@redue/cli 0.1.0-alpha.17 → 0.1.0-alpha.18

package/src/pnpm-inputs.mjs

@@ -7,16 +7,18 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createRequire} from 'node:module';
 import {execFileSync,spawnSync} from 'node:child_process';
-import micromatch from './glob.mjs';
+import micromatch,{patternMatcher} from './glob.mjs';
 import YAML from 'yaml';
 import {resolveLinks} from './installed-inputs.mjs';
 import {withinPath as within,realObservedPath,samePath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
+import {npmrc} from './npmrc.mjs';
+import {runConfig,tscRun,tscRuns} from './typescript-invocation.mjs';
 
 const rel=(root,file)=>path.relative(root,file).split(path.sep).join('/');
 const read=file=>JSON.parse(fs.readFileSync(file,'utf8'));
 const exists=file=>{try{fs.lstatSync(file);return true;}catch{return false;}};
-function yaml(file){
+export function yaml(file){
   const doc=YAML.parseDocument(fs.readFileSync(file,'utf8'),{uniqueKeys:true});
   if(doc.errors.length)throw Error(`${path.basename(file)} cannot be interpreted safely`);
   return doc.toJS()||{};
@@ -41,20 +43,6 @@ const refused=[['modulesDir','modules-dir'],['virtualStoreDir','virtual-store-di
   ['enableGlobalVirtualStore','enable-global-virtual-store'],['injectWorkspacePackages','inject-workspace-packages'],
   ['sharedWorkspaceLockfile','shared-workspace-lockfile'],['pnpmfile','pnpmfile'],['globalPnpmfile','global-pnpmfile'],
   ['configDependencies','config-dependencies']];
-// .npmrc read as pnpm's ini parser reads it: a BOM is dropped, a bare key is
-// true, quotes are removed, and "true"/"false" become booleans.
-function npmrc(file){
-  const settings={};
-  if(!exists(file))return settings;
-  for(const line of fs.readFileSync(file,'utf8').replace(/^\uFEFF/,'').split(/\r?\n/)){
-    const trimmed=line.trim();if(!trimmed||/^[#;]/.test(trimmed))continue;
-    const at=trimmed.indexOf('='),key=(at<0?trimmed:trimmed.slice(0,at)).trim();
-    let value=at<0?true:trimmed.slice(at+1).trim();
-    if(typeof value==='string'&&/^(["']).*\1$/.test(value))value=value.slice(1,-1);
-    settings[key]=value==='true'?true:value==='false'?false:value;
-  }
-  return settings;
-}
 // Whether a refused setting is set: present at all, except that only
 // sharedWorkspaceLockfile=false and injectWorkspacePackages=true move files.
 const setting=(key,value)=>value!==undefined&&
@@ -204,16 +192,37 @@ function packageAt(root,requester,name){
   }
   return {physical:null,candidates};
 }
-function parsedTypeScript(root,dir,ts){
-  const config=path.join(root,dir,'tsconfig.json'),reads=new Set();
+// Files TypeScript may consume from its own include: each directory its
+// include patterns watch for new files (TypeScript's own
+// wildcardDirectories), and each file it lists. node_modules below them is
+// left out, as TypeScript's wildcards leave it out; installed files a program
+// reads are installed inputs. `exclude` entries stay inputs: an import can
+// still reach an excluded file.
+const sourceFiles='*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json}';
+function sourcePatterns(root,parsed){
+  const patterns=new Set(),excluded=new Set();
+  for(const [folder,flags] of Object.entries(parsed.wildcardDirectories||{})){
+    // TypeScript 4 lowercases these keys on case-insensitive file systems;
+    // the native realpath gives the directory's own spelling.
+    let at;try{at=fs.realpathSync.native(folder);}catch{at=path.resolve(folder);}
+    if(!within(at,root))throw Error('TypeScript source membership escapes the checkout');
+    const prefix=rel(root,at)?rel(root,at)+'/':'';
+    if(flags&1){patterns.add(`${prefix}**/${sourceFiles}`);excluded.add(`!${prefix}**/node_modules/**`);}
+    else patterns.add(prefix+sourceFiles);
+  }
+  const included=patternMatcher([...patterns,...excluded]);
+  for(const file of parsed.fileNames.map(name=>path.resolve(name))){
+    if(!within(file,root))throw Error('TypeScript source membership escapes the checkout');
+    if(!included(rel(root,file)))patterns.add(rel(root,file));
+  }
+  return [...patterns,...excluded];
+}
+function parsedTypeScript(root,dir,ts,configName='tsconfig.json'){
+  const config=path.join(root,dir,configName),reads=new Set();
   const host={...ts.sys,readFile(file){reads.add(path.resolve(file));return ts.sys.readFile(file);},
     onUnRecoverableConfigFileDiagnostic(){}};
   const parsed=ts.getParsedCommandLineOfConfigFile(config,{},host);
   if(!parsed||parsed.errors?.length)throw Error('TypeScript configuration unavailable');
-  const raw=ts.readConfigFile(config,ts.sys.readFile);
-  if(raw.error||!Array.isArray(raw.config?.include)||raw.config.include.length!==1||
-    !/^src(?:$|\/)/.test(raw.config.include[0]))
-    throw Error('TypeScript source file membership is outside the supported src include');
   if(parsed.options.plugins?.length||parsed.options.incremental||parsed.options.composite||
     parsed.projectReferences?.length||parsed.options.paths||parsed.options.baseUrl||
     parsed.options.rootDirs?.length||parsed.options.typeRoots?.length||
@@ -225,12 +234,13 @@ function parsedTypeScript(root,dir,ts){
     throw Error('TypeScript module resolver is outside the supported Node contract');
   for(const file of reads)if(!within(realObservedPath(file),root))
     throw Error('TypeScript configuration escapes the checkout');
-  return {parsed,configs:[...reads].map(file=>rel(root,file)).sort()};
+  return {parsed,configs:[...reads].map(file=>rel(root,file)).sort(),
+    sourcePatterns:sourcePatterns(root,parsed)};
 }
-function listedTypeScriptFiles(root,selected,tsc){
+function listedTypeScriptFiles(root,selected,tsc,configName){
   // --listFilesOnly resolves the compiler's effective module/file set but
   // performs no typecheck and emits no project outputs.
-  const out=spawnSync(process.execPath,[tsc,'-p','tsconfig.json','--listFilesOnly'],
+  const out=spawnSync(process.execPath,[tsc,'-p',configName,'--listFilesOnly'],
     {cwd:path.join(root,selected.dir),env:process.env,encoding:'utf8',
       // The native NTFS public workspace takes 3-5 s to list ~770 inputs;
       // 5 s sometimes expired despite bounded, progressing compiler work.
@@ -267,17 +277,23 @@ function sharedHardlinkIn(folder){
   }
   return false;
 }
-export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}={}){
+// `run`: the check's {script, part, args}, or a script name for its only run.
+export function pnpmTypecheckInputs(root,workspace,run,{captureQueries=false}={}){
   const totalStarted=performance.now();
   root=realObservedPath(root);
   const install=pnpmInstallInfo(root),members=pnpmWorkspacePackages(root,install.patterns);
   const selected=workspace==='.'?{name:'.',dir:'.',manifest:'package.json',
     pkg:read(path.join(root,'package.json'))}:members.get(workspace);
   if(!selected)throw Error(`workspace ${workspace} is not declared`);
-  if(!/^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(
-    selected.pkg.scripts?.[script]?.trim()||'')||
-    selected.pkg.scripts?.['pre'+script]||selected.pkg.scripts?.['post'+script])
-    throw Error('typecheck must be one standalone TypeScript invocation');
+  // A script name stands for its only run.
+  if(typeof run==='string'){const runs=tscRuns(selected.pkg.scripts?.[run]);run={script:run,args:runs?.length===1?runs[0].args:[]};}
+  const {run:own,issue}=tscRun(selected.pkg.scripts,run);
+  if(issue)throw Error(`typecheck must be standalone TypeScript runs: ${issue}`);
+  // `tsc -p .` without --noEmit predates the other forms.
+  if(!own.noEmit&&!['-p .','-p tsconfig.json'].includes(run.args.join(' ')))
+    throw Error('typecheck must pass --noEmit');
+  const configName=runConfig(path.join(root,selected.dir),run.args);
+  if(!configName)throw Error('TypeScript project is outside the package');
   const selectedDir=path.join(root,selected.dir),lookup=createRequire(path.join(selectedDir,'package.json'));
   let tsPackage;try{tsPackage=realObservedPath(lookup.resolve('typescript/package.json'));}
   catch{throw Error('installed TypeScript compiler cannot be resolved');}
@@ -286,7 +302,8 @@ export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}
   const tsc=path.join(tsRoot,'bin','tsc');
   if(!exists(tsc))throw Error('installed TypeScript executable is missing');
   const configStarted=performance.now();
-  const {configs}=parsedTypeScript(root,selected.dir,ts);
+  const {configs,sourcePatterns:sources}=parsedTypeScript(root,selected.dir,ts,configName);
+  const isSource=patternMatcher(sources);
   timing('pnpm.ts_config',configStarted,{configs:configs.length});
   const closure=new Map(),installed=new Set(),generated=new Set(),
     links=new Set(),candidates=new Set(),absences=[],instances=new Map();
@@ -336,12 +353,12 @@ export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}
     resolutionMs:Math.round(resolutionMs),workspaceLinks:links.size,
     candidates:candidates.size});
   const listingStarted=performance.now();
-  const captured=captureQueries?compilerFiles(tsRoot,path.join(root,selected.dir)):null;
-  const files=captured?captured.files.map(realObservedPath):listedTypeScriptFiles(root,selected,tsc);
+  const captured=captureQueries?compilerFiles(tsRoot,path.join(root,selected.dir),configName):null;
+  const files=captured?captured.files.map(realObservedPath):listedTypeScriptFiles(root,selected,tsc,configName);
   timing('pnpm.ts_input_listing',listingStarted,{files:files.length});
   const mappingStarted=performance.now();
   for(const file of files){
-    if(within(file,path.join(selectedDir,'src'))||
+    if(isSource(rel(root,file))||
       [...closure.values()].some(member=>within(file,path.join(root,member.dir))))continue;
     const packageRoot=installedPackageRoot(root,file);
     if(!packageRoot)throw Error(`TypeScript consumes a file outside the observed pnpm contract: ${rel(root,file)}`);
@@ -352,6 +369,16 @@ export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}
   }
   timing('pnpm.input_mapping',mappingStarted,{instances:instances.size,
     installedPatterns:installed.size});
+  // A config extended from an installed package is an installed input too:
+  // source patterns leave node_modules out.
+  for(const config of configs){
+    const file=realObservedPath(path.join(root,config));
+    if(!within(file,path.join(root,'node_modules')))continue;
+    const packageRoot=installedPackageRoot(root,file);
+    if(!packageRoot)throw Error(`TypeScript configuration ${config} is outside an installed package`);
+    installed.add(`${rel(root,packageRoot)}/**`);
+    installed.add(`!${rel(root,packageRoot)}/node_modules/**`);
+  }
   installed.add(`${rel(root,tsRoot)}/**`);
   installed.add(`!${rel(root,tsRoot)}/node_modules/**`);
   if(!instances.has(tsRoot))instances.set(tsRoot,{name:'typescript',physicalRoot:rel(root,tsRoot)});
@@ -360,11 +387,12 @@ export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}
   timing('pnpm.hardlink_inspection',sharedStarted,{instances:instances.size,
     shared:shared.length});
   const source=[...new Set([...install.configurationInputs,selected.manifest,
-    ...configs,`${selected.dir==='.'?'':selected.dir+'/'}src/**`,
+    ...configs,...sources,
     ...closure.values().map(member=>member.manifest),...generated])];
   timing('pnpm.total_discovery',totalStarted,{instances:instances.size,
     inputFiles:files.length});
   return {install,workspace:selected,closure:[...closure.values()],source,
+    sourcePatterns:sources,args:run.args,
     installed:[...installed],generated:[...generated],
     // The read-only state probe consumes this same resolved compiler file set.
     // It is deliberately omitted from the persisted user-facing input plan.

package/src/pnpm-typecheck-probe.mjs

@@ -7,14 +7,17 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
+import {patternMatcher} from './glob.mjs';
 import {withinPath as within,realObservedPath} from './path-identity.mjs';
+import {runFromArgv} from './typescript-invocation.mjs';
 
-const [rootArg,workspace,script]=process.argv.slice(2);
+const [rootArg,workspace,...rest]=process.argv.slice(2).filter(value=>!value.startsWith('--redue-'));
 const hash=value=>createHash('sha256').update(value).digest('hex');
 const digest=file=>hash(fs.readFileSync(file));
 const fail=code=>{throw Object.assign(Error(code),{code});};
 try{
-  if(!rootArg||!workspace||!script)fail('probe-arguments');
+  if(!rootArg||!workspace)fail('probe-arguments');
+  const run=runFromArgv(rest);
   const root=realObservedPath(rootArg);
   if(process.env.NODE_OPTIONS||process.env.NODE_PATH||process.env.BASH_ENV||
     process.env.ENV||Object.entries(process.env).some(([key,value])=>{
@@ -24,23 +27,25 @@ try{
       return /^(PNPM_|COREPACK_|npm_config_|DYLD_|TSGO_)/i.test(key);
     }))
     fail('pnpm-execution-environment-unsupported');
-  const contextHash=hash(JSON.stringify([root,workspace,script,process.version]));
+  const contextHash=hash(JSON.stringify([root,workspace,run,process.version]));
   if(contextOnly(contextHash))process.exit(0);
-  const contract=pnpmTypecheckInputs(root,workspace,script,{captureQueries:process.argv.includes('--redue-checkpoint')});
+  const contract=pnpmTypecheckInputs(root,workspace,run,{captureQueries:process.argv.includes('--redue-checkpoint')});
   if(contract.limitations.length)fail('pnpm-input-coverage-unavailable');
   const selected=path.join(root,contract.workspace.dir),tsc=contract.tsc;
   const inputs=contract.listedFiles;
   if(!inputs.length)fail('typescript-input-list-unavailable');
-  const inputRoots=[path.join(selected,'src'),...contract.generated.map(pattern=>
+  const inputRoots=[...contract.generated.map(pattern=>
     path.join(root,pattern.slice(0,-3))),...contract.installed.filter(p=>!p.startsWith('!'))
       .map(pattern=>path.join(root,pattern.slice(0,-3)))];
+  const isSource=patternMatcher(contract.sourcePatterns);
   for(const file of inputs)if(!within(file,root)||
+    !isSource(path.relative(root,file).split(path.sep).join('/'))&&
     !inputRoots.some(boundary=>within(file,boundary)))
     fail('typescript-input-outside-pnpm-contract');
   const files=[...new Set(inputs)].sort().map(file=>
     [hash(path.relative(root,file)),digest(file)]);
   const configs=contract.configs.map(file=>[hash(file),digest(path.join(root,file))]);
-  probeResult(hash(JSON.stringify({schema:1,workspace,script,
+  probeResult(hash(JSON.stringify({schema:1,workspace,run,
     files,configs,node:process.version,tsc:digest(tsc),
     packageManager:contract.install.version,linker:contract.install.linker})),contextHash,contract.discoveryQueries);
 }catch(e){console.error(`VSTATE_REASON:${e.code&&/^[a-z-]+$/.test(e.code)?e.code:

package/src/test-direct.mjs

@@ -10,11 +10,13 @@ import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {fileURLToPath} from 'node:url';
 import {spawnSync} from 'node:child_process';
-import micromatch from './glob.mjs';
+import {patternMatcher} from './glob.mjs';
 import {runFact} from './direct-run-certificate.mjs';
 import {queryAnswer} from './typescript-list.mjs';
-import {pnpmInstallInfo,pnpmProjectInfo} from './pnpm-inputs.mjs';
+import {pnpmInstallInfo,pnpmProjectInfo,yaml} from './pnpm-inputs.mjs';
 import {workspaceManifests} from './workspace-manifests.mjs';
+import {atomicJson} from './state-store.mjs';
+import {racyUntil} from './path-identity.mjs';
 
 const digest=value=>createHash('sha256').update(value).digest('hex');
 export const testRecorder=fileURLToPath(new URL('test-recorder.cjs',import.meta.url));
@@ -65,9 +67,7 @@ export function testRunGuard(dir,{root,sourcePatterns,files,runner,environment=t
   const compared=name=>(environment.variables||[]).includes(name)||
     (environment.prefixes||[]).some(prefix=>name.toLowerCase().startsWith(prefix.toLowerCase()));
   const issues=[],add=issue=>{if(!issues.includes(issue))issues.push(issue);};
-  const positive=sourcePatterns.filter(p=>!p.startsWith('!')).map(p=>micromatch.matcher(p,{dot:true}));
-  const negative=sourcePatterns.filter(p=>p.startsWith('!')).map(p=>micromatch.matcher(p.slice(1),{dot:true}));
-  const included=rel=>positive.some(fn=>fn(rel))&&!negative.some(fn=>fn(rel));
+  const included=patternMatcher(sourcePatterns);
   const observed=rel=>Object.hasOwn(files||{},rel);
   const headers=new Map(),records=[];
   let names=[];
@@ -336,21 +336,70 @@ export function testWorkspaceDirs(root,pkg){
 // Each node_modules the recipe observes as installed: the root's and every
 // workspace package's, relative to the root.
 const modulesDirs=({dirs=[]})=>['node_modules',...dirs.map(dir=>`${dir}/node_modules`)];
-// The first installed file with more than one link, or null. A package store
-// outside the checkout (pnpm's default on Linux, Yarn's hardlinks modes) can
-// change such a file with no event here. Checked at every recorded run: a later
-// install that adds links replaces the files, which is a change REDUE sees.
-export function sharedInstalledFile(root,project={}){
+// pnpm's content-addressed store, as the install recorded it in .modules.yaml:
+// files/<first 2 hex>/<rest of the content's sha512 hex>, "-exec" for
+// executables. pnpm writes new store files and never changes one in place.
+function pnpmStoreFiles(root){
+  try{const {storeDir}=yaml(path.join(root,'node_modules','.modules.yaml'));
+    return typeof storeDir==='string'&&path.isAbsolute(storeDir)?path.join(storeDir,'files'):null;}
+  catch{return null;}
+}
+const identity=st=>`${st.size}:${st.mtimeNs}:${st.ctimeNs}`;
+const sameFile=(file,st)=>{
+  try{const other=fs.statSync(file,{bigint:true});return other.dev===st.dev&&other.ino===st.ino;}
+  catch{return false;}};
+// The file's store path relative to `files`, or null when the store does not
+// hold this file at its content's address.
+function storePath(files,file,st){
+  const hash=createHash('sha512'),buffer=Buffer.alloc(1<<20),fd=fs.openSync(file,'r');
+  try{for(let n;(n=fs.readSync(fd,buffer,0,buffer.length,null))>0;)hash.update(buffer.subarray(0,n));}
+  finally{fs.closeSync(fd);}
+  const hex=hash.digest('hex'),at=path.join(hex.slice(0,2),hex.slice(2));
+  return [at,at+'-exec'].find(candidate=>sameFile(path.join(files,candidate),st))??null;
+}
+// The first installed file with more than one link, as {file, reason}, or
+// null. A package store outside the checkout (pnpm's default on Linux, Yarn's
+// hardlinks modes) can change such a file with no event here. A link into
+// pnpm's own store is accepted: the store's file is named by its content.
+// Checked at every recorded run: a later install that adds links replaces the
+// files, which is a change REDUE sees. `cache` (in owned state) keeps each
+// file found in the store with its identity and store path, so an unchanged
+// file is not hashed again; its store link is still checked.
+export function sharedInstalledFile(root,project={},cache=null){
   const stack=modulesDirs(project).map(dir=>path.join(root,dir));
+  const files=pnpmStoreFiles(root),now=Date.now();
+  let known={},changed=false;
+  if(files&&cache)try{const value=JSON.parse(fs.readFileSync(cache,'utf8'));
+    if(value?.files===files&&value.entries&&typeof value.entries==='object')known=value.entries;}catch{}
+  const found={};
+  const shared=(file,reason)=>({file:path.relative(root,file).split(path.sep).join('/'),reason});
   while(stack.length){
     const dir=stack.pop();let entries;
     try{entries=fs.readdirSync(dir,{withFileTypes:true});}catch{continue;}
     for(const entry of entries){
       const file=path.join(dir,entry.name);
-      if(entry.isDirectory())stack.push(file);
-      else if(entry.isFile())try{if(fs.lstatSync(file).nlink>1)return path.relative(root,file).split(path.sep).join('/');}catch{}
+      if(entry.isDirectory()){stack.push(file);continue;}
+      if(!entry.isFile())continue;
+      let st;try{st=fs.lstatSync(file,{bigint:true});}catch{continue;}
+      if(st.nlink<=1n)continue;
+      if(!files)return shared(file,'has another hard link, and the install records no pnpm store');
+      const key=`${st.dev}:${st.ino}`,cached=known[key];
+      let at=Array.isArray(cached)&&cached[0]===identity(st)&&typeof cached[1]==='string'&&
+        sameFile(path.join(files,cached[1]),st)?cached[1]:null;
+      if(!at){
+        try{at=storePath(files,file,st);}
+        catch(e){return shared(file,`could not be checked against pnpm's store (${e.code||e.message})`);}
+        if(!at)return shared(file,"has another hard link outside pnpm's store");
+        changed=true;
+      }
+      // A file changed within the racy window could change again unseen in
+      // the same timestamp tick; it is hashed again next time.
+      if(racyUntil(st)<=now)found[key]=[identity(st),at];
+      else changed=true;
     }
   }
+  if(files&&cache&&(changed||Object.keys(found).length!==Object.keys(known).length))
+    try{atomicJson(cache,{files,entries:found});}catch{}
   return null;
 }
 // The runner a package's script reaches: Node's lookup from the package

package/src/typescript-input-facts.mjs

@@ -9,7 +9,7 @@ import {timing} from './decision-profile.mjs';
 const require=createRequire(import.meta.url),hash=value=>createHash('sha256').update(value).digest('hex');
 const digestFile=file=>hash(fs.readFileSync(file));
 const fail=code=>{throw Object.assign(Error(code),{code});};
-export function typeScriptInputFacts(root,tsRoot,tsc){
+export function typeScriptInputFacts(root,tsRoot,tsc,config='tsconfig.json'){
   const configReads=new Set(),visited=new Set(),referenced=[];
   let buildInfo=null;
   let ts;try{ts=require(tsRoot);}catch{}
@@ -37,15 +37,15 @@ export function typeScriptInputFacts(root,tsRoot,tsc){
         parseConfig(reference.path.endsWith('.json')?reference.path:
           path.join(reference.path,'tsconfig.json'));
     };
-    parseConfig(path.join(root,'tsconfig.json'),true);
+    parseConfig(path.join(root,config),true);
   }else{
     // TypeScript 7's native compiler does not expose the previous config API.
     // Its CLI reports the effective config; restrict this path to one direct
     // config rather than guessing about extends/reference provenance.
-    const config=path.join(root,'tsconfig.json'),raw=fs.readFileSync(config,'utf8');
+    const file=path.join(root,config),raw=fs.readFileSync(file,'utf8');
     if(/"(?:extends|references|plugins|incremental|composite)"\s*:/.test(raw))
       fail('typescript-config-graph-unsupported');
-    const shown=spawnSync(process.execPath,[tsc,'--showConfig'],{cwd:root,
+    const shown=spawnSync(process.execPath,[tsc,'--showConfig','-p',config],{cwd:root,
       env:process.env,encoding:'utf8',timeout:probeTimeLeft(4000),maxBuffer:16*1024*1024,
       stdio:['ignore','pipe','pipe']});
     if(shown.error||shown.signal||shown.status!==0)fail('typescript-config-unavailable');
@@ -53,13 +53,13 @@ export function typeScriptInputFacts(root,tsRoot,tsc){
     if(effective.compilerOptions?.plugins?.length||
       effective.compilerOptions?.incremental||effective.compilerOptions?.composite)
       fail('typescript-config-graph-unsupported');
-    configReads.add(config);
+    configReads.add(file);
   }
   for(const file of configReads)if(!within(realObservedPath(file),root))
     fail('typescript-config-outside-repository');
   const listingStarted=performance.now();
-  const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(tsRoot,root):null;
-  const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'--noEmit','--listFilesOnly'],
+  const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(tsRoot,root,config):null;
+  const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'--noEmit','--listFilesOnly','-p',config],
     {cwd:root,env:process.env,encoding:'utf8',timeout:probeTimeLeft(process.platform==='win32'?10000:4000),
       maxBuffer:16*1024*1024,
       stdio:['ignore','pipe','pipe']});

package/src/typescript-invocation.mjs

@@ -0,0 +1,92 @@
+// The package-script forms of a standalone TypeScript check: one `tsc` run, or
+// several joined by `&&`, each with these arguments in any order:
+// --noEmit, -p/--project PATH, --skipLibCheck, --pretty [true|false].
+// Anything else (tsc -b, --watch, other options, other commands) is not one.
+import fs from 'node:fs';
+import path from 'node:path';
+
+// No shell metacharacters; a leading @ would read as a REDUE token.
+const word=/^[A-Za-z0-9_./+-][A-Za-z0-9_./@+-]*$/;
+// More runs than this is not a script REDUE splits into checks.
+const maxRuns=16;
+function parseRun(words){
+  if(words[0]!=='tsc'||!words.every(value=>word.test(value)))return null;
+  let project=null,noEmit=false;
+  for(let i=1;i<words.length;i++){
+    const value=words[i];
+    if(value==='-p'||value==='--project'){
+      if(project!==null||!words[i+1]||words[i+1].startsWith('-'))return null;
+      project=words[++i];
+    }else if(value==='--noEmit')noEmit=true;
+    else if(value==='--pretty'){if(['true','false'].includes(words[i+1]))i++;}
+    else if(value!=='--skipLibCheck')return null;
+  }
+  return {args:words.slice(1),project,noEmit};
+}
+// The runs of a script, as [{args, project, noEmit}], or null.
+export function tscRuns(text){
+  if(typeof text!=='string'||!text.trim())return null;
+  const parts=text.trim().split(/[ \t]+&&[ \t]+/);
+  if(parts.length>maxRuns)return null;
+  const runs=parts.map(part=>parseRun(part.split(/[ \t]+/)));
+  return runs.every(Boolean)?runs:null;
+}
+// The run a check makes: its `script` (null for a check init proposed without
+// one), the tsc arguments after the compiler in its command, and `count`, the
+// number of configured checks for that script (more than one for a chain).
+// Returns {run} with the parsed run, or {issue} when the arguments are outside
+// the forms, or the script no longer has exactly `count` runs, one of them
+// with exactly these arguments.
+export function tscRun(scripts,{script=null,args,count=1}){
+  if(!Array.isArray(args)||!args.every(value=>typeof value==='string'))return {issue:'TypeScript arguments are invalid'};
+  const own=parseRun(['tsc',...args]);
+  if(!own)return {issue:'TypeScript arguments are outside the supported forms'};
+  if(script===null)return {run:own};
+  if(typeof scripts?.[script]!=='string')return {issue:'typecheck script was removed'};
+  if(scripts['pre'+script]||scripts['post'+script])return {issue:'typecheck script has pre or post scripts'};
+  const runs=tscRuns(scripts[script]);
+  if(runs?.length!==count||!runs.some(run=>JSON.stringify(run.args)===JSON.stringify(args)))
+    return {issue:'typecheck script changed'};
+  return {run:own};
+}
+// The config file a run names, relative to the directory `dir` it runs in
+// (posix): tsconfig.json without -p, a directory's tsconfig.json, or null
+// when it leaves that directory or the arguments are not a run.
+export function runConfig(dir,args){
+  const run=parseRun(['tsc',...args]);
+  if(!run)return null;
+  let file=path.posix.normalize((run.project??'tsconfig.json').split(path.sep).join('/'));
+  let directory=false;try{directory=fs.statSync(path.join(dir,file)).isDirectory();}catch{}
+  if(!file.endsWith('.json')||directory)file=path.posix.join(file,'tsconfig.json');
+  if(path.posix.isAbsolute(file)||file==='..'||file.startsWith('../'))return null;
+  return file;
+}
+// The check names for a script's runs: the kind's name for one run, and
+// NAME.1 ... NAME.n for a chain (not #: the hook refuses it and zsh may glob it).
+export const partName=(name,index,count)=>count===1?name:`${name}.${index}`;
+// Probe arguments for a run, and back: SCRIPT (or -), COUNT, then the tsc
+// arguments.
+export const runArgv=({script=null,args,count=1})=>[script??'-',String(count),...args];
+export function runFromArgv(values){
+  const [script,count,...args]=values;
+  if(typeof script!=='string'||!script||!/^[1-9]\d?$/.test(count||''))throw Object.assign(Error('probe-arguments'),{code:'probe-arguments'});
+  return {script:script==='-'?null:script,args,count:Number(count)};
+}
+// The run a configured check makes: its script, the arguments after the
+// compiler in its command, and how many checks the config has for the script
+// (`runCount`, set when the config is loaded).
+export const checkRun=check=>({script:check.script??null,
+  args:Array.isArray(check.command)?check.command.slice(2):[],count:check.runCount??1});
+// A script's checks in the order of its runs: one check per run with the same
+// arguments ({name, args} each), as names; null when they do not correspond.
+export function scriptRunChecks(text,checks){
+  const runs=tscRuns(text);
+  if(!runs||runs.length!==checks.length)return null;
+  const left=[...checks],names=[];
+  for(const run of runs){
+    const at=left.findIndex(check=>JSON.stringify(check.args)===JSON.stringify(run.args));
+    if(at<0)return null;
+    names.push(left.splice(at,1)[0].name);
+  }
+  return names;
+}

package/src/typescript-list.mjs

@@ -63,7 +63,7 @@ export function queriesMatch(queries) {
   return queries.every(([kind,file,answer,options])=>
     JSON.stringify(queryAnswer(kind,file,options))===JSON.stringify(answer));
 }
-export function compilerFiles(tsRoot,cwd) {
+export function compilerFiles(tsRoot,cwd,config='tsconfig.json') {
   const require=createRequire(import.meta.url),ts=require(tsRoot);
   if(typeof ts.createProgram!=='function'||typeof ts.createCompilerHost!=='function')return null;
   const queries=new Map();
@@ -114,7 +114,7 @@ export function compilerFiles(tsRoot,cwd) {
   };
   const realpath=file=>{remember('realpath',file);return ts.sys.realpath(file);};
   // `extends` of a package config resolves through realpath too.
-  const parsed=ts.getParsedCommandLineOfConfigFile(path.join(cwd,'tsconfig.json'),{},
+  const parsed=ts.getParsedCommandLineOfConfigFile(path.join(cwd,config),{},
     {...ts.sys,readFile,fileExists,directoryExists,getDirectories,readDirectory,realpath,
       onUnRecoverableConfigFileDiagnostic(){}});
   if(!parsed||parsed.errors?.length)throw Error('TypeScript configuration unavailable');

package/src/typescript-qualification.mjs

@@ -2,6 +2,7 @@ import {directProject,directQualification,directEnvironment} from './direct-type
 import fs from 'node:fs';
 import path from 'node:path';
 import {realObservedPath} from './path-identity.mjs';
+import {checkRun,runArgv} from './typescript-invocation.mjs';
 
 // This is a machine-enforced contract, not a claim inferred from a script name.
 // Runtime validation checks effective compiler membership, configuration and
@@ -11,10 +12,9 @@ export function qualifyTypeScript(root,selected,discovered={}) {
   if(selected.qualification===directQualification){
     const issues=[];
     try{
-      const compiler=directProject(root,selected.script);
-      if(selected.command?.length!==3||selected.command[0]!==process.execPath||
-        selected.command[1]!==compiler.entry||selected.command[2]!=='--noEmit'||
-        selected.cwd&&selected.cwd!=='.')issues.push('direct compiler invocation changed');
+      const compiler=directProject(root,checkRun(selected));
+      if(selected.command?.[0]!==process.execPath||
+        selected.command[1]!==compiler.entry||selected.cwd&&selected.cwd!=='.')issues.push('direct compiler invocation changed');
     }catch(e){issues.push(e.code||'direct compiler prerequisites unavailable');}
     if(!selected.inputs?.includes('**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json,jsonc}')||
       !selected.inputs?.includes('package.json')||!selected.inputs?.includes('tsconfig.json')||
@@ -24,23 +24,22 @@ export function qualifyTypeScript(root,selected,discovered={}) {
       !directEnvironment.prefixes.every(key=>selected.environment?.prefixes?.includes(key)))
       issues.push('direct compiler execution context incomplete');
     if(selected.probes?.length!==1||!selected.probes?.some(argv=>path.basename(argv[1]||'')==='direct-typescript-probe.mjs'&&
-      argv[0]===process.execPath&&argv[2]===root&&argv[3]===selected.script))issues.push('direct compiler probe missing');
+      argv[0]===process.execPath&&argv[2]===root&&
+      JSON.stringify(argv.slice(3))===JSON.stringify(runArgv(checkRun(selected)))))issues.push('direct compiler probe missing');
     return {qualified:issues.length===0,issues};
   }
   if(selected.qualification==='pnpm-tsc-v1'){
     const issues=[];
     const workspace=selected.workspace||'.';
-    const script=selected.script||selected.command?.at(-1);
     try{
       if(discovered.issue)throw Error(discovered.issue);
       const contract=discovered.workspace;
       if(!contract)throw Error('pnpm TypeScript input discovery unavailable');
       issues.push(...contract.limitations);
-      const declared=contract.workspace.pkg.scripts[script].trim().split(/\s+/).slice(1);
+      // The arguments are checked against the script by the contract itself.
       if(path.resolve(root,selected.cwd||'.')!==path.join(root,contract.workspace.dir)||
         selected.command?.[0]!==process.execPath||
-        selected.command?.[1]!==contract.tsc||
-        JSON.stringify(selected.command.slice(2))!==JSON.stringify(declared))
+        selected.command?.[1]!==contract.tsc)
         issues.push('standalone TypeScript invocation changed');
     }catch(e){issues.push(e.message);}
     if(!selected.probes?.some(argv=>path.basename(argv[1]||'')==='pnpm-typecheck-probe.mjs'))

package/src/workspace-manifests.mjs

@@ -3,7 +3,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import {spawnSync} from 'node:child_process';
-import micromatch from './glob.mjs';
+import {patternMatcher} from './glob.mjs';
 
 export function workspaceManifests(root,patterns) {
   const listing=spawnSync('git',['ls-files','--cached','--others','--exclude-standard',
@@ -12,11 +12,10 @@ export function workspaceManifests(root,patterns) {
     env:{...process.env,GIT_OPTIONAL_LOCKS:'0'}});
   if(listing.status!==0||listing.error)throw Error('workspace package manifests cannot be inspected');
   // `!pattern` entries exclude, as in pnpm-workspace.yaml.
-  const positive=patterns.filter(p=>!p.startsWith('!')),negative=patterns.filter(p=>p.startsWith('!')).map(p=>p.slice(1));
+  const included=patternMatcher(patterns);
   const matched=listing.stdout.split('\0').filter(Boolean).filter(file=>{
     const dir=path.posix.dirname(file);
-    return dir!=='.'&&!dir.split('/').includes('node_modules')&&
-      micromatch.isMatch(dir,positive,{dot:true})&&!(negative.length&&micromatch.isMatch(dir,negative,{dot:true}));
+    return dir!=='.'&&!dir.split('/').includes('node_modules')&&included(dir);
   }).sort();
   if(matched.length>50)throw Error('more than 50 workspace packages found; select checks explicitly');
   return matched.map(file=>({file,pkg:JSON.parse(fs.readFileSync(path.join(root,file),'utf8'))}));