@futdevpro/nts-dynamo 1.15.151 → 1.15.154

package/src/_modules/artifact-compiler/artifact-compiler.control-service.ts

@@ -1,356 +1,356 @@
-import { createHash } from 'node:crypto';
-import path from 'node:path';
-
-import {
-  BuildFailure,
-  BuildOptions,
-  BuildResult,
-  Message,
-  OnLoadResult,
-  OnResolveArgs,
-  OnResolveResult,
-  OutputFile,
-  Plugin,
-  PluginBuild,
-  build
-} from 'esbuild';
-import ts from 'typescript';
-
-import { DyNTS_ArtifactCompileOutcome_Type } from './_enums/artifact-compile-outcome.type-enum';
-import { DyNTS_ArtifactCompileStage_Type } from './_enums/artifact-compile-stage.type-enum';
-import { DyNTS_ArtifactRetryClass_Type } from './_enums/artifact-retry-class.type-enum';
-import {
-  DyNTS_ArtifactCompileFinding_Interface,
-  DyNTS_ArtifactCompileRequest_Interface,
-  DyNTS_ArtifactCompileResult_Interface
-} from './_models/artifact-compile.interface';
-
-/**
- * Deterministically bundles one in-memory TypeScript program for a classic browser Worker.
- * This compiler is not a sandbox: consumers must validate source policy before compilation and execute the result
- * inside a separately enforced runtime boundary.
- */
-export class DyNTS_ArtifactCompiler_ControlService {
-  public static readonly contractVersion: 'dynts-artifact-compiler/1' = 'dynts-artifact-compiler/1';
-  private readonly absoluteMaxSourceBytes: number = 1_048_576;
-  private readonly absoluteMaxOutputBytes: number = 16_777_216;
-  private readonly absoluteMaxAllowedPackages: number = 64;
-  private readonly absoluteMaxPackageNameLength: number = 128;
-  private readonly absoluteMaxSourceFileNameLength: number = 128;
-  private readonly absoluteMaxResolveDirectoryLength: number = 1_024;
-  private readonly packageNamePattern: RegExp =
-    /^(?:@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*|[a-z0-9][a-z0-9._-]*)$/;
-  private readonly sourceFileNamePattern: RegExp = /^[a-z0-9][a-z0-9._-]*\.ts$/;
-
-  /** Compiles without writing source, sourcemaps, metadata or output files to disk. */
-  public async compile(
-    request: DyNTS_ArtifactCompileRequest_Interface
-  ): Promise<DyNTS_ArtifactCompileResult_Interface> {
-    const sourceChecksum: string = this.checksum(typeof request?.source === 'string' ? request.source : '');
-    const requestFinding: DyNTS_ArtifactCompileFinding_Interface | null = this.validateRequest(request);
-
-    if (requestFinding) {
-      return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|REQUEST_INVALID', [ requestFinding ]);
-    }
-
-    const importFinding: DyNTS_ArtifactCompileFinding_Interface | null = this.validateDirectImports(request);
-
-    if (importFinding) {
-      return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|IMPORT_REJECTED', [ importFinding ]);
-    }
-
-    try {
-      const result: BuildResult = await build(this.buildOptions(request));
-      const outputFiles: OutputFile[] = result.outputFiles ?? [];
-
-      if (outputFiles.length !== 1 || !outputFiles[0].path.endsWith('.js')) {
-        return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|OUTPUT_INVALID', [{
-          code: 'DYNTS|ARTIFACT_COMPILER|OUTPUT_COUNT',
-          stage: DyNTS_ArtifactCompileStage_Type.output,
-          line: null,
-          column: null,
-          retryClass: DyNTS_ArtifactRetryClass_Type.deterministicToolFixable,
-        }]);
-      }
-
-      const bundleSource: string = outputFiles[0].text;
-      const outputBytes: number = Buffer.byteLength(bundleSource, 'utf8');
-
-      if (!outputBytes || outputBytes > request.maxOutputBytes) {
-        return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|OUTPUT_LIMIT', [{
-          code: 'DYNTS|ARTIFACT_COMPILER|OUTPUT_SIZE',
-          stage: DyNTS_ArtifactCompileStage_Type.output,
-          line: null,
-          column: null,
-          retryClass: DyNTS_ArtifactRetryClass_Type.agentFixable,
-        }]);
-      }
-
-      return {
-        contractVersion: DyNTS_ArtifactCompiler_ControlService.contractVersion,
-        outcome: DyNTS_ArtifactCompileOutcome_Type.compiled,
-        code: 'DYNTS|ARTIFACT_COMPILER|COMPILED',
-        sourceChecksum: sourceChecksum,
-        bundleChecksum: this.checksum(bundleSource),
-        outputBytes: outputBytes,
-        bundleSource: bundleSource,
-        findings: [],
-      };
-    } catch (error: unknown) {
-      return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|BUILD_FAILED', this.buildFindings(error));
-    }
-  }
-
-  private validateRequest(
-    request: DyNTS_ArtifactCompileRequest_Interface
-  ): DyNTS_ArtifactCompileFinding_Interface | null {
-    const sourceBytes: number = typeof request?.source === 'string'
-      ? Buffer.byteLength(request.source, 'utf8')
-      : 0;
-    const allowedPackages: string[] = Array.isArray(request?.allowedPackages) ? request.allowedPackages : [];
-    const uniquePackages: Set<string> = new Set<string>(allowedPackages);
-    const isPackageSetValid: boolean = allowedPackages.length <= this.absoluteMaxAllowedPackages
-      && uniquePackages.size === allowedPackages.length
-      && allowedPackages.every((packageName: string): boolean => packageName.length <= this.absoluteMaxPackageNameLength
-        && this.packageNamePattern.test(packageName));
-
-    if (
-      request?.contractVersion !== DyNTS_ArtifactCompiler_ControlService.contractVersion
-      || !sourceBytes
-      || !Number.isInteger(request.maxSourceBytes)
-      || request.maxSourceBytes < 1
-      || request.maxSourceBytes > this.absoluteMaxSourceBytes
-      || sourceBytes > request.maxSourceBytes
-      || !Number.isInteger(request.maxOutputBytes)
-      || request.maxOutputBytes < 1
-      || request.maxOutputBytes > this.absoluteMaxOutputBytes
-      || typeof request.sourceFileName !== 'string'
-      || request.sourceFileName.length > this.absoluteMaxSourceFileNameLength
-      || !this.sourceFileNamePattern.test(request.sourceFileName)
-      || typeof request.resolveDirectory !== 'string'
-      || request.resolveDirectory.length > this.absoluteMaxResolveDirectoryLength
-      || !path.isAbsolute(request.resolveDirectory)
-      || !isPackageSetValid
-    ) {
-      return {
-        code: 'DYNTS|ARTIFACT_COMPILER|REQUEST_CONTRACT',
-        stage: DyNTS_ArtifactCompileStage_Type.request,
-        line: null,
-        column: null,
-        retryClass: DyNTS_ArtifactRetryClass_Type.deterministicToolFixable,
-      };
-    }
-
-    return null;
-  }
-
-  private buildOptions(request: DyNTS_ArtifactCompileRequest_Interface): BuildOptions {
-    return {
-      absWorkingDir: request.resolveDirectory,
-      bundle: true,
-      charset: 'utf8',
-      conditions: [ 'browser', 'default' ],
-      entryPoints: [ 'dynts-entry:candidate' ],
-      format: 'iife',
-      legalComments: 'none',
-      logLevel: 'silent',
-      mainFields: [ 'browser', 'module', 'main' ],
-      metafile: false,
-      minify: true,
-      outdir: 'dynts-in-memory-output',
-      platform: 'browser',
-      plugins: [ this.allowlistedEntryPlugin(request) ],
-      sourcemap: false,
-      target: [ 'es2022' ],
-      treeShaking: true,
-      write: false,
-    };
-  }
-
-  /**
-   * Validates every syntactic import before esbuild can tree-shake it. The plugin below is a second resolution gate,
-   * but it cannot be the only policy boundary because unused imports need not reach package resolution.
-   */
-  private validateDirectImports(
-    request: DyNTS_ArtifactCompileRequest_Interface
-  ): DyNTS_ArtifactCompileFinding_Interface | null {
-    const sourceFile: ts.SourceFile = ts.createSourceFile(
-      request.sourceFileName,
-      request.source,
-      ts.ScriptTarget.ES2022,
-      true,
-      ts.ScriptKind.TS
-    );
-    const allowedPackages: ReadonlySet<string> = new Set<string>(request.allowedPackages);
-    let finding: DyNTS_ArtifactCompileFinding_Interface | null = null;
-
-    /** Traverses the parsed source once and stops at the first forbidden module load. */
-    const inspectNode: (node: ts.Node) => void = (node: ts.Node): void => {
-      if (finding) {
-        return;
-      }
-
-      const moduleName: string | null = this.moduleName(node);
-
-      if (moduleName !== null && !allowedPackages.has(this.packageRoot(moduleName))) {
-        finding = this.importFinding(sourceFile, node);
-
-        return;
-      }
-
-      if (this.isDynamicModuleLoad(node)) {
-        finding = this.importFinding(sourceFile, node);
-
-        return;
-      }
-
-      ts.forEachChild(node, inspectNode);
-    };
-
-    inspectNode(sourceFile);
-
-    return finding;
-  }
-
-  private moduleName(node: ts.Node): string | null {
-    if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier) {
-      return ts.isStringLiteral(node.moduleSpecifier) ? node.moduleSpecifier.text : '';
-    }
-
-    if (
-      ts.isImportEqualsDeclaration(node)
-      && ts.isExternalModuleReference(node.moduleReference)
-      && node.moduleReference.expression
-    ) {
-      return ts.isStringLiteral(node.moduleReference.expression) ? node.moduleReference.expression.text : '';
-    }
-
-    return null;
-  }
-
-  private isDynamicModuleLoad(node: ts.Node): boolean {
-    return ts.isCallExpression(node)
-      && (node.expression.kind === ts.SyntaxKind.ImportKeyword
-        || (ts.isIdentifier(node.expression) && node.expression.text === 'require'));
-  }
-
-  private importFinding(
-    sourceFile: ts.SourceFile,
-    node: ts.Node
-  ): DyNTS_ArtifactCompileFinding_Interface {
-    const location: ts.LineAndCharacter = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
-
-    return {
-      code: 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED',
-      stage: DyNTS_ArtifactCompileStage_Type.sourcePolicy,
-      line: location.line + 1,
-      column: location.character + 1,
-      retryClass: DyNTS_ArtifactRetryClass_Type.terminal,
-    };
-  }
-
-  private allowlistedEntryPlugin(request: DyNTS_ArtifactCompileRequest_Interface): Plugin {
-    const allowedPackages: ReadonlySet<string> = new Set<string>(request.allowedPackages);
-
-    return {
-      name: 'dynts-allowlisted-in-memory-entry',
-      setup: (pluginBuild: PluginBuild): void => {
-        pluginBuild.onResolve({ filter: /^dynts-entry:candidate$/ }, (): OnResolveResult => ({
-          path: 'candidate',
-          namespace: 'dynts-entry',
-        }));
-        pluginBuild.onLoad({ filter: /^candidate$/, namespace: 'dynts-entry' }, (): OnLoadResult => ({
-          contents: request.source,
-          loader: 'ts',
-          resolveDir: request.resolveDirectory,
-        }));
-        pluginBuild.onResolve({ filter: /.*/, namespace: 'dynts-entry' }, async (
-          args: OnResolveArgs
-        ): Promise<OnResolveResult> => {
-          if (!allowedPackages.has(this.packageRoot(args.path))) {
-            return {
-              errors: [{ text: 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED' }],
-            };
-          }
-
-          return pluginBuild.resolve(args.path, {
-            importer: args.importer,
-            kind: args.kind,
-            namespace: 'file',
-            resolveDir: request.resolveDirectory,
-          });
-        });
-      },
-    };
-  }
-
-  private buildFindings(error: unknown): DyNTS_ArtifactCompileFinding_Interface[] {
-    if (!this.isBuildFailure(error)) {
-      return [ this.genericBuildFinding() ];
-    }
-
-    const findings: DyNTS_ArtifactCompileFinding_Interface[] = error.errors.map((message: Message):
-      DyNTS_ArtifactCompileFinding_Interface => ({
-      code: message.text === 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED'
-        ? message.text
-        : 'DYNTS|ARTIFACT_COMPILER|COMPILE_ERROR',
-      stage: message.text === 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED'
-        ? DyNTS_ArtifactCompileStage_Type.resolve
-        : DyNTS_ArtifactCompileStage_Type.compile,
-      line: message.location?.line ?? null,
-      column: message.location ? message.location.column + 1 : null,
-      retryClass: message.text === 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED'
-        ? DyNTS_ArtifactRetryClass_Type.terminal
-        : DyNTS_ArtifactRetryClass_Type.agentFixable,
-    }));
-
-    return findings.length ? findings : [ this.genericBuildFinding() ];
-  }
-
-  private isBuildFailure(error: unknown): error is BuildFailure {
-    if (!error || typeof error !== 'object') {
-      return false;
-    }
-
-    return 'errors' in error && Array.isArray(error.errors);
-  }
-
-  private genericBuildFinding(): DyNTS_ArtifactCompileFinding_Interface {
-    return {
-      code: 'DYNTS|ARTIFACT_COMPILER|COMPILE_ERROR',
-      stage: DyNTS_ArtifactCompileStage_Type.compile,
-      line: null,
-      column: null,
-      retryClass: DyNTS_ArtifactRetryClass_Type.agentFixable,
-    };
-  }
-
-  private rejected(
-    sourceChecksum: string,
-    code: string,
-    findings: DyNTS_ArtifactCompileFinding_Interface[]
-  ): DyNTS_ArtifactCompileResult_Interface {
-    return {
-      contractVersion: DyNTS_ArtifactCompiler_ControlService.contractVersion,
-      outcome: DyNTS_ArtifactCompileOutcome_Type.rejected,
-      code: code,
-      sourceChecksum: sourceChecksum,
-      bundleChecksum: '',
-      outputBytes: 0,
-      bundleSource: null,
-      findings: findings,
-    };
-  }
-
-  private packageRoot(moduleName: string): string {
-    if (moduleName.startsWith('@')) {
-      return moduleName.split('/').slice(0, 2).join('/');
-    }
-
-    return moduleName.split('/')[0];
-  }
-
-  private checksum(value: string): string {
-    return createHash('sha256').update(value, 'utf8').digest('hex');
-  }
-}
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+
+import {
+  BuildFailure,
+  BuildOptions,
+  BuildResult,
+  Message,
+  OnLoadResult,
+  OnResolveArgs,
+  OnResolveResult,
+  OutputFile,
+  Plugin,
+  PluginBuild,
+  build
+} from 'esbuild';
+import ts from 'typescript';
+
+import { DyNTS_ArtifactCompileOutcome_Type } from './_enums/artifact-compile-outcome.type-enum';
+import { DyNTS_ArtifactCompileStage_Type } from './_enums/artifact-compile-stage.type-enum';
+import { DyNTS_ArtifactRetryClass_Type } from './_enums/artifact-retry-class.type-enum';
+import {
+  DyNTS_ArtifactCompileFinding_Interface,
+  DyNTS_ArtifactCompileRequest_Interface,
+  DyNTS_ArtifactCompileResult_Interface
+} from './_models/artifact-compile.interface';
+
+/**
+ * Deterministically bundles one in-memory TypeScript program for a classic browser Worker.
+ * This compiler is not a sandbox: consumers must validate source policy before compilation and execute the result
+ * inside a separately enforced runtime boundary.
+ */
+export class DyNTS_ArtifactCompiler_ControlService {
+  public static readonly contractVersion: 'dynts-artifact-compiler/1' = 'dynts-artifact-compiler/1';
+  private readonly absoluteMaxSourceBytes: number = 1_048_576;
+  private readonly absoluteMaxOutputBytes: number = 16_777_216;
+  private readonly absoluteMaxAllowedPackages: number = 64;
+  private readonly absoluteMaxPackageNameLength: number = 128;
+  private readonly absoluteMaxSourceFileNameLength: number = 128;
+  private readonly absoluteMaxResolveDirectoryLength: number = 1_024;
+  private readonly packageNamePattern: RegExp =
+    /^(?:@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*|[a-z0-9][a-z0-9._-]*)$/;
+  private readonly sourceFileNamePattern: RegExp = /^[a-z0-9][a-z0-9._-]*\.ts$/;
+
+  /** Compiles without writing source, sourcemaps, metadata or output files to disk. */
+  public async compile(
+    request: DyNTS_ArtifactCompileRequest_Interface
+  ): Promise<DyNTS_ArtifactCompileResult_Interface> {
+    const sourceChecksum: string = this.checksum(typeof request?.source === 'string' ? request.source : '');
+    const requestFinding: DyNTS_ArtifactCompileFinding_Interface | null = this.validateRequest(request);
+
+    if (requestFinding) {
+      return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|REQUEST_INVALID', [ requestFinding ]);
+    }
+
+    const importFinding: DyNTS_ArtifactCompileFinding_Interface | null = this.validateDirectImports(request);
+
+    if (importFinding) {
+      return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|IMPORT_REJECTED', [ importFinding ]);
+    }
+
+    try {
+      const result: BuildResult = await build(this.buildOptions(request));
+      const outputFiles: OutputFile[] = result.outputFiles ?? [];
+
+      if (outputFiles.length !== 1 || !outputFiles[0].path.endsWith('.js')) {
+        return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|OUTPUT_INVALID', [{
+          code: 'DYNTS|ARTIFACT_COMPILER|OUTPUT_COUNT',
+          stage: DyNTS_ArtifactCompileStage_Type.output,
+          line: null,
+          column: null,
+          retryClass: DyNTS_ArtifactRetryClass_Type.deterministicToolFixable,
+        }]);
+      }
+
+      const bundleSource: string = outputFiles[0].text;
+      const outputBytes: number = Buffer.byteLength(bundleSource, 'utf8');
+
+      if (!outputBytes || outputBytes > request.maxOutputBytes) {
+        return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|OUTPUT_LIMIT', [{
+          code: 'DYNTS|ARTIFACT_COMPILER|OUTPUT_SIZE',
+          stage: DyNTS_ArtifactCompileStage_Type.output,
+          line: null,
+          column: null,
+          retryClass: DyNTS_ArtifactRetryClass_Type.agentFixable,
+        }]);
+      }
+
+      return {
+        contractVersion: DyNTS_ArtifactCompiler_ControlService.contractVersion,
+        outcome: DyNTS_ArtifactCompileOutcome_Type.compiled,
+        code: 'DYNTS|ARTIFACT_COMPILER|COMPILED',
+        sourceChecksum: sourceChecksum,
+        bundleChecksum: this.checksum(bundleSource),
+        outputBytes: outputBytes,
+        bundleSource: bundleSource,
+        findings: [],
+      };
+    } catch (error: unknown) {
+      return this.rejected(sourceChecksum, 'DYNTS|ARTIFACT_COMPILER|BUILD_FAILED', this.buildFindings(error));
+    }
+  }
+
+  private validateRequest(
+    request: DyNTS_ArtifactCompileRequest_Interface
+  ): DyNTS_ArtifactCompileFinding_Interface | null {
+    const sourceBytes: number = typeof request?.source === 'string'
+      ? Buffer.byteLength(request.source, 'utf8')
+      : 0;
+    const allowedPackages: string[] = Array.isArray(request?.allowedPackages) ? request.allowedPackages : [];
+    const uniquePackages: Set<string> = new Set<string>(allowedPackages);
+    const isPackageSetValid: boolean = allowedPackages.length <= this.absoluteMaxAllowedPackages
+      && uniquePackages.size === allowedPackages.length
+      && allowedPackages.every((packageName: string): boolean => packageName.length <= this.absoluteMaxPackageNameLength
+        && this.packageNamePattern.test(packageName));
+
+    if (
+      request?.contractVersion !== DyNTS_ArtifactCompiler_ControlService.contractVersion
+      || !sourceBytes
+      || !Number.isInteger(request.maxSourceBytes)
+      || request.maxSourceBytes < 1
+      || request.maxSourceBytes > this.absoluteMaxSourceBytes
+      || sourceBytes > request.maxSourceBytes
+      || !Number.isInteger(request.maxOutputBytes)
+      || request.maxOutputBytes < 1
+      || request.maxOutputBytes > this.absoluteMaxOutputBytes
+      || typeof request.sourceFileName !== 'string'
+      || request.sourceFileName.length > this.absoluteMaxSourceFileNameLength
+      || !this.sourceFileNamePattern.test(request.sourceFileName)
+      || typeof request.resolveDirectory !== 'string'
+      || request.resolveDirectory.length > this.absoluteMaxResolveDirectoryLength
+      || !path.isAbsolute(request.resolveDirectory)
+      || !isPackageSetValid
+    ) {
+      return {
+        code: 'DYNTS|ARTIFACT_COMPILER|REQUEST_CONTRACT',
+        stage: DyNTS_ArtifactCompileStage_Type.request,
+        line: null,
+        column: null,
+        retryClass: DyNTS_ArtifactRetryClass_Type.deterministicToolFixable,
+      };
+    }
+
+    return null;
+  }
+
+  private buildOptions(request: DyNTS_ArtifactCompileRequest_Interface): BuildOptions {
+    return {
+      absWorkingDir: request.resolveDirectory,
+      bundle: true,
+      charset: 'utf8',
+      conditions: [ 'browser', 'default' ],
+      entryPoints: [ 'dynts-entry:candidate' ],
+      format: 'iife',
+      legalComments: 'none',
+      logLevel: 'silent',
+      mainFields: [ 'browser', 'module', 'main' ],
+      metafile: false,
+      minify: true,
+      outdir: 'dynts-in-memory-output',
+      platform: 'browser',
+      plugins: [ this.allowlistedEntryPlugin(request) ],
+      sourcemap: false,
+      target: [ 'es2022' ],
+      treeShaking: true,
+      write: false,
+    };
+  }
+
+  /**
+   * Validates every syntactic import before esbuild can tree-shake it. The plugin below is a second resolution gate,
+   * but it cannot be the only policy boundary because unused imports need not reach package resolution.
+   */
+  private validateDirectImports(
+    request: DyNTS_ArtifactCompileRequest_Interface
+  ): DyNTS_ArtifactCompileFinding_Interface | null {
+    const sourceFile: ts.SourceFile = ts.createSourceFile(
+      request.sourceFileName,
+      request.source,
+      ts.ScriptTarget.ES2022,
+      true,
+      ts.ScriptKind.TS
+    );
+    const allowedPackages: ReadonlySet<string> = new Set<string>(request.allowedPackages);
+    let finding: DyNTS_ArtifactCompileFinding_Interface | null = null;
+
+    /** Traverses the parsed source once and stops at the first forbidden module load. */
+    const inspectNode: (node: ts.Node) => void = (node: ts.Node): void => {
+      if (finding) {
+        return;
+      }
+
+      const moduleName: string | null = this.moduleName(node);
+
+      if (moduleName !== null && !allowedPackages.has(this.packageRoot(moduleName))) {
+        finding = this.importFinding(sourceFile, node);
+
+        return;
+      }
+
+      if (this.isDynamicModuleLoad(node)) {
+        finding = this.importFinding(sourceFile, node);
+
+        return;
+      }
+
+      ts.forEachChild(node, inspectNode);
+    };
+
+    inspectNode(sourceFile);
+
+    return finding;
+  }
+
+  private moduleName(node: ts.Node): string | null {
+    if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier) {
+      return ts.isStringLiteral(node.moduleSpecifier) ? node.moduleSpecifier.text : '';
+    }
+
+    if (
+      ts.isImportEqualsDeclaration(node)
+      && ts.isExternalModuleReference(node.moduleReference)
+      && node.moduleReference.expression
+    ) {
+      return ts.isStringLiteral(node.moduleReference.expression) ? node.moduleReference.expression.text : '';
+    }
+
+    return null;
+  }
+
+  private isDynamicModuleLoad(node: ts.Node): boolean {
+    return ts.isCallExpression(node)
+      && (node.expression.kind === ts.SyntaxKind.ImportKeyword
+        || (ts.isIdentifier(node.expression) && node.expression.text === 'require'));
+  }
+
+  private importFinding(
+    sourceFile: ts.SourceFile,
+    node: ts.Node
+  ): DyNTS_ArtifactCompileFinding_Interface {
+    const location: ts.LineAndCharacter = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+
+    return {
+      code: 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED',
+      stage: DyNTS_ArtifactCompileStage_Type.sourcePolicy,
+      line: location.line + 1,
+      column: location.character + 1,
+      retryClass: DyNTS_ArtifactRetryClass_Type.terminal,
+    };
+  }
+
+  private allowlistedEntryPlugin(request: DyNTS_ArtifactCompileRequest_Interface): Plugin {
+    const allowedPackages: ReadonlySet<string> = new Set<string>(request.allowedPackages);
+
+    return {
+      name: 'dynts-allowlisted-in-memory-entry',
+      setup: (pluginBuild: PluginBuild): void => {
+        pluginBuild.onResolve({ filter: /^dynts-entry:candidate$/ }, (): OnResolveResult => ({
+          path: 'candidate',
+          namespace: 'dynts-entry',
+        }));
+        pluginBuild.onLoad({ filter: /^candidate$/, namespace: 'dynts-entry' }, (): OnLoadResult => ({
+          contents: request.source,
+          loader: 'ts',
+          resolveDir: request.resolveDirectory,
+        }));
+        pluginBuild.onResolve({ filter: /.*/, namespace: 'dynts-entry' }, async (
+          args: OnResolveArgs
+        ): Promise<OnResolveResult> => {
+          if (!allowedPackages.has(this.packageRoot(args.path))) {
+            return {
+              errors: [{ text: 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED' }],
+            };
+          }
+
+          return pluginBuild.resolve(args.path, {
+            importer: args.importer,
+            kind: args.kind,
+            namespace: 'file',
+            resolveDir: request.resolveDirectory,
+          });
+        });
+      },
+    };
+  }
+
+  private buildFindings(error: unknown): DyNTS_ArtifactCompileFinding_Interface[] {
+    if (!this.isBuildFailure(error)) {
+      return [ this.genericBuildFinding() ];
+    }
+
+    const findings: DyNTS_ArtifactCompileFinding_Interface[] = error.errors.map((message: Message):
+      DyNTS_ArtifactCompileFinding_Interface => ({
+      code: message.text === 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED'
+        ? message.text
+        : 'DYNTS|ARTIFACT_COMPILER|COMPILE_ERROR',
+      stage: message.text === 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED'
+        ? DyNTS_ArtifactCompileStage_Type.resolve
+        : DyNTS_ArtifactCompileStage_Type.compile,
+      line: message.location?.line ?? null,
+      column: message.location ? message.location.column + 1 : null,
+      retryClass: message.text === 'DYNTS|ARTIFACT_COMPILER|IMPORT_NOT_ALLOWED'
+        ? DyNTS_ArtifactRetryClass_Type.terminal
+        : DyNTS_ArtifactRetryClass_Type.agentFixable,
+    }));
+
+    return findings.length ? findings : [ this.genericBuildFinding() ];
+  }
+
+  private isBuildFailure(error: unknown): error is BuildFailure {
+    if (!error || typeof error !== 'object') {
+      return false;
+    }
+
+    return 'errors' in error && Array.isArray(error.errors);
+  }
+
+  private genericBuildFinding(): DyNTS_ArtifactCompileFinding_Interface {
+    return {
+      code: 'DYNTS|ARTIFACT_COMPILER|COMPILE_ERROR',
+      stage: DyNTS_ArtifactCompileStage_Type.compile,
+      line: null,
+      column: null,
+      retryClass: DyNTS_ArtifactRetryClass_Type.agentFixable,
+    };
+  }
+
+  private rejected(
+    sourceChecksum: string,
+    code: string,
+    findings: DyNTS_ArtifactCompileFinding_Interface[]
+  ): DyNTS_ArtifactCompileResult_Interface {
+    return {
+      contractVersion: DyNTS_ArtifactCompiler_ControlService.contractVersion,
+      outcome: DyNTS_ArtifactCompileOutcome_Type.rejected,
+      code: code,
+      sourceChecksum: sourceChecksum,
+      bundleChecksum: '',
+      outputBytes: 0,
+      bundleSource: null,
+      findings: findings,
+    };
+  }
+
+  private packageRoot(moduleName: string): string {
+    if (moduleName.startsWith('@')) {
+      return moduleName.split('/').slice(0, 2).join('/');
+    }
+
+    return moduleName.split('/')[0];
+  }
+
+  private checksum(value: string): string {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+  }
+}