@redue/cli 0.1.0-alpha.17 → 0.1.0-alpha.19

package/src/declared-plan.mjs

@@ -7,8 +7,10 @@ import {permittedRoots,resolveDeclaredInstalled} from './installed-inputs.mjs';
 import {qualifyTypeScript} from './typescript-qualification.mjs';
 import {directBuildInfo} from './direct-typescript.mjs';
 import {qualifyTests,testWorkspacePatterns,testsQualification} from './test-direct.mjs';
+import {qualifyNodeScript,scriptQualification} from './node-script.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
+import {checkRun} from './typescript-invocation.mjs';
 import {observedRelative,withinPath,realObservedPath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
 
@@ -64,8 +66,7 @@ export function discoverDeclared(config) {
       catch(e){workspaceIssue=e.message;}
     }
     if(selected.qualification==='pnpm-tsc-v1'){
-      try{workspace=pnpmTypecheckInputs(root,selected.workspace||'.',
-        selected.script||selected.command.at(-1));}
+      try{workspace=pnpmTypecheckInputs(root,selected.workspace||'.',checkRun(selected));}
       catch(e){workspaceIssue=e.message;}
     }
     timing('plan.workspace_inputs',workspaceStarted,{available:workspace?1:0});
@@ -75,13 +76,14 @@ export function discoverDeclared(config) {
     // until then the run reports the unexpected write and is not reusable.
     let buildInfo=null;
     if(selected.qualification==='npm-typescript-direct-v1')
-      try{buildInfo=directBuildInfo(root,selected.script);}catch{}
+      try{buildInfo=directBuildInfo(root,checkRun(selected));}catch{}
     const excluded=buildInfo?['!'+buildInfo]:[];
     const installedStarted=performance.now();
     const installed=resolveDeclaredInstalled(root,
       [...(selected.installedInputs||[]),...(workspace?.installed||[]),...excluded],allowedRoots);
     timing('plan.installed_resolution',installedStarted,{mappings:installed.mappings.length});
     const automatic=selected.qualification===testsQualification?qualifyTests(root,selected):
+      selected.qualification===scriptQualification?qualifyNodeScript(root,selected):
       qualifyTypeScript(root,selected,{workspace,issue:workspaceIssue});
     const sourcePatterns=[...new Set([...selected.inputs,...(workspace?.source||[]),
       ...(workspace?.generated||[]),...excluded])].sort();
@@ -92,9 +94,10 @@ export function discoverDeclared(config) {
       ...(workspaceIssue?[workspaceIssue]:[])];
     for(const item of workspace?.configurationInputs||[])configurationInputs.add(item);
     for(const item of workspace?.workspacePatterns||[])workspacePatterns.add(item);
-    // A workspace test check is qualified against the current package list: a
-    // package manifest appearing or pnpm's package list changing re-plans.
-    if(selected.qualification===testsQualification&&selected.workspace)try{
+    // A workspace test check, and a general check in a workspace, is qualified
+    // against the current package list: a package manifest appearing or pnpm's
+    // package list changing re-plans.
+    if(selected.qualification===testsQualification&&selected.workspace||selected.qualification===scriptQualification)try{
       for(const item of testWorkspacePatterns(root,JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'))))
         workspacePatterns.add(item);
       if(fs.existsSync(path.join(root,'pnpm-workspace.yaml')))configurationInputs.add('pnpm-workspace.yaml');

package/src/direct-typescript-probe.mjs

@@ -4,18 +4,20 @@ import {typeScriptInputFacts} from './typescript-input-facts.mjs';
 import {contextOnly,probeResult} from './probe-result.mjs';
 import {realObservedPath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
+import {runArgv,runFromArgv} from './typescript-invocation.mjs';
 try{
-  const [rootArg,script]=process.argv.slice(2),root=realObservedPath(rootArg);
+  const [rootArg,...rest]=process.argv.slice(2).filter(value=>!value.startsWith('--redue-')),root=realObservedPath(rootArg);
+  const run=runFromArgv(rest),script=runArgv(run).join(' ');
   // Verify all installed implementation bytes before loading compiler API/code,
   // including the optimized context-only path. A version label is insufficient.
   const implementationStarted=performance.now();
-  const compiler=directProject(root,script);
+  const compiler=directProject(root,run);
   timing('direct_probe.implementation',implementationStarted,{version:compiler.version});
   const context={interpretation:directInterpretation,compiler:compiler.digest,
     entry:compiler.entry,node:[realObservedPath(process.execPath),process.version]};
   const contextHash=directContextHash(compiler,context.node);
   if(!contextOnly(contextHash)){
-    const {queries,configs,files,buildInfo}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry);
+    const {queries,configs,files,buildInfo}=typeScriptInputFacts(root,compiler.tsRoot,compiler.entry,compiler.config);
     const layout={root,script,configs,files,context,...(buildInfo?{buildInfo}:{})};
     probeResult(directProbeOutput(layout),contextHash,queries,layout);
   }

package/src/direct-typescript.mjs

@@ -3,7 +3,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {createRequire} from 'node:module';
-import {realObservedPath,withinPath} from './path-identity.mjs';
+import {racyUntil,realObservedPath,withinPath} from './path-identity.mjs';
+import {cachedTarball,lockedPackage,matchTarball,npmCacheDir,registryPackage,tarballFiles} from './npm-integrity.mjs';
+import {runConfig,tscRun} from './typescript-invocation.mjs';
 export const directInterpretation='npm-direct-typescript@1';
 export const directQualification='npm-typescript-direct-v1';
 const reviewed={
@@ -60,8 +62,9 @@ export function directCompiler(root,{verify=true}={}){
   const tsRoot=path.dirname(realObservedPath(manifest));
   if(!withinPath(tsRoot,root)||tsRoot!==realObservedPath(path.join(root,'node_modules/typescript')))
     fail('direct-typescript-layout-unsupported');
-  const version=JSON.parse(fs.readFileSync(manifest)).version,spec=reviewed[version];
-  if(!spec)fail('direct-typescript-version-unsupported');
+  const version=JSON.parse(fs.readFileSync(manifest)).version;
+  if(!reviewed[version])return lockedCompiler(root,tsRoot,version,verify);
+  const spec=reviewed[version];
   if(verify){
     const files=[];
     const walk=(dir,relative='')=>{
@@ -78,6 +81,42 @@ export function directCompiler(root,{verify=true}={}){
   }
   return {tsRoot,version,entry:path.join(tsRoot,spec.entry),digest:spec.digest};
 }
+// A TypeScript 5.x or 6.0 the lockfile records: the installed package must be
+// the registry's `typescript` at that version, holding exactly the files of
+// the tarball npm cached under the lockfile's integrity. Its identity is that
+// integrity. The entry is lib/_tsc.js where the package has one (5.7 and
+// later), as for the reviewed versions, else lib/tsc.js. A verified tree is
+// remembered per process while its files keep their identity.
+const verifiedTrees=new Map();
+function treeIdentity(tsRoot){
+  const parts=[],now=Date.now();
+  const walk=folder=>{for(const entry of fs.readdirSync(folder,{withFileTypes:true})){
+    const full=path.join(folder,entry.name),st=fs.lstatSync(full,{bigint:true});
+    if(racyUntil(st)>now)return null;
+    parts.push([full,st.dev,st.ino,st.size,st.mtimeNs,st.ctimeNs].join(':'));
+    if(entry.isDirectory()&&walk(full)===null)return null;
+  }};
+  try{if(walk(tsRoot)===null)return null;}catch{return null;}
+  return hash(parts.sort().join('\n'));
+}
+function lockedCompiler(root,tsRoot,version,verify){
+  if(!/^(?:5\.\d+|6\.0)\.\d+$/.test(version))fail('direct-typescript-version-unsupported');
+  let locked;try{locked=lockedPackage(root,'typescript');}
+  catch(e){fail(['npm-lockfile-unreadable','npm-shrinkwrap-unsupported'].includes(e.code)?e.code:'direct-typescript-lockfile-integrity-missing');}
+  if(locked.version!==version)fail('direct-typescript-lockfile-version-differs');
+  if(!registryPackage(locked,'typescript',version)||
+    JSON.parse(fs.readFileSync(path.join(tsRoot,'package.json'),'utf8')).name!=='typescript')
+    fail('direct-typescript-lockfile-source-unsupported');
+  if(verify){
+    const tree=treeIdentity(tsRoot);
+    if(!tree||verifiedTrees.get(locked.integrity)!==tree){
+      matchTarball(tsRoot,tarballFiles(cachedTarball(npmCacheDir(root),locked.integrity)));
+      if(tree)verifiedTrees.set(locked.integrity,tree);
+    }
+  }
+  const entry=fs.existsSync(path.join(tsRoot,'lib','_tsc.js'))?'lib/_tsc.js':'lib/tsc.js';
+  return {tsRoot,version,entry:path.join(tsRoot,entry),digest:hash('npm-integrity\0'+locked.integrity)};
+}
 // The direct probe's output: root, script, configuration and program files with
 // their byte digests, and the execution context. A recorded run rebuilds it from
 // the same layout (direct-run-certificate.mjs).
@@ -101,13 +140,16 @@ export function buildInfoFor(ts,options,root) {
   if(!relative.endsWith('.tsbuildinfo')||/[*?[\]{}()!+@,]/.test(relative))return {issue:'typescript-buildinfo-name-unsupported'};
   return {file:relative};
 }
+// The config a run's arguments name, relative to the root, or null.
+export const directConfig=(root,args)=>runConfig(root,args);
 // The plan's build-info file, or null. The compiler is loaded only when the
-// root config sets incremental or extends another config.
-export function directBuildInfo(root,script) {
-  const config=path.join(root,'tsconfig.json');
+// run's config sets incremental or extends another config.
+export function directBuildInfo(root,run) {
+  const name=directConfig(root,run.args);if(!name)return null;
+  const config=path.join(root,name);
   let raw;try{raw=fs.readFileSync(config,'utf8');}catch{return null;}
   if(!/"(?:incremental|extends)"\s*:/.test(raw))return null;
-  const compiler=directProject(root,script,{verify:false}),ts=createRequire(import.meta.url)(compiler.tsRoot);
+  const compiler=directProject(root,run,{verify:false}),ts=createRequire(import.meta.url)(compiler.tsRoot);
   const parsed=ts.getParsedCommandLineOfConfigFile(config,{},{...ts.sys,onUnRecoverableConfigFileDiagnostic(){}});
   return parsed?.options?.composite?null:buildInfoFor(ts,parsed?.options,root).file??null;
 }
@@ -120,16 +162,21 @@ export function directContextHash(compiler,node){
   return hash(JSON.stringify({interpretation:directInterpretation,compiler:compiler.digest,
     entry:compiler.entry,node}));
 }
-export function directProject(root,script,{verify=true}={}){
+// The compiler for one check run {script, part, args}: script null for a
+// check init proposed without one. The run must pass --noEmit and name a
+// config inside the root.
+export function directProject(root,run,{verify=true}={}){
   const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json')));
   if(pkg.workspaces||pkg.packageManager&&!/^npm@/.test(pkg.packageManager)||
     !['package-lock.json','npm-shrinkwrap.json'].some(file=>fs.existsSync(path.join(root,file)))||
     ['yarn.lock','pnpm-lock.yaml','bun.lock','bun.lockb'].some(file=>fs.existsSync(path.join(root,file))))
     fail('direct-npm-project-unsupported');
-  if(pkg.scripts?.[script]?.trim()!=='tsc --noEmit'||pkg.scripts?.['pre'+script]||pkg.scripts?.['post'+script])
-    fail('typecheck-script-changed');
+  const own=tscRun(pkg.scripts,run).run;
+  if(!own?.noEmit)fail('typecheck-script-changed');
+  const config=directConfig(root,run.args);
+  if(!config||!fs.existsSync(path.join(root,config)))fail('typescript-config-unavailable');
   const issue=directEnvironmentIssue();if(issue)fail(issue);
-  return directCompiler(root,{verify});
+  return {...directCompiler(root,{verify}),config};
 }
 // Provenance only: retain a digest, never proxy URLs/credentials or a raw dump.
 // No npm process runs in this recipe; these keys are not compiler applicability.

package/src/glob.mjs

@@ -7,3 +7,11 @@ export default {
   matcher(pattern,options){return picomatch(pattern,options);},
   isMatch(file,patterns,options){return picomatch(patterns,options)(file);}
 };
+// A matcher for a pattern list with `!` exclusions: a path matches when a
+// positive pattern does and no excluded one does. A plain list match would
+// take any `!` pattern as matching everything else.
+export function patternMatcher(patterns){
+  const positive=patterns.filter(p=>!p.startsWith('!')).map(p=>picomatch(p,{dot:true}));
+  const negative=patterns.filter(p=>p.startsWith('!')).map(p=>picomatch(p.slice(1),{dot:true}));
+  return file=>positive.some(fn=>fn(file))&&!negative.some(fn=>fn(file));
+}

package/src/index.mjs

@@ -55,7 +55,7 @@ function fileHash(root, rel,installed=false,before=fs.lstatSync(path.join(root,r
     const target=fs.statSync(resolution.physical,{bigint:true});
     const physical=path.relative(root,resolution.physical).split(path.sep).join('/');
     const directory=target.isDirectory()&&installed&&observedDir?.(physical);
-    if(!target.isFile()&&!directory)throw Error(`directory input symlink unsupported: ${rel}`);
+    if(!target.isFile()&&!directory)throw Error(`directory input symlink unsupported: ${rel} -> ${physical}`);
     if(directory)value='dirlink:'+JSON.stringify(resolution.links)+':'+physical;
     else{
       if(installed)racy=racyUntil(target);else bytes=Number(target.size);
@@ -192,10 +192,16 @@ export class InputIndex {
       const installed=this.installedPath(rel);
       try{const started=performance.now();
         // A linked directory counts as observed only strictly inside an
-        // installed root, and only if every check matching the link also
-        // observes the directory's own files (its package.json stands for them).
+        // installed root, or as a checkout directory outside node_modules (a
+        // workspace package the package manager links), and only if every
+        // check matching the link also observes the directory's own files
+        // (its package.json stands for them).
+        // The second form is for recorded checks only: their recorder
+        // classifies a read through the link where it leads.
+        const recorded=name=>['node-script-v1','npm-tests-direct-v1'].includes(this.checks.get(name).plan.qualification);
         const observedDir=installed?physical=>!this.includeInstalled&&
-          [...this.installedRootSet].some(root=>physical.startsWith(root+'/'))&&
+          ([...this.installedRootSet].some(root=>physical.startsWith(root+'/'))||
+            !physical.split('/').includes('node_modules')&&!this.installedPath(physical+'/package.json')&&matched.every(recorded))&&
           matched.every(name=>this.matches(this.checks.get(name),physical+'/package.json')):null;
         inspection=fileHash(this.root,rel,installed,stat,observedDir);
         fresh=inspection.hash;

package/src/node-onboarding.mjs

@@ -1,5 +1,9 @@
 import {directProject,directQualification} from './direct-typescript.mjs';
-import {testProject,testRecipeScript,testCheckInputs,testsQualification} from './test-direct.mjs';
+import {testProject,testRecipeScript,testCheckInputs,testEnvironmentIssue,testsQualification} from './test-direct.mjs';
+import {commandLineIssue,scriptCheckInputs,scriptPath,scriptProject,scriptQualification} from './node-script.mjs';
+// Init proposes the general recipe for typecheck and lint scripts; test
+// scripts use the direct test recipe (Vitest, Jest).
+const generalKinds=['typecheck','lint'];
 import fs from 'node:fs';
 import path from 'node:path';
 import {spawnSync} from 'node:child_process';
@@ -8,11 +12,12 @@ import {pnpmInstallInfo,pnpmProjectInfo,pnpmTypecheckInputs} from './pnpm-inputs
 import {realObservedPath} from './path-identity.mjs';
 import {findExecutable} from './executable-lookup.mjs';
 import {workspaceManifests} from './workspace-manifests.mjs';
+import {partName,tscRuns} from './typescript-invocation.mjs';
 
 const exists=file=>{try{fs.accessSync(file);return true;}catch{return false;}};
 const readJson=file=>JSON.parse(fs.readFileSync(file,'utf8'));
 const scriptNames={
-  typecheck:['typecheck','type-check','check:types','types:check'],
+  typecheck:['typecheck','type-check','check:types','types:check','check-types'],
   test:['test','test:unit','test:check'],
   lint:['lint','lint:check'],
   build:['build'],
@@ -82,6 +87,28 @@ function manager(root,pkg) {
   return {name,version,layout:'node-modules/classic',issue:null,lockfiles:locks};
 }
 const exactTypeScript=script=>script.trim()==='tsc --noEmit';
+// A script of tsc runs that each pass --noEmit (typescript-invocation.mjs).
+const noEmitRuns=script=>Boolean(tscRuns(script)?.every(run=>run.noEmit));
+// Ready checks for a typecheck, one per tsc run: the script's runs (a chain
+// gives NAME.1 ... NAME.n), or with no script one proposed `tsc --noEmit`.
+// `make(run)` returns a run's command, cwd and inputs, or throws why its
+// contract does not hold.
+function tscChecks(name,script,scripts,make){
+  const runs=script===null?[{args:['--noEmit']}]:tscRuns(scripts[script]);
+  if(!runs)throw Error('the script is not tsc runs in a supported form');
+  return runs.map(({args},i)=>({name:partName(name,i+1,runs.length),
+    ...(script===null?{}:{script}),...make({script,args,count:runs.length})}));
+}
+// A proposed `tsc --noEmit` only where nothing typechecks already: a script
+// that runs any TypeScript checker in another form (tsc -b, vue-tsc,
+// svelte-check, tsgo, also quoted or wrapped by concurrently or run-p) is the
+// project's own typecheck, which plain tsc would not match.
+const typeChecker=/(?:^|[^\w-])(?:tsc|vue-tsc|tsgo|svelte-check|tsc-watch)(?=$|[^\w-])|\bastro check\b|\bnuxi typecheck\b/;
+const typechecks=scripts=>Object.values(scripts||{}).some(text=>typeof text==='string'&&typeChecker.test(text));
+const proposable=(dir,scripts)=>exists(path.join(dir,'tsconfig.json'))&&!typechecks(scripts);
+// The inputs a TypeScript contract adds to its check's config: no exclusions,
+// which would outlive the tsconfig they came from; the plan adds the current ones.
+const contractInputs=contract=>[...contract.configs,...contract.sourcePatterns.filter(p=>!p.startsWith('!'))];
 function sourceLinkIssue(root) {
   const stack=likelyDirs.filter(name=>exists(path.join(root,name)));
   let inspected=0;
@@ -107,7 +134,8 @@ function sourceInputs(root,kind,lockfiles) {
     '!node_modules/**','!.git/**'])];
   const dirs=likelyDirs.filter(name=>exists(path.join(root,name)))
     .map(name=>`${name}/**`);
-  return [...new Set([...files,...(dirs.length?dirs:['package.json'])])];
+  // A workspace package's node_modules under them is installed, not source.
+  return [...new Set([...files,...(dirs.length?[...dirs,'!**/node_modules/**']:['package.json'])])];
 }
 function classify(kind,scriptName,script,pkg,managerInfo,root) {
   const value=script.trim();
@@ -139,14 +167,26 @@ function selectScript(kind,names,scripts) {
   const candidates=Object.keys(scripts).filter(name=>{
     const value=scripts[name]?.trim();
     if(typeof value!=='string')return false;
-    if(kind==='typecheck')return exactTypeScript(value);
+    if(kind==='typecheck')return noEmitRuns(value);
     if(kind==='test')return /^(?:vitest|jest)(?:\s|$)/.test(value);
     if(kind==='lint')return /^eslint(?:\s|$)/.test(value);
     return /^vite\s+build(?:\s|$)/.test(value);
   });
+  // A lone plain `tsc --noEmit` wins over other tsc shapes beside it (a
+  // project's `typescript` next to `typescript:tests:raw`).
+  const exact=kind==='typecheck'?candidates.filter(name=>exactTypeScript(scripts[name])):[];
+  if(exact.length===1)return {script:exact[0]};
   return candidates.length===1?{script:candidates[0]}:
     candidates.length>1?{ambiguous:candidates}:{};
 }
+// A pnpm workspace package's TypeScript run, as its check's command, cwd and inputs.
+function pnpmCheck(root,name,dir,manifest,run){
+  const contract=pnpmTypecheckInputs(root,name,run);
+  if(contract.limitations.length)throw Error(contract.limitations.join('; '));
+  return {cwd:dir,command:['@node',`@typescript-bin:${dir}`,...run.args],
+    inputs:[...new Set(['package.json','pnpm-lock.yaml','pnpm-workspace.yaml',manifest,
+      ...contractInputs(contract)])]};
+}
 // Workspace packages as init finds them, with their scripts; [] without workspaces.
 export function workspacePackages(root){
   root=realObservedPath(root);
@@ -156,8 +196,27 @@ export function workspacePackages(root){
   return workspaceManifests(root,patterns).map(({file,pkg:member})=>
     ({name:member.name,dir:path.posix.dirname(file),scripts:member.scripts&&typeof member.scripts==='object'?member.scripts:{}}));
 }
+// The general recipe for a root script, or why it does not apply: a
+// supported package manager and platform, and a script (with its pre and post
+// scripts) that, read as text, starts only Node programs.
+function generalCheck(root,kind,script){
+  if(!['darwin','linux'].includes(process.platform))throw Error('the general recipe records runs on macOS and Linux only');
+  const environmentIssue=testEnvironmentIssue();
+  if(environmentIssue)throw Error(environmentIssue);
+  let project;
+  try{project=scriptProject(root,script);}catch(e){throw Error(e.code?.replace(/^test-/,'')||e.message);}
+  for(const name of ['pre'+script,script,'post'+script]){
+    if(typeof project.scripts[name]!=='string')continue;
+    const issue=commandLineIssue(project.scripts[name],{cwd:root,searchPath:scriptPath(root,process.env.PATH)});
+    if(issue)throw Error(name===script?issue:`${name}: ${issue}`);
+  }
+  return {config:{name:kind,script,kind,qualification:scriptQualification,...scriptCheckInputs(project.dirs)},manager:project.manager};
+}
 export function discoverNodeProject(root,{recipe=null}={}) {
-  if(recipe&&!['typescript-direct','tests-direct'].includes(recipe))throw Error('unknown recipe; use typescript-direct or tests-direct');
+  if(recipe&&!['typescript-direct','tests-direct','node-script'].includes(recipe))
+    throw Error('unknown recipe; use typescript-direct, tests-direct or node-script');
+  // Without --recipe, init tries the strict recipes first, then the general one.
+  const auto=recipe===null;
   root=realObservedPath(root);
   const packageFile=path.join(root,'package.json');
   if(!exists(packageFile))throw Error('run init from a repository containing package.json');
@@ -178,22 +237,30 @@ export function discoverNodeProject(root,{recipe=null}={}) {
   for(const [kind,names] of Object.entries(scriptNames)) {
     const selected=selectScript(kind,names,scripts),script=selected.script;
     if(selected.ambiguous)ambiguous.push({kind,scripts:selected.ambiguous});
-    if(!script)continue;
+    // With no typecheck script, a root tsconfig.json gets a proposed
+    // `tsc --noEmit` check; package.json stays unchanged. It is kept only
+    // when a contract makes it ready.
+    const proposed=!script&&!selected.ambiguous&&kind==='typecheck'&&!observationIssue&&
+      proposable(root,scripts);
+    if(!script&&!proposed)continue;
     let classification=observationIssue?{level:'unsupported',reason:observationIssue}:
-      classify(kind,script,scripts[script],pkg,pm,root);
+      script?classify(kind,script,scripts[script],pkg,pm,root):{level:'recording',reason:'no typecheck script'};
+    let parts=null;
     if(workspaces&&classification.qualification==='typescript-noemit-v1')classification={level:'recording',
       reason:'workspace task and installed-input closure need explicit qualification'};
     const check={name:kind,script,kind,inputs:sourceInputs(root,kind,pm.lockfiles||[])};
-    if(recipe==='typescript-direct'&&kind==='typecheck'){
+    if((recipe==='typescript-direct'||auto&&pm.name==='npm'&&!workspaces)&&kind==='typecheck'){
       try{
         if(pm.name!=='npm'||workspaces||observationIssue||pm.issue)throw Error('direct recipe requires a supported single-package npm checkout');
-        const compiler=directProject(root,script);
-        check.command=['@node','@typescript-compiler:.','--noEmit'];check.cwd='.';
+        let version;
+        parts=tscChecks('typecheck',script??null,scripts,run=>{
+          version=directProject(root,run).version;
+          return {command:['@node','@typescript-compiler:.',...run.args],cwd:'.'};});
         classification={level:'ready',qualification:directQualification,
-          reason:`explicit local TypeScript ${compiler.version} compilation; npm launcher/lifecycle scripts are not executed; package.json stays unchanged`};
+          reason:`explicit local TypeScript ${version} compilation; npm launcher/lifecycle scripts are not executed; package.json stays unchanged`};
       }catch(e){classification={level:'recording',reason:`Direct recipe unavailable (${e.code||e.message}); original npm script retained, without bypassing required behavior`};}
     }
-    if(recipe==='tests-direct'&&kind==='test'){
+    if((recipe==='tests-direct'||auto)&&kind==='test'){
       try{
         if(!['npm','pnpm','yarn'].includes(pm.name)||workspaces||observationIssue||pm.issue)
           throw Error('test recipe requires a supported single-package npm, pnpm or Yarn checkout');
@@ -207,20 +274,32 @@ export function discoverNodeProject(root,{recipe=null}={}) {
           reason:`explicit local ${project.runner} ${project.version} run of script ${JSON.stringify(chosen.script)}; the whole checkout is its input; npm and lifecycle scripts are not executed`};
       }catch(e){classification={level:'recording',reason:`Test recipe unavailable (${e.code||e.message}); original npm script retained`};}
     }
-    if(pm.name==='pnpm'&&kind==='typecheck'&&!workspaces&&!pm.issue&&
-      /^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(scripts[script].trim())){
-      try{const contract=pnpmTypecheckInputs(root,'.',script);
-        if(contract.limitations.length)throw Error(contract.limitations.join('; '));
-        check.command=['@node','@typescript-bin:.',
-          ...scripts[script].trim().split(/\s+/).slice(1)];
-        check.cwd='.';
-        check.inputs=['package.json','pnpm-lock.yaml',
-          ...(exists(path.join(root,'pnpm-workspace.yaml'))?['pnpm-workspace.yaml']:[]),
-          'tsconfig.json','src/**'];
+    if(recipe!=='node-script'&&pm.name==='pnpm'&&kind==='typecheck'&&!workspaces&&!pm.issue&&(script===undefined||tscRuns(scripts[script]))){
+      try{
+        parts=tscChecks('typecheck',script??null,scripts,run=>{
+          const contract=pnpmTypecheckInputs(root,'.',run);
+          if(contract.limitations.length)throw Error(contract.limitations.join('; '));
+          return {command:['@node','@typescript-bin:.',...run.args],cwd:'.',
+            inputs:[...new Set(['package.json','pnpm-lock.yaml',
+              ...(exists(path.join(root,'pnpm-workspace.yaml'))?['pnpm-workspace.yaml']:[]),
+              ...contractInputs(contract)])]};});
         classification={level:'ready',reason:'pnpm TypeScript inputs and installation; checked again before reuse',
           qualification:'pnpm-tsc-v1'};}
       catch(e){classification={level:'recording',reason:`pnpm TypeScript contract needs review: ${e.message}`};}
     }
+    if((auto||recipe==='node-script')&&script&&generalKinds.includes(kind)&&classification.level!=='ready'&&!observationIssue){
+      try{
+        const general=generalCheck(root,kind,script);
+        checks.push({config:general.config,level:'ready',qualification:scriptQualification,
+          reason:`general recipe: ${general.manager} runs script ${JSON.stringify(script)} with REDUE's recorder in every Node process; the whole checkout is its input`});
+        continue;
+      }catch(e){classification={...classification,reason:`General recipe unavailable (${e.message}); ${classification.reason}`};}
+    }
+    if(!script&&classification.level!=='ready')continue;
+    if(parts&&classification.level==='ready'){
+      for(const part of parts)checks.push({config:{...check,...part,qualification:classification.qualification},...classification});
+      continue;
+    }
     if(classification.qualification)check.qualification=classification.qualification;
     checks.push({config:check,...classification});
   }
@@ -238,6 +317,16 @@ export function discoverNodeProject(root,{recipe=null}={}) {
         const selected=selectScript(kind,names,member.scripts||{});
         if(selected.ambiguous){ambiguous.push({kind:`${name}:${kind}`,
           scripts:selected.ambiguous});continue;}
+        // A pnpm package with a tsconfig.json and no typecheck script gets a
+        // proposed `tsc --noEmit` check when the pnpm contract holds.
+        if(!selected.script&&kind==='typecheck'&&pm.name==='pnpm'&&!pm.issue&&
+          proposable(path.join(root,dir),member.scripts)&&!typechecks(scripts)){
+          try{for(const part of tscChecks(`${name}:typecheck`,null,{},run=>pnpmCheck(root,name,dir,file,run)))
+            checks.push({config:{kind,workspace:name,qualification:'pnpm-tsc-v1',...part},level:'ready',
+              reason:'proposed tsc --noEmit for the package\'s tsconfig.json; pnpm workspace TypeScript inputs; checked again before reuse'});}
+          catch{}
+          continue;
+        }
         if(!selected.script)continue;
         const command=pm.name==='npm'?['@which:npm','run',selected.script,
           '--workspace',name]:pm.name==='yarn'?
@@ -245,7 +334,7 @@ export function discoverNodeProject(root,{recipe=null}={}) {
           ['@which:pnpm','--filter',name,'run',selected.script];
         const check={name:`${name}:${kind}`,kind,command,
           inputs:['package.json',...(pm.lockfiles||[]),`${dir}/**`,
-            `!${dir}/node_modules/**`]};
+            `!${dir}/node_modules/**`,`!${dir}/**/node_modules/**`]};
         let level=pm.issue&&pm.name!=='pnpm'?'unsupported':'recording';
         let reason=pm.issue||'workspace script found; shared configuration and installed inputs need review';
         if(!pm.issue&&pm.name==='yarn'&&pm.layout==='node-modules/classic'&&
@@ -258,20 +347,11 @@ export function discoverNodeProject(root,{recipe=null}={}) {
             level='ready';reason='pinned Yarn workspace tsc and installed inputs; checked again before reuse';
           }catch(e){reason=`workspace TypeScript contract needs review: ${e.message}`;}
         }
-        if(!pm.issue&&pm.name==='pnpm'&&kind==='typecheck'&&
-          /^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(
-            (member.scripts||{})[selected.script]?.trim()||'')&&
-          !member.scripts?.['pre'+selected.script]&&!member.scripts?.['post'+selected.script]){
-          try{const contract=pnpmTypecheckInputs(root,name,selected.script);
-            if(contract.limitations.length)throw Error(contract.limitations.join('; '));
-            check.workspace=name;check.qualification='pnpm-tsc-v1';
-            check.script=selected.script;
-            check.cwd=dir;
-            check.command=['@node',`@typescript-bin:${dir}`,
-              ...member.scripts[selected.script].trim().split(/\s+/).slice(1)];
-            check.inputs=['package.json','pnpm-lock.yaml','pnpm-workspace.yaml',file,
-              `${dir}/src/**`];
-            level='ready';reason='pnpm workspace TypeScript inputs; checked again before reuse';
+        if(!pm.issue&&pm.name==='pnpm'&&kind==='typecheck'&&tscRuns((member.scripts||{})[selected.script])){
+          try{const parts=tscChecks(`${name}:typecheck`,selected.script,member.scripts,run=>pnpmCheck(root,name,dir,file,run));
+            for(const part of parts)checks.push({config:{kind,workspace:name,qualification:'pnpm-tsc-v1',...part},level:'ready',
+              reason:'pnpm workspace TypeScript inputs; checked again before reuse'});
+            continue;
           }catch(e){reason=`pnpm TypeScript contract needs review: ${e.message}`;}
         }
         if(recipe==='tests-direct'&&kind==='test'&&!pm.issue){