@openclaw/diagnostics-otel 2026.7.1-beta.1 → 2026.7.1-beta.4

package/node_modules/import-in-the-middle/create-hook.mjs

@@ -6,9 +6,10 @@ import { URL, fileURLToPath } from 'url'
 import { inspect } from 'util'
 import { builtinModules } from 'module'
 import {
-  getExports as getExportsImpl,
+  getExports,
   hasModuleExportsCJSDefault
 } from './lib/get-exports.mjs'
+import { RESOLVE, driveSync, driveAsync } from './lib/io.mjs'
 
 const specifiers = new Map()
 const isWin = process.platform === 'win32'
@@ -16,17 +17,34 @@ const isWin = process.platform === 'win32'
 // FIXME: Typescript extensions are added temporarily until we find a better
 // way of supporting arbitrary extensions
 const EXTENSION_RE = /\.(js|mjs|cjs|ts|mts|cts)$/
-const NODE_VERSION = process.versions.node.split('.')
-const NODE_MAJOR = Number(NODE_VERSION[0])
-const NODE_MINOR = Number(NODE_VERSION[1])
 const HANDLED_FORMATS = new Set(['builtin', 'module', 'commonjs'])
 const TRACE_WARNINGS = process.execArgv.includes('--trace-warnings')
 
-let getExports
-if (NODE_MAJOR > 16 || (NODE_MAJOR === 16 && NODE_MINOR >= 16)) {
-  getExports = getExportsImpl
-} else {
-  getExports = (url) => import(url).then(Object.keys)
+// process.versions.node is always "major.minor.patch" (nightlies add a suffix
+// the regex ignores).
+const [, NODE_MAJOR, NODE_MINOR, NODE_PATCH] =
+  process.versions.node.match(/^(\d+)\.(\d+)\.(\d+)/).map(Number)
+
+/**
+ * Whether the running Node.js can correctly run the synchronous loader via
+ * `module.registerHooks`.
+ *
+ * `module.registerHooks` exists since v22.15, but its synchronous load hook
+ * rejected the nullish CommonJS `source` the loader returns for `require()`s
+ * pulled into the ESM graph (throwing `ERR_INVALID_RETURN_PROPERTY_VALUE`) until
+ * https://github.com/nodejs/node/pull/59929, released in 22.22.3, 24.11.1,
+ * 25.1.0 and 26.0.0. Earlier 24.x (<= 24.11.0) and 25.0.0 ship `registerHooks`
+ * but predate the fix, so the synchronous loader must fall back to the
+ * asynchronous one there.
+ *
+ * @returns {boolean}
+ */
+export function supportsSyncHooks () {
+  if (NODE_MAJOR >= 26) return true
+  if (NODE_MAJOR === 25) return NODE_MINOR >= 1
+  if (NODE_MAJOR === 24) return NODE_MINOR > 11 || (NODE_MINOR === 11 && NODE_PATCH >= 1)
+  if (NODE_MAJOR === 22) return NODE_MINOR > 22 || (NODE_MINOR === 22 && NODE_PATCH >= 3)
+  return false
 }
 
 function hasIitm (url) {
@@ -181,21 +199,81 @@ function emitWarning (err) {
   process.emitWarning(warnMessage)
 }
 
+/**
+ * Builds the setter/getter/re-export block injected into the wrapper module for
+ * a single named export. This is pure string generation, identical regardless
+ * of how the loader is driven, so both the synchronous and asynchronous paths
+ * share it.
+ *
+ * @param {string} n The exported name.
+ * @param {string} srcUrl The URL of the module the export belongs to.
+ * @returns {string}
+ */
+function buildSetter (n, srcUrl) {
+  const variableName = `$${n.replace(/[^a-zA-Z0-9_$]/g, '_')}`
+  const objectKey = JSON.stringify(n)
+  const reExportedName = n === 'default' ? n : objectKey
+
+  // For the module.exports synthetic export (Node 23+), fall back to $default
+  // when namespace['module.exports'] is not exposed by the native ESM namespace
+  // (builtins don't expose it). This ensures the IITM hook proxy returns the
+  // actual CJS value (e.g. EventEmitter) when an instrumentor reads
+  // capturedExports['module.exports'], rather than undefined.
+  const moduleExportsFallback = n === 'module.exports' ? ' ?? $default' : ''
+
+  const reExportLine = (n === 'module.exports' && (srcUrl.startsWith('node:') || builtinModules.includes(srcUrl)))
+    ? ''
+    : `export { ${variableName} as ${reExportedName} }`
+
+  return `
+      let ${variableName}
+      __overridden[${objectKey}] = false
+      let ${variableName}Defer = false
+      try {
+        ${variableName} = _[${objectKey}] = namespace[${objectKey}]${moduleExportsFallback}
+      } catch (err) {
+        if (!(err instanceof ReferenceError)) throw err
+        ${variableName}Defer = true
+      }
+
+      if (${variableName}Defer || ${variableName} === undefined) {
+        __pending.push(__makeUpdater(
+          ${objectKey},
+          () => namespace[${objectKey}]${moduleExportsFallback},
+          (v) => { ${variableName} = _[${objectKey}] = v }
+        ))
+      }
+      ${reExportLine}
+      set[${objectKey}] = (v) => {
+        __overridden[${objectKey}] = true
+        ${variableName} = v
+        return true
+      }
+      get[${objectKey}] = () => ${variableName}
+      `
+}
+
 /**
  * Processes a module's exports and builds a set of setter blocks.
  *
+ * Written as a "sans-io" generator (see `lib/io.mjs`): instead of calling the
+ * loader's resolve/load hooks directly it `yield`s `[RESOLVE, ...]` to resolve
+ * star re-exports and `[LOAD, ...]` (via {@link getExports}) to read source,
+ * and is driven by either {@link driveSync} (for
+ * `module.registerHooks`) or {@link driveAsync} (for `module.register`). The
+ * body is identical for both, so there is a single implementation to maintain.
+ *
  * @param {object} params
  * @param {string} params.srcUrl The full URL to the module to process.
  * @param {object} params.context Provided by the loaders API.
- * @param {Function} params.parentGetSource Provides the source code for the parent module.
- * @param {Function} params.parentResolve Provides the resolve function for the parent module.
  * @param {boolean} [params.excludeDefault = false] Exclude the default export.
  *
- * @returns {Promise<Map<string, string>>} The shimmed setters for all the exports
+ * @returns {Generator<Array, Map<string, string>>} A generator that yields I/O
+ * operations and ultimately returns the shimmed setters for all the exports
  * from the module and any transitive export all modules.
  */
-async function processModule ({ srcUrl, context, parentGetSource, parentResolve, excludeDefault = false }) {
-  const exportNames = await getExports(srcUrl, context, parentGetSource)
+function * processModule ({ srcUrl, context, excludeDefault = false }) {
+  const exportNames = yield * getExports(srcUrl, context)
   const starExports = new Set()
   const setters = new Map()
 
@@ -243,17 +321,14 @@ async function processModule ({ srcUrl, context, parentGetSource, parentResolve,
 
       // Relative paths need to be resolved relative to the parent module
       const newSpecifier = isBareSpecifier(modFile) ? modFile : new URL(modFile, srcUrl).href
-      // We need to call `parentResolve` to resolve bare specifiers to a full
-      // URL. We also need to call `parentResolve` for all sub-modules to get
-      // the `format`. We can't rely on the parents `format` to know if this
-      // sub-module is ESM or CJS!
-      const result = await parentResolve(newSpecifier, { parentURL: srcUrl })
+      // We need to resolve bare specifiers to a full URL. We also need to
+      // resolve all sub-modules to get the `format`. We can't rely on the
+      // parent's `format` to know if this sub-module is ESM or CJS!
+      const result = yield [RESOLVE, newSpecifier, { parentURL: srcUrl }]
 
-      const subSetters = await processModule({
+      const subSetters = yield * processModule({
         srcUrl: result.url,
         context: { ...context, format: result.format },
-        parentGetSource,
-        parentResolve,
         excludeDefault: true
       })
 
@@ -261,36 +336,7 @@ async function processModule ({ srcUrl, context, parentGetSource, parentResolve,
         addSetter(name, setter, true)
       }
     } else {
-      const variableName = `$${n.replace(/[^a-zA-Z0-9_$]/g, '_')}`
-      const objectKey = JSON.stringify(n)
-      const reExportedName = n === 'default' ? n : objectKey
-
-      addSetter(n, `
-      let ${variableName}
-      __overridden[${objectKey}] = false
-      let ${variableName}Defer = false
-      try {
-        ${variableName} = _[${objectKey}] = namespace[${objectKey}]
-      } catch (err) {
-        if (!(err instanceof ReferenceError)) throw err
-        ${variableName}Defer = true
-      }
-
-      if (${variableName}Defer || ${variableName} === undefined) {
-        __pending.push(__makeUpdater(
-          ${objectKey},
-          () => namespace[${objectKey}],
-          (v) => { ${variableName} = _[${objectKey}] = v }
-        ))
-      }
-      export { ${variableName} as ${reExportedName} }
-      set[${objectKey}] = (v) => {
-        __overridden[${objectKey}] = true
-        ${variableName} = v
-        return true
-      }
-      get[${objectKey}] = () => ${variableName}
-      `)
+      addSetter(n, buildSetter(n, srcUrl))
     }
   }
 
@@ -307,56 +353,105 @@ export function createHook (meta) {
   let cachedResolve
   const iitmURL = new URL('lib/register.js', meta.url).toString()
   let includeModules, excludeModules
+  let shouldInclude = defaultShouldInclude
+
+  // Track CJS module URLs that IITM has wrapped. On Node 24+, CJS modules loaded
+  // via loadCJSModule (in an ESM import chain) have their require() calls for
+  // builtins routed through the ESM resolver. Without this guard, IITM would
+  // intercept those require() calls and return an ESM namespace object instead
+  // of the native CJS module value (e.g. EventEmitter constructor), breaking
+  // patterns like `class App extends require('events') {}`.
+  const cjsInIitmChain = new Set()
+
+  // Default matcher, used unless the consumer supplies its own `shouldInclude`
+  // (see applyOptions). It applies the include/exclude lists, so finishResolve
+  // always has a predicate to call and never has to special-case its absence.
+  //
+  // We check the specifier to match libraries loaded with bare specifiers from
+  // node_modules, and the full file URL for non-bare specifier imports (relative
+  // paths would be error prone). An absolute path entry added via Hook over the
+  // message port matches the resolved file path, so it is resolved here.
+  function defaultShouldInclude (url, specifier) {
+    let resultPath
+    if (url.startsWith('file:')) {
+      const stackTraceLimit = Error.stackTraceLimit
+      Error.stackTraceLimit = 0
+      try {
+        resultPath = fileURLToPath(url)
+      } catch {}
+      Error.stackTraceLimit = stackTraceLimit
+    }
+    function match (each) {
+      if (each instanceof RegExp) {
+        return each.test(url)
+      }
 
-  async function initialize (data) {
-    if (global.__import_in_the_middle_initialized__) {
-      process.emitWarning("The 'import-in-the-middle' hook has already been initialized")
+      return each === specifier || each === url || (resultPath && each === resultPath)
     }
 
-    global.__import_in_the_middle_initialized__ = true
+    if (includeModules && !includeModules.some(match)) {
+      return false
+    }
 
-    if (data) {
-      includeModules = ensureArrayWithBareSpecifiersFileUrlsAndRegex(data.include, 'include')
-      excludeModules = ensureArrayWithBareSpecifiersFileUrlsAndRegex(data.exclude, 'exclude')
+    if (excludeModules && excludeModules.some(match)) {
+      return false
+    }
 
-      if (data.addHookMessagePort) {
-        data.addHookMessagePort.on('message', (modules) => {
-          if (includeModules === undefined) {
-            includeModules = []
-          }
+    return true
+  }
 
-          for (const each of modules) {
-            if (!each.startsWith('node:') && builtinModules.includes(each)) {
-              includeModules.push(`node:${each}`)
-            }
+  // Applies the include/exclude/message-port configuration. Shared by the
+  // asynchronous `initialize` (off-thread `module.register`, which receives
+  // `data` over the registration boundary) and by synchronous registration
+  // (`module.registerHooks`), which has no `initialize` step and passes the
+  // same options directly.
+  function applyOptions (data) {
+    includeModules = ensureArrayWithBareSpecifiersFileUrlsAndRegex(data.include, 'include')
+    excludeModules = ensureArrayWithBareSpecifiersFileUrlsAndRegex(data.exclude, 'exclude')
+
+    // A consumer can supply its own matcher as `shouldInclude(url, specifier)`,
+    // taking ownership of the include/exclude decision instead of expressing it
+    // as bare-specifier / file-URL / regex lists. It replaces the default list
+    // matcher and is called with the resolved URL and specifier; otherwise the
+    // default applies the include/exclude options.
+    shouldInclude = typeof data.shouldInclude === 'function' ? data.shouldInclude : defaultShouldInclude
+
+    if (data.addHookMessagePort) {
+      data.addHookMessagePort.on('message', (modules) => {
+        if (includeModules === undefined) {
+          includeModules = []
+        }
 
-            includeModules.push(each)
+        for (const each of modules) {
+          if (!each.startsWith('node:') && builtinModules.includes(each)) {
+            includeModules.push(`node:${each}`)
           }
 
-          data.addHookMessagePort.postMessage('ack')
-        }).unref()
-      }
+          includeModules.push(each)
+        }
+
+        data.addHookMessagePort.postMessage('ack')
+      }).unref()
     }
   }
 
-  async function resolve (specifier, context, parentResolve) {
-    cachedResolve = parentResolve
-
-    // See https://github.com/nodejs/import-in-the-middle/pull/76.
-    if (specifier === iitmURL) {
-      return {
-        url: specifier,
-        shortCircuit: true
-      }
+  async function initialize (data) {
+    if (global.__import_in_the_middle_initialized__) {
+      process.emitWarning("The 'import-in-the-middle' hook has already been initialized")
     }
 
-    const { parentURL = '' } = context
-    const newSpecifier = deleteIitm(specifier)
-    if (isWin && parentURL.indexOf('file:node') === 0) {
-      context.parentURL = ''
+    global.__import_in_the_middle_initialized__ = true
+
+    if (data) {
+      applyOptions(data)
     }
-    const result = await parentResolve(newSpecifier, context)
+  }
 
+  // Shared post-processing for the `resolve` hook: everything that happens
+  // once the parent loader has turned the specifier into a resolved URL. The
+  // only difference between the asynchronous and synchronous hooks is whether
+  // that resolution was awaited, so all the wrapping decisions live here.
+  function finishResolve (result, specifier, context, parentURL) {
     // Do not wrap the entrypoint module. Many CLIs check whether they are the
     // "main" module (e.g. require.main === module). Wrapping changes how they
     // are evaluated, and can make them exit without doing anything.
@@ -367,37 +462,28 @@ export function createHook (meta) {
       return result
     }
 
-    // For included/excluded modules, we check the specifier to match libraries
-    // that are loaded with bare specifiers from node_modules.
-    //
-    // For non-bare specifier imports, we match to the full file URL because
-    // using relative paths would be very error prone!
-    let resultPath
-    if (result.url.startsWith('file:')) {
-      const stackTraceLimit = Error.stackTraceLimit
-      Error.stackTraceLimit = 0
-      try {
-        resultPath = fileURLToPath(result.url)
-      } catch {}
-      Error.stackTraceLimit = stackTraceLimit
-    }
-    function match (each) {
-      if (each instanceof RegExp) {
-        return each.test(result.url)
-      }
-
-      return each === specifier || each === result.url || (resultPath && each === resultPath)
-    }
-
+    // Never wrap a module whose format we don't handle (e.g. json, wasm); this
+    // holds regardless of how inclusion is decided below.
     if (result.format && !HANDLED_FORMATS.has(result.format)) {
       return result
     }
 
-    if (includeModules && !includeModules.some(match)) {
+    // The synchronous hooks (`module.registerHooks`) fire for `require()` as well
+    // as `import`, but iitm only owns the ESM graph: CommonJS modules are
+    // instrumented separately through require-in-the-middle, and `require()` must
+    // return the native, mutable module value (e.g. graceful-fs does
+    // `Object.defineProperty(require('fs'), ...)`, which throws on a frozen ESM
+    // namespace). Node reports the active module system in `context.conditions`
+    // ('require' vs 'import'), so leave any require() resolution untouched. The
+    // asynchronous hook never sees the 'require' condition, so this is a no-op
+    // there and only affects the synchronous path.
+    if (context.conditions?.includes('require')) {
       return result
     }
 
-    if (excludeModules && excludeModules.some(match)) {
+    // `shouldInclude` is always set (the include/exclude list matcher by default,
+    // a consumer-provided predicate otherwise), so no nullish check is needed.
+    if (!shouldInclude(result.url, specifier)) {
       return result
     }
 
@@ -405,6 +491,17 @@ export function createHook (meta) {
       return result
     }
 
+    // When a CJS module is loaded by an IITM shim, its require() calls for
+    // builtins may be routed through the ESM resolver on Node 24+. Skip IITM
+    // wrapping in that case so require() returns the native module value.
+    // We also propagate the membership to the resolved child so that its own
+    // transitive require() calls are likewise skipped (the entire synchronous
+    // CJS require chain must remain unwrapped to avoid ERR_VM_MODULE_LINK_FAILURE).
+    if (cjsInIitmChain.has(parentURL)) {
+      cjsInIitmChain.add(result.url)
+      return result
+    }
+
     // We don't want to attempt to wrap native modules
     if (result.url.endsWith('.node')) {
       return result
@@ -430,26 +527,63 @@ export function createHook (meta) {
     return {
       url: addIitm(result.url),
       shortCircuit: true,
-      format: result.format
+      // Node's synchronous resolver drops `format: 'builtin'` for bare builtin
+      // specifiers (`require('crypto')` -> `node:crypto`), so restore it;
+      // otherwise the load hook reads `node:crypto` from disk and throws ENOENT.
+      format: result.format ?? (result.url.startsWith('node:') ? 'builtin' : undefined)
     }
   }
 
-  async function getSource (url, context, parentGetSource) {
-    if (hasIitm(url)) {
-      const realUrl = deleteIitm(url)
-      const originalSpecifier = specifiers.get(realUrl)
+  async function resolve (specifier, context, parentResolve) {
+    cachedResolve = parentResolve
 
-      try {
-        const setters = await processModule({
-          srcUrl: realUrl,
-          context,
-          parentGetSource,
-          parentResolve: cachedResolve
-        })
-        // If the module loaded successfully, we can remove the specifier to reduce memory usage early.
-        specifiers.delete(realUrl)
-        return {
-          source: `
+    // See https://github.com/nodejs/import-in-the-middle/pull/76.
+    if (specifier === iitmURL) {
+      return {
+        url: specifier,
+        shortCircuit: true
+      }
+    }
+
+    const { parentURL = '' } = context
+    const newSpecifier = deleteIitm(specifier)
+    if (isWin && parentURL.indexOf('file:node') === 0) {
+      context.parentURL = ''
+    }
+    const result = await parentResolve(newSpecifier, context)
+
+    return finishResolve(result, specifier, context, parentURL)
+  }
+
+  // Synchronous counterpart to `resolve`, for `module.registerHooks`. The
+  // synchronous `nextResolve` returns its result directly. We stash it so the
+  // synchronous `load` hook can resolve star re-exports later, mirroring how
+  // `resolve` caches `parentResolve`.
+  function resolveSync (specifier, context, nextResolve) {
+    cachedResolve = nextResolve
+
+    if (specifier === iitmURL) {
+      return {
+        url: specifier,
+        shortCircuit: true
+      }
+    }
+
+    const { parentURL = '' } = context
+    const newSpecifier = deleteIitm(specifier)
+    if (isWin && parentURL.indexOf('file:node') === 0) {
+      context.parentURL = ''
+    }
+    const result = nextResolve(newSpecifier, context)
+
+    return finishResolve(result, specifier, context, parentURL)
+  }
+
+  // Builds the wrapper module source that re-exports the real module through
+  // iitm's proxy. Pure string generation shared by the asynchronous and
+  // synchronous `load` paths.
+  function buildWrapperSource (realUrl, setters, originalSpecifier) {
+    return `
 import { register } from '${iitmURL}'
 import * as namespace from ${JSON.stringify(realUrl)}
 
@@ -518,26 +652,46 @@ if (__pending.length > 0) {
 
 register(${JSON.stringify(realUrl)}, _, set, get, ${JSON.stringify(originalSpecifier)})
 `
-        }
-      } catch (cause) {
-        // If the module failed loading, the specifier will not be used again, so
-        // we can remove it to prevent a memory leak.
-        specifiers.delete(realUrl)
-        // If there are other ESM loader hooks registered as well as iitm,
-        // depending on the order they are registered, source might not be
-        // JavaScript.
-        //
-        // If we fail to parse a module for exports, we should fall back to the
-        // parent loader. These modules will not be wrapped with proxies and
-        // cannot be Hook'ed but at least this does not take down the entire app
-        // and block iitm from being used.
-        //
-        // We log the error because there might be bugs in iitm and without this
-        // it would be very tricky to debug
-        const err = new Error(`'import-in-the-middle' failed to wrap '${realUrl}'`)
-        err.cause = cause
-        emitWarning(err)
+  }
+
+  // Bookkeeping shared by the async and sync wrap paths once `processModule`
+  // succeeds: free the specifier entry early, and remember CJS modules so their
+  // transitive require() chain bypasses iitm (see `load`). Returns the wrapper
+  // module source.
+  function onWrapSuccess (realUrl, context, originalSpecifier, setters) {
+    specifiers.delete(realUrl)
+    // context.format is set to 'commonjs' by getCjsExports during processModule.
+    if (context.format === 'commonjs') {
+      cjsInIitmChain.add(realUrl)
+    }
+    return buildWrapperSource(realUrl, setters, originalSpecifier)
+  }
+
+  // Bookkeeping shared by the async and sync wrap paths when `processModule`
+  // throws. iitm falls back to the parent loader so the module loads unwrapped
+  // (it just can't be Hook'ed) rather than taking down the whole app. We free
+  // the specifier entry to avoid a leak, and log because a failure here is
+  // usually an iitm bug and would otherwise be very tricky to debug.
+  function onWrapFailure (realUrl, cause) {
+    specifiers.delete(realUrl)
+    const err = new Error(`'import-in-the-middle' failed to wrap '${realUrl}'`)
+    err.cause = cause
+    emitWarning(err)
+  }
+
+  async function getSource (url, context, parentGetSource) {
+    if (hasIitm(url)) {
+      const realUrl = deleteIitm(url)
+      const originalSpecifier = specifiers.get(realUrl)
 
+      try {
+        const setters = await driveAsync(
+          processModule({ srcUrl: realUrl, context }),
+          { resolve: cachedResolve, load: parentGetSource }
+        )
+        return { source: onWrapSuccess(realUrl, context, originalSpecifier, setters) }
+      } catch (cause) {
+        onWrapFailure(realUrl, cause)
         // Revert back to the non-iitm URL
         url = realUrl
       }
@@ -546,6 +700,29 @@ register(${JSON.stringify(realUrl)}, _, set, get, ${JSON.stringify(originalSpeci
     return parentGetSource(url, context)
   }
 
+  // Synchronous counterpart to `getSource`, for `module.registerHooks`. Drives
+  // `processModule` straight through; all bookkeeping and source generation is
+  // shared with `getSource`.
+  function getSourceSync (url, context, nextLoad) {
+    if (hasIitm(url)) {
+      const realUrl = deleteIitm(url)
+      const originalSpecifier = specifiers.get(realUrl)
+
+      try {
+        const setters = driveSync(
+          processModule({ srcUrl: realUrl, context }),
+          { resolve: cachedResolve, load: nextLoad }
+        )
+        return { source: onWrapSuccess(realUrl, context, originalSpecifier, setters) }
+      } catch (cause) {
+        onWrapFailure(realUrl, cause)
+        url = realUrl
+      }
+    }
+
+    return nextLoad(url, context)
+  }
+
   async function load (url, context, parentLoad) {
     if (hasIitm(url)) {
       const result = await getSource(url, context, parentLoad)
@@ -563,8 +740,60 @@ register(${JSON.stringify(realUrl)}, _, set, get, ${JSON.stringify(originalSpeci
       return parentLoad(deleteIitm(url), context)
     }
 
+    // On Node 22+, when a CJS module is loaded through the ESM translator and
+    // another loader hook provides its source (instead of leaving source null
+    // for Node to read natively), require() calls inside that CJS module for
+    // packages using the "module-sync" exports condition fail with
+    // ERR_VM_MODULE_LINK_FAILURE. Work around this Node bug by stripping
+    // hook-provided source for CJS modules in the synchronous require chain,
+    // forcing Node to use its native CJS loader which handles this correctly.
+    if (cjsInIitmChain.has(url)) {
+      const result = await parentLoad(url, context)
+      if (result.format === 'commonjs' && result.source != null) {
+        return {
+          format: result.format,
+          source: undefined
+        }
+      }
+      return result
+    }
+
     return parentLoad(url, context)
   }
 
-  return { initialize, load, resolve }
+  // Synchronous counterpart to `load`, for `module.registerHooks`. Mirrors the
+  // async `load` exactly — wrapping via `getSourceSync` and applying the same
+  // CJS-in-iitm-chain source stripping — only without awaiting.
+  function loadSync (url, context, nextLoad) {
+    if (hasIitm(url)) {
+      const result = getSourceSync(url, context, nextLoad)
+      // If wrapping failed, `getSourceSync()` may have fallen back to `nextLoad`,
+      // which can legally return `source: null` (e.g. for non-JS formats).
+      if (result && typeof result === 'object' && result.source != null) {
+        return {
+          source: result.source,
+          shortCircuit: true,
+          format: 'module'
+        }
+      }
+
+      // Fall back to the parent loader with the original (non-iitm) URL.
+      return nextLoad(deleteIitm(url), context)
+    }
+
+    if (cjsInIitmChain.has(url)) {
+      const result = nextLoad(url, context)
+      if (result.format === 'commonjs' && result.source != null) {
+        return {
+          format: result.format,
+          source: undefined
+        }
+      }
+      return result
+    }
+
+    return nextLoad(url, context)
+  }
+
+  return { initialize, load, resolve, resolveSync, loadSync, applyOptions }
 }