@pho9ubenaa/siro 0.4.3 → 0.5.1

package/dist/{node-io-B3Hbcwyn.mjs → node-io-BDHg4J2w.mjs}

@@ -1,13 +1,15 @@
 import path from "node:path";
-import { accessSync, constants, readFileSync, statSync } from "node:fs";
+import { lstatSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import satisfies from "semver/functions/satisfies.js";
 import * as vb from "valibot";
-import pc from "picocolors";
+import { lt, parse } from "semver";
+import valid from "semver/functions/valid.js";
+import { GLOBSTAR, Minimatch, braceExpand } from "minimatch";
 import ini from "ini";
-import { parse } from "smol-toml";
+import { parse as parse$1 } from "smol-toml";
 import { parseDocument } from "yaml";
-import valid from "semver/functions/valid.js";
+import pc from "picocolors";
 //#region src/shared/errors.ts
 var SiroError = class extends Error {
 	exitCode;
@@ -46,15 +48,22 @@ const wrapCodecError = (filePath, fn) => {
 };
 //#endregion
 //#region src/shared/paths.ts
+const isRelPath = (value) => typeof value === "string" && value.length > 0 && !value.includes("\0") && !/^[\\/]/u.test(value) && !/^[a-z]:/iu.test(value) && !value.split(/[\\/]/u).includes("..");
+const asRelPath = (value) => {
+	if (!isRelPath(value)) throw new TypeError("Expected a repository-relative path without parent traversal.");
+	return value;
+};
+//#endregion
+//#region src/adapters/node-paths.ts
 const isAbsPath = (value) => typeof value === "string" && !value.includes("\0") && path.isAbsolute(value);
-const isRelPath = (value) => typeof value === "string" && value.length > 0 && !value.includes("\0") && !path.posix.isAbsolute(value) && !path.win32.isAbsolute(value) && !/^[a-z]:/iu.test(value) && !value.split(/[\\/]/u).includes("..");
 const asAbsPath = (value) => {
 	if (!isAbsPath(value)) throw new TypeError("Expected an absolute filesystem path.");
 	return value;
 };
-const asRelPath = (value) => {
-	if (!isRelPath(value)) throw new TypeError("Expected a repository-relative path without parent traversal.");
-	return value;
+const nodePaths = {
+	isAbsolute: isAbsPath,
+	resolve: (root, relative) => asAbsPath(path.join(root, asRelPath(relative))),
+	normalizePattern: (pattern) => path.posix.normalize(pattern)
 };
 //#endregion
 //#region src/adapters/node-errors.ts
@@ -62,10 +71,34 @@ const asRelPath = (value) => {
 const isNodeError = (value) => value instanceof Error && "code" in value && typeof value.code === "string";
 //#endregion
 //#region src/adapters/node-file-system.ts
+const assertRegularFile = (filePath) => {
+	if (!statSync(filePath).isFile()) throw new ConfigError(`${filePath}: expected a regular file.`);
+};
 const nodeFileSystem = {
+	readDirectories(directory) {
+		return readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+	},
+	resolveDirectory(parent, name) {
+		let target;
+		try {
+			target = lstatSync(path.join(parent, name), { bigint: true });
+		} catch (error) {
+			if (isNodeError(error) && error.code === "ENOENT") return void 0;
+			throw error;
+		}
+		if (!target.isDirectory()) return void 0;
+		const names = readdirSync(parent, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+		if (names.includes(name)) return name;
+		const matches = names.filter((candidate) => {
+			const entry = lstatSync(path.join(parent, candidate), { bigint: true });
+			return entry.isDirectory() && entry.dev === target.dev && entry.ino === target.ino;
+		});
+		if (target.ino === 0n || matches.length !== 1) throw new ConfigError(`${parent}: cannot identify the resolved workspace directory ${name}.`);
+		return matches[0];
+	},
 	exists(filePath) {
 		try {
-			accessSync(filePath, constants.F_OK);
+			assertRegularFile(filePath);
 			return true;
 		} catch (error) {
 			if (isNodeError(error) && error.code === "ENOENT") return false;
@@ -74,6 +107,7 @@ const nodeFileSystem = {
 	},
 	readText(filePath) {
 		try {
+			assertRegularFile(filePath);
 			return readFileSync(filePath, "utf8");
 		} catch (error) {
 			if (isNodeError(error) && error.code === "ENOENT") return;
@@ -81,16 +115,20 @@ const nodeFileSystem = {
 		}
 	}
 };
-const resolveIn = (root, relPath) => asAbsPath(path.join(root, asRelPath(relPath)));
+const resolveIn = (root, relPath) => nodePaths.resolve(root, relPath);
 const assertDirectory = (root) => {
 	if (!statSync(root).isDirectory()) throw new UsageError("The lint target must be a directory.");
 };
 //#endregion
 //#region package.json
-var version$1 = "0.4.3";
+var version$1 = "0.5.1";
+var engines = { "node": "^22.18.0 || ^24.0.0" };
+//#endregion
+//#region src/version.ts
+const version = version$1;
+const SUPPORTED_NODE_RANGE = engines.node;
 //#endregion
-//#region src/shared/node-version.ts
-const SUPPORTED_NODE_RANGE = { "node": "^22.18.0 || ^24.0.0" }.node;
+//#region src/adapters/node-version.ts
 const isSupportedNodeVersion = (version) => satisfies(version, SUPPORTED_NODE_RANGE);
 //#endregion
 //#region src/domain/entities/pms.ts
@@ -173,19 +211,26 @@ const toParsedConfig = (value) => {
 	throw new TypeError("Config root must be a mapping.");
 };
 //#endregion
-//#region src/domain/entities/rule.ts
-const defineRule = (rule) => rule;
-const isOptionalString = (value) => typeof value === "undefined" || typeof value === "string";
+//#region src/domain/entities/config-file-ref.ts
 const CONFIG_FILE_KINDS = new Set(CODEC_KINDS);
 const isConfigFileRefShape = (value) => {
 	if (!isPlainRecord(value) || typeof value.kind !== "string" || !isRelPath(value.path)) return false;
 	return CONFIG_FILE_KINDS.has(value.kind);
 };
+//#endregion
+//#region src/domain/entities/rule.ts
+const defineRule = (rule) => rule;
+const isOptionalString = (value) => typeof value === "undefined" || typeof value === "string";
 const isConfigValueShape = (value) => typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
 const isDenseStringArray = (value) => Array.isArray(value) && Array.from(value).every((item) => typeof item === "string");
 const isCheckStatusShape = (value) => {
 	if (!isPlainRecord(value)) return false;
 	if (value.state === "ok" || value.state === "na") return true;
+	if (value.state === "violations") return Array.isArray(value.violations) && value.violations.length > 0 && Array.from(value.violations).every(isViolationStatusShape);
+	return isViolationStatusShape(value);
+};
+const isViolationStatusShape = (value) => {
+	if (!isPlainRecord(value)) return false;
 	return value.state === "violation" && typeof value.message === "string" && (value.file === void 0 || isRelPath(value.file)) && (value.expected === void 0 || isConfigValueShape(value.expected)) && (value.severity === void 0 || typeof value.severity === "string" && isSeverity(value.severity)) && !("manualSteps" in value) && !("fix" in value) && !("fixable" in value) && (value.remediation === void 0 || isRemediationShape(value.remediation));
 };
 const isSetKeyOperation = (value) => isPlainRecord(value) && value.op === "setKey" && isConfigFileRefShape(value.file) && isDenseStringArray(value.keyPath) && value.keyPath.length > 0 && isConfigValueShape(value.value);
@@ -207,12 +252,26 @@ const isRuleShape = (value) => {
 	return typeof value.id === "string" && typeof value.title === "string" && typeof value.description === "string" && typeof value.severity === "string" && isSeverity(value.severity) && isOptionalString(value.docs) && isProjectTypesShape(value.projectTypes) && isBindingsShape(value.bindings);
 };
 //#endregion
-//#region src/application/config.ts
+//#region src/domain/services/pm-versions.ts
+/** Release history establishes stable versions, not ranges or prerelease builds. */
+const isStableVersion = (value) => {
+	if (typeof value !== "string" || !/^\d/u.test(value) || value.trim() !== value) return false;
+	const version = parse(value);
+	return version !== null && version.prerelease.length === 0;
+};
+/** Keep name-only detection independent from whether the declaration pins a version. */
+const declaredPMVersion = (declaration) => {
+	const [pm, version, ...extra] = declaration?.trim().split("@") ?? [];
+	return pm && isPM(pm) && isStableVersion(version) && extra.length === 0 ? { [pm]: version } : {};
+};
+//#endregion
+//#region src/domain/services/parse-siro-config.ts
 const RuleSettingSchema = vb.union([vb.picklist(SEVERITIES), vb.literal("off")]);
 const ConfigSchema = vb.strictObject({
 	customRules: vb.optional(vb.array(vb.custom(isRuleShape, "must be a structurally valid rule"))),
 	pms: vb.optional(vb.pipe(vb.array(vb.picklist(PMS)), vb.minLength(1, "must not be empty (omit the key to auto-detect, or list at least one PM)"))),
 	projectType: vb.optional(vb.picklist(PROJECT_TYPES)),
+	pmVersions: vb.optional(vb.pipe(vb.custom(isPlainRecord, "must be an object of PM versions"), vb.check((value) => Object.keys(value).every(isPM), "unknown package manager in pmVersions"), vb.record(vb.picklist(PMS), vb.custom(isStableVersion, "must be an exact stable version such as 10.16.0")))),
 	reporters: vb.optional(vb.array(vb.custom(isReporterShape, "must be a { name, format } reporter"))),
 	rules: vb.optional(vb.pipe(vb.custom(isPlainRecord, "must be an object of rule settings"), vb.rawTransform(({ dataset, addIssue }) => {
 		const entries = [];
@@ -269,276 +328,210 @@ const loadConfig = async (cwd, nodeVersion = process.versions.node) => {
 	return parseConfig(mod !== null && typeof mod === "object" && "default" in mod ? mod.default : mod, name);
 };
 //#endregion
-//#region src/domain/services/filter.ts
-const EXIT_SUCCESS = 0;
-const EXIT_FAILURE = 1;
-const meetsThreshold = (severity, threshold) => SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
-/** Keep only findings at or above `threshold`, recomputing the summary. */
-const filterBySeverity = (result, threshold) => {
-	const findings = [];
-	const summary = {
-		error: 0,
-		info: 0,
-		warn: 0
-	};
-	for (const finding of result.findings) if (meetsThreshold(finding.severity, threshold)) {
-		findings.push(finding);
-		summary[finding.severity] += 1;
+//#region src/domain/entities/config-files.ts
+/** Known configuration locations and their parsers. */
+const CONFIG_FILES = {
+	aubeWorkspace: {
+		kind: "yaml",
+		path: asRelPath("aube-workspace.yaml")
+	},
+	bunfig: {
+		kind: "toml",
+		path: asRelPath("bunfig.toml")
+	},
+	denoJson: {
+		kind: "json",
+		path: asRelPath("deno.json")
+	},
+	npmrc: {
+		kind: "npmrc",
+		path: asRelPath(".npmrc")
+	},
+	packageJson: {
+		kind: "json",
+		path: asRelPath("package.json")
+	},
+	pnpmWorkspace: {
+		kind: "yaml",
+		path: asRelPath("pnpm-workspace.yaml")
+	},
+	yarnrc: {
+		kind: "yaml",
+		path: asRelPath(".yarnrc.yml")
 	}
-	return {
-		findings,
-		summary
-	};
-};
-/**
-* Exit code for a lint run. Non-zero when any finding meets `threshold`
-* (default: only `error` fails the run).
-*/
-const exitCodeForLint = (result, threshold = "error") => {
-	if (result.findings.some((finding) => meetsThreshold(finding.severity, threshold))) return EXIT_FAILURE;
-	return EXIT_SUCCESS;
 };
 //#endregion
-//#region src/adapters/reporters/github.ts
-const COMMAND = {
-	error: "error",
-	info: "notice",
-	warn: "warning"
-};
-const escapeData = (raw) => raw.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
-const escapeProp = (raw) => escapeData(raw).replaceAll(":", "%3A").replaceAll(",", "%2C");
-/** Emit GitHub Actions workflow commands (annotations on PRs). */
-const githubReporter = {
-	format(result, io) {
-		for (const finding of result.findings) {
-			let file = "";
-			if (finding.file) file = `file=${escapeProp(finding.file)},`;
-			let body = `[${finding.pm}] ${finding.message}`;
-			if (finding.docs) body += ` (${finding.docs})`;
-			io.stdout(`::${COMMAND[finding.severity]} ${file}title=${escapeProp(finding.ruleId)}::${escapeData(body)}`);
-		}
+//#region src/domain/setting-availability.ts
+const { npmrc: npmrc$7, packageJson: packageJson$2, pnpmWorkspace: pnpmWorkspace$11, yarnrc: yarnrc$10, bunfig: bunfig$6 } = CONFIG_FILES;
+const settingAvailability = [
+	{
+		pm: "npm",
+		file: npmrc$7,
+		keyPath: ["provenance"],
+		since: "9.5.0",
+		source: "https://github.com/npm/cli/releases/tag/v9.5.0"
 	},
-	name: "github"
-};
-//#endregion
-//#region src/version.ts
-const version = version$1;
-//#endregion
-//#region src/adapters/reporters/json.ts
-/**
-* Versioned machine-readable output — the public contract consumed by
-* external fixers (see docs/json-output.md). Bump `schemaVersion` on any
-* breaking shape change and update that doc in the same commit.
-*/
-const SCHEMA_VERSION = 2;
-const jsonReporter = {
-	format(result, io) {
-		io.stdout(JSON.stringify({
-			schemaVersion: SCHEMA_VERSION,
-			siroVersion: version,
-			findings: result.findings,
-			summary: result.summary
-		}, void 0, 2));
+	{
+		pm: "npm",
+		file: packageJson$2,
+		keyPath: ["publishConfig", "provenance"],
+		since: "9.5.0",
+		source: "https://github.com/npm/cli/releases/tag/v9.5.0"
 	},
-	name: "json"
-};
+	{
+		pm: "npm",
+		file: npmrc$7,
+		keyPath: ["min-release-age"],
+		since: "11.10.0",
+		source: "https://github.com/npm/cli/releases/tag/v11.10.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["strictDepBuilds"],
+		since: "10.6.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.6.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["dangerouslyAllowAllBuilds"],
+		since: "10.9.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.9.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["minimumReleaseAge"],
+		since: "10.16.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.16.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["minimumReleaseAgeExclude"],
+		since: "10.16.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.16.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["trustPolicy"],
+		since: "10.21.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.21.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["blockExoticSubdeps"],
+		since: "10.26.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.26.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["frozenStore"],
+		since: "11.7.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v11.7.0"
+	},
+	{
+		pm: "yarn",
+		file: yarnrc$10,
+		keyPath: ["enableHardenedMode"],
+		since: "4.0.0",
+		source: "https://yarnpkg.com/blog/release/4.0"
+	},
+	{
+		pm: "yarn",
+		file: yarnrc$10,
+		keyPath: ["npmMinimalAgeGate"],
+		since: "4.10.0",
+		source: "https://github.com/yarnpkg/berry/releases/tag/@yarnpkg/cli/4.10.0"
+	},
+	{
+		pm: "yarn",
+		file: yarnrc$10,
+		keyPath: ["npmPreapprovedPackages"],
+		since: "4.10.0",
+		source: "https://github.com/yarnpkg/berry/releases/tag/@yarnpkg/cli/4.10.0"
+	},
+	{
+		pm: "bun",
+		file: bunfig$6,
+		keyPath: ["install", "minimumReleaseAge"],
+		since: "1.3.0",
+		source: "https://bun.com/blog/bun-v1.3#minimum-release-age"
+	},
+	{
+		pm: "bun",
+		file: bunfig$6,
+		keyPath: [
+			"install",
+			"security",
+			"scanner"
+		],
+		since: "1.2.21",
+		source: "https://bun.com/blog/bun-v1.2.21#security-scanner-api-for-bun-install"
+	},
+	{
+		pm: "deno",
+		file: npmrc$7,
+		keyPath: ["min-release-age"],
+		since: "2.8.1",
+		source: "https://github.com/denoland/deno/releases/tag/v2.8.1"
+	}
+];
 //#endregion
-//#region src/adapters/reporters/pretty.ts
-const GLYPH = {
-	error: "✖ error",
-	info: "ℹ info",
-	warn: "⚠ warn"
-};
-/**
-* Decide colour at call time, not at import time.
-*
-* picocolors snapshots `isColorSupported` when imported, so a later
-* `process.env.NO_COLOR = '1'` (or a different stdout) is ignored. The
-* reporter is invoked per `siro lint` run from many contexts (TTY, CI
-* with FORCE_COLOR, redirected output, …) — checking each call is the
-* only way NO_COLOR can truly win, as https://no-color.org/ requires.
-*/
-const colorSupportedNow = () => {
-	const { env } = process;
-	if (typeof env.NO_COLOR !== "undefined" && env.NO_COLOR !== "") return false;
-	if ("FORCE_COLOR" in env) return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "";
-	return pc.isColorSupported;
-};
-const renderFinding = (finding, ctx) => {
-	let where = "";
-	if (finding.file) where = ctx.colors.dim(` (${finding.file})`);
-	ctx.io.stdout(`${ctx.tag[finding.severity](GLYPH[finding.severity])}  [${finding.pm}] ${ctx.colors.bold(finding.ruleId)}${where}`);
-	ctx.io.stdout(`    ${finding.message}`);
-	for (const step of finding.remediation?.kind === "manual" ? finding.remediation.steps : []) ctx.io.stdout(`    ↳ ${step}`);
-	if (finding.docs) ctx.io.stdout(ctx.colors.dim(`    → ${finding.docs}`));
-};
-const buildRenderCtx = (io) => {
-	const colors = pc.createColors(colorSupportedNow());
+//#region src/domain/services/remediation-availability.ts
+const sameSetting = (setting, target) => target.file.path === setting.file.path && target.file.kind === setting.file.kind && target.keyPath.length === setting.keyPath.length && target.keyPath.every((key, index) => key === setting.keyPath[index]);
+/** Undefined means the target version or the setting's introduction is unknown. */
+const settingSupportedByTarget = (pm, version, target) => {
+	if (version === void 0) return void 0;
+	const availability = settingAvailability.find((setting) => setting.pm === pm && sameSetting(setting, target));
+	return availability === void 0 ? void 0 : !lt(version, availability.since);
+};
+/** Keep a proposal atomic and make known version prerequisites explicit. */
+const guardRemediationAvailability = (pm, version, remediation, targets = remediation?.kind === "automatic" ? remediation.operations : []) => {
+	if (version === void 0 || remediation === void 0) return remediation;
+	const unsupported = settingAvailability.filter((setting) => setting.pm === pm && lt(version, setting.since) && targets.some((target) => sameSetting(setting, target)));
+	if (unsupported.length === 0) return remediation;
 	return {
-		colors,
-		io,
-		tag: {
-			error: colors.red,
-			info: colors.cyan,
-			warn: colors.yellow
-		}
+		kind: "manual",
+		steps: [`Target ${pm} ${version} does not support this proposal: ${unsupported.map((setting) => `${setting.file.path}#${setting.keyPath.join(".")} requires ${pm} >=${setting.since}`).join("; ")}. Verify and upgrade the target before applying the steps below, or choose a supported security control. Removing a setting alone does not provide its protection.`, ...remediation.kind === "manual" ? remediation.steps : remediation.operations.map((operation) => `After upgrading, set ${operation.file.path}#${operation.keyPath.join(".")} to ${JSON.stringify(operation.value)}.`)]
 	};
 };
-const prettyReporter = {
-	format(result, io) {
-		const ctx = buildRenderCtx(io);
-		if (result.findings.length === 0) {
-			io.stdout(ctx.colors.green("✔ No security best-practice issues found."));
-			return;
+//#endregion
+//#region src/domain/rules/remediation.ts
+/** Scalar writes must not discard an existing container or replace a non-object parent. */
+const proposeChanges = (config, operations) => {
+	for (const operation of operations) {
+		let current = config;
+		for (const key of operation.keyPath) {
+			if (current === void 0) break;
+			if (!isPlainRecord(current)) return {
+				kind: "manual",
+				steps: [`Review ${operation.file.path}: ${operation.keyPath.join(".")} has a non-object parent. Restructure it before setting the value to ${JSON.stringify(operation.value)}.`]
+			};
+			current = Object.hasOwn(current, key) ? current[key] : void 0;
 		}
-		for (const finding of result.findings) renderFinding(finding, ctx);
-		const { error, warn, info } = result.summary;
-		io.stdout("");
-		io.stdout(`Summary: ${error} error, ${warn} warn, ${info} info`);
-	},
-	name: "pretty"
+		if (current !== null && typeof current === "object") return {
+			kind: "manual",
+			steps: [`Review ${operation.file.path}: ${operation.keyPath.join(".")} contains nested settings. Preserve the required entries when correcting this value.`]
+		};
+	}
+	return {
+		kind: "automatic",
+		operations
+	};
 };
 //#endregion
-//#region src/adapters/reporters/registry.ts
-const BUILTINS = [
-	prettyReporter,
-	jsonReporter,
-	githubReporter
-];
-const DEFAULT_REPORTER_NAME = prettyReporter.name;
-const JSON_REPORTER_NAME = jsonReporter.name;
-/** Names of every built-in reporter, in stable display order. */
-const BUILTIN_REPORTER_NAMES = BUILTINS.map((rep) => rep.name);
-/** Later registrations replace earlier reporters with the same name. */
-const createRegistry = (extras = []) => new Map([...BUILTINS, ...extras].map((reporter) => [reporter.name, reporter]));
-//#endregion
-//#region src/domain/schemas/package-json.ts
-const PackageJsonSchema = vb.looseObject({
-	files: vb.optional(vb.array(vb.string())),
-	name: vb.optional(vb.string()),
-	packageManager: vb.optional(vb.string()),
-	private: vb.optional(vb.boolean()),
-	publishConfig: vb.optional(vb.looseObject({ access: vb.optional(vb.picklist([
-		"public",
-		"restricted",
-		"private"
-	])) })),
-	trustedDependencies: vb.optional(vb.array(vb.string()))
-});
-const parsePackageJson = (value) => {
-	if (!isPlainRecord(value)) throw new ConfigError("package.json: expected an object at the root.");
-	const result = vb.safeParse(PackageJsonSchema, value);
-	if (result.success) return result.output;
-	const issue = result.issues[0];
-	const field = vb.getDotPath(issue);
-	throw new ConfigError(`package.json: ${field ? `${field}: ` : ""}${issue.message}`);
-};
-//#endregion
-//#region src/adapters/repo-context.ts
-const tryParseJson = (text) => {
-	try {
-		return JSON.parse(text);
-	} catch (error) {
-		let errMsg = String(error);
-		if (error instanceof Error) errMsg = error.message;
-		throw new ConfigError(`package.json: invalid JSON — ${errMsg}`);
-	}
-};
-const readPackageJson = (raw) => {
-	return parsePackageJson(tryParseJson(raw.trim()));
-};
-const createRepoContext = (root, fs = nodeFileSystem, projectType) => {
-	if (fs === nodeFileSystem) assertDirectory(root);
-	const readText = (relPath) => fs.readText(resolveIn(root, relPath));
-	const exists = (relPath) => fs.exists(resolveIn(root, relPath));
-	const raw = readText(asRelPath("package.json"));
-	let packageJson = void 0;
-	if (typeof raw !== "undefined") packageJson = readPackageJson(raw);
-	return {
-		exists,
-		packageJson,
-		projectType,
-		readText,
-		root
-	};
-};
-//#endregion
-//#region src/adapters/codecs/ini.ts
-const INTEGER_PATTERN = /^-?\d+$/u;
-const coerceBoolean = (str) => {
-	if (str === "true") return true;
-	if (str === "false") return false;
-};
-const coerceInteger = (str) => {
-	if (INTEGER_PATTERN.test(str)) return Number(str);
-};
-const coerce = (raw) => {
-	if (typeof raw !== "string") return raw;
-	return coerceBoolean(raw) ?? coerceInteger(raw) ?? raw;
-};
-//#endregion
-//#region src/adapters/codecs/store.ts
-const CODECS = {
-	json: { parse(text) {
-		const trimmed = text.trim();
-		return toParsedConfig(JSON.parse(trimmed));
-	} },
-	npmrc: { parse(text) {
-		const raw = toParsedConfig(ini.parse(text));
-		const config = {};
-		for (const [key, value] of Object.entries(raw)) if (Array.isArray(value)) config[key] = value.map((elem) => coerce(elem));
-		else if (typeof value === "object" && value !== null) config[key] = toParsedConfig(value);
-		else config[key] = coerce(value);
-		return config;
-	} },
-	toml: { parse(text) {
-		if (text.trim() === "") return {};
-		return toParsedConfig(parse(text.replace(/^\uFEFF/u, "")));
-	} },
-	yaml: { parse(text) {
-		if (text.trim() === "") return {};
-		const document = parseDocument(text);
-		if (document.errors.length > 0) throw document.errors[0];
-		if (document.contents === null) return {};
-		return toParsedConfig(document.toJS({ onAnchor: (value, count) => {
-			if (count > 1) JSON.stringify(value);
-		} }));
-	} }
-};
-/** Look up the codec for a parseable kind. Total — every CodecKind has one. */
-const codecFor = (kind) => CODECS[kind];
-//#endregion
-//#region src/domain/rules/remediation.ts
-/** Scalar writes must not discard an existing container or replace a non-object parent. */
-const proposeChanges = (config, operations) => {
-	for (const operation of operations) {
-		let current = config;
-		for (const key of operation.keyPath) {
-			if (current === void 0) break;
-			if (!isPlainRecord(current)) return {
-				kind: "manual",
-				steps: [`Review ${operation.file.path}: ${operation.keyPath.join(".")} has a non-object parent. Restructure it before setting the value to ${JSON.stringify(operation.value)}.`]
-			};
-			current = Object.hasOwn(current, key) ? current[key] : void 0;
-		}
-		if (current !== null && typeof current === "object") return {
-			kind: "manual",
-			steps: [`Review ${operation.file.path}: ${operation.keyPath.join(".")} contains nested settings. Preserve the required entries when correcting this value.`]
-		};
-	}
-	return {
-		kind: "automatic",
-		operations
-	};
-};
-//#endregion
-//#region src/domain/rules/builders/require-config-key.ts
-const overrideBindings = (rule, overrides) => ({
-	...rule,
-	bindings: {
-		...rule.bindings,
-		...overrides
-	}
+//#region src/domain/rules/builders/require-config-key.ts
+const overrideBindings = (rule, overrides) => ({
+	...rule,
+	bindings: {
+		...rule.bindings,
+		...overrides
+	}
 });
 const accepts = (spec, actual) => spec.accept ? spec.accept(actual) : actual === spec.value;
 const checkKeyValue = (spec, config) => {
@@ -561,10 +554,14 @@ const checkKeyValue = (spec, config) => {
 		}])
 	};
 };
-const buildBinding = (spec, applies) => ({
+const buildBinding = (spec, pm, applies) => ({
 	check(ctx, config) {
 		if (typeof applies !== "undefined" && !applies(ctx)) return { state: "na" };
-		return checkKeyValue(spec, config);
+		const status = checkKeyValue(spec, config);
+		return status.state === "violation" ? {
+			...status,
+			remediation: guardRemediationAvailability(pm, ctx.pmVersion, status.remediation, [spec])
+		} : status;
 	},
 	docs: spec.docs,
 	file: spec.file,
@@ -578,7 +575,7 @@ const requireConfigKey = (options) => {
 		const spec = options.bindings[pm];
 		if (typeof spec !== "undefined") {
 			if ("extraFix" in spec) throw new TypeError("extraFix is no longer supported; use a custom binding.");
-			bindings[pm] = buildBinding(spec, options.applies);
+			bindings[pm] = buildBinding(spec, pm, options.applies);
 		}
 	}
 	return {
@@ -605,39 +602,6 @@ const withAubeParanoid = (rule) => {
 	} });
 };
 //#endregion
-//#region src/domain/entities/config-files.ts
-/** Known configuration locations and their parsers. */
-const CONFIG_FILES = {
-	aubeWorkspace: {
-		kind: "yaml",
-		path: asRelPath("aube-workspace.yaml")
-	},
-	bunfig: {
-		kind: "toml",
-		path: asRelPath("bunfig.toml")
-	},
-	denoJson: {
-		kind: "json",
-		path: asRelPath("deno.json")
-	},
-	npmrc: {
-		kind: "npmrc",
-		path: asRelPath(".npmrc")
-	},
-	packageJson: {
-		kind: "json",
-		path: asRelPath("package.json")
-	},
-	pnpmWorkspace: {
-		kind: "yaml",
-		path: asRelPath("pnpm-workspace.yaml")
-	},
-	yarnrc: {
-		kind: "yaml",
-		path: asRelPath(".yarnrc.yml")
-	}
-};
-//#endregion
 //#region src/domain/rules/advisory-check.ts
 const { aubeWorkspace: aubeWorkspace$8 } = CONFIG_FILES;
 const advisoryCheck = withAubeParanoid(requireConfigKey({
@@ -746,7 +710,7 @@ const blockAutoInstall = requireConfigKey({
 const { aubeWorkspace: aubeWorkspace$7, npmrc: npmrc$6, pnpmWorkspace: pnpmWorkspace$10 } = CONFIG_FILES;
 const isRootOrNone = (value) => value === "root" || value === "none";
 const npmMessage = "Set `allow-git=none` and `allow-remote=none` in .npmrc to block git/tarball URLs; use `root` only when direct URL dependencies are required.";
-const npmBinding$2 = {
+const npmBinding$1 = {
 	check(_ctx, config) {
 		const git = getByPath(config, ["allow-git"]);
 		const remote = getByPath(config, ["allow-remote"]);
@@ -802,13 +766,13 @@ const blockExoticSubdeps = overrideBindings(requireConfigKey({
 	id: "block-exotic-subdeps",
 	severity: "warn",
 	title: "Block exotic subdependencies"
-}), { npm: npmBinding$2 });
+}), { npm: npmBinding$1 });
 //#endregion
 //#region src/domain/rules/bun-security-scanner.ts
 const { bunfig: bunfig$4 } = CONFIG_FILES;
 const bunSecurityScanner = defineRule({
 	bindings: { bun: {
-		check(_ctx, config) {
+		check(ctx, config) {
 			const scanner = getByPath(config, [
 				"install",
 				"security",
@@ -816,10 +780,17 @@ const bunSecurityScanner = defineRule({
 			]);
 			if (isNonBlankString(scanner)) return { state: "ok" };
 			return {
-				remediation: {
+				remediation: guardRemediationAvailability("bun", ctx.pmVersion, {
 					kind: "manual",
 					steps: ["Add `[install.security] scanner = \"@socketsecurity/bun-security-scanner\"` (or another bun-compatible scanner) to bunfig.toml."]
-				},
+				}, [{
+					file: bunfig$4,
+					keyPath: [
+						"install",
+						"security",
+						"scanner"
+					]
+				}]),
 				actual: scanner,
 				message: "Configure `[install.security] scanner = \"...\"` in bunfig.toml (e.g. `@socketsecurity/bun-security-scanner`) to scan new packages on install.",
 				state: "violation"
@@ -827,7 +798,7 @@ const bunSecurityScanner = defineRule({
 		},
 		docs: "https://bun.com/docs/pm/security-scanner-api",
 		file: bunfig$4,
-		versionNote: { configAvailableSince: "bun 1.3.0" }
+		versionNote: { configAvailableSince: "bun 1.2.21" }
 	} },
 	description: "Bun supports a Security Scanner API that intercepts new packages at install time (e.g. Socket Firewall).",
 	docs: "https://github.com/bodadotsh/npm-security-best-practices#preinstall-scanners",
@@ -927,7 +898,7 @@ const lockfileBinding = (pm) => {
 		versionNote: LOCKFILE_VERSION_NOTES[pm]
 	};
 };
-const denoBinding$2 = {
+const denoBinding$1 = {
 	file: CONFIG_FILES.denoJson,
 	docs: LOCKFILE_DOCS.deno,
 	versionNote: LOCKFILE_VERSION_NOTES.deno,
@@ -958,7 +929,7 @@ const commitLockfile = defineRule({
 	bindings: {
 		aube: lockfileBinding("aube"),
 		bun: lockfileBinding("bun"),
-		deno: denoBinding$2,
+		deno: denoBinding$1,
 		npm: lockfileBinding("npm"),
 		pnpm: lockfileBinding("pnpm"),
 		yarn: lockfileBinding("yarn")
@@ -1008,31 +979,74 @@ const dependencyOverrides = defineRule({
 //#region src/domain/rules/disable-lifecycle-scripts.ts
 const { npmrc: npmrc$5, pnpmWorkspace: pnpmWorkspace$8, yarnrc: yarnrc$6, aubeWorkspace: aubeWorkspace$5, bunfig: bunfig$3 } = CONFIG_FILES;
 const pnpmBinding$4 = {
-	check(_ctx, config) {
+	check(ctx, config) {
 		if (getByPath(config, ["ignoreScripts"]) === true) return { state: "ok" };
 		const bypass = getByPath(config, ["dangerouslyAllowAllBuilds"]);
-		if (bypass === true) return {
-			actual: bypass,
-			expected: false,
-			remediation: {
-				kind: "manual",
-				steps: ["Remove `dangerouslyAllowAllBuilds: true` from pnpm-workspace.yaml (or set it to `false`). Setting `strictDepBuilds: true` alone has no effect while the bypass remains."]
-			},
-			message: "`dangerouslyAllowAllBuilds: true` in pnpm-workspace.yaml bypasses strictDepBuilds — remove it (or set it to false) to restore lifecycle-script gating.",
-			state: "violation"
-		};
 		const strict = getByPath(config, ["strictDepBuilds"]);
+		if (bypass === true) {
+			const bypassTarget = {
+				file: pnpmWorkspace$8,
+				keyPath: ["dangerouslyAllowAllBuilds"]
+			};
+			if (settingSupportedByTarget("pnpm", ctx.pmVersion, bypassTarget) === false) {
+				const proposal = {
+					kind: "manual",
+					steps: ["Remove `dangerouslyAllowAllBuilds: true` before upgrading to pnpm 10.9.0 or newer; the declared target ignores it, but a later version would activate the bypass.", ...strict === true ? [] : ["Set `strictDepBuilds: true` in pnpm-workspace.yaml to enable lifecycle-script gating for the declared target."]]
+				};
+				return {
+					state: "violation",
+					actual: bypass,
+					expected: false,
+					message: "The declared target ignores this future-version bypass. Removing the ignored bypass alone does not provide protection against lifecycle scripts, and leaving it configured would disable gating after an upgrade.",
+					remediation: strict === true ? proposal : guardRemediationAvailability("pnpm", ctx.pmVersion, proposal, [{
+						file: pnpmWorkspace$8,
+						keyPath: ["strictDepBuilds"]
+					}])
+				};
+			}
+			const proposal = {
+				kind: "manual",
+				steps: ["After upgrading, remove `dangerouslyAllowAllBuilds: true` (or set it to false) and configure lifecycle-script gating."]
+			};
+			const guarded = guardRemediationAvailability("pnpm", ctx.pmVersion, proposal, [{
+				file: pnpmWorkspace$8,
+				keyPath: ["strictDepBuilds"]
+			}, {
+				file: pnpmWorkspace$8,
+				keyPath: ["dangerouslyAllowAllBuilds"]
+			}]);
+			if (guarded !== proposal) return {
+				state: "violation",
+				actual: bypass,
+				expected: false,
+				message: "The target cannot use the proposed YAML lifecycle-script controls. Removing an unsupported bypass alone does not provide protection.",
+				remediation: guarded
+			};
+			return {
+				actual: bypass,
+				expected: false,
+				remediation: {
+					kind: "manual",
+					steps: ["Remove `dangerouslyAllowAllBuilds: true` from pnpm-workspace.yaml (or set it to `false`). Setting `strictDepBuilds: true` alone has no effect while the bypass remains."]
+				},
+				message: "`dangerouslyAllowAllBuilds: true` in pnpm-workspace.yaml bypasses strictDepBuilds — remove it (or set it to false) to restore lifecycle-script gating.",
+				state: "violation"
+			};
+		}
 		if (strict === true) return { state: "ok" };
 		return {
 			state: "violation",
 			actual: strict,
 			expected: true,
 			message: strict === void 0 ? "Set `strictDepBuilds: true` in pnpm-workspace.yaml to pin lifecycle-script gating across versions." : "Set `strictDepBuilds: true` in pnpm-workspace.yaml to block silent skips of un-approved dep builds.",
-			remediation: proposeChanges(config, [{
+			remediation: guardRemediationAvailability("pnpm", ctx.pmVersion, proposeChanges(config, [{
 				file: pnpmWorkspace$8,
 				keyPath: ["strictDepBuilds"],
 				op: "setKey",
 				value: true
+			}]), [{
+				file: pnpmWorkspace$8,
+				keyPath: ["strictDepBuilds"]
 			}])
 		};
 	},
@@ -1040,6 +1054,7 @@ const pnpmBinding$4 = {
 	file: pnpmWorkspace$8,
 	versionNote: {
 		configAvailableSince: "pnpm 10.3.0",
+		note: "pnpm-workspace.yaml settings require pnpm 10.6.0",
 		defaultSafeSince: "pnpm 11.0.0"
 	}
 };
@@ -1049,31 +1064,37 @@ const aubeBinding$2 = {
 		const jail = getByPath(config, ["jailBuilds"]);
 		const strict = getByPath(npmConfig, ["strictDepBuilds"]);
 		if (jail === true && strict === true) return { state: "ok" };
-		const jailRemedy = proposeChanges(config, [{
-			file: aubeWorkspace$5,
-			keyPath: ["jailBuilds"],
-			op: "setKey",
-			value: true
-		}]);
-		const strictRemedy = proposeChanges(npmConfig, [{
-			file: npmrc$5,
-			keyPath: ["strictDepBuilds"],
-			op: "setKey",
-			value: true
-		}]);
-		return {
+		const violations = [];
+		if (jail !== true) violations.push({
 			state: "violation",
-			file: jail !== true ? aubeWorkspace$5.path : npmrc$5.path,
-			actual: jail !== true ? jail : strict,
+			file: aubeWorkspace$5.path,
+			actual: jail,
 			expected: true,
-			message: "Set `jailBuilds: true` in aube-workspace.yaml and `strictDepBuilds=true` in .npmrc to sandbox approved builds and reject unreviewed lifecycle scripts.",
-			remediation: jailRemedy.kind === "automatic" && strictRemedy.kind === "automatic" ? {
-				kind: "automatic",
-				operations: [...jailRemedy.operations, ...strictRemedy.operations]
-			} : {
-				kind: "manual",
-				steps: [...jailRemedy.kind === "manual" ? jailRemedy.steps : ["Set `jailBuilds: true` in aube-workspace.yaml."], ...strictRemedy.kind === "manual" ? strictRemedy.steps : ["Set `strictDepBuilds=true` in .npmrc."]]
-			}
+			message: "Set `jailBuilds: true` in aube-workspace.yaml to sandbox approved builds.",
+			remediation: proposeChanges(config, [{
+				file: aubeWorkspace$5,
+				keyPath: ["jailBuilds"],
+				op: "setKey",
+				value: true
+			}])
+		});
+		if (strict !== true) violations.push({
+			state: "violation",
+			file: npmrc$5.path,
+			actual: strict,
+			expected: true,
+			message: "Set `strictDepBuilds=true` in .npmrc to reject unreviewed lifecycle scripts.",
+			remediation: proposeChanges(npmConfig, [{
+				file: npmrc$5,
+				keyPath: ["strictDepBuilds"],
+				op: "setKey",
+				value: true
+			}])
+		});
+		const [first, ...rest] = violations;
+		return !first ? { state: "ok" } : rest.length === 0 ? first : {
+			state: "violations",
+			violations: [first, ...rest]
 		};
 	},
 	docs: "https://aube.jdx.dev/security.html",
@@ -1196,7 +1217,7 @@ const resolvePackageJsonProjectType = (ctx) => {
 	const inferredPackage = pkg?.private !== true && isPublishableName(pkg?.name);
 	return resolveProjectType(ctx.projectType, inferredPackage);
 };
-const resolveDenoProjectType = (ctx, denoConfig) => resolveProjectType(ctx.projectType, isPublishableName(getByPath(denoConfig, ["name"])));
+const resolveDenoProjectType = (ctx, denoConfig) => resolveProjectType(ctx.projectType, getByPath(denoConfig, ["publish"]) !== false && isPublishableName(getByPath(denoConfig, ["name"])));
 //#endregion
 //#region src/domain/rules/publishable.ts
 const isPublishable = (ctx) => resolvePackageJsonProjectType(ctx) === "package";
@@ -1319,14 +1340,17 @@ const frozenLockfile = overrideBindings(requireConfigKey({
 const { pnpmWorkspace: pnpmWorkspace$6 } = CONFIG_FILES;
 const frozenStore = defineRule({
 	bindings: { pnpm: {
-		check(_ctx, config) {
+		check(ctx, config) {
 			const value = getByPath(config, ["frozenStore"]);
 			if (value === true) return { state: "ok" };
 			return {
-				remediation: {
+				remediation: guardRemediationAvailability("pnpm", ctx.pmVersion, {
 					kind: "manual",
 					steps: ["Populate the store before enabling `frozenStore: true`. Use it for read-only deployments; it is incompatible with --force and a configured pnpr server."]
-				},
+				}, [{
+					file: pnpmWorkspace$6,
+					keyPath: ["frozenStore"]
+				}]),
 				actual: value,
 				message: "For a pre-populated read-only store, consider `frozenStore` in pnpm-workspace.yaml. Normal installs need a writable store.",
 				state: "violation"
@@ -1365,19 +1389,9 @@ const hardenedMode = requireConfigKey({
 	title: "Enable hardened mode (yarn)"
 });
 //#endregion
-//#region src/domain/rules/minimum-release-age.ts
-const HOURS_PER_DAY = 24;
-const MINUTES_PER_HOUR = 60;
-const SECONDS_PER_MINUTE = 60;
-const MINUTES_PER_DAY = HOURS_PER_DAY * MINUTES_PER_HOUR;
-const SECONDS_PER_DAY = MINUTES_PER_DAY * SECONDS_PER_MINUTE;
-const RECOMMENDED_RELEASE_AGE_DAYS = 3;
-const RECOMMENDED_RELEASE_AGE_MINUTES = RECOMMENDED_RELEASE_AGE_DAYS * MINUTES_PER_DAY;
-const RECOMMENDED_RELEASE_AGE_SECONDS = RECOMMENDED_RELEASE_AGE_DAYS * SECONDS_PER_DAY;
-const DOCUMENTED_DEFAULT_MINUTES = MINUTES_PER_DAY;
-const { npmrc: npmrc$3, pnpmWorkspace: pnpmWorkspace$5, yarnrc: yarnrc$2, bunfig: bunfig$1, denoJson: denoJson$1, aubeWorkspace: aubeWorkspace$4 } = CONFIG_FILES;
+//#region src/domain/services/deno-release-age.ts
 const DENO_DURATION = /^\+?P(?:\+?\d+[Ww]|(?:\d+[Dd])*(?:T(?:\d+[HhMm]|\d+(?:\.\d+)?[Ss])+)?)$/u;
-const DENO_MIN_TIMESTAMP = Date.parse("-262143-01-01T00:00:00Z");
+const DENO_MIN_TIMESTAMP = Date.UTC(-262143, 0, 1);
 const DENO_UNIT_SECONDS = {
 	w: 604800,
 	d: 86400,
@@ -1388,35 +1402,59 @@ const DENO_UNIT_SECONDS = {
 const DENO_DATE = /^\d{4}-\d{2}-\d{2}$/u;
 const DENO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}[Tt ](?:[01]\d|2[0-3]):[0-5]\d:(?:[0-5]\d|60)(?:\.\d+)?(?:[Zz]|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/u;
 const DENO_OFFSET_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T(?:[01]\d|2[0-3]):[0-5]\d(?::(?:[0-5]\d|60))?[+-](?:[01]\d|2[0-3]):?[0-5]\d$/u;
-const isPositiveNumber = (value) => typeof value === "number" && Number.isFinite(value) && value > 0;
-const isPositiveYarnDuration = (value) => isPositiveNumber(value) || typeof value === "string" && /^\d*\.?\d+(?:ms|s|m|h|d|w)?$/u.test(value) && Number.isFinite(Number.parseFloat(value)) && Number.parseFloat(value) > 0;
-const isPositiveDenoSeconds = (seconds) => seconds > 0 && Number.isFinite(seconds) && Date.now() - seconds * 1e3 >= DENO_MIN_TIMESTAMP;
-const isActiveDenoAge = (value) => {
-	if (typeof value === "number") return Number.isSafeInteger(value) && isPositiveDenoSeconds(value * 60);
-	if (typeof value !== "string") return false;
-	if (/^\d+$/u.test(value)) return Number.isSafeInteger(Number(value)) && isPositiveDenoSeconds(Number(value) * 60);
-	if (DENO_DURATION.test(value)) {
-		let seconds = 0;
-		for (const [, integer, fraction, unit] of value.matchAll(/(\d+)(?:\.(\d+))?([WDHMS])/giu)) {
-			const amount = Number(integer) + Number(`0.${(fraction ?? "").slice(0, 9) || "0"}`);
-			seconds += amount * (DENO_UNIT_SECONDS[unit?.toLowerCase() ?? ""] ?? 0);
-		}
-		return isPositiveDenoSeconds(seconds);
+const DENO_DURATION_TOKEN = /(\d+)(?:\.(\d+))?([WDHMS])/giu;
+const LEAP_SECOND = /:60(?=\.|Z|z|[+-])/u;
+const isPositiveDenoSeconds = (seconds, now) => seconds > 0 && Number.isFinite(seconds) && now - seconds * 1e3 >= DENO_MIN_TIMESTAMP;
+const durationSeconds = (value) => {
+	let seconds = 0;
+	for (const [, integer, fraction, unit] of value.matchAll(DENO_DURATION_TOKEN)) {
+		const amount = Number(integer) + Number(`0.${(fraction ?? "").slice(0, 9) || "0"}`);
+		seconds += amount * (DENO_UNIT_SECONDS[unit?.toLowerCase() ?? ""] ?? 0);
 	}
+	return seconds;
+};
+/** Match Deno's minimumDependencyAge value grammar and active-cutoff semantics. */
+const isActiveDenoReleaseAge = (value, now, parse) => {
+	if (typeof value === "number") return Number.isSafeInteger(value) && isPositiveDenoSeconds(value * 60, now);
+	if (typeof value !== "string") return false;
+	if (/^\d+$/u.test(value)) return Number.isSafeInteger(Number(value)) && isPositiveDenoSeconds(Number(value) * 60, now);
+	if (DENO_DURATION.test(value)) return isPositiveDenoSeconds(durationSeconds(value), now);
 	if (!DENO_DATE.test(value) && !DENO_TIMESTAMP.test(value) && !DENO_OFFSET_TIMESTAMP.test(value)) return false;
 	const date = value.slice(0, 10);
 	const midnight = /* @__PURE__ */ new Date(`${date}T00:00:00Z`);
-	const leapSecond = /:60(?=\.|Z|z|[+-])/u.test(value);
-	const timestamp = Date.parse(value.replace(/:60(?=\.|Z|z|[+-])/u, ":59")) + (leapSecond ? 1e3 : 0);
-	return !Number.isNaN(midnight.valueOf()) && midnight.toISOString().slice(0, 10) === date && timestamp < Date.now();
+	const leapSecond = LEAP_SECOND.test(value);
+	const timestamp = parse(value.replace(LEAP_SECOND, ":59")) + (leapSecond ? 1e3 : 0);
+	return !Number.isNaN(midnight.valueOf()) && midnight.toISOString().slice(0, 10) === date && timestamp < now;
 };
-const isNonDisabledDenoDuration = (value) => {
-	if (!isPlainRecord(value)) return isActiveDenoAge(value);
+//#endregion
+//#region src/domain/rules/minimum-release-age.ts
+const HOURS_PER_DAY = 24;
+const MINUTES_PER_HOUR = 60;
+const SECONDS_PER_MINUTE = 60;
+const MINUTES_PER_DAY = HOURS_PER_DAY * MINUTES_PER_HOUR;
+const SECONDS_PER_DAY = MINUTES_PER_DAY * SECONDS_PER_MINUTE;
+const RECOMMENDED_RELEASE_AGE_DAYS = 3;
+const RECOMMENDED_RELEASE_AGE_MINUTES = RECOMMENDED_RELEASE_AGE_DAYS * MINUTES_PER_DAY;
+const RECOMMENDED_RELEASE_AGE_SECONDS = RECOMMENDED_RELEASE_AGE_DAYS * SECONDS_PER_DAY;
+const DOCUMENTED_DEFAULT_MINUTES = MINUTES_PER_DAY;
+const { npmrc: npmrc$3, pnpmWorkspace: pnpmWorkspace$5, yarnrc: yarnrc$2, bunfig: bunfig$1, denoJson: denoJson$1, aubeWorkspace: aubeWorkspace$4 } = CONFIG_FILES;
+const isPositiveNumber = (value) => typeof value === "number" && Number.isFinite(value) && value > 0;
+const isPositiveYarnDuration = (value) => isPositiveNumber(value) || typeof value === "string" && /^\d*\.?\d+(?:ms|s|m|h|d|w)?$/u.test(value) && Number.isFinite(Number.parseFloat(value)) && Number.parseFloat(value) > 0;
+const isNonDisabledDenoReleaseAge = (value, now, parse) => {
+	if (!isPlainRecord(value)) return isActiveDenoReleaseAge(value, now, parse);
+	if (Object.keys(value).some((key) => key !== "age" && key !== "exclude")) return false;
+	if (value.exclude !== void 0 && !isStringList(value.exclude)) return false;
+	return value.age == null || isActiveDenoReleaseAge(value.age, now, parse);
+};
+const denoAgeUsesFallback = (value) => {
+	if (value === void 0 || value === null) return true;
+	if (!isPlainRecord(value)) return false;
 	if (Object.keys(value).some((key) => key !== "age" && key !== "exclude")) return false;
 	if (value.exclude !== void 0 && !isStringList(value.exclude)) return false;
-	return value.age == null || isActiveDenoAge(value.age);
+	return value.age == null;
 };
-const minimumReleaseAge = overrideBindings(requireConfigKey({
+const isPositiveDenoNpmrcDays = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+const baseRule$1 = requireConfigKey({
 	bindings: {
 		aube: {
 			accept: isPositiveNumber,
@@ -1468,75 +1506,105 @@ const minimumReleaseAge = overrideBindings(requireConfigKey({
 	id: "minimum-release-age",
 	severity: "warn",
 	title: "Set a minimum release age"
-}), {
-	npm: {
-		file: npmrc$3,
-		docs: "https://docs.npmjs.com/cli/v12/using-npm/config#min-release-age",
-		versionNote: { note: "min-release-age available since npm 11.10.0" },
-		check(_ctx, config) {
-			const now = Date.now();
-			if (Object.hasOwn(config, "before")) {
-				const actual = config.before;
-				if ((typeof actual === "string" || typeof actual === "number") && Date.parse(String(actual)) < now) return { state: "ok" };
-				return {
-					state: "violation",
-					actual,
-					expected: "a date in the past",
-					message: "Use a valid past before cutoff, or remove before and set min-release-age.",
-					remediation: {
-						kind: "manual",
-						steps: [`In .npmrc, set before to a valid past date, or remove before and set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days. A future or disabled before overrides min-release-age in this file.`]
-					}
-				};
-			}
-			const actual = getByPath(config, ["min-release-age"]);
-			const age = typeof actual === "number" || typeof actual === "string" ? Number(actual) : NaN;
-			const cutoff = (/* @__PURE__ */ new Date(now - SECONDS_PER_DAY * 1e3 * age)).valueOf();
-			if (age > 0 && Number.isFinite(cutoff) && cutoff < now) return { state: "ok" };
+});
+const createNpmBinding = (time) => ({
+	file: npmrc$3,
+	docs: "https://docs.npmjs.com/cli/v12/using-npm/config#min-release-age",
+	versionNote: { note: "min-release-age available since npm 11.10.0" },
+	check(ctx, config) {
+		const now = time.now();
+		if (Object.hasOwn(config, "before")) {
+			const actual = config.before;
+			if ((typeof actual === "string" || typeof actual === "number") && time.parse(String(actual)) < now) return { state: "ok" };
 			return {
 				state: "violation",
 				actual,
-				expected: RECOMMENDED_RELEASE_AGE_DAYS,
-				message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days to quarantine brand-new releases.`,
-				remediation: proposeChanges(config, [{
-					file: npmrc$3,
-					op: "setKey",
-					keyPath: ["min-release-age"],
-					value: RECOMMENDED_RELEASE_AGE_DAYS
-				}])
+				expected: "a date in the past",
+				message: "Use a valid past before cutoff, or remove before and set min-release-age.",
+				remediation: {
+					kind: "manual",
+					steps: ["In .npmrc, set before to a valid past date. A future or disabled before overrides min-release-age in this file.", ...guardRemediationAvailability("npm", ctx.pmVersion, {
+						kind: "manual",
+						steps: [`Alternatively, remove before and set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days.`]
+					}, [{
+						file: npmrc$3,
+						keyPath: ["min-release-age"]
+					}])?.steps ?? []]
+				}
 			};
 		}
+		const actual = getByPath(config, ["min-release-age"]);
+		const age = typeof actual === "number" || typeof actual === "string" ? Number(actual) : NaN;
+		const cutoff = (/* @__PURE__ */ new Date(now - SECONDS_PER_DAY * 1e3 * age)).valueOf();
+		if (age > 0 && Number.isFinite(cutoff) && cutoff < now) return { state: "ok" };
+		return {
+			state: "violation",
+			actual,
+			expected: RECOMMENDED_RELEASE_AGE_DAYS,
+			message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days to quarantine brand-new releases.`,
+			remediation: guardRemediationAvailability("npm", ctx.pmVersion, proposeChanges(config, [{
+				file: npmrc$3,
+				op: "setKey",
+				keyPath: ["min-release-age"],
+				value: RECOMMENDED_RELEASE_AGE_DAYS
+			}]), [{
+				file: npmrc$3,
+				keyPath: ["min-release-age"]
+			}])
+		};
+	}
+});
+const createDenoBinding = (time) => ({
+	file: denoJson$1,
+	docs: "https://docs.deno.com/runtime/reference/deno_json/",
+	versionNote: {
+		defaultSafeSince: "deno 2.9.0 (1440 minutes)",
+		note: "object age may be omitted; project .npmrc fallback available since deno 2.8.1"
 	},
-	deno: {
-		file: denoJson$1,
-		docs: "https://docs.deno.com/runtime/reference/deno_json/",
-		versionNote: {
-			defaultSafeSince: "deno 2.9.0 (1440 minutes)",
-			note: "object age may be omitted"
-		},
-		check(_ctx, config) {
-			const actual = getByPath(config, ["minimumDependencyAge"]);
-			if (isNonDisabledDenoDuration(actual)) return { state: "ok" };
-			const objectAge = isPlainRecord(actual);
-			const invalidObject = objectAge && (Object.keys(actual).some((key) => key !== "age" && key !== "exclude") || actual.exclude !== void 0 && !isStringList(actual.exclude));
-			return {
+	check(ctx, config) {
+		const actual = getByPath(config, ["minimumDependencyAge"]);
+		if (denoAgeUsesFallback(actual)) {
+			const npmrcConfig = ctx.readConfig(npmrc$3);
+			const npmrcAge = getByPath(npmrcConfig, ["min-release-age"]);
+			if (isPositiveDenoNpmrcDays(npmrcAge)) return { state: "ok" };
+			if (npmrcAge === 0) return {
 				state: "violation",
-				actual,
-				expected: "P3D",
-				message: `Set minimumDependencyAge (e.g. "P3D" for a ${RECOMMENDED_RELEASE_AGE_DAYS}-day cooldown) in deno.json.`,
-				remediation: invalidObject ? {
-					kind: "manual",
-					steps: ["Use only age and exclude in minimumDependencyAge. Make exclude a list of package names and set age to a positive supported duration."]
-				} : proposeChanges(config, [{
-					file: denoJson$1,
+				actual: npmrcAge,
+				expected: RECOMMENDED_RELEASE_AGE_DAYS,
+				file: npmrc$3.path,
+				message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days in .npmrc, or set minimumDependencyAge in deno.json.`,
+				remediation: proposeChanges(npmrcConfig, [{
+					file: npmrc$3,
 					op: "setKey",
-					keyPath: objectAge ? ["minimumDependencyAge", "age"] : ["minimumDependencyAge"],
-					value: "P3D"
+					keyPath: ["min-release-age"],
+					value: RECOMMENDED_RELEASE_AGE_DAYS
 				}])
 			};
 		}
+		if (isNonDisabledDenoReleaseAge(actual, time.now(), time.parse)) return { state: "ok" };
+		const objectAge = isPlainRecord(actual);
+		const invalidObject = objectAge && (Object.keys(actual).some((key) => key !== "age" && key !== "exclude") || actual.exclude !== void 0 && !isStringList(actual.exclude));
+		return {
+			state: "violation",
+			actual,
+			expected: "P3D",
+			message: `Set minimumDependencyAge (e.g. "P3D" for a ${RECOMMENDED_RELEASE_AGE_DAYS}-day cooldown) in deno.json.`,
+			remediation: invalidObject ? {
+				kind: "manual",
+				steps: ["Use only age and exclude in minimumDependencyAge. Make exclude a list of package names and set age to a positive supported duration."]
+			} : proposeChanges(config, [{
+				file: denoJson$1,
+				op: "setKey",
+				keyPath: objectAge ? ["minimumDependencyAge", "age"] : ["minimumDependencyAge"],
+				value: "P3D"
+			}])
+		};
 	}
 });
+const createMinimumReleaseAge = (time) => overrideBindings(baseRule$1, {
+	npm: createNpmBinding(time),
+	deno: createDenoBinding(time)
+});
 //#endregion
 //#region src/domain/rules/named-registries.ts
 const { pnpmWorkspace: pnpmWorkspace$4 } = CONFIG_FILES;
@@ -1617,7 +1685,8 @@ const REGISTRY_VERSION = /^(?:npm|jsr):(?:@[^/@]+\/)?[^/@]+@(?<version>[^/]*)/u;
 const isUnpinnedRegistryImport = (specifier) => {
 	if (!specifier.startsWith("npm:") && !specifier.startsWith("jsr:")) return false;
 	const version = REGISTRY_VERSION.exec(specifier)?.groups?.version;
-	return version === void 0 || valid(version.replace(/^=/u, "")) === null;
+	const normalized = version?.startsWith("=") ? version.slice(1) : version;
+	return normalized === void 0 || valid(normalized) === null;
 };
 const collectUnpinnedImports = (imports) => {
 	const offenders = [];
@@ -1943,9 +2012,74 @@ const strictStoreIntegrity = defineRule({
 //#endregion
 //#region src/domain/rules/trust-policy.ts
 const { aubeWorkspace, pnpmWorkspace } = CONFIG_FILES;
+const trustPolicy = withAubeParanoid(requireConfigKey({
+	bindings: {
+		aube: {
+			docs: "https://aube.jdx.dev/security.html",
+			documentedDefault: "no-downgrade",
+			file: aubeWorkspace,
+			keyPath: ["trustPolicy"],
+			message: "Set `trustPolicy: no-downgrade` in aube-workspace.yaml to block packages whose trust level has decreased.",
+			value: "no-downgrade"
+		},
+		pnpm: {
+			docs: "https://pnpm.io/settings#trustpolicy",
+			file: pnpmWorkspace,
+			keyPath: ["trustPolicy"],
+			message: "Set `trustPolicy: no-downgrade` in pnpm-workspace.yaml to block packages whose trust level has decreased.",
+			value: "no-downgrade",
+			versionNote: { configAvailableSince: "pnpm 10.21.0" }
+		}
+	},
+	description: "Fail installation when a package trust level has decreased compared to previous releases, catching publisher credential downgrades.",
+	docs: "https://pnpm.io/settings#trustpolicy",
+	id: "trust-policy",
+	severity: "warn",
+	title: "Enforce trust policy on dependency updates"
+}));
+//#endregion
+//#region src/domain/rules/unsupported-settings.ts
+const bindingFor = (pm) => {
+	const settings = settingAvailability.filter((setting) => setting.pm === pm);
+	return { check(ctx) {
+		const version = ctx.pmVersion;
+		if (version === void 0) return { state: "na" };
+		const unsupported = settings.filter((setting) => lt(version, setting.since) && getByPath(ctx.readConfig(setting.file), setting.keyPath) !== void 0);
+		const [first, ...rest] = [...new Set(unsupported.map((setting) => setting.file.path))].map((file) => {
+			const fileSettings = unsupported.filter((setting) => setting.file.path === file);
+			return {
+				state: "violation",
+				file,
+				message: `Target ${pm} ${version} predates support for ${file}: ${fileSettings.map((setting) => `${setting.keyPath.join(".")} (requires ${pm} >=${setting.since})`).join("; ")}.`,
+				remediation: {
+					kind: "manual",
+					steps: ["Verify the PM version used by your install or publish command. If the declared target is accurate, upgrade the PM or use a security control supported by that target; removing a setting alone does not provide its protection.", ...fileSettings.map((setting) => `${setting.file.path}#${setting.keyPath.join(".")}: ${setting.source}`)]
+				}
+			};
+		});
+		return first ? {
+			state: "violations",
+			violations: [first, ...rest]
+		} : { state: "ok" };
+	} };
+};
+const unsupportedSettings = defineRule({
+	id: "unsupported-settings",
+	title: "Use settings available in the target PM version",
+	description: "Report configured settings whose recorded introduction version is newer than the declared or explicit stable PM target. Reports each affected file separately, grouping its unsupported keys. Workspace findings retain their member directory. Only the coverage table below is checked. Unknown targets and unlisted settings are not evaluated for availability.",
+	severity: "error",
+	docs: "https://github.com/pHo9UBenaA/siro/blob/main/docs/rules.md#unsupported-settings--error",
+	bindings: {
+		npm: bindingFor("npm"),
+		pnpm: bindingFor("pnpm"),
+		yarn: bindingFor("yarn"),
+		bun: bindingFor("bun"),
+		deno: bindingFor("deno")
+	}
+});
 //#endregion
 //#region src/domain/builtin-rules.ts
-const rules = [
+const createBuiltinRules = (time) => [
 	advisoryCheck,
 	approvedGitRepos,
 	auditSuppression,
@@ -1961,7 +2095,7 @@ const rules = [
 	frozenLockfile,
 	frozenStore,
 	hardenedMode,
-	minimumReleaseAge,
+	createMinimumReleaseAge(time),
 	namedRegistries,
 	paranoidMode,
 	patchedDependencies,
@@ -1972,32 +2106,449 @@ const rules = [
 	strictAllowScripts,
 	strictReleaseAge,
 	strictStoreIntegrity,
-	withAubeParanoid(requireConfigKey({
-		bindings: {
-			aube: {
-				docs: "https://aube.jdx.dev/security.html",
-				documentedDefault: "no-downgrade",
-				file: aubeWorkspace,
-				keyPath: ["trustPolicy"],
-				message: "Set `trustPolicy: no-downgrade` in aube-workspace.yaml to block packages whose trust level has decreased.",
-				value: "no-downgrade"
-			},
-			pnpm: {
-				docs: "https://pnpm.io/settings#trustpolicy",
-				file: pnpmWorkspace,
-				keyPath: ["trustPolicy"],
-				message: "Set `trustPolicy: no-downgrade` in pnpm-workspace.yaml to block packages whose trust level has decreased.",
-				value: "no-downgrade",
-				versionNote: { configAvailableSince: "pnpm 10.21.0" }
+	trustPolicy,
+	unsupportedSettings
+];
+//#endregion
+//#region src/composition/rules.ts
+/** Read time at evaluation, never at module initialization. */
+const rules = createBuiltinRules({
+	now: () => Date.now(),
+	parse: (value) => Date.parse(value)
+});
+//#endregion
+//#region src/adapters/workspace-globs.ts
+const MAX_WORKSPACE_GLOB_ALTERNATIVES = 8192;
+const BRACE_EXPANSION_PROBE_LIMIT = 8193;
+const boundedBraceExpand = (pattern) => {
+	const alternatives = braceExpand(pattern, { braceExpandMax: BRACE_EXPANSION_PROBE_LIMIT });
+	if (alternatives.length > MAX_WORKSPACE_GLOB_ALTERNATIVES) throw new ConfigError(`Workspace pattern expands beyond ${MAX_WORKSPACE_GLOB_ALTERNATIVES} alternatives.`);
+	return alternatives;
+};
+/** Expand with minimatch's own bounded brace semantics. */
+const expandWorkspaceGlob = (pattern) => {
+	try {
+		return boundedBraceExpand(pattern);
+	} catch (error) {
+		if (error instanceof TypeError) throw new ConfigError(`Invalid workspace pattern: ${error.message}.`);
+		throw error;
+	}
+};
+/** Engine choices live here; the application supplies only PM matching policy. */
+const engineOptions = (options) => {
+	if (options.kind === "declaration") return {};
+	return {
+		platform: "linux",
+		windowsPathsNoEscape: true,
+		nonegate: true,
+		nocomment: !options.hashComments,
+		nocase: options.caseInsensitive,
+		dot: options.includeDotDirectories ?? false,
+		nobrace: options.syntax === "wildcards",
+		noext: options.syntax === "wildcards" || options.extendedPatterns === false,
+		optimizationLevel: options.syntax === "shell" ? 2 : 1
+	};
+};
+/** Compile once so membership, exclusions, and traversal share glob semantics. */
+const compileWorkspaceGlob = (pattern, options) => {
+	let matcher;
+	try {
+		const settings = engineOptions(options);
+		if (!settings.nobrace) boundedBraceExpand(pattern);
+		matcher = new Minimatch(options.kind === "directory" && options.syntax === "wildcards" ? pattern.replace(/[[\]]/gu, (character) => character === "[" ? "[[]" : "[]]") : pattern, {
+			...settings,
+			braceExpandMax: BRACE_EXPANSION_PROBE_LIMIT
+		});
+	} catch (error) {
+		if (error instanceof TypeError) throw new ConfigError(`Invalid workspace pattern: ${error.message}.`);
+		throw error;
+	}
+	return {
+		matches: (directory) => matcher.match(directory),
+		canDescend(directory) {
+			const parts = directory.split("/");
+			return matcher.set.some((alternative) => (alternative.includes(GLOBSTAR) || parts.length < alternative.length) && matcher.matchOne(parts, alternative, true));
+		}
+	};
+};
+const minimatchGlobs = {
+	expand: expandWorkspaceGlob,
+	compile: compileWorkspaceGlob
+};
+//#endregion
+//#region src/domain/services/parse-config-file.ts
+const EMPTY_FILE = Object.freeze({});
+/** Create a fresh parser and cache for one lint command. */
+const createConfigParser = (codecFor, ctx) => {
+	const cache = /* @__PURE__ */ new Map();
+	return (file) => {
+		if (file === void 0) return EMPTY_FILE;
+		const cacheKey = `${file.kind}:${file.path}`;
+		const cached = cache.get(cacheKey);
+		if (cached !== void 0) return cached;
+		const text = ctx.readText(file.path);
+		if (text === void 0) {
+			cache.set(cacheKey, EMPTY_FILE);
+			return EMPTY_FILE;
+		}
+		const parsed = wrapCodecError(file.path, () => codecFor(file.kind).parse(text));
+		cache.set(cacheKey, parsed);
+		return parsed;
+	};
+};
+//#endregion
+//#region src/application/workspace-pattern.ts
+/** Detect the basic * and ? markers shared across workspace dialects. */
+const hasBasicWorkspaceWildcard = (pattern) => pattern.includes("*") || pattern.includes("?");
+/** Workspace declarations use POSIX separators regardless of the host platform. */
+const stripTrailingWorkspaceSlashes = (pattern) => {
+	let end = pattern.length;
+	while (end > 0 && pattern[end - 1] === "/") end -= 1;
+	return pattern.slice(0, end);
+};
+//#endregion
+//#region src/application/workspace-prefix.ts
+/** Anchor Deno's native literal prefix before applying its glob suffix. */
+const anchorWorkspacePrefix = (pattern, glob, resolveChild) => {
+	const parts = pattern.split("/");
+	const firstWildcard = parts.findIndex(hasBasicWorkspaceWildcard);
+	const prefix = parts.slice(0, firstWildcard < 0 ? parts.length : firstWildcard);
+	if (prefix.length === 0 || pattern === ".") return glob;
+	const declared = prefix.join("/");
+	let resolved;
+	let attempted = false;
+	const resolve = () => {
+		if (!attempted) {
+			attempted = true;
+			let current = ".";
+			for (const part of prefix) {
+				const child = resolveChild(current, part);
+				if (child === void 0) return void 0;
+				current = current === "." ? child : `${current}/${child}`;
 			}
+			resolved = current;
+		}
+		return resolved;
+	};
+	const rewrite = (directory, actual) => directory === actual ? declared : directory.startsWith(`${actual}/`) ? declared + directory.slice(actual.length) : void 0;
+	return {
+		matches(directory) {
+			if (directory === ".") return false;
+			const actual = resolve();
+			const rewritten = actual === void 0 ? void 0 : rewrite(directory, actual);
+			return rewritten !== void 0 && glob.matches(rewritten);
 		},
-		description: "Fail installation when a package trust level has decreased compared to previous releases, catching publisher credential downgrades.",
-		docs: "https://pnpm.io/settings#trustpolicy",
-		id: "trust-policy",
-		severity: "warn",
-		title: "Enforce trust policy on dependency updates"
-	}))
-];
+		canDescend(directory) {
+			const actual = resolve();
+			if (actual === void 0) return false;
+			if (directory === "." || actual.startsWith(`${directory}/`)) return true;
+			const rewritten = rewrite(directory, actual);
+			return rewritten !== void 0 && glob.canDescend(rewritten);
+		}
+	};
+};
+//#endregion
+//#region src/application/workspace-glob-policy.ts
+const workspaceGlobOptions = (caseInsensitive) => ({
+	kind: "directory",
+	syntax: "shell",
+	caseInsensitive
+});
+//#endregion
+//#region src/application/workspace-dialects.ts
+const containsUnsupportedAubeGlobSyntax = (pattern) => /[[\]{}()]/u.test(pattern);
+const matchesCrossPathGlob = (pattern, value) => {
+	const patternCharacters = [...pattern];
+	const valueCharacters = [...value];
+	let patternIndex = 0;
+	let valueIndex = 0;
+	let starIndex = -1;
+	let retryIndex = 0;
+	while (valueIndex < valueCharacters.length) {
+		const character = patternCharacters[patternIndex];
+		if (character === "?" || character === valueCharacters[valueIndex]) {
+			patternIndex += 1;
+			valueIndex += 1;
+		} else if (character === "*") {
+			starIndex = patternIndex;
+			retryIndex = valueIndex;
+			patternIndex += 1;
+		} else if (starIndex >= 0) {
+			patternIndex = starIndex + 1;
+			retryIndex += 1;
+			valueIndex = retryIndex;
+		} else return false;
+	}
+	while (patternCharacters[patternIndex] === "*") patternIndex += 1;
+	return patternIndex === patternCharacters.length;
+};
+/** The bounded glob subset verified against the recorded Deno/Aube sources. */
+const compileAdditionalWorkspaceGlob = (pattern, pm, excluded, caseInsensitive, globs) => {
+	const parts = pattern.split("/");
+	if (parts.some((part) => part.includes("**") && part !== "**")) throw new ConfigError(`${pm}: ** must occupy an entire workspace path component.`);
+	if (pm === "aube" && (containsUnsupportedAubeGlobSyntax(pattern) || pattern.includes("**") && (parts.at(-1) !== "**" || hasBasicWorkspaceWildcard(parts.slice(0, -1).join("/"))))) throw new ConfigError("Aube workspace inspection supports literals, * and ?, and a trailing ** after a literal prefix; other glob forms are not yet supported.");
+	const matcher = globs.compile(pattern, {
+		kind: "directory",
+		syntax: "wildcards",
+		includeDotDirectories: pm === "aube",
+		caseInsensitive: pm === "deno" && (hasBasicWorkspaceWildcard(pattern) || caseInsensitive)
+	});
+	if (pm === "deno" && hasBasicWorkspaceWildcard(pattern)) {
+		const files = globs.compile(`${pattern}/package.json`, {
+			kind: "directory",
+			syntax: "wildcards",
+			caseInsensitive: true
+		});
+		return {
+			...matcher,
+			matches: (directory) => files.matches(directory === "." ? "package.json" : `${directory}/package.json`)
+		};
+	}
+	if (pm !== "aube" || !excluded) return matcher;
+	const self = pattern.endsWith("/**") ? pattern.slice(0, -3) : void 0;
+	return {
+		...matcher,
+		matches: (directory) => matchesCrossPathGlob(pattern, directory) || directory === self
+	};
+};
+//#endregion
+//#region src/application/workspaces.ts
+/** npm cancels an earlier exclusion when a later positive pattern matches it. */
+const splitNpmPattern = (raw) => {
+	const prefix = /^!+/u.exec(raw)?.[0] ?? "";
+	return {
+		excluded: prefix.length % 2 === 1,
+		pattern: raw.slice(prefix.length)
+	};
+};
+const npmPatterns = (patterns, globs) => {
+	const positive = [];
+	let negative = [];
+	for (const raw of patterns) {
+		const parsed = splitNpmPattern(raw);
+		const pattern = parsed.pattern.replace(/^\.?\/+/u, "");
+		if (parsed.excluded) negative.push({
+			pattern,
+			glob: globs.compile(pattern, { kind: "declaration" })
+		});
+		else {
+			for (let index = 0; index < negative.length; index += 1) if (negative[index]?.glob.matches(pattern)) negative.splice(index, 1);
+			positive.push(pattern);
+		}
+	}
+	return [...positive, ...negative.map(({ pattern }) => `!${pattern}`)];
+};
+/** Read declaration sources separately so Deno's two manifest sets stay distinct. */
+const workspaceDefinitions = (ctx, pm, dependencies) => {
+	const { codecFor, paths, globs } = dependencies;
+	const parse = createConfigParser(codecFor, ctx);
+	const validate = (value, source, denoManifests = false) => {
+		if (value === void 0) return {
+			patterns: [],
+			denoManifests
+		};
+		if (!Array.isArray(value) || !Array.from(value).every((item) => typeof item === "string")) throw new ConfigError(`${source}: expected an array of directory patterns.`);
+		for (const pattern of value) {
+			const positive = pm === "npm" ? splitNpmPattern(pattern).pattern : pattern.startsWith("!") ? pattern.slice(1) : pattern;
+			if ((pm === "deno" || pm === "aube" ? [positive] : globs.expand(positive)).some((alternative) => !isRelPath(alternative) || alternative.includes("\\") || alternative.startsWith("!"))) throw new ConfigError(`${source}: use relative directory patterns without parent traversal: ${JSON.stringify(pattern)}.`);
+			if (pm === "deno" && denoManifests && !pattern.startsWith("!") && paths.normalizePattern(positive) === ".") throw new ConfigError(`${source}: a Deno workspace cannot contain itself.`);
+		}
+		return {
+			patterns: pm === "npm" ? npmPatterns(value, globs) : value,
+			denoManifests
+		};
+	};
+	const packageDefinition = () => {
+		let value = ctx.packageJson?.workspaces;
+		if (isPlainRecord(value)) {
+			value = value.packages;
+			if (value === void 0) throw new ConfigError("package.json#workspaces: expected a packages array.");
+		}
+		return validate(value, "package.json#workspaces");
+	};
+	if (pm === "pnpm") return [validate(ctx.exists(CONFIG_FILES.pnpmWorkspace.path) ? parse(CONFIG_FILES.pnpmWorkspace).packages : void 0, "pnpm-workspace.yaml#packages")];
+	if (pm === "aube") {
+		const file = [CONFIG_FILES.aubeWorkspace, CONFIG_FILES.pnpmWorkspace].find((candidate) => ctx.exists(candidate.path));
+		return [file ? validate(parse(file).packages, `${file.path}#packages`) : packageDefinition()];
+	}
+	if (pm === "deno") return [validate(parse(CONFIG_FILES.denoJson).workspace, "deno.json#workspace", true), packageDefinition()];
+	return [packageDefinition()];
+};
+/** Traverse only ordinary directories that can fall under a positive pattern. */
+const workspaceDirectories = (ctx, fs, definition, pm, dependencies) => {
+	const { codecFor, paths, globs, caseInsensitiveGlobs } = dependencies;
+	const defaultWorkspaceGlobOptions = workspaceGlobOptions(caseInsensitiveGlobs);
+	const { patterns } = definition;
+	const skipVendor = pm === "deno" && createConfigParser(codecFor, ctx)(CONFIG_FILES.denoJson).vendor === true;
+	const positive = patterns.filter((pattern) => !pattern.startsWith("!")).map((pattern) => stripTrailingWorkspaceSlashes(paths.normalizePattern(pattern)));
+	const negative = patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => stripTrailingWorkspaceSlashes(paths.normalizePattern(pattern.slice(1))));
+	const directoryCache = /* @__PURE__ */ new Map();
+	const readDirectories = (directory) => {
+		const cached = directoryCache.get(directory);
+		if (cached) return cached;
+		if (!fs.readDirectories) throw new UsageError("Workspace discovery requires FileSystem.readDirectories; no host filesystem fallback is used.");
+		const names = fs.readDirectories(paths.resolve(ctx.root, asRelPath(directory)));
+		if (!Array.isArray(names)) throw new ConfigError("FileSystem.readDirectories must return an array of directory names.");
+		for (const name of Array.from(names)) if (!isRelPath(name) || name === "." || name === ".." || /[\\/]/u.test(name)) throw new ConfigError("FileSystem.readDirectories returned an invalid child directory name.");
+		const result = [...new Set(names)].sort();
+		directoryCache.set(directory, result);
+		return result;
+	};
+	const resolveChild = (parent, name) => {
+		if (name === ".git" || name === "node_modules") return void 0;
+		const names = readDirectories(parent);
+		const resolved = names.includes(name) ? name : fs.resolveDirectory?.(paths.resolve(ctx.root, asRelPath(parent)), name);
+		if (resolved !== void 0 && !names.includes(resolved)) throw new ConfigError("FileSystem.resolveDirectory must return an enumerated ordinary child directory name.");
+		return resolved === ".git" || resolved === "node_modules" ? void 0 : resolved;
+	};
+	const compile = (pattern, excluded = false) => {
+		if (pm !== "deno" && pm !== "aube") return globs.compile(pattern, pm === "npm" ? {
+			...defaultWorkspaceGlobOptions,
+			hashComments: true
+		} : defaultWorkspaceGlobOptions);
+		const glob = compileAdditionalWorkspaceGlob(pattern, pm, excluded, caseInsensitiveGlobs, globs);
+		return pm === "deno" && !excluded ? anchorWorkspacePrefix(pattern, glob, resolveChild) : glob;
+	};
+	const included = positive.map((pattern) => compile(pattern));
+	const excluded = negative.map((pattern) => {
+		return {
+			glob: compile(pattern, true),
+			subtree: pm === "deno" || pm === "aube" || pm === "bun" ? void 0 : pattern === "**" ? { matches: () => true } : pattern.endsWith("/**") ? compile(pattern.slice(0, -3), true) : void 0
+		};
+	});
+	const declaredBase = (pattern) => {
+		const parts = pattern.split("/");
+		const wildcard = parts.findIndex(hasBasicWorkspaceWildcard);
+		return parts.slice(0, wildcard < 0 ? parts.length : wildcard).join("/") || ".";
+	};
+	const relatedBases = (left, right) => left === "." || right === "." || left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
+	const denoPositive = pm === "deno" ? positive.filter(hasBasicWorkspaceWildcard).map((pattern) => ({
+		base: declaredBase(pattern),
+		scope: anchorWorkspacePrefix(declaredBase(pattern), {
+			matches: () => true,
+			canDescend: () => true
+		}, resolveChild)
+	})) : [];
+	const denoOrdered = pm === "deno" ? patterns.filter((pattern) => hasBasicWorkspaceWildcard(pattern) || pattern.startsWith("!")).map((raw) => {
+		const isExcluded = raw.startsWith("!");
+		const pattern = stripTrailingWorkspaceSlashes(paths.normalizePattern(isExcluded ? raw.slice(1) : raw));
+		const glob = compile(pattern, isExcluded);
+		if (!isExcluded) return {
+			excluded: false,
+			glob
+		};
+		return {
+			excluded: true,
+			glob: {
+				...glob,
+				matches(directory) {
+					if (!hasBasicWorkspaceWildcard(pattern)) return directory === pattern;
+					if (!glob.matches(directory)) return false;
+					const applicable = denoPositive.filter((item) => item.scope.matches(directory)).map((item) => relatedBases(item.base, declaredBase(pattern)));
+					if (applicable.some(Boolean) && applicable.some((value) => !value)) throw new ConfigError("Deno workspace exclusion has ambiguous overlapping bases; use consistent prefix spelling or separate non-overlapping patterns.");
+					return applicable.some(Boolean);
+				}
+			}
+		};
+	}) : [];
+	const bunPatterns = pm === "bun" ? patterns.map((raw) => {
+		const isExcluded = raw.startsWith("!");
+		const pattern = stripTrailingWorkspaceSlashes(paths.normalizePattern(isExcluded ? raw.slice(1) : raw));
+		const usesGlob = isExcluded || hasBasicWorkspaceWildcard(pattern) || pattern.includes("{") || pattern.includes("[");
+		const glob = globs.compile(pattern, {
+			...defaultWorkspaceGlobOptions,
+			extendedPatterns: false
+		});
+		const subtree = isExcluded && pattern.endsWith("/**") ? globs.compile(pattern.slice(0, -3), {
+			...defaultWorkspaceGlobOptions,
+			extendedPatterns: false
+		}) : void 0;
+		return {
+			isExcluded,
+			usesGlob,
+			glob,
+			matches: (directory) => glob.matches(directory) || glob.matches(`${directory}/`) || subtree?.matches(directory) === true
+		};
+	}) : [];
+	const bunOrdered = bunPatterns.filter(({ usesGlob }) => usesGlob);
+	const bunLiterals = bunPatterns.filter(({ isExcluded, usesGlob }) => !isExcluded && !usesGlob);
+	const bunTraversal = bunPatterns.filter(({ isExcluded }) => !isExcluded).map(({ glob }) => glob);
+	const denoLiteral = pm === "deno" ? positive.filter((pattern) => !hasBasicWorkspaceWildcard(pattern)).map((pattern) => compile(pattern)) : [];
+	if (definition.denoManifests && denoOrdered.findLast(({ glob }) => glob.matches("."))?.excluded === false) throw new ConfigError("deno.json#workspace: a Deno workspace cannot contain itself.");
+	if (positive.length === 0 || positive.every((pattern) => pattern === ".")) return [];
+	if (!fs.readDirectories) throw new UsageError("Workspace discovery requires FileSystem.readDirectories; no host filesystem fallback is used.");
+	const result = [];
+	const pending = ["."];
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (current === void 0) break;
+		for (const name of readDirectories(current)) {
+			if (name === ".git" || name === "node_modules") continue;
+			const directory = asRelPath(current === "." ? name : `${current}/${name}`);
+			if (pm === "bun" && name === "CMakeFiles" && !bunLiterals.some(({ glob }) => glob.matches(directory) || glob.canDescend(directory))) continue;
+			const inVendor = skipVendor && (directory === "vendor" || directory.startsWith("vendor/"));
+			if (inVendor && !denoLiteral.some((pattern) => pattern.matches(directory) || pattern.canDescend(directory))) continue;
+			const isExcluded = pm !== "deno" && excluded.some(({ glob }) => glob.matches(directory) || glob.matches(`${directory}/`));
+			if (excluded.some(({ subtree }) => subtree?.matches(directory))) continue;
+			const lastDenoMatch = denoOrdered.findLast(({ glob }) => glob.matches(directory));
+			const lastBunMatch = bunOrdered.findLast(({ matches }) => matches(directory));
+			if (pm === "deno" ? denoLiteral.some((pattern) => pattern.matches(directory)) || !inVendor && lastDenoMatch?.excluded === false : pm === "bun" ? bunLiterals.some(({ glob }) => glob.matches(directory)) || lastBunMatch?.isExcluded === false : !isExcluded && included.some((pattern) => pattern.matches(directory))) result.push(directory);
+			if ((pm === "bun" ? bunTraversal : inVendor ? denoLiteral : included).some((pattern) => pattern.canDescend(directory))) pending.push(directory);
+		}
+	}
+	return result.sort();
+};
+//#endregion
+//#region src/application/workspace-contexts.ts
+/** Expand each manager's declarations into isolated publication contexts. */
+const collectWorkspaceMembers = (ctx, fs, pms, projectType, dependencies) => {
+	const { codecFor, createRepoContext, paths } = dependencies;
+	return pms.flatMap((pm) => {
+		const seen = /* @__PURE__ */ new Set();
+		return workspaceDefinitions(ctx, pm, dependencies).flatMap((definition) => workspaceDirectories(ctx, fs, definition, pm, dependencies).flatMap((directory) => {
+			const root = paths.resolve(ctx.root, directory);
+			const manifest = paths.resolve(root, asRelPath("package.json"));
+			const denoManifest = paths.resolve(root, asRelPath("deno.json"));
+			const denoJsonc = paths.resolve(root, asRelPath("deno.jsonc"));
+			const allowed = new Set(pm === "deno" ? [
+				manifest,
+				denoManifest,
+				denoJsonc
+			] : [manifest]);
+			const memberFs = {
+				exists: (file) => allowed.has(file) && fs.exists(file),
+				readText: (file) => allowed.has(file) ? fs.readText(file) : void 0
+			};
+			try {
+				const explicitMember = definition.patterns.some((pattern) => !pattern.startsWith("!") && !hasBasicWorkspaceWildcard(pattern) && stripTrailingWorkspaceSlashes(paths.normalizePattern(pattern)) === directory);
+				if (!definition.denoManifests && !fs.exists(manifest)) {
+					if (pm === "deno" && explicitMember) throw new ConfigError("Declared npm workspace member has no package.json.");
+					return [];
+				}
+				if (pm === "deno" && !fs.exists(denoManifest) && fs.exists(denoJsonc)) throw new ConfigError("deno.jsonc is not supported; use strict deno.json.");
+				const memberCtx = createRepoContext(root, memberFs, projectType);
+				if (!definition.denoManifests && !memberCtx.packageJson) return [];
+				if (!memberCtx.packageJson && !memberCtx.exists(asRelPath("deno.json"))) {
+					if (definition.denoManifests && explicitMember) throw new ConfigError("Declared Deno member has no deno.json or package.json.");
+					return [];
+				}
+				if (pm === "deno") {
+					if (createConfigParser(codecFor, memberCtx)(CONFIG_FILES.denoJson).workspace !== void 0 || memberCtx.packageJson?.workspaces !== void 0) throw new ConfigError("Nested workspace declarations are not supported by Deno.");
+				}
+				if (seen.has(directory)) return [];
+				seen.add(directory);
+				return [{
+					directory,
+					pm,
+					ctx: memberCtx
+				}];
+			} catch (error) {
+				if (error instanceof ConfigError) throw new ConfigError(`${directory}/${error.message}`);
+				throw error;
+			}
+		}));
+	});
+};
 //#endregion
 //#region src/domain/services/apply-config.ts
 /** Select active rules and keep user severity choices as explicit runtime data. */
@@ -2076,27 +2627,6 @@ const resolvePMs = (ctx, opts) => {
 /** Resolve the most specific severity signal for one finding. */
 const decideSeverity = (status, binding, rule, userOverride) => userOverride ?? status.severity ?? binding.severity ?? rule.severity;
 //#endregion
-//#region src/domain/services/parse-config-file.ts
-const EMPTY_FILE = Object.freeze({});
-/** Create a fresh parser and cache for one lint command. */
-const createConfigParser = (codecFor, ctx) => {
-	const cache = /* @__PURE__ */ new Map();
-	return (file) => {
-		if (file === void 0) return EMPTY_FILE;
-		const cacheKey = `${file.kind}:${file.path}`;
-		const cached = cache.get(cacheKey);
-		if (cached !== void 0) return cached;
-		const text = ctx.readText(file.path);
-		if (text === void 0) {
-			cache.set(cacheKey, EMPTY_FILE);
-			return EMPTY_FILE;
-		}
-		const parsed = wrapCodecError(file.path, () => codecFor(file.kind).parse(text));
-		cache.set(cacheKey, parsed);
-		return parsed;
-	};
-};
-//#endregion
 //#region src/domain/services/render-version-note.ts
 const buildVersionNoteParts = (versionNote) => {
 	const parts = [];
@@ -2128,29 +2658,33 @@ const runLint = (opts) => {
 		warn: 0
 	};
 	const parseConfig = createConfigParser(codecFor, ctx);
-	const ruleContext = {
-		...ctx,
-		readConfig: parseConfig
-	};
 	for (const rule of ruleSet) for (const pm of pms) {
 		const binding = rule.bindings[pm];
 		if (!binding || rule.projectTypes && !rule.projectTypes.includes(resolveBindingProjectType(ctx, pm, parseConfig))) continue;
-		const status = binding.check(ruleContext, parseConfig(binding.file));
-		if (!isCheckStatusShape(status)) throw new ConfigError(`Rule '${rule.id}' returned an invalid check result.`);
-		if (status.state !== "violation") continue;
-		const finding = {
-			ruleId: rule.id,
-			pm,
-			severity: decideSeverity(status, binding, rule, severityOverrides?.get(rule.id)),
-			message: renderVersionNoteMessage(status.message, binding.versionNote),
-			file: status.file ?? binding.file?.path,
-			docs: binding.docs ?? rule.docs,
-			actual: status.actual,
-			expected: status.expected,
-			remediation: status.remediation
+		const ruleContext = {
+			...ctx,
+			readConfig: parseConfig,
+			pmVersion: opts.pmVersions?.[pm]
 		};
-		findings.push(finding);
-		summary[finding.severity] += 1;
+		const response = binding.check(ruleContext, parseConfig(binding.file));
+		if (!isCheckStatusShape(response)) throw new ConfigError(`Rule '${rule.id}' returned an invalid check result.`);
+		const statuses = response.state === "violations" ? response.violations : [response];
+		for (const status of statuses) {
+			if (status.state !== "violation") continue;
+			const finding = {
+				ruleId: rule.id,
+				pm,
+				severity: decideSeverity(status, binding, rule, severityOverrides?.get(rule.id)),
+				message: renderVersionNoteMessage(status.message, binding.versionNote),
+				file: status.file ?? binding.file?.path,
+				docs: binding.docs ?? rule.docs,
+				actual: status.actual,
+				expected: status.expected,
+				remediation: guardRemediationAvailability(pm, ruleContext.pmVersion, status.remediation)
+			};
+			findings.push(finding);
+			summary[finding.severity] += 1;
+		}
 	}
 	return {
 		findings,
@@ -2160,52 +2694,352 @@ const runLint = (opts) => {
 //#endregion
 //#region src/application/lint.ts
 /** Evaluate a repository without reporting or executing configuration files. */
-const prepareLint = (options) => {
-	if (!options || !isAbsPath(options.cwd)) throw new UsageError("cwd must be an absolute filesystem path.");
+const prepareLint = (options, dependencies) => {
+	const { paths, codecFor, createRepoContext } = dependencies;
+	if (!options || !paths.isAbsolute(options.cwd)) throw new UsageError("cwd must be an absolute filesystem path.");
 	if ("customRules" in options || "reporters" in options) throw new UsageError("Pass customRules and reporters inside the config option.");
 	if (options.pm !== void 0 && !isPM(options.pm)) throw new UsageError(`Unknown package manager: ${String(options.pm)}`);
 	if (options.projectType !== void 0 && !isProjectType(options.projectType)) throw new UsageError(`Unknown project type: ${String(options.projectType)}`);
+	if (options.pmVersion !== void 0 && (!options.pm || !isStableVersion(options.pmVersion))) throw new UsageError("pmVersion / --pm-version requires pm / --pm and an exact stable version such as 10.16.0.");
+	if (options.workspaces !== void 0 && typeof options.workspaces !== "boolean") throw new UsageError("workspaces must be a boolean.");
 	const config = options.config === void 0 ? void 0 : parseConfig(options.config);
-	const ctx = createRepoContext(options.cwd, options.fs, options.projectType ?? config?.projectType);
+	const fs = options.fs === void 0 ? dependencies.fileSystem : options.fs;
+	const ctx = createRepoContext(options.cwd, fs, options.projectType ?? config?.projectType);
 	const pms = resolvePMs(ctx, {
 		allowed: config?.pms,
 		pmOverride: options.pm
 	});
 	if (pms.includes("deno") && !ctx.exists(asRelPath("deno.json")) && ctx.exists(asRelPath("deno.jsonc"))) throw new ConfigError("deno.jsonc is not supported. siro currently reads strict JSON from deno.json only.");
-	const configured = applyConfig(rules, config);
+	const configured = applyConfig(dependencies.rules, config);
 	return {
 		ctx,
 		pms,
+		pmVersions: {
+			...declaredPMVersion(ctx.packageJson?.packageManager),
+			...config?.pmVersions,
+			...options.pm && options.pmVersion ? { [options.pm]: options.pmVersion } : {}
+		},
+		members: options.workspaces ? collectWorkspaceMembers(ctx, fs, pms, options.projectType ?? config?.projectType, dependencies) : [],
 		ruleSet: configured.rules,
 		severityOverrides: configured.severityOverrides,
 		codecFor,
 		reporters: config?.reporters ?? []
 	};
 };
-const lint = (options) => runLint(prepareLint(options));
+/** Reuse the existing manifest checks; installation policy remains rooted at cwd. */
+const runPreparedLint = (prepared) => {
+	const result = runLint(prepared);
+	const findings = [...result.findings];
+	const summary = { ...result.summary };
+	const memberRules = prepared.ruleSet.filter((rule) => [
+		"files-field",
+		"publish-access",
+		"unsupported-settings"
+	].includes(rule.id));
+	for (const member of prepared.members) {
+		const child = runLint({
+			...prepared,
+			ctx: member.ctx,
+			pms: [member.pm],
+			ruleSet: memberRules
+		});
+		for (const finding of child.findings) findings.push({
+			...finding,
+			file: `${member.directory}/${finding.file ?? "package.json"}`,
+			message: `${member.directory}: ${finding.message}`,
+			remediation: finding.remediation?.kind === "manual" ? {
+				kind: "manual",
+				steps: [`Work in ${member.directory} for this finding.`, ...finding.remediation.steps]
+			} : finding.remediation
+		});
+		for (const level of [
+			"error",
+			"warn",
+			"info"
+		]) summary[level] += child.summary[level];
+	}
+	return {
+		findings,
+		summary
+	};
+};
+const lint$1 = (options, dependencies) => runPreparedLint(prepareLint(options, dependencies));
+//#endregion
+//#region src/domain/services/filter.ts
+const EXIT_SUCCESS = 0;
+const EXIT_FAILURE = 1;
+const meetsThreshold = (severity, threshold) => SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
+/** Keep only findings at or above `threshold`, recomputing the summary. */
+const filterBySeverity = (result, threshold) => {
+	const findings = [];
+	const summary = {
+		error: 0,
+		info: 0,
+		warn: 0
+	};
+	for (const finding of result.findings) if (meetsThreshold(finding.severity, threshold)) {
+		findings.push(finding);
+		summary[finding.severity] += 1;
+	}
+	return {
+		findings,
+		summary
+	};
+};
+/**
+* Exit code for a lint run. Non-zero when any finding meets `threshold`
+* (default: only `error` fails the run).
+*/
+const exitCodeForLint = (result, threshold = "error") => {
+	if (result.findings.some((finding) => meetsThreshold(finding.severity, threshold))) return EXIT_FAILURE;
+	return EXIT_SUCCESS;
+};
 //#endregion
 //#region src/application/commands/lint.ts
 /** Evaluate and report. Executable config loading belongs to the CLI adapter. */
-const lintCommand = async (options, io) => {
+const lintCommand$1 = async (options, io, dependencies, reporters) => {
 	if (!options) throw new UsageError("Lint options are required.");
 	if (options.severity !== void 0 && !isSeverity(options.severity)) throw new UsageError(`Invalid severity: ${String(options.severity)}`);
-	const prepared = prepareLint(options);
-	const registry = createRegistry(prepared.reporters);
-	const selection = options.reporter ?? DEFAULT_REPORTER_NAME;
+	const prepared = prepareLint(options, dependencies);
+	const registry = reporters.createRegistry(prepared.reporters);
+	const selection = options.reporter ?? reporters.defaultName;
 	const reporter = typeof selection === "string" ? registry.get(selection) : selection;
 	if (!isReporterShape(reporter)) throw new UsageError(`${typeof selection === "string" ? "Unknown" : "Invalid"} reporter: ${String(selection)} (available: ${[...registry.keys()].join(", ")})`);
-	const result = runLint(prepared);
+	const result = runPreparedLint(prepared);
 	const exitCode = exitCodeForLint(result, options.severity ?? "error");
-	reporter.format(filterBySeverity(result, options.severity ?? "info"), io);
+	await reporter.format(filterBySeverity(result, options.severity ?? "info"), io);
 	return exitCode;
 };
 //#endregion
+//#region src/domain/schemas/package-json.ts
+const PackageJsonSchema = vb.looseObject({
+	files: vb.optional(vb.array(vb.string())),
+	name: vb.optional(vb.string()),
+	packageManager: vb.optional(vb.string()),
+	private: vb.optional(vb.boolean()),
+	publishConfig: vb.optional(vb.looseObject({ access: vb.optional(vb.picklist([
+		"public",
+		"restricted",
+		"private"
+	])) })),
+	trustedDependencies: vb.optional(vb.array(vb.string()))
+});
+const parsePackageJson = (value) => {
+	if (!isPlainRecord(value)) throw new ConfigError("package.json: expected an object at the root.");
+	const result = vb.safeParse(PackageJsonSchema, value);
+	if (result.success) return result.output;
+	const issue = result.issues[0];
+	const field = vb.getDotPath(issue);
+	throw new ConfigError(`package.json: ${field ? `${field}: ` : ""}${issue.message}`);
+};
+//#endregion
+//#region src/adapters/repo-context.ts
+const tryParseJson = (text) => {
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		let errMsg = String(error);
+		if (error instanceof Error) errMsg = error.message;
+		throw new ConfigError(`package.json: invalid JSON — ${errMsg}`);
+	}
+};
+const readPackageJson = (raw) => {
+	return parsePackageJson(tryParseJson(raw.trim()));
+};
+const createRepoContext = (root, fs = nodeFileSystem, projectType) => {
+	if (fs === nodeFileSystem) assertDirectory(root);
+	const readText = (relPath) => fs.readText(resolveIn(root, relPath));
+	const exists = (relPath) => fs.exists(resolveIn(root, relPath));
+	const raw = readText(asRelPath("package.json"));
+	let packageJson = void 0;
+	if (typeof raw !== "undefined") packageJson = readPackageJson(raw);
+	return {
+		exists,
+		packageJson,
+		projectType,
+		readText,
+		root
+	};
+};
+//#endregion
+//#region src/adapters/codecs/ini.ts
+const INTEGER_PATTERN = /^-?\d+$/u;
+const coerceBoolean = (str) => {
+	if (str === "true") return true;
+	if (str === "false") return false;
+};
+const coerceInteger = (str) => {
+	if (INTEGER_PATTERN.test(str)) return Number(str);
+};
+const coerce = (raw) => {
+	if (typeof raw !== "string") return raw;
+	return coerceBoolean(raw) ?? coerceInteger(raw) ?? raw;
+};
+//#endregion
+//#region src/adapters/codecs/store.ts
+const CODECS = {
+	json: { parse(text) {
+		const trimmed = text.trim();
+		return toParsedConfig(JSON.parse(trimmed));
+	} },
+	npmrc: { parse(text) {
+		const raw = toParsedConfig(ini.parse(text));
+		const config = {};
+		for (const [key, value] of Object.entries(raw)) if (Array.isArray(value)) config[key] = value.map((elem) => coerce(elem));
+		else if (typeof value === "object" && value !== null) config[key] = toParsedConfig(value);
+		else config[key] = coerce(value);
+		return config;
+	} },
+	toml: { parse(text) {
+		if (text.trim() === "") return {};
+		return toParsedConfig(parse$1(text.startsWith("") ? text.slice(1) : text));
+	} },
+	yaml: { parse(text) {
+		if (text.trim() === "") return {};
+		const document = parseDocument(text);
+		if (document.errors.length > 0) throw document.errors[0];
+		if (document.contents === null) return {};
+		return toParsedConfig(document.toJS({ onAnchor: (value, count) => {
+			if (count > 1) JSON.stringify(value);
+		} }));
+	} }
+};
+/** Look up the codec for a parseable kind. Total — every CodecKind has one. */
+const codecFor = (kind) => CODECS[kind];
+//#endregion
+//#region src/adapters/reporters/github.ts
+const COMMAND = {
+	error: "error",
+	info: "notice",
+	warn: "warning"
+};
+const escapeData = (raw) => raw.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+const escapeProp = (raw) => escapeData(raw).replaceAll(":", "%3A").replaceAll(",", "%2C");
+/** Emit GitHub Actions workflow commands (annotations on PRs). */
+const githubReporter = {
+	format(result, io) {
+		for (const finding of result.findings) {
+			let file = "";
+			if (finding.file) file = `file=${escapeProp(finding.file)},`;
+			let body = `[${finding.pm}] ${finding.message}`;
+			if (finding.docs) body += ` (${finding.docs})`;
+			io.stdout(`::${COMMAND[finding.severity]} ${file}title=${escapeProp(finding.ruleId)}::${escapeData(body)}`);
+		}
+	},
+	name: "github"
+};
+//#endregion
+//#region src/adapters/reporters/json.ts
+/**
+* Versioned machine-readable output — the public contract consumed by
+* external fixers (see docs/json-output.md). Bump `schemaVersion` on any
+* breaking shape change and update that doc in the same commit.
+*/
+const SCHEMA_VERSION = 2;
+const jsonReporter = {
+	format(result, io) {
+		io.stdout(JSON.stringify({
+			schemaVersion: SCHEMA_VERSION,
+			siroVersion: version,
+			findings: result.findings,
+			summary: result.summary
+		}, void 0, 2));
+	},
+	name: "json"
+};
+//#endregion
+//#region src/adapters/reporters/pretty.ts
+const GLYPH = {
+	error: "✖ error",
+	info: "ℹ info",
+	warn: "⚠ warn"
+};
+/**
+* Decide colour at call time, not at import time.
+*
+* picocolors snapshots `isColorSupported` when imported, so a later
+* `process.env.NO_COLOR = '1'` (or a different stdout) is ignored. The
+* reporter is invoked per `siro lint` run from many contexts (TTY, CI
+* with FORCE_COLOR, redirected output, …) — checking each call is the
+* only way NO_COLOR can truly win, as https://no-color.org/ requires.
+*/
+const colorSupportedNow = () => {
+	const { env } = process;
+	if (typeof env.NO_COLOR !== "undefined" && env.NO_COLOR !== "") return false;
+	if ("FORCE_COLOR" in env) return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "";
+	return pc.isColorSupported;
+};
+const renderFinding = (finding, ctx) => {
+	let where = "";
+	if (finding.file) where = ctx.colors.dim(` (${finding.file})`);
+	ctx.io.stdout(`${ctx.tag[finding.severity](GLYPH[finding.severity])}  [${finding.pm}] ${ctx.colors.bold(finding.ruleId)}${where}`);
+	ctx.io.stdout(`    ${finding.message}`);
+	for (const step of finding.remediation?.kind === "manual" ? finding.remediation.steps : []) ctx.io.stdout(`    ↳ ${step}`);
+	if (finding.docs) ctx.io.stdout(ctx.colors.dim(`    → ${finding.docs}`));
+};
+const buildRenderCtx = (io) => {
+	const colors = pc.createColors(colorSupportedNow());
+	return {
+		colors,
+		io,
+		tag: {
+			error: colors.red,
+			info: colors.cyan,
+			warn: colors.yellow
+		}
+	};
+};
+const prettyReporter = {
+	format(result, io) {
+		const ctx = buildRenderCtx(io);
+		if (result.findings.length === 0) {
+			io.stdout(ctx.colors.green("✔ No security best-practice issues found."));
+			return;
+		}
+		for (const finding of result.findings) renderFinding(finding, ctx);
+		const { error, warn, info } = result.summary;
+		io.stdout("");
+		io.stdout(`Summary: ${error} error, ${warn} warn, ${info} info`);
+	},
+	name: "pretty"
+};
+//#endregion
+//#region src/adapters/reporters/registry.ts
+const BUILTINS = [
+	prettyReporter,
+	jsonReporter,
+	githubReporter
+];
+const DEFAULT_REPORTER_NAME = prettyReporter.name;
+const JSON_REPORTER_NAME = jsonReporter.name;
+/** Names of every built-in reporter, in stable display order. */
+const BUILTIN_REPORTER_NAMES = BUILTINS.map((rep) => rep.name);
+/** Later registrations replace earlier reporters with the same name. */
+const createRegistry = (extras = []) => new Map([...BUILTINS, ...extras].map((reporter) => [reporter.name, reporter]));
+//#endregion
+//#region src/composition/lint.ts
+const dependencies = {
+	rules,
+	fileSystem: nodeFileSystem,
+	paths: nodePaths,
+	createRepoContext,
+	codecFor,
+	globs: minimatchGlobs,
+	caseInsensitiveGlobs: process.platform === "darwin" || process.platform === "win32"
+};
+/** Public Node API: callers can replace the filesystem without assembling the application. */
+const lint = (options) => lint$1(options, dependencies);
+const lintCommand = (options, io) => lintCommand$1(options, io, dependencies, {
+	defaultName: DEFAULT_REPORTER_NAME,
+	createRegistry
+});
+//#endregion
 //#region src/adapters/node-io.ts
 const nodeIO = {
 	stderr: (line) => process.stderr.write(`${line}\n`),
 	stdout: (line) => process.stdout.write(`${line}\n`)
 };
 //#endregion
-export { ConfigError as A, SUPPORTED_NODE_RANGE as C, isNodeError as D, nodeFileSystem as E, UsageError as M, asAbsPath as O, isSeverity as S, assertDirectory as T, PROJECT_TYPES as _, overrideBindings as a, SEVERITIES as b, DEFAULT_REPORTER_NAME as c, jsonReporter as d, version as f, getByPath as g, defineRule as h, CONFIG_FILES as i, SiroError as j, asRelPath as k, JSON_REPORTER_NAME as l, loadConfig as m, lintCommand as n, requireConfigKey as o, githubReporter as p, lint as r, BUILTIN_REPORTER_NAMES as s, nodeIO as t, prettyReporter as u, isProjectType as v, isSupportedNodeVersion as w, isPM as x, PMS as y };
+export { ConfigError as A, SUPPORTED_NODE_RANGE as C, isNodeError as D, nodeFileSystem as E, UsageError as M, asAbsPath as O, isSupportedNodeVersion as S, assertDirectory as T, isProjectType as _, DEFAULT_REPORTER_NAME as a, isPM as b, jsonReporter as c, requireConfigKey as d, CONFIG_FILES as f, PROJECT_TYPES as g, getByPath as h, BUILTIN_REPORTER_NAMES as i, SiroError as j, asRelPath as k, githubReporter as l, defineRule as m, lint as n, JSON_REPORTER_NAME as o, loadConfig as p, lintCommand as r, prettyReporter as s, nodeIO as t, overrideBindings as u, PMS as v, version as w, isSeverity as x, SEVERITIES as y };
 
-//# sourceMappingURL=node-io-B3Hbcwyn.mjs.map
+//# sourceMappingURL=node-io-BDHg4J2w.mjs.map