@ttsc/lint 0.12.3 → 0.13.0

package/linthost/config.go

@@ -3,6 +3,8 @@ package linthost
 import (
   "bytes"
   "context"
+  "crypto/sha256"
+  "encoding/hex"
   "encoding/json"
   "fmt"
   "os"
@@ -85,22 +87,34 @@ type RuleConfig map[string]Severity
 
 // RuleOptionsMap captures the rule-specific options blob, keyed by rule
 // name. Severity-only rules never appear here. The values are the raw
-// JSON the user wrote in the second tuple slot of an ESLint-style
-// `["error", { ... }]` setting; each rule decodes the blob into its own
-// option struct on demand.
+// JSON the user wrote in the second tuple slot of a `["error", { ... }]`
+// rule setting; each rule decodes the blob into its own option struct on
+// demand.
 type RuleOptionsMap map[string]json.RawMessage
 
 // ResolvedRuleConfig is the rule map that applies to one source file.
-// `Ignored` means an external ESLint-style ignore-only config matched the
-// file and the engine should skip linting it entirely.
+// `Ignored` means an `ignores`-only config entry matched the file and the
+// engine should skip linting it entirely.
 type ResolvedRuleConfig struct {
   Rules   RuleConfig
   Ignored bool
 }
 
+// RuleResolver is the engine-facing view of a resolved lint configuration.
+// Implementations include RuleConfig (severity-only, no options),
+// InlineRuleResolver (a severity map plus per-rule options), and *ConfigStore
+// (a parsed lint config file, with per-file glob resolution and a unified
+// options map).
 type RuleResolver interface {
+  // ResolveRules returns the effective severity map for the given source file.
+  // Implementations that support `files`/`ignores` patterns apply them here;
+  // flat RuleConfig always returns all rules unchanged.
   ResolveRules(fileName string) ResolvedRuleConfig
+  // ActiveRuleNames returns the sorted names of every rule that is not SeverityOff
+  // in at least one config entry. Used to build the engine's dispatch table.
   ActiveRuleNames() []string
+  // EnabledRuleConfig returns the project-wide severity map for rules that are
+  // not SeverityOff. Where multiple entries disagree, SeverityError wins.
   EnabledRuleConfig() RuleConfig
   // RuleOptions returns the raw JSON options for `name`, or nil when the
   // rule was configured with a severity alone. Returns nil for unknown
@@ -108,14 +122,20 @@ type RuleResolver interface {
   RuleOptions(name string) json.RawMessage
 }
 
+// ResolveRules implements RuleResolver. A flat RuleConfig has no glob scoping,
+// so every file receives the full map unchanged.
 func (c RuleConfig) ResolveRules(string) ResolvedRuleConfig {
   return ResolvedRuleConfig{Rules: c}
 }
 
+// ActiveRuleNames implements RuleResolver. Returns rule names whose severity
+// is not SeverityOff, sorted for deterministic engine dispatch-table construction.
 func (c RuleConfig) ActiveRuleNames() []string {
   return sortedRuleNames(c, func(sev Severity) bool { return sev != SeverityOff })
 }
 
+// EnabledRuleConfig implements RuleResolver. Returns a copy containing only the
+// non-off entries; used to populate engine state and diagnostic reporting.
 func (c RuleConfig) EnabledRuleConfig() RuleConfig {
   out := RuleConfig{}
   for name, sev := range c {
@@ -127,30 +147,37 @@ func (c RuleConfig) EnabledRuleConfig() RuleConfig {
 }
 
 // RuleOptions on a bare RuleConfig is always nil — this form is the
-// severity-only path used by Go unit tests and the legacy inline-rules
-// surface that predates option support.
+// severity-only path used by Go unit tests and rule constructors that
+// predate option support.
 func (RuleConfig) RuleOptions(string) json.RawMessage { return nil }
 
-// InlineRuleResolver pairs a severity map with an options map for
-// tsconfig-inline rule blocks. The fields are public so tests can
-// construct one without going through ParseRulesWithOptions.
+// InlineRuleResolver pairs a severity map with an options map. The fields
+// are public so tests can construct one without going through
+// ParseRulesWithOptions.
 type InlineRuleResolver struct {
   Rules   RuleConfig
   Options RuleOptionsMap
 }
 
+// ResolveRules implements RuleResolver. Inline rules have no glob scoping;
+// the full map applies to every file.
 func (r InlineRuleResolver) ResolveRules(string) ResolvedRuleConfig {
   return ResolvedRuleConfig{Rules: r.Rules}
 }
 
+// ActiveRuleNames implements RuleResolver by delegating to the inner RuleConfig.
 func (r InlineRuleResolver) ActiveRuleNames() []string {
   return r.Rules.ActiveRuleNames()
 }
 
+// EnabledRuleConfig implements RuleResolver by delegating to the inner RuleConfig.
 func (r InlineRuleResolver) EnabledRuleConfig() RuleConfig {
   return r.Rules.EnabledRuleConfig()
 }
 
+// RuleOptions implements RuleResolver. Returns the raw JSON options blob for
+// `name`, or nil when the rule was configured without options or the name is
+// unknown.
 func (r InlineRuleResolver) RuleOptions(name string) json.RawMessage {
   if r.Options == nil {
     return nil
@@ -158,11 +185,18 @@ func (r InlineRuleResolver) RuleOptions(name string) json.RawMessage {
   return r.Options[name]
 }
 
+// ConfigStore holds the parsed representation of a lint config file. It
+// implements RuleResolver with per-file glob scoping: ResolveRules walks the
+// entries in declaration order and the last matching entry wins. Options are
+// intentionally NOT per-file — one project-wide options map is kept so rule
+// behavior is uniform across the codebase even when severity varies by glob.
+//
+// A config file is a single `ITtscLintConfig` object. Its `extends` field
+// names another config file to fold in first; the extends chain produces one
+// ConfigEntry per file, the extends-target entries declared before the
+// extending file's own entry so local rules win on collision.
 type ConfigStore struct {
-  entries               []ConfigEntry
-  externalConfigPath    string
-  eslintRuntime         bool
-  eslintRuntimeRequired bool
+  entries []ConfigEntry
   // options is a flat rule-name → JSON map. Options are not scoped by
   // `files` / `ignores`: a rule's behavior is a single project-wide
   // configuration even when its severity is per-file. The simplification
@@ -179,6 +213,11 @@ func (s *ConfigStore) RuleOptions(name string) json.RawMessage {
   return s.options[name]
 }
 
+// ConfigEntry is the parsed form of one config file in the extends chain.
+// BaseDir anchors glob resolution; Files and Ignores are the pattern lists.
+// IgnoreOnly marks entries that carry only `ignores` (no `files`, no `rules`)
+// — these are evaluated first in ResolveRules and short-circuit the walk when
+// matched.
 type ConfigEntry struct {
   BaseDir    string
   Files      []string
@@ -187,6 +226,10 @@ type ConfigEntry struct {
   IgnoreOnly bool
 }
 
+// ResolveRules implements RuleResolver. Ignore-only entries are checked first;
+// if one matches, the file is marked Ignored and linting is skipped entirely.
+// Otherwise the entries are walked in declaration order and the last matching
+// entry wins (later entries shadow earlier ones for the same rule name).
 func (s *ConfigStore) ResolveRules(fileName string) ResolvedRuleConfig {
   if s == nil {
     return ResolvedRuleConfig{Rules: RuleConfig{}}
@@ -208,6 +251,10 @@ func (s *ConfigStore) ResolveRules(fileName string) ResolvedRuleConfig {
   return ResolvedRuleConfig{Rules: out}
 }
 
+// ActiveRuleNames implements RuleResolver. Returns the sorted union of all rule
+// names that are not SeverityOff across every non-ignore-only config entry,
+// regardless of which files they apply to. The engine uses this to build the
+// per-rule dispatch table before file iteration begins.
 func (s *ConfigStore) ActiveRuleNames() []string {
   if s == nil {
     return nil
@@ -226,6 +273,9 @@ func (s *ConfigStore) ActiveRuleNames() []string {
   return sortedRuleNames(active, func(Severity) bool { return true })
 }
 
+// EnabledRuleConfig implements RuleResolver. Returns the project-wide severity
+// map for non-off rules. Where multiple entries configure the same rule,
+// SeverityError is sticky — it cannot be downgraded by a later warning entry.
 func (s *ConfigStore) EnabledRuleConfig() RuleConfig {
   out := RuleConfig{}
   if s == nil {
@@ -247,6 +297,9 @@ func (s *ConfigStore) EnabledRuleConfig() RuleConfig {
   return out
 }
 
+// Flatten returns the unconstrained union of all non-ignore-only entries,
+// including SeverityOff rules. Used by LoadRuleConfig (callers that expect a
+// plain RuleConfig). Later entries shadow earlier ones for the same rule name.
 func (s *ConfigStore) Flatten() RuleConfig {
   out := RuleConfig{}
   if s == nil {
@@ -263,31 +316,6 @@ func (s *ConfigStore) Flatten() RuleConfig {
   return out
 }
 
-func (s *ConfigStore) ExternalConfigPath() string {
-  if s == nil {
-    return ""
-  }
-  return s.externalConfigPath
-}
-
-func (s *ConfigStore) WantsESLintRuntime() bool {
-  if s == nil {
-    return false
-  }
-  if s.eslintRuntime {
-    return true
-  }
-  base := filepath.Base(s.externalConfigPath)
-  return strings.HasPrefix(base, "eslint.config.")
-}
-
-func (s *ConfigStore) RequiresESLintRuntime() bool {
-  if s == nil {
-    return false
-  }
-  return s.eslintRuntimeRequired
-}
-
 func (e ConfigEntry) matchesFile(fileName string) bool {
   if len(e.Files) > 0 && !matchAnyPattern(e.BaseDir, e.Files, fileName) {
     return false
@@ -302,8 +330,7 @@ func (e ConfigEntry) matchesIgnores(fileName string) bool {
   return len(e.Ignores) > 0 && matchAnyPattern(e.BaseDir, e.Ignores, fileName)
 }
 
-// ParseRules normalizes the standard native rules map from a tsconfig plugin
-// entry.
+// ParseRules normalizes a rule severity map.
 //
 // Severity values:
 //   - `"off"` → SeverityOff
@@ -327,7 +354,7 @@ func ParseRulesWithOptions(raw any) (RuleConfig, RuleOptionsMap, error) {
   }
   dict, ok := raw.(map[string]any)
   if !ok {
-    return nil, nil, fmt.Errorf("@ttsc/lint: \"config\" must be an object, got %T", raw)
+    return nil, nil, fmt.Errorf("@ttsc/lint: \"rules\" must be an object, got %T", raw)
   }
   cfg := make(RuleConfig, len(dict))
   opts := make(RuleOptionsMap)
@@ -344,11 +371,10 @@ func ParseRulesWithOptions(raw any) (RuleConfig, RuleOptionsMap, error) {
   return cfg, opts, nil
 }
 
-// parseRuleEntry splits an ESLint-shaped rule entry into its severity
-// and (optional) options payload. Bare severity literals produce a nil
-// options blob; `[severity]` (no options) does the same; `[severity,
-// options]` re-serializes the options to JSON so each rule can decode it
-// into its own struct later.
+// parseRuleEntry splits a rule entry into its severity and (optional) options
+// payload. Bare severity literals produce a nil options blob; `[severity]`
+// (no options) does the same; `[severity, options]` re-serializes the options
+// to JSON so each rule can decode it into its own struct later.
 func parseRuleEntry(value any) (Severity, json.RawMessage, error) {
   if tuple, ok := value.([]any); ok {
     if len(tuple) == 0 {
@@ -368,10 +394,9 @@ func parseRuleEntry(value any) (Severity, json.RawMessage, error) {
       return sev, nil, nil
     }
     if _, ok := tuple[1].(map[string]any); !ok {
-      // ESLint accepts string-typed positional options as a shorthand
-      // (e.g. `["error", "single"]` for the `quotes` rule). ttsc does
-      // not: every option struct in TtscLintRuleOptions is an object,
-      // and silently encoding a non-object slot would land in
+      // A positional string option (e.g. `["error", "single"]`) is
+      // rejected: every option struct in TtscLintRuleOptions is an
+      // object, and silently encoding a non-object slot would land in
       // DecodeOptions as a decode error that every rule discards. Fail
       // loudly so users discover the proper `["error", { … }]` form.
       return SeverityOff, nil, fmt.Errorf("severity tuple's options slot must be an object, got %T", tuple[1])
@@ -386,6 +411,9 @@ func parseRuleEntry(value any) (Severity, json.RawMessage, error) {
   return sev, nil, err
 }
 
+// parseExternalConfigRules is a convenience wrapper used by unit tests that
+// only need a flat RuleConfig from an already-deserialized config object. Glob
+// scoping and options are discarded.
 func parseExternalConfigRules(raw any) (RuleConfig, error) {
   store, err := parseExternalConfigStore(raw, "")
   if err != nil {
@@ -394,164 +422,175 @@ func parseExternalConfigRules(raw any) (RuleConfig, error) {
   return store.Flatten(), nil
 }
 
+// parseExternalConfigStore parses a single `ITtscLintConfig` object into a
+// *ConfigStore. `configDir` anchors glob resolution and `extends` lookups; it
+// is empty for in-memory inputs that do not load from a real file.
 func parseExternalConfigStore(raw any, configDir string) (*ConfigStore, error) {
-  return parseExternalConfigStoreWithRuntimeMode(raw, configDir, false)
+  return collectConfigStore(raw, configDir, "")
 }
 
-func parseExternalConfigStoreForFile(raw any, configDir string) (*ConfigStore, error) {
-  return parseExternalConfigStoreWithRuntimeMode(raw, configDir, true)
-}
-
-func parseExternalConfigStoreWithRuntimeMode(raw any, configDir string, allowRuntimeOnly bool) (*ConfigStore, error) {
+// collectConfigStore parses a single `ITtscLintConfig` object into a fresh
+// *ConfigStore. `rootPath` is the absolute path of the file `raw` was loaded
+// from, or "" for in-memory inputs; when set it seeds the `extends` cycle
+// guard so a config that `extends` itself (directly or transitively) is
+// rejected.
+func collectConfigStore(raw any, configDir, rootPath string) (*ConfigStore, error) {
   store := &ConfigStore{}
-  if err := collectExternalConfigEntries(store, raw, configDir, "config", allowRuntimeOnly); err != nil {
+  var chain []string
+  if rootPath != "" {
+    chain = []string{filepath.Clean(rootPath)}
+  }
+  if err := collectConfigObject(store, raw, configDir, "config", chain); err != nil {
     return nil, err
   }
   return store, nil
 }
 
-func collectExternalConfigEntries(store *ConfigStore, raw any, baseDir, path string, allowRuntimeOnly bool) error {
+// extendsDepthLimit caps how many `extends` hops collectConfigObject will
+// follow. The cycle check in appendExtendsLink already rejects every loop;
+// this is a backstop so a config chain that escapes that check (e.g. a future
+// change that resolves the same file under two different cleaned paths) still
+// fails fast instead of spawning an unbounded run of `ttsx`/`node`
+// config-loader subprocesses — one per hop.
+const extendsDepthLimit = 32
+
+// appendExtendsLink validates that following the `extends` target at `next`
+// neither closes a cycle nor exceeds extendsDepthLimit, then returns `chain`
+// extended by `next`. `chain` holds the resolved absolute paths of every
+// config file already on the current `extends` lineage, root first. The guard
+// runs before loadConfigFile so a cyclic chain fails fast instead of
+// re-reading files (and re-spawning subprocesses) without bound.
+func appendExtendsLink(chain []string, next string) ([]string, error) {
+  for i, prior := range chain {
+    if prior == next {
+      // chain[i:] capped at its own length so append allocates a fresh
+      // backing array rather than mutating the caller's `chain`.
+      cycle := append(chain[i:len(chain):len(chain)], next)
+      return nil, fmt.Errorf(
+        "@ttsc/lint: extends cycle detected: %s",
+        strings.Join(cycle, " -> "),
+      )
+    }
+  }
+  if len(chain) >= extendsDepthLimit {
+    return nil, fmt.Errorf(
+      "@ttsc/lint: extends chain exceeds the depth limit of %d: %s -> ...",
+      extendsDepthLimit,
+      strings.Join(chain, " -> "),
+    )
+  }
+  extended := make([]string, len(chain)+1)
+  copy(extended, chain)
+  extended[len(chain)] = next
+  return extended, nil
+}
+
+// collectConfigObject parses one `ITtscLintConfig` object into `store`,
+// appending one ConfigEntry for the object's own rules (and, recursively, the
+// entries of any `extends`-named config file). The extends-target's entries
+// are appended first so the extending file's local rules win on collision.
+//
+// `chain` carries the resolved absolute paths of the config files already on
+// the current `extends` lineage (root first); appendExtendsLink consults it to
+// reject cyclic or pathologically deep chains before another file is read.
+func collectConfigObject(store *ConfigStore, raw any, baseDir, path string, chain []string) error {
   if raw == nil {
     return nil
   }
-  switch typed := raw.(type) {
-  case []any:
-    for i, item := range typed {
-      if err := collectExternalConfigEntries(store, item, baseDir, fmt.Sprintf("%s[%d]", path, i), allowRuntimeOnly); err != nil {
-        return err
-      }
+  obj, ok := raw.(map[string]any)
+  if !ok {
+    return fmt.Errorf("@ttsc/lint: %s must be an ITtscLintConfig object, got %T", path, raw)
+  }
+  if err := rejectUnknownConfigKeys(obj, path); err != nil {
+    return err
+  }
+
+  if extended, hasExtends := obj["extends"]; hasExtends && extended != nil {
+    extendsStr, ok := extended.(string)
+    if !ok {
+      return fmt.Errorf("@ttsc/lint: %s.extends must be a string path to another config file, got %T", path, extended)
     }
-    return nil
-  case map[string]any:
-    if isESLintConfigObject(typed) {
-      if marker, ok := typed["__ttscLintEslintRuntime"].(bool); ok && marker {
-        store.eslintRuntime = true
-        store.eslintRuntimeRequired = true
-      }
-      localBaseDir := baseDir
-      if rawBasePath, ok := typed["basePath"]; ok {
-        basePath, ok := rawBasePath.(string)
-        if !ok {
-          return fmt.Errorf("@ttsc/lint: %s.basePath must be a string, got %T", path, rawBasePath)
-        }
-        if filepath.IsAbs(basePath) {
-          localBaseDir = basePath
-        } else {
-          localBaseDir = filepath.Join(baseDir, basePath)
-        }
-      }
-      if hasESLintRuntimeFields(typed) {
-        store.eslintRuntime = true
-        store.eslintRuntimeRequired = true
-      }
-      if extended, ok := typed["extends"]; ok {
-        if err := collectExternalExtends(store, extended, localBaseDir, path+".extends", allowRuntimeOnly); err != nil {
-          return err
-        }
-      }
-      files, err := parsePatternList(typed["files"], path+".files")
-      if err != nil {
-        return err
-      }
-      ignores, err := parsePatternList(typed["ignores"], path+".ignores")
-      if err != nil {
-        return err
-      }
-      rulesValue, hasRules := typed["rules"]
-      formatValue, hasFormat := typed["format"]
-      if hasRules || hasFormat {
-        // Expand the format block (if any) into a rules-shaped map,
-        // then overlay any explicit `rules` entries. `rules`-wins
-        // semantics match the inline path; the conflict-resolution
-        // table is identical regardless of which surface a user
-        // chose.
-        var formatRulesRaw map[string]any
-        if hasFormat {
-          fmtMap, ok := formatValue.(map[string]any)
-          if !ok {
-            return fmt.Errorf("@ttsc/lint: %s.format must be an object, got %T", path, formatValue)
-          }
-          expanded, err := expandFormatBlock(fmtMap)
-          if err != nil {
-            return err
-          }
-          formatRulesRaw = expanded
-        }
-        var rulesMap map[string]any
-        if hasRules {
-          // `parseExternalRuleMapInto` accepts the raw map directly.
-          // Coerce here to feed the same merge pipeline as the
-          // inline path.
-          typedMap, ok := rulesValue.(map[string]any)
-          if !ok {
-            return fmt.Errorf("@ttsc/lint: %s.rules must be a rule severity map, got %T", path, rulesValue)
-          }
-          rulesMap = typedMap
-        }
-        merged := mergeRuleMaps(formatRulesRaw, rulesMap)
-        if len(merged) == 0 {
-          return nil
-        }
-        parsed, err := parseExternalRuleMapInto(merged, path+".rules", store)
-        if err != nil {
-          return err
-        }
-        store.entries = append(store.entries, ConfigEntry{
-          BaseDir: localBaseDir,
-          Files:   files,
-          Ignores: ignores,
-          Rules:   parsed,
-        })
-        return nil
-      }
-      if len(files) == 0 && len(ignores) > 0 {
-        store.entries = append(store.entries, ConfigEntry{
-          BaseDir:    localBaseDir,
-          Ignores:    ignores,
-          IgnoreOnly: true,
-        })
-      }
-      return nil
+    if strings.TrimSpace(extendsStr) == "" {
+      return fmt.Errorf("@ttsc/lint: %s.extends must not be empty", path)
+    }
+    location := extendsStr
+    if !filepath.IsAbs(location) {
+      location = filepath.Join(baseDir, location)
     }
-    parsed, err := parseExternalRuleMapInto(typed, path, store)
+    location = filepath.Clean(location)
+    extendedChain, err := appendExtendsLink(chain, location)
     if err != nil {
       return err
     }
-    store.entries = append(store.entries, ConfigEntry{
-      BaseDir: baseDir,
-      Rules:   parsed,
-    })
-    return nil
-  default:
-    return fmt.Errorf("@ttsc/lint: %s must be an object or flat config array, got %T", path, raw)
+    extendedRaw, err := loadConfigFile(location)
+    if err != nil {
+      return err
+    }
+    if err := collectConfigObject(store, extendedRaw, filepath.Dir(location), path+".extends", extendedChain); err != nil {
+      return err
+    }
   }
-}
 
-func collectExternalExtends(store *ConfigStore, raw any, baseDir, path string, allowRuntimeOnly bool) error {
-  switch typed := raw.(type) {
-  case string:
-    if allowRuntimeOnly {
-      store.eslintRuntime = true
-      store.eslintRuntimeRequired = true
-      return nil
+  files, err := parsePatternList(obj["files"], path+".files")
+  if err != nil {
+    return err
+  }
+  ignores, err := parsePatternList(obj["ignores"], path+".ignores")
+  if err != nil {
+    return err
+  }
+
+  rulesValue, hasRules := obj["rules"]
+  formatValue, hasFormat := obj["format"]
+  if hasRules || hasFormat {
+    // Expand the format block (if any) into a rules-shaped map, then
+    // overlay any explicit `rules` entries. `rules`-wins semantics: a
+    // `rules` entry that names a `format/*` rule fully replaces the
+    // entry expanded from the `format` block.
+    var formatRulesRaw map[string]any
+    if hasFormat {
+      formatMap, ok := formatValue.(map[string]any)
+      if !ok {
+        return fmt.Errorf("@ttsc/lint: %s.format must be an object, got %T", path, formatValue)
+      }
+      expanded, err := expandFormatBlock(formatMap)
+      if err != nil {
+        return err
+      }
+      formatRulesRaw = expanded
     }
-    return fmt.Errorf("@ttsc/lint: %s must be an object or flat config array, got %T", path, raw)
-  case []any:
-    for i, item := range typed {
-      itemPath := fmt.Sprintf("%s[%d]", path, i)
-      if _, ok := item.(string); ok && allowRuntimeOnly {
-        store.eslintRuntime = true
-        store.eslintRuntimeRequired = true
-        continue
+    var rulesMap map[string]any
+    if hasRules {
+      typedMap, ok := rulesValue.(map[string]any)
+      if !ok {
+        return fmt.Errorf("@ttsc/lint: %s.rules must be a rule severity map, got %T", path, rulesValue)
       }
-      if err := collectExternalConfigEntries(store, item, baseDir, itemPath, allowRuntimeOnly); err != nil {
+      rulesMap = typedMap
+    }
+    merged := mergeRuleMaps(formatRulesRaw, rulesMap)
+    if len(merged) > 0 {
+      parsed, err := parseExternalRuleMapInto(merged, path+".rules", store)
+      if err != nil {
         return err
       }
+      store.entries = append(store.entries, ConfigEntry{
+        BaseDir: baseDir,
+        Files:   files,
+        Ignores: ignores,
+        Rules:   parsed,
+      })
     }
     return nil
-  default:
-    return collectExternalConfigEntries(store, raw, baseDir, path, allowRuntimeOnly)
   }
+
+  if len(files) == 0 && len(ignores) > 0 {
+    store.entries = append(store.entries, ConfigEntry{
+      BaseDir:    baseDir,
+      Ignores:    ignores,
+      IgnoreOnly: true,
+    })
+  }
+  return nil
 }
 
 // parseExternalRuleMapInto parses the rules map and folds any
@@ -570,7 +609,7 @@ func parseExternalRuleMapInto(raw any, path string, store *ConfigStore) (RuleCon
 
 // collectExternalRuleMapWithOptions also records the rule's options blob
 // when the entry is a `[severity, options]` tuple. `opts` may be nil
-// when the caller does not need option capture (legacy paths).
+// when the caller does not need option capture.
 func collectExternalRuleMapWithOptions(out RuleConfig, opts RuleOptionsMap, raw any, path string) error {
   dict, ok := raw.(map[string]any)
   if !ok {
@@ -590,110 +629,37 @@ func collectExternalRuleMapWithOptions(out RuleConfig, opts RuleOptionsMap, raw
   return nil
 }
 
-func isESLintConfigObject(value map[string]any) bool {
-  for _, key := range []string{
-    "basePath",
-    "extends",
-    "files",
-    "format",
-    "ignores",
-    "languageOptions",
-    "linterOptions",
-    "name",
-    "plugins",
-    "processor",
-    "rules",
-    "settings",
-    "__ttscLintEslintRuntime",
-  } {
-    if _, ok := value[key]; ok {
-      return true
-    }
-  }
-  return false
-}
-
-func hasESLintRuntimeFields(value map[string]any) bool {
-  for _, key := range []string{
-    "languageOptions",
-    "linterOptions",
-    "processor",
-    "settings",
-  } {
-    if _, ok := value[key]; ok {
-      return true
-    }
-  }
-  if plugins, ok := value["plugins"]; ok {
-    if !isNativePluginMap(plugins) {
-      return true
-    }
-  }
-  return false
-}
-
-// isNativePluginMap reports whether every entry in a flat-config
-// `plugins` map points at a ttsc-lint native contributor object
-// (carrying a non-empty string `source` field). Native contributors are
-// compiled into the lint binary at build time and require no JS ESLint
-// runtime; only mixed or pure-ESLint plugin maps require the runtime
-// fallback.
-func isNativePluginMap(value any) bool {
-  dict, ok := value.(map[string]any)
-  if !ok {
-    return false
+// rejectUnknownConfigKeys surfaces typos in top-level config-file keys at the
+// boundary rather than silently ignoring them. The key set mirrors
+// `ITtscLintConfig` exactly.
+func rejectUnknownConfigKeys(value map[string]any, path string) error {
+  allowed := map[string]struct{}{
+    "files":   {},
+    "ignores": {},
+    "extends": {},
+    "plugins": {},
+    "rules":   {},
+    "format":  {},
   }
-  if len(dict) == 0 {
-    return true
-  }
-  for _, entry := range dict {
-    if !isNativePluginValue(entry) {
-      return false
-    }
-  }
-  return true
-}
-
-func isNativePluginValue(entry any) bool {
-  if entry == nil {
-    return false
-  }
-  switch typed := entry.(type) {
-  case string:
-    // A non-empty string is a native npm specifier (matching the JS
-    // factory's `normalizePluginValue` contract for `.js`/`.cjs`/`.ts`
-    // configs and the JSON-only `readJsonConfigPlugins` path). The JS
-    // factory resolves the specifier at load time and bakes the
-    // contributor into the binary, so the Go sidecar should not flip
-    // `eslintRuntimeRequired` for a file that already declared a
-    // native specifier.
-    return typed != ""
-  case map[string]any:
-    // Walk ESM-from-CJS `.default` indirection so a contributor authored
-    // as `export default plugin` registers as native here, matching the
-    // JS factory's `extractPluginSource` behavior.
-    current := typed
-    for i := 0; i < 4; i++ {
-      if source, ok := current["source"].(string); ok && source != "" {
-        return true
-      }
-      next, ok := current["default"].(map[string]any)
-      if !ok {
-        return false
-      }
-      current = next
+  for key := range value {
+    if _, ok := allowed[key]; !ok {
+      return fmt.Errorf("@ttsc/lint: %s has unknown key %q; a lint config file must be an ITtscLintConfig object (files, ignores, extends, plugins, rules, format)", path, key)
     }
-    return false
-  default:
-    return false
   }
+  return nil
 }
 
+// normalizeExternalRuleName strips the standard typescript-eslint namespace
+// prefixes so that rules like "@typescript-eslint/no-explicit-any" and the
+// bare "no-explicit-any" key both resolve to the same engine-internal name.
 func normalizeExternalRuleName(name string) string {
   name = strings.TrimPrefix(name, "@typescript-eslint/")
   return strings.TrimPrefix(name, "typescript-eslint/")
 }
 
+// parsePatternList coerces a raw config value to a string slice for use as a
+// `files` or `ignores` pattern list. Accepts a bare string (single-pattern
+// shorthand) or a string array. Empty patterns are rejected eagerly.
 func parsePatternList(raw any, path string) ([]string, error) {
   if raw == nil {
     return nil, nil
@@ -722,10 +688,9 @@ func parsePatternList(raw any, path string) ([]string, error) {
   }
 }
 
-// LoadRuleConfig resolves the lint config for one plugin entry. The only
-// accepted lint-specific tsconfig key is `config`; it may be either an inline
-// rules object or a string path to a standalone config file. Relative config
-// paths are resolved from the tsconfig directory.
+// LoadRuleConfig resolves the lint config for one plugin entry and flattens it
+// to a plain RuleConfig (no glob scoping). Used by callers and tests that only
+// need a project-wide severity map.
 func LoadRuleConfig(entry *PluginEntry, cwd, tsconfigPath string) (RuleConfig, error) {
   resolver, err := LoadConfigResolver(entry, cwd, tsconfigPath)
   if err != nil {
@@ -741,22 +706,17 @@ func LoadRuleConfig(entry *PluginEntry, cwd, tsconfigPath string) (RuleConfig, e
   }
 }
 
-// LoadConfigResolver resolves one plugin entry into the engine-facing
-// config model.
+// LoadConfigResolver resolves one plugin entry into the engine-facing config
+// model.
 //
-// Two equivalent input shapes are accepted:
+// The tsconfig plugin entry carries exactly one optional lint-specific key:
+// `configFile`, a path (relative to the tsconfig directory, or absolute) to
+// the lint config file. When `configFile` is set, that file is loaded; when it
+// is absent, a `lint.config.*` / `ttsc-lint.config.*` file is discovered by
+// walking upward from the tsconfig directory.
 //
-//   - `rules` (inline severity map) + `extends` (config file path) —
-//     the canonical fields mirroring ESLint flat-config vocabulary.
-//   - `config` (legacy) — accepts the same string-or-map values but
-//     emits a one-time stderr deprecation notice. Removed in a future
-//     minor.
-//
-// `rules` and `extends` are mutually exclusive on a single plugin
-// entry; mixing legacy `config` with either new field is rejected.
-// `configFile` and `configPath` remain reserved keywords surfaced with
-// a hint pointing at `extends`, in case a user mistakenly reaches for
-// either spelling.
+// All rules, format options, and contributor plugins live in the config file
+// itself — the tsconfig entry has no inline rule/format/plugin surface.
 func LoadConfigResolver(entry *PluginEntry, cwd, tsconfigPath string) (RuleResolver, error) {
   if entry == nil {
     return RuleConfig{}, nil
@@ -765,102 +725,17 @@ func LoadConfigResolver(entry *PluginEntry, cwd, tsconfigPath string) (RuleResol
   if inline == nil {
     inline = map[string]any{}
   }
-  for _, key := range []string{"configFile", "configPath"} {
-    if _, ok := inline[key]; ok {
-      return nil, fmt.Errorf("@ttsc/lint: %q is not supported; use \"extends\"", key)
-    }
-  }
-
-  rulesValue, hasRules := inline["rules"]
-  extendsValue, hasExtends := inline["extends"]
-  legacyValue, hasLegacy := inline["config"]
-  formatValue, hasFormat := inline["format"]
-
-  if hasLegacy && (hasRules || hasExtends || hasFormat) {
-    sibling := ""
-    switch {
-    case hasFormat && !hasRules && !hasExtends:
-      sibling = "format"
-    case hasExtends && !hasRules && !hasFormat:
-      sibling = "extends"
-    case hasRules && !hasExtends && !hasFormat:
-      sibling = "rules"
-    default:
-      sibling = "rules/extends/format"
-    }
-    return nil, fmt.Errorf("@ttsc/lint: tsconfig plugin entry mixes legacy \"config\" with the new %q field; remove \"config\" (deprecated)", sibling)
-  }
-  if hasRules && hasExtends {
-    return nil, fmt.Errorf("@ttsc/lint: \"rules\" and \"extends\" cannot be combined on a single plugin entry; put base rules in the \"extends\" file and inline overrides in lint.config.ts itself")
-  }
-  if hasFormat && hasExtends {
-    return nil, fmt.Errorf("@ttsc/lint: \"format\" and \"extends\" cannot be combined on a single plugin entry; put format options inside the extends-target lint.config.ts instead")
-  }
-
-  // Expand the format block (if any) into a rules-shaped map.
-  var formatRulesRaw map[string]any
-  if hasFormat {
-    formatMap, ok := formatValue.(map[string]any)
-    if !ok {
-      return nil, fmt.Errorf("@ttsc/lint: \"format\" must be an object, got %T", formatValue)
-    }
-    expanded, err := expandFormatBlock(formatMap)
-    if err != nil {
-      return nil, err
-    }
-    formatRulesRaw = expanded
-  }
 
-  if hasRules || hasFormat {
-    // Merge format defaults with inline rule overrides; the `rules`
-    // entry wins on key collisions (more explicit surface).
-    var rulesMap map[string]any
-    if hasRules {
-      typed, ok := rulesValue.(map[string]any)
-      if !ok {
-        return nil, fmt.Errorf("@ttsc/lint: \"rules\" must be a rule severity map, got %T", rulesValue)
-      }
-      rulesMap = typed
-    }
-    merged := mergeRuleMaps(formatRulesRaw, rulesMap)
-    if len(merged) == 0 {
-      return InlineRuleResolver{Rules: RuleConfig{}, Options: RuleOptionsMap{}}, nil
-    }
-    cfg, opts, err := ParseRulesWithOptions(merged)
-    if err != nil {
-      return nil, err
-    }
-    return InlineRuleResolver{Rules: cfg, Options: opts}, nil
-  }
-  if hasExtends {
-    extendsStr, ok := extendsValue.(string)
+  if configFileValue, ok := inline["configFile"]; ok {
+    configFile, ok := configFileValue.(string)
     if !ok {
-      return nil, fmt.Errorf("@ttsc/lint: \"extends\" must be a string path, got %T", extendsValue)
+      return nil, fmt.Errorf("@ttsc/lint: \"configFile\" must be a string path, got %T", configFileValue)
     }
-    if strings.TrimSpace(extendsStr) == "" {
-      return nil, fmt.Errorf("@ttsc/lint: \"extends\" must not be empty")
-    }
-    location := resolveConfigFilePath(extendsStr, cwd, tsconfigPath)
-    return loadExternalConfigResolver(location)
-  }
-  if hasLegacy {
-    emitLegacyConfigDeprecation()
-    switch typed := legacyValue.(type) {
-    case string:
-      if strings.TrimSpace(typed) == "" {
-        return nil, fmt.Errorf("@ttsc/lint: legacy \"config\" must not be empty")
-      }
-      location := resolveConfigFilePath(typed, cwd, tsconfigPath)
-      return loadExternalConfigResolver(location)
-    case map[string]any:
-      cfg, opts, err := ParseRulesWithOptions(typed)
-      if err != nil {
-        return nil, err
-      }
-      return InlineRuleResolver{Rules: cfg, Options: opts}, nil
-    default:
-      return nil, fmt.Errorf("@ttsc/lint: legacy \"config\" must be a string path or object, got %T", legacyValue)
+    if strings.TrimSpace(configFile) == "" {
+      return nil, fmt.Errorf("@ttsc/lint: \"configFile\" must not be empty")
     }
+    location := resolveConfigFilePath(configFile, cwd, tsconfigPath)
+    return loadConfigResolver(location)
   }
 
   discovered, err := findLintConfigFile(cwd, tsconfigPath)
@@ -868,29 +743,22 @@ func LoadConfigResolver(entry *PluginEntry, cwd, tsconfigPath string) (RuleResol
     return nil, err
   }
   if discovered == "" {
-    return nil, fmt.Errorf("@ttsc/lint: \"rules\" or \"extends\" is required when no lint.config.*, ttsc-lint.config.*, or supported eslint.config.* file can be discovered (searched upward from %s)", cwd)
+    return nil, fmt.Errorf("@ttsc/lint: no lint.config.* or ttsc-lint.config.* file found (searched upward from %s); create one or set \"configFile\" on the tsconfig plugin entry", cwd)
   }
-  return loadExternalConfigResolver(discovered)
-}
-
-var legacyConfigDeprecationOnce sync.Once
-
-func emitLegacyConfigDeprecation() {
-  legacyConfigDeprecationOnce.Do(func() {
-    fmt.Fprintln(os.Stderr, "@ttsc/lint: tsconfig plugin entry \"config\" is deprecated; use \"rules\" for inline severity maps or \"extends\" for a config file path.")
-  })
+  return loadConfigResolver(discovered)
 }
 
-func loadExternalConfigResolver(location string) (RuleResolver, error) {
+// loadConfigResolver loads and parses the lint config file at `location` into
+// a *ConfigStore and returns it as a RuleResolver.
+func loadConfigResolver(location string) (RuleResolver, error) {
   raw, err := loadConfigFile(location)
   if err != nil {
     return nil, err
   }
-  store, err := parseExternalConfigStoreForFile(raw, filepath.Dir(location))
+  store, err := collectConfigStore(raw, filepath.Dir(location), location)
   if err != nil {
     return nil, err
   }
-  store.externalConfigPath = location
   return store, nil
 }
 
@@ -913,12 +781,6 @@ func findLintConfigFile(cwd, tsconfigPath string) (string, error) {
       "ttsc-lint.config.ts",
       "ttsc-lint.config.mts",
       "ttsc-lint.config.cts",
-      "eslint.config.js",
-      "eslint.config.mjs",
-      "eslint.config.cjs",
-      "eslint.config.ts",
-      "eslint.config.mts",
-      "eslint.config.cts",
     } {
       candidate := filepath.Join(dir, name)
       if stat, err := os.Stat(candidate); err == nil && !stat.IsDir() {
@@ -930,7 +792,7 @@ func findLintConfigFile(cwd, tsconfigPath string) (string, error) {
       for _, m := range matches {
         names = append(names, filepath.Base(m))
       }
-      return "", fmt.Errorf("@ttsc/lint: multiple lint config files found in %s (%s); set \"extends\" explicitly", dir, strings.Join(names, ", "))
+      return "", fmt.Errorf("@ttsc/lint: multiple lint config files found in %s (%s); set \"configFile\" explicitly", dir, strings.Join(names, ", "))
     }
     if len(matches) == 1 {
       return matches[0], nil
@@ -943,6 +805,9 @@ func findLintConfigFile(cwd, tsconfigPath string) (string, error) {
   }
 }
 
+// resolveConfigFilePath resolves a user-supplied config path to an absolute
+// path. Absolute paths are returned unchanged; relative paths are joined to the
+// tsconfig directory (or cwd when no tsconfig is set).
 func resolveConfigFilePath(configPath, cwd, tsconfigPath string) string {
   if filepath.IsAbs(configPath) {
     return configPath
@@ -950,6 +815,10 @@ func resolveConfigFilePath(configPath, cwd, tsconfigPath string) string {
   return filepath.Join(tsconfigBaseDir(cwd, tsconfigPath), configPath)
 }
 
+// discoveryConfigBaseDir returns the directory from which auto-discovery walks
+// upward when no explicit config path is provided. Prefer the tsconfig
+// directory over cwd so that nested package configs are found relative to the
+// tsconfig that triggered the lint run.
 func discoveryConfigBaseDir(cwd, tsconfigPath string) string {
   if tsconfigPath != "" {
     resolvedTsconfig := tsconfigPath
@@ -961,6 +830,9 @@ func discoveryConfigBaseDir(cwd, tsconfigPath string) string {
   return cwd
 }
 
+// tsconfigBaseDir returns the directory that contains the tsconfig file, or
+// cwd when tsconfigPath is empty. Used as the base for relative config paths
+// supplied in the tsconfig plugin entry.
 func tsconfigBaseDir(cwd, tsconfigPath string) string {
   if tsconfigPath == "" {
     return cwd
@@ -972,20 +844,171 @@ func tsconfigBaseDir(cwd, tsconfigPath string) string {
   return filepath.Dir(resolvedTsconfig)
 }
 
+// loadConfigFile loads and deserializes a lint config file at `location`.
+// The file format is determined by extension: .json is parsed natively;
+// .js/.cjs/.mjs run through a Node subprocess; .ts/.cts/.mts run through ttsx.
+// The two subprocess-backed forms go through loadCachedConfigFile so that a
+// monorepo build — which spawns one `ttsc` process per package — evaluates a
+// shared lint config once instead of once per package.
 func loadConfigFile(location string) (any, error) {
   ext := strings.ToLower(filepath.Ext(location))
   switch ext {
   case ".json":
     return loadJSONConfigFile(location)
   case ".js", ".cjs", ".mjs":
-    return loadScriptConfigFile(location)
+    return loadCachedConfigFile(location, loadScriptConfigFile)
   case ".ts", ".cts", ".mts":
-    return loadTypeScriptConfigFile(location)
+    return loadCachedConfigFile(location, loadTypeScriptConfigFile)
   default:
     return nil, fmt.Errorf("@ttsc/lint: unsupported config file extension %q for %s", ext, location)
   }
 }
 
+// configCacheVersion namespaces the on-disk config cache. Bump it whenever
+// the shape of a cached config object changes so that entries written by an
+// older @ttsc/lint binary are treated as a miss rather than silently reused.
+const configCacheVersion = "v1"
+
+// configEvalCache memoizes evaluated .ts/.js lint config objects for the
+// lifetime of one process; the on-disk cache (configCacheDir) extends the
+// same memoization across the separate `ttsc` processes a monorepo build
+// spawns. Guarded by configEvalCacheMu.
+var (
+  configEvalCacheMu sync.Mutex
+  configEvalCache   = map[string]any{}
+)
+
+// configCacheDir is the directory shared by this Go sidecar and the JS
+// plugin factory (packages/lint/src/index.ts) for cached lint configs.
+// Evaluating a .ts/.js config means spawning a ttsx/node subprocess; the
+// cache keeps every `ttsc` invocation after the first from re-paying it.
+func configCacheDir() string {
+  return filepath.Join(os.TempDir(), "ttsc-lint-config-cache")
+}
+
+// configCacheDisabled reports whether the env opt-out is set — an escape
+// hatch for callers that must force a fresh evaluation (e.g. a config whose
+// behavior depends on imported non-config files that the key cannot see).
+func configCacheDisabled() bool {
+  return os.Getenv("TTSC_LINT_DISABLE_CONFIG_CACHE") != ""
+}
+
+// configCacheKey derives the cache key for a config file from a version
+// tag, a namespace `kind`, the file's absolute path, and its exact
+// contents. Content-addressing means an edited config invalidates cleanly
+// with no clock-resolution race; the absolute path keeps two projects with
+// byte-identical configs distinct; `kind` separates this sidecar's
+// evaluated-config namespace from the JS factory's plugin-entry namespace.
+func configCacheKey(kind, absPath string, content []byte) string {
+  h := sha256.New()
+  h.Write([]byte(configCacheVersion))
+  h.Write([]byte{0})
+  h.Write([]byte(kind))
+  h.Write([]byte{0})
+  h.Write([]byte(absPath))
+  h.Write([]byte{0})
+  h.Write(content)
+  return hex.EncodeToString(h.Sum(nil))
+}
+
+// loadCachedConfigFile wraps a subprocess-backed config loader (`eval`)
+// with the two-tier (in-process + on-disk) config cache. The cache key
+// covers the config file's path and bytes only — a config's own `import`s
+// of non-config files are NOT tracked, since a lint config is expected to
+// be self-contained; set TTSC_LINT_DISABLE_CONFIG_CACHE when it is not.
+// Errors are never cached: a failed evaluation re-runs next time.
+func loadCachedConfigFile(location string, eval func(string) (any, error)) (any, error) {
+  if configCacheDisabled() {
+    return eval(location)
+  }
+  content, err := os.ReadFile(location)
+  if err != nil {
+    return nil, fmt.Errorf("@ttsc/lint: read config file %s: %w", location, err)
+  }
+  abs := location
+  if resolved, absErr := filepath.Abs(location); absErr == nil {
+    abs = resolved
+  }
+  key := configCacheKey("config", abs, content)
+
+  configEvalCacheMu.Lock()
+  cached, ok := configEvalCache[key]
+  configEvalCacheMu.Unlock()
+  if ok {
+    return cached, nil
+  }
+  if value, hit := readConfigDiskCache(key); hit {
+    configEvalCacheMu.Lock()
+    configEvalCache[key] = value
+    configEvalCacheMu.Unlock()
+    return value, nil
+  }
+
+  value, err := eval(location)
+  if err != nil {
+    return nil, err
+  }
+  configEvalCacheMu.Lock()
+  configEvalCache[key] = value
+  configEvalCacheMu.Unlock()
+  writeConfigDiskCache(key, value)
+  return value, nil
+}
+
+// readConfigDiskCache returns the cached config object for `key`, or
+// (nil, false) on any miss — a missing file, an unreadable file, or
+// content that no longer parses as a config object. Every failure is a
+// soft miss: the caller re-evaluates rather than surfacing a cache fault.
+func readConfigDiskCache(key string) (any, bool) {
+  body, err := os.ReadFile(filepath.Join(configCacheDir(), key+".json"))
+  if err != nil {
+    return nil, false
+  }
+  var value any
+  if err := json.Unmarshal(body, &value); err != nil {
+    return nil, false
+  }
+  if !isConfigObject(value) {
+    return nil, false
+  }
+  return value, true
+}
+
+// writeConfigDiskCache stores `value` under `key`. It is best-effort: a
+// failure to create the directory or write the file leaves the cache cold
+// (the next run re-evaluates) rather than failing the lint run. The write
+// goes through a temp file + rename so a concurrent reader in a sibling
+// `ttsc` process never observes a half-written entry.
+func writeConfigDiskCache(key string, value any) {
+  body, err := json.Marshal(value)
+  if err != nil {
+    return
+  }
+  dir := configCacheDir()
+  if err := os.MkdirAll(dir, 0o755); err != nil {
+    return
+  }
+  tmp, err := os.CreateTemp(dir, key+".*.tmp")
+  if err != nil {
+    return
+  }
+  tmpName := tmp.Name()
+  if _, err := tmp.Write(body); err != nil {
+    tmp.Close()
+    os.Remove(tmpName)
+    return
+  }
+  if err := tmp.Close(); err != nil {
+    os.Remove(tmpName)
+    return
+  }
+  if err := os.Rename(tmpName, filepath.Join(dir, key+".json")); err != nil {
+    os.Remove(tmpName)
+  }
+}
+
+// loadJSONConfigFile reads and JSON-parses a lint config file. A leading UTF-8
+// BOM is stripped before parsing so files saved by Windows editors are accepted.
 func loadJSONConfigFile(location string) (any, error) {
   body, err := os.ReadFile(location)
   if err != nil {
@@ -1000,12 +1023,17 @@ func loadJSONConfigFile(location string) (any, error) {
   if err := json.Unmarshal(body, &out); err != nil {
     return nil, fmt.Errorf("@ttsc/lint: parse config file %s: %w", location, err)
   }
-  if !isConfigContainer(out) {
-    return nil, fmt.Errorf("@ttsc/lint: config file %s must export an object or flat config array", location)
+  if !isConfigObject(out) {
+    return nil, fmt.Errorf("@ttsc/lint: config file %s must export an ITtscLintConfig object", location)
   }
   return out, nil
 }
 
+// loadScriptConfigFile evaluates a .js/.cjs/.mjs config file by running a
+// Node subprocess that dynamic-imports the file, resolves the exported config
+// through the same 8-hop default/config unwrap used by the TS loader, and
+// serializes the result as JSON to stdout. The subprocess has a
+// configLoaderTimeout deadline to prevent user code from hanging indefinitely.
 func loadScriptConfigFile(location string) (any, error) {
   const script = `
 const { pathToFileURL } = require("node:url");
@@ -1032,8 +1060,8 @@ const { pathToFileURL } = require("node:url");
     break;
   }
   const value = typeof current === "function" ? await current() : current;
-  if (value === null || typeof value !== "object") {
-    throw new Error("config file must export an object or flat config array");
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("config file must export an ITtscLintConfig object");
   }
   process.stdout.write(JSON.stringify(toSerializableConfig(value)));
 })().catch((error) => {
@@ -1041,114 +1069,18 @@ const { pathToFileURL } = require("node:url");
   process.exit(1);
 });
 
+// toSerializableConfig copies every ITtscLintConfig key onto a plain object so
+// it survives the JSON round trip to the Go sidecar. Every key is copied
+// verbatim — files, ignores, extends, plugins, rules, AND format — so a config
+// whose only key is ` + "`" + `format` + "`" + ` is not silently dropped.
 function toSerializableConfig(value) {
-  if (Array.isArray(value)) {
-    return value.map((item) => toSerializableConfig(item));
-  }
-  if (value === null || typeof value !== "object") {
-    return value;
-  }
-  if (isESLintConfigObject(value)) {
-    const out = {};
-    if (hasESLintRuntimeFields(value)) {
-      out.__ttscLintEslintRuntime = true;
-    }
-    if (Object.prototype.hasOwnProperty.call(value, "basePath")) {
-      out.basePath = value.basePath;
-    }
-    if (Object.prototype.hasOwnProperty.call(value, "extends")) {
-      out.extends = toSerializableConfig(value.extends);
-    }
-    if (Object.prototype.hasOwnProperty.call(value, "files")) {
-      out.files = toSerializablePatterns(value.files, "files");
-    }
-    if (Object.prototype.hasOwnProperty.call(value, "ignores")) {
-      out.ignores = toSerializablePatterns(value.ignores, "ignores");
-    }
-    if (Object.prototype.hasOwnProperty.call(value, "rules")) {
-      out.rules = toSerializableRules(value.rules);
-    }
-    return out;
-  }
-  return { rules: toSerializableRules(value) };
-}
-
-function toSerializableRules(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("rules must be an object");
-  }
-  return Object.fromEntries(Object.entries(value));
-}
-
-function toSerializablePatterns(value, key) {
-  if (typeof value === "string") {
-    return value;
-  }
-  if (Array.isArray(value)) {
-    return value.map((item, index) => {
-      if (typeof item !== "string") {
-        throw new Error(key + "[" + index + "] must be a string");
-      }
-      return item;
-    });
-  }
-  throw new Error(key + " must be a string or string array");
-}
-
-function isESLintConfigObject(value) {
-  return [
-    "basePath",
-    "extends",
-    "files",
-    "ignores",
-    "languageOptions",
-    "linterOptions",
-    "name",
-    "plugins",
-    "processor",
-    "rules",
-    "settings",
-  ].some((key) => Object.prototype.hasOwnProperty.call(value, key));
-}
-
-function hasESLintRuntimeFields(value) {
-  for (const key of ["languageOptions", "linterOptions", "processor", "settings"]) {
-    if (Object.prototype.hasOwnProperty.call(value, key)) return true;
-  }
-  if (Object.prototype.hasOwnProperty.call(value, "plugins")) {
-    if (!isNativePluginMap(value.plugins)) return true;
-  }
-  return false;
-}
-
-function isNativePluginMap(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    return false;
-  }
-  const entries = Object.values(value);
-  if (entries.length === 0) return true;
-  for (const entry of entries) {
-    if (!isNativePluginValue(entry)) return false;
-  }
-  return true;
-}
-
-function isNativePluginValue(entry) {
-  // A non-empty string is a native specifier — JS factory resolves it
-  // at load time, so the loader must not flip the ESLint-runtime flag.
-  if (typeof entry === "string") return entry.length > 0;
-  if (entry === null || typeof entry !== "object") return false;
-  let current = entry;
-  for (let i = 0; i < 4; i++) {
-    if (typeof current.source === "string" && current.source.length > 0) {
-      return true;
-    }
-    if (current.default === null || typeof current.default !== "object") {
-      return false;
+  const out = {};
+  for (const key of ["files", "ignores", "extends", "plugins", "rules", "format"]) {
+    if (Object.prototype.hasOwnProperty.call(value, key)) {
+      out[key] = value[key];
     }
-    current = current.default;
   }
-  return false;
+  return out;
 }
 `
   node := os.Getenv("TTSC_NODE_BINARY")
@@ -1176,12 +1108,17 @@ function isNativePluginValue(entry) {
   if err := json.Unmarshal(output, &out); err != nil {
     return nil, fmt.Errorf("@ttsc/lint: parse config file %s output: %w", location, err)
   }
-  if !isConfigContainer(out) {
-    return nil, fmt.Errorf("@ttsc/lint: config file %s must export an object or flat config array", location)
+  if !isConfigObject(out) {
+    return nil, fmt.Errorf("@ttsc/lint: config file %s must export an ITtscLintConfig object", location)
   }
   return out, nil
 }
 
+// loadTypeScriptConfigFile evaluates a .ts/.cts/.mts config file by writing
+// an ephemeral loader script and tsconfig into a temp directory, symlinking the
+// nearest node_modules, then running `ttsx` with a configLoaderTimeout deadline.
+// The loader script imports the config file, resolves it through the same
+// unwrap chain used by loadScriptConfigFile, and writes JSON to stdout.
 func loadTypeScriptConfigFile(location string) (any, error) {
   tempDir, err := os.MkdirTemp("", "ttsc-lint-config-")
   if err != nil {
@@ -1214,6 +1151,15 @@ func loadTypeScriptConfigFile(location string) (any, error) {
     "--project", tsconfig,
     "--cwd", tempDir,
     "--cache-dir", filepath.Join(tempDir, "cache"),
+    // The loader only needs to type-check and execute the user's
+    // `*.config.ts`; it must NOT load the host project's transform /
+    // check plugins. Discovering them (`@nestia/core`, `typia`, …)
+    // would run their project checks against this ephemeral loader
+    // tsconfig — which is deliberately lenient (`strict: false`) — so a
+    // plugin like `@nestia/core` that demands strict mode would fail
+    // the build and abort config evaluation. `--no-plugins` makes the
+    // ttsx build hermetic.
+    "--no-plugins",
   }
   if tsgo := os.Getenv("TTSC_TSGO_BINARY"); tsgo != "" {
     args = append(args, "--binary", tsgo)
@@ -1242,21 +1188,25 @@ func loadTypeScriptConfigFile(location string) (any, error) {
   if err := json.Unmarshal(output, &out); err != nil {
     return nil, fmt.Errorf("@ttsc/lint: parse TypeScript config file %s output: %w", location, err)
   }
-  if !isConfigContainer(out) {
-    return nil, fmt.Errorf("@ttsc/lint: config file %s must export an object or flat config array", location)
+  if !isConfigObject(out) {
+    return nil, fmt.Errorf("@ttsc/lint: config file %s must export an ITtscLintConfig object", location)
   }
   return out, nil
 }
 
-func isConfigContainer(value any) bool {
-  switch value.(type) {
-  case []any, map[string]any:
-    return true
-  default:
-    return false
-  }
+// isConfigObject reports whether `value` is a top-level config object. A lint
+// config file always exports a single `ITtscLintConfig` object; arrays and
+// scalars are rejected so users get a clear error instead of an opaque parse
+// failure downstream.
+func isConfigObject(value any) bool {
+  _, ok := value.(map[string]any)
+  return ok
 }
 
+// relativeImportSpecifier computes the ESM import specifier for `location`
+// relative to `fromDir`. The result always starts with "./" or "../" so it is
+// treated as a relative path by the ESM loader rather than as a bare package
+// name.
 func relativeImportSpecifier(fromDir, location string) (string, error) {
   relative, err := filepath.Rel(fromDir, location)
   if err != nil {
@@ -1269,6 +1219,11 @@ func relativeImportSpecifier(fromDir, location string) (string, error) {
   return "./" + relative, nil
 }
 
+// typeScriptConfigLoaderSource returns the TypeScript source of the ephemeral
+// loader script that ttsx executes to evaluate a TypeScript lint config file.
+// `importLiteral` is a JSON-encoded relative import path (e.g. `"./lint.config.ts"`)
+// that is spliced directly into the `import * as` statement, so it must
+// already be a valid JSON string (produced by json.Marshal).
 func typeScriptConfigLoaderSource(importLiteral string) string {
   return fmt.Sprintf(`import * as importedConfig from %s;
 
@@ -1280,8 +1235,8 @@ declare const process: {
 
 try {
   const value = await resolveConfig(importedConfig, true);
-  if (!isObject(value)) {
-    throw new Error("config file must export an object or flat config array");
+  if (!isObject(value) || Array.isArray(value)) {
+    throw new Error("config file must export an ITtscLintConfig object");
   }
   process.stdout.write(JSON.stringify(toSerializableConfig(value)));
 } catch (error) {
@@ -1318,130 +1273,26 @@ function hasOwn(value: Record<string, unknown>, key: string): boolean {
   return Object.prototype.hasOwnProperty.call(value, key);
 }
 
-function toSerializableConfig(value: unknown): unknown {
-  if (Array.isArray(value)) {
-    return value.map((item) => toSerializableConfig(item));
-  }
-  if (!isObject(value)) {
-    return value;
-  }
-  if (isESLintConfigObject(value)) {
-    const out: Record<string, unknown> = {};
-    if (hasESLintRuntimeFields(value)) {
-      out.__ttscLintEslintRuntime = true;
+// toSerializableConfig copies every ITtscLintConfig key onto a plain object so
+// it survives the JSON round trip to the Go sidecar. Every key is copied
+// verbatim — files, ignores, extends, plugins, rules, AND format — so a config
+// whose only key is "format" is not silently dropped.
+function toSerializableConfig(value: Record<string, unknown>): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const key of ["files", "ignores", "extends", "plugins", "rules", "format"]) {
+    if (hasOwn(value, key)) {
+      out[key] = value[key];
     }
-    if (hasOwn(value, "basePath")) {
-      out.basePath = value.basePath;
-    }
-    if (hasOwn(value, "extends")) {
-      out.extends = toSerializableConfig(value.extends);
-    }
-    if (hasOwn(value, "files")) {
-      out.files = toSerializablePatterns(value.files, "files");
-    }
-    if (hasOwn(value, "ignores")) {
-      out.ignores = toSerializablePatterns(value.ignores, "ignores");
-    }
-    if (hasOwn(value, "rules")) {
-      out.rules = toSerializableRules(value.rules);
-    }
-    return out;
-  }
-  return { rules: toSerializableRules(value) };
-}
-
-function toSerializableRules(value: unknown): Record<string, unknown> {
-  if (!isObject(value) || Array.isArray(value)) {
-    throw new Error("rules must be an object");
-  }
-  return Object.fromEntries(Object.entries(value));
-}
-
-function toSerializablePatterns(value: unknown, key: string): string | string[] {
-  if (typeof value === "string") {
-    return value;
-  }
-  if (Array.isArray(value)) {
-    return value.map((item, index) => {
-      if (typeof item !== "string") {
-        throw new Error(key + "[" + index + "] must be a string");
-      }
-      return item;
-    });
-  }
-  throw new Error(key + " must be a string or string array");
-}
-
-function isESLintConfigObject(value: Record<string, unknown>): boolean {
-  return [
-    "basePath",
-    "extends",
-    "files",
-    "ignores",
-    "languageOptions",
-    "linterOptions",
-    "name",
-    "plugins",
-    "processor",
-    "rules",
-    "settings",
-  ].some((key) => hasOwn(value, key));
-}
-
-function hasESLintRuntimeFields(value: Record<string, unknown>): boolean {
-  for (const key of ["languageOptions", "linterOptions", "processor", "settings"]) {
-    if (hasOwn(value, key)) return true;
   }
-  if (hasOwn(value, "plugins")) {
-    const plugins = value.plugins;
-    if (!isNativePluginMap(plugins)) return true;
-  }
-  return false;
-}
-
-// isNativePluginMap reports whether every entry of a plugins map points
-// at a ttsc-lint native contributor (an object with a string "source"
-// field). Native plugins are compiled into the lint binary at build
-// time, so their presence does NOT require the JavaScript ESLint
-// runtime; only mixed or pure-ESLint plugin maps do.
-function isNativePluginMap(value: unknown): boolean {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    return false;
-  }
-  const entries = Object.values(value as Record<string, unknown>);
-  if (entries.length === 0) return true;
-  for (const entry of entries) {
-    if (!isNativePluginValue(entry)) return false;
-  }
-  return true;
-}
-
-function isNativePluginValue(entry: unknown): boolean {
-  // A non-empty string is a native specifier — see the matching Go-side
-  // and JS-loader implementations.
-  if (typeof entry === "string") return entry.length > 0;
-  if (entry === null || typeof entry !== "object") return false;
-  // ESM-from-CJS interop wraps CJS modules' "exports.default" so a
-  // contributor authored as "export default plugin" lands under a
-  // ".default" indirection. Walk a few hops so both "export default"
-  // and plain "module.exports = plugin" contributors register as
-  // native here.
-  let current = entry as Record<string, unknown>;
-  for (let i = 0; i < 4; i++) {
-    if (typeof current.source === "string" && (current.source as string).length > 0) {
-      return true;
-    }
-    const next = current.default;
-    if (next === null || typeof next !== "object" || Array.isArray(next)) {
-      return false;
-    }
-    current = next as Record<string, unknown>;
-  }
-  return false;
+  return out;
 }
 `, importLiteral)
 }
 
+// typeScriptConfigLoaderTsconfig generates the JSON content of the ephemeral
+// tsconfig that compiles the loader script. Settings mirror the JS-factory
+// loader's lenient baseline so identical user configs evaluate the same way
+// from both the JS and Go sides.
 func typeScriptConfigLoaderTsconfig(loader, location, outDir string) string {
   // Mirror the JS-factory loader's lenient settings (see the matching
   // tsconfig synthesis in `packages/lint/src/index.ts::readTtsxConfigPlugins`).
@@ -1478,6 +1329,8 @@ func typeScriptConfigLoaderTsconfig(loader, location, outDir string) string {
   return string(body)
 }
 
+// ttsxCommand returns a ttsx exec.Cmd bound to a background context. Use
+// ttsxCommandContext when a deadline is needed (e.g. config file loading).
 func ttsxCommand(args ...string) *exec.Cmd {
   return ttsxCommandContext(context.Background(), args...)
 }
@@ -1501,6 +1354,9 @@ func ttsxCommandContext(ctx context.Context, args ...string) *exec.Cmd {
   return exec.CommandContext(ctx, ttsx, args...)
 }
 
+// shouldRunTtsxThroughNode reports whether the resolved ttsx binary is a
+// script (JS or TS extension) rather than a compiled native executable.
+// Scripts must be executed via `node <binary> <args>` instead of directly.
 func shouldRunTtsxThroughNode(binary string) bool {
   switch strings.ToLower(filepath.Ext(binary)) {
   case ".js", ".cjs", ".mjs", ".ts", ".cts", ".mts":
@@ -1510,6 +1366,10 @@ func shouldRunTtsxThroughNode(binary string) bool {
   }
 }
 
+// nodeConfigLoaderEnv builds the environment for a Node.js config-loader
+// subprocess. It prepends the nearest node_modules directory to NODE_PATH so
+// that imports in .js/.cjs/.mjs config files resolve correctly even when the
+// subprocess's cwd differs from the config file's location.
 func nodeConfigLoaderEnv(location string) []string {
   env := os.Environ()
   parts := make([]string, 0, 2)
@@ -1525,6 +1385,11 @@ func nodeConfigLoaderEnv(location string) []string {
   return setEnv(env, "NODE_PATH", strings.Join(parts, string(os.PathListSeparator)))
 }
 
+// linkNearestNodeModules creates a node_modules symlink (or Windows junction)
+// inside `tempDir` that points at the nearest node_modules directory found
+// upward from `sourceDir`. This lets the TypeScript config loader resolve
+// imports from the user's project without copying the entire module tree.
+// If no node_modules directory exists, the function is a no-op.
 func linkNearestNodeModules(tempDir, sourceDir string) error {
   nodeModules := findNearestNodeModules(sourceDir)
   if nodeModules == "" {
@@ -1550,6 +1415,10 @@ func linkNearestNodeModules(tempDir, sourceDir string) error {
   return fmt.Errorf("@ttsc/lint: link config node_modules %s: %w", nodeModules, err)
 }
 
+// createWindowsJunction creates a directory junction at `link` pointing at
+// `target` using `cmd /c mklink /J`. Junctions do not require elevated
+// privileges (unlike symlinks on Windows), making them the right fallback when
+// os.Symlink fails.
 func createWindowsJunction(link, target string) error {
   // `cmd /c mklink /J link target` is the standard recipe and works
   // without elevated privileges. Both arguments must be absolute paths
@@ -1561,6 +1430,9 @@ func createWindowsJunction(link, target string) error {
   return nil
 }
 
+// findNearestNodeModules walks upward from `start` and returns the first
+// node_modules directory found, or the empty string if the filesystem root is
+// reached without a match.
 func findNearestNodeModules(start string) string {
   dir := filepath.Clean(start)
   for {
@@ -1576,6 +1448,9 @@ func findNearestNodeModules(start string) string {
   }
 }
 
+// setEnv updates an existing key=value entry in `env` (in-place) or appends
+// a new one. It is intentionally a pure-slice helper — no os.Setenv side
+// effects — so callers can pass it directly to exec.Cmd.Env.
 func setEnv(env []string, key, value string) []string {
   prefix := key + "="
   for i, entry := range env {
@@ -1587,44 +1462,16 @@ func setEnv(env []string, key, value string) []string {
   return append(env, prefix+value)
 }
 
-// parseExternalRuleEntry mirrors parseRuleEntry for ESLint-style config
-// inputs. The contract is identical to the inline path: severity
-// literal, `[severity]`, or `[severity, options]`. Tuples longer than
-// two elements are rejected because no built-in rule's option struct
-// models positional ESLint args, so silently encoding the tail as a
-// JSON array would land in `DecodeOptions` and fall back to defaults
-// — a silent fallback the standard parser deliberately avoids.
+// parseExternalRuleEntry delegates to parseRuleEntry. It is kept under this
+// name because test files in the same package call it directly.
 func parseExternalRuleEntry(v any) (Severity, json.RawMessage, error) {
-  if tuple, ok := v.([]any); ok {
-    if len(tuple) == 0 {
-      return SeverityOff, nil, fmt.Errorf("severity tuple must not be empty")
-    }
-    sev, err := parseSeverity(tuple[0])
-    if err != nil {
-      return SeverityOff, nil, err
-    }
-    if len(tuple) == 1 {
-      return sev, nil, nil
-    }
-    if len(tuple) > 2 {
-      return SeverityOff, nil, fmt.Errorf("severity tuple must be [severity] or [severity, options], got %d elements", len(tuple))
-    }
-    if tuple[1] == nil {
-      return sev, nil, nil
-    }
-    if _, ok := tuple[1].(map[string]any); !ok {
-      return SeverityOff, nil, fmt.Errorf("severity tuple's options slot must be an object, got %T", tuple[1])
-    }
-    encoded, err := json.Marshal(tuple[1])
-    if err != nil {
-      return SeverityOff, nil, fmt.Errorf("encode options: %w", err)
-    }
-    return sev, encoded, nil
-  }
-  sev, err := parseSeverity(v)
-  return sev, nil, err
+  return parseRuleEntry(v)
 }
 
+// parseSeverity converts a raw config value to a Severity. Accepts the string
+// literals "off", "warn"/"warning", "error" and the numeric equivalents 0, 1,
+// 2 (the ESLint convention). Any other value is a hard error — there is no
+// silent fallback so typos are surfaced immediately.
 func parseSeverity(v any) (Severity, error) {
   switch x := v.(type) {
   case string:
@@ -1651,6 +1498,9 @@ func parseSeverity(v any) (Severity, error) {
   return SeverityOff, fmt.Errorf("severity must be one of: off | warn | warning | error | 0 | 1 | 2, got %T", v)
 }
 
+// sortedRuleNames returns the sorted slice of rule names from `config` for
+// which `include` returns true. Sorting ensures deterministic dispatch-table
+// ordering so test output and diagnostic ordering are stable across runs.
 func sortedRuleNames(config RuleConfig, include func(Severity) bool) []string {
   names := make([]string, 0, len(config))
   for name, sev := range config {
@@ -1662,6 +1512,12 @@ func sortedRuleNames(config RuleConfig, include func(Severity) bool) []string {
   return names
 }
 
+// matchAnyPattern reports whether `fileName` matches at least one of the
+// provided glob patterns. If baseDir is non-empty, both paths are made
+// absolute before computing a relative path so that glob patterns rooted at
+// the config file's directory match correctly regardless of the process cwd.
+// Files outside the base directory never match (the relative path would start
+// with "..").
 func matchAnyPattern(baseDir string, patterns []string, fileName string) bool {
   rel := filepath.ToSlash(fileName)
   if baseDir != "" {
@@ -1689,6 +1545,10 @@ func matchAnyPattern(baseDir string, patterns []string, fileName string) bool {
   return false
 }
 
+// normalizeGlobPattern normalizes a user-supplied glob pattern to forward
+// slashes and strips a leading "./". Patterns that contain no slash are treated
+// as basename-only globs by prepending "**/" so that `*.ts` matches any
+// TypeScript file regardless of directory depth, matching ESLint's behavior.
 func normalizeGlobPattern(pattern string) string {
   pattern = filepath.ToSlash(pattern)
   pattern = strings.TrimPrefix(pattern, "./")
@@ -1698,20 +1558,120 @@ func normalizeGlobPattern(pattern string) string {
   return pattern
 }
 
+// matchGlob tests whether `name` matches `pattern` using the ESLint-compatible
+// glob semantics implemented by matchGlobParts. Both strings are trimmed of
+// leading/trailing slashes before splitting on "/" so that empty segments do
+// not appear in the part slices. Brace alternatives (`{a,b,c}`) are expanded
+// before matching so patterns like `src/foo/{a.ts,b.ts}` reach every branch —
+// Go's `filepath.Match` does not honor brace expansion natively.
 func matchGlob(pattern, name string) bool {
   pattern = strings.Trim(pattern, "/")
   name = strings.Trim(name, "/")
   if pattern == "" {
     return name == ""
   }
-  patternParts := strings.Split(pattern, "/")
   nameParts := []string{}
   if name != "" {
     nameParts = strings.Split(name, "/")
   }
-  return matchGlobParts(patternParts, nameParts)
+  for _, expanded := range expandBraces(pattern) {
+    if matchGlobParts(strings.Split(expanded, "/"), nameParts) {
+      return true
+    }
+  }
+  return false
+}
+
+// expandBraces expands shell-style brace alternatives (`{a,b,c}`) in `pattern`
+// into the equivalent flat list of patterns. The expansion is recursive: a
+// pattern with multiple brace groups produces the Cartesian product across all
+// groups. Patterns with no braces, or with an unmatched opening `{`, are
+// returned unchanged so that callers can treat the result as an authoritative
+// list of every concrete alternative the user wrote.
+//
+// Only top-level braces are recognized; nested braces inside another brace
+// group's alternative are honored by the recursion in alternative expansion,
+// but escaped braces (`\{`, `\}`) are not currently supported because lint
+// config patterns have no reason to embed literal braces. If a user ever needs
+// one, the simplest workaround is to author the glob without the brace group.
+func expandBraces(pattern string) []string {
+  open := strings.IndexByte(pattern, '{')
+  if open < 0 {
+    return []string{pattern}
+  }
+  // Find the matching close brace, accounting for nested groups so the
+  // outermost group is split first. A pattern with no matching close brace
+  // is treated as a literal — return it unchanged. `closeIdx` shadows no
+  // builtin (unlike the natural `close` name), which keeps `go vet` quiet.
+  depth := 0
+  closeIdx := -1
+  for i := open; i < len(pattern); i++ {
+    switch pattern[i] {
+    case '{':
+      depth++
+    case '}':
+      depth--
+      if depth == 0 {
+        closeIdx = i
+      }
+    }
+    if closeIdx >= 0 {
+      break
+    }
+  }
+  if closeIdx < 0 {
+    return []string{pattern}
+  }
+  prefix := pattern[:open]
+  suffix := pattern[closeIdx+1:]
+  // Split the brace body on top-level commas so nested groups remain
+  // intact for the recursive expansion below.
+  body := pattern[open+1 : closeIdx]
+  alternatives := splitBraceAlternatives(body)
+  // Expand each alternative against the suffix; the suffix may itself
+  // contain further brace groups, which the recursive call handles.
+  suffixExpansions := expandBraces(suffix)
+  out := make([]string, 0, len(alternatives)*len(suffixExpansions))
+  for _, alt := range alternatives {
+    for _, altExpanded := range expandBraces(alt) {
+      for _, suf := range suffixExpansions {
+        out = append(out, prefix+altExpanded+suf)
+      }
+    }
+  }
+  return out
+}
+
+// splitBraceAlternatives splits the body of a brace group on top-level commas.
+// Commas inside a nested `{...}` are not separators — the matching close brace
+// is tracked so `a,{b,c},d` splits into three alternatives, not four.
+func splitBraceAlternatives(body string) []string {
+  out := []string{}
+  depth := 0
+  start := 0
+  for i := 0; i < len(body); i++ {
+    switch body[i] {
+    case '{':
+      depth++
+    case '}':
+      if depth > 0 {
+        depth--
+      }
+    case ',':
+      if depth == 0 {
+        out = append(out, body[start:i])
+        start = i + 1
+      }
+    }
+  }
+  out = append(out, body[start:])
+  return out
 }
 
+// matchGlobParts recursively matches path segments against pattern segments.
+// A "**" segment matches zero or more path segments (greedy: tries zero first,
+// then each successive prefix) so that `**/*.ts` matches both `a.ts` and
+// `dir/a.ts`.
 func matchGlobParts(patternParts, nameParts []string) bool {
   if len(patternParts) == 0 {
     return len(nameParts) == 0