@redue/cli 0.1.0-alpha.3 → 0.1.0-alpha.30

package/src/observation.mjs

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import {mark,traceEnvironment} from './decision-profile.mjs';
 import path from 'node:path';
 import {randomUUID} from 'node:crypto';
 import {fork} from 'node:child_process';
@@ -8,16 +9,39 @@ import {fileURLToPath} from 'node:url';
 // subscription is healthy; history may accelerate catch-up; a fresh scan is
 // the deterministic fallback. A failed history operation never updates cursor.
 const workerFile=path.join(path.dirname(fileURLToPath(import.meta.url)),'history-worker.mjs');
+// Each query runs in a fresh helper: a reused native history session can take
+// ten times longer. The next helper is forked once a query settles, so its
+// startup is off the decision path. A failed or late helper is killed.
+let spare=null,queue=Promise.resolve(),closed=false;
+// After the observer's last query no helper is kept or started.
+export function closeHistory() {closed=true;spare?.kill('SIGKILL');spare=null;}
+function startHelper() {
+  const child=fork(workerFile,[],{stdio:['ignore','ignore','ignore','ipc'],env:traceEnvironment()});
+  child.abandoned=new Set();child.on('error',()=>{});
+  child.once('exit',()=>{if(spare===child)spare=null;
+    child.reply?.({ok:false,lost:Error(`history helper exited ${child.exitCode??child.signalCode}`)});
+    for(const next of child.abandoned)try{fs.unlinkSync(next);}catch{}});
+  return child;
+}
 export function history(root,cursor,backend,deadlineMs,faultFile) {
+  const run=()=>query(root,cursor,backend,deadlineMs,faultFile);
+  const result=queue.then(run,run);queue=result.catch(()=>{});return result;
+}
+function query(root,cursor,backend,deadlineMs,faultFile) {
   const next=cursor+'.'+randomUUID()+'.next';
   return new Promise((resolve,reject)=>{
-    const worker=fork(workerFile,[root,fs.existsSync(cursor)?cursor:'',next,backend,
-      faultFile||''],{stdio:['ignore','ignore','ignore','ipc']});
-    let settled=false,abandoned=false;
+    mark('history.submit',{deadlineMs});
+    const worker=spare??startHelper();spare=null;
+    worker.ref();worker.channel?.ref();
+    let settled=false;
     const finish=(error,value)=>{
-      if(settled)return;settled=true;clearTimeout(timer);
+      if(settled)return;settled=true;worker.reply=null;clearTimeout(timer);
+      mark('history.complete',{childPid:worker.pid,outcome:error?.code||error?.name||'ok',events:value?.length});
+      if(error)worker.abandoned.add(next);
       worker.kill('SIGKILL');
-      if(error){abandoned=true;try{fs.unlinkSync(next);}catch{}
+      // A failed query disables history for this observer; keep no helper.
+      if(!closed&&!error){spare=startHelper();spare.unref();spare.channel?.unref();}
+      if(error){try{fs.unlinkSync(next);}catch{}
         reject(error);return;}
       try{fs.renameSync(next,cursor);resolve(value);}
       catch(e){try{fs.unlinkSync(next);}catch{}reject(e);}
@@ -26,12 +50,10 @@ export function history(root,cursor,backend,deadlineMs,faultFile) {
       const e=Error(`history query did not settle within ${deadlineMs} ms`);
       e.code='ETIMEDOUT';finish(e);
     },deadlineMs);
-    worker.on('message',message=>message.ok?finish(null,message.changes):
-      finish(Object.assign(Error(message.error),{code:message.code})));
-    worker.once('error',e=>finish(e));
-    worker.once('exit',(code,signal)=>{
-      if(abandoned)try{fs.unlinkSync(next);}catch{}
-      if(!settled)finish(Error(`history helper exited ${code??signal}`));
-    });
+    worker.reply=message=>message.lost?finish(message.lost):message.ok?finish(null,message.changes):
+      finish(Object.assign(Error(message.error),{code:message.code}));
+    worker.on('message',message=>worker.reply?.(message));
+    try{worker.send({root,previous:fs.existsSync(cursor)?cursor:'',next,backend,faultFile:faultFile||''});}
+    catch(e){finish(e);}
   });
 }

package/src/path-identity.mjs

@@ -41,3 +41,11 @@ export function validInputRelative(rel,platform=process.platform) {
     rel.includes('\\')))return false;
   return true;
 }
+
+// File identity fields. Any write changes ctime, but timestamps tick in
+// milliseconds: a file changed within the racy window could be rewritten in the
+// same tick at the same size without changing them (git's racy rule).
+export const identityFields=['dev','ino','mode','nlink','size','mtimeNs','ctimeNs'];
+export const racyWindowMs=2000;
+// ctime, which no ordinary tool can set ahead, ends the window.
+export const racyUntil=st=>Number(st.ctimeNs/1000000n)+racyWindowMs;

package/src/plan-worker.mjs

@@ -3,11 +3,14 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {discover} from './plan.mjs';
-import {InputIndex} from './index.mjs';
+import {InputIndex,dehydrateIndex} from './index.mjs';
+import {directProject,directQualification} from './direct-typescript.mjs';
+import {checkRun} from './typescript-invocation.mjs';
 import {queriesMatch} from './typescript-list.mjs';
 import {planGuard,inputKey} from './decision-validation.mjs';
-import {timing} from './decision-profile.mjs';
+import {timing,traceBase} from './decision-profile.mjs';
 
+traceBase(workerData.diagnostic);
 try {
   const totalStarted=performance.now();
   const configStarted=performance.now();
@@ -21,7 +24,16 @@ try {
     try{
       guard=planGuard(bundle);
       const queryStarted=performance.now();
-      const queriesValid=!workerData.reuse.queries?.length||queriesMatch(workerData.reuse.queries);
+      // Cached membership queries load the compiler API; establish its reviewed
+      // implementation before that optimization can execute project code.
+      // Every direct check (a chain has one per run) uses the root's compiler:
+      // its bytes are verified once.
+      const directRoots=new Set(config.checks.filter(check=>check.qualification===directQualification)
+        .map((check,i)=>directProject(config.root,checkRun(check),{verify:i===0}).tsRoot));
+      if(directRoots.size&&(workerData.reuse.queries||[]).some(([kind,,,options])=>
+        kind==='readDirectory'&&!directRoots.has(options?.tsRoot)))throw Error('retained compiler implementation changed');
+      const queriesValid=guard===workerData.reuse.guard&&
+        (!workerData.reuse.queries?.length||queriesMatch(workerData.reuse.queries));
       timing('worker.compiler_queries',queryStarted,{queries:workerData.reuse.queries?.length||0,matched:queriesValid?1:0});
       if(guard!==workerData.reuse.guard||!queriesValid)reuseReason='configuration_or_resolution_changed';
       else {
@@ -104,26 +116,14 @@ try {
     const outside=new InputIndex({root:boundary,plans},{trackGit:false,includeInstalled:true});
     outside.coldScan();
     if(outside.unavailable)throw Error(outside.unavailable);
-    external[boundary]={files:[...outside.files],
-      aliasDependencies:[...outside.aliasDependencies].map(([name,refs])=>[name,[...refs]]),
-      rows:[...outside.checks]
-      .map(([name,row])=>({name,files:[...row.files],sum:row.sum.toString('hex'),
-        revision:row.revision,lastReason:row.lastReason})),
-      eventCount:outside.eventCount,rehashedFiles:outside.rehashedFiles,
-      rehashedBytes:outside.rehashedBytes,profile:outside.profile};
+    external[boundary]=dehydrateIndex(outside);
   }
   timing('worker.total',totalStarted,{mode:'cold',files:index.files.size});
   parentPort.postMessage({ok:true,bundle,discoveryMs,indexingMs,guard,planReused,
     inputKeys:Object.fromEntries([...index.checks].map(([name,row])=>[name,inputKey(row)])),
     restartMode:'cold-index',
     external,
-    index:{files:[...index.files],
-      aliasDependencies:[...index.aliasDependencies].map(([name,refs])=>[name,[...refs]]),
-      rows:[...index.checks].map(([name,row])=>({
-      name,files:[...row.files],sum:row.sum.toString('hex'),revision:row.revision,
-      lastReason:row.lastReason})),
-    eventCount:index.eventCount,rehashedFiles:index.rehashedFiles,
-    rehashedBytes:index.rehashedBytes,profile:index.profile}});
+    index:dehydrateIndex(index)});
   }
 } catch(error) {
   parentPort.postMessage({ok:false,error:error?.message||String(error),

package/src/pnpm-inputs.mjs

@@ -1,21 +1,27 @@
-// Pinned pnpm 12 node-modules installation provider. The engine sees only
+// pnpm 9-12 node-modules installation provider. The engine sees only
 // repository-relative input sets and resolution relationships, never pnpm
 // virtual-store names as semantic identities.
-import {compilerFiles} from './typescript-list.mjs';
+import {probeTimeLeft} from './probe-deadline.mjs';
+import {compilerApiIssue,compilerFiles} from './typescript-list.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import {createRequire} from 'node:module';
 import {execFileSync,spawnSync} from 'node:child_process';
-import micromatch from './glob.mjs';
-import YAML from 'yaml';
+import micromatch,{patternMatcher} from './glob.mjs';
 import {resolveLinks} from './installed-inputs.mjs';
 import {withinPath as within,realObservedPath,samePath} from './path-identity.mjs';
 import {timing} from './decision-profile.mjs';
+import {npmrc} from './npmrc.mjs';
+import {runConfig,tscRun,tscRuns} from './typescript-invocation.mjs';
 
 const rel=(root,file)=>path.relative(root,file).split(path.sep).join('/');
 const read=file=>JSON.parse(fs.readFileSync(file,'utf8'));
 const exists=file=>{try{fs.lstatSync(file);return true;}catch{return false;}};
-function yaml(file){
+// Loaded on first use: the parser takes about 40 ms to load, and every
+// command imports this module.
+let YAML=null;
+export function yaml(file){
+  YAML??=createRequire(import.meta.url)('yaml');
   const doc=YAML.parseDocument(fs.readFileSync(file,'utf8'),{uniqueKeys:true});
   if(doc.errors.length)throw Error(`${path.basename(file)} cannot be interpreted safely`);
   return doc.toJS()||{};
@@ -26,40 +32,67 @@ function safePatterns(values){
     throw Error('pnpm workspace patterns are unsupported');
   return values;
 }
+// The supported pnpm majors. pnpm 9 reads settings from .npmrc, pnpm 10 from
+// pnpm-workspace.yaml first and then .npmrc, pnpm 11 and 12 from
+// pnpm-workspace.yaml only.
+export const pnpmMajors=[9,10,11,12];
+// Settings that move or copy installed files, or run code during install,
+// where the contract does not look; by pnpm-workspace.yaml and .npmrc name.
+// Other settings change only what gets installed, and the installed files are
+// what the contract observes. These are refused when either file sets them,
+// whichever file the installed pnpm reads. Only the project's files are read:
+// user or global rc files and npm_config_* variables at install time are not.
+const refused=[['modulesDir','modules-dir'],['virtualStoreDir','virtual-store-dir'],['lockfileDir','lockfile-dir'],
+  ['enableGlobalVirtualStore','enable-global-virtual-store'],['injectWorkspacePackages','inject-workspace-packages'],
+  ['sharedWorkspaceLockfile','shared-workspace-lockfile'],['pnpmfile','pnpmfile'],['globalPnpmfile','global-pnpmfile'],
+  ['configDependencies','config-dependencies']];
+// Whether a refused setting is set: present at all, except that only
+// sharedWorkspaceLockfile=false and injectWorkspacePackages=true move files.
+const setting=(key,value)=>value!==undefined&&
+  (key==='sharedWorkspaceLockfile'?value===false:key==='injectWorkspacePackages'?value===true:true);
 export function pnpmProjectInfo(root){
   root=realObservedPath(root);
   const pkg=read(path.join(root,'package.json'));
-  const pin=/^pnpm@(12\.\d+\.\d+)(?:\+[^\s]+)?$/.exec(pkg.packageManager||'');
-  if(!pin)throw Error('an exact pnpm 12 packageManager pin is required');
+  // A pin is optional; when present it names pnpm 9-12, and the install must match it.
+  const pin=pkg.packageManager===undefined?null:/^pnpm@((\d+)\.\d+\.\d+)(?:\+[^\s]+)?$/.exec(pkg.packageManager);
+  if(pkg.packageManager!==undefined&&(!pin||!pnpmMajors.includes(Number(pin[2]))))
+    throw Error(`packageManager ${JSON.stringify(String(pkg.packageManager).split('+')[0])} is outside pnpm ${pnpmMajors[0]}-${pnpmMajors.at(-1)}`);
   const workspaceFile=path.join(root,'pnpm-workspace.yaml');
-  const settings=exists(workspaceFile)?yaml(workspaceFile):{};
-  const patterns=safePatterns(settings.packages||[]);
-  const linker=settings.nodeLinker||'isolated';
-  return {version:pin[1],linker,patterns,settings};
+  const workspace=exists(workspaceFile)?yaml(workspaceFile):{},rc=npmrc(path.join(root,'.npmrc'));
+  const patterns=safePatterns(workspace.packages||[]);
+  // The linker the given pnpm major reads; without a major, the one any reads.
+  const linkerFor=major=>(major===9?rc['node-linker']:major>=11?workspace.nodeLinker:
+    workspace.nodeLinker??rc['node-linker'])||'isolated';
+  const major=pin?Number(pin[2]):null;
+  return {version:pin?.[1]??null,linker:linkerFor(major),linkerFor,patterns,settings:workspace,
+    refused:refused.filter(([key,name])=>setting(key,workspace[key])||setting(key,rc[name])).map(([key])=>key)};
 }
 export function pnpmInstallInfo(root){
   const started=performance.now();
   root=realObservedPath(root);
-  const pkg=read(path.join(root,'package.json'));
-  const {version,linker,patterns,settings}=pnpmProjectInfo(root);
+  const {version,linkerFor,patterns,settings,refused}=pnpmProjectInfo(root);
   const workspaceFile=path.join(root,'pnpm-workspace.yaml');
-  if(!['isolated','hoisted'].includes(linker))throw Error(`pnpm ${linker} linker is recording-only`);
-  if(settings.modulesDir||settings.virtualStoreDir||settings.enableGlobalVirtualStore)
-    throw Error('custom pnpm modules or virtual-store location is recording-only');
-  if(settings.injectWorkspacePackages)
-    throw Error('injected workspace dependencies are recording-only');
-  if(settings.sharedWorkspaceLockfile===false)
-    throw Error('separate workspace lockfiles are recording-only');
-  if(exists(path.join(root,'.pnpmfile.cjs'))||exists(path.join(root,'.pnpmfile.mjs')))
+  if(refused.some(key=>['pnpmfile','globalPnpmfile','configDependencies'].includes(key))||
+    exists(path.join(root,'.pnpmfile.cjs'))||exists(path.join(root,'.pnpmfile.mjs')))
     throw Error('custom pnpm installation hooks need review');
+  if(refused.some(key=>['modulesDir','virtualStoreDir','lockfileDir','enableGlobalVirtualStore'].includes(key)))
+    throw Error('custom pnpm modules or virtual-store location is recording-only');
+  if(refused.includes('injectWorkspacePackages'))throw Error('injected workspace dependencies are recording-only');
+  if(refused.includes('sharedWorkspaceLockfile'))throw Error('separate workspace lockfiles are recording-only');
   const modulesFile=path.join(root,'node_modules','.modules.yaml');
   if(!exists(modulesFile))throw Error('installed pnpm module metadata is missing');
   const modules=yaml(modulesFile);
-  if(modules.nodeLinker!==linker||modules.packageManager!==pkg.packageManager)
+  const installed=/^pnpm@((\d+)\.\d+\.\d+)$/.exec(String(modules.packageManager));
+  if(!installed||!pnpmMajors.includes(Number(installed[2])))
+    throw Error(`installed by ${JSON.stringify(String(modules.packageManager))}, outside pnpm ${pnpmMajors[0]}-${pnpmMajors.at(-1)}`);
+  const linker=linkerFor(Number(installed[2]));
+  if(!['isolated','hoisted'].includes(linker))throw Error(`pnpm ${linker} linker is recording-only`);
+  if(modules.nodeLinker!==linker||version!==null&&installed[1]!==version)
     throw Error('installed pnpm linker or version differs from project configuration');
   const virtualStore=path.join(root,'node_modules','.pnpm');
-  // pnpm 12 on Windows can omit virtualStoreDir when using its project-local
-  // default. Accept only the observed, ordinary local directory in that case.
+  // pnpm can omit virtualStoreDir when using its project-local default
+  // (seen with pnpm 12 on Windows). Accept only the observed, ordinary local
+  // directory in that case.
   const declared=modules.virtualStoreDir;
   const selected=declared===undefined?virtualStore:
     path.resolve(path.dirname(modulesFile),declared);
@@ -71,18 +104,8 @@ export function pnpmInstallInfo(root){
     throw Error('nonstandard or incomplete project-local pnpm virtual store');
   if(!exists(path.join(root,'pnpm-lock.yaml')))
     throw Error('pnpm lockfile is missing');
-  if(exists(path.join(root,'.npmrc'))){
-    // pnpm 12 reads project settings from pnpm-workspace.yaml. Registry/auth
-    // entries affect acquisition, not a completed local TypeScript invocation.
-    for(const line of fs.readFileSync(path.join(root,'.npmrc'),'utf8').split(/\r?\n/)){
-      const trimmed=line.trim();if(!trimmed||/^[#;]/.test(trimmed))continue;
-      const key=trimmed.split('=')[0].trim();
-      if(key!=='registry'&&!/^\/\/[^\s]+\/:_authToken$/.test(key))
-        throw Error('project .npmrc has execution-relevant pnpm settings requiring review');
-    }
-  }
   timing('pnpm.install_metadata',started);
-  return {version,linker,patterns,settings,modulesFile,
+  return {version:installed[1],linker,patterns,settings,modulesFile,
     configurationInputs:['package.json','pnpm-lock.yaml',
       ...(exists(workspaceFile)?['pnpm-workspace.yaml']:[]),
       ...(exists(path.join(root,'.npmrc'))?['.npmrc']:[]),
@@ -96,7 +119,7 @@ export function pnpmWorkspacePackages(root,patterns){
   const files=execFileSync('git',['ls-files','--cached','--others','--exclude-standard',
     '-z','--',':(glob)**/package.json'],{cwd:root,
     env:{...process.env,GIT_OPTIONAL_LOCKS:'0'},maxBuffer:32*1024*1024,
-    timeout:5000}).toString().split('\0').filter(Boolean);
+    timeout:probeTimeLeft(5000)}).toString().split('\0').filter(Boolean);
   for(const file of files){
     const dir=path.posix.dirname(file);
     if(dir==='.'||dir.split('/').includes('node_modules')||
@@ -172,16 +195,37 @@ function packageAt(root,requester,name){
   }
   return {physical:null,candidates};
 }
-function parsedTypeScript(root,dir,ts){
-  const config=path.join(root,dir,'tsconfig.json'),reads=new Set();
+// Files TypeScript may consume from its own include: each directory its
+// include patterns watch for new files (TypeScript's own
+// wildcardDirectories), and each file it lists. node_modules below them is
+// left out, as TypeScript's wildcards leave it out; installed files a program
+// reads are installed inputs. `exclude` entries stay inputs: an import can
+// still reach an excluded file.
+const sourceFiles='*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json}';
+function sourcePatterns(root,parsed){
+  const patterns=new Set(),excluded=new Set();
+  for(const [folder,flags] of Object.entries(parsed.wildcardDirectories||{})){
+    // TypeScript 4 lowercases these keys on case-insensitive file systems;
+    // the native realpath gives the directory's own spelling.
+    let at;try{at=fs.realpathSync.native(folder);}catch{at=path.resolve(folder);}
+    if(!within(at,root))throw Error('TypeScript source membership escapes the checkout');
+    const prefix=rel(root,at)?rel(root,at)+'/':'';
+    if(flags&1){patterns.add(`${prefix}**/${sourceFiles}`);excluded.add(`!${prefix}**/node_modules/**`);}
+    else patterns.add(prefix+sourceFiles);
+  }
+  const included=patternMatcher([...patterns,...excluded]);
+  for(const file of parsed.fileNames.map(name=>path.resolve(name))){
+    if(!within(file,root))throw Error('TypeScript source membership escapes the checkout');
+    if(!included(rel(root,file)))patterns.add(rel(root,file));
+  }
+  return [...patterns,...excluded];
+}
+function parsedTypeScript(root,dir,ts,configName='tsconfig.json'){
+  const config=path.join(root,dir,configName),reads=new Set();
   const host={...ts.sys,readFile(file){reads.add(path.resolve(file));return ts.sys.readFile(file);},
     onUnRecoverableConfigFileDiagnostic(){}};
   const parsed=ts.getParsedCommandLineOfConfigFile(config,{},host);
   if(!parsed||parsed.errors?.length)throw Error('TypeScript configuration unavailable');
-  const raw=ts.readConfigFile(config,ts.sys.readFile);
-  if(raw.error||!Array.isArray(raw.config?.include)||raw.config.include.length!==1||
-    !/^src(?:$|\/)/.test(raw.config.include[0]))
-    throw Error('TypeScript source file membership is outside the supported src include');
   if(parsed.options.plugins?.length||parsed.options.incremental||parsed.options.composite||
     parsed.projectReferences?.length||parsed.options.paths||parsed.options.baseUrl||
     parsed.options.rootDirs?.length||parsed.options.typeRoots?.length||
@@ -193,16 +237,17 @@ function parsedTypeScript(root,dir,ts){
     throw Error('TypeScript module resolver is outside the supported Node contract');
   for(const file of reads)if(!within(realObservedPath(file),root))
     throw Error('TypeScript configuration escapes the checkout');
-  return {parsed,configs:[...reads].map(file=>rel(root,file)).sort()};
+  return {parsed,configs:[...reads].map(file=>rel(root,file)).sort(),
+    sourcePatterns:sourcePatterns(root,parsed)};
 }
-function listedTypeScriptFiles(root,selected,tsc){
+function listedTypeScriptFiles(root,selected,tsc,configName){
   // --listFilesOnly resolves the compiler's effective module/file set but
   // performs no typecheck and emits no project outputs.
-  const out=spawnSync(process.execPath,[tsc,'-p','tsconfig.json','--listFilesOnly'],
+  const out=spawnSync(process.execPath,[tsc,'-p',configName,'--listFilesOnly'],
     {cwd:path.join(root,selected.dir),env:process.env,encoding:'utf8',
       // The native NTFS public workspace takes 3-5 s to list ~770 inputs;
       // 5 s sometimes expired despite bounded, progressing compiler work.
-      timeout:10000,maxBuffer:32*1024*1024,stdio:['ignore','pipe','pipe']});
+      timeout:probeTimeLeft(10000),maxBuffer:32*1024*1024,stdio:['ignore','pipe','pipe']});
   if(out.error||out.signal||out.status!==0)
     throw Error('TypeScript input listing is unavailable');
   const files=out.stdout.trim().split(/\r?\n/).filter(Boolean)
@@ -235,26 +280,35 @@ function sharedHardlinkIn(folder){
   }
   return false;
 }
-export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}={}){
+// `run`: the check's {script, part, args}, or a script name for its only run.
+export function pnpmTypecheckInputs(root,workspace,run,{captureQueries=false}={}){
   const totalStarted=performance.now();
   root=realObservedPath(root);
   const install=pnpmInstallInfo(root),members=pnpmWorkspacePackages(root,install.patterns);
   const selected=workspace==='.'?{name:'.',dir:'.',manifest:'package.json',
     pkg:read(path.join(root,'package.json'))}:members.get(workspace);
   if(!selected)throw Error(`workspace ${workspace} is not declared`);
-  if(!/^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(
-    selected.pkg.scripts?.[script]?.trim()||'')||
-    selected.pkg.scripts?.['pre'+script]||selected.pkg.scripts?.['post'+script])
-    throw Error('typecheck must be one standalone TypeScript invocation');
+  // A script name stands for its only run.
+  if(typeof run==='string'){const runs=tscRuns(selected.pkg.scripts?.[run]);run={script:run,args:runs?.length===1?runs[0].args:[]};}
+  const {run:own,issue}=tscRun(selected.pkg.scripts,run);
+  if(issue)throw Error(`typecheck must be standalone TypeScript runs: ${issue}`);
+  // `tsc -p .` without --noEmit predates the other forms.
+  if(!own.noEmit&&!['-p .','-p tsconfig.json'].includes(run.args.join(' ')))
+    throw Error('typecheck must pass --noEmit');
+  const configName=runConfig(path.join(root,selected.dir),run.args);
+  if(!configName)throw Error('TypeScript project is outside the package');
   const selectedDir=path.join(root,selected.dir),lookup=createRequire(path.join(selectedDir,'package.json'));
   let tsPackage;try{tsPackage=realObservedPath(lookup.resolve('typescript/package.json'));}
   catch{throw Error('installed TypeScript compiler cannot be resolved');}
   if(!within(tsPackage,root))throw Error('TypeScript compiler is outside the observed checkout');
-  const tsRoot=path.dirname(tsPackage),ts=lookup('typescript');
+  const tsRoot=path.dirname(tsPackage),apiIssue=compilerApiIssue(tsRoot);
+  if(apiIssue)throw Error(apiIssue);
+  const ts=lookup('typescript');
   const tsc=path.join(tsRoot,'bin','tsc');
   if(!exists(tsc))throw Error('installed TypeScript executable is missing');
   const configStarted=performance.now();
-  const {configs}=parsedTypeScript(root,selected.dir,ts);
+  const {configs,sourcePatterns:sources}=parsedTypeScript(root,selected.dir,ts,configName);
+  const isSource=patternMatcher(sources);
   timing('pnpm.ts_config',configStarted,{configs:configs.length});
   const closure=new Map(),installed=new Set(),generated=new Set(),
     links=new Set(),candidates=new Set(),absences=[],instances=new Map();
@@ -304,12 +358,12 @@ export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}
     resolutionMs:Math.round(resolutionMs),workspaceLinks:links.size,
     candidates:candidates.size});
   const listingStarted=performance.now();
-  const captured=captureQueries?compilerFiles(tsRoot,path.join(root,selected.dir)):null;
-  const files=captured?captured.files.map(realObservedPath):listedTypeScriptFiles(root,selected,tsc);
+  const captured=captureQueries?compilerFiles(tsRoot,path.join(root,selected.dir),configName):null;
+  const files=captured?captured.files.map(realObservedPath):listedTypeScriptFiles(root,selected,tsc,configName);
   timing('pnpm.ts_input_listing',listingStarted,{files:files.length});
   const mappingStarted=performance.now();
   for(const file of files){
-    if(within(file,path.join(selectedDir,'src'))||
+    if(isSource(rel(root,file))||
       [...closure.values()].some(member=>within(file,path.join(root,member.dir))))continue;
     const packageRoot=installedPackageRoot(root,file);
     if(!packageRoot)throw Error(`TypeScript consumes a file outside the observed pnpm contract: ${rel(root,file)}`);
@@ -320,6 +374,16 @@ export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}
   }
   timing('pnpm.input_mapping',mappingStarted,{instances:instances.size,
     installedPatterns:installed.size});
+  // A config extended from an installed package is an installed input too:
+  // source patterns leave node_modules out.
+  for(const config of configs){
+    const file=realObservedPath(path.join(root,config));
+    if(!within(file,path.join(root,'node_modules')))continue;
+    const packageRoot=installedPackageRoot(root,file);
+    if(!packageRoot)throw Error(`TypeScript configuration ${config} is outside an installed package`);
+    installed.add(`${rel(root,packageRoot)}/**`);
+    installed.add(`!${rel(root,packageRoot)}/node_modules/**`);
+  }
   installed.add(`${rel(root,tsRoot)}/**`);
   installed.add(`!${rel(root,tsRoot)}/node_modules/**`);
   if(!instances.has(tsRoot))instances.set(tsRoot,{name:'typescript',physicalRoot:rel(root,tsRoot)});
@@ -328,11 +392,12 @@ export function pnpmTypecheckInputs(root,workspace,script,{captureQueries=false}
   timing('pnpm.hardlink_inspection',sharedStarted,{instances:instances.size,
     shared:shared.length});
   const source=[...new Set([...install.configurationInputs,selected.manifest,
-    ...configs,`${selected.dir==='.'?'':selected.dir+'/'}src/**`,
+    ...configs,...sources,
     ...closure.values().map(member=>member.manifest),...generated])];
   timing('pnpm.total_discovery',totalStarted,{instances:instances.size,
     inputFiles:files.length});
   return {install,workspace:selected,closure:[...closure.values()],source,
+    sourcePatterns:sources,args:run.args,
     installed:[...installed],generated:[...generated],
     // The read-only state probe consumes this same resolved compiler file set.
     // It is deliberately omitted from the persisted user-facing input plan.