@nifrajs/cli 5.0.0 → 5.1.0

package/src/output-schemas.ts

@@ -267,6 +267,9 @@ async function shapeOf<T>(
     for (const property of properties) {
       if (property.name.startsWith("__@") || (await reader.callable(property.type))) continue
       const shape = await shapeOf(reader, property.type, seen, depth + 1)
+      // `key?: undefined` is how TypeScript lines up a union of object literals: a key the other
+      // members have and this one never sends.
+      if (shape.kind === "undefined" || shape.kind === "never") continue
       const defined = withoutUndefined(shape)
       fields.push({
         name: property.name,
@@ -341,6 +344,58 @@ export function schemaSource(shape: Shape, indent = ""): string {
   }
 }
 
+/** The paths a draft of `shape` leaves out: credential-like names, and values that are not JSON. */
+export function omittedPaths(shape: Shape, path = ""): string[] {
+  switch (shape.kind) {
+    case "array":
+      return omittedPaths(shape.items, `${path}[]`)
+    case "tuple":
+      return omittedPaths(unionOf(shape.items), `${path}[]`)
+    case "record":
+      return omittedPaths(shape.values, `${path}{}`)
+    case "deferred":
+      return omittedPaths(shape.value, path)
+    case "union":
+      return [...new Set(shape.members.flatMap((member) => omittedPaths(member, path)))]
+    case "object":
+      return shape.fields.flatMap((field) => {
+        const at = path === "" ? field.name : `${path}.${field.name}`
+        return isSensitiveFieldName(field.name) || field.shape.kind === "opaque"
+          ? [at]
+          : omittedPaths(field.shape, at)
+      })
+    default:
+      return []
+  }
+}
+
+/** The paths a draft of `shape` admits any value at: `any` or `unknown` there, or a type too deep or
+ * recursive to read. The output guard drops nothing below them. */
+export function openPaths(shape: Shape, path = ""): string[] {
+  switch (shape.kind) {
+    case "json":
+      return shape.reason === undefined ? [] : [path === "" ? "(the whole value)" : path]
+    case "array":
+      return openPaths(shape.items, `${path}[]`)
+    case "tuple":
+      return openPaths(unionOf(shape.items), `${path}[]`)
+    case "record":
+      return openPaths(shape.values, `${path}{}`)
+    case "deferred":
+      return openPaths(shape.value, path)
+    case "union":
+      return [...new Set(shape.members.flatMap((member) => openPaths(member, path)))]
+    case "object":
+      return shape.fields.flatMap((field) =>
+        isSensitiveFieldName(field.name) || field.shape.kind === "opaque"
+          ? []
+          : openPaths(field.shape, path === "" ? field.name : `${path}.${field.name}`),
+      )
+    default:
+      return []
+  }
+}
+
 /**
  * The paths `returned` carries that `declared` does not, as `a.b`, `items[].c`: what the output guard
  * drops before the page renders. A declared `t.json()` or record admits everything below it.
@@ -430,7 +485,7 @@ function schemaTokens(text: string): string {
 
 function declarationText(schema: OutputExport, fn: RouteFn, body: string): string {
   return [
-    `// ${GENERATED_MARK} ${hashOf(body)} - from the ${fn}'s return type; \`nifra schemas --write\` keeps it current. Delete this line to edit it by hand.`,
+    `// ${GENERATED_MARK} ${hashOf(body)} - drafted from the ${fn}'s return type; review that the browser may see every field it declares. \`nifra schemas --write\` keeps it current; delete this line to edit it by hand.`,
     `export const ${schema} = ${body}`,
   ].join("\n")
 }
@@ -618,7 +673,11 @@ function reader7(semantic: TypeScriptSemanticSession, checker: Checker7): TypeRe
 }
 
 /** Read every listed route function's return type and schema's output type through one program. */
-async function readShapes(root: string, routes: readonly ProbeRoute[]): Promise<ProbeResult> {
+async function readShapes(
+  root: string,
+  routes: readonly ProbeRoute[],
+  sources: ReadonlyMap<string, string>,
+): Promise<ProbeResult> {
   const warnings: string[] = []
   const shapes = new Map<string, Shape>()
   if (routes.length === 0) return { shapes, warnings }
@@ -658,10 +717,14 @@ async function readShapes(root: string, routes: readonly ProbeRoute[]): Promise<
       ),
       "utf8",
     )
+    // The routes and every planned file the caller supplies are read from `sources`, not the disk:
+    // a migration plans against the layout it has not written yet.
     const contents = new Map<string, string>([[probePath, probe]])
-    for (const file of routeFiles) contents.set(file, readFileSync(file, "utf8"))
+    for (const [file, text] of sources) contents.set(join(root, file), text)
+    for (const file of routeFiles)
+      if (!contents.has(file)) contents.set(file, readFileSync(file, "utf8"))
     const loaded = await loadProjectTypeScript(root, undefined, {
-      files: [...routeFiles, probePath],
+      files: [...contents.keys()],
       read: (file) => contents.get(file),
       projectConfig: probeConfigPath,
     })
@@ -704,7 +767,7 @@ async function readShapes(root: string, routes: readonly ProbeRoute[]): Promise<
       skipLibCheck: true,
       allowImportingTsExtensions: true,
     }
-    const program = ts.createProgram([probePath], options, ts.createCompilerHost(options, true))
+    const program = ts.createProgram([probePath], options, overlaidHost(ts, options, contents))
     const source = program.getSourceFile(probePath)
     if (source === undefined) {
       warnings.push("could not create the type probe")
@@ -731,6 +794,43 @@ async function readShapes(root: string, routes: readonly ProbeRoute[]): Promise<
   }
 }
 
+/** A compiler host that reads `contents` (absolute path -> text) before the disk. */
+function overlaidHost(
+  ts: TypeScriptApi,
+  options: TSApi.CompilerOptions,
+  contents: ReadonlyMap<string, string>,
+): TSApi.CompilerHost {
+  const host = ts.createCompilerHost(options, true)
+  const key = (file: string): string => posix(ts.sys.resolvePath(file))
+  const overlay = new Map([...contents].map(([file, text]) => [key(file), text]))
+  const folders = new Set<string>()
+  for (const file of overlay.keys())
+    for (let at = file.lastIndexOf("/"); at > 0; at = file.lastIndexOf("/", at - 1))
+      folders.add(file.slice(0, at))
+  const { fileExists, readFile, getSourceFile, directoryExists } = host
+  return Object.assign(host, {
+    fileExists: (file: string): boolean => overlay.has(key(file)) || fileExists.call(host, file),
+    readFile: (file: string): string | undefined =>
+      overlay.get(key(file)) ?? readFile.call(host, file),
+    directoryExists: (folder: string): boolean =>
+      folders.has(key(folder)) ||
+      (directoryExists === undefined
+        ? ts.sys.directoryExists(folder)
+        : directoryExists.call(host, folder)),
+    getSourceFile: (
+      file: string,
+      language: TSApi.ScriptTarget | TSApi.CreateSourceFileOptions,
+      onError?: (message: string) => void,
+      fresh?: boolean,
+    ): TSApi.SourceFile | undefined => {
+      const text = overlay.get(key(file))
+      return text === undefined
+        ? getSourceFile.call(host, file, language, onError, fresh)
+        : ts.createSourceFile(file, text, language)
+    },
+  })
+}
+
 // ---- planning edits ----------------------------------------------------------------------------
 
 export type OutputSchemaStatus =
@@ -755,6 +855,11 @@ export interface OutputSchemaEntry {
   /** A generated schema whose text was changed under its marker: stale though its route is not. */
   readonly edited?: boolean
   readonly reason?: string
+  /** Returned paths a draft leaves out: credential-like names, and values that are not JSON. */
+  readonly omitted?: readonly string[]
+  /** Returned paths a generated schema admits any value at, because the type there is `any` or
+   * `unknown`: the output guard drops nothing below them until the type says what is sent. */
+  readonly open?: readonly string[]
 }
 
 interface SchemaDeclaration {
@@ -872,18 +977,37 @@ function withSchemaImport(content: string): string | undefined {
     : `${content.slice(0, end)}\n${line}${content.slice(end)}`
 }
 
-interface Plan {
+export interface OutputSchemaPlan {
   readonly entries: OutputSchemaEntry[]
+  /** App-relative file -> its content with the planned schemas written. */
   readonly edits: Map<string, string>
   readonly warnings: readonly string[]
 }
 
-/** What each listed route backend half needs, and the file contents that would apply it. */
-async function plan(
+export interface OutputSchemaPlanOptions {
+  /**
+   * App-relative file -> text the types are read from instead of the disk: a layout planned but not
+   * written yet. The routes' own text comes from `read`.
+   */
+  readonly overlay?: ReadonlyMap<string, string>
+  /**
+   * Only these declarations, and only where none exists: a draft for a missing schema, never a
+   * refresh of a generated one or a change to a hand-written one.
+   */
+  readonly draft?: (file: string, schema: OutputExport) => boolean
+}
+
+/**
+ * What each listed route backend half needs, and the file contents that would apply it. `nifra
+ * schemas`, `nifra migrate layout` and the NF-C030 fix share it, so one return type drafts one schema.
+ */
+export async function planOutputSchemas(
   root: string,
   files: readonly string[],
   read: (file: string) => string | undefined,
-): Promise<Plan> {
+  options: OutputSchemaPlanOptions = {},
+): Promise<OutputSchemaPlan> {
+  const { draft } = options
   const perFile = new Map<string, { content: string; targets: Target[] }>()
   for (const file of files) {
     const content = read(file)
@@ -891,18 +1015,31 @@ async function plan(
     const targets = targetsOf(content)
     if (targets.length > 0) perFile.set(file, { content, targets })
   }
-  const probe: ProbeRoute[] = [...perFile].map(([file, { targets }]) => ({
-    file,
-    fns: targets.map((target) => target.fn),
-    schemas: targets.filter((t) => t.declaration !== undefined).map((t) => t.schema),
-  }))
-  const { shapes, warnings } = await readShapes(root, probe)
+  const chosen = (file: string, target: Target): boolean =>
+    draft === undefined || (draft(file, target.schema) && target.declaration === undefined)
+  const probe: ProbeRoute[] = [...perFile].flatMap(([file, { targets }]) => {
+    const read = targets.filter((target) => chosen(file, target))
+    return read.length === 0
+      ? []
+      : [
+          {
+            file,
+            fns: read.map((target) => target.fn),
+            schemas: read.filter((t) => t.declaration !== undefined).map((t) => t.schema),
+          },
+        ]
+  })
+  const sources = new Map(options.overlay)
+  for (const [file, { content }] of perFile) sources.set(file, content)
+  const { shapes, warnings } = await readShapes(root, probe, sources)
   const entries: OutputSchemaEntry[] = []
   const edits = new Map<string, string>()
   if (warnings.length > 0) return { entries, edits, warnings }
   for (const [file, { content, targets }] of perFile) {
+    const mask = codePositionMask(content)
     const replacements: Array<{ start: number; end: number; text: string; entry: number }> = []
     for (const target of targets) {
+      if (!chosen(file, target)) continue
       const raw = shapes.get(`${file}#${target.fn}`)
       const declared = shapes.get(`${file}#${target.schema}`)
       const { declaration } = target
@@ -912,13 +1049,16 @@ async function plan(
         dropped: readonly string[] = [],
         reason?: string,
         edited = false,
+        omitted: readonly string[] = [],
+        open: readonly string[] = [],
       ): number => {
         const schema = target.schema
         const generated = declaration?.hash !== undefined
         const base: OutputSchemaEntry = { file, line, schema, status, generated, dropped }
         const item: OutputSchemaEntry =
           reason !== undefined ? { ...base, reason } : edited ? { ...base, edited } : base
-        return entries.push(item) - 1
+        const withOmitted = omitted.length === 0 ? item : { ...item, omitted }
+        return entries.push(open.length === 0 ? withOmitted : { ...withOmitted, open }) - 1
       }
       if (target.annotated) {
         // A `Route.Loader` annotation returns the schema's own input type: comparing the two would
@@ -956,8 +1096,19 @@ async function plan(
         continue
       }
       const body = schemaSource(returned)
+      const omitted = omittedPaths(returned)
+      const open = openPaths(returned)
       if (declaration === undefined) {
-        const at = entry("missing")
+        // The name bound any other way (declared, imported) would clash with the one written here.
+        if (new RegExp(`(?<![\\w$.])${target.schema}(?![\\w$])`).test(mask)) {
+          entry(
+            "missing",
+            [],
+            `\`${target.schema}\` already names something in this file, so no draft was written`,
+          )
+          continue
+        }
+        const at = entry("missing", [], undefined, false, omitted, open)
         const written = declarationText(target.schema, target.fn, body)
         const text = target.insertAt === content.length ? `\n${written}\n` : `${written}\n\n`
         replacements.push({ start: target.insertAt, end: target.insertAt, text, entry: at })
@@ -965,11 +1116,11 @@ async function plan(
         declaration.hash === hashOf(body) &&
         schemaTokens(declaration.value) === schemaTokens(body)
       ) {
-        entry("current")
+        entry("current", [], undefined, false, [], open)
       } else {
         // The marker still matches what would be written, so the text under it was edited.
         const edited = declaration.hash === hashOf(body)
-        const at = entry("stale", dropped, undefined, edited)
+        const at = entry("stale", dropped, undefined, edited, omitted, open)
         const text = declarationText(target.schema, target.fn, body)
         replacements.push({ start: declaration.start, end: declaration.end, text, entry: at })
       }
@@ -1024,10 +1175,10 @@ export interface OutputSchemasReport {
  */
 export async function outputSchemas(
   dir: string,
-  options: { readonly write?: boolean } = {},
+  options: { readonly write?: boolean; readonly check?: boolean } = {},
 ): Promise<OutputSchemasReport> {
   const write = options.write === true
-  const { entries, edits, warnings } = await plan(dir, routeBackends(dir), (file) => {
+  const { entries, edits, warnings } = await planOutputSchemas(dir, routeBackends(dir), (file) => {
     try {
       return readFileSync(join(dir, file), "utf8")
     } catch {
@@ -1051,8 +1202,13 @@ export async function outputSchemas(
             : entry,
     )
   }
+  // `check` also fails what a review still owes: a schema not written yet, and one that admits anything.
+  const owed = (entry: OutputSchemaEntry): boolean =>
+    entry.status === "missing" || (entry.open?.length ?? 0) > 0
   return {
-    ok: warnings.length === 0 && !final.some((entry) => entry.status === "stale"),
+    ok:
+      warnings.length === 0 &&
+      !final.some((entry) => entry.status === "stale" || (options.check === true && owed(entry))),
     write,
     entries: final,
     written,
@@ -1075,7 +1231,7 @@ export async function staleGeneratedSchemas(
 }> {
   const marked = files.filter((file) => read(file)?.includes(GENERATED_MARK) === true)
   if (marked.length === 0) return { stale: [], unchecked: [], warnings: [] }
-  const { entries, warnings } = await plan(root, marked, read)
+  const { entries, warnings } = await planOutputSchemas(root, marked, read)
   return {
     stale: entries.filter((entry) => entry.status === "stale"),
     unchecked: entries.filter((entry) => entry.generated && entry.status === "unreadable"),

package/src/project-path.ts

@@ -1,6 +1,45 @@
-import { realpath } from "node:fs/promises"
+import { lstatSync, readlinkSync, realpathSync } from "node:fs"
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path"
 
+const MAX_SYMLINKS = 40
+
+function errorCode(error: unknown): unknown {
+  return typeof error === "object" && error !== null ? Reflect.get(error, "code") : undefined
+}
+
+/**
+ * Where a write to `path` lands, canonicalized: the real path of its nearest existing ancestor plus
+ * the components still missing below it. A dangling symlink is followed to the path it names, since
+ * writing through it creates that path. `undefined` when the filesystem cannot say.
+ */
+export function writeTargetOf(path: string): string | undefined {
+  let probe = resolve(path)
+  const missing: string[] = []
+  let links = 0
+  for (;;) {
+    try {
+      return resolve(realpathSync(probe), ...[...missing].reverse())
+    } catch (error) {
+      if (errorCode(error) !== "ENOENT") return undefined
+    }
+    let link: string | undefined
+    try {
+      if (lstatSync(probe).isSymbolicLink()) link = readlinkSync(probe)
+    } catch (error) {
+      if (errorCode(error) !== "ENOENT") return undefined
+    }
+    if (link !== undefined) {
+      if (++links > MAX_SYMLINKS) return undefined
+      probe = resolve(dirname(probe), link)
+      continue
+    }
+    const parent = dirname(probe)
+    if (parent === probe) return undefined
+    missing.push(basename(probe))
+    probe = parent
+  }
+}
+
 function escapesRoot(root: string, candidate: string): boolean {
   const rel = relative(root, candidate)
   return rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)
@@ -17,18 +56,10 @@ export async function resolveInsideProject(
     const resolved = resolve(resolvedRoot, candidate)
     if (escapesRoot(resolvedRoot, resolved)) return undefined
 
-    const realRoot = await realpath(resolvedRoot)
-    let realCandidate: string
-    try {
-      realCandidate = await realpath(resolved)
-    } catch (error) {
-      if (!(error && typeof error === "object" && (error as { code?: string }).code === "ENOENT")) {
-        return undefined
-      }
-      const realParent = await realpath(dirname(resolved))
-      realCandidate = resolve(realParent, basename(resolved))
-    }
-    if (escapesRoot(realRoot, realCandidate)) return undefined
+    // The same canonicalizer on both sides: fs/promises expands Windows 8.3 names, realpathSync does not.
+    const realRoot = realpathSync(resolvedRoot)
+    const realCandidate = writeTargetOf(resolved)
+    if (realCandidate === undefined || escapesRoot(realRoot, realCandidate)) return undefined
     return resolved
   } catch {
     return undefined

package/src/release-verification.ts

@@ -59,6 +59,11 @@ export interface ReleaseVerificationOptions {
    * runner swings too far run to run to gate a release on.
    */
   readonly sharedRunner?: boolean
+  /**
+   * Fail a gate whose script package.json does not declare, instead of reporting it `undeclared`.
+   * The repository's own gate runs every gate in its plan, so a renamed script cannot drop one.
+   */
+  readonly requireScripts?: boolean
   readonly runCommand?: (spec: ReleaseCommandSpec) => Promise<ReleaseCommandResult>
 }
 
@@ -213,6 +218,14 @@ const undeclaredGate = (gate: VerificationGateSpec, script: string): ReleaseGate
   remediation: `Declare a \`${script}\` script to run this gate.`,
 })
 
+const missingScriptGate = (gate: VerificationGateSpec, script: string): ReleaseGateResult => ({
+  id: gate.id,
+  status: "fail",
+  commands: gate.commands.map(commandLabel),
+  message: `\`${script}\` is not a script in package.json`,
+  remediation: `Declare the \`${script}\` script this gate runs, or rename the gate's command to the script that replaced it.`,
+})
+
 /** The first `bun run <script>` of a gate that the root package.json does not declare. */
 const undeclaredScript = (
   gate: VerificationGateSpec,
@@ -248,6 +261,12 @@ export async function collectReleaseVerification(
       }
       // The plan names the nifra repository's own scripts; a project without one has nothing to run.
       const missing = undeclaredScript(gate, scripts)
+      if (missing !== undefined && options.requireScripts === true) {
+        const result = missingScriptGate(gate, missing)
+        gates.push(result)
+        failedId = result.id
+        continue
+      }
       if (missing !== undefined) {
         gates.push(undeclaredGate(gate, missing))
         continue
@@ -315,6 +334,7 @@ if (import.meta.main) {
   const ok = await runReleaseVerification(process.cwd(), {
     mode,
     sharedRunner: process.argv.includes("--shared-runner"),
+    requireScripts: true,
     json: process.argv.includes("--json"),
   })
   if (!ok) process.exitCode = 1

package/src/review.ts

@@ -152,6 +152,8 @@ export const CHECK_CODES: Readonly<Record<string, ReviewCheckId>> = {
   "NF-C038": "configuration",
   "NF-C039": "contract-witness",
   "NF-C040": "route-boundary",
+  "NF-C041": "route-boundary",
+  "NF-C042": "route-boundary",
   "NF-D001": "dependency",
   "NF-D002": "dependency",
   "NF-A001": "route-assurance",
@@ -456,8 +458,11 @@ async function diffScope(cwd: string, ref: string): Promise<ReviewScope> {
   if (!verified.ok) throw new ReviewInputError("invalid git ref")
   const commit = verified.stdout.trim()
   if (!/^[0-9a-f]{40,64}$/.test(commit)) throw new ReviewInputError("invalid git ref")
+  // `--relative` keeps tracked paths app-relative, like `ls-files` and every finding, when the app is a
+  // subdirectory of the repository; without it no finding in a changed tracked file is in scope.
   const changed = await runGit(cwd, [
     "diff",
+    "--relative",
     "--name-only",
     "-z",
     "--diff-filter=ACDMRTUXB",

package/src/rules/codes.ts

@@ -31,12 +31,14 @@ export const RULE_CODES = Object.freeze({
   "NF-C032": "Credential in browser code",
   "NF-C033": "Generated output schema out of date",
   "NF-C034": "Root status page wraps the root layout itself",
-  "NF-C035": "Backend mounted at the implicit /api",
+  "NF-C035": "Backend not served over HTTP",
   "NF-C036": "Route path the static scan cannot read",
   "NF-C037": "API-only declaration over a web app",
   "NF-C038": "Retired root layout file",
   "NF-C039": "Implemented contract operation the backend does not serve",
   "NF-C040": "Layout meta reads data its layout never loads",
+  "NF-C041": "Server-only export in a route frontend file",
+  "NF-C042": "Layout loader refuses access without a gate",
   "NF-C020": "Island enhancer cleanup check",
   "NF-C021": "nano binding cleanup check",
   "NF-C022": "nano bindList key check",

package/src/rules/data-guard.ts

@@ -264,6 +264,32 @@ export function missingOutputSchemas(content: string): MissingOutputSchema[] {
   return missing
 }
 
+const GENERATED_LINE = /^[ \t]*\/\/ nifra:generated [0-9a-f]{8}\b/
+const OPEN_DRAFT = /\bt\.json\(\)\s*\/\*\s*(any|unknown) in the source type\s*\*\//g
+
+/** Where a generated output schema (the export under a `nifra:generated` line) admits any value: the
+ * note `nifra schemas` writes beside a `t.json()` drafted from `any` or `unknown`. */
+export function openDraftLines(content: string): Array<{ line: number; type: string }> {
+  const found: Array<{ line: number; type: string }> = []
+  let marked = false
+  let generated = false
+  for (const [index, text] of content.split("\n").entries()) {
+    if (GENERATED_LINE.test(text)) {
+      marked = true
+      continue
+    }
+    if (/^export\s/.test(text)) {
+      generated = marked
+      marked = false
+    }
+    if (!generated) continue
+    for (const match of text.matchAll(OPEN_DRAFT)) {
+      found.push({ line: index + 1, type: match[1] ?? "any" })
+    }
+  }
+  return found
+}
+
 export const missingOutputRule: CheckRule = {
   code: "NF-C030",
   title: "Route data without an output schema",
@@ -289,10 +315,24 @@ export const missingOutputRule: CheckRule = {
               `missing: ${schema}`,
               ...(proven ? ["returns: a data literal"] : []),
             ],
+            fix: { recipe: "schemas.draft", command: "nifra fix --code NF-C030" },
             verify: "nifra check",
           }),
         )
       }
+      for (const { line, type } of openDraftLines(content)) {
+        findings.push(
+          diagnostic({
+            code: "NF-C030",
+            severity: "warn",
+            file,
+            line,
+            message: `${file}'s generated output schema admits any value here, because the type it was drafted from is ${type} at this point: the output guard drops nothing below it. Give that value a type, then run \`nifra schemas --write\`.`,
+            evidence: [`draft: t.json() from ${type}`],
+            verify: "nifra schemas --check",
+          }),
+        )
+      }
     }
     return findings.sort(byPlace)
   },

package/src/rules/legacy.ts

@@ -345,6 +345,25 @@ const typecheckRule: CheckRule = {
         }),
       )
     }
+    if (tc.sourcesWithoutTsconfig !== undefined) {
+      findings.push(
+        legacyDiagnostic("typecheck", {
+          severity: "error",
+          file: "tsconfig.json",
+          message: `${tc.sourcesWithoutTsconfig} TypeScript file(s) but no tsconfig.json in this directory - the typecheck gate did NOT run`,
+          fix: "add a tsconfig.json that includes the project's sources",
+          suggestion: {
+            kind: "manual",
+            title: "Add a tsconfig.json so the contract gate can run",
+            steps: [
+              "Create tsconfig.json in the directory `nifra check` runs from, with `include` covering the project's TypeScript sources.",
+              "In a monorepo, run `nifra check` from each app that has its own tsconfig.json.",
+              "Run `nifra_check` again: the typecheck now runs `tsc --noEmit -p tsconfig.json`.",
+            ],
+          },
+        }),
+      )
+    }
     if (tc.ran && !tc.ok) {
       const lines = (tc.output ?? "").split("\n")
       let matched = false
@@ -1083,7 +1102,9 @@ const contractRule: CheckRule = {
         }),
       ]
     }
-    if (contract.vacuous) {
+    // `vacuous` describes the routes as they are now, so it only stands in for drift when the lock has
+    // none: a lock whose schemas were all deleted is drift, not an empty contract.
+    if (contract.vacuous && contract.error === undefined && contract.diagnostics.length === 0) {
       return [
         diagnostic({
           code: LEGACY_RULE_CODES["contract-drift"]!,