gate-evm-tools 1.0.28 → 1.2.0

package/dist-runtime/delivery/custom-closure.js

@@ -0,0 +1,818 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomModuleClosure = exports.parseCustomInputClosure = void 0;
+exports.customBusinessRoot = customBusinessRoot;
+exports.assertBusinessInput = assertBusinessInput;
+const closure_format_1 = require("./closure-format");
+var closure_format_2 = require("./closure-format");
+Object.defineProperty(exports, "parseCustomInputClosure", { enumerable: true, get: function () { return closure_format_2.parseCustomInputClosure; } });
+/** Bounded deterministic CJS input collector. Supported-code validation, not a hostile-code sandbox. */
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_vm_1 = __importDefault(require("node:vm"));
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const typescript_1 = __importDefault(require("typescript"));
+const project_files_1 = require("./project-files");
+const data_1 = require("./data");
+const input_files_1 = require("./input-files");
+const protocol_1 = require("./protocol");
+const canonicalData_1 = require("../workflow/lib/canonicalData");
+const hash = (bytes) => (0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex");
+const portable = (name) => name.split(node_path_1.default.sep).join("/");
+const compare = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+const extensions = [".ts", ".cts", ".js", ".cjs", ".json"];
+const policy = "gate-custom-cjs@1";
+/** Validate before normalization; only the supplied project root and its realpath are aliases. */
+function customBusinessRoot(root, businessRoot) {
+    if (typeof businessRoot !== "string" ||
+        !node_path_1.default.isAbsolute(businessRoot) ||
+        businessRoot.includes("\\") ||
+        businessRoot.split(node_path_1.default.sep).some((part) => part === "." || part === ".."))
+        throw new Error("Unsafe custom business root directory");
+    const canonicalRoot = node_fs_1.default.realpathSync(root);
+    const base = node_path_1.default.resolve(businessRoot);
+    const alias = [node_path_1.default.resolve(root), canonicalRoot].find((candidate) => base === candidate || base.startsWith(candidate + node_path_1.default.sep));
+    if (!alias)
+        throw new Error("Custom business root must be confined to the project");
+    const relative = portable(node_path_1.default.relative(alias, base));
+    // A not-yet-created task directory is valid when the script uses no file ports.
+    return relative
+        ? (0, project_files_1.confinedFile)(canonicalRoot, relative, "directory")
+        : canonicalRoot;
+}
+const runtimeOptions = closure_format_1.closureRuntimeOptions;
+const ambient = new Set([
+    "process",
+    "global",
+    "globalThis",
+    "window",
+    "self",
+    "document",
+    "Deno",
+    "Bun",
+    "Date",
+    "performance",
+    "crypto",
+    "fetch",
+    "WebSocket",
+    "XMLHttpRequest",
+    "Worker",
+    "SharedArrayBuffer",
+    "Atomics",
+    "Buffer",
+    "console",
+    "setTimeout",
+    "setInterval",
+    "setImmediate",
+    "queueMicrotask",
+    "eval",
+    "Function",
+    "AsyncFunction",
+    "WebAssembly",
+    "createRequire",
+    "__dirname",
+    "__filename",
+    "Intl",
+    "Reflect",
+    "Proxy",
+    "WeakRef",
+    "FinalizationRegistry",
+]);
+const forbiddenMembers = new Set([
+    "constructor",
+    "__proto__",
+    "getPrototypeOf",
+    "setPrototypeOf",
+    "getOwnPropertyDescriptor",
+    "getOwnPropertyDescriptors",
+    "random",
+    "stack",
+    "captureStackTrace",
+    "prepareStackTrace",
+]);
+/** Same restrictions for business ports and project imports: config/provenance is a separate future projection. */
+function assertBusinessInput(relative, packageCode = false) {
+    (0, protocol_1.portablePath)(relative, "business input path");
+    if (/[*?\[\]{}]/.test(relative))
+        throw new Error("Unsupported directory/glob business input");
+    if (relative
+        .split("/")
+        .some((segment) => /^(?:\.env.*|\.npmrc(?:\..*)?|\.yarnrc(?:\..*)?|\.git|\.ssh|\.aws|\.openzeppelin(?:\..*)?|keys?|keystores?|credentials?|secrets?|wallets?|results?|reports?|status|releases?|candidates?|handoffs?|manifests?)(?:\..*)?$/i.test(segment) ||
+        /^(?:contractInfo|deploymentInfo|state|release|pending|handoff|manifest|status|private[-_]?keys?|package-lock|npm-shrinkwrap|yarn\.lock|pnpm-lock|deploy(?:ment)?[-_.]?(?:config|settings)|\.gate-template|hardhat\.config|foundry)(?:\..*)?$/i.test(segment) ||
+        /\.(?:pem|key|p12|pfx)$/i.test(segment) ||
+        (!packageCode &&
+            /^(?:artifacts?|cache|dist(?:-.*)?|node_modules|config|configs|deployments?)(?:\..*)?$/i.test(segment))))
+        throw new Error("Business input cannot access sensitive, generated-state or private config paths");
+}
+function packageName(specifier) {
+    const parts = specifier.split("/");
+    return specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+}
+function propertyText(node) {
+    if (typescript_1.default.isComputedPropertyName(node))
+        return propertyText(node.expression);
+    return typescript_1.default.isIdentifier(node) ||
+        typescript_1.default.isStringLiteral(node) ||
+        typescript_1.default.isNumericLiteral(node)
+        ? node.text
+        : "";
+}
+function staticEdges(source, name) {
+    const ast = typescript_1.default.createSourceFile(name, source, typescript_1.default.ScriptTarget.Latest, true, name.endsWith(".ts") || name.endsWith(".cts")
+        ? typescript_1.default.ScriptKind.TS
+        : typescript_1.default.ScriptKind.JS);
+    if (ast
+        .parseDiagnostics.length)
+        throw new Error(`Unsupported module syntax: ${name}`);
+    const edges = new Set();
+    const literal = (node) => {
+        if (!node || !typescript_1.default.isStringLiteral(node))
+            throw new Error(`Unsupported nonliteral loader: ${name}`);
+        edges.add(node.text);
+    };
+    const visit = (node) => {
+        // Transpile-only type edges are deliberately absent from the runtime graph.
+        if (typescript_1.default.isTypeNode(node) ||
+            typescript_1.default.isInterfaceDeclaration(node) ||
+            typescript_1.default.isTypeAliasDeclaration(node))
+            return;
+        if (typescript_1.default.isImportDeclaration(node)) {
+            const clause = node.importClause;
+            if (clause?.isTypeOnly ||
+                (clause &&
+                    !clause.name &&
+                    clause.namedBindings &&
+                    typescript_1.default.isNamedImports(clause.namedBindings) &&
+                    clause.namedBindings.elements.every((e) => e.isTypeOnly)))
+                return;
+            literal(node.moduleSpecifier);
+            return;
+        }
+        if (typescript_1.default.isExportDeclaration(node)) {
+            if (node.isTypeOnly ||
+                (node.exportClause &&
+                    typescript_1.default.isNamedExports(node.exportClause) &&
+                    node.exportClause.elements.length > 0 &&
+                    node.exportClause.elements.every((e) => e.isTypeOnly)))
+                return;
+            if (node.moduleSpecifier)
+                literal(node.moduleSpecifier);
+            return;
+        }
+        if (typescript_1.default.isImportEqualsDeclaration(node)) {
+            if (node.isTypeOnly)
+                return;
+            if (!typescript_1.default.isExternalModuleReference(node.moduleReference))
+                throw new Error(`Unsupported import alias: ${name}`);
+            literal(node.moduleReference.expression);
+            return;
+        }
+        if (typescript_1.default.isCallExpression(node) &&
+            node.expression.kind === typescript_1.default.SyntaxKind.ImportKeyword)
+            throw new Error(`Unsupported runtime import loader: ${name}`);
+        if (typescript_1.default.isIdentifier(node)) {
+            if (ambient.has(node.text))
+                throw new Error(`Unsupported ambient capability ${node.text}: ${name}`);
+            if (node.text === "require") {
+                const p = node.parent;
+                if (!typescript_1.default.isCallExpression(p) ||
+                    p.expression !== node ||
+                    p.arguments.length !== 1)
+                    throw new Error(`Unsupported require loader access: ${name}`);
+                literal(p.arguments[0]);
+            }
+            if (node.text === "module" &&
+                !(typescript_1.default.isPropertyAccessExpression(node.parent) &&
+                    node.parent.expression === node &&
+                    node.parent.name.text === "exports"))
+                throw new Error(`Unsupported module loader access: ${name}`);
+        }
+        if ((typescript_1.default.isElementAccessExpression(node) &&
+            !typescript_1.default.isStringLiteral(node.argumentExpression) &&
+            !typescript_1.default.isNumericLiteral(node.argumentExpression)) ||
+            (typescript_1.default.isComputedPropertyName(node) &&
+                ((!typescript_1.default.isStringLiteral(node.expression) &&
+                    !typescript_1.default.isNumericLiteral(node.expression)) ||
+                    forbiddenMembers.has(propertyText(node)))) ||
+            (typescript_1.default.isBindingElement(node) &&
+                forbiddenMembers.has(propertyText(node.propertyName ?? node.name))))
+            throw new Error(`Unsupported dynamic reflective access: ${name}`);
+        if ((typescript_1.default.isPropertyAccessExpression(node) &&
+            forbiddenMembers.has(node.name.text)) ||
+            (typescript_1.default.isElementAccessExpression(node) &&
+                node.argumentExpression &&
+                typescript_1.default.isStringLiteral(node.argumentExpression) &&
+                forbiddenMembers.has(node.argumentExpression.text)))
+            throw new Error(`Unsupported reflective or ambient access: ${name}`);
+        typescript_1.default.forEachChild(node, visit);
+    };
+    visit(ast);
+    return [...edges].sort();
+}
+/** A fresh Node process avoids require.resolve's path and package-json caches during drift checks. */
+function nodeResolve(root, importer, specifier) {
+    const output = (0, node_child_process_1.spawnSync)(process.execPath, [
+        "--preserve-symlinks",
+        "-e",
+        `const fs=require('node:fs'),{createRequire}=require('node:module');const q=JSON.parse(fs.readFileSync(0,'utf8'));try{process.stdout.write(createRequire(q.importer).resolve(q.specifier))}catch{process.exitCode=1}`,
+    ], {
+        cwd: root,
+        env: {},
+        input: JSON.stringify({ importer, specifier }),
+        encoding: "utf8",
+        timeout: 10000,
+        maxBuffer: 1024 * 1024,
+    });
+    if (output.status !== 0 || !node_path_1.default.isAbsolute(output.stdout))
+        throw new Error("Unsupported ambient package or missing Node CJS resolution");
+    return output.stdout;
+}
+function validateHost(root) {
+    if (process.env.NODE_PATH ||
+        process.env.NODE_OPTIONS ||
+        Object.keys(process.env).some((k) => k.startsWith("TS_NODE_")))
+        throw new Error("Unsupported ambient loader environment");
+    const args = process.execArgv;
+    // Node's test runner may pass only test-related switches, which do not install loaders.
+    const relevant = args.filter((a) => !/^--test(?:=|$|-)/.test(a));
+    if (!relevant.length)
+        return { kind: "isolated-cjs", preload: null, packages: [] };
+    if (relevant.length !== 2 ||
+        !["-r", "--require"].includes(relevant[0]) ||
+        relevant[1] !== "ts-node/register")
+        throw new Error("Unsupported preload, loader or conditions");
+    try {
+        const packages = [];
+        const lock = JSON.parse(node_fs_1.default.readFileSync((0, project_files_1.confinedFile)(root, "package-lock.json"), "utf8"));
+        for (const [name, version] of [
+            ["ts-node", "10.9.2"],
+            ["hardhat", "2.26.3"],
+        ]) {
+            const bytes = node_fs_1.default.readFileSync((0, project_files_1.confinedFile)(root, `node_modules/${name}/package.json`));
+            const metadata = JSON.parse(bytes.toString("utf8"));
+            const locked = lock.packages?.[`node_modules/${name}`];
+            if (![2, 3].includes(lock.lockfileVersion) ||
+                metadata.name !== name ||
+                metadata.version !== version ||
+                locked?.version !== version ||
+                locked?.link)
+                throw new Error();
+            packages.push({ name, version, metadataDigest: hash(bytes) });
+        }
+        const actual = nodeResolve(root, node_path_1.default.join(root, "package.json"), "ts-node/register");
+        if (actual !== (0, project_files_1.confinedFile)(root, "node_modules/ts-node/register/index.js") ||
+            !require.cache[actual]?.loaded)
+            throw new Error();
+        if (process.env.HARDHAT_TSCONFIG &&
+            node_path_1.default.resolve(process.env.HARDHAT_TSCONFIG) !==
+                node_path_1.default.join(root, "tsconfig.json"))
+            throw new Error();
+        return {
+            kind: "hardhat-2.26.3-ts-node-10.9.2",
+            preload: {
+                path: "node_modules/ts-node/register/index.js",
+                digest: hash(node_fs_1.default.readFileSync(actual)),
+            },
+            packages,
+        };
+    }
+    catch {
+        throw new Error("Unsupported pinned Hardhat preload adapter identity/location");
+    }
+}
+class CustomModuleClosure {
+    #root;
+    #inputRoot;
+    #files = new Map();
+    #edges = new Map();
+    #packages = new Map();
+    #roots = new Set();
+    #failure;
+    #absent = new Set();
+    #cache = new Map();
+    #context = node_vm_1.default.createContext(Object.create(null), {
+        codeGeneration: { strings: false, wasm: false },
+    });
+    #realm;
+    #options = { ...runtimeOptions };
+    #adapter;
+    #config = null;
+    constructor(root) {
+        if (typescript_1.default.version !== "5.9.3")
+            throw new Error("Unsupported custom TypeScript compiler version");
+        this.#inputRoot = node_path_1.default.resolve(root);
+        this.#root = node_fs_1.default.realpathSync(root);
+        this.#adapter = validateHost(this.#root);
+        this.#realm = node_vm_1.default.runInContext("({object:Object.prototype,array:Array.prototype})", this.#context);
+        node_vm_1.default.runInContext('Object.defineProperty(Math,"random",{value:undefined});Object.freeze(Math);', this.#context);
+        this.#readConfig();
+    }
+    #relative(file) {
+        const relative = portable(node_path_1.default.relative(this.#root, file));
+        (0, protocol_1.portablePath)(relative, "confined module path");
+        return relative;
+    }
+    #file(relative) {
+        return (0, project_files_1.confinedFile)(this.#root, relative);
+    }
+    #capture(relative, kind) {
+        const bytes = node_fs_1.default.readFileSync(this.#file(relative));
+        const previous = this.#files.get(relative);
+        if (previous) {
+            if (hash(bytes) !== previous.identity.digest)
+                throw new Error(`Custom input changed during session: ${relative}`);
+            if (kind === "module" ||
+                kind === "json" ||
+                (kind === "config" && previous.identity.kind === "metadata"))
+                previous.identity.kind = kind;
+            return previous;
+        }
+        const captured = {
+            identity: {
+                path: relative,
+                kind,
+                digest: hash(bytes),
+                emittedDigest: null,
+            },
+            bytes,
+        };
+        this.#files.set(relative, captured);
+        return captured;
+    }
+    #metadata(relative) {
+        try {
+            return (0, data_1.strictData)(JSON.parse(this.#capture(relative, "metadata").bytes.toString("utf8")));
+        }
+        catch {
+            throw new Error("Invalid package metadata");
+        }
+    }
+    #sourceFormat(relative) {
+        let dir = node_path_1.default.posix.dirname(relative);
+        while (true) {
+            const name = dir === "." ? "package.json" : `${dir}/package.json`;
+            if ((0, project_files_1.stat)(this.#file(name))) {
+                const metadata = this.#metadata(name);
+                if ((relative.endsWith(".js") || relative.endsWith(".ts")) &&
+                    metadata.type === "module")
+                    throw new Error("Unsupported native ESM source format");
+                break;
+            }
+            this.#absent.add(name);
+            if (dir === ".")
+                break;
+            dir = node_path_1.default.posix.dirname(dir);
+        }
+    }
+    #packageFor(relative) {
+        const parts = relative.split("/");
+        const i = parts.lastIndexOf("node_modules");
+        if (i < 0)
+            return null;
+        const count = parts[i + 1]?.startsWith("@") ? 3 : 2;
+        if (parts.length <= i + count)
+            throw new Error("Invalid package runtime path");
+        return parts.slice(0, i + count).join("/");
+    }
+    #payload(location) {
+        const entries = [];
+        const walk = (dir) => {
+            for (const name of node_fs_1.default
+                .readdirSync((0, project_files_1.confinedFile)(this.#root, `${location}${dir ? "/" + dir : ""}`, "directory"))
+                .sort()) {
+                if (name === "node_modules")
+                    continue; // Independently resolved nested packages; never merge identities.
+                const relative = dir ? `${dir}/${name}` : name;
+                const info = (0, project_files_1.stat)(node_path_1.default.join(this.#root, location, relative));
+                if (info.isSymbolicLink())
+                    throw new Error("Unsafe symlink in package payload");
+                if (info.isDirectory())
+                    walk(relative);
+                else {
+                    const file = this.#file(`${location}/${relative}`);
+                    if (name.endsWith(".node"))
+                        throw new Error("Unsupported native package payload");
+                    entries.push({ path: relative, digest: hash(node_fs_1.default.readFileSync(file)) });
+                }
+            }
+        };
+        walk("");
+        return entries.sort((a, b) => compare(a.path, b.path));
+    }
+    #package(location) {
+        const metadata = this.#metadata(`${location}/package.json`);
+        let lock;
+        try {
+            lock = (0, data_1.strictData)(JSON.parse(node_fs_1.default.readFileSync(this.#file("package-lock.json"), "utf8")));
+        }
+        catch {
+            throw new Error("Custom packages require a local npm lock v2/v3");
+        }
+        if (![2, 3].includes(lock.lockfileVersion) ||
+            !lock.packages ||
+            typeof lock.packages !== "object")
+            throw new Error("Unsupported npm lock");
+        const entry = Object.getOwnPropertyDescriptor(lock.packages, location)?.value;
+        const installedName = location
+            .split("/node_modules/")
+            .at(-1)
+            .replace(/^node_modules\//, "");
+        if (!entry ||
+            entry.link ||
+            entry.extraneous ||
+            typeof metadata.name !== "string" ||
+            metadata.name !== installedName ||
+            (entry.name !== undefined && entry.name !== metadata.name) ||
+            entry.version !== metadata.version ||
+            typeof metadata.version !== "string" ||
+            !/^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/.test(metadata.version))
+            throw new Error("Package lock identity/version mismatch or extraneous package");
+        if (typeof entry.integrity !== "string" ||
+            !/^sha(?:256|384|512)-[A-Za-z0-9+/]+={0,2}$/.test(entry.integrity) ||
+            Buffer.from(entry.integrity.split("-")[1], "base64").length !==
+                Number(entry.integrity.slice(3).split("-")[0]) / 8 ||
+            typeof entry.resolved !== "string")
+            throw new Error("Package requires locked source integrity");
+        const tarball = /^file:.*\.tgz$/.test(entry.resolved);
+        if (!tarball && !/^https?:\/\//.test(entry.resolved))
+            throw new Error("Unsupported package source: directory/workspace links are not supported");
+        const resolution = Object.fromEntries(["type", "main", "exports", "imports"]
+            .filter((k) => Object.hasOwn(metadata, k))
+            .map((k) => [k, metadata[k]]));
+        const payload = this.#payload(location);
+        const result = {
+            lockLocation: location,
+            name: metadata.name,
+            version: metadata.version,
+            integrity: entry.integrity,
+            // Never serialize URLs or local tarball paths; installed payload and tarball SRI are separate identities.
+            source: {
+                kind: tarball ? "tarball" : "registry",
+                identity: tarball ? hash(entry.integrity) : hash(entry.resolved),
+            },
+            metadataDigest: this.#files.get(`${location}/package.json`).identity
+                .digest,
+            resolution,
+            payload,
+            payloadDigest: (0, canonicalData_1.semanticHash)(payload),
+        };
+        const previous = this.#packages.get(location);
+        if (previous && (0, canonicalData_1.canonicalJson)(previous) !== (0, canonicalData_1.canonicalJson)(result))
+            throw new Error(`Package payload/lock drift: ${location}`);
+        this.#packages.set(location, result);
+        return result;
+    }
+    #resolve(importer, specifier, kind) {
+        if (!specifier ||
+            specifier.includes("\\") ||
+            specifier.startsWith("#") ||
+            node_path_1.default.isAbsolute(specifier) ||
+            /^[a-zA-Z][a-zA-Z\d+.-]*:/.test(specifier))
+            throw new Error("Unsupported loader specifier");
+        if (specifier.startsWith(".")) {
+            const base = this.#relative(node_path_1.default.resolve(this.#root, node_path_1.default.posix.dirname(importer), specifier));
+            const importerPackage = this.#packageFor(importer);
+            assertBusinessInput(base, !!importerPackage);
+            if (importerPackage) {
+                const selected = this.#relative(nodeResolve(this.#root, node_path_1.default.join(this.#root, importer), specifier));
+                const location = this.#packageFor(selected);
+                if (!location)
+                    throw new Error("Unsupported package relative resolution escape");
+                this.#file(selected);
+                this.#package(location);
+                return selected;
+            }
+            const candidates = node_path_1.default.posix.extname(base)
+                ? [base]
+                : [
+                    base,
+                    ...extensions.map((ext) => base + ext),
+                    ...extensions.map((ext) => `${base}/index${ext}`),
+                ];
+            const present = candidates.filter((name) => {
+                const info = (0, project_files_1.stat)(node_path_1.default.join(this.#root, name));
+                if (!info)
+                    return false;
+                if (info.isDirectory()) {
+                    (0, project_files_1.confinedFile)(this.#root, name, "directory");
+                    return false;
+                }
+                this.#file(name);
+                return info.isFile();
+            });
+            if (present.length !== 1)
+                throw new Error(`Missing or ambiguous runtime target: ${importer}`);
+            return present[0];
+        }
+        if (specifier.split("/").some((p) => !p || p === "." || p === "..") ||
+            !/^(@[A-Za-z0-9._-]+\/)?[A-Za-z0-9_-][A-Za-z0-9._-]*(\/.*)?$/.test(specifier))
+            throw new Error("Unsupported package specifier");
+        const selected = this.#relative(nodeResolve(this.#root, node_path_1.default.join(this.#root, importer), specifier));
+        const location = this.#packageFor(selected);
+        if (!location || !selected.startsWith(location + "/"))
+            throw new Error("Unsupported ancestor/global package resolution");
+        this.#file(selected);
+        const metadata = this.#package(location);
+        if (metadata.name !== packageName(specifier))
+            throw new Error("Package resolution identity mismatch");
+        if (kind === "runtime" &&
+            (selected.endsWith(".mjs") ||
+                selected.endsWith(".node") ||
+                (selected.endsWith(".js") && metadata.resolution.type === "module")))
+            throw new Error("Unsupported native ESM or addon package");
+        return selected;
+    }
+    #edge(importer, specifier, kind) {
+        const target = this.#resolve(importer, specifier, kind);
+        const key = (0, canonicalData_1.canonicalJson)([importer, specifier, kind]);
+        const previous = this.#edges.get(key);
+        if (previous && previous.target !== target)
+            throw new Error("Custom resolution drift");
+        this.#edges.set(key, { importer, specifier, target, kind });
+        return target;
+    }
+    #readConfig() {
+        const rootConfig = "tsconfig.json";
+        const active = new Set();
+        const read = (name) => {
+            assertBusinessInput(name, true);
+            const location = this.#packageFor(name);
+            if (location)
+                this.#package(location);
+            if (active.has(name))
+                throw new Error("Unsupported tsconfig extends cycle");
+            active.add(name);
+            const raw = typescript_1.default.parseConfigFileTextToJson(name, this.#capture(name, "config").bytes.toString("utf8"));
+            if (raw.error)
+                throw new Error("Invalid tsconfig JSONC");
+            const value = (0, data_1.strictData)(raw.config);
+            if (Object.hasOwn(value, "ts-node") || Object.hasOwn(value, "plugins"))
+                throw new Error("Unsupported tsconfig loader hooks");
+            let inherited = {};
+            if (value.extends !== undefined) {
+                if (typeof value.extends !== "string")
+                    throw new Error("Unsupported tsconfig extends");
+                const spec = value.extends;
+                const parent = spec.startsWith(".")
+                    ? this.#relative(node_path_1.default.resolve(this.#root, node_path_1.default.posix.dirname(name), spec.endsWith(".json") ? spec : spec + ".json"))
+                    : this.#edge(name, spec, "config");
+                if (spec.startsWith(".")) {
+                    this.#edges.set((0, canonicalData_1.canonicalJson)([name, spec, "config"]), {
+                        importer: name,
+                        specifier: spec,
+                        target: parent,
+                        kind: "config",
+                    });
+                }
+                inherited = read(parent);
+            }
+            const options = value.compilerOptions ?? {};
+            if (!options || typeof options !== "object" || Array.isArray(options))
+                throw new Error("Invalid compiler options");
+            for (const key of [
+                "baseUrl",
+                "paths",
+                "rootDirs",
+                "plugins",
+                "customConditions",
+                "moduleSuffixes",
+                "outFile",
+                "jsx",
+                "jsxFactory",
+                "jsxImportSource",
+                "experimentalDecorators",
+                "emitDecoratorMetadata",
+                "importHelpers",
+                "noResolve",
+            ])
+                if (Object.hasOwn(options, key))
+                    throw new Error(`Unsupported runtime compiler option/alias: ${key}`);
+            active.delete(name);
+            return { ...inherited, ...options };
+        };
+        if ((0, project_files_1.stat)(this.#file(rootConfig))) {
+            this.#config = rootConfig;
+            const options = read(rootConfig);
+            const parsed = typescript_1.default.convertCompilerOptionsFromJson(options, ".");
+            if (parsed.errors.length)
+                throw new Error("Unsupported or invalid tsconfig options");
+            if (parsed.options.module !== undefined &&
+                ![
+                    typescript_1.default.ModuleKind.CommonJS,
+                    typescript_1.default.ModuleKind.Node16,
+                    typescript_1.default.ModuleKind.NodeNext,
+                ].includes(parsed.options.module))
+                throw new Error("Unsupported runtime module option");
+            if (parsed.options.target !== undefined)
+                this.#options.target = parsed.options.target;
+            if (parsed.options.esModuleInterop !== undefined)
+                this.#options.esModuleInterop = parsed.options.esModuleInterop;
+            if (parsed.options.useDefineForClassFields !== undefined)
+                this.#options.useDefineForClassFields =
+                    parsed.options.useDefineForClassFields;
+        }
+        else
+            this.#absent.add(rootConfig);
+    }
+    #collect(relative) {
+        if (this.#files.get(relative)?.identity.kind === "module" ||
+            this.#files.get(relative)?.identity.kind === "json")
+            return;
+        const location = this.#packageFor(relative);
+        assertBusinessInput(location ? relative.slice(location.length + 1) : relative, !!location);
+        if (location)
+            this.#package(location);
+        const ext = node_path_1.default.posix.extname(relative);
+        if (!extensions.includes(ext) || /\.d\.(?:ts|cts)$/.test(relative))
+            throw new Error("Unsupported runtime module extension");
+        if (location && [".ts", ".cts"].includes(ext))
+            throw new Error("Unsupported package TypeScript runtime adapter");
+        this.#sourceFormat(relative);
+        const captured = this.#capture(relative, ext === ".json" ? "json" : "module");
+        if (ext === ".json") {
+            (0, input_files_1.parseInputDocument)(captured.bytes, 'json');
+            return;
+        }
+        const dependencies = staticEdges(captured.bytes.toString("utf8"), relative);
+        const emitted = typescript_1.default.transpileModule(captured.bytes.toString("utf8"), {
+            compilerOptions: this.#options,
+            fileName: relative,
+            reportDiagnostics: true,
+        });
+        if (emitted.diagnostics?.some((d) => d.category === typescript_1.default.DiagnosticCategory.Error))
+            throw new Error(`Unsupported transpilation: ${relative}`);
+        captured.emitted = emitted.outputText;
+        captured.identity.emittedDigest = hash(emitted.outputText);
+        for (const specifier of dependencies)
+            this.#collect(this.#edge(relative, specifier, "runtime"));
+    }
+    #load(relative) {
+        const previous = this.#cache.get(relative);
+        if (previous)
+            return previous.exports; // Node CJS cycle semantics: publish partial exports before evaluation.
+        const captured = this.#files.get(relative);
+        const module = { exports: {} };
+        this.#cache.set(relative, module);
+        try {
+            if (captured.identity.kind === "json")
+                module.exports = (0, canonicalData_1.deepFreeze)((0, input_files_1.parseInputDocument)(captured.bytes, 'json'));
+            else {
+                const ownedRequire = (specifier) => {
+                    const edge = this.#edges.get((0, canonicalData_1.canonicalJson)([relative, specifier, "runtime"]));
+                    if (!edge)
+                        throw new Error("Unsupported uncaptured loader access");
+                    return this.#load(edge.target);
+                };
+                const wrapper = new node_vm_1.default.Script(`(function(exports,module,require){"use strict";\n${captured.emitted}\n})`, { filename: relative }).runInContext(this.#context);
+                wrapper(module.exports, module, ownedRequire);
+            }
+            return module.exports;
+        }
+        catch (error) {
+            // CJS retries failed initializers, retaining any successfully loaded dependencies.
+            this.#cache.delete(relative);
+            throw error;
+        }
+    }
+    /** Normalize only this collector's own VM prototypes; never invoke getters or toJSON. */
+    normalize(raw) {
+        const active = new Set();
+        const visit = (value) => {
+            if (value === null ||
+                typeof value === "string" ||
+                typeof value === "boolean" ||
+                (typeof value === "number" && Number.isSafeInteger(value)))
+                return value;
+            if (!value ||
+                typeof value !== "object" ||
+                active.has(value) ||
+                Object.getOwnPropertySymbols(value).length)
+                throw new Error("Custom result requires acyclic own JSON data");
+            const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
+            if (!(array
+                ? [this.#realm.array, Array.prototype]
+                : [this.#realm.object, Object.prototype, null]).includes(proto))
+                throw new Error("Custom result requires plain own data");
+            const keys = Object.getOwnPropertyNames(value);
+            if (array &&
+                (keys.length !== value.length + 1 ||
+                    keys.some((k) => k !== "length" &&
+                        (!/^(0|[1-9][0-9]*)$/.test(k) || Number(k) >= value.length))))
+                throw new Error("Custom result requires dense own array data");
+            active.add(value);
+            const out = array ? [] : {};
+            for (const key of keys) {
+                if (array && key === "length")
+                    continue;
+                const d = Object.getOwnPropertyDescriptor(value, key);
+                if (!d.enumerable || !("value" in d))
+                    throw new Error("Custom result requires enumerable own data");
+                Object.defineProperty(out, key, {
+                    value: visit(d.value),
+                    enumerable: true,
+                    writable: true,
+                    configurable: true,
+                });
+            }
+            active.delete(value);
+            return out;
+        };
+        return (0, data_1.strictData)(visit(raw));
+    }
+    #readsClosed = false;
+    closeReads() { this.#readsClosed = true; }
+    load(relative) {
+        try {
+            if (this.#readsClosed)
+                throw new Error("Custom input reads closed");
+            (0, protocol_1.portablePath)(relative, "custom module");
+            this.assertUnchanged();
+            this.#collect(relative);
+            this.#roots.add(relative);
+            return {
+                module: this.#load(relative),
+                identity: {
+                    path: relative,
+                    digest: this.#files.get(relative).identity.digest,
+                },
+            };
+        }
+        catch (error) {
+            this.#failure =
+                error instanceof Error
+                    ? error
+                    : new Error("Unsupported module evaluation");
+            throw error;
+        }
+    }
+    readData(root, relative) {
+        if (this.#readsClosed)
+            throw new Error("Custom input reads closed");
+        assertBusinessInput(relative);
+        const base = customBusinessRoot(this.#inputRoot, root);
+        const name = portable(node_path_1.default.relative(this.#root, node_path_1.default.join(base, relative)));
+        (0, protocol_1.portablePath)(name, "business input");
+        assertBusinessInput(name);
+        return {
+            bytes: Buffer.from(this.#capture(name, "data").bytes),
+            path: name,
+        };
+    }
+    assertUnchanged() {
+        if (this.#failure)
+            throw new Error(`Custom closure collection failed: ${this.#failure.message}`);
+        if ((0, canonicalData_1.canonicalJson)(validateHost(this.#root)) !== (0, canonicalData_1.canonicalJson)(this.#adapter))
+            throw new Error("Host loader adapter drift");
+        for (const name of this.#absent)
+            if ((0, project_files_1.stat)(this.#file(name)))
+                throw new Error(`Custom resolution metadata changed: ${name}`);
+        for (const [name, value] of this.#files)
+            if (hash(node_fs_1.default.readFileSync(this.#file(name))) !== value.identity.digest)
+                throw new Error(`Custom input drift: ${name}`);
+        for (const edge of this.#edges.values()) {
+            const selected = edge.kind === "config" && edge.specifier.startsWith(".")
+                ? this.#relative(node_path_1.default.resolve(this.#root, node_path_1.default.posix.dirname(edge.importer), edge.specifier.endsWith(".json")
+                    ? edge.specifier
+                    : edge.specifier + ".json"))
+                : this.#resolve(edge.importer, edge.specifier, edge.kind);
+            if (selected !== edge.target)
+                throw new Error("Custom resolution changed during session");
+        }
+        for (const location of this.#packages.keys())
+            this.#package(location);
+    }
+    seal() {
+        this.assertUnchanged();
+        const body = {
+            version: 1,
+            policy,
+            roots: [...this.#roots].sort(),
+            files: [...this.#files.values()]
+                .map((f) => ({ ...f.identity }))
+                .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),
+            edges: [...this.#edges.values()].sort((a, b) => compare((0, canonicalData_1.canonicalJson)(a), (0, canonicalData_1.canonicalJson)(b))),
+            packages: [...this.#packages.values()].sort((a, b) => compare(a.lockLocation, b.lockLocation)),
+            compiler: {
+                version: typescript_1.default.version,
+                options: { ...this.#options },
+                config: this.#config,
+            },
+            hostAdapter: this.#adapter,
+            resolver: {
+                policy: "node-default-cjs",
+                version: process.versions.node,
+                flags: ["--preserve-symlinks"],
+                environment: "empty",
+            },
+        };
+        return (0, canonicalData_1.deepFreeze)({ ...body, closureHash: (0, canonicalData_1.semanticHash)(body) });
+    }
+}
+exports.CustomModuleClosure = CustomModuleClosure;
+Object.freeze(CustomModuleClosure.prototype);
+/** Pure structural parser; only collector-owned sessions establish collection authority. */
+//# sourceMappingURL=custom-closure.js.map