carrick 0.3.102 → 0.3.104

package/sidecar/dist/src/capture/repair-dangling.js

@@ -37,17 +37,28 @@ import * as fs from 'node:fs';
  * `failing` maps an absolute file path to the specifiers the stub could not
  * resolve from it. Returns the files actually rewritten; a file whose names
  * cannot all be replaced by `unknown` is left exactly as it was.
+ *
+ * Only a file `tree` (a guard over the stub's types tree) lets it write is
+ * repaired (carrick#1742). The self-check program also loads files the stub
+ * merely reaches: the repo's own sources, through a workspace package linked
+ * into the `node_modules` the stub borrows, or a runtime's dependency cache.
+ * Those report their missing modules exactly as an emitted declaration does,
+ * and they belong to the user: a scan reads them and never writes them. The
+ * guard decides on the resolved path, so a file reached through the link is
+ * the repo's, whatever path the program loaded it by.
  */
-export function repairDanglingImports(failing) {
+export function repairDanglingImports(failing, tree) {
     const repaired = new Map();
     for (const [file, specifiers] of failing) {
-        const result = repairFile(file, specifiers);
+        if (!tree.allowsWrite(file))
+            continue;
+        const result = repairFile(file, specifiers, tree);
         if (result)
             repaired.set(file, result);
     }
     return repaired;
 }
-function repairFile(file, specifiers) {
+function repairFile(file, specifiers, tree) {
     let text;
     try {
         text = fs.readFileSync(file, 'utf8');
@@ -116,7 +127,7 @@ function repairFile(file, specifiers) {
     for (const edit of edits) {
         out = out.slice(0, edit.start) + edit.text + out.slice(edit.end);
     }
-    fs.writeFileSync(file, out);
+    tree.writeFile(file, out);
     return { specifiers: [...removedSpecifiers].sort(), names: [...names].sort() };
 }
 /** The module specifier an import STATEMENT names, if it names one. */

package/sidecar/dist/src/capture/self-check.d.ts

@@ -32,7 +32,10 @@
 import ts from 'typescript';
 import type { CaptureAliasRecord } from './api.js';
 import type { ResolvedAnchor } from './anchors.js';
+import type { WriteGuard } from './guarded-fs.js';
 export interface SelfCheckArgs {
+    /** Writes are held to the stub (carrick#1748). */
+    guard: WriteGuard;
     stubDir: string;
     surfaceAbsPath: string;
     resolved: ResolvedAnchor[];

package/sidecar/dist/src/capture/self-check.js

@@ -53,7 +53,7 @@ export function selfCheckStub(args) {
     const linkPath = path.join(args.stubDir, 'node_modules');
     let linked = false;
     if (!args.bareCheckout && fs.existsSync(repoNodeModules) && !fs.existsSync(linkPath)) {
-        fs.symlinkSync(repoNodeModules, linkPath, 'dir');
+        args.guard.symlink(repoNodeModules, linkPath, 'dir');
         linked = true;
     }
     try {
@@ -65,7 +65,7 @@ export function selfCheckStub(args) {
         // the verdict: it reads the repaired text, and a name the rewrite did not
         // reach comes back as a `Cannot find name` diagnostic that
         // `repairedNameFailures` folds back into the same dangling specifier.
-        const repaired = repairDanglingImports(first.internalFailuresByFile);
+        const repaired = repairDanglingImports(first.internalFailuresByFile, args.guard.narrow(typesDir));
         if (repaired.size === 0)
             return first.records;
         return runSelfCheck(args, treeFiles, repaired).records;
@@ -74,7 +74,7 @@ export function selfCheckStub(args) {
         // unlinkSync, not rmSync: the link target is a directory and rmSync
         // refuses symlinks-to-directories with EISDIR.
         if (linked)
-            fs.unlinkSync(linkPath);
+            args.guard.unlink(linkPath);
     }
 }
 function runSelfCheck(args, treeFiles, repaired) {

package/sidecar/dist/src/capture/service-config.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Which tsconfig types a service that names none (carrick#1776).
+ *
+ * Both readers of a service, the init'd project and capture, ask this one
+ * function, so they type the service under the same options.
+ *
+ * The service root is searched first, for the names a service keeps its own
+ * config under. Above it, the search is `tsc`'s own when it is run with no
+ * `-p`: the nearest `tsconfig.json` in an ancestor directory. A layout that
+ * keeps one config above several services (their module resolution, `paths`,
+ * `lib`) is typed under that config, as the repo's own `tsc` types it; without
+ * it, every import only that config resolves read `any`.
+ *
+ * The walk stops at the scan root, inclusive: a config outside the scanned
+ * tree is never read. With no scan root, or a service outside it, only the
+ * service root is searched.
+ */
+/** Absolute path of the config that types the service, or undefined for none. */
+export declare function findServiceTsconfig(serviceRoot: string, scanRoot?: string): string | undefined;

package/sidecar/dist/src/capture/service-config.js

@@ -0,0 +1,57 @@
+/**
+ * Which tsconfig types a service that names none (carrick#1776).
+ *
+ * Both readers of a service, the init'd project and capture, ask this one
+ * function, so they type the service under the same options.
+ *
+ * The service root is searched first, for the names a service keeps its own
+ * config under. Above it, the search is `tsc`'s own when it is run with no
+ * `-p`: the nearest `tsconfig.json` in an ancestor directory. A layout that
+ * keeps one config above several services (their module resolution, `paths`,
+ * `lib`) is typed under that config, as the repo's own `tsc` types it; without
+ * it, every import only that config resolves read `any`.
+ *
+ * The walk stops at the scan root, inclusive: a config outside the scanned
+ * tree is never read. With no scan root, or a service outside it, only the
+ * service root is searched.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+/** The names a service root is searched for, in order. */
+const SERVICE_ROOT_NAMES = ['tsconfig.json', 'tsconfig.build.json', 'tsconfig.app.json'];
+/** The name an ancestor directory is searched for, as `tsc` searches. */
+const ANCESTOR_NAME = 'tsconfig.json';
+/** Absolute path of the config that types the service, or undefined for none. */
+export function findServiceTsconfig(serviceRoot, scanRoot) {
+    const root = path.resolve(serviceRoot);
+    for (const name of SERVICE_ROOT_NAMES) {
+        const candidate = path.join(root, name);
+        if (fs.existsSync(candidate))
+            return candidate;
+    }
+    if (scanRoot === undefined)
+        return undefined;
+    // Containment is decided on real paths, so a symlink on either end cannot
+    // hide the service inside the scan root or place it outside; the walk then
+    // climbs the path as given, one directory per level between them.
+    const fromBound = path.relative(realPath(scanRoot), realPath(root));
+    if (fromBound === '' || fromBound.startsWith('..') || path.isAbsolute(fromBound))
+        return undefined;
+    let dir = root;
+    for (let level = fromBound.split(path.sep).length; level > 0; level--) {
+        dir = path.dirname(dir);
+        const candidate = path.join(dir, ANCESTOR_NAME);
+        if (fs.existsSync(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+/** The path with every symlink resolved; the path as given when it does not exist. */
+function realPath(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch {
+        return path.resolve(p);
+    }
+}

package/sidecar/dist/src/index.d.ts

@@ -3,7 +3,7 @@
  *
  * This module implements a message loop that:
  * 1. Listens on stdin for JSON requests
- * 2. Processes each request (init, bundle, emit_surface, infer, build_workspace, check_compatibility, health, shutdown)
+ * 2. Processes each request (see handleRequest for the actions)
  * 3. Writes JSON responses to stdout
  *
  * IMPORTANT:

package/sidecar/dist/src/index.js

@@ -3,7 +3,7 @@
  *
  * This module implements a message loop that:
  * 1. Listens on stdin for JSON requests
- * 2. Processes each request (init, bundle, emit_surface, infer, build_workspace, check_compatibility, health, shutdown)
+ * 2. Processes each request (see handleRequest for the actions)
  * 3. Writes JSON responses to stdout
  *
  * IMPORTANT:
@@ -15,9 +15,8 @@ import * as path from 'node:path';
 import * as readline from 'node:readline';
 import { parseRequest } from './validators.js';
 import { ProjectLoader } from './project-loader.js';
-import { TypeBundler, SurfaceEmitter } from './bundler.js';
+import { TypeBundler } from './bundler.js';
 import { TypeInferrer } from './type-inferrer.js';
-import { MonorepoBuilder } from './monorepo-builder.js';
 import { DefinitionResolver } from './definition-resolver.js';
 import { captureStub, findDisqualifyingTopTypes, jsonWireDeclarations, runCheck, } from './capture/index.js';
 import { Retyper } from './retype.js';
@@ -26,7 +25,6 @@ import { LibraryClaimsVerifier, httpCheck } from './library-claims.js';
 // Module-level state
 // ===========================================================================
 let projectLoader = null;
-let monorepoBuilder = null;
 let initTimeMs = null;
 /**
  * Components by project key (`ProjectLoader.projectKeyFor`): `''` is the
@@ -62,7 +60,6 @@ function projectComponents(key = '') {
         });
         built = {
             typeBundler: new TypeBundler({ project, repoRoot }),
-            surfaceEmitter: new SurfaceEmitter({ project, repoRoot }),
             typeInferrer,
             definitionResolver: new DefinitionResolver({ project }),
             // Locates calls exactly as `infer` does, so it rewrites the node the
@@ -128,6 +125,7 @@ function handleInit(request) {
         projectLoader = new ProjectLoader({
             repoRoot: request.repo_root,
             tsconfigPath: request.tsconfig_path,
+            scanRoot: request.scan_root,
             tsconfigSnapshot: request.tsconfig_snapshot,
             pinnedDependencies: request.pinned_dependencies,
         });
@@ -143,8 +141,6 @@ function handleInit(request) {
         // The project and everything that reads it are built by the first request
         // that needs them, so readiness costs the same on a bare checkout as on
         // one with its dependencies installed (carrick#749).
-        // Initialize monorepo builder (doesn't need project)
-        monorepoBuilder = new MonorepoBuilder();
         initTimeMs = result.initTimeMs || Math.round(performance.now() - startTime);
         log(`Initialization complete in ${initTimeMs}ms`);
         return {
@@ -202,38 +198,6 @@ function handleBundle(request) {
         };
     }
 }
-/**
- * Handle the 'emit_surface' action - emit a surface .d.ts with rewritten specifiers
- */
-function handleEmitSurface(request) {
-    try {
-        log(`Emitting surface for repo '${request.repo_name}' with ${request.payloads.length} payload(s)`);
-        const result = projectComponents().surfaceEmitter.emit(request.repo_name, request.payloads, request.output_path);
-        if (!result.success) {
-            return {
-                request_id: request.request_id,
-                status: 'error',
-                errors: result.errors,
-            };
-        }
-        return {
-            request_id: request.request_id,
-            status: 'success',
-            output_path: result.output_path,
-            surface_content: result.surface_content,
-            manifest: result.manifest,
-        };
-    }
-    catch (err) {
-        const error = err instanceof Error ? err.message : String(err);
-        logError(`Surface emission failed: ${error}`);
-        return {
-            request_id: request.request_id,
-            status: 'error',
-            errors: [error],
-        };
-    }
-}
 /**
  * Handle the 'capture_v2' action - v2 "tsc as serializer" capture.
  * Stateless by design: unlike bundle/infer it needs no init'd ts-morph
@@ -250,6 +214,7 @@ function handleCaptureV2(request) {
             anchors: request.anchors,
             outDir: request.out_dir,
             tsconfigPath: request.tsconfig_path,
+            scanRoot: request.scan_root,
         });
         return {
             request_id: request.request_id,
@@ -461,76 +426,6 @@ function handleListLibrarySurface(request) {
         return { request_id: request.request_id, status: 'error', errors: [error] };
     }
 }
-/**
- * Handle the 'build_workspace' action - build synthetic monorepo workspace
- */
-function handleBuildWorkspace(request) {
-    // MonorepoBuilder doesn't require project initialization
-    if (!monorepoBuilder) {
-        monorepoBuilder = new MonorepoBuilder();
-    }
-    try {
-        log(`Building synthetic workspace with ${request.repos.length} repo(s)`);
-        const result = monorepoBuilder.build(request.repos, request.workspace_root);
-        if (!result.success) {
-            return {
-                request_id: request.request_id,
-                status: 'error',
-                errors: result.errors,
-            };
-        }
-        return {
-            request_id: request.request_id,
-            status: 'success',
-            workspace_path: result.workspace_path,
-            stub_packages: result.stub_packages,
-            checker_path: result.checker_path,
-        };
-    }
-    catch (err) {
-        const error = err instanceof Error ? err.message : String(err);
-        logError(`Workspace build failed: ${error}`);
-        return {
-            request_id: request.request_id,
-            status: 'error',
-            errors: [error],
-        };
-    }
-}
-/**
- * Handle the 'check_compatibility' action - run type compatibility checks
- */
-function handleCheckCompatibility(request) {
-    if (!monorepoBuilder) {
-        monorepoBuilder = new MonorepoBuilder();
-    }
-    try {
-        log(`Running compatibility checks: ${request.checks.length} check(s)`);
-        const result = monorepoBuilder.checkCompatibility(request.workspace_root, request.checks);
-        if (!result.success) {
-            return {
-                request_id: request.request_id,
-                status: 'error',
-                errors: result.errors,
-            };
-        }
-        return {
-            request_id: request.request_id,
-            status: 'success',
-            results: result.results,
-            diagnostics: result.diagnostics,
-        };
-    }
-    catch (err) {
-        const error = err instanceof Error ? err.message : String(err);
-        logError(`Compatibility check failed: ${error}`);
-        return {
-            request_id: request.request_id,
-            status: 'error',
-            errors: [error],
-        };
-    }
-}
 /**
  * Handle the 'resolve_definitions' action - resolve surface aliases from a
  * v2 capture stub package's declaration tree.
@@ -597,16 +492,10 @@ function handleRequest(request) {
             return handleInit(request);
         case 'bundle':
             return handleBundle(request);
-        case 'emit_surface':
-            return handleEmitSurface(request);
         case 'capture_v2':
             return handleCaptureV2(request);
         case 'infer':
             return handleInfer(request);
-        case 'build_workspace':
-            return handleBuildWorkspace(request);
-        case 'check_compatibility':
-            return handleCheckCompatibility(request);
         case 'resolve_definitions':
             return handleResolveDefinitions(request);
         case 'retype_check':

package/sidecar/dist/src/origin.d.ts

@@ -13,7 +13,7 @@
  * bundle, so the two are kept in lockstep by `machinery-indicator-mirror.test.ts`
  * rather than by sharing this module.
  */
-import type { ts } from 'ts-morph';
+import type { Project, ResolutionHostFactory, ts } from 'ts-morph';
 /**
  * True when a declaration's source file is runtime/library origin rather than
  * user source. Four answers, in order:
@@ -32,14 +32,55 @@ import type { ts } from 'ts-morph';
  *     types from its own cache, a path with no `node_modules` segment, and
  *     `DenoProject.resolve` hands the compiler `isExternalLibraryImport` from
  *     the graph, which the compiler records on the file. Nothing crosses the
- *     capture seam; both programs are built with that host. One exclusion: a
- *     workspace package reached through a `node_modules` symlink is also
- *     marked external by the compiler but is the user's own source, so a file
- *     inside the checkout (the nearest `.git` above the service root) that
- *     carries no `node_modules` segment stays user source.
+ *     capture seam; both programs are built with that host. The compiler's
+ *     record does not survive an edit to a ts-morph project, so `imports`, the
+ *     resolver's answers kept for the project's life, is read beside it
+ *     (`ExternalImports`, carrick#1731). One exclusion: a workspace package
+ *     reached through a `node_modules` symlink is also marked external by the
+ *     compiler but is the user's own source, so a file inside the checkout
+ *     (the nearest `.git` above the service root) that carries no
+ *     `node_modules` segment stays user source.
  *
  * Lockstep mirror of `isExternalOrigin` in `capture/machinery.ts` (the capture
  * seam forbids sharing a module); `machinery-indicator-mirror.test.ts` guards
- * the pair on a real program.
+ * the pair on a real program. The capture builds each program once and never
+ * edits it, so it has no `imports` to read.
  */
-export declare function isExternalOrigin(program: ts.Program, sourceFile: ts.SourceFile, repoRoot: string): boolean;
+export declare function isExternalOrigin(program: ts.Program, sourceFile: ts.SourceFile, repoRoot: string, imports?: ExternalImports): boolean;
+/**
+ * Every file a ts-morph project's resolver reached as an external-library
+ * import, recorded as the resolver answers (carrick#1731).
+ *
+ * The compiler keeps that verdict on each program (rule 4 of
+ * `isExternalOrigin`), but ts-morph rebuilds the program after any edit to the
+ * project, such as a probe file created and removed or a file rewritten and
+ * restored, and passes every file it has loaded as a ROOT file. The compiler
+ * marks no root file as external, so after the first edit no dependency is.
+ * Where a path test cannot answer (a Deno project serves npm types from its own
+ * cache), every library type then read as the user's: framework machinery was
+ * published as a contract and the printer inlined library types it keeps by
+ * name. The resolver's answer for a file does not change with the project's
+ * history, so it is kept here for as long as the project lives.
+ *
+ * The compiler's verdict also carries down: a file a library imports, even by
+ * a relative path the resolver answers as not external, is reached while the
+ * compiler is inside an external import and is marked external too. A Deno
+ * npm package's own relative imports are answered that way, so an answer for
+ * an import made from a recorded file is recorded as well.
+ */
+export declare class ExternalImports {
+    private readonly files;
+    /** `factory` as it was, with every answer it gives recorded. */
+    recording(factory: ResolutionHostFactory): ResolutionHostFactory;
+    /** Whether a resolution reached `fileName` as an external-library import. */
+    has(fileName: string): boolean;
+    /** Record the external answers to `containingFile`'s imports. */
+    private record;
+}
+/** Keep `imports` as the record of `project`, which resolves through it. */
+export declare function registerExternalImports(project: Project, imports: ExternalImports): void;
+/**
+ * The record of a project the loader built with a recording resolver, or
+ * `undefined` for any other project, which reads the compiler's flag alone.
+ */
+export declare function externalImportsOf(project: Project): ExternalImports | undefined;

package/sidecar/dist/src/origin.js

@@ -33,17 +33,21 @@ import * as path from 'node:path';
  *     types from its own cache, a path with no `node_modules` segment, and
  *     `DenoProject.resolve` hands the compiler `isExternalLibraryImport` from
  *     the graph, which the compiler records on the file. Nothing crosses the
- *     capture seam; both programs are built with that host. One exclusion: a
- *     workspace package reached through a `node_modules` symlink is also
- *     marked external by the compiler but is the user's own source, so a file
- *     inside the checkout (the nearest `.git` above the service root) that
- *     carries no `node_modules` segment stays user source.
+ *     capture seam; both programs are built with that host. The compiler's
+ *     record does not survive an edit to a ts-morph project, so `imports`, the
+ *     resolver's answers kept for the project's life, is read beside it
+ *     (`ExternalImports`, carrick#1731). One exclusion: a workspace package
+ *     reached through a `node_modules` symlink is also marked external by the
+ *     compiler but is the user's own source, so a file inside the checkout
+ *     (the nearest `.git` above the service root) that carries no
+ *     `node_modules` segment stays user source.
  *
  * Lockstep mirror of `isExternalOrigin` in `capture/machinery.ts` (the capture
  * seam forbids sharing a module); `machinery-indicator-mirror.test.ts` guards
- * the pair on a real program.
+ * the pair on a real program. The capture builds each program once and never
+ * edits it, so it has no `imports` to read.
  */
-export function isExternalOrigin(program, sourceFile, repoRoot) {
+export function isExternalOrigin(program, sourceFile, repoRoot, imports) {
     const file = sourceFile.fileName.replace(/\\/g, '/');
     if (file.includes('/.carrick/deno/')) {
         return true;
@@ -54,7 +58,76 @@ export function isExternalOrigin(program, sourceFile, repoRoot) {
     if (file.includes('/node_modules/')) {
         return true;
     }
-    return program.isSourceFileFromExternalLibrary(sourceFile) && !isInsideCheckout(file, repoRoot);
+    const external = program.isSourceFileFromExternalLibrary(sourceFile) || imports?.has(file) === true;
+    return external && !isInsideCheckout(file, repoRoot);
+}
+/**
+ * Every file a ts-morph project's resolver reached as an external-library
+ * import, recorded as the resolver answers (carrick#1731).
+ *
+ * The compiler keeps that verdict on each program (rule 4 of
+ * `isExternalOrigin`), but ts-morph rebuilds the program after any edit to the
+ * project, such as a probe file created and removed or a file rewritten and
+ * restored, and passes every file it has loaded as a ROOT file. The compiler
+ * marks no root file as external, so after the first edit no dependency is.
+ * Where a path test cannot answer (a Deno project serves npm types from its own
+ * cache), every library type then read as the user's: framework machinery was
+ * published as a contract and the printer inlined library types it keeps by
+ * name. The resolver's answer for a file does not change with the project's
+ * history, so it is kept here for as long as the project lives.
+ *
+ * The compiler's verdict also carries down: a file a library imports, even by
+ * a relative path the resolver answers as not external, is reached while the
+ * compiler is inside an external import and is marked external too. A Deno
+ * npm package's own relative imports are answered that way, so an answer for
+ * an import made from a recorded file is recorded as well.
+ */
+export class ExternalImports {
+    files = new Set();
+    /** `factory` as it was, with every answer it gives recorded. */
+    recording(factory) {
+        return (moduleResolutionHost, getCompilerOptions) => {
+            const host = factory(moduleResolutionHost, getCompilerOptions);
+            return {
+                ...host,
+                ...(host.resolveModuleNames && {
+                    resolveModuleNames: (...args) => this.record(args[1], host.resolveModuleNames(...args)),
+                }),
+                ...(host.resolveTypeReferenceDirectives && {
+                    resolveTypeReferenceDirectives: (...args) => this.record(args[1], host.resolveTypeReferenceDirectives(...args)),
+                }),
+            };
+        };
+    }
+    /** Whether a resolution reached `fileName` as an external-library import. */
+    has(fileName) {
+        return this.files.has(normalised(fileName));
+    }
+    /** Record the external answers to `containingFile`'s imports. */
+    record(containingFile, answers) {
+        const fromLibrary = this.has(containingFile);
+        for (const answer of answers) {
+            if (answer?.resolvedFileName && (fromLibrary || answer.isExternalLibraryImport)) {
+                this.files.add(normalised(answer.resolvedFileName));
+            }
+        }
+        return answers;
+    }
+}
+function normalised(fileName) {
+    return path.resolve(fileName).replace(/\\/g, '/');
+}
+const externalImportsByProject = new WeakMap();
+/** Keep `imports` as the record of `project`, which resolves through it. */
+export function registerExternalImports(project, imports) {
+    externalImportsByProject.set(project, imports);
+}
+/**
+ * The record of a project the loader built with a recording resolver, or
+ * `undefined` for any other project, which reads the compiler's flag alone.
+ */
+export function externalImportsOf(project) {
+    return externalImportsByProject.get(project);
 }
 const checkoutRoots = new Map();
 /** The checkout the service root sits in: the nearest ancestor holding a

package/sidecar/dist/src/project-loader.d.ts

@@ -19,6 +19,12 @@ export interface ProjectLoaderOptions {
     repoRoot: string;
     /** Optional path to tsconfig.json (relative to repo root or absolute) */
     tsconfigPath?: string;
+    /**
+     * The scanned repo's root, the upper bound of the search for a tsconfig
+     * above `repoRoot` when none is named (carrick#1776). Without it only
+     * `repoRoot` is searched.
+     */
+    scanRoot?: string;
     /** Optional tsconfig snapshot (closed/merged) - preferred over tsconfigPath */
     tsconfigSnapshot?: TsconfigSnapshot;
     /** Optional pinned dependencies for this repo */
@@ -69,6 +75,7 @@ export declare class ProjectLoader {
     private readonly ownerProjects;
     private readonly repoRoot;
     private readonly tsconfigPath;
+    private readonly scanRoot;
     private readonly tsconfigSnapshot;
     private readonly pinnedDependencies;
     private initialized;
@@ -140,9 +147,10 @@ export declare class ProjectLoader {
      */
     getPinnedDependencies(): PinnedDependencySnapshot | undefined;
     /**
-     * Find the tsconfig.json file to use
+     * The tsconfig to build from: the named one when it exists, else the one
+     * `findServiceTsconfig` finds for the service, which capture also reads.
      *
-     * @returns Absolute path to tsconfig.json, or undefined if not found
+     * @returns Absolute path to the tsconfig, or undefined if not found
      */
     private findTsConfig;
     /**