without this optional port, Deno literal prefixes use exact names from readDirectories. */
+  resolveDirectory?: (parent: AbsPath, name: string) => string | undefined;
+  /** Read a regular file (including a symlink to one); undefined only for ENOENT. Other errors and non-file entries must throw. */
+  readText: (path: AbsPath) => string | undefined;
+  /** True for a regular file (including a symlink to one); false only for ENOENT. Other errors and non-file entries must throw. */
+  exists: (path: AbsPath) => boolean;
+}
+//#endregion
+//#region src/domain/ports/date-time.d.ts
+/** Host time and native date parsing, including the host timezone for offsetless input. */
+interface DateTime {
+  now: () => number;
+  parse: (value: string) => number;
+}
+//#endregion
 //#region src/domain/builtin-rules.d.ts
-declare const rules: readonly [Rule<"advisory-check">, Rule<"approved-git-repos">, Rule<"audit-suppression">, Rule<"block-auto-install">, Rule<"block-exotic-subdeps">, Rule<"bun-security-scanner">, Rule<"checksum-verification">, Rule<"commit-lockfile">, Rule<"dependency-overrides">, Rule<"disable-lifecycle-scripts">, Rule<"enforce-strict-ssl">, Rule<"files-field">, Rule<"frozen-lockfile">, Rule<"frozen-store">, Rule<"hardened-mode">, Rule<"minimum-release-age">, Rule<"named-registries">, Rule<"paranoid-mode">, Rule<"patched-dependencies">, Rule<"pin-exact-versions">, Rule<"provenance">, Rule<"publish-access">, Rule<"store-server">, Rule<"strict-allow-scripts">, Rule<"strict-release-age">, Rule<"strict-store-integrity">, Rule<"trust-policy">];
-type BuiltinRuleId = (typeof rules)[number]['id'];
+declare const createBuiltinRules: (time: DateTime) => readonly [Rule<"advisory-check">, Rule<"approved-git-repos">, Rule<"audit-suppression">, Rule<"block-auto-install">, Rule<"block-exotic-subdeps">, Rule<"bun-security-scanner">, Rule<"checksum-verification">, Rule<"commit-lockfile">, Rule<"dependency-overrides">, Rule<"disable-lifecycle-scripts">, Rule<"enforce-strict-ssl">, Rule<"files-field">, Rule<"frozen-lockfile">, Rule<"frozen-store">, Rule<"hardened-mode">, Rule<"minimum-release-age">, Rule<"named-registries">, Rule<"paranoid-mode">, Rule<"patched-dependencies">, Rule<"pin-exact-versions">, Rule<"provenance">, Rule<"publish-access">, Rule<"store-server">, Rule<"strict-allow-scripts">, Rule<"strict-release-age">, Rule<"strict-store-integrity">, Rule<"trust-policy">, Rule<"unsupported-settings">];
+type BuiltinRuleId = ReturnType<typeof createBuiltinRules>[number]['id'];
 //#endregion
 //#region src/domain/ports/io.d.ts
 /** Output sink for commands; injectable so tests can drive a string buffer. */
@@ -172,7 +195,7 @@ interface LintResult {
 //#region src/domain/ports/reporter.d.ts
 interface Reporter<Name extends string = string> {
   readonly name: Name;
-  format: (result: LintResult, io: IO) => void;
+  format: (result: LintResult, io: IO) => void | Promise<void>;
 }
 //#endregion
 //#region src/domain/entities/siro-config.d.ts
@@ -190,6 +213,8 @@ type RuleSetting = Severity | 'off';
  */
 interface SiroConfig {
   readonly pms?: readonly PM[];
+  /** Exact stable target versions; does not select managers or inspect installed binaries. */
+  readonly pmVersions?: Readonly<Partial<Record<PM, string>>>;
   readonly projectType?: ProjectType;
   readonly rules?: Readonly<Partial<Record<BuiltinRuleId | (string & Record<never, never>), RuleSetting>>>;
   readonly customRules?: readonly Rule[];
@@ -203,11 +228,25 @@ interface LintOptions {
   readonly cwd: AbsPath;
   readonly fs?: FileSystem;
   readonly pm?: PM;
+  /** Exact stable version for `pm`; overrides config.pmVersions and packageManager. */
+  readonly pmVersion?: string;
+  /** Also inspect declared workspace members' publication settings. */
+  readonly workspaces?: boolean;
   readonly projectType?: ProjectType;
   /** Explicit configuration; the library never imports files from the target repository. */
   readonly config?: SiroConfig;
 }
+//#endregion
+//#region src/application/commands/lint.d.ts
+interface LintCommandOptions extends LintOptions {
+  readonly reporter?: string | Reporter;
+  readonly severity?: Severity;
+}
+//#endregion
+//#region src/composition/lint.d.ts
+/** Public Node API: callers can replace the filesystem without assembling the application. */
 declare const lint: (options: LintOptions) => LintResult;
+declare const lintCommand: (options: LintCommandOptions, io: IO) => Promise<number>;
 //#endregion
 //#region src/adapters/config-loader.d.ts
 /** Load the first matching config; executable imports always use the real filesystem. */
@@ -236,14 +275,6 @@ declare const BUILTIN_REPORTER_NAMES: readonly BuiltinReporterName[];
 /** Literal union of every built-in reporter name. */
 type BuiltinReporterName = (typeof BUILTINS)[number]['name'];
 //#endregion
-//#region src/application/commands/lint.d.ts
-interface LintCommandOptions extends LintOptions {
-  readonly reporter?: string | Reporter;
-  readonly severity?: Severity;
-}
-/** Evaluate and report. Executable config loading belongs to the CLI adapter. */
-declare const lintCommand: (options: LintCommandOptions, io: IO) => Promise<number>;
-//#endregion
 //#region src/domain/entities/config-files.d.ts
 /** Known configuration locations and their parsers. */
 declare const CONFIG_FILES: {
@@ -330,5 +361,8 @@ declare class UsageError extends SiroError {
 //#region src/version.d.ts
 declare const version: string;
 //#endregion
-export { type AbsPath, BUILTIN_REPORTER_NAMES, type BuiltinReporterName, CONFIG_FILES, type CheckStatus, ConfigError, type ConfigFileRef, type ConfigReadValue, type ConfigValue, type FileSystem, type Finding, type IO, type KeyPath, type LintCommandOptions, type LintOptions, type LintResult, type PM, PMS, PROJECT_TYPES, type ParsedConfig, type ProjectType, type RelPath, type Remediation, type RepoContext, type Reporter, type RequireConfigKeyOptions, type Rule, type RuleBinding, type RuleContext, type RuleSetting, SEVERITIES, type SetKeyOperation, type Severity, type SiroConfig, SiroError, UsageError, type VersionNote, asAbsPath, asRelPath, defineConfig, defineRule, getByPath, githubReporter, isPM, isSeverity, jsonReporter, lint, lintCommand, loadConfig, nodeFileSystem, nodeIO, overrideBindings, prettyReporter, requireConfigKey, version };
+//#region src/adapters/node-paths.d.ts
+declare const asAbsPath: (value: string) => AbsPath;
+//#endregion
+export { type AbsPath, BUILTIN_REPORTER_NAMES, type BuiltinReporterName, CONFIG_FILES, type CheckStatus, ConfigError, type ConfigFileRef, type ConfigReadValue, type ConfigValue, type FileSystem, type Finding, type IO, type KeyPath, type LintCommandOptions, type LintOptions, type LintResult, type PM, PMS, PROJECT_TYPES, type ParsedConfig, type ProjectType, type RelPath, type Remediation, type RepoContext, type Reporter, type RequireConfigKeyOptions, type Rule, type RuleBinding, type RuleContext, type RuleSetting, SEVERITIES, type SetKeyOperation, type Severity, type SiroConfig, SiroError, UsageError, type VersionNote, type ViolationStatus, asAbsPath, asRelPath, defineConfig, defineRule, getByPath, githubReporter, isPM, isSeverity, jsonReporter, lint, lintCommand, loadConfig, nodeFileSystem, nodeIO, overrideBindings, prettyReporter, requireConfigKey, version };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { A as ConfigError, E as nodeFileSystem, M as UsageError, O as asAbsPath, S as isSeverity, _ as PROJECT_TYPES, a as overrideBindings, b as SEVERITIES, d as jsonReporter, f as version, g as getByPath, h as defineRule, i as CONFIG_FILES, j as SiroError, k as asRelPath, m as loadConfig, n as lintCommand, o as requireConfigKey, p as githubReporter, r as lint, s as BUILTIN_REPORTER_NAMES, t as nodeIO, u as prettyReporter, x as isPM, y as PMS } from "./node-io-B3Hbcwyn.mjs";
+import { A as ConfigError, E as nodeFileSystem, M as UsageError, O as asAbsPath, b as isPM, c as jsonReporter, d as requireConfigKey, f as CONFIG_FILES, g as PROJECT_TYPES, h as getByPath, i as BUILTIN_REPORTER_NAMES, j as SiroError, k as asRelPath, l as githubReporter, m as defineRule, n as lint, p as loadConfig, r as lintCommand, s as prettyReporter, t as nodeIO, u as overrideBindings, v as PMS, w as version, x as isSeverity, y as SEVERITIES } from "./node-io-BDHg4J2w.mjs";
 //#region src/domain/entities/siro-config.ts
 /** Identity helper for type-checked config files. */
 const defineConfig = (config) => config;