@ttsc/strip 0.26.2 → 0.27.0

package/driver/config.go

@@ -3,6 +3,7 @@ package strip
 import (
   "bytes"
   "context"
+  "crypto/sha256"
   "encoding/json"
   "fmt"
   "os"
@@ -41,6 +42,14 @@ var allowedTsconfigKeys = map[string]struct{}{
 // configuration from either an explicit configFile or an auto-discovered
 // strip.config.* file. Returns the raw config map ready for parseStrip.
 func loadStripConfigMap(pluginConfig map[string]any, cwd, tsconfigPath string) (map[string]any, error) {
+  return loadStripConfigMapWithReporter(pluginConfig, cwd, tsconfigPath, nil)
+}
+
+func loadStripConfigMapWithReporter(pluginConfig map[string]any, cwd, tsconfigPath string, reporter func(string)) (map[string]any, error) {
+  return loadStripConfigMapWithReporters(pluginConfig, cwd, tsconfigPath, reporter, nil, nil)
+}
+
+func loadStripConfigMapWithReporters(pluginConfig map[string]any, cwd, tsconfigPath string, reporter func(string), hashReporter, realpathReporter func(string, *string)) (map[string]any, error) {
   // Reject any key that @ttsc/strip does not recognise. This surfaces
   // stale inline keys (calls, statements) with a clear error so users
   // migrate to a config file instead of silently using defaults.
@@ -81,11 +90,12 @@ func loadStripConfigMap(pluginConfig map[string]any, cwd, tsconfigPath string) (
     return map[string]any{}, nil
   }
 
-  raw, err := loadStripConfigFile(configFilePath, resolutionRoot)
+  loaded, err := loadStripConfigFileWithInputs(configFilePath, resolutionRoot)
   if err != nil {
     return nil, err
   }
-  cfg, ok := raw.(map[string]any)
+  reportStripConfigInputs(loaded.inputs, loaded.hashes, loaded.realpaths, reporter, hashReporter, realpathReporter)
+  cfg, ok := loaded.value.(map[string]any)
   if !ok {
     return nil, fmt.Errorf("@ttsc/strip: config file %s must export an object", configFilePath)
   }
@@ -157,16 +167,117 @@ func resolveStripConfigFilePath(configPath, cwd, tsconfigPath string) string {
 // see stripConfigToolAnchors. The JSON and JS branches spawn no ttsx and
 // ignore it.
 func loadStripConfigFile(location, resolutionRoot string) (any, error) {
+  loaded, err := loadStripConfigFileWithInputs(location, resolutionRoot)
+  return loaded.value, err
+}
+
+type stripLoadedConfig struct {
+  hashes    map[string]*string
+  inputs    []string
+  realpaths map[string]*string
+  value     any
+}
+
+func loadStripConfigFileWithInputs(location, resolutionRoot string) (stripLoadedConfig, error) {
   ext := strings.ToLower(filepath.Ext(location))
   switch ext {
   case ".json":
-    return loadStripJSONConfigFile(location)
+    body, err := os.ReadFile(location)
+    if err != nil {
+      return stripLoadedConfig{}, fmt.Errorf("@ttsc/strip: read config file %s: %w", location, err)
+    }
+    value, err := parseStripJSONConfigFile(location, body)
+    digest := fmt.Sprintf("%x", sha256.Sum256(body))
+    return stripLoadedConfig{hashes: map[string]*string{location: &digest}, inputs: []string{location}, realpaths: map[string]*string{location: stripPhysicalHostInput(location)}, value: value}, err
   case ".js", ".cjs", ".mjs":
-    return loadStripScriptConfigFile(location)
+    return loadStripScriptConfigFileWithInputs(location)
   case ".ts", ".cts", ".mts":
-    return loadStripTypeScriptConfigFile(location, resolutionRoot)
+    return loadStripTypeScriptConfigFileWithInputs(location, resolutionRoot)
   default:
-    return nil, fmt.Errorf("@ttsc/strip: unsupported config file extension %q for %s", ext, location)
+    return stripLoadedConfig{}, fmt.Errorf("@ttsc/strip: unsupported config file extension %q for %s", ext, location)
+  }
+}
+
+func reportStripConfigInputs(inputs []string, hashes, realpaths map[string]*string, reporter func(string), hashReporter, realpathReporter func(string, *string)) {
+  if reporter == nil && hashReporter == nil && realpathReporter == nil {
+    return
+  }
+  for _, input := range inputs {
+    if reporter != nil {
+      reporter(input)
+    }
+    if hashReporter != nil {
+      if hash, ok := hashes[input]; ok {
+        hashReporter(input, hash)
+      }
+    }
+    if realpathReporter != nil {
+      if realpath, ok := realpaths[input]; ok {
+        realpathReporter(input, realpath)
+      }
+    }
+  }
+}
+
+func stripPhysicalHostInput(file string) *string {
+  resolved, err := filepath.Abs(file)
+  if err != nil {
+    return nil
+  }
+  resolved = filepath.Clean(resolved)
+  seen := make(map[string]struct{})
+  for range 255 {
+    if _, exists := seen[resolved]; exists {
+      return nil
+    }
+    seen[resolved] = struct{}{}
+    if evaluated, evalErr := filepath.EvalSymlinks(resolved); evalErr == nil {
+      evaluated, evalErr = filepath.Abs(evaluated)
+      if evalErr != nil {
+        return nil
+      }
+      evaluated = filepath.Clean(evaluated)
+      if _, statErr := os.Stat(evaluated); statErr != nil {
+        return nil
+      }
+      return &evaluated
+    }
+    next, ok := stripResolveHostInputLinkAncestor(resolved)
+    if !ok {
+      return nil
+    }
+    resolved = next
+  }
+  return nil
+}
+
+// stripResolveHostInputLinkAncestor follows the nearest link-like ancestor and
+// reattaches its remaining suffix. Windows junction children can be opened and
+// os.Readlink exposes the junction itself even when EvalSymlinks rejects the
+// complete child path.
+func stripResolveHostInputLinkAncestor(location string) (string, bool) {
+  probe := filepath.Clean(location)
+  suffix := make([]string, 0)
+  for {
+    if target, err := os.Readlink(probe); err == nil {
+      if !filepath.IsAbs(target) {
+        target = filepath.Join(filepath.Dir(probe), target)
+      }
+      for i := len(suffix) - 1; i >= 0; i-- {
+        target = filepath.Join(target, suffix[i])
+      }
+      absolute, absErr := filepath.Abs(target)
+      if absErr != nil {
+        return "", false
+      }
+      return filepath.Clean(absolute), true
+    }
+    parent := filepath.Dir(probe)
+    if parent == probe {
+      return "", false
+    }
+    suffix = append(suffix, filepath.Base(probe))
+    probe = parent
   }
 }
 
@@ -178,6 +289,10 @@ func loadStripJSONConfigFile(location string) (any, error) {
   if err != nil {
     return nil, fmt.Errorf("@ttsc/strip: read config file %s: %w", location, err)
   }
+  return parseStripJSONConfigFile(location, body)
+}
+
+func parseStripJSONConfigFile(location string, body []byte) (any, error) {
   body = bytes.TrimPrefix(body, []byte{0xEF, 0xBB, 0xBF})
   var out any
   if err := json.Unmarshal(body, &out); err != nil {
@@ -190,7 +305,201 @@ func loadStripJSONConfigFile(location string) (any, error) {
 // loadStripScriptConfigFile to evaluate a .js/.cjs/.mjs strip config and
 // serialize the result to stdout as JSON.
 const stripScriptLoaderSource = `
-const { pathToFileURL } = require("node:url");
+const { createRequire, isBuiltin, registerHooks } = require("node:module");
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+const { fileURLToPath, pathToFileURL } = require("node:url");
+const inputs = new Set();
+const hashes = new Map();
+const realpaths = new Map();
+const signatures = new Map();
+const unstableHashes = new Set();
+
+function existingFile(file) {
+  try { return fs.statSync(file).isFile(); }
+  catch { return false; }
+}
+
+function missingPathError(error) {
+  return error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+}
+
+function inputMetadataSignature(file) {
+  const requested = path.resolve(file);
+  let current = requested;
+  for (;;) {
+    try {
+      const link = fs.lstatSync(current, { bigint: true });
+      let target = link;
+      if (link.isSymbolicLink()) {
+        try { target = fs.statSync(current, { bigint: true }); }
+        catch { return undefined; }
+      }
+      return [path.relative(current, requested), link.dev, link.ino, link.mode, link.size, link.mtimeNs, link.ctimeNs, target.dev, target.ino, target.mode, target.size, target.mtimeNs, target.ctimeNs].join(":");
+    } catch (error) {
+      if (!missingPathError(error)) return undefined;
+      const parent = path.dirname(current);
+      if (parent === current) return undefined;
+      current = parent;
+    }
+  }
+}
+
+function recordInput(file) {
+  file = path.resolve(file);
+  inputs.add(file);
+  if (unstableHashes.has(file)) return;
+  const beforeSignature = inputMetadataSignature(file);
+  let observed;
+  let observedRealpath;
+  try { observed = fs.statSync(file).isDirectory() ? crypto.createHash("sha256").update("ttsc:host-input:directory\\0").digest("hex") : crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex"); }
+  catch { observed = null; }
+  try { observedRealpath = fs.realpathSync.native(file); }
+  catch { observedRealpath = null; }
+  const afterSignature = inputMetadataSignature(file);
+  if (beforeSignature === undefined || afterSignature === undefined || beforeSignature !== afterSignature || (signatures.has(file) && signatures.get(file) !== afterSignature) || (hashes.has(file) && hashes.get(file) !== observed) || (realpaths.has(file) && realpaths.get(file) !== observedRealpath)) {
+    hashes.delete(file);
+    realpaths.delete(file);
+    signatures.delete(file);
+    unstableHashes.add(file);
+    return;
+  }
+  signatures.set(file, afterSignature);
+  hashes.set(file, observed);
+  realpaths.set(file, observedRealpath);
+}
+
+function recordFile(file) {
+  const resolvedFile = path.resolve(file);
+  recordInput(resolvedFile);
+  for (let directory = path.dirname(resolvedFile);;) {
+    const manifest = path.join(directory, "package.json");
+    recordInput(manifest);
+    if (existingFile(manifest)) {
+      break;
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory) {
+      break;
+    }
+    directory = parent;
+  }
+}
+
+function recordPackageManifests(file) {
+  for (let directory = path.dirname(path.resolve(file));;) {
+    const manifest = path.join(directory, "package.json");
+    recordInput(manifest);
+    if (existingFile(manifest)) return;
+    const parent = path.dirname(directory);
+    if (parent === directory) return;
+    directory = parent;
+  }
+}
+
+const moduleProbeExtensions = [".ts", ".tsx", ".mts", ".cts", ".js", ".mjs", ".cjs", ".json", ".node"];
+function moduleCandidates(base) {
+  return [
+    base,
+    ...moduleProbeExtensions.map((extension) => base + extension),
+    path.join(base, "package.json"),
+    ...moduleProbeExtensions.map((extension) => path.join(base, "index" + extension)),
+  ];
+}
+const recordedModuleBases = new Set();
+function recordManifestTargets(value, directory, allowBare = false) {
+  if (typeof value === "string") {
+    if (value !== "" && (allowBare || value.startsWith("./") || value.startsWith("../"))) recordModuleCandidates(path.resolve(directory, value));
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) recordManifestTargets(item, directory, allowBare);
+    return;
+  }
+  if (value && typeof value === "object") {
+    for (const item of Object.values(value)) recordManifestTargets(item, directory, allowBare);
+  }
+}
+function recordModuleCandidates(base) {
+  const resolvedBase = path.resolve(base);
+  if (recordedModuleBases.has(resolvedBase)) return;
+  recordedModuleBases.add(resolvedBase);
+  for (const candidate of moduleCandidates(resolvedBase)) recordInput(candidate);
+  try {
+    const manifest = JSON.parse(fs.readFileSync(path.join(resolvedBase, "package.json"), "utf8").replace(/^\uFEFF/, ""));
+    recordManifestTargets(manifest.exports, resolvedBase);
+    recordManifestTargets(manifest.module, resolvedBase, true);
+    recordManifestTargets(manifest.main, resolvedBase, true);
+  } catch {}
+}
+function candidateSelected(base, resolvedFile) {
+  for (const candidate of moduleCandidates(base)) {
+    try {
+      const canonical = fs.realpathSync.native(candidate);
+      const relative = path.relative(canonical, resolvedFile);
+      if (relative === "" || (fs.statSync(canonical).isDirectory() && relative !== ".." && !relative.startsWith(".." + path.sep) && !path.isAbsolute(relative))) return true;
+    } catch {}
+  }
+  return false;
+}
+function localBases(specifier, parentDirectory) {
+  if (specifier.startsWith("file:")) return [fileURLToPath(specifier)];
+  const raw = path.resolve(parentDirectory, specifier);
+  const suffixStart = specifier.search(/[?#]/);
+  if (suffixStart === -1) return [raw];
+  const pathname = specifier.slice(0, suffixStart);
+  return pathname === "" ? [raw] : [...new Set([raw, path.resolve(parentDirectory, pathname)])];
+}
+function recordResolutionCandidates(specifier, parentURL, resolvedURL) {
+  if (typeof parentURL !== "string" || !parentURL.startsWith("file:")) return;
+  const parentDirectory = path.dirname(fileURLToPath(parentURL));
+  let resolvedFile;
+  try {
+    resolvedFile = typeof resolvedURL === "string" && resolvedURL.startsWith("file:")
+      ? fs.realpathSync.native(fileURLToPath(resolvedURL))
+      : undefined;
+  } catch {}
+  if (specifier.startsWith(".") || path.isAbsolute(specifier) || specifier.startsWith("file:")) {
+    try {
+      for (const base of localBases(specifier, parentDirectory)) {
+        recordPackageManifests(base);
+        let exact = false;
+        try { exact = resolvedFile === undefined ? fs.statSync(base).isFile() : fs.realpathSync.native(base) === resolvedFile; } catch {}
+        if (exact) recordInput(base);
+        else recordModuleCandidates(base);
+      }
+    } catch {}
+    return;
+  }
+  if (isBuiltin(specifier) || specifier.startsWith("#")) return;
+  const parts = specifier.split("/");
+  const packageParts = parts[0].startsWith("@") ? parts.slice(0, 2) : parts.slice(0, 1);
+  if (packageParts.some((part) => part === undefined || part === "")) return;
+  const packageName = packageParts.join("/");
+  const subpath = parts.slice(packageParts.length);
+  const searchPaths = createRequire(parentURL).resolve.paths(specifier) ?? [];
+  for (const searchPath of searchPaths) {
+    const packageDirectory = path.join(searchPath, packageName);
+    recordModuleCandidates(packageDirectory);
+    if (subpath.length !== 0) recordModuleCandidates(path.join(packageDirectory, ...subpath));
+    if (resolvedFile !== undefined && candidateSelected(packageDirectory, resolvedFile)) break;
+  }
+}
+
+recordFile(process.argv[1]);
+registerHooks({
+  resolve(specifier, context, nextResolve) {
+    recordResolutionCandidates(specifier, context.parentURL, undefined);
+    const resolved = nextResolve(specifier, context);
+    const url = typeof resolved === "string" ? resolved : resolved && resolved.url;
+    recordResolutionCandidates(specifier, context.parentURL, url);
+    if (typeof url === "string" && url.startsWith("file:")) {
+      recordFile(fileURLToPath(url));
+    }
+    return resolved;
+  },
+});
 
 (async () => {
   const mod = await import(pathToFileURL(process.argv[1]).href);
@@ -206,15 +515,11 @@ const { pathToFileURL } = require("node:url");
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     throw new Error("strip config file must export an object");
   }
-  process.stdout.write(JSON.stringify(value));
+  const serializedValue = JSON.stringify(value);
+  for (const input of [...inputs]) recordInput(input);
+  process.stdout.write(JSON.stringify({ value: JSON.parse(serializedValue), hashes: Object.fromEntries(hashes), inputs: [...inputs].sort(), realpaths: Object.fromEntries(realpaths) }));
 })().catch((error) => {
   process.stderr.write(error && error.stack ? error.stack : String(error));
-  // The stack above is for the reader. This is for the caller: the parent reads
-  // stdout as the payload channel either way, so a failure reason travels as
-  // data rather than as text scraped back out of a captured stream. The exit
-  // code is set before the write so a callback that never fires still fails the
-  // load, and the write's completion is what triggers the exit, because
-  // process.exit abandons a pending pipe write.
   process.exitCode = 1;
   process.stdout.write(JSON.stringify({ __ttscLoaderError: error && error.message ? String(error.message) : String(error) }), () => process.exit(1));
 });
@@ -224,13 +529,26 @@ const { pathToFileURL } = require("node:url");
 // Node subprocess that dynamic-imports the file, resolves the default export,
 // and serializes the result as JSON to stdout.
 func loadStripScriptConfigFile(location string) (any, error) {
+  loaded, err := loadStripScriptConfigFileWithInputs(location)
+  return loaded.value, err
+}
+
+func loadStripScriptConfigFileWithInputs(location string) (stripLoadedConfig, error) {
   node := os.Getenv("TTSC_NODE_BINARY")
   if node == "" {
     node = "node"
   }
   ctx, cancel := context.WithCancel(context.Background())
   defer cancel()
-  cmd := exec.CommandContext(ctx, node, "-e", stripScriptLoaderSource, location)
+  // Windows limits the whole process command line to roughly 32 KiB. The
+  // dependency-tracking loader is intentionally larger than that, so keep only
+  // an explicit CommonJS stdin program and remove Node's stdin sentinel before
+  // the loader runs. This preserves the historical process.argv layout seen by
+  // both the loader and the imported user config without using string eval.
+  cmd := exec.CommandContext(ctx, node, "--input-type=commonjs", "-", location)
+  cmd.Stdin = strings.NewReader(
+    "process.argv.splice(1, 1);\n" + stripScriptLoaderSource,
+  )
   cmd.Env = stripNodeConfigLoaderEnv(location)
   // The child's stderr is human output and goes straight to this process's
   // stderr as it is written. Collecting it only to replay it afterwards is what
@@ -243,15 +561,46 @@ func loadStripScriptConfigFile(location string) (any, error) {
     // What it could not put there is a reason a caller can act on, so that
     // arrives through the payload channel instead.
     if reason := loaderFailureReason(output); reason != "" {
-      return nil, fmt.Errorf("@ttsc/strip: load config file %s: %s", location, reason)
+      return stripLoadedConfig{}, fmt.Errorf("@ttsc/strip: load config file %s: %s", location, reason)
     }
-    return nil, fmt.Errorf("@ttsc/strip: load config file %s: %w", location, err)
+    return stripLoadedConfig{}, fmt.Errorf("@ttsc/strip: load config file %s: %w", location, err)
   }
-  var out any
-  if err := json.Unmarshal(output, &out); err != nil {
-    return nil, fmt.Errorf("@ttsc/strip: parse config file %s output: %w", location, err)
+  loaded, err := decodeStripConfigLoaderOutput(output)
+  if err != nil {
+    return stripLoadedConfig{}, fmt.Errorf("@ttsc/strip: parse config file %s output: %w", location, err)
   }
-  return out, nil
+  return loaded, nil
+}
+
+func decodeStripConfigLoaderOutput(output []byte) (stripLoadedConfig, error) {
+  var envelope struct {
+    Error     string             `json:"__ttscLoaderError"`
+    Hashes    map[string]*string `json:"hashes"`
+    Inputs    []string           `json:"inputs"`
+    Realpaths map[string]*string `json:"realpaths"`
+    Value     json.RawMessage    `json:"value"`
+  }
+  if err := json.Unmarshal(output, &envelope); err != nil {
+    return stripLoadedConfig{}, err
+  }
+  if envelope.Error != "" {
+    return stripLoadedConfig{}, fmt.Errorf("%s", envelope.Error)
+  }
+  if len(envelope.Value) == 0 {
+    // Test/fallback launchers written against the historical payload return
+    // the config value directly. Preserve that accepted contract while real
+    // loaders use the envelope to carry runtime inputs.
+    var value any
+    if err := json.Unmarshal(output, &value); err != nil {
+      return stripLoadedConfig{}, err
+    }
+    return stripLoadedConfig{value: value}, nil
+  }
+  var value any
+  if err := json.Unmarshal(envelope.Value, &value); err != nil {
+    return stripLoadedConfig{}, err
+  }
+  return stripLoadedConfig{hashes: envelope.Hashes, inputs: envelope.Inputs, realpaths: envelope.Realpaths, value: value}, nil
 }
 
 // stripTypeScriptLoaderSource returns the TypeScript source of the ephemeral
@@ -259,7 +608,217 @@ func loadStripScriptConfigFile(location string) (any, error) {
 // importLiteral must be a JSON-encoded relative import path (e.g.
 // `"./strip.config.ts"`) produced by json.Marshal.
 func stripTypeScriptLoaderSource(importLiteral string) string {
-  return fmt.Sprintf(`import * as importedConfig from %s;
+  return fmt.Sprintf(`// @ts-nocheck
+import { createRequire, isBuiltin, registerHooks } from "node:module";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const inputs = new Set<string>();
+const hashes = new Map<string, string | null>();
+const realpaths = new Map<string, string | null>();
+const signatures = new Map<string, string>();
+const unstableHashes = new Set<string>();
+
+function existingFile(file: string): boolean {
+  try { return fs.statSync(file).isFile(); }
+  catch { return false; }
+}
+
+function missingPathError(error: unknown): boolean {
+  const code = (error as { code?: unknown } | undefined)?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+
+function inputMetadataSignature(file: string): string | undefined {
+  const requested = path.resolve(file);
+  let current = requested;
+  for (;;) {
+    try {
+      const link = fs.lstatSync(current, { bigint: true });
+      let target = link;
+      if (link.isSymbolicLink()) {
+        try { target = fs.statSync(current, { bigint: true }); }
+        catch { return undefined; }
+      }
+      return [path.relative(current, requested), link.dev, link.ino, link.mode, link.size, link.mtimeNs, link.ctimeNs, target.dev, target.ino, target.mode, target.size, target.mtimeNs, target.ctimeNs].join(":");
+    } catch (error) {
+      if (!missingPathError(error)) return undefined;
+      const parent = path.dirname(current);
+      if (parent === current) return undefined;
+      current = parent;
+    }
+  }
+}
+
+function recordInput(file: string): void {
+  file = path.resolve(file);
+  inputs.add(file);
+  if (unstableHashes.has(file)) return;
+  const beforeSignature = inputMetadataSignature(file);
+  let observed: string | null;
+  let observedRealpath: string | null;
+  try { observed = fs.statSync(file).isDirectory() ? crypto.createHash("sha256").update("ttsc:host-input:directory\\0").digest("hex") : crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex"); }
+  catch { observed = null; }
+  try { observedRealpath = fs.realpathSync.native(file); }
+  catch { observedRealpath = null; }
+  const afterSignature = inputMetadataSignature(file);
+  if (beforeSignature === undefined || afterSignature === undefined || beforeSignature !== afterSignature || (signatures.has(file) && signatures.get(file) !== afterSignature) || (hashes.has(file) && hashes.get(file) !== observed) || (realpaths.has(file) && realpaths.get(file) !== observedRealpath)) {
+    hashes.delete(file);
+    realpaths.delete(file);
+    signatures.delete(file);
+    unstableHashes.add(file);
+    return;
+  }
+  signatures.set(file, afterSignature);
+  hashes.set(file, observed);
+  realpaths.set(file, observedRealpath);
+}
+
+function recordFile(file: string): void {
+  const resolvedFile = path.resolve(file);
+  recordInput(resolvedFile);
+  for (let directory = path.dirname(resolvedFile);;) {
+    const manifest = path.join(directory, "package.json");
+    recordInput(manifest);
+    if (existingFile(manifest)) {
+      break;
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory) {
+      break;
+    }
+    directory = parent;
+  }
+}
+
+function recordPackageManifests(file: string): void {
+  for (let directory = path.dirname(path.resolve(file));;) {
+    const manifest = path.join(directory, "package.json");
+    recordInput(manifest);
+    if (existingFile(manifest)) return;
+    const parent = path.dirname(directory);
+    if (parent === directory) return;
+    directory = parent;
+  }
+}
+
+const moduleProbeExtensions = [".ts", ".tsx", ".mts", ".cts", ".js", ".mjs", ".cjs", ".json", ".node"] as const;
+const jsToTsProbeExtensions = new Map<string, readonly string[]>([
+  [".js", [".ts", ".tsx"]],
+  [".jsx", [".tsx"]],
+  [".mjs", [".mts"]],
+  [".cjs", [".cts"]],
+]);
+function sourceSubstitutionCandidates(base: string): string[] {
+  const extension = path.extname(base).toLowerCase();
+  const substitutions = jsToTsProbeExtensions.get(extension);
+  if (substitutions === undefined) return [];
+  const stem = base.slice(0, base.length - extension.length);
+  return substitutions.map((candidate) => stem + candidate);
+}
+function moduleCandidates(base: string): string[] {
+  return [
+    base,
+    ...sourceSubstitutionCandidates(base),
+    ...moduleProbeExtensions.map((extension) => base + extension),
+    path.join(base, "package.json"),
+    ...moduleProbeExtensions.map((extension) => path.join(base, "index" + extension)),
+  ];
+}
+const recordedModuleBases = new Set<string>();
+function recordManifestTargets(value: unknown, directory: string, allowBare: boolean = false): void {
+  if (typeof value === "string") {
+    if (value !== "" && (allowBare || value.startsWith("./") || value.startsWith("../"))) recordModuleCandidates(path.resolve(directory, value));
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) recordManifestTargets(item, directory, allowBare);
+    return;
+  }
+  if (value !== null && typeof value === "object") {
+    for (const item of Object.values(value)) recordManifestTargets(item, directory, allowBare);
+  }
+}
+function recordModuleCandidates(base: string): void {
+  const resolvedBase = path.resolve(base);
+  if (recordedModuleBases.has(resolvedBase)) return;
+  recordedModuleBases.add(resolvedBase);
+  for (const candidate of moduleCandidates(resolvedBase)) recordInput(candidate);
+  try {
+    const manifest = JSON.parse(fs.readFileSync(path.join(resolvedBase, "package.json"), "utf8").replace(/^\uFEFF/, ""));
+    recordManifestTargets(manifest.exports, resolvedBase);
+    recordManifestTargets(manifest.module, resolvedBase, true);
+    recordManifestTargets(manifest.main, resolvedBase, true);
+  } catch {}
+}
+function candidateSelected(base: string, resolvedFile: string): boolean {
+  for (const candidate of moduleCandidates(base)) {
+    try {
+      const canonical = fs.realpathSync.native(candidate);
+      const relative = path.relative(canonical, resolvedFile);
+      if (relative === "" || (fs.statSync(canonical).isDirectory() && relative !== ".." && !relative.startsWith(".." + path.sep) && !path.isAbsolute(relative))) return true;
+    } catch {}
+  }
+  return false;
+}
+function localBases(specifier: string, parentDirectory: string): string[] {
+  if (specifier.startsWith("file:")) return [fileURLToPath(specifier)];
+  const raw = path.resolve(parentDirectory, specifier);
+  const suffixStart = specifier.search(/[?#]/);
+  if (suffixStart === -1) return [raw];
+  const pathname = specifier.slice(0, suffixStart);
+  return pathname === "" ? [raw] : [...new Set([raw, path.resolve(parentDirectory, pathname)])];
+}
+function recordResolutionCandidates(specifier: string, parentURL: string | undefined, resolvedURL: string | undefined): void {
+  if (typeof parentURL !== "string" || !parentURL.startsWith("file:")) return;
+  const parentDirectory = path.dirname(fileURLToPath(parentURL));
+  let resolvedFile: string | undefined;
+  try {
+    resolvedFile = typeof resolvedURL === "string" && resolvedURL.startsWith("file:")
+      ? fs.realpathSync.native(fileURLToPath(resolvedURL))
+      : undefined;
+  } catch {}
+  if (specifier.startsWith(".") || path.isAbsolute(specifier) || specifier.startsWith("file:")) {
+    try {
+      for (const base of localBases(specifier, parentDirectory)) {
+        recordPackageManifests(base);
+        let exact = false;
+        try { exact = resolvedFile === undefined ? fs.statSync(base).isFile() : fs.realpathSync.native(base) === resolvedFile; } catch {}
+        if (exact) recordInput(base);
+        else recordModuleCandidates(base);
+      }
+    } catch {}
+    return;
+  }
+  if (isBuiltin(specifier) || specifier.startsWith("#")) return;
+  const parts = specifier.split("/");
+  const packageParts = parts[0]!.startsWith("@") ? parts.slice(0, 2) : parts.slice(0, 1);
+  if (packageParts.some((part) => part === undefined || part === "")) return;
+  const packageName = packageParts.join("/");
+  const subpath = parts.slice(packageParts.length);
+  const searchPaths = createRequire(parentURL).resolve.paths(specifier) ?? [];
+  for (const searchPath of searchPaths) {
+    const packageDirectory = path.join(searchPath, packageName);
+    recordModuleCandidates(packageDirectory);
+    if (subpath.length !== 0) recordModuleCandidates(path.join(packageDirectory, ...subpath));
+    if (resolvedFile !== undefined && candidateSelected(packageDirectory, resolvedFile)) break;
+  }
+}
+
+registerHooks({
+  resolve(specifier, context, nextResolve) {
+    recordResolutionCandidates(specifier, context.parentURL, undefined);
+    const resolved = nextResolve(specifier, context);
+    const url = typeof resolved === "string" ? resolved : resolved?.url;
+    recordResolutionCandidates(specifier, context.parentURL, url);
+    if (typeof url === "string" && url.startsWith("file:")) {
+      recordFile(fileURLToPath(url));
+    }
+    return resolved;
+  },
+});
 
 declare const process: {
   exitCode?: number;
@@ -275,6 +834,7 @@ declare const process: {
 // left for a trailing handler to settle.
 (async () => {
   try {
+    const importedConfig = await import(%s);
     let current: unknown = importedConfig;
     for (let i = 0; i < 8; i++) {
       if (current !== null && typeof current === "object" && Object.prototype.hasOwnProperty.call(current as Record<string, unknown>, "default")) {
@@ -289,7 +849,9 @@ declare const process: {
     if (current === null || typeof current !== "object" || Array.isArray(current)) {
       throw new Error("strip config file must export an object");
     }
-    process.stdout.write(JSON.stringify(current));
+    const serializedValue = JSON.stringify(current);
+    for (const input of [...inputs]) recordInput(input);
+    process.stdout.write(JSON.stringify({ value: JSON.parse(serializedValue), hashes: Object.fromEntries(hashes), inputs: [...inputs].sort(), realpaths: Object.fromEntries(realpaths) }));
   } catch (error) {
     process.stderr.write(error instanceof Error && error.stack ? error.stack : String(error));
     // The stack above is for the reader. This is for the caller: the parent
@@ -321,31 +883,36 @@ declare const process: {
 // resolved from the project rather than from the process environment alone;
 // see stripConfigToolAnchors.
 func loadStripTypeScriptConfigFile(location, resolutionRoot string) (any, error) {
+  loaded, err := loadStripTypeScriptConfigFileWithInputs(location, resolutionRoot)
+  return loaded.value, err
+}
+
+func loadStripTypeScriptConfigFileWithInputs(location, resolutionRoot string) (stripLoadedConfig, error) {
   tempDir, err := os.MkdirTemp(stripLoaderTempBase(location, os.TempDir()), "ttsc-strip-config-")
   if err != nil {
-    return nil, fmt.Errorf("@ttsc/strip: create config loader tempdir: %w", err)
+    return stripLoadedConfig{}, fmt.Errorf("@ttsc/strip: create config loader tempdir: %w", err)
   }
   defer os.RemoveAll(tempDir)
 
   if err := stripLinkNearestNodeModules(tempDir, filepath.Dir(location)); err != nil {
-    return nil, err
+    return stripLoadedConfig{}, err
   }
 
   loader := filepath.Join(tempDir, "loader.mts")
   tsconfig := filepath.Join(tempDir, "tsconfig.json")
   importSpecifier, err := stripRelativeImportSpecifier(tempDir, location)
   if err != nil {
-    return nil, err
+    return stripLoadedConfig{}, err
   }
   importLiteral, err := json.Marshal(importSpecifier)
   if err != nil {
-    return nil, fmt.Errorf("@ttsc/strip: encode config import %s: %w", location, err)
+    return stripLoadedConfig{}, fmt.Errorf("@ttsc/strip: encode config import %s: %w", location, err)
   }
   if err := os.WriteFile(loader, []byte(stripTypeScriptLoaderSource(string(importLiteral))), 0o644); err != nil {
-    return nil, fmt.Errorf("@ttsc/strip: write config loader: %w", err)
+    return stripLoadedConfig{}, fmt.Errorf("@ttsc/strip: write config loader: %w", err)
   }
   if err := os.WriteFile(tsconfig, []byte(stripTypeScriptLoaderTsconfig(loader, location, tempDir)), 0o644); err != nil {
-    return nil, fmt.Errorf("@ttsc/strip: write config loader tsconfig: %w", err)
+    return stripLoadedConfig{}, fmt.Errorf("@ttsc/strip: write config loader tsconfig: %w", err)
   }
 
   args := []string{
@@ -375,15 +942,15 @@ func loadStripTypeScriptConfigFile(location, resolutionRoot string) (any, error)
     // What it could not put there is a reason a caller can act on, so that
     // arrives through the payload channel instead.
     if reason := loaderFailureReason(output); reason != "" {
-      return nil, fmt.Errorf("@ttsc/strip: load TypeScript config file %s: %s", location, reason)
+      return stripLoadedConfig{}, fmt.Errorf("@ttsc/strip: load TypeScript config file %s: %s", location, reason)
     }
-    return nil, fmt.Errorf("@ttsc/strip: load TypeScript config file %s: %w", location, err)
+    return stripLoadedConfig{}, fmt.Errorf("@ttsc/strip: load TypeScript config file %s: %w", location, err)
   }
-  var out any
-  if err := json.Unmarshal(output, &out); err != nil {
-    return nil, fmt.Errorf("@ttsc/strip: parse TypeScript config file %s output: %w", location, err)
+  loaded, err := decodeStripConfigLoaderOutput(output)
+  if err != nil {
+    return stripLoadedConfig{}, fmt.Errorf("@ttsc/strip: parse TypeScript config file %s output: %w", location, err)
   }
-  return out, nil
+  return loaded, nil
 }
 
 // stripTypeScriptLoaderTsconfig generates the JSON content of the ephemeral
@@ -402,6 +969,7 @@ func stripTypeScriptLoaderTsconfig(loader, location, outDir string) string {
       // resolving either way.
       "module":                          stripConfigModuleOption(location),
       "moduleResolution":                "bundler",
+      "jsx":                             "preserve",
       "noImplicitAny":                   false,
       "outDir":                          filepath.ToSlash(filepath.Join(outDir, "out")),
       "rewriteRelativeImportExtensions": true,

package/driver/strip.go

@@ -19,7 +19,7 @@ type plugin struct{}
 // ApplyProgram strips configured call expressions and debugger statements from
 // every source file in the program.
 func (plugin) ApplyProgram(prog *driver.Program, ctx driver.PluginContext) error {
-  config, err := loadStripConfigMap(ctx.Entry.Config, ctx.Cwd, ctx.Tsconfig)
+  config, err := loadStripConfigMapWithReporters(ctx.Entry.Config, ctx.Cwd, ctx.Tsconfig, ctx.ReportHostInput, ctx.ReportHostInputHash, ctx.ReportHostInputRealpath)
   if err != nil {
     return err
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttsc/strip",
-  "version": "0.26.2",
+  "version": "0.27.0",
   "description": "First-party ttsc plugin that removes configured calls and statements from emitted JavaScript.",
   "main": "src/index.cjs",
   "types": "src/index.d.ts",

package/src/index.cjs

@@ -1,6 +1,8 @@
 // @ts-check
 "use strict";
 
+const fs = require("node:fs");
+const crypto = require("node:crypto");
 const path = require("node:path");
 
 // Keys from the tsconfig plugin entry that @ttsc/strip accepts. All other keys
@@ -28,7 +30,11 @@ module.exports = function createTtscStrip(context) {
       );
     }
   }
+  const configInputs = stripConfigInputs(context);
   return {
+    hostInputHashes: configInputs.hashes,
+    hostInputRealpaths: configInputs.realpaths,
+    hostInputs: configInputs.inputs,
     name: "@ttsc/strip",
     // `context.dirname` is this descriptor's own directory in every load mode —
     // the ESM-safe replacement for `__dirname`.
@@ -36,3 +42,82 @@ module.exports = function createTtscStrip(context) {
     stage: "transform",
   };
 };
+
+const STRIP_CONFIG_FILENAMES = [
+  "strip.config.ts",
+  "strip.config.mts",
+  "strip.config.cts",
+  "strip.config.js",
+  "strip.config.mjs",
+  "strip.config.cjs",
+  "strip.config.json",
+];
+
+function stripConfigInputs(context) {
+  const configFile = context.plugin?.configFile;
+  const base = path.resolve(
+    context.pluginConfigDir ?? path.dirname(context.tsconfig),
+  );
+  if (typeof configFile === "string" && configFile.trim() !== "") {
+    const file = path.isAbsolute(configFile)
+      ? path.resolve(configFile)
+      : path.resolve(base, configFile);
+    return {
+      hashes: { [file]: hostInputHash(file) },
+      inputs: [file],
+      realpaths: { [file]: hostInputRealpath(file) },
+    };
+  }
+  const inputs = [];
+  const hashes = {};
+  const realpaths = {};
+  for (let directory = base; ; directory = path.dirname(directory)) {
+    const candidates = STRIP_CONFIG_FILENAMES.map((name) =>
+      path.join(directory, name),
+    );
+    inputs.push(...candidates);
+    for (const candidate of candidates) {
+      hashes[candidate] = hostInputHash(candidate);
+      realpaths[candidate] = hostInputRealpath(candidate);
+    }
+    if (candidates.some(configCandidateExists)) break;
+    const parent = path.dirname(directory);
+    if (parent === directory) break;
+  }
+  return { hashes, inputs, realpaths };
+}
+
+function hostInputRealpath(file) {
+  try {
+    return fs.realpathSync.native(file);
+  } catch {
+    return null;
+  }
+}
+
+/** Hash the exact candidate state observed before discovery selects a file. */
+function hostInputHash(file) {
+  try {
+    if (fs.statSync(file).isDirectory()) {
+      return crypto
+        .createHash("sha256")
+        .update("ttsc:host-input:directory\0")
+        .digest("hex");
+    }
+    return crypto
+      .createHash("sha256")
+      .update(fs.readFileSync(file))
+      .digest("hex");
+  } catch {
+    return null;
+  }
+}
+
+/** Match the native discovery rule: a directory is never a config file. */
+function configCandidateExists(file) {
+  try {
+    return !fs.statSync(file).isDirectory();
+  } catch {
+    return false;
+  }
+}

package/src/index.d.ts

@@ -14,9 +14,16 @@ declare function createTtscStrip(context: {
    * it.
    */
   dirname: string;
+  /** Host-declared anchor for implicit strip config discovery. */
+  pluginConfigDir?: string;
   /** Original tsconfig plugin entry, validated for unsupported keys. */
   plugin?: Record<string, unknown>;
+  /** Absolute resolved tsconfig path. */
+  tsconfig: string;
 }): {
+  hostInputHashes: Record<string, string | null>;
+  hostInputRealpaths: Record<string, string | null>;
+  hostInputs: string[];
   name: string;
   source: string;
   stage: "transform";