@pho9ubenaa/siro 0.5.0 → 0.6.0

package/dist/{node-io-CaqobxYp.mjs → node-io-CAszdmko.mjs}

@@ -1,16 +1,16 @@
 import path from "node:path";
-import { lstatSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { readFileSync, readdirSync, statSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import satisfies from "semver/functions/satisfies.js";
 import * as vb from "valibot";
 import { lt, parse } from "semver";
-import pc from "picocolors";
+import valid from "semver/functions/valid.js";
+import { Minimatch } from "minimatch";
 import ini from "ini";
 import { parse as parse$1 } from "smol-toml";
 import { parseDocument } from "yaml";
-import { GLOBSTAR, Minimatch, braceExpand } from "minimatch";
-import valid from "semver/functions/valid.js";
-//#region src/shared/errors.ts
+import pc from "picocolors";
+//#region src/core/contracts/errors.ts
 var SiroError = class extends Error {
 	exitCode;
 	constructor(message, exitCode) {
@@ -47,16 +47,32 @@ const wrapCodecError = (filePath, fn) => {
 	}
 };
 //#endregion
-//#region src/shared/paths.ts
+//#region src/core/contracts/paths.ts
+const isRelPath = (value) => typeof value === "string" && value.length > 0 && !value.includes("\0") && !/^[\\/]/u.test(value) && !/^[a-z]:/iu.test(value) && !value.split(/[\\/]/u).includes("..");
+const asRelPath = (value) => {
+	if (!isRelPath(value)) throw new TypeError("Expected a repository-relative path without parent traversal.");
+	return value;
+};
+//#endregion
+//#region src/adapters/node-paths.ts
 const isAbsPath = (value) => typeof value === "string" && !value.includes("\0") && path.isAbsolute(value);
-const isRelPath = (value) => typeof value === "string" && value.length > 0 && !value.includes("\0") && !path.posix.isAbsolute(value) && !path.win32.isAbsolute(value) && !/^[a-z]:/iu.test(value) && !value.split(/[\\/]/u).includes("..");
 const asAbsPath = (value) => {
 	if (!isAbsPath(value)) throw new TypeError("Expected an absolute filesystem path.");
 	return value;
 };
-const asRelPath = (value) => {
-	if (!isRelPath(value)) throw new TypeError("Expected a repository-relative path without parent traversal.");
-	return value;
+const nodePaths = {
+	isAbsolute: isAbsPath,
+	resolve(root, relative) {
+		if (typeof relative !== "string" || relative.includes("\0") || path.isAbsolute(relative) || relative.split(path.sep === "\\" ? /[\\/]/u : /\//u).includes("..")) throw new ConfigError(`Invalid repository-relative path: ${String(relative)}`);
+		const resolved = path.join(root, relative);
+		const within = path.relative(root, resolved);
+		if (within === ".." || within.startsWith(`..${path.sep}`) || path.isAbsolute(within)) throw new ConfigError("Path escapes repository root.");
+		return asAbsPath(resolved);
+	},
+	child(parent, name) {
+		if (typeof name !== "string" || !name || name === "." || name === ".." || name.includes("\0") || name.includes("/") || path.sep === "\\" && (name.includes("\\") || name.includes(":"))) throw new ConfigError(`FileSystem.readDirectories returned an invalid child directory name: ${String(name)}`);
+		return parent === "." ? name : `${parent}/${name}`;
+	}
 };
 //#endregion
 //#region src/adapters/node-errors.ts
@@ -71,24 +87,6 @@ const nodeFileSystem = {
 	readDirectories(directory) {
 		return readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
 	},
-	resolveDirectory(parent, name) {
-		let target;
-		try {
-			target = lstatSync(path.join(parent, name), { bigint: true });
-		} catch (error) {
-			if (isNodeError(error) && error.code === "ENOENT") return void 0;
-			throw error;
-		}
-		if (!target.isDirectory()) return void 0;
-		const names = readdirSync(parent, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-		if (names.includes(name)) return name;
-		const matches = names.filter((candidate) => {
-			const entry = lstatSync(path.join(parent, candidate), { bigint: true });
-			return entry.isDirectory() && entry.dev === target.dev && entry.ino === target.ino;
-		});
-		if (target.ino === 0n || matches.length !== 1) throw new ConfigError(`${parent}: cannot identify the resolved workspace directory ${name}.`);
-		return matches[0];
-	},
 	exists(filePath) {
 		try {
 			assertRegularFile(filePath);
@@ -108,23 +106,36 @@ const nodeFileSystem = {
 		}
 	}
 };
-const resolveIn = (root, relPath) => asAbsPath(path.join(root, asRelPath(relPath)));
+const resolveIn = (root, relPath) => nodePaths.resolve(root, relPath);
 const assertDirectory = (root) => {
 	if (!statSync(root).isDirectory()) throw new UsageError("The lint target must be a directory.");
 };
 //#endregion
 //#region package.json
-var version$1 = "0.5.0";
+var version$1 = "0.6.0";
+var engines = { "node": "^22.18.0 || ^24.0.0" };
 //#endregion
-//#region src/shared/node-version.ts
-const SUPPORTED_NODE_RANGE = { "node": "^22.18.0 || ^24.0.0" }.node;
+//#region src/version.ts
+const version = version$1;
+const SUPPORTED_NODE_RANGE = engines.node;
+//#endregion
+//#region src/adapters/node-version.ts
 const isSupportedNodeVersion = (version) => satisfies(version, SUPPORTED_NODE_RANGE);
 //#endregion
-//#region src/domain/entities/pms.ts
+//#region src/core/contracts/records.ts
+/** Configuration maps are ordinary objects or null-prototype dictionaries. */
+const isPlainRecord = (value) => {
+	if (typeof value !== "object" || value === null) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+};
+//#endregion
+//#region src/core/contracts/pms.ts
 /**
 * Single source of truth for package managers and severities.
-* Types, runtime sets, and ordering are all derived from these tuples — add a
-* package manager here and the rest of the codebase follows.
+* Types, runtime sets, and ordering derive from these tuples. Adding a manager
+* still requires local detection signals, applicable rule bindings and verified
+* policy/availability evidence; the tuple alone does not implement support.
 */
 const PMS = [
 	"npm",
@@ -160,24 +171,68 @@ const parsePackageManagerField = (value) => {
 	if (typeof name !== "undefined" && isPM(name)) return name;
 };
 //#endregion
-//#region src/domain/entities/project-type.ts
-const PROJECT_TYPES = ["application", "package"];
-const isProjectType = (value) => PROJECT_TYPES.some((projectType) => projectType === value);
+//#region src/core/pm-versions.ts
+/** Release history establishes stable versions, not ranges or prerelease builds. */
+const isStableVersion = (value) => {
+	if (typeof value !== "string" || !/^\d/u.test(value) || value.trim() !== value) return false;
+	const version = parse(value);
+	return version !== null && version.prerelease.length === 0;
+};
+/** Keep name-only detection independent from whether the declaration pins a version. */
+const declaredPMVersion = (declaration) => {
+	const [pm, version, ...extra] = declaration?.trim().split("@") ?? [];
+	return pm && isPM(pm) && isStableVersion(version) && extra.length === 0 ? { [pm]: version } : {};
+};
 //#endregion
-//#region src/shared/records.ts
-/** Configuration maps are ordinary objects or null-prototype dictionaries. */
-const isPlainRecord = (value) => {
-	if (typeof value !== "object" || value === null) return false;
-	const prototype = Object.getPrototypeOf(value);
-	return prototype === Object.prototype || prototype === null;
+//#region src/core/inspection-options.ts
+const denseArray = (value, name) => {
+	if (!Array.isArray(value)) throw new ConfigError(`${name} must be a dense array.`);
+	for (let index = 0; index < value.length; index += 1) if (!Object.hasOwn(value, index)) throw new ConfigError(`${name} must be a dense array.`);
+	return value;
+};
+const relativeInput = (value, name) => {
+	if (typeof value !== "string" || !value || value.includes("\0") || name === "exclude" && (value.includes("\\") || /^[a-z]:/iu.test(value)) || /^[\\/]/u.test(value) || /^[a-z]:[\\/]/iu.test(value) || value.split("/").includes("..")) throw new ConfigError(`${name}: expected a nonempty cwd-relative /-separated path without parent traversal.`);
+	return value.split("/").filter((part) => part && part !== ".").join("/") || ".";
+};
+const parseExcludes = (value) => [...new Set(denseArray(value, "exclude").map((input) => {
+	const pattern = relativeInput(input, "exclude");
+	if (pattern === "." || pattern.startsWith("!")) throw new ConfigError("exclude cannot exclude cwd (.) or re-include with leading !.");
+	return pattern;
+}))];
+const parseInstallationRoots = (value) => {
+	const roots = /* @__PURE__ */ new Map();
+	for (const input of denseArray(value, "installationRoots")) {
+		if (typeof input !== "string" && (!isPlainRecord(input) || Object.keys(input).some((key) => ![
+			"path",
+			"pm",
+			"pmVersion"
+		].includes(key)))) throw new ConfigError("installationRoots entries must be paths or { path, pm?, pmVersion? }.");
+		const entry = typeof input === "string" ? { path: input } : input;
+		const path = relativeInput(entry.path, "installationRoots");
+		if (entry.pm !== void 0 && (typeof entry.pm !== "string" || !isPM(entry.pm)) || entry.pmVersion !== void 0 && (!entry.pm || typeof entry.pmVersion !== "string" || !isStableVersion(entry.pmVersion))) throw new ConfigError(`${path}: pmVersion requires pm and an exact stable version; pm must be a supported manager.`);
+		if (path === "." && (entry.pm !== void 0 || entry.pmVersion !== void 0)) throw new ConfigError("Use top-level pm / pmVersion / pms / pmVersions for installation root \".\".");
+		const root = {
+			path,
+			pm: entry.pm,
+			pmVersion: entry.pmVersion
+		};
+		const previous = roots.get(path);
+		if (previous && (previous.pm !== root.pm || previous.pmVersion !== root.pmVersion)) throw new ConfigError(`${path}: conflicting installationRoots entries.`);
+		roots.set(path, root);
+	}
+	return [...roots.values()];
 };
 //#endregion
-//#region src/domain/ports/reporter.ts
+//#region src/core/contracts/project-type.ts
+const PROJECT_TYPES = ["application", "package"];
+const isProjectType = (value) => PROJECT_TYPES.some((projectType) => projectType === value);
+//#endregion
+//#region src/core/contracts/reporter.ts
 const isReporterShape = (value) => {
 	return isPlainRecord(value) && typeof value.name === "string" && typeof value.format === "function";
 };
 //#endregion
-//#region src/domain/entities/config-value.ts
+//#region src/core/contracts/config-value.ts
 const CODEC_KINDS = [
 	"json",
 	"npmrc",
@@ -200,14 +255,16 @@ const toParsedConfig = (value) => {
 	throw new TypeError("Config root must be a mapping.");
 };
 //#endregion
-//#region src/domain/entities/rule.ts
-const defineRule = (rule) => rule;
-const isOptionalString = (value) => typeof value === "undefined" || typeof value === "string";
+//#region src/core/contracts/config-file-ref.ts
 const CONFIG_FILE_KINDS = new Set(CODEC_KINDS);
 const isConfigFileRefShape = (value) => {
 	if (!isPlainRecord(value) || typeof value.kind !== "string" || !isRelPath(value.path)) return false;
 	return CONFIG_FILE_KINDS.has(value.kind);
 };
+//#endregion
+//#region src/core/contracts/rule.ts
+const defineRule = (rule) => rule;
+const isOptionalString = (value) => typeof value === "undefined" || typeof value === "string";
 const isConfigValueShape = (value) => typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
 const isDenseStringArray = (value) => Array.isArray(value) && Array.from(value).every((item) => typeof item === "string");
 const isCheckStatusShape = (value) => {
@@ -239,22 +296,26 @@ const isRuleShape = (value) => {
 	return typeof value.id === "string" && typeof value.title === "string" && typeof value.description === "string" && typeof value.severity === "string" && isSeverity(value.severity) && isOptionalString(value.docs) && isProjectTypesShape(value.projectTypes) && isBindingsShape(value.bindings);
 };
 //#endregion
-//#region src/domain/services/pm-versions.ts
-/** Release history establishes stable versions, not ranges or prerelease builds. */
-const isStableVersion = (value) => {
-	if (typeof value !== "string" || !/^\d/u.test(value) || value.trim() !== value) return false;
-	const version = parse(value);
-	return version !== null && version.prerelease.length === 0;
-};
-/** Keep name-only detection independent from whether the declaration pins a version. */
-const declaredPMVersion = (declaration) => {
-	const [pm, version, ...extra] = declaration?.trim().split("@") ?? [];
-	return pm && isPM(pm) && isStableVersion(version) && extra.length === 0 ? { [pm]: version } : {};
+//#region src/core/contracts/synchronous.ts
+/** Reject only the submitted async value, without a process-wide rejection handler. */
+const assertSynchronous = (value, label) => {
+	if (value !== null && (typeof value === "object" || typeof value === "function") && "then" in value && typeof value.then === "function") {
+		Promise.resolve(value).catch(() => {});
+		throw new ConfigError(`${label} must be synchronous; Promise/thenable values are not supported.`);
+	}
 };
 //#endregion
-//#region src/application/config.ts
+//#region src/core/parse-siro-config.ts
 const RuleSettingSchema = vb.union([vb.picklist(SEVERITIES), vb.literal("off")]);
 const ConfigSchema = vb.strictObject({
+	exclude: vb.optional(vb.custom((value) => {
+		parseExcludes(value);
+		return true;
+	})),
+	installationRoots: vb.optional(vb.custom((value) => {
+		parseInstallationRoots(value);
+		return true;
+	})),
 	customRules: vb.optional(vb.array(vb.custom(isRuleShape, "must be a structurally valid rule"))),
 	pms: vb.optional(vb.pipe(vb.array(vb.picklist(PMS)), vb.minLength(1, "must not be empty (omit the key to auto-detect, or list at least one PM)"))),
 	projectType: vb.optional(vb.picklist(PROJECT_TYPES)),
@@ -285,13 +346,14 @@ const formatIssues = (issues) => issues.map((issue) => {
 	return issue.message;
 }).join("; ");
 const parseConfig = (candidate, name = "siro.config") => {
+	assertSynchronous(candidate, name);
 	if (!isPlainRecord(candidate)) throw new ConfigError(`${name} must export a config object (got ${Array.isArray(candidate) ? "an array" : typeof candidate}).`);
 	const result = vb.safeParse(ConfigSchema, Object.fromEntries(Object.entries(candidate)));
 	if (!result.success) throw new ConfigError(`${name}: ${formatIssues(result.issues)}`);
 	return result.output;
 };
 //#endregion
-//#region src/adapters/config-loader.ts
+//#region src/load-config.ts
 const CONFIG_NAMES = [
 	"siro.config.ts",
 	"siro.config.mjs",
@@ -315,150 +377,7 @@ const loadConfig = async (cwd, nodeVersion = process.versions.node) => {
 	return parseConfig(mod !== null && typeof mod === "object" && "default" in mod ? mod.default : mod, name);
 };
 //#endregion
-//#region src/domain/services/filter.ts
-const EXIT_SUCCESS = 0;
-const EXIT_FAILURE = 1;
-const meetsThreshold = (severity, threshold) => SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
-/** Keep only findings at or above `threshold`, recomputing the summary. */
-const filterBySeverity = (result, threshold) => {
-	const findings = [];
-	const summary = {
-		error: 0,
-		info: 0,
-		warn: 0
-	};
-	for (const finding of result.findings) if (meetsThreshold(finding.severity, threshold)) {
-		findings.push(finding);
-		summary[finding.severity] += 1;
-	}
-	return {
-		findings,
-		summary
-	};
-};
-/**
-* Exit code for a lint run. Non-zero when any finding meets `threshold`
-* (default: only `error` fails the run).
-*/
-const exitCodeForLint = (result, threshold = "error") => {
-	if (result.findings.some((finding) => meetsThreshold(finding.severity, threshold))) return EXIT_FAILURE;
-	return EXIT_SUCCESS;
-};
-//#endregion
-//#region src/adapters/reporters/github.ts
-const COMMAND = {
-	error: "error",
-	info: "notice",
-	warn: "warning"
-};
-const escapeData = (raw) => raw.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
-const escapeProp = (raw) => escapeData(raw).replaceAll(":", "%3A").replaceAll(",", "%2C");
-/** Emit GitHub Actions workflow commands (annotations on PRs). */
-const githubReporter = {
-	format(result, io) {
-		for (const finding of result.findings) {
-			let file = "";
-			if (finding.file) file = `file=${escapeProp(finding.file)},`;
-			let body = `[${finding.pm}] ${finding.message}`;
-			if (finding.docs) body += ` (${finding.docs})`;
-			io.stdout(`::${COMMAND[finding.severity]} ${file}title=${escapeProp(finding.ruleId)}::${escapeData(body)}`);
-		}
-	},
-	name: "github"
-};
-//#endregion
-//#region src/version.ts
-const version = version$1;
-//#endregion
-//#region src/adapters/reporters/json.ts
-/**
-* Versioned machine-readable output — the public contract consumed by
-* external fixers (see docs/json-output.md). Bump `schemaVersion` on any
-* breaking shape change and update that doc in the same commit.
-*/
-const SCHEMA_VERSION = 2;
-const jsonReporter = {
-	format(result, io) {
-		io.stdout(JSON.stringify({
-			schemaVersion: SCHEMA_VERSION,
-			siroVersion: version,
-			findings: result.findings,
-			summary: result.summary
-		}, void 0, 2));
-	},
-	name: "json"
-};
-//#endregion
-//#region src/adapters/reporters/pretty.ts
-const GLYPH = {
-	error: "✖ error",
-	info: "ℹ info",
-	warn: "⚠ warn"
-};
-/**
-* Decide colour at call time, not at import time.
-*
-* picocolors snapshots `isColorSupported` when imported, so a later
-* `process.env.NO_COLOR = '1'` (or a different stdout) is ignored. The
-* reporter is invoked per `siro lint` run from many contexts (TTY, CI
-* with FORCE_COLOR, redirected output, …) — checking each call is the
-* only way NO_COLOR can truly win, as https://no-color.org/ requires.
-*/
-const colorSupportedNow = () => {
-	const { env } = process;
-	if (typeof env.NO_COLOR !== "undefined" && env.NO_COLOR !== "") return false;
-	if ("FORCE_COLOR" in env) return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "";
-	return pc.isColorSupported;
-};
-const renderFinding = (finding, ctx) => {
-	let where = "";
-	if (finding.file) where = ctx.colors.dim(` (${finding.file})`);
-	ctx.io.stdout(`${ctx.tag[finding.severity](GLYPH[finding.severity])}  [${finding.pm}] ${ctx.colors.bold(finding.ruleId)}${where}`);
-	ctx.io.stdout(`    ${finding.message}`);
-	for (const step of finding.remediation?.kind === "manual" ? finding.remediation.steps : []) ctx.io.stdout(`    ↳ ${step}`);
-	if (finding.docs) ctx.io.stdout(ctx.colors.dim(`    → ${finding.docs}`));
-};
-const buildRenderCtx = (io) => {
-	const colors = pc.createColors(colorSupportedNow());
-	return {
-		colors,
-		io,
-		tag: {
-			error: colors.red,
-			info: colors.cyan,
-			warn: colors.yellow
-		}
-	};
-};
-const prettyReporter = {
-	format(result, io) {
-		const ctx = buildRenderCtx(io);
-		if (result.findings.length === 0) {
-			io.stdout(ctx.colors.green("✔ No security best-practice issues found."));
-			return;
-		}
-		for (const finding of result.findings) renderFinding(finding, ctx);
-		const { error, warn, info } = result.summary;
-		io.stdout("");
-		io.stdout(`Summary: ${error} error, ${warn} warn, ${info} info`);
-	},
-	name: "pretty"
-};
-//#endregion
-//#region src/adapters/reporters/registry.ts
-const BUILTINS = [
-	prettyReporter,
-	jsonReporter,
-	githubReporter
-];
-const DEFAULT_REPORTER_NAME = prettyReporter.name;
-const JSON_REPORTER_NAME = jsonReporter.name;
-/** Names of every built-in reporter, in stable display order. */
-const BUILTIN_REPORTER_NAMES = BUILTINS.map((rep) => rep.name);
-/** Later registrations replace earlier reporters with the same name. */
-const createRegistry = (extras = []) => new Map([...BUILTINS, ...extras].map((reporter) => [reporter.name, reporter]));
-//#endregion
-//#region src/domain/entities/config-files.ts
+//#region src/core/config-files.ts
 /** Known configuration locations and their parsers. */
 const CONFIG_FILES = {
 	aubeWorkspace: {
@@ -491,509 +410,7 @@ const CONFIG_FILES = {
 	}
 };
 //#endregion
-//#region src/domain/services/parse-config-file.ts
-const EMPTY_FILE = Object.freeze({});
-/** Create a fresh parser and cache for one lint command. */
-const createConfigParser = (codecFor, ctx) => {
-	const cache = /* @__PURE__ */ new Map();
-	return (file) => {
-		if (file === void 0) return EMPTY_FILE;
-		const cacheKey = `${file.kind}:${file.path}`;
-		const cached = cache.get(cacheKey);
-		if (cached !== void 0) return cached;
-		const text = ctx.readText(file.path);
-		if (text === void 0) {
-			cache.set(cacheKey, EMPTY_FILE);
-			return EMPTY_FILE;
-		}
-		const parsed = wrapCodecError(file.path, () => codecFor(file.kind).parse(text));
-		cache.set(cacheKey, parsed);
-		return parsed;
-	};
-};
-//#endregion
-//#region src/adapters/codecs/ini.ts
-const INTEGER_PATTERN = /^-?\d+$/u;
-const coerceBoolean = (str) => {
-	if (str === "true") return true;
-	if (str === "false") return false;
-};
-const coerceInteger = (str) => {
-	if (INTEGER_PATTERN.test(str)) return Number(str);
-};
-const coerce = (raw) => {
-	if (typeof raw !== "string") return raw;
-	return coerceBoolean(raw) ?? coerceInteger(raw) ?? raw;
-};
-//#endregion
-//#region src/adapters/codecs/store.ts
-const CODECS = {
-	json: { parse(text) {
-		const trimmed = text.trim();
-		return toParsedConfig(JSON.parse(trimmed));
-	} },
-	npmrc: { parse(text) {
-		const raw = toParsedConfig(ini.parse(text));
-		const config = {};
-		for (const [key, value] of Object.entries(raw)) if (Array.isArray(value)) config[key] = value.map((elem) => coerce(elem));
-		else if (typeof value === "object" && value !== null) config[key] = toParsedConfig(value);
-		else config[key] = coerce(value);
-		return config;
-	} },
-	toml: { parse(text) {
-		if (text.trim() === "") return {};
-		return toParsedConfig(parse$1(text.replace(/^\uFEFF/u, "")));
-	} },
-	yaml: { parse(text) {
-		if (text.trim() === "") return {};
-		const document = parseDocument(text);
-		if (document.errors.length > 0) throw document.errors[0];
-		if (document.contents === null) return {};
-		return toParsedConfig(document.toJS({ onAnchor: (value, count) => {
-			if (count > 1) JSON.stringify(value);
-		} }));
-	} }
-};
-/** Look up the codec for a parseable kind. Total — every CodecKind has one. */
-const codecFor = (kind) => CODECS[kind];
-//#endregion
-//#region src/domain/schemas/package-json.ts
-const PackageJsonSchema = vb.looseObject({
-	files: vb.optional(vb.array(vb.string())),
-	name: vb.optional(vb.string()),
-	packageManager: vb.optional(vb.string()),
-	private: vb.optional(vb.boolean()),
-	publishConfig: vb.optional(vb.looseObject({ access: vb.optional(vb.picklist([
-		"public",
-		"restricted",
-		"private"
-	])) })),
-	trustedDependencies: vb.optional(vb.array(vb.string()))
-});
-const parsePackageJson = (value) => {
-	if (!isPlainRecord(value)) throw new ConfigError("package.json: expected an object at the root.");
-	const result = vb.safeParse(PackageJsonSchema, value);
-	if (result.success) return result.output;
-	const issue = result.issues[0];
-	const field = vb.getDotPath(issue);
-	throw new ConfigError(`package.json: ${field ? `${field}: ` : ""}${issue.message}`);
-};
-//#endregion
-//#region src/adapters/repo-context.ts
-const tryParseJson = (text) => {
-	try {
-		return JSON.parse(text);
-	} catch (error) {
-		let errMsg = String(error);
-		if (error instanceof Error) errMsg = error.message;
-		throw new ConfigError(`package.json: invalid JSON — ${errMsg}`);
-	}
-};
-const readPackageJson = (raw) => {
-	return parsePackageJson(tryParseJson(raw.trim()));
-};
-const createRepoContext = (root, fs = nodeFileSystem, projectType) => {
-	if (fs === nodeFileSystem) assertDirectory(root);
-	const readText = (relPath) => fs.readText(resolveIn(root, relPath));
-	const exists = (relPath) => fs.exists(resolveIn(root, relPath));
-	const raw = readText(asRelPath("package.json"));
-	let packageJson = void 0;
-	if (typeof raw !== "undefined") packageJson = readPackageJson(raw);
-	return {
-		exists,
-		packageJson,
-		projectType,
-		readText,
-		root
-	};
-};
-//#endregion
-//#region src/application/workspace-prefix.ts
-/** Anchor Deno's native literal prefix before applying its glob suffix. */
-const anchorWorkspacePrefix = (pattern, glob, resolveChild) => {
-	const parts = pattern.split("/");
-	const firstWildcard = parts.findIndex((part) => /[*?]/u.test(part));
-	const prefix = parts.slice(0, firstWildcard < 0 ? parts.length : firstWildcard);
-	if (prefix.length === 0 || pattern === ".") return glob;
-	const declared = prefix.join("/");
-	let resolved;
-	let attempted = false;
-	const resolve = () => {
-		if (!attempted) {
-			attempted = true;
-			let current = ".";
-			for (const part of prefix) {
-				const child = resolveChild(current, part);
-				if (child === void 0) return void 0;
-				current = current === "." ? child : `${current}/${child}`;
-			}
-			resolved = current;
-		}
-		return resolved;
-	};
-	const rewrite = (directory, actual) => directory === actual ? declared : directory.startsWith(`${actual}/`) ? declared + directory.slice(actual.length) : void 0;
-	return {
-		matches(directory) {
-			if (directory === ".") return false;
-			const actual = resolve();
-			const rewritten = actual === void 0 ? void 0 : rewrite(directory, actual);
-			return rewritten !== void 0 && glob.matches(rewritten);
-		},
-		canDescend(directory) {
-			const actual = resolve();
-			if (actual === void 0) return false;
-			if (directory === "." || actual.startsWith(`${directory}/`)) return true;
-			const rewritten = rewrite(directory, actual);
-			return rewritten !== void 0 && glob.canDescend(rewritten);
-		}
-	};
-};
-//#endregion
-//#region src/application/workspace-globs.ts
-const MAX_WORKSPACE_GLOB_ALTERNATIVES = 8192;
-const BRACE_EXPANSION_PROBE_LIMIT = 8193;
-const defaultWorkspaceGlobOptions = {
-	platform: "linux",
-	nocase: process.platform === "darwin" || process.platform === "win32",
-	windowsPathsNoEscape: true,
-	nonegate: true,
-	nocomment: true,
-	optimizationLevel: 2
-};
-const boundedBraceExpand = (pattern) => {
-	const alternatives = braceExpand(pattern, { braceExpandMax: BRACE_EXPANSION_PROBE_LIMIT });
-	if (alternatives.length > MAX_WORKSPACE_GLOB_ALTERNATIVES) throw new ConfigError(`Workspace pattern expands beyond ${MAX_WORKSPACE_GLOB_ALTERNATIVES} alternatives.`);
-	return alternatives;
-};
-/** Expand with minimatch's own bounded brace semantics. */
-const expandWorkspaceGlob = (pattern) => {
-	try {
-		return boundedBraceExpand(pattern);
-	} catch (error) {
-		if (error instanceof TypeError) throw new ConfigError(`Invalid workspace pattern: ${error.message}.`);
-		throw error;
-	}
-};
-/** Compile once so membership, exclusions, and traversal share glob semantics. */
-const compileWorkspaceGlob = (pattern, options = defaultWorkspaceGlobOptions) => {
-	let matcher;
-	try {
-		if (!options.nobrace) boundedBraceExpand(pattern);
-		matcher = new Minimatch(pattern, {
-			...options,
-			braceExpandMax: BRACE_EXPANSION_PROBE_LIMIT
-		});
-	} catch (error) {
-		if (error instanceof TypeError) throw new ConfigError(`Invalid workspace pattern: ${error.message}.`);
-		throw error;
-	}
-	return {
-		matches: (directory) => matcher.match(directory),
-		canDescend(directory) {
-			const parts = directory.split("/");
-			return matcher.set.some((alternative) => (alternative.includes(GLOBSTAR) || parts.length < alternative.length) && matcher.matchOne(parts, alternative, true));
-		}
-	};
-};
-//#endregion
-//#region src/application/workspace-dialects.ts
-const matchesCrossPathGlob = (pattern, value) => {
-	const patternCharacters = [...pattern];
-	const valueCharacters = [...value];
-	let patternIndex = 0;
-	let valueIndex = 0;
-	let starIndex = -1;
-	let retryIndex = 0;
-	while (valueIndex < valueCharacters.length) {
-		const character = patternCharacters[patternIndex];
-		if (character === "?" || character === valueCharacters[valueIndex]) {
-			patternIndex += 1;
-			valueIndex += 1;
-		} else if (character === "*") {
-			starIndex = patternIndex;
-			retryIndex = valueIndex;
-			patternIndex += 1;
-		} else if (starIndex >= 0) {
-			patternIndex = starIndex + 1;
-			retryIndex += 1;
-			valueIndex = retryIndex;
-		} else return false;
-	}
-	while (patternCharacters[patternIndex] === "*") patternIndex += 1;
-	return patternIndex === patternCharacters.length;
-};
-/** The bounded glob subset verified against the recorded Deno/Aube sources. */
-const compileAdditionalWorkspaceGlob = (pattern, pm, excluded) => {
-	const parts = pattern.split("/");
-	if (parts.some((part) => part.includes("**") && part !== "**")) throw new ConfigError(`${pm}: ** must occupy an entire workspace path component.`);
-	if (pm === "aube" && (/[[\]{}()]/u.test(pattern) || pattern.includes("**") && (parts.at(-1) !== "**" || /[*?]/u.test(parts.slice(0, -1).join("/"))))) throw new ConfigError("Aube workspace inspection supports literals, * and ?, and a trailing ** after a literal prefix; other glob forms are not yet supported.");
-	const escaped = pm === "deno" ? pattern.replace(/[[\]]/gu, (character) => character === "[" ? "[[]" : "[]]") : pattern;
-	const matcher = compileWorkspaceGlob(escaped, {
-		platform: "linux",
-		windowsPathsNoEscape: true,
-		nonegate: true,
-		nocomment: true,
-		nobrace: true,
-		noext: true,
-		dot: pm === "aube",
-		nocase: pm === "deno" && (/[*?]/u.test(pattern) || process.platform === "darwin" || process.platform === "win32")
-	});
-	if (pm === "deno" && /[*?]/u.test(pattern)) {
-		const files = compileWorkspaceGlob(`${escaped}/package.json`, {
-			platform: "linux",
-			windowsPathsNoEscape: true,
-			nonegate: true,
-			nocomment: true,
-			nobrace: true,
-			noext: true,
-			nocase: true
-		});
-		return {
-			...matcher,
-			matches: (directory) => files.matches(directory === "." ? "package.json" : `${directory}/package.json`)
-		};
-	}
-	if (pm !== "aube" || !excluded) return matcher;
-	const self = pattern.endsWith("/**") ? pattern.slice(0, -3) : void 0;
-	return {
-		...matcher,
-		matches: (directory) => matchesCrossPathGlob(pattern, directory) || directory === self
-	};
-};
-//#endregion
-//#region src/application/workspaces.ts
-/** npm cancels an earlier exclusion when a later positive pattern matches it. */
-const splitNpmPattern = (raw) => {
-	const prefix = /^!+/u.exec(raw)?.[0] ?? "";
-	return {
-		excluded: prefix.length % 2 === 1,
-		pattern: raw.slice(prefix.length)
-	};
-};
-const npmPatterns = (patterns) => {
-	const positive = [];
-	let negative = [];
-	for (const raw of patterns) {
-		const parsed = splitNpmPattern(raw);
-		const pattern = parsed.pattern.replace(/^\.?\/+/u, "");
-		if (parsed.excluded) negative.push({
-			pattern,
-			glob: compileWorkspaceGlob(pattern, {})
-		});
-		else {
-			for (let index = 0; index < negative.length; index += 1) if (negative[index]?.glob.matches(pattern)) negative.splice(index, 1);
-			positive.push(pattern);
-		}
-	}
-	return [...positive, ...negative.map(({ pattern }) => `!${pattern}`)];
-};
-/** Read declaration sources separately so Deno's two manifest sets stay distinct. */
-const workspaceDefinitions = (ctx, pm) => {
-	const parse = createConfigParser(codecFor, ctx);
-	const validate = (value, source, denoManifests = false) => {
-		if (value === void 0) return {
-			patterns: [],
-			denoManifests
-		};
-		if (!Array.isArray(value) || !Array.from(value).every((item) => typeof item === "string")) throw new ConfigError(`${source}: expected an array of directory patterns.`);
-		for (const pattern of value) {
-			const positive = pm === "npm" ? splitNpmPattern(pattern).pattern : pattern.startsWith("!") ? pattern.slice(1) : pattern;
-			if ((pm === "deno" || pm === "aube" ? [positive] : expandWorkspaceGlob(positive)).some((alternative) => !isRelPath(alternative) || alternative.includes("\\") || alternative.startsWith("!"))) throw new ConfigError(`${source}: use relative directory patterns without parent traversal: ${JSON.stringify(pattern)}.`);
-			if (pm === "deno" && denoManifests && !pattern.startsWith("!") && path.posix.normalize(positive) === ".") throw new ConfigError(`${source}: a Deno workspace cannot contain itself.`);
-		}
-		return {
-			patterns: pm === "npm" ? npmPatterns(value) : value,
-			denoManifests
-		};
-	};
-	const packageDefinition = () => {
-		let value = ctx.packageJson?.workspaces;
-		if (isPlainRecord(value)) {
-			value = value.packages;
-			if (value === void 0) throw new ConfigError("package.json#workspaces: expected a packages array.");
-		}
-		return validate(value, "package.json#workspaces");
-	};
-	if (pm === "pnpm") return [validate(ctx.exists(CONFIG_FILES.pnpmWorkspace.path) ? parse(CONFIG_FILES.pnpmWorkspace).packages : void 0, "pnpm-workspace.yaml#packages")];
-	if (pm === "aube") {
-		const file = [CONFIG_FILES.aubeWorkspace, CONFIG_FILES.pnpmWorkspace].find((candidate) => ctx.exists(candidate.path));
-		return [file ? validate(parse(file).packages, `${file.path}#packages`) : packageDefinition()];
-	}
-	if (pm === "deno") return [validate(parse(CONFIG_FILES.denoJson).workspace, "deno.json#workspace", true), packageDefinition()];
-	return [packageDefinition()];
-};
-/** Traverse only ordinary directories that can fall under a positive pattern. */
-const workspaceDirectories = (ctx, fs, definition, pm) => {
-	const { patterns } = definition;
-	const skipVendor = pm === "deno" && createConfigParser(codecFor, ctx)(CONFIG_FILES.denoJson).vendor === true;
-	const positive = patterns.filter((pattern) => !pattern.startsWith("!")).map((pattern) => path.posix.normalize(pattern).replace(/\/+$/u, ""));
-	const negative = patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => path.posix.normalize(pattern.slice(1)).replace(/\/+$/u, ""));
-	const directoryCache = /* @__PURE__ */ new Map();
-	const readDirectories = (directory) => {
-		const cached = directoryCache.get(directory);
-		if (cached) return cached;
-		if (!fs.readDirectories) throw new UsageError("Workspace discovery requires FileSystem.readDirectories; no host filesystem fallback is used.");
-		const names = fs.readDirectories(resolveIn(ctx.root, asRelPath(directory)));
-		if (!Array.isArray(names)) throw new ConfigError("FileSystem.readDirectories must return an array of directory names.");
-		for (const name of Array.from(names)) if (!isRelPath(name) || name === "." || name === ".." || /[\\/]/u.test(name)) throw new ConfigError("FileSystem.readDirectories returned an invalid child directory name.");
-		const result = [...new Set(names)].sort();
-		directoryCache.set(directory, result);
-		return result;
-	};
-	const resolveChild = (parent, name) => {
-		if (name === ".git" || name === "node_modules") return void 0;
-		const names = readDirectories(parent);
-		const resolved = names.includes(name) ? name : fs.resolveDirectory?.(resolveIn(ctx.root, asRelPath(parent)), name);
-		if (resolved !== void 0 && !names.includes(resolved)) throw new ConfigError("FileSystem.resolveDirectory must return an enumerated ordinary child directory name.");
-		return resolved === ".git" || resolved === "node_modules" ? void 0 : resolved;
-	};
-	const compile = (pattern, excluded = false) => {
-		if (pm !== "deno" && pm !== "aube") return compileWorkspaceGlob(pattern, pm === "npm" ? {
-			...defaultWorkspaceGlobOptions,
-			nocomment: false
-		} : defaultWorkspaceGlobOptions);
-		const glob = compileAdditionalWorkspaceGlob(pattern, pm, excluded);
-		return pm === "deno" && !excluded ? anchorWorkspacePrefix(pattern, glob, resolveChild) : glob;
-	};
-	const included = positive.map((pattern) => compile(pattern));
-	const excluded = negative.map((pattern) => {
-		return {
-			glob: compile(pattern, true),
-			subtree: pm === "deno" || pm === "aube" || pm === "bun" ? void 0 : pattern === "**" ? { matches: () => true } : pattern.endsWith("/**") ? compile(pattern.slice(0, -3), true) : void 0
-		};
-	});
-	const declaredBase = (pattern) => {
-		const parts = pattern.split("/");
-		const wildcard = parts.findIndex((part) => /[*?]/u.test(part));
-		return parts.slice(0, wildcard < 0 ? parts.length : wildcard).join("/") || ".";
-	};
-	const relatedBases = (left, right) => left === "." || right === "." || left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
-	const denoPositive = pm === "deno" ? positive.filter((pattern) => /[*?]/u.test(pattern)).map((pattern) => ({
-		base: declaredBase(pattern),
-		scope: anchorWorkspacePrefix(declaredBase(pattern), {
-			matches: () => true,
-			canDescend: () => true
-		}, resolveChild)
-	})) : [];
-	const denoOrdered = pm === "deno" ? patterns.filter((pattern) => /[*?]/u.test(pattern) || pattern.startsWith("!")).map((raw) => {
-		const isExcluded = raw.startsWith("!");
-		const pattern = path.posix.normalize(raw.replace(/^!/u, "")).replace(/\/+$/u, "");
-		const glob = compile(pattern, isExcluded);
-		if (!isExcluded) return {
-			excluded: false,
-			glob
-		};
-		return {
-			excluded: true,
-			glob: {
-				...glob,
-				matches(directory) {
-					if (!/[*?]/u.test(pattern)) return directory === pattern;
-					if (!glob.matches(directory)) return false;
-					const applicable = denoPositive.filter((item) => item.scope.matches(directory)).map((item) => relatedBases(item.base, declaredBase(pattern)));
-					if (applicable.some(Boolean) && applicable.some((value) => !value)) throw new ConfigError("Deno workspace exclusion has ambiguous overlapping bases; use consistent prefix spelling or separate non-overlapping patterns.");
-					return applicable.some(Boolean);
-				}
-			}
-		};
-	}) : [];
-	const bunPatterns = pm === "bun" ? patterns.map((raw) => {
-		const isExcluded = raw.startsWith("!");
-		const pattern = path.posix.normalize(raw.replace(/^!/u, "")).replace(/\/+$/u, "");
-		const usesGlob = isExcluded || pattern.includes("*") || pattern.includes("?") || pattern.includes("{") || pattern.includes("[");
-		const glob = compileWorkspaceGlob(pattern, {
-			...defaultWorkspaceGlobOptions,
-			noext: true
-		});
-		const subtree = isExcluded && pattern.endsWith("/**") ? compileWorkspaceGlob(pattern.slice(0, -3), {
-			...defaultWorkspaceGlobOptions,
-			noext: true
-		}) : void 0;
-		return {
-			isExcluded,
-			usesGlob,
-			glob,
-			matches: (directory) => glob.matches(directory) || glob.matches(`${directory}/`) || subtree?.matches(directory) === true
-		};
-	}) : [];
-	const bunOrdered = bunPatterns.filter(({ usesGlob }) => usesGlob);
-	const bunLiterals = bunPatterns.filter(({ isExcluded, usesGlob }) => !isExcluded && !usesGlob);
-	const bunTraversal = bunPatterns.filter(({ isExcluded }) => !isExcluded).map(({ glob }) => glob);
-	const denoLiteral = pm === "deno" ? positive.filter((pattern) => !/[*?]/u.test(pattern)).map((pattern) => compile(pattern)) : [];
-	if (definition.denoManifests && denoOrdered.findLast(({ glob }) => glob.matches("."))?.excluded === false) throw new ConfigError("deno.json#workspace: a Deno workspace cannot contain itself.");
-	if (positive.length === 0 || positive.every((pattern) => pattern === ".")) return [];
-	if (!fs.readDirectories) throw new UsageError("Workspace discovery requires FileSystem.readDirectories; no host filesystem fallback is used.");
-	const result = [];
-	const pending = ["."];
-	while (pending.length > 0) {
-		const current = pending.pop();
-		if (current === void 0) break;
-		for (const name of readDirectories(current)) {
-			if (name === ".git" || name === "node_modules") continue;
-			const directory = asRelPath(current === "." ? name : `${current}/${name}`);
-			if (pm === "bun" && name === "CMakeFiles" && !bunLiterals.some(({ glob }) => glob.matches(directory) || glob.canDescend(directory))) continue;
-			const inVendor = skipVendor && (directory === "vendor" || directory.startsWith("vendor/"));
-			if (inVendor && !denoLiteral.some((pattern) => pattern.matches(directory) || pattern.canDescend(directory))) continue;
-			const isExcluded = pm !== "deno" && excluded.some(({ glob }) => glob.matches(directory) || glob.matches(`${directory}/`));
-			if (excluded.some(({ subtree }) => subtree?.matches(directory))) continue;
-			const lastDenoMatch = denoOrdered.findLast(({ glob }) => glob.matches(directory));
-			const lastBunMatch = bunOrdered.findLast(({ matches }) => matches(directory));
-			if (pm === "deno" ? denoLiteral.some((pattern) => pattern.matches(directory)) || !inVendor && lastDenoMatch?.excluded === false : pm === "bun" ? bunLiterals.some(({ glob }) => glob.matches(directory)) || lastBunMatch?.isExcluded === false : !isExcluded && included.some((pattern) => pattern.matches(directory))) result.push(directory);
-			if ((pm === "bun" ? bunTraversal : inVendor ? denoLiteral : included).some((pattern) => pattern.canDescend(directory))) pending.push(directory);
-		}
-	}
-	return result.sort();
-};
-//#endregion
-//#region src/application/workspace-contexts.ts
-/** Expand each manager's declarations into isolated publication contexts. */
-const collectWorkspaceMembers = (ctx, fs, pms, projectType) => pms.flatMap((pm) => {
-	const seen = /* @__PURE__ */ new Set();
-	return workspaceDefinitions(ctx, pm).flatMap((definition) => workspaceDirectories(ctx, fs, definition, pm).flatMap((directory) => {
-		const root = resolveIn(ctx.root, directory);
-		const manifest = resolveIn(root, asRelPath("package.json"));
-		const denoManifest = resolveIn(root, asRelPath("deno.json"));
-		const denoJsonc = resolveIn(root, asRelPath("deno.jsonc"));
-		const allowed = new Set(pm === "deno" ? [
-			manifest,
-			denoManifest,
-			denoJsonc
-		] : [manifest]);
-		const memberFs = {
-			exists: (file) => allowed.has(file) && fs.exists(file),
-			readText: (file) => allowed.has(file) ? fs.readText(file) : void 0
-		};
-		try {
-			const explicitMember = definition.patterns.some((pattern) => !pattern.startsWith("!") && !/[*?]/u.test(pattern) && path.posix.normalize(pattern).replace(/\/+$/u, "") === directory);
-			if (!definition.denoManifests && !fs.exists(manifest)) {
-				if (pm === "deno" && explicitMember) throw new ConfigError("Declared npm workspace member has no package.json.");
-				return [];
-			}
-			if (pm === "deno" && !fs.exists(denoManifest) && fs.exists(denoJsonc)) throw new ConfigError("deno.jsonc is not supported; use strict deno.json.");
-			const memberCtx = createRepoContext(root, memberFs, projectType);
-			if (!definition.denoManifests && !memberCtx.packageJson) return [];
-			if (!memberCtx.packageJson && !memberCtx.exists(asRelPath("deno.json"))) {
-				if (definition.denoManifests && explicitMember) throw new ConfigError("Declared Deno member has no deno.json or package.json.");
-				return [];
-			}
-			if (pm === "deno") {
-				if (createConfigParser(codecFor, memberCtx)(CONFIG_FILES.denoJson).workspace !== void 0 || memberCtx.packageJson?.workspaces !== void 0) throw new ConfigError("Nested workspace declarations are not supported by Deno.");
-			}
-			if (seen.has(directory)) return [];
-			seen.add(directory);
-			return [{
-				directory,
-				pm,
-				ctx: memberCtx
-			}];
-		} catch (error) {
-			if (error instanceof ConfigError) throw new ConfigError(`${directory}/${error.message}`);
-			throw error;
-		}
-	}));
-});
-//#endregion
-//#region src/domain/setting-availability.ts
+//#region src/core/rules/setting-availability.ts
 const { npmrc: npmrc$7, packageJson: packageJson$2, pnpmWorkspace: pnpmWorkspace$11, yarnrc: yarnrc$10, bunfig: bunfig$6 } = CONFIG_FILES;
 const settingAvailability = [
 	{
@@ -1114,7 +531,7 @@ const settingAvailability = [
 	}
 ];
 //#endregion
-//#region src/domain/services/remediation-availability.ts
+//#region src/core/rules/remediation-availability.ts
 const sameSetting = (setting, target) => target.file.path === setting.file.path && target.file.kind === setting.file.kind && target.keyPath.length === setting.keyPath.length && target.keyPath.every((key, index) => key === setting.keyPath[index]);
 /** Undefined means the target version or the setting's introduction is unknown. */
 const settingSupportedByTarget = (pm, version, target) => {
@@ -1133,7 +550,7 @@ const guardRemediationAvailability = (pm, version, remediation, targets = remedi
 	};
 };
 //#endregion
-//#region src/domain/rules/remediation.ts
+//#region src/core/rules/remediation.ts
 /** Scalar writes must not discard an existing container or replace a non-object parent. */
 const proposeChanges = (config, operations) => {
 	for (const operation of operations) {
@@ -1157,7 +574,7 @@ const proposeChanges = (config, operations) => {
 	};
 };
 //#endregion
-//#region src/domain/rules/builders/require-config-key.ts
+//#region src/core/rules/builders/require-config-key.ts
 const overrideBindings = (rule, overrides) => ({
 	...rule,
 	bindings: {
@@ -1168,7 +585,7 @@ const overrideBindings = (rule, overrides) => ({
 const accepts = (spec, actual) => spec.accept ? spec.accept(actual) : actual === spec.value;
 const checkKeyValue = (spec, config) => {
 	const actual = getByPath(config, spec.keyPath);
-	const coveredByDefault = actual === void 0 && spec.documentedDefault !== void 0 && spec.versionNote?.defaultSafeSince === void 0 && accepts(spec, spec.documentedDefault);
+	const coveredByDefault = actual === void 0 && spec.documentedDefault !== void 0 && spec.defaultSafety === "unconditional" && accepts(spec, spec.documentedDefault);
 	if (!coveredByDefault && accepts(spec, actual)) return { state: "ok" };
 	const severity = coveredByDefault ? spec.defaultSatisfiedSeverity ?? "info" : void 0;
 	if (severity === "off") return { state: "ok" };
@@ -1221,7 +638,7 @@ const requireConfigKey = (options) => {
 	};
 };
 //#endregion
-//#region src/domain/rules/builders/with-aube-paranoid.ts
+//#region src/core/rules/builders/with-aube-paranoid.ts
 const withAubeParanoid = (rule) => {
 	const { aube } = rule.bindings;
 	if (!aube) return rule;
@@ -1234,13 +651,14 @@ const withAubeParanoid = (rule) => {
 	} });
 };
 //#endregion
-//#region src/domain/rules/advisory-check.ts
+//#region src/core/rules/advisory-check.ts
 const { aubeWorkspace: aubeWorkspace$8 } = CONFIG_FILES;
 const advisoryCheck = withAubeParanoid(requireConfigKey({
 	bindings: { aube: {
 		accept: (value) => value === "on" || value === "required",
 		docs: "https://aube.jdx.dev/security.html",
 		documentedDefault: "on",
+		defaultSafety: "unconditional",
 		file: aubeWorkspace$8,
 		keyPath: ["advisoryCheck"],
 		message: "Set `advisoryCheck: on` (or `required`) in aube-workspace.yaml to check dependencies against known-malicious advisories.",
@@ -1253,11 +671,11 @@ const advisoryCheck = withAubeParanoid(requireConfigKey({
 	title: "Enable malicious-package advisory checks"
 }));
 //#endregion
-//#region src/domain/rules/config-predicates.ts
+//#region src/core/rules/config-predicates.ts
 const isNonBlankString = (value) => typeof value === "string" && value.trim().length > 0;
 const isStringList = (value) => Array.isArray(value) && Array.from(value).every(isNonBlankString);
 //#endregion
-//#region src/domain/rules/approved-git-repos.ts
+//#region src/core/rules/approved-git-repos.ts
 const { yarnrc: yarnrc$9 } = CONFIG_FILES;
 const message = "Set `approvedGitRepositories: []` in .yarnrc.yml to block all git: protocol dependencies (or list approved repository globs).";
 const approvedGitRepos = defineRule({
@@ -1287,7 +705,7 @@ const approvedGitRepos = defineRule({
 	title: "Approve git repository dependencies"
 });
 //#endregion
-//#region src/domain/rules/audit-suppression.ts
+//#region src/core/rules/audit-suppression.ts
 const { yarnrc: yarnrc$8 } = CONFIG_FILES;
 const isNonEmptyArray = (value) => Array.isArray(value) && value.length > 0;
 const SUPPRESSION_KEYS = ["npmAuditIgnoreAdvisories", "npmAuditExcludePackages"];
@@ -1320,7 +738,7 @@ const auditSuppression = defineRule({
 	title: "Review audit suppression entries"
 });
 //#endregion
-//#region src/domain/rules/block-auto-install.ts
+//#region src/core/rules/block-auto-install.ts
 const { bunfig: bunfig$5 } = CONFIG_FILES;
 const blockAutoInstall = requireConfigKey({
 	bindings: { bun: {
@@ -1338,11 +756,11 @@ const blockAutoInstall = requireConfigKey({
 	title: "Block automatic package installation"
 });
 //#endregion
-//#region src/domain/rules/block-exotic-subdeps.ts
+//#region src/core/rules/block-exotic-subdeps.ts
 const { aubeWorkspace: aubeWorkspace$7, npmrc: npmrc$6, pnpmWorkspace: pnpmWorkspace$10 } = CONFIG_FILES;
 const isRootOrNone = (value) => value === "root" || value === "none";
 const npmMessage = "Set `allow-git=none` and `allow-remote=none` in .npmrc to block git/tarball URLs; use `root` only when direct URL dependencies are required.";
-const npmBinding$2 = {
+const npmBinding$1 = {
 	check(_ctx, config) {
 		const git = getByPath(config, ["allow-git"]);
 		const remote = getByPath(config, ["allow-remote"]);
@@ -1375,14 +793,16 @@ const blockExoticSubdeps = overrideBindings(requireConfigKey({
 		aube: {
 			docs: "https://aube.jdx.dev/security.html",
 			documentedDefault: true,
+			defaultSafety: "unconditional",
 			file: aubeWorkspace$7,
 			keyPath: ["blockExoticSubdeps"],
 			message: "Set `blockExoticSubdeps: true` in aube-workspace.yaml to block git/tarball URLs in transitive dependencies.",
 			value: true
 		},
 		pnpm: {
-			docs: "https://pnpm.io/settings#blockexoticsubdeps",
+			docs: "https://pnpm.io/settings/dependency-resolution#blockexoticsubdeps",
 			documentedDefault: true,
+			defaultSafety: "conditional",
 			file: pnpmWorkspace$10,
 			keyPath: ["blockExoticSubdeps"],
 			message: "Set `blockExoticSubdeps: true` in pnpm-workspace.yaml to block git/tarball URLs in transitive dependencies.",
@@ -1394,13 +814,13 @@ const blockExoticSubdeps = overrideBindings(requireConfigKey({
 		}
 	},
 	description: "Refuse to install transitive dependencies sourced from git or tarball URLs, which bypass registry integrity checking.",
-	docs: "https://pnpm.io/settings#blockexoticsubdeps",
+	docs: "https://pnpm.io/settings/dependency-resolution#blockexoticsubdeps",
 	id: "block-exotic-subdeps",
 	severity: "warn",
 	title: "Block exotic subdependencies"
-}), { npm: npmBinding$2 });
+}), { npm: npmBinding$1 });
 //#endregion
-//#region src/domain/rules/bun-security-scanner.ts
+//#region src/core/rules/bun-security-scanner.ts
 const { bunfig: bunfig$4 } = CONFIG_FILES;
 const bunSecurityScanner = defineRule({
 	bindings: { bun: {
@@ -1439,12 +859,13 @@ const bunSecurityScanner = defineRule({
 	title: "Enable a bun install-time security scanner"
 });
 //#endregion
-//#region src/domain/rules/checksum-verification.ts
+//#region src/core/rules/checksum-verification.ts
 const { yarnrc: yarnrc$7 } = CONFIG_FILES;
 const checksumVerification = requireConfigKey({
 	bindings: { yarn: {
 		docs: "https://yarnpkg.com/configuration/yarnrc#checksumBehavior",
 		documentedDefault: "throw",
+		defaultSafety: "unconditional",
 		file: yarnrc$7,
 		keyPath: ["checksumBehavior"],
 		message: "Set `checksumBehavior: throw` in .yarnrc.yml to reject packages whose checksum does not match the lockfile.",
@@ -1457,7 +878,7 @@ const checksumVerification = requireConfigKey({
 	title: "Verify package checksums"
 });
 //#endregion
-//#region src/domain/entities/signals.ts
+//#region src/core/signals.ts
 const PM_SIGNALS = {
 	aube: {
 		configs: [CONFIG_FILES.aubeWorkspace.path],
@@ -1492,11 +913,11 @@ const PM_SIGNALS = {
 	}
 };
 //#endregion
-//#region src/domain/rules/commit-lockfile.ts
+//#region src/core/rules/commit-lockfile.ts
 const LOCKFILE_DOCS = {
 	aube: "https://github.com/aubepkg/aube/blob/main/docs/package-manager/lockfiles.md",
 	bun: "https://bun.com/docs/install/lockfile",
-	deno: "https://docs.deno.com/runtime/fundamentals/modules/#integrity-checking-and-lock-files",
+	deno: "https://docs.deno.com/runtime/reference/deno_json/#lockfile",
 	npm: "https://docs.npmjs.com/cli/v12/configuring-npm/package-lock-json",
 	pnpm: "https://pnpm.io/git#lockfiles",
 	yarn: "https://yarnpkg.com/getting-started/qa#should-lockfiles-be-committed-to-the-repository"
@@ -1505,7 +926,7 @@ const LOCKFILE_VERSION_NOTES = { deno: { configAvailableSince: "deno 1.28.0" } }
 const lockfileBinding = (pm) => {
 	const { lockfiles, reusesLockfiles } = PM_SIGNALS[pm];
 	const [primary] = lockfiles;
-	const accepted = [...lockfiles, ...reusesLockfiles ?? []].filter((lockfile) => pm !== "npm" || lockfile === primary);
+	const accepted = [...lockfiles, ...reusesLockfiles ?? []];
 	return {
 		check(ctx) {
 			if (pm === "aube" && ctx.exists(asRelPath("bun.lockb")) && !ctx.exists(asRelPath("bun.lock"))) return {
@@ -1516,7 +937,20 @@ const lockfileBinding = (pm) => {
 					steps: ["Run `bun install --save-text-lockfile` to generate bun.lock, then commit it."]
 				}
 			};
-			if (accepted.some((lf) => ctx.exists(asRelPath(lf)))) return { state: "ok" };
+			if (pm === "npm") {
+				if (ctx.exists(asRelPath(primary))) return { state: "ok" };
+				if (ctx.exists(asRelPath("npm-shrinkwrap.json"))) {
+					if (ctx.pmVersion && lt(ctx.pmVersion, "12.0.0")) return { state: "ok" };
+					return {
+						state: "violation",
+						message: ctx.pmVersion ? `npm ${ctx.pmVersion} no longer reads npm-shrinkwrap.json. Use package-lock.json.` : "Found npm-shrinkwrap.json, but the npm target version is unknown; npm 12 no longer reads it.",
+						remediation: {
+							kind: "manual",
+							steps: ["Verify and declare the npm version used by this project. For npm 12 or newer, migrate to package-lock.json and review the resulting dependency resolutions."]
+						}
+					};
+				}
+			} else if (accepted.some((lf) => ctx.exists(asRelPath(lf)))) return { state: "ok" };
 			return {
 				remediation: {
 					kind: "manual",
@@ -1530,7 +964,7 @@ const lockfileBinding = (pm) => {
 		versionNote: LOCKFILE_VERSION_NOTES[pm]
 	};
 };
-const denoBinding$2 = {
+const denoBinding$1 = {
 	file: CONFIG_FILES.denoJson,
 	docs: LOCKFILE_DOCS.deno,
 	versionNote: LOCKFILE_VERSION_NOTES.deno,
@@ -1561,19 +995,19 @@ const commitLockfile = defineRule({
 	bindings: {
 		aube: lockfileBinding("aube"),
 		bun: lockfileBinding("bun"),
-		deno: denoBinding$2,
+		deno: denoBinding$1,
 		npm: lockfileBinding("npm"),
 		pnpm: lockfileBinding("pnpm"),
 		yarn: lockfileBinding("yarn")
 	},
 	description: "Lockfiles pin the full dependency tree and integrity hashes, enabling reproducible, verifiable installs (e.g. `npm ci`).",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-include-lockfiles",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#3-include-lockfiles",
 	id: "commit-lockfile",
 	severity: "error",
 	title: "Commit a lockfile"
 });
 //#endregion
-//#region src/domain/rules/dependency-overrides.ts
+//#region src/core/rules/dependency-overrides.ts
 const { aubeWorkspace: aubeWorkspace$6, pnpmWorkspace: pnpmWorkspace$9 } = CONFIG_FILES;
 const isNonEmptyObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
 const checkOverrides = (config, file) => {
@@ -1599,16 +1033,16 @@ const makeBinding = (file, fileName, docs) => ({
 const dependencyOverrides = defineRule({
 	bindings: {
 		aube: makeBinding(aubeWorkspace$6, "aube-workspace.yaml", "https://aube.sh/settings/"),
-		pnpm: makeBinding(pnpmWorkspace$9, "pnpm-workspace.yaml", "https://pnpm.io/settings#overrides")
+		pnpm: makeBinding(pnpmWorkspace$9, "pnpm-workspace.yaml", "https://pnpm.io/settings/dependency-resolution#overrides")
 	},
 	description: "Flag dependency overrides that can replace transitive packages with arbitrary versions or forks — a supply-chain injection vector.",
-	docs: "https://pnpm.io/settings#overrides",
+	docs: "https://pnpm.io/settings/dependency-resolution#overrides",
 	id: "dependency-overrides",
 	severity: "info",
 	title: "Review dependency overrides"
 });
 //#endregion
-//#region src/domain/rules/disable-lifecycle-scripts.ts
+//#region src/core/rules/disable-lifecycle-scripts.ts
 const { npmrc: npmrc$5, pnpmWorkspace: pnpmWorkspace$8, yarnrc: yarnrc$6, aubeWorkspace: aubeWorkspace$5, bunfig: bunfig$3 } = CONFIG_FILES;
 const pnpmBinding$4 = {
 	check(ctx, config) {
@@ -1682,7 +1116,7 @@ const pnpmBinding$4 = {
 			}])
 		};
 	},
-	docs: "https://pnpm.io/settings#strictdepbuilds",
+	docs: "https://pnpm.io/settings/build#strictdepbuilds",
 	file: pnpmWorkspace$8,
 	versionNote: {
 		configAvailableSince: "pnpm 10.3.0",
@@ -1769,6 +1203,7 @@ const disableLifecycleScripts = withAubeParanoid(overrideBindings(requireConfigK
 		yarn: {
 			docs: "https://yarnpkg.com/configuration/yarnrc#enableScripts",
 			documentedDefault: false,
+			defaultSafety: "conditional",
 			file: yarnrc$6,
 			keyPath: ["enableScripts"],
 			message: "Set `enableScripts: false` in .yarnrc.yml to pin the policy across versions.",
@@ -1780,7 +1215,7 @@ const disableLifecycleScripts = withAubeParanoid(overrideBindings(requireConfigK
 		}
 	},
 	description: "Malicious postinstall scripts are a primary supply-chain attack vector. Prevent automatic execution of dependency lifecycle scripts.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#3-disable-lifecycle-scripts",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#1-disable-lifecycle-scripts",
 	id: "disable-lifecycle-scripts",
 	severity: "error",
 	title: "Disable dependency lifecycle scripts"
@@ -1790,7 +1225,7 @@ const disableLifecycleScripts = withAubeParanoid(overrideBindings(requireConfigK
 	pnpm: pnpmBinding$4
 }));
 //#endregion
-//#region src/domain/rules/enforce-strict-ssl.ts
+//#region src/core/rules/enforce-strict-ssl.ts
 const { npmrc: npmrc$4, yarnrc: yarnrc$5 } = CONFIG_FILES;
 const yarnMessage = "Set `enableStrictSsl: true` in .yarnrc.yml to enforce SSL certificate validation for registry connections.";
 const yarnBinding = {
@@ -1829,6 +1264,7 @@ const enforceStrictSsl = overrideBindings(requireConfigKey({
 	bindings: { npm: {
 		docs: "https://docs.npmjs.com/cli/v11/using-npm/config#strict-ssl",
 		documentedDefault: true,
+		defaultSafety: "unconditional",
 		file: npmrc$4,
 		keyPath: ["strict-ssl"],
 		message: "Set `strict-ssl=true` in .npmrc to enforce SSL certificate validation.",
@@ -1841,7 +1277,7 @@ const enforceStrictSsl = overrideBindings(requireConfigKey({
 	title: "Enforce SSL for registry connections"
 }), { yarn: yarnBinding });
 //#endregion
-//#region src/domain/services/project-type.ts
+//#region src/core/resolve-project-type.ts
 const isPublishableName = (value) => typeof value === "string" && value.trim().length > 0;
 const resolveProjectType = (selected, inferredPackage) => selected ?? (inferredPackage ? "package" : "application");
 const resolvePackageJsonProjectType = (ctx) => {
@@ -1851,10 +1287,10 @@ const resolvePackageJsonProjectType = (ctx) => {
 };
 const resolveDenoProjectType = (ctx, denoConfig) => resolveProjectType(ctx.projectType, getByPath(denoConfig, ["publish"]) !== false && isPublishableName(getByPath(denoConfig, ["name"])));
 //#endregion
-//#region src/domain/rules/publishable.ts
+//#region src/core/rules/publishable.ts
 const isPublishable = (ctx) => resolvePackageJsonProjectType(ctx) === "package";
 //#endregion
-//#region src/domain/rules/files-field.ts
+//#region src/core/rules/files-field.ts
 const { packageJson: packageJson$1, denoJson: denoJson$3 } = CONFIG_FILES;
 const packageJsonFilesBinding = {
 	check(ctx) {
@@ -1874,47 +1310,48 @@ const packageJsonFilesBinding = {
 	docs: "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#files",
 	file: packageJson$1
 };
+const denoPublishBinding = {
+	check(ctx, config) {
+		if (resolveDenoProjectType(ctx, config) !== "package") return { state: "na" };
+		const include = getByPath(config, ["publish", "include"]);
+		if (isStringList(include) && include.length > 0) return { state: "ok" };
+		return {
+			remediation: {
+				kind: "manual",
+				steps: ["Add a non-empty `publish.include` array to deno.json; use `publish.exclude` for additional exclusions."]
+			},
+			actual: include,
+			message: "Add `publish.include` to deno.json to limit what gets published.",
+			state: "violation"
+		};
+	},
+	docs: "https://docs.deno.com/runtime/reference/deno_json/#publish---override-.gitignore",
+	file: denoJson$3
+};
 const filesField = defineRule({
 	bindings: {
 		aube: packageJsonFilesBinding,
 		bun: packageJsonFilesBinding,
-		deno: {
-			check(ctx, config) {
-				if (resolveDenoProjectType(ctx, config) !== "package") return { state: "na" };
-				const include = getByPath(config, ["publish", "include"]);
-				if (isStringList(include) && include.length > 0) return { state: "ok" };
-				return {
-					remediation: {
-						kind: "manual",
-						steps: ["Add a non-empty `publish.include` array to deno.json; use `publish.exclude` for additional exclusions."]
-					},
-					actual: include,
-					message: "Add `publish.include` to deno.json to limit what gets published.",
-					state: "violation"
-				};
-			},
-			docs: "https://docs.deno.com/runtime/reference/cli/publish/#how-publishing-works",
-			file: denoJson$3
-		},
+		deno: denoPublishBinding,
 		npm: packageJsonFilesBinding,
 		pnpm: packageJsonFilesBinding,
 		yarn: packageJsonFilesBinding
 	},
 	description: "An explicit `files` array in package.json restricts what gets published, preventing accidental inclusion of secrets or local files.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#11-review-published-files",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#12-review-published-files",
 	id: "files-field",
 	projectTypes: ["package"],
 	severity: "info",
 	title: "Declare a published files allow-list"
 });
 //#endregion
-//#region src/domain/rules/frozen-lockfile.ts
+//#region src/core/rules/frozen-lockfile.ts
 const { pnpmWorkspace: pnpmWorkspace$7, yarnrc: yarnrc$4, bunfig: bunfig$2, denoJson: denoJson$2 } = CONFIG_FILES;
 const aubeFrozenCommand = "Use `aube ci` or `aube install --frozen-lockfile` to fail when the lockfile would change.";
 const frozenLockfile = overrideBindings(requireConfigKey({
 	bindings: {
 		deno: {
-			docs: "https://docs.deno.com/runtime/fundamentals/configuration/#lock",
+			docs: "https://docs.deno.com/runtime/reference/deno_json/#lockfile",
 			file: denoJson$2,
 			keyPath: ["lock", "frozen"],
 			message: "Set `lock.frozen: true` in deno.json for reproducible, verified installs.",
@@ -1929,7 +1366,7 @@ const frozenLockfile = overrideBindings(requireConfigKey({
 			versionNote: { configAvailableSince: "bun 0.6.10" }
 		},
 		pnpm: {
-			docs: "https://pnpm.io/settings#frozenlockfile",
+			docs: "https://pnpm.io/cli/install#--frozen-lockfile",
 			file: pnpmWorkspace$7,
 			keyPath: ["frozenLockfile"],
 			message: "pnpm defaults frozenLockfile to true in CI — set it explicitly in pnpm-workspace.yaml to pin the policy outside CI too.",
@@ -1938,6 +1375,7 @@ const frozenLockfile = overrideBindings(requireConfigKey({
 		yarn: {
 			docs: "https://yarnpkg.com/configuration/yarnrc#enableImmutableInstalls",
 			documentedDefault: true,
+			defaultSafety: "conditional",
 			file: yarnrc$4,
 			keyPath: ["enableImmutableInstalls"],
 			message: "Set `enableImmutableInstalls: true` in .yarnrc.yml to pin the policy outside CI too.",
@@ -1949,7 +1387,7 @@ const frozenLockfile = overrideBindings(requireConfigKey({
 		}
 	},
 	description: "Refuse to mutate the lockfile on install so unexpected dependency changes fail loudly.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-include-lockfiles",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#3-include-lockfiles",
 	id: "frozen-lockfile",
 	severity: "warn",
 	title: "Freeze the lockfile"
@@ -1968,7 +1406,7 @@ const frozenLockfile = overrideBindings(requireConfigKey({
 	severity: "info"
 } });
 //#endregion
-//#region src/domain/rules/frozen-store.ts
+//#region src/core/rules/frozen-store.ts
 const { pnpmWorkspace: pnpmWorkspace$6 } = CONFIG_FILES;
 const frozenStore = defineRule({
 	bindings: { pnpm: {
@@ -1999,12 +1437,13 @@ const frozenStore = defineRule({
 	title: "Consider a pre-populated read-only store"
 });
 //#endregion
-//#region src/domain/rules/hardened-mode.ts
+//#region src/core/rules/hardened-mode.ts
 const { yarnrc: yarnrc$3 } = CONFIG_FILES;
 const hardenedMode = requireConfigKey({
 	bindings: { yarn: {
 		docs: "https://yarnpkg.com/configuration/yarnrc#enableHardenedMode",
 		documentedDefault: true,
+		defaultSafety: "conditional",
 		file: yarnrc$3,
 		keyPath: ["enableHardenedMode"],
 		message: "yarn enables hardened mode automatically only for pull requests on public repositories — set `enableHardenedMode: true` in .yarnrc.yml to extend end-to-end install verification to every install.",
@@ -2021,19 +1460,9 @@ const hardenedMode = requireConfigKey({
 	title: "Enable hardened mode (yarn)"
 });
 //#endregion
-//#region src/domain/rules/minimum-release-age.ts
-const HOURS_PER_DAY = 24;
-const MINUTES_PER_HOUR = 60;
-const SECONDS_PER_MINUTE = 60;
-const MINUTES_PER_DAY = HOURS_PER_DAY * MINUTES_PER_HOUR;
-const SECONDS_PER_DAY = MINUTES_PER_DAY * SECONDS_PER_MINUTE;
-const RECOMMENDED_RELEASE_AGE_DAYS = 3;
-const RECOMMENDED_RELEASE_AGE_MINUTES = RECOMMENDED_RELEASE_AGE_DAYS * MINUTES_PER_DAY;
-const RECOMMENDED_RELEASE_AGE_SECONDS = RECOMMENDED_RELEASE_AGE_DAYS * SECONDS_PER_DAY;
-const DOCUMENTED_DEFAULT_MINUTES = MINUTES_PER_DAY;
-const { npmrc: npmrc$3, pnpmWorkspace: pnpmWorkspace$5, yarnrc: yarnrc$2, bunfig: bunfig$1, denoJson: denoJson$1, aubeWorkspace: aubeWorkspace$4 } = CONFIG_FILES;
+//#region src/core/rules/deno-release-age.ts
 const DENO_DURATION = /^\+?P(?:\+?\d+[Ww]|(?:\d+[Dd])*(?:T(?:\d+[HhMm]|\d+(?:\.\d+)?[Ss])+)?)$/u;
-const DENO_MIN_TIMESTAMP = Date.parse("-262143-01-01T00:00:00Z");
+const DENO_MIN_TIMESTAMP = Date.UTC(-262143, 0, 1);
 const DENO_UNIT_SECONDS = {
 	w: 604800,
 	d: 86400,
@@ -2044,33 +1473,49 @@ const DENO_UNIT_SECONDS = {
 const DENO_DATE = /^\d{4}-\d{2}-\d{2}$/u;
 const DENO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}[Tt ](?:[01]\d|2[0-3]):[0-5]\d:(?:[0-5]\d|60)(?:\.\d+)?(?:[Zz]|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/u;
 const DENO_OFFSET_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T(?:[01]\d|2[0-3]):[0-5]\d(?::(?:[0-5]\d|60))?[+-](?:[01]\d|2[0-3]):?[0-5]\d$/u;
-const isPositiveNumber = (value) => typeof value === "number" && Number.isFinite(value) && value > 0;
-const isPositiveYarnDuration = (value) => isPositiveNumber(value) || typeof value === "string" && /^\d*\.?\d+(?:ms|s|m|h|d|w)?$/u.test(value) && Number.isFinite(Number.parseFloat(value)) && Number.parseFloat(value) > 0;
-const isPositiveDenoSeconds = (seconds) => seconds > 0 && Number.isFinite(seconds) && Date.now() - seconds * 1e3 >= DENO_MIN_TIMESTAMP;
-const isActiveDenoAge = (value) => {
-	if (typeof value === "number") return Number.isSafeInteger(value) && isPositiveDenoSeconds(value * 60);
-	if (typeof value !== "string") return false;
-	if (/^\d+$/u.test(value)) return Number.isSafeInteger(Number(value)) && isPositiveDenoSeconds(Number(value) * 60);
-	if (DENO_DURATION.test(value)) {
-		let seconds = 0;
-		for (const [, integer, fraction, unit] of value.matchAll(/(\d+)(?:\.(\d+))?([WDHMS])/giu)) {
-			const amount = Number(integer) + Number(`0.${(fraction ?? "").slice(0, 9) || "0"}`);
-			seconds += amount * (DENO_UNIT_SECONDS[unit?.toLowerCase() ?? ""] ?? 0);
-		}
-		return isPositiveDenoSeconds(seconds);
+const DENO_DURATION_TOKEN = /(\d+)(?:\.(\d+))?([WDHMS])/giu;
+const LEAP_SECOND = /:60(?=\.|Z|z|[+-])/u;
+const isPositiveDenoSeconds = (seconds, now) => seconds > 0 && Number.isFinite(seconds) && now - seconds * 1e3 >= DENO_MIN_TIMESTAMP;
+const durationSeconds = (value) => {
+	let seconds = 0;
+	for (const [, integer, fraction, unit] of value.matchAll(DENO_DURATION_TOKEN)) {
+		const amount = Number(integer) + Number(`0.${(fraction ?? "").slice(0, 9) || "0"}`);
+		seconds += amount * (DENO_UNIT_SECONDS[unit?.toLowerCase() ?? ""] ?? 0);
 	}
+	return seconds;
+};
+/** Match Deno's minimumDependencyAge value grammar and active-cutoff semantics. */
+const isActiveDenoReleaseAge = (value, now, parse) => {
+	if (typeof value === "number") return Number.isSafeInteger(value) && isPositiveDenoSeconds(value * 60, now);
+	if (typeof value !== "string") return false;
+	if (/^\d+$/u.test(value)) return Number.isSafeInteger(Number(value)) && isPositiveDenoSeconds(Number(value) * 60, now);
+	if (DENO_DURATION.test(value)) return isPositiveDenoSeconds(durationSeconds(value), now);
 	if (!DENO_DATE.test(value) && !DENO_TIMESTAMP.test(value) && !DENO_OFFSET_TIMESTAMP.test(value)) return false;
 	const date = value.slice(0, 10);
 	const midnight = /* @__PURE__ */ new Date(`${date}T00:00:00Z`);
-	const leapSecond = /:60(?=\.|Z|z|[+-])/u.test(value);
-	const timestamp = Date.parse(value.replace(/:60(?=\.|Z|z|[+-])/u, ":59")) + (leapSecond ? 1e3 : 0);
-	return !Number.isNaN(midnight.valueOf()) && midnight.toISOString().slice(0, 10) === date && timestamp < Date.now();
+	const leapSecond = LEAP_SECOND.test(value);
+	const timestamp = parse(value.replace(LEAP_SECOND, ":59")) + (leapSecond ? 1e3 : 0);
+	return !Number.isNaN(midnight.valueOf()) && midnight.toISOString().slice(0, 10) === date && timestamp < now;
 };
-const isNonDisabledDenoDuration = (value) => {
-	if (!isPlainRecord(value)) return isActiveDenoAge(value);
+//#endregion
+//#region src/core/rules/minimum-release-age.ts
+const HOURS_PER_DAY = 24;
+const MINUTES_PER_HOUR = 60;
+const SECONDS_PER_MINUTE = 60;
+const MINUTES_PER_DAY = HOURS_PER_DAY * MINUTES_PER_HOUR;
+const SECONDS_PER_DAY = MINUTES_PER_DAY * SECONDS_PER_MINUTE;
+const RECOMMENDED_RELEASE_AGE_DAYS = 3;
+const RECOMMENDED_RELEASE_AGE_MINUTES = RECOMMENDED_RELEASE_AGE_DAYS * MINUTES_PER_DAY;
+const RECOMMENDED_RELEASE_AGE_SECONDS = RECOMMENDED_RELEASE_AGE_DAYS * SECONDS_PER_DAY;
+const DOCUMENTED_DEFAULT_MINUTES = MINUTES_PER_DAY;
+const { npmrc: npmrc$3, pnpmWorkspace: pnpmWorkspace$5, yarnrc: yarnrc$2, bunfig: bunfig$1, denoJson: denoJson$1, aubeWorkspace: aubeWorkspace$4 } = CONFIG_FILES;
+const isPositiveNumber = (value) => typeof value === "number" && Number.isFinite(value) && value > 0;
+const isPositiveYarnDuration = (value) => isPositiveNumber(value) || typeof value === "string" && /^\d*\.?\d+(?:ms|s|m|h|d|w)?$/u.test(value) && Number.isFinite(Number.parseFloat(value)) && Number.parseFloat(value) > 0;
+const isNonDisabledDenoReleaseAge = (value, now, parse) => {
+	if (!isPlainRecord(value)) return isActiveDenoReleaseAge(value, now, parse);
 	if (Object.keys(value).some((key) => key !== "age" && key !== "exclude")) return false;
 	if (value.exclude !== void 0 && !isStringList(value.exclude)) return false;
-	return value.age == null || isActiveDenoAge(value.age);
+	return value.age != null && isActiveDenoReleaseAge(value.age, now, parse);
 };
 const denoAgeUsesFallback = (value) => {
 	if (value === void 0 || value === null) return true;
@@ -2079,13 +1524,14 @@ const denoAgeUsesFallback = (value) => {
 	if (value.exclude !== void 0 && !isStringList(value.exclude)) return false;
 	return value.age == null;
 };
-const isPositiveDenoNpmrcDays = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
-const minimumReleaseAge = overrideBindings(requireConfigKey({
+const isPositiveDenoNpmrcDays = (value, now, parse) => typeof value === "number" && Number.isSafeInteger(value) && isActiveDenoReleaseAge(value * MINUTES_PER_DAY, now, parse);
+const baseRule$2 = requireConfigKey({
 	bindings: {
 		aube: {
 			accept: isPositiveNumber,
 			docs: "https://aube.sh/settings/",
 			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
+			defaultSafety: "unconditional",
 			file: aubeWorkspace$4,
 			keyPath: ["minimumReleaseAge"],
 			message: `Set minimumReleaseAge (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in aube-workspace.yaml.`,
@@ -2102,8 +1548,9 @@ const minimumReleaseAge = overrideBindings(requireConfigKey({
 		},
 		pnpm: {
 			accept: isPositiveNumber,
-			docs: "https://pnpm.io/settings#minimumreleaseage",
+			docs: "https://pnpm.io/settings/dependency-resolution#minimumreleaseage",
 			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
+			defaultSafety: "conditional",
 			file: pnpmWorkspace$5,
 			keyPath: ["minimumReleaseAge"],
 			message: `Set minimumReleaseAge (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in pnpm-workspace.yaml.`,
@@ -2117,6 +1564,7 @@ const minimumReleaseAge = overrideBindings(requireConfigKey({
 			accept: isPositiveYarnDuration,
 			docs: "https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate",
 			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
+			defaultSafety: "conditional",
 			file: yarnrc$2,
 			keyPath: ["npmMinimalAgeGate"],
 			message: `Set npmMinimalAgeGate (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in .yarnrc.yml.`,
@@ -2128,108 +1576,112 @@ const minimumReleaseAge = overrideBindings(requireConfigKey({
 		}
 	},
 	description: "Refuse to install releases newer than a cooldown window so freshly published (possibly compromised) versions are skipped.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#set-minimal-release-age",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-set-cooldowns--minimum-release-age",
 	id: "minimum-release-age",
 	severity: "warn",
 	title: "Set a minimum release age"
-}), {
-	npm: {
-		file: npmrc$3,
-		docs: "https://docs.npmjs.com/cli/v12/using-npm/config#min-release-age",
-		versionNote: { note: "min-release-age available since npm 11.10.0" },
-		check(ctx, config) {
-			const now = Date.now();
-			if (Object.hasOwn(config, "before")) {
-				const actual = config.before;
-				if ((typeof actual === "string" || typeof actual === "number") && Date.parse(String(actual)) < now) return { state: "ok" };
-				return {
-					state: "violation",
-					actual,
-					expected: "a date in the past",
-					message: "Use a valid past before cutoff, or remove before and set min-release-age.",
-					remediation: {
-						kind: "manual",
-						steps: ["In .npmrc, set before to a valid past date. A future or disabled before overrides min-release-age in this file.", ...guardRemediationAvailability("npm", ctx.pmVersion, {
-							kind: "manual",
-							steps: [`Alternatively, remove before and set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days.`]
-						}, [{
-							file: npmrc$3,
-							keyPath: ["min-release-age"]
-						}])?.steps ?? []]
-					}
-				};
-			}
-			const actual = getByPath(config, ["min-release-age"]);
-			const age = typeof actual === "number" || typeof actual === "string" ? Number(actual) : NaN;
-			const cutoff = (/* @__PURE__ */ new Date(now - SECONDS_PER_DAY * 1e3 * age)).valueOf();
-			if (age > 0 && Number.isFinite(cutoff) && cutoff < now) return { state: "ok" };
+});
+const createNpmBinding = (time) => ({
+	file: npmrc$3,
+	docs: "https://docs.npmjs.com/cli/v12/using-npm/config#min-release-age",
+	versionNote: { note: "min-release-age available since npm 11.10.0" },
+	check(ctx, config) {
+		const now = time.now();
+		if (Object.hasOwn(config, "before")) {
+			const actual = config.before;
+			if ((typeof actual === "string" || typeof actual === "number") && time.parse(String(actual)) < now) return { state: "ok" };
 			return {
 				state: "violation",
 				actual,
-				expected: RECOMMENDED_RELEASE_AGE_DAYS,
-				message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days to quarantine brand-new releases.`,
-				remediation: guardRemediationAvailability("npm", ctx.pmVersion, proposeChanges(config, [{
-					file: npmrc$3,
-					op: "setKey",
-					keyPath: ["min-release-age"],
-					value: RECOMMENDED_RELEASE_AGE_DAYS
-				}]), [{
-					file: npmrc$3,
-					keyPath: ["min-release-age"]
-				}])
+				expected: "a date in the past",
+				message: "Use a valid past before cutoff, or remove before and set min-release-age.",
+				remediation: {
+					kind: "manual",
+					steps: ["In .npmrc, set before to a valid past date. A future or disabled before overrides min-release-age in this file.", ...guardRemediationAvailability("npm", ctx.pmVersion, {
+						kind: "manual",
+						steps: [`Alternatively, remove before and set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days.`]
+					}, [{
+						file: npmrc$3,
+						keyPath: ["min-release-age"]
+					}])?.steps ?? []]
+				}
 			};
 		}
+		const actual = getByPath(config, ["min-release-age"]);
+		const age = typeof actual === "number" || typeof actual === "string" ? Number(actual) : NaN;
+		const cutoff = (/* @__PURE__ */ new Date(now - SECONDS_PER_DAY * 1e3 * age)).valueOf();
+		if (age > 0 && Number.isFinite(cutoff) && cutoff < now) return { state: "ok" };
+		return {
+			state: "violation",
+			actual,
+			expected: RECOMMENDED_RELEASE_AGE_DAYS,
+			message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days to quarantine brand-new releases.`,
+			remediation: guardRemediationAvailability("npm", ctx.pmVersion, proposeChanges(config, [{
+				file: npmrc$3,
+				op: "setKey",
+				keyPath: ["min-release-age"],
+				value: RECOMMENDED_RELEASE_AGE_DAYS
+			}]), [{
+				file: npmrc$3,
+				keyPath: ["min-release-age"]
+			}])
+		};
+	}
+});
+const createDenoBinding = (time) => ({
+	file: denoJson$1,
+	docs: "https://docs.deno.com/runtime/reference/deno_json/",
+	versionNote: {
+		defaultSafeSince: "deno 2.9.0 (1440 minutes)",
+		note: "object age may be omitted; project .npmrc fallback available since deno 2.8.1"
 	},
-	deno: {
-		file: denoJson$1,
-		docs: "https://docs.deno.com/runtime/reference/deno_json/",
-		versionNote: {
-			defaultSafeSince: "deno 2.9.0 (1440 minutes)",
-			note: "object age may be omitted; project .npmrc fallback available since deno 2.8.1"
-		},
-		check(ctx, config) {
-			const actual = getByPath(config, ["minimumDependencyAge"]);
-			if (denoAgeUsesFallback(actual)) {
-				const npmrcConfig = ctx.readConfig(npmrc$3);
-				const npmrcAge = getByPath(npmrcConfig, ["min-release-age"]);
-				if (isPositiveDenoNpmrcDays(npmrcAge)) return { state: "ok" };
-				if (npmrcAge === 0) return {
-					state: "violation",
-					actual: npmrcAge,
-					expected: RECOMMENDED_RELEASE_AGE_DAYS,
-					file: npmrc$3.path,
-					message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days in .npmrc, or set minimumDependencyAge in deno.json.`,
-					remediation: proposeChanges(npmrcConfig, [{
-						file: npmrc$3,
-						op: "setKey",
-						keyPath: ["min-release-age"],
-						value: RECOMMENDED_RELEASE_AGE_DAYS
-					}])
-				};
-			}
-			if (isNonDisabledDenoDuration(actual)) return { state: "ok" };
-			const objectAge = isPlainRecord(actual);
-			const invalidObject = objectAge && (Object.keys(actual).some((key) => key !== "age" && key !== "exclude") || actual.exclude !== void 0 && !isStringList(actual.exclude));
-			return {
+	check(ctx, config) {
+		const actual = getByPath(config, ["minimumDependencyAge"]);
+		const now = time.now();
+		if (denoAgeUsesFallback(actual)) {
+			const npmrcConfig = ctx.readConfig(npmrc$3);
+			const npmrcAge = getByPath(npmrcConfig, ["min-release-age"]);
+			if (isPositiveDenoNpmrcDays(npmrcAge, now, time.parse)) return { state: "ok" };
+			if (npmrcAge === 0) return {
 				state: "violation",
-				actual,
-				expected: "P3D",
-				message: `Set minimumDependencyAge (e.g. "P3D" for a ${RECOMMENDED_RELEASE_AGE_DAYS}-day cooldown) in deno.json.`,
-				remediation: invalidObject ? {
-					kind: "manual",
-					steps: ["Use only age and exclude in minimumDependencyAge. Make exclude a list of package names and set age to a positive supported duration."]
-				} : proposeChanges(config, [{
-					file: denoJson$1,
+				actual: npmrcAge,
+				expected: RECOMMENDED_RELEASE_AGE_DAYS,
+				file: npmrc$3.path,
+				message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days in .npmrc, or set minimumDependencyAge in deno.json.`,
+				remediation: proposeChanges(npmrcConfig, [{
+					file: npmrc$3,
 					op: "setKey",
-					keyPath: objectAge ? ["minimumDependencyAge", "age"] : ["minimumDependencyAge"],
-					value: "P3D"
+					keyPath: ["min-release-age"],
+					value: RECOMMENDED_RELEASE_AGE_DAYS
 				}])
 			};
 		}
+		if (isNonDisabledDenoReleaseAge(actual, now, time.parse)) return { state: "ok" };
+		const objectAge = isPlainRecord(actual);
+		const invalidObject = objectAge && (Object.keys(actual).some((key) => key !== "age" && key !== "exclude") || actual.exclude !== void 0 && !isStringList(actual.exclude));
+		return {
+			state: "violation",
+			actual,
+			expected: "P3D",
+			message: `Set minimumDependencyAge (e.g. "P3D" for a ${RECOMMENDED_RELEASE_AGE_DAYS}-day cooldown) in deno.json.`,
+			remediation: invalidObject ? {
+				kind: "manual",
+				steps: ["Use only age and exclude in minimumDependencyAge. Make exclude a list of package names and set age to a positive supported duration."]
+			} : proposeChanges(config, [{
+				file: denoJson$1,
+				op: "setKey",
+				keyPath: objectAge ? ["minimumDependencyAge", "age"] : ["minimumDependencyAge"],
+				value: "P3D"
+			}])
+		};
 	}
 });
+const createMinimumReleaseAge = (time) => overrideBindings(baseRule$2, {
+	npm: createNpmBinding(time),
+	deno: createDenoBinding(time)
+});
 //#endregion
-//#region src/domain/rules/named-registries.ts
+//#region src/core/rules/named-registries.ts
 const { pnpmWorkspace: pnpmWorkspace$4 } = CONFIG_FILES;
 const isNonEmptyObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
 const namedRegistries = defineRule({
@@ -2247,17 +1699,17 @@ const namedRegistries = defineRule({
 				state: "violation"
 			};
 		},
-		docs: "https://pnpm.io/settings#namedregistries",
+		docs: "https://pnpm.io/settings/dependency-resolution#namedregistries",
 		file: pnpmWorkspace$4
 	} },
 	description: "Flag named registry mappings that redirect package resolution to custom registries, which may enable dependency confusion attacks.",
-	docs: "https://pnpm.io/settings#namedregistries",
+	docs: "https://pnpm.io/settings/dependency-resolution#namedregistries",
 	id: "named-registries",
 	severity: "info",
 	title: "Review named registry mappings"
 });
 //#endregion
-//#region src/domain/rules/paranoid-mode.ts
+//#region src/core/rules/paranoid-mode.ts
 const { aubeWorkspace: aubeWorkspace$3 } = CONFIG_FILES;
 const paranoidMode = requireConfigKey({
 	bindings: { aube: {
@@ -2274,7 +1726,7 @@ const paranoidMode = requireConfigKey({
 	title: "Enable paranoid security mode"
 });
 //#endregion
-//#region src/domain/rules/patched-dependencies.ts
+//#region src/core/rules/patched-dependencies.ts
 const { pnpmWorkspace: pnpmWorkspace$3 } = CONFIG_FILES;
 const isNonEmptyObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
 const patchedDependencies = defineRule({
@@ -2292,27 +1744,33 @@ const patchedDependencies = defineRule({
 				state: "violation"
 			};
 		},
-		docs: "https://pnpm.io/settings#patcheddependencies",
+		docs: "https://pnpm.io/cli/patch#patcheddependencies",
 		file: pnpmWorkspace$3
 	} },
 	description: "Review local patches separately from the registry artifacts they modify.",
-	docs: "https://pnpm.io/settings#patcheddependencies",
+	docs: "https://pnpm.io/cli/patch#patcheddependencies",
 	id: "patched-dependencies",
 	severity: "info",
 	title: "Review patched dependencies"
 });
 //#endregion
-//#region src/domain/rules/pin-exact-versions.ts
+//#region src/core/rules/pin-exact-versions.ts
 const { npmrc: npmrc$2, pnpmWorkspace: pnpmWorkspace$2, yarnrc: yarnrc$1, bunfig, denoJson } = CONFIG_FILES;
 const REGISTRY_VERSION = /^(?:npm|jsr):(?:@[^/@]+\/)?[^/@]+@(?<version>[^/]*)/u;
 const isUnpinnedRegistryImport = (specifier) => {
 	if (!specifier.startsWith("npm:") && !specifier.startsWith("jsr:")) return false;
 	const version = REGISTRY_VERSION.exec(specifier)?.groups?.version;
-	return version === void 0 || valid(version.replace(/^=/u, "")) === null;
+	const normalized = version?.startsWith("=") ? version.slice(1) : version;
+	return normalized === void 0 || valid(normalized) === null;
 };
-const collectUnpinnedImports = (imports) => {
+const collectUnpinnedImports = (imports, location) => {
+	if (!isPlainRecord(imports)) throw new ConfigError(`deno.json: ${location} must be an import mapping object.`);
 	const offenders = [];
-	for (const [name, value] of Object.entries(imports)) if (typeof value === "string" && isUnpinnedRegistryImport(value)) offenders.push(`${name}=${value}`);
+	for (const [name, value] of Object.entries(imports)) {
+		if (value === null) continue;
+		if (typeof value !== "string") throw new ConfigError(`deno.json: ${location}.${name} must be a string or null.`);
+		if (isUnpinnedRegistryImport(value)) offenders.push(`${location}.${name}=${value}`);
+	}
 	return offenders;
 };
 const MAX_SAMPLE_COUNT = 3;
@@ -2323,23 +1781,26 @@ const formatOffenders = (offenders) => {
 	return {
 		remediation: {
 			kind: "manual",
-			steps: ["Run `deno add --save-exact <pkg>` for each unpinned registry import in deno.json, or rewrite the `imports` entries to use exact versions."]
+			steps: ["Pin each reported imports/scopes entry in deno.json to an exact version. For top-level imports, `deno add --save-exact <pkg>` can help; edit scoped mappings at their reported locations."]
 		},
 		message: `${offenders.length} deno imports are not pinned: ${sample}${more}. Use \`deno add --save-exact\` or pin manually.`,
 		state: "violation"
 	};
 };
 const OK = { state: "ok" };
-const extractImportsRecord = (config) => {
+const unpinnedInlineImports = (config) => {
 	const imports = getByPath(config, ["imports"]);
-	if (!isPlainRecord(imports)) return;
-	return imports;
+	const offenders = imports == null ? [] : collectUnpinnedImports(imports, "imports");
+	const scopes = getByPath(config, ["scopes"]);
+	if (scopes != null) {
+		if (!isPlainRecord(scopes)) throw new ConfigError("deno.json: scopes must be an object.");
+		for (const [scope, mapping] of Object.entries(scopes)) offenders.push(...collectUnpinnedImports(mapping, `scopes[${JSON.stringify(scope)}]`));
+	}
+	return offenders;
 };
 const denoBinding = {
 	check(_ctx, config) {
-		const imports = extractImportsRecord(config);
-		if (!imports) return OK;
-		const offenders = collectUnpinnedImports(imports);
+		const offenders = unpinnedInlineImports(config);
 		if (offenders.length === 0) return OK;
 		return formatOffenders(offenders);
 	},
@@ -2370,7 +1831,7 @@ const npmBinding = {
 };
 const aubeBinding = {
 	file: npmrc$2,
-	docs: "https://aube.jdx.dev/settings/#saveprefix",
+	docs: "https://aube.sh/settings/#setting-saveprefix",
 	check(_ctx, config) {
 		const prefixes = ["save-prefix", "savePrefix"].filter((key) => Object.hasOwn(config, key)).map((key) => config[key]);
 		if (prefixes.length > 0 && prefixes.every((value) => value === "")) return OK;
@@ -2411,8 +1872,8 @@ const pinExactVersions = overrideBindings(requireConfigKey({
 			versionNote: { configAvailableSince: "yarn 2.0.0" }
 		}
 	},
-	description: "Semver ranges (^, ~) auto-adopt new releases, including compromised ones. Save exact versions by default.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#1-pin-dependency-versions",
+	description: "Semver ranges (^, ~) auto-adopt new releases, including compromised ones. Save exact versions by default; for Deno, inspect registry mappings in both inline imports and scopes (not external import maps).",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#4-pin-dependency-versions",
 	id: "pin-exact-versions",
 	severity: "error",
 	title: "Pin exact dependency versions"
@@ -2422,7 +1883,7 @@ const pinExactVersions = overrideBindings(requireConfigKey({
 	npm: npmBinding
 });
 //#endregion
-//#region src/domain/rules/provenance.ts
+//#region src/core/rules/provenance.ts
 const { npmrc: npmrc$1, yarnrc } = CONFIG_FILES;
 const npmrcProvenance = {
 	file: npmrc$1,
@@ -2430,7 +1891,7 @@ const npmrcProvenance = {
 	message: "Set `provenance=true` (and publish from CI) to attest releases.",
 	value: true
 };
-const provenance = requireConfigKey({
+const baseRule = requireConfigKey({
 	applies: isPublishable,
 	bindings: {
 		bun: {
@@ -2456,14 +1917,37 @@ const provenance = requireConfigKey({
 		}
 	},
 	description: "Provenance statements (via Sigstore) bind a published artifact to its recorded source and build.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#10-generate-provenance-statements",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#11-generate-provenance-statements",
 	id: "provenance",
 	projectTypes: ["package"],
 	severity: "warn",
 	title: "Publish with provenance"
 });
+const provenance = overrideBindings(baseRule, { npm: {
+	...baseRule.bindings.npm,
+	check(ctx, config) {
+		if (!isPublishable(ctx)) return { state: "na" };
+		const publishConfig = ctx.packageJson?.publishConfig;
+		if (!publishConfig || !Object.hasOwn(publishConfig, "provenance")) return baseRule.bindings.npm.check(ctx, config);
+		if (publishConfig.provenance === true) return { state: "ok" };
+		const file = CONFIG_FILES.packageJson;
+		return {
+			state: "violation",
+			file: file.path,
+			actual: publishConfig.provenance,
+			expected: true,
+			message: "Set publishConfig.provenance=true in package.json (and publish from CI) to attest releases.",
+			remediation: guardRemediationAvailability("npm", ctx.pmVersion, proposeChanges(ctx.readConfig(file), [{
+				file,
+				op: "setKey",
+				keyPath: ["publishConfig", "provenance"],
+				value: true
+			}]))
+		};
+	}
+} });
 //#endregion
-//#region src/domain/rules/publish-access.ts
+//#region src/core/rules/publish-access.ts
 const { packageJson } = CONFIG_FILES;
 const publishAccessBinding = {
 	check(ctx) {
@@ -2506,7 +1990,7 @@ const publishAccess = defineRule({
 	title: "Declare publish access explicitly"
 });
 //#endregion
-//#region src/domain/rules/store-server.ts
+//#region src/core/rules/store-server.ts
 const { pnpmWorkspace: pnpmWorkspace$1 } = CONFIG_FILES;
 const storeServer = defineRule({
 	bindings: { pnpm: {
@@ -2523,17 +2007,17 @@ const storeServer = defineRule({
 				state: "violation"
 			};
 		},
-		docs: "https://pnpm.io/settings#userunningStoreserver",
+		docs: "https://pnpm.io/settings/store#userunningstoreserver",
 		file: pnpmWorkspace$1
 	} },
 	description: "Flag use of an external store server process, which introduces a trust boundary where tampered packages could be served.",
-	docs: "https://pnpm.io/settings#userunningStoreserver",
+	docs: "https://pnpm.io/settings/store#userunningstoreserver",
 	id: "store-server",
 	severity: "info",
 	title: "Review store server usage"
 });
 //#endregion
-//#region src/domain/rules/strict-allow-scripts.ts
+//#region src/core/rules/strict-allow-scripts.ts
 const { npmrc } = CONFIG_FILES;
 const strictAllowScripts = defineRule({
 	bindings: { npm: {
@@ -2575,7 +2059,7 @@ const strictAllowScripts = defineRule({
 	title: "Require explicit script allow-listing"
 });
 //#endregion
-//#region src/domain/rules/strict-release-age.ts
+//#region src/core/rules/strict-release-age.ts
 const { aubeWorkspace: aubeWorkspace$2 } = CONFIG_FILES;
 const strictReleaseAge = withAubeParanoid(requireConfigKey({
 	bindings: { aube: {
@@ -2592,7 +2076,7 @@ const strictReleaseAge = withAubeParanoid(requireConfigKey({
 	title: "Enforce strict release age gate"
 }));
 //#endregion
-//#region src/domain/rules/strict-store-integrity.ts
+//#region src/core/rules/strict-store-integrity.ts
 const { aubeWorkspace: aubeWorkspace$1 } = CONFIG_FILES;
 const strictStoreIntegrity = defineRule({
 	bindings: { aube: {
@@ -2632,20 +2116,21 @@ const strictStoreIntegrity = defineRule({
 	title: "Require tarball integrity metadata"
 });
 //#endregion
-//#region src/domain/rules/trust-policy.ts
+//#region src/core/rules/trust-policy.ts
 const { aubeWorkspace, pnpmWorkspace } = CONFIG_FILES;
 const trustPolicy = withAubeParanoid(requireConfigKey({
 	bindings: {
 		aube: {
 			docs: "https://aube.jdx.dev/security.html",
 			documentedDefault: "no-downgrade",
+			defaultSafety: "unconditional",
 			file: aubeWorkspace,
 			keyPath: ["trustPolicy"],
 			message: "Set `trustPolicy: no-downgrade` in aube-workspace.yaml to block packages whose trust level has decreased.",
 			value: "no-downgrade"
 		},
 		pnpm: {
-			docs: "https://pnpm.io/settings#trustpolicy",
+			docs: "https://pnpm.io/settings/dependency-resolution#trustpolicy",
 			file: pnpmWorkspace,
 			keyPath: ["trustPolicy"],
 			message: "Set `trustPolicy: no-downgrade` in pnpm-workspace.yaml to block packages whose trust level has decreased.",
@@ -2654,15 +2139,15 @@ const trustPolicy = withAubeParanoid(requireConfigKey({
 		}
 	},
 	description: "Fail installation when a package trust level has decreased compared to previous releases, catching publisher credential downgrades.",
-	docs: "https://pnpm.io/settings#trustpolicy",
+	docs: "https://pnpm.io/settings/dependency-resolution#trustpolicy",
 	id: "trust-policy",
 	severity: "warn",
 	title: "Enforce trust policy on dependency updates"
 }));
 //#endregion
-//#region src/domain/rules/unsupported-settings.ts
-const bindingFor = (pm) => {
-	const settings = settingAvailability.filter((setting) => setting.pm === pm);
+//#region src/core/rules/unsupported-settings.ts
+const bindingFor = (pm, includesFile) => {
+	const settings = settingAvailability.filter((setting) => setting.pm === pm && includesFile(setting.file.path));
 	return { check(ctx) {
 		const version = ctx.pmVersion;
 		if (version === void 0) return { state: "na" };
@@ -2685,9 +2170,24 @@ const bindingFor = (pm) => {
 		} : { state: "ok" };
 	} };
 };
+const createUnsupportedSettings = (includesFile) => defineRule({
+	id: "unsupported-settings",
+	title: "Use settings available in the target PM version",
+	description: "Report configured settings whose recorded introduction version is newer than the declared or explicit stable PM target. Reports each affected file separately, grouping its unsupported keys. Findings retain their evaluation directory. Only the coverage table below is checked. Unknown targets and unlisted settings are not evaluated for availability.",
+	severity: "error",
+	docs: "https://github.com/pHo9UBenaA/siro/blob/main/docs/rules.md#unsupported-settings--error",
+	bindings: {
+		npm: bindingFor("npm", includesFile),
+		pnpm: bindingFor("pnpm", includesFile),
+		yarn: bindingFor("yarn", includesFile),
+		bun: bindingFor("bun", includesFile),
+		deno: bindingFor("deno", includesFile)
+	}
+});
+const unsupportedSettings = createUnsupportedSettings(() => true);
 //#endregion
-//#region src/domain/builtin-rules.ts
-const rules = [
+//#region src/core/rules/builtin-rules.ts
+const createBuiltinRules = (time) => [
 	advisoryCheck,
 	approvedGitRepos,
 	auditSuppression,
@@ -2703,7 +2203,7 @@ const rules = [
 	frozenLockfile,
 	frozenStore,
 	hardenedMode,
-	minimumReleaseAge,
+	createMinimumReleaseAge(time),
 	namedRegistries,
 	paranoidMode,
 	patchedDependencies,
@@ -2715,23 +2215,59 @@ const rules = [
 	strictReleaseAge,
 	strictStoreIntegrity,
 	trustPolicy,
-	defineRule({
-		id: "unsupported-settings",
-		title: "Use settings available in the target PM version",
-		description: "Report configured settings whose recorded introduction version is newer than the declared or explicit stable PM target. Reports each affected file separately, grouping its unsupported keys. Workspace findings retain their member directory. Only the coverage table below is checked. Unknown targets and unlisted settings are not evaluated for availability.",
-		severity: "error",
-		docs: "https://github.com/pHo9UBenaA/siro/blob/main/docs/rules.md#unsupported-settings--error",
-		bindings: {
-			npm: bindingFor("npm"),
-			pnpm: bindingFor("pnpm"),
-			yarn: bindingFor("yarn"),
-			bun: bindingFor("bun"),
-			deno: bindingFor("deno")
-		}
-	})
+	unsupportedSettings
 ];
+const builtinScope = {
+	"advisory-check": "installation",
+	"approved-git-repos": "installation",
+	"audit-suppression": "installation",
+	"block-auto-install": "installation",
+	"block-exotic-subdeps": "installation",
+	"bun-security-scanner": "installation",
+	"checksum-verification": "installation",
+	"commit-lockfile": "installation",
+	"dependency-overrides": "installation",
+	"disable-lifecycle-scripts": "installation",
+	"enforce-strict-ssl": "installation",
+	"files-field": "manifest",
+	"frozen-lockfile": "installation",
+	"frozen-store": "installation",
+	"hardened-mode": "installation",
+	"minimum-release-age": "installation",
+	"named-registries": "installation",
+	"paranoid-mode": "installation",
+	"patched-dependencies": "installation",
+	"pin-exact-versions": "installation",
+	provenance: "installation",
+	"publish-access": "manifest",
+	"store-server": "installation",
+	"strict-allow-scripts": "installation",
+	"strict-release-age": "installation",
+	"strict-store-integrity": "installation",
+	"trust-policy": "installation",
+	"unsupported-settings": "split"
+};
+const scopeOf = (id) => Object.hasOwn(builtinScope, id) ? builtinScope[id] : "custom";
+//#endregion
+//#region src/adapters/exclusions.ts
+const compileExclusions = (patterns) => {
+	try {
+		const matchers = patterns.map((pattern) => new Minimatch(pattern.replace(/(?:\/\*\*)+$/u, "").replace(/[\\[\]]/gu, "\\$&"), {
+			dot: true,
+			nocase: false,
+			nonegate: true,
+			nocomment: true,
+			nobrace: true,
+			noext: true,
+			platform: "linux"
+		}));
+		return (directory) => matchers.some((matcher) => matcher.match(directory));
+	} catch (error) {
+		throw new ConfigError(`exclude: ${error instanceof Error ? error.message : String(error)}`);
+	}
+};
 //#endregion
-//#region src/domain/services/apply-config.ts
+//#region src/core/apply-config.ts
 /** Select active rules and keep user severity choices as explicit runtime data. */
 const applyConfig = (base, config) => {
 	const merged = [...base, ...config?.customRules ?? []];
@@ -2759,7 +2295,7 @@ const applyConfig = (base, config) => {
 	};
 };
 //#endregion
-//#region src/domain/services/detect-pms.ts
+//#region src/core/detect-pms.ts
 const registerSignals = (signals, pm, owner) => {
 	for (const file of signals) {
 		const prior = owner.get(file);
@@ -2791,24 +2327,25 @@ const detectPMs = (ctx) => {
 	return PMS.filter((pm) => found.has(pm));
 };
 //#endregion
-//#region src/domain/services/resolve-pms.ts
+//#region src/core/resolve-pms.ts
 /** Apply the explicit selection or detection, then the configured allow-list. */
 const resolvePMs = (ctx, opts) => {
 	const { pmOverride, allowed } = opts;
 	const detected = pmOverride ? [pmOverride] : detectPMs(ctx);
 	const pms = allowed ? detected.filter((pm) => allowed.includes(pm)) : detected;
 	if (pms.length > 0) return pms;
+	if (opts.optional && detected.length === 0) return [];
 	if (!allowed) throw new UsageError(`No package manager detected. Pass --pm <${PMS.join("|")}> to be explicit.`);
 	if (pmOverride) throw new UsageError(`--pm ${pmOverride} is not in siro.config.ts pms (${allowed.join(", ")}). Adjust the config or the flag.`);
 	if (detected.length > 0) throw new UsageError(`Detected PMs (${detected.join(", ")}) do not match siro.config.ts pms (${allowed.join(", ")}). Adjust the config or remove the restriction.`);
 	throw new UsageError(`No package manager detected, and siro.config.ts restricts pms to ${allowed.join(", ")}. Adjust the config or remove the restriction.`);
 };
 //#endregion
-//#region src/domain/services/decide-severity.ts
+//#region src/core/decide-severity.ts
 /** Resolve the most specific severity signal for one finding. */
 const decideSeverity = (status, binding, rule, userOverride) => userOverride ?? status.severity ?? binding.severity ?? rule.severity;
 //#endregion
-//#region src/domain/services/render-version-note.ts
+//#region src/core/render-version-note.ts
 const buildVersionNoteParts = (versionNote) => {
 	const parts = [];
 	if (typeof versionNote.configAvailableSince !== "undefined") parts.push(`available since ${versionNote.configAvailableSince}`);
@@ -2823,151 +2360,704 @@ const renderVersionNoteMessage = (message, versionNote) => {
 	return `${message} (${parts.join("; ")})`;
 };
 //#endregion
-//#region src/application/run-lint.ts
+//#region src/core/evaluate-binding.ts
+/** One response boundary for generic and PM-specific checks. Selection stays with callers. */
+const evaluateBinding = (repository, rule, binding, overrides, target) => {
+	const response = binding.check({
+		...repository.ctx,
+		readConfig: repository.parseConfig,
+		pmVersion: target?.version
+	}, repository.parseConfig(binding.file));
+	assertSynchronous(response, `Rule '${rule.id}' check`);
+	if (!isCheckStatusShape(response)) throw new ConfigError(`Rule '${rule.id}' returned an invalid check result.`);
+	return (response.state === "violations" ? response.violations : [response]).flatMap((status) => status.state !== "violation" ? [] : [{
+		ruleId: rule.id,
+		directory: ".",
+		...target ? { pm: target.pm } : {},
+		severity: decideSeverity(status, binding, rule, overrides?.get(rule.id)),
+		message: renderVersionNoteMessage(status.message, binding.versionNote),
+		file: status.file ?? binding.file?.path,
+		docs: binding.docs ?? rule.docs,
+		actual: status.actual,
+		expected: status.expected,
+		remediation: target ? guardRemediationAvailability(target.pm, target.version, status.remediation) : status.remediation
+	}]);
+};
+//#endregion
+//#region src/core/run-lint.ts
 const resolveBindingProjectType = (ctx, pm, parseConfig) => {
 	if (ctx.projectType !== void 0) return ctx.projectType;
-	if (pm === "deno") return resolveDenoProjectType(ctx, parseConfig(CONFIG_FILES.denoJson));
-	return resolvePackageJsonProjectType(ctx);
+	return pm === "deno" ? resolveDenoProjectType(ctx, parseConfig(CONFIG_FILES.denoJson)) : resolvePackageJsonProjectType(ctx);
 };
-/** Evaluate every applicable rule binding and collect violations. */
+/** Select applicable PM bindings; response handling is shared with manifest checks. */
 const runLint = (opts) => {
-	const { ctx, pms, ruleSet, severityOverrides, codecFor } = opts;
+	const { repository, pms, ruleSet, severityOverrides } = opts;
 	const findings = [];
+	for (const rule of ruleSet) for (const pm of pms) {
+		const binding = rule.bindings[pm];
+		if (!binding || rule.projectTypes && !rule.projectTypes.includes(resolveBindingProjectType(repository.ctx, pm, repository.parseConfig))) continue;
+		findings.push(...evaluateBinding(repository, rule, binding, severityOverrides, {
+			pm,
+			version: opts.pmVersions?.[pm]
+		}));
+	}
 	const summary = {
 		error: 0,
 		info: 0,
 		warn: 0
 	};
-	const parseConfig = createConfigParser(codecFor, ctx);
-	for (const rule of ruleSet) for (const pm of pms) {
-		const binding = rule.bindings[pm];
-		if (!binding || rule.projectTypes && !rule.projectTypes.includes(resolveBindingProjectType(ctx, pm, parseConfig))) continue;
-		const ruleContext = {
-			...ctx,
-			readConfig: parseConfig,
-			pmVersion: opts.pmVersions?.[pm]
-		};
-		const response = binding.check(ruleContext, parseConfig(binding.file));
-		if (!isCheckStatusShape(response)) throw new ConfigError(`Rule '${rule.id}' returned an invalid check result.`);
-		const statuses = response.state === "violations" ? response.violations : [response];
-		for (const status of statuses) {
-			if (status.state !== "violation") continue;
-			const finding = {
-				ruleId: rule.id,
-				pm,
-				severity: decideSeverity(status, binding, rule, severityOverrides?.get(rule.id)),
-				message: renderVersionNoteMessage(status.message, binding.versionNote),
-				file: status.file ?? binding.file?.path,
-				docs: binding.docs ?? rule.docs,
-				actual: status.actual,
-				expected: status.expected,
-				remediation: guardRemediationAvailability(pm, ruleContext.pmVersion, status.remediation)
-			};
-			findings.push(finding);
-			summary[finding.severity] += 1;
-		}
-	}
+	for (const finding of findings) summary[finding.severity] += 1;
 	return {
 		findings,
 		summary
 	};
 };
 //#endregion
-//#region src/application/lint.ts
-/** Evaluate a repository without reporting or executing configuration files. */
-const prepareLint = (options) => {
-	if (!options || !isAbsPath(options.cwd)) throw new UsageError("cwd must be an absolute filesystem path.");
+//#region src/core/contracts/deno-json.ts
+/** Validate consumed publication metadata, not Deno's entire versioned schema. */
+const validateDenoMetadata = (config) => {
+	const name = getByPath(config, ["name"]);
+	if (name != null && typeof name !== "string") throw new ConfigError("deno.json: name must be a string or null.");
+	const publish = getByPath(config, ["publish"]);
+	if (publish == null || typeof publish === "boolean") return;
+	if (!isPlainRecord(publish)) throw new ConfigError("deno.json: publish must be a boolean, object or null.");
+	const include = getByPath(publish, ["include"]);
+	if (include != null && (!Array.isArray(include) || !Array.from(include).every((item) => typeof item === "string"))) throw new ConfigError("deno.json: publish.include must be a string array or null.");
+};
+//#endregion
+//#region src/core/parse-config-file.ts
+const EMPTY_FILE = Object.freeze({});
+/** Create a lazy parser for one repository context; callers own its lifetime. */
+const createConfigParser = (codecFor, ctx) => {
+	const cache = /* @__PURE__ */ new Map();
+	return (file) => {
+		if (file === void 0) return EMPTY_FILE;
+		const cacheKey = `${file.kind}:${file.path}`;
+		const cached = cache.get(cacheKey);
+		if (cached !== void 0) return cached;
+		const text = ctx.readText(file.path);
+		if (text === void 0) {
+			cache.set(cacheKey, EMPTY_FILE);
+			return EMPTY_FILE;
+		}
+		const parsed = wrapCodecError(file.path, () => codecFor(file.kind).parse(text));
+		cache.set(cacheKey, parsed);
+		return parsed;
+	};
+};
+/** Pair the context with a fresh lazy parser; construction performs no reads. */
+const createRepositoryEvaluation = (ctx, codecFor) => ({
+	ctx,
+	parseConfig: createConfigParser(codecFor, ctx)
+});
+//#endregion
+//#region src/core/discovery.ts
+/** One context per selected directory, shared by publication and installation passes. */
+const discover = (cwd, fs, excluded, projectType, dependencies) => {
+	if (typeof fs.readDirectories !== "function") throw new ConfigError("FileSystem.readDirectories is required for package discovery; no native filesystem fallback is used.");
+	const { paths, createRepoContext, codecFor } = dependencies;
+	const pending = [asRelPath(".")];
+	const directories = [];
+	while (pending.length) {
+		const directory = pending.pop();
+		const absolute = paths.resolve(cwd, directory);
+		let repository;
+		const manifests = [];
+		try {
+			repository = createRepositoryEvaluation(createRepoContext(absolute, fs, projectType), codecFor);
+			const { ctx, parseConfig } = repository;
+			if (ctx.packageJson !== void 0) manifests.push("package.json");
+			if (ctx.readText(CONFIG_FILES.denoJson.path) !== void 0) {
+				validateDenoMetadata(parseConfig(CONFIG_FILES.denoJson));
+				manifests.push("deno.json");
+			} else if (ctx.exists(asRelPath("deno.jsonc"))) throw new ConfigError("deno.jsonc is not supported; use strict deno.json.");
+		} catch (error) {
+			if (error instanceof ConfigError && directory !== ".") throw new ConfigError(`${directory}/${error.message}`);
+			throw error;
+		}
+		directories.push({
+			directory,
+			repository,
+			manifests
+		});
+		const names = fs.readDirectories(absolute);
+		if (!Array.isArray(names)) throw new ConfigError(`${directory}: FileSystem.readDirectories must return a dense array.`);
+		const children = /* @__PURE__ */ new Set();
+		for (let i = 0; i < names.length; i += 1) {
+			if (!Object.hasOwn(names, i)) throw new ConfigError(`${directory}: FileSystem.readDirectories must return a dense array.`);
+			const child = paths.child(directory, names[i]);
+			if (names[i] === ".git" || names[i] === "node_modules" || excluded(child) || children.has(child)) continue;
+			children.add(child);
+			pending.push(child);
+		}
+	}
+	return directories.sort((a, b) => a.directory < b.directory ? -1 : a.directory > b.directory ? 1 : 0);
+};
+//#endregion
+//#region src/core/manifest-checks.ts
+const manifestProjectType = (repository, file) => file === "deno.json" ? resolveDenoProjectType(repository.ctx, repository.parseConfig(CONFIG_FILES.denoJson)) : resolvePackageJsonProjectType(repository.ctx);
+const selectBinding = {
+	"files-field": (file) => file === "deno.json" ? denoPublishBinding : packageJsonFilesBinding,
+	"publish-access": (file, repository, targets) => {
+		if (file !== "package.json") return void 0;
+		return repository.ctx.packageJson?.publishConfig?.access === "private" && targets.length > 0 ? "pm" : publishAccessBinding;
+	}
+};
+const checkManifest = (repository, file, targets, rules, overrides) => {
+	const findings = [];
+	const projectType = manifestProjectType(repository, file);
+	const pms = targets.map((target) => target.pm);
+	const pmVersions = Object.fromEntries(targets.map((target) => [target.pm, target.version]));
+	for (const rule of rules) {
+		if (rule.projectTypes && !rule.projectTypes.includes(projectType)) continue;
+		if (rule.id === "unsupported-settings") findings.push(...runLint({
+			repository,
+			pms,
+			pmVersions,
+			ruleSet: [{
+				...rule,
+				bindings: createUnsupportedSettings((path) => path === file).bindings
+			}],
+			severityOverrides: overrides
+		}).findings);
+		else if (Object.hasOwn(selectBinding, rule.id)) {
+			const binding = selectBinding[rule.id](file, repository, targets);
+			if (binding === "pm") findings.push(...runLint({
+				repository,
+				pms,
+				pmVersions,
+				ruleSet: [rule],
+				severityOverrides: overrides
+			}).findings);
+			else if (binding) findings.push(...evaluateBinding(repository, rule, binding, overrides));
+		}
+	}
+	return findings;
+};
+//#endregion
+//#region src/core/rebase-finding.ts
+/** Context-local rule output becomes cwd-relative once, without mutating rule-owned data. */
+const rebaseFinding = (directory, finding) => {
+	if (directory === ".") return {
+		...finding,
+		directory
+	};
+	const remediation = finding.remediation;
+	const rebaseOperation = (operation) => ({
+		...operation,
+		file: {
+			...operation.file,
+			path: `${directory}/${operation.file.path}`
+		}
+	});
+	return {
+		...finding,
+		directory,
+		...finding.file === void 0 ? {} : { file: `${directory}/${finding.file}` },
+		remediation: remediation?.kind === "automatic" ? {
+			...remediation,
+			operations: [rebaseOperation(remediation.operations[0]), ...remediation.operations.slice(1).map(rebaseOperation)]
+		} : remediation?.kind === "manual" ? {
+			...remediation,
+			steps: [`Work in ${directory} for this finding.`, ...remediation.steps]
+		} : remediation
+	};
+};
+//#endregion
+//#region src/core/lint.ts
+const validateLintOptions = (options, paths) => {
+	if (!options || !paths.isAbsolute(options.cwd)) throw new UsageError("cwd must be an absolute filesystem path.");
+	if ("workspaces" in options) throw new UsageError("workspaces was removed in 0.6.0. Package discovery is recursive by default; use exclude and installationRoots to specify scope.");
 	if ("customRules" in options || "reporters" in options) throw new UsageError("Pass customRules and reporters inside the config option.");
 	if (options.pm !== void 0 && !isPM(options.pm)) throw new UsageError(`Unknown package manager: ${String(options.pm)}`);
 	if (options.projectType !== void 0 && !isProjectType(options.projectType)) throw new UsageError(`Unknown project type: ${String(options.projectType)}`);
 	if (options.pmVersion !== void 0 && (!options.pm || !isStableVersion(options.pmVersion))) throw new UsageError("pmVersion / --pm-version requires pm / --pm and an exact stable version such as 10.16.0.");
-	if (options.workspaces !== void 0 && typeof options.workspaces !== "boolean") throw new UsageError("workspaces must be a boolean.");
+};
+/** Validate inputs and prepare shared contexts, without running rules or child executable configs. */
+const prepareLint = (options, dependencies) => {
+	validateLintOptions(options, dependencies.paths);
 	const config = options.config === void 0 ? void 0 : parseConfig(options.config);
-	const ctx = createRepoContext(options.cwd, options.fs, options.projectType ?? config?.projectType);
-	const pms = resolvePMs(ctx, {
-		allowed: config?.pms,
-		pmOverride: options.pm
-	});
-	if (pms.includes("deno") && !ctx.exists(asRelPath("deno.json")) && ctx.exists(asRelPath("deno.jsonc"))) throw new ConfigError("deno.jsonc is not supported. siro currently reads strict JSON from deno.json only.");
-	const configured = applyConfig(rules, config);
-	const pmVersions = {
-		...declaredPMVersion(ctx.packageJson?.packageManager),
-		...config?.pmVersions,
-		...options.pm && options.pmVersion ? { [options.pm]: options.pmVersion } : {}
-	};
-	const fs = options.fs ?? nodeFileSystem;
+	const fs = options.fs === void 0 ? dependencies.fileSystem : options.fs;
+	const excluded = dependencies.compileExclusions(parseExcludes(options.exclude !== void 0 ? options.exclude : config?.exclude ?? []));
+	const installations = parseInstallationRoots(options.installationRoots !== void 0 ? options.installationRoots : config?.installationRoots ?? ["."]);
+	const configured = applyConfig(dependencies.rules, config);
+	const needsCustomTarget = configured.rules.some((rule) => scopeOf(rule.id) === "custom");
+	const discovered = discover(options.cwd, fs, excluded, options.projectType ?? config?.projectType, dependencies);
+	for (const entry of installations) if (!discovered.some((item) => item.directory === entry.path)) throw new UsageError(`${entry.path}: installation root must be an existing, selected ordinary directory using its exact enumerated spelling (no symlinks, excluded or hard-skipped paths).`);
 	return {
-		ctx,
-		pms,
-		pmVersions,
-		members: options.workspaces ? collectWorkspaceMembers(ctx, fs, pms, options.projectType ?? config?.projectType) : [],
-		ruleSet: configured.rules,
-		severityOverrides: configured.severityOverrides,
-		codecFor,
+		evaluation: {
+			directories: discovered.map((item) => {
+				const { ctx } = item.repository;
+				const entry = installations.find((root) => root.path === item.directory);
+				let pms;
+				let versions = declaredPMVersion(ctx.packageJson?.packageManager);
+				if (item.directory === ".") {
+					pms = resolvePMs(ctx, {
+						allowed: config?.pms,
+						pmOverride: options.pm,
+						optional: !entry && !needsCustomTarget
+					});
+					versions = {
+						...versions,
+						...config?.pmVersions,
+						...options.pm && options.pmVersion ? { [options.pm]: options.pmVersion } : {}
+					};
+				} else if (entry) {
+					try {
+						pms = resolvePMs(ctx, { pmOverride: entry.pm });
+					} catch (error) {
+						if (error instanceof UsageError) throw new UsageError(`${item.directory}: ${error.message}`);
+						throw error;
+					}
+					if (entry.pm && entry.pmVersion) versions = {
+						...versions,
+						[entry.pm]: entry.pmVersion
+					};
+				} else {
+					const declared = ctx.packageJson?.packageManager === void 0 ? void 0 : parsePackageManagerField(ctx.packageJson.packageManager);
+					pms = PMS.filter((pm) => pm === declared || pm === "deno" && item.manifests.includes("deno.json"));
+				}
+				return {
+					...item,
+					installation: entry !== void 0,
+					targets: pms.map((pm) => ({
+						pm,
+						...versions[pm] === void 0 ? {} : { version: versions[pm] }
+					}))
+				};
+			}),
+			ruleSet: configured.rules,
+			severityOverrides: configured.severityOverrides
+		},
 		reporters: config?.reporters ?? []
 	};
 };
-/** Reuse the existing manifest checks; installation policy remains rooted at cwd. */
-const runPreparedLint = (prepared) => {
-	const result = runLint(prepared);
-	const findings = [...result.findings];
-	const summary = { ...result.summary };
-	const memberRules = prepared.ruleSet.filter((rule) => [
-		"files-field",
-		"publish-access",
-		"unsupported-settings"
-	].includes(rule.id));
-	for (const member of prepared.members) {
-		const child = runLint({
-			...prepared,
-			ctx: member.ctx,
-			pms: [member.pm],
-			ruleSet: memberRules
+const runPreparedLint = (evaluation) => {
+	const { directories, ruleSet, severityOverrides } = evaluation;
+	const findings = [];
+	const manifests = [];
+	const installationRoots = [];
+	const ruleOrder = new Map(ruleSet.map((rule, index) => [rule.id, index]));
+	for (const item of directories) {
+		const { directory, repository, targets, installation } = item;
+		const local = [];
+		for (const file of item.manifests) {
+			const manifestTargets = targets.filter(({ pm }) => file === "deno.json" ? pm === "deno" : pm !== "deno");
+			manifests.push({
+				path: directory === "." ? file : `${directory}/${file}`,
+				projectType: manifestProjectType(repository, file),
+				targets: manifestTargets
+			});
+			local.push(...checkManifest(repository, file, manifestTargets, ruleSet, severityOverrides));
+		}
+		if (installation) installationRoots.push({
+			directory,
+			targets
 		});
-		for (const finding of child.findings) findings.push({
-			...finding,
-			file: `${member.directory}/${finding.file ?? "package.json"}`,
-			message: `${member.directory}: ${finding.message}`,
-			remediation: finding.remediation?.kind === "manual" ? {
-				kind: "manual",
-				steps: [`Work in ${member.directory} for this finding.`, ...finding.remediation.steps]
-			} : finding.remediation
+		const scopedRules = ruleSet.flatMap((rule) => {
+			const scope = scopeOf(rule.id);
+			if (scope === "installation" && installation || scope === "custom" && directory === ".") return [rule];
+			if (scope === "split" && installation) return [{
+				...rule,
+				bindings: createUnsupportedSettings((file) => file !== "package.json" && file !== "deno.json").bindings
+			}];
+			return [];
 		});
-		for (const level of [
-			"error",
-			"warn",
-			"info"
-		]) summary[level] += child.summary[level];
+		try {
+			local.push(...runLint({
+				repository,
+				pms: targets.map(({ pm }) => pm),
+				pmVersions: Object.fromEntries(targets.map(({ pm, version }) => [pm, version])),
+				ruleSet: scopedRules,
+				severityOverrides
+			}).findings);
+		} catch (error) {
+			if (error instanceof ConfigError && directory !== ".") throw new ConfigError(`${directory}/${error.message}`);
+			throw error;
+		}
+		local.sort((a, b) => (ruleOrder.get(a.ruleId) ?? 0) - (ruleOrder.get(b.ruleId) ?? 0));
+		findings.push(...local.map((finding) => rebaseFinding(directory, finding)));
+	}
+	const summary = {
+		error: 0,
+		warn: 0,
+		info: 0
+	};
+	for (const finding of findings) summary[finding.severity] += 1;
+	return {
+		findings,
+		summary,
+		inspection: {
+			manifests,
+			installationRoots
+		}
+	};
+};
+const lint$1 = (options, dependencies) => runPreparedLint(prepareLint(options, dependencies).evaluation);
+//#endregion
+//#region src/core/filter.ts
+const EXIT_SUCCESS = 0;
+const EXIT_FAILURE = 1;
+const meetsThreshold = (severity, threshold) => SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
+/** Keep only findings at or above `threshold`, recomputing the summary. */
+const filterBySeverity = (result, threshold) => {
+	const findings = [];
+	const summary = {
+		error: 0,
+		info: 0,
+		warn: 0
+	};
+	for (const finding of result.findings) if (meetsThreshold(finding.severity, threshold)) {
+		findings.push(finding);
+		summary[finding.severity] += 1;
 	}
 	return {
+		...result,
 		findings,
 		summary
 	};
 };
-const lint = (options) => runPreparedLint(prepareLint(options));
+/**
+* Exit code for a lint run. Non-zero when any finding meets `threshold`
+* (default: only `error` fails the run).
+*/
+const exitCodeForLint = (result, threshold = "error") => {
+	if (result.findings.some((finding) => meetsThreshold(finding.severity, threshold))) return EXIT_FAILURE;
+	return EXIT_SUCCESS;
+};
 //#endregion
-//#region src/application/commands/lint.ts
+//#region src/core/lint-command.ts
 /** Evaluate and report. Executable config loading belongs to the CLI adapter. */
-const lintCommand = async (options, io) => {
+const lintCommand$1 = async (options, io, dependencies, reporters) => {
 	if (!options) throw new UsageError("Lint options are required.");
 	if (options.severity !== void 0 && !isSeverity(options.severity)) throw new UsageError(`Invalid severity: ${String(options.severity)}`);
-	const prepared = prepareLint(options);
-	const registry = createRegistry(prepared.reporters);
-	const selection = options.reporter ?? DEFAULT_REPORTER_NAME;
+	const prepared = prepareLint(options, dependencies);
+	const registry = reporters.createRegistry(prepared.reporters);
+	const selection = options.reporter ?? reporters.defaultName;
 	const reporter = typeof selection === "string" ? registry.get(selection) : selection;
 	if (!isReporterShape(reporter)) throw new UsageError(`${typeof selection === "string" ? "Unknown" : "Invalid"} reporter: ${String(selection)} (available: ${[...registry.keys()].join(", ")})`);
-	const result = runPreparedLint(prepared);
+	const result = runPreparedLint(prepared.evaluation);
 	const exitCode = exitCodeForLint(result, options.severity ?? "error");
-	await reporter.format(filterBySeverity(result, options.severity ?? "info"), io);
+	const writes = [];
+	let outputFailed = false;
+	let outputFailure;
+	const recordFailure = (error) => {
+		if (!outputFailed) {
+			outputFailed = true;
+			outputFailure = error;
+		}
+	};
+	const track = (write) => (line) => {
+		try {
+			const written = write(line);
+			writes.push(Promise.resolve(written).then(() => {}, recordFailure));
+			return written;
+		} catch (error) {
+			recordFailure(error);
+			throw error;
+		}
+	};
+	try {
+		await reporter.format(filterBySeverity(result, options.severity ?? "info"), {
+			stdout: track((line) => io.stdout(line)),
+			stderr: track((line) => io.stderr(line))
+		}, { cwd: options.cwd });
+	} finally {
+		await Promise.all(writes);
+	}
+	if (outputFailed) throw outputFailure;
 	return exitCode;
 };
 //#endregion
+//#region src/core/contracts/package-json.ts
+const PackageJsonSchema = vb.looseObject({
+	files: vb.optional(vb.array(vb.string())),
+	name: vb.optional(vb.string()),
+	packageManager: vb.optional(vb.string()),
+	private: vb.optional(vb.boolean()),
+	publishConfig: vb.optional(vb.looseObject({
+		access: vb.optional(vb.picklist([
+			"public",
+			"restricted",
+			"private"
+		])),
+		provenance: vb.optional(vb.boolean())
+	})),
+	trustedDependencies: vb.optional(vb.array(vb.string()))
+});
+const parsePackageJson = (value) => {
+	if (!isPlainRecord(value)) throw new ConfigError("package.json: expected an object at the root.");
+	const result = vb.safeParse(PackageJsonSchema, value);
+	if (result.success) return result.output;
+	const issue = result.issues[0];
+	const field = vb.getDotPath(issue);
+	throw new ConfigError(`package.json: ${field ? `${field}: ` : ""}${issue.message}`);
+};
+//#endregion
+//#region src/adapters/repo-context.ts
+const tryParseJson = (text) => {
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		let errMsg = String(error);
+		if (error instanceof Error) errMsg = error.message;
+		throw new ConfigError(`package.json: invalid JSON — ${errMsg}`);
+	}
+};
+const readPackageJson = (raw) => {
+	return parsePackageJson(tryParseJson(raw.trim()));
+};
+const createRepoContext = (root, fs = nodeFileSystem, projectType) => {
+	if (fs === nodeFileSystem) assertDirectory(root);
+	const packageFile = resolveIn(root, asRelPath("package.json"));
+	const raw = fs.readText(packageFile);
+	const texts = new Map([[packageFile, raw]]);
+	const readText = (relPath) => {
+		const file = resolveIn(root, relPath);
+		if (!texts.has(file)) texts.set(file, fs.readText(file));
+		return texts.get(file);
+	};
+	const exists = (relPath) => fs.exists(resolveIn(root, relPath));
+	let packageJson = void 0;
+	if (typeof raw !== "undefined") packageJson = readPackageJson(raw);
+	return {
+		exists,
+		packageJson,
+		projectType,
+		readText,
+		root
+	};
+};
+//#endregion
+//#region src/adapters/codecs/ini.ts
+const INTEGER_PATTERN = /^-?\d+$/u;
+const coerceBoolean = (str) => {
+	if (str === "true") return true;
+	if (str === "false") return false;
+};
+const coerceInteger = (str) => {
+	if (INTEGER_PATTERN.test(str)) return Number(str);
+};
+const coerce = (raw) => {
+	if (typeof raw !== "string") return raw;
+	return coerceBoolean(raw) ?? coerceInteger(raw) ?? raw;
+};
+//#endregion
+//#region src/adapters/codecs/store.ts
+const CODECS = {
+	json: { parse(text) {
+		const trimmed = text.trim();
+		return toParsedConfig(JSON.parse(trimmed));
+	} },
+	npmrc: { parse(text) {
+		const raw = toParsedConfig(ini.parse(text));
+		const config = {};
+		for (const [key, value] of Object.entries(raw)) if (Array.isArray(value)) config[key] = value.map((elem) => coerce(elem));
+		else if (typeof value === "object" && value !== null) config[key] = toParsedConfig(value);
+		else config[key] = coerce(value);
+		return config;
+	} },
+	toml: { parse(text) {
+		if (text.trim() === "") return {};
+		return toParsedConfig(parse$1(text.startsWith("") ? text.slice(1) : text));
+	} },
+	yaml: { parse(text) {
+		if (text.trim() === "") return {};
+		const document = parseDocument(text);
+		if (document.errors.length > 0) throw document.errors[0];
+		if (document.contents === null) return {};
+		return toParsedConfig(document.toJS({ onAnchor: (value, count) => {
+			if (count > 1) JSON.stringify(value);
+		} }));
+	} }
+};
+/** Look up the codec for a parseable kind. Total — every CodecKind has one. */
+const codecFor = (kind) => CODECS[kind];
+//#endregion
+//#region src/adapters/reporters/github.ts
+const COMMAND = {
+	error: "error",
+	info: "notice",
+	warn: "warning"
+};
+const escapeData = (raw) => raw.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+const escapeProp = (raw) => escapeData(raw).replaceAll(":", "%3A").replaceAll(",", "%2C");
+/** Emit GitHub Actions workflow commands (annotations on PRs). */
+const githubReporter = {
+	async format(result, io, context) {
+		for (const finding of result.findings) {
+			let file = "";
+			if (finding.file) file = `file=${escapeProp(path.resolve(context.cwd, finding.file))},`;
+			let body = `[${finding.pm ?? "package"}] ${finding.directory}: ${finding.message}`;
+			if (finding.docs) body += ` (${finding.docs})`;
+			await io.stdout(`::${COMMAND[finding.severity]} ${file}title=${escapeProp(finding.ruleId)}::${escapeData(body)}`);
+		}
+	},
+	name: "github"
+};
+//#endregion
+//#region src/adapters/safe-text.ts
+/** Visible escaping for untrusted human-facing text; never rewrite API/native paths. */
+const safeText = (text) => text.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/gu, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`).replaceAll("##[", "#\\u0023[").replace(/^(\s*)::/u, "$1\\u003a:");
+/** JSON syntax and decoded values stay identical; CI must not parse legacy commands in it. */
+const safeJsonText = (json) => json.replace(/[\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/gu, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`).replaceAll("##[", "\\u0023\\u0023[");
+//#endregion
+//#region src/adapters/reporters/json.ts
+/**
+* Versioned machine-readable output — the public contract consumed by
+* external fixers (see docs/json-output.md). Bump `schemaVersion` on any
+* breaking shape change and update that doc in the same commit.
+*/
+const SCHEMA_VERSION = 3;
+const jsonReporter = {
+	async format(result, io) {
+		await io.stdout(safeJsonText(JSON.stringify({
+			schemaVersion: SCHEMA_VERSION,
+			siroVersion: version,
+			findings: result.findings,
+			summary: result.summary,
+			inspection: result.inspection
+		}, void 0, 2)));
+	},
+	name: "json"
+};
+//#endregion
+//#region src/adapters/reporters/pretty.ts
+const GLYPH = {
+	error: "✖ error",
+	info: "ℹ info",
+	warn: "⚠ warn"
+};
+/**
+* Decide colour at call time, not at import time.
+*
+* picocolors snapshots `isColorSupported` when imported, so a later
+* `process.env.NO_COLOR = '1'` (or a different stdout) is ignored. The
+* reporter is invoked per `siro lint` run from many contexts (TTY, CI
+* with FORCE_COLOR, redirected output, …) — checking each call is the
+* only way NO_COLOR can truly win, as https://no-color.org/ requires.
+*/
+const colorSupportedNow = () => {
+	const { env } = process;
+	if (typeof env.NO_COLOR !== "undefined" && env.NO_COLOR !== "") return false;
+	if ("FORCE_COLOR" in env) return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "";
+	return pc.isColorSupported;
+};
+const renderFinding = (finding, ctx) => {
+	const where = ctx.colors.dim(` (${safeText(finding.file ?? finding.directory)})`);
+	ctx.io.stdout(`${ctx.tag[finding.severity](GLYPH[finding.severity])}  [${finding.pm ?? "package"}] ${ctx.colors.bold(safeText(finding.ruleId))}${where}`);
+	ctx.io.stdout(`    ${safeText(finding.message)}`);
+	for (const step of finding.remediation?.kind === "manual" ? finding.remediation.steps : []) ctx.io.stdout(`    ↳ ${safeText(step)}`);
+	if (finding.docs) ctx.io.stdout(ctx.colors.dim(`    → ${safeText(finding.docs)}`));
+};
+const buildRenderCtx = (io) => {
+	const colors = pc.createColors(colorSupportedNow());
+	return {
+		colors,
+		io,
+		tag: {
+			error: colors.red,
+			info: colors.cyan,
+			warn: colors.yellow
+		}
+	};
+};
+const prettyReporter = {
+	async format(result, io) {
+		const lines = [];
+		const collect = (line) => {
+			lines.push(line);
+		};
+		const ctx = buildRenderCtx({
+			stdout: collect,
+			stderr: collect
+		});
+		collect(`Inspection: ${result.inspection.manifests.length} manifests; installation roots: ${result.inspection.installationRoots.map((root) => safeText(root.directory)).join(", ") || "none"}.`);
+		collect("Unknown PM/version targets have no availability assessment; installation scope is explicit.");
+		if (result.findings.length === 0) collect(ctx.colors.green("✔ No security best-practice issues found."));
+		else {
+			for (const finding of result.findings) renderFinding(finding, ctx);
+			const { error, warn, info } = result.summary;
+			collect("");
+			collect(`Summary: ${error} error, ${warn} warn, ${info} info`);
+		}
+		await io.stdout(lines.join("\n"));
+	},
+	name: "pretty"
+};
+//#endregion
+//#region src/adapters/reporters/registry.ts
+const BUILTINS = [
+	prettyReporter,
+	jsonReporter,
+	githubReporter
+];
+const DEFAULT_REPORTER_NAME = prettyReporter.name;
+const JSON_REPORTER_NAME = jsonReporter.name;
+/** Names of every built-in reporter, in stable display order. */
+const BUILTIN_REPORTER_NAMES = BUILTINS.map((rep) => rep.name);
+/** Later registrations replace earlier reporters with the same name. */
+const createRegistry = (extras = []) => new Map([...BUILTINS, ...extras].map((reporter) => [reporter.name, reporter]));
+const dependencies = {
+	rules: createBuiltinRules({
+		now: () => Date.now(),
+		parse: (value) => Date.parse(value)
+	}),
+	fileSystem: nodeFileSystem,
+	paths: nodePaths,
+	createRepoContext,
+	codecFor,
+	compileExclusions
+};
+/** Public Node API: callers can replace the filesystem without assembling the application. */
+const lint = (options) => lint$1(options, dependencies);
+const lintCommand = (options, io) => lintCommand$1(options, io, dependencies, {
+	defaultName: DEFAULT_REPORTER_NAME,
+	createRegistry
+});
+//#endregion
 //#region src/adapters/node-io.ts
-const nodeIO = {
-	stderr: (line) => process.stderr.write(`${line}\n`),
-	stdout: (line) => process.stdout.write(`${line}\n`)
+const writer = (stream) => {
+	let failure;
+	const pending = /* @__PURE__ */ new Set();
+	const fail = (cause) => {
+		failure ??= new Error(`Output failed: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		for (const reject of pending) reject(failure);
+		pending.clear();
+		return failure;
+	};
+	let observing = false;
+	return (line) => {
+		if (!observing) {
+			observing = true;
+			stream.on("error", fail);
+			stream.on("close", () => fail(/* @__PURE__ */ new Error("Output stream closed.")));
+		}
+		return new Promise((resolve, reject) => {
+			if (failure || stream.destroyed) {
+				reject(failure ?? fail(/* @__PURE__ */ new Error("Output stream is destroyed.")));
+				return;
+			}
+			pending.add(reject);
+			try {
+				stream.write(`${line}\n`, (error) => {
+					pending.delete(reject);
+					if (error) reject(fail(error));
+					else resolve();
+				});
+			} catch (error) {
+				fail(error);
+			}
+		});
+	};
 };
+/** Node-only construction; keep streams and their errors outside the core. */
+const createNodeIO = (stdout, stderr) => ({
+	stdout: writer(stdout),
+	stderr: writer(stderr)
+});
+const nodeIO = createNodeIO(process.stdout, process.stderr);
 //#endregion
-export { ConfigError as A, SUPPORTED_NODE_RANGE as C, isNodeError as D, nodeFileSystem as E, UsageError as M, asAbsPath as O, isSeverity as S, assertDirectory as T, PROJECT_TYPES as _, requireConfigKey as a, SEVERITIES as b, DEFAULT_REPORTER_NAME as c, jsonReporter as d, version as f, getByPath as g, defineRule as h, overrideBindings as i, SiroError as j, asRelPath as k, JSON_REPORTER_NAME as l, loadConfig as m, lintCommand as n, CONFIG_FILES as o, githubReporter as p, lint as r, BUILTIN_REPORTER_NAMES as s, nodeIO as t, prettyReporter as u, isProjectType as v, isSupportedNodeVersion as w, isPM as x, PMS as y };
+export { asRelPath as A, isSupportedNodeVersion as C, nodeFileSystem as D, assertDirectory as E, SiroError as M, UsageError as N, isNodeError as O, isSeverity as S, version as T, PROJECT_TYPES as _, DEFAULT_REPORTER_NAME as a, SEVERITIES as b, jsonReporter as c, overrideBindings as d, requireConfigKey as f, getByPath as g, defineRule as h, BUILTIN_REPORTER_NAMES as i, ConfigError as j, asAbsPath as k, safeText as l, loadConfig as m, lint as n, JSON_REPORTER_NAME as o, CONFIG_FILES as p, lintCommand as r, prettyReporter as s, nodeIO as t, githubReporter as u, isProjectType as v, SUPPORTED_NODE_RANGE as w, isPM as x, PMS as y };
 
-//# sourceMappingURL=node-io-CaqobxYp.mjs.map
+//# sourceMappingURL=node-io-CAszdmko.mjs.map