@redue/cli 0.1.0-alpha.16 → 0.1.0-alpha.18

package/src/pnpm-inputs.mjs

@@ -1,4 +1,4 @@
-// Pinned pnpm 12 node-modules installation provider. The engine sees only
+// pnpm 9-12 node-modules installation provider. The engine sees only
 // repository-relative input sets and resolution relationships, never pnpm
 // virtual-store names as semantic identities.
 import {probeTimeLeft} from './probe-deadline.mjs';
@@ -7,16 +7,18 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createRequire} from 'node:module';
 import {execFileSync,spawnSync} from 'node:child_process';
-import micromatch from './glob.mjs';
+import micromatch,{patternMatcher} from './glob.mjs';
 import YAML from 'yaml';
 import {resolveLinks} from './installed-inputs.mjs';
 import {withinPath as within,realObservedPath,samePath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
+import {npmrc} from './npmrc.mjs';
+import {runConfig,tscRun,tscRuns} from './typescript-invocation.mjs';
 
 const rel=(root,file)=>path.relative(root,file).split(path.sep).join('/');
 const read=file=>JSON.parse(fs.readFileSync(file,'utf8'));
 const exists=file=>{try{fs.lstatSync(file);return true;}catch{return false;}};
-function yaml(file){
+export function yaml(file){
   const doc=YAML.parseDocument(fs.readFileSync(file,'utf8'),{uniqueKeys:true});
   if(doc.errors.length)throw Error(`${path.basename(file)} cannot be interpreted safely`);
   return doc.toJS()||{};
@@ -27,40 +29,67 @@ function safePatterns(values){
     throw Error('pnpm workspace patterns are unsupported');
   return values;
 }
+// The supported pnpm majors. pnpm 9 reads settings from .npmrc, pnpm 10 from
+// pnpm-workspace.yaml first and then .npmrc, pnpm 11 and 12 from
+// pnpm-workspace.yaml only.
+export const pnpmMajors=[9,10,11,12];
+// Settings that move or copy installed files, or run code during install,
+// where the contract does not look; by pnpm-workspace.yaml and .npmrc name.
+// Other settings change only what gets installed, and the installed files are
+// what the contract observes. These are refused when either file sets them,
+// whichever file the installed pnpm reads. Only the project's files are read:
+// user or global rc files and npm_config_* variables at install time are not.
+const refused=[['modulesDir','modules-dir'],['virtualStoreDir','virtual-store-dir'],['lockfileDir','lockfile-dir'],
+  ['enableGlobalVirtualStore','enable-global-virtual-store'],['injectWorkspacePackages','inject-workspace-packages'],
+  ['sharedWorkspaceLockfile','shared-workspace-lockfile'],['pnpmfile','pnpmfile'],['globalPnpmfile','global-pnpmfile'],
+  ['configDependencies','config-dependencies']];
+// Whether a refused setting is set: present at all, except that only
+// sharedWorkspaceLockfile=false and injectWorkspacePackages=true move files.
+const setting=(key,value)=>value!==undefined&&
+  (key==='sharedWorkspaceLockfile'?value===false:key==='injectWorkspacePackages'?value===true:true);
 export function pnpmProjectInfo(root){
   root=realObservedPath(root);
   const pkg=read(path.join(root,'package.json'));
-  const pin=/^pnpm@(12\.\d+\.\d+)(?:\+[^\s]+)?$/.exec(pkg.packageManager||'');
-  if(!pin)throw Error('an exact pnpm 12 packageManager pin is required');
+  // A pin is optional; when present it names pnpm 9-12, and the install must match it.
+  const pin=pkg.packageManager===undefined?null:/^pnpm@((\d+)\.\d+\.\d+)(?:\+[^\s]+)?$/.exec(pkg.packageManager);
+  if(pkg.packageManager!==undefined&&(!pin||!pnpmMajors.includes(Number(pin[2]))))
+    throw Error(`packageManager ${JSON.stringify(String(pkg.packageManager).split('+')[0])} is outside pnpm ${pnpmMajors[0]}-${pnpmMajors.at(-1)}`);
   const workspaceFile=path.join(root,'pnpm-workspace.yaml');
-  const settings=exists(workspaceFile)?yaml(workspaceFile):{};
-  const patterns=safePatterns(settings.packages||[]);
-  const linker=settings.nodeLinker||'isolated';
-  return {version:pin[1],linker,patterns,settings};
+  const workspace=exists(workspaceFile)?yaml(workspaceFile):{},rc=npmrc(path.join(root,'.npmrc'));
+  const patterns=safePatterns(workspace.packages||[]);
+  // The linker the given pnpm major reads; without a major, the one any reads.
+  const linkerFor=major=>(major===9?rc['node-linker']:major>=11?workspace.nodeLinker:
+    workspace.nodeLinker??rc['node-linker'])||'isolated';
+  const major=pin?Number(pin[2]):null;
+  return {version:pin?.[1]??null,linker:linkerFor(major),linkerFor,patterns,settings:workspace,
+    refused:refused.filter(([key,name])=>setting(key,workspace[key])||setting(key,rc[name])).map(([key])=>key)};
 }
 export function pnpmInstallInfo(root){
   const started=performance.now();
   root=realObservedPath(root);
-  const pkg=read(path.join(root,'package.json'));
-  const {version,linker,patterns,settings}=pnpmProjectInfo(root);
+  const {version,linkerFor,patterns,settings,refused}=pnpmProjectInfo(root);
   const workspaceFile=path.join(root,'pnpm-workspace.yaml');
-  if(!['isolated','hoisted'].includes(linker))throw Error(`pnpm ${linker} linker is recording-only`);
-  if(settings.modulesDir||settings.virtualStoreDir||settings.enableGlobalVirtualStore)
-    throw Error('custom pnpm modules or virtual-store location is recording-only');
-  if(settings.injectWorkspacePackages)
-    throw Error('injected workspace dependencies are recording-only');
-  if(settings.sharedWorkspaceLockfile===false)
-    throw Error('separate workspace lockfiles are recording-only');
-  if(exists(path.join(root,'.pnpmfile.cjs'))||exists(path.join(root,'.pnpmfile.mjs')))
+  if(refused.some(key=>['pnpmfile','globalPnpmfile','configDependencies'].includes(key))||
+    exists(path.join(root,'.pnpmfile.cjs'))||exists(path.join(root,'.pnpmfile.mjs')))
     throw Error('custom pnpm installation hooks need review');
+  if(refused.some(key=>['modulesDir','virtualStoreDir','lockfileDir','enableGlobalVirtualStore'].includes(key)))
+    throw Error('custom pnpm modules or virtual-store location is recording-only');
+  if(refused.includes('injectWorkspacePackages'))throw Error('injected workspace dependencies are recording-only');
+  if(refused.includes('sharedWorkspaceLockfile'))throw Error('separate workspace lockfiles are recording-only');
   const modulesFile=path.join(root,'node_modules','.modules.yaml');
   if(!exists(modulesFile))throw Error('installed pnpm module metadata is missing');
   const modules=yaml(modulesFile);
-  if(modules.nodeLinker!==linker||modules.packageManager!==pkg.packageManager)
+  const installed=/^pnpm@((\d+)\.\d+\.\d+)$/.exec(String(modules.packageManager));
+  if(!installed||!pnpmMajors.includes(Number(installed[2])))
+    throw Error(`installed by ${JSON.stringify(String(modules.packageManager))}, outside pnpm ${pnpmMajors[0]}-${pnpmMajors.at(-1)}`);
+  const linker=linkerFor(Number(installed[2]));
+  if(!['isolated','hoisted'].includes(linker))throw Error(`pnpm ${linker} linker is recording-only`);
+  if(modules.nodeLinker!==linker||version!==null&&installed[1]!==version)
     throw Error('installed pnpm linker or version differs from project configuration');
   const virtualStore=path.join(root,'node_modules','.pnpm');
-  // pnpm 12 on Windows can omit virtualStoreDir when using its project-local
-  // default. Accept only the observed, ordinary local directory in that case.
+  // pnpm can omit virtualStoreDir when using its project-local default
+  // (seen with pnpm 12 on Windows). Accept only the observed, ordinary local
+  // directory in that case.
   const declared=modules.virtualStoreDir;
   const selected=declared===undefined?virtualStore:
     path.resolve(path.dirname(modulesFile),declared);
@@ -72,18 +101,8 @@ export function pnpmInstallInfo(root){
     throw Error('nonstandard or incomplete project-local pnpm virtual store');
   if(!exists(path.join(root,'pnpm-lock.yaml')))
     throw Error('pnpm lockfile is missing');
-  if(exists(path.join(root,'.npmrc'))){
-    // pnpm 12 reads project settings from pnpm-workspace.yaml. Registry/auth
-    // entries affect acquisition, not a completed local TypeScript invocation.
-    for(const line of fs.readFileSync(path.join(root,'.npmrc'),'utf8').split(/\r?\n/)){
-      const trimmed=line.trim();if(!trimmed||/^[#;]/.test(trimmed))continue;
-      const key=trimmed.split('=')[0].trim();
-      if(key!=='registry'&&!/^\/\/[^\s]+\/:_authToken$/.test(key))
-        throw Error('project .npmrc has execution-relevant pnpm settings requiring review');
-    }
-  }
   timing('pnpm.install_metadata',started);
-  return {version,linker,patterns,settings,modulesFile,
+  return {version:installed[1],linker,patterns,settings,modulesFile,
     configurationInputs:['package.json','pnpm-lock.yaml',
       ...(exists(workspaceFile)?['pnpm-workspace.yaml']:[]),
       ...(exists(path.join(root,'.npmrc'))?['.npmrc']:[]),
@@ -173,16 +192,37 @@ function packageAt(root,requester,name){
   }
   return {physical:null,candidates};
 }
-function parsedTypeScript(root,dir,ts){
-  const config=path.join(root,dir,'tsconfig.json'),reads=new Set();
+// Files TypeScript may consume from its own include: each directory its
+// include patterns watch for new files (TypeScript's own
+// wildcardDirectories), and each file it lists. node_modules below them is
+// left out, as TypeScript's wildcards leave it out; installed files a program
+// reads are installed inputs. `exclude` entries stay inputs: an import can
+// still reach an excluded file.
+const sourceFiles='*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json}';
+function sourcePatterns(root,parsed){
+  const patterns=new Set(),excluded=new Set();
+  for(const [folder,flags] of Object.entries(parsed.wildcardDirectories||{})){
+    // TypeScript 4 lowercases these keys on case-insensitive file systems;
+    // the native realpath gives the directory's own spelling.
+    let at;try{at=fs.realpathSync.native(folder);}catch{at=path.resolve(folder);}
+    if(!within(at,root))throw Error('TypeScript source membership escapes the checkout');
+    const prefix=rel(root,at)?rel(root,at)+'/':'';
+    if(flags&1){patterns.add(`${prefix}**/${sourceFiles}`);excluded.add(`!${prefix}**/node_modules/**`);}
+    else patterns.add(prefix+sourceFiles);
+  }
+  const included=patternMatcher([...patterns,...excluded]);
+  for(const file of parsed.fileNames.map(name=>path.resolve(name))){
+    if(!within(file,root))throw Error('TypeScript source membership escapes the checkout');
+    if(!included(rel(root,file)))patterns.add(rel(root,file));
+  }
+  return [...patterns,...excluded];
+}
+function parsedTypeScript(root,dir,ts,configName='tsconfig.json'){
+  const config=path.join(root,dir,configName),reads=new Set();
   const host={...ts.sys,readFile(file){reads.add(path.resolve(file));return ts.sys.readFile(file);},
     onUnRecoverableConfigFileDiagnostic(){}};
   const parsed=ts.getParsedCommandLineOfConfigFile(config,{},host);
   if(!parsed||parsed.errors?.length)throw Error('TypeScript configuration unavailable');
-  const raw=ts.readConfigFile(config,ts.sys.readFile);
-  if(raw.error||!Array.isArray(raw.config?.include)||raw.config.include.length!==1||
-    !/^src(?:$|\/)/.test(raw.config.include[0]))
-    throw Error('TypeScript source file membership is outside the supported src include');
   if(parsed.options.plugins?.length||parsed.options.incremental||parsed.options.composite||
     parsed.projectReferences?.length||parsed.options.paths||parsed.options.baseUrl||
     parsed.options.rootDirs?.length||parsed.options.typeRoots?.length||
@@ -194,12 +234,13 @@ function parsedTypeScript(root,dir,ts){
     throw Error('TypeScript module resolver is outside the supported Node contract');
   for(const file of reads)if(!within(realObservedPath(file),root))
     throw Error('TypeScript configuration escapes the checkout');
-  return {parsed,configs:[...reads].map(file=>rel(root,file)).sort()};
+  return {parsed,configs:[...reads].map(file=>rel(root,file)).sort(),
+    sourcePatterns:sourcePatterns(root,parsed)};
 }
-function listedTypeScriptFiles(root,selected,tsc){
+function listedTypeScriptFiles(root,selected,tsc,configName){
   // --listFilesOnly resolves the compiler's effective module/file set but
   // performs no typecheck and emits no project outputs.
-  const out=spawnSync(process.execPath,[tsc,'-p','tsconfig.json','--listFilesOnly'],
+  const out=spawnSync(process.execPath,[tsc,'-p',configName,'--listFilesOnly'],
     {cwd:path.join(root,selected.dir),env:process.env,encoding:'utf8',
       // The native NTFS public workspace takes 3-5 s to list ~770 inputs;
       // 5 s sometimes expired despite bounded, progressing compiler work.
@@ -236,17 +277,23 @@ function sharedHardlinkIn(folder){
   }
   return false;
 }
-export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}={}){
+// `run`: the check's {script, part, args}, or a script name for its only run.
+export function pnpmTypecheckInputs(root,workspace,run,{captureQueries=false}={}){
   const totalStarted=performance.now();
   root=realObservedPath(root);
   const install=pnpmInstallInfo(root),members=pnpmWorkspacePackages(root,install.patterns);
   const selected=workspace==='.'?{name:'.',dir:'.',manifest:'package.json',
     pkg:read(path.join(root,'package.json'))}:members.get(workspace);
   if(!selected)throw Error(`workspace ${workspace} is not declared`);
-  if(!/^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(
-    selected.pkg.scripts?.[script]?.trim()||'')||
-    selected.pkg.scripts?.['pre'+script]||selected.pkg.scripts?.['post'+script])
-    throw Error('typecheck must be one standalone TypeScript invocation');
+  // A script name stands for its only run.
+  if(typeof run==='string'){const runs=tscRuns(selected.pkg.scripts?.[run]);run={script:run,args:runs?.length===1?runs[0].args:[]};}
+  const {run:own,issue}=tscRun(selected.pkg.scripts,run);
+  if(issue)throw Error(`typecheck must be standalone TypeScript runs: ${issue}`);
+  // `tsc -p .` without --noEmit predates the other forms.
+  if(!own.noEmit&&!['-p .','-p tsconfig.json'].includes(run.args.join(' ')))
+    throw Error('typecheck must pass --noEmit');
+  const configName=runConfig(path.join(root,selected.dir),run.args);
+  if(!configName)throw Error('TypeScript project is outside the package');
   const selectedDir=path.join(root,selected.dir),lookup=createRequire(path.join(selectedDir,'package.json'));
   let tsPackage;try{tsPackage=realObservedPath(lookup.resolve('typescript/package.json'));}
   catch{throw Error('installed TypeScript compiler cannot be resolved');}
@@ -255,7 +302,8 @@ export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}
   const tsc=path.join(tsRoot,'bin','tsc');
   if(!exists(tsc))throw Error('installed TypeScript executable is missing');
   const configStarted=performance.now();
-  const {configs}=parsedTypeScript(root,selected.dir,ts);
+  const {configs,sourcePatterns:sources}=parsedTypeScript(root,selected.dir,ts,configName);
+  const isSource=patternMatcher(sources);
   timing('pnpm.ts_config',configStarted,{configs:configs.length});
   const closure=new Map(),installed=new Set(),generated=new Set(),
     links=new Set(),candidates=new Set(),absences=[],instances=new Map();
@@ -305,12 +353,12 @@ export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}
     resolutionMs:Math.round(resolutionMs),workspaceLinks:links.size,
     candidates:candidates.size});
   const listingStarted=performance.now();
-  const captured=captureQueries?compilerFiles(tsRoot,path.join(root,selected.dir)):null;
-  const files=captured?captured.files.map(realObservedPath):listedTypeScriptFiles(root,selected,tsc);
+  const captured=captureQueries?compilerFiles(tsRoot,path.join(root,selected.dir),configName):null;
+  const files=captured?captured.files.map(realObservedPath):listedTypeScriptFiles(root,selected,tsc,configName);
   timing('pnpm.ts_input_listing',listingStarted,{files:files.length});
   const mappingStarted=performance.now();
   for(const file of files){
-    if(within(file,path.join(selectedDir,'src'))||
+    if(isSource(rel(root,file))||
       [...closure.values()].some(member=>within(file,path.join(root,member.dir))))continue;
     const packageRoot=installedPackageRoot(root,file);
     if(!packageRoot)throw Error(`TypeScript consumes a file outside the observed pnpm contract: ${rel(root,file)}`);
@@ -321,6 +369,16 @@ export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}
   }
   timing('pnpm.input_mapping',mappingStarted,{instances:instances.size,
     installedPatterns:installed.size});
+  // A config extended from an installed package is an installed input too:
+  // source patterns leave node_modules out.
+  for(const config of configs){
+    const file=realObservedPath(path.join(root,config));
+    if(!within(file,path.join(root,'node_modules')))continue;
+    const packageRoot=installedPackageRoot(root,file);
+    if(!packageRoot)throw Error(`TypeScript configuration ${config} is outside an installed package`);
+    installed.add(`${rel(root,packageRoot)}/**`);
+    installed.add(`!${rel(root,packageRoot)}/node_modules/**`);
+  }
   installed.add(`${rel(root,tsRoot)}/**`);
   installed.add(`!${rel(root,tsRoot)}/node_modules/**`);
   if(!instances.has(tsRoot))instances.set(tsRoot,{name:'typescript',physicalRoot:rel(root,tsRoot)});
@@ -329,11 +387,12 @@ export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}
   timing('pnpm.hardlink_inspection',sharedStarted,{instances:instances.size,
     shared:shared.length});
   const source=[...new Set([...install.configurationInputs,selected.manifest,
-    ...configs,`${selected.dir==='.'?'':selected.dir+'/'}src/**`,
+    ...configs,...sources,
     ...closure.values().map(member=>member.manifest),...generated])];
   timing('pnpm.total_discovery',totalStarted,{instances:instances.size,
     inputFiles:files.length});
   return {install,workspace:selected,closure:[...closure.values()],source,
+    sourcePatterns:sources,args:run.args,
     installed:[...installed],generated:[...generated],
     // The read-only state probe consumes this same resolved compiler file set.
     // It is deliberately omitted from the persisted user-facing input plan.

package/src/pnpm-typecheck-probe.mjs

@@ -7,14 +7,17 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
+import {patternMatcher} from './glob.mjs';
 import {withinPath as within,realObservedPath} from './path-identity.mjs';
+import {runFromArgv} from './typescript-invocation.mjs';
 
-const [rootArg,workspace,script]=process.argv.slice(2);
+const [rootArg,workspace,...rest]=process.argv.slice(2).filter(value=>!value.startsWith('--redue-'));
 const hash=value=>createHash('sha256').update(value).digest('hex');
 const digest=file=>hash(fs.readFileSync(file));
 const fail=code=>{throw Object.assign(Error(code),{code});};
 try{
-  if(!rootArg||!workspace||!script)fail('probe-arguments');
+  if(!rootArg||!workspace)fail('probe-arguments');
+  const run=runFromArgv(rest);
   const root=realObservedPath(rootArg);
   if(process.env.NODE_OPTIONS||process.env.NODE_PATH||process.env.BASH_ENV||
     process.env.ENV||Object.entries(process.env).some(([key,value])=>{
@@ -24,23 +27,25 @@ try{
       return /^(PNPM_|COREPACK_|npm_config_|DYLD_|TSGO_)/i.test(key);
     }))
     fail('pnpm-execution-environment-unsupported');
-  const contextHash=hash(JSON.stringify([root,workspace,script,process.version]));
+  const contextHash=hash(JSON.stringify([root,workspace,run,process.version]));
   if(contextOnly(contextHash))process.exit(0);
-  const contract=pnpmTypecheckInputs(root,workspace,script,{captureQueries:process.argv.includes('--redue-checkpoint')});
+  const contract=pnpmTypecheckInputs(root,workspace,run,{captureQueries:process.argv.includes('--redue-checkpoint')});
   if(contract.limitations.length)fail('pnpm-input-coverage-unavailable');
   const selected=path.join(root,contract.workspace.dir),tsc=contract.tsc;
   const inputs=contract.listedFiles;
   if(!inputs.length)fail('typescript-input-list-unavailable');
-  const inputRoots=[path.join(selected,'src'),...contract.generated.map(pattern=>
+  const inputRoots=[...contract.generated.map(pattern=>
     path.join(root,pattern.slice(0,-3))),...contract.installed.filter(p=>!p.startsWith('!'))
       .map(pattern=>path.join(root,pattern.slice(0,-3)))];
+  const isSource=patternMatcher(contract.sourcePatterns);
   for(const file of inputs)if(!within(file,root)||
+    !isSource(path.relative(root,file).split(path.sep).join('/'))&&
     !inputRoots.some(boundary=>within(file,boundary)))
     fail('typescript-input-outside-pnpm-contract');
   const files=[...new Set(inputs)].sort().map(file=>
     [hash(path.relative(root,file)),digest(file)]);
   const configs=contract.configs.map(file=>[hash(file),digest(path.join(root,file))]);
-  probeResult(hash(JSON.stringify({schema:1,workspace,script,
+  probeResult(hash(JSON.stringify({schema:1,workspace,run,
     files,configs,node:process.version,tsc:digest(tsc),
     packageManager:contract.install.version,linker:contract.install.linker})),contextHash,contract.discoveryQueries);
 }catch(e){console.error(`VSTATE_REASON:${e.code&&/^[a-z-]+$/.test(e.code)?e.code: