@alint-js/config 0.0.18 → 0.0.20

package/README.md

@@ -11,34 +11,77 @@ This package owns the file-system side of configuration:
 - parses and stringifies setup TOML
 - merges setup layers
 - writes provider setup files
-- exports built-in ignore pattern groups
+- installs remote plugin packages or local plugin directories and writes `.alint/plugins/lock.json`
+- exports built-in ignore pattern groups for lower-level tooling
 
 It is used by `@alint-js/cli` and is useful for tools that need to inspect or prepare an `alint` project without running the linter.
 
+Ordinary `alint.config.*` files should import ignore presets through the `@alint-js/cli` facade so projects only need the CLI package.
+
 ## How to use
 
 ```ts
 import {
   getGlobalSetupConfigPath,
+  installStaticPlugins,
   loadAlintConfig,
   loadSetupConfig,
   writeSetupConfig,
 } from '@alint-js/config'
 
 const setupPath = getGlobalSetupConfigPath()
-const setup = await loadSetupConfig({ cwd: process.cwd() })
-const config = await loadAlintConfig({ cwd: process.cwd() })
+const cwd = process.cwd()
+const setup = await loadSetupConfig(setupPath)
+
+await installStaticPlugins({ cwd })
+
+const config = await loadAlintConfig(cwd)
 
 await writeSetupConfig(setupPath, setup)
 ```
 
+Static configs can use TOML, YAML, JSON, JSONC, or JSON5. They are data-only alternatives to executable JavaScript and TypeScript flat configs, and identify plugin sources with strings.
+
+For example, TOML supports exact remote packages, config-relative directories, and native absolute paths:
+
+```toml
+[[config.group]]
+
+[config.group.plugins]
+plugin_1 = "@scope/alint-plugin-example1@1.2.3" # package
+plugin_2 = "./plugins/relative-plugin-examplex" # relative directory
+plugin_3 = "/opt/alint/plugins/absolute-plugin" # absolute directory
+```
+
+Relative paths use the config file's directory as their base. Windows native paths should use TOML literal strings so backslashes remain literal:
+
+```toml
+[[config.group]]
+
+[config.group.plugins]
+native = 'C:\alint\plugins\native-plugin'
+```
+
+Use `installStaticPlugins` after adding or changing plugin sources.
+
+- **Package:** downloads the exact package version into `.alint/plugins/store`, verifies its integrity, and locks the installed snapshot.
+- **Local:** installs the directory in place, validates its package root export, and locks its physical directory identity. It does not build the plugin or install its dependencies.
+
+Run installation again after changing a source string, moving a local directory, or changing its symlink target. Changes inside the same local directory are loaded by the next process without reinstalling.
+
+## Plugin lockfile
+
+`.alint/plugins/lock.json` stores package snapshots with integrity metadata and local directory source identities. Local plugin code executes as trusted Node.js; containment checks are not a sandbox.
+
 ## When to use
 
 - You are building CLI commands, editors, or automation around `alint` config.
 - You need to read or write provider setup TOML.
-- You need the same ignore defaults as the official CLI.
+- You need to load `alint.config.*` outside the official CLI.
+- You need to install remote packages or local plugin directories before loading static config.
+- You need the same ignore defaults as the official CLI in lower-level tooling.
 
 ## When not to use
 
-- Use `@alint-js/cli` when you only need the `alint` command.
+- Use `@alint-js/cli` when you only need the `alint` command or an ordinary `alint.config.*` file.
 - Use `@alint-js/core` when you need the rule DSL, source runtime, model resolution, or run engine.

package/dist/index.d.mts

@@ -1,9 +1,56 @@
-import { AlintConfig, AlintConfig as AlintConfig$1, ModelSize, ProviderDefinition, ProviderType, RunnerConfig, RunnerStatsConfig, SetupConfig, SetupConfig as SetupConfig$1, SetupModelDefinition } from "@alint-js/core";
+import { AlintConfig, AlintConfig as AlintConfig$1, AlintConfigItem, ModelSize, PluginDefinition, ProviderDefinition, ProviderType, RunnerConfig, RunnerStatsConfig, SetupConfig, SetupConfig as SetupConfig$1, SetupModelDefinition } from "@alint-js/core";
 
+//#region src/plugins/spec.d.ts
+interface DirectoryPluginSpecifier {
+  directory: string;
+  raw: string;
+  type: 'directory';
+}
+type ParsedPluginSpecifier = DirectoryPluginSpecifier | RegistryPluginSpecifier;
+interface ParsePluginSpecifierOptions {
+  configFile?: string;
+}
+interface RegistryPluginSpecifier {
+  name: string;
+  raw: string;
+  registryPath: string;
+  segments: string[];
+  type: 'registry';
+  version: string;
+}
+declare function parsePluginSpecifier(value: string, options?: ParsePluginSpecifierOptions): ParsedPluginSpecifier;
+//#endregion
+//#region src/config/static.d.ts
+interface ParsedStaticConfig {
+  groups: ParsedStaticConfigGroup[];
+}
+interface ParsedStaticConfigGroup {
+  item: StaticConfigItem;
+  plugins: StaticPluginReference[];
+}
+interface ParseStaticConfigOptions {
+  configFile?: string;
+}
+type StaticConfigInput = readonly StaticConfigInput[] | StaticConfigItem;
+interface StaticConfigItem extends Omit<AlintConfigItem, 'plugins'> {
+  plugins?: Record<string, PluginDefinition | string>;
+}
+interface StaticPluginReference {
+  alias: string;
+  specifier: ParsedPluginSpecifier;
+}
+type StaticPluginResolver = (reference: StaticPluginReference) => Promise<PluginDefinition>;
+interface ToAlintConfigOptions {
+  pluginResolver: StaticPluginResolver;
+}
+declare function parseStaticConfig(value: unknown, options?: ParseStaticConfigOptions): ParsedStaticConfig;
+declare function toAlintConfig(config: ParsedStaticConfig, options: ToAlintConfigOptions): Promise<AlintConfig$1>;
+//#endregion
 //#region src/config/load.d.ts
 declare function loadAlintConfig(cwd: string, configFile?: string): Promise<AlintConfig$1>;
+declare function loadStaticConfig(cwd: string, configFile?: string): Promise<ParsedStaticConfig>;
 //#endregion
-//#region src/ignore-patterns.d.ts
+//#region src/constants/patterns/ignore.d.ts
 declare const ignorePatternsEslintDefaults: readonly ["**/node_modules/**", ".git/**", "**/.git/**"];
 declare const ignorePatternsBuildOutputs: readonly ["**/dist/**", "**/coverage/**", "**/output/**", "**/.output/**", "**/.next/**", "**/.nuxt/**", "**/.svelte-kit/**", "**/.vercel/**"];
 declare const ignorePatternsCaches: readonly ["**/.cache/**", "**/.temp/**", "**/.tmp/**", "**/temp/**", "**/tmp/**", "**/.vitepress/cache/**", "**/.vite-inspect/**"];
@@ -17,9 +64,83 @@ interface GlobalSetupConfigPathOptions {
   xdgConfig?: string;
 }
 declare function getGlobalSetupConfigPath(env?: NodeJS.ProcessEnv, options?: GlobalSetupConfigPathOptions): string;
+declare function getProjectPluginLockPath(cwd: string): string;
+declare function getProjectPluginStorePath(cwd: string): string;
 declare function getProjectSetupConfigPath(cwd: string): string;
 declare function getStatsDir(env?: NodeJS.ProcessEnv, options?: GlobalSetupConfigPathOptions): string;
 //#endregion
+//#region src/plugins/types.d.ts
+interface DirectoryPluginLockEntry {
+  alias: string;
+  path: string;
+  specifier: string;
+  type: 'directory';
+}
+interface ParsedDirectoryPluginLockEntry {
+  alias: string;
+  cwd: string;
+  lockEntry: DirectoryPluginLockEntry;
+  resolutionError?: unknown;
+  specifier: DirectoryPluginSpecifier;
+  type: 'directory';
+}
+type ParsedPluginLockEntry = ParsedDirectoryPluginLockEntry | ParsedRegistryPluginLockEntry;
+interface ParsedPluginLockFile {
+  cwd: string;
+  entries: ParsedPluginLockEntry[];
+  file: PluginLockFile;
+  find: (reference: StaticPluginReference) => ParsedPluginLockEntry | undefined;
+  get: (reference: StaticPluginReference) => ParsedPluginLockEntry;
+}
+interface ParsedRegistryPluginLockEntry {
+  alias: string;
+  cwd: string;
+  lockEntry: RegistryPluginLockEntry;
+  resolutionError?: unknown;
+  specifier: RegistryPluginSpecifier;
+  type: 'registry';
+}
+type PluginLockEntry = DirectoryPluginLockEntry | RegistryPluginLockEntry;
+interface PluginLockFile {
+  plugins: Record<string, PluginLockEntry>;
+  version: 2;
+}
+interface RegistryPluginLockEntry {
+  alias: string;
+  entry: string;
+  integrity: string;
+  name: string;
+  registry: string;
+  specifier: string;
+  tarball: string;
+  type: 'registry';
+  version: string;
+}
+interface StaticPluginInstallOptions {
+  configFile?: string;
+  cwd: string;
+  registry?: string;
+}
+interface StaticPluginInstallResult {
+  configuredPluginCount: number;
+  installedLocalDirectoryCount: number;
+  installedPackageCount: number;
+  lock: PluginLockFile;
+}
+//#endregion
+//#region src/plugins/install.d.ts
+declare function installStaticPlugins(options: StaticPluginInstallOptions): Promise<StaticPluginInstallResult>;
+//#endregion
+//#region src/plugins/lock.d.ts
+declare function createEmptyPluginLockFile(): PluginLockFile;
+declare function listMissing(config: ParsedStaticConfig, lock: ParsedPluginLockFile): StaticPluginReference[];
+declare function listUnresolved(config: ParsedStaticConfig, lock: ParsedPluginLockFile): Promise<ParsedPluginLockEntry[]>;
+declare function loadPluginLockFile(cwd: string): Promise<PluginLockFile>;
+declare function parsePluginLockFile(value: unknown, options: {
+  cwd: string;
+}): ParsedPluginLockFile;
+declare function writePluginLockFile(cwd: string, lockFile: PluginLockFile): Promise<void>;
+//#endregion
 //#region src/setup/load.d.ts
 declare const emptySetupConfig: SetupConfig$1;
 declare function loadSetupConfig(filePath: string): Promise<SetupConfig$1>;
@@ -32,4 +153,4 @@ declare function stringifySetupConfigToml(config: SetupConfig$1): string;
 //#region src/setup/write.d.ts
 declare function writeSetupConfig(filePath: string, config: SetupConfig$1): Promise<void>;
 //#endregion
-export { type AlintConfig, type GlobalSetupConfigPathOptions, type ModelSize, type ProviderDefinition, type ProviderType, type RunnerConfig, type RunnerStatsConfig, type SetupConfig, type SetupModelDefinition, emptySetupConfig, getGlobalSetupConfigPath, getProjectSetupConfigPath, getStatsDir, ignorePatternsAIAgents, ignorePatternsBuildOutputs, ignorePatternsCaches, ignorePatternsCommon, ignorePatternsEslintDefaults, ignorePatternsGenerated, loadAlintConfig, loadSetupConfig, mergeSetupConfigs, parseSetupConfigToml, stringifySetupConfigToml, writeSetupConfig };
+export { type AlintConfig, type DirectoryPluginLockEntry, type GlobalSetupConfigPathOptions, type ModelSize, type ParseStaticConfigOptions, type ParsedDirectoryPluginLockEntry, type ParsedPluginLockEntry, type ParsedPluginLockFile, type ParsedPluginSpecifier, type ParsedRegistryPluginLockEntry, type ParsedStaticConfig, type ParsedStaticConfigGroup, type PluginLockEntry, type PluginLockFile, type ProviderDefinition, type ProviderType, type RegistryPluginLockEntry, type RunnerConfig, type RunnerStatsConfig, type SetupConfig, type SetupModelDefinition, type StaticConfigInput, type StaticConfigItem, type StaticPluginInstallOptions, type StaticPluginInstallResult, type StaticPluginReference, type StaticPluginResolver, type ToAlintConfigOptions, createEmptyPluginLockFile, emptySetupConfig, getGlobalSetupConfigPath, getProjectPluginLockPath, getProjectPluginStorePath, getProjectSetupConfigPath, getStatsDir, ignorePatternsAIAgents, ignorePatternsBuildOutputs, ignorePatternsCaches, ignorePatternsCommon, ignorePatternsEslintDefaults, ignorePatternsGenerated, installStaticPlugins, listMissing, listUnresolved, loadAlintConfig, loadPluginLockFile, loadSetupConfig, loadStaticConfig, mergeSetupConfigs, parsePluginLockFile, parsePluginSpecifier, parseSetupConfigToml, parseStaticConfig, stringifySetupConfigToml, toAlintConfig, writePluginLockFile, writeSetupConfig };

package/dist/index.mjs

@@ -1,23 +1,735 @@
+import { dirname, isAbsolute, join, normalize, posix, relative, resolve, sep, win32 } from "node:path";
 import { loadConfig } from "c12";
+import { createJiti } from "jiti/static";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { array, boolean, literal, looseObject, optional, parse, picklist, record, strictObject, string, tuple, union, unknown, variant } from "valibot";
 import process from "node:process";
 import { homedir } from "node:os";
-import { dirname, join } from "pathe";
+import { dirname as dirname$1, extname, join as join$1 } from "pathe";
 import { xdgConfig } from "xdg-basedir";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { parse, stringify } from "smol-toml";
+import { isError } from "@moeru/std/error";
+import { exports } from "resolve.exports";
+import { Buffer } from "node:buffer";
+import { createWriteStream } from "node:fs";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createGunzip } from "node:zlib";
+import tar from "tar-stream";
+import { ofetch } from "ofetch";
+import { pathToFileURL } from "node:url";
+import { isPlainObject } from "es-toolkit/compat";
+import { parse as parse$1, stringify } from "smol-toml";
+//#region src/paths.ts
+function getGlobalSetupConfigPath(env = process.env, options = {}) {
+	return join$1(resolveAlintHome(env, options), "config.toml");
+}
+function getProjectPluginLockPath(cwd) {
+	return join$1(cwd, ".alint", "plugins", "lock.json");
+}
+function getProjectPluginStorePath(cwd) {
+	return join$1(cwd, ".alint", "plugins", "store");
+}
+function getProjectSetupConfigPath(cwd) {
+	return join$1(cwd, ".alint", "config.toml");
+}
+function getStatsDir(env = process.env, options = {}) {
+	return join$1(resolveAlintHome(env, options), "stats");
+}
+function resolveAlintHome(env, options) {
+	return join$1(env.XDG_CONFIG_HOME ?? resolveDefaultConfigHome(options), "alint");
+}
+function resolveDefaultConfigHome(options) {
+	if (options.isMacOS ?? process.platform === "darwin") return join$1(homedir(), ".config");
+	return options.xdgConfig ?? xdgConfig ?? join$1(homedir(), ".config");
+}
+//#endregion
+//#region src/utils/fs.ts
+async function exists(path) {
+	try {
+		await stat(path);
+		return true;
+	} catch (error) {
+		if (isENOENTError(error)) return false;
+		throw error;
+	}
+}
+function isENOENTError(error) {
+	return isNodeErrorCode(error, "ENOENT");
+}
+function isNodeErrorCode(error, code) {
+	return isError(error) && "code" in error && error.code === code;
+}
+function isPathInside(path, parent) {
+	const childRelativePath = relative(parent, path);
+	return childRelativePath === "" || childRelativePath !== ".." && !childRelativePath.startsWith(`..${sep}`) && !isAbsolute(childRelativePath);
+}
+//#endregion
+//#region src/plugins/integrity.ts
+const SUPPORTED_INTEGRITY_ALGORITHMS = ["sha512", "sha256"];
+const SUPPORTED_INTEGRITY_TOKEN_PATTERN = /^(sha512|sha256)-([A-Za-z0-9+/]+={0,2})$/u;
+function checkIntegrity(data, integrity, specifier) {
+	const result = parseIntegrity(integrity, specifier);
+	if (!result.tokens.some(({ algorithm, expected }) => {
+		if (algorithm !== result.strongestAlgorithm) return false;
+		return createHash(algorithm).update(data).digest("base64") === expected;
+	})) throw new Error(`Integrity mismatch for "${specifier}".`);
+}
+function parseIntegrity(integrity, specifier) {
+	const tokens = integrity.trim().split(/\s+/u).map((token) => SUPPORTED_INTEGRITY_TOKEN_PATTERN.exec(token)).filter((match) => match !== null).map(([, algorithm, expected]) => ({
+		algorithm,
+		expected
+	}));
+	const strongestAlgorithm = SUPPORTED_INTEGRITY_ALGORITHMS.find((algorithm) => tokens.some((token) => token.algorithm === algorithm));
+	if (strongestAlgorithm === void 0) throw new Error(`Unsupported npm integrity format for "${specifier}": "${integrity}".`);
+	return {
+		strongestAlgorithm,
+		tokens
+	};
+}
+//#endregion
+//#region src/plugins/sources/manifest.ts
+function resolveRelativeRootEntry(packageJson) {
+	const [entry] = exports(packageJson, ".", {
+		browser: false,
+		require: false
+	}) ?? [];
+	if (entry === void 0) {
+		const name = typeof packageJson.name === "string" ? packageJson.name : "<unknown>";
+		throw new Error(`Package "${name}" does not define a resolvable "." export.`);
+	}
+	return entry.startsWith("./") ? entry.slice(2) : entry;
+}
+//#endregion
+//#region src/plugins/sources/local/index.ts
+async function createLockEntry$1(installed, options) {
+	const relativePath = relative(await realpath(options.cwd), installed.path);
+	const path = isAbsolute(relativePath) || win32.isAbsolute(relativePath) ? installed.path : relativePath === "" ? "." : relativePath;
+	return {
+		alias: options.alias,
+		path,
+		specifier: options.specifier.raw,
+		type: "directory"
+	};
+}
+async function install$1(options) {
+	const packageDir = await canonicalRoot(options.alias, options.specifier.directory);
+	await validateRoot(options.alias, packageDir);
+	return {
+		path: packageDir,
+		type: "directory"
+	};
+}
+async function resolve$2(entry) {
+	const lockedPath = isAbsolute(entry.lockEntry.path) || win32.isAbsolute(entry.lockEntry.path) ? entry.lockEntry.path : resolve(entry.cwd, entry.lockEntry.path);
+	const [packageDir, lockedPackageDir] = await Promise.all([lockedRoot(entry.alias, entry.specifier.directory, "configured"), lockedRoot(entry.alias, lockedPath, "locked")]);
+	if (packageDir !== lockedPackageDir) throw new Error(`Directory plugin "${entry.alias}" has moved or its symlink target changed. Run: alint plugin install`);
+	return {
+		cache: "content",
+		entry: await validateRoot(entry.alias, packageDir)
+	};
+}
+async function canonicalRoot(alias, directory) {
+	let packageDir;
+	try {
+		packageDir = await realpath(directory);
+	} catch (error) {
+		if (isENOENTError(error)) throw new Error(`Directory plugin "${alias}" does not exist at "${directory}".`, { cause: error });
+		throw new Error(`Could not resolve directory plugin "${alias}" at "${directory}".`, { cause: error });
+	}
+	let directoryStat;
+	try {
+		directoryStat = await stat(packageDir);
+	} catch (error) {
+		throw new Error(`Could not inspect directory plugin "${alias}" at "${directory}".`, { cause: error });
+	}
+	if (!directoryStat.isDirectory()) throw new Error(`Directory plugin "${alias}" path "${directory}" is not a directory.`);
+	return packageDir;
+}
+async function lockedRoot(alias, directory, source) {
+	try {
+		return await realpath(directory);
+	} catch (error) {
+		if (isENOENTError(error)) throw new Error(`Directory plugin "${alias}" has moved or its symlink target changed. Run: alint plugin install`, { cause: error });
+		throw new Error(`Could not resolve ${source} directory plugin "${alias}" at "${directory}".`, { cause: error });
+	}
+}
+async function validateRoot(alias, packageDir) {
+	const manifestPath = join(packageDir, "package.json");
+	let packageJson;
+	try {
+		packageJson = JSON.parse(await readFile(manifestPath, "utf8"));
+	} catch (error) {
+		throw new Error(`Directory plugin "${alias}" has an unreadable or invalid package.json at "${manifestPath}".`, { cause: error });
+	}
+	const relativeEntry = resolveRelativeRootEntry(packageJson);
+	const entry = resolve(packageDir, relativeEntry);
+	if (!isPathInside(entry, packageDir)) throw new Error(`Directory plugin "${alias}" root export escapes the package directory.`);
+	let physicalEntry;
+	try {
+		physicalEntry = await realpath(entry);
+	} catch (error) {
+		if (isENOENTError(error)) throw new Error(`Directory plugin "${alias}" entry "${relativeEntry}" does not exist. Build the package and try again.`, { cause: error });
+		throw new Error(`Could not resolve directory plugin "${alias}" entry "${relativeEntry}".`, { cause: error });
+	}
+	if (!isPathInside(physicalEntry, packageDir)) throw new Error(`Directory plugin "${alias}" entry physically escapes the package directory.`);
+	let entryStat;
+	try {
+		entryStat = await stat(physicalEntry);
+	} catch (error) {
+		if (isENOENTError(error)) throw new Error(`Directory plugin "${alias}" entry "${relativeEntry}" does not exist. Build the package and try again.`, { cause: error });
+		throw new Error(`Could not inspect directory plugin "${alias}" entry "${relativeEntry}".`, { cause: error });
+	}
+	if (!entryStat.isFile()) throw new Error(`Directory plugin "${alias}" entry "${relativeEntry}" is not a regular file.`);
+	return physicalEntry;
+}
+//#endregion
+//#region src/plugins/sources/package/index.ts
+function createLockEntry(installed, options) {
+	return {
+		alias: options.alias,
+		entry: installed.entry,
+		integrity: installed.integrity,
+		name: installed.name,
+		registry: installed.registry,
+		specifier: options.specifier.raw,
+		tarball: installed.tarball,
+		type: "registry",
+		version: installed.version
+	};
+}
+async function install(options) {
+	const { name, segments, version } = options.specifier;
+	const npmRegistry = options.npmRegistry.endsWith("/") ? options.npmRegistry : `${options.npmRegistry}/`;
+	const dist = (await ofetch(`${npmRegistry.replace(/\/$/u, "")}/${options.specifier.registryPath}`)).versions?.[version]?.dist;
+	if (dist?.tarball === void 0) throw new Error(`Npm metadata for "${name}" does not include a tarball for version ${version}.`);
+	if (dist.integrity === void 0 || dist.integrity.trim() === "") throw new Error(`Npm metadata for "${name}" does not include integrity for version ${version}.`);
+	const storePath = getProjectPluginStorePath(options.cwd);
+	const packageDir = join(storePath, ...segments, version, "package");
+	if (!isPathInside(resolve(packageDir), resolve(storePath))) throw new Error(`Static plugin package "${name}" resolves outside the project plugin store.`);
+	const stagingPackageDir = join(dirname(packageDir), `package-staging-${randomUUID()}`);
+	let relativeEntry;
+	try {
+		const tarball = Buffer.from(await ofetch(dist.tarball, { responseType: "arrayBuffer" }));
+		checkIntegrity(tarball, dist.integrity, `${name}@${version}`);
+		await mkdir(stagingPackageDir, { recursive: true });
+		await extractTarball(tarball, stagingPackageDir);
+		relativeEntry = resolveRelativeRootEntry(JSON.parse(await readFile(join(stagingPackageDir, "package.json"), "utf8")));
+		await replaceDirectory(packageDir, stagingPackageDir);
+	} catch (error) {
+		await rm(stagingPackageDir, {
+			force: true,
+			recursive: true
+		});
+		throw error;
+	}
+	return {
+		entry: posix.join(".alint/plugins/store", ...segments, version, "package", relativeEntry.split(/[\\/]/u).join("/")),
+		integrity: dist.integrity,
+		name,
+		registry: npmRegistry,
+		tarball: dist.tarball,
+		type: "registry",
+		version
+	};
+}
+async function resolve$1(entry) {
+	const projectRoot = resolve(entry.cwd);
+	const pluginRoot = join(projectRoot, ".alint", "plugins", "store");
+	const rawEntryPath = entry.lockEntry.entry;
+	const resolvedEntry = isAbsolute(rawEntryPath) ? resolve(rawEntryPath) : resolve(projectRoot, rawEntryPath);
+	if (!isPathInside(resolvedEntry, projectRoot)) throw new Error(`Plugin lock entry "${entry.alias}" resolves outside the project root.`);
+	const [physicalEntry, physicalPluginRoot] = await Promise.all([resolvePhysicalPath(resolvedEntry), realpath(pluginRoot)]);
+	if (!isPathInside(physicalEntry, physicalPluginRoot)) throw new Error(`Plugin lock entry "${entry.alias}" resolves outside the plugin store.`);
+	const packageDir = getLockedPackageDir(projectRoot, pluginRoot, entry);
+	if (await realpath(packageDir) !== join(physicalPluginRoot, ...getPackagePathSegments(entry.lockEntry.name), entry.lockEntry.version, "package")) throw new Error(`Plugin lock entry "${entry.alias}" resolves outside the locked package directory.`);
+	if (!isPathInside(resolvedEntry, packageDir)) throw new Error(`Plugin lock entry "${entry.alias}" resolves outside the locked package directory.`);
+	JSON.parse(await readFile(join(packageDir, "package.json"), "utf8"));
+	return {
+		cache: "default",
+		entry: resolvedEntry
+	};
+}
+async function extractEntry(packageDir, header, stream) {
+	const entryName = header.name;
+	if (!entryName.startsWith("package/")) {
+		stream.resume();
+		return;
+	}
+	const relativeEntry = entryName.slice(8);
+	const normalized = posix.normalize(relativeEntry);
+	if (relativeEntry === "" || normalized === ".") {
+		stream.resume();
+		return;
+	}
+	if (normalized === ".." || normalized.startsWith("../") || posix.isAbsolute(normalized)) {
+		stream.resume();
+		throw new Error(`Plugin tarball entry "${entryName}" escapes the package directory.`);
+	}
+	const outputPath = resolve(packageDir, normalized);
+	if (!isPathInside(outputPath, packageDir)) {
+		stream.resume();
+		throw new Error(`Plugin tarball entry "${entryName}" escapes the package directory.`);
+	}
+	if (header.type === "directory") {
+		stream.resume();
+		await mkdir(outputPath, { recursive: true });
+		return;
+	}
+	if (header.type !== "file") {
+		stream.resume();
+		return;
+	}
+	await mkdir(dirname(outputPath), { recursive: true });
+	await pipeline(stream, createWriteStream(outputPath));
+}
+async function extractTarball(tarball, packageDir) {
+	const extract = tar.extract();
+	extract.on("entry", (header, stream, next) => {
+		extractEntry(packageDir, header, stream).then(() => next()).catch((error) => extract.destroy(error));
+	});
+	await pipeline(Readable.from(tarball), createGunzip(), extract);
+}
+function getLockedPackageDir(projectRoot, pluginRoot, entry) {
+	const name = entry.lockEntry.name;
+	const version = entry.lockEntry.version;
+	if (entry.specifier.name !== name) throw new Error(`Plugin lock entry "${entry.alias}" package name does not match its specifier.`);
+	if (entry.specifier.version !== version) throw new Error(`Plugin lock entry "${entry.alias}" package version does not match its specifier.`);
+	const packageDir = join(pluginRoot, ...getPackagePathSegments(name), version, "package");
+	if (!isPathInside(packageDir, projectRoot) || !isPathInside(packageDir, pluginRoot)) throw new Error(`Plugin lock entry "${entry.alias}" package metadata resolves outside the plugin store.`);
+	return packageDir;
+}
+function getPackagePathSegments(name) {
+	const segments = name.split("/");
+	const segmentPattern = /^[\w.-]+$/u;
+	if (segments.length === 2) {
+		const [scope, packageName] = segments;
+		if (scope === void 0 || packageName === void 0 || !scope.startsWith("@") || !segmentPattern.test(scope.slice(1)) || !segmentPattern.test(packageName)) throw new Error(`Invalid static plugin package name "${name}".`);
+		return segments;
+	}
+	if (segments.length !== 1 || !segmentPattern.test(segments[0])) throw new Error(`Invalid static plugin package name "${name}".`);
+	return segments;
+}
+async function nearestExistingParent(path) {
+	let current = path;
+	while (current !== dirname(current)) {
+		if (await exists(current)) return current;
+		current = dirname(current);
+	}
+	return current;
+}
+async function replaceDirectory(packageDir, stagingPackageDir) {
+	const backupPackageDir = join(dirname(packageDir), `package-backup-${randomUUID()}`);
+	let hasBackup = false;
+	let replaced = false;
+	try {
+		await rename(packageDir, backupPackageDir);
+		hasBackup = true;
+	} catch (error) {
+		if (!isENOENTError(error)) throw error;
+	}
+	try {
+		await rename(stagingPackageDir, packageDir);
+		replaced = true;
+	} catch (error) {
+		if (hasBackup) {
+			await rename(backupPackageDir, packageDir);
+			hasBackup = false;
+		}
+		throw error;
+	} finally {
+		if (replaced || !hasBackup) await rm(backupPackageDir, {
+			force: true,
+			recursive: true
+		});
+	}
+}
+async function resolvePhysicalPath(path) {
+	try {
+		return await realpath(path);
+	} catch (error) {
+		if (!isENOENTError(error)) throw error;
+	}
+	const parent = await nearestExistingParent(dirname(path));
+	return join(await realpath(parent), relative(parent, path));
+}
+//#endregion
+//#region src/plugins/resolve.ts
+function resolvePluginImportTarget(entry) {
+	return entry.type === "directory" ? resolve$2(entry) : resolve$1(entry);
+}
+//#endregion
+//#region src/plugins/spec.ts
+const explicitRelativePathPattern = /^\.{1,2}(?:[\\/]|$)/u;
+function getPluginSpecifierKey(specifier) {
+	return specifier.type === "registry" ? `registry:${specifier.raw}` : `directory:${normalizeDirectoryIdentity(specifier.directory)}`;
+}
+function isDirectoryPluginSpecifier(value) {
+	return isAbsolute(value) || win32.isAbsolute(value) || explicitRelativePathPattern.test(value);
+}
+function parsePluginSpecifier(value, options = {}) {
+	if (/^file:/iu.test(value)) throw new Error("Static plugin file URLs are not supported. Use a relative or absolute directory path instead.");
+	if (isAbsolute(value) || win32.isAbsolute(value)) return {
+		directory: isAbsolute(value) ? normalize(value) : win32.normalize(value),
+		raw: value,
+		type: "directory"
+	};
+	if (explicitRelativePathPattern.test(value)) {
+		if (options.configFile === void 0) throw new Error(`Relative static plugin directory "${value}" requires a config file.`);
+		const relativePath = value.split(/[\\/]/u).join(sep);
+		return {
+			directory: resolve(dirname(options.configFile), relativePath),
+			raw: value,
+			type: "directory"
+		};
+	}
+	const versionSeparator = value.lastIndexOf("@");
+	if (versionSeparator <= 0 || versionSeparator === value.length - 1) throw new Error(`Static plugin specifier "${value}" must include an exact package version.`);
+	const name = value.slice(0, versionSeparator);
+	const segments = parsePackageNameSegments(name);
+	return {
+		name,
+		raw: value,
+		registryPath: name.startsWith("@") ? name.replace("/", "%2f") : encodeURIComponent(name),
+		segments,
+		type: "registry",
+		version: value.slice(versionSeparator + 1)
+	};
+}
+function normalizeDirectoryIdentity(directory) {
+	return isAbsolute(directory) ? normalize(directory) : win32.normalize(directory);
+}
+function parsePackageNameSegments(name) {
+	if (name === "" || name.includes("\\") || isAbsolute(name) || posix.isAbsolute(name)) throw new Error(`Invalid static plugin package name "${name}".`);
+	const segments = name.split("/");
+	if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) throw new Error(`Invalid static plugin package name "${name}".`);
+	const segmentPattern = /^[a-z0-9][a-z0-9._~-]*$/u;
+	if (name.startsWith("@")) {
+		const [scope, packageName, extraSegment] = segments;
+		if (segments.length !== 2 || scope === void 0 || packageName === void 0 || extraSegment !== void 0 || !scope.startsWith("@") || !segmentPattern.test(scope.slice(1)) || !segmentPattern.test(packageName)) throw new Error(`Invalid static plugin package name "${name}".`);
+		return segments;
+	}
+	if (segments.length !== 1 || !segmentPattern.test(segments[0])) throw new Error(`Invalid static plugin package name "${name}".`);
+	return segments;
+}
+//#endregion
+//#region src/plugins/lock.ts
+const PluginLockEntrySchema = variant("type", [strictObject({
+	alias: string(),
+	path: string(),
+	specifier: string(),
+	type: literal("directory")
+}), strictObject({
+	alias: string(),
+	entry: string(),
+	integrity: string(),
+	name: string(),
+	registry: string(),
+	specifier: string(),
+	tarball: string(),
+	type: literal("registry"),
+	version: string()
+})]);
+const PluginLockFileSchema = strictObject({
+	plugins: record(string(), PluginLockEntrySchema),
+	version: literal(2)
+});
+function createEmptyPluginLockFile() {
+	return {
+		plugins: {},
+		version: 2
+	};
+}
+function listMissing(config, lock) {
+	const missing = [];
+	for (const group of config.groups) for (const reference of group.plugins) if (lock.find(reference) === void 0) missing.push(reference);
+	return missing;
+}
+async function listUnresolved(config, lock) {
+	const unresolved = [];
+	const checkedAliases = /* @__PURE__ */ new Set();
+	for (const group of config.groups) for (const reference of group.plugins) {
+		const entry = lock.find(reference);
+		if (entry === void 0 || checkedAliases.has(entry.alias)) continue;
+		checkedAliases.add(entry.alias);
+		try {
+			await resolvePluginImportTarget(entry);
+		} catch (error) {
+			unresolved.push({
+				...entry,
+				resolutionError: error
+			});
+		}
+	}
+	return unresolved;
+}
+async function loadPluginLockFile(cwd) {
+	try {
+		return parsePluginLockFileValue(await readFile(getProjectPluginLockPath(cwd), "utf8"));
+	} catch (error) {
+		if (isENOENTError(error)) return createEmptyPluginLockFile();
+		throw error;
+	}
+}
+function parsePluginLockFile(value, options) {
+	const file = parsePluginLockFileValue(value);
+	const entries = Object.values(file.plugins).map((entry) => {
+		if (entry.type === "registry") {
+			const specifier = parsePluginSpecifier(entry.specifier);
+			if (specifier.type !== "registry") throw new Error(`Registry plugin lock entry "${entry.alias}" must use a registry specifier.`);
+			return {
+				alias: entry.alias,
+				cwd: options.cwd,
+				lockEntry: entry,
+				specifier,
+				type: "registry"
+			};
+		}
+		const specifier = parsePluginSpecifier(resolveDirectoryLockIdentity(entry.path, options.cwd));
+		if (specifier.type !== "directory") throw new Error(`Directory plugin lock entry "${entry.alias}" must use a directory path.`);
+		return {
+			alias: entry.alias,
+			cwd: options.cwd,
+			lockEntry: entry,
+			specifier: {
+				...specifier,
+				raw: entry.specifier
+			},
+			type: "directory"
+		};
+	});
+	const byAlias = new Map(entries.map((entry) => [entry.alias, entry]));
+	return {
+		cwd: options.cwd,
+		entries,
+		file,
+		find(reference) {
+			const entry = byAlias.get(reference.alias);
+			return entry !== void 0 && matchesReference(entry, reference) ? associateCurrentSpecifier(entry, reference) : void 0;
+		},
+		get(reference) {
+			const entry = byAlias.get(reference.alias);
+			const expected = reference.specifier.raw;
+			if (entry === void 0) throw new Error(`Plugin "${reference.alias}" requires ${expected}, but no matching lock entry exists.\nRun: alint plugin install`);
+			if (!matchesReference(entry, reference)) throw new Error(`Plugin "${reference.alias}" is locked to ${entry.lockEntry.specifier}, but config requires ${expected}.\nRun: alint plugin install`);
+			return associateCurrentSpecifier(entry, reference);
+		}
+	};
+}
+async function writePluginLockFile(cwd, lockFile) {
+	const content = `${JSON.stringify(parsePluginLockFileValue(lockFile), null, 2)}\n`;
+	const lockPath = getProjectPluginLockPath(cwd);
+	const lockDir = dirname(lockPath);
+	const tempPath = join(lockDir, `lock.${randomUUID()}.tmp`);
+	await mkdir(lockDir, { recursive: true });
+	try {
+		await writeFile(tempPath, content, "utf8");
+		await rename(tempPath, lockPath);
+	} catch (error) {
+		await rm(tempPath, { force: true });
+		throw error;
+	}
+}
+function associateCurrentSpecifier(entry, reference) {
+	if (entry.type === "directory" && reference.specifier.type === "directory") return {
+		...entry,
+		specifier: reference.specifier
+	};
+	return entry;
+}
+function matchesReference(entry, reference) {
+	if (entry.type !== reference.specifier.type) return false;
+	if (entry.type === "directory") return entry.lockEntry.specifier === reference.specifier.raw || getPluginSpecifierKey(entry.specifier) === getPluginSpecifierKey(reference.specifier);
+	return getPluginSpecifierKey(entry.specifier) === getPluginSpecifierKey(reference.specifier);
+}
+function parsePluginLockFileValue(value) {
+	const parsedValue = typeof value === "string" ? JSON.parse(value) : value;
+	if (typeof parsedValue === "object" && parsedValue !== null && "version" in parsedValue && parsedValue.version === 1) throw new Error("Unsupported plugin lock version 1. Run: alint plugin install");
+	const file = parse(PluginLockFileSchema, parsedValue);
+	for (const [alias, entry] of Object.entries(file.plugins)) {
+		if (entry.alias !== alias) throw new Error(`Plugin lock entry key "${alias}" must match alias "${entry.alias}".`);
+		if (entry.type === "registry") {
+			parseIntegrity(entry.integrity, entry.specifier);
+			if (isDirectoryPluginSpecifier(entry.specifier)) throw new Error(`Registry plugin lock entry "${alias}" must use a registry specifier.`);
+			const specifier = parsePluginSpecifier(entry.specifier);
+			if (specifier.type !== "registry" || specifier.name !== entry.name || specifier.version !== entry.version) throw new Error(`Registry plugin lock entry "${alias}" identity does not match specifier "${entry.specifier}".`);
+		} else if (!isDirectoryPluginSpecifier(entry.specifier)) throw new Error(`Directory plugin lock entry "${alias}" must use a directory specifier.`);
+	}
+	return file;
+}
+function resolveDirectoryLockIdentity(path, cwd) {
+	return isAbsolute(path) || win32.isAbsolute(path) ? path : resolve(cwd, path);
+}
+//#endregion
+//#region src/plugins/sources/import.ts
+async function importPlugin(target) {
+	const url = pathToFileURL(target.entry);
+	if (target.cache === "content") url.searchParams.set("content", createHash("sha256").update(await readFile(target.entry)).digest("hex"));
+	return getDefaultExport(await import(url.href));
+}
+function getDefaultExport(value) {
+	if (!isPlainObject(value)) return value;
+	const objectValue = value;
+	return Object.hasOwn(objectValue, "default") ? Reflect.get(objectValue, "default") : value;
+}
+//#endregion
+//#region src/config/static.ts
+const filePatternSchema = union([string(), array(string())]);
+const ruleSeveritySchema = picklist([
+	"error",
+	"off",
+	"warn"
+]);
+const ruleConfigEntrySchema = union([ruleSeveritySchema, tuple([ruleSeveritySchema])]);
+const staticConfigItemSchema = looseObject({
+	agent: optional(unknown()),
+	basePath: optional(string()),
+	extends: optional(array(unknown())),
+	files: optional(array(filePatternSchema)),
+	ignore: optional(looseObject({ gitignore: optional(boolean()) })),
+	ignores: optional(array(string())),
+	language: optional(string()),
+	languageOptions: optional(record(string(), unknown())),
+	linterOptions: optional(looseObject({
+		noInlineConfig: optional(boolean()),
+		reportUnusedDisableDirectives: optional(ruleSeveritySchema)
+	})),
+	name: optional(string()),
+	plugins: optional(record(string(), unknown())),
+	processor: optional(unknown()),
+	rules: optional(record(string(), ruleConfigEntrySchema)),
+	runner: optional(unknown()),
+	settings: optional(record(string(), unknown()))
+});
+function parseStaticConfig(value, options = {}) {
+	const items = toAlintConfigItems(value, options);
+	const pluginsByAlias = /* @__PURE__ */ new Map();
+	return { groups: items.map((item) => {
+		return {
+			item,
+			plugins: readStaticPluginReferences(item, pluginsByAlias, options)
+		};
+	}) };
+}
+async function toAlintConfig(config, options) {
+	const pluginCache = /* @__PURE__ */ new Map();
+	return Promise.all(config.groups.map((group) => resolveStaticPlugins(group, options, pluginCache)));
+}
+function isPlainObject$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isTomlConfig(configFile) {
+	return extname(configFile ?? "").toLowerCase() === ".toml";
+}
+function parseStaticConfigInputArray(value, arrayStack = []) {
+	if (arrayStack.includes(value)) throw new Error("Circular static config array.");
+	return value.flatMap((item) => Array.isArray(item) ? parseStaticConfigInputArray(item, [...arrayStack, value]) : [parseStaticConfigItem(item)]);
+}
+function parseStaticConfigItem(value) {
+	if (Array.isArray(value)) throw new TypeError("Invalid type: Expected Object but received Array");
+	return parse(staticConfigItemSchema, value);
+}
+function parseStaticConfigItems(value) {
+	return value.map(parseStaticConfigItem);
+}
+function readConfigGroup(value) {
+	if (!isPlainObject$2(value)) return;
+	const wrapper = value;
+	if (wrapper.config === void 0) return;
+	if (!isPlainObject$2(wrapper.config) || !Array.isArray(wrapper.config.group)) throw new TypeError("Static config field \"config.group\" must be an array.");
+	return wrapper.config.group;
+}
+function readStaticPluginReferences(item, pluginsByAlias, options) {
+	if (!isPlainObject$2(item.plugins)) return [];
+	const references = [];
+	for (const [alias, plugin] of Object.entries(item.plugins)) {
+		if (typeof plugin !== "string") continue;
+		const specifier = parsePluginSpecifier(plugin, options);
+		const existing = pluginsByAlias.get(alias);
+		if (existing !== void 0 && getPluginSpecifierKey(existing) !== getPluginSpecifierKey(specifier)) throw new Error(`Static plugin "${alias}" is configured with multiple specifiers: "${existing.raw}" and "${specifier.raw}".`);
+		pluginsByAlias.set(alias, specifier);
+		references.push({
+			alias,
+			specifier
+		});
+	}
+	return references;
+}
+async function resolveStaticPlugins(group, options, pluginCache) {
+	if (group.item.plugins === void 0) {
+		const { plugins: _plugins, ...item } = group.item;
+		return item;
+	}
+	const plugins = {};
+	for (const [alias, plugin] of Object.entries(group.item.plugins)) {
+		if (typeof plugin !== "string") {
+			plugins[alias] = plugin;
+			continue;
+		}
+		const reference = group.plugins.find((item) => item.alias === alias);
+		if (reference === void 0) throw new Error(`Static plugin "${alias}" is missing a parsed plugin reference.`);
+		const pluginCacheKey = getPluginSpecifierKey(reference.specifier);
+		let resolvedPlugin = pluginCache.get(pluginCacheKey);
+		if (resolvedPlugin === void 0) {
+			resolvedPlugin = options.pluginResolver(reference);
+			pluginCache.set(pluginCacheKey, resolvedPlugin);
+		}
+		plugins[alias] = await resolvedPlugin;
+	}
+	return {
+		...group.item,
+		plugins
+	};
+}
+function toAlintConfigItems(value, options = {}) {
+	if (Array.isArray(value)) return parseStaticConfigInputArray(value);
+	const group = readConfigGroup(value);
+	if (group !== void 0) return parseStaticConfigItems(group);
+	if (isTomlConfig(options.configFile)) throw new Error("Static TOML config must use [[config.group]].");
+	if (value === void 0 || value === null) return [];
+	throw new Error("Static config must be a flat config array or { config: { group: [...] } }.");
+}
+//#endregion
 //#region src/config/load.ts
 async function loadAlintConfig(cwd, configFile) {
+	const staticConfig = await loadStaticConfig(cwd, configFile);
+	if (staticConfig.groups.flatMap((group) => group.plugins).length === 0) return toAlintConfig(staticConfig, { pluginResolver: async (reference) => {
+		throw new Error(`Static plugin "${reference.alias}" was not expected to require resolution.`);
+	} });
+	const lock = parsePluginLockFile(await loadPluginLockFile(cwd), { cwd });
+	const missing = listMissing(staticConfig, lock);
+	if (missing.length > 0) throw new Error(`Static plugin references are missing from the lock file: ${formatStaticPluginReferences(missing)}.\nRun: alint plugin install`);
+	const unresolved = await listUnresolved(staticConfig, lock);
+	if (unresolved.length > 0) {
+		const message = `Static plugins could not be resolved from the lock file: ${formatPluginLockEntries(unresolved)}.\nRun: alint plugin install`;
+		throw new Error(message, { cause: unresolved[0]?.resolutionError });
+	}
+	return toAlintConfig(staticConfig, { async pluginResolver(reference) {
+		return importPlugin(await resolvePluginImportTarget(lock.get(reference)));
+	} });
+}
+async function loadStaticConfig(cwd, configFile) {
 	const result = await loadConfig({
 		configFile,
 		cwd,
 		dotenv: true,
+		jiti: createJiti(resolve(cwd, configFile ?? "alint.config"), {
+			interopDefault: true,
+			moduleCache: false
+		}),
 		name: "alint"
 	});
-	if (result._configFile === void 0) return [];
-	return result.config ?? [];
+	if (result._configFile === void 0) return parseStaticConfig(void 0);
+	return parseStaticConfig(result.config, { configFile: result._configFile });
+}
+function formatPluginLockEntries(entries) {
+	return entries.map((entry) => `${entry.alias} (${entry.specifier.raw})`).join(", ");
+}
+function formatStaticPluginReferences(references) {
+	return references.map((reference) => `${reference.alias} (${reference.specifier.raw})`).join(", ");
 }
 //#endregion
-//#region src/ignore-patterns.ts
+//#region src/constants/patterns/ignore.ts
 const ignorePatternsEslintDefaults = [
 	"**/node_modules/**",
 	".git/**",
@@ -57,22 +769,61 @@ const ignorePatternsCommon = [
 	...ignorePatternsGenerated
 ];
 //#endregion
-//#region src/paths.ts
-function getGlobalSetupConfigPath(env = process.env, options = {}) {
-	return join(resolveAlintHome(env, options), "config.toml");
-}
-function getProjectSetupConfigPath(cwd) {
-	return join(cwd, ".alint", "config.toml");
-}
-function getStatsDir(env = process.env, options = {}) {
-	return join(resolveAlintHome(env, options), "stats");
-}
-function resolveAlintHome(env, options) {
-	return join(env.XDG_CONFIG_HOME ?? resolveDefaultConfigHome(options), "alint");
-}
-function resolveDefaultConfigHome(options) {
-	if (options.isMacOS ?? process.platform === "darwin") return join(homedir(), ".config");
-	return options.xdgConfig ?? xdgConfig ?? join(homedir(), ".config");
+//#region src/plugins/install.ts
+const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
+async function installStaticPlugins(options) {
+	const configuredPlugins = (await loadStaticConfig(options.cwd, options.configFile)).groups.flatMap((group) => group.plugins);
+	const npmRegistry = options.registry ?? DEFAULT_REGISTRY;
+	const lockFile = createEmptyPluginLockFile();
+	const packageInstallations = /* @__PURE__ */ new Map();
+	const localDirectoryInstallations = /* @__PURE__ */ new Map();
+	const installedLocalDirectories = /* @__PURE__ */ new Map();
+	for (const configuredPlugin of configuredPlugins) {
+		const specifier = configuredPlugin.specifier;
+		if (specifier.type === "directory") {
+			const key = getPluginSpecifierKey(specifier);
+			let installation = localDirectoryInstallations.get(key);
+			if (installation === void 0) {
+				installation = install$1({
+					alias: configuredPlugin.alias,
+					specifier
+				});
+				localDirectoryInstallations.set(key, installation);
+			}
+			const installed = await installation;
+			const canonical = installed.path;
+			const entry = installedLocalDirectories.get(canonical) ?? installed;
+			installedLocalDirectories.set(canonical, entry);
+			lockFile.plugins[configuredPlugin.alias] = await createLockEntry$1(entry, {
+				alias: configuredPlugin.alias,
+				cwd: options.cwd,
+				specifier
+			});
+			continue;
+		}
+		const key = getPluginSpecifierKey(specifier);
+		let packageInstallation = packageInstallations.get(key);
+		if (packageInstallation === void 0) {
+			packageInstallation = install({
+				cwd: options.cwd,
+				npmRegistry,
+				specifier
+			});
+			packageInstallations.set(key, packageInstallation);
+		}
+		const installedPackage = await packageInstallation;
+		lockFile.plugins[configuredPlugin.alias] = createLockEntry(installedPackage, {
+			alias: configuredPlugin.alias,
+			specifier
+		});
+	}
+	await writePluginLockFile(options.cwd, lockFile);
+	return {
+		configuredPluginCount: configuredPlugins.length,
+		installedLocalDirectoryCount: installedLocalDirectories.size,
+		installedPackageCount: packageInstallations.size,
+		lock: lockFile
+	};
 }
 //#endregion
 //#region src/setup/toml.ts
@@ -82,7 +833,7 @@ const modelSizes = /* @__PURE__ */ new Set([
 	"small"
 ]);
 function parseSetupConfigToml(toml) {
-	const rawConfig = parse(toml);
+	const rawConfig = parse$1(toml);
 	if (rawConfig.version !== 1) throw new Error("Invalid setup config: version must be 1.");
 	if (!Array.isArray(rawConfig.providers)) throw new TypeError("Invalid setup config: providers must be an array.");
 	const parsedConfig = {
@@ -103,7 +854,7 @@ function stringifySetupConfigToml(config) {
 function isModelSize(value) {
 	return typeof value === "string" && modelSizes.has(value);
 }
-function isPlainObject(value) {
+function isPlainObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseModel(providerId, model) {
@@ -149,7 +900,7 @@ function parseRunner(runner) {
 }
 function parseRunnerCache(cache) {
 	if (typeof cache === "boolean") return cache;
-	if (!isPlainObject(cache)) throw new TypeError("Invalid runner cache: must be a boolean or table.");
+	if (!isPlainObject$1(cache)) throw new TypeError("Invalid runner cache: must be a boolean or table.");
 	const tomlCache = cache;
 	const parsedCache = {};
 	if (tomlCache.enabled !== void 0) {
@@ -161,7 +912,7 @@ function parseRunnerCache(cache) {
 }
 function parseRunnerStats(stats) {
 	if (typeof stats === "boolean") return stats;
-	if (!isPlainObject(stats)) throw new TypeError("Invalid runner stats: must be a boolean or an object.");
+	if (!isPlainObject$1(stats)) throw new TypeError("Invalid runner stats: must be a boolean or an object.");
 	const tomlStats = stats;
 	const parsedStats = {};
 	if (tomlStats.enabled !== void 0) {
@@ -182,7 +933,7 @@ function readNonEmptyString(value, label) {
 	return stringValue;
 }
 function readRecord(value, label) {
-	if (!isPlainObject(value)) throw new Error(`Invalid ${label}: must be a table.`);
+	if (!isPlainObject$1(value)) throw new Error(`Invalid ${label}: must be a table.`);
 	return value;
 }
 function readString(value, label) {
@@ -248,7 +999,7 @@ async function loadSetupConfig(filePath) {
 	try {
 		return parseSetupConfigToml(await readFile(filePath, "utf8"));
 	} catch (error) {
-		if (isNodeError(error) && error.code === "ENOENT") return createEmptySetupConfig();
+		if (isENOENTError(error)) return createEmptySetupConfig();
 		throw error;
 	}
 }
@@ -321,9 +1072,6 @@ function createEmptySetupConfig() {
 		version: 1
 	};
 }
-function isNodeError(error) {
-	return error instanceof Error && "code" in error;
-}
 function mergeModel(existingModel, incomingModel) {
 	const existing = cloneModel(existingModel);
 	const incoming = cloneModel(incomingModel);
@@ -342,8 +1090,8 @@ function prioritizeProviders(providers, prioritizedProviders) {
 //#endregion
 //#region src/setup/write.ts
 async function writeSetupConfig(filePath, config) {
-	await mkdir(dirname(filePath), { recursive: true });
+	await mkdir(dirname$1(filePath), { recursive: true });
 	await writeFile(filePath, stringifySetupConfigToml(config), "utf8");
 }
 //#endregion
-export { emptySetupConfig, getGlobalSetupConfigPath, getProjectSetupConfigPath, getStatsDir, ignorePatternsAIAgents, ignorePatternsBuildOutputs, ignorePatternsCaches, ignorePatternsCommon, ignorePatternsEslintDefaults, ignorePatternsGenerated, loadAlintConfig, loadSetupConfig, mergeSetupConfigs, parseSetupConfigToml, stringifySetupConfigToml, writeSetupConfig };
+export { createEmptyPluginLockFile, emptySetupConfig, getGlobalSetupConfigPath, getProjectPluginLockPath, getProjectPluginStorePath, getProjectSetupConfigPath, getStatsDir, ignorePatternsAIAgents, ignorePatternsBuildOutputs, ignorePatternsCaches, ignorePatternsCommon, ignorePatternsEslintDefaults, ignorePatternsGenerated, installStaticPlugins, listMissing, listUnresolved, loadAlintConfig, loadPluginLockFile, loadSetupConfig, loadStaticConfig, mergeSetupConfigs, parsePluginLockFile, parsePluginSpecifier, parseSetupConfigToml, parseStaticConfig, stringifySetupConfigToml, toAlintConfig, writePluginLockFile, writeSetupConfig };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@alint-js/config",
   "type": "module",
-  "version": "0.0.18",
+  "version": "0.0.20",
   "exports": {
     ".": {
       "types": "./dist/index.d.mts",
@@ -13,14 +13,24 @@
     "dist"
   ],
   "dependencies": {
+    "@moeru/std": "^0.1.0-beta.18",
+    "@package-json/types": "^0.0.13",
     "c12": "^3.3.4",
+    "es-toolkit": "^1.49.0",
+    "jiti": "^2.7.0",
+    "ofetch": "^1.5.1",
     "pathe": "^2.0.3",
+    "resolve.exports": "2.0.3",
     "smol-toml": "^1.7.0",
+    "tar-stream": "^3.2.0",
+    "valibot": "^1.4.1",
     "xdg-basedir": "^5.1.0",
-    "@alint-js/core": "0.0.18"
+    "@alint-js/core": "0.0.20"
   },
   "devDependencies": {
     "@types/node": "^26.0.1",
+    "@types/tar-stream": "^3.1.4",
+    "h3": "2.0.1-rc.25",
     "tsdown": "^0.22.3",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9"