@exodus/stasis 1.0.0-beta.3 → 1.0.0-beta.6

package/src/sbom.js

@@ -1,4 +1,4 @@
-import semver from './apis/npm/semver.cjs'
+import { compareVersions, valid } from '@preventive/upstream/semver.js'
 import pkg from '../package.json' with { type: 'json' }
 
 // Derive an SPDX 2.3 or CycloneDX 1.5 SBOM from already-parsed stasis artifacts (`Bundle`/`Lockfile`).
@@ -10,7 +10,9 @@ const DEFAULT_TOOL = { name: '@exodus/stasis', version: pkg.version, vendor: 'Ex
 // Web Crypto (global) instead of node:crypto, keeping this module dependency-light.
 const newUuid = () => globalThis.crypto.randomUUID()
 
-// purl types we can mint; an ecosystem with no registered type (`soldeer`) gets no purl rather than a fabricated one.
+// purl types we can mint; an ecosystem with no registered type (`soldeer`) gets no purl rather than a fabricated one,
+// and so does a crate vendored from git or from a source not known (`cargo-git`, `cargo-unknown`): `pkg:cargo` names
+// crates.io's crate of that name, which it may not be.
 const PURL_TYPES = new Set(['npm', 'composer', 'cargo', 'github'])
 
 // Infer an artifact's ecosystem from its loader formats: PHP bundles map to Composer, everything
@@ -27,11 +29,12 @@ function detectEcosystem(artifact) {
 }
 
 // Legacy scope classification (pre-`ecosystem` artifacts): non-`node_modules` dirs are first-party,
-// except in a Composer bundle where vendor packages live outside `node_modules`.
+// except in a Composer bundle where vendor packages live outside `node_modules`. `node_modules` is
+// a path segment, as stasis-core's hasNodeModulesSegment has it: `foo_node_modules/x` is first-party.
 function classifyScope(ecosystem, dir) {
   if (dir === '.') return 'workspace'
   if (ecosystem === 'composer') return 'dependency'
-  return dir.includes('node_modules') ? 'dependency' : 'workspace'
+  return dir.split('/').includes('node_modules') ? 'dependency' : 'workspace'
 }
 
 // Split a package name into purl/CycloneDX namespace (group) + bare name: npm scopes, Composer
@@ -49,6 +52,8 @@ function splitName(ecosystem, name) {
 // Build a Package URL (purl) for a known ecosystem, or null when it has no purl type. Each path
 // segment is percent-encoded (npm scope's `@` -> `%40`) while the `/` namespace separator and the
 // `@` before the version stay literal; Composer and GitHub names are lowercased, per the purl spec.
+// The version qualifier is optional in the purl spec, so a versionless workspace package mints a
+// bare-name purl rather than a fabricated version.
 export function buildPurl(ecosystem, rawName, version) {
   if (!PURL_TYPES.has(ecosystem)) return null
   let { group, name } = splitName(ecosystem, rawName)
@@ -57,23 +62,29 @@ export function buildPurl(ecosystem, rawName, version) {
     name = name.toLowerCase()
   }
   const namespace = group ? `${encodeURIComponent(group)}/` : ''
-  return `pkg:${ecosystem}/${namespace}${encodeURIComponent(name)}@${encodeURIComponent(version)}`
+  const at = version == null ? '' : `@${encodeURIComponent(version)}`
+  return `pkg:${ecosystem}/${namespace}${encodeURIComponent(name)}${at}`
 }
 
 function compareComponents(a, b) {
   if (a.name !== b.name) return a.name < b.name ? -1 : 1
-  if (a.version !== b.version) {
-    if (semver.valid(a.version) && semver.valid(b.version)) return semver.compare(a.version, b.version)
-    return a.version < b.version ? -1 : 1
+  // A missing version sorts first, as '' (comparing raw undefined would be order-unstable).
+  const [av, bv] = [a.version ?? '', b.version ?? '']
+  if (av !== bv) {
+    if (valid(av) && valid(bv)) return compareVersions(av, bv)
+    return av < bv ? -1 : 1
   }
   return a.ecosystem < b.ecosystem ? -1 : a.ecosystem > b.ecosystem ? 1 : 0
 }
 
 // Collect the deduplicated, sorted set of packages across parsed artifacts. Unlike `stasis audit`
 // (installed deps only), an SBOM is the *full* bill of materials, so workspace/first-party packages
-// are included too, tagged scope 'workspace' vs 'dependency'. Buckets without a name+version are
-// skipped. Dedup is by ecosystem+name+version; a package seen as workspace in any artifact stays
-// workspace regardless of argument order, so output doesn't depend on how artifacts are listed.
+// are included too, tagged scope 'workspace' vs 'dependency'. Buckets without a name are skipped,
+// and so are DEPENDENCY buckets without a version (v0 partial metadata: unverifiable identity) --
+// but a workspace package may legitimately omit version (private/unpublished) and is kept, since
+// dropping it would silently lose the document's own first-party subject. Dedup is by
+// ecosystem+name+version; a package seen as workspace in any artifact stays workspace regardless
+// of argument order, so output doesn't depend on how artifacts are listed.
 export function collectComponents(artifacts) {
   const seen = new Map()
   for (const artifact of artifacts) {
@@ -83,7 +94,7 @@ export function collectComponents(artifacts) {
     const tagged = records.some(([, m]) => m.ecosystem !== undefined)
     const fileEcosystem = detectEcosystem(artifact)
     for (const [dir, { name, version, ecosystem }] of records) {
-      if (!name || !version) continue
+      if (!name) continue
       let scope, eco
       if (ecosystem !== undefined) {
         scope = 'dependency'
@@ -96,13 +107,14 @@ export function collectComponents(artifacts) {
         scope = classifyScope(fileEcosystem, dir)
         eco = fileEcosystem
       }
-      const key = `${eco} ${name} ${version}`
+      if (!version && scope !== 'workspace') continue
+      const key = `${eco} ${name} ${version ?? ''}`
       const existing = seen.get(key)
       if (existing) {
         if (scope === 'workspace') existing.scope = 'workspace'
         continue
       }
-      seen.set(key, { name, version, scope, ecosystem: eco, purl: buildPurl(eco, name, version) })
+      seen.set(key, { name, version: version ?? undefined, scope, ecosystem: eco, purl: buildPurl(eco, name, version) })
     }
   }
   return [...seen.values()].toSorted(compareComponents)
@@ -121,8 +133,8 @@ function selectPrimary(components) {
 const isoSeconds = (date) => date.toISOString().replace(/\.\d{3}Z$/u, 'Z')
 
 // A CycloneDX bom-ref must uniquely identify a component; use the purl when present, else
-// ecosystem+name+version (unique by construction -- it's the dedup key).
-const bomRef = (c) => c.purl ?? `${c.ecosystem}:${c.name}@${c.version}`
+// ecosystem+name(+version) (unique by construction -- it's the dedup key).
+const bomRef = (c) => c.purl ?? `${c.ecosystem}:${c.name}${c.version == null ? '' : `@${c.version}`}`
 
 // Render an SPDX 2.3 document. It DESCRIBES its primary component, which DEPENDS_ON each installed
 // dependency (flat graph). With no single primary, the document DESCRIBES the workspace packages,
@@ -135,7 +147,8 @@ export function toSpdx(components, { tool = DEFAULT_TOOL, now = new Date(), uuid
   const packages = ordered.map((c) => ({
     SPDXID: ids.get(c),
     name: c.name,
-    versionInfo: c.version,
+    // SPDX versionInfo is optional; omit it for a versionless workspace package.
+    ...(c.version == null ? {} : { versionInfo: c.version }),
     downloadLocation: 'NOASSERTION',
     filesAnalyzed: false,
     ...(c.purl && {
@@ -159,7 +172,9 @@ export function toSpdx(components, { tool = DEFAULT_TOOL, now = new Date(), uuid
     }
   }
 
-  const docName = primary ? `${primary.name}@${primary.version}` : 'stasis-sbom'
+  const docName = primary
+    ? (primary.version == null ? primary.name : `${primary.name}@${primary.version}`)
+    : 'stasis-sbom'
   return {
     spdxVersion: 'SPDX-2.3',
     dataLicense: 'CC0-1.0',
@@ -186,7 +201,8 @@ export function toCyclonedx(components, { tool = DEFAULT_TOOL, now = new Date(),
       'bom-ref': bomRef(c),
       ...(group && { group }),
       name,
-      version: c.version,
+      // CycloneDX 1.5 `version` is optional; omit it for a versionless workspace package.
+      ...(c.version == null ? {} : { version: c.version }),
       ...(c.purl && { purl: c.purl }),
     }
   }

package/src/scan.js

@@ -1,35 +1,34 @@
-import { readFileSync, existsSync } from 'node:fs'
-import { extname, resolve as resolvePath, relative } from 'node:path'
+import { dirname, extname, resolve as resolvePath, relative } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 import { createRequire, isBuiltin } from 'node:module'
 import assert from 'node:assert/strict'
 import { packageType } from '@exodus/stasis-core/bundle-util'
-import { classifyExtension, classifyFormat } from '@exodus/stasis-core/util'
+import { classifyExtension, classifyFormat, isTypeDeclaration, relativeEscapes } from '@exodus/stasis-core/util'
+import { inNodeModules, resolveTypescriptFallback, typescriptSiblings } from './resolve-typescript.js'
+import { diskHost } from '@exodus/stasis-core/host'
 
 // Static require/import graph walker: parses source, never loads or executes user code.
 // Dynamic specifiers (`require(name)`, `import('./'+x)`) are recorded as unresolved.
 
-const SCRIPT_EXTS = new Set(['.js', '.cjs', '.mjs', '.ts', '.cts', '.mts'])
+// .jsx/.tsx need no flag: oxc parses them as JSX/TSX purely from the filename, so a reached one
+// -- e.g. a package whose React Native entry is src/index.tsx -- is parsed and carried like any .ts.
+const SCRIPT_EXTS = new Set(['.js', '.cjs', '.mjs', '.ts', '.cts', '.mts', '.jsx', '.tsx'])
 const RESOLVABLE_EXTS = new Set([...SCRIPT_EXTS, '.json'])
-// Under `jsx`, these get parsed with JSX enabled. Excludes the .ts family: TypeScript's `<T>`
+// The extensions whose name can't tell whether they hold JSX, parsed with JSX enabled only under
+// `jsx` (React Native's JSX-in-.js convention). Excludes the .ts family: TypeScript's `<T>`
 // generics collide with JSX, so tsc/oxc reserve JSX for .tsx — JSX-in-TS belongs in a .tsx file.
 const JSX_EXTS = new Set(['.js', '.cjs', '.mjs'])
-// The inherently-JSX extensions (oxc parses them as JSX/TSX purely from the filename, no flag).
-// Scanned + carried only under `--jsx`: off by default the scanner treats them as opaque leaves,
-// so a bundle whose toolchain can't build JSX never silently ships .jsx/.tsx source. Under `--jsx`
-// they join SCRIPT_EXTS/RESOLVABLE_EXTS (see the constructor) so a reached .jsx/.tsx dependency
-// — e.g. a package whose React Native entry is src/index.tsx — is parsed and carried like any .ts.
-const JSX_FILE_EXTS = new Set(['.jsx', '.tsx'])
 
 // Flow type syntax lives in the JS (non-TS) family; oxc parses TS natively, and running
 // flow-remove-types over a .ts/.tsx file would corrupt TS-only constructs, so --flow only strips
 // these. .jsx is included (it's JS + JSX, and can carry Flow types like .js); .tsx is not (it's
 // TypeScript). flow-remove-types preserves JSX, so a stripped .jsx re-parses under lang:jsx.
 const FLOW_EXTS = new Set(['.js', '.cjs', '.mjs', '.jsx'])
+const TS_EXTS = new Set(['.ts', '.cts', '.mts', '.tsx'])
 
 // Required lazily so non-JS bundlers don't load the native oxc parser.
 let _parser
-function getParser() {
+export function getParser() {
   _parser ??= createRequire(import.meta.url)('oxc-parser')
   return _parser
 }
@@ -54,15 +53,18 @@ function getFlowRemoveTypes() {
 // classifyFormat is the shared name->format authority (static and runtime bundles must agree); it
 // returns null for the .js/.ts family whose module system comes from package.json `type` (null =
 // detect from syntax, signaled up as null).
-function formatForFile(file) {
+function formatForFile(file, host) {
   const format = classifyFormat(file)
   if (format != null) return format
-  const type = packageType(file)
+  const type = packageType(file, host)
   if (type === null) return null
   return `${type}${extname(file) === '.ts' ? '-typescript' : ''}`
 }
 
-function literalSpec(node) {
+// The errors oxc reports for a parse, but its warnings and advice.
+export const syntaxErrors = (parsed) => (parsed.errors ?? []).filter((e) => e.severity !== 'Warning' && e.severity !== 'Advice')
+
+export function literalSpec(node) {
   if (!node) return null
   if (node.type === 'Literal' && typeof node.value === 'string') return node.value
   if (node.type === 'TemplateLiteral' && node.expressions.length === 0 && node.quasis.length === 1) {
@@ -110,6 +112,67 @@ function findCallSpecifiers(ast, push) {
   visit(ast)
 }
 
+// The import specifiers `program` holds, as { kind, spec } ({ kind, dynamic: true } for a computed
+// one). STATEMENT-level type-ness decides an edge, matching what survives type erasure at runtime
+// (verbatimModuleSyntax / Node's own type stripping): an `import type` / `export type` statement is
+// erased whole, so no edge; a statement that merely lists inline `type` specifiers
+// (`import { type A }`, `export { type B } from`) -- or none at all (`import {}`, `export {} from`)
+// -- still loads its module, so its edge is real. oxc's module records can't draw that line
+// (`import type { A }` and `import { type A }` yield identical all-isType entries, and
+// `export {} from` yields no entry at all), so the statements are read off the AST, where
+// importKind/exportKind carry it.
+function collectSpecifiers(program) {
+  const specs = []
+  for (const node of program.body) {
+    if (node.type === 'ImportDeclaration') {
+      if (node.importKind !== 'type') specs.push({ kind: 'import', spec: node.source.value })
+    } else if (node.type === 'ExportNamedDeclaration') {
+      if (node.source != null && node.exportKind !== 'type') specs.push({ kind: 'export-from', spec: node.source.value })
+    } else if (node.type === 'ExportAllDeclaration') {
+      if (node.exportKind !== 'type') specs.push({ kind: 'export-from', spec: node.source.value })
+    }
+  }
+  findCallSpecifiers(program, (s) => specs.push(s))
+  return specs
+}
+
+// Whether `entries` (absolute paths) import TS sources by their OUTPUT names -- tsc's convention,
+// which only --typescript resolves -- so the build can take --typescript as given: every entry is
+// TypeScript, they hold at least one relative import naming a JS output (`./a.js`, or .jsx/.mjs/
+// .cjs), and not one of those is on disk while the TS source it maps to is (`./a.ts`; see
+// typescriptSiblings), outside node_modules as the resolver requires. Any part missing is no tell, and neither is an entry that doesn't parse as
+// the scan parses it (Scan#parseFile; the scan reports it), nor one in node_modules, where
+// --typescript maps nothing. Read off the entries alone, before the scan.
+export function importsTypescriptByOutputName(entries, host = diskHost) {
+  if (!entries.every((entry) => TS_EXTS.has(extname(entry)) && !inNodeModules(entry, host))) return false
+  // Outside the try, as in the scan: a missing oxc-parser is an env error, not an entry's.
+  getParser()
+  const scanner = new Scan({ host })
+  const targets = []
+  for (const entry of entries) {
+    let result
+    try {
+      result = scanner.parseFile(entry)
+    } catch {
+      return false // unreadable: the scan reports it
+    }
+    if (result.crash !== undefined || result.errors.length > 0) return false
+    for (const { spec } of collectSpecifiers(result.parsed.program)) {
+      if (spec?.startsWith('./') || spec?.startsWith('../')) {
+        const target = resolvePath(dirname(entry), spec)
+        if (typescriptSiblings(target).length > 0) targets.push(target)
+      }
+    }
+  }
+  // tsc's pick, the first TS source on disk, as the resolver maps it: none where it lies in node_modules.
+  const isSource = (file) => !isTypeDeclaration(file) && (host.stat(file)?.isFile() ?? false)
+  const mapsTo = (target) => {
+    const pick = typescriptSiblings(target).find(isSource)
+    return pick !== undefined && !inNodeModules(pick, host)
+  }
+  return targets.length > 0 && targets.every((target) => host.stat(target) === null && mapsTo(target))
+}
+
 function condKey(set) {
   return [...set].join(', ')
 }
@@ -127,19 +190,26 @@ export class Scan {
   // `jsx` opts the .js/.cjs/.mjs family into JSX syntax (React Native's JSX-in-.js convention);
   // off by default because oxc, like tsc, only auto-enables JSX for .jsx/.tsx by extension.
   // `flow`: strip Flow type syntax from JS-family sources before parsing (see #scanFile).
+  // `typescript`: retry a failed resolution with tsc's mapping (see #typescriptResolve), with
+  // `typescriptPaths` (a tsconfig paths matcher; see resolveTypescriptFallback) adding tsconfig alias support; only consulted
+  // on the built-in (Node) resolver -- a custom `resolve` owns its own TS handling. Without it, the
+  // mapping only names the file a miss would resolve to under --typescript (see #typescriptCandidate).
+  // `typescriptResolve`: the custom `resolve`'s --typescript twin (same shape), consulted only for
+  // that hint; null when there is no custom resolver or `typescript` is on.
   // `resources` (a `parseResourcesOption` Set of extensions/filenames): reached files matching it
   // are carried as opaque resources (bytes only) rather than rejected as un-carryable -- for graphs
   // that aren't fully loadable in JS (e.g. Metro consuming .png/.svg assets).
-  constructor({ conditions = [], resolve = null, jsx = false, flow = false, resources = new Set() } = {}) {
+  // `host`: the filesystem the walk reads and resolves through (@exodus/stasis-core/host).
+  constructor({ conditions = [], resolve = null, jsx = false, flow = false, typescript = false, typescriptPaths = null, typescriptResolve = null, resources = new Set(), host = diskHost } = {}) {
     this.extraConditions = [...conditions]
     this.customResolve = resolve
+    this.typescriptResolve = typescriptResolve
     this.jsx = jsx
     this.flow = flow
+    this.typescript = typescript
+    this.typescriptPaths = typescriptPaths
     this.resources = resources
-    // --jsx widens the script/resolvable extension sets to include .jsx/.tsx, so those files are
-    // parsed (not left as opaque leaves) and queued when reached. Off by default the base sets apply.
-    this.scriptExts = jsx ? new Set([...SCRIPT_EXTS, ...JSX_FILE_EXTS]) : SCRIPT_EXTS
-    this.resolvableExts = jsx ? new Set([...RESOLVABLE_EXTS, ...JSX_FILE_EXTS]) : RESOLVABLE_EXTS
+    this.host = host
   }
 
   // A reached file whose extension/filename is in the --resources allowlist: carried as an opaque
@@ -154,7 +224,7 @@ export class Scan {
     const queue = []
     for (const entry of entries) {
       const abs = resolvePath(entry)
-      assert.ok(existsSync(abs), `entry not found: ${abs}`)
+      assert.ok(this.host.stat(abs) !== null, `entry not found: ${abs}`)
       const url = pathToFileURL(abs).toString()
       this.entries.add(url)
       queue.push(url)
@@ -183,6 +253,37 @@ export class Scan {
     this.parseErrors.push({ url, format, message, recovered })
   }
 
+  // --typescript: resolve `spec` the way tsc maps TS sources, invoked only AFTER Node's own
+  // resolution missed -- so an on-disk `.js` (or any Node-resolvable target) always wins, and the
+  // mapping only completes a failed resolution, never rewrites a successful one. The rules
+  // (extension substitution, extensionless/index completion, manifest-target and tsconfig-paths
+  // mapping) live in the shared dispatcher (resolve-typescript.js), so this resolver and the
+  // legacy-field one cannot drift. The hit is realpathed to match req.resolve's canonical output
+  // (every other recorded edge is a realpath).
+  #typescriptResolve(parentFile, spec, conditions) {
+    const hit = resolveTypescriptFallback(parentFile, spec, {
+      conditions,
+      paths: this.typescriptPaths,
+      host: this.host,
+    })
+    if (hit == null) return null
+    try {
+      return this.host.realpath(hit)
+    } catch {
+      return null
+    }
+  }
+
+  // The file: URL a miss would resolve to under --typescript, or null: a hint for the unresolved
+  // report only, never an edge. A custom resolver asks its --typescript twin; the built-in one
+  // tsc's mapping, as #typescriptResolve gives it under --typescript.
+  #typescriptCandidate(parentFile, spec, conditions) {
+    if (this.typescript) return null
+    if (this.customResolve) return this.typescriptResolve?.(parentFile, spec, conditions)?.url ?? null
+    const hit = this.#typescriptResolve(parentFile, spec, conditions)
+    return hit == null ? null : pathToFileURL(hit).toString()
+  }
+
   // Strip Flow type syntax to plain JS via the optional flow-remove-types dep (resolved lazily; a
   // missing dep is an env error and propagates). Only invoked as a parse fallback (see #scanFile),
   // so plain-JS files never reach it. Returns the rewritten source, or null when the transform
@@ -199,28 +300,15 @@ export class Scan {
     }
   }
 
-  #scanFile(url, queue) {
-    const file = fileURLToPath(url)
+  // Parse `file` (a script extension) as Node loads it: under the format its name and package
+  // declare, or for a typeless .js/.ts the one Node detects from its syntax. -> { format, parsed,
+  // errors } (`errors`: what the parse still reports), or { declared, crash } where the parser
+  // itself threw on the file, salvaging nothing.
+  parseFile(file) {
     const ext = extname(file)
-    if (ext === '.json') {
-      this.files.set(url, { format: 'json', edges: [] })
-      return
-    }
-    if (this.#isResource(file)) {
-      // Allowlisted asset: carry it as a resource with no parse and no edges. `resource: true` is
-      // the authoritative signal (both bundle builders key off it); the concrete format
-      // (resource vs resource:base64) is byte-derived by the builder, so leave it unset here.
-      this.files.set(url, { format: null, edges: [], resource: true })
-      return
-    }
-    if (!this.scriptExts.has(ext)) {
-      this.files.set(url, { format: null, edges: [] })
-      return
-    }
-
     // declared === null: typeless package; Node decides .js/.ts by syntax, resolved after parse.
-    const declared = formatForFile(file)
-    const src = readFileSync(file, 'utf8')
+    const declared = formatForFile(file, this.host)
+    const src = this.host.readFile(file).toString('utf8')
 
     // Resolve the parser outside the try: a missing oxc-parser is an env error, not this
     // file's — it must not be swallowed into a silent zero-edge leaf.
@@ -229,14 +317,15 @@ export class Scan {
     // force the JSX variant when opted in (`--jsx`) to parse React Native's JSX-in-.js source.
     const lang = this.jsx && JSX_EXTS.has(ext) ? 'jsx' : undefined
     const parseOptions = (sourceType) => (lang ? { sourceType, lang } : { sourceType })
+    // `commonjs`, not `script`: Node runs CJS inside its module wrapper function, where a top-level
+    // `return` or `new.target` is legal; oxc's `commonjs` accepts both and is otherwise `script`.
     const baseSourceType = declared === null ? 'unambiguous'
-      : declared.startsWith('module') ? 'module' : 'script'
+      : declared.startsWith('module') ? 'module' : 'commonjs'
     let parsed
     try {
       parsed = parser.parseSync(file, src, parseOptions(baseSourceType))
     } catch (cause) {
-      this.#recordParseError(url, declared, cause.message, false)
-      return
+      return { declared, crash: cause.message }
     }
 
     // Match Node's syntax detection for typeless packages: ESM syntax picks the module variant
@@ -244,22 +333,36 @@ export class Scan {
     // `-typescript` suffix; .jsx/.tsx deliberately land on plain module/commonjs (like a JSX-in-.js
     // file) — they're bundler-transformed, keyed by extension in `stasis build`, not Node-strippable,
     // so the "needs a JSX/TS transform" signal rides the .jsx/.tsx extension, not the format tag.
-    let format = declared
-      ?? `${parsed.module.hasModuleSyntax ? 'module' : 'commonjs'}${ext === '.ts' ? '-typescript' : ''}`
+    const tsSuffix = ext === '.ts' ? '-typescript' : ''
+    const detectedFormat = (p) => `${p.module.hasModuleSyntax ? 'module' : 'commonjs'}${tsSuffix}`
+    let format = declared ?? detectedFormat(parsed)
 
     // oxc recovers from syntax errors (reports them in parsed.errors) rather than throwing;
     // Warning/Advice severities aren't real parse errors.
-    const nonWarning = (p) => (p.errors ?? []).filter((e) => e.severity !== 'Warning' && e.severity !== 'Advice')
-    let errors = nonWarning(parsed)
+    let errors = syntaxErrors(parsed)
 
-    // oxc's hasModuleSyntax misses top-level await, so a TLA-only ESM file parses here as a
-    // broken script; mirror Node by retrying as module and preferring a clean module parse.
+    // oxc's `unambiguous` mode counts top-level await as module syntax (since 0.109; before, a
+    // TLA-only ESM file parsed here as a broken script). Keep mirroring Node for any script parse
+    // that still fails: retry as module and prefer a clean module parse.
     if (errors.length > 0 && declared === null && !format.startsWith('module')) {
       try {
         const asModule = parser.parseSync(file, src, parseOptions('module'))
-        if (nonWarning(asModule).length === 0) {
+        if (syntaxErrors(asModule).length === 0) {
           parsed = asModule
-          format = `module${ext === '.ts' ? '-typescript' : ''}`
+          format = `module${tsSuffix}`
+          errors = []
+        }
+      } catch { /* keep the script parse and its recorded errors */ }
+    }
+
+    // A typeless file Node detects as CJS runs inside the module wrapper too, but `unambiguous`
+    // parses it as a plain script, so a top-level `return` still fails there: retry as `commonjs`
+    // and prefer a clean parse (the detected commonjs format stands).
+    if (errors.length > 0 && declared === null && !format.startsWith('module')) {
+      try {
+        const asCommonjs = parser.parseSync(file, src, parseOptions('commonjs'))
+        if (syntaxErrors(asCommonjs).length === 0) {
+          parsed = asCommonjs
           errors = []
         }
       } catch { /* keep the script parse and its recorded errors */ }
@@ -276,15 +379,44 @@ export class Scan {
       if (flowSrc !== null) {
         try {
           const asFlow = parser.parseSync(file, flowSrc, parseOptions(baseSourceType))
-          if (nonWarning(asFlow).length === 0) {
+          if (syntaxErrors(asFlow).length === 0) {
             parsed = asFlow
-            format = declared ?? `${parsed.module.hasModuleSyntax ? 'module' : 'commonjs'}${ext === '.ts' ? '-typescript' : ''}`
+            format = declared ?? detectedFormat(parsed)
             errors = []
           }
         } catch { /* keep the original parse + its errors */ }
       }
     }
 
+    return { format, parsed, errors }
+  }
+
+  #scanFile(url, queue) {
+    const file = fileURLToPath(url)
+    const ext = extname(file)
+    if (ext === '.json') {
+      this.files.set(url, { format: 'json', edges: [] })
+      return
+    }
+    if (this.#isResource(file)) {
+      // Allowlisted asset: carry it as a resource with no parse and no edges. `resource: true` is
+      // the authoritative signal (both bundle builders key off it); the concrete format
+      // (resource vs resource:base64) is byte-derived by the builder, so leave it unset here.
+      this.files.set(url, { format: null, edges: [], resource: true })
+      return
+    }
+    if (!SCRIPT_EXTS.has(ext)) {
+      this.files.set(url, { format: null, edges: [] })
+      return
+    }
+
+    const result = this.parseFile(file)
+    if (result.crash !== undefined) {
+      this.#recordParseError(url, result.declared, result.crash, false)
+      return
+    }
+    const { format, parsed, errors } = result
+
     let parseError
     if (errors.length > 0) {
       parseError = errors.map((e) => e.message).join('; ')
@@ -297,35 +429,26 @@ export class Scan {
       this.parseErrors.push({ url, format, message: parseError, recovered: true })
     }
 
-    const specs = []
-    // Type-only edges (`import type`, `export type`) are erased before runtime — skip them so the
-    // bundle matches Node's load graph. Mixed (`{ type A, B }`) and bare side-effect imports are kept.
-    if (parsed.module?.staticImports) {
-      for (const imp of parsed.module.staticImports) {
-        if (imp.entries.length > 0 && imp.entries.every((e) => e.isType)) continue
-        specs.push({ kind: 'import', spec: imp.moduleRequest.value })
-      }
-    }
-    if (parsed.module?.staticExports) {
-      for (const exp of parsed.module.staticExports) {
-        for (const entry of exp.entries) {
-          if (entry.moduleRequest && !entry.isType) specs.push({ kind: 'export-from', spec: entry.moduleRequest.value })
-        }
-      }
-    }
-    findCallSpecifiers(parsed.program, (s) => specs.push(s))
+    const specs = collectSpecifiers(parsed.program)
 
     // The edge KIND picks the resolution context, not the parent's format: createRequire()d
     // require() inside ESM resolves under REQUIRE conditions, literal import() inside CJS under
     // IMPORT conditions -- the parent-format set baked the wrong `exports` branch into the bundle.
     // The custom (legacy-field) resolver keeps the format set: bundlers don't split per edge.
     const formatContext = ['module', 'module-typescript'].includes(format) ? 'import' : 'require'
-    const req = createRequire(file)
     const edges = []
     const specMaps = new Map() // condition key -> specifier -> child URL
-    const record = (key, spec, childURL) => {
+    const addChild = (s, key, childURL, childPath) => {
+      edges.push({ ...s, child: childURL })
       if (!specMaps.has(key)) specMaps.set(key, new Map())
-      specMaps.get(key).set(spec, childURL)
+      specMaps.get(key).set(s.spec, childURL)
+      if (RESOLVABLE_EXTS.has(extname(childPath)) || this.#isResource(childPath)) queue.push(childURL)
+    }
+    // Records the file --typescript would land the miss on too (typescriptURL), resolved as the miss was.
+    const addUnresolved = (s, reason, conditions) => {
+      edges.push({ ...s, error: reason })
+      const typescriptURL = this.#typescriptCandidate(file, s.spec, conditions)
+      this.unresolved.push({ parentURL: url, kind: s.kind, spec: s.spec, reason, ...(typescriptURL ? { typescriptURL } : {}) })
     }
 
     for (const s of specs) {
@@ -346,13 +469,9 @@ export class Scan {
         } else if (r?.empty) {
           edges.push({ ...s, empty: true })
         } else if (r?.url) {
-          edges.push({ ...s, child: r.url })
-          record(key, s.spec, r.url)
-          const childPath = fileURLToPath(r.url)
-          if (this.resolvableExts.has(extname(childPath)) || this.#isResource(childPath)) queue.push(r.url)
+          addChild(s, key, r.url, fileURLToPath(r.url))
         } else {
-          edges.push({ ...s, error: 'MODULE_NOT_FOUND' })
-          this.unresolved.push({ parentURL: url, kind: s.kind, spec: s.spec, reason: 'MODULE_NOT_FOUND' })
+          addUnresolved(s, 'MODULE_NOT_FOUND', conditions)
         }
         continue
       }
@@ -360,17 +479,19 @@ export class Scan {
         edges.push({ ...s, builtin: true })
         continue
       }
+      let childPath
       try {
-        const childPath = req.resolve(s.spec, { conditions })
-        const childURL = pathToFileURL(childPath).toString()
-        edges.push({ ...s, child: childURL })
-        record(key, s.spec, childURL)
-        const childExt = extname(childPath)
-        if (this.resolvableExts.has(childExt) || this.#isResource(childPath)) queue.push(childURL)
+        childPath = this.host.resolve(file, s.spec, conditions)
       } catch (cause) {
-        edges.push({ ...s, error: cause.code ?? cause.message })
-        this.unresolved.push({ parentURL: url, kind: s.kind, spec: s.spec, reason: cause.code ?? cause.message })
+        // --typescript: complete the miss with tsc's mapping (see #typescriptResolve); the edge
+        // stays keyed by the ORIGINAL specifier -- only the target is the mapped file.
+        if (this.typescript) childPath = this.#typescriptResolve(file, s.spec, conditions)
+        if (childPath == null) {
+          addUnresolved(s, cause.code ?? cause.message, conditions)
+          continue
+        }
       }
+      addChild(s, key, pathToFileURL(childPath).toString(), childPath)
     }
 
     for (const [key, specMap] of specMaps) {
@@ -384,7 +505,7 @@ export class Scan {
     const rel = (url) => {
       const abs = fileURLToPath(url)
       const r = relative(root, abs)
-      if (r.startsWith('..')) throw new Error(`Path outside root: ${abs}`)
+      if (relativeEscapes(r)) throw new Error(`Path outside root: ${abs}`)
       return r
     }
     const relEdge = (e) => (e.child ? { ...e, child: rel(e.child) } : e)
@@ -404,7 +525,7 @@ export class Scan {
           ),
         ])
       ),
-      unresolved: this.unresolved.map(({ parentURL, ...rest }) => ({ parent: rel(parentURL), ...rest })),
+      unresolved: this.unresolved.map(({ parentURL, typescriptURL, ...rest }) => ({ parent: rel(parentURL), ...rest, ...(typescriptURL ? { typescript: rel(typescriptURL) } : {}) })),
       parseErrors: this.parseErrors.map(({ url, ...rest }) => ({ file: rel(url), ...rest })),
     }
   }