@series-inc/rundot-syncplay 5.23.0-beta.7

package/dist/cjs/tools/static-checker.js

@@ -0,0 +1,1468 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkDeterminism = checkDeterminism;
+exports.collectDeterminismSuppressions = collectDeterminismSuppressions;
+exports.checkSourceText = checkSourceText;
+exports.getDeterminismParserKind = getDeterminismParserKind;
+const promises_1 = require("node:fs/promises");
+const node_module_1 = require("node:module");
+const node_path_1 = require("node:path");
+const rules = [
+    {
+        ruleId: 'determinism/no-math-random',
+        severity: 'error',
+        pattern: /\bMath\.random\s*\(/g,
+        message: 'Math.random() cannot be replayed or seeded by the deterministic session.',
+        suggestion: 'Use ctx.random.nextInt() or ctx.random.nextFixed() inside step().',
+    },
+    {
+        ruleId: 'determinism/no-date-now',
+        severity: 'error',
+        pattern: /\bDate\.now\s*\(/g,
+        message: 'Date.now() uses ambient wall-clock time and diverges during replay.',
+        suggestion: 'Use ctx.frame, fixed tick counters, or deterministic scheduled events.',
+    },
+    {
+        ruleId: 'determinism/no-new-date',
+        severity: 'error',
+        pattern: /\bnew\s+Date\s*\(/g,
+        message: 'new Date() uses ambient wall-clock time and is not replay-safe.',
+        suggestion: 'Store deterministic frame numbers or explicit timestamps supplied as inputs.',
+    },
+    {
+        ruleId: 'determinism/no-performance-now',
+        severity: 'error',
+        pattern: /\bperformance\.now\s*\(/g,
+        message: 'performance.now() depends on the local runtime clock.',
+        suggestion: 'Use fixed frame counters from the deterministic step context.',
+    },
+    {
+        ruleId: 'determinism/no-timers',
+        severity: 'error',
+        pattern: /\b(setTimeout|setInterval|requestAnimationFrame)\s*\(/g,
+        message: 'Timers are wall-clock or render-clock driven and cannot be replayed.',
+        suggestion: 'Use countdown fields in deterministic state advanced by fixed ticks.',
+    },
+    {
+        ruleId: 'determinism/no-io',
+        severity: 'error',
+        pattern: /\b(fetch|WebSocket)\s*\(/g,
+        message: 'External I/O inside simulation breaks replay and rollback.',
+        suggestion: 'Move I/O outside simulation and feed results through deterministic inputs.',
+    },
+    {
+        ruleId: 'determinism/no-commonjs-require',
+        severity: 'error',
+        pattern: /\brequire\s*\(/g,
+        message: 'CommonJS require() can load host-dependent code paths during simulation.',
+        suggestion: 'Use static imports in non-simulation code or route external data through deterministic assets/config.',
+    },
+    {
+        ruleId: 'determinism/no-node-builtin-import',
+        severity: 'error',
+        pattern: /\b(?:import|export)\b[^'"]*['"](?:node:|fs|path|crypto|http|https|net|tls|child_process|worker_threads|process)['"]/g,
+        message: 'Node builtin modules expose host I/O, clocks, process state, or platform-specific behavior.',
+        suggestion: 'Keep Node-only work outside deterministic simulation and provide deterministic assets, configs, or inputs instead.',
+    },
+    {
+        ruleId: 'determinism/no-dynamic-code',
+        severity: 'error',
+        pattern: /\b(?:eval|Function)\s*\(/g,
+        message: 'Dynamic code evaluation bypasses static determinism checks and can vary by host runtime.',
+        suggestion: 'Use compiled deterministic systems or descriptor/codegen outputs checked into the deterministic build.',
+    },
+    {
+        ruleId: 'determinism/no-import-meta',
+        severity: 'error',
+        pattern: /\bimport\.meta\b/g,
+        message: 'import.meta exposes host module identity and environment-specific metadata.',
+        suggestion: 'Resolve module metadata outside simulation and pass stable values through deterministic config assets.',
+    },
+    {
+        ruleId: 'determinism/no-process-env',
+        severity: 'error',
+        pattern: /\bprocess\.env\b/g,
+        message: 'process.env reads depend on host configuration and are not replay-safe.',
+        suggestion: 'Resolve environment configuration before simulation and pass it through deterministic config assets.',
+    },
+    {
+        ruleId: 'determinism/no-locale-compare',
+        severity: 'error',
+        pattern: /\.localeCompare\s*\(/g,
+        message: 'localeCompare can vary by runtime locale and ICU data.',
+        suggestion: 'Use ordinal comparison: left < right ? -1 : left > right ? 1 : 0.',
+    },
+    {
+        ruleId: 'determinism/no-intl-locale',
+        severity: 'error',
+        pattern: /\bIntl\.(Collator|DateTimeFormat|NumberFormat|PluralRules|RelativeTimeFormat|ListFormat|Segmenter|DisplayNames)\s*\(/g,
+        message: 'Intl formatting and collation depend on runtime ICU data and locale support.',
+        suggestion: 'Precompute locale-sensitive data outside simulation or use deterministic ordinal/quantized formatting tables.',
+    },
+    {
+        ruleId: 'determinism/no-locale-format',
+        severity: 'error',
+        pattern: /\.(toLocaleString|toLocaleDateString|toLocaleTimeString|toLocaleLowerCase|toLocaleUpperCase)\s*\(/g,
+        message: 'Locale-sensitive formatting can vary by runtime locale and ICU data.',
+        suggestion: 'Format outside simulation or use deterministic fixed-format serializers.',
+    },
+    {
+        ruleId: 'determinism/no-float-format',
+        severity: 'error',
+        pattern: /(?<!math)\.(toFixed|toPrecision)\s*\(/g,
+        message: 'toFixed/toPrecision rounding has diverged across JS engines (Hermes vs V8) — a cross-engine desync vector when the result feeds checksummed state.',
+        suggestion: 'Quantize with pure integer arithmetic (Math.round(value * scale) / scale) or the fixed-point math helpers.',
+    },
+    {
+        ruleId: 'determinism/no-crypto-random',
+        severity: 'error',
+        pattern: /\bcrypto\.(getRandomValues|randomUUID)\s*\(/g,
+        message: 'Crypto random APIs use external entropy.',
+        suggestion: 'Use deterministic session RNG seeded by replay identity.',
+    },
+    {
+        ruleId: 'determinism/no-object-key-order',
+        severity: 'warn',
+        pattern: /\bObject\.(keys|values|entries)\s*\(/g,
+        message: 'Object key iteration can hide ordering assumptions in simulation code.',
+        suggestion: 'Sort keys explicitly or use schema-declared arrays with stable indexes.',
+    },
+    {
+        ruleId: 'determinism/no-for-in',
+        severity: 'warn',
+        pattern: /\bfor\s*\([^)]*\bin\b[^)]*\)/g,
+        message: 'for...in iteration can hide ordering assumptions and prototype pollution.',
+        suggestion: 'Iterate schema-declared arrays or Object.keys(record).sort() with an explicit comparator.',
+    },
+    {
+        ruleId: 'determinism/no-reflect-own-keys',
+        severity: 'error',
+        pattern: /\bReflect\.ownKeys\s*\(/g,
+        message: 'Reflect.ownKeys() exposes host object key ordering assumptions.',
+        suggestion: 'Use schema-declared keys or Object.keys(record).sort(compareStableStrings).',
+    },
+    {
+        ruleId: 'determinism/no-native-map-set-iteration',
+        severity: 'error',
+        pattern: /\b(?:Array\.from\s*\(\s*[A-Za-z_$][\w$]*\s*\)|\[\s*\.\.\.\s*[A-Za-z_$][\w$]*\s*\])/g,
+        message: 'Native Map/Set iteration order can hide nondeterministic insertion-order assumptions.',
+        suggestion: 'Use deterministic frame collections or materialize entries sorted by stable schema ids.',
+    },
+    {
+        ruleId: 'determinism/no-sort-without-comparator',
+        severity: 'error',
+        pattern: /\.sort\s*\(\s*\)/g,
+        message: 'Array.sort() without a comparator relies on implicit string conversion.',
+        suggestion: 'Pass an explicit deterministic comparator.',
+    },
+    {
+        ruleId: 'determinism/no-random-sort-comparator',
+        severity: 'error',
+        pattern: /\.sort\s*\(.*\bMath\.random\s*\(/g,
+        message: 'Random sort comparators produce unstable ordering and cannot be replayed.',
+        suggestion: 'Use a deterministic shuffle driven by ctx.random or sort by stable ids.',
+    },
+    {
+        ruleId: 'determinism/no-extracted-mutating-method',
+        severity: 'error',
+        pattern: /\b(?:push|pop|shift|unshift|splice|sort|reverse|fill|copyWithin|set|add|delete|clear)\.(?:call|apply|bind)\s*\(/g,
+        message: 'Extracted mutating collection methods hide deterministic state mutation from the checker.',
+        suggestion: 'Mutate only rollback-owned state through deterministic APIs or use local scratch collections inside a single step.',
+    },
+    {
+        ruleId: 'determinism/no-async-step',
+        // error, not warn: an async step() (or promise scheduling inside the sim)
+        // breaks frame atomicity outright — never advisory.
+        severity: 'error',
+        pattern: /\basync\s+function\b|\bnew\s+Promise\s*\(|\bPromise(?:\.[A-Za-z_$][\w$]*)?\s*\(|\b(queueMicrotask|setImmediate)\s*\(/g,
+        message: 'Async scheduling is not deterministic inside simulation.',
+        suggestion: 'Keep simulation steps synchronous and model effects as explicit outputs.',
+    },
+    {
+        ruleId: 'determinism/no-dynamic-import',
+        severity: 'error',
+        pattern: /\bimport\s*\(/g,
+        message: 'Dynamic import() can load host-dependent code paths during simulation.',
+        suggestion: 'Use top-level static imports outside deterministic simulation or route external data through deterministic assets/config.',
+    },
+    {
+        ruleId: 'determinism/no-trig-math',
+        // error, not warn: libm-divergent float math is the desync class this
+        // engine exists to prevent — certification must block it out of the box.
+        severity: 'error',
+        pattern: /\bMath\.(sin|cos|tan|asin|acos|atan|atan2|sqrt|cbrt|hypot|pow|log|log10|log2|log1p|exp|expm1|fround|sinh|cosh|tanh|asinh|acosh|atanh)\s*\(/g,
+        message: 'Native floating math can drift across runtimes when checksummed.',
+        suggestion: 'Use deterministic math wrappers, fixed-point helpers, or quantized lookup tables.',
+    },
+    {
+        ruleId: 'determinism/no-render-object-mutation',
+        severity: 'error',
+        pattern: /\b(scene|mesh|camera|group|object3D)\.(position|rotation|scale)\b/g,
+        message: 'Render object mutation belongs outside checksummed simulation state.',
+        suggestion: 'Mutate plain deterministic state in step(), then map frames to r3f/Three props in render code.',
+    },
+    {
+        ruleId: 'determinism/no-uncertified-physics-step',
+        severity: 'error',
+        pattern: /\b(world|physicsWorld|rapierWorld|matterWorld)\.step\s*\(/g,
+        message: 'Physics engine stepping inside simulation is blocked until that engine passes rollback certification.',
+        suggestion: 'Use fixed-point collision helpers or a certified physics adapter with snapshot/restore checks.',
+    },
+    {
+        ruleId: 'determinism/no-module-mutable-state',
+        severity: 'error',
+        pattern: /^\s*(?:export\s+)?let\s+[A-Za-z_$][\w$]*/gm,
+        message: 'Mutable module state survives rollback and violates stateless deterministic system rules.',
+        suggestion: 'Move mutable values into checksummed frame state, singleton components, or system-local scratch created inside the step.',
+    },
+    {
+        ruleId: 'determinism/no-closure-mutable-state',
+        severity: 'error',
+        pattern: /\b[A-Za-z_$][\w$]*\s*(?:\+\+|--|[+\-*/%]?=)/g,
+        message: 'Closure mutable state can persist across rollback outside the deterministic frame.',
+        suggestion: 'Store counters and accumulators in frame state or local variables recreated each step.',
+    },
+    {
+        ruleId: 'determinism/no-mutable-class-state',
+        severity: 'error',
+        pattern: /\bclass\s+[A-Za-z_$][\w$]*[\s\S]*?\{[\s\S]*?\b[A-Za-z_$][\w$]*\s*(?:=|;)/g,
+        message: 'Class fields create mutable simulation object state outside the deterministic frame.',
+        suggestion: 'Represent deterministic data as plain frame components and keep systems stateless.',
+    },
+    {
+        ruleId: 'determinism/no-mutable-collection-state',
+        severity: 'error',
+        pattern: /^\s*(?:export\s+)?const\s+[A-Za-z_$][\w$]*\s*=\s*new\s+(Map|Set|WeakMap|WeakSet)\s*\(/gm,
+        message: 'Native mutable collections preserve insertion and mutation state outside declared deterministic storage.',
+        suggestion: 'Use deterministic frame collections or recreate local collections inside a step and serialize their ordered contents.',
+    },
+];
+const requireModule = (0, node_module_1.createRequire)((0, node_path_1.resolve)('package.json'));
+let parserKind;
+const unsafeNativeMathExpressions = new Set([
+    'Math.sin', 'Math.cos', 'Math.tan',
+    'Math.asin', 'Math.acos', 'Math.atan', 'Math.atan2',
+    'Math.sqrt', 'Math.cbrt', 'Math.hypot', 'Math.pow',
+    'Math.log', 'Math.log10', 'Math.log2', 'Math.log1p',
+    'Math.exp', 'Math.expm1', 'Math.fround',
+    'Math.sinh', 'Math.cosh', 'Math.tanh',
+    'Math.asinh', 'Math.acosh', 'Math.atanh',
+]);
+const nodeBuiltinSpecifiers = new Set([
+    'assert',
+    'async_hooks',
+    'buffer',
+    'child_process',
+    'cluster',
+    'crypto',
+    'dgram',
+    'diagnostics_channel',
+    'dns',
+    'events',
+    'fs',
+    'http',
+    'http2',
+    'https',
+    'inspector',
+    'module',
+    'net',
+    'os',
+    'path',
+    'perf_hooks',
+    'process',
+    'readline',
+    'stream',
+    'string_decoder',
+    'timers',
+    'tls',
+    'tty',
+    'url',
+    'util',
+    'v8',
+    'vm',
+    'worker_threads',
+    'zlib',
+]);
+async function checkDeterminism(options) {
+    const mode = options.mode ?? 'warn';
+    const files = await collectFiles(options.paths, options.followImports ?? true, options.project);
+    const diagnostics = [];
+    const schemaOptions = createSchemaOptions(options.schemaStateFields, options.stateObjectName);
+    for (const file of files) {
+        const content = await (0, promises_1.readFile)(file, 'utf8');
+        diagnostics.push(...checkFile(file, content, mode, schemaOptions, options.parserKind));
+    }
+    return diagnostics;
+}
+async function collectDeterminismSuppressions(paths) {
+    const files = await collectFiles(paths, true);
+    const suppressions = [];
+    for (const file of files) {
+        const lines = (await (0, promises_1.readFile)(file, 'utf8')).split(/\r?\n/);
+        lines.forEach((line, index) => {
+            const suppression = parseSuppressionDetails(line);
+            if (suppression !== undefined) {
+                suppressions.push({
+                    path: file,
+                    line: index + 1,
+                    ...suppression,
+                });
+            }
+        });
+    }
+    /* istanbul ignore next -- one suppression can exist per source line, so the rule-id tie-breaker is defensive ordering. */
+    return suppressions.sort((left, right) => left.path.localeCompare(right.path) || left.line - right.line || left.ruleId.localeCompare(right.ruleId));
+}
+function checkSourceText(path, content, mode = 'warn', options = {}) {
+    return checkFile(path, content, mode, createSchemaOptions(options.schemaStateFields, options.stateObjectName), options.parserKind);
+}
+function getDeterminismParserKind() {
+    if (parserKind !== undefined) {
+        return parserKind;
+    }
+    try {
+        requireModule.resolve('typescript');
+        parserKind = 'typescript-ast';
+    }
+    catch {
+        /* istanbul ignore next -- parserKind override covers regex behavior without requiring a no-typescript install fixture. */
+        parserKind = 'regex-scanner';
+    }
+    return parserKind;
+}
+function checkFile(path, content, mode, schemaOptions, parserKindOverride) {
+    if ((parserKindOverride ?? getDeterminismParserKind()) === 'typescript-ast') {
+        return checkFileWithAst(path, content, mode, schemaOptions);
+    }
+    return checkFileWithRegex(path, content, mode, schemaOptions);
+}
+function checkFileWithAst(path, content, mode, schemaOptions) {
+    const typescript = requireModule('typescript');
+    const sourceFile = typescript.createSourceFile(path, content, typescript.ScriptTarget.Latest, true, typescript.ScriptKind.TS);
+    const diagnostics = [];
+    const declarations = new Map();
+    const forbiddenAliases = new Map();
+    const namespaceAliases = new Map();
+    const mutatingMethodAliases = new Set();
+    const functionStack = [];
+    let functionDepth = 0;
+    let returnedFunctionDepth = 0;
+    diagnostics.push(...parseDiagnosticsToDeterminismDiagnostics(typescript, sourceFile, path));
+    if (diagnostics.some((diagnostic) => diagnostic.ruleId === 'determinism/syntax-error')) {
+        return diagnostics;
+    }
+    visit(sourceFile);
+    return diagnostics.sort((left, right) => left.line - right.line || left.column - right.column || left.ruleId.localeCompare(right.ruleId));
+    function visit(node) {
+        if (isFunctionScopeNode(node)) {
+            functionDepth += 1;
+            functionStack.push(functionName(node));
+            const returnedFunction = isReturnedFunction(node);
+            returnedFunctionDepth += returnedFunction ? 1 : 0;
+            checkFunctionNode(node);
+            typescript.forEachChild(node, visit);
+            returnedFunctionDepth -= returnedFunction ? 1 : 0;
+            functionStack.pop();
+            functionDepth -= 1;
+            return;
+        }
+        if (typescript.isVariableStatement(node)) {
+            checkVariableStatement(node);
+        }
+        if (typescript.isVariableDeclaration(node)) {
+            registerVariableDeclaration(node);
+        }
+        if (typescript.isCallExpression(node)) {
+            checkCallExpression(node);
+        }
+        if (typescript.isImportDeclaration(node) || typescript.isExportDeclaration(node)) {
+            const moduleSpecifier = node.moduleSpecifier;
+            if (moduleSpecifier !== undefined && typescript.isStringLiteralLike(moduleSpecifier) && isNodeBuiltinSpecifier(moduleSpecifier.text)) {
+                pushRule(node, 'determinism/no-node-builtin-import');
+            }
+        }
+        if (typescript.isImportEqualsDeclaration(node) && typescript.isExternalModuleReference(node.moduleReference)) {
+            const expression = node.moduleReference.expression;
+            if (typescript.isStringLiteralLike(expression) && isNodeBuiltinSpecifier(expression.text)) {
+                pushRule(node, 'determinism/no-node-builtin-import');
+            }
+        }
+        if (typescript.isNewExpression(node)) {
+            const expressionText = normalizedExpressionText(node.expression);
+            if (expressionText === 'Date') {
+                pushRule(node, 'determinism/no-new-date');
+            }
+            if (expressionText === 'Function' || expressionText === 'globalThis.Function') {
+                pushRule(node, 'determinism/no-dynamic-code');
+            }
+            if (expressionText === 'Promise' || expressionText === 'globalThis.Promise') {
+                pushRule(node, 'determinism/no-async-step');
+            }
+            if (expressionText.startsWith('Intl.') || expressionText.startsWith('globalThis.Intl.')) {
+                pushRule(node, 'determinism/no-intl-locale');
+            }
+            if (typescript.isIdentifier(node.expression)) {
+                const aliasRule = forbiddenAliases.get(node.expression.text);
+                if (aliasRule === 'determinism/no-intl-locale' || aliasRule === 'determinism/no-dynamic-code') {
+                    pushRule(node, aliasRule);
+                }
+            }
+        }
+        if (typescript.isNewExpression(node) &&
+            (normalizedExpressionText(node.expression) === 'WebSocket' || normalizedExpressionText(node.expression) === 'globalThis.WebSocket')) {
+            pushRule(node, 'determinism/no-io');
+        }
+        if (typescript.isForInStatement(node)) {
+            pushRule(node, 'determinism/no-for-in');
+        }
+        if (node.kind === typescript.SyntaxKind.MetaProperty && node.getText(sourceFile) === 'import.meta') {
+            pushRule(node, 'determinism/no-import-meta');
+        }
+        if (typescript.isForOfStatement(node)) {
+            checkNativeCollectionIteration(node.expression, node);
+        }
+        if (typescript.isSpreadElement(node)) {
+            checkNativeCollectionIteration(node.expression, node);
+        }
+        if (typescript.isPropertyAccessExpression(node) &&
+            isRenderObjectReceiver(node.expression.getText(sourceFile)) &&
+            (node.name.text === 'position' || node.name.text === 'rotation' || node.name.text === 'scale')) {
+            pushRule(node, 'determinism/no-render-object-mutation');
+        }
+        if (typescript.isPropertyAccessExpression(node) &&
+            normalizedExpressionText(node) === 'process.env') {
+            pushRule(node, 'determinism/no-process-env');
+        }
+        if (typescript.isElementAccessExpression(node) &&
+            normalizedExpressionText(node) === 'process.env') {
+            pushRule(node, 'determinism/no-process-env');
+        }
+        if (typescript.isPropertyDeclaration(node) && isSystemLikeClassProperty(node)) {
+            pushRule(node, 'determinism/no-mutable-class-state');
+        }
+        if (typescript.isBinaryExpression(node) &&
+            isMutationOperator(node.operatorToken.kind) &&
+            typescript.isIdentifier(node.left)) {
+            checkMutableIdentifierWrite(node.left);
+        }
+        if (typescript.isBinaryExpression(node) &&
+            isMutationOperator(node.operatorToken.kind) &&
+            (typescript.isPropertyAccessExpression(node.left) || typescript.isElementAccessExpression(node.left))) {
+            checkCapturedMutableValueUse(node.left);
+        }
+        if ((typescript.isPrefixUnaryExpression(node) || typescript.isPostfixUnaryExpression(node)) &&
+            (node.operator === typescript.SyntaxKind.PlusPlusToken || node.operator === typescript.SyntaxKind.MinusMinusToken) &&
+            typescript.isIdentifier(node.operand)) {
+            checkMutableIdentifierWrite(node.operand);
+        }
+        if ((typescript.isPrefixUnaryExpression(node) || typescript.isPostfixUnaryExpression(node)) &&
+            (node.operator === typescript.SyntaxKind.PlusPlusToken || node.operator === typescript.SyntaxKind.MinusMinusToken) &&
+            (typescript.isPropertyAccessExpression(node.operand) || typescript.isElementAccessExpression(node.operand))) {
+            checkCapturedMutableValueUse(node.operand);
+        }
+        if (schemaOptions.stateFields !== undefined) {
+            checkStateFieldAccess(node, schemaOptions.stateFields);
+        }
+        typescript.forEachChild(node, visit);
+    }
+    function isFunctionScopeNode(node) {
+        return typescript.isFunctionDeclaration(node)
+            || typescript.isFunctionExpression(node)
+            || typescript.isArrowFunction(node)
+            || typescript.isMethodDeclaration(node);
+    }
+    function checkFunctionNode(node) {
+        if (node.modifiers?.some((modifier) => modifier.kind === typescript.SyntaxKind.AsyncKeyword) === true) {
+            pushRule(node, 'determinism/no-async-step');
+        }
+    }
+    function checkVariableStatement(node) {
+        if ((node.declarationList.flags & typescript.NodeFlags.Let) !== 0 && node.parent === sourceFile) {
+            pushRule(node, 'determinism/no-module-mutable-state');
+        }
+    }
+    function registerVariableDeclaration(node) {
+        registerForbiddenAlias(node);
+        if (!typescript.isIdentifier(node.name)) {
+            return;
+        }
+        const mutable = (node.parent.flags & typescript.NodeFlags.Let) !== 0;
+        declarations.set(node.name.text, {
+            functionDepth,
+            mutable,
+            capturedMutableValue: isCapturedMutableValueInitializer(node.initializer),
+            nativeCollectionKind: nativeCollectionInitializerKind(node.initializer),
+        });
+        if (functionDepth === 0 && node.initializer !== undefined && isMutableCollectionExpression(node.initializer)) {
+            pushRule(node.initializer, 'determinism/no-mutable-collection-state');
+        }
+    }
+    function registerForbiddenAlias(node) {
+        if (node.initializer === undefined) {
+            return;
+        }
+        if (typescript.isIdentifier(node.name)) {
+            const expressionText = normalizedExpressionText(node.initializer);
+            const namespaceRoot = forbiddenNamespaceRoot(expressionText);
+            if (namespaceRoot !== undefined) {
+                namespaceAliases.set(node.name.text, namespaceRoot);
+            }
+            const rule = forbiddenExpressionRule(expressionText);
+            if (rule !== undefined) {
+                forbiddenAliases.set(node.name.text, rule);
+            }
+            if (isExtractedMutatingMethodExpression(expressionText)) {
+                mutatingMethodAliases.add(node.name.text);
+            }
+            return;
+        }
+        if (typescript.isArrayBindingPattern(node.name)) {
+            registerArrayBindingAliases(node);
+            return;
+        }
+        const objectBinding = node.name;
+        const objectText = normalizedExpressionText(node.initializer);
+        for (const element of objectBinding.elements) {
+            if (!typescript.isIdentifier(element.name)) {
+                continue;
+            }
+            const propertyName = element.propertyName?.getText(sourceFile) ?? element.name.text;
+            const rule = forbiddenExpressionRule(`${objectText}.${propertyName}`);
+            if (rule !== undefined) {
+                forbiddenAliases.set(element.name.text, rule);
+            }
+        }
+    }
+    function registerArrayBindingAliases(node) {
+        const initializer = node.initializer;
+        if (initializer === undefined || !typescript.isArrayBindingPattern(node.name) || !typescript.isArrayLiteralExpression(initializer)) {
+            return;
+        }
+        node.name.elements.forEach((element, index) => {
+            if (!typescript.isBindingElement(element) || !typescript.isIdentifier(element.name)) {
+                return;
+            }
+            const initializerElement = initializer.elements[index];
+            if (initializerElement === undefined || typescript.isSpreadElement(initializerElement)) {
+                return;
+            }
+            const expressionText = normalizedExpressionText(initializerElement);
+            const rule = forbiddenExpressionRule(expressionText);
+            if (rule !== undefined) {
+                forbiddenAliases.set(element.name.text, rule);
+            }
+            if (isExtractedMutatingMethodExpression(expressionText)) {
+                mutatingMethodAliases.add(element.name.text);
+            }
+        });
+    }
+    function checkMutableIdentifierWrite(node) {
+        const declaration = declarations.get(node.text);
+        if (declaration === undefined || !declaration.mutable || declaration.functionDepth === functionDepth) {
+            return;
+        }
+        if (declaration.functionDepth > 0 && returnedFunctionDepth === 0) {
+            return;
+        }
+        pushRule(node, 'determinism/no-closure-mutable-state');
+    }
+    function checkCapturedMutableValueUse(node) {
+        const root = rootIdentifier(node.expression);
+        if (root === undefined || !isCapturedMutableValueMutation(root)) {
+            return;
+        }
+        pushRule(node, 'determinism/no-closure-mutable-state');
+    }
+    function checkCapturedMutatingMethodCall(node) {
+        if (!typescript.isPropertyAccessExpression(node.expression)) {
+            return false;
+        }
+        const methodName = node.expression.name.text;
+        if (!isMutatingMethodName(methodName)) {
+            return false;
+        }
+        const root = rootIdentifier(node.expression.expression);
+        if (root === undefined || !isCapturedMutableValueMutation(root)) {
+            return false;
+        }
+        pushRule(node.expression, 'determinism/no-closure-mutable-state');
+        return true;
+    }
+    function checkNativeCollectionIteration(expression, node) {
+        if (!isDeterministicStepScope()) {
+            return;
+        }
+        const collectionKind = nativeCollectionExpressionKind(expression);
+        if (collectionKind === 'Map' || collectionKind === 'Set') {
+            pushRule(node, 'determinism/no-native-map-set-iteration');
+        }
+    }
+    function isCapturedMutableValueMutation(identifier) {
+        const declaration = declarations.get(identifier.text);
+        if (declaration === undefined || !declaration.capturedMutableValue || declaration.functionDepth === functionDepth) {
+            return false;
+        }
+        if (!isDeterministicStepScope()) {
+            return false;
+        }
+        if (declaration.functionDepth > 0 && returnedFunctionDepth === 0) {
+            return false;
+        }
+        return true;
+    }
+    function isDeterministicStepScope() {
+        return functionStack.some((name) => name === 'step' || name === 'simulate' || name === 'mutate' || name === 'update');
+    }
+    function isReturnedFunction(node) {
+        if (typescript.isMethodDeclaration(node)) {
+            return false;
+        }
+        let parent = node.parent;
+        while (parent !== undefined && typescript.isParenthesizedExpression(parent)) {
+            parent = parent.parent;
+        }
+        return parent !== undefined && typescript.isReturnStatement(parent);
+    }
+    function isSystemLikeClassProperty(node) {
+        let parent = node.parent;
+        /* istanbul ignore next -- TypeScript PropertyDeclaration nodes are class-owned; this loop is defensive for malformed ASTs. */
+        while (parent !== undefined && !typescript.isClassDeclaration(parent)) {
+            parent = parent.parent;
+        }
+        /* istanbul ignore next -- TypeScript PropertyDeclaration nodes are class-owned; retained as a defensive malformed-AST guard. */
+        if (parent === undefined || !typescript.isClassDeclaration(parent)) {
+            return false;
+        }
+        const className = parent.name?.text ?? '';
+        return /(?:System|Processor|Simulation|Runtime|Stepper|Controller)$/.test(className);
+    }
+    function isMutationOperator(kind) {
+        return kind === typescript.SyntaxKind.EqualsToken
+            || kind === typescript.SyntaxKind.PlusEqualsToken
+            || kind === typescript.SyntaxKind.MinusEqualsToken
+            || kind === typescript.SyntaxKind.AsteriskEqualsToken
+            || kind === typescript.SyntaxKind.SlashEqualsToken
+            || kind === typescript.SyntaxKind.PercentEqualsToken;
+    }
+    function isMutableCollectionExpression(node) {
+        return nativeCollectionInitializerKind(node) !== undefined;
+    }
+    function nativeCollectionInitializerKind(node) {
+        if (node === undefined || !typescript.isNewExpression(node)) {
+            return undefined;
+        }
+        const expressionText = normalizedExpressionText(node.expression);
+        if (expressionText === 'Map' || expressionText === 'globalThis.Map') {
+            return 'Map';
+        }
+        if (expressionText === 'Set' || expressionText === 'globalThis.Set') {
+            return 'Set';
+        }
+        if (expressionText === 'WeakMap' || expressionText === 'globalThis.WeakMap') {
+            return 'WeakMap';
+        }
+        if (expressionText === 'WeakSet' || expressionText === 'globalThis.WeakSet') {
+            return 'WeakSet';
+        }
+        return undefined;
+    }
+    function nativeCollectionExpressionKind(node) {
+        const initializerKind = nativeCollectionInitializerKind(node);
+        if (initializerKind !== undefined) {
+            return initializerKind;
+        }
+        const root = rootIdentifier(node);
+        return root === undefined ? undefined : declarations.get(root.text)?.nativeCollectionKind;
+    }
+    function isCapturedMutableValueInitializer(node) {
+        if (node === undefined) {
+            return false;
+        }
+        return isMutableCollectionExpression(node)
+            || typescript.isObjectLiteralExpression(node)
+            || typescript.isArrayLiteralExpression(node);
+    }
+    function rootIdentifier(node) {
+        let current = node;
+        while (typescript.isPropertyAccessExpression(current) || typescript.isElementAccessExpression(current)) {
+            current = current.expression;
+        }
+        return typescript.isIdentifier(current) ? current : undefined;
+    }
+    function isMutatingMethodName(methodName) {
+        return methodName === 'push'
+            || methodName === 'pop'
+            || methodName === 'shift'
+            || methodName === 'unshift'
+            || methodName === 'splice'
+            || methodName === 'sort'
+            || methodName === 'reverse'
+            || methodName === 'fill'
+            || methodName === 'copyWithin'
+            || methodName === 'set'
+            || methodName === 'add'
+            || methodName === 'delete'
+            || methodName === 'clear';
+    }
+    function isExtractedMutatingMethodExpression(expressionText) {
+        const methodName = expressionText.split('.').at(-1);
+        return methodName !== undefined && isMutatingMethodName(methodName);
+    }
+    function checkCallExpression(node) {
+        if (checkCapturedMutatingMethodCall(node)) {
+            return;
+        }
+        if (node.expression.kind === typescript.SyntaxKind.ImportKeyword) {
+            pushRule(node, 'determinism/no-dynamic-import');
+            const moduleSpecifier = node.arguments[0];
+            if (moduleSpecifier !== undefined && typescript.isStringLiteralLike(moduleSpecifier) && isNodeBuiltinSpecifier(moduleSpecifier.text)) {
+                pushRule(node, 'determinism/no-node-builtin-import');
+            }
+            return;
+        }
+        const expressionText = normalizedExpressionText(node.expression);
+        if (isAllowedCertificationTimerCall(expressionText)) {
+            return;
+        }
+        if (typescript.isIdentifier(node.expression)) {
+            const aliasRule = forbiddenAliases.get(node.expression.text);
+            if (aliasRule !== undefined) {
+                pushRule(node, aliasRule);
+                if (aliasRule === 'determinism/no-commonjs-require') {
+                    const moduleSpecifier = node.arguments[0];
+                    if (moduleSpecifier !== undefined && typescript.isStringLiteralLike(moduleSpecifier) && isNodeBuiltinSpecifier(moduleSpecifier.text)) {
+                        pushRule(node, 'determinism/no-node-builtin-import');
+                    }
+                }
+                return;
+            }
+            if (mutatingMethodAliases.has(node.expression.text)) {
+                pushRule(node, 'determinism/no-extracted-mutating-method');
+                return;
+            }
+        }
+        const indirectRule = indirectForbiddenCallRule(node);
+        if (indirectRule !== undefined) {
+            pushRule(node, indirectRule);
+            return;
+        }
+        if (expressionText === 'require' || expressionText === 'globalThis.require') {
+            pushRule(node, 'determinism/no-commonjs-require');
+            const moduleSpecifier = node.arguments[0];
+            if (moduleSpecifier !== undefined && typescript.isStringLiteralLike(moduleSpecifier) && isNodeBuiltinSpecifier(moduleSpecifier.text)) {
+                pushRule(node, 'determinism/no-node-builtin-import');
+            }
+            return;
+        }
+        if (expressionText === 'eval' || expressionText === 'globalThis.eval' || expressionText === 'Function' || expressionText === 'globalThis.Function') {
+            pushRule(node, 'determinism/no-dynamic-code');
+            return;
+        }
+        const forbiddenRule = forbiddenExpressionRule(expressionText);
+        if (forbiddenRule !== undefined) {
+            pushRule(node, forbiddenRule);
+            return;
+        }
+        if (expressionText.endsWith('.localeCompare')) {
+            pushRule(node, 'determinism/no-locale-compare');
+            return;
+        }
+        if (expressionText === 'Object.keys' || expressionText === 'Object.values' || expressionText === 'Object.entries') {
+            if (isKeyOrderStabilized(node)) {
+                return;
+            }
+            pushRule(node, 'determinism/no-object-key-order');
+            return;
+        }
+        if (expressionText === 'Reflect.ownKeys' || expressionText === 'globalThis.Reflect.ownKeys') {
+            if (isKeyOrderStabilized(node)) {
+                return;
+            }
+            pushRule(node, 'determinism/no-reflect-own-keys');
+            return;
+        }
+        if (isNativeCollectionIterationCall(node)) {
+            pushRule(node, 'determinism/no-native-map-set-iteration');
+            return;
+        }
+        if (isUnsafeNativeMathExpression(expressionText)) {
+            pushRule(node, 'determinism/no-trig-math');
+            return;
+        }
+        if (expressionText.endsWith('.step') && isUncertifiedPhysicsReceiver(expressionText.slice(0, -'.step'.length))) {
+            pushRule(node, 'determinism/no-uncertified-physics-step');
+            return;
+        }
+        if (typescript.isPropertyAccessExpression(node.expression) && node.expression.name.text === 'sort') {
+            if (node.arguments.length === 0) {
+                pushRule(node, 'determinism/no-sort-without-comparator');
+                return;
+            }
+            if (node.arguments.some(argumentContainsMathRandom)) {
+                pushRule(node, 'determinism/no-random-sort-comparator');
+            }
+        }
+    }
+    function indirectForbiddenCallRule(node) {
+        if (typescript.isPropertyAccessExpression(node.expression)
+            && (node.expression.name.text === 'call' || node.expression.name.text === 'apply' || node.expression.name.text === 'bind')) {
+            const receiverText = normalizedExpressionText(node.expression.expression);
+            const rule = forbiddenAliases.get(receiverText) ?? forbiddenExpressionRule(receiverText);
+            if (rule !== undefined) {
+                return rule;
+            }
+            if (mutatingMethodAliases.has(receiverText) || isExtractedMutatingMethodExpression(receiverText)) {
+                return 'determinism/no-extracted-mutating-method';
+            }
+        }
+        if (expressionTextForCall(node) === 'Reflect.get') {
+            const reflected = reflectedPropertyAccessText(node);
+            if (reflected !== undefined) {
+                return forbiddenExpressionRule(reflected);
+            }
+        }
+        return undefined;
+    }
+    function expressionTextForCall(node) {
+        return normalizedExpressionText(node.expression);
+    }
+    function reflectedPropertyAccessText(node) {
+        const receiver = node.arguments[0];
+        const property = node.arguments[1];
+        if (receiver === undefined || property === undefined || !typescript.isStringLiteralLike(property)) {
+            return undefined;
+        }
+        return `${normalizedExpressionText(receiver)}.${property.text}`;
+    }
+    /**
+     * Strip a global-object prefix so `window.Math.random`, `self.crypto.…`,
+     * `top.performance.now`, etc. match the same rules as bare/globalThis forms.
+     * H5 games run in a browser where window/self are the ambient globals —
+     * prefixed access must not be a rule bypass.
+     */
+    function stripGlobalPrefix(expressionText) {
+        let stripped = expressionText;
+        let changed = true;
+        while (changed) {
+            changed = false;
+            for (const prefix of ['globalThis.', 'window.', 'self.', 'top.', 'parent.', 'frames.']) {
+                if (stripped.startsWith(prefix)) {
+                    stripped = stripped.slice(prefix.length);
+                    changed = true;
+                }
+            }
+        }
+        return stripped;
+    }
+    function forbiddenExpressionRule(rawExpressionText) {
+        const expressionText = stripGlobalPrefix(rawExpressionText);
+        if (expressionText === 'Math.random') {
+            return 'determinism/no-math-random';
+        }
+        if (expressionText === 'Date.now') {
+            return 'determinism/no-date-now';
+        }
+        if (expressionText === 'performance.now') {
+            return 'determinism/no-performance-now';
+        }
+        if (expressionText === 'setTimeout' ||
+            expressionText === 'setInterval' ||
+            expressionText === 'requestAnimationFrame') {
+            return 'determinism/no-timers';
+        }
+        if (expressionText === 'setImmediate' || expressionText === 'queueMicrotask') {
+            return 'determinism/no-async-step';
+        }
+        if (expressionText === 'Promise' ||
+            expressionText === 'Promise.resolve' ||
+            expressionText === 'Promise.reject' ||
+            expressionText === 'Promise.all' ||
+            expressionText === 'Promise.allSettled' ||
+            expressionText === 'Promise.any' ||
+            expressionText === 'Promise.race') {
+            return 'determinism/no-async-step';
+        }
+        if (expressionText === 'fetch' || expressionText === 'WebSocket') {
+            return 'determinism/no-io';
+        }
+        if (expressionText === 'require') {
+            return 'determinism/no-commonjs-require';
+        }
+        if (expressionText === 'eval' || expressionText === 'Function') {
+            return 'determinism/no-dynamic-code';
+        }
+        if (expressionText === 'process.env') {
+            return 'determinism/no-process-env';
+        }
+        if (expressionText.startsWith('Intl.')) {
+            return 'determinism/no-intl-locale';
+        }
+        if (isLocaleSensitiveFormatter(expressionText)) {
+            return 'determinism/no-locale-format';
+        }
+        if (isFloatFormatter(expressionText)) {
+            return 'determinism/no-float-format';
+        }
+        if (expressionText === 'crypto.getRandomValues' || expressionText === 'crypto.randomUUID') {
+            return 'determinism/no-crypto-random';
+        }
+        return undefined;
+    }
+    function forbiddenNamespaceRoot(rawExpressionText) {
+        const expressionText = stripGlobalPrefix(rawExpressionText);
+        if (expressionText === 'Math') {
+            return 'Math';
+        }
+        if (expressionText === 'Date') {
+            return 'Date';
+        }
+        if (expressionText === 'performance') {
+            return 'performance';
+        }
+        if (expressionText === 'crypto') {
+            return 'crypto';
+        }
+        if (expressionText === 'Intl') {
+            return 'Intl';
+        }
+        if (expressionText === 'Reflect') {
+            return 'Reflect';
+        }
+        if (expressionText === 'globalThis' || rawExpressionText === 'globalThis') {
+            return 'globalThis';
+        }
+        if (rawExpressionText !== expressionText && expressionText === '') {
+            // A bare window/self/top/parent/frames reference is the same escape
+            // hatch as bare globalThis.
+            return 'globalThis';
+        }
+        return undefined;
+    }
+    function isNodeBuiltinSpecifier(specifier) {
+        const normalized = specifier.startsWith('node:') ? specifier.slice('node:'.length) : specifier;
+        const slashIndex = normalized.indexOf('/');
+        const rootSpecifier = slashIndex === -1 ? normalized : normalized.slice(0, slashIndex);
+        return nodeBuiltinSpecifiers.has(normalized) || nodeBuiltinSpecifiers.has(rootSpecifier);
+    }
+    function isFloatFormatter(expressionText) {
+        // toFixed/toPrecision half-way rounding has diverged across JS engines
+        // (Hermes-native vs V8-web both ship here) — the most likely accidental
+        // desync a creator introduces when quantizing state. The deterministic
+        // fixed-point helper is itself named toFixed (ctx.math.toFixed) — a
+        // `math`-suffixed receiver is that API, not Number.prototype.toFixed.
+        if (expressionText.endsWith('math.toFixed')) {
+            return false;
+        }
+        return expressionText.endsWith('.toFixed') || expressionText.endsWith('.toPrecision');
+    }
+    function isLocaleSensitiveFormatter(expressionText) {
+        return expressionText.endsWith('.toLocaleString')
+            || expressionText.endsWith('.toLocaleDateString')
+            || expressionText.endsWith('.toLocaleTimeString')
+            || expressionText.endsWith('.toLocaleLowerCase')
+            || expressionText.endsWith('.toLocaleUpperCase');
+    }
+    function isNativeCollectionIterationCall(node) {
+        if (!isDeterministicStepScope()) {
+            return false;
+        }
+        if (typescript.isPropertyAccessExpression(node.expression)) {
+            const methodName = node.expression.name.text;
+            if (methodName === 'keys' || methodName === 'values' || methodName === 'entries' || methodName === 'forEach') {
+                const collectionKind = nativeCollectionExpressionKind(node.expression.expression);
+                return collectionKind === 'Map' || collectionKind === 'Set';
+            }
+        }
+        const expressionText = normalizedExpressionText(node.expression);
+        if (expressionText === 'Array.from' || expressionText === 'globalThis.Array.from') {
+            const firstArgument = node.arguments[0];
+            if (firstArgument === undefined) {
+                return false;
+            }
+            const collectionKind = nativeCollectionExpressionKind(firstArgument);
+            return collectionKind === 'Map' || collectionKind === 'Set';
+        }
+        return false;
+    }
+    function isUnsafeNativeMathExpression(rawExpressionText) {
+        return unsafeNativeMathExpressions.has(stripGlobalPrefix(rawExpressionText));
+    }
+    function isAllowedCertificationTimerCall(expressionText) {
+        return stripGlobalPrefix(expressionText) === 'performance.now'
+            && functionStack.at(-1) === 'engineCompleteNowMs';
+    }
+    function functionName(node) {
+        if (typescript.isFunctionDeclaration(node) || typescript.isFunctionExpression(node)) {
+            return node.name?.text ?? '';
+        }
+        if (typescript.isMethodDeclaration(node)) {
+            return propertyNameText(node.name);
+        }
+        if (typescript.isVariableDeclaration(node.parent) && typescript.isIdentifier(node.parent.name)) {
+            return node.parent.name.text;
+        }
+        return '';
+    }
+    function propertyNameText(name) {
+        if (typescript.isIdentifier(name) ||
+            typescript.isStringLiteral(name) ||
+            typescript.isNumericLiteral(name) ||
+            typescript.isPrivateIdentifier(name)) {
+            return name.text;
+        }
+        return '';
+    }
+    function argumentContainsMathRandom(node) {
+        let found = false;
+        const scan = (candidate) => {
+            if (typescript.isCallExpression(candidate) &&
+                normalizedExpressionText(candidate.expression) === 'Math.random') {
+                found = true;
+                return;
+            }
+            typescript.forEachChild(candidate, scan);
+        };
+        scan(node);
+        return found;
+    }
+    function isKeyOrderStabilized(node) {
+        let current = node;
+        for (let depth = 0; depth < 8; depth += 1) {
+            const propertyAccess = current.parent;
+            if (!typescript.isPropertyAccessExpression(propertyAccess)) {
+                return false;
+            }
+            const call = propertyAccess.parent;
+            if (!typescript.isCallExpression(call)) {
+                return false;
+            }
+            if (propertyAccess.name.text === 'sort') {
+                return call.arguments.length > 0;
+            }
+            if (propertyAccess.name.text !== 'filter' && propertyAccess.name.text !== 'map') {
+                return false;
+            }
+            current = call;
+        }
+        return false;
+    }
+    function checkStateFieldAccess(node, stateFields) {
+        const ruleId = 'determinism/no-undeclared-state-field';
+        if (typescript.isPropertyAccessExpression(node) &&
+            typescript.isIdentifier(node.expression) &&
+            node.expression.text === schemaOptions.stateObjectName &&
+            !stateFields.has(node.name.text)) {
+            pushDiagnostic(node, ruleId, `State field ${node.name.text} is not declared in the deterministic state schema.`, 'Declare the field in descriptor.state.fields or keep it outside checksummed simulation state.');
+        }
+        if (typescript.isElementAccessExpression(node) &&
+            typescript.isIdentifier(node.expression) &&
+            node.expression.text === schemaOptions.stateObjectName &&
+            node.argumentExpression !== undefined &&
+            typescript.isStringLiteralLike(node.argumentExpression) &&
+            !stateFields.has(node.argumentExpression.text)) {
+            pushDiagnostic(node, ruleId, `State field ${node.argumentExpression.text} is not declared in the deterministic state schema.`, 'Declare the field in descriptor.state.fields or keep it outside checksummed simulation state.');
+        }
+    }
+    function normalizedExpressionText(node) {
+        if (typescript.isIdentifier(node)) {
+            return namespaceAliases.get(node.text) ?? node.text;
+        }
+        if (typescript.isPropertyAccessExpression(node)) {
+            return `${normalizedExpressionText(node.expression)}.${node.name.text}`;
+        }
+        if (typescript.isElementAccessExpression(node)) {
+            const key = literalPropertyName(node.argumentExpression);
+            return key === undefined ? node.getText(sourceFile) : `${normalizedExpressionText(node.expression)}.${key}`;
+        }
+        return node.getText(sourceFile);
+    }
+    function literalPropertyName(node) {
+        /* istanbul ignore next -- ElementAccessExpression argumentExpression is present for parseable element access. */
+        if (node === undefined) {
+            return undefined;
+        }
+        if (typescript.isStringLiteralLike(node)) {
+            return node.text;
+        }
+        return undefined;
+    }
+    function pushRule(node, ruleId) {
+        const rule = rules.find((candidate) => candidate.ruleId === ruleId);
+        /* istanbul ignore next -- internal callers pass rule ids from the static rule table. */
+        if (rule === undefined) {
+            return;
+        }
+        pushDiagnostic(node, rule.ruleId, rule.message, rule.suggestion, rule.severity);
+    }
+    function pushDiagnostic(node, ruleId, message, suggestion, defaultSeverity = 'error') {
+        const start = node.getStart(sourceFile);
+        const location = sourceFile.getLineAndCharacterOfPosition(start);
+        const line = location.line + 1;
+        const suppression = parseSuppression(getLine(content, line - 1), ruleId);
+        if (suppression === 'valid') {
+            return;
+        }
+        if (suppression === 'invalid') {
+            diagnostics.push({
+                ruleId: 'determinism/invalid-suppression',
+                severity: 'error',
+                path,
+                line,
+                column: 1,
+                message: 'Determinism suppression comments must name a rule and include a reason.',
+                suggestion: 'Use // rdm-ignore-next-line <rule-id>: <reason> directly above the suppressed line.',
+            });
+            return;
+        }
+        diagnostics.push({
+            ruleId,
+            severity: mode === 'strict' || defaultSeverity === 'error' ? 'error' : 'warn',
+            path,
+            line,
+            column: location.character + 1,
+            message,
+            suggestion,
+        });
+    }
+}
+function parseDiagnosticsToDeterminismDiagnostics(typescript, sourceFile, path) {
+    /* istanbul ignore next -- TypeScript SourceFile always exposes parseDiagnostics; fallback protects unusual host shims. */
+    const parseDiagnostics = sourceFile.parseDiagnostics ?? [];
+    return parseDiagnostics.map((diagnostic) => {
+        /* istanbul ignore next -- TypeScript parse diagnostics include start offsets for source-file syntax errors. */
+        const start = diagnostic.start ?? 0;
+        const position = sourceFile.getLineAndCharacterOfPosition(start);
+        const message = typescript.flattenDiagnosticMessageText(diagnostic.messageText, ' ');
+        return {
+            ruleId: 'determinism/syntax-error',
+            severity: 'error',
+            path,
+            line: position.line + 1,
+            column: position.character + 1,
+            message: `TypeScript syntax error: ${message}`,
+            suggestion: 'Fix the syntax error before certifying deterministic simulation code.',
+        };
+    });
+}
+function checkFileWithRegex(path, content, mode, schemaOptions) {
+    const diagnostics = [];
+    const lines = content.split(/\r?\n/);
+    lines.forEach((lineText, lineIndex) => {
+        const sourceLine = lineIndex + 1;
+        const checkableLineText = maskNonCodeText(lineText);
+        for (const rule of rules) {
+            rule.pattern.lastIndex = 0;
+            let match = rule.pattern.exec(checkableLineText);
+            while (match !== null) {
+                const suppression = parseSuppression(lines[lineIndex - 1], rule.ruleId);
+                if (suppression === 'valid') {
+                    match = rule.pattern.exec(checkableLineText);
+                    continue;
+                }
+                if (suppression === 'invalid') {
+                    diagnostics.push({
+                        ruleId: 'determinism/invalid-suppression',
+                        severity: 'error',
+                        path,
+                        line: sourceLine,
+                        column: 1,
+                        message: 'Determinism suppression comments must name a rule and include a reason.',
+                        suggestion: 'Use // rdm-ignore-next-line <rule-id>: <reason> directly above the suppressed line.',
+                    });
+                }
+                else {
+                    diagnostics.push({
+                        ruleId: rule.ruleId,
+                        severity: mode === 'strict' || rule.severity === 'error' ? 'error' : 'warn',
+                        path,
+                        line: sourceLine,
+                        column: match.index + 1,
+                        message: rule.message,
+                        suggestion: rule.suggestion,
+                    });
+                }
+                match = rule.pattern.exec(checkableLineText);
+            }
+        }
+        diagnostics.push(...checkDeclaredStateFields(path, checkableLineText, lines[lineIndex - 1], sourceLine, mode, schemaOptions));
+    });
+    return diagnostics;
+}
+function getLine(content, line) {
+    return content.split(/\r?\n/)[line - 1];
+}
+function isUncertifiedPhysicsReceiver(receiver) {
+    return receiver === 'world' || receiver === 'physicsWorld' || receiver === 'rapierWorld' || receiver === 'matterWorld';
+}
+function isRenderObjectReceiver(receiver) {
+    return receiver === 'scene' || receiver === 'mesh' || receiver === 'camera' || receiver === 'group' || receiver === 'object3D';
+}
+function createSchemaOptions(schemaStateFields, stateObjectName = 'state') {
+    return {
+        stateFields: schemaStateFields === undefined ? undefined : new Set(schemaStateFields),
+        stateObjectName,
+    };
+}
+function checkDeclaredStateFields(path, lineText, previousLine, sourceLine, mode, options) {
+    if (options.stateFields === undefined) {
+        return [];
+    }
+    const diagnostics = [];
+    const ruleId = 'determinism/no-undeclared-state-field';
+    const stateName = escapeRegExp(options.stateObjectName);
+    const dotPattern = new RegExp(`\\b${stateName}\\.([A-Za-z_$][A-Za-z0-9_$]*)`, 'g');
+    const bracketPattern = new RegExp(`\\b${stateName}\\s*\\[\\s*['"]([^'"]+)['"]\\s*\\]`, 'g');
+    const hasStateAccess = dotPattern.test(lineText) || bracketPattern.test(lineText);
+    dotPattern.lastIndex = 0;
+    bracketPattern.lastIndex = 0;
+    if (!hasStateAccess) {
+        return [];
+    }
+    const suppression = parseSuppression(previousLine, ruleId);
+    if (suppression === 'valid') {
+        return [];
+    }
+    if (suppression === 'invalid') {
+        diagnostics.push({
+            ruleId: 'determinism/invalid-suppression',
+            severity: 'error',
+            path,
+            line: sourceLine,
+            column: 1,
+            message: 'Determinism suppression comments must name a rule and include a reason.',
+            suggestion: 'Use // rdm-ignore-next-line <rule-id>: <reason> directly above the suppressed line.',
+        });
+        return diagnostics;
+    }
+    collectStateFieldDiagnostics(dotPattern, path, sourceLine, mode, options.stateFields, diagnostics);
+    collectStateFieldDiagnostics(bracketPattern, path, sourceLine, mode, options.stateFields, diagnostics);
+    return diagnostics;
+    function collectStateFieldDiagnostics(pattern, diagnosticPath, diagnosticLine, diagnosticMode, stateFields, target) {
+        let match = pattern.exec(lineText);
+        while (match !== null) {
+            const field = match[1];
+            if (!stateFields.has(field)) {
+                target.push({
+                    ruleId,
+                    severity: diagnosticMode === 'strict' ? 'error' : 'warn',
+                    path: diagnosticPath,
+                    line: diagnosticLine,
+                    column: match.index + 1,
+                    message: `State field ${field} is not declared in the deterministic state schema.`,
+                    suggestion: 'Declare the field in descriptor.state.fields or keep it outside checksummed simulation state.',
+                });
+            }
+            match = pattern.exec(lineText);
+        }
+    }
+}
+async function collectFiles(paths, followImports, project) {
+    const files = [];
+    const visited = new Set();
+    const resolver = await createImportResolver(project);
+    for (const path of paths) {
+        const entry = await (0, promises_1.stat)(path);
+        if (entry.isFile() && isCheckableFile(path)) {
+            if (followImports) {
+                files.push(...(await collectFileWithImports(path, visited, resolver)));
+            }
+            else {
+                files.push(path);
+            }
+        }
+        if (entry.isDirectory()) {
+            files.push(...(await collectDirectory(path)));
+        }
+    }
+    return Array.from(new Set(files)).sort();
+}
+async function collectDirectory(path) {
+    const files = [];
+    const entries = await (0, promises_1.readdir)(path);
+    for (const entry of entries) {
+        if (entry === 'node_modules' || entry === 'dist' || entry === 'artifacts') {
+            continue;
+        }
+        const childPath = `${path}/${entry}`;
+        const child = await (0, promises_1.stat)(childPath);
+        if (child.isDirectory()) {
+            files.push(...(await collectDirectory(childPath)));
+        }
+        else if (child.isFile() && isCheckableFile(childPath)) {
+            files.push(childPath);
+        }
+    }
+    return files;
+}
+function isCheckableFile(path) {
+    return /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(path);
+}
+async function collectFileWithImports(path, visited, resolver) {
+    const absolutePath = (0, node_path_1.resolve)(path);
+    if (visited.has(absolutePath)) {
+        return [];
+    }
+    visited.add(absolutePath);
+    const files = [path];
+    const content = await (0, promises_1.readFile)(path, 'utf8');
+    for (const specifier of findStaticImportSpecifiers(content)) {
+        const resolvedPath = await resolver.resolve(path, specifier);
+        if (resolvedPath !== undefined) {
+            files.push(...(await collectFileWithImports(resolvedPath, visited, resolver)));
+        }
+    }
+    return files;
+}
+function findStaticImportSpecifiers(content) {
+    const specifiers = [];
+    const importPattern = /^\s*(?:import|export)\s+(?:[^'"]*?\s+from\s+)?['"]([^'"]+)['"]/gm;
+    let match = importPattern.exec(content);
+    while (match !== null) {
+        specifiers.push(match[1]);
+        match = importPattern.exec(content);
+    }
+    return specifiers;
+}
+async function createImportResolver(project) {
+    const relativeResolver = {
+        resolve(containingFile, specifier) {
+            if (!specifier.startsWith('.') && !specifier.startsWith('/')) {
+                return Promise.resolve(undefined);
+            }
+            return resolveImportPath((0, node_path_1.dirname)(containingFile), specifier);
+        },
+    };
+    if (project === undefined) {
+        return relativeResolver;
+    }
+    const typescript = requireModule('typescript');
+    const projectPath = (0, node_path_1.resolve)(project);
+    const config = typescript.readConfigFile(projectPath, typescript.sys.readFile);
+    if (config.error !== undefined) {
+        const message = typescript.flattenDiagnosticMessageText(config.error.messageText, '\n');
+        throw new Error(`Unable to read deterministic project ${projectPath}: ${message}`);
+    }
+    const parsed = typescript.parseJsonConfigFileContent(config.config, typescript.sys, (0, node_path_1.dirname)(projectPath));
+    const compilerOptions = parsed.options;
+    const host = typescript.createCompilerHost(compilerOptions, true);
+    return {
+        async resolve(containingFile, specifier) {
+            const resolved = typescript.resolveModuleName(specifier, (0, node_path_1.resolve)(containingFile), compilerOptions, host).resolvedModule;
+            if (resolved !== undefined && !resolved.isExternalLibraryImport && isCheckableFile(resolved.resolvedFileName)) {
+                return resolved.resolvedFileName;
+            }
+            return relativeResolver.resolve(containingFile, specifier);
+        },
+    };
+}
+async function resolveImportPath(baseDirectory, specifier) {
+    const candidate = (0, node_path_1.resolve)(baseDirectory, specifier);
+    const sourceCandidate = candidate.replace(/\.(js|jsx|mjs|cjs)$/, '');
+    const paths = [
+        candidate,
+        `${sourceCandidate}.ts`,
+        `${sourceCandidate}.tsx`,
+        `${candidate}.ts`,
+        `${candidate}.tsx`,
+        `${candidate}.js`,
+        `${candidate}.jsx`,
+        `${candidate}.mjs`,
+        `${candidate}.cjs`,
+        `${candidate}/index.ts`,
+        `${candidate}/index.tsx`,
+        `${candidate}/index.js`,
+        `${candidate}/index.jsx`,
+    ];
+    for (const path of paths) {
+        try {
+            const entry = await (0, promises_1.stat)(path);
+            if (entry.isFile() && isCheckableFile(path)) {
+                return path;
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    return undefined;
+}
+function parseSuppression(previousLine, ruleId) {
+    if (previousLine === undefined || !previousLine.includes('rdm-ignore-next-line')) {
+        return 'none';
+    }
+    const suppression = parseSuppressionComment(previousLine);
+    if (suppression === undefined || suppression.ruleId !== ruleId || suppression.reason.length < 8) {
+        return 'invalid';
+    }
+    return 'valid';
+}
+function parseSuppressionDetails(line) {
+    if (!line.includes('rdm-ignore-next-line')) {
+        return undefined;
+    }
+    const suppression = parseSuppressionComment(line);
+    if (suppression === undefined || suppression.reason.length < 8) {
+        return undefined;
+    }
+    return suppression;
+}
+function parseSuppressionComment(line) {
+    const markerIndex = line.indexOf('rdm-ignore-next-line');
+    let cursor = markerIndex + 'rdm-ignore-next-line'.length;
+    while (cursor < line.length && isInlineWhitespace(line[cursor])) {
+        cursor += 1;
+    }
+    const ruleStart = cursor;
+    while (cursor < line.length && !isInlineWhitespace(line[cursor]) && line[cursor] !== ':') {
+        cursor += 1;
+    }
+    const ruleId = line.slice(ruleStart, cursor);
+    while (cursor < line.length && isInlineWhitespace(line[cursor])) {
+        cursor += 1;
+    }
+    if (ruleId.length === 0 || line[cursor] !== ':') {
+        return undefined;
+    }
+    const reason = line.slice(cursor + 1).trim();
+    return { ruleId, reason };
+}
+function isInlineWhitespace(value) {
+    return value === ' ' || value === '\t';
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function maskNonCodeText(lineText) {
+    let result = '';
+    let quote;
+    let escaped = false;
+    for (let index = 0; index < lineText.length; index += 1) {
+        const char = lineText[index];
+        const next = lineText[index + 1];
+        if (quote === undefined && char === '/' && next === '/') {
+            return `${result}${' '.repeat(lineText.length - result.length)}`;
+        }
+        if (quote === undefined && (char === '"' || char === "'" || char === '`')) {
+            quote = char;
+            result += ' ';
+            continue;
+        }
+        if (quote !== undefined) {
+            result += ' ';
+            if (escaped) {
+                escaped = false;
+                continue;
+            }
+            if (char === '\\') {
+                escaped = true;
+                continue;
+            }
+            if (char === quote) {
+                quote = undefined;
+            }
+            continue;
+        }
+        result += char;
+    }
+    return result;
+}