@pho9ubenaa/siro 0.6.0 → 0.6.2

package/dist/node-io-CAszdmko.mjs

@@ -1,3063 +0,0 @@
-import path from "node:path";
-import { readFileSync, readdirSync, statSync } from "node:fs";
-import { pathToFileURL } from "node:url";
-import satisfies from "semver/functions/satisfies.js";
-import * as vb from "valibot";
-import { lt, parse } from "semver";
-import valid from "semver/functions/valid.js";
-import { Minimatch } from "minimatch";
-import ini from "ini";
-import { parse as parse$1 } from "smol-toml";
-import { parseDocument } from "yaml";
-import pc from "picocolors";
-//#region src/core/contracts/errors.ts
-var SiroError = class extends Error {
-	exitCode;
-	constructor(message, exitCode) {
-		super(message);
-		this.name = "SiroError";
-		this.exitCode = exitCode;
-	}
-};
-var ConfigError = class extends SiroError {
-	constructor(message) {
-		super(message, 2);
-		this.name = "ConfigError";
-	}
-};
-var UsageError = class extends SiroError {
-	constructor(message) {
-		super(message, 2);
-		this.name = "UsageError";
-	}
-};
-/**
-* Run `fn` and wrap any non-`ConfigError` failure as a `ConfigError` prefixed
-* with `filePath`. A `ConfigError` that bubbles up from a nested call is re-thrown unchanged so
-* the original `path: message` framing is preserved.
-*/
-const wrapCodecError = (filePath, fn) => {
-	try {
-		return fn();
-	} catch (error) {
-		if (error instanceof ConfigError) throw error;
-		let msg = String(error);
-		if (error instanceof Error) msg = error.message;
-		throw new ConfigError(`${filePath}: ${msg}`);
-	}
-};
-//#endregion
-//#region src/core/contracts/paths.ts
-const isRelPath = (value) => typeof value === "string" && value.length > 0 && !value.includes("\0") && !/^[\\/]/u.test(value) && !/^[a-z]:/iu.test(value) && !value.split(/[\\/]/u).includes("..");
-const asRelPath = (value) => {
-	if (!isRelPath(value)) throw new TypeError("Expected a repository-relative path without parent traversal.");
-	return value;
-};
-//#endregion
-//#region src/adapters/node-paths.ts
-const isAbsPath = (value) => typeof value === "string" && !value.includes("\0") && path.isAbsolute(value);
-const asAbsPath = (value) => {
-	if (!isAbsPath(value)) throw new TypeError("Expected an absolute filesystem path.");
-	return value;
-};
-const nodePaths = {
-	isAbsolute: isAbsPath,
-	resolve(root, relative) {
-		if (typeof relative !== "string" || relative.includes("\0") || path.isAbsolute(relative) || relative.split(path.sep === "\\" ? /[\\/]/u : /\//u).includes("..")) throw new ConfigError(`Invalid repository-relative path: ${String(relative)}`);
-		const resolved = path.join(root, relative);
-		const within = path.relative(root, resolved);
-		if (within === ".." || within.startsWith(`..${path.sep}`) || path.isAbsolute(within)) throw new ConfigError("Path escapes repository root.");
-		return asAbsPath(resolved);
-	},
-	child(parent, name) {
-		if (typeof name !== "string" || !name || name === "." || name === ".." || name.includes("\0") || name.includes("/") || path.sep === "\\" && (name.includes("\\") || name.includes(":"))) throw new ConfigError(`FileSystem.readDirectories returned an invalid child directory name: ${String(name)}`);
-		return parent === "." ? name : `${parent}/${name}`;
-	}
-};
-//#endregion
-//#region src/adapters/node-errors.ts
-/** Only the Error and code properties are established by this guard. */
-const isNodeError = (value) => value instanceof Error && "code" in value && typeof value.code === "string";
-//#endregion
-//#region src/adapters/node-file-system.ts
-const assertRegularFile = (filePath) => {
-	if (!statSync(filePath).isFile()) throw new ConfigError(`${filePath}: expected a regular file.`);
-};
-const nodeFileSystem = {
-	readDirectories(directory) {
-		return readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-	},
-	exists(filePath) {
-		try {
-			assertRegularFile(filePath);
-			return true;
-		} catch (error) {
-			if (isNodeError(error) && error.code === "ENOENT") return false;
-			throw error;
-		}
-	},
-	readText(filePath) {
-		try {
-			assertRegularFile(filePath);
-			return readFileSync(filePath, "utf8");
-		} catch (error) {
-			if (isNodeError(error) && error.code === "ENOENT") return;
-			throw error;
-		}
-	}
-};
-const resolveIn = (root, relPath) => nodePaths.resolve(root, relPath);
-const assertDirectory = (root) => {
-	if (!statSync(root).isDirectory()) throw new UsageError("The lint target must be a directory.");
-};
-//#endregion
-//#region package.json
-var version$1 = "0.6.0";
-var engines = { "node": "^22.18.0 || ^24.0.0" };
-//#endregion
-//#region src/version.ts
-const version = version$1;
-const SUPPORTED_NODE_RANGE = engines.node;
-//#endregion
-//#region src/adapters/node-version.ts
-const isSupportedNodeVersion = (version) => satisfies(version, SUPPORTED_NODE_RANGE);
-//#endregion
-//#region src/core/contracts/records.ts
-/** Configuration maps are ordinary objects or null-prototype dictionaries. */
-const isPlainRecord = (value) => {
-	if (typeof value !== "object" || value === null) return false;
-	const prototype = Object.getPrototypeOf(value);
-	return prototype === Object.prototype || prototype === null;
-};
-//#endregion
-//#region src/core/contracts/pms.ts
-/**
-* Single source of truth for package managers and severities.
-* Types, runtime sets, and ordering derive from these tuples. Adding a manager
-* still requires local detection signals, applicable rule bindings and verified
-* policy/availability evidence; the tuple alone does not implement support.
-*/
-const PMS = [
-	"npm",
-	"pnpm",
-	"yarn",
-	"bun",
-	"deno",
-	"aube"
-];
-const SEVERITIES = [
-	"error",
-	"warn",
-	"info"
-];
-/**
-* Numeric ordering of severities for threshold comparisons. Co-located with
-* `Severity` so `filter`, `runLint`, and any future severity-aware code share
-* one source of truth — drifting the order in one place silently changes the
-* fail-on-threshold contract everywhere.
-*/
-const SEVERITY_RANK = {
-	error: 3,
-	info: 1,
-	warn: 2
-};
-const PM_SET = new Set(PMS);
-const SEVERITY_SET = new Set(SEVERITIES);
-const isPM = (value) => PM_SET.has(value);
-const isSeverity = (value) => SEVERITY_SET.has(value);
-const PACKAGE_MANAGER_FIELD = /^(?<pmName>[a-z]+)(?:@.+)?$/u;
-const parsePackageManagerField = (value) => {
-	const name = PACKAGE_MANAGER_FIELD.exec(value.trim())?.groups?.pmName;
-	if (typeof name !== "undefined" && isPM(name)) return name;
-};
-//#endregion
-//#region src/core/pm-versions.ts
-/** Release history establishes stable versions, not ranges or prerelease builds. */
-const isStableVersion = (value) => {
-	if (typeof value !== "string" || !/^\d/u.test(value) || value.trim() !== value) return false;
-	const version = parse(value);
-	return version !== null && version.prerelease.length === 0;
-};
-/** Keep name-only detection independent from whether the declaration pins a version. */
-const declaredPMVersion = (declaration) => {
-	const [pm, version, ...extra] = declaration?.trim().split("@") ?? [];
-	return pm && isPM(pm) && isStableVersion(version) && extra.length === 0 ? { [pm]: version } : {};
-};
-//#endregion
-//#region src/core/inspection-options.ts
-const denseArray = (value, name) => {
-	if (!Array.isArray(value)) throw new ConfigError(`${name} must be a dense array.`);
-	for (let index = 0; index < value.length; index += 1) if (!Object.hasOwn(value, index)) throw new ConfigError(`${name} must be a dense array.`);
-	return value;
-};
-const relativeInput = (value, name) => {
-	if (typeof value !== "string" || !value || value.includes("\0") || name === "exclude" && (value.includes("\\") || /^[a-z]:/iu.test(value)) || /^[\\/]/u.test(value) || /^[a-z]:[\\/]/iu.test(value) || value.split("/").includes("..")) throw new ConfigError(`${name}: expected a nonempty cwd-relative /-separated path without parent traversal.`);
-	return value.split("/").filter((part) => part && part !== ".").join("/") || ".";
-};
-const parseExcludes = (value) => [...new Set(denseArray(value, "exclude").map((input) => {
-	const pattern = relativeInput(input, "exclude");
-	if (pattern === "." || pattern.startsWith("!")) throw new ConfigError("exclude cannot exclude cwd (.) or re-include with leading !.");
-	return pattern;
-}))];
-const parseInstallationRoots = (value) => {
-	const roots = /* @__PURE__ */ new Map();
-	for (const input of denseArray(value, "installationRoots")) {
-		if (typeof input !== "string" && (!isPlainRecord(input) || Object.keys(input).some((key) => ![
-			"path",
-			"pm",
-			"pmVersion"
-		].includes(key)))) throw new ConfigError("installationRoots entries must be paths or { path, pm?, pmVersion? }.");
-		const entry = typeof input === "string" ? { path: input } : input;
-		const path = relativeInput(entry.path, "installationRoots");
-		if (entry.pm !== void 0 && (typeof entry.pm !== "string" || !isPM(entry.pm)) || entry.pmVersion !== void 0 && (!entry.pm || typeof entry.pmVersion !== "string" || !isStableVersion(entry.pmVersion))) throw new ConfigError(`${path}: pmVersion requires pm and an exact stable version; pm must be a supported manager.`);
-		if (path === "." && (entry.pm !== void 0 || entry.pmVersion !== void 0)) throw new ConfigError("Use top-level pm / pmVersion / pms / pmVersions for installation root \".\".");
-		const root = {
-			path,
-			pm: entry.pm,
-			pmVersion: entry.pmVersion
-		};
-		const previous = roots.get(path);
-		if (previous && (previous.pm !== root.pm || previous.pmVersion !== root.pmVersion)) throw new ConfigError(`${path}: conflicting installationRoots entries.`);
-		roots.set(path, root);
-	}
-	return [...roots.values()];
-};
-//#endregion
-//#region src/core/contracts/project-type.ts
-const PROJECT_TYPES = ["application", "package"];
-const isProjectType = (value) => PROJECT_TYPES.some((projectType) => projectType === value);
-//#endregion
-//#region src/core/contracts/reporter.ts
-const isReporterShape = (value) => {
-	return isPlainRecord(value) && typeof value.name === "string" && typeof value.format === "function";
-};
-//#endregion
-//#region src/core/contracts/config-value.ts
-const CODEC_KINDS = [
-	"json",
-	"npmrc",
-	"toml",
-	"yaml"
-];
-/** Read an own key path; absent or non-mapping parents yield undefined. */
-const getByPath = (config, keyPath) => {
-	let current = config;
-	for (const key of keyPath) {
-		if (!isPlainRecord(current)) return;
-		if (!Object.hasOwn(current, key)) return;
-		current = current[key];
-	}
-	return current;
-};
-/** Accept only mapping roots while preserving unvalidated values inside them. */
-const toParsedConfig = (value) => {
-	if (isPlainRecord(value)) return value;
-	throw new TypeError("Config root must be a mapping.");
-};
-//#endregion
-//#region src/core/contracts/config-file-ref.ts
-const CONFIG_FILE_KINDS = new Set(CODEC_KINDS);
-const isConfigFileRefShape = (value) => {
-	if (!isPlainRecord(value) || typeof value.kind !== "string" || !isRelPath(value.path)) return false;
-	return CONFIG_FILE_KINDS.has(value.kind);
-};
-//#endregion
-//#region src/core/contracts/rule.ts
-const defineRule = (rule) => rule;
-const isOptionalString = (value) => typeof value === "undefined" || typeof value === "string";
-const isConfigValueShape = (value) => typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
-const isDenseStringArray = (value) => Array.isArray(value) && Array.from(value).every((item) => typeof item === "string");
-const isCheckStatusShape = (value) => {
-	if (!isPlainRecord(value)) return false;
-	if (value.state === "ok" || value.state === "na") return true;
-	if (value.state === "violations") return Array.isArray(value.violations) && value.violations.length > 0 && Array.from(value.violations).every(isViolationStatusShape);
-	return isViolationStatusShape(value);
-};
-const isViolationStatusShape = (value) => {
-	if (!isPlainRecord(value)) return false;
-	return value.state === "violation" && typeof value.message === "string" && (value.file === void 0 || isRelPath(value.file)) && (value.expected === void 0 || isConfigValueShape(value.expected)) && (value.severity === void 0 || typeof value.severity === "string" && isSeverity(value.severity)) && !("manualSteps" in value) && !("fix" in value) && !("fixable" in value) && (value.remediation === void 0 || isRemediationShape(value.remediation));
-};
-const isSetKeyOperation = (value) => isPlainRecord(value) && value.op === "setKey" && isConfigFileRefShape(value.file) && isDenseStringArray(value.keyPath) && value.keyPath.length > 0 && isConfigValueShape(value.value);
-const isRemediationShape = (value) => {
-	if (!isPlainRecord(value)) return false;
-	if (value.kind === "manual") return !("operations" in value) && isDenseStringArray(value.steps) && value.steps.length > 0;
-	return value.kind === "automatic" && !("steps" in value) && Array.isArray(value.operations) && value.operations.length > 0 && Array.from(value.operations).every(isSetKeyOperation);
-};
-const isVersionNoteShape = (value) => typeof value === "undefined" || isPlainRecord(value) && isOptionalString(value.configAvailableSince) && isOptionalString(value.defaultSafeSince) && isOptionalString(value.note);
-const isRuleBindingShape = (value) => {
-	if (!isPlainRecord(value)) return false;
-	return (value.file === void 0 || isConfigFileRefShape(value.file)) && !("fix" in value) && !("fixKind" in value) && !("fileGlob" in value) && isOptionalString(value.docs) && (typeof value.severity === "undefined" || typeof value.severity === "string" && isSeverity(value.severity)) && isVersionNoteShape(value.versionNote) && typeof value.check === "function";
-};
-const isBindingsShape = (value) => isPlainRecord(value) && Object.keys(value).every(isPM) && PMS.every((pm) => value[pm] === void 0 || isRuleBindingShape(value[pm]));
-const isProjectTypeValue = (value) => typeof value === "string" && isProjectType(value);
-const isProjectTypesShape = (value) => typeof value === "undefined" || Array.isArray(value) && Array.from(value).every((projectType) => isProjectTypeValue(projectType));
-const isRuleShape = (value) => {
-	if (!isPlainRecord(value)) return false;
-	return typeof value.id === "string" && typeof value.title === "string" && typeof value.description === "string" && typeof value.severity === "string" && isSeverity(value.severity) && isOptionalString(value.docs) && isProjectTypesShape(value.projectTypes) && isBindingsShape(value.bindings);
-};
-//#endregion
-//#region src/core/contracts/synchronous.ts
-/** Reject only the submitted async value, without a process-wide rejection handler. */
-const assertSynchronous = (value, label) => {
-	if (value !== null && (typeof value === "object" || typeof value === "function") && "then" in value && typeof value.then === "function") {
-		Promise.resolve(value).catch(() => {});
-		throw new ConfigError(`${label} must be synchronous; Promise/thenable values are not supported.`);
-	}
-};
-//#endregion
-//#region src/core/parse-siro-config.ts
-const RuleSettingSchema = vb.union([vb.picklist(SEVERITIES), vb.literal("off")]);
-const ConfigSchema = vb.strictObject({
-	exclude: vb.optional(vb.custom((value) => {
-		parseExcludes(value);
-		return true;
-	})),
-	installationRoots: vb.optional(vb.custom((value) => {
-		parseInstallationRoots(value);
-		return true;
-	})),
-	customRules: vb.optional(vb.array(vb.custom(isRuleShape, "must be a structurally valid rule"))),
-	pms: vb.optional(vb.pipe(vb.array(vb.picklist(PMS)), vb.minLength(1, "must not be empty (omit the key to auto-detect, or list at least one PM)"))),
-	projectType: vb.optional(vb.picklist(PROJECT_TYPES)),
-	pmVersions: vb.optional(vb.pipe(vb.custom(isPlainRecord, "must be an object of PM versions"), vb.check((value) => Object.keys(value).every(isPM), "unknown package manager in pmVersions"), vb.record(vb.picklist(PMS), vb.custom(isStableVersion, "must be an exact stable version such as 10.16.0")))),
-	reporters: vb.optional(vb.array(vb.custom(isReporterShape, "must be a { name, format } reporter"))),
-	rules: vb.optional(vb.pipe(vb.custom(isPlainRecord, "must be an object of rule settings"), vb.rawTransform(({ dataset, addIssue }) => {
-		const entries = [];
-		for (const [key, value] of Object.entries(dataset.value)) {
-			const result = vb.safeParse(RuleSettingSchema, value);
-			if (result.success) entries.push([key, result.output]);
-			else addIssue({
-				message: result.issues[0].message,
-				path: [{
-					input: dataset.value,
-					key,
-					origin: "value",
-					type: "object",
-					value
-				}]
-			});
-		}
-		return Object.fromEntries(entries);
-	})))
-}, "unknown config key (check for a typo)");
-const formatIssues = (issues) => issues.map((issue) => {
-	const keyPath = (issue.path ?? []).map((seg) => seg.key).filter((key) => typeof key === "string" || typeof key === "number").join(".");
-	if (keyPath) return `${keyPath}: ${issue.message}`;
-	return issue.message;
-}).join("; ");
-const parseConfig = (candidate, name = "siro.config") => {
-	assertSynchronous(candidate, name);
-	if (!isPlainRecord(candidate)) throw new ConfigError(`${name} must export a config object (got ${Array.isArray(candidate) ? "an array" : typeof candidate}).`);
-	const result = vb.safeParse(ConfigSchema, Object.fromEntries(Object.entries(candidate)));
-	if (!result.success) throw new ConfigError(`${name}: ${formatIssues(result.issues)}`);
-	return result.output;
-};
-//#endregion
-//#region src/load-config.ts
-const CONFIG_NAMES = [
-	"siro.config.ts",
-	"siro.config.mjs",
-	"siro.config.js"
-];
-const describeError = (error) => error instanceof Error ? error.message : String(error);
-let loadCounter = 0;
-/** Load the first matching config; executable imports always use the real filesystem. */
-const loadConfig = async (cwd, nodeVersion = process.versions.node) => {
-	const name = CONFIG_NAMES.find((candidate) => nodeFileSystem.exists(asAbsPath(path.join(cwd, candidate))));
-	if (name === void 0) return;
-	if (name.endsWith(".ts") && !isSupportedNodeVersion(nodeVersion)) throw new ConfigError(`${name} requires Node.js with native type stripping (${SUPPORTED_NODE_RANGE}); current is v${nodeVersion}. Rename the config to siro.config.mjs (plain JS) or upgrade Node.js.`);
-	const url = pathToFileURL(path.join(cwd, name));
-	url.searchParams.set("siro-load", String(++loadCounter));
-	let mod;
-	try {
-		mod = await import(url.href);
-	} catch (error) {
-		throw new ConfigError(`Failed to load ${name}: ${describeError(error)}`);
-	}
-	return parseConfig(mod !== null && typeof mod === "object" && "default" in mod ? mod.default : mod, name);
-};
-//#endregion
-//#region src/core/config-files.ts
-/** Known configuration locations and their parsers. */
-const CONFIG_FILES = {
-	aubeWorkspace: {
-		kind: "yaml",
-		path: asRelPath("aube-workspace.yaml")
-	},
-	bunfig: {
-		kind: "toml",
-		path: asRelPath("bunfig.toml")
-	},
-	denoJson: {
-		kind: "json",
-		path: asRelPath("deno.json")
-	},
-	npmrc: {
-		kind: "npmrc",
-		path: asRelPath(".npmrc")
-	},
-	packageJson: {
-		kind: "json",
-		path: asRelPath("package.json")
-	},
-	pnpmWorkspace: {
-		kind: "yaml",
-		path: asRelPath("pnpm-workspace.yaml")
-	},
-	yarnrc: {
-		kind: "yaml",
-		path: asRelPath(".yarnrc.yml")
-	}
-};
-//#endregion
-//#region src/core/rules/setting-availability.ts
-const { npmrc: npmrc$7, packageJson: packageJson$2, pnpmWorkspace: pnpmWorkspace$11, yarnrc: yarnrc$10, bunfig: bunfig$6 } = CONFIG_FILES;
-const settingAvailability = [
-	{
-		pm: "npm",
-		file: npmrc$7,
-		keyPath: ["provenance"],
-		since: "9.5.0",
-		source: "https://github.com/npm/cli/releases/tag/v9.5.0"
-	},
-	{
-		pm: "npm",
-		file: packageJson$2,
-		keyPath: ["publishConfig", "provenance"],
-		since: "9.5.0",
-		source: "https://github.com/npm/cli/releases/tag/v9.5.0"
-	},
-	{
-		pm: "npm",
-		file: npmrc$7,
-		keyPath: ["min-release-age"],
-		since: "11.10.0",
-		source: "https://github.com/npm/cli/releases/tag/v11.10.0"
-	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["strictDepBuilds"],
-		since: "10.6.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v10.6.0"
-	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["dangerouslyAllowAllBuilds"],
-		since: "10.9.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v10.9.0"
-	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["minimumReleaseAge"],
-		since: "10.16.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v10.16.0"
-	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["minimumReleaseAgeExclude"],
-		since: "10.16.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v10.16.0"
-	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["trustPolicy"],
-		since: "10.21.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v10.21.0"
-	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["blockExoticSubdeps"],
-		since: "10.26.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v10.26.0"
-	},
-	{
-		pm: "pnpm",
-		file: pnpmWorkspace$11,
-		keyPath: ["frozenStore"],
-		since: "11.7.0",
-		source: "https://github.com/pnpm/pnpm/releases/tag/v11.7.0"
-	},
-	{
-		pm: "yarn",
-		file: yarnrc$10,
-		keyPath: ["enableHardenedMode"],
-		since: "4.0.0",
-		source: "https://yarnpkg.com/blog/release/4.0"
-	},
-	{
-		pm: "yarn",
-		file: yarnrc$10,
-		keyPath: ["npmMinimalAgeGate"],
-		since: "4.10.0",
-		source: "https://github.com/yarnpkg/berry/releases/tag/@yarnpkg/cli/4.10.0"
-	},
-	{
-		pm: "yarn",
-		file: yarnrc$10,
-		keyPath: ["npmPreapprovedPackages"],
-		since: "4.10.0",
-		source: "https://github.com/yarnpkg/berry/releases/tag/@yarnpkg/cli/4.10.0"
-	},
-	{
-		pm: "bun",
-		file: bunfig$6,
-		keyPath: ["install", "minimumReleaseAge"],
-		since: "1.3.0",
-		source: "https://bun.com/blog/bun-v1.3#minimum-release-age"
-	},
-	{
-		pm: "bun",
-		file: bunfig$6,
-		keyPath: [
-			"install",
-			"security",
-			"scanner"
-		],
-		since: "1.2.21",
-		source: "https://bun.com/blog/bun-v1.2.21#security-scanner-api-for-bun-install"
-	},
-	{
-		pm: "deno",
-		file: npmrc$7,
-		keyPath: ["min-release-age"],
-		since: "2.8.1",
-		source: "https://github.com/denoland/deno/releases/tag/v2.8.1"
-	}
-];
-//#endregion
-//#region src/core/rules/remediation-availability.ts
-const sameSetting = (setting, target) => target.file.path === setting.file.path && target.file.kind === setting.file.kind && target.keyPath.length === setting.keyPath.length && target.keyPath.every((key, index) => key === setting.keyPath[index]);
-/** Undefined means the target version or the setting's introduction is unknown. */
-const settingSupportedByTarget = (pm, version, target) => {
-	if (version === void 0) return void 0;
-	const availability = settingAvailability.find((setting) => setting.pm === pm && sameSetting(setting, target));
-	return availability === void 0 ? void 0 : !lt(version, availability.since);
-};
-/** Keep a proposal atomic and make known version prerequisites explicit. */
-const guardRemediationAvailability = (pm, version, remediation, targets = remediation?.kind === "automatic" ? remediation.operations : []) => {
-	if (version === void 0 || remediation === void 0) return remediation;
-	const unsupported = settingAvailability.filter((setting) => setting.pm === pm && lt(version, setting.since) && targets.some((target) => sameSetting(setting, target)));
-	if (unsupported.length === 0) return remediation;
-	return {
-		kind: "manual",
-		steps: [`Target ${pm} ${version} does not support this proposal: ${unsupported.map((setting) => `${setting.file.path}#${setting.keyPath.join(".")} requires ${pm} >=${setting.since}`).join("; ")}. Verify and upgrade the target before applying the steps below, or choose a supported security control. Removing a setting alone does not provide its protection.`, ...remediation.kind === "manual" ? remediation.steps : remediation.operations.map((operation) => `After upgrading, set ${operation.file.path}#${operation.keyPath.join(".")} to ${JSON.stringify(operation.value)}.`)]
-	};
-};
-//#endregion
-//#region src/core/rules/remediation.ts
-/** Scalar writes must not discard an existing container or replace a non-object parent. */
-const proposeChanges = (config, operations) => {
-	for (const operation of operations) {
-		let current = config;
-		for (const key of operation.keyPath) {
-			if (current === void 0) break;
-			if (!isPlainRecord(current)) return {
-				kind: "manual",
-				steps: [`Review ${operation.file.path}: ${operation.keyPath.join(".")} has a non-object parent. Restructure it before setting the value to ${JSON.stringify(operation.value)}.`]
-			};
-			current = Object.hasOwn(current, key) ? current[key] : void 0;
-		}
-		if (current !== null && typeof current === "object") return {
-			kind: "manual",
-			steps: [`Review ${operation.file.path}: ${operation.keyPath.join(".")} contains nested settings. Preserve the required entries when correcting this value.`]
-		};
-	}
-	return {
-		kind: "automatic",
-		operations
-	};
-};
-//#endregion
-//#region src/core/rules/builders/require-config-key.ts
-const overrideBindings = (rule, overrides) => ({
-	...rule,
-	bindings: {
-		...rule.bindings,
-		...overrides
-	}
-});
-const accepts = (spec, actual) => spec.accept ? spec.accept(actual) : actual === spec.value;
-const checkKeyValue = (spec, config) => {
-	const actual = getByPath(config, spec.keyPath);
-	const coveredByDefault = actual === void 0 && spec.documentedDefault !== void 0 && spec.defaultSafety === "unconditional" && accepts(spec, spec.documentedDefault);
-	if (!coveredByDefault && accepts(spec, actual)) return { state: "ok" };
-	const severity = coveredByDefault ? spec.defaultSatisfiedSeverity ?? "info" : void 0;
-	if (severity === "off") return { state: "ok" };
-	return {
-		state: "violation",
-		actual,
-		expected: spec.value,
-		message: spec.message,
-		...severity === void 0 ? {} : { severity },
-		remediation: proposeChanges(config, [{
-			file: spec.file,
-			keyPath: spec.keyPath,
-			op: "setKey",
-			value: spec.value
-		}])
-	};
-};
-const buildBinding = (spec, pm, applies) => ({
-	check(ctx, config) {
-		if (typeof applies !== "undefined" && !applies(ctx)) return { state: "na" };
-		const status = checkKeyValue(spec, config);
-		return status.state === "violation" ? {
-			...status,
-			remediation: guardRemediationAvailability(pm, ctx.pmVersion, status.remediation, [spec])
-		} : status;
-	},
-	docs: spec.docs,
-	file: spec.file,
-	severity: spec.severity,
-	versionNote: spec.versionNote
-});
-/** Build a Rule from a per-PM table of {file, keyPath, value, message}. */
-const requireConfigKey = (options) => {
-	const bindings = {};
-	for (const pm of PMS) {
-		const spec = options.bindings[pm];
-		if (typeof spec !== "undefined") {
-			if ("extraFix" in spec) throw new TypeError("extraFix is no longer supported; use a custom binding.");
-			bindings[pm] = buildBinding(spec, pm, options.applies);
-		}
-	}
-	return {
-		bindings,
-		description: options.description,
-		docs: options.docs,
-		id: options.id,
-		projectTypes: options.projectTypes,
-		severity: options.severity,
-		title: options.title
-	};
-};
-//#endregion
-//#region src/core/rules/builders/with-aube-paranoid.ts
-const withAubeParanoid = (rule) => {
-	const { aube } = rule.bindings;
-	if (!aube) return rule;
-	return overrideBindings(rule, { aube: {
-		...aube,
-		check(ctx, config) {
-			if (getByPath(config, ["paranoid"]) === true) return { state: "ok" };
-			return aube.check(ctx, config);
-		}
-	} });
-};
-//#endregion
-//#region src/core/rules/advisory-check.ts
-const { aubeWorkspace: aubeWorkspace$8 } = CONFIG_FILES;
-const advisoryCheck = withAubeParanoid(requireConfigKey({
-	bindings: { aube: {
-		accept: (value) => value === "on" || value === "required",
-		docs: "https://aube.jdx.dev/security.html",
-		documentedDefault: "on",
-		defaultSafety: "unconditional",
-		file: aubeWorkspace$8,
-		keyPath: ["advisoryCheck"],
-		message: "Set `advisoryCheck: on` (or `required`) in aube-workspace.yaml to check dependencies against known-malicious advisories.",
-		value: "on"
-	} },
-	description: "Query the OSV database for known-malicious packages during dependency resolution.",
-	docs: "https://aube.jdx.dev/security.html",
-	id: "advisory-check",
-	severity: "warn",
-	title: "Enable malicious-package advisory checks"
-}));
-//#endregion
-//#region src/core/rules/config-predicates.ts
-const isNonBlankString = (value) => typeof value === "string" && value.trim().length > 0;
-const isStringList = (value) => Array.isArray(value) && Array.from(value).every(isNonBlankString);
-//#endregion
-//#region src/core/rules/approved-git-repos.ts
-const { yarnrc: yarnrc$9 } = CONFIG_FILES;
-const message = "Set `approvedGitRepositories: []` in .yarnrc.yml to block all git: protocol dependencies (or list approved repository globs).";
-const approvedGitRepos = defineRule({
-	bindings: { yarn: {
-		check(_ctx, config) {
-			const value = getByPath(config, ["approvedGitRepositories"]);
-			if (isStringList(value)) return { state: "ok" };
-			return {
-				remediation: {
-					kind: "manual",
-					steps: ["Add `approvedGitRepositories: []` to .yarnrc.yml to block all git deps, or list specific approved repository URL globs."]
-				},
-				actual: value,
-				expected: "[]",
-				message,
-				state: "violation"
-			};
-		},
-		docs: "https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories",
-		file: yarnrc$9,
-		versionNote: { configAvailableSince: "yarn 4.14.0" }
-	} },
-	description: "Restrict git: protocol dependencies to an explicit allowlist of approved repository URL patterns.",
-	docs: "https://yarnpkg.com/configuration/yarnrc#approvedGitRepositories",
-	id: "approved-git-repos",
-	severity: "warn",
-	title: "Approve git repository dependencies"
-});
-//#endregion
-//#region src/core/rules/audit-suppression.ts
-const { yarnrc: yarnrc$8 } = CONFIG_FILES;
-const isNonEmptyArray = (value) => Array.isArray(value) && value.length > 0;
-const SUPPRESSION_KEYS = ["npmAuditIgnoreAdvisories", "npmAuditExcludePackages"];
-const checkSuppression = (config) => {
-	const present = SUPPRESSION_KEYS.filter((key) => isNonEmptyArray(getByPath(config, [key])));
-	const [first] = present;
-	if (typeof first === "undefined") return { state: "ok" };
-	return {
-		actual: getByPath(config, [first]),
-		message: `Review audit suppression in .yarnrc.yml (${present.join(", ")}). Broad glob patterns can silently hide future vulnerabilities.`,
-		state: "violation",
-		remediation: {
-			kind: "manual",
-			steps: ["Review entries in `npmAuditIgnoreAdvisories` and `npmAuditExcludePackages` — remove stale suppressions and overly broad glob patterns."]
-		}
-	};
-};
-const auditSuppression = defineRule({
-	bindings: { yarn: {
-		check(_ctx, config) {
-			return checkSuppression(config);
-		},
-		docs: "https://yarnpkg.com/configuration/yarnrc#npmAuditIgnoreAdvisories",
-		file: yarnrc$8
-	} },
-	description: "Flag audit advisory suppressions that may silently hide future vulnerabilities via broad glob patterns.",
-	docs: "https://yarnpkg.com/configuration/yarnrc#npmAuditIgnoreAdvisories",
-	id: "audit-suppression",
-	severity: "info",
-	title: "Review audit suppression entries"
-});
-//#endregion
-//#region src/core/rules/block-auto-install.ts
-const { bunfig: bunfig$5 } = CONFIG_FILES;
-const blockAutoInstall = requireConfigKey({
-	bindings: { bun: {
-		docs: "https://bun.sh/docs/runtime/bunfig#install-auto",
-		file: bunfig$5,
-		keyPath: ["install", "auto"],
-		message: "Set `auto = \"disable\"` under [install] in bunfig.toml to prevent auto-install from bypassing security guards.",
-		value: "disable",
-		accept: (value) => value === "disable" || value === false
-	} },
-	description: "Disable auto-install so dependencies are only installed through an explicit install step where security guards apply.",
-	docs: "https://bun.sh/docs/runtime/bunfig#install-auto",
-	id: "block-auto-install",
-	severity: "warn",
-	title: "Block automatic package installation"
-});
-//#endregion
-//#region src/core/rules/block-exotic-subdeps.ts
-const { aubeWorkspace: aubeWorkspace$7, npmrc: npmrc$6, pnpmWorkspace: pnpmWorkspace$10 } = CONFIG_FILES;
-const isRootOrNone = (value) => value === "root" || value === "none";
-const npmMessage = "Set `allow-git=none` and `allow-remote=none` in .npmrc to block git/tarball URLs; use `root` only when direct URL dependencies are required.";
-const npmBinding$1 = {
-	check(_ctx, config) {
-		const git = getByPath(config, ["allow-git"]);
-		const remote = getByPath(config, ["allow-remote"]);
-		const invalid = [git, remote].find((value) => value !== void 0 && !isRootOrNone(value));
-		if (invalid === void 0 && git !== void 0 && remote !== void 0) return { state: "ok" };
-		return {
-			state: "violation",
-			expected: "none",
-			...invalid === void 0 ? {} : { actual: invalid },
-			message: npmMessage,
-			remediation: proposeChanges(config, [{
-				file: npmrc$6,
-				keyPath: ["allow-git"],
-				op: "setKey",
-				value: "none"
-			}, {
-				file: npmrc$6,
-				keyPath: ["allow-remote"],
-				op: "setKey",
-				value: "none"
-			}])
-		};
-	},
-	docs: "https://docs.npmjs.com/cli/v12/using-npm/config#allow-git",
-	file: npmrc$6,
-	versionNote: { defaultSafeSince: "npm 12.0.0" }
-};
-const blockExoticSubdeps = overrideBindings(requireConfigKey({
-	bindings: {
-		aube: {
-			docs: "https://aube.jdx.dev/security.html",
-			documentedDefault: true,
-			defaultSafety: "unconditional",
-			file: aubeWorkspace$7,
-			keyPath: ["blockExoticSubdeps"],
-			message: "Set `blockExoticSubdeps: true` in aube-workspace.yaml to block git/tarball URLs in transitive dependencies.",
-			value: true
-		},
-		pnpm: {
-			docs: "https://pnpm.io/settings/dependency-resolution#blockexoticsubdeps",
-			documentedDefault: true,
-			defaultSafety: "conditional",
-			file: pnpmWorkspace$10,
-			keyPath: ["blockExoticSubdeps"],
-			message: "Set `blockExoticSubdeps: true` in pnpm-workspace.yaml to block git/tarball URLs in transitive dependencies.",
-			value: true,
-			versionNote: {
-				configAvailableSince: "pnpm 10.26.0",
-				defaultSafeSince: "pnpm 10.26.0"
-			}
-		}
-	},
-	description: "Refuse to install transitive dependencies sourced from git or tarball URLs, which bypass registry integrity checking.",
-	docs: "https://pnpm.io/settings/dependency-resolution#blockexoticsubdeps",
-	id: "block-exotic-subdeps",
-	severity: "warn",
-	title: "Block exotic subdependencies"
-}), { npm: npmBinding$1 });
-//#endregion
-//#region src/core/rules/bun-security-scanner.ts
-const { bunfig: bunfig$4 } = CONFIG_FILES;
-const bunSecurityScanner = defineRule({
-	bindings: { bun: {
-		check(ctx, config) {
-			const scanner = getByPath(config, [
-				"install",
-				"security",
-				"scanner"
-			]);
-			if (isNonBlankString(scanner)) return { state: "ok" };
-			return {
-				remediation: guardRemediationAvailability("bun", ctx.pmVersion, {
-					kind: "manual",
-					steps: ["Add `[install.security] scanner = \"@socketsecurity/bun-security-scanner\"` (or another bun-compatible scanner) to bunfig.toml."]
-				}, [{
-					file: bunfig$4,
-					keyPath: [
-						"install",
-						"security",
-						"scanner"
-					]
-				}]),
-				actual: scanner,
-				message: "Configure `[install.security] scanner = \"...\"` in bunfig.toml (e.g. `@socketsecurity/bun-security-scanner`) to scan new packages on install.",
-				state: "violation"
-			};
-		},
-		docs: "https://bun.com/docs/pm/security-scanner-api",
-		file: bunfig$4,
-		versionNote: { configAvailableSince: "bun 1.2.21" }
-	} },
-	description: "Bun supports a Security Scanner API that intercepts new packages at install time (e.g. Socket Firewall).",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#preinstall-scanners",
-	id: "bun-security-scanner",
-	severity: "info",
-	title: "Enable a bun install-time security scanner"
-});
-//#endregion
-//#region src/core/rules/checksum-verification.ts
-const { yarnrc: yarnrc$7 } = CONFIG_FILES;
-const checksumVerification = requireConfigKey({
-	bindings: { yarn: {
-		docs: "https://yarnpkg.com/configuration/yarnrc#checksumBehavior",
-		documentedDefault: "throw",
-		defaultSafety: "unconditional",
-		file: yarnrc$7,
-		keyPath: ["checksumBehavior"],
-		message: "Set `checksumBehavior: throw` in .yarnrc.yml to reject packages whose checksum does not match the lockfile.",
-		value: "throw"
-	} },
-	description: "Throw on checksum mismatches so tampered or corrupted packages are never silently installed.",
-	docs: "https://yarnpkg.com/configuration/yarnrc#checksumBehavior",
-	id: "checksum-verification",
-	severity: "warn",
-	title: "Verify package checksums"
-});
-//#endregion
-//#region src/core/signals.ts
-const PM_SIGNALS = {
-	aube: {
-		configs: [CONFIG_FILES.aubeWorkspace.path],
-		lockfiles: ["aube-lock.yaml"],
-		reusesLockfiles: [
-			"pnpm-lock.yaml",
-			"package-lock.json",
-			"npm-shrinkwrap.json",
-			"yarn.lock",
-			"bun.lock"
-		]
-	},
-	bun: {
-		configs: [CONFIG_FILES.bunfig.path],
-		lockfiles: ["bun.lock", "bun.lockb"]
-	},
-	deno: {
-		configs: [CONFIG_FILES.denoJson.path, "deno.jsonc"],
-		lockfiles: ["deno.lock"]
-	},
-	npm: {
-		configs: [],
-		lockfiles: ["package-lock.json", "npm-shrinkwrap.json"]
-	},
-	pnpm: {
-		configs: [CONFIG_FILES.pnpmWorkspace.path],
-		lockfiles: ["pnpm-lock.yaml"]
-	},
-	yarn: {
-		configs: [CONFIG_FILES.yarnrc.path],
-		lockfiles: ["yarn.lock"]
-	}
-};
-//#endregion
-//#region src/core/rules/commit-lockfile.ts
-const LOCKFILE_DOCS = {
-	aube: "https://github.com/aubepkg/aube/blob/main/docs/package-manager/lockfiles.md",
-	bun: "https://bun.com/docs/install/lockfile",
-	deno: "https://docs.deno.com/runtime/reference/deno_json/#lockfile",
-	npm: "https://docs.npmjs.com/cli/v12/configuring-npm/package-lock-json",
-	pnpm: "https://pnpm.io/git#lockfiles",
-	yarn: "https://yarnpkg.com/getting-started/qa#should-lockfiles-be-committed-to-the-repository"
-};
-const LOCKFILE_VERSION_NOTES = { deno: { configAvailableSince: "deno 1.28.0" } };
-const lockfileBinding = (pm) => {
-	const { lockfiles, reusesLockfiles } = PM_SIGNALS[pm];
-	const [primary] = lockfiles;
-	const accepted = [...lockfiles, ...reusesLockfiles ?? []];
-	return {
-		check(ctx) {
-			if (pm === "aube" && ctx.exists(asRelPath("bun.lockb")) && !ctx.exists(asRelPath("bun.lock"))) return {
-				state: "violation",
-				message: "Aube cannot read bun.lockb, even when another lockfile exists.",
-				remediation: {
-					kind: "manual",
-					steps: ["Run `bun install --save-text-lockfile` to generate bun.lock, then commit it."]
-				}
-			};
-			if (pm === "npm") {
-				if (ctx.exists(asRelPath(primary))) return { state: "ok" };
-				if (ctx.exists(asRelPath("npm-shrinkwrap.json"))) {
-					if (ctx.pmVersion && lt(ctx.pmVersion, "12.0.0")) return { state: "ok" };
-					return {
-						state: "violation",
-						message: ctx.pmVersion ? `npm ${ctx.pmVersion} no longer reads npm-shrinkwrap.json. Use package-lock.json.` : "Found npm-shrinkwrap.json, but the npm target version is unknown; npm 12 no longer reads it.",
-						remediation: {
-							kind: "manual",
-							steps: ["Verify and declare the npm version used by this project. For npm 12 or newer, migrate to package-lock.json and review the resulting dependency resolutions."]
-						}
-					};
-				}
-			} else if (accepted.some((lf) => ctx.exists(asRelPath(lf)))) return { state: "ok" };
-			return {
-				remediation: {
-					kind: "manual",
-					steps: [`Install dependencies to generate ${primary}, then commit it.`]
-				},
-				message: `No lockfile found. Generate and commit ${primary}.`,
-				state: "violation"
-			};
-		},
-		docs: LOCKFILE_DOCS[pm],
-		versionNote: LOCKFILE_VERSION_NOTES[pm]
-	};
-};
-const denoBinding$1 = {
-	file: CONFIG_FILES.denoJson,
-	docs: LOCKFILE_DOCS.deno,
-	versionNote: LOCKFILE_VERSION_NOTES.deno,
-	check(ctx, config) {
-		const lock = getByPath(config, ["lock"]);
-		if (lock != null && typeof lock !== "boolean" && typeof lock !== "string" && !(isPlainRecord(lock) && (lock.path == null || typeof lock.path === "string") && (lock.frozen == null || typeof lock.frozen === "boolean"))) return {
-			state: "violation",
-			message: "Invalid Deno lock setting.",
-			remediation: {
-				kind: "manual",
-				steps: ["Use a boolean, a lockfile path, or an object with optional path and frozen fields."]
-			}
-		};
-		const selected = typeof lock === "string" ? lock : getByPath(config, ["lock", "path"]);
-		const lockPath = selected == null ? asRelPath("deno.lock") : selected;
-		if (lock !== false && isRelPath(lockPath) && ctx.exists(lockPath)) return { state: "ok" };
-		return {
-			state: "violation",
-			message: lock === false ? "Enable the Deno lockfile; `lock: false` disables it even when deno.lock exists." : `No readable project lockfile found at ${String(lockPath)}.`,
-			remediation: {
-				kind: "manual",
-				steps: ["Enable lockfile use in deno.json and generate and commit the configured lockfile within the project."]
-			}
-		};
-	}
-};
-const commitLockfile = defineRule({
-	bindings: {
-		aube: lockfileBinding("aube"),
-		bun: lockfileBinding("bun"),
-		deno: denoBinding$1,
-		npm: lockfileBinding("npm"),
-		pnpm: lockfileBinding("pnpm"),
-		yarn: lockfileBinding("yarn")
-	},
-	description: "Lockfiles pin the full dependency tree and integrity hashes, enabling reproducible, verifiable installs (e.g. `npm ci`).",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#3-include-lockfiles",
-	id: "commit-lockfile",
-	severity: "error",
-	title: "Commit a lockfile"
-});
-//#endregion
-//#region src/core/rules/dependency-overrides.ts
-const { aubeWorkspace: aubeWorkspace$6, pnpmWorkspace: pnpmWorkspace$9 } = CONFIG_FILES;
-const isNonEmptyObject$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
-const checkOverrides = (config, file) => {
-	const value = getByPath(config, ["overrides"]);
-	if (!isNonEmptyObject$2(value)) return { state: "ok" };
-	return {
-		actual: value,
-		message: `Review \`overrides\` in ${file}. Overrides can replace transitive dependencies with arbitrary versions or forks.`,
-		state: "violation",
-		remediation: {
-			kind: "manual",
-			steps: ["Review each entry in `overrides` — verify pinned versions address a known CVE and are not redirecting to untrusted packages."]
-		}
-	};
-};
-const makeBinding = (file, fileName, docs) => ({
-	check(_ctx, config) {
-		return checkOverrides(config, fileName);
-	},
-	docs,
-	file
-});
-const dependencyOverrides = defineRule({
-	bindings: {
-		aube: makeBinding(aubeWorkspace$6, "aube-workspace.yaml", "https://aube.sh/settings/"),
-		pnpm: makeBinding(pnpmWorkspace$9, "pnpm-workspace.yaml", "https://pnpm.io/settings/dependency-resolution#overrides")
-	},
-	description: "Flag dependency overrides that can replace transitive packages with arbitrary versions or forks — a supply-chain injection vector.",
-	docs: "https://pnpm.io/settings/dependency-resolution#overrides",
-	id: "dependency-overrides",
-	severity: "info",
-	title: "Review dependency overrides"
-});
-//#endregion
-//#region src/core/rules/disable-lifecycle-scripts.ts
-const { npmrc: npmrc$5, pnpmWorkspace: pnpmWorkspace$8, yarnrc: yarnrc$6, aubeWorkspace: aubeWorkspace$5, bunfig: bunfig$3 } = CONFIG_FILES;
-const pnpmBinding$4 = {
-	check(ctx, config) {
-		if (getByPath(config, ["ignoreScripts"]) === true) return { state: "ok" };
-		const bypass = getByPath(config, ["dangerouslyAllowAllBuilds"]);
-		const strict = getByPath(config, ["strictDepBuilds"]);
-		if (bypass === true) {
-			const bypassTarget = {
-				file: pnpmWorkspace$8,
-				keyPath: ["dangerouslyAllowAllBuilds"]
-			};
-			if (settingSupportedByTarget("pnpm", ctx.pmVersion, bypassTarget) === false) {
-				const proposal = {
-					kind: "manual",
-					steps: ["Remove `dangerouslyAllowAllBuilds: true` before upgrading to pnpm 10.9.0 or newer; the declared target ignores it, but a later version would activate the bypass.", ...strict === true ? [] : ["Set `strictDepBuilds: true` in pnpm-workspace.yaml to enable lifecycle-script gating for the declared target."]]
-				};
-				return {
-					state: "violation",
-					actual: bypass,
-					expected: false,
-					message: "The declared target ignores this future-version bypass. Removing the ignored bypass alone does not provide protection against lifecycle scripts, and leaving it configured would disable gating after an upgrade.",
-					remediation: strict === true ? proposal : guardRemediationAvailability("pnpm", ctx.pmVersion, proposal, [{
-						file: pnpmWorkspace$8,
-						keyPath: ["strictDepBuilds"]
-					}])
-				};
-			}
-			const proposal = {
-				kind: "manual",
-				steps: ["After upgrading, remove `dangerouslyAllowAllBuilds: true` (or set it to false) and configure lifecycle-script gating."]
-			};
-			const guarded = guardRemediationAvailability("pnpm", ctx.pmVersion, proposal, [{
-				file: pnpmWorkspace$8,
-				keyPath: ["strictDepBuilds"]
-			}, {
-				file: pnpmWorkspace$8,
-				keyPath: ["dangerouslyAllowAllBuilds"]
-			}]);
-			if (guarded !== proposal) return {
-				state: "violation",
-				actual: bypass,
-				expected: false,
-				message: "The target cannot use the proposed YAML lifecycle-script controls. Removing an unsupported bypass alone does not provide protection.",
-				remediation: guarded
-			};
-			return {
-				actual: bypass,
-				expected: false,
-				remediation: {
-					kind: "manual",
-					steps: ["Remove `dangerouslyAllowAllBuilds: true` from pnpm-workspace.yaml (or set it to `false`). Setting `strictDepBuilds: true` alone has no effect while the bypass remains."]
-				},
-				message: "`dangerouslyAllowAllBuilds: true` in pnpm-workspace.yaml bypasses strictDepBuilds — remove it (or set it to false) to restore lifecycle-script gating.",
-				state: "violation"
-			};
-		}
-		if (strict === true) return { state: "ok" };
-		return {
-			state: "violation",
-			actual: strict,
-			expected: true,
-			message: strict === void 0 ? "Set `strictDepBuilds: true` in pnpm-workspace.yaml to pin lifecycle-script gating across versions." : "Set `strictDepBuilds: true` in pnpm-workspace.yaml to block silent skips of un-approved dep builds.",
-			remediation: guardRemediationAvailability("pnpm", ctx.pmVersion, proposeChanges(config, [{
-				file: pnpmWorkspace$8,
-				keyPath: ["strictDepBuilds"],
-				op: "setKey",
-				value: true
-			}]), [{
-				file: pnpmWorkspace$8,
-				keyPath: ["strictDepBuilds"]
-			}])
-		};
-	},
-	docs: "https://pnpm.io/settings/build#strictdepbuilds",
-	file: pnpmWorkspace$8,
-	versionNote: {
-		configAvailableSince: "pnpm 10.3.0",
-		note: "pnpm-workspace.yaml settings require pnpm 10.6.0",
-		defaultSafeSince: "pnpm 11.0.0"
-	}
-};
-const aubeBinding$2 = {
-	check(ctx, config) {
-		const npmConfig = ctx.readConfig(npmrc$5);
-		const jail = getByPath(config, ["jailBuilds"]);
-		const strict = getByPath(npmConfig, ["strictDepBuilds"]);
-		if (jail === true && strict === true) return { state: "ok" };
-		const violations = [];
-		if (jail !== true) violations.push({
-			state: "violation",
-			file: aubeWorkspace$5.path,
-			actual: jail,
-			expected: true,
-			message: "Set `jailBuilds: true` in aube-workspace.yaml to sandbox approved builds.",
-			remediation: proposeChanges(config, [{
-				file: aubeWorkspace$5,
-				keyPath: ["jailBuilds"],
-				op: "setKey",
-				value: true
-			}])
-		});
-		if (strict !== true) violations.push({
-			state: "violation",
-			file: npmrc$5.path,
-			actual: strict,
-			expected: true,
-			message: "Set `strictDepBuilds=true` in .npmrc to reject unreviewed lifecycle scripts.",
-			remediation: proposeChanges(npmConfig, [{
-				file: npmrc$5,
-				keyPath: ["strictDepBuilds"],
-				op: "setKey",
-				value: true
-			}])
-		});
-		const [first, ...rest] = violations;
-		return !first ? { state: "ok" } : rest.length === 0 ? first : {
-			state: "violations",
-			violations: [first, ...rest]
-		};
-	},
-	docs: "https://aube.jdx.dev/security.html",
-	file: aubeWorkspace$5
-};
-const bunMessage = "Set `ignoreScripts = true` under [install] in bunfig.toml — or set `\"trustedDependencies\": []` in package.json — to opt out of the curated allow-list (postinstall is already blocked for untrusted packages by default).";
-const bunBinding = {
-	check(ctx, config) {
-		const ignoreScripts = getByPath(config, ["install", "ignoreScripts"]);
-		if (ignoreScripts === true) return { state: "ok" };
-		const trusted = ctx.packageJson?.trustedDependencies;
-		if (typeof trusted !== "undefined" && trusted.length === 0) return { state: "ok" };
-		return {
-			remediation: proposeChanges(config, [{
-				file: bunfig$3,
-				keyPath: ["install", "ignoreScripts"],
-				op: "setKey",
-				value: true
-			}]),
-			actual: ignoreScripts,
-			expected: true,
-			message: bunMessage,
-			state: "violation"
-		};
-	},
-	docs: "https://bun.com/docs/pm/lifecycle",
-	file: bunfig$3,
-	severity: "info",
-	versionNote: { configAvailableSince: "bun 1.2.0" }
-};
-const disableLifecycleScripts = withAubeParanoid(overrideBindings(requireConfigKey({
-	bindings: {
-		npm: {
-			docs: "https://docs.npmjs.com/cli/v11/using-npm/config#ignore-scripts",
-			file: npmrc$5,
-			keyPath: ["ignore-scripts"],
-			message: "Set `ignore-scripts=true` in .npmrc to block dependency lifecycle scripts.",
-			value: true
-		},
-		yarn: {
-			docs: "https://yarnpkg.com/configuration/yarnrc#enableScripts",
-			documentedDefault: false,
-			defaultSafety: "conditional",
-			file: yarnrc$6,
-			keyPath: ["enableScripts"],
-			message: "Set `enableScripts: false` in .yarnrc.yml to pin the policy across versions.",
-			value: false,
-			versionNote: {
-				configAvailableSince: "yarn 2.0.0",
-				defaultSafeSince: "yarn 4.14.0"
-			}
-		}
-	},
-	description: "Malicious postinstall scripts are a primary supply-chain attack vector. Prevent automatic execution of dependency lifecycle scripts.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#1-disable-lifecycle-scripts",
-	id: "disable-lifecycle-scripts",
-	severity: "error",
-	title: "Disable dependency lifecycle scripts"
-}), {
-	aube: aubeBinding$2,
-	bun: bunBinding,
-	pnpm: pnpmBinding$4
-}));
-//#endregion
-//#region src/core/rules/enforce-strict-ssl.ts
-const { npmrc: npmrc$4, yarnrc: yarnrc$5 } = CONFIG_FILES;
-const yarnMessage = "Set `enableStrictSsl: true` in .yarnrc.yml to enforce SSL certificate validation for registry connections.";
-const yarnBinding = {
-	check(_ctx, config) {
-		const strictSsl = getByPath(config, ["enableStrictSsl"]);
-		const whitelist = getByPath(config, ["unsafeHttpWhitelist"]);
-		if (Array.isArray(whitelist) && whitelist.length > 0) return {
-			actual: whitelist,
-			expected: "",
-			remediation: {
-				kind: "manual",
-				steps: ["Review and remove entries from `unsafeHttpWhitelist` in .yarnrc.yml. Each entry permits unencrypted HTTP to that hostname. Also set `enableStrictSsl: true`."]
-			},
-			message: "`unsafeHttpWhitelist` in .yarnrc.yml allows unencrypted HTTP connections — remove entries or clear the list to enforce HTTPS-only registry access.",
-			state: "violation"
-		};
-		if (strictSsl === true) return { state: "ok" };
-		return {
-			state: "violation",
-			actual: strictSsl,
-			expected: true,
-			message: yarnMessage,
-			...strictSsl === void 0 ? { severity: "info" } : {},
-			remediation: proposeChanges(config, [{
-				file: yarnrc$5,
-				keyPath: ["enableStrictSsl"],
-				op: "setKey",
-				value: true
-			}])
-		};
-	},
-	docs: "https://yarnpkg.com/configuration/yarnrc#enableStrictSsl",
-	file: yarnrc$5
-};
-const enforceStrictSsl = overrideBindings(requireConfigKey({
-	bindings: { npm: {
-		docs: "https://docs.npmjs.com/cli/v11/using-npm/config#strict-ssl",
-		documentedDefault: true,
-		defaultSafety: "unconditional",
-		file: npmrc$4,
-		keyPath: ["strict-ssl"],
-		message: "Set `strict-ssl=true` in .npmrc to enforce SSL certificate validation.",
-		value: true
-	} },
-	description: "Require SSL certificate validation so registry traffic cannot be intercepted or tampered with.",
-	docs: "https://docs.npmjs.com/cli/v11/using-npm/config#strict-ssl",
-	id: "enforce-strict-ssl",
-	severity: "warn",
-	title: "Enforce SSL for registry connections"
-}), { yarn: yarnBinding });
-//#endregion
-//#region src/core/resolve-project-type.ts
-const isPublishableName = (value) => typeof value === "string" && value.trim().length > 0;
-const resolveProjectType = (selected, inferredPackage) => selected ?? (inferredPackage ? "package" : "application");
-const resolvePackageJsonProjectType = (ctx) => {
-	const pkg = ctx.packageJson;
-	const inferredPackage = pkg?.private !== true && isPublishableName(pkg?.name);
-	return resolveProjectType(ctx.projectType, inferredPackage);
-};
-const resolveDenoProjectType = (ctx, denoConfig) => resolveProjectType(ctx.projectType, getByPath(denoConfig, ["publish"]) !== false && isPublishableName(getByPath(denoConfig, ["name"])));
-//#endregion
-//#region src/core/rules/publishable.ts
-const isPublishable = (ctx) => resolvePackageJsonProjectType(ctx) === "package";
-//#endregion
-//#region src/core/rules/files-field.ts
-const { packageJson: packageJson$1, denoJson: denoJson$3 } = CONFIG_FILES;
-const packageJsonFilesBinding = {
-	check(ctx) {
-		if (!isPublishable(ctx)) return { state: "na" };
-		const files = ctx.packageJson?.files;
-		if (isStringList(files) && files.length > 0) return { state: "ok" };
-		return {
-			remediation: {
-				kind: "manual",
-				steps: ["Add a `files` array to package.json (e.g. [\"dist\"]) and verify with `npm pack --dry-run`."]
-			},
-			actual: files,
-			message: "Add a `files` allow-list to package.json to limit what gets published.",
-			state: "violation"
-		};
-	},
-	docs: "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#files",
-	file: packageJson$1
-};
-const denoPublishBinding = {
-	check(ctx, config) {
-		if (resolveDenoProjectType(ctx, config) !== "package") return { state: "na" };
-		const include = getByPath(config, ["publish", "include"]);
-		if (isStringList(include) && include.length > 0) return { state: "ok" };
-		return {
-			remediation: {
-				kind: "manual",
-				steps: ["Add a non-empty `publish.include` array to deno.json; use `publish.exclude` for additional exclusions."]
-			},
-			actual: include,
-			message: "Add `publish.include` to deno.json to limit what gets published.",
-			state: "violation"
-		};
-	},
-	docs: "https://docs.deno.com/runtime/reference/deno_json/#publish---override-.gitignore",
-	file: denoJson$3
-};
-const filesField = defineRule({
-	bindings: {
-		aube: packageJsonFilesBinding,
-		bun: packageJsonFilesBinding,
-		deno: denoPublishBinding,
-		npm: packageJsonFilesBinding,
-		pnpm: packageJsonFilesBinding,
-		yarn: packageJsonFilesBinding
-	},
-	description: "An explicit `files` array in package.json restricts what gets published, preventing accidental inclusion of secrets or local files.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#12-review-published-files",
-	id: "files-field",
-	projectTypes: ["package"],
-	severity: "info",
-	title: "Declare a published files allow-list"
-});
-//#endregion
-//#region src/core/rules/frozen-lockfile.ts
-const { pnpmWorkspace: pnpmWorkspace$7, yarnrc: yarnrc$4, bunfig: bunfig$2, denoJson: denoJson$2 } = CONFIG_FILES;
-const aubeFrozenCommand = "Use `aube ci` or `aube install --frozen-lockfile` to fail when the lockfile would change.";
-const frozenLockfile = overrideBindings(requireConfigKey({
-	bindings: {
-		deno: {
-			docs: "https://docs.deno.com/runtime/reference/deno_json/#lockfile",
-			file: denoJson$2,
-			keyPath: ["lock", "frozen"],
-			message: "Set `lock.frozen: true` in deno.json for reproducible, verified installs.",
-			value: true
-		},
-		bun: {
-			docs: "https://bun.com/docs/runtime/bunfig#install-frozenlockfile",
-			file: bunfig$2,
-			keyPath: ["install", "frozenLockfile"],
-			message: "Set `frozenLockfile = true` under [install] in bunfig.toml so installs fail when the lockfile would change.",
-			value: true,
-			versionNote: { configAvailableSince: "bun 0.6.10" }
-		},
-		pnpm: {
-			docs: "https://pnpm.io/cli/install#--frozen-lockfile",
-			file: pnpmWorkspace$7,
-			keyPath: ["frozenLockfile"],
-			message: "pnpm defaults frozenLockfile to true in CI — set it explicitly in pnpm-workspace.yaml to pin the policy outside CI too.",
-			value: true
-		},
-		yarn: {
-			docs: "https://yarnpkg.com/configuration/yarnrc#enableImmutableInstalls",
-			documentedDefault: true,
-			defaultSafety: "conditional",
-			file: yarnrc$4,
-			keyPath: ["enableImmutableInstalls"],
-			message: "Set `enableImmutableInstalls: true` in .yarnrc.yml to pin the policy outside CI too.",
-			value: true,
-			versionNote: {
-				configAvailableSince: "yarn 2.0.0",
-				defaultSafeSince: "yarn 3.0.0 in CI"
-			}
-		}
-	},
-	description: "Refuse to mutate the lockfile on install so unexpected dependency changes fail loudly.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#3-include-lockfiles",
-	id: "frozen-lockfile",
-	severity: "warn",
-	title: "Freeze the lockfile"
-}), { aube: {
-	check() {
-		return {
-			remediation: {
-				kind: "manual",
-				steps: [aubeFrozenCommand]
-			},
-			message: "`preferFrozenLockfile` only reuses an up-to-date lockfile; it does not prevent updates. Verify that install commands enforce a frozen lockfile.",
-			state: "violation"
-		};
-	},
-	docs: "https://github.com/aubepkg/aube/blob/main/docs/cli/ci.md",
-	severity: "info"
-} });
-//#endregion
-//#region src/core/rules/frozen-store.ts
-const { pnpmWorkspace: pnpmWorkspace$6 } = CONFIG_FILES;
-const frozenStore = defineRule({
-	bindings: { pnpm: {
-		check(ctx, config) {
-			const value = getByPath(config, ["frozenStore"]);
-			if (value === true) return { state: "ok" };
-			return {
-				remediation: guardRemediationAvailability("pnpm", ctx.pmVersion, {
-					kind: "manual",
-					steps: ["Populate the store before enabling `frozenStore: true`. Use it for read-only deployments; it is incompatible with --force and a configured pnpr server."]
-				}, [{
-					file: pnpmWorkspace$6,
-					keyPath: ["frozenStore"]
-				}]),
-				actual: value,
-				message: "For a pre-populated read-only store, consider `frozenStore` in pnpm-workspace.yaml. Normal installs need a writable store.",
-				state: "violation"
-			};
-		},
-		docs: "https://pnpm.io/settings/store#frozenstore",
-		file: pnpmWorkspace$6,
-		versionNote: { configAvailableSince: "pnpm 11.7.0" }
-	} },
-	description: "Consider read-only store access for deployments whose dependencies are already present.",
-	docs: "https://pnpm.io/settings/store#frozenstore",
-	id: "frozen-store",
-	severity: "info",
-	title: "Consider a pre-populated read-only store"
-});
-//#endregion
-//#region src/core/rules/hardened-mode.ts
-const { yarnrc: yarnrc$3 } = CONFIG_FILES;
-const hardenedMode = requireConfigKey({
-	bindings: { yarn: {
-		docs: "https://yarnpkg.com/configuration/yarnrc#enableHardenedMode",
-		documentedDefault: true,
-		defaultSafety: "conditional",
-		file: yarnrc$3,
-		keyPath: ["enableHardenedMode"],
-		message: "yarn enables hardened mode automatically only for pull requests on public repositories — set `enableHardenedMode: true` in .yarnrc.yml to extend end-to-end install verification to every install.",
-		value: true,
-		versionNote: {
-			configAvailableSince: "yarn 4.0.0",
-			defaultSafeSince: "yarn 4.0.0 (conditional: auto-enabled for PRs on public repositories)"
-		}
-	} },
-	description: "Yarn 4's enableHardenedMode performs end-to-end checksum, lockfile, and version verification at install time.",
-	docs: "https://yarnpkg.com/configuration/yarnrc#enableHardenedMode",
-	id: "hardened-mode",
-	severity: "warn",
-	title: "Enable hardened mode (yarn)"
-});
-//#endregion
-//#region src/core/rules/deno-release-age.ts
-const DENO_DURATION = /^\+?P(?:\+?\d+[Ww]|(?:\d+[Dd])*(?:T(?:\d+[HhMm]|\d+(?:\.\d+)?[Ss])+)?)$/u;
-const DENO_MIN_TIMESTAMP = Date.UTC(-262143, 0, 1);
-const DENO_UNIT_SECONDS = {
-	w: 604800,
-	d: 86400,
-	h: 3600,
-	m: 60,
-	s: 1
-};
-const DENO_DATE = /^\d{4}-\d{2}-\d{2}$/u;
-const DENO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}[Tt ](?:[01]\d|2[0-3]):[0-5]\d:(?:[0-5]\d|60)(?:\.\d+)?(?:[Zz]|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/u;
-const DENO_OFFSET_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T(?:[01]\d|2[0-3]):[0-5]\d(?::(?:[0-5]\d|60))?[+-](?:[01]\d|2[0-3]):?[0-5]\d$/u;
-const DENO_DURATION_TOKEN = /(\d+)(?:\.(\d+))?([WDHMS])/giu;
-const LEAP_SECOND = /:60(?=\.|Z|z|[+-])/u;
-const isPositiveDenoSeconds = (seconds, now) => seconds > 0 && Number.isFinite(seconds) && now - seconds * 1e3 >= DENO_MIN_TIMESTAMP;
-const durationSeconds = (value) => {
-	let seconds = 0;
-	for (const [, integer, fraction, unit] of value.matchAll(DENO_DURATION_TOKEN)) {
-		const amount = Number(integer) + Number(`0.${(fraction ?? "").slice(0, 9) || "0"}`);
-		seconds += amount * (DENO_UNIT_SECONDS[unit?.toLowerCase() ?? ""] ?? 0);
-	}
-	return seconds;
-};
-/** Match Deno's minimumDependencyAge value grammar and active-cutoff semantics. */
-const isActiveDenoReleaseAge = (value, now, parse) => {
-	if (typeof value === "number") return Number.isSafeInteger(value) && isPositiveDenoSeconds(value * 60, now);
-	if (typeof value !== "string") return false;
-	if (/^\d+$/u.test(value)) return Number.isSafeInteger(Number(value)) && isPositiveDenoSeconds(Number(value) * 60, now);
-	if (DENO_DURATION.test(value)) return isPositiveDenoSeconds(durationSeconds(value), now);
-	if (!DENO_DATE.test(value) && !DENO_TIMESTAMP.test(value) && !DENO_OFFSET_TIMESTAMP.test(value)) return false;
-	const date = value.slice(0, 10);
-	const midnight = /* @__PURE__ */ new Date(`${date}T00:00:00Z`);
-	const leapSecond = LEAP_SECOND.test(value);
-	const timestamp = parse(value.replace(LEAP_SECOND, ":59")) + (leapSecond ? 1e3 : 0);
-	return !Number.isNaN(midnight.valueOf()) && midnight.toISOString().slice(0, 10) === date && timestamp < now;
-};
-//#endregion
-//#region src/core/rules/minimum-release-age.ts
-const HOURS_PER_DAY = 24;
-const MINUTES_PER_HOUR = 60;
-const SECONDS_PER_MINUTE = 60;
-const MINUTES_PER_DAY = HOURS_PER_DAY * MINUTES_PER_HOUR;
-const SECONDS_PER_DAY = MINUTES_PER_DAY * SECONDS_PER_MINUTE;
-const RECOMMENDED_RELEASE_AGE_DAYS = 3;
-const RECOMMENDED_RELEASE_AGE_MINUTES = RECOMMENDED_RELEASE_AGE_DAYS * MINUTES_PER_DAY;
-const RECOMMENDED_RELEASE_AGE_SECONDS = RECOMMENDED_RELEASE_AGE_DAYS * SECONDS_PER_DAY;
-const DOCUMENTED_DEFAULT_MINUTES = MINUTES_PER_DAY;
-const { npmrc: npmrc$3, pnpmWorkspace: pnpmWorkspace$5, yarnrc: yarnrc$2, bunfig: bunfig$1, denoJson: denoJson$1, aubeWorkspace: aubeWorkspace$4 } = CONFIG_FILES;
-const isPositiveNumber = (value) => typeof value === "number" && Number.isFinite(value) && value > 0;
-const isPositiveYarnDuration = (value) => isPositiveNumber(value) || typeof value === "string" && /^\d*\.?\d+(?:ms|s|m|h|d|w)?$/u.test(value) && Number.isFinite(Number.parseFloat(value)) && Number.parseFloat(value) > 0;
-const isNonDisabledDenoReleaseAge = (value, now, parse) => {
-	if (!isPlainRecord(value)) return isActiveDenoReleaseAge(value, now, parse);
-	if (Object.keys(value).some((key) => key !== "age" && key !== "exclude")) return false;
-	if (value.exclude !== void 0 && !isStringList(value.exclude)) return false;
-	return value.age != null && isActiveDenoReleaseAge(value.age, now, parse);
-};
-const denoAgeUsesFallback = (value) => {
-	if (value === void 0 || value === null) return true;
-	if (!isPlainRecord(value)) return false;
-	if (Object.keys(value).some((key) => key !== "age" && key !== "exclude")) return false;
-	if (value.exclude !== void 0 && !isStringList(value.exclude)) return false;
-	return value.age == null;
-};
-const isPositiveDenoNpmrcDays = (value, now, parse) => typeof value === "number" && Number.isSafeInteger(value) && isActiveDenoReleaseAge(value * MINUTES_PER_DAY, now, parse);
-const baseRule$2 = requireConfigKey({
-	bindings: {
-		aube: {
-			accept: isPositiveNumber,
-			docs: "https://aube.sh/settings/",
-			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
-			defaultSafety: "unconditional",
-			file: aubeWorkspace$4,
-			keyPath: ["minimumReleaseAge"],
-			message: `Set minimumReleaseAge (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in aube-workspace.yaml.`,
-			value: RECOMMENDED_RELEASE_AGE_MINUTES
-		},
-		bun: {
-			accept: isPositiveNumber,
-			docs: "https://bun.com/docs/runtime/bunfig#install-minimumreleaseage",
-			file: bunfig$1,
-			keyPath: ["install", "minimumReleaseAge"],
-			message: `Set install.minimumReleaseAge (bun) to ~${RECOMMENDED_RELEASE_AGE_SECONDS} seconds to quarantine brand-new releases.`,
-			value: RECOMMENDED_RELEASE_AGE_SECONDS,
-			versionNote: { configAvailableSince: "bun 1.3.0" }
-		},
-		pnpm: {
-			accept: isPositiveNumber,
-			docs: "https://pnpm.io/settings/dependency-resolution#minimumreleaseage",
-			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
-			defaultSafety: "conditional",
-			file: pnpmWorkspace$5,
-			keyPath: ["minimumReleaseAge"],
-			message: `Set minimumReleaseAge (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in pnpm-workspace.yaml.`,
-			value: RECOMMENDED_RELEASE_AGE_MINUTES,
-			versionNote: {
-				configAvailableSince: "pnpm 10.16.0",
-				defaultSafeSince: "pnpm 11.0.0 (1440 minutes)"
-			}
-		},
-		yarn: {
-			accept: isPositiveYarnDuration,
-			docs: "https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate",
-			documentedDefault: DOCUMENTED_DEFAULT_MINUTES,
-			defaultSafety: "conditional",
-			file: yarnrc$2,
-			keyPath: ["npmMinimalAgeGate"],
-			message: `Set npmMinimalAgeGate (~${RECOMMENDED_RELEASE_AGE_MINUTES} minutes for a 3-day cooldown) in .yarnrc.yml.`,
-			value: RECOMMENDED_RELEASE_AGE_MINUTES,
-			versionNote: {
-				configAvailableSince: "yarn 4.10.0",
-				defaultSafeSince: "yarn 4.15.0 (1440 minutes)"
-			}
-		}
-	},
-	description: "Refuse to install releases newer than a cooldown window so freshly published (possibly compromised) versions are skipped.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#2-set-cooldowns--minimum-release-age",
-	id: "minimum-release-age",
-	severity: "warn",
-	title: "Set a minimum release age"
-});
-const createNpmBinding = (time) => ({
-	file: npmrc$3,
-	docs: "https://docs.npmjs.com/cli/v12/using-npm/config#min-release-age",
-	versionNote: { note: "min-release-age available since npm 11.10.0" },
-	check(ctx, config) {
-		const now = time.now();
-		if (Object.hasOwn(config, "before")) {
-			const actual = config.before;
-			if ((typeof actual === "string" || typeof actual === "number") && time.parse(String(actual)) < now) return { state: "ok" };
-			return {
-				state: "violation",
-				actual,
-				expected: "a date in the past",
-				message: "Use a valid past before cutoff, or remove before and set min-release-age.",
-				remediation: {
-					kind: "manual",
-					steps: ["In .npmrc, set before to a valid past date. A future or disabled before overrides min-release-age in this file.", ...guardRemediationAvailability("npm", ctx.pmVersion, {
-						kind: "manual",
-						steps: [`Alternatively, remove before and set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days.`]
-					}, [{
-						file: npmrc$3,
-						keyPath: ["min-release-age"]
-					}])?.steps ?? []]
-				}
-			};
-		}
-		const actual = getByPath(config, ["min-release-age"]);
-		const age = typeof actual === "number" || typeof actual === "string" ? Number(actual) : NaN;
-		const cutoff = (/* @__PURE__ */ new Date(now - SECONDS_PER_DAY * 1e3 * age)).valueOf();
-		if (age > 0 && Number.isFinite(cutoff) && cutoff < now) return { state: "ok" };
-		return {
-			state: "violation",
-			actual,
-			expected: RECOMMENDED_RELEASE_AGE_DAYS,
-			message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days to quarantine brand-new releases.`,
-			remediation: guardRemediationAvailability("npm", ctx.pmVersion, proposeChanges(config, [{
-				file: npmrc$3,
-				op: "setKey",
-				keyPath: ["min-release-age"],
-				value: RECOMMENDED_RELEASE_AGE_DAYS
-			}]), [{
-				file: npmrc$3,
-				keyPath: ["min-release-age"]
-			}])
-		};
-	}
-});
-const createDenoBinding = (time) => ({
-	file: denoJson$1,
-	docs: "https://docs.deno.com/runtime/reference/deno_json/",
-	versionNote: {
-		defaultSafeSince: "deno 2.9.0 (1440 minutes)",
-		note: "object age may be omitted; project .npmrc fallback available since deno 2.8.1"
-	},
-	check(ctx, config) {
-		const actual = getByPath(config, ["minimumDependencyAge"]);
-		const now = time.now();
-		if (denoAgeUsesFallback(actual)) {
-			const npmrcConfig = ctx.readConfig(npmrc$3);
-			const npmrcAge = getByPath(npmrcConfig, ["min-release-age"]);
-			if (isPositiveDenoNpmrcDays(npmrcAge, now, time.parse)) return { state: "ok" };
-			if (npmrcAge === 0) return {
-				state: "violation",
-				actual: npmrcAge,
-				expected: RECOMMENDED_RELEASE_AGE_DAYS,
-				file: npmrc$3.path,
-				message: `Set min-release-age to ~${RECOMMENDED_RELEASE_AGE_DAYS} days in .npmrc, or set minimumDependencyAge in deno.json.`,
-				remediation: proposeChanges(npmrcConfig, [{
-					file: npmrc$3,
-					op: "setKey",
-					keyPath: ["min-release-age"],
-					value: RECOMMENDED_RELEASE_AGE_DAYS
-				}])
-			};
-		}
-		if (isNonDisabledDenoReleaseAge(actual, now, time.parse)) return { state: "ok" };
-		const objectAge = isPlainRecord(actual);
-		const invalidObject = objectAge && (Object.keys(actual).some((key) => key !== "age" && key !== "exclude") || actual.exclude !== void 0 && !isStringList(actual.exclude));
-		return {
-			state: "violation",
-			actual,
-			expected: "P3D",
-			message: `Set minimumDependencyAge (e.g. "P3D" for a ${RECOMMENDED_RELEASE_AGE_DAYS}-day cooldown) in deno.json.`,
-			remediation: invalidObject ? {
-				kind: "manual",
-				steps: ["Use only age and exclude in minimumDependencyAge. Make exclude a list of package names and set age to a positive supported duration."]
-			} : proposeChanges(config, [{
-				file: denoJson$1,
-				op: "setKey",
-				keyPath: objectAge ? ["minimumDependencyAge", "age"] : ["minimumDependencyAge"],
-				value: "P3D"
-			}])
-		};
-	}
-});
-const createMinimumReleaseAge = (time) => overrideBindings(baseRule$2, {
-	npm: createNpmBinding(time),
-	deno: createDenoBinding(time)
-});
-//#endregion
-//#region src/core/rules/named-registries.ts
-const { pnpmWorkspace: pnpmWorkspace$4 } = CONFIG_FILES;
-const isNonEmptyObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
-const namedRegistries = defineRule({
-	bindings: { pnpm: {
-		check(_ctx, config) {
-			const value = getByPath(config, ["namedRegistries"]);
-			if (!isNonEmptyObject$1(value)) return { state: "ok" };
-			return {
-				remediation: {
-					kind: "manual",
-					steps: ["Verify each named registry points to a trusted source and that scoped packages cannot be hijacked via a public registry of the same name."]
-				},
-				actual: value,
-				message: "Review `namedRegistries` in pnpm-workspace.yaml. Custom registry mappings can redirect package resolution away from the public registry, enabling dependency confusion attacks.",
-				state: "violation"
-			};
-		},
-		docs: "https://pnpm.io/settings/dependency-resolution#namedregistries",
-		file: pnpmWorkspace$4
-	} },
-	description: "Flag named registry mappings that redirect package resolution to custom registries, which may enable dependency confusion attacks.",
-	docs: "https://pnpm.io/settings/dependency-resolution#namedregistries",
-	id: "named-registries",
-	severity: "info",
-	title: "Review named registry mappings"
-});
-//#endregion
-//#region src/core/rules/paranoid-mode.ts
-const { aubeWorkspace: aubeWorkspace$3 } = CONFIG_FILES;
-const paranoidMode = requireConfigKey({
-	bindings: { aube: {
-		docs: "https://aube.jdx.dev/security.html",
-		file: aubeWorkspace$3,
-		keyPath: ["paranoid"],
-		message: "Set `paranoid: true` in aube-workspace.yaml to enable the strict-security bundle (trustPolicy, jailBuilds, minimumReleaseAgeStrict, strictStoreIntegrity, strictDepBuilds, advisoryCheck).",
-		value: true
-	} },
-	description: "Activate the strict-security setting bundle that forces trustPolicy, jailBuilds, minimumReleaseAgeStrict, strictStoreIntegrity, strictDepBuilds, and advisoryCheck on in one switch.",
-	docs: "https://aube.jdx.dev/security.html",
-	id: "paranoid-mode",
-	severity: "info",
-	title: "Enable paranoid security mode"
-});
-//#endregion
-//#region src/core/rules/patched-dependencies.ts
-const { pnpmWorkspace: pnpmWorkspace$3 } = CONFIG_FILES;
-const isNonEmptyObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length > 0;
-const patchedDependencies = defineRule({
-	bindings: { pnpm: {
-		check(_ctx, config) {
-			const value = getByPath(config, ["patchedDependencies"]);
-			if (!isNonEmptyObject(value)) return { state: "ok" };
-			return {
-				remediation: {
-					kind: "manual",
-					steps: ["Review each entry in `patchedDependencies` — verify patches address a known issue and have not been tampered with."]
-				},
-				actual: value,
-				message: "Review `patchedDependencies` in pnpm-workspace.yaml. Local patches modify dependency code after the registry artifact is verified; review the patch files separately.",
-				state: "violation"
-			};
-		},
-		docs: "https://pnpm.io/cli/patch#patcheddependencies",
-		file: pnpmWorkspace$3
-	} },
-	description: "Review local patches separately from the registry artifacts they modify.",
-	docs: "https://pnpm.io/cli/patch#patcheddependencies",
-	id: "patched-dependencies",
-	severity: "info",
-	title: "Review patched dependencies"
-});
-//#endregion
-//#region src/core/rules/pin-exact-versions.ts
-const { npmrc: npmrc$2, pnpmWorkspace: pnpmWorkspace$2, yarnrc: yarnrc$1, bunfig, denoJson } = CONFIG_FILES;
-const REGISTRY_VERSION = /^(?:npm|jsr):(?:@[^/@]+\/)?[^/@]+@(?<version>[^/]*)/u;
-const isUnpinnedRegistryImport = (specifier) => {
-	if (!specifier.startsWith("npm:") && !specifier.startsWith("jsr:")) return false;
-	const version = REGISTRY_VERSION.exec(specifier)?.groups?.version;
-	const normalized = version?.startsWith("=") ? version.slice(1) : version;
-	return normalized === void 0 || valid(normalized) === null;
-};
-const collectUnpinnedImports = (imports, location) => {
-	if (!isPlainRecord(imports)) throw new ConfigError(`deno.json: ${location} must be an import mapping object.`);
-	const offenders = [];
-	for (const [name, value] of Object.entries(imports)) {
-		if (value === null) continue;
-		if (typeof value !== "string") throw new ConfigError(`deno.json: ${location}.${name} must be a string or null.`);
-		if (isUnpinnedRegistryImport(value)) offenders.push(`${location}.${name}=${value}`);
-	}
-	return offenders;
-};
-const MAX_SAMPLE_COUNT = 3;
-const formatOffenders = (offenders) => {
-	const sample = offenders.slice(0, MAX_SAMPLE_COUNT).join(", ");
-	let more = "";
-	if (offenders.length > MAX_SAMPLE_COUNT) more = ` (and ${offenders.length - MAX_SAMPLE_COUNT} more)`;
-	return {
-		remediation: {
-			kind: "manual",
-			steps: ["Pin each reported imports/scopes entry in deno.json to an exact version. For top-level imports, `deno add --save-exact <pkg>` can help; edit scoped mappings at their reported locations."]
-		},
-		message: `${offenders.length} deno imports are not pinned: ${sample}${more}. Use \`deno add --save-exact\` or pin manually.`,
-		state: "violation"
-	};
-};
-const OK = { state: "ok" };
-const unpinnedInlineImports = (config) => {
-	const imports = getByPath(config, ["imports"]);
-	const offenders = imports == null ? [] : collectUnpinnedImports(imports, "imports");
-	const scopes = getByPath(config, ["scopes"]);
-	if (scopes != null) {
-		if (!isPlainRecord(scopes)) throw new ConfigError("deno.json: scopes must be an object.");
-		for (const [scope, mapping] of Object.entries(scopes)) offenders.push(...collectUnpinnedImports(mapping, `scopes[${JSON.stringify(scope)}]`));
-	}
-	return offenders;
-};
-const denoBinding = {
-	check(_ctx, config) {
-		const offenders = unpinnedInlineImports(config);
-		if (offenders.length === 0) return OK;
-		return formatOffenders(offenders);
-	},
-	docs: "https://docs.deno.com/runtime/reference/cli/add/",
-	file: denoJson,
-	versionNote: { configAvailableSince: "deno 1.30.0" }
-};
-const npmBinding = {
-	file: npmrc$2,
-	docs: "https://docs.npmjs.com/cli/v12/using-npm/config#save-exact",
-	check(_ctx, config) {
-		const exact = getByPath(config, ["save-exact"]);
-		const prefix = getByPath(config, ["save-prefix"]);
-		if (exact === true || prefix === "" || prefix === "=") return OK;
-		return {
-			remediation: proposeChanges(config, [{
-				op: "setKey",
-				file: npmrc$2,
-				keyPath: ["save-exact"],
-				value: true
-			}]),
-			state: "violation",
-			actual: exact,
-			expected: true,
-			message: "Set `save-exact=true` in .npmrc to save exact versions by default."
-		};
-	}
-};
-const aubeBinding = {
-	file: npmrc$2,
-	docs: "https://aube.sh/settings/#setting-saveprefix",
-	check(_ctx, config) {
-		const prefixes = ["save-prefix", "savePrefix"].filter((key) => Object.hasOwn(config, key)).map((key) => config[key]);
-		if (prefixes.length > 0 && prefixes.every((value) => value === "")) return OK;
-		return {
-			remediation: {
-				kind: "manual",
-				steps: ["Use one `save-prefix=` entry in .npmrc. Aube resolves aliases by line order; reconcile conflicting entries before changing them."]
-			},
-			state: "violation",
-			message: "Set `save-prefix=` in .npmrc; remove any conflicting `savePrefix` alias."
-		};
-	}
-};
-const pinExactVersions = overrideBindings(requireConfigKey({
-	bindings: {
-		bun: {
-			docs: "https://bun.com/docs/runtime/bunfig#install-exact",
-			file: bunfig,
-			keyPath: ["install", "exact"],
-			message: "Set `exact = true` under [install] in bunfig.toml to pin exact versions.",
-			value: true,
-			versionNote: { note: "install.exact verified in bun 1.2.0" }
-		},
-		pnpm: {
-			accept: (value) => value === "" || value === "=",
-			docs: "https://pnpm.io/settings/other#saveprefix",
-			file: pnpmWorkspace$2,
-			keyPath: ["savePrefix"],
-			message: "Set `savePrefix: ''` in pnpm-workspace.yaml to pin exact versions.",
-			value: ""
-		},
-		yarn: {
-			docs: "https://yarnpkg.com/configuration/yarnrc#defaultSemverRangePrefix",
-			file: yarnrc$1,
-			keyPath: ["defaultSemverRangePrefix"],
-			message: "Set `defaultSemverRangePrefix: ''` in .yarnrc.yml to pin exact versions.",
-			value: "",
-			versionNote: { configAvailableSince: "yarn 2.0.0" }
-		}
-	},
-	description: "Semver ranges (^, ~) auto-adopt new releases, including compromised ones. Save exact versions by default; for Deno, inspect registry mappings in both inline imports and scopes (not external import maps).",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#4-pin-dependency-versions",
-	id: "pin-exact-versions",
-	severity: "error",
-	title: "Pin exact dependency versions"
-}), {
-	aube: aubeBinding,
-	deno: denoBinding,
-	npm: npmBinding
-});
-//#endregion
-//#region src/core/rules/provenance.ts
-const { npmrc: npmrc$1, yarnrc } = CONFIG_FILES;
-const npmrcProvenance = {
-	file: npmrc$1,
-	keyPath: ["provenance"],
-	message: "Set `provenance=true` (and publish from CI) to attest releases.",
-	value: true
-};
-const baseRule = requireConfigKey({
-	applies: isPublishable,
-	bindings: {
-		bun: {
-			...npmrcProvenance,
-			docs: "https://github.com/oven-sh/bun/issues/15601",
-			message: "Set `provenance=true` in .npmrc and publish via `bunx npm publish` from CI — `bun publish` does not emit provenance attestations natively (tracking: oven-sh/bun#15601)."
-		},
-		npm: {
-			...npmrcProvenance,
-			docs: "https://docs.npmjs.com/cli/v11/using-npm/config#provenance",
-			versionNote: { configAvailableSince: "npm 9.5.0" }
-		},
-		pnpm: {
-			...npmrcProvenance,
-			docs: "https://pnpm.io/cli/publish"
-		},
-		yarn: {
-			docs: "https://yarnpkg.com/configuration/yarnrc#npmPublishProvenance",
-			file: yarnrc,
-			keyPath: ["npmPublishProvenance"],
-			message: "Set `npmPublishProvenance: true` (and publish from CI) to attest releases.",
-			value: true
-		}
-	},
-	description: "Provenance statements (via Sigstore) bind a published artifact to its recorded source and build.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#11-generate-provenance-statements",
-	id: "provenance",
-	projectTypes: ["package"],
-	severity: "warn",
-	title: "Publish with provenance"
-});
-const provenance = overrideBindings(baseRule, { npm: {
-	...baseRule.bindings.npm,
-	check(ctx, config) {
-		if (!isPublishable(ctx)) return { state: "na" };
-		const publishConfig = ctx.packageJson?.publishConfig;
-		if (!publishConfig || !Object.hasOwn(publishConfig, "provenance")) return baseRule.bindings.npm.check(ctx, config);
-		if (publishConfig.provenance === true) return { state: "ok" };
-		const file = CONFIG_FILES.packageJson;
-		return {
-			state: "violation",
-			file: file.path,
-			actual: publishConfig.provenance,
-			expected: true,
-			message: "Set publishConfig.provenance=true in package.json (and publish from CI) to attest releases.",
-			remediation: guardRemediationAvailability("npm", ctx.pmVersion, proposeChanges(ctx.readConfig(file), [{
-				file,
-				op: "setKey",
-				keyPath: ["publishConfig", "provenance"],
-				value: true
-			}]))
-		};
-	}
-} });
-//#endregion
-//#region src/core/rules/publish-access.ts
-const { packageJson } = CONFIG_FILES;
-const publishAccessBinding = {
-	check(ctx) {
-		if (!isPublishable(ctx)) return { state: "na" };
-		const access = ctx.packageJson?.publishConfig?.access;
-		if (access === "public" || access === "restricted") return { state: "ok" };
-		return {
-			remediation: {
-				kind: "manual",
-				steps: ["Add `\"publishConfig\": { \"access\": \"public\" }` (or `\"restricted\"`) to package.json so publishes never default unexpectedly."]
-			},
-			actual: access,
-			message: "Set `publishConfig.access` in package.json to `public` or `restricted` to declare publish scope explicitly.",
-			state: "violation"
-		};
-	},
-	docs: "https://docs.npmjs.com/cli/v11/configuring-npm/package-json#publishconfig",
-	file: packageJson
-};
-const publishAccess = defineRule({
-	bindings: {
-		aube: publishAccessBinding,
-		bun: publishAccessBinding,
-		npm: {
-			...publishAccessBinding,
-			docs: "https://docs.npmjs.com/cli/v12/using-npm/config#access",
-			check(ctx, config) {
-				if (isPublishable(ctx) && ctx.packageJson?.publishConfig?.access === "private") return { state: "ok" };
-				return publishAccessBinding.check(ctx, config);
-			}
-		},
-		pnpm: publishAccessBinding,
-		yarn: publishAccessBinding
-	},
-	description: "Set `publishConfig.access` so a misconfigured scope or registry never accidentally publishes an internal package publicly.",
-	docs: "https://github.com/bodadotsh/npm-security-best-practices#for-maintainers",
-	id: "publish-access",
-	projectTypes: ["package"],
-	severity: "info",
-	title: "Declare publish access explicitly"
-});
-//#endregion
-//#region src/core/rules/store-server.ts
-const { pnpmWorkspace: pnpmWorkspace$1 } = CONFIG_FILES;
-const storeServer = defineRule({
-	bindings: { pnpm: {
-		check(_ctx, config) {
-			const value = getByPath(config, ["useRunningStoreServer"]);
-			if (value !== true) return { state: "ok" };
-			return {
-				remediation: {
-					kind: "manual",
-					steps: ["Verify the store server is running in a trusted environment and that its communication channel is not exposed to untrusted networks."]
-				},
-				actual: value,
-				message: "Review `useRunningStoreServer` in pnpm-workspace.yaml. Delegating store operations to an external process introduces a trust boundary — the server process can serve tampered packages.",
-				state: "violation"
-			};
-		},
-		docs: "https://pnpm.io/settings/store#userunningstoreserver",
-		file: pnpmWorkspace$1
-	} },
-	description: "Flag use of an external store server process, which introduces a trust boundary where tampered packages could be served.",
-	docs: "https://pnpm.io/settings/store#userunningstoreserver",
-	id: "store-server",
-	severity: "info",
-	title: "Review store server usage"
-});
-//#endregion
-//#region src/core/rules/strict-allow-scripts.ts
-const { npmrc } = CONFIG_FILES;
-const strictAllowScripts = defineRule({
-	bindings: { npm: {
-		check(_ctx, config) {
-			if (getByPath(config, ["ignore-scripts"]) === true) return { state: "ok" };
-			const bypass = getByPath(config, ["dangerously-allow-all-scripts"]);
-			if (bypass === true) return {
-				actual: bypass,
-				expected: false,
-				remediation: {
-					kind: "manual",
-					steps: ["Remove `dangerously-allow-all-scripts=true` from .npmrc (or set it to false), then set `strict-allow-scripts=true`. The bypass overrides strict script approval."]
-				},
-				message: "`dangerously-allow-all-scripts=true` bypasses script approval even when `strict-allow-scripts=true`.",
-				state: "violation"
-			};
-			const strict = getByPath(config, ["strict-allow-scripts"]);
-			if (strict === true) return { state: "ok" };
-			return {
-				remediation: proposeChanges(config, [{
-					file: npmrc,
-					keyPath: ["strict-allow-scripts"],
-					op: "setKey",
-					value: true
-				}]),
-				actual: strict,
-				expected: true,
-				message: "Set `strict-allow-scripts=true` in .npmrc to fail installation for unreviewed install scripts.",
-				state: "violation"
-			};
-		},
-		docs: "https://docs.npmjs.com/cli/v12/using-npm/config#strict-allow-scripts",
-		file: npmrc
-	} },
-	description: "Turn install-script policy warnings into hard errors so unapproved lifecycle scripts block installation.",
-	docs: "https://docs.npmjs.com/cli/v12/using-npm/config#strict-allow-scripts",
-	id: "strict-allow-scripts",
-	severity: "warn",
-	title: "Require explicit script allow-listing"
-});
-//#endregion
-//#region src/core/rules/strict-release-age.ts
-const { aubeWorkspace: aubeWorkspace$2 } = CONFIG_FILES;
-const strictReleaseAge = withAubeParanoid(requireConfigKey({
-	bindings: { aube: {
-		docs: "https://aube.jdx.dev/settings/",
-		file: aubeWorkspace$2,
-		keyPath: ["minimumReleaseAgeStrict"],
-		message: "Set `minimumReleaseAgeStrict: true` in aube-workspace.yaml to make the release age gate a hard block.",
-		value: true
-	} },
-	description: "Fail when no satisfying version meets the release age, instead of falling back to the lowest satisfying version.",
-	docs: "https://aube.jdx.dev/security.html",
-	id: "strict-release-age",
-	severity: "info",
-	title: "Enforce strict release age gate"
-}));
-//#endregion
-//#region src/core/rules/strict-store-integrity.ts
-const { aubeWorkspace: aubeWorkspace$1 } = CONFIG_FILES;
-const strictStoreIntegrity = defineRule({
-	bindings: { aube: {
-		check(_ctx, config) {
-			if (getByPath(config, ["verifyStoreIntegrity"]) === false) return {
-				actual: false,
-				expected: true,
-				remediation: {
-					kind: "manual",
-					steps: ["Set `verifyStoreIntegrity: true` (or remove `verifyStoreIntegrity: false`) in aube-workspace.yaml, and enable `strictStoreIntegrity: true` or `paranoid: true`."]
-				},
-				message: "`verifyStoreIntegrity: false` bypasses strict integrity checks, including when `paranoid: true`.",
-				state: "violation"
-			};
-			const strict = getByPath(config, ["strictStoreIntegrity"]);
-			if (strict === true || getByPath(config, ["paranoid"]) === true) return { state: "ok" };
-			return {
-				remediation: proposeChanges(config, [{
-					file: aubeWorkspace$1,
-					keyPath: ["strictStoreIntegrity"],
-					op: "setKey",
-					value: true
-				}]),
-				actual: strict,
-				expected: true,
-				message: "Set `strictStoreIntegrity: true` in aube-workspace.yaml to refuse tarballs that lack integrity metadata.",
-				state: "violation"
-			};
-		},
-		docs: "https://aube.jdx.dev/settings/",
-		file: aubeWorkspace$1
-	} },
-	description: "Refuse to import tarballs from the registry when the packument lacks a dist.integrity field, preventing silent integrity bypass.",
-	docs: "https://aube.jdx.dev/security.html",
-	id: "strict-store-integrity",
-	severity: "warn",
-	title: "Require tarball integrity metadata"
-});
-//#endregion
-//#region src/core/rules/trust-policy.ts
-const { aubeWorkspace, pnpmWorkspace } = CONFIG_FILES;
-const trustPolicy = withAubeParanoid(requireConfigKey({
-	bindings: {
-		aube: {
-			docs: "https://aube.jdx.dev/security.html",
-			documentedDefault: "no-downgrade",
-			defaultSafety: "unconditional",
-			file: aubeWorkspace,
-			keyPath: ["trustPolicy"],
-			message: "Set `trustPolicy: no-downgrade` in aube-workspace.yaml to block packages whose trust level has decreased.",
-			value: "no-downgrade"
-		},
-		pnpm: {
-			docs: "https://pnpm.io/settings/dependency-resolution#trustpolicy",
-			file: pnpmWorkspace,
-			keyPath: ["trustPolicy"],
-			message: "Set `trustPolicy: no-downgrade` in pnpm-workspace.yaml to block packages whose trust level has decreased.",
-			value: "no-downgrade",
-			versionNote: { configAvailableSince: "pnpm 10.21.0" }
-		}
-	},
-	description: "Fail installation when a package trust level has decreased compared to previous releases, catching publisher credential downgrades.",
-	docs: "https://pnpm.io/settings/dependency-resolution#trustpolicy",
-	id: "trust-policy",
-	severity: "warn",
-	title: "Enforce trust policy on dependency updates"
-}));
-//#endregion
-//#region src/core/rules/unsupported-settings.ts
-const bindingFor = (pm, includesFile) => {
-	const settings = settingAvailability.filter((setting) => setting.pm === pm && includesFile(setting.file.path));
-	return { check(ctx) {
-		const version = ctx.pmVersion;
-		if (version === void 0) return { state: "na" };
-		const unsupported = settings.filter((setting) => lt(version, setting.since) && getByPath(ctx.readConfig(setting.file), setting.keyPath) !== void 0);
-		const [first, ...rest] = [...new Set(unsupported.map((setting) => setting.file.path))].map((file) => {
-			const fileSettings = unsupported.filter((setting) => setting.file.path === file);
-			return {
-				state: "violation",
-				file,
-				message: `Target ${pm} ${version} predates support for ${file}: ${fileSettings.map((setting) => `${setting.keyPath.join(".")} (requires ${pm} >=${setting.since})`).join("; ")}.`,
-				remediation: {
-					kind: "manual",
-					steps: ["Verify the PM version used by your install or publish command. If the declared target is accurate, upgrade the PM or use a security control supported by that target; removing a setting alone does not provide its protection.", ...fileSettings.map((setting) => `${setting.file.path}#${setting.keyPath.join(".")}: ${setting.source}`)]
-				}
-			};
-		});
-		return first ? {
-			state: "violations",
-			violations: [first, ...rest]
-		} : { state: "ok" };
-	} };
-};
-const createUnsupportedSettings = (includesFile) => defineRule({
-	id: "unsupported-settings",
-	title: "Use settings available in the target PM version",
-	description: "Report configured settings whose recorded introduction version is newer than the declared or explicit stable PM target. Reports each affected file separately, grouping its unsupported keys. Findings retain their evaluation directory. Only the coverage table below is checked. Unknown targets and unlisted settings are not evaluated for availability.",
-	severity: "error",
-	docs: "https://github.com/pHo9UBenaA/siro/blob/main/docs/rules.md#unsupported-settings--error",
-	bindings: {
-		npm: bindingFor("npm", includesFile),
-		pnpm: bindingFor("pnpm", includesFile),
-		yarn: bindingFor("yarn", includesFile),
-		bun: bindingFor("bun", includesFile),
-		deno: bindingFor("deno", includesFile)
-	}
-});
-const unsupportedSettings = createUnsupportedSettings(() => true);
-//#endregion
-//#region src/core/rules/builtin-rules.ts
-const createBuiltinRules = (time) => [
-	advisoryCheck,
-	approvedGitRepos,
-	auditSuppression,
-	blockAutoInstall,
-	blockExoticSubdeps,
-	bunSecurityScanner,
-	checksumVerification,
-	commitLockfile,
-	dependencyOverrides,
-	disableLifecycleScripts,
-	enforceStrictSsl,
-	filesField,
-	frozenLockfile,
-	frozenStore,
-	hardenedMode,
-	createMinimumReleaseAge(time),
-	namedRegistries,
-	paranoidMode,
-	patchedDependencies,
-	pinExactVersions,
-	provenance,
-	publishAccess,
-	storeServer,
-	strictAllowScripts,
-	strictReleaseAge,
-	strictStoreIntegrity,
-	trustPolicy,
-	unsupportedSettings
-];
-const builtinScope = {
-	"advisory-check": "installation",
-	"approved-git-repos": "installation",
-	"audit-suppression": "installation",
-	"block-auto-install": "installation",
-	"block-exotic-subdeps": "installation",
-	"bun-security-scanner": "installation",
-	"checksum-verification": "installation",
-	"commit-lockfile": "installation",
-	"dependency-overrides": "installation",
-	"disable-lifecycle-scripts": "installation",
-	"enforce-strict-ssl": "installation",
-	"files-field": "manifest",
-	"frozen-lockfile": "installation",
-	"frozen-store": "installation",
-	"hardened-mode": "installation",
-	"minimum-release-age": "installation",
-	"named-registries": "installation",
-	"paranoid-mode": "installation",
-	"patched-dependencies": "installation",
-	"pin-exact-versions": "installation",
-	provenance: "installation",
-	"publish-access": "manifest",
-	"store-server": "installation",
-	"strict-allow-scripts": "installation",
-	"strict-release-age": "installation",
-	"strict-store-integrity": "installation",
-	"trust-policy": "installation",
-	"unsupported-settings": "split"
-};
-const scopeOf = (id) => Object.hasOwn(builtinScope, id) ? builtinScope[id] : "custom";
-//#endregion
-//#region src/adapters/exclusions.ts
-const compileExclusions = (patterns) => {
-	try {
-		const matchers = patterns.map((pattern) => new Minimatch(pattern.replace(/(?:\/\*\*)+$/u, "").replace(/[\\[\]]/gu, "\\$&"), {
-			dot: true,
-			nocase: false,
-			nonegate: true,
-			nocomment: true,
-			nobrace: true,
-			noext: true,
-			platform: "linux"
-		}));
-		return (directory) => matchers.some((matcher) => matcher.match(directory));
-	} catch (error) {
-		throw new ConfigError(`exclude: ${error instanceof Error ? error.message : String(error)}`);
-	}
-};
-//#endregion
-//#region src/core/apply-config.ts
-/** Select active rules and keep user severity choices as explicit runtime data. */
-const applyConfig = (base, config) => {
-	const merged = [...base, ...config?.customRules ?? []];
-	const known = /* @__PURE__ */ new Set();
-	const duplicates = /* @__PURE__ */ new Set();
-	for (const rule of merged) {
-		if (known.has(rule.id)) duplicates.add(rule.id);
-		known.add(rule.id);
-	}
-	if (duplicates.size > 0) throw new ConfigError(`Duplicate rule ids: ${[...duplicates].map((id) => `'${id}'`).join(", ")}`);
-	const unknown = Object.keys(config?.rules ?? {}).filter((id) => !known.has(id));
-	if (unknown.length > 0) throw new ConfigError(`Unknown rule ids: ${unknown.map((id) => `'${id}'`).join(", ")}`);
-	const activeRules = [];
-	const severityOverrides = /* @__PURE__ */ new Map();
-	const overrides = config?.rules;
-	for (const rule of merged) {
-		const override = overrides && Object.hasOwn(overrides, rule.id) ? overrides[rule.id] : void 0;
-		if (override === "off") continue;
-		activeRules.push(rule);
-		if (override !== void 0) severityOverrides.set(rule.id, override);
-	}
-	return {
-		rules: activeRules,
-		severityOverrides
-	};
-};
-//#endregion
-//#region src/core/detect-pms.ts
-const registerSignals = (signals, pm, owner) => {
-	for (const file of signals) {
-		const prior = owner.get(file);
-		if (typeof prior !== "undefined") throw new TypeError(`detection signal '${file}' is claimed by both '${prior}' and '${pm}'`);
-		owner.set(file, pm);
-	}
-};
-const buildDetectionSignals = () => {
-	const out = /* @__PURE__ */ new Map();
-	const owner = /* @__PURE__ */ new Map();
-	for (const pm of PMS) {
-		const { lockfiles, configs } = PM_SIGNALS[pm];
-		const signals = [...lockfiles, ...configs];
-		registerSignals(signals, pm, owner);
-		out.set(pm, signals);
-	}
-	return out;
-};
-const DETECTION_SIGNALS = buildDetectionSignals();
-const detectPMs = (ctx) => {
-	const found = /* @__PURE__ */ new Set();
-	const declared = ctx.packageJson?.packageManager;
-	const declaredPM = declared === void 0 ? void 0 : parsePackageManagerField(declared);
-	if (declaredPM !== void 0) found.add(declaredPM);
-	for (const pm of PMS) {
-		const signals = DETECTION_SIGNALS.get(pm);
-		if (signals && signals.some((file) => ctx.exists(asRelPath(file)))) found.add(pm);
-	}
-	return PMS.filter((pm) => found.has(pm));
-};
-//#endregion
-//#region src/core/resolve-pms.ts
-/** Apply the explicit selection or detection, then the configured allow-list. */
-const resolvePMs = (ctx, opts) => {
-	const { pmOverride, allowed } = opts;
-	const detected = pmOverride ? [pmOverride] : detectPMs(ctx);
-	const pms = allowed ? detected.filter((pm) => allowed.includes(pm)) : detected;
-	if (pms.length > 0) return pms;
-	if (opts.optional && detected.length === 0) return [];
-	if (!allowed) throw new UsageError(`No package manager detected. Pass --pm <${PMS.join("|")}> to be explicit.`);
-	if (pmOverride) throw new UsageError(`--pm ${pmOverride} is not in siro.config.ts pms (${allowed.join(", ")}). Adjust the config or the flag.`);
-	if (detected.length > 0) throw new UsageError(`Detected PMs (${detected.join(", ")}) do not match siro.config.ts pms (${allowed.join(", ")}). Adjust the config or remove the restriction.`);
-	throw new UsageError(`No package manager detected, and siro.config.ts restricts pms to ${allowed.join(", ")}. Adjust the config or remove the restriction.`);
-};
-//#endregion
-//#region src/core/decide-severity.ts
-/** Resolve the most specific severity signal for one finding. */
-const decideSeverity = (status, binding, rule, userOverride) => userOverride ?? status.severity ?? binding.severity ?? rule.severity;
-//#endregion
-//#region src/core/render-version-note.ts
-const buildVersionNoteParts = (versionNote) => {
-	const parts = [];
-	if (typeof versionNote.configAvailableSince !== "undefined") parts.push(`available since ${versionNote.configAvailableSince}`);
-	if (typeof versionNote.defaultSafeSince !== "undefined") parts.push(`default safe since ${versionNote.defaultSafeSince}`);
-	if (typeof versionNote.note !== "undefined") parts.push(versionNote.note);
-	return parts;
-};
-const renderVersionNoteMessage = (message, versionNote) => {
-	if (typeof versionNote === "undefined") return message;
-	const parts = buildVersionNoteParts(versionNote);
-	if (parts.length === 0) return message;
-	return `${message} (${parts.join("; ")})`;
-};
-//#endregion
-//#region src/core/evaluate-binding.ts
-/** One response boundary for generic and PM-specific checks. Selection stays with callers. */
-const evaluateBinding = (repository, rule, binding, overrides, target) => {
-	const response = binding.check({
-		...repository.ctx,
-		readConfig: repository.parseConfig,
-		pmVersion: target?.version
-	}, repository.parseConfig(binding.file));
-	assertSynchronous(response, `Rule '${rule.id}' check`);
-	if (!isCheckStatusShape(response)) throw new ConfigError(`Rule '${rule.id}' returned an invalid check result.`);
-	return (response.state === "violations" ? response.violations : [response]).flatMap((status) => status.state !== "violation" ? [] : [{
-		ruleId: rule.id,
-		directory: ".",
-		...target ? { pm: target.pm } : {},
-		severity: decideSeverity(status, binding, rule, overrides?.get(rule.id)),
-		message: renderVersionNoteMessage(status.message, binding.versionNote),
-		file: status.file ?? binding.file?.path,
-		docs: binding.docs ?? rule.docs,
-		actual: status.actual,
-		expected: status.expected,
-		remediation: target ? guardRemediationAvailability(target.pm, target.version, status.remediation) : status.remediation
-	}]);
-};
-//#endregion
-//#region src/core/run-lint.ts
-const resolveBindingProjectType = (ctx, pm, parseConfig) => {
-	if (ctx.projectType !== void 0) return ctx.projectType;
-	return pm === "deno" ? resolveDenoProjectType(ctx, parseConfig(CONFIG_FILES.denoJson)) : resolvePackageJsonProjectType(ctx);
-};
-/** Select applicable PM bindings; response handling is shared with manifest checks. */
-const runLint = (opts) => {
-	const { repository, pms, ruleSet, severityOverrides } = opts;
-	const findings = [];
-	for (const rule of ruleSet) for (const pm of pms) {
-		const binding = rule.bindings[pm];
-		if (!binding || rule.projectTypes && !rule.projectTypes.includes(resolveBindingProjectType(repository.ctx, pm, repository.parseConfig))) continue;
-		findings.push(...evaluateBinding(repository, rule, binding, severityOverrides, {
-			pm,
-			version: opts.pmVersions?.[pm]
-		}));
-	}
-	const summary = {
-		error: 0,
-		info: 0,
-		warn: 0
-	};
-	for (const finding of findings) summary[finding.severity] += 1;
-	return {
-		findings,
-		summary
-	};
-};
-//#endregion
-//#region src/core/contracts/deno-json.ts
-/** Validate consumed publication metadata, not Deno's entire versioned schema. */
-const validateDenoMetadata = (config) => {
-	const name = getByPath(config, ["name"]);
-	if (name != null && typeof name !== "string") throw new ConfigError("deno.json: name must be a string or null.");
-	const publish = getByPath(config, ["publish"]);
-	if (publish == null || typeof publish === "boolean") return;
-	if (!isPlainRecord(publish)) throw new ConfigError("deno.json: publish must be a boolean, object or null.");
-	const include = getByPath(publish, ["include"]);
-	if (include != null && (!Array.isArray(include) || !Array.from(include).every((item) => typeof item === "string"))) throw new ConfigError("deno.json: publish.include must be a string array or null.");
-};
-//#endregion
-//#region src/core/parse-config-file.ts
-const EMPTY_FILE = Object.freeze({});
-/** Create a lazy parser for one repository context; callers own its lifetime. */
-const createConfigParser = (codecFor, ctx) => {
-	const cache = /* @__PURE__ */ new Map();
-	return (file) => {
-		if (file === void 0) return EMPTY_FILE;
-		const cacheKey = `${file.kind}:${file.path}`;
-		const cached = cache.get(cacheKey);
-		if (cached !== void 0) return cached;
-		const text = ctx.readText(file.path);
-		if (text === void 0) {
-			cache.set(cacheKey, EMPTY_FILE);
-			return EMPTY_FILE;
-		}
-		const parsed = wrapCodecError(file.path, () => codecFor(file.kind).parse(text));
-		cache.set(cacheKey, parsed);
-		return parsed;
-	};
-};
-/** Pair the context with a fresh lazy parser; construction performs no reads. */
-const createRepositoryEvaluation = (ctx, codecFor) => ({
-	ctx,
-	parseConfig: createConfigParser(codecFor, ctx)
-});
-//#endregion
-//#region src/core/discovery.ts
-/** One context per selected directory, shared by publication and installation passes. */
-const discover = (cwd, fs, excluded, projectType, dependencies) => {
-	if (typeof fs.readDirectories !== "function") throw new ConfigError("FileSystem.readDirectories is required for package discovery; no native filesystem fallback is used.");
-	const { paths, createRepoContext, codecFor } = dependencies;
-	const pending = [asRelPath(".")];
-	const directories = [];
-	while (pending.length) {
-		const directory = pending.pop();
-		const absolute = paths.resolve(cwd, directory);
-		let repository;
-		const manifests = [];
-		try {
-			repository = createRepositoryEvaluation(createRepoContext(absolute, fs, projectType), codecFor);
-			const { ctx, parseConfig } = repository;
-			if (ctx.packageJson !== void 0) manifests.push("package.json");
-			if (ctx.readText(CONFIG_FILES.denoJson.path) !== void 0) {
-				validateDenoMetadata(parseConfig(CONFIG_FILES.denoJson));
-				manifests.push("deno.json");
-			} else if (ctx.exists(asRelPath("deno.jsonc"))) throw new ConfigError("deno.jsonc is not supported; use strict deno.json.");
-		} catch (error) {
-			if (error instanceof ConfigError && directory !== ".") throw new ConfigError(`${directory}/${error.message}`);
-			throw error;
-		}
-		directories.push({
-			directory,
-			repository,
-			manifests
-		});
-		const names = fs.readDirectories(absolute);
-		if (!Array.isArray(names)) throw new ConfigError(`${directory}: FileSystem.readDirectories must return a dense array.`);
-		const children = /* @__PURE__ */ new Set();
-		for (let i = 0; i < names.length; i += 1) {
-			if (!Object.hasOwn(names, i)) throw new ConfigError(`${directory}: FileSystem.readDirectories must return a dense array.`);
-			const child = paths.child(directory, names[i]);
-			if (names[i] === ".git" || names[i] === "node_modules" || excluded(child) || children.has(child)) continue;
-			children.add(child);
-			pending.push(child);
-		}
-	}
-	return directories.sort((a, b) => a.directory < b.directory ? -1 : a.directory > b.directory ? 1 : 0);
-};
-//#endregion
-//#region src/core/manifest-checks.ts
-const manifestProjectType = (repository, file) => file === "deno.json" ? resolveDenoProjectType(repository.ctx, repository.parseConfig(CONFIG_FILES.denoJson)) : resolvePackageJsonProjectType(repository.ctx);
-const selectBinding = {
-	"files-field": (file) => file === "deno.json" ? denoPublishBinding : packageJsonFilesBinding,
-	"publish-access": (file, repository, targets) => {
-		if (file !== "package.json") return void 0;
-		return repository.ctx.packageJson?.publishConfig?.access === "private" && targets.length > 0 ? "pm" : publishAccessBinding;
-	}
-};
-const checkManifest = (repository, file, targets, rules, overrides) => {
-	const findings = [];
-	const projectType = manifestProjectType(repository, file);
-	const pms = targets.map((target) => target.pm);
-	const pmVersions = Object.fromEntries(targets.map((target) => [target.pm, target.version]));
-	for (const rule of rules) {
-		if (rule.projectTypes && !rule.projectTypes.includes(projectType)) continue;
-		if (rule.id === "unsupported-settings") findings.push(...runLint({
-			repository,
-			pms,
-			pmVersions,
-			ruleSet: [{
-				...rule,
-				bindings: createUnsupportedSettings((path) => path === file).bindings
-			}],
-			severityOverrides: overrides
-		}).findings);
-		else if (Object.hasOwn(selectBinding, rule.id)) {
-			const binding = selectBinding[rule.id](file, repository, targets);
-			if (binding === "pm") findings.push(...runLint({
-				repository,
-				pms,
-				pmVersions,
-				ruleSet: [rule],
-				severityOverrides: overrides
-			}).findings);
-			else if (binding) findings.push(...evaluateBinding(repository, rule, binding, overrides));
-		}
-	}
-	return findings;
-};
-//#endregion
-//#region src/core/rebase-finding.ts
-/** Context-local rule output becomes cwd-relative once, without mutating rule-owned data. */
-const rebaseFinding = (directory, finding) => {
-	if (directory === ".") return {
-		...finding,
-		directory
-	};
-	const remediation = finding.remediation;
-	const rebaseOperation = (operation) => ({
-		...operation,
-		file: {
-			...operation.file,
-			path: `${directory}/${operation.file.path}`
-		}
-	});
-	return {
-		...finding,
-		directory,
-		...finding.file === void 0 ? {} : { file: `${directory}/${finding.file}` },
-		remediation: remediation?.kind === "automatic" ? {
-			...remediation,
-			operations: [rebaseOperation(remediation.operations[0]), ...remediation.operations.slice(1).map(rebaseOperation)]
-		} : remediation?.kind === "manual" ? {
-			...remediation,
-			steps: [`Work in ${directory} for this finding.`, ...remediation.steps]
-		} : remediation
-	};
-};
-//#endregion
-//#region src/core/lint.ts
-const validateLintOptions = (options, paths) => {
-	if (!options || !paths.isAbsolute(options.cwd)) throw new UsageError("cwd must be an absolute filesystem path.");
-	if ("workspaces" in options) throw new UsageError("workspaces was removed in 0.6.0. Package discovery is recursive by default; use exclude and installationRoots to specify scope.");
-	if ("customRules" in options || "reporters" in options) throw new UsageError("Pass customRules and reporters inside the config option.");
-	if (options.pm !== void 0 && !isPM(options.pm)) throw new UsageError(`Unknown package manager: ${String(options.pm)}`);
-	if (options.projectType !== void 0 && !isProjectType(options.projectType)) throw new UsageError(`Unknown project type: ${String(options.projectType)}`);
-	if (options.pmVersion !== void 0 && (!options.pm || !isStableVersion(options.pmVersion))) throw new UsageError("pmVersion / --pm-version requires pm / --pm and an exact stable version such as 10.16.0.");
-};
-/** Validate inputs and prepare shared contexts, without running rules or child executable configs. */
-const prepareLint = (options, dependencies) => {
-	validateLintOptions(options, dependencies.paths);
-	const config = options.config === void 0 ? void 0 : parseConfig(options.config);
-	const fs = options.fs === void 0 ? dependencies.fileSystem : options.fs;
-	const excluded = dependencies.compileExclusions(parseExcludes(options.exclude !== void 0 ? options.exclude : config?.exclude ?? []));
-	const installations = parseInstallationRoots(options.installationRoots !== void 0 ? options.installationRoots : config?.installationRoots ?? ["."]);
-	const configured = applyConfig(dependencies.rules, config);
-	const needsCustomTarget = configured.rules.some((rule) => scopeOf(rule.id) === "custom");
-	const discovered = discover(options.cwd, fs, excluded, options.projectType ?? config?.projectType, dependencies);
-	for (const entry of installations) if (!discovered.some((item) => item.directory === entry.path)) throw new UsageError(`${entry.path}: installation root must be an existing, selected ordinary directory using its exact enumerated spelling (no symlinks, excluded or hard-skipped paths).`);
-	return {
-		evaluation: {
-			directories: discovered.map((item) => {
-				const { ctx } = item.repository;
-				const entry = installations.find((root) => root.path === item.directory);
-				let pms;
-				let versions = declaredPMVersion(ctx.packageJson?.packageManager);
-				if (item.directory === ".") {
-					pms = resolvePMs(ctx, {
-						allowed: config?.pms,
-						pmOverride: options.pm,
-						optional: !entry && !needsCustomTarget
-					});
-					versions = {
-						...versions,
-						...config?.pmVersions,
-						...options.pm && options.pmVersion ? { [options.pm]: options.pmVersion } : {}
-					};
-				} else if (entry) {
-					try {
-						pms = resolvePMs(ctx, { pmOverride: entry.pm });
-					} catch (error) {
-						if (error instanceof UsageError) throw new UsageError(`${item.directory}: ${error.message}`);
-						throw error;
-					}
-					if (entry.pm && entry.pmVersion) versions = {
-						...versions,
-						[entry.pm]: entry.pmVersion
-					};
-				} else {
-					const declared = ctx.packageJson?.packageManager === void 0 ? void 0 : parsePackageManagerField(ctx.packageJson.packageManager);
-					pms = PMS.filter((pm) => pm === declared || pm === "deno" && item.manifests.includes("deno.json"));
-				}
-				return {
-					...item,
-					installation: entry !== void 0,
-					targets: pms.map((pm) => ({
-						pm,
-						...versions[pm] === void 0 ? {} : { version: versions[pm] }
-					}))
-				};
-			}),
-			ruleSet: configured.rules,
-			severityOverrides: configured.severityOverrides
-		},
-		reporters: config?.reporters ?? []
-	};
-};
-const runPreparedLint = (evaluation) => {
-	const { directories, ruleSet, severityOverrides } = evaluation;
-	const findings = [];
-	const manifests = [];
-	const installationRoots = [];
-	const ruleOrder = new Map(ruleSet.map((rule, index) => [rule.id, index]));
-	for (const item of directories) {
-		const { directory, repository, targets, installation } = item;
-		const local = [];
-		for (const file of item.manifests) {
-			const manifestTargets = targets.filter(({ pm }) => file === "deno.json" ? pm === "deno" : pm !== "deno");
-			manifests.push({
-				path: directory === "." ? file : `${directory}/${file}`,
-				projectType: manifestProjectType(repository, file),
-				targets: manifestTargets
-			});
-			local.push(...checkManifest(repository, file, manifestTargets, ruleSet, severityOverrides));
-		}
-		if (installation) installationRoots.push({
-			directory,
-			targets
-		});
-		const scopedRules = ruleSet.flatMap((rule) => {
-			const scope = scopeOf(rule.id);
-			if (scope === "installation" && installation || scope === "custom" && directory === ".") return [rule];
-			if (scope === "split" && installation) return [{
-				...rule,
-				bindings: createUnsupportedSettings((file) => file !== "package.json" && file !== "deno.json").bindings
-			}];
-			return [];
-		});
-		try {
-			local.push(...runLint({
-				repository,
-				pms: targets.map(({ pm }) => pm),
-				pmVersions: Object.fromEntries(targets.map(({ pm, version }) => [pm, version])),
-				ruleSet: scopedRules,
-				severityOverrides
-			}).findings);
-		} catch (error) {
-			if (error instanceof ConfigError && directory !== ".") throw new ConfigError(`${directory}/${error.message}`);
-			throw error;
-		}
-		local.sort((a, b) => (ruleOrder.get(a.ruleId) ?? 0) - (ruleOrder.get(b.ruleId) ?? 0));
-		findings.push(...local.map((finding) => rebaseFinding(directory, finding)));
-	}
-	const summary = {
-		error: 0,
-		warn: 0,
-		info: 0
-	};
-	for (const finding of findings) summary[finding.severity] += 1;
-	return {
-		findings,
-		summary,
-		inspection: {
-			manifests,
-			installationRoots
-		}
-	};
-};
-const lint$1 = (options, dependencies) => runPreparedLint(prepareLint(options, dependencies).evaluation);
-//#endregion
-//#region src/core/filter.ts
-const EXIT_SUCCESS = 0;
-const EXIT_FAILURE = 1;
-const meetsThreshold = (severity, threshold) => SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
-/** Keep only findings at or above `threshold`, recomputing the summary. */
-const filterBySeverity = (result, threshold) => {
-	const findings = [];
-	const summary = {
-		error: 0,
-		info: 0,
-		warn: 0
-	};
-	for (const finding of result.findings) if (meetsThreshold(finding.severity, threshold)) {
-		findings.push(finding);
-		summary[finding.severity] += 1;
-	}
-	return {
-		...result,
-		findings,
-		summary
-	};
-};
-/**
-* Exit code for a lint run. Non-zero when any finding meets `threshold`
-* (default: only `error` fails the run).
-*/
-const exitCodeForLint = (result, threshold = "error") => {
-	if (result.findings.some((finding) => meetsThreshold(finding.severity, threshold))) return EXIT_FAILURE;
-	return EXIT_SUCCESS;
-};
-//#endregion
-//#region src/core/lint-command.ts
-/** Evaluate and report. Executable config loading belongs to the CLI adapter. */
-const lintCommand$1 = async (options, io, dependencies, reporters) => {
-	if (!options) throw new UsageError("Lint options are required.");
-	if (options.severity !== void 0 && !isSeverity(options.severity)) throw new UsageError(`Invalid severity: ${String(options.severity)}`);
-	const prepared = prepareLint(options, dependencies);
-	const registry = reporters.createRegistry(prepared.reporters);
-	const selection = options.reporter ?? reporters.defaultName;
-	const reporter = typeof selection === "string" ? registry.get(selection) : selection;
-	if (!isReporterShape(reporter)) throw new UsageError(`${typeof selection === "string" ? "Unknown" : "Invalid"} reporter: ${String(selection)} (available: ${[...registry.keys()].join(", ")})`);
-	const result = runPreparedLint(prepared.evaluation);
-	const exitCode = exitCodeForLint(result, options.severity ?? "error");
-	const writes = [];
-	let outputFailed = false;
-	let outputFailure;
-	const recordFailure = (error) => {
-		if (!outputFailed) {
-			outputFailed = true;
-			outputFailure = error;
-		}
-	};
-	const track = (write) => (line) => {
-		try {
-			const written = write(line);
-			writes.push(Promise.resolve(written).then(() => {}, recordFailure));
-			return written;
-		} catch (error) {
-			recordFailure(error);
-			throw error;
-		}
-	};
-	try {
-		await reporter.format(filterBySeverity(result, options.severity ?? "info"), {
-			stdout: track((line) => io.stdout(line)),
-			stderr: track((line) => io.stderr(line))
-		}, { cwd: options.cwd });
-	} finally {
-		await Promise.all(writes);
-	}
-	if (outputFailed) throw outputFailure;
-	return exitCode;
-};
-//#endregion
-//#region src/core/contracts/package-json.ts
-const PackageJsonSchema = vb.looseObject({
-	files: vb.optional(vb.array(vb.string())),
-	name: vb.optional(vb.string()),
-	packageManager: vb.optional(vb.string()),
-	private: vb.optional(vb.boolean()),
-	publishConfig: vb.optional(vb.looseObject({
-		access: vb.optional(vb.picklist([
-			"public",
-			"restricted",
-			"private"
-		])),
-		provenance: vb.optional(vb.boolean())
-	})),
-	trustedDependencies: vb.optional(vb.array(vb.string()))
-});
-const parsePackageJson = (value) => {
-	if (!isPlainRecord(value)) throw new ConfigError("package.json: expected an object at the root.");
-	const result = vb.safeParse(PackageJsonSchema, value);
-	if (result.success) return result.output;
-	const issue = result.issues[0];
-	const field = vb.getDotPath(issue);
-	throw new ConfigError(`package.json: ${field ? `${field}: ` : ""}${issue.message}`);
-};
-//#endregion
-//#region src/adapters/repo-context.ts
-const tryParseJson = (text) => {
-	try {
-		return JSON.parse(text);
-	} catch (error) {
-		let errMsg = String(error);
-		if (error instanceof Error) errMsg = error.message;
-		throw new ConfigError(`package.json: invalid JSON — ${errMsg}`);
-	}
-};
-const readPackageJson = (raw) => {
-	return parsePackageJson(tryParseJson(raw.trim()));
-};
-const createRepoContext = (root, fs = nodeFileSystem, projectType) => {
-	if (fs === nodeFileSystem) assertDirectory(root);
-	const packageFile = resolveIn(root, asRelPath("package.json"));
-	const raw = fs.readText(packageFile);
-	const texts = new Map([[packageFile, raw]]);
-	const readText = (relPath) => {
-		const file = resolveIn(root, relPath);
-		if (!texts.has(file)) texts.set(file, fs.readText(file));
-		return texts.get(file);
-	};
-	const exists = (relPath) => fs.exists(resolveIn(root, relPath));
-	let packageJson = void 0;
-	if (typeof raw !== "undefined") packageJson = readPackageJson(raw);
-	return {
-		exists,
-		packageJson,
-		projectType,
-		readText,
-		root
-	};
-};
-//#endregion
-//#region src/adapters/codecs/ini.ts
-const INTEGER_PATTERN = /^-?\d+$/u;
-const coerceBoolean = (str) => {
-	if (str === "true") return true;
-	if (str === "false") return false;
-};
-const coerceInteger = (str) => {
-	if (INTEGER_PATTERN.test(str)) return Number(str);
-};
-const coerce = (raw) => {
-	if (typeof raw !== "string") return raw;
-	return coerceBoolean(raw) ?? coerceInteger(raw) ?? raw;
-};
-//#endregion
-//#region src/adapters/codecs/store.ts
-const CODECS = {
-	json: { parse(text) {
-		const trimmed = text.trim();
-		return toParsedConfig(JSON.parse(trimmed));
-	} },
-	npmrc: { parse(text) {
-		const raw = toParsedConfig(ini.parse(text));
-		const config = {};
-		for (const [key, value] of Object.entries(raw)) if (Array.isArray(value)) config[key] = value.map((elem) => coerce(elem));
-		else if (typeof value === "object" && value !== null) config[key] = toParsedConfig(value);
-		else config[key] = coerce(value);
-		return config;
-	} },
-	toml: { parse(text) {
-		if (text.trim() === "") return {};
-		return toParsedConfig(parse$1(text.startsWith("") ? text.slice(1) : text));
-	} },
-	yaml: { parse(text) {
-		if (text.trim() === "") return {};
-		const document = parseDocument(text);
-		if (document.errors.length > 0) throw document.errors[0];
-		if (document.contents === null) return {};
-		return toParsedConfig(document.toJS({ onAnchor: (value, count) => {
-			if (count > 1) JSON.stringify(value);
-		} }));
-	} }
-};
-/** Look up the codec for a parseable kind. Total — every CodecKind has one. */
-const codecFor = (kind) => CODECS[kind];
-//#endregion
-//#region src/adapters/reporters/github.ts
-const COMMAND = {
-	error: "error",
-	info: "notice",
-	warn: "warning"
-};
-const escapeData = (raw) => raw.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
-const escapeProp = (raw) => escapeData(raw).replaceAll(":", "%3A").replaceAll(",", "%2C");
-/** Emit GitHub Actions workflow commands (annotations on PRs). */
-const githubReporter = {
-	async format(result, io, context) {
-		for (const finding of result.findings) {
-			let file = "";
-			if (finding.file) file = `file=${escapeProp(path.resolve(context.cwd, finding.file))},`;
-			let body = `[${finding.pm ?? "package"}] ${finding.directory}: ${finding.message}`;
-			if (finding.docs) body += ` (${finding.docs})`;
-			await io.stdout(`::${COMMAND[finding.severity]} ${file}title=${escapeProp(finding.ruleId)}::${escapeData(body)}`);
-		}
-	},
-	name: "github"
-};
-//#endregion
-//#region src/adapters/safe-text.ts
-/** Visible escaping for untrusted human-facing text; never rewrite API/native paths. */
-const safeText = (text) => text.replace(/[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/gu, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`).replaceAll("##[", "#\\u0023[").replace(/^(\s*)::/u, "$1\\u003a:");
-/** JSON syntax and decoded values stay identical; CI must not parse legacy commands in it. */
-const safeJsonText = (json) => json.replace(/[\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/gu, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`).replaceAll("##[", "\\u0023\\u0023[");
-//#endregion
-//#region src/adapters/reporters/json.ts
-/**
-* Versioned machine-readable output — the public contract consumed by
-* external fixers (see docs/json-output.md). Bump `schemaVersion` on any
-* breaking shape change and update that doc in the same commit.
-*/
-const SCHEMA_VERSION = 3;
-const jsonReporter = {
-	async format(result, io) {
-		await io.stdout(safeJsonText(JSON.stringify({
-			schemaVersion: SCHEMA_VERSION,
-			siroVersion: version,
-			findings: result.findings,
-			summary: result.summary,
-			inspection: result.inspection
-		}, void 0, 2)));
-	},
-	name: "json"
-};
-//#endregion
-//#region src/adapters/reporters/pretty.ts
-const GLYPH = {
-	error: "✖ error",
-	info: "ℹ info",
-	warn: "⚠ warn"
-};
-/**
-* Decide colour at call time, not at import time.
-*
-* picocolors snapshots `isColorSupported` when imported, so a later
-* `process.env.NO_COLOR = '1'` (or a different stdout) is ignored. The
-* reporter is invoked per `siro lint` run from many contexts (TTY, CI
-* with FORCE_COLOR, redirected output, …) — checking each call is the
-* only way NO_COLOR can truly win, as https://no-color.org/ requires.
-*/
-const colorSupportedNow = () => {
-	const { env } = process;
-	if (typeof env.NO_COLOR !== "undefined" && env.NO_COLOR !== "") return false;
-	if ("FORCE_COLOR" in env) return env.FORCE_COLOR !== "0" && env.FORCE_COLOR !== "";
-	return pc.isColorSupported;
-};
-const renderFinding = (finding, ctx) => {
-	const where = ctx.colors.dim(` (${safeText(finding.file ?? finding.directory)})`);
-	ctx.io.stdout(`${ctx.tag[finding.severity](GLYPH[finding.severity])}  [${finding.pm ?? "package"}] ${ctx.colors.bold(safeText(finding.ruleId))}${where}`);
-	ctx.io.stdout(`    ${safeText(finding.message)}`);
-	for (const step of finding.remediation?.kind === "manual" ? finding.remediation.steps : []) ctx.io.stdout(`    ↳ ${safeText(step)}`);
-	if (finding.docs) ctx.io.stdout(ctx.colors.dim(`    → ${safeText(finding.docs)}`));
-};
-const buildRenderCtx = (io) => {
-	const colors = pc.createColors(colorSupportedNow());
-	return {
-		colors,
-		io,
-		tag: {
-			error: colors.red,
-			info: colors.cyan,
-			warn: colors.yellow
-		}
-	};
-};
-const prettyReporter = {
-	async format(result, io) {
-		const lines = [];
-		const collect = (line) => {
-			lines.push(line);
-		};
-		const ctx = buildRenderCtx({
-			stdout: collect,
-			stderr: collect
-		});
-		collect(`Inspection: ${result.inspection.manifests.length} manifests; installation roots: ${result.inspection.installationRoots.map((root) => safeText(root.directory)).join(", ") || "none"}.`);
-		collect("Unknown PM/version targets have no availability assessment; installation scope is explicit.");
-		if (result.findings.length === 0) collect(ctx.colors.green("✔ No security best-practice issues found."));
-		else {
-			for (const finding of result.findings) renderFinding(finding, ctx);
-			const { error, warn, info } = result.summary;
-			collect("");
-			collect(`Summary: ${error} error, ${warn} warn, ${info} info`);
-		}
-		await io.stdout(lines.join("\n"));
-	},
-	name: "pretty"
-};
-//#endregion
-//#region src/adapters/reporters/registry.ts
-const BUILTINS = [
-	prettyReporter,
-	jsonReporter,
-	githubReporter
-];
-const DEFAULT_REPORTER_NAME = prettyReporter.name;
-const JSON_REPORTER_NAME = jsonReporter.name;
-/** Names of every built-in reporter, in stable display order. */
-const BUILTIN_REPORTER_NAMES = BUILTINS.map((rep) => rep.name);
-/** Later registrations replace earlier reporters with the same name. */
-const createRegistry = (extras = []) => new Map([...BUILTINS, ...extras].map((reporter) => [reporter.name, reporter]));
-const dependencies = {
-	rules: createBuiltinRules({
-		now: () => Date.now(),
-		parse: (value) => Date.parse(value)
-	}),
-	fileSystem: nodeFileSystem,
-	paths: nodePaths,
-	createRepoContext,
-	codecFor,
-	compileExclusions
-};
-/** Public Node API: callers can replace the filesystem without assembling the application. */
-const lint = (options) => lint$1(options, dependencies);
-const lintCommand = (options, io) => lintCommand$1(options, io, dependencies, {
-	defaultName: DEFAULT_REPORTER_NAME,
-	createRegistry
-});
-//#endregion
-//#region src/adapters/node-io.ts
-const writer = (stream) => {
-	let failure;
-	const pending = /* @__PURE__ */ new Set();
-	const fail = (cause) => {
-		failure ??= new Error(`Output failed: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
-		for (const reject of pending) reject(failure);
-		pending.clear();
-		return failure;
-	};
-	let observing = false;
-	return (line) => {
-		if (!observing) {
-			observing = true;
-			stream.on("error", fail);
-			stream.on("close", () => fail(/* @__PURE__ */ new Error("Output stream closed.")));
-		}
-		return new Promise((resolve, reject) => {
-			if (failure || stream.destroyed) {
-				reject(failure ?? fail(/* @__PURE__ */ new Error("Output stream is destroyed.")));
-				return;
-			}
-			pending.add(reject);
-			try {
-				stream.write(`${line}\n`, (error) => {
-					pending.delete(reject);
-					if (error) reject(fail(error));
-					else resolve();
-				});
-			} catch (error) {
-				fail(error);
-			}
-		});
-	};
-};
-/** Node-only construction; keep streams and their errors outside the core. */
-const createNodeIO = (stdout, stderr) => ({
-	stdout: writer(stdout),
-	stderr: writer(stderr)
-});
-const nodeIO = createNodeIO(process.stdout, process.stderr);
-//#endregion
-export { asRelPath as A, isSupportedNodeVersion as C, nodeFileSystem as D, assertDirectory as E, SiroError as M, UsageError as N, isNodeError as O, isSeverity as S, version as T, PROJECT_TYPES as _, DEFAULT_REPORTER_NAME as a, SEVERITIES as b, jsonReporter as c, overrideBindings as d, requireConfigKey as f, getByPath as g, defineRule as h, BUILTIN_REPORTER_NAMES as i, ConfigError as j, asAbsPath as k, safeText as l, loadConfig as m, lint as n, JSON_REPORTER_NAME as o, CONFIG_FILES as p, lintCommand as r, prettyReporter as s, nodeIO as t, githubReporter as u, isProjectType as v, SUPPORTED_NODE_RANGE as w, isPM as x, PMS as y };
-
-//# sourceMappingURL=node-io-CAszdmko.mjs.map