@redue/cli 0.1.0-alpha.11 → 0.1.0-alpha.12

package/src/direct-run-certificate.mjs

@@ -10,12 +10,20 @@ import {timing} from './decision-profile.mjs';
 import {directCompiler,directContextHash,directEnvironmentIssue,directProbeOutput,directProbeValue} from './direct-typescript.mjs';
 import {withinPath} from './path-identity.mjs';
 const hash=value=>createHash('sha256').update(value).digest('hex');
-export function directRunCertificateAllowed(selected) {
+// Whether a direct run is recorded at all: on macOS and Linux, always, so its
+// run facts are known even when full probes check it.
+export function directRunRecordable(selected) {
   return ['darwin','linux'].includes(process.platform)&&selected.qualification==='npm-typescript-direct-v1'&&
     selected.probes?.length===1&&
-    selected.probes[0][1]===fileURLToPath(new URL('direct-typescript-probe.mjs',import.meta.url))&&
+    selected.probes[0][1]===fileURLToPath(new URL('direct-typescript-probe.mjs',import.meta.url));
+}
+// Whether a recorded run may replace the probes (tests can force full probes).
+export function directRunCertificateAllowed(selected) {
+  return directRunRecordable(selected)&&
     !(process.env.VSTATE_TEST_FAULTS==='1'&&process.env.VSTATE_TEST_FULL_RUN_PROBES==='1');
 }
+// The incremental build-info file the plan leaves out of the inputs, if any.
+export const buildInfoPath=plan=>typeof plan?.buildInfo==='string'?path.join(plan.root,plan.buildInfo):null;
 // The start snapshot's discovery certificate, checked without a child process.
 // Returns what a recorded run is compared against, or null for full probes.
 export function directRunCertificate(plan,selected,snapshot,root) {
@@ -26,7 +34,7 @@ export function directRunCertificate(plan,selected,snapshot,root) {
     c.planId!==snapshot.planId||c.cwd!==plan.cwd||
     c.probeDefinition!==hash(JSON.stringify(selected.probes))||
     ![c.output,c.context,c.stderrHash].every(s=>typeof s==='string'&&/^[a-f0-9]{64}$/.test(s))||
-    typeof c.queryData!=='string'||c.queryData.length>512*1024)
+    typeof c.queryData!=='string'||c.queryData.length>1024*1024)
     return fallback('certificate_unavailable');
   // The compile runs in this process's environment; the daemon's is never substituted.
   if(directEnvironmentIssue())return fallback('environment_unsupported');
@@ -41,9 +49,21 @@ export function directRunCertificate(plan,selected,snapshot,root) {
     const queries=JSON.parse(inflateSync(Buffer.from(c.queryData,'base64'),{maxOutputLength:8*1024*1024}));
     if(!Array.isArray(queries)||!queries.length)return fallback('certificate_invalid');
     timing('cli.run_certificate',started,{outcome:'available',queries:queries.length});
-    return {value,queries,context:c.context,compiler};
+    return {value,queries,context:c.context,compiler,buildInfo:buildInfoPath(plan)};
   }catch{return fallback('certificate_invalid');}
 }
+// The last probe's questions, sent for a run checked by full probes. They only
+// show which of the run's lookups are run facts; the full probes, not these,
+// establish the result.
+export function probeQuestions(plan,selected,snapshot,root) {
+  const q=snapshot?.probeQuestions;
+  if(!directRunRecordable(selected)||typeof q?.queryData!=='string'||
+    q.queryData.length>1024*1024||typeof q.context!=='string')return null;
+  try{const queries=JSON.parse(inflateSync(Buffer.from(q.queryData,'base64'),{maxOutputLength:8*1024*1024}));
+    if(!Array.isArray(queries)||!queries.length)return null;
+    return {queries,context:q.context,compiler:directCompiler(root,{verify:false}),buildInfo:buildInfoPath(plan)};}
+  catch{return null;}
+}
 // Without a start certificate, the daemon may offer to build one from this run's
 // recording at the end checkpoint. Returns its token, or null for full probes.
 export function directRunRecording(plan,selected,snapshot,root) {
@@ -93,6 +113,18 @@ function statAgrees([kind,file,answer,options],target,result) {
 }
 const withinCompiler=compiler=>file=>withinPath(file,compiler.tsRoot)||
   file!==compiler.entry&&file.toLowerCase()===compiler.entry.toLowerCase();
+// The certificate question that asks again what a run's stat, realpath or
+// package.json read answered, in queryAnswer's terms; null when it cannot be asked again.
+function runFact(kind,file,answer) {
+  if(kind==='stat')return answer===null||answer==='f'?['fileExists',file,answer&&true]:
+    answer==='d'?['directoryExists',file,true]:null;
+  if(kind==='realpath')return answer===null||typeof answer==='string'?['realpath',file,answer]:null;
+  // Declaration checks read the package.json of each dependency they resolve.
+  // Its content hash is asked again like any other run fact; other reads are not.
+  if(kind==='read'&&path.basename(file)==='package.json')
+    return answer===null||typeof answer==='string'?['readFile',file,answer]:null;
+  return null;
+}
 // Null when every answer the run received agrees with the certified state,
 // otherwise why not. The compiler is deterministic given its context and its
 // answers, so a run whose answers all agree computed the certified result.
@@ -100,17 +132,36 @@ const withinCompiler=compiler=>file=>withinPath(file,compiler.tsRoot)||
 // compiler tree are covered by the daemon's toolchain identity instead. tsc
 // also stats a case-swapped copy of its own path to detect case sensitivity;
 // only that one stat is exempt.
-export function runRecordIssue(record,certificate) {
+// With a `facts` array, a stat or realpath the probe never asked about is
+// added to it instead (declaration diagnostics resolve module paths that
+// building the program does not), as is a read of a package.json. The receipt
+// keeps those run facts, and status asks them again before every CURRENT
+// answer. Any other uncovered read, and any directory listing, is an issue.
+// The record's facts without the build-info file an incremental run reads and
+// writes, or {issue} when the run wrote anything else. That file is compiler
+// state, not an input. A directory tsc created for it was missing when tsc
+// checked it, so that check goes too; every other check stays.
+export function withoutBuildInfo(facts,buildInfo) {
+  const created=new Set(facts.filter(([kind])=>kind==='mkdir').map(([,file])=>file));
+  for(const [kind,file] of facts){
+    if(kind==='write'&&file!==buildInfo)return {issue:`the compiler wrote ${file}`};
+    if(kind==='mkdir'&&!buildInfo?.startsWith(file+path.sep))return {issue:`the compiler created ${file}`};
+  }
+  return {facts:facts.filter(([kind,file])=>kind!=='write'&&kind!=='mkdir'&&file!==buildInfo&&
+    !(kind==='stat'&&created.has(file)))};
+}
+export function runRecordIssue(record,certificate,runFacts=null) {
   if(record?.schema!==1||!Array.isArray(record.facts))return 'record unavailable';
   if(record.unsupported)return `unsupported ${record.unsupported}`;
   if(record.conflict)return `answer changed during the run: ${record.conflict}`;
-  const {compiler,queries}=certificate;
+  const {compiler,queries}=certificate,kept=withoutBuildInfo(record.facts,certificate.buildInfo||null);
+  if(kept.issue)return kept.issue;
   if(record.main!==compiler.entry||!Array.isArray(record.node)||
     directContextHash(compiler,record.node)!==certificate.context)return 'execution context changed';
   const inCompiler=withinCompiler(compiler);
   const facts=new Map();
   for(const query of queries){if(!facts.has(query[1]))facts.set(query[1],[]);facts.get(query[1]).push(query);}
-  for(const [kind,file,answer] of record.facts){
+  for(const [kind,file,answer] of kept.facts){
     if(inCompiler(file))continue;
     const known=facts.get(file)||[];
     let checks=[];
@@ -123,40 +174,54 @@ export function runRecordIssue(record,certificate) {
     else if(kind==='stat')checks=[...known,...(facts.get(path.dirname(file))||[])]
       .map(q=>statAgrees(q,file,answer)).filter(value=>value!==null);
     else return `unknown answer ${kind}`;
-    if(!checks.some(value=>value!==undefined))return `${kind} ${file} is not in the discovery certificate`;
+    if(!checks.some(value=>value!==undefined)){
+      const fact=runFacts&&runFact(kind,file,answer);
+      if(fact){runFacts.push(fact);continue;}
+      return `${kind} ${file} is not in the discovery certificate`;
+    }
     if(checks.includes(false))return `${kind} ${file} differs from the discovery certificate`;
+    // Covered only by a listing of its directory: a later probe may keep the
+    // same program while that listing changes, so the run's own lookup stays
+    // a run fact.
+    if(kind==='stat'&&runFacts&&!known.length){const fact=runFact(kind,file,answer);if(fact)runFacts.push(fact);}
   }
   return null;
 }
-// Compares the record run-recorder.cjs wrote to fd 3.
-export function validateRunRecord(text,certificate) {
+// Compares the record run-recorder.cjs wrote to fd 3. Run facts go to `facts`.
+export function validateRunRecord(text,certificate,facts=[]) {
   const started=performance.now();
   let record=null;
   try{record=JSON.parse(text);}catch{}
   let issue;
-  try{issue=runRecordIssue(record,certificate);}catch{issue='record unreadable';}
+  try{issue=runRecordIssue(record,certificate,facts);}catch{issue='record unreadable';}
   timing('cli.run_recording',started,{outcome:issue?'rejected':'validated',
-    facts:record?.facts?.length||0,...(issue?{reason:issue}:{})});
+    facts:record?.facts?.length||0,runFacts:facts.length,...(issue?{reason:issue}:{})});
   return issue;
 }
 // A certificate for the current inputs, built from a recorded run and the
 // certificate of the last full probe, or {issue}. The run must read the same
 // files, with the same configuration, and every answer it received must be
-// covered by the old questions; only file contents may differ. The program
+// covered by the old questions or be a run fact; only file contents may differ.
+// Run facts stay out of this certificate: the receipt keeps them, and status
+// asks them again for every answer. The program
 // layout is then the same, so the output is rebuilt as the probe computes it.
 // Limit: a file whose role changes (a package.json newly imported as a module)
 // keeps its old role, so a later full probe can report the check STALE.
-export function recordedCertificate(text,cache,compiler) {
+export function recordedCertificate(text,cache,compiler,buildInfo=null) {
   let record=null;
   try{record=JSON.parse(text);}catch{}
   if(record?.schema!==1||!Array.isArray(record.facts))return {issue:'record unavailable'};
   if(!cache?.layout||!cache.queries?.length)return {issue:'no previous layout'};
+  const kept=withoutBuildInfo(record.facts,buildInfo);
+  if(kept.issue)return {issue:kept.issue};
   const inCompiler=withinCompiler(compiler),reads=new Map();
-  for(const [kind,file,answer] of record.facts)if(kind==='read'&&!inCompiler(file)){
+  const before=new Map(cache.queries.filter(q=>q[0]==='readFile'&&!inCompiler(q[1])).map(q=>[q[1],q[2]]));
+  for(const [kind,file,answer] of kept.facts)if(kind==='read'&&!inCompiler(file)){
     if(answer!==null&&typeof answer!=='string')return {issue:`read ${file} failed`};
+    // A package.json only declaration checks read is a run fact, not a program read.
+    if(!before.has(file)&&path.basename(file)==='package.json')continue;
     reads.set(file,answer);
   }
-  const before=new Map(cache.queries.filter(q=>q[0]==='readFile'&&!inCompiler(q[1])).map(q=>[q[1],q[2]]));
   if(reads.size!==before.size||[...before.keys()].some(file=>!reads.has(file)))
     return {issue:'the run read different files'};
   if(cache.layout.configs.some(([file])=>!reads.has(file)||reads.get(file)!==before.get(file)))
@@ -169,7 +234,9 @@ export function recordedCertificate(text,cache,compiler) {
     return {issue:'the run loaded different lib files'};
   const changed=new Set([...reads].filter(([file,answer])=>before.get(file)!==answer).map(([file])=>file));
   const queries=cache.queries.map(q=>q[0]==='readFile'&&changed.has(q[1])?[q[0],q[1],reads.get(q[1]),...q.slice(3)]:q);
-  const issue=runRecordIssue(record,{compiler,queries,context:cache.context});
+  // Run facts belong to the receipt, which the caller builds; they do not
+  // change the program layout.
+  const issue=runRecordIssue({...record,facts:kept.facts},{compiler,queries,context:cache.context},[]);
   if(issue)return {issue};
   const files=[];
   for(const [file,digest] of cache.layout.files){

package/src/direct-typescript-probe.mjs

@@ -15,8 +15,8 @@ try{
     entry:compiler.entry,node:[realObservedPath(process.execPath),process.version]};
   const contextHash=directContextHash(compiler,context.node);
   if(!contextOnly(contextHash)){
-    const {queries,configs,files}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry);
-    const layout={root,script,configs,files,context};
+    const {queries,configs,files,buildInfo}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry);
+    const layout={root,script,configs,files,context,...(buildInfo?{buildInfo}:{})};
     probeResult(directProbeOutput(layout),contextHash,queries,layout);
   }
 }catch(e){console.error(`VSTATE_REASON:${e.code&&/^[a-z-]+$/.test(e.code)?e.code:'typescript-contract-unavailable'}`);process.exitCode=2;}

package/src/direct-typescript.mjs

@@ -10,7 +10,10 @@ const reviewed={
   '5.5.2':{entry:'lib/tsc.js',digest:'953b4844b5f6edc745be844b6c367c227b59029b73c4182f508f90cc47e21816'},
   '5.6.3':{entry:'lib/tsc.js',digest:'e674b5dc4dac50f6e91be30094aeea983a1f340231717e62b0b6199ae3049eb2'},
   '5.9.3':{entry:'lib/_tsc.js',digest:'d1b32e75475710fdc85102b1365254d84ceb192d3639d962c53fe1355ce274ca'},
+  '6.0.2':{entry:'lib/_tsc.js',digest:'273e16620fe23362e085980d6dd822e1315d81ba792221c9b6008755fdafccdd'},
+  '6.0.3':{entry:'lib/_tsc.js',digest:'e0a6519f0d0a90125b7fd3bdbbcf700e167656beb3baf8aca8ed8bc037494537'},
 };
+export const reviewedTypeScriptVersions=Object.keys(reviewed);
 const fail=code=>{throw Object.assign(Error(code),{code});};
 const hash=bytes=>createHash('sha256').update(bytes).digest('hex');
 export const directEnvironment={variables:['NODE_ENV','NODE_OPTIONS','NODE_PATH','NODE_COMPILE_CACHE','VSCODE_INSPECTOR_OPTIONS'],
@@ -78,9 +81,35 @@ export function directCompiler(root,{verify=true}={}){
 // The direct probe's output: root, script, configuration and program files with
 // their byte digests, and the execution context. A recorded run rebuilds it from
 // the same layout (direct-run-certificate.mjs).
-export function directProbeOutput({root,script,configs,files,context}){
+export function directProbeOutput({root,script,configs,files,context,buildInfo}){
   const named=list=>list.map(([file,digest])=>[hash(file),digest]);
-  return hash(JSON.stringify({root,script,configs:named(configs),files:named(files),...context}));
+  return hash(JSON.stringify({root,script,configs:named(configs),files:named(files),...context,
+    ...(buildInfo?{buildInfo}:{})}));
+}
+// The build-info file an incremental root config makes tsc read and write,
+// as {file} relative to the root, {} when not incremental, or {issue}. The
+// probe and the plan both use this rule. It must be inside the checkout, end
+// in .tsbuildinfo (the only write the run recorder allows) and contain no glob
+// characters (the plan excludes it with a pattern). An option that makes the
+// result depend on the build-info history is refused.
+export function buildInfoFor(ts,options,root) {
+  if(!options?.incremental)return {};
+  if(options.assumeChangesOnlyAffectDirectDependencies)return {issue:'typescript-incremental-unsound'};
+  const file=ts.getTsBuildInfoEmitOutputFilePath?.(options);
+  if(!file||!withinPath(path.resolve(file),root))return {issue:'typescript-buildinfo-outside-repository'};
+  const relative=path.relative(root,path.resolve(file)).split(path.sep).join('/');
+  if(!relative.endsWith('.tsbuildinfo')||/[*?[\]{}()!+@,]/.test(relative))return {issue:'typescript-buildinfo-name-unsupported'};
+  return {file:relative};
+}
+// The plan's build-info file, or null. The compiler is loaded only when the
+// root config sets incremental or extends another config.
+export function directBuildInfo(root,script) {
+  const config=path.join(root,'tsconfig.json');
+  let raw;try{raw=fs.readFileSync(config,'utf8');}catch{return null;}
+  if(!/"(?:incremental|extends)"\s*:/.test(raw))return null;
+  const compiler=directProject(root,script,{verify:false}),ts=createRequire(import.meta.url)(compiler.tsRoot);
+  const parsed=ts.getParsedCommandLineOfConfigFile(config,{},{...ts.sys,onUnRecoverableConfigFileDiagnostic(){}});
+  return parsed?.options?.composite?null:buildInfoFor(ts,parsed?.options,root).file??null;
 }
 // The probe value the daemon stores for one direct probe's checkpoint output.
 export function directProbeValue(argv,output,stderrHash){

package/src/index.mjs

@@ -5,7 +5,7 @@ import {createHash} from 'node:crypto';
 import micromatch from './glob.mjs';
 import {sha} from './plan.mjs';
 import {resolveLinks} from './installed-inputs.mjs';
-import {validInputRelative} from './path-identity.mjs';
+import {validInputRelative,identityFields,racyUntil} from './path-identity.mjs';
 
 const tracked = root => [...new Set(execFileSync('git',
   ['ls-files','--cached','--others','--exclude-standard','-z'],
@@ -35,37 +35,43 @@ const pathPrefixes = rel => {
   return prefixes;
 };
 
+// An installed file is observed by identity, not content: every write changes
+// ctime, so its entry changes without reading the whole installation. The
+// compiler's own reads are content-checked by its probe and certificate. A file
+// changed within the racy window could still be rewritten in the same timestamp
+// tick at the same size; such files are tracked in `racy`, and the daemon waits
+// the window out and records them again before it writes a run checkpoint.
+const identity=st=>identityFields.map(key=>String(st[key])).join(':');
 function fileHash(root, rel,installed=false,before=fs.lstatSync(path.join(root,rel),
   {bigint:true})) {
   const file=path.join(root, rel);
-  let value,references=[],bytes=Number(before.size);
+  let value,references=[],bytes=installed?0:Number(before.size),racy=0;
   if(before.isSymbolicLink()){
     const resolution=resolveLinks(file,root,[],true);
     if(!resolution.physical)throw Error(`symlink input target observation unavailable: ${rel}: ${resolution.reason}`);
     const target=fs.statSync(resolution.physical,{bigint:true});
     if(!target.isFile())throw Error(`directory input symlink unsupported: ${rel}`);
-    value='link:'+JSON.stringify(resolution.links)+':'+target.mode+':'+
-      (installed&&target.nlink>1?target.nlink+':':'')+
-      hashRegular(resolution.physical).hash;
+    if(installed)racy=racyUntil(target);else bytes=Number(target.size);
+    value='link:'+JSON.stringify(resolution.links)+':'+(installed?'stat:'+identity(target):
+      target.mode+':'+hashRegular(resolution.physical).hash);
     references=[...new Set([...resolution.links.map(link=>path.relative(root,link.path)
       .split(path.sep).join('/')),path.relative(root,resolution.physical)
       .split(path.sep).join('/')])];
-    bytes=Number(target.size);
     const targetAfter=fs.statSync(resolution.physical,{bigint:true});
-    for(const key of ['dev','ino','mode','nlink','size','mtimeNs','ctimeNs'])
+    for(const key of identityFields)
       if(target[key]!==targetAfter[key])throw Error(`input changed during inspection: ${rel}`);
     const resolutionAfter=resolveLinks(file,root,[],true);
     if(resolutionAfter.physical!==resolution.physical||
       JSON.stringify(resolutionAfter.links)!==JSON.stringify(resolution.links))
       throw Error(`input link changed during inspection: ${rel}`);
   }
-  else if(before.isFile()) value='file:'+before.mode+':'+
-    (installed&&before.nlink>1?before.nlink+':':'')+hashRegular(file).hash;
+  else if(before.isFile()&&installed){value='stat:'+identity(before);racy=racyUntil(before);}
+  else if(before.isFile()) value='file:'+before.mode+':'+hashRegular(file).hash;
   else throw Error(`non-file input: ${rel}`);
   const after=fs.lstatSync(file,{bigint:true});
-  for(const key of ['dev','ino','mode','nlink','size','mtimeNs','ctimeNs'])
+  for(const key of identityFields)
     if(before[key]!==after[key]) throw Error(`input changed during inspection: ${rel}`);
-  return {hash:sha(value),references,bytes};
+  return {hash:sha(value),references,bytes,racy};
 }
 const readBuffer=Buffer.allocUnsafe(65536);
 function hashRegular(file) {
@@ -81,6 +87,7 @@ export class InputIndex {
     const matcherStarted=performance.now();
     this.bundle=bundle; this.root=bundle.root; this.files=new Map(); this.members=new Map();
     this.symlinkRefs=new Map();this.aliasDependencies=new Map();
+    this.racy=new Map();
     this.trackGit=options.trackGit!==false;
     this.installedRoots=[...new Set(Object.values(bundle.plans).flatMap(plan=>
       plan.installedPhysicalRoots||[]))];
@@ -149,6 +156,17 @@ export class InputIndex {
     }
     return {files,bytes,durationMs:performance.now()-started};
   }
+  // When the racy window of the named checks' installed members ends (0: none).
+  racyUntil(names=null) {
+    let until=0;
+    for(const [rel,time] of this.racy)
+      if(!names||[...this.members.get(rel)||[]].some(name=>names.includes(name)))until=Math.max(until,time);
+    return until;
+  }
+  // Records again every installed file whose racy window has passed.
+  settleRacy() {
+    for(const [rel,time] of [...this.racy])if(time<=Date.now())this.record(rel,rel+' changed');
+  }
   summary(name) { const row=this.checks.get(name); return {fingerprint:this.fingerprint(name),
     revision:row.revision,planId:row.plan.id,files:row.files.size,probeAt:row.probeAt}; }
   record(rel, changeReason=rel+' changed', observedStat=null) {
@@ -182,6 +200,7 @@ export class InputIndex {
       }
     }
     const oldNames=this.members.get(rel)||new Set(), newNames=new Set(fresh===undefined?[]:matched);
+    if(inspection?.racy>Date.now()&&newNames.size)this.racy.set(rel,inspection.racy);else this.racy.delete(rel);
     if(old===fresh && oldNames.size===newNames.size && [...oldNames].every(n=>newNames.has(n))) return false;
     for(const name of new Set([...oldNames,...newNames])) {
       const row=this.checks.get(name);
@@ -304,3 +323,14 @@ export class InputIndex {
     return out;
   }
 }
+
+// The index state a worker sends and a restart retains; hydrate() in daemon.mjs
+// reads it back.
+export function dehydrateIndex(value) {
+  return {files:[...value.files],
+    aliasDependencies:[...value.aliasDependencies].map(([name,refs])=>[name,[...refs]]),
+    rows:[...value.checks].map(([name,row])=>({name,files:[...row.files],
+      sum:row.sum.toString('hex'),revision:row.revision,lastReason:row.lastReason})),
+    eventCount:value.eventCount,rehashedFiles:value.rehashedFiles,
+    rehashedBytes:value.rehashedBytes,profile:value.profile,racy:[...value.racy]};
+}

package/src/linux-inotify.py

@@ -73,10 +73,18 @@ def main(root):
     file_paths = {}
     intentional_removals = set()
 
+    # No input lies in a .git directory (config refuses such patterns and the
+    # index skips them), so none is watched: git creates object directories
+    # there on most commits, and each would be an observation gap.
+    def in_git(target):
+        return '.git' in os.path.relpath(target, root).split(os.sep)
+
     def add_tree(folder):
         stack = [folder]
         while stack:
             current = stack.pop()
+            if in_git(current):
+                continue
             wd = libc.inotify_add_watch(fd, os.fsencode(current), MASK)
             if wd < 0:
                 raise OSError(ctypes.get_errno(), 'inotify_add_watch failed')
@@ -119,6 +127,8 @@ def main(root):
                     emit('gap', reason='inotify_watch_unknown')
                     return False
                 target = os.path.join(parent, os.fsdecode(raw)) if raw else parent
+                if in_git(target):
+                    continue
                 if mask & (IN_UNMOUNT | IN_DELETE_SELF | IN_MOVE_SELF | IN_IGNORED):
                     emit('gap', reason='inotify_watch_lost')
                     return False

package/src/path-identity.mjs

@@ -41,3 +41,11 @@ export function validInputRelative(rel,platform=process.platform) {
     rel.includes('\\')))return false;
   return true;
 }
+
+// File identity fields. Any write changes ctime, but timestamps tick in
+// milliseconds: a file changed within the racy window could be rewritten in the
+// same tick at the same size without changing them (git's racy rule).
+export const identityFields=['dev','ino','mode','nlink','size','mtimeNs','ctimeNs'];
+export const racyWindowMs=2000;
+// ctime, which no ordinary tool can set ahead, ends the window.
+export const racyUntil=st=>Number(st.ctimeNs/1000000n)+racyWindowMs;

package/src/plan-worker.mjs

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {discover} from './plan.mjs';
-import {InputIndex} from './index.mjs';
+import {InputIndex,dehydrateIndex} from './index.mjs';
 import {directProject,directQualification} from './direct-typescript.mjs';
 import {queriesMatch} from './typescript-list.mjs';
 import {planGuard,inputKey} from './decision-validation.mjs';
@@ -113,26 +113,14 @@ try {
     const outside=new InputIndex({root:boundary,plans},{trackGit:false,includeInstalled:true});
     outside.coldScan();
     if(outside.unavailable)throw Error(outside.unavailable);
-    external[boundary]={files:[...outside.files],
-      aliasDependencies:[...outside.aliasDependencies].map(([name,refs])=>[name,[...refs]]),
-      rows:[...outside.checks]
-      .map(([name,row])=>({name,files:[...row.files],sum:row.sum.toString('hex'),
-        revision:row.revision,lastReason:row.lastReason})),
-      eventCount:outside.eventCount,rehashedFiles:outside.rehashedFiles,
-      rehashedBytes:outside.rehashedBytes,profile:outside.profile};
+    external[boundary]=dehydrateIndex(outside);
   }
   timing('worker.total',totalStarted,{mode:'cold',files:index.files.size});
   parentPort.postMessage({ok:true,bundle,discoveryMs,indexingMs,guard,planReused,
     inputKeys:Object.fromEntries([...index.checks].map(([name,row])=>[name,inputKey(row)])),
     restartMode:'cold-index',
     external,
-    index:{files:[...index.files],
-      aliasDependencies:[...index.aliasDependencies].map(([name,refs])=>[name,[...refs]]),
-      rows:[...index.checks].map(([name,row])=>({
-      name,files:[...row.files],sum:row.sum.toString('hex'),revision:row.revision,
-      lastReason:row.lastReason})),
-    eventCount:index.eventCount,rehashedFiles:index.rehashedFiles,
-    rehashedBytes:index.rehashedBytes,profile:index.profile}});
+    index:dehydrateIndex(index)});
   }
 } catch(error) {
   parentPort.postMessage({ok:false,error:error?.message||String(error),

package/src/run-recorder.cjs

@@ -51,13 +51,26 @@ const realpath=observe('realpath',original.realpathSync,value=>value);
 realpath.native=observe('realpath',original.native,value=>value);
 fs.realpathSync=realpath;
 // readFileSync opens through fs.openSync; only a writable open is a write.
+// The one write a direct run may make is its build-info file (incremental);
+// it is recorded, and the caller checks it is the configured one.
+const buildInfo=file=>typeof file==='string'&&file.endsWith('.tsbuildinfo');
 fs.openSync=function(file,flags,...rest){
-  if(!(flags===undefined||flags==='r'||flags==='rs'||flags===fs.constants.O_RDONLY))unsupported??='openSync';
+  if(!(flags===undefined||flags==='r'||flags==='rs'||flags===fs.constants.O_RDONLY)){
+    if(flags==='w'&&buildInfo(file))note('write',path.resolve(file),null);
+    else unsupported??='openSync';
+  }
   return original.openSync.call(this,file,flags,...rest);
 };
+// tsc creates the build-info directory one level at a time; each is recorded.
+const mkdirSync=fs.mkdirSync;
+fs.mkdirSync=function(file,options,...rest){
+  if(typeof file==='string'&&options===undefined)note('mkdir',path.resolve(file),null);
+  else unsupported??='mkdirSync';
+  return mkdirSync.call(this,file,options,...rest);
+};
 // Writes, and reads this record cannot answer for, make it unusable. readSync
 // and fstatSync stay open: readFileSync reads through them.
-for(const name of ['writeFileSync','appendFileSync','mkdirSync','unlinkSync','utimesSync',
+for(const name of ['writeFileSync','appendFileSync','unlinkSync','utimesSync',
   'renameSync','rmSync','watch','watchFile','existsSync','lstatSync','accessSync','opendirSync',
   'readlinkSync','readFile','stat','lstat','readdir','realpath','access','exists','open','opendir',
   'readlink','createReadStream']){

package/src/typescript-input-facts.mjs

@@ -2,18 +2,20 @@
 import fs from 'node:fs';import path from 'node:path';import {createHash} from 'node:crypto';
 import {createRequire} from 'node:module';import {spawnSync} from 'node:child_process';
 import {compilerFiles} from './typescript-list.mjs';
+import {buildInfoFor} from './direct-typescript.mjs';
 import {withinPath as within,realObservedPath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
 const require=createRequire(import.meta.url),hash=value=>createHash('sha256').update(value).digest('hex');
 const digestFile=file=>hash(fs.readFileSync(file));
 const fail=code=>{throw Object.assign(Error(code),{code});};
 export function typeScriptInputFacts(root,tsRoot,tsc){
-  const configReads=new Set(),visited=new Set();
+  const configReads=new Set(),visited=new Set(),referenced=[];
+  let buildInfo=null;
   let ts;try{ts=require(tsRoot);}catch{}
   if(typeof ts?.getParsedCommandLineOfConfigFile==='function'){
     const host={...ts.sys,readFile(file){configReads.add(path.resolve(file));
       return ts.sys.readFile(file);},onUnRecoverableConfigFileDiagnostic(){}};
-    const parseConfig=file=>{
+    const parseConfig=(file,top=false)=>{
       const absolute=path.resolve(file);
       if(!within(absolute,root))fail('typescript-config-outside-repository');
       if(visited.has(absolute))return;visited.add(absolute);
@@ -21,13 +23,20 @@ export function typeScriptInputFacts(root,tsRoot,tsc){
       const parsed=ts.getParsedCommandLineOfConfigFile(absolute,{},host);
       if(!parsed||parsed.errors?.length)fail('typescript-config-unavailable');
       if(parsed.options?.plugins?.length)fail('typescript-plugin-unsupported');
-      if(parsed.options?.incremental||parsed.options?.composite)
-        fail('typescript-incremental-unsupported');
+      // Plain tsc reads a referenced config but never builds it, so only the
+      // root config's build settings matter. An incremental root reads and
+      // writes one build-info file, which must be inside the checkout.
+      if(top){
+        if(parsed.options?.composite)fail('typescript-incremental-unsupported');
+        const found=buildInfoFor(ts,parsed.options,root);
+        if(found.issue)fail(found.issue);
+        buildInfo=found.file||null;
+      }else referenced.push(parsed);
       for(const reference of parsed.projectReferences||[])
         parseConfig(reference.path.endsWith('.json')?reference.path:
           path.join(reference.path,'tsconfig.json'));
     };
-    parseConfig(path.join(root,'tsconfig.json'));
+    parseConfig(path.join(root,'tsconfig.json'),true);
   }else{
     // TypeScript 7's native compiler does not expose the previous config API.
     // Its CLI reports the effective config; restrict this path to one direct
@@ -60,9 +69,23 @@ export function typeScriptInputFacts(root,tsRoot,tsc){
     .map(file=>path.resolve(file));
   if(!files.length||files.some(file=>!within(realObservedPath(file),root)))
     fail('typescript-input-outside-repository');
+  // A program that uses a referenced project's sources or outputs depends on
+  // that project's build, which plain tsc does not run. tsc redirects only
+  // TypeScript sources; a shared .d.ts or .json is an ordinary input.
+  const declaration=/\.d\.[cm]?ts$|\.json$/;
+  const sources=new Set(),outputs=new Set(),outDirs=[];
+  for(const parsed of referenced){
+    const dirs=[parsed.options.outDir,parsed.options.declarationDir].filter(Boolean).map(dir=>path.resolve(dir));
+    outDirs.push(...dirs);
+    for(const file of parsed.fileNames.map(name=>path.resolve(name)))if(!declaration.test(file)){
+      sources.add(file);if(!dirs.length)outputs.add(file.replace(/\.[cm]?tsx?$/,ext=>ext.replace(/tsx?$/,'d.ts')));}
+  }
+  if(files.some(file=>sources.has(file)||outputs.has(file)||outDirs.some(dir=>within(file,dir))))
+    fail('typescript-project-reference-consumed');
   // Every hashed configuration must also be a certified question.
   const queries=captured?.queries&&[...configReads].every(file=>
     captured.queries.some(([kind,read])=>kind==='readFile'&&read===file))?captured.queries:null;
   return {configs:[...configReads].sort().map(file=>[file,digestFile(file)]),
-    files:[...new Set(files)].sort().map(file=>[file,digestFile(file)]),queries};
+    files:[...new Set(files)].sort().map(file=>[file,digestFile(file)]),queries,
+    ...(buildInfo?{buildInfo}:{})};
 }

package/src/typescript-list.mjs

@@ -5,6 +5,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {createRequire} from 'node:module';
+import {identityFields,racyUntil} from './path-identity.mjs';
 const require=createRequire(import.meta.url);
 const hash=value=>createHash('sha256').update(JSON.stringify(value)).digest('hex');
 export function queryAnswer(kind,file,options) {
@@ -38,6 +39,24 @@ export function queryAnswer(kind,file,options) {
     throw Error('unknown compiler filesystem question');
   }catch(error){if(['ENOENT','ENOTDIR'].includes(error.code))return null;throw error;}
 }
+// Null when every run fact answers as it did during the run, otherwise the
+// first path that does not. Asked in-process; nothing is launched.
+export function runFactChange(facts) {
+  if(!Array.isArray(facts))return 'an unreadable run fact';
+  for(const fact of facts){
+    if(!Array.isArray(fact)||!['fileExists','directoryExists','realpath','readFile'].includes(fact[0])||
+      typeof fact[1]!=='string')return 'an unreadable run fact';
+    const [kind,file,answer]=fact;
+    let now;try{now=queryAnswer(kind,file);}catch{return file;}
+    if(now!==answer)return file;
+  }
+  return null;
+}
+// Why a receipt's run facts no longer hold, or null when they all do.
+export function runFactReason(facts) {
+  const changed=runFactChange(facts);
+  return changed&&`a lookup the last run made answers differently now: ${changed}`;
+}
 export function queriesMatch(queries) {
   if(!queries?.length)return false;
   return queries.every(([kind,file,answer,options])=>
@@ -92,13 +111,15 @@ export function compilerFiles(tsRoot,cwd) {
       ['readDirectory',full,[...result].sort(),options]);
     return result;
   };
+  const realpath=file=>{remember('realpath',file);return ts.sys.realpath(file);};
+  // `extends` of a package config resolves through realpath too.
   const parsed=ts.getParsedCommandLineOfConfigFile(path.join(cwd,'tsconfig.json'),{},
-    {...ts.sys,readFile,fileExists,directoryExists,getDirectories,readDirectory,
+    {...ts.sys,readFile,fileExists,directoryExists,getDirectories,readDirectory,realpath,
       onUnRecoverableConfigFileDiagnostic(){}});
   if(!parsed||parsed.errors?.length)throw Error('TypeScript configuration unavailable');
   const host=ts.createCompilerHost(parsed.options);
   Object.assign(host,{readFile,fileExists,directoryExists,getDirectories,readDirectory,
-    realpath(file){remember('realpath',file);return ts.sys.realpath(file);},
+    realpath,
     getSourceFile(file,languageVersion,onError){
       const text=readFile(file);return text===undefined?undefined:
         ts.createSourceFile(file,text,languageVersion);
@@ -109,9 +130,9 @@ export function compilerFiles(tsRoot,cwd) {
   // Stable answers are necessary even at first capture; a concurrent edit
   // cannot become the basis for a reusable discovery result.
   const facts=[...queries.values()];
-  // A certificate must cover every program file; references parse further
-  // configurations outside this host and are not certified.
-  const complete=!parsed.projectReferences?.length&&files.every(file=>queries.has('readFile\0'+file));
+  // A certificate must cover every program file. Referenced configurations
+  // are parsed through this host, so their reads and listings are certified.
+  const complete=files.every(file=>queries.has('readFile\0'+file));
   return {files,queries:complete&&queriesMatch(facts)?facts:null};
 }
 // Identity of a read file and, for a link, of its target. Writes through any
@@ -119,8 +140,8 @@ export function compilerFiles(tsRoot,cwd) {
 // coarse timestamp cannot hide a second write in the same tick (git's racy rule).
 export function fileIdentity(file,now=Date.now()) {
   try{const link=fs.lstatSync(file,{bigint:true}),target=link.isSymbolicLink()?fs.statSync(file,{bigint:true}):link;
-    if(Number(link.ctimeNs/1000000n)>=now-2000||Number(target.ctimeNs/1000000n)>=now-2000)return null;
-    const fields=st=>['dev','ino','mode','nlink','size','mtimeNs','ctimeNs'].map(key=>String(st[key]));
+    if(racyUntil(link)>=now||racyUntil(target)>=now)return null;
+    const fields=st=>identityFields.map(key=>String(st[key]));
     return JSON.stringify([fields(target),target===link?null:[fs.realpathSync(file),...fields(link)]]);}
   catch(error){if(['ENOENT','ENOTDIR'].includes(error.code))return null;throw error;}
 }