ttsc 0.19.1 → 0.19.2

package/cmd/ttscgraph/serve.go

@@ -22,16 +22,91 @@ import (
   "github.com/samchon/ttsc/packages/ttsc/internal/graph"
 )
 
+// serveProtocolVersion is the version of the newline-delimited serve envelope.
+// It moves when a field is added, removed, or given a new meaning.
+//
+// Every response carries it, rather than a handshake establishing it once. The
+// binary and the npm package version independently — @ttsc/graph resolves
+// whichever ttscgraph the target project installed — so a mismatched pair is
+// reachable, and a per-response version lets the client fail fast on the first
+// frame it reads without spending a round-trip to learn the version it is about
+// to be told anyway. It also keeps the protocol stateless: a response is
+// self-describing even when read from a log.
+const serveProtocolVersion = 1
+
+// serveModes are the computation modes Snapshot can report, plus the error mode
+// the transport adds. A consumer branches on these to report honestly what the
+// producer did rather than inferring it from a generation counter.
+const (
+  // serveModeInitial is the first snapshot of a session.
+  serveModeInitial = "initial"
+  // serveModeReload is a full program reload: the build universe moved.
+  serveModeReload = "reload"
+  // serveModeUnchanged is no change since the last snapshot; no dump rides it.
+  serveModeUnchanged = "unchanged"
+  // serveModeIncremental is edits applied onto the reused resident program.
+  serveModeIncremental = "incremental"
+  // serveModeRebuild is edits applied but the program could not be reused.
+  serveModeRebuild = "rebuild"
+  // serveModeError is a request that produced no snapshot. It is a transport
+  // mode, not a computation mode: it exists so mode is never absent, because a
+  // field that disappears on the error path cannot be relied on.
+  serveModeError = "error"
+)
+
+// fullSnapshotCapabilities is what a snapshot from a resident compiler session
+// proves. Both commands that own a real Program declare all three; the constant
+// exists so the envelope's claim and the dump's claim cannot drift apart.
+var fullSnapshotCapabilities = []string{
+  graph.CapabilityUniverse,
+  graph.CapabilitySourceDigests,
+  graph.CapabilityDiskDigests,
+  graph.CapabilityDiagnostics,
+}
+
+// serveCapabilities is what this server can prove, answered before a consumer
+// has a dump to inspect — an `unchanged` response carries no dump, and a client
+// negotiating on the first frame has not parsed one yet. It mirrors what every
+// dump this server publishes declares for itself.
+var serveCapabilities = fullSnapshotCapabilities
+
 type serveRequest struct {
   ID int `json:"id"`
 }
 
 type serveResponse struct {
-  Dump    *graph.Dump `json:"dump,omitempty"`
-  Error   string      `json:"error,omitempty"`
-  ID      int         `json:"id"`
-  Mode    string      `json:"mode,omitempty"`
-  Changed bool        `json:"changed"`
+  Dump *graph.Dump `json:"dump,omitempty"`
+  // Error is set when the request produced no snapshot; Mode is then
+  // serveModeError.
+  Error string `json:"error,omitempty"`
+  ID    int    `json:"id"`
+  // ProtocolVersion is serveProtocolVersion on every response, including error
+  // responses: a client that cannot parse the rest still learns why.
+  ProtocolVersion int `json:"protocolVersion"`
+  // Mode is always present. It was omitempty, which meant the one field that
+  // distinguishes a reuse from a full rebuild silently vanished exactly when a
+  // consumer most wanted to report what happened.
+  Mode         string   `json:"mode"`
+  Capabilities []string `json:"capabilities"`
+  Changed      bool     `json:"changed"`
+}
+
+// newServeResponse stamps the fields every response owes the client, so no exit
+// from the serve loop can forget one.
+func newServeResponse(id int) serveResponse {
+  return serveResponse{
+    ID:              id,
+    ProtocolVersion: serveProtocolVersion,
+    Capabilities:    serveCapabilities,
+  }
+}
+
+// errorResponse is a response that carries no snapshot.
+func errorResponse(id int, message string) serveResponse {
+  response := newServeResponse(id)
+  response.Mode = serveModeError
+  response.Error = message
+  return response
 }
 
 type graphSession struct {
@@ -42,7 +117,17 @@ type graphSession struct {
   auxStates    map[string]diskState
   sourceHashes map[string][sha256.Size]byte
   rootFiles    []string
-  initialized  bool
+  // diskDigests is the published disk evidence for the current generation, kept
+  // beside sourceHashes because the two answer different questions: one decides
+  // whether to invalidate, the other is what the snapshot tells a consumer.
+  diskDigests map[string]string
+  // configDigests and roots are the build-universe fingerprint for the current
+  // generation, captured from the same parse that produced configHashes and
+  // rootFiles so the published evidence and the invalidation state can never
+  // describe different loads.
+  configDigests []graph.FileDigest
+  roots         []graph.RootFile
+  initialized   bool
 }
 
 func newGraphSession(cwd, tsconfig string) (*graphSession, error) {
@@ -64,7 +149,7 @@ func (s *graphSession) Snapshot() (*graph.Dump, string, bool, error) {
   if !s.initialized {
     dump := s.buildDump()
     s.initialized = true
-    return &dump, "initial", true, nil
+    return &dump, serveModeInitial, true, nil
   }
 
   configChanged, err := hashesChanged(s.configHashes)
@@ -76,7 +161,7 @@ func (s *graphSession) Snapshot() (*graph.Dump, string, bool, error) {
       return nil, "", false, err
     }
     dump := s.buildDump()
-    return &dump, "reload", true, nil
+    return &dump, serveModeReload, true, nil
   }
 
   if diskStatesChanged(s.auxStates) {
@@ -84,7 +169,7 @@ func (s *graphSession) Snapshot() (*graph.Dump, string, bool, error) {
       return nil, "", false, err
     }
     dump := s.buildDump()
-    return &dump, "reload", true, nil
+    return &dump, serveModeReload, true, nil
   }
 
   roots, err := projectRootFiles(s.compiler.Program(), true)
@@ -96,7 +181,7 @@ func (s *graphSession) Snapshot() (*graph.Dump, string, bool, error) {
       return nil, "", false, err
     }
     dump := s.buildDump()
-    return &dump, "reload", true, nil
+    return &dump, serveModeReload, true, nil
   }
 
   changed, deleted, err := changedSources(s.sourceHashes)
@@ -108,20 +193,20 @@ func (s *graphSession) Snapshot() (*graph.Dump, string, bool, error) {
       return nil, "", false, err
     }
     dump := s.buildDump()
-    return &dump, "reload", true, nil
+    return &dump, serveModeReload, true, nil
   }
   if len(changed) == 0 {
-    return nil, "unchanged", false, nil
+    return nil, serveModeUnchanged, false, nil
   }
   if s.compiler.Program().HasLinkedProgramPlugins() {
     if err := s.reload(); err != nil {
       return nil, "", false, err
     }
     dump := s.buildDump()
-    return &dump, "reload", true, nil
+    return &dump, serveModeReload, true, nil
   }
 
-  mode := "incremental"
+  mode := serveModeIncremental
   paths := make([]string, 0, len(changed))
   for path := range changed {
     paths = append(paths, path)
@@ -129,7 +214,7 @@ func (s *graphSession) Snapshot() (*graph.Dump, string, bool, error) {
   sort.Strings(paths)
   for _, path := range paths {
     if reused := s.compiler.Apply(path, changed[path]); !reused {
-      mode = "rebuild"
+      mode = serveModeRebuild
     }
     current, exists := s.compiler.SourceText(path)
     expected := driver.ApplySourcePreambleToFile(path, changed[path], s.compiler.Program().SourcePreamble)
@@ -138,7 +223,7 @@ func (s *graphSession) Snapshot() (*graph.Dump, string, bool, error) {
         return nil, "", false, err
       }
       dump := s.buildDump()
-      return &dump, "reload", true, nil
+      return &dump, serveModeReload, true, nil
     }
   }
   if err := s.captureState(); err != nil {
@@ -182,7 +267,7 @@ func (s *graphSession) captureState() error {
   if err != nil {
     return err
   }
-  sourceHashes, err := hashProgramSources(program)
+  sourceHashes, diskDigests, err := hashProgramSources(program)
   if err != nil {
     return err
   }
@@ -191,10 +276,37 @@ func (s *graphSession) captureState() error {
   s.configHashes = configHashes
   s.auxStates = captureDiskStates(compactSortedStrings(inputs))
   s.sourceHashes = sourceHashes
+  s.diskDigests = diskDigests
   s.rootFiles = projectRootFilesFromConfigs(configs, false)
+  s.configDigests = fileDigests(configHashes)
+  s.roots = rootFileEntries(s.rootFiles)
   return nil
 }
 
+// fileDigests projects a path-to-hash map onto the wire's file/digest pairs.
+func fileDigests(hashes map[string][sha256.Size]byte) []graph.FileDigest {
+  out := make([]graph.FileDigest, 0, len(hashes))
+  for path, hash := range hashes {
+    out = append(out, graph.FileDigest{File: path, Digest: graph.Digest(hash)})
+  }
+  return out
+}
+
+// rootFileEntries splits the internal config\x00file root encoding back into the
+// pair it stands for. The joined form exists only so the root set compares with
+// slices.Equal; it is not a shape to publish.
+func rootFileEntries(roots []string) []graph.RootFile {
+  out := make([]graph.RootFile, 0, len(roots))
+  for _, root := range roots {
+    config, file, found := strings.Cut(root, "\x00")
+    if !found {
+      continue
+    }
+    out = append(out, graph.RootFile{Config: config, File: file})
+  }
+  return out
+}
+
 // missingRootInputs returns config root files absent from the loaded program.
 // A literal `files` entry keeps its name whether or not the file exists, so
 // neither the root-set comparison nor source hashing notices when such a root
@@ -214,15 +326,39 @@ func missingRootInputs(configs []*shimtsoptions.ParsedCommandLine, sourceHashes
 func (s *graphSession) buildDump() graph.Dump {
   program := s.compiler.Program()
   built := graph.Build(program)
+  // One texts map feeds both the spans and the manifest digests, so the bytes a
+  // span points into are provably the bytes the manifest attests to.
+  texts := graph.SourceTexts(program)
   return graph.NewDump(
     built,
     s.cwd,
     s.tsconfig,
     graph.GitIgnoredFiles(s.cwd, built),
-    graph.SourceTexts(program),
+    texts,
+    graph.DumpOrigin{
+      Provenance: graph.NewProvenance(
+        s.cwd,
+        serveProducer(),
+        fullSnapshotCapabilities,
+        s.configDigests,
+        s.roots,
+        texts,
+        s.diskDigests,
+      ),
+      Diagnostics: graph.NewDiagnostics(program, s.cwd),
+    },
   )
 }
 
+// serveProducer names this binary and the checker it links.
+func serveProducer() graph.Producer {
+  return graph.Producer{
+    Tool:       "ttscgraph",
+    Version:    version,
+    Typescript: graph.TypescriptVersion(),
+  }
+}
+
 func configFiles(configs []*shimtsoptions.ParsedCommandLine) []string {
   files := []string{}
   for _, parsed := range configs {
@@ -311,8 +447,22 @@ func invalidProjectError(diags []driver.Diagnostic) error {
   return fmt.Errorf("ttscgraph: invalid project: %s", strings.Join(messages, "; "))
 }
 
-func hashProgramSources(program *driver.Program) (map[string][sha256.Size]byte, error) {
+// hashProgramSources returns two maps keyed by absolute source path.
+//
+// The first is the invalidation state: the hash the next snapshot compares
+// against to decide whether a file moved. It is deliberately not always the
+// file's disk hash — a file that raced the load is recorded under its resident
+// text so the comparison is guaranteed to miss and force a revisit.
+//
+// The second is the source manifest's disk evidence: the hex digest of the bytes
+// actually read from disk, present only when the read succeeded. These are
+// separate values because the first is a sentinel chosen to control the next
+// comparison and the second is a fact published to a consumer. Publishing the
+// sentinel would tell a consumer that a file it is about to read hashes to
+// something it can never reproduce.
+func hashProgramSources(program *driver.Program) (map[string][sha256.Size]byte, map[string]string, error) {
   hashes := make(map[string][sha256.Size]byte)
+  digests := make(map[string]string)
   for _, source := range program.TSProgram.SourceFiles() {
     // Virtual sources (tsgo's `bundled:///` libs) have no on-disk identity;
     // real project files always carry an absolute path.
@@ -334,9 +484,13 @@ func hashProgramSources(program *driver.Program) (map[string][sha256.Size]byte,
     }
     content, err := os.ReadFile(source.FileName())
     if err != nil {
-      return nil, fmt.Errorf("ttscgraph: read %s: %w", source.FileName(), err)
+      return nil, nil, fmt.Errorf("ttscgraph: read %s: %w", source.FileName(), err)
     }
     rawHash := sha256.Sum256(content)
+    // The bytes were read, so their digest is a fact regardless of whether they
+    // match what the checker holds. When they do not, the manifest's text and
+    // disk digests disagree, which is precisely what a consumer needs to see.
+    digests[source.FileName()] = graph.Digest(rawHash)
     expected := driver.ApplySourcePreambleToFile(source.FileName(), string(content), program.SourcePreamble)
     if source.Text() == expected {
       hashes[source.FileName()] = rawHash
@@ -346,7 +500,7 @@ func hashProgramSources(program *driver.Program) (map[string][sha256.Size]byte,
       hashes[source.FileName()] = sha256.Sum256([]byte(source.Text()))
     }
   }
-  return hashes, nil
+  return hashes, digests, nil
 }
 
 func hashFiles(paths []string) (map[string][sha256.Size]byte, error) {
@@ -833,22 +987,37 @@ func serveSnapshots(input io.Reader, output io.Writer, cwd, tsconfig string) int
     }
     var request serveRequest
     if err := json.Unmarshal([]byte(line), &request); err != nil {
-      _ = encoder.Encode(serveResponse{Error: fmt.Sprintf("invalid request: %v", err)})
-      continue
+      // A response is addressed by id, and an unparseable line has no id to
+      // address it to. Replying with the zero id answered nobody: the client
+      // drops a frame matching no pending request, so the caller's promise
+      // never settled and the graph call hung forever.
+      //
+      // There is no recoverable reading of this. The client is the only writer
+      // and it writes nothing but {"id":N}, so a line it cannot produce means
+      // the stream is not the protocol. Fail it: the exit carries this stderr
+      // to the client, which rejects every pending request with it — an
+      // outcome, where the dropped frame was silence.
+      fmt.Fprintf(stderr, "ttscgraph: unaddressable serve request: %v\n", err)
+      return 1
     }
     if session == nil {
       created, err := newGraphSession(cwd, tsconfig)
       if err != nil {
-        _ = encoder.Encode(serveResponse{ID: request.ID, Error: err.Error()})
+        _ = encoder.Encode(errorResponse(request.ID, err.Error()))
         continue
       }
       session = created
     }
     dump, mode, changed, err := session.Snapshot()
-    response := serveResponse{ID: request.ID, Dump: dump, Mode: mode, Changed: changed}
+    response := newServeResponse(request.ID)
+    response.Dump = dump
+    response.Mode = mode
+    response.Changed = changed
     if err != nil {
       response.Error = err.Error()
       response.Dump = nil
+      response.Mode = serveModeError
+      response.Changed = false
     }
     if err := encoder.Encode(response); err != nil {
       fmt.Fprintf(stderr, "ttscgraph: write serve response: %v\n", err)

package/cmd/ttscgraph/serve_error_response_still_names_its_mode_test.go

@@ -0,0 +1,73 @@
+package main
+
+import (
+  "bytes"
+  "encoding/json"
+  "os"
+  "path/filepath"
+  "strings"
+  "testing"
+)
+
+// TestServeErrorResponseStillNamesItsMode verifies a failed snapshot answers
+// with a mode and a protocol version rather than dropping them.
+//
+// This is the negative twin of the successful snapshot. Mode used to be
+// omitempty, so it vanished on exactly the path where a consumer most needs to
+// say what happened: the error path serves no dump and set no mode, leaving
+// "what did the compiler do" unanswerable and the field unrelied-upon. A field
+// that is present only when things go well is not a field a consumer can branch
+// on.
+//
+//  1. Serve a project whose tsconfig is invalid, so the session cannot be built.
+//  2. Assert the response carries the error, and mode is the error mode.
+//  3. Assert the protocol version still rides it, so the client can read it at
+//     all.
+func TestServeErrorResponseStillNamesItsMode(t *testing.T) {
+  root := graphSessionFixture(t)
+  if err := os.WriteFile(filepath.Join(root, "tsconfig.json"), []byte("{ invalid"), 0o644); err != nil {
+    t.Fatal(err)
+  }
+
+  var output bytes.Buffer
+  if code := serveSnapshots(strings.NewReader("{\"id\":7}\n"), &output, root, "tsconfig.json"); code != 0 {
+    t.Fatalf("serveSnapshots exited %d", code)
+  }
+  // Keep the bytes: they are read twice below, once as the typed envelope and
+  // once as bare keys, and a decoder would drain the buffer before the second.
+  line := output.Bytes()
+  var response serveResponse
+  if err := json.Unmarshal(line, &response); err != nil {
+    t.Fatal(err)
+  }
+  if response.Error == "" {
+    t.Fatalf("invalid config produced no error: %#v", response)
+  }
+  if response.ID != 7 {
+    t.Fatalf("error response id %d, want the request's 7", response.ID)
+  }
+  if response.Mode != serveModeError {
+    t.Fatalf("error response mode %q, want %q", response.Mode, serveModeError)
+  }
+  if response.ProtocolVersion != serveProtocolVersion {
+    t.Fatalf("error response protocol version %d, want %d", response.ProtocolVersion, serveProtocolVersion)
+  }
+  if response.Dump != nil {
+    t.Fatal("error response carried a dump")
+  }
+  if response.Changed {
+    t.Fatal("error response claimed the graph changed")
+  }
+
+  // The wire keys, not the Go fields: mode must survive serialization, which is
+  // the whole regression — omitempty dropped it there and nowhere else.
+  var raw map[string]any
+  if err := json.Unmarshal(line, &raw); err != nil {
+    t.Fatal(err)
+  }
+  for _, key := range []string{"mode", "protocolVersion", "capabilities"} {
+    if _, ok := raw[key]; !ok {
+      t.Fatalf("error response omitted %q on the wire: %s", key, line)
+    }
+  }
+}

package/cmd/ttscgraph/serve_protocol_fails_the_stream_on_an_unaddressable_request_line_test.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+  "bytes"
+  "strings"
+  "testing"
+)
+
+// TestServeProtocolFailsTheStreamOnAnUnaddressableRequestLine verifies a
+// malformed NDJSON line ends the stream with a diagnostic on stderr instead of
+// answering with a reply nobody can read.
+//
+// The server used to answer an unparseable line with an error carrying the zero
+// ID, because none could be parsed. That reply had no addressee: the launcher
+// matches a response to a pending request by id and drops anything else, and its
+// ids start at 1, so the frame was discarded and the caller's promise never
+// settled — a graph call hung forever on a line the client itself sent. There is
+// no recoverable reading of a line the protocol cannot address, so failing the
+// stream is the honest outcome: the exit carries this stderr to the client,
+// which rejects every pending request with it.
+//
+//  1. Send a non-JSON line, then a valid request that must never be served.
+//  2. Assert serveSnapshots exits non-zero and names the offending line.
+//  3. Assert no response frame was written, since none could be addressed.
+func TestServeProtocolFailsTheStreamOnAnUnaddressableRequestLine(t *testing.T) {
+  root := graphSessionFixture(t)
+  oldStderr := stderr
+  defer func() { stderr = oldStderr }()
+  var errOut bytes.Buffer
+  stderr = &errOut
+
+  input := strings.NewReader("not-json\n{\"id\":1}\n")
+  var output bytes.Buffer
+  if code := serveSnapshots(input, &output, root, "tsconfig.json"); code == 0 {
+    t.Fatalf("serveSnapshots accepted an unaddressable line: %q", output.String())
+  }
+  if !strings.Contains(errOut.String(), "unaddressable serve request") {
+    t.Fatalf("stderr did not explain the failure: %q", errOut.String())
+  }
+  if output.Len() != 0 {
+    t.Fatalf("serveSnapshots answered an unaddressable line: %q", output.String())
+  }
+}

package/cmd/ttscgraph/serve_protocol_version_matches_the_typescript_client_test.go

@@ -0,0 +1,48 @@
+package main
+
+import (
+  "bytes"
+  "os"
+  "path/filepath"
+  "regexp"
+  "strconv"
+  "testing"
+)
+
+// TestServeProtocolVersionMatchesTheTypescriptClient verifies the Go server and
+// the TypeScript client agree on the serve protocol version.
+//
+// The envelope exists in two hand-written places with no generator between them:
+// serveResponse here and ITtscGraphSnapshot in @ttsc/graph. Nothing but this
+// test makes bumping one a failure until the other follows. That is the whole
+// point of the field — a version both sides invent separately detects nothing —
+// so the drift it is meant to catch must not be able to start here.
+//
+//  1. Read PROTOCOL_VERSION out of the TypeScript client's source.
+//  2. Compare it to serveProtocolVersion.
+func TestServeProtocolVersionMatchesTheTypescriptClient(t *testing.T) {
+  client := filepath.Join("..", "..", "..", "graph", "src", "model", "TtscGraphSession.ts")
+  source, err := os.ReadFile(client)
+  if err != nil {
+    t.Fatalf("read the TypeScript client: %v", err)
+  }
+  // The checkout is CRLF on Windows, and a line-anchored match would never
+  // see the end of a line that ends in a carriage return.
+  source = bytes.ReplaceAll(source, []byte("\r\n"), []byte("\n"))
+  match := regexp.MustCompile(`(?m)^const PROTOCOL_VERSION = (\d+);$`).FindSubmatch(source)
+  if match == nil {
+    t.Fatalf("no `const PROTOCOL_VERSION = <n>;` in %s; if it moved, this gate must follow it", client)
+  }
+  declared, err := strconv.Atoi(string(match[1]))
+  if err != nil {
+    t.Fatalf("PROTOCOL_VERSION is not a number: %v", err)
+  }
+  if declared != serveProtocolVersion {
+    t.Fatalf(
+      "serve protocol drifted: Go serves v%d, %s reads v%d",
+      serveProtocolVersion,
+      client,
+      declared,
+    )
+  }
+}

package/cmd/ttscgraph/serve_snapshot_proves_its_program_without_a_second_read_test.go

@@ -0,0 +1,109 @@
+package main
+
+import (
+  "bytes"
+  "crypto/sha256"
+  "encoding/json"
+  "os"
+  "path/filepath"
+  "strings"
+  "testing"
+
+  "github.com/samchon/ttsc/packages/ttsc/internal/graph"
+)
+
+// TestServeSnapshotProvesItsProgramWithoutASecondRead verifies a single serve
+// response carries everything needed to prove which program produced it.
+//
+// This is the contract the envelope exists for. A consumer used to be handed
+// paths and nothing else, so proving that the nodes, edges, and the file bytes
+// it was about to read all belonged to one Program meant re-reading the disk
+// afterwards and asking the server a second time whether anything had moved —
+// which narrows the race without closing it, and never proves the bytes read are
+// the bytes the checker resolved against. Everything below has to come out of
+// one frame, because a second frame is the thing being replaced.
+//
+//  1. Take one snapshot of a fixture project.
+//  2. Assert the envelope names its protocol, mode, and capabilities.
+//  3. Assert every file the dump names carries a digest, and that hashing the
+//     file off the disk independently reproduces it.
+func TestServeSnapshotProvesItsProgramWithoutASecondRead(t *testing.T) {
+  root := graphSessionFixture(t)
+  var output bytes.Buffer
+  if code := serveSnapshots(strings.NewReader("{\"id\":1}\n"), &output, root, "tsconfig.json"); code != 0 {
+    t.Fatalf("serveSnapshots exited %d", code)
+  }
+
+  var response serveResponse
+  if err := json.NewDecoder(&output).Decode(&response); err != nil {
+    t.Fatal(err)
+  }
+  if response.Error != "" {
+    t.Fatalf("snapshot failed: %s", response.Error)
+  }
+  if response.ProtocolVersion != serveProtocolVersion {
+    t.Fatalf("envelope protocol version %d, want %d", response.ProtocolVersion, serveProtocolVersion)
+  }
+  if response.Mode != serveModeInitial {
+    t.Fatalf("mode %q, want %q", response.Mode, serveModeInitial)
+  }
+  if len(response.Capabilities) == 0 {
+    t.Fatal("envelope declared no capabilities, so a consumer cannot tell what it may rely on")
+  }
+  if response.Dump == nil {
+    t.Fatal("initial snapshot carried no dump")
+  }
+
+  provenance := response.Dump.Provenance
+  if provenance.SchemaVersion != graph.DumpSchemaVersion {
+    t.Fatalf("dump schema version %d, want %d", provenance.SchemaVersion, graph.DumpSchemaVersion)
+  }
+  if provenance.Producer.Tool != "ttscgraph" {
+    t.Fatalf("provenance names producer %q, want ttscgraph", provenance.Producer.Tool)
+  }
+  if provenance.Producer.Typescript == "" {
+    t.Fatal("provenance did not name the TypeScript version behind the facts")
+  }
+  if len(provenance.Universe.Configs) == 0 {
+    t.Fatal("universe fingerprinted no config, though the fixture has a tsconfig")
+  }
+  if len(provenance.Universe.Roots) == 0 {
+    t.Fatal("universe fingerprinted no root file")
+  }
+
+  // Every file a node names must appear in the manifest. A file with facts but
+  // no digest is exactly the gap the manifest closes: a consumer would have to
+  // trust it.
+  digests := make(map[string]graph.SourceDigest, len(provenance.Sources))
+  for _, source := range provenance.Sources {
+    digests[source.File] = source
+  }
+  for _, node := range response.Dump.Nodes {
+    if node.External {
+      continue
+    }
+    if _, ok := digests[node.File]; !ok {
+      t.Fatalf("node %q names file %q, which the manifest does not digest", node.ID, node.File)
+    }
+  }
+
+  // The point of the disk digest: a consumer that opens the file itself can
+  // reproduce it. Do exactly that, from outside the compiler.
+  proven := 0
+  for file, source := range digests {
+    if source.Disk == "" {
+      continue
+    }
+    content, err := os.ReadFile(filepath.Join(root, filepath.FromSlash(file)))
+    if err != nil {
+      continue
+    }
+    if got := graph.Digest(sha256.Sum256(content)); got != source.Disk {
+      t.Fatalf("independent read of %q hashes to %s, manifest says %s", file, got, source.Disk)
+    }
+    proven++
+  }
+  if proven == 0 {
+    t.Fatal("no file's digest could be reproduced from disk, so the manifest proves nothing")
+  }
+}