@isentinel/eslint-config 6.0.0-beta.2 → 6.0.0-beta.21

package/dist/lint-cli.mjs

@@ -0,0 +1,4827 @@
+import { createRequire } from "node:module";
+import process$1 from "node:process";
+import { getPackageInfoSync, isPackageExists } from "local-pkg";
+import yargs from "yargs";
+import "find-up-simple";
+import fs from "node:fs";
+import path from "node:path";
+import "semver";
+import crypto from "node:crypto";
+import concurrently from "concurrently";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import os, { availableParallelism } from "node:os";
+import fileEntryCache from "file-entry-cache";
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+//#region package.json
+var version = "6.0.0-beta.21";
+//#endregion
+//#region src/lint-cli/lib/cli/types.ts
+/**
+* User-facing error. When thrown from the runner the message is printed
+* without a stack trace and the process exits non-zero.
+*/
+var CliError = class extends Error {
+	name = "CliError";
+};
+/**
+* The real TS/JS-family file extensions {@link GLOB_SRC_EXT} encodes (the glob
+* additionally matches non-existent combinations such as `cjsx`). Kept next to
+* the glob so the two are maintained together; consumed by the lint CLI to size
+* its type-aware pass.
+*/
+const GLOB_SRC_EXTENSIONS = [
+	"ts",
+	"tsx",
+	"mts",
+	"cts",
+	"js",
+	"jsx",
+	"mjs",
+	"cjs"
+];
+/**
+* Every file extension the preset lints by default: the TS/JS family
+* ({@link GLOB_SRC_EXTENSIONS} / {@link GLOB_SRC}) plus the other languages the
+* config enables — JSONC ({@link GLOB_ALL_JSON}), YAML ({@link GLOB_YAML}),
+* TOML ({@link GLOB_TOML}), Markdown ({@link GLOB_MARKDOWN}) and Lua
+* ({@link GLOB_LUA}). Each group is bound to its glob so the list stays in step
+* with the patterns.
+*/
+const GLOB_LINTABLE_EXTENSIONS = [
+	...GLOB_SRC_EXTENSIONS,
+	"json",
+	"jsonc",
+	"json5",
+	"yaml",
+	"yml",
+	"toml",
+	"md",
+	"lua"
+];
+//#endregion
+//#region src/guards.ts
+/**
+* Internal runtime type guards. Prefer these over `as` assertions so values
+* crossing untyped boundaries (`JSON.parse`, dynamic `import`, plugin objects)
+* are validated at runtime rather than asserted away.
+*/
+/**
+* Whether a value is a non-null, non-array object usable as a string-keyed
+* record. Narrows `unknown` without an assertion.
+*
+* @param value - The value to test.
+* @returns Whether the value is a plain object.
+*/
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Whether a value is an array whose every element is a string.
+*
+* @param value - The value to test.
+* @returns Whether the value is a `string` array.
+*/
+function isStringArray(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+createRequire(import.meta.url);
+/**
+* Whether the environment signals a CI run. Treats an unset, empty, `"false"`
+* or `"0"` `CI` value as not-CI, so a deliberately falsy `CI=false` is honoured
+* rather than read as truthy.
+*
+* @param environment - The environment variables to inspect.
+* @returns Whether CI is active.
+*/
+function isCi(environment = process$1.env) {
+	const value = environment["CI"];
+	return value !== void 0 && value !== "" && value !== "false" && value !== "0";
+}
+function isInGitHooksOrLintStaged(environment = process$1.env) {
+	return [
+		environment["GIT_HOOK"],
+		environment["GIT_PARAMS"],
+		environment["VSCODE_GIT_COMMAND"],
+		environment["npm_lifecycle_script"]?.startsWith("lint-staged")
+	].some(Boolean);
+}
+/**
+* Agent probes, mirroring `unjs/std-env`'s `src/agents.ts` (@50dc652) so the
+* two stay diffable. An entry is either an environment variable that is truthy
+* only inside that agent, or a matcher for the agents that hide in a shared
+* variable. Entries run in std-env's order, one agent per line group.
+*
+* `CLAUDE_CODE_ENTRYPOINT` has no std-env counterpart; it predates this port
+* and stays for the Claude Code versions that set only it.
+*/
+const AGENT_CHECKS = [
+	"CLAUDECODE",
+	"CLAUDE_CODE",
+	"CLAUDE_CODE_ENTRYPOINT",
+	"REPL_ID",
+	"GEMINI_CLI",
+	"CODEX_SANDBOX",
+	"CODEX_THREAD_ID",
+	"OPENCODE",
+	environmentMatcher("PATH", /\.pi[/\\]agent/),
+	"AUGMENT_AGENT",
+	"GOOSE_PROVIDER",
+	"JUNIE_DATA",
+	"JUNIE_SHIM_PATH",
+	environmentMatcher("EDITOR", /devin/),
+	"CURSOR_AGENT",
+	environmentMatcher("TERM_PROGRAM", /kiro/, { noTty: true })
+];
+/**
+* Whether the process runs inside an AI coding agent session.
+*
+* `AI_AGENT` forces detection on, matching std-env's explicit override. Git
+* hook and lint-staged runs are excluded even under an agent: those are
+* human-initiated commits whose output a person reads.
+*
+* Not a pure function of `environment` — the kiro check also consults
+* `process.stdout.isTTY` (see {@link environmentMatcher}).
+*
+* @param environment - The environment variables to inspect.
+* @returns Whether an agent session was detected.
+*/
+function isInAgentSession(environment = process$1.env) {
+	if (isInGitHooksOrLintStaged(environment)) return false;
+	if (environment["AI_AGENT"] !== void 0 && environment["AI_AGENT"] !== "") return true;
+	return AGENT_CHECKS.some((check) => {
+		return typeof check === "string" ? Boolean(environment[check]) : check(environment);
+	});
+}
+/**
+* Whether autofixes that rewrite code an agent just wrote should be withheld.
+*
+* Opt-in, and deliberately not tied to {@link isInAgentSession}: merely being
+* an agent is no reason to lint differently — an agent that runs the linter
+* wants the same fixes a human would get. The case this exists for is the
+* wrapper that fixes without anyone reading the diff (an edit hook, a
+* fix-on-save daemon), which knows it is that and can say so.
+*
+* @param environment - The environment variables to inspect.
+* @returns Whether fix suppression was requested.
+*/
+function isAgentAutofixDisabled(environment = process$1.env) {
+	const value = environment["ESLINT_AGENT_NO_AUTOFIX"];
+	return value === "true" || value === "1";
+}
+function isInEditorEnvironment(environment = process$1.env) {
+	const explicitValue = environment["ESLINT_IN_EDITOR"];
+	if (explicitValue !== void 0) return explicitValue === "true" || explicitValue === "1";
+	if (isCi(environment)) return false;
+	if (isInGitHooksOrLintStaged(environment)) return false;
+	return [
+		environment["VSCODE_PID"],
+		environment["VSCODE_CWD"],
+		environment["JETBRAINS_IDE"],
+		environment["VIM"],
+		environment["NVIM"]
+	].some(Boolean);
+}
+/**
+* Build a probe that regex-tests one environment variable, for the agents that
+* announce themselves inside a variable a human also sets.
+*
+* `noTty` marks a variable an interactive user shares with the agent (kiro's
+* `TERM_PROGRAM` is set in its terminal too): an attached stdout TTY means a
+* person is watching, so the probe declines.
+*
+* @param name - The environment variable to test.
+* @param pattern - The pattern the value must match.
+* @param options - Probe options.
+* @param options.noTty - Whether an attached stdout TTY disqualifies the match.
+* @returns The probe.
+*/
+function environmentMatcher(name, pattern, { noTty = false } = {}) {
+	return (environment) => {
+		if (noTty && process$1.stdout.isTTY) return false;
+		const value = environment[name];
+		return value !== void 0 && pattern.test(value);
+	};
+}
+//#endregion
+//#region src/lint-cli/lib/cli/parse.ts
+/**
+* Parse an integer that must be at least `min`, returning `undefined` for any
+* value that is missing, non-numeric, fractional or below the bound. The three
+* env-derived numeric knobs (concurrency, files-per-worker, affected-bust
+* threshold) share this parse and keep their differing failure actions
+* (undefined vs throw vs default) at their call sites.
+*
+* @param value - The raw string to parse (usually an environment variable).
+* @param min - The inclusive lower bound the parsed integer must meet.
+* @returns The parsed integer, or `undefined` when it is absent or invalid.
+*/
+function parseBoundedInteger(value, min) {
+	if (value === void 0) return;
+	const parsed = Number(value.trim());
+	if (!Number.isInteger(parsed) || parsed < min) return;
+	return parsed;
+}
+//#endregion
+//#region src/lint-cli/lib/cli/split-args.ts
+/**
+* Split a raw argument string into tokens, honouring single and double quotes
+* so values such as `--rule "no-console: error"` survive as one argument.
+*
+* @param input - The raw argument string to split.
+* @returns The parsed argument tokens.
+*/
+function splitArgs(input) {
+	const tokens = [];
+	let current = "";
+	let quote;
+	let hasToken = false;
+	for (const char of input) {
+		if (quote !== void 0) {
+			if (char === quote) quote = void 0;
+			else current += char;
+			continue;
+		}
+		if (char === "\"" || char === "'") {
+			quote = char;
+			hasToken = true;
+			continue;
+		}
+		if (char === " " || char === "	" || char === "\n") {
+			if (hasToken) {
+				tokens.push(current);
+				current = "";
+				hasToken = false;
+			}
+			continue;
+		}
+		current += char;
+		hasToken = true;
+	}
+	if (hasToken) tokens.push(current);
+	return tokens;
+}
+//#endregion
+//#region src/lint-cli/lib/cli/options.ts
+/**
+* Parse and validate an `isentinel-lint` argv slice (without the node/bin
+* prefix). Throws {@link CliError} on any invalid combination.
+*
+* `--agents` is tri-state: absent it follows {@link isInAgentSession}, so an
+* agent gets agent-shaped output without passing the flag and `--no-agents`
+* forces it back off.
+*
+* @param argv - The argument slice to parse.
+* @param environment - The process environment (defaults to `process.env`).
+* @returns The parsed and validated options.
+*/
+function parseArguments(argv, environment = process$1.env) {
+	const separator = argv.indexOf("--");
+	const head = separator === -1 ? argv : argv.slice(0, separator);
+	const tail = separator === -1 ? [] : argv.slice(separator);
+	const eslintExtract = extractValueOption(head, "eslint-args");
+	const oxlintExtract = extractValueOption(eslintExtract.rest, "oxlint-args");
+	const parsed = yargs([...oxlintExtract.rest, ...tail]).scriptName("isentinel-lint").parserConfiguration({
+		"boolean-negation": true,
+		"populate--": true
+	}).option("eslint", {
+		description: "Run only ESLint.",
+		type: "boolean"
+	}).option("oxlint", {
+		description: "Run only oxlint.",
+		type: "boolean"
+	}).option("fix", {
+		description: "Apply fixes (oxlint then ESLint).",
+		type: "boolean"
+	}).option("agents", {
+		description: "Agent-friendly output (default: on in an agent session).",
+		type: "boolean"
+	}).option("print", {
+		description: "Print the composed commands.",
+		type: "boolean"
+	}).option("cache", {
+		default: true,
+		description: "Use ESLint's on-disk cache.",
+		type: "boolean"
+	}).option("oxlint-type-aware", {
+		default: true,
+		description: "Pass --type-aware to oxlint.",
+		type: "boolean"
+	}).option("type-aware", {
+		choices: [
+			"off",
+			"only",
+			"full"
+		],
+		description: "ESLint type-aware mode.",
+		type: "string"
+	}).option("concurrency", {
+		description: "ESLint concurrency override (<n> or off).",
+		type: "string"
+	}).conflicts("eslint", "oxlint").strictOptions().exitProcess(false).fail((message, error) => {
+		throw new CliError(message ?? error?.message ?? "Invalid arguments.");
+	}).parseSync();
+	const eslintOnly = parsed.eslint === true;
+	const oxlintOnly = parsed.oxlint === true;
+	const { typeAware } = parsed;
+	const fix = parsed.fix === true;
+	if (fix && typeAware !== void 0) throw new CliError("Cannot combine --fix with --type-aware; --fix always uses the full config.");
+	const eslintArgs = eslintExtract.value !== void 0 ? splitArgs(eslintExtract.value) : [];
+	const oxlintArgs = oxlintExtract.value !== void 0 ? splitArgs(oxlintExtract.value) : [];
+	const rawPassthrough = parsed["--"];
+	const passthrough = Array.isArray(rawPassthrough) ? rawPassthrough.map(String) : [];
+	if (passthrough.length > 0) {
+		if (eslintOnly === oxlintOnly) throw new CliError("`--` passthrough requires a single tool; use it with --eslint or --oxlint.");
+		if (eslintOnly) eslintArgs.push(...passthrough);
+		else oxlintArgs.push(...passthrough);
+	}
+	const paths = parsed._.map(String).filter((value) => value.length > 0);
+	return {
+		agents: parsed.agents ?? isInAgentSession(environment),
+		cache: parsed.cache,
+		concurrency: parseConcurrency(parsed.concurrency),
+		eslint: eslintOnly,
+		eslintArgs,
+		fix,
+		oxlint: oxlintOnly,
+		oxlintArgs,
+		oxlintTypeAware: parsed.oxlintTypeAware,
+		paths: paths.length > 0 ? paths : ["."],
+		print: parsed.print === true,
+		typeAware
+	};
+}
+/**
+* Pull a single `--name <value>` / `--name=<value>` option out of an argv
+* slice. Done before yargs because yargs refuses dash-prefixed values (for
+* example `--eslint-args "--max-warnings 0"`).
+*
+* @param argv - The argument slice to scan.
+* @param name - The option name (without leading dashes).
+* @returns The extracted value and the remaining arguments.
+*/
+function extractValueOption(argv, name) {
+	const flag = `--${name}`;
+	const inline = `${flag}=`;
+	const rest = [];
+	let value;
+	for (let index = 0; index < argv.length; index += 1) {
+		const token = argv[index];
+		if (token === void 0) continue;
+		if (token === flag) {
+			const next = argv[index + 1];
+			if (next === void 0) throw new CliError(`Option ${flag} requires a value.`);
+			value = next;
+			index += 1;
+			continue;
+		}
+		if (token.startsWith(inline)) {
+			value = token.slice(inline.length);
+			continue;
+		}
+		rest.push(token);
+	}
+	return {
+		rest,
+		value
+	};
+}
+function parseConcurrency(value) {
+	if (value === void 0) return;
+	if (value === "off") return "off";
+	const parsed = parseBoundedInteger(value, 1);
+	if (parsed === void 0) throw new CliError(`Invalid --concurrency "${value}"; expected a positive integer or "off".`);
+	return parsed;
+}
+/**
+* Environment variable a consumer sets to fold its own config branches into the
+* cache key. The env-derived key only sees the branches this preset owns, so a
+* consumer whose `eslint.config.*` varies on anything else — its own
+* `isInAgentSession()` check, a feature flag, an explicit `isAgent` /
+* `isInEditor` / `defaultSeverity` option — must name that branch here or its
+* variants will keep sharing (and overwriting) one cache.
+*/
+const CACHE_KEY_OVERRIDE = "ISENTINEL_LINT_CACHE_KEY";
+/**
+* Resolve the cache-variant key for this run. Every input that makes the preset
+* resolve a *different* ESLint config gets its own key, and therefore its own
+* cache file and its own per-cache state.
+*
+* This exists because ESLint stores a `hashOfConfig` per cache entry: two runs
+* whose resolved configs differ by even one rule severity invalidate each
+* other's entries wholesale when they share a cache file. An agent run and a
+* human run alternating against one cache re-lint the whole project in both
+* directions, forever. Splitting the file by variant means nothing is
+* invalidated — the variants simply stop overwriting each other.
+*
+* The key is derived from the environment rather than from the resolved config
+* because hashing the real config costs a full `eslint --print-config`
+* (~4.6s/run), and the key stored in an existing cache describes the *previous*
+* run, which cannot predict this one.
+*
+* @param environment - The process environment to derive the key from.
+* @returns An 8-character hex key identifying the config variant.
+*/
+function resolveCacheKey(environment) {
+	const parts = [
+		isInAgentSession(environment),
+		isAgentAutofixDisabled(environment),
+		isInEditorEnvironment(environment),
+		isCi(environment),
+		environment[CACHE_KEY_OVERRIDE] ?? ""
+	];
+	return crypto.createHash("sha256").update(parts.join("|")).digest("hex").slice(0, 8);
+}
+/**
+* Describe a run from the process facts it starts with.
+*
+* @param cwd - The working directory.
+* @param environment - The process environment.
+* @param mutate - Whether the run may mutate (false for `--print`).
+* @returns The run context every stage is threaded.
+*/
+function resolveRunContext(cwd, environment, mutate) {
+	return {
+		key: resolveCacheKey(environment),
+		ci: isCi(environment),
+		cwd,
+		environment,
+		mutate
+	};
+}
+//#endregion
+//#region src/lint-cli/lib/exec/resolve.ts
+/** Memoised {@link resolveLocalBin} results, keyed by `cwd\0name`. */
+const localBinCache = /* @__PURE__ */ new Map();
+/**
+* Resolve the JavaScript entry of a locally installed CLI (eslint / oxlint)
+* from the consumer's `node_modules`, walking up from `cwd`. Returning the JS
+* file lets the caller spawn it with `process.execPath` and no shell, avoiding
+* Windows `.cmd`/`.ps1` quoting hazards. Memoised so the two ESLint passes
+* resolve the same bin once.
+*
+* @param name - The package name to resolve (for example `eslint`).
+* @param cwd - The directory to resolve from.
+* @returns The absolute path to the package's JavaScript entry.
+*/
+function resolveLocalBin(name, cwd) {
+	const cacheKey = `${cwd}\0${name}`;
+	const cached = localBinCache.get(cacheKey);
+	if (cached !== void 0) return cached;
+	const info = getPackageInfoSync(name, { paths: [cwd] });
+	if (info === void 0) throw new CliError(`Could not find "${name}". Install it in this project to run isentinel-lint.`);
+	const { bin } = info.packageJson;
+	const relative = typeof bin === "string" ? bin : bin?.[name];
+	if (relative === void 0) throw new CliError(`Package "${name}" does not declare a "${name}" bin entry.`);
+	const resolved = path.resolve(info.rootPath, relative);
+	localBinCache.set(cacheKey, resolved);
+	return resolved;
+}
+/**
+* Resolve the agent-friendly ESLint formatter shipped alongside this entry
+* (built from `src/formatter-agents.ts` to `formatter-agents.mjs`). Resolved
+* lazily so it is only touched when `--agents` is used.
+*
+* Meaningful only in the bundled layout, where every entry is flattened into
+* `dist/` and this resolves to `dist/formatter-agents.mjs`. Run from source
+* there is no sibling `.mjs` at all, so the path names a file that does not
+* exist — `--agents` is a shipped-package feature and has never worked from a
+* source checkout. Unlike {@link resolveIgnoredHelper} there is no source
+* fallback, because ESLint would have to load the `.ts` formatter itself.
+*
+* @returns The absolute path to the agent ESLint formatter.
+*/
+function resolveAgentsFormatter() {
+	return fileURLToPath(new URL("./formatter-agents.mjs", import.meta.url));
+}
+/**
+* Resolve the ignored-files helper shipped alongside this entry (built from
+* `src/lint-cli/ignored-child.ts` to `lint-ignored.mjs`).
+*
+* Unlike {@link resolveAgentsFormatter} this falls back to the TypeScript
+* source, because the runner spawns it itself and the fixture tests run from
+* `src` where no bundle exists. That fallback path is relative to *this
+* file's* source location (`lib/exec/`), while the built branch resolves
+* against a flat `dist/` — which is why only the former carries `../../`. The
+* fallback means the tests never exercise the shipped path — a broken or
+* unshipped `dist` entry degrades the runner to "no ignore filtering" rather
+* than failing.
+*
+* @returns The absolute path to the helper module.
+*/
+function resolveIgnoredHelper() {
+	const built = fileURLToPath(new URL("./lint-ignored.mjs", import.meta.url));
+	return fs.existsSync(built) ? built : fileURLToPath(new URL("../../ignored-child.ts", import.meta.url));
+}
+//#endregion
+//#region src/lint-cli/lib/exec/shell.ts
+const SAFE_TOKEN = /^[\w@+=:,./-]+$/;
+/**
+* Render a command as a shell-equivalent line (env prefix + logical binary +
+* arguments) for `--print`. Uses POSIX quoting for stable, cross-platform
+* output.
+*
+* @param command - The child command to render.
+* @returns The shell-equivalent command line.
+*/
+function formatCommandLine(command) {
+	const environmentPrefix = Object.entries(command.env).flatMap(([key, value]) => value === void 0 ? [] : [`${key}=${quotePosix(value)}`]).join(" ");
+	const body = [command.bin, ...command.args].map(quotePosix).join(" ");
+	return environmentPrefix.length > 0 ? `${environmentPrefix} ${body}` : body;
+}
+/**
+* Build the command string concurrently runs through a shell. The tool is
+* launched via `node <binJs>` so no `.cmd`/`.ps1` shim quoting is involved.
+*
+* @param nodePath - Absolute path to the Node executable.
+* @param binJsPath - Absolute path to the tool's JavaScript entry.
+* @param args - The tool arguments.
+* @param platform - The platform whose shell quoting rules to apply.
+* @returns The shell command string.
+*/
+function buildShellCommand(nodePath, binJsPath, args, platform) {
+	const tokens = [
+		nodePath,
+		binJsPath,
+		...args
+	];
+	if (platform === "win32") {
+		const offending = tokens.find((token) => token.includes("%"));
+		if (offending !== void 0) throw new CliError(`Cannot safely pass "${offending}" to cmd.exe: "%" triggers environment-variable expansion even inside quotes. Remove it, or run the tool directly.`);
+	}
+	const quote = platform === "win32" ? quoteWindows : quotePosix;
+	return tokens.map(quote).join(" ");
+}
+function quotePosix(token) {
+	if (token.length > 0 && SAFE_TOKEN.test(token)) return token;
+	return `'${token.replaceAll("'", "'\\''")}'`;
+}
+function quoteWindows(token) {
+	if (token.length > 0 && SAFE_TOKEN.test(token)) return token;
+	let escaped = "";
+	let slashes = 0;
+	for (const char of token) {
+		if (char === "\\") {
+			slashes += 1;
+			escaped += char;
+			continue;
+		}
+		escaped += char === "\"" ? `${"\\".repeat(slashes)}\\"` : char;
+		slashes = 0;
+	}
+	return `"${escaped}${"\\".repeat(slashes)}"`;
+}
+//#endregion
+//#region src/lint-cli/lib/exec/execute.ts
+/** Prefix colour per child label for `concurrently`; kept visually distinct. */
+const PREFIX_COLOR = {
+	eslint: "blue",
+	fast: "blue",
+	oxc: "magenta",
+	typed: "cyan"
+};
+/**
+* Run the composed children and aggregate their exit codes.
+*
+* Sequential when the caller asks for it — `--fix` must not have two children
+* writing the same files at once, and a lone child gains nothing from the
+* concurrently harness. Otherwise every child runs at once. Either way all of
+* them run to completion: an ordinary lint failure in one no longer kills its
+* siblings, so the user keeps every result. The returned code is non-zero when
+* any child exited non-zero.
+*
+* @param commands - The child commands to run.
+* @param cwd - The working directory.
+* @param sequential - Whether to run the children one at a time.
+* @returns The aggregated exit code.
+*/
+async function execute(commands, cwd, sequential) {
+	return sequential ? runSequential(commands, cwd) : runConcurrent(commands, cwd);
+}
+/**
+* Run every command concurrently to completion and aggregate their exit codes.
+* Unlike the previous `killOthersOn: ["failure"]` behaviour, an ordinary lint
+* failure in one child no longer kills its siblings — each runs to the end so
+* the user keeps every result. The returned code is non-zero when any child
+* exited non-zero.
+*
+* @param commands - The child commands to run.
+* @param cwd - The working directory.
+* @returns The aggregated exit code.
+*/
+async function runConcurrent(commands, cwd) {
+	const { result } = concurrently(commands.map((command) => {
+		return {
+			name: command.label,
+			command: buildShellCommand(process$1.execPath, resolveLocalBin(command.bin, cwd), command.args, process$1.platform),
+			env: command.env,
+			prefixColor: PREFIX_COLOR[command.label]
+		};
+	}), {
+		cwd,
+		group: true
+	});
+	try {
+		await result;
+		return 0;
+	} catch {
+		return 1;
+	}
+}
+async function spawnChild(command, cwd) {
+	const binJsPath = resolveLocalBin(command.bin, cwd);
+	return new Promise((resolve) => {
+		const child = spawn(process$1.execPath, [binJsPath, ...command.args], {
+			cwd,
+			env: {
+				...process$1.env,
+				...command.env
+			},
+			stdio: "inherit"
+		});
+		child.on("error", () => {
+			resolve(1);
+		});
+		child.on("close", (code) => {
+			resolve(code ?? 1);
+		});
+	});
+}
+async function runSequential(commands, cwd) {
+	let exitCode = 0;
+	for (const command of commands) {
+		const code = await spawnChild(command, cwd);
+		if (code !== 0) exitCode = code;
+	}
+	return exitCode;
+}
+//#endregion
+//#region src/lint-cli/lib/plan/command.ts
+/**
+* Compose the oxlint child command.
+*
+* @param options - The parsed CLI options.
+* @param context - The resolved composition context.
+* @returns The oxlint child command.
+*/
+function composeOxlintCommand(options, context) {
+	const args = [];
+	if (options.agents) args.push("--format", "agent");
+	if (context.oxlintTypeAware) args.push("--type-aware");
+	if (options.fix) args.push("--fix");
+	args.push(...options.oxlintArgs, ...context.paths);
+	return {
+		args,
+		bin: "oxlint",
+		env: {},
+		label: "oxc"
+	};
+}
+/**
+* Compose the ESLint child command.
+*
+* @param options - The parsed CLI options.
+* @param context - The resolved composition context.
+* @returns The ESLint child command.
+*/
+function composeEslintCommand(options, context) {
+	const args = [];
+	if (options.cache) args.push("--cache", "--cache-location", context.cacheLocation);
+	args.push("--no-warn-ignored", "--concurrency", String(context.concurrency));
+	if (options.cache && context.ci) args.push("--cache-strategy", "content");
+	if (options.agents) args.push("--format", context.agentsFormatterPath);
+	if (options.fix) args.push("--fix");
+	args.push(...options.eslintArgs, ...context.paths);
+	return {
+		args,
+		bin: "eslint",
+		env: { ESLINT_TYPE_AWARE: context.typeAwareEnv },
+		label: context.eslintLabel
+	};
+}
+//#endregion
+//#region src/lint-cli/lib/plan/compose.ts
+/** The stderr notice emitted when a lint target resolves outside the cwd. */
+const OUTSIDE_CWD_NOTICE = "isentinel-lint: a lint target resolves outside the working directory; sizing conservatively and not auto-skipping the type-aware pass.\n";
+/**
+* Turn a {@link RunPlan} into child commands. Pure: no I/O and no mutation, so
+* it is safe to run for `--print`.
+*
+* @param runPlan - The planned run.
+* @param options - The parsed CLI options (paths and per-tool args).
+* @returns The composed command plan.
+*/
+function compose(runPlan, options) {
+	const commands = [];
+	const notices = [];
+	if (runPlan.oxlintReason !== void 0) notices.push(runPlan.oxlintReason);
+	if (runPlan.targetsOutsideCwd) notices.push(OUTSIDE_CWD_NOTICE);
+	if (runPlan.oxlint) commands.push(composeOxlintCommand(options, {
+		oxlintTypeAware: runPlan.oxlintTypeAware,
+		paths: runPlan.oxlintPaths
+	}));
+	for (const pass of runPlan.passes) {
+		if (!pass.shouldRun) {
+			if (pass.skipReason !== void 0) notices.push(pass.skipReason);
+			continue;
+		}
+		commands.push(composeEslintCommand(options, {
+			agentsFormatterPath: runPlan.agentsFormatterPath,
+			cacheLocation: pass.cacheFile,
+			ci: runPlan.ci,
+			concurrency: pass.concurrency,
+			eslintLabel: pass.descriptor.label,
+			paths: options.paths,
+			typeAwareEnv: pass.descriptor.typeAwareEnv
+		}));
+	}
+	return {
+		commands,
+		notice: notices.length > 0 ? notices.join("") : void 0
+	};
+}
+//#endregion
+//#region src/lint-cli/lib/state.ts
+/**
+* Directory (relative to the project root) where the CLI keeps its persisted
+* state. Lives under `node_modules/.cache` so it is discarded with the
+* dependency tree and never committed.
+*/
+const CACHE_DIRECTORY = path.join("node_modules", ".cache", "isentinel-lint");
+/**
+* The directory every state file lives in.
+*
+* @param cwd - The consumer project root.
+* @returns The absolute path to the runner's cache directory.
+*/
+function stateDirectory(cwd) {
+	return path.resolve(cwd, CACHE_DIRECTORY);
+}
+/**
+* Resolve one state file inside {@link stateDirectory}.
+*
+* @param cwd - The consumer project root.
+* @param name - The state's base name.
+* @param parts - Further hyphen-joined segments, usually the config-variant key
+*   from `resolveCacheKey`. State that is consumed once (a stored hash, a
+*   drained builder) must carry that key, or the first variant to run absorbs
+*   the change on behalf of all of them.
+* @returns The absolute path to the state file.
+*/
+function statePath(cwd, name, ...parts) {
+	return path.join(stateDirectory(cwd), [name, ...parts].join("-"));
+}
+/**
+* Read a UTF-8 file, or `undefined` when it cannot be read for any reason.
+* Shared by every tolerant read in the CLI: state files, and the config-import
+* closure walk.
+*
+* @param filePath - The file to read.
+* @returns The file's content, or `undefined`.
+*/
+function readFileIfPresent(filePath) {
+	try {
+		return fs.readFileSync(filePath, "utf8");
+	} catch {
+		return;
+	}
+}
+/**
+* Read a state file written by {@link writeState}. Every failure mode — the
+* file is missing, unreadable, malformed, or was written by another
+* {@link STATE_VERSION} — degrades to `undefined`, which every caller treats as
+* "unknown" and recomputes from.
+*
+* @template T - The shape this file's writer stores. Asserted, not checked:
+*   only the schema version is verified, exactly as the per-module casts this
+*   replaced did.
+* @param filePath - The state file, from {@link statePath}.
+* @returns The stored payload, or `undefined`.
+*/
+function readState(filePath) {
+	const raw = readFileIfPresent(filePath);
+	return raw === void 0 ? void 0 : parseState(raw);
+}
+/**
+* Persist a state payload, creating the cache directory as needed.
+*
+* The write is atomic (temp file plus rename), since `plan()` runs concurrently
+* across packages in a parallel per-package lint setup and a torn file would be
+* read back as "unknown" at best.
+*
+* Best-effort — a failed write leaves the state unknown, so the next run
+* recomputes rather than trusting something stale.
+*
+* @param filePath - The state file, from {@link statePath}.
+* @param data - The payload to store.
+*/
+function writeState(filePath, data) {
+	const content = `${JSON.stringify({
+		data,
+		version: 2
+	})}\n`;
+	const temporary = `${filePath}.${process$1.pid}.tmp`;
+	try {
+		fs.mkdirSync(path.dirname(filePath), { recursive: true });
+		fs.writeFileSync(temporary, content);
+		fs.renameSync(temporary, filePath);
+	} catch {
+		try {
+			fs.rmSync(temporary, { force: true });
+		} catch {}
+	}
+}
+/**
+* Compare a value against the stored one and replace it when they differ, the
+* compare-and-swap every hash-drift bust runs: the caller acts on the outcome
+* and never on the stored value itself.
+*
+* The value is consumed by the swap — once stored, every later run reads back
+* `"unchanged"` — which is why hash state is keyed per config variant.
+*
+* A stored value this {@link STATE_VERSION} cannot read counts as `"changed"`,
+* so a CLI upgrade invalidates rather than silently adopts what it finds.
+*
+* @param filePath - The state file, from {@link statePath}.
+* @param value - The value this run computed.
+* @returns How the stored value compared.
+*/
+function swapState(filePath, value) {
+	const raw = readFileIfPresent(filePath);
+	if ((raw === void 0 ? void 0 : parseState(raw)) === value) return "unchanged";
+	writeState(filePath, value);
+	return raw === void 0 ? "first" : "changed";
+}
+/**
+* Refresh a state file's mtime without rewriting it, so a reader comparing that
+* mtime against another file's still sees the state as fresh. Best-effort: a
+* missing file simply stays missing.
+*
+* @param filePath - The state file, from {@link statePath}.
+*/
+function touchState(filePath) {
+	try {
+		const now = Date.now() / 1e3;
+		fs.utimesSync(filePath, now, now);
+	} catch {}
+}
+/**
+* Parse one state file's content, or `undefined` when it is malformed or
+* carries another {@link STATE_VERSION}.
+*
+* @template T - The shape this file's writer stores (asserted, not checked).
+* @param raw - The file's content.
+* @returns The stored payload, or `undefined`.
+*/
+function parseState(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null) return;
+	const envelope = parsed;
+	return envelope.version === 2 ? envelope.data : void 0;
+}
+/**
+* Base name of every ESLint cache file the runner manages. Each real file adds
+* a pass suffix and a config-variant key (see {@link cacheFileFor}), so this
+* doubles as the prefix the whole-cache sweep matches on.
+*/
+const CACHE_FILE_PREFIX = ".eslintcache";
+/** ESLint cache base name used when no type-aware mode is selected. */
+const CACHE_FILE_DEFAULT = CACHE_FILE_PREFIX;
+/** ESLint cache base name used for `--type-aware=off` (syntactic-only) runs. */
+const CACHE_FILE_FAST = `${CACHE_FILE_PREFIX}-fast`;
+/** ESLint cache base name used for `--type-aware=only` runs. */
+const CACHE_FILE_TYPE_AWARE = `${CACHE_FILE_PREFIX}-typeaware`;
+/** Every ESLint cache base name the runner manages. */
+const ALL_CACHE_FILES = [
+	CACHE_FILE_DEFAULT,
+	CACHE_FILE_FAST,
+	CACHE_FILE_TYPE_AWARE
+];
+/**
+* Suffix a cache base name with the run's config-variant key. Two runs whose
+* resolved ESLint configs differ get different keys and therefore different
+* files, so neither can invalidate the other's entries via ESLint's per-entry
+* `hashOfConfig`.
+*
+* @param baseName - The pass's cache base name (see {@link ALL_CACHE_FILES}).
+* @param key - The variant key from `resolveCacheKey`.
+* @returns The keyed cache file name, relative to the working directory.
+*/
+function cacheFileFor(baseName, key) {
+	return `${baseName}-${key}`;
+}
+/**
+* Resolve the affected-set bust threshold, honouring the
+* `LINT_AFFECTED_BUST_THRESHOLD` override.
+*
+* @param environment - The environment variables to read the override from.
+* @returns The resolved threshold.
+*/
+function resolveAffectedBustThreshold(environment) {
+	return parseBoundedInteger(environment["LINT_AFFECTED_BUST_THRESHOLD"], 0) ?? 1e3;
+}
+//#endregion
+//#region src/lint-cli/lib/cache/bust.ts
+/**
+* The resolved ESLint config's content changed.
+*
+* Deletes all three caches, the fast (syntactic-only) one included: a config
+* change such as a rule-severity flip alters a syntactic lint too. This is why
+* it is evaluated before {@link PACKAGE_RESOLUTION}, which spares that cache.
+*/
+const CONFIG_DRIFT = {
+	name: "config-hash",
+	caches: ALL_CACHE_FILES
+};
+/**
+* The consumer's `package.json` resolution surface changed.
+*
+* Deletes only the two type-aware caches (`.eslintcache-typeaware-<key>` and
+* `.eslintcache-<key>`), leaving `.eslintcache-fast-<key>` intact: a resolution
+* change alters which types an importer sees, and a syntactic lint does not
+* look at types.
+*/
+const PACKAGE_RESOLUTION = {
+	name: "package-json-hash",
+	caches: [CACHE_FILE_DEFAULT, CACHE_FILE_TYPE_AWARE]
+};
+/**
+* Delete this variant's affected caches when the bust's hash changed since the
+* last run. The first run only stores the hash.
+*
+* The state file is keyed per config variant because the stored hash is
+* consumed once: after the first run that sees a new hash, every later run
+* finds `stored === hash` and returns early. A shared state file would let
+* whichever variant ran first absorb the change on behalf of all of them,
+* leaving every cache it did not delete permanently stale with respect to it.
+* Only this variant's cache files are deleted, for the same reason.
+*
+* Takes the hash rather than computing it, so `undefined` unambiguously means
+* "could not be computed" (no config entry point, no resolvable TypeScript, no
+* readable `package.json`) and the check degrades to a no-op — and so the
+* planner can share one config hash between this bust and the ignore-set memo.
+*
+* @param run - The run context.
+* @param bust - Which hash this is, and what it invalidates.
+* @param hash - The hash this run computed, or `undefined` when unavailable.
+* @returns The bust outcome.
+*/
+function applyHashBust(run, bust, hash) {
+	if (hash === void 0) return {
+		busted: false,
+		firstRun: false
+	};
+	const swap = swapState(statePath(run.cwd, bust.name, run.key), hash);
+	if (swap !== "changed") return {
+		busted: false,
+		firstRun: swap === "first"
+	};
+	for (const base of bust.caches) fs.rmSync(path.resolve(run.cwd, cacheFileFor(base, run.key)), { force: true });
+	return {
+		busted: true,
+		firstRun: false
+	};
+}
+//#endregion
+//#region src/lint-cli/lib/typescript/load.ts
+/**
+* Resolve the consumer's `typescript` and load it lazily. Anchored at `cwd` so
+* resolution walks the consumer's `node_modules` (typescript is a peer of
+* typescript-eslint, never a dependency of this package). Using `createRequire`
+* rather than a static import keeps typescript out of the bundle and off the
+* load path unless a caller actually needs it.
+*
+* @param cwd - The consumer project root to resolve from.
+* @returns The TypeScript module, or `undefined` when it cannot be resolved.
+*/
+function loadTypescript(cwd) {
+	try {
+		const required = createRequire(path.join(cwd, "__isentinel-lint__.js"))("typescript");
+		return isTypeScriptModule(required) ? required : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Whether a required module is the TypeScript compiler API this module returns.
+*
+* @param value - The required module's exports.
+* @returns Whether the exports expose the TypeScript compiler API.
+*/
+function isTypeScriptModule(value) {
+	return isRecord(value) && typeof value["createProgram"] === "function";
+}
+//#endregion
+//#region src/lint-cli/lib/cache/config-hash.ts
+/**
+* Upper bound on the number of files walked from the config entry points. A
+* flat-config import graph is a handful of local modules; the cap only guards
+* against a pathological graph and never trips in practice.
+*/
+const MAX_CLOSURE_FILES = 500;
+/**
+* Hash the content of `eslint.config.*` and its transitive local import
+* closure. This models the input ESLint keys its per-entry `hashOfConfig` on:
+* ESLint re-lints every file when the resolved config changes, but the runner's
+* dirty count only sees the config file (via `CACHE_BUST_PATTERNS`), not the
+* modules it imports. Hashing content (not mtimes) means a checkout or a
+* save-without-change never busts.
+*
+* The closure is discovered with the consumer's own TypeScript: a lexer
+* extracts each specifier and `resolveModuleName` resolves it (honouring
+* tsconfig `paths`/`baseUrl`, extension-less and `index` lookups, and
+* re-export forwarding). External (`node_modules`) imports are dropped — a
+* dependency swap is already covered by the lockfile bust and `package-hash`.
+* Returns `undefined` when `typescript` is unresolvable or no config entry
+* point exists, so the caller treats the check as a no-op.
+*
+* @param cwd - The consumer project root.
+* @param configFiles - The flat-config entry points (see `RepoFiles.configFiles`).
+* @returns The hex digest, or `undefined` when unavailable.
+*/
+function computeConfigHash(cwd, configFiles) {
+	if (configFiles.length === 0) return;
+	const ts = loadTypescript(cwd);
+	if (ts === void 0) return;
+	const closure = discoverConfigClosure(ts, cwd, configFiles);
+	if (closure.length === 0) return;
+	const hash = crypto.createHash("sha256");
+	for (const { content, file } of closure) {
+		hash.update(file);
+		hash.update("\0");
+		hash.update(content);
+		hash.update("\0");
+	}
+	return hash.digest("hex");
+}
+/**
+* Add every not-yet-seen target to the visited set and the work queue.
+*
+* @param targets - The candidate import targets.
+* @param visited - The set of already-seen paths (mutated).
+* @param queue - The BFS work queue (mutated).
+*/
+function enqueueUnvisited(targets, visited, queue) {
+	for (const target of targets) {
+		if (visited.has(target)) continue;
+		visited.add(target);
+		queue.push(target);
+	}
+}
+/**
+* Resolve every in-project import found in one file's already-read content.
+* `node_modules` results and unresolvable specifiers are dropped, so a
+* dependency swap (covered by the lockfile bust) never enters the closure.
+*
+* @param resolver - The shared TypeScript resolution state.
+* @param file - The absolute path of the importing file.
+* @param content - The importing file's content.
+* @returns The absolute, normalized in-project import targets.
+*/
+function importsOf({ cache, options, ts }, file, content) {
+	const targets = [];
+	const nodeModules = `${path.sep}node_modules${path.sep}`;
+	for (const reference of ts.preProcessFile(content, true, true).importedFiles) {
+		const resolved = ts.resolveModuleName(reference.fileName, file, options, ts.sys, cache).resolvedModule;
+		if (resolved === void 0 || resolved.isExternalLibraryImport === true) continue;
+		const target = path.normalize(resolved.resolvedFileName);
+		if (!target.includes(nodeModules)) targets.push(target);
+	}
+	return targets;
+}
+/**
+* Resolve the consumer's compiler options from the nearest `tsconfig.json` so
+* `resolveModuleName` honours `paths`/`baseUrl`. Falls back to empty options
+* (relative and `node_modules` resolution still work) when none is found or it
+* fails to parse.
+*
+* @param ts - The consumer's resolved TypeScript module.
+* @param cwd - The consumer project root.
+* @returns The parsed compiler options.
+*/
+function resolveCompilerOptions(ts, cwd) {
+	const configPath = ts.findConfigFile(cwd, (file) => ts.sys.fileExists(file), "tsconfig.json");
+	if (configPath === void 0) return {};
+	const read = ts.readConfigFile(configPath, (file) => ts.sys.readFile(file));
+	if (read.error !== void 0 || read.config === void 0) return {};
+	const host = {
+		fileExists: (file) => ts.sys.fileExists(file),
+		readDirectory: () => [],
+		readFile: (file) => ts.sys.readFile(file),
+		useCaseSensitiveFileNames: ts.sys.useCaseSensitiveFileNames
+	};
+	return ts.parseJsonConfigFileContent(read.config, host, path.dirname(configPath)).options;
+}
+/**
+* Walk the local import closure of the config entry points. BFS with a
+* normalized-path visited set; the roots are included so their own content
+* contributes to the hash. Each file is read exactly once — the content feeds
+* both import extraction and the hash.
+*
+* @param ts - The consumer's resolved TypeScript module.
+* @param cwd - The consumer project root.
+* @param roots - The config entry-point paths to start from.
+* @returns The readable closure files (roots included), each with its content.
+*/
+function discoverConfigClosure(ts, cwd, roots) {
+	const options = resolveCompilerOptions(ts, cwd);
+	const resolver = {
+		cache: ts.createModuleResolutionCache(cwd, (fileName) => fileName, options),
+		options,
+		ts
+	};
+	const visited = /* @__PURE__ */ new Set();
+	const queue = [];
+	enqueueUnvisited(roots.map((root) => path.normalize(root)), visited, queue);
+	const files = [];
+	while (queue.length > 0 && visited.size <= MAX_CLOSURE_FILES) {
+		const file = queue.shift();
+		if (file === void 0) break;
+		const content = readFileIfPresent(file);
+		if (content === void 0) continue;
+		files.push({
+			content,
+			file
+		});
+		enqueueUnvisited(importsOf(resolver, file, content), visited, queue);
+	}
+	return files;
+}
+//#endregion
+//#region src/lint-cli/lib/paths.ts
+/**
+* Rewrite a path to forward slashes. The shared separator-splitting primitive
+* that both the cache-key `normalizePath` and the file walk build on, so there
+* is a single place that translates OS-native separators to POSIX.
+*
+* @param value - The path to rewrite.
+* @returns The path with every separator as a forward slash.
+*/
+function toPosix(value) {
+	return value.split(path.sep).join("/");
+}
+//#endregion
+//#region src/lint-cli/lib/cache/entries.ts
+/**
+* Compute the newest modification time across the given files. Callers hash the
+* cache-bust set once per run and compare each pass's cache mtime against the
+* result, rather than re-reading every bust file's mtime per pass.
+*
+* @param files - Absolute paths to stat.
+* @returns The newest mtime in milliseconds, or `undefined` when none exist.
+*/
+function maxMtimeMs(files) {
+	let newest;
+	for (const file of files) {
+		const mtime = safeMtimeMs(file);
+		if (mtime !== void 0 && (newest === void 0 || mtime > newest)) newest = mtime;
+	}
+	return newest;
+}
+/**
+* Whether the cache file is older than the newest cache-bust modification. A
+* missing cache file (or no bust files) returns false: the caller already
+* treats an absent cache as "everything is dirty".
+*
+* @param cacheFilePath - The ESLint cache file to compare against.
+* @param newestBustMtimeMs - The newest bust-file mtime (see {@link maxMtimeMs}).
+* @returns Whether the cache is stale.
+*/
+function isCacheStale(cacheFilePath, newestBustMtimeMs) {
+	if (newestBustMtimeMs === void 0) return false;
+	const cacheMtime = safeMtimeMs(cacheFilePath);
+	if (cacheMtime === void 0) return false;
+	return newestBustMtimeMs > cacheMtime;
+}
+/**
+* Delete the individually stale cache files in the working directory.
+*
+* Deliberately per-file rather than all-or-nothing: variants this run did not
+* select still sit on disk, and {@link isCacheStale} reports a missing file as
+* fresh. An all-or-nothing gate over only the selected passes therefore lets an
+* unselected-but-stale variant survive a config edit, then wipes every fresh
+* variant the next time that stale one is selected — the same mutual
+* invalidation the variant split exists to remove, relocated to the config-edit
+* path.
+*
+* @param cwd - The working directory containing the cache files.
+* @param newestBustMtimeMs - The newest bust-file mtime (see {@link maxMtimeMs}).
+* @returns The absolute paths deleted.
+*/
+function sweepStaleCaches(cwd, newestBustMtimeMs) {
+	const removed = [];
+	for (const cacheFilePath of listCacheFiles(cwd)) {
+		if (!isCacheStale(cacheFilePath, newestBustMtimeMs)) continue;
+		removeCacheFile(cacheFilePath);
+		removed.push(cacheFilePath);
+	}
+	return removed;
+}
+/**
+* Normalize a path for cache-key comparison: absolute, forward-slash and
+* lower-cased. TypeScript emits forward-slash paths while ESLint keys the cache
+* with OS-native ones, and Windows paths are case-insensitive — this collapses
+* all of those into a single comparable form.
+*
+* @param filePath - The path to normalize.
+* @returns The canonical key.
+*/
+function normalizePath(filePath) {
+	return toPosix(path.resolve(filePath)).toLowerCase();
+}
+/**
+* Open an ESLint cache for reuse, or `undefined` when the file is missing (the
+* caller then treats every target file as dirty). The returned handle backs
+* both {@link DirtyCache.getUpdatedFiles} and {@link DirtyCache.removeEntries}
+* so a pass parses the cache once instead of twice.
+*
+* @param cacheFilePath - The ESLint cache file to open.
+* @param useChecksum - Compare by content checksum instead of metadata.
+* @returns The loaded cache, or `undefined` when the file does not exist.
+*/
+function openCache(cacheFilePath, useChecksum) {
+	if (!fs.existsSync(cacheFilePath)) return;
+	const cache = fileEntryCache.createFromFile(cacheFilePath, useChecksum);
+	return {
+		getUpdatedFiles: (files) => cache.getUpdatedFiles(files),
+		removeEntries: (files) => removeEntriesFrom(cache, files)
+	};
+}
+function safeMtimeMs(filePath) {
+	try {
+		return fs.statSync(filePath).mtimeMs;
+	} catch {
+		return;
+	}
+}
+/**
+* List every ESLint cache file present in the working directory, matched by
+* prefix rather than by exact name: each pass's cache carries a config-variant
+* key suffix, so the set on disk is open-ended and an exact-name list would
+* miss (and therefore leak) every variant but the current run's.
+*
+* @param cwd - The working directory containing the cache files.
+* @returns Absolute paths to the cache files found.
+*/
+function listCacheFiles(cwd) {
+	let entries;
+	try {
+		entries = fs.readdirSync(cwd);
+	} catch {
+		return [];
+	}
+	return entries.filter((entry) => entry.startsWith(CACHE_FILE_PREFIX)).map((entry) => path.resolve(cwd, entry));
+}
+function removeCacheFile(cacheFilePath) {
+	try {
+		fs.rmSync(cacheFilePath, { force: true });
+	} catch {}
+}
+function removeEntriesFrom(cache, files) {
+	const keyByNormalized = /* @__PURE__ */ new Map();
+	for (const key of cache.cache.keys()) keyByNormalized.set(normalizePath(key), key);
+	let removed = 0;
+	for (const file of files) {
+		const key = keyByNormalized.get(normalizePath(file));
+		if (key !== void 0) {
+			cache.removeEntry(key);
+			removed += 1;
+		}
+	}
+	if (removed > 0) cache.cache.save(true);
+	return removed;
+}
+//#endregion
+//#region src/lint-cli/lib/files/workspace.ts
+/**
+* Markers that identify a repository or pnpm-workspace root. `.git` may be a
+* directory (normal clone) or a file (a worktree pointer); `existsSync` accepts
+* both.
+*/
+const WORKSPACE_ROOT_MARKERS = [".git", "pnpm-workspace.yaml"];
+/**
+* Walk up from `cwd` to the nearest directory that looks like a repository or
+* pnpm-workspace root (contains `.git` or `pnpm-workspace.yaml`). Returns `cwd`
+* unchanged when it is itself the root, or when no marker is found before the
+* filesystem root — in both cases there is no ancestor to fold in.
+*
+* @param cwd - The directory to walk up from.
+* @returns The workspace root, or `cwd` when there is no distinct ancestor root.
+*/
+function findWorkspaceRoot(cwd) {
+	let current = cwd;
+	for (;;) {
+		for (const marker of WORKSPACE_ROOT_MARKERS) if (fs.existsSync(path.join(current, marker))) return current;
+		const parent = path.dirname(current);
+		if (parent === current) return cwd;
+		current = parent;
+	}
+}
+//#endregion
+//#region src/lint-cli/lib/cache/package-hash.ts
+/**
+* Root `package.json` fields whose edits can change the types a consumer's
+* importers see (resolution surface + dependency versions). A change to any of
+* these must invalidate the type-aware caches; unrelated edits (`scripts`,
+* `version`, metadata) must not. `pnpm` (overrides/patchedDependencies) and
+* `optionalDependencies` can silently swap a resolved version too.
+*/
+const RESOLUTION_FIELDS = [
+	"exports",
+	"imports",
+	"main",
+	"module",
+	"types",
+	"typesVersions",
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies",
+	"pnpm"
+];
+/**
+* Hash the resolution-relevant fields of the consumer's `package.json` as
+* sorted, stable JSON. When `cwd` sits in a workspace whose root differs, the
+* root `package.json`'s resolution fields fold into the same digest — a hoisted
+* root dependency bump changes the types a sub-package sees even though its own
+* `package.json` text is untouched. Returns `undefined` when there is no
+* readable/parseable local `package.json` (the caller then treats the check as
+* a no-op).
+*
+* @param cwd - The consumer project root.
+* @returns The hex digest, or `undefined` when unavailable.
+*/
+function computePackageJsonHash(cwd) {
+	const local = resolutionSubset(cwd);
+	if (local === void 0) return;
+	const combined = { local };
+	const root = findWorkspaceRoot(cwd);
+	if (root !== cwd) {
+		const rootSubset = resolutionSubset(root);
+		if (rootSubset !== void 0) combined["root"] = rootSubset;
+	}
+	return crypto.createHash("sha256").update(stableStringify(combined)).digest("hex");
+}
+/**
+* Read a directory's `package.json` and project it down to the resolution
+* fields, or `undefined` when it is absent or unparseable.
+*
+* @param directory - The directory whose `package.json` to read.
+* @returns The resolution-field subset, or `undefined`.
+*/
+function resolutionSubset(directory) {
+	const raw = readFileIfPresent(path.join(directory, "package.json"));
+	if (raw === void 0) return;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (!isRecord(parsed)) return;
+	const subset = {};
+	for (const field of RESOLUTION_FIELDS) if (Object.hasOwn(parsed, field)) subset[field] = parsed[field];
+	return subset;
+}
+/**
+* Serialize a value to JSON with object keys sorted at every depth so the
+* digest is insensitive to key ordering.
+*
+* @param value - The value to stringify.
+* @returns The stable JSON string.
+*/
+function stableStringify(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+	if (isRecord(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+//#endregion
+//#region node_modules/.pnpm/picomatch@4.0.5/node_modules/picomatch/lib/constants.js
+var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const WIN_SLASH = "\\\\/";
+	const WIN_NO_SLASH = `[^${WIN_SLASH}]`;
+	const DEFAULT_MAX_EXTGLOB_RECURSION = 0;
+	/**
+	* Posix glob regex
+	*/
+	const DOT_LITERAL = "\\.";
+	const PLUS_LITERAL = "\\+";
+	const QMARK_LITERAL = "\\?";
+	const SLASH_LITERAL = "\\/";
+	const ONE_CHAR = "(?=.)";
+	const QMARK = "[^/]";
+	const END_ANCHOR = `(?:${SLASH_LITERAL}|$)`;
+	const START_ANCHOR = `(?:^|${SLASH_LITERAL})`;
+	const DOTS_SLASH = `${DOT_LITERAL}{1,2}${END_ANCHOR}`;
+	const POSIX_CHARS = {
+		DOT_LITERAL,
+		PLUS_LITERAL,
+		QMARK_LITERAL,
+		SLASH_LITERAL,
+		ONE_CHAR,
+		QMARK,
+		END_ANCHOR,
+		DOTS_SLASH,
+		NO_DOT: `(?!${DOT_LITERAL})`,
+		NO_DOTS: `(?!${START_ANCHOR}${DOTS_SLASH})`,
+		NO_DOT_SLASH: `(?!${DOT_LITERAL}{0,1}${END_ANCHOR})`,
+		NO_DOTS_SLASH: `(?!${DOTS_SLASH})`,
+		QMARK_NO_DOT: `[^.${SLASH_LITERAL}]`,
+		STAR: `${QMARK}*?`,
+		START_ANCHOR,
+		SEP: "/"
+	};
+	/**
+	* Windows glob regex
+	*/
+	const WINDOWS_CHARS = {
+		...POSIX_CHARS,
+		SLASH_LITERAL: `[${WIN_SLASH}]`,
+		QMARK: WIN_NO_SLASH,
+		STAR: `${WIN_NO_SLASH}*?`,
+		DOTS_SLASH: `${DOT_LITERAL}{1,2}(?:[${WIN_SLASH}]|$)`,
+		NO_DOT: `(?!${DOT_LITERAL})`,
+		NO_DOTS: `(?!(?:^|[${WIN_SLASH}])${DOT_LITERAL}{1,2}(?:[${WIN_SLASH}]|$))`,
+		NO_DOT_SLASH: `(?!${DOT_LITERAL}{0,1}(?:[${WIN_SLASH}]|$))`,
+		NO_DOTS_SLASH: `(?!${DOT_LITERAL}{1,2}(?:[${WIN_SLASH}]|$))`,
+		QMARK_NO_DOT: `[^.${WIN_SLASH}]`,
+		START_ANCHOR: `(?:^|[${WIN_SLASH}])`,
+		END_ANCHOR: `(?:[${WIN_SLASH}]|$)`,
+		SEP: "\\"
+	};
+	module.exports = {
+		DEFAULT_MAX_EXTGLOB_RECURSION,
+		MAX_LENGTH: 1024 * 64,
+		POSIX_REGEX_SOURCE: {
+			__proto__: null,
+			alnum: "a-zA-Z0-9",
+			alpha: "a-zA-Z",
+			ascii: "\\x00-\\x7F",
+			blank: " \\t",
+			cntrl: "\\x00-\\x1F\\x7F",
+			digit: "0-9",
+			graph: "\\x21-\\x7E",
+			lower: "a-z",
+			print: "\\x20-\\x7E ",
+			punct: "\\-!\"#$%&'()\\*+,./:;<=>?@[\\]^_`{|}~",
+			space: " \\t\\r\\n\\v\\f",
+			upper: "A-Z",
+			word: "A-Za-z0-9_",
+			xdigit: "A-Fa-f0-9"
+		},
+		REGEX_BACKSLASH: /\\(?![*+?^${}(|)[\]])/g,
+		REGEX_NON_SPECIAL_CHARS: /^[^@![\].,$*+?^{}()|\\/]+/,
+		REGEX_SPECIAL_CHARS: /[-*+?.^${}(|)[\]]/,
+		REGEX_SPECIAL_CHARS_BACKREF: /(\\?)((\W)(\3*))/g,
+		REGEX_SPECIAL_CHARS_GLOBAL: /([-*+?.^${}(|)[\]])/g,
+		REGEX_REMOVE_BACKSLASH: /(?:\[.*?[^\\]\]|\\(?=.))/g,
+		REPLACEMENTS: {
+			__proto__: null,
+			"***": "*",
+			"**/**": "**",
+			"**/**/**": "**"
+		},
+		CHAR_0: 48,
+		CHAR_9: 57,
+		CHAR_UPPERCASE_A: 65,
+		CHAR_LOWERCASE_A: 97,
+		CHAR_UPPERCASE_Z: 90,
+		CHAR_LOWERCASE_Z: 122,
+		CHAR_LEFT_PARENTHESES: 40,
+		CHAR_RIGHT_PARENTHESES: 41,
+		CHAR_ASTERISK: 42,
+		CHAR_AMPERSAND: 38,
+		CHAR_AT: 64,
+		CHAR_BACKWARD_SLASH: 92,
+		CHAR_CARRIAGE_RETURN: 13,
+		CHAR_CIRCUMFLEX_ACCENT: 94,
+		CHAR_COLON: 58,
+		CHAR_COMMA: 44,
+		CHAR_DOT: 46,
+		CHAR_DOUBLE_QUOTE: 34,
+		CHAR_EQUAL: 61,
+		CHAR_EXCLAMATION_MARK: 33,
+		CHAR_FORM_FEED: 12,
+		CHAR_FORWARD_SLASH: 47,
+		CHAR_GRAVE_ACCENT: 96,
+		CHAR_HASH: 35,
+		CHAR_HYPHEN_MINUS: 45,
+		CHAR_LEFT_ANGLE_BRACKET: 60,
+		CHAR_LEFT_CURLY_BRACE: 123,
+		CHAR_LEFT_SQUARE_BRACKET: 91,
+		CHAR_LINE_FEED: 10,
+		CHAR_NO_BREAK_SPACE: 160,
+		CHAR_PERCENT: 37,
+		CHAR_PLUS: 43,
+		CHAR_QUESTION_MARK: 63,
+		CHAR_RIGHT_ANGLE_BRACKET: 62,
+		CHAR_RIGHT_CURLY_BRACE: 125,
+		CHAR_RIGHT_SQUARE_BRACKET: 93,
+		CHAR_SEMICOLON: 59,
+		CHAR_SINGLE_QUOTE: 39,
+		CHAR_SPACE: 32,
+		CHAR_TAB: 9,
+		CHAR_UNDERSCORE: 95,
+		CHAR_VERTICAL_LINE: 124,
+		CHAR_ZERO_WIDTH_NOBREAK_SPACE: 65279,
+		/**
+		* Create EXTGLOB_CHARS
+		*/
+		extglobChars(chars) {
+			return {
+				"!": {
+					type: "negate",
+					open: "(?:(?!(?:",
+					close: `))${chars.STAR})`
+				},
+				"?": {
+					type: "qmark",
+					open: "(?:",
+					close: ")?"
+				},
+				"+": {
+					type: "plus",
+					open: "(?:",
+					close: ")+"
+				},
+				"*": {
+					type: "star",
+					open: "(?:",
+					close: ")*"
+				},
+				"@": {
+					type: "at",
+					open: "(?:",
+					close: ")"
+				}
+			};
+		},
+		/**
+		* Create GLOB_CHARS
+		*/
+		globChars(win32) {
+			return win32 === true ? WINDOWS_CHARS : POSIX_CHARS;
+		}
+	};
+}));
+//#endregion
+//#region node_modules/.pnpm/picomatch@4.0.5/node_modules/picomatch/lib/utils.js
+var require_utils = /* @__PURE__ */ __commonJSMin(((exports) => {
+	const { REGEX_BACKSLASH, REGEX_REMOVE_BACKSLASH, REGEX_SPECIAL_CHARS, REGEX_SPECIAL_CHARS_GLOBAL } = require_constants();
+	exports.isObject = (val) => val !== null && typeof val === "object" && !Array.isArray(val);
+	exports.hasRegexChars = (str) => REGEX_SPECIAL_CHARS.test(str);
+	exports.isRegexChar = (str) => str.length === 1 && exports.hasRegexChars(str);
+	exports.escapeRegex = (str) => str.replace(REGEX_SPECIAL_CHARS_GLOBAL, "\\$1");
+	exports.toPosixSlashes = (str) => str.replace(REGEX_BACKSLASH, "/");
+	exports.isWindows = () => {
+		if (typeof navigator !== "undefined" && navigator.platform) {
+			const platform = navigator.platform.toLowerCase();
+			return platform === "win32" || platform === "windows";
+		}
+		if (typeof process !== "undefined" && process.platform) return process.platform === "win32";
+		return false;
+	};
+	exports.removeBackslashes = (str) => {
+		return str.replace(REGEX_REMOVE_BACKSLASH, (match) => {
+			return match === "\\" ? "" : match;
+		});
+	};
+	exports.escapeLast = (input, char, lastIdx) => {
+		const idx = input.lastIndexOf(char, lastIdx);
+		if (idx === -1) return input;
+		if (input[idx - 1] === "\\") return exports.escapeLast(input, char, idx - 1);
+		return `${input.slice(0, idx)}\\${input.slice(idx)}`;
+	};
+	exports.removePrefix = (input, state = {}) => {
+		let output = input;
+		if (output.startsWith("./")) {
+			output = output.slice(2);
+			state.prefix = "./";
+		}
+		return output;
+	};
+	exports.wrapOutput = (input, state = {}, options = {}) => {
+		let output = `${options.contains ? "" : "^"}(?:${input})${options.contains ? "" : "$"}`;
+		if (state.negated === true) output = `(?:^(?!${output}).*$)`;
+		return output;
+	};
+	exports.basename = (path, { windows } = {}) => {
+		const segs = path.split(windows ? /[\\/]/ : "/");
+		const last = segs[segs.length - 1];
+		if (last === "") return segs[segs.length - 2];
+		return last;
+	};
+}));
+//#endregion
+//#region node_modules/.pnpm/picomatch@4.0.5/node_modules/picomatch/lib/scan.js
+var require_scan = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const utils = require_utils();
+	const { CHAR_ASTERISK, CHAR_AT, CHAR_BACKWARD_SLASH, CHAR_COMMA, CHAR_DOT, CHAR_EXCLAMATION_MARK, CHAR_FORWARD_SLASH, CHAR_LEFT_CURLY_BRACE, CHAR_LEFT_PARENTHESES, CHAR_LEFT_SQUARE_BRACKET, CHAR_PLUS, CHAR_QUESTION_MARK, CHAR_RIGHT_CURLY_BRACE, CHAR_RIGHT_PARENTHESES, CHAR_RIGHT_SQUARE_BRACKET } = require_constants();
+	const isPathSeparator = (code) => {
+		return code === CHAR_FORWARD_SLASH || code === CHAR_BACKWARD_SLASH;
+	};
+	const depth = (token) => {
+		if (token.isPrefix !== true) token.depth = token.isGlobstar ? Infinity : 1;
+	};
+	/**
+	* Quickly scans a glob pattern and returns an object with a handful of
+	* useful properties, like `isGlob`, `path` (the leading non-glob, if it exists),
+	* `glob` (the actual pattern), `negated` (true if the path starts with `!` but not
+	* with `!(`) and `negatedExtglob` (true if the path starts with `!(`).
+	*
+	* ```js
+	* const pm = require('picomatch');
+	* console.log(pm.scan('foo/bar/*.js'));
+	* { isGlob: true, input: 'foo/bar/*.js', base: 'foo/bar', glob: '*.js' }
+	* ```
+	* @param {String} `str`
+	* @param {Object} `options`
+	* @return {Object} Returns an object with tokens and regex source string.
+	* @api public
+	*/
+	const scan = (input, options) => {
+		const opts = options || {};
+		const length = input.length - 1;
+		const scanToEnd = opts.parts === true || opts.scanToEnd === true;
+		const slashes = [];
+		const tokens = [];
+		const parts = [];
+		let str = input;
+		let index = -1;
+		let start = 0;
+		let lastIndex = 0;
+		let isBrace = false;
+		let isBracket = false;
+		let isGlob = false;
+		let isExtglob = false;
+		let isGlobstar = false;
+		let braceEscaped = false;
+		let backslashes = false;
+		let negated = false;
+		let negatedExtglob = false;
+		let finished = false;
+		let braces = 0;
+		let prev;
+		let code;
+		let token = {
+			value: "",
+			depth: 0,
+			isGlob: false
+		};
+		const eos = () => index >= length;
+		const peek = () => str.charCodeAt(index + 1);
+		const advance = () => {
+			prev = code;
+			return str.charCodeAt(++index);
+		};
+		while (index < length) {
+			code = advance();
+			let next;
+			if (code === CHAR_BACKWARD_SLASH) {
+				backslashes = token.backslashes = true;
+				code = advance();
+				if (code === CHAR_LEFT_CURLY_BRACE) braceEscaped = true;
+				continue;
+			}
+			if (braceEscaped === true || code === CHAR_LEFT_CURLY_BRACE) {
+				braces++;
+				while (eos() !== true && (code = advance())) {
+					if (code === CHAR_BACKWARD_SLASH) {
+						backslashes = token.backslashes = true;
+						advance();
+						continue;
+					}
+					if (code === CHAR_LEFT_CURLY_BRACE) {
+						braces++;
+						continue;
+					}
+					if (braceEscaped !== true && code === CHAR_DOT && (code = advance()) === CHAR_DOT) {
+						isBrace = token.isBrace = true;
+						isGlob = token.isGlob = true;
+						finished = true;
+						if (scanToEnd === true) continue;
+						break;
+					}
+					if (braceEscaped !== true && code === CHAR_COMMA) {
+						isBrace = token.isBrace = true;
+						isGlob = token.isGlob = true;
+						finished = true;
+						if (scanToEnd === true) continue;
+						break;
+					}
+					if (code === CHAR_RIGHT_CURLY_BRACE) {
+						braces--;
+						if (braces === 0) {
+							braceEscaped = false;
+							isBrace = token.isBrace = true;
+							finished = true;
+							break;
+						}
+					}
+				}
+				if (scanToEnd === true) continue;
+				break;
+			}
+			if (code === CHAR_FORWARD_SLASH) {
+				slashes.push(index);
+				tokens.push(token);
+				token = {
+					value: "",
+					depth: 0,
+					isGlob: false
+				};
+				if (finished === true) continue;
+				if (prev === CHAR_DOT && index === start + 1) {
+					start += 2;
+					continue;
+				}
+				lastIndex = index + 1;
+				continue;
+			}
+			if (opts.noext !== true) {
+				if ((code === CHAR_PLUS || code === CHAR_AT || code === CHAR_ASTERISK || code === CHAR_QUESTION_MARK || code === CHAR_EXCLAMATION_MARK) === true && peek() === CHAR_LEFT_PARENTHESES) {
+					isGlob = token.isGlob = true;
+					isExtglob = token.isExtglob = true;
+					finished = true;
+					if (code === CHAR_EXCLAMATION_MARK && index === start) negatedExtglob = true;
+					if (scanToEnd === true) {
+						while (eos() !== true && (code = advance())) {
+							if (code === CHAR_BACKWARD_SLASH) {
+								backslashes = token.backslashes = true;
+								code = advance();
+								continue;
+							}
+							if (code === CHAR_RIGHT_PARENTHESES) {
+								isGlob = token.isGlob = true;
+								finished = true;
+								break;
+							}
+						}
+						continue;
+					}
+					break;
+				}
+			}
+			if (code === CHAR_ASTERISK) {
+				if (prev === CHAR_ASTERISK) isGlobstar = token.isGlobstar = true;
+				isGlob = token.isGlob = true;
+				finished = true;
+				if (scanToEnd === true) continue;
+				break;
+			}
+			if (code === CHAR_QUESTION_MARK) {
+				isGlob = token.isGlob = true;
+				finished = true;
+				if (scanToEnd === true) continue;
+				break;
+			}
+			if (code === CHAR_LEFT_SQUARE_BRACKET) {
+				while (eos() !== true && (next = advance())) {
+					if (next === CHAR_BACKWARD_SLASH) {
+						backslashes = token.backslashes = true;
+						advance();
+						continue;
+					}
+					if (next === CHAR_RIGHT_SQUARE_BRACKET) {
+						isBracket = token.isBracket = true;
+						isGlob = token.isGlob = true;
+						finished = true;
+						break;
+					}
+				}
+				if (scanToEnd === true) continue;
+				break;
+			}
+			if (opts.nonegate !== true && code === CHAR_EXCLAMATION_MARK && index === start) {
+				negated = token.negated = true;
+				start++;
+				continue;
+			}
+			if (opts.noparen !== true && code === CHAR_LEFT_PARENTHESES) {
+				isGlob = token.isGlob = true;
+				if (scanToEnd === true) {
+					while (eos() !== true && (code = advance())) {
+						if (code === CHAR_LEFT_PARENTHESES) {
+							backslashes = token.backslashes = true;
+							code = advance();
+							continue;
+						}
+						if (code === CHAR_RIGHT_PARENTHESES) {
+							finished = true;
+							break;
+						}
+					}
+					continue;
+				}
+				break;
+			}
+			if (isGlob === true) {
+				finished = true;
+				if (scanToEnd === true) continue;
+				break;
+			}
+		}
+		if (opts.noext === true) {
+			isExtglob = false;
+			isGlob = false;
+		}
+		let base = str;
+		let prefix = "";
+		let glob = "";
+		if (start > 0) {
+			prefix = str.slice(0, start);
+			str = str.slice(start);
+			lastIndex -= start;
+		}
+		if (base && isGlob === true && lastIndex > 0) {
+			base = str.slice(0, lastIndex);
+			glob = str.slice(lastIndex);
+		} else if (isGlob === true) {
+			base = "";
+			glob = str;
+		} else base = str;
+		if (base && base !== "" && base !== "/" && base !== str) {
+			if (isPathSeparator(base.charCodeAt(base.length - 1))) base = base.slice(0, -1);
+		}
+		if (opts.unescape === true) {
+			if (glob) glob = utils.removeBackslashes(glob);
+			if (base && backslashes === true) base = utils.removeBackslashes(base);
+		}
+		const state = {
+			prefix,
+			input,
+			start,
+			base,
+			glob,
+			isBrace,
+			isBracket,
+			isGlob,
+			isExtglob,
+			isGlobstar,
+			negated,
+			negatedExtglob
+		};
+		if (opts.tokens === true) {
+			state.maxDepth = 0;
+			if (!isPathSeparator(code)) tokens.push(token);
+			state.tokens = tokens;
+		}
+		if (opts.parts === true || opts.tokens === true) {
+			let prevIndex;
+			for (let idx = 0; idx < slashes.length; idx++) {
+				const n = prevIndex ? prevIndex + 1 : start;
+				const i = slashes[idx];
+				const value = input.slice(n, i);
+				if (opts.tokens) {
+					if (idx === 0 && start !== 0) {
+						tokens[idx].isPrefix = true;
+						tokens[idx].value = prefix;
+					} else tokens[idx].value = value;
+					depth(tokens[idx]);
+					state.maxDepth += tokens[idx].depth;
+				}
+				if (idx !== 0 || value !== "") parts.push(value);
+				prevIndex = i;
+			}
+			if (prevIndex && prevIndex + 1 < input.length) {
+				const value = input.slice(prevIndex + 1);
+				parts.push(value);
+				if (opts.tokens) {
+					tokens[tokens.length - 1].value = value;
+					depth(tokens[tokens.length - 1]);
+					state.maxDepth += tokens[tokens.length - 1].depth;
+				}
+			}
+			state.slashes = slashes;
+			state.parts = parts;
+		}
+		return state;
+	};
+	module.exports = scan;
+}));
+//#endregion
+//#region node_modules/.pnpm/picomatch@4.0.5/node_modules/picomatch/lib/parse.js
+var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const constants = require_constants();
+	const utils = require_utils();
+	/**
+	* Constants
+	*/
+	const { MAX_LENGTH, POSIX_REGEX_SOURCE, REGEX_NON_SPECIAL_CHARS, REGEX_SPECIAL_CHARS_BACKREF, REPLACEMENTS } = constants;
+	/**
+	* Helpers
+	*/
+	const expandRange = (args, options) => {
+		if (typeof options.expandRange === "function") return options.expandRange(...args, options);
+		args.sort();
+		const value = `[${args.join("-")}]`;
+		try {
+			new RegExp(value);
+		} catch (ex) {
+			return args.map((v) => utils.escapeRegex(v)).join("..");
+		}
+		return value;
+	};
+	/**
+	* Create the message for a syntax error
+	*/
+	const syntaxError = (type, char) => {
+		return `Missing ${type}: "${char}" - use "\\\\${char}" to match literal characters`;
+	};
+	const splitTopLevel = (input) => {
+		const parts = [];
+		let bracket = 0;
+		let paren = 0;
+		let quote = 0;
+		let value = "";
+		let escaped = false;
+		for (const ch of input) {
+			if (escaped === true) {
+				value += ch;
+				escaped = false;
+				continue;
+			}
+			if (ch === "\\") {
+				value += ch;
+				escaped = true;
+				continue;
+			}
+			if (ch === "\"") {
+				quote = quote === 1 ? 0 : 1;
+				value += ch;
+				continue;
+			}
+			if (quote === 0) {
+				if (ch === "[") bracket++;
+				else if (ch === "]" && bracket > 0) bracket--;
+				else if (bracket === 0) {
+					if (ch === "(") paren++;
+					else if (ch === ")" && paren > 0) paren--;
+					else if (ch === "|" && paren === 0) {
+						parts.push(value);
+						value = "";
+						continue;
+					}
+				}
+			}
+			value += ch;
+		}
+		parts.push(value);
+		return parts;
+	};
+	const isPlainBranch = (branch) => {
+		let escaped = false;
+		for (const ch of branch) {
+			if (escaped === true) {
+				escaped = false;
+				continue;
+			}
+			if (ch === "\\") {
+				escaped = true;
+				continue;
+			}
+			if (/[?*+@!()[\]{}]/.test(ch)) return false;
+		}
+		return true;
+	};
+	const normalizeSimpleBranch = (branch) => {
+		let value = branch.trim();
+		let changed = true;
+		while (changed === true) {
+			changed = false;
+			if (/^@\([^\\()[\]{}|]+\)$/.test(value)) {
+				value = value.slice(2, -1);
+				changed = true;
+			}
+		}
+		if (!isPlainBranch(value)) return;
+		return value.replace(/\\(.)/g, "$1");
+	};
+	const hasRepeatedCharPrefixOverlap = (branches) => {
+		const values = branches.map(normalizeSimpleBranch).filter(Boolean);
+		for (let i = 0; i < values.length; i++) for (let j = i + 1; j < values.length; j++) {
+			const a = values[i];
+			const b = values[j];
+			const char = a[0];
+			if (!char || a !== char.repeat(a.length) || b !== char.repeat(b.length)) continue;
+			if (a === b || a.startsWith(b) || b.startsWith(a)) return true;
+		}
+		return false;
+	};
+	const parseRepeatedExtglob = (pattern, requireEnd = true) => {
+		if (pattern[0] !== "+" && pattern[0] !== "*" || pattern[1] !== "(") return;
+		let bracket = 0;
+		let paren = 0;
+		let quote = 0;
+		let escaped = false;
+		for (let i = 1; i < pattern.length; i++) {
+			const ch = pattern[i];
+			if (escaped === true) {
+				escaped = false;
+				continue;
+			}
+			if (ch === "\\") {
+				escaped = true;
+				continue;
+			}
+			if (ch === "\"") {
+				quote = quote === 1 ? 0 : 1;
+				continue;
+			}
+			if (quote === 1) continue;
+			if (ch === "[") {
+				bracket++;
+				continue;
+			}
+			if (ch === "]" && bracket > 0) {
+				bracket--;
+				continue;
+			}
+			if (bracket > 0) continue;
+			if (ch === "(") {
+				paren++;
+				continue;
+			}
+			if (ch === ")") {
+				paren--;
+				if (paren === 0) {
+					if (requireEnd === true && i !== pattern.length - 1) return;
+					return {
+						type: pattern[0],
+						body: pattern.slice(2, i),
+						end: i
+					};
+				}
+			}
+		}
+	};
+	const buildCharClassStar = (chars) => {
+		return `${chars.length === 1 ? utils.escapeRegex(chars[0]) : `[${chars.map((ch) => utils.escapeRegex(ch)).join("")}]`}*`;
+	};
+	const getStarExtglobSequenceChars = (pattern) => {
+		let index = 0;
+		const chars = [];
+		while (index < pattern.length) {
+			const match = parseRepeatedExtglob(pattern.slice(index), false);
+			if (!match || match.type !== "*") return;
+			const branches = splitTopLevel(match.body).map((branch) => branch.trim());
+			if (branches.length !== 1) return;
+			const branch = normalizeSimpleBranch(branches[0]);
+			if (!branch || branch.length !== 1) return;
+			chars.push(branch);
+			index += match.end + 1;
+		}
+		if (chars.length < 1) return;
+		return chars;
+	};
+	const repeatedExtglobRecursion = (pattern) => {
+		let depth = 0;
+		let value = pattern.trim();
+		let match = parseRepeatedExtglob(value);
+		while (match) {
+			depth++;
+			value = match.body.trim();
+			match = parseRepeatedExtglob(value);
+		}
+		return depth;
+	};
+	const analyzeRepeatedExtglob = (body, options) => {
+		if (options.maxExtglobRecursion === false) return { risky: false };
+		const max = typeof options.maxExtglobRecursion === "number" ? options.maxExtglobRecursion : constants.DEFAULT_MAX_EXTGLOB_RECURSION;
+		const branches = splitTopLevel(body).map((branch) => branch.trim());
+		if (branches.length > 1) {
+			if (branches.some((branch) => branch === "") || branches.some((branch) => /^[*?]+$/.test(branch)) || hasRepeatedCharPrefixOverlap(branches)) return { risky: true };
+		}
+		const safeChars = [];
+		let sawStarSequence = false;
+		let combinable = true;
+		for (const branch of branches) {
+			const chars = getStarExtglobSequenceChars(branch);
+			if (chars) {
+				sawStarSequence = true;
+				safeChars.push(...chars);
+				continue;
+			}
+			const literal = normalizeSimpleBranch(branch);
+			if (literal && literal.length === 1) {
+				safeChars.push(literal);
+				continue;
+			}
+			combinable = false;
+			if (repeatedExtglobRecursion(branch) > max) return { risky: true };
+		}
+		if (sawStarSequence) return combinable ? {
+			risky: true,
+			safeOutput: buildCharClassStar([...new Set(safeChars)])
+		} : { risky: true };
+		return { risky: false };
+	};
+	/**
+	* Parse the given input string.
+	* @param {String} input
+	* @param {Object} options
+	* @return {Object}
+	*/
+	const parse = (input, options) => {
+		if (typeof input !== "string") throw new TypeError("Expected a string");
+		input = REPLACEMENTS[input] || input;
+		const opts = { ...options };
+		const max = typeof opts.maxLength === "number" ? Math.min(MAX_LENGTH, opts.maxLength) : MAX_LENGTH;
+		let len = input.length;
+		if (len > max) throw new SyntaxError(`Input length: ${len}, exceeds maximum allowed length: ${max}`);
+		const bos = {
+			type: "bos",
+			value: "",
+			output: opts.prepend || ""
+		};
+		const tokens = [bos];
+		const capture = opts.capture ? "" : "?:";
+		const PLATFORM_CHARS = constants.globChars(opts.windows);
+		const EXTGLOB_CHARS = constants.extglobChars(PLATFORM_CHARS);
+		const { DOT_LITERAL, PLUS_LITERAL, SLASH_LITERAL, ONE_CHAR, DOTS_SLASH, NO_DOT, NO_DOT_SLASH, NO_DOTS_SLASH, QMARK, QMARK_NO_DOT, STAR, START_ANCHOR } = PLATFORM_CHARS;
+		const globstar = (opts) => {
+			return `(${capture}(?:(?!${START_ANCHOR}${opts.dot ? DOTS_SLASH : DOT_LITERAL}).)*?)`;
+		};
+		const nodot = opts.dot ? "" : NO_DOT;
+		const qmarkNoDot = opts.dot ? QMARK : QMARK_NO_DOT;
+		let star = opts.bash === true ? globstar(opts) : STAR;
+		if (opts.capture) star = `(${star})`;
+		if (typeof opts.noext === "boolean") opts.noextglob = opts.noext;
+		const state = {
+			input,
+			index: -1,
+			start: 0,
+			dot: opts.dot === true,
+			consumed: "",
+			output: "",
+			prefix: "",
+			backtrack: false,
+			negated: false,
+			brackets: 0,
+			braces: 0,
+			parens: 0,
+			quotes: 0,
+			globstar: false,
+			tokens
+		};
+		input = utils.removePrefix(input, state);
+		len = input.length;
+		const extglobs = [];
+		const braces = [];
+		const stack = [];
+		let prev = bos;
+		let value;
+		/**
+		* Tokenizing helpers
+		*/
+		const eos = () => state.index === len - 1;
+		const peek = state.peek = (n = 1) => input[state.index + n];
+		const advance = state.advance = () => input[++state.index] || "";
+		const remaining = () => input.slice(state.index + 1);
+		const consume = (value = "", num = 0) => {
+			state.consumed += value;
+			state.index += num;
+		};
+		const append = (token) => {
+			state.output += token.output != null ? token.output : token.value;
+			consume(token.value);
+		};
+		const negate = () => {
+			let count = 1;
+			while (peek() === "!" && (peek(2) !== "(" || peek(3) === "?")) {
+				advance();
+				state.start++;
+				count++;
+			}
+			if (count % 2 === 0) return false;
+			state.negated = true;
+			state.start++;
+			return true;
+		};
+		const increment = (type) => {
+			state[type]++;
+			stack.push(type);
+		};
+		const decrement = (type) => {
+			state[type]--;
+			stack.pop();
+		};
+		/**
+		* Push tokens onto the tokens array. This helper speeds up
+		* tokenizing by 1) helping us avoid backtracking as much as possible,
+		* and 2) helping us avoid creating extra tokens when consecutive
+		* characters are plain text. This improves performance and simplifies
+		* lookbehinds.
+		*/
+		const push = (tok) => {
+			if (prev.type === "globstar") {
+				const isBrace = state.braces > 0 && (tok.type === "comma" || tok.type === "brace");
+				const isExtglob = tok.extglob === true || extglobs.length && (tok.type === "pipe" || tok.type === "paren");
+				if (tok.type !== "slash" && tok.type !== "paren" && !isBrace && !isExtglob) {
+					state.output = state.output.slice(0, -prev.output.length);
+					prev.type = "star";
+					prev.value = "*";
+					prev.output = star;
+					state.output += prev.output;
+				}
+			}
+			if (extglobs.length && tok.type !== "paren") extglobs[extglobs.length - 1].inner += tok.value;
+			if (tok.value || tok.output) append(tok);
+			if (prev && prev.type === "text" && tok.type === "text") {
+				prev.output = (prev.output || prev.value) + tok.value;
+				prev.value += tok.value;
+				return;
+			}
+			tok.prev = prev;
+			tokens.push(tok);
+			prev = tok;
+		};
+		const extglobOpen = (type, value) => {
+			const token = {
+				...EXTGLOB_CHARS[value],
+				conditions: 1,
+				inner: ""
+			};
+			token.prev = prev;
+			token.parens = state.parens;
+			token.output = state.output;
+			token.startIndex = state.index;
+			token.tokensIndex = tokens.length;
+			const output = (opts.capture ? "(" : "") + token.open;
+			increment("parens");
+			push({
+				type,
+				value,
+				output: state.output ? "" : ONE_CHAR
+			});
+			push({
+				type: "paren",
+				extglob: true,
+				value: advance(),
+				output
+			});
+			extglobs.push(token);
+		};
+		const extglobClose = (token) => {
+			const literal = input.slice(token.startIndex, state.index + 1);
+			const body = input.slice(token.startIndex + 2, state.index);
+			const analysis = analyzeRepeatedExtglob(body, opts);
+			if ((token.type === "plus" || token.type === "star") && analysis.risky) {
+				const safeOutput = analysis.safeOutput ? (token.output ? "" : ONE_CHAR) + (opts.capture ? `(${analysis.safeOutput})` : analysis.safeOutput) : void 0;
+				const open = tokens[token.tokensIndex];
+				open.type = "text";
+				open.value = literal;
+				open.output = safeOutput || utils.escapeRegex(literal);
+				for (let i = token.tokensIndex + 1; i < tokens.length; i++) {
+					tokens[i].value = "";
+					tokens[i].output = "";
+					delete tokens[i].suffix;
+				}
+				state.output = token.output + open.output;
+				state.backtrack = true;
+				push({
+					type: "paren",
+					extglob: true,
+					value,
+					output: ""
+				});
+				decrement("parens");
+				return;
+			}
+			let output = token.close + (opts.capture ? ")" : "");
+			let rest;
+			if (token.type === "negate") {
+				let extglobStar = star;
+				if (token.inner && token.inner.length > 1 && token.inner.includes("/")) extglobStar = globstar(opts);
+				if (extglobStar !== star || eos() || /^\)+$/.test(remaining())) output = token.close = `)$))${extglobStar}`;
+				if (token.inner.includes("*") && (rest = remaining()) && /^\.[^\\/.]+$/.test(rest)) output = token.close = `)${parse(rest, {
+					...options,
+					fastpaths: false
+				}).output})${extglobStar})`;
+				if (token.prev.type === "bos") state.negatedExtglob = true;
+			}
+			push({
+				type: "paren",
+				extglob: true,
+				value,
+				output
+			});
+			decrement("parens");
+		};
+		/**
+		* Fast paths
+		*/
+		if (opts.fastpaths !== false && !/(^[*!]|[/()[\]{}"])/.test(input)) {
+			let backslashes = false;
+			let output = input.replace(REGEX_SPECIAL_CHARS_BACKREF, (m, esc, chars, first, rest, index) => {
+				if (first === "\\") {
+					backslashes = true;
+					return m;
+				}
+				if (first === "?") {
+					if (esc) return esc + first + (rest ? QMARK.repeat(rest.length) : "");
+					if (index === 0) return qmarkNoDot + (rest ? QMARK.repeat(rest.length) : "");
+					return QMARK.repeat(chars.length);
+				}
+				if (first === ".") return DOT_LITERAL.repeat(chars.length);
+				if (first === "*") {
+					if (esc) return esc + first + (rest ? star : "");
+					return star;
+				}
+				return esc ? m : `\\${m}`;
+			});
+			if (backslashes === true) if (opts.unescape === true) output = output.replace(/\\/g, "");
+			else output = output.replace(/\\+/g, (m) => {
+				return m.length % 2 === 0 ? "\\\\" : m ? "\\" : "";
+			});
+			if (output === input && opts.contains === true) {
+				state.output = input;
+				return state;
+			}
+			state.output = utils.wrapOutput(output, state, options);
+			return state;
+		}
+		/**
+		* Tokenize input until we reach end-of-string
+		*/
+		while (!eos()) {
+			value = advance();
+			if (value === "\0") continue;
+			/**
+			* Escaped characters
+			*/
+			if (value === "\\") {
+				const next = peek();
+				if (next === "/" && opts.bash !== true) continue;
+				if (next === "." || next === ";") continue;
+				if (!next) {
+					value += "\\";
+					push({
+						type: "text",
+						value
+					});
+					continue;
+				}
+				const match = /^\\+/.exec(remaining());
+				let slashes = 0;
+				if (match && match[0].length > 2) {
+					slashes = match[0].length;
+					state.index += slashes;
+					if (slashes % 2 !== 0) value += "\\";
+				}
+				if (opts.unescape === true) value = advance();
+				else value += advance();
+				if (state.brackets === 0) {
+					push({
+						type: "text",
+						value
+					});
+					continue;
+				}
+			}
+			/**
+			* If we're inside a regex character class, continue
+			* until we reach the closing bracket.
+			*/
+			if (state.brackets > 0 && (value !== "]" || prev.value === "[" || prev.value === "[^")) {
+				if (opts.posix !== false && value === ":") {
+					const inner = prev.value.slice(1);
+					if (inner.includes("[")) {
+						prev.posix = true;
+						if (inner.includes(":")) {
+							const idx = prev.value.lastIndexOf("[");
+							const pre = prev.value.slice(0, idx);
+							const rest = prev.value.slice(idx + 2);
+							const posix = POSIX_REGEX_SOURCE[rest];
+							if (posix) {
+								prev.value = pre + posix;
+								state.backtrack = true;
+								advance();
+								if (!bos.output && tokens.indexOf(prev) === 1) bos.output = ONE_CHAR;
+								continue;
+							}
+						}
+					}
+				}
+				if (value === "[" && peek() !== ":" || value === "-" && peek() === "]") value = `\\${value}`;
+				if (value === "]" && (prev.value === "[" || prev.value === "[^")) value = `\\${value}`;
+				if (opts.posix === true && value === "!" && prev.value === "[") value = "^";
+				prev.value += value;
+				append({ value });
+				continue;
+			}
+			/**
+			* If we're inside a quoted string, continue
+			* until we reach the closing double quote.
+			*/
+			if (state.quotes === 1 && value !== "\"") {
+				value = utils.escapeRegex(value);
+				prev.value += value;
+				append({ value });
+				continue;
+			}
+			/**
+			* Double quotes
+			*/
+			if (value === "\"") {
+				state.quotes = state.quotes === 1 ? 0 : 1;
+				if (opts.keepQuotes === true) push({
+					type: "text",
+					value
+				});
+				continue;
+			}
+			/**
+			* Parentheses
+			*/
+			if (value === "(") {
+				increment("parens");
+				push({
+					type: "paren",
+					value
+				});
+				continue;
+			}
+			if (value === ")") {
+				if (state.parens === 0 && opts.strictBrackets === true) throw new SyntaxError(syntaxError("opening", "("));
+				const extglob = extglobs[extglobs.length - 1];
+				if (extglob && state.parens === extglob.parens + 1) {
+					extglobClose(extglobs.pop());
+					continue;
+				}
+				push({
+					type: "paren",
+					value,
+					output: state.parens ? ")" : "\\)"
+				});
+				decrement("parens");
+				continue;
+			}
+			/**
+			* Square brackets
+			*/
+			if (value === "[") {
+				if (opts.nobracket === true || !remaining().includes("]")) {
+					if (opts.nobracket !== true && opts.strictBrackets === true) throw new SyntaxError(syntaxError("closing", "]"));
+					value = `\\${value}`;
+				} else increment("brackets");
+				push({
+					type: "bracket",
+					value
+				});
+				continue;
+			}
+			if (value === "]") {
+				if (opts.nobracket === true || prev && prev.type === "bracket" && prev.value.length === 1) {
+					push({
+						type: "text",
+						value,
+						output: `\\${value}`
+					});
+					continue;
+				}
+				if (state.brackets === 0) {
+					if (opts.strictBrackets === true) throw new SyntaxError(syntaxError("opening", "["));
+					push({
+						type: "text",
+						value,
+						output: `\\${value}`
+					});
+					continue;
+				}
+				decrement("brackets");
+				const prevValue = prev.value.slice(1);
+				if (prev.posix !== true && prevValue[0] === "^" && !prevValue.includes("/")) value = `/${value}`;
+				prev.value += value;
+				append({ value });
+				if (opts.literalBrackets === false || utils.hasRegexChars(prevValue)) continue;
+				const escaped = utils.escapeRegex(prev.value);
+				state.output = state.output.slice(0, -prev.value.length);
+				if (opts.literalBrackets === true) {
+					state.output += escaped;
+					prev.value = escaped;
+					continue;
+				}
+				prev.value = `(${capture}${escaped}|${prev.value})`;
+				state.output += prev.value;
+				continue;
+			}
+			/**
+			* Braces
+			*/
+			if (value === "{" && opts.nobrace !== true) {
+				increment("braces");
+				const open = {
+					type: "brace",
+					value,
+					output: "(",
+					outputIndex: state.output.length,
+					tokensIndex: state.tokens.length
+				};
+				braces.push(open);
+				push(open);
+				continue;
+			}
+			if (value === "}") {
+				const brace = braces[braces.length - 1];
+				if (opts.nobrace === true || !brace) {
+					push({
+						type: "text",
+						value,
+						output: value
+					});
+					continue;
+				}
+				let output = ")";
+				if (brace.dots === true) {
+					const arr = tokens.slice();
+					const range = [];
+					for (let i = arr.length - 1; i >= 0; i--) {
+						tokens.pop();
+						if (arr[i].type === "brace") break;
+						if (arr[i].type !== "dots") range.unshift(arr[i].value);
+					}
+					output = expandRange(range, opts);
+					state.backtrack = true;
+				}
+				if (brace.comma !== true && brace.dots !== true) {
+					const out = state.output.slice(0, brace.outputIndex);
+					const toks = state.tokens.slice(brace.tokensIndex);
+					brace.value = brace.output = "\\{";
+					value = output = "\\}";
+					state.output = out;
+					for (const t of toks) state.output += t.output || t.value;
+				}
+				push({
+					type: "brace",
+					value,
+					output
+				});
+				decrement("braces");
+				braces.pop();
+				continue;
+			}
+			/**
+			* Pipes
+			*/
+			if (value === "|") {
+				if (extglobs.length > 0) extglobs[extglobs.length - 1].conditions++;
+				push({
+					type: "text",
+					value
+				});
+				continue;
+			}
+			/**
+			* Commas
+			*/
+			if (value === ",") {
+				let output = value;
+				const brace = braces[braces.length - 1];
+				if (brace && stack[stack.length - 1] === "braces") {
+					brace.comma = true;
+					output = "|";
+				}
+				push({
+					type: "comma",
+					value,
+					output
+				});
+				continue;
+			}
+			/**
+			* Slashes
+			*/
+			if (value === "/") {
+				if (prev.type === "dot" && state.index === state.start + 1) {
+					state.start = state.index + 1;
+					state.consumed = "";
+					state.output = "";
+					tokens.pop();
+					prev = bos;
+					continue;
+				}
+				push({
+					type: "slash",
+					value,
+					output: SLASH_LITERAL
+				});
+				continue;
+			}
+			/**
+			* Dots
+			*/
+			if (value === ".") {
+				if (state.braces > 0 && prev.type === "dot") {
+					if (prev.value === ".") prev.output = DOT_LITERAL;
+					const brace = braces[braces.length - 1];
+					prev.type = "dots";
+					prev.output += value;
+					prev.value += value;
+					brace.dots = true;
+					continue;
+				}
+				if (state.braces + state.parens === 0 && prev.type !== "bos" && prev.type !== "slash") {
+					push({
+						type: "text",
+						value,
+						output: DOT_LITERAL
+					});
+					continue;
+				}
+				push({
+					type: "dot",
+					value,
+					output: DOT_LITERAL
+				});
+				continue;
+			}
+			/**
+			* Question marks
+			*/
+			if (value === "?") {
+				if (!(prev && prev.value === "(") && opts.noextglob !== true && peek() === "(" && peek(2) !== "?") {
+					extglobOpen("qmark", value);
+					continue;
+				}
+				if (prev && prev.type === "paren") {
+					const next = peek();
+					let output = value;
+					if (prev.value === "(" && !/[!=<:]/.test(next) || next === "<" && !/<([!=]|\w+>)/.test(remaining())) output = `\\${value}`;
+					push({
+						type: "text",
+						value,
+						output
+					});
+					continue;
+				}
+				if (opts.dot !== true && (prev.type === "slash" || prev.type === "bos")) {
+					push({
+						type: "qmark",
+						value,
+						output: QMARK_NO_DOT
+					});
+					continue;
+				}
+				push({
+					type: "qmark",
+					value,
+					output: QMARK
+				});
+				continue;
+			}
+			/**
+			* Exclamation
+			*/
+			if (value === "!") {
+				if (opts.noextglob !== true && peek() === "(") {
+					if (peek(2) !== "?" || !/[!=<:]/.test(peek(3))) {
+						extglobOpen("negate", value);
+						continue;
+					}
+				}
+				if (opts.nonegate !== true && state.index === 0) {
+					negate();
+					continue;
+				}
+			}
+			/**
+			* Plus
+			*/
+			if (value === "+") {
+				if (opts.noextglob !== true && peek() === "(" && peek(2) !== "?") {
+					extglobOpen("plus", value);
+					continue;
+				}
+				if (prev && prev.value === "(" || opts.regex === false) {
+					push({
+						type: "plus",
+						value,
+						output: PLUS_LITERAL
+					});
+					continue;
+				}
+				if (prev && (prev.type === "bracket" || prev.type === "paren" || prev.type === "brace") || state.parens > 0) {
+					push({
+						type: "plus",
+						value
+					});
+					continue;
+				}
+				push({
+					type: "plus",
+					value: PLUS_LITERAL
+				});
+				continue;
+			}
+			/**
+			* Plain text
+			*/
+			if (value === "@") {
+				if (opts.noextglob !== true && peek() === "(" && peek(2) !== "?") {
+					push({
+						type: "at",
+						extglob: true,
+						value,
+						output: ""
+					});
+					continue;
+				}
+				push({
+					type: "text",
+					value
+				});
+				continue;
+			}
+			/**
+			* Plain text
+			*/
+			if (value !== "*") {
+				if (value === "$" || value === "^") value = `\\${value}`;
+				const match = REGEX_NON_SPECIAL_CHARS.exec(remaining());
+				if (match) {
+					value += match[0];
+					state.index += match[0].length;
+				}
+				push({
+					type: "text",
+					value
+				});
+				continue;
+			}
+			/**
+			* Stars
+			*/
+			if (prev && (prev.type === "globstar" || prev.star === true)) {
+				prev.type = "star";
+				prev.star = true;
+				prev.value += value;
+				prev.output = star;
+				state.backtrack = true;
+				state.globstar = true;
+				consume(value);
+				continue;
+			}
+			let rest = remaining();
+			if (opts.noextglob !== true && /^\([^?]/.test(rest)) {
+				extglobOpen("star", value);
+				continue;
+			}
+			if (prev.type === "star") {
+				if (opts.noglobstar === true) {
+					consume(value);
+					continue;
+				}
+				const prior = prev.prev;
+				const before = prior.prev;
+				const isStart = prior.type === "slash" || prior.type === "bos";
+				const afterStar = before && (before.type === "star" || before.type === "globstar");
+				if (opts.bash === true && (!isStart || rest[0] && rest[0] !== "/")) {
+					push({
+						type: "star",
+						value,
+						output: ""
+					});
+					continue;
+				}
+				const isBrace = state.braces > 0 && (prior.type === "comma" || prior.type === "brace");
+				const isExtglob = extglobs.length && (prior.type === "pipe" || prior.type === "paren");
+				if (!isStart && prior.type !== "paren" && !isBrace && !isExtglob) {
+					push({
+						type: "star",
+						value,
+						output: ""
+					});
+					continue;
+				}
+				while (rest.slice(0, 3) === "/**") {
+					const after = input[state.index + 4];
+					if (after && after !== "/") break;
+					rest = rest.slice(3);
+					consume("/**", 3);
+				}
+				if (prior.type === "bos" && eos()) {
+					prev.type = "globstar";
+					prev.value += value;
+					prev.output = globstar(opts);
+					state.output = prev.output;
+					state.globstar = true;
+					consume(value);
+					continue;
+				}
+				if (prior.type === "slash" && prior.prev.type !== "bos" && !afterStar && eos()) {
+					state.output = state.output.slice(0, -(prior.output + prev.output).length);
+					prior.output = `(?:${prior.output}`;
+					prev.type = "globstar";
+					prev.output = globstar(opts) + (opts.strictSlashes ? ")" : "|$)");
+					prev.value += value;
+					state.globstar = true;
+					state.output += prior.output + prev.output;
+					consume(value);
+					continue;
+				}
+				if (prior.type === "slash" && prior.prev.type !== "bos" && rest[0] === "/") {
+					const end = rest[1] !== void 0 ? "|$" : "";
+					state.output = state.output.slice(0, -(prior.output + prev.output).length);
+					prior.output = `(?:${prior.output}`;
+					prev.type = "globstar";
+					prev.output = `${globstar(opts)}${SLASH_LITERAL}|${SLASH_LITERAL}${end})`;
+					prev.value += value;
+					state.output += prior.output + prev.output;
+					state.globstar = true;
+					consume(value + advance());
+					push({
+						type: "slash",
+						value: "/",
+						output: ""
+					});
+					continue;
+				}
+				if (prior.type === "bos" && rest[0] === "/") {
+					prev.type = "globstar";
+					prev.value += value;
+					prev.output = `(?:^|${SLASH_LITERAL}|${globstar(opts)}${SLASH_LITERAL})`;
+					state.output = prev.output;
+					state.globstar = true;
+					consume(value + advance());
+					push({
+						type: "slash",
+						value: "/",
+						output: ""
+					});
+					continue;
+				}
+				state.output = state.output.slice(0, -prev.output.length);
+				prev.type = "globstar";
+				prev.output = globstar(opts);
+				prev.value += value;
+				state.output += prev.output;
+				state.globstar = true;
+				consume(value);
+				continue;
+			}
+			const token = {
+				type: "star",
+				value,
+				output: star
+			};
+			if (opts.bash === true) {
+				token.output = ".*?";
+				if (prev.type === "bos" || prev.type === "slash") token.output = nodot + token.output;
+				push(token);
+				continue;
+			}
+			if (prev && (prev.type === "bracket" || prev.type === "paren") && opts.regex === true) {
+				token.output = value;
+				push(token);
+				continue;
+			}
+			if (state.index === state.start || prev.type === "slash" || prev.type === "dot") {
+				if (prev.type === "dot") {
+					state.output += NO_DOT_SLASH;
+					prev.output += NO_DOT_SLASH;
+				} else if (opts.dot === true) {
+					state.output += NO_DOTS_SLASH;
+					prev.output += NO_DOTS_SLASH;
+				} else {
+					state.output += nodot;
+					prev.output += nodot;
+				}
+				if (peek() !== "*") {
+					state.output += ONE_CHAR;
+					prev.output += ONE_CHAR;
+				}
+			}
+			push(token);
+		}
+		while (state.brackets > 0) {
+			if (opts.strictBrackets === true) throw new SyntaxError(syntaxError("closing", "]"));
+			state.output = utils.escapeLast(state.output, "[");
+			decrement("brackets");
+		}
+		while (state.parens > 0) {
+			if (opts.strictBrackets === true) throw new SyntaxError(syntaxError("closing", ")"));
+			state.output = utils.escapeLast(state.output, "(");
+			decrement("parens");
+		}
+		while (state.braces > 0) {
+			if (opts.strictBrackets === true) throw new SyntaxError(syntaxError("closing", "}"));
+			state.output = utils.escapeLast(state.output, "{");
+			decrement("braces");
+		}
+		if (opts.strictSlashes !== true && (prev.type === "star" || prev.type === "bracket")) push({
+			type: "maybe_slash",
+			value: "",
+			output: `${SLASH_LITERAL}?`
+		});
+		if (state.backtrack === true) {
+			state.output = "";
+			for (const token of state.tokens) {
+				state.output += token.output != null ? token.output : token.value;
+				if (token.suffix) state.output += token.suffix;
+			}
+		}
+		return state;
+	};
+	/**
+	* Fast paths for creating regular expressions for common glob patterns.
+	* This can significantly speed up processing and has very little downside
+	* impact when none of the fast paths match.
+	*/
+	parse.fastpaths = (input, options) => {
+		const opts = { ...options };
+		const max = typeof opts.maxLength === "number" ? Math.min(MAX_LENGTH, opts.maxLength) : MAX_LENGTH;
+		const len = input.length;
+		if (len > max) throw new SyntaxError(`Input length: ${len}, exceeds maximum allowed length: ${max}`);
+		input = REPLACEMENTS[input] || input;
+		const { DOT_LITERAL, SLASH_LITERAL, ONE_CHAR, DOTS_SLASH, NO_DOT, NO_DOTS, NO_DOTS_SLASH, STAR, START_ANCHOR } = constants.globChars(opts.windows);
+		const nodot = opts.dot ? NO_DOTS : NO_DOT;
+		const slashDot = opts.dot ? NO_DOTS_SLASH : NO_DOT;
+		const capture = opts.capture ? "" : "?:";
+		const state = {
+			negated: false,
+			prefix: ""
+		};
+		let star = opts.bash === true ? ".*?" : STAR;
+		if (opts.capture) star = `(${star})`;
+		const globstar = (opts) => {
+			if (opts.noglobstar === true) return star;
+			return `(${capture}(?:(?!${START_ANCHOR}${opts.dot ? DOTS_SLASH : DOT_LITERAL}).)*?)`;
+		};
+		const create = (str) => {
+			switch (str) {
+				case "*": return `${nodot}${ONE_CHAR}${star}`;
+				case ".*": return `${DOT_LITERAL}${ONE_CHAR}${star}`;
+				case "*.*": return `${nodot}${star}${DOT_LITERAL}${ONE_CHAR}${star}`;
+				case "*/*": return `${nodot}${star}${SLASH_LITERAL}${ONE_CHAR}${slashDot}${star}`;
+				case "**": return nodot + globstar(opts);
+				case "**/*": return `(?:${nodot}${globstar(opts)}${SLASH_LITERAL})?${slashDot}${ONE_CHAR}${star}`;
+				case "**/*.*": return `(?:${nodot}${globstar(opts)}${SLASH_LITERAL})?${slashDot}${star}${DOT_LITERAL}${ONE_CHAR}${star}`;
+				case "**/.*": return `(?:${nodot}${globstar(opts)}${SLASH_LITERAL})?${DOT_LITERAL}${ONE_CHAR}${star}`;
+				default: {
+					const match = /^(.*?)\.(\w+)$/.exec(str);
+					if (!match) return;
+					const source = create(match[1]);
+					if (!source) return;
+					return source + DOT_LITERAL + match[2];
+				}
+			}
+		};
+		let source = create(utils.removePrefix(input, state));
+		if (source && opts.strictSlashes !== true) source += `${SLASH_LITERAL}?`;
+		return source;
+	};
+	module.exports = parse;
+}));
+//#endregion
+//#region node_modules/.pnpm/picomatch@4.0.5/node_modules/picomatch/lib/picomatch.js
+var require_picomatch$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const scan = require_scan();
+	const parse = require_parse();
+	const utils = require_utils();
+	const constants = require_constants();
+	const isObject = (val) => val && typeof val === "object" && !Array.isArray(val);
+	/**
+	* Creates a matcher function from one or more glob patterns. The
+	* returned function takes a string to match as its first argument,
+	* and returns true if the string is a match. The returned matcher
+	* function also takes a boolean as the second argument that, when true,
+	* returns an object with additional information.
+	*
+	* ```js
+	* const picomatch = require('picomatch');
+	* // picomatch(glob[, options]);
+	*
+	* const isMatch = picomatch('*.!(*a)');
+	* console.log(isMatch('a.a')); //=> false
+	* console.log(isMatch('a.b')); //=> true
+	*
+	* // For environments without `node.js`, `picomatch/posix` provides you a dependency-free matcher, without automatic OS detection.
+	* const picomatch = require('picomatch/posix');
+	* // the same API, defaulting to posix paths
+	* const isMatch = picomatch('a/*');
+	* console.log(isMatch('a\\b')); //=> false
+	* console.log(isMatch('a/b')); //=> true
+	*
+	* // you can still configure the matcher function to accept windows paths
+	* const isMatch = picomatch('a/*', { options: windows });
+	* console.log(isMatch('a\\b')); //=> true
+	* console.log(isMatch('a/b')); //=> true
+	* ```
+	* @name picomatch
+	* @param {String|Array} `globs` One or more glob patterns.
+	* @param {Object=} `options`
+	* @return {Function=} Returns a matcher function.
+	* @api public
+	*/
+	const picomatch = (glob, options, returnState = false) => {
+		if (Array.isArray(glob)) {
+			const fns = glob.map((input) => picomatch(input, options, returnState));
+			const arrayMatcher = (str) => {
+				for (const isMatch of fns) {
+					const state = isMatch(str);
+					if (state) return state;
+				}
+				return false;
+			};
+			return arrayMatcher;
+		}
+		const isState = isObject(glob) && glob.tokens && glob.input;
+		if (glob === "" || typeof glob !== "string" && !isState) throw new TypeError("Expected pattern to be a non-empty string");
+		const opts = options || {};
+		const posix = opts.windows;
+		const regex = isState ? picomatch.compileRe(glob, options) : picomatch.makeRe(glob, options, false, true);
+		const state = regex.state;
+		delete regex.state;
+		let isIgnored = () => false;
+		if (opts.ignore) {
+			const ignoreOpts = {
+				...options,
+				ignore: null,
+				onMatch: null,
+				onResult: null
+			};
+			isIgnored = picomatch(opts.ignore, ignoreOpts, returnState);
+		}
+		const matcher = (input, returnObject = false) => {
+			const { isMatch, match, output } = picomatch.test(input, regex, options, {
+				glob,
+				posix
+			});
+			const result = {
+				glob,
+				state,
+				regex,
+				posix,
+				input,
+				output,
+				match,
+				isMatch
+			};
+			if (typeof opts.onResult === "function") opts.onResult(result);
+			if (isMatch === false) {
+				result.isMatch = false;
+				return returnObject ? result : false;
+			}
+			if (isIgnored(input)) {
+				if (typeof opts.onIgnore === "function") opts.onIgnore(result);
+				result.isMatch = false;
+				return returnObject ? result : false;
+			}
+			if (typeof opts.onMatch === "function") opts.onMatch(result);
+			return returnObject ? result : true;
+		};
+		if (returnState) matcher.state = state;
+		return matcher;
+	};
+	/**
+	* Test `input` with the given `regex`. This is used by the main
+	* `picomatch()` function to test the input string.
+	*
+	* ```js
+	* const picomatch = require('picomatch');
+	* // picomatch.test(input, regex[, options]);
+	*
+	* console.log(picomatch.test('foo/bar', /^(?:([^/]*?)\/([^/]*?))$/));
+	* // { isMatch: true, match: [ 'foo/', 'foo', 'bar' ], output: 'foo/bar' }
+	* ```
+	* @param {String} `input` String to test.
+	* @param {RegExp} `regex`
+	* @return {Object} Returns an object with matching info.
+	* @api public
+	*/
+	picomatch.test = (input, regex, options, { glob, posix } = {}) => {
+		if (typeof input !== "string") throw new TypeError("Expected input to be a string");
+		if (input === "") return {
+			isMatch: false,
+			output: ""
+		};
+		const opts = options || {};
+		const format = opts.format || (posix ? utils.toPosixSlashes : null);
+		let match = input === glob;
+		let output = match && format ? format(input) : input;
+		if (match === false) {
+			output = format ? format(input) : input;
+			match = output === glob;
+		}
+		if (match === false || opts.capture === true) if (opts.matchBase === true || opts.basename === true) match = picomatch.matchBase(input, regex, options, posix);
+		else match = regex.exec(output);
+		return {
+			isMatch: Boolean(match),
+			match,
+			output
+		};
+	};
+	/**
+	* Match the basename of a filepath.
+	*
+	* ```js
+	* const picomatch = require('picomatch');
+	* // picomatch.matchBase(input, glob[, options]);
+	* console.log(picomatch.matchBase('foo/bar.js', '*.js'); // true
+	* ```
+	* @param {String} `input` String to test.
+	* @param {RegExp|String} `glob` Glob pattern or regex created by [.makeRe](#makeRe).
+	* @return {Boolean}
+	* @api public
+	*/
+	picomatch.matchBase = (input, glob, options, posix = options && options.windows) => {
+		return (glob instanceof RegExp ? glob : picomatch.makeRe(glob, options)).test(utils.basename(input, { windows: posix }));
+	};
+	/**
+	* Returns true if **any** of the given glob `patterns` match the specified `string`.
+	*
+	* ```js
+	* const picomatch = require('picomatch');
+	* // picomatch.isMatch(string, patterns[, options]);
+	*
+	* console.log(picomatch.isMatch('a.a', ['b.*', '*.a'])); //=> true
+	* console.log(picomatch.isMatch('a.a', 'b.*')); //=> false
+	* ```
+	* @param {String|Array} str The string to test.
+	* @param {String|Array} patterns One or more glob patterns to use for matching.
+	* @param {Object} [options] See available [options](#options).
+	* @return {Boolean} Returns true if any patterns match `str`
+	* @api public
+	*/
+	picomatch.isMatch = (str, patterns, options) => picomatch(patterns, options)(str);
+	/**
+	* Parse a glob pattern to create the source string for a regular
+	* expression.
+	*
+	* ```js
+	* const picomatch = require('picomatch');
+	* const result = picomatch.parse(pattern[, options]);
+	* ```
+	* @param {String} `pattern`
+	* @param {Object} `options`
+	* @return {Object} Returns an object with useful properties and output to be used as a regex source string.
+	* @api public
+	*/
+	picomatch.parse = (pattern, options) => {
+		if (Array.isArray(pattern)) return pattern.map((p) => picomatch.parse(p, options));
+		return parse(pattern, {
+			...options,
+			fastpaths: false
+		});
+	};
+	/**
+	* Scan a glob pattern to separate the pattern into segments.
+	*
+	* ```js
+	* const picomatch = require('picomatch');
+	* // picomatch.scan(input[, options]);
+	*
+	* const result = picomatch.scan('!./foo/*.js');
+	* console.log(result);
+	* { prefix: '!./',
+	*   input: '!./foo/*.js',
+	*   start: 3,
+	*   base: 'foo',
+	*   glob: '*.js',
+	*   isBrace: false,
+	*   isBracket: false,
+	*   isGlob: true,
+	*   isExtglob: false,
+	*   isGlobstar: false,
+	*   negated: true }
+	* ```
+	* @param {String} `input` Glob pattern to scan.
+	* @param {Object} `options`
+	* @return {Object} Returns an object with
+	* @api public
+	*/
+	picomatch.scan = (input, options) => scan(input, options);
+	/**
+	* Compile a regular expression from the `state` object returned by the
+	* [parse()](#parse) method.
+	*
+	* ```js
+	* const picomatch = require('picomatch');
+	* const state = picomatch.parse('*.js');
+	* // picomatch.compileRe(state[, options]);
+	*
+	* console.log(picomatch.compileRe(state));
+	* //=> /^(?:(?!\.)(?=.)[^/]*?\.js)$/
+	* ```
+	* @param {Object} `state`
+	* @param {Object} `options`
+	* @param {Boolean} `returnOutput` Intended for implementors, this argument allows you to return the raw output from the parser.
+	* @param {Boolean} `returnState` Adds the state to a `state` property on the returned regex. Useful for implementors and debugging.
+	* @return {RegExp}
+	* @api public
+	*/
+	picomatch.compileRe = (state, options, returnOutput = false, returnState = false) => {
+		if (returnOutput === true) return state.output;
+		const opts = options || {};
+		const prepend = opts.contains ? "" : "^";
+		const append = opts.contains ? "" : "$";
+		let source = `${prepend}(?:${state.output})${append}`;
+		if (state && state.negated === true) source = `^(?!${source}).*$`;
+		const regex = picomatch.toRegex(source, options);
+		if (returnState === true) regex.state = state;
+		return regex;
+	};
+	/**
+	* Create a regular expression from a parsed glob pattern.
+	*
+	* ```js
+	* const picomatch = require('picomatch');
+	* // picomatch.makeRe(state[, options]);
+	*
+	* const result = picomatch.makeRe('*.js');
+	* console.log(result);
+	* //=> /^(?:(?!\.)(?=.)[^/]*?\.js)$/
+	* ```
+	* @param {String} `state` The object returned from the `.parse` method.
+	* @param {Object} `options`
+	* @param {Boolean} `returnOutput` Implementors may use this argument to return the compiled output, instead of a regular expression. This is not exposed on the options to prevent end-users from mutating the result.
+	* @param {Boolean} `returnState` Implementors may use this argument to return the state from the parsed glob with the returned regular expression.
+	* @return {RegExp} Returns a regex created from the given pattern.
+	* @api public
+	*/
+	picomatch.makeRe = (input, options = {}, returnOutput = false, returnState = false) => {
+		if (!input || typeof input !== "string") throw new TypeError("Expected a non-empty string");
+		let parsed = {
+			negated: false,
+			fastpaths: true
+		};
+		if (options.fastpaths !== false && (input[0] === "." || input[0] === "*")) parsed.output = parse.fastpaths(input, options);
+		if (!parsed.output) parsed = parse(input, options);
+		return picomatch.compileRe(parsed, options, returnOutput, returnState);
+	};
+	/**
+	* Create a regular expression from the given regex source string.
+	*
+	* ```js
+	* const picomatch = require('picomatch');
+	* // picomatch.toRegex(source[, options]);
+	*
+	* const { output } = picomatch.parse('*.js');
+	* console.log(picomatch.toRegex(output));
+	* //=> /^(?:(?!\.)(?=.)[^/]*?\.js)$/
+	* ```
+	* @param {String} `source` Regular expression source string.
+	* @param {Object} `options`
+	* @return {RegExp}
+	* @api public
+	*/
+	picomatch.toRegex = (source, options) => {
+		try {
+			const opts = options || {};
+			return new RegExp(source, opts.flags || (opts.nocase ? "i" : ""));
+		} catch (err) {
+			if (options && options.debug === true) throw err;
+			return /$^/;
+		}
+	};
+	/**
+	* Picomatch constants.
+	* @return {Object}
+	*/
+	picomatch.constants = constants;
+	/**
+	* Expose "picomatch"
+	*/
+	module.exports = picomatch;
+}));
+//#endregion
+//#region src/lint-cli/lib/files/constants.ts
+var import_picomatch = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const pico = require_picomatch$1();
+	const utils = require_utils();
+	function picomatch(glob, options, returnState = false) {
+		if (options && (options.windows === null || options.windows === void 0)) options = {
+			...options,
+			windows: utils.isWindows()
+		};
+		return pico(glob, options, returnState);
+	}
+	Object.assign(picomatch, pico);
+	module.exports = picomatch;
+})))(), 1);
+/** Matches a flat-config entry-point basename (`eslint.config.*`). */
+const ESLINT_CONFIG_FILE_PATTERN = /^eslint\.config\./;
+/**
+* Glob patterns whose modification invalidates every ESLint cache. A bare
+* `*` never crosses a path separator, so single-segment patterns (for example
+* `*.config.*` or the lockfiles) only match root-level files, while
+* `**` patterns match at any depth.
+*/
+const CACHE_BUST_PATTERNS = [
+	"eslint.config.*",
+	"*.config.*",
+	"**/tsconfig*.json",
+	".oxlintrc*",
+	".prettierrc*",
+	"pnpm-lock.yaml",
+	"package-lock.json",
+	"yarn.lock",
+	"bun.lock",
+	"bun.lockb"
+];
+//#endregion
+//#region src/lint-cli/lib/files/collect.ts
+const ANCESTOR_BUST_PATTERNS = CACHE_BUST_PATTERNS.map((pattern) => {
+	return pattern.startsWith("**/") ? pattern.slice(3) : pattern;
+});
+const IGNORED_WALK_DIRECTORIES = /* @__PURE__ */ new Set([
+	".git",
+	".next",
+	".turbo",
+	"build",
+	"coverage",
+	"dist",
+	"node_modules",
+	"out"
+]);
+const LINTABLE_EXTENSION_SET = new Set(GLOB_LINTABLE_EXTENSIONS.map((extension) => `.${extension}`));
+const TYPE_AWARE_EXTENSION_SET = new Set(GLOB_SRC_EXTENSIONS.map((extension) => `.${extension}`));
+/**
+* Collect every file list a run needs from a single whole-project
+* `git ls-files` (honouring `.gitignore`), rather than re-spawning git for each
+* pass. The one scan feeds three filters: the cache-bust set (config files,
+* tsconfigs, lockfiles — always whole-project), the lintable files restricted
+* to `targets`, and their type-aware subset.
+*
+* @param cwd - The project root to scan.
+* @param targets - The lint target paths that restrict the lintable set.
+* @returns The cache-bust, lintable and type-aware file lists.
+*/
+function collectRepoFiles(cwd, targets) {
+	const relatives = listFiles(cwd, ["."]);
+	const isBustFile = (0, import_picomatch.default)([...CACHE_BUST_PATTERNS], { dot: true });
+	const normalizedTargets = targets.map((target) => normalizeTarget(target, cwd));
+	const targetsOutsideCwd = normalizedTargets.some((target) => isOutsideCwd(target));
+	const isWithinTargets = matchTargets(normalizedTargets);
+	const bustFiles = collectAncestorBustFiles(cwd);
+	const lintable = [];
+	const typeAware = [];
+	for (const relative of relatives) {
+		if (isBustFile(relative)) bustFiles.push(path.resolve(cwd, relative));
+		if (isWithinTargets(relative) && hasLintableExtension(relative)) {
+			const absolute = path.resolve(cwd, relative);
+			lintable.push(absolute);
+			if (isTypeAwareFile(relative)) typeAware.push(absolute);
+		}
+	}
+	return {
+		bustFiles,
+		configFiles: bustFiles.filter(isConfigEntryPoint),
+		lintable,
+		targetsOutsideCwd,
+		typeAware
+	};
+}
+/**
+* Drop the files ESLint declines to lint from the *target* lists, leaving the
+* rest of the listing untouched.
+*
+* Only the `lintable` and `typeAware` lists are lint targets. The `bustFiles`
+* and `configFiles` lists are whole-project cache-bust inputs — a tsconfig or
+* lockfile is never linted, so filtering them by "would ESLint lint this" would
+* empty them. Any list added to {@link RepoFiles} later has to make that same
+* choice here, which is why this lives beside the type rather than at the call
+* site.
+*
+* @param files - The collected repository files.
+* @param ignored - The ignored set from `resolveIgnoredFiles` (normalized keys).
+* @returns The listing with its target lists filtered.
+*/
+function withoutIgnored(files, ignored) {
+	return {
+		...files,
+		lintable: retained(files.lintable, ignored),
+		typeAware: retained(files.typeAware, ignored)
+	};
+}
+/**
+* Restrict explicit lint targets to the ones oxlint could lint. Oxlint only
+* handles the TS/JS family, and exits non-zero with "No files found to lint"
+* when every path it was handed resolves to nothing — so a hook run over a
+* `package.json`-only change would fail on a file oxlint was never going to
+* lint. A path is kept when its extension is type-aware, when it has no
+* extension, or when it is an existing directory (either may hold TS/JS files).
+*
+* Surviving targets are then dropped when oxlint's own ignore matching would
+* skip them (see {@link gitIgnoredTargets}): a hook stages a `.gitignore`d yet
+* git-tracked file (a committed generated `*.d.ts`, say), which passes the
+* extension test but is the exact all-ignored set oxlint exits non-zero on.
+*
+* @param cwd - The working directory to resolve targets against.
+* @param targets - The explicit lint target paths.
+* @returns The subset oxlint should receive.
+*/
+function oxlintTargets(cwd, targets) {
+	const candidates = targets.filter((target) => {
+		const extension = path.extname(target).toLowerCase();
+		if (extension === "" || TYPE_AWARE_EXTENSION_SET.has(extension)) return true;
+		try {
+			return fs.statSync(path.resolve(cwd, target)).isDirectory();
+		} catch {
+			return false;
+		}
+	});
+	if (candidates.length === 0) return candidates;
+	const ignored = gitIgnoredTargets(cwd, candidates);
+	return candidates.filter((target) => !ignored.has(target));
+}
+/**
+* Whether an absolute path is a flat-config entry point.
+*
+* @param file - The absolute path to test.
+* @returns True when the basename matches `eslint.config.*`.
+*/
+function isConfigEntryPoint(file) {
+	return ESLINT_CONFIG_FILE_PATTERN.test(path.basename(file));
+}
+/**
+* Scan the single-segment cache-bust candidates in each directory from `cwd`'s
+* parent up to and including the workspace root. A sub-package `git ls-files`
+* only lists files under `cwd`, so a hoisted root lockfile, tsconfig or ESLint
+* config change would otherwise never bust the caches. Returns absolute paths
+* (fine for mtime comparison); empty when `cwd` is itself the root.
+*
+* @param cwd - The project (sub-package) root to walk up from.
+* @returns Absolute paths of the ancestor cache-bust files.
+*/
+function collectAncestorBustFiles(cwd) {
+	const root = findWorkspaceRoot(cwd);
+	if (root === cwd) return [];
+	const isBustName = (0, import_picomatch.default)([...ANCESTOR_BUST_PATTERNS], { dot: true });
+	const found = [];
+	let current = path.dirname(cwd);
+	for (;;) {
+		let entries = [];
+		try {
+			entries = fs.readdirSync(current, { withFileTypes: true });
+		} catch {
+			entries = [];
+		}
+		for (const entry of entries) if (entry.isFile() && isBustName(entry.name)) found.push(path.join(current, entry.name));
+		const parent = path.dirname(current);
+		if (current === root || parent === current) break;
+		current = parent;
+	}
+	return found;
+}
+/**
+* Reduce a raw target to the cwd-relative posix form the listing is keyed by.
+* Absolute targets (including Windows drive paths) are relativized against
+* `cwd`; `./` prefixes and trailing slashes are stripped. A target that
+* resolves to `cwd` itself becomes `""` (match-all). Targets outside `cwd` keep
+* their `..`-prefixed relative form so {@link isOutsideCwd} can flag them.
+*
+* @param target - The raw lint target path.
+* @param cwd - The working directory to relativize against.
+* @returns The normalized cwd-relative posix target.
+*/
+function normalizeTarget(target, cwd) {
+	let value = path.isAbsolute(target) ? toPosix(path.relative(cwd, target)) : toPosix(target);
+	if (value.startsWith("./")) value = value.slice(2);
+	while (value.endsWith("/")) value = value.slice(0, -1);
+	return value;
+}
+/**
+* Whether a normalized target lies outside `cwd`. A cwd-relative listing never
+* starts with `..`, so any `..`-prefixed target can never match — its files are
+* invisible to the dirty count.
+*
+* @param normalizedTarget - A target already run through {@link normalizeTarget}.
+* @returns True when the target escapes `cwd`.
+*/
+function isOutsideCwd(normalizedTarget) {
+	return normalizedTarget === ".." || normalizedTarget.startsWith("../");
+}
+/**
+* Build a predicate for git-pathspec-style target membership: `.` matches
+* everything, otherwise a relative path matches when it equals a target or sits
+* beneath one. Faithful to `git ls-files -- <target>` for the plain directory
+* and file targets consumers pass.
+*
+* @param normalized - The lint target paths, already normalized against cwd.
+* @returns A predicate testing whether a relative posix path is a target.
+*/
+function matchTargets(normalized) {
+	if (normalized.some((target) => target === "" || target === ".")) return () => true;
+	return (relative) => {
+		return normalized.some((target) => relative === target || relative.startsWith(`${target}/`));
+	};
+}
+function isTypeAwareFile(filePath) {
+	return TYPE_AWARE_EXTENSION_SET.has(path.extname(filePath).toLowerCase());
+}
+function hasLintableExtension(filePath) {
+	return LINTABLE_EXTENSION_SET.has(path.extname(filePath).toLowerCase());
+}
+function gitListFiles(cwd, pathSpecs) {
+	try {
+		return execFileSync("git", [
+			"ls-files",
+			"--cached",
+			"--others",
+			"--exclude-standard",
+			"--",
+			...pathSpecs
+		], {
+			cwd,
+			encoding: "utf8",
+			maxBuffer: 64 * 1024 * 1024
+		}).split("\n").filter((line) => line.length > 0);
+	} catch {
+		return;
+	}
+}
+function walkDirectory(root, current, accumulator) {
+	let entries;
+	try {
+		entries = fs.readdirSync(current, { withFileTypes: true });
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		const entryPath = path.join(current, entry.name);
+		if (entry.isDirectory()) {
+			if (!IGNORED_WALK_DIRECTORIES.has(entry.name)) walkDirectory(root, entryPath, accumulator);
+			continue;
+		}
+		if (entry.isFile()) accumulator.push(toPosix(path.relative(root, entryPath)));
+	}
+}
+function walkFallback(cwd, targets) {
+	const files = [];
+	for (const target of targets) {
+		const absolute = path.resolve(cwd, target);
+		let stat;
+		try {
+			stat = fs.statSync(absolute);
+		} catch {
+			continue;
+		}
+		if (stat.isDirectory()) walkDirectory(cwd, absolute, files);
+		else if (stat.isFile()) files.push(toPosix(path.relative(cwd, absolute)));
+	}
+	return files;
+}
+function listFiles(cwd, targets) {
+	return gitListFiles(cwd, targets) ?? walkFallback(cwd, targets);
+}
+function retained(files, ignored) {
+	return files.filter((file) => !ignored.has(normalizePath(file)));
+}
+/**
+* The subset of `targets` oxlint's own ignore matching would skip, echoed back
+* verbatim by `git check-ignore`. Empty when git cannot answer (outside a repo,
+* git absent) or when nothing matches — either way the caller drops nothing,
+* the behaviour before this existed.
+*
+* Oxlint matches `.gitignore` rules through the `ignore` crate, which never
+* consults git's index — so a file that is `.gitignore`d yet git-*tracked* is
+* ignored by oxlint all the same. `--no-index` is the flag that makes git
+* agree: without it, git reports a tracked file as not-ignored and we keep
+* handing oxlint a path it refuses. `check-ignore` exits 1 (printing nothing)
+* when no path matches, which `execFileSync` raises as a throw —
+* indistinguishable here from git being absent, and correctly so: both mean
+* "drop nothing"..
+*
+* @param cwd - The working directory to resolve targets against.
+* @param targets - The candidate target paths, passed verbatim on stdin.
+* @returns The ignored subset, matched against the original target strings.
+*/
+function gitIgnoredTargets(cwd, targets) {
+	try {
+		const output = execFileSync("git", [
+			"check-ignore",
+			"--no-index",
+			"--stdin"
+		], {
+			cwd,
+			encoding: "utf8",
+			input: targets.join("\n"),
+			maxBuffer: 64 * 1024 * 1024,
+			stdio: [
+				"pipe",
+				"pipe",
+				"ignore"
+			]
+		});
+		return new Set(output.split("\n").map((line) => line.trim()).filter(Boolean));
+	} catch {
+		return /* @__PURE__ */ new Set();
+	}
+}
+//#endregion
+//#region src/lint-cli/lib/exec/eslint-install.ts
+/**
+* Locating the ESLint installation a run's config is resolved against.
+*
+* The runner and its ignore helper both need it and must agree: the helper
+* serializes the config's match patterns out of one ESLint's config loader, and
+* the runner evaluates them with that same ESLint's matcher. Resolving them
+* separately would let the two drift onto different installations, and a
+* matcher that disagrees with the one that produced the patterns is exactly the
+* failure this feature cannot have.
+*/
+/**
+* A synthetic basename for `createRequire`, which resolves relative to a file
+* rather than a directory. Spelled so it can never collide with a real consumer
+* module.
+*/
+const RESOLVE_ANCHOR = "__isentinel-lint__.js";
+/**
+* Resolve the ESLint the consumer's config will be linted with: their own,
+* resolved from `cwd`, falling back to the one resolvable from this file (the
+* hoisted peer dependency) when `cwd` has no `node_modules` of its own — the
+* case in the fixture-based tests.
+*
+* @param cwd - The consumer project root.
+* @returns The package root and a require anchored in it.
+* @throws {Error} When ESLint cannot be resolved from either location.
+*/
+function resolveEslintInstall(cwd) {
+	let packageJson;
+	try {
+		packageJson = createRequire(path.join(cwd, RESOLVE_ANCHOR)).resolve("eslint/package.json");
+	} catch {
+		packageJson = createRequire(import.meta.url).resolve("eslint/package.json");
+	}
+	return {
+		requireFrom: createRequire(packageJson),
+		root: path.dirname(packageJson)
+	};
+}
+//#endregion
+//#region src/lint-cli/lib/files/ignored-predicate.ts
+/**
+* The serialized form of a resolved config's match patterns, and the in-process
+* evaluation of it. Produced by {@link file://./ignored-child.ts}, consumed by
+* {@link file://./ignored.ts}.
+*
+* The patterns are evaluated with the same `@eslint/config-array` the
+* consumer's ESLint uses, not a re-implementation: the matcher is the part
+* that has to agree exactly, since a file wrongly classified as ignored is
+* dropped from the dirty count and can skip a typed pass that had work to do.
+*/
+/**
+* Classify lint targets against a stored payload.
+*
+* An `"answers"` payload only knows the targets it was computed from, so
+* anything else is reported not-ignored — the safe direction, which over-counts
+* dirty files rather than skipping work. A `"predicate"` payload knows the
+* config itself and classifies any path, including files added since it was
+* stored.
+*
+* A path counts as ignored when its status is anything but `"matched"`: a file
+* no config's `files` covers is `"unconfigured"` rather than `"ignored"`, and
+* ESLint declines to lint it just the same.
+*
+* @param cwd - The consumer project root, used to resolve the matcher.
+* @param payload - The stored payload.
+* @param targets - The absolute target paths to classify.
+* @returns The ignored subset of `targets`, or `undefined` when the payload
+*   could not be evaluated.
+*/
+function classifyIgnored(cwd, payload, targets) {
+	if (payload.mode === "answers") {
+		const wanted = new Set(targets);
+		return payload.ignored.filter((file) => wanted.has(file));
+	}
+	try {
+		const { ConfigArray } = loadConfigArrayModule(cwd);
+		const configArray = new ConfigArray(payload.entries, { basePath: payload.basePath });
+		configArray.normalizeSync();
+		return targets.filter((target) => configArray.getConfigStatus(target) !== "matched");
+	} catch {
+		return;
+	}
+}
+/**
+* Whether a required module exposes the `ConfigArray` constructor this module
+* uses.
+*
+* @param value - The required module's exports.
+* @returns Whether the exports carry a `ConfigArray` constructor.
+*/
+function isConfigArrayModule(value) {
+	return isRecord(value) && typeof value["ConfigArray"] === "function";
+}
+/**
+* Load the matcher out of the consumer's own ESLint installation, so the
+* patterns are evaluated by the same version that produced them.
+*
+* @param cwd - The consumer project root.
+* @returns The `@eslint/config-array` module namespace.
+* @throws {Error} When neither ESLint nor its config-array can be resolved.
+*/
+function loadConfigArrayModule(cwd) {
+	const required = resolveEslintInstall(cwd).requireFrom("@eslint/config-array");
+	if (!isConfigArrayModule(required)) throw new Error("@eslint/config-array did not export a ConfigArray constructor");
+	return required;
+}
+//#endregion
+//#region src/lint-cli/lib/files/ignored.ts
+/**
+* Whether a value is a serializable predicate-entry array. The child writes it,
+* so its element shape is trusted to its array-ness — a wrong element throws
+* where the payload is used, and that degrades to no filtering all the same.
+*
+* @param value - The value to test.
+* @returns Whether the value is an array of {@link PredicateEntry}.
+*/
+function isPredicateEntryArray(value) {
+	return Array.isArray(value);
+}
+/** Reused for every miss, so callers never allocate on the no-op path. */
+const EMPTY = /* @__PURE__ */ new Set();
+/**
+* Resolve the persisted ignore-set file for a config variant, keyed by the same
+* variant as the config hash it stores.
+*
+* @param run - The run context.
+* @returns The absolute path to the stored ignore-set file.
+*/
+function ignoredStatePath(run) {
+	return statePath(run.cwd, "ignored", run.key);
+}
+/**
+* The lint targets ESLint declines to lint, as {@link normalizePath} keys, so
+* the runner can drop them from its dirty count.
+*
+* The file lists come from `git ls-files` filtered by extension and know
+* nothing of the config's own `ignores`. ESLint writes no cache entry for a
+* file it never lints, so every consumer-ignored file is reported dirty on
+* every run, forever — which floors the type-aware pass's dirty count above
+* zero and makes its auto-skip unreachable.
+*
+* Asking ESLint itself is the only correct answer, but loading a consumer's
+* flat config costs several seconds. It is therefore memoised against the same
+* config hash that drives the cache-drift bust: the answer can only change when
+* the resolved config changes. That recompute is a blocking cost on the run
+* that pays it, but it is a run whose caches the drift bust just deleted, so
+* every file re-lints anyway — and the ignore set still sizes that re-lint's
+* workers, which is why it is computed then rather than deferred.
+*
+* What is memoised is the config's *patterns*, not its answers about one
+* target list. Storing answers made the memo a partial function over a file
+* list that kept moving: every file added after the last config change was
+* absent from the set, counted not-ignored, and floored the typed pass's dirty
+* count above zero forever. Patterns depend on the config alone, which is what
+* the key already says, so new files classify with no helper spawn at all.
+*
+* The answers are still stored, but now as a cache *derived* from the patterns
+* rather than as the source of truth: a target the cache does not cover is
+* matched against the patterns rather than assumed not-ignored, which is the
+* whole difference. It exists because that match costs ~300µs per path, so a
+* few thousand targets would otherwise add a second to every run — the cost the
+* memo exists to avoid, charged a little at a time.
+*
+* A config whose `files`/`ignores` hold function matchers cannot be
+* serialized; the helper falls back to answering per target, and that payload
+* keeps the old residual — targets absent from it read as not-ignored, which
+* over-counts dirty files rather than skipping work.
+*
+* @param run - The run context.
+* @param configHash - The config hash for this run, or `undefined` when
+*   unavailable (the memo is then unusable and no filtering happens).
+* @param targets - Every lintable target, absolute (see `RepoFiles.lintable`).
+* @returns The ignored subset of `targets`, or an empty set when unavailable.
+*/
+function resolveIgnoredFiles(run, configHash, targets) {
+	if (configHash === void 0 || targets.length === 0) return EMPTY;
+	const { cwd, mutate } = run;
+	const stateFile = ignoredStatePath(run);
+	const stored = readState(stateFile);
+	const fresh = stored?.hash === configHash ? stored : void 0;
+	let payload = fresh?.payload;
+	if (payload === void 0) {
+		if (!mutate) return EMPTY;
+		payload = queryIgnoredFiles(cwd, targets);
+		if (payload === void 0) return EMPTY;
+	}
+	const classified = classifyTargets(cwd, payload, targets, fresh?.classified);
+	if (classified === void 0) return EMPTY;
+	if (mutate && !sameClassification(classified, fresh?.classified)) writeState(stateFile, {
+		classified,
+		hash: configHash,
+		payload
+	});
+	return new Set(classified.ignored);
+}
+/**
+* Split the targets by whether ESLint would lint them, asking the payload only
+* about the ones the stored classification does not already cover — which after
+* the first run means only the files added since it.
+*
+* The result covers exactly the current targets, so storing it also drops the
+* entries for files that have gone away.
+*
+* @param cwd - The consumer project root.
+* @param payload - The patterns (or answers) to classify against.
+* @param targets - The absolute target paths this run cares about.
+* @param cached - The stored classification, when one applies to this payload.
+* @returns The split, or `undefined` when the payload could not be evaluated.
+*/
+function classifyTargets(cwd, payload, targets, cached) {
+	const known = /* @__PURE__ */ new Map();
+	const cachedIgnored = cached?.ignored ?? [];
+	const cachedLinted = cached?.linted ?? [];
+	for (const file of cachedIgnored) known.set(file, true);
+	for (const file of cachedLinted) known.set(file, false);
+	const byKey = new Map(targets.map((target) => [normalizePath(target), target]));
+	const unknown = [...byKey].filter(([key]) => !known.has(key));
+	if (unknown.length > 0) {
+		const ignored = classifyIgnored(cwd, payload, unknown.map(([, target]) => target));
+		if (ignored === void 0) return;
+		const ignoredKeys = new Set(ignored.map((file) => normalizePath(file)));
+		for (const [key] of unknown) known.set(key, ignoredKeys.has(key));
+	}
+	const classified = {
+		ignored: [],
+		linted: []
+	};
+	for (const key of byKey.keys()) (known.get(key) === true ? classified.ignored : classified.linted).push(key);
+	return classified;
+}
+/**
+* Whether a classification is the one already on disk, so an unchanged run can
+* skip rewriting it.
+*
+* @param classified - The classification this run computed.
+* @param cached - The stored classification, when one applies.
+* @returns True when the two cover the same targets.
+*/
+function sameClassification(classified, cached) {
+	return cached !== void 0 && cached.ignored.length === classified.ignored.length && cached.linted.length === classified.linted.length;
+}
+/**
+* Spawn the helper and read back its payload. Every failure mode (no
+* resolvable ESLint, a config that throws, a malformed result) degrades to
+* `undefined`, which the caller treats as "no filtering" — the behaviour
+* before this existed.
+*
+* The result comes back through a scratch file rather than stdout: loading a
+* consumer's config evaluates their plugins, and anything one of those prints
+* would land in the middle of the JSON.
+*
+* @param cwd - The consumer project root.
+* @param targets - The target files the fallback path classifies.
+* @returns The helper's payload, or `undefined` when the query failed.
+*/
+function queryIgnoredFiles(cwd, targets) {
+	const outFile = path.join(os.tmpdir(), `isentinel-lint-ignored-${process$1.pid}.json`);
+	try {
+		execFileSync(process$1.execPath, [
+			resolveIgnoredHelper(),
+			cwd,
+			outFile
+		], {
+			cwd,
+			input: JSON.stringify(targets),
+			maxBuffer: 64 * 1024 * 1024,
+			stdio: [
+				"pipe",
+				"ignore",
+				"ignore"
+			]
+		});
+		const parsed = JSON.parse(fs.readFileSync(outFile, "utf8"));
+		if (!isRecord(parsed)) return;
+		const { basePath, entries, ignored, mode } = parsed;
+		if (mode === "answers" && isStringArray(ignored)) return {
+			ignored,
+			mode
+		};
+		if (mode === "predicate" && typeof basePath === "string" && isPredicateEntryArray(entries)) return {
+			basePath,
+			entries,
+			mode
+		};
+		return;
+	} catch {
+		return;
+	} finally {
+		fs.rmSync(outFile, { force: true });
+	}
+}
+//#endregion
+//#region src/hybrid-status.ts
+/**
+* Absolute path to the hybrid-status file for a project root.
+*
+* @param cwd - The project root.
+* @returns The absolute status-file path.
+*/
+function hybridStatusPath(cwd) {
+	return statePath(cwd, "hybrid-status");
+}
+/**
+* Read the persisted hybrid status, or `undefined` when the file is missing,
+* unreadable or malformed (the CLI then treats the status as unknown).
+*
+* @param cwd - The project root.
+* @returns The parsed status, or `undefined`.
+*/
+function readHybridStatus(cwd) {
+	const stored = readState(hybridStatusPath(cwd));
+	return typeof stored?.oxlint === "boolean" ? stored : void 0;
+}
+/**
+* Passively record whether the resolved ESLint config runs in hybrid mode.
+* Called from the factory on every config evaluation, so an unchanged status is
+* touched rather than rewritten: the file must not churn as editors and both
+* lint passes re-evaluate the config, yet its mtime must stay ahead of the
+* config's or the CLI re-runs its ~3s probe every lint. Every failure is
+* swallowed — config evaluation must never throw for this, and the CLI treats a
+* missing or stale file as "unknown" and re-probes.
+*
+* Skipped entirely when `node_modules` is absent (nothing installed, so no
+* cache home and no CLI to read it).
+*
+* @param cwd - The project root.
+* @param oxlint - Whether the config enabled hybrid mode.
+*/
+function writeHybridStatus(cwd, oxlint) {
+	let installed;
+	try {
+		installed = fs.existsSync(path.resolve(cwd, "node_modules"));
+	} catch {
+		return;
+	}
+	if (!installed) return;
+	const filePath = hybridStatusPath(cwd);
+	if (readHybridStatus(cwd)?.oxlint === oxlint) {
+		touchState(filePath);
+		return;
+	}
+	writeState(filePath, { oxlint });
+}
+//#endregion
+//#region src/lint-cli/lib/hybrid/probe.ts
+/**
+* Read the hybrid marker from `eslint --print-config` stdout. Config evaluation
+* can print non-JSON before the payload (plugin/editor-detection logs), so the
+* JSON object is isolated (first `{` to last `}`) before parsing. Returns
+* `undefined` when no JSON object is present or it fails to parse.
+*
+* @param stdout - The raw `--print-config` stdout.
+* @returns The probed status, or `undefined` when unparseable.
+*/
+function parseHybridPrintConfig(stdout) {
+	const first = stdout.indexOf("{");
+	const last = stdout.lastIndexOf("}");
+	if (first === -1 || last < first) return;
+	try {
+		const config = JSON.parse(stdout.slice(first, last + 1));
+		const settings = isRecord(config) ? config["settings"] : void 0;
+		return { oxlint: isRecord(settings) && settings["isentinel/oxlint"] === true };
+	} catch {
+		return;
+	}
+}
+/**
+* The real prober: spawn the resolved local ESLint with `--print-config` and
+* read the hybrid marker from the merged `settings`.
+*
+* @param cwd - The project root.
+* @param target - A file whose resolved config carries the marker.
+* @returns The probed status, or `undefined` on any failure.
+*/
+function probeHybridConfig(cwd, target) {
+	let binJs;
+	try {
+		binJs = resolveLocalBin("eslint", cwd);
+	} catch {
+		return;
+	}
+	const result = spawnSync(process$1.execPath, [
+		binJs,
+		"--print-config",
+		target
+	], {
+		cwd,
+		encoding: "utf8",
+		maxBuffer: 64 * 1024 * 1024
+	});
+	if (result.status !== 0 || typeof result.stdout !== "string") return;
+	return parseHybridPrintConfig(result.stdout);
+}
+//#endregion
+//#region src/lint-cli/lib/hybrid/gate.ts
+/**
+* The stderr warning emitted when the resolved ESLint config is not hybrid, so
+* running oxlint too would double-lint every mapped rule. Oxlint is dropped.
+*/
+const NON_HYBRID_WARNING = "isentinel-lint: the ESLint config does not enable hybrid mode (`oxlint: true` or `oxlint: \"native\"`), so oxlint would re-run rules ESLint already checks. Running ESLint only; enable hybrid mode in your config or pass --oxlint to run oxlint explicitly.\n";
+/**
+* The stderr warning emitted when the hybrid status cannot be determined (the
+* probe failed). The run fails open: both engines run, as before.
+*/
+const HYBRID_UNKNOWN_WARNING = "isentinel-lint: could not determine whether the ESLint config enables hybrid mode; running both engines.\n";
+/**
+* Decide whether the oxlint child runs. When both engines would run (default
+* mode or `--fix`, i.e. Neither `--eslint` nor `--oxlint`), the ESLint config
+* must be hybrid or oxlint would double-lint every mapped rule; a non-hybrid
+* config drops oxlint with a warning. Explicit single-tool runs skip the check
+* entirely and keep today's behaviour.
+*
+* The hybrid status is trusted from the on-disk `hybrid-status` file when it is
+* at least as new as the ESLint config; otherwise the resolved config is
+* actively probed (unless `mutate` is false, e.g. `--print`, which never probes
+* and assumes hybrid). A probe failure fails open: both engines run.
+*
+* @param run - The run context.
+* @param input - The assembled plan-phase inputs.
+* @param probe - The config prober (injected in tests).
+* @returns The oxlint run decision.
+*/
+function resolveOxlintRun(run, input, probe = probeHybridConfig) {
+	if (!input.runOxlint || !input.runEslint) return {
+		reason: void 0,
+		run: input.runOxlint
+	};
+	const status = resolveHybridStatus(run, input, probe);
+	if (status === void 0) return {
+		reason: HYBRID_UNKNOWN_WARNING,
+		run: true
+	};
+	if (!status.oxlint) return {
+		reason: NON_HYBRID_WARNING,
+		run: false
+	};
+	return {
+		reason: void 0,
+		run: true
+	};
+}
+/**
+* Read the cached hybrid status only when it is at least as new as the ESLint
+* config; a stale or missing file yields `undefined` (the caller then probes).
+*
+* Known limitation: freshness tracks `eslint.config.*` mtimes only, so toggling
+* hybrid mode from a module the config *imports* (rather than the config file
+* itself) is trusted from the cache for one more run before the factory's
+* passive write corrects it — it self-heals on the next invocation.
+*
+* @param cwd - The project root.
+* @param configMtime - The newest ESLint-config mtime, or `undefined` when none.
+* @returns The fresh cached status, or `undefined`.
+*/
+function readFreshHybridStatus(cwd, configMtime) {
+	const status = readHybridStatus(cwd);
+	if (status === void 0) return;
+	if (configMtime === void 0) return status;
+	const statusMtime = maxMtimeMs([hybridStatusPath(cwd)]);
+	if (statusMtime === void 0 || statusMtime < configMtime) return;
+	return status;
+}
+/**
+* Resolve the hybrid status, trusting a fresh cache file and otherwise probing.
+* Returns `undefined` only when a probe was attempted and failed.
+*
+* @param run - The run context.
+* @param input - The assembled plan-phase inputs.
+* @param probe - The config prober.
+* @returns The hybrid status, or `undefined` when a probe failed.
+*/
+function resolveHybridStatus({ cwd, mutate }, { files }, probe) {
+	const cached = readFreshHybridStatus(cwd, maxMtimeMs(files.configFiles));
+	if (cached !== void 0) return cached;
+	if (!mutate) return { oxlint: true };
+	const target = files.typeAware[0] ?? files.configFiles[0];
+	if (target === void 0) return;
+	const probed = probe(cwd, target);
+	if (probed === void 0) return;
+	writeHybridStatus(cwd, probed.oxlint);
+	return probed;
+}
+/**
+* Derive the worker limits from environment overrides, falling back to the
+* default files-per-worker and a share of the available parallelism.
+*
+* A type-aware worker costs a fixed TypeScript program build plus roughly
+* 10-20ms per file. The build is not a constant: `projectService` only builds
+* the projects covering the files a worker was given, so splitting the run
+* splits the build too — but each split still repeats the per-project floor,
+* which is what keeps the sweet spot near 300 files per worker rather than
+* ESLint's syntax-tuned `auto`.
+*
+* Locally the cap is a quarter of the CPUs: the fast and typed passes run as
+* siblings alongside oxlint (and usually an editor), so each pass only gets a
+* share. In CI the run collapses to a single full pass with nothing to reserve
+* for, and a 4-core CI runner sweep (3.1k-file repo) measured monotonic
+* improvement all the way to workers = cores — 200s single-process against 53s
+* at 4 workers — so CI uses the full parallelism instead.
+*
+* @param environment - The environment variables to read overrides from.
+* @param availableParallelism - The number of available CPUs.
+* @param ci - Whether the run is in CI (single pass, idle machine).
+* @returns The resolved worker limits.
+*/
+function resolveWorkerLimits(environment, availableParallelism, ci) {
+	const filesPerWorker = parsePositiveInteger(environment["FILES_PER_WORKER"]) ?? 300;
+	const explicit = parsePositiveInteger(environment["LINT_MAX_WORKERS"]);
+	const maxWorkers = explicit ?? (ci ? availableParallelism : Math.floor(availableParallelism / 4));
+	return {
+		filesPerWorker,
+		maxWorkers,
+		typedMaxWorkers: explicit ?? Math.min(maxWorkers, 6)
+	};
+}
+/**
+* Resolve the fast pass's files-per-worker, honouring the
+* `FAST_FILES_PER_WORKER` override. The fast pass lints each file syntactically
+* in isolation, so its break-even worker size is far higher than the type-aware
+* pass (see {@link DEFAULT_FAST_FILES_PER_WORKER}).
+*
+* @param environment - The environment variables to read the override from.
+* @returns The resolved fast-pass files-per-worker.
+*/
+function resolveFastFilesPerWorker(environment) {
+	return parsePositiveInteger(environment["FAST_FILES_PER_WORKER"]) ?? 800;
+}
+/**
+* Compute ESLint's `--concurrency` value. Returns `"off"` when a single worker
+* (or fewer) would be used, since parallelism only pays off past that point.
+*
+* @param input - The dirty count and worker limits.
+* @returns The worker count, or `"off"` to disable parallelism.
+*/
+function computeWorkerCount({ dirtyCount, filesPerWorker, maxWorkers }) {
+	if (dirtyCount <= 0 || filesPerWorker <= 0 || maxWorkers <= 0) return "off";
+	const workers = Math.min(Math.ceil(dirtyCount / filesPerWorker), maxWorkers);
+	if (workers < 2) return "off";
+	return workers;
+}
+function parsePositiveInteger(value) {
+	return parseBoundedInteger(value, 1);
+}
+//#endregion
+//#region src/lint-cli/lib/plan/passes.ts
+/**
+* The syntactic-only fast pass (`ESLINT_TYPE_AWARE=off`, `.eslintcache-fast`).
+*/
+const FAST_PASS = {
+	cacheFileBase: CACHE_FILE_FAST,
+	filesPerWorker: (_limits, environment) => resolveFastFilesPerWorker(environment),
+	invalidation: "none",
+	label: "fast",
+	typeAwareEnv: "off",
+	typeAwareOnly: false
+};
+/** The type-aware pass (`ESLINT_TYPE_AWARE=only`, `.eslintcache-typeaware`). */
+const TYPED_PASS = {
+	cacheFileBase: CACHE_FILE_TYPE_AWARE,
+	filesPerWorker: (limits) => limits.filesPerWorker,
+	invalidation: "only",
+	label: "typed",
+	typeAwareEnv: "only",
+	typeAwareOnly: true
+};
+/** The full-config pass (env unset, `.eslintcache`): CI, `--fix`, `=full`. */
+const FULL_PASS = {
+	cacheFileBase: CACHE_FILE_DEFAULT,
+	filesPerWorker: (limits) => limits.filesPerWorker,
+	invalidation: "full",
+	label: "eslint",
+	typeAwareEnv: void 0,
+	typeAwareOnly: false
+};
+/**
+* Select the ESLint passes for the resolved mode. An explicit `--type-aware`
+* always wins: `=full` (and `--fix`) collapse to the single full pass, while
+* `=off`/`=only` run their one pass even in CI. Only when no mode is given does
+* CI change the default — collapsing the concurrent two-pass split to one full
+* pass; a local default run keeps the split (the typed pass may later be
+* skipped). CI's `--cache-strategy content` is applied by the command composer
+* to whichever pass runs, independently of this selection.
+*
+* @param options - The parsed CLI options.
+* @param ci - Whether the run is in CI.
+* @returns The pass descriptors to plan, in run order.
+*/
+function selectPasses(options, ci) {
+	if (options.fix || options.typeAware === "full") return [FULL_PASS];
+	if (options.typeAware === "off") return [FAST_PASS];
+	if (options.typeAware === "only") return [TYPED_PASS];
+	if (ci) return [FULL_PASS];
+	return [FAST_PASS, TYPED_PASS];
+}
+/**
+* The worker cap for a pass. `invalidation` already records whether a pass
+* builds a TypeScript program — the fast pass runs no builder precisely because
+* it builds none — so it doubles as the cap selector rather than restating the
+* same fact per descriptor.
+*
+* @param descriptor - The pass being sized.
+* @param limits - The shared worker limits.
+* @returns The worker cap for this pass.
+*/
+function maxWorkersFor(descriptor, limits) {
+	return descriptor.invalidation === "none" ? limits.maxWorkers : limits.typedMaxWorkers;
+}
+//#endregion
+//#region src/lint-cli/lib/typescript/affected.ts
+const warned = /* @__PURE__ */ new Set();
+/**
+* Compute the set of files whose type-aware lint results may have changed since
+* the previous run, using TypeScript's builder API. The builder does a native
+* shape-hash BFS: it recomputes each dependent's emitted-`.d.ts` shape hash and
+* stops propagating where shapes stabilise, so an implementation-only edit
+* invalidates nothing downstream while an exported-type change invalidates its
+* transitive importers. Files that `affectsGlobalScope` invalidate everything.
+*
+* Returns `undefined` when the builder path is skipped or fails (no tsconfig,
+* `typescript` unresolvable, parse/build error) — callers then lint without
+* invalidation. Never throws.
+*
+* @param run - The run context.
+* @param mode - The active ESLint type-aware mode.
+* @returns The affected result, or `undefined` when skipped.
+*/
+function computeAffectedFiles({ key, cwd }, mode) {
+	const ts = loadTypescript(cwd);
+	if (ts === void 0) {
+		warnOnce("typescript is not resolvable; skipping type-aware cache invalidation");
+		return;
+	}
+	const configPath = ts.findConfigFile(cwd, (file) => ts.sys.fileExists(file), "tsconfig.json");
+	if (configPath === void 0) {
+		warnOnce("no tsconfig.json found; skipping type-aware cache invalidation");
+		return;
+	}
+	try {
+		const { entryReadable, projects } = collectProjects(ts, configPath);
+		if (projects.length === 0) {
+			if (entryReadable) warnOnce(`no TypeScript files resolved from ${path.basename(configPath)}; skipping type-aware cache invalidation`);
+			return;
+		}
+		fs.mkdirSync(stateDirectory(cwd), { recursive: true });
+		const affected = /* @__PURE__ */ new Set();
+		let warmProjects = 0;
+		for (const project of projects) {
+			const result = runBuilder({
+				buildInfoPath: builderStatePath(cwd, mode, key, project.id),
+				project,
+				ts
+			});
+			warmProjects += result.firstRun ? 0 : 1;
+			for (const file of result.affected) affected.add(file);
+		}
+		return {
+			affected,
+			firstRun: warmProjects === 0
+		};
+	} catch (err) {
+		warnOnce(`type-aware cache invalidation failed: ${err instanceof Error ? err.message : String(err)}`);
+		return;
+	}
+}
+/**
+* Resolve the builder incremental-state (`.tsbuildinfo`) file for a mode and
+* config variant.
+*
+* The variant key is part of the path because this state is drained
+* destructively: {@link computeAffectedFiles} consumes the affected set and
+* advances the buildinfo, and the caller removes those files from *one* cache.
+* Sharing one buildinfo across variants would let an agent run advance the
+* state while only its own cache was invalidated; the next human run would
+* then see an empty affected set with stale entries still in its own warm
+* cache — and since those files' mtimes never changed, the typed pass would
+* auto-skip and report stale diagnostics that ESLint's `hashOfConfig` cannot
+* catch.
+*
+* @param cwd - The consumer project root.
+* @param mode - The active ESLint type-aware mode (never `"off"` here).
+* @param key - The config-variant key from `resolveCacheKey`.
+* @param projectId - {@link projectDigest} of the project's tsconfig. Every
+*   project is suffixed, including the entry one: a solution's members each
+*   need their own state, and an unsuffixed special case for the entry config
+*   would make `${key}` and `${key}-${digest}` ambiguous to parse back.
+* @returns The absolute path to the mode's buildinfo file.
+*/
+function builderStatePath(cwd, mode, key, projectId) {
+	return statePath(cwd, "tsbuildinfo", mode === "only" ? "typeaware" : "full", key, projectId);
+}
+/**
+* Emit a warning at most once per distinct message. Keyed by message rather
+* than a single global flag so per-project degradation (one unreadable
+* reference among many) stays reportable instead of being swallowed by an
+* earlier, unrelated warning.
+*
+* @param message - The warning text, also its dedupe key.
+*/
+function warnOnce(message) {
+	if (warned.has(message)) return;
+	warned.add(message);
+	process$1.stderr.write(`isentinel-lint: ${message}\n`);
+}
+/**
+* Derive a project's buildinfo discriminator from its canonical config path.
+* Hashed rather than slugified so nested paths stay short and two configs that
+* would sanitise to the same slug cannot collide.
+*
+* @param canonicalPath - The project's canonical tsconfig path.
+* @returns A filename-safe hex digest.
+*/
+function projectDigest(canonicalPath) {
+	return crypto.createHash("sha256").update(canonicalPath).digest("hex").slice(0, 8);
+}
+/**
+* Walk the project-reference graph from an entry tsconfig, collecting every
+* project that owns files.
+*
+* `parseJsonConfigFileContent` does not follow `references`, so a
+* solution-style tsconfig (`files: []`, `include: []`) resolves to zero file
+* names on its own. Recursing gives referenced-project consumers real
+* cross-file invalidation instead of a silent no-op. References nest — a
+* referenced project may itself be solution-style — so this recurses rather
+* than reading one level, and the visited set guards against reference cycles
+* and diamond graphs.
+*
+* A referenced config that cannot be read is warned about and skipped rather
+* than failing the whole walk: one broken reference should degrade invalidation
+* for its own files, not for every sibling project.
+*
+* @param ts - The resolved TypeScript module.
+* @param entryPath - The tsconfig to start from.
+* @returns The file-owning projects and whether the entry config parsed.
+*/
+function collectProjects(ts, entryPath) {
+	const projects = [];
+	const seen = /* @__PURE__ */ new Set();
+	let entryReadable = true;
+	/**
+	* Canonical form of a config path, for cycle detection and digesting.
+	* TypeScript reaches the same file through differently-cased paths on a
+	* case-insensitive filesystem, so fold case only there. Folding
+	* unconditionally would collapse two genuinely distinct sibling configs
+	* on a case-sensitive filesystem into one — dropping all but the first
+	* from the walk and colliding their buildinfo digests.
+	*
+	* @param configPath - The path to canonicalize.
+	* @returns The canonical form.
+	*/
+	function canonical(configPath) {
+		const resolved = toPosix(path.resolve(configPath));
+		return ts.sys.useCaseSensitiveFileNames ? resolved : resolved.toLowerCase();
+	}
+	/**
+	* Visit one config, recording it when it owns files and recursing into its
+	* references.
+	*
+	* @param configPath - The tsconfig to resolve at this step.
+	*/
+	function walk(configPath) {
+		const key = canonical(configPath);
+		if (seen.has(key)) return;
+		seen.add(key);
+		const configFile = ts.readConfigFile(configPath, (file) => ts.sys.readFile(file));
+		if (configFile.error !== void 0) {
+			warnOnce(`${configPath} could not be read; its files skip type-aware invalidation`);
+			if (configPath === entryPath) entryReadable = false;
+			return;
+		}
+		const parsed = ts.parseJsonConfigFileContent(configFile.config, ts.sys, path.dirname(configPath));
+		if (parsed.fileNames.length > 0) projects.push({
+			id: projectDigest(key),
+			fileNames: parsed.fileNames,
+			options: parsed.options
+		});
+		const references = parsed.projectReferences ?? [];
+		for (const reference of references) walk(ts.resolveProjectReferencePath(reference));
+	}
+	walk(entryPath);
+	return {
+		entryReadable,
+		projects
+	};
+}
+/**
+* Add a file to the affected set when it is an in-project file. Library
+* declarations and dependencies live under `node_modules` and are never in the
+* ESLint cache, so removing them would be a no-op and they would only inflate
+* the escape-valve threshold.
+*
+* @param fileName - The TypeScript file name (forward-slash absolute).
+* @param into - The accumulating affected set.
+*/
+function addProjectFile(fileName, into) {
+	const normalized = path.normalize(fileName);
+	if (normalized.includes(`${path.sep}node_modules${path.sep}`)) return;
+	into.add(normalized);
+}
+/**
+* Fold one affected target into the set. The builder yields a `SourceFile`
+* for a normal affected file, or the whole `Program` when a change affects
+* global scope (ambient/augmentation) — in which case every source file is
+* affected.
+*
+* @param target - The affected `Program` or `SourceFile`.
+* @param into - The accumulating affected set.
+*/
+function collectAffected(target, into) {
+	if ("getSourceFiles" in target) {
+		for (const sourceFile of target.getSourceFiles()) addProjectFile(sourceFile.fileName, into);
+		return;
+	}
+	addProjectFile(target.fileName, into);
+}
+/**
+* Persist the builder's incremental state by emitting ONLY the buildinfo.
+* `program.emit` walks remaining affected files and writes the `.tsbuildinfo`;
+* the writeFile callback swallows every other output so no JS/`.d.ts` reaches
+* the consumer's tree.
+*
+* The emit is what computes each file's real declaration signature, so it
+* cannot be swapped for the cheaper `emitBuildInfo`: without it the shape hash
+* degrades to a source-text hash and every implementation-only edit invalidates
+* all its importers.
+*
+* @param builder - The drained builder program.
+* @param buildInfoPath - The variant's buildinfo file.
+*/
+function persistBuilderState(builder, buildInfoPath) {
+	const normalizedBuildInfo = path.normalize(buildInfoPath);
+	builder.emit(void 0, (fileName, data) => {
+		if (path.normalize(fileName) === normalizedBuildInfo) fs.writeFileSync(fileName, data);
+	});
+}
+/**
+* Drive the incremental builder: read prior state, drain the affected set
+* without reporting diagnostics, then persist updated state.
+*
+* @param build - The project, its state file, and the run's shared handles.
+* @returns The affected result.
+*/
+function runBuilder({ buildInfoPath, project, ts }) {
+	const firstRun = !fs.existsSync(buildInfoPath);
+	const options = {
+		...project.options,
+		composite: false,
+		declaration: true,
+		declarationMap: false,
+		emitDeclarationOnly: false,
+		incremental: true,
+		noEmit: false,
+		tsBuildInfoFile: buildInfoPath
+	};
+	const host = ts.createIncrementalCompilerHost(options, ts.sys);
+	const oldProgram = ts.readBuilderProgram(options, host);
+	const builder = ts.createEmitAndSemanticDiagnosticsBuilderProgram(project.fileNames, options, host, oldProgram);
+	const affected = /* @__PURE__ */ new Set();
+	let touched = false;
+	let next = builder.getSemanticDiagnosticsOfNextAffectedFile();
+	while (next !== void 0) {
+		touched = true;
+		collectAffected(next.affected, affected);
+		next = builder.getSemanticDiagnosticsOfNextAffectedFile();
+	}
+	if (touched) persistBuilderState(builder, buildInfoPath);
+	return {
+		affected,
+		firstRun
+	};
+}
+//#endregion
+//#region src/lint-cli/lib/cache/invalidation.ts
+/**
+* Fold TypeScript builder-based invalidation into the ESLint cache. Computes
+* the affected set (files whose type-aware results may have changed because a
+* file they import changed), then either:
+*
+* - persists state only, when this is the builder's first run (its affected set
+*   is meaningless — everything is "affected");
+* - deletes the mode cache wholesale, when the affected set exceeds the bust
+*   threshold (surgical removal stops paying off);
+* - surgically removes the affected files that are lint targets and not already
+*   dirty by mtime/checksum.
+*
+* Never throws: a skipped/failed builder yields a no-op outcome.
+*
+* @param run - The run context.
+* @param request - The invalidation inputs.
+* @returns The invalidation outcome.
+*/
+function applyTypeAwareInvalidation(run, { alreadyDirty, cache, cacheLocation, mode, targetFiles }) {
+	const result = computeAffectedFiles(run, mode);
+	if (result === void 0) return {
+		busted: false,
+		firstRun: false,
+		invalidated: [],
+		skipped: true
+	};
+	if (result.firstRun) return {
+		busted: false,
+		firstRun: true,
+		invalidated: [],
+		skipped: false
+	};
+	const targets = /* @__PURE__ */ new Set();
+	for (const file of targetFiles) targets.add(normalizePath(file));
+	const affectedTargets = [];
+	for (const affected of result.affected) {
+		const normalized = normalizePath(affected);
+		if (targets.has(normalized)) affectedTargets.push(normalized);
+	}
+	const threshold = resolveAffectedBustThreshold(run.environment);
+	if (affectedTargets.length > threshold) {
+		fs.rmSync(cacheLocation, { force: true });
+		return {
+			busted: true,
+			firstRun: false,
+			invalidated: [],
+			skipped: false
+		};
+	}
+	const invalidated = affectedTargets.filter((target) => !alreadyDirty.has(target));
+	cache?.removeEntries(invalidated);
+	return {
+		busted: false,
+		firstRun: false,
+		invalidated,
+		skipped: false
+	};
+}
+//#endregion
+//#region src/lint-cli/lib/plan/sizing.ts
+/** The stderr notice emitted when the type-aware pass is skipped. */
+const TYPED_SKIP_NOTICE = "isentinel-lint: skipping the type-aware ESLint pass; no type-relevant files changed since the last run.\n";
+/**
+* Size every selected pass: count the files each will re-lint, resolve its
+* concurrency, and decide whether it runs at all.
+*
+* The dirty count is the whole point. It routes on whether the run may mutate:
+* a real run clears stale caches and folds TypeScript builder invalidation into
+* the count, while `--print` only reports what is already dirty by
+* mtime/checksum and touches nothing. Callers see neither path — they get the
+* planned passes.
+*
+* @param descriptors - The passes to size, in run order.
+* @param run - The run context.
+* @param inputs - The file lists, limits and bust results to size against.
+* @returns The planned passes, in the same order.
+*/
+function sizePasses(descriptors, run, inputs) {
+	const multiPass = descriptors.length > 1;
+	return descriptors.map((descriptor) => sizePass(descriptor, {
+		...inputs,
+		multiPass,
+		run
+	}));
+}
+/**
+* Dirty count for a real run: clear the cache wholesale when stale, then fold
+* TS builder invalidation in, reusing a single loaded cache for the dirty query
+* and the surgical entry removal.
+*
+* @param descriptor - The pass being sized.
+* @param cacheLocation - The resolved cache file path.
+* @param targetFiles - The candidate files for this pass.
+* @param context - The shared sizing inputs.
+* @returns The number of dirty files.
+*/
+function mutatingDirtyCount(descriptor, cacheLocation, targetFiles, { clearedCaches, run }) {
+	if (clearedCaches.has(cacheLocation)) return targetFiles.length;
+	const cache = openCache(cacheLocation, run.ci);
+	const dirty = new Set((cache?.getUpdatedFiles(targetFiles) ?? targetFiles).map((file) => normalizePath(file)));
+	if (descriptor.invalidation !== "none") {
+		const outcome = applyTypeAwareInvalidation(run, {
+			alreadyDirty: dirty,
+			cache,
+			cacheLocation,
+			mode: descriptor.invalidation === "only" ? "only" : void 0,
+			targetFiles
+		});
+		if (outcome.busted) return targetFiles.length;
+		for (const file of outcome.invalidated) dirty.add(file);
+	}
+	return dirty.size;
+}
+/**
+* Dirty count for `--print`: reflect cache staleness but never delete it, and
+* never run the builder. Only the mtime/checksum-dirty files count.
+*
+* @param cacheLocation - The resolved cache file path.
+* @param targetFiles - The candidate files for this pass.
+* @param context - The shared sizing inputs.
+* @returns The number of dirty files.
+*/
+function readOnlyDirtyCount(cacheLocation, targetFiles, { newestBustMtime, run }) {
+	if (isCacheStale(cacheLocation, newestBustMtime)) return targetFiles.length;
+	return (openCache(cacheLocation, run.ci)?.getUpdatedFiles(targetFiles) ?? targetFiles).length;
+}
+/**
+* Count the files a pass will re-lint. Routes on `mutate`: the mutating path
+* clears stale caches and folds builder invalidation into the count (reusing
+* one loaded cache for the dirty query and the surgical removal); the read-only
+* path only reports the mtime/checksum-dirty files.
+*
+* @param descriptor - The pass being sized.
+* @param cacheFile - The pass's keyed cache file name.
+* @param context - The shared sizing inputs.
+* @returns The number of dirty files.
+*/
+function passDirtyCount(descriptor, cacheFile, context) {
+	const targetFiles = descriptor.typeAwareOnly ? context.files.typeAware : context.files.lintable;
+	if (!context.options.cache) return targetFiles.length;
+	const cacheLocation = path.resolve(context.run.cwd, cacheFile);
+	return context.run.mutate ? mutatingDirtyCount(descriptor, cacheLocation, targetFiles, context) : readOnlyDirtyCount(cacheLocation, targetFiles, context);
+}
+/**
+* Size one pass: count its dirty files, resolve concurrency and decide whether
+* it runs. The default-mode type-aware pass is skipped when nothing
+* type-relevant is dirty; an explicit single-pass mode never skips.
+*
+* @param descriptor - The pass being sized.
+* @param context - The shared sizing inputs.
+* @returns The planned pass.
+*/
+function sizePass(descriptor, context) {
+	const cacheFile = cacheFileFor(descriptor.cacheFileBase, context.run.key);
+	const dirtyCount = passDirtyCount(descriptor, cacheFile, context);
+	const conservative = context.files.targetsOutsideCwd;
+	const filesPerWorker = descriptor.filesPerWorker(context.limits, context.run.environment);
+	const maxWorkers = maxWorkersFor(descriptor, context.limits);
+	const sizingDirtyCount = conservative ? maxWorkers * filesPerWorker : dirtyCount;
+	const concurrency = context.options.concurrency ?? computeWorkerCount({
+		dirtyCount: sizingDirtyCount,
+		filesPerWorker,
+		maxWorkers
+	});
+	if (context.run.mutate && context.multiPass && descriptor === TYPED_PASS && !conservative && dirtyCount === 0) return {
+		cacheFile,
+		concurrency,
+		descriptor,
+		shouldRun: false,
+		skipReason: TYPED_SKIP_NOTICE
+	};
+	return {
+		cacheFile,
+		concurrency,
+		descriptor,
+		shouldRun: true,
+		skipReason: void 0
+	};
+}
+//#endregion
+//#region src/lint-cli/lib/plan/plan.ts
+/**
+* Plan the run: collect the repo file list once, apply the package.json and
+* mtime busts and TypeScript builder invalidation, size each pass and decide
+* which run. All I/O and mutation happen here, exactly once. When `mutate` is
+* false (`--print`) the whole mutation step is skipped — no builder, no cache
+* deletion, no state writes and no auto-skip — while still sizing from the
+* on-disk caches. The returned value is plain data.
+*
+* @param options - The parsed CLI options.
+* @param run - The run context (cwd, variant key, environment, mutate).
+* @returns The run plan.
+*/
+function plan(options, run) {
+	const { ci, cwd, environment, mutate } = run;
+	const runEslint = !options.oxlint;
+	const oxlintTypeAware = resolveOxlintTypeAware(options);
+	const agentsFormatterPath = options.agents ? resolveAgentsFormatter() : "";
+	const oxlintPaths = oxlintTargets(cwd, options.paths);
+	const runOxlint = !options.eslint && oxlintPaths.length > 0;
+	if (!runEslint) return {
+		agentsFormatterPath,
+		ci,
+		oxlint: runOxlint,
+		oxlintPaths,
+		oxlintReason: void 0,
+		oxlintTypeAware,
+		passes: [],
+		targetsOutsideCwd: false
+	};
+	const descriptors = selectPasses(options, ci);
+	const files = collectRepoFiles(cwd, options.paths);
+	const newestBustMtime = maxMtimeMs(files.bustFiles);
+	const limits = resolveWorkerLimits(environment, availableParallelism(), ci);
+	const oxlintDecision = resolveOxlintRun(run, {
+		files,
+		runEslint,
+		runOxlint
+	});
+	const canMutateCaches = mutate && options.cache;
+	const hasTypeAwarePass = descriptors.some((descriptor) => descriptor.invalidation !== "none");
+	const configHash = options.cache ? computeConfigHash(cwd, files.configFiles) : void 0;
+	if (canMutateCaches) applyHashBust(run, CONFIG_DRIFT, configHash);
+	if (canMutateCaches && hasTypeAwarePass) applyHashBust(run, PACKAGE_RESOLUTION, computePackageJsonHash(cwd));
+	const passes = sizePasses(descriptors, run, {
+		clearedCaches: new Set(canMutateCaches ? sweepStaleCaches(cwd, newestBustMtime) : []),
+		files: withoutIgnored(files, resolveIgnoredFiles(run, configHash, files.lintable)),
+		limits,
+		newestBustMtime,
+		options
+	});
+	return {
+		agentsFormatterPath,
+		ci,
+		oxlint: oxlintDecision.run,
+		oxlintPaths,
+		oxlintReason: oxlintDecision.reason,
+		oxlintTypeAware,
+		passes,
+		targetsOutsideCwd: files.targetsOutsideCwd
+	};
+}
+function resolveOxlintTypeAware(options) {
+	return !options.eslint && options.oxlintTypeAware && options.typeAware !== "off";
+}
+//#endregion
+//#region src/lint-cli/lib/run.ts
+/**
+* Parse, validate, compose and run the hybrid oxlint + ESLint invocation.
+*
+* @param argv - The argument slice (without the node/bin prefix).
+* @param cwd - The working directory (defaults to `process.cwd()`; injected in tests).
+* @param environment - The process environment (defaults to `process.env`).
+* @returns The process exit code.
+* @rejects {CliError} When the arguments are invalid or a tool is missing.
+*/
+async function runLint(argv, cwd = process$1.cwd(), environment = process$1.env) {
+	const options = parseArguments(argv, environment);
+	const { commands, notice } = compose(plan(options, resolveRunContext(cwd, environment, !options.print)), options);
+	if (options.print) {
+		for (const command of commands) process$1.stdout.write(`${formatCommandLine(command)}\n`);
+		return 0;
+	}
+	if (commands.some((command) => command.bin === "oxlint" && command.args.includes("--type-aware")) && !isPackageExists("oxlint-tsgolint", { paths: [cwd] })) throw new CliError("oxlint-tsgolint is not installed, so oxlint cannot run type-aware rules. Install oxlint-tsgolint, or pass --no-oxlint-type-aware to skip type-aware linting.");
+	if (notice !== void 0) process$1.stderr.write(notice);
+	return execute(commands, cwd, options.fix || commands.length <= 1);
+}
+//#endregion
+//#region src/lint-cli/index.ts
+const HELP = `isentinel-lint [flags] [paths...]
+
+Runs oxlint and ESLint together, sizing ESLint's --concurrency from how many
+files actually need re-linting and managing per-mode caches.
+
+Flags:
+  --eslint                 Run only ESLint.
+  --oxlint                 Run only oxlint.
+  --fix                    Apply fixes: oxlint --fix then eslint --fix.
+  --agents, --no-agents    Emit agent-friendly output. On by default when an AI
+                           agent session is detected (AI_AGENT, CLAUDECODE, ...).
+  --type-aware=off|only|full
+                           Force a single ESLint pass. Default runs the fast and
+                           type-aware passes concurrently; full is the escape hatch.
+  --no-oxlint-type-aware   Skip oxlint's type-aware rules (no tsgolint needed).
+  --no-cache               Disable ESLint's cache.
+  --concurrency <n|off>    Override the concurrency heuristic.
+  --eslint-args "<args>"   Extra arguments for ESLint.
+  --oxlint-args "<args>"   Extra arguments for oxlint.
+  --print                  Print the composed commands without running them.
+  -- <args>                Forward args to the single selected tool.
+  -h, --help               Show this help.
+  -v, --version            Show the version.
+`;
+async function main() {
+	const argv = process$1.argv.slice(2);
+	if (argv.includes("--help") || argv.includes("-h")) {
+		process$1.stdout.write(`${HELP}\n`);
+		return 0;
+	}
+	if (argv.includes("--version") || argv.includes("-v")) {
+		process$1.stdout.write(`${version}\n`);
+		return 0;
+	}
+	return runLint(argv);
+}
+main().then((code) => {
+	process$1.exitCode = code;
+}).catch((err) => {
+	if (err instanceof CliError) console.error(err.message);
+	else console.error(err);
+	process$1.exitCode = 1;
+});
+//#endregion
+export {};