@scriptc/compiler 0.1.6 → 0.2.0

package/dist/frontend/program.js

@@ -46,15 +46,17 @@ import { isNodeModulesPath, nearestInvalidPackageJsonPath, nearestPackageType, n
 import { probeNodeImportRefusal, probeNodeRequireRefusal } from "./npm.js";
 import { isNpmStaticPackage, npmStaticActive, npmStaticFsShadow, npmStaticPackageOfPath, reportNpmStaticOffender, setNpmStaticDeclarationOverloads, setNpmStaticPackages } from "./npm-static.js";
 import { isPrunedNpmReexport, planNpmStaticReexports } from "./npm-static-prune.js";
-import { npmStaticDeclarationReexports, npmStaticRuntimeClassTargets, parseNpmStaticDeclarationOverloads, parseNpmStaticDeclarationProperties } from "./npm-static-declarations.js";
+import { isNpmStaticSubclassArgument } from "./npm-static-subtyping.js";
+import { npmStaticDeclarationReexports, npmStaticRuntimeClassTargets, parseNpmStaticDeclarationOverloads, parseNpmStaticDeclarationProperties } from "./npm-static-declaration-syntax.js";
 import { provenanceEntryFor, provenancePaths } from "./provenance-registry.js";
-import { cjsLexerVisibleNames } from "./cjs-lexer.js";
+import { cjsLexedExportsOfFile, cjsVisibleNames } from "./cjs-syntax.js";
 import { ambientDtsPath, fallbackDtsPath, isNodeTypesPath, overridesDtsPath, tsgoPath, } from "./dts-paths.js";
 import { builtinDefaultImportModule, canonicalBuiltinModule, SUPPORTED_NODE_MODULES, unsupportedModuleFeatureOf, } from "./builtin-modules.js";
 import { clearWorkspacePackages, isRelativeSpecifier, isWorkspacePackageName, npmPackageNameOf, registerWorkspacePackage, workspacePackageOfPath, } from "./workspace-registry.js";
 import { ADOPTED_OPTIONS, isJsSourceFileName, JS_ANY_OPERATOR_CODES, JS_RELAXED_TSC_CODES, } from "./tsc-codes.js";
 import { trackedFileExists, trackedReadFile, trackedRealpath } from "./input-tracker.js";
 import { forkTargetPaths } from "./fork-target.js";
+import { inferredJsDiagnosticSuppressed } from "./inferred-js-diagnostics.js";
 const BASE_OPTIONS = {
     strict: true,
 };
@@ -127,6 +129,25 @@ function jsoncSyntaxError(text) {
         return e instanceof Error ? e.message : String(e);
     }
 }
+/** Preserve TypeScript 5.9's computed synthetic-default permission from the
+ * project's own module settings. Preflight later forces ESNext/Bundler for
+ * scriptc's checker, so those forced options must not decide which source
+ * import forms were legal in the original project. */
+function projectAllowsSyntheticDefaultImports(options) {
+    const explicitSyntheticDefaultImports = options["allowSyntheticDefaultImports"];
+    if (explicitSyntheticDefaultImports !== undefined)
+        return explicitSyntheticDefaultImports === true;
+    const moduleKind = options["module"];
+    const explicitEsModuleInterop = options["esModuleInterop"];
+    const esModuleInterop = explicitEsModuleInterop !== undefined
+        ? explicitEsModuleInterop === true
+        : moduleKind === ts.ModuleKind.Node16 ||
+            moduleKind === ts.ModuleKind.Node18 ||
+            moduleKind === ts.ModuleKind.Node20 ||
+            moduleKind === ts.ModuleKind.NodeNext ||
+            moduleKind === ts.ModuleKind.Preserve;
+    return esModuleInterop || moduleKind === ts.ModuleKind.System || options["moduleResolution"] === ts.ModuleResolutionKind.Bundler;
+}
 /** The project's tsconfig adoption in the 7 world: tsgo's own config parser
  * (extends chains resolved server-side), the ADOPTED_OPTIONS subset taken,
  * the rest forced, the strictNullChecks floor enforced. */
@@ -148,6 +169,9 @@ function adoptProjectConfig7(host, entryPath) {
         if (value !== undefined)
             adopted[key] = value;
     }
+    if (projectAllowsSyntheticDefaultImports(parsed.options)) {
+        adopted["allowSyntheticDefaultImports"] = true;
+    }
     // TS 7 accepts `paths`, but no longer accepts `baseUrl` as a compiler
     // option. Translate the established baseUrl+paths spelling into absolute
     // targets: the synthesized config lives beside the entry rather than the
@@ -220,7 +244,7 @@ function runtimeReexportTarget(fromFile, specifier) {
 /** Visits an opted package's own declaration entry and relative barrel
  * closure. This is intentionally narrower than TypeScript module
  * resolution: bare edges name other packages and never inherit trust. */
-function visitNpmStaticDeclarationClosure(entryPath, onSource) {
+function visitNpmStaticDeclarationClosure(services, entryPath, onSource) {
     const seen = new Set();
     const packageJson = nearestPkgJsonPath(entryPath);
     const packageRoot = (packageJson === null ? dirname(entryPath) : dirname(packageJson)).split("\\").join("/");
@@ -236,7 +260,7 @@ function visitNpmStaticDeclarationClosure(entryPath, onSource) {
         if (source === null)
             return;
         onSource(path, source);
-        for (const specifier of npmStaticDeclarationReexports(path, source)) {
+        for (const specifier of npmStaticDeclarationReexports(services.parse(path, source, "ts"))) {
             const target = declarationReexportTarget(path, specifier);
             if (target !== null)
                 visit(target);
@@ -244,10 +268,10 @@ function visitNpmStaticDeclarationClosure(entryPath, onSource) {
     };
     visit(entryPath);
 }
-function npmStaticDeclarationOverloadsOf(entryPath) {
+function npmStaticDeclarationOverloadsOf(services, entryPath) {
     const classes = new Map();
-    visitNpmStaticDeclarationClosure(entryPath, (path, source) => {
-        for (const [className, methods] of parseNpmStaticDeclarationOverloads(path, source)) {
+    visitNpmStaticDeclarationClosure(services, entryPath, (path, source) => {
+        for (const [className, methods] of parseNpmStaticDeclarationOverloads(services.parse(path, source, "ts"))) {
             const target = classes.get(className) ?? new Map();
             classes.set(className, target);
             for (const [methodName, signatures] of methods) {
@@ -258,10 +282,10 @@ function npmStaticDeclarationOverloadsOf(entryPath) {
     });
     return classes;
 }
-function npmStaticDeclarationPropertiesOf(entryPath) {
+function npmStaticDeclarationPropertiesOf(services, entryPath) {
     const classes = new Map();
-    visitNpmStaticDeclarationClosure(entryPath, (path, source) => {
-        for (const [className, properties] of parseNpmStaticDeclarationProperties(path, source)) {
+    visitNpmStaticDeclarationClosure(services, entryPath, (path, source) => {
+        for (const [className, properties] of parseNpmStaticDeclarationProperties(services.parse(path, source, "ts"))) {
             const target = classes.get(className) ?? new Map();
             classes.set(className, target);
             for (const [propertyName, type] of properties) {
@@ -369,12 +393,15 @@ function createRequireProgramRoots7(program) {
                 return "skip";
             let target = resolveProjectModule(sf.fileName, spec);
             if (target === null && !spec.startsWith("#")) {
-                const npm = resolveNpmImport7(sf.fileName, spec);
+                const npm = resolveNpmImport7(sf.fileName, spec, "require");
                 if (npm !== null && isNpmStaticPackage(npm.packageName) && isJsSourceFileName(npm.typesFile)) {
                     target = npm.typesFile;
                 }
             }
-            if (target === null || target.endsWith(".json"))
+            // A directory's package.json may point at a native addon. Keep it
+            // out of TypeScript's source roots so the require call can report
+            // the native-addon boundary instead of an unsupported-file error.
+            if (target === null || target.endsWith(".json") || target.endsWith(".node"))
                 return "skip";
             const normalized = tsgoPath(resolve(target));
             if (!known.has(normalized))
@@ -384,6 +411,41 @@ function createRequireProgramRoots7(program) {
     }
     return [...roots].sort();
 }
+/** Classify the explicitly selected installed package's own sources. */
+export function entryPackageFilePredicate(entryPath) {
+    const entryFile = tsgoPath(entryPath);
+    const installedAt = entryFile.lastIndexOf("/node_modules/");
+    const prefix = installedAt < 0
+        ? null
+        : entryFile.slice(0, installedAt) + "/node_modules/" + npmPackageNameOf(entryFile) + "/";
+    return (file) => {
+        const normalized = tsgoPath(file);
+        return normalized === entryFile || (prefix !== null && normalized.startsWith(prefix) &&
+            !normalized.slice(prefix.length).split("/").includes("node_modules"));
+    };
+}
+/** maxNodeModuleJsDepth omits even relative JS imports within an installed
+ * entry's own package. Add those sources as roots to the existing discovery
+ * fixpoint without raising the checker depth for other packages. */
+function entryPackageProgramRoots7(program, entryPath) {
+    if (!isNodeModulesPath(entryPath))
+        return [];
+    const belongsToEntry = entryPackageFilePredicate(entryPath);
+    const roots = new Set();
+    for (const sf of program.getSourceFiles()) {
+        if (sf.isDeclarationFile || !belongsToEntry(sf.fileName))
+            continue;
+        for (const specifier of sf.imports) {
+            if (!ts.isStringLiteralLike(specifier))
+                continue;
+            const target = resolveProjectModule(sf.fileName, specifier.text);
+            if (target !== null && belongsToEntry(target) && isJsSourceFileName(target) &&
+                program.getSourceFile(target) === undefined)
+                roots.add(target);
+        }
+    }
+    return [...roots].sort();
+}
 function loadProgram7(host, entryPath, externalTypes = new Map()) {
     const config = adoptProjectConfig7(host, entryPath);
     const configuredPaths = config.options["paths"];
@@ -422,51 +484,54 @@ function loadProgram7(host, entryPath, externalTypes = new Map()) {
     }
     const coreRoots = [entryPath, ambientDtsPath(), nodeTypes ?? fallbackDtsPath()];
     const programRoots = [...coreRoots];
-    let program = ts.createProgram([...programRoots, overridesDtsPath()], options, host);
-    for (let pass = 0; pass < 32; pass++) {
-        const candidates = [
-            ...createRequireProgramRoots7(program),
-            ...forkTargetPaths(program, program.getSourceFiles()),
-        ];
-        const extraRoots = candidates.filter((root, index) => !programRoots.includes(root) && candidates.indexOf(root) === index);
-        if (extraRoots.length === 0)
-            break;
-        program.dispose();
-        programRoots.push(...extraRoots);
-        program = ts.createProgram([...programRoots, overridesDtsPath()], options, host);
-        if (pass === 31)
-            throw new Error("static program-root discovery did not converge");
-    }
-    const entry = program.getSourceFile(entryPath);
-    if (!entry)
-        throw new Error(`could not load ${entryPath}`);
-    const externalTypeSpecifiersByFile = externalTypeFileClosure7(program, externalTypes);
-    let projectWorld = null;
-    return {
-        program,
-        entry,
-        moduleOrder: [],
-        configDiags: config.diags,
-        externalTypes,
-        externalTypeSpecifiersByFile,
-        projectWorld: () => (projectWorld ??= ts.createProgram(programRoots, options, host)),
-        disposeAll: () => {
-            projectWorld?.dispose();
+    let program = host.createProgram([...programRoots, overridesDtsPath()], options);
+    try {
+        for (let pass = 0; pass < 32; pass++) {
+            const candidates = [
+                ...entryPackageProgramRoots7(program, entryPath),
+                ...createRequireProgramRoots7(program),
+                ...forkTargetPaths(program, program.getSourceFiles()),
+            ];
+            const extraRoots = candidates.filter((root, index) => !programRoots.includes(root) && candidates.indexOf(root) === index);
+            if (extraRoots.length === 0)
+                break;
             program.dispose();
-        },
-    };
+            programRoots.push(...extraRoots);
+            program = host.createProgram([...programRoots, overridesDtsPath()], options);
+            if (pass === 31)
+                throw new Error("static program-root discovery did not converge");
+        }
+        const entry = program.getSourceFile(entryPath);
+        if (!entry)
+            throw new Error(`could not load ${entryPath}`);
+        const externalTypeSpecifiersByFile = externalTypeFileClosure7(program, externalTypes);
+        let projectWorld = null;
+        return {
+            program,
+            entry,
+            moduleOrder: [],
+            configDiags: config.diags,
+            externalTypes,
+            externalTypeSpecifiersByFile,
+            projectWorld: () => (projectWorld ??= host.createProgram(programRoots, options)),
+            disposeAll: () => {
+                try {
+                    projectWorld?.dispose();
+                }
+                finally {
+                    program.dispose();
+                }
+            },
+        };
+    }
+    catch (error) {
+        program.dispose();
+        throw error;
+    }
 }
-/** The pipeline surface: ONE tsgo program serves preflight AND the
- * lowering. The caller runs checkPreflight, hands program/entry/
- * moduleOrder straight to lowerToIr, and MUST dispose() when done — the
- * spawned tsgo server must not outlive the compile. */
-export function loadProgram(entryPath, opts) {
-    // Absolute from the start: tsgo's world is absolute-path-keyed (the CLI
-    // resolves before calling; this covers direct API callers too).
+export function loadProgram(entryPath, services, opts) {
     entryPath = resolve(entryPath);
-    const externalTypeEntries = opts?.externalTypes instanceof Map
-        ? [...opts.externalTypes]
-        : Object.entries(opts?.externalTypes ?? {});
+    const externalTypeEntries = opts?.externalTypes ?? [];
     const externalTypes = new Map();
     for (const [specifier, file] of externalTypeEntries) {
         if (!isExactExternalTypeSpecifier(specifier)) {
@@ -488,6 +553,7 @@ export function loadProgram(entryPath, opts) {
     // or executable module edges.
     const declarationOverloads = new Map();
     const declarationProperties = new Map();
+    const projectionOwners = new Map();
     for (const pkg of npmStaticPackages) {
         const resolved = resolveBareModule(entryPath, pkg, "types-only");
         if (resolved === null ||
@@ -495,8 +561,8 @@ export function loadProgram(entryPath, opts) {
             !/\.d\.(?:ts|mts|cts)$/.test(resolved.typesFile)) {
             continue;
         }
-        const overloads = npmStaticDeclarationOverloadsOf(resolved.typesFile);
-        const properties = npmStaticDeclarationPropertiesOf(resolved.typesFile);
+        const overloads = npmStaticDeclarationOverloadsOf(services, resolved.typesFile);
+        const properties = npmStaticDeclarationPropertiesOf(services, resolved.typesFile);
         const classNames = new Set([...overloads.keys(), ...properties.keys()]);
         if (classNames.size === 0)
             continue;
@@ -506,8 +572,8 @@ export function loadProgram(entryPath, opts) {
         const runtimeSource = trackedReadFile(runtime.typesFile);
         if (runtimeSource === null)
             continue;
-        const targets = npmStaticRuntimeClassTargets(runtime.typesFile, runtimeSource, classNames);
-        for (const [className, specifier] of targets) {
+        const targets = npmStaticRuntimeClassTargets(services.parse(runtime.typesFile, runtimeSource, "js"), runtimeSource, classNames);
+        for (const [className, { specifier, localName }] of targets) {
             const methods = overloads.get(className);
             const fields = properties.get(className);
             if (methods === undefined && fields === undefined)
@@ -521,14 +587,39 @@ export function loadProgram(entryPath, opts) {
                 targetNorm.startsWith(runtime.workspaceDir.split("\\").join("/") + "/");
             if (targetPackage !== pkg && !insideWorkspace)
                 continue;
+            const projectionKey = JSON.stringify([targetNorm, localName]);
+            const previousOwner = projectionOwners.get(projectionKey);
+            if (previousOwner !== undefined && previousOwner !== className) {
+                // Two public class declarations naming one runtime class are
+                // ambiguous. Keep inference instead of choosing one alias's ABI.
+                projectionOwners.set(projectionKey, null);
+                const priorMethods = new Map(declarationOverloads.get(targetNorm) ?? []);
+                priorMethods.delete(localName);
+                declarationOverloads.set(targetNorm, priorMethods);
+                const priorFields = new Map(declarationProperties.get(targetNorm) ?? []);
+                priorFields.delete(localName);
+                declarationProperties.set(targetNorm, priorFields);
+                continue;
+            }
+            projectionOwners.set(projectionKey, className);
+            // The safe declaration grammar can name only its own class. Bind
+            // that type to the actual runtime class after a named ESM alias.
+            const renameSelf = (type) => type.split(/([\s[\]<>()|,]+)/).map((name) => name === className ? localName : name).join("");
             if (methods !== undefined) {
                 const byClass = new Map(declarationOverloads.get(targetNorm) ?? []);
-                byClass.set(className, methods);
+                byClass.set(localName, new Map([...methods].map(([name, signatures]) => [name, signatures.map((signature) => ({
+                        parameters: signature.parameters.map((parameter) => ({
+                            name: parameter.name,
+                            type: renameSelf(parameter.type),
+                            optional: parameter.optional,
+                        })),
+                        returnType: renameSelf(signature.returnType),
+                    }))])));
                 declarationOverloads.set(targetNorm, byClass);
             }
             if (fields !== undefined) {
                 const byClass = new Map(declarationProperties.get(targetNorm) ?? []);
-                byClass.set(className, fields);
+                byClass.set(localName, new Map([...fields].map(([name, type]) => [name, renameSelf(type)])));
                 declarationProperties.set(targetNorm, byClass);
             }
         }
@@ -558,25 +649,37 @@ export function loadProgram(entryPath, opts) {
     // outside node_modules — the classic typed-JS-library entry — must not exist for
     // the checker, so its resolution lands on the JS Node actually loads;
     // resolve.ts answers the same sibling for scriptc's own edges).
-    const npmShadow = npmStaticFsShadow();
+    const npmShadow = npmStaticFsShadow(services);
     const fsShadow = {
         readFile: (path) => npmShadow?.readFile(path),
         hideFile: (path) => (npmShadow?.hideFile(path) ?? false) || projectDtsRuntimeSibling(path) !== null,
     };
-    const host = new ts.Ts7Host({ cwd: dirname(entryPath), fsShadow });
-    const load = loadProgram7(host, entryPath, externalTypes);
-    return {
-        ...load,
-        dispose: () => {
-            load.disposeAll();
-            host.close();
-        },
-    };
+    const host = services.createProgramHost({ cwd: dirname(entryPath), fsShadow });
+    try {
+        const load = loadProgram7(host, entryPath, externalTypes);
+        return {
+            ...load,
+            services,
+            dispose: () => {
+                try {
+                    load.disposeAll();
+                }
+                finally {
+                    host.close();
+                }
+            },
+        };
+    }
+    catch (error) {
+        host.close();
+        throw error;
+    }
 }
 /** tsc diagnostics (syntax + types), the supported-import fence, and the
  * module evaluation order: fills load.moduleOrder (the SourceFiles
  * themselves — the lowering consumes them directly) and returns the
- * preflight diagnostics. The lowerer runs only on programs that pass. */
+ * preflight diagnostics. Preserve the caller's complete load shape when
+ * mutating it, including its owned services and disposal callback. */
 export function checkPreflight(load) {
     const { diags, moduleOrder, startupCrash } = preflight7(load);
     load.moduleOrder = moduleOrder;
@@ -663,33 +766,141 @@ function requiresOf7(stmt) {
     }
     return out;
 }
+/** The exact `Object.defineProperty(exports|module.exports, "__esModule",
+ * { value: true })` interop stamp (shared by preflight and the no-op lowering). */
+export function isEsModuleStamp(expr) {
+    if (!ts.isCallExpression(expr) || expr.questionDotToken !== undefined)
+        return false;
+    const callee = expr.expression;
+    if (!ts.isPropertyAccessExpression(callee) ||
+        !ts.isIdentifier(callee.expression) ||
+        callee.expression.text !== "Object" ||
+        !ts.isIdentifier(callee.name) ||
+        callee.name.text !== "defineProperty") {
+        return false;
+    }
+    if (expr.arguments.length !== 3)
+        return false;
+    const [recv, nameArg, desc] = expr.arguments;
+    const isExports = (ts.isIdentifier(recv) && recv.text === "exports") ||
+        (ts.isPropertyAccessExpression(recv) &&
+            ts.isIdentifier(recv.expression) &&
+            recv.expression.text === "module" &&
+            ts.isIdentifier(recv.name) &&
+            recv.name.text === "exports");
+    if (!isExports)
+        return false;
+    if (!ts.isStringLiteral(nameArg) || nameArg.text !== "__esModule")
+        return false;
+    if (!ts.isObjectLiteralExpression(desc) || desc.properties.length !== 1)
+        return false;
+    const p = desc.properties[0];
+    return (ts.isPropertyAssignment(p) &&
+        ts.isIdentifier(p.name) &&
+        p.name.text === "value" &&
+        p.initializer.kind === ts.SyntaxKind.TrueKeyword);
+}
+/** Plain CommonJS prologue writes only publish values; in particular,
+ * publishing a hoisted function does not invoke its body. Later runnable
+ * statements may call the export or mutate its receiver, and still need
+ * the conservative TDZ scan over the whole prefix. */
+function pureCjsExport7(program, stmt) {
+    const cjs = cjsExportAssignmentOf(stmt);
+    if (cjs === null)
+        return false;
+    const sf = stmt.getSourceFile();
+    const plainMember = (left) => {
+        if (!ts.isPropertyAccessExpression(left) || left.questionDotToken)
+            return false;
+        // A replacement export can have setters or non-writable function
+        // properties. Only the wrapper's original object gets this exception.
+        if (sf.statements.some((s) => cjsExportAssignmentOf(s)?.kind === "table"))
+            return false;
+        if (left.name.text === "__proto__" || left.name.text === "__esModule")
+            return false;
+        let receiver = left.expression;
+        if (isModuleExportsAccess(receiver)) {
+            receiver = receiver.expression;
+            return ts.isIdentifier(receiver) && !sourceBinding7(program, receiver);
+        }
+        return ts.isIdentifier(receiver) && receiver.text === "exports" && !sourceBinding7(program, receiver);
+    };
+    if (cjs.kind === "member") {
+        if (!plainMember(cjs.expr.left))
+            return false;
+    }
+    else {
+        const receiver = cjs.expr.left.expression;
+        if (sourceBinding7(program, receiver))
+            return false;
+    }
+    let value = cjs.expr.right;
+    // tsc emits chains such as exports.A = exports.B = void 0.
+    while (ts.isBinaryExpression(value) && value.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+        if (!plainMember(value.left))
+            return false;
+        value = value.right;
+    }
+    if (ts.isVoidExpression(value) && ts.isNumericLiteral(value.expression))
+        return true;
+    if (ts.isStringLiteralLike(value) || ts.isNumericLiteral(value) ||
+        value.kind === ts.SyntaxKind.TrueKeyword || value.kind === ts.SyntaxKind.FalseKeyword ||
+        value.kind === ts.SyntaxKind.NullKeyword)
+        return true;
+    if (!ts.isIdentifier(value))
+        return false;
+    if (value.text === "undefined" && !sourceBinding7(program, value))
+        return true;
+    const checker = program.getTypeChecker();
+    const symbol = checker.getSymbolAtLocation(value);
+    return symbol !== undefined && checker.declarationsOf(symbol).some((decl) => ts.isFunctionDeclaration(decl) && decl.parent === stmt.parent);
+}
+function sourceBinding7(program, ident) {
+    const checker = program.getTypeChecker();
+    const symbol = checker.getSymbolAtLocation(ident);
+    return symbol !== undefined && checker.declarationsOf(symbol).some((decl) => !decl.getSourceFile().isDeclarationFile && !ts.isSourceFile(decl));
+}
+function purePrefixDecl7(decl) {
+    const init = decl.initializer;
+    return init === undefined || requireSpecOf7(init) !== null ||
+        ts.isStringLiteralLike(init) || ts.isNumericLiteral(init) ||
+        init.kind === ts.SyntaxKind.TrueKeyword || init.kind === ts.SyntaxKind.FalseKeyword ||
+        init.kind === ts.SyntaxKind.NullKeyword;
+}
 /** True for top-level statements that cannot run user code: directives,
  * empty statements, hoisted declarations, require statements themselves,
- * and literal-initialized variables. A require preceded ONLY by these can
- * never have its bindings observed early — nothing above it executes. */
-function purePrefixStmt7(s) {
+ * literal-initialized variables, and CommonJS function-export prologues.
+ * A require preceded ONLY by these cannot observe its own bindings early;
+ * require cycles are checked separately by the module graph fences. */
+function purePrefixStmt7(program, s) {
     if (ts.isEmptyStatement(s) || ts.isFunctionDeclaration(s))
         return true;
     if (ts.isExpressionStatement(s) && ts.isStringLiteral(s.expression))
         return true; // directive
     if (isRequireStatement7(s))
         return true;
+    if (isCjsJsFile7(s.getSourceFile(), program)) {
+        if (ts.isExpressionStatement(s) && isEsModuleStamp(s.expression)) {
+            const call = s.expression;
+            const object = call.expression.expression;
+            let receiver = call.arguments[0];
+            if (ts.isPropertyAccessExpression(receiver))
+                receiver = receiver.expression;
+            if (!sourceBinding7(program, object) && ts.isIdentifier(receiver) && !sourceBinding7(program, receiver))
+                return true;
+        }
+        if (pureCjsExport7(program, s))
+            return true;
+    }
     if (ts.isVariableStatement(s)) {
-        return s.declarationList.declarations.every((d) => d.initializer === undefined ||
-            requireSpecOf7(d.initializer) !== null ||
-            ts.isStringLiteralLike(d.initializer) ||
-            ts.isNumericLiteral(d.initializer) ||
-            d.initializer.kind === ts.SyntaxKind.TrueKeyword ||
-            d.initializer.kind === ts.SyntaxKind.FalseKeyword ||
-            d.initializer.kind === ts.SyntaxKind.NullKeyword);
+        return s.declarationList.declarations.every(purePrefixDecl7);
     }
     return false;
 }
-/** Can code that runs BEFORE the require statement at index `k` reach one
- * of the require's bindings? Node initializes them AT the require (TDZ —
- * earlier access is a ReferenceError), but the lowering aliases reads
- * through to the exporter's storage with no TDZ state, so a reachable
- * early read would silently diverge. Conservative reachability: earlier
+/** Can code that runs BEFORE the declaration at index `k` reach one of
+ * its bindings? Static require aliases and symbol field keys bypass
+ * storage reads, so an early use could erase a TDZ error or a var's
+ * initial undefined value. Conservative reachability: earlier
  * statements' whole subtrees (arrows and function expressions included)
  * read the binding directly, or reference a hoisted function/class whose
  * body (transitively through other hoisted declarations) reads it — a
@@ -700,7 +911,7 @@ function purePrefixStmt7(s) {
  * (The CheckerFacade memoizes symbol queries, and 7's client dedupes
  * symbol identity by server handle, so the Map-keyed-by-Symbol discipline
  * carries over from the 5.9.3 original unchanged.) */
-function requireTdzRisk7(program, sf, k, decl) {
+export function bindingEarlyUse7(program, sf, k, decl, precedingDecls) {
     const checker = program.getTypeChecker();
     const bound = [];
     if (ts.isIdentifier(decl.name))
@@ -736,7 +947,9 @@ function requireTdzRisk7(program, sf, k, decl) {
         // this scan must survive it so the nesting fence can answer later.
         ts.walkPreorder(root, (n) => {
             if (ts.isIdentifier(n)) {
-                const sym = checker.getSymbolAtLocation(n);
+                const sym = ts.isShorthandPropertyAssignment(n.parent)
+                    ? checker.getShorthandAssignmentValueSymbol(n.parent)
+                    : checker.getSymbolAtLocation(n);
                 if (sym) {
                     const name = bindings.get(sym);
                     if (name !== undefined) {
@@ -756,12 +969,15 @@ function requireTdzRisk7(program, sf, k, decl) {
     // These are the exact roots the TDZ analysis scans eagerly. Their files
     // are phase-managed already, so warm their deferred identifiers as one
     // symbol-only batch instead of paying one IPC query per occurrence.
-    checker.prefetchSymbolRoots(stmts.slice(0, k).filter((stmt) => !ts.isFunctionDeclaration(stmt)));
-    for (let i = 0; i < k && hit === null; i++) {
-        const s = stmts[i];
-        if (ts.isFunctionDeclaration(s))
-            continue;
-        scan(s);
+    const roots = [
+        ...stmts.slice(0, k).filter((stmt) => !ts.isFunctionDeclaration(stmt)),
+        ...precedingDecls,
+    ];
+    checker.prefetchSymbolRoots(roots);
+    for (const root of roots) {
+        if (hit !== null)
+            break;
+        scan(root);
     }
     while (hit === null && work.length > 0) {
         // A scanned reference can make a hoisted declaration's body reachable
@@ -809,7 +1025,7 @@ function isCreateRequireImport7(program, ident) {
     const decl = symbol ? checker.declarationsOf(symbol)[0] : undefined;
     if (decl === undefined || !ts.isImportSpecifier(decl))
         return false;
-    const importDecl = decl.parent.parent.parent;
+    const importDecl = decl.parent?.parent?.parent;
     if (ts.isImportDeclaration(importDecl) && ts.isStringLiteral(importDecl.moduleSpecifier)) {
         const module = canonicalBuiltinModule(importDecl.moduleSpecifier.text);
         const member = decl.propertyName?.text ?? decl.name.text;
@@ -829,11 +1045,10 @@ function isCreateRequireImport7(program, ident) {
     }
     return false;
 }
-/** True only for the createRequire binding shape the lowering recognizes:
- * a const initialized from node:module's createRequire with a base naming
- * the current file. Arbitrary source declarations named `require` must not
- * ride the module-edge lowering, which would erase their calls. */
-function isCreateRequireBinding7(program, callee) {
+/** True only for createRequire bindings the lowering can erase. Mutable
+ * declaration syntax needs a whole-file proof: no writes or escapes, and
+ * no code before initialization can reach the binding. */
+export function isCreateRequireBinding7(program, callee) {
     const checker = program.getTypeChecker();
     const symbol = checker.getSymbolAtLocation(callee);
     const decl = symbol
@@ -841,11 +1056,70 @@ function isCreateRequireBinding7(program, callee) {
         : undefined;
     if (decl === undefined ||
         decl.initializer === undefined ||
-        !ts.isVariableDeclarationList(decl.parent) ||
-        (decl.parent.flags & ts.NodeFlags.Const) === 0) {
+        !ts.isVariableDeclarationList(decl.parent)) {
         return false;
     }
-    const init = stripRequireCasts7(decl.initializer);
+    return isCreateRequireBaseCall7(program, decl.initializer) && ((decl.parent.flags & ts.NodeFlags.Const) !== 0 ||
+        stableCreateRequireBindingReason7(program, decl) === null);
+}
+/** Only literal calls and literal resolution queries can erase the loader
+ * value. In particular, assignments, exported aliases, shorthand properties,
+ * optional calls, and passing the loader to user code cannot pass this test. */
+function staticCreateRequireUse7(expr) {
+    let use = expr;
+    while (ts.isParenthesizedExpression(use.parent))
+        use = use.parent;
+    if (ts.isPropertyAccessExpression(use.parent) && use.parent.expression === use && use.parent.name.text === "resolve" && !use.parent.questionDotToken) {
+        use = use.parent;
+        if (ts.isPropertyAccessExpression(use.parent) && use.parent.expression === use && use.parent.name.text === "paths" && !use.parent.questionDotToken)
+            use = use.parent;
+    }
+    const call = use.parent;
+    return ts.isCallExpression(call) && call.expression === use && !call.questionDotToken &&
+        call.arguments.length === 1 && ts.isStringLiteralLike(call.arguments[0]);
+}
+function stableCreateRequireBindingReason7(program, decl) {
+    const cache = program.analysis.createRequireReasons;
+    if (cache.has(decl))
+        return cache.get(decl);
+    const check = () => {
+        const stmt = decl.parent?.parent;
+        if (!ts.isIdentifier(decl.name) || !ts.isVariableStatement(stmt) || !ts.isSourceFile(stmt.parent)) {
+            return "its mutable createRequire binding is outside the module's top level";
+        }
+        const checker = program.getTypeChecker();
+        const symbol = checker.getSymbolAtLocation(decl.name);
+        if (!symbol || checker.declarationsOf(symbol).length !== 1)
+            return "its createRequire binding is redeclared";
+        if ((ts.getCombinedModifierFlags(decl) & ts.ModifierFlags.Export) !== 0)
+            return "its createRequire result escapes through an exported binding";
+        const sf = decl.getSourceFile();
+        const refs = identifierOccurrences7(sf, decl.name.text);
+        checker.prefetchSymbolNodesExact(refs);
+        for (const ref of refs) {
+            if (ref === decl.name || inTypePosition7(ref))
+                continue;
+            let target = ts.isShorthandPropertyAssignment(ref.parent)
+                ? checker.getShorthandAssignmentValueSymbol(ref.parent)
+                : checker.getSymbolAtLocation(ref);
+            if (target && (target.flags & ts.SymbolFlags.Alias) !== 0)
+                target = checker.getAliasedSymbol(target);
+            if (target === symbol && !staticCreateRequireUse7(ref)) {
+                return "its createRequire binding is reassigned, escapes, or uses a computed specifier";
+            }
+        }
+        const preceding = stmt.declarationList.declarations.slice(0, stmt.declarationList.declarations.indexOf(decl));
+        if (bindingEarlyUse7(program, sf, sf.statements.indexOf(stmt), decl, preceding) !== null) {
+            return "its createRequire binding can be used before initialization";
+        }
+        return null;
+    };
+    const reason = check();
+    cache.set(decl, reason);
+    return reason;
+}
+function isCreateRequireBaseCall7(program, expr) {
+    const init = stripRequireCasts7(expr);
     if (!ts.isCallExpression(init) ||
         init.questionDotToken !== undefined ||
         !ts.isIdentifier(init.expression) ||
@@ -855,13 +1129,77 @@ function isCreateRequireBinding7(program, callee) {
     }
     const base = stripRequireCasts7(init.arguments[0]);
     if (ts.isIdentifier(base) && base.text === "__filename")
-        return true;
+        return !sourceBinding7(program, base);
     return (ts.isPropertyAccessExpression(base) &&
         base.questionDotToken === undefined &&
         ts.isMetaProperty(base.expression) &&
         base.expression.keywordToken === ts.SyntaxKind.ImportKeyword &&
         (base.name.text === "url" || base.name.text === "filename"));
 }
+/** A node:module import alone does not require an engine. Retain npm
+ * fallback for require indirection the lowering cannot erase, while
+ * admitting literal calls through the same stable/inline shapes as program
+ * code. Inspect symbols, not names: nested shadows are unrelated bindings. */
+function npmStaticModuleImportReason7(program, stmt) {
+    const clause = stmt.importClause;
+    if (!clause)
+        return null;
+    const bindings = clause.namedBindings;
+    if (clause.name || (bindings && !ts.isNamedImports(bindings))) {
+        return "its node:module namespace or default import has no static createRequire usage proof";
+    }
+    if (!bindings || !ts.isNamedImports(bindings))
+        return null;
+    const checker = program.getTypeChecker();
+    const sf = stmt.getSourceFile();
+    for (const specifier of bindings.elements) {
+        if ((specifier.propertyName?.text ?? specifier.name.text) !== "createRequire")
+            continue;
+        const imported = checker.getSymbolAtLocation(specifier.name);
+        if (!imported)
+            return "its createRequire import could not be resolved";
+        checker.prefetchSymbolNodesExact(identifierOccurrences7(sf, specifier.name.text));
+        let reason = null;
+        const checkUse = (expr) => {
+            if (!staticCreateRequireUse7(expr)) {
+                reason = "its createRequire result escapes or is used with a computed specifier (static requires need literal specifiers)";
+            }
+        };
+        ts.walkPreorder(sf, (node) => {
+            if (reason || !ts.isIdentifier(node) || node.text !== specifier.name.text || node === specifier.name || checker.getSymbolAtLocation(node) !== imported)
+                return;
+            const call = node.parent;
+            if (!ts.isCallExpression(call) || call.expression !== node || !isCreateRequireBaseCall7(program, call)) {
+                reason = "its createRequire import is used outside a supported call based on the current file";
+                return;
+            }
+            const decl = call.parent;
+            if (ts.isVariableDeclaration(decl) && decl.initializer === call && ts.isIdentifier(decl.name)) {
+                if ((ts.getCombinedModifierFlags(decl) & ts.ModifierFlags.Export) !== 0) {
+                    reason = "its createRequire result escapes through an exported binding";
+                    return;
+                }
+                if (!isCreateRequireBinding7(program, decl.name)) {
+                    reason = stableCreateRequireBindingReason7(program, decl);
+                    return;
+                }
+                const sym = checker.getSymbolAtLocation(decl.name);
+                const name = decl.name.text;
+                checker.prefetchSymbolNodesExact(identifierOccurrences7(sf, name));
+                ts.walkPreorder(sf, (ref) => {
+                    if (ts.isIdentifier(ref) && ref.text === name && ref !== decl.name && checker.getSymbolAtLocation(ref) === sym)
+                        checkUse(ref);
+                });
+            }
+            else {
+                checkUse(call);
+            }
+        });
+        if (reason)
+            return reason;
+    }
+    return null;
+}
 /** Classifies a require-shaped call as Node's ambient CommonJS global, the
  * one supported createRequire source binding, or another source binding.
  * The scanners still collect createRequire calls because they carry static
@@ -946,9 +1284,11 @@ function nodeEsmSyntaxMarker7(sf) {
             found = node;
             return "stop";
         }
-        if (!insideFunctionLike7(node) &&
-            (ts.isAwaitExpression(node) ||
-                (ts.isForOfStatement(node) && node.awaitModifier !== undefined))) {
+        // Only await syntax needs an ancestor walk. Doing this for every node
+        // makes a deeply nested expression take quadratic time to classify.
+        if ((ts.isAwaitExpression(node) ||
+            (ts.isForOfStatement(node) && node.awaitModifier !== undefined)) &&
+            !insideFunctionLike7(node)) {
             found = node;
             return "stop";
         }
@@ -956,14 +1296,13 @@ function nodeEsmSyntaxMarker7(sf) {
     });
     return found;
 }
-const nodeEsmFileCache7 = new WeakMap();
 /** True when Node would treat this file as an ES MODULE (never defining
  * require/__dirname there): fixed extensions first, then an explicit
  * nearest-package type, then Node's syntax markers for ambiguous .js/.ts
  * files. TypeScript's external-module bit is forced for checker scoping and
  * therefore intentionally plays no part in this runtime decision. */
-function isNodeEsmFile7(sf) {
-    const cached = nodeEsmFileCache7.get(sf);
+function isNodeEsmFile7(sf, program) {
+    const cached = program?.analysis.nodeEsmFiles.get(sf);
     if (cached !== undefined)
         return cached;
     let result;
@@ -981,21 +1320,21 @@ function isNodeEsmFile7(sf) {
                 ? false
                 : nodeEsmSyntaxMarker7(sf) !== null;
     }
-    nodeEsmFileCache7.set(sf, result);
+    program?.analysis.nodeEsmFiles.set(sf, result);
     return result;
 }
 /** A JavaScript source file Node treats as CommonJS (not an ES module):
  * ESM namespace/default machinery must not claim it — its export surface
  * is module.exports, read through the CJS interop paths and their own
  * fences. */
-function isCjsJsFile7(sf) {
-    return isJsSourceFileName(sf.fileName) && !isNodeEsmFile7(sf);
+function isCjsJsFile7(sf, program) {
+    return isJsSourceFileName(sf.fileName) && !isNodeEsmFile7(sf, program);
 }
 /** The exported spelling of isCjsJsFile7 (the lowering's gate for
  * module.exports surfaces — `ts.isExternalModule` is NOT the CJS test:
  * tsgo marks CJS files with export assignments as external modules). */
-export function isCjsJsFile(sf) {
-    return isCjsJsFile7(sf);
+export function isCjsJsFile(sf, program) {
+    return isCjsJsFile7(sf, program);
 }
 /** The self-import TDZ fences: for `import { x } from "<self>"` (default
  * and namespace forms included), any TOP-LEVEL reference lexically above
@@ -1405,7 +1744,7 @@ function identifierOccurrences7(root, text) {
  * Re-export statements bind nothing locally — always null: the alias is
  * link-time plumbing, never an evaluation-time read. Export specifiers
  * of an imported binding are the same alias story, not reads. */
-function backEdgeUseOffence7(program, sf, stmt) {
+function backEdgeUseOffence7(program, stmt, occurrences) {
     if (!ts.isImportDeclaration(stmt) || stmt.importClause === undefined)
         return null;
     const checker = program.getTypeChecker();
@@ -1425,25 +1764,16 @@ function backEdgeUseOffence7(program, sf, stmt) {
         const sym = checker.getSymbolAtLocation(bindingName);
         if (sym === undefined)
             continue;
-        checker.prefetchSymbolNodesExact(identifierOccurrences7(sf, bindingName.text));
-        let offence = null;
-        const visit = (node) => {
-            if (offence !== null || ts.isImportDeclaration(node))
-                return;
-            if (ts.isIdentifier(node) &&
-                node.text === bindingName.text &&
-                !(node.parent !== undefined && ts.isExportSpecifier(node.parent)) &&
+        const references = occurrences.get(bindingName.text) ?? [];
+        checker.prefetchSymbolNodesExact(references);
+        for (const node of references) {
+            if (!(node.parent !== undefined && ts.isExportSpecifier(node.parent)) &&
                 checker.getSymbolAtLocation(node) === sym &&
                 !inTypePosition7(node) &&
                 !inDeferredPosition7(node)) {
-                offence = { name: bindingName.text, node };
-                return;
+                return { name: bindingName.text, node };
             }
-            ts.forEachChild(node, visit);
-        };
-        visit(sf);
-        if (offence !== null)
-            return offence;
+        }
     }
     return null;
 }
@@ -1514,6 +1844,30 @@ export function makeCycleAdmission(program, edgesOf) {
     // reason the cluster's cycles stay fenced, or null when its every
     // member passes the inert-top-level bar.
     const sccVerdict = new Map();
+    // A module can close many cycle edges, each importing many bindings.
+    // Index its identifiers once for this admission pass. ASTs are immutable;
+    // the pass owns the index so it cannot retain a disposed program.
+    const bindingUses = new Map();
+    const usesOf = (sf) => {
+        const cached = bindingUses.get(sf);
+        if (cached !== undefined)
+            return cached;
+        const uses = new Map();
+        ts.walkPreorder(sf, (node) => {
+            if (ts.isImportDeclaration(node))
+                return "skip";
+            if (ts.isIdentifier(node)) {
+                const references = uses.get(node.text);
+                if (references !== undefined)
+                    references.push(node);
+                else
+                    uses.set(node.text, [node]);
+            }
+            return undefined;
+        });
+        bindingUses.set(sf, uses);
+        return uses;
+    };
     return (importer, e) => {
         if (e.stmt === undefined)
             return "the cycle closes through a require() edge";
@@ -1537,7 +1891,7 @@ export function makeCycleAdmission(program, edgesOf) {
         if (!sccVerdict.has(comp)) {
             let reason = null;
             for (const m of comp) {
-                if (isCjsJsFile7(m)) {
+                if (isCjsJsFile7(m, program)) {
                     reason = `${m.fileName} is a CommonJS module — admission covers ES-module cycles only`;
                     break;
                 }
@@ -1550,9 +1904,11 @@ export function makeCycleAdmission(program, edgesOf) {
             sccVerdict.set(comp, reason);
         }
         const clusterReason = sccVerdict.get(comp);
+        if (clusterReason === undefined)
+            throw new Error("missing module-cycle verdict");
         if (clusterReason !== null)
             return clusterReason;
-        const use = backEdgeUseOffence7(program, importer, e.stmt);
+        const use = backEdgeUseOffence7(program, e.stmt, usesOf(importer));
         if (use !== null) {
             return `the cycle-crossing binding '${use.name}' is read at ${lineOf(use.node)}, outside any function body — a read during the init window observes the partially-initialized module (Node's TDZ ReferenceError / stale var), which is not modeled`;
         }
@@ -1574,7 +1930,7 @@ function resolveImport7(program, from, specifier) {
  * island under --dynamic. Resolution rides the own resolver (resolve.ts).
  * Null for relative and node: specifiers, and for anything that doesn't
  * resolve into node_modules. */
-function resolveNpmImport7(fromFileName, specifier) {
+function resolveNpmImport7(fromFileName, specifier, resolutionKind = "import") {
     if (isRelativeSpecifier(specifier) || specifier.startsWith("node:")) {
         return null;
     }
@@ -1583,7 +1939,7 @@ function resolveNpmImport7(fromFileName, specifier) {
     // answers the entry), so no island embed and no .d.ts type surface.
     if (provenanceEntryFor(specifier) !== null)
         return null;
-    const resolved = resolveBareModule(fromFileName, specifier);
+    const resolved = resolveBareModule(fromFileName, specifier, undefined, resolutionKind);
     if (!resolved)
         return null;
     if (!isNodeModulesPath(resolved.typesFile)) {
@@ -1658,29 +2014,27 @@ function processModuleAliasImport7(spec, stmt) {
     return clause !== undefined && clause.name !== undefined && clause.namedBindings === undefined;
 }
 /** The whole TS7-lane lifecycle for one entry: spawn (or share) a tsgo
- * host, build the lowering-world program, run the ported preflight, and
- * dispose EVERYTHING before returning — the CLI process must exit promptly,
- * so no snapshot or tsgo child outlives the call. */
-export function checkPreflightTs7(entryPath, sharedHost) {
-    const host = sharedHost ?? new ts.Ts7Host({ cwd: dirname(entryPath) });
+ * host, build the lowering-world program, run preflight, and release its
+ * snapshot. The caller owns the supplied host and can reuse or close it. */
+export function checkPreflightTs7(entryPath, host) {
+    const load = loadProgram7(host, resolve(entryPath));
     try {
-        const load = loadProgram7(host, entryPath);
-        try {
-            const { diags, moduleOrder } = preflight7(load);
-            return { diags, moduleOrder: moduleOrder.map((sf) => sf.fileName) };
-        }
-        finally {
-            load.disposeAll();
-        }
+        const { diags, moduleOrder } = preflight7(load);
+        return { diags, moduleOrder: moduleOrder.map((sf) => sf.fileName) };
     }
     finally {
-        if (!sharedHost)
-            host.close();
+        load.disposeAll();
     }
 }
 function preflight7(load) {
     const { program, entry } = load;
     const diags = [...load.configDiags];
+    // An explicit entry can itself live in an installed package. Its own
+    // source files are program code, including relative barrels and sibling
+    // modules; their location must not silently erase the module graph.
+    // Match the full installed directory, not just the package name, and
+    // exclude nested installations so dependencies keep their npm policy.
+    const entryPackageFile = entryPackageFilePredicate(entry.fileName);
     // Workspace-linked packages register BEFORE the tsc gate. Their files
     // live at realpaths OUTSIDE node_modules (the monorepo-tool symlink
     // shape), so nothing path-shaped marks them as npm surface — yet their
@@ -1808,6 +2162,7 @@ function preflight7(load) {
      * pass above), suppressed here unless --npm-static opted them into being
      * program modules. */
     const islandJsFile = (file) => isJsSourceFileName(file) &&
+        !entryPackageFile(file) &&
         npmStaticPackageOfPath(file) === null &&
         (isNodeModulesPath(file) || workspacePackageOfPath(file) !== null);
     const nodeModulesJsSuppressed = (d) => d.fileName !== undefined && islandJsFile(d.fileName);
@@ -1882,6 +2237,8 @@ function preflight7(load) {
             !npmStaticFileSuppressed(d) &&
             !nodeModulesJsSuppressed(d) &&
             !namespaceCalleeSuppressed(p, d) &&
+            !inferredJsDiagnosticSuppressed(p, d) &&
+            !isNpmStaticSubclassArgument(p, d) &&
             !workspaceImplicitAnySuppressed(p, d) &&
             !jsdocTypeSuppressed(p, d, commentDup));
     };
@@ -1914,10 +2271,10 @@ function preflight7(load) {
         .filter((sf) => sf.fileName !== ambient &&
         !sf.isDeclarationFile &&
         !sf.fileName.endsWith(".json") &&
-        (!isNodeModulesPath(sf.fileName) || npmStaticPackageOfPath(sf.fileName) !== null) &&
+        (!isNodeModulesPath(sf.fileName) || entryPackageFile(sf.fileName) || npmStaticPackageOfPath(sf.fileName) !== null) &&
         !islandJsFile(sf.fileName));
     const userFiles = npmStaticActive()
-        ? planNpmStaticReexports(program, entry, programFiles, [...createRequireProgramRoots7(program), ...forkTargetPaths(program, program.getSourceFiles())], (sf, spec) => resolveImport7(program, sf, spec) ?? npmStaticDepSf7(program, sf, spec))
+        ? planNpmStaticReexports(program, entry, programFiles, [...createRequireProgramRoots7(program), ...forkTargetPaths(program, program.getSourceFiles())], (sf, spec, resolutionKind) => resolveImport7(program, sf, spec) ?? npmStaticDepSf7(program, sf, spec, resolutionKind))
         : programFiles;
     program.getTypeChecker().prefetchSourceFileStructures(userFiles);
     // node_modules JS that no --npm-static opt-in claims is NOT program
@@ -1941,7 +2298,7 @@ function preflight7(load) {
             }
             continue;
         }
-        if (!isNodeEsmFile7(sf)) {
+        if (!isNodeEsmFile7(sf, program)) {
             const marker = nodeEsmSyntaxMarker7(sf);
             if (marker !== null)
                 diags.push(commonJsModuleSyntaxDiag(locOf7(marker)));
@@ -2079,7 +2436,7 @@ function preflight7(load) {
                 // RESOLVED user module lowers; everything else keeps the fence —
                 // there is no namespace object to materialize.
                 if (stmt.exportClause && ts.isNamespaceExport(stmt.exportClause)) {
-                    if (reDep === null || reDep.fileName.endsWith(".json") || isCjsJsFile7(reDep)) {
+                    if (reDep === null || reDep.fileName.endsWith(".json") || isCjsJsFile7(reDep, program)) {
                         diags.push(unsupportedDiag("SC1013", locOf7(stmt), "namespace re-exports (export * as ns) of this module form"));
                         continue;
                     }
@@ -2110,17 +2467,15 @@ function preflight7(load) {
             }
             const isRelative = isRelativeSpecifier(spec);
             const isBare = !isRelative && !ambientModules.has(spec);
-            // --npm-static: an opted-in package importing node:module admits
-            // for PROGRAM code (per-member fences, divergence 370) but marks
-            // the PACKAGE an offender — createRequire's static story covers
-            // only literal-specifier requires, and bundler banners (esbuild's
-            // __createRequire(import.meta.url) prologue) feed the returned
-            // require COMPUTED specifiers at module INIT, so a static compile
-            // would fence at load where the island runs the package as shipped.
+            // Npm packages can use the same static createRequire forms as program
+            // code. Preserve fallback for bundler banners that pass the require
+            // value around or feed it computed specifiers during initialization.
             if (canonicalBuiltinModule(spec) === "module") {
                 const pkg = npmStaticPackageOfPath(sf.fileName);
                 if (pkg !== null) {
-                    reportNpmStaticOffender(pkg, "it imports node:module (bundler banners drive createRequire's require with computed specifiers; the island serves the package)");
+                    const reason = npmStaticModuleImportReason7(program, stmt);
+                    if (reason !== null)
+                        reportNpmStaticOffender(pkg, reason);
                 }
             }
             // An import edge Node's own resolution refuses BEFORE any module
@@ -2245,17 +2600,13 @@ function preflight7(load) {
                 // surface and the lowering keys the same tables
                 // (builtinNamespaceModuleOf's default-import twin). JS sources
                 // always (Node never asks for interop flags); TS sources when the
-                // adopted interop knobs made the checker accept the spelling
-                // (the `import os from 'os'` spelling under esModuleInterop — the
-                // program TYPECHECKED, so the form is the project's own legal
-                // dialect). A TS project without interop flags keeps the fence:
-                // the SC1012 wording beats the raw TS1259 at the same site. The
-                // callable module objects (assert, events, test) stay allowed
-                // everywhere.
-                const opts = program.getCompilerOptions();
-                const interopOn = opts.esModuleInterop === true || opts.allowSyntheticDefaultImports === true;
+                // project's explicit or implied synthetic-default permission accepts
+                // the spelling. A TS project without that permission keeps the
+                // SC1012 fence. The callable module objects (assert, events, test)
+                // stay allowed everywhere.
+                const syntheticDefaultsOn = program.getCompilerOptions().allowSyntheticDefaultImports === true;
                 const defaultOk = builtinDefaultImportModule(spec) !== null ||
-                    ((isJsSourceFileName(sf.fileName) || interopOn) && canonicalBuiltinModule(spec) !== null);
+                    ((isJsSourceFileName(sf.fileName) || syntheticDefaultsOn) && canonicalBuiltinModule(spec) !== null);
                 if (clause.name && !isJson && dep === null && !defaultOk) {
                     diags.push(unsupportedDiag("SC1012", locOf7(clause.name)));
                 }
@@ -2276,7 +2627,7 @@ function preflight7(load) {
                     if (isJson) {
                         diags.push(unsupportedDiag("SC1013", locOf7(clause.namedBindings), "namespace imports of JSON modules"));
                     }
-                    else if (dep !== null && isCjsJsFile7(dep)) {
+                    else if (dep !== null && isCjsJsFile7(dep, program)) {
                         // A CJS namespace binding whose every use is a bare expression
                         // statement (`cjs;` — the corpus's "the import linked"
                         // assertion) carries no surface question: the statement lowers
@@ -2304,7 +2655,7 @@ function preflight7(load) {
             const stmts = sf.statements;
             let firstRunnable = -1;
             stmts.forEach((s, i) => {
-                if (firstRunnable < 0 && !purePrefixStmt7(s))
+                if (firstRunnable < 0 && !purePrefixStmt7(program, s))
                     firstRunnable = i;
             });
             for (let k = 0; k < stmts.length; k++) {
@@ -2318,7 +2669,7 @@ function preflight7(load) {
                     // files keep the full CommonJS scan.
                     if (!jsRequireFile && bindingKind !== "createRequire")
                         continue;
-                    if (isNodeEsmFile7(sf)) {
+                    if (isNodeEsmFile7(sf, program)) {
                         if (bindingKind !== "createRequire") {
                             diags.push(unsupportedDiag("SC1013", loc, esmRequireFeature7(bindingKind)));
                             continue;
@@ -2346,7 +2697,7 @@ function preflight7(load) {
                         // form above (bundle dists require their workspace siblings —
                         // the same resolution, the same offender discipline on a
                         // miss).
-                        const npmReq = !req.spec.startsWith("#") ? resolveNpmImport7(sf.fileName, req.spec) : null;
+                        const npmReq = !req.spec.startsWith("#") ? resolveNpmImport7(sf.fileName, req.spec, "require") : null;
                         if (npmReq !== null && isNpmStaticPackage(npmReq.packageName)) {
                             dep = npmStaticProgramDep(program, npmReq.packageName, npmReq.typesFile);
                             if (dep === null)
@@ -2381,8 +2732,16 @@ function preflight7(load) {
                         diags.push(unsupportedDiag("SC1012", loc, "require() of JSON modules"));
                         continue;
                     }
-                    const tdzName = firstRunnable >= 0 && firstRunnable < k && req.decl
-                        ? requireTdzRisk7(program, sf, k, req.decl)
+                    // Earlier declarators run too: `const x = read(), dep =
+                    // require('./dep')` must not lose the guard merely because both
+                    // initializers share one VariableStatement.
+                    const precedingDecls = req.decl && ts.isVariableStatement(stmt)
+                        ? stmt.declarationList.declarations.slice(0, stmt.declarationList.declarations.indexOf(req.decl))
+                        : [];
+                    const prefixCanRun = (firstRunnable >= 0 && firstRunnable < k) ||
+                        precedingDecls.some((decl) => !purePrefixDecl7(decl));
+                    const tdzName = prefixCanRun && req.decl
+                        ? bindingEarlyUse7(program, sf, k, req.decl, precedingDecls)
                         : null;
                     if (tdzName !== null) {
                         diags.push(unsupportedDiag("SC1013", loc, `require() below code that can reach its binding '${tdzName}' (Node initializes the binding AT the require and throws ReferenceError on any earlier access, which is not modeled — move the require above the code that can run first)`));
@@ -2400,7 +2759,7 @@ function preflight7(load) {
                 const bindingKind = requireCallBindingKind7(program, call);
                 if (!jsRequireFile && bindingKind !== "createRequire")
                     continue;
-                if (isNodeEsmFile7(sf)) {
+                if (isNodeEsmFile7(sf, program)) {
                     if (bindingKind !== "createRequire") {
                         diags.push(unsupportedDiag("SC1013", loc, esmRequireFeature7(bindingKind)));
                         continue;
@@ -2423,7 +2782,7 @@ function preflight7(load) {
                 if (!isRelativeSpecifier(spec)) {
                     // --npm-static: opted-in packages ride the program-module edge
                     // (the statement-level require branch above).
-                    const npmReq = !spec.startsWith("#") ? resolveNpmImport7(sf.fileName, spec) : null;
+                    const npmReq = !spec.startsWith("#") ? resolveNpmImport7(sf.fileName, spec, "require") : null;
                     if (npmReq !== null && isNpmStaticPackage(npmReq.packageName)) {
                         const nDep = npmStaticProgramDep(program, npmReq.packageName, npmReq.typesFile);
                         if (nDep !== null)
@@ -2572,19 +2931,19 @@ function cjsNamedImportLinkCheck(program, entry, moduleOrder, diags) {
     // Reexport targets union in only when they resolve to CommonJS program
     // files (Node's cjsPreparseModuleExports rule).
     const resolveCjsDep = (from, spec) => {
-        const dep = resolveEdge(from, spec);
-        return dep !== null && isCjsJsFile7(dep) ? dep : null;
+        const dep = resolveImport7(program, from, spec) ?? npmStaticDepSf7(program, from, spec, "require");
+        return dep !== null && isCjsJsFile7(dep, program) ? dep : null;
     };
     const visible = (dep, name) => 
     // `default` is the module.exports binding itself — always provided.
-    // (cjs-lexer.ts lexes SOURCE TEXT — only strings cross into the
-    // typescript5 island; the SourceFile is just the memo/resolve handle.)
-    name === "default" || cjsLexerVisibleNames(dep, (d) => d.text, resolveCjsDep, lexMemo).has(name);
+    // The program already owns native source ASTs; reuse them without
+    // starting another syntax session or reparsing their source text.
+    name === "default" || cjsVisibleNames(dep, cjsLexedExportsOfFile, resolveCjsDep, lexMemo).has(name);
     /** The statement's resolved LOCAL CommonJS dependency, when it is an
      * import/re-export from one. */
     const cjsDepOf = (sf, spec) => {
         const dep = resolveEdge(sf, spec);
-        return dep !== null && isCjsJsFile7(dep) ? dep : null;
+        return dep !== null && isCjsJsFile7(dep, program) ? dep : null;
     };
     /** The first lexer-invisible CJS name request of ONE module, in V8's
      * check order: all regular named imports sorted by local binding name,
@@ -2657,7 +3016,7 @@ function cjsNamedImportLinkCheck(program, entry, moduleOrder, diags) {
                 continue;
             const spec = specNode.text;
             const dep = resolveEdge(sf, spec);
-            if (dep === null || dep.fileName.endsWith(".json") || !isNodeEsmFile7(dep))
+            if (dep === null || dep.fileName.endsWith(".json") || !isNodeEsmFile7(dep, program))
                 continue;
             const bad = dfs(dep);
             if (bad !== null)
@@ -2665,12 +3024,12 @@ function cjsNamedImportLinkCheck(program, entry, moduleOrder, diags) {
         }
         return firstInvisibleOf(sf);
     };
-    const bad = isNodeEsmFile7(entry) ? dfs(entry) : null;
+    const bad = isNodeEsmFile7(entry, program) ? dfs(entry) : null;
     // ESM modules only require() reaches: same invisibility, but Node's
     // SyntaxError fires mid-evaluation at the require — a pointed fence
     // instead of a mismodeled crash position.
     for (const sf of moduleOrder) {
-        if (!isNodeEsmFile7(sf) || visited.has(sf))
+        if (!isNodeEsmFile7(sf, program) || visited.has(sf))
             continue;
         const b = firstInvisibleOf(sf);
         if (b !== null) {
@@ -2786,7 +3145,7 @@ function analyzeEsmNamedImportLinks(program, entry) {
             if (stmt.moduleSpecifier === undefined || !ts.isStringLiteral(stmt.moduleSpecifier))
                 continue;
             const target = resolveEdge(dep, stmt.moduleSpecifier.text);
-            if (target === null || target.fileName.endsWith(".json") || !isNodeEsmFile7(target))
+            if (target === null || target.fileName.endsWith(".json") || !isNodeEsmFile7(target, program))
                 continue;
             const candidate = runtimeExport(target, name, nextSeen);
             if (candidate === undefined)
@@ -2807,7 +3166,7 @@ function analyzeEsmNamedImportLinks(program, entry) {
                 continue;
             const spec = stmt.moduleSpecifier.text;
             const dep = resolveEdge(sf, spec);
-            if (dep === null || dep.fileName.endsWith(".json") || !isNodeEsmFile7(dep))
+            if (dep === null || dep.fileName.endsWith(".json") || !isNodeEsmFile7(dep, program))
                 continue;
             if (clause.name !== undefined) {
                 imports.push({ local: clause.name.text, exportName: "default", spec, nameNode: clause.name, dep });
@@ -2852,7 +3211,7 @@ function analyzeEsmNamedImportLinks(program, entry) {
                 continue;
             const spec = moduleSpecifier.text;
             const dep = resolveEdge(sf, spec);
-            if (dep === null || dep.fileName.endsWith(".json") || !isNodeEsmFile7(dep))
+            if (dep === null || dep.fileName.endsWith(".json") || !isNodeEsmFile7(dep, program))
                 continue;
             for (const element of exportClause.elements) {
                 if (element.isTypeOnly)
@@ -2884,7 +3243,7 @@ function analyzeEsmNamedImportLinks(program, entry) {
             if (moduleSpecifier === undefined || !ts.isStringLiteral(moduleSpecifier))
                 continue;
             const dep = resolveEdge(sf, moduleSpecifier.text);
-            if (dep === null || dep.fileName.endsWith(".json") || !isNodeEsmFile7(dep))
+            if (dep === null || dep.fileName.endsWith(".json") || !isNodeEsmFile7(dep, program))
                 continue;
             const bad = dfs(dep);
             if (bad !== null)
@@ -2895,7 +3254,7 @@ function analyzeEsmNamedImportLinks(program, entry) {
     // Native ESM linking itself starts only from an ESM entry. The caller
     // supplies dynamic-only roots here too; each such root gets its own
     // promise rejection rather than a startup crash.
-    const bad = isNodeEsmFile7(entry) ? dfs(entry) : null;
+    const bad = isNodeEsmFile7(entry, program) ? dfs(entry) : null;
     if (bad !== null) {
         return {
             crash: {
@@ -2922,7 +3281,7 @@ function esmNamedImportLinkCheck(program, entry, moduleOrder, diags) {
     // before earlier output). Keep the compile-time fence used by the CJS link
     // checker for the analogous mid-evaluation failure instead.
     for (const sf of moduleOrder) {
-        if (!isNodeEsmFile7(sf) || analysis.visited.has(sf))
+        if (!isNodeEsmFile7(sf, program) || analysis.visited.has(sf))
             continue;
         const childFailure = analysis.firstMissingOf(sf);
         if (childFailure !== null) {
@@ -3090,12 +3449,12 @@ export function orderedImportsOf(program, sf) {
  * as a module edge), else null. No offender reporting here — preflight
  * already classified the import; this is the lookup the module-order and
  * lowering paths share. */
-export function npmStaticDepSf7(program, sf, spec) {
+export function npmStaticDepSf7(program, sf, spec, resolutionKind = "import") {
     if (!npmStaticActive() || isRelativeSpecifier(spec))
         return null;
     if (spec.startsWith("node:") || spec.startsWith("#"))
         return null;
-    const npm = resolveNpmImport7(sf.fileName, spec);
+    const npm = resolveNpmImport7(sf.fileName, spec, resolutionKind);
     if (npm === null || !isNpmStaticPackage(npm.packageName))
         return null;
     if (!isJsSourceFileName(npm.typesFile))