@exodus/stasis 1.0.0-beta.1 → 1.0.0-beta.10

package/src/scan.js

@@ -1,63 +1,70 @@
-import { readFileSync, existsSync } from 'node:fs'
-import { extname, resolve as resolvePath, relative } from 'node:path'
+import { dirname, extname, resolve as resolvePath, relative } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
-import { createRequire, isBuiltin, findPackageJSON } from 'node:module'
+import { createRequire, isBuiltin } from 'node:module'
 import assert from 'node:assert/strict'
+import { packageType } from '@exodus/stasis-core/bundle-util'
+import { classifyExtension, classifyFormat, isTypeDeclaration, relativeEscapes } from '@exodus/stasis-core/util'
+import { inNodeModules, resolveTypescriptFallback, typescriptSiblings } from './resolve-typescript.js'
+import { diskHost } from '@exodus/stasis-core/host'
 
-// Static require/import graph walker. Reads source files and parses them; never
-// loads or executes any user code. Resolves specifiers through Node's own
-// resolver (`createRequire(parent).resolve(spec, { conditions: Set })`), which
-// reads package.json manifests and applies `exports` conditions but never runs
-// the target module. Dynamic specifiers (`require(name)`, `import('./'+x)`)
-// are recorded as unresolved -- a fundamental limit of static analysis for
-// CJS, not a tooling shortcoming. Files that fail to parse are recorded in
-// `parseErrors` (and flagged with `parseError` in `files`): for script (CJS)
-// files oxc's recovered AST still yields the edges (Node's module wrapper
-// accepts code oxc rejects, e.g. top-level `return`), while module files keep
-// no edges -- a missed static edge is a hole consumers can't enumerate.
-
-const SCRIPT_EXTS = new Set(['.js', '.cjs', '.mjs', '.ts', '.cts', '.mts'])
+// Static require/import graph walker: parses source, never loads or executes user code.
+// Dynamic specifiers (`require(name)`, `import('./'+x)`) are recorded as unresolved.
+
+// .jsx/.tsx need no flag: oxc parses them as JSX/TSX purely from the filename, so a reached one
+// -- e.g. a package whose React Native entry is src/index.tsx -- is parsed and carried like any .ts.
+const SCRIPT_EXTS = new Set(['.js', '.cjs', '.mjs', '.ts', '.cts', '.mts', '.jsx', '.tsx'])
 const RESOLVABLE_EXTS = new Set([...SCRIPT_EXTS, '.json'])
+// The extensions whose name can't tell whether they hold JSX, parsed with JSX enabled only under
+// `jsx` (React Native's JSX-in-.js convention). Excludes the .ts family: TypeScript's `<T>`
+// generics collide with JSX, so tsc/oxc reserve JSX for .tsx — JSX-in-TS belongs in a .tsx file.
+const JSX_EXTS = new Set(['.js', '.cjs', '.mjs'])
+
+// Flow type syntax lives in the JS (non-TS) family; oxc parses TS natively, and running
+// flow-remove-types over a .ts/.tsx file would corrupt TS-only constructs, so --flow only strips
+// these. .jsx is included (it's JS + JSX, and can carry Flow types like .js); .tsx is not (it's
+// TypeScript). flow-remove-types preserves JSX, so a stripped .jsx re-parses under lang:jsx.
+const FLOW_EXTS = new Set(['.js', '.cjs', '.mjs', '.jsx'])
+const TS_EXTS = new Set(['.ts', '.cts', '.mts', '.tsx'])
 
-// oxc-parser is a regular dependency, required lazily so non-JS bundlers (which
-// never reach getParser()) don't load the native parser.
+// Required lazily so non-JS bundlers don't load the native oxc parser.
 let _parser
-function getParser() {
+export function getParser() {
   _parser ??= createRequire(import.meta.url)('oxc-parser')
   return _parser
 }
 
-function packageType(file) {
-  const pkg = findPackageJSON(pathToFileURL(file).toString())
-  if (!pkg) return null
+// flow-remove-types is an optional dependency, loaded lazily and only under --flow: it strips
+// Flow type syntax down to plain JS before oxc (which parses JS/TS, not Flow) sees it. A missing
+// dep is an env error, so surface it with an actionable install hint rather than a bare resolve throw.
+let _flowRemoveTypes
+function getFlowRemoveTypes() {
+  if (_flowRemoveTypes) return _flowRemoveTypes
   try {
-    const type = JSON.parse(readFileSync(pkg, 'utf8')).type
-    return type === 'module' || type === 'commonjs' ? type : null
-  } catch {
-    return null
+    _flowRemoveTypes = createRequire(import.meta.url)('flow-remove-types')
+  } catch (cause) {
+    throw new Error(
+      "--flow needs the optional 'flow-remove-types' dependency; install it (e.g. `npm i flow-remove-types`)",
+      { cause }
+    )
   }
+  return _flowRemoveTypes
 }
 
-// Format per Node's own rules. TypeScript files get Node's type-stripping
-// formats ('module-typescript' / 'commonjs-typescript'), matching what Node's
-// load hook reports for them. For .js/.ts the module system comes from the
-// nearest package.json `type`; when that's absent (or unrecognized), Node
-// falls back to module-syntax detection, which requires the parse — null
-// signals "detect from syntax" to the caller.
-function formatForFile(file) {
-  const ext = extname(file)
-  if (ext === '.mjs') return 'module'
-  if (ext === '.cjs') return 'commonjs'
-  if (ext === '.json') return 'json'
-  if (ext === '.mts') return 'module-typescript'
-  if (ext === '.cts') return 'commonjs-typescript'
-  const type = packageType(file)
+// classifyFormat is the shared name->format authority (static and runtime bundles must agree); it
+// returns null for the .js/.ts family whose module system comes from package.json `type` (null =
+// detect from syntax, signaled up as null).
+function formatForFile(file, host) {
+  const format = classifyFormat(file)
+  if (format != null) return format
+  const type = packageType(file, host)
   if (type === null) return null
-  const suffix = ext === '.ts' ? '-typescript' : ''
-  return `${type}${suffix}`
+  return `${type}${extname(file) === '.ts' ? '-typescript' : ''}`
 }
 
-function literalSpec(node) {
+// The errors oxc reports for a parse, but its warnings and advice.
+export const syntaxErrors = (parsed) => (parsed.errors ?? []).filter((e) => e.severity !== 'Warning' && e.severity !== 'Advice')
+
+export function literalSpec(node) {
   if (!node) return null
   if (node.type === 'Literal' && typeof node.value === 'string') return node.value
   if (node.type === 'TemplateLiteral' && node.expressions.length === 0 && node.quasis.length === 1) {
@@ -66,9 +73,7 @@ function literalSpec(node) {
   return null
 }
 
-// Walk the AST for require() and dynamic import() calls. ESM static imports and
-// re-exports are picked up separately from oxc-parser's `module.staticImports` /
-// `module.staticExports` -- much cheaper than walking the whole tree for them.
+// Walks require()/import() calls only; ESM static imports/re-exports come from oxc module records.
 function findCallSpecifiers(ast, push) {
   const visit = (node) => {
     if (!node || typeof node !== 'object') return
@@ -90,11 +95,8 @@ function findCallSpecifiers(ast, push) {
       if (spec != null) push({ kind: 'dynamic-import', spec })
       else push({ kind: 'dynamic-import', dynamic: true })
     } else if (node.type === 'TSImportEqualsDeclaration') {
-      // `import lib = require('./dep.cts')`: TS-only CJS import form. Node's
-      // type stripping refuses to run it (non-erasable syntax), but the
-      // dependency edge is real — record it like a require() so the bundle
-      // stays self-contained for transform-types users and external analysis.
-      // Qualified-name references (`import A = B.C`) carry no file edge.
+      // `import lib = require('./dep.cts')`: TS-only CJS import; record the real edge.
+      // Qualified-name form (`import A = B.C`) carries no file edge.
       if (node.moduleReference?.type === 'TSExternalModuleReference') {
         const spec = literalSpec(node.moduleReference.expression)
         if (spec != null) push({ kind: 'require', spec })
@@ -110,6 +112,67 @@ function findCallSpecifiers(ast, push) {
   visit(ast)
 }
 
+// The import specifiers `program` holds, as { kind, spec } ({ kind, dynamic: true } for a computed
+// one). STATEMENT-level type-ness decides an edge, matching what survives type erasure at runtime
+// (verbatimModuleSyntax / Node's own type stripping): an `import type` / `export type` statement is
+// erased whole, so no edge; a statement that merely lists inline `type` specifiers
+// (`import { type A }`, `export { type B } from`) -- or none at all (`import {}`, `export {} from`)
+// -- still loads its module, so its edge is real. oxc's module records can't draw that line
+// (`import type { A }` and `import { type A }` yield identical all-isType entries, and
+// `export {} from` yields no entry at all), so the statements are read off the AST, where
+// importKind/exportKind carry it.
+function collectSpecifiers(program) {
+  const specs = []
+  for (const node of program.body) {
+    if (node.type === 'ImportDeclaration') {
+      if (node.importKind !== 'type') specs.push({ kind: 'import', spec: node.source.value })
+    } else if (node.type === 'ExportNamedDeclaration') {
+      if (node.source != null && node.exportKind !== 'type') specs.push({ kind: 'export-from', spec: node.source.value })
+    } else if (node.type === 'ExportAllDeclaration') {
+      if (node.exportKind !== 'type') specs.push({ kind: 'export-from', spec: node.source.value })
+    }
+  }
+  findCallSpecifiers(program, (s) => specs.push(s))
+  return specs
+}
+
+// Whether `entries` (absolute paths) import TS sources by their OUTPUT names -- tsc's convention,
+// which only --typescript resolves -- so the build can take --typescript as given: every entry is
+// TypeScript, they hold at least one relative import naming a JS output (`./a.js`, or .jsx/.mjs/
+// .cjs), and not one of those is on disk while the TS source it maps to is (`./a.ts`; see
+// typescriptSiblings), outside node_modules as the resolver requires. Any part missing is no tell, and neither is an entry that doesn't parse as
+// the scan parses it (Scan#parseFile; the scan reports it), nor one in node_modules, where
+// --typescript maps nothing. Read off the entries alone, before the scan.
+export function importsTypescriptByOutputName(entries, host = diskHost) {
+  if (!entries.every((entry) => TS_EXTS.has(extname(entry)) && !inNodeModules(entry, host))) return false
+  // Outside the try, as in the scan: a missing oxc-parser is an env error, not an entry's.
+  getParser()
+  const scanner = new Scan({ host })
+  const targets = []
+  for (const entry of entries) {
+    let result
+    try {
+      result = scanner.parseFile(entry)
+    } catch {
+      return false // unreadable: the scan reports it
+    }
+    if (result.crash !== undefined || result.errors.length > 0) return false
+    for (const { spec } of collectSpecifiers(result.parsed.program)) {
+      if (spec?.startsWith('./') || spec?.startsWith('../')) {
+        const target = resolvePath(dirname(entry), spec)
+        if (typescriptSiblings(target).length > 0) targets.push(target)
+      }
+    }
+  }
+  // tsc's pick, the first TS source on disk, as the resolver maps it: none where it lies in node_modules.
+  const isSource = (file) => !isTypeDeclaration(file) && (host.stat(file)?.isFile() ?? false)
+  const mapsTo = (target) => {
+    const pick = typescriptSiblings(target).find(isSource)
+    return pick !== undefined && !inNodeModules(pick, host)
+  }
+  return targets.length > 0 && targets.every((target) => host.stat(target) === null && mapsTo(target))
+}
+
 function condKey(set) {
   return [...set].join(', ')
 }
@@ -121,29 +184,47 @@ export class Scan {
   parseErrors = []
   entries = new Set()
 
-  // `conditions` is *additive* on top of the format-derived base set: ESM parents
-  // get ['node', 'import'] and CJS parents get ['node', 'require'], with any
-  // user-supplied conditions (e.g. 'browser', 'development') merged in. This
-  // matches what the runtime loader records when Node reports conditions for an
-  // edge -- different edges in the same scan can end up under different keys.
-  //
-  // `resolve` optionally replaces Node's own resolver with a custom one (the
-  // legacy-field resolver in resolve-fields.js drives `stasis bundle --mainFields`).
-  // It is called `(parentFile, specifier, conditions)` and returns
-  // `{ url } | { empty: true } | { builtin: true } | null` -- `empty` marks a
-  // browser/react-native `false` redirect (an empty-module stub the caller
-  // materialises), the rest mirror Node resolution. When set, it also handles
-  // builtins, so the built-in `isBuiltin` short-circuit is skipped.
-  constructor({ conditions = [], resolve = null } = {}) {
+  // `conditions` is additive on top of the edge-context base set. `resolve` optionally
+  // replaces Node's resolver (resolve-fields.js): returns `{ url } | { empty } | { builtin } | null`
+  // (`empty` = a browser/react-native `false` redirect) and owns builtin handling when set.
+  // `jsx` opts the .js/.cjs/.mjs family into JSX syntax (React Native's JSX-in-.js convention);
+  // off by default because oxc, like tsc, only auto-enables JSX for .jsx/.tsx by extension.
+  // `flow`: strip Flow type syntax from JS-family sources before parsing (see #scanFile).
+  // `typescript`: retry a failed resolution with tsc's mapping (see #typescriptResolve), with
+  // `typescriptPaths` (a tsconfig paths matcher; see resolveTypescriptFallback) adding tsconfig alias support; only consulted
+  // on the built-in (Node) resolver -- a custom `resolve` owns its own TS handling. Without it, the
+  // mapping only names the file a miss would resolve to under --typescript (see #typescriptCandidate).
+  // `typescriptResolve`: the custom `resolve`'s --typescript twin (same shape), consulted only for
+  // that hint; null when there is no custom resolver or `typescript` is on.
+  // `resources` (a `parseResourcesOption` Set of extensions/filenames): reached files matching it
+  // are carried as opaque resources (bytes only) rather than rejected as un-carryable -- for graphs
+  // that aren't fully loadable in JS (e.g. Metro consuming .png/.svg assets).
+  // `host`: the filesystem the walk reads and resolves through (@exodus/stasis-core/host).
+  constructor({ conditions = [], resolve = null, jsx = false, flow = false, typescript = false, typescriptPaths = null, typescriptResolve = null, resources = new Set(), host = diskHost } = {}) {
     this.extraConditions = [...conditions]
     this.customResolve = resolve
+    this.typescriptResolve = typescriptResolve
+    this.jsx = jsx
+    this.flow = flow
+    this.typescript = typescript
+    this.typescriptPaths = typescriptPaths
+    this.resources = resources
+    this.host = host
+  }
+
+  // A reached file whose extension/filename is in the --resources allowlist: carried as an opaque
+  // resource (bytes only, no parse, no edges), not rejected as "a source bundle can't carry".
+  // classifyExtension returns 'resource' only for non-code names in the allowlist, so this never
+  // shadows a script/json extension (parseResourcesOption rejects code extensions).
+  #isResource(file) {
+    return this.resources.size > 0 && classifyExtension(file, this.resources) === 'resource'
   }
 
   walk(entries) {
     const queue = []
     for (const entry of entries) {
       const abs = resolvePath(entry)
-      assert.ok(existsSync(abs), `entry not found: ${abs}`)
+      assert.ok(this.host.stat(abs) !== null, `entry not found: ${abs}`)
       const url = pathToFileURL(abs).toString()
       this.entries.add(url)
       queue.push(url)
@@ -156,137 +237,224 @@ export class Scan {
     return this
   }
 
-  // Match the runtime resolver's full condition set. Node 22 passes
-  // `['node', import|require, 'module-sync', 'node-addons']` to the resolve
-  // hook; if we omit any of these, a package whose `exports` map gates on the
-  // runtime-only conditions (e.g. `"module-sync": "./a.js", "import": "./b.js"`)
-  // resolves to a different file under static scan than under plain Node.
-  // Confirmed by reproducer with module-sync: plain node hits sync.js, static
-  // bundle loads with async.js -- silently runs different code.
-  #conditionsFor(format) {
-    const base = ['module', 'module-typescript'].includes(format)
-      ? ['node', 'import', 'module-sync', 'node-addons']
-      : ['node', 'require', 'module-sync', 'node-addons']
-    return new Set([...base, ...this.extraConditions])
+  // Node's resolver: must match the runtime resolver's condition set (omitting one resolves
+  // `exports`-gated packages to a different file) AND its order: the recorded key must equal the
+  // runtime hooks' string for exact lookups. Extras go where Node puts user conditions in each set.
+  // A custom resolver (--mainFields/--metro) resolves for a bundler instead, so it gets what
+  // esbuild, webpack and Metro all assert: `import`/`require`, `default` (which Node's resolver
+  // matches anyway) and the extras, never `node`, `node-addons` or `module-sync`; the same set as
+  // resolve-fields.js's resolveConditions.
+  #conditionSet(context) {
+    if (this.customResolve) return new Set([context, 'default', ...this.extraConditions])
+    return context === 'import'
+      ? new Set(['node', 'import', 'module-sync', 'node-addons', ...this.extraConditions])
+      : new Set(['require', 'node', 'node-addons', ...this.extraConditions, 'module-sync'])
   }
 
-  // `recovered: false` means the parser crashed on this file and nothing was
-  // salvaged -- its edges are entirely unknown. `recovered: true` means oxc
-  // returned, but we discarded its partial module records (module-family
-  // formats only; see #scanFile).
+  // `recovered`: false = parser crashed, nothing salvaged; true = oxc returned but we
+  // discarded its partial module records (module-family only; see #scanFile).
   #recordParseError(url, format, message, recovered) {
     this.files.set(url, { format, edges: [], parseError: message })
     this.parseErrors.push({ url, format, message, recovered })
   }
 
-  #scanFile(url, queue) {
-    const file = fileURLToPath(url)
-    const ext = extname(file)
-    if (ext === '.json') {
-      this.files.set(url, { format: 'json', edges: [] })
-      return
+  // --typescript: resolve `spec` the way tsc maps TS sources, invoked only AFTER Node's own
+  // resolution missed -- so an on-disk `.js` (or any Node-resolvable target) always wins, and the
+  // mapping only completes a failed resolution, never rewrites a successful one. The rules
+  // (extension substitution, extensionless/index completion, manifest-target and tsconfig-paths
+  // mapping) live in the shared dispatcher (resolve-typescript.js), so this resolver and the
+  // legacy-field one cannot drift. The hit is realpathed to match req.resolve's canonical output
+  // (every other recorded edge is a realpath).
+  #typescriptResolve(parentFile, spec, conditions) {
+    const hit = resolveTypescriptFallback(parentFile, spec, {
+      conditions,
+      paths: this.typescriptPaths,
+      host: this.host,
+    })
+    if (hit == null) return null
+    try {
+      return this.host.realpath(hit)
+    } catch {
+      return null
     }
-    if (!SCRIPT_EXTS.has(ext)) {
-      this.files.set(url, { format: null, edges: [] })
-      return
+  }
+
+  // The file: URL a miss would resolve to under --typescript, or null: a hint for the unresolved
+  // report only, never an edge. A custom resolver asks its --typescript twin; the built-in one
+  // tsc's mapping, as #typescriptResolve gives it under --typescript.
+  #typescriptCandidate(parentFile, spec, conditions) {
+    if (this.typescript) return null
+    if (this.customResolve) return this.typescriptResolve?.(parentFile, spec, conditions)?.url ?? null
+    const hit = this.#typescriptResolve(parentFile, spec, conditions)
+    return hit == null ? null : pathToFileURL(hit).toString()
+  }
+
+  // Strip Flow type syntax to plain JS via the optional flow-remove-types dep (resolved lazily; a
+  // missing dep is an env error and propagates). Only invoked as a parse fallback (see #scanFile),
+  // so plain-JS files never reach it. Returns the rewritten source, or null when the transform
+  // itself fails on this file -- the caller then keeps oxc's original parse error.
+  #stripFlow(src, file) {
+    const flowRemoveTypes = getFlowRemoveTypes()
+    try {
+      // `all: true` ignores the @flow/@noflow pragma (RN sources mix both); the transform blanks
+      // types with whitespace, so byte offsets and every import specifier are preserved.
+      return flowRemoveTypes(src, { all: true }).toString()
+    } catch (cause) {
+      console.warn(`[stasis] --flow: could not strip Flow types from ${file}; leaving it to oxc (${cause.message})`)
+      return null
     }
+  }
 
-    // declared === null: typeless package, where Node decides .js/.ts by
-    // module-syntax detection — that needs the parse, so resolve it below.
-    const declared = formatForFile(file)
-    const src = readFileSync(file, 'utf8')
+  // Parse `file` (a script extension) as Node loads it: under the format its name and package
+  // declare, or for a typeless .js/.ts the one Node detects from its syntax. -> { format, parsed,
+  // errors } (`errors`: what the parse still reports), or { declared, crash } where the parser
+  // itself threw on the file, salvaging nothing.
+  parseFile(file) {
+    const ext = extname(file)
+    // declared === null: typeless package; Node decides .js/.ts by syntax, resolved after parse.
+    const declared = formatForFile(file, this.host)
+    const src = this.host.readFile(file).toString('utf8')
 
-    // Resolve the parser outside the per-file try below: a missing oxc-parser is
-    // an environment error, not a property of this file, so it must not be
-    // swallowed into a silent zero-edge leaf.
+    // Resolve the parser outside the try: a missing oxc-parser is an env error, not this
+    // file's — it must not be swallowed into a silent zero-edge leaf.
     const parser = getParser()
+    // oxc picks JS/TS + JSX from the filename; the .js family lands on plain JS (no JSX), so
+    // force the JSX variant when opted in (`--jsx`) to parse React Native's JSX-in-.js source.
+    const lang = this.jsx && JSX_EXTS.has(ext) ? 'jsx' : undefined
+    const parseOptions = (sourceType) => (lang ? { sourceType, lang } : { sourceType })
+    // `commonjs`, not `script`: Node runs CJS inside its module wrapper function, where a top-level
+    // `return` or `new.target` is legal; oxc's `commonjs` accepts both and is otherwise `script`.
+    const baseSourceType = declared === null ? 'unambiguous'
+      : declared.startsWith('module') ? 'module' : 'commonjs'
     let parsed
     try {
-      parsed = parser.parseSync(file, src, {
-        sourceType: declared === null ? 'unambiguous'
-          : declared.startsWith('module') ? 'module' : 'script',
-      })
+      parsed = parser.parseSync(file, src, parseOptions(baseSourceType))
     } catch (cause) {
-      this.#recordParseError(url, declared, cause.message, false)
-      return
+      return { declared, crash: cause.message }
     }
 
-    // Match Node's module-syntax detection for typeless packages: ESM syntax
-    // (import/export/import.meta) selects the module variant. Recording the
-    // commonjs variant here would make `--bundle=load` feed the source to the
-    // wrong translator, which throws instead of reparsing as ESM the way
-    // Node's on-disk loader does.
-    let format = declared
-      ?? `${parsed.module.hasModuleSyntax ? 'module' : 'commonjs'}${ext === '.ts' ? '-typescript' : ''}`
-
-    // oxc-parser recovers from syntax errors instead of throwing: it reports
-    // them in `parsed.errors` and returns whatever AST/module records it could
-    // salvage. (Warning/advice-severity diagnostics don't imply a broken parse
-    // and are not errors.)
-    const nonWarning = (p) => (p.errors ?? []).filter((e) => e.severity !== 'Warning' && e.severity !== 'Advice')
-    let errors = nonWarning(parsed)
-
-    // Node's detector also counts top-level await as module syntax, which
-    // oxc's hasModuleSyntax does not flag: a typeless file whose ESM-ness
-    // rests on TLA alone parses here as a broken script while plain node runs
-    // it as a clean module. Mirror Node's parse-as-CJS-retry-as-ESM: when the
-    // detected-commonjs parse has errors but a module parse is clean, the
-    // module parse wins. Genuine CJS salvage cases (e.g. a top-level `return`
-    // guard) error under BOTH source types and stay on the script path.
+    // Match Node's syntax detection for typeless packages: ESM syntax picks the module variant
+    // (mislabeling as commonjs makes `--bundle=load` feed the wrong translator). Only .ts takes the
+    // `-typescript` suffix; .jsx/.tsx deliberately land on plain module/commonjs (like a JSX-in-.js
+    // file) — they're bundler-transformed, keyed by extension in `stasis build`, not Node-strippable,
+    // so the "needs a JSX/TS transform" signal rides the .jsx/.tsx extension, not the format tag.
+    const tsSuffix = ext === '.ts' ? '-typescript' : ''
+    const detectedFormat = (p) => `${p.module.hasModuleSyntax ? 'module' : 'commonjs'}${tsSuffix}`
+    let format = declared ?? detectedFormat(parsed)
+
+    // oxc recovers from syntax errors (reports them in parsed.errors) rather than throwing;
+    // Warning/Advice severities aren't real parse errors.
+    let errors = syntaxErrors(parsed)
+
+    // oxc's `unambiguous` mode counts top-level await as module syntax (since 0.109; before, a
+    // TLA-only ESM file parsed here as a broken script). Keep mirroring Node for any script parse
+    // that still fails: retry as module and prefer a clean module parse.
     if (errors.length > 0 && declared === null && !format.startsWith('module')) {
       try {
-        const asModule = parser.parseSync(file, src, { sourceType: 'module' })
-        if (nonWarning(asModule).length === 0) {
+        const asModule = parser.parseSync(file, src, parseOptions('module'))
+        if (syntaxErrors(asModule).length === 0) {
           parsed = asModule
-          format = `module${ext === '.ts' ? '-typescript' : ''}`
+          format = `module${tsSuffix}`
           errors = []
         }
       } catch { /* keep the script parse and its recorded errors */ }
     }
 
+    // A typeless file Node detects as CJS runs inside the module wrapper too, but `unambiguous`
+    // parses it as a plain script, so a top-level `return` still fails there: retry as `commonjs`
+    // and prefer a clean parse (the detected commonjs format stands).
+    if (errors.length > 0 && declared === null && !format.startsWith('module')) {
+      try {
+        const asCommonjs = parser.parseSync(file, src, parseOptions('commonjs'))
+        if (syntaxErrors(asCommonjs).length === 0) {
+          parsed = asCommonjs
+          errors = []
+        }
+      } catch { /* keep the script parse and its recorded errors */ }
+    }
+
+    // --flow: oxc parses JS/TS but not Flow, so a Flow-typed .js/.cjs/.mjs file lands here with
+    // parse errors. Only now -- after a raw oxc parse actually failed -- strip Flow types and
+    // re-parse, so plain-JS files never pay the transform cost. Only the parse input is rewritten;
+    // the bundle stores the pristine on-disk source (State/buildResolvedJsBundle re-read it), so
+    // attestation still covers the real bytes. A clean re-parse replaces the errored one; otherwise
+    // we keep the original result so a genuine (non-Flow) parse error still surfaces.
+    if (errors.length > 0 && this.flow && FLOW_EXTS.has(ext)) {
+      const flowSrc = this.#stripFlow(src, file)
+      if (flowSrc !== null) {
+        try {
+          const asFlow = parser.parseSync(file, flowSrc, parseOptions(baseSourceType))
+          if (syntaxErrors(asFlow).length === 0) {
+            parsed = asFlow
+            format = declared ?? detectedFormat(parsed)
+            errors = []
+          }
+        } catch { /* keep the original parse + its errors */ }
+      }
+    }
+
+    return { format, parsed, errors }
+  }
+
+  #scanFile(url, queue) {
+    const file = fileURLToPath(url)
+    const ext = extname(file)
+    if (ext === '.json') {
+      this.files.set(url, { format: 'json', edges: [] })
+      return
+    }
+    if (this.#isResource(file)) {
+      // Allowlisted asset: carry it as a resource with no parse and no edges. `resource: true` is
+      // the authoritative signal (both bundle builders key off it); the concrete format
+      // (resource vs resource:base64) is byte-derived by the builder, so leave it unset here.
+      this.files.set(url, { format: null, edges: [], resource: true })
+      return
+    }
+    if (!SCRIPT_EXTS.has(ext)) {
+      this.files.set(url, { format: null, edges: [] })
+      return
+    }
+
+    const result = this.parseFile(file)
+    if (result.crash !== undefined) {
+      this.#recordParseError(url, result.declared, result.crash, false)
+      return
+    }
+    const { format, parsed, errors } = result
+
     let parseError
     if (errors.length > 0) {
       parseError = errors.map((e) => e.message).join('; ')
-      // A partially-parsed module file may be missing static link-time edges
-      // -- holes we can't enumerate -- so don't pretend we know its imports.
+      // A partially-parsed module file may be missing link-time edges we can't enumerate.
       if (format.startsWith('module')) {
         this.#recordParseError(url, format, parseError, true)
         return
       }
-      // Script (CJS) files: Node's module wrapper accepts code oxc rejects
-      // (e.g. a top-level `return` guard), and oxc's recovered AST keeps the
-      // require()/import() calls -- salvage the edges, record the error, and
-      // let callers decide how loud to be.
+      // Script (CJS) files: oxc's recovered AST still yields the require()/import() edges — salvage them.
       this.parseErrors.push({ url, format, message: parseError, recovered: true })
     }
 
-    const specs = []
-    // ESM static imports + re-exports come from oxc's pre-extracted module info.
-    // Type-only edges (`import type ... from`, `export type ... from`) are
-    // erased before runtime and never loaded by Node; skip them so the bundle
-    // matches Node's actual load graph. A mixed `import { type A, B }` still
-    // loads, and bare side-effect imports have no entries — both are kept.
-    if (parsed.module?.staticImports) {
-      for (const imp of parsed.module.staticImports) {
-        if (imp.entries.length > 0 && imp.entries.every((e) => e.isType)) continue
-        specs.push({ kind: 'import', spec: imp.moduleRequest.value })
-      }
-    }
-    if (parsed.module?.staticExports) {
-      for (const exp of parsed.module.staticExports) {
-        for (const entry of exp.entries) {
-          if (entry.moduleRequest && !entry.isType) specs.push({ kind: 'export-from', spec: entry.moduleRequest.value })
-        }
-      }
-    }
-    // require() and dynamic import() come from the AST.
-    findCallSpecifiers(parsed.program, (s) => specs.push(s))
+    const specs = collectSpecifiers(parsed.program)
 
-    const conditions = this.#conditionsFor(format)
-    const key = condKey(conditions)
-    const req = createRequire(file)
+    // The edge KIND picks the resolution context, not the parent's format: createRequire()d
+    // require() inside ESM resolves under REQUIRE conditions, literal import() inside CJS under
+    // IMPORT conditions -- the parent-format set baked the wrong `exports` branch into the bundle.
+    // The custom (legacy-field) resolver keeps the format set: bundlers don't split per edge.
+    const formatContext = ['module', 'module-typescript'].includes(format) ? 'import' : 'require'
     const edges = []
-    const specMap = new Map()
+    const specMaps = new Map() // condition key -> specifier -> child URL
+    const addChild = (s, key, childURL, childPath) => {
+      edges.push({ ...s, child: childURL })
+      if (!specMaps.has(key)) specMaps.set(key, new Map())
+      specMaps.get(key).set(s.spec, childURL)
+      if (RESOLVABLE_EXTS.has(extname(childPath)) || this.#isResource(childPath)) queue.push(childURL)
+    }
+    // Records the file --typescript would land the miss on too (typescriptURL), resolved as the miss was.
+    const addUnresolved = (s, reason, conditions) => {
+      edges.push({ ...s, error: reason })
+      const typescriptURL = this.#typescriptCandidate(file, s.spec, conditions)
+      this.unresolved.push({ parentURL: url, kind: s.kind, spec: s.spec, reason, ...(typescriptURL ? { typescriptURL } : {}) })
+    }
 
     for (const s of specs) {
       if (s.dynamic) {
@@ -294,10 +462,11 @@ export class Scan {
         this.unresolved.push({ parentURL: url, kind: s.kind, reason: 'dynamic' })
         continue
       }
-      // Custom (legacy-field) resolver: it owns builtin handling and adds the
-      // `empty` outcome (a browser/react-native `false` redirect). An empty edge
-      // is recorded but neither queued (an empty module has no edges) nor counted
-      // as unresolved (it resolved -- to nothing).
+      const context = this.customResolve ? formatContext : (s.kind === 'require' ? 'require' : 'import')
+      const conditions = this.#conditionSet(context)
+      const key = condKey(conditions)
+      // Custom (legacy-field) resolver owns builtin handling and the `empty` outcome (browser/RN
+      // `false` redirect): an empty edge is recorded but neither queued nor counted as unresolved.
       if (this.customResolve) {
         const r = this.customResolve(file, s.spec, conditions)
         if (r?.builtin) {
@@ -305,12 +474,9 @@ export class Scan {
         } else if (r?.empty) {
           edges.push({ ...s, empty: true })
         } else if (r?.url) {
-          edges.push({ ...s, child: r.url })
-          specMap.set(s.spec, r.url)
-          if (RESOLVABLE_EXTS.has(extname(fileURLToPath(r.url)))) queue.push(r.url)
+          addChild(s, key, r.url, fileURLToPath(r.url))
         } else {
-          edges.push({ ...s, error: 'MODULE_NOT_FOUND' })
-          this.unresolved.push({ parentURL: url, kind: s.kind, spec: s.spec, reason: 'MODULE_NOT_FOUND' })
+          addUnresolved(s, 'MODULE_NOT_FOUND', conditions)
         }
         continue
       }
@@ -318,20 +484,22 @@ export class Scan {
         edges.push({ ...s, builtin: true })
         continue
       }
+      let childPath
       try {
-        const childPath = req.resolve(s.spec, { conditions })
-        const childURL = pathToFileURL(childPath).toString()
-        edges.push({ ...s, child: childURL })
-        specMap.set(s.spec, childURL)
-        const childExt = extname(childPath)
-        if (RESOLVABLE_EXTS.has(childExt)) queue.push(childURL)
+        childPath = this.host.resolve(file, s.spec, conditions)
       } catch (cause) {
-        edges.push({ ...s, error: cause.code ?? cause.message })
-        this.unresolved.push({ parentURL: url, kind: s.kind, spec: s.spec, reason: cause.code ?? cause.message })
+        // --typescript: complete the miss with tsc's mapping (see #typescriptResolve); the edge
+        // stays keyed by the ORIGINAL specifier -- only the target is the mapped file.
+        if (this.typescript) childPath = this.#typescriptResolve(file, s.spec, conditions)
+        if (childPath == null) {
+          addUnresolved(s, cause.code ?? cause.message, conditions)
+          continue
+        }
       }
+      addChild(s, key, pathToFileURL(childPath).toString(), childPath)
     }
 
-    if (specMap.size > 0) {
+    for (const [key, specMap] of specMaps) {
       if (!this.imports.has(key)) this.imports.set(key, new Map())
       this.imports.get(key).set(url, specMap)
     }
@@ -342,7 +510,7 @@ export class Scan {
     const rel = (url) => {
       const abs = fileURLToPath(url)
       const r = relative(root, abs)
-      if (r.startsWith('..')) throw new Error(`Path outside root: ${abs}`)
+      if (relativeEscapes(r)) throw new Error(`Path outside root: ${abs}`)
       return r
     }
     const relEdge = (e) => (e.child ? { ...e, child: rel(e.child) } : e)
@@ -362,7 +530,7 @@ export class Scan {
           ),
         ])
       ),
-      unresolved: this.unresolved.map(({ parentURL, ...rest }) => ({ parent: rel(parentURL), ...rest })),
+      unresolved: this.unresolved.map(({ parentURL, typescriptURL, ...rest }) => ({ parent: rel(parentURL), ...rest, ...(typescriptURL ? { typescript: rel(typescriptURL) } : {}) })),
       parseErrors: this.parseErrors.map(({ url, ...rest }) => ({ file: rel(url), ...rest })),
     }
   }