@ttsc/unplugin 0.34.0 → 0.34.2

package/src/core/bridge/projectRecordMoved.ts

@@ -5,26 +5,29 @@ import { walkProjectInputs } from "../transform/project/walkProjectInputs";
 import { watchInputEvidenceMatchesDisk } from "../transform/watch/watchInputEvidenceMatchesDisk";
 import type { TtscProjectRecord } from "./TtscProjectRecord";
 import { membershipRecordDigest } from "./membershipRecordDigest";
+import { projectRecordArgumentsMatch } from "./projectRecordArgumentsMatch";
 
 /**
- * The first recorded input or membership state that current replay cannot
- * establish as unchanged, or nothing when all recorded checks hold. This is the
- * proof a build start makes of a record (`refreshProjectRecordFiles`),
+ * The first invocation, recorded input or membership state that current replay
+ * cannot establish as unchanged, or nothing when all recorded checks hold. This
+ * is the proof a build start makes of a record (`refreshProjectRecordFiles`),
  * separable from the move it follows with, so a harness or a maintainer can ask
  * the same question of a record without moving it.
  *
- * Each recorded input is proven against the disk the way a delivery proves a
- * generation (`watchInputEvidenceMatchesDisk`), and the walk is run again under
- * the recorded policy and its digest compared (`membershipRecordDigest`). A
- * plugin source is proven by the metadata of its files where that metadata
- * holds (`pluginSourceFilesDigest`), which stands for their bytes only against
- * a clock reference minted since any rollback, so the proof mints one first, as
- * a delivery does. It holds no generation, so the reference is minted in the
+ * The captured invocation must match the active context before each recorded
+ * input is proven against the disk the way a delivery proves a generation
+ * (`watchInputEvidenceMatchesDisk`), and the walk is run again under the
+ * recorded policy and its digest compared (`membershipRecordDigest`). A plugin
+ * source is proven by the metadata of its files where that metadata holds
+ * (`pluginSourceFilesDigest`), which stands for their bytes only against a
+ * clock reference minted since any rollback, so the proof mints one first, as a
+ * delivery does. It holds no generation, so the reference is minted in the
  * probe directory this process keeps (`refreshProcessClockReference`).
  *
  * @returns The tsconfig when it is gone, which a build start answers by
  *   removing the record rather than moving it, the first input whose state
- *   moved, the project root when the root files did, or `undefined`.
+ *   moved, the project root when invocation or root membership differs, or
+ *   `undefined`.
  * @evidence contracts/common.md#principled-implementation
  *   Each codec is re-proved against the same filesystem view and membership is
  *   re-walked under the stored policy. A fresh process clock reference prevents
@@ -56,8 +59,11 @@ import { membershipRecordDigest } from "./membershipRecordDigest";
 export function projectRecordMoved(
   record: TtscProjectRecord,
   filesystem: TtscTransformFilesystemOperations = DEFAULT_FILESYSTEM_OPERATIONS,
+  compilerArgumentsIdentity?: string,
 ): string | undefined {
   if (!filesystem.exists(record.tsconfig)) return record.tsconfig;
+  if (!projectRecordArgumentsMatch(record, compilerArgumentsIdentity))
+    return record.root;
   refreshProcessClockReference(record.root, filesystem);
   for (const [input, evidence] of Object.entries(record.inputs)) {
     if (evidence === null || typeof evidence !== "object") return input;

package/src/core/bridge/readProjectRecordFile.ts

@@ -10,9 +10,10 @@ import type { TtscProjectRecord } from "./TtscProjectRecord";
  * run over it (`refreshProjectRecordFiles`), and the next generation's delivery
  * writes it whole.
  *
- * Validate consumed input codecs and membership policy before exposing the
- * parsed record. A JSON object header alone does not establish that observers
- * can safely interpret its nested evidence.
+ * Validate the optional invocation witness, consumed input codecs and
+ * membership policy before exposing the parsed record. A JSON object header
+ * alone does not establish that observers can safely interpret its nested
+ * evidence.
  *
  * @evidence contracts/common.md#principled-implementation Structural guards validate the record, every consumed input codec and membership policy; predicate proof uses the existing producer-schema normalizer rather than inventing missing observations.
  * @evidence contracts/common.md#clear-and-simple-design This disk boundary owns untrusted JSON parsing and small schema predicates; filesystem replay and state-change decisions remain with the existing record consumers.
@@ -48,11 +49,16 @@ export function readProjectRecordFile(
     !Number.isFinite(candidate.signal) ||
     !isInputEvidenceMap(candidate.inputs) ||
     !isMembership(candidate.membership) ||
+    (candidate.compilerArguments !== undefined &&
+      !isCompilerArguments(candidate.compilerArguments)) ||
     (candidate.dependencies !== undefined && !isStrings(candidate.dependencies))
   ) {
     return undefined;
   }
   return {
+    ...(candidate.compilerArguments === undefined
+      ? {}
+      : { compilerArguments: candidate.compilerArguments }),
     ...(candidate.dependencies === undefined
       ? {}
       : { dependencies: candidate.dependencies }),
@@ -105,6 +111,23 @@ function isPolicy(value: unknown): boolean {
     )
       return false;
   }
+  const extensionOrigins = value.extensionOptionOrigins;
+  if (
+    extensionOrigins !== undefined &&
+    (!isRecord(extensionOrigins) ||
+      !isStrings(extensionOrigins.mapperExtensions) ||
+      ["allowJs", "checkJs", "resolveJsonModule"].some(
+        (key) =>
+          extensionOrigins[key] !== undefined &&
+          typeof extensionOrigins[key] !== "boolean",
+      ) ||
+      ["module", "moduleResolution"].some(
+        (key) =>
+          extensionOrigins[key] !== undefined &&
+          typeof extensionOrigins[key] !== "string",
+      ))
+  )
+    return false;
   const origins = value.directoryExclusionOrigins;
   return (
     origins === undefined ||
@@ -174,3 +197,16 @@ function isInputEvidenceMap(
 ): value is TtscProjectRecord["inputs"] {
   return isRecord(value) && Object.values(value).every(isInputEvidence);
 }
+
+/** Argument transport identity and the explicit policy needed for replay. */
+function isCompilerArguments(
+  value: unknown,
+): value is NonNullable<TtscProjectRecord["compilerArguments"]> {
+  return (
+    isRecord(value) &&
+    typeof value.identity === "string" &&
+    /^[0-9a-f]{64}$/.test(value.identity) &&
+    (value.runExternalCode === undefined ||
+      typeof value.runExternalCode === "boolean")
+  );
+}

package/src/core/bridge/refreshProjectRecordFile.ts

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import { DEFAULT_FILESYSTEM_OPERATIONS } from "../transform/filesystem/DEFAULT_FILESYSTEM_OPERATIONS";
 import type { TtscTransformFilesystemOperations } from "../transform/filesystem/TtscTransformFilesystemOperations";
 import type { HostWatchBridge } from "./HostWatchBridge";
+import { projectRecordArgumentsMatch } from "./projectRecordArgumentsMatch";
 import { projectRecordMoved } from "./projectRecordMoved";
 import { projectRecordWatchInputs } from "./projectRecordWatchInputs";
 import { readProjectRecordFile } from "./readProjectRecordFile";
@@ -16,7 +17,8 @@ import { signalProjectRecordFile } from "./signalProjectRecordFile";
  * A host restoring a module from its cache never runs the adapter for it, so
  * the adapter cannot learn at delivery that an input moved, a root file
  * appeared, or a tsconfig vanished while the host was stopped. It learns here:
- * each recorded input is proven against the disk the way a delivery proves it
+ * the captured compiler invocation must match the active context, then each
+ * recorded input is proven against the disk the way a delivery proves it
  * (`watchInputEvidenceMatchesDisk`), and the walk is run again under the
  * recorded policy and its digest compared. One mismatch moves the record
  * (`signalProjectRecordFile`); the host, which recorded the file as a
@@ -69,6 +71,7 @@ export function refreshProjectRecordFile(
   file: string,
   bridge?: HostWatchBridge,
   filesystem: TtscTransformFilesystemOperations = DEFAULT_FILESYSTEM_OPERATIONS,
+  compilerArgumentsIdentity?: string,
 ): void {
   const record = readProjectRecordFile(file);
   // A record that cannot be read proves nothing, and is moved as a proof that
@@ -98,6 +101,10 @@ export function refreshProjectRecordFile(
     return;
   }
   if (bridge !== undefined) {
+    if (!projectRecordArgumentsMatch(record, compilerArgumentsIdentity)) {
+      signalProjectRecordFile(file);
+      return;
+    }
     bridge.register(file, projectRecordWatchInputs(record));
     return;
   }
@@ -106,7 +113,7 @@ export function refreshProjectRecordFile(
   // a record the next proof can run over.
   let moved: string | undefined;
   try {
-    moved = projectRecordMoved(record, filesystem);
+    moved = projectRecordMoved(record, filesystem, compilerArgumentsIdentity);
   } catch {
     moved = record.root;
   }

package/src/core/bridge/refreshProjectRecordFiles.ts

@@ -58,6 +58,7 @@ export function refreshProjectRecordFiles(
   toolDirectory: string,
   bridge?: HostWatchBridge,
   filesystem: TtscTransformFilesystemOperations = DEFAULT_FILESYSTEM_OPERATIONS,
+  compilerArgumentsIdentity?: string,
 ): void {
   const directory = path.join(toolDirectory, PROJECT_RECORD_DIRECTORY);
   let names: string[];
@@ -68,6 +69,11 @@ export function refreshProjectRecordFiles(
   }
   for (const name of names) {
     if (name.endsWith(".json"))
-      refreshProjectRecordFile(path.join(directory, name), bridge, filesystem);
+      refreshProjectRecordFile(
+        path.join(directory, name),
+        bridge,
+        filesystem,
+        compilerArgumentsIdentity,
+      );
   }
 }

package/src/core/index.ts

@@ -27,6 +27,8 @@ export { collectProjectInputHashSnapshot } from "./transform/project/collectProj
 export { isProjectWalkPath } from "./transform/project/isProjectWalkPath";
 export type { TtscProjectInputHashSnapshot } from "./transform/project/TtscProjectInputHashSnapshot";
 export { transformTtsc } from "./transform/transformTtsc";
+export { compilerEnvironmentIdentity } from "./transform/tsconfig/compilerEnvironmentIdentity";
+export { resolveCompilerEnvironment } from "./transform/tsconfig/resolveCompilerEnvironment";
 export { captureWatchInputBaseline } from "./transform/watch/captureWatchInputBaseline";
 export { captureWatchInputFileBaseline } from "./transform/watch/captureWatchInputFileBaseline";
 export { isWatchInputKeyBaseline } from "./transform/watch/isWatchInputKeyBaseline";

package/src/core/next/next.ts

@@ -8,6 +8,8 @@ import { refreshProjectRecordFiles } from "../bridge/refreshProjectRecordFiles";
 import type { TtscUnpluginOptions } from "../options/TtscUnpluginOptions";
 import { TYPESCRIPT_TURBOPACK_RULE_GLOBS } from "../source/TYPESCRIPT_TURBOPACK_RULE_GLOBS";
 import { openTtscTransformSession } from "../transform/session/openTtscTransformSession";
+import { captureCompilerArguments } from "../transform/tsconfig/captureCompilerArguments";
+import { resolveCompilerEnvironment } from "../transform/tsconfig/resolveCompilerEnvironment";
 import type { TtscTurbopackLoaderOptions } from "../turbopack/TtscTurbopackLoaderOptions";
 import { unplugin } from "../unplugin";
 import type { NextLikeConfig } from "./NextLikeConfig";
@@ -99,11 +101,25 @@ export function next(
   // Before either compiler validates a module against the cache below
   // `.next`: a project whose state moved while nothing ran is heard through
   // its record, which only a proof here can move.
-  refreshProjectRecordFiles(hostToolDirectory(process.cwd()));
+  const compilerArguments = captureCompilerArguments(
+    resolveCompilerEnvironment(options?.runExternalCode),
+  ).identity;
+  refreshProjectRecordFiles(
+    hostToolDirectory(process.cwd()),
+    undefined,
+    undefined,
+    compilerArguments,
+  );
   // And where webpack's records live when that directory cannot be written
   // (samchon/ttsc#1480); Turbopack's loader proves its own.
   const fallback = fallbackToolDirectory(process.cwd());
-  if (fallback !== undefined) refreshProjectRecordFiles(fallback);
+  if (fallback !== undefined)
+    refreshProjectRecordFiles(
+      fallback,
+      undefined,
+      undefined,
+      compilerArguments,
+    );
   return {
     ...nextConfig,
     turbopack: withTtscTurbopackRules(nextConfig.turbopack, options),

package/src/core/options/ResolvedTtscUnpluginOptions.ts

@@ -43,6 +43,9 @@ export interface ResolvedTtscUnpluginOptions {
   /** Compiler-options overlay applied on top of the discovered tsconfig. */
   compilerOptions: TtscUnpluginCompilerOptionsJson;
 
+  /** Explicit invocation permission; omission retains inherited arguments. */
+  runExternalCode?: boolean;
+
   /**
    * Resolved plugin list; mirrors the semantics of
    * `TtscUnpluginOptions.plugins`.

package/src/core/options/TtscUnpluginOptions.ts

@@ -69,6 +69,15 @@ export interface TtscUnpluginOptions {
    */
   compilerOptions?: TtscUnpluginCompilerOptionsJson;
 
+  /**
+   * Allow the selected TypeScript 7.1 compiler to execute content mappers.
+   *
+   * This invocation's explicit value overrides inherited `TTSC_TSGO_ARGS`
+   * permission without changing `process.env`. Omission retains inherited
+   * arguments. TypeScript 7.0 rejects this option's compiler flag.
+   */
+  runExternalCode?: boolean;
+
   /**
    * `ttsc` plugin entries.
    *

package/src/core/options/resolveOptions.ts

@@ -11,9 +11,10 @@ const defaultOptions: ResolvedTtscUnpluginOptions = {
 /**
  * Normalise raw user-supplied options into {@link ResolvedTtscUnpluginOptions}.
  *
- * Merges provided values with defaults. The `plugins` field uses an explicit
- * `"plugins" in options` presence check rather than a falsy guard so that
- * `plugins: false` (disable all plugins) is preserved as-is.
+ * Merges provided values with defaults, preserving an explicit false mapper
+ * permission. The `plugins` field uses an explicit `"plugins" in options`
+ * presence check rather than a falsy guard so that `plugins: false` (disable
+ * all plugins) is preserved as-is.
  *
  * @evidence contracts/common.md#principled-implementation
  *   Nullish defaults normalize the overlay and project; a presence check
@@ -48,6 +49,7 @@ export function resolveOptions(
     precompile:
       options.precompile === undefined ? undefined : [...options.precompile],
     compilerOptions: { ...(options.compilerOptions ?? {}) },
+    runExternalCode: options.runExternalCode,
     plugins: "plugins" in options ? options.plugins : defaultOptions.plugins,
     project: options.project ?? defaultOptions.project,
     projectRoot: options.projectRoot ?? defaultOptions.projectRoot,

package/src/core/rollup/rollupDeliveryOptions.ts

@@ -1,6 +1,8 @@
 import path from "node:path";
 
 import type { ResolvedTtscUnpluginOptions } from "../options/ResolvedTtscUnpluginOptions";
+import { compilerEnvironmentIdentity } from "../transform/tsconfig/compilerEnvironmentIdentity";
+import { resolveCompilerEnvironment } from "../transform/tsconfig/resolveCompilerEnvironment";
 import { hashText } from "../transform/utils/hashText";
 import { stableStringify } from "../transform/utils/stableStringify";
 
@@ -9,11 +11,11 @@ import { stableStringify } from "../transform/utils/stableStringify";
  * the module carries into Rollup's cache (`TtscRollupDelivery`).
  *
  * The identity records alias mappings, compiler overlay, plugin payloads and
- * configured project and source-root selection. Tsconfig input state is
- * represented separately by the delivery's project record. A configured project
- * resolves under the same native cwd rule as explicit selection; it is not
- * canonicalized to a physical alias or made process-independent across
- * different cwd spellings.
+ * configured project/source-root selection and effective compiler argument
+ * transport. Tsconfig input state is represented separately by the delivery's
+ * project record. A configured project resolves under the same native cwd rule
+ * as explicit selection; it is not canonicalized to a physical alias or made
+ * process-independent across different cwd spellings.
  *
  * Compiler options, plugin payloads and alias mappings preserve their actual
  * JSON order. Their consumers can observe declaration order; the host cannot
@@ -41,11 +43,13 @@ import { stableStringify } from "../transform/utils/stableStringify";
 export function rollupDeliveryOptions(
   options: ResolvedTtscUnpluginOptions,
   aliasPaths: Record<string, string[]>,
+  compilerEnvironment = resolveCompilerEnvironment(options.runExternalCode),
 ): string {
   return hashText(
     stableStringify({
       aliasPaths: JSON.stringify(aliasPaths),
       compilerOptions: JSON.stringify(options.compilerOptions),
+      compilerEnvironment: compilerEnvironmentIdentity(compilerEnvironment),
       plugins: JSON.stringify(options.plugins),
       project:
         options.project === undefined ? null : path.resolve(options.project),

package/src/core/transform/cache/TRANSFORM_CACHE_MEMBERSHIP_POLICIES.ts

@@ -0,0 +1,14 @@
+import type { TtscCompilerMembershipHint } from "../generation/TtscCompilerMembershipHint";
+import type { TtscTransformCache } from "./TtscTransformCache";
+
+/**
+ * Qualified native root hint per invocation key, retained across generation
+ * disposal. Its config-policy basis must match before priming a new walk;
+ * neither the match nor report proves current filesystem state. Entries live
+ * until the cache is collected; distinct invocation keys and their path bytes
+ * have no independent cap.
+ */
+export const TRANSFORM_CACHE_MEMBERSHIP_POLICIES = new WeakMap<
+  TtscTransformCache,
+  Map<string, TtscCompilerMembershipHint>
+>();

package/src/core/transform/cache/TtscCachedProjectTransform.ts

@@ -1,8 +1,10 @@
 import type { ITtscCompilerTransformation } from "ttsc";
 
 import type { ITtscProjectMembershipPolicy } from "../../tsconfig/ITtscProjectMembershipPolicy";
+import type { TtscCompilerMembershipHint } from "../generation/TtscCompilerMembershipHint";
 import type { TtscProjectDirectorySnapshot } from "../project/TtscProjectDirectorySnapshot";
 import type { TtscProjectMutationTracker } from "../tracker/TtscProjectMutationTracker";
+import type { TtscCompilerArgumentsWitness } from "../tsconfig/TtscCompilerArgumentsWitness";
 import type { TtscHostInputValidation } from "../validation/TtscHostInputValidation";
 
 /**
@@ -42,6 +44,11 @@ import type { TtscHostInputValidation } from "../validation/TtscHostInputValidat
  *   retained state at runtime.
  */
 export interface TtscCachedProjectTransform {
+  /** Native settings learned under this capture's validated config-policy basis. */
+  compilerMembership?: TtscCompilerMembershipHint;
+
+  /** Actual captured invocation, retained for persisted host-cache proofs. */
+  compilerArguments?: TtscCompilerArgumentsWitness;
   /** Predicate-preserving compiler proofs for external candidate spellings. */
   externalInputObservations?: Record<
     string,

package/src/core/transform/cache/createTransformCacheKey.ts

@@ -3,6 +3,7 @@ import path from "node:path";
 import type { ResolvedTtscUnpluginOptions } from "../../options/ResolvedTtscUnpluginOptions";
 import { createHostPathIdentityContext } from "../filesystem/createHostPathIdentityContext";
 import { pathIdentityKey } from "../filesystem/pathIdentityKey";
+import { compilerEnvironmentIdentity } from "../tsconfig/compilerEnvironmentIdentity";
 import { stableStringify } from "../utils/stableStringify";
 
 /**
@@ -10,13 +11,14 @@ import { stableStringify } from "../utils/stableStringify";
  *
  * The declared compile configuration is represented by: the selected tsconfig's
  * filesystem identity, common source-root identity, compiler overlay, plugin
- * list, and translated aliases. Two adapter configurations that have different
- * supported JSON representations therefore receive different keys; native
- * spellings resolving to one config identity may share a key. A key does not
- * encode current filesystem content or prove freshness. Compiler overlays,
- * plugin payloads and alias mappings retain their JSON declaration order: tied
- * compiler path patterns and arbitrary plugin payloads can observe it. Only the
- * host-owned outer manifest is serialized with sorted keys.
+ * list, effective compiler argument transport, and translated aliases. Two
+ * adapter configurations that have different supported JSON representations
+ * therefore receive different keys; native spellings resolving to one config
+ * identity may share a key. A key does not encode current filesystem content or
+ * prove freshness. Compiler overlays, plugin payloads and alias mappings retain
+ * their JSON declaration order: tied compiler path patterns and arbitrary
+ * plugin payloads can observe it. Only the host-owned outer manifest is
+ * serialized with sorted keys.
  *
  * @evidence contracts/common.md#principled-implementation Native config and source-root identities plus actual JSON representations of compiler overlays, plugin payloads and alias mappings distinguish requested compiles, retaining declaration order that path-pattern ties or plugins can observe.
  * @evidence contracts/common.md#clear-and-simple-design Existing path identity and stable JSON encoding define the key; filesystem state remains the generation validator's responsibility.
@@ -25,7 +27,7 @@ import { stableStringify } from "../utils/stableStringify";
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Returns a string and retains nothing.
  * @evidence contracts/performance.md#efficient-algorithms
  *   Three payload serializations preserve supported JSON order; the outer
- *   five-field manifest sorts only its fixed keys and serializes their text
+ *   fixed-field manifest sorts only its own keys and serializes their text
  *   again, with escaping/output space proportional to the payload text.
  *   One path-identity transaction for config and root observes uncached native
  *   aliases, ancestors and directory case policy; that work is not constant
@@ -43,6 +45,8 @@ import { stableStringify } from "../utils/stableStringify";
 export function createTransformCacheKey(props: {
   aliasPaths: Record<string, string[]>;
   compilerOptions: Record<string, unknown>;
+  /** Effective compiler argument snapshot selected before cache lookup. */
+  compilerEnvironment?: NodeJS.ProcessEnv;
   plugins?: ResolvedTtscUnpluginOptions["plugins"];
   /** Common source root; omission defaults to the config directory. */
   projectRoot?: string;
@@ -52,6 +56,7 @@ export function createTransformCacheKey(props: {
   return stableStringify({
     aliasPaths: JSON.stringify(props.aliasPaths),
     compilerOptions: JSON.stringify(props.compilerOptions),
+    compilerEnvironment: compilerEnvironmentIdentity(props.compilerEnvironment),
     plugins: JSON.stringify(props.plugins),
     projectRoot: pathIdentityKey(
       props.projectRoot ?? path.dirname(props.tsconfig),

package/src/core/transform/generation/TtscCompilerMembershipHint.ts

@@ -0,0 +1,24 @@
+import type { ITtscCompilerTransformation } from "ttsc";
+
+/**
+ * A provisional native root report tied to the config policy that learned it.
+ * It predicts a later walk's settings and carries no filesystem reuse proof.
+ *
+ * @evidence contracts/common.md#principled-implementation A config-policy identity prevents a previously learned CLI report from overriding newly read JSON settings; capture qualifies the report against config and graph observations.
+ * @evidence contracts/common.md#clear-and-simple-design One pair keeps the prediction and its premise together across attempts and cache generations.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts The hint is optional and does not replace the current compiler report or snapshot proof.
+ * @evidence contracts/common.md#meaningful-documentation Members distinguish the config identity from the native prediction and state their authority limit.
+ * @evidenceExclude contracts/portability.md#os-neutral-implementation This carrier interprets no path, platform or process value.
+ * @evidenceExclude contracts/performance.md#efficient-algorithms This type declares no runtime computation.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work This type coordinates no work; the primer and capture own prediction validity.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources This type owns no handle or retained population.
+ */
+export interface TtscCompilerMembershipHint {
+  /** Digest of the fresh JSON and overlay policy before native projection. */
+  basis: string;
+
+  /** Qualified native settings, subject to the next compiler's report. */
+  report: NonNullable<
+    ITtscCompilerTransformation.IReferenceGraph["membership"]
+  >;
+}

package/src/core/transform/generation/applyCompilerMembership.ts

@@ -0,0 +1,44 @@
+import type { ITtscCompilerTransformation } from "ttsc";
+
+import type { ITtscProjectMembershipPolicy } from "../../tsconfig/ITtscProjectMembershipPolicy";
+import { flattenDirectoryExclusionOrigins } from "../../tsconfig/flattenDirectoryExclusionOrigins";
+
+/**
+ * Apply a native root report without reinterpreting its resolved paths as JSON.
+ *
+ * @evidence contracts/common.md#principled-implementation Effective native suffixes replace the provisional extension population; parsed output paths replace only implicit output exclusions while authored explicit excludes survive.
+ * @evidence contracts/common.md#clear-and-simple-design One projection serves both priming from a previous report and adopting the current compiler report.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Native paths are already resolved and are not passed through configDir substitution again; an absent report leaves the policy unchanged.
+ * @evidence contracts/common.md#meaningful-documentation Native prose distinguishes resolved compiler paths, JSON interpretation and report absence.
+ * @evidence contracts/portability.md#os-neutral-implementation Absolute native output spellings pass through unchanged; this owner performs no path lookup or case folding of filesystem names.
+ * @evidence contracts/performance.md#efficient-algorithms Copies the exclusion origins and extension list once, then flattens the existing explicit and implicit directory population; storage follows those names and paths.
+ * @evidenceExclude contracts/performance.md#reuse-equivalent-work The caller owns report lifetime and reuse permission; this projection retains no prior result.
+ * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources The returned policy transfers to the caller and acquires no handle or history.
+ */
+export function applyCompilerMembership(
+  policy: ITtscProjectMembershipPolicy,
+  report: ITtscCompilerTransformation.IReferenceGraph["membership"],
+): ITtscProjectMembershipPolicy {
+  if (report === undefined) return policy;
+  const origins: {
+    exclude: readonly string[];
+    useImplicitOutputExclusions?: boolean;
+    outDir?: string;
+    declarationDir?: string;
+  } = {
+    ...(policy.directoryExclusionOrigins ?? {
+      exclude: policy.excludedDirectories,
+      useImplicitOutputExclusions: true,
+    }),
+  };
+  for (const key of ["outDir", "declarationDir"] as const) {
+    if (report[key] === null) delete origins[key];
+    else origins[key] = report[key];
+  }
+  return {
+    ...policy,
+    directoryExclusionOrigins: origins,
+    excludedDirectories: flattenDirectoryExclusionOrigins(origins),
+    inputExtensions: [...report.inputExtensions],
+  };
+}

package/src/core/transform/generation/captureTransformGeneration.ts

@@ -33,6 +33,7 @@ import { createHostInputMutationTracker } from "../tracker/createHostInputMutati
 import { createProjectMutationTracker } from "../tracker/createProjectMutationTracker";
 import { settleMutationTrackers } from "../tracker/settleMutationTrackers";
 import { trackedInputScopes } from "../tracker/trackedInputScopes";
+import { captureCompilerArguments } from "../tsconfig/captureCompilerArguments";
 import { compilerProjectSpelling } from "../tsconfig/compilerProjectSpelling";
 import { createTransformScratchDirectory } from "../tsconfig/createTransformScratchDirectory";
 import { createTransformTsconfig } from "../tsconfig/createTransformTsconfig";
@@ -47,10 +48,12 @@ import { walkSnapshotComplete } from "../validation/walkSnapshotComplete";
 import { witnessExternalDependencies } from "../validation/witnessExternalDependencies";
 import { TRANSFORM_FAILED_GENERATION_VALIDATIONS } from "./TRANSFORM_FAILED_GENERATION_VALIDATIONS";
 import { TRANSFORM_GENERATION_FAILURES } from "./TRANSFORM_GENERATION_FAILURES";
+import type { TtscCompilerMembershipHint } from "./TtscCompilerMembershipHint";
 import { captureFailedGenerationInputStates } from "./captureFailedGenerationInputStates";
 import { captureTransformSourceHashes } from "./captureTransformSourceHashes";
 import { createGenerationProofFailures } from "./createGenerationProofFailures";
 import { mergeGenerationProofFailures } from "./mergeGenerationProofFailures";
+import { primeCompilerMembership } from "./primeCompilerMembership";
 import { projectWalkFailureFingerprint } from "./projectWalkFailureFingerprint";
 import { projectWalkStable } from "./projectWalkStable";
 import { recordGenerationProofFailure } from "./recordGenerationProofFailure";
@@ -121,6 +124,14 @@ export async function captureTransformGeneration(props: {
   /** Compiler options overlaid on the project without editing its source config. */
   compilerOptions: Record<string, unknown>;
 
+  /** Detached environment paired with the requesting generation's cache key. */
+  compilerEnvironment?: NodeJS.ProcessEnv;
+  /** Explicit override that produced the effective compiler environment. */
+  runExternalCode?: boolean;
+
+  /** Learned native root settings used only to prime this attempt's walk. */
+  compilerMembership?: TtscCompilerMembershipHint;
+
   /** Native source path whose host delivery initiated the attempt. */
   currentFile: string;
 
@@ -242,7 +253,10 @@ export async function captureTransformGeneration(props: {
     );
     const temporaryTsconfig =
       configured.path === props.tsconfig ? undefined : configured.path;
-    const compilerEnvironment = transformScratchEnvironment(scratchDirectory);
+    const compilerEnvironment = transformScratchEnvironment(
+      scratchDirectory,
+      props.compilerEnvironment,
+    );
     if (temporaryTsconfig === undefined) {
       delete compilerEnvironment[TTSC_SEMANTIC_CONFIG_PATH];
     } else {
@@ -255,11 +269,15 @@ export async function captureTransformGeneration(props: {
     // relative `outDir` is anchored at the config that declares it, and the
     // generated config lives in a system temp directory. The caller's
     // compiler-options overlay still wins, since it wins for the compile too.
-    const mergedPolicy = mergeMembershipPolicyOverlay(
-      tsconfigState.membershipPolicy,
-      props.compilerOptions,
-      path.dirname(props.tsconfig),
+    const membershipPrimer = primeCompilerMembership(
+      mergeMembershipPolicyOverlay(
+        tsconfigState.membershipPolicy,
+        props.compilerOptions,
+        path.dirname(props.tsconfig),
+      ),
+      props.compilerMembership,
     );
+    const mergedPolicy = membershipPrimer.policy;
     // The walk before the compile matches root specs under the case policy an
     // earlier compile reported, or a provisional cache-root approximation
     // under this attempt's environment. The approximation does not observe
@@ -432,7 +450,7 @@ export async function captureTransformGeneration(props: {
       undefined,
       projectRoot,
     );
-    const { membershipPolicy, casePolicyLearned } =
+    const { membershipPolicy, membershipPolicyLearned } =
       selectReportedMembershipPolicy(primedPolicy, result);
     TRANSFORM_RESULT_MEMBERSHIP.set(result, {
       // Only the actual complete directory walk authorizes replacing a listing
@@ -440,7 +458,7 @@ export async function captureTransformGeneration(props: {
       // unreadable directory was enumerated, and a changed compiler comparison
       // answer means the primed walk used another admission policy.
       enumeratedDirectories:
-        before.directoryComplete && !casePolicyLearned
+        before.directoryComplete && !membershipPolicyLearned
           ? new Set(before.projectDirectories.map((snapshot) => snapshot.path))
           : new Set(),
       policy: membershipPolicy,
@@ -623,7 +641,7 @@ export async function captureTransformGeneration(props: {
     // published.
     await settleMutationTrackers([tracker, hostInputTracker, candidateTracker]);
     const walkStable =
-      !casePolicyLearned &&
+      !membershipPolicyLearned &&
       projectWalkStable({
         before,
         configStable,
@@ -657,6 +675,10 @@ export async function captureTransformGeneration(props: {
       : undefined;
     const projectInputHashes = { ...inputSnapshot.hashes };
     const cached: TtscCachedProjectTransform = {
+      compilerArguments: captureCompilerArguments(
+        compilerEnvironment,
+        props.runExternalCode,
+      ),
       // The pass this compile was started for. Its snapshot describes the
       // project as of this compile, so it is settled for this pass and any
       // later pass must re-prove it.
@@ -750,10 +772,10 @@ export async function captureTransformGeneration(props: {
         path: props.tsconfig,
       });
     }
-    if (casePolicyLearned) {
+    if (membershipPolicyLearned) {
       recordGenerationProofFailure(failures, {
         domain: "project",
-        kind: "case-policy-learned",
+        kind: "membership-policy-learned",
         path: props.tsconfig,
       });
     } else if (!walkStable) {
@@ -788,6 +810,17 @@ export async function captureTransformGeneration(props: {
     mergeGenerationProofFailures(failures, universalInputCapture.failures);
     const graphProofs =
       graphFailures.entries.length === 0 && graphFailures.omitted === 0;
+    if (
+      configStable &&
+      graphProofs &&
+      adoptionFailure === undefined &&
+      result.type !== "exception" &&
+      result.graph?.membership !== undefined
+    )
+      cached.compilerMembership = {
+        basis: membershipPrimer.basis,
+        report: result.graph.membership,
+      };
     const universalInputs = universalInputCapture.validation !== undefined;
     const stableProjectSnapshot =
       walkStable &&