@pho9ubenaa/siro 0.5.0 → 0.5.1

package/dist/{node-io-CaqobxYp.mjs → node-io-BDHg4J2w.mjs}

@@ -4,12 +4,12 @@ import { pathToFileURL } from "node:url";
 import satisfies from "semver/functions/satisfies.js";
 import * as vb from "valibot";
 import { lt, parse } from "semver";
-import pc from "picocolors";
+import valid from "semver/functions/valid.js";
+import { GLOBSTAR, Minimatch, braceExpand } from "minimatch";
 import ini from "ini";
 import { parse as parse$1 } from "smol-toml";
 import { parseDocument } from "yaml";
-import { GLOBSTAR, Minimatch, braceExpand } from "minimatch";
-import valid from "semver/functions/valid.js";
+import pc from "picocolors";
 //#region src/shared/errors.ts
 var SiroError = class extends Error {
 	exitCode;
@@ -48,15 +48,22 @@ const wrapCodecError = (filePath, fn) => {
 };
 //#endregion
 //#region src/shared/paths.ts
+const isRelPath = (value) => typeof value === "string" && value.length > 0 && !value.includes("\0") && !/^[\\/]/u.test(value) && !/^[a-z]:/iu.test(value) && !value.split(/[\\/]/u).includes("..");
+const asRelPath = (value) => {
+	if (!isRelPath(value)) throw new TypeError("Expected a repository-relative path without parent traversal.");
+	return value;
+};
+//#endregion
+//#region src/adapters/node-paths.ts
 const isAbsPath = (value) => typeof value === "string" && !value.includes("\0") && path.isAbsolute(value);
-const isRelPath = (value) => typeof value === "string" && value.length > 0 && !value.includes("\0") && !path.posix.isAbsolute(value) && !path.win32.isAbsolute(value) && !/^[a-z]:/iu.test(value) && !value.split(/[\\/]/u).includes("..");
 const asAbsPath = (value) => {
 	if (!isAbsPath(value)) throw new TypeError("Expected an absolute filesystem path.");
 	return value;
 };
-const asRelPath = (value) => {
-	if (!isRelPath(value)) throw new TypeError("Expected a repository-relative path without parent traversal.");
-	return value;
+const nodePaths = {
+	isAbsolute: isAbsPath,
+	resolve: (root, relative) => asAbsPath(path.join(root, asRelPath(relative))),
+	normalizePattern: (pattern) => path.posix.normalize(pattern)
 };
 //#endregion
 //#region src/adapters/node-errors.ts
@@ -108,16 +115,20 @@ const nodeFileSystem = {
 		}
 	}
 };
-const resolveIn = (root, relPath) => asAbsPath(path.join(root, asRelPath(relPath)));
+const resolveIn = (root, relPath) => nodePaths.resolve(root, relPath);
 const assertDirectory = (root) => {
 	if (!statSync(root).isDirectory()) throw new UsageError("The lint target must be a directory.");
 };
 //#endregion
 //#region package.json
-var version$1 = "0.5.0";
+var version$1 = "0.5.1";
+var engines = { "node": "^22.18.0 || ^24.0.0" };
+//#endregion
+//#region src/version.ts
+const version = version$1;
+const SUPPORTED_NODE_RANGE = engines.node;
 //#endregion
-//#region src/shared/node-version.ts
-const SUPPORTED_NODE_RANGE = { "node": "^22.18.0 || ^24.0.0" }.node;
+//#region src/adapters/node-version.ts
 const isSupportedNodeVersion = (version) => satisfies(version, SUPPORTED_NODE_RANGE);
 //#endregion
 //#region src/domain/entities/pms.ts
@@ -200,14 +211,16 @@ const toParsedConfig = (value) => {
 	throw new TypeError("Config root must be a mapping.");
 };
 //#endregion
-//#region src/domain/entities/rule.ts
-const defineRule = (rule) => rule;
-const isOptionalString = (value) => typeof value === "undefined" || typeof value === "string";
+//#region src/domain/entities/config-file-ref.ts
 const CONFIG_FILE_KINDS = new Set(CODEC_KINDS);
 const isConfigFileRefShape = (value) => {
 	if (!isPlainRecord(value) || typeof value.kind !== "string" || !isRelPath(value.path)) return false;
 	return CONFIG_FILE_KINDS.has(value.kind);
 };
+//#endregion
+//#region src/domain/entities/rule.ts
+const defineRule = (rule) => rule;
+const isOptionalString = (value) => typeof value === "undefined" || typeof value === "string";
 const isConfigValueShape = (value) => typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
 const isDenseStringArray = (value) => Array.isArray(value) && Array.from(value).every((item) => typeof item === "string");
 const isCheckStatusShape = (value) => {
@@ -252,7 +265,7 @@ const declaredPMVersion = (declaration) => {
 	return pm && isPM(pm) && isStableVersion(version) && extra.length === 0 ? { [pm]: version } : {};
 };
 //#endregion
-//#region src/application/config.ts
+//#region src/domain/services/parse-siro-config.ts
 const RuleSettingSchema = vb.union([vb.picklist(SEVERITIES), vb.literal("off")]);
 const ConfigSchema = vb.strictObject({
 	customRules: vb.optional(vb.array(vb.custom(isRuleShape, "must be a structurally valid rule"))),
@@ -315,149 +328,6 @@ const loadConfig = async (cwd, nodeVersion = process.versions.node) => {
 	return parseConfig(mod !== null && typeof mod === "object" && "default" in mod ? mod.default : mod, name);
 };
 //#endregion
-//#region src/domain/services/filter.ts
-const EXIT_SUCCESS = 0;
-const EXIT_FAILURE = 1;
-const meetsThreshold = (severity, threshold) => SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
-/** Keep only findings at or above `threshold`, recomputing the summary. */
-const filterBySeverity = (result, threshold) => {
-	const findings = [];
-	const summary = {
-		error: 0,
-		info: 0,
-		warn: 0
-	};
-	for (const finding of result.findings) if (meetsThreshold(finding.severity, threshold)) {
-		findings.push(finding);
-		summary[finding.severity] += 1;
-	}
-	return {
-		findings,
-		summary
-	};
-};
-/**
-* Exit code for a lint run. Non-zero when any finding meets `threshold`
-* (default: only `error` fails the run).
-*/
-const exitCodeForLint = (result, threshold = "error") => {
-	if (result.findings.some((finding) => meetsThreshold(finding.severity, threshold))) return EXIT_FAILURE;
-	return EXIT_SUCCESS;
-};
-//#endregion
-//#region src/adapters/reporters/github.ts
-const COMMAND = {
-	error: "error",
-	info: "notice",
-	warn: "warning"
-};
-const escapeData = (raw) => raw.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
-const escapeProp = (raw) => escapeData(raw).replaceAll(":", "%3A").replaceAll(",", "%2C");
-/** Emit GitHub Actions workflow commands (annotations on PRs). */
-const githubReporter = {
-	format(result, io) {
-		for (const finding of result.findings) {
-			let file = "";
-			if (finding.file) file = `file=${escapeProp(finding.file)},`;
-			let body = `[${finding.pm}] ${finding.message}`;
-			if (finding.docs) body += ` (${finding.docs})`;
-			io.stdout(`::${COMMAND[finding.severity]} ${file}title=${escapeProp(finding.ruleId)}::${escapeData(body)}`);
-		}
-	},
-	name: "github"
-};
-//#endregion
-//#region src/version.ts
-const version = version$1;
-//#endregion
-//#region src/adapters/reporters/json.ts
-/**
-* Versioned machine-readable output — the public contract consumed by
-* external fixers (see docs/json-output.md). Bump `schemaVersion` on any
-* breaking shape change and update that doc in the same commit.
-*/
-const SCHEMA_VERSION = 2;
-const jsonReporter = {
-	format(result, io) {
-		io.stdout(JSON.stringify({
-			schemaVersion: SCHEMA_VERSION,
-			siroVersion: version,
-			findings: result.findings,
-			summary: result.summary
-		}, void 0, 2));
-	},
-	name: "json"
-};
-//#endregion
-//#region src/adapters/reporters/pretty.ts
-const GLYPH = {
-	error: "✖ error",
-	info: "ℹ info",
-	warn: "⚠ warn"
-};
-/**
-* Decide colour at call time, not at import time.
-*
-* picocolors snapshots `isColorSupported` when imported, so a later
-* `process.env.NO_COLOR = '1'` (or a different stdout) is ignored. The
-* reporter is invoked per `siro lint` run from many contexts (TTY, CI
-* with FORCE_COLOR, redirected output, …) — checking each call is the
-* only way NO_COLOR can truly win, as https://no-color.org/ requires.
-*/
-const colorSupportedNow = () => {
-	const { env } = process;
-	if (typeof env.NO_COLOR !== "undefined" && env.NO_COLOR !== "") return false;
-	if ("FORCE_COLOR" in env) return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "";
-	return pc.isColorSupported;
-};
-const renderFinding = (finding, ctx) => {
-	let where = "";
-	if (finding.file) where = ctx.colors.dim(` (${finding.file})`);
-	ctx.io.stdout(`${ctx.tag[finding.severity](GLYPH[finding.severity])}  [${finding.pm}] ${ctx.colors.bold(finding.ruleId)}${where}`);
-	ctx.io.stdout(`    ${finding.message}`);
-	for (const step of finding.remediation?.kind === "manual" ? finding.remediation.steps : []) ctx.io.stdout(`    ↳ ${step}`);
-	if (finding.docs) ctx.io.stdout(ctx.colors.dim(`    → ${finding.docs}`));
-};
-const buildRenderCtx = (io) => {
-	const colors = pc.createColors(colorSupportedNow());
-	return {
-		colors,
-		io,
-		tag: {
-			error: colors.red,
-			info: colors.cyan,
-			warn: colors.yellow
-		}
-	};
-};
-const prettyReporter = {
-	format(result, io) {
-		const ctx = buildRenderCtx(io);
-		if (result.findings.length === 0) {
-			io.stdout(ctx.colors.green("✔ No security best-practice issues found."));
-			return;
-		}
-		for (const finding of result.findings) renderFinding(finding, ctx);
-		const { error, warn, info } = result.summary;
-		io.stdout("");
-		io.stdout(`Summary: ${error} error, ${warn} warn, ${info} info`);
-	},
-	name: "pretty"
-};
-//#endregion
-//#region src/adapters/reporters/registry.ts
-const BUILTINS = [
-	prettyReporter,
-	jsonReporter,
-	githubReporter
-];
-const DEFAULT_REPORTER_NAME = prettyReporter.name;
-const JSON_REPORTER_NAME = jsonReporter.name;
-/** Names of every built-in reporter, in stable display order. */
-const BUILTIN_REPORTER_NAMES = BUILTINS.map((rep) => rep.name);
-/** Later registrations replace earlier reporters with the same name. */
-const createRegistry = (extras = []) => new Map([...BUILTINS, ...extras].map((reporter) => [reporter.name, reporter]));
-//#endregion
 //#region src/domain/entities/config-files.ts
 /** Known configuration locations and their parsers. */
 const CONFIG_FILES = {
@@ -491,1304 +361,802 @@ const CONFIG_FILES = {
 	}
 };
 //#endregion
-//#region src/domain/services/parse-config-file.ts
-const EMPTY_FILE = Object.freeze({});
-/** Create a fresh parser and cache for one lint command. */
-const createConfigParser = (codecFor, ctx) => {
-	const cache = /* @__PURE__ */ new Map();
-	return (file) => {
-		if (file === void 0) return EMPTY_FILE;
-		const cacheKey = `${file.kind}:${file.path}`;
-		const cached = cache.get(cacheKey);
-		if (cached !== void 0) return cached;
-		const text = ctx.readText(file.path);
-		if (text === void 0) {
-			cache.set(cacheKey, EMPTY_FILE);
-			return EMPTY_FILE;
-		}
-		const parsed = wrapCodecError(file.path, () => codecFor(file.kind).parse(text));
-		cache.set(cacheKey, parsed);
-		return parsed;
-	};
-};
-//#endregion
-//#region src/adapters/codecs/ini.ts
-const INTEGER_PATTERN = /^-?\d+$/u;
-const coerceBoolean = (str) => {
-	if (str === "true") return true;
-	if (str === "false") return false;
-};
-const coerceInteger = (str) => {
-	if (INTEGER_PATTERN.test(str)) return Number(str);
-};
-const coerce = (raw) => {
-	if (typeof raw !== "string") return raw;
-	return coerceBoolean(raw) ?? coerceInteger(raw) ?? raw;
-};
-//#endregion
-//#region src/adapters/codecs/store.ts
-const CODECS = {
-	json: { parse(text) {
-		const trimmed = text.trim();
-		return toParsedConfig(JSON.parse(trimmed));
-	} },
-	npmrc: { parse(text) {
-		const raw = toParsedConfig(ini.parse(text));
-		const config = {};
-		for (const [key, value] of Object.entries(raw)) if (Array.isArray(value)) config[key] = value.map((elem) => coerce(elem));
-		else if (typeof value === "object" && value !== null) config[key] = toParsedConfig(value);
-		else config[key] = coerce(value);
-		return config;
-	} },
-	toml: { parse(text) {
-		if (text.trim() === "") return {};
-		return toParsedConfig(parse$1(text.replace(/^\uFEFF/u, "")));
-	} },
-	yaml: { parse(text) {
-		if (text.trim() === "") return {};
-		const document = parseDocument(text);
-		if (document.errors.length > 0) throw document.errors[0];
-		if (document.contents === null) return {};
-		return toParsedConfig(document.toJS({ onAnchor: (value, count) => {
-			if (count > 1) JSON.stringify(value);
-		} }));
-	} }
-};
-/** Look up the codec for a parseable kind. Total — every CodecKind has one. */
-const codecFor = (kind) => CODECS[kind];
-//#endregion
-//#region src/domain/schemas/package-json.ts
-const PackageJsonSchema = vb.looseObject({
-	files: vb.optional(vb.array(vb.string())),
-	name: vb.optional(vb.string()),
-	packageManager: vb.optional(vb.string()),
-	private: vb.optional(vb.boolean()),
-	publishConfig: vb.optional(vb.looseObject({ access: vb.optional(vb.picklist([
-		"public",
-		"restricted",
-		"private"
-	])) })),
-	trustedDependencies: vb.optional(vb.array(vb.string()))
-});
-const parsePackageJson = (value) => {
-	if (!isPlainRecord(value)) throw new ConfigError("package.json: expected an object at the root.");
-	const result = vb.safeParse(PackageJsonSchema, value);
-	if (result.success) return result.output;
-	const issue = result.issues[0];
-	const field = vb.getDotPath(issue);
-	throw new ConfigError(`package.json: ${field ? `${field}: ` : ""}${issue.message}`);
-};
-//#endregion
-//#region src/adapters/repo-context.ts
-const tryParseJson = (text) => {
-	try {
-		return JSON.parse(text);
-	} catch (error) {
-		let errMsg = String(error);
-		if (error instanceof Error) errMsg = error.message;
-		throw new ConfigError(`package.json: invalid JSON — ${errMsg}`);
+//#region src/domain/setting-availability.ts
+const { npmrc: npmrc$7, packageJson: packageJson$2, pnpmWorkspace: pnpmWorkspace$11, yarnrc: yarnrc$10, bunfig: bunfig$6 } = CONFIG_FILES;
+const settingAvailability = [
+	{
+		pm: "npm",
+		file: npmrc$7,
+		keyPath: ["provenance"],
+		since: "9.5.0",
+		source: "https://github.com/npm/cli/releases/tag/v9.5.0"
+	},
+	{
+		pm: "npm",
+		file: packageJson$2,
+		keyPath: ["publishConfig", "provenance"],
+		since: "9.5.0",
+		source: "https://github.com/npm/cli/releases/tag/v9.5.0"
+	},
+	{
+		pm: "npm",
+		file: npmrc$7,
+		keyPath: ["min-release-age"],
+		since: "11.10.0",
+		source: "https://github.com/npm/cli/releases/tag/v11.10.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["strictDepBuilds"],
+		since: "10.6.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.6.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["dangerouslyAllowAllBuilds"],
+		since: "10.9.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.9.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["minimumReleaseAge"],
+		since: "10.16.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.16.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["minimumReleaseAgeExclude"],
+		since: "10.16.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.16.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["trustPolicy"],
+		since: "10.21.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.21.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["blockExoticSubdeps"],
+		since: "10.26.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v10.26.0"
+	},
+	{
+		pm: "pnpm",
+		file: pnpmWorkspace$11,
+		keyPath: ["frozenStore"],
+		since: "11.7.0",
+		source: "https://github.com/pnpm/pnpm/releases/tag/v11.7.0"
+	},
+	{
+		pm: "yarn",
+		file: yarnrc$10,
+		keyPath: ["enableHardenedMode"],
+		since: "4.0.0",
+		source: "https://yarnpkg.com/blog/release/4.0"
+	},
+	{
+		pm: "yarn",
+		file: yarnrc$10,
+		keyPath: ["npmMinimalAgeGate"],
+		since: "4.10.0",
+		source: "https://github.com/yarnpkg/berry/releases/tag/@yarnpkg/cli/4.10.0"
+	},
+	{
+		pm: "yarn",
+		file: yarnrc$10,
+		keyPath: ["npmPreapprovedPackages"],
+		since: "4.10.0",
+		source: "https://github.com/yarnpkg/berry/releases/tag/@yarnpkg/cli/4.10.0"
+	},
+	{
+		pm: "bun",
+		file: bunfig$6,
+		keyPath: ["install", "minimumReleaseAge"],
+		since: "1.3.0",
+		source: "https://bun.com/blog/bun-v1.3#minimum-release-age"
+	},
+	{
+		pm: "bun",
+		file: bunfig$6,
+		keyPath: [
+			"install",
+			"security",
+			"scanner"
+		],
+		since: "1.2.21",
+		source: "https://bun.com/blog/bun-v1.2.21#security-scanner-api-for-bun-install"
+	},
+	{
+		pm: "deno",
+		file: npmrc$7,
+		keyPath: ["min-release-age"],
+		since: "2.8.1",
+		source: "https://github.com/denoland/deno/releases/tag/v2.8.1"
 	}
+];
+//#endregion
+//#region src/domain/services/remediation-availability.ts
+const sameSetting = (setting, target) => target.file.path === setting.file.path && target.file.kind === setting.file.kind && target.keyPath.length === setting.keyPath.length && target.keyPath.every((key, index) => key === setting.keyPath[index]);
+/** Undefined means the target version or the setting's introduction is unknown. */
+const settingSupportedByTarget = (pm, version, target) => {
+	if (version === void 0) return void 0;
+	const availability = settingAvailability.find((setting) => setting.pm === pm && sameSetting(setting, target));
+	return availability === void 0 ? void 0 : !lt(version, availability.since);
 };
-const readPackageJson = (raw) => {
-	return parsePackageJson(tryParseJson(raw.trim()));
-};
-const createRepoContext = (root, fs = nodeFileSystem, projectType) => {
-	if (fs === nodeFileSystem) assertDirectory(root);
-	const readText = (relPath) => fs.readText(resolveIn(root, relPath));
-	const exists = (relPath) => fs.exists(resolveIn(root, relPath));
-	const raw = readText(asRelPath("package.json"));
-	let packageJson = void 0;
-	if (typeof raw !== "undefined") packageJson = readPackageJson(raw);
+/** Keep a proposal atomic and make known version prerequisites explicit. */
+const guardRemediationAvailability = (pm, version, remediation, targets = remediation?.kind === "automatic" ? remediation.operations : []) => {
+	if (version === void 0 || remediation === void 0) return remediation;
+	const unsupported = settingAvailability.filter((setting) => setting.pm === pm && lt(version, setting.since) && targets.some((target) => sameSetting(setting, target)));
+	if (unsupported.length === 0) return remediation;
 	return {
-		exists,
-		packageJson,
-		projectType,
-		readText,
-		root
+		kind: "manual",
+		steps: [`Target ${pm} ${version} does not support this proposal: ${unsupported.map((setting) => `${setting.file.path}#${setting.keyPath.join(".")} requires ${pm} >=${setting.since}`).join("; ")}. Verify and upgrade the target before applying the steps below, or choose a supported security control. Removing a setting alone does not provide its protection.`, ...remediation.kind === "manual" ? remediation.steps : remediation.operations.map((operation) => `After upgrading, set ${operation.file.path}#${operation.keyPath.join(".")} to ${JSON.stringify(operation.value)}.`)]
 	};
 };
 //#endregion
-//#region src/application/workspace-prefix.ts
-/** Anchor Deno's native literal prefix before applying its glob suffix. */
-const anchorWorkspacePrefix = (pattern, glob, resolveChild) => {
-	const parts = pattern.split("/");
-	const firstWildcard = parts.findIndex((part) => /[*?]/u.test(part));
-	const prefix = parts.slice(0, firstWildcard < 0 ? parts.length : firstWildcard);
-	if (prefix.length === 0 || pattern === ".") return glob;
-	const declared = prefix.join("/");
-	let resolved;
-	let attempted = false;
-	const resolve = () => {
-		if (!attempted) {
-			attempted = true;
-			let current = ".";
-			for (const part of prefix) {
-				const child = resolveChild(current, part);
-				if (child === void 0) return void 0;
-				current = current === "." ? child : `${current}/${child}`;
-			}
-			resolved = current;
+//#region src/domain/rules/remediation.ts
+/** Scalar writes must not discard an existing container or replace a non-object parent. */
+const proposeChanges = (config, operations) => {
+	for (const operation of operations) {
+		let current = config;
+		for (const key of operation.keyPath) {
+			if (current === void 0) break;
+			if (!isPlainRecord(current)) return {
+				kind: "manual",
+				steps: [`Review ${operation.file.path}: ${operation.keyPath.join(".")} has a non-object parent. Restructure it before setting the value to ${JSON.stringify(operation.value)}.`]
+			};
+			current = Object.hasOwn(current, key) ? current[key] : void 0;
 		}
-		return resolved;
-	};
-	const rewrite = (directory, actual) => directory === actual ? declared : directory.startsWith(`${actual}/`) ? declared + directory.slice(actual.length) : void 0;
+		if (current !== null && typeof current === "object") return {
+			kind: "manual",
+			steps: [`Review ${operation.file.path}: ${operation.keyPath.join(".")} contains nested settings. Preserve the required entries when correcting this value.`]
+		};
+	}
 	return {
-		matches(directory) {
-			if (directory === ".") return false;
-			const actual = resolve();
-			const rewritten = actual === void 0 ? void 0 : rewrite(directory, actual);
-			return rewritten !== void 0 && glob.matches(rewritten);
-		},
-		canDescend(directory) {
-			const actual = resolve();
-			if (actual === void 0) return false;
-			if (directory === "." || actual.startsWith(`${directory}/`)) return true;
-			const rewritten = rewrite(directory, actual);
-			return rewritten !== void 0 && glob.canDescend(rewritten);
-		}
+		kind: "automatic",
+		operations
 	};
 };
 //#endregion
-//#region src/application/workspace-globs.ts
-const MAX_WORKSPACE_GLOB_ALTERNATIVES = 8192;
-const BRACE_EXPANSION_PROBE_LIMIT = 8193;
-const defaultWorkspaceGlobOptions = {
-	platform: "linux",
-	nocase: process.platform === "darwin" || process.platform === "win32",
-	windowsPathsNoEscape: true,
-	nonegate: true,
-	nocomment: true,
-	optimizationLevel: 2
-};
-const boundedBraceExpand = (pattern) => {
-	const alternatives = braceExpand(pattern, { braceExpandMax: BRACE_EXPANSION_PROBE_LIMIT });
-	if (alternatives.length > MAX_WORKSPACE_GLOB_ALTERNATIVES) throw new ConfigError(`Workspace pattern expands beyond ${MAX_WORKSPACE_GLOB_ALTERNATIVES} alternatives.`);
-	return alternatives;
-};
-/** Expand with minimatch's own bounded brace semantics. */
-const expandWorkspaceGlob = (pattern) => {
-	try {
-		return boundedBraceExpand(pattern);
-	} catch (error) {
-		if (error instanceof TypeError) throw new ConfigError(`Invalid workspace pattern: ${error.message}.`);
-		throw error;
-	}
-};
-/** Compile once so membership, exclusions, and traversal share glob semantics. */
-const compileWorkspaceGlob = (pattern, options = defaultWorkspaceGlobOptions) => {
-	let matcher;
-	try {
-		if (!options.nobrace) boundedBraceExpand(pattern);
-		matcher = new Minimatch(pattern, {
-			...options,
-			braceExpandMax: BRACE_EXPANSION_PROBE_LIMIT
-		});
-	} catch (error) {
-		if (error instanceof TypeError) throw new ConfigError(`Invalid workspace pattern: ${error.message}.`);
-		throw error;
+//#region src/domain/rules/builders/require-config-key.ts
+const overrideBindings = (rule, overrides) => ({
+	...rule,
+	bindings: {
+		...rule.bindings,
+		...overrides
 	}
+});
+const accepts = (spec, actual) => spec.accept ? spec.accept(actual) : actual === spec.value;
+const checkKeyValue = (spec, config) => {
+	const actual = getByPath(config, spec.keyPath);
+	const coveredByDefault = actual === void 0 && spec.documentedDefault !== void 0 && spec.versionNote?.defaultSafeSince === void 0 && accepts(spec, spec.documentedDefault);
+	if (!coveredByDefault && accepts(spec, actual)) return { state: "ok" };
+	const severity = coveredByDefault ? spec.defaultSatisfiedSeverity ?? "info" : void 0;
+	if (severity === "off") return { state: "ok" };
 	return {
-		matches: (directory) => matcher.match(directory),
-		canDescend(directory) {
-			const parts = directory.split("/");
-			return matcher.set.some((alternative) => (alternative.includes(GLOBSTAR) || parts.length < alternative.length) && matcher.matchOne(parts, alternative, true));
-		}
-	};
-};
-//#endregion
-//#region src/application/workspace-dialects.ts
-const matchesCrossPathGlob = (pattern, value) => {
-	const patternCharacters = [...pattern];
-	const valueCharacters = [...value];
-	let patternIndex = 0;
-	let valueIndex = 0;
-	let starIndex = -1;
-	let retryIndex = 0;
-	while (valueIndex < valueCharacters.length) {
-		const character = patternCharacters[patternIndex];
-		if (character === "?" || character === valueCharacters[valueIndex]) {
-			patternIndex += 1;
-			valueIndex += 1;
-		} else if (character === "*") {
-			starIndex = patternIndex;
-			retryIndex = valueIndex;
-			patternIndex += 1;
-		} else if (starIndex >= 0) {
-			patternIndex = starIndex + 1;
-			retryIndex += 1;
-			valueIndex = retryIndex;
-		} else return false;
-	}
-	while (patternCharacters[patternIndex] === "*") patternIndex += 1;
-	return patternIndex === patternCharacters.length;
+		state: "violation",
+		actual,
+		expected: spec.value,
+		message: spec.message,
+		...severity === void 0 ? {} : { severity },
+		remediation: proposeChanges(config, [{
+			file: spec.file,
+			keyPath: spec.keyPath,
+			op: "setKey",
+			value: spec.value
+		}])
+	};
 };
-/** The bounded glob subset verified against the recorded Deno/Aube sources. */
-const compileAdditionalWorkspaceGlob = (pattern, pm, excluded) => {
-	const parts = pattern.split("/");
-	if (parts.some((part) => part.includes("**") && part !== "**")) throw new ConfigError(`${pm}: ** must occupy an entire workspace path component.`);
-	if (pm === "aube" && (/[[\]{}()]/u.test(pattern) || pattern.includes("**") && (parts.at(-1) !== "**" || /[*?]/u.test(parts.slice(0, -1).join("/"))))) throw new ConfigError("Aube workspace inspection supports literals, * and ?, and a trailing ** after a literal prefix; other glob forms are not yet supported.");
-	const escaped = pm === "deno" ? pattern.replace(/[[\]]/gu, (character) => character === "[" ? "[[]" : "[]]") : pattern;
-	const matcher = compileWorkspaceGlob(escaped, {
-		platform: "linux",
-		windowsPathsNoEscape: true,
-		nonegate: true,
-		nocomment: true,
-		nobrace: true,
-		noext: true,
-		dot: pm === "aube",
-		nocase: pm === "deno" && (/[*?]/u.test(pattern) || process.platform === "darwin" || process.platform === "win32")
-	});
-	if (pm === "deno" && /[*?]/u.test(pattern)) {
-		const files = compileWorkspaceGlob(`${escaped}/package.json`, {
-			platform: "linux",
-			windowsPathsNoEscape: true,
-			nonegate: true,
-			nocomment: true,
-			nobrace: true,
-			noext: true,
-			nocase: true
-		});
-		return {
-			...matcher,
-			matches: (directory) => files.matches(directory === "." ? "package.json" : `${directory}/package.json`)
-		};
+const buildBinding = (spec, pm, applies) => ({
+	check(ctx, config) {
+		if (typeof applies !== "undefined" && !applies(ctx)) return { state: "na" };
+		const status = checkKeyValue(spec, config);
+		return status.state === "violation" ? {
+			...status,
+			remediation: guardRemediationAvailability(pm, ctx.pmVersion, status.remediation, [spec])
+		} : status;
+	},
+	docs: spec.docs,
+	file: spec.file,
+	severity: spec.severity,
+	versionNote: spec.versionNote
+});
+/** Build a Rule from a per-PM table of {file, keyPath, value, message}. */
+const requireConfigKey = (options) => {
+	const bindings = {};
+	for (const pm of PMS) {
+		const spec = options.bindings[pm];
+		if (typeof spec !== "undefined") {
+			if ("extraFix" in spec) throw new TypeError("extraFix is no longer supported; use a custom binding.");
+			bindings[pm] = buildBinding(spec, pm, options.applies);
+		}
 	}
-	if (pm !== "aube" || !excluded) return matcher;
-	const self = pattern.endsWith("/**") ? pattern.slice(0, -3) : void 0;
 	return {
-		...matcher,
-		matches: (directory) => matchesCrossPathGlob(pattern, directory) || directory === self
+		bindings,
+		description: options.description,
+		docs: options.docs,
+		id: options.id,
+		projectTypes: options.projectTypes,
+		severity: options.severity,
+		title: options.title
 	};
 };
 //#endregion
-//#region src/application/workspaces.ts
-/** npm cancels an earlier exclusion when a later positive pattern matches it. */
-const splitNpmPattern = (raw) => {
-	const prefix = /^!+/u.exec(raw)?.[0] ?? "";
-	return {
-		excluded: prefix.length % 2 === 1,
-		pattern: raw.slice(prefix.length)
-	};
-};
-const npmPatterns = (patterns) => {
-	const positive = [];
-	let negative = [];
-	for (const raw of patterns) {
-		const parsed = splitNpmPattern(raw);
-		const pattern = parsed.pattern.replace(/^\.?\/+/u, "");
-		if (parsed.excluded) negative.push({
-			pattern,
-			glob: compileWorkspaceGlob(pattern, {})
-		});
-		else {
-			for (let index = 0; index < negative.length; index += 1) if (negative[index]?.glob.matches(pattern)) negative.splice(index, 1);
-			positive.push(pattern);
+//#region src/domain/rules/builders/with-aube-paranoid.ts
+const withAubeParanoid = (rule) => {
+	const { aube } = rule.bindings;
+	if (!aube) return rule;
+	return overrideBindings(rule, { aube: {
+		...aube,
+		check(ctx, config) {
+			if (getByPath(config, ["paranoid"]) === true) return { state: "ok" };
+			return aube.check(ctx, config);
 		}
-	}
-	return [...positive, ...negative.map(({ pattern }) => `!${pattern}`)];
+	} });
 };
-/** Read declaration sources separately so Deno's two manifest sets stay distinct. */
-const workspaceDefinitions = (ctx, pm) => {
-	const parse = createConfigParser(codecFor, ctx);
-	const validate = (value, source, denoManifests = false) => {
-		if (value === void 0) return {
-			patterns: [],
-			denoManifests
-		};
-		if (!Array.isArray(value) || !Array.from(value).every((item) => typeof item === "string")) throw new ConfigError(`${source}: expected an array of directory patterns.`);
-		for (const pattern of value) {
-			const positive = pm === "npm" ? splitNpmPattern(pattern).pattern : pattern.startsWith("!") ? pattern.slice(1) : pattern;
-			if ((pm === "deno" || pm === "aube" ? [positive] : expandWorkspaceGlob(positive)).some((alternative) => !isRelPath(alternative) || alternative.includes("\\") || alternative.startsWith("!"))) throw new ConfigError(`${source}: use relative directory patterns without parent traversal: ${JSON.stringify(pattern)}.`);
-			if (pm === "deno" && denoManifests && !pattern.startsWith("!") && path.posix.normalize(positive) === ".") throw new ConfigError(`${source}: a Deno workspace cannot contain itself.`);
-		}
-		return {
-			patterns: pm === "npm" ? npmPatterns(value) : value,
-			denoManifests
-		};
-	};
-	const packageDefinition = () => {
-		let value = ctx.packageJson?.workspaces;
-		if (isPlainRecord(value)) {
-			value = value.packages;
-			if (value === void 0) throw new ConfigError("package.json#workspaces: expected a packages array.");
+//#endregion
+//#region src/domain/rules/advisory-check.ts
+const { aubeWorkspace: aubeWorkspace$8 } = CONFIG_FILES;
+const advisoryCheck = withAubeParanoid(requireConfigKey({
+	bindings: { aube: {
+		accept: (value) => value === "on" || value === "required",
+		docs: "https://aube.jdx.dev/security.html",
+		documentedDefault: "on",
+		file: aubeWorkspace$8,
+		keyPath: ["advisoryCheck"],
+		message: "Set `advisoryCheck: on` (or `required`) in aube-workspace.yaml to check dependencies against known-malicious advisories.",
+		value: "on"
+	} },
+	description: "Query the OSV database for known-malicious packages during dependency resolution.",
+	docs: "https://aube.jdx.dev/security.html",
+	id: "advisory-check",
+	severity: "warn",
+	title: "Enable malicious-package advisory checks"
+}));
+//#endregion
+//#region src/domain/rules/config-predicates.ts
+const isNonBlankString = (value) => typeof value === "string" && value.trim().length > 0;
+const isStringList = (value) => Array.isArray(value) && Array.from(value).every(isNonBlankString);
+//#endregion
+//#region src/domain/rules/approved-git-repos.ts
+const { yarnrc: yarnrc$9 } = CONFIG_FILES;
+const message = "Set `approvedGitRepositories: []` in .yarnrc.yml to block all git: protocol dependencies (or list approved repository globs).";
+const approvedGitRepos = defineRule({
+	bindings: { yarn: {
+		check(_ctx, config) {
+			const value = getByPath(config, ["approvedGitRepositories"]);
+			if (isStringList(value)) return { state: "ok" };
+			return {
+				remediation: {
+					kind: "manual",
+					steps: ["Add `approvedGitRepositories: []` to .yarnrc.yml to block all git deps, or list specific approved repository URL globs."]
+				},
+				actual: value,
+				expected: "[]",
+				message,
+				state: "violation"
+			};
+		},
+		docs: "https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories",
+		file: yarnrc$9,
+		versionNote: { configAvailableSince: "yarn 4.14.0" }
+	} },
+	description: "Restrict git: protocol dependencies to an explicit allowlist of approved repository URL patterns.",
+	docs: "https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories",
+	id: "approved-git-repos",
+	severity: "warn",
+	title: "Approve git repository dependencies"
+});
+//#endregion
+//#region src/domain/rules/audit-suppression.ts
+const { yarnrc: yarnrc$8 } = CONFIG_FILES;
+const isNonEmptyArray = (value) => Array.isArray(value) && value.length > 0;
+const SUPPRESSION_KEYS = ["npmAuditIgnoreAdvisories", "npmAuditExcludePackages"];
+const checkSuppression = (config) => {
+	const present = SUPPRESSION_KEYS.filter((key) => isNonEmptyArray(getByPath(config, [key])));
+	const [first] = present;
+	if (typeof first === "undefined") return { state: "ok" };
+	return {
+		actual: getByPath(config, [first]),
+		message: `Review audit suppression in .yarnrc.yml (${present.join(", ")}). Broad glob patterns can silently hide future vulnerabilities.`,
+		state: "violation",
+		remediation: {
+			kind: "manual",
+			steps: ["Review entries in `npmAuditIgnoreAdvisories` and `npmAuditExcludePackages` — remove stale suppressions and overly broad glob patterns."]
 		}
-		return validate(value, "package.json#workspaces");
 	};
-	if (pm === "pnpm") return [validate(ctx.exists(CONFIG_FILES.pnpmWorkspace.path) ? parse(CONFIG_FILES.pnpmWorkspace).packages : void 0, "pnpm-workspace.yaml#packages")];
-	if (pm === "aube") {
-		const file = [CONFIG_FILES.aubeWorkspace, CONFIG_FILES.pnpmWorkspace].find((candidate) => ctx.exists(candidate.path));
-		return [file ? validate(parse(file).packages, `${file.path}#packages`) : packageDefinition()];
-	}
-	if (pm === "deno") return [validate(parse(CONFIG_FILES.denoJson).workspace, "deno.json#workspace", true), packageDefinition()];
-	return [packageDefinition()];
 };
-/** Traverse only ordinary directories that can fall under a positive pattern. */
-const workspaceDirectories = (ctx, fs, definition, pm) => {
-	const { patterns } = definition;
-	const skipVendor = pm === "deno" && createConfigParser(codecFor, ctx)(CONFIG_FILES.denoJson).vendor === true;
-	const positive = patterns.filter((pattern) => !pattern.startsWith("!")).map((pattern) => path.posix.normalize(pattern).replace(/\/+$/u, ""));
-	const negative = patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => path.posix.normalize(pattern.slice(1)).replace(/\/+$/u, ""));
-	const directoryCache = /* @__PURE__ */ new Map();
-	const readDirectories = (directory) => {
-		const cached = directoryCache.get(directory);
-		if (cached) return cached;
-		if (!fs.readDirectories) throw new UsageError("Workspace discovery requires FileSystem.readDirectories; no host filesystem fallback is used.");
-		const names = fs.readDirectories(resolveIn(ctx.root, asRelPath(directory)));
-		if (!Array.isArray(names)) throw new ConfigError("FileSystem.readDirectories must return an array of directory names.");
-		for (const name of Array.from(names)) if (!isRelPath(name) || name === "." || name === ".." || /[\\/]/u.test(name)) throw new ConfigError("FileSystem.readDirectories returned an invalid child directory name.");
-		const result = [...new Set(names)].sort();
-		directoryCache.set(directory, result);
-		return result;
-	};
-	const resolveChild = (parent, name) => {
-		if (name === ".git" || name === "node_modules") return void 0;
-		const names = readDirectories(parent);
-		const resolved = names.includes(name) ? name : fs.resolveDirectory?.(resolveIn(ctx.root, asRelPath(parent)), name);
-		if (resolved !== void 0 && !names.includes(resolved)) throw new ConfigError("FileSystem.resolveDirectory must return an enumerated ordinary child directory name.");
-		return resolved === ".git" || resolved === "node_modules" ? void 0 : resolved;
-	};
-	const compile = (pattern, excluded = false) => {
-		if (pm !== "deno" && pm !== "aube") return compileWorkspaceGlob(pattern, pm === "npm" ? {
-			...defaultWorkspaceGlobOptions,
-			nocomment: false
-		} : defaultWorkspaceGlobOptions);
-		const glob = compileAdditionalWorkspaceGlob(pattern, pm, excluded);
-		return pm === "deno" && !excluded ? anchorWorkspacePrefix(pattern, glob, resolveChild) : glob;
-	};
-	const included = positive.map((pattern) => compile(pattern));
-	const excluded = negative.map((pattern) => {
-		return {
-			glob: compile(pattern, true),
-			subtree: pm === "deno" || pm === "aube" || pm === "bun" ? void 0 : pattern === "**" ? { matches: () => true } : pattern.endsWith("/**") ? compile(pattern.slice(0, -3), true) : void 0
-		};
-	});
-	const declaredBase = (pattern) => {
-		const parts = pattern.split("/");
-		const wildcard = parts.findIndex((part) => /[*?]/u.test(part));
-		return parts.slice(0, wildcard < 0 ? parts.length : wildcard).join("/") || ".";
-	};
-	const relatedBases = (left, right) => left === "." || right === "." || left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
-	const denoPositive = pm === "deno" ? positive.filter((pattern) => /[*?]/u.test(pattern)).map((pattern) => ({
-		base: declaredBase(pattern),
-		scope: anchorWorkspacePrefix(declaredBase(pattern), {
-			matches: () => true,
-			canDescend: () => true
-		}, resolveChild)
-	})) : [];
-	const denoOrdered = pm === "deno" ? patterns.filter((pattern) => /[*?]/u.test(pattern) || pattern.startsWith("!")).map((raw) => {
-		const isExcluded = raw.startsWith("!");
-		const pattern = path.posix.normalize(raw.replace(/^!/u, "")).replace(/\/+$/u, "");
-		const glob = compile(pattern, isExcluded);
-		if (!isExcluded) return {
-			excluded: false,
-			glob
-		};
-		return {
-			excluded: true,
-			glob: {
-				...glob,
-				matches(directory) {
-					if (!/[*?]/u.test(pattern)) return directory === pattern;
-					if (!glob.matches(directory)) return false;
-					const applicable = denoPositive.filter((item) => item.scope.matches(directory)).map((item) => relatedBases(item.base, declaredBase(pattern)));
-					if (applicable.some(Boolean) && applicable.some((value) => !value)) throw new ConfigError("Deno workspace exclusion has ambiguous overlapping bases; use consistent prefix spelling or separate non-overlapping patterns.");
-					return applicable.some(Boolean);
-				}
-			}
-		};
-	}) : [];
-	const bunPatterns = pm === "bun" ? patterns.map((raw) => {
-		const isExcluded = raw.startsWith("!");
-		const pattern = path.posix.normalize(raw.replace(/^!/u, "")).replace(/\/+$/u, "");
-		const usesGlob = isExcluded || pattern.includes("*") || pattern.includes("?") || pattern.includes("{") || pattern.includes("[");
-		const glob = compileWorkspaceGlob(pattern, {
-			...defaultWorkspaceGlobOptions,
-			noext: true
-		});
-		const subtree = isExcluded && pattern.endsWith("/**") ? compileWorkspaceGlob(pattern.slice(0, -3), {
-			...defaultWorkspaceGlobOptions,
-			noext: true
-		}) : void 0;
+const auditSuppression = defineRule({
+	bindings: { yarn: {
+		check(_ctx, config) {
+			return checkSuppression(config);
+		},
+		docs: "https://yarnpkg.com/configuration/yarnrc#npmAuditIgnoreAdvisories",
+		file: yarnrc$8
+	} },
+	description: "Flag audit advisory suppressions that may silently hide future vulnerabilities via broad glob patterns.",
+	docs: "https://yarnpkg.com/configuration/yarnrc#npmAuditIgnoreAdvisories",
+	id: "audit-suppression",
+	severity: "info",
+	title: "Review audit suppression entries"
+});
+//#endregion
+//#region src/domain/rules/block-auto-install.ts
+const { bunfig: bunfig$5 } = CONFIG_FILES;
+const blockAutoInstall = requireConfigKey({
+	bindings: { bun: {
+		docs: "https://bun.sh/docs/runtime/bunfig#install-auto",
+		file: bunfig$5,
+		keyPath: ["install", "auto"],
+		message: "Set `auto = \"disable\"` under [install] in bunfig.toml to prevent auto-install from bypassing security guards.",
+		value: "disable",
+		accept: (value) => value === "disable" || value === false
+	} },
+	description: "Disable auto-install so dependencies are only installed through an explicit install step where security guards apply.",
+	docs: "https://bun.sh/docs/runtime/bunfig#install-auto",
+	id: "block-auto-install",
+	severity: "warn",
+	title: "Block automatic package installation"
+});
+//#endregion
+//#region src/domain/rules/block-exotic-subdeps.ts
+const { aubeWorkspace: aubeWorkspace$7, npmrc: npmrc$6, pnpmWorkspace: pnpmWorkspace$10 } = CONFIG_FILES;
+const isRootOrNone = (value) => value === "root" || value === "none";
+const npmMessage = "Set `allow-git=none` and `allow-remote=none` in .npmrc to block git/tarball URLs; use `root` only when direct URL dependencies are required.";
+const npmBinding$1 = {
+	check(_ctx, config) {
+		const git = getByPath(config, ["allow-git"]);
+		const remote = getByPath(config, ["allow-remote"]);
+		const invalid = [git, remote].find((value) => value !== void 0 && !isRootOrNone(value));
+		if (invalid === void 0 && git !== void 0 && remote !== void 0) return { state: "ok" };
 		return {
-			isExcluded,
-			usesGlob,
-			glob,
-			matches: (directory) => glob.matches(directory) || glob.matches(`${directory}/`) || subtree?.matches(directory) === true
+			state: "violation",
+			expected: "none",
+			...invalid === void 0 ? {} : { actual: invalid },
+			message: npmMessage,
+			remediation: proposeChanges(config, [{
+				file: npmrc$6,
+				keyPath: ["allow-git"],
+				op: "setKey",
+				value: "none"
+			}, {
+				file: npmrc$6,
+				keyPath: ["allow-remote"],
+				op: "setKey",
+				value: "none"
+			}])
 		};
-	}) : [];
-	const bunOrdered = bunPatterns.filter(({ usesGlob }) => usesGlob);
-	const bunLiterals = bunPatterns.filter(({ isExcluded, usesGlob }) => !isExcluded && !usesGlob);
-	const bunTraversal = bunPatterns.filter(({ isExcluded }) => !isExcluded).map(({ glob }) => glob);
-	const denoLiteral = pm === "deno" ? positive.filter((pattern) => !/[*?]/u.test(pattern)).map((pattern) => compile(pattern)) : [];
-	if (definition.denoManifests && denoOrdered.findLast(({ glob }) => glob.matches("."))?.excluded === false) throw new ConfigError("deno.json#workspace: a Deno workspace cannot contain itself.");
-	if (positive.length === 0 || positive.every((pattern) => pattern === ".")) return [];
-	if (!fs.readDirectories) throw new UsageError("Workspace discovery requires FileSystem.readDirectories; no host filesystem fallback is used.");
-	const result = [];
-	const pending = ["."];
-	while (pending.length > 0) {
-		const current = pending.pop();
-		if (current === void 0) break;
-		for (const name of readDirectories(current)) {
-			if (name === ".git" || name === "node_modules") continue;
-			const directory = asRelPath(current === "." ? name : `${current}/${name}`);
-			if (pm === "bun" && name === "CMakeFiles" && !bunLiterals.some(({ glob }) => glob.matches(directory) || glob.canDescend(directory))) continue;
-			const inVendor = skipVendor && (directory === "vendor" || directory.startsWith("vendor/"));
-			if (inVendor && !denoLiteral.some((pattern) => pattern.matches(directory) || pattern.canDescend(directory))) continue;
-			const isExcluded = pm !== "deno" && excluded.some(({ glob }) => glob.matches(directory) || glob.matches(`${directory}/`));
-			if (excluded.some(({ subtree }) => subtree?.matches(directory))) continue;
-			const lastDenoMatch = denoOrdered.findLast(({ glob }) => glob.matches(directory));
-			const lastBunMatch = bunOrdered.findLast(({ matches }) => matches(directory));
-			if (pm === "deno" ? denoLiteral.some((pattern) => pattern.matches(directory)) || !inVendor && lastDenoMatch?.excluded === false : pm === "bun" ? bunLiterals.some(({ glob }) => glob.matches(directory)) || lastBunMatch?.isExcluded === false : !isExcluded && included.some((pattern) => pattern.matches(directory))) result.push(directory);
-			if ((pm === "bun" ? bunTraversal : inVendor ? denoLiteral : included).some((pattern) => pattern.canDescend(directory))) pending.push(directory);
-		}
-	}
-	return result.sort();
+	},
+	docs: "https://docs.npmjs.com/cli/v12/using-npm/config#allow-git",
+	file: npmrc$6,
+	versionNote: { defaultSafeSince: "npm 12.0.0" }
 };
-//#endregion
-//#region src/application/workspace-contexts.ts
-/** Expand each manager's declarations into isolated publication contexts. */
-const collectWorkspaceMembers = (ctx, fs, pms, projectType) => pms.flatMap((pm) => {
-	const seen = /* @__PURE__ */ new Set();
-	return workspaceDefinitions(ctx, pm).flatMap((definition) => workspaceDirectories(ctx, fs, definition, pm).flatMap((directory) => {
-		const root = resolveIn(ctx.root, directory);
-		const manifest = resolveIn(root, asRelPath("package.json"));
-		const denoManifest = resolveIn(root, asRelPath("deno.json"));
-		const denoJsonc = resolveIn(root, asRelPath("deno.jsonc"));
-		const allowed = new Set(pm === "deno" ? [
-			manifest,
-			denoManifest,
-			denoJsonc
-		] : [manifest]);
-		const memberFs = {
-			exists: (file) => allowed.has(file) && fs.exists(file),
-			readText: (file) => allowed.has(file) ? fs.readText(file) : void 0
-		};
-		try {
-			const explicitMember = definition.patterns.some((pattern) => !pattern.startsWith("!") && !/[*?]/u.test(pattern) && path.posix.normalize(pattern).replace(/\/+$/u, "") === directory);
-			if (!definition.denoManifests && !fs.exists(manifest)) {
-				if (pm === "deno" && explicitMember) throw new ConfigError("Declared npm workspace member has no package.json.");
-				return [];
-			}
-			if (pm === "deno" && !fs.exists(denoManifest) && fs.exists(denoJsonc)) throw new ConfigError("deno.jsonc is not supported; use strict deno.json.");
-			const memberCtx = createRepoContext(root, memberFs, projectType);
-			if (!definition.denoManifests && !memberCtx.packageJson) return [];
-			if (!memberCtx.packageJson && !memberCtx.exists(asRelPath("deno.json"))) {
-				if (definition.denoManifests && explicitMember) throw new ConfigError("Declared Deno member has no deno.json or package.json.");
-				return [];
-			}
-			if (pm === "deno") {
-				if (createConfigParser(codecFor, memberCtx)(CONFIG_FILES.denoJson).workspace !== void 0 || memberCtx.packageJson?.workspaces !== void 0) throw new ConfigError("Nested workspace declarations are not supported by Deno.");
+const blockExoticSubdeps = overrideBindings(requireConfigKey({
+	bindings: {
+		aube: {
+			docs: "https://aube.jdx.dev/security.html",
+			documentedDefault: true,
+			file: aubeWorkspace$7,
+			keyPath: ["blockExoticSubdeps"],
+			message: "Set `blockExoticSubdeps: true` in aube-workspace.yaml to block git/tarball URLs in transitive dependencies.",
+			value: true
+		},
+		pnpm: {
+			docs: "https://pnpm.io/settings#blockexoticsubdeps",
+			documentedDefault: true,
+			file: pnpmWorkspace$10,
+			keyPath: ["blockExoticSubdeps"],
+			message: "Set `blockExoticSubdeps: true` in pnpm-workspace.yaml to block git/tarball URLs in transitive dependencies.",
+			value: true,
+			versionNote: {
+				configAvailableSince: "pnpm 10.26.0",
+				defaultSafeSince: "pnpm 10.26.0"
 			}
-			if (seen.has(directory)) return [];
-			seen.add(directory);
-			return [{
-				directory,
-				pm,
-				ctx: memberCtx
-			}];
-		} catch (error) {
-			if (error instanceof ConfigError) throw new ConfigError(`${directory}/${error.message}`);
-			throw error;
 		}
-	}));
+	},
+	description: "Refuse to install transitive dependencies sourced from git or tarball URLs, which bypass registry integrity checking.",
+	docs: "https://pnpm.io/settings#blockexoticsubdeps",
+	id: "block-exotic-subdeps",
+	severity: "warn",
+	title: "Block exotic subdependencies"
+}), { npm: npmBinding$1 });
+//#endregion
+//#region src/domain/rules/bun-security-scanner.ts
+const { bunfig: bunfig$4 } = CONFIG_FILES;
+const bunSecurityScanner = defineRule({
+	bindings: { bun: {
+		check(ctx, config) {
+			const scanner = getByPath(config, [
+				"install",
+				"security",
+				"scanner"
+			]);
+			if (isNonBlankString(scanner)) return { state: "ok" };
+			return {
+				remediation: guardRemediationAvailability("bun", ctx.pmVersion, {
+					kind: "manual",
+					steps: ["Add `[install.security] scanner = \"@socketsecurity/bun-security-scanner\"` (or another bun-compatible scanner) to bunfig.toml."]
+				}, [{
+					file: bunfig$4,
+					keyPath: [
+						"install",
+						"security",
+						"scanner"
+					]
+				}]),
+				actual: scanner,
+				message: "Configure `[install.security] scanner = \"...\"` in bunfig.toml (e.g. `@socketsecurity/bun-security-scanner`) to scan new packages on install.",
+				state: "violation"
+			};
+		},
+		docs: "https://bun.com/docs/pm/security-scanner-api",
+		file: bunfig$4,
+		versionNote: { configAvailableSince: "bun 1.2.21" }
+	} },
+	description: "Bun supports a Security Scanner API that intercepts new packages at install time (e.g. Socket Firewall).",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#preinstall-scanners",
+	id: "bun-security-scanner",
+	severity: "info",
+	title: "Enable a bun install-time security scanner"
 });
 //#endregion
-//#region src/domain/setting-availability.ts
-const { npmrc: npmrc$7, packageJson: packageJson$2, pnpmWorkspace: pnpmWorkspace$11, yarnrc: yarnrc$10, bunfig: bunfig$6 } = CONFIG_FILES;
-const settingAvailability = [
-	{
-		pm: "npm",
-		file: npmrc$7,
-		keyPath: ["provenance"],
-		since: "9.5.0",
-		source: "https://github.com/npm/cli/releases/tag/v9.5.0"
+//#region src/domain/rules/checksum-verification.ts
+const { yarnrc: yarnrc$7 } = CONFIG_FILES;
+const checksumVerification = requireConfigKey({
+	bindings: { yarn: {
+		docs: "https://yarnpkg.com/configuration/yarnrc#checksumBehavior",
+		documentedDefault: "throw",
+		file: yarnrc$7,
+		keyPath: ["checksumBehavior"],
+		message: "Set `checksumBehavior: throw` in .yarnrc.yml to reject packages whose checksum does not match the lockfile.",
+		value: "throw"
+	} },
+	description: "Throw on checksum mismatches so tampered or corrupted packages are never silently installed.",
+	docs: "https://yarnpkg.com/configuration/yarnrc#checksumBehavior",
+	id: "checksum-verification",
+	severity: "warn",
+	title: "Verify package checksums"
+});
+//#endregion
+//#region src/domain/entities/signals.ts
+const PM_SIGNALS = {
+	aube: {
+		configs: [CONFIG_FILES.aubeWorkspace.path],
+		lockfiles: ["aube-lock.yaml"],
+		reusesLockfiles: [
+			"pnpm-lock.yaml",
+			"package-lock.json",
+			"npm-shrinkwrap.json",
+			"yarn.lock",
+			"bun.lock"
+		]
 	},
-	{
-		pm: "npm",
-		file: packageJson$2,
-		keyPath: ["publishConfig", "provenance"],
-		since: "9.5.0",
-		source: "https://github.com/npm/cli/releases/tag/v9.5.0"
+	bun: {
+		configs: [CONFIG_FILES.bunfig.path],
+		lockfiles: ["bun.lock", "bun.lockb"]
 	},
-	{
-		pm: "npm",
-		file: npmrc$7,
-		keyPath: ["min-release-age"],
-		since: "11.10.0",
-		source: "https://github.com/npm/cli/releases/tag/v11.10.0"
+	deno: {
+		configs: [CONFIG_FILES.denoJson.path, "deno.jsonc"],
+		lockfiles: ["deno.lock"]
 	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["strictDepBuilds"],
-		since: "10.6.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v10.6.0"
+	npm: {
+		configs: [],
+		lockfiles: ["package-lock.json", "npm-shrinkwrap.json"]
 	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["dangerouslyAllowAllBuilds"],
-		since: "10.9.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v10.9.0"
-	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["minimumReleaseAge"],
-		since: "10.16.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v10.16.0"
-	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["minimumReleaseAgeExclude"],
-		since: "10.16.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v10.16.0"
-	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["trustPolicy"],
-		since: "10.21.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v10.21.0"
-	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["blockExoticSubdeps"],
-		since: "10.26.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v10.26.0"
-	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["frozenStore"],
-		since: "11.7.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v11.7.0"
-	},
-	{
-		pm: "yarn",
-		file: yarnrc$10,
-		keyPath: ["enableHardenedMode"],
-		since: "4.0.0",
-		source: "https://yarnpkg.com/blog/release/4.0"
-	},
-	{
-		pm: "yarn",
-		file: yarnrc$10,
-		keyPath: ["npmMinimalAgeGate"],
-		since: "4.10.0",
-		source: "https://github.com/yarnpkg/berry/releases/tag/@yarnpkg/cli/4.10.0"
-	},
-	{
-		pm: "yarn",
-		file: yarnrc$10,
-		keyPath: ["npmPreapprovedPackages"],
-		since: "4.10.0",
-		source: "https://github.com/yarnpkg/berry/releases/tag/@yarnpkg/cli/4.10.0"
-	},
-	{
-		pm: "bun",
-		file: bunfig$6,
-		keyPath: ["install", "minimumReleaseAge"],
-		since: "1.3.0",
-		source: "https://bun.com/blog/bun-v1.3#minimum-release-age"
-	},
-	{
-		pm: "bun",
-		file: bunfig$6,
-		keyPath: [
-			"install",
-			"security",
-			"scanner"
-		],
-		since: "1.2.21",
-		source: "https://bun.com/blog/bun-v1.2.21#security-scanner-api-for-bun-install"
+	pnpm: {
+		configs: [CONFIG_FILES.pnpmWorkspace.path],
+		lockfiles: ["pnpm-lock.yaml"]
 	},
-	{
-		pm: "deno",
-		file: npmrc$7,
-		keyPath: ["min-release-age"],
-		since: "2.8.1",
-		source: "https://github.com/denoland/deno/releases/tag/v2.8.1"
+	yarn: {
+		configs: [CONFIG_FILES.yarnrc.path],
+		lockfiles: ["yarn.lock"]
 	}
-];
+};
 //#endregion
-//#region src/domain/services/remediation-availability.ts
-const sameSetting = (setting, target) => target.file.path === setting.file.path && target.file.kind === setting.file.kind && target.keyPath.length === setting.keyPath.length && target.keyPath.every((key, index) => key === setting.keyPath[index]);
-/** Undefined means the target version or the setting's introduction is unknown. */
-const settingSupportedByTarget = (pm, version, target) => {
-	if (version === void 0) return void 0;
-	const availability = settingAvailability.find((setting) => setting.pm === pm && sameSetting(setting, target));
-	return availability === void 0 ? void 0 : !lt(version, availability.since);
+//#region src/domain/rules/commit-lockfile.ts
+const LOCKFILE_DOCS = {
+	aube: "https://github.com/aubepkg/aube/blob/main/docs/package-manager/lockfiles.md",
+	bun: "https://bun.com/docs/install/lockfile",
+	deno: "https://docs.deno.com/runtime/fundamentals/modules/#integrity-checking-and-lock-files",
+	npm: "https://docs.npmjs.com/cli/v12/configuring-npm/package-lock-json",
+	pnpm: "https://pnpm.io/git#lockfiles",
+	yarn: "https://yarnpkg.com/getting-started/qa#should-lockfiles-be-committed-to-the-repository"
 };
-/** Keep a proposal atomic and make known version prerequisites explicit. */
-const guardRemediationAvailability = (pm, version, remediation, targets = remediation?.kind === "automatic" ? remediation.operations : []) => {
-	if (version === void 0 || remediation === void 0) return remediation;
-	const unsupported = settingAvailability.filter((setting) => setting.pm === pm && lt(version, setting.since) && targets.some((target) => sameSetting(setting, target)));
-	if (unsupported.length === 0) return remediation;
+const LOCKFILE_VERSION_NOTES = { deno: { configAvailableSince: "deno 1.28.0" } };
+const lockfileBinding = (pm) => {
+	const { lockfiles, reusesLockfiles } = PM_SIGNALS[pm];
+	const [primary] = lockfiles;
+	const accepted = [...lockfiles, ...reusesLockfiles ?? []].filter((lockfile) => pm !== "npm" || lockfile === primary);
 	return {
-		kind: "manual",
-		steps: [`Target ${pm} ${version} does not support this proposal: ${unsupported.map((setting) => `${setting.file.path}#${setting.keyPath.join(".")} requires ${pm} >=${setting.since}`).join("; ")}. Verify and upgrade the target before applying the steps below, or choose a supported security control. Removing a setting alone does not provide its protection.`, ...remediation.kind === "manual" ? remediation.steps : remediation.operations.map((operation) => `After upgrading, set ${operation.file.path}#${operation.keyPath.join(".")} to ${JSON.stringify(operation.value)}.`)]
+		check(ctx) {
+			if (pm === "aube" && ctx.exists(asRelPath("bun.lockb")) && !ctx.exists(asRelPath("bun.lock"))) return {
+				state: "violation",
+				message: "Aube cannot read bun.lockb, even when another lockfile exists.",
+				remediation: {
+					kind: "manual",
+					steps: ["Run `bun install --save-text-lockfile` to generate bun.lock, then commit it."]
+				}
+			};
+			if (accepted.some((lf) => ctx.exists(asRelPath(lf)))) return { state: "ok" };
+			return {
+				remediation: {
+					kind: "manual",
+					steps: [`Install dependencies to generate ${primary}, then commit it.`]
+				},
+				message: `No lockfile found. Generate and commit ${primary}.`,
+				state: "violation"
+			};
+		},
+		docs: LOCKFILE_DOCS[pm],
+		versionNote: LOCKFILE_VERSION_NOTES[pm]
 	};
 };
-//#endregion
-//#region src/domain/rules/remediation.ts
-/** Scalar writes must not discard an existing container or replace a non-object parent. */
-const proposeChanges = (config, operations) => {
-	for (const operation of operations) {
-		let current = config;
-		for (const key of operation.keyPath) {
-			if (current === void 0) break;
-			if (!isPlainRecord(current)) return {
+const denoBinding$1 = {
+	file: CONFIG_FILES.denoJson,
+	docs: LOCKFILE_DOCS.deno,
+	versionNote: LOCKFILE_VERSION_NOTES.deno,
+	check(ctx, config) {
+		const lock = getByPath(config, ["lock"]);
+		if (lock != null && typeof lock !== "boolean" && typeof lock !== "string" && !(isPlainRecord(lock) && (lock.path == null || typeof lock.path === "string") && (lock.frozen == null || typeof lock.frozen === "boolean"))) return {
+			state: "violation",
+			message: "Invalid Deno lock setting.",
+			remediation: {
 				kind: "manual",
-				steps: [`Review ${operation.file.path}: ${operation.keyPath.join(".")} has a non-object parent. Restructure it before setting the value to ${JSON.stringify(operation.value)}.`]
-			};
-			current = Object.hasOwn(current, key) ? current[key] : void 0;
-		}
-		if (current !== null && typeof current === "object") return {
-			kind: "manual",
-			steps: [`Review ${operation.file.path}: ${operation.keyPath.join(".")} contains nested settings. Preserve the required entries when correcting this value.`]
+				steps: ["Use a boolean, a lockfile path, or an object with optional path and frozen fields."]
+			}
+		};
+		const selected = typeof lock === "string" ? lock : getByPath(config, ["lock", "path"]);
+		const lockPath = selected == null ? asRelPath("deno.lock") : selected;
+		if (lock !== false && isRelPath(lockPath) && ctx.exists(lockPath)) return { state: "ok" };
+		return {
+			state: "violation",
+			message: lock === false ? "Enable the Deno lockfile; `lock: false` disables it even when deno.lock exists." : `No readable project lockfile found at ${String(lockPath)}.`,
+			remediation: {
+				kind: "manual",
+				steps: ["Enable lockfile use in deno.json and generate and commit the configured lockfile within the project."]
+			}
 		};
 	}
-	return {
-		kind: "automatic",
-		operations
-	};
 };
-//#endregion
-//#region src/domain/rules/builders/require-config-key.ts
-const overrideBindings = (rule, overrides) => ({
-	...rule,
+const commitLockfile = defineRule({
 	bindings: {
-		...rule.bindings,
-		...overrides
-	}
+		aube: lockfileBinding("aube"),
+		bun: lockfileBinding("bun"),
+		deno: denoBinding$1,
+		npm: lockfileBinding("npm"),
+		pnpm: lockfileBinding("pnpm"),
+		yarn: lockfileBinding("yarn")
+	},
+	description: "Lockfiles pin the full dependency tree and integrity hashes, enabling reproducible, verifiable installs (e.g. `npm ci`).",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-include-lockfiles",
+	id: "commit-lockfile",
+	severity: "error",
+	title: "Commit a lockfile"
 });
-const accepts = (spec, actual) => spec.accept ? spec.accept(actual) : actual === spec.value;
-const checkKeyValue = (spec, config) => {
-	const actual = getByPath(config, spec.keyPath);
-	const coveredByDefault = actual === void 0 && spec.documentedDefault !== void 0 && spec.versionNote?.defaultSafeSince === void 0 && accepts(spec, spec.documentedDefault);
-	if (!coveredByDefault && accepts(spec, actual)) return { state: "ok" };
-	const severity = coveredByDefault ? spec.defaultSatisfiedSeverity ?? "info" : void 0;
-	if (severity === "off") return { state: "ok" };
+//#endregion
+//#region src/domain/rules/dependency-overrides.ts
+const { aubeWorkspace: aubeWorkspace$6, pnpmWorkspace: pnpmWorkspace$9 } = CONFIG_FILES;
+const isNonEmptyObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
+const checkOverrides = (config, file) => {
+	const value = getByPath(config, ["overrides"]);
+	if (!isNonEmptyObject$2(value)) return { state: "ok" };
 	return {
+		actual: value,
+		message: `Review \`overrides\` in ${file}. Overrides can replace transitive dependencies with arbitrary versions or forks.`,
 		state: "violation",
-		actual,
-		expected: spec.value,
-		message: spec.message,
-		...severity === void 0 ? {} : { severity },
-		remediation: proposeChanges(config, [{
-			file: spec.file,
-			keyPath: spec.keyPath,
-			op: "setKey",
-			value: spec.value
-		}])
+		remediation: {
+			kind: "manual",
+			steps: ["Review each entry in `overrides` — verify pinned versions address a known CVE and are not redirecting to untrusted packages."]
+		}
 	};
 };
-const buildBinding = (spec, pm, applies) => ({
-	check(ctx, config) {
-		if (typeof applies !== "undefined" && !applies(ctx)) return { state: "na" };
-		const status = checkKeyValue(spec, config);
-		return status.state === "violation" ? {
-			...status,
-			remediation: guardRemediationAvailability(pm, ctx.pmVersion, status.remediation, [spec])
-		} : status;
+const makeBinding = (file, fileName, docs) => ({
+	check(_ctx, config) {
+		return checkOverrides(config, fileName);
 	},
-	docs: spec.docs,
-	file: spec.file,
-	severity: spec.severity,
-	versionNote: spec.versionNote
+	docs,
+	file
+});
+const dependencyOverrides = defineRule({
+	bindings: {
+		aube: makeBinding(aubeWorkspace$6, "aube-workspace.yaml", "https://aube.sh/settings/"),
+		pnpm: makeBinding(pnpmWorkspace$9, "pnpm-workspace.yaml", "https://pnpm.io/settings#overrides")
+	},
+	description: "Flag dependency overrides that can replace transitive packages with arbitrary versions or forks — a supply-chain injection vector.",
+	docs: "https://pnpm.io/settings#overrides",
+	id: "dependency-overrides",
+	severity: "info",
+	title: "Review dependency overrides"
 });
-/** Build a Rule from a per-PM table of {file, keyPath, value, message}. */
-const requireConfigKey = (options) => {
-	const bindings = {};
-	for (const pm of PMS) {
-		const spec = options.bindings[pm];
-		if (typeof spec !== "undefined") {
-			if ("extraFix" in spec) throw new TypeError("extraFix is no longer supported; use a custom binding.");
-			bindings[pm] = buildBinding(spec, pm, options.applies);
-		}
-	}
-	return {
-		bindings,
-		description: options.description,
-		docs: options.docs,
-		id: options.id,
-		projectTypes: options.projectTypes,
-		severity: options.severity,
-		title: options.title
-	};
-};
-//#endregion
-//#region src/domain/rules/builders/with-aube-paranoid.ts
-const withAubeParanoid = (rule) => {
-	const { aube } = rule.bindings;
-	if (!aube) return rule;
-	return overrideBindings(rule, { aube: {
-		...aube,
-		check(ctx, config) {
-			if (getByPath(config, ["paranoid"]) === true) return { state: "ok" };
-			return aube.check(ctx, config);
-		}
-	} });
-};
-//#endregion
-//#region src/domain/rules/advisory-check.ts
-const { aubeWorkspace: aubeWorkspace$8 } = CONFIG_FILES;
-const advisoryCheck = withAubeParanoid(requireConfigKey({
-	bindings: { aube: {
-		accept: (value) => value === "on" || value === "required",
-		docs: "https://aube.jdx.dev/security.html",
-		documentedDefault: "on",
-		file: aubeWorkspace$8,
-		keyPath: ["advisoryCheck"],
-		message: "Set `advisoryCheck: on` (or `required`) in aube-workspace.yaml to check dependencies against known-malicious advisories.",
-		value: "on"
-	} },
-	description: "Query the OSV database for known-malicious packages during dependency resolution.",
-	docs: "https://aube.jdx.dev/security.html",
-	id: "advisory-check",
-	severity: "warn",
-	title: "Enable malicious-package advisory checks"
-}));
-//#endregion
-//#region src/domain/rules/config-predicates.ts
-const isNonBlankString = (value) => typeof value === "string" && value.trim().length > 0;
-const isStringList = (value) => Array.isArray(value) && Array.from(value).every(isNonBlankString);
 //#endregion
-//#region src/domain/rules/approved-git-repos.ts
-const { yarnrc: yarnrc$9 } = CONFIG_FILES;
-const message = "Set `approvedGitRepositories: []` in .yarnrc.yml to block all git: protocol dependencies (or list approved repository globs).";
-const approvedGitRepos = defineRule({
-	bindings: { yarn: {
-		check(_ctx, config) {
-			const value = getByPath(config, ["approvedGitRepositories"]);
-			if (isStringList(value)) return { state: "ok" };
+//#region src/domain/rules/disable-lifecycle-scripts.ts
+const { npmrc: npmrc$5, pnpmWorkspace: pnpmWorkspace$8, yarnrc: yarnrc$6, aubeWorkspace: aubeWorkspace$5, bunfig: bunfig$3 } = CONFIG_FILES;
+const pnpmBinding$4 = {
+	check(ctx, config) {
+		if (getByPath(config, ["ignoreScripts"]) === true) return { state: "ok" };
+		const bypass = getByPath(config, ["dangerouslyAllowAllBuilds"]);
+		const strict = getByPath(config, ["strictDepBuilds"]);
+		if (bypass === true) {
+			const bypassTarget = {
+				file: pnpmWorkspace$8,
+				keyPath: ["dangerouslyAllowAllBuilds"]
+			};
+			if (settingSupportedByTarget("pnpm", ctx.pmVersion, bypassTarget) === false) {
+				const proposal = {
+					kind: "manual",
+					steps: ["Remove `dangerouslyAllowAllBuilds: true` before upgrading to pnpm 10.9.0 or newer; the declared target ignores it, but a later version would activate the bypass.", ...strict === true ? [] : ["Set `strictDepBuilds: true` in pnpm-workspace.yaml to enable lifecycle-script gating for the declared target."]]
+				};
+				return {
+					state: "violation",
+					actual: bypass,
+					expected: false,
+					message: "The declared target ignores this future-version bypass. Removing the ignored bypass alone does not provide protection against lifecycle scripts, and leaving it configured would disable gating after an upgrade.",
+					remediation: strict === true ? proposal : guardRemediationAvailability("pnpm", ctx.pmVersion, proposal, [{
+						file: pnpmWorkspace$8,
+						keyPath: ["strictDepBuilds"]
+					}])
+				};
+			}
+			const proposal = {
+				kind: "manual",
+				steps: ["After upgrading, remove `dangerouslyAllowAllBuilds: true` (or set it to false) and configure lifecycle-script gating."]
+			};
+			const guarded = guardRemediationAvailability("pnpm", ctx.pmVersion, proposal, [{
+				file: pnpmWorkspace$8,
+				keyPath: ["strictDepBuilds"]
+			}, {
+				file: pnpmWorkspace$8,
+				keyPath: ["dangerouslyAllowAllBuilds"]
+			}]);
+			if (guarded !== proposal) return {
+				state: "violation",
+				actual: bypass,
+				expected: false,
+				message: "The target cannot use the proposed YAML lifecycle-script controls. Removing an unsupported bypass alone does not provide protection.",
+				remediation: guarded
+			};
 			return {
+				actual: bypass,
+				expected: false,
 				remediation: {
 					kind: "manual",
-					steps: ["Add `approvedGitRepositories: []` to .yarnrc.yml to block all git deps, or list specific approved repository URL globs."]
+					steps: ["Remove `dangerouslyAllowAllBuilds: true` from pnpm-workspace.yaml (or set it to `false`). Setting `strictDepBuilds: true` alone has no effect while the bypass remains."]
 				},
-				actual: value,
-				expected: "[]",
-				message,
+				message: "`dangerouslyAllowAllBuilds: true` in pnpm-workspace.yaml bypasses strictDepBuilds — remove it (or set it to false) to restore lifecycle-script gating.",
 				state: "violation"
 			};
-		},
-		docs: "https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories",
-		file: yarnrc$9,
-		versionNote: { configAvailableSince: "yarn 4.14.0" }
-	} },
-	description: "Restrict git: protocol dependencies to an explicit allowlist of approved repository URL patterns.",
-	docs: "https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories",
-	id: "approved-git-repos",
-	severity: "warn",
-	title: "Approve git repository dependencies"
-});
-//#endregion
-//#region src/domain/rules/audit-suppression.ts
-const { yarnrc: yarnrc$8 } = CONFIG_FILES;
-const isNonEmptyArray = (value) => Array.isArray(value) && value.length > 0;
-const SUPPRESSION_KEYS = ["npmAuditIgnoreAdvisories", "npmAuditExcludePackages"];
-const checkSuppression = (config) => {
-	const present = SUPPRESSION_KEYS.filter((key) => isNonEmptyArray(getByPath(config, [key])));
-	const [first] = present;
-	if (typeof first === "undefined") return { state: "ok" };
-	return {
-		actual: getByPath(config, [first]),
-		message: `Review audit suppression in .yarnrc.yml (${present.join(", ")}). Broad glob patterns can silently hide future vulnerabilities.`,
-		state: "violation",
-		remediation: {
-			kind: "manual",
-			steps: ["Review entries in `npmAuditIgnoreAdvisories` and `npmAuditExcludePackages` — remove stale suppressions and overly broad glob patterns."]
 		}
-	};
-};
-const auditSuppression = defineRule({
-	bindings: { yarn: {
-		check(_ctx, config) {
-			return checkSuppression(config);
-		},
-		docs: "https://yarnpkg.com/configuration/yarnrc#npmAuditIgnoreAdvisories",
-		file: yarnrc$8
-	} },
-	description: "Flag audit advisory suppressions that may silently hide future vulnerabilities via broad glob patterns.",
-	docs: "https://yarnpkg.com/configuration/yarnrc#npmAuditIgnoreAdvisories",
-	id: "audit-suppression",
-	severity: "info",
-	title: "Review audit suppression entries"
-});
-//#endregion
-//#region src/domain/rules/block-auto-install.ts
-const { bunfig: bunfig$5 } = CONFIG_FILES;
-const blockAutoInstall = requireConfigKey({
-	bindings: { bun: {
-		docs: "https://bun.sh/docs/runtime/bunfig#install-auto",
-		file: bunfig$5,
-		keyPath: ["install", "auto"],
-		message: "Set `auto = \"disable\"` under [install] in bunfig.toml to prevent auto-install from bypassing security guards.",
-		value: "disable",
-		accept: (value) => value === "disable" || value === false
-	} },
-	description: "Disable auto-install so dependencies are only installed through an explicit install step where security guards apply.",
-	docs: "https://bun.sh/docs/runtime/bunfig#install-auto",
-	id: "block-auto-install",
-	severity: "warn",
-	title: "Block automatic package installation"
-});
-//#endregion
-//#region src/domain/rules/block-exotic-subdeps.ts
-const { aubeWorkspace: aubeWorkspace$7, npmrc: npmrc$6, pnpmWorkspace: pnpmWorkspace$10 } = CONFIG_FILES;
-const isRootOrNone = (value) => value === "root" || value === "none";
-const npmMessage = "Set `allow-git=none` and `allow-remote=none` in .npmrc to block git/tarball URLs; use `root` only when direct URL dependencies are required.";
-const npmBinding$2 = {
-	check(_ctx, config) {
-		const git = getByPath(config, ["allow-git"]);
-		const remote = getByPath(config, ["allow-remote"]);
-		const invalid = [git, remote].find((value) => value !== void 0 && !isRootOrNone(value));
-		if (invalid === void 0 && git !== void 0 && remote !== void 0) return { state: "ok" };
+		if (strict === true) return { state: "ok" };
 		return {
 			state: "violation",
-			expected: "none",
-			...invalid === void 0 ? {} : { actual: invalid },
-			message: npmMessage,
-			remediation: proposeChanges(config, [{
-				file: npmrc$6,
-				keyPath: ["allow-git"],
-				op: "setKey",
-				value: "none"
-			}, {
-				file: npmrc$6,
-				keyPath: ["allow-remote"],
+			actual: strict,
+			expected: true,
+			message: strict === void 0 ? "Set `strictDepBuilds: true` in pnpm-workspace.yaml to pin lifecycle-script gating across versions." : "Set `strictDepBuilds: true` in pnpm-workspace.yaml to block silent skips of un-approved dep builds.",
+			remediation: guardRemediationAvailability("pnpm", ctx.pmVersion, proposeChanges(config, [{
+				file: pnpmWorkspace$8,
+				keyPath: ["strictDepBuilds"],
 				op: "setKey",
-				value: "none"
+				value: true
+			}]), [{
+				file: pnpmWorkspace$8,
+				keyPath: ["strictDepBuilds"]
 			}])
 		};
 	},
-	docs: "https://docs.npmjs.com/cli/v12/using-npm/config#allow-git",
-	file: npmrc$6,
-	versionNote: { defaultSafeSince: "npm 12.0.0" }
+	docs: "https://pnpm.io/settings#strictdepbuilds",
+	file: pnpmWorkspace$8,
+	versionNote: {
+		configAvailableSince: "pnpm 10.3.0",
+		note: "pnpm-workspace.yaml settings require pnpm 10.6.0",
+		defaultSafeSince: "pnpm 11.0.0"
+	}
 };
-const blockExoticSubdeps = overrideBindings(requireConfigKey({
-	bindings: {
-		aube: {
-			docs: "https://aube.jdx.dev/security.html",
-			documentedDefault: true,
-			file: aubeWorkspace$7,
-			keyPath: ["blockExoticSubdeps"],
-			message: "Set `blockExoticSubdeps: true` in aube-workspace.yaml to block git/tarball URLs in transitive dependencies.",
-			value: true
-		},
-		pnpm: {
-			docs: "https://pnpm.io/settings#blockexoticsubdeps",
-			documentedDefault: true,
-			file: pnpmWorkspace$10,
-			keyPath: ["blockExoticSubdeps"],
-			message: "Set `blockExoticSubdeps: true` in pnpm-workspace.yaml to block git/tarball URLs in transitive dependencies.",
-			value: true,
-			versionNote: {
-				configAvailableSince: "pnpm 10.26.0",
-				defaultSafeSince: "pnpm 10.26.0"
-			}
-		}
-	},
-	description: "Refuse to install transitive dependencies sourced from git or tarball URLs, which bypass registry integrity checking.",
-	docs: "https://pnpm.io/settings#blockexoticsubdeps",
-	id: "block-exotic-subdeps",
-	severity: "warn",
-	title: "Block exotic subdependencies"
-}), { npm: npmBinding$2 });
-//#endregion
-//#region src/domain/rules/bun-security-scanner.ts
-const { bunfig: bunfig$4 } = CONFIG_FILES;
-const bunSecurityScanner = defineRule({
-	bindings: { bun: {
-		check(ctx, config) {
-			const scanner = getByPath(config, [
-				"install",
-				"security",
-				"scanner"
-			]);
-			if (isNonBlankString(scanner)) return { state: "ok" };
-			return {
-				remediation: guardRemediationAvailability("bun", ctx.pmVersion, {
-					kind: "manual",
-					steps: ["Add `[install.security] scanner = \"@socketsecurity/bun-security-scanner\"` (or another bun-compatible scanner) to bunfig.toml."]
-				}, [{
-					file: bunfig$4,
-					keyPath: [
-						"install",
-						"security",
-						"scanner"
-					]
-				}]),
-				actual: scanner,
-				message: "Configure `[install.security] scanner = \"...\"` in bunfig.toml (e.g. `@socketsecurity/bun-security-scanner`) to scan new packages on install.",
-				state: "violation"
-			};
-		},
-		docs: "https://bun.com/docs/pm/security-scanner-api",
-		file: bunfig$4,
-		versionNote: { configAvailableSince: "bun 1.2.21" }
-	} },
-	description: "Bun supports a Security Scanner API that intercepts new packages at install time (e.g. Socket Firewall).",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#preinstall-scanners",
-	id: "bun-security-scanner",
-	severity: "info",
-	title: "Enable a bun install-time security scanner"
-});
-//#endregion
-//#region src/domain/rules/checksum-verification.ts
-const { yarnrc: yarnrc$7 } = CONFIG_FILES;
-const checksumVerification = requireConfigKey({
-	bindings: { yarn: {
-		docs: "https://yarnpkg.com/configuration/yarnrc#checksumBehavior",
-		documentedDefault: "throw",
-		file: yarnrc$7,
-		keyPath: ["checksumBehavior"],
-		message: "Set `checksumBehavior: throw` in .yarnrc.yml to reject packages whose checksum does not match the lockfile.",
-		value: "throw"
-	} },
-	description: "Throw on checksum mismatches so tampered or corrupted packages are never silently installed.",
-	docs: "https://yarnpkg.com/configuration/yarnrc#checksumBehavior",
-	id: "checksum-verification",
-	severity: "warn",
-	title: "Verify package checksums"
-});
-//#endregion
-//#region src/domain/entities/signals.ts
-const PM_SIGNALS = {
-	aube: {
-		configs: [CONFIG_FILES.aubeWorkspace.path],
-		lockfiles: ["aube-lock.yaml"],
-		reusesLockfiles: [
-			"pnpm-lock.yaml",
-			"package-lock.json",
-			"npm-shrinkwrap.json",
-			"yarn.lock",
-			"bun.lock"
-		]
-	},
-	bun: {
-		configs: [CONFIG_FILES.bunfig.path],
-		lockfiles: ["bun.lock", "bun.lockb"]
-	},
-	deno: {
-		configs: [CONFIG_FILES.denoJson.path, "deno.jsonc"],
-		lockfiles: ["deno.lock"]
-	},
-	npm: {
-		configs: [],
-		lockfiles: ["package-lock.json", "npm-shrinkwrap.json"]
-	},
-	pnpm: {
-		configs: [CONFIG_FILES.pnpmWorkspace.path],
-		lockfiles: ["pnpm-lock.yaml"]
-	},
-	yarn: {
-		configs: [CONFIG_FILES.yarnrc.path],
-		lockfiles: ["yarn.lock"]
-	}
-};
-//#endregion
-//#region src/domain/rules/commit-lockfile.ts
-const LOCKFILE_DOCS = {
-	aube: "https://github.com/aubepkg/aube/blob/main/docs/package-manager/lockfiles.md",
-	bun: "https://bun.com/docs/install/lockfile",
-	deno: "https://docs.deno.com/runtime/fundamentals/modules/#integrity-checking-and-lock-files",
-	npm: "https://docs.npmjs.com/cli/v12/configuring-npm/package-lock-json",
-	pnpm: "https://pnpm.io/git#lockfiles",
-	yarn: "https://yarnpkg.com/getting-started/qa#should-lockfiles-be-committed-to-the-repository"
-};
-const LOCKFILE_VERSION_NOTES = { deno: { configAvailableSince: "deno 1.28.0" } };
-const lockfileBinding = (pm) => {
-	const { lockfiles, reusesLockfiles } = PM_SIGNALS[pm];
-	const [primary] = lockfiles;
-	const accepted = [...lockfiles, ...reusesLockfiles ?? []].filter((lockfile) => pm !== "npm" || lockfile === primary);
-	return {
-		check(ctx) {
-			if (pm === "aube" && ctx.exists(asRelPath("bun.lockb")) && !ctx.exists(asRelPath("bun.lock"))) return {
-				state: "violation",
-				message: "Aube cannot read bun.lockb, even when another lockfile exists.",
-				remediation: {
-					kind: "manual",
-					steps: ["Run `bun install --save-text-lockfile` to generate bun.lock, then commit it."]
-				}
-			};
-			if (accepted.some((lf) => ctx.exists(asRelPath(lf)))) return { state: "ok" };
-			return {
-				remediation: {
-					kind: "manual",
-					steps: [`Install dependencies to generate ${primary}, then commit it.`]
-				},
-				message: `No lockfile found. Generate and commit ${primary}.`,
-				state: "violation"
-			};
-		},
-		docs: LOCKFILE_DOCS[pm],
-		versionNote: LOCKFILE_VERSION_NOTES[pm]
-	};
-};
-const denoBinding$2 = {
-	file: CONFIG_FILES.denoJson,
-	docs: LOCKFILE_DOCS.deno,
-	versionNote: LOCKFILE_VERSION_NOTES.deno,
+const aubeBinding$2 = {
 	check(ctx, config) {
-		const lock = getByPath(config, ["lock"]);
-		if (lock != null && typeof lock !== "boolean" && typeof lock !== "string" && !(isPlainRecord(lock) && (lock.path == null || typeof lock.path === "string") && (lock.frozen == null || typeof lock.frozen === "boolean"))) return {
+		const npmConfig = ctx.readConfig(npmrc$5);
+		const jail = getByPath(config, ["jailBuilds"]);
+		const strict = getByPath(npmConfig, ["strictDepBuilds"]);
+		if (jail === true && strict === true) return { state: "ok" };
+		const violations = [];
+		if (jail !== true) violations.push({
 			state: "violation",
-			message: "Invalid Deno lock setting.",
-			remediation: {
-				kind: "manual",
-				steps: ["Use a boolean, a lockfile path, or an object with optional path and frozen fields."]
-			}
+			file: aubeWorkspace$5.path,
+			actual: jail,
+			expected: true,
+			message: "Set `jailBuilds: true` in aube-workspace.yaml to sandbox approved builds.",
+			remediation: proposeChanges(config, [{
+				file: aubeWorkspace$5,
+				keyPath: ["jailBuilds"],
+				op: "setKey",
+				value: true
+			}])
+		});
+		if (strict !== true) violations.push({
+			state: "violation",
+			file: npmrc$5.path,
+			actual: strict,
+			expected: true,
+			message: "Set `strictDepBuilds=true` in .npmrc to reject unreviewed lifecycle scripts.",
+			remediation: proposeChanges(npmConfig, [{
+				file: npmrc$5,
+				keyPath: ["strictDepBuilds"],
+				op: "setKey",
+				value: true
+			}])
+		});
+		const [first, ...rest] = violations;
+		return !first ? { state: "ok" } : rest.length === 0 ? first : {
+			state: "violations",
+			violations: [first, ...rest]
 		};
-		const selected = typeof lock === "string" ? lock : getByPath(config, ["lock", "path"]);
-		const lockPath = selected == null ? asRelPath("deno.lock") : selected;
-		if (lock !== false && isRelPath(lockPath) && ctx.exists(lockPath)) return { state: "ok" };
+	},
+	docs: "https://aube.jdx.dev/security.html",
+	file: aubeWorkspace$5
+};
+const bunMessage = "Set `ignoreScripts = true` under [install] in bunfig.toml — or set `\"trustedDependencies\": []` in package.json — to opt out of the curated allow-list (postinstall is already blocked for untrusted packages by default).";
+const bunBinding = {
+	check(ctx, config) {
+		const ignoreScripts = getByPath(config, ["install", "ignoreScripts"]);
+		if (ignoreScripts === true) return { state: "ok" };
+		const trusted = ctx.packageJson?.trustedDependencies;
+		if (typeof trusted !== "undefined" && trusted.length === 0) return { state: "ok" };
 		return {
-			state: "violation",
-			message: lock === false ? "Enable the Deno lockfile; `lock: false` disables it even when deno.lock exists." : `No readable project lockfile found at ${String(lockPath)}.`,
-			remediation: {
-				kind: "manual",
-				steps: ["Enable lockfile use in deno.json and generate and commit the configured lockfile within the project."]
-			}
+			remediation: proposeChanges(config, [{
+				file: bunfig$3,
+				keyPath: ["install", "ignoreScripts"],
+				op: "setKey",
+				value: true
+			}]),
+			actual: ignoreScripts,
+			expected: true,
+			message: bunMessage,
+			state: "violation"
 		};
-	}
+	},
+	docs: "https://bun.com/docs/pm/lifecycle",
+	file: bunfig$3,
+	severity: "info",
+	versionNote: { configAvailableSince: "bun 1.2.0" }
 };
-const commitLockfile = defineRule({
+const disableLifecycleScripts = withAubeParanoid(overrideBindings(requireConfigKey({
 	bindings: {
-		aube: lockfileBinding("aube"),
-		bun: lockfileBinding("bun"),
-		deno: denoBinding$2,
-		npm: lockfileBinding("npm"),
-		pnpm: lockfileBinding("pnpm"),
-		yarn: lockfileBinding("yarn")
+		npm: {
+			docs: "https://docs.npmjs.com/cli/v11/using-npm/config#ignore-scripts",
+			file: npmrc$5,
+			keyPath: ["ignore-scripts"],
+			message: "Set `ignore-scripts=true` in .npmrc to block dependency lifecycle scripts.",
+			value: true
+		},
+		yarn: {
+			docs: "https://yarnpkg.com/configuration/yarnrc#enableScripts",
+			documentedDefault: false,
+			file: yarnrc$6,
+			keyPath: ["enableScripts"],
+			message: "Set `enableScripts: false` in .yarnrc.yml to pin the policy across versions.",
+			value: false,
+			versionNote: {
+				configAvailableSince: "yarn 2.0.0",
+				defaultSafeSince: "yarn 4.14.0"
+			}
+		}
 	},
-	description: "Lockfiles pin the full dependency tree and integrity hashes, enabling reproducible, verifiable installs (e.g. `npm ci`).",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-include-lockfiles",
-	id: "commit-lockfile",
+	description: "Malicious postinstall scripts are a primary supply-chain attack vector. Prevent automatic execution of dependency lifecycle scripts.",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#3-disable-lifecycle-scripts",
+	id: "disable-lifecycle-scripts",
 	severity: "error",
-	title: "Commit a lockfile"
-});
-//#endregion
-//#region src/domain/rules/dependency-overrides.ts
-const { aubeWorkspace: aubeWorkspace$6, pnpmWorkspace: pnpmWorkspace$9 } = CONFIG_FILES;
-const isNonEmptyObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
-const checkOverrides = (config, file) => {
-	const value = getByPath(config, ["overrides"]);
-	if (!isNonEmptyObject$2(value)) return { state: "ok" };
-	return {
-		actual: value,
-		message: `Review \`overrides\` in ${file}. Overrides can replace transitive dependencies with arbitrary versions or forks.`,
-		state: "violation",
-		remediation: {
-			kind: "manual",
-			steps: ["Review each entry in `overrides` — verify pinned versions address a known CVE and are not redirecting to untrusted packages."]
-		}
-	};
-};
-const makeBinding = (file, fileName, docs) => ({
-	check(_ctx, config) {
-		return checkOverrides(config, fileName);
-	},
-	docs,
-	file
-});
-const dependencyOverrides = defineRule({
-	bindings: {
-		aube: makeBinding(aubeWorkspace$6, "aube-workspace.yaml", "https://aube.sh/settings/"),
-		pnpm: makeBinding(pnpmWorkspace$9, "pnpm-workspace.yaml", "https://pnpm.io/settings#overrides")
-	},
-	description: "Flag dependency overrides that can replace transitive packages with arbitrary versions or forks — a supply-chain injection vector.",
-	docs: "https://pnpm.io/settings#overrides",
-	id: "dependency-overrides",
-	severity: "info",
-	title: "Review dependency overrides"
-});
-//#endregion
-//#region src/domain/rules/disable-lifecycle-scripts.ts
-const { npmrc: npmrc$5, pnpmWorkspace: pnpmWorkspace$8, yarnrc: yarnrc$6, aubeWorkspace: aubeWorkspace$5, bunfig: bunfig$3 } = CONFIG_FILES;
-const pnpmBinding$4 = {
-	check(ctx, config) {
-		if (getByPath(config, ["ignoreScripts"]) === true) return { state: "ok" };
-		const bypass = getByPath(config, ["dangerouslyAllowAllBuilds"]);
-		const strict = getByPath(config, ["strictDepBuilds"]);
-		if (bypass === true) {
-			const bypassTarget = {
-				file: pnpmWorkspace$8,
-				keyPath: ["dangerouslyAllowAllBuilds"]
-			};
-			if (settingSupportedByTarget("pnpm", ctx.pmVersion, bypassTarget) === false) {
-				const proposal = {
-					kind: "manual",
-					steps: ["Remove `dangerouslyAllowAllBuilds: true` before upgrading to pnpm 10.9.0 or newer; the declared target ignores it, but a later version would activate the bypass.", ...strict === true ? [] : ["Set `strictDepBuilds: true` in pnpm-workspace.yaml to enable lifecycle-script gating for the declared target."]]
-				};
-				return {
-					state: "violation",
-					actual: bypass,
-					expected: false,
-					message: "The declared target ignores this future-version bypass. Removing the ignored bypass alone does not provide protection against lifecycle scripts, and leaving it configured would disable gating after an upgrade.",
-					remediation: strict === true ? proposal : guardRemediationAvailability("pnpm", ctx.pmVersion, proposal, [{
-						file: pnpmWorkspace$8,
-						keyPath: ["strictDepBuilds"]
-					}])
-				};
-			}
-			const proposal = {
-				kind: "manual",
-				steps: ["After upgrading, remove `dangerouslyAllowAllBuilds: true` (or set it to false) and configure lifecycle-script gating."]
-			};
-			const guarded = guardRemediationAvailability("pnpm", ctx.pmVersion, proposal, [{
-				file: pnpmWorkspace$8,
-				keyPath: ["strictDepBuilds"]
-			}, {
-				file: pnpmWorkspace$8,
-				keyPath: ["dangerouslyAllowAllBuilds"]
-			}]);
-			if (guarded !== proposal) return {
-				state: "violation",
-				actual: bypass,
-				expected: false,
-				message: "The target cannot use the proposed YAML lifecycle-script controls. Removing an unsupported bypass alone does not provide protection.",
-				remediation: guarded
-			};
-			return {
-				actual: bypass,
-				expected: false,
-				remediation: {
-					kind: "manual",
-					steps: ["Remove `dangerouslyAllowAllBuilds: true` from pnpm-workspace.yaml (or set it to `false`). Setting `strictDepBuilds: true` alone has no effect while the bypass remains."]
-				},
-				message: "`dangerouslyAllowAllBuilds: true` in pnpm-workspace.yaml bypasses strictDepBuilds — remove it (or set it to false) to restore lifecycle-script gating.",
-				state: "violation"
-			};
-		}
-		if (strict === true) return { state: "ok" };
-		return {
-			state: "violation",
-			actual: strict,
-			expected: true,
-			message: strict === void 0 ? "Set `strictDepBuilds: true` in pnpm-workspace.yaml to pin lifecycle-script gating across versions." : "Set `strictDepBuilds: true` in pnpm-workspace.yaml to block silent skips of un-approved dep builds.",
-			remediation: guardRemediationAvailability("pnpm", ctx.pmVersion, proposeChanges(config, [{
-				file: pnpmWorkspace$8,
-				keyPath: ["strictDepBuilds"],
-				op: "setKey",
-				value: true
-			}]), [{
-				file: pnpmWorkspace$8,
-				keyPath: ["strictDepBuilds"]
-			}])
-		};
-	},
-	docs: "https://pnpm.io/settings#strictdepbuilds",
-	file: pnpmWorkspace$8,
-	versionNote: {
-		configAvailableSince: "pnpm 10.3.0",
-		note: "pnpm-workspace.yaml settings require pnpm 10.6.0",
-		defaultSafeSince: "pnpm 11.0.0"
-	}
-};
-const aubeBinding$2 = {
-	check(ctx, config) {
-		const npmConfig = ctx.readConfig(npmrc$5);
-		const jail = getByPath(config, ["jailBuilds"]);
-		const strict = getByPath(npmConfig, ["strictDepBuilds"]);
-		if (jail === true && strict === true) return { state: "ok" };
-		const violations = [];
-		if (jail !== true) violations.push({
-			state: "violation",
-			file: aubeWorkspace$5.path,
-			actual: jail,
-			expected: true,
-			message: "Set `jailBuilds: true` in aube-workspace.yaml to sandbox approved builds.",
-			remediation: proposeChanges(config, [{
-				file: aubeWorkspace$5,
-				keyPath: ["jailBuilds"],
-				op: "setKey",
-				value: true
-			}])
-		});
-		if (strict !== true) violations.push({
-			state: "violation",
-			file: npmrc$5.path,
-			actual: strict,
-			expected: true,
-			message: "Set `strictDepBuilds=true` in .npmrc to reject unreviewed lifecycle scripts.",
-			remediation: proposeChanges(npmConfig, [{
-				file: npmrc$5,
-				keyPath: ["strictDepBuilds"],
-				op: "setKey",
-				value: true
-			}])
-		});
-		const [first, ...rest] = violations;
-		return !first ? { state: "ok" } : rest.length === 0 ? first : {
-			state: "violations",
-			violations: [first, ...rest]
-		};
-	},
-	docs: "https://aube.jdx.dev/security.html",
-	file: aubeWorkspace$5
-};
-const bunMessage = "Set `ignoreScripts = true` under [install] in bunfig.toml — or set `\"trustedDependencies\": []` in package.json — to opt out of the curated allow-list (postinstall is already blocked for untrusted packages by default).";
-const bunBinding = {
-	check(ctx, config) {
-		const ignoreScripts = getByPath(config, ["install", "ignoreScripts"]);
-		if (ignoreScripts === true) return { state: "ok" };
-		const trusted = ctx.packageJson?.trustedDependencies;
-		if (typeof trusted !== "undefined" && trusted.length === 0) return { state: "ok" };
-		return {
-			remediation: proposeChanges(config, [{
-				file: bunfig$3,
-				keyPath: ["install", "ignoreScripts"],
-				op: "setKey",
-				value: true
-			}]),
-			actual: ignoreScripts,
-			expected: true,
-			message: bunMessage,
-			state: "violation"
-		};
-	},
-	docs: "https://bun.com/docs/pm/lifecycle",
-	file: bunfig$3,
-	severity: "info",
-	versionNote: { configAvailableSince: "bun 1.2.0" }
-};
-const disableLifecycleScripts = withAubeParanoid(overrideBindings(requireConfigKey({
-	bindings: {
-		npm: {
-			docs: "https://docs.npmjs.com/cli/v11/using-npm/config#ignore-scripts",
-			file: npmrc$5,
-			keyPath: ["ignore-scripts"],
-			message: "Set `ignore-scripts=true` in .npmrc to block dependency lifecycle scripts.",
-			value: true
-		},
-		yarn: {
-			docs: "https://yarnpkg.com/configuration/yarnrc#enableScripts",
-			documentedDefault: false,
-			file: yarnrc$6,
-			keyPath: ["enableScripts"],
-			message: "Set `enableScripts: false` in .yarnrc.yml to pin the policy across versions.",
-			value: false,
-			versionNote: {
-				configAvailableSince: "yarn 2.0.0",
-				defaultSafeSince: "yarn 4.14.0"
-			}
-		}
-	},
-	description: "Malicious postinstall scripts are a primary supply-chain attack vector. Prevent automatic execution of dependency lifecycle scripts.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#3-disable-lifecycle-scripts",
-	id: "disable-lifecycle-scripts",
-	severity: "error",
-	title: "Disable dependency lifecycle scripts"
-}), {
-	aube: aubeBinding$2,
-	bun: bunBinding,
-	pnpm: pnpmBinding$4
-}));
+	title: "Disable dependency lifecycle scripts"
+}), {
+	aube: aubeBinding$2,
+	bun: bunBinding,
+	pnpm: pnpmBinding$4
+}));
 //#endregion
 //#region src/domain/rules/enforce-strict-ssl.ts
 const { npmrc: npmrc$4, yarnrc: yarnrc$5 } = CONFIG_FILES;
@@ -2021,19 +1389,9 @@ const hardenedMode = requireConfigKey({
 	title: "Enable hardened mode (yarn)"
 });
 //#endregion
-//#region src/domain/rules/minimum-release-age.ts
-const HOURS_PER_DAY = 24;
-const MINUTES_PER_HOUR = 60;
-const SECONDS_PER_MINUTE = 60;
-const MINUTES_PER_DAY = HOURS_PER_DAY * MINUTES_PER_HOUR;
-const SECONDS_PER_DAY = MINUTES_PER_DAY * SECONDS_PER_MINUTE;
-const RECOMMENDED_RELEASE_AGE_DAYS = 3;
-const RECOMMENDED_RELEASE_AGE_MINUTES = RECOMMENDED_RELEASE_AGE_DAYS * MINUTES_PER_DAY;
-const RECOMMENDED_RELEASE_AGE_SECONDS = RECOMMENDED_RELEASE_AGE_DAYS * SECONDS_PER_DAY;
-const DOCUMENTED_DEFAULT_MINUTES = MINUTES_PER_DAY;
-const { npmrc: npmrc$3, pnpmWorkspace: pnpmWorkspace$5, yarnrc: yarnrc$2, bunfig: bunfig$1, denoJson: denoJson$1, aubeWorkspace: aubeWorkspace$4 } = CONFIG_FILES;
+//#region src/domain/services/deno-release-age.ts
 const DENO_DURATION = /^\+?P(?:\+?\d+[Ww]|(?:\d+[Dd])*(?:T(?:\d+[HhMm]|\d+(?:\.\d+)?[Ss])+)?)$/u;
-const DENO_MIN_TIMESTAMP = Date.parse("-262143-01-01T00:00:00Z");
+const DENO_MIN_TIMESTAMP = Date.UTC(-262143, 0, 1);
 const DENO_UNIT_SECONDS = {
 	w: 604800,
 	d: 86400,
@@ -2044,33 +1402,49 @@ const DENO_UNIT_SECONDS = {
 const DENO_DATE = /^\d{4}-\d{2}-\d{2}$/u;
 const DENO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}[Tt ](?:[01]\d|2[0-3]):[0-5]\d:(?:[0-5]\d|60)(?:\.\d+)?(?:[Zz]|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/u;
 const DENO_OFFSET_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T(?:[01]\d|2[0-3]):[0-5]\d(?::(?:[0-5]\d|60))?[+-](?:[01]\d|2[0-3]):?[0-5]\d$/u;
-const isPositiveNumber = (value) => typeof value === "number" && Number.isFinite(value) && value > 0;
-const isPositiveYarnDuration = (value) => isPositiveNumber(value) || typeof value === "string" && /^\d*\.?\d+(?:ms|s|m|h|d|w)?$/u.test(value) && Number.isFinite(Number.parseFloat(value)) && Number.parseFloat(value) > 0;
-const isPositiveDenoSeconds = (seconds) => seconds > 0 && Number.isFinite(seconds) && Date.now() - seconds * 1e3 >= DENO_MIN_TIMESTAMP;
-const isActiveDenoAge = (value) => {
-	if (typeof value === "number") return Number.isSafeInteger(value) && isPositiveDenoSeconds(value * 60);
-	if (typeof value !== "string") return false;
-	if (/^\d+$/u.test(value)) return Number.isSafeInteger(Number(value)) && isPositiveDenoSeconds(Number(value) * 60);
-	if (DENO_DURATION.test(value)) {
-		let seconds = 0;
-		for (const [, integer, fraction, unit] of value.matchAll(/(\d+)(?:\.(\d+))?([WDHMS])/giu)) {
-			const amount = Number(integer) + Number(`0.${(fraction ?? "").slice(0, 9) || "0"}`);
-			seconds += amount * (DENO_UNIT_SECONDS[unit?.toLowerCase() ?? ""] ?? 0);
-		}
-		return isPositiveDenoSeconds(seconds);
+const DENO_DURATION_TOKEN = /(\d+)(?:\.(\d+))?([WDHMS])/giu;
+const LEAP_SECOND = /:60(?=\.|Z|z|[+-])/u;
+const isPositiveDenoSeconds = (seconds, now) => seconds > 0 && Number.isFinite(seconds) && now - seconds * 1e3 >= DENO_MIN_TIMESTAMP;
+const durationSeconds = (value) => {
+	let seconds = 0;
+	for (const [, integer, fraction, unit] of value.matchAll(DENO_DURATION_TOKEN)) {
+		const amount = Number(integer) + Number(`0.${(fraction ?? "").slice(0, 9) || "0"}`);
+		seconds += amount * (DENO_UNIT_SECONDS[unit?.toLowerCase() ?? ""] ?? 0);
 	}
+	return seconds;
+};
+/** Match Deno's minimumDependencyAge value grammar and active-cutoff semantics. */
+const isActiveDenoReleaseAge = (value, now, parse) => {
+	if (typeof value === "number") return Number.isSafeInteger(value) && isPositiveDenoSeconds(value * 60, now);
+	if (typeof value !== "string") return false;
+	if (/^\d+$/u.test(value)) return Number.isSafeInteger(Number(value)) && isPositiveDenoSeconds(Number(value) * 60, now);
+	if (DENO_DURATION.test(value)) return isPositiveDenoSeconds(durationSeconds(value), now);
 	if (!DENO_DATE.test(value) && !DENO_TIMESTAMP.test(value) && !DENO_OFFSET_TIMESTAMP.test(value)) return false;
 	const date = value.slice(0, 10);
 	const midnight = /* @__PURE__ */ new Date(`${date}T00:00:00Z`);
-	const leapSecond = /:60(?=\.|Z|z|[+-])/u.test(value);
-	const timestamp = Date.parse(value.replace(/:60(?=\.|Z|z|[+-])/u, ":59")) + (leapSecond ? 1e3 : 0);
-	return !Number.isNaN(midnight.valueOf()) && midnight.toISOString().slice(0, 10) === date && timestamp < Date.now();
+	const leapSecond = LEAP_SECOND.test(value);
+	const timestamp = parse(value.replace(LEAP_SECOND, ":59")) + (leapSecond ? 1e3 : 0);
+	return !Number.isNaN(midnight.valueOf()) && midnight.toISOString().slice(0, 10) === date && timestamp < now;
 };
-const isNonDisabledDenoDuration = (value) => {
-	if (!isPlainRecord(value)) return isActiveDenoAge(value);
+//#endregion
+//#region src/domain/rules/minimum-release-age.ts
+const HOURS_PER_DAY = 24;
+const MINUTES_PER_HOUR = 60;
+const SECONDS_PER_MINUTE = 60;
+const MINUTES_PER_DAY = HOURS_PER_DAY * MINUTES_PER_HOUR;
+const SECONDS_PER_DAY = MINUTES_PER_DAY * SECONDS_PER_MINUTE;
+const RECOMMENDED_RELEASE_AGE_DAYS = 3;
+const RECOMMENDED_RELEASE_AGE_MINUTES = RECOMMENDED_RELEASE_AGE_DAYS * MINUTES_PER_DAY;
+const RECOMMENDED_RELEASE_AGE_SECONDS = RECOMMENDED_RELEASE_AGE_DAYS * SECONDS_PER_DAY;
+const DOCUMENTED_DEFAULT_MINUTES = MINUTES_PER_DAY;
+const { npmrc: npmrc$3, pnpmWorkspace: pnpmWorkspace$5, yarnrc: yarnrc$2, bunfig: bunfig$1, denoJson: denoJson$1, aubeWorkspace: aubeWorkspace$4 } = CONFIG_FILES;
+const isPositiveNumber = (value) => typeof value === "number" && Number.isFinite(value) && value > 0;
+const isPositiveYarnDuration = (value) => isPositiveNumber(value) || typeof value === "string" && /^\d*\.?\d+(?:ms|s|m|h|d|w)?$/u.test(value) && Number.isFinite(Number.parseFloat(value)) && Number.parseFloat(value) > 0;
+const isNonDisabledDenoReleaseAge = (value, now, parse) => {
+	if (!isPlainRecord(value)) return isActiveDenoReleaseAge(value, now, parse);
 	if (Object.keys(value).some((key) => key !== "age" && key !== "exclude")) return false;
 	if (value.exclude !== void 0 && !isStringList(value.exclude)) return false;
-	return value.age == null || isActiveDenoAge(value.age);
+	return value.age == null || isActiveDenoReleaseAge(value.age, now, parse);
 };
 const denoAgeUsesFallback = (value) => {
 	if (value === void 0 || value === null) return true;
@@ -2080,7 +1454,7 @@ const denoAgeUsesFallback = (value) => {
 	return value.age == null;
 };
 const isPositiveDenoNpmrcDays = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
-const minimumReleaseAge = overrideBindings(requireConfigKey({
+const baseRule$1 = requireConfigKey({
 	bindings: {
 		aube: {
 			accept: isPositiveNumber,
@@ -2132,102 +1506,105 @@ const minimumReleaseAge = overrideBindings(requireConfigKey({
 	id: "minimum-release-age",
 	severity: "warn",
 	title: "Set a minimum release age"
-}), {
-	npm: {
-		file: npmrc$3,
-		docs: "https://docs.npmjs.com/cli/v12/using-npm/config#min-release-age",
-		versionNote: { note: "min-release-age available since npm 11.10.0" },
-		check(ctx, config) {
-			const now = Date.now();
-			if (Object.hasOwn(config, "before")) {
-				const actual = config.before;
-				if ((typeof actual === "string" || typeof actual === "number") && Date.parse(String(actual)) < now) return { state: "ok" };
-				return {
-					state: "violation",
-					actual,
-					expected: "a date in the past",
-					message: "Use a valid past before cutoff, or remove before and set min-release-age.",
-					remediation: {
-						kind: "manual",
-						steps: ["In .npmrc, set before to a valid past date. A future or disabled before overrides min-release-age in this file.", ...guardRemediationAvailability("npm", ctx.pmVersion, {
-							kind: "manual",
-							steps: [`Alternatively, remove before and set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days.`]
-						}, [{
-							file: npmrc$3,
-							keyPath: ["min-release-age"]
-						}])?.steps ?? []]
-					}
-				};
-			}
-			const actual = getByPath(config, ["min-release-age"]);
-			const age = typeof actual === "number" || typeof actual === "string" ? Number(actual) : NaN;
-			const cutoff = (/* @__PURE__ */ new Date(now - SECONDS_PER_DAY * 1e3 * age)).valueOf();
-			if (age > 0 && Number.isFinite(cutoff) && cutoff < now) return { state: "ok" };
+});
+const createNpmBinding = (time) => ({
+	file: npmrc$3,
+	docs: "https://docs.npmjs.com/cli/v12/using-npm/config#min-release-age",
+	versionNote: { note: "min-release-age available since npm 11.10.0" },
+	check(ctx, config) {
+		const now = time.now();
+		if (Object.hasOwn(config, "before")) {
+			const actual = config.before;
+			if ((typeof actual === "string" || typeof actual === "number") && time.parse(String(actual)) < now) return { state: "ok" };
 			return {
 				state: "violation",
 				actual,
-				expected: RECOMMENDED_RELEASE_AGE_DAYS,
-				message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days to quarantine brand-new releases.`,
-				remediation: guardRemediationAvailability("npm", ctx.pmVersion, proposeChanges(config, [{
-					file: npmrc$3,
-					op: "setKey",
-					keyPath: ["min-release-age"],
-					value: RECOMMENDED_RELEASE_AGE_DAYS
-				}]), [{
-					file: npmrc$3,
-					keyPath: ["min-release-age"]
-				}])
+				expected: "a date in the past",
+				message: "Use a valid past before cutoff, or remove before and set min-release-age.",
+				remediation: {
+					kind: "manual",
+					steps: ["In .npmrc, set before to a valid past date. A future or disabled before overrides min-release-age in this file.", ...guardRemediationAvailability("npm", ctx.pmVersion, {
+						kind: "manual",
+						steps: [`Alternatively, remove before and set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days.`]
+					}, [{
+						file: npmrc$3,
+						keyPath: ["min-release-age"]
+					}])?.steps ?? []]
+				}
 			};
 		}
+		const actual = getByPath(config, ["min-release-age"]);
+		const age = typeof actual === "number" || typeof actual === "string" ? Number(actual) : NaN;
+		const cutoff = (/* @__PURE__ */ new Date(now - SECONDS_PER_DAY * 1e3 * age)).valueOf();
+		if (age > 0 && Number.isFinite(cutoff) && cutoff < now) return { state: "ok" };
+		return {
+			state: "violation",
+			actual,
+			expected: RECOMMENDED_RELEASE_AGE_DAYS,
+			message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days to quarantine brand-new releases.`,
+			remediation: guardRemediationAvailability("npm", ctx.pmVersion, proposeChanges(config, [{
+				file: npmrc$3,
+				op: "setKey",
+				keyPath: ["min-release-age"],
+				value: RECOMMENDED_RELEASE_AGE_DAYS
+			}]), [{
+				file: npmrc$3,
+				keyPath: ["min-release-age"]
+			}])
+		};
+	}
+});
+const createDenoBinding = (time) => ({
+	file: denoJson$1,
+	docs: "https://docs.deno.com/runtime/reference/deno_json/",
+	versionNote: {
+		defaultSafeSince: "deno 2.9.0 (1440 minutes)",
+		note: "object age may be omitted; project .npmrc fallback available since deno 2.8.1"
 	},
-	deno: {
-		file: denoJson$1,
-		docs: "https://docs.deno.com/runtime/reference/deno_json/",
-		versionNote: {
-			defaultSafeSince: "deno 2.9.0 (1440 minutes)",
-			note: "object age may be omitted; project .npmrc fallback available since deno 2.8.1"
-		},
-		check(ctx, config) {
-			const actual = getByPath(config, ["minimumDependencyAge"]);
-			if (denoAgeUsesFallback(actual)) {
-				const npmrcConfig = ctx.readConfig(npmrc$3);
-				const npmrcAge = getByPath(npmrcConfig, ["min-release-age"]);
-				if (isPositiveDenoNpmrcDays(npmrcAge)) return { state: "ok" };
-				if (npmrcAge === 0) return {
-					state: "violation",
-					actual: npmrcAge,
-					expected: RECOMMENDED_RELEASE_AGE_DAYS,
-					file: npmrc$3.path,
-					message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days in .npmrc, or set minimumDependencyAge in deno.json.`,
-					remediation: proposeChanges(npmrcConfig, [{
-						file: npmrc$3,
-						op: "setKey",
-						keyPath: ["min-release-age"],
-						value: RECOMMENDED_RELEASE_AGE_DAYS
-					}])
-				};
-			}
-			if (isNonDisabledDenoDuration(actual)) return { state: "ok" };
-			const objectAge = isPlainRecord(actual);
-			const invalidObject = objectAge && (Object.keys(actual).some((key) => key !== "age" && key !== "exclude") || actual.exclude !== void 0 && !isStringList(actual.exclude));
-			return {
+	check(ctx, config) {
+		const actual = getByPath(config, ["minimumDependencyAge"]);
+		if (denoAgeUsesFallback(actual)) {
+			const npmrcConfig = ctx.readConfig(npmrc$3);
+			const npmrcAge = getByPath(npmrcConfig, ["min-release-age"]);
+			if (isPositiveDenoNpmrcDays(npmrcAge)) return { state: "ok" };
+			if (npmrcAge === 0) return {
 				state: "violation",
-				actual,
-				expected: "P3D",
-				message: `Set minimumDependencyAge (e.g. "P3D" for a ${RECOMMENDED_RELEASE_AGE_DAYS}-day cooldown) in deno.json.`,
-				remediation: invalidObject ? {
-					kind: "manual",
-					steps: ["Use only age and exclude in minimumDependencyAge. Make exclude a list of package names and set age to a positive supported duration."]
-				} : proposeChanges(config, [{
-					file: denoJson$1,
+				actual: npmrcAge,
+				expected: RECOMMENDED_RELEASE_AGE_DAYS,
+				file: npmrc$3.path,
+				message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days in .npmrc, or set minimumDependencyAge in deno.json.`,
+				remediation: proposeChanges(npmrcConfig, [{
+					file: npmrc$3,
 					op: "setKey",
-					keyPath: objectAge ? ["minimumDependencyAge", "age"] : ["minimumDependencyAge"],
-					value: "P3D"
+					keyPath: ["min-release-age"],
+					value: RECOMMENDED_RELEASE_AGE_DAYS
 				}])
 			};
 		}
+		if (isNonDisabledDenoReleaseAge(actual, time.now(), time.parse)) return { state: "ok" };
+		const objectAge = isPlainRecord(actual);
+		const invalidObject = objectAge && (Object.keys(actual).some((key) => key !== "age" && key !== "exclude") || actual.exclude !== void 0 && !isStringList(actual.exclude));
+		return {
+			state: "violation",
+			actual,
+			expected: "P3D",
+			message: `Set minimumDependencyAge (e.g. "P3D" for a ${RECOMMENDED_RELEASE_AGE_DAYS}-day cooldown) in deno.json.`,
+			remediation: invalidObject ? {
+				kind: "manual",
+				steps: ["Use only age and exclude in minimumDependencyAge. Make exclude a list of package names and set age to a positive supported duration."]
+			} : proposeChanges(config, [{
+				file: denoJson$1,
+				op: "setKey",
+				keyPath: objectAge ? ["minimumDependencyAge", "age"] : ["minimumDependencyAge"],
+				value: "P3D"
+			}])
+		};
 	}
 });
+const createMinimumReleaseAge = (time) => overrideBindings(baseRule$1, {
+	npm: createNpmBinding(time),
+	deno: createDenoBinding(time)
+});
 //#endregion
 //#region src/domain/rules/named-registries.ts
 const { pnpmWorkspace: pnpmWorkspace$4 } = CONFIG_FILES;
@@ -2308,7 +1685,8 @@ const REGISTRY_VERSION = /^(?:npm|jsr):(?:@[^/@]+\/)?[^/@]+@(?<version>[^/]*)/u;
 const isUnpinnedRegistryImport = (specifier) => {
 	if (!specifier.startsWith("npm:") && !specifier.startsWith("jsr:")) return false;
 	const version = REGISTRY_VERSION.exec(specifier)?.groups?.version;
-	return version === void 0 || valid(version.replace(/^=/u, "")) === null;
+	const normalized = version?.startsWith("=") ? version.slice(1) : version;
+	return normalized === void 0 || valid(normalized) === null;
 };
 const collectUnpinnedImports = (imports) => {
 	const offenders = [];
@@ -2685,9 +2063,23 @@ const bindingFor = (pm) => {
 		} : { state: "ok" };
 	} };
 };
+const unsupportedSettings = defineRule({
+	id: "unsupported-settings",
+	title: "Use settings available in the target PM version",
+	description: "Report configured settings whose recorded introduction version is newer than the declared or explicit stable PM target. Reports each affected file separately, grouping its unsupported keys. Workspace findings retain their member directory. Only the coverage table below is checked. Unknown targets and unlisted settings are not evaluated for availability.",
+	severity: "error",
+	docs: "https://github.com/pHo9UBenaA/siro/blob/main/docs/rules.md#unsupported-settings--error",
+	bindings: {
+		npm: bindingFor("npm"),
+		pnpm: bindingFor("pnpm"),
+		yarn: bindingFor("yarn"),
+		bun: bindingFor("bun"),
+		deno: bindingFor("deno")
+	}
+});
 //#endregion
 //#region src/domain/builtin-rules.ts
-const rules = [
+const createBuiltinRules = (time) => [
 	advisoryCheck,
 	approvedGitRepos,
 	auditSuppression,
@@ -2703,7 +2095,7 @@ const rules = [
 	frozenLockfile,
 	frozenStore,
 	hardenedMode,
-	minimumReleaseAge,
+	createMinimumReleaseAge(time),
 	namedRegistries,
 	paranoidMode,
 	patchedDependencies,
@@ -2715,21 +2107,448 @@ const rules = [
 	strictReleaseAge,
 	strictStoreIntegrity,
 	trustPolicy,
-	defineRule({
-		id: "unsupported-settings",
-		title: "Use settings available in the target PM version",
-		description: "Report configured settings whose recorded introduction version is newer than the declared or explicit stable PM target. Reports each affected file separately, grouping its unsupported keys. Workspace findings retain their member directory. Only the coverage table below is checked. Unknown targets and unlisted settings are not evaluated for availability.",
-		severity: "error",
-		docs: "https://github.com/pHo9UBenaA/siro/blob/main/docs/rules.md#unsupported-settings--error",
-		bindings: {
-			npm: bindingFor("npm"),
-			pnpm: bindingFor("pnpm"),
-			yarn: bindingFor("yarn"),
-			bun: bindingFor("bun"),
-			deno: bindingFor("deno")
+	unsupportedSettings
+];
+//#endregion
+//#region src/composition/rules.ts
+/** Read time at evaluation, never at module initialization. */
+const rules = createBuiltinRules({
+	now: () => Date.now(),
+	parse: (value) => Date.parse(value)
+});
+//#endregion
+//#region src/adapters/workspace-globs.ts
+const MAX_WORKSPACE_GLOB_ALTERNATIVES = 8192;
+const BRACE_EXPANSION_PROBE_LIMIT = 8193;
+const boundedBraceExpand = (pattern) => {
+	const alternatives = braceExpand(pattern, { braceExpandMax: BRACE_EXPANSION_PROBE_LIMIT });
+	if (alternatives.length > MAX_WORKSPACE_GLOB_ALTERNATIVES) throw new ConfigError(`Workspace pattern expands beyond ${MAX_WORKSPACE_GLOB_ALTERNATIVES} alternatives.`);
+	return alternatives;
+};
+/** Expand with minimatch's own bounded brace semantics. */
+const expandWorkspaceGlob = (pattern) => {
+	try {
+		return boundedBraceExpand(pattern);
+	} catch (error) {
+		if (error instanceof TypeError) throw new ConfigError(`Invalid workspace pattern: ${error.message}.`);
+		throw error;
+	}
+};
+/** Engine choices live here; the application supplies only PM matching policy. */
+const engineOptions = (options) => {
+	if (options.kind === "declaration") return {};
+	return {
+		platform: "linux",
+		windowsPathsNoEscape: true,
+		nonegate: true,
+		nocomment: !options.hashComments,
+		nocase: options.caseInsensitive,
+		dot: options.includeDotDirectories ?? false,
+		nobrace: options.syntax === "wildcards",
+		noext: options.syntax === "wildcards" || options.extendedPatterns === false,
+		optimizationLevel: options.syntax === "shell" ? 2 : 1
+	};
+};
+/** Compile once so membership, exclusions, and traversal share glob semantics. */
+const compileWorkspaceGlob = (pattern, options) => {
+	let matcher;
+	try {
+		const settings = engineOptions(options);
+		if (!settings.nobrace) boundedBraceExpand(pattern);
+		matcher = new Minimatch(options.kind === "directory" && options.syntax === "wildcards" ? pattern.replace(/[[\]]/gu, (character) => character === "[" ? "[[]" : "[]]") : pattern, {
+			...settings,
+			braceExpandMax: BRACE_EXPANSION_PROBE_LIMIT
+		});
+	} catch (error) {
+		if (error instanceof TypeError) throw new ConfigError(`Invalid workspace pattern: ${error.message}.`);
+		throw error;
+	}
+	return {
+		matches: (directory) => matcher.match(directory),
+		canDescend(directory) {
+			const parts = directory.split("/");
+			return matcher.set.some((alternative) => (alternative.includes(GLOBSTAR) || parts.length < alternative.length) && matcher.matchOne(parts, alternative, true));
+		}
+	};
+};
+const minimatchGlobs = {
+	expand: expandWorkspaceGlob,
+	compile: compileWorkspaceGlob
+};
+//#endregion
+//#region src/domain/services/parse-config-file.ts
+const EMPTY_FILE = Object.freeze({});
+/** Create a fresh parser and cache for one lint command. */
+const createConfigParser = (codecFor, ctx) => {
+	const cache = /* @__PURE__ */ new Map();
+	return (file) => {
+		if (file === void 0) return EMPTY_FILE;
+		const cacheKey = `${file.kind}:${file.path}`;
+		const cached = cache.get(cacheKey);
+		if (cached !== void 0) return cached;
+		const text = ctx.readText(file.path);
+		if (text === void 0) {
+			cache.set(cacheKey, EMPTY_FILE);
+			return EMPTY_FILE;
+		}
+		const parsed = wrapCodecError(file.path, () => codecFor(file.kind).parse(text));
+		cache.set(cacheKey, parsed);
+		return parsed;
+	};
+};
+//#endregion
+//#region src/application/workspace-pattern.ts
+/** Detect the basic * and ? markers shared across workspace dialects. */
+const hasBasicWorkspaceWildcard = (pattern) => pattern.includes("*") || pattern.includes("?");
+/** Workspace declarations use POSIX separators regardless of the host platform. */
+const stripTrailingWorkspaceSlashes = (pattern) => {
+	let end = pattern.length;
+	while (end > 0 && pattern[end - 1] === "/") end -= 1;
+	return pattern.slice(0, end);
+};
+//#endregion
+//#region src/application/workspace-prefix.ts
+/** Anchor Deno's native literal prefix before applying its glob suffix. */
+const anchorWorkspacePrefix = (pattern, glob, resolveChild) => {
+	const parts = pattern.split("/");
+	const firstWildcard = parts.findIndex(hasBasicWorkspaceWildcard);
+	const prefix = parts.slice(0, firstWildcard < 0 ? parts.length : firstWildcard);
+	if (prefix.length === 0 || pattern === ".") return glob;
+	const declared = prefix.join("/");
+	let resolved;
+	let attempted = false;
+	const resolve = () => {
+		if (!attempted) {
+			attempted = true;
+			let current = ".";
+			for (const part of prefix) {
+				const child = resolveChild(current, part);
+				if (child === void 0) return void 0;
+				current = current === "." ? child : `${current}/${child}`;
+			}
+			resolved = current;
+		}
+		return resolved;
+	};
+	const rewrite = (directory, actual) => directory === actual ? declared : directory.startsWith(`${actual}/`) ? declared + directory.slice(actual.length) : void 0;
+	return {
+		matches(directory) {
+			if (directory === ".") return false;
+			const actual = resolve();
+			const rewritten = actual === void 0 ? void 0 : rewrite(directory, actual);
+			return rewritten !== void 0 && glob.matches(rewritten);
+		},
+		canDescend(directory) {
+			const actual = resolve();
+			if (actual === void 0) return false;
+			if (directory === "." || actual.startsWith(`${directory}/`)) return true;
+			const rewritten = rewrite(directory, actual);
+			return rewritten !== void 0 && glob.canDescend(rewritten);
+		}
+	};
+};
+//#endregion
+//#region src/application/workspace-glob-policy.ts
+const workspaceGlobOptions = (caseInsensitive) => ({
+	kind: "directory",
+	syntax: "shell",
+	caseInsensitive
+});
+//#endregion
+//#region src/application/workspace-dialects.ts
+const containsUnsupportedAubeGlobSyntax = (pattern) => /[[\]{}()]/u.test(pattern);
+const matchesCrossPathGlob = (pattern, value) => {
+	const patternCharacters = [...pattern];
+	const valueCharacters = [...value];
+	let patternIndex = 0;
+	let valueIndex = 0;
+	let starIndex = -1;
+	let retryIndex = 0;
+	while (valueIndex < valueCharacters.length) {
+		const character = patternCharacters[patternIndex];
+		if (character === "?" || character === valueCharacters[valueIndex]) {
+			patternIndex += 1;
+			valueIndex += 1;
+		} else if (character === "*") {
+			starIndex = patternIndex;
+			retryIndex = valueIndex;
+			patternIndex += 1;
+		} else if (starIndex >= 0) {
+			patternIndex = starIndex + 1;
+			retryIndex += 1;
+			valueIndex = retryIndex;
+		} else return false;
+	}
+	while (patternCharacters[patternIndex] === "*") patternIndex += 1;
+	return patternIndex === patternCharacters.length;
+};
+/** The bounded glob subset verified against the recorded Deno/Aube sources. */
+const compileAdditionalWorkspaceGlob = (pattern, pm, excluded, caseInsensitive, globs) => {
+	const parts = pattern.split("/");
+	if (parts.some((part) => part.includes("**") && part !== "**")) throw new ConfigError(`${pm}: ** must occupy an entire workspace path component.`);
+	if (pm === "aube" && (containsUnsupportedAubeGlobSyntax(pattern) || pattern.includes("**") && (parts.at(-1) !== "**" || hasBasicWorkspaceWildcard(parts.slice(0, -1).join("/"))))) throw new ConfigError("Aube workspace inspection supports literals, * and ?, and a trailing ** after a literal prefix; other glob forms are not yet supported.");
+	const matcher = globs.compile(pattern, {
+		kind: "directory",
+		syntax: "wildcards",
+		includeDotDirectories: pm === "aube",
+		caseInsensitive: pm === "deno" && (hasBasicWorkspaceWildcard(pattern) || caseInsensitive)
+	});
+	if (pm === "deno" && hasBasicWorkspaceWildcard(pattern)) {
+		const files = globs.compile(`${pattern}/package.json`, {
+			kind: "directory",
+			syntax: "wildcards",
+			caseInsensitive: true
+		});
+		return {
+			...matcher,
+			matches: (directory) => files.matches(directory === "." ? "package.json" : `${directory}/package.json`)
+		};
+	}
+	if (pm !== "aube" || !excluded) return matcher;
+	const self = pattern.endsWith("/**") ? pattern.slice(0, -3) : void 0;
+	return {
+		...matcher,
+		matches: (directory) => matchesCrossPathGlob(pattern, directory) || directory === self
+	};
+};
+//#endregion
+//#region src/application/workspaces.ts
+/** npm cancels an earlier exclusion when a later positive pattern matches it. */
+const splitNpmPattern = (raw) => {
+	const prefix = /^!+/u.exec(raw)?.[0] ?? "";
+	return {
+		excluded: prefix.length % 2 === 1,
+		pattern: raw.slice(prefix.length)
+	};
+};
+const npmPatterns = (patterns, globs) => {
+	const positive = [];
+	let negative = [];
+	for (const raw of patterns) {
+		const parsed = splitNpmPattern(raw);
+		const pattern = parsed.pattern.replace(/^\.?\/+/u, "");
+		if (parsed.excluded) negative.push({
+			pattern,
+			glob: globs.compile(pattern, { kind: "declaration" })
+		});
+		else {
+			for (let index = 0; index < negative.length; index += 1) if (negative[index]?.glob.matches(pattern)) negative.splice(index, 1);
+			positive.push(pattern);
+		}
+	}
+	return [...positive, ...negative.map(({ pattern }) => `!${pattern}`)];
+};
+/** Read declaration sources separately so Deno's two manifest sets stay distinct. */
+const workspaceDefinitions = (ctx, pm, dependencies) => {
+	const { codecFor, paths, globs } = dependencies;
+	const parse = createConfigParser(codecFor, ctx);
+	const validate = (value, source, denoManifests = false) => {
+		if (value === void 0) return {
+			patterns: [],
+			denoManifests
+		};
+		if (!Array.isArray(value) || !Array.from(value).every((item) => typeof item === "string")) throw new ConfigError(`${source}: expected an array of directory patterns.`);
+		for (const pattern of value) {
+			const positive = pm === "npm" ? splitNpmPattern(pattern).pattern : pattern.startsWith("!") ? pattern.slice(1) : pattern;
+			if ((pm === "deno" || pm === "aube" ? [positive] : globs.expand(positive)).some((alternative) => !isRelPath(alternative) || alternative.includes("\\") || alternative.startsWith("!"))) throw new ConfigError(`${source}: use relative directory patterns without parent traversal: ${JSON.stringify(pattern)}.`);
+			if (pm === "deno" && denoManifests && !pattern.startsWith("!") && paths.normalizePattern(positive) === ".") throw new ConfigError(`${source}: a Deno workspace cannot contain itself.`);
+		}
+		return {
+			patterns: pm === "npm" ? npmPatterns(value, globs) : value,
+			denoManifests
+		};
+	};
+	const packageDefinition = () => {
+		let value = ctx.packageJson?.workspaces;
+		if (isPlainRecord(value)) {
+			value = value.packages;
+			if (value === void 0) throw new ConfigError("package.json#workspaces: expected a packages array.");
+		}
+		return validate(value, "package.json#workspaces");
+	};
+	if (pm === "pnpm") return [validate(ctx.exists(CONFIG_FILES.pnpmWorkspace.path) ? parse(CONFIG_FILES.pnpmWorkspace).packages : void 0, "pnpm-workspace.yaml#packages")];
+	if (pm === "aube") {
+		const file = [CONFIG_FILES.aubeWorkspace, CONFIG_FILES.pnpmWorkspace].find((candidate) => ctx.exists(candidate.path));
+		return [file ? validate(parse(file).packages, `${file.path}#packages`) : packageDefinition()];
+	}
+	if (pm === "deno") return [validate(parse(CONFIG_FILES.denoJson).workspace, "deno.json#workspace", true), packageDefinition()];
+	return [packageDefinition()];
+};
+/** Traverse only ordinary directories that can fall under a positive pattern. */
+const workspaceDirectories = (ctx, fs, definition, pm, dependencies) => {
+	const { codecFor, paths, globs, caseInsensitiveGlobs } = dependencies;
+	const defaultWorkspaceGlobOptions = workspaceGlobOptions(caseInsensitiveGlobs);
+	const { patterns } = definition;
+	const skipVendor = pm === "deno" && createConfigParser(codecFor, ctx)(CONFIG_FILES.denoJson).vendor === true;
+	const positive = patterns.filter((pattern) => !pattern.startsWith("!")).map((pattern) => stripTrailingWorkspaceSlashes(paths.normalizePattern(pattern)));
+	const negative = patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => stripTrailingWorkspaceSlashes(paths.normalizePattern(pattern.slice(1))));
+	const directoryCache = /* @__PURE__ */ new Map();
+	const readDirectories = (directory) => {
+		const cached = directoryCache.get(directory);
+		if (cached) return cached;
+		if (!fs.readDirectories) throw new UsageError("Workspace discovery requires FileSystem.readDirectories; no host filesystem fallback is used.");
+		const names = fs.readDirectories(paths.resolve(ctx.root, asRelPath(directory)));
+		if (!Array.isArray(names)) throw new ConfigError("FileSystem.readDirectories must return an array of directory names.");
+		for (const name of Array.from(names)) if (!isRelPath(name) || name === "." || name === ".." || /[\\/]/u.test(name)) throw new ConfigError("FileSystem.readDirectories returned an invalid child directory name.");
+		const result = [...new Set(names)].sort();
+		directoryCache.set(directory, result);
+		return result;
+	};
+	const resolveChild = (parent, name) => {
+		if (name === ".git" || name === "node_modules") return void 0;
+		const names = readDirectories(parent);
+		const resolved = names.includes(name) ? name : fs.resolveDirectory?.(paths.resolve(ctx.root, asRelPath(parent)), name);
+		if (resolved !== void 0 && !names.includes(resolved)) throw new ConfigError("FileSystem.resolveDirectory must return an enumerated ordinary child directory name.");
+		return resolved === ".git" || resolved === "node_modules" ? void 0 : resolved;
+	};
+	const compile = (pattern, excluded = false) => {
+		if (pm !== "deno" && pm !== "aube") return globs.compile(pattern, pm === "npm" ? {
+			...defaultWorkspaceGlobOptions,
+			hashComments: true
+		} : defaultWorkspaceGlobOptions);
+		const glob = compileAdditionalWorkspaceGlob(pattern, pm, excluded, caseInsensitiveGlobs, globs);
+		return pm === "deno" && !excluded ? anchorWorkspacePrefix(pattern, glob, resolveChild) : glob;
+	};
+	const included = positive.map((pattern) => compile(pattern));
+	const excluded = negative.map((pattern) => {
+		return {
+			glob: compile(pattern, true),
+			subtree: pm === "deno" || pm === "aube" || pm === "bun" ? void 0 : pattern === "**" ? { matches: () => true } : pattern.endsWith("/**") ? compile(pattern.slice(0, -3), true) : void 0
+		};
+	});
+	const declaredBase = (pattern) => {
+		const parts = pattern.split("/");
+		const wildcard = parts.findIndex(hasBasicWorkspaceWildcard);
+		return parts.slice(0, wildcard < 0 ? parts.length : wildcard).join("/") || ".";
+	};
+	const relatedBases = (left, right) => left === "." || right === "." || left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
+	const denoPositive = pm === "deno" ? positive.filter(hasBasicWorkspaceWildcard).map((pattern) => ({
+		base: declaredBase(pattern),
+		scope: anchorWorkspacePrefix(declaredBase(pattern), {
+			matches: () => true,
+			canDescend: () => true
+		}, resolveChild)
+	})) : [];
+	const denoOrdered = pm === "deno" ? patterns.filter((pattern) => hasBasicWorkspaceWildcard(pattern) || pattern.startsWith("!")).map((raw) => {
+		const isExcluded = raw.startsWith("!");
+		const pattern = stripTrailingWorkspaceSlashes(paths.normalizePattern(isExcluded ? raw.slice(1) : raw));
+		const glob = compile(pattern, isExcluded);
+		if (!isExcluded) return {
+			excluded: false,
+			glob
+		};
+		return {
+			excluded: true,
+			glob: {
+				...glob,
+				matches(directory) {
+					if (!hasBasicWorkspaceWildcard(pattern)) return directory === pattern;
+					if (!glob.matches(directory)) return false;
+					const applicable = denoPositive.filter((item) => item.scope.matches(directory)).map((item) => relatedBases(item.base, declaredBase(pattern)));
+					if (applicable.some(Boolean) && applicable.some((value) => !value)) throw new ConfigError("Deno workspace exclusion has ambiguous overlapping bases; use consistent prefix spelling or separate non-overlapping patterns.");
+					return applicable.some(Boolean);
+				}
+			}
+		};
+	}) : [];
+	const bunPatterns = pm === "bun" ? patterns.map((raw) => {
+		const isExcluded = raw.startsWith("!");
+		const pattern = stripTrailingWorkspaceSlashes(paths.normalizePattern(isExcluded ? raw.slice(1) : raw));
+		const usesGlob = isExcluded || hasBasicWorkspaceWildcard(pattern) || pattern.includes("{") || pattern.includes("[");
+		const glob = globs.compile(pattern, {
+			...defaultWorkspaceGlobOptions,
+			extendedPatterns: false
+		});
+		const subtree = isExcluded && pattern.endsWith("/**") ? globs.compile(pattern.slice(0, -3), {
+			...defaultWorkspaceGlobOptions,
+			extendedPatterns: false
+		}) : void 0;
+		return {
+			isExcluded,
+			usesGlob,
+			glob,
+			matches: (directory) => glob.matches(directory) || glob.matches(`${directory}/`) || subtree?.matches(directory) === true
+		};
+	}) : [];
+	const bunOrdered = bunPatterns.filter(({ usesGlob }) => usesGlob);
+	const bunLiterals = bunPatterns.filter(({ isExcluded, usesGlob }) => !isExcluded && !usesGlob);
+	const bunTraversal = bunPatterns.filter(({ isExcluded }) => !isExcluded).map(({ glob }) => glob);
+	const denoLiteral = pm === "deno" ? positive.filter((pattern) => !hasBasicWorkspaceWildcard(pattern)).map((pattern) => compile(pattern)) : [];
+	if (definition.denoManifests && denoOrdered.findLast(({ glob }) => glob.matches("."))?.excluded === false) throw new ConfigError("deno.json#workspace: a Deno workspace cannot contain itself.");
+	if (positive.length === 0 || positive.every((pattern) => pattern === ".")) return [];
+	if (!fs.readDirectories) throw new UsageError("Workspace discovery requires FileSystem.readDirectories; no host filesystem fallback is used.");
+	const result = [];
+	const pending = ["."];
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (current === void 0) break;
+		for (const name of readDirectories(current)) {
+			if (name === ".git" || name === "node_modules") continue;
+			const directory = asRelPath(current === "." ? name : `${current}/${name}`);
+			if (pm === "bun" && name === "CMakeFiles" && !bunLiterals.some(({ glob }) => glob.matches(directory) || glob.canDescend(directory))) continue;
+			const inVendor = skipVendor && (directory === "vendor" || directory.startsWith("vendor/"));
+			if (inVendor && !denoLiteral.some((pattern) => pattern.matches(directory) || pattern.canDescend(directory))) continue;
+			const isExcluded = pm !== "deno" && excluded.some(({ glob }) => glob.matches(directory) || glob.matches(`${directory}/`));
+			if (excluded.some(({ subtree }) => subtree?.matches(directory))) continue;
+			const lastDenoMatch = denoOrdered.findLast(({ glob }) => glob.matches(directory));
+			const lastBunMatch = bunOrdered.findLast(({ matches }) => matches(directory));
+			if (pm === "deno" ? denoLiteral.some((pattern) => pattern.matches(directory)) || !inVendor && lastDenoMatch?.excluded === false : pm === "bun" ? bunLiterals.some(({ glob }) => glob.matches(directory)) || lastBunMatch?.isExcluded === false : !isExcluded && included.some((pattern) => pattern.matches(directory))) result.push(directory);
+			if ((pm === "bun" ? bunTraversal : inVendor ? denoLiteral : included).some((pattern) => pattern.canDescend(directory))) pending.push(directory);
 		}
-	})
-];
+	}
+	return result.sort();
+};
+//#endregion
+//#region src/application/workspace-contexts.ts
+/** Expand each manager's declarations into isolated publication contexts. */
+const collectWorkspaceMembers = (ctx, fs, pms, projectType, dependencies) => {
+	const { codecFor, createRepoContext, paths } = dependencies;
+	return pms.flatMap((pm) => {
+		const seen = /* @__PURE__ */ new Set();
+		return workspaceDefinitions(ctx, pm, dependencies).flatMap((definition) => workspaceDirectories(ctx, fs, definition, pm, dependencies).flatMap((directory) => {
+			const root = paths.resolve(ctx.root, directory);
+			const manifest = paths.resolve(root, asRelPath("package.json"));
+			const denoManifest = paths.resolve(root, asRelPath("deno.json"));
+			const denoJsonc = paths.resolve(root, asRelPath("deno.jsonc"));
+			const allowed = new Set(pm === "deno" ? [
+				manifest,
+				denoManifest,
+				denoJsonc
+			] : [manifest]);
+			const memberFs = {
+				exists: (file) => allowed.has(file) && fs.exists(file),
+				readText: (file) => allowed.has(file) ? fs.readText(file) : void 0
+			};
+			try {
+				const explicitMember = definition.patterns.some((pattern) => !pattern.startsWith("!") && !hasBasicWorkspaceWildcard(pattern) && stripTrailingWorkspaceSlashes(paths.normalizePattern(pattern)) === directory);
+				if (!definition.denoManifests && !fs.exists(manifest)) {
+					if (pm === "deno" && explicitMember) throw new ConfigError("Declared npm workspace member has no package.json.");
+					return [];
+				}
+				if (pm === "deno" && !fs.exists(denoManifest) && fs.exists(denoJsonc)) throw new ConfigError("deno.jsonc is not supported; use strict deno.json.");
+				const memberCtx = createRepoContext(root, memberFs, projectType);
+				if (!definition.denoManifests && !memberCtx.packageJson) return [];
+				if (!memberCtx.packageJson && !memberCtx.exists(asRelPath("deno.json"))) {
+					if (definition.denoManifests && explicitMember) throw new ConfigError("Declared Deno member has no deno.json or package.json.");
+					return [];
+				}
+				if (pm === "deno") {
+					if (createConfigParser(codecFor, memberCtx)(CONFIG_FILES.denoJson).workspace !== void 0 || memberCtx.packageJson?.workspaces !== void 0) throw new ConfigError("Nested workspace declarations are not supported by Deno.");
+				}
+				if (seen.has(directory)) return [];
+				seen.add(directory);
+				return [{
+					directory,
+					pm,
+					ctx: memberCtx
+				}];
+			} catch (error) {
+				if (error instanceof ConfigError) throw new ConfigError(`${directory}/${error.message}`);
+				throw error;
+			}
+		}));
+	});
+};
 //#endregion
 //#region src/domain/services/apply-config.ts
 /** Select active rules and keep user severity choices as explicit runtime data. */
@@ -2875,32 +2694,32 @@ const runLint = (opts) => {
 //#endregion
 //#region src/application/lint.ts
 /** Evaluate a repository without reporting or executing configuration files. */
-const prepareLint = (options) => {
-	if (!options || !isAbsPath(options.cwd)) throw new UsageError("cwd must be an absolute filesystem path.");
+const prepareLint = (options, dependencies) => {
+	const { paths, codecFor, createRepoContext } = dependencies;
+	if (!options || !paths.isAbsolute(options.cwd)) throw new UsageError("cwd must be an absolute filesystem path.");
 	if ("customRules" in options || "reporters" in options) throw new UsageError("Pass customRules and reporters inside the config option.");
 	if (options.pm !== void 0 && !isPM(options.pm)) throw new UsageError(`Unknown package manager: ${String(options.pm)}`);
 	if (options.projectType !== void 0 && !isProjectType(options.projectType)) throw new UsageError(`Unknown project type: ${String(options.projectType)}`);
 	if (options.pmVersion !== void 0 && (!options.pm || !isStableVersion(options.pmVersion))) throw new UsageError("pmVersion / --pm-version requires pm / --pm and an exact stable version such as 10.16.0.");
 	if (options.workspaces !== void 0 && typeof options.workspaces !== "boolean") throw new UsageError("workspaces must be a boolean.");
 	const config = options.config === void 0 ? void 0 : parseConfig(options.config);
-	const ctx = createRepoContext(options.cwd, options.fs, options.projectType ?? config?.projectType);
+	const fs = options.fs === void 0 ? dependencies.fileSystem : options.fs;
+	const ctx = createRepoContext(options.cwd, fs, options.projectType ?? config?.projectType);
 	const pms = resolvePMs(ctx, {
 		allowed: config?.pms,
 		pmOverride: options.pm
 	});
 	if (pms.includes("deno") && !ctx.exists(asRelPath("deno.json")) && ctx.exists(asRelPath("deno.jsonc"))) throw new ConfigError("deno.jsonc is not supported. siro currently reads strict JSON from deno.json only.");
-	const configured = applyConfig(rules, config);
-	const pmVersions = {
-		...declaredPMVersion(ctx.packageJson?.packageManager),
-		...config?.pmVersions,
-		...options.pm && options.pmVersion ? { [options.pm]: options.pmVersion } : {}
-	};
-	const fs = options.fs ?? nodeFileSystem;
+	const configured = applyConfig(dependencies.rules, config);
 	return {
 		ctx,
 		pms,
-		pmVersions,
-		members: options.workspaces ? collectWorkspaceMembers(ctx, fs, pms, options.projectType ?? config?.projectType) : [],
+		pmVersions: {
+			...declaredPMVersion(ctx.packageJson?.packageManager),
+			...config?.pmVersions,
+			...options.pm && options.pmVersion ? { [options.pm]: options.pmVersion } : {}
+		},
+		members: options.workspaces ? collectWorkspaceMembers(ctx, fs, pms, options.projectType ?? config?.projectType, dependencies) : [],
 		ruleSet: configured.rules,
 		severityOverrides: configured.severityOverrides,
 		codecFor,
@@ -2944,16 +2763,46 @@ const runPreparedLint = (prepared) => {
 		summary
 	};
 };
-const lint = (options) => runPreparedLint(prepareLint(options));
+const lint$1 = (options, dependencies) => runPreparedLint(prepareLint(options, dependencies));
+//#endregion
+//#region src/domain/services/filter.ts
+const EXIT_SUCCESS = 0;
+const EXIT_FAILURE = 1;
+const meetsThreshold = (severity, threshold) => SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
+/** Keep only findings at or above `threshold`, recomputing the summary. */
+const filterBySeverity = (result, threshold) => {
+	const findings = [];
+	const summary = {
+		error: 0,
+		info: 0,
+		warn: 0
+	};
+	for (const finding of result.findings) if (meetsThreshold(finding.severity, threshold)) {
+		findings.push(finding);
+		summary[finding.severity] += 1;
+	}
+	return {
+		findings,
+		summary
+	};
+};
+/**
+* Exit code for a lint run. Non-zero when any finding meets `threshold`
+* (default: only `error` fails the run).
+*/
+const exitCodeForLint = (result, threshold = "error") => {
+	if (result.findings.some((finding) => meetsThreshold(finding.severity, threshold))) return EXIT_FAILURE;
+	return EXIT_SUCCESS;
+};
 //#endregion
 //#region src/application/commands/lint.ts
 /** Evaluate and report. Executable config loading belongs to the CLI adapter. */
-const lintCommand = async (options, io) => {
+const lintCommand$1 = async (options, io, dependencies, reporters) => {
 	if (!options) throw new UsageError("Lint options are required.");
 	if (options.severity !== void 0 && !isSeverity(options.severity)) throw new UsageError(`Invalid severity: ${String(options.severity)}`);
-	const prepared = prepareLint(options);
-	const registry = createRegistry(prepared.reporters);
-	const selection = options.reporter ?? DEFAULT_REPORTER_NAME;
+	const prepared = prepareLint(options, dependencies);
+	const registry = reporters.createRegistry(prepared.reporters);
+	const selection = options.reporter ?? reporters.defaultName;
 	const reporter = typeof selection === "string" ? registry.get(selection) : selection;
 	if (!isReporterShape(reporter)) throw new UsageError(`${typeof selection === "string" ? "Unknown" : "Invalid"} reporter: ${String(selection)} (available: ${[...registry.keys()].join(", ")})`);
 	const result = runPreparedLint(prepared);
@@ -2962,12 +2811,235 @@ const lintCommand = async (options, io) => {
 	return exitCode;
 };
 //#endregion
+//#region src/domain/schemas/package-json.ts
+const PackageJsonSchema = vb.looseObject({
+	files: vb.optional(vb.array(vb.string())),
+	name: vb.optional(vb.string()),
+	packageManager: vb.optional(vb.string()),
+	private: vb.optional(vb.boolean()),
+	publishConfig: vb.optional(vb.looseObject({ access: vb.optional(vb.picklist([
+		"public",
+		"restricted",
+		"private"
+	])) })),
+	trustedDependencies: vb.optional(vb.array(vb.string()))
+});
+const parsePackageJson = (value) => {
+	if (!isPlainRecord(value)) throw new ConfigError("package.json: expected an object at the root.");
+	const result = vb.safeParse(PackageJsonSchema, value);
+	if (result.success) return result.output;
+	const issue = result.issues[0];
+	const field = vb.getDotPath(issue);
+	throw new ConfigError(`package.json: ${field ? `${field}: ` : ""}${issue.message}`);
+};
+//#endregion
+//#region src/adapters/repo-context.ts
+const tryParseJson = (text) => {
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		let errMsg = String(error);
+		if (error instanceof Error) errMsg = error.message;
+		throw new ConfigError(`package.json: invalid JSON — ${errMsg}`);
+	}
+};
+const readPackageJson = (raw) => {
+	return parsePackageJson(tryParseJson(raw.trim()));
+};
+const createRepoContext = (root, fs = nodeFileSystem, projectType) => {
+	if (fs === nodeFileSystem) assertDirectory(root);
+	const readText = (relPath) => fs.readText(resolveIn(root, relPath));
+	const exists = (relPath) => fs.exists(resolveIn(root, relPath));
+	const raw = readText(asRelPath("package.json"));
+	let packageJson = void 0;
+	if (typeof raw !== "undefined") packageJson = readPackageJson(raw);
+	return {
+		exists,
+		packageJson,
+		projectType,
+		readText,
+		root
+	};
+};
+//#endregion
+//#region src/adapters/codecs/ini.ts
+const INTEGER_PATTERN = /^-?\d+$/u;
+const coerceBoolean = (str) => {
+	if (str === "true") return true;
+	if (str === "false") return false;
+};
+const coerceInteger = (str) => {
+	if (INTEGER_PATTERN.test(str)) return Number(str);
+};
+const coerce = (raw) => {
+	if (typeof raw !== "string") return raw;
+	return coerceBoolean(raw) ?? coerceInteger(raw) ?? raw;
+};
+//#endregion
+//#region src/adapters/codecs/store.ts
+const CODECS = {
+	json: { parse(text) {
+		const trimmed = text.trim();
+		return toParsedConfig(JSON.parse(trimmed));
+	} },
+	npmrc: { parse(text) {
+		const raw = toParsedConfig(ini.parse(text));
+		const config = {};
+		for (const [key, value] of Object.entries(raw)) if (Array.isArray(value)) config[key] = value.map((elem) => coerce(elem));
+		else if (typeof value === "object" && value !== null) config[key] = toParsedConfig(value);
+		else config[key] = coerce(value);
+		return config;
+	} },
+	toml: { parse(text) {
+		if (text.trim() === "") return {};
+		return toParsedConfig(parse$1(text.startsWith("") ? text.slice(1) : text));
+	} },
+	yaml: { parse(text) {
+		if (text.trim() === "") return {};
+		const document = parseDocument(text);
+		if (document.errors.length > 0) throw document.errors[0];
+		if (document.contents === null) return {};
+		return toParsedConfig(document.toJS({ onAnchor: (value, count) => {
+			if (count > 1) JSON.stringify(value);
+		} }));
+	} }
+};
+/** Look up the codec for a parseable kind. Total — every CodecKind has one. */
+const codecFor = (kind) => CODECS[kind];
+//#endregion
+//#region src/adapters/reporters/github.ts
+const COMMAND = {
+	error: "error",
+	info: "notice",
+	warn: "warning"
+};
+const escapeData = (raw) => raw.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+const escapeProp = (raw) => escapeData(raw).replaceAll(":", "%3A").replaceAll(",", "%2C");
+/** Emit GitHub Actions workflow commands (annotations on PRs). */
+const githubReporter = {
+	format(result, io) {
+		for (const finding of result.findings) {
+			let file = "";
+			if (finding.file) file = `file=${escapeProp(finding.file)},`;
+			let body = `[${finding.pm}] ${finding.message}`;
+			if (finding.docs) body += ` (${finding.docs})`;
+			io.stdout(`::${COMMAND[finding.severity]} ${file}title=${escapeProp(finding.ruleId)}::${escapeData(body)}`);
+		}
+	},
+	name: "github"
+};
+//#endregion
+//#region src/adapters/reporters/json.ts
+/**
+* Versioned machine-readable output — the public contract consumed by
+* external fixers (see docs/json-output.md). Bump `schemaVersion` on any
+* breaking shape change and update that doc in the same commit.
+*/
+const SCHEMA_VERSION = 2;
+const jsonReporter = {
+	format(result, io) {
+		io.stdout(JSON.stringify({
+			schemaVersion: SCHEMA_VERSION,
+			siroVersion: version,
+			findings: result.findings,
+			summary: result.summary
+		}, void 0, 2));
+	},
+	name: "json"
+};
+//#endregion
+//#region src/adapters/reporters/pretty.ts
+const GLYPH = {
+	error: "✖ error",
+	info: "ℹ info",
+	warn: "⚠ warn"
+};
+/**
+* Decide colour at call time, not at import time.
+*
+* picocolors snapshots `isColorSupported` when imported, so a later
+* `process.env.NO_COLOR = '1'` (or a different stdout) is ignored. The
+* reporter is invoked per `siro lint` run from many contexts (TTY, CI
+* with FORCE_COLOR, redirected output, …) — checking each call is the
+* only way NO_COLOR can truly win, as https://no-color.org/ requires.
+*/
+const colorSupportedNow = () => {
+	const { env } = process;
+	if (typeof env.NO_COLOR !== "undefined" && env.NO_COLOR !== "") return false;
+	if ("FORCE_COLOR" in env) return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "";
+	return pc.isColorSupported;
+};
+const renderFinding = (finding, ctx) => {
+	let where = "";
+	if (finding.file) where = ctx.colors.dim(` (${finding.file})`);
+	ctx.io.stdout(`${ctx.tag[finding.severity](GLYPH[finding.severity])}  [${finding.pm}] ${ctx.colors.bold(finding.ruleId)}${where}`);
+	ctx.io.stdout(`    ${finding.message}`);
+	for (const step of finding.remediation?.kind === "manual" ? finding.remediation.steps : []) ctx.io.stdout(`    ↳ ${step}`);
+	if (finding.docs) ctx.io.stdout(ctx.colors.dim(`    → ${finding.docs}`));
+};
+const buildRenderCtx = (io) => {
+	const colors = pc.createColors(colorSupportedNow());
+	return {
+		colors,
+		io,
+		tag: {
+			error: colors.red,
+			info: colors.cyan,
+			warn: colors.yellow
+		}
+	};
+};
+const prettyReporter = {
+	format(result, io) {
+		const ctx = buildRenderCtx(io);
+		if (result.findings.length === 0) {
+			io.stdout(ctx.colors.green("✔ No security best-practice issues found."));
+			return;
+		}
+		for (const finding of result.findings) renderFinding(finding, ctx);
+		const { error, warn, info } = result.summary;
+		io.stdout("");
+		io.stdout(`Summary: ${error} error, ${warn} warn, ${info} info`);
+	},
+	name: "pretty"
+};
+//#endregion
+//#region src/adapters/reporters/registry.ts
+const BUILTINS = [
+	prettyReporter,
+	jsonReporter,
+	githubReporter
+];
+const DEFAULT_REPORTER_NAME = prettyReporter.name;
+const JSON_REPORTER_NAME = jsonReporter.name;
+/** Names of every built-in reporter, in stable display order. */
+const BUILTIN_REPORTER_NAMES = BUILTINS.map((rep) => rep.name);
+/** Later registrations replace earlier reporters with the same name. */
+const createRegistry = (extras = []) => new Map([...BUILTINS, ...extras].map((reporter) => [reporter.name, reporter]));
+//#endregion
+//#region src/composition/lint.ts
+const dependencies = {
+	rules,
+	fileSystem: nodeFileSystem,
+	paths: nodePaths,
+	createRepoContext,
+	codecFor,
+	globs: minimatchGlobs,
+	caseInsensitiveGlobs: process.platform === "darwin" || process.platform === "win32"
+};
+/** Public Node API: callers can replace the filesystem without assembling the application. */
+const lint = (options) => lint$1(options, dependencies);
+const lintCommand = (options, io) => lintCommand$1(options, io, dependencies, {
+	defaultName: DEFAULT_REPORTER_NAME,
+	createRegistry
+});
+//#endregion
 //#region src/adapters/node-io.ts
 const nodeIO = {
 	stderr: (line) => process.stderr.write(`${line}\n`),
 	stdout: (line) => process.stdout.write(`${line}\n`)
 };
 //#endregion
-export { ConfigError as A, SUPPORTED_NODE_RANGE as C, isNodeError as D, nodeFileSystem as E, UsageError as M, asAbsPath as O, isSeverity as S, assertDirectory as T, PROJECT_TYPES as _, requireConfigKey as a, SEVERITIES as b, DEFAULT_REPORTER_NAME as c, jsonReporter as d, version as f, getByPath as g, defineRule as h, overrideBindings as i, SiroError as j, asRelPath as k, JSON_REPORTER_NAME as l, loadConfig as m, lintCommand as n, CONFIG_FILES as o, githubReporter as p, lint as r, BUILTIN_REPORTER_NAMES as s, nodeIO as t, prettyReporter as u, isProjectType as v, isSupportedNodeVersion as w, isPM as x, PMS as y };
+export { ConfigError as A, SUPPORTED_NODE_RANGE as C, isNodeError as D, nodeFileSystem as E, UsageError as M, asAbsPath as O, isSupportedNodeVersion as S, assertDirectory as T, isProjectType as _, DEFAULT_REPORTER_NAME as a, isPM as b, jsonReporter as c, requireConfigKey as d, CONFIG_FILES as f, PROJECT_TYPES as g, getByPath as h, BUILTIN_REPORTER_NAMES as i, SiroError as j, asRelPath as k, githubReporter as l, defineRule as m, lint as n, JSON_REPORTER_NAME as o, loadConfig as p, lintCommand as r, prettyReporter as s, nodeIO as t, overrideBindings as u, PMS as v, version as w, isSeverity as x, SEVERITIES as y };
 
-//# sourceMappingURL=node-io-CaqobxYp.mjs.map
+//# sourceMappingURL=node-io-BDHg4J2w.mjs.map