@redue/cli 0.0.0-stage → 0.1.0-alpha.10

package/src/probe-result.mjs

@@ -0,0 +1,21 @@
+// Internal supported-provider protocol. Default stdout is unchanged, so
+// ordinary run checkpoints keep the same probe/result identity. The daemon
+// may reuse a complete result only after revalidating its input key AND this
+// independently checked execution/toolchain context. No TTL grants trust.
+import {deflateSync} from 'node:zlib';
+export function contextOnly(context) {
+  if(process.argv.includes('--redue-context')){
+    process.stdout.write(context);return true;
+  }
+  return false;
+}
+export function probeResult(output,context,queries=null) {
+  if(!process.argv.includes('--redue-checkpoint')){process.stdout.write(output);return;}
+  const raw=queries?JSON.stringify(queries):null;
+  let value=JSON.stringify({output,context,queryData:raw&&Buffer.byteLength(raw)<=8*1024*1024?
+    deflateSync(raw).toString('base64'):null});
+  // Optimization metadata must not overflow the ordinary probe channel.
+  // Larger contracts keep the normal complete probe, without result reuse.
+  if(Buffer.byteLength(value)>512*1024)value=JSON.stringify({output,context,queries:null});
+  process.stdout.write(value);
+}

package/src/process-liveness.mjs

@@ -0,0 +1,11 @@
+import fs from 'node:fs';
+
+export function processAlive(pid) {
+  if(!Number.isSafeInteger(pid)||pid<1)return true;
+  if(process.platform==='linux')try{
+    const stat=fs.readFileSync(`/proc/${pid}/stat`,'utf8');
+    if(['Z','X'].includes(stat.slice(stat.lastIndexOf(')')+2)[0]))return false;
+  }catch(e){if(e.code!=='ENOENT'&&e.code!=='ESRCH')return true;}
+  try{process.kill(pid,0);return true;}
+  catch(e){return e.code!=='ESRCH';}
+}

package/src/project-location.mjs

@@ -0,0 +1,34 @@
+// Shared project selection only; evidence and caller-context semantics stay in the kernel.
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+import {realObservedPath} from './path-identity.mjs';
+import {stateIdentity,userStateBase} from './platform-state.mjs';
+
+export function discoverConfig(cwd=process.cwd()) {
+  let dir=path.resolve(cwd);const found=[];
+  for(;;){
+    for(const name of ['redue.config.json','vstate.config.json']) {
+      const file=path.join(dir,name);
+      if(fs.existsSync(file))found.push(file);
+    }
+    if(fs.existsSync(path.join(dir,'.git'))||path.dirname(dir)===dir)break;
+    dir=path.dirname(dir);
+  }
+  if(found.length>1)throw Error('multiple REDUE configurations apply; select the intended one with --config FILE');
+  return found[0]||path.resolve(cwd,'redue.config.json');
+}
+export function canonicalConfig(configFile) {
+  return path.join(realObservedPath(path.dirname(configFile)),path.basename(configFile));
+}
+export function projectState(root,configFile) {
+  return path.join(userStateBase(process.platform,process.env,os.homedir()),'vstate',
+    `vstate-${createHash('sha256').update(stateIdentity(root)+'\0'+stateIdentity(canonicalConfig(configFile))).digest('hex').slice(0,16)}`);
+}
+export function readProject(configFile) {
+  const config=JSON.parse(fs.readFileSync(configFile,'utf8'));
+  if(config.schema!==1||!Array.isArray(config.checks)||!config.checks.length)
+    throw Error('config needs schema 1 and at least one check');
+  return {config,root:realObservedPath(path.resolve(path.dirname(configFile),config.root||'.'))};
+}

package/src/run-lock.mjs

@@ -0,0 +1,77 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {randomUUID} from 'node:crypto';
+import {processAlive} from './process-liveness.mjs';
+
+const alive=processAlive;
+const write=(file,value)=>{
+  const temp=file+`.${process.pid}.tmp`;
+  fs.writeFileSync(temp,JSON.stringify(value),{mode:0o600});
+  fs.renameSync(temp,file);
+};
+
+export function inspectRunLock(state) {
+  const lock=path.join(state,'run.lock');
+  if(!fs.existsSync(lock))return {state:'absent'};
+  let owner;
+  try{owner=JSON.parse(fs.readFileSync(path.join(lock,'owner.json'),'utf8'));}
+  catch{return {state:'uncertain',reason:'lock owner record missing or unreadable'};}
+  if(owner.schema!==1||!owner.token||!Number.isSafeInteger(owner.pid))
+    return {state:'uncertain',reason:'lock owner record invalid'};
+  if(alive(owner.pid))return {state:'live',reason:'wrapper process exists',owner};
+  if(owner.phase==='running'&&Number.isSafeInteger(owner.childPid)&&alive(owner.childPid))
+    return {state:'uncertain',reason:'recorded check process is still running',owner};
+  if(['launching','running','finished'].includes(owner.phase))
+    return {state:'uncertain',reason:'a descendant check process may survive; operator review required',owner};
+  if(owner.phase!=='prepared')
+    return {state:'uncertain',reason:'unknown wrapper phase',owner};
+  return {state:'abandoned',reason:'wrapper died before child launch',owner};
+}
+
+function reclaim(state,confirmed=false){
+  const lock=path.join(state,'run.lock'),guard=path.join(state,'run-recovery.lock');
+  fs.mkdirSync(guard);
+  try{
+    const status=inspectRunLock(state);
+    if(status.state!=='abandoned'){
+      const owner=status.owner;
+      const candidate=confirmed&&status.state==='uncertain'&&owner&&
+        !alive(owner.pid)&&(!Number.isSafeInteger(owner.childPid)||!alive(owner.childPid));
+      if(!candidate)throw Error(`run lock ${status.state}: ${status.reason}; inspect ${lock}`);
+    }
+    const entries=fs.readdirSync(lock);
+    if(entries.length!==1||entries[0]!=='owner.json')
+      throw Error('run lock has unexpected files; operator inspection required');
+    const quarantined=path.join(state,`abandoned-run-${randomUUID()}`);
+    fs.renameSync(lock,quarantined);
+    fs.unlinkSync(path.join(quarantined,'owner.json'));fs.rmdirSync(quarantined);
+  }finally{fs.rmdirSync(guard);}
+}
+
+export function recoverRunLock(state,confirmed=false){
+  if(!confirmed)throw Error('explicit --confirm-check-stopped required');
+  reclaim(state,true);
+  return {recovered:true};
+}
+
+export function acquireRunLock(state) {
+  const lock=path.join(state,'run.lock');
+  const token=randomUUID();
+  try{fs.mkdirSync(lock);}
+  catch(e){
+    if(e.code!=='EEXIST')throw e;
+    reclaim(state);
+    fs.mkdirSync(lock);
+  }
+  const owner={schema:1,token,pid:process.pid,phase:'prepared',childPid:null,
+    startedAt:Date.now()};
+  const file=path.join(lock,'owner.json');write(file,owner);
+  return {
+    phase(value,childPid=null){owner.phase=value;owner.childPid=childPid;write(file,owner);},
+    release(){
+      const current=JSON.parse(fs.readFileSync(file,'utf8'));
+      if(current.token!==token)throw Error('run lock ownership changed; refusing removal');
+      fs.unlinkSync(file);fs.rmdirSync(lock);
+    }
+  };
+}

package/src/state-store.mjs

@@ -0,0 +1,73 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const STATE_SCHEMA=1;
+
+export function atomicJson(file,value){
+  const temp=file+`.`+process.pid+`.tmp`;
+  fs.writeFileSync(temp,JSON.stringify(value),{mode:0o600});
+  // Windows readers and AV can briefly hold the replaced name open. Keep the
+  // old complete file until replacement succeeds; never delete it first.
+  for(let attempt=0;;attempt++)try{fs.renameSync(temp,file);break;}catch(e){
+    if(process.platform!=='win32'||!['EPERM','EACCES','EBUSY'].includes(e.code)||attempt===9)
+      throw e;
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,10*(attempt+1));
+  }
+}
+
+export function readReceipts(state){
+  let value;
+  try{value=JSON.parse(fs.readFileSync(path.join(state,'receipts-v1.json'),'utf8'));}
+  catch(e){if(e.code==='ENOENT')return {schema:STATE_SCHEMA,checks:{}};throw e;}
+  if(!value||typeof value!=='object'||Array.isArray(value)||value.schema!==STATE_SCHEMA||
+    !value.checks||typeof value.checks!=='object'||Array.isArray(value.checks))
+    throw Error(`incompatible receipt state in ${state}; inspect or remove only this vstate state directory`);
+  return value;
+}
+
+// This identity detects replacement of REDUE's owned, atomically written receipt
+// selector. It is not an input-content fingerprint or permission to reuse inputs.
+export function receiptRevision(state){
+  // A failed/crashed owned writer may have persisted a new immutable outcome
+  // without replacing the selector. Never certify its older selection.
+  try {fs.lstatSync(path.join(state,'receipt-selection-pending-v1.json'));
+    throw Error('receipt selection update incomplete; inspect the failed run, then record a new execution to recover');
+  }catch(error){if(error.code!=='ENOENT')throw error;}
+  try {const stat=fs.statSync(path.join(state,'receipts-v1.json'),{bigint:true});
+    if(!stat.isFile())throw Error('receipt selector is not a file');
+    return JSON.stringify(['dev','ino','size','mtimeNs','ctimeNs'].map(key=>String(stat[key])));
+  }catch(error){if(error.code==='ENOENT')return 'absent';throw error;}
+}
+
+export function readReceiptSnapshot(state){
+  const revision=receiptRevision(state),value=readReceipts(state);
+  if(receiptRevision(state)!==revision)
+    throw Error('receipt selection changed during read; retry status');
+  return {revision,value};
+}
+
+export function commitReceipt(state,name,receipt){
+  const prior=readReceipts(state),runId=receipt.invocation?.runId;
+  if(!/^[0-9a-f-]{36}$/.test(runId||''))throw Error('receipt lacks a valid run ID');
+  const runs=path.join(state,'runs-v1');
+  fs.mkdirSync(runs,{recursive:true,mode:0o700});
+  // The caller holds the state run lock. Leave this marker on any write failure;
+  // only a later successful owned commit may clear it. No journal scan guesses
+  // which incomplete execution should become the selected evidence.
+  const pending=path.join(state,'receipt-selection-pending-v1.json');
+  let updates={schema:STATE_SCHEMA,checks:{}};
+  try {updates=JSON.parse(fs.readFileSync(pending,'utf8'));
+    if(updates?.schema!==STATE_SCHEMA||!updates.checks||typeof updates.checks!=='object'||Array.isArray(updates.checks))
+      throw Error('incompatible incomplete receipt update; inspect owned state before recording');
+  }catch(error){if(error.code!=='ENOENT')throw error;}
+  updates.checks[name]={runId};
+  atomicJson(pending,updates);
+  // One immutable outcome per invocation. Never overwrite an existing run.
+  fs.writeFileSync(path.join(runs,runId+'.json'),
+    JSON.stringify({schema:STATE_SCHEMA,check:name,receipt}),{flag:'wx',mode:0o600});
+  prior.checks[name]=receipt;
+  atomicJson(path.join(state,'receipts-v1.json'),prior);
+  delete updates.checks[name];
+  if(Object.keys(updates.checks).length)atomicJson(pending,updates);
+  else fs.unlinkSync(pending);
+}

package/src/toolchain-probe.mjs

@@ -0,0 +1,21 @@
+// Read-only execution identity for explicitly named local tools. Output contains
+// hashes and metadata only; the verifier hashes the output again for its receipt.
+import fs from 'node:fs';
+import {createHash} from 'node:crypto';
+import {fileURLToPath} from 'node:url';
+
+const sha=value=>createHash('sha256').update(value).digest('hex');
+function identity(file) {
+  const real=fs.realpathSync(file),stat=fs.statSync(real,{bigint:true});
+  if(!stat.isFile())throw Error('toolchain identity requires a regular file');
+  const facts=[sha(real),...['dev','ino','mode','size','mtimeNs','ctimeNs']
+    .map(key=>String(stat[key]))];
+  // Hash small scripts/bundles on each probe. For large native executables,
+  // version plus identity/metadata keeps synchronized reads inexpensive.
+  if(stat.size<=16n*1024n*1024n)facts.push(sha(fs.readFileSync(real)));
+  return facts;
+}
+const own=fileURLToPath(import.meta.url);
+process.stdout.write(JSON.stringify({schema:1,nodeVersion:process.version,
+  node:identity(process.execPath),probe:identity(own),
+  tools:process.argv.slice(2).map(identity)}));

package/src/typescript-contract-probe.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// Retired npm-launcher interpretation. Do not return even a context-only digest:
+// old receipts and cached compiler certificates cannot qualify this obligation.
+console.error('VSTATE_REASON:npm-launcher-unobserved-inputs');
+process.exitCode=2;

package/src/typescript-input-facts.mjs

@@ -0,0 +1,65 @@
+// Extracted from the existing npm TypeScript probe; shared compiler input logic.
+import fs from 'node:fs';import path from 'node:path';import {createHash} from 'node:crypto';
+import {createRequire} from 'node:module';import {spawnSync} from 'node:child_process';
+import {compilerFiles} from './typescript-list.mjs';
+import {withinPath as within,realObservedPath} from './path-identity.mjs';
+import {timing} from './decision-profile.mjs';
+const require=createRequire(import.meta.url),hash=value=>createHash('sha256').update(value).digest('hex');
+const digestFile=file=>hash(fs.readFileSync(file));
+const fail=code=>{throw Object.assign(Error(code),{code});};
+export function typeScriptInputFacts(root,tsRoot,tsc){
+  const configReads=new Set(),visited=new Set();
+  let ts;try{ts=require(tsRoot);}catch{}
+  if(typeof ts?.getParsedCommandLineOfConfigFile==='function'){
+    const host={...ts.sys,readFile(file){configReads.add(path.resolve(file));
+      return ts.sys.readFile(file);},onUnRecoverableConfigFileDiagnostic(){}};
+    const parseConfig=file=>{
+      const absolute=path.resolve(file);
+      if(!within(absolute,root))fail('typescript-config-outside-repository');
+      if(visited.has(absolute))return;visited.add(absolute);
+      if(visited.size>64)fail('typescript-config-graph-too-large');
+      const parsed=ts.getParsedCommandLineOfConfigFile(absolute,{},host);
+      if(!parsed||parsed.errors?.length)fail('typescript-config-unavailable');
+      if(parsed.options?.plugins?.length)fail('typescript-plugin-unsupported');
+      if(parsed.options?.incremental||parsed.options?.composite)
+        fail('typescript-incremental-unsupported');
+      for(const reference of parsed.projectReferences||[])
+        parseConfig(reference.path.endsWith('.json')?reference.path:
+          path.join(reference.path,'tsconfig.json'));
+    };
+    parseConfig(path.join(root,'tsconfig.json'));
+  }else{
+    // TypeScript 7's native compiler does not expose the previous config API.
+    // Its CLI reports the effective config; restrict this path to one direct
+    // config rather than guessing about extends/reference provenance.
+    const config=path.join(root,'tsconfig.json'),raw=fs.readFileSync(config,'utf8');
+    if(/"(?:extends|references|plugins|incremental|composite)"\s*:/.test(raw))
+      fail('typescript-config-graph-unsupported');
+    const shown=spawnSync(process.execPath,[tsc,'--showConfig'],{cwd:root,
+      env:process.env,encoding:'utf8',timeout:4000,maxBuffer:16*1024*1024,
+      stdio:['ignore','pipe','pipe']});
+    if(shown.error||shown.signal||shown.status!==0)fail('typescript-config-unavailable');
+    const effective=JSON.parse(shown.stdout);
+    if(effective.compilerOptions?.plugins?.length||
+      effective.compilerOptions?.incremental||effective.compilerOptions?.composite)
+      fail('typescript-config-graph-unsupported');
+    configReads.add(config);
+  }
+  for(const file of configReads)if(!within(realObservedPath(file),root))
+    fail('typescript-config-outside-repository');
+  const listingStarted=performance.now();
+  const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(tsRoot,root):null;
+  const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'--noEmit','--listFilesOnly'],
+    {cwd:root,env:process.env,encoding:'utf8',timeout:process.platform==='win32'?10000:4000,
+      maxBuffer:16*1024*1024,
+      stdio:['ignore','pipe','pipe']});
+  timing('typescript_contract.list_files',listingStarted,{status:listed.status??null,
+    error:listed.error?.code||null});
+  if(listed.error||listed.signal||listed.status!==0)fail('typescript-input-list-unavailable');
+  const files=listed.stdout.trim().split(/\r?\n/).filter(Boolean)
+    .map(file=>path.resolve(file));
+  if(!files.length||files.some(file=>!within(realObservedPath(file),root)))
+    fail('typescript-input-outside-repository');
+  return {configs:[...configReads].sort().map(file=>[hash(file),digestFile(file)]),
+    files:[...new Set(files)].sort().map(file=>[hash(file),digestFile(file)]),queries:captured?.queries};
+}

package/src/typescript-list.mjs

@@ -0,0 +1,72 @@
+// TypeScript's compiler host exposes the filesystem questions used to resolve
+// a program. Capture those answers, not runtime application accesses. Reuse is
+// allowed only while every answer and the observed input content still matches.
+import fs from 'node:fs';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {createRequire} from 'node:module';
+const require=createRequire(import.meta.url);
+const hash=value=>createHash('sha256').update(JSON.stringify(value)).digest('hex');
+export function queryAnswer(kind,file,options) {
+  try{
+    if(kind==='readDirectory')return require(options.tsRoot).sys.readDirectory(file,
+      ...options.args.map((value,i)=>options.undefinedArguments?.includes(i)?undefined:value)).sort();
+    if(kind==='readFile')return hash(fs.readFileSync(file,'utf8'));
+    if(kind==='fileExists')return fs.statSync(file).isFile();
+    if(kind==='directoryExists')return fs.statSync(file).isDirectory();
+    if(kind==='realpath')return fs.realpathSync(file);
+    if(kind==='directories')return fs.readdirSync(file,{withFileTypes:true})
+      .filter(entry=>entry.isDirectory()||entry.isSymbolicLink()&&
+        fs.statSync(path.join(file,entry.name)).isDirectory()).map(entry=>entry.name).sort();
+    // Directory entries include names/types, including newly created candidates.
+    if(kind==='entries')return fs.readdirSync(file,{withFileTypes:true})
+      .map(entry=>[entry.name,entry.isDirectory()?'d':entry.isSymbolicLink()?'l':'f']).sort();
+    throw Error('unknown compiler filesystem question');
+  }catch(error){if(['ENOENT','ENOTDIR'].includes(error.code))return null;throw error;}
+}
+export function queriesMatch(queries) {
+  if(!queries?.length)return false;
+  return queries.every(([kind,file,answer,options])=>
+    JSON.stringify(queryAnswer(kind,file,options))===JSON.stringify(answer));
+}
+export function compilerFiles(tsRoot,cwd) {
+  const require=createRequire(import.meta.url),ts=require(tsRoot);
+  if(typeof ts.createProgram!=='function'||typeof ts.createCompilerHost!=='function')return null;
+  const queries=new Map();
+  const remember=(kind,file)=>{
+    const full=path.resolve(file),answer=queryAnswer(kind,full);
+    queries.set(kind+'\0'+full,[kind,full,answer]);return answer;
+  };
+  const readFile=file=>{remember('readFile',file);return ts.sys.readFile(file);};
+  const fileExists=file=>{remember('fileExists',file);return ts.sys.fileExists(file);};
+  const directoryExists=file=>{remember('directoryExists',file);return ts.sys.directoryExists(file);};
+  const getDirectories=file=>{remember('directories',file);return ts.sys.getDirectories(file);};
+  const readDirectory=(dir,...args)=>{
+    const result=ts.sys.readDirectory(dir,...args);
+    // JSON turns undefined array entries into null. TypeScript distinguishes
+    // them (an omitted exclude list is not a null list), so retain that fact.
+    const full=path.resolve(dir),options={tsRoot,args,argsVersion:1,
+      undefinedArguments:args.flatMap((value,i)=>value===undefined?[i]:[])};
+    queries.set('readDirectory\0'+full+JSON.stringify(args),
+      ['readDirectory',full,[...result].sort(),options]);
+    return result;
+  };
+  const parsed=ts.getParsedCommandLineOfConfigFile(path.join(cwd,'tsconfig.json'),{},
+    {...ts.sys,readFile,fileExists,directoryExists,getDirectories,readDirectory,
+      onUnRecoverableConfigFileDiagnostic(){}});
+  if(!parsed||parsed.errors?.length)throw Error('TypeScript configuration unavailable');
+  const host=ts.createCompilerHost(parsed.options);
+  Object.assign(host,{readFile,fileExists,directoryExists,getDirectories,
+    realpath(file){remember('realpath',file);return ts.sys.realpath(file);},
+    getSourceFile(file,languageVersion,onError){
+      const text=readFile(file);return text===undefined?undefined:
+        ts.createSourceFile(file,text,languageVersion);
+    }});
+  const program=ts.createProgram({rootNames:parsed.fileNames,options:parsed.options,
+    projectReferences:parsed.projectReferences,host});
+  const files=program.getSourceFiles().map(file=>path.resolve(file.fileName));
+  // Stable answers are necessary even at first capture; a concurrent edit
+  // cannot become the basis for a reusable discovery result.
+  const facts=[...queries.values()];
+  return {files,queries:queriesMatch(facts)?facts:null};
+}

package/src/typescript-qualification.mjs

@@ -0,0 +1,77 @@
+import {directProject,directQualification,directEnvironment} from './direct-typescript.mjs';
+import fs from 'node:fs';
+import path from 'node:path';
+import {realObservedPath} from './path-identity.mjs';
+
+// This is a machine-enforced contract, not a claim inferred from a script name.
+// Runtime validation checks effective compiler membership, configuration and
+// toolchain identity. Supported discovery certificates still validate those
+// filesystem queries; caller context is independently compared at the decision.
+export function qualifyTypeScript(root,selected,discovered={}) {
+  if(selected.qualification===directQualification){
+    const issues=[];
+    try{
+      const compiler=directProject(root,selected.script);
+      if(selected.command?.length!==3||selected.command[0]!==process.execPath||
+        selected.command[1]!==compiler.entry||selected.command[2]!=='--noEmit'||
+        selected.cwd&&selected.cwd!=='.')issues.push('direct compiler invocation changed');
+    }catch(e){issues.push(e.code||'direct compiler prerequisites unavailable');}
+    if(!selected.inputs?.includes('**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json,jsonc}')||
+      !selected.inputs?.includes('package.json')||!selected.inputs?.includes('tsconfig.json')||
+      !selected.installedInputs?.includes('node_modules/**'))issues.push('direct compiler source/config/installed inputs incomplete');
+    if(!selected.environment?.executableIdentity||
+      !directEnvironment.variables.every(key=>selected.environment?.variables?.includes(key))||
+      !directEnvironment.prefixes.every(key=>selected.environment?.prefixes?.includes(key)))
+      issues.push('direct compiler execution context incomplete');
+    if(selected.probes?.length!==1||!selected.probes?.some(argv=>path.basename(argv[1]||'')==='direct-typescript-probe.mjs'&&
+      argv[0]===process.execPath&&argv[2]===root&&argv[3]===selected.script))issues.push('direct compiler probe missing');
+    return {qualified:issues.length===0,issues};
+  }
+  if(selected.qualification==='pnpm-tsc-v1'){
+    const issues=[];
+    const workspace=selected.workspace||'.';
+    const script=selected.script||selected.command?.at(-1);
+    try{
+      if(discovered.issue)throw Error(discovered.issue);
+      const contract=discovered.workspace;
+      if(!contract)throw Error('pnpm TypeScript input discovery unavailable');
+      issues.push(...contract.limitations);
+      const declared=contract.workspace.pkg.scripts[script].trim().split(/\s+/).slice(1);
+      if(path.resolve(root,selected.cwd||'.')!==path.join(root,contract.workspace.dir)||
+        selected.command?.[0]!==process.execPath||
+        selected.command?.[1]!==contract.tsc||
+        JSON.stringify(selected.command.slice(2))!==JSON.stringify(declared))
+        issues.push('standalone TypeScript invocation changed');
+    }catch(e){issues.push(e.message);}
+    if(!selected.probes?.some(argv=>path.basename(argv[1]||'')==='pnpm-typecheck-probe.mjs'))
+      issues.push('pnpm TypeScript input probe missing');
+    if(!selected.environment?.executableIdentity||
+      !['node'].every(name=>selected.environment?.pathExecutables?.includes(name))||
+      !['PNPM_','COREPACK_','npm_config_','DYLD_','TSGO_'].every(name=>
+        selected.environment?.prefixes?.includes(name)))
+      issues.push('pnpm execution context declaration incomplete');
+    return {qualified:issues.length===0,issues};
+  }
+  if(selected.qualification==='yarn-workspace-tsc-v1'){
+    const issues=[];
+    try{
+      if(!selected.workspace||selected.command?.length!==5||
+        selected.command[1]!=='workspace'||selected.command[2]!==selected.workspace||
+        selected.command[3]!=='run')issues.push('workspace command changed');
+      else if(discovered.issue)throw Error(discovered.issue);
+      else if(!discovered.workspace)throw Error('Yarn workspace input discovery unavailable');
+    }catch(e){issues.push(e.message);}
+    if(!selected.probes?.some(argv=>path.basename(argv[1]||'')==='yarn-workspace-typecheck-probe.mjs'))
+      issues.push('workspace TypeScript input probe missing');
+    if(!selected.environment?.executableIdentity||
+      !['node','yarn'].every(name=>selected.environment?.pathExecutables?.includes(name))||
+      !['YARN_','COREPACK_','npm_config_','DYLD_','TSGO_'].every(name=>
+        selected.environment?.prefixes?.includes(name)))
+      issues.push('Yarn execution context declaration incomplete');
+    return {qualified:issues.length===0,issues};
+  }
+  if(selected.qualification!=='typescript-noemit-v1')return null;
+  // Retired automatic launcher contract: npm's notifier consumes unobserved
+  // remote/cache/time state. A successful execution is still an outcome.
+  return {qualified:false,issues:['npm launcher applicability is unqualified: update notification uses unobserved remote/cache/time inputs; run the npm script when needed']};
+}

package/src/windows-command.mjs

@@ -0,0 +1,16 @@
+import path from 'node:path';
+
+// Windows cannot CreateProcess a .cmd/.bat file directly. Keep the logical
+// argv in the receipt, and launch only the well-defined, quoted batch subset
+// through cmd.exe. Unrepresentable arguments fail instead of being altered.
+export function windowsLaunch(command,{platform=process.platform,
+  comspec=process.env.ComSpec||process.env.COMSPEC||'C:\\Windows\\System32\\cmd.exe'}={}) {
+  if(platform!=='win32')return {file:command[0],args:command.slice(1),options:{}};
+  if(!/\.(?:cmd|bat)$/i.test(path.win32.extname(command[0])))
+    return {file:command[0],args:command.slice(1),options:{}};
+  if(command.some(value=>/[\r\n"%!^&|<>]/.test(value)))
+    throw Error('Windows batch command contains characters that cannot be passed safely; use an executable or Node script as exact argv');
+  const line='"'+command.map(value=>'"'+value+'"').join(' ')+'"';
+  return {file:comspec,args:['/d','/s','/c',line],
+    options:{windowsVerbatimArguments:true,windowsHide:false},mechanism:'cmd-batch'};
+}

package/src/windows-process.mjs

@@ -0,0 +1,15 @@
+import {spawn} from 'node:child_process';
+
+// taskkill /T is the native narrow process-tree operation available without
+// elevation. It cannot own deliberately detached descendants.
+export function terminateWindowsTree(pid,{start=spawn,timeoutMs=5000}={}) {
+  if(!Number.isSafeInteger(pid)||pid<1)return Promise.reject(Error('invalid check PID'));
+  return new Promise((resolve,reject)=>{
+    const child=start('taskkill.exe',['/PID',String(pid),'/T','/F'],
+      {stdio:'ignore',windowsHide:true});
+    const timer=setTimeout(()=>{child.kill();reject(Error('taskkill deadline exceeded'));},timeoutMs);
+    child.once('error',error=>{clearTimeout(timer);reject(error);});
+    child.once('close',code=>{clearTimeout(timer);code===0?resolve():
+      reject(Error(`taskkill exited ${code}`));});
+  });
+}

package/src/yarn-workspace-inputs.mjs

@@ -0,0 +1,148 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {execFileSync} from 'node:child_process';
+import {createRequire} from 'node:module';
+import micromatch from './glob.mjs';
+import {withinPath as within,realObservedPath} from './path-identity.mjs';
+
+export function yarnLocalTsc(root){
+  const expected=path.join(root,'node_modules','typescript','bin','tsc');
+  if(process.platform==='win32'){
+    const shim=path.join(root,'node_modules','.bin','tsc.cmd');
+    const body=fs.readFileSync(shim,'utf8').replace(/\r\n/g,'\n').trim();
+    const standard=`@IF EXIST "%~dp0\\node.exe" (
+  "%~dp0\\node.exe"  "%~dp0\\..\\typescript\\bin\\tsc" %*
+) ELSE (
+  @SETLOCAL
+  @SET PATHEXT=%PATHEXT:;.JS;=;%
+  node  "%~dp0\\..\\typescript\\bin\\tsc" %*
+)`;
+    if(body!==standard)throw Error('local TypeScript executable is not the installed compiler');
+    return realObservedPath(expected);
+  }
+  const tsc=realObservedPath(path.join(root,'node_modules','.bin','tsc'));
+  if(tsc!==expected)throw Error('local TypeScript executable is not the installed compiler');
+  return tsc;
+}
+
+const posix=file=>file.split(path.sep).join('/');
+const read=file=>JSON.parse(fs.readFileSync(file,'utf8'));
+const relative=(root,file)=>posix(path.relative(root,file));
+const safeDirectory=(root,dir)=>{
+  const full=path.resolve(root,dir);
+  if(!within(full,root))throw Error('workspace path escapes checkout');
+  return full;
+};
+
+export function yarnWorkspacePackages(root){
+  root=realObservedPath(root);
+  const pkg=read(path.join(root,'package.json'));
+  const patterns=Array.isArray(pkg.workspaces)?pkg.workspaces:pkg.workspaces?.packages;
+  if(!Array.isArray(patterns)||!patterns.length||patterns.some(value=>
+    typeof value!=='string'||path.isAbsolute(value)||value.split('/').includes('..')))
+    throw Error('workspace declarations are unsupported');
+  const files=execFileSync('git',['ls-files','--cached','--others','--exclude-standard',
+    '-z','--',':(glob)**/package.json'],{cwd:root,env:{...process.env,GIT_OPTIONAL_LOCKS:'0'},
+    maxBuffer:32*1024*1024,timeout:5000}).toString().split('\0').filter(Boolean);
+  const found=new Map();
+  for(const file of files){
+    const dir=path.posix.dirname(file);
+    if(dir==='.'||dir.split('/').includes('node_modules')||
+      !micromatch.isMatch(dir,patterns,{dot:true}))continue;
+    const member=read(path.join(root,file));
+    if(!member.name||found.has(member.name))throw Error('workspace package name missing or duplicated');
+    found.set(member.name,{name:member.name,dir,manifest:file,pkg:member});
+  }
+  if(found.size>50)throw Error('workspace count exceeds narrow Node onboarding contract');
+  return found;
+}
+
+function parsedTypeScript(root,dir){
+  const require=createRequire(path.join(root,'package.json'));
+  const ts=require(path.join(root,'node_modules','typescript'));
+  const config=path.join(root,dir,'tsconfig.json'),reads=new Set();
+  const host={...ts.sys,readFile(file){reads.add(path.resolve(file));return ts.sys.readFile(file);},
+    onUnRecoverableConfigFileDiagnostic(){}};
+  const parsed=ts.getParsedCommandLineOfConfigFile(config,{},host);
+  if(!parsed||parsed.errors?.length)throw Error('TypeScript configuration unavailable');
+  const raw=ts.readConfigFile(config,ts.sys.readFile);
+  if(raw.error||!Array.isArray(raw.config?.include)||raw.config.include.length!==1||
+    !['src','src/**/*','src/**'].includes(raw.config.include[0]))
+    throw Error('workspace TypeScript file membership is outside the supported src include');
+  if(parsed.options.plugins?.length||parsed.options.incremental||parsed.options.composite)
+    throw Error('TypeScript plugins or incremental/project builds are outside this contract');
+  if(parsed.options.paths||parsed.options.baseUrl||parsed.options.rootDirs?.length||
+    parsed.options.typeRoots?.length||parsed.options.customConditions?.length||
+    parsed.options.moduleSuffixes?.length||
+    parsed.options.moduleResolution!==undefined&&
+      parsed.options.moduleResolution!==ts.ModuleResolutionKind.Node10)
+    throw Error('custom TypeScript module resolution needs explicit input coverage');
+  if(parsed.projectReferences?.length)throw Error('TypeScript project references need a separate contract');
+  for(const file of reads)if(!within(realObservedPath(file),root))
+    throw Error(`TypeScript configuration escapes the checkout: ${path.basename(file)}`);
+  return {parsed,configs:[...reads].map(file=>relative(root,file)).sort()};
+}
+
+export function yarnWorkspaceTypecheckInputs(root,workspace,script){
+  root=realObservedPath(root);
+  const rootPkg=read(path.join(root,'package.json'));
+  if(!/^yarn@4\./.test(rootPkg.packageManager||''))throw Error('pinned Yarn 4 required');
+  const yarnrc=fs.readFileSync(path.join(root,'.yarnrc.yml'),'utf8');
+  const linker=yarnrc.match(/^\s*nodeLinker\s*:\s*['"]?([\w-]+)/m)?.[1];
+  const mode=yarnrc.match(/^\s*nmMode\s*:\s*['"]?([\w-]+)/m)?.[1]||'classic';
+  if(linker!=='node-modules'||mode!=='classic')
+    throw Error('Yarn node-modules classic installation required');
+  if(/^\s*(?:yarnPath|plugins)\s*:/m.test(yarnrc))
+    throw Error('custom Yarn executable or plugins need explicit toolchain coverage');
+  const members=yarnWorkspacePackages(root),selected=members.get(workspace);
+  if(!selected)throw Error(`workspace ${workspace} is not declared`);
+  if(selected.pkg.scripts?.[script]?.trim()!=='tsc -p .'||
+    selected.pkg.scripts?.['pre'+script]||selected.pkg.scripts?.['post'+script])
+    throw Error('workspace typecheck must be standalone tsc -p .');
+  const packageDir=safeDirectory(root,selected.dir);
+  if(fs.existsSync(path.join(packageDir,'node_modules','.bin','tsc'))||
+    fs.existsSync(path.join(packageDir,'node_modules','.bin','tsc.cmd')))
+    throw Error('workspace-local TypeScript executable needs separate toolchain coverage');
+  const {parsed,configs}=parsedTypeScript(root,selected.dir);
+  const outDir=parsed.options.outDir&&within(path.resolve(parsed.options.outDir),root)?
+    relative(root,path.resolve(parsed.options.outDir)):null;
+  if(!parsed.options.noEmit&&!outDir)
+    throw Error('emitting TypeScript check needs an in-checkout outDir');
+  if(outDir&&within(path.join(root,outDir),path.join(packageDir,'src')))
+    throw Error('TypeScript output overlaps observed source inputs');
+  const closure=new Map(),visit=member=>{
+    for(const name of Object.keys({...member.pkg.dependencies,...member.pkg.devDependencies,
+      ...member.pkg.peerDependencies,...member.pkg.optionalDependencies})){
+      const dep=members.get(name);if(!dep||dep.name===selected.name||closure.has(name))continue;
+      closure.set(name,dep);visit(dep);
+    }
+  };
+  visit(selected);
+  const source=[...new Set(['package.json','yarn.lock','.yarnrc.yml',
+    selected.manifest,...configs,`${selected.dir}/src/**`])];
+  const installed=['node_modules/**',`${selected.dir}/node_modules/**`];
+  const generated=[];
+  const linkTriggers=[];
+  for(const member of members.values()){
+    const logical=`node_modules/${member.name}`;
+    installed.push(`!${logical}`,`!${logical}/**`);
+    if(!closure.has(member.name))continue;
+    installed.push(`${member.dir}/node_modules/**`);
+    const declaration=member.pkg.types||member.pkg.typings;
+    if(!declaration||path.isAbsolute(declaration)||declaration.split('/').includes('..'))
+      throw Error(`${member.name} has no supported declaration-output location`);
+    const output=path.posix.dirname(declaration);
+    const outputDir=output==='.'?member.dir:`${member.dir}/${output}`;
+    generated.push(`${outputDir}/**`);
+    source.push(member.manifest);
+    // The logical link is part of resolution identity even though its target
+    // contents are indexed at the physical workspace output location.
+    linkTriggers.push(logical);
+  }
+  yarnLocalTsc(root);
+  return {workspace:selected,closure:[...closure.values()],source:[...new Set(source)],
+    installed,generated:[...new Set(generated)],configs,
+    configurationInputs:[...new Set(['package.json','yarn.lock','.yarnrc.yml',
+      ...configs,...members.values().map(row=>row.manifest),
+      'node_modules/.yarn-state.yml'])],linkTriggers,outDir};
+}