@redue/cli 0.1.0-alpha.17 → 0.1.0-alpha.18

package/src/daemon.mjs

@@ -20,7 +20,9 @@ import {inputKey,planGuard,toolchainKey} from './decision-validation.mjs';
 import {queriesHold,runFactReason as runFactChanged} from './typescript-list.mjs';
 import {nextProbeHint,probeDeadline,probeFloorMs} from './probe-deadline.mjs';
 import {statusSummary} from './cached-state.mjs';
-import {directProject,directProbeValue,reviewedTypeScriptVersions} from './direct-typescript.mjs';
+import {directProject,directProbeValue} from './direct-typescript.mjs';
+import {npmCacheDir} from './npm-integrity.mjs';
+import {runFromArgv} from './typescript-invocation.mjs';
 import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
 import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
 
@@ -130,7 +132,7 @@ function continuityBarrier() {
 // The basis a full direct probe is checked against: plan guard, observation
 // continuity, and the compiler tree and Node identity taken before the probe.
 function certificateBasis(row) {
-  const argv=row.plan.probes[0],compiler=directProject(argv[2],argv[3],{verify:false});
+  const argv=row.plan.probes[0],compiler=directProject(argv[2],runFromArgv(argv.slice(3)),{verify:false});
   return {guard:planGuard(index.bundle),gaps:metrics.gaps,
     compiler:JSON.stringify([compiler.tsRoot,compiler.entry,compiler.digest]),
     toolchain:toolchainKey(compiler.tsRoot,argv[0])};
@@ -238,8 +240,18 @@ function probe(row,allowReuse=false,{launch=true}={}) {
         .includes(row.plan.qualification)?
         /VSTATE_REASON:([a-z-]+)/.exec(out.stderr?.toString()||'')?.[1]:null;
       const explanations={
-        'direct-typescript-implementation-unreviewed':'installed TypeScript bytes or membership differ from the reviewed compiler',
-        'direct-typescript-version-unsupported':`direct compiler recipe supports reviewed TypeScript ${reviewedTypeScriptVersions.join(', ')} only`,
+        'direct-typescript-implementation-unreviewed':'installed TypeScript files differ from the reviewed compiler or from the tarball package-lock.json names',
+        'direct-typescript-version-unsupported':'direct compiler recipe supports TypeScript 5.x and 6.0',
+        'direct-typescript-lockfile-source-unsupported':'package-lock.json installs TypeScript from somewhere other than the registry\'s typescript package (an alias, a file or a git source)',
+        'npm-shrinkwrap-unsupported':'npm-shrinkwrap.json is not read; the reviewed TypeScript releases still qualify',
+        'direct-typescript-lockfile-integrity-missing':'package-lock.json records no integrity for the installed TypeScript',
+        'direct-typescript-lockfile-version-differs':'installed TypeScript version differs from package-lock.json; run npm ci',
+        'npm-lockfile-unreadable':'package-lock.json cannot be read',
+        'npm-lockfile-integrity-unsupported':'package-lock.json records TypeScript integrity with neither sha512 nor sha1',
+        'npm-tarball-uncached':`the TypeScript tarball package-lock.json names is not in npm's cache (${npmCacheDir(root)}); run npm ci or npm cache add`,
+        'npm-tarball-corrupt':"npm's cached TypeScript tarball does not match its integrity",
+        'npm-tarball-invalid':"npm's cached TypeScript tarball cannot be read",
+        'npm-tarball-link-unsupported':"npm's cached TypeScript tarball holds links",
         'direct-execution-environment-unsupported':'direct compiler rejects development helpers, Node cache/preloads, and unreviewed runtime overrides',
         'direct-node-version-unsupported':'direct compiler recipe supports Node 22 and 24',
         'npm-launcher-unobserved-inputs':'npm launcher uses unobserved notifier inputs; execution is recording-only',
@@ -492,7 +504,7 @@ function adopt(name,row,token) {
     return done('inputs or certificate changed during the run');
   const cache=pending.cache,argv=row.plan.probes[0];
   let result;
-  try{result=recordedCertificate(text,cache,directProject(argv[2],argv[3],{verify:false}),buildInfoPath(row.plan));}
+  try{result=recordedCertificate(text,cache,directProject(argv[2],runFromArgv(argv.slice(3)),{verify:false}),buildInfoPath(row.plan));}
   catch{return done('recording unreadable');}
   if(result.issue)return done(result.issue);
   const identities=new Map(cache.identities);
@@ -1217,7 +1229,9 @@ const server=net.createServer(client=>{
     event('control_reply_unavailable',{classification:handled?'closed_without_reply':
       'closed_before_request',request_bytes:text.length});});
   client.on('data',d=>{
-    if(handled)return;text+=d;if(text.length>4096){event('control_request_rejected',
+    // A sync request carries each check's context digests, about 1.5 KB per
+    // check; 1 MiB leaves room for hundreds of checks.
+    if(handled)return;text+=d;if(text.length>1024*1024){event('control_request_rejected',
       {classification:'request_too_large',request_bytes:text.length});client.destroy();return;}
     if(!text.includes('\n'))return;handled=true;
     try{const message=JSON.parse(text);

package/src/declared-plan.mjs

@@ -9,6 +9,7 @@ import {directBuildInfo} from './direct-typescript.mjs';
 import {qualifyTests,testWorkspacePatterns,testsQualification} from './test-direct.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
+import {checkRun} from './typescript-invocation.mjs';
 import {observedRelative,withinPath,realObservedPath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
 
@@ -64,8 +65,7 @@ export function discoverDeclared(config) {
       catch(e){workspaceIssue=e.message;}
     }
     if(selected.qualification==='pnpm-tsc-v1'){
-      try{workspace=pnpmTypecheckInputs(root,selected.workspace||'.',
-        selected.script||selected.command.at(-1));}
+      try{workspace=pnpmTypecheckInputs(root,selected.workspace||'.',checkRun(selected));}
       catch(e){workspaceIssue=e.message;}
     }
     timing('plan.workspace_inputs',workspaceStarted,{available:workspace?1:0});
@@ -75,7 +75,7 @@ export function discoverDeclared(config) {
     // until then the run reports the unexpected write and is not reusable.
     let buildInfo=null;
     if(selected.qualification==='npm-typescript-direct-v1')
-      try{buildInfo=directBuildInfo(root,selected.script);}catch{}
+      try{buildInfo=directBuildInfo(root,checkRun(selected));}catch{}
     const excluded=buildInfo?['!'+buildInfo]:[];
     const installedStarted=performance.now();
     const installed=resolveDeclaredInstalled(root,

package/src/direct-typescript-probe.mjs

@@ -4,18 +4,20 @@ import {typeScriptInputFacts} from './typescript-input-facts.mjs';
 import {contextOnly,probeResult} from './probe-result.mjs';
 import {realObservedPath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
+import {runArgv,runFromArgv} from './typescript-invocation.mjs';
 try{
-  const [rootArg,script]=process.argv.slice(2),root=realObservedPath(rootArg);
+  const [rootArg,...rest]=process.argv.slice(2).filter(value=>!value.startsWith('--redue-')),root=realObservedPath(rootArg);
+  const run=runFromArgv(rest),script=runArgv(run).join(' ');
   // Verify all installed implementation bytes before loading compiler API/code,
   // including the optimized context-only path. A version label is insufficient.
   const implementationStarted=performance.now();
-  const compiler=directProject(root,script);
+  const compiler=directProject(root,run);
   timing('direct_probe.implementation',implementationStarted,{version:compiler.version});
   const context={interpretation:directInterpretation,compiler:compiler.digest,
     entry:compiler.entry,node:[realObservedPath(process.execPath),process.version]};
   const contextHash=directContextHash(compiler,context.node);
   if(!contextOnly(contextHash)){
-    const {queries,configs,files,buildInfo}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry);
+    const {queries,configs,files,buildInfo}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry,compiler.config);
     const layout={root,script,configs,files,context,...(buildInfo?{buildInfo}:{})};
     probeResult(directProbeOutput(layout),contextHash,queries,layout);
   }

package/src/direct-typescript.mjs

@@ -3,7 +3,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {createRequire} from 'node:module';
-import {realObservedPath,withinPath} from './path-identity.mjs';
+import {racyUntil,realObservedPath,withinPath} from './path-identity.mjs';
+import {cachedTarball,lockedPackage,matchTarball,npmCacheDir,registryPackage,tarballFiles} from './npm-integrity.mjs';
+import {runConfig,tscRun} from './typescript-invocation.mjs';
 export const directInterpretation='npm-direct-typescript@1';
 export const directQualification='npm-typescript-direct-v1';
 const reviewed={
@@ -60,8 +62,9 @@ export function directCompiler(root,{verify=true}={}){
   const tsRoot=path.dirname(realObservedPath(manifest));
   if(!withinPath(tsRoot,root)||tsRoot!==realObservedPath(path.join(root,'node_modules/typescript')))
     fail('direct-typescript-layout-unsupported');
-  const version=JSON.parse(fs.readFileSync(manifest)).version,spec=reviewed[version];
-  if(!spec)fail('direct-typescript-version-unsupported');
+  const version=JSON.parse(fs.readFileSync(manifest)).version;
+  if(!reviewed[version])return lockedCompiler(root,tsRoot,version,verify);
+  const spec=reviewed[version];
   if(verify){
     const files=[];
     const walk=(dir,relative='')=>{
@@ -78,6 +81,42 @@ export function directCompiler(root,{verify=true}={}){
   }
   return {tsRoot,version,entry:path.join(tsRoot,spec.entry),digest:spec.digest};
 }
+// A TypeScript 5.x or 6.0 the lockfile records: the installed package must be
+// the registry's `typescript` at that version, holding exactly the files of
+// the tarball npm cached under the lockfile's integrity. Its identity is that
+// integrity. The entry is lib/_tsc.js where the package has one (5.7 and
+// later), as for the reviewed versions, else lib/tsc.js. A verified tree is
+// remembered per process while its files keep their identity.
+const verifiedTrees=new Map();
+function treeIdentity(tsRoot){
+  const parts=[],now=Date.now();
+  const walk=folder=>{for(const entry of fs.readdirSync(folder,{withFileTypes:true})){
+    const full=path.join(folder,entry.name),st=fs.lstatSync(full,{bigint:true});
+    if(racyUntil(st)>now)return null;
+    parts.push([full,st.dev,st.ino,st.size,st.mtimeNs,st.ctimeNs].join(':'));
+    if(entry.isDirectory()&&walk(full)===null)return null;
+  }};
+  try{if(walk(tsRoot)===null)return null;}catch{return null;}
+  return hash(parts.sort().join('\n'));
+}
+function lockedCompiler(root,tsRoot,version,verify){
+  if(!/^(?:5\.\d+|6\.0)\.\d+$/.test(version))fail('direct-typescript-version-unsupported');
+  let locked;try{locked=lockedPackage(root,'typescript');}
+  catch(e){fail(['npm-lockfile-unreadable','npm-shrinkwrap-unsupported'].includes(e.code)?e.code:'direct-typescript-lockfile-integrity-missing');}
+  if(locked.version!==version)fail('direct-typescript-lockfile-version-differs');
+  if(!registryPackage(locked,'typescript',version)||
+    JSON.parse(fs.readFileSync(path.join(tsRoot,'package.json'),'utf8')).name!=='typescript')
+    fail('direct-typescript-lockfile-source-unsupported');
+  if(verify){
+    const tree=treeIdentity(tsRoot);
+    if(!tree||verifiedTrees.get(locked.integrity)!==tree){
+      matchTarball(tsRoot,tarballFiles(cachedTarball(npmCacheDir(root),locked.integrity)));
+      if(tree)verifiedTrees.set(locked.integrity,tree);
+    }
+  }
+  const entry=fs.existsSync(path.join(tsRoot,'lib','_tsc.js'))?'lib/_tsc.js':'lib/tsc.js';
+  return {tsRoot,version,entry:path.join(tsRoot,entry),digest:hash('npm-integrity\0'+locked.integrity)};
+}
 // The direct probe's output: root, script, configuration and program files with
 // their byte digests, and the execution context. A recorded run rebuilds it from
 // the same layout (direct-run-certificate.mjs).
@@ -101,13 +140,16 @@ export function buildInfoFor(ts,options,root) {
   if(!relative.endsWith('.tsbuildinfo')||/[*?[\]{}()!+@,]/.test(relative))return {issue:'typescript-buildinfo-name-unsupported'};
   return {file:relative};
 }
+// The config a run's arguments name, relative to the root, or null.
+export const directConfig=(root,args)=>runConfig(root,args);
 // The plan's build-info file, or null. The compiler is loaded only when the
-// root config sets incremental or extends another config.
-export function directBuildInfo(root,script) {
-  const config=path.join(root,'tsconfig.json');
+// run's config sets incremental or extends another config.
+export function directBuildInfo(root,run) {
+  const name=directConfig(root,run.args);if(!name)return null;
+  const config=path.join(root,name);
   let raw;try{raw=fs.readFileSync(config,'utf8');}catch{return null;}
   if(!/"(?:incremental|extends)"\s*:/.test(raw))return null;
-  const compiler=directProject(root,script,{verify:false}),ts=createRequire(import.meta.url)(compiler.tsRoot);
+  const compiler=directProject(root,run,{verify:false}),ts=createRequire(import.meta.url)(compiler.tsRoot);
   const parsed=ts.getParsedCommandLineOfConfigFile(config,{},{...ts.sys,onUnRecoverableConfigFileDiagnostic(){}});
   return parsed?.options?.composite?null:buildInfoFor(ts,parsed?.options,root).file??null;
 }
@@ -120,16 +162,21 @@ export function directContextHash(compiler,node){
   return hash(JSON.stringify({interpretation:directInterpretation,compiler:compiler.digest,
     entry:compiler.entry,node}));
 }
-export function directProject(root,script,{verify=true}={}){
+// The compiler for one check run {script, part, args}: script null for a
+// check init proposed without one. The run must pass --noEmit and name a
+// config inside the root.
+export function directProject(root,run,{verify=true}={}){
   const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json')));
   if(pkg.workspaces||pkg.packageManager&&!/^npm@/.test(pkg.packageManager)||
     !['package-lock.json','npm-shrinkwrap.json'].some(file=>fs.existsSync(path.join(root,file)))||
     ['yarn.lock','pnpm-lock.yaml','bun.lock','bun.lockb'].some(file=>fs.existsSync(path.join(root,file))))
     fail('direct-npm-project-unsupported');
-  if(pkg.scripts?.[script]?.trim()!=='tsc --noEmit'||pkg.scripts?.['pre'+script]||pkg.scripts?.['post'+script])
-    fail('typecheck-script-changed');
+  const own=tscRun(pkg.scripts,run).run;
+  if(!own?.noEmit)fail('typecheck-script-changed');
+  const config=directConfig(root,run.args);
+  if(!config||!fs.existsSync(path.join(root,config)))fail('typescript-config-unavailable');
   const issue=directEnvironmentIssue();if(issue)fail(issue);
-  return directCompiler(root,{verify});
+  return {...directCompiler(root,{verify}),config};
 }
 // Provenance only: retain a digest, never proxy URLs/credentials or a raw dump.
 // No npm process runs in this recipe; these keys are not compiler applicability.

package/src/glob.mjs

@@ -7,3 +7,11 @@ export default {
   matcher(pattern,options){return picomatch(pattern,options);},
   isMatch(file,patterns,options){return picomatch(patterns,options)(file);}
 };
+// A matcher for a pattern list with `!` exclusions: a path matches when a
+// positive pattern does and no excluded one does. A plain list match would
+// take any `!` pattern as matching everything else.
+export function patternMatcher(patterns){
+  const positive=patterns.filter(p=>!p.startsWith('!')).map(p=>picomatch(p,{dot:true}));
+  const negative=patterns.filter(p=>p.startsWith('!')).map(p=>picomatch(p.slice(1),{dot:true}));
+  return file=>positive.some(fn=>fn(file))&&!negative.some(fn=>fn(file));
+}

package/src/node-onboarding.mjs

@@ -8,11 +8,12 @@ import {pnpmInstallInfo,pnpmProjectInfo,pnpmTypecheckInputs} from './pnpm-inputs
 import {realObservedPath} from './path-identity.mjs';
 import {findExecutable} from './executable-lookup.mjs';
 import {workspaceManifests} from './workspace-manifests.mjs';
+import {partName,tscRuns} from './typescript-invocation.mjs';
 
 const exists=file=>{try{fs.accessSync(file);return true;}catch{return false;}};
 const readJson=file=>JSON.parse(fs.readFileSync(file,'utf8'));
 const scriptNames={
-  typecheck:['typecheck','type-check','check:types','types:check'],
+  typecheck:['typecheck','type-check','check:types','types:check','check-types'],
   test:['test','test:unit','test:check'],
   lint:['lint','lint:check'],
   build:['build'],
@@ -82,6 +83,28 @@ function manager(root,pkg) {
   return {name,version,layout:'node-modules/classic',issue:null,lockfiles:locks};
 }
 const exactTypeScript=script=>script.trim()==='tsc --noEmit';
+// A script of tsc runs that each pass --noEmit (typescript-invocation.mjs).
+const noEmitRuns=script=>Boolean(tscRuns(script)?.every(run=>run.noEmit));
+// Ready checks for a typecheck, one per tsc run: the script's runs (a chain
+// gives NAME.1 ... NAME.n), or with no script one proposed `tsc --noEmit`.
+// `make(run)` returns a run's command, cwd and inputs, or throws why its
+// contract does not hold.
+function tscChecks(name,script,scripts,make){
+  const runs=script===null?[{args:['--noEmit']}]:tscRuns(scripts[script]);
+  if(!runs)throw Error('the script is not tsc runs in a supported form');
+  return runs.map(({args},i)=>({name:partName(name,i+1,runs.length),
+    ...(script===null?{}:{script}),...make({script,args,count:runs.length})}));
+}
+// A proposed `tsc --noEmit` only where nothing typechecks already: a script
+// that runs any TypeScript checker in another form (tsc -b, vue-tsc,
+// svelte-check, tsgo, also quoted or wrapped by concurrently or run-p) is the
+// project's own typecheck, which plain tsc would not match.
+const typeChecker=/(?:^|[^\w-])(?:tsc|vue-tsc|tsgo|svelte-check|tsc-watch)(?=$|[^\w-])|\bastro check\b|\bnuxi typecheck\b/;
+const typechecks=scripts=>Object.values(scripts||{}).some(text=>typeof text==='string'&&typeChecker.test(text));
+const proposable=(dir,scripts)=>exists(path.join(dir,'tsconfig.json'))&&!typechecks(scripts);
+// The inputs a TypeScript contract adds to its check's config: no exclusions,
+// which would outlive the tsconfig they came from; the plan adds the current ones.
+const contractInputs=contract=>[...contract.configs,...contract.sourcePatterns.filter(p=>!p.startsWith('!'))];
 function sourceLinkIssue(root) {
   const stack=likelyDirs.filter(name=>exists(path.join(root,name)));
   let inspected=0;
@@ -139,14 +162,26 @@ function selectScript(kind,names,scripts) {
   const candidates=Object.keys(scripts).filter(name=>{
     const value=scripts[name]?.trim();
     if(typeof value!=='string')return false;
-    if(kind==='typecheck')return exactTypeScript(value);
+    if(kind==='typecheck')return noEmitRuns(value);
     if(kind==='test')return /^(?:vitest|jest)(?:\s|$)/.test(value);
     if(kind==='lint')return /^eslint(?:\s|$)/.test(value);
     return /^vite\s+build(?:\s|$)/.test(value);
   });
+  // A lone plain `tsc --noEmit` wins over other tsc shapes beside it (a
+  // project's `typescript` next to `typescript:tests:raw`).
+  const exact=kind==='typecheck'?candidates.filter(name=>exactTypeScript(scripts[name])):[];
+  if(exact.length===1)return {script:exact[0]};
   return candidates.length===1?{script:candidates[0]}:
     candidates.length>1?{ambiguous:candidates}:{};
 }
+// A pnpm workspace package's TypeScript run, as its check's command, cwd and inputs.
+function pnpmCheck(root,name,dir,manifest,run){
+  const contract=pnpmTypecheckInputs(root,name,run);
+  if(contract.limitations.length)throw Error(contract.limitations.join('; '));
+  return {cwd:dir,command:['@node',`@typescript-bin:${dir}`,...run.args],
+    inputs:[...new Set(['package.json','pnpm-lock.yaml','pnpm-workspace.yaml',manifest,
+      ...contractInputs(contract)])]};
+}
 // Workspace packages as init finds them, with their scripts; [] without workspaces.
 export function workspacePackages(root){
   root=realObservedPath(root);
@@ -178,19 +213,27 @@ export function discoverNodeProject(root,{recipe=null}={}) {
   for(const [kind,names] of Object.entries(scriptNames)) {
     const selected=selectScript(kind,names,scripts),script=selected.script;
     if(selected.ambiguous)ambiguous.push({kind,scripts:selected.ambiguous});
-    if(!script)continue;
+    // With no typecheck script, a root tsconfig.json gets a proposed
+    // `tsc --noEmit` check; package.json stays unchanged. It is kept only
+    // when a contract makes it ready.
+    const proposed=!script&&!selected.ambiguous&&kind==='typecheck'&&!observationIssue&&
+      proposable(root,scripts);
+    if(!script&&!proposed)continue;
     let classification=observationIssue?{level:'unsupported',reason:observationIssue}:
-      classify(kind,script,scripts[script],pkg,pm,root);
+      script?classify(kind,script,scripts[script],pkg,pm,root):{level:'recording',reason:'no typecheck script'};
+    let parts=null;
     if(workspaces&&classification.qualification==='typescript-noemit-v1')classification={level:'recording',
       reason:'workspace task and installed-input closure need explicit qualification'};
     const check={name:kind,script,kind,inputs:sourceInputs(root,kind,pm.lockfiles||[])};
     if(recipe==='typescript-direct'&&kind==='typecheck'){
       try{
         if(pm.name!=='npm'||workspaces||observationIssue||pm.issue)throw Error('direct recipe requires a supported single-package npm checkout');
-        const compiler=directProject(root,script);
-        check.command=['@node','@typescript-compiler:.','--noEmit'];check.cwd='.';
+        let version;
+        parts=tscChecks('typecheck',script??null,scripts,run=>{
+          version=directProject(root,run).version;
+          return {command:['@node','@typescript-compiler:.',...run.args],cwd:'.'};});
         classification={level:'ready',qualification:directQualification,
-          reason:`explicit local TypeScript ${compiler.version} compilation; npm launcher/lifecycle scripts are not executed; package.json stays unchanged`};
+          reason:`explicit local TypeScript ${version} compilation; npm launcher/lifecycle scripts are not executed; package.json stays unchanged`};
       }catch(e){classification={level:'recording',reason:`Direct recipe unavailable (${e.code||e.message}); original npm script retained, without bypassing required behavior`};}
     }
     if(recipe==='tests-direct'&&kind==='test'){
@@ -207,20 +250,24 @@ export function discoverNodeProject(root,{recipe=null}={}) {
           reason:`explicit local ${project.runner} ${project.version} run of script ${JSON.stringify(chosen.script)}; the whole checkout is its input; npm and lifecycle scripts are not executed`};
       }catch(e){classification={level:'recording',reason:`Test recipe unavailable (${e.code||e.message}); original npm script retained`};}
     }
-    if(pm.name==='pnpm'&&kind==='typecheck'&&!workspaces&&!pm.issue&&
-      /^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(scripts[script].trim())){
-      try{const contract=pnpmTypecheckInputs(root,'.',script);
-        if(contract.limitations.length)throw Error(contract.limitations.join('; '));
-        check.command=['@node','@typescript-bin:.',
-          ...scripts[script].trim().split(/\s+/).slice(1)];
-        check.cwd='.';
-        check.inputs=['package.json','pnpm-lock.yaml',
-          ...(exists(path.join(root,'pnpm-workspace.yaml'))?['pnpm-workspace.yaml']:[]),
-          'tsconfig.json','src/**'];
+    if(pm.name==='pnpm'&&kind==='typecheck'&&!workspaces&&!pm.issue&&(script===undefined||tscRuns(scripts[script]))){
+      try{
+        parts=tscChecks('typecheck',script??null,scripts,run=>{
+          const contract=pnpmTypecheckInputs(root,'.',run);
+          if(contract.limitations.length)throw Error(contract.limitations.join('; '));
+          return {command:['@node','@typescript-bin:.',...run.args],cwd:'.',
+            inputs:[...new Set(['package.json','pnpm-lock.yaml',
+              ...(exists(path.join(root,'pnpm-workspace.yaml'))?['pnpm-workspace.yaml']:[]),
+              ...contractInputs(contract)])]};});
         classification={level:'ready',reason:'pnpm TypeScript inputs and installation; checked again before reuse',
           qualification:'pnpm-tsc-v1'};}
       catch(e){classification={level:'recording',reason:`pnpm TypeScript contract needs review: ${e.message}`};}
     }
+    if(!script&&classification.level!=='ready')continue;
+    if(parts&&classification.level==='ready'){
+      for(const part of parts)checks.push({config:{...check,...part,qualification:classification.qualification},...classification});
+      continue;
+    }
     if(classification.qualification)check.qualification=classification.qualification;
     checks.push({config:check,...classification});
   }
@@ -238,6 +285,16 @@ export function discoverNodeProject(root,{recipe=null}={}) {
         const selected=selectScript(kind,names,member.scripts||{});
         if(selected.ambiguous){ambiguous.push({kind:`${name}:${kind}`,
           scripts:selected.ambiguous});continue;}
+        // A pnpm package with a tsconfig.json and no typecheck script gets a
+        // proposed `tsc --noEmit` check when the pnpm contract holds.
+        if(!selected.script&&kind==='typecheck'&&pm.name==='pnpm'&&!pm.issue&&
+          proposable(path.join(root,dir),member.scripts)&&!typechecks(scripts)){
+          try{for(const part of tscChecks(`${name}:typecheck`,null,{},run=>pnpmCheck(root,name,dir,file,run)))
+            checks.push({config:{kind,workspace:name,qualification:'pnpm-tsc-v1',...part},level:'ready',
+              reason:'proposed tsc --noEmit for the package\'s tsconfig.json; pnpm workspace TypeScript inputs; checked again before reuse'});}
+          catch{}
+          continue;
+        }
         if(!selected.script)continue;
         const command=pm.name==='npm'?['@which:npm','run',selected.script,
           '--workspace',name]:pm.name==='yarn'?
@@ -258,20 +315,11 @@ export function discoverNodeProject(root,{recipe=null}={}) {
             level='ready';reason='pinned Yarn workspace tsc and installed inputs; checked again before reuse';
           }catch(e){reason=`workspace TypeScript contract needs review: ${e.message}`;}
         }
-        if(!pm.issue&&pm.name==='pnpm'&&kind==='typecheck'&&
-          /^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(
-            (member.scripts||{})[selected.script]?.trim()||'')&&
-          !member.scripts?.['pre'+selected.script]&&!member.scripts?.['post'+selected.script]){
-          try{const contract=pnpmTypecheckInputs(root,name,selected.script);
-            if(contract.limitations.length)throw Error(contract.limitations.join('; '));
-            check.workspace=name;check.qualification='pnpm-tsc-v1';
-            check.script=selected.script;
-            check.cwd=dir;
-            check.command=['@node',`@typescript-bin:${dir}`,
-              ...member.scripts[selected.script].trim().split(/\s+/).slice(1)];
-            check.inputs=['package.json','pnpm-lock.yaml','pnpm-workspace.yaml',file,
-              `${dir}/src/**`];
-            level='ready';reason='pnpm workspace TypeScript inputs; checked again before reuse';
+        if(!pm.issue&&pm.name==='pnpm'&&kind==='typecheck'&&tscRuns((member.scripts||{})[selected.script])){
+          try{const parts=tscChecks(`${name}:typecheck`,selected.script,member.scripts,run=>pnpmCheck(root,name,dir,file,run));
+            for(const part of parts)checks.push({config:{kind,workspace:name,qualification:'pnpm-tsc-v1',...part},level:'ready',
+              reason:'pnpm workspace TypeScript inputs; checked again before reuse'});
+            continue;
           }catch(e){reason=`pnpm TypeScript contract needs review: ${e.message}`;}
         }
         if(recipe==='tests-direct'&&kind==='test'&&!pm.issue){

package/src/npm-integrity.mjs

@@ -0,0 +1,124 @@
+// An installed npm package checked against what the lockfile recorded: the
+// tarball npm cached under the lockfile's integrity (sha512, else sha1),
+// unpacked in memory and compared file by file. Nothing is fetched.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import zlib from 'node:zlib';
+import {createHash} from 'node:crypto';
+import {npmrc} from './npmrc.mjs';
+import {racyUntil} from './path-identity.mjs';
+
+const fail=code=>{throw Object.assign(Error(code),{code});};
+// npm's cache directory, as npm picks it: npm_config_cache, else `cache` in
+// the project's .npmrc, then the user's (npm_config_userconfig or
+// ~/.npmrc), else npm's default. A leading ~ is the home directory. The
+// global npmrc is not read.
+export function npmCacheDir(root=null,env=process.env,platform=process.platform,home=os.homedir()){
+  const variable=name=>Object.entries(env).find(([key])=>key.toLowerCase()===name)?.[1];
+  const expand=value=>path.resolve(value.replace(/^~(?=$|[\/])/,home));
+  const configured=variable('npm_config_cache');
+  if(configured)return expand(configured);
+  for(const file of [root&&path.join(root,'.npmrc'),variable('npm_config_userconfig')||path.join(home,'.npmrc')].filter(Boolean)){
+    let cache;try{cache=npmrc(file).cache;}catch{}
+    if(typeof cache==='string'&&cache)return expand(cache);
+  }
+  return platform==='win32'?path.join(env.LOCALAPPDATA||path.join(home,'AppData','Local'),'npm-cache'):path.join(home,'.npm');
+}
+// The package-lock.json entry for an installed top-level package:
+// {version, integrity, resolved, alias}. npm-shrinkwrap.json, which npm reads
+// instead, is not modeled. Parsed entries are kept per process by the
+// lockfile's identity: the daemon asks on every reuse check.
+const lockfiles=new Map();
+export function lockedPackage(root,name){
+  if(fs.existsSync(path.join(root,'npm-shrinkwrap.json')))fail('npm-shrinkwrap-unsupported');
+  const file=path.join(root,'package-lock.json');
+  let st;try{st=fs.statSync(file,{bigint:true});}catch{fail('npm-lockfile-integrity-missing');}
+  const identity=[st.dev,st.ino,st.size,st.mtimeNs,st.ctimeNs].join(':');
+  let packages=lockfiles.get(file)?.identity===identity?lockfiles.get(file).packages:null;
+  if(!packages){
+    try{packages=JSON.parse(fs.readFileSync(file,'utf8'))?.packages;}catch{fail('npm-lockfile-unreadable');}
+    // A lockfile changed within the racy window is read again next time.
+    if(racyUntil(st)<=Date.now())lockfiles.set(file,{identity,packages});
+  }
+  const entry=packages?.[`node_modules/${name}`];
+  if(!entry||typeof entry.version!=='string'||typeof entry.integrity!=='string')fail('npm-lockfile-integrity-missing');
+  return {version:entry.version,integrity:entry.integrity,resolved:entry.resolved??null,alias:entry.name??null};
+}
+// Whether a lockfile entry is the registry's own package NAME at VERSION:
+// no alias, and a tarball URL .../NAME/-/NAME-VERSION.tgz over https.
+export const registryPackage=(entry,name,version)=>entry.alias===null&&typeof entry.resolved==='string'&&
+  /^https:\/\//.test(entry.resolved)&&entry.resolved.endsWith(`/${name}/-/${name}-${version}.tgz`);
+// The digest an SRI string names, as {algorithm, hex}: sha512, else sha1
+// (some registries record only sha1; a collision needs a malicious party,
+// which is outside REDUE's threat model). null for anything else.
+export function sriDigest(integrity){
+  const items=String(integrity).split(/\s+/);
+  for(const [algorithm,length] of [['sha512',64],['sha1',20]]){
+    const value=items.map(item=>new RegExp(`^${algorithm}-([A-Za-z0-9+/]+={0,2})$`).exec(item)?.[1]).find(Boolean);
+    const bytes=value&&Buffer.from(value,'base64');
+    if(bytes?.length===length)return {algorithm,hex:bytes.toString('hex')};
+  }
+  return null;
+}
+// The cached tarball for an integrity, checked against it.
+export function cachedTarball(cache,integrity){
+  const digest=sriDigest(integrity);
+  if(!digest)fail('npm-lockfile-integrity-unsupported');
+  const {algorithm,hex}=digest;
+  let bytes;
+  try{bytes=fs.readFileSync(path.join(cache,'_cacache','content-v2',algorithm,hex.slice(0,2),hex.slice(2,4),hex.slice(4)));}
+  catch{fail('npm-tarball-uncached');}
+  if(createHash(algorithm).update(bytes).digest('hex')!==hex)fail('npm-tarball-corrupt');
+  return bytes;
+}
+// The regular files of a gzipped npm tarball, as Map(path below the top
+// directory -> bytes). Links and special files are refused.
+export function tarballFiles(gzipped){
+  let tar;try{tar=zlib.gunzipSync(gzipped,{maxOutputLength:512*1024*1024});}catch{fail('npm-tarball-invalid');}
+  const files=new Map();
+  const text=(block,from,to)=>block.subarray(from,to).toString('utf8').replace(/\0[\s\S]*$/,'');
+  let offset=0,longName=null,paxPath=null;
+  while(offset+512<=tar.length){
+    const header=tar.subarray(offset,offset+512);
+    if(header.every(byte=>byte===0))break;
+    const size=parseInt(text(header,124,136).trim()||'0',8),type=String.fromCharCode(header[156]||48);
+    if(!Number.isSafeInteger(size)||size<0)fail('npm-tarball-invalid');
+    const body=tar.subarray(offset+512,offset+512+size);
+    offset+=512+Math.ceil(size/512)*512;
+    if(type==='x'){
+      // pax records: "LEN key=value\n"
+      for(const record of body.toString('utf8').split('\n')){const match=/^\d+ path=(.*)$/.exec(record);if(match)paxPath=match[1];}
+      continue;
+    }
+    if(type==='g')continue;
+    if(type==='L'){longName=body.toString('utf8').replace(/\0[\s\S]*$/,'');continue;}
+    const prefix=text(header,345,500);
+    const name=paxPath??longName??(prefix?`${prefix}/${text(header,0,100)}`:text(header,0,100));
+    paxPath=null;longName=null;
+    if(type==='5')continue;
+    if(!['0','7'].includes(type))fail('npm-tarball-link-unsupported');
+    // npm strips the top directory (usually package/).
+    const relative=name.split('/').slice(1).join('/');
+    if(!relative||relative.split('/').some(part=>part===''||part==='.'||part==='..'))fail('npm-tarball-invalid');
+    files.set(relative,body);
+  }
+  return files;
+}
+// Whether `dir` holds exactly the tarball's files, byte for byte; throws
+// otherwise. About 120 ms for TypeScript 6 (140 files, 24 MB).
+export function matchTarball(dir,files){
+  let count=0;
+  const walk=(folder,relative='')=>{
+    let entries;try{entries=fs.readdirSync(folder,{withFileTypes:true});}catch{fail('direct-typescript-implementation-unreviewed');}
+    for(const entry of entries){
+      const name=relative?`${relative}/${entry.name}`:entry.name,full=path.join(folder,entry.name);
+      if(entry.isDirectory()){walk(full,name);continue;}
+      const expected=files.get(name);
+      let same=false;try{same=entry.isFile()&&Boolean(expected)&&fs.readFileSync(full).equals(expected);}catch{}
+      if(!same)fail('direct-typescript-implementation-unreviewed');
+      count++;
+    }
+  };walk(dir);
+  if(count!==files.size)fail('direct-typescript-implementation-unreviewed');
+}

package/src/npmrc.mjs

@@ -0,0 +1,16 @@
+// An .npmrc file read as npm reads ini: comments, a BOM, `key = value`, a bare
+// key as true, quotes stripped, true/false as booleans. {} when it is absent.
+import fs from 'node:fs';
+
+export function npmrc(file){
+  const settings={};
+  if(!fs.existsSync(file))return settings;
+  for(const line of fs.readFileSync(file,'utf8').replace(/^\uFEFF/,'').split(/\r?\n/)){
+    const trimmed=line.trim();if(!trimmed||/^[#;]/.test(trimmed))continue;
+    const at=trimmed.indexOf('='),key=(at<0?trimmed:trimmed.slice(0,at)).trim();
+    let value=at<0?true:trimmed.slice(at+1).trim();
+    if(typeof value==='string'&&/^(["']).*\1$/.test(value))value=value.slice(1,-1);
+    settings[key]=value==='true'?true:value==='false'?false:value;
+  }
+  return settings;
+}

package/src/plan-worker.mjs

@@ -5,6 +5,7 @@ import {createHash} from 'node:crypto';
 import {discover} from './plan.mjs';
 import {InputIndex,dehydrateIndex} from './index.mjs';
 import {directProject,directQualification} from './direct-typescript.mjs';
+import {checkRun} from './typescript-invocation.mjs';
 import {queriesMatch} from './typescript-list.mjs';
 import {planGuard,inputKey} from './decision-validation.mjs';
 import {timing,traceBase} from './decision-profile.mjs';
@@ -25,8 +26,10 @@ try {
       const queryStarted=performance.now();
       // Cached membership queries load the compiler API; establish its reviewed
       // implementation before that optimization can execute project code.
+      // Every direct check (a chain has one per run) uses the root's compiler:
+      // its bytes are verified once.
       const directRoots=new Set(config.checks.filter(check=>check.qualification===directQualification)
-        .map(check=>directProject(config.root,check.script).tsRoot));
+        .map((check,i)=>directProject(config.root,checkRun(check),{verify:i===0}).tsRoot));
       if(directRoots.size&&(workerData.reuse.queries||[]).some(([kind,,,options])=>
         kind==='readDirectory'&&!directRoots.has(options?.tsRoot)))throw Error('retained compiler implementation changed');
       const queriesValid=guard===workerData.reuse.guard&&