@futdevpro/nts-dynamo 1.15.142 → 1.15.144

package/__documentations/2026-08-18-artifact-compiler.md

@@ -0,0 +1,44 @@
+# Dynamo NTS in-memory artifact compiler
+
+**Contract:** `dynts-artifact-compiler/1`
+
+**Release candidate:** `@futdevpro/nts-dynamo@1.15.144`
+
+## Purpose
+
+The artifact compiler turns one already policy-validated TypeScript program into a self-contained JavaScript bundle
+for a classic browser Worker. It is a shared build capability, not a sandbox, an authorization layer or a source
+policy validator. Consumers must validate source before compilation and execute the output inside an independently
+enforced runtime boundary.
+
+## Guarantees
+
+- source is supplied through an in-memory virtual entry;
+- output uses the asynchronous esbuild API with `bundle:true`, `platform:'browser'`, `format:'iife'` and
+  `write:false`;
+- no sourcemap, embedded source content, legal comment file, plugin supplied by the caller or filesystem output;
+- the TypeScript AST is traversed before bundling, so unused imports cannot disappear through tree-shaking before
+  policy evaluation;
+- only caller-allowlisted static package roots resolve from the supplied absolute dependency directory;
+- relative, absolute, re-export, import-equals, `require()` and dynamic `import()` module loads fail closed;
+- transitive modules resolve only through the installed dependency graph;
+- source and output byte limits, allowlist cardinality, package names and path fields have absolute Bedrock
+  ceilings;
+- success returns exactly one JavaScript output with SHA-256 metadata;
+- errors return stable codes and optional line/column only, never esbuild message text, source excerpt or path.
+
+The output is deterministic for the same source, settings, installed lock graph, platform and compiler version. The
+consumer must therefore version and checksum the compiler version and dependency lock together with the bundle.
+
+## Security boundary
+
+esbuild's own documentation explicitly states that esbuild is not a sandbox. This module never executes generated
+code, and successful compilation must not be interpreted as permission to run it. Direct relative/absolute, Node,
+HTTP or non-allowlisted imports fail because only package roots in `allowedPackages` can resolve from the virtual
+entry. Trusted allowed packages may resolve their own installed transitive graph.
+
+## Verification
+
+The eight focused Bedrock specs cover deterministic output, a real bundled dependency, non-allowlisted imports,
+all supported static and dynamic module-load syntax, content-free syntax diagnostics, invalid request contracts and
+source/output budgets. Company Toolmaker is the first direct consumer under `BFR-CTM-007`.

package/build/_modules/artifact-compiler/_enums/artifact-compile-outcome.type-enum.d.ts

@@ -0,0 +1,6 @@
+/** Terminal result of one deterministic in-memory artifact compilation. */
+export declare enum DyNTS_ArtifactCompileOutcome_Type {
+    compiled = "compiled",
+    rejected = "rejected"
+}
+//# sourceMappingURL=artifact-compile-outcome.type-enum.d.ts.map

package/build/_modules/artifact-compiler/_enums/artifact-compile-outcome.type-enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-compile-outcome.type-enum.d.ts","sourceRoot":"","sources":["../../../../src/_modules/artifact-compiler/_enums/artifact-compile-outcome.type-enum.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,oBAAY,iCAAiC;IAC3C,QAAQ,aAAa;IACrB,QAAQ,aAAa;CACtB"}

package/build/_modules/artifact-compiler/_enums/artifact-compile-outcome.type-enum.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_ArtifactCompileOutcome_Type = void 0;
+/** Terminal result of one deterministic in-memory artifact compilation. */
+var DyNTS_ArtifactCompileOutcome_Type;
+(function (DyNTS_ArtifactCompileOutcome_Type) {
+    DyNTS_ArtifactCompileOutcome_Type["compiled"] = "compiled";
+    DyNTS_ArtifactCompileOutcome_Type["rejected"] = "rejected";
+})(DyNTS_ArtifactCompileOutcome_Type || (exports.DyNTS_ArtifactCompileOutcome_Type = DyNTS_ArtifactCompileOutcome_Type = {}));
+//# sourceMappingURL=artifact-compile-outcome.type-enum.js.map

package/build/_modules/artifact-compiler/_enums/artifact-compile-outcome.type-enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-compile-outcome.type-enum.js","sourceRoot":"","sources":["../../../../src/_modules/artifact-compiler/_enums/artifact-compile-outcome.type-enum.ts"],"names":[],"mappings":";;;AAAA,2EAA2E;AAC3E,IAAY,iCAGX;AAHD,WAAY,iCAAiC;IAC3C,0DAAqB,CAAA;IACrB,0DAAqB,CAAA;AACvB,CAAC,EAHW,iCAAiC,iDAAjC,iCAAiC,QAG5C"}

package/build/_modules/artifact-compiler/_enums/artifact-compile-stage.type-enum.d.ts

@@ -0,0 +1,9 @@
+/** Content-free stage identifiers for artifact compiler findings. */
+export declare enum DyNTS_ArtifactCompileStage_Type {
+    request = "request",
+    sourcePolicy = "source-policy",
+    resolve = "resolve",
+    compile = "compile",
+    output = "output"
+}
+//# sourceMappingURL=artifact-compile-stage.type-enum.d.ts.map

package/build/_modules/artifact-compiler/_enums/artifact-compile-stage.type-enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-compile-stage.type-enum.d.ts","sourceRoot":"","sources":["../../../../src/_modules/artifact-compiler/_enums/artifact-compile-stage.type-enum.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,oBAAY,+BAA+B;IACzC,OAAO,YAAY;IACnB,YAAY,kBAAkB;IAC9B,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,MAAM,WAAW;CAClB"}

package/build/_modules/artifact-compiler/_enums/artifact-compile-stage.type-enum.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_ArtifactCompileStage_Type = void 0;
+/** Content-free stage identifiers for artifact compiler findings. */
+var DyNTS_ArtifactCompileStage_Type;
+(function (DyNTS_ArtifactCompileStage_Type) {
+    DyNTS_ArtifactCompileStage_Type["request"] = "request";
+    DyNTS_ArtifactCompileStage_Type["sourcePolicy"] = "source-policy";
+    DyNTS_ArtifactCompileStage_Type["resolve"] = "resolve";
+    DyNTS_ArtifactCompileStage_Type["compile"] = "compile";
+    DyNTS_ArtifactCompileStage_Type["output"] = "output";
+})(DyNTS_ArtifactCompileStage_Type || (exports.DyNTS_ArtifactCompileStage_Type = DyNTS_ArtifactCompileStage_Type = {}));
+//# sourceMappingURL=artifact-compile-stage.type-enum.js.map

package/build/_modules/artifact-compiler/_enums/artifact-compile-stage.type-enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-compile-stage.type-enum.js","sourceRoot":"","sources":["../../../../src/_modules/artifact-compiler/_enums/artifact-compile-stage.type-enum.ts"],"names":[],"mappings":";;;AAAA,qEAAqE;AACrE,IAAY,+BAMX;AAND,WAAY,+BAA+B;IACzC,sDAAmB,CAAA;IACnB,iEAA8B,CAAA;IAC9B,sDAAmB,CAAA;IACnB,sDAAmB,CAAA;IACnB,oDAAiB,CAAA;AACnB,CAAC,EANW,+BAA+B,+CAA/B,+BAA+B,QAM1C"}

package/build/_modules/artifact-compiler/_enums/artifact-retry-class.type-enum.d.ts

@@ -0,0 +1,7 @@
+/** Stable remediation classification for artifact compiler findings. */
+export declare enum DyNTS_ArtifactRetryClass_Type {
+    agentFixable = "agent-fixable",
+    deterministicToolFixable = "deterministic-tool-fixable",
+    terminal = "terminal"
+}
+//# sourceMappingURL=artifact-retry-class.type-enum.d.ts.map

package/build/_modules/artifact-compiler/_enums/artifact-retry-class.type-enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-retry-class.type-enum.d.ts","sourceRoot":"","sources":["../../../../src/_modules/artifact-compiler/_enums/artifact-retry-class.type-enum.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oBAAY,6BAA6B;IACvC,YAAY,kBAAkB;IAC9B,wBAAwB,+BAA+B;IACvD,QAAQ,aAAa;CACtB"}

package/build/_modules/artifact-compiler/_enums/artifact-retry-class.type-enum.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_ArtifactRetryClass_Type = void 0;
+/** Stable remediation classification for artifact compiler findings. */
+var DyNTS_ArtifactRetryClass_Type;
+(function (DyNTS_ArtifactRetryClass_Type) {
+    DyNTS_ArtifactRetryClass_Type["agentFixable"] = "agent-fixable";
+    DyNTS_ArtifactRetryClass_Type["deterministicToolFixable"] = "deterministic-tool-fixable";
+    DyNTS_ArtifactRetryClass_Type["terminal"] = "terminal";
+})(DyNTS_ArtifactRetryClass_Type || (exports.DyNTS_ArtifactRetryClass_Type = DyNTS_ArtifactRetryClass_Type = {}));
+//# sourceMappingURL=artifact-retry-class.type-enum.js.map

package/build/_modules/artifact-compiler/_enums/artifact-retry-class.type-enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-retry-class.type-enum.js","sourceRoot":"","sources":["../../../../src/_modules/artifact-compiler/_enums/artifact-retry-class.type-enum.ts"],"names":[],"mappings":";;;AAAA,wEAAwE;AACxE,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,+DAA8B,CAAA;IAC9B,wFAAuD,CAAA;IACvD,sDAAqB,CAAA;AACvB,CAAC,EAJW,6BAA6B,6CAA7B,6BAA6B,QAIxC"}

package/build/_modules/artifact-compiler/_models/artifact-compile.interface.d.ts

@@ -0,0 +1,33 @@
+import { DyNTS_ArtifactCompileOutcome_Type } from '../_enums/artifact-compile-outcome.type-enum';
+import { DyNTS_ArtifactCompileStage_Type } from '../_enums/artifact-compile-stage.type-enum';
+import { DyNTS_ArtifactRetryClass_Type } from '../_enums/artifact-retry-class.type-enum';
+/** Versioned input for the deterministic TypeScript-to-browser bundle compiler. */
+export interface DyNTS_ArtifactCompileRequest_Interface {
+    contractVersion: 'dynts-artifact-compiler/1';
+    source: string;
+    sourceFileName: string;
+    resolveDirectory: string;
+    allowedPackages: string[];
+    maxSourceBytes: number;
+    maxOutputBytes: number;
+}
+/** Content-free compiler finding. Source text and dependency paths are deliberately excluded. */
+export interface DyNTS_ArtifactCompileFinding_Interface {
+    code: string;
+    stage: DyNTS_ArtifactCompileStage_Type;
+    line: number | null;
+    column: number | null;
+    retryClass: DyNTS_ArtifactRetryClass_Type;
+}
+/** One self-contained JavaScript output or a fail-closed, content-free rejection. */
+export interface DyNTS_ArtifactCompileResult_Interface {
+    contractVersion: 'dynts-artifact-compiler/1';
+    outcome: DyNTS_ArtifactCompileOutcome_Type;
+    code: string;
+    sourceChecksum: string;
+    bundleChecksum: string;
+    outputBytes: number;
+    bundleSource: string | null;
+    findings: DyNTS_ArtifactCompileFinding_Interface[];
+}
+//# sourceMappingURL=artifact-compile.interface.d.ts.map

package/build/_modules/artifact-compiler/_models/artifact-compile.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-compile.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/artifact-compiler/_models/artifact-compile.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,8CAA8C,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AAEzF,mFAAmF;AACnF,MAAM,WAAW,sCAAsC;IACrD,eAAe,EAAE,2BAA2B,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,sCAAsC;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,+BAA+B,CAAC;IACvC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,6BAA6B,CAAC;CAC3C;AAED,qFAAqF;AACrF,MAAM,WAAW,qCAAqC;IACpD,eAAe,EAAE,2BAA2B,CAAC;IAC7C,OAAO,EAAE,iCAAiC,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,sCAAsC,EAAE,CAAC;CACpD"}

package/build/_modules/artifact-compiler/_models/artifact-compile.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=artifact-compile.interface.js.map

package/build/_modules/artifact-compiler/_models/artifact-compile.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-compile.interface.js","sourceRoot":"","sources":["../../../../src/_modules/artifact-compiler/_models/artifact-compile.interface.ts"],"names":[],"mappings":""}

package/build/_modules/artifact-compiler/artifact-compiler.control-service.d.ts

@@ -0,0 +1,37 @@
+import { DyNTS_ArtifactCompileRequest_Interface, DyNTS_ArtifactCompileResult_Interface } from './_models/artifact-compile.interface';
+/**
+ * Deterministically bundles one in-memory TypeScript program for a classic browser Worker.
+ * This compiler is not a sandbox: consumers must validate source policy before compilation and execute the result
+ * inside a separately enforced runtime boundary.
+ */
+export declare class DyNTS_ArtifactCompiler_ControlService {
+    static readonly contractVersion: 'dynts-artifact-compiler/1';
+    private readonly absoluteMaxSourceBytes;
+    private readonly absoluteMaxOutputBytes;
+    private readonly absoluteMaxAllowedPackages;
+    private readonly absoluteMaxPackageNameLength;
+    private readonly absoluteMaxSourceFileNameLength;
+    private readonly absoluteMaxResolveDirectoryLength;
+    private readonly packageNamePattern;
+    private readonly sourceFileNamePattern;
+    /** Compiles without writing source, sourcemaps, metadata or output files to disk. */
+    compile(request: DyNTS_ArtifactCompileRequest_Interface): Promise<DyNTS_ArtifactCompileResult_Interface>;
+    private validateRequest;
+    private buildOptions;
+    /**
+     * Validates every syntactic import before esbuild can tree-shake it. The plugin below is a second resolution gate,
+     * but it cannot be the only policy boundary because unused imports need not reach package resolution.
+     */
+    private validateDirectImports;
+    private moduleName;
+    private isDynamicModuleLoad;
+    private importFinding;
+    private allowlistedEntryPlugin;
+    private buildFindings;
+    private isBuildFailure;
+    private genericBuildFinding;
+    private rejected;
+    private packageRoot;
+    private checksum;
+}
+//# sourceMappingURL=artifact-compiler.control-service.d.ts.map

package/build/_modules/artifact-compiler/artifact-compiler.control-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-compiler.control-service.d.ts","sourceRoot":"","sources":["../../../src/_modules/artifact-compiler/artifact-compiler.control-service.ts"],"names":[],"mappings":"AAqBA,OAAO,EAEL,sCAAsC,EACtC,qCAAqC,EACtC,MAAM,sCAAsC,CAAC;AAE9C;;;;GAIG;AACH,qBAAa,qCAAqC;IAChD,gBAAuB,eAAe,EAAE,2BAA2B,CAA+B;IAClG,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAqB;IAC5D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAsB;IAC7D,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAc;IACzD,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAe;IAC5D,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAe;IAC/D,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAAiB;IACnE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CACwC;IAC3E,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAwC;IAE9E,qFAAqF;IACxE,OAAO,CAClB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,qCAAqC,CAAC;IAwDjD,OAAO,CAAC,eAAe;IA2CvB,OAAO,CAAC,YAAY;IAuBpB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAyC7B,OAAO,CAAC,UAAU;IAgBlB,OAAO,CAAC,mBAAmB;IAM3B,OAAO,CAAC,aAAa;IAerB,OAAO,CAAC,sBAAsB;IAmC9B,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,mBAAmB;IAU3B,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,WAAW;IAQnB,OAAO,CAAC,QAAQ;CAGjB"}

package/build/_modules/artifact-compiler/artifact-compiler.control-service.js

@@ -0,0 +1,274 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_ArtifactCompiler_ControlService = void 0;
+const tslib_1 = require("tslib");
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = tslib_1.__importDefault(require("node:path"));
+const esbuild_1 = require("esbuild");
+const typescript_1 = tslib_1.__importDefault(require("typescript"));
+const artifact_compile_outcome_type_enum_1 = require("./_enums/artifact-compile-outcome.type-enum");
+const artifact_compile_stage_type_enum_1 = require("./_enums/artifact-compile-stage.type-enum");
+const artifact_retry_class_type_enum_1 = require("./_enums/artifact-retry-class.type-enum");
+/**
+ * Deterministically bundles one in-memory TypeScript program for a classic browser Worker.
+ * This compiler is not a sandbox: consumers must validate source policy before compilation and execute the result
+ * inside a separately enforced runtime boundary.
+ */
+class DyNTS_ArtifactCompiler_ControlService {
+    static contractVersion = 'dynts-artifact-compiler/1';
+    absoluteMaxSourceBytes = 1_048_576;
+    absoluteMaxOutputBytes = 16_777_216;
+    absoluteMaxAllowedPackages = 64;
+    absoluteMaxPackageNameLength = 128;
+    absoluteMaxSourceFileNameLength = 128;
+    absoluteMaxResolveDirectoryLength = 1_024;
+    packageNamePattern = /^(?:@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*|[a-z0-9][a-z0-9._-]*)$/;
+    sourceFileNamePattern = /^[a-z0-9][a-z0-9._-]*\.ts$/;
+    /** Compiles without writing source, sourcemaps, metadata or output files to disk. */
+    async compile(request) {
+        const sourceChecksum = this.checksum(typeof request?.source === 'string' ? request.source : '');
+        const requestFinding = this.validateRequest(request);
+        if (requestFinding) {
+            return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|REQUEST_INVALID', [requestFinding]);
+        }
+        const importFinding = this.validateDirectImports(request);
+        if (importFinding) {
+            return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|IMPORT_REJECTED', [importFinding]);
+        }
+        try {
+            const result = await (0, esbuild_1.build)(this.buildOptions(request));
+            const outputFiles = result.outputFiles ?? [];
+            if (outputFiles.length !== 1 || !outputFiles[0].path.endsWith('.js')) {
+                return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|OUTPUT_INVALID', [{
+                        code: 'DYNTS|ARTIFACT_COMPILER|OUTPUT_COUNT',
+                        stage: artifact_compile_stage_type_enum_1.DyNTS_ArtifactCompileStage_Type.output,
+                        line: null,
+                        column: null,
+                        retryClass: artifact_retry_class_type_enum_1.DyNTS_ArtifactRetryClass_Type.deterministicToolFixable,
+                    }]);
+            }
+            const bundleSource = outputFiles[0].text;
+            const outputBytes = Buffer.byteLength(bundleSource, 'utf8');
+            if (!outputBytes || outputBytes > request.maxOutputBytes) {
+                return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|OUTPUT_LIMIT', [{
+                        code: 'DYNTS|ARTIFACT_COMPILER|OUTPUT_SIZE',
+                        stage: artifact_compile_stage_type_enum_1.DyNTS_ArtifactCompileStage_Type.output,
+                        line: null,
+                        column: null,
+                        retryClass: artifact_retry_class_type_enum_1.DyNTS_ArtifactRetryClass_Type.agentFixable,
+                    }]);
+            }
+            return {
+                contractVersion: DyNTS_ArtifactCompiler_ControlService.contractVersion,
+                outcome: artifact_compile_outcome_type_enum_1.DyNTS_ArtifactCompileOutcome_Type.compiled,
+                code: 'DYNTS|ARTIFACT_COMPILER|COMPILED',
+                sourceChecksum: sourceChecksum,
+                bundleChecksum: this.checksum(bundleSource),
+                outputBytes: outputBytes,
+                bundleSource: bundleSource,
+                findings: [],
+            };
+        }
+        catch (error) {
+            return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|BUILD_FAILED', this.buildFindings(error));
+        }
+    }
+    validateRequest(request) {
+        const sourceBytes = typeof request?.source === 'string'
+            ? Buffer.byteLength(request.source, 'utf8')
+            : 0;
+        const allowedPackages = Array.isArray(request?.allowedPackages) ? request.allowedPackages : [];
+        const uniquePackages = new Set(allowedPackages);
+        const isPackageSetValid = allowedPackages.length <= this.absoluteMaxAllowedPackages
+            && uniquePackages.size === allowedPackages.length
+            && allowedPackages.every((packageName) => packageName.length <= this.absoluteMaxPackageNameLength
+                && this.packageNamePattern.test(packageName));
+        if (request?.contractVersion !== DyNTS_ArtifactCompiler_ControlService.contractVersion
+            || !sourceBytes
+            || !Number.isInteger(request.maxSourceBytes)
+            || request.maxSourceBytes < 1
+            || request.maxSourceBytes > this.absoluteMaxSourceBytes
+            || sourceBytes > request.maxSourceBytes
+            || !Number.isInteger(request.maxOutputBytes)
+            || request.maxOutputBytes < 1
+            || request.maxOutputBytes > this.absoluteMaxOutputBytes
+            || typeof request.sourceFileName !== 'string'
+            || request.sourceFileName.length > this.absoluteMaxSourceFileNameLength
+            || !this.sourceFileNamePattern.test(request.sourceFileName)
+            || typeof request.resolveDirectory !== 'string'
+            || request.resolveDirectory.length > this.absoluteMaxResolveDirectoryLength
+            || !node_path_1.default.isAbsolute(request.resolveDirectory)
+            || !isPackageSetValid) {
+            return {
+                code: 'DYNTS|ARTIFACT_COMPILER|REQUEST_CONTRACT',
+                stage: artifact_compile_stage_type_enum_1.DyNTS_ArtifactCompileStage_Type.request,
+                line: null,
+                column: null,
+                retryClass: artifact_retry_class_type_enum_1.DyNTS_ArtifactRetryClass_Type.deterministicToolFixable,
+            };
+        }
+        return null;
+    }
+    buildOptions(request) {
+        return {
+            absWorkingDir: request.resolveDirectory,
+            bundle: true,
+            charset: 'utf8',
+            conditions: ['browser', 'default'],
+            entryPoints: ['dynts-entry:candidate'],
+            format: 'iife',
+            legalComments: 'none',
+            logLevel: 'silent',
+            mainFields: ['browser', 'module', 'main'],
+            metafile: false,
+            minify: true,
+            outdir: 'dynts-in-memory-output',
+            platform: 'browser',
+            plugins: [this.allowlistedEntryPlugin(request)],
+            sourcemap: false,
+            target: ['es2022'],
+            treeShaking: true,
+            write: false,
+        };
+    }
+    /**
+     * Validates every syntactic import before esbuild can tree-shake it. The plugin below is a second resolution gate,
+     * but it cannot be the only policy boundary because unused imports need not reach package resolution.
+     */
+    validateDirectImports(request) {
+        const sourceFile = typescript_1.default.createSourceFile(request.sourceFileName, request.source, typescript_1.default.ScriptTarget.ES2022, true, typescript_1.default.ScriptKind.TS);
+        const allowedPackages = new Set(request.allowedPackages);
+        let finding = null;
+        /** Traverses the parsed source once and stops at the first forbidden module load. */
+        const inspectNode = (node) => {
+            if (finding) {
+                return;
+            }
+            const moduleName = this.moduleName(node);
+            if (moduleName !== null && !allowedPackages.has(this.packageRoot(moduleName))) {
+                finding = this.importFinding(sourceFile, node);
+                return;
+            }
+            if (this.isDynamicModuleLoad(node)) {
+                finding = this.importFinding(sourceFile, node);
+                return;
+            }
+            typescript_1.default.forEachChild(node, inspectNode);
+        };
+        inspectNode(sourceFile);
+        return finding;
+    }
+    moduleName(node) {
+        if ((typescript_1.default.isImportDeclaration(node) || typescript_1.default.isExportDeclaration(node)) && node.moduleSpecifier) {
+            return typescript_1.default.isStringLiteral(node.moduleSpecifier) ? node.moduleSpecifier.text : '';
+        }
+        if (typescript_1.default.isImportEqualsDeclaration(node)
+            && typescript_1.default.isExternalModuleReference(node.moduleReference)
+            && node.moduleReference.expression) {
+            return typescript_1.default.isStringLiteral(node.moduleReference.expression) ? node.moduleReference.expression.text : '';
+        }
+        return null;
+    }
+    isDynamicModuleLoad(node) {
+        return typescript_1.default.isCallExpression(node)
+            && (node.expression.kind === typescript_1.default.SyntaxKind.ImportKeyword
+                || (typescript_1.default.isIdentifier(node.expression) && node.expression.text === 'require'));
+    }
+    importFinding(sourceFile, node) {
+        const location = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+        return {
+            code: 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED',
+            stage: artifact_compile_stage_type_enum_1.DyNTS_ArtifactCompileStage_Type.sourcePolicy,
+            line: location.line + 1,
+            column: location.character + 1,
+            retryClass: artifact_retry_class_type_enum_1.DyNTS_ArtifactRetryClass_Type.terminal,
+        };
+    }
+    allowlistedEntryPlugin(request) {
+        const allowedPackages = new Set(request.allowedPackages);
+        return {
+            name: 'dynts-allowlisted-in-memory-entry',
+            setup: (pluginBuild) => {
+                pluginBuild.onResolve({ filter: /^dynts-entry:candidate$/ }, () => ({
+                    path: 'candidate',
+                    namespace: 'dynts-entry',
+                }));
+                pluginBuild.onLoad({ filter: /^candidate$/, namespace: 'dynts-entry' }, () => ({
+                    contents: request.source,
+                    loader: 'ts',
+                    resolveDir: request.resolveDirectory,
+                }));
+                pluginBuild.onResolve({ filter: /.*/, namespace: 'dynts-entry' }, async (args) => {
+                    if (!allowedPackages.has(this.packageRoot(args.path))) {
+                        return {
+                            errors: [{ text: 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED' }],
+                        };
+                    }
+                    return pluginBuild.resolve(args.path, {
+                        importer: args.importer,
+                        kind: args.kind,
+                        namespace: 'file',
+                        resolveDir: request.resolveDirectory,
+                    });
+                });
+            },
+        };
+    }
+    buildFindings(error) {
+        if (!this.isBuildFailure(error)) {
+            return [this.genericBuildFinding()];
+        }
+        const findings = error.errors.map((message) => ({
+            code: message.text === 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED'
+                ? message.text
+                : 'DYNTS|ARTIFACT_COMPILER|COMPILE_ERROR',
+            stage: message.text === 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED'
+                ? artifact_compile_stage_type_enum_1.DyNTS_ArtifactCompileStage_Type.resolve
+                : artifact_compile_stage_type_enum_1.DyNTS_ArtifactCompileStage_Type.compile,
+            line: message.location?.line ?? null,
+            column: message.location ? message.location.column + 1 : null,
+            retryClass: message.text === 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED'
+                ? artifact_retry_class_type_enum_1.DyNTS_ArtifactRetryClass_Type.terminal
+                : artifact_retry_class_type_enum_1.DyNTS_ArtifactRetryClass_Type.agentFixable,
+        }));
+        return findings.length ? findings : [this.genericBuildFinding()];
+    }
+    isBuildFailure(error) {
+        if (!error || typeof error !== 'object') {
+            return false;
+        }
+        return 'errors' in error && Array.isArray(error.errors);
+    }
+    genericBuildFinding() {
+        return {
+            code: 'DYNTS|ARTIFACT_COMPILER|COMPILE_ERROR',
+            stage: artifact_compile_stage_type_enum_1.DyNTS_ArtifactCompileStage_Type.compile,
+            line: null,
+            column: null,
+            retryClass: artifact_retry_class_type_enum_1.DyNTS_ArtifactRetryClass_Type.agentFixable,
+        };
+    }
+    rejected(sourceChecksum, code, findings) {
+        return {
+            contractVersion: DyNTS_ArtifactCompiler_ControlService.contractVersion,
+            outcome: artifact_compile_outcome_type_enum_1.DyNTS_ArtifactCompileOutcome_Type.rejected,
+            code: code,
+            sourceChecksum: sourceChecksum,
+            bundleChecksum: '',
+            outputBytes: 0,
+            bundleSource: null,
+            findings: findings,
+        };
+    }
+    packageRoot(moduleName) {
+        if (moduleName.startsWith('@')) {
+            return moduleName.split('/').slice(0, 2).join('/');
+        }
+        return moduleName.split('/')[0];
+    }
+    checksum(value) {
+        return (0, node_crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex');
+    }
+}
+exports.DyNTS_ArtifactCompiler_ControlService = DyNTS_ArtifactCompiler_ControlService;
+//# sourceMappingURL=artifact-compiler.control-service.js.map

package/build/_modules/artifact-compiler/artifact-compiler.control-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-compiler.control-service.js","sourceRoot":"","sources":["../../../src/_modules/artifact-compiler/artifact-compiler.control-service.ts"],"names":[],"mappings":";;;;AAAA,6CAAyC;AACzC,kEAA6B;AAE7B,qCAYiB;AACjB,oEAA4B;AAE5B,oGAAgG;AAChG,gGAA4F;AAC5F,4FAAwF;AAOxF;;;;GAIG;AACH,MAAa,qCAAqC;IACzC,MAAM,CAAU,eAAe,GAAgC,2BAA2B,CAAC;IACjF,sBAAsB,GAAW,SAAS,CAAC;IAC3C,sBAAsB,GAAW,UAAU,CAAC;IAC5C,0BAA0B,GAAW,EAAE,CAAC;IACxC,4BAA4B,GAAW,GAAG,CAAC;IAC3C,+BAA+B,GAAW,GAAG,CAAC;IAC9C,iCAAiC,GAAW,KAAK,CAAC;IAClD,kBAAkB,GACjC,wEAAwE,CAAC;IAC1D,qBAAqB,GAAW,4BAA4B,CAAC;IAE9E,qFAAqF;IAC9E,KAAK,CAAC,OAAO,CAClB,OAA+C;QAE/C,MAAM,cAAc,GAAW,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxG,MAAM,cAAc,GAAkD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAEpG,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,yCAAyC,EAAE,CAAE,cAAc,CAAE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,aAAa,GAAkD,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAEzG,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,yCAAyC,EAAE,CAAE,aAAa,CAAE,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAgB,MAAM,IAAA,eAAK,EAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;YACpE,MAAM,WAAW,GAAiB,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;YAE3D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,wCAAwC,EAAE,CAAC;wBAC9E,IAAI,EAAE,sCAAsC;wBAC5C,KAAK,EAAE,kEAA+B,CAAC,MAAM;wBAC7C,IAAI,EAAE,IAAI;wBACV,MAAM,EAAE,IAAI;wBACZ,UAAU,EAAE,8DAA6B,CAAC,wBAAwB;qBACnE,CAAC,CAAC,CAAC;YACN,CAAC;YAED,MAAM,YAAY,GAAW,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACjD,MAAM,WAAW,GAAW,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YAEpE,IAAI,CAAC,WAAW,IAAI,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,sCAAsC,EAAE,CAAC;wBAC5E,IAAI,EAAE,qCAAqC;wBAC3C,KAAK,EAAE,kEAA+B,CAAC,MAAM;wBAC7C,IAAI,EAAE,IAAI;wBACV,MAAM,EAAE,IAAI;wBACZ,UAAU,EAAE,8DAA6B,CAAC,YAAY;qBACvD,CAAC,CAAC,CAAC;YACN,CAAC;YAED,OAAO;gBACL,eAAe,EAAE,qCAAqC,CAAC,eAAe;gBACtE,OAAO,EAAE,sEAAiC,CAAC,QAAQ;gBACnD,IAAI,EAAE,kCAAkC;gBACxC,cAAc,EAAE,cAAc;gBAC9B,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC3C,WAAW,EAAE,WAAW;gBACxB,YAAY,EAAE,YAAY;gBAC1B,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,sCAAsC,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAEO,eAAe,CACrB,OAA+C;QAE/C,MAAM,WAAW,GAAW,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ;YAC7D,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;YAC3C,CAAC,CAAC,CAAC,CAAC;QACN,MAAM,eAAe,GAAa,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,cAAc,GAAgB,IAAI,GAAG,CAAS,eAAe,CAAC,CAAC;QACrE,MAAM,iBAAiB,GAAY,eAAe,CAAC,MAAM,IAAI,IAAI,CAAC,0BAA0B;eACvF,cAAc,CAAC,IAAI,KAAK,eAAe,CAAC,MAAM;eAC9C,eAAe,CAAC,KAAK,CAAC,CAAC,WAAmB,EAAW,EAAE,CAAC,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,4BAA4B;mBAC7G,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAElD,IACE,OAAO,EAAE,eAAe,KAAK,qCAAqC,CAAC,eAAe;eAC/E,CAAC,WAAW;eACZ,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC;eACzC,OAAO,CAAC,cAAc,GAAG,CAAC;eAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,sBAAsB;eACpD,WAAW,GAAG,OAAO,CAAC,cAAc;eACpC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC;eACzC,OAAO,CAAC,cAAc,GAAG,CAAC;eAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,sBAAsB;eACpD,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ;eAC1C,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,IAAI,CAAC,+BAA+B;eACpE,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;eACxD,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ;eAC5C,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,IAAI,CAAC,iCAAiC;eACxE,CAAC,mBAAI,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC;eAC1C,CAAC,iBAAiB,EACrB,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,0CAA0C;gBAChD,KAAK,EAAE,kEAA+B,CAAC,OAAO;gBAC9C,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,8DAA6B,CAAC,wBAAwB;aACnE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY,CAAC,OAA+C;QAClE,OAAO;YACL,aAAa,EAAE,OAAO,CAAC,gBAAgB;YACvC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,CAAE,SAAS,EAAE,SAAS,CAAE;YACpC,WAAW,EAAE,CAAE,uBAAuB,CAAE;YACxC,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,MAAM;YACrB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,CAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAE;YAC3C,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,CAAE,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAE;YACjD,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,CAAE,QAAQ,CAAE;YACpB,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,KAAK;SACb,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,qBAAqB,CAC3B,OAA+C;QAE/C,MAAM,UAAU,GAAkB,oBAAE,CAAC,gBAAgB,CACnD,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,MAAM,EACd,oBAAE,CAAC,YAAY,CAAC,MAAM,EACtB,IAAI,EACJ,oBAAE,CAAC,UAAU,CAAC,EAAE,CACjB,CAAC;QACF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAS,OAAO,CAAC,eAAe,CAAC,CAAC;QACtF,IAAI,OAAO,GAAkD,IAAI,CAAC;QAElE,qFAAqF;QACrF,MAAM,WAAW,GAA4B,CAAC,IAAa,EAAQ,EAAE;YACnE,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAkB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAExD,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC9E,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAE/C,OAAO;YACT,CAAC;YAED,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAE/C,OAAO;YACT,CAAC;YAED,oBAAE,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACrC,CAAC,CAAC;QAEF,WAAW,CAAC,UAAU,CAAC,CAAC;QAExB,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,UAAU,CAAC,IAAa;QAC9B,IAAI,CAAC,oBAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,oBAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3F,OAAO,oBAAE,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,CAAC;QAED,IACE,oBAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;eAC/B,oBAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC;eAClD,IAAI,CAAC,eAAe,CAAC,UAAU,EAClC,CAAC;YACD,OAAO,oBAAE,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,mBAAmB,CAAC,IAAa;QACvC,OAAO,oBAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;eAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,oBAAE,CAAC,UAAU,CAAC,aAAa;mBACnD,CAAC,oBAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC;IACnF,CAAC;IAEO,aAAa,CACnB,UAAyB,EACzB,IAAa;QAEb,MAAM,QAAQ,GAAwB,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAE1G,OAAO;YACL,IAAI,EAAE,4CAA4C;YAClD,KAAK,EAAE,kEAA+B,CAAC,YAAY;YACnD,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC;YACvB,MAAM,EAAE,QAAQ,CAAC,SAAS,GAAG,CAAC;YAC9B,UAAU,EAAE,8DAA6B,CAAC,QAAQ;SACnD,CAAC;IACJ,CAAC;IAEO,sBAAsB,CAAC,OAA+C;QAC5E,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAS,OAAO,CAAC,eAAe,CAAC,CAAC;QAEtF,OAAO;YACL,IAAI,EAAE,mCAAmC;YACzC,KAAK,EAAE,CAAC,WAAwB,EAAQ,EAAE;gBACxC,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,GAAoB,EAAE,CAAC,CAAC;oBACnF,IAAI,EAAE,WAAW;oBACjB,SAAS,EAAE,aAAa;iBACzB,CAAC,CAAC,CAAC;gBACJ,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,GAAiB,EAAE,CAAC,CAAC;oBAC3F,QAAQ,EAAE,OAAO,CAAC,MAAM;oBACxB,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,OAAO,CAAC,gBAAgB;iBACrC,CAAC,CAAC,CAAC;gBACJ,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,KAAK,EACrE,IAAmB,EACO,EAAE;oBAC5B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;wBACtD,OAAO;4BACL,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,4CAA4C,EAAE,CAAC;yBACjE,CAAC;oBACJ,CAAC;oBAED,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;wBACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,SAAS,EAAE,MAAM;wBACjB,UAAU,EAAE,OAAO,CAAC,gBAAgB;qBACrC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,KAAc;QAClC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,CAAE,IAAI,CAAC,mBAAmB,EAAE,CAAE,CAAC;QACxC,CAAC;QAED,MAAM,QAAQ,GAA6C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAgB,EACpD,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,4CAA4C;gBACjE,CAAC,CAAC,OAAO,CAAC,IAAI;gBACd,CAAC,CAAC,uCAAuC;YAC3C,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,4CAA4C;gBAClE,CAAC,CAAC,kEAA+B,CAAC,OAAO;gBACzC,CAAC,CAAC,kEAA+B,CAAC,OAAO;YAC3C,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI;YACpC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7D,UAAU,EAAE,OAAO,CAAC,IAAI,KAAK,4CAA4C;gBACvE,CAAC,CAAC,8DAA6B,CAAC,QAAQ;gBACxC,CAAC,CAAC,8DAA6B,CAAC,YAAY;SAC/C,CAAC,CAAC,CAAC;QAEJ,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,mBAAmB,EAAE,CAAE,CAAC;IACrE,CAAC;IAEO,cAAc,CAAC,KAAc;QACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IAEO,mBAAmB;QACzB,OAAO;YACL,IAAI,EAAE,uCAAuC;YAC7C,KAAK,EAAE,kEAA+B,CAAC,OAAO;YAC9C,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,8DAA6B,CAAC,YAAY;SACvD,CAAC;IACJ,CAAC;IAEO,QAAQ,CACd,cAAsB,EACtB,IAAY,EACZ,QAAkD;QAElD,OAAO;YACL,eAAe,EAAE,qCAAqC,CAAC,eAAe;YACtE,OAAO,EAAE,sEAAiC,CAAC,QAAQ;YACnD,IAAI,EAAE,IAAI;YACV,cAAc,EAAE,cAAc;YAC9B,cAAc,EAAE,EAAE;YAClB,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,QAAQ;SACnB,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,UAAkB;QACpC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAEO,QAAQ,CAAC,KAAa;QAC5B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;;AAlUH,sFAmUC"}

package/build/_modules/artifact-compiler/index.d.ts

@@ -0,0 +1,6 @@
+export { DyNTS_ArtifactCompiler_ControlService } from './artifact-compiler.control-service';
+export { DyNTS_ArtifactCompileOutcome_Type } from './_enums/artifact-compile-outcome.type-enum';
+export { DyNTS_ArtifactCompileStage_Type } from './_enums/artifact-compile-stage.type-enum';
+export { DyNTS_ArtifactRetryClass_Type } from './_enums/artifact-retry-class.type-enum';
+export { DyNTS_ArtifactCompileFinding_Interface, DyNTS_ArtifactCompileRequest_Interface, DyNTS_ArtifactCompileResult_Interface } from './_models/artifact-compile.interface';
+//# sourceMappingURL=index.d.ts.map

package/build/_modules/artifact-compiler/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/_modules/artifact-compiler/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAChG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sCAAsC,EACtC,sCAAsC,EACtC,qCAAqC,EACtC,MAAM,sCAAsC,CAAC"}

package/build/_modules/artifact-compiler/index.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_ArtifactRetryClass_Type = exports.DyNTS_ArtifactCompileStage_Type = exports.DyNTS_ArtifactCompileOutcome_Type = exports.DyNTS_ArtifactCompiler_ControlService = void 0;
+var artifact_compiler_control_service_1 = require("./artifact-compiler.control-service");
+Object.defineProperty(exports, "DyNTS_ArtifactCompiler_ControlService", { enumerable: true, get: function () { return artifact_compiler_control_service_1.DyNTS_ArtifactCompiler_ControlService; } });
+var artifact_compile_outcome_type_enum_1 = require("./_enums/artifact-compile-outcome.type-enum");
+Object.defineProperty(exports, "DyNTS_ArtifactCompileOutcome_Type", { enumerable: true, get: function () { return artifact_compile_outcome_type_enum_1.DyNTS_ArtifactCompileOutcome_Type; } });
+var artifact_compile_stage_type_enum_1 = require("./_enums/artifact-compile-stage.type-enum");
+Object.defineProperty(exports, "DyNTS_ArtifactCompileStage_Type", { enumerable: true, get: function () { return artifact_compile_stage_type_enum_1.DyNTS_ArtifactCompileStage_Type; } });
+var artifact_retry_class_type_enum_1 = require("./_enums/artifact-retry-class.type-enum");
+Object.defineProperty(exports, "DyNTS_ArtifactRetryClass_Type", { enumerable: true, get: function () { return artifact_retry_class_type_enum_1.DyNTS_ArtifactRetryClass_Type; } });
+//# sourceMappingURL=index.js.map

package/build/_modules/artifact-compiler/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/_modules/artifact-compiler/index.ts"],"names":[],"mappings":";;;AAAA,yFAA4F;AAAnF,0JAAA,qCAAqC,OAAA;AAC9C,kGAAgG;AAAvF,uJAAA,iCAAiC,OAAA;AAC1C,8FAA4F;AAAnF,mJAAA,+BAA+B,OAAA;AACxC,0FAAwF;AAA/E,+IAAA,6BAA6B,OAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@futdevpro/nts-dynamo",
-  "version": "01.15.142",
+  "version": "01.15.144",
   "description": "Dynamic NodeTS (NodeJS-Typescript), MongoDB Backend System Framework by Future Development Program Ltd.",
   "DyBu_settings": {
     "packageType": "server-package",
@@ -224,6 +224,12 @@
       "types": "./build/_modules/privacy-lifecycle/index.d.ts",
       "typings": "./build/_modules/privacy-lifecycle/index.d.ts"
     },
+    "./artifact-compiler": {
+      "default": "./build/_modules/artifact-compiler/index.js",
+      "module": "./build/_modules/artifact-compiler/index.js",
+      "types": "./build/_modules/artifact-compiler/index.d.ts",
+      "typings": "./build/_modules/artifact-compiler/index.d.ts"
+    },
     "./oauth2": {
       "default": "./build/_modules/oauth2/index.js",
       "module": "./build/_modules/oauth2/index.js",
@@ -356,6 +362,9 @@
       "privacy-lifecycle": [
         "build/_modules/privacy-lifecycle/index.d.ts"
       ],
+      "artifact-compiler": [
+        "build/_modules/artifact-compiler/index.d.ts"
+      ],
       "oauth2": [
         "build/_modules/oauth2/index.d.ts"
       ],
@@ -392,6 +401,10 @@
     "@futdevpro/fsm-dynamo": "file:../tgz-collection/dynamo-fsm/futdevpro-fsm-dynamo-01.15.8.tgz",
     "empty": ""
   },
+  "dependencies": {
+    "esbuild": "0.28.2",
+    "typescript": "5.5.4"
+  },
   "peerDependencies": {
     "@anthropic-ai/sdk": "~0.39.0",
     "@modelcontextprotocol/sdk": "~1.29.0",
@@ -441,6 +454,7 @@
     "@types/better-sqlite3": "~7.6.13",
     "better-sqlite3": "~12.4.1",
     "crypto-js": "~4.2.0",
+    "decimal.js": "10.6.0",
     "discord.js": "~14.24.2",
     "eslint": "^9.34.0",
     "eslint-plugin-import": "^2.29.0",
@@ -456,7 +470,6 @@
     "socket.io": "~4.8.1",
     "socket.io-client": "~4.8.1",
     "tslib": "~2.6.2",
-    "typescript": "~5.5.4",
     "husky": "^9.1.7"
   }
 }

package/pnpm-workspace.yaml

@@ -1,5 +1,6 @@
-allowBuilds:
-  '@discordjs/opus': false
-  better-sqlite3: true
+allowBuilds:
+  '@discordjs/opus': false
+  better-sqlite3: true
+  esbuild: true
 minimumReleaseAgeExclude:
   - '@futdevpro/*'

package/src/_modules/artifact-compiler/_enums/artifact-compile-outcome.type-enum.ts

@@ -0,0 +1,5 @@
+/** Terminal result of one deterministic in-memory artifact compilation. */
+export enum DyNTS_ArtifactCompileOutcome_Type {
+  compiled = 'compiled',
+  rejected = 'rejected',
+}

package/src/_modules/artifact-compiler/_enums/artifact-compile-stage.type-enum.ts

@@ -0,0 +1,8 @@
+/** Content-free stage identifiers for artifact compiler findings. */
+export enum DyNTS_ArtifactCompileStage_Type {
+  request = 'request',
+  sourcePolicy = 'source-policy',
+  resolve = 'resolve',
+  compile = 'compile',
+  output = 'output',
+}

package/src/_modules/artifact-compiler/_enums/artifact-retry-class.type-enum.ts

@@ -0,0 +1,6 @@
+/** Stable remediation classification for artifact compiler findings. */
+export enum DyNTS_ArtifactRetryClass_Type {
+  agentFixable = 'agent-fixable',
+  deterministicToolFixable = 'deterministic-tool-fixable',
+  terminal = 'terminal',
+}

package/src/_modules/artifact-compiler/_models/artifact-compile.interface.ts

@@ -0,0 +1,35 @@
+import { DyNTS_ArtifactCompileOutcome_Type } from '../_enums/artifact-compile-outcome.type-enum';
+import { DyNTS_ArtifactCompileStage_Type } from '../_enums/artifact-compile-stage.type-enum';
+import { DyNTS_ArtifactRetryClass_Type } from '../_enums/artifact-retry-class.type-enum';
+
+/** Versioned input for the deterministic TypeScript-to-browser bundle compiler. */
+export interface DyNTS_ArtifactCompileRequest_Interface {
+  contractVersion: 'dynts-artifact-compiler/1';
+  source: string;
+  sourceFileName: string;
+  resolveDirectory: string;
+  allowedPackages: string[];
+  maxSourceBytes: number;
+  maxOutputBytes: number;
+}
+
+/** Content-free compiler finding. Source text and dependency paths are deliberately excluded. */
+export interface DyNTS_ArtifactCompileFinding_Interface {
+  code: string;
+  stage: DyNTS_ArtifactCompileStage_Type;
+  line: number | null;
+  column: number | null;
+  retryClass: DyNTS_ArtifactRetryClass_Type;
+}
+
+/** One self-contained JavaScript output or a fail-closed, content-free rejection. */
+export interface DyNTS_ArtifactCompileResult_Interface {
+  contractVersion: 'dynts-artifact-compiler/1';
+  outcome: DyNTS_ArtifactCompileOutcome_Type;
+  code: string;
+  sourceChecksum: string;
+  bundleChecksum: string;
+  outputBytes: number;
+  bundleSource: string | null;
+  findings: DyNTS_ArtifactCompileFinding_Interface[];
+}

package/src/_modules/artifact-compiler/artifact-compiler.control-service.spec.ts

@@ -0,0 +1,151 @@
+import path from 'node:path';
+
+import { DyNTS_ArtifactCompileOutcome_Type } from './_enums/artifact-compile-outcome.type-enum';
+import {
+  DyNTS_ArtifactCompileRequest_Interface,
+  DyNTS_ArtifactCompileResult_Interface
+} from './_models/artifact-compile.interface';
+import { DyNTS_ArtifactCompiler_ControlService } from './artifact-compiler.control-service';
+
+describe('| DyNTS_ArtifactCompiler_ControlService', (): void => {
+  const compiler_CS: DyNTS_ArtifactCompiler_ControlService = new DyNTS_ArtifactCompiler_ControlService();
+
+  it('| emits one deterministic self-contained classic-worker bundle without filesystem output', async (
+  ): Promise<void> => {
+    const request: DyNTS_ArtifactCompileRequest_Interface = buildRequest(workerSource());
+    const first: DyNTS_ArtifactCompileResult_Interface = await compiler_CS.compile(request);
+    const second: DyNTS_ArtifactCompileResult_Interface = await compiler_CS.compile(request);
+
+    expect(first.outcome).toBe(DyNTS_ArtifactCompileOutcome_Type.compiled);
+    expect(first.bundleSource).toContain('self.onmessage');
+    expect(first.bundleSource).not.toContain('sourceMappingURL');
+    expect(first.bundleSource).not.toContain('dynts-in-memory-output');
+    expect(first.bundleChecksum).toMatch(/^[a-f0-9]{64}$/);
+    expect(first.outputBytes).toBeGreaterThan(0);
+    expect(second).toEqual(first);
+  });
+
+  it('| bundles an explicitly allowed installed package into the output', async (): Promise<void> => {
+    const source: string = `import Decimal from 'decimal.js';
+self.onmessage = (): void => {
+  const value: string = new Decimal(1).plus(2).toString();
+  const output: ArrayBuffer = new TextEncoder().encode(value).buffer;
+  self.postMessage({ type: 'complete', output: output }, [ output ]);
+};`;
+    const request: DyNTS_ArtifactCompileRequest_Interface = buildRequest(source);
+
+    request.allowedPackages = [ 'decimal.js' ];
+
+    const result: DyNTS_ArtifactCompileResult_Interface = await compiler_CS.compile(request);
+
+    expect(result.outcome).toBe(DyNTS_ArtifactCompileOutcome_Type.compiled);
+    expect(result.bundleSource).not.toContain('from\'decimal.js\'');
+    expect(result.outputBytes).toBeGreaterThan(1_000);
+  });
+
+  it('| rejects non-allowlisted direct imports without reflecting the source canary', async (): Promise<void> => {
+    const canary: string = 'SOURCE-CANARY-MUST-NOT-RETURN';
+    const request: DyNTS_ArtifactCompileRequest_Interface = buildRequest(
+      `import fs from 'node:fs';\nconst secret = '${canary}';\n${workerSource()}`
+    );
+    const result: DyNTS_ArtifactCompileResult_Interface = await compiler_CS.compile(request);
+
+    expect(result.outcome).toBe(DyNTS_ArtifactCompileOutcome_Type.rejected);
+    expect(result.findings[0].code).toBe('DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED');
+    expect(JSON.stringify(result)).not.toContain(canary);
+    expect(result.bundleSource).toBeNull();
+  });
+
+  it('| rejects re-exports, import-equals, require and dynamic import syntax before bundling', async (
+  ): Promise<void> => {
+    const sources: string[] = [
+      'export { readFile } from \'node:fs\';',
+      'import fs = require(\'node:fs\');',
+      'const fs = require(\'node:fs\');',
+      'void import(\'decimal.js\');',
+    ];
+
+    for (const source of sources) {
+      const result: DyNTS_ArtifactCompileResult_Interface = await compiler_CS.compile(buildRequest(source));
+
+      expect(result.code).toBe('DYNTS|ARTIFACT_COMPILER|IMPORT_REJECTED');
+      expect(result.findings[0].stage).toBe('source-policy');
+    }
+  });
+
+  it('| returns content-free compile diagnostics for invalid TypeScript', async (): Promise<void> => {
+    const canary: string = 'INVALID-CANARY-MUST-NOT-RETURN';
+    const result: DyNTS_ArtifactCompileResult_Interface = await compiler_CS.compile(
+      buildRequest(`const ${canary}: = ;`)
+    );
+
+    expect(result.outcome).toBe(DyNTS_ArtifactCompileOutcome_Type.rejected);
+    expect(result.findings[0].code).toBe('DYNTS|ARTIFACT_COMPILER|COMPILE_ERROR');
+    expect(result.findings[0].line).toBe(1);
+    expect(JSON.stringify(result)).not.toContain(canary);
+  });
+
+  it('| rejects invalid contracts, duplicate packages and unsafe resolve inputs', async (): Promise<void> => {
+    const request: DyNTS_ArtifactCompileRequest_Interface = buildRequest(workerSource());
+
+    request.allowedPackages = [ 'decimal.js', 'decimal.js' ];
+    request.resolveDirectory = 'relative/path';
+    request.maxOutputBytes = 20_000_000;
+
+    const result: DyNTS_ArtifactCompileResult_Interface = await compiler_CS.compile(request);
+
+    expect(result.code).toBe('DYNTS|ARTIFACT_COMPILER|REQUEST_INVALID');
+    expect(result.findings[0].stage).toBe('request');
+  });
+
+  it('| bounds allowlist cardinality and request path lengths', async (): Promise<void> => {
+    const packageLimited: DyNTS_ArtifactCompileRequest_Interface = buildRequest(workerSource());
+    const pathLimited: DyNTS_ArtifactCompileRequest_Interface = buildRequest(workerSource());
+
+    packageLimited.allowedPackages = Array.from({ length: 65 }, (_value: unknown, index: number): string =>
+      `package-${index}`);
+    pathLimited.sourceFileName = `${'a'.repeat(128)}.ts`;
+
+    const packageResult: DyNTS_ArtifactCompileResult_Interface = await compiler_CS.compile(packageLimited);
+    const pathResult: DyNTS_ArtifactCompileResult_Interface = await compiler_CS.compile(pathLimited);
+
+    expect(packageResult.code).toBe('DYNTS|ARTIFACT_COMPILER|REQUEST_INVALID');
+    expect(pathResult.code).toBe('DYNTS|ARTIFACT_COMPILER|REQUEST_INVALID');
+  });
+
+  it('| enforces source and output byte budgets before returning bundle content', async (): Promise<void> => {
+    const sourceLimited: DyNTS_ArtifactCompileRequest_Interface = buildRequest(workerSource());
+    const outputLimited: DyNTS_ArtifactCompileRequest_Interface = buildRequest(workerSource());
+
+    sourceLimited.maxSourceBytes = 1;
+    outputLimited.maxOutputBytes = 1;
+
+    const sourceResult: DyNTS_ArtifactCompileResult_Interface = await compiler_CS.compile(sourceLimited);
+    const outputResult: DyNTS_ArtifactCompileResult_Interface = await compiler_CS.compile(outputLimited);
+
+    expect(sourceResult.code).toBe('DYNTS|ARTIFACT_COMPILER|REQUEST_INVALID');
+    expect(outputResult.code).toBe('DYNTS|ARTIFACT_COMPILER|OUTPUT_LIMIT');
+    expect(outputResult.bundleSource).toBeNull();
+  });
+
+  /** Builds a valid request resolved against this package's installed dependencies. */
+  function buildRequest(source: string): DyNTS_ArtifactCompileRequest_Interface {
+    return {
+      contractVersion: 'dynts-artifact-compiler/1',
+      source: source,
+      sourceFileName: 'candidate.ts',
+      resolveDirectory: path.resolve(process.cwd()),
+      allowedPackages: [],
+      maxSourceBytes: 512_000,
+      maxOutputBytes: 8_000_000,
+    };
+  }
+
+  /** Returns a minimal classic Worker contract. */
+  function workerSource(): string {
+    return `self.onmessage = (event: MessageEvent<{ input: ArrayBuffer }>): void => {
+  const output: ArrayBuffer = event.data.input;
+  self.postMessage({ type: 'complete', output: output }, [ output ]);
+};`;
+  }
+});

package/src/_modules/artifact-compiler/artifact-compiler.control-service.ts

@@ -0,0 +1,356 @@
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+
+import {
+  BuildFailure,
+  BuildOptions,
+  BuildResult,
+  Message,
+  OnLoadResult,
+  OnResolveArgs,
+  OnResolveResult,
+  OutputFile,
+  Plugin,
+  PluginBuild,
+  build
+} from 'esbuild';
+import ts from 'typescript';
+
+import { DyNTS_ArtifactCompileOutcome_Type } from './_enums/artifact-compile-outcome.type-enum';
+import { DyNTS_ArtifactCompileStage_Type } from './_enums/artifact-compile-stage.type-enum';
+import { DyNTS_ArtifactRetryClass_Type } from './_enums/artifact-retry-class.type-enum';
+import {
+  DyNTS_ArtifactCompileFinding_Interface,
+  DyNTS_ArtifactCompileRequest_Interface,
+  DyNTS_ArtifactCompileResult_Interface
+} from './_models/artifact-compile.interface';
+
+/**
+ * Deterministically bundles one in-memory TypeScript program for a classic browser Worker.
+ * This compiler is not a sandbox: consumers must validate source policy before compilation and execute the result
+ * inside a separately enforced runtime boundary.
+ */
+export class DyNTS_ArtifactCompiler_ControlService {
+  public static readonly contractVersion: 'dynts-artifact-compiler/1' = 'dynts-artifact-compiler/1';
+  private readonly absoluteMaxSourceBytes: number = 1_048_576;
+  private readonly absoluteMaxOutputBytes: number = 16_777_216;
+  private readonly absoluteMaxAllowedPackages: number = 64;
+  private readonly absoluteMaxPackageNameLength: number = 128;
+  private readonly absoluteMaxSourceFileNameLength: number = 128;
+  private readonly absoluteMaxResolveDirectoryLength: number = 1_024;
+  private readonly packageNamePattern: RegExp =
+    /^(?:@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*|[a-z0-9][a-z0-9._-]*)$/;
+  private readonly sourceFileNamePattern: RegExp = /^[a-z0-9][a-z0-9._-]*\.ts$/;
+
+  /** Compiles without writing source, sourcemaps, metadata or output files to disk. */
+  public async compile(
+    request: DyNTS_ArtifactCompileRequest_Interface
+  ): Promise<DyNTS_ArtifactCompileResult_Interface> {
+    const sourceChecksum: string = this.checksum(typeof request?.source === 'string' ? request.source : '');
+    const requestFinding: DyNTS_ArtifactCompileFinding_Interface | null = this.validateRequest(request);
+
+    if (requestFinding) {
+      return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|REQUEST_INVALID', [ requestFinding ]);
+    }
+
+    const importFinding: DyNTS_ArtifactCompileFinding_Interface | null = this.validateDirectImports(request);
+
+    if (importFinding) {
+      return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|IMPORT_REJECTED', [ importFinding ]);
+    }
+
+    try {
+      const result: BuildResult = await build(this.buildOptions(request));
+      const outputFiles: OutputFile[] = result.outputFiles ?? [];
+
+      if (outputFiles.length !== 1 || !outputFiles[0].path.endsWith('.js')) {
+        return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|OUTPUT_INVALID', [{
+          code: 'DYNTS|ARTIFACT_COMPILER|OUTPUT_COUNT',
+          stage: DyNTS_ArtifactCompileStage_Type.output,
+          line: null,
+          column: null,
+          retryClass: DyNTS_ArtifactRetryClass_Type.deterministicToolFixable,
+        }]);
+      }
+
+      const bundleSource: string = outputFiles[0].text;
+      const outputBytes: number = Buffer.byteLength(bundleSource, 'utf8');
+
+      if (!outputBytes || outputBytes > request.maxOutputBytes) {
+        return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|OUTPUT_LIMIT', [{
+          code: 'DYNTS|ARTIFACT_COMPILER|OUTPUT_SIZE',
+          stage: DyNTS_ArtifactCompileStage_Type.output,
+          line: null,
+          column: null,
+          retryClass: DyNTS_ArtifactRetryClass_Type.agentFixable,
+        }]);
+      }
+
+      return {
+        contractVersion: DyNTS_ArtifactCompiler_ControlService.contractVersion,
+        outcome: DyNTS_ArtifactCompileOutcome_Type.compiled,
+        code: 'DYNTS|ARTIFACT_COMPILER|COMPILED',
+        sourceChecksum: sourceChecksum,
+        bundleChecksum: this.checksum(bundleSource),
+        outputBytes: outputBytes,
+        bundleSource: bundleSource,
+        findings: [],
+      };
+    } catch (error: unknown) {
+      return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|BUILD_FAILED', this.buildFindings(error));
+    }
+  }
+
+  private validateRequest(
+    request: DyNTS_ArtifactCompileRequest_Interface
+  ): DyNTS_ArtifactCompileFinding_Interface | null {
+    const sourceBytes: number = typeof request?.source === 'string'
+      ? Buffer.byteLength(request.source, 'utf8')
+      : 0;
+    const allowedPackages: string[] = Array.isArray(request?.allowedPackages) ? request.allowedPackages : [];
+    const uniquePackages: Set<string> = new Set<string>(allowedPackages);
+    const isPackageSetValid: boolean = allowedPackages.length <= this.absoluteMaxAllowedPackages
+      && uniquePackages.size === allowedPackages.length
+      && allowedPackages.every((packageName: string): boolean => packageName.length <= this.absoluteMaxPackageNameLength
+        && this.packageNamePattern.test(packageName));
+
+    if (
+      request?.contractVersion !== DyNTS_ArtifactCompiler_ControlService.contractVersion
+      || !sourceBytes
+      || !Number.isInteger(request.maxSourceBytes)
+      || request.maxSourceBytes < 1
+      || request.maxSourceBytes > this.absoluteMaxSourceBytes
+      || sourceBytes > request.maxSourceBytes
+      || !Number.isInteger(request.maxOutputBytes)
+      || request.maxOutputBytes < 1
+      || request.maxOutputBytes > this.absoluteMaxOutputBytes
+      || typeof request.sourceFileName !== 'string'
+      || request.sourceFileName.length > this.absoluteMaxSourceFileNameLength
+      || !this.sourceFileNamePattern.test(request.sourceFileName)
+      || typeof request.resolveDirectory !== 'string'
+      || request.resolveDirectory.length > this.absoluteMaxResolveDirectoryLength
+      || !path.isAbsolute(request.resolveDirectory)
+      || !isPackageSetValid
+    ) {
+      return {
+        code: 'DYNTS|ARTIFACT_COMPILER|REQUEST_CONTRACT',
+        stage: DyNTS_ArtifactCompileStage_Type.request,
+        line: null,
+        column: null,
+        retryClass: DyNTS_ArtifactRetryClass_Type.deterministicToolFixable,
+      };
+    }
+
+    return null;
+  }
+
+  private buildOptions(request: DyNTS_ArtifactCompileRequest_Interface): BuildOptions {
+    return {
+      absWorkingDir: request.resolveDirectory,
+      bundle: true,
+      charset: 'utf8',
+      conditions: [ 'browser', 'default' ],
+      entryPoints: [ 'dynts-entry:candidate' ],
+      format: 'iife',
+      legalComments: 'none',
+      logLevel: 'silent',
+      mainFields: [ 'browser', 'module', 'main' ],
+      metafile: false,
+      minify: true,
+      outdir: 'dynts-in-memory-output',
+      platform: 'browser',
+      plugins: [ this.allowlistedEntryPlugin(request) ],
+      sourcemap: false,
+      target: [ 'es2022' ],
+      treeShaking: true,
+      write: false,
+    };
+  }
+
+  /**
+   * Validates every syntactic import before esbuild can tree-shake it. The plugin below is a second resolution gate,
+   * but it cannot be the only policy boundary because unused imports need not reach package resolution.
+   */
+  private validateDirectImports(
+    request: DyNTS_ArtifactCompileRequest_Interface
+  ): DyNTS_ArtifactCompileFinding_Interface | null {
+    const sourceFile: ts.SourceFile = ts.createSourceFile(
+      request.sourceFileName,
+      request.source,
+      ts.ScriptTarget.ES2022,
+      true,
+      ts.ScriptKind.TS
+    );
+    const allowedPackages: ReadonlySet<string> = new Set<string>(request.allowedPackages);
+    let finding: DyNTS_ArtifactCompileFinding_Interface | null = null;
+
+    /** Traverses the parsed source once and stops at the first forbidden module load. */
+    const inspectNode: (node: ts.Node) => void = (node: ts.Node): void => {
+      if (finding) {
+        return;
+      }
+
+      const moduleName: string | null = this.moduleName(node);
+
+      if (moduleName !== null && !allowedPackages.has(this.packageRoot(moduleName))) {
+        finding = this.importFinding(sourceFile, node);
+
+        return;
+      }
+
+      if (this.isDynamicModuleLoad(node)) {
+        finding = this.importFinding(sourceFile, node);
+
+        return;
+      }
+
+      ts.forEachChild(node, inspectNode);
+    };
+
+    inspectNode(sourceFile);
+
+    return finding;
+  }
+
+  private moduleName(node: ts.Node): string | null {
+    if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier) {
+      return ts.isStringLiteral(node.moduleSpecifier) ? node.moduleSpecifier.text : '';
+    }
+
+    if (
+      ts.isImportEqualsDeclaration(node)
+      && ts.isExternalModuleReference(node.moduleReference)
+      && node.moduleReference.expression
+    ) {
+      return ts.isStringLiteral(node.moduleReference.expression) ? node.moduleReference.expression.text : '';
+    }
+
+    return null;
+  }
+
+  private isDynamicModuleLoad(node: ts.Node): boolean {
+    return ts.isCallExpression(node)
+      && (node.expression.kind === ts.SyntaxKind.ImportKeyword
+        || (ts.isIdentifier(node.expression) && node.expression.text === 'require'));
+  }
+
+  private importFinding(
+    sourceFile: ts.SourceFile,
+    node: ts.Node
+  ): DyNTS_ArtifactCompileFinding_Interface {
+    const location: ts.LineAndCharacter = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+
+    return {
+      code: 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED',
+      stage: DyNTS_ArtifactCompileStage_Type.sourcePolicy,
+      line: location.line + 1,
+      column: location.character + 1,
+      retryClass: DyNTS_ArtifactRetryClass_Type.terminal,
+    };
+  }
+
+  private allowlistedEntryPlugin(request: DyNTS_ArtifactCompileRequest_Interface): Plugin {
+    const allowedPackages: ReadonlySet<string> = new Set<string>(request.allowedPackages);
+
+    return {
+      name: 'dynts-allowlisted-in-memory-entry',
+      setup: (pluginBuild: PluginBuild): void => {
+        pluginBuild.onResolve({ filter: /^dynts-entry:candidate$/ }, (): OnResolveResult => ({
+          path: 'candidate',
+          namespace: 'dynts-entry',
+        }));
+        pluginBuild.onLoad({ filter: /^candidate$/, namespace: 'dynts-entry' }, (): OnLoadResult => ({
+          contents: request.source,
+          loader: 'ts',
+          resolveDir: request.resolveDirectory,
+        }));
+        pluginBuild.onResolve({ filter: /.*/, namespace: 'dynts-entry' }, async (
+          args: OnResolveArgs
+        ): Promise<OnResolveResult> => {
+          if (!allowedPackages.has(this.packageRoot(args.path))) {
+            return {
+              errors: [{ text: 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED' }],
+            };
+          }
+
+          return pluginBuild.resolve(args.path, {
+            importer: args.importer,
+            kind: args.kind,
+            namespace: 'file',
+            resolveDir: request.resolveDirectory,
+          });
+        });
+      },
+    };
+  }
+
+  private buildFindings(error: unknown): DyNTS_ArtifactCompileFinding_Interface[] {
+    if (!this.isBuildFailure(error)) {
+      return [ this.genericBuildFinding() ];
+    }
+
+    const findings: DyNTS_ArtifactCompileFinding_Interface[] = error.errors.map((message: Message):
+      DyNTS_ArtifactCompileFinding_Interface => ({
+      code: message.text === 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED'
+        ? message.text
+        : 'DYNTS|ARTIFACT_COMPILER|COMPILE_ERROR',
+      stage: message.text === 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED'
+        ? DyNTS_ArtifactCompileStage_Type.resolve
+        : DyNTS_ArtifactCompileStage_Type.compile,
+      line: message.location?.line ?? null,
+      column: message.location ? message.location.column + 1 : null,
+      retryClass: message.text === 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED'
+        ? DyNTS_ArtifactRetryClass_Type.terminal
+        : DyNTS_ArtifactRetryClass_Type.agentFixable,
+    }));
+
+    return findings.length ? findings : [ this.genericBuildFinding() ];
+  }
+
+  private isBuildFailure(error: unknown): error is BuildFailure {
+    if (!error || typeof error !== 'object') {
+      return false;
+    }
+
+    return 'errors' in error && Array.isArray(error.errors);
+  }
+
+  private genericBuildFinding(): DyNTS_ArtifactCompileFinding_Interface {
+    return {
+      code: 'DYNTS|ARTIFACT_COMPILER|COMPILE_ERROR',
+      stage: DyNTS_ArtifactCompileStage_Type.compile,
+      line: null,
+      column: null,
+      retryClass: DyNTS_ArtifactRetryClass_Type.agentFixable,
+    };
+  }
+
+  private rejected(
+    sourceChecksum: string,
+    code: string,
+    findings: DyNTS_ArtifactCompileFinding_Interface[]
+  ): DyNTS_ArtifactCompileResult_Interface {
+    return {
+      contractVersion: DyNTS_ArtifactCompiler_ControlService.contractVersion,
+      outcome: DyNTS_ArtifactCompileOutcome_Type.rejected,
+      code: code,
+      sourceChecksum: sourceChecksum,
+      bundleChecksum: '',
+      outputBytes: 0,
+      bundleSource: null,
+      findings: findings,
+    };
+  }
+
+  private packageRoot(moduleName: string): string {
+    if (moduleName.startsWith('@')) {
+      return moduleName.split('/').slice(0, 2).join('/');
+    }
+
+    return moduleName.split('/')[0];
+  }
+
+  private checksum(value: string): string {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+  }
+}

package/src/_modules/artifact-compiler/index.ts

@@ -0,0 +1,9 @@
+export { DyNTS_ArtifactCompiler_ControlService } from './artifact-compiler.control-service';
+export { DyNTS_ArtifactCompileOutcome_Type } from './_enums/artifact-compile-outcome.type-enum';
+export { DyNTS_ArtifactCompileStage_Type } from './_enums/artifact-compile-stage.type-enum';
+export { DyNTS_ArtifactRetryClass_Type } from './_enums/artifact-retry-class.type-enum';
+export {
+  DyNTS_ArtifactCompileFinding_Interface,
+  DyNTS_ArtifactCompileRequest_Interface,
+  DyNTS_ArtifactCompileResult_Interface
+} from './_models/artifact-compile.interface';