ox-dep-lint 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 0.5.0
+
+### Minor Changes
+
+- 57698bb: `invalid-package` now reports a workspace member whose `dependencies`, `devDependencies`, `optionalDependencies` or `peerDependencies` is not an object: a string (`"dependencies": "some string"`), a list, a number, a boolean or `null`. 0.4 read no names from such a field and said nothing, so a forbidden or undeclared edge written there passed unseen. The finding names the field and what it holds, once per field; the member is still checked, as if that field declared nothing. The root `package.json` is not judged this way.
+
+  This is a minor release rather than a patch because it can fail a check that passed on 0.4 (the rule in `.changeset/README.md`: before 1.0, a change to what the rules report is a minor bump). Fix the field, or baseline the finding by its own target, the member's directory and the field joined by `#`:
+
+  ```ts
+  baseline: [
+    {
+      file: "tools/quality/package.json",
+      rule: "invalid-package",
+      target: "tools/quality#peerDependencies",
+      reason: "...",
+    },
+  ]
+  ```
+
+  Such an entry covers only that field. If the `package.json` later cannot be read or loses its name, which drops the member from the check, that is still reported, with the directory as its target.
+
+### Patch Changes
+
+- 57698bb: A path that disappears while the check runs is skipped instead of reported as `unreadable-path`. A test that creates and removes a temporary tree inside a package while the CLI walks it (tsukuri's `tools/quality/.scan-x/...`) no longer fails the check with `ENOENT`. This covers every place the check lists, stats or reads: the walk of each package, the `workspaces` and kind globs, a member's `package.json`, a symbolic link's destination, and a development file that shipped code imports. `ENOTDIR` (a directory on the way replaced by a file) is skipped the same way. A path that exists but cannot be read (`EACCES` and every other error) is still a finding: `unreadable-path`, or `invalid-package` for a member's `package.json`, or `shipped-imports-development-file` for a development file that shipped code imports, or `symbolic-link` (to an unreadable destination) for a link, and the oxlint plugin, which shares these functions, behaves the same. The file count the CLI prints no longer includes files that disappeared.
+
+## 0.4.0
+
+### Minor Changes
+
+- e75db50: Sources under a workspace glob no longer escape the check unreported: each one is read, or the reason it cannot be read is a finding. Plain files at a glob's level (`packages/x.ts`, outside every package directory) and entries that are neither files, directories nor links (FIFOs, sockets) are still not reported. This can add findings to a repository that passed before, so upgrade with the CLI once and baseline or fix what it reports.
+
+  - The walk now reads dot directories inside a package (`src/.internal/x.ts`), as oxlint already did; it skips only `node_modules` and `.git`.
+  - `output` now defaults to `dist/**`, `coverage/**` and the caches tools write at a package root: `.wrangler/**`, `.astro/**`, `.svelte-kit/**`, `.next/**`, `.turbo/**`, `.vercel/**`, `.nuxt/**`, `.output/**`. Setting `output` replaces the defaults; it does not add to them.
+  - `symbolic-link`: every symbolic link under a package directory, whatever it points at and whatever its name (`.d.ts`, `.md`, `.json`, extensionless); a link a `workspaces` or kind glob matches or names literally; and a link a glob passes through (`packages` itself a link). Links are never followed: 0.2 read a link to a file as if it were the file, skipped a link to a directory silently, and followed a linked `packages`. Only links inside directories the check skips on purpose are not reported: `node_modules`, `.git`, and directories that `ignore`, `output` or an unchecked file class cover through a trailing `/**`. A baseline entry names the link as `file` and its destination, as written, as `target`; baselined or not, what a link points at is never read. A Nix `result` link inside a package is a finding; `ignore: ["**/result/**"]` clears it. The oxlint plugin reports it on each file oxlint reaches through a link and reads nothing else in that file.
+  - `unreadable-path`: a directory the walk, a `workspaces` glob or a kind's glob cannot list, or a source file the check cannot read (`EACCES`), unless the check skips it on purpose. 0.2 stopped with exit code 2 and the error instead.
+  - `directory-without-package`: a directory a root `workspaces` glob matches that has no `package.json` and lies neither inside nor above a member, so nothing checks its files; and a dot directory such a glob would match (`packages/.template`), with or without a `package.json`, since npm and Bun workspaces never match dot directories. Only the topmost of nested ones is reported, and a negated glob (`!tools/legacy` or `!tools/legacy/**`) leaves it out. No new configuration key: add `dir/**` to `ignore`, or baseline it, to keep one.
+
+  A workspaces entry or kind glob that names or passes through a symbolic link no longer finds packages there: the link is reported instead of followed. `listSourceFiles` no longer lists a file reached through a link; the new `walkSources` returns the files with the walk's findings. `Workspace` has a new field, `globs`, the root's `workspaces` globs.
+
 ## 0.3.0
 
 ### Minor Changes

package/README.md

@@ -11,27 +11,30 @@ ox-dep-lint replaces the hand-written module graph checks of three repositories
 
 ## What it checks
 
-| Rule                               | Finding                                                                                                                                                                                                                                                                                                                                                           | Front end                       |
-| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- |
-| `forbidden-edge`                   | A load of a workspace package that its kind (or its `uses`) does not allow. The same check runs on edges declared in `package.json`: all four dependency fields by default, devDependencies included.                                                                                                                                                             | both                            |
-| `type-only-edge`                   | A value import of a package listed in `typeOnlyUses`. Only `import type` and `export type` declarations are type-only; an inline `import { type X }` still loads the module under `verbatimModuleSyntax`.                                                                                                                                                         | both                            |
-| `unknown-workspace-package`        | A name under a workspace scope that no package has, in an import or a `package.json`.                                                                                                                                                                                                                                                                             | both                            |
-| `package-path-escape`              | A package specifier with `.` or `..` after the name (`@acme/a/../b/src/x.ts`).                                                                                                                                                                                                                                                                                    | both                            |
-| `relative-import-leaves-package`   | A relative path, alias, root-absolute path or worker URL that resolves into another package, into `node_modules` or out of the repository. Import a package by its name instead.                                                                                                                                                                                  | both                            |
-| `shipped-imports-development-file` | Shipped code importing a development file (of its own package, or one another package exports), or a file under `output` or `ignore`, that would not pass as shipped code itself: a test helper using `fast-check`, a script using `node:fs`. A development file that would pass, such as a shared helper under `scripts/`, may be imported.                      | both                            |
-| `forbidden-external`               | An outside package that the kind's `externals` does not allow, in shipped code or in `package.json`'s shipped fields. An outside package is named by the package it installs (the `name` in its installed `package.json`, or an `npm:` alias's target), so an alias cannot pass one package off as another; `externals` name real packages.                       | both, `package.json` in the CLI |
-| `runtime-module`                   | `node:*`, a bare Node built-in (`fs`), `bun`, `bun:*` or `cloudflare:*`, also when a package import (`#crypto`) maps to one, in the shipped code of a kind with `runtimeModules: false`.                                                                                                                                                                          | both                            |
-| `test-only-in-shipped`             | A `testOnlySpecifiers` match (`fast-check`, `vite-plus/test`) in shipped code, with any `?query` stripped.                                                                                                                                                                                                                                                        | both                            |
-| `undeclared-import`                | A package the file's own `package.json` does not declare. Shipped code needs `dependencies`, `peerDependencies` or `optionalDependencies` (`imports.shippedFields`); type-only imports and development files may also use devDependencies and the root's. This covers what knip misses: files no entry reaches, and shipped code leaning on a root devDependency. | both                            |
-| `computed-import`                  | A load whose module the check cannot read: `import(expression)`, `require(expression)`, `import.meta.glob`, a kept `createRequire` function, or a literal written with an escape sequence (which is also checked by the module it spells). Shipped code only, by default.                                                                                         | both                            |
-| `unresolved-import`                | A relative path or alias (`#x`, `@/x`, `~/x`) that names no file.                                                                                                                                                                                                                                                                                                 | both                            |
-| `self-import-by-name`              | A package importing itself by its own name (off by default).                                                                                                                                                                                                                                                                                                      | both                            |
-| `package-without-kind`             | A workspace package that no kind's globs hold.                                                                                                                                                                                                                                                                                                                    | both                            |
-| `package-outside-workspace`        | A directory a kind names, with a `package.json`, that the root `workspaces` leave out, so nothing in it would be checked.                                                                                                                                                                                                                                         | CLI                             |
-| `invalid-package`                  | A workspace member whose `package.json` cannot be read, has no name, or has another member's name.                                                                                                                                                                                                                                                                | CLI                             |
-| `package-cycle`                    | A cycle between packages through their runtime dependency fields.                                                                                                                                                                                                                                                                                                 | CLI                             |
-| `stale-baseline`                   | A baseline entry that no finding needs any more, so the baseline can only shrink.                                                                                                                                                                                                                                                                                 | CLI                             |
-| `parse-error`                      | A file that does not parse, so its imports cannot be checked.                                                                                                                                                                                                                                                                                                     | both                            |
+| Rule                               | Finding                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Front end                                                    |
+| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
+| `forbidden-edge`                   | A load of a workspace package that its kind (or its `uses`) does not allow. The same check runs on edges declared in `package.json`: all four dependency fields by default, devDependencies included.                                                                                                                                                                                                                                                                                                                                                                                       | both                                                         |
+| `type-only-edge`                   | A value import of a package listed in `typeOnlyUses`. Only `import type` and `export type` declarations are type-only; an inline `import { type X }` still loads the module under `verbatimModuleSyntax`.                                                                                                                                                                                                                                                                                                                                                                                   | both                                                         |
+| `unknown-workspace-package`        | A name under a workspace scope that no package has, in an import or a `package.json`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | both                                                         |
+| `package-path-escape`              | A package specifier with `.` or `..` after the name (`@acme/a/../b/src/x.ts`).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | both                                                         |
+| `relative-import-leaves-package`   | A relative path, alias, root-absolute path or worker URL that resolves into another package, into `node_modules` or out of the repository. Import a package by its name instead.                                                                                                                                                                                                                                                                                                                                                                                                            | both                                                         |
+| `shipped-imports-development-file` | Shipped code importing a development file (of its own package, or one another package exports), or a file under `output` or `ignore`, that would not pass as shipped code itself: a test helper using `fast-check`, a script using `node:fs`. A development file that would pass, such as a shared helper under `scripts/`, may be imported.                                                                                                                                                                                                                                                | both                                                         |
+| `forbidden-external`               | An outside package that the kind's `externals` does not allow, in shipped code or in `package.json`'s shipped fields. An outside package is named by the package it installs (the `name` in its installed `package.json`, or an `npm:` alias's target), so an alias cannot pass one package off as another; `externals` name real packages.                                                                                                                                                                                                                                                 | both, `package.json` in the CLI                              |
+| `runtime-module`                   | `node:*`, a bare Node built-in (`fs`), `bun`, `bun:*` or `cloudflare:*`, also when a package import (`#crypto`) maps to one, in the shipped code of a kind with `runtimeModules: false`.                                                                                                                                                                                                                                                                                                                                                                                                    | both                                                         |
+| `test-only-in-shipped`             | A `testOnlySpecifiers` match (`fast-check`, `vite-plus/test`) in shipped code, with any `?query` stripped.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | both                                                         |
+| `undeclared-import`                | A package the file's own `package.json` does not declare. Shipped code needs `dependencies`, `peerDependencies` or `optionalDependencies` (`imports.shippedFields`); type-only imports and development files may also use devDependencies and the root's. This covers what knip misses: files no entry reaches, and shipped code leaning on a root devDependency.                                                                                                                                                                                                                           | both                                                         |
+| `computed-import`                  | A load whose module the check cannot read: `import(expression)`, `require(expression)`, `import.meta.glob`, a kept `createRequire` function, or a literal written with an escape sequence (which is also checked by the module it spells). Shipped code only, by default.                                                                                                                                                                                                                                                                                                                   | both                                                         |
+| `unresolved-import`                | A relative path or alias (`#x`, `@/x`, `~/x`) that names no file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | both                                                         |
+| `self-import-by-name`              | A package importing itself by its own name (off by default).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | both                                                         |
+| `package-without-kind`             | A workspace package that no kind's globs hold.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | both                                                         |
+| `package-outside-workspace`        | A directory a kind names, with a `package.json`, that the root `workspaces` leave out, so nothing in it would be checked.                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | CLI                                                          |
+| `invalid-package`                  | A workspace member whose `package.json` cannot be read, has no name, or has another member's name; or one with a dependency field (`dependencies`, `devDependencies`, `optionalDependencies`, `peerDependencies`) that is not an object (`"dependencies": "x"`, a list, a number, `null`), so no edge in it could be read. Such a member is still checked, as if that field declared nothing. A field's finding has the target `<directory>#<field>` (`tools/quality#peerDependencies`), so a baseline entry for it cannot cover the other causes, whose target is the directory.           | CLI                                                          |
+| `directory-without-package`        | A directory a root `workspaces` glob matches that has no `package.json` and lies neither inside nor above a member, so no package owns its files and nothing checks them (tsukuri's "directory in no tier"). Also a dot directory such a glob would match (`packages/.template`), with or without a `package.json`: npm and Bun workspaces never match dot directories, so it is no package. Only the topmost of nested ones is reported; a negated glob (`!tools/legacy` or `!tools/legacy/**`) leaves the directory out. Silence one with `ignore` (`tools/vendored/**`) or the baseline. | CLI                                                          |
+| `symbolic-link`                    | Every symbolic link under a package directory, whatever it points at (a file, a directory, nothing, a cycle) and whatever its name (`.d.ts`, `.md`, `.json`, extensionless); a link a `workspaces` or kind glob matches or names (`packages/x -> ../elsewhere`); and a link a glob passes through (`packages` itself a link). The check never follows one. It skips only links inside directories it skips on purpose: `node_modules`, `.git`, and directories `ignore`, `output` or an unchecked file class cover through a trailing `/**`.                                                | both (the plugin on each file oxlint reaches through a link) |
+| `unreadable-path`                  | A directory the walk, a `workspaces` glob or a kind glob cannot list, or a source file the check cannot read (`EACCES`), unless the check skips it on purpose. It used to stop the check with exit code 2. A path removed while the check runs (`ENOENT`, or `ENOTDIR` when a directory on the way became a file), such as a test's temporary tree, is skipped with no finding.                                                                                                                                                                                                             | CLI                                                          |
+| `package-cycle`                    | A cycle between packages through their runtime dependency fields.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | CLI                                                          |
+| `stale-baseline`                   | A baseline entry that no finding needs any more, so the baseline can only shrink.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | CLI                                                          |
+| `parse-error`                      | A file that does not parse, so its imports cannot be checked.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | both                                                         |
 
 A load is any of: `import` and `export ... from` (static, `defer` and `source` phases), `import()`, a type-level `import("...")`, `import x = require("...")`, a string-named `declare module "..."`, `/// <reference types="..." />`, `require`, `require.resolve`, `module.require`, `import.meta.require`, `import.meta.resolve`, `process.getBuiltinModule`, `createRequire(...)("...")`, and a `new URL("...", import.meta.url)` passed to `new Worker`, `new SharedWorker` or `navigator.serviceWorker.register` (bundlers load it as a module, extension or not; any other `new URL` locates a file to read or an asset to serve, and is not a load). `require.resolve` and `import.meta.resolve` with a literal are edges; with an expression they load nothing.
 
@@ -43,7 +46,7 @@ The first matching file class decides how a file is checked. Globs in a class ar
 - **development:** kind edges, relative imports and unresolved imports are still checked. The file may use devDependencies (its own and the root's), test-only specifiers, runtime modules, any outside package and computed `import()`.
 - **unchecked:** the file is not read.
 
-By default, `test/**`, `tests/**`, `e2e/**`, `scripts/**`, package-root `*.config.*`, `**/__tests__/**`, `**/fixtures/**` and `**/*.{test,spec,bench}.*` are development files. A package's `dist/**` and `coverage/**` are not read; `output` changes that list (`[]` reads everything). A package's `testSupportFiles` are development files too (a conformance suite's entry, for example).
+By default, `test/**`, `tests/**`, `e2e/**`, `scripts/**`, package-root `*.config.*`, `**/__tests__/**`, `**/fixtures/**` and `**/*.{test,spec,bench}.*` are development files. A package's build output and the caches tools write at its root are not read: `output` defaults to `dist/**`, `coverage/**`, `.wrangler/**`, `.astro/**`, `.svelte-kit/**`, `.next/**`, `.turbo/**`, `.vercel/**`, `.nuxt/**` and `.output/**`. Setting `output` replaces these defaults rather than adding to them, so list the ones you still want (`[]` reads everything). Shipped code that imports a file under `output` still has that file judged. A package's `testSupportFiles` are development files too (a conformance suite's entry, for example).
 
 ## Configuration
 
@@ -85,6 +88,10 @@ A kind may use its own kind only when `mayUse` lists it. `imports` holds the pol
 
 Misspelled keys, unknown policies and baseline entries without a `target` are configuration errors, never silent defaults.
 
+The root `workspaces` globs also say where packages live: a directory they match without a `package.json` is a `directory-without-package` finding, so no new key is needed. To keep such a directory (vendored sources that are not a package), add `dir/**` to `ignore` or baseline it with `file` and `target` both set to the directory.
+
+A `symbolic-link` baseline entry names the link as `file` and its destination, as the link writes it, as `target`, so pointing the link elsewhere makes the entry stale. Baselining a link does not make the check read through it: what a link points at is never read, baselined or not. A Nix `result` link (from `nix build`) left inside a package is a finding too; build outside packages, or add `**/result/**` to `ignore`.
+
 ## Installing
 
 ```sh
@@ -95,7 +102,7 @@ Releases are published from a `v*` tag by `.github/workflows/release.yml`, with
 
 ## Running it
 
-The CLI walks every workspace package's directory (skipping `node_modules`, dot directories and `output`), so generated and gitignored sources and nested repositories are checked too, and runs the whole-graph checks:
+The CLI walks every workspace package's directory, dot directories included (`src/.internal/`), skipping only `node_modules` and `.git` and reading nothing under `output`, so generated and gitignored sources and nested repositories are checked too, and runs the whole-graph checks. Tool caches such as `.wrangler` and `.astro` are in the default `output`; for another cache, set `output` to the defaults plus its glob, since `output` replaces the defaults. The CLI never follows a symbolic link: every link is a `symbolic-link` finding, and a directory it cannot list or a file it cannot read is an `unreadable-path` finding; one that disappears between being listed and being read is skipped. What it still does not report: plain files directly at a workspace glob's level (`packages/x.ts`), and FIFOs and sockets.
 
 ```sh
 ox-dep-lint            # finds ox-dep-lint.config.{ts,mts,js,mjs,json} at the workspace root
@@ -120,7 +127,7 @@ export default defineConfig({
 
 The plugin and the CLI call one function per file, and a test runs both under real oxlint and requires the same findings at the same places. In a long-lived process (an editor's language server) the plugin rebuilds its view of the workspace when a `package.json` changes, and looks again for a file it could not resolve.
 
-Where they can still differ: oxlint chooses which files it lints (its own ignores), and the CLI reads the files of workspace packages. oxlint shows line-1 columns of a file that starts with a byte order mark three further on than the CLI does.
+Where they can still differ: oxlint chooses which files it lints (its own ignores), and the CLI reads the files of workspace packages. oxlint follows symbolic links, so the plugin reports `symbolic-link` at line 1 of each file it is given through a link (and reads nothing else in it), where the CLI reports the link once; a link to a file oxlint does not lint (`README.md`) is reported by the CLI alone. Both read dot directories. oxlint shows line-1 columns of a file that starts with a byte order mark three further on than the CLI does.
 
 ## Not yet
 

package/dist/check-CWi8LUnB.mjs

@@ -0,0 +1,348 @@
+import { C as attempt, E as vanished, O as matchesGlob, c as linkDestination, d as reads, f as reportsLink, g as withoutBaselined, h as unreadablePathFinding, i as edgeRefusal, l as passedOver, m as symbolicLinkFinding, n as coversDirectory, o as findingsForFile, p as skipsDirectory, r as createEngine, s as ignoresDirectory, t as baselineCovers, v as directoriesMatching, w as codeOf } from "./engine-CwR59HVO.mjs";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import nodePath from "node:path";
+// src/graph.ts
+/**
+* Checks that need the whole workspace rather than one file: edges declared only in `package.json`, cycles between
+* packages, packages no kind holds, directories the workspaces match that no package owns, and baseline entries no
+* finding needs any more. Only the CLI runs these, because an oxlint plugin sees one file at a time and never sees
+* `package.json`.
+*/
+const runtimeFields = [
+	"dependencies",
+	"optionalDependencies",
+	"peerDependencies"
+];
+const graphFindings = (engine) => {
+	const { config, workspace } = engine;
+	const findings = [];
+	const at = {
+		line: 1,
+		column: 0
+	};
+	for (const problem of workspace.problems) {
+		const target = problem.field === void 0 ? problem.directory : `${problem.directory}#${problem.field}`;
+		findings.push({
+			rule: "invalid-package",
+			file: `${problem.directory}/package.json`,
+			...at,
+			message: problem.message,
+			target
+		});
+	}
+	const members = /* @__PURE__ */ new Set([...workspace.packages.map((entry) => entry.directory), ...workspace.problems.map((problem) => problem.directory)]);
+	const unlistedByKinds = {
+		links: [],
+		unreadable: [],
+		dotDirectories: []
+	};
+	for (const kind of Object.values(config.kinds)) for (const pattern of kind.packages) for (const directory of directoriesMatching(workspace.root, pattern, unlistedByKinds)) if (!members.has(directory) && existsSync(nodePath.join(workspace.root, directory, "package.json"))) {
+		members.add(directory);
+		findings.push({
+			rule: "package-outside-workspace",
+			file: `${directory}/package.json`,
+			...at,
+			message: `${directory} is a package a kind names, but the root package.json's workspaces leave it out, so nothing in it is checked`,
+			target: directory
+		});
+	}
+	findings.push(...directoriesWithoutPackage(engine, members, unlistedByKinds));
+	for (const entry of workspace.packages) {
+		const manifest = `${entry.directory}/package.json`;
+		if (engine.kindOf(entry) === void 0) {
+			findings.push({
+				rule: "package-without-kind",
+				file: manifest,
+				...at,
+				message: `${entry.name} matches no kind: add its directory to one`,
+				target: entry.name
+			});
+			continue;
+		}
+		const kindRule = config.kinds[engine.kindOf(entry) ?? ""];
+		const extra = config.packages[entry.name]?.externals ?? [];
+		for (const field of config.imports.shippedFields) for (const name of entry.manifest[field]) {
+			const outside = !workspace.byName.has(name) && !config.workspaceScopes.some((scope) => name.startsWith(scope));
+			const installed = entry.aliases.get(name) ?? name;
+			if (outside && kindRule !== void 0 && kindRule.externals !== "any" && !kindRule.externals.includes(installed) && !extra.includes(installed)) findings.push({
+				rule: "forbidden-external",
+				file: manifest,
+				...at,
+				message: `${field} names ${installed === name ? name : `${name} (${installed})`}, which its kind does not allow`,
+				target: installed
+			});
+		}
+		for (const field of config.imports.manifestEdgeFields) for (const name of entry.manifest[field]) {
+			const to = workspace.byName.get(name);
+			if (to === void 0) {
+				if (config.workspaceScopes.some((scope) => name.startsWith(scope))) findings.push({
+					rule: "unknown-workspace-package",
+					file: manifest,
+					...at,
+					message: `${field} names ${name}, which is not a workspace package`,
+					target: name
+				});
+				continue;
+			}
+			const refusal = edgeRefusal(engine, entry, to, true);
+			if (refusal !== void 0 && to.name !== entry.name) findings.push({
+				rule: refusal.rule,
+				file: manifest,
+				...at,
+				message: `${field}: ${refusal.why}`,
+				target: name
+			});
+		}
+	}
+	findings.push(...packageCycles(engine));
+	return findings;
+};
+const isDirectory = (absolute) => {
+	try {
+		return statSync(absolute).isDirectory();
+	} catch {
+		return false;
+	}
+};
+/** Whether `absolute`, links followed, is something other than a directory; false when nothing is there. */
+const isFile = (absolute) => {
+	try {
+		return !statSync(absolute).isDirectory();
+	} catch {
+		return false;
+	}
+};
+/**
+* What the root's `workspaces` globs (and a kind's globs) match that is no package: a directory without a
+* `package.json`, whose files no package owns and so nothing checks (only the topmost of nested ones); a dot directory,
+* which no workspaces glob matches; a directory the globs cannot list; and a symbolic link to a directory (or to
+* nothing), which is never followed. Inside a member the walk reports these, so they are left to it. A directory above a member (under `packages/**`), one a negated glob or `ignore` leaves out, and
+* anything under `node_modules` or `.git` are not reported.
+*/
+const directoriesWithoutPackage = (engine, members, unlistedByKinds) => {
+	const { workspace } = engine;
+	const negated = workspace.globs.filter((glob) => glob.startsWith("!")).map((glob) => glob.slice(1).replace(/^\.\//u, "").replace(/\/$/u, ""));
+	const inside = (path) => [...members].some((member) => path === member || path.startsWith(`${member}/`));
+	const above = (path) => [...members].some((member) => member.startsWith(`${path}/`));
+	const leftOut = (path) => path.split("/").some(passedOver) || negated.some((pattern) => matchesGlob(path, pattern) || coversDirectory(pattern, path)) || ignoresDirectory(engine, path);
+	const candidates = /* @__PURE__ */ new Map();
+	const unlisted = {
+		links: [...unlistedByKinds.links],
+		unreadable: [...unlistedByKinds.unreadable],
+		dotDirectories: []
+	};
+	for (const glob of workspace.globs.filter((pattern) => !pattern.startsWith("!"))) for (const directory of directoriesMatching(workspace.root, glob, unlisted)) if (!candidates.has(directory)) candidates.set(directory, glob);
+	const withoutPackage = (directory, glob) => {
+		if (above(directory) || !isDirectory(nodePath.join(workspace.root, directory))) return;
+		const listed = attempt(() => readdirSync(nodePath.join(workspace.root, directory)));
+		if (!listed.ok) return vanished(listed.error) ? void 0 : unreadablePathFinding(directory, codeOf(listed.error));
+		return {
+			rule: "directory-without-package",
+			file: directory,
+			line: 1,
+			column: 0,
+			message: `${directory} matches the workspaces glob ${glob} but has no package.json, so no package owns what it holds and nothing in it is checked: make it a package, remove it, or add ${directory}/** to ignore`,
+			target: directory
+		};
+	};
+	const dotDirectory = (directory) => ({
+		rule: "directory-without-package",
+		file: directory,
+		line: 1,
+		column: 0,
+		message: `${directory} is a dot directory, which workspaces globs never match, so it is no package${existsSync(nodePath.join(workspace.root, directory, "package.json")) ? " though it has a package.json" : ""} and nothing in it is checked: rename it, list it in workspaces by its full path, remove it, or add ${directory}/** to ignore`,
+		target: directory
+	});
+	const pending = [
+		...unlisted.unreadable.map(({ directory, code }) => ({
+			path: directory,
+			finding: () => unreadablePathFinding(directory, code)
+		})),
+		...[...candidates].map(([directory, glob]) => ({
+			path: directory,
+			finding: () => withoutPackage(directory, glob)
+		})),
+		...unlisted.dotDirectories.map((directory) => ({
+			path: directory,
+			finding: () => dotDirectory(directory)
+		})),
+		...unlisted.links.map((link) => ({
+			path: link,
+			finding: () => {
+				const destination = isFile(nodePath.join(workspace.root, link)) ? void 0 : linkDestination(nodePath.join(workspace.root, link));
+				return destination === void 0 ? void 0 : symbolicLinkFinding(link, destination);
+			}
+		}))
+	].toSorted((left, right) => left.path.split("/").length - right.path.split("/").length || left.path.localeCompare(right.path));
+	const findings = /* @__PURE__ */ new Map();
+	for (const { path, finding } of pending) {
+		const reportedAbove = [...findings.keys()].some((reported) => path.startsWith(`${reported}/`));
+		if (findings.has(path) || inside(path) || leftOut(path) || reportedAbove) continue;
+		const made = finding();
+		if (made !== void 0) findings.set(path, made);
+	}
+	return [...findings.values()].toSorted((left, right) => left.file.localeCompare(right.file));
+};
+/**
+* Tarjan's strongly connected components, iterative so that a long chain of packages cannot exhaust the stack. The
+* search starts from `roots` in order and follows each node's `successors` in order, so components and routes are
+* deterministic.
+*/
+const stronglyConnectedComponents = (roots, successors) => {
+	const index = /* @__PURE__ */ new Map();
+	const lowLink = /* @__PURE__ */ new Map();
+	const stack = [];
+	const onStack = /* @__PURE__ */ new Set();
+	const frames = [];
+	const pathPosition = /* @__PURE__ */ new Map();
+	const components = [];
+	const routes = [];
+	const enter = (name) => {
+		const order = index.size;
+		index.set(name, order);
+		lowLink.set(name, order);
+		stack.push(name);
+		onStack.add(name);
+		pathPosition.set(name, frames.length);
+		frames.push({
+			name,
+			next: 0
+		});
+	};
+	for (const root of roots) {
+		if (index.has(root)) continue;
+		enter(root);
+		for (let frame = frames.at(-1); frame !== void 0; frame = frames.at(-1)) {
+			const target = (successors.get(frame.name) ?? [])[frame.next];
+			if (target !== void 0) {
+				frame.next += 1;
+				if (!index.has(target)) enter(target);
+				else if (onStack.has(target)) {
+					lowLink.set(frame.name, Math.min(lowLink.get(frame.name) ?? 0, index.get(target) ?? 0));
+					const position = pathPosition.get(target);
+					if (position !== void 0) routes.push([...frames.slice(position).map((onPath) => onPath.name), target]);
+				}
+				continue;
+			}
+			frames.pop();
+			pathPosition.delete(frame.name);
+			const link = lowLink.get(frame.name) ?? 0;
+			if (link === index.get(frame.name)) {
+				const component = [];
+				for (let member = stack.pop(); member !== void 0; member = member === frame.name ? void 0 : stack.pop()) {
+					onStack.delete(member);
+					component.push(member);
+				}
+				components.push(component);
+			}
+			const parent = frames.at(-1);
+			if (parent !== void 0) lowLink.set(parent.name, Math.min(lowLink.get(parent.name) ?? 0, link));
+		}
+	}
+	return {
+		components,
+		routes
+	};
+};
+/**
+* Cycles between workspace packages through their runtime dependency fields. Every route the search closes is a
+* finding, once per set of packages, starting at the package the search reached first; so a component with several
+* cycles can have several findings.
+*/
+const packageCycles = (engine) => {
+	const { workspace } = engine;
+	const edges = new Map(workspace.packages.map((entry) => [entry.name, [...new Set(runtimeFields.flatMap((field) => entry.manifest[field]))].filter((name) => workspace.byName.has(name) && name !== entry.name)]));
+	const findings = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const cycle of stronglyConnectedComponents([...edges.keys()].toSorted(), edges).routes) {
+		const key = cycle.slice(0, -1).toSorted().join(" ");
+		if (!seen.has(key)) {
+			seen.add(key);
+			const first = cycle[0] ?? "";
+			findings.push({
+				rule: "package-cycle",
+				file: `${workspace.byName.get(first)?.directory ?? first}/package.json`,
+				line: 1,
+				column: 0,
+				message: `dependency cycle: ${cycle.join(" -> ")}`,
+				target: key
+			});
+		}
+	}
+	return findings;
+};
+/** Baseline entries that no finding in `findings` needs; each is a finding of its own, so the baseline only shrinks. */
+const staleBaseline = (engine, findings) => engine.config.baseline.filter((entry) => !findings.some((finding) => baselineCovers(entry, finding))).map((entry) => ({
+	rule: "stale-baseline",
+	file: entry.file,
+	line: 1,
+	column: 0,
+	message: `the baseline entry for ${entry.rule}${entry.target === void 0 ? "" : ` (${entry.target})`} is no longer needed: remove it`,
+	target: entry.rule
+}));
+// src/check.ts
+/** The whole check: every source file of the workspace through the engine, plus the whole-graph checks and the baseline. */
+/**
+* Every source file the engine reads, found by walking each package's directory (skipping `node_modules` and `.git`;
+* other dot directories hold sources too). A walk rather than `git ls-files`: generated and gitignored sources still
+* ship, and a nested repository or submodule inside a package is still part of it. A symbolic link is never followed:
+* every one is a finding, whatever it points at, unless it lies in a directory the check skips on purpose; and so is a
+* directory the walk cannot list. A path removed between being listed and being read is skipped, with no finding.
+*/
+const walkSources = (engine) => {
+	const files = /* @__PURE__ */ new Set();
+	const findings = /* @__PURE__ */ new Map();
+	const { root } = engine.workspace;
+	const walk = (relative) => {
+		let entries;
+		try {
+			entries = readdirSync(nodePath.join(root, relative), { withFileTypes: true });
+		} catch (cause) {
+			if (!vanished(cause) && !skipsDirectory(engine, relative)) findings.set(relative, unreadablePathFinding(relative, codeOf(cause)));
+			return;
+		}
+		for (const entry of entries) {
+			const path = `${relative}/${entry.name}`;
+			if (entry.isDirectory()) {
+				if (!passedOver(entry.name)) walk(path);
+			} else if (entry.isSymbolicLink()) {
+				const destination = reportsLink(engine, path) ? linkDestination(nodePath.join(root, path)) : void 0;
+				if (destination !== void 0) findings.set(path, symbolicLinkFinding(path, destination));
+			} else if (entry.isFile() && reads(engine, path)) files.add(path);
+		}
+	};
+	for (const entry of engine.workspace.packages) walk(entry.directory);
+	return {
+		files: [...files].toSorted(),
+		findings: [...findings.values()].toSorted((left, right) => left.file.localeCompare(right.file))
+	};
+};
+/** The source files `walkSources` finds. */
+const listSourceFiles = (engine) => [...walkSources(engine).files];
+const checkWorkspace = (root, config) => {
+	const engine = createEngine(root, config);
+	const { files, findings: walked } = walkSources(engine);
+	const perFile = [];
+	let checked = 0;
+	for (const file of files) {
+		const text = attempt(() => readFileSync(nodePath.join(root, file), "utf8"));
+		if (text.ok) {
+			checked += 1;
+			perFile.push(...findingsForFile(engine, file, text.value));
+		} else if (!vanished(text.error)) {
+			checked += 1;
+			perFile.push(unreadablePathFinding(file, codeOf(text.error), "file"));
+		}
+	}
+	const all = [
+		...walked,
+		...perFile.filter((finding) => finding.rule !== "package-without-kind"),
+		...graphFindings(engine)
+	];
+	return {
+		files: checked,
+		findings: [...withoutBaselined(engine, all), ...staleBaseline(engine, all)]
+	};
+};
+const formatFinding = (finding) => `${finding.file}:${finding.line}:${finding.column + 1} ${finding.rule}: ${finding.message}`;
+export { graphFindings as a, walkSources as i, formatFinding as n, staleBaseline as o, listSourceFiles as r, checkWorkspace as t };

package/dist/cli.d.mts

@@ -1,2 +1,2 @@
-import { n as Config } from "./config-DO_LRXM8.mjs";
+import { n as Config } from "./config-CmWm5RyK.mjs";
 export declare const loadConfig: (path: string) => Promise<Config>;

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { d as findWorkspaceRoot } from "./engine-Dc5tRuHT.mjs";
-import { n as formatFinding, t as checkWorkspace } from "./check-F4cLmfYv.mjs";
+import { y as findWorkspaceRoot } from "./engine-CwR59HVO.mjs";
+import { n as formatFinding, t as checkWorkspace } from "./check-CWi8LUnB.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import nodePath from "node:path";
 import process from "node:process";

package/dist/{config-DO_LRXM8.d.mts → config-CmWm5RyK.d.mts}

@@ -33,7 +33,7 @@ interface FileClass {
   readonly files: readonly string[];
   readonly policy: FilePolicy;
 }
-declare const ruleNames: readonly ["unknown-workspace-package", "package-without-kind", "package-outside-workspace", "invalid-package", "forbidden-edge", "type-only-edge", "relative-import-leaves-package", "package-path-escape", "shipped-imports-development-file", "self-import-by-name", "forbidden-external", "runtime-module", "test-only-in-shipped", "undeclared-import", "computed-import", "unresolved-import", "package-cycle", "stale-baseline", "parse-error"];
+declare const ruleNames: readonly ["unknown-workspace-package", "package-without-kind", "package-outside-workspace", "directory-without-package", "invalid-package", "symbolic-link", "unreadable-path", "forbidden-edge", "type-only-edge", "relative-import-leaves-package", "package-path-escape", "shipped-imports-development-file", "self-import-by-name", "forbidden-external", "runtime-module", "test-only-in-shipped", "undeclared-import", "computed-import", "unresolved-import", "package-cycle", "stale-baseline", "parse-error"];
 type RuleName = (typeof ruleNames)[number];
 /** A finding the repository tolerates for now. The check fails when no finding needs it any more, so the list shrinks. */
 interface BaselineEntry {

package/dist/{engine-Dc5tRuHT.mjs → engine-CwR59HVO.mjs}

@@ -1,5 +1,5 @@
 import { builtinModules } from "node:module";
-import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, realpathSync, statSync } from "node:fs";
 import nodePath from "node:path";
 import * as v from "valibot";
 import { ResolverFactory } from "oxc-resolver";
@@ -9,7 +9,10 @@ const ruleNames = [
 	"unknown-workspace-package",
 	"package-without-kind",
 	"package-outside-workspace",
+	"directory-without-package",
 	"invalid-package",
+	"symbolic-link",
+	"unreadable-path",
 	"forbidden-edge",
 	"type-only-edge",
 	"relative-import-leaves-package",
@@ -41,8 +44,22 @@ const defaultFileClasses = [{
 	],
 	policy: "development"
 }];
-/** Build output and coverage reports under a package, never read unless `output` says otherwise. */
-const defaultOutput = ["dist/**", "coverage/**"];
+/**
+* Build output, coverage reports and the caches tools write under a package root (generated, never written by hand),
+* never read unless `output` says otherwise. Shipped code that imports from them is still judged.
+*/
+const defaultOutput = [
+	"dist/**",
+	"coverage/**",
+	".wrangler/**",
+	".astro/**",
+	".svelte-kit/**",
+	".next/**",
+	".turbo/**",
+	".vercel/**",
+	".nuxt/**",
+	".output/**"
+];
 const allManifestFields = [
 	"dependencies",
 	"devDependencies",
@@ -520,6 +537,17 @@ const attempt = (operation) => {
 };
 /** The message of something thrown, which need not be an Error. */
 const messageOf = (cause) => cause instanceof Error ? cause.message : String(cause);
+/**
+* Whether something thrown by `node:fs` says the path is no longer there: `ENOENT`, or `ENOTDIR` when a directory on the
+* way was replaced by a file. A path removed between being listed and being read (a test's temporary tree, an editor's
+* swap file) fails this way, and is skipped rather than reported as unreadable.
+*/
+const vanished = (cause) => {
+	const code = codeOf(cause);
+	return code === "ENOENT" || code === "ENOTDIR";
+};
+/** The error code of something thrown by `node:fs` (`EACCES`), or its message when it has none. */
+const codeOf = (cause) => typeof cause === "object" && cause !== null && "code" in cause && typeof cause.code === "string" ? cause.code : messageOf(cause);
 // src/workspace.ts
 /**
 * The workspace as `package.json` files declare it: the root's `workspaces` globs, and each package's real name (never
@@ -527,12 +555,36 @@ const messageOf = (cause) => cause instanceof Error ? cause.message : String(cau
 */
 /** The manifest at `path`, or why it cannot be read. */
 const readManifest = (path) => {
-	const parsed = attempt(() => JSON.parse(readFileSync(path, "utf8")));
-	if (!parsed.ok) return failure(`${path}: ${messageOf(parsed.error)}`);
-	if (typeof parsed.value !== "object" || parsed.value === null) return failure(`${path} is not a JSON object`);
+	const text = attempt(() => readFileSync(path, "utf8"));
+	if (!text.ok) return failure({
+		message: `${path}: ${messageOf(text.error)}`,
+		vanished: vanished(text.error)
+	});
+	const parsed = attempt(() => JSON.parse(text.value));
+	if (!parsed.ok) return failure({
+		message: `${path}: ${messageOf(parsed.error)}`,
+		vanished: false
+	});
+	if (typeof parsed.value !== "object" || parsed.value === null) return failure({
+		message: `${path} is not a JSON object`,
+		vanished: false
+	});
 	return success(parsed.value);
 };
-const namesOf = (field) => typeof field === "object" && field !== null && !Array.isArray(field) ? Object.keys(field).toSorted() : [];
+/** Whether a dependency field has the shape npm and Bun require: an object of package names to version ranges. */
+const isRecord = (field) => typeof field === "object" && field !== null && !Array.isArray(field);
+const namesOf = (field) => isRecord(field) ? Object.keys(field).toSorted() : [];
+/**
+* A message for each dependency field of `manifest` that is present and not an object (`"dependencies": "x"`, a list, a
+* number, null). Such a field declares nothing the check can read, so without a finding its edges would pass unseen.
+*/
+const malformedFields = (manifest) => allManifestFields.filter((field) => manifest[field] !== void 0 && !isRecord(manifest[field])).map((field) => {
+	const value = manifest[field];
+	return {
+		field,
+		message: `${field} is ${value === null ? "null" : Array.isArray(value) ? "a list" : `a ${typeof value}`}, not an object of package names to version ranges, so no dependency in it is read`
+	};
+});
 const fieldsOf = (manifest) => ({
 	dependencies: namesOf(manifest.dependencies),
 	devDependencies: namesOf(manifest.devDependencies),
@@ -547,7 +599,7 @@ const aliasesOf = (manifest) => {
 		manifest.devDependencies,
 		manifest.optionalDependencies,
 		manifest.peerDependencies
-	]) if (typeof field === "object" && field !== null && !Array.isArray(field)) for (const [name, spec] of Object.entries(field)) {
+	]) if (isRecord(field)) for (const [name, spec] of Object.entries(field)) {
 		const target = typeof spec === "string" ? /^npm:(?<target>@?[^@]+)/u.exec(spec)?.groups?.target : void 0;
 		if (target !== void 0) aliases.set(name, target);
 	}
@@ -589,7 +641,21 @@ const findWorkspaceRoot = (start) => {
 		if (nodePath.dirname(candidate) === candidate) return root ?? nearest;
 	}
 };
-const directoriesMatching = (root, pattern) => {
+/** The first of `path`'s directories (repository-relative), itself included, that is a symbolic link. */
+const linkAlong = (root, path) => {
+	const parts = path === "" ? [] : path.split("/");
+	return parts.map((_, index) => parts.slice(0, index + 1).join("/")).find((prefix) => {
+		const status = attempt(() => lstatSync(nodePath.join(root, prefix)));
+		return status.ok && status.value.isSymbolicLink();
+	});
+};
+/**
+* The directories under `root` that `pattern` matches, skipping `node_modules` and dot directories, as npm and Bun
+* workspaces do. A symbolic link is never followed, not even one the pattern names literally or passes through (a
+* `packages` that is a link), and a directory that cannot be listed is passed over; with `unlisted`, those and the dot
+* directories the pattern would match are collected there, so the caller can report them.
+*/
+const directoriesMatching = (root, pattern, unlisted) => {
 	const clean = (pattern.startsWith("!") ? pattern.slice(1) : pattern).replace(/^\.\//u, "").replace(/\/$/u, "");
 	const fixed = [];
 	for (const segment of clean.split("/")) {
@@ -602,16 +668,34 @@ const directoriesMatching = (root, pattern) => {
 	const walk = (relative, depth) => {
 		if (matchesGlob(relative, clean)) found.push(relative);
 		if (depth >= depthLimit) return;
-		const absolute = nodePath.join(root, relative);
-		for (const entry of readdirSync(absolute, { withFileTypes: true })) if (entry.isDirectory() && entry.name !== "node_modules" && !entry.name.startsWith(".")) walk(relative === "" ? entry.name : `${relative}/${entry.name}`, depth + 1);
+		const listed = attempt(() => readdirSync(nodePath.join(root, relative), { withFileTypes: true }));
+		if (!listed.ok) {
+			if (!vanished(listed.error)) unlisted?.unreadable.push({
+				directory: relative,
+				code: codeOf(listed.error)
+			});
+			return;
+		}
+		for (const entry of listed.value) {
+			const path = relative === "" ? entry.name : `${relative}/${entry.name}`;
+			if (entry.isDirectory() && entry.name !== "node_modules" && !entry.name.startsWith(".")) walk(path, depth + 1);
+			else if (entry.isDirectory() && entry.name.startsWith(".") && entry.name !== ".git" && matchesGlob(path, clean)) unlisted?.dotDirectories.push(path);
+			else if (entry.isSymbolicLink() && matchesGlob(path, clean)) unlisted?.links.push(path);
+		}
 	};
+	const link = linkAlong(root, base);
+	if (link !== void 0) {
+		unlisted?.links.push(link);
+		return [];
+	}
 	if (base === clean) return existsSync(nodePath.join(root, base)) ? [base] : [];
-	if (existsSync(nodePath.join(root, base)) && statSync(nodePath.join(root, base)).isDirectory()) walk(base, base === "" ? 0 : base.split("/").length);
+	const status = attempt(() => statSync(nodePath.join(root, base)));
+	if (status.ok && status.value.isDirectory()) walk(base, base === "" ? 0 : base.split("/").length);
 	return found;
 };
 const loadWorkspace = (root) => {
 	const rootRead = readManifest(nodePath.join(root, "package.json"));
-	if (!rootRead.ok) throw new Error(rootRead.error);
+	if (!rootRead.ok) throw new Error(rootRead.error.message);
 	const rootManifest = rootRead.value;
 	const globs = workspaceGlobs(rootManifest) ?? [];
 	const directories = /* @__PURE__ */ new Set();
@@ -622,10 +706,11 @@ const loadWorkspace = (root) => {
 	const byName = /* @__PURE__ */ new Map();
 	for (const directory of [...directories].toSorted()) {
 		const read = readManifest(nodePath.join(root, directory, "package.json"));
+		if (!read.ok && read.error.vanished) continue;
 		if (!read.ok) {
 			problems.push({
 				directory,
-				message: `package.json cannot be read: ${read.error}`
+				message: `package.json cannot be read: ${read.error.message}`
 			});
 			continue;
 		}
@@ -645,6 +730,11 @@ const loadWorkspace = (root) => {
 			});
 			continue;
 		}
+		for (const { field, message } of malformedFields(manifest)) problems.push({
+			directory,
+			message,
+			field
+		});
 		const entry = {
 			name: manifest.name,
 			directory,
@@ -659,7 +749,8 @@ const loadWorkspace = (root) => {
 		packages,
 		byName,
 		rootManifest: fieldsOf(rootManifest),
-		problems
+		problems,
+		globs
 	};
 };
 /** The package whose directory holds the repository-relative `file`, the deepest one when packages nest. */
@@ -1120,6 +1211,97 @@ const reads = (engine, file) => {
 	const owner = packageOfFile(engine.workspace, file);
 	return owner !== void 0 && !matchesAny(file.slice(owner.directory.length + 1), engine.config.output);
 };
+/** Whether `glob` matches every path under `directory`: it is `**`, or it or a directory above it matches what comes before a trailing `/**`. */
+const coversDirectory = (glob, directory) => {
+	if (glob === "**") return true;
+	if (!glob.endsWith("/**") || directory === "") return false;
+	const parts = directory.split("/");
+	return parts.some((_, index) => matchesGlob(parts.slice(0, index + 1).join("/"), glob.slice(0, -3)));
+};
+/**
+* Whether `glob` might match a path under `directory`: its leading segments agree with the directory's until a `**`,
+* and it is longer than the directory. A glob with braces is taken to match, so a doubt counts as a match.
+*/
+const mayMatchUnder = (glob, directory) => {
+	if (glob.includes("{")) return true;
+	const globParts = glob.split("/");
+	const directoryParts = directory === "" ? [] : directory.split("/");
+	for (const [index, part] of directoryParts.entries()) {
+		const globPart = globParts[index];
+		if (globPart === void 0) return false;
+		if (globPart === "**") return true;
+		if (!matchesGlob(part, globPart)) return false;
+	}
+	return globParts.length > directoryParts.length;
+};
+/** Whether an `ignore` glob covers every file under the repository-relative `directory`. */
+const ignoresDirectory = (engine, directory) => engine.config.ignore.some((glob) => coversDirectory(glob, directory));
+/**
+* Whether the check reads no file under the repository-relative `directory`, so a symbolic link or an unreadable
+* directory there hides nothing: an `ignore` glob covers it, or (relative to the package that owns it) an `output` glob
+* or an unchecked file class does, with no earlier class that might match a file in it. A glob covers a directory only
+* through a trailing `/**`; any doubt counts as read, so the answer errs towards a finding.
+*/
+const skipsDirectory = (engine, directory) => {
+	const { config } = engine;
+	if (ignoresDirectory(engine, directory)) return true;
+	const owner = packageOfFile(engine.workspace, `${directory}/`);
+	if (owner === void 0) return true;
+	const relative = directory.slice(owner.directory.length + 1);
+	if (config.output.some((glob) => coversDirectory(glob, relative))) return true;
+	for (const fileClass of config.fileClasses) {
+		if (fileClass.files.some((glob) => coversDirectory(glob, relative))) return fileClass.policy === "unchecked";
+		if (fileClass.policy !== "unchecked" && fileClass.files.some((glob) => mayMatchUnder(glob, relative))) return false;
+	}
+	return false;
+};
+/** Directories the walk never enters, wherever they are: dependencies and git's own data. */
+const passedOver = (name) => name === "node_modules" || name === ".git";
+/**
+* Whether a symbolic link at the repository-relative `path` is a finding: always, whatever it points at, unless it lies
+* in (or is) a directory the check skips on purpose (`node_modules`, `.git`, or one `skipsDirectory` covers).
+*/
+const reportsLink = (engine, path) => !path.split("/").some(passedOver) && !skipsDirectory(engine, path);
+/** A symbolic link the check met and did not follow, at `path` (repository-relative), with the destination it names. */
+const symbolicLinkFinding = (path, destination) => ({
+	rule: "symbolic-link",
+	file: path,
+	line: 1,
+	column: 0,
+	message: `${path} is a symbolic link to ${destination}, which the check never follows, so what it reaches goes unchecked: replace it with the files themselves, or baseline it`,
+	target: destination
+});
+/** A directory the check needed to list, or a source file it needed to read, and could not, with the error code that said why. */
+const unreadablePathFinding = (path, code, kind = "directory") => ({
+	rule: "unreadable-path",
+	file: path,
+	line: 1,
+	column: 0,
+	message: kind === "directory" ? `${path} cannot be read (${code}), so the files in it cannot be checked: make it readable, or add ${path}/** to ignore` : `${path} cannot be read (${code}), so its imports cannot be checked: make it readable, or add it to ignore`,
+	target: path
+});
+/** The destination a symbolic link names, as written, or undefined when the link has been removed since it was seen. */
+const linkDestination = (absolute) => {
+	const destination = attempt(() => readlinkSync(absolute));
+	if (destination.ok) return destination.value;
+	return vanished(destination.error) ? void 0 : "an unreadable destination";
+};
+/**
+* The first symbolic link on the way from `owner`'s directory down to `file` (both repository-relative), the file
+* itself included. The CLI's walk never follows one, but oxlint does, and lints the files behind it under the link's
+* path.
+*/
+const linkOnPath = (engine, owner, file) => {
+	const parts = file.slice(owner.directory.length + 1).split("/");
+	for (const [index] of parts.entries()) {
+		const path = [owner.directory, ...parts.slice(0, index + 1)].join("/");
+		try {
+			if (lstatSync(nodePath.join(engine.workspace.root, path)).isSymbolicLink()) return path;
+		} catch {
+			return;
+		}
+	}
+};
 /** The rules that hold for shipped code and not for development files. */
 const shippedOnlyRules = /* @__PURE__ */ new Set([
 	"runtime-module",
@@ -1160,7 +1342,13 @@ const developmentFileBreaks = (engine, file) => {
 		const directory = nodePath.dirname(next);
 		read.set(directory, modifiedTime(nodePath.join(engine.workspace.root, directory)) ?? -1);
 		const reached = [];
-		const finding = findingsForFile(engine, next, readFileSync(absolute, "utf8"), { developmentImports: reached }).find((candidate) => shippedOnlyRules.has(candidate.rule));
+		const text = attempt(() => readFileSync(absolute, "utf8"));
+		if (!text.ok && vanished(text.error)) continue;
+		if (!text.ok) {
+			breaks = `${next} cannot be read (${codeOf(text.error)}), so it cannot be judged`;
+			break;
+		}
+		const finding = findingsForFile(engine, next, text.value, { developmentImports: reached }).find((candidate) => shippedOnlyRules.has(candidate.rule));
 		if (finding !== void 0) breaks = `${next === file ? "" : `through ${next}, `}${finding.rule} at line ${finding.line}: ${finding.message}`;
 		queue.push(...reached);
 	}
@@ -1180,7 +1368,13 @@ const findingsForFile = (engine, file, text, options = {}) => {
 	const asShipped = developmentImports !== void 0;
 	const { config, workspace } = engine;
 	const owner = packageOfFile(workspace, file);
-	if (owner === void 0 || !sourceFile.test(file) || !reads(engine, file) && developmentImports === void 0) return [];
+	if (owner === void 0 || !sourceFile.test(file)) return [];
+	const link = linkOnPath(engine, owner, file);
+	if (link !== void 0) {
+		const destination = reportsLink(engine, link) ? linkDestination(nodePath.join(workspace.root, link)) : void 0;
+		return destination === void 0 ? [] : [symbolicLinkFinding(link, destination)];
+	}
+	if (!reads(engine, file) && developmentImports === void 0) return [];
 	const packageRelative = file.slice(owner.directory.length + 1);
 	const classified = effectivePolicy(engine, owner, packageRelative);
 	const policy = asShipped ? "shipped" : classified;
@@ -1311,4 +1505,4 @@ const findingsForFile = (engine, file, text, options = {}) => {
 const baselineCovers = (entry, finding) => entry.file === finding.file && entry.rule === finding.rule && entry.target === finding.target;
 /** `findings` less those the baseline covers. */
 const withoutBaselined = (engine, findings) => findings.filter((finding) => !engine.config.baseline.some((entry) => baselineCovers(entry, finding)));
-export { resolveConfig as S, matchesAny as _, findingsForFile as a, defaultFileClasses as b, withoutBaselined as c, findWorkspaceRoot as d, loadWorkspace as f, failure as g, attempt as h, effectivePolicy as i, importForms as l, packageOfFile as m, createEngine as n, policyOf as o, packageNameOf as p, edgeRefusal as r, reads as s, baselineCovers as t, directoriesMatching as u, matchesGlob as v, defineConfig as x, configProblems as y };
+export { defaultFileClasses as A, attempt as C, matchesAny as D, vanished as E, resolveConfig as M, matchesGlob as O, packageOfFile as S, failure as T, importForms as _, effectivePolicy as a, loadWorkspace as b, linkDestination as c, reads as d, reportsLink as f, withoutBaselined as g, unreadablePathFinding as h, edgeRefusal as i, defineConfig as j, configProblems as k, passedOver as l, symbolicLinkFinding as m, coversDirectory as n, findingsForFile as o, skipsDirectory as p, createEngine as r, ignoresDirectory as s, baselineCovers as t, policyOf as u, directoriesMatching as v, codeOf as w, packageNameOf as x, findWorkspaceRoot as y };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as ImportPolicy, c as PackageRule, d as configProblems, f as defaultFileClasses, i as FilePolicy, l as ResolvedConfig, m as resolveConfig, n as Config, o as KindRule, p as defineConfig, r as FileClass, s as ManifestField, t as BaselineEntry, u as RuleName } from "./config-DO_LRXM8.mjs";
+import { a as ImportPolicy, c as PackageRule, d as configProblems, f as defaultFileClasses, i as FilePolicy, l as ResolvedConfig, m as resolveConfig, n as Config, o as KindRule, p as defineConfig, r as FileClass, s as ManifestField, t as BaselineEntry, u as RuleName } from "./config-CmWm5RyK.mjs";
 interface WorkspacePackage {
   readonly name: string;
   /** Repository-relative directory, `/`-separated (`libraries/parcel`). */
@@ -14,11 +14,18 @@ interface Workspace {
   readonly byName: ReadonlyMap<string, WorkspacePackage>;
   /** The root package's own dependency fields. */
   readonly rootManifest: Readonly<Record<ManifestField, readonly string[]>>;
-  /** Members that cannot be checked: no name, a name another member has, an unreadable package.json. */
+  /**
+   * Members whose package.json is wrong. With no name, a name another member has, or a package.json that cannot be read,
+   * the member cannot be checked and is not in `packages`; with a dependency field that is not an object, it is, as if
+   * that field declared nothing, and `field` names it.
+   */
   readonly problems: readonly {
     readonly directory: string;
     readonly message: string;
+    readonly field?: ManifestField;
   }[];
+  /** The root package.json's `workspaces` globs, negations (`!apps/old`) included. */
+  readonly globs: readonly string[];
 }
 /**
  * The workspace root for a file in `start`. The nearest directory whose `package.json` `workspaces` hold `start` is a
@@ -125,11 +132,21 @@ export declare const findingsForFile: (engine: Engine, file: string, text: strin
 }) => Finding[];
 /** `findings` less those the baseline covers. */
 export declare const withoutBaselined: (engine: Engine, findings: readonly Finding[]) => Finding[];
+/** The source files of the workspace's packages, and what kept the walk from seeing all of them. */
+interface SourceWalk {
+  readonly files: readonly string[];
+  /** A `symbolic-link` finding for each link outside the directories it skips, an `unreadable-path` one for each directory it could not list. */
+  readonly findings: readonly Finding[];
+}
 /**
- * Every source file the engine reads, found by walking each package's directory (skipping `node_modules` and dot
- * directories). A walk rather than `git ls-files`: generated and gitignored sources still ship, and a nested repository
- * or submodule inside a package is still part of it.
+ * Every source file the engine reads, found by walking each package's directory (skipping `node_modules` and `.git`;
+ * other dot directories hold sources too). A walk rather than `git ls-files`: generated and gitignored sources still
+ * ship, and a nested repository or submodule inside a package is still part of it. A symbolic link is never followed:
+ * every one is a finding, whatever it points at, unless it lies in a directory the check skips on purpose; and so is a
+ * directory the walk cannot list. A path removed between being listed and being read is skipped, with no finding.
  */
+export declare const walkSources: (engine: Engine) => SourceWalk;
+/** The source files `walkSources` finds. */
 export declare const listSourceFiles: (engine: Engine) => string[];
 interface CheckResult {
   readonly files: number;
@@ -167,4 +184,4 @@ interface ImportForms {
   readonly parseErrors: readonly string[];
 }
 export declare const importForms: (path: string, source: string) => ImportForms;
-export { type BaselineEntry, type CheckResult, type ComputedSite, type Config, type Engine, type FileClass, type FilePolicy, type Finding, type ImportForms, type ImportPolicy, type ImportSite, type KindRule, type ManifestField, type PackageRule, type ResolvedConfig, type RuleName, type Workspace, type WorkspacePackage, configProblems, defaultFileClasses, defineConfig, resolveConfig };
+export { type BaselineEntry, type CheckResult, type ComputedSite, type Config, type Engine, type FileClass, type FilePolicy, type Finding, type ImportForms, type ImportPolicy, type ImportSite, type KindRule, type ManifestField, type PackageRule, type ResolvedConfig, type RuleName, type SourceWalk, type Workspace, type WorkspacePackage, configProblems, defaultFileClasses, defineConfig, resolveConfig };

package/dist/index.mjs

@@ -1,3 +1,3 @@
-import { S as resolveConfig, _ as matchesAny, a as findingsForFile, b as defaultFileClasses, c as withoutBaselined, d as findWorkspaceRoot, f as loadWorkspace, i as effectivePolicy, l as importForms, m as packageOfFile, n as createEngine, o as policyOf, p as packageNameOf, s as reads, v as matchesGlob, x as defineConfig, y as configProblems } from "./engine-Dc5tRuHT.mjs";
-import { a as staleBaseline, i as graphFindings, n as formatFinding, r as listSourceFiles, t as checkWorkspace } from "./check-F4cLmfYv.mjs";
-export { checkWorkspace, configProblems, createEngine, defaultFileClasses, defineConfig, effectivePolicy, findWorkspaceRoot, findingsForFile, formatFinding, graphFindings, importForms, listSourceFiles, loadWorkspace, matchesAny, matchesGlob, packageNameOf, packageOfFile, policyOf, reads, resolveConfig, staleBaseline, withoutBaselined };
+import { A as defaultFileClasses, D as matchesAny, M as resolveConfig, O as matchesGlob, S as packageOfFile, _ as importForms, a as effectivePolicy, b as loadWorkspace, d as reads, g as withoutBaselined, j as defineConfig, k as configProblems, o as findingsForFile, r as createEngine, u as policyOf, x as packageNameOf, y as findWorkspaceRoot } from "./engine-CwR59HVO.mjs";
+import { a as graphFindings, i as walkSources, n as formatFinding, o as staleBaseline, r as listSourceFiles, t as checkWorkspace } from "./check-CWi8LUnB.mjs";
+export { checkWorkspace, configProblems, createEngine, defaultFileClasses, defineConfig, effectivePolicy, findWorkspaceRoot, findingsForFile, formatFinding, graphFindings, importForms, listSourceFiles, loadWorkspace, matchesAny, matchesGlob, packageNameOf, packageOfFile, policyOf, reads, resolveConfig, staleBaseline, walkSources, withoutBaselined };

package/dist/plugin.mjs

@@ -1,4 +1,4 @@
-import { a as findingsForFile, c as withoutBaselined, d as findWorkspaceRoot, g as failure, h as attempt, n as createEngine } from "./engine-Dc5tRuHT.mjs";
+import { C as attempt, T as failure, g as withoutBaselined, o as findingsForFile, r as createEngine, y as findWorkspaceRoot } from "./engine-CwR59HVO.mjs";
 import { statSync } from "node:fs";
 import nodePath from "node:path";
 // src/plugin.ts
@@ -9,7 +9,9 @@ import nodePath from "node:path";
 *   jsPlugins: ["ox-dep-lint/plugin"],
 *   rules: { "dep-lint/imports": ["error", depLintConfig] }
 *
-* Whole-graph checks (package.json edges and externals, package cycles, stale baseline entries) need the CLI.
+* Whole-graph checks (package.json edges and externals, package cycles, directories no package owns, unreadable
+* directories, stale baseline entries) need the CLI. oxlint follows symbolic links, so a file it reaches through one is
+* reported as `symbolic-link` and not read further, as the CLI never reads it.
 */
 /** How often (milliseconds) a long-lived process (an editor's language server) looks for changed package.json files. */
 const recheckInterval = 1e3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ox-dep-lint",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Module dependency graph rules for oxlint: package kinds, outside packages, runtime and test-only modules, undeclared, escaping and computed imports",
   "license": "MIT",
   "author": "Philip B. Krogh",

package/dist/check-F4cLmfYv.mjs

@@ -1,223 +0,0 @@
-import { a as findingsForFile, c as withoutBaselined, n as createEngine, r as edgeRefusal, s as reads, t as baselineCovers, u as directoriesMatching } from "./engine-Dc5tRuHT.mjs";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import nodePath from "node:path";
-// src/graph.ts
-/**
-* Checks that need the whole workspace rather than one file: edges declared only in `package.json`, cycles between
-* packages, packages no kind holds, and baseline entries no finding needs any more. Only the CLI runs these, because an
-* oxlint plugin sees one file at a time and never sees `package.json`.
-*/
-const runtimeFields = [
-	"dependencies",
-	"optionalDependencies",
-	"peerDependencies"
-];
-const graphFindings = (engine) => {
-	const { config, workspace } = engine;
-	const findings = [];
-	const at = {
-		line: 1,
-		column: 0
-	};
-	for (const problem of workspace.problems) findings.push({
-		rule: "invalid-package",
-		file: `${problem.directory}/package.json`,
-		...at,
-		message: problem.message,
-		target: problem.directory
-	});
-	const members = /* @__PURE__ */ new Set([...workspace.packages.map((entry) => entry.directory), ...workspace.problems.map((problem) => problem.directory)]);
-	for (const kind of Object.values(config.kinds)) for (const pattern of kind.packages) for (const directory of directoriesMatching(workspace.root, pattern)) if (!members.has(directory) && existsSync(nodePath.join(workspace.root, directory, "package.json"))) {
-		members.add(directory);
-		findings.push({
-			rule: "package-outside-workspace",
-			file: `${directory}/package.json`,
-			...at,
-			message: `${directory} is a package a kind names, but the root package.json's workspaces leave it out, so nothing in it is checked`,
-			target: directory
-		});
-	}
-	for (const entry of workspace.packages) {
-		const manifest = `${entry.directory}/package.json`;
-		if (engine.kindOf(entry) === void 0) {
-			findings.push({
-				rule: "package-without-kind",
-				file: manifest,
-				...at,
-				message: `${entry.name} matches no kind: add its directory to one`,
-				target: entry.name
-			});
-			continue;
-		}
-		const kindRule = config.kinds[engine.kindOf(entry) ?? ""];
-		const extra = config.packages[entry.name]?.externals ?? [];
-		for (const field of config.imports.shippedFields) for (const name of entry.manifest[field]) {
-			const outside = !workspace.byName.has(name) && !config.workspaceScopes.some((scope) => name.startsWith(scope));
-			const installed = entry.aliases.get(name) ?? name;
-			if (outside && kindRule !== void 0 && kindRule.externals !== "any" && !kindRule.externals.includes(installed) && !extra.includes(installed)) findings.push({
-				rule: "forbidden-external",
-				file: manifest,
-				...at,
-				message: `${field} names ${installed === name ? name : `${name} (${installed})`}, which its kind does not allow`,
-				target: installed
-			});
-		}
-		for (const field of config.imports.manifestEdgeFields) for (const name of entry.manifest[field]) {
-			const to = workspace.byName.get(name);
-			if (to === void 0) {
-				if (config.workspaceScopes.some((scope) => name.startsWith(scope))) findings.push({
-					rule: "unknown-workspace-package",
-					file: manifest,
-					...at,
-					message: `${field} names ${name}, which is not a workspace package`,
-					target: name
-				});
-				continue;
-			}
-			const refusal = edgeRefusal(engine, entry, to, true);
-			if (refusal !== void 0 && to.name !== entry.name) findings.push({
-				rule: refusal.rule,
-				file: manifest,
-				...at,
-				message: `${field}: ${refusal.why}`,
-				target: name
-			});
-		}
-	}
-	findings.push(...packageCycles(engine));
-	return findings;
-};
-/**
-* Tarjan's strongly connected components, iterative so that a long chain of packages cannot exhaust the stack. The
-* search starts from `roots` in order and follows each node's `successors` in order, so components and routes are
-* deterministic.
-*/
-const stronglyConnectedComponents = (roots, successors) => {
-	const index = /* @__PURE__ */ new Map();
-	const lowLink = /* @__PURE__ */ new Map();
-	const stack = [];
-	const onStack = /* @__PURE__ */ new Set();
-	const frames = [];
-	const pathPosition = /* @__PURE__ */ new Map();
-	const components = [];
-	const routes = [];
-	const enter = (name) => {
-		const order = index.size;
-		index.set(name, order);
-		lowLink.set(name, order);
-		stack.push(name);
-		onStack.add(name);
-		pathPosition.set(name, frames.length);
-		frames.push({
-			name,
-			next: 0
-		});
-	};
-	for (const root of roots) {
-		if (index.has(root)) continue;
-		enter(root);
-		for (let frame = frames.at(-1); frame !== void 0; frame = frames.at(-1)) {
-			const target = (successors.get(frame.name) ?? [])[frame.next];
-			if (target !== void 0) {
-				frame.next += 1;
-				if (!index.has(target)) enter(target);
-				else if (onStack.has(target)) {
-					lowLink.set(frame.name, Math.min(lowLink.get(frame.name) ?? 0, index.get(target) ?? 0));
-					const position = pathPosition.get(target);
-					if (position !== void 0) routes.push([...frames.slice(position).map((onPath) => onPath.name), target]);
-				}
-				continue;
-			}
-			frames.pop();
-			pathPosition.delete(frame.name);
-			const link = lowLink.get(frame.name) ?? 0;
-			if (link === index.get(frame.name)) {
-				const component = [];
-				for (let member = stack.pop(); member !== void 0; member = member === frame.name ? void 0 : stack.pop()) {
-					onStack.delete(member);
-					component.push(member);
-				}
-				components.push(component);
-			}
-			const parent = frames.at(-1);
-			if (parent !== void 0) lowLink.set(parent.name, Math.min(lowLink.get(parent.name) ?? 0, link));
-		}
-	}
-	return {
-		components,
-		routes
-	};
-};
-/**
-* Cycles between workspace packages through their runtime dependency fields. Every route the search closes is a
-* finding, once per set of packages, starting at the package the search reached first; so a component with several
-* cycles can have several findings.
-*/
-const packageCycles = (engine) => {
-	const { workspace } = engine;
-	const edges = new Map(workspace.packages.map((entry) => [entry.name, [...new Set(runtimeFields.flatMap((field) => entry.manifest[field]))].filter((name) => workspace.byName.has(name) && name !== entry.name)]));
-	const findings = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const cycle of stronglyConnectedComponents([...edges.keys()].toSorted(), edges).routes) {
-		const key = cycle.slice(0, -1).toSorted().join(" ");
-		if (!seen.has(key)) {
-			seen.add(key);
-			const first = cycle[0] ?? "";
-			findings.push({
-				rule: "package-cycle",
-				file: `${workspace.byName.get(first)?.directory ?? first}/package.json`,
-				line: 1,
-				column: 0,
-				message: `dependency cycle: ${cycle.join(" -> ")}`,
-				target: key
-			});
-		}
-	}
-	return findings;
-};
-/** Baseline entries that no finding in `findings` needs; each is a finding of its own, so the baseline only shrinks. */
-const staleBaseline = (engine, findings) => engine.config.baseline.filter((entry) => !findings.some((finding) => baselineCovers(entry, finding))).map((entry) => ({
-	rule: "stale-baseline",
-	file: entry.file,
-	line: 1,
-	column: 0,
-	message: `the baseline entry for ${entry.rule}${entry.target === void 0 ? "" : ` (${entry.target})`} is no longer needed: remove it`,
-	target: entry.rule
-}));
-// src/check.ts
-/** The whole check: every source file of the workspace through the engine, plus the whole-graph checks and the baseline. */
-const isFile = (path) => {
-	try {
-		return statSync(path).isFile();
-	} catch {
-		return false;
-	}
-};
-/**
-* Every source file the engine reads, found by walking each package's directory (skipping `node_modules` and dot
-* directories). A walk rather than `git ls-files`: generated and gitignored sources still ship, and a nested repository
-* or submodule inside a package is still part of it.
-*/
-const listSourceFiles = (engine) => {
-	const files = /* @__PURE__ */ new Set();
-	const walk = (relative) => {
-		for (const entry of readdirSync(nodePath.join(engine.workspace.root, relative), { withFileTypes: true })) {
-			const path = `${relative}/${entry.name}`;
-			if (entry.isDirectory() && entry.name !== "node_modules" && !entry.name.startsWith(".")) walk(path);
-			else if ((entry.isFile() || entry.isSymbolicLink() && isFile(nodePath.join(engine.workspace.root, path))) && reads(engine, path)) files.add(path);
-		}
-	};
-	for (const entry of engine.workspace.packages) walk(entry.directory);
-	return [...files].toSorted();
-};
-const checkWorkspace = (root, config) => {
-	const engine = createEngine(root, config);
-	const files = listSourceFiles(engine);
-	const all = [...files.flatMap((file) => findingsForFile(engine, file, readFileSync(nodePath.join(root, file), "utf8"))).filter((finding) => finding.rule !== "package-without-kind"), ...graphFindings(engine)];
-	return {
-		files: files.length,
-		findings: [...withoutBaselined(engine, all), ...staleBaseline(engine, all)]
-	};
-};
-const formatFinding = (finding) => `${finding.file}:${finding.line}:${finding.column + 1} ${finding.rule}: ${finding.message}`;
-export { staleBaseline as a, graphFindings as i, formatFinding as n, listSourceFiles as r, checkWorkspace as t };