ox-dep-lint 0.1.1 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.3.0
+
+### Minor Changes
+
+- 7af0fef: An internal refactor with no change in behaviour for configurations written as plain data (objects, arrays and strings, without getters, Proxies or custom iterators): every finding and every message is the same as in 0.2.0, in the same order, and so is every configuration error. Output differs only where 0.2.0 crashed: a hole in a sparse `fileClasses` or `baseline` list (`[ , ]` in an `.mjs` file) is now reported as `fileClasses must be a list of objects` or `baseline must be a list of objects`, also when a Symbol elsewhere would have crashed first; and a chain of thousands of packages, which exhausted 0.2.0's stack, is now checked. A Symbol written into a message (a baseline entry's file, a kind in `mayUse`) still crashes (exit 2) when no such hole is present, though the TypeError's wording can differ when another value that cannot become a string (an object without a usable `toString`) is also present, because the checks run in another order. A configuration built from getters, Proxies or custom iterators can now be read differently, because validation reads values (including those of unknown keys) that 0.2.0 never read.
+
+  The configuration is validated by valibot schemas whose issues map to 0.2's messages, cycles between packages come from Tarjan's strongly connected components (iterative, so a long chain of packages cannot exhaust the stack) with the same routes as before, and the walk through development files reads its queue from a head index instead of `shift()`.
+
+  New runtime dependency: `valibot` 1.5.0 (MIT). The public types are unchanged and written out as before; the emitted declarations do not import valibot.
+
+## 0.2.0
+
+### Minor Changes
+
+- 89ab407: New policy `imports.typeOnly`. With `"as-values"`, shipped code's type-only imports (every form, `/// <reference types>` included) are judged by `runtime-module`, `forbidden-external`, `undeclared-import` and `shipped-imports-development-file`. So `import type { Socket } from "bun"` fails in a kind with `runtimeModules: false`, and a vendor's types fail where the kind's `externals` do not allow it. A shipped `@types/x` still declares `x` for a type-only import. The default, `"relaxed"`, keeps 0.1's behaviour: types do not load, so those rules skip them.
+
+  A runtime's own types package (`node`, `@types/node`, `bun-types`, `@types/bun`, `@cloudflare/workers-types`, or a subpath of one) used type-only now counts as that runtime, in shipped and development files alike. So it is never reported as an outside package or as undeclared; until now an undeclared one gave `undeclared-import`. Under `"as-values"`, `runtime-module` judges it where the kind allows no runtime modules; under `"relaxed"` it passes, like other type-only imports.
+
 ## 0.1.1
 
 - 0.1.0 was published without its built `dist` files, so neither the CLI nor the plugin could load. A `prepack` script now builds before every pack and publish, so a package cannot go out without them. Use 0.1.1.

package/README.md

@@ -79,6 +79,9 @@ A kind may use its own kind only when `mayUse` lists it. `imports` holds the pol
 | `manifestEdgeFields` | all four fields                                            | any subset       |
 | `requireDeclared`    | `true`                                                     | `false`          |
 | `shippedFields`      | `dependencies`, `peerDependencies`, `optionalDependencies` | any subset       |
+| `typeOnly`           | `relaxed`                                                  | `as-values`      |
+
+`typeOnly: "as-values"` judges shipped code's type-only imports (`import type`, `export type`, type-level `import()`, `declare module`, `import type X = require()`, `/// <reference types>`) by `runtime-module`, `forbidden-external`, `undeclared-import` and `shipped-imports-development-file`, so `import type { Socket } from "bun"` fails in a kind without runtime modules. Two differences from value imports remain. A shipped field that declares `@types/x` declares `x` for a type-only import, and such an `@types/x` is an outside package too, so `externals` lists both. A runtime's own types package (`node` or `@types/node`, `bun`, `bun-types` or `@types/bun`, `@cloudflare/workers-types`) counts as that runtime, so it is judged by `runtime-module` and never needs declaring. That includes a published package whose emitted declarations reference those types: declare `@types/node` or `bun-types` for its consumers yourself; this check does not ask for it. By default types do not load, so those rules skip type-only imports. Kind edges and `typeOnlyUses` always see the real form.
 
 Misspelled keys, unknown policies and baseline entries without a `target` are configuration errors, never silent defaults.
 
@@ -127,6 +130,12 @@ Where they can still differ: oxlint chooses which files it lints (its own ignore
 - `/// <reference path="..." />` and JSDoc `@import` types are not read.
 - A `require` passed around as a value (`const load = require; load("x")`) is not followed. Telling the global loader from a local of the same name needs scope analysis; until then the check reads `require` only where it is called.
 
+## Contributing and releases
+
+- Commits and pull request titles follow [Conventional Commits](https://www.conventionalcommits.org/) (`fix:`, `feat:`, `chore:`); a `commit-msg` hook and CI check them with commitlint.
+- Every pull request adds a changeset: `bunx changeset` and pick patch, minor or major, or `bunx changeset --empty` when nothing ships. Before 1.0, a breaking change is a minor bump.
+- Versions follow [semantic versioning](https://semver.org/) and are never edited by hand. While changesets wait on main, the `release` workflow keeps a pull request `chore(release): vX.Y.Z` up to date with the bumped `package.json` and the new `CHANGELOG.md` entry. Merging it publishes that version to npm through trusted publishing (with provenance), tags it and makes a GitHub release. Empty changesets alone open no release; they are consumed with the next one.
+
 ## Licence
 
 MIT. The specifier reader and resolver are adapted from phibkro/vektorprogrammet-reimagined, and the rules from that repository and phibkro/file-transfer, all by the same author. The escape-sequence rule closes a bypass found in reebeat/reebeat's tier check. No code from reebeat was copied.

package/dist/{check-GClvJhK3.mjs → check-F4cLmfYv.mjs}

@@ -1,4 +1,4 @@
-import { a as findingsForFile, c as withoutBaselined, n as createEngine, r as edgeRefusal, s as reads, t as baselineCovers, u as directoriesMatching } from "./engine-7N-4EtzS.mjs";
+import { a as findingsForFile, c as withoutBaselined, n as createEngine, r as edgeRefusal, s as reads, t as baselineCovers, u as directoriesMatching } from "./engine-Dc5tRuHT.mjs";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import nodePath from "node:path";
 // src/graph.ts
@@ -87,37 +87,92 @@ const graphFindings = (engine) => {
 	findings.push(...packageCycles(engine));
 	return findings;
 };
-/** Cycles between workspace packages through their runtime dependency fields, each reported once. */
+/**
+* Tarjan's strongly connected components, iterative so that a long chain of packages cannot exhaust the stack. The
+* search starts from `roots` in order and follows each node's `successors` in order, so components and routes are
+* deterministic.
+*/
+const stronglyConnectedComponents = (roots, successors) => {
+	const index = /* @__PURE__ */ new Map();
+	const lowLink = /* @__PURE__ */ new Map();
+	const stack = [];
+	const onStack = /* @__PURE__ */ new Set();
+	const frames = [];
+	const pathPosition = /* @__PURE__ */ new Map();
+	const components = [];
+	const routes = [];
+	const enter = (name) => {
+		const order = index.size;
+		index.set(name, order);
+		lowLink.set(name, order);
+		stack.push(name);
+		onStack.add(name);
+		pathPosition.set(name, frames.length);
+		frames.push({
+			name,
+			next: 0
+		});
+	};
+	for (const root of roots) {
+		if (index.has(root)) continue;
+		enter(root);
+		for (let frame = frames.at(-1); frame !== void 0; frame = frames.at(-1)) {
+			const target = (successors.get(frame.name) ?? [])[frame.next];
+			if (target !== void 0) {
+				frame.next += 1;
+				if (!index.has(target)) enter(target);
+				else if (onStack.has(target)) {
+					lowLink.set(frame.name, Math.min(lowLink.get(frame.name) ?? 0, index.get(target) ?? 0));
+					const position = pathPosition.get(target);
+					if (position !== void 0) routes.push([...frames.slice(position).map((onPath) => onPath.name), target]);
+				}
+				continue;
+			}
+			frames.pop();
+			pathPosition.delete(frame.name);
+			const link = lowLink.get(frame.name) ?? 0;
+			if (link === index.get(frame.name)) {
+				const component = [];
+				for (let member = stack.pop(); member !== void 0; member = member === frame.name ? void 0 : stack.pop()) {
+					onStack.delete(member);
+					component.push(member);
+				}
+				components.push(component);
+			}
+			const parent = frames.at(-1);
+			if (parent !== void 0) lowLink.set(parent.name, Math.min(lowLink.get(parent.name) ?? 0, link));
+		}
+	}
+	return {
+		components,
+		routes
+	};
+};
+/**
+* Cycles between workspace packages through their runtime dependency fields. Every route the search closes is a
+* finding, once per set of packages, starting at the package the search reached first; so a component with several
+* cycles can have several findings.
+*/
 const packageCycles = (engine) => {
 	const { workspace } = engine;
 	const edges = new Map(workspace.packages.map((entry) => [entry.name, [...new Set(runtimeFields.flatMap((field) => entry.manifest[field]))].filter((name) => workspace.byName.has(name) && name !== entry.name)]));
-	const state = /* @__PURE__ */ new Map();
 	const findings = [];
 	const seen = /* @__PURE__ */ new Set();
-	const visit = (name, path) => {
-		if (state.get(name) === "done") return;
-		if (state.get(name) === "visiting") {
-			const cycle = [...path.slice(path.indexOf(name)), name];
-			const key = cycle.slice(0, -1).toSorted().join(" ");
-			if (!seen.has(key)) {
-				seen.add(key);
-				const first = workspace.byName.get(name);
-				findings.push({
-					rule: "package-cycle",
-					file: `${first?.directory ?? name}/package.json`,
-					line: 1,
-					column: 0,
-					message: `dependency cycle: ${cycle.join(" -> ")}`,
-					target: key
-				});
-			}
-			return;
+	for (const cycle of stronglyConnectedComponents([...edges.keys()].toSorted(), edges).routes) {
+		const key = cycle.slice(0, -1).toSorted().join(" ");
+		if (!seen.has(key)) {
+			seen.add(key);
+			const first = cycle[0] ?? "";
+			findings.push({
+				rule: "package-cycle",
+				file: `${workspace.byName.get(first)?.directory ?? first}/package.json`,
+				line: 1,
+				column: 0,
+				message: `dependency cycle: ${cycle.join(" -> ")}`,
+				target: key
+			});
 		}
-		state.set(name, "visiting");
-		for (const next of edges.get(name) ?? []) visit(next, [...path, name]);
-		state.set(name, "done");
-	};
-	for (const name of [...edges.keys()].toSorted()) visit(name, []);
+	}
 	return findings;
 };
 /** Baseline entries that no finding in `findings` needs; each is a finding of its own, so the baseline only shrinks. */

package/dist/cli.d.mts

@@ -1,2 +1,2 @@
-import { n as Config } from "./config-CpuQhyZE.mjs";
+import { n as Config } from "./config-DO_LRXM8.mjs";
 export declare const loadConfig: (path: string) => Promise<Config>;

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { d as findWorkspaceRoot } from "./engine-7N-4EtzS.mjs";
-import { n as formatFinding, t as checkWorkspace } from "./check-GClvJhK3.mjs";
+import { d as findWorkspaceRoot } from "./engine-Dc5tRuHT.mjs";
+import { n as formatFinding, t as checkWorkspace } from "./check-F4cLmfYv.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import nodePath from "node:path";
 import process from "node:process";

package/dist/{config-CpuQhyZE.d.mts → config-DO_LRXM8.d.mts}

@@ -63,6 +63,14 @@ interface ImportPolicy {
   readonly requireDeclared?: boolean;
   /** The fields that satisfy a shipped import. Default `dependencies`, `peerDependencies`, `optionalDependencies`. */
   readonly shippedFields?: readonly ManifestField[];
+  /**
+   * How shipped code's type-only imports (`import type`, `export type`, a type-level `import()`, `declare module`, a
+   * types reference) are judged by `runtime-module`, `forbidden-external`, `undeclared-import` and
+   * `shipped-imports-development-file`. `"relaxed"` (default): types do not load, so those rules skip them and
+   * devDependencies declare them. `"as-values"`: judged like value imports, for kinds whose public types must not name
+   * a runtime or vendor either. Kind edges and `typeOnlyUses` always see the real form.
+   */
+  readonly typeOnly?: "relaxed" | "as-values";
 }
 interface Config {
   /** Scopes whose specifiers must name a workspace package (`@file-transfer/`). */
@@ -105,6 +113,7 @@ interface ResolvedConfig {
 declare const defaultFileClasses: readonly FileClass[];
 /** Identity, for type checking a configuration file. */
 declare const defineConfig: (config: Config) => Config;
+/** Problems that make a configuration unusable, as messages: the outline's alone when it does not hold, else every other. */
 declare const configProblems: (config: Config) => string[];
 declare const resolveConfig: (config: Config) => ResolvedConfig;
 export { ImportPolicy as a, PackageRule as c, configProblems as d, defaultFileClasses as f, FilePolicy as i, ResolvedConfig as l, resolveConfig as m, Config as n, KindRule as o, defineConfig as p, FileClass as r, ManifestField as s, BaselineEntry as t, RuleName as u };

package/dist/{engine-7N-4EtzS.mjs → engine-Dc5tRuHT.mjs}

@@ -1,6 +1,7 @@
 import { builtinModules } from "node:module";
 import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import nodePath from "node:path";
+import * as v from "valibot";
 import { ResolverFactory } from "oxc-resolver";
 import { Visitor, parseSync } from "oxc-parser";
 // src/config.ts
@@ -50,135 +51,367 @@ const allManifestFields = [
 ];
 /** Identity, for type checking a configuration file. */
 const defineConfig = (config) => config;
-const allowedKeys = {
-	config: [
-		"workspaceScopes",
-		"kinds",
-		"packages",
-		"fileClasses",
-		"runtimeModules",
-		"virtualModules",
-		"testOnlySpecifiers",
-		"imports",
-		"baseline",
-		"ignore",
-		"output"
-	],
-	kind: [
-		"packages",
-		"mayUse",
-		"externals",
-		"runtimeModules"
-	],
-	package: [
-		"uses",
-		"externals",
-		"typeOnlyUses",
-		"valueSpecifiers",
-		"testSupportFiles"
-	],
-	fileClass: ["files", "policy"],
-	runtimeModules: ["prefixes", "names"],
-	imports: [
-		"computed",
-		"selfByName",
-		"unresolved",
-		"manifestEdgeFields",
-		"requireDeclared",
-		"shippedFields"
-	],
-	baseline: [
-		"file",
-		"rule",
-		"target",
-		"reason"
-	]
-};
-const choices = {
-	computed: [
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const plainObject = v.custom(isPlainObject);
+/** `schema` itself, which fails to type check unless it accepts exactly `Output`. */
+const schemaOf = () => (schema) => schema;
+const filePolicySchema = schemaOf()(v.picklist([
+	"shipped",
+	"development",
+	"unchecked"
+]));
+const manifestFieldSchema = schemaOf()(v.picklist(allManifestFields));
+const ruleNameSchema = schemaOf()(v.picklist(ruleNames));
+/** The values each import policy may take. */
+const policies = {
+	computed: schemaOf()(v.picklist([
 		"error-in-shipped",
 		"error",
 		"allow"
-	],
-	selfByName: ["error", "allow"],
-	unresolved: ["error", "ignore"],
-	requireDeclared: [true, false]
+	])),
+	selfByName: schemaOf()(v.picklist(["error", "allow"])),
+	unresolved: schemaOf()(v.picklist(["error", "ignore"])),
+	requireDeclared: schemaOf()(v.boolean()),
+	typeOnly: schemaOf()(v.picklist(["relaxed", "as-values"]))
 };
+/** 0.2's test for a list of strings. `every` skips the holes of a sparse array, where `v.array` reads `undefined`. */
 const isStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
-const unknownKeys = (where, value, allowed) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.keys(value).filter((key) => !allowed.includes(key)).map((key) => `${where} has the unknown key ${key} (known: ${allowed.join(", ")})`) : [`${where} is not an object`];
-/** Problems that make a configuration unusable, as messages. A misspelled key is a problem, never a silent default. */
-const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** Problems with the configuration's outline (objects where objects belong, lists where lists belong), checked first. */
-const shapeProblems = (config) => {
-	if (!isObject(config)) return ["the configuration must be an object"];
-	const { kinds, packages, fileClasses, baseline } = config;
+const stringList = v.custom(isStringList);
+/** A list of manifest fields, holes skipped as in 0.2. */
+const manifestFieldList = v.custom((value) => isStringList(value) && value.every((field) => v.is(manifestFieldSchema, field)));
+/**
+* A value in a message, written as 0.2 wrote it: a template literal, which throws for a Symbol. 0.2 threw that way
+* (exit 2 with the TypeError's message), so the check still does.
+*/
+const asText = (value) => `${value}`;
+/**
+* Every own entry of an object, each value checked by `value`. Not `v.record`, which skips the keys `constructor`,
+* `prototype` and `__proto__` that 0.2 checked. In an issue's path, the entry is its index and then 1.
+*/
+const ownEntries = (value) => v.pipe(plainObject, v.transform((input) => Object.entries(input)), v.array(v.tuple([v.string(), value])));
+/** 0.2's outline test for a list of objects, which skips holes as `every` does. */
+const objectList = v.custom((value) => Array.isArray(value) && value.every(isPlainObject));
+/** The outline (objects where objects belong, lists where lists belong), checked first: nothing else is read until it holds. */
+const outlineSchema = v.pipe(plainObject, v.looseObject({
+	kinds: ownEntries(plainObject),
+	packages: v.optional(ownEntries(plainObject)),
+	imports: v.optional(plainObject),
+	runtimeModules: v.optional(plainObject),
+	fileClasses: v.optional(objectList),
+	baseline: v.optional(objectList)
+}));
+const kindRuleSchema = v.strictObject({
+	packages: v.pipe(v.array(v.unknown()), v.minLength(1)),
+	mayUse: v.union([v.literal("any"), stringList]),
+	externals: v.optional(v.union([v.literal("any"), stringList])),
+	runtimeModules: v.optional(v.boolean())
+});
+const packageRuleSchema = v.strictObject({
+	uses: v.exactOptional(stringList),
+	externals: v.exactOptional(stringList),
+	typeOnlyUses: v.exactOptional(stringList),
+	valueSpecifiers: v.exactOptional(stringList),
+	testSupportFiles: v.exactOptional(stringList)
+});
+const fileClassSchema = v.strictObject({
+	files: stringList,
+	policy: filePolicySchema
+});
+const runtimeModulesSchema = v.strictObject({
+	prefixes: v.exactOptional(stringList),
+	names: v.exactOptional(stringList)
+});
+const importPolicySchema = v.strictObject({
+	computed: v.optional(policies.computed),
+	selfByName: v.optional(policies.selfByName),
+	unresolved: v.optional(policies.unresolved),
+	manifestEdgeFields: v.optional(manifestFieldList),
+	requireDeclared: v.optional(policies.requireDeclared),
+	shippedFields: v.optional(manifestFieldList),
+	typeOnly: v.optional(policies.typeOnly)
+});
+const baselineEntrySchema = v.strictObject({
+	file: v.optional(v.unknown()),
+	rule: ruleNameSchema,
+	target: v.pipe(v.string(), v.nonEmpty()),
+	reason: v.pipe(v.string(), v.check((reason) => reason.trim() !== ""))
+});
+const configSchema = v.strictObject({
+	workspaceScopes: stringList,
+	kinds: ownEntries(kindRuleSchema),
+	packages: v.optional(ownEntries(packageRuleSchema)),
+	fileClasses: v.optional(v.array(fileClassSchema)),
+	runtimeModules: v.optional(runtimeModulesSchema),
+	virtualModules: v.optional(stringList),
+	testOnlySpecifiers: v.optional(stringList),
+	imports: v.optional(importPolicySchema),
+	baseline: v.optional(v.array(baselineEntrySchema)),
+	ignore: v.optional(stringList),
+	output: v.optional(stringList)
+});
+/** The sections of the messages, in 0.2's order. */
+const section = {
+	configurationKeys: 0,
+	kinds: 1,
+	packages: 2,
+	workspaceScopes: 3,
+	testOnlySpecifiers: 4,
+	virtualModules: 5,
+	ignore: 6,
+	output: 7,
+	runtimeModuleValues: 8,
+	importFields: 9,
+	fileClasses: 10,
+	runtimeModuleKeys: 11,
+	importKeys: 12,
+	importPolicies: 13,
+	baseline: 14
+};
+/** Within a kind: its unknown keys, then these fields, then the kinds it names that do not exist. */
+const kindFieldOrder = [
+	"packages",
+	"mayUse",
+	"runtimeModules",
+	"externals"
+];
+const importFieldOrder = ["manifestEdgeFields", "shippedFields"];
+const importPolicyOrder = [
+	"computed",
+	"selfByName",
+	"unresolved",
+	"requireDeclared",
+	"typeOnly"
+];
+const baselineFieldOrder = [
+	"file",
+	"rule",
+	"target",
+	"reason"
+];
+/** The values a policy may take, as its message lists them. */
+const policyValues = (field) => {
+	const schema = policies[field];
+	return "options" in schema ? schema.options : [true, false];
+};
+/** One message per key of `object` that `entries` does not know, in the object's order. */
+const unknownKeyProblems = (where, object, entries, order) => Object.keys(object).flatMap((key, position) => Object.hasOwn(entries, key) ? [] : [{
+	order: [...order, position],
+	message: `${where} has the unknown key ${key} (known: ${Object.keys(entries).join(", ")})`
+}]);
+/** For an object whose every value is a list of strings: the unknown keys whose value is not one, in the object's order. */
+const unknownListProblems = (object, entries, order, message) => Object.entries(object).flatMap(([key, value], position) => Object.hasOwn(entries, key) || v.is(stringList, value) ? [] : [{
+	order: [...order, position],
+	message: message(key)
+}]);
+/** The value an issue's path passes through at `index`, as an object (an entry of `ownEntries` is a pair). */
+const objectAt = (path, index) => {
+	const value = path[index]?.value;
+	return isPlainObject(value) ? value : {};
+};
+/** The key and value of the `ownEntries` entry at `index` of an issue's path. */
+const entryAt = (path, index) => {
+	const pair = path[index]?.value;
+	const [name, value] = Array.isArray(pair) ? pair : [];
+	return {
+		name: String(name),
+		value: isPlainObject(value) ? value : {}
+	};
+};
+const outlineMessage = (path) => {
+	const field = path[0]?.key;
+	if (field === void 0) return "the configuration must be an object";
+	if (field === "kinds") return path.length === 1 ? "kinds must map each kind to its rule" : `kind ${entryAt(path, 1).name} must be an object`;
+	if (field === "packages") return path.length === 1 ? "packages must map package names to their rules" : `package ${entryAt(path, 1).name} must be an object`;
+	if (field === "imports" || field === "runtimeModules") return `${field} must be an object`;
+	return `${field === "fileClasses" ? "fileClasses" : "baseline"} must be a list of objects`;
+};
+const kindProblems = (path, unknownKey, holder) => {
+	const index = Number(path[1]?.key);
+	const { name } = entryAt(path, 1);
+	if (unknownKey) return unknownKeyProblems(`kind ${name}`, holder, kindRuleSchema.entries, [
+		section.kinds,
+		index,
+		0
+	]);
+	const field = String(path[3]?.key);
+	const message = {
+		packages: `kind ${name} names no packages`,
+		mayUse: `kind ${name}: mayUse must be "any" or a list of kinds`,
+		runtimeModules: `kind ${name}: runtimeModules must be true or false`,
+		externals: `kind ${name}: externals must be "any" or a list of package names`
+	}[field];
+	return message === void 0 ? [] : [{
+		order: [
+			section.kinds,
+			index,
+			kindFieldOrder.indexOf(field) + 1
+		],
+		message
+	}];
+};
+/** The kinds a kind may use that are not kinds: a reference across entries, which no schema of one entry sees. */
+const kindReferenceProblems = (kinds) => {
+	const known = new Set(Object.keys(kinds));
 	const problems = [];
-	if (!isObject(kinds)) problems.push("kinds must map each kind to its rule");
-	else for (const [name, kind] of Object.entries(kinds)) if (!isObject(kind)) problems.push(`kind ${name} must be an object`);
-	if (packages !== void 0 && !isObject(packages)) problems.push("packages must map package names to their rules");
-	else for (const [name, rule] of Object.entries(packages ?? {})) if (!isObject(rule)) problems.push(`package ${name} must be an object`);
-	for (const [key, value] of [["imports", config.imports], ["runtimeModules", config.runtimeModules]]) if (value !== void 0 && !isObject(value)) problems.push(`${key} must be an object`);
-	for (const [key, list] of [["fileClasses", fileClasses], ["baseline", baseline]]) if (list !== void 0 && (!Array.isArray(list) || !list.every(isObject))) problems.push(`${key} must be a list of objects`);
+	for (const [index, [name, kind]] of Object.entries(kinds).entries()) {
+		const mayUse = isPlainObject(kind) ? kind.mayUse : void 0;
+		if (!Array.isArray(mayUse)) continue;
+		for (const [position, used] of [...mayUse].entries()) if (typeof used !== "string" || !known.has(used)) problems.push({
+			order: [
+				section.kinds,
+				index,
+				kindFieldOrder.length + 1,
+				position
+			],
+			message: `kind ${name} may use ${asText(used)}, which is not a kind`
+		});
+	}
 	return problems;
 };
-const configProblems = (config) => {
-	const outline = shapeProblems(config);
-	if (outline.length > 0) return outline;
-	const problems = unknownKeys("the configuration", config, allowedKeys.config);
-	const kinds = new Set(Object.keys(config.kinds));
-	for (const [name, kind] of Object.entries(config.kinds)) {
-		problems.push(...unknownKeys(`kind ${name}`, kind, allowedKeys.kind));
-		if (!Array.isArray(kind.packages) || kind.packages.length === 0) problems.push(`kind ${name} names no packages`);
-		if (kind.mayUse !== "any" && !isStringList(kind.mayUse)) problems.push(`kind ${name}: mayUse must be "any" or a list of kinds`);
-		if (kind.runtimeModules !== void 0 && typeof kind.runtimeModules !== "boolean") problems.push(`kind ${name}: runtimeModules must be true or false`);
-		if (kind.externals !== void 0 && kind.externals !== "any" && !isStringList(kind.externals)) problems.push(`kind ${name}: externals must be "any" or a list of package names`);
-		if (kind.mayUse !== "any") {
-			for (const used of Array.isArray(kind.mayUse) ? kind.mayUse : []) if (!kinds.has(used)) problems.push(`kind ${name} may use ${used}, which is not a kind`);
-		}
-	}
-	for (const [name, refinements] of Object.entries(config.packages ?? {})) {
-		problems.push(...unknownKeys(`package ${name}`, refinements, allowedKeys.package));
-		for (const [key, value] of Object.entries(refinements)) if (!isStringList(value)) problems.push(`package ${name}: ${key} must be a list of strings`);
-	}
-	if (!isStringList(config.workspaceScopes)) problems.push("workspaceScopes must be a list of scopes");
-	for (const key of [
-		"testOnlySpecifiers",
-		"virtualModules",
-		"ignore",
-		"output"
-	]) {
-		const value = config[key];
-		if (value !== void 0 && !isStringList(value)) problems.push(`${key} must be a list of strings`);
-	}
-	for (const [key, value] of Object.entries(config.runtimeModules ?? {})) if (!isStringList(value)) problems.push(`runtimeModules.${key} must be a list of strings`);
-	for (const key of ["manifestEdgeFields", "shippedFields"]) {
-		const value = config.imports?.[key];
-		if (value !== void 0 && (!isStringList(value) || !value.every((field) => allManifestFields.includes(field)))) problems.push(`imports.${key} must be a list of ${allManifestFields.join(", ")}`);
-	}
-	for (const [index, fileClass] of (config.fileClasses ?? []).entries()) {
-		problems.push(...unknownKeys(`file class ${index}`, fileClass, allowedKeys.fileClass));
-		if (!isStringList(fileClass.files)) problems.push(`file class ${index}: files must be a list of globs`);
-		if (![
-			"shipped",
-			"development",
-			"unchecked"
-		].includes(fileClass.policy)) problems.push(`file class ${index} has the unknown policy ${String(fileClass.policy)}`);
-	}
-	if (config.runtimeModules !== void 0) problems.push(...unknownKeys("runtimeModules", config.runtimeModules, allowedKeys.runtimeModules));
-	if (config.imports !== void 0) {
-		problems.push(...unknownKeys("imports", config.imports, allowedKeys.imports));
-		for (const [key, allowed] of Object.entries(choices)) {
-			const value = config.imports[key];
-			if (value !== void 0 && !allowed.includes(value)) problems.push(`imports.${key} is ${JSON.stringify(value)}; it must be one of ${allowed.join(", ")}`);
-		}
+const packageProblems = (path, unknownKey, holder) => {
+	const index = Number(path[1]?.key);
+	const { name, value } = entryAt(path, 1);
+	const listMessage = (key) => `package ${name}: ${key} must be a list of strings`;
+	if (unknownKey) return [...unknownKeyProblems(`package ${name}`, holder, packageRuleSchema.entries, [
+		section.packages,
+		index,
+		0
+	]), ...unknownListProblems(holder, packageRuleSchema.entries, [
+		section.packages,
+		index,
+		1
+	], listMessage)];
+	const field = String(path[3]?.key);
+	return [{
+		order: [
+			section.packages,
+			index,
+			1,
+			Object.keys(value).indexOf(field)
+		],
+		message: listMessage(field)
+	}];
+};
+const runtimeModulesProblems = (path, unknownKey, holder) => {
+	const listMessage = (key) => `runtimeModules.${key} must be a list of strings`;
+	if (unknownKey) return [...unknownKeyProblems("runtimeModules", holder, runtimeModulesSchema.entries, [section.runtimeModuleKeys]), ...unknownListProblems(holder, runtimeModulesSchema.entries, [section.runtimeModuleValues], listMessage)];
+	const field = String(path[1]?.key);
+	return [{
+		order: [section.runtimeModuleValues, Object.keys(objectAt(path, 0)).indexOf(field)],
+		message: listMessage(field)
+	}];
+};
+const importProblems = (path, unknownKey, holder) => {
+	if (unknownKey) return unknownKeyProblems("imports", holder, importPolicySchema.entries, [section.importKeys]);
+	const field = String(path[1]?.key);
+	if (importFieldOrder.includes(field)) return [{
+		order: [section.importFields, importFieldOrder.indexOf(field)],
+		message: `imports.${field} must be a list of ${allManifestFields.join(", ")}`
+	}];
+	return [{
+		order: [section.importPolicies, importPolicyOrder.indexOf(field)],
+		message: `imports.${field} is ${JSON.stringify(path[1]?.value)}; it must be one of ${policyValues(field).join(", ")}`
+	}];
+};
+const fileClassProblems = (path, unknownKey, holder) => {
+	const index = Number(path[1]?.key);
+	if (unknownKey) return unknownKeyProblems(`file class ${index}`, holder, fileClassSchema.entries, [
+		section.fileClasses,
+		index,
+		0
+	]);
+	return path[2]?.key === "files" ? [{
+		order: [
+			section.fileClasses,
+			index,
+			1
+		],
+		message: `file class ${index}: files must be a list of globs`
+	}] : [{
+		order: [
+			section.fileClasses,
+			index,
+			2
+		],
+		message: `file class ${index} has the unknown policy ${String(objectAt(path, 1).policy)}`
+	}];
+};
+const baselineProblems = (path, unknownKey, holder) => {
+	const index = Number(path[1]?.key);
+	const entry = objectAt(path, 1);
+	const file = asText(entry.file);
+	if (unknownKey) return unknownKeyProblems(`the baseline entry for ${file}`, holder, baselineEntrySchema.entries, [
+		section.baseline,
+		index,
+		0
+	]);
+	const field = String(path[2]?.key);
+	const message = {
+		rule: () => `the baseline entry for ${file} names the unknown rule ${String(entry.rule)}`,
+		target: () => `the baseline entry for ${asText(entry.rule)} in ${file} names no target, so it would hide every future finding of that rule there`,
+		reason: () => `the baseline entry for ${asText(entry.rule)} in ${file} has no reason`
+	}[field]?.();
+	return message === void 0 ? [] : [{
+		order: [
+			section.baseline,
+			index,
+			baselineFieldOrder.indexOf(field)
+		],
+		message
+	}];
+};
+/** The messages for one issue of `configSchema`. */
+const problemsOf = (issue) => {
+	const path = issue.path ?? [];
+	const unknownKey = issue.type === "strict_object" && issue.expected === "never";
+	const at = unknownKey ? path.slice(0, -1) : path;
+	const holder = unknownKey ? path.at(-1)?.input : void 0;
+	const object = isPlainObject(holder) ? holder : {};
+	const field = at[0]?.key;
+	switch (field) {
+		case void 0: return unknownKey ? unknownKeyProblems("the configuration", object, configSchema.entries, [section.configurationKeys]) : [];
+		case "kinds": return kindProblems(path, unknownKey, object);
+		case "packages": return packageProblems(path, unknownKey, object);
+		case "runtimeModules": return runtimeModulesProblems(path, unknownKey, object);
+		case "imports": return importProblems(path, unknownKey, object);
+		case "fileClasses": return fileClassProblems(path, unknownKey, object);
+		case "baseline": return baselineProblems(path, unknownKey, object);
+		case "workspaceScopes": return [{
+			order: [section.workspaceScopes],
+			message: "workspaceScopes must be a list of scopes"
+		}];
+		case "testOnlySpecifiers":
+		case "virtualModules":
+		case "ignore":
+		case "output": return [{
+			order: [section[field]],
+			message: `${field} must be a list of strings`
+		}];
+		default: return [];
 	}
-	for (const entry of config.baseline ?? []) {
-		problems.push(...unknownKeys(`the baseline entry for ${entry.file}`, entry, allowedKeys.baseline));
-		if (!ruleNames.includes(entry.rule)) problems.push(`the baseline entry for ${entry.file} names the unknown rule ${String(entry.rule)}`);
-		if (typeof entry.target !== "string" || entry.target === "") problems.push(`the baseline entry for ${entry.rule} in ${entry.file} names no target, so it would hide every future finding of that rule there`);
-		if (typeof entry.reason !== "string" || entry.reason.trim() === "") problems.push(`the baseline entry for ${entry.rule} in ${entry.file} has no reason`);
+};
+const compareOrders = (left, right) => {
+	for (let index = 0; index < Math.max(left.length, right.length); index++) {
+		const difference = (left[index] ?? -1) - (right[index] ?? -1);
+		if (difference !== 0) return difference;
 	}
-	return problems;
+	return 0;
+};
+/** Problems that make a configuration unusable, as messages: the outline's alone when it does not hold, else every other. */
+const configProblems = (config) => {
+	const outline = v.safeParse(outlineSchema, config);
+	if (!outline.success) return [...new Set(outline.issues.map((issue) => outlineMessage(issue.path ?? [])))];
+	const sparse = ["fileClasses", "baseline"].filter((key) => [...config[key] ?? []].includes(void 0));
+	if (sparse.length > 0) return sparse.map((key) => `${key} must be a list of objects`);
+	for (const entry of config.baseline ?? []) asText(entry.file);
+	const problems = [...(v.safeParse(configSchema, config).issues ?? []).flatMap(problemsOf), ...kindReferenceProblems(config.kinds)].toSorted((left, right) => compareOrders(left.order, right.order));
+	const seen = /* @__PURE__ */ new Set();
+	return problems.flatMap((problem) => {
+		const key = problem.order.join(" ");
+		if (seen.has(key)) return [];
+		seen.add(key);
+		return [problem.message];
+	});
 };
 const resolveConfig = (config) => {
 	const problems = configProblems(config);
@@ -213,7 +446,8 @@ const resolveConfig = (config) => {
 				"dependencies",
 				"peerDependencies",
 				"optionalDependencies"
-			]
+			],
+			typeOnly: config.imports?.typeOnly ?? "relaxed"
 		},
 		baseline: config.baseline ?? [],
 		ignore: config.ignore ?? [],
@@ -267,20 +501,36 @@ const globExpression = (pattern) => {
 const matchesGlob = (path, pattern) => globExpression(pattern).test(path);
 /** Whether `path` matches any of `patterns`. */
 const matchesAny = (path, patterns) => patterns.some((pattern) => matchesGlob(path, pattern));
+// src/result.ts
+const success = (value) => ({
+	ok: true,
+	value
+});
+const failure = (error) => ({
+	ok: false,
+	error
+});
+/** Runs `operation`, with what it throws as the failure. */
+const attempt = (operation) => {
+	try {
+		return success(operation());
+	} catch (cause) {
+		return failure(cause);
+	}
+};
+/** The message of something thrown, which need not be an Error. */
+const messageOf = (cause) => cause instanceof Error ? cause.message : String(cause);
 // src/workspace.ts
 /**
 * The workspace as `package.json` files declare it: the root's `workspaces` globs, and each package's real name (never
 * guessed from its directory) and dependency fields.
 */
+/** The manifest at `path`, or why it cannot be read. */
 const readManifest = (path) => {
-	let parsed;
-	try {
-		parsed = JSON.parse(readFileSync(path, "utf8"));
-	} catch (cause) {
-		throw new Error(`${path}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
-	}
-	if (typeof parsed !== "object" || parsed === null) throw new Error(`${path} is not a JSON object`);
-	return parsed;
+	const parsed = attempt(() => JSON.parse(readFileSync(path, "utf8")));
+	if (!parsed.ok) return failure(`${path}: ${messageOf(parsed.error)}`);
+	if (typeof parsed.value !== "object" || parsed.value === null) return failure(`${path} is not a JSON object`);
+	return success(parsed.value);
 };
 const namesOf = (field) => typeof field === "object" && field !== null && !Array.isArray(field) ? Object.keys(field).toSorted() : [];
 const fieldsOf = (manifest) => ({
@@ -308,12 +558,9 @@ const workspaceGlobs = (manifest) => {
 	if (Array.isArray(field)) return field.filter((entry) => typeof entry === "string");
 	if (typeof field === "object" && field !== null && "packages" in field && Array.isArray(field.packages)) return field.packages.filter((entry) => typeof entry === "string");
 };
-const workspacesOf = (manifest) => {
-	try {
-		return workspaceGlobs(readManifest(manifest)) ?? [];
-	} catch {
-		return [];
-	}
+const workspacesOf = (path) => {
+	const manifest = readManifest(path);
+	return manifest.ok ? workspaceGlobs(manifest.value) ?? [] : [];
 };
 /** Whether `globs` (from the manifest in `candidate`) hold `directory`: one of them matches it or a directory above it. */
 const holds = (candidate, globs, directory) => {
@@ -363,7 +610,9 @@ const directoriesMatching = (root, pattern) => {
 	return found;
 };
 const loadWorkspace = (root) => {
-	const rootManifest = readManifest(nodePath.join(root, "package.json"));
+	const rootRead = readManifest(nodePath.join(root, "package.json"));
+	if (!rootRead.ok) throw new Error(rootRead.error);
+	const rootManifest = rootRead.value;
 	const globs = workspaceGlobs(rootManifest) ?? [];
 	const directories = /* @__PURE__ */ new Set();
 	for (const pattern of globs.filter((glob) => !glob.startsWith("!"))) for (const directory of directoriesMatching(root, pattern)) if (existsSync(nodePath.join(root, directory, "package.json"))) directories.add(directory);
@@ -372,16 +621,15 @@ const loadWorkspace = (root) => {
 	const problems = [];
 	const byName = /* @__PURE__ */ new Map();
 	for (const directory of [...directories].toSorted()) {
-		let manifest;
-		try {
-			manifest = readManifest(nodePath.join(root, directory, "package.json"));
-		} catch (error) {
+		const read = readManifest(nodePath.join(root, directory, "package.json"));
+		if (!read.ok) {
 			problems.push({
 				directory,
-				message: `package.json cannot be read: ${error instanceof Error ? error.message : String(error)}`
+				message: `package.json cannot be read: ${read.error}`
 			});
 			continue;
 		}
+		const manifest = read.value;
 		if (typeof manifest.name !== "string" || manifest.name === "") {
 			problems.push({
 				directory,
@@ -800,6 +1048,19 @@ const importForms = (path, source) => {
 * it over every file and adds the whole-graph checks (`graph.ts`), so the two never disagree. Rules adapted from the
 * module graph checks of phibkro/file-transfer, phibkro/vektorprogrammet-reimagined and reebeat/reebeat.
 */
+const nodeModules = ["node:module", ...builtinModules];
+/**
+* Packages that hold a runtime's types, and the runtime modules they describe: the package counts as the runtime when
+* the configuration names any of them a runtime module (Node's by its `node:` prefix or any bare built-in).
+*/
+const runtimeTypePackages = {
+	node: nodeModules,
+	"@types/node": nodeModules,
+	bun: ["bun"],
+	"bun-types": ["bun"],
+	"@types/bun": ["bun"],
+	"@cloudflare/workers-types": ["cloudflare:workers"]
+};
 /** The source files the engine reads; anything else (`.vue`, `.json`) is no finding in either front end. */
 const sourceFile = /\.[cm]?[jt]sx?$/u;
 const createEngine = (root, config) => {
@@ -887,9 +1148,11 @@ const developmentFileBreaks = (engine, file) => {
 	if (known !== void 0 && [...known.read].every(([path, time]) => modifiedTime(nodePath.join(engine.workspace.root, path)) === time)) return known.breaks;
 	const read = /* @__PURE__ */ new Map();
 	const queue = [file];
+	let head = 0;
 	let breaks;
-	while (queue.length > 0 && breaks === void 0) {
-		const next = queue.shift() ?? file;
+	while (head < queue.length && breaks === void 0) {
+		const next = queue[head] ?? file;
+		head += 1;
 		const absolute = nodePath.join(engine.workspace.root, next);
 		const time = modifiedTime(absolute);
 		if (read.has(next) || time === void 0) continue;
@@ -963,10 +1226,22 @@ const findingsForFile = (engine, file, text, options = {}) => {
 		column: 0
 	}, `could not be parsed, so its imports cannot be checked: ${message}`, "parse");
 	for (const site of forms.computed) if (config.imports.computed === "error" || config.imports.computed === "error-in-shipped" && shipped) report("computed-import", site, `${site.text}: ${site.reason}; nothing can check what it loads`, site.text);
+	/**
+	* The packages that hold a runtime's own types, by the runtime module they describe: a type-only use of one
+	* (`/// <reference types="node" />`, `import type {} from "bun-types"`) is a use of that runtime, judged by
+	* `runtime-module` like `node:fs` and never as an outside package to declare.
+	*/
+	const runtimeOf = (site) => {
+		return (site.typeOnly ? runtimeTypePackages[packageNameOf(site.specifier)] : void 0)?.find((module) => isRuntimeModule(config, module));
+	};
 	for (const site of forms.imports) {
-		const { typeOnly } = site;
+		const typeOnly = site.typeOnly && config.imports.typeOnly === "relaxed";
 		const specifier = withoutQuery(site.specifier);
-		const target = engine.resolver.resolve(file, site.specifier);
+		const runtime = runtimeOf(site);
+		const target = runtime === void 0 ? engine.resolver.resolve(file, site.specifier) : {
+			kind: "runtime",
+			name: runtime
+		};
 		const resolvedName = target.kind === "external" || target.kind === "workspace" ? target.name : void 0;
 		const subpathOf = (name) => specifier === name || specifier.startsWith(`${name}/`);
 		const names = resolvedName === void 0 || subpathOf(resolvedName) ? [specifier] : [specifier, resolvedName];
@@ -982,7 +1257,7 @@ const findingsForFile = (engine, file, text, options = {}) => {
 		};
 		switch (target.kind) {
 			case "runtime":
-				if (shipped && !typeOnly && kindRule?.runtimeModules === false) report("runtime-module", site, `imports the runtime module ${specifier}, which ${article(kind)} package may not use in shipped code`, specifier);
+				if (shipped && !typeOnly && kindRule?.runtimeModules === false) report("runtime-module", site, `imports ${runtime === void 0 ? `the runtime module ${specifier},` : `the runtime types package ${specifier},`} which ${article(kind)} package may not use in shipped code`, specifier);
 				break;
 			case "virtual": break;
 			case "unknown-workspace":
@@ -1000,7 +1275,7 @@ const findingsForFile = (engine, file, text, options = {}) => {
 					if (config.imports.selfByName === "error") report("self-import-by-name", site, "imports its own package by its name; use a relative path", specifier);
 					break;
 				}
-				const refusal = edgeRefusal(engine, owner, to, typeOnly, specifier);
+				const refusal = edgeRefusal(engine, owner, to, site.typeOnly, specifier);
 				if (refusal !== void 0) report(refusal.rule, site, refusal.why, to.name);
 				if (config.imports.requireDeclared && !declares(engine, owner, to.name, !shipped || typeOnly)) report("undeclared-import", site, `imports ${to.name}, which ${owner.directory}/package.json does not declare${shipped ? " for shipped code" : ""}`, to.name);
 				break;
@@ -1024,7 +1299,7 @@ const findingsForFile = (engine, file, text, options = {}) => {
 				const permitted = (name) => allowed === "any" || allowed?.includes(name) === true || extra.includes(name);
 				if (shipped && !typeOnly && !permitted(target.name)) report("forbidden-external", site, `${article(kind)} package may not import ${target.name} in shipped code`, target.name);
 				const anywhere = !shipped || typeOnly;
-				const declared = declares(engine, owner, target.name, anywhere) || declares(engine, owner, target.written, anywhere) || typeOnly && declares(engine, owner, typesPackage(target.name), true);
+				const declared = declares(engine, owner, target.name, anywhere) || declares(engine, owner, target.written, anywhere) || site.typeOnly && declares(engine, owner, typesPackage(target.name), anywhere);
 				if (config.imports.requireDeclared && !declared) report("undeclared-import", site, `imports ${target.name}, which ${owner.directory}/package.json does not declare${shipped ? " for shipped code" : ""}`, target.name);
 				break;
 			}
@@ -1036,4 +1311,4 @@ const findingsForFile = (engine, file, text, options = {}) => {
 const baselineCovers = (entry, finding) => entry.file === finding.file && entry.rule === finding.rule && entry.target === finding.target;
 /** `findings` less those the baseline covers. */
 const withoutBaselined = (engine, findings) => findings.filter((finding) => !engine.config.baseline.some((entry) => baselineCovers(entry, finding)));
-export { configProblems as _, findingsForFile as a, resolveConfig as b, withoutBaselined as c, findWorkspaceRoot as d, loadWorkspace as f, matchesGlob as g, matchesAny as h, effectivePolicy as i, importForms as l, packageOfFile as m, createEngine as n, policyOf as o, packageNameOf as p, edgeRefusal as r, reads as s, baselineCovers as t, directoriesMatching as u, defaultFileClasses as v, defineConfig as y };
+export { resolveConfig as S, matchesAny as _, findingsForFile as a, defaultFileClasses as b, withoutBaselined as c, findWorkspaceRoot as d, loadWorkspace as f, failure as g, attempt as h, effectivePolicy as i, importForms as l, packageOfFile as m, createEngine as n, policyOf as o, packageNameOf as p, edgeRefusal as r, reads as s, baselineCovers as t, directoriesMatching as u, matchesGlob as v, defineConfig as x, configProblems as y };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as ImportPolicy, c as PackageRule, d as configProblems, f as defaultFileClasses, i as FilePolicy, l as ResolvedConfig, m as resolveConfig, n as Config, o as KindRule, p as defineConfig, r as FileClass, s as ManifestField, t as BaselineEntry, u as RuleName } from "./config-CpuQhyZE.mjs";
+import { a as ImportPolicy, c as PackageRule, d as configProblems, f as defaultFileClasses, i as FilePolicy, l as ResolvedConfig, m as resolveConfig, n as Config, o as KindRule, p as defineConfig, r as FileClass, s as ManifestField, t as BaselineEntry, u as RuleName } from "./config-DO_LRXM8.mjs";
 interface WorkspacePackage {
   readonly name: string;
   /** Repository-relative directory, `/`-separated (`libraries/parcel`). */

package/dist/index.mjs

@@ -1,3 +1,3 @@
-import { _ as configProblems, a as findingsForFile, b as resolveConfig, c as withoutBaselined, d as findWorkspaceRoot, f as loadWorkspace, g as matchesGlob, h as matchesAny, i as effectivePolicy, l as importForms, m as packageOfFile, n as createEngine, o as policyOf, p as packageNameOf, s as reads, v as defaultFileClasses, y as defineConfig } from "./engine-7N-4EtzS.mjs";
-import { a as staleBaseline, i as graphFindings, n as formatFinding, r as listSourceFiles, t as checkWorkspace } from "./check-GClvJhK3.mjs";
+import { S as resolveConfig, _ as matchesAny, a as findingsForFile, b as defaultFileClasses, c as withoutBaselined, d as findWorkspaceRoot, f as loadWorkspace, i as effectivePolicy, l as importForms, m as packageOfFile, n as createEngine, o as policyOf, p as packageNameOf, s as reads, v as matchesGlob, x as defineConfig, y as configProblems } from "./engine-Dc5tRuHT.mjs";
+import { a as staleBaseline, i as graphFindings, n as formatFinding, r as listSourceFiles, t as checkWorkspace } from "./check-F4cLmfYv.mjs";
 export { checkWorkspace, configProblems, createEngine, defaultFileClasses, defineConfig, effectivePolicy, findWorkspaceRoot, findingsForFile, formatFinding, graphFindings, importForms, listSourceFiles, loadWorkspace, matchesAny, matchesGlob, packageNameOf, packageOfFile, policyOf, reads, resolveConfig, staleBaseline, withoutBaselined };

package/dist/plugin.mjs

@@ -1,4 +1,4 @@
-import { a as findingsForFile, c as withoutBaselined, d as findWorkspaceRoot, n as createEngine } from "./engine-7N-4EtzS.mjs";
+import { a as findingsForFile, c as withoutBaselined, d as findWorkspaceRoot, g as failure, h as attempt, n as createEngine } from "./engine-Dc5tRuHT.mjs";
 import { statSync } from "node:fs";
 import nodePath from "node:path";
 // src/plugin.ts
@@ -23,7 +23,7 @@ const modified = (path) => {
 	}
 };
 const manifestsOf = (root, engine) => {
-	const directories = engine instanceof Error ? [] : engine.workspace.packages.map((entry) => nodePath.join(root, entry.directory));
+	const directories = engine.ok ? engine.value.workspace.packages.map((entry) => nodePath.join(root, entry.directory)) : [];
 	const paths = [
 		nodePath.join(root, "package.json"),
 		...directories.map((directory) => nodePath.join(directory, "package.json")),
@@ -32,11 +32,8 @@ const manifestsOf = (root, engine) => {
 	return new Map(paths.map((path) => [path, modified(path)]));
 };
 const build = (root, config) => {
-	try {
-		return createEngine(root, config);
-	} catch (error) {
-		return error instanceof Error ? error : new Error(String(error));
-	}
+	const built = attempt(() => createEngine(root, config));
+	return built.ok ? built : failure(built.error instanceof Error ? built.error : new Error(String(built.error)));
 };
 /** The engine for `root` and `config`, rebuilt when a package.json it read has changed. */
 const engineFor = (root, config) => {
@@ -90,14 +87,15 @@ const plugin = {
 					});
 					return;
 				}
-				const engine = engineFor(root, config);
-				if (engine instanceof Error) {
+				const built = engineFor(root, config);
+				if (!built.ok) {
 					context.report({
-						message: engine.message,
+						message: built.error.message,
 						loc: { start }
 					});
 					return;
 				}
+				const engine = built.value;
 				const file = nodePath.relative(root, context.filename).split(nodePath.sep).join("/");
 				for (const finding of withoutBaselined(engine, findingsForFile(engine, file, context.sourceCode.text))) {
 					const message = `${finding.rule}: ${finding.message}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ox-dep-lint",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "Module dependency graph rules for oxlint: package kinds, outside packages, runtime and test-only modules, undeclared, escaping and computed imports",
   "license": "MIT",
   "author": "Philip B. Krogh",
@@ -32,13 +32,19 @@
     "build": "vp pack",
     "check": "vp check --deny-warnings && vp test run",
     "test": "vp test run",
-    "prepack": "vp pack"
+    "prepack": "vp pack",
+    "prepare": "vp config",
+    "changeset": "changeset"
   },
   "dependencies": {
     "oxc-parser": "0.153.0",
-    "oxc-resolver": "11.24.2"
+    "oxc-resolver": "11.24.2",
+    "valibot": "1.5.0"
   },
   "devDependencies": {
+    "@changesets/cli": "3.0.3",
+    "@commitlint/cli": "21.2.3",
+    "@commitlint/config-conventional": "21.2.3",
     "@types/node": "24.9.1",
     "oxlint": "1.86.0",
     "typescript": "7.0.2",