@scriptc/compiler 0.4.6 → 0.4.8

package/dist/executable/prepare.js

@@ -1,18 +1,22 @@
+import { readFileSync, realpathSync } from "node:fs";
 import { frontendDisposed } from "../frontend/dispose-hook.js";
-import { checkerPanicDiag, nodeIslandNoteDiag, nodeIslandRetryFailedDiag, npmStaticRefusalDiag, iceDiag, isCheckerPanic, } from "../diagnostics/diagnostic.js";
+import { checkerPanicDiag, nodeIslandEntryPatchDiag, nodeIslandEntryReadDiag, nodeIslandImplicitGlobalReadDiag, nodeIslandModuleNoteDiag, nodeIslandNoteDiag, nodeIslandReaderStripDiag, nodeIslandStripDiag, nodeIslandRetryFailedDiag, npmStaticRefusalDiag, nativePackageDiag, iceDiag, isCheckerPanic, stdioPatchAcrossIslandsDiag, } from "../diagnostics/diagnostic.js";
 import { validateModule } from "../ir/validate.js";
 import { checkContracts } from "../contracts/check.js";
 import { fenceSpeculativeWasiFunctions, moduleWasiUnavailableSurface, targetRefusalDiag, } from "../backend/target-diagnostics.js";
 import { readProjectConfig } from "../project-config.js";
-import { nodeIslandPolicy } from "../node-islands/policy.js";
+import { isMarkedUserModule, nodeIslandPolicy, } from "../node-islands/policy.js";
 import { buildNodeIslandReport } from "../node-islands/report.js";
-import { classifyDiagnostic, isIslandReasonCode } from "../node-islands/classify.js";
+import { classifyDiagnostic, classifyMarker, isIslandReasonCode, } from "../node-islands/classify.js";
 import { packageDirOf, packageVersionOf } from "../node-islands/origin.js";
 import { describe } from "../node-islands/summary.js";
 import { resolveBareModule } from "../frontend/resolve.js";
-import { isEsmFile } from "../frontend/lowering/lower-node-island.js";
-/** Release the parser/checker before native object generation begins. */
-export function prepareExecutableModule(entryPath, opts, ffi, buildPlatform, createFrontend, timing = () => { }, lowerIslands = new Map(), retryFences = true) {
+import { growIslandSet } from "../node-islands/growth.js";
+import { isJsSourceFileName } from "../frontend/tsc-codes.js";
+/** Release the parser/checker before native object generation begins.
+ * `unitStore` keeps the lowered units of this build for the next one
+ * (unit-reuse.ts). */
+export function prepareExecutableModule(entryPath, opts, ffi, buildPlatform, createFrontend, timing = () => { }, lowerIslands = new Map(), retryFences = true, unitStore = null, lowerModules = new Map()) {
     // The island decision reads the detector's scan unless islands are off.
     const islandScan = nodeIslandPolicy(readProjectConfig(entryPath), opts.nodeIslands).mode !== "off";
     let fe = createFrontend(entryPath, opts.npmStatic, undefined, undefined, { islandScan });
@@ -20,20 +24,44 @@ export function prepareExecutableModule(entryPath, opts, ffi, buildPlatform, cre
     // Node islands (scope-B NI-4): packages refused natively run in Node,
     // unless the policy says otherwise. The frontend reloads without them,
     // so their declarations type the program.
-    const islandDecision = decideNodeIslands(entryPath, opts, fe, lowerIslands);
+    const islandDecision = decideNodeIslands(entryPath, opts, fe, lowerIslands, lowerModules);
+    // A patched builtin the native build cannot represent (an entry module
+    // patch, or a native read of a patched member) fails here.
+    if (islandDecision !== null && islandDecision.errors.length > 0) {
+        const diagnostics = islandDecision.errors;
+        const sourceTexts = fe.sourceTexts();
+        fe.dispose();
+        return { ok: false, diagnostics, sourceTexts };
+    }
     if (islandDecision !== null) {
         fe.dispose();
         fe = createFrontend(entryPath, opts.npmStatic, undefined, undefined, {
             islandPackages: new Set(islandDecision.packages.keys()),
+            ...(islandDecision.modules.size > 0
+                ? { islandModules: new Set(islandDecision.modules.keys()) }
+                : {}),
             islandScan,
         });
         timing("frontend-island-reload");
     }
     let lowered;
     let sourceTexts;
+    let contractWarnings = [];
     let disposed = false;
     let fenceGrown = null;
     const fenceSure = new Set();
+    // The growth inputs this build's frontend offers (node-islands/growth.ts).
+    // Built once: the frontend does not change inside a build, and its scan is
+    // a whole-program walk.
+    let growthInputs = null;
+    let growthBuilt = false;
+    const growthOf = () => {
+        if (!growthBuilt) {
+            growthInputs = islandGrowth(entryPath, opts, fe);
+            growthBuilt = true;
+        }
+        return growthInputs;
+    };
     // The frontend (and its tsgo server) is released as soon as lowering
     // ends — clang and the link never hold it open.
     try {
@@ -50,12 +78,13 @@ export function prepareExecutableModule(entryPath, opts, ffi, buildPlatform, cre
             // An import of a natively compiled package that preflight refuses
             // in the importer (a CommonJS namespace import) is that package's
             // refusal: it runs in a Node island instead.
-            const grown = preflightIslands(entryPath, opts, fe, lowerIslands);
+            const growth = growthOf();
+            const grown = growth === null ? null : growIslandSet(growth, lowerIslands, { preflight: fe.preflight });
             if (grown !== null) {
                 fe.dispose();
                 frontendDisposed();
                 disposed = true;
-                return prepareExecutableModule(entryPath, opts, ffi, buildPlatform, createFrontend, timing, grown, retryFences);
+                return prepareExecutableModule(entryPath, opts, ffi, buildPlatform, createFrontend, timing, grown, retryFences, unitStore, lowerModules);
             }
             return fail(fe.preflight);
         }
@@ -65,6 +94,7 @@ export function prepareExecutableModule(entryPath, opts, ffi, buildPlatform, cre
                 targetPlatform: buildPlatform,
                 ...(ffi !== null ? { ffiImports: ffi.functions } : {}),
                 ...(opts.tier !== undefined ? { tierMode: opts.tier } : {}),
+                ...(unitStore !== null ? { unitStore } : {}),
             }, (module) => validateModule(module).length === 0);
             timing("lower");
         }
@@ -82,12 +112,19 @@ export function prepareExecutableModule(entryPath, opts, ffi, buildPlatform, cre
             // Packages whose own modules refused to lower run in Node islands
             // too (the authoritative lowering, DESIGN.md §1.4): build again with
             // them as islands.
-            const grown = loweringIslands(entryPath, opts, fe, lowered.diagnostics, lowerIslands, fe.nodeIslandScan?.({ userJs: false }).edges);
-            if (grown !== null) {
+            const growth = growthOf();
+            const grown = growth === null
+                ? null
+                : growIslandSet(growth, lowerIslands, { diagnostics: lowered.diagnostics });
+            // Sloppy user modules the lowering refused join the same retry
+            // (DESIGN.md note 1 §3.2): one reload with every island at once,
+            // never one round per module.
+            const grownModules = loweringModules(entryPath, opts, lowered.diagnostics, lowerModules);
+            if (grown !== null || grownModules !== null) {
                 fe.dispose();
                 frontendDisposed();
                 disposed = true;
-                return prepareExecutableModule(entryPath, opts, ffi, buildPlatform, createFrontend, timing, grown, retryFences);
+                return prepareExecutableModule(entryPath, opts, ffi, buildPlatform, createFrontend, timing, grown ?? lowerIslands, retryFences, unitStore, grownModules ?? lowerModules);
             }
             // A failed program whose compiled packages need the runtime or a
             // mutable object model (NI-2's report): try them as islands. If that
@@ -96,17 +133,28 @@ export function prepareExecutableModule(entryPath, opts, ffi, buildPlatform, cre
             // declare (interfaces, aliases such as `Static<T>`) are `any`, so its
             // diagnostics describe a program the island build does not compile:
             // there the packages' declarations type the user code.
-            const marked = retryFences
-                ? fenceIslands(entryPath, opts, fe, lowered, lowerIslands, false)
+            const marked = retryFences && growth !== null
+                ? growIslandSet(growth, lowerIslands, {
+                    diagnostics: lowered.diagnostics,
+                    fences: lowered.runtimeFences,
+                    fenceMode: "report",
+                })
                 : null;
             if (marked !== null) {
                 fe.dispose();
                 frontendDisposed();
                 disposed = true;
-                return prepareExecutableModule(entryPath, opts, ffi, buildPlatform, createFrontend, timing, marked, false);
+                return prepareExecutableModule(entryPath, opts, ffi, buildPlatform, createFrontend, timing, marked, false, undefined, lowerModules);
             }
             return fail(lowered.diagnostics);
         }
+        // A program that replaces a process output stream's write method has
+        // nowhere to route an island's writes: the island's process.stdout is
+        // its own object. Until islands share the native stream object (H2),
+        // refuse the combination instead of silently missing the patch.
+        if (islandDecision !== null && lowered.stdioPatches !== undefined) {
+            return fail(lowered.stdioPatches.map((p) => stdioPatchAcrossIslandsDiag(p.stream, p.loc)));
+        }
         const validation = validateModule(lowered.module);
         timing("ir-validate");
         if (validation.length > 0) {
@@ -134,9 +182,20 @@ export function prepareExecutableModule(entryPath, opts, ffi, buildPlatform, cre
                 return fail(checked.diagnostics);
             if (checked.contracts)
                 lowered.module.contracts = checked.contracts;
+            contractWarnings = checked.warnings;
+        }
+        if (retryFences) {
+            const growth = growthOf();
+            fenceGrown =
+                growth === null
+                    ? null
+                    : growIslandSet(growth, lowerIslands, {
+                        diagnostics: lowered.diagnostics,
+                        fences: lowered.runtimeFences,
+                        fenceMode: "sure",
+                        sure: fenceSure,
+                    });
         }
-        if (retryFences)
-            fenceGrown = fenceIslands(entryPath, opts, fe, lowered, lowerIslands, true, fenceSure);
     }
     finally {
         if (!disposed) {
@@ -155,7 +214,16 @@ export function prepareExecutableModule(entryPath, opts, ffi, buildPlatform, cre
             ...(fe.warnings ?? []),
             ...(lowered.divergences ?? []),
             ...(lowered.performance ?? []),
+            ...contractWarnings,
         ],
+        ...(islandDecision === null
+            ? {}
+            : {
+                islands: {
+                    packages: [...islandDecision.packages.keys()].sort(),
+                    modules: [...islandDecision.modules.keys()].sort(),
+                },
+            }),
     };
     // Packages compiled with runtime fences that need the JavaScript
     // runtime or a mutable object model (fenceIslands): build again with
@@ -171,7 +239,7 @@ export function prepareExecutableModule(entryPath, opts, ffi, buildPlatform, cre
             attempts.push(sure);
         let firstError = null;
         for (const islands of attempts) {
-            const islanded = prepareExecutableModule(entryPath, opts, ffi, buildPlatform, createFrontend, timing, islands, false);
+            const islanded = prepareExecutableModule(entryPath, opts, ffi, buildPlatform, createFrontend, timing, islands, false, unitStore, lowerModules);
             if (islanded.ok)
                 return islanded;
             firstError ??= islanded.diagnostics[0] ?? null;
@@ -183,12 +251,84 @@ export function prepareExecutableModule(entryPath, opts, ffi, buildPlatform, cre
     }
     return prepared;
 }
-/** The packages a build runs in Node islands, or null for none: under
- * `--node-islands=auto` (the default) every npm package the native
- * pipeline refused, plus packages marked `node`; under `explicit` only the
+/** Whether two spellings name the same file (the checker resolves through
+ * symlinks; a CLI argument may not). */
+function sameFile(a, b) {
+    if (samePath(a, b))
+        return true;
+    try {
+        const real = realpathSync(a);
+        const other = realpathSync(b);
+        return samePath(real, other);
+    }
+    catch {
+        return false;
+    }
+}
+function samePath(a, b) {
+    return a.replaceAll("\\", "/") === b.replaceAll("\\", "/");
+}
+/** The pre-scan reasons that make a user module a sloppy-semantics island
+ * by themselves (DESIGN.md note 1 §3.1): the constructs whose behavior
+ * needs the JavaScript engine and that a syntax scan decides exactly, plus
+ * the conservative `this` marker (decision S2). */
+const SLOPPY_REASONS = new Set([
+    "with",
+    "direct-eval",
+    "annexb-block-function",
+    "sloppy-this",
+]);
+/** A module that patches a builtin module's CommonJS object (the user's
+ * decision, 2026-10-29): its patch is meant for code that shares Node's
+ * builtin, so it runs in Node, where an island consumer sees it. */
+const PATCH_REASONS = new Set(["builtin-patch"]);
+function moduleIslands(entryPath, policy, scan) {
+    const modules = new Map();
+    let entryPatch = null;
+    const stripProblems = [];
+    for (const m of scan.modules) {
+        if (m.origin !== "user")
+            continue;
+        const patches = m.markers.filter((marker) => PATCH_REASONS.has(marker.reason));
+        // A TypeScript module islands only for a builtin patch (H3.2).
+        if (!isJsSourceFileName(m.file) && patches.length === 0)
+            continue;
+        if (sameFile(m.file, entryPath)) {
+            if (patches.length > 0 && entryPatch === null)
+                entryPatch = { file: m.file, marker: patches[0] };
+            continue;
+        }
+        if (m.stripProblem !== null) {
+            stripProblems.push({ file: m.file, ...m.stripProblem });
+            continue;
+        }
+        const marked = isMarkedUserModule(policy, m.file);
+        const sloppy = m.markers.filter((marker) => SLOPPY_REASONS.has(marker.reason));
+        if (marked === null &&
+            (policy.mode !== "auto" || (sloppy.length === 0 && patches.length === 0)))
+            continue;
+        const first = sloppy[0] ?? patches[0];
+        const reason = first === undefined ? null : classifyMarker(first);
+        modules.set(m.file, {
+            file: m.file,
+            class: reason === null ? "marked" : reason.class,
+            reason: reason === null
+                ? marked === "cli"
+                    ? "marked with --node-island"
+                    : 'marked "node" in scriptc.nodeIslands.modules'
+                : describe(reason),
+            decision: marked === null ? "auto" : "marked",
+        });
+    }
+    return { modules, entryPatch, stripProblems };
+}
+/** The packages and modules a build runs in Node islands, or null for none:
+ * under `--node-islands=auto` (the default) every npm package the native
+ * pipeline refused plus the user modules the pre-scan found a sloppy
+ * construct in, and packages marked `node`; under `explicit` only the
  * marked ones; under `off`, none (refusals stay SC2013). Each island is
  * reported once as an SC8001 note. */
-function decideNodeIslands(entryPath, opts, fe, lowerIslands) {
+function decideNodeIslands(entryPath, opts, fe, lowerIslands, lowerModules) {
     const policy = nodeIslandPolicy(readProjectConfig(entryPath), opts.nodeIslands);
     if (policy.mode === "off" || fe.nodeIslandScan === undefined)
         return null;
@@ -201,11 +341,168 @@ function decideNodeIslands(entryPath, opts, fe, lowerIslands) {
         : []);
     for (const name of lowerIslands.keys())
         refused.add(name);
-    if (refused.size === 0 && policy.forcedNode.size === 0)
+    // The pre-scan's user-JavaScript markers exist only where a build may act
+    // on them.
+    const scan = fe.nodeIslandScan({ userJs: policy.mode === "auto" });
+    const moduleDecision = moduleIslands(entryPath, policy, scan);
+    const modules = moduleDecision.modules;
+    // A sloppy write to an undeclared name creates a global — a sloppy-only
+    // semantic the native tier does not implement, so the module runs in
+    // Node (the user's policy, 2026-10-31). The checker decides this one, not
+    // the syntax pre-scan: a write target needs bindings, and its sloppiness
+    // depends on the enclosing function and file strictness. Preflight
+    // reports it as SC1091 carrying the R2.4 reason. The entry stays native
+    // (a whole-file island is a different feature), and a strict-mode write
+    // is an ordinary lowering gap, so neither joins here.
+    if (policy.mode === "auto") {
+        for (const d of fe.preflight) {
+            if (d.code !== "SC1091" || d.reason !== "implicit-global-write")
+                continue;
+            const file = d.loc.file;
+            if (modules.has(file) || sameFile(file, entryPath))
+                continue;
+            if (!isJsSourceFileName(file) || file.includes("/node_modules/"))
+                continue;
+            const reason = classifyDiagnostic(d, "refusal");
+            modules.set(file, {
+                file,
+                class: reason.class,
+                reason: describe(reason),
+                decision: "auto",
+            });
+        }
+    }
+    // Modules the lowering refused keep their first reason (the reload no
+    // longer compiles them).
+    for (const [file, island] of lowerModules)
+        if (!modules.has(file))
+            modules.set(file, island);
+    const errors = [];
+    if (moduleDecision.entryPatch !== null) {
+        const { file, marker } = moduleDecision.entryPatch;
+        errors.push(nodeIslandEntryPatchDiag(file, marker.member ?? marker.construct, builtinModuleOf(marker.member), marker.loc));
+    }
+    for (const problem of moduleDecision.stripProblems)
+        errors.push(nodeIslandStripDiag(problem.file, problem.construct, problem.loc));
+    // Who else must see the patch (H3.4): every module that reads a patched
+    // member through the builtin's CommonJS object joins the island set, npm
+    // package or user module alike — the patch lives in the islands' Node, and
+    // only sharing the builtin shows the read the patch, as in Node. The entry
+    // stays native, and a user TypeScript module Node cannot strip cannot run
+    // in Node at all: both are SC8006.
+    const patchedMembers = new Map();
+    for (const m of scan.modules) {
+        if (!modules.has(m.file))
+            continue;
+        for (const marker of m.markers) {
+            if (!PATCH_REASONS.has(marker.reason) || marker.member === undefined)
+                continue;
+            if (!patchedMembers.has(marker.member))
+                patchedMembers.set(marker.member, m.file);
+        }
+    }
+    const readerPackages = new Map();
+    // A package the build marks native stays native: a read that only an
+    // island could satisfy is SC8003, once per package and construct.
+    const forcedNativeReads = new Set();
+    const readerModules = new Map();
+    if (policy.mode === "auto" && patchedMembers.size > 0) {
+        for (const m of scan.modules) {
+            if (modules.has(m.file))
+                continue;
+            for (const read of m.cjsReads) {
+                const patchFile = patchFileOf(patchedMembers, read.member);
+                if (patchFile === undefined)
+                    continue;
+                if (m.origin === "npm" && m.packageName !== null && m.packageDir !== null) {
+                    if (policy.forcedNative.has(m.packageName)) {
+                        const key = `${m.packageName}:${read.member}`;
+                        if (!forcedNativeReads.has(key)) {
+                            forcedNativeReads.add(key);
+                            errors.push(nativePackageDiag(m.packageName, `it reads '${read.member}' through the CommonJS ${builtinModuleOf(read.member)} object, which island module ${patchFile} patches; a native read cannot see the patch`, fe.npmImportSites.get(m.packageName) ?? read.loc));
+                        }
+                        continue;
+                    }
+                    if (!readerPackages.has(m.packageName) && !refused.has(m.packageName))
+                        readerPackages.set(m.packageName, {
+                            packageDir: m.packageDir,
+                            member: read.member,
+                            patchFile,
+                        });
+                }
+                else if (m.origin === "user") {
+                    if (sameFile(m.file, entryPath)) {
+                        errors.push(nodeIslandEntryReadDiag(m.file, read.member, builtinModuleOf(read.member), patchFile, read.loc));
+                        continue;
+                    }
+                    if (m.stripProblem !== null) {
+                        errors.push(nodeIslandReaderStripDiag(m.file, read.member, patchFile, m.stripProblem.construct, m.stripProblem.loc));
+                        continue;
+                    }
+                    if (!readerModules.has(m.file))
+                        readerModules.set(m.file, { member: read.member, patchFile });
+                }
+            }
+        }
+    }
+    // Who else must see an implicit global (H3.4): a sloppy write creates the
+    // name on Node's global object when its island module runs, and native
+    // code has no global object to read it from. An npm package that reads
+    // the name joins the island set (its Node sees the global); a user module
+    // or the entry is SC8020.
+    const readerGlobals = new Map();
+    const createdGlobals = policy.mode === "auto" ? implicitGlobalWrites(fe, modules) : new Map();
+    if (createdGlobals.size > 0) {
+        for (const m of scan.modules) {
+            if (modules.has(m.file))
+                continue;
+            for (const read of m.globalReads) {
+                const writerFile = createdGlobals.get(read.name);
+                if (writerFile === undefined)
+                    continue;
+                if (m.origin === "npm" && m.packageName !== null && m.packageDir !== null) {
+                    if (policy.forcedNative.has(m.packageName)) {
+                        const key = `${m.packageName}:${read.name}`;
+                        if (!forcedNativeReads.has(key)) {
+                            forcedNativeReads.add(key);
+                            errors.push(nativePackageDiag(m.packageName, `it reads '${read.name}', which island module ${writerFile} creates as an implicit global; the native build has no global object, so the read cannot see it`, fe.npmImportSites.get(m.packageName) ?? read.loc));
+                        }
+                        continue;
+                    }
+                    if (!readerGlobals.has(m.packageName) && !refused.has(m.packageName))
+                        readerGlobals.set(m.packageName, {
+                            packageDir: m.packageDir,
+                            global: read.name,
+                            writerFile,
+                        });
+                }
+                else if (m.origin === "user") {
+                    errors.push(nodeIslandImplicitGlobalReadDiag(read.name, writerFile, read.loc));
+                }
+            }
+        }
+    }
+    if (errors.length > 0)
+        return { packages: new Map(), modules: new Map(), notes: [], errors };
+    // A user module that reads a patched member runs in a Node island, so its
+    // read goes through the patched object exactly as in Node (H3.4).
+    for (const [file, reader] of readerModules) {
+        modules.set(file, {
+            file,
+            class: "object-model",
+            reason: `it reads '${reader.member}' through the CommonJS ${builtinModuleOf(reader.member)} object, which island module ${reader.patchFile} patches`,
+            decision: "auto",
+        });
+    }
+    if (refused.size === 0 &&
+        policy.forcedNode.size === 0 &&
+        modules.size === 0 &&
+        readerPackages.size === 0 &&
+        readerGlobals.size === 0)
         return null;
     const report = buildNodeIslandReport({
         entry: entryPath,
-        scan: fe.nodeIslandScan({ userJs: false }),
+        scan,
         npm: fe.npmStatic,
         diagnostics: [],
         fences: [],
@@ -264,240 +561,147 @@ function decideNodeIslands(entryPath, opts, fe, lowerIslands) {
         packages.set(name, island);
         notes.push(nodeIslandNoteDiag(island.name, island.version, island.class, island.reason, fe.npmImportSites.get(name) ?? { file: entryPath, start: 0, end: 0 }));
     }
-    return packages.size === 0 ? null : { packages, notes };
-}
-/** The island set grown by the npm packages whose own modules refused to
- * lower (`--node-islands=auto` only), or null when there are none. */
-function loweringIslands(entryPath, opts, fe, diagnostics, known, edges) {
-    const policy = nodeIslandPolicy(readProjectConfig(entryPath), opts.nodeIslands);
-    if (policy.mode !== "auto" || known.size > 16)
-        return null;
-    const compiled = new Set(fe.npmStatic.filter((e) => e.status === "static").map((e) => e.package));
-    const grown = new Map(known);
-    for (const d of diagnostics) {
-        // A use of a package outside the compiled module graph (an import()
-        // the frontend did not compile): that package runs in an island.
-        const named = d.code === "SC2013" ? /npm package '([^']+)'/.exec(d.message) : null;
-        if (named !== null) {
-            const name = named[1];
-            if (grown.has(name) || policy.forcedNative.has(name) || policy.unloaded.has(name))
-                continue;
-            const js = resolveBareModule(d.loc.file, name, "js-only") ??
-                resolveBareModule(d.loc.file, name, "js-only", "require");
-            const at = js === null ? null : packageDirOf(js.typesFile);
-            if (at === null || at.name !== name)
-                continue;
-            grown.set(name, {
-                name,
-                version: packageVersionOf(at.dir),
-                dir: at.dir,
-                class: "packaging",
-                reason: `${d.code}: ${d.message}`,
-            });
-            continue;
-        }
-        if (!isIslandReasonCode(d.code))
+    // npm packages that read a patched member join the island set: their
+    // patch lives in the island's Node, and only a shared builtin shows it.
+    for (const [name, reader] of readerPackages) {
+        if (packages.has(name))
             continue;
-        const at = packageDirOf(d.loc.file);
-        if (at === null || !compiled.has(at.name) || grown.has(at.name))
-            continue;
-        if (policy.forcedNative.has(at.name) || policy.unloaded.has(at.name))
-            continue;
-        const reason = classifyDiagnostic(d, "refusal");
-        grown.set(at.name, {
-            name: at.name,
-            version: packageVersionOf(at.dir),
-            dir: at.dir,
-            class: reason.class,
-            reason: describe(reason),
+        const version = packageVersionOf(reader.packageDir);
+        const reason = `it reads '${reader.member}' through the CommonJS ${builtinModuleOf(reader.member)} object, which island module ${reader.patchFile} patches`;
+        packages.set(name, {
+            name,
+            version,
+            dir: reader.packageDir,
+            class: "object-model",
+            reason,
         });
+        notes.push(nodeIslandNoteDiag(name, version, "object-model", reason, fe.npmImportSites.get(name) ?? { file: entryPath, start: 0, end: 0 }));
     }
-    // A native ES module that imports an island CommonJS module would read
-    // its bindings from the module's exports object, where Node gives it the
-    // namespace its CommonJS facade builds (the lexed names, module.exports
-    // as the default): the importing package runs in the island too.
-    for (let added = edges !== undefined; added;) {
-        added = false;
-        for (const edge of edges) {
-            const name = edge.to;
-            if (!grown.has(name) || edge.fromDir === null || edge.shim)
-                continue;
-            const at = packageDirOf(edge.fromFile);
-            if (at === null || grown.has(at.name) || !compiled.has(at.name))
-                continue;
-            if (policy.forcedNative.has(at.name) || policy.unloaded.has(at.name))
-                continue;
-            if (!isEsmFile(edge.fromFile))
-                continue;
-            const target = resolveBareModule(edge.fromFile, name, "js-only") ??
-                resolveBareModule(edge.fromFile, name, "js-only", "require");
-            if (target === null || isEsmFile(target.typesFile))
-                continue;
-            grown.set(at.name, {
-                name: at.name,
-                version: packageVersionOf(at.dir),
-                dir: at.dir,
-                class: "packaging",
-                reason: `an ES module of the package imports the CommonJS island package '${name}'`,
-            });
-            added = true;
-        }
+    // npm packages that read an implicit global an island module creates join
+    // the island set: the global lives on their Node's global object.
+    for (const [name, reader] of readerGlobals) {
+        if (packages.has(name))
+            continue;
+        const version = packageVersionOf(reader.packageDir);
+        const reason = `it reads '${reader.global}', the implicit global island module ${reader.writerFile} creates`;
+        packages.set(name, {
+            name,
+            version,
+            dir: reader.packageDir,
+            class: "object-model",
+            reason,
+        });
+        notes.push(nodeIslandNoteDiag(name, version, "object-model", reason, fe.npmImportSites.get(name) ?? { file: entryPath, start: 0, end: 0 }));
     }
-    return grown.size === known.size ? null : grown;
+    for (const island of [...modules.values()].sort((a, b) => a.file < b.file ? -1 : a.file > b.file ? 1 : 0))
+        notes.push(nodeIslandModuleNoteDiag(island.file, island.class, island.reason, {
+            file: island.file,
+            start: 0,
+            end: 0,
+        }));
+    return packages.size === 0 && modules.size === 0 ? null : { packages, modules, notes, errors };
 }
-/** Preflight refusals at import statements of natively compiled npm
- * packages (`--node-islands=auto` only): those packages become islands. */
-function preflightIslands(entryPath, opts, fe, known) {
-    const policy = nodeIslandPolicy(readProjectConfig(entryPath), opts.nodeIslands);
-    if (policy.mode !== "auto" || known.size > 16)
-        return null;
-    const compiled = new Set(fe.npmStatic.filter((e) => e.status === "static").map((e) => e.package));
-    if (compiled.size === 0)
-        return null;
-    const texts = fe.sourceTexts();
-    const grown = new Map(known);
+/** The names the island modules' sloppy implicit-global writes create, each
+ * with the file that creates it. Preflight reports each write as an SC1091
+ * whose range is the write target. */
+function implicitGlobalWrites(fe, modules) {
+    const globals = new Map();
+    const sources = new Map();
     for (const d of fe.preflight) {
-        if (d.code !== "SC1013")
-            continue;
-        const text = texts.get(d.loc.file);
-        if (text === undefined)
-            continue;
-        // The import statement around the diagnostic: its module specifier.
-        const start = text.lastIndexOf("import", d.loc.start);
-        const end = text.indexOf(";", d.loc.end);
-        const stmt = text.slice(start < 0 ? d.loc.start : start, end < 0 ? text.length : end);
-        const m = /\bfrom\s*["']([^"']+)["']/.exec(stmt);
-        if (m === null)
+        if (d.code !== "SC1091" || d.reason !== "implicit-global-write")
             continue;
-        const spec = m[1];
-        const name = spec.startsWith("@") ? spec.split("/").slice(0, 2).join("/") : spec.split("/")[0];
-        if (!compiled.has(name) || grown.has(name))
+        const file = d.loc.file;
+        if (!modules.has(file))
             continue;
-        if (policy.forcedNative.has(name) || policy.unloaded.has(name))
-            continue;
-        const site = fe.npmImportSites.get(name);
-        const jsEntry = site === undefined ? null : resolveBareModule(site.file, spec, "js-only");
-        const at = jsEntry === null ? null : packageDirOf(jsEntry.typesFile);
-        if (at === null)
-            continue;
-        grown.set(name, {
-            name,
-            version: packageVersionOf(at.dir),
-            dir: at.dir,
-            class: "gap",
-            reason: `${d.code}: ${d.message}`,
-        });
+        let source = sources.get(file);
+        if (source === undefined) {
+            source = readFileSync(file, "utf8");
+            sources.set(file, source);
+        }
+        const name = source.slice(d.loc.start, d.loc.end);
+        if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) && !globals.has(name))
+            globals.set(name, file);
     }
-    return grown.size === known.size ? null : grown;
+    return globals;
 }
-/** Packages compiled natively with runtime fences (refusals deferred to the
- * operation that reaches them) that should run in islands instead: those
- * with a fence that surely fires (one in top-level module code, which runs
- * when the module evaluates) or that itself needs the runtime (R1). Other
- * fences stay deferred refusals until decision 8 (D6) retires them, so
- * typed packages like jose stay native. With `requireFence` false (after a
- * failed build) the package's island class by NI-2's report decides
- * instead: runtime (R1) or object-model (R2). `--node-islands=auto` only;
- * null for none. */
-function fenceIslands(entryPath, opts, fe, lowered, known, requireFence = true, sure) {
-    if (fe.nodeIslandScan === undefined)
-        return null;
-    if (requireFence && lowered.runtimeFences.length === 0)
-        return null;
-    const policy = nodeIslandPolicy(readProjectConfig(entryPath), opts.nodeIslands);
-    if (policy.mode !== "auto" || known.size > 32)
-        return null;
-    // An explicit --npm-static request keeps its package native.
-    const explicit = new Set(Array.isArray(opts.npmStatic) ? opts.npmStatic.map((n) => n.replace(/\.\.\.$/, "")) : []);
-    const compiled = new Set(fe.npmStatic
-        .filter((e) => e.status === "static" && !explicit.has(e.package))
-        .map((e) => e.package));
-    const fenced = new Map();
-    for (const d of lowered.runtimeFences) {
-        const at = packageDirOf(d.loc.file);
-        if (at === null || !compiled.has(at.name) || known.has(at.name))
-            continue;
-        if (policy.forcedNative.has(at.name) || policy.unloaded.has(at.name))
+/** The builtin module a patched member belongs to ("fs" of
+ * "fs.readFileSync"). */
+function builtinModuleOf(member) {
+    if (member === undefined)
+        return "";
+    const end = /[.[]/.exec(member);
+    return end === null ? member : member.slice(0, end.index);
+}
+/** The island module that patches `member`, matching an exact member or a
+ * whole-module patch ("fs.*"). A read the scan cannot name ("fs.*", a
+ * computed key or a rest element) matches every patch of its module, and so
+ * does a patch through a computed key ("fs[…]"). */
+function patchFileOf(patched, member) {
+    const module = builtinModuleOf(member);
+    const exact = patched.get(member) ?? patched.get(`${module}.*`);
+    if (exact !== undefined)
+        return exact;
+    const unnamedRead = member === `${module}.*`;
+    for (const [patch, file] of patched) {
+        if (builtinModuleOf(patch) !== module)
             continue;
-        // A fence in top-level module code throws when the module evaluates:
-        // it counts like one that needs the runtime.
-        const runtime = d.moduleInit === true || classifyDiagnostic(d, "fence").class === "runtime";
-        fenced.set(at.name, (fenced.get(at.name) ?? false) || runtime);
-        if (runtime)
-            sure?.add(at.name);
+        if (unnamedRead || patch.includes("["))
+            return file;
     }
-    if (requireFence && fenced.size === 0)
+    return undefined;
+}
+/** The growth inputs this build's frontend offers the shared island-growth
+ * rules (node-islands/growth.ts), or null when the frontend holds no island
+ * scan: the rules then grow nothing. `npmStatic` keeps a `"auto"` request
+ * out: only an explicit list names the packages to keep native. */
+function islandGrowth(entryPath, opts, fe) {
+    const scan = fe.nodeIslandScan?.({ userJs: false });
+    if (scan === undefined)
         return null;
-    const scan = fe.nodeIslandScan({ userJs: false });
-    const report = buildNodeIslandReport({
+    return {
         entry: entryPath,
+        policy: nodeIslandPolicy(readProjectConfig(entryPath), opts.nodeIslands),
         scan,
         npm: fe.npmStatic,
-        diagnostics: lowered.diagnostics,
-        fences: lowered.runtimeFences,
-        policy,
-    });
+        npmImportSites: fe.npmImportSites,
+        ...(Array.isArray(opts.npmStatic) ? { explicitNpmStatic: opts.npmStatic } : {}),
+        sourceTexts: () => fe.sourceTexts(),
+    };
+}
+/** The island modules grown by the lowering's refusals in user JavaScript
+ * (`--node-islands=auto` only), or null when there are none: a sloppy
+ * module whose semantics the native pipeline refuses (an implicit global,
+ * a mapped `arguments`, a `with` the pre-scan could not decide) runs in
+ * Node. One retry adds every one of them at once. */
+function loweringModules(entryPath, opts, diagnostics, known) {
+    const policy = nodeIslandPolicy(readProjectConfig(entryPath), opts.nodeIslands);
+    if (policy.mode !== "auto" || known.size > 16)
+        return null;
     const grown = new Map(known);
-    for (const island of report.islands) {
-        const runtimeFence = requireFence
-            ? fenced.get(island.package)
-            : (fenced.get(island.package) ?? false);
-        if (runtimeFence === undefined || island.path === null)
+    for (const d of diagnostics) {
+        if (!isIslandReasonCode(d.code))
             continue;
-        if (!compiled.has(island.package) || known.has(island.package))
+        const file = d.loc.file;
+        // Packages run in Node through their own decision
+        // (node-islands/growth.ts).
+        if (file.includes("/node_modules/") || packageDirOf(file) !== null)
             continue;
-        if (policy.forcedNative.has(island.package) || policy.unloaded.has(island.package))
+        if (!isJsSourceFileName(file) || sameFile(file, entryPath))
             continue;
-        // With fences (requireFence), only fences that surely fire count: a
-        // gap fence inside a function body may never run (jose's typed paths
-        // stay native, DECISIONS.md 2026-10-21). After a failed build
-        // (!requireFence), the package's report class decides.
-        if (requireFence && !runtimeFence)
+        if (grown.has(file))
             continue;
-        if (!runtimeFence && island.class !== "runtime" && island.class !== "object-model")
+        const reason = classifyDiagnostic(d, "refusal");
+        // A gap is a construct scriptc does not implement, not a sloppy
+        // semantic: running it in Node would hide a compiler limitation.
+        if (reason.class === "gap")
             continue;
-        grown.set(island.package, {
-            name: island.package,
-            version: island.version,
-            dir: island.path,
-            class: island.class,
-            reason: island.reason,
+        grown.set(file, {
+            file,
+            class: reason.class,
+            reason: describe(reason),
+            decision: "auto",
         });
     }
-    // A native ES module that imports an island CommonJS module would read
-    // its bindings from the module's exports object, where Node gives it the
-    // namespace its CommonJS facade builds (the lexed names, module.exports
-    // as the default): the importing package runs in the island too.
-    for (let added = true; added;) {
-        added = false;
-        for (const edge of scan.edges) {
-            const name = edge.to;
-            if (!grown.has(name) || edge.fromDir === null || edge.shim)
-                continue;
-            const at = packageDirOf(edge.fromFile);
-            if (at === null || grown.has(at.name) || !compiled.has(at.name))
-                continue;
-            if (policy.forcedNative.has(at.name) || policy.unloaded.has(at.name))
-                continue;
-            if (!isEsmFile(edge.fromFile))
-                continue;
-            const target = resolveBareModule(edge.fromFile, name, "js-only") ??
-                resolveBareModule(edge.fromFile, name, "js-only", "require");
-            if (target === null || isEsmFile(target.typesFile))
-                continue;
-            grown.set(at.name, {
-                name: at.name,
-                version: packageVersionOf(at.dir),
-                dir: at.dir,
-                class: "packaging",
-                reason: `an ES module of the package imports the CommonJS island package '${name}'`,
-            });
-            // It goes wherever that island goes, the sure-fence retry included.
-            if (known.has(name) || sure?.has(name) === true)
-                sure?.add(at.name);
-            added = true;
-        }
-    }
     return grown.size === known.size ? null : grown;
 }
 //# sourceMappingURL=prepare.js.map