carveout 0.1.1 → 0.2.0

package/dist/src/policy.js

@@ -16,7 +16,8 @@ import { execFileSync } from "node:child_process";
 import { existsSync, statSync } from "node:fs";
 import { posix, resolve } from "node:path";
 import ts from "typescript";
-import { isTestPath, pathMatcher } from "./core.js";
+import { isTestPath, isTestSupportPath, pathMatcher } from "./core.js";
+import { ownSpecifier, scriptKindOf, weakenedTest } from "./test-integrity.js";
 import { isNodeBuiltin } from "./extract/typescript.js";
 import { PURE_NODE_MODULES, serviceOf } from "./slice/externals.js";
 /**
@@ -63,6 +64,26 @@ export const PROTECTED_PATHS = [
     "**/docker-compose*.yaml",
     "**/Makefile",
     "**/*.sh",
+    // Task runners and hooks that run a command the file names.
+    "**/project.json",
+    "**/nx.json",
+    "**/turbo.json",
+    "**/.lintstagedrc*",
+    "**/lint-staged.config.*",
+    "**/lefthook.y*ml",
+    "**/.pre-commit-config.yaml",
+    "**/bunfig.toml",
+    "**/deno.json",
+    "**/deno.jsonc",
+    "**/vercel.json",
+    "**/netlify.toml",
+    "**/Taskfile.y*ml",
+    "**/justfile",
+    "**/Justfile",
+    "**/Procfile",
+    "**/*.tf",
+    "**/cdk.json",
+    "**/serverless.y*ml",
 ];
 /**
  * Throws unless `path` is a plain relative path that stays where it is
@@ -151,18 +172,50 @@ export const CHECK_CONFIG_PATHS = [
     "**/biome.jsonc",
     "**/vitest.config.*",
     "**/vitest.workspace.*",
+    "**/vitest.setup.*",
     "**/vite.config.*",
     "**/jest.config.*",
+    "**/jest.setup.*",
+    "**/setupTests.*",
+    "**/test-setup.*",
+    "**/.mocharc*",
+    "**/ava.config.*",
+    "**/playwright.config.*",
+    "**/babel.config.*",
+    "**/.babelrc*",
+    "**/.swcrc",
     "**/.c8rc",
     "**/.c8rc.json",
     "**/.nycrc",
     "**/.nycrc.json",
 ];
+/**
+ * Of those, the files a runner or a build picks up by being there: added,
+ * they change what a check holds code to as an edit does (a
+ * `vitest.config.ts` that includes nothing, a setup file that skips every
+ * test, a transform that rewrites the code). A new package's tsconfig or
+ * linter configuration is not one.
+ */
+const PICKED_UP_CONFIG_PATHS = CHECK_CONFIG_PATHS.filter((pattern) => !/tsconfig|jsconfig/.test(pattern));
+/** A test's helper by its name, wherever it is kept: `test-helpers.ts`, `cart.fixture.ts`. */
+const HELPER_NAME = /(^|\/)[^/]*(test|spec)[-_.]?(helpers?|utils?|support|setup|fakes?|doubles?|builders?|factories)\.[cm]?[jt]sx?$|\.(fixtures?|mocks?|fakes?|stubs?)\.[cm]?[jt]sx?$/i;
+/**
+ * Data a test compares against: snapshots and screenshots, wherever they
+ * are kept. Edited or deleted, the test is.
+ */
+const FIXTURE_PATH = /(^|\/)(__snapshots__|__screenshots__|__fixtures__|__image_snapshots__|[^/]*-snapshots)\/|\.snap(shot)?$/;
+/** Code the policy cannot read: added or edited, it is held for a reader. */
+const UNREAD_CODE = /\.(py|rb|go|rs|java|kt|kts|scala|php|cs|swift|lua|pl|vue|svelte|astro|mdx|node|wasm|so|dylib|dll|exe|bat|cmd|ps1)$/i;
 /** Comments that switch a check off for the code after them. */
 const SUPPRESSION = /@ts-ignore|@ts-nocheck|@ts-expect-error|eslint-disable|biome-ignore|istanbul ignore|c8 ignore|v8 ignore/g;
-/** How many check suppressions a script's text holds. */
-export function suppressionsOf(text) {
-    return text.match(SUPPRESSION)?.length ?? 0;
+/**
+ * How many check suppressions a script's text holds. A test's
+ * `@ts-expect-error` asserts that a call does not type-check, which is a
+ * test of the types, not a suppression.
+ */
+export function suppressionsOf(text, path = "") {
+    const found = text.match(SUPPRESSION) ?? [];
+    return isTestPath(path) ? found.filter((match) => match !== "@ts-expect-error").length : found.length;
 }
 /**
  * Judges each path a patch would carry. `packages` are the repository's
@@ -173,6 +226,7 @@ export function handoffPolicy(options) {
     const allowed = pathMatcher(options.allow ?? []);
     const protectedPath = pathMatcher(PROTECTED_PATHS);
     const checkConfig = pathMatcher(options.checks === true ? CHECK_CONFIG_PATHS : []);
+    const pickedUp = pathMatcher(options.checks === true ? PICKED_UP_CONFIG_PATHS : []);
     const noun = options.testNoun ?? "a test the slice was handed";
     const { packages, packageOf } = options;
     return (path, change, texts) => {
@@ -180,27 +234,58 @@ export function handoffPolicy(options) {
             return null;
         if (protectedPath(path))
             return "a protected path (CI, hooks, manifests, lockfiles, environment): review it and pass --allow to carry it";
-        if (checkConfig(path) && change !== "added")
-            return "changes what a check holds code to (compiler, linter or test-runner configuration): review it and pass --allow to carry it";
+        if ((checkConfig(path) || options.testSetup?.(path) === true) && (change !== "added" || pickedUp(path)))
+            return `${change === "added" ? "adds" : change === "deleted" ? "deletes" : "changes"} what a check holds code to (compiler, linter, test-runner configuration or setup): review it and pass --allow to carry it`;
         if (change === "added" &&
             packages !== undefined &&
             packageOf !== undefined &&
             !packages.has(packageOf(path)))
             return "a new file outside the slice's packages";
+        const script = /\.[cm]?[jt]sx?$/.test(path) && !/\.d\.[cm]?ts$/.test(path);
+        // A fake, a builder or a fixture decides what a test sees as much as
+        // the test does: an edit to one is a test edit.
+        const support = !isTestPath(path) &&
+            (isTestSupportPath(path) || FIXTURE_PATH.test(path) || HELPER_NAME.test(path) || (options.testSupport?.(path) ?? false));
+        // A module mock a runner picks up by being there (`__mocks__/pkg.ts`
+        // replaces `pkg` in every Jest test).
+        if (change === "added" && /(^|\/)__mocks__\//.test(path))
+            return "adds a module mock (__mocks__) that the test runner picks up for every test: review it and pass --allow to carry it";
+        if (change !== "deleted" && UNREAD_CODE.test(path))
+            return "code in a language the policy does not read: review it and pass --allow to carry it";
+        // A file with no extension, which Node loads as code by its bare name
+        // (`./checkout`) and the policy cannot read as a script.
+        if (change === "added" && !/\.[^/.]+$/.test(path.split("/").pop() ?? path))
+            return "a file with no extension, which Node can load as code by its bare name: review it and pass --allow to carry it";
         if (change === "deleted" && isTestPath(path))
             return `deletes ${noun}`;
-        if (change === "changed" && isTestPath(path) && texts !== undefined && texts.before !== null) {
-            const weakened = weakenedTest(path, texts.before, texts.after, noun);
+        if (change === "deleted" && support)
+            return "deletes a test's helper or fixture: review it and pass --allow to carry it";
+        if (change === "changed" &&
+            (isTestPath(path) || (support && script)) &&
+            texts !== undefined &&
+            texts.before !== null) {
+            const weakened = weakenedTest(path, texts.before, texts.after, support ? "a test's helper" : noun);
             if (weakened !== null)
                 return `${weakened}: review it and pass --allow to carry it`;
         }
+        if (change === "changed" && support && !script && (texts === undefined || texts.before !== texts.after))
+            return "changes a test fixture (data a test reads): review it and pass --allow to carry it";
+        if (options.integrity === true && change !== "deleted" && texts !== undefined) {
+            const gained = gainedIntegrity(path, texts.before, texts.after);
+            if (gained.length > 0)
+                return `could pass a test without the code passing it (${gained.join(", ")}): review it and pass --allow to carry it`;
+        }
         if (options.checks === true && change !== "deleted" && texts !== undefined && /\.[cm]?[jt]sx?$/.test(path)) {
-            const more = suppressionsOf(texts.after) - suppressionsOf(texts.before ?? "");
+            const more = suppressionsOf(texts.after, path) - suppressionsOf(texts.before ?? "", path);
             if (more > 0)
                 return `adds ${more} check suppression${more === 1 ? "" : "s"} (@ts-ignore, eslint-disable, coverage ignores): review it and pass --allow to carry it`;
         }
         if (options.reach === true && change !== "deleted" && texts !== undefined) {
-            const gained = gainedReach(path, texts.before, texts.after);
+            const gained = gainedReach(path, texts.before, texts.after, {
+                ...(options.knownPackages === undefined ? {} : { knownPackages: options.knownPackages }),
+                ...(packages === undefined || packageOf === undefined ? {} : { packages, packageOf }),
+                ...(options.holds === undefined ? {} : { holds: options.holds }),
+            });
             if (gained.length > 0)
                 return `reaches what it did not before (${gained.join(", ")}): it runs beside the whole repository, the closed part included; read it and pass --allow to carry it`;
         }
@@ -232,40 +317,72 @@ const REACHING_GLOBALS = new Set([
     "EventSource",
     "eval",
     "Function",
+    "WebAssembly",
     "Worker",
     "Deno",
     "Bun",
 ]);
-/** What a `process` member reaches: its environment, or native code. */
+/** A module specifier that loads code from somewhere other than a package or a file. */
+const URL_SPECIFIER = /^(data|https?|file|blob):/i;
+/** A specifier a bundler or Node reads as raw bytes or native code: `x?raw`, `addon.node`. */
+const RAW_SPECIFIER = /\?|\.node$/;
+/** What a `process` member reaches: its environment, a report of it, or native code. */
 const REACHING_PROCESS = new Set([
     "env",
     "binding",
     "dlopen",
     "mainModule",
     "getBuiltinModule",
+    "report",
+    "loadEnvFile",
 ]);
 /** Names the global object goes by. */
 const GLOBAL_OBJECTS = new Set(["globalThis", "global", "window", "self"]);
 /**
- * What a script reaches beyond its own computation, read from its syntax
- * and never run: Node modules with the disk, the network or the process
- * (`node:fs`), service SDKs, network and code-running globals (`fetch`,
- * `eval`), the environment (`process.env`, `import.meta.env`), and modules
- * or globals named by a computed value, which could be any of these. Each
- * as a short label, sorted. Text-level: a hold for a reader, not a sandbox.
+ * Packages a slice installs that carry the disk or the environment inside:
+ * typescript's `sys` (always installed), vite's `loadEnv`.
  */
-export function reachOf(path, text) {
-    const kind = /\.[cm]?tsx$|\.jsx$/.test(path) ? ts.ScriptKind.TSX : ts.ScriptKind.TS;
-    const source = ts.createSourceFile(path, text, ts.ScriptTarget.Latest, true, kind);
-    const found = new Set();
+const PACKAGE_REACH = [
+    { module: "typescript", member: "sys", label: "typescript's sys (the disk and the environment)" },
+    { module: "vite", member: "loadEnv", label: "vite's loadEnv (the environment)" },
+];
+/** The members of CommonJS's `module` that load code. */
+const MODULE_LOADER = new Set(["require", "constructor", "_load", "_resolveFilename", "_compile", "createRequire"]);
+/** A label for each time a script reaches past its computation; the multiset `reachOf` reads. */
+function reachCounts(path, text, context = {}) {
+    const source = ts.createSourceFile(path, text, ts.ScriptTarget.Latest, true, scriptKindOf(path));
+    const found = new Map();
+    const add = (label) => found.set(label, (found.get(label) ?? 0) + 1);
     const specifier = (name) => {
-        if (isNodeBuiltin(name)) {
+        if (URL_SPECIFIER.test(name))
+            add("a module loaded from a URL");
+        else if (RAW_SPECIFIER.test(name))
+            add("a file loaded raw or as native code");
+        else if (isNodeBuiltin(name)) {
             const root = (name.startsWith("node:") ? name.slice(5) : name).split("/")[0] ?? name;
             if (!QUIET_NODE_MODULES.has(root))
-                found.add(`node:${root}`);
+                add(`node:${root}`);
+        }
+        else if (name.startsWith(".")) {
+            // An installed package's files by path: no patch shows what is there,
+            // and the folder's own copy is the contributor's to plant.
+            if (/(^|\/)node_modules(\/|$)/.test(name))
+                add("a package's files by path (node_modules)");
+            // A relative import that leaves the slice's packages reads closed code.
+            const { packages, packageOf, holds } = context;
+            if (packages !== undefined && packageOf !== undefined) {
+                const target = posix.normalize(posix.join(posix.dirname(path), name));
+                if (!target.startsWith("..") && !packages.has(packageOf(target)) && !(holds?.(target) ?? false))
+                    add("a module outside the slice's packages");
+            }
         }
         else if (serviceOf(name) !== null)
-            found.add(name);
+            add(name);
+        else if (!ownSpecifier(name) && context.knownPackages !== undefined) {
+            const pkg = name.startsWith("@") ? name.split("/").slice(0, 2).join("/") : (name.split("/")[0] ?? name);
+            if (!context.knownPackages.has(pkg))
+                add(`a package the slice does not have (${pkg})`);
+        }
     };
     const computed = "a module named by a computed value";
     const literal = (node) => node !== undefined && ts.isStringLiteralLike(node) ? node.text : null;
@@ -283,6 +400,8 @@ export function reachOf(path, text) {
         // `{ fetch }` reads it; `{ fetch: 1 }`, `const fetch`, `f(fetch)` name or read.
         if (ts.isShorthandPropertyAssignment(parent))
             return false;
+        if (ts.isImportSpecifier(parent) || ts.isImportClause(parent) || ts.isNamespaceImport(parent))
+            return true;
         return parent.name === node;
     };
     /** `process`, or `globalThis.process`. */
@@ -291,267 +410,634 @@ export function reachOf(path, text) {
             node.name.text === "process" &&
             ts.isIdentifier(node.expression) &&
             GLOBAL_OBJECTS.has(node.expression.text));
+    // The names the file declares anywhere: a bare name it does not declare is a global.
+    const declared = new Set();
+    const declare = (node) => {
+        if ((ts.isVariableDeclaration(node) || ts.isParameter(node) || ts.isBindingElement(node) || ts.isFunctionDeclaration(node) || ts.isClassDeclaration(node) || ts.isImportSpecifier(node) || ts.isImportClause(node) || ts.isNamespaceImport(node)) &&
+            node.name !== undefined &&
+            ts.isIdentifier(node.name))
+            declared.add(node.name.text);
+        ts.forEachChild(node, declare);
+    };
+    declare(source);
+    // The names this file binds to a package that carries reach inside.
+    const packageReach = new Map();
+    for (const statement of source.statements) {
+        if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier))
+            continue;
+        for (const rule of PACKAGE_REACH) {
+            if (statement.moduleSpecifier.text !== rule.module)
+                continue;
+            const clause = statement.importClause;
+            if (clause?.name !== undefined)
+                packageReach.set(clause.name.text, { ...rule, whole: true });
+            const bindings = clause?.namedBindings;
+            if (bindings !== undefined && ts.isNamespaceImport(bindings))
+                packageReach.set(bindings.name.text, { ...rule, whole: true });
+            else if (bindings !== undefined)
+                for (const element of bindings.elements)
+                    if ((element.propertyName ?? element.name).text === rule.member)
+                        add(rule.label);
+        }
+    }
     const visit = (node) => {
+        if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.expression)) {
+            const bound = packageReach.get(node.expression.text);
+            if (bound !== undefined && node.name.text === bound.member)
+                add(bound.label);
+        }
+        if (ts.isImportDeclaration(node) &&
+            ts.isStringLiteral(node.moduleSpecifier) &&
+            /^(node:)?test$/.test(node.moduleSpecifier.text) &&
+            node.importClause?.namedBindings !== undefined &&
+            ts.isNamedImports(node.importClause.namedBindings) &&
+            node.importClause.namedBindings.elements.some((element) => (element.propertyName ?? element.name).text === "run"))
+            add("a test run of its own (node:test run)");
         if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier !== undefined) {
             const name = literal(node.moduleSpecifier);
-            if (name !== null && !(ts.isImportDeclaration(node) && node.importClause?.isTypeOnly === true))
+            const typeOnly = (ts.isImportDeclaration(node) && node.importClause?.isTypeOnly === true) ||
+                (ts.isExportDeclaration(node) && node.isTypeOnly);
+            if (name !== null && !typeOnly)
                 specifier(name);
         }
         else if (ts.isImportEqualsDeclaration(node) && ts.isExternalModuleReference(node.moduleReference)) {
             const name = literal(node.moduleReference.expression);
             if (name === null)
-                found.add(computed);
+                add(computed);
             else
                 specifier(name);
         }
-        else if (ts.isCallExpression(node)) {
-            const callee = node.expression;
-            if (callee.kind === ts.SyntaxKind.ImportKeyword || (ts.isIdentifier(callee) && callee.text === "require")) {
-                const name = literal(node.arguments[0]);
-                if (name === null)
-                    found.add(computed);
-                else
-                    specifier(name);
-            }
-        }
-        else if (ts.isPropertyAccessExpression(node)) {
-            if (isProcess(node.expression) && REACHING_PROCESS.has(node.name.text))
-                found.add(`process.${node.name.text}`);
-            if (node.name.text === "env" &&
-                ts.isMetaProperty(node.expression) &&
-                node.expression.keywordToken === ts.SyntaxKind.ImportKeyword)
-                found.add("import.meta.env");
+        else if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || (ts.isIdentifier(node.expression) && node.expression.text === "require"))) {
+            const name = literal(node.arguments[0]);
+            if (name === null)
+                add(computed);
+            else
+                specifier(name);
         }
-        else if (ts.isElementAccessExpression(node)) {
+        else if (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) {
             const target = node.expression;
-            const key = literal(node.argumentExpression);
+            const key = ts.isPropertyAccessExpression(node) ? node.name.text : literal(node.argumentExpression);
             if (isProcess(target)) {
                 if (key === null)
-                    found.add("a process member named by a computed value");
+                    add("a process member named by a computed value");
                 else if (REACHING_PROCESS.has(key))
-                    found.add(`process.${key}`);
+                    add(`process.${key}`);
             }
             else if (ts.isIdentifier(target) && GLOBAL_OBJECTS.has(target.text)) {
                 if (key === null)
-                    found.add("a global named by a computed value");
+                    add("a global named by a computed value");
                 else if (REACHING_GLOBALS.has(key))
-                    found.add(key);
+                    add(key);
                 else if (key === "process")
-                    found.add("process");
+                    add("process");
+            }
+            else if (ts.isIdentifier(target) && target.text === "module" && key !== null && MODULE_LOADER.has(key)) {
+                add("the module loader (module.require)");
+            }
+            // `x.constructor`, and `x.constructor.constructor`, are `Function` by
+            // another name: only its `.name`, a comparison and `this.constructor`
+            // in a class are not.
+            if (key === "constructor" && target.kind !== ts.SyntaxKind.ThisKeyword) {
+                const parent = node.parent;
+                const harmless = (ts.isPropertyAccessExpression(parent) && parent.expression === node && parent.name.text === "name") ||
+                    (ts.isBinaryExpression(parent) &&
+                        [
+                            ts.SyntaxKind.EqualsEqualsEqualsToken,
+                            ts.SyntaxKind.ExclamationEqualsEqualsToken,
+                            ts.SyntaxKind.EqualsEqualsToken,
+                            ts.SyntaxKind.ExclamationEqualsToken,
+                            ts.SyntaxKind.InstanceOfKeyword,
+                        ].includes(parent.operatorToken.kind));
+                if (!harmless)
+                    add("a constructor reached through .constructor");
+            }
+        }
+        else if (ts.isMetaProperty(node) && node.keywordToken === ts.SyntaxKind.ImportKeyword && node.name.text === "meta") {
+            // `import.meta.env`, also through a cast (`(import.meta as any).env`),
+            // a computed key, a destructuring or an alias (`const m = import.meta`):
+            // only a named member other than `env` (`url`, `dirname`, `glob`) is
+            // no reach.
+            let outer = node;
+            while (ts.isParenthesizedExpression(outer.parent) ||
+                ts.isAsExpression(outer.parent) ||
+                ts.isNonNullExpression(outer.parent) ||
+                ts.isSatisfiesExpression(outer.parent) ||
+                ts.isTypeAssertionExpression(outer.parent))
+                outer = outer.parent;
+            const parent = outer.parent;
+            if ((ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) && parent.expression === outer) {
+                const key = ts.isPropertyAccessExpression(parent) ? parent.name.text : literal(parent.argumentExpression);
+                if (key === "env")
+                    add("import.meta.env");
+                else if (key === null)
+                    add("import.meta named by a computed value");
             }
+            else if (ts.isVariableDeclaration(parent) && parent.initializer === outer && ts.isObjectBindingPattern(parent.name)) {
+                for (const element of parent.name.elements) {
+                    const key = element.dotDotDotToken !== undefined
+                        ? null
+                        : element.propertyName === undefined
+                            ? ts.isIdentifier(element.name)
+                                ? element.name.text
+                                : null
+                            : ts.isIdentifier(element.propertyName) || ts.isStringLiteralLike(element.propertyName)
+                                ? element.propertyName.text
+                                : null;
+                    if (key === "env")
+                        add("import.meta.env");
+                    else if (key === null)
+                        add("import.meta named by a computed value");
+                }
+            }
+            else if (!ts.isTypeOfExpression(parent))
+                add("import.meta taken as a value");
         }
         else if (ts.isIdentifier(node) && REACHING_GLOBALS.has(node.text) && !named(node)) {
-            found.add(node.text);
+            add(node.text);
+        }
+        else if (ts.isIdentifier(node) && node.text === "require" && !named(node)) {
+            // `require("x")` names its module and `require.resolve` loads nothing;
+            // `const r = require` loads whatever `r` is later given.
+            const parent = node.parent;
+            const called = ts.isCallExpression(parent) && parent.expression === node;
+            const resolves = ts.isPropertyAccessExpression(parent) && parent.name.text === "resolve";
+            if (!called && !resolves)
+                add("require taken as a value");
+        }
+        else if (ts.isIdentifier(node) &&
+            (node.text === "globalThis" || node.text === "global" || node.text === "process" || ((node.text === "window" || node.text === "self") && !declared.has(node.text))) &&
+            !named(node)) {
+            // `process.env` and `globalThis["fetch"]` are judged by name above;
+            // `const p = process`, `const { env } = process` or `Reflect.get(process, …)`
+            // hide every later access behind another name.
+            const parent = node.parent;
+            const accessed = ((ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) && parent.expression === node) ||
+                ts.isTypeOfExpression(parent) ||
+                // `vi.spyOn(process, "exit")` replaces a member for a test.
+                (ts.isCallExpression(parent) &&
+                    parent.arguments[0] === node &&
+                    /^(vi\.spyOn|jest\.spyOn|mock\.method|t\.mock\.method|sinon\.stub)$/.test(parent.expression.getText(source)));
+            if (!accessed)
+                add(node.text === "process" ? "process taken as a value" : "the global object taken as a value");
         }
         ts.forEachChild(node, visit);
     };
     visit(source);
-    return [...found].sort();
-}
-/**
- * The reach a script's new text has that its old text did not (`reachOf`),
- * or nothing when it is no script. A file that already read the disk may
- * keep doing so: only what the change adds is a question.
- */
-export function gainedReach(path, before, after) {
-    if (!/\.[cm]?[jt]sx?$/.test(path) || /\.d\.[cm]?ts$/.test(path))
-        return [];
-    const had = new Set(before === null ? [] : reachOf(path, before));
-    return reachOf(path, after).filter((label) => !had.has(label));
+    return found;
 }
 /**
- * Whether an expression is a constant the code can read without running
- * it: `true`, `false`, `0`, `1`, `""`, `null`, `undefined`, `!x` of one, or
- * one in parentheses. Null for anything else.
+ * What a script reaches beyond its own computation, read from its syntax
+ * and never run: Node modules with the disk, the network or the process
+ * (`node:fs`), service SDKs, a package the slice does not have, a module
+ * outside the slice's packages, network and code-running globals (`fetch`,
+ * `eval`, `Function` by any route), the environment (`process.env`,
+ * `import.meta.env`, `process.report`), the module loader, a file loaded
+ * raw or as native code, and modules or globals named by a computed value
+ * or hidden behind one (`const p = process`), which could be any of these.
+ * Each as a short label, sorted. Text-level: a hold for a reader, not a
+ * sandbox.
  */
-function constantOf(node) {
-    if (ts.isParenthesizedExpression(node))
-        return constantOf(node.expression);
-    if (ts.isPrefixUnaryExpression(node) && node.operator === ts.SyntaxKind.ExclamationToken) {
-        const inner = constantOf(node.operand);
-        return inner === null ? null : !inner;
-    }
-    if (node.kind === ts.SyntaxKind.TrueKeyword)
-        return true;
-    if (node.kind === ts.SyntaxKind.FalseKeyword || node.kind === ts.SyntaxKind.NullKeyword)
-        return false;
-    if (ts.isIdentifier(node) && node.text === "undefined")
-        return false;
-    if (ts.isNumericLiteral(node))
-        return Number(node.text) !== 0;
-    if (ts.isStringLiteralLike(node))
-        return node.text !== "";
-    return null;
+export function reachOf(path, text, context = {}) {
+    return [...reachCounts(path, text, context).keys()].sort();
 }
-/** Modules whose calls are assertions, by import specifier. */
-const ASSERTION_MODULES = /^(node:)?assert(\/strict)?$|^(vitest|chai|expect|@jest\/globals)$/;
-/**
- * The assertions of a test file, each as its whitespace-free text, and the
- * tests it skips. An assertion is a call rooted at `assert` or `expect`,
- * or at a name imported from an assertion module (`strictEqual` from
- * `node:assert`); a skip is `test.skip`, `it.todo`, `describe.skip`,
- * `xit`, `xdescribe`, or a `{ skip }` or `{ todo }` option; a focus is
- * `test.only`, `describe.only`, `fit` or `fdescribe`, which skips the rest.
- */
-function assertionsOf(path, text) {
-    const source = ts.createSourceFile(path, text, ts.ScriptTarget.Latest, true);
-    const roots = new Set(["assert", "expect"]);
-    for (const statement of source.statements) {
-        if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier))
-            continue;
-        if (!ASSERTION_MODULES.test(statement.moduleSpecifier.text))
-            continue;
-        const clause = statement.importClause;
-        if (clause?.name !== undefined)
-            roots.add(clause.name.text);
-        const bindings = clause?.namedBindings;
-        if (bindings !== undefined && ts.isNamespaceImport(bindings))
-            roots.add(bindings.name.text);
-        else if (bindings !== undefined)
-            for (const element of bindings.elements)
-                roots.add(element.name.text);
-    }
+/** Test runners' globals: read from code that is not a test, they tell a test run from a real one. */
+const TEST_RUNNER_GLOBALS = new Set([
+    "describe",
+    "it",
+    "test",
+    "expect",
+    "vi",
+    "jest",
+    "suite",
+    "beforeEach",
+    "afterEach",
+    "beforeAll",
+    "afterAll",
+    "__vitest_worker__",
+    "__vitest_environment__",
+]);
+/** Environment variables a test runner sets in the processes it starts. */
+const TEST_RUNNER_ENV = new Set([
+    "VITEST",
+    "VITEST_WORKER_ID",
+    "VITEST_POOL_ID",
+    "VITEST_MODE",
+    "JEST_WORKER_ID",
+    "NODE_TEST_CONTEXT",
+    "MOCHA_WORKER_ID",
+    "npm_lifecycle_event",
+]);
+/** What, matched against `process.argv`, names a test run. */
+const RUNNER_ARGUMENT = /\b(vitest|jest|mocha|ava)\b|--test(?![\w-])|\.(test|spec)\.|(?:^|[\\/._-])(?:tests?|spec)\.[cm]?[jt]sx?$|test[-_]runner|node:test/i;
+/** What, searched for anywhere in `process.argv` (not one argument's place), names a test run too. */
+const RUNNER_WORD = /(?<![\w-])(tests?|spec)(?![\w-])/i;
+/** Methods that search `process.argv` as a whole, rather than read one argument. */
+const SEARCHES = new Set(["includes", "some", "find", "findIndex", "join", "filter", "indexOf", "toString", "every"]);
+/** `process` members that end the run, or set the code it ends with. */
+const ENDING_PROCESS = new Set(["exit", "exitCode", "abort", "reallyExit", "kill"]);
+/** Process events a listener can use to swallow a test's failure, or rewrite its exit. */
+const FAILURE_EVENTS = new Set([
+    "uncaughtException",
+    "uncaughtExceptionMonitor",
+    "unhandledRejection",
+    "exit",
+    "beforeExit",
+]);
+/** Built-ins whose members code under test calls: rewritten, they change every test's answer. */
+const BUILTIN_OBJECTS = new Set([
+    "Object",
+    "Array",
+    "String",
+    "Number",
+    "Boolean",
+    "BigInt",
+    "Symbol",
+    "Promise",
+    "JSON",
+    "Math",
+    "Date",
+    "Function",
+    "RegExp",
+    "Error",
+    "Map",
+    "Set",
+    "WeakMap",
+    "WeakSet",
+    "Reflect",
+    "Intl",
+]);
+/** Built-in members a test may fake for itself: the clock and the dice. */
+const TEST_FAKES = new Set(["Date.now", "Math.random"]);
+/** Built-in members any code may set: how much of a stack an error keeps. */
+const BUILTIN_SETTINGS = new Set(["Error.stackTraceLimit"]);
+/** Modules a test takes its runner or its assertions from. */
+const RUNNER_MODULES = /^(node:)?(assert(\/strict)?|test)$|^(vitest|chai|expect|@jest\/globals|mocha|bun:test)$/;
+/** Matchers a runner has, which `expect.extend` must not replace. */
+const BUILTIN_MATCHERS = /^(to[A-Z]\w*|resolves|rejects|not)$/;
+/** Functions that run their callback right after the module loads. */
+const SOON = /^(queueMicrotask|setTimeout|setImmediate|setInterval|process\.nextTick)$/;
+/** A label for each way a script could pass a test without the code; the multiset `integrityOf` reads. */
+function integrityCounts(path, text) {
+    const source = ts.createSourceFile(path, text, ts.ScriptTarget.Latest, true, scriptKindOf(path));
+    const testCode = isTestPath(path) || isTestSupportPath(path);
+    const found = new Map();
+    const add = (label) => found.set(label, (found.get(label) ?? 0) + 1);
+    const literal = (node) => node !== undefined && ts.isStringLiteralLike(node) ? node.text : null;
+    /** The identifier a member chain starts at, through casts: `assert` for `(assert as any).equal`. */
     const rootOf = (node) => {
         let current = node;
         for (;;) {
             if (ts.isIdentifier(current))
-                return current.text;
+                return current;
             if (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current))
                 current = current.expression;
-            else if (ts.isCallExpression(current))
-                current = current.expression;
-            else if (ts.isNonNullExpression(current) || ts.isParenthesizedExpression(current))
+            else if (ts.isParenthesizedExpression(current) ||
+                ts.isNonNullExpression(current) ||
+                ts.isAsExpression(current) ||
+                ts.isSatisfiesExpression(current) ||
+                ts.isTypeAssertionExpression(current))
                 current = current.expression;
             else
                 return null;
         }
     };
-    const assertions = [];
-    let skips = 0;
-    let focused = 0;
+    // The names this file binds to its runner and assertion modules, the
+    // runner's globals, `process`, the built-ins, and what aliases them.
+    const runnerBindings = new Set(["assert", "expect", "vi", "jest", "chai"]);
+    const processNames = new Set(["process"]);
+    const builtins = new Set(BUILTIN_OBJECTS);
+    const bindName = (into, name) => {
+        if (ts.isIdentifier(name))
+            into.add(name.text);
+    };
+    const scan = (node) => {
+        if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier) && RUNNER_MODULES.test(node.moduleSpecifier.text)) {
+            const clause = node.importClause;
+            if (clause?.name !== undefined)
+                runnerBindings.add(clause.name.text);
+            const bindings = clause?.namedBindings;
+            if (bindings !== undefined && ts.isNamespaceImport(bindings))
+                runnerBindings.add(bindings.name.text);
+            else if (bindings !== undefined)
+                for (const element of bindings.elements)
+                    runnerBindings.add(element.name.text);
+        }
+        if (ts.isVariableDeclaration(node) && node.initializer !== undefined) {
+            const init = node.initializer;
+            // `const assert = require("node:assert")`
+            if (ts.isCallExpression(init) && ts.isIdentifier(init.expression) && init.expression.text === "require" && RUNNER_MODULES.test(literal(init.arguments[0]) ?? ""))
+                bindName(runnerBindings, node.name);
+            // `const a = assert`, `const O = Object`, `const p = process`
+            const root = rootOf(init);
+            if (root !== null && root === init) {
+                if (runnerBindings.has(root.text))
+                    bindName(runnerBindings, node.name);
+                if (builtins.has(root.text))
+                    bindName(builtins, node.name);
+                if (processNames.has(root.text))
+                    bindName(processNames, node.name);
+            }
+        }
+        ts.forEachChild(node, scan);
+    };
+    scan(source);
+    const declaredNames = new Set();
+    const declare = (node) => {
+        if ((ts.isVariableDeclaration(node) || ts.isParameter(node) || ts.isBindingElement(node) || ts.isFunctionDeclaration(node) || ts.isClassDeclaration(node) || ts.isImportSpecifier(node) || ts.isImportClause(node) || ts.isNamespaceImport(node)) &&
+            node.name !== undefined &&
+            ts.isIdentifier(node.name))
+            declaredNames.add(node.name.text);
+        ts.forEachChild(node, declare);
+    };
+    declare(source);
+    const isProcess = (node) => {
+        const root = rootOf(node);
+        return ((root !== null && root === node && processNames.has(root.text)) ||
+            (ts.isPropertyAccessExpression(node) &&
+                node.name.text === "process" &&
+                ts.isIdentifier(node.expression) &&
+                GLOBAL_OBJECTS.has(node.expression.text)));
+    };
+    /** `x.name` or `x["name"]`: the member's name when it is written out. */
+    const memberName = (node) => ts.isPropertyAccessExpression(node)
+        ? node.name.text
+        : ts.isElementAccessExpression(node)
+            ? literal(node.argumentExpression)
+            : null;
+    /** Whether a member chain, or a name, is the runner's or the assertion library's. */
+    const onRunner = (node) => {
+        const root = rootOf(node);
+        return root !== null && runnerBindings.has(root.text);
+    };
+    /** `Array.prototype.x`, `Math.x`, or `Object` itself: the built-in and the members named, casts left out. */
+    const builtinTarget = (node) => {
+        const root = rootOf(node);
+        if (root === null || !builtins.has(root.text))
+            return null;
+        const members = [];
+        let current = node;
+        while (current !== root) {
+            if (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
+                members.unshift(memberName(current) ?? "[…]");
+                current = current.expression;
+            }
+            else if (ts.isParenthesizedExpression(current) ||
+                ts.isNonNullExpression(current) ||
+                ts.isAsExpression(current) ||
+                ts.isSatisfiesExpression(current) ||
+                ts.isTypeAssertionExpression(current))
+                current = current.expression;
+            else
+                break;
+        }
+        return [BUILTIN_OBJECTS.has(root.text) ? root.text : "a built-in", ...members].join(".");
+    };
+    /** Whether a node sits in a listener for a signal (`process.on("SIGTERM", …)`), which runs only when one comes. */
+    const onSignal = (node) => {
+        for (let current = node.parent; current !== undefined; current = current.parent)
+            if (ts.isFunctionLike(current) &&
+                current.parent !== undefined &&
+                ts.isCallExpression(current.parent) &&
+                /^SIG[A-Z]+$/.test(literal(current.parent.arguments[0]) ?? ""))
+                return true;
+        return false;
+    };
+    /**
+     * Whether a node runs when the module loads: at its top level, in an
+     * immediately called function, or in a callback a timer or a microtask
+     * runs right after; not inside a function something else must call.
+     */
+    const runsOnLoad = (node) => {
+        for (let current = node.parent; current !== undefined; current = current.parent) {
+            if (!ts.isFunctionLike(current))
+                continue;
+            let call = current.parent;
+            while (call !== undefined && ts.isParenthesizedExpression(call))
+                call = call.parent;
+            const immediately = call !== undefined &&
+                ts.isCallExpression(call) &&
+                (call.expression === current ||
+                    (ts.isParenthesizedExpression(call.expression) && call.expression.expression === current) ||
+                    (call.arguments.some((argument) => argument === current) && SOON.test(call.expression.getText(source))));
+            if (!immediately)
+                return false;
+        }
+        return true;
+    };
+    const isTestEnv = (node) => {
+        if (!(ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)))
+            return null;
+        const name = memberName(node);
+        const target = node.expression;
+        if (name === null || !((ts.isPropertyAccessExpression(target) || ts.isElementAccessExpression(target)) && memberName(target) === "env" && isProcess(target.expression)))
+            return null;
+        return TEST_RUNNER_ENV.has(name) ? `process.env.${name}` : name === "NODE_ENV" ? "NODE_ENV" : null;
+    };
     const visit = (node) => {
-        if (ts.isCallExpression(node)) {
-            const callee = node.expression;
-            const name = ts.isPropertyAccessExpression(callee) ? callee.name.text : null;
-            const base = rootOf(callee);
-            if ((name === "skip" || name === "todo") &&
-                base !== null &&
-                ["test", "it", "describe", "suite"].includes(base))
-                skips += 1;
-            if (name === "only" && base !== null && ["test", "it", "describe", "suite"].includes(base))
-                focused += 1;
-            if (ts.isIdentifier(callee) && (callee.text === "fit" || callee.text === "fdescribe"))
-                focused += 1;
-            if (ts.isIdentifier(callee) && (callee.text === "xit" || callee.text === "xdescribe" || callee.text === "xtest"))
-                skips += 1;
-            if (base !== null && ["test", "it", "describe", "suite"].includes(base))
-                for (const argument of node.arguments)
-                    if (ts.isObjectLiteralExpression(argument))
-                        for (const property of argument.properties)
-                            if (ts.isPropertyAssignment(property) &&
-                                ts.isIdentifier(property.name) &&
-                                (property.name.text === "skip" || property.name.text === "todo") &&
-                                property.initializer.kind !== ts.SyntaxKind.FalseKeyword)
-                                skips += 1;
-            if (base !== null && roots.has(base)) {
-                // The outermost call of a chain is the assertion: `expect(x).toBe(y)`.
-                // Formatting is not a change: whitespace and trailing commas go.
-                assertions.push(node.getText(source).replace(/\s+/g, "").replace(/,(?=[)\]}])/g, ""));
-                return;
+        // Ending the run: `process.exit(0)`, `process.exitCode = 0`, `process.kill(process.pid)`.
+        if ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) && isProcess(node.expression)) {
+            const name = memberName(node);
+            const parent = node.parent;
+            const called = ts.isCallExpression(parent) && parent.expression === node ? parent : null;
+            const assigned = ts.isBinaryExpression(parent) && parent.left === node && parent.operatorToken.kind === ts.SyntaxKind.EqualsToken ? parent : null;
+            // A literal non-zero code fails the run: it fakes no pass.
+            const code = called?.arguments[0] ?? assigned?.right;
+            const failing = code !== undefined && ts.isNumericLiteral(code) && Number(code.text) !== 0;
+            const killsItself = name !== "kill" ||
+                (called !== null && /^(globalThis\.)?process\.p?pid$/.test(called.arguments[0]?.getText(source).replace(/\s+/g, "") ?? ""));
+            // Anywhere, not only when the module loads: a function of the code
+            // under test that exits 0 when a test calls it ends the test file
+            // there, and node:test reports the file as passing, the failing
+            // assertion after it and the tests below never run.
+            if (name !== null && ENDING_PROCESS.has(name) && killsItself && !failing && !onSignal(node))
+                add(`process.${name}`);
+            if (!testCode && (name === "argv" || name === "execArgv")) {
+                // Read from the code under test and matched against a runner's name.
+                let statement = node;
+                while (statement.parent !== undefined && !ts.isStatement(statement))
+                    statement = statement.parent;
+                const said = [];
+                const strings = (child) => {
+                    if (ts.isStringLiteralLike(child))
+                        said.push(child.text);
+                    if (ts.isRegularExpressionLiteral(child))
+                        said.push(child.text);
+                    ts.forEachChild(child, strings);
+                };
+                strings(statement);
+                const parent = node.parent;
+                const searched = (ts.isPropertyAccessExpression(parent) && parent.expression === node && SEARCHES.has(parent.name.text)) ||
+                    ts.isTemplateSpan(parent) ||
+                    (ts.isCallExpression(parent) && parent.arguments.some((argument) => argument === node));
+                if (said.some((value) => RUNNER_ARGUMENT.test(value) || (searched && RUNNER_WORD.test(value))))
+                    add(`process.${name} matched against a test runner`);
             }
         }
-        // Code that never runs holds no assertion: what follows a `return`,
-        // `throw`, `break` or `continue` in its block, and the branch of an
-        // `if` (or the body of a loop) on a constant that never takes it. A
-        // test emptied by `return;` at its top keeps every assertion's text.
-        if (ts.isBlock(node) || ts.isSourceFile(node) || ts.isCaseClause(node) || ts.isDefaultClause(node) || ts.isModuleBlock(node)) {
-            for (const statement of node.statements) {
-                visit(statement);
-                if (ts.isReturnStatement(statement) ||
-                    ts.isThrowStatement(statement) ||
-                    ts.isBreakStatement(statement) ||
-                    ts.isContinueStatement(statement))
-                    return;
+        // Swallowing a failure: `process.on("uncaughtException", () => {})`.
+        if (ts.isCallExpression(node)) {
+            const callee = node.expression;
+            const method = memberName(callee);
+            const event = literal(node.arguments[0]);
+            if ((ts.isPropertyAccessExpression(callee) || ts.isElementAccessExpression(callee)) &&
+                isProcess(callee.expression) &&
+                method !== null &&
+                ["on", "once", "addListener", "prependListener", "prependOnceListener"].includes(method) &&
+                event !== null &&
+                FAILURE_EVENTS.has(event) &&
+                (testCode || runsOnLoad(node)))
+                add(`process.${method}("${event}")`);
+            // `expect.extend({ toBe })` replaces a matcher; `addEqualityTesters`
+            // decides what equal means.
+            if (ts.isPropertyAccessExpression(callee) && onRunner(callee.expression)) {
+                if (callee.name.text === "addEqualityTesters")
+                    add("rewrites the test runner or the assertion library");
+                if (callee.name.text === "extend") {
+                    const matchers = node.arguments[0];
+                    const replaces = matchers === undefined ||
+                        !ts.isObjectLiteralExpression(matchers) ||
+                        matchers.properties.some((property) => {
+                            const key = property.name !== undefined && (ts.isIdentifier(property.name) || ts.isStringLiteralLike(property.name)) ? property.name.text : null;
+                            return key === null || BUILTIN_MATCHERS.test(key);
+                        });
+                    if (replaces)
+                        add("rewrites the test runner or the assertion library");
+                }
+                if (/^(overwrite|add)(Method|Property|ChainableMethod)$/.test(callee.name.text))
+                    add("rewrites the test runner or the assertion library");
             }
-            return;
         }
-        // An assertion in a `try` whose `catch` does not throw again fails
-        // into the catch and passes: `try { assert(...) } catch {}`.
-        if (ts.isTryStatement(node) && node.catchClause !== undefined) {
-            let rethrows = false;
-            const find = (child) => {
-                if (ts.isThrowStatement(child))
-                    rethrows = true;
-                else if (!ts.isFunctionLike(child))
-                    ts.forEachChild(child, find);
-            };
-            find(node.catchClause.block);
-            if (rethrows)
-                visit(node.tryBlock);
-            visit(node.catchClause.block);
-            if (node.finallyBlock !== undefined)
-                visit(node.finallyBlock);
-            return;
+        // Rewriting the runner, the assertions, or a built-in.
+        const written = [];
+        if (ts.isBinaryExpression(node) &&
+            node.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+            node.operatorToken.kind <= ts.SyntaxKind.LastAssignment)
+            written.push(node.left);
+        if (ts.isCallExpression(node)) {
+            const callee = node.expression;
+            const target = ts.isPropertyAccessExpression(callee) && ts.isIdentifier(callee.expression) ? callee.expression.text : null;
+            const method = ts.isPropertyAccessExpression(callee) ? callee.name.text : null;
+            const first = node.arguments[0];
+            if (first !== undefined &&
+                ((target === "Object" && ["assign", "defineProperty", "defineProperties", "setPrototypeOf"].includes(method ?? "")) ||
+                    (target === "Reflect" && ["set", "defineProperty", "setPrototypeOf", "deleteProperty"].includes(method ?? ""))))
+                written.push(first);
         }
-        if (ts.isIfStatement(node)) {
-            const known = constantOf(node.expression);
-            visit(node.expression);
-            if (known !== false)
-                visit(node.thenStatement);
-            if (known !== true && node.elseStatement !== undefined)
-                visit(node.elseStatement);
-            return;
+        for (const target of written) {
+            if (onRunner(target))
+                add("rewrites the test runner or the assertion library");
+            else {
+                const member = builtinTarget(target);
+                if (member !== null && !BUILTIN_SETTINGS.has(member) && !(testCode && TEST_FAKES.has(member)))
+                    add(`rewrites ${member}`);
+            }
         }
-        const loopCondition = ts.isWhileStatement(node)
-            ? node.expression
-            : ts.isForStatement(node)
-                ? node.condition
-                : undefined;
-        if (loopCondition !== undefined && constantOf(loopCondition) === false)
-            return;
-        if (ts.isBinaryExpression(node) && constantOf(node.left) !== null) {
-            const known = constantOf(node.left);
-            visit(node.left);
-            const operator = node.operatorToken.kind;
-            if ((operator === ts.SyntaxKind.AmpersandAmpersandToken && known === true) ||
-                (operator === ts.SyntaxKind.BarBarToken && known === false) ||
-                (operator !== ts.SyntaxKind.AmpersandAmpersandToken && operator !== ts.SyntaxKind.BarBarToken))
-                visit(node.right);
-            return;
+        if (!testCode) {
+            // Telling a test run from a real one.
+            if (ts.isTypeOfExpression(node) && ts.isIdentifier(node.expression) && TEST_RUNNER_GLOBALS.has(node.expression.text))
+                add(`typeof ${node.expression.text}`);
+            if ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) &&
+                ts.isIdentifier(node.expression) &&
+                GLOBAL_OBJECTS.has(node.expression.text)) {
+                const name = memberName(node);
+                if (name !== null && TEST_RUNNER_GLOBALS.has(name))
+                    add(`${node.expression.text}.${name}`);
+            }
+            if (ts.isPropertyAccessExpression(node) &&
+                node.name.text === "vitest" &&
+                ts.isMetaProperty(node.expression) &&
+                node.expression.keywordToken === ts.SyntaxKind.ImportKeyword)
+                add("import.meta.vitest");
+            if (ts.isIdentifier(node) && (node.text === "__vitest_worker__" || node.text === "__vitest_environment__"))
+                add(node.text);
+            // `if (it)`, `typeof expect`: a runner's global, read where nothing declares it.
+            if (ts.isIdentifier(node) &&
+                TEST_RUNNER_GLOBALS.has(node.text) &&
+                !node.text.startsWith("__") &&
+                !declaredNames.has(node.text) &&
+                !ts.isTypeOfExpression(node.parent) &&
+                !(ts.isPropertyAccessExpression(node.parent) && node.parent.name === node) &&
+                !(ts.isPropertyAssignment(node.parent) && node.parent.name === node) &&
+                !ts.isTypeReferenceNode(node.parent) &&
+                !ts.isQualifiedName(node.parent) &&
+                !(node.parent.name === node))
+                add(`${node.text} read as a global`);
+            const env = isTestEnv(node);
+            if (env !== null && env !== "NODE_ENV")
+                add(env);
+            // `process.env.NODE_ENV === "test"`, either way round, or as a `case`.
+            if (ts.isBinaryExpression(node) &&
+                [
+                    ts.SyntaxKind.EqualsEqualsEqualsToken,
+                    ts.SyntaxKind.EqualsEqualsToken,
+                    ts.SyntaxKind.ExclamationEqualsEqualsToken,
+                    ts.SyntaxKind.ExclamationEqualsToken,
+                ].includes(node.operatorToken.kind)) {
+                const sides = [node.left, node.right];
+                if (sides.some((side) => isTestEnv(side) === "NODE_ENV") && sides.some((side) => /^test(ing)?$/i.test(literal(side) ?? "")))
+                    add('NODE_ENV === "test"');
+            }
+            if (ts.isSwitchStatement(node) && isTestEnv(node.expression) === "NODE_ENV" &&
+                node.caseBlock.clauses.some((clause) => ts.isCaseClause(clause) && /^test(ing)?$/i.test(literal(clause.expression) ?? "")))
+                add('NODE_ENV === "test"');
+            // Reading the stack for the runner's frames.
+            if (ts.isPropertyAccessExpression(node) && node.name.text === "stack") {
+                let statement = node;
+                while (statement.parent !== undefined && !ts.isStatement(statement))
+                    statement = statement.parent;
+                if (/test_runner|vitest|jest|node:test/.test(statement.getText(source)))
+                    add("the stack read for a test runner");
+            }
         }
         ts.forEachChild(node, visit);
     };
     visit(source);
-    return { assertions, skips, focused };
+    return found;
 }
 /**
- * Why a change to a test the slice was handed weakens it, or null: an
- * assertion removed or rewritten (an expected value changed), a test
- * skipped, or one focused with `.only`. Assertions only added pass. A
- * rewritten assertion may be the change itself (a behaviour the
- * contributor was asked to change), so it is refused for a maintainer to
- * read, not judged wrong.
+ * How a script could make a test pass without the code under test passing
+ * it, read from its syntax and never run. In any script: ending the
+ * process early with no failing code (`process.exit(0)` before the tests
+ * run reports success; in the code under test, when it loads), listening
+ * for the failures it would otherwise die of (`process.on("uncaughtException",
+ * …)`), rewriting the assertion library or the runner (`assert.equal = …`,
+ * an alias of it, `expect.extend` over a built-in matcher,
+ * `addEqualityTesters`), and rewriting a built-in (`Object.is = …`), which
+ * a test may do only for the clock and the dice (`Date.now`,
+ * `Math.random`). In code that is not a test nor a test's helper: telling
+ * a test run from a real one (`typeof describe`, `import.meta.vitest`,
+ * `process.env.VITEST`, `NODE_ENV === "test"`, `process.argv` matched
+ * against a runner, the stack read for one). `process` and the built-ins
+ * are followed through aliases and casts. Each as a short label, sorted.
+ * Text-level, like `reachOf`: a hold for a reader, not a sandbox.
  */
-export function weakenedTest(path, before, after, noun = "a test the slice was handed") {
-    const old = assertionsOf(path, before);
-    const now = assertionsOf(path, after);
-    const left = new Map();
-    for (const assertion of now.assertions)
-        left.set(assertion, (left.get(assertion) ?? 0) + 1);
-    let removed = 0;
-    for (const assertion of old.assertions) {
-        const count = left.get(assertion) ?? 0;
-        if (count > 0)
-            left.set(assertion, count - 1);
-        else
-            removed += 1;
-    }
-    const reasons = [];
-    if (removed > 0)
-        reasons.push(`removes or rewrites ${removed} assertion${removed === 1 ? "" : "s"} of ${noun}`);
-    if (now.skips > old.skips)
-        reasons.push(`skips ${now.skips - old.skips} more test${now.skips - old.skips === 1 ? "" : "s"}`);
-    if (now.focused > old.focused)
-        reasons.push(`focuses ${now.focused - old.focused} more test${now.focused - old.focused === 1 ? "" : "s"} with .only, which skips the rest of the file`);
-    return reasons.length === 0 ? null : reasons.join(", and ");
+export function integrityOf(path, text) {
+    return [...integrityCounts(path, text).keys()].sort();
+}
+/** The labels whose count grew from one text to the other. */
+function grown(before, after) {
+    return [...after.entries()]
+        .filter(([label, count]) => count > (before?.get(label) ?? 0))
+        .map(([label]) => label)
+        .sort();
+}
+const isScriptPath = (path) => /\.[cm]?[jt]sx?$/.test(path) && !/\.d\.[cm]?ts$/.test(path);
+/**
+ * The ways to pass a test without the code that a script's new text has
+ * more of than its old text (`integrityOf`), or nothing when it is no script.
+ */
+export function gainedIntegrity(path, before, after) {
+    if (!isScriptPath(path))
+        return [];
+    return grown(before === null ? null : integrityCounts(path, before), integrityCounts(path, after));
+}
+/**
+ * The reach a script's new text has more of than its old text did
+ * (`reachOf`), or nothing when it is no script. A file that already read
+ * the disk may keep doing so: only what the change adds is a question.
+ */
+export function gainedReach(path, before, after, context = {}) {
+    if (!isScriptPath(path))
+        return [];
+    return grown(before === null ? null : reachCounts(path, before, context), reachCounts(path, after, context));
 }
+export { weakenedTest };