@orkestrel/probe 0.0.1

package/dist/src/server/index.js

@@ -0,0 +1,2321 @@
+import { createRequire } from "node:module";
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { attempt, compileGuard, compileSchema, isArray, isRecord, schemaToParameters } from "@orkestrel/contract";
+import { CLAIM_SHAPE, ProbeError, computeReceipt, createDestroyedError, formatCheck, formatSpecification, formatVerdict, isClaim, isDraft, isVerdict, matchesSpecification } from "../core/index.js";
+import { Emitter } from "@orkestrel/emitter";
+import { createQueue } from "@orkestrel/queue";
+import { createTimeout } from "@orkestrel/timeout";
+import { spawn } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { PassThrough } from "node:stream";
+import { setImmediate } from "node:timers/promises";
+import { createMCPLegacy, createMCPServer } from "@orkestrel/mcp";
+import { createStdioServer } from "@orkestrel/mcp/server";
+import { createTool, createToolManager } from "@orkestrel/tool";
+//#region src/server/helpers.ts
+/**
+* Rewrites one path into the forward-slash spelling this package compares and reports paths in.
+*
+* @remarks
+* Windows reports a path with backslashes and accepts either separator, so two spellings of one
+* file compare unequal until they are rewritten. Every path this package keys a map on, matches a
+* prefix against, or hands a caller passes through here first.
+*
+* @param path - The path to rewrite
+* @returns The same path with every backslash replaced by a forward slash
+*
+* @example
+* ```ts
+* normalizePath('src\\core\\greeting.ts') // 'src/core/greeting.ts'
+* normalizePath('src/core/greeting.ts') // 'src/core/greeting.ts'
+* ```
+*/
+function normalizePath(path) {
+	return path.replaceAll("\\", "/");
+}
+/**
+* Resolves a path inside a target workspace and rejects traversal outside it.
+*
+* @remarks
+* A native `ENAMETOOLONG` or NUL-byte `ERR_INVALID_ARG_VALUE` fault is a claimant refusal. This
+* classifies the fault, not the author: a workspace nested deeply enough that this package's short
+* generated names overflow the host limit also reads as a claimant refusal.
+*
+* @param workspace - The target workspace root
+* @param target - A workspace-relative path
+* @param mutate - If `true`, refuses a symbolic link in an existing descendant; if `false`,
+* resolves lexically. Default: `false`
+* @returns The absolute contained path
+* @throws When the path resolves outside the workspace, mutation would cross a symbolic link, or
+* the target tree cannot be inspected
+*
+* @example
+* ```ts
+* resolveWorkspaceFile('/srv/checkout', 'src/core/greeting.ts')
+* // '/srv/checkout/src/core/greeting.ts'
+* resolveWorkspaceFile('/srv/checkout', '../secrets.env')
+* // throws: Path escapes the workspace: ../secrets.env
+* ```
+*/
+function resolveWorkspaceFile(workspace, target, mutate = false) {
+	const root = resolve(workspace);
+	const file = resolve(root, target);
+	const path = relative(root, file);
+	if (path === "" || path === ".." || path.startsWith(`..${sep}`) || isAbsolute(path)) throw new ProbeError(`Path escapes the workspace: ${target}`, {
+		origin: "claimant",
+		code: "refused",
+		context: { path: target }
+	});
+	if (!mutate) return file;
+	try {
+		const canonical = realpathSync(root);
+		let descendant = root;
+		for (const segment of path.split(sep)) {
+			descendant = resolve(descendant, segment);
+			const outcome = attempt(() => lstatSync(descendant));
+			if (!outcome.success) {
+				const error = outcome.error;
+				if (typeof error === "object" && error !== null && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR")) break;
+				throw error;
+			}
+			if (outcome.value.isSymbolicLink()) throw new ProbeError(`Path crosses a symbolic link: ${target}`, {
+				origin: "workspace",
+				code: "refused",
+				context: { path: target }
+			});
+			const resolved = realpathSync(descendant);
+			const remainder = relative(canonical, resolved);
+			if (remainder === ".." || remainder.startsWith(`..${sep}`) || isAbsolute(remainder)) throw new ProbeError(`Path escapes the workspace: ${target}`, {
+				origin: "claimant",
+				code: "refused",
+				context: { path: target }
+			});
+		}
+	} catch (error) {
+		if (error instanceof ProbeError) throw error;
+		const claimant = typeof error === "object" && error !== null && "code" in error && (error.code === "ENAMETOOLONG" || error.code === "ERR_INVALID_ARG_VALUE");
+		throw new ProbeError(`The workspace path cannot be inspected: ${target}`, {
+			origin: claimant ? "claimant" : "workspace",
+			code: claimant ? "refused" : "malformed",
+			context: { path: target },
+			cause: error
+		});
+	}
+	return file;
+}
+/**
+* Projects an absolute tool path into the workspace-relative form issues expose.
+*
+* @param workspace - The target workspace root
+* @param file - The path a tool reported
+* @returns A forward-slash workspace-relative path
+*
+* @example
+* ```ts
+* relativeWorkspaceFile('/srv/checkout', '/srv/checkout/src/core/greeting.ts')
+* // 'src/core/greeting.ts'
+* ```
+*/
+function relativeWorkspaceFile(workspace, file) {
+	return normalizePath(relative(resolve(workspace), resolve(file)));
+}
+/**
+* Resolves one installed module from the target workspace.
+*
+* @param workspace - The target workspace root
+* @param specifier - The module specifier to resolve
+* @returns The installed module entry path
+* @throws When the workspace does not install the module
+*
+* @example
+* ```ts
+* resolveWorkspaceModule(process.cwd(), 'typescript/package.json') ===
+* 	readWorkspaceManifest(process.cwd(), 'typescript').path // true
+* ```
+*/
+function resolveWorkspaceModule(workspace, specifier) {
+	const outcome = attempt(() => createRequire(resolve(workspace, "package.json")).resolve(specifier));
+	if (outcome.success) return outcome.value;
+	const error = outcome.error;
+	const missing = typeof error === "object" && error !== null && "code" in error && error.code === "MODULE_NOT_FOUND";
+	throw new ProbeError(`The workspace cannot resolve ${specifier}`, {
+		origin: "workspace",
+		code: missing ? "missing" : "malformed",
+		context: { name: specifier },
+		cause: error
+	});
+}
+function loadWorkspaceModule(workspace, specifier) {
+	const outcome = attempt(() => {
+		const require = createRequire(resolve(workspace, "package.json"));
+		return specifier === "typescript" ? require("typescript") : require("vitest/node");
+	});
+	if (outcome.success) return outcome.value;
+	const error = outcome.error;
+	const missing = typeof error === "object" && error !== null && "code" in error && error.code === "MODULE_NOT_FOUND";
+	throw new ProbeError(`The workspace cannot load ${specifier}`, {
+		origin: "workspace",
+		code: missing ? "missing" : "malformed",
+		context: { name: specifier },
+		cause: error
+	});
+}
+/**
+* Reads one installed package manifest from the target workspace.
+*
+* @param workspace - The target workspace root
+* @param name - The installed package name
+* @returns The manifest's absolute path and parsed record
+* @throws When the package cannot be resolved, read, parsed, or does not publish a record manifest
+*
+* @example
+* ```ts
+* const manifest = readWorkspaceManifest(process.cwd(), 'typescript')
+* console.log(manifest.contents.version)
+* ```
+*/
+function readWorkspaceManifest(workspace, name) {
+	let path;
+	try {
+		path = resolveWorkspaceModule(workspace, `${name}/package.json`);
+	} catch (error) {
+		if (!(error instanceof ProbeError)) throw error;
+		throw new ProbeError(`${name} does not publish a readable manifest`, {
+			origin: "workspace",
+			code: error.code,
+			context: { name },
+			cause: error.cause
+		});
+	}
+	const reading = attempt(() => readFileSync(path, "utf8"));
+	if (!reading.success) {
+		const error = reading.error;
+		const missing = typeof error === "object" && error !== null && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+		throw new ProbeError(`${name} does not publish a readable manifest`, {
+			origin: "workspace",
+			code: missing ? "missing" : "malformed",
+			context: {
+				name,
+				path
+			},
+			cause: error
+		});
+	}
+	const parsing = attempt(() => JSON.parse(reading.value));
+	if (!parsing.success) throw new ProbeError(`${name} does not publish a readable manifest`, {
+		origin: "workspace",
+		code: "malformed",
+		context: {
+			name,
+			path
+		},
+		cause: parsing.error
+	});
+	const contents = parsing.value;
+	if (!isRecord(contents)) throw new ProbeError(`${name} does not publish a readable manifest`, {
+		origin: "workspace",
+		code: "malformed",
+		context: {
+			name,
+			path
+		}
+	});
+	return {
+		path,
+		contents
+	};
+}
+/**
+* Resolves a package's portable JavaScript binary from the target workspace.
+*
+* @param workspace - The target workspace root
+* @param name - The installed package name and binary key
+* @returns The absolute JavaScript entry named by the package's `bin` field
+* @throws When the package does not publish a binary under the requested name
+*
+* @example
+* ```ts
+* relativeWorkspaceFile(process.cwd(), resolveWorkspaceBinary(process.cwd(), 'oxlint'))
+* // 'node_modules/oxlint/bin/oxlint'
+* resolveWorkspaceBinary(process.cwd(), 'typescript')
+* // throws: typescript does not publish the typescript binary
+* ```
+*/
+function resolveWorkspaceBinary(workspace, name) {
+	const manifest = readWorkspaceManifest(workspace, name);
+	const bin = manifest.contents.bin;
+	if (bin === void 0) throw new ProbeError(`${name} does not publish a bin field`, {
+		origin: "workspace",
+		code: "missing",
+		context: { name }
+	});
+	if (typeof bin === "string") return resolve(manifest.path, "..", bin);
+	if (!isRecord(bin) || !(name in bin)) throw new ProbeError(`${name} does not publish the ${name} binary`, {
+		origin: "workspace",
+		code: "missing",
+		context: { name }
+	});
+	const entry = bin[name];
+	if (typeof entry !== "string") throw new ProbeError(`${name} publishes an invalid ${name} binary`, {
+		origin: "workspace",
+		code: "malformed",
+		context: {
+			name,
+			value: entry
+		}
+	});
+	return resolve(manifest.path, "..", entry);
+}
+/**
+* Selects the scoped TypeScript project for one candidate draft path.
+*
+* @param path - The workspace-relative candidate draft path
+* @returns The workspace-relative scoped project path
+* @throws When the path does not name a configured source or application environment
+*
+* @example
+* ```ts
+* inferTypeProject('src/core/greeting.ts') // 'configs/src/tsconfig.core.json'
+* inferTypeProject('tests/src/core/greeting.test.ts')
+* // throws: Cannot infer a scoped TypeScript project for tests/src/core/greeting.test.ts
+* ```
+*/
+function inferTypeProject(path) {
+	const [axis, environment] = normalizePath(path).split("/");
+	if (axis !== "src" && axis !== "app" || environment === void 0 || environment === "") throw new ProbeError(`Cannot infer a scoped TypeScript project for ${path}`, {
+		origin: "claimant",
+		code: "refused",
+		context: { path }
+	});
+	return `configs/${axis}/tsconfig.${environment}.json`;
+}
+/**
+* Selects the Vitest project whose environment matches one test path.
+*
+* @remarks
+* There is no root-project fallback. A path no configured project collects returns `undefined`,
+* and the runtime stage refuses that claimant test with `code: 'missing'` rather than running it
+* somewhere the workspace never configured.
+*
+* @param path - The workspace-relative test path
+* @returns The matching project's name, or `undefined` when no configured project collects the path
+*
+* @example
+* ```ts
+* inferTestProject('tmp/probe/greeting.test.ts') // 'probe'
+* inferTestProject('tests/src/server/helpers.test.ts') // 'src:server'
+* inferTestProject('tests/config.test.ts') // undefined
+* ```
+*/
+function inferTestProject(path) {
+	const [root, axis, environment] = normalizePath(path).split("/");
+	if (root === "tmp" && axis === "probe") return "probe";
+	if (root !== "tests" || axis === void 0 || environment === void 0) return void 0;
+	if (axis !== "src" && axis !== "app") return void 0;
+	return `${axis}:${environment}`;
+}
+/**
+* Selects the Language Server Protocol language identifier for a source path.
+*
+* @param path - The source path whose extension selects the language
+* @returns The matching JavaScript or TypeScript language identifier
+*
+* @example
+* ```ts
+* inferDocumentLanguage('src/core/greeting.ts') // 'typescript'
+* inferDocumentLanguage('src/browser/Panel.tsx') // 'typescriptreact'
+* ```
+*/
+function inferDocumentLanguage(path) {
+	const extension = extname(path).toLowerCase();
+	if (extension === ".tsx") return "typescriptreact";
+	if (extension === ".js" || extension === ".mjs" || extension === ".cjs") return "javascript";
+	if (extension === ".jsx") return "javascriptreact";
+	return "typescript";
+}
+/**
+* Creates a fresh sibling identity while preserving a test's resolution directory.
+*
+* @param workspace - The target workspace root
+* @param path - The workspace-relative test path
+* @param revision - The fresh revision identity
+* @returns An absolute sibling file path
+*
+* @example
+* ```ts
+* relativeWorkspaceFile(
+* 	'/srv/checkout',
+* 	createRevisionFile('/srv/checkout', 'tmp/probe/greeting.test.ts', '4821-9f0c'),
+* )
+* // 'tmp/probe/greeting.test.probe-4821-9f0c.ts'
+* ```
+*/
+function createRevisionFile(workspace, path, revision) {
+	const file = resolveWorkspaceFile(workspace, path);
+	const extension = extname(file);
+	return `${extension === "" ? file : file.slice(0, -extension.length)}.probe-${revision}${extension}`;
+}
+/**
+* Reports whether a path is a workspace module Vitest can cache.
+*
+* @param path - The candidate file path
+* @returns True for script, TypeScript, Vue, and JSON modules; false otherwise
+*
+* @example
+* ```ts
+* matchesWorkspaceModule('src/core/greeting.ts') // true
+* matchesWorkspaceModule('src/styles/tokens.css') // false
+* ```
+*/
+function matchesWorkspaceModule(path) {
+	return /\.(?:[cm]?[jt]sx?|vue|json)$/.test(path);
+}
+/**
+* Reads a JSON-RPC frame's declared byte length.
+*
+* @param header - The frame header text without its terminating empty line
+* @returns The non-negative content length, or `undefined` for an invalid header
+*
+* @example
+* ```ts
+* parseContentLength('Content-Length: 128') // 128
+* parseContentLength('Content-Type: application/json') // undefined
+* ```
+*/
+function parseContentLength(header) {
+	const text = /(?:^|\r\n)Content-Length:\s*(\d+)(?:\r\n|$)/i.exec(header)?.[1];
+	if (text === void 0) return void 0;
+	const length = Number.parseInt(text, 10);
+	return Number.isSafeInteger(length) && length >= 0 ? length : void 0;
+}
+/**
+* Normalizes a caught or foreign error into readable text.
+*
+* @param value - The value to describe
+* @returns Its message when present, or its string representation
+*
+* @example
+* ```ts
+* describeUnknown(new Error('The lint stage has been destroyed'))
+* // 'The lint stage has been destroyed'
+* describeUnknown(17) // '17'
+* ```
+*/
+function describeUnknown(value) {
+	if (value instanceof Error) return value.message;
+	if (typeof value === "object" && value !== null && "message" in value && typeof value.message === "string") return value.message;
+	return String(value);
+}
+/**
+* Names every draft member of a claim-shaped value whose `path` this package's guard refuses.
+*
+* @remarks
+* The published claim schema constrains `Draft.path` to a non-empty string and nothing else, while
+* `isDraft` also refuses an absolute path and one that escapes the workspace. That one member is
+* the whole of the difference between the advertised contract and the enforced one, so a caller
+* refused after satisfying the schema is refused here and nowhere else. The whole input must first
+* satisfy that schema. Each draft is then tested with `isDraft` itself rather than with a second
+* copy of its rule. Reports nothing for a value carrying no draft member, including one refused for
+* a member this contract does not declare.
+*
+* This function lives in the server helpers rather than in core: core's leaf pair, `helpers.ts` and
+* `validators.ts`, may not consume the shapes module this function reads `CLAIM_SHAPE` from, and
+* `ProbeServer` is the sole consumer of the result it returns.
+*
+* @param value - The rejected tool input
+* @returns The dotted member names, in `case` then `control` order, or an empty list
+*
+* @example
+* ```ts
+* const test = { path: 'tmp/probe/greeting.test.ts', text: '' }
+* findRefusedPaths({
+* 	project: 'tsconfig.json',
+* 	case: { files: [{ path: '../../etc/hosts', text: '' }], test },
+* 	control: { files: [], test, stage: 'type', reason: 'must not compile' },
+* })
+* // ['case.files.0.path']
+* ```
+*/
+function findRefusedPaths(value) {
+	if (!compileGuard(CLAIM_SHAPE)(value)) return [];
+	const members = [];
+	for (const phase of ["case", "control"]) {
+		const subject = value[phase];
+		const drafts = /* @__PURE__ */ new Map([[`${phase}.test`, subject.test]]);
+		for (const [index, file] of subject.files.entries()) drafts.set(`${phase}.files.${index}`, file);
+		for (const [member, draft] of drafts) {
+			if (isDraft(draft)) continue;
+			members.push(`${member}.path`);
+		}
+	}
+	return members;
+}
+/**
+* Rewrites every workspace-contained absolute path in a value to its workspace-relative form and
+* sorts every record's keys.
+*
+* @remarks
+* A parsed TypeScript project carries the absolute root it was parsed at, so the same commit
+* checked out at two paths produces two values that describe one configuration. Rewriting those
+* members makes the value portable and stops a host path leaking into anything derived from it. A
+* path that escapes the workspace is left as it stands, because rewriting it would name a file
+* outside the tree by a relative spelling. Key order is the parser's, not the configuration's, so
+* sorting removes a difference that means nothing.
+*
+* @param workspace - The target workspace root
+* @param value - The value to rewrite
+* @returns The value with contained absolute paths made relative and every record key sorted
+*
+* @example
+* ```ts
+* normalizeValue('/srv/checkout', { rootDir: '/srv/checkout/src/core', strict: true })
+* // { rootDir: 'src/core', strict: true }
+* ```
+*/
+function normalizeValue(workspace, value) {
+	const root = resolve(workspace);
+	if (typeof value === "string") {
+		if (!isAbsolute(value)) return value;
+		const path = relative(root, resolve(value));
+		if (path === "") return ".";
+		if (path === ".." || path.startsWith(`..${sep}`) || isAbsolute(path)) return value;
+		return normalizePath(path);
+	}
+	if (isArray(value)) return value.map((entry) => normalizeValue(workspace, entry));
+	if (isRecord(value)) {
+		const record = {};
+		for (const key of Object.keys(value).sort()) record[key] = normalizeValue(workspace, value[key]);
+		return record;
+	}
+	return value;
+}
+/**
+* Computes the canonical digest of one value as it stands in a target workspace.
+*
+* @remarks
+* Digests the normalized value rather than the value itself, so one commit read at two absolute
+* roots produces one digest and a digest carries no host path. The result is the leading 32 hex
+* characters of a SHA-256 over the normalized JSON.
+*
+* @param workspace - The target workspace root the value's paths are read against
+* @param value - The value to digest
+* @returns 32 lowercase hex characters
+*
+* @example
+* ```ts
+* computeDigest('/srv/checkout', { strict: true }).length // 32
+* ```
+*/
+function computeDigest(workspace, value) {
+	return createHash("sha256").update(JSON.stringify(normalizeValue(workspace, value))).digest("hex").slice(0, 32);
+}
+/**
+* Records the listeners one emitter carries for a set of events.
+*
+* @param emitter - The emitter to read
+* @param events - The event names to record
+* @returns The listeners each named event carries at the moment of the call
+*
+* @example
+* ```ts
+* const capture = captureListeners(process, ['SIGTERM'])
+* capture.get('SIGTERM')?.length === process.listenerCount('SIGTERM') // true
+* ```
+*/
+function captureListeners(emitter, events) {
+	const capture = /* @__PURE__ */ new Map();
+	for (const event of events) capture.set(event, emitter.listeners(event));
+	return capture;
+}
+/**
+* Removes every listener one emitter gained for the captured events since its capture.
+*
+* @remarks
+* Compares identity rather than name, so a listener whose name a dependency changes between
+* releases is still recognized and a listener that merely shares a name is still left alone. A
+* listener the capture already held survives, and a listener the capture held that has since been
+* removed is not restored.
+*
+* A gain is not evidence of who caused it, so this reads every gain as the callee's. Call it only
+* across a window nothing else can attach in — a synchronous call, or a call whose handlers land
+* before its first await and that is released as it returns — because a listener anyone else
+* attaches inside that window is removed with the rest. Where a caller cannot promise that window,
+* hold each handler as a field and remove it by reference instead of capturing at all.
+*
+* @param emitter - The emitter to release
+* @param capture - The listeners the emitter carried at capture time
+* @returns Nothing
+*
+* @example
+* ```ts
+* const capture = captureListeners(process, ['SIGTERM'])
+* process.on('SIGTERM', () => {})
+* releaseListeners(process, capture)
+* process.listenerCount('SIGTERM') === capture.get('SIGTERM')?.length // true
+* ```
+*/
+function releaseListeners(emitter, capture) {
+	for (const [event, captured] of capture) for (const listener of emitter.listeners(event)) {
+		if (captured.includes(listener)) continue;
+		emitter.removeListener(event, listener);
+	}
+}
+//#endregion
+//#region src/server/Overlay.ts
+/**
+* Holds the candidate drafts one inspection substitutes for the files a tool would read from disk.
+*
+* @remarks
+* One overlay belongs to one inspection: the inspection creates it, records every candidate it
+* carries, and clears it when the inspection ends. Each stage adapts the same set to the host its
+* own tool expects rather than sharing one filesystem across tools. A fresh identity per instance
+* is what makes a resident tool re-read a path this overlay holds, so two inspections that supply
+* different text for one path never share a cached answer.
+*
+* @example
+* ```ts
+* const overlay = new Overlay()
+* overlay.set('/srv/checkout/src/core/greeting.ts', "export const GREETING = 'hi'\n")
+* console.log(overlay.text('/srv/checkout/src/core/greeting.ts'))
+* overlay.clear()
+* ```
+*/
+var Overlay = class {
+	#revision = randomUUID();
+	#candidates = /* @__PURE__ */ new Map();
+	get revision() {
+		return this.#revision;
+	}
+	get paths() {
+		return [...this.#candidates.keys()];
+	}
+	/**
+	* Records one candidate's text against the absolute path it stands in for.
+	*
+	* @param path - The absolute path the candidate replaces
+	* @param text - The candidate's full contents
+	* @returns Nothing
+	*/
+	set(path, text) {
+		this.#candidates.set(normalizePath(path), text);
+	}
+	/**
+	* Reads the candidate text recorded for one absolute path.
+	*
+	* @param path - The absolute path to read
+	* @returns The recorded text, or `undefined` when this overlay holds no candidate there
+	*/
+	text(path) {
+		return this.#candidates.get(normalizePath(path));
+	}
+	/**
+	* Checks whether a candidate sits beneath one directory.
+	*
+	* @remarks
+	* The answer is derived from the paths the overlay holds rather than stored, so it stops being
+	* true exactly when the inspection that declared those candidates clears them. Both sides pass
+	* through `normalizePath` first, because a tool that normalizes its own paths asks about a
+	* directory in a spelling the recorded path may not share.
+	*
+	* @param directory - The absolute directory path to check
+	* @returns True if a candidate path sits beneath the directory; false otherwise
+	*/
+	covers(directory) {
+		const base = `${normalizePath(directory).replace(/\/+$/, "")}/`;
+		for (const path of this.#candidates.keys()) if (path.startsWith(base)) return true;
+		return false;
+	}
+	/**
+	* Releases every candidate.
+	*
+	* @returns Nothing
+	*/
+	clear() {
+		this.#candidates.clear();
+	}
+};
+//#endregion
+//#region package.json
+var version = "0.0.1";
+var peerDependencies = {
+	"oxlint": "^1.77.0",
+	"typescript": "^6.0.0",
+	"vitest": "^4.1.0"
+};
+//#endregion
+//#region src/server/stages/LintStage.ts
+/**
+* Inspects virtual documents through one resident Oxlint language server.
+*
+* @remarks
+* Construction starts the target workspace's Oxlint binary with its Language Server Protocol
+* mode. Each inspection opens the supplied text by URI, waits for published diagnostics, and
+* closes the document without writing it to disk.
+*
+* Teardown is bounded at both ends. Warming waits for the server's `initialize` response and the
+* ending waits for its `shutdown` reply, and the protocol leaves both answers to the server, so
+* `destroy` bounds each exchange and takes the ending back with a signal when the bound passes.
+*
+* The URI is the path the candidate declared, so the candidate receives exactly the rule set the
+* workspace's own lint gate applies to that path, including an override anchored to one directory,
+* one file name, or one exact file. A path the workspace's version-control ignore files exclude is
+* a path that gate never lints, and this stage reports the same nothing for it. Reuse of one
+* declared path across inspections is what the caller's own serialization protects: the stage
+* refuses a second inspection of a path it already has open rather than answering either one with
+* the other's diagnostics.
+*
+* @example
+* ```ts
+* const stage = new LintStage('/srv/checkout')
+* const check = await stage.inspect(subject)
+* await stage.destroy()
+* ```
+*/
+var LintStage = class {
+	#workspace;
+	#deadline = 2e3;
+	#warmth;
+	#responses = /* @__PURE__ */ new Map();
+	#failures = /* @__PURE__ */ new Map();
+	#documents = /* @__PURE__ */ new Map();
+	#publishes = /* @__PURE__ */ new Map();
+	#refusals = /* @__PURE__ */ new Map();
+	#child;
+	#buffer = Buffer.alloc(0);
+	#sequence = 0;
+	#closing;
+	#progress = 0;
+	#destroyed = false;
+	/**
+	* Starts warming the target workspace's Oxlint language server.
+	*
+	* @param workspace - The target workspace root. Default: the current working directory
+	*/
+	constructor(workspace = process.cwd()) {
+		this.#workspace = workspace;
+		this.#warmth = this.#warm();
+		this.#warmth.catch(() => {});
+	}
+	get stage() {
+		return "lint";
+	}
+	get progress() {
+		return this.#progress;
+	}
+	async inspect(subject) {
+		if (this.#destroyed) throw createDestroyedError("lint stage");
+		const started = performance.now();
+		await this.#warmth;
+		if (this.#destroyed) throw createDestroyedError("lint stage");
+		const issues = [];
+		for (const draft of [...subject.files, subject.test]) issues.push(...await this.#document(draft));
+		return {
+			stage: this.stage,
+			elapsed: Math.round(performance.now() - started),
+			issues
+		};
+	}
+	destroy() {
+		if (this.#closing !== void 0) return this.#closing;
+		this.#destroyed = true;
+		this.#closing = this.#destroy();
+		return this.#closing;
+	}
+	async #destroy() {
+		const child = await this.#warmed();
+		this.#fail(createDestroyedError("lint stage"));
+		if (child === void 0 || this.#ending !== void 0) return;
+		const released = new Promise((resolve) => {
+			child.once("exit", () => resolve());
+			child.once("close", () => resolve());
+		});
+		await this.#release(child, released);
+	}
+	async #warmed() {
+		const timeout = createTimeout({ ms: this.#deadline });
+		timeout.start();
+		try {
+			return await Promise.race([this.#warmth, this.#expiry(timeout)]);
+		} catch {
+			return this.#child;
+		} finally {
+			timeout.clear();
+		}
+	}
+	async #release(child, released) {
+		const timeout = createTimeout({ ms: this.#deadline });
+		timeout.start();
+		try {
+			await Promise.race([this.#retire(child).then(() => released), this.#expiry(timeout)]);
+		} catch {
+			child.kill("SIGKILL");
+			await released;
+		} finally {
+			timeout.clear();
+		}
+	}
+	async #retire(child) {
+		try {
+			await this.#request("shutdown", void 0);
+			this.#notify("exit", void 0);
+		} catch {
+			child.kill("SIGKILL");
+		}
+	}
+	#expiry(timeout) {
+		return new Promise((_resolve, reject) => {
+			timeout.signal.addEventListener("abort", () => reject(new ProbeError(`The Oxlint language server did not exit within ${timeout.ms} ms`, {
+				origin: "instrument",
+				code: "deadline",
+				context: {
+					stage: this.stage,
+					deadline: timeout.ms
+				}
+			})), { once: true });
+		});
+	}
+	async #warm() {
+		const binary = resolveWorkspaceBinary(this.#workspace, "oxlint");
+		const child = spawn(process.execPath, [binary, "--lsp"], {
+			cwd: this.#workspace,
+			stdio: "pipe"
+		});
+		this.#child = child;
+		child.stderr.resume();
+		child.stdout.on("data", (chunk) => this.#read(chunk));
+		child.stdin.on("error", (error) => this.#fail(error));
+		child.on("error", (error) => this.#fail(error));
+		child.on("exit", (code, signal) => this.#exit(code, signal));
+		await this.#request("initialize", {
+			processId: process.pid,
+			rootUri: pathToFileURL(this.#workspace).href,
+			capabilities: {},
+			workspaceFolders: [{
+				uri: pathToFileURL(this.#workspace).href,
+				name: "workspace"
+			}]
+		});
+		this.#notify("initialized", {});
+		return child;
+	}
+	#document(draft) {
+		const uri = pathToFileURL(resolveWorkspaceFile(this.#workspace, draft.path)).href;
+		if (this.#publishes.has(uri)) return Promise.reject(new ProbeError(`The lint stage is already inspecting ${draft.path}`, {
+			origin: "claimant",
+			code: "refused",
+			context: {
+				stage: this.stage,
+				path: draft.path
+			}
+		}));
+		const inspected = new Promise((resolve, reject) => {
+			this.#documents.set(uri, normalizePath(draft.path));
+			this.#publishes.set(uri, resolve);
+			this.#refusals.set(uri, reject);
+		}).finally(() => this.#close(uri));
+		try {
+			this.#notify("textDocument/didOpen", { textDocument: {
+				uri,
+				languageId: inferDocumentLanguage(draft.path),
+				version: this.#sequence,
+				text: draft.text
+			} });
+			this.#progress += 1;
+		} catch (error) {
+			this.#refusals.get(uri)?.(this.#fault(describeUnknown(error), error, draft.path));
+		}
+		return inspected;
+	}
+	get #ending() {
+		const child = this.#child;
+		if (child === void 0) return void 0;
+		if (child.exitCode === null && child.signalCode === null) return void 0;
+		return this.#describe(child.exitCode, child.signalCode);
+	}
+	#describe(code, signal) {
+		return signal === null ? `code ${code}` : `signal ${signal}`;
+	}
+	#fault(message, cause, path) {
+		return new ProbeError(message, {
+			origin: "instrument",
+			code: "malformed",
+			context: {
+				stage: this.stage,
+				...path === void 0 ? {} : { path }
+			},
+			...cause === void 0 ? {} : { cause }
+		});
+	}
+	get #reachable() {
+		return this.#ending === void 0 && this.#child?.stdin.writable === true;
+	}
+	#close(uri) {
+		this.#documents.delete(uri);
+		this.#publishes.delete(uri);
+		this.#refusals.delete(uri);
+		if (this.#destroyed || !this.#reachable) return;
+		this.#notify("textDocument/didClose", { textDocument: { uri } });
+	}
+	#request(method, params) {
+		this.#sequence += 1;
+		const id = this.#sequence;
+		const response = new Promise((resolve, reject) => {
+			this.#responses.set(id, resolve);
+			this.#failures.set(id, reject);
+		});
+		try {
+			this.#send({
+				jsonrpc: "2.0",
+				id,
+				method,
+				params
+			});
+		} catch (error) {
+			const reject = this.#failures.get(id);
+			this.#responses.delete(id);
+			this.#failures.delete(id);
+			reject?.(this.#fault(describeUnknown(error), error));
+		}
+		return response;
+	}
+	#notify(method, params) {
+		this.#sequence += 1;
+		this.#send({
+			jsonrpc: "2.0",
+			method,
+			params
+		});
+	}
+	#send(message) {
+		const child = this.#child;
+		if (this.#ending !== void 0) throw this.#fault(`The Oxlint language server exited with ${this.#ending}`);
+		if (child === void 0) throw this.#fault("The Oxlint language server is not running");
+		if (!child.stdin.writable) throw this.#fault("The Oxlint language server closed its input");
+		const content = JSON.stringify(message);
+		const header = `Content-Length: ${Buffer.byteLength(content)}\r\n\r\n`;
+		child.stdin.write(header + content);
+	}
+	#read(chunk) {
+		this.#buffer = Buffer.concat([this.#buffer, chunk]);
+		while (this.#frame());
+	}
+	#frame() {
+		const boundary = this.#buffer.indexOf("\r\n\r\n");
+		if (boundary < 0) return false;
+		const length = parseContentLength(this.#buffer.subarray(0, boundary).toString("ascii"));
+		if (length === void 0) {
+			this.#fail(this.#fault("Oxlint sent an invalid JSON-RPC frame header"));
+			return false;
+		}
+		const start = boundary + 4;
+		const end = start + length;
+		if (this.#buffer.length < end) return false;
+		const content = this.#buffer.subarray(start, end).toString("utf8");
+		this.#buffer = this.#buffer.subarray(end);
+		try {
+			const message = JSON.parse(content);
+			this.#receive(message);
+		} catch (error) {
+			this.#fail(this.#fault(`Oxlint sent invalid JSON: ${describeUnknown(error)}`, error));
+		}
+		return true;
+	}
+	#receive(message) {
+		if (typeof message !== "object" || message === null) return;
+		if ("id" in message && typeof message.id === "number") {
+			const id = message.id;
+			const resolve = this.#responses.get(id);
+			const reject = this.#failures.get(id);
+			this.#responses.delete(id);
+			this.#failures.delete(id);
+			if ("error" in message && message.error !== void 0) reject?.(this.#fault(describeUnknown(message.error)));
+			else resolve?.("result" in message ? message.result : void 0);
+			return;
+		}
+		if (!("method" in message) || message.method !== "textDocument/publishDiagnostics") return;
+		if (!("params" in message) || typeof message.params !== "object" || message.params === null) return;
+		const params = message.params;
+		if (!("uri" in params) || typeof params.uri !== "string") return;
+		if (!("diagnostics" in params) || !Array.isArray(params.diagnostics)) return;
+		const publish = this.#publishes.get(params.uri);
+		if (publish === void 0) return;
+		publish(this.#issues(params.uri, params.diagnostics));
+	}
+	#issues(uri, diagnostics) {
+		const path = this.#documents.get(uri);
+		if (path === void 0) return [];
+		const issues = [];
+		for (const diagnostic of diagnostics) {
+			if (typeof diagnostic !== "object" || diagnostic === null) continue;
+			if (!("message" in diagnostic) || typeof diagnostic.message !== "string") continue;
+			if (!("range" in diagnostic) || typeof diagnostic.range !== "object" || diagnostic.range === null) {
+				issues.push({
+					origin: "claimant",
+					path,
+					message: diagnostic.message
+				});
+				continue;
+			}
+			const range = diagnostic.range;
+			if (!("start" in range) || typeof range.start !== "object" || range.start === null) {
+				issues.push({
+					origin: "claimant",
+					path,
+					message: diagnostic.message
+				});
+				continue;
+			}
+			const start = range.start;
+			if (!("line" in start) || typeof start.line !== "number") {
+				issues.push({
+					origin: "claimant",
+					path,
+					message: diagnostic.message
+				});
+				continue;
+			}
+			issues.push({
+				origin: "claimant",
+				path,
+				message: diagnostic.message,
+				line: start.line + 1
+			});
+		}
+		return issues;
+	}
+	#fail(error) {
+		for (const reject of this.#failures.values()) reject(error);
+		for (const reject of this.#refusals.values()) reject(error);
+		this.#responses.clear();
+		this.#failures.clear();
+		this.#publishes.clear();
+		this.#refusals.clear();
+	}
+	#exit(code, signal) {
+		this.#fail(this.#fault(`The Oxlint language server exited with ${this.#describe(code, signal)}`));
+	}
+};
+//#endregion
+//#region src/server/stages/RuntimeStage.ts
+/**
+* Inspects tests through one resident Vitest service from the target workspace.
+*
+* @remarks
+* Construction starts Vitest with the threads pool and instruments each inline or function-declared
+* project with a Vite plugin that reads the active inspection's candidate overlay. A selected
+* string-declared project reports a workspace issue because its configuration carries no runtime
+* overlay plugin. Every inspection writes one fresh sibling specification, invalidates each
+* workspace module whose disk content or candidate revision changed, runs that specification,
+* evicts its result, and deletes the file. Clearing the overlay makes the next snapshot differ from
+* the candidate revision, so the next inspection invalidates that module and reads disk again.
+*
+* Vite retains one unresolved URL for every specification path, so the stage replaces its whole
+* Vitest service after 64 specifications rather than deleting from each map that service owns. Any
+* bound holds the retention flat, because the replacement releases everything the instance held,
+* and 64 is the value chosen. The inspection that crosses the bound pays the replacement
+* synchronously: it closes the resident service and warms a new one before it runs. On 2026-08-20,
+* over this package's own workspace on the host `guides/probe.md` § Cost names, two runs of 66
+* inspections put that one at 480 ms and 269 ms against median inspections of 156 ms and 155 ms, so
+* budget one call in 64 at 110 ms to 330 ms above the rest.
+*
+* Every issue this stage emits names its party, and the stage emits an issue for every party
+* `Party` declares. An `origin: 'claimant'` issue is a failure Vitest reported about the candidate.
+* An `origin: 'workspace'` issue names the target tree: a project the root configuration declares
+* as a path string, into which the stage can install no overlay, and a specification path that
+* crosses a symbolic link, whose existing components this host cannot inspect, or whose directory
+* the target tree blocks probe from creating. An `origin: 'instrument'` issue names this package's
+* own machinery: a specification it could not write after its directory exists, or one it could
+* not run, evict, or delete, in each case for a reason the target tree does not own, and a run
+* that reported no test. An unmapped caller test and a test whose named project is absent are claimant failures with
+* `code: 'missing'`, thrown rather than reported, because a test that never ran is no evidence
+* about the candidate.
+*
+* The write path's physical-containment guarantee covers the claim inputs and the target tree as
+* inspected. A concurrent process that mutates a path component between the final inspection and
+* the write is outside that guarantee.
+*
+* @example
+* ```ts
+* const stage = new RuntimeStage('/srv/checkout')
+* const check = await stage.inspect(subject)
+* await stage.destroy()
+* ```
+*/
+var RuntimeStage = class {
+	#workspace;
+	#vitest;
+	#overlay = new Overlay();
+	#modules = /* @__PURE__ */ new Map();
+	#revisions = /* @__PURE__ */ new Set();
+	#specifications = 0;
+	#closing;
+	#progress = 0;
+	#destroyed = false;
+	/**
+	* Starts warming the target workspace's Vitest service.
+	*
+	* @param workspace - The target workspace root. Default: the current working directory
+	*/
+	constructor(workspace = process.cwd()) {
+		this.#workspace = workspace;
+		const vitest = loadWorkspaceModule(this.#workspace, "vitest/node");
+		this.#vitest = this.#warm(vitest.createVitest);
+		this.#vitest.catch(() => {});
+	}
+	get stage() {
+		return "runtime";
+	}
+	get progress() {
+		return this.#progress;
+	}
+	async inspect(subject) {
+		if (this.#destroyed) throw createDestroyedError("runtime stage");
+		const started = performance.now();
+		const exitCode = process.exitCode;
+		const vitest = await this.#runner();
+		if (this.#destroyed) throw createDestroyedError("runtime stage");
+		const project = this.#project(vitest, subject.test.path);
+		if ("message" in project) return {
+			stage: this.stage,
+			elapsed: Math.round(performance.now() - started),
+			issues: [project]
+		};
+		const overlay = new Overlay();
+		this.#overlay = overlay;
+		try {
+			for (const draft of subject.files) overlay.set(resolveWorkspaceFile(this.#workspace, draft.path), draft.text);
+			this.#revalidate(vitest);
+			const specification = this.#specification(subject.test);
+			if (typeof specification !== "string") return {
+				stage: this.stage,
+				elapsed: Math.round(performance.now() - started),
+				issues: [specification]
+			};
+			const file = specification;
+			this.#specifications += 1;
+			this.#revisions.add(file);
+			let issues = [];
+			let cleanup = [];
+			const task = project.createSpecification(file, void 0, "threads");
+			this.#progress += 1;
+			try {
+				try {
+					const result = await vitest.runTestSpecifications([task], false);
+					issues = this.#issues(result, file, subject.test.path);
+				} catch (error) {
+					if (error instanceof ProbeError) throw error;
+					throw new ProbeError(`The runtime stage could not run the generated specification (${describeUnknown(error)})`, {
+						origin: "instrument",
+						code: "malformed",
+						context: {
+							stage: this.stage,
+							path: subject.test.path
+						},
+						cause: error
+					});
+				}
+			} finally {
+				this.#progress -= 1;
+				process.exitCode = exitCode;
+				this.#revisions.delete(file);
+				cleanup = await this.#evict(vitest, file);
+				try {
+					const contained = resolveWorkspaceFile(this.#workspace, relative(this.#workspace, file), true);
+					if (existsSync(contained)) unlinkSync(contained);
+				} catch (error) {
+					cleanup = [...cleanup, {
+						origin: error instanceof ProbeError && error.origin === "workspace" ? "workspace" : "instrument",
+						path: relativeWorkspaceFile(this.#workspace, file),
+						message: `The runtime stage could not delete the generated specification (${describeUnknown(error)})`
+					}];
+				}
+			}
+			return {
+				stage: this.stage,
+				elapsed: Math.round(performance.now() - started),
+				issues: [...issues, ...cleanup]
+			};
+		} finally {
+			overlay.clear();
+		}
+	}
+	destroy() {
+		if (this.#closing !== void 0) return this.#closing;
+		this.#destroyed = true;
+		this.#closing = this.#destroy();
+		return this.#closing;
+	}
+	async #destroy() {
+		try {
+			for (const file of this.#revisions) try {
+				const contained = resolveWorkspaceFile(this.#workspace, relative(this.#workspace, file), true);
+				if (existsSync(contained)) unlinkSync(contained);
+			} catch {}
+			this.#revisions.clear();
+			const vitest = await this.#vitest.catch(() => void 0);
+			if (vitest !== void 0) {
+				vitest.cancelCurrentRun("keyboard-input").catch(() => {});
+				await vitest.close();
+			}
+		} finally {
+			this.#modules.clear();
+			this.#overlay.clear();
+		}
+	}
+	async #warm(create) {
+		this.#sweep();
+		const output = new PassThrough();
+		output.resume();
+		const signals = captureListeners(process, ["SIGINT", "SIGTERM"]);
+		try {
+			return create("test", {
+				root: this.#workspace,
+				config: resolveWorkspaceFile(this.#workspace, "vite.config.ts"),
+				watch: false,
+				run: true,
+				pool: "threads",
+				reporters: [{
+					onInit() {},
+					onTestRunEnd() {}
+				}]
+			}, { plugins: [{
+				name: "orkestrel-project-instrumentation",
+				enforce: "post",
+				config: this.#configure.bind(this)
+			}] }, {
+				stdout: output,
+				stderr: process.stderr
+			});
+		} finally {
+			releaseListeners(process, signals);
+		}
+	}
+	#configure(config) {
+		const test = config.test;
+		if (test?.projects === void 0) return;
+		test.projects = test.projects.map((project) => this.#augment(project));
+	}
+	#augment(project) {
+		if (typeof project === "string") return project;
+		if (typeof project === "function") return this.#wrap(project);
+		return Promise.resolve(project).then(this.#instrument.bind(this));
+	}
+	#wrap(project) {
+		return async (environment) => this.#instrument(await project(environment));
+	}
+	#instrument(config) {
+		return {
+			...config,
+			plugins: [...config.plugins ?? [], {
+				name: "orkestrel-runtime-overlay",
+				enforce: "pre",
+				resolveId: this.#resolve.bind(this),
+				load: this.#load.bind(this)
+			}]
+		};
+	}
+	#resolve(id, importer) {
+		const separator = id.lastIndexOf("?");
+		const specifier = separator === -1 ? id : id.slice(0, separator);
+		const suffix = separator === -1 ? "" : id.slice(separator);
+		if (!specifier.startsWith(".") && !isAbsolute(specifier)) return void 0;
+		if (importer === void 0 && !isAbsolute(specifier)) return void 0;
+		const imported = isAbsolute(specifier) ? specifier : resolve(dirname(importer ?? this.#workspace), specifier);
+		const candidates = [imported];
+		const extension = extname(imported);
+		if (extension === ".js") candidates.push(`${imported.slice(0, -extension.length)}.ts`);
+		if (extension === "") candidates.push(`${imported}.ts`);
+		for (const candidate of candidates) {
+			const resolved = `${candidate}${suffix}`;
+			if (this.#load(resolved) !== void 0) return resolved;
+		}
+	}
+	#load(id) {
+		const text = this.#overlay.text(id);
+		if (text !== void 0) return text;
+		const separator = id.lastIndexOf("?");
+		if (separator === -1) return void 0;
+		const query = id.slice(separator + 1);
+		if (!query.startsWith("v=") || query.length === 2 || query.includes("&") || query.includes("#") || query.slice(2).includes("?")) return;
+		return this.#overlay.text(id.slice(0, separator));
+	}
+	#specification(test) {
+		let creating = false;
+		const outcome = attempt(() => {
+			const revision = `${process.pid}-${randomUUID()}`;
+			const file = createRevisionFile(this.#workspace, test.path, revision);
+			const target = relative(this.#workspace, file);
+			resolveWorkspaceFile(this.#workspace, target, true);
+			creating = true;
+			mkdirSync(dirname(file), { recursive: true });
+			creating = false;
+			resolveWorkspaceFile(this.#workspace, target, true);
+			writeFileSync(file, formatSpecification(test.text, revision), {
+				encoding: "utf8",
+				flag: "wx"
+			});
+			return file;
+		});
+		if (outcome.success) return outcome.value;
+		if (outcome.error instanceof ProbeError && outcome.error.origin === "claimant") throw new ProbeError(outcome.error.message, {
+			origin: outcome.error.origin,
+			code: outcome.error.code,
+			context: {
+				...outcome.error.context,
+				path: test.path
+			},
+			cause: outcome.error.cause
+		});
+		return {
+			origin: outcome.error instanceof ProbeError && outcome.error.origin === "workspace" || creating ? "workspace" : "instrument",
+			path: test.path,
+			message: `The runtime stage could not write the generated specification (${describeUnknown(outcome.error)})`
+		};
+	}
+	#project(vitest, path) {
+		const name = inferTestProject(relative(this.#workspace, resolve(this.#workspace, path)));
+		if (name === void 0) throw new ProbeError("The runtime stage found no configured Vitest project matching the test path", {
+			origin: "claimant",
+			code: "missing",
+			context: {
+				stage: this.stage,
+				path
+			}
+		});
+		const project = vitest.projects.find((candidate) => candidate.name === name);
+		if (project === void 0) throw new ProbeError(`The runtime stage found no configured Vitest project named ${name}`, {
+			origin: "claimant",
+			code: "missing",
+			context: {
+				stage: this.stage,
+				path
+			}
+		});
+		if (!project.vite.config.plugins.some((plugin) => plugin.name === "orkestrel-runtime-overlay")) return {
+			origin: "workspace",
+			path,
+			message: `The runtime stage cannot instrument the string-declared Vitest project ${name} because its configuration carries no runtime overlay plugin`
+		};
+		return project;
+	}
+	async #evict(vitest, file) {
+		try {
+			const ids = [];
+			for (const [id, task] of vitest.state.idMap) {
+				const path = "filepath" in task ? task.filepath : task.file.filepath;
+				if (resolve(path) === resolve(file)) ids.push(id);
+			}
+			for (const id of ids) vitest.state.idMap.delete(id);
+			vitest.state.pathsSet.delete(file);
+			vitest.clearSpecificationsCache(file);
+			vitest.invalidateFile(file);
+			const graphs = vitest.projects.flatMap((project) => Object.values(project.vite.environments).map((environment) => environment.moduleGraph));
+			for (const graph of graphs) {
+				const modules = graph.getModulesByFile(file);
+				graph.onFileDelete(file);
+				if (modules === void 0) continue;
+				for (const module of modules) {
+					for (const importer of module.importers) {
+						importer.importedModules.delete(module);
+						importer.acceptedHmrDeps.delete(module);
+					}
+					if (module.id !== null) graph.idToModuleMap.delete(module.id);
+					graph.urlToModuleMap.delete(module.url);
+				}
+				graph.fileToModulesMap.delete(file);
+			}
+			vitest.watcher.onFileDelete(file);
+			vitest.watcher.invalidates.delete(file);
+			vitest.cache.results.removeFromCache(normalizePath(relative(this.#workspace, file)));
+			await vitest.cache.results.writeToCache();
+			return [];
+		} catch (error) {
+			return [{
+				origin: "instrument",
+				path: relativeWorkspaceFile(this.#workspace, file),
+				message: `The runtime stage could not evict the generated specification (${describeUnknown(error)})`
+			}];
+		}
+	}
+	#runner() {
+		if (this.#specifications < 64) return this.#vitest;
+		this.#specifications = 0;
+		this.#vitest = this.#replace(this.#vitest);
+		this.#vitest.catch(() => {});
+		return this.#vitest;
+	}
+	async #replace(current) {
+		await (await current).close();
+		if (this.#destroyed) throw createDestroyedError("runtime stage");
+		const runner = loadWorkspaceModule(this.#workspace, "vitest/node");
+		return this.#warm(runner.createVitest);
+	}
+	#revalidate(vitest) {
+		const modules = this.#snapshot();
+		for (const [path, digest] of modules) {
+			if (this.#modules.get(path) === digest) continue;
+			this.#invalidate(vitest, path);
+		}
+		for (const path of this.#modules.keys()) {
+			if (modules.has(path)) continue;
+			this.#invalidate(vitest, path);
+		}
+		this.#modules.clear();
+		for (const [path, digest] of modules) this.#modules.set(path, digest);
+	}
+	#invalidate(vitest, path) {
+		vitest.invalidateFile(path);
+		vitest.watcher.invalidates.add(path);
+	}
+	#snapshot() {
+		const modules = /* @__PURE__ */ new Map();
+		for (const path of this.#walk()) {
+			if (!matchesWorkspaceModule(path)) continue;
+			try {
+				const digest = createHash("sha256").update(readFileSync(path)).digest("hex");
+				modules.set(path, digest);
+			} catch {}
+		}
+		for (const path of this.#overlay.paths) modules.set(path, `overlay:${this.#overlay.revision}`);
+		return modules;
+	}
+	#sweep() {
+		for (const path of this.#walk()) {
+			const match = [...basename(path).matchAll(/\.probe-((\d+)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?=\.|$)/gu)].at(-1);
+			const revision = match?.[1];
+			const owner = match?.[2];
+			if (revision === void 0 || owner === void 0) continue;
+			if (this.#alive(Number.parseInt(owner, 10))) continue;
+			if (!this.#owned(path, revision)) continue;
+			try {
+				unlinkSync(resolveWorkspaceFile(this.#workspace, relative(this.#workspace, path), true));
+			} catch {}
+		}
+	}
+	#owned(path, revision) {
+		const outcome = attempt(() => readFileSync(path, "utf8"));
+		return outcome.success && matchesSpecification(outcome.value, revision);
+	}
+	#alive(id) {
+		if (!Number.isSafeInteger(id) || id <= 0) return true;
+		try {
+			process.kill(id, 0);
+			return true;
+		} catch (error) {
+			return error instanceof Error && "code" in error && error.code === "EPERM";
+		}
+	}
+	*#walk() {
+		const directories = [resolve(this.#workspace)];
+		while (directories.length > 0) {
+			const directory = directories.pop();
+			if (directory === void 0) break;
+			let entries = [];
+			try {
+				entries = readdirSync(directory, { withFileTypes: true });
+			} catch {}
+			for (const entry of entries) {
+				if (entry.name === ".git" || entry.name === "dist" || entry.name === "node_modules") continue;
+				const path = join(directory, entry.name);
+				if (entry.isDirectory()) {
+					directories.push(path);
+					continue;
+				}
+				if (entry.isFile()) yield path;
+			}
+		}
+	}
+	#issues(result, file, original) {
+		const specification = this.#real(file);
+		const issues = [];
+		for (const module of result.testModules) {
+			const before = issues.length;
+			for (const error of module.errors()) issues.push(this.#issue(error, specification, original));
+			for (const test of module.children.allTests("failed")) {
+				const errors = test.result().errors ?? [];
+				for (const error of errors) issues.push(this.#issue(error, specification, original));
+			}
+			const state = module.state();
+			if (state === "passed") {
+				if (Array.from(module.children.allTests()).length === 0) issues.push({
+					origin: "instrument",
+					path: original,
+					message: "Vitest ran no tests in the module"
+				});
+				for (const test of module.children.allTests("skipped")) issues.push({
+					origin: "instrument",
+					path: original,
+					message: `Vitest did not run the test (${test.fullName})`
+				});
+				continue;
+			}
+			if (state === "skipped") {
+				issues.push({
+					origin: "instrument",
+					path: original,
+					message: "Vitest ran no tests in the module"
+				});
+				continue;
+			}
+			if (state === "failed") {
+				if (issues.length === before) issues.push({
+					origin: "claimant",
+					path: original,
+					message: "Vitest reported a failed test module"
+				});
+				continue;
+			}
+			if (state === "pending" || state === "queued") {
+				issues.push({
+					origin: "instrument",
+					path: original,
+					message: `Vitest did not finish the test module (${state})`
+				});
+				continue;
+			}
+			issues.push({
+				origin: "instrument",
+				path: original,
+				message: `Vitest reported an unrecognized test module state (${state})`
+			});
+		}
+		for (const error of result.unhandledErrors) issues.push(this.#issue(error, specification, original));
+		if (result.testModules.length === 0 && issues.length === 0) issues.push({
+			origin: "instrument",
+			path: original,
+			message: "Vitest returned no test module"
+		});
+		return issues;
+	}
+	#real(path) {
+		const outcome = attempt(() => realpathSync(path));
+		return outcome.success ? outcome.value : path;
+	}
+	#issue(error, specification, original) {
+		const message = describeUnknown(error);
+		if (typeof error !== "object" || error === null || !("stacks" in error)) return {
+			origin: "claimant",
+			path: original,
+			message
+		};
+		const stacks = error.stacks;
+		if (!Array.isArray(stacks)) return {
+			origin: "claimant",
+			path: original,
+			message
+		};
+		for (const stack of stacks) {
+			if (typeof stack !== "object" || stack === null) continue;
+			if (!("file" in stack) || typeof stack.file !== "string") continue;
+			const declared = stack.file.startsWith("file:") ? fileURLToPath(stack.file) : isAbsolute(stack.file) ? stack.file : resolve(this.#workspace, stack.file);
+			const reported = this.#real(declared);
+			const path = reported === specification ? original : relativeWorkspaceFile(this.#real(this.#workspace), reported);
+			if (!("line" in stack) || typeof stack.line !== "number") return {
+				origin: "claimant",
+				path,
+				message
+			};
+			return {
+				origin: "claimant",
+				path,
+				message,
+				line: stack.line
+			};
+		}
+		return {
+			origin: "claimant",
+			path: original,
+			message
+		};
+	}
+};
+//#endregion
+//#region src/server/stages/TypeStage.ts
+/**
+* Inspects TypeScript source through resident language services from the target workspace.
+*
+* @remarks
+* Construction starts loading the workspace's compiler and warming one service per project the
+* workspace declares. A candidate draft is checked against the project a call names, or
+* against its own scoped environment project when a call names none, while the test uses the root
+* project. Disk snapshots use their modification time as the service version so dependency edits
+* cannot leave a warm answer stale. Candidate text lives in an overlay the inspection owns, and
+* the language-service host answers existence, reads, and versions from it, so a candidate that
+* exists only as text is importable and a candidate that shadows a disk file is checked as the
+* text the case supplied. A project outside the declared set holds one recycled slot, so a caller
+* varying the project cannot grow the resident set. A language service checks one candidate
+* synchronously, so the stage hands the host's event loop back at each candidate boundary: a
+* caller's deadline is answered within one candidate's check rather than after the whole
+* inspection, and an inspection abandoned at that deadline stops at the next boundary.
+*
+* @example
+* ```ts
+* const stage = new TypeStage('/srv/checkout')
+* const check = await stage.inspect(subject, 'configs/src/tsconfig.core.json')
+* await stage.destroy()
+* ```
+*/
+var TypeStage = class {
+	#workspace;
+	#typescript;
+	#services = /* @__PURE__ */ new Map();
+	#resident = /* @__PURE__ */ new Set();
+	#options = /* @__PURE__ */ new Map();
+	#files = /* @__PURE__ */ new Map();
+	#diagnostics = /* @__PURE__ */ new Map();
+	#overlay = new Overlay();
+	#recycled;
+	#closing;
+	#progress = 0;
+	#destroyed = false;
+	/**
+	* Starts warming the target workspace's TypeScript service.
+	*
+	* @param workspace - The target workspace root. Default: the current working directory
+	*/
+	constructor(workspace = process.cwd()) {
+		this.#workspace = workspace;
+		const typescript = loadWorkspaceModule(this.#workspace, "typescript");
+		this.#typescript = this.#warm(typescript);
+		this.#typescript.catch(() => {});
+	}
+	get stage() {
+		return "type";
+	}
+	get progress() {
+		return this.#progress;
+	}
+	/**
+	* Inspects one case, against a caller-named project where the caller names one.
+	*
+	* @remarks
+	* The `project` parameter is this stage's own, not the stage contract's: the lint and runtime
+	* stages read no project, so `StageInterface` declares one parameter and every caller that
+	* needs this one holds a `TypeStage`.
+	*
+	* @param subject - The candidate drafts and test to inspect
+	* @param project - The workspace-relative TypeScript project the candidate drafts are checked
+	* against. Default: the scoped project each candidate path infers
+	* @returns One outcome for this stage
+	* @throws When the resident compiler cannot start or the stage has already been destroyed
+	*/
+	async inspect(subject, project) {
+		if (this.#destroyed) throw createDestroyedError("type stage");
+		const started = performance.now();
+		const typescript = await this.#typescript;
+		if (this.#destroyed) throw createDestroyedError("type stage");
+		const selections = subject.files.map((draft) => ({
+			draft,
+			path: resolveWorkspaceFile(this.#workspace, draft.path)
+		})).map((candidate) => ({
+			draft: candidate.draft,
+			project: project ?? inferTypeProject(relativeWorkspaceFile(this.#workspace, candidate.path))
+		}));
+		this.#configure(this.#service(typescript, "tsconfig.json"), "tsconfig.json");
+		for (const selection of selections) this.#configure(this.#service(typescript, selection.project), selection.project);
+		const overlay = new Overlay();
+		this.#overlay = overlay;
+		try {
+			this.#record(subject.test, overlay);
+			for (const draft of subject.files) this.#record(draft, overlay);
+			this.#progress += 1;
+			const issues = [];
+			const projects = /* @__PURE__ */ new Set();
+			const root = this.#service(typescript, "tsconfig.json");
+			issues.push(...this.#issues(typescript, root, subject.test, "tsconfig.json", false, true));
+			projects.add("tsconfig.json");
+			await this.#unblock();
+			for (const selection of selections) {
+				const draft = selection.draft;
+				const selected = selection.project;
+				const service = this.#service(typescript, selected);
+				issues.push(...this.#issues(typescript, service, draft, selected, project !== void 0, !projects.has(selected)));
+				projects.add(selected);
+				await this.#unblock();
+			}
+			return {
+				stage: this.stage,
+				elapsed: Math.round(performance.now() - started),
+				issues
+			};
+		} finally {
+			overlay.clear();
+		}
+	}
+	/**
+	* Resolves one project to the path and digest this stage applies for it.
+	*
+	* @remarks
+	* Reads the parse this stage itself applies, filling its cache when the project is not already
+	* resident, so the reported digest is the configuration the inspection is judged under rather
+	* than a second parse a caller ran. The returned record is a value copy, so a later eviction
+	* does not move it.
+	*
+	* @param project - The workspace-relative TypeScript project to resolve
+	* @returns The resolved workspace-relative path and the digest of its compiler options
+	* @throws When the project escapes the workspace, cannot be parsed, or the stage has already
+	* been destroyed
+	*/
+	async resolve(project) {
+		if (this.#destroyed) throw createDestroyedError("type stage");
+		const typescript = await this.#typescript;
+		if (this.#destroyed) throw createDestroyedError("type stage");
+		const resolved = resolveWorkspaceFile(this.#workspace, project);
+		this.#service(typescript, project);
+		return {
+			path: relativeWorkspaceFile(this.#workspace, resolved),
+			digest: computeDigest(this.#workspace, this.#options.get(resolved) ?? {})
+		};
+	}
+	destroy() {
+		if (this.#closing !== void 0) return this.#closing;
+		this.#destroyed = true;
+		this.#closing = this.#destroy();
+		return this.#closing;
+	}
+	async #destroy() {
+		await this.#typescript.catch(() => void 0);
+		for (const service of this.#services.values()) service.dispose();
+		this.#services.clear();
+		this.#resident.clear();
+		this.#recycled = void 0;
+		this.#options.clear();
+		this.#files.clear();
+		this.#diagnostics.clear();
+	}
+	async #warm(typescript) {
+		for (const project of this.#projects()) {
+			this.#resident.add(resolveWorkspaceFile(this.#workspace, project));
+			this.#service(typescript, project);
+		}
+		return typescript;
+	}
+	#projects() {
+		const projects = ["tsconfig.json"];
+		for (const axis of ["src", "app"]) {
+			const directory = resolveWorkspaceFile(this.#workspace, `configs/${axis}`);
+			let names;
+			try {
+				names = readdirSync(directory);
+			} catch {
+				continue;
+			}
+			for (const name of names.filter((entry) => /^tsconfig\.[^.]+\.json$/.test(entry)).sort()) projects.push(`configs/${axis}/${name}`);
+		}
+		return projects;
+	}
+	async #unblock() {
+		await setImmediate();
+		if (this.#destroyed) throw createDestroyedError("type stage");
+	}
+	#record(draft, overlay) {
+		overlay.set(resolveWorkspaceFile(this.#workspace, draft.path), draft.text);
+	}
+	#service(typescript, project) {
+		const path = resolveWorkspaceFile(this.#workspace, project);
+		const existing = this.#services.get(path);
+		if (existing !== void 0) return existing;
+		const config = typescript.readConfigFile(path, typescript.sys.readFile);
+		if (config.error !== void 0) throw new ProbeError(typescript.flattenDiagnosticMessageText(config.error.messageText, "\n"), {
+			origin: "workspace",
+			code: "malformed",
+			context: {
+				stage: this.stage,
+				project
+			}
+		});
+		const parsed = typescript.parseJsonConfigFileContent(config.config, typescript.sys, dirname(path), void 0, path);
+		if (parsed.errors.length > 0) throw new ProbeError(typescript.flattenDiagnosticMessageText(parsed.errors[0]?.messageText ?? "", "\n"), {
+			origin: "workspace",
+			code: "malformed",
+			context: {
+				stage: this.stage,
+				project
+			}
+		});
+		this.#options.set(path, parsed.options);
+		this.#files.set(path, parsed.fileNames);
+		const service = typescript.createLanguageService({
+			getCompilationSettings: () => this.#options.get(path) ?? {},
+			getScriptFileNames: () => [...this.#files.get(path) ?? [], ...this.#overlay.paths],
+			getScriptVersion: (file) => this.#version(file),
+			getScriptSnapshot: (file) => this.#snapshot(typescript, file),
+			getCurrentDirectory: () => this.#workspace,
+			getDefaultLibFileName: (options) => typescript.getDefaultLibFilePath(options),
+			fileExists: (file) => this.#overlay.text(file) !== void 0 || typescript.sys.fileExists(file),
+			readFile: (file) => this.#overlay.text(file) ?? typescript.sys.readFile(file),
+			readDirectory: typescript.sys.readDirectory,
+			directoryExists: (directory) => typescript.sys.directoryExists(directory) || this.#overlay.covers(directory),
+			getDirectories: typescript.sys.getDirectories,
+			useCaseSensitiveFileNames: () => typescript.sys.useCaseSensitiveFileNames,
+			getNewLine: () => typescript.sys.newLine
+		});
+		this.#services.set(path, service);
+		if (!this.#resident.has(path)) this.#recycle(path);
+		return service;
+	}
+	#configure(service, project) {
+		const path = resolveWorkspaceFile(this.#workspace, project);
+		if (this.#diagnostics.has(path)) return;
+		this.#diagnostics.set(path, service.getCompilerOptionsDiagnostics());
+	}
+	#recycle(path) {
+		const previous = this.#recycled;
+		this.#recycled = path;
+		if (previous === void 0 || previous === path) return;
+		this.#services.get(previous)?.dispose();
+		this.#services.delete(previous);
+		this.#options.delete(previous);
+		this.#files.delete(previous);
+		this.#diagnostics.delete(previous);
+	}
+	#version(file) {
+		if (this.#overlay.text(file) !== void 0) return `virtual:${this.#overlay.revision}`;
+		try {
+			return `disk:${statSync(file).mtimeMs}`;
+		} catch {
+			return "missing";
+		}
+	}
+	#snapshot(typescript, file) {
+		const text = this.#overlay.text(file) ?? typescript.sys.readFile(file);
+		return text === void 0 ? void 0 : typescript.ScriptSnapshot.fromString(text);
+	}
+	#issues(typescript, service, draft, project, selected, configure) {
+		const path = resolveWorkspaceFile(this.#workspace, draft.path);
+		const configuration = resolveWorkspaceFile(this.#workspace, project);
+		return [
+			...configure ? this.#diagnostics.get(configuration) ?? [] : [],
+			...service.getSyntacticDiagnostics(path),
+			...service.getSemanticDiagnostics(path)
+		].map((diagnostic) => this.#issue(typescript, diagnostic, project, selected));
+	}
+	#issue(typescript, diagnostic, project, selected) {
+		const message = typescript.flattenDiagnosticMessageText(diagnostic.messageText, "\n");
+		if (diagnostic.file === void 0) {
+			if (selected) throw new ProbeError(message, {
+				origin: "claimant",
+				code: "refused",
+				context: {
+					stage: this.stage,
+					project
+				}
+			});
+			return {
+				origin: "instrument",
+				path: project,
+				message
+			};
+		}
+		const path = relativeWorkspaceFile(this.#workspace, diagnostic.file.fileName);
+		if (diagnostic.start === void 0) return {
+			origin: "claimant",
+			path,
+			message
+		};
+		return {
+			origin: "claimant",
+			path,
+			message,
+			line: diagnostic.file.getLineAndCharacterOfPosition(diagnostic.start).line + 1
+		};
+	}
+};
+//#endregion
+//#region src/server/Probe.ts
+/**
+* Answers claims through resident TypeScript, Oxlint, and Vitest stages.
+*
+* @remarks
+* Construction resolves the target workspace's toolchain and begins warming every stage. The boot
+* controls mutate imported dependencies and refuse service unless the type and runtime stages
+* report their respective changes. One queue per stage admits inspections in arrival order, one at
+* a time, so a stage never serves two claims at once and the deadline covers active work rather
+* than queue wait. Each active stage inspection has a coordinator-owned deadline. An expiry at any
+* stage abandons that stage and replaces it before the next queued inspection begins, so one slow
+* claim costs that claim rather than the process. A failed boot is replaced the same way: the next
+* claim runs the controls again rather than inheriting a refusal.
+*
+* @example
+* ```ts
+* const probe = new Probe({ workspace: '/srv/checkout' })
+* const verdict = await probe.prove(claim)
+* await probe.destroy()
+* ```
+*/
+var Probe = class {
+	#workspace;
+	#deadline;
+	#emitter;
+	#toolchain;
+	#type;
+	#lint;
+	#runtime;
+	#typeQueue;
+	#lintQueue;
+	#runtimeQueue;
+	#arming;
+	#closing;
+	#destroyed = false;
+	/**
+	* Resolves the target toolchain and starts warming the resident stages.
+	*
+	* @param options - Workspace, deadline, and initial observation hooks
+	*/
+	constructor(options) {
+		this.#workspace = options?.workspace ?? process.cwd();
+		this.#deadline = createTimeout({ ms: options?.deadline ?? 3e4 }).ms;
+		this.#emitter = new Emitter({
+			...options?.on === void 0 ? {} : { on: options.on },
+			...options?.error === void 0 ? {} : { error: options.error }
+		});
+		this.#toolchain = Object.freeze({
+			typescript: this.#version("typescript"),
+			oxlint: this.#version("oxlint"),
+			vitest: this.#version("vitest")
+		});
+		this.#type = new TypeStage(this.#workspace);
+		this.#lint = new LintStage(this.#workspace);
+		this.#runtime = new RuntimeStage(this.#workspace);
+		this.#typeQueue = createQueue({
+			concurrency: 1,
+			retries: 0,
+			handler: (inspection) => this.#inspectStage(this.#type, this.#type.progress, this.#type.inspect(inspection.subject, inspection.claim.project), inspection.claim)
+		});
+		this.#lintQueue = createQueue({
+			concurrency: 1,
+			retries: 0,
+			handler: (inspection) => this.#inspectStage(this.#lint, this.#lint.progress, this.#lint.inspect(inspection.subject), inspection.claim)
+		});
+		this.#runtimeQueue = createQueue({
+			concurrency: 1,
+			retries: 0,
+			handler: (inspection) => this.#inspectStage(this.#runtime, this.#runtime.progress, this.#runtime.inspect(inspection.subject), inspection.claim)
+		});
+		this.#arming = this.#arm();
+		this.#arming.catch(() => {});
+	}
+	get emitter() {
+		return this.#emitter;
+	}
+	get toolchain() {
+		return this.#toolchain;
+	}
+	async prove(claim) {
+		try {
+			this.#support();
+			await this.#ready();
+			if (this.#destroyed) throw createDestroyedError("probe");
+			const started = performance.now();
+			const id = randomUUID();
+			const project = await this.#type.resolve(claim.project);
+			const digest = computeDigest(this.#workspace, {
+				case: claim.case,
+				control: claim.control
+			});
+			const subject = Object.freeze(await this.#inspect(claim.case, claim));
+			const control = Object.freeze(await this.#inspect(claim.control, claim));
+			const basis = {
+				id,
+				digest,
+				toolchain: this.#toolchain,
+				project,
+				reason: claim.control.reason,
+				case: subject,
+				control,
+				elapsed: Math.round(performance.now() - started)
+			};
+			const receipt = computeReceipt(basis, claim.control.stage);
+			const verdict = receipt === void 0 ? basis : {
+				...basis,
+				receipt
+			};
+			this.#emitter.emit("prove", verdict);
+			return verdict;
+		} catch (error) {
+			this.#emitter.emit("error", error);
+			throw error;
+		}
+	}
+	destroy() {
+		if (this.#closing !== void 0) return this.#closing;
+		this.#destroyed = true;
+		this.#closing = this.#destroy();
+		return this.#closing;
+	}
+	async #ready() {
+		const attempt = this.#arming;
+		try {
+			await attempt;
+			return;
+		} catch (error) {
+			if (this.#destroyed) throw error;
+		}
+		if (this.#arming === attempt) {
+			this.#arming = this.#arm();
+			this.#arming.catch(() => {});
+		}
+		await this.#arming;
+	}
+	async #arm() {
+		const created = this.#workbench();
+		try {
+			await this.#boot(created);
+		} catch (error) {
+			throw new ProbeError(`The probe could not arm: ${describeUnknown(error)}`, {
+				origin: "instrument",
+				code: "malformed",
+				cause: error
+			});
+		}
+		this.#emitter.emit("arm", this.#toolchain);
+	}
+	#workbench() {
+		const path = "tmp/probe";
+		const directory = resolveWorkspaceFile(this.#workspace, path);
+		const created = !existsSync(directory);
+		try {
+			mkdirSync(resolveWorkspaceFile(this.#workspace, path, true), { recursive: true });
+		} catch (error) {
+			const code = error instanceof ProbeError && error.origin === "workspace" ? error.code : "malformed";
+			throw new ProbeError(`The probe could not create the boot workbench (${describeUnknown(error)})`, {
+				origin: "workspace",
+				code,
+				context: { path },
+				cause: error
+			});
+		}
+		return created;
+	}
+	async #boot(created) {
+		const revision = `${process.pid}-${randomUUID()}`;
+		const typeDependency = createRevisionFile(this.#workspace, "tmp/probe/arm-type.ts", revision);
+		const runtimeDependency = createRevisionFile(this.#workspace, "tmp/probe/arm-runtime.ts", revision);
+		const typeModule = basename(typeDependency, ".ts");
+		const runtimeModule = basename(runtimeDependency, ".ts");
+		const typeTest = {
+			path: `tmp/probe/${typeModule}.test.ts`,
+			text: `import type { Signal } from './${typeModule}.js'\nimport { expect, test } from 'vitest'\nconst SIGNAL: Signal = 'before'\ntest('revalidates a mutated type', () => {\n\texpect(SIGNAL).toBe('before')\n})\n`
+		};
+		const runtimeTest = {
+			path: `tmp/probe/${runtimeModule}.test.ts`,
+			text: `import { SIGNAL } from './${runtimeModule}.js'\nimport { expect, test } from 'vitest'\ntest('revalidates a mutated value', () => {\n\texpect(SIGNAL).toBe('before')\n})\n`
+		};
+		const typeClaim = {
+			project: "tsconfig.json",
+			case: {
+				files: [],
+				test: typeTest
+			},
+			control: {
+				files: [],
+				test: typeTest,
+				stage: "type",
+				reason: "the imported type changed after the resident type host cached it"
+			}
+		};
+		const runtimeClaim = {
+			project: "tsconfig.json",
+			case: {
+				files: [],
+				test: runtimeTest
+			},
+			control: {
+				files: [],
+				test: runtimeTest,
+				stage: "runtime",
+				reason: "the imported dependency changed after the resident runtime cached it"
+			}
+		};
+		try {
+			resolveWorkspaceFile(this.#workspace, relative(this.#workspace, typeDependency), true);
+			resolveWorkspaceFile(this.#workspace, relative(this.#workspace, runtimeDependency), true);
+			writeFileSync(typeDependency, formatSpecification("export type Signal = string\n", revision), {
+				encoding: "utf8",
+				flag: "wx"
+			});
+			writeFileSync(runtimeDependency, formatSpecification("export const SIGNAL = 'before'\n", revision), {
+				encoding: "utf8",
+				flag: "wx"
+			});
+			const beforeType = await this.#inspect(typeClaim.case, typeClaim);
+			const beforeRuntime = await this.#inspect(runtimeClaim.case, runtimeClaim);
+			const before = [...beforeType, ...beforeRuntime];
+			if (before.some((check) => check.issues.length > 0)) throw new ProbeError(`The probe boot control did not begin clean\n${before.map(formatCheck).join("\n")}`, {
+				origin: "instrument",
+				code: "malformed"
+			});
+			resolveWorkspaceFile(this.#workspace, relative(this.#workspace, typeDependency), true);
+			writeFileSync(typeDependency, formatSpecification("export type Signal = number\n", revision), "utf8");
+			const afterType = await this.#inspect(typeClaim.control, typeClaim);
+			const type = afterType.find((check) => check.stage === typeClaim.control.stage);
+			const tolerant = afterType.find((check) => check.stage === "runtime");
+			if (type === void 0 || type.issues.length === 0) throw new ProbeError(`The probe boot type control did not detect a mutated dependency\n${afterType.map(formatCheck).join("\n")}`, {
+				origin: "instrument",
+				code: "malformed",
+				context: { stage: typeClaim.control.stage }
+			});
+			if (tolerant === void 0 || tolerant.issues.length > 0) throw new ProbeError(`The probe boot type control did not remain runtime-clean\n${afterType.map(formatCheck).join("\n")}`, {
+				origin: "instrument",
+				code: "malformed",
+				context: { stage: "runtime" }
+			});
+			resolveWorkspaceFile(this.#workspace, relative(this.#workspace, runtimeDependency), true);
+			writeFileSync(runtimeDependency, formatSpecification("export const SIGNAL = 'after'\n", revision), "utf8");
+			const afterRuntime = await this.#inspect(runtimeClaim.control, runtimeClaim);
+			const runtime = afterRuntime.find((check) => check.stage === runtimeClaim.control.stage);
+			if (runtime === void 0 || runtime.issues.length === 0) throw new ProbeError(`The probe boot runtime control did not detect a mutated dependency\n${afterRuntime.map(formatCheck).join("\n")}`, {
+				origin: "instrument",
+				code: "malformed",
+				context: { stage: runtimeClaim.control.stage }
+			});
+		} finally {
+			rmSync(resolveWorkspaceFile(this.#workspace, relative(this.#workspace, typeDependency), true), { force: true });
+			rmSync(resolveWorkspaceFile(this.#workspace, relative(this.#workspace, runtimeDependency), true), { force: true });
+			if (created) try {
+				rmdirSync(resolveWorkspaceFile(this.#workspace, "tmp/probe", true));
+			} catch {}
+		}
+	}
+	#inspect(subject, claim) {
+		const inspection = {
+			subject,
+			claim
+		};
+		const admitted = [
+			this.#typeQueue.enqueue(inspection),
+			this.#lintQueue.enqueue(inspection),
+			this.#runtimeQueue.enqueue(inspection)
+		];
+		for (const pending of admitted) pending.catch(() => {});
+		return Promise.all(admitted);
+	}
+	async #inspectStage(stage, progress, operation, claim) {
+		const timeout = createTimeout({ ms: this.#deadline });
+		timeout.start();
+		try {
+			return await Promise.race([operation, this.#expiry(timeout, `The ${stage.stage} stage exceeded ${this.#deadline} ms`, stage, progress)]);
+		} catch (error) {
+			if (!timeout.expired) throw error;
+			if (await this.#recycle(stage)) this.#emitter.emit("expire", claim);
+			throw error;
+		} finally {
+			timeout.clear();
+		}
+	}
+	async #recycle(stage) {
+		const timeout = createTimeout({ ms: this.#deadline });
+		timeout.start();
+		try {
+			await Promise.race([stage.destroy(), this.#expiry(timeout, `The ${stage.stage} stage recovery exceeded ${this.#deadline} ms`, stage, stage.progress)]);
+		} catch {} finally {
+			timeout.clear();
+		}
+		if (this.#destroyed) return false;
+		if (stage === this.#type) {
+			this.#type = new TypeStage(this.#workspace);
+			return true;
+		}
+		if (stage === this.#lint) {
+			this.#lint = new LintStage(this.#workspace);
+			return true;
+		}
+		if (stage === this.#runtime) {
+			this.#runtime = new RuntimeStage(this.#workspace);
+			return true;
+		}
+		return false;
+	}
+	#expiry(timeout, message, stage, progress) {
+		return new Promise((_resolve, reject) => {
+			timeout.signal.addEventListener("abort", () => reject(new ProbeError(message, {
+				origin: stage.progress > progress ? "claimant" : "instrument",
+				code: "deadline",
+				context: {
+					stage: stage.stage,
+					deadline: this.#deadline
+				}
+			})), { once: true });
+		});
+	}
+	async #destroy() {
+		try {
+			await this.#arming;
+		} catch {}
+		await Promise.all([
+			this.#type.destroy(),
+			this.#lint.destroy(),
+			this.#runtime.destroy()
+		]);
+	}
+	#version(name) {
+		const version = readWorkspaceManifest(this.#workspace, name).contents.version;
+		if (typeof version !== "string") throw new ProbeError(`${name} publishes no readable version`, {
+			origin: "workspace",
+			code: "malformed",
+			context: { name }
+		});
+		return version;
+	}
+	#support() {
+		const version = this.#toolchain.typescript;
+		const range = peerDependencies.typescript;
+		const supported = /^\^(\d+)\./u.exec(range)?.[1];
+		const found = /^(\d+)\./u.exec(version)?.[1];
+		if (supported === void 0 || found !== supported) throw new ProbeError(`The supported TypeScript range is ${range}; found ${version}`, {
+			origin: "workspace",
+			code: "malformed",
+			context: {
+				name: "typescript",
+				value: version
+			}
+		});
+	}
+};
+//#endregion
+//#region src/server/ProbeServer.ts
+/**
+* Serves one probe over this process's Model Context Protocol stdio transport.
+*
+* @remarks
+* Construction creates the probe, publishes the `prove` tool, and binds the dual-era dispatcher to
+* the stdio transport. The probe begins warming there, so a harness that spawns the entry pays
+* arming while its client is still handshaking.
+*
+* `start` seizes standard input and registers the signals a harness ends a child with, and records
+* whether standard input was already flowing. Every listener it attaches is held as a field, and
+* `destroy` removes exactly those by reference, so a listener a host registers while this server is
+* serving is still attached and still fires afterwards. The transport reads a stream this server
+* owns rather than this process's standard input, which is what makes that possible: the
+* transport's own listeners land on that stream, and the only listeners this server ever puts on
+* `process.stdin` are the `data`, `close`, and `error` forwarders into it. `destroy` pauses the
+* stream only when this server is what set it flowing and nothing else is reading it, so a process
+* that outlives this server reads its own standard input again and receives its own signals.
+* Teardown removes the signal handlers first: it takes seconds when a boot is in flight, and a
+* harness that signals again means to kill rather than to queue.
+*
+* @example
+* ```ts
+* const server = new ProbeServer({ workspace: process.cwd() })
+* server.start()
+* await server.destroy()
+* ```
+*/
+var ProbeServer = class {
+	#probe;
+	#stream;
+	#transport;
+	#data;
+	#close;
+	#error;
+	#signal;
+	#owns;
+	#closing;
+	/**
+	* Creates the probe this server publishes and binds it to this process's stdio transport.
+	*
+	* @param options - Workspace, deadline, and initial observation hooks for the probe it creates
+	*/
+	constructor(options) {
+		this.#probe = new Probe(options);
+		this.#stream = new PassThrough();
+		this.#transport = createStdioServer(createMCPLegacy(this.#publish()), { input: this.#stream });
+		this.#data = this.#receive.bind(this);
+		this.#close = this.#finish.bind(this);
+		this.#error = this.#fail.bind(this);
+		this.#signal = this.#release.bind(this);
+	}
+	start() {
+		if (this.#closing !== void 0) throw createDestroyedError("probe server");
+		if (this.#owns !== void 0) return;
+		this.#owns = process.stdin.readableFlowing !== true;
+		this.#transport.start();
+		process.stdin.on("data", this.#data);
+		process.stdin.on("close", this.#close);
+		process.stdin.on("error", this.#error);
+		process.on("SIGINT", this.#signal);
+		process.on("SIGTERM", this.#signal);
+	}
+	destroy() {
+		if (this.#closing !== void 0) return this.#closing;
+		this.#closing = this.#destroy();
+		return this.#closing;
+	}
+	async #destroy() {
+		process.removeListener("SIGINT", this.#signal);
+		process.removeListener("SIGTERM", this.#signal);
+		this.#transport.stop();
+		process.stdin.removeListener("data", this.#data);
+		process.stdin.removeListener("close", this.#close);
+		process.stdin.removeListener("error", this.#error);
+		if (this.#owns === true && process.stdin.listenerCount("data") === 0) process.stdin.pause();
+		this.#owns = void 0;
+		this.#stream.destroy();
+		await this.#probe.destroy();
+	}
+	#receive(chunk) {
+		this.#stream.write(chunk);
+	}
+	#finish() {
+		this.#stream.end();
+	}
+	#fail(error) {
+		this.#stream.destroy(error);
+	}
+	#release() {
+		this.destroy();
+	}
+	#publish() {
+		const parameters = schemaToParameters(compileSchema(CLAIM_SHAPE));
+		if (parameters === void 0) throw new ProbeError("The claim schema cannot be advertised as tool parameters", {
+			origin: "instrument",
+			code: "malformed"
+		});
+		const tools = createToolManager();
+		tools.add(createTool({
+			name: "prove",
+			description: "Proves a claim with type, lint, and runtime evidence.",
+			parameters,
+			execute: async (input) => {
+				if (!isClaim(input)) {
+					const refused = findRefusedPaths(input);
+					throw new ProbeError(refused.length === 0 ? "The prove tool requires a claim matching the advertised schema" : `The prove tool refuses ${refused.join(", ")}: a draft path must stay inside the workspace, which the advertised schema does not constrain`, {
+						origin: "claimant",
+						code: "refused",
+						context: { value: input }
+					});
+				}
+				return this.#probe.prove(input);
+			}
+		}));
+		return createMCPServer({
+			identity: {
+				name: "probe",
+				version
+			},
+			tools,
+			execution: async ({ call }) => {
+				const result = await tools.execute(call);
+				if (!result.success) return result;
+				if (!isVerdict(result.value)) throw new ProbeError("The prove tool returned an invalid verdict", {
+					origin: "instrument",
+					code: "malformed",
+					context: { value: result.value }
+				});
+				return {
+					resultType: "complete",
+					content: [{
+						type: "text",
+						text: formatVerdict(result.value)
+					}]
+				};
+			}
+		});
+	}
+};
+//#endregion
+export { LintStage, Overlay, Probe, ProbeServer, RuntimeStage, TypeStage, captureListeners, computeDigest, createRevisionFile, describeUnknown, findRefusedPaths, inferDocumentLanguage, inferTestProject, inferTypeProject, loadWorkspaceModule, matchesWorkspaceModule, normalizePath, normalizeValue, parseContentLength, readWorkspaceManifest, relativeWorkspaceFile, releaseListeners, resolveWorkspaceBinary, resolveWorkspaceFile, resolveWorkspaceModule };
+
+//# sourceMappingURL=index.js.map