@joshuafolkken/kit 1.2116.0 → 1.3041.0

package/scripts/split/split-measure.ts

@@ -3,8 +3,12 @@ import path from 'node:path'
 import { change_base } from '#scripts/git/change-base'
 import { changed_paths } from '#scripts/git/changed-paths'
 import { git_command } from '#scripts/git/git-command'
+import { git_path_quoting } from '#scripts/git/git-path-quoting'
 import { git_spawn } from '#scripts/git/git-spawn'
+import { lane_implement_rate_read } from '#scripts/lane/lane-implement-rate-read'
+import { lane_stage_budget } from '#scripts/lane/lane-stage-budget'
 import { split_assess } from './split-assess'
+import { split_relocations } from './split-relocations'
 
 // The branch's size measurement — the one reading every `split_assess` caller takes.
 //
@@ -15,6 +19,8 @@ import { split_assess } from './split-assess'
 // `git diff --numstat` counts it. An entry with no readable content — a dangling symlink, a nested
 // repository's directory — still counts as a file, of zero lines, so one such entry cannot reject
 // the whole measurement.
+// Exact relocations are removed after combining both halves (joshuafolkken/kit#6360). The files the
+// branch adds group a new scripts module with its importer, as `lane:plan` does (joshuafolkken/kit#6724).
 //
 // joshuafolkken/kit#4696: **the tracked half is measured from the tree's base, through a merge in
 // progress** (`change_base.resolved_through_merge`). A merge of the default branch stopped on a
@@ -49,33 +55,41 @@ async function read_content(file_path: string): Promise<Buffer> {
 async function untracked_row(root: string, file: string): Promise<string> {
 	const lines = line_count(await read_content(path.join(root, file)))
 
-	return `${String(lines)}\t0\t${file}`
+	return `${String(lines)}\t0\t${git_path_quoting.quote(file)}`
 }
 
-async function untracked_numstat(): Promise<string> {
-	const files = changed_paths.to_paths(await git_command.untracked_names())
-
-	if (files.length === 0) return ''
-
-	const toplevel = await git_spawn.read(['rev-parse', '--show-toplevel'])
-	const root = toplevel.trim()
+async function untracked_numstat(root: string, files: ReadonlyArray<string>): Promise<string> {
 	const rows = await Promise.all(files.map(async (file) => await untracked_row(root, file)))
 
 	return rows.join(NEWLINE)
 }
 
-async function tracked_numstat(): Promise<string> {
+async function read_guide(): Promise<ReturnType<typeof split_assess.guide_for>> {
+	const measured = await lane_implement_rate_read.measurements()
+
+	return split_assess.guide_for(
+		lane_stage_budget.BUDGET_MINUTES.implement,
+		measured.implement_rate,
+		measured.growth,
+	)
+}
+
+async function read_branch(): Promise<ReturnType<typeof split_assess.assess>> {
 	const base = await change_base.resolved_through_merge()
 
 	if (base === undefined) throw new Error(UNRESOLVED_BASE)
 
-	return await git_command.diff_numstat_since(base)
-}
+	const tracked = await git_command.diff_numstat_since(base)
+	const files = changed_paths
+		.to_paths(await git_command.untracked_names())
+		.map((file) => git_path_quoting.unquote(file))
+	const toplevel = await git_spawn.read(['rev-parse', '--show-toplevel'])
+	const root = toplevel.trim()
+	const numstat = `${tracked}${NEWLINE}${await untracked_numstat(root, files)}`
 
-async function read_branch(): Promise<ReturnType<typeof split_assess.assess>> {
-	const tracked = await tracked_numstat()
+	const adjusted = await split_relocations.without_relocations(root, base, numstat, files)
 
-	return split_assess.assess(`${tracked}${NEWLINE}${await untracked_numstat()}`)
+	return split_assess.assess(adjusted.numstat, await read_guide(), new Set(adjusted.added))
 }
 
 const split_measure = { line_count, read_branch }

package/scripts/split/split-relocations.ts

@@ -0,0 +1,108 @@
+import { lstat } from 'node:fs/promises'
+import path from 'node:path'
+import { git_path_quoting } from '#scripts/git/git-path-quoting'
+import { git_spawn } from '#scripts/git/git-spawn'
+
+interface DeletedBlob {
+	file: string
+	object: string
+}
+
+interface RelocatedDiff {
+	numstat: string
+	added: ReadonlyArray<string>
+}
+
+interface RawChange {
+	header: string
+	file: string
+}
+
+const PAIR_FIELDS = 2
+const RAW_OPTIONS = ['diff', '--raw', '-z', '--no-abbrev', '--no-relative', '--no-renames']
+
+function raw_changes(raw: string): Array<RawChange> {
+	return raw
+		.split('\0')
+		.flatMap((header, index, fields) =>
+			index % PAIR_FIELDS === 0 && fields[index + 1] !== undefined
+				? { header, file: fields[index + 1] ?? '' }
+				: [],
+		)
+}
+
+function deleted_blobs(raw: string): Array<DeletedBlob> {
+	return raw_changes(raw).flatMap(({ header, file }) => {
+		const object = /^:100\d+ \d+ (\w+) \w+ D$/u.exec(header)?.[1]
+
+		return object === undefined ? [] : { file, object }
+	})
+}
+
+function added_paths(raw: string): Array<string> {
+	return raw_changes(raw)
+		.filter((change) => change.header.endsWith(' A'))
+		.map((change) => change.file)
+}
+
+async function content_object(root: string, file: string): Promise<string | undefined> {
+	try {
+		const stat = await lstat(path.join(root, file))
+
+		if (!stat.isFile()) return undefined
+
+		return await git_spawn.read(['-C', root, 'hash-object', '--no-filters', '--', file])
+	} catch {
+		return undefined
+	}
+}
+
+function pair(deleted: Array<DeletedBlob>, addition: DeletedBlob): Array<string> {
+	const index = deleted.findIndex((blob) => blob.object === addition.object)
+
+	if (index === -1) return []
+
+	return deleted.splice(index, 1).flatMap((source) => [source.file, addition.file])
+}
+
+function paired_paths(raw: string, additions: ReadonlyArray<DeletedBlob>): ReadonlySet<string> {
+	const deleted = deleted_blobs(raw)
+
+	const paths = additions.flatMap((addition) => pair(deleted, addition))
+
+	return new Set(paths.map((file) => git_path_quoting.quote(file)))
+}
+
+async function candidates(root: string, files: ReadonlyArray<string>): Promise<Array<DeletedBlob>> {
+	return await Promise.all(
+		files.map(async (file) => ({
+			file,
+			object: (await content_object(root, file)) ?? '',
+		})),
+	)
+}
+
+// Exact relocations carry no implementation lines. Each deletion can answer only one addition;
+// edited moves and unrelated additions/deletions retain their full numstat contribution. The files
+// the branch adds, tracked or not, come back beside it for the split notice's units
+// (joshuafolkken/kit#6724).
+async function without_relocations(
+	root: string,
+	base: string,
+	numstat: string,
+	untracked: ReadonlyArray<string>,
+): Promise<RelocatedDiff> {
+	const raw = await git_spawn.read([...RAW_OPTIONS, base, '--'])
+	const added = [...added_paths(raw), ...untracked]
+	const paired = paired_paths(raw, await candidates(root, added))
+	const rows = numstat
+		.split('\n')
+		.filter((row) => !paired.has(row.split('\t').slice(PAIR_FIELDS).join('\t')))
+
+	return { numstat: rows.join('\n'), added }
+}
+
+const split_relocations = { without_relocations }
+
+export type { RelocatedDiff }
+export { split_relocations }

package/scripts/split/split-resolution.ts

@@ -1,7 +1,7 @@
-import { git_gh_issue_read } from '#scripts/gh/git-gh-issue-read'
+import { issue_cite } from '#scripts/issue/issue-cite'
 import { SPLIT_ROUTE_LABEL } from '#scripts/issue/issue-labels'
-import { issue_read } from '#scripts/issue/issue-read'
 import { session_cite } from '#scripts/issue/session-cite'
+import { lane_child_marker } from '#scripts/lane/lane-child-marker'
 import {
 	lane_ledger,
 	type LedgerEntry,
@@ -9,20 +9,34 @@ import {
 	type SplitNoticeEntry,
 } from '#scripts/lane/lane-ledger'
 import { lane_ledger_write } from '#scripts/lane/lane-ledger-write'
+import { error_text } from '#scripts/lib/error-message'
 import { split_assess } from './split-assess'
 
-// **What answers a split notice** (joshuafolkken/kit#4695). Of the lanes the notice reached, none split
-// and none recorded why it stayed one Issue (joshuafolkken/kit#4676): the notice asked, and nothing
-// checked. The pre-gate `josh run:cut` now does. A noticed Issue passes once it has either answer:
-//
-// - **a split child** — a `josh issue:file --route split` filed from its lane, recorded in the lane
-//   ledger as the filing lands;
-// - **a reason** — a trusted Issue comment carrying the filing's own reason line
-//   (`split_assess.REASON_PREFIX`), so one declaration reads the same at filing and before the gate.
+// A split child answers a notice; the child is recorded as the filing lands (joshuafolkken/kit#6212).
+// A started lane is never split (joshuafolkken/kit#7183): its own `--route split --found-during` is
+// refused, and an overrun is recorded at its merge as a pre-split miss (`lane-size-record.ts`).
 
-const { REASON_PREFIX } = split_assess
 const NOTICE_SECTION = `split-assessment.md → "${split_assess.NOTICE_SECTION}"`
-const UNREAD_NOTE = 'Its comments could not be read, so no recorded reason was found. '
+
+interface SplitArguments {
+	route: string | undefined
+	found_during: string | undefined
+}
+
+// Whether the filing is not a split of the dispatched lane it is filed from; a refusal is printed. An
+// independent new requirement found in the lane is filed as an observation instead. An omitted
+// `--found-during` is the lane's own, as `issue_file_fold.finder` reads it.
+function is_split_clear({ route, found_during }: SplitArguments): boolean {
+	const marked = lane_child_marker.marked_issue()
+	const finder = found_during ?? marked
+
+	if (route !== SPLIT_ROUTE_LABEL || finder === undefined || finder !== marked) return true
+	console.error(
+		`refused: ${session_cite.issue(finder)} is a dispatched lane, which is never split — finish it; file an independent new requirement without \`--route split\` (${NOTICE_SECTION}).`,
+	)
+
+	return false
+}
 
 function is_notice(entry: LedgerEntry): entry is SplitNoticeEntry {
 	return entry.kind === lane_ledger.KIND.SPLIT_NOTICE
@@ -42,53 +56,6 @@ function split_issues(entries: ReadonlyArray<LedgerEntry>): ReadonlySet<number>
 	return new Set(entries.filter((entry) => is_split_child(entry)).map((entry) => entry.issue))
 }
 
-function is_reason_line(line: string): boolean {
-	const text = line.trim()
-
-	return text.startsWith(REASON_PREFIX) && text !== REASON_PREFIX
-}
-
-function has_reason(bodies: ReadonlyArray<string>): boolean {
-	return bodies.some((body) => body.split('\n').some((line) => is_reason_line(line)))
-}
-
-// The trusted comments' bodies, or `undefined` when the listing could not be read.
-async function trusted_comments(issue: number): Promise<ReadonlyArray<string> | undefined> {
-	const json = await git_gh_issue_read.issue_list_comments(String(issue))
-	const comments = await issue_read.parse_comments(json)
-
-	return comments === undefined ? undefined : issue_read.trusted_bodies(comments)
-}
-
-function refusal_text(notice: SplitNoticeEntry, bodies: ReadonlyArray<string> | undefined): string {
-	const counted = `${String(notice.files)} file(s), ${String(notice.lines)} line(s), tests excluded`
-	const unread = bodies === undefined ? UNREAD_NOTE : ''
-	const answers = `post an Issue comment with the line \`${REASON_PREFIX} <理由>\`, or file the rest with \`pnpm josh issue:file --route split\``
-
-	return `${session_cite.issue(notice.issue)} got the split notice (${counted}) and has neither a recorded reason nor a split child. ${unread}Either ${answers}, then run \`pnpm josh run:cut ${String(notice.issue)}\` again — ${NOTICE_SECTION}`
-}
-
-// The refusal for a noticed Issue that has no answer yet, else `undefined`. The ledger is read first,
-// so an Issue the notice never reached costs no GitHub read.
-async function refusal(
-	issue: number,
-	entries: ReadonlyArray<LedgerEntry>,
-): Promise<string | undefined> {
-	const notice = notices(entries).findLast((entry) => entry.issue === issue)
-
-	if (notice === undefined || split_issues(entries).has(issue)) return undefined
-	const bodies = await trusted_comments(issue)
-
-	return bodies !== undefined && has_reason(bodies) ? undefined : refusal_text(notice, bodies)
-}
-
-// The refusal against this repository's lane ledger; outside a repository there is none to read.
-async function ledger_refusal(issue: number): Promise<string | undefined> {
-	const ledger = await lane_ledger.target()
-
-	return ledger === undefined ? undefined : await refusal(issue, lane_ledger.read_entries(ledger))
-}
-
 interface Filing {
 	route: string | undefined
 	found_during: string | undefined
@@ -99,9 +66,44 @@ interface Filing {
 // other route, and a filing found in no lane, record nothing.
 async function record_child({ route, found_during, child }: Filing): Promise<void> {
 	if (route !== SPLIT_ROUTE_LABEL || found_during === undefined) return
-	await lane_ledger_write.record_split_filed({ issue: Number(found_during), child })
+
+	try {
+		await lane_ledger_write.record_split_filed({ issue: Number(found_during), child })
+	} catch (error) {
+		throw new Error(
+			`Created ${child}, but split-child evidence could not be recorded. Do not create another child. Recover with \`pnpm josh split:recover ${found_during} ${child}\`.`,
+			{ cause: error },
+		)
+	}
+}
+
+interface Fold {
+	origin: string
+	target: string
+}
+
+// joshuafolkken/kit#6630: the split part folded into existing Issue `target`
+// (`josh issue:fold-existing --apply <target> --found-during <origin>`) answers the notice as its child.
+async function record_fold({ origin, target }: Fold): Promise<void> {
+	try {
+		await lane_ledger_write.record_split_filed({
+			issue: Number(origin),
+			child: issue_cite.plain_for('program', target),
+		})
+	} catch (error) {
+		throw new Error(
+			`Folded into ${session_cite.issue(target)}, but split-child evidence for ${session_cite.issue(origin)} could not be recorded: ${error_text.message_of(error)}`,
+			{ cause: error },
+		)
+	}
 }
 
-const split_resolution = { ledger_refusal, notices, record_child, refusal, split_issues }
+const split_resolution = {
+	is_split_clear,
+	notices,
+	record_child,
+	record_fold,
+	split_issues,
+}
 
 export { split_resolution }

package/scripts/sync/claude-settings-merge.ts

@@ -2,15 +2,15 @@ import { json_format } from '#scripts/config-merge/json-format'
 import { hook_command_rewrite } from '#scripts/init/hook-command-rewrite'
 import { json_value } from '#scripts/lib/json-value'
 
-// `josh sync` used to replace a project's `.claude/settings.json` with the distributed file, which
-// deleted every hook and permission the project had added — and `.claude/settings.local.json` is
-// personal, so a team had nowhere to keep a shared one. The merge replaces what kit ships and keeps
-// the rest:
+// The project settings file holds team-shared hooks and permissions, so sync must preserve project
+// additions while replacing the entries kit owns:
 //
 //  - hooks: a handler whose command has one of kit's shapes is kit's — the current ones are replaced
 //    and a retired one is dropped; every other handler is the project's and stays.
 //  - permissions: kit's `allow` / `deny` entries are always present, so a removed `deny` comes back;
 //    the project's own entries follow them, less the ones kit has withdrawn.
+//  - statusLine: the project's where it has one, kit's only where it has none — a project's own
+//    status line is a display choice kit's usage recorder must not take over.
 //  - any other key: kit's value where kit ships one, the project's where it does not. Objects merge
 //    entry by entry, so a project's own `env` variable or plugin survives beside kit's.
 //
@@ -22,12 +22,15 @@ type EntryMerge = (key: string, kit: unknown, own: unknown) => unknown
 
 const HOOKS_KEY = 'hooks'
 const PERMISSIONS_KEY = 'permissions'
+const STATUS_LINE_KEY = 'statusLine'
 // An entry kit stops shipping would otherwise stay in every merged file as if the project had added
 // it, so a permission kit withdraws could never be withdrawn. Withdrawing one means removing it from
 // kit's settings file and naming it here.
 const WITHDRAWN_KIT_PERMISSIONS: ReadonlySet<unknown> = new Set([
 	'Bash(git commit -a*)',
 	'Bash(git commit --all*)',
+	'Edit(./.github/workflows/**)',
+	'Write(./.github/workflows/**)',
 ])
 
 function as_array(value: unknown): Array<unknown> {
@@ -112,6 +115,7 @@ function merge_hooks(kit: unknown, own: unknown): unknown {
 function merge_top_level(key: string, kit: unknown, own: unknown): unknown {
 	if (key === HOOKS_KEY) return merge_hooks(kit, own)
 	if (key === PERMISSIONS_KEY) return merge_permissions(kit, own)
+	if (key === STATUS_LINE_KEY) return own ?? kit
 
 	return merge_kit_value(kit, own)
 }

package/scripts/sync/managed-config-scope.ts

@@ -1,4 +1,5 @@
 import { init_logic } from '#scripts/init/init-logic'
+import { npm_publish_files } from '#scripts/init/npm-publish-files'
 import { PLUGIN_SKILL_DIRECTORIES } from './plugin-skill-directories'
 import { synced_paths } from './synced-paths'
 
@@ -18,6 +19,11 @@ const SYNCED_PATHS_LIST = 'SYNCED_PATHS'
 // reaches consumers through the package, so the gate keeps flagging it.
 const PLUGIN_SKILL_DIRECTORIES_LIST = 'PLUGIN_SKILL_DIRECTORIES'
 
+// The sixth source: the publish workflow sync copies only to a repository npm carries under kit's
+// scope. Matched by path alone — whether a given consumer receives it is the registry's answer, but a
+// change to it reaches every one that does (#7303).
+const NPM_PUBLISH_FILES_LIST = 'NPM_PUBLISH_FILES'
+
 const PATH_SEPARATOR = '/'
 
 interface ManagedHit {
@@ -62,7 +68,11 @@ function matches_synced_path(path: string): boolean {
 	return synced_paths.get_synced_paths().includes(path)
 }
 
-// A table rather than a chain of `if`s: a fifth distribution surface is then one row, and the search
+function matches_npm_publish_file(path: string): boolean {
+	return path === npm_publish_files.PUBLISH_WORKFLOW
+}
+
+// A table rather than a chain of `if`s: another distribution surface is then one row, and the search
 // order stays visible in one place. The sources are searched top to bottom and the first to claim the
 // path wins — a path on two is reported once, because naming the second changes nothing the reader
 // does and a second row per path would make the count of hits disagree with the count of files.
@@ -72,6 +82,7 @@ const MATCHERS: ReadonlyArray<{ list: string; matches: (path: string) => boolean
 	{ list: AI_COPY_DIRECTORIES_LIST, matches: matches_directory },
 	{ list: PLUGIN_SKILL_DIRECTORIES_LIST, matches: matches_plugin_skill },
 	{ list: SYNCED_PATHS_LIST, matches: matches_synced_path },
+	{ list: NPM_PUBLISH_FILES_LIST, matches: matches_npm_publish_file },
 ]
 
 function find_list(path: string): string | undefined {
@@ -119,5 +130,6 @@ export {
 	AI_COPY_DIRECTORIES_LIST,
 	PLUGIN_SKILL_DIRECTORIES_LIST,
 	SYNCED_PATHS_LIST,
+	NPM_PUBLISH_FILES_LIST,
 }
 export type { ManagedHit }

package/scripts/sync/sync-ai-files.ts

@@ -46,7 +46,7 @@ function should_skip_hook_file(filename: string): boolean {
 }
 
 // The project's own hooks, permissions and keys survive: only kit's entries are replaced
-// (`claude-settings-merge.ts`). `--force` is the replacement sync used to make, as it is for
+// (`claude-settings-merge.ts`). `--force` requests replacement, as it does for
 // `pnpm-workspace.yaml`.
 function sync_claude_settings(
 	source_path: string,
@@ -201,7 +201,7 @@ function sync_ai_copy_all(is_force: boolean, shape?: ProjectShape): void {
 
 	sync_claude_md(path.join(PROJECT_ROOT, CLAUDE_MD_FILENAME), shape)
 
-	for (const filename of init_ai_copy.ai_files(shape)) {
+	for (const filename of init_ai_copy.copied_files(shape)) {
 		sync_ai_copy_file(filename, is_force, shape)
 	}
 

package/scripts/sync/sync-configs.ts

@@ -31,11 +31,9 @@ function sync_with_merge(
 	console.info(`  ✔ synced    ${destination_name}`)
 }
 
-// Removes only the exact settings lines earlier kit releases wrote, which pnpm 12 ignores in
-// `.npmrc`; every other line, a `_authToken` line included, is left alone.
-// Sync used to remove the env-var form, which broke every project that had opted its project
-// .npmrc in via `npmrcAuthFile` — there the line is the live credential, and the opt-in itself
-// can live in a deploy platform's dashboard where sync cannot see it.
+// Remove only exact obsolete settings that pnpm 12 ignores in `.npmrc`. Preserve authentication
+// lines, including env-var forms: npmrcAuthFile can opt the file into authentication from a deploy
+// dashboard that sync cannot inspect.
 function sync_npmrc(destination_path: string): void {
 	sync_with_merge(destination_path, '.npmrc', init_logic.merge_npmrc)
 }

package/scripts/test/test-e2e-guard.ts

@@ -73,11 +73,12 @@ async function run_playwright(extra_arguments: ReadonlyArray<string>): Promise<n
 }
 
 // Only a run reserves: a skip starts nothing, and a claim there could wait out a full ledger for it.
+// A whole suite, so a ship's push never runs it ahead of other lanes (`core-priority.ts`).
 async function run_reserved_playwright(extra_arguments: ReadonlyArray<string>): Promise<number> {
 	return await core_budget.with_command_reservation(
 		core_budget.CORE_WEIGHTS.e2e,
 		async () => await run_playwright(extra_arguments),
-		{ command: 'test:e2e' },
+		{ command: 'test:e2e', memory_mb: core_budget.MEMORY_MB.e2e, is_suite: true },
 	)
 }
 

package/scripts/test/test-inputs.ts

@@ -0,0 +1,119 @@
+import type ts from 'typescript'
+
+// Only closed module inputs can reuse an individual green test. Anything outside this small
+// vocabulary (filesystem, environment, subprocesses, dynamic loading, globals) remains unknown.
+const GLOBALS: ReadonlySet<string> = new Set([
+	'undefined',
+	'NaN',
+	'Infinity',
+	'Array',
+	'Object',
+	'String',
+	'Number',
+	'Boolean',
+	'BigInt',
+	'Symbol',
+	'Map',
+	'Set',
+	'WeakMap',
+	'WeakSet',
+	'JSON',
+	'RegExp',
+	'Error',
+	'TypeError',
+	'RangeError',
+	'Promise',
+	'parseInt',
+	'parseFloat',
+	'isNaN',
+	'isFinite',
+])
+const UNSAFE: ReadonlySet<string> = new Set([
+	'process',
+	'global',
+	'globalThis',
+	'eval',
+	'Function',
+	'require',
+	'constructor',
+	'__proto__',
+	'prototype',
+	'vi',
+	'vitest',
+	'inject',
+	'provide',
+	'toMatchSnapshot',
+	'toMatchFileSnapshot',
+	'toThrowErrorMatchingSnapshot',
+	'matchSnapshot',
+])
+
+type TypeScript = typeof ts
+
+function is_property(typescript: TypeScript, node: ts.Identifier): boolean {
+	const { parent } = node
+
+	return (
+		(typescript.isPropertyAccessExpression(parent) && parent.name === node) ||
+		((typescript.isPropertyAssignment(parent) || typescript.isMethodDeclaration(parent)) &&
+			parent.name === node)
+	)
+}
+
+function is_unsafe_syntax(typescript: TypeScript, node: ts.Node): boolean {
+	return [
+		typescript.isNamespaceImport(node),
+		typescript.isElementAccessExpression(node),
+		node.kind === typescript.SyntaxKind.ThisKeyword,
+		typescript.isMetaProperty(node),
+	].includes(true)
+}
+
+function is_dynamic_import(typescript: TypeScript, node: ts.Node): boolean {
+	return (
+		typescript.isCallExpression(node) &&
+		node.expression.kind === typescript.SyntaxKind.ImportKeyword
+	)
+}
+
+function is_unknown_identifier(
+	typescript: TypeScript,
+	node: ts.Identifier,
+	checker: ts.TypeChecker,
+): boolean {
+	if (UNSAFE.has(node.text)) return true
+
+	return (
+		!is_property(typescript, node) &&
+		checker.getSymbolAtLocation(node) === undefined &&
+		!GLOBALS.has(node.text)
+	)
+}
+
+function is_unknown(typescript: TypeScript, node: ts.Node, checker: ts.TypeChecker): boolean {
+	if (is_unsafe_syntax(typescript, node) || is_dynamic_import(typescript, node)) return true
+	if (!typescript.isIdentifier(node)) return false
+
+	return is_unknown_identifier(typescript, node, checker)
+}
+
+function is_closed(typescript: TypeScript, file: string, content: string): boolean {
+	const source = typescript.createSourceFile(file, content, typescript.ScriptTarget.Latest, true)
+	const host = typescript.createCompilerHost({})
+
+	host.getSourceFile = (name) => (name === file ? source : undefined)
+	const program = typescript.createProgram([file], { noLib: true, noResolve: true }, host)
+	const checker = program.getTypeChecker()
+
+	function unknown(node: ts.Node): boolean {
+		if (typescript.isTypeNode(node)) return false
+
+		return is_unknown(typescript, node, checker) || typescript.forEachChild(node, unknown) === true
+	}
+
+	return program.getSyntacticDiagnostics(source).length === 0 && !unknown(source)
+}
+
+const test_inputs = { is_closed }
+
+export { test_inputs }