@redue/cli 0.1.0-alpha.16 → 0.1.0-alpha.18

package/src/test-direct.mjs

@@ -10,9 +10,13 @@ import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {fileURLToPath} from 'node:url';
 import {spawnSync} from 'node:child_process';
-import micromatch from './glob.mjs';
+import {patternMatcher} from './glob.mjs';
 import {runFact} from './direct-run-certificate.mjs';
 import {queryAnswer} from './typescript-list.mjs';
+import {pnpmInstallInfo,pnpmProjectInfo,yaml} from './pnpm-inputs.mjs';
+import {workspaceManifests} from './workspace-manifests.mjs';
+import {atomicJson} from './state-store.mjs';
+import {racyUntil} from './path-identity.mjs';
 
 const digest=value=>createHash('sha256').update(value).digest('hex');
 export const testRecorder=fileURLToPath(new URL('test-recorder.cjs',import.meta.url));
@@ -39,10 +43,10 @@ const issueLimit=20,factLimit=10000;
 
 // The guard file the recorder reads: where to write, what counts as the
 // checkout and as temporary space, and digests of the caller's environment.
-export function testGuardConfig(dir,root,env=process.env) {
+export function testGuardConfig(dir,root,env=process.env,project={}) {
   const tmp=[...new Set([path.resolve(os.tmpdir()),fs.realpathSync(os.tmpdir())])];
   const real=dir=>{try{return fs.realpathSync(dir);}catch{return dir;}};
-  return {schema:1,dir,root,tmp,runnerData:[...new Set(runnerDataDirectories(env).flatMap(dir=>[path.resolve(dir),real(dir)]))],
+  return {schema:1,dir,root,tmp,installed:modulesDirs(project).map(at=>path.join(root,at)),runnerData:[...new Set(runnerDataDirectories(env).flatMap(dir=>[path.resolve(dir),real(dir)]))],
     env:Object.fromEntries(Object.entries(env).filter(([,value])=>typeof value==='string').map(([key,value])=>[key,digest(value)]))};
 }
 
@@ -63,9 +67,7 @@ export function testRunGuard(dir,{root,sourcePatterns,files,runner,environment=t
   const compared=name=>(environment.variables||[]).includes(name)||
     (environment.prefixes||[]).some(prefix=>name.toLowerCase().startsWith(prefix.toLowerCase()));
   const issues=[],add=issue=>{if(!issues.includes(issue))issues.push(issue);};
-  const positive=sourcePatterns.filter(p=>!p.startsWith('!')).map(p=>micromatch.matcher(p,{dot:true}));
-  const negative=sourcePatterns.filter(p=>p.startsWith('!')).map(p=>micromatch.matcher(p.slice(1),{dot:true}));
-  const included=rel=>positive.some(fn=>fn(rel))&&!negative.some(fn=>fn(rel));
+  const included=patternMatcher(sourcePatterns);
   const observed=rel=>Object.hasOwn(files||{},rel);
   const headers=new Map(),records=[];
   let names=[];
@@ -262,48 +264,199 @@ export function testRecipeScript(scripts){
   return near?{issue:issue(near)}:{};
 }
 const majorOf=version=>Number(String(version).split('.')[0]);
-// The runner's executable inside the checkout's node_modules.
+// The runner's executable inside the checkout's node_modules. pnpm links
+// node_modules/RUNNER into node_modules/.pnpm; the files stay in node_modules.
 export function testRunnerEntry(root,runner){
   if(!runners[runner])fail('test-runner-unsupported');
   const dir=path.join(root,'node_modules',runner);
   let pkg,real;
   try{real=fs.realpathSync(dir);pkg=JSON.parse(fs.readFileSync(path.join(real,'package.json'),'utf8'));}
   catch{fail('test-runner-missing');}
-  if(real!==dir||pkg.name!==runner)fail('test-runner-layout-unsupported');
+  const modules=fs.realpathSync(path.join(root,'node_modules'));
+  if(!real.startsWith(modules+path.sep)||pkg.name!==runner)fail('test-runner-layout-unsupported');
   const bin=typeof pkg.bin==='string'?pkg.bin:pkg.bin?.[runner];
   const entry=typeof bin==='string'?path.resolve(real,bin):null;
   if(!entry||!entry.startsWith(real+path.sep)||!fs.existsSync(entry))fail('test-runner-layout-unsupported');
   return entry;
 }
-// The project facts the recipe needs, or an error code.
-export function testProject(root,script){
+// The package manager of a checkout whose install the recipe observes in
+// node_modules: npm, pnpm 9-12 (isolated or hoisted), or Yarn with the
+// node-modules linker. One lockfile kind, agreeing with any declaration.
+// Workspaces are refused unless `workspaces` is set.
+export function testPackageManager(root,pkg,{workspaces=false}={}){
+  const has=file=>fs.existsSync(path.join(root,file));
+  const kinds=new Set([has('package-lock.json')||has('npm-shrinkwrap.json')?'npm':null,has('pnpm-lock.yaml')?'pnpm':null,
+    has('yarn.lock')?'yarn':null,has('bun.lock')||has('bun.lockb')?'bun':null].filter(Boolean));
+  const declared=/^(npm|pnpm|yarn|bun)@/.exec(pkg.packageManager||'')?.[1];
+  if(pkg.packageManager!==undefined&&!declared)fail('test-package-manager-unsupported');
+  if(declared)kinds.add(declared);
+  const name=kinds.size===1?[...kinds][0]:null;
+  if(!name||!has({npm:'package-lock.json',pnpm:'pnpm-lock.yaml',yarn:'yarn.lock',bun:'bun.lock'}[name])&&
+    !(name==='npm'&&has('npm-shrinkwrap.json')))fail('test-package-manager-unsupported');
+  if(pkg.workspaces&&!workspaces)fail('test-workspace-unsupported');
+  if(name==='pnpm'){
+    // pnpm 10+ keeps settings in pnpm-workspace.yaml; only `packages` makes a workspace.
+    let install;try{install=pnpmInstallInfo(root);}catch{fail('test-pnpm-install-unsupported');}
+    if(install.patterns.length&&!workspaces)fail('test-workspace-unsupported');
+  }
+  if(name==='yarn'){
+    // Yarn 2+ needs top-level `nodeLinker: node-modules` and the classic nmMode
+    // (no hard links); Yarn 1 always installs node_modules.
+    const rc=has('.yarnrc.yml')?fs.readFileSync(path.join(root,'.yarnrc.yml'),'utf8'):null;
+    const top=key=>rc?new RegExp(`^${key}\\s*:\\s*['"]?([\\w-]+)`,'m').exec(rc)?.[1]:undefined;
+    const version=/^yarn@(\d+)\./.exec(pkg.packageManager||'')?.[1];
+    if(!version||(version==='1'?rc!==null:top('nodeLinker')!=='node-modules'||![undefined,'classic'].includes(top('nmMode'))))
+      fail('test-yarn-install-unsupported');
+  }
+  if(name==='bun')fail('test-package-manager-unsupported');
+  return name;
+}
+// What a recorded run needs, from the check itself rather than the checkout:
+// the package directory, the workspace node_modules its installed inputs
+// list, and the runner and arguments of the package's script. A package
+// added since init is then not treated as installed, so reads there are
+// unobserved and make the run UNVERIFIED.
+export function testRunFacts(root,check){
+  const dir=check.cwd&&check.cwd!=='.'?check.cwd:'.';
+  const dirs=(check.installedInputs||[]).map(p=>/^([^!*]+)\/node_modules\/\*\*$/.exec(p)?.[1]).filter(Boolean);
+  const own=JSON.parse(fs.readFileSync(path.join(root,dir,'package.json'),'utf8'));
+  if(typeof own.scripts?.[check.script]!=='string')fail('test-script-changed');
+  return {...testScript(own.scripts[check.script]),dir,dirs};
+}
+// The checkout's workspace patterns: pnpm's `packages`, else package.json's.
+export function testWorkspacePatterns(root,pkg){
+  return fs.existsSync(path.join(root,'pnpm-lock.yaml'))?pnpmProjectInfo(root).patterns:
+    Array.isArray(pkg.workspaces)?pkg.workspaces:pkg.workspaces?.packages??[];
+}
+// The checkout's workspace package directories, [] for a single package.
+export function testWorkspaceDirs(root,pkg){
+  const patterns=testWorkspacePatterns(root,pkg);
+  return patterns.length?workspaceManifests(root,patterns).map(({file})=>path.posix.dirname(file)):[];
+}
+// Each node_modules the recipe observes as installed: the root's and every
+// workspace package's, relative to the root.
+const modulesDirs=({dirs=[]})=>['node_modules',...dirs.map(dir=>`${dir}/node_modules`)];
+// pnpm's content-addressed store, as the install recorded it in .modules.yaml:
+// files/<first 2 hex>/<rest of the content's sha512 hex>, "-exec" for
+// executables. pnpm writes new store files and never changes one in place.
+function pnpmStoreFiles(root){
+  try{const {storeDir}=yaml(path.join(root,'node_modules','.modules.yaml'));
+    return typeof storeDir==='string'&&path.isAbsolute(storeDir)?path.join(storeDir,'files'):null;}
+  catch{return null;}
+}
+const identity=st=>`${st.size}:${st.mtimeNs}:${st.ctimeNs}`;
+const sameFile=(file,st)=>{
+  try{const other=fs.statSync(file,{bigint:true});return other.dev===st.dev&&other.ino===st.ino;}
+  catch{return false;}};
+// The file's store path relative to `files`, or null when the store does not
+// hold this file at its content's address.
+function storePath(files,file,st){
+  const hash=createHash('sha512'),buffer=Buffer.alloc(1<<20),fd=fs.openSync(file,'r');
+  try{for(let n;(n=fs.readSync(fd,buffer,0,buffer.length,null))>0;)hash.update(buffer.subarray(0,n));}
+  finally{fs.closeSync(fd);}
+  const hex=hash.digest('hex'),at=path.join(hex.slice(0,2),hex.slice(2));
+  return [at,at+'-exec'].find(candidate=>sameFile(path.join(files,candidate),st))??null;
+}
+// The first installed file with more than one link, as {file, reason}, or
+// null. A package store outside the checkout (pnpm's default on Linux, Yarn's
+// hardlinks modes) can change such a file with no event here. A link into
+// pnpm's own store is accepted: the store's file is named by its content.
+// Checked at every recorded run: a later install that adds links replaces the
+// files, which is a change REDUE sees. `cache` (in owned state) keeps each
+// file found in the store with its identity and store path, so an unchanged
+// file is not hashed again; its store link is still checked.
+export function sharedInstalledFile(root,project={},cache=null){
+  const stack=modulesDirs(project).map(dir=>path.join(root,dir));
+  const files=pnpmStoreFiles(root),now=Date.now();
+  let known={},changed=false;
+  if(files&&cache)try{const value=JSON.parse(fs.readFileSync(cache,'utf8'));
+    if(value?.files===files&&value.entries&&typeof value.entries==='object')known=value.entries;}catch{}
+  const found={};
+  const shared=(file,reason)=>({file:path.relative(root,file).split(path.sep).join('/'),reason});
+  while(stack.length){
+    const dir=stack.pop();let entries;
+    try{entries=fs.readdirSync(dir,{withFileTypes:true});}catch{continue;}
+    for(const entry of entries){
+      const file=path.join(dir,entry.name);
+      if(entry.isDirectory()){stack.push(file);continue;}
+      if(!entry.isFile())continue;
+      let st;try{st=fs.lstatSync(file,{bigint:true});}catch{continue;}
+      if(st.nlink<=1n)continue;
+      if(!files)return shared(file,'has another hard link, and the install records no pnpm store');
+      const key=`${st.dev}:${st.ino}`,cached=known[key];
+      let at=Array.isArray(cached)&&cached[0]===identity(st)&&typeof cached[1]==='string'&&
+        sameFile(path.join(files,cached[1]),st)?cached[1]:null;
+      if(!at){
+        try{at=storePath(files,file,st);}
+        catch(e){return shared(file,`could not be checked against pnpm's store (${e.code||e.message})`);}
+        if(!at)return shared(file,"has another hard link outside pnpm's store");
+        changed=true;
+      }
+      // A file changed within the racy window could change again unseen in
+      // the same timestamp tick; it is hashed again next time.
+      if(racyUntil(st)<=now)found[key]=[identity(st),at];
+      else changed=true;
+    }
+  }
+  if(files&&cache&&(changed||Object.keys(found).length!==Object.keys(known).length))
+    try{atomicJson(cache,{files,entries:found});}catch{}
+  return null;
+}
+// The runner a package's script reaches: Node's lookup from the package
+// directory up to the root, skipping candidates that are not the runner. Its
+// files must be in an observed node_modules (`dirs`: workspace packages).
+// `logical` is where the lookup found it, before links, relative to the root.
+export function testRunnerAt(root,dir,runner,dirs=[]){
+  if(dir==='.')return {entry:testRunnerEntry(root,runner),logical:`node_modules/${runner}`};
+  if(!runners[runner])fail('test-runner-unsupported');
+  const rootReal=fs.realpathSync(root),observed=modulesDirs({dirs}).map(at=>path.join(rootReal,at)+path.sep);
+  for(let at=dir;;at=path.posix.dirname(at)){
+    const logical=at==='.'?`node_modules/${runner}`:`${at}/node_modules/${runner}`;
+    let real,pkg;
+    try{real=fs.realpathSync(path.join(root,logical));pkg=JSON.parse(fs.readFileSync(path.join(real,'package.json'),'utf8'));}catch{}
+    if(pkg?.name===runner){
+      if(!observed.some(prefix=>real.startsWith(prefix)))fail('test-runner-layout-unsupported');
+      const bin=typeof pkg.bin==='string'?pkg.bin:pkg.bin?.[runner];
+      const entry=typeof bin==='string'?path.resolve(real,bin):null;
+      if(!entry||!entry.startsWith(real+path.sep)||!fs.existsSync(entry))fail('test-runner-layout-unsupported');
+      return {entry,logical};
+    }
+    if(at==='.')fail('test-runner-missing');
+  }
+}
+// The project facts the recipe needs, or an error code. `dir` is a workspace
+// package's directory; there the recipe supports Vitest only.
+export function testProject(root,script,dir='.'){
   const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));
-  if(pkg.workspaces||pkg.packageManager&&!/^npm@/.test(pkg.packageManager)||
-    !['package-lock.json','npm-shrinkwrap.json'].some(file=>fs.existsSync(path.join(root,file)))||
-    ['yarn.lock','pnpm-lock.yaml','bun.lock','bun.lockb'].some(file=>fs.existsSync(path.join(root,file))))
-    fail('test-npm-project-unsupported');
-  if(typeof pkg.scripts?.[script]!=='string'||pkg.scripts['pre'+script]||pkg.scripts['post'+script])fail('test-script-changed');
-  const {runner,args}=testScript(pkg.scripts[script]);
-  const entry=testRunnerEntry(root,runner);
-  const version=JSON.parse(fs.readFileSync(path.join(root,'node_modules',runner,'package.json'),'utf8')).version;
+  testPackageManager(root,pkg,{workspaces:dir!=='.'});
+  const dirs=dir==='.'?[]:testWorkspaceDirs(root,pkg);
+  if(dir!=='.'&&!dirs.includes(dir))fail('test-workspace-unsupported');
+  const own=dir==='.'?pkg:JSON.parse(fs.readFileSync(path.join(root,dir,'package.json'),'utf8'));
+  if(typeof own.scripts?.[script]!=='string'||own.scripts['pre'+script]||own.scripts['post'+script])fail('test-script-changed');
+  const {runner,args}=testScript(own.scripts[script]);
+  if(dir!=='.'&&runner!=='vitest')fail('test-runner-unsupported');
+  const {entry,logical}=testRunnerAt(root,dir,runner,dirs);
+  const version=JSON.parse(fs.readFileSync(path.join(root,logical,'package.json'),'utf8')).version;
   if(!runners[runner].majors.includes(majorOf(version)))fail('test-runner-version-unsupported');
   if(runner==='jest'){
     let util=null;try{util=JSON.parse(fs.readFileSync(path.join(root,'node_modules/jest-util/package.json'),'utf8')).version;}catch{}
     if(majorOf(util)!==29||!fs.existsSync(path.join(root,'node_modules/jest-util/build/createProcessObject.js')))
       fail('test-runner-layout-unsupported');
   }
-  return {runner,version,args,entry};
+  return {runner,version,args,entry,dir,dirs,logical};
 }
 // Inputs: the whole checkout except documentation and the coverage report a
 // --coverage run writes. Git-ignored files the run creates are handled per
-// run (cli.mjs). Installed files are observed by identity; Vite's
-// caches inside node_modules are written by every Vitest run.
-export function testCheckInputs({runner,args}){
-  return {inputs:['**','!node_modules/**','!.git/**','!**/*.md','!**/*.mdx',
-    ...(args.includes('--coverage')?['!coverage/**']:[])],
+// run (cli.mjs). Installed files, in the root's node_modules and every
+// workspace package's, are observed by identity; Vite's caches inside them
+// are written by every Vitest run.
+export function testCheckInputs({runner,args,dir='.',dirs=[],logical=`node_modules/${runner}`}){
+  const modules=modulesDirs({dirs});
+  return {inputs:['**',...modules.map(at=>`!${at}/**`),'!.git/**','!**/*.md','!**/*.mdx',
+    ...(args.includes('--coverage')?[`!${dir==='.'?'':dir+'/'}coverage/**`]:[])],
   // Vitest's typecheck mode keeps tsc's build info in its own dist directory.
-  installedInputs:['node_modules/**',...(runner==='vitest'?['!node_modules/.vite/**','!node_modules/.vite-temp/**','!node_modules/.vitest/**',
-    '!node_modules/vitest/dist/tsconfig.tmp.tsbuildinfo']:[])]};
+  installedInputs:modules.flatMap(at=>[`${at}/**`,...(runner==='vitest'?[`!${at}/.vite/**`,`!${at}/.vite-temp/**`,`!${at}/.vitest/**`]:[])])
+    .concat(runner==='vitest'?[`!${logical}/dist/tsconfig.tmp.tsbuildinfo`]:[])};
 }
 // The coverage directory a --coverage run may read back: Jest reads every
 // .js file under its roots, an earlier report's included, to map dependencies,
@@ -311,21 +464,26 @@ export function testCheckInputs({runner,args}){
 // when no configuration names thresholds (which make the report decide the
 // result) or another report directory. Configuration can be code, so this
 // reads its text.
-export function coverageReadable(root,{runner,args}){
+export function coverageReadable(checkout,{runner,args,dir='.'}){
   if(!args.includes('--coverage'))return null;
+  // A workspace package's configuration and report live in its directory.
+  const root=path.join(checkout,dir);
   const names=runner==='jest'?['jest.config.js','jest.config.ts','jest.config.mjs','jest.config.cjs','jest.config.json']:
     ['vitest.config.ts','vitest.config.mts','vitest.config.cts','vitest.config.js','vitest.config.mjs','vitest.config.cjs',
       'vite.config.ts','vite.config.mts','vite.config.cts','vite.config.js','vite.config.mjs','vite.config.cjs',
       'vitest.workspace.ts','vitest.workspace.js','vitest.workspace.json'];
   const at=args.findIndex(arg=>arg==='--config'||arg==='-c'),inline=args.find(arg=>/^(?:--config|-c)=/.test(arg));
   const given=at>=0?args[at+1]:inline?.split(/=(.*)/s)[1];
-  const texts=[];
-  for(const name of [...names,...(given?[given]:[])]){
-    try{texts.push(fs.readFileSync(path.resolve(root,name),'utf8'));}catch{}
+  // Vitest finds its configuration in the package directory or a parent.
+  const texts=[],folders=[];
+  for(let at=dir;;at=path.posix.dirname(at)){folders.push(path.join(checkout,at));if(at==='.')break;}
+  for(const name of [...names,...(given?[given]:[])])for(const folder of folders){
+    try{texts.push(fs.readFileSync(path.resolve(folder,name),'utf8'));}catch{}
   }
   try{const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));
     if(runner==='jest'&&pkg.jest)texts.push(JSON.stringify(pkg.jest));}catch{return null;}
-  return texts.some(text=>/coverageThreshold|thresholds|coverageDirectory|reportsDirectory/.test(text))?null:'coverage';
+  return texts.some(text=>/coverageThreshold|thresholds|coverageDirectory|reportsDirectory/.test(text))?null:
+    dir==='.'?'coverage':`${dir}/coverage`;
 }
 // The caller's environment, when it would load code before the recorder or
 // the Node version is not one the recipe supports. Compared variables are
@@ -345,13 +503,17 @@ export function qualifyTests(root,selected){
   const issues=[];
   if(!['darwin','linux'].includes(process.platform))issues.push('the test recipe records runs on macOS and Linux only');
   try{
-    const project=testProject(root,selected.script);
-    if(JSON.stringify(selected.command)!==JSON.stringify([process.execPath,project.entry,...project.args])||
-      selected.cwd&&selected.cwd!=='.')issues.push('test runner invocation changed; run redue init again');
+    const dir=selected.cwd&&selected.cwd!=='.'?selected.cwd:'.';
+    if(dir!=='.'&&!selected.workspace)throw Object.assign(Error(),{code:'a test check in a directory needs its workspace'});
+    const project=testProject(root,selected.script,dir);
+    if(JSON.stringify(selected.command)!==JSON.stringify([process.execPath,project.entry,...project.args]))
+      issues.push('test runner invocation changed; run redue init again');
     // Every checkout file but installed ones is a content input; the recorder
     // skips node_modules because it is observed as installed files.
-    const positives=(selected.inputs||[]).filter(p=>!p.startsWith('!'));
-    if(positives.length!==1||positives[0]!=='**'||!selected.inputs.includes('!node_modules/**')||
+    if(dir!=='.'&&JSON.parse(fs.readFileSync(path.join(root,dir,'package.json'),'utf8')).name!==selected.workspace)
+      issues.push('the test check names another workspace package than its directory holds; run redue init again');
+    const expected=testCheckInputs(project),sorted=list=>JSON.stringify([...(list||[])].sort());
+    if(sorted(selected.inputs)!==sorted(expected.inputs)||
       JSON.stringify([...(selected.installedInputs||[])].sort())!==JSON.stringify([...testCheckInputs(project).installedInputs].sort()))
       issues.push('test inputs must be the whole checkout, with node_modules observed as installed files; run redue init again');
   }catch(e){issues.push(e.code||'test runner prerequisites unavailable');}

package/src/test-recorder.cjs

@@ -24,7 +24,8 @@ function install(){
     for(let at=0;at<line.length;)at+=original.writeSync(fd,line,at,line.length-at);}catch{}};
   const failed=reason=>emit(['U',reason]);
   emit(['H',{pid:process.pid,ppid:process.ppid,threadId}]);
-  const sep=path.sep,root=config.root,installed=path.join(root,'node_modules'),
+  // Every node_modules observed as installed: the root's and each workspace package's.
+  const sep=path.sep,root=config.root,installed=Array.isArray(config.installed)?config.installed:[path.join(root,'node_modules')],
     tmp=config.tmp;
   const within=(file,dir)=>file===dir||file.startsWith(dir+sep);
   const digest=value=>createHash('sha256').update(value).digest('hex');
@@ -85,7 +86,7 @@ function install(){
       if(full===undefined)return;
       if(full===null){if(!['produce','touch','mkdir'].includes(role))failed(`${role} of an unsupported path argument`);return;}
       // Installed files are observed by identity.
-      if(within(full,installed))return;
+      if(installed.some(dir=>within(full,dir)))return;
       if(role==='produce'){if(!error)produced.add(full);if(!error&&within(full,root))once(['P',rel(full)]);return;}
       // A directory the run created held nothing before it, so everything in
       // it is the run's output, whichever process reads it.

package/src/typescript-input-facts.mjs

@@ -9,7 +9,7 @@ import {timing} from './decision-profile.mjs';
 const require=createRequire(import.meta.url),hash=value=>createHash('sha256').update(value).digest('hex');
 const digestFile=file=>hash(fs.readFileSync(file));
 const fail=code=>{throw Object.assign(Error(code),{code});};
-export function typeScriptInputFacts(root,tsRoot,tsc){
+export function typeScriptInputFacts(root,tsRoot,tsc,config='tsconfig.json'){
   const configReads=new Set(),visited=new Set(),referenced=[];
   let buildInfo=null;
   let ts;try{ts=require(tsRoot);}catch{}
@@ -37,15 +37,15 @@ export function typeScriptInputFacts(root,tsRoot,tsc){
         parseConfig(reference.path.endsWith('.json')?reference.path:
           path.join(reference.path,'tsconfig.json'));
     };
-    parseConfig(path.join(root,'tsconfig.json'),true);
+    parseConfig(path.join(root,config),true);
   }else{
     // TypeScript 7's native compiler does not expose the previous config API.
     // Its CLI reports the effective config; restrict this path to one direct
     // config rather than guessing about extends/reference provenance.
-    const config=path.join(root,'tsconfig.json'),raw=fs.readFileSync(config,'utf8');
+    const file=path.join(root,config),raw=fs.readFileSync(file,'utf8');
     if(/"(?:extends|references|plugins|incremental|composite)"\s*:/.test(raw))
       fail('typescript-config-graph-unsupported');
-    const shown=spawnSync(process.execPath,[tsc,'--showConfig'],{cwd:root,
+    const shown=spawnSync(process.execPath,[tsc,'--showConfig','-p',config],{cwd:root,
       env:process.env,encoding:'utf8',timeout:probeTimeLeft(4000),maxBuffer:16*1024*1024,
       stdio:['ignore','pipe','pipe']});
     if(shown.error||shown.signal||shown.status!==0)fail('typescript-config-unavailable');
@@ -53,13 +53,13 @@ export function typeScriptInputFacts(root,tsRoot,tsc){
     if(effective.compilerOptions?.plugins?.length||
       effective.compilerOptions?.incremental||effective.compilerOptions?.composite)
       fail('typescript-config-graph-unsupported');
-    configReads.add(config);
+    configReads.add(file);
   }
   for(const file of configReads)if(!within(realObservedPath(file),root))
     fail('typescript-config-outside-repository');
   const listingStarted=performance.now();
-  const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(tsRoot,root):null;
-  const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'--noEmit','--listFilesOnly'],
+  const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(tsRoot,root,config):null;
+  const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'--noEmit','--listFilesOnly','-p',config],
     {cwd:root,env:process.env,encoding:'utf8',timeout:probeTimeLeft(process.platform==='win32'?10000:4000),
       maxBuffer:16*1024*1024,
       stdio:['ignore','pipe','pipe']});

package/src/typescript-invocation.mjs

@@ -0,0 +1,92 @@
+// The package-script forms of a standalone TypeScript check: one `tsc` run, or
+// several joined by `&&`, each with these arguments in any order:
+// --noEmit, -p/--project PATH, --skipLibCheck, --pretty [true|false].
+// Anything else (tsc -b, --watch, other options, other commands) is not one.
+import fs from 'node:fs';
+import path from 'node:path';
+
+// No shell metacharacters; a leading @ would read as a REDUE token.
+const word=/^[A-Za-z0-9_./+-][A-Za-z0-9_./@+-]*$/;
+// More runs than this is not a script REDUE splits into checks.
+const maxRuns=16;
+function parseRun(words){
+  if(words[0]!=='tsc'||!words.every(value=>word.test(value)))return null;
+  let project=null,noEmit=false;
+  for(let i=1;i<words.length;i++){
+    const value=words[i];
+    if(value==='-p'||value==='--project'){
+      if(project!==null||!words[i+1]||words[i+1].startsWith('-'))return null;
+      project=words[++i];
+    }else if(value==='--noEmit')noEmit=true;
+    else if(value==='--pretty'){if(['true','false'].includes(words[i+1]))i++;}
+    else if(value!=='--skipLibCheck')return null;
+  }
+  return {args:words.slice(1),project,noEmit};
+}
+// The runs of a script, as [{args, project, noEmit}], or null.
+export function tscRuns(text){
+  if(typeof text!=='string'||!text.trim())return null;
+  const parts=text.trim().split(/[ \t]+&&[ \t]+/);
+  if(parts.length>maxRuns)return null;
+  const runs=parts.map(part=>parseRun(part.split(/[ \t]+/)));
+  return runs.every(Boolean)?runs:null;
+}
+// The run a check makes: its `script` (null for a check init proposed without
+// one), the tsc arguments after the compiler in its command, and `count`, the
+// number of configured checks for that script (more than one for a chain).
+// Returns {run} with the parsed run, or {issue} when the arguments are outside
+// the forms, or the script no longer has exactly `count` runs, one of them
+// with exactly these arguments.
+export function tscRun(scripts,{script=null,args,count=1}){
+  if(!Array.isArray(args)||!args.every(value=>typeof value==='string'))return {issue:'TypeScript arguments are invalid'};
+  const own=parseRun(['tsc',...args]);
+  if(!own)return {issue:'TypeScript arguments are outside the supported forms'};
+  if(script===null)return {run:own};
+  if(typeof scripts?.[script]!=='string')return {issue:'typecheck script was removed'};
+  if(scripts['pre'+script]||scripts['post'+script])return {issue:'typecheck script has pre or post scripts'};
+  const runs=tscRuns(scripts[script]);
+  if(runs?.length!==count||!runs.some(run=>JSON.stringify(run.args)===JSON.stringify(args)))
+    return {issue:'typecheck script changed'};
+  return {run:own};
+}
+// The config file a run names, relative to the directory `dir` it runs in
+// (posix): tsconfig.json without -p, a directory's tsconfig.json, or null
+// when it leaves that directory or the arguments are not a run.
+export function runConfig(dir,args){
+  const run=parseRun(['tsc',...args]);
+  if(!run)return null;
+  let file=path.posix.normalize((run.project??'tsconfig.json').split(path.sep).join('/'));
+  let directory=false;try{directory=fs.statSync(path.join(dir,file)).isDirectory();}catch{}
+  if(!file.endsWith('.json')||directory)file=path.posix.join(file,'tsconfig.json');
+  if(path.posix.isAbsolute(file)||file==='..'||file.startsWith('../'))return null;
+  return file;
+}
+// The check names for a script's runs: the kind's name for one run, and
+// NAME.1 ... NAME.n for a chain (not #: the hook refuses it and zsh may glob it).
+export const partName=(name,index,count)=>count===1?name:`${name}.${index}`;
+// Probe arguments for a run, and back: SCRIPT (or -), COUNT, then the tsc
+// arguments.
+export const runArgv=({script=null,args,count=1})=>[script??'-',String(count),...args];
+export function runFromArgv(values){
+  const [script,count,...args]=values;
+  if(typeof script!=='string'||!script||!/^[1-9]\d?$/.test(count||''))throw Object.assign(Error('probe-arguments'),{code:'probe-arguments'});
+  return {script:script==='-'?null:script,args,count:Number(count)};
+}
+// The run a configured check makes: its script, the arguments after the
+// compiler in its command, and how many checks the config has for the script
+// (`runCount`, set when the config is loaded).
+export const checkRun=check=>({script:check.script??null,
+  args:Array.isArray(check.command)?check.command.slice(2):[],count:check.runCount??1});
+// A script's checks in the order of its runs: one check per run with the same
+// arguments ({name, args} each), as names; null when they do not correspond.
+export function scriptRunChecks(text,checks){
+  const runs=tscRuns(text);
+  if(!runs||runs.length!==checks.length)return null;
+  const left=[...checks],names=[];
+  for(const run of runs){
+    const at=left.findIndex(check=>JSON.stringify(check.args)===JSON.stringify(run.args));
+    if(at<0)return null;
+    names.push(left.splice(at,1)[0].name);
+  }
+  return names;
+}

package/src/typescript-list.mjs

@@ -63,7 +63,7 @@ export function queriesMatch(queries) {
   return queries.every(([kind,file,answer,options])=>
     JSON.stringify(queryAnswer(kind,file,options))===JSON.stringify(answer));
 }
-export function compilerFiles(tsRoot,cwd) {
+export function compilerFiles(tsRoot,cwd,config='tsconfig.json') {
   const require=createRequire(import.meta.url),ts=require(tsRoot);
   if(typeof ts.createProgram!=='function'||typeof ts.createCompilerHost!=='function')return null;
   const queries=new Map();
@@ -114,7 +114,7 @@ export function compilerFiles(tsRoot,cwd) {
   };
   const realpath=file=>{remember('realpath',file);return ts.sys.realpath(file);};
   // `extends` of a package config resolves through realpath too.
-  const parsed=ts.getParsedCommandLineOfConfigFile(path.join(cwd,'tsconfig.json'),{},
+  const parsed=ts.getParsedCommandLineOfConfigFile(path.join(cwd,config),{},
     {...ts.sys,readFile,fileExists,directoryExists,getDirectories,readDirectory,realpath,
       onUnRecoverableConfigFileDiagnostic(){}});
   if(!parsed||parsed.errors?.length)throw Error('TypeScript configuration unavailable');

package/src/typescript-qualification.mjs

@@ -2,6 +2,7 @@ import {directProject,directQualification,directEnvironment} from './direct-type
 import fs from 'node:fs';
 import path from 'node:path';
 import {realObservedPath} from './path-identity.mjs';
+import {checkRun,runArgv} from './typescript-invocation.mjs';
 
 // This is a machine-enforced contract, not a claim inferred from a script name.
 // Runtime validation checks effective compiler membership, configuration and
@@ -11,10 +12,9 @@ export function qualifyTypeScript(root,selected,discovered={}) {
   if(selected.qualification===directQualification){
     const issues=[];
     try{
-      const compiler=directProject(root,selected.script);
-      if(selected.command?.length!==3||selected.command[0]!==process.execPath||
-        selected.command[1]!==compiler.entry||selected.command[2]!=='--noEmit'||
-        selected.cwd&&selected.cwd!=='.')issues.push('direct compiler invocation changed');
+      const compiler=directProject(root,checkRun(selected));
+      if(selected.command?.[0]!==process.execPath||
+        selected.command[1]!==compiler.entry||selected.cwd&&selected.cwd!=='.')issues.push('direct compiler invocation changed');
     }catch(e){issues.push(e.code||'direct compiler prerequisites unavailable');}
     if(!selected.inputs?.includes('**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json,jsonc}')||
       !selected.inputs?.includes('package.json')||!selected.inputs?.includes('tsconfig.json')||
@@ -24,23 +24,22 @@ export function qualifyTypeScript(root,selected,discovered={}) {
       !directEnvironment.prefixes.every(key=>selected.environment?.prefixes?.includes(key)))
       issues.push('direct compiler execution context incomplete');
     if(selected.probes?.length!==1||!selected.probes?.some(argv=>path.basename(argv[1]||'')==='direct-typescript-probe.mjs'&&
-      argv[0]===process.execPath&&argv[2]===root&&argv[3]===selected.script))issues.push('direct compiler probe missing');
+      argv[0]===process.execPath&&argv[2]===root&&
+      JSON.stringify(argv.slice(3))===JSON.stringify(runArgv(checkRun(selected)))))issues.push('direct compiler probe missing');
     return {qualified:issues.length===0,issues};
   }
   if(selected.qualification==='pnpm-tsc-v1'){
     const issues=[];
     const workspace=selected.workspace||'.';
-    const script=selected.script||selected.command?.at(-1);
     try{
       if(discovered.issue)throw Error(discovered.issue);
       const contract=discovered.workspace;
       if(!contract)throw Error('pnpm TypeScript input discovery unavailable');
       issues.push(...contract.limitations);
-      const declared=contract.workspace.pkg.scripts[script].trim().split(/\s+/).slice(1);
+      // The arguments are checked against the script by the contract itself.
       if(path.resolve(root,selected.cwd||'.')!==path.join(root,contract.workspace.dir)||
         selected.command?.[0]!==process.execPath||
-        selected.command?.[1]!==contract.tsc||
-        JSON.stringify(selected.command.slice(2))!==JSON.stringify(declared))
+        selected.command?.[1]!==contract.tsc)
         issues.push('standalone TypeScript invocation changed');
     }catch(e){issues.push(e.message);}
     if(!selected.probes?.some(argv=>path.basename(argv[1]||'')==='pnpm-typecheck-probe.mjs'))

package/src/workspace-manifests.mjs

@@ -0,0 +1,22 @@
+// Workspace package manifests: package.json files Git tracks or would add,
+// in directories that match the workspace patterns, outside node_modules.
+import fs from 'node:fs';
+import path from 'node:path';
+import {spawnSync} from 'node:child_process';
+import {patternMatcher} from './glob.mjs';
+
+export function workspaceManifests(root,patterns) {
+  const listing=spawnSync('git',['ls-files','--cached','--others','--exclude-standard',
+    '-z','--',':(glob)**/package.json'],{cwd:root,encoding:'utf8',timeout:5000,
+    maxBuffer:32*1024*1024,stdio:['ignore','pipe','ignore'],
+    env:{...process.env,GIT_OPTIONAL_LOCKS:'0'}});
+  if(listing.status!==0||listing.error)throw Error('workspace package manifests cannot be inspected');
+  // `!pattern` entries exclude, as in pnpm-workspace.yaml.
+  const included=patternMatcher(patterns);
+  const matched=listing.stdout.split('\0').filter(Boolean).filter(file=>{
+    const dir=path.posix.dirname(file);
+    return dir!=='.'&&!dir.split('/').includes('node_modules')&&included(dir);
+  }).sort();
+  if(matched.length>50)throw Error('more than 50 workspace packages found; select checks explicitly');
+  return matched.map(file=>({file,pkg:JSON.parse(fs.readFileSync(path.join(root,file),'utf8'))}));
+}