@redue/cli 0.1.0-alpha.4 → 0.1.0-alpha.6

package/src/direct-typescript.mjs

@@ -0,0 +1,72 @@
+// Versioned, explicit offline compiler recipe. No package manager is executed.
+import fs from 'node:fs';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {createRequire} from 'node:module';
+import {realObservedPath,withinPath} from './path-identity.mjs';
+export const directInterpretation='npm-direct-typescript@1';
+export const directQualification='npm-typescript-direct-v1';
+const reviewed={
+  '5.6.3':{entry:'lib/tsc.js',digest:'e674b5dc4dac50f6e91be30094aeea983a1f340231717e62b0b6199ae3049eb2'},
+  '5.9.3':{entry:'lib/_tsc.js',digest:'d1b32e75475710fdc85102b1365254d84ceb192d3639d962c53fe1355ce274ca'},
+};
+const fail=code=>{throw Object.assign(Error(code),{code});};
+const hash=bytes=>createHash('sha256').update(bytes).digest('hex');
+export const directEnvironment={variables:['NODE_ENV','NODE_OPTIONS','NODE_PATH','NODE_COMPILE_CACHE','VSCODE_INSPECTOR_OPTIONS'],
+  prefixes:['NODE_','DYLD_','LD_','TSGO_','TSC_'],executableIdentity:true};
+export function directEnvironmentIssue(env=process.env){
+  if(![22,24].includes(Number(process.versions.node.split('.')[0])))return 'direct-node-version-unsupported';
+  if(env.VSCODE_INSPECTOR_OPTIONS)return 'direct-execution-environment-unsupported';
+  for(const [key,value] of Object.entries(env)){
+    if(/^NODE_/i.test(key)){
+      // Node 22.13.0 predates env-proxy initialization. This injected flag is
+      // inert there, but remains strictly fingerprinted as NODE_ context.
+      if(key==='NODE_USE_ENV_PROXY'&&value==='1'&&process.version==='v22.13.0'&&
+        !process.allowedNodeEnvironmentFlags.has('--use-env-proxy'))continue;
+      if(key==='NODE_ENV'&&['','production','test'].includes(value))continue;
+      if(value!=='')return 'direct-execution-environment-unsupported';
+    }
+    if(/^(DYLD_|LD_|TSGO_|TSC_)/i.test(key)&&value!=='')return 'direct-execution-environment-unsupported';
+  }
+  return null;
+}
+export function directCompiler(root,{verify=true}={}){
+  root=realObservedPath(root);
+  const manifest=createRequire(path.join(root,'package.json')).resolve('typescript/package.json');
+  const tsRoot=path.dirname(realObservedPath(manifest));
+  if(!withinPath(tsRoot,root)||tsRoot!==realObservedPath(path.join(root,'node_modules/typescript')))
+    fail('direct-typescript-layout-unsupported');
+  const version=JSON.parse(fs.readFileSync(manifest)).version,spec=reviewed[version];
+  if(!spec)fail('direct-typescript-version-unsupported');
+  if(verify){
+    const files=[];
+    const walk=(dir,relative='')=>{
+      for(const entry of fs.readdirSync(dir,{withFileTypes:true})){
+        const name=relative?relative+'/'+entry.name:entry.name,full=path.join(dir,entry.name);
+        if(entry.isDirectory())walk(full,name);
+        else if(entry.isFile())files.push([name,full]);
+        else fail('direct-typescript-implementation-unreviewed');
+      }
+    };walk(tsRoot);
+    const digest=createHash('sha256');
+    for(const [name,file] of files.sort(([a],[b])=>a<b?-1:a>b?1:0))digest.update(name+'\0'+hash(fs.readFileSync(file))+'\0');
+    if(digest.digest('hex')!==spec.digest)fail('direct-typescript-implementation-unreviewed');
+  }
+  return {tsRoot,version,entry:path.join(tsRoot,spec.entry),digest:spec.digest};
+}
+export function directProject(root,script,{verify=true}={}){
+  const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json')));
+  if(pkg.workspaces||pkg.packageManager&&!/^npm@/.test(pkg.packageManager)||
+    !['package-lock.json','npm-shrinkwrap.json'].some(file=>fs.existsSync(path.join(root,file)))||
+    ['yarn.lock','pnpm-lock.yaml','bun.lock','bun.lockb'].some(file=>fs.existsSync(path.join(root,file))))
+    fail('direct-npm-project-unsupported');
+  if(pkg.scripts?.[script]?.trim()!=='tsc --noEmit'||pkg.scripts?.['pre'+script]||pkg.scripts?.['post'+script])
+    fail('typecheck-script-changed');
+  const issue=directEnvironmentIssue();if(issue)fail(issue);
+  return directCompiler(root,{verify});
+}
+// Provenance only: retain a digest, never proxy URLs/credentials or a raw dump.
+// No npm process runs in this recipe; these keys are not compiler applicability.
+export function observedNpmContext(env=process.env){
+  return hash(JSON.stringify(Object.entries(env).filter(([key])=>/^npm_/i.test(key)||/^(?:https?_proxy|all_proxy|no_proxy)$/i.test(key)).sort(([a],[b])=>a<b?-1:a>b?1:0)));
+}

package/src/node-onboarding.mjs

@@ -1,3 +1,4 @@
+import {directProject,directQualification} from './direct-typescript.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import {spawnSync} from 'node:child_process';
@@ -159,7 +160,8 @@ function workspaceManifests(root,patterns) {
   if(matched.length>50)throw Error('more than 50 workspace packages found; select checks explicitly');
   return matched.map(file=>({file,pkg:readJson(path.join(root,file))}));
 }
-export function discoverNodeProject(root) {
+export function discoverNodeProject(root,{recipe=null}={}) {
+  if(recipe&&recipe!=='typescript-direct')throw Error('unknown recipe; use typescript-direct');
   root=realObservedPath(root);
   const packageFile=path.join(root,'package.json');
   if(!exists(packageFile))throw Error('run init from a repository containing package.json');
@@ -186,6 +188,15 @@ export function discoverNodeProject(root) {
     if(workspaces&&classification.qualification==='typescript-noemit-v1')classification={level:'recording',
       reason:'workspace task and installed-input closure need explicit qualification'};
     const check={name:kind,script,kind,inputs:sourceInputs(root,kind,pm.lockfiles||[])};
+    if(recipe==='typescript-direct'&&kind==='typecheck'){
+      try{
+        if(pm.name!=='npm'||workspaces||observationIssue||pm.issue)throw Error('direct recipe requires a supported single-package npm checkout');
+        const compiler=directProject(root,script);
+        check.command=['@node','@typescript-compiler:.','--noEmit'];check.cwd='.';
+        classification={level:'ready',qualification:directQualification,
+          reason:`explicit local TypeScript ${compiler.version} compilation; npm launcher/lifecycle scripts are not executed; package.json stays unchanged`};
+      }catch(e){classification={level:'recording',reason:`Direct recipe unavailable (${e.code||e.message}); original npm script retained, without bypassing required behavior`};}
+    }
     if(pm.name==='pnpm'&&kind==='typecheck'&&!workspaces&&!pm.issue&&
       /^(?:tsc --noEmit|tsc -p (?:\.|tsconfig\.json)(?: --noEmit)?)$/.test(scripts[script].trim())){
       try{const contract=pnpmTypecheckInputs(root,'.',script);

package/src/npm-typecheck-environment.mjs

@@ -0,0 +1,36 @@
+// Admission for the standalone npm 10.9.2 -> tsc --noEmit contract only.
+// Values are never returned: the caller separately fingerprints every original
+// npm_config_* key/value (including case and empty values).
+import path from 'node:path';
+export const npmEnvironmentInterpretation = 'npm-tsc-environment@2';
+const proxyKeys = new Set(['proxy', 'https_proxy', 'http_proxy', 'noproxy']);
+export function npmTypecheckEnvironmentIssue(env, {npmVersion, platform = process.platform} = {}) {
+  if (env.NODE_OPTIONS || env.NODE_PATH || env.BASH_ENV || env.ENV)
+    return 'execution-environment-unsupported';
+  const seen = new Map();
+  for (const [key, value] of Object.entries(env)) {
+    if (/^(DYLD_|TSGO_)/i.test(key)) return 'execution-environment-unsupported';
+    if (!/^npm_config_/i.test(key)) continue;
+    if (/^npm_config_prefix$/i.test(key) && platform === 'win32' && path.win32.isAbsolute(value)) continue;
+    const suffix = key.slice('npm_config_'.length).toLowerCase();
+    if (!proxyKeys.has(suffix)) return 'execution-environment-unsupported';
+    // http_proxy is an unknown, inert pass-through key in this inspected npm
+    // version, not an alias for proxy. Other npm versions require source review.
+    if (npmVersion !== '10.9.2') return 'npm-proxy-version-unsupported';
+    if (seen.has(suffix) && seen.get(suffix) !== value)
+      return 'npm-proxy-context-ambiguous';
+    seen.set(suffix, value);
+    if (typeof value !== 'string' || /[\x00-\x1f\x7f]/.test(value))
+      return 'npm-proxy-value-unsupported';
+    // npm ignores empty environment config, but passes the original environment
+    // to the child. Empty and absent remain distinct caller identities.
+    if (value === '' || (suffix === 'proxy' && value === 'false')) continue;
+    if (suffix === 'noproxy') continue;
+    try {
+      const url = new URL(value);
+      if (!['http:', 'https:'].includes(url.protocol) || !url.hostname)
+        return 'npm-proxy-value-unsupported';
+    } catch { return 'npm-proxy-value-unsupported'; }
+  }
+  return null;
+}

package/src/plan-worker.mjs

@@ -4,6 +4,7 @@ import path from 'node:path';
 import {createHash} from 'node:crypto';
 import {discover} from './plan.mjs';
 import {InputIndex} from './index.mjs';
+import {directProject,directQualification} from './direct-typescript.mjs';
 import {queriesMatch} from './typescript-list.mjs';
 import {planGuard,inputKey} from './decision-validation.mjs';
 import {timing} from './decision-profile.mjs';
@@ -21,7 +22,14 @@ try {
     try{
       guard=planGuard(bundle);
       const queryStarted=performance.now();
-      const queriesValid=!workerData.reuse.queries?.length||queriesMatch(workerData.reuse.queries);
+      // Cached membership queries load the compiler API; establish its reviewed
+      // implementation before that optimization can execute project code.
+      const directRoots=new Set(config.checks.filter(check=>check.qualification===directQualification)
+        .map(check=>directProject(config.root,check.script).tsRoot));
+      if(directRoots.size&&(workerData.reuse.queries||[]).some(([kind,,,options])=>
+        kind==='readDirectory'&&!directRoots.has(options?.tsRoot)))throw Error('retained compiler implementation changed');
+      const queriesValid=guard===workerData.reuse.guard&&
+        (!workerData.reuse.queries?.length||queriesMatch(workerData.reuse.queries));
       timing('worker.compiler_queries',queryStarted,{queries:workerData.reuse.queries?.length||0,matched:queriesValid?1:0});
       if(guard!==workerData.reuse.guard||!queriesValid)reuseReason='configuration_or_resolution_changed';
       else {

package/src/presentation.mjs

@@ -33,6 +33,7 @@ export function renderExplain(value,name) {
   return rows.map(row=>{
     const lines=[`${row.name}: ${checkLabel(row)}${row.result?` / ${row.result}`:''}`];
     if(row.result==='FAIL')lines.push(`Historical failure; applicability: ${row.freshness}.`);
+    if(row.verification_recipe==='npm-direct-typescript@1')lines.push('Recorded recipe: direct local TypeScript compiler; npm and lifecycle scripts were not executed.');
     lines.push(explanation(row));
     if(row.changed_inputs?.length)lines.push('Relevant inputs changed:',...row.changed_inputs.map(file=>`  ${file}`));
     if(row.freshness==='STALE')lines.push(`Due again when verification is needed: redue run ${JSON.stringify(row.name)}`);

package/src/project-location.mjs

@@ -0,0 +1,34 @@
+// Shared project selection only; evidence and caller-context semantics stay in the kernel.
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+import {realObservedPath} from './path-identity.mjs';
+import {stateIdentity,userStateBase} from './platform-state.mjs';
+
+export function discoverConfig(cwd=process.cwd()) {
+  let dir=path.resolve(cwd);const found=[];
+  for(;;){
+    for(const name of ['redue.config.json','vstate.config.json']) {
+      const file=path.join(dir,name);
+      if(fs.existsSync(file))found.push(file);
+    }
+    if(fs.existsSync(path.join(dir,'.git'))||path.dirname(dir)===dir)break;
+    dir=path.dirname(dir);
+  }
+  if(found.length>1)throw Error('multiple REDUE configurations apply; select the intended one with --config FILE');
+  return found[0]||path.resolve(cwd,'redue.config.json');
+}
+export function canonicalConfig(configFile) {
+  return path.join(realObservedPath(path.dirname(configFile)),path.basename(configFile));
+}
+export function projectState(root,configFile) {
+  return path.join(userStateBase(process.platform,process.env,os.homedir()),'vstate',
+    `vstate-${createHash('sha256').update(stateIdentity(root)+'\0'+stateIdentity(canonicalConfig(configFile))).digest('hex').slice(0,16)}`);
+}
+export function readProject(configFile) {
+  const config=JSON.parse(fs.readFileSync(configFile,'utf8'));
+  if(config.schema!==1||!Array.isArray(config.checks)||!config.checks.length)
+    throw Error('config needs schema 1 and at least one check');
+  return {config,root:realObservedPath(path.resolve(path.dirname(configFile),config.root||'.'))};
+}

package/src/typescript-input-facts.mjs

@@ -0,0 +1,65 @@
+// Extracted from the existing npm TypeScript probe; shared compiler input logic.
+import fs from 'node:fs';import path from 'node:path';import {createHash} from 'node:crypto';
+import {createRequire} from 'node:module';import {spawnSync} from 'node:child_process';
+import {compilerFiles} from './typescript-list.mjs';
+import {withinPath as within,realObservedPath} from './path-identity.mjs';
+import {timing} from './decision-profile.mjs';
+const require=createRequire(import.meta.url),hash=value=>createHash('sha256').update(value).digest('hex');
+const digestFile=file=>hash(fs.readFileSync(file));
+const fail=code=>{throw Object.assign(Error(code),{code});};
+export function typeScriptInputFacts(root,tsRoot,tsc){
+  const configReads=new Set(),visited=new Set();
+  let ts;try{ts=require(tsRoot);}catch{}
+  if(typeof ts?.getParsedCommandLineOfConfigFile==='function'){
+    const host={...ts.sys,readFile(file){configReads.add(path.resolve(file));
+      return ts.sys.readFile(file);},onUnRecoverableConfigFileDiagnostic(){}};
+    const parseConfig=file=>{
+      const absolute=path.resolve(file);
+      if(!within(absolute,root))fail('typescript-config-outside-repository');
+      if(visited.has(absolute))return;visited.add(absolute);
+      if(visited.size>64)fail('typescript-config-graph-too-large');
+      const parsed=ts.getParsedCommandLineOfConfigFile(absolute,{},host);
+      if(!parsed||parsed.errors?.length)fail('typescript-config-unavailable');
+      if(parsed.options?.plugins?.length)fail('typescript-plugin-unsupported');
+      if(parsed.options?.incremental||parsed.options?.composite)
+        fail('typescript-incremental-unsupported');
+      for(const reference of parsed.projectReferences||[])
+        parseConfig(reference.path.endsWith('.json')?reference.path:
+          path.join(reference.path,'tsconfig.json'));
+    };
+    parseConfig(path.join(root,'tsconfig.json'));
+  }else{
+    // TypeScript 7's native compiler does not expose the previous config API.
+    // Its CLI reports the effective config; restrict this path to one direct
+    // config rather than guessing about extends/reference provenance.
+    const config=path.join(root,'tsconfig.json'),raw=fs.readFileSync(config,'utf8');
+    if(/"(?:extends|references|plugins|incremental|composite)"\s*:/.test(raw))
+      fail('typescript-config-graph-unsupported');
+    const shown=spawnSync(process.execPath,[tsc,'--showConfig'],{cwd:root,
+      env:process.env,encoding:'utf8',timeout:4000,maxBuffer:16*1024*1024,
+      stdio:['ignore','pipe','pipe']});
+    if(shown.error||shown.signal||shown.status!==0)fail('typescript-config-unavailable');
+    const effective=JSON.parse(shown.stdout);
+    if(effective.compilerOptions?.plugins?.length||
+      effective.compilerOptions?.incremental||effective.compilerOptions?.composite)
+      fail('typescript-config-graph-unsupported');
+    configReads.add(config);
+  }
+  for(const file of configReads)if(!within(realObservedPath(file),root))
+    fail('typescript-config-outside-repository');
+  const listingStarted=performance.now();
+  const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(tsRoot,root):null;
+  const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'--noEmit','--listFilesOnly'],
+    {cwd:root,env:process.env,encoding:'utf8',timeout:process.platform==='win32'?10000:4000,
+      maxBuffer:16*1024*1024,
+      stdio:['ignore','pipe','pipe']});
+  timing('typescript_contract.list_files',listingStarted,{status:listed.status??null,
+    error:listed.error?.code||null});
+  if(listed.error||listed.signal||listed.status!==0)fail('typescript-input-list-unavailable');
+  const files=listed.stdout.trim().split(/\r?\n/).filter(Boolean)
+    .map(file=>path.resolve(file));
+  if(!files.length||files.some(file=>!within(realObservedPath(file),root)))
+    fail('typescript-input-outside-repository');
+  return {configs:[...configReads].sort().map(file=>[hash(file),digestFile(file)]),
+    files:[...new Set(files)].sort().map(file=>[hash(file),digestFile(file)]),queries:captured?.queries};
+}

package/src/typescript-list.mjs

@@ -9,7 +9,8 @@ const require=createRequire(import.meta.url);
 const hash=value=>createHash('sha256').update(JSON.stringify(value)).digest('hex');
 export function queryAnswer(kind,file,options) {
   try{
-    if(kind==='readDirectory')return require(options.tsRoot).sys.readDirectory(file,...options.args).sort();
+    if(kind==='readDirectory')return require(options.tsRoot).sys.readDirectory(file,
+      ...options.args.map((value,i)=>options.undefinedArguments?.includes(i)?undefined:value)).sort();
     if(kind==='readFile')return hash(fs.readFileSync(file,'utf8'));
     if(kind==='fileExists')return fs.statSync(file).isFile();
     if(kind==='directoryExists')return fs.statSync(file).isDirectory();
@@ -42,7 +43,10 @@ export function compilerFiles(tsRoot,cwd) {
   const getDirectories=file=>{remember('directories',file);return ts.sys.getDirectories(file);};
   const readDirectory=(dir,...args)=>{
     const result=ts.sys.readDirectory(dir,...args);
-    const full=path.resolve(dir),options={tsRoot,args};
+    // JSON turns undefined array entries into null. TypeScript distinguishes
+    // them (an omitted exclude list is not a null list), so retain that fact.
+    const full=path.resolve(dir),options={tsRoot,args,argsVersion:1,
+      undefinedArguments:args.flatMap((value,i)=>value===undefined?[i]:[])};
     queries.set('readDirectory\0'+full+JSON.stringify(args),
       ['readDirectory',full,[...result].sort(),options]);
     return result;

package/src/typescript-qualification.mjs

@@ -1,11 +1,32 @@
+import {directProject,directQualification,directEnvironment} from './direct-typescript.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import {realObservedPath} from './path-identity.mjs';
 
 // This is a machine-enforced contract, not a claim inferred from a script name.
-// The read-only runtime probe separately checks the effective TypeScript file
-// list, config graph, npm toolchain and caller context on every sync/run.
+// Runtime validation checks effective compiler membership, configuration and
+// toolchain identity. Supported discovery certificates still validate those
+// filesystem queries; caller context is independently compared at the decision.
 export function qualifyTypeScript(root,selected,discovered={}) {
+  if(selected.qualification===directQualification){
+    const issues=[];
+    try{
+      const compiler=directProject(root,selected.script);
+      if(selected.command?.length!==3||selected.command[0]!==process.execPath||
+        selected.command[1]!==compiler.entry||selected.command[2]!=='--noEmit'||
+        selected.cwd&&selected.cwd!=='.')issues.push('direct compiler invocation changed');
+    }catch(e){issues.push(e.code||'direct compiler prerequisites unavailable');}
+    if(!selected.inputs?.includes('**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json,jsonc}')||
+      !selected.inputs?.includes('package.json')||!selected.inputs?.includes('tsconfig.json')||
+      !selected.installedInputs?.includes('node_modules/**'))issues.push('direct compiler source/config/installed inputs incomplete');
+    if(!selected.environment?.executableIdentity||
+      !directEnvironment.variables.every(key=>selected.environment?.variables?.includes(key))||
+      !directEnvironment.prefixes.every(key=>selected.environment?.prefixes?.includes(key)))
+      issues.push('direct compiler execution context incomplete');
+    if(selected.probes?.length!==1||!selected.probes?.some(argv=>path.basename(argv[1]||'')==='direct-typescript-probe.mjs'&&
+      argv[0]===process.execPath&&argv[2]===root&&argv[3]===selected.script))issues.push('direct compiler probe missing');
+    return {qualified:issues.length===0,issues};
+  }
   if(selected.qualification==='pnpm-tsc-v1'){
     const issues=[];
     const workspace=selected.workspace||'.';