@pho9ubenaa/siro 0.5.1 → 0.6.0

package/dist/{node-io-BDHg4J2w.mjs → node-io-CAszdmko.mjs}

@@ -1,16 +1,16 @@
 import path from "node:path";
-import { lstatSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { readFileSync, readdirSync, statSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import satisfies from "semver/functions/satisfies.js";
 import * as vb from "valibot";
 import { lt, parse } from "semver";
 import valid from "semver/functions/valid.js";
-import { GLOBSTAR, Minimatch, braceExpand } from "minimatch";
+import { Minimatch } from "minimatch";
 import ini from "ini";
 import { parse as parse$1 } from "smol-toml";
 import { parseDocument } from "yaml";
 import pc from "picocolors";
-//#region src/shared/errors.ts
+//#region src/core/contracts/errors.ts
 var SiroError = class extends Error {
 	exitCode;
 	constructor(message, exitCode) {
@@ -47,7 +47,7 @@ const wrapCodecError = (filePath, fn) => {
 	}
 };
 //#endregion
-//#region src/shared/paths.ts
+//#region src/core/contracts/paths.ts
 const isRelPath = (value) => typeof value === "string" && value.length > 0 && !value.includes("\0") && !/^[\\/]/u.test(value) && !/^[a-z]:/iu.test(value) && !value.split(/[\\/]/u).includes("..");
 const asRelPath = (value) => {
 	if (!isRelPath(value)) throw new TypeError("Expected a repository-relative path without parent traversal.");
@@ -62,8 +62,17 @@ const asAbsPath = (value) => {
 };
 const nodePaths = {
 	isAbsolute: isAbsPath,
-	resolve: (root, relative) => asAbsPath(path.join(root, asRelPath(relative))),
-	normalizePattern: (pattern) => path.posix.normalize(pattern)
+	resolve(root, relative) {
+		if (typeof relative !== "string" || relative.includes("\0") || path.isAbsolute(relative) || relative.split(path.sep === "\\" ? /[\\/]/u : /\//u).includes("..")) throw new ConfigError(`Invalid repository-relative path: ${String(relative)}`);
+		const resolved = path.join(root, relative);
+		const within = path.relative(root, resolved);
+		if (within === ".." || within.startsWith(`..${path.sep}`) || path.isAbsolute(within)) throw new ConfigError("Path escapes repository root.");
+		return asAbsPath(resolved);
+	},
+	child(parent, name) {
+		if (typeof name !== "string" || !name || name === "." || name === ".." || name.includes("\0") || name.includes("/") || path.sep === "\\" && (name.includes("\\") || name.includes(":"))) throw new ConfigError(`FileSystem.readDirectories returned an invalid child directory name: ${String(name)}`);
+		return parent === "." ? name : `${parent}/${name}`;
+	}
 };
 //#endregion
 //#region src/adapters/node-errors.ts
@@ -78,24 +87,6 @@ const nodeFileSystem = {
 	readDirectories(directory) {
 		return readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
 	},
-	resolveDirectory(parent, name) {
-		let target;
-		try {
-			target = lstatSync(path.join(parent, name), { bigint: true });
-		} catch (error) {
-			if (isNodeError(error) && error.code === "ENOENT") return void 0;
-			throw error;
-		}
-		if (!target.isDirectory()) return void 0;
-		const names = readdirSync(parent, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-		if (names.includes(name)) return name;
-		const matches = names.filter((candidate) => {
-			const entry = lstatSync(path.join(parent, candidate), { bigint: true });
-			return entry.isDirectory() && entry.dev === target.dev && entry.ino === target.ino;
-		});
-		if (target.ino === 0n || matches.length !== 1) throw new ConfigError(`${parent}: cannot identify the resolved workspace directory ${name}.`);
-		return matches[0];
-	},
 	exists(filePath) {
 		try {
 			assertRegularFile(filePath);
@@ -121,7 +112,7 @@ const assertDirectory = (root) => {
 };
 //#endregion
 //#region package.json
-var version$1 = "0.5.1";
+var version$1 = "0.6.0";
 var engines = { "node": "^22.18.0 || ^24.0.0" };
 //#endregion
 //#region src/version.ts
@@ -131,11 +122,20 @@ const SUPPORTED_NODE_RANGE = engines.node;
 //#region src/adapters/node-version.ts
 const isSupportedNodeVersion = (version) => satisfies(version, SUPPORTED_NODE_RANGE);
 //#endregion
-//#region src/domain/entities/pms.ts
+//#region src/core/contracts/records.ts
+/** Configuration maps are ordinary objects or null-prototype dictionaries. */
+const isPlainRecord = (value) => {
+	if (typeof value !== "object" || value === null) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+};
+//#endregion
+//#region src/core/contracts/pms.ts
 /**
 * Single source of truth for package managers and severities.
-* Types, runtime sets, and ordering are all derived from these tuples — add a
-* package manager here and the rest of the codebase follows.
+* Types, runtime sets, and ordering derive from these tuples. Adding a manager
+* still requires local detection signals, applicable rule bindings and verified
+* policy/availability evidence; the tuple alone does not implement support.
 */
 const PMS = [
 	"npm",
@@ -171,24 +171,68 @@ const parsePackageManagerField = (value) => {
 	if (typeof name !== "undefined" && isPM(name)) return name;
 };
 //#endregion
-//#region src/domain/entities/project-type.ts
-const PROJECT_TYPES = ["application", "package"];
-const isProjectType = (value) => PROJECT_TYPES.some((projectType) => projectType === value);
+//#region src/core/pm-versions.ts
+/** Release history establishes stable versions, not ranges or prerelease builds. */
+const isStableVersion = (value) => {
+	if (typeof value !== "string" || !/^\d/u.test(value) || value.trim() !== value) return false;
+	const version = parse(value);
+	return version !== null && version.prerelease.length === 0;
+};
+/** Keep name-only detection independent from whether the declaration pins a version. */
+const declaredPMVersion = (declaration) => {
+	const [pm, version, ...extra] = declaration?.trim().split("@") ?? [];
+	return pm && isPM(pm) && isStableVersion(version) && extra.length === 0 ? { [pm]: version } : {};
+};
 //#endregion
-//#region src/shared/records.ts
-/** Configuration maps are ordinary objects or null-prototype dictionaries. */
-const isPlainRecord = (value) => {
-	if (typeof value !== "object" || value === null) return false;
-	const prototype = Object.getPrototypeOf(value);
-	return prototype === Object.prototype || prototype === null;
+//#region src/core/inspection-options.ts
+const denseArray = (value, name) => {
+	if (!Array.isArray(value)) throw new ConfigError(`${name} must be a dense array.`);
+	for (let index = 0; index < value.length; index += 1) if (!Object.hasOwn(value, index)) throw new ConfigError(`${name} must be a dense array.`);
+	return value;
+};
+const relativeInput = (value, name) => {
+	if (typeof value !== "string" || !value || value.includes("\0") || name === "exclude" && (value.includes("\\") || /^[a-z]:/iu.test(value)) || /^[\\/]/u.test(value) || /^[a-z]:[\\/]/iu.test(value) || value.split("/").includes("..")) throw new ConfigError(`${name}: expected a nonempty cwd-relative /-separated path without parent traversal.`);
+	return value.split("/").filter((part) => part && part !== ".").join("/") || ".";
+};
+const parseExcludes = (value) => [...new Set(denseArray(value, "exclude").map((input) => {
+	const pattern = relativeInput(input, "exclude");
+	if (pattern === "." || pattern.startsWith("!")) throw new ConfigError("exclude cannot exclude cwd (.) or re-include with leading !.");
+	return pattern;
+}))];
+const parseInstallationRoots = (value) => {
+	const roots = /* @__PURE__ */ new Map();
+	for (const input of denseArray(value, "installationRoots")) {
+		if (typeof input !== "string" && (!isPlainRecord(input) || Object.keys(input).some((key) => ![
+			"path",
+			"pm",
+			"pmVersion"
+		].includes(key)))) throw new ConfigError("installationRoots entries must be paths or { path, pm?, pmVersion? }.");
+		const entry = typeof input === "string" ? { path: input } : input;
+		const path = relativeInput(entry.path, "installationRoots");
+		if (entry.pm !== void 0 && (typeof entry.pm !== "string" || !isPM(entry.pm)) || entry.pmVersion !== void 0 && (!entry.pm || typeof entry.pmVersion !== "string" || !isStableVersion(entry.pmVersion))) throw new ConfigError(`${path}: pmVersion requires pm and an exact stable version; pm must be a supported manager.`);
+		if (path === "." && (entry.pm !== void 0 || entry.pmVersion !== void 0)) throw new ConfigError("Use top-level pm / pmVersion / pms / pmVersions for installation root \".\".");
+		const root = {
+			path,
+			pm: entry.pm,
+			pmVersion: entry.pmVersion
+		};
+		const previous = roots.get(path);
+		if (previous && (previous.pm !== root.pm || previous.pmVersion !== root.pmVersion)) throw new ConfigError(`${path}: conflicting installationRoots entries.`);
+		roots.set(path, root);
+	}
+	return [...roots.values()];
 };
 //#endregion
-//#region src/domain/ports/reporter.ts
+//#region src/core/contracts/project-type.ts
+const PROJECT_TYPES = ["application", "package"];
+const isProjectType = (value) => PROJECT_TYPES.some((projectType) => projectType === value);
+//#endregion
+//#region src/core/contracts/reporter.ts
 const isReporterShape = (value) => {
 	return isPlainRecord(value) && typeof value.name === "string" && typeof value.format === "function";
 };
 //#endregion
-//#region src/domain/entities/config-value.ts
+//#region src/core/contracts/config-value.ts
 const CODEC_KINDS = [
 	"json",
 	"npmrc",
@@ -211,14 +255,14 @@ const toParsedConfig = (value) => {
 	throw new TypeError("Config root must be a mapping.");
 };
 //#endregion
-//#region src/domain/entities/config-file-ref.ts
+//#region src/core/contracts/config-file-ref.ts
 const CONFIG_FILE_KINDS = new Set(CODEC_KINDS);
 const isConfigFileRefShape = (value) => {
 	if (!isPlainRecord(value) || typeof value.kind !== "string" || !isRelPath(value.path)) return false;
 	return CONFIG_FILE_KINDS.has(value.kind);
 };
 //#endregion
-//#region src/domain/entities/rule.ts
+//#region src/core/contracts/rule.ts
 const defineRule = (rule) => rule;
 const isOptionalString = (value) => typeof value === "undefined" || typeof value === "string";
 const isConfigValueShape = (value) => typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
@@ -252,22 +296,26 @@ const isRuleShape = (value) => {
 	return typeof value.id === "string" && typeof value.title === "string" && typeof value.description === "string" && typeof value.severity === "string" && isSeverity(value.severity) && isOptionalString(value.docs) && isProjectTypesShape(value.projectTypes) && isBindingsShape(value.bindings);
 };
 //#endregion
-//#region src/domain/services/pm-versions.ts
-/** Release history establishes stable versions, not ranges or prerelease builds. */
-const isStableVersion = (value) => {
-	if (typeof value !== "string" || !/^\d/u.test(value) || value.trim() !== value) return false;
-	const version = parse(value);
-	return version !== null && version.prerelease.length === 0;
-};
-/** Keep name-only detection independent from whether the declaration pins a version. */
-const declaredPMVersion = (declaration) => {
-	const [pm, version, ...extra] = declaration?.trim().split("@") ?? [];
-	return pm && isPM(pm) && isStableVersion(version) && extra.length === 0 ? { [pm]: version } : {};
+//#region src/core/contracts/synchronous.ts
+/** Reject only the submitted async value, without a process-wide rejection handler. */
+const assertSynchronous = (value, label) => {
+	if (value !== null && (typeof value === "object" || typeof value === "function") && "then" in value && typeof value.then === "function") {
+		Promise.resolve(value).catch(() => {});
+		throw new ConfigError(`${label} must be synchronous; Promise/thenable values are not supported.`);
+	}
 };
 //#endregion
-//#region src/domain/services/parse-siro-config.ts
+//#region src/core/parse-siro-config.ts
 const RuleSettingSchema = vb.union([vb.picklist(SEVERITIES), vb.literal("off")]);
 const ConfigSchema = vb.strictObject({
+	exclude: vb.optional(vb.custom((value) => {
+		parseExcludes(value);
+		return true;
+	})),
+	installationRoots: vb.optional(vb.custom((value) => {
+		parseInstallationRoots(value);
+		return true;
+	})),
 	customRules: vb.optional(vb.array(vb.custom(isRuleShape, "must be a structurally valid rule"))),
 	pms: vb.optional(vb.pipe(vb.array(vb.picklist(PMS)), vb.minLength(1, "must not be empty (omit the key to auto-detect, or list at least one PM)"))),
 	projectType: vb.optional(vb.picklist(PROJECT_TYPES)),
@@ -298,13 +346,14 @@ const formatIssues = (issues) => issues.map((issue) => {
 	return issue.message;
 }).join("; ");
 const parseConfig = (candidate, name = "siro.config") => {
+	assertSynchronous(candidate, name);
 	if (!isPlainRecord(candidate)) throw new ConfigError(`${name} must export a config object (got ${Array.isArray(candidate) ? "an array" : typeof candidate}).`);
 	const result = vb.safeParse(ConfigSchema, Object.fromEntries(Object.entries(candidate)));
 	if (!result.success) throw new ConfigError(`${name}: ${formatIssues(result.issues)}`);
 	return result.output;
 };
 //#endregion
-//#region src/adapters/config-loader.ts
+//#region src/load-config.ts
 const CONFIG_NAMES = [
 	"siro.config.ts",
 	"siro.config.mjs",
@@ -328,7 +377,7 @@ const loadConfig = async (cwd, nodeVersion = process.versions.node) => {
 	return parseConfig(mod !== null && typeof mod === "object" && "default" in mod ? mod.default : mod, name);
 };
 //#endregion
-//#region src/domain/entities/config-files.ts
+//#region src/core/config-files.ts
 /** Known configuration locations and their parsers. */
 const CONFIG_FILES = {
 	aubeWorkspace: {
@@ -361,7 +410,7 @@ const CONFIG_FILES = {
 	}
 };
 //#endregion
-//#region src/domain/setting-availability.ts
+//#region src/core/rules/setting-availability.ts
 const { npmrc: npmrc$7, packageJson: packageJson$2, pnpmWorkspace: pnpmWorkspace$11, yarnrc: yarnrc$10, bunfig: bunfig$6 } = CONFIG_FILES;
 const settingAvailability = [
 	{
@@ -482,7 +531,7 @@ const settingAvailability = [
 	}
 ];
 //#endregion
-//#region src/domain/services/remediation-availability.ts
+//#region src/core/rules/remediation-availability.ts
 const sameSetting = (setting, target) => target.file.path === setting.file.path && target.file.kind === setting.file.kind && target.keyPath.length === setting.keyPath.length && target.keyPath.every((key, index) => key === setting.keyPath[index]);
 /** Undefined means the target version or the setting's introduction is unknown. */
 const settingSupportedByTarget = (pm, version, target) => {
@@ -501,7 +550,7 @@ const guardRemediationAvailability = (pm, version, remediation, targets = remedi
 	};
 };
 //#endregion
-//#region src/domain/rules/remediation.ts
+//#region src/core/rules/remediation.ts
 /** Scalar writes must not discard an existing container or replace a non-object parent. */
 const proposeChanges = (config, operations) => {
 	for (const operation of operations) {
@@ -525,7 +574,7 @@ const proposeChanges = (config, operations) => {
 	};
 };
 //#endregion
-//#region src/domain/rules/builders/require-config-key.ts
+//#region src/core/rules/builders/require-config-key.ts
 const overrideBindings = (rule, overrides) => ({
 	...rule,
 	bindings: {
@@ -536,7 +585,7 @@ const overrideBindings = (rule, overrides) => ({
 const accepts = (spec, actual) => spec.accept ? spec.accept(actual) : actual === spec.value;
 const checkKeyValue = (spec, config) => {
 	const actual = getByPath(config, spec.keyPath);
-	const coveredByDefault = actual === void 0 && spec.documentedDefault !== void 0 && spec.versionNote?.defaultSafeSince === void 0 && accepts(spec, spec.documentedDefault);
+	const coveredByDefault = actual === void 0 && spec.documentedDefault !== void 0 && spec.defaultSafety === "unconditional" && accepts(spec, spec.documentedDefault);
 	if (!coveredByDefault && accepts(spec, actual)) return { state: "ok" };
 	const severity = coveredByDefault ? spec.defaultSatisfiedSeverity ?? "info" : void 0;
 	if (severity === "off") return { state: "ok" };
@@ -589,7 +638,7 @@ const requireConfigKey = (options) => {
 	};
 };
 //#endregion
-//#region src/domain/rules/builders/with-aube-paranoid.ts
+//#region src/core/rules/builders/with-aube-paranoid.ts
 const withAubeParanoid = (rule) => {
 	const { aube } = rule.bindings;
 	if (!aube) return rule;
@@ -602,13 +651,14 @@ const withAubeParanoid = (rule) => {
 	} });
 };
 //#endregion
-//#region src/domain/rules/advisory-check.ts
+//#region src/core/rules/advisory-check.ts
 const { aubeWorkspace: aubeWorkspace$8 } = CONFIG_FILES;
 const advisoryCheck = withAubeParanoid(requireConfigKey({
 	bindings: { aube: {
 		accept: (value) => value === "on" || value === "required",
 		docs: "https://aube.jdx.dev/security.html",
 		documentedDefault: "on",
+		defaultSafety: "unconditional",
 		file: aubeWorkspace$8,
 		keyPath: ["advisoryCheck"],
 		message: "Set `advisoryCheck: on` (or `required`) in aube-workspace.yaml to check dependencies against known-malicious advisories.",
@@ -621,11 +671,11 @@ const advisoryCheck = withAubeParanoid(requireConfigKey({
 	title: "Enable malicious-package advisory checks"
 }));
 //#endregion
-//#region src/domain/rules/config-predicates.ts
+//#region src/core/rules/config-predicates.ts
 const isNonBlankString = (value) => typeof value === "string" && value.trim().length > 0;
 const isStringList = (value) => Array.isArray(value) && Array.from(value).every(isNonBlankString);
 //#endregion
-//#region src/domain/rules/approved-git-repos.ts
+//#region src/core/rules/approved-git-repos.ts
 const { yarnrc: yarnrc$9 } = CONFIG_FILES;
 const message = "Set `approvedGitRepositories: []` in .yarnrc.yml to block all git: protocol dependencies (or list approved repository globs).";
 const approvedGitRepos = defineRule({
@@ -655,7 +705,7 @@ const approvedGitRepos = defineRule({
 	title: "Approve git repository dependencies"
 });
 //#endregion
-//#region src/domain/rules/audit-suppression.ts
+//#region src/core/rules/audit-suppression.ts
 const { yarnrc: yarnrc$8 } = CONFIG_FILES;
 const isNonEmptyArray = (value) => Array.isArray(value) && value.length > 0;
 const SUPPRESSION_KEYS = ["npmAuditIgnoreAdvisories", "npmAuditExcludePackages"];
@@ -688,7 +738,7 @@ const auditSuppression = defineRule({
 	title: "Review audit suppression entries"
 });
 //#endregion
-//#region src/domain/rules/block-auto-install.ts
+//#region src/core/rules/block-auto-install.ts
 const { bunfig: bunfig$5 } = CONFIG_FILES;
 const blockAutoInstall = requireConfigKey({
 	bindings: { bun: {
@@ -706,7 +756,7 @@ const blockAutoInstall = requireConfigKey({
 	title: "Block automatic package installation"
 });
 //#endregion
-//#region src/domain/rules/block-exotic-subdeps.ts
+//#region src/core/rules/block-exotic-subdeps.ts
 const { aubeWorkspace: aubeWorkspace$7, npmrc: npmrc$6, pnpmWorkspace: pnpmWorkspace$10 } = CONFIG_FILES;
 const isRootOrNone = (value) => value === "root" || value === "none";
 const npmMessage = "Set `allow-git=none` and `allow-remote=none` in .npmrc to block git/tarball URLs; use `root` only when direct URL dependencies are required.";
@@ -743,14 +793,16 @@ const blockExoticSubdeps = overrideBindings(requireConfigKey({
 		aube: {
 			docs: "https://aube.jdx.dev/security.html",
 			documentedDefault: true,
+			defaultSafety: "unconditional",
 			file: aubeWorkspace$7,
 			keyPath: ["blockExoticSubdeps"],
 			message: "Set `blockExoticSubdeps: true` in aube-workspace.yaml to block git/tarball URLs in transitive dependencies.",
 			value: true
 		},
 		pnpm: {
-			docs: "https://pnpm.io/settings#blockexoticsubdeps",
+			docs: "https://pnpm.io/settings/dependency-resolution#blockexoticsubdeps",
 			documentedDefault: true,
+			defaultSafety: "conditional",
 			file: pnpmWorkspace$10,
 			keyPath: ["blockExoticSubdeps"],
 			message: "Set `blockExoticSubdeps: true` in pnpm-workspace.yaml to block git/tarball URLs in transitive dependencies.",
@@ -762,13 +814,13 @@ const blockExoticSubdeps = overrideBindings(requireConfigKey({
 		}
 	},
 	description: "Refuse to install transitive dependencies sourced from git or tarball URLs, which bypass registry integrity checking.",
-	docs: "https://pnpm.io/settings#blockexoticsubdeps",
+	docs: "https://pnpm.io/settings/dependency-resolution#blockexoticsubdeps",
 	id: "block-exotic-subdeps",
 	severity: "warn",
 	title: "Block exotic subdependencies"
 }), { npm: npmBinding$1 });
 //#endregion
-//#region src/domain/rules/bun-security-scanner.ts
+//#region src/core/rules/bun-security-scanner.ts
 const { bunfig: bunfig$4 } = CONFIG_FILES;
 const bunSecurityScanner = defineRule({
 	bindings: { bun: {
@@ -807,12 +859,13 @@ const bunSecurityScanner = defineRule({
 	title: "Enable a bun install-time security scanner"
 });
 //#endregion
-//#region src/domain/rules/checksum-verification.ts
+//#region src/core/rules/checksum-verification.ts
 const { yarnrc: yarnrc$7 } = CONFIG_FILES;
 const checksumVerification = requireConfigKey({
 	bindings: { yarn: {
 		docs: "https://yarnpkg.com/configuration/yarnrc#checksumBehavior",
 		documentedDefault: "throw",
+		defaultSafety: "unconditional",
 		file: yarnrc$7,
 		keyPath: ["checksumBehavior"],
 		message: "Set `checksumBehavior: throw` in .yarnrc.yml to reject packages whose checksum does not match the lockfile.",
@@ -825,7 +878,7 @@ const checksumVerification = requireConfigKey({
 	title: "Verify package checksums"
 });
 //#endregion
-//#region src/domain/entities/signals.ts
+//#region src/core/signals.ts
 const PM_SIGNALS = {
 	aube: {
 		configs: [CONFIG_FILES.aubeWorkspace.path],
@@ -860,11 +913,11 @@ const PM_SIGNALS = {
 	}
 };
 //#endregion
-//#region src/domain/rules/commit-lockfile.ts
+//#region src/core/rules/commit-lockfile.ts
 const LOCKFILE_DOCS = {
 	aube: "https://github.com/aubepkg/aube/blob/main/docs/package-manager/lockfiles.md",
 	bun: "https://bun.com/docs/install/lockfile",
-	deno: "https://docs.deno.com/runtime/fundamentals/modules/#integrity-checking-and-lock-files",
+	deno: "https://docs.deno.com/runtime/reference/deno_json/#lockfile",
 	npm: "https://docs.npmjs.com/cli/v12/configuring-npm/package-lock-json",
 	pnpm: "https://pnpm.io/git#lockfiles",
 	yarn: "https://yarnpkg.com/getting-started/qa#should-lockfiles-be-committed-to-the-repository"
@@ -873,7 +926,7 @@ const LOCKFILE_VERSION_NOTES = { deno: { configAvailableSince: "deno 1.28.0" } }
 const lockfileBinding = (pm) => {
 	const { lockfiles, reusesLockfiles } = PM_SIGNALS[pm];
 	const [primary] = lockfiles;
-	const accepted = [...lockfiles, ...reusesLockfiles ?? []].filter((lockfile) => pm !== "npm" || lockfile === primary);
+	const accepted = [...lockfiles, ...reusesLockfiles ?? []];
 	return {
 		check(ctx) {
 			if (pm === "aube" && ctx.exists(asRelPath("bun.lockb")) && !ctx.exists(asRelPath("bun.lock"))) return {
@@ -884,7 +937,20 @@ const lockfileBinding = (pm) => {
 					steps: ["Run `bun install --save-text-lockfile` to generate bun.lock, then commit it."]
 				}
 			};
-			if (accepted.some((lf) => ctx.exists(asRelPath(lf)))) return { state: "ok" };
+			if (pm === "npm") {
+				if (ctx.exists(asRelPath(primary))) return { state: "ok" };
+				if (ctx.exists(asRelPath("npm-shrinkwrap.json"))) {
+					if (ctx.pmVersion && lt(ctx.pmVersion, "12.0.0")) return { state: "ok" };
+					return {
+						state: "violation",
+						message: ctx.pmVersion ? `npm ${ctx.pmVersion} no longer reads npm-shrinkwrap.json. Use package-lock.json.` : "Found npm-shrinkwrap.json, but the npm target version is unknown; npm 12 no longer reads it.",
+						remediation: {
+							kind: "manual",
+							steps: ["Verify and declare the npm version used by this project. For npm 12 or newer, migrate to package-lock.json and review the resulting dependency resolutions."]
+						}
+					};
+				}
+			} else if (accepted.some((lf) => ctx.exists(asRelPath(lf)))) return { state: "ok" };
 			return {
 				remediation: {
 					kind: "manual",
@@ -935,13 +1001,13 @@ const commitLockfile = defineRule({
 		yarn: lockfileBinding("yarn")
 	},
 	description: "Lockfiles pin the full dependency tree and integrity hashes, enabling reproducible, verifiable installs (e.g. `npm ci`).",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-include-lockfiles",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#3-include-lockfiles",
 	id: "commit-lockfile",
 	severity: "error",
 	title: "Commit a lockfile"
 });
 //#endregion
-//#region src/domain/rules/dependency-overrides.ts
+//#region src/core/rules/dependency-overrides.ts
 const { aubeWorkspace: aubeWorkspace$6, pnpmWorkspace: pnpmWorkspace$9 } = CONFIG_FILES;
 const isNonEmptyObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
 const checkOverrides = (config, file) => {
@@ -967,16 +1033,16 @@ const makeBinding = (file, fileName, docs) => ({
 const dependencyOverrides = defineRule({
 	bindings: {
 		aube: makeBinding(aubeWorkspace$6, "aube-workspace.yaml", "https://aube.sh/settings/"),
-		pnpm: makeBinding(pnpmWorkspace$9, "pnpm-workspace.yaml", "https://pnpm.io/settings#overrides")
+		pnpm: makeBinding(pnpmWorkspace$9, "pnpm-workspace.yaml", "https://pnpm.io/settings/dependency-resolution#overrides")
 	},
 	description: "Flag dependency overrides that can replace transitive packages with arbitrary versions or forks — a supply-chain injection vector.",
-	docs: "https://pnpm.io/settings#overrides",
+	docs: "https://pnpm.io/settings/dependency-resolution#overrides",
 	id: "dependency-overrides",
 	severity: "info",
 	title: "Review dependency overrides"
 });
 //#endregion
-//#region src/domain/rules/disable-lifecycle-scripts.ts
+//#region src/core/rules/disable-lifecycle-scripts.ts
 const { npmrc: npmrc$5, pnpmWorkspace: pnpmWorkspace$8, yarnrc: yarnrc$6, aubeWorkspace: aubeWorkspace$5, bunfig: bunfig$3 } = CONFIG_FILES;
 const pnpmBinding$4 = {
 	check(ctx, config) {
@@ -1050,7 +1116,7 @@ const pnpmBinding$4 = {
 			}])
 		};
 	},
-	docs: "https://pnpm.io/settings#strictdepbuilds",
+	docs: "https://pnpm.io/settings/build#strictdepbuilds",
 	file: pnpmWorkspace$8,
 	versionNote: {
 		configAvailableSince: "pnpm 10.3.0",
@@ -1137,6 +1203,7 @@ const disableLifecycleScripts = withAubeParanoid(overrideBindings(requireConfigK
 		yarn: {
 			docs: "https://yarnpkg.com/configuration/yarnrc#enableScripts",
 			documentedDefault: false,
+			defaultSafety: "conditional",
 			file: yarnrc$6,
 			keyPath: ["enableScripts"],
 			message: "Set `enableScripts: false` in .yarnrc.yml to pin the policy across versions.",
@@ -1148,7 +1215,7 @@ const disableLifecycleScripts = withAubeParanoid(overrideBindings(requireConfigK
 		}
 	},
 	description: "Malicious postinstall scripts are a primary supply-chain attack vector. Prevent automatic execution of dependency lifecycle scripts.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#3-disable-lifecycle-scripts",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#1-disable-lifecycle-scripts",
 	id: "disable-lifecycle-scripts",
 	severity: "error",
 	title: "Disable dependency lifecycle scripts"
@@ -1158,7 +1225,7 @@ const disableLifecycleScripts = withAubeParanoid(overrideBindings(requireConfigK
 	pnpm: pnpmBinding$4
 }));
 //#endregion
-//#region src/domain/rules/enforce-strict-ssl.ts
+//#region src/core/rules/enforce-strict-ssl.ts
 const { npmrc: npmrc$4, yarnrc: yarnrc$5 } = CONFIG_FILES;
 const yarnMessage = "Set `enableStrictSsl: true` in .yarnrc.yml to enforce SSL certificate validation for registry connections.";
 const yarnBinding = {
@@ -1197,6 +1264,7 @@ const enforceStrictSsl = overrideBindings(requireConfigKey({
 	bindings: { npm: {
 		docs: "https://docs.npmjs.com/cli/v11/using-npm/config#strict-ssl",
 		documentedDefault: true,
+		defaultSafety: "unconditional",
 		file: npmrc$4,
 		keyPath: ["strict-ssl"],
 		message: "Set `strict-ssl=true` in .npmrc to enforce SSL certificate validation.",
@@ -1209,7 +1277,7 @@ const enforceStrictSsl = overrideBindings(requireConfigKey({
 	title: "Enforce SSL for registry connections"
 }), { yarn: yarnBinding });
 //#endregion
-//#region src/domain/services/project-type.ts
+//#region src/core/resolve-project-type.ts
 const isPublishableName = (value) => typeof value === "string" && value.trim().length > 0;
 const resolveProjectType = (selected, inferredPackage) => selected ?? (inferredPackage ? "package" : "application");
 const resolvePackageJsonProjectType = (ctx) => {
@@ -1219,10 +1287,10 @@ const resolvePackageJsonProjectType = (ctx) => {
 };
 const resolveDenoProjectType = (ctx, denoConfig) => resolveProjectType(ctx.projectType, getByPath(denoConfig, ["publish"]) !== false && isPublishableName(getByPath(denoConfig, ["name"])));
 //#endregion
-//#region src/domain/rules/publishable.ts
+//#region src/core/rules/publishable.ts
 const isPublishable = (ctx) => resolvePackageJsonProjectType(ctx) === "package";
 //#endregion
-//#region src/domain/rules/files-field.ts
+//#region src/core/rules/files-field.ts
 const { packageJson: packageJson$1, denoJson: denoJson$3 } = CONFIG_FILES;
 const packageJsonFilesBinding = {
 	check(ctx) {
@@ -1242,47 +1310,48 @@ const packageJsonFilesBinding = {
 	docs: "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#files",
 	file: packageJson$1
 };
+const denoPublishBinding = {
+	check(ctx, config) {
+		if (resolveDenoProjectType(ctx, config) !== "package") return { state: "na" };
+		const include = getByPath(config, ["publish", "include"]);
+		if (isStringList(include) && include.length > 0) return { state: "ok" };
+		return {
+			remediation: {
+				kind: "manual",
+				steps: ["Add a non-empty `publish.include` array to deno.json; use `publish.exclude` for additional exclusions."]
+			},
+			actual: include,
+			message: "Add `publish.include` to deno.json to limit what gets published.",
+			state: "violation"
+		};
+	},
+	docs: "https://docs.deno.com/runtime/reference/deno_json/#publish---override-.gitignore",
+	file: denoJson$3
+};
 const filesField = defineRule({
 	bindings: {
 		aube: packageJsonFilesBinding,
 		bun: packageJsonFilesBinding,
-		deno: {
-			check(ctx, config) {
-				if (resolveDenoProjectType(ctx, config) !== "package") return { state: "na" };
-				const include = getByPath(config, ["publish", "include"]);
-				if (isStringList(include) && include.length > 0) return { state: "ok" };
-				return {
-					remediation: {
-						kind: "manual",
-						steps: ["Add a non-empty `publish.include` array to deno.json; use `publish.exclude` for additional exclusions."]
-					},
-					actual: include,
-					message: "Add `publish.include` to deno.json to limit what gets published.",
-					state: "violation"
-				};
-			},
-			docs: "https://docs.deno.com/runtime/reference/cli/publish/#how-publishing-works",
-			file: denoJson$3
-		},
+		deno: denoPublishBinding,
 		npm: packageJsonFilesBinding,
 		pnpm: packageJsonFilesBinding,
 		yarn: packageJsonFilesBinding
 	},
 	description: "An explicit `files` array in package.json restricts what gets published, preventing accidental inclusion of secrets or local files.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#11-review-published-files",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#12-review-published-files",
 	id: "files-field",
 	projectTypes: ["package"],
 	severity: "info",
 	title: "Declare a published files allow-list"
 });
 //#endregion
-//#region src/domain/rules/frozen-lockfile.ts
+//#region src/core/rules/frozen-lockfile.ts
 const { pnpmWorkspace: pnpmWorkspace$7, yarnrc: yarnrc$4, bunfig: bunfig$2, denoJson: denoJson$2 } = CONFIG_FILES;
 const aubeFrozenCommand = "Use `aube ci` or `aube install --frozen-lockfile` to fail when the lockfile would change.";
 const frozenLockfile = overrideBindings(requireConfigKey({
 	bindings: {
 		deno: {
-			docs: "https://docs.deno.com/runtime/fundamentals/configuration/#lock",
+			docs: "https://docs.deno.com/runtime/reference/deno_json/#lockfile",
 			file: denoJson$2,
 			keyPath: ["lock", "frozen"],
 			message: "Set `lock.frozen: true` in deno.json for reproducible, verified installs.",
@@ -1297,7 +1366,7 @@ const frozenLockfile = overrideBindings(requireConfigKey({
 			versionNote: { configAvailableSince: "bun 0.6.10" }
 		},
 		pnpm: {
-			docs: "https://pnpm.io/settings#frozenlockfile",
+			docs: "https://pnpm.io/cli/install#--frozen-lockfile",
 			file: pnpmWorkspace$7,
 			keyPath: ["frozenLockfile"],
 			message: "pnpm defaults frozenLockfile to true in CI — set it explicitly in pnpm-workspace.yaml to pin the policy outside CI too.",
@@ -1306,6 +1375,7 @@ const frozenLockfile = overrideBindings(requireConfigKey({
 		yarn: {
 			docs: "https://yarnpkg.com/configuration/yarnrc#enableImmutableInstalls",
 			documentedDefault: true,
+			defaultSafety: "conditional",
 			file: yarnrc$4,
 			keyPath: ["enableImmutableInstalls"],
 			message: "Set `enableImmutableInstalls: true` in .yarnrc.yml to pin the policy outside CI too.",
@@ -1317,7 +1387,7 @@ const frozenLockfile = overrideBindings(requireConfigKey({
 		}
 	},
 	description: "Refuse to mutate the lockfile on install so unexpected dependency changes fail loudly.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-include-lockfiles",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#3-include-lockfiles",
 	id: "frozen-lockfile",
 	severity: "warn",
 	title: "Freeze the lockfile"
@@ -1336,7 +1406,7 @@ const frozenLockfile = overrideBindings(requireConfigKey({
 	severity: "info"
 } });
 //#endregion
-//#region src/domain/rules/frozen-store.ts
+//#region src/core/rules/frozen-store.ts
 const { pnpmWorkspace: pnpmWorkspace$6 } = CONFIG_FILES;
 const frozenStore = defineRule({
 	bindings: { pnpm: {
@@ -1367,12 +1437,13 @@ const frozenStore = defineRule({
 	title: "Consider a pre-populated read-only store"
 });
 //#endregion
-//#region src/domain/rules/hardened-mode.ts
+//#region src/core/rules/hardened-mode.ts
 const { yarnrc: yarnrc$3 } = CONFIG_FILES;
 const hardenedMode = requireConfigKey({
 	bindings: { yarn: {
 		docs: "https://yarnpkg.com/configuration/yarnrc#enableHardenedMode",
 		documentedDefault: true,
+		defaultSafety: "conditional",
 		file: yarnrc$3,
 		keyPath: ["enableHardenedMode"],
 		message: "yarn enables hardened mode automatically only for pull requests on public repositories — set `enableHardenedMode: true` in .yarnrc.yml to extend end-to-end install verification to every install.",
@@ -1389,7 +1460,7 @@ const hardenedMode = requireConfigKey({
 	title: "Enable hardened mode (yarn)"
 });
 //#endregion
-//#region src/domain/services/deno-release-age.ts
+//#region src/core/rules/deno-release-age.ts
 const DENO_DURATION = /^\+?P(?:\+?\d+[Ww]|(?:\d+[Dd])*(?:T(?:\d+[HhMm]|\d+(?:\.\d+)?[Ss])+)?)$/u;
 const DENO_MIN_TIMESTAMP = Date.UTC(-262143, 0, 1);
 const DENO_UNIT_SECONDS = {
@@ -1427,7 +1498,7 @@ const isActiveDenoReleaseAge = (value, now, parse) => {
 	return !Number.isNaN(midnight.valueOf()) && midnight.toISOString().slice(0, 10) === date && timestamp < now;
 };
 //#endregion
-//#region src/domain/rules/minimum-release-age.ts
+//#region src/core/rules/minimum-release-age.ts
 const HOURS_PER_DAY = 24;
 const MINUTES_PER_HOUR = 60;
 const SECONDS_PER_MINUTE = 60;
@@ -1444,7 +1515,7 @@ const isNonDisabledDenoReleaseAge = (value, now, parse) => {
 	if (!isPlainRecord(value)) return isActiveDenoReleaseAge(value, now, parse);
 	if (Object.keys(value).some((key) => key !== "age" && key !== "exclude")) return false;
 	if (value.exclude !== void 0 && !isStringList(value.exclude)) return false;
-	return value.age == null || isActiveDenoReleaseAge(value.age, now, parse);
+	return value.age != null && isActiveDenoReleaseAge(value.age, now, parse);
 };
 const denoAgeUsesFallback = (value) => {
 	if (value === void 0 || value === null) return true;
@@ -1453,13 +1524,14 @@ const denoAgeUsesFallback = (value) => {
 	if (value.exclude !== void 0 && !isStringList(value.exclude)) return false;
 	return value.age == null;
 };
-const isPositiveDenoNpmrcDays = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
-const baseRule$1 = requireConfigKey({
+const isPositiveDenoNpmrcDays = (value, now, parse) => typeof value === "number" && Number.isSafeInteger(value) && isActiveDenoReleaseAge(value * MINUTES_PER_DAY, now, parse);
+const baseRule$2 = requireConfigKey({
 	bindings: {
 		aube: {
 			accept: isPositiveNumber,
 			docs: "https://aube.sh/settings/",
 			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
+			defaultSafety: "unconditional",
 			file: aubeWorkspace$4,
 			keyPath: ["minimumReleaseAge"],
 			message: `Set minimumReleaseAge (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in aube-workspace.yaml.`,
@@ -1476,8 +1548,9 @@ const baseRule$1 = requireConfigKey({
 		},
 		pnpm: {
 			accept: isPositiveNumber,
-			docs: "https://pnpm.io/settings#minimumreleaseage",
+			docs: "https://pnpm.io/settings/dependency-resolution#minimumreleaseage",
 			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
+			defaultSafety: "conditional",
 			file: pnpmWorkspace$5,
 			keyPath: ["minimumReleaseAge"],
 			message: `Set minimumReleaseAge (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in pnpm-workspace.yaml.`,
@@ -1491,6 +1564,7 @@ const baseRule$1 = requireConfigKey({
 			accept: isPositiveYarnDuration,
 			docs: "https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate",
 			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
+			defaultSafety: "conditional",
 			file: yarnrc$2,
 			keyPath: ["npmMinimalAgeGate"],
 			message: `Set npmMinimalAgeGate (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in .yarnrc.yml.`,
@@ -1502,7 +1576,7 @@ const baseRule$1 = requireConfigKey({
 		}
 	},
 	description: "Refuse to install releases newer than a cooldown window so freshly published (possibly compromised) versions are skipped.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#set-minimal-release-age",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-set-cooldowns--minimum-release-age",
 	id: "minimum-release-age",
 	severity: "warn",
 	title: "Set a minimum release age"
@@ -1563,10 +1637,11 @@ const createDenoBinding = (time) => ({
 	},
 	check(ctx, config) {
 		const actual = getByPath(config, ["minimumDependencyAge"]);
+		const now = time.now();
 		if (denoAgeUsesFallback(actual)) {
 			const npmrcConfig = ctx.readConfig(npmrc$3);
 			const npmrcAge = getByPath(npmrcConfig, ["min-release-age"]);
-			if (isPositiveDenoNpmrcDays(npmrcAge)) return { state: "ok" };
+			if (isPositiveDenoNpmrcDays(npmrcAge, now, time.parse)) return { state: "ok" };
 			if (npmrcAge === 0) return {
 				state: "violation",
 				actual: npmrcAge,
@@ -1581,7 +1656,7 @@ const createDenoBinding = (time) => ({
 				}])
 			};
 		}
-		if (isNonDisabledDenoReleaseAge(actual, time.now(), time.parse)) return { state: "ok" };
+		if (isNonDisabledDenoReleaseAge(actual, now, time.parse)) return { state: "ok" };
 		const objectAge = isPlainRecord(actual);
 		const invalidObject = objectAge && (Object.keys(actual).some((key) => key !== "age" && key !== "exclude") || actual.exclude !== void 0 && !isStringList(actual.exclude));
 		return {
@@ -1601,12 +1676,12 @@ const createDenoBinding = (time) => ({
 		};
 	}
 });
-const createMinimumReleaseAge = (time) => overrideBindings(baseRule$1, {
+const createMinimumReleaseAge = (time) => overrideBindings(baseRule$2, {
 	npm: createNpmBinding(time),
 	deno: createDenoBinding(time)
 });
 //#endregion
-//#region src/domain/rules/named-registries.ts
+//#region src/core/rules/named-registries.ts
 const { pnpmWorkspace: pnpmWorkspace$4 } = CONFIG_FILES;
 const isNonEmptyObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
 const namedRegistries = defineRule({
@@ -1624,17 +1699,17 @@ const namedRegistries = defineRule({
 				state: "violation"
 			};
 		},
-		docs: "https://pnpm.io/settings#namedregistries",
+		docs: "https://pnpm.io/settings/dependency-resolution#namedregistries",
 		file: pnpmWorkspace$4
 	} },
 	description: "Flag named registry mappings that redirect package resolution to custom registries, which may enable dependency confusion attacks.",
-	docs: "https://pnpm.io/settings#namedregistries",
+	docs: "https://pnpm.io/settings/dependency-resolution#namedregistries",
 	id: "named-registries",
 	severity: "info",
 	title: "Review named registry mappings"
 });
 //#endregion
-//#region src/domain/rules/paranoid-mode.ts
+//#region src/core/rules/paranoid-mode.ts
 const { aubeWorkspace: aubeWorkspace$3 } = CONFIG_FILES;
 const paranoidMode = requireConfigKey({
 	bindings: { aube: {
@@ -1651,7 +1726,7 @@ const paranoidMode = requireConfigKey({
 	title: "Enable paranoid security mode"
 });
 //#endregion
-//#region src/domain/rules/patched-dependencies.ts
+//#region src/core/rules/patched-dependencies.ts
 const { pnpmWorkspace: pnpmWorkspace$3 } = CONFIG_FILES;
 const isNonEmptyObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
 const patchedDependencies = defineRule({
@@ -1669,17 +1744,17 @@ const patchedDependencies = defineRule({
 				state: "violation"
 			};
 		},
-		docs: "https://pnpm.io/settings#patcheddependencies",
+		docs: "https://pnpm.io/cli/patch#patcheddependencies",
 		file: pnpmWorkspace$3
 	} },
 	description: "Review local patches separately from the registry artifacts they modify.",
-	docs: "https://pnpm.io/settings#patcheddependencies",
+	docs: "https://pnpm.io/cli/patch#patcheddependencies",
 	id: "patched-dependencies",
 	severity: "info",
 	title: "Review patched dependencies"
 });
 //#endregion
-//#region src/domain/rules/pin-exact-versions.ts
+//#region src/core/rules/pin-exact-versions.ts
 const { npmrc: npmrc$2, pnpmWorkspace: pnpmWorkspace$2, yarnrc: yarnrc$1, bunfig, denoJson } = CONFIG_FILES;
 const REGISTRY_VERSION = /^(?:npm|jsr):(?:@[^/@]+\/)?[^/@]+@(?<version>[^/]*)/u;
 const isUnpinnedRegistryImport = (specifier) => {
@@ -1688,9 +1763,14 @@ const isUnpinnedRegistryImport = (specifier) => {
 	const normalized = version?.startsWith("=") ? version.slice(1) : version;
 	return normalized === void 0 || valid(normalized) === null;
 };
-const collectUnpinnedImports = (imports) => {
+const collectUnpinnedImports = (imports, location) => {
+	if (!isPlainRecord(imports)) throw new ConfigError(`deno.json: ${location} must be an import mapping object.`);
 	const offenders = [];
-	for (const [name, value] of Object.entries(imports)) if (typeof value === "string" && isUnpinnedRegistryImport(value)) offenders.push(`${name}=${value}`);
+	for (const [name, value] of Object.entries(imports)) {
+		if (value === null) continue;
+		if (typeof value !== "string") throw new ConfigError(`deno.json: ${location}.${name} must be a string or null.`);
+		if (isUnpinnedRegistryImport(value)) offenders.push(`${location}.${name}=${value}`);
+	}
 	return offenders;
 };
 const MAX_SAMPLE_COUNT = 3;
@@ -1701,23 +1781,26 @@ const formatOffenders = (offenders) => {
 	return {
 		remediation: {
 			kind: "manual",
-			steps: ["Run `deno add --save-exact <pkg>` for each unpinned registry import in deno.json, or rewrite the `imports` entries to use exact versions."]
+			steps: ["Pin each reported imports/scopes entry in deno.json to an exact version. For top-level imports, `deno add --save-exact <pkg>` can help; edit scoped mappings at their reported locations."]
 		},
 		message: `${offenders.length} deno imports are not pinned: ${sample}${more}. Use \`deno add --save-exact\` or pin manually.`,
 		state: "violation"
 	};
 };
 const OK = { state: "ok" };
-const extractImportsRecord = (config) => {
+const unpinnedInlineImports = (config) => {
 	const imports = getByPath(config, ["imports"]);
-	if (!isPlainRecord(imports)) return;
-	return imports;
+	const offenders = imports == null ? [] : collectUnpinnedImports(imports, "imports");
+	const scopes = getByPath(config, ["scopes"]);
+	if (scopes != null) {
+		if (!isPlainRecord(scopes)) throw new ConfigError("deno.json: scopes must be an object.");
+		for (const [scope, mapping] of Object.entries(scopes)) offenders.push(...collectUnpinnedImports(mapping, `scopes[${JSON.stringify(scope)}]`));
+	}
+	return offenders;
 };
 const denoBinding = {
 	check(_ctx, config) {
-		const imports = extractImportsRecord(config);
-		if (!imports) return OK;
-		const offenders = collectUnpinnedImports(imports);
+		const offenders = unpinnedInlineImports(config);
 		if (offenders.length === 0) return OK;
 		return formatOffenders(offenders);
 	},
@@ -1748,7 +1831,7 @@ const npmBinding = {
 };
 const aubeBinding = {
 	file: npmrc$2,
-	docs: "https://aube.jdx.dev/settings/#saveprefix",
+	docs: "https://aube.sh/settings/#setting-saveprefix",
 	check(_ctx, config) {
 		const prefixes = ["save-prefix", "savePrefix"].filter((key) => Object.hasOwn(config, key)).map((key) => config[key]);
 		if (prefixes.length > 0 && prefixes.every((value) => value === "")) return OK;
@@ -1789,8 +1872,8 @@ const pinExactVersions = overrideBindings(requireConfigKey({
 			versionNote: { configAvailableSince: "yarn 2.0.0" }
 		}
 	},
-	description: "Semver ranges (^, ~) auto-adopt new releases, including compromised ones. Save exact versions by default.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#1-pin-dependency-versions",
+	description: "Semver ranges (^, ~) auto-adopt new releases, including compromised ones. Save exact versions by default; for Deno, inspect registry mappings in both inline imports and scopes (not external import maps).",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#4-pin-dependency-versions",
 	id: "pin-exact-versions",
 	severity: "error",
 	title: "Pin exact dependency versions"
@@ -1800,7 +1883,7 @@ const pinExactVersions = overrideBindings(requireConfigKey({
 	npm: npmBinding
 });
 //#endregion
-//#region src/domain/rules/provenance.ts
+//#region src/core/rules/provenance.ts
 const { npmrc: npmrc$1, yarnrc } = CONFIG_FILES;
 const npmrcProvenance = {
 	file: npmrc$1,
@@ -1808,7 +1891,7 @@ const npmrcProvenance = {
 	message: "Set `provenance=true` (and publish from CI) to attest releases.",
 	value: true
 };
-const provenance = requireConfigKey({
+const baseRule = requireConfigKey({
 	applies: isPublishable,
 	bindings: {
 		bun: {
@@ -1834,14 +1917,37 @@ const provenance = requireConfigKey({
 		}
 	},
 	description: "Provenance statements (via Sigstore) bind a published artifact to its recorded source and build.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#10-generate-provenance-statements",
+	docs: "https://github.com/bodadotsh/npm-security-best-practices#11-generate-provenance-statements",
 	id: "provenance",
 	projectTypes: ["package"],
 	severity: "warn",
 	title: "Publish with provenance"
 });
+const provenance = overrideBindings(baseRule, { npm: {
+	...baseRule.bindings.npm,
+	check(ctx, config) {
+		if (!isPublishable(ctx)) return { state: "na" };
+		const publishConfig = ctx.packageJson?.publishConfig;
+		if (!publishConfig || !Object.hasOwn(publishConfig, "provenance")) return baseRule.bindings.npm.check(ctx, config);
+		if (publishConfig.provenance === true) return { state: "ok" };
+		const file = CONFIG_FILES.packageJson;
+		return {
+			state: "violation",
+			file: file.path,
+			actual: publishConfig.provenance,
+			expected: true,
+			message: "Set publishConfig.provenance=true in package.json (and publish from CI) to attest releases.",
+			remediation: guardRemediationAvailability("npm", ctx.pmVersion, proposeChanges(ctx.readConfig(file), [{
+				file,
+				op: "setKey",
+				keyPath: ["publishConfig", "provenance"],
+				value: true
+			}]))
+		};
+	}
+} });
 //#endregion
-//#region src/domain/rules/publish-access.ts
+//#region src/core/rules/publish-access.ts
 const { packageJson } = CONFIG_FILES;
 const publishAccessBinding = {
 	check(ctx) {
@@ -1884,7 +1990,7 @@ const publishAccess = defineRule({
 	title: "Declare publish access explicitly"
 });
 //#endregion
-//#region src/domain/rules/store-server.ts
+//#region src/core/rules/store-server.ts
 const { pnpmWorkspace: pnpmWorkspace$1 } = CONFIG_FILES;
 const storeServer = defineRule({
 	bindings: { pnpm: {
@@ -1901,17 +2007,17 @@ const storeServer = defineRule({
 				state: "violation"
 			};
 		},
-		docs: "https://pnpm.io/settings#userunningStoreserver",
+		docs: "https://pnpm.io/settings/store#userunningstoreserver",
 		file: pnpmWorkspace$1
 	} },
 	description: "Flag use of an external store server process, which introduces a trust boundary where tampered packages could be served.",
-	docs: "https://pnpm.io/settings#userunningStoreserver",
+	docs: "https://pnpm.io/settings/store#userunningstoreserver",
 	id: "store-server",
 	severity: "info",
 	title: "Review store server usage"
 });
 //#endregion
-//#region src/domain/rules/strict-allow-scripts.ts
+//#region src/core/rules/strict-allow-scripts.ts
 const { npmrc } = CONFIG_FILES;
 const strictAllowScripts = defineRule({
 	bindings: { npm: {
@@ -1953,7 +2059,7 @@ const strictAllowScripts = defineRule({
 	title: "Require explicit script allow-listing"
 });
 //#endregion
-//#region src/domain/rules/strict-release-age.ts
+//#region src/core/rules/strict-release-age.ts
 const { aubeWorkspace: aubeWorkspace$2 } = CONFIG_FILES;
 const strictReleaseAge = withAubeParanoid(requireConfigKey({
 	bindings: { aube: {
@@ -1970,7 +2076,7 @@ const strictReleaseAge = withAubeParanoid(requireConfigKey({
 	title: "Enforce strict release age gate"
 }));
 //#endregion
-//#region src/domain/rules/strict-store-integrity.ts
+//#region src/core/rules/strict-store-integrity.ts
 const { aubeWorkspace: aubeWorkspace$1 } = CONFIG_FILES;
 const strictStoreIntegrity = defineRule({
 	bindings: { aube: {
@@ -2010,20 +2116,21 @@ const strictStoreIntegrity = defineRule({
 	title: "Require tarball integrity metadata"
 });
 //#endregion
-//#region src/domain/rules/trust-policy.ts
+//#region src/core/rules/trust-policy.ts
 const { aubeWorkspace, pnpmWorkspace } = CONFIG_FILES;
 const trustPolicy = withAubeParanoid(requireConfigKey({
 	bindings: {
 		aube: {
 			docs: "https://aube.jdx.dev/security.html",
 			documentedDefault: "no-downgrade",
+			defaultSafety: "unconditional",
 			file: aubeWorkspace,
 			keyPath: ["trustPolicy"],
 			message: "Set `trustPolicy: no-downgrade` in aube-workspace.yaml to block packages whose trust level has decreased.",
 			value: "no-downgrade"
 		},
 		pnpm: {
-			docs: "https://pnpm.io/settings#trustpolicy",
+			docs: "https://pnpm.io/settings/dependency-resolution#trustpolicy",
 			file: pnpmWorkspace,
 			keyPath: ["trustPolicy"],
 			message: "Set `trustPolicy: no-downgrade` in pnpm-workspace.yaml to block packages whose trust level has decreased.",
@@ -2032,15 +2139,15 @@ const trustPolicy = withAubeParanoid(requireConfigKey({
 		}
 	},
 	description: "Fail installation when a package trust level has decreased compared to previous releases, catching publisher credential downgrades.",
-	docs: "https://pnpm.io/settings#trustpolicy",
+	docs: "https://pnpm.io/settings/dependency-resolution#trustpolicy",
 	id: "trust-policy",
 	severity: "warn",
 	title: "Enforce trust policy on dependency updates"
 }));
 //#endregion
-//#region src/domain/rules/unsupported-settings.ts
-const bindingFor = (pm) => {
-	const settings = settingAvailability.filter((setting) => setting.pm === pm);
+//#region src/core/rules/unsupported-settings.ts
+const bindingFor = (pm, includesFile) => {
+	const settings = settingAvailability.filter((setting) => setting.pm === pm && includesFile(setting.file.path));
 	return { check(ctx) {
 		const version = ctx.pmVersion;
 		if (version === void 0) return { state: "na" };
@@ -2063,22 +2170,23 @@ const bindingFor = (pm) => {
 		} : { state: "ok" };
 	} };
 };
-const unsupportedSettings = defineRule({
+const createUnsupportedSettings = (includesFile) => defineRule({
 	id: "unsupported-settings",
 	title: "Use settings available in the target PM version",
-	description: "Report configured settings whose recorded introduction version is newer than the declared or explicit stable PM target. Reports each affected file separately, grouping its unsupported keys. Workspace findings retain their member directory. Only the coverage table below is checked. Unknown targets and unlisted settings are not evaluated for availability.",
+	description: "Report configured settings whose recorded introduction version is newer than the declared or explicit stable PM target. Reports each affected file separately, grouping its unsupported keys. Findings retain their evaluation directory. Only the coverage table below is checked. Unknown targets and unlisted settings are not evaluated for availability.",
 	severity: "error",
 	docs: "https://github.com/pHo9UBenaA/siro/blob/main/docs/rules.md#unsupported-settings--error",
 	bindings: {
-		npm: bindingFor("npm"),
-		pnpm: bindingFor("pnpm"),
-		yarn: bindingFor("yarn"),
-		bun: bindingFor("bun"),
-		deno: bindingFor("deno")
+		npm: bindingFor("npm", includesFile),
+		pnpm: bindingFor("pnpm", includesFile),
+		yarn: bindingFor("yarn", includesFile),
+		bun: bindingFor("bun", includesFile),
+		deno: bindingFor("deno", includesFile)
 	}
 });
+const unsupportedSettings = createUnsupportedSettings(() => true);
 //#endregion
-//#region src/domain/builtin-rules.ts
+//#region src/core/rules/builtin-rules.ts
 const createBuiltinRules = (time) => [
 	advisoryCheck,
 	approvedGitRepos,
@@ -2109,448 +2217,57 @@ const createBuiltinRules = (time) => [
 	trustPolicy,
 	unsupportedSettings
 ];
-//#endregion
-//#region src/composition/rules.ts
-/** Read time at evaluation, never at module initialization. */
-const rules = createBuiltinRules({
-	now: () => Date.now(),
-	parse: (value) => Date.parse(value)
-});
-//#endregion
-//#region src/adapters/workspace-globs.ts
-const MAX_WORKSPACE_GLOB_ALTERNATIVES = 8192;
-const BRACE_EXPANSION_PROBE_LIMIT = 8193;
-const boundedBraceExpand = (pattern) => {
-	const alternatives = braceExpand(pattern, { braceExpandMax: BRACE_EXPANSION_PROBE_LIMIT });
-	if (alternatives.length > MAX_WORKSPACE_GLOB_ALTERNATIVES) throw new ConfigError(`Workspace pattern expands beyond ${MAX_WORKSPACE_GLOB_ALTERNATIVES} alternatives.`);
-	return alternatives;
-};
-/** Expand with minimatch's own bounded brace semantics. */
-const expandWorkspaceGlob = (pattern) => {
+const builtinScope = {
+	"advisory-check": "installation",
+	"approved-git-repos": "installation",
+	"audit-suppression": "installation",
+	"block-auto-install": "installation",
+	"block-exotic-subdeps": "installation",
+	"bun-security-scanner": "installation",
+	"checksum-verification": "installation",
+	"commit-lockfile": "installation",
+	"dependency-overrides": "installation",
+	"disable-lifecycle-scripts": "installation",
+	"enforce-strict-ssl": "installation",
+	"files-field": "manifest",
+	"frozen-lockfile": "installation",
+	"frozen-store": "installation",
+	"hardened-mode": "installation",
+	"minimum-release-age": "installation",
+	"named-registries": "installation",
+	"paranoid-mode": "installation",
+	"patched-dependencies": "installation",
+	"pin-exact-versions": "installation",
+	provenance: "installation",
+	"publish-access": "manifest",
+	"store-server": "installation",
+	"strict-allow-scripts": "installation",
+	"strict-release-age": "installation",
+	"strict-store-integrity": "installation",
+	"trust-policy": "installation",
+	"unsupported-settings": "split"
+};
+const scopeOf = (id) => Object.hasOwn(builtinScope, id) ? builtinScope[id] : "custom";
+//#endregion
+//#region src/adapters/exclusions.ts
+const compileExclusions = (patterns) => {
 	try {
-		return boundedBraceExpand(pattern);
-	} catch (error) {
-		if (error instanceof TypeError) throw new ConfigError(`Invalid workspace pattern: ${error.message}.`);
-		throw error;
-	}
-};
-/** Engine choices live here; the application supplies only PM matching policy. */
-const engineOptions = (options) => {
-	if (options.kind === "declaration") return {};
-	return {
-		platform: "linux",
-		windowsPathsNoEscape: true,
-		nonegate: true,
-		nocomment: !options.hashComments,
-		nocase: options.caseInsensitive,
-		dot: options.includeDotDirectories ?? false,
-		nobrace: options.syntax === "wildcards",
-		noext: options.syntax === "wildcards" || options.extendedPatterns === false,
-		optimizationLevel: options.syntax === "shell" ? 2 : 1
-	};
-};
-/** Compile once so membership, exclusions, and traversal share glob semantics. */
-const compileWorkspaceGlob = (pattern, options) => {
-	let matcher;
-	try {
-		const settings = engineOptions(options);
-		if (!settings.nobrace) boundedBraceExpand(pattern);
-		matcher = new Minimatch(options.kind === "directory" && options.syntax === "wildcards" ? pattern.replace(/[[\]]/gu, (character) => character === "[" ? "[[]" : "[]]") : pattern, {
-			...settings,
-			braceExpandMax: BRACE_EXPANSION_PROBE_LIMIT
-		});
+		const matchers = patterns.map((pattern) => new Minimatch(pattern.replace(/(?:\/\*\*)+$/u, "").replace(/[\\[\]]/gu, "\\$&"), {
+			dot: true,
+			nocase: false,
+			nonegate: true,
+			nocomment: true,
+			nobrace: true,
+			noext: true,
+			platform: "linux"
+		}));
+		return (directory) => matchers.some((matcher) => matcher.match(directory));
 	} catch (error) {
-		if (error instanceof TypeError) throw new ConfigError(`Invalid workspace pattern: ${error.message}.`);
-		throw error;
-	}
-	return {
-		matches: (directory) => matcher.match(directory),
-		canDescend(directory) {
-			const parts = directory.split("/");
-			return matcher.set.some((alternative) => (alternative.includes(GLOBSTAR) || parts.length < alternative.length) && matcher.matchOne(parts, alternative, true));
-		}
-	};
-};
-const minimatchGlobs = {
-	expand: expandWorkspaceGlob,
-	compile: compileWorkspaceGlob
-};
-//#endregion
-//#region src/domain/services/parse-config-file.ts
-const EMPTY_FILE = Object.freeze({});
-/** Create a fresh parser and cache for one lint command. */
-const createConfigParser = (codecFor, ctx) => {
-	const cache = /* @__PURE__ */ new Map();
-	return (file) => {
-		if (file === void 0) return EMPTY_FILE;
-		const cacheKey = `${file.kind}:${file.path}`;
-		const cached = cache.get(cacheKey);
-		if (cached !== void 0) return cached;
-		const text = ctx.readText(file.path);
-		if (text === void 0) {
-			cache.set(cacheKey, EMPTY_FILE);
-			return EMPTY_FILE;
-		}
-		const parsed = wrapCodecError(file.path, () => codecFor(file.kind).parse(text));
-		cache.set(cacheKey, parsed);
-		return parsed;
-	};
-};
-//#endregion
-//#region src/application/workspace-pattern.ts
-/** Detect the basic * and ? markers shared across workspace dialects. */
-const hasBasicWorkspaceWildcard = (pattern) => pattern.includes("*") || pattern.includes("?");
-/** Workspace declarations use POSIX separators regardless of the host platform. */
-const stripTrailingWorkspaceSlashes = (pattern) => {
-	let end = pattern.length;
-	while (end > 0 && pattern[end - 1] === "/") end -= 1;
-	return pattern.slice(0, end);
-};
-//#endregion
-//#region src/application/workspace-prefix.ts
-/** Anchor Deno's native literal prefix before applying its glob suffix. */
-const anchorWorkspacePrefix = (pattern, glob, resolveChild) => {
-	const parts = pattern.split("/");
-	const firstWildcard = parts.findIndex(hasBasicWorkspaceWildcard);
-	const prefix = parts.slice(0, firstWildcard < 0 ? parts.length : firstWildcard);
-	if (prefix.length === 0 || pattern === ".") return glob;
-	const declared = prefix.join("/");
-	let resolved;
-	let attempted = false;
-	const resolve = () => {
-		if (!attempted) {
-			attempted = true;
-			let current = ".";
-			for (const part of prefix) {
-				const child = resolveChild(current, part);
-				if (child === void 0) return void 0;
-				current = current === "." ? child : `${current}/${child}`;
-			}
-			resolved = current;
-		}
-		return resolved;
-	};
-	const rewrite = (directory, actual) => directory === actual ? declared : directory.startsWith(`${actual}/`) ? declared + directory.slice(actual.length) : void 0;
-	return {
-		matches(directory) {
-			if (directory === ".") return false;
-			const actual = resolve();
-			const rewritten = actual === void 0 ? void 0 : rewrite(directory, actual);
-			return rewritten !== void 0 && glob.matches(rewritten);
-		},
-		canDescend(directory) {
-			const actual = resolve();
-			if (actual === void 0) return false;
-			if (directory === "." || actual.startsWith(`${directory}/`)) return true;
-			const rewritten = rewrite(directory, actual);
-			return rewritten !== void 0 && glob.canDescend(rewritten);
-		}
-	};
-};
-//#endregion
-//#region src/application/workspace-glob-policy.ts
-const workspaceGlobOptions = (caseInsensitive) => ({
-	kind: "directory",
-	syntax: "shell",
-	caseInsensitive
-});
-//#endregion
-//#region src/application/workspace-dialects.ts
-const containsUnsupportedAubeGlobSyntax = (pattern) => /[[\]{}()]/u.test(pattern);
-const matchesCrossPathGlob = (pattern, value) => {
-	const patternCharacters = [...pattern];
-	const valueCharacters = [...value];
-	let patternIndex = 0;
-	let valueIndex = 0;
-	let starIndex = -1;
-	let retryIndex = 0;
-	while (valueIndex < valueCharacters.length) {
-		const character = patternCharacters[patternIndex];
-		if (character === "?" || character === valueCharacters[valueIndex]) {
-			patternIndex += 1;
-			valueIndex += 1;
-		} else if (character === "*") {
-			starIndex = patternIndex;
-			retryIndex = valueIndex;
-			patternIndex += 1;
-		} else if (starIndex >= 0) {
-			patternIndex = starIndex + 1;
-			retryIndex += 1;
-			valueIndex = retryIndex;
-		} else return false;
-	}
-	while (patternCharacters[patternIndex] === "*") patternIndex += 1;
-	return patternIndex === patternCharacters.length;
-};
-/** The bounded glob subset verified against the recorded Deno/Aube sources. */
-const compileAdditionalWorkspaceGlob = (pattern, pm, excluded, caseInsensitive, globs) => {
-	const parts = pattern.split("/");
-	if (parts.some((part) => part.includes("**") && part !== "**")) throw new ConfigError(`${pm}: ** must occupy an entire workspace path component.`);
-	if (pm === "aube" && (containsUnsupportedAubeGlobSyntax(pattern) || pattern.includes("**") && (parts.at(-1) !== "**" || hasBasicWorkspaceWildcard(parts.slice(0, -1).join("/"))))) throw new ConfigError("Aube workspace inspection supports literals, * and ?, and a trailing ** after a literal prefix; other glob forms are not yet supported.");
-	const matcher = globs.compile(pattern, {
-		kind: "directory",
-		syntax: "wildcards",
-		includeDotDirectories: pm === "aube",
-		caseInsensitive: pm === "deno" && (hasBasicWorkspaceWildcard(pattern) || caseInsensitive)
-	});
-	if (pm === "deno" && hasBasicWorkspaceWildcard(pattern)) {
-		const files = globs.compile(`${pattern}/package.json`, {
-			kind: "directory",
-			syntax: "wildcards",
-			caseInsensitive: true
-		});
-		return {
-			...matcher,
-			matches: (directory) => files.matches(directory === "." ? "package.json" : `${directory}/package.json`)
-		};
-	}
-	if (pm !== "aube" || !excluded) return matcher;
-	const self = pattern.endsWith("/**") ? pattern.slice(0, -3) : void 0;
-	return {
-		...matcher,
-		matches: (directory) => matchesCrossPathGlob(pattern, directory) || directory === self
-	};
-};
-//#endregion
-//#region src/application/workspaces.ts
-/** npm cancels an earlier exclusion when a later positive pattern matches it. */
-const splitNpmPattern = (raw) => {
-	const prefix = /^!+/u.exec(raw)?.[0] ?? "";
-	return {
-		excluded: prefix.length % 2 === 1,
-		pattern: raw.slice(prefix.length)
-	};
-};
-const npmPatterns = (patterns, globs) => {
-	const positive = [];
-	let negative = [];
-	for (const raw of patterns) {
-		const parsed = splitNpmPattern(raw);
-		const pattern = parsed.pattern.replace(/^\.?\/+/u, "");
-		if (parsed.excluded) negative.push({
-			pattern,
-			glob: globs.compile(pattern, { kind: "declaration" })
-		});
-		else {
-			for (let index = 0; index < negative.length; index += 1) if (negative[index]?.glob.matches(pattern)) negative.splice(index, 1);
-			positive.push(pattern);
-		}
-	}
-	return [...positive, ...negative.map(({ pattern }) => `!${pattern}`)];
-};
-/** Read declaration sources separately so Deno's two manifest sets stay distinct. */
-const workspaceDefinitions = (ctx, pm, dependencies) => {
-	const { codecFor, paths, globs } = dependencies;
-	const parse = createConfigParser(codecFor, ctx);
-	const validate = (value, source, denoManifests = false) => {
-		if (value === void 0) return {
-			patterns: [],
-			denoManifests
-		};
-		if (!Array.isArray(value) || !Array.from(value).every((item) => typeof item === "string")) throw new ConfigError(`${source}: expected an array of directory patterns.`);
-		for (const pattern of value) {
-			const positive = pm === "npm" ? splitNpmPattern(pattern).pattern : pattern.startsWith("!") ? pattern.slice(1) : pattern;
-			if ((pm === "deno" || pm === "aube" ? [positive] : globs.expand(positive)).some((alternative) => !isRelPath(alternative) || alternative.includes("\\") || alternative.startsWith("!"))) throw new ConfigError(`${source}: use relative directory patterns without parent traversal: ${JSON.stringify(pattern)}.`);
-			if (pm === "deno" && denoManifests && !pattern.startsWith("!") && paths.normalizePattern(positive) === ".") throw new ConfigError(`${source}: a Deno workspace cannot contain itself.`);
-		}
-		return {
-			patterns: pm === "npm" ? npmPatterns(value, globs) : value,
-			denoManifests
-		};
-	};
-	const packageDefinition = () => {
-		let value = ctx.packageJson?.workspaces;
-		if (isPlainRecord(value)) {
-			value = value.packages;
-			if (value === void 0) throw new ConfigError("package.json#workspaces: expected a packages array.");
-		}
-		return validate(value, "package.json#workspaces");
-	};
-	if (pm === "pnpm") return [validate(ctx.exists(CONFIG_FILES.pnpmWorkspace.path) ? parse(CONFIG_FILES.pnpmWorkspace).packages : void 0, "pnpm-workspace.yaml#packages")];
-	if (pm === "aube") {
-		const file = [CONFIG_FILES.aubeWorkspace, CONFIG_FILES.pnpmWorkspace].find((candidate) => ctx.exists(candidate.path));
-		return [file ? validate(parse(file).packages, `${file.path}#packages`) : packageDefinition()];
-	}
-	if (pm === "deno") return [validate(parse(CONFIG_FILES.denoJson).workspace, "deno.json#workspace", true), packageDefinition()];
-	return [packageDefinition()];
-};
-/** Traverse only ordinary directories that can fall under a positive pattern. */
-const workspaceDirectories = (ctx, fs, definition, pm, dependencies) => {
-	const { codecFor, paths, globs, caseInsensitiveGlobs } = dependencies;
-	const defaultWorkspaceGlobOptions = workspaceGlobOptions(caseInsensitiveGlobs);
-	const { patterns } = definition;
-	const skipVendor = pm === "deno" && createConfigParser(codecFor, ctx)(CONFIG_FILES.denoJson).vendor === true;
-	const positive = patterns.filter((pattern) => !pattern.startsWith("!")).map((pattern) => stripTrailingWorkspaceSlashes(paths.normalizePattern(pattern)));
-	const negative = patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => stripTrailingWorkspaceSlashes(paths.normalizePattern(pattern.slice(1))));
-	const directoryCache = /* @__PURE__ */ new Map();
-	const readDirectories = (directory) => {
-		const cached = directoryCache.get(directory);
-		if (cached) return cached;
-		if (!fs.readDirectories) throw new UsageError("Workspace discovery requires FileSystem.readDirectories; no host filesystem fallback is used.");
-		const names = fs.readDirectories(paths.resolve(ctx.root, asRelPath(directory)));
-		if (!Array.isArray(names)) throw new ConfigError("FileSystem.readDirectories must return an array of directory names.");
-		for (const name of Array.from(names)) if (!isRelPath(name) || name === "." || name === ".." || /[\\/]/u.test(name)) throw new ConfigError("FileSystem.readDirectories returned an invalid child directory name.");
-		const result = [...new Set(names)].sort();
-		directoryCache.set(directory, result);
-		return result;
-	};
-	const resolveChild = (parent, name) => {
-		if (name === ".git" || name === "node_modules") return void 0;
-		const names = readDirectories(parent);
-		const resolved = names.includes(name) ? name : fs.resolveDirectory?.(paths.resolve(ctx.root, asRelPath(parent)), name);
-		if (resolved !== void 0 && !names.includes(resolved)) throw new ConfigError("FileSystem.resolveDirectory must return an enumerated ordinary child directory name.");
-		return resolved === ".git" || resolved === "node_modules" ? void 0 : resolved;
-	};
-	const compile = (pattern, excluded = false) => {
-		if (pm !== "deno" && pm !== "aube") return globs.compile(pattern, pm === "npm" ? {
-			...defaultWorkspaceGlobOptions,
-			hashComments: true
-		} : defaultWorkspaceGlobOptions);
-		const glob = compileAdditionalWorkspaceGlob(pattern, pm, excluded, caseInsensitiveGlobs, globs);
-		return pm === "deno" && !excluded ? anchorWorkspacePrefix(pattern, glob, resolveChild) : glob;
-	};
-	const included = positive.map((pattern) => compile(pattern));
-	const excluded = negative.map((pattern) => {
-		return {
-			glob: compile(pattern, true),
-			subtree: pm === "deno" || pm === "aube" || pm === "bun" ? void 0 : pattern === "**" ? { matches: () => true } : pattern.endsWith("/**") ? compile(pattern.slice(0, -3), true) : void 0
-		};
-	});
-	const declaredBase = (pattern) => {
-		const parts = pattern.split("/");
-		const wildcard = parts.findIndex(hasBasicWorkspaceWildcard);
-		return parts.slice(0, wildcard < 0 ? parts.length : wildcard).join("/") || ".";
-	};
-	const relatedBases = (left, right) => left === "." || right === "." || left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
-	const denoPositive = pm === "deno" ? positive.filter(hasBasicWorkspaceWildcard).map((pattern) => ({
-		base: declaredBase(pattern),
-		scope: anchorWorkspacePrefix(declaredBase(pattern), {
-			matches: () => true,
-			canDescend: () => true
-		}, resolveChild)
-	})) : [];
-	const denoOrdered = pm === "deno" ? patterns.filter((pattern) => hasBasicWorkspaceWildcard(pattern) || pattern.startsWith("!")).map((raw) => {
-		const isExcluded = raw.startsWith("!");
-		const pattern = stripTrailingWorkspaceSlashes(paths.normalizePattern(isExcluded ? raw.slice(1) : raw));
-		const glob = compile(pattern, isExcluded);
-		if (!isExcluded) return {
-			excluded: false,
-			glob
-		};
-		return {
-			excluded: true,
-			glob: {
-				...glob,
-				matches(directory) {
-					if (!hasBasicWorkspaceWildcard(pattern)) return directory === pattern;
-					if (!glob.matches(directory)) return false;
-					const applicable = denoPositive.filter((item) => item.scope.matches(directory)).map((item) => relatedBases(item.base, declaredBase(pattern)));
-					if (applicable.some(Boolean) && applicable.some((value) => !value)) throw new ConfigError("Deno workspace exclusion has ambiguous overlapping bases; use consistent prefix spelling or separate non-overlapping patterns.");
-					return applicable.some(Boolean);
-				}
-			}
-		};
-	}) : [];
-	const bunPatterns = pm === "bun" ? patterns.map((raw) => {
-		const isExcluded = raw.startsWith("!");
-		const pattern = stripTrailingWorkspaceSlashes(paths.normalizePattern(isExcluded ? raw.slice(1) : raw));
-		const usesGlob = isExcluded || hasBasicWorkspaceWildcard(pattern) || pattern.includes("{") || pattern.includes("[");
-		const glob = globs.compile(pattern, {
-			...defaultWorkspaceGlobOptions,
-			extendedPatterns: false
-		});
-		const subtree = isExcluded && pattern.endsWith("/**") ? globs.compile(pattern.slice(0, -3), {
-			...defaultWorkspaceGlobOptions,
-			extendedPatterns: false
-		}) : void 0;
-		return {
-			isExcluded,
-			usesGlob,
-			glob,
-			matches: (directory) => glob.matches(directory) || glob.matches(`${directory}/`) || subtree?.matches(directory) === true
-		};
-	}) : [];
-	const bunOrdered = bunPatterns.filter(({ usesGlob }) => usesGlob);
-	const bunLiterals = bunPatterns.filter(({ isExcluded, usesGlob }) => !isExcluded && !usesGlob);
-	const bunTraversal = bunPatterns.filter(({ isExcluded }) => !isExcluded).map(({ glob }) => glob);
-	const denoLiteral = pm === "deno" ? positive.filter((pattern) => !hasBasicWorkspaceWildcard(pattern)).map((pattern) => compile(pattern)) : [];
-	if (definition.denoManifests && denoOrdered.findLast(({ glob }) => glob.matches("."))?.excluded === false) throw new ConfigError("deno.json#workspace: a Deno workspace cannot contain itself.");
-	if (positive.length === 0 || positive.every((pattern) => pattern === ".")) return [];
-	if (!fs.readDirectories) throw new UsageError("Workspace discovery requires FileSystem.readDirectories; no host filesystem fallback is used.");
-	const result = [];
-	const pending = ["."];
-	while (pending.length > 0) {
-		const current = pending.pop();
-		if (current === void 0) break;
-		for (const name of readDirectories(current)) {
-			if (name === ".git" || name === "node_modules") continue;
-			const directory = asRelPath(current === "." ? name : `${current}/${name}`);
-			if (pm === "bun" && name === "CMakeFiles" && !bunLiterals.some(({ glob }) => glob.matches(directory) || glob.canDescend(directory))) continue;
-			const inVendor = skipVendor && (directory === "vendor" || directory.startsWith("vendor/"));
-			if (inVendor && !denoLiteral.some((pattern) => pattern.matches(directory) || pattern.canDescend(directory))) continue;
-			const isExcluded = pm !== "deno" && excluded.some(({ glob }) => glob.matches(directory) || glob.matches(`${directory}/`));
-			if (excluded.some(({ subtree }) => subtree?.matches(directory))) continue;
-			const lastDenoMatch = denoOrdered.findLast(({ glob }) => glob.matches(directory));
-			const lastBunMatch = bunOrdered.findLast(({ matches }) => matches(directory));
-			if (pm === "deno" ? denoLiteral.some((pattern) => pattern.matches(directory)) || !inVendor && lastDenoMatch?.excluded === false : pm === "bun" ? bunLiterals.some(({ glob }) => glob.matches(directory)) || lastBunMatch?.isExcluded === false : !isExcluded && included.some((pattern) => pattern.matches(directory))) result.push(directory);
-			if ((pm === "bun" ? bunTraversal : inVendor ? denoLiteral : included).some((pattern) => pattern.canDescend(directory))) pending.push(directory);
-		}
+		throw new ConfigError(`exclude: ${error instanceof Error ? error.message : String(error)}`);
 	}
-	return result.sort();
-};
-//#endregion
-//#region src/application/workspace-contexts.ts
-/** Expand each manager's declarations into isolated publication contexts. */
-const collectWorkspaceMembers = (ctx, fs, pms, projectType, dependencies) => {
-	const { codecFor, createRepoContext, paths } = dependencies;
-	return pms.flatMap((pm) => {
-		const seen = /* @__PURE__ */ new Set();
-		return workspaceDefinitions(ctx, pm, dependencies).flatMap((definition) => workspaceDirectories(ctx, fs, definition, pm, dependencies).flatMap((directory) => {
-			const root = paths.resolve(ctx.root, directory);
-			const manifest = paths.resolve(root, asRelPath("package.json"));
-			const denoManifest = paths.resolve(root, asRelPath("deno.json"));
-			const denoJsonc = paths.resolve(root, asRelPath("deno.jsonc"));
-			const allowed = new Set(pm === "deno" ? [
-				manifest,
-				denoManifest,
-				denoJsonc
-			] : [manifest]);
-			const memberFs = {
-				exists: (file) => allowed.has(file) && fs.exists(file),
-				readText: (file) => allowed.has(file) ? fs.readText(file) : void 0
-			};
-			try {
-				const explicitMember = definition.patterns.some((pattern) => !pattern.startsWith("!") && !hasBasicWorkspaceWildcard(pattern) && stripTrailingWorkspaceSlashes(paths.normalizePattern(pattern)) === directory);
-				if (!definition.denoManifests && !fs.exists(manifest)) {
-					if (pm === "deno" && explicitMember) throw new ConfigError("Declared npm workspace member has no package.json.");
-					return [];
-				}
-				if (pm === "deno" && !fs.exists(denoManifest) && fs.exists(denoJsonc)) throw new ConfigError("deno.jsonc is not supported; use strict deno.json.");
-				const memberCtx = createRepoContext(root, memberFs, projectType);
-				if (!definition.denoManifests && !memberCtx.packageJson) return [];
-				if (!memberCtx.packageJson && !memberCtx.exists(asRelPath("deno.json"))) {
-					if (definition.denoManifests && explicitMember) throw new ConfigError("Declared Deno member has no deno.json or package.json.");
-					return [];
-				}
-				if (pm === "deno") {
-					if (createConfigParser(codecFor, memberCtx)(CONFIG_FILES.denoJson).workspace !== void 0 || memberCtx.packageJson?.workspaces !== void 0) throw new ConfigError("Nested workspace declarations are not supported by Deno.");
-				}
-				if (seen.has(directory)) return [];
-				seen.add(directory);
-				return [{
-					directory,
-					pm,
-					ctx: memberCtx
-				}];
-			} catch (error) {
-				if (error instanceof ConfigError) throw new ConfigError(`${directory}/${error.message}`);
-				throw error;
-			}
-		}));
-	});
 };
 //#endregion
-//#region src/domain/services/apply-config.ts
+//#region src/core/apply-config.ts
 /** Select active rules and keep user severity choices as explicit runtime data. */
 const applyConfig = (base, config) => {
 	const merged = [...base, ...config?.customRules ?? []];
@@ -2578,7 +2295,7 @@ const applyConfig = (base, config) => {
 	};
 };
 //#endregion
-//#region src/domain/services/detect-pms.ts
+//#region src/core/detect-pms.ts
 const registerSignals = (signals, pm, owner) => {
 	for (const file of signals) {
 		const prior = owner.get(file);
@@ -2610,24 +2327,25 @@ const detectPMs = (ctx) => {
 	return PMS.filter((pm) => found.has(pm));
 };
 //#endregion
-//#region src/domain/services/resolve-pms.ts
+//#region src/core/resolve-pms.ts
 /** Apply the explicit selection or detection, then the configured allow-list. */
 const resolvePMs = (ctx, opts) => {
 	const { pmOverride, allowed } = opts;
 	const detected = pmOverride ? [pmOverride] : detectPMs(ctx);
 	const pms = allowed ? detected.filter((pm) => allowed.includes(pm)) : detected;
 	if (pms.length > 0) return pms;
+	if (opts.optional && detected.length === 0) return [];
 	if (!allowed) throw new UsageError(`No package manager detected. Pass --pm <${PMS.join("|")}> to be explicit.`);
 	if (pmOverride) throw new UsageError(`--pm ${pmOverride} is not in siro.config.ts pms (${allowed.join(", ")}). Adjust the config or the flag.`);
 	if (detected.length > 0) throw new UsageError(`Detected PMs (${detected.join(", ")}) do not match siro.config.ts pms (${allowed.join(", ")}). Adjust the config or remove the restriction.`);
 	throw new UsageError(`No package manager detected, and siro.config.ts restricts pms to ${allowed.join(", ")}. Adjust the config or remove the restriction.`);
 };
 //#endregion
-//#region src/domain/services/decide-severity.ts
+//#region src/core/decide-severity.ts
 /** Resolve the most specific severity signal for one finding. */
 const decideSeverity = (status, binding, rule, userOverride) => userOverride ?? status.severity ?? binding.severity ?? rule.severity;
 //#endregion
-//#region src/domain/services/render-version-note.ts
+//#region src/core/render-version-note.ts
 const buildVersionNoteParts = (versionNote) => {
 	const parts = [];
 	if (typeof versionNote.configAvailableSince !== "undefined") parts.push(`available since ${versionNote.configAvailableSince}`);
@@ -2642,130 +2360,342 @@ const renderVersionNoteMessage = (message, versionNote) => {
 	return `${message} (${parts.join("; ")})`;
 };
 //#endregion
-//#region src/application/run-lint.ts
+//#region src/core/evaluate-binding.ts
+/** One response boundary for generic and PM-specific checks. Selection stays with callers. */
+const evaluateBinding = (repository, rule, binding, overrides, target) => {
+	const response = binding.check({
+		...repository.ctx,
+		readConfig: repository.parseConfig,
+		pmVersion: target?.version
+	}, repository.parseConfig(binding.file));
+	assertSynchronous(response, `Rule '${rule.id}' check`);
+	if (!isCheckStatusShape(response)) throw new ConfigError(`Rule '${rule.id}' returned an invalid check result.`);
+	return (response.state === "violations" ? response.violations : [response]).flatMap((status) => status.state !== "violation" ? [] : [{
+		ruleId: rule.id,
+		directory: ".",
+		...target ? { pm: target.pm } : {},
+		severity: decideSeverity(status, binding, rule, overrides?.get(rule.id)),
+		message: renderVersionNoteMessage(status.message, binding.versionNote),
+		file: status.file ?? binding.file?.path,
+		docs: binding.docs ?? rule.docs,
+		actual: status.actual,
+		expected: status.expected,
+		remediation: target ? guardRemediationAvailability(target.pm, target.version, status.remediation) : status.remediation
+	}]);
+};
+//#endregion
+//#region src/core/run-lint.ts
 const resolveBindingProjectType = (ctx, pm, parseConfig) => {
 	if (ctx.projectType !== void 0) return ctx.projectType;
-	if (pm === "deno") return resolveDenoProjectType(ctx, parseConfig(CONFIG_FILES.denoJson));
-	return resolvePackageJsonProjectType(ctx);
+	return pm === "deno" ? resolveDenoProjectType(ctx, parseConfig(CONFIG_FILES.denoJson)) : resolvePackageJsonProjectType(ctx);
 };
-/** Evaluate every applicable rule binding and collect violations. */
+/** Select applicable PM bindings; response handling is shared with manifest checks. */
 const runLint = (opts) => {
-	const { ctx, pms, ruleSet, severityOverrides, codecFor } = opts;
+	const { repository, pms, ruleSet, severityOverrides } = opts;
 	const findings = [];
+	for (const rule of ruleSet) for (const pm of pms) {
+		const binding = rule.bindings[pm];
+		if (!binding || rule.projectTypes && !rule.projectTypes.includes(resolveBindingProjectType(repository.ctx, pm, repository.parseConfig))) continue;
+		findings.push(...evaluateBinding(repository, rule, binding, severityOverrides, {
+			pm,
+			version: opts.pmVersions?.[pm]
+		}));
+	}
 	const summary = {
 		error: 0,
 		info: 0,
 		warn: 0
 	};
-	const parseConfig = createConfigParser(codecFor, ctx);
-	for (const rule of ruleSet) for (const pm of pms) {
-		const binding = rule.bindings[pm];
-		if (!binding || rule.projectTypes && !rule.projectTypes.includes(resolveBindingProjectType(ctx, pm, parseConfig))) continue;
-		const ruleContext = {
-			...ctx,
-			readConfig: parseConfig,
-			pmVersion: opts.pmVersions?.[pm]
-		};
-		const response = binding.check(ruleContext, parseConfig(binding.file));
-		if (!isCheckStatusShape(response)) throw new ConfigError(`Rule '${rule.id}' returned an invalid check result.`);
-		const statuses = response.state === "violations" ? response.violations : [response];
-		for (const status of statuses) {
-			if (status.state !== "violation") continue;
-			const finding = {
-				ruleId: rule.id,
-				pm,
-				severity: decideSeverity(status, binding, rule, severityOverrides?.get(rule.id)),
-				message: renderVersionNoteMessage(status.message, binding.versionNote),
-				file: status.file ?? binding.file?.path,
-				docs: binding.docs ?? rule.docs,
-				actual: status.actual,
-				expected: status.expected,
-				remediation: guardRemediationAvailability(pm, ruleContext.pmVersion, status.remediation)
-			};
-			findings.push(finding);
-			summary[finding.severity] += 1;
-		}
-	}
+	for (const finding of findings) summary[finding.severity] += 1;
 	return {
 		findings,
 		summary
 	};
 };
 //#endregion
-//#region src/application/lint.ts
-/** Evaluate a repository without reporting or executing configuration files. */
-const prepareLint = (options, dependencies) => {
-	const { paths, codecFor, createRepoContext } = dependencies;
+//#region src/core/contracts/deno-json.ts
+/** Validate consumed publication metadata, not Deno's entire versioned schema. */
+const validateDenoMetadata = (config) => {
+	const name = getByPath(config, ["name"]);
+	if (name != null && typeof name !== "string") throw new ConfigError("deno.json: name must be a string or null.");
+	const publish = getByPath(config, ["publish"]);
+	if (publish == null || typeof publish === "boolean") return;
+	if (!isPlainRecord(publish)) throw new ConfigError("deno.json: publish must be a boolean, object or null.");
+	const include = getByPath(publish, ["include"]);
+	if (include != null && (!Array.isArray(include) || !Array.from(include).every((item) => typeof item === "string"))) throw new ConfigError("deno.json: publish.include must be a string array or null.");
+};
+//#endregion
+//#region src/core/parse-config-file.ts
+const EMPTY_FILE = Object.freeze({});
+/** Create a lazy parser for one repository context; callers own its lifetime. */
+const createConfigParser = (codecFor, ctx) => {
+	const cache = /* @__PURE__ */ new Map();
+	return (file) => {
+		if (file === void 0) return EMPTY_FILE;
+		const cacheKey = `${file.kind}:${file.path}`;
+		const cached = cache.get(cacheKey);
+		if (cached !== void 0) return cached;
+		const text = ctx.readText(file.path);
+		if (text === void 0) {
+			cache.set(cacheKey, EMPTY_FILE);
+			return EMPTY_FILE;
+		}
+		const parsed = wrapCodecError(file.path, () => codecFor(file.kind).parse(text));
+		cache.set(cacheKey, parsed);
+		return parsed;
+	};
+};
+/** Pair the context with a fresh lazy parser; construction performs no reads. */
+const createRepositoryEvaluation = (ctx, codecFor) => ({
+	ctx,
+	parseConfig: createConfigParser(codecFor, ctx)
+});
+//#endregion
+//#region src/core/discovery.ts
+/** One context per selected directory, shared by publication and installation passes. */
+const discover = (cwd, fs, excluded, projectType, dependencies) => {
+	if (typeof fs.readDirectories !== "function") throw new ConfigError("FileSystem.readDirectories is required for package discovery; no native filesystem fallback is used.");
+	const { paths, createRepoContext, codecFor } = dependencies;
+	const pending = [asRelPath(".")];
+	const directories = [];
+	while (pending.length) {
+		const directory = pending.pop();
+		const absolute = paths.resolve(cwd, directory);
+		let repository;
+		const manifests = [];
+		try {
+			repository = createRepositoryEvaluation(createRepoContext(absolute, fs, projectType), codecFor);
+			const { ctx, parseConfig } = repository;
+			if (ctx.packageJson !== void 0) manifests.push("package.json");
+			if (ctx.readText(CONFIG_FILES.denoJson.path) !== void 0) {
+				validateDenoMetadata(parseConfig(CONFIG_FILES.denoJson));
+				manifests.push("deno.json");
+			} else if (ctx.exists(asRelPath("deno.jsonc"))) throw new ConfigError("deno.jsonc is not supported; use strict deno.json.");
+		} catch (error) {
+			if (error instanceof ConfigError && directory !== ".") throw new ConfigError(`${directory}/${error.message}`);
+			throw error;
+		}
+		directories.push({
+			directory,
+			repository,
+			manifests
+		});
+		const names = fs.readDirectories(absolute);
+		if (!Array.isArray(names)) throw new ConfigError(`${directory}: FileSystem.readDirectories must return a dense array.`);
+		const children = /* @__PURE__ */ new Set();
+		for (let i = 0; i < names.length; i += 1) {
+			if (!Object.hasOwn(names, i)) throw new ConfigError(`${directory}: FileSystem.readDirectories must return a dense array.`);
+			const child = paths.child(directory, names[i]);
+			if (names[i] === ".git" || names[i] === "node_modules" || excluded(child) || children.has(child)) continue;
+			children.add(child);
+			pending.push(child);
+		}
+	}
+	return directories.sort((a, b) => a.directory < b.directory ? -1 : a.directory > b.directory ? 1 : 0);
+};
+//#endregion
+//#region src/core/manifest-checks.ts
+const manifestProjectType = (repository, file) => file === "deno.json" ? resolveDenoProjectType(repository.ctx, repository.parseConfig(CONFIG_FILES.denoJson)) : resolvePackageJsonProjectType(repository.ctx);
+const selectBinding = {
+	"files-field": (file) => file === "deno.json" ? denoPublishBinding : packageJsonFilesBinding,
+	"publish-access": (file, repository, targets) => {
+		if (file !== "package.json") return void 0;
+		return repository.ctx.packageJson?.publishConfig?.access === "private" && targets.length > 0 ? "pm" : publishAccessBinding;
+	}
+};
+const checkManifest = (repository, file, targets, rules, overrides) => {
+	const findings = [];
+	const projectType = manifestProjectType(repository, file);
+	const pms = targets.map((target) => target.pm);
+	const pmVersions = Object.fromEntries(targets.map((target) => [target.pm, target.version]));
+	for (const rule of rules) {
+		if (rule.projectTypes && !rule.projectTypes.includes(projectType)) continue;
+		if (rule.id === "unsupported-settings") findings.push(...runLint({
+			repository,
+			pms,
+			pmVersions,
+			ruleSet: [{
+				...rule,
+				bindings: createUnsupportedSettings((path) => path === file).bindings
+			}],
+			severityOverrides: overrides
+		}).findings);
+		else if (Object.hasOwn(selectBinding, rule.id)) {
+			const binding = selectBinding[rule.id](file, repository, targets);
+			if (binding === "pm") findings.push(...runLint({
+				repository,
+				pms,
+				pmVersions,
+				ruleSet: [rule],
+				severityOverrides: overrides
+			}).findings);
+			else if (binding) findings.push(...evaluateBinding(repository, rule, binding, overrides));
+		}
+	}
+	return findings;
+};
+//#endregion
+//#region src/core/rebase-finding.ts
+/** Context-local rule output becomes cwd-relative once, without mutating rule-owned data. */
+const rebaseFinding = (directory, finding) => {
+	if (directory === ".") return {
+		...finding,
+		directory
+	};
+	const remediation = finding.remediation;
+	const rebaseOperation = (operation) => ({
+		...operation,
+		file: {
+			...operation.file,
+			path: `${directory}/${operation.file.path}`
+		}
+	});
+	return {
+		...finding,
+		directory,
+		...finding.file === void 0 ? {} : { file: `${directory}/${finding.file}` },
+		remediation: remediation?.kind === "automatic" ? {
+			...remediation,
+			operations: [rebaseOperation(remediation.operations[0]), ...remediation.operations.slice(1).map(rebaseOperation)]
+		} : remediation?.kind === "manual" ? {
+			...remediation,
+			steps: [`Work in ${directory} for this finding.`, ...remediation.steps]
+		} : remediation
+	};
+};
+//#endregion
+//#region src/core/lint.ts
+const validateLintOptions = (options, paths) => {
 	if (!options || !paths.isAbsolute(options.cwd)) throw new UsageError("cwd must be an absolute filesystem path.");
+	if ("workspaces" in options) throw new UsageError("workspaces was removed in 0.6.0. Package discovery is recursive by default; use exclude and installationRoots to specify scope.");
 	if ("customRules" in options || "reporters" in options) throw new UsageError("Pass customRules and reporters inside the config option.");
 	if (options.pm !== void 0 && !isPM(options.pm)) throw new UsageError(`Unknown package manager: ${String(options.pm)}`);
 	if (options.projectType !== void 0 && !isProjectType(options.projectType)) throw new UsageError(`Unknown project type: ${String(options.projectType)}`);
 	if (options.pmVersion !== void 0 && (!options.pm || !isStableVersion(options.pmVersion))) throw new UsageError("pmVersion / --pm-version requires pm / --pm and an exact stable version such as 10.16.0.");
-	if (options.workspaces !== void 0 && typeof options.workspaces !== "boolean") throw new UsageError("workspaces must be a boolean.");
+};
+/** Validate inputs and prepare shared contexts, without running rules or child executable configs. */
+const prepareLint = (options, dependencies) => {
+	validateLintOptions(options, dependencies.paths);
 	const config = options.config === void 0 ? void 0 : parseConfig(options.config);
 	const fs = options.fs === void 0 ? dependencies.fileSystem : options.fs;
-	const ctx = createRepoContext(options.cwd, fs, options.projectType ?? config?.projectType);
-	const pms = resolvePMs(ctx, {
-		allowed: config?.pms,
-		pmOverride: options.pm
-	});
-	if (pms.includes("deno") && !ctx.exists(asRelPath("deno.json")) && ctx.exists(asRelPath("deno.jsonc"))) throw new ConfigError("deno.jsonc is not supported. siro currently reads strict JSON from deno.json only.");
+	const excluded = dependencies.compileExclusions(parseExcludes(options.exclude !== void 0 ? options.exclude : config?.exclude ?? []));
+	const installations = parseInstallationRoots(options.installationRoots !== void 0 ? options.installationRoots : config?.installationRoots ?? ["."]);
 	const configured = applyConfig(dependencies.rules, config);
+	const needsCustomTarget = configured.rules.some((rule) => scopeOf(rule.id) === "custom");
+	const discovered = discover(options.cwd, fs, excluded, options.projectType ?? config?.projectType, dependencies);
+	for (const entry of installations) if (!discovered.some((item) => item.directory === entry.path)) throw new UsageError(`${entry.path}: installation root must be an existing, selected ordinary directory using its exact enumerated spelling (no symlinks, excluded or hard-skipped paths).`);
 	return {
-		ctx,
-		pms,
-		pmVersions: {
-			...declaredPMVersion(ctx.packageJson?.packageManager),
-			...config?.pmVersions,
-			...options.pm && options.pmVersion ? { [options.pm]: options.pmVersion } : {}
+		evaluation: {
+			directories: discovered.map((item) => {
+				const { ctx } = item.repository;
+				const entry = installations.find((root) => root.path === item.directory);
+				let pms;
+				let versions = declaredPMVersion(ctx.packageJson?.packageManager);
+				if (item.directory === ".") {
+					pms = resolvePMs(ctx, {
+						allowed: config?.pms,
+						pmOverride: options.pm,
+						optional: !entry && !needsCustomTarget
+					});
+					versions = {
+						...versions,
+						...config?.pmVersions,
+						...options.pm && options.pmVersion ? { [options.pm]: options.pmVersion } : {}
+					};
+				} else if (entry) {
+					try {
+						pms = resolvePMs(ctx, { pmOverride: entry.pm });
+					} catch (error) {
+						if (error instanceof UsageError) throw new UsageError(`${item.directory}: ${error.message}`);
+						throw error;
+					}
+					if (entry.pm && entry.pmVersion) versions = {
+						...versions,
+						[entry.pm]: entry.pmVersion
+					};
+				} else {
+					const declared = ctx.packageJson?.packageManager === void 0 ? void 0 : parsePackageManagerField(ctx.packageJson.packageManager);
+					pms = PMS.filter((pm) => pm === declared || pm === "deno" && item.manifests.includes("deno.json"));
+				}
+				return {
+					...item,
+					installation: entry !== void 0,
+					targets: pms.map((pm) => ({
+						pm,
+						...versions[pm] === void 0 ? {} : { version: versions[pm] }
+					}))
+				};
+			}),
+			ruleSet: configured.rules,
+			severityOverrides: configured.severityOverrides
 		},
-		members: options.workspaces ? collectWorkspaceMembers(ctx, fs, pms, options.projectType ?? config?.projectType, dependencies) : [],
-		ruleSet: configured.rules,
-		severityOverrides: configured.severityOverrides,
-		codecFor,
 		reporters: config?.reporters ?? []
 	};
 };
-/** Reuse the existing manifest checks; installation policy remains rooted at cwd. */
-const runPreparedLint = (prepared) => {
-	const result = runLint(prepared);
-	const findings = [...result.findings];
-	const summary = { ...result.summary };
-	const memberRules = prepared.ruleSet.filter((rule) => [
-		"files-field",
-		"publish-access",
-		"unsupported-settings"
-	].includes(rule.id));
-	for (const member of prepared.members) {
-		const child = runLint({
-			...prepared,
-			ctx: member.ctx,
-			pms: [member.pm],
-			ruleSet: memberRules
+const runPreparedLint = (evaluation) => {
+	const { directories, ruleSet, severityOverrides } = evaluation;
+	const findings = [];
+	const manifests = [];
+	const installationRoots = [];
+	const ruleOrder = new Map(ruleSet.map((rule, index) => [rule.id, index]));
+	for (const item of directories) {
+		const { directory, repository, targets, installation } = item;
+		const local = [];
+		for (const file of item.manifests) {
+			const manifestTargets = targets.filter(({ pm }) => file === "deno.json" ? pm === "deno" : pm !== "deno");
+			manifests.push({
+				path: directory === "." ? file : `${directory}/${file}`,
+				projectType: manifestProjectType(repository, file),
+				targets: manifestTargets
+			});
+			local.push(...checkManifest(repository, file, manifestTargets, ruleSet, severityOverrides));
+		}
+		if (installation) installationRoots.push({
+			directory,
+			targets
 		});
-		for (const finding of child.findings) findings.push({
-			...finding,
-			file: `${member.directory}/${finding.file ?? "package.json"}`,
-			message: `${member.directory}: ${finding.message}`,
-			remediation: finding.remediation?.kind === "manual" ? {
-				kind: "manual",
-				steps: [`Work in ${member.directory} for this finding.`, ...finding.remediation.steps]
-			} : finding.remediation
+		const scopedRules = ruleSet.flatMap((rule) => {
+			const scope = scopeOf(rule.id);
+			if (scope === "installation" && installation || scope === "custom" && directory === ".") return [rule];
+			if (scope === "split" && installation) return [{
+				...rule,
+				bindings: createUnsupportedSettings((file) => file !== "package.json" && file !== "deno.json").bindings
+			}];
+			return [];
 		});
-		for (const level of [
-			"error",
-			"warn",
-			"info"
-		]) summary[level] += child.summary[level];
+		try {
+			local.push(...runLint({
+				repository,
+				pms: targets.map(({ pm }) => pm),
+				pmVersions: Object.fromEntries(targets.map(({ pm, version }) => [pm, version])),
+				ruleSet: scopedRules,
+				severityOverrides
+			}).findings);
+		} catch (error) {
+			if (error instanceof ConfigError && directory !== ".") throw new ConfigError(`${directory}/${error.message}`);
+			throw error;
+		}
+		local.sort((a, b) => (ruleOrder.get(a.ruleId) ?? 0) - (ruleOrder.get(b.ruleId) ?? 0));
+		findings.push(...local.map((finding) => rebaseFinding(directory, finding)));
 	}
+	const summary = {
+		error: 0,
+		warn: 0,
+		info: 0
+	};
+	for (const finding of findings) summary[finding.severity] += 1;
 	return {
 		findings,
-		summary
+		summary,
+		inspection: {
+			manifests,
+			installationRoots
+		}
 	};
 };
-const lint$1 = (options, dependencies) => runPreparedLint(prepareLint(options, dependencies));
+const lint$1 = (options, dependencies) => runPreparedLint(prepareLint(options, dependencies).evaluation);
 //#endregion
-//#region src/domain/services/filter.ts
+//#region src/core/filter.ts
 const EXIT_SUCCESS = 0;
 const EXIT_FAILURE = 1;
 const meetsThreshold = (severity, threshold) => SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
@@ -2782,6 +2712,7 @@ const filterBySeverity = (result, threshold) => {
 		summary[finding.severity] += 1;
 	}
 	return {
+		...result,
 		findings,
 		summary
 	};
@@ -2795,7 +2726,7 @@ const exitCodeForLint = (result, threshold = "error") => {
 	return EXIT_SUCCESS;
 };
 //#endregion
-//#region src/application/commands/lint.ts
+//#region src/core/lint-command.ts
 /** Evaluate and report. Executable config loading belongs to the CLI adapter. */
 const lintCommand$1 = async (options, io, dependencies, reporters) => {
 	if (!options) throw new UsageError("Lint options are required.");
@@ -2805,23 +2736,53 @@ const lintCommand$1 = async (options, io, dependencies, reporters) => {
 	const selection = options.reporter ?? reporters.defaultName;
 	const reporter = typeof selection === "string" ? registry.get(selection) : selection;
 	if (!isReporterShape(reporter)) throw new UsageError(`${typeof selection === "string" ? "Unknown" : "Invalid"} reporter: ${String(selection)} (available: ${[...registry.keys()].join(", ")})`);
-	const result = runPreparedLint(prepared);
+	const result = runPreparedLint(prepared.evaluation);
 	const exitCode = exitCodeForLint(result, options.severity ?? "error");
-	await reporter.format(filterBySeverity(result, options.severity ?? "info"), io);
+	const writes = [];
+	let outputFailed = false;
+	let outputFailure;
+	const recordFailure = (error) => {
+		if (!outputFailed) {
+			outputFailed = true;
+			outputFailure = error;
+		}
+	};
+	const track = (write) => (line) => {
+		try {
+			const written = write(line);
+			writes.push(Promise.resolve(written).then(() => {}, recordFailure));
+			return written;
+		} catch (error) {
+			recordFailure(error);
+			throw error;
+		}
+	};
+	try {
+		await reporter.format(filterBySeverity(result, options.severity ?? "info"), {
+			stdout: track((line) => io.stdout(line)),
+			stderr: track((line) => io.stderr(line))
+		}, { cwd: options.cwd });
+	} finally {
+		await Promise.all(writes);
+	}
+	if (outputFailed) throw outputFailure;
 	return exitCode;
 };
 //#endregion
-//#region src/domain/schemas/package-json.ts
+//#region src/core/contracts/package-json.ts
 const PackageJsonSchema = vb.looseObject({
 	files: vb.optional(vb.array(vb.string())),
 	name: vb.optional(vb.string()),
 	packageManager: vb.optional(vb.string()),
 	private: vb.optional(vb.boolean()),
-	publishConfig: vb.optional(vb.looseObject({ access: vb.optional(vb.picklist([
-		"public",
-		"restricted",
-		"private"
-	])) })),
+	publishConfig: vb.optional(vb.looseObject({
+		access: vb.optional(vb.picklist([
+			"public",
+			"restricted",
+			"private"
+		])),
+		provenance: vb.optional(vb.boolean())
+	})),
 	trustedDependencies: vb.optional(vb.array(vb.string()))
 });
 const parsePackageJson = (value) => {
@@ -2848,9 +2809,15 @@ const readPackageJson = (raw) => {
 };
 const createRepoContext = (root, fs = nodeFileSystem, projectType) => {
 	if (fs === nodeFileSystem) assertDirectory(root);
-	const readText = (relPath) => fs.readText(resolveIn(root, relPath));
+	const packageFile = resolveIn(root, asRelPath("package.json"));
+	const raw = fs.readText(packageFile);
+	const texts = new Map([[packageFile, raw]]);
+	const readText = (relPath) => {
+		const file = resolveIn(root, relPath);
+		if (!texts.has(file)) texts.set(file, fs.readText(file));
+		return texts.get(file);
+	};
 	const exists = (relPath) => fs.exists(resolveIn(root, relPath));
-	const raw = readText(asRelPath("package.json"));
 	let packageJson = void 0;
 	if (typeof raw !== "undefined") packageJson = readPackageJson(raw);
 	return {
@@ -2917,33 +2884,40 @@ const escapeData = (raw) => raw.replaceAll("%", "%25").replaceAll("\r", "%0D").r
 const escapeProp = (raw) => escapeData(raw).replaceAll(":", "%3A").replaceAll(",", "%2C");
 /** Emit GitHub Actions workflow commands (annotations on PRs). */
 const githubReporter = {
-	format(result, io) {
+	async format(result, io, context) {
 		for (const finding of result.findings) {
 			let file = "";
-			if (finding.file) file = `file=${escapeProp(finding.file)},`;
-			let body = `[${finding.pm}] ${finding.message}`;
+			if (finding.file) file = `file=${escapeProp(path.resolve(context.cwd, finding.file))},`;
+			let body = `[${finding.pm ?? "package"}] ${finding.directory}: ${finding.message}`;
 			if (finding.docs) body += ` (${finding.docs})`;
-			io.stdout(`::${COMMAND[finding.severity]} ${file}title=${escapeProp(finding.ruleId)}::${escapeData(body)}`);
+			await io.stdout(`::${COMMAND[finding.severity]} ${file}title=${escapeProp(finding.ruleId)}::${escapeData(body)}`);
 		}
 	},
 	name: "github"
 };
 //#endregion
+//#region src/adapters/safe-text.ts
+/** Visible escaping for untrusted human-facing text; never rewrite API/native paths. */
+const safeText = (text) => text.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/gu, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`).replaceAll("##[", "#\\u0023[").replace(/^(\s*)::/u, "$1\\u003a:");
+/** JSON syntax and decoded values stay identical; CI must not parse legacy commands in it. */
+const safeJsonText = (json) => json.replace(/[\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/gu, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`).replaceAll("##[", "\\u0023\\u0023[");
+//#endregion
 //#region src/adapters/reporters/json.ts
 /**
 * Versioned machine-readable output — the public contract consumed by
 * external fixers (see docs/json-output.md). Bump `schemaVersion` on any
 * breaking shape change and update that doc in the same commit.
 */
-const SCHEMA_VERSION = 2;
+const SCHEMA_VERSION = 3;
 const jsonReporter = {
-	format(result, io) {
-		io.stdout(JSON.stringify({
+	async format(result, io) {
+		await io.stdout(safeJsonText(JSON.stringify({
 			schemaVersion: SCHEMA_VERSION,
 			siroVersion: version,
 			findings: result.findings,
-			summary: result.summary
-		}, void 0, 2));
+			summary: result.summary,
+			inspection: result.inspection
+		}, void 0, 2)));
 	},
 	name: "json"
 };
@@ -2970,12 +2944,11 @@ const colorSupportedNow = () => {
 	return pc.isColorSupported;
 };
 const renderFinding = (finding, ctx) => {
-	let where = "";
-	if (finding.file) where = ctx.colors.dim(` (${finding.file})`);
-	ctx.io.stdout(`${ctx.tag[finding.severity](GLYPH[finding.severity])}  [${finding.pm}] ${ctx.colors.bold(finding.ruleId)}${where}`);
-	ctx.io.stdout(`    ${finding.message}`);
-	for (const step of finding.remediation?.kind === "manual" ? finding.remediation.steps : []) ctx.io.stdout(`    ↳ ${step}`);
-	if (finding.docs) ctx.io.stdout(ctx.colors.dim(`    → ${finding.docs}`));
+	const where = ctx.colors.dim(` (${safeText(finding.file ?? finding.directory)})`);
+	ctx.io.stdout(`${ctx.tag[finding.severity](GLYPH[finding.severity])}  [${finding.pm ?? "package"}] ${ctx.colors.bold(safeText(finding.ruleId))}${where}`);
+	ctx.io.stdout(`    ${safeText(finding.message)}`);
+	for (const step of finding.remediation?.kind === "manual" ? finding.remediation.steps : []) ctx.io.stdout(`    ↳ ${safeText(step)}`);
+	if (finding.docs) ctx.io.stdout(ctx.colors.dim(`    → ${safeText(finding.docs)}`));
 };
 const buildRenderCtx = (io) => {
 	const colors = pc.createColors(colorSupportedNow());
@@ -2990,16 +2963,25 @@ const buildRenderCtx = (io) => {
 	};
 };
 const prettyReporter = {
-	format(result, io) {
-		const ctx = buildRenderCtx(io);
-		if (result.findings.length === 0) {
-			io.stdout(ctx.colors.green("✔ No security best-practice issues found."));
-			return;
+	async format(result, io) {
+		const lines = [];
+		const collect = (line) => {
+			lines.push(line);
+		};
+		const ctx = buildRenderCtx({
+			stdout: collect,
+			stderr: collect
+		});
+		collect(`Inspection: ${result.inspection.manifests.length} manifests; installation roots: ${result.inspection.installationRoots.map((root) => safeText(root.directory)).join(", ") || "none"}.`);
+		collect("Unknown PM/version targets have no availability assessment; installation scope is explicit.");
+		if (result.findings.length === 0) collect(ctx.colors.green("✔ No security best-practice issues found."));
+		else {
+			for (const finding of result.findings) renderFinding(finding, ctx);
+			const { error, warn, info } = result.summary;
+			collect("");
+			collect(`Summary: ${error} error, ${warn} warn, ${info} info`);
 		}
-		for (const finding of result.findings) renderFinding(finding, ctx);
-		const { error, warn, info } = result.summary;
-		io.stdout("");
-		io.stdout(`Summary: ${error} error, ${warn} warn, ${info} info`);
+		await io.stdout(lines.join("\n"));
 	},
 	name: "pretty"
 };
@@ -3016,16 +2998,16 @@ const JSON_REPORTER_NAME = jsonReporter.name;
 const BUILTIN_REPORTER_NAMES = BUILTINS.map((rep) => rep.name);
 /** Later registrations replace earlier reporters with the same name. */
 const createRegistry = (extras = []) => new Map([...BUILTINS, ...extras].map((reporter) => [reporter.name, reporter]));
-//#endregion
-//#region src/composition/lint.ts
 const dependencies = {
-	rules,
+	rules: createBuiltinRules({
+		now: () => Date.now(),
+		parse: (value) => Date.parse(value)
+	}),
 	fileSystem: nodeFileSystem,
 	paths: nodePaths,
 	createRepoContext,
 	codecFor,
-	globs: minimatchGlobs,
-	caseInsensitiveGlobs: process.platform === "darwin" || process.platform === "win32"
+	compileExclusions
 };
 /** Public Node API: callers can replace the filesystem without assembling the application. */
 const lint = (options) => lint$1(options, dependencies);
@@ -3035,11 +3017,47 @@ const lintCommand = (options, io) => lintCommand$1(options, io, dependencies, {
 });
 //#endregion
 //#region src/adapters/node-io.ts
-const nodeIO = {
-	stderr: (line) => process.stderr.write(`${line}\n`),
-	stdout: (line) => process.stdout.write(`${line}\n`)
+const writer = (stream) => {
+	let failure;
+	const pending = /* @__PURE__ */ new Set();
+	const fail = (cause) => {
+		failure ??= new Error(`Output failed: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+		for (const reject of pending) reject(failure);
+		pending.clear();
+		return failure;
+	};
+	let observing = false;
+	return (line) => {
+		if (!observing) {
+			observing = true;
+			stream.on("error", fail);
+			stream.on("close", () => fail(/* @__PURE__ */ new Error("Output stream closed.")));
+		}
+		return new Promise((resolve, reject) => {
+			if (failure || stream.destroyed) {
+				reject(failure ?? fail(/* @__PURE__ */ new Error("Output stream is destroyed.")));
+				return;
+			}
+			pending.add(reject);
+			try {
+				stream.write(`${line}\n`, (error) => {
+					pending.delete(reject);
+					if (error) reject(fail(error));
+					else resolve();
+				});
+			} catch (error) {
+				fail(error);
+			}
+		});
+	};
 };
+/** Node-only construction; keep streams and their errors outside the core. */
+const createNodeIO = (stdout, stderr) => ({
+	stdout: writer(stdout),
+	stderr: writer(stderr)
+});
+const nodeIO = createNodeIO(process.stdout, process.stderr);
 //#endregion
-export { ConfigError as A, SUPPORTED_NODE_RANGE as C, isNodeError as D, nodeFileSystem as E, UsageError as M, asAbsPath as O, isSupportedNodeVersion as S, assertDirectory as T, isProjectType as _, DEFAULT_REPORTER_NAME as a, isPM as b, jsonReporter as c, requireConfigKey as d, CONFIG_FILES as f, PROJECT_TYPES as g, getByPath as h, BUILTIN_REPORTER_NAMES as i, SiroError as j, asRelPath as k, githubReporter as l, defineRule as m, lint as n, JSON_REPORTER_NAME as o, loadConfig as p, lintCommand as r, prettyReporter as s, nodeIO as t, overrideBindings as u, PMS as v, version as w, isSeverity as x, SEVERITIES as y };
+export { asRelPath as A, isSupportedNodeVersion as C, nodeFileSystem as D, assertDirectory as E, SiroError as M, UsageError as N, isNodeError as O, isSeverity as S, version as T, PROJECT_TYPES as _, DEFAULT_REPORTER_NAME as a, SEVERITIES as b, jsonReporter as c, overrideBindings as d, requireConfigKey as f, getByPath as g, defineRule as h, BUILTIN_REPORTER_NAMES as i, ConfigError as j, asAbsPath as k, safeText as l, loadConfig as m, lint as n, JSON_REPORTER_NAME as o, CONFIG_FILES as p, lintCommand as r, prettyReporter as s, nodeIO as t, githubReporter as u, isProjectType as v, SUPPORTED_NODE_RANGE as w, isPM as x, PMS as y };
 
-//# sourceMappingURL=node-io-BDHg4J2w.mjs.map
+//# sourceMappingURL=node-io-CAszdmko.mjs.map