@pho9ubenaa/siro 0.5.1 → 0.6.1

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import * as vb from "valibot";
 
-//#region src/shared/paths.d.ts
+//#region src/core/contracts/paths.d.ts
 declare const AbsPathBrand: unique symbol;
 declare const RelPathBrand: unique symbol;
 type AbsPath = string & {
@@ -11,7 +11,7 @@ type RelPath = string & {
 };
 declare const asRelPath: (value: string) => RelPath;
 //#endregion
-//#region src/domain/entities/config-value.d.ts
+//#region src/core/contracts/config-value.d.ts
 declare const CODEC_KINDS: readonly ["json", "npmrc", "toml", "yaml"];
 type CodecKind = (typeof CODEC_KINDS)[number];
 /** Scalar value that can be written back to a config file. */
@@ -27,18 +27,19 @@ type ConfigReadValue = unknown;
 /** Read an own key path; absent or non-mapping parents yield undefined. */
 declare const getByPath: (config: ParsedConfig, keyPath: KeyPath) => ConfigReadValue;
 //#endregion
-//#region src/domain/entities/config-file-ref.d.ts
+//#region src/core/contracts/config-file-ref.d.ts
 /** A repository-relative configuration location, independent of any rule. */
 interface ConfigFileRef {
   readonly kind: CodecKind;
   readonly path: RelPath;
 }
 //#endregion
-//#region src/domain/entities/pms.d.ts
+//#region src/core/contracts/pms.d.ts
 /**
  * Single source of truth for package managers and severities.
- * Types, runtime sets, and ordering are all derived from these tuples — add a
- * package manager here and the rest of the codebase follows.
+ * Types, runtime sets, and ordering derive from these tuples. Adding a manager
+ * still requires local detection signals, applicable rule bindings and verified
+ * policy/availability evidence; the tuple alone does not implement support.
  */
 declare const PMS: readonly ["npm", "pnpm", "yarn", "bun", "deno", "aube"];
 type PM = (typeof PMS)[number];
@@ -47,7 +48,7 @@ type Severity = (typeof SEVERITIES)[number];
 declare const isPM: (value: string) => value is PM;
 declare const isSeverity: (value: string) => value is Severity;
 //#endregion
-//#region src/domain/schemas/package-json.d.ts
+//#region src/core/contracts/package-json.d.ts
 declare const PackageJsonSchema: vb.LooseObjectSchema<{
   readonly files: vb.OptionalSchema<vb.ArraySchema<vb.StringSchema<undefined>, undefined>, undefined>;
   readonly name: vb.OptionalSchema<vb.StringSchema<undefined>, undefined>;
@@ -55,16 +56,17 @@ declare const PackageJsonSchema: vb.LooseObjectSchema<{
   readonly private: vb.OptionalSchema<vb.BooleanSchema<undefined>, undefined>;
   readonly publishConfig: vb.OptionalSchema<vb.LooseObjectSchema<{
     readonly access: vb.OptionalSchema<vb.PicklistSchema<["public", "restricted", "private"], undefined>, undefined>;
+    readonly provenance: vb.OptionalSchema<vb.BooleanSchema<undefined>, undefined>;
   }, undefined>, undefined>;
   readonly trustedDependencies: vb.OptionalSchema<vb.ArraySchema<vb.StringSchema<undefined>, undefined>, undefined>;
 }, undefined>;
 type PackageJson = vb.InferOutput<typeof PackageJsonSchema>;
 //#endregion
-//#region src/domain/entities/project-type.d.ts
+//#region src/core/contracts/project-type.d.ts
 declare const PROJECT_TYPES: readonly ["application", "package"];
 type ProjectType = (typeof PROJECT_TYPES)[number];
 //#endregion
-//#region src/domain/ports/repo-context.d.ts
+//#region src/core/contracts/repo-context.d.ts
 /** Read-only view of a repository, passed to every rule's `check`. */
 interface RepoContext {
   readonly root: AbsPath;
@@ -80,7 +82,7 @@ interface RuleContext extends RepoContext {
   readConfig: (file: ConfigFileRef) => ParsedConfig;
 }
 //#endregion
-//#region src/domain/entities/rule.d.ts
+//#region src/core/contracts/rule.d.ts
 interface SetKeyOperation {
   readonly op: 'setKey';
   readonly file: ConfigFileRef;
@@ -116,7 +118,7 @@ type CheckStatus = {
   readonly state: 'violations'; /** Independent findings; a rule chooses its own grouping granularity. */
   readonly violations: readonly [ViolationStatus, ...ViolationStatus[]];
 };
-/** Display-only package-manager version metadata. */
+/** Display-only annotations: presence and wording never change policy. */
 interface VersionNote {
   readonly configAvailableSince?: string;
   readonly defaultSafeSince?: string;
@@ -143,62 +145,105 @@ interface Rule<Id extends string = string> {
 }
 declare const defineRule: <const Id extends string>(rule: Rule<Id>) => Rule<Id>;
 //#endregion
-//#region src/domain/ports/file-system.d.ts
+//#region src/core/contracts/file-system.d.ts
 /** IO boundary: swap in memfs (or any other backend) for tests. */
 interface FileSystem {
-  /** Ordinary child directory names, excluding symlinks. Required only for workspace discovery. Errors must propagate. */
-  readDirectories?: (path: AbsPath) => readonly string[];
-  /** Resolve one ordinary child using this filesystem's native name semantics, returning its enumerated name. No symlinks. Undefined for absence; other errors propagate. Without this optional port, Deno literal prefixes use exact names from readDirectories. */
-  resolveDirectory?: (parent: AbsPath, name: string) => string | undefined;
+  /** Ordinary native child directory names, excluding symlinks. Required for recursive discovery. Errors must propagate. */
+  readDirectories: (path: AbsPath) => readonly string[];
   /** Read a regular file (including a symlink to one); undefined only for ENOENT. Other errors and non-file entries must throw. */
   readText: (path: AbsPath) => string | undefined;
   /** True for a regular file (including a symlink to one); false only for ENOENT. Other errors and non-file entries must throw. */
   exists: (path: AbsPath) => boolean;
 }
 //#endregion
-//#region src/domain/ports/date-time.d.ts
-/** Host time and native date parsing, including the host timezone for offsetless input. */
-interface DateTime {
-  now: () => number;
-  parse: (value: string) => number;
-}
-//#endregion
-//#region src/domain/builtin-rules.d.ts
-declare const createBuiltinRules: (time: DateTime) => readonly [Rule<"advisory-check">, Rule<"approved-git-repos">, Rule<"audit-suppression">, Rule<"block-auto-install">, Rule<"block-exotic-subdeps">, Rule<"bun-security-scanner">, Rule<"checksum-verification">, Rule<"commit-lockfile">, Rule<"dependency-overrides">, Rule<"disable-lifecycle-scripts">, Rule<"enforce-strict-ssl">, Rule<"files-field">, Rule<"frozen-lockfile">, Rule<"frozen-store">, Rule<"hardened-mode">, Rule<"minimum-release-age">, Rule<"named-registries">, Rule<"paranoid-mode">, Rule<"patched-dependencies">, Rule<"pin-exact-versions">, Rule<"provenance">, Rule<"publish-access">, Rule<"store-server">, Rule<"strict-allow-scripts">, Rule<"strict-release-age">, Rule<"strict-store-integrity">, Rule<"trust-policy">, Rule<"unsupported-settings">];
-type BuiltinRuleId = ReturnType<typeof createBuiltinRules>[number]['id'];
-//#endregion
-//#region src/domain/ports/io.d.ts
-/** Output sink for commands; injectable so tests can drive a string buffer. */
+//#region src/core/contracts/io.d.ts
+/** Output sink. Synchronous return values are ignored; returned promises are awaited. */
 interface IO {
-  stdout: (line: string) => void;
-  stderr: (line: string) => void;
+  stdout: (line: string) => unknown;
+  stderr: (line: string) => unknown;
 }
 //#endregion
-//#region src/domain/entities/lint-result.d.ts
+//#region src/core/contracts/lint-result.d.ts
 interface Finding {
   readonly ruleId: string;
-  readonly pm: PM;
+  /** Absent for PM-neutral publication checks. */
+  readonly pm?: PM;
+  /** Evaluation directory relative to cwd; root is '.'. */
+  readonly directory: string;
   readonly severity: Severity;
   readonly message: string;
   readonly file?: string;
   readonly remediation?: Remediation;
   readonly expected?: ConfigValue;
   readonly actual?: ConfigReadValue;
-  /** Official PM doc anchor for the setting this finding is about, if any. */
   readonly docs?: string;
 }
+interface PolicyTarget {
+  readonly pm: PM;
+  /** Missing means unknown, not the installed binary's version. */
+  readonly version?: string;
+}
+interface Inspection {
+  readonly manifests: readonly {
+    readonly path: string;
+    readonly projectType: ProjectType; /** Empty means unknown: target-dependent availability is not evaluated. */
+    readonly targets: readonly PolicyTarget[];
+  }[];
+  readonly installationRoots: readonly {
+    readonly directory: string;
+    readonly targets: readonly PolicyTarget[];
+  }[];
+}
 interface LintResult {
   readonly findings: readonly Finding[];
   readonly summary: Readonly<Record<Severity, number>>;
+  /** Selected inputs, not an attestation that all security controls passed. */
+  readonly inspection: Inspection;
+}
+//#endregion
+//#region src/core/contracts/scan-limits.d.ts
+/** Finite per-scan budgets, controlled by the caller, never repository config. */
+interface ScanLimits {
+  readonly maxFileBytes: number;
+  readonly maxTotalBytes: number;
+  readonly maxEntries: number;
+  readonly maxDirectories: number;
+  readonly maxDirectoryDepth: number;
+  readonly maxConfigDepth: number;
+  readonly maxFindings: number;
+  readonly maxOutputBytes: number;
 }
+declare const DEFAULT_SCAN_LIMITS: Readonly<ScanLimits>;
 //#endregion
-//#region src/domain/ports/reporter.d.ts
+//#region src/core/contracts/reporter.d.ts
+interface ReportContext {
+  readonly cwd: AbsPath;
+  readonly limits?: ScanLimits;
+}
 interface Reporter<Name extends string = string> {
   readonly name: Name;
-  format: (result: LintResult, io: IO) => void | Promise<void>;
+  format: (result: LintResult, io: IO, context: ReportContext) => void | Promise<void>;
+}
+//#endregion
+//#region src/core/inspection-options.d.ts
+type InstallationRootInput = string | {
+  readonly path: string;
+  readonly pm?: PM;
+  readonly pmVersion?: string;
+};
+//#endregion
+//#region src/core/contracts/date-time.d.ts
+/** Host time and native date parsing, including the host timezone for offsetless input. */
+interface DateTime {
+  now: () => number;
+  parse: (value: string) => number;
 }
 //#endregion
-//#region src/domain/entities/siro-config.d.ts
+//#region src/core/rules/builtin-rules.d.ts
+declare const createBuiltinRules: (time: DateTime) => readonly [Rule<"advisory-check">, Rule<"approved-git-repos">, Rule<"audit-suppression">, Rule<"block-auto-install">, Rule<"block-exotic-subdeps">, Rule<"bun-security-scanner">, Rule<"checksum-verification">, Rule<"commit-lockfile">, Rule<"dependency-overrides">, Rule<"disable-lifecycle-scripts">, Rule<"enforce-strict-ssl">, Rule<"files-field">, Rule<"frozen-lockfile">, Rule<"frozen-store">, Rule<"hardened-mode">, Rule<"minimum-release-age">, Rule<"named-registries">, Rule<"paranoid-mode">, Rule<"patched-dependencies">, Rule<"pin-exact-versions">, Rule<"provenance">, Rule<"publish-access">, Rule<"store-server">, Rule<"strict-allow-scripts">, Rule<"strict-release-age">, Rule<"strict-store-integrity">, Rule<"trust-policy">, Rule<"unsupported-settings">];
+type BuiltinRuleId = ReturnType<typeof createBuiltinRules>[number]['id'];
+//#endregion
+//#region src/core/siro-config.d.ts
 /** Per-rule setting. `'off'` disables; a Severity overrides the default level. */
 type RuleSetting = Severity | 'off';
 /**
@@ -212,6 +257,9 @@ type RuleSetting = Severity | 'off';
  *   })
  */
 interface SiroConfig {
+  readonly exclude?: readonly string[];
+  /** Replaces the default ['.']; [] disables installation checks, not manifest checks. */
+  readonly installationRoots?: readonly InstallationRootInput[];
   readonly pms?: readonly PM[];
   /** Exact stable target versions; does not select managers or inspect installed binaries. */
   readonly pmVersions?: Readonly<Partial<Record<PM, string>>>;
@@ -223,32 +271,37 @@ interface SiroConfig {
 /** Identity helper for type-checked config files. */
 declare const defineConfig: (config: SiroConfig) => SiroConfig;
 //#endregion
-//#region src/application/lint.d.ts
+//#region src/core/lint.d.ts
 interface LintOptions {
   readonly cwd: AbsPath;
   readonly fs?: FileSystem;
+  /** Caller-controlled finite budgets; omitted values use DEFAULT_SCAN_LIMITS. */
+  readonly limits?: Partial<ScanLimits>;
+  /** Reject file/path symlinks in the native adapter; not an atomic containment sandbox. */
+  readonly rejectSymlinks?: boolean;
+  /** Applies only to cwd, never to discovered children or additional installation roots. */
   readonly pm?: PM;
-  /** Exact stable version for `pm`; overrides config.pmVersions and packageManager. */
   readonly pmVersion?: string;
-  /** Also inspect declared workspace members' publication settings. */
-  readonly workspaces?: boolean;
+  readonly exclude?: readonly string[];
+  /** Replaces config/default ['.']; [] disables installation checks. */
+  readonly installationRoots?: readonly InstallationRootInput[];
   readonly projectType?: ProjectType;
   /** Explicit configuration; the library never imports files from the target repository. */
   readonly config?: SiroConfig;
 }
 //#endregion
-//#region src/application/commands/lint.d.ts
+//#region src/core/lint-command.d.ts
 interface LintCommandOptions extends LintOptions {
   readonly reporter?: string | Reporter;
   readonly severity?: Severity;
 }
 //#endregion
-//#region src/composition/lint.d.ts
+//#region src/runtime.d.ts
 /** Public Node API: callers can replace the filesystem without assembling the application. */
 declare const lint: (options: LintOptions) => LintResult;
 declare const lintCommand: (options: LintCommandOptions, io: IO) => Promise<number>;
 //#endregion
-//#region src/adapters/config-loader.d.ts
+//#region src/load-config.d.ts
 /** Load the first matching config; executable imports always use the real filesystem. */
 declare const loadConfig: (cwd: AbsPath, nodeVersion?: string) => Promise<SiroConfig | undefined>;
 //#endregion
@@ -269,13 +322,12 @@ declare const jsonReporter: Reporter<'json'>;
 declare const prettyReporter: Reporter<'pretty'>;
 //#endregion
 //#region src/adapters/reporters/registry.d.ts
-declare const BUILTINS: readonly [Reporter<"pretty">, Reporter<"json">, Reporter<"github">];
 /** Names of every built-in reporter, in stable display order. */
 declare const BUILTIN_REPORTER_NAMES: readonly BuiltinReporterName[];
 /** Literal union of every built-in reporter name. */
-type BuiltinReporterName = (typeof BUILTINS)[number]['name'];
+type BuiltinReporterName = (typeof prettyReporter | typeof jsonReporter | typeof githubReporter)['name'];
 //#endregion
-//#region src/domain/entities/config-files.d.ts
+//#region src/core/config-files.d.ts
 /** Known configuration locations and their parsers. */
 declare const CONFIG_FILES: {
   readonly aubeWorkspace: {
@@ -308,7 +360,8 @@ declare const CONFIG_FILES: {
   };
 };
 //#endregion
-//#region src/domain/rules/builders/require-config-key.d.ts
+//#region src/core/rules/builders/require-config-key.d.ts
+/** One public helper binding: setting requirement, safe-default policy and proposal. */
 interface RequireConfigKeySpec {
   readonly file: ConfigFileRef;
   readonly keyPath: KeyPath;
@@ -318,11 +371,10 @@ interface RequireConfigKeySpec {
   readonly docs?: string;
   readonly severity?: Severity;
   accept?: (actual: unknown) => boolean;
-  /**
-   * An omitted value that is safe across every supported version and target
-   * environment emits info. Version-dependent defaults retain full severity.
-   */
+  /** Recorded default value; does not establish safety without `defaultSafety`. */
   readonly documentedDefault?: ConfigValue;
+  /** Only unconditional defaults may reduce severity; omitted means conditional. */
+  readonly defaultSafety?: 'unconditional' | 'conditional';
   /**
    * Severity used when `documentedDefault` satisfies the requirement. Defaults
    * to `'info'` (advisory). Set `'off'` to silence the finding entirely.
@@ -346,7 +398,7 @@ declare const overrideBindings: <Id extends string>(rule: Rule<Id>, overrides: P
 /** Build a Rule from a per-PM table of {file, keyPath, value, message}. */
 declare const requireConfigKey: <const Id extends string>(options: RequireConfigKeyOptions<Id>) => Rule<Id>;
 //#endregion
-//#region src/shared/errors.d.ts
+//#region src/core/contracts/errors.d.ts
 declare class SiroError extends Error {
   readonly exitCode: number;
   constructor(message: string, exitCode: number);
@@ -364,5 +416,5 @@ declare const version: string;
 //#region src/adapters/node-paths.d.ts
 declare const asAbsPath: (value: string) => AbsPath;
 //#endregion
-export { type AbsPath, BUILTIN_REPORTER_NAMES, type BuiltinReporterName, CONFIG_FILES, type CheckStatus, ConfigError, type ConfigFileRef, type ConfigReadValue, type ConfigValue, type FileSystem, type Finding, type IO, type KeyPath, type LintCommandOptions, type LintOptions, type LintResult, type PM, PMS, PROJECT_TYPES, type ParsedConfig, type ProjectType, type RelPath, type Remediation, type RepoContext, type Reporter, type RequireConfigKeyOptions, type Rule, type RuleBinding, type RuleContext, type RuleSetting, SEVERITIES, type SetKeyOperation, type Severity, type SiroConfig, SiroError, UsageError, type VersionNote, type ViolationStatus, asAbsPath, asRelPath, defineConfig, defineRule, getByPath, githubReporter, isPM, isSeverity, jsonReporter, lint, lintCommand, loadConfig, nodeFileSystem, nodeIO, overrideBindings, prettyReporter, requireConfigKey, version };
+export { type AbsPath, BUILTIN_REPORTER_NAMES, type BuiltinReporterName, CONFIG_FILES, type CheckStatus, ConfigError, type ConfigFileRef, type ConfigReadValue, type ConfigValue, DEFAULT_SCAN_LIMITS, type FileSystem, type Finding, type IO, type Inspection, type InstallationRootInput, type KeyPath, type LintCommandOptions, type LintOptions, type LintResult, type PM, PMS, PROJECT_TYPES, type ParsedConfig, type PolicyTarget, type ProjectType, type RelPath, type Remediation, type RepoContext, type ReportContext, type Reporter, type RequireConfigKeyOptions, type RequireConfigKeySpec, type Rule, type RuleBinding, type RuleContext, type RuleSetting, SEVERITIES, type ScanLimits, type SetKeyOperation, type Severity, type SiroConfig, SiroError, UsageError, type VersionNote, type ViolationStatus, asAbsPath, asRelPath, defineConfig, defineRule, getByPath, githubReporter, isPM, isSeverity, jsonReporter, lint, lintCommand, loadConfig, nodeFileSystem, nodeIO, overrideBindings, prettyReporter, requireConfigKey, version };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { A as ConfigError, E as nodeFileSystem, M as UsageError, O as asAbsPath, b as isPM, c as jsonReporter, d as requireConfigKey, f as CONFIG_FILES, g as PROJECT_TYPES, h as getByPath, i as BUILTIN_REPORTER_NAMES, j as SiroError, k as asRelPath, l as githubReporter, m as defineRule, n as lint, p as loadConfig, r as lintCommand, s as prettyReporter, t as nodeIO, u as overrideBindings, v as PMS, w as version, x as isSeverity, y as SEVERITIES } from "./node-io-BDHg4J2w.mjs";
-//#region src/domain/entities/siro-config.ts
+import { A as nodeFileSystem, C as isSeverity, D as asAbsPath, E as version, F as SiroError, I as UsageError, M as DEFAULT_SCAN_LIMITS, O as asRelPath, P as ConfigError, S as isPM, _ as PROJECT_TYPES, b as PMS, c as jsonReporter, d as overrideBindings, f as requireConfigKey, g as getByPath, h as defineRule, i as BUILTIN_REPORTER_NAMES, m as loadConfig, n as lint, p as CONFIG_FILES, r as lintCommand, s as prettyReporter, t as nodeIO, u as githubReporter, x as SEVERITIES } from "./node-io-BpAHyeBG.mjs";
+//#region src/core/siro-config.ts
 /** Identity helper for type-checked config files. */
 const defineConfig = (config) => config;
 //#endregion
-export { BUILTIN_REPORTER_NAMES, CONFIG_FILES, ConfigError, PMS, PROJECT_TYPES, SEVERITIES, SiroError, UsageError, asAbsPath, asRelPath, defineConfig, defineRule, getByPath, githubReporter, isPM, isSeverity, jsonReporter, lint, lintCommand, loadConfig, nodeFileSystem, nodeIO, overrideBindings, prettyReporter, requireConfigKey, version };
+export { BUILTIN_REPORTER_NAMES, CONFIG_FILES, ConfigError, DEFAULT_SCAN_LIMITS, PMS, PROJECT_TYPES, SEVERITIES, SiroError, UsageError, asAbsPath, asRelPath, defineConfig, defineRule, getByPath, githubReporter, isPM, isSeverity, jsonReporter, lint, lintCommand, loadConfig, nodeFileSystem, nodeIO, overrideBindings, prettyReporter, requireConfigKey, version };
 
 //# sourceMappingURL=index.mjs.map