@pulse-compute/wasm-compiler 1.0.0-beta.7 → 1.0.0-beta.9

package/README.md

@@ -8,9 +8,9 @@
 > **Stability:** Internal compiler interface; no application-author compatibility guarantee.<br>
 > **npm:** [`@pulse-compute/wasm-compiler`](https://www.npmjs.com/package/@pulse-compute/wasm-compiler)<br>
 > **Canonical replacement:** `@pulse-compute/cli`<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.7/packages/implementation-packages/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.9/packages/implementation-packages/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.7` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.9` package policy.
 <!-- pulse-package-status:end -->
 
 Whole-project compiler implementation used by the `pulse` workflow. Application projects should use `@pulse-compute/cli`, not import this package directly.
@@ -63,4 +63,4 @@ The package exports its root implementation plus focused compiler, CLI, extracto
 
 Compiler changes should be covered by focused static/lowering tests, canonical project inspection, provider-plan parity, packed-package discovery where relevant, and the release documentation gates.
 
-See the installed [implementation package guide](https://pulsecompute.io/v1.0.0-beta.7/packages/implementation-packages/) and [compilation concepts](https://pulsecompute.io/v1.0.0-beta.7/concepts/compilation-and-lowering/).
+See the installed [implementation package guide](https://pulsecompute.io/v1.0.0-beta.9/packages/implementation-packages/) and [compilation concepts](https://pulsecompute.io/v1.0.0-beta.9/concepts/compilation-and-lowering/).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/wasm-compiler",
-  "version": "1.0.0-beta.7",
+  "version": "1.0.0-beta.9",
   "license": "Apache-2.0",
   "description": "PulseWasm compiler package inside the Pulse monorepo.",
   "type": "commonjs",
@@ -9,13 +9,13 @@
     "pulsewasm": "./bin/pulsewasm-extract.js"
   },
   "dependencies": {
-    "@pulse-compute/wasm-build-support": "1.0.0-beta.7",
-    "@pulse-compute/wasm-contracts": "1.0.0-beta.7",
-    "@pulse-compute/wasm-guest-link": "1.0.0-beta.7",
-    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.7",
-    "@pulse-compute/wasm-library-kit": "1.0.0-beta.7",
-    "@pulse-compute/wasm-runtime-core-as": "1.0.0-beta.7",
-    "@pulse-compute/wasm-schema-json": "1.0.0-beta.7",
+    "@pulse-compute/wasm-build-support": "1.0.0-beta.9",
+    "@pulse-compute/wasm-contracts": "1.0.0-beta.9",
+    "@pulse-compute/wasm-guest-link": "1.0.0-beta.9",
+    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.9",
+    "@pulse-compute/wasm-library-kit": "1.0.0-beta.9",
+    "@pulse-compute/wasm-runtime-core-as": "1.0.0-beta.9",
+    "@pulse-compute/wasm-schema-json": "1.0.0-beta.9",
     "assemblyscript": "0.28.18",
     "json-as": "1.5.0",
     "typescript": "5.9.3"
@@ -56,7 +56,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "wasm/packages/compiler"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.7/packages/implementation-packages/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.9/packages/implementation-packages/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   },

package/src/canonical-native-compiler.js

@@ -142,7 +142,14 @@ function realizeCanonicalNativePlan(plan, options = {}, providerRequirements) {
     source, sourceHash: sha256(source), manifest: Object.freeze({
       ...application.manifest, planVersion: plan.version, planHash: plan.planHash, sourceHash: sha256(source)
     })
-  }) : runtimeCore.generateCanonicalNativeAssemblyScript(plan, options);
+  }) : runtimeCore.generateCanonicalNativeAssemblyScript(plan, {
+    ...options,
+    // This compiler emits the pulse_host artifact consumed by Node Native.
+    // Provider writers own their final emission policies. Linked guests retain
+    // their existing path until separately qualified; budgeted plans are gated
+    // by the canonical numeric proof itself.
+    numericRegions: guestUnits.length === 0 ? 'host-numeric-regions-v1' : undefined
+  });
   const schemaCodecsActive = generated.manifest.schemaCodecs && generated.manifest.schemaCodecs.active === true;
   let jsonAs;
   if (schemaCodecsActive) {
@@ -221,9 +228,10 @@ function realizeCanonicalNativePlan(plan, options = {}, providerRequirements) {
         '--path', jsonAs.dependencyRoot
       );
     }
+    require('@pulse-compute/wasm-build-support/native-optimization').appendJsonCacheArenaArgs(args, options.elideJsonCacheArena, schemaCodecsActive);
     const readReportCapture = options.reportCapture === false ? () => null : prepareReportCapture(args, stagingDir, generated.manifest,
       require(path.join(asc.packageRoot, 'package.json')).version, 'canonical-native.as/');
-    const startedAt = Date.now();
+    const startedAt = process.hrtime.bigint();
     const result = spawnSync(asc.executable, args, {
       cwd: stagingDir,
       encoding: 'utf8',
@@ -233,7 +241,7 @@ function realizeCanonicalNativePlan(plan, options = {}, providerRequirements) {
         ? { ...process.env, JSON_STRICT: 'true', JSON_USE_FAST_PATH: '0', JSON_MODE: 'NAIVE' }
         : process.env
     });
-    const durationMs = Date.now() - startedAt;
+    const durationMs = Math.round(Number(process.hrtime.bigint() - startedAt) / 1e6);
     if (result.error || result.status !== 0 || !fs.existsSync(wasmFile)) {
       throw new CanonicalNativeCompileError('AssemblyScript failed to compile the canonical native plan.', {
         status: result.status,
@@ -253,9 +261,15 @@ function realizeCanonicalNativePlan(plan, options = {}, providerRequirements) {
       guestUnits,
       generated,
       reportAttribution: readReportCapture(wasm),
+      buildObservation: require('@pulse-compute/wasm-build-support/native-optimization').observeAssemblyScript(args, {
+        version: require(path.join(asc.packageRoot, 'package.json')).version,
+        assemblyScriptRoot: asc.packageRoot, timeoutMs: Number(options.timeoutMs || 120000),
+        compilerVersion: runtimeContract.CANONICAL_NATIVE_COMPILER_VERSION, durationMs, jsonAsVersion: jsonAs && jsonAs.version
+      }),
       wasm,
       wat: emitWat ? fs.readFileSync(watFile, 'utf8') : '',
       textEmitted: emitWat,
+      elideJsonCacheArena: options.elideJsonCacheArena === true,
       assemblyScriptVersion: require(path.join(asc.packageRoot, 'package.json')).version,
       jsonAsVersion: jsonAs && jsonAs.version,
       optimization,
@@ -286,8 +300,9 @@ function verifyCanonicalNativeRealization(realization) {
     compilerVersion: runtimeContract.CANONICAL_NATIVE_COMPILER_VERSION,
     assemblyScript: Object.freeze({ package: 'assemblyscript', version: realization.assemblyScriptVersion }),
     optimization: resolveNativeOptimization(realization.optimization),
+    elideJsonCacheArena: realization.elideJsonCacheArena,
     jsonAs: realization.jsonAsVersion
-      ? Object.freeze({ package: 'json-as', version: realization.jsonAsVersion, transform: true, strict: true, mode: 'NAIVE', fastPath: false })
+      ? Object.freeze({ package: 'json-as', version: realization.jsonAsVersion, transform: true, strict: true, mode: 'NAIVE', fastPath: false, elideDisabledCacheArena: realization.elideJsonCacheArena })
       : null,
     wasm: Object.freeze({ bytes: inspection.bytes, sha256: inspection.sha256, magic: inspection.magic }),
     wat: Object.freeze(realization.textEmitted
@@ -321,6 +336,7 @@ function verifyCanonicalNativeRealization(realization) {
     wat: realization.wat,
     inspection,
     manifest,
+    buildObservation: realization.buildObservation,
     durationMs: realization.durationMs,
     output: realization.output
   });

package/src/canonical-native-plan.js

@@ -1905,6 +1905,7 @@ module.exports = Object.freeze({
   CANONICAL_NATIVE_PLAN_OWNERSHIP_VERSION: contract.CANONICAL_NATIVE_PLAN_OWNERSHIP_VERSION,
   CanonicalNativePlanError,
   buildCanonicalNativePlan,
+  collectCanonicalReportReferences: require('./report-reference-provenance').collectCanonicalReportReferences,
   validateCanonicalNativePlan: assertCanonicalNativePlan,
   writeCanonicalNativePlan,
   stableStringify

package/src/canonical-project-compiler.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { retainSourceInputs, sourceInputsForCompiled } = require('./report-source-inputs');
+
 const fs = require('node:fs');
 const path = require('node:path');
 const ts = require('typescript');
@@ -395,6 +397,7 @@ function prepareReachableProjectPackageOperations(graphBuild, options = {}) {
       // identity checkout-independent. Absolute paths remain private graph
       // facts and must not feed project or native-plan hashes.
       ...(preserveSingleFilePublicEnvelope ? { publicSourceName: module.path } : {}),
+      packageDirs: context.packageContractCatalog.contracts.map(entry => entry.packageDir),
       selectedContracts: [...selectedContracts].sort()
     }));
   }
@@ -995,6 +998,7 @@ function compileCanonicalProjectLegacy(entryFile, options = {}) {
   try {
     graphBuild = buildReachableProjectGraph(absoluteEntry, {
       rootDir,
+      target: options.target,
       workspaceRoot: options.workspaceRoot,
       tsconfigFile: options.tsconfigFile,
       resolver: options.moduleResolver,
@@ -1230,10 +1234,12 @@ function compileCanonicalProjectLegacy(entryFile, options = {}) {
     ...(applicationEnvelope ? { application: applicationEnvelope } : {}),
     watchFiles: Object.freeze([...new Set([
       ...graphBuild.projectFiles,
+      ...graphBuild.packageSourceManifests,
       ...schema.dependencies,
       ...(packageOperationRecognition.dependencies || [])
     ].map((file) => path.resolve(file)))])
   });
+  retainSourceInputs(project, projectGraphContext(graphBuild));
   attachPackageOperationRecognition(project, packageOperationRecognition);
   if (terminalPackageApplication) attachTerminalPackageNative(project, {
     application: terminalPackageApplication, recognition: packageOperationRecognition,
@@ -1261,5 +1267,6 @@ module.exports = Object.freeze({
   compileProjectSchemas,
   compileProjectPackageExtensions,
   compileCanonicalProject,
-  packageRealizationArtifactsForCompiled
+  packageRealizationArtifactsForCompiled,
+  sourceInputsForCompiled
 });

package/src/javascript-application-plan.js

@@ -112,6 +112,7 @@ function buildJavascriptApplicationPlan(entryFile, options = {}) {
   let graphBuild;
   try {
     graphBuild = buildReachableProjectGraph(absoluteEntry, {
+      target: 'javascript',
       rootDir: options.rootDir,
       workspaceRoot: options.workspaceRoot,
       configFile: options.configFile,

package/src/project/npm-source-resolution.js

@@ -0,0 +1,91 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const ts = require('typescript');
+const { sourceResolution } = require('../report-source-inputs');
+const reportOwners = new WeakMap();
+
+// This resolver reads source; it never imports a package or its compiler metadata.
+const CONDITIONS = new Set(['pulse', 'import', 'default']);
+
+function fail(message) { throw new Error(message); }
+
+function exportTarget(exports, subpath) {
+  let selected = exports;
+  if (exports && typeof exports === 'object' && !Array.isArray(exports)) {
+    const keys = Object.keys(exports);
+    if (keys.some(key => key.startsWith('.'))) {
+      if (keys.some(key => !key.startsWith('.'))) fail('Mixed export subpaths and conditions are unsupported.');
+      if (!Object.hasOwn(exports, subpath)) fail(`No exact declared export for ${subpath}; wildcard exports are unsupported.`);
+      selected = exports[subpath];
+    } else if (subpath !== '.') fail(`No exact declared export for ${subpath}.`);
+  } else if (subpath !== '.') fail(`No exact declared export for ${subpath}.`);
+  while (selected && typeof selected === 'object' && !Array.isArray(selected)) {
+    const key = Object.keys(selected).find(key => CONDITIONS.has(key));
+    if (!key) fail('No pulse, import or default export condition.');
+    selected = selected[key];
+  }
+  if (typeof selected !== 'string') fail('A source export must select one string target; blocked, missing and array targets are unsupported.');
+  if (!selected.startsWith('./') || /[\\%?#*\0]/.test(selected)
+      || selected.slice(2).split('/').some(part => !part || part === '.' || part === '..' || part.toLowerCase() === 'node_modules')) {
+    fail('A source export must name a contained relative file without traversal or node_modules.');
+  }
+  return selected;
+}
+
+function sourceFile(root, candidate, declaration = false, reportOwner, prefix) {
+  const relative = path.relative(root, candidate);
+  if (!relative || relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)
+      || relative.split(path.sep).some(part => part.toLowerCase() === 'node_modules')) fail('Source file escapes its package root.');
+  const supported = file => /\.(?:ts|mts|js|mjs)$/.test(file) && (declaration || !/\.d\.(?:ts|mts)$/.test(file));
+  if (!supported(candidate)) fail('Only .ts, .mts, .js and .mjs ESM source files are supported.');
+  if (!fs.existsSync(candidate) || !fs.statSync(candidate).isFile()) fail('Declared source file does not exist.');
+  const real = fs.realpathSync(candidate);
+  if (!supported(real)) fail('Source symlink must resolve to a supported ESM source file.');
+  const realRelative = path.relative(root, real);
+  if (!realRelative || realRelative === '..' || realRelative.startsWith(`..${path.sep}`) || path.isAbsolute(realRelative)
+      || realRelative.split(path.sep).some(part => part.toLowerCase() === 'node_modules')) fail('Source symlink escapes its package root.');
+  sourceResolution(reportOwner, candidate, real, `${prefix}/${realRelative.split(path.sep).join('/')}`);
+  return real;
+}
+
+function packageSource(manifestPath, manifest, packageName, subpath, manifestHash, reportOwner) {
+  if (manifest.name !== packageName || typeof manifest.version !== 'string'
+      || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(manifest.version)) fail('Source packages require a matching name and concrete version.');
+  const root = fs.realpathSync(path.dirname(manifestPath));
+  const target = exportTarget(manifest.exports, subpath);
+  const prefix = `npm/${packageName}@${manifest.version}/${manifestHash}`;
+  const absolute = sourceFile(root, path.resolve(root, target), false, reportOwner, prefix);
+  if (manifest.type === 'commonjs' && /\.(?:js|ts)$/.test(absolute)) fail('Explicit CommonJS package sources are unsupported; declare an ESM source export.');
+  const owner = Object.freeze({ root, absolute, packageName, packageVersion: manifest.version, packageManifestHash: manifestHash, packageType: manifest.type,
+    prefix });
+  if (reportOwner) reportOwners.set(owner, reportOwner);
+  return owner;
+}
+
+function relativeSource(owner, importer, specifier, declaration = false) {
+  if (!specifier.startsWith('./') && !specifier.startsWith('../')) fail('Package source cannot use application tsconfig aliases.');
+  if (/[\\%?#\0]/.test(specifier)) fail('Unsupported package source specifier.');
+  // Exact ESM file links only: no extension substitution, directory or main fallback.
+  const absolute = sourceFile(owner.root, path.resolve(path.dirname(importer), specifier), declaration, reportOwners.get(owner), owner.prefix);
+  if (!declaration && owner.packageType === 'commonjs' && /\.(?:js|ts)$/.test(absolute)) fail('Explicit CommonJS package sources are unsupported.');
+  return absolute;
+}
+
+function unsupportedStatement(sourceFile) {
+  const functionValue = node => {
+    while (node && (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node))) node = node.expression;
+    return node && (ts.isArrowFunction(node) || ts.isFunctionExpression(node));
+  };
+  return sourceFile.statements.find(statement => {
+    if (ts.isImportDeclaration(statement) || ts.isExportDeclaration(statement) || ts.isFunctionDeclaration(statement)
+        || ts.isInterfaceDeclaration(statement) || ts.isTypeAliasDeclaration(statement) || ts.isEmptyStatement(statement)) return false;
+    if (ts.isExportAssignment(statement)) return statement.isExportEquals || !(ts.isIdentifier(statement.expression) || functionValue(statement.expression));
+    if (ts.isVariableStatement(statement)) return !(statement.declarationList.flags & ts.NodeFlags.Const)
+      || statement.declarationList.declarations.some(declaration => !ts.isIdentifier(declaration.name) || !functionValue(declaration.initializer));
+    return true;
+  });
+}
+
+module.exports = Object.freeze({ packageSource, relativeSource, unsupportedStatement });

package/src/project/package-reachability.js

@@ -337,7 +337,7 @@ function packageRelationsForModule(context, targetKey) {
   for (const module of context.projectModules.values()) {
     for (const relation of [...module.imports, ...module.reExports]) {
       const resolution = module.resolutions.find((entry) => entry.relation === relation);
-      if (!resolution || resolution.targetKey !== targetKey) continue;
+      if (!resolution || (resolution.packageKey || resolution.targetKey) !== targetKey) continue;
       records.push(Object.freeze({ module, relation }));
     }
   }
@@ -505,6 +505,7 @@ function derivePackageReachabilityProjection(context, manifest, states) {
     const reExportSources = relations.filter((entry) => entry.relation.kind === 're-export' && entry.relation.typeOnly !== true).map((entry) => entry.relation.source);
     let nativeStatus = 'unsupported';
     if (module.coreAuthoring) nativeStatus = 'core-authoring';
+    else if (module.sourceModule) nativeStatus = 'static-source';
     else if (module.packageContract && module.contract && module.contract.targetSupport.native === true) nativeStatus = 'trusted-lowerable';
     if (module.runtime && nativeStatus === 'trusted-lowerable') selectedContracts.add(module.packageContract);
     packages.push({

package/src/project/reachable-graph-builder.js

@@ -2,8 +2,10 @@
 
 const crypto = require('node:crypto');
 const fs = require('node:fs');
+const { readSourceInput, missingManifest } = require('../report-source-inputs');
 const path = require('node:path');
 const ts = require('typescript');
+const npmSource = require('./npm-source-resolution.js');
 const { discoverPackageContractCatalog } = require('../spine/package-operation-seam.js');
 const {
   PackageReachabilityError,
@@ -34,7 +36,8 @@ class ReachableProjectGraphError extends Error {
   constructor(message, diagnostics = [], detail = {}) {
     super(message);
     this.name = 'ReachableProjectGraphError';
-    this.code = 'PULSE_PROJECT_GRAPH_FAILED';
+    this.code = diagnostics.length > 0 && diagnostics.every(entry => entry.code === 'PULSE_NATIVE_IMPORT_UNSUPPORTED')
+      ? 'PULSE_NATIVE_IMPORT_UNSUPPORTED' : 'PULSE_PROJECT_GRAPH_FAILED';
     this.diagnostics = Object.freeze([...diagnostics]);
     this.detail = Object.freeze({ ...detail });
   }
@@ -158,8 +161,8 @@ function propertyNameText(node) {
   return undefined;
 }
 
-function parseModule(rootDir, absolutePath, logicalPathInput) {
-  const sourceText = fs.readFileSync(absolutePath, 'utf8');
+function parseModule(rootDir, absolutePath, logicalPathInput, reportOwner) {
+  const sourceText = reportOwner ? readSourceInput(reportOwner, absolutePath, 'source', logicalPathInput) : fs.readFileSync(absolutePath, 'utf8');
   const logicalPath = logicalPathInput ? graph.normalizePortablePath(logicalPathInput, 'project module path') : portableFilePath(rootDir, absolutePath);
   const sourceFile = ts.createSourceFile(logicalPath, sourceText, ts.ScriptTarget.ES2022, true, scriptKindForFile(absolutePath));
   const imports = [];
@@ -419,12 +422,13 @@ function workspacePackageIndex(workspaceRoot) {
   return out;
 }
 
-function searchNodeModulesPackage(importerFile, packageName, stopDir) {
+function searchNodeModulesPackage(importerFile, packageName, stopDir, reportOwner) {
   let current = path.dirname(importerFile);
   const stop = path.resolve(stopDir);
   while (true) {
     const candidate = path.join(current, 'node_modules', ...packageName.split('/'), 'package.json');
     if (fs.existsSync(candidate)) return candidate;
+    missingManifest(reportOwner, candidate, packageName);
     if (current === stop || current === path.dirname(current)) break;
     current = path.dirname(current);
   }
@@ -437,27 +441,73 @@ function packageOwner(packageName) {
   return 'third-party';
 }
 
+function discoverResolvedPackageContract(context, manifestPath, packageName) {
+  if (!manifestPath || context.fixedPackageContractCatalog) return;
+  const packageDir = fs.realpathSync(path.dirname(manifestPath));
+  if (context.packageContractDirs.has(packageDir)) return;
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  if (!manifest.pulse?.contract && !manifest.pulsewasm?.manifest && !manifest.pulsewasm?.lowerableManifest) return;
+  if (manifest.name !== packageName) throw new TypeError(`Resolved lowerer package identity must match ${packageName}.`);
+  context.packageContractDirs.add(packageDir);
+  const catalog = discoverPackageContractCatalog({ cwd: context.rootDir, workspaceRoot: context.workspaceRoot,
+    packageDirs: [...context.packageContractDirs] });
+  context.packageContractCatalog = catalog;
+  for (const entry of catalog.contracts) {
+    context.packageContractsBySubpath.set(entry.lowerableSubpath, entry);
+    for (const subpath of entry.compatibilitySubpaths) context.packageContractsBySubpath.set(subpath, entry);
+    context.packageContractsByPackage.set(entry.packageName, catalog.contracts.filter(value => value.packageName === entry.packageName));
+  }
+  for (const entry of catalog.productCatalog.contracts) {
+    context.packageProductContractsByPackage.set(entry.npmPackage, entry);
+    context.packageProductContractsBySpecifier.set(entry.authoring.import, { contract: entry, role: 'authoring' });
+    for (const specifier of entry.ownership.helperImports) context.packageProductContractsBySpecifier.set(specifier, { contract: entry, role: 'helper' });
+    for (const specifier of entry.ownership.reExportImports) context.packageProductContractsBySpecifier.set(specifier, { contract: entry, role: 're-export' });
+  }
+}
+
 function packageModuleForSpecifier(context, importer, classification) {
   const packageName = classification.packageName;
   const specifier = classification.specifier;
+  // Resolve the installed copy at this import before granting compiler authority.
+  const resolvedManifest = searchNodeModulesPackage(importer.absolutePath, packageName, context.workspaceRoot)
+    || context.workspacePackages.get(packageName);
+  discoverResolvedPackageContract(context, resolvedManifest, packageName);
   const contract = context.packageContractsBySubpath.get(specifier) || null;
+  const declaredOwners = context.packageContractsByPackage.get(packageName) || [];
+  if (resolvedManifest && declaredOwners.some(entry => entry.packageDir && fs.realpathSync(entry.packageDir) !== fs.realpathSync(path.dirname(resolvedManifest)))) {
+    throw new TypeError(`Resolved package ${packageName} does not match its selected lowerer owner.`);
+  }
   const productBinding = context.packageProductContractsBySpecifier.get(specifier) || null;
   const productContract = productBinding && productBinding.contract || context.packageProductContractsByPackage.get(packageName) || null;
   const productRole = productBinding && productBinding.role || null;
-  let manifestPath = context.workspacePackages.get(packageName);
-  if (!manifestPath) manifestPath = searchNodeModulesPackage(importer.absolutePath, packageName, context.workspaceRoot);
+  const trusted = CORE_AUTHORING_PACKAGES.has(packageName) || productContract || context.packageContractsByPackage.has(packageName);
+  let manifestPath = (trusted || !context.nativePackageSources) && resolvedManifest;
+  if (!manifestPath && importer.packageSource && importer.packageSource.packageName === packageName) manifestPath = path.join(importer.packageSource.root, 'package.json');
+  if (!manifestPath) manifestPath = searchNodeModulesPackage(importer.absolutePath, packageName, context.workspaceRoot, context.nativePackageSources && !trusted ? context : undefined);
   let manifest;
   let manifestHash;
   if (manifestPath) {
-    const source = fs.readFileSync(manifestPath, 'utf8');
-    manifest = JSON.parse(source);
-    manifestHash = sha256(source);
+    try {
+      const source = context.nativePackageSources && !trusted
+        ? readSourceInput(context, manifestPath, 'manifest', packageName) : fs.readFileSync(manifestPath, 'utf8');
+      manifest = JSON.parse(source);
+      if (!isPlainObject(manifest)) throw new TypeError('Expected a package manifest object.');
+      manifestHash = sha256(source);
+    } catch (_) {
+      throw new ReachableProjectGraphError(`Invalid package manifest for ${packageName}.`, [diagnostic(context.rootDir, importer.sourceFile, null,
+        'PULSE_NATIVE_IMPORT_UNSUPPORTED', `Cannot read a valid package manifest for ${packageName}.`, { packageName })]);
+    }
   } else {
     manifest = { name: packageName, version: 'unresolved' };
     manifestHash = sha256(JSON.stringify(manifest));
   }
   const packageSubpath = classification.packageSubpath || '.';
   const key = `package:${packageName}:${packageSubpath}:${manifestHash}`;
+  const existing = context.packageModules.get(key);
+  if (context.nativePackageSources && existing && existing.sourceCandidate && existing.manifestPath && manifestPath && existing.manifestPath !== fs.realpathSync(manifestPath)) {
+    throw new ReachableProjectGraphError(`Ambiguous installed copies of ${packageName}@${manifest.version}.`, [diagnostic(context.rootDir, importer.sourceFile, null,
+      'PULSE_NATIVE_IMPORT_UNSUPPORTED', 'Distinct installed package roots share one package identity; deduplicate the dependency.', { packageName, packageSubpath })]);
+  }
   if (!context.packageModules.has(key)) {
     context.packageModules.set(key, {
       key,
@@ -478,6 +528,9 @@ function packageModuleForSpecifier(context, importer, classification) {
       source: null,
       specifier,
       classification,
+      manifestPath: manifestPath && fs.realpathSync(manifestPath),
+      manifest,
+      sourceCandidate: !trusted && Boolean(manifestPath),
       contract,
       productContract,
       productRole,
@@ -487,6 +540,35 @@ function packageModuleForSpecifier(context, importer, classification) {
   return context.packageModules.get(key);
 }
 
+function loadPackageSource(context, packageModule, importer, relation) {
+  if (packageModule.sourceModule) return packageModule.sourceModule;
+  let owner;
+  try {
+    owner = npmSource.packageSource(packageModule.manifestPath, packageModule.manifest, packageModule.packageName,
+      packageModule.packageSubpath, packageModule.packageManifestHash, context);
+    const identity = `${owner.packageName}:${owner.packageManifestHash}`;
+    const priorRoot = context.packageSourceRoots.get(identity);
+    if (priorRoot && priorRoot !== owner.root) throw new Error('Distinct installed roots share this package identity; deduplicate the dependency.');
+    context.packageSourceRoots.set(identity, owner.root);
+  } catch (error) {
+    context.diagnostics.push(diagnostic(context.rootDir, importer.sourceFile, relation.statement, 'PULSE_NATIVE_IMPORT_UNSUPPORTED',
+      `Cannot resolve static source export ${relation.specifier}: ${error.message}`, { packageName: packageModule.packageName,
+        packageVersion: packageModule.packageVersion, packageSubpath: packageModule.packageSubpath, automaticFallback: false }));
+    return undefined;
+  }
+  const sourcePath = `${owner.prefix}/${portableFilePath(owner.root, owner.absolute)}`;
+  // Register before following imports so cycles are reported by the graph, not recursion.
+  packageModule.sourceModule = sourcePath;
+  packageModule.source = { file: sourcePath, line: 1, column: 1 };
+  const module = loadProjectModule(context, owner.absolute, sourcePath, owner);
+  packageModule.contentHash = sha256(`${packageModule.contentHash}:${module.contentHash}`);
+  packageModule.exports = exportedNamesForModule(module);
+  context.edges.push({ kind: 're-export', from: packageModule.key, to: sourcePath,
+    specifier: `./${portableFilePath(owner.root, owner.absolute)}`, resolutionKind: 'project-relative', runtime: true,
+    importedNames: [], exportedNames: packageModule.exports, packageContract: null, source: packageModule.source });
+  return sourcePath;
+}
+
 function generatedConfigModule(context) {
   if (!context.configFile) return undefined;
   const key = 'generated:pulse-project-config';
@@ -562,9 +644,19 @@ function scanUnsupportedBoundaries(context, module) {
 function resolveModuleEdges(context, module) {
   const relations = [...module.imports, ...module.reExports];
   for (const relation of relations) {
-    const classification = graph.classifyModuleSpecifier(relation.specifier, context.resolver);
+    const classification = graph.classifyModuleSpecifier(relation.specifier, module.packageSource ? graph.normalizeModuleResolverInput({ baseUrl: '.' }) : context.resolver);
     if (classification.kind === 'project-relative' || classification.kind === 'tsconfig-path') {
-      const resolved = resolveProjectSpecifier(context, module, relation.specifier);
+      let resolved;
+      if (module.packageSource) {
+        try {
+          const absolute = npmSource.relativeSource(module.packageSource, module.absolutePath, relation.specifier, relation.kind === 'type-import' || relation.typeOnly === true);
+          resolved = { status: 'resolved', absolute, portable: `${module.packageSource.prefix}/${portableFilePath(module.packageSource.root, absolute)}` };
+        } catch (error) {
+          context.diagnostics.push(diagnostic(context.rootDir, module.sourceFile, relation.statement, 'PULSE_NATIVE_IMPORT_UNSUPPORTED',
+            `Cannot resolve package source ${relation.specifier}: ${error.message}`, { automaticFallback: false }));
+          continue;
+        }
+      } else resolved = resolveProjectSpecifier(context, module, relation.specifier);
       if (resolved.status === 'missing') {
         context.diagnostics.push(diagnostic(context.rootDir, module.sourceFile, relation.statement, 'PULSE_PROJECT_MODULE_NOT_FOUND', `Unable to resolve project module ${JSON.stringify(relation.specifier)} from ${module.path}.`, { specifier: relation.specifier, candidates: resolved.candidates }));
         continue;
@@ -590,7 +682,7 @@ function resolveModuleEdges(context, module) {
         });
         continue;
       }
-      const target = loadProjectModule(context, resolved.absolute, resolved.portable);
+      const target = loadProjectModule(context, resolved.absolute, resolved.portable, module.packageSource);
       module.resolutions.push(Object.freeze({ relation, classification, targetKey: target.path }));
       context.edges.push({
         kind: relation.kind,
@@ -638,7 +730,9 @@ function resolveModuleEdges(context, module) {
     }
 
     const packageModule = packageModuleForSpecifier(context, module, classification);
-    module.resolutions.push(Object.freeze({ relation, classification, targetKey: packageModule.key }));
+    const sourceKey = context.nativePackageSources && relation.kind !== 'type-import' && relation.typeOnly !== true && packageModule.sourceCandidate
+      ? loadPackageSource(context, packageModule, module, relation) : undefined;
+    module.resolutions.push(Object.freeze({ relation, classification, targetKey: sourceKey || packageModule.key, packageKey: packageModule.key }));
     const packageContractEdge = relation.kind !== 'type-import' && packageModule.packageContract != null;
     context.edges.push({
       kind: packageContractEdge ? 'package-contract' : relation.kind,
@@ -655,13 +749,17 @@ function resolveModuleEdges(context, module) {
   }
 }
 
-function loadProjectModule(context, absolutePath, logicalPath) {
-  const contained = realContainedPath(context.rootDir, absolutePath);
+function loadProjectModule(context, absolutePath, logicalPath, packageSource) {
+  const contained = realContainedPath(packageSource ? packageSource.root : context.rootDir, absolutePath);
   if (!contained) throw new ReachableProjectGraphError(`Project module ${absolutePath} is outside the workspace or missing.`, [], { rootDir: context.rootDir, file: absolutePath });
   const key = logicalPath
     ? graph.normalizePortablePath(logicalPath, 'project module path')
     : portablePath(context.rootDir, path.resolve(absolutePath));
-  if (context.projectModules.has(key)) return context.projectModules.get(key);
+  if (context.projectModules.has(key)) {
+    const existing = context.projectModules.get(key);
+    if (existing.absolutePath !== contained) throw new ReachableProjectGraphError(`Source identity collision at ${key}.`);
+    return existing;
+  }
   const folded = key.toLocaleLowerCase('en-US');
   const collision = [...context.projectModules.keys()].find((existing) => existing.toLocaleLowerCase('en-US') === folded && existing !== key);
   if (collision) {
@@ -675,9 +773,16 @@ function loadProjectModule(context, absolutePath, logicalPath) {
       detail: Object.freeze({ existing: collision, candidate: key })
     })], { rootDir: context.rootDir, existing: collision, candidate: key });
   }
-  const module = parseModule(context.rootDir, contained, key);
+  const module = parseModule(context.rootDir, contained, key, packageSource ? context : undefined);
+  module.packageSource = packageSource;
   context.projectModules.set(key, module);
   context.diagnostics.push(...module.parseDiagnostics);
+  if (packageSource) {
+    const unsupported = npmSource.unsupportedStatement(module.sourceFile);
+    if (unsupported) context.diagnostics.push(diagnostic(context.rootDir, module.sourceFile, unsupported, 'PULSE_NATIVE_IMPORT_UNSUPPORTED',
+      'Package source permits static imports/re-exports, types and function declarations only; module initialization and captured values are unsupported.',
+      { packageName: packageSource.packageName, packageVersion: packageSource.packageVersion, automaticFallback: false }));
+  }
   scanUnsupportedBoundaries(context, module);
   resolveModuleEdges(context, module);
   return module;
@@ -721,7 +826,9 @@ function moduleInputs(context) {
     modules.push({
       key: module.path,
       kind: 'project',
-      owner: 'application',
+      owner: module.packageSource ? packageOwner(module.packageSource.packageName) : 'application',
+      ...(module.packageSource ? { packageName: module.packageSource.packageName, packageVersion: module.packageSource.packageVersion,
+        packageManifestHash: module.packageSource.packageManifestHash, packageSubpath: `./${portableFilePath(module.packageSource.root, module.absolutePath)}` } : {}),
       format: module.format,
       runtime: module.runtime === true,
       path: module.path,
@@ -764,7 +871,7 @@ function createContext(entryFile, options = {}) {
   const packageContractCatalog = options.packageContractCatalog || discoverPackageContractCatalog({
     cwd: rootDir,
     workspaceRoot,
-    scanNodeModules: true
+    packageDirs: []
   });
   const packageContractsBySubpath = new Map();
   for (const entry of packageContractCatalog.contracts) {
@@ -797,14 +904,18 @@ function createContext(entryFile, options = {}) {
       ? Object.freeze({ ...options.projectFragments })
       : Object.freeze({}),
     resolver: resolverInputFromProject(rootDir, options),
+    nativePackageSources: options.target !== 'javascript',
     workspacePackages: workspacePackageIndex(workspaceRoot),
     packageContractCatalog,
+    fixedPackageContractCatalog: Boolean(options.packageContractCatalog),
+    packageContractDirs: new Set(),
     packageContractsBySubpath,
     packageContractsByPackage,
     packageProductContractsByPackage,
     packageProductContractsBySpecifier,
     projectModules: new Map(),
     packageModules: new Map(),
+    packageSourceRoots: new Map(),
     generatedModules: new Map(),
     externalModules: new Map(),
     edges: [],
@@ -915,6 +1026,7 @@ function buildReachableProjectGraph(entryFile, options = {}) {
     entryKey: entry.path,
     graph: preliminary,
     projectFiles: Object.freeze([...context.projectModules.values()].map((module) => module.absolutePath).sort()),
+    packageSourceManifests: Object.freeze([...context.packageModules.values()].filter(module => module.sourceModule).map(module => module.manifestPath).sort()),
     runtimeProjectFiles: Object.freeze([...context.projectModules.values()].filter((module) => module.runtime).map((module) => module.absolutePath).sort()),
     projectModulePaths: Object.freeze([...context.projectModules.values()].map((module) => module.path).sort()),
     runtimeProjectModulePaths: Object.freeze([...context.projectModules.values()].filter((module) => module.runtime).map((module) => module.path).sort()),