@redue/cli 0.1.0-alpha.2 → 0.1.0-alpha.21

package/src/typescript-input-facts.mjs

@@ -0,0 +1,92 @@
+// Extracted from the existing npm TypeScript probe; shared compiler input logic.
+import fs from 'node:fs';import path from 'node:path';import {createHash} from 'node:crypto';
+import {createRequire} from 'node:module';import {spawnSync} from 'node:child_process';
+import {compilerFiles} from './typescript-list.mjs';
+import {buildInfoFor} from './direct-typescript.mjs';
+import {probeTimeLeft} from './probe-deadline.mjs';
+import {withinPath as within,realObservedPath} from './path-identity.mjs';
+import {timing} from './decision-profile.mjs';
+const require=createRequire(import.meta.url),hash=value=>createHash('sha256').update(value).digest('hex');
+const digestFile=file=>hash(fs.readFileSync(file));
+const fail=code=>{throw Object.assign(Error(code),{code});};
+export function typeScriptInputFacts(root,tsRoot,tsc,config='tsconfig.json'){
+  const configReads=new Set(),visited=new Set(),referenced=[];
+  let buildInfo=null;
+  let ts;try{ts=require(tsRoot);}catch{}
+  if(typeof ts?.getParsedCommandLineOfConfigFile==='function'){
+    const host={...ts.sys,readFile(file){configReads.add(path.resolve(file));
+      return ts.sys.readFile(file);},onUnRecoverableConfigFileDiagnostic(){}};
+    const parseConfig=(file,top=false)=>{
+      const absolute=path.resolve(file);
+      if(!within(absolute,root))fail('typescript-config-outside-repository');
+      if(visited.has(absolute))return;visited.add(absolute);
+      if(visited.size>64)fail('typescript-config-graph-too-large');
+      const parsed=ts.getParsedCommandLineOfConfigFile(absolute,{},host);
+      if(!parsed||parsed.errors?.length)fail('typescript-config-unavailable');
+      if(parsed.options?.plugins?.length)fail('typescript-plugin-unsupported');
+      // Plain tsc reads a referenced config but never builds it, so only the
+      // root config's build settings matter. An incremental root reads and
+      // writes one build-info file, which must be inside the checkout.
+      if(top){
+        if(parsed.options?.composite)fail('typescript-incremental-unsupported');
+        const found=buildInfoFor(ts,parsed.options,root);
+        if(found.issue)fail(found.issue);
+        buildInfo=found.file||null;
+      }else referenced.push(parsed);
+      for(const reference of parsed.projectReferences||[])
+        parseConfig(reference.path.endsWith('.json')?reference.path:
+          path.join(reference.path,'tsconfig.json'));
+    };
+    parseConfig(path.join(root,config),true);
+  }else{
+    // TypeScript 7's native compiler does not expose the previous config API.
+    // Its CLI reports the effective config; restrict this path to one direct
+    // config rather than guessing about extends/reference provenance.
+    const file=path.join(root,config),raw=fs.readFileSync(file,'utf8');
+    if(/"(?:extends|references|plugins|incremental|composite)"\s*:/.test(raw))
+      fail('typescript-config-graph-unsupported');
+    const shown=spawnSync(process.execPath,[tsc,'--showConfig','-p',config],{cwd:root,
+      env:process.env,encoding:'utf8',timeout:probeTimeLeft(4000),maxBuffer:16*1024*1024,
+      stdio:['ignore','pipe','pipe']});
+    if(shown.error||shown.signal||shown.status!==0)fail('typescript-config-unavailable');
+    const effective=JSON.parse(shown.stdout);
+    if(effective.compilerOptions?.plugins?.length||
+      effective.compilerOptions?.incremental||effective.compilerOptions?.composite)
+      fail('typescript-config-graph-unsupported');
+    configReads.add(file);
+  }
+  for(const file of configReads)if(!within(realObservedPath(file),root))
+    fail('typescript-config-outside-repository');
+  const listingStarted=performance.now();
+  const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(tsRoot,root,config):null;
+  const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'--noEmit','--listFilesOnly','-p',config],
+    {cwd:root,env:process.env,encoding:'utf8',timeout:probeTimeLeft(process.platform==='win32'?10000:4000),
+      maxBuffer:16*1024*1024,
+      stdio:['ignore','pipe','pipe']});
+  timing('typescript_contract.list_files',listingStarted,{status:listed.status??null,
+    error:listed.error?.code||null});
+  if(listed.error||listed.signal||listed.status!==0)fail('typescript-input-list-unavailable');
+  const files=listed.stdout.trim().split(/\r?\n/).filter(Boolean)
+    .map(file=>path.resolve(file));
+  if(!files.length||files.some(file=>!within(realObservedPath(file),root)))
+    fail('typescript-input-outside-repository');
+  // A program that uses a referenced project's sources or outputs depends on
+  // that project's build, which plain tsc does not run. tsc redirects only
+  // TypeScript sources; a shared .d.ts or .json is an ordinary input.
+  const declaration=/\.d\.[cm]?ts$|\.json$/;
+  const sources=new Set(),outputs=new Set(),outDirs=[];
+  for(const parsed of referenced){
+    const dirs=[parsed.options.outDir,parsed.options.declarationDir].filter(Boolean).map(dir=>path.resolve(dir));
+    outDirs.push(...dirs);
+    for(const file of parsed.fileNames.map(name=>path.resolve(name)))if(!declaration.test(file)){
+      sources.add(file);if(!dirs.length)outputs.add(file.replace(/\.[cm]?tsx?$/,ext=>ext.replace(/tsx?$/,'d.ts')));}
+  }
+  if(files.some(file=>sources.has(file)||outputs.has(file)||outDirs.some(dir=>within(file,dir))))
+    fail('typescript-project-reference-consumed');
+  // Every hashed configuration must also be a certified question.
+  const queries=captured?.queries&&[...configReads].every(file=>
+    captured.queries.some(([kind,read])=>kind==='readFile'&&read===file))?captured.queries:null;
+  return {configs:[...configReads].sort().map(file=>[file,digestFile(file)]),
+    files:[...new Set(files)].sort().map(file=>[file,digestFile(file)]),queries,
+    ...(buildInfo?{buildInfo}:{})};
+}

package/src/typescript-invocation.mjs

@@ -0,0 +1,92 @@
+// The package-script forms of a standalone TypeScript check: one `tsc` run, or
+// several joined by `&&`, each with these arguments in any order:
+// --noEmit, -p/--project PATH, --skipLibCheck, --pretty [true|false].
+// Anything else (tsc -b, --watch, other options, other commands) is not one.
+import fs from 'node:fs';
+import path from 'node:path';
+
+// No shell metacharacters; a leading @ would read as a REDUE token.
+const word=/^[A-Za-z0-9_./+-][A-Za-z0-9_./@+-]*$/;
+// More runs than this is not a script REDUE splits into checks.
+const maxRuns=16;
+function parseRun(words){
+  if(words[0]!=='tsc'||!words.every(value=>word.test(value)))return null;
+  let project=null,noEmit=false;
+  for(let i=1;i<words.length;i++){
+    const value=words[i];
+    if(value==='-p'||value==='--project'){
+      if(project!==null||!words[i+1]||words[i+1].startsWith('-'))return null;
+      project=words[++i];
+    }else if(value==='--noEmit')noEmit=true;
+    else if(value==='--pretty'){if(['true','false'].includes(words[i+1]))i++;}
+    else if(value!=='--skipLibCheck')return null;
+  }
+  return {args:words.slice(1),project,noEmit};
+}
+// The runs of a script, as [{args, project, noEmit}], or null.
+export function tscRuns(text){
+  if(typeof text!=='string'||!text.trim())return null;
+  const parts=text.trim().split(/[ \t]+&&[ \t]+/);
+  if(parts.length>maxRuns)return null;
+  const runs=parts.map(part=>parseRun(part.split(/[ \t]+/)));
+  return runs.every(Boolean)?runs:null;
+}
+// The run a check makes: its `script` (null for a check init proposed without
+// one), the tsc arguments after the compiler in its command, and `count`, the
+// number of configured checks for that script (more than one for a chain).
+// Returns {run} with the parsed run, or {issue} when the arguments are outside
+// the forms, or the script no longer has exactly `count` runs, one of them
+// with exactly these arguments.
+export function tscRun(scripts,{script=null,args,count=1}){
+  if(!Array.isArray(args)||!args.every(value=>typeof value==='string'))return {issue:'TypeScript arguments are invalid'};
+  const own=parseRun(['tsc',...args]);
+  if(!own)return {issue:'TypeScript arguments are outside the supported forms'};
+  if(script===null)return {run:own};
+  if(typeof scripts?.[script]!=='string')return {issue:'typecheck script was removed'};
+  if(scripts['pre'+script]||scripts['post'+script])return {issue:'typecheck script has pre or post scripts'};
+  const runs=tscRuns(scripts[script]);
+  if(runs?.length!==count||!runs.some(run=>JSON.stringify(run.args)===JSON.stringify(args)))
+    return {issue:'typecheck script changed'};
+  return {run:own};
+}
+// The config file a run names, relative to the directory `dir` it runs in
+// (posix): tsconfig.json without -p, a directory's tsconfig.json, or null
+// when it leaves that directory or the arguments are not a run.
+export function runConfig(dir,args){
+  const run=parseRun(['tsc',...args]);
+  if(!run)return null;
+  let file=path.posix.normalize((run.project??'tsconfig.json').split(path.sep).join('/'));
+  let directory=false;try{directory=fs.statSync(path.join(dir,file)).isDirectory();}catch{}
+  if(!file.endsWith('.json')||directory)file=path.posix.join(file,'tsconfig.json');
+  if(path.posix.isAbsolute(file)||file==='..'||file.startsWith('../'))return null;
+  return file;
+}
+// The check names for a script's runs: the kind's name for one run, and
+// NAME.1 ... NAME.n for a chain (not #: the hook refuses it and zsh may glob it).
+export const partName=(name,index,count)=>count===1?name:`${name}.${index}`;
+// Probe arguments for a run, and back: SCRIPT (or -), COUNT, then the tsc
+// arguments.
+export const runArgv=({script=null,args,count=1})=>[script??'-',String(count),...args];
+export function runFromArgv(values){
+  const [script,count,...args]=values;
+  if(typeof script!=='string'||!script||!/^[1-9]\d?$/.test(count||''))throw Object.assign(Error('probe-arguments'),{code:'probe-arguments'});
+  return {script:script==='-'?null:script,args,count:Number(count)};
+}
+// The run a configured check makes: its script, the arguments after the
+// compiler in its command, and how many checks the config has for the script
+// (`runCount`, set when the config is loaded).
+export const checkRun=check=>({script:check.script??null,
+  args:Array.isArray(check.command)?check.command.slice(2):[],count:check.runCount??1});
+// A script's checks in the order of its runs: one check per run with the same
+// arguments ({name, args} each), as names; null when they do not correspond.
+export function scriptRunChecks(text,checks){
+  const runs=tscRuns(text);
+  if(!runs||runs.length!==checks.length)return null;
+  const left=[...checks],names=[];
+  for(const run of runs){
+    const at=left.findIndex(check=>JSON.stringify(check.args)===JSON.stringify(run.args));
+    if(at<0)return null;
+    names.push(left.splice(at,1)[0].name);
+  }
+  return names;
+}

package/src/typescript-list.mjs

@@ -5,55 +5,122 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {createRequire} from 'node:module';
+import {identityFields,racyUntil} from './path-identity.mjs';
 const require=createRequire(import.meta.url);
 const hash=value=>createHash('sha256').update(JSON.stringify(value)).digest('hex');
 export function queryAnswer(kind,file,options) {
   try{
-    if(kind==='readDirectory')return require(options.tsRoot).sys.readDirectory(file,...options.args).sort();
+    if(kind==='readDirectory')return require(options.tsRoot).sys.readDirectory(file,
+      ...options.args.map((value,i)=>options.undefinedArguments?.includes(i)?undefined:value)).sort();
     if(kind==='readFile')return hash(fs.readFileSync(file,'utf8'));
     if(kind==='fileExists')return fs.statSync(file).isFile();
     if(kind==='directoryExists')return fs.statSync(file).isDirectory();
-    if(kind==='realpath')return fs.realpathSync(file);
+    // The compiler resolves through realpathSync.native outside Windows.
+    if(kind==='realpath')return process.platform==='win32'?fs.realpathSync(file):fs.realpathSync.native(file);
     if(kind==='directories')return fs.readdirSync(file,{withFileTypes:true})
       .filter(entry=>entry.isDirectory()||entry.isSymbolicLink()&&
         fs.statSync(path.join(file,entry.name)).isDirectory()).map(entry=>entry.name).sort();
     // Directory entries include names/types, including newly created candidates.
     if(kind==='entries')return fs.readdirSync(file,{withFileTypes:true})
       .map(entry=>[entry.name,entry.isDirectory()?'d':entry.isSymbolicLink()?'l':'f']).sort();
+    // A compiler directory listing: subdirectories and files with a requested
+    // extension, classifying links by their targets as matchFiles does.
+    if(kind==='listing'){
+      const suffixes=options?.extensions?.map(value=>value.toLowerCase());
+      return fs.readdirSync(file,{withFileTypes:true}).flatMap(entry=>{
+        let type=entry;
+        if(entry.isSymbolicLink())try{type=fs.statSync(path.join(file,entry.name));}catch{return [];}
+        if(type.isDirectory())return [[entry.name,'d']];
+        if(type.isFile()&&(!suffixes||suffixes.some(value=>entry.name.toLowerCase().endsWith(value))))
+          return [[entry.name,'f']];
+        return [];
+      }).sort();
+    }
     throw Error('unknown compiler filesystem question');
   }catch(error){if(['ENOENT','ENOTDIR'].includes(error.code))return null;throw error;}
 }
+// Null when every run fact answers as it did during the run, otherwise the
+// first path that does not. Asked in-process; nothing is launched.
+export function runFactChange(facts) {
+  if(!Array.isArray(facts))return 'an unreadable run fact';
+  for(const fact of facts){
+    if(!Array.isArray(fact)||!['fileExists','directoryExists','realpath','readFile','entries'].includes(fact[0])||
+      typeof fact[1]!=='string')return 'an unreadable run fact';
+    const [kind,file,answer]=fact;
+    let now;try{now=queryAnswer(kind,file);}catch{return file;}
+    // A test run's directory listings are arrays.
+    if(kind==='entries'?JSON.stringify(now)!==JSON.stringify(answer):now!==answer)return file;
+  }
+  return null;
+}
+// Why a receipt's run facts no longer hold, or null when they all do.
+export function runFactReason(facts) {
+  const changed=runFactChange(facts);
+  return changed&&`a lookup the last run made answers differently now: ${changed}`;
+}
 export function queriesMatch(queries) {
   if(!queries?.length)return false;
   return queries.every(([kind,file,answer,options])=>
     JSON.stringify(queryAnswer(kind,file,options))===JSON.stringify(answer));
 }
-export function compilerFiles(tsRoot,cwd) {
+export function compilerFiles(tsRoot,cwd,config='tsconfig.json') {
   const require=createRequire(import.meta.url),ts=require(tsRoot);
   if(typeof ts.createProgram!=='function'||typeof ts.createCompilerHost!=='function')return null;
   const queries=new Map();
-  const remember=(kind,file)=>{
-    const full=path.resolve(file),answer=queryAnswer(kind,full);
-    queries.set(kind+'\0'+full,[kind,full,answer]);return answer;
+  const remember=(kind,file,options)=>{
+    const full=path.resolve(file),answer=queryAnswer(kind,full,options);
+    queries.set(kind+'\0'+full+(options?JSON.stringify(options):''),
+      options?[kind,full,answer,options]:[kind,full,answer]);return answer;
   };
   const readFile=file=>{remember('readFile',file);return ts.sys.readFile(file);};
   const fileExists=file=>{remember('fileExists',file);return ts.sys.fileExists(file);};
   const directoryExists=file=>{remember('directoryExists',file);return ts.sys.directoryExists(file);};
   const getDirectories=file=>{remember('directories',file);return ts.sys.getDirectories(file);};
   const readDirectory=(dir,...args)=>{
-    const result=ts.sys.readDirectory(dir,...args);
-    const full=path.resolve(dir),options={tsRoot,args};
+    // Reviewed compilers enumerate each visited directory through fs.readdirSync.
+    // Record those listings as ordinary questions so a validator without the
+    // compiler API can replay this answer; the listing itself stays authoritative.
+    const listed=[],readdirSync=fs.readdirSync;
+    fs.readdirSync=function(file,...rest){listed.push(path.resolve(String(file)));
+      return readdirSync.call(this,file,...rest);};
+    let result;try{result=ts.sys.readDirectory(dir,...args);}finally{fs.readdirSync=readdirSync;}
+    // JSON turns undefined array entries into null. TypeScript distinguishes
+    // them (an omitted exclude list is not a null list), so retain that fact.
+    const full=path.resolve(dir),options={tsRoot,args,argsVersion:1,
+      undefinedArguments:args.flatMap((value,i)=>value===undefined?[i]:[])};
+    const visited=new Set(listed);
+    if(typeof ts.getFileMatcherPatterns==='function'&&
+      result.every(file=>visited.has(path.dirname(path.resolve(file)))))try{
+      // Base paths and symlinked directories reach matchFiles through realpath
+      // deduplication without a listing; a retargeted link changes this answer.
+      for(const base of ts.getFileMatcherPatterns(full,args[1],args[2],
+        ts.sys.useCaseSensitiveFileNames,process.cwd()).basePaths)remember('realpath',base);
+      const extensions=Array.isArray(args[0])?args[0]:null;
+      for(const directory of visited){
+        // matchFiles also resolves every visited directory to detect cycles.
+        remember('realpath',directory);
+        remember('listing',directory,{extensions});
+        let entries=[];
+        try{entries=fs.readdirSync(directory,{withFileTypes:true});}
+        catch(error){if(!['ENOENT','ENOTDIR'].includes(error.code))throw error;}
+        for(const entry of entries)
+          if(entry.isSymbolicLink())remember('realpath',path.join(directory,entry.name));
+      }
+      options.covered=1;
+    }catch{/* uncovered listings are replayed only through the compiler API */}
     queries.set('readDirectory\0'+full+JSON.stringify(args),
       ['readDirectory',full,[...result].sort(),options]);
     return result;
   };
-  const parsed=ts.getParsedCommandLineOfConfigFile(path.join(cwd,'tsconfig.json'),{},
-    {...ts.sys,readFile,fileExists,directoryExists,getDirectories,readDirectory,
+  const realpath=file=>{remember('realpath',file);return ts.sys.realpath(file);};
+  // `extends` of a package config resolves through realpath too.
+  const parsed=ts.getParsedCommandLineOfConfigFile(path.join(cwd,config),{},
+    {...ts.sys,readFile,fileExists,directoryExists,getDirectories,readDirectory,realpath,
       onUnRecoverableConfigFileDiagnostic(){}});
   if(!parsed||parsed.errors?.length)throw Error('TypeScript configuration unavailable');
   const host=ts.createCompilerHost(parsed.options);
-  Object.assign(host,{readFile,fileExists,directoryExists,getDirectories,
-    realpath(file){remember('realpath',file);return ts.sys.realpath(file);},
+  Object.assign(host,{readFile,fileExists,directoryExists,getDirectories,readDirectory,
+    realpath,
     getSourceFile(file,languageVersion,onError){
       const text=readFile(file);return text===undefined?undefined:
         ts.createSourceFile(file,text,languageVersion);
@@ -64,5 +131,33 @@ export function compilerFiles(tsRoot,cwd) {
   // Stable answers are necessary even at first capture; a concurrent edit
   // cannot become the basis for a reusable discovery result.
   const facts=[...queries.values()];
-  return {files,queries:queriesMatch(facts)?facts:null};
+  // A certificate must cover every program file. Referenced configurations
+  // are parsed through this host, so their reads and listings are certified.
+  const complete=files.every(file=>queries.has('readFile\0'+file));
+  return {files,queries:complete&&queriesMatch(facts)?facts:null};
+}
+// Identity of a read file and, for a link, of its target. Writes through any
+// alias change ctime. A file changed within the last 2 s has no identity, so a
+// coarse timestamp cannot hide a second write in the same tick (git's racy rule).
+export function fileIdentity(file,now=Date.now()) {
+  try{const link=fs.lstatSync(file,{bigint:true}),target=link.isSymbolicLink()?fs.statSync(file,{bigint:true}):link;
+    if(racyUntil(link)>=now||racyUntil(target)>=now)return null;
+    const fields=st=>identityFields.map(key=>String(st[key]));
+    return JSON.stringify([fields(target),target===link?null:[fs.realpathSync(file),...fields(link)]]);}
+  catch(error){if(['ENOENT','ENOTDIR'].includes(error.code))return null;throw error;}
+}
+// In-process replay of a certificate. Covered directory listings are checked
+// through their recorded listings instead of loading the compiler API. A read
+// file is re-hashed until a match records its identity, taken before the read,
+// and again whenever that identity changes.
+export function queriesHold(queries,identities=new Map()) {
+  if(!queries?.length)return false;
+  return queries.every(([kind,file,answer,options])=>{
+    if(kind==='readDirectory')return options?.covered===1;
+    const identity=kind==='readFile'?fileIdentity(file):null;
+    if(identity&&identities.get(file)===identity)return true;
+    const held=JSON.stringify(queryAnswer(kind,file,options))===JSON.stringify(answer);
+    if(kind==='readFile'){if(held&&identity)identities.set(file,identity);else identities.delete(file);}
+    return held;
+  });
 }

package/src/typescript-qualification.mjs

@@ -1,25 +1,45 @@
+import {directProject,directQualification,directEnvironment} from './direct-typescript.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import {realObservedPath} from './path-identity.mjs';
+import {checkRun,runArgv} from './typescript-invocation.mjs';
 
 // This is a machine-enforced contract, not a claim inferred from a script name.
-// The read-only runtime probe separately checks the effective TypeScript file
-// list, config graph, npm toolchain and caller context on every sync/run.
+// Runtime validation checks effective compiler membership, configuration and
+// toolchain identity. Supported discovery certificates still validate those
+// filesystem queries; caller context is independently compared at the decision.
 export function qualifyTypeScript(root,selected,discovered={}) {
+  if(selected.qualification===directQualification){
+    const issues=[];
+    try{
+      const compiler=directProject(root,checkRun(selected));
+      if(selected.command?.[0]!==process.execPath||
+        selected.command[1]!==compiler.entry||selected.cwd&&selected.cwd!=='.')issues.push('direct compiler invocation changed');
+    }catch(e){issues.push(e.code||'direct compiler prerequisites unavailable');}
+    if(!selected.inputs?.includes('**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json,jsonc}')||
+      !selected.inputs?.includes('package.json')||!selected.inputs?.includes('tsconfig.json')||
+      !selected.installedInputs?.includes('node_modules/**'))issues.push('direct compiler source/config/installed inputs incomplete');
+    if(!selected.environment?.executableIdentity||
+      !directEnvironment.variables.every(key=>selected.environment?.variables?.includes(key))||
+      !directEnvironment.prefixes.every(key=>selected.environment?.prefixes?.includes(key)))
+      issues.push('direct compiler execution context incomplete');
+    if(selected.probes?.length!==1||!selected.probes?.some(argv=>path.basename(argv[1]||'')==='direct-typescript-probe.mjs'&&
+      argv[0]===process.execPath&&argv[2]===root&&
+      JSON.stringify(argv.slice(3))===JSON.stringify(runArgv(checkRun(selected)))))issues.push('direct compiler probe missing');
+    return {qualified:issues.length===0,issues};
+  }
   if(selected.qualification==='pnpm-tsc-v1'){
     const issues=[];
     const workspace=selected.workspace||'.';
-    const script=selected.script||selected.command?.at(-1);
     try{
       if(discovered.issue)throw Error(discovered.issue);
       const contract=discovered.workspace;
       if(!contract)throw Error('pnpm TypeScript input discovery unavailable');
       issues.push(...contract.limitations);
-      const declared=contract.workspace.pkg.scripts[script].trim().split(/\s+/).slice(1);
+      // The arguments are checked against the script by the contract itself.
       if(path.resolve(root,selected.cwd||'.')!==path.join(root,contract.workspace.dir)||
         selected.command?.[0]!==process.execPath||
-        selected.command?.[1]!==contract.tsc||
-        JSON.stringify(selected.command.slice(2))!==JSON.stringify(declared))
+        selected.command?.[1]!==contract.tsc)
         issues.push('standalone TypeScript invocation changed');
     }catch(e){issues.push(e.message);}
     if(!selected.probes?.some(argv=>path.basename(argv[1]||'')==='pnpm-typecheck-probe.mjs'))
@@ -50,47 +70,7 @@ export function qualifyTypeScript(root,selected,discovered={}) {
     return {qualified:issues.length===0,issues};
   }
   if(selected.qualification!=='typescript-noemit-v1')return null;
-  const issues=[];
-  let pkg;
-  try{pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));}
-  catch{issues.push('package manifest unavailable');}
-  if(!selected.script||pkg?.scripts?.[selected.script]?.trim()!=='tsc --noEmit'||
-    pkg?.scripts?.['pre'+selected.script]||pkg?.scripts?.['post'+selected.script])
-    issues.push('typecheck script is not the supported standalone tsc --noEmit invocation');
-  if(selected.command?.length!==3||selected.command[1]!=='run'||
-    selected.command[2]!==selected.script)
-    issues.push('package-manager invocation differs from the discovered script');
-  try{const npm=fs.realpathSync(selected.command[0]);
-    const supported=process.platform==='win32'?path.basename(npm).toLowerCase()==='npm.cmd'&&
-      fs.existsSync(path.join(path.dirname(npm),'node_modules','npm','bin','npm-cli.js')):
-      path.basename(npm)==='npm-cli.js'&&
-      path.basename(path.dirname(path.dirname(npm)))==='npm';
-    if(!supported)
-      issues.push('npm executable layout is not supported');}
-  catch{issues.push('npm executable unavailable');}
-  if(!fs.existsSync(path.join(root,'tsconfig.json')))
-    issues.push('tsconfig.json is missing');
-  if(!fs.existsSync(path.join(root,'node_modules','typescript','package.json'))||
-    !fs.existsSync(path.join(root,'node_modules','.bin',
-      process.platform==='win32'?'tsc.cmd':'tsc')))
-    issues.push('local TypeScript installation is missing');
-  if(!selected.inputs?.includes('**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json,jsonc}')||
-    !selected.inputs?.includes('package.json')||
-    !selected.inputs?.includes('tsconfig.json'))
-    issues.push('TypeScript source/config file-set declaration is incomplete');
-  if(!selected.installedInputs?.includes('node_modules/**'))
-    issues.push('installed package contents and membership are not declared');
-  if(!selected.environment?.executableIdentity||
-    !['node','npm'].every(name=>selected.environment?.pathExecutables?.includes(name))||
-    !['NODE_OPTIONS','NODE_PATH','HOME','BASH_ENV','ENV'].every(name=>
-      selected.environment?.variables?.includes(name))||
-    !['npm_config_','DYLD_','TSGO_'].every(name=>
-      selected.environment?.prefixes?.includes(name)))
-    issues.push('caller toolchain or execution context declaration is incomplete');
-  if(!selected.probes?.some(argv=>path.basename(argv[1]||'')==='typescript-contract-probe.mjs'&&
-    argv[2]&&fs.existsSync(argv[2])&&
-    realObservedPath(argv[2])===root&&argv[3]===selected.script&&
-    argv[4]===selected.command[0]))
-    issues.push('TypeScript input and toolchain probe is missing');
-  return {qualified:issues.length===0,issues};
+  // Retired automatic launcher contract: npm's notifier consumes unobserved
+  // remote/cache/time state. A successful execution is still an outcome.
+  return {qualified:false,issues:['npm launcher applicability is unqualified: update notification uses unobserved remote/cache/time inputs; run the npm script when needed']};
 }

package/src/workspace-manifests.mjs

@@ -0,0 +1,24 @@
+// Workspace package manifests: package.json files Git tracks or would add,
+// in directories that match the workspace patterns, outside node_modules.
+import fs from 'node:fs';
+import path from 'node:path';
+import {spawnSync} from 'node:child_process';
+import {patternMatcher} from './glob.mjs';
+
+// Up to 1000 packages: every workspace node_modules is an installed input of
+// a root check, so all of them are listed.
+export function workspaceManifests(root,patterns,limit=1000) {
+  const listing=spawnSync('git',['ls-files','--cached','--others','--exclude-standard',
+    '-z','--',':(glob)**/package.json'],{cwd:root,encoding:'utf8',timeout:5000,
+    maxBuffer:32*1024*1024,stdio:['ignore','pipe','ignore'],
+    env:{...process.env,GIT_OPTIONAL_LOCKS:'0'}});
+  if(listing.status!==0||listing.error)throw Error('workspace package manifests cannot be inspected');
+  // `!pattern` entries exclude, as in pnpm-workspace.yaml.
+  const included=patternMatcher(patterns);
+  const matched=listing.stdout.split('\0').filter(Boolean).filter(file=>{
+    const dir=path.posix.dirname(file);
+    return dir!=='.'&&!dir.split('/').includes('node_modules')&&included(dir);
+  }).sort();
+  if(matched.length>limit)throw Error(`more than ${limit} workspace packages found; select checks explicitly`);
+  return matched.map(file=>({file,pkg:JSON.parse(fs.readFileSync(path.join(root,file),'utf8'))}));
+}

package/src/yarn-workspace-typecheck-probe.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 // Read-only applicability probe. Its output is one digest or a fixed reason;
 // source, configuration, environment values, and command output are not logged.
+import {probeTimeLeft} from './probe-deadline.mjs';
 import {compilerFiles} from './typescript-list.mjs';
 import {contextOnly,probeResult} from './probe-result.mjs';
 import fs from 'node:fs';
@@ -79,7 +80,7 @@ try{
   const tsc=yarnLocalTsc(root);
   const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(path.join(root,'node_modules/typescript'),cwd):null;
   const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'-p','.','--listFilesOnly'],
-    {cwd,env:process.env,encoding:'utf8',timeout:4000,maxBuffer:16*1024*1024,
+    {cwd,env:process.env,encoding:'utf8',timeout:probeTimeLeft(4000),maxBuffer:16*1024*1024,
       stdio:['ignore','pipe','pipe']});
   if(listed.error||listed.signal||listed.status!==0)fail('typescript-input-list-unavailable');
   const inputs=listed.stdout.trim().split(/\r?\n/).filter(Boolean)