@thymian/plugin-sampler 0.3.0-canary.20261007-e6cb8dc → 0.3.0-canary.20261007-cdbe1d3

package/dist/selectors/transaction-filter.d.ts

@@ -0,0 +1,119 @@
+import type { ThymianHttpTransaction } from '@thymian/core';
+/**
+ * A path glob, by shape.
+ *
+ * A string with no `*` is not a `PathGlob`, so it has to be an exact path —
+ * which is what keeps a typo'd exact path a compile error while a glob stays a
+ * plain string. The shape type never touches the `Path` union: validating a
+ * glob *against* the union was measured and rejected on language-server cost,
+ * and vacuousness is checked at run and validate time instead.
+ *
+ * {@link PATH_GLOB_SOURCE} is the same type as text, so the generated surface
+ * and this module cannot drift on it.
+ */
+export type PathGlob = `${string}*${string}`;
+/** {@link PathGlob} as source text, for the generated declaration file. */
+export declare const PATH_GLOB_SOURCE = "`${string}*${string}`";
+/**
+ * The fields a filter can constrain, as the runtime sees them.
+ *
+ * Every one is a closed, spec-derived union in the *generated* surface, which is
+ * what makes a stale value a compile error. Here they are the widest thing a
+ * `.js` hook file could pass, because that file is not type-checked — so the
+ * runtime validates shapes itself rather than trusting them.
+ */
+export type FilterFields = {
+    readonly method?: string | readonly string[];
+    readonly status?: number | readonly number[];
+    readonly statusClass?: string | readonly string[];
+    readonly path?: string | PathGlob | readonly (string | PathGlob)[];
+    readonly requestMediaType?: string | readonly string[];
+    readonly responseMediaType?: string | readonly string[];
+};
+/**
+ * Targets a set of Transactions.
+ *
+ * Fields **AND**-combine; an array within a field **OR**-combines. `not` takes
+ * filter fields and excludes anything matching them — one level deep by
+ * construction, because `FilterFields` has no `not` of its own.
+ */
+export type TransactionFilter = FilterFields & {
+    readonly not?: FilterFields | readonly FilterFields[];
+};
+declare const FIELDS: {
+    method: {
+        valid: (value: unknown) => value is string;
+        expected: string;
+        accepts: (value: unknown, { thymianReq }: ThymianHttpTransaction) => boolean;
+    };
+    status: {
+        valid: (value: unknown) => boolean;
+        expected: string;
+        accepts: (value: unknown, { thymianRes }: ThymianHttpTransaction) => boolean;
+    };
+    statusClass: {
+        valid: (value: unknown) => boolean;
+        expected: string;
+        accepts: (value: unknown, { thymianRes }: ThymianHttpTransaction) => boolean;
+    };
+    path: {
+        valid: (value: unknown) => value is string;
+        expected: string;
+        accepts: (value: unknown, transaction: ThymianHttpTransaction) => boolean;
+    };
+    requestMediaType: {
+        valid: (value: unknown) => value is string;
+        expected: string;
+        accepts: (value: unknown, { thymianReq }: ThymianHttpTransaction) => boolean;
+    };
+    responseMediaType: {
+        valid: (value: unknown) => value is string;
+        expected: string;
+        accepts: (value: unknown, { thymianRes }: ThymianHttpTransaction) => boolean;
+    };
+};
+export type FilterFieldName = keyof typeof FIELDS;
+/** The path a filter compares against: the description's own spelling. */
+export declare function pathOf(transaction: ThymianHttpTransaction): string;
+/**
+ * Whether `value` is shaped like a filter.
+ *
+ * One known field is enough. Requiring *every* key to be known meant a single
+ * typo — `{ path: '/v1/**', tag: 'x' }` — was reported as "not a filter at
+ * all", which sends the reader looking for a selector they never wrote;
+ * {@link filterProblems} names the unknown key instead.
+ */
+export declare function isTransactionFilter(value: unknown): value is TransactionFilter;
+/** One thing wrong with a filter, in the words a diagnostic uses. */
+export type FilterProblem = string;
+/**
+ * Everything wrong with a filter's own text, before any Transaction is
+ * consulted.
+ *
+ * Separate from matching because a filter that cannot mean anything is a
+ * different fault from one that means something nothing satisfies. Reporting a
+ * mistyped `'4xx'` as "all valid but intersects nothing" is the wrong sentence,
+ * and letting `{ method: 42 }` through produced a bare `TypeError` naming no
+ * file at all.
+ */
+export declare function filterProblems(filter: TransactionFilter): FilterProblem[];
+/**
+ * Field names `fields` gives an explicit, empty value list — a disjunction of
+ * zero alternatives, which {@link matchesFields} treats as always false.
+ *
+ * Read back from the same rule {@link matchesFields} applies, rather than a
+ * second definition of "empty": a field that is merely absent is not named
+ * here, only one that was given a value and that value is an empty array.
+ */
+export declare function emptyValueFields(fields: FilterFields): FilterFieldName[];
+/**
+ * `matches(t) = positive(t) && !not.some(n => n(t))`.
+ *
+ * An empty positive side matches everything, which is what makes
+ * `{ not: { … } }` mean "all but these" without a second spelling.
+ */
+export declare function matchesTransactionFilter(filter: TransactionFilter, transaction: ThymianHttpTransaction): boolean;
+/** Every path value a filter mentions, including the ones inside `not`. */
+export declare function pathValuesOf(filter: TransactionFilter): readonly string[];
+export {};
+//# sourceMappingURL=transaction-filter.d.ts.map

package/dist/selectors/transaction-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction-filter.d.ts","sourceRoot":"","sources":["../../src/selectors/transaction-filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAK5D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAE7C,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC;IACnE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACvD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG;IAC7C,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,SAAS,YAAY,EAAE,CAAC;CACvD,CAAC;AAsBF,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCyB,CAAC;AAEtC,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,MAAM,CAAC;AAIlD,0EAA0E;AAC1E,wBAAgB,MAAM,CAAC,WAAW,EAAE,sBAAsB,GAAG,MAAM,CAElE;AAUD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iBAAiB,CAQ5B;AAED,qEAAqE;AACrE,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,iBAAiB,GAAG,aAAa,EAAE,CAuDzE;AAuDD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,eAAe,EAAE,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAgBT;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,MAAM,EAAE,CAWzE"}

package/dist/selectors/transaction-filter.js

@@ -0,0 +1,191 @@
+import { matchesPathGlob } from './path-glob.js';
+import { canonicalPath } from './selector.js';
+/** {@link PathGlob} as source text, for the generated declaration file. */
+export const PATH_GLOB_SOURCE = '`${string}*${string}`';
+/** A status class: the first digit of a status, spelled `1XX` … `5XX`. */
+const STATUS_CLASS = /^[1-5]XX$/;
+const FIELDS = {
+    method: {
+        valid: (value) => typeof value === 'string',
+        expected: 'an HTTP method',
+        // Methods are compared case-insensitively because a selector uppercases
+        // them, so `get` and `GET` are the same method by construction.
+        accepts: (value, { thymianReq }) => String(value).toUpperCase() === thymianReq.method.toUpperCase(),
+    },
+    status: {
+        valid: (value) => typeof value === 'number' && Number.isInteger(value),
+        expected: 'a status code, as a number',
+        accepts: (value, { thymianRes }) => value === thymianRes.statusCode,
+    },
+    statusClass: {
+        valid: (value) => typeof value === 'string' && STATUS_CLASS.test(value),
+        expected: 'a status class: "1XX", "2XX", "3XX", "4XX" or "5XX"',
+        // The first digit, not core's list of registered codes: a status class is a
+        // range, and a description is free to declare a 418 or a vendor's 499.
+        accepts: (value, { thymianRes }) => String(thymianRes.statusCode).startsWith(String(value)[0]),
+    },
+    path: {
+        valid: (value) => typeof value === 'string',
+        expected: 'a path or a path glob',
+        accepts: (value, transaction) => matchesPathGlob(String(value), pathOf(transaction)),
+    },
+    requestMediaType: {
+        valid: (value) => typeof value === 'string',
+        expected: 'a media type',
+        accepts: (value, { thymianReq }) => value === thymianReq.mediaType,
+    },
+    responseMediaType: {
+        valid: (value) => typeof value === 'string',
+        expected: 'a media type',
+        accepts: (value, { thymianRes }) => value === thymianRes.mediaType,
+    },
+};
+const FIELD_NAMES = Object.keys(FIELDS);
+/** The path a filter compares against: the description's own spelling. */
+export function pathOf(transaction) {
+    return canonicalPath(transaction.thymianReq.path);
+}
+function asList(value) {
+    if (value === undefined) {
+        return [];
+    }
+    return Array.isArray(value) ? value : [value];
+}
+/**
+ * Whether `value` is shaped like a filter.
+ *
+ * One known field is enough. Requiring *every* key to be known meant a single
+ * typo — `{ path: '/v1/**', tag: 'x' }` — was reported as "not a filter at
+ * all", which sends the reader looking for a selector they never wrote;
+ * {@link filterProblems} names the unknown key instead.
+ */
+export function isTransactionFilter(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return false;
+    }
+    return Object.keys(value).some((key) => key === 'not' || FIELD_NAMES.includes(key));
+}
+/**
+ * Everything wrong with a filter's own text, before any Transaction is
+ * consulted.
+ *
+ * Separate from matching because a filter that cannot mean anything is a
+ * different fault from one that means something nothing satisfies. Reporting a
+ * mistyped `'4xx'` as "all valid but intersects nothing" is the wrong sentence,
+ * and letting `{ method: 42 }` through produced a bare `TypeError` naming no
+ * file at all.
+ */
+export function filterProblems(filter) {
+    const problems = [];
+    const record = filter;
+    for (const key of Object.keys(record)) {
+        if (key === 'not') {
+            for (const exclusion of asList(record[key])) {
+                if (typeof exclusion !== 'object' ||
+                    exclusion === null ||
+                    Array.isArray(exclusion)) {
+                    problems.push('"not" takes a filter, or a list of filters, and nothing else');
+                    continue;
+                }
+                if (constrainsNothing(exclusion)) {
+                    problems.push('"not" was given an exclusion that constrains nothing, which would exclude every transaction');
+                }
+                problems.push(...filterProblems(exclusion).map((problem) => `inside "not": ${problem}`));
+            }
+            continue;
+        }
+        if (!FIELD_NAMES.includes(key)) {
+            problems.push(`"${key}" is not a filter field; the fields are ${FIELD_NAMES.map((name) => `"${name}"`).join(', ')} and "not"`);
+            continue;
+        }
+        const spec = FIELDS[key];
+        for (const value of asList(record[key])) {
+            if (!spec.valid(value)) {
+                problems.push(`"${key}" was given ${JSON.stringify(value) ?? String(value)}, but it takes ${spec.expected}`);
+            }
+        }
+    }
+    return problems;
+}
+/**
+ * Whether an exclusion constrains nothing at all.
+ *
+ * `matchesFields` is an `every` over the fields that are present, so a group
+ * with no present field is vacuously true — which as an *exclusion* means "not
+ * anything", excluding every transaction. `{ not: {} }` type-checks because
+ * every `FilterFields` member is optional, `{ not: { path: undefined } }` is
+ * what a computed list that came back `undefined` produces, and a `.js` hook
+ * can reach the same state with `{ not: { not: X } }`, whose only key is not a
+ * field at all. All three are the author asking to exclude nothing and getting
+ * everything.
+ */
+function constrainsNothing(fields) {
+    const record = fields;
+    return FIELD_NAMES.every((name) => record[name] === undefined);
+}
+/**
+ * Whether every field present in `fields` accepts `transaction`.
+ *
+ * A field that is simply absent (`undefined`) does not constrain — vacuously
+ * true, which is what lets `{ method: 'GET' }` leave every other field open.
+ * A field that is *present* with a value list that turns out empty is a
+ * different thing: `{ method: [] }` is a disjunction of zero alternatives,
+ * which is false by construction, never true. Collapsing the two would let a
+ * computed filter array that happened to come back empty silently widen into
+ * "this field doesn't matter" instead of "nothing satisfies this field" — see
+ * {@link emptyValueFields}, which reads this same rule back as data for the
+ * diagnostic.
+ */
+function matchesFields(fields, transaction) {
+    const record = fields;
+    return FIELD_NAMES.every((name) => {
+        const raw = record[name];
+        if (raw === undefined) {
+            return true;
+        }
+        const values = asList(raw);
+        return (values.length > 0 &&
+            values.some((value) => FIELDS[name].accepts(value, transaction)));
+    });
+}
+/**
+ * Field names `fields` gives an explicit, empty value list — a disjunction of
+ * zero alternatives, which {@link matchesFields} treats as always false.
+ *
+ * Read back from the same rule {@link matchesFields} applies, rather than a
+ * second definition of "empty": a field that is merely absent is not named
+ * here, only one that was given a value and that value is an empty array.
+ */
+export function emptyValueFields(fields) {
+    const record = fields;
+    return FIELD_NAMES.filter((name) => {
+        const raw = record[name];
+        return raw !== undefined && asList(raw).length === 0;
+    });
+}
+/**
+ * `matches(t) = positive(t) && !not.some(n => n(t))`.
+ *
+ * An empty positive side matches everything, which is what makes
+ * `{ not: { … } }` mean "all but these" without a second spelling.
+ */
+export function matchesTransactionFilter(filter, transaction) {
+    if (!matchesFields(filter, transaction)) {
+        return false;
+    }
+    // An exclusion that constrains nothing excludes nothing. Vacuous truth is
+    // the right answer for a *conjunction* of present fields and the wrong one
+    // for an exclusion, which would otherwise swallow the whole catalog.
+    // `filterProblems` reports it; this keeps the run's behaviour honest in the
+    // meantime, and keeps the diagnostic pointed at the real fault instead of
+    // the "values are all valid but intersect nothing" hint.
+    return !asList(filter.not).some((exclusion) => !constrainsNothing(exclusion) &&
+        matchesFields(exclusion, transaction));
+}
+/** Every path value a filter mentions, including the ones inside `not`. */
+export function pathValuesOf(filter) {
+    const own = asList(filter.path).filter((value) => typeof value === 'string');
+    const excluded = asList(filter.not).flatMap((exclusion) => asList(exclusion['path']).filter((value) => typeof value === 'string'));
+    return [...own, ...excluded];
+}
+//# sourceMappingURL=transaction-filter.js.map

package/dist/selectors/transaction-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction-filter.js","sourceRoot":"","sources":["../../src/selectors/transaction-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAgB9C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AA8BxD,0EAA0E;AAC1E,MAAM,YAAY,GAAG,WAAW,CAAC;AAmBjC,MAAM,MAAM,GAAG;IACb,MAAM,EAAE;QACN,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;QAC3C,QAAQ,EAAE,gBAAgB;QAC1B,wEAAwE;QACxE,gEAAgE;QAChE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CACjC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE;KAClE;IACD,MAAM,EAAE;QACN,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACtE,QAAQ,EAAE,4BAA4B;QACtC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,UAAU;KACpE;IACD,WAAW,EAAE;QACX,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QACvE,QAAQ,EAAE,qDAAqD;QAC/D,4EAA4E;QAC5E,uEAAuE;QACvE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CACjC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAW,CAAC;KACvE;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;QAC3C,QAAQ,EAAE,uBAAuB;QACjC,OAAO,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,CAC9B,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;KACtD;IACD,gBAAgB,EAAE;QAChB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;QAC3C,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,SAAS;KACnE;IACD,iBAAiB,EAAE;QACjB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ;QAC3C,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,UAAU,CAAC,SAAS;KACnE;CACkC,CAAC;AAItC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAsB,CAAC;AAE7D,0EAA0E;AAC1E,MAAM,UAAU,MAAM,CAAC,WAAmC;IACxD,OAAO,aAAa,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAC5B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,IAAK,WAAiC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC3E,CAAC;AACJ,CAAC;AAKD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB;IACtD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,MAAiC,CAAC;IAEjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC5C,IACE,OAAO,SAAS,KAAK,QAAQ;oBAC7B,SAAS,KAAK,IAAI;oBAClB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACxB,CAAC;oBACD,QAAQ,CAAC,IAAI,CACX,8DAA8D,CAC/D,CAAC;oBAEF,SAAS;gBACX,CAAC;gBAED,IAAI,iBAAiB,CAAC,SAAyB,CAAC,EAAE,CAAC;oBACjD,QAAQ,CAAC,IAAI,CACX,6FAA6F,CAC9F,CAAC;gBACJ,CAAC;gBAED,QAAQ,CAAC,IAAI,CACX,GAAG,cAAc,CAAC,SAA8B,CAAC,CAAC,GAAG,CACnD,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,OAAO,EAAE,CACxC,CACF,CAAC;YACJ,CAAC;YAED,SAAS;QACX,CAAC;QAED,IAAI,CAAE,WAAiC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,2CAA2C,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAChH,CAAC;YAEF,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAsB,CAAC,CAAC;QAE5C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,eAAe,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,QAAQ,EAAE,CAC9F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,MAAoB;IAC7C,MAAM,MAAM,GAAG,MAAiC,CAAC;IAEjD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,aAAa,CACpB,MAAoB,EACpB,WAAmC;IAEnC,MAAM,MAAM,GAAG,MAAiC,CAAC;IAEjD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAEzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAE3B,OAAO,CACL,MAAM,CAAC,MAAM,GAAG,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CACjE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAoB;IACnD,MAAM,MAAM,GAAG,MAAiC,CAAC;IAEjD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAEzB,OAAO,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAyB,EACzB,WAAmC;IAEnC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,4EAA4E;IAC5E,0EAA0E;IAC1E,yDAAyD;IACzD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAC7B,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,iBAAiB,CAAC,SAAyB,CAAC;QAC7C,aAAa,CAAC,SAAyB,EAAE,WAAW,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,MAAyB;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CACpC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CACxD,MAAM,CAAE,SAAqC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAC3D,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD,CACF,CAAC;IAEF,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC/B,CAAC"}

package/dist/ts-path.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Normalizes a filesystem path to the forward-slash form TypeScript itself
+ * uses for `ts.SourceFile.fileName` and `ts.Diagnostic.file.fileName` —
+ * `ts.createProgram` produces that form regardless of platform, while
+ * `node:path` (`join`, `relative`, `mkdtemp`) produces the platform's own
+ * separator, backslashes on Windows.
+ *
+ * Printing a path for a user (a tsconfig `exclude` hint, a tree listing) goes
+ * through this directly. Comparing a path against a TypeScript file name
+ * should go through {@link isSameTsPath} or {@link tsPathRelativeTo} instead —
+ * they normalize both sides so a caller cannot compare a raw one against a
+ * normalized one by mistake.
+ */
+export declare function toTypeScriptPath(path: string): string;
+/**
+ * Whether two paths — a TypeScript file name and/or a `node:path` value —
+ * name the same file, ignoring separator style.
+ *
+ * A raw `===` holds on POSIX, where the two forms are already the same
+ * string, and silently never matches on Windows.
+ */
+export declare function isSameTsPath(a: string, b: string): boolean;
+/**
+ * `fileName`'s path relative to `root`, both normalized first — or
+ * `undefined` when `fileName` does not fall under `root`.
+ *
+ * This is the exclusion test and the display path in one: `validate`'s
+ * scratch-surface exclusion asks only whether the result is `undefined`, and
+ * the compile probe's diagnostic location uses the string itself. A raw
+ * `startsWith`/`slice` pair against un-normalized paths is what let every
+ * scratch-surface diagnostic through on Windows — `scratch` is a `node:path`
+ * value and `fileName` is TypeScript's own forward-slashed form, so the
+ * comparison never matched.
+ */
+export declare function tsPathRelativeTo(fileName: string, root: string): string | undefined;
+//# sourceMappingURL=ts-path.d.ts.map

package/dist/ts-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ts-path.d.ts","sourceRoot":"","sources":["../src/ts-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAOpB"}

package/dist/ts-path.js

@@ -0,0 +1,46 @@
+/**
+ * Normalizes a filesystem path to the forward-slash form TypeScript itself
+ * uses for `ts.SourceFile.fileName` and `ts.Diagnostic.file.fileName` —
+ * `ts.createProgram` produces that form regardless of platform, while
+ * `node:path` (`join`, `relative`, `mkdtemp`) produces the platform's own
+ * separator, backslashes on Windows.
+ *
+ * Printing a path for a user (a tsconfig `exclude` hint, a tree listing) goes
+ * through this directly. Comparing a path against a TypeScript file name
+ * should go through {@link isSameTsPath} or {@link tsPathRelativeTo} instead —
+ * they normalize both sides so a caller cannot compare a raw one against a
+ * normalized one by mistake.
+ */
+export function toTypeScriptPath(path) {
+    return path.split(/[\\/]/).join('/');
+}
+/**
+ * Whether two paths — a TypeScript file name and/or a `node:path` value —
+ * name the same file, ignoring separator style.
+ *
+ * A raw `===` holds on POSIX, where the two forms are already the same
+ * string, and silently never matches on Windows.
+ */
+export function isSameTsPath(a, b) {
+    return toTypeScriptPath(a) === toTypeScriptPath(b);
+}
+/**
+ * `fileName`'s path relative to `root`, both normalized first — or
+ * `undefined` when `fileName` does not fall under `root`.
+ *
+ * This is the exclusion test and the display path in one: `validate`'s
+ * scratch-surface exclusion asks only whether the result is `undefined`, and
+ * the compile probe's diagnostic location uses the string itself. A raw
+ * `startsWith`/`slice` pair against un-normalized paths is what let every
+ * scratch-surface diagnostic through on Windows — `scratch` is a `node:path`
+ * value and `fileName` is TypeScript's own forward-slashed form, so the
+ * comparison never matched.
+ */
+export function tsPathRelativeTo(fileName, root) {
+    const path = toTypeScriptPath(fileName);
+    const rootPath = toTypeScriptPath(root);
+    return path === rootPath || path.startsWith(`${rootPath}/`)
+        ? path.slice(rootPath.length + 1)
+        : undefined;
+}
+//# sourceMappingURL=ts-path.js.map

package/dist/ts-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ts-path.js","sourceRoot":"","sources":["../src/ts-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,OAAO,gBAAgB,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAExC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACjC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/dist/utils.d.ts

@@ -1,4 +1,3 @@
-export declare function sanitize(name: string): string;
-export declare function checkForSafePath(path: string, baseDir: string): void;
+/** Whether a filesystem entry exists at `path`. */
 export declare function entryExists(path: string): Promise<boolean>;
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAKA,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAmBpE;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOhE"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAEA,mDAAmD;AACnD,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOhE"}

package/dist/utils.js

@@ -1,29 +1,11 @@
 import { access } from 'node:fs/promises';
-import { isAbsolute, relative, resolve, sep } from 'node:path';
-import { ThymianBaseError } from '@thymian/core';
-export function sanitize(name) {
-    return decodeURIComponent(name).replace(/[^a-z0-9.-]/gi, '_');
-}
-export function checkForSafePath(path, baseDir) {
-    const resolvedBaseDir = resolve(baseDir);
-    const resolvedPath = resolve(resolvedBaseDir, path);
-    const relativePath = relative(resolvedBaseDir, resolvedPath);
-    const isSafe = relativePath !== '..' &&
-        !relativePath.startsWith(`..${sep}`) &&
-        !isAbsolute(relativePath);
-    if (!isSafe) {
-        throw new ThymianBaseError(`Access denied. Path "${resolvedPath}" is outside of the base directory "${resolvedBaseDir}".`, {
-            name: 'PathTraversalError',
-            ref: 'https://thymian.dev/references/errors/path-traversal-error/',
-        });
-    }
-}
+/** Whether a filesystem entry exists at `path`. */
 export async function entryExists(path) {
     try {
         await access(path);
         return true;
     }
-    catch (e) {
+    catch {
         return false;
     }
 }

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAe;IAC5D,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAE7D,MAAM,MAAM,GACV,YAAY,KAAK,IAAI;QACrB,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QACpC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAE5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAgB,CACxB,wBAAwB,YAAY,uCAAuC,eAAe,IAAI,EAC9F;YACE,IAAI,EAAE,oBAAoB;YAC1B,GAAG,EAAE,6DAA6D;SACnE,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/validation/canonicalize.d.ts

@@ -0,0 +1,17 @@
+/**
+ * A comparison form of a declaration file: every token, one space apart, with
+ * comments and JSDoc gone.
+ *
+ * The drift signal is about the *type surface*, not about its prose. A
+ * description-only edit in the API description changes the JSDoc the emitter
+ * writes and nothing else, and reporting that as drift would make the gate red
+ * for a diff that cannot break a hook. Reformatting is the same class of
+ * non-event.
+ *
+ * Tokenized rather than regex-stripped: `//` inside a string literal is not a
+ * comment, and a scanner is the only thing that knows the difference.
+ */
+export declare function canonicalize(source: string): string;
+/** Whether two declaration files say the same thing about types. */
+export declare function sameSurface(a: string, b: string): boolean;
+//# sourceMappingURL=canonicalize.d.ts.map

package/dist/validation/canonicalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/validation/canonicalize.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBnD;AAED,oEAAoE;AACpE,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/dist/validation/canonicalize.js

@@ -0,0 +1,29 @@
+import ts from 'typescript';
+/**
+ * A comparison form of a declaration file: every token, one space apart, with
+ * comments and JSDoc gone.
+ *
+ * The drift signal is about the *type surface*, not about its prose. A
+ * description-only edit in the API description changes the JSDoc the emitter
+ * writes and nothing else, and reporting that as drift would make the gate red
+ * for a diff that cannot break a hook. Reformatting is the same class of
+ * non-event.
+ *
+ * Tokenized rather than regex-stripped: `//` inside a string literal is not a
+ * comment, and a scanner is the only thing that knows the difference.
+ */
+export function canonicalize(source) {
+    const scanner = ts.createScanner(ts.ScriptTarget.Latest, 
+    // Skip trivia: whitespace and comments never reach us.
+    true, ts.LanguageVariant.Standard, source);
+    const tokens = [];
+    for (let token = scanner.scan(); token !== ts.SyntaxKind.EndOfFileToken; token = scanner.scan()) {
+        tokens.push(scanner.getTokenText());
+    }
+    return tokens.join(' ');
+}
+/** Whether two declaration files say the same thing about types. */
+export function sameSurface(a, b) {
+    return canonicalize(a) === canonicalize(b);
+}
+//# sourceMappingURL=canonicalize.js.map

package/dist/validation/canonicalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.js","sourceRoot":"","sources":["../../src/validation/canonicalize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,OAAO,GAAG,EAAE,CAAC,aAAa,CAC9B,EAAE,CAAC,YAAY,CAAC,MAAM;IACtB,uDAAuD;IACvD,IAAI,EACJ,EAAE,CAAC,eAAe,CAAC,QAAQ,EAC3B,MAAM,CACP,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KACE,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,EAC1B,KAAK,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,EACtC,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,EACtB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/validation/shared-compiler-host.d.ts

@@ -0,0 +1,17 @@
+import ts from 'typescript';
+/**
+ * A `ts.CompilerHost` that reuses {@link sourceFiles} across every call to
+ * `ts.createProgram` a caller makes with it.
+ *
+ * Each compile-seam program here pins the same `target`/`lib` (ES2023), so
+ * `ts.createProgram`'s dominant cost — parsing the lib closure — is identical
+ * work performed again on every "cold" program. That cost was paid once per
+ * `it()` block across dozens of compile-seam tests, and once per `validate`
+ * call in production. A plain `ts.createCompilerHost` has no cross-call cache
+ * of its own; this wraps `getSourceFile` with one that does, which is what the
+ * review's "share compiler state instead of a cold program per test" asked
+ * for — `validate` benefits the same way the tests do, since it goes through
+ * the same host.
+ */
+export declare function sharedCompilerHost(options: ts.CompilerOptions): ts.CompilerHost;
+//# sourceMappingURL=shared-compiler-host.d.ts.map

package/dist/validation/shared-compiler-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-compiler-host.d.ts","sourceRoot":"","sources":["../../src/validation/shared-compiler-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAsB5B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,EAAE,CAAC,eAAe,GAC1B,EAAE,CAAC,YAAY,CA2CjB"}

package/dist/validation/shared-compiler-host.js

@@ -0,0 +1,58 @@
+import ts from 'typescript';
+/**
+ * A parsed-`SourceFile` cache, shared by every `ts.CompilerHost` this module
+ * hands out.
+ *
+ * **Only TypeScript's own `lib.*.d.ts` closure.** That closure is the whole
+ * win — it is the dominant cost of a cold `ts.createProgram`, every program
+ * here pins the same `target`/`lib`, and it lives at a fixed path under
+ * `node_modules/typescript` that cannot change within a process.
+ *
+ * Nothing else may be cached, because a file name is not a version. The
+ * probes write under a fresh `mkdtemp` root per call, so caching them only
+ * grows the map forever; the user's hooks are worse — `typecheck-hooks.ts`
+ * compiles them at their *stable* paths, and `sampler.validate` is an ordinary
+ * action that `thymian serve` dispatches over the WebSocket proxy. In one
+ * long-lived `serve` process the second `validate` after an edit would have
+ * type-checked the first call's parse: a fixed hook still reporting its old
+ * error, a newly broken one passing. One-shot CLI runs never showed it.
+ */
+const sourceFiles = new Map();
+/**
+ * A `ts.CompilerHost` that reuses {@link sourceFiles} across every call to
+ * `ts.createProgram` a caller makes with it.
+ *
+ * Each compile-seam program here pins the same `target`/`lib` (ES2023), so
+ * `ts.createProgram`'s dominant cost — parsing the lib closure — is identical
+ * work performed again on every "cold" program. That cost was paid once per
+ * `it()` block across dozens of compile-seam tests, and once per `validate`
+ * call in production. A plain `ts.createCompilerHost` has no cross-call cache
+ * of its own; this wraps `getSourceFile` with one that does, which is what the
+ * review's "share compiler state instead of a cold program per test" asked
+ * for — `validate` benefits the same way the tests do, since it goes through
+ * the same host.
+ */
+export function sharedCompilerHost(options) {
+    const host = ts.createCompilerHost(options, true);
+    const getSourceFile = host.getSourceFile.bind(host);
+    const libDirectory = host.getDefaultLibLocation?.();
+    /** Immutable for the life of the process, so safe to hold parsed. */
+    const isLibFile = (fileName) => libDirectory !== undefined &&
+        fileName.startsWith(libDirectory.endsWith('/') ? libDirectory : `${libDirectory}/`);
+    host.getSourceFile = (fileName, languageVersionOrOptions, onError, shouldCreateNewSourceFile) => {
+        const cacheable = isLibFile(fileName);
+        if (cacheable && !shouldCreateNewSourceFile) {
+            const cached = sourceFiles.get(fileName);
+            if (cached) {
+                return cached;
+            }
+        }
+        const sourceFile = getSourceFile(fileName, languageVersionOrOptions, onError, shouldCreateNewSourceFile);
+        if (sourceFile && cacheable) {
+            sourceFiles.set(fileName, sourceFile);
+        }
+        return sourceFile;
+    };
+    return host;
+}
+//# sourceMappingURL=shared-compiler-host.js.map

package/dist/validation/shared-compiler-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-compiler-host.js","sourceRoot":"","sources":["../../src/validation/shared-compiler-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA2B;IAE3B,MAAM,IAAI,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;IAEpD,qEAAqE;IACrE,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC9C,YAAY,KAAK,SAAS;QAC1B,QAAQ,CAAC,UAAU,CACjB,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,CAC/D,CAAC;IAEJ,IAAI,CAAC,aAAa,GAAG,CACnB,QAAQ,EACR,wBAAwB,EACxB,OAAO,EACP,yBAAyB,EACzB,EAAE;QACF,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,SAAS,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAEzC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,aAAa,CAC9B,QAAQ,EACR,wBAAwB,EACxB,OAAO,EACP,yBAAyB,CAC1B,CAAC;QAEF,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;YAC5B,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC;AACd,CAAC"}