@redue/cli 0.1.0-alpha.16 → 0.1.0-alpha.18

package/src/node-onboarding.mjs

@@ -3,16 +3,17 @@ import {testProject,testRecipeScript,testCheckInputs,testsQualification} from '.
 import fs from 'node:fs';
 import path from 'node:path';
 import {spawnSync} from 'node:child_process';
-import micromatch from './glob.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmInstallInfo,pnpmProjectInfo,pnpmTypecheckInputs} from './pnpm-inputs.mjs';
 import {realObservedPath} from './path-identity.mjs';
 import {findExecutable} from './executable-lookup.mjs';
+import {workspaceManifests} from './workspace-manifests.mjs';
+import {partName,tscRuns} from './typescript-invocation.mjs';
 
 const exists=file=>{try{fs.accessSync(file);return true;}catch{return false;}};
 const readJson=file=>JSON.parse(fs.readFileSync(file,'utf8'));
 const scriptNames={
-  typecheck:['typecheck','type-check','check:types','types:check'],
+  typecheck:['typecheck','type-check','check:types','types:check','check-types'],
   test:['test','test:unit','test:check'],
   lint:['lint','lint:check'],
   build:['build'],
@@ -82,6 +83,28 @@ function manager(root,pkg) {
   return {name,version,layout:'node-modules/classic',issue:null,lockfiles:locks};
 }
 const exactTypeScript=script=>script.trim()==='tsc --noEmit';
+// A script of tsc runs that each pass --noEmit (typescript-invocation.mjs).
+const noEmitRuns=script=>Boolean(tscRuns(script)?.every(run=>run.noEmit));
+// Ready checks for a typecheck, one per tsc run: the script's runs (a chain
+// gives NAME.1 ... NAME.n), or with no script one proposed `tsc --noEmit`.
+// `make(run)` returns a run's command, cwd and inputs, or throws why its
+// contract does not hold.
+function tscChecks(name,script,scripts,make){
+  const runs=script===null?[{args:['--noEmit']}]:tscRuns(scripts[script]);
+  if(!runs)throw Error('the script is not tsc runs in a supported form');
+  return runs.map(({args},i)=>({name:partName(name,i+1,runs.length),
+    ...(script===null?{}:{script}),...make({script,args,count:runs.length})}));
+}
+// A proposed `tsc --noEmit` only where nothing typechecks already: a script
+// that runs any TypeScript checker in another form (tsc -b, vue-tsc,
+// svelte-check, tsgo, also quoted or wrapped by concurrently or run-p) is the
+// project's own typecheck, which plain tsc would not match.
+const typeChecker=/(?:^|[^\w-])(?:tsc|vue-tsc|tsgo|svelte-check|tsc-watch)(?=$|[^\w-])|\bastro check\b|\bnuxi typecheck\b/;
+const typechecks=scripts=>Object.values(scripts||{}).some(text=>typeof text==='string'&&typeChecker.test(text));
+const proposable=(dir,scripts)=>exists(path.join(dir,'tsconfig.json'))&&!typechecks(scripts);
+// The inputs a TypeScript contract adds to its check's config: no exclusions,
+// which would outlive the tsconfig they came from; the plan adds the current ones.
+const contractInputs=contract=>[...contract.configs,...contract.sourcePatterns.filter(p=>!p.startsWith('!'))];
 function sourceLinkIssue(root) {
   const stack=likelyDirs.filter(name=>exists(path.join(root,name)));
   let inspected=0;
@@ -139,27 +162,25 @@ function selectScript(kind,names,scripts) {
   const candidates=Object.keys(scripts).filter(name=>{
     const value=scripts[name]?.trim();
     if(typeof value!=='string')return false;
-    if(kind==='typecheck')return exactTypeScript(value);
+    if(kind==='typecheck')return noEmitRuns(value);
     if(kind==='test')return /^(?:vitest|jest)(?:\s|$)/.test(value);
     if(kind==='lint')return /^eslint(?:\s|$)/.test(value);
     return /^vite\s+build(?:\s|$)/.test(value);
   });
+  // A lone plain `tsc --noEmit` wins over other tsc shapes beside it (a
+  // project's `typescript` next to `typescript:tests:raw`).
+  const exact=kind==='typecheck'?candidates.filter(name=>exactTypeScript(scripts[name])):[];
+  if(exact.length===1)return {script:exact[0]};
   return candidates.length===1?{script:candidates[0]}:
     candidates.length>1?{ambiguous:candidates}:{};
 }
-function workspaceManifests(root,patterns) {
-  const listing=spawnSync('git',['ls-files','--cached','--others','--exclude-standard',
-    '-z','--',':(glob)**/package.json'],{cwd:root,encoding:'utf8',timeout:5000,
-    maxBuffer:32*1024*1024,stdio:['ignore','pipe','ignore'],
-    env:{...process.env,GIT_OPTIONAL_LOCKS:'0'}});
-  if(listing.status!==0||listing.error)throw Error('workspace package manifests cannot be inspected');
-  const matched=listing.stdout.split('\0').filter(Boolean).filter(file=>{
-    const dir=path.posix.dirname(file);
-    return dir!=='.'&&!dir.split('/').includes('node_modules')&&
-      micromatch.isMatch(dir,patterns,{dot:true});
-  }).sort();
-  if(matched.length>50)throw Error('more than 50 workspace packages found; select checks explicitly');
-  return matched.map(file=>({file,pkg:readJson(path.join(root,file))}));
+// A pnpm workspace package's TypeScript run, as its check's command, cwd and inputs.
+function pnpmCheck(root,name,dir,manifest,run){
+  const contract=pnpmTypecheckInputs(root,name,run);
+  if(contract.limitations.length)throw Error(contract.limitations.join('; '));
+  return {cwd:dir,command:['@node',`@typescript-bin:${dir}`,...run.args],
+    inputs:[...new Set(['package.json','pnpm-lock.yaml','pnpm-workspace.yaml',manifest,
+      ...contractInputs(contract)])]};
 }
 // Workspace packages as init finds them, with their scripts; [] without workspaces.
 export function workspacePackages(root){
@@ -192,24 +213,33 @@ export function discoverNodeProject(root,{recipe=null}={}) {
   for(const [kind,names] of Object.entries(scriptNames)) {
     const selected=selectScript(kind,names,scripts),script=selected.script;
     if(selected.ambiguous)ambiguous.push({kind,scripts:selected.ambiguous});
-    if(!script)continue;
+    // With no typecheck script, a root tsconfig.json gets a proposed
+    // `tsc --noEmit` check; package.json stays unchanged. It is kept only
+    // when a contract makes it ready.
+    const proposed=!script&&!selected.ambiguous&&kind==='typecheck'&&!observationIssue&&
+      proposable(root,scripts);
+    if(!script&&!proposed)continue;
     let classification=observationIssue?{level:'unsupported',reason:observationIssue}:
-      classify(kind,script,scripts[script],pkg,pm,root);
+      script?classify(kind,script,scripts[script],pkg,pm,root):{level:'recording',reason:'no typecheck script'};
+    let parts=null;
     if(workspaces&&classification.qualification==='typescript-noemit-v1')classification={level:'recording',
       reason:'workspace task and installed-input closure need explicit qualification'};
     const check={name:kind,script,kind,inputs:sourceInputs(root,kind,pm.lockfiles||[])};
     if(recipe==='typescript-direct'&&kind==='typecheck'){
       try{
         if(pm.name!=='npm'||workspaces||observationIssue||pm.issue)throw Error('direct recipe requires a supported single-package npm checkout');
-        const compiler=directProject(root,script);
-        check.command=['@node','@typescript-compiler:.','--noEmit'];check.cwd='.';
+        let version;
+        parts=tscChecks('typecheck',script??null,scripts,run=>{
+          version=directProject(root,run).version;
+          return {command:['@node','@typescript-compiler:.',...run.args],cwd:'.'};});
         classification={level:'ready',qualification:directQualification,
-          reason:`explicit local TypeScript ${compiler.version} compilation; npm launcher/lifecycle scripts are not executed; package.json stays unchanged`};
+          reason:`explicit local TypeScript ${version} compilation; npm launcher/lifecycle scripts are not executed; package.json stays unchanged`};
       }catch(e){classification={level:'recording',reason:`Direct recipe unavailable (${e.code||e.message}); original npm script retained, without bypassing required behavior`};}
     }
     if(recipe==='tests-direct'&&kind==='test'){
       try{
-        if(pm.name!=='npm'||workspaces||observationIssue||pm.issue)throw Error('test recipe requires a supported single-package npm checkout');
+        if(!['npm','pnpm','yarn'].includes(pm.name)||workspaces||observationIssue||pm.issue)
+          throw Error('test recipe requires a supported single-package npm, pnpm or Yarn checkout');
         const chosen=testRecipeScript(scripts);
         if(chosen.ambiguous)throw Error(`several scripts run Vitest or Jest directly (${chosen.ambiguous.join(', ')})`);
         if(!chosen.script)throw Error(chosen.issue||'no script runs Vitest or Jest directly');
@@ -220,20 +250,24 @@ export function discoverNodeProject(root,{recipe=null}={}) {
           reason:`explicit local ${project.runner} ${project.version} run of script ${JSON.stringify(chosen.script)}; the whole checkout is its input; npm and lifecycle scripts are not executed`};
       }catch(e){classification={level:'recording',reason:`Test recipe unavailable (${e.code||e.message}); original npm script retained`};}
     }
-    if(pm.name==='pnpm'&&kind==='typecheck'&&!workspaces&&!pm.issue&&
-      /^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(scripts[script].trim())){
-      try{const contract=pnpmTypecheckInputs(root,'.',script);
-        if(contract.limitations.length)throw Error(contract.limitations.join('; '));
-        check.command=['@node','@typescript-bin:.',
-          ...scripts[script].trim().split(/\s+/).slice(1)];
-        check.cwd='.';
-        check.inputs=['package.json','pnpm-lock.yaml',
-          ...(exists(path.join(root,'pnpm-workspace.yaml'))?['pnpm-workspace.yaml']:[]),
-          'tsconfig.json','src/**'];
-        classification={level:'ready',reason:'pinned pnpm TypeScript inputs and installation; checked again before reuse',
+    if(pm.name==='pnpm'&&kind==='typecheck'&&!workspaces&&!pm.issue&&(script===undefined||tscRuns(scripts[script]))){
+      try{
+        parts=tscChecks('typecheck',script??null,scripts,run=>{
+          const contract=pnpmTypecheckInputs(root,'.',run);
+          if(contract.limitations.length)throw Error(contract.limitations.join('; '));
+          return {command:['@node','@typescript-bin:.',...run.args],cwd:'.',
+            inputs:[...new Set(['package.json','pnpm-lock.yaml',
+              ...(exists(path.join(root,'pnpm-workspace.yaml'))?['pnpm-workspace.yaml']:[]),
+              ...contractInputs(contract)])]};});
+        classification={level:'ready',reason:'pnpm TypeScript inputs and installation; checked again before reuse',
           qualification:'pnpm-tsc-v1'};}
       catch(e){classification={level:'recording',reason:`pnpm TypeScript contract needs review: ${e.message}`};}
     }
+    if(!script&&classification.level!=='ready')continue;
+    if(parts&&classification.level==='ready'){
+      for(const part of parts)checks.push({config:{...check,...part,qualification:classification.qualification},...classification});
+      continue;
+    }
     if(classification.qualification)check.qualification=classification.qualification;
     checks.push({config:check,...classification});
   }
@@ -251,6 +285,16 @@ export function discoverNodeProject(root,{recipe=null}={}) {
         const selected=selectScript(kind,names,member.scripts||{});
         if(selected.ambiguous){ambiguous.push({kind:`${name}:${kind}`,
           scripts:selected.ambiguous});continue;}
+        // A pnpm package with a tsconfig.json and no typecheck script gets a
+        // proposed `tsc --noEmit` check when the pnpm contract holds.
+        if(!selected.script&&kind==='typecheck'&&pm.name==='pnpm'&&!pm.issue&&
+          proposable(path.join(root,dir),member.scripts)&&!typechecks(scripts)){
+          try{for(const part of tscChecks(`${name}:typecheck`,null,{},run=>pnpmCheck(root,name,dir,file,run)))
+            checks.push({config:{kind,workspace:name,qualification:'pnpm-tsc-v1',...part},level:'ready',
+              reason:'proposed tsc --noEmit for the package\'s tsconfig.json; pnpm workspace TypeScript inputs; checked again before reuse'});}
+          catch{}
+          continue;
+        }
         if(!selected.script)continue;
         const command=pm.name==='npm'?['@which:npm','run',selected.script,
           '--workspace',name]:pm.name==='yarn'?
@@ -271,22 +315,21 @@ export function discoverNodeProject(root,{recipe=null}={}) {
             level='ready';reason='pinned Yarn workspace tsc and installed inputs; checked again before reuse';
           }catch(e){reason=`workspace TypeScript contract needs review: ${e.message}`;}
         }
-        if(!pm.issue&&pm.name==='pnpm'&&kind==='typecheck'&&
-          /^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(
-            (member.scripts||{})[selected.script]?.trim()||'')&&
-          !member.scripts?.['pre'+selected.script]&&!member.scripts?.['post'+selected.script]){
-          try{const contract=pnpmTypecheckInputs(root,name,selected.script);
-            if(contract.limitations.length)throw Error(contract.limitations.join('; '));
-            check.workspace=name;check.qualification='pnpm-tsc-v1';
-            check.script=selected.script;
-            check.cwd=dir;
-            check.command=['@node',`@typescript-bin:${dir}`,
-              ...member.scripts[selected.script].trim().split(/\s+/).slice(1)];
-            check.inputs=['package.json','pnpm-lock.yaml','pnpm-workspace.yaml',file,
-              `${dir}/src/**`];
-            level='ready';reason='pinned pnpm workspace TypeScript inputs; checked again before reuse';
+        if(!pm.issue&&pm.name==='pnpm'&&kind==='typecheck'&&tscRuns((member.scripts||{})[selected.script])){
+          try{const parts=tscChecks(`${name}:typecheck`,selected.script,member.scripts,run=>pnpmCheck(root,name,dir,file,run));
+            for(const part of parts)checks.push({config:{kind,workspace:name,qualification:'pnpm-tsc-v1',...part},level:'ready',
+              reason:'pnpm workspace TypeScript inputs; checked again before reuse'});
+            continue;
           }catch(e){reason=`pnpm TypeScript contract needs review: ${e.message}`;}
         }
+        if(recipe==='tests-direct'&&kind==='test'&&!pm.issue){
+          try{const project=testProject(root,selected.script,dir);
+            Object.assign(check,{workspace:name,script:selected.script,cwd:dir,
+              command:['@node',`@test-runner:${project.runner}`,...project.args],...testCheckInputs(project),
+              qualification:testsQualification});
+            level='ready';reason=`explicit local ${project.runner} ${project.version} run of ${name}'s script ${JSON.stringify(selected.script)}; the whole checkout is its input; the package manager and lifecycle scripts are not executed`;
+          }catch(e){reason=`Test recipe unavailable (${e.code||e.message}); original script retained`;}
+        }
         checks.push({config:check,level,reason});
       }
     }

package/src/npm-integrity.mjs

@@ -0,0 +1,124 @@
+// An installed npm package checked against what the lockfile recorded: the
+// tarball npm cached under the lockfile's integrity (sha512, else sha1),
+// unpacked in memory and compared file by file. Nothing is fetched.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import zlib from 'node:zlib';
+import {createHash} from 'node:crypto';
+import {npmrc} from './npmrc.mjs';
+import {racyUntil} from './path-identity.mjs';
+
+const fail=code=>{throw Object.assign(Error(code),{code});};
+// npm's cache directory, as npm picks it: npm_config_cache, else `cache` in
+// the project's .npmrc, then the user's (npm_config_userconfig or
+// ~/.npmrc), else npm's default. A leading ~ is the home directory. The
+// global npmrc is not read.
+export function npmCacheDir(root=null,env=process.env,platform=process.platform,home=os.homedir()){
+  const variable=name=>Object.entries(env).find(([key])=>key.toLowerCase()===name)?.[1];
+  const expand=value=>path.resolve(value.replace(/^~(?=$|[\/])/,home));
+  const configured=variable('npm_config_cache');
+  if(configured)return expand(configured);
+  for(const file of [root&&path.join(root,'.npmrc'),variable('npm_config_userconfig')||path.join(home,'.npmrc')].filter(Boolean)){
+    let cache;try{cache=npmrc(file).cache;}catch{}
+    if(typeof cache==='string'&&cache)return expand(cache);
+  }
+  return platform==='win32'?path.join(env.LOCALAPPDATA||path.join(home,'AppData','Local'),'npm-cache'):path.join(home,'.npm');
+}
+// The package-lock.json entry for an installed top-level package:
+// {version, integrity, resolved, alias}. npm-shrinkwrap.json, which npm reads
+// instead, is not modeled. Parsed entries are kept per process by the
+// lockfile's identity: the daemon asks on every reuse check.
+const lockfiles=new Map();
+export function lockedPackage(root,name){
+  if(fs.existsSync(path.join(root,'npm-shrinkwrap.json')))fail('npm-shrinkwrap-unsupported');
+  const file=path.join(root,'package-lock.json');
+  let st;try{st=fs.statSync(file,{bigint:true});}catch{fail('npm-lockfile-integrity-missing');}
+  const identity=[st.dev,st.ino,st.size,st.mtimeNs,st.ctimeNs].join(':');
+  let packages=lockfiles.get(file)?.identity===identity?lockfiles.get(file).packages:null;
+  if(!packages){
+    try{packages=JSON.parse(fs.readFileSync(file,'utf8'))?.packages;}catch{fail('npm-lockfile-unreadable');}
+    // A lockfile changed within the racy window is read again next time.
+    if(racyUntil(st)<=Date.now())lockfiles.set(file,{identity,packages});
+  }
+  const entry=packages?.[`node_modules/${name}`];
+  if(!entry||typeof entry.version!=='string'||typeof entry.integrity!=='string')fail('npm-lockfile-integrity-missing');
+  return {version:entry.version,integrity:entry.integrity,resolved:entry.resolved??null,alias:entry.name??null};
+}
+// Whether a lockfile entry is the registry's own package NAME at VERSION:
+// no alias, and a tarball URL .../NAME/-/NAME-VERSION.tgz over https.
+export const registryPackage=(entry,name,version)=>entry.alias===null&&typeof entry.resolved==='string'&&
+  /^https:\/\//.test(entry.resolved)&&entry.resolved.endsWith(`/${name}/-/${name}-${version}.tgz`);
+// The digest an SRI string names, as {algorithm, hex}: sha512, else sha1
+// (some registries record only sha1; a collision needs a malicious party,
+// which is outside REDUE's threat model). null for anything else.
+export function sriDigest(integrity){
+  const items=String(integrity).split(/\s+/);
+  for(const [algorithm,length] of [['sha512',64],['sha1',20]]){
+    const value=items.map(item=>new RegExp(`^${algorithm}-([A-Za-z0-9+/]+={0,2})$`).exec(item)?.[1]).find(Boolean);
+    const bytes=value&&Buffer.from(value,'base64');
+    if(bytes?.length===length)return {algorithm,hex:bytes.toString('hex')};
+  }
+  return null;
+}
+// The cached tarball for an integrity, checked against it.
+export function cachedTarball(cache,integrity){
+  const digest=sriDigest(integrity);
+  if(!digest)fail('npm-lockfile-integrity-unsupported');
+  const {algorithm,hex}=digest;
+  let bytes;
+  try{bytes=fs.readFileSync(path.join(cache,'_cacache','content-v2',algorithm,hex.slice(0,2),hex.slice(2,4),hex.slice(4)));}
+  catch{fail('npm-tarball-uncached');}
+  if(createHash(algorithm).update(bytes).digest('hex')!==hex)fail('npm-tarball-corrupt');
+  return bytes;
+}
+// The regular files of a gzipped npm tarball, as Map(path below the top
+// directory -> bytes). Links and special files are refused.
+export function tarballFiles(gzipped){
+  let tar;try{tar=zlib.gunzipSync(gzipped,{maxOutputLength:512*1024*1024});}catch{fail('npm-tarball-invalid');}
+  const files=new Map();
+  const text=(block,from,to)=>block.subarray(from,to).toString('utf8').replace(/\0[\s\S]*$/,'');
+  let offset=0,longName=null,paxPath=null;
+  while(offset+512<=tar.length){
+    const header=tar.subarray(offset,offset+512);
+    if(header.every(byte=>byte===0))break;
+    const size=parseInt(text(header,124,136).trim()||'0',8),type=String.fromCharCode(header[156]||48);
+    if(!Number.isSafeInteger(size)||size<0)fail('npm-tarball-invalid');
+    const body=tar.subarray(offset+512,offset+512+size);
+    offset+=512+Math.ceil(size/512)*512;
+    if(type==='x'){
+      // pax records: "LEN key=value\n"
+      for(const record of body.toString('utf8').split('\n')){const match=/^\d+ path=(.*)$/.exec(record);if(match)paxPath=match[1];}
+      continue;
+    }
+    if(type==='g')continue;
+    if(type==='L'){longName=body.toString('utf8').replace(/\0[\s\S]*$/,'');continue;}
+    const prefix=text(header,345,500);
+    const name=paxPath??longName??(prefix?`${prefix}/${text(header,0,100)}`:text(header,0,100));
+    paxPath=null;longName=null;
+    if(type==='5')continue;
+    if(!['0','7'].includes(type))fail('npm-tarball-link-unsupported');
+    // npm strips the top directory (usually package/).
+    const relative=name.split('/').slice(1).join('/');
+    if(!relative||relative.split('/').some(part=>part===''||part==='.'||part==='..'))fail('npm-tarball-invalid');
+    files.set(relative,body);
+  }
+  return files;
+}
+// Whether `dir` holds exactly the tarball's files, byte for byte; throws
+// otherwise. About 120 ms for TypeScript 6 (140 files, 24 MB).
+export function matchTarball(dir,files){
+  let count=0;
+  const walk=(folder,relative='')=>{
+    let entries;try{entries=fs.readdirSync(folder,{withFileTypes:true});}catch{fail('direct-typescript-implementation-unreviewed');}
+    for(const entry of entries){
+      const name=relative?`${relative}/${entry.name}`:entry.name,full=path.join(folder,entry.name);
+      if(entry.isDirectory()){walk(full,name);continue;}
+      const expected=files.get(name);
+      let same=false;try{same=entry.isFile()&&Boolean(expected)&&fs.readFileSync(full).equals(expected);}catch{}
+      if(!same)fail('direct-typescript-implementation-unreviewed');
+      count++;
+    }
+  };walk(dir);
+  if(count!==files.size)fail('direct-typescript-implementation-unreviewed');
+}

package/src/npmrc.mjs

@@ -0,0 +1,16 @@
+// An .npmrc file read as npm reads ini: comments, a BOM, `key = value`, a bare
+// key as true, quotes stripped, true/false as booleans. {} when it is absent.
+import fs from 'node:fs';
+
+export function npmrc(file){
+  const settings={};
+  if(!fs.existsSync(file))return settings;
+  for(const line of fs.readFileSync(file,'utf8').replace(/^\uFEFF/,'').split(/\r?\n/)){
+    const trimmed=line.trim();if(!trimmed||/^[#;]/.test(trimmed))continue;
+    const at=trimmed.indexOf('='),key=(at<0?trimmed:trimmed.slice(0,at)).trim();
+    let value=at<0?true:trimmed.slice(at+1).trim();
+    if(typeof value==='string'&&/^(["']).*\1$/.test(value))value=value.slice(1,-1);
+    settings[key]=value==='true'?true:value==='false'?false:value;
+  }
+  return settings;
+}

package/src/plan-worker.mjs

@@ -5,6 +5,7 @@ import {createHash} from 'node:crypto';
 import {discover} from './plan.mjs';
 import {InputIndex,dehydrateIndex} from './index.mjs';
 import {directProject,directQualification} from './direct-typescript.mjs';
+import {checkRun} from './typescript-invocation.mjs';
 import {queriesMatch} from './typescript-list.mjs';
 import {planGuard,inputKey} from './decision-validation.mjs';
 import {timing,traceBase} from './decision-profile.mjs';
@@ -25,8 +26,10 @@ try {
       const queryStarted=performance.now();
       // Cached membership queries load the compiler API; establish its reviewed
       // implementation before that optimization can execute project code.
+      // Every direct check (a chain has one per run) uses the root's compiler:
+      // its bytes are verified once.
       const directRoots=new Set(config.checks.filter(check=>check.qualification===directQualification)
-        .map(check=>directProject(config.root,check.script).tsRoot));
+        .map((check,i)=>directProject(config.root,checkRun(check),{verify:i===0}).tsRoot));
       if(directRoots.size&&(workerData.reuse.queries||[]).some(([kind,,,options])=>
         kind==='readDirectory'&&!directRoots.has(options?.tsRoot)))throw Error('retained compiler implementation changed');
       const queriesValid=guard===workerData.reuse.guard&&