@nubjs/nub-win32-arm64 0.0.14 → 0.0.16

package/runtime/transform-core.mjs

@@ -8,131 +8,88 @@
 // Temporal lazy global, watch-mode IPC, and the compat-tier CJS `require()`
 // shim. EVERYTHING about how a file is resolved and transpiled — extension
 // probing, the `.js`→`.ts` swap, tsconfig `paths`, module-format detection,
-// oxc-transform options (including `target: 'es2022'` `using`-lowering), the
+// transform options (including `target: 'es2022'` `using`-lowering), the
 // Stage-3 decorator guard, the on-disk cache, data-format imports, package
 // clobbering — lives here, so the two tiers can never drift. (They used to:
 // separate copies diverged on probe order, `target` lowering, the decorator
 // guard, module-format detection, the Temporal clobber's named exports, and the
 // reserved-export filter — every one a real compat bug. This module is the fix.)
 //
-// Side effects are confined to: loading the N-API data addon, lazily loading
-// oxc-parser/oxc-transform, and reading/writing the transpile cache. There is no
-// top-level hook registration here — importing this module never augments the
+// Side effects are confined to: loading the N-API addon (data parsers + the
+// in-process TS/JSX transpiler), and reading/writing the transpile cache. There is
+// no top-level hook registration here — importing this module never augments the
 // realm; the tier files do that.
 
-// EVERY dependency of this module is pulled in via CJS `require()` (below), NOT
-// via static ESM `import`. This is load-bearing for loader compatibility (R11):
-// nub loads transform-core through `require(esm)`, and Node's `require(esm)`
-// instantiates the module by walking its STATIC IMPORT graph through whatever ESM
-// loader hooks are registered — including the USER's `--loader`/`register()`
-// chain. Static `import oxc-transform`/`get-tsconfig`/`./version.mjs`/`node:*`
-// here therefore leaked nub's entire internal graph (transform-core, version.mjs,
-// oxc-transform, get-tsconfig, their transitive node_modules deps, and the node:
-// builtins) THROUGH the user's resolve/load hooks, which observed and corrupted
-// it (a user load hook returning `source: 1` for version.mjs, a resolve hook
-// appending `?foo` to `oxc-transform`, a strict loader throwing on the bare
-// `oxc-transform` specifier — see test-esm-loader-chaining, -example-loader,
+// EVERY node: builtin this module needs is pulled in via CJS `require()` / `process
+// .getBuiltinModule` (below), NOT via static ESM `import`. This is load-bearing for
+// loader compatibility (R11): nub loads transform-core through `require(esm)`, and
+// Node's `require(esm)` instantiates the module by walking its STATIC IMPORT graph
+// through whatever ESM loader hooks are registered — including the USER's
+// `--loader`/`register()` chain. Static `import get-tsconfig`/`./version.mjs`/`node:*`
+// here therefore once leaked nub's entire internal graph (transform-core,
+// version.mjs, get-tsconfig, their transitive node_modules deps, and the node:
+// builtins) THROUGH the user's resolve/load hooks, which observed and corrupted it
+// (a user load hook returning `source: 1` for version.mjs, a strict loader throwing
+// on a bare specifier — see test-esm-loader-chaining, -example-loader,
 // -preserve-symlinks-not-found, test-shadow-realm-custom-loaders). Verified: a CJS
-// `require()` of a package/builtin does NOT route through the ESM loader chain, so
-// loading the graph this way bypasses the user chain entirely. `process
+// `require()` of a builtin does NOT route through the ESM loader chain, so loading
+// off it bypasses the user chain entirely. As of this migration the point is
+// stronger: transform-core `require()`s ZERO npm packages — the transpiler, TS/JSX
+// detection, tsconfig discovery/parse, the additive TS-resolver, AND the transpile
+// cache are ALL native calls into nub's own N-API addon (loaded by absolute `.node`
+// path, off the loader chain), and the version.mjs text read is gone (the cache
+// version is baked into the addon). So the worst historical leaks — oxc-transform's
+// and then get-tsconfig's graphs pulled through the user chain — are gone by
+// construction; only node: builtins remain, fetched off the chain. `process
 // .getBuiltinModule` fetches node: builtins synchronously off the loader chain;
-// `createRequire(import.meta.url)` resolves the bare deps from nub's distribution.
+// `createRequire(import.meta.url)` resolves the (now CommonJS-only) vendored
+// polyfills + the `@oxc-project/runtime` helpers from nub's distribution.
 // This file keeps its `export`s (it stays an ES module), but has ZERO static
 // imports, so `require(esm)` finds no dependency graph to route through the user.
-const { createRequire } = process.getBuiltinModule("node:module");
+// `process.getBuiltinModule` (Node 22.3 / backported to 20.16 / 18.20.4) fetches a
+// node: builtin synchronously off the loader chain. On older floor Node (18.19,
+// 20.11–20.15, 22.0–22.2) it's `undefined` — calling it threw `TypeError: process
+// .getBuiltinModule is not a function`, aborting every run. Fall back to a
+// createRequire bootstrapped from a single static `node:module` import. That import
+// is a BUILTIN specifier — resolved by Node natively, never routed through a user
+// loader hook (and resolved here at preload time, before any hook registers) — so
+// the "zero user-routable dependency graph for require(esm)" property still holds.
+import { createRequire as __bootstrapCreateRequire } from "node:module";
+const __getBuiltin =
+  typeof process.getBuiltinModule === "function"
+    ? (id) => process.getBuiltinModule(id)
+    : ((__r) => (id) => __r(id))(__bootstrapCreateRequire(import.meta.url));
+
+const { createRequire } = __getBuiltin("node:module");
 const __require = createRequire(import.meta.url);
 
-const module = process.getBuiltinModule("node:module");
-const { readFileSync, writeFileSync, mkdirSync, statSync, renameSync, unlinkSync, readdirSync } = process.getBuiltinModule("node:fs");
-const { fileURLToPath, pathToFileURL } = process.getBuiltinModule("node:url");
-const { join, dirname, resolve: pathResolve, extname: pathExtname } = process.getBuiltinModule("node:path");
-// oxc-transform is `type: module`, so a plain `require("oxc-transform")` uses
-// `require(esm)` and Node instantiates its ESM entry by walking ITS static
-// imports through the registered ESM loader chain — i.e. through the USER's
-// `--loader` worker (which nub's main-thread sync hooks do NOT chain into, so the
-// resolveSpec short-circuit can't catch it). oxc-transform's entry has exactly one
-// ESM-only construct that leaks: `import { createRequire } from 'node:module'`
-// (the rest is CJS `require`/`module.exports`-shaped). To keep it off the chain
-// entirely we load it AS CommonJS: read the entry source, neutralize its tiny ESM
-// header (the `import { createRequire }` line, the `const require =
-// createRequire(import.meta.url)` shadow, the `import.meta.url`-based `__dirname`)
-// and convert its `export { X }` footer to `module.exports`, then compile it with
-// `module._compile` at its real path so its internal `require('./binding.node')`
-// and `__dirname` resolve correctly. A CJS-compiled module has no static-import
-// graph for Node to route through any loader. Falls back to plain require(esm) if
-// the source shape ever changes (then the leak returns, but transpilation works).
-function requireOxcAsCjs() {
-  const Module = module;
-  let entry;
-  try {
-    entry = __require.resolve("oxc-transform");
-  } catch {
-    return __require("oxc-transform");
-  }
-  // Only the .js NAPI-RS wrapper has the mixed ESM-header/CJS-body shape we can
-  // safely transform; anything else, defer to the normal loader.
-  if (!entry.endsWith(".js")) return __require("oxc-transform");
-  try {
-    let src = readFileSync(entry, "utf8");
-    // Strip the ESM header: `import { createRequire } from 'node:module'`,
-    // `const require = createRequire(import.meta.url)`, and any
-    // `const __dirname = new URL('.', import.meta.url).pathname`. In a CJS module
-    // `require`, `__dirname`, `__filename` are already injected by _compile.
-    src = src
-      .replace(/^\s*import\s*\{[^}]*\}\s*from\s*['"]node:module['"];?\s*$/m, "")
-      .replace(/^\s*const\s+require\s*=\s*createRequire\([^)]*\);?\s*$/m, "")
-      .replace(/^\s*const\s+__dirname\s*=\s*new URL\([^)]*\)\.pathname;?\s*$/m, "");
-    // Convert the `export { Name }` footer lines to a single CJS exports block.
-    const names = [];
-    src = src.replace(/^\s*export\s*\{\s*([A-Za-z0-9_$]+)\s*\}\s*;?\s*$/gm, (_m, n) => {
-      names.push(n);
-      return "";
-    });
-    // Guard: if any `import`/`export`/`import.meta` survived, we don't understand
-    // this version's shape — bail to the safe loader rather than ship broken code.
-    if (/^\s*(import|export)\s/m.test(src) || /\bimport\.meta\b/.test(src)) {
-      return __require("oxc-transform");
-    }
-    if (names.length === 0) return __require("oxc-transform");
-    src += `\nmodule.exports = { ${names.join(", ")} };\n`;
-    const m = new Module(entry, null);
-    m.filename = entry;
-    m.paths = Module._nodeModulePaths(dirname(entry));
-    m._compile(src, entry);
-    return m.exports;
-  } catch {
-    return __require("oxc-transform");
-  }
-}
-const { transformSync } = requireOxcAsCjs();
-const { getTsconfig, createPathsMatcher } = __require("get-tsconfig");
-
-// NUB_VERSION is the single source of truth in runtime/version.mjs. We must NOT
-// `import` it (that would route version.mjs through the user loader chain — see
-// above; a user load hook returning bogus source corrupts it), and we cannot
-// `require()` it either (it is an ES module, so `require()` uses require(esm),
-// which re-routes version.mjs's own load through the chain). Instead read its
-// text directly and extract the literal — `make version` keeps the assignment on
-// one line (`export const NUB_VERSION = "x.y.z";`), so a tight regex is stable.
-const NUB_VERSION = (() => {
-  try {
-    const text = readFileSync(fileURLToPath(new URL("./version.mjs", import.meta.url)), "utf8");
-    const m = text.match(/NUB_VERSION\s*=\s*["']([^"']+)["']/);
-    if (m) return m[1];
-  } catch {}
-  return "0.0.0";
-})();
-
-// `node:crypto` is used ONLY to hash the transpile-cache key, so it loads lazily
-// on first transpile rather than at module top level. Importing it eagerly pulls
-// in the crypto/tls native tree (~dozens of builtins) on EVERY startup — including
-// a plain-JS run that never transpiles anything (R7). The first `.ts` transpile
-// pays the one-time require; a no-TS run never touches it. Memoized.
-let _createHash = null;
-function getCreateHash() {
-  return (_createHash ??= __require("node:crypto").createHash);
+const module = __getBuiltin("node:module");
+const { readFileSync, writeFileSync, mkdirSync, statSync } = __getBuiltin("node:fs");
+const { fileURLToPath, pathToFileURL } = __getBuiltin("node:url");
+const { join, dirname } = __getBuiltin("node:path");
+// Nub's N-API addon — the in-process TS/JSX transpiler (`transform`,
+// `transformCached`, `detectModuleInfo`), the tsconfig reader + additive
+// TS-resolver (`loadTsconfig`, `resolveTs`), AND the data-format parsers
+// (`parseYaml`/`parseToml`/`parseJson5`/`parseJsonc`), all native. Loaded once
+// per module instance (= once per thread: the main thread and the loader worker
+// each import this module separately). It is a `.node` binary resolved by absolute
+// path off this file's dir, so it never touches the ESM loader chain — the
+// historical require(esm)-of-an-ESM-npm-package leak (oxc-transform, and before
+// this migration get-tsconfig) is gone: transpilation, tsconfig discovery, the
+// additive resolution, and the transpile cache are synchronous native calls, no JS
+// package, no static-import graph to route. nub now loads ZERO npm packages
+// internally, so the user ESM loader chain can never observe a nub dependency.
+let nubNative = null;
+for (const rel of ["./addons/nub-native.node", "../runtime/addons/nub-native.node"]) {
+  try { nubNative = __require(fileURLToPath(new URL(rel, import.meta.url))); break; } catch {}
 }
 
+// NOTE: the transpile-cache version component is no longer read here. nub's
+// version is baked into the native addon at compile time (`env!("CARGO_PKG_VERSION")`
+// in nub-native's cache.rs), which `make version` keeps in lockstep with
+// runtime/version.mjs and Cargo.toml — so the cache key's version component lives
+// natively now, and this file no longer needs to read version.mjs.
+
 // ── Constants ───────────────────────────────────────────────────────
 export const TRANSPILE_EXTS = new Set([".ts", ".tsx", ".mts", ".cts", ".jsx"]);
 export const DATA_EXTS = { ".jsonc": "jsonc", ".json5": "json5", ".toml": "toml", ".yaml": "yaml", ".yml": "yaml", ".txt": "txt" };
@@ -174,14 +131,6 @@ export const CLOBBER_MAP = new Map([
   ["abort-controller", () => `export const AbortController = globalThis.AbortController; export const AbortSignal = globalThis.AbortSignal; export default globalThis.AbortController;`],
 ]);
 
-// Nub's N-API addon for data-format parsing (Rust-native YAML/TOML/JSON5/JSONC).
-// Loaded once per module instance (= once per thread: the main thread and the
-// loader worker each import this module separately).
-let nubNative = null;
-for (const rel of ["./addons/nub-native.node", "../runtime/addons/nub-native.node"]) {
-  try { nubNative = __require(fileURLToPath(new URL(rel, import.meta.url))); break; } catch {}
-}
-
 // ── Watch-mode hooks (injected by the main-thread tier) ─────────────
 // `nub watch` needs config files (tsconfig.json, package.json) and `.env*` —
 // which are not in any import graph — surfaced to Node's FilesWatcher. The main
@@ -195,15 +144,24 @@ export function setWatchHooks({ reportDep, reportEnvDir } = {}) {
 }
 
 // ── tsconfig + package-type caches ──────────────────────────────────
+// tsconfig discovery / parse / `extends` resolution + the `paths` matcher all
+// happen natively (nub-native `loadTsconfig`, the get-tsconfig@4.14.0 port). This
+// JS wrapper exists only to (a) memoize per importer-dir — native ALSO memoizes,
+// but a JS-side Map skips the napi boundary on a hit and lets watch-mode report
+// the dep exactly once per dir — and (b) surface the resolved tsconfig path to the
+// watch FilesWatcher. The returned shape exposes the transform-relevant
+// `compilerOptions` slice and the `tsconfigHash` cache-key component; the `paths`
+// matcher lives entirely in native (`resolveTs` runs it), so there is no JS matcher.
 const tsconfigCache = new Map();
 export function getTsconfigForDir(dir) {
   if (tsconfigCache.has(dir)) return tsconfigCache.get(dir);
-  const result = getTsconfig(dir);
-  const matcher = result ? createPathsMatcher(result) : null;
-  const entry = { tsconfig: result, matcher };
-  tsconfigCache.set(dir, entry);
-  if (result?.path) _reportDep?.(result.path);
-  return entry;
+  // { path: string|null, compilerOptions: object|null, tsconfigHash: string }
+  const result = nubNative
+    ? nubNative.loadTsconfig(dir)
+    : { path: null, compilerOptions: null, tsconfigHash: "" };
+  tsconfigCache.set(dir, result);
+  if (result.path) _reportDep?.(result.path);
+  return result;
 }
 
 // The NEAREST package.json's `type` decides the format of ambiguous extensions
@@ -250,11 +208,6 @@ export function fileExists(filePath) {
   return s !== undefined && s.isFile();
 }
 
-export function dirExists(filePath) {
-  const s = statSync(filePath, { throwIfNoEntry: false });
-  return s !== undefined && s.isDirectory();
-}
-
 function safeRequireResolve(specifier) {
   try { return __require.resolve(specifier); } catch { return null; }
 }
@@ -266,167 +219,52 @@ export function barePkg(specifier) {
 }
 
 // ── Resolution ──────────────────────────────────────────────────────
-// Read a directory's package.json `main` (its legacy CJS entry point), or null.
-// `exports` is deliberately NOT consulted: Node honors `exports` only for
-// package-name/self-reference resolution, never for a relative/absolute import
-// of a directory path (verified against Node 24 — a relative dir import with
-// `exports` but no `main` falls through to index, not the export). So matching
-// Node here means `main` only.
-function readPackageMain(dir) {
-  const pkgPath = join(dir, "package.json");
-  if (!fileExists(pkgPath)) return null;
+// The ADDITIVE TS resolution — tsconfig `paths` aliases, `.ts/.tsx/.mts/.cts/.jsx`
+// extension probing, the `.js`→`.ts` (and `.jsx→.tsx`, `.mjs→.mts`, `.cjs→.cts`)
+// emit-convention swap, directory-index probing, and reading a directory's
+// `package.json#main` — all happens natively now (nub-native `resolveTs`). It
+// returns an absolute path for the additive cases nub owns, or `null` for
+// EVERYTHING Node owns (node_modules, `exports`/`imports`, conditions, scoped/bare
+// specifiers), which the resolve hooks below turn into a fall-through to Node. That
+// `null` is the byte-for-byte compat boundary; reimplementing Node's resolution in
+// nub is forbidden. The `node:`/`data:`/builtin guards, the nub-internal-graph
+// bypass, vendored packages, and the clobber map all stay in JS and run BEFORE the
+// native resolver (see resolveSpec / resolveCjsPath).
+function resolveTs(specifier, parentPath) {
+  if (!nubNative) return null;
   try {
-    const main = JSON.parse(readFileSync(pkgPath, "utf8")).main;
-    return typeof main === "string" && main.trim() ? main : null;
+    return nubNative.resolveTs(specifier, parentPath || "");
   } catch {
     return null;
   }
 }
 
-// Try to resolve a file path with extensionless probing + .js→.ts swap.
-// `allowDirMain` honors a resolved directory's package.json `main` before its
-// index; it is cleared on the recursive main-target probe because Node's
-// LOAD_AS_DIRECTORY resolves `main` with file+index probing only and does not
-// recurse into the target's own nested `main` (verified against Node 24).
-export function tryResolveFile(target, parentExt, allowDirMain = true) {
-  // If the target already has an extension and exists, use it.
-  const existingExt = pathExtname(target);
-  if (existingExt && fileExists(target)) return target;
-
-  // .js → .ts swap (tsc emit convention reversal).
-  if (existingExt === ".js") {
-    const tsSwap = target.slice(0, -3) + ".ts";
-    if (fileExists(tsSwap)) return tsSwap;
-    const tsxSwap = target.slice(0, -3) + ".tsx";
-    if (fileExists(tsxSwap)) return tsxSwap;
-  }
-  if (existingExt === ".jsx") {
-    const tsxSwap = target.slice(0, -4) + ".tsx";
-    if (fileExists(tsxSwap)) return tsxSwap;
-  }
-  // .mjs → .mts swap (Bun does this).
-  if (existingExt === ".mjs") {
-    const mtsSwap = target.slice(0, -4) + ".mts";
-    if (fileExists(mtsSwap)) return mtsSwap;
-  }
-  // .cjs → .cts swap — the CommonJS analog of .mjs→.mts. tsc resolves
-  // `import "./foo.cjs"` to foo.cts (it strips the .cjs and finds the .cts
-  // source — verified via --traceResolution), so a TS file using the emitted
-  // extension to reference a .cts source must resolve at runtime. (Bun omits
-  // this swap even though it does .mjs→.mts; we match tsc, not that gap.)
-  if (existingExt === ".cjs") {
-    const ctsSwap = target.slice(0, -4) + ".cts";
-    if (fileExists(ctsSwap)) return ctsSwap;
-  }
-
-  // Extensionless: probe in parent-ext-aware order.
-  if (!existingExt) {
-    const probeOrder = getProbeOrder(parentExt);
-    for (const ext of probeOrder) {
-      if (fileExists(target + ext)) return target + ext;
-    }
-    // Directory: honor package.json `main` (Node's legacy LOAD_AS_DIRECTORY)
-    // before falling back to index probing. The main target is resolved with
-    // the same extensionless/TS-swap probing (so a TS package can point `main`
-    // at a `.ts`, or `.js`→`.ts` swaps apply), but without re-reading a nested
-    // `main` — matching Node. If `main` is absent or unresolvable, index wins
-    // (Node falls back to index too, with a DEP0128 warning we needn't emit).
-    if (dirExists(target)) {
-      if (allowDirMain) {
-        const main = readPackageMain(target);
-        if (main) {
-          const resolved = tryResolveFile(pathResolve(target, main), parentExt, false);
-          if (resolved) return resolved;
-        }
-      }
-      for (const ext of probeOrder) {
-        const idx = join(target, "index" + ext);
-        if (fileExists(idx)) return idx;
-      }
-    }
-  }
-
-  return null;
-}
-
-export function getProbeOrder(parentExt) {
-  switch (parentExt) {
-    case ".tsx": return [".tsx", ".ts", ".jsx", ".js", ".json"];
-    // .mts/.cts prefer their own module system first, but STILL fall through to
-    // the general TS (`.ts`) and JS extensions: tsc and Node resolve an
-    // extensionless `./foo` from a .mts/.cts parent to foo.ts / foo.js too, not
-    // only foo.mts / foo.cts. Omitting `.ts` here is what made `require('./config')`
-    // — and a tsconfig-paths alias — from a .cts (or .mts) parent miss a `.ts`
-    // target (works from .js/.cjs, which use the default order below).
-    case ".mts": return [".mts", ".ts", ".mjs", ".js", ".json"];
-    case ".cts": return [".cts", ".ts", ".cjs", ".js", ".json"];
-    default:     return [".ts", ".tsx", ".js", ".jsx", ".json"];
-  }
-}
-
 // nub's own runtime directory (this file's dir, as a file: URL prefix). Any
 // resolution whose IMPORTER lives here is one of nub's internal requires — the
-// preload loading transform-core, transform-core requiring oxc, the Temporal lazy
-// getter resolving @js-temporal/polyfill — and must NEVER be routed through nub's
-// own clobber/vendored/tsconfig logic: those are user-code conveniences, and
-// applying them to nub's internals both breaks them (e.g. the Temporal clobber
-// re-exports globalThis.Temporal, which IS the getter → a require of the polyfill
-// from the getter would recurse into the clobber) and amplifies the user loader
-// chain by re-walking nub's internal graph through user hooks (R11). Short-circuit
-// to native resolution for these.
+// preload loading transform-core, the Temporal lazy getter resolving
+// @js-temporal/polyfill — and must NEVER be routed through nub's own
+// clobber/vendored/tsconfig logic: those are user-code conveniences, and applying
+// them to nub's internals both breaks them (e.g. the Temporal clobber re-exports
+// globalThis.Temporal, which IS the getter → a require of the polyfill from the
+// getter would recurse into the clobber) and amplifies the user loader chain by
+// re-walking nub's internal graph through user hooks (R11). Short-circuit to native
+// resolution for these.
 const RUNTIME_DIR_URL = new URL(".", import.meta.url).href;
 
-// nub's internal-graph package roots — the file: URL prefixes of the npm packages
-// nub itself loads (oxc-transform, get-tsconfig) and their transitive deps. Any
-// resolution whose IMPORTER lives under one of these is part of nub's internal
-// graph, NOT user code. `oxc-transform` is `type: module`, so even when nub pulls
-// it in via CJS `require()`, Node loads its `index.js` through `require(esm)` and
-// walks ITS static `import "node:module"` graph through the registered ESM loader
-// chain — including the USER's loader. That re-leaks nub internals one hop down
-// (R11): test-esm-example-loader's strict loader throws on `node:module`,
-// loader-resolve-shortcircuit appends `?foo` to oxc's specifiers, etc. So a
-// nub-internal-graph resolution must FULLY short-circuit (resolve natively, return
-// shortCircuit:true) — never delegate to nextResolve — for EVERY specifier,
-// including node: builtins and the package's own relative imports. Computed lazily
-// (and pinned even on resolve failure) so a missing dep can't wedge startup.
-let _nubGraphRoots = null;
-function nubGraphRoots() {
-  if (_nubGraphRoots) return _nubGraphRoots;
-  const roots = [];
-  for (const pkg of ["oxc-transform", "get-tsconfig"]) {
-    try {
-      const entry = __require.resolve(pkg);
-      // Package root = the directory two levels up does not work generically;
-      // instead key on the package-name segment: everything under
-      // `.../node_modules/<pkg>/` is that package. Use the entry's dir-with-pkg.
-      const idx = entry.lastIndexOf(`${sep()}node_modules${sep()}`);
-      if (idx !== -1) {
-        // Keep through the package-name segment (handles scoped names too).
-        const afterNM = entry.slice(idx + (`${sep()}node_modules${sep()}`).length);
-        const firstSeg = afterNM.startsWith("@")
-          ? afterNM.split(sep()).slice(0, 2).join(sep())
-          : afterNM.split(sep())[0];
-        const pkgRoot = entry.slice(0, idx) + `${sep()}node_modules${sep()}` + firstSeg + sep();
-        roots.push(pathToFileURL(pkgRoot).href);
-      }
-    } catch {}
-  }
-  return (_nubGraphRoots = roots);
-}
-function sep() {
-  return process.platform === "win32" ? "\\" : "/";
-}
-
-// Is this importer part of nub's own internal module graph (runtime dir or a nub
-// dependency package)? Such imports must bypass the user ESM loader chain entirely.
+// Is this importer part of nub's own internal module graph? Such imports must
+// bypass the user ESM loader chain entirely (R11). nub now loads ZERO npm packages
+// internally — tsconfig, the additive resolver, the transpile cache, the
+// transpiler, and module detection are ALL native nub-native calls, and the only
+// remaining JS deps (@oxc-project/runtime helpers, the polyfills) are CommonJS,
+// whose `require()` graph already bypasses the ESM loader chain by construction. So
+// the only nub-internal ESM importer left is nub's own runtime directory (this
+// file, the preload tiers, the Temporal lazy getter resolving @js-temporal/
+// polyfill). The historical "nub-dependency package roots" walk — which existed
+// solely to catch an ESM hop into get-tsconfig (and before that oxc-transform) — is
+// gone with those packages.
 function isNubInternalParent(parentURL) {
   if (!parentURL) return false;
-  const p = String(parentURL);
-  if (p.startsWith(RUNTIME_DIR_URL)) return true;
-  for (const root of nubGraphRoots()) {
-    if (p.startsWith(root)) return true;
-  }
-  return false;
+  return String(parentURL).startsWith(RUNTIME_DIR_URL);
 }
 
 // Resolve a specifier the way both hook tiers do. Returns `{ url, shortCircuit }`
@@ -438,8 +276,8 @@ export function resolveSpec(specifier, parentURL) {
   // user's loader chain) never observes nub's internals. This MUST run before the
   // node:/data:/builtin early-returns below, because those `return null` =
   // DELEGATE to the user loader — and a nub-internal `import "node:module"` (e.g.
-  // from oxc-transform's ESM entry) delegated to a strict user loader is exactly
-  // the R11 leak. See isNubInternalParent / nubGraphRoots.
+  // from a nub-dependency ESM entry) delegated to a strict user loader is exactly
+  // the R11 leak. See isNubInternalParent.
   if (isNubInternalParent(parentURL)) {
     if (specifier.startsWith("node:") || module.builtinModules.includes(specifier)) {
       const url = specifier.startsWith("node:") ? specifier : `node:${specifier}`;
@@ -482,30 +320,16 @@ export function resolveSpec(specifier, parentURL) {
   }
 
   const parent = String(parentURL || "");
-  const parentExt = extname(parent);
-
-  // 4. tsconfig-paths (only for bare/aliased specifiers, not relative).
-  if (!specifier.startsWith(".") && !specifier.startsWith("/") && !specifier.startsWith("file:") && !isNodeModules(parent)) {
-    const parentDir = parent.startsWith("file:") ? dirname(fileURLToPath(parent)) : process.cwd();
-    const { matcher } = getTsconfigForDir(parentDir);
-    if (matcher) {
-      const mapped = matcher(specifier);
-      if (mapped && mapped.length > 0) {
-        for (const candidate of mapped) {
-          const resolved = tryResolveFile(candidate, parentExt);
-          if (resolved) return { url: pathToFileURL(resolved).href, shortCircuit: true };
-        }
-      }
-    }
-  }
 
-  // 5. Extensionless probing (only when parent is a TS file).
-  if (TS_PARENT_EXTS.has(parentExt) && (specifier.startsWith("./") || specifier.startsWith("../"))) {
-    const parentDir = dirname(fileURLToPath(parent));
-    const target = pathResolve(parentDir, specifier);
-    const resolved = tryResolveFile(target, parentExt);
-    if (resolved) return { url: pathToFileURL(resolved).href, shortCircuit: true };
-  }
+  // 4. The ADDITIVE TS resolution (tsconfig `paths`, extension probing, `.js`→`.ts`
+  // swap, directory index/`main`) — native. `resolveTs` is handed the parent's
+  // absolute FS path (or "" for a non-file: parent / the entry, where it falls back
+  // to cwd, matching the old `process.cwd()` parentDir). A non-null result is an
+  // additive hit nub owns; null falls through to Node's resolver (the compat
+  // boundary — node_modules, `exports`, bare/scoped specifiers stay Node's).
+  const parentPath = parent.startsWith("file:") ? fileURLToPath(parent) : "";
+  const resolved = resolveTs(specifier, parentPath);
+  if (resolved) return { url: pathToFileURL(resolved).href, shortCircuit: true };
 
   return null;
 }
@@ -522,36 +346,11 @@ export function resolveCjsPath(request, parentPath) {
       module.builtinModules.includes(request)) {
     return null;
   }
-  const parentExt = parentPath ? pathExtname(parentPath) : "";
-
-  // tsconfig `paths` — bare/aliased specifiers from a file outside node_modules
-  // (not gated on a TS parent: a plain .js with a paths alias resolves too).
-  if (!request.startsWith(".") && !request.startsWith("/") && !request.startsWith("file:") &&
-      !isNodeModules(parentPath || "")) {
-    const parentDir = parentPath ? dirname(parentPath) : process.cwd();
-    const { matcher } = getTsconfigForDir(parentDir);
-    if (matcher) {
-      const mapped = matcher(request);
-      if (mapped && mapped.length > 0) {
-        for (const candidate of mapped) {
-          const resolved = tryResolveFile(candidate, parentExt);
-          if (resolved) return resolved;
-        }
-      }
-    }
-    return null; // a plain bare package → let Node resolve it from node_modules
-  }
-
-  // Extensionless probing + .js→.ts swap for a relative specifier — only when the
-  // requiring file is itself TS (same TS_PARENT_EXTS gate as resolveSpec step 5).
-  if (parentPath && TS_PARENT_EXTS.has(parentExt) &&
-      (request.startsWith("./") || request.startsWith("../"))) {
-    const target = pathResolve(dirname(parentPath), request);
-    const resolved = tryResolveFile(target, parentExt);
-    if (resolved) return resolved;
-  }
-
-  return null;
+  // The SAME native additive resolver as resolveSpec, returning an absolute path
+  // (not a URL). Vendored/clobber/builtin are import-only and never reach here. A
+  // null result (node_modules / `exports` / a plain bare package) falls through to
+  // Node's CJS resolver — the compat boundary.
+  return resolveTs(request, parentPath || "");
 }
 
 // Would `require()`-ing this resolved TS file need Node's require(esm)? An
@@ -572,68 +371,29 @@ export function requireTargetIsEsm(filePath, ext) {
 }
 
 // ── Module-format detection ─────────────────────────────────────────
-// oxc-parser loads a native binding (~8 ms) and is needed ONLY for absent-`type`
-// module detection + the Stage-3 decorator guard, so it loads lazily — `nub
-// script.js` and explicit-`type` files never pay for it.
-//
-// oxc-parser is ESM-only, so `require()` of it needs require(esm), which only
-// exists on Node 20.19+ / 22.12+. The fast tier (>= 22.15) has it, so a lazy
-// `require` there keeps the load off plain-JS startups. The compat tier reaches
-// down to 18.19, where `require("oxc-parser")` throws ERR_REQUIRE_ESM — so the
-// compat-tier callers (the loader worker's async load hook, and preload.mjs's
-// main-thread compat branch) `await ensureParser()` first, which loads it via
-// dynamic `import()` (native ESM, works on every supported Node). Without this,
-// detection silently fell back to "ESM", so a CJS-content `.ts` mis-loaded as ESM
-// and decorator syntax slipped past the guard on Node 18.19 / 20.x.
-let _parseSync = null;
-let _requireTried = false;
-let _importTried = false;
-
-/// Async, idempotent: ensure oxc-parser is loaded via dynamic import (the only
-/// form that works below require(esm)). Compat-tier callers await this before the
-/// synchronous detection below runs.
-export async function ensureParser() {
-  if (_parseSync || _importTried) return;
-  _importTried = true;
-  try { _parseSync = (await import("oxc-parser")).parseSync; } catch { /* unavailable */ }
-}
-
-function getParseSync() {
-  if (!_parseSync && !_requireTried) {
-    _requireTried = true;
-    try { _parseSync = __require("oxc-parser").parseSync; } catch { /* try ensureParser instead */ }
-  }
-  return _parseSync;
-}
-
-// Does the source carry VALUE-level ESM syntax? Mirrors Node's
-// `--experimental-detect-module`: type-only imports/exports are erased by oxc
-// and must NOT count, but a value import/export, a bare `import "x"`, an
-// `export {}` marker, `import.meta`, or top-level `await` all force ESM.
-// Used only for the ambiguous extensions when package.json has no `type`.
-function hasEsmSyntax(filePath, source, lang) {
-  const parse = getParseSync();
-  if (!parse) return true; // detection unavailable → default ESM (the common case)
-  let mod;
+// Both signals nub needs to read off a file's syntax — the absent-`type` module
+// format and the Stage-3-decorator guard — come from ONE native call into nub's
+// N-API addon (`detectModuleInfo`, the oxc parser compiled in-process). There is
+// no JS parser package anymore: `oxc-parser` (ESM-only, which used to need
+// `require(esm)` on the fast tier and a dynamic-`import()` `ensureParser()` dance
+// on the 18.19 compat tier) is gone, and with it the whole "is require(esm)
+// available here?" fork. The native call is synchronous and works identically on
+// every supported Node, so there is nothing to preload and no async warm-up — the
+// former `ensureParser()` export is removed (its compat-tier callers just stop
+// calling it). Used only for ambiguous extensions / the decorator guard; explicit
+// `type` and `.mts`/`.cts` short-circuit before the parser runs.
+function detectModuleInfo(filePath, source, lang) {
+  // Addon missing (should never happen in a real install): default to ESM for
+  // format (the common case) and "no decorators" for the guard — the same fallback
+  // the old oxc-parser-unavailable branches used.
+  if (!nubNative) return { hasValueEsmSyntax: true, hasDecorators: false };
   try {
-    mod = parse(filePath, source, { lang }).module;
+    return nubNative.detectModuleInfo(filePath, source, lang);
   } catch {
-    return false; // unparseable → default CJS; the transpile surfaces the real error
+    // Unparseable → CJS for format + no decorators (the transpile/V8 surfaces the
+    // real error), matching the old per-call catch blocks.
+    return { hasValueEsmSyntax: false, hasDecorators: false };
   }
-  const valueImport = mod.staticImports.some(
-    (si) => si.entries.length === 0 || si.entries.some((e) => !e.isType),
-  );
-  const valueExport = mod.staticExports.some(
-    (se) => se.entries.length === 0 || se.entries.some((e) => !e.isType),
-  );
-  if (valueImport || valueExport || mod.importMetas.length > 0) return true;
-  // Top-level await: `hasModuleSyntax` is set with no static import/export/meta.
-  return (
-    mod.hasModuleSyntax &&
-    mod.staticImports.length === 0 &&
-    mod.staticExports.length === 0 &&
-    mod.importMetas.length === 0
-  );
 }
 
 // Map a transpiled file's extension + nearest package.json "type" to the module
@@ -647,7 +407,7 @@ export function moduleFormatFor(ext, pkgType, filePath, source) {
   if (pkgType === "module") return "module";
   if (pkgType === "commonjs") return "commonjs";
   const lang = ext === ".tsx" ? "tsx" : ext === ".jsx" ? "jsx" : "ts";
-  return hasEsmSyntax(filePath, source, lang) ? "module" : "commonjs";
+  return detectModuleInfo(filePath, source, lang).hasValueEsmSyntax ? "module" : "commonjs";
 }
 
 // The Stage-3-decorator rejection diagnostic. oxc does not lower TC39 Stage 3
@@ -672,54 +432,22 @@ function stage3DecoratorError(filePath) {
 // member)? Used ONLY when legacy decorators are off, to surface a clear
 // diagnostic instead of oxc's verbatim passthrough → V8 SyntaxError. The cheap
 // `source.includes("@")` pre-filter in the caller keeps decorator-free files off
-// the parser; decorators only attach to ClassDeclaration/ClassExpression and
-// their members (incl. accessors), and to `export`/`export default` wrappers.
+// the native parser. The walk now happens in Rust (detectModuleInfo's AST visit).
 function hasDecoratorSyntax(filePath, source, lang) {
-  const parse = getParseSync();
-  if (!parse) return false; // parser unavailable → let oxc/V8 surface the error
-  let program;
-  try {
-    program = parse(filePath, source, { lang }).program;
-  } catch {
-    return false; // unparseable → the transpile/V8 surfaces the real error
-  }
-  let found = false;
-  const visit = (node) => {
-    if (found || !node || typeof node !== "object") return;
-    if (Array.isArray(node)) {
-      for (const child of node) visit(child);
-      return;
-    }
-    if (Array.isArray(node.decorators) && node.decorators.length > 0) {
-      found = true;
-      return;
-    }
-    for (const k in node) {
-      if (k === "type" || k === "start" || k === "end") continue;
-      visit(node[k]);
-      if (found) return;
-    }
-  };
-  visit(program.body);
-  return found;
-}
-
-// Drop a trailing bare `export {};` — oxc injects it to preserve module-ness
-// after stripping a file's only module syntax (e.g. a lone `import type`).
-const EMPTY_EXPORT_MARKER = /(?:^|\n)[ \t]*export[ \t]*\{[ \t]*\}[ \t]*;?\s*$/;
-function stripEmptyExportMarker(code) {
-  return code.replace(EMPTY_EXPORT_MARKER, "");
+  return detectModuleInfo(filePath, source, lang).hasDecorators;
 }
 
 // ── Transpile cache ─────────────────────────────────────────────────
-// NUB_VERSION (from version.mjs) is the SOLE version component of the cache key:
-// oxc-transform is pinned exact + vendored per release, so any emit change ships
-// only in a new nub version, which `make version` bumps. CACHE_SCHEMA busts the
-// cache when the on-disk ENTRY FORMAT changes (v3 = integrity prefix + leading
-// format byte). The fast and compat tiers share this cache: post-extraction they
-// emit byte-identical output for the same (source, ext, tsconfig, pkgType), so a
-// single cache under one key is correct and maximizes hits.
-const CACHE_SCHEMA = "3";
+// The transpile cache — `cacheGet` + transform-on-miss + post-processing
+// (CJS empty-export strip, inline sourceMap, `//# sourceURL=`) + `cacheSet` — is
+// ONE native call now (nub-native `transformCached`): the cache key (NUB_VERSION
+// is the sole version component — a new release ships any emit change + a rebuilt
+// addon), the 16-hex integrity prefix, the `c`/`m` format byte, and the atomic
+// `*.tmp`-then-rename write all live in Rust, byte-identical to the old JS cache so
+// warm caches survive. This JS file keeps only (a) the cache enable/disable signal
+// and (b) the cache directory it passes IN, so the policy stays in JS and native
+// just does the I/O against the dir nub hands it.
+//
 // Disable the transpile cache when (a) the permission model is active (writing a
 // cache file may not be granted), or (b) the user set `NODE_COMPILE_CACHE=0` —
 // Node's compile-cache disable signal, which nub honors as "no caching in this
@@ -736,50 +464,6 @@ if (!CACHE_DISABLED) {
   }
 }
 
-function cacheKey(source) {
-  return getCreateHash()("sha256")
-    .update(NUB_VERSION).update("\0")
-    .update(CACHE_SCHEMA).update("\0")
-    .update(source)
-    .digest("hex");
-}
-// Each entry is stored as `<16-hex integrity prefix><body>`, where the prefix is
-// the first 8 bytes of sha256(body). cacheGet re-checks it and treats ANY
-// mismatch — truncation, on-disk corruption, bit-rot, external edits — as a miss,
-// so the entry is re-transpiled and overwritten (self-heals) instead of feeding
-// garbage to V8.
-const CACHE_INTEGRITY_LEN = 16;
-function cacheIntegrity(body) {
-  return getCreateHash()("sha256").update(body).digest("hex").slice(0, CACHE_INTEGRITY_LEN);
-}
-function cacheGet(key) {
-  if (!cacheDir) return null;
-  let raw;
-  try {
-    raw = readFileSync(join(cacheDir, key), "utf8");
-  } catch {
-    return null;
-  }
-  if (raw.length < CACHE_INTEGRITY_LEN) return null;
-  const body = raw.slice(CACHE_INTEGRITY_LEN);
-  if (raw.slice(0, CACHE_INTEGRITY_LEN) !== cacheIntegrity(body)) return null;
-  return body;
-}
-let cacheTmpCounter = 0;
-function cacheSet(key, value) {
-  if (!cacheDir) return;
-  const finalPath = join(cacheDir, key);
-  // Atomic write: temp file in the same dir, then rename (atomic on POSIX +
-  // Windows same-volume), so a concurrent reader sees old-or-complete, never torn.
-  const tmpPath = `${finalPath}.${process.pid}.${cacheTmpCounter++}.tmp`;
-  try {
-    writeFileSync(tmpPath, cacheIntegrity(value) + value);
-    renameSync(tmpPath, finalPath);
-  } catch {
-    try { unlinkSync(tmpPath); } catch {}
-  }
-}
-
 // ── Bounded-cache maintenance ───────────────────────────────────────
 const CACHE_MAX_BYTES = 512 * 1024 * 1024; // 512 MiB — bounds runaway growth, not normal use
 const SWEEP_INTERVAL_MS = 24 * 60 * 60 * 1000; // ≤ one sweep per day
@@ -814,25 +498,14 @@ export function loadTranspile(url, ext) {
   const filePath = fileURLToPath(url);
   const source = readFileSync(filePath, "utf8");
   const dir = dirname(filePath);
-  const { tsconfig } = getTsconfigForDir(dir);
-  const co = tsconfig?.config?.compilerOptions;
+  // The transform-relevant compilerOptions slice + the byte-for-byte cache-key
+  // component (`tsconfigHash`) both come from the native tsconfig reader.
+  const { compilerOptions: co, tsconfigHash } = getTsconfigForDir(dir);
 
-  // Cache key folds in ext, the resolved tsconfig, and the nearest package.json
-  // type — the same source can transpile to a different format under a different
-  // type. The cached entry's leading byte ('c'/'m') records the chosen format,
-  // so a hit needs no re-detection.
+  // The nearest package.json `type` decides the format of an ambiguous extension
+  // (.ts/.tsx/.jsx); .mts/.cts are explicit so its lookup is skipped. The chosen
+  // format is folded into the cache key (and the entry's leading byte) by native.
   const pkgType = ext === ".mts" || ext === ".cts" ? undefined : getPackageType(dir);
-  const tsconfigHash = co ? JSON.stringify(co) : "";
-  const key = cacheKey(source + "\0" + ext + "\0" + tsconfigHash + "\0" + (pkgType || ""));
-  const cached = cacheGet(key);
-  if (cached) {
-    return {
-      format: cached[0] === "c" ? "commonjs" : "module",
-      source: cached.slice(1),
-      shortCircuit: true,
-    };
-  }
-
   const format = moduleFormatFor(ext, pkgType, filePath, source);
 
   const lang = ext === ".tsx" ? "tsx" : ext === ".jsx" ? "jsx" : "ts";
@@ -867,39 +540,28 @@ export function loadTranspile(url, ext) {
   // Stage-3 decorators: oxc returns errors:[] and emits the `@decorator` syntax
   // verbatim, so the result-error check below never fires and V8 throws a bare
   // SyntaxError. When legacy mode is off and decorator syntax is present, reject
-  // with the documented Option-A diagnostic instead.
+  // with the documented Option-A diagnostic instead. (Cheap `source.includes("@")`
+  // pre-filter keeps decorator-free files off the native parser; runs BEFORE the
+  // cache so the diagnostic surfaces even on what would be a warm hit.)
   if (co?.experimentalDecorators !== true && source.includes("@") &&
       hasDecoratorSyntax(filePath, source, lang)) {
     throw stage3DecoratorError(filePath);
   }
 
-  const result = transformSync(filePath, source, opts);
+  // cacheGet + transform-on-miss + post-process (CJS empty-export strip, inline
+  // sourceMap, sourceURL append) + cacheSet — ALL native, byte-identical on-disk.
+  // The cache key folds in ext + tsconfigHash + pkgType (same source, different
+  // type → different format → distinct entry). `cacheDir: null/undefined` is the
+  // JS enable/disable signal: native then skips all cache I/O and just transforms.
+  const formatByte = format === "commonjs" ? "c" : "m";
+  const result = nubNative.transformCached(
+    filePath, source, opts, ext, tsconfigHash || "", pkgType || "", formatByte, cacheDir ?? undefined,
+  );
   if (result.errors.length > 0) {
     const details = result.errors.map((e) => e.codeframe || e.message).join("\n\n");
     throw new Error(`Transpile error in ${filePath}:\n${details}`);
   }
-
-  let code = result.code;
-  // A CommonJS file must not carry oxc's injected ESM `export {};` marker (CJS
-  // body + ESM marker won't run). Node's strip-types emits no such marker.
-  if (format === "commonjs") code = stripEmptyExportMarker(code);
-  if (result.map) {
-    const map = typeof result.map === "string" ? JSON.parse(result.map) : result.map;
-    map.sourcesContent = [source];
-    code += `\n//# sourceMappingURL=data:application/json;base64,${Buffer.from(JSON.stringify(map)).toString("base64")}\n`;
-  }
-  // Append a `//# sourceURL=` magic comment, matching Node's native strip-types
-  // (lib/internal/modules/typescript.js: `return ${code}\n\n//# sourceURL=${filename}`).
-  // This is the marker V8/the inspector reads to set `scriptParsed.hasSourceURL =
-  // true` — the signal that a script is generated/transpiled rather than read
-  // verbatim from disk (test-inspector-strip-types asserts it). It coexists with
-  // the inline sourceMappingURL above (maps still drive stack frames); sourceURL
-  // only names the origin. Use the absolute file path, exactly as Node does.
-  code += `\n//# sourceURL=${filePath}\n`;
-
-  // Store the chosen format as a leading byte so cache hits skip re-detection.
-  cacheSet(key, (format === "commonjs" ? "c" : "m") + code);
-  return { format, source: code, shortCircuit: true };
+  return { format: result.format, source: result.code, shortCircuit: true };
 }
 
 // ── Data-format imports ─────────────────────────────────────────────