ox-dep-lint 0.2.0 → 0.4.0

package/dist/{engine-C1qSxYaL.mjs → engine-DmECSDnu.mjs}

@@ -1,6 +1,7 @@
 import { builtinModules } from "node:module";
-import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, realpathSync, statSync } from "node:fs";
 import nodePath from "node:path";
+import * as v from "valibot";
 import { ResolverFactory } from "oxc-resolver";
 import { Visitor, parseSync } from "oxc-parser";
 // src/config.ts
@@ -8,7 +9,10 @@ const ruleNames = [
 	"unknown-workspace-package",
 	"package-without-kind",
 	"package-outside-workspace",
+	"directory-without-package",
 	"invalid-package",
+	"symbolic-link",
+	"unreadable-path",
 	"forbidden-edge",
 	"type-only-edge",
 	"relative-import-leaves-package",
@@ -40,8 +44,22 @@ const defaultFileClasses = [{
 	],
 	policy: "development"
 }];
-/** Build output and coverage reports under a package, never read unless `output` says otherwise. */
-const defaultOutput = ["dist/**", "coverage/**"];
+/**
+* Build output, coverage reports and the caches tools write under a package root (generated, never written by hand),
+* never read unless `output` says otherwise. Shipped code that imports from them is still judged.
+*/
+const defaultOutput = [
+	"dist/**",
+	"coverage/**",
+	".wrangler/**",
+	".astro/**",
+	".svelte-kit/**",
+	".next/**",
+	".turbo/**",
+	".vercel/**",
+	".nuxt/**",
+	".output/**"
+];
 const allManifestFields = [
 	"dependencies",
 	"devDependencies",
@@ -50,137 +68,367 @@ const allManifestFields = [
 ];
 /** Identity, for type checking a configuration file. */
 const defineConfig = (config) => config;
-const allowedKeys = {
-	config: [
-		"workspaceScopes",
-		"kinds",
-		"packages",
-		"fileClasses",
-		"runtimeModules",
-		"virtualModules",
-		"testOnlySpecifiers",
-		"imports",
-		"baseline",
-		"ignore",
-		"output"
-	],
-	kind: [
-		"packages",
-		"mayUse",
-		"externals",
-		"runtimeModules"
-	],
-	package: [
-		"uses",
-		"externals",
-		"typeOnlyUses",
-		"valueSpecifiers",
-		"testSupportFiles"
-	],
-	fileClass: ["files", "policy"],
-	runtimeModules: ["prefixes", "names"],
-	imports: [
-		"computed",
-		"selfByName",
-		"unresolved",
-		"manifestEdgeFields",
-		"requireDeclared",
-		"shippedFields",
-		"typeOnly"
-	],
-	baseline: [
-		"file",
-		"rule",
-		"target",
-		"reason"
-	]
-};
-const choices = {
-	computed: [
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const plainObject = v.custom(isPlainObject);
+/** `schema` itself, which fails to type check unless it accepts exactly `Output`. */
+const schemaOf = () => (schema) => schema;
+const filePolicySchema = schemaOf()(v.picklist([
+	"shipped",
+	"development",
+	"unchecked"
+]));
+const manifestFieldSchema = schemaOf()(v.picklist(allManifestFields));
+const ruleNameSchema = schemaOf()(v.picklist(ruleNames));
+/** The values each import policy may take. */
+const policies = {
+	computed: schemaOf()(v.picklist([
 		"error-in-shipped",
 		"error",
 		"allow"
-	],
-	selfByName: ["error", "allow"],
-	unresolved: ["error", "ignore"],
-	requireDeclared: [true, false],
-	typeOnly: ["relaxed", "as-values"]
+	])),
+	selfByName: schemaOf()(v.picklist(["error", "allow"])),
+	unresolved: schemaOf()(v.picklist(["error", "ignore"])),
+	requireDeclared: schemaOf()(v.boolean()),
+	typeOnly: schemaOf()(v.picklist(["relaxed", "as-values"]))
 };
+/** 0.2's test for a list of strings. `every` skips the holes of a sparse array, where `v.array` reads `undefined`. */
 const isStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
-const unknownKeys = (where, value, allowed) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.keys(value).filter((key) => !allowed.includes(key)).map((key) => `${where} has the unknown key ${key} (known: ${allowed.join(", ")})`) : [`${where} is not an object`];
-/** Problems that make a configuration unusable, as messages. A misspelled key is a problem, never a silent default. */
-const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** Problems with the configuration's outline (objects where objects belong, lists where lists belong), checked first. */
-const shapeProblems = (config) => {
-	if (!isObject(config)) return ["the configuration must be an object"];
-	const { kinds, packages, fileClasses, baseline } = config;
+const stringList = v.custom(isStringList);
+/** A list of manifest fields, holes skipped as in 0.2. */
+const manifestFieldList = v.custom((value) => isStringList(value) && value.every((field) => v.is(manifestFieldSchema, field)));
+/**
+* A value in a message, written as 0.2 wrote it: a template literal, which throws for a Symbol. 0.2 threw that way
+* (exit 2 with the TypeError's message), so the check still does.
+*/
+const asText = (value) => `${value}`;
+/**
+* Every own entry of an object, each value checked by `value`. Not `v.record`, which skips the keys `constructor`,
+* `prototype` and `__proto__` that 0.2 checked. In an issue's path, the entry is its index and then 1.
+*/
+const ownEntries = (value) => v.pipe(plainObject, v.transform((input) => Object.entries(input)), v.array(v.tuple([v.string(), value])));
+/** 0.2's outline test for a list of objects, which skips holes as `every` does. */
+const objectList = v.custom((value) => Array.isArray(value) && value.every(isPlainObject));
+/** The outline (objects where objects belong, lists where lists belong), checked first: nothing else is read until it holds. */
+const outlineSchema = v.pipe(plainObject, v.looseObject({
+	kinds: ownEntries(plainObject),
+	packages: v.optional(ownEntries(plainObject)),
+	imports: v.optional(plainObject),
+	runtimeModules: v.optional(plainObject),
+	fileClasses: v.optional(objectList),
+	baseline: v.optional(objectList)
+}));
+const kindRuleSchema = v.strictObject({
+	packages: v.pipe(v.array(v.unknown()), v.minLength(1)),
+	mayUse: v.union([v.literal("any"), stringList]),
+	externals: v.optional(v.union([v.literal("any"), stringList])),
+	runtimeModules: v.optional(v.boolean())
+});
+const packageRuleSchema = v.strictObject({
+	uses: v.exactOptional(stringList),
+	externals: v.exactOptional(stringList),
+	typeOnlyUses: v.exactOptional(stringList),
+	valueSpecifiers: v.exactOptional(stringList),
+	testSupportFiles: v.exactOptional(stringList)
+});
+const fileClassSchema = v.strictObject({
+	files: stringList,
+	policy: filePolicySchema
+});
+const runtimeModulesSchema = v.strictObject({
+	prefixes: v.exactOptional(stringList),
+	names: v.exactOptional(stringList)
+});
+const importPolicySchema = v.strictObject({
+	computed: v.optional(policies.computed),
+	selfByName: v.optional(policies.selfByName),
+	unresolved: v.optional(policies.unresolved),
+	manifestEdgeFields: v.optional(manifestFieldList),
+	requireDeclared: v.optional(policies.requireDeclared),
+	shippedFields: v.optional(manifestFieldList),
+	typeOnly: v.optional(policies.typeOnly)
+});
+const baselineEntrySchema = v.strictObject({
+	file: v.optional(v.unknown()),
+	rule: ruleNameSchema,
+	target: v.pipe(v.string(), v.nonEmpty()),
+	reason: v.pipe(v.string(), v.check((reason) => reason.trim() !== ""))
+});
+const configSchema = v.strictObject({
+	workspaceScopes: stringList,
+	kinds: ownEntries(kindRuleSchema),
+	packages: v.optional(ownEntries(packageRuleSchema)),
+	fileClasses: v.optional(v.array(fileClassSchema)),
+	runtimeModules: v.optional(runtimeModulesSchema),
+	virtualModules: v.optional(stringList),
+	testOnlySpecifiers: v.optional(stringList),
+	imports: v.optional(importPolicySchema),
+	baseline: v.optional(v.array(baselineEntrySchema)),
+	ignore: v.optional(stringList),
+	output: v.optional(stringList)
+});
+/** The sections of the messages, in 0.2's order. */
+const section = {
+	configurationKeys: 0,
+	kinds: 1,
+	packages: 2,
+	workspaceScopes: 3,
+	testOnlySpecifiers: 4,
+	virtualModules: 5,
+	ignore: 6,
+	output: 7,
+	runtimeModuleValues: 8,
+	importFields: 9,
+	fileClasses: 10,
+	runtimeModuleKeys: 11,
+	importKeys: 12,
+	importPolicies: 13,
+	baseline: 14
+};
+/** Within a kind: its unknown keys, then these fields, then the kinds it names that do not exist. */
+const kindFieldOrder = [
+	"packages",
+	"mayUse",
+	"runtimeModules",
+	"externals"
+];
+const importFieldOrder = ["manifestEdgeFields", "shippedFields"];
+const importPolicyOrder = [
+	"computed",
+	"selfByName",
+	"unresolved",
+	"requireDeclared",
+	"typeOnly"
+];
+const baselineFieldOrder = [
+	"file",
+	"rule",
+	"target",
+	"reason"
+];
+/** The values a policy may take, as its message lists them. */
+const policyValues = (field) => {
+	const schema = policies[field];
+	return "options" in schema ? schema.options : [true, false];
+};
+/** One message per key of `object` that `entries` does not know, in the object's order. */
+const unknownKeyProblems = (where, object, entries, order) => Object.keys(object).flatMap((key, position) => Object.hasOwn(entries, key) ? [] : [{
+	order: [...order, position],
+	message: `${where} has the unknown key ${key} (known: ${Object.keys(entries).join(", ")})`
+}]);
+/** For an object whose every value is a list of strings: the unknown keys whose value is not one, in the object's order. */
+const unknownListProblems = (object, entries, order, message) => Object.entries(object).flatMap(([key, value], position) => Object.hasOwn(entries, key) || v.is(stringList, value) ? [] : [{
+	order: [...order, position],
+	message: message(key)
+}]);
+/** The value an issue's path passes through at `index`, as an object (an entry of `ownEntries` is a pair). */
+const objectAt = (path, index) => {
+	const value = path[index]?.value;
+	return isPlainObject(value) ? value : {};
+};
+/** The key and value of the `ownEntries` entry at `index` of an issue's path. */
+const entryAt = (path, index) => {
+	const pair = path[index]?.value;
+	const [name, value] = Array.isArray(pair) ? pair : [];
+	return {
+		name: String(name),
+		value: isPlainObject(value) ? value : {}
+	};
+};
+const outlineMessage = (path) => {
+	const field = path[0]?.key;
+	if (field === void 0) return "the configuration must be an object";
+	if (field === "kinds") return path.length === 1 ? "kinds must map each kind to its rule" : `kind ${entryAt(path, 1).name} must be an object`;
+	if (field === "packages") return path.length === 1 ? "packages must map package names to their rules" : `package ${entryAt(path, 1).name} must be an object`;
+	if (field === "imports" || field === "runtimeModules") return `${field} must be an object`;
+	return `${field === "fileClasses" ? "fileClasses" : "baseline"} must be a list of objects`;
+};
+const kindProblems = (path, unknownKey, holder) => {
+	const index = Number(path[1]?.key);
+	const { name } = entryAt(path, 1);
+	if (unknownKey) return unknownKeyProblems(`kind ${name}`, holder, kindRuleSchema.entries, [
+		section.kinds,
+		index,
+		0
+	]);
+	const field = String(path[3]?.key);
+	const message = {
+		packages: `kind ${name} names no packages`,
+		mayUse: `kind ${name}: mayUse must be "any" or a list of kinds`,
+		runtimeModules: `kind ${name}: runtimeModules must be true or false`,
+		externals: `kind ${name}: externals must be "any" or a list of package names`
+	}[field];
+	return message === void 0 ? [] : [{
+		order: [
+			section.kinds,
+			index,
+			kindFieldOrder.indexOf(field) + 1
+		],
+		message
+	}];
+};
+/** The kinds a kind may use that are not kinds: a reference across entries, which no schema of one entry sees. */
+const kindReferenceProblems = (kinds) => {
+	const known = new Set(Object.keys(kinds));
 	const problems = [];
-	if (!isObject(kinds)) problems.push("kinds must map each kind to its rule");
-	else for (const [name, kind] of Object.entries(kinds)) if (!isObject(kind)) problems.push(`kind ${name} must be an object`);
-	if (packages !== void 0 && !isObject(packages)) problems.push("packages must map package names to their rules");
-	else for (const [name, rule] of Object.entries(packages ?? {})) if (!isObject(rule)) problems.push(`package ${name} must be an object`);
-	for (const [key, value] of [["imports", config.imports], ["runtimeModules", config.runtimeModules]]) if (value !== void 0 && !isObject(value)) problems.push(`${key} must be an object`);
-	for (const [key, list] of [["fileClasses", fileClasses], ["baseline", baseline]]) if (list !== void 0 && (!Array.isArray(list) || !list.every(isObject))) problems.push(`${key} must be a list of objects`);
+	for (const [index, [name, kind]] of Object.entries(kinds).entries()) {
+		const mayUse = isPlainObject(kind) ? kind.mayUse : void 0;
+		if (!Array.isArray(mayUse)) continue;
+		for (const [position, used] of [...mayUse].entries()) if (typeof used !== "string" || !known.has(used)) problems.push({
+			order: [
+				section.kinds,
+				index,
+				kindFieldOrder.length + 1,
+				position
+			],
+			message: `kind ${name} may use ${asText(used)}, which is not a kind`
+		});
+	}
 	return problems;
 };
-const configProblems = (config) => {
-	const outline = shapeProblems(config);
-	if (outline.length > 0) return outline;
-	const problems = unknownKeys("the configuration", config, allowedKeys.config);
-	const kinds = new Set(Object.keys(config.kinds));
-	for (const [name, kind] of Object.entries(config.kinds)) {
-		problems.push(...unknownKeys(`kind ${name}`, kind, allowedKeys.kind));
-		if (!Array.isArray(kind.packages) || kind.packages.length === 0) problems.push(`kind ${name} names no packages`);
-		if (kind.mayUse !== "any" && !isStringList(kind.mayUse)) problems.push(`kind ${name}: mayUse must be "any" or a list of kinds`);
-		if (kind.runtimeModules !== void 0 && typeof kind.runtimeModules !== "boolean") problems.push(`kind ${name}: runtimeModules must be true or false`);
-		if (kind.externals !== void 0 && kind.externals !== "any" && !isStringList(kind.externals)) problems.push(`kind ${name}: externals must be "any" or a list of package names`);
-		if (kind.mayUse !== "any") {
-			for (const used of Array.isArray(kind.mayUse) ? kind.mayUse : []) if (!kinds.has(used)) problems.push(`kind ${name} may use ${used}, which is not a kind`);
-		}
-	}
-	for (const [name, refinements] of Object.entries(config.packages ?? {})) {
-		problems.push(...unknownKeys(`package ${name}`, refinements, allowedKeys.package));
-		for (const [key, value] of Object.entries(refinements)) if (!isStringList(value)) problems.push(`package ${name}: ${key} must be a list of strings`);
-	}
-	if (!isStringList(config.workspaceScopes)) problems.push("workspaceScopes must be a list of scopes");
-	for (const key of [
-		"testOnlySpecifiers",
-		"virtualModules",
-		"ignore",
-		"output"
-	]) {
-		const value = config[key];
-		if (value !== void 0 && !isStringList(value)) problems.push(`${key} must be a list of strings`);
-	}
-	for (const [key, value] of Object.entries(config.runtimeModules ?? {})) if (!isStringList(value)) problems.push(`runtimeModules.${key} must be a list of strings`);
-	for (const key of ["manifestEdgeFields", "shippedFields"]) {
-		const value = config.imports?.[key];
-		if (value !== void 0 && (!isStringList(value) || !value.every((field) => allManifestFields.includes(field)))) problems.push(`imports.${key} must be a list of ${allManifestFields.join(", ")}`);
-	}
-	for (const [index, fileClass] of (config.fileClasses ?? []).entries()) {
-		problems.push(...unknownKeys(`file class ${index}`, fileClass, allowedKeys.fileClass));
-		if (!isStringList(fileClass.files)) problems.push(`file class ${index}: files must be a list of globs`);
-		if (![
-			"shipped",
-			"development",
-			"unchecked"
-		].includes(fileClass.policy)) problems.push(`file class ${index} has the unknown policy ${String(fileClass.policy)}`);
-	}
-	if (config.runtimeModules !== void 0) problems.push(...unknownKeys("runtimeModules", config.runtimeModules, allowedKeys.runtimeModules));
-	if (config.imports !== void 0) {
-		problems.push(...unknownKeys("imports", config.imports, allowedKeys.imports));
-		for (const [key, allowed] of Object.entries(choices)) {
-			const value = config.imports[key];
-			if (value !== void 0 && !allowed.includes(value)) problems.push(`imports.${key} is ${JSON.stringify(value)}; it must be one of ${allowed.join(", ")}`);
-		}
+const packageProblems = (path, unknownKey, holder) => {
+	const index = Number(path[1]?.key);
+	const { name, value } = entryAt(path, 1);
+	const listMessage = (key) => `package ${name}: ${key} must be a list of strings`;
+	if (unknownKey) return [...unknownKeyProblems(`package ${name}`, holder, packageRuleSchema.entries, [
+		section.packages,
+		index,
+		0
+	]), ...unknownListProblems(holder, packageRuleSchema.entries, [
+		section.packages,
+		index,
+		1
+	], listMessage)];
+	const field = String(path[3]?.key);
+	return [{
+		order: [
+			section.packages,
+			index,
+			1,
+			Object.keys(value).indexOf(field)
+		],
+		message: listMessage(field)
+	}];
+};
+const runtimeModulesProblems = (path, unknownKey, holder) => {
+	const listMessage = (key) => `runtimeModules.${key} must be a list of strings`;
+	if (unknownKey) return [...unknownKeyProblems("runtimeModules", holder, runtimeModulesSchema.entries, [section.runtimeModuleKeys]), ...unknownListProblems(holder, runtimeModulesSchema.entries, [section.runtimeModuleValues], listMessage)];
+	const field = String(path[1]?.key);
+	return [{
+		order: [section.runtimeModuleValues, Object.keys(objectAt(path, 0)).indexOf(field)],
+		message: listMessage(field)
+	}];
+};
+const importProblems = (path, unknownKey, holder) => {
+	if (unknownKey) return unknownKeyProblems("imports", holder, importPolicySchema.entries, [section.importKeys]);
+	const field = String(path[1]?.key);
+	if (importFieldOrder.includes(field)) return [{
+		order: [section.importFields, importFieldOrder.indexOf(field)],
+		message: `imports.${field} must be a list of ${allManifestFields.join(", ")}`
+	}];
+	return [{
+		order: [section.importPolicies, importPolicyOrder.indexOf(field)],
+		message: `imports.${field} is ${JSON.stringify(path[1]?.value)}; it must be one of ${policyValues(field).join(", ")}`
+	}];
+};
+const fileClassProblems = (path, unknownKey, holder) => {
+	const index = Number(path[1]?.key);
+	if (unknownKey) return unknownKeyProblems(`file class ${index}`, holder, fileClassSchema.entries, [
+		section.fileClasses,
+		index,
+		0
+	]);
+	return path[2]?.key === "files" ? [{
+		order: [
+			section.fileClasses,
+			index,
+			1
+		],
+		message: `file class ${index}: files must be a list of globs`
+	}] : [{
+		order: [
+			section.fileClasses,
+			index,
+			2
+		],
+		message: `file class ${index} has the unknown policy ${String(objectAt(path, 1).policy)}`
+	}];
+};
+const baselineProblems = (path, unknownKey, holder) => {
+	const index = Number(path[1]?.key);
+	const entry = objectAt(path, 1);
+	const file = asText(entry.file);
+	if (unknownKey) return unknownKeyProblems(`the baseline entry for ${file}`, holder, baselineEntrySchema.entries, [
+		section.baseline,
+		index,
+		0
+	]);
+	const field = String(path[2]?.key);
+	const message = {
+		rule: () => `the baseline entry for ${file} names the unknown rule ${String(entry.rule)}`,
+		target: () => `the baseline entry for ${asText(entry.rule)} in ${file} names no target, so it would hide every future finding of that rule there`,
+		reason: () => `the baseline entry for ${asText(entry.rule)} in ${file} has no reason`
+	}[field]?.();
+	return message === void 0 ? [] : [{
+		order: [
+			section.baseline,
+			index,
+			baselineFieldOrder.indexOf(field)
+		],
+		message
+	}];
+};
+/** The messages for one issue of `configSchema`. */
+const problemsOf = (issue) => {
+	const path = issue.path ?? [];
+	const unknownKey = issue.type === "strict_object" && issue.expected === "never";
+	const at = unknownKey ? path.slice(0, -1) : path;
+	const holder = unknownKey ? path.at(-1)?.input : void 0;
+	const object = isPlainObject(holder) ? holder : {};
+	const field = at[0]?.key;
+	switch (field) {
+		case void 0: return unknownKey ? unknownKeyProblems("the configuration", object, configSchema.entries, [section.configurationKeys]) : [];
+		case "kinds": return kindProblems(path, unknownKey, object);
+		case "packages": return packageProblems(path, unknownKey, object);
+		case "runtimeModules": return runtimeModulesProblems(path, unknownKey, object);
+		case "imports": return importProblems(path, unknownKey, object);
+		case "fileClasses": return fileClassProblems(path, unknownKey, object);
+		case "baseline": return baselineProblems(path, unknownKey, object);
+		case "workspaceScopes": return [{
+			order: [section.workspaceScopes],
+			message: "workspaceScopes must be a list of scopes"
+		}];
+		case "testOnlySpecifiers":
+		case "virtualModules":
+		case "ignore":
+		case "output": return [{
+			order: [section[field]],
+			message: `${field} must be a list of strings`
+		}];
+		default: return [];
 	}
-	for (const entry of config.baseline ?? []) {
-		problems.push(...unknownKeys(`the baseline entry for ${entry.file}`, entry, allowedKeys.baseline));
-		if (!ruleNames.includes(entry.rule)) problems.push(`the baseline entry for ${entry.file} names the unknown rule ${String(entry.rule)}`);
-		if (typeof entry.target !== "string" || entry.target === "") problems.push(`the baseline entry for ${entry.rule} in ${entry.file} names no target, so it would hide every future finding of that rule there`);
-		if (typeof entry.reason !== "string" || entry.reason.trim() === "") problems.push(`the baseline entry for ${entry.rule} in ${entry.file} has no reason`);
+};
+const compareOrders = (left, right) => {
+	for (let index = 0; index < Math.max(left.length, right.length); index++) {
+		const difference = (left[index] ?? -1) - (right[index] ?? -1);
+		if (difference !== 0) return difference;
 	}
-	return problems;
+	return 0;
+};
+/** Problems that make a configuration unusable, as messages: the outline's alone when it does not hold, else every other. */
+const configProblems = (config) => {
+	const outline = v.safeParse(outlineSchema, config);
+	if (!outline.success) return [...new Set(outline.issues.map((issue) => outlineMessage(issue.path ?? [])))];
+	const sparse = ["fileClasses", "baseline"].filter((key) => [...config[key] ?? []].includes(void 0));
+	if (sparse.length > 0) return sparse.map((key) => `${key} must be a list of objects`);
+	for (const entry of config.baseline ?? []) asText(entry.file);
+	const problems = [...(v.safeParse(configSchema, config).issues ?? []).flatMap(problemsOf), ...kindReferenceProblems(config.kinds)].toSorted((left, right) => compareOrders(left.order, right.order));
+	const seen = /* @__PURE__ */ new Set();
+	return problems.flatMap((problem) => {
+		const key = problem.order.join(" ");
+		if (seen.has(key)) return [];
+		seen.add(key);
+		return [problem.message];
+	});
 };
 const resolveConfig = (config) => {
 	const problems = configProblems(config);
@@ -270,20 +518,38 @@ const globExpression = (pattern) => {
 const matchesGlob = (path, pattern) => globExpression(pattern).test(path);
 /** Whether `path` matches any of `patterns`. */
 const matchesAny = (path, patterns) => patterns.some((pattern) => matchesGlob(path, pattern));
+// src/result.ts
+const success = (value) => ({
+	ok: true,
+	value
+});
+const failure = (error) => ({
+	ok: false,
+	error
+});
+/** Runs `operation`, with what it throws as the failure. */
+const attempt = (operation) => {
+	try {
+		return success(operation());
+	} catch (cause) {
+		return failure(cause);
+	}
+};
+/** The message of something thrown, which need not be an Error. */
+const messageOf = (cause) => cause instanceof Error ? cause.message : String(cause);
+/** The error code of something thrown by `node:fs` (`EACCES`), or its message when it has none. */
+const codeOf = (cause) => typeof cause === "object" && cause !== null && "code" in cause && typeof cause.code === "string" ? cause.code : messageOf(cause);
 // src/workspace.ts
 /**
 * The workspace as `package.json` files declare it: the root's `workspaces` globs, and each package's real name (never
 * guessed from its directory) and dependency fields.
 */
+/** The manifest at `path`, or why it cannot be read. */
 const readManifest = (path) => {
-	let parsed;
-	try {
-		parsed = JSON.parse(readFileSync(path, "utf8"));
-	} catch (cause) {
-		throw new Error(`${path}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
-	}
-	if (typeof parsed !== "object" || parsed === null) throw new Error(`${path} is not a JSON object`);
-	return parsed;
+	const parsed = attempt(() => JSON.parse(readFileSync(path, "utf8")));
+	if (!parsed.ok) return failure(`${path}: ${messageOf(parsed.error)}`);
+	if (typeof parsed.value !== "object" || parsed.value === null) return failure(`${path} is not a JSON object`);
+	return success(parsed.value);
 };
 const namesOf = (field) => typeof field === "object" && field !== null && !Array.isArray(field) ? Object.keys(field).toSorted() : [];
 const fieldsOf = (manifest) => ({
@@ -311,12 +577,9 @@ const workspaceGlobs = (manifest) => {
 	if (Array.isArray(field)) return field.filter((entry) => typeof entry === "string");
 	if (typeof field === "object" && field !== null && "packages" in field && Array.isArray(field.packages)) return field.packages.filter((entry) => typeof entry === "string");
 };
-const workspacesOf = (manifest) => {
-	try {
-		return workspaceGlobs(readManifest(manifest)) ?? [];
-	} catch {
-		return [];
-	}
+const workspacesOf = (path) => {
+	const manifest = readManifest(path);
+	return manifest.ok ? workspaceGlobs(manifest.value) ?? [] : [];
 };
 /** Whether `globs` (from the manifest in `candidate`) hold `directory`: one of them matches it or a directory above it. */
 const holds = (candidate, globs, directory) => {
@@ -345,7 +608,21 @@ const findWorkspaceRoot = (start) => {
 		if (nodePath.dirname(candidate) === candidate) return root ?? nearest;
 	}
 };
-const directoriesMatching = (root, pattern) => {
+/** The first of `path`'s directories (repository-relative), itself included, that is a symbolic link. */
+const linkAlong = (root, path) => {
+	const parts = path === "" ? [] : path.split("/");
+	return parts.map((_, index) => parts.slice(0, index + 1).join("/")).find((prefix) => {
+		const status = attempt(() => lstatSync(nodePath.join(root, prefix)));
+		return status.ok && status.value.isSymbolicLink();
+	});
+};
+/**
+* The directories under `root` that `pattern` matches, skipping `node_modules` and dot directories, as npm and Bun
+* workspaces do. A symbolic link is never followed, not even one the pattern names literally or passes through (a
+* `packages` that is a link), and a directory that cannot be listed is passed over; with `unlisted`, those and the dot
+* directories the pattern would match are collected there, so the caller can report them.
+*/
+const directoriesMatching = (root, pattern, unlisted) => {
 	const clean = (pattern.startsWith("!") ? pattern.slice(1) : pattern).replace(/^\.\//u, "").replace(/\/$/u, "");
 	const fixed = [];
 	for (const segment of clean.split("/")) {
@@ -358,15 +635,34 @@ const directoriesMatching = (root, pattern) => {
 	const walk = (relative, depth) => {
 		if (matchesGlob(relative, clean)) found.push(relative);
 		if (depth >= depthLimit) return;
-		const absolute = nodePath.join(root, relative);
-		for (const entry of readdirSync(absolute, { withFileTypes: true })) if (entry.isDirectory() && entry.name !== "node_modules" && !entry.name.startsWith(".")) walk(relative === "" ? entry.name : `${relative}/${entry.name}`, depth + 1);
+		const listed = attempt(() => readdirSync(nodePath.join(root, relative), { withFileTypes: true }));
+		if (!listed.ok) {
+			unlisted?.unreadable.push({
+				directory: relative,
+				code: codeOf(listed.error)
+			});
+			return;
+		}
+		for (const entry of listed.value) {
+			const path = relative === "" ? entry.name : `${relative}/${entry.name}`;
+			if (entry.isDirectory() && entry.name !== "node_modules" && !entry.name.startsWith(".")) walk(path, depth + 1);
+			else if (entry.isDirectory() && entry.name.startsWith(".") && entry.name !== ".git" && matchesGlob(path, clean)) unlisted?.dotDirectories.push(path);
+			else if (entry.isSymbolicLink() && matchesGlob(path, clean)) unlisted?.links.push(path);
+		}
 	};
+	const link = linkAlong(root, base);
+	if (link !== void 0) {
+		unlisted?.links.push(link);
+		return [];
+	}
 	if (base === clean) return existsSync(nodePath.join(root, base)) ? [base] : [];
 	if (existsSync(nodePath.join(root, base)) && statSync(nodePath.join(root, base)).isDirectory()) walk(base, base === "" ? 0 : base.split("/").length);
 	return found;
 };
 const loadWorkspace = (root) => {
-	const rootManifest = readManifest(nodePath.join(root, "package.json"));
+	const rootRead = readManifest(nodePath.join(root, "package.json"));
+	if (!rootRead.ok) throw new Error(rootRead.error);
+	const rootManifest = rootRead.value;
 	const globs = workspaceGlobs(rootManifest) ?? [];
 	const directories = /* @__PURE__ */ new Set();
 	for (const pattern of globs.filter((glob) => !glob.startsWith("!"))) for (const directory of directoriesMatching(root, pattern)) if (existsSync(nodePath.join(root, directory, "package.json"))) directories.add(directory);
@@ -375,16 +671,15 @@ const loadWorkspace = (root) => {
 	const problems = [];
 	const byName = /* @__PURE__ */ new Map();
 	for (const directory of [...directories].toSorted()) {
-		let manifest;
-		try {
-			manifest = readManifest(nodePath.join(root, directory, "package.json"));
-		} catch (error) {
+		const read = readManifest(nodePath.join(root, directory, "package.json"));
+		if (!read.ok) {
 			problems.push({
 				directory,
-				message: `package.json cannot be read: ${error instanceof Error ? error.message : String(error)}`
+				message: `package.json cannot be read: ${read.error}`
 			});
 			continue;
 		}
+		const manifest = read.value;
 		if (typeof manifest.name !== "string" || manifest.name === "") {
 			problems.push({
 				directory,
@@ -414,7 +709,8 @@ const loadWorkspace = (root) => {
 		packages,
 		byName,
 		rootManifest: fieldsOf(rootManifest),
-		problems
+		problems,
+		globs
 	};
 };
 /** The package whose directory holds the repository-relative `file`, the deepest one when packages nest. */
@@ -875,6 +1171,99 @@ const reads = (engine, file) => {
 	const owner = packageOfFile(engine.workspace, file);
 	return owner !== void 0 && !matchesAny(file.slice(owner.directory.length + 1), engine.config.output);
 };
+/** Whether `glob` matches every path under `directory`: it is `**`, or it or a directory above it matches what comes before a trailing `/**`. */
+const coversDirectory = (glob, directory) => {
+	if (glob === "**") return true;
+	if (!glob.endsWith("/**") || directory === "") return false;
+	const parts = directory.split("/");
+	return parts.some((_, index) => matchesGlob(parts.slice(0, index + 1).join("/"), glob.slice(0, -3)));
+};
+/**
+* Whether `glob` might match a path under `directory`: its leading segments agree with the directory's until a `**`,
+* and it is longer than the directory. A glob with braces is taken to match, so a doubt counts as a match.
+*/
+const mayMatchUnder = (glob, directory) => {
+	if (glob.includes("{")) return true;
+	const globParts = glob.split("/");
+	const directoryParts = directory === "" ? [] : directory.split("/");
+	for (const [index, part] of directoryParts.entries()) {
+		const globPart = globParts[index];
+		if (globPart === void 0) return false;
+		if (globPart === "**") return true;
+		if (!matchesGlob(part, globPart)) return false;
+	}
+	return globParts.length > directoryParts.length;
+};
+/** Whether an `ignore` glob covers every file under the repository-relative `directory`. */
+const ignoresDirectory = (engine, directory) => engine.config.ignore.some((glob) => coversDirectory(glob, directory));
+/**
+* Whether the check reads no file under the repository-relative `directory`, so a symbolic link or an unreadable
+* directory there hides nothing: an `ignore` glob covers it, or (relative to the package that owns it) an `output` glob
+* or an unchecked file class does, with no earlier class that might match a file in it. A glob covers a directory only
+* through a trailing `/**`; any doubt counts as read, so the answer errs towards a finding.
+*/
+const skipsDirectory = (engine, directory) => {
+	const { config } = engine;
+	if (ignoresDirectory(engine, directory)) return true;
+	const owner = packageOfFile(engine.workspace, `${directory}/`);
+	if (owner === void 0) return true;
+	const relative = directory.slice(owner.directory.length + 1);
+	if (config.output.some((glob) => coversDirectory(glob, relative))) return true;
+	for (const fileClass of config.fileClasses) {
+		if (fileClass.files.some((glob) => coversDirectory(glob, relative))) return fileClass.policy === "unchecked";
+		if (fileClass.policy !== "unchecked" && fileClass.files.some((glob) => mayMatchUnder(glob, relative))) return false;
+	}
+	return false;
+};
+/** Directories the walk never enters, wherever they are: dependencies and git's own data. */
+const passedOver = (name) => name === "node_modules" || name === ".git";
+/**
+* Whether a symbolic link at the repository-relative `path` is a finding: always, whatever it points at, unless it lies
+* in (or is) a directory the check skips on purpose (`node_modules`, `.git`, or one `skipsDirectory` covers).
+*/
+const reportsLink = (engine, path) => !path.split("/").some(passedOver) && !skipsDirectory(engine, path);
+/** A symbolic link the check met and did not follow, at `path` (repository-relative), with the destination it names. */
+const symbolicLinkFinding = (path, destination) => ({
+	rule: "symbolic-link",
+	file: path,
+	line: 1,
+	column: 0,
+	message: `${path} is a symbolic link to ${destination}, which the check never follows, so what it reaches goes unchecked: replace it with the files themselves, or baseline it`,
+	target: destination
+});
+/** A directory the check needed to list, or a source file it needed to read, and could not, with the error code that said why. */
+const unreadablePathFinding = (path, code, kind = "directory") => ({
+	rule: "unreadable-path",
+	file: path,
+	line: 1,
+	column: 0,
+	message: kind === "directory" ? `${path} cannot be read (${code}), so the files in it cannot be checked: make it readable, or add ${path}/** to ignore` : `${path} cannot be read (${code}), so its imports cannot be checked: make it readable, or add it to ignore`,
+	target: path
+});
+/** The destination a symbolic link names, as written. */
+const linkDestination = (absolute) => {
+	try {
+		return readlinkSync(absolute);
+	} catch {
+		return "an unreadable destination";
+	}
+};
+/**
+* The first symbolic link on the way from `owner`'s directory down to `file` (both repository-relative), the file
+* itself included. The CLI's walk never follows one, but oxlint does, and lints the files behind it under the link's
+* path.
+*/
+const linkOnPath = (engine, owner, file) => {
+	const parts = file.slice(owner.directory.length + 1).split("/");
+	for (const [index] of parts.entries()) {
+		const path = [owner.directory, ...parts.slice(0, index + 1)].join("/");
+		try {
+			if (lstatSync(nodePath.join(engine.workspace.root, path)).isSymbolicLink()) return path;
+		} catch {
+			return;
+		}
+	}
+};
 /** The rules that hold for shipped code and not for development files. */
 const shippedOnlyRules = /* @__PURE__ */ new Set([
 	"runtime-module",
@@ -903,9 +1292,11 @@ const developmentFileBreaks = (engine, file) => {
 	if (known !== void 0 && [...known.read].every(([path, time]) => modifiedTime(nodePath.join(engine.workspace.root, path)) === time)) return known.breaks;
 	const read = /* @__PURE__ */ new Map();
 	const queue = [file];
+	let head = 0;
 	let breaks;
-	while (queue.length > 0 && breaks === void 0) {
-		const next = queue.shift() ?? file;
+	while (head < queue.length && breaks === void 0) {
+		const next = queue[head] ?? file;
+		head += 1;
 		const absolute = nodePath.join(engine.workspace.root, next);
 		const time = modifiedTime(absolute);
 		if (read.has(next) || time === void 0) continue;
@@ -913,7 +1304,12 @@ const developmentFileBreaks = (engine, file) => {
 		const directory = nodePath.dirname(next);
 		read.set(directory, modifiedTime(nodePath.join(engine.workspace.root, directory)) ?? -1);
 		const reached = [];
-		const finding = findingsForFile(engine, next, readFileSync(absolute, "utf8"), { developmentImports: reached }).find((candidate) => shippedOnlyRules.has(candidate.rule));
+		const text = attempt(() => readFileSync(absolute, "utf8"));
+		if (!text.ok) {
+			breaks = `${next} cannot be read (${codeOf(text.error)}), so it cannot be judged`;
+			break;
+		}
+		const finding = findingsForFile(engine, next, text.value, { developmentImports: reached }).find((candidate) => shippedOnlyRules.has(candidate.rule));
 		if (finding !== void 0) breaks = `${next === file ? "" : `through ${next}, `}${finding.rule} at line ${finding.line}: ${finding.message}`;
 		queue.push(...reached);
 	}
@@ -933,7 +1329,10 @@ const findingsForFile = (engine, file, text, options = {}) => {
 	const asShipped = developmentImports !== void 0;
 	const { config, workspace } = engine;
 	const owner = packageOfFile(workspace, file);
-	if (owner === void 0 || !sourceFile.test(file) || !reads(engine, file) && developmentImports === void 0) return [];
+	if (owner === void 0 || !sourceFile.test(file)) return [];
+	const link = linkOnPath(engine, owner, file);
+	if (link !== void 0) return reportsLink(engine, link) ? [symbolicLinkFinding(link, linkDestination(nodePath.join(workspace.root, link)))] : [];
+	if (!reads(engine, file) && developmentImports === void 0) return [];
 	const packageRelative = file.slice(owner.directory.length + 1);
 	const classified = effectivePolicy(engine, owner, packageRelative);
 	const policy = asShipped ? "shipped" : classified;
@@ -1064,4 +1463,4 @@ const findingsForFile = (engine, file, text, options = {}) => {
 const baselineCovers = (entry, finding) => entry.file === finding.file && entry.rule === finding.rule && entry.target === finding.target;
 /** `findings` less those the baseline covers. */
 const withoutBaselined = (engine, findings) => findings.filter((finding) => !engine.config.baseline.some((entry) => baselineCovers(entry, finding)));
-export { configProblems as _, findingsForFile as a, resolveConfig as b, withoutBaselined as c, findWorkspaceRoot as d, loadWorkspace as f, matchesGlob as g, matchesAny as h, effectivePolicy as i, importForms as l, packageOfFile as m, createEngine as n, policyOf as o, packageNameOf as p, edgeRefusal as r, reads as s, baselineCovers as t, directoriesMatching as u, defaultFileClasses as v, defineConfig as y };
+export { defineConfig as A, attempt as C, matchesGlob as D, matchesAny as E, configProblems as O, packageOfFile as S, failure as T, importForms as _, effectivePolicy as a, loadWorkspace as b, linkDestination as c, reads as d, reportsLink as f, withoutBaselined as g, unreadablePathFinding as h, edgeRefusal as i, resolveConfig as j, defaultFileClasses as k, passedOver as l, symbolicLinkFinding as m, coversDirectory as n, findingsForFile as o, skipsDirectory as p, createEngine as r, ignoresDirectory as s, baselineCovers as t, policyOf as u, directoriesMatching as v, codeOf as w, packageNameOf as x, findWorkspaceRoot as y };