@nifrajs/cli 3.5.0 → 4.0.0

package/src/port.ts

@@ -17,9 +17,11 @@
 import { join } from "node:path"
 import { Glob } from "bun"
 import { stripComments } from "./check.ts"
+import { readConfigTarget } from "./config-target.ts"
+import { codeUnitOrder } from "./internal/code-unit-order.ts"
 
 /** The five deploy targets a nifra `site` app can build for (mirrors create-nifra's DEPLOY presets). */
-export const TARGETS = ["bun", "node", "deno", "cf-pages", "vercel"] as const
+export const TARGETS = ["bun", "node", "deno", "cloudflare", "vercel"] as const
 export type Target = (typeof TARGETS)[number]
 
 const isTarget = (value: string): value is Target => (TARGETS as readonly string[]).includes(value)
@@ -56,14 +58,14 @@ const inMemoryVerdicts: Readonly<Record<Target, Verdict>> = {
   bun: "caveat",
   node: "caveat",
   deno: "caveat",
-  "cf-pages": "unsupported",
+  cloudflare: "unsupported",
   vercel: "unsupported",
 }
 const inMemoryReasons = (shared: string): Readonly<Record<Target, string>> => ({
   bun: "ok single-instance; state is lost on restart and not shared across instances",
   node: "ok single-instance; state is lost on restart and not shared across instances",
   deno: "ok single-instance; state is lost on restart and not shared across instances",
-  "cf-pages": shared,
+  cloudflare: shared,
   vercel: shared,
 })
 
@@ -105,14 +107,14 @@ export const FEATURES: Readonly<Record<FeatureId, FeatureSpec>> = {
       bun: "ok",
       node: "ok",
       deno: "ok",
-      "cf-pages": "caveat",
+      cloudflare: "caveat",
       vercel: "unsupported",
     },
     reasons: {
       bun: "long-lived process runs the scheduler loop",
       node: "long-lived process runs the scheduler loop",
       deno: "long-lived process runs the scheduler loop",
-      "cf-pages":
+      cloudflare:
         "no long-lived loop on Workers - use the platform `scheduled` trigger via toFetchHandler(app, { scheduled }) and a wrangler [triggers] cron",
       vercel: "no long-lived process - use a Vercel Cron Job hitting an endpoint",
     },
@@ -124,14 +126,14 @@ export const FEATURES: Readonly<Record<FeatureId, FeatureSpec>> = {
       bun: "ok",
       node: "ok",
       deno: "ok",
-      "cf-pages": "caveat",
+      cloudflare: "caveat",
       vercel: "unsupported",
     },
     reasons: {
       bun: "all sockets live in one process; app.publish broadcasts to every client",
       node: "all sockets live in one process; app.publish broadcasts to every client",
       deno: "all sockets live in one process; app.publish broadcasts to every client",
-      "cf-pages":
+      cloudflare:
         "a stateless fetch can't broadcast across isolates - wrap the app in createWebSocketHub (a Durable Object) from @nifrajs/workers",
       vercel: "Vercel's serverless functions don't hold long-lived WebSocket connections",
     },
@@ -143,14 +145,14 @@ export const FEATURES: Readonly<Record<FeatureId, FeatureSpec>> = {
       bun: "ok",
       node: "unsupported",
       deno: "unsupported",
-      "cf-pages": "unsupported",
+      cloudflare: "unsupported",
       vercel: "unsupported",
     },
     reasons: {
       bun: "the Bun runtime provides the Bun global",
       node: "no Bun global on Node - use the node: / Web equivalents",
       deno: "no Bun global on Deno - use the Deno / Web equivalents",
-      "cf-pages": "no Bun global in the Workers runtime",
+      cloudflare: "no Bun global in the Workers runtime",
       vercel: "no Bun global in the Vercel runtime",
     },
   },
@@ -161,14 +163,14 @@ export const FEATURES: Readonly<Record<FeatureId, FeatureSpec>> = {
       bun: "unsupported",
       node: "unsupported",
       deno: "ok",
-      "cf-pages": "unsupported",
+      cloudflare: "unsupported",
       vercel: "unsupported",
     },
     reasons: {
       bun: "no Deno global on Bun - use the Bun / Web equivalents",
       node: "no Deno global on Node - use the node: / Web equivalents",
       deno: "the Deno runtime provides the Deno global",
-      "cf-pages": "no Deno global in the Workers runtime",
+      cloudflare: "no Deno global in the Workers runtime",
       vercel: "no Deno global in the Vercel runtime",
     },
   },
@@ -179,14 +181,14 @@ export const FEATURES: Readonly<Record<FeatureId, FeatureSpec>> = {
       bun: "ok",
       node: "ok",
       deno: "ok",
-      "cf-pages": "caveat",
+      cloudflare: "caveat",
       vercel: "caveat",
     },
     reasons: {
       bun: "Bun implements the node: builtins",
       node: "native node: builtins",
       deno: "Deno implements the node: builtins",
-      "cf-pages":
+      cloudflare:
         'Workers needs `compatibility_flags = ["nodejs_compat"]` in wrangler.toml (and not every builtin is covered)',
       vercel: "needs the Node.js runtime (not the Edge runtime) so node: builtins resolve",
     },
@@ -242,8 +244,9 @@ const WS_ROUTE = /\.ws\s*\(/g
 const WS_HUB = /(?<![.\w$])createWebSocketHub\b/
 // `Bun.` / `Deno.` runtime globals. `(?<![.\w$])` rejects `myBun.x`, `globalThis.Bun` stays a real use
 // (we want it), and `obj.Bun.` won't match because the char before `Bun` would be `.`.
-const BUN_GLOBAL = /(?<![.\w$])Bun\s*\./g
-const DENO_GLOBAL = /(?<![.\w$])Deno\s*\./g
+const BUN_GLOBAL = /(?<![.\w$])(?:globalThis\.)?Bun\s*\./g
+const DENO_GLOBAL = /(?<![.\w$])(?:globalThis\.)?Deno\s*\./g
+const BUN_MODULE_IMPORT = /(?:from|import)\s*\(?\s*["'`]bun(?:\/[^"'`]*)?["'`]/g
 // `node:` builtin specifier in any import/require/export-from form.
 const NODE_BUILTIN = /(?:from|import|require)\s*\(?\s*["'`](node:[A-Za-z0-9/_-]+)["'`]/g
 
@@ -298,8 +301,12 @@ export function scanFileForFeatures(file: string, content: string, state: ScanSt
   // WS routes are collected unconditionally; the hub-presence post-pass decides whether they're a hazard.
   pushHits(add("in-process-websocket"), file, content, code, WS_ROUTE)
   pushHits(add("bun-runtime-api"), file, content, code, BUN_GLOBAL)
+  pushHits(add("bun-runtime-api"), file, content, code, BUN_MODULE_IMPORT)
   pushHits(add("deno-runtime-api"), file, content, code, DENO_GLOBAL)
   pushHits(add("node-builtin"), file, content, code, NODE_BUILTIN)
+  for (const evidence of state.evidence.values()) {
+    evidence.sort((a, b) => codeUnitOrder(a.file, b.file) || a.line - b.line)
+  }
 }
 
 // Mirror nifra check/doctor's ignore set: deps, build output, generated/per-runtime dist dirs, VCS.
@@ -323,7 +330,7 @@ async function walkPortSource(
 }
 
 const byEvidence = (a: Evidence, b: Evidence): number =>
-  a.file.localeCompare(b.file) || a.line - b.line
+  codeUnitOrder(a.file, b.file) || a.line - b.line
 
 /** Run every detector over the project and return the detected features (sorted, stable). */
 export async function detectFeatures(cwd: string): Promise<DetectedFeature[]> {
@@ -353,12 +360,18 @@ export async function detectFeatures(cwd: string): Promise<DetectedFeature[]> {
 export interface ResolvedTarget {
   readonly target: Target
   /** How the target was determined - surfaced so the report explains itself. */
-  readonly source: "flag" | "package-json-build" | "package-json-deploy" | "wrangler" | "vercel"
+  readonly source:
+    | "flag"
+    | "config"
+    | "package-json-build"
+    | "package-json-deploy"
+    | "wrangler"
+    | "vercel"
 }
 
 const BUILD_SCRIPT_TARGET: ReadonlyArray<readonly [RegExp, Target]> = [
   // create-nifra's canonical per-target build scripts (build-bun.ts / build-node.ts / build-deno.ts /
-  // build-vercel.ts), plus the bare `build.ts` the cf-pages preset uses.
+  // build-vercel.ts), plus the bare `build.ts` the cloudflare preset uses.
   [/build-vercel\.[cm]?[jt]s\b/, "vercel"],
   [/build-deno\.[cm]?[jt]s\b/, "deno"],
   [/build-node\.[cm]?[jt]s\b/, "node"],
@@ -367,7 +380,7 @@ const BUILD_SCRIPT_TARGET: ReadonlyArray<readonly [RegExp, Target]> = [
 const DEPLOY_SCRIPT_TARGET: ReadonlyArray<readonly [RegExp, Target]> = [
   [/\bvercel\s+deploy\b/, "vercel"],
   [/\bdeployctl\b/, "deno"],
-  [/wrangler\s+pages\s+deploy\b/, "cf-pages"],
+  [/wrangler\s+pages\s+deploy\b/, "cloudflare"],
   [/\bdocker\s+build\b/, "node"],
 ]
 
@@ -376,8 +389,9 @@ interface PackageJsonScripts {
 }
 
 /**
- * Resolve the app's deploy target. `--target` (validated) always wins. Otherwise infer it, in priority
- * order, from: the canonical `build` script (create-nifra's `build-<target>.ts`), the `deploy` script
+ * Resolve the app's deploy target. `--target` (validated) always wins, then the `target` that
+ * `nifra.config.ts` exports. Otherwise infer it, in priority order, from: the canonical `build` script
+ * (an older create-nifra's `build-<target>.ts`), the `deploy` script
  * (the vendor CLI it shells out to), a `wrangler.toml` (Cloudflare Pages), or a `vercel.json`. Returns
  * `undefined` when nothing signals a target (the matrix still prints; CI gating needs an explicit one).
  */
@@ -385,11 +399,18 @@ export async function resolveTarget(
   cwd: string,
   override?: string,
 ): Promise<ResolvedTarget | undefined> {
-  if (override !== undefined) {
-    if (!isTarget(override)) {
-      throw new Error(`[nifra] invalid --target "${override}". options: ${TARGETS.join(", ")}`)
-    }
-    return { target: override, source: "flag" }
+  const checked = (value: string, label: string): Target => {
+    if (isTarget(value)) return value
+    throw new Error(
+      value === "cf-pages"
+        ? `[nifra] the ${label} "cf-pages" is now "cloudflare"`
+        : `[nifra] invalid ${label} "${value}". options: ${TARGETS.join(", ")}`,
+    )
+  }
+  if (override !== undefined) return { target: checked(override, "--target"), source: "flag" }
+  const configured = readConfigTarget(cwd)
+  if (configured !== undefined && configured !== "static") {
+    return { target: checked(configured, "target in nifra.config.ts"), source: "config" }
   }
 
   const pkg = await readJson<PackageJsonScripts>(join(cwd, "package.json"))
@@ -406,7 +427,7 @@ export async function resolveTarget(
   }
 
   if (await Bun.file(join(cwd, "wrangler.toml")).exists()) {
-    return { target: "cf-pages", source: "wrangler" }
+    return { target: "cloudflare", source: "wrangler" }
   }
   if (
     (await Bun.file(join(cwd, "vercel.json")).exists()) ||
@@ -513,7 +534,7 @@ export async function collectPortResult(
 // --- Rendering ----------------------------------------------------------------------------------------
 
 const CELL: Readonly<Record<Verdict, string>> = { ok: "✓", caveat: "⚠", unsupported: "✗" }
-const COL_WIDTH = 9 // widest target header ("cf-pages") + padding
+const COL_WIDTH = 12 // widest target header ("cloudflare") + padding
 
 const padCell = (s: string, width: number): string => {
   // Pad accounting for the symbol's display width (✓/⚠/✗ render as 1 cell in a monospace terminal).
@@ -530,7 +551,7 @@ export function renderReport(result: PortResult, opts: { readonly strict?: boole
     out.push(`target: ${resolved.target} (detected from ${describeSource(resolved.source)})`)
   } else {
     out.push(
-      "target: not detected - pass --target <bun|node|deno|cf-pages|vercel> to gate against one",
+      "target: not detected - pass --target <bun|node|deno|cloudflare|vercel> to gate against one",
     )
   }
   out.push("")
@@ -610,6 +631,8 @@ function describeSource(source: ResolvedTarget["source"]): string {
   switch (source) {
     case "flag":
       return "--target"
+    case "config":
+      return "nifra.config.ts"
     case "package-json-build":
       return "the package.json build script"
     case "package-json-deploy":
@@ -655,7 +678,7 @@ export async function runPort(cwd: string, opts: RunPortOptions = {}): Promise<b
   if (result.resolved === undefined) {
     if (!opts.json) {
       console.error(
-        "\n[nifra] --ci needs a deploy target to gate against, and none was detected. Pass --target <bun|node|deno|cf-pages|vercel>.",
+        "\n[nifra] --ci needs a deploy target to gate against, and none was detected. Pass --target <bun|node|deno|cloudflare|vercel>.",
       )
     }
     return false

package/src/project-facts.ts

@@ -11,6 +11,7 @@ import type {
   TransitiveServerImportFinding,
 } from "./check-scan.ts"
 import type { DoctorResult } from "./doctor.ts"
+import type { TypeScriptSession } from "./internal/typescript-import.ts"
 import type { PipelineReport } from "./pipeline-report.ts"
 import type { RulePack, SourceIndex } from "./rules/index.ts"
 
@@ -47,6 +48,10 @@ export interface ContractCheckFacts {
 export interface ProjectCheckFacts {
   readonly typecheck: CheckTypecheckResult
   readonly sqlCompilerAvailable: boolean
+  /** Set when a project TypeScript install is present but outside the scanner adapter range. */
+  readonly unsupportedTypeScriptVersion?: string
+  /** Shared syntax/checker session for built-in rules; omitted from serialized check output. */
+  readonly typescriptSession?: TypeScriptSession
   readonly checkConfigError?: string
   readonly checkConfigWarnings: readonly string[]
   readonly contracts: ContractCheckFacts

package/src/recipes/4.0.0.ts

@@ -0,0 +1,35 @@
+import type { UpgradeRecipe } from "./index.ts"
+
+/**
+ * Upgrade recipe for Nifra 4.0.
+ *
+ * The runner pins the fixed group and moves the retired `server-only` marker import. The layout move
+ * is `nifra migrate layout`'s job, so the notes lead with it, then cover what an app may observe.
+ */
+export const recipe: UpgradeRecipe = {
+  version: "4.0.0",
+  pins: [
+    { match: "@nifrajs/", to: "4.0.0" },
+    { match: "create-nifra", to: "4.0.0" },
+    { match: "nifra", to: "4.0.0" },
+  ],
+  importMoves: [{ from: "@nifrajs/web/server-only", to: "@nifrajs/web/backend-only" }],
+  notes: [
+    "Run `nifra migrate layout` (a dry run; `--write` applies it). An app's code now lives in `routes/`, `frontend/`, `backend/` and `shared/`: each route splits into `x.tsx` (the page) and `x.backend.ts` (`loader`, `action`, `middleware` and the other server exports), `_middleware.ts` folds into `_layout.backend.ts`, the root `backend.ts` and `framework.ts` move to `backend/app.ts` and `backend/framework.ts`, `*.server` modules move under `backend/`, and `ServerOnly` becomes `BackendOnly`. It lists what it could not decide.",
+    "Browser builds and dev servers refuse backend code, server packages and any first-party file in no zone, naming the import chain; `nifra check` reports the same (NF-C004, NF-C028) and private environment reads in browser code (NF-C029).",
+    "A loader or action that returns data needs `loaderOutput` / `actionOutput` in its backend half, or the request fails; the data is projected through the schema, so undeclared keys never reach the page. A deferred value is declared with `t.deferred(schema)`. `nifra check` reports a loader without one (NF-C030).",
+    "Builds fail on what looks like a credential in a client bundle, a `public/` file or a prerendered page; exempt a reviewed false positive with `secretExemptions` in `nifra.config.ts`.",
+    "The Cloudflare Pages target is `cloudflare` (`cf-pages` is refused), and `export const target` in `nifra.config.ts` sets what `nifra build` emits.",
+    '`withISR` no longer caches a page per query string by default: a request with any query parameter renders fresh and is not stored. Pass `query: ["page", ...]` to cache those parameters, or `query: "all"` to both `withISR` and `revalidateEndpoint` to keep the old keys.',
+    "A page file under the backend's API prefix or any other mount (`routes/api/*.tsx` with a backend) now fails at startup, at build and in `nifra check` (NF-C027), instead of answering 404. Move the page, change `apiPrefix` in `backend/framework.ts`, or serve that path from the backend.",
+    "Request methods match exactly: a request sent as `post` or `Patch` answers 405 or 404 instead of reaching the `POST`/`PATCH` route.",
+    "A request path's `.` and `..` segments (also `%2e` and backslashes) are resolved before routing on every runtime, so `/users/../posts` routes to `/posts` and `c.req.url` shows the resolved path.",
+    "A JSON body is parsed only when its media type is `application/json` or `application/*+json`; `text/plain; x=application/json` no longer parses, and server functions answer it with 415.",
+    "`revalidateEndpoint()` and `previewEndpoint()` throw at construction without a `secret`.",
+    'Rendering a hydrating page with an empty `clientEntry` throws instead of emitting `<script src="">`.',
+    'The typed client refuses a `.` or `..` path param value (`{ ok: false, status: 0, error: { error: "invalid_path" } }`) instead of sending a request to another path.',
+    "`jwt()`, `verifyCsrfToken()` and `verifyDownloadUrl()` accept only canonical unpadded base64url signatures.",
+    "In plural messages, `#` is formatted in the locale's number format (`1,000 items`), not as plain digits.",
+    "`solidBunPlugin` is exported from `@nifrajs/web-solid/plugin` and `svelteBunPlugin` from `@nifrajs/web-svelte/plugin`; the adapter roots export only the render adapter. Run `nifra fix --code NF-C005` to rewrite the imports.",
+  ],
+}

package/src/recipes/index.ts

@@ -7,6 +7,7 @@
 import { recipe as v1_8_0 } from "./1.8.0.ts"
 import { recipe as v2_0_0 } from "./2.0.0.ts"
 import { recipe as v3_0_0 } from "./3.0.0.ts"
+import { recipe as v4_0_0 } from "./4.0.0.ts"
 
 /** A pin rule: every dependency whose name starts with `match` is set to version `to`. */
 export interface PinRule {
@@ -42,6 +43,7 @@ const RECIPES: Record<string, UpgradeRecipe> = {
   [v1_8_0.version]: v1_8_0,
   [v2_0_0.version]: v2_0_0,
   [v3_0_0.version]: v3_0_0,
+  [v4_0_0.version]: v4_0_0,
 }
 
 export function getRecipe(version: string): UpgradeRecipe | undefined {

package/src/release-verification.ts

@@ -16,7 +16,8 @@ import {
 } from "./verification-plan.ts"
 
 export type ReleaseVerificationMode = VerificationPlanMode
-export type ReleaseGateStatus = "pass" | "fail" | "skipped"
+/** `undeclared`: the project's package.json has no script for the gate, so it was not run. */
+export type ReleaseGateStatus = "pass" | "fail" | "skipped" | "undeclared"
 
 export interface ReleaseGateResult {
   readonly id: string
@@ -24,6 +25,8 @@ export interface ReleaseGateResult {
   readonly commands: readonly string[]
   readonly exitCode?: number
   readonly message?: string
+  /** The last lines a failed gate's command printed, so a CI log shows why it failed. */
+  readonly output?: string
   readonly remediation: string
 }
 
@@ -33,6 +36,8 @@ export interface ReleaseVerificationResult {
   readonly gates: readonly ReleaseGateResult[]
   /** Release gates intentionally absent from the selected shorter plan. */
   readonly omittedReleaseGateIds: readonly string[]
+  /** Gates a shared runner left out; a local verification runs them. */
+  readonly localGateIds: readonly string[]
 }
 
 export interface ReleaseCommandResult {
@@ -49,6 +54,11 @@ export interface ReleaseCommandSpec {
 
 export interface ReleaseVerificationOptions {
   readonly mode?: ReleaseVerificationMode
+  /**
+   * Leave out the gates the plan keeps off CI (`workflowRequired: false`): timing on a shared
+   * runner swings too far run to run to gate a release on.
+   */
+  readonly sharedRunner?: boolean
   readonly runCommand?: (spec: ReleaseCommandSpec) => Promise<ReleaseCommandResult>
 }
 
@@ -67,6 +77,18 @@ const runBunCommand = async (spec: ReleaseCommandSpec): Promise<ReleaseCommandRe
   return { exitCode, stdout, stderr }
 }
 
+const OUTPUT_TAIL_LINES = 40
+
+/** The last lines a command printed, stdout before stderr, or undefined when it printed nothing. */
+const outputTail = (result: ReleaseCommandResult): string | undefined => {
+  const printed = [result.stdout, result.stderr]
+    .map((text) => text?.trimEnd() ?? "")
+    .filter((text) => text !== "")
+  return printed.length === 0
+    ? undefined
+    : printed.join("\n").split("\n").slice(-OUTPUT_TAIL_LINES).join("\n")
+}
+
 const parsePackage = (path: string): Record<string, unknown> | undefined => {
   try {
     const value: unknown = JSON.parse(readFileSync(path, "utf8"))
@@ -153,7 +175,7 @@ const runGate = async (
     })
     lastExitCode = result.exitCode
     if (result.exitCode !== 0) {
-      return {
+      const failed: Omit<ReleaseGateResult, "output"> & { output?: string } = {
         id: gate.id,
         status: "fail",
         commands: gate.commands.map(commandLabel),
@@ -161,6 +183,9 @@ const runGate = async (
         message: `${commandLabel(args)} exited with code ${result.exitCode}`,
         remediation: gate.remediation,
       }
+      const output = outputTail(result)
+      if (output !== undefined) failed.output = output
+      return failed
     }
   }
   return {
@@ -180,6 +205,23 @@ const skippedGate = (gate: VerificationGateSpec, failedId: string): ReleaseGateR
   remediation: `Fix the ${failedId} gate first, then rerun verification.`,
 })
 
+const undeclaredGate = (gate: VerificationGateSpec, script: string): ReleaseGateResult => ({
+  id: gate.id,
+  status: "undeclared",
+  commands: gate.commands.map(commandLabel),
+  message: `\`${script}\` is not a script in package.json`,
+  remediation: `Declare a \`${script}\` script to run this gate.`,
+})
+
+/** The first `bun run <script>` of a gate that the root package.json does not declare. */
+const undeclaredScript = (
+  gate: VerificationGateSpec,
+  scripts: ReadonlySet<string>,
+): string | undefined =>
+  gate.commands.find(
+    ([verb, script]) => verb === "run" && script !== undefined && !scripts.has(script),
+  )?.[1]
+
 /** Collect the same gate result rendered by the CLI and used by repository scripts. */
 export async function collectReleaseVerification(
   start: string,
@@ -189,14 +231,27 @@ export async function collectReleaseVerification(
   const root = await resolveVerificationRoot(start)
   const runCommand = options.runCommand ?? runBunCommand
   const fixtureRoot = mkdtempSync(join(realpathSync(tmpdir()), "nifra-verify-"))
+  const declared = parsePackage(join(root, "package.json"))?.scripts
+  const scripts = new Set(
+    declared !== null && typeof declared === "object" ? Object.keys(declared) : [],
+  )
+  const plan = gatePlan(mode)
+  const local = options.sharedRunner === true ? plan.filter((gate) => !gate.workflowRequired) : []
   const gates: ReleaseGateResult[] = []
   try {
     let failedId: string | undefined
-    for (const gate of gatePlan(mode)) {
+    for (const gate of plan) {
+      if (local.includes(gate)) continue
       if (failedId !== undefined) {
         gates.push(skippedGate(gate, failedId))
         continue
       }
+      // The plan names the nifra repository's own scripts; a project without one has nothing to run.
+      const missing = undeclaredScript(gate, scripts)
+      if (missing !== undefined) {
+        gates.push(undeclaredGate(gate, missing))
+        continue
+      }
       const result = await runGate(root, gate, runCommand, fixtureRoot)
       gates.push(result)
       if (result.status === "fail") failedId = result.id
@@ -205,10 +260,13 @@ export async function collectReleaseVerification(
     rmSync(fixtureRoot, { recursive: true, force: true })
   }
   return {
-    ok: gates.every((gate) => gate.status === "pass"),
+    ok:
+      gates.some((gate) => gate.status === "pass") &&
+      gates.every((gate) => gate.status === "pass" || gate.status === "undeclared"),
     mode,
     gates,
     omittedReleaseGateIds: omittedVerificationGateIds(mode),
+    localGateIds: local.map((gate) => gate.id),
   }
 }
 
@@ -218,7 +276,10 @@ export function renderReleaseVerification(result: ReleaseVerificationResult): st
     const marker = gate.status === "pass" ? "✓" : gate.status === "fail" ? "✗" : "-"
     lines.push(`${marker} ${gate.id}: ${gate.status}`)
     if (gate.message !== undefined) lines.push(`  ${gate.message}`)
-    if (gate.status !== "pass") lines.push(`  fix: ${gate.remediation}`)
+    if (gate.output !== undefined)
+      lines.push(...gate.output.split("\n").map((line) => `  | ${line}`))
+    if (gate.status === "fail" || gate.status === "skipped")
+      lines.push(`  fix: ${gate.remediation}`)
   }
   if (result.omittedReleaseGateIds.length > 0) {
     lines.push(
@@ -227,6 +288,13 @@ export function renderReleaseVerification(result: ReleaseVerificationResult): st
       "      run `bun run check:release` for the full release gate.",
     )
   }
+  if (result.localGateIds.length > 0) {
+    lines.push(
+      "",
+      `note: a shared runner leaves out the timing gates: ${result.localGateIds.join(", ")}`,
+      "      run `bun run check:release` locally for them.",
+    )
+  }
   lines.push("", result.ok ? "✓ verification passed" : "✗ verification failed")
   return lines.join("\n")
 }
@@ -246,6 +314,7 @@ if (import.meta.main) {
   const mode: ReleaseVerificationMode = process.argv.includes("--release") ? "release" : "default"
   const ok = await runReleaseVerification(process.cwd(), {
     mode,
+    sharedRunner: process.argv.includes("--shared-runner"),
     json: process.argv.includes("--json"),
   })
   if (!ok) process.exitCode = 1

package/src/review.ts

@@ -615,23 +615,20 @@ async function composeCollectedReport(
   const changedPaths = new Set(scope.changedPaths)
   const retainedByCheck = new Map<ReviewCheckId, CandidateFinding[]>()
   let totalOutOfScope = 0
+  let typeErrorOutOfScope = false
   for (const id of CHECK_IDS) {
-    const source = candidatesByCheck.get(id) ?? []
     const retained: CandidateFinding[] = []
-    let outOfScope = 0
-    for (const candidate of source) {
+    for (const candidate of candidatesByCheck.get(id) ?? []) {
       if (
         scope.kind === "diff" &&
         candidate.location !== undefined &&
         !changedPaths.has(candidate.location.path)
       ) {
-        outOfScope += 1
         totalOutOfScope += 1
+        if (id === "typecheck" && candidate.severity === "error") typeErrorOutOfScope = true
       } else retained.push(candidate)
     }
     retainedByCheck.set(id, retained)
-    // Store the per-check count temporarily on the scope map below through a side channel-free map.
-    void outOfScope
   }
 
   const checks: ReviewCheckResult[] = []
@@ -653,6 +650,11 @@ async function composeCollectedReport(
           : checkResult.typecheckNote?.toLowerCase().includes("typescript")
             ? "missing-typescript"
             : "unsupported"
+    } else if (id === "typecheck" && typeErrorOutOfScope) {
+      // A change can break a caller it never touched, so a type error outside the diff cannot be
+      // ruled out as this change's: the required check stays open instead of passing.
+      status = "unavailable"
+      reasonCode = "filtered-out-of-scope"
     } else if (!configured) {
       status = "skipped"
       reasonCode = "not-configured"
@@ -671,7 +673,8 @@ async function composeCollectedReport(
       id,
       required: REQUIRED_CHECKS.has(id),
       status,
-      duration: status === "unavailable" ? "timeout" : "standard",
+      duration:
+        status === "unavailable" && reasonCode !== "filtered-out-of-scope" ? "timeout" : "standard",
       counts: countsFor(retained, outOfScope),
       findingIds: retained.map((candidate) => candidate.finding.id),
       evidence: checkEvidence,
@@ -942,7 +945,9 @@ export function renderReviewReport(report: ReviewReport): readonly string[] {
   for (const check of report.checks) {
     if (check.status === "skipped") lines.push(`  skipped ${check.id}`)
     if (check.status === "unavailable" || check.status === "error")
-      lines.push(`  unavailable ${check.id}`)
+      lines.push(
+        `  unavailable ${check.id}${check.reasonCode === undefined ? "" : ` (${check.reasonCode})`}`,
+      )
   }
   return lines
 }