@redue/cli 0.1.0-alpha.3 → 0.1.0-alpha.5

package/src/node-onboarding.mjs

@@ -1,3 +1,4 @@
+import {directProject,directQualification} from './direct-typescript.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import {spawnSync} from 'node:child_process';
@@ -116,7 +117,7 @@ function classify(kind,scriptName,script,pkg,managerInfo,root) {
     managerInfo.name==='npm'&&
     exists(path.join(root,'tsconfig.json'))&&
     exists(path.join(root,'node_modules/typescript/package.json')))
-    return {level:'ready',reason:'canonical local tsc --noEmit; checked again before reuse',
+    return {level:'recording',reason:'npm launcher uses unobserved remote/cache/time inputs; execution can be recorded, but cannot be reused',
       qualification:'typescript-noemit-v1'};
   if(kind==='typecheck')return {level:'recording',reason:
     'TypeScript invocation, installation, or configuration is outside the automatic noEmit contract'};
@@ -159,7 +160,8 @@ function workspaceManifests(root,patterns) {
   if(matched.length>50)throw Error('more than 50 workspace packages found; select checks explicitly');
   return matched.map(file=>({file,pkg:readJson(path.join(root,file))}));
 }
-export function discoverNodeProject(root) {
+export function discoverNodeProject(root,{recipe=null}={}) {
+  if(recipe&&recipe!=='typescript-direct')throw Error('unknown recipe; use typescript-direct');
   root=realObservedPath(root);
   const packageFile=path.join(root,'package.json');
   if(!exists(packageFile))throw Error('run init from a repository containing package.json');
@@ -183,9 +185,18 @@ export function discoverNodeProject(root) {
     if(!script)continue;
     let classification=observationIssue?{level:'unsupported',reason:observationIssue}:
       classify(kind,script,scripts[script],pkg,pm,root);
-    if(workspaces&&classification.level==='ready')classification={level:'recording',
+    if(workspaces&&classification.qualification==='typescript-noemit-v1')classification={level:'recording',
       reason:'workspace task and installed-input closure need explicit qualification'};
     const check={name:kind,script,kind,inputs:sourceInputs(root,kind,pm.lockfiles||[])};
+    if(recipe==='typescript-direct'&&kind==='typecheck'){
+      try{
+        if(pm.name!=='npm'||workspaces||observationIssue||pm.issue)throw Error('direct recipe requires a supported single-package npm checkout');
+        const compiler=directProject(root,script);
+        check.command=['@node','@typescript-compiler:.','--noEmit'];check.cwd='.';
+        classification={level:'ready',qualification:directQualification,
+          reason:`explicit local TypeScript ${compiler.version} compilation; npm launcher/lifecycle scripts are not executed; package.json stays unchanged`};
+      }catch(e){classification={level:'recording',reason:`Direct recipe unavailable (${e.code||e.message}); original npm script retained, without bypassing required behavior`};}
+    }
     if(pm.name==='pnpm'&&kind==='typecheck'&&!workspaces&&!pm.issue&&
       /^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(scripts[script].trim())){
       try{const contract=pnpmTypecheckInputs(root,'.',script);

package/src/npm-typecheck-environment.mjs

@@ -0,0 +1,36 @@
+// Admission for the standalone npm 10.9.2 -> tsc --noEmit contract only.
+// Values are never returned: the caller separately fingerprints every original
+// npm_config_* key/value (including case and empty values).
+import path from 'node:path';
+export const npmEnvironmentInterpretation = 'npm-tsc-environment@2';
+const proxyKeys = new Set(['proxy', 'https_proxy', 'http_proxy', 'noproxy']);
+export function npmTypecheckEnvironmentIssue(env, {npmVersion, platform = process.platform} = {}) {
+  if (env.NODE_OPTIONS || env.NODE_PATH || env.BASH_ENV || env.ENV)
+    return 'execution-environment-unsupported';
+  const seen = new Map();
+  for (const [key, value] of Object.entries(env)) {
+    if (/^(DYLD_|TSGO_)/i.test(key)) return 'execution-environment-unsupported';
+    if (!/^npm_config_/i.test(key)) continue;
+    if (/^npm_config_prefix$/i.test(key) && platform === 'win32' && path.win32.isAbsolute(value)) continue;
+    const suffix = key.slice('npm_config_'.length).toLowerCase();
+    if (!proxyKeys.has(suffix)) return 'execution-environment-unsupported';
+    // http_proxy is an unknown, inert pass-through key in this inspected npm
+    // version, not an alias for proxy. Other npm versions require source review.
+    if (npmVersion !== '10.9.2') return 'npm-proxy-version-unsupported';
+    if (seen.has(suffix) && seen.get(suffix) !== value)
+      return 'npm-proxy-context-ambiguous';
+    seen.set(suffix, value);
+    if (typeof value !== 'string' || /[\x00-\x1f\x7f]/.test(value))
+      return 'npm-proxy-value-unsupported';
+    // npm ignores empty environment config, but passes the original environment
+    // to the child. Empty and absent remain distinct caller identities.
+    if (value === '' || (suffix === 'proxy' && value === 'false')) continue;
+    if (suffix === 'noproxy') continue;
+    try {
+      const url = new URL(value);
+      if (!['http:', 'https:'].includes(url.protocol) || !url.hostname)
+        return 'npm-proxy-value-unsupported';
+    } catch { return 'npm-proxy-value-unsupported'; }
+  }
+  return null;
+}

package/src/plan-worker.mjs

@@ -4,6 +4,7 @@ import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {discover} from './plan.mjs';
 import {InputIndex} from './index.mjs';
+import {directProject,directQualification} from './direct-typescript.mjs';
 import {queriesMatch} from './typescript-list.mjs';
 import {planGuard,inputKey} from './decision-validation.mjs';
 import {timing} from './decision-profile.mjs';
@@ -21,7 +22,14 @@ try {
     try{
       guard=planGuard(bundle);
       const queryStarted=performance.now();
-      const queriesValid=!workerData.reuse.queries?.length||queriesMatch(workerData.reuse.queries);
+      // Cached membership queries load the compiler API; establish its reviewed
+      // implementation before that optimization can execute project code.
+      const directRoots=new Set(config.checks.filter(check=>check.qualification===directQualification)
+        .map(check=>directProject(config.root,check.script).tsRoot));
+      if(directRoots.size&&(workerData.reuse.queries||[]).some(([kind,,,options])=>
+        kind==='readDirectory'&&!directRoots.has(options?.tsRoot)))throw Error('retained compiler implementation changed');
+      const queriesValid=guard===workerData.reuse.guard&&
+        (!workerData.reuse.queries?.length||queriesMatch(workerData.reuse.queries));
       timing('worker.compiler_queries',queryStarted,{queries:workerData.reuse.queries?.length||0,matched:queriesValid?1:0});
       if(guard!==workerData.reuse.guard||!queriesValid)reuseReason='configuration_or_resolution_changed';
       else {

package/src/presentation.mjs

@@ -33,6 +33,7 @@ export function renderExplain(value,name) {
   return rows.map(row=>{
     const lines=[`${row.name}: ${checkLabel(row)}${row.result?` / ${row.result}`:''}`];
     if(row.result==='FAIL')lines.push(`Historical failure; applicability: ${row.freshness}.`);
+    if(row.verification_recipe==='npm-direct-typescript@1')lines.push('Recorded recipe: direct local TypeScript compiler; npm and lifecycle scripts were not executed.');
     lines.push(explanation(row));
     if(row.changed_inputs?.length)lines.push('Relevant inputs changed:',...row.changed_inputs.map(file=>`  ${file}`));
     if(row.freshness==='STALE')lines.push(`Due again when verification is needed: redue run ${JSON.stringify(row.name)}`);

package/src/project-location.mjs

@@ -0,0 +1,34 @@
+// Shared project selection only; evidence and caller-context semantics stay in the kernel.
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+import {realObservedPath} from './path-identity.mjs';
+import {stateIdentity,userStateBase} from './platform-state.mjs';
+
+export function discoverConfig(cwd=process.cwd()) {
+  let dir=path.resolve(cwd);const found=[];
+  for(;;){
+    for(const name of ['redue.config.json','vstate.config.json']) {
+      const file=path.join(dir,name);
+      if(fs.existsSync(file))found.push(file);
+    }
+    if(fs.existsSync(path.join(dir,'.git'))||path.dirname(dir)===dir)break;
+    dir=path.dirname(dir);
+  }
+  if(found.length>1)throw Error('multiple REDUE configurations apply; select the intended one with --config FILE');
+  return found[0]||path.resolve(cwd,'redue.config.json');
+}
+export function canonicalConfig(configFile) {
+  return path.join(realObservedPath(path.dirname(configFile)),path.basename(configFile));
+}
+export function projectState(root,configFile) {
+  return path.join(userStateBase(process.platform,process.env,os.homedir()),'vstate',
+    `vstate-${createHash('sha256').update(stateIdentity(root)+'\0'+stateIdentity(canonicalConfig(configFile))).digest('hex').slice(0,16)}`);
+}
+export function readProject(configFile) {
+  const config=JSON.parse(fs.readFileSync(configFile,'utf8'));
+  if(config.schema!==1||!Array.isArray(config.checks)||!config.checks.length)
+    throw Error('config needs schema 1 and at least one check');
+  return {config,root:realObservedPath(path.resolve(path.dirname(configFile),config.root||'.'))};
+}

package/src/typescript-contract-probe.mjs

@@ -1,188 +1,5 @@
 #!/usr/bin/env node
-// Read-only applicability probe for the deliberately narrow npm/tsc --noEmit
-// contract. It emits one digest; failures emit only a fixed diagnostic code.
-import {compilerFiles} from './typescript-list.mjs';
-import {contextOnly,probeResult} from './probe-result.mjs';
-import fs from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-import {createHash} from 'node:crypto';
-import {createRequire} from 'node:module';
-import {spawnSync} from 'node:child_process';
-import {withinPath as within,realObservedPath} from './path-identity.mjs';
-import {timing} from './decision-profile.mjs';
-
-const [rootArg,scriptName,npmArg]=process.argv.slice(2);
-const hash=value=>createHash('sha256').update(value).digest('hex');
-const fail=code=>{throw Object.assign(Error(code),{code});};
-const digestFile=file=>hash(fs.readFileSync(file));
-const require=createRequire(import.meta.url);
-function treeHash(dir){
-  const digest=createHash('sha256');let count=0;
-  const visit=(folder,rel='')=>{
-    for(const entry of fs.readdirSync(folder,{withFileTypes:true}).sort((a,b)=>
-      a.name.localeCompare(b.name))){
-      const name=rel?rel+'/'+entry.name:entry.name,full=path.join(folder,entry.name);
-      if(entry.isDirectory())visit(full,name);
-      else if(entry.isFile()){digest.update(name+'\0'+digestFile(full)+'\0');count++;}
-      else fail('npm-installation-unobservable');
-    }
-  };
-  visit(dir);return [digest.digest('hex'),count];
-}
-function npmRcKeys(file){
-  if(!fs.existsSync(file))return null;
-  const keys=[];
-  for(const line of fs.readFileSync(file,'utf8').split(/\r?\n/)){
-    const trimmed=line.trim();if(!trimmed||/^[#;]/.test(trimmed))continue;
-    const at=trimmed.indexOf('=');if(at<0)fail('npm-configuration-unsupported');
-    const key=trimmed.slice(0,at).trim();
-    if(key!=='registry'&&!/^\/\/[^\s]+\/:_authToken$/.test(key))
-      fail('npm-configuration-unsupported');
-    keys.push(key);
-  }
-  return keys.sort();
-}
-try{
-  if(!rootArg||!scriptName||!npmArg)fail('probe-arguments');
-  const root=realObservedPath(rootArg),npm=realObservedPath(npmArg);
-  const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));
-  if(pkg.scripts?.[scriptName]?.trim()!=='tsc --noEmit'||
-    pkg.scripts?.['pre'+scriptName]||pkg.scripts?.['post'+scriptName])
-    fail('typecheck-script-changed');
-  if(process.env.NODE_OPTIONS||process.env.NODE_PATH||process.env.BASH_ENV||
-    process.env.ENV||Object.entries(process.env).some(([key,value])=>{
-      if(/^npm_config_prefix$/i.test(key)&&process.platform==='win32'){
-        // The Windows runner supplies a global npm prefix independently of
-        // the selected local compiler. Its value is part of caller context.
-        return !path.isAbsolute(value);
-      }
-      return /^(npm_config_|DYLD_|TSGO_)/i.test(key);
-    }))fail('execution-environment-unsupported');
-  let npmRoot;
-  if(process.platform==='win32'){
-    if(path.basename(npm).toLowerCase()!=='npm.cmd')
-      fail('npm-installation-layout-unsupported');
-    npmRoot=path.join(path.dirname(npm),'node_modules','npm');
-    const body=fs.readFileSync(npm,'utf8');
-    if(!body.includes('node_modules\\npm\\bin\\npm-cli.js')||
-      !body.includes('node_modules\\npm\\bin\\npm-prefix.js')||
-      !body.includes('"%NODE_EXE%" "%NPM_CLI_JS%" %*'))
-      fail('npm-installation-layout-unsupported');
-    const prefix=spawnSync(process.execPath,[path.join(npmRoot,'bin','npm-prefix.js')],
-      {cwd:root,env:process.env,encoding:'utf8',timeout:4000,stdio:['ignore','pipe','ignore']});
-    const selectedPrefix=prefix.stdout?.trim();
-    if(prefix.error||prefix.status!==0||!selectedPrefix||
-      !path.isAbsolute(selectedPrefix))fail('npm-installation-layout-unsupported');
-    // npm.cmd selects the prefix's CLI only when that file exists. Otherwise
-    // it runs the bundled CLI beside npm.cmd; observe the same branch here.
-    const alternate=path.join(selectedPrefix,'node_modules','npm','bin','npm-cli.js');
-    if(fs.existsSync(alternate)&&
-      realObservedPath(alternate)!==realObservedPath(path.join(npmRoot,'bin','npm-cli.js')))
-      fail('npm-installation-layout-unsupported');
-  }else npmRoot=path.dirname(path.dirname(npm));
-  if(path.basename(npmRoot)!=='npm'||path.basename(path.dirname(npmRoot))!=='node_modules')
-    fail('npm-installation-layout-unsupported');
-  const home=process.platform==='win32'?os.homedir():process.env.HOME;
-  if(!home||!path.isAbsolute(home))fail('home-context-unavailable');
-  const npmConfig=[path.join(root,'.npmrc'),path.join(home,'.npmrc')]
-    .map(file=>[hash(file),npmRcKeys(file)]);
-  const contextFacts={
-    npmTree:treeHash(npmRoot),npmConfig,
-    node:hash(JSON.stringify([process.version,realObservedPath(process.execPath),
-      fs.statSync(process.execPath).size])),
-    shell:process.platform==='win32'?hash(JSON.stringify([
-      realObservedPath(process.env.ComSpec||process.env.COMSPEC||''),
-      digestFile(process.env.ComSpec||process.env.COMSPEC||''),
-      process.env.PATHEXT||'',digestFile(npm),
-      digestFile(path.join(root,'node_modules','.bin','tsc.cmd'))])):
-      digestFile('/bin/sh')};
-  const contextHash=hash(JSON.stringify(contextFacts));
-  if(contextOnly(contextHash))process.exit(0);
-  const tsRoot=path.join(root,'node_modules','typescript');
-  let tsc;
-  if(process.platform==='win32'){
-    const shim=path.join(root,'node_modules','.bin','tsc.cmd');
-    const body=fs.readFileSync(shim,'utf8').replace(/\r\n/g,'\n').trim();
-    const expected=`@ECHO off
-GOTO start
-:find_dp0
-SET dp0=%~dp0
-EXIT /b
-:start
-SETLOCAL
-CALL :find_dp0
-
-IF EXIST "%dp0%\\node.exe" (
-  SET "_prog=%dp0%\\node.exe"
-) ELSE (
-  SET "_prog=node"
-  SET PATHEXT=%PATHEXT:;.JS;=;%
-)
-
-endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%"  "%dp0%\\..\\typescript\\bin\\tsc" %*`;
-    if(body!==expected)fail('typescript-executable-changed');
-    tsc=realObservedPath(path.join(tsRoot,'bin','tsc'));
-  }else{
-    tsc=realObservedPath(path.join(root,'node_modules','.bin','tsc'));
-    if(tsc!==path.join(tsRoot,'bin','tsc'))fail('typescript-executable-changed');
-  }
-  const configReads=new Set(),visited=new Set();
-  let ts;try{ts=require(tsRoot);}catch{}
-  if(typeof ts?.getParsedCommandLineOfConfigFile==='function'){
-    const host={...ts.sys,readFile(file){configReads.add(path.resolve(file));
-      return ts.sys.readFile(file);},onUnRecoverableConfigFileDiagnostic(){}};
-    const parseConfig=file=>{
-      const absolute=path.resolve(file);
-      if(!within(absolute,root))fail('typescript-config-outside-repository');
-      if(visited.has(absolute))return;visited.add(absolute);
-      if(visited.size>64)fail('typescript-config-graph-too-large');
-      const parsed=ts.getParsedCommandLineOfConfigFile(absolute,{},host);
-      if(!parsed||parsed.errors?.length)fail('typescript-config-unavailable');
-      if(parsed.options?.plugins?.length)fail('typescript-plugin-unsupported');
-      if(parsed.options?.incremental||parsed.options?.composite)
-        fail('typescript-incremental-unsupported');
-      for(const reference of parsed.projectReferences||[])
-        parseConfig(reference.path.endsWith('.json')?reference.path:
-          path.join(reference.path,'tsconfig.json'));
-    };
-    parseConfig(path.join(root,'tsconfig.json'));
-  }else{
-    // TypeScript 7's native compiler does not expose the previous config API.
-    // Its CLI reports the effective config; restrict this path to one direct
-    // config rather than guessing about extends/reference provenance.
-    const config=path.join(root,'tsconfig.json'),raw=fs.readFileSync(config,'utf8');
-    if(/"(?:extends|references|plugins|incremental|composite)"\s*:/.test(raw))
-      fail('typescript-config-graph-unsupported');
-    const shown=spawnSync(process.execPath,[tsc,'--showConfig'],{cwd:root,
-      env:process.env,encoding:'utf8',timeout:4000,maxBuffer:16*1024*1024,
-      stdio:['ignore','pipe','pipe']});
-    if(shown.error||shown.signal||shown.status!==0)fail('typescript-config-unavailable');
-    const effective=JSON.parse(shown.stdout);
-    if(effective.compilerOptions?.plugins?.length||
-      effective.compilerOptions?.incremental||effective.compilerOptions?.composite)
-      fail('typescript-config-graph-unsupported');
-    configReads.add(config);
-  }
-  for(const file of configReads)if(!within(realObservedPath(file),root))
-    fail('typescript-config-outside-repository');
-  const listingStarted=performance.now();
-  const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(tsRoot,root):null;
-  const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'--noEmit','--listFilesOnly'],
-    {cwd:root,env:process.env,encoding:'utf8',timeout:process.platform==='win32'?10000:4000,
-      maxBuffer:16*1024*1024,
-      stdio:['ignore','pipe','pipe']});
-  timing('typescript_contract.list_files',listingStarted,{status:listed.status??null,
-    error:listed.error?.code||null});
-  if(listed.error||listed.signal||listed.status!==0)fail('typescript-input-list-unavailable');
-  const files=listed.stdout.trim().split(/\r?\n/).filter(Boolean)
-    .map(file=>path.resolve(file));
-  if(!files.length||files.some(file=>!within(realObservedPath(file),root)))
-    fail('typescript-input-outside-repository');
-  const facts={schema:1,root:hash(root),script:scriptName,
-    configs:[...configReads].sort().map(file=>[hash(file),digestFile(file)]),
-    files:[...new Set(files)].sort().map(file=>[hash(file),digestFile(file)]),
-    ...contextFacts};
-  probeResult(hash(JSON.stringify(facts)),contextHash,captured?.queries);
-}catch(e){console.error(`VSTATE_REASON:${e.code&&/^[a-z-]+$/.test(e.code)?e.code:
-  'typescript-contract-unavailable'}`);process.exitCode=2;}
+// Retired npm-launcher interpretation. Do not return even a context-only digest:
+// old receipts and cached compiler certificates cannot qualify this obligation.
+console.error('VSTATE_REASON:npm-launcher-unobserved-inputs');
+process.exitCode=2;

package/src/typescript-input-facts.mjs

@@ -0,0 +1,65 @@
+// Extracted from the existing npm TypeScript probe; shared compiler input logic.
+import fs from 'node:fs';import path from 'node:path';import {createHash} from 'node:crypto';
+import {createRequire} from 'node:module';import {spawnSync} from 'node:child_process';
+import {compilerFiles} from './typescript-list.mjs';
+import {withinPath as within,realObservedPath} from './path-identity.mjs';
+import {timing} from './decision-profile.mjs';
+const require=createRequire(import.meta.url),hash=value=>createHash('sha256').update(value).digest('hex');
+const digestFile=file=>hash(fs.readFileSync(file));
+const fail=code=>{throw Object.assign(Error(code),{code});};
+export function typeScriptInputFacts(root,tsRoot,tsc){
+  const configReads=new Set(),visited=new Set();
+  let ts;try{ts=require(tsRoot);}catch{}
+  if(typeof ts?.getParsedCommandLineOfConfigFile==='function'){
+    const host={...ts.sys,readFile(file){configReads.add(path.resolve(file));
+      return ts.sys.readFile(file);},onUnRecoverableConfigFileDiagnostic(){}};
+    const parseConfig=file=>{
+      const absolute=path.resolve(file);
+      if(!within(absolute,root))fail('typescript-config-outside-repository');
+      if(visited.has(absolute))return;visited.add(absolute);
+      if(visited.size>64)fail('typescript-config-graph-too-large');
+      const parsed=ts.getParsedCommandLineOfConfigFile(absolute,{},host);
+      if(!parsed||parsed.errors?.length)fail('typescript-config-unavailable');
+      if(parsed.options?.plugins?.length)fail('typescript-plugin-unsupported');
+      if(parsed.options?.incremental||parsed.options?.composite)
+        fail('typescript-incremental-unsupported');
+      for(const reference of parsed.projectReferences||[])
+        parseConfig(reference.path.endsWith('.json')?reference.path:
+          path.join(reference.path,'tsconfig.json'));
+    };
+    parseConfig(path.join(root,'tsconfig.json'));
+  }else{
+    // TypeScript 7's native compiler does not expose the previous config API.
+    // Its CLI reports the effective config; restrict this path to one direct
+    // config rather than guessing about extends/reference provenance.
+    const config=path.join(root,'tsconfig.json'),raw=fs.readFileSync(config,'utf8');
+    if(/"(?:extends|references|plugins|incremental|composite)"\s*:/.test(raw))
+      fail('typescript-config-graph-unsupported');
+    const shown=spawnSync(process.execPath,[tsc,'--showConfig'],{cwd:root,
+      env:process.env,encoding:'utf8',timeout:4000,maxBuffer:16*1024*1024,
+      stdio:['ignore','pipe','pipe']});
+    if(shown.error||shown.signal||shown.status!==0)fail('typescript-config-unavailable');
+    const effective=JSON.parse(shown.stdout);
+    if(effective.compilerOptions?.plugins?.length||
+      effective.compilerOptions?.incremental||effective.compilerOptions?.composite)
+      fail('typescript-config-graph-unsupported');
+    configReads.add(config);
+  }
+  for(const file of configReads)if(!within(realObservedPath(file),root))
+    fail('typescript-config-outside-repository');
+  const listingStarted=performance.now();
+  const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(tsRoot,root):null;
+  const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'--noEmit','--listFilesOnly'],
+    {cwd:root,env:process.env,encoding:'utf8',timeout:process.platform==='win32'?10000:4000,
+      maxBuffer:16*1024*1024,
+      stdio:['ignore','pipe','pipe']});
+  timing('typescript_contract.list_files',listingStarted,{status:listed.status??null,
+    error:listed.error?.code||null});
+  if(listed.error||listed.signal||listed.status!==0)fail('typescript-input-list-unavailable');
+  const files=listed.stdout.trim().split(/\r?\n/).filter(Boolean)
+    .map(file=>path.resolve(file));
+  if(!files.length||files.some(file=>!within(realObservedPath(file),root)))
+    fail('typescript-input-outside-repository');
+  return {configs:[...configReads].sort().map(file=>[hash(file),digestFile(file)]),
+    files:[...new Set(files)].sort().map(file=>[hash(file),digestFile(file)]),queries:captured?.queries};
+}

package/src/typescript-qualification.mjs

@@ -1,3 +1,4 @@
+import {directProject,directQualification,directEnvironment} from './direct-typescript.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import {realObservedPath} from './path-identity.mjs';
@@ -6,6 +7,25 @@ import {realObservedPath} from './path-identity.mjs';
 // The read-only runtime probe separately checks the effective TypeScript file
 // list, config graph, npm toolchain and caller context on every sync/run.
 export function qualifyTypeScript(root,selected,discovered={}) {
+  if(selected.qualification===directQualification){
+    const issues=[];
+    try{
+      const compiler=directProject(root,selected.script);
+      if(selected.command?.length!==3||selected.command[0]!==process.execPath||
+        selected.command[1]!==compiler.entry||selected.command[2]!=='--noEmit'||
+        selected.cwd&&selected.cwd!=='.')issues.push('direct compiler invocation changed');
+    }catch(e){issues.push(e.code||'direct compiler prerequisites unavailable');}
+    if(!selected.inputs?.includes('**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json,jsonc}')||
+      !selected.inputs?.includes('package.json')||!selected.inputs?.includes('tsconfig.json')||
+      !selected.installedInputs?.includes('node_modules/**'))issues.push('direct compiler source/config/installed inputs incomplete');
+    if(!selected.environment?.executableIdentity||
+      !directEnvironment.variables.every(key=>selected.environment?.variables?.includes(key))||
+      !directEnvironment.prefixes.every(key=>selected.environment?.prefixes?.includes(key)))
+      issues.push('direct compiler execution context incomplete');
+    if(selected.probes?.length!==1||!selected.probes?.some(argv=>path.basename(argv[1]||'')==='direct-typescript-probe.mjs'&&
+      argv[0]===process.execPath&&argv[2]===root&&argv[3]===selected.script))issues.push('direct compiler probe missing');
+    return {qualified:issues.length===0,issues};
+  }
   if(selected.qualification==='pnpm-tsc-v1'){
     const issues=[];
     const workspace=selected.workspace||'.';
@@ -50,47 +70,7 @@ export function qualifyTypeScript(root,selected,discovered={}) {
     return {qualified:issues.length===0,issues};
   }
   if(selected.qualification!=='typescript-noemit-v1')return null;
-  const issues=[];
-  let pkg;
-  try{pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));}
-  catch{issues.push('package manifest unavailable');}
-  if(!selected.script||pkg?.scripts?.[selected.script]?.trim()!=='tsc --noEmit'||
-    pkg?.scripts?.['pre'+selected.script]||pkg?.scripts?.['post'+selected.script])
-    issues.push('typecheck script is not the supported standalone tsc --noEmit invocation');
-  if(selected.command?.length!==3||selected.command[1]!=='run'||
-    selected.command[2]!==selected.script)
-    issues.push('package-manager invocation differs from the discovered script');
-  try{const npm=fs.realpathSync(selected.command[0]);
-    const supported=process.platform==='win32'?path.basename(npm).toLowerCase()==='npm.cmd'&&
-      fs.existsSync(path.join(path.dirname(npm),'node_modules','npm','bin','npm-cli.js')):
-      path.basename(npm)==='npm-cli.js'&&
-      path.basename(path.dirname(path.dirname(npm)))==='npm';
-    if(!supported)
-      issues.push('npm executable layout is not supported');}
-  catch{issues.push('npm executable unavailable');}
-  if(!fs.existsSync(path.join(root,'tsconfig.json')))
-    issues.push('tsconfig.json is missing');
-  if(!fs.existsSync(path.join(root,'node_modules','typescript','package.json'))||
-    !fs.existsSync(path.join(root,'node_modules','.bin',
-      process.platform==='win32'?'tsc.cmd':'tsc')))
-    issues.push('local TypeScript installation is missing');
-  if(!selected.inputs?.includes('**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json,jsonc}')||
-    !selected.inputs?.includes('package.json')||
-    !selected.inputs?.includes('tsconfig.json'))
-    issues.push('TypeScript source/config file-set declaration is incomplete');
-  if(!selected.installedInputs?.includes('node_modules/**'))
-    issues.push('installed package contents and membership are not declared');
-  if(!selected.environment?.executableIdentity||
-    !['node','npm'].every(name=>selected.environment?.pathExecutables?.includes(name))||
-    !['NODE_OPTIONS','NODE_PATH','HOME','BASH_ENV','ENV'].every(name=>
-      selected.environment?.variables?.includes(name))||
-    !['npm_config_','DYLD_','TSGO_'].every(name=>
-      selected.environment?.prefixes?.includes(name)))
-    issues.push('caller toolchain or execution context declaration is incomplete');
-  if(!selected.probes?.some(argv=>path.basename(argv[1]||'')==='typescript-contract-probe.mjs'&&
-    argv[2]&&fs.existsSync(argv[2])&&
-    realObservedPath(argv[2])===root&&argv[3]===selected.script&&
-    argv[4]===selected.command[0]))
-    issues.push('TypeScript input and toolchain probe is missing');
-  return {qualified:issues.length===0,issues};
+  // Retired automatic launcher contract: npm's notifier consumes unobserved
+  // remote/cache/time state. A successful execution is still an outcome.
+  return {qualified:false,issues:['npm launcher applicability is unqualified: update notification uses unobserved remote/cache/time inputs; run the npm script when needed']};
 }