@wrtnlabs/evidence 0.0.0

package/lib/internal/WatchDependencySnapshot.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WatchDependencySnapshot = void 0;
+const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:fs/promises");
+/**
+ * Immutable filesystem versions used to validate a watch attempt before publication.
+ *
+ * Versions include symlink and directory-entry state because either can change
+ * which source is read; a content-only check would miss resolution changes.
+ */
+class WatchDependencySnapshot {
+    versions;
+    /**
+     * Creates a snapshot from already captured dependency version strings.
+     *
+     * capture and select are the only constructors because callers must not invent
+     * values that would falsely validate a watch attempt.
+     */
+    constructor(versions) {
+        this.versions = versions;
+    }
+    /**
+     * Captures every dependency asynchronously, encoding inaccessible paths as observable failures.
+     *
+     * Watch publication compares this baseline with a later capture so deletion,
+     * permission failure, and repair all count as distinct filesystem states.
+     */
+    static async capture(dependencies) {
+        const versions = new Map();
+        for (const dependency of dependencies)
+            versions.set(key(dependency), await version(dependency));
+        return new WatchDependencySnapshot(versions);
+    }
+    /**
+     * States whether two snapshots cover the same dependencies at the same versions.
+     *
+     * Watch attempts publish only when this equality holds, preventing output from
+     * describing a source state that changed during analysis.
+     */
+    equals(other) {
+        if (this.versions.size !== other.versions.size)
+            return false;
+        for (const [location, value] of this.versions)
+            if (other.versions.get(location) !== value)
+                return false;
+        return true;
+    }
+    /**
+     * Returns a dependency subset captured by this stable baseline.
+     *
+     * Every requested key must exist in the baseline; omission throws rather than
+     * allowing a narrower snapshot to validate unrelated watch work.
+     */
+    select(dependencies) {
+        const selected = new Map();
+        for (const dependency of dependencies) {
+            const location = key(dependency);
+            const value = this.versions.get(location);
+            if (value === undefined)
+                throw new Error(`Watch dependency '${dependency.path}' was not captured.`);
+            selected.set(location, value);
+        }
+        return new WatchDependencySnapshot(selected);
+    }
+}
+exports.WatchDependencySnapshot = WatchDependencySnapshot;
+/**
+ * Reads a stable watch version without throwing on ordinary filesystem disappearance.
+ *
+ * capture uses this value for each dependency so failures become comparable state
+ * and a repaired path invalidates the prior failed snapshot.
+ */
+async function version(dependency) {
+    let link;
+    try {
+        link = await (0, promises_1.lstat)(dependency.path, { bigint: true });
+    }
+    catch (cause) {
+        return failure(cause);
+    }
+    const values = [metadata(link)];
+    let followed = link;
+    if (link.isSymbolicLink()) {
+        try {
+            values.push(`link:${await (0, promises_1.readlink)(dependency.path)}`);
+            values.push(`real:${await (0, promises_1.realpath)(dependency.path)}`);
+            followed = await (0, promises_1.stat)(dependency.path, { bigint: true });
+            values.push(metadata(followed));
+        }
+        catch (cause) {
+            values.push(failure(cause));
+            return values.join("\u0001");
+        }
+    }
+    try {
+        if (followed.isFile())
+            values.push(`content:${(0, node_crypto_1.createHash)("sha256")
+                .update(await (0, promises_1.readFile)(dependency.path))
+                .digest("hex")}`);
+        else if (followed.isDirectory() && dependency.recursive)
+            values.push(`entries:${(await (0, promises_1.readdir)(dependency.path, { withFileTypes: true }))
+                .sort(compareEntries)
+                .map(entryVersion)
+                .join("\u0000")}`);
+    }
+    catch (cause) {
+        values.push(failure(cause));
+    }
+    return values.join("\u0001");
+}
+/**
+ * Serializes metadata fields whose changes can affect filesystem resolution or reads.
+ *
+ * File and link versions include this component before content or directory entries
+ * so metadata-only replacement is observable to the watch baseline.
+ */
+function metadata(info) {
+    return [
+        info.mode,
+        info.size,
+        info.mtimeNs,
+        info.ctimeNs,
+        info.dev,
+        info.ino,
+    ].join(":");
+}
+/**
+ * Encodes a directory entry's name and coarse type for recursive invalidation.
+ *
+ * Recursive directory versions use this value after sorting, so additions,
+ * removals, and entry-type changes invalidate the dependency snapshot.
+ */
+function entryVersion(entry) {
+    const kind = entry.isDirectory()
+        ? "directory"
+        : entry.isFile()
+            ? "file"
+            : entry.isSymbolicLink()
+                ? "link"
+                : "other";
+    return `${kind}:${entry.name}`;
+}
+/**
+ * Sorts directory entries before deterministic concatenation.
+ *
+ * Filesystem enumeration order is not stable, so version derives the same string
+ * for an unchanged recursive directory across captures.
+ */
+function compareEntries(left, right) {
+    return left.name < right.name ? -1 : left.name > right.name ? 1 : 0;
+}
+/**
+ * Distinguishes exact and recursive observations of the same filesystem path.
+ *
+ * Snapshot maps use this key so a file watch cannot be substituted for the
+ * broader directory observation required by a recursive dependency.
+ */
+function key(dependency) {
+    return `${dependency.recursive ? "recursive" : "exact"}:${dependency.path}`;
+}
+/**
+ * Turns a failed filesystem read into versioned state.
+ *
+ * The encoded error lets later repair produce a different snapshot instead of
+ * making disappearance invisible to the watch publication check.
+ */
+function failure(cause) {
+    return `error:${errorCode(cause)}:${errorMessage(cause)}`;
+}
+/**
+ * Extracts a platform error code without assuming every thrown value is an Error.
+ *
+ * failure uses UNKNOWN for non-Error values and errors without string codes so
+ * opaque exceptions still become stable observable watch state.
+ */
+function errorCode(cause) {
+    if (!(cause instanceof Error) || !("code" in cause))
+        return "UNKNOWN";
+    const code = cause.code;
+    return typeof code === "string" ? code : "UNKNOWN";
+}
+/**
+ * Preserves a human-readable component for otherwise opaque watch failures.
+ *
+ * Together with errorCode, this distinguishes read failures in snapshot values
+ * while retaining useful context for diagnostics and change detection.
+ */
+function errorMessage(cause) {
+    return cause instanceof Error ? cause.message : String(cause);
+}

package/lib/internal/createEvidenceConfigPlan.d.ts

@@ -0,0 +1,10 @@
+import type { IEvidenceConfig } from "../structures/IEvidenceConfig";
+import type { IEvidenceConfigPlan } from "../structures/IEvidenceConfigPlan";
+/**
+ * Validates configuration and derives the immutable enabled-analysis plan.
+ *
+ * Validation precedes filtering so a disabled or off entry cannot hide an
+ * invalid declaration. The plan clones populations to prevent later caller
+ * mutation from changing an in-progress graph evaluation.
+ */
+export declare function createEvidenceConfigPlan(config: IEvidenceConfig, configFile?: string): IEvidenceConfigPlan;

package/lib/internal/createEvidenceConfigPlan.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEvidenceConfigPlan = createEvidenceConfigPlan;
+const node_path_1 = require("node:path");
+const EvidenceLanguageRegistry_1 = require("../parsers/EvidenceLanguageRegistry");
+const validateEvidenceConfig_1 = require("./validateEvidenceConfig");
+/**
+ * Validates configuration and derives the immutable enabled-analysis plan.
+ *
+ * Validation precedes filtering so a disabled or off entry cannot hide an
+ * invalid declaration. The plan clones populations to prevent later caller
+ * mutation from changing an in-progress graph evaluation.
+ */
+function createEvidenceConfigPlan(config, configFile) {
+    const filename = configFile ?? (0, node_path_1.resolve)("evidence.config.ts");
+    (0, validateEvidenceConfig_1.validateEvidenceConfig)(config, filename);
+    const rootSeverity = config.severity ?? "error";
+    const claims = [];
+    config.claims.forEach((claim, index) => {
+        const severity = claim.severity ?? rootSeverity;
+        if (claim.disabled === true || severity === "off")
+            return;
+        const references = referenceList(claim).flatMap((reference, referenceIndex) => {
+            const referenceSeverity = reference.severity ?? severity;
+            if (referenceSeverity === "off")
+                return [];
+            return [
+                {
+                    index: referenceIndex,
+                    population: structuredClone(reference),
+                    severity: active(referenceSeverity),
+                    symbols: symbols(reference, true),
+                },
+            ];
+        });
+        if (references.length === 0)
+            return;
+        claims.push({
+            index,
+            population: structuredClone(claim),
+            severity: active(severity),
+            symbols: symbols(claim, false),
+            references,
+        });
+    });
+    return { configFile: filename, claims };
+}
+/** Narrows a retained severity and defends the invariant established by plan filtering.
+ *
+ * Plan construction has already removed unsupported values, so this helper documents and enforces the remaining configuration contract.
+ */
+function active(severity) {
+    if (severity === "off")
+        throw new Error("An inactive severity cannot enter the Evidence config plan.");
+    return severity;
+}
+/** Normalizes singular and plural reference syntax without changing reference order.
+ *
+ * Later plan consumers preserve that order when resolving target applicability and reporting configuration results.
+ */
+function referenceList(claim) {
+    return Array.isArray(claim.reference) ? claim.reference : [claim.reference];
+}
+/** Applies artifact defaults only when configuration did not explicitly select symbols.
+ *
+ * An explicit empty or narrowed symbol selection is never replaced by the artifact's broad default population.
+ */
+function symbols(population, reference) {
+    if (population.symbol !== undefined)
+        return Array.isArray(population.symbol)
+            ? [...population.symbol]
+            : [population.symbol];
+    if (population.type === "markdown")
+        return ["file", "h1", "h2", "h3", "h4"];
+    if (population.type === "swagger")
+        return ["operation"];
+    if (DATABASE_TYPES.has(population.type))
+        return reference ? ["model"] : ["model", "column", "relation"];
+    const supported = EvidenceLanguageRegistry_1.EvidenceLanguageRegistry.list().find((language) => language.type === population.type)?.adapter?.symbols ?? ["type", "function", "property"];
+    return reference && supported.includes("type") ? ["type"] : [...supported];
+}
+const DATABASE_TYPES = new Set([
+    "prisma",
+    "sql",
+    "postgresql",
+    "mysql",
+    "sqlite",
+    "bigquery",
+    "dbml",
+]);

package/lib/internal/evaluateTypeScriptConfig.d.ts

@@ -0,0 +1,9 @@
+import type { IEvaluateTypeScriptConfigOptions } from "./IEvaluateTypeScriptConfigOptions";
+/**
+ * Typechecks and evaluates a config in an isolated temporary project through its own ttsx.
+ *
+ * The evaluator resolves the consumer's compiler rather than this package's,
+ * and serializes the default export with V8 so invalid configuration values
+ * reach parent-side validation without JSON silently dropping them.
+ */
+export declare function evaluateTypeScriptConfig(configFile: string, options?: IEvaluateTypeScriptConfigOptions): Promise<unknown>;

package/lib/internal/evaluateTypeScriptConfig.js

@@ -0,0 +1,341 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateTypeScriptConfig = evaluateTypeScriptConfig;
+const _assertGuard_1 = __importStar(require("typia/lib/internal/_assertGuard"));
+const utils_1 = require("@typia/utils");
+const node_child_process_1 = require("node:child_process");
+const promises_1 = require("node:fs/promises");
+const node_module_1 = require("node:module");
+const node_os_1 = require("node:os");
+const node_path_1 = __importDefault(require("node:path"));
+const node_v8_1 = require("node:v8");
+const typia_1 = __importDefault(require("typia"));
+/**
+ * Typechecks and evaluates a config in an isolated temporary project through its own ttsx.
+ *
+ * The evaluator resolves the consumer's compiler rather than this package's,
+ * and serializes the default export with V8 so invalid configuration values
+ * reach parent-side validation without JSON silently dropping them.
+ */
+async function evaluateTypeScriptConfig(configFile, options = {}) {
+    const requireFromConfig = (0, node_module_1.createRequire)(configFile);
+    let launcher;
+    let compiler;
+    try {
+        const manifestFile = requireFromConfig.resolve("ttsc/package.json");
+        const manifest = (() => {
+            const _ao0 = (input, _path, _exceptionable = true) => ("object" === typeof input.bin && null !== input.bin || _assertGuard_1._assertGuard(_exceptionable, {
+                method: "typia.json.assertParse",
+                path: _path + ".bin",
+                expected: "ITtsxExecutables",
+                value: input.bin
+            }, _errorFactory)) && _ao1(input.bin, _path + ".bin", true && _exceptionable) || _assertGuard_1._assertGuard(_exceptionable, {
+                method: "typia.json.assertParse",
+                path: _path + ".bin",
+                expected: "ITtsxExecutables",
+                value: input.bin
+            }, _errorFactory);
+            const _ao1 = (input, _path, _exceptionable = true) => "string" === typeof input.ttsx || _assertGuard_1._assertGuard(_exceptionable, {
+                method: "typia.json.assertParse",
+                path: _path + ".ttsx",
+                expected: "string",
+                value: input.ttsx
+            }, _errorFactory);
+            const _io0 = input => "object" === typeof input.bin && null !== input.bin && _io1(input.bin);
+            const _io1 = input => "string" === typeof input.ttsx;
+            const __is = input => "object" === typeof input && null !== input && _io0(input);
+            let _errorFactory;
+            const __assert = (input, errorFactory) => {
+                if (false === __is(input)) {
+                    _errorFactory = errorFactory;
+                    ((input, _path, _exceptionable = true) => ("object" === typeof input && null !== input || _assertGuard_1._assertGuard(true, {
+                        method: "typia.json.assertParse",
+                        path: _path + "",
+                        expected: "ITtsxManifest",
+                        value: input
+                    }, _errorFactory)) && _ao0(input, _path + "", true) || _assertGuard_1._assertGuard(true, {
+                        method: "typia.json.assertParse",
+                        path: _path + "",
+                        expected: "ITtsxManifest",
+                        value: input
+                    }, _errorFactory))(input, "$input", true);
+                }
+                return input;
+            };
+            return (input, errorFactory) => __assert(JSON.parse(input), errorFactory);
+        })()(await (0, promises_1.readFile)(manifestFile, "utf8"));
+        launcher = node_path_1.default.resolve(node_path_1.default.dirname(manifestFile), manifest.bin.ttsx);
+        const typescript = requireFromConfig.resolve("typescript/package.json");
+        const platform = (0, node_module_1.createRequire)(typescript).resolve(`@typescript/typescript-${process.platform}-${process.arch}/package.json`);
+        compiler = node_path_1.default.join(node_path_1.default.dirname(platform), "lib", process.platform === "win32" ? "tsc.exe" : "tsc");
+        if (!(await (0, promises_1.stat)(launcher)).isFile() || !(await (0, promises_1.stat)(compiler)).isFile())
+            throw new Error("Compiler launcher or platform binary is not a file.");
+    }
+    catch (cause) {
+        throw new Error(`Cannot resolve the compiler for ${configFile}. Install it with: pnpm i -D typescript ttsc @wrtnlabs/evidence`, { cause });
+    }
+    const directory = node_path_1.default.dirname(configFile);
+    const nodeModules = await findNodeModules(directory);
+    const temporary = await (0, promises_1.realpath)(await (0, promises_1.mkdtemp)(node_path_1.default.join(await tempBase(configFile, nodeModules), "evidence-config-")));
+    let failed = false;
+    try {
+        if (nodeModules !== undefined)
+            await (0, promises_1.symlink)(nodeModules, node_path_1.default.join(temporary, "node_modules"), "junction");
+        const entry = node_path_1.default.join(temporary, "loader.ts");
+        const writer = node_path_1.default.join(temporary, "write-result.cjs");
+        const resultFile = node_path_1.default.join(temporary, "result.bin");
+        const project = node_path_1.default.join(temporary, "tsconfig.json");
+        const relative = node_path_1.default.relative(temporary, configFile).replaceAll("\\", "/");
+        await (0, promises_1.writeFile)(entry, (0, utils_1.dedent) `
+        import config from EVIDENCE_CONFIG_FILE;
+        import write from "./write-result.cjs";
+
+        void write(config);
+      `.replace("EVIDENCE_CONFIG_FILE", () => JSON.stringify(relative.startsWith(".") ? relative : `./${relative}`)));
+        // V8 serialization preserves invalid values such as undefined and BigInt for
+        // parent-side validation; JSON serialization could erase them first.
+        await (0, promises_1.writeFile)(writer, (0, utils_1.dedent) `
+        const { writeFile } = require("node:fs/promises");
+        const { serialize } = require("node:v8");
+
+        module.exports = async function write(value) {
+          try {
+            await writeFile(EVIDENCE_RESULT_FILE, serialize(value));
+          } catch (error) {
+            console.error(error);
+            process.exitCode = 1;
+          }
+        };
+      `.replace("EVIDENCE_RESULT_FILE", () => JSON.stringify(resultFile)));
+        await (0, promises_1.writeFile)(node_path_1.default.join(temporary, "write-result.d.cts"), (0, utils_1.dedent) `
+        declare function write(value: unknown): Promise<void>;
+        export = write;
+      `);
+        await (0, promises_1.writeFile)(project, JSON.stringify({
+            compilerOptions: {
+                target: "ES2023",
+                module: await configModule(configFile),
+                moduleResolution: "bundler",
+                strict: true,
+                esModuleInterop: true,
+                skipLibCheck: true,
+                allowJs: true,
+                checkJs: false,
+                allowImportingTsExtensions: true,
+                rewriteRelativeImportExtensions: true,
+                resolveJsonModule: true,
+                types: ["*"],
+                rootDir: node_path_1.default.parse(temporary).root.replaceAll("\\", "/"),
+                outDir: node_path_1.default.join(temporary, "out").replaceAll("\\", "/"),
+            },
+            files: [entry, configFile],
+        }, null, 2));
+        await runEvaluator(configFile, [
+            launcher,
+            "--binary",
+            compiler,
+            "--project",
+            project,
+            "--cwd",
+            directory,
+            "--no-plugins",
+            "--cache-dir",
+            node_path_1.default.join(temporary, "cache"),
+            entry,
+        ], options.writeDiagnostic ?? writeProcessDiagnostic);
+        if (!(await exists(resultFile)))
+            throw new Error(`Config evaluator for ${configFile} exited without returning its default export.`);
+        const value = (0, node_v8_1.deserialize)(await (0, promises_1.readFile)(resultFile));
+        return value;
+    }
+    catch (cause) {
+        failed = true;
+        throw cause;
+    }
+    finally {
+        await (0, promises_1.rm)(temporary, {
+            recursive: true,
+            force: true,
+            maxRetries: 3,
+            retryDelay: 100,
+        }).catch((cause) => {
+            // Preserve the evaluator's diagnostic if cleanup also fails.
+            if (!failed)
+                throw cause;
+        });
+    }
+}
+/** Starts the isolated evaluator and forwards compiler output without parsing or rewriting it.
+ *
+ * Config loading owns the failure boundary, while this helper preserves TypeScript and runtime diagnostics in their original format.
+ */
+function runEvaluator(configFile, args, writeDiagnostic) {
+    return new Promise((resolve, reject) => {
+        const child = (0, node_child_process_1.spawn)(process.execPath, args, {
+            cwd: node_path_1.default.dirname(configFile),
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", writeDiagnostic);
+        child.stderr.on("data", writeDiagnostic);
+        child.once("error", (cause) => {
+            reject(new Error(`Could not start the config evaluator for ${configFile}.`, {
+                cause,
+            }));
+        });
+        child.once("close", (code, signal) => {
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`Config evaluation failed for ${configFile} (${signal ?? `exit ${String(code)}`}). See compiler or runtime diagnostics above.`));
+        });
+    });
+}
+/** Writes child diagnostics to the parent process while preserving compiler formatting.
+ *
+ * The evaluator streams both output channels here so users receive compiler context before config loading rejects.
+ */
+function writeProcessDiagnostic(content) {
+    process.stderr.write(content);
+}
+/** Determines module kind from Node's nearest package boundary without inheriting application tsconfig settings.
+ *
+ * The temporary evaluator must follow the configuration file's runtime module rules, rather than unrelated compiler options from the application.
+ */
+async function configModule(configFile) {
+    if (node_path_1.default.extname(configFile) === ".mts")
+        return "ESNext";
+    if (node_path_1.default.extname(configFile) === ".cts")
+        return "CommonJS";
+    let directory = node_path_1.default.dirname(configFile);
+    for (;;) {
+        const file = node_path_1.default.join(directory, "package.json");
+        if (await exists(file)) {
+            const scope = (() => {
+                const _ao0 = (input, _path, _exceptionable = true) => undefined === input.type || "string" === typeof input.type || _assertGuard_1._assertGuard(_exceptionable, {
+                    method: "typia.json.assertParse",
+                    path: _path + ".type",
+                    expected: "(string | undefined)",
+                    value: input.type
+                }, _errorFactory);
+                const _io0 = input => undefined === input.type || "string" === typeof input.type;
+                const __is = input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+                let _errorFactory;
+                const __assert = (input, errorFactory) => {
+                    if (false === __is(input)) {
+                        _errorFactory = errorFactory;
+                        ((input, _path, _exceptionable = true) => ("object" === typeof input && null !== input && false === Array.isArray(input) || _assertGuard_1._assertGuard(true, {
+                            method: "typia.json.assertParse",
+                            path: _path + "",
+                            expected: "IConfigPackageScope",
+                            value: input
+                        }, _errorFactory)) && _ao0(input, _path + "", true) || _assertGuard_1._assertGuard(true, {
+                            method: "typia.json.assertParse",
+                            path: _path + "",
+                            expected: "IConfigPackageScope",
+                            value: input
+                        }, _errorFactory))(input, "$input", true);
+                    }
+                    return input;
+                };
+                return (input, errorFactory) => __assert(JSON.parse(input), errorFactory);
+            })()(await (0, promises_1.readFile)(file, "utf8"));
+            return scope.type === "module" ? "ESNext" : "CommonJS";
+        }
+        const parent = node_path_1.default.dirname(directory);
+        if (parent === directory)
+            return "CommonJS";
+        directory = parent;
+    }
+}
+/** Finds the nearest reusable dependency tree so the temporary project resolves the consumer's packages.
+ *
+ * The evaluator links this tree instead of resolving dependencies from Evidence's own installation location.
+ */
+async function findNodeModules(start) {
+    let directory = start;
+    for (;;) {
+        const candidate = node_path_1.default.join(directory, "node_modules");
+        if ((await exists(candidate)) && (await (0, promises_1.stat)(candidate)).isDirectory())
+            return (0, promises_1.realpath)(candidate);
+        const parent = node_path_1.default.dirname(directory);
+        if (parent === directory)
+            return undefined;
+        directory = parent;
+    }
+}
+/** Chooses a temporary evaluator directory outside dependencies and on the config's volume.
+ *
+ * Keeping the generated project on that volume permits valid relative links when the system temp directory is on another drive.
+ */
+async function tempBase(configFile, nodeModules) {
+    const system = await (0, promises_1.realpath)((0, node_os_1.tmpdir)());
+    if (node_path_1.default.parse(system).root.toLowerCase() ===
+        node_path_1.default.parse(configFile).root.toLowerCase())
+        return system;
+    const root = nodeModules === undefined ||
+        node_path_1.default.parse(nodeModules).root.toLowerCase() !==
+            node_path_1.default.parse(configFile).root.toLowerCase()
+        ? node_path_1.default.dirname(configFile)
+        : node_path_1.default.dirname(nodeModules);
+    const directory = node_path_1.default.join(root, ".tmp", "evidence-config");
+    await (0, promises_1.mkdir)(directory, { recursive: true });
+    return (0, promises_1.realpath)(directory);
+}
+/** Treats absent paths as false while preserving unexpected filesystem failures for diagnostics.
+ *
+ * Callers can probe optional package and dependency boundaries without hiding permission or device errors.
+ */
+async function exists(file) {
+    try {
+        await (0, promises_1.access)(file);
+        return true;
+    }
+    catch (cause) {
+        if ((() => {
+            const _io0 = input => "string" === typeof input.name && "string" === typeof input.message && (undefined === input.stack || "string" === typeof input.stack) && true && (undefined === input.errno || "number" === typeof input.errno) && (undefined === input.code || "string" === typeof input.code) && (undefined === input.path || "string" === typeof input.path) && (undefined === input.syscall || "string" === typeof input.syscall);
+            return input => "object" === typeof input && null !== input && _io0(input);
+        })()(cause) &&
+            (cause.code === "ENOENT" || cause.code === "ENOTDIR"))
+            return false;
+        throw cause;
+    }
+}