@ttsc/lint 0.30.4 → 0.31.0

package/lib/index.js

@@ -17,2650 +17,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TTSX_EXTRACTOR_SCRIPT = void 0;
-exports.default = createTtscPlugin;
-const node_buffer_1 = require("node:buffer");
-const node_child_process_1 = require("node:child_process");
-const node_crypto_1 = require("node:crypto");
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_module_1 = require("node:module");
-const node_os_1 = __importDefault(require("node:os"));
-const node_path_1 = __importDefault(require("node:path"));
-const node_url_1 = require("node:url");
-const configEvaluatorFailure_1 = require("./internal/configEvaluatorFailure");
+exports.TTSX_EXTRACTOR_SCRIPT = exports.default = void 0;
+var createTtscPlugin_1 = require("./createTtscPlugin");
+Object.defineProperty(exports, "default", { enumerable: true, get: function () { return __importDefault(createTtscPlugin_1).default; } });
+Object.defineProperty(exports, "TTSX_EXTRACTOR_SCRIPT", { enumerable: true, get: function () { return createTtscPlugin_1.TTSX_EXTRACTOR_SCRIPT; } });
 __exportStar(require("./defaultFormat"), exports);
 __exportStar(require("./structures/index"), exports);
-// Namespace becomes the rule-name prefix (`<ns>/<rule>`). Mirrors ESLint
-// plugin namespace conventions: lowercase ASCII, digits, hyphens, and
-// underscores; leading character must be alphabetic so the prefix never
-// collides with a rule name that itself starts with a digit. Hyphens
-// are encoded into underscores for the Go sub-package name (see
-// `goSubpackageName`); the user-facing prefix keeps the original form.
-const NAMESPACE_PATTERN = /^[a-z][a-z0-9_-]*$/;
-/**
- * Map a user-facing namespace (`react-hooks`) to a Go-valid sub-package name
- * (`react_hooks`). Required because ttsc's plugin builder uses the `name` field
- * as a directory and import-path suffix, both of which must satisfy Go's
- * stricter `[a-z][a-z0-9_]*` identifier rules. The function is total over
- * namespaces that already passed `NAMESPACE_PATTERN`.
- */
-function goSubpackageName(namespace) {
-    return namespace.replace(/-/g, "_");
-}
-const LINT_CONFIG_FILENAMES = [
-    "lint.config.json",
-    "lint.config.js",
-    "lint.config.mjs",
-    "lint.config.cjs",
-    "lint.config.ts",
-    "lint.config.mts",
-    "lint.config.cts",
-    "ttsc-lint.config.json",
-    "ttsc-lint.config.js",
-    "ttsc-lint.config.mjs",
-    "ttsc-lint.config.cjs",
-    "ttsc-lint.config.ts",
-    "ttsc-lint.config.mts",
-    "ttsc-lint.config.cts",
-];
-/**
- * Tsconfig plugin-entry keys owned by the ttsc host framework. They are
- * accepted alongside the single lint-specific `configFile` key; every other key
- * is rejected so a stale inline option (`rules`, `format`, `extends`, legacy
- * `config`, `plugins`) surfaces as a clear migration error instead of being
- * silently ignored. Mirrors `@ttsc/banner` and `@ttsc/strip`.
- */
-const FRAMEWORK_KEYS = new Set([
-    "enabled",
-    "name",
-    "stage",
-    "transform",
-]);
-/**
- * Plugin descriptor factory consumed by ttsc package discovery.
- *
- * Contributor lint plugins come from one place: the project's lint config file
- * (`lint.config.{ts,cts,mts,js,cjs,mjs,json}` or `ttsc-lint.config.*`). The
- * tsconfig plugin entry carries no rule or plugin surface — it optionally names
- * the config file via `configFile`, otherwise the file is discovered by walking
- * upward from the tsconfig directory (or from the caller-declared
- * `pluginConfigDir` when the resolved tsconfig is a generated wrapper in a temp
- * directory).
- *
- * The factory locates the config file, evaluates it (via ttsx for TS / ESM
- * sources, `require` for CommonJS, `JSON.parse` for JSON), reads every
- * `plugins` map (top-level and inside array-form flat configs), and forwards
- * each contributor's Go source directory to ttsc's plugin builder via the
- * descriptor's `contributors` field.
- */
-function createTtscPlugin(context) {
-    rejectUnsupportedEntryKeys(context.plugin);
-    const resolvedConfig = resolveConfigFileContributors(context);
-    // Build the descriptor without a `contributors` key when none were
-    // declared, so consumers (and the existing key-shape regression
-    // tests) see the same surface as before this feature shipped.
-    const descriptor = {
-        capabilities: {
-            diagnosticsTiming: true,
-            graphNodes: true,
-            lsp: true,
-            projectContextArgs: true,
-            projectDiagnostics: true,
-            projectInputs: true,
-            residentCheck: true,
-            threadingArgs: true,
-        },
-        hostInputHashes: resolvedConfig.hostInputHashes,
-        hostInputRealpaths: resolvedConfig.hostInputRealpaths,
-        hostInputs: resolvedConfig.hostInputs,
-        name: "@ttsc/lint",
-        reportsTypeScriptDiagnostics: true,
-        // `context.dirname` is this descriptor's own directory in every load mode —
-        // the ESM-safe replacement for `__dirname`, which is undefined when ttsc
-        // loads a descriptor as `.ts` source or ESM.
-        source: node_path_1.default.resolve(context.dirname, "..", "plugin"),
-        stage: "check",
-    };
-    if (resolvedConfig.contributors.length > 0) {
-        descriptor.contributors = resolvedConfig.contributors;
-    }
-    return descriptor;
-}
-function loadContributorPluginViaRequire(specifier, context, namespace, anchorFile) {
-    // Resolve relative paths and node_modules lookups from the file that
-    // declared the specifier, when one is available — `lint.config.json`
-    // / `lint.config.cjs` reach this code with their own path on disk,
-    // and ttsc's tsconfig plugin entry falls back to the project root.
-    const anchor = anchorFile ??
-        node_path_1.default.join(node_path_1.default.resolve(context.cwd ?? context.projectRoot), "__lint_contributor_resolve__.cjs");
-    const requireFromProject = (0, node_module_1.createRequire)(anchor);
-    let resolved;
-    try {
-        resolved = requireFromProject.resolve(specifier);
-    }
-    catch (error) {
-        throw new Error(`@ttsc/lint: failed to resolve contributor "${namespace}" via "${specifier}": ${error instanceof Error ? error.message : String(error)}`);
-    }
-    let mod;
-    try {
-        mod = requireFromProject(resolved);
-    }
-    catch (error) {
-        throw new Error(`@ttsc/lint: failed to load contributor "${namespace}" from ${resolved}: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    return validatePluginShape(unwrapDefault(mod), namespace, resolved);
-}
-/**
- * Resolves the contributor lint plugins declared in the project's lint config
- * file.
- *
- * - When the tsconfig plugin entry sets `configFile`, that exact file is loaded
- *   (relative paths resolve against the tsconfig directory, or against the
- *   caller-declared `pluginConfigDir` when present).
- * - Otherwise a `lint.config.*` / `ttsc-lint.config.*` file is discovered by
- *   walking upward from the tsconfig directory (or from `pluginConfigDir` when
- *   present).
- *
- * Returns an empty array when no config file is set or discovered — the Go
- * sidecar surfaces the missing-config error; the factory only needs to forward
- * contributors when a config file is present.
- */
-function resolveConfigFileContributors(context) {
-    const configFile = readConfigFileOption(context);
-    const explicitConfigPath = configFile === undefined
-        ? undefined
-        : node_path_1.default.resolve(pluginConfigBaseDir(context), configFile);
-    const discovery = explicitConfigPath === undefined
-        ? discoverLintConfigFile(context)
-        : {
-            configPath: explicitConfigPath,
-            hostInputHashes: hashHostInputPaths([explicitConfigPath]),
-            hostInputRealpaths: realpathHostInputPaths([explicitConfigPath]),
-            hostInputs: [explicitConfigPath],
-        };
-    const { configPath } = discovery;
-    if (!configPath || !node_fs_1.default.existsSync(configPath)) {
-        return {
-            contributors: [],
-            hostInputHashes: discovery.hostInputHashes,
-            hostInputRealpaths: discovery.hostInputRealpaths,
-            hostInputs: discovery.hostInputs,
-        };
-    }
-    const evaluation = readConfigPluginEntries(configPath, context);
-    const entries = evaluation.entries;
-    assertContributorNamespacesDoNotCollide(entries, configPath);
-    // Dedup exact repeated namespaces on the Go-subpackage form. Config-array
-    // folding can surface the same namespace more than once; that existing
-    // behavior stays intact after distinct namespaces are rejected above.
-    const occupied = new Set();
-    const out = [];
-    for (const entry of entries) {
-        const goName = goSubpackageName(entry.namespace);
-        if (occupied.has(goName))
-            continue;
-        occupied.add(goName);
-        out.push({ name: goName, source: entry.source });
-    }
-    const dependencyInputs = evaluation.dependencies
-        .filter((dependency) => dependency.scope === "watch" && dependency.kind !== "directory")
-        .map((dependency) => dependency.path);
-    const hostInputHashes = { ...discovery.hostInputHashes };
-    const hostInputRealpaths = { ...discovery.hostInputRealpaths };
-    const unstableRealpaths = new Set();
-    const unprovenInputs = new Set();
-    const missingOptionalDigest = (0, node_crypto_1.createHash)("sha256")
-        .update("missing\0")
-        .digest("hex");
-    const directoryCandidateDigest = (0, node_crypto_1.createHash)("sha256")
-        .update("ttsc:host-input:directory\0")
-        .digest("hex");
-    for (const dependency of evaluation.dependencies) {
-        if (dependency.scope !== "watch" || dependency.kind === "directory") {
-            continue;
-        }
-        const input = node_path_1.default.resolve(dependency.path);
-        const realpath = dependency.realpath;
-        if (!dependency.identityStable) {
-            delete hostInputRealpaths[input];
-            delete hostInputHashes[input];
-            unstableRealpaths.add(input);
-            unprovenInputs.add(input);
-            continue;
-        }
-        if (Object.prototype.hasOwnProperty.call(hostInputRealpaths, input) &&
-            hostInputRealpaths[input] !== realpath) {
-            delete hostInputRealpaths[input];
-            delete hostInputHashes[input];
-            unstableRealpaths.add(input);
-        }
-        else if (!unstableRealpaths.has(input)) {
-            hostInputRealpaths[input] = realpath;
-        }
-        let hash;
-        if (dependency.kind === "file" &&
-            /^[0-9a-f]{64}$/.test(dependency.digest)) {
-            hash = dependency.digest;
-        }
-        else if (dependency.digest === missingOptionalDigest) {
-            // The evaluator's optional-file digest includes a state prefix. The
-            // public host-input contract uses null for the observed missing state.
-            hash = null;
-        }
-        else if (dependency.digest === directoryCandidateDigest) {
-            // A path that is currently a directory is still an exact file candidate:
-            // replacing it with a file changes module/config selection.
-            hash = directoryCandidateDigest;
-        }
-        if (hash === undefined) {
-            delete hostInputHashes[input];
-            unprovenInputs.add(input);
-        }
-        else if (unprovenInputs.has(input)) {
-            // A later observation cannot revive proof another evaluation stage
-            // could not provide for the same combined descriptor result.
-        }
-        else if (Object.prototype.hasOwnProperty.call(hostInputHashes, input) &&
-            hostInputHashes[input] !== hash) {
-            delete hostInputHashes[input];
-            unprovenInputs.add(input);
-        }
-        else {
-            hostInputHashes[input] = hash;
-        }
-    }
-    return {
-        contributors: out,
-        hostInputHashes,
-        hostInputRealpaths,
-        hostInputs: [...discovery.hostInputs, ...dependencyInputs],
-    };
-}
-/** Snapshot config candidates before any discovery/evaluation side effect. */
-function hashHostInputPaths(inputs) {
-    return Object.fromEntries(inputs.map((input) => {
-        const file = node_path_1.default.resolve(input);
-        try {
-            if (node_fs_1.default.statSync(file).isDirectory()) {
-                return [
-                    file,
-                    (0, node_crypto_1.createHash)("sha256")
-                        .update("ttsc:host-input:directory\0")
-                        .digest("hex"),
-                ];
-            }
-            return [
-                file,
-                (0, node_crypto_1.createHash)("sha256").update(node_fs_1.default.readFileSync(file)).digest("hex"),
-            ];
-        }
-        catch {
-            return [file, null];
-        }
-    }));
-}
-function hostInputRealpath(file) {
-    try {
-        return node_fs_1.default.realpathSync.native(file);
-    }
-    catch {
-        return null;
-    }
-}
-function realpathHostInputPaths(inputs) {
-    return Object.fromEntries(inputs.map((input) => {
-        const file = node_path_1.default.resolve(input);
-        return [file, hostInputRealpath(file)];
-    }));
-}
-/** Mirror native discovery and fingerprint every candidate before selecting. */
-function discoverLintConfigFile(context) {
-    const hostInputHashes = {};
-    const hostInputRealpaths = {};
-    const hostInputs = [];
-    const recordCandidates = (candidates) => {
-        for (const candidate of candidates) {
-            const absolute = node_path_1.default.resolve(candidate);
-            if (Object.prototype.hasOwnProperty.call(hostInputHashes, absolute)) {
-                continue;
-            }
-            hostInputs.push(absolute);
-            Object.assign(hostInputHashes, hashHostInputPaths([absolute]));
-            Object.assign(hostInputRealpaths, realpathHostInputPaths([absolute]));
-        }
-    };
-    for (const origin of discoveryConfigBaseDirs(context)) {
-        for (let directory = origin;; directory = node_path_1.default.dirname(directory)) {
-            const candidates = LINT_CONFIG_FILENAMES.map((name) => node_path_1.default.join(directory, name));
-            recordCandidates(candidates);
-            const matches = lintConfigMatchesIn(directory);
-            if (matches.length === 1) {
-                return {
-                    configPath: matches[0],
-                    hostInputHashes,
-                    hostInputRealpaths,
-                    hostInputs,
-                };
-            }
-            if (matches.length > 1) {
-                throw new Error(`@ttsc/lint: multiple lint config files found in ${directory} (${matches
-                    .map((file) => node_path_1.default.basename(file))
-                    .join(", ")}); set "configFile" explicitly`);
-            }
-            const parent = node_path_1.default.dirname(directory);
-            if (parent === directory)
-                break;
-        }
-    }
-    return { hostInputHashes, hostInputRealpaths, hostInputs };
-}
-function assertContributorNamespacesDoNotCollide(entries, configPath) {
-    const namespacesByGoName = new Map();
-    for (const entry of entries) {
-        const goName = goSubpackageName(entry.namespace);
-        let namespaces = namespacesByGoName.get(goName);
-        if (namespaces === undefined) {
-            namespaces = new Set();
-            namespacesByGoName.set(goName, namespaces);
-        }
-        namespaces.add(entry.namespace);
-    }
-    const collisions = [...namespacesByGoName]
-        .map(([goName, namespaces]) => [goName, [...namespaces].sort()])
-        .filter(([, namespaces]) => namespaces.length > 1)
-        .sort(([left], [right]) => left.localeCompare(right));
-    if (collisions.length === 0)
-        return;
-    const details = collisions
-        .map(([goName, namespaces]) => `${namespaces.map((namespace) => JSON.stringify(namespace)).join(", ")} all normalize to ${JSON.stringify(goName)}`)
-        .join("; ");
-    throw new Error(`@ttsc/lint: lint config ${configPath} contributor namespaces collide after Go normalization: ${details}`);
-}
-/**
- * Rejects any tsconfig plugin-entry key that is neither a host framework key
- * nor the single lint-specific `configFile` key. Rule, format, and plugin
- * settings live only in the lint config file, so a leftover inline key is
- * surfaced as an explicit migration error rather than silently ignored.
- */
-function rejectUnsupportedEntryKeys(entry) {
-    for (const key of Object.keys(entry)) {
-        if (FRAMEWORK_KEYS.has(key) || key === "configFile") {
-            continue;
-        }
-        throw new Error(`@ttsc/lint: tsconfig plugin entry contains unsupported key ${JSON.stringify(key)}. ` +
-            `Rules, format, and plugin settings must live in a ` +
-            `lint.config.{ts,cts,mts,js,cjs,mjs,json} file. The only accepted key ` +
-            `in the tsconfig entry is "configFile" (optional path to the config file).`);
-    }
-}
-/**
- * Reads the optional `configFile` key from the tsconfig plugin entry. It is the
- * only lint-specific key the entry accepts; when present it overrides
- * auto-discovery of the lint config file.
- */
-function readConfigFileOption(context) {
-    const value = context.plugin.configFile;
-    if (value === undefined)
-        return undefined;
-    if (typeof value !== "string" || value.length === 0) {
-        throw new Error(`@ttsc/lint: "configFile" must be a non-empty string path`);
-    }
-    return value;
-}
-function discoveryConfigBaseDirs(context) {
-    if (context.pluginConfigDir) {
-        return [node_path_1.default.resolve(context.cwd ?? ".", context.pluginConfigDir)];
-    }
-    const tsconfigDir = tsconfigBaseDir(context);
-    const cwd = node_path_1.default.resolve(context.cwd ?? context.projectRoot);
-    return tsconfigDir === cwd ? [tsconfigDir] : [tsconfigDir, cwd];
-}
-/** Return the non-directory candidates native discovery recognizes. */
-function lintConfigMatchesIn(directory) {
-    const matches = [];
-    for (const name of LINT_CONFIG_FILENAMES) {
-        const candidate = node_path_1.default.join(directory, name);
-        try {
-            // Go's os.Stat follows symlinks and junctions. Follow them here too so a
-            // directory or dangling link cannot stop descriptor discovery before
-            // the native host reaches a valid ancestor config. Probing the canonical
-            // candidate spelling also preserves Go's behavior on case-insensitive
-            // filesystems when the directory entry uses different casing.
-            if (!node_fs_1.default.statSync(candidate).isDirectory())
-                matches.push(candidate);
-        }
-        catch {
-            // Missing, dangling, and unreadable candidates are not native matches.
-        }
-    }
-    return matches;
-}
-/**
- * Base directory for resolving a relative `configFile` from the tsconfig plugin
- * entry. Mirrors the Go side (driver.PluginConfigBaseDir): the caller-declared
- * pluginConfigDir wins when present — the resolved tsconfig is then a generated
- * wrapper in a temp directory that no longer identifies the project — otherwise
- * the tsconfig directory, falling back to the working directory.
- */
-function pluginConfigBaseDir(context) {
-    if (context.pluginConfigDir) {
-        return node_path_1.default.resolve(context.cwd ?? ".", context.pluginConfigDir);
-    }
-    return tsconfigBaseDir(context);
-}
-function tsconfigBaseDir(context) {
-    const cwd = context.cwd ?? context.projectRoot;
-    if (context.tsconfig) {
-        return node_path_1.default.dirname(node_path_1.default.isAbsolute(context.tsconfig)
-            ? context.tsconfig
-            : node_path_1.default.join(cwd, context.tsconfig));
-    }
-    return node_path_1.default.resolve(cwd);
-}
-function readConfigPluginEntries(configPath, context) {
-    // A JSON config that can bring no contributor with it — no `plugins` map and
-    // no `extends` chain to follow — has nothing to extract, and reading it runs
-    // no user code, so the isolated evaluator is not needed to keep its strings
-    // away from stdout. Skipping it there matters beyond the cost: the evaluator
-    // is a real subprocess, and a host that only wanted to know whether there
-    // were contributors would otherwise depend on a launcher being resolvable and
-    // on a compiler accepting one more invocation.
-    if (jsonConfigDeclaresNoContributor(configPath)) {
-        return { dependencies: [], entries: [] };
-    }
-    // Every other config uses the same isolated evaluator. Executable config can
-    // name contributor packages whose top-level code writes to stdout, so loading
-    // it in this host process would corrupt CLI JSON or preface the first LSP
-    // frame.
-    return readTtsxConfigPlugins(configPath, context);
-}
-function jsonConfigDeclaresNoContributor(configPath) {
-    if (node_path_1.default.extname(configPath).toLowerCase() !== ".json")
-        return false;
-    try {
-        const value = JSON.parse(node_fs_1.default.readFileSync(configPath, "utf8"));
-        return !configMayDeclareContributor(value);
-    }
-    catch {
-        // A malformed config is the evaluator's diagnostic to report, not this
-        // shortcut's, so it falls through to the path that reports it.
-        return false;
-    }
-}
-/**
- * Whether any object in a config could still bring a contributor with it.
- *
- * A `plugins` map names one directly. An `extends` chain names one indirectly:
- * the base it points at may be executable and may declare contributors of its
- * own, and following that chain is the evaluator's job. Treating a config that
- * extends anything as undecidable here is what keeps this shortcut from
- * silently dropping a contributor the base would have supplied.
- */
-function configMayDeclareContributor(value) {
-    if (Array.isArray(value)) {
-        return value.some((entry) => configMayDeclareContributor(entry));
-    }
-    if (value === null || typeof value !== "object")
-        return false;
-    const record = value;
-    for (const key of ["plugins", "extends"]) {
-        const declared = record[key];
-        if (declared !== undefined && declared !== null)
-            return true;
-    }
-    return false;
-}
-// TypeScript source written to a temp file and executed via ttsx. The
-// %CONFIG_IMPORT% placeholder is replaced with a JSON-quoted file URL
-// before the file hits disk. The script walks the exported config object,
-// collects every `plugins` map, and serialises each plugin's `source` field
-// as a JSON array for the parent process to parse — avoiding the need to
-// serialise arbitrary in-memory plugin objects across the process boundary.
-// The URL lives in a variable so tsgo does not statically resolve it.
-/**
- * The descriptor extractor's emitted source.
- *
- * Exported so a regression can inspect the same bytes the loader executes. The
- * template consumes its own escapes, so reading this file's text instead would
- * check characters no consumer ever sees.
- */
-exports.TTSX_EXTRACTOR_SCRIPT = `// @ts-ignore -- internal loader must not require user-installed Node typings.
-import * as fs from "node:fs";
-// @ts-ignore -- internal loader must not require user-installed Node typings.
-import { Buffer } from "node:buffer";
-// @ts-ignore -- internal loader must not require user-installed Node typings.
-import { createHash } from "node:crypto";
-// @ts-ignore -- internal loader must not require user-installed Node typings.
-import { createRequire, registerHooks } from "node:module";
-// @ts-ignore -- internal loader must not require user-installed Node typings.
-import * as path from "node:path";
-// @ts-ignore -- internal loader must not require user-installed Node typings.
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-const configUrl = %CONFIG_IMPORT%;
-const outputPath = %CONFIG_OUTPUT%;
-const resolutionRoot = path.resolve(%CONFIG_ROOT%);
-const requireFromConfig = createRequire(configUrl);
-const CONFIG_KEYS = new Set<string>([
-  "files",
-  "ignores",
-  "extends",
-  "plugins",
-  "rules",
-  "format",
-]);
-const dependencies = new Map<string, {
-  digest: string;
-  identityStable: boolean;
-  kind: "directory" | "file" | "optional-file";
-  path: string;
-  owners: Set<string>;
-  realpath: string | null;
-}>();
-const graphNodes = new Map<string, string>();
-const graphEdges: Array<{
-  child: string;
-  packageBoundary: boolean;
-  parent: string;
-}> = [];
-const configLocation = fileURLToPath(configUrl);
-// Every spelling of this config the module system might key an edge under.
-//
-// Which one it uses is not knowable from here, and guessing has failed in both
-// directions. A path handed in by another producer can be escaped by a rule
-// Node does not share. Node respells a resolved file module through its real
-// path unless "--preserve-symlinks" is set, so a config reached through a
-// symlinked directory is keyed by its target. And a Windows 8.3 short name is
-// not a symlink: fs.realpathSync expands it, the module resolver does not, so
-// asking the volume there produces a spelling no edge carries.
-//
-// A seed that names a URL no edge was keyed under sits on a node with no
-// outgoing edges, the walk ends immediately, and every dependency recorded
-// after the first import is demoted from watch to cache. That failure is
-// silent: the build still succeeds and simply stops reacting. Seeding every
-// spelling costs one extra queue entry and cannot be wrong.
-const configUrlSpellings = [
-  ...new Set([
-    configUrl,
-    pathToFileURL(configLocation).href,
-    pathToFileURL(realConfigLocation()).href,
-  ]),
-];
-const moduleProbeExtensions = [
-  ".ts",
-  ".tsx",
-  ".mts",
-  ".cts",
-  ".js",
-  ".mjs",
-  ".cjs",
-  ".json",
-  ".node",
-] as const;
-const jsToTsProbeExtensions = new Map<string, readonly string[]>([
-  [".js", [".ts", ".tsx"]],
-  [".jsx", [".tsx"]],
-  [".mjs", [".mts"]],
-  [".cjs", [".cts"]],
-]);
-for (const spelling of configUrlSpellings) {
-  graphNodes.set(spelling, configLocation);
-}
-recordDependency(
-  "file",
-  configLocation,
-  createHash("sha256").update(fs.readFileSync(configLocation)).digest("hex"),
-  configUrlSpellings,
-);
-recordPackageManifests(configLocation, configUrlSpellings);
-
-declare const process: {
-  cwd(): string;
-  platform: string;
-  stdout: { write(value: string): void };
-  stderr: { write(value: string): void };
-  exit(code?: number): never;
-};
-
-const hooks = registerHooks({
-  resolve(specifier, context, nextResolve) {
-    const requestedParent =
-      context.parentURL && new URL(context.parentURL).href;
-    if (requestedParent !== undefined && graphNodes.has(requestedParent)) {
-      recordLocalResolutionCandidates(specifier, requestedParent);
-    }
-    const resolved = nextResolve(specifier, context);
-    if (typeof resolved.url !== "string" || !resolved.url.startsWith("file:")) {
-      return resolved;
-    }
-    const url = new URL(resolved.url).href;
-    const parent = context.parentURL && new URL(context.parentURL).href;
-    const location = fileURLToPath(url);
-    // The entry is recognized by what was asked for, not only by what came
-    // back. A module URL is assigned by whoever loaded it: a compiling loader
-    // can serve the config from its emitted output, and a platform can hand
-    // back a different spelling of the same file. Either way the URL bears no
-    // resemblance to the one this process was given, so the config's own
-    // imports would be rejected here — their parent is a URL no node was
-    // recorded under — and the graph would collapse to the records made before
-    // the first import. The request itself is unambiguous, so it decides.
-    const entry =
-      specifier === configUrl ||
-      url === new URL(configUrl).href ||
-      samePhysicalPath(location, configLocation);
-    if (!entry && (parent === undefined || !graphNodes.has(parent))) {
-      return resolved;
-    }
-    graphNodes.set(url, location);
-    if (parent !== undefined) {
-      graphEdges.push({
-        child: url,
-        packageBoundary:
-          pathHasNodeModules(location) && !isLocalModuleSpecifier(specifier),
-        parent,
-      });
-      recordResolutionTopology(
-        specifier,
-        parent,
-        url,
-        location,
-        context.conditions,
-      );
-    }
-    try {
-      recordDependency(
-        "file",
-        location,
-        createHash("sha256").update(fs.readFileSync(location)).digest("hex"),
-        [url],
-      );
-    } catch {
-      // The evaluator remains authoritative for the load error. An unreadable
-      // dependency simply makes this result non-cacheable in the parent.
-      recordDependency("file", location, "", [url]);
-    }
-    return resolved;
-  },
-});
-
-// Wrapped and settled explicitly rather than written as a top-level await.
-// The loader tsconfig's "module" now follows the config's own package, and
-// TS1378 rejects top-level await under a CommonJS module option however this
-// .mts file emits. The trailing catch is what a top-level await gave for
-// free: without it a throw from the finally would leave the promise
-// unsettled instead of failing the load.
-(async () => {
-  try {
-    const importedConfig = configLocation.toLowerCase().endsWith(".json")
-      ? JSON.parse(fs.readFileSync(configLocation, "utf8").replace(/^\uFEFF/, ""))
-      : await import(configUrl);
-    const current = await resolveConfig(importedConfig, true);
-    const pluginMaps = collectPluginObjects(current);
-    const entries: Array<{ namespace: string; source: string }> = [];
-    for (const map of pluginMaps) {
-      for (const [namespace, value] of Object.entries(map)) {
-        const source = extractPluginSource(value);
-        if (source === undefined || source.length === 0) {
-          throw new Error(
-            \`contributor \${JSON.stringify(namespace)} must resolve to an object with a non-empty "source" string\`,
-          );
-        }
-        entries.push({ namespace, source });
-      }
-    }
-    fs.writeFileSync(outputPath, JSON.stringify({
-      dependencies: finalizeDependencies(),
-      entries,
-    }), "utf8");
-  } catch (error) {
-    reportLoaderFailure(error);
-  } finally {
-    hooks.deregister();
-  }
-})().catch((error) => {
-  // Reached only when the finally above throws: the catch already ends the
-  // process, so this is the deregistration's own failure, not the config's.
-  reportLoaderFailure(error);
-});
-
-// reportLoaderFailure ends this loader on an error it can name, on both of the
-// channels the parent uses.
-//
-// The stack is for a reader and streams to stderr as it is written. The reason
-// is a fact about the user's config that a caller has to act on, so it travels
-// as data through the result file the parent already reads. Only a well-formed
-// envelope is honoured there, so a partially written or unrelated file leaves
-// the process status to speak for itself.
-function reportLoaderFailure(error: unknown): never {
-  // The trailing newline ends the stack as a line of its own. Without it the
-  // parent's own message, written to this same stream, starts mid-line.
-  process.stderr.write((error instanceof Error && error.stack ? error.stack : String(error)) + "\\n");
-  try {
-    fs.writeFileSync(
-      outputPath,
-      JSON.stringify({ __ttscLoaderError: error instanceof Error ? error.message : String(error) }),
-      "utf8",
-    );
-  } catch {
-    // A reason that cannot be written leaves the exit status as the report.
-  }
-  return process.exit(1);
-}
-
-function isObject(value: unknown): value is Record<string, unknown> {
-  return value !== null && typeof value === "object";
-}
-
-function recordDependency(
-  kind: "directory" | "file" | "optional-file",
-  location: string,
-  digest: string,
-  owners: readonly string[],
-): void {
-  const key = kind + "\\0" + location;
-  const previous = dependencies.get(key);
-  const mergedOwners = previous?.owners ?? new Set<string>();
-  for (const owner of owners) mergedOwners.add(owner);
-  const realpath = dependencyRealpath(location);
-  const identityStable =
-    previous?.identityStable !== false &&
-    (previous === undefined || previous.realpath === realpath);
-  dependencies.set(key, {
-    digest:
-      !identityStable ||
-      (previous !== undefined && previous.digest !== digest)
-        ? ""
-        : digest,
-    identityStable,
-    kind,
-    owners: mergedOwners,
-    path: location,
-    realpath,
-  });
-}
-
-function dependencyRealpath(location: string): string | null {
-  try {
-    return realPath(location);
-  } catch {
-    return null;
-  }
-}
-
-function isLocalModuleSpecifier(specifier: string): boolean {
-  return specifier.startsWith(".") ||
-    specifier.startsWith("/") ||
-    specifier.startsWith("file:") ||
-    /^[A-Za-z]:[\\\\/]/.test(specifier);
-}
-
-function pathHasNodeModules(location: string): boolean {
-  return location.replaceAll("\\\\", "/").split("/").includes("node_modules");
-}
-
-function recordResolutionTopology(
-  specifier: string,
-  parentUrl: string,
-  childUrl: string,
-  childLocation: string,
-  conditions: readonly string[],
-): void {
-  const owners = [parentUrl, childUrl];
-  const parentLocation = graphNodes.get(parentUrl);
-  if (parentLocation !== undefined && isLocalModuleSpecifier(specifier)) {
-    recordDirectoryDependency(path.dirname(parentLocation), owners);
-  }
-  recordDirectoryDependency(path.dirname(childLocation), owners);
-  recordPackageManifests(childLocation, owners);
-  if (parentLocation !== undefined && !isLocalModuleSpecifier(specifier)) {
-    recordNodeModulesSearchDirectories(
-      parentLocation,
-      specifier,
-      childLocation,
-      owners,
-      conditions,
-    );
-  }
-}
-
-function recordDirectoryDependency(
-  location: string,
-  owners: readonly string[],
-): void {
-  try {
-    recordDependency("directory", location, directoryDigest(location), owners);
-  } catch {
-    recordDependency("directory", location, "", owners);
-  }
-}
-
-function directoryDigest(location: string): string {
-  const entries: Buffer[] = [];
-  if (process.platform === "win32") {
-    for (const entry of fs.readdirSync(location, { withFileTypes: true })) {
-      let target = Buffer.alloc(0);
-      if (entry.isSymbolicLink()) {
-        try {
-          target = Buffer.from(
-            fs.readlinkSync(path.join(location, entry.name)),
-            "utf8",
-          );
-        } catch {
-          target = Buffer.from("<unreadable>");
-        }
-      }
-      entries.push(directoryDigestRecord(Buffer.from(entry.name), entry, target));
-    }
-  } else {
-    for (const entry of fs.readdirSync(location, {
-      encoding: "buffer",
-      withFileTypes: true,
-    })) {
-      let target = Buffer.alloc(0);
-      if (entry.isSymbolicLink()) {
-        try {
-          target = fs.readlinkSync(
-            Buffer.concat([
-              Buffer.from(location),
-              Buffer.from(path.sep),
-              entry.name,
-            ]),
-            { encoding: "buffer" },
-          );
-        } catch {
-          target = Buffer.from("<unreadable>");
-        }
-      }
-      entries.push(directoryDigestRecord(entry.name, entry, target));
-    }
-  }
-  entries.sort(Buffer.compare);
-  const serialized = Buffer.concat(
-    entries.flatMap((entry, index) =>
-      index === 0 ? [entry] : [Buffer.from([0]), entry],
-    ),
-  );
-  return createHash("sha256").update(serialized).digest("hex");
-}
-
-function directoryDigestRecord(
-  name: Buffer,
-  entry: {
-    isDirectory(): boolean;
-    isFile(): boolean;
-    isSymbolicLink(): boolean;
-  },
-  target: Buffer,
-): Buffer {
-  const kind = entry.isDirectory()
-    ? "directory"
-    : entry.isFile()
-      ? "file"
-      : entry.isSymbolicLink()
-        ? "symlink"
-        : "other";
-  return Buffer.concat([name, Buffer.from("\\0" + kind + "\\0"), target]);
-}
-
-function optionalFileDigest(location: string): string {
-  try {
-    const entry = fs.statSync(location);
-    if (entry.isFile()) {
-      return createHash("sha256")
-        .update(Buffer.concat([Buffer.from("file\\0"), fs.readFileSync(location)]))
-        .digest("hex");
-    }
-    if (entry.isDirectory()) {
-      return createHash("sha256")
-        .update("ttsc:host-input:directory\\0")
-        .digest("hex");
-    }
-  } catch {
-    // Missing and unreadable candidates share the absent state.
-  }
-  return createHash("sha256").update("missing\\0").digest("hex");
-}
-
-function recordOptionalFileDependency(
-  location: string,
-  owners: readonly string[],
-): boolean {
-  try {
-    if (fs.statSync(location).isFile()) {
-      recordDependency(
-        "file",
-        location,
-        createHash("sha256").update(fs.readFileSync(location)).digest("hex"),
-        owners,
-      );
-      return true;
-    }
-  } catch {
-    // The exact missing path remains a dependency of the resolution result.
-  }
-  recordDependency("optional-file", location, optionalFileDigest(location), owners);
-  return false;
-}
-
-function moduleResolutionCandidates(base: string): string[] {
-  const extension = path.extname(base).toLowerCase();
-  const substitutions = jsToTsProbeExtensions.get(extension) ?? [];
-  const stem = base.slice(0, base.length - extension.length);
-  return [
-    base,
-    ...substitutions.map((candidate) => stem + candidate),
-    ...moduleProbeExtensions.map((candidate) => base + candidate),
-    path.join(base, "package.json"),
-    ...moduleProbeExtensions.map((candidate) =>
-      path.join(base, "index" + candidate),
-    ),
-  ];
-}
-
-/** Record exact local probes before the runtime resolver chooses one. */
-function recordLocalResolutionCandidates(
-  specifier: string,
-  parentUrl: string,
-): void {
-  if (!isLocalModuleSpecifier(specifier)) return;
-  let bases: string[];
-  try {
-    if (specifier.startsWith("file:")) {
-      bases = [fileURLToPath(specifier)];
-    } else {
-      const directory = path.dirname(fileURLToPath(parentUrl));
-      const raw = path.resolve(directory, specifier);
-      const suffixStart = specifier.search(/[?#]/);
-      const pathname =
-        suffixStart === -1 ? specifier : specifier.slice(0, suffixStart);
-      bases = pathname === ""
-        ? [raw]
-        : [...new Set([raw, path.resolve(directory, pathname)])];
-    }
-  } catch {
-    return;
-  }
-  const owners = [parentUrl];
-  for (const base of bases) {
-    try {
-      if (fs.statSync(base).isFile()) {
-        recordOptionalFileDependency(base, owners);
-        continue;
-      }
-    } catch {
-      // A missing exact spelling falls through to source/extension/directory
-      // probes, all of which can redirect a later evaluation.
-    }
-    for (const candidate of moduleResolutionCandidates(base)) {
-      recordOptionalFileDependency(candidate, owners);
-    }
-  }
-}
-
-/** CommonJS LOAD_AS_FILE / LOAD_AS_DIRECTORY candidates for one legacy path. */
-function recordLegacyPackagePathCandidates(
-  candidate: string,
-  owners: readonly string[],
-): void {
-  for (const file of [
-    candidate,
-    candidate + ".js",
-    candidate + ".json",
-    candidate + ".node",
-    path.join(candidate, "package.json"),
-    path.join(candidate, "index.js"),
-    path.join(candidate, "index.json"),
-    path.join(candidate, "index.node"),
-  ]) {
-    recordOptionalFileDependency(file, owners);
-  }
-}
-
-function recordPackageManifests(
-  location: string,
-  owners: readonly string[],
-): void {
-  let current = path.dirname(location);
-  while (true) {
-    const manifest = path.join(current, "package.json");
-    if (recordOptionalFileDependency(manifest, owners)) return;
-    const parent = path.dirname(current);
-    if (parent === current || path.basename(current) === "node_modules") return;
-    current = parent;
-  }
-}
-
-function recordNodeModulesSearchDirectories(
-  parentLocation: string,
-  specifier: string,
-  childLocation: string,
-  owners: readonly string[],
-  conditions: readonly string[],
-): void {
-  const packageName = modulePackageName(specifier);
-  const scope =
-    specifier.startsWith("@") && specifier.includes("/")
-      ? specifier.slice(0, specifier.indexOf("/"))
-      : undefined;
-  let current = path.dirname(parentLocation);
-  while (true) {
-    // A newly created nearer node_modules directory can shadow the package
-    // selected by this evaluation, so missing search levels are dependencies.
-    recordDirectoryDependency(current, owners);
-    const modules = path.join(current, "node_modules");
-    try {
-      if (fs.statSync(modules).isDirectory()) {
-        recordDirectoryDependency(modules, owners);
-        if (scope !== undefined) {
-          const scoped = path.join(modules, scope);
-          try {
-            if (fs.statSync(scoped).isDirectory()) {
-              recordDirectoryDependency(scoped, owners);
-            }
-          } catch {
-            // The directory digest of node_modules records a missing scope.
-          }
-        }
-      }
-    } catch {
-      // Missing search levels do not participate in the current resolution.
-    }
-    if (packageName !== undefined) {
-      const selected = recordPackageCandidateTopology(
-        modules,
-        packageName,
-        specifier,
-        childLocation,
-        owners,
-        conditions,
-      );
-      if (
-        selected ||
-        resolvedPackageContains(modules, packageName, childLocation)
-      ) {
-        return;
-      }
-    }
-    if (
-      packageName === undefined &&
-      samePhysicalPath(current, resolutionRoot)
-    ) {
-      return;
-    }
-    const parent = path.dirname(current);
-    if (parent === current) return;
-    current = parent;
-  }
-}
-
-function recordPackageCandidateTopology(
-  modules: string,
-  packageName: string,
-  specifier: string,
-  childLocation: string,
-  owners: readonly string[],
-  conditions: readonly string[],
-): boolean {
-  const packageRoot = path.join(modules, packageName);
-  const subpath = specifier
-    .slice(packageName.length)
-    .replace(/^[/\\\\]+/, "");
-  try {
-    if (!fs.statSync(packageRoot).isDirectory()) {
-      recordOptionalFileDependency(
-        path.join(packageRoot, "package.json"),
-        owners,
-      );
-      recordLegacyPackagePathCandidates(
-        subpath === "" ? packageRoot : path.join(packageRoot, subpath),
-        owners,
-      );
-      return false;
-    }
-  } catch {
-    recordOptionalFileDependency(
-      path.join(packageRoot, "package.json"),
-      owners,
-    );
-    recordLegacyPackagePathCandidates(
-      subpath === "" ? packageRoot : path.join(packageRoot, subpath),
-      owners,
-    );
-    return false;
-  }
-  const rootTopology = recordPackageRootTopology(
-    packageRoot,
-    owners,
-    subpath === "",
-    subpath === "" ? "." : "./" + subpath.replaceAll("\\\\", "/"),
-    childLocation,
-    conditions,
-  );
-  if (subpath !== "" && !rootTopology.hasExports) {
-    return (
-      recordPackageSubpathTopology(
-        packageRoot,
-        subpath,
-        childLocation,
-        owners,
-      ) || rootTopology.selected
-    );
-  }
-  return rootTopology.selected;
-}
-
-function recordPackageRootTopology(
-  packageRoot: string,
-  owners: readonly string[],
-  useMain: boolean,
-  packageSubpath: string,
-  childLocation: string,
-  conditions: readonly string[],
-): { hasExports: boolean; selected: boolean } {
-  const normalizedRoot = path.resolve(packageRoot);
-  const manifest = path.join(normalizedRoot, "package.json");
-  const legacySelected = (): boolean =>
-    useMain &&
-    packagePathCandidateMatchesChild(normalizedRoot, childLocation, true);
-  if (useMain) recordLegacyPackagePathCandidates(normalizedRoot, owners);
-  if (!recordOptionalFileDependency(manifest, owners)) {
-    const selected = legacySelected();
-    if (!selected) {
-      recordPackageIndexCandidates(normalizedRoot, useMain, owners);
-    }
-    return { hasExports: false, selected };
-  }
-  try {
-    const value = JSON.parse(fs.readFileSync(manifest, "utf8"));
-    if (value !== null && typeof value === "object") {
-      const metadata = value as Record<string, unknown>;
-      const hasExports =
-        metadata.exports !== undefined && metadata.exports !== null;
-      if (hasExports) {
-        const target = selectPackageExportsTarget(
-          metadata.exports,
-          packageSubpath,
-          new Set(conditions),
-        );
-        const candidate =
-          typeof target === "string"
-            ? packageExportsTarget(normalizedRoot, target)
-            : undefined;
-        const selected =
-          candidate !== undefined &&
-          packagePathCandidateMatchesChild(
-            candidate,
-            childLocation,
-            false,
-          );
-        if (selected) {
-          recordPackagePathCandidate(candidate, owners);
-        } else if (candidate !== undefined) {
-          // A nearer package the search skipped starts winning the moment its
-          // own active target appears, and neither the parent node_modules
-          // listing nor the manifest changes when only that file is created.
-          recordOptionalFileDependency(candidate, owners);
-        }
-        return { hasExports: true, selected };
-      }
-      let selected = legacySelected();
-      if (useMain && typeof metadata.main === "string") {
-        // CommonJS main is a legacy path, not an exports target. Node resolves
-        // it literally and permits absolute paths and paths outside the package.
-        const main = path.resolve(normalizedRoot, metadata.main);
-        recordPackagePathCandidate(main, owners);
-        recordLegacyPackagePathCandidates(main, owners);
-        selected =
-          packagePathCandidateMatchesChild(main, childLocation, true) ||
-          selected;
-      }
-      if (!selected) {
-        recordPackageIndexCandidates(normalizedRoot, useMain, owners);
-      }
-      return {
-        hasExports: false,
-        selected,
-      };
-    }
-  } catch {
-    // Node owns malformed-manifest diagnostics; the manifest digest is enough
-    // to invalidate this evaluation when its contents change.
-  }
-  const selected = legacySelected();
-  if (!selected) {
-    recordPackageIndexCandidates(normalizedRoot, useMain, owners);
-  }
-  return { hasExports: false, selected };
-}
-
-// recordPackageIndexCandidates pins the LOAD_INDEX fallbacks of a package root
-// this resolution walked past without selecting. An empty package directory, or
-// one whose manifest declares no usable entry, becomes resolvable as soon as one
-// of these files exists, and that creation changes neither the parent directory
-// listing nor the manifest digest already recorded for the candidate.
-function recordPackageIndexCandidates(
-  packageRoot: string,
-  useMain: boolean,
-  owners: readonly string[],
-): void {
-  if (!useMain) return;
-  for (const name of ["index.js", "index.json", "index.node"]) {
-    recordOptionalFileDependency(path.join(packageRoot, name), owners);
-  }
-}
-
-function selectPackageExportsTarget(
-  exportsValue: unknown,
-  packageSubpath: string,
-  conditions: ReadonlySet<string>,
-): string | null | undefined {
-  let mappings: unknown = exportsValue;
-  if (
-    typeof mappings === "string" ||
-    Array.isArray(mappings) ||
-    (isObject(mappings) &&
-      Object.keys(mappings).every((key) => !key.startsWith(".")))
-  ) {
-    if (packageSubpath !== ".") return undefined;
-    return selectPackageTarget(mappings, "", false, conditions);
-  }
-  if (!isObject(mappings)) return undefined;
-  if (
-    Object.prototype.hasOwnProperty.call(mappings, packageSubpath) &&
-    !packageSubpath.includes("*") &&
-    !packageSubpath.endsWith("/")
-  ) {
-    return selectPackageTarget(
-      mappings[packageSubpath],
-      "",
-      false,
-      conditions,
-    );
-  }
-  let bestMatch = "";
-  let bestSubpath = "";
-  for (const key of Object.keys(mappings)) {
-    const wildcard = key.indexOf("*");
-    if (
-      wildcard === -1 ||
-      key.lastIndexOf("*") !== wildcard ||
-      !packageSubpath.startsWith(key.slice(0, wildcard))
-    ) {
-      continue;
-    }
-    const trailer = key.slice(wildcard + 1);
-    if (
-      packageSubpath.length < key.length ||
-      !packageSubpath.endsWith(trailer) ||
-      packagePatternKeyCompare(bestMatch, key) !== 1
-    ) {
-      continue;
-    }
-    bestMatch = key;
-    bestSubpath = packageSubpath.slice(
-      wildcard,
-      packageSubpath.length - trailer.length,
-    );
-  }
-  return bestMatch === ""
-    ? undefined
-    : selectPackageTarget(
-        mappings[bestMatch],
-        bestSubpath,
-        true,
-        conditions,
-      );
-}
-
-function selectPackageTarget(
-  target: unknown,
-  subpath: string,
-  pattern: boolean,
-  conditions: ReadonlySet<string>,
-): string | null | undefined {
-  if (typeof target === "string") {
-    const selected = pattern ? target.replaceAll("*", subpath) : target;
-    return validPackageExportsTarget(selected) ? selected : undefined;
-  }
-  if (Array.isArray(target)) {
-    for (const item of target) {
-      const selected = selectPackageTarget(
-        item,
-        subpath,
-        pattern,
-        conditions,
-      );
-      if (selected !== undefined && selected !== null) return selected;
-    }
-    return null;
-  }
-  if (isObject(target)) {
-    for (const [condition, value] of Object.entries(target)) {
-      if (condition !== "default" && !conditions.has(condition)) continue;
-      const selected = selectPackageTarget(
-        value,
-        subpath,
-        pattern,
-        conditions,
-      );
-      if (selected !== undefined) return selected;
-    }
-    return undefined;
-  }
-  return target === null ? null : undefined;
-}
-
-function packagePatternKeyCompare(left: string, right: string): number {
-  const leftWildcard = left.indexOf("*");
-  const rightWildcard = right.indexOf("*");
-  const leftBase =
-    leftWildcard === -1 ? left.length : leftWildcard + 1;
-  const rightBase =
-    rightWildcard === -1 ? right.length : rightWildcard + 1;
-  if (leftBase > rightBase) return -1;
-  if (rightBase > leftBase) return 1;
-  if (leftWildcard === -1) return 1;
-  if (rightWildcard === -1) return -1;
-  if (left.length > right.length) return -1;
-  if (right.length > left.length) return 1;
-  return 0;
-}
-
-function packageExportsTarget(
-  packageRoot: string,
-  target: string,
-): string | undefined {
-  if (!validPackageExportsTarget(target)) return undefined;
-  try {
-    // Node resolves an exports target as a URL against the package manifest,
-    // so percent escapes, query strings, and fragments all take part in the
-    // path it finally loads. Joining the raw target by hand diverges from that
-    // whenever the target is anything but a plain relative path, and a target
-    // Node resolves while this model rejects loses the selected file's
-    // fingerprint, leaving a retargeted symlink cached as fresh.
-    const packageUrl = pathToFileURL(path.join(packageRoot, "package.json"));
-    const resolved = new URL(target, packageUrl);
-    const packagePath = new URL(".", packageUrl).pathname;
-    if (!resolved.pathname.startsWith(packagePath)) return undefined;
-    return fileURLToPath(resolved);
-  } catch {
-    return undefined;
-  }
-}
-
-function validPackageExportsTarget(target: string): boolean {
-  if (!target.startsWith("./") || /%2f|%5c/i.test(target)) return false;
-  const components = target
-    .slice(2)
-    .replaceAll("\\\\", "/")
-    .split("/");
-  if (
-    components.some(
-      (component) => {
-        try {
-          const decoded = decodeURIComponent(component);
-          return (
-            decoded === "." ||
-            decoded === ".." ||
-            decoded.includes("/") ||
-            decoded.includes("\\\\") ||
-            decoded.toLowerCase() === "node_modules"
-          );
-        } catch {
-          return true;
-        }
-      },
-    )
-  ) {
-    return false;
-  }
-  return true;
-}
-
-function packagePathCandidateMatchesChild(
-  candidate: string,
-  childLocation: string,
-  legacy: boolean,
-): boolean {
-  let child: string;
-  try {
-    child = fs.realpathSync.native(childLocation);
-  } catch {
-    child = path.resolve(childLocation);
-  }
-  const candidates = legacy
-    ? [
-        candidate,
-        candidate + ".js",
-        candidate + ".json",
-        candidate + ".node",
-        path.join(candidate, "index.js"),
-        path.join(candidate, "index.json"),
-        path.join(candidate, "index.node"),
-      ]
-    : [candidate];
-  return candidates.some((location) => {
-    try {
-      return sameResolutionPath(fs.realpathSync.native(location), child);
-    } catch {
-      return false;
-    }
-  });
-}
-
-function recordPackageSubpathTopology(
-  packageRoot: string,
-  subpath: string,
-  childLocation: string,
-  owners: readonly string[],
-): boolean {
-  const candidate = boundedPackageTarget(packageRoot, subpath);
-  if (candidate === undefined) return false;
-  recordPackagePathCandidate(candidate, owners);
-  recordLegacyPackagePathCandidates(candidate, owners);
-  let selected = packagePathCandidateMatchesChild(
-    candidate,
-    childLocation,
-    true,
-  );
-  try {
-    if (!fs.statSync(candidate).isDirectory()) return selected;
-  } catch {
-    return selected;
-  }
-  const manifest = path.join(candidate, "package.json");
-  if (!recordOptionalFileDependency(manifest, owners)) return selected;
-  try {
-    const value = JSON.parse(fs.readFileSync(manifest, "utf8"));
-    if (value !== null && typeof value === "object") {
-      const metadata = value as Record<string, unknown>;
-      if (typeof metadata.main === "string") {
-        const main = path.resolve(candidate, metadata.main);
-        recordPackagePathCandidate(main, owners);
-        recordLegacyPackagePathCandidates(main, owners);
-        selected =
-          packagePathCandidateMatchesChild(main, childLocation, true) ||
-          selected;
-      }
-    }
-  } catch {
-    // Node owns malformed nested-package diagnostics.
-  }
-  return selected;
-}
-
-function boundedPackageTarget(
-  packageRoot: string,
-  target: string,
-): string | undefined {
-  const candidate = path.resolve(packageRoot, target);
-  const relative = path.relative(packageRoot, candidate);
-  if (
-    relative === ".." ||
-    relative.startsWith(".." + path.sep) ||
-    path.isAbsolute(relative)
-  ) {
-    return undefined;
-  }
-  return candidate;
-}
-
-function recordPackagePathCandidate(
-  candidate: string,
-  owners: readonly string[],
-  visited: Set<string> = new Set(),
-  depth = 0,
-): void {
-  const normalized = path.resolve(candidate);
-  // The depth bound owns termination. A platform-wide case fold would merge
-  // paths that differ only by case, which a per-directory case-sensitive
-  // Windows tree keeps distinct, and would truncate a valid symlink chain.
-  if (depth >= 64 || visited.has(normalized)) return;
-  visited.add(normalized);
-  const parsed = path.parse(normalized);
-  const components = normalized
-    .slice(parsed.root.length)
-    .split(path.sep)
-    .filter(Boolean);
-  let current = parsed.root;
-  for (let index = 0; index < components.length; index++) {
-    const component = components[index];
-    const next = path.join(current, component);
-    let entry: ReturnType<typeof fs.lstatSync>;
-    try {
-      entry = fs.lstatSync(next);
-    } catch {
-      recordDirectoryDependency(current, owners);
-      return;
-    }
-    if (entry.isSymbolicLink()) {
-      // The containing directory digest carries the raw link target.
-      recordDirectoryDependency(current, owners);
-      try {
-        const target = fs.readlinkSync(next);
-        const remainder = components.slice(index + 1);
-        recordPackagePathCandidate(
-          path.join(
-            path.resolve(current, target),
-            ...remainder,
-          ),
-          owners,
-          visited,
-          depth + 1,
-        );
-      } catch {
-        // The lexical link record already carries the unreadable state.
-      }
-    }
-    let isDirectory = entry.isDirectory();
-    if (entry.isSymbolicLink()) {
-      try {
-        isDirectory = fs.statSync(next).isDirectory();
-      } catch {
-        return;
-      }
-    }
-    if (index === components.length - 1) {
-      recordDirectoryDependency(isDirectory ? next : current, owners);
-      return;
-    }
-    if (!isDirectory) {
-      recordDirectoryDependency(current, owners);
-      return;
-    }
-    current = next;
-  }
-  recordDirectoryDependency(current, owners);
-}
-
-function modulePackageName(specifier: string): string | undefined {
-  if (specifier.startsWith("@")) {
-    const components = specifier.split("/");
-    return components.length >= 2
-      ? components[0] + "/" + components[1]
-      : undefined;
-  }
-  const [name] = specifier.split("/");
-  return name && !name.startsWith("#") ? name : undefined;
-}
-
-function resolvedPackageContains(
-  modules: string,
-  packageName: string,
-  childLocation: string,
-): boolean {
-  try {
-    const packageRoot = fs.realpathSync(path.join(modules, packageName));
-    const relative = path.relative(
-      packageRoot,
-      fs.realpathSync(childLocation),
-    );
-    return (
-      relative === "" ||
-      (relative !== ".." &&
-        !relative.startsWith(".." + path.sep) &&
-        !path.isAbsolute(relative))
-    );
-  } catch {
-    return false;
-  }
-}
-
-function sameResolutionPath(left: string, right: string): boolean {
-  return path.relative(left, right) === "";
-}
-
-function samePhysicalPath(left: string, right: string): boolean {
-  try {
-    return sameResolutionPath(realPath(left), realPath(right));
-  } catch {
-    // Fall back to the spellings themselves, folding case the way the platform
-    // does. On the entry gate a false negative is catastrophic — the config
-    // stops being recognized and its whole graph collapses — while a false
-    // positive only over-includes, so the degradation has to lean toward "same
-    // file". A drive-letter or component case difference is the ordinary
-    // Windows situation; a per-directory case-sensitive tree is the rare one.
-    return sameResolutionPath(left, right);
-  }
-}
-
-/**
- * The config's real path, or its declared one when the volume will not say.
- *
- * A config can disappear between the host reading it and this loader starting,
- * and a throw here would replace a precise report from the import below with a
- * crash in bookkeeping. Seeding lexically instead only risks the demotion this
- * value exists to prevent, on a file that is already gone.
- */
-function realConfigLocation(): string {
-  try {
-    return realPath(configLocation);
-  } catch {
-    return configLocation;
-  }
-}
-
-function realPath(location: string): string {
-  return fs.realpathSync.native
-    ? fs.realpathSync.native(location)
-    : fs.realpathSync(location);
-}
-
-function finalizeDependencies(): Array<{
-  digest: string;
-  identityStable: boolean;
-  kind: "directory" | "file" | "optional-file";
-  path: string;
-  realpath: string | null;
-  scope: "cache" | "watch";
-}> {
-  // The evaluator may have observed a dependency, run arbitrary config code,
-  // and then serialize after that path changed again. Re-read every recorded
-  // dependency under its original ownership set so an A -> B -> A transition
-  // is marked identity-unstable instead of pairing transient output with the
-  // restored fingerprint.
-  for (const dependency of [...dependencies.values()]) {
-    recordDependency(
-      dependency.kind,
-      dependency.path,
-      currentDependencyDigest(dependency.kind, dependency.path),
-      [...dependency.owners],
-    );
-  }
-  const watched = graphWatchReachability();
-  return [...dependencies.values()].map(({ owners, ...dependency }) => ({
-    ...dependency,
-    scope: [...owners].some((owner) => watched.has(owner))
-      ? "watch"
-      : "cache",
-  }));
-}
-
-function currentDependencyDigest(
-  kind: "directory" | "file" | "optional-file",
-  location: string,
-): string {
-  try {
-    if (kind === "directory") return directoryDigest(location);
-    if (kind === "optional-file") return optionalFileDigest(location);
-    return createHash("sha256")
-      .update(fs.readFileSync(location))
-      .digest("hex");
-  } catch {
-    return "";
-  }
-}
-
-function graphWatchReachability(): Set<string> {
-  const adjacency = new Map<string, typeof graphEdges>();
-  for (const edge of graphEdges) {
-    const outgoing = adjacency.get(edge.parent) ?? [];
-    outgoing.push(edge);
-    adjacency.set(edge.parent, outgoing);
-  }
-  const queue: Array<{ url: string; watched: boolean }> =
-    configUrlSpellings.map((url) => ({ url, watched: true }));
-  const visited = new Set<string>();
-  const watched = new Set<string>();
-  while (queue.length !== 0) {
-    const state = queue.shift()!;
-    const key = state.url + "\\0" + (state.watched ? "1" : "0");
-    if (visited.has(key)) continue;
-    visited.add(key);
-    if (state.watched) watched.add(state.url);
-    for (const edge of adjacency.get(state.url) ?? []) {
-      const childLocation = graphNodes.get(edge.child);
-      const childWatched = edge.packageBoundary
-        ? false
-        : childLocation !== undefined && !pathHasNodeModules(childLocation)
-          ? true
-          : state.watched;
-      queue.push({ url: edge.child, watched: childWatched });
-    }
-  }
-  return watched;
-}
-
-function hasOwn(value: Record<string, unknown>, key: string): boolean {
-  return Object.prototype.hasOwnProperty.call(value, key);
-}
-
-async function resolveConfig(value: unknown, allowNamedConfig: boolean): Promise<unknown> {
-  let current = value;
-  for (let i = 0; i < 8; i++) {
-    if (typeof current === "function") {
-      current = await (current as () => unknown | Promise<unknown>)();
-      allowNamedConfig = false;
-      continue;
-    }
-    if (isObject(current) && !Array.isArray(current)) {
-      if (hasOwn(current, "default")) {
-        const defaultValue = current.default;
-        if (isModuleNamespace(current) || !hasConfigKey(current)) {
-          current = defaultValue;
-          allowNamedConfig = false;
-          continue;
-        }
-        const normalizedDefault = await resolveConfig(defaultValue, false);
-        if (isObject(normalizedDefault) && !Array.isArray(normalizedDefault)) {
-          current = mergeConfigObjects(normalizedDefault, current);
-          allowNamedConfig = false;
-          continue;
-        }
-      }
-      if (allowNamedConfig && hasOwn(current, "config")) {
-        current = current.config;
-        allowNamedConfig = false;
-        continue;
-      }
-    }
-    break;
-  }
-  return current;
-}
-
-function isModuleNamespace(value: Record<string, unknown>): boolean {
-  return Object.prototype.toString.call(value) === "[object Module]";
-}
-
-function hasConfigKey(value: Record<string, unknown>): boolean {
-  for (const key of CONFIG_KEYS) {
-    if (hasOwn(value, key)) {
-      return true;
-    }
-  }
-  return false;
-}
-
-function mergeConfigObjects(
-  base: Record<string, unknown>,
-  override: Record<string, unknown>,
-): Record<string, unknown> {
-  const out: Record<string, unknown> = {};
-  for (const key of CONFIG_KEYS) {
-    if (hasOwn(base, key)) {
-      out[key] = base[key];
-    }
-  }
-  for (const key of CONFIG_KEYS) {
-    if (hasOwn(override, key)) {
-      out[key] = override[key];
-    }
-  }
-  return out;
-}
-
-function collectPluginObjects(value: unknown): Array<Record<string, unknown>> {
-  const out: Array<Record<string, unknown>> = [];
-  visit(value);
-  return out;
-
-  function visit(node: unknown): void {
-    if (Array.isArray(node)) {
-      for (const item of node) visit(item);
-      return;
-    }
-    if (!isObject(node)) return;
-    if (hasOwn(node, "plugins") && isObject(node.plugins)) {
-      out.push(node.plugins as Record<string, unknown>);
-    }
-  }
-}
-
-function extractPluginSource(value: unknown): string | undefined {
-  if (typeof value === "string") {
-    value = requireFromConfig(value);
-  }
-  if (!isObject(value)) return undefined;
-  // ESM-from-CJS interop wraps CJS modules' \`exports.default\` so the
-  // plugin object can land under a \`.default\` indirection. Walk a few
-  // hops so contributors authored as \`export default plugin\` and
-  // contributors authored as plain \`module.exports = plugin\` both
-  // resolve identically.
-  let current: Record<string, unknown> = value;
-  // 8 hops to match the outer-process unwrapDefault helper; previously
-  // 4, which silently misrouted deeply re-exported plugins while
-  // unwrapDefault would have unwrapped them.
-  for (let i = 0; i < 8; i++) {
-    if (typeof current.source === "string") break;
-    const next = current.default;
-    if (!isObject(next)) break;
-    current = next;
-  }
-  const source = current.source;
-  return typeof source === "string" ? source : undefined;
-}
-`;
-/**
- * Resolves contributor plugin entries declared in any executable lint config,
- * memoized through the shared on-disk config cache.
- *
- * Evaluating such a config spawns a full `ttsx` subprocess. A monorepo build
- * runs one `ttsc` process per package, and each would otherwise re-spawn `ttsx`
- * for the same shared config; the cache collapses that to a single evaluation.
- * The cache key covers the entry's path and exact contents; the payload also
- * fingerprints every local module reached from that entry. An entry or helper
- * edit therefore re-evaluates cleanly without treating installed packages as
- * project watch inputs.
- */
-function readTtsxConfigPlugins(configPath, context) {
-    const resolutionRoot = node_path_1.default.resolve(pluginConfigBaseDir(context));
-    const cacheKey = configCacheKey(`plugins\0${resolutionRoot}`, configPath);
-    if (cacheKey) {
-        const cached = readConfigPluginCache(cacheKey);
-        // Re-validate cached entries before trusting them: a contributor's
-        // resolved `source` directory may have moved since the entry was
-        // written. A stale entry falls through to a fresh evaluation rather
-        // than being forwarded to ttsc's plugin builder as a dead path.
-        if (cached &&
-            cached.entries.every(isValidConfigPluginEntry) &&
-            configDependenciesAreCurrent(cached.dependencies)) {
-            return cached;
-        }
-    }
-    // A config can be saved while it is being evaluated. Retry a bounded number
-    // of times until every dependency still has the bytes the module hook saw.
-    // A continuously changing config remains usable but is deliberately not
-    // cached; watch will schedule another cycle.
-    let evaluation;
-    for (let attempt = 0; attempt < 3; attempt++) {
-        evaluation = evaluateTtsxConfigPlugins(configPath, context);
-        if (configDependenciesAreCurrent(evaluation.dependencies)) {
-            if (cacheKey)
-                writeConfigPluginCache(cacheKey, evaluation);
-            return evaluation;
-        }
-    }
-    return evaluation;
-}
-/**
- * Reports whether a cached plugin entry is still usable: a well-formed
- * namespace and an absolute `source` that still points at a directory. Pure
- * predicate — never throws — so a malformed cache entry simply triggers
- * re-evaluation instead of aborting plugin discovery.
- */
-function isValidConfigPluginEntry(entry) {
-    if (entry == null ||
-        typeof entry !== "object" ||
-        typeof entry.namespace !== "string" ||
-        typeof entry.source !== "string") {
-        return false;
-    }
-    const { namespace, source } = entry;
-    if (!NAMESPACE_PATTERN.test(namespace) || !node_path_1.default.isAbsolute(source)) {
-        return false;
-    }
-    try {
-        return node_fs_1.default.statSync(source).isDirectory();
-    }
-    catch {
-        return false;
-    }
-}
-function evaluateTtsxConfigPlugins(configPath, context) {
-    const tempDir = createCanonicalTempDirectory("ttsc-lint-cfg-", loaderTempBase(configPath));
-    try {
-        linkNearestNodeModules(tempDir, node_path_1.default.dirname(configPath));
-        const loaderPath = node_path_1.default.join(tempDir, "loader.mts");
-        const outputPath = node_path_1.default.join(tempDir, "result.json");
-        const tsconfigPath = node_path_1.default.join(tempDir, "tsconfig.json");
-        const loaderSource = exports.TTSX_EXTRACTOR_SCRIPT.replace("%CONFIG_IMPORT%", JSON.stringify((0, node_url_1.pathToFileURL)(configPath).href))
-            .replace("%CONFIG_OUTPUT%", JSON.stringify(outputPath))
-            .replace("%CONFIG_ROOT%", JSON.stringify(node_path_1.default.resolve(pluginConfigBaseDir(context))));
-        node_fs_1.default.writeFileSync(loaderPath, loaderSource, "utf8");
-        node_fs_1.default.writeFileSync(tsconfigPath, JSON.stringify({
-            compilerOptions: {
-                // `.mjs` and `.js` configs reach this loader because Node
-                // cannot `require()` ESM synchronously; ttsx's TypeScript
-                // project compiler refuses to admit them without `allowJs`,
-                // so set it alongside the strict bypass to make the loader
-                // tolerant of any of `lint.config.{ts,cts,mts,js,mjs,cjs}`.
-                allowImportingTsExtensions: true,
-                allowJs: true,
-                checkJs: false,
-                // The config is a Node module, so Node's rule decides its format:
-                // the nearest `package.json` `type` above it. Hardcoding one answer
-                // ran every ambiguous `.ts` config as ESM and broke `__dirname` in
-                // an ordinary CommonJS package (#1068). `moduleResolution` stays
-                // `bundler`, which tsgo accepts for both kinds, so extensionless
-                // relative imports keep resolving either way.
-                module: configModuleOption(configPath),
-                moduleResolution: "bundler",
-                noImplicitAny: false,
-                outDir: node_path_1.default.join(tempDir, "out").replace(/\\/g, "/"),
-                rewriteRelativeImportExtensions: true,
-                rootDir: node_path_1.default.parse(tempDir).root.replace(/\\/g, "/"),
-                skipLibCheck: true,
-                strict: false,
-                target: "ES2022",
-                // TypeScript 7 includes no ambient type package unless `types` asks
-                // for it, and this Program extends nothing, so without the wildcard
-                // a config could not name a single Node global (#1068). The loader
-                // directory links the config's nearest `node_modules`, so the
-                // default `typeRoots` walk finds exactly what the project installed.
-                types: ["*"],
-            },
-            files: [
-                loaderPath.replace(/\\/g, "/"),
-                ...(node_path_1.default.extname(configPath).toLowerCase() === ".json"
-                    ? []
-                    : [configPath.replace(/\\/g, "/")]),
-            ],
-        }, null, 2), "utf8");
-        // The config comes first, so a project that pins its own ttsc gets it. This
-        // descriptor's own location comes second, because a fixture or a workspace
-        // that installs only the lint package cannot resolve ttsc from the config
-        // at all, and the descriptor always sits beside the host that loaded it.
-        const ttsxBinary = resolveTtsxLauncher([configPath, context.dirname]);
-        // `--no-plugins` keeps this build hermetic: the loader only needs to
-        // type-check and run the user's lint config to extract its plugin
-        // entries. Loading the host project's transform/check plugins
-        // (`@nestia/core`, `typia`, …) would run their project checks
-        // against this deliberately lenient loader tsconfig and fail the
-        // build — e.g. `@nestia/core` rejects the loader's `strict: false`.
-        const args = [
-            "--project",
-            tsconfigPath,
-            "--cwd",
-            tempDir,
-            "--no-plugins",
-            loaderPath,
-        ];
-        const tsgoBinary = resolveConfigTsgo(configPath, context);
-        if (tsgoBinary) {
-            args.unshift("--binary", tsgoBinary);
-        }
-        const env = {
-            ...nodeConfigLoaderEnv(configPath),
-        };
-        const command = ttsxThroughNodeIfNeeded(ttsxBinary);
-        const result = (0, node_child_process_1.spawnSync)(command.binary, [...command.prefix, ...args], {
-            cwd: tempDir,
-            env,
-            // Both child streams are human output, and they go straight to this
-            // process's stderr as they are written. Nothing is collected here: the
-            // parent's stdout is reserved for compiler JSON and LSP frames, and
-            // buffering the child only to replay it afterwards is what forced an
-            // invented output ceiling and made a long evaluation print nothing at all.
-            stdio: ["ignore", 2, 2],
-            windowsHide: true,
-        });
-        const processFailure = (0, configEvaluatorFailure_1.configEvaluatorProcessFailure)(result, configPath);
-        if (processFailure) {
-            // The evaluator's stack already reached the user's stderr as it ran. What
-            // it could not put there is a reason a caller can act on, so that arrives
-            // through the result file instead.
-            const reason = (0, configEvaluatorFailure_1.configEvaluatorFailureReason)(outputPath);
-            throw reason === ""
-                ? processFailure
-                : new Error(`${processFailure.message}\n${reason}`);
-        }
-        let payload;
-        try {
-            payload = JSON.parse(node_fs_1.default.readFileSync(outputPath, "utf8"));
-        }
-        catch (error) {
-            throw new Error(`@ttsc/lint: lint config ${configPath} evaluator returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        if (!Array.isArray(payload.entries)) {
-            throw new Error(`@ttsc/lint: lint config ${configPath} evaluator omitted its plugin-entry array`);
-        }
-        const entries = payload.entries.map((entry) => {
-            // The ttsx extractor already resolved each plugin object's
-            // `source` to an absolute directory path. Validate the shape but
-            // skip the specifier-resolution branch — re-routing a directory
-            // through `createRequire().resolve` would fail.
-            if (entry === null ||
-                typeof entry !== "object" ||
-                typeof entry.namespace !== "string") {
-                throw new Error(`@ttsc/lint: lint config ${configPath} evaluator returned a malformed plugin entry`);
-            }
-            if (!NAMESPACE_PATTERN.test(entry.namespace)) {
-                throw new Error(`@ttsc/lint: lint config ${configPath} namespace ${JSON.stringify(entry.namespace)} must match /^[a-z][a-z0-9_-]*$/`);
-            }
-            if (typeof entry.source !== "string" || entry.source.length === 0) {
-                throw new Error(`@ttsc/lint: lint config ${configPath} plugin ${JSON.stringify(entry.namespace)} did not expose a "source" string`);
-            }
-            if (!node_path_1.default.isAbsolute(entry.source)) {
-                throw new Error(`@ttsc/lint: lint config ${configPath} plugin ${JSON.stringify(entry.namespace)} "source" must be absolute; got ${JSON.stringify(entry.source)}`);
-            }
-            if (!node_fs_1.default.existsSync(entry.source) ||
-                !node_fs_1.default.statSync(entry.source).isDirectory()) {
-                throw new Error(`@ttsc/lint: lint config ${configPath} plugin ${JSON.stringify(entry.namespace)} "source" must be an existing directory: ${entry.source}`);
-            }
-            return { namespace: entry.namespace, source: entry.source };
-        });
-        const dependencies = normalizeConfigDependencyFingerprints(payload.dependencies);
-        if (dependencies === undefined) {
-            throw new Error(`@ttsc/lint: lint config ${configPath} evaluator returned malformed dependency fingerprints`);
-        }
-        return { dependencies, entries };
-    }
-    finally {
-        removeEvaluationTempDir(tempDir);
-    }
-}
-// ────────────────────────────────────────────────────────────────────────────
-// Config cache (shared with the Go sidecar — packages/lint/linthost/config.go)
-// ────────────────────────────────────────────────────────────────────────────
-/** Create evaluator storage beneath a frozen physical parent. */
-function createCanonicalTempDirectory(prefix, parent) {
-    const physicalParent = node_fs_1.default.realpathSync.native(parent);
-    if (!node_fs_1.default.lstatSync(physicalParent).isDirectory()) {
-        throw new Error(`@ttsc/lint: temporary directory parent is not a directory: ${physicalParent}`);
-    }
-    const directory = node_fs_1.default.mkdtempSync(node_path_1.default.join(physicalParent, prefix));
-    if (!node_fs_1.default.lstatSync(directory).isDirectory()) {
-        throw new Error(`@ttsc/lint: temporary directory postflight is not a directory: ${directory}`);
-    }
-    const physicalDirectory = node_fs_1.default.realpathSync.native(directory);
-    if (node_path_1.default.dirname(physicalDirectory) !== physicalParent) {
-        throw new Error(`@ttsc/lint: temporary directory escaped its physical parent: ${physicalDirectory}`);
-    }
-    return physicalDirectory;
-}
-/**
- * Namespaces the on-disk config cache. Kept in lockstep with the Go sidecar's
- * `configCacheVersion`; bump both when the cached shape changes.
- */
-const CONFIG_CACHE_VERSION = "v7";
-/**
- * Directory shared by this factory and the Go sidecar for cached lint configs.
- * The two write different files (the `kind` segment of the cache key keeps
- * their namespaces apart), so they coexist without collision.
- */
-function configCacheDir() {
-    return node_path_1.default.join(node_os_1.default.tmpdir(), "ttsc-lint-config-cache");
-}
-/** Env opt-out, mirroring the Go sidecar's `TTSC_LINT_DISABLE_CONFIG_CACHE`. */
-function configCacheDisabled() {
-    return Boolean(process.env.TTSC_LINT_DISABLE_CONFIG_CACHE);
-}
-/**
- * Content-addressed cache key for a lint config file. Mirrors the Go sidecar's
- * `configCacheKey`: a version tag, a namespace `kind`, the config's absolute
- * path, and its exact bytes. Returns "" — a "do not cache" signal — when the
- * file cannot be read or the env opt-out is set.
- */
-function configCacheKey(kind, configPath) {
-    if (configCacheDisabled())
-        return "";
-    let content;
-    try {
-        content = node_fs_1.default.readFileSync(configPath);
-    }
-    catch {
-        return "";
-    }
-    return (0, node_crypto_1.createHash)("sha256")
-        .update(CONFIG_CACHE_VERSION)
-        .update("\0")
-        .update(kind)
-        .update("\0")
-        .update(node_path_1.default.resolve(configPath))
-        .update("\0")
-        .update(content)
-        .digest("hex");
-}
-/**
- * Returns the cached plugin-entry list for `cacheKey`, or undefined on any miss
- * — a missing file, an unreadable file, or content that is not a JSON array.
- * Every failure is a soft miss: the caller re-evaluates.
- */
-function readConfigPluginCache(cacheKey) {
-    let body;
-    try {
-        body = node_fs_1.default.readFileSync(node_path_1.default.join(configCacheDir(), `${cacheKey}.json`), "utf8");
-    }
-    catch {
-        return undefined;
-    }
-    try {
-        const parsed = JSON.parse(body);
-        if (parsed === null ||
-            typeof parsed !== "object" ||
-            !Array.isArray(parsed.entries) ||
-            !Array.isArray(parsed.dependencies)) {
-            return undefined;
-        }
-        const dependencies = normalizeConfigDependencyFingerprints(parsed.dependencies);
-        if (dependencies === undefined)
-            return undefined;
-        return {
-            dependencies,
-            entries: parsed.entries,
-        };
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Writes `entries` to the config cache under `cacheKey`. Best-effort: any
- * failure leaves the cache cold rather than aborting plugin discovery. The
- * temp-file + rename keeps a concurrent reader in a sibling `ttsc` process from
- * observing a half-written file.
- */
-function writeConfigPluginCache(cacheKey, evaluation) {
-    try {
-        const dir = configCacheDir();
-        node_fs_1.default.mkdirSync(dir, { recursive: true });
-        const tmp = node_path_1.default.join(dir, `${cacheKey}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
-        try {
-            node_fs_1.default.writeFileSync(tmp, JSON.stringify(evaluation), "utf8");
-            node_fs_1.default.renameSync(tmp, node_path_1.default.join(dir, `${cacheKey}.json`));
-        }
-        finally {
-            try {
-                node_fs_1.default.unlinkSync(tmp);
-            }
-            catch {
-                // A successful rename already consumed the temporary path.
-            }
-        }
-    }
-    catch {
-        // Cold cache on failure — the next invocation re-evaluates.
-    }
-}
-function normalizeConfigDependencyFingerprints(value) {
-    if (!Array.isArray(value) || value.length === 0)
-        return undefined;
-    const dependencies = new Map();
-    for (const candidate of value) {
-        if (candidate === null ||
-            typeof candidate !== "object" ||
-            typeof candidate.path !== "string" ||
-            typeof candidate.digest !== "string" ||
-            typeof candidate.identityStable !==
-                "boolean" ||
-            (candidate.realpath !== null &&
-                (typeof candidate.realpath !==
-                    "string" ||
-                    !node_path_1.default.isAbsolute(candidate.realpath))) ||
-            !["directory", "file", "optional-file"].includes(candidate.kind) ||
-            !["cache", "watch"].includes(candidate.scope)) {
-            return undefined;
-        }
-        const candidatePath = candidate.path;
-        const digest = candidate.digest;
-        const kind = candidate.kind;
-        const identityStable = candidate
-            .identityStable;
-        const realpath = candidate.realpath;
-        const scope = candidate.scope;
-        if (!node_path_1.default.isAbsolute(candidatePath) ||
-            (digest !== "" && !/^[0-9a-f]{64}$/.test(digest))) {
-            return undefined;
-        }
-        const location = node_path_1.default.resolve(candidatePath);
-        // The same lexical path can be both a traversed directory and an exact
-        // file candidate. Those observations have different freshness contracts:
-        // one fingerprints the listing, while the other fingerprints its entry
-        // type. Preserve both, but still reject contradictory duplicates of one
-        // kind.
-        const key = kind + "\0" + location;
-        const previous = dependencies.get(key);
-        if (previous !== undefined &&
-            (previous.digest !== digest ||
-                previous.identityStable !== identityStable ||
-                previous.kind !== kind ||
-                previous.realpath !== realpath ||
-                previous.scope !== scope)) {
-            return undefined;
-        }
-        dependencies.set(key, {
-            digest,
-            identityStable,
-            kind,
-            path: location,
-            realpath,
-            scope,
-        });
-    }
-    return [...dependencies.values()].sort((left, right) => left.path.localeCompare(right.path));
-}
-function configDependenciesAreCurrent(dependencies) {
-    if (dependencies.length === 0)
-        return false;
-    return dependencies.every((dependency) => {
-        if (!dependency.identityStable ||
-            dependency.realpath !== hostInputRealpath(dependency.path)) {
-            return false;
-        }
-        if (!/^[0-9a-f]{64}$/.test(dependency.digest))
-            return false;
-        try {
-            const digest = dependency.kind === "directory"
-                ? configDirectoryDigest(dependency.path)
-                : dependency.kind === "optional-file"
-                    ? configOptionalFileDigest(dependency.path)
-                    : (0, node_crypto_1.createHash)("sha256")
-                        .update(node_fs_1.default.readFileSync(dependency.path))
-                        .digest("hex");
-            return digest === dependency.digest;
-        }
-        catch {
-            return false;
-        }
-    });
-}
-function configDirectoryDigest(location) {
-    const entries = [];
-    if (process.platform === "win32") {
-        for (const entry of node_fs_1.default.readdirSync(location, { withFileTypes: true })) {
-            let target = node_buffer_1.Buffer.alloc(0);
-            if (entry.isSymbolicLink()) {
-                try {
-                    target = node_buffer_1.Buffer.from(node_fs_1.default.readlinkSync(node_path_1.default.join(location, entry.name)), "utf8");
-                }
-                catch {
-                    target = node_buffer_1.Buffer.from("<unreadable>");
-                }
-            }
-            entries.push(configDirectoryDigestRecord(node_buffer_1.Buffer.from(entry.name), entry, target));
-        }
-    }
-    else {
-        for (const entry of node_fs_1.default.readdirSync(location, {
-            encoding: "buffer",
-            withFileTypes: true,
-        })) {
-            let target = node_buffer_1.Buffer.alloc(0);
-            if (entry.isSymbolicLink()) {
-                try {
-                    target = node_fs_1.default.readlinkSync(node_buffer_1.Buffer.concat([
-                        node_buffer_1.Buffer.from(location),
-                        node_buffer_1.Buffer.from(node_path_1.default.sep),
-                        entry.name,
-                    ]), { encoding: "buffer" });
-                }
-                catch {
-                    target = node_buffer_1.Buffer.from("<unreadable>");
-                }
-            }
-            entries.push(configDirectoryDigestRecord(entry.name, entry, target));
-        }
-    }
-    entries.sort(node_buffer_1.Buffer.compare);
-    const serialized = node_buffer_1.Buffer.concat(entries.flatMap((entry, index) => index === 0 ? [entry] : [node_buffer_1.Buffer.from([0]), entry]));
-    return (0, node_crypto_1.createHash)("sha256").update(serialized).digest("hex");
-}
-function configDirectoryDigestRecord(name, entry, target) {
-    const kind = entry.isDirectory()
-        ? "directory"
-        : entry.isFile()
-            ? "file"
-            : entry.isSymbolicLink()
-                ? "symlink"
-                : "other";
-    return node_buffer_1.Buffer.concat([name, node_buffer_1.Buffer.from("\0" + kind + "\0"), target]);
-}
-function configOptionalFileDigest(location) {
-    try {
-        const entry = node_fs_1.default.statSync(location);
-        if (entry.isFile()) {
-            return (0, node_crypto_1.createHash)("sha256")
-                .update(node_buffer_1.Buffer.concat([node_buffer_1.Buffer.from("file\0"), node_fs_1.default.readFileSync(location)]))
-                .digest("hex");
-        }
-        if (entry.isDirectory()) {
-            return (0, node_crypto_1.createHash)("sha256")
-                .update("ttsc:host-input:directory\0")
-                .digest("hex");
-        }
-    }
-    catch {
-        // Missing and unreadable candidates share the absent state.
-    }
-    return (0, node_crypto_1.createHash)("sha256").update("missing\0").digest("hex");
-}
-// ────────────────────────────────────────────────────────────────────────────
-// Shared helpers
-// ────────────────────────────────────────────────────────────────────────────
-function collectPluginObjectsFromConfig(value) {
-    const out = [];
-    const visit = (node) => {
-        if (Array.isArray(node)) {
-            for (const item of node)
-                visit(item);
-            return;
-        }
-        if (typeof node !== "object" || node === null)
-            return;
-        const obj = node;
-        const plugins = obj.plugins;
-        if (typeof plugins === "object" &&
-            plugins !== null &&
-            !Array.isArray(plugins)) {
-            out.push(plugins);
-        }
-    };
-    visit(value);
-    return out;
-}
-function normalizePluginValue(namespace, value, configPath) {
-    if (!NAMESPACE_PATTERN.test(namespace)) {
-        throw new Error(`@ttsc/lint: lint config ${configPath} namespace ${JSON.stringify(namespace)} must match /^[a-z][a-z0-9_-]*$/`);
-    }
-    if (typeof value === "string") {
-        // For .js/.cjs configs, a string value would be an npm specifier
-        // (matching JSON behavior). require it through the config's own
-        // module resolution.
-        const requireFromConfig = (0, node_module_1.createRequire)(configPath);
-        let resolved;
-        try {
-            resolved = requireFromConfig.resolve(value);
-        }
-        catch (error) {
-            throw new Error(`@ttsc/lint: lint config ${configPath} plugin ${JSON.stringify(namespace)} failed to resolve "${value}": ${error instanceof Error ? error.message : String(error)}`);
-        }
-        let mod;
-        try {
-            mod = requireFromConfig(resolved);
-        }
-        catch (error) {
-            throw new Error(`@ttsc/lint: lint config ${configPath} plugin ${JSON.stringify(namespace)} failed to load from ${resolved}: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        const plugin = validatePluginShape(unwrapDefault(mod), namespace, resolved);
-        return { namespace, source: plugin.source };
-    }
-    if (typeof value === "object" && value !== null) {
-        const plugin = validatePluginShape(value, namespace, configPath);
-        return { namespace, source: plugin.source };
-    }
-    throw new Error(`@ttsc/lint: lint config ${configPath} plugin ${JSON.stringify(namespace)} must be a plugin object or specifier string; got ${typeof value}`);
-}
-function validatePluginShape(candidate, namespace, origin) {
-    if (typeof candidate !== "object" || candidate === null) {
-        throw new Error(`@ttsc/lint: contributor "${namespace}" loaded from ${origin} did not export an object`);
-    }
-    const obj = candidate;
-    if (typeof obj.source !== "string" || obj.source.length === 0) {
-        throw new Error(`@ttsc/lint: contributor "${namespace}" from ${origin} is missing a string "source" field`);
-    }
-    if (!node_path_1.default.isAbsolute(obj.source)) {
-        throw new Error(`@ttsc/lint: contributor "${namespace}" from ${origin} "source" must be an absolute path; got ${JSON.stringify(obj.source)}. Use path.resolve(__dirname, ...).`);
-    }
-    if (!node_fs_1.default.existsSync(obj.source) || !node_fs_1.default.statSync(obj.source).isDirectory()) {
-        throw new Error(`@ttsc/lint: contributor "${namespace}" from ${origin} "source" must be an existing directory: ${obj.source}`);
-    }
-    return obj;
-}
-function unwrapDefault(mod) {
-    let current = mod;
-    for (let i = 0; i < 8; i++) {
-        if (current !== null &&
-            typeof current === "object" &&
-            "default" in current) {
-            const next = current.default;
-            if (next !== undefined) {
-                current = next;
-                continue;
-            }
-        }
-        break;
-    }
-    return current;
-}
-function findNearestNodeModules(start) {
-    let dir = node_path_1.default.resolve(start);
-    while (true) {
-        const candidate = node_path_1.default.join(dir, "node_modules");
-        if (node_fs_1.default.existsSync(candidate) && node_fs_1.default.statSync(candidate).isDirectory()) {
-            return candidate;
-        }
-        const parent = node_path_1.default.dirname(dir);
-        if (parent === dir)
-            return undefined;
-        dir = parent;
-    }
-}
-/**
- * The loader tsconfig's `module` for a given config file: the module kind Node
- * would give the file itself.
- *
- * An explicit `.cts`/`.cjs` or `.mts`/`.mjs` extension already decides the emit
- * format on its own, so those keep the ES-module setting and let the extension
- * win — the same precedence tsgo applies. Everything ambiguous walks up for the
- * nearest `package.json` `type`, exactly as Node does when it loads the file.
- */
-function configModuleOption(configPath) {
-    const extension = node_path_1.default.extname(configPath).toLowerCase();
-    if (extension !== ".ts" && extension !== ".tsx" && extension !== ".js") {
-        return "ESNext";
-    }
-    return nearestPackageType(configPath) === "commonjs" ? "CommonJS" : "ESNext";
-}
-/**
- * Nearest `package.json` `"type"` at or above `configPath`, mirroring Node's
- * package-scope lookup: the walk stops at the **first** manifest it finds, and
- * a manifest that declares no `"type"` means CommonJS rather than a reason to
- * keep climbing. Reaching the filesystem root without any manifest also means
- * CommonJS.
- */
-function nearestPackageType(configPath) {
-    let dir = node_path_1.default.dirname(node_path_1.default.resolve(configPath));
-    for (;;) {
-        // One read rather than a stat-then-read: an unreadable entry and a missing
-        // one are the same answer here — keep walking — and the Go loaders resolve
-        // it the same way, so the four implementations of this rule cannot drift.
-        let raw;
-        try {
-            raw = node_fs_1.default.readFileSync(node_path_1.default.join(dir, "package.json"), "utf8");
-        }
-        catch {
-            raw = undefined;
-        }
-        if (raw !== undefined) {
-            try {
-                const manifest = JSON.parse(raw);
-                const type = typeof manifest === "object" && manifest !== null
-                    ? manifest.type
-                    : undefined;
-                return type === "module" ? "module" : "commonjs";
-            }
-            catch {
-                // A manifest that does not parse still bounds the package scope; Node
-                // refuses to look past it, and CommonJS is the format it defaults to.
-                return "commonjs";
-            }
-        }
-        const parent = node_path_1.default.dirname(dir);
-        if (parent === dir) {
-            return "commonjs";
-        }
-        dir = parent;
-    }
-}
-function linkNearestNodeModules(tempDir, sourceDir) {
-    const nodeModules = findNearestNodeModules(sourceDir);
-    if (!nodeModules)
-        return;
-    const link = node_path_1.default.join(tempDir, "node_modules");
-    try {
-        node_fs_1.default.symlinkSync(nodeModules, link, "junction");
-    }
-    catch (error) {
-        const code = error.code;
-        if (code !== "EEXIST") {
-            throw new Error(`@ttsc/lint: failed to link node_modules from ${nodeModules}: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-}
-/**
- * Picks the parent directory for the ephemeral config-loader tree. The system
- * temp dir is the default, but when it sits on a different volume than the
- * config file (Windows: TEMP on `C:`, project on `D:`) the loader cannot work
- * from there — no single tsconfig `rootDir` spans two volumes and
- * `path.relative` cannot produce a relative import across drives (#305) — so
- * the tree is created under the config's nearest `node_modules/.cache` instead,
- * falling back to the config's own directory when no `node_modules` exists (or
- * its `.cache` cannot be created): any location on the config's volume beats
- * the system temp dir, which is guaranteed to fail. Keeps the system temp dir
- * when the volumes already match.
- */
-function loaderTempBase(configPath) {
-    const systemTemp = node_os_1.default.tmpdir();
-    const systemRoot = node_path_1.default.parse(systemTemp).root;
-    const configRoot = node_path_1.default.parse(configPath).root;
-    // A relative config path has no root; "" must not be read as "a volume
-    // other than the system temp's" — it keeps the historical default.
-    if (configRoot === "" ||
-        systemRoot.toLowerCase() === configRoot.toLowerCase()) {
-        return systemTemp;
-    }
-    const nodeModules = findNearestNodeModules(node_path_1.default.dirname(configPath));
-    if (!nodeModules)
-        return node_path_1.default.dirname(configPath);
-    const base = node_path_1.default.join(nodeModules, ".cache");
-    try {
-        node_fs_1.default.mkdirSync(base, { recursive: true });
-        // Resolve symlinks/junctions now (a linked node_modules is common):
-        // Node's ESM loader realpaths the loader module at import time, and a
-        // relative config specifier computed from the link-form path would
-        // resolve against the wrong directory. Realpathing may also land on
-        // another volume, which defeats the whole point — fall through then.
-        const real = node_fs_1.default.realpathSync(base);
-        if (node_path_1.default.parse(real).root.toLowerCase() === configRoot.toLowerCase()) {
-            return real;
-        }
-    }
-    catch {
-        // fall through to the config's own directory
-    }
-    return node_path_1.default.dirname(configPath);
-}
-function nodeConfigLoaderEnv(configPath) {
-    const env = { ...process.env };
-    const parts = [];
-    const nodeModules = findNearestNodeModules(node_path_1.default.dirname(configPath));
-    if (nodeModules)
-        parts.push(nodeModules);
-    if (env.NODE_PATH)
-        parts.push(env.NODE_PATH);
-    if (parts.length > 0) {
-        env.NODE_PATH = parts.join(node_path_1.default.delimiter);
-    }
-    return env;
-}
-/**
- * Where the isolated config evaluator lives.
- *
- * An explicit override wins. Otherwise the launcher is resolved out of a ttsc
- * installation one of the anchors can see, because a bare command name only
- * works when a bin link happens to be on PATH — which it is for a spawned CLI
- * and is not for a host that loaded this descriptor in process. The bare name
- * remains the last resort for an installation none of them reach.
- */
-/**
- * The native TypeScript compiler the config evaluator must run.
- *
- * The evaluator builds the loader in an ephemeral directory, so the child it
- * spawns cannot discover `typescript` the way an ordinary invocation does: the
- * directory is not in the project, and `linkNearestNodeModules` is the only
- * thing that puts the project's modules within reach of it. Leaving the child
- * to re-derive the compiler from there made this work by inheritance —
- * `TTSC_TSGO_BINARY` is exported by `ttsx` to its own descendants, so a build
- * launched under `ttsx` passed a binary down and a build launched any other way
- * did not. A published consumer exports no such variable, and neither does a
- * process that deliberately sheds the launcher's runtime state, and for those
- * the evaluator failed with `ttsc: typescript is required` before it read a
- * line of the config.
- *
- * The host has already resolved a compiler for the project it is linting, so
- * the answer is asked of the project rather than of the environment. The config
- * comes first and the descriptor's own location second, the same order and for
- * the same reason as {@link resolveTtsxLauncher}. An explicit `TTSC_TSGO_BINARY`
- * still wins, so an embedder that pins a compiler keeps pinning it.
- *
- * Returning `undefined` leaves the child to resolve for itself, which is what
- * it did before: a project that cannot answer here could not answer there
- * either, and the child's own diagnostic is the one that names the missing
- * package.
- */
-function resolveConfigTsgo(configPath, context) {
-    const explicit = process.env.TTSC_TSGO_BINARY?.trim();
-    if (explicit)
-        return explicit;
-    const anchors = [
-        configPath,
-        node_path_1.default.join(context.projectRoot, "package.json"),
-        context.dirname,
-    ];
-    for (const anchor of anchors) {
-        const binary = tsgoBinaryFrom(anchor);
-        if (binary !== undefined)
-            return binary;
-    }
-    return undefined;
-}
-/**
- * The platform compiler binary of the `typescript` install `anchor` can see, or
- * `undefined` when this anchor reaches neither the package nor its platform
- * dependency. Mirrors ttsc's own resolution order so both name one file.
- */
-function tsgoBinaryFrom(anchor) {
-    try {
-        const manifest = (0, node_module_1.createRequire)(anchor).resolve("typescript/package.json");
-        const platform = (0, node_module_1.createRequire)(manifest).resolve(`@typescript/typescript-${process.platform}-${process.arch}/package.json`);
-        const binary = node_path_1.default.join(node_path_1.default.dirname(platform), "lib", process.platform === "win32" ? "tsc.exe" : "tsc");
-        return node_fs_1.default.existsSync(binary) ? binary : undefined;
-    }
-    catch {
-        // This anchor cannot see the compiler; the caller tries the next one.
-        return undefined;
-    }
-}
-function resolveTtsxLauncher(anchors) {
-    const explicit = process.env.TTSC_TTSX_BINARY?.trim();
-    if (explicit)
-        return explicit;
-    for (const anchor of anchors) {
-        const launcher = ttsxLauncherFrom(anchor);
-        if (launcher !== undefined)
-            return launcher;
-    }
-    return "ttsx";
-}
-function ttsxLauncherFrom(anchor) {
-    try {
-        // Only the manifest is exported, so the launcher is derived from where the
-        // manifest resolved rather than requested as a subpath. Resolution is
-        // anchored on the config being evaluated, which is how every other
-        // resolution in this descriptor is anchored and picks the ttsc the project
-        // actually installed.
-        const manifest = (0, node_module_1.createRequire)(anchor).resolve("ttsc/package.json");
-        const launcher = node_path_1.default.join(node_path_1.default.dirname(manifest), "lib", "launcher", "ttsx.js");
-        if (node_fs_1.default.existsSync(launcher))
-            return launcher;
-    }
-    catch {
-        // This anchor cannot see ttsc; the caller tries the next one.
-    }
-    return undefined;
-}
-function ttsxThroughNodeIfNeeded(binary) {
-    const ext = node_path_1.default.extname(binary).toLowerCase();
-    if ([".js", ".cjs", ".mjs", ".ts", ".cts", ".mts"].includes(ext)) {
-        return { binary: process.execPath, prefix: [binary] };
-    }
-    return { binary, prefix: [] };
-}
-/**
- * Remove an evaluation temp directory without letting cleanup replace a result.
- *
- * This runs from a `finally`, so a throw here would surface instead of the
- * evaluation's own outcome — and on Windows a grandchild that inherited a
- * handle, or a scanner holding the file, can make removal fail. Leaving bytes
- * in the system temp directory is by far the lesser outcome.
- */
-function removeEvaluationTempDir(directory) {
-    try {
-        node_fs_1.default.rmSync(directory, { force: true, recursive: true });
-    }
-    catch {
-        // Best effort.
-    }
-}
 //# sourceMappingURL=index.js.map