ttsc 0.33.1 → 0.34.0

package/README.md

@@ -21,6 +21,8 @@ A `typescript-go` toolchain for compiler-powered plugins and type-safe execution
 npm install -D ttsc typescript
 ```
 
+`ttsc` runs the native TypeScript compiler installed beside it, so the project needs `typescript` 7.0 or later.
+
 ```bash
 npx ttsx src/index.ts   # run a file, type-checked first
 npx ttsc                # build

package/cmd/ttsc/api_compile.go

@@ -13,6 +13,7 @@ import (
   "os"
 
   shimcompiler "github.com/microsoft/typescript-go/shim/compiler"
+  shimtspath "github.com/microsoft/typescript-go/shim/tspath"
 
   "github.com/samchon/ttsc/packages/ttsc/driver"
   cwdutil "github.com/samchon/ttsc/packages/ttsc/internal/cwd"
@@ -114,8 +115,8 @@ func writeCompiledProgramResponse(prog *driver.Program, diags []driver.Diagnosti
     // Capture WriteFile output in a map keyed by project-relative paths. This
     // gives the JS API a deterministic object and avoids touching outDir.
     writeFile := shimcompiler.WriteFile(
-      func(fileName, text string, _ *shimcompiler.WriteFileData) error {
-        output[apiOutputKey(cwd, fileName)] = text
+      func(fileName shimtspath.RootedFilePath, text string, _ *shimcompiler.WriteFileData) error {
+        output[apiOutputKey(cwd, string(fileName))] = text
         return nil
       },
     )

package/cmd/ttsc/api_transform.go

@@ -117,7 +117,7 @@ func writeTransformedProgramResponse(prog *driver.Program, diags []driver.Diagno
     // not the mutated output.
     graph = driver.NewTransformGraph(prog, cwd)
     for _, file := range prog.SourceFiles() {
-      typescript[apiOutputKey(cwd, file.FileName())] = file.Text()
+      typescript[apiOutputKey(cwd, string(file.FileName()))] = file.Text()
     }
     diags = append(diags, prog.Diagnostics()...)
     dependencies = prog.TransformDependenciesFor(cwd)

package/cmd/ttsc/build.go

@@ -15,6 +15,7 @@ import (
   "path/filepath"
 
   shimcompiler "github.com/microsoft/typescript-go/shim/compiler"
+  shimtspath "github.com/microsoft/typescript-go/shim/tspath"
 
   "github.com/samchon/ttsc/packages/ttsc/driver"
 )
@@ -92,8 +93,8 @@ func writeBuildProgramResponse(prog *driver.Program, diags []driver.Diagnostic,
     // wraps only the final WriteFile step so native rewrites and custom output
     // capture share the same path.
     writeFile := shimcompiler.WriteFile(
-      func(fileName, text string, _ *shimcompiler.WriteFileData) error {
-        return driver.DefaultWriteFile(fileName, text)
+      func(fileName shimtspath.RootedFilePath, text string, _ *shimcompiler.WriteFileData) error {
+        return driver.DefaultWriteFile(string(fileName), text)
       },
     )
     var snapshot func() map[string][]string
@@ -130,8 +131,8 @@ func writeBuildProgramResponse(prog *driver.Program, diags []driver.Diagnostic,
     if !request.quiet {
       fmt.Fprintf(stdout, "// ttsc: emitted=%d files\n", len(res.EmittedFiles))
       for _, f := range res.EmittedFiles {
-        rel := f
-        if abs, err := filepath.Rel(request.cwd, f); err == nil {
+        rel := string(f)
+        if abs, err := filepath.Rel(request.cwd, string(f)); err == nil {
           rel = abs
         }
         fmt.Fprintln(stdout, "  +", rel)

package/cmd/ttsc-cache/account.go

@@ -4,6 +4,7 @@ import (
   "errors"
   "fmt"
   "io"
+  "io/fs"
   "os"
   "path/filepath"
 )
@@ -21,6 +22,12 @@ type artifactAccounting struct {
 // accountArtifactStore reads bounded rooted metadata for every retained cache
 // population. The byte totals are logical file lengths, not free-space or
 // physical allocated-byte claims; concurrent writers can change them later.
+//
+// A concurrent preparation of the same store removes its staging lock, and
+// cleanup removes staged files, while this walks. An entry or directory that
+// no longer exists when it is reached is therefore skipped as absent rather
+// than failing the accounting; the depth, count, size and alias policies
+// still apply to everything that does exist.
 func accountArtifactStore(store *artifactStore) (artifactAccounting, error) {
   var result artifactAccounting
   var entries int
@@ -30,12 +37,18 @@ func accountArtifactStore(store *artifactStore) (artifactAccounting, error) {
       return errors.New("artifact storage exceeds directory depth policy")
     }
     opened, err := store.root.Open(directory)
+    if errors.Is(err, fs.ErrNotExist) {
+      return nil
+    }
     if err != nil {
       return err
     }
     defer opened.Close()
     for {
       batch, readErr := opened.ReadDir(256)
+      if len(batch) != 0 && store.accountingListed != nil {
+        store.accountingListed(directory)
+      }
       for _, entry := range batch {
         entries++
         if entries > 100000 {
@@ -43,6 +56,9 @@ func accountArtifactStore(store *artifactStore) (artifactAccounting, error) {
         }
         child := filepath.ToSlash(filepath.Join(directory, entry.Name()))
         info, err := store.root.Lstat(child)
+        if errors.Is(err, fs.ErrNotExist) {
+          continue
+        }
         if err != nil {
           return err
         }

package/cmd/ttsc-cache/account_test.go

@@ -0,0 +1,91 @@
+package main
+
+import (
+  "os"
+  "path/filepath"
+  "strings"
+  "testing"
+)
+
+// TestAccountArtifactStore verifies that accounting skips entries a concurrent preparation removes while it walks.
+//
+// Verifies: a staging lock or staged directory removed between listing and stat is omitted from a successful accounting, while existing entries are still counted and still bound by policy.
+// 1. Account a populated store without interference, as the baseline.
+// 2. Remove a staging lock and a staged directory after their directories are listed, and require success without them.
+// 3. Exceed the depth policy beside a removed entry, and require the policy failure.
+//
+// @evidence contracts/testing.md#behavioral-verification Calls the production accountArtifactStore over real files in an owned store and compares the returned totals; removals happen through the store's accountingListed seam at the exact listing-to-stat window of the race.
+// @evidence contracts/testing.md#independent-expectations Totals are the literal byte lengths written by the test: 7 pack bytes, 5 + 9 staging bytes with the lock and the staged file present, and only the 5-byte staged body once they are removed.
+// @evidence contracts/testing.md#distinguishing-cases The undisturbed baseline contrasts with a vanished file and a vanished directory, and the depth case shows the absence rule does not excuse an entry that exists and breaks policy.
+// @evidence contracts/testing.md#execution-ownership This Go unit test owns a temporary directory and calls accounting directly; it starts no preparation, transfer or external process.
+func TestAccountArtifactStore(t *testing.T) {
+  populate := func(t *testing.T) *artifactStore {
+    store, err := openArtifactStore(t.TempDir(), nil)
+    if err != nil {
+      t.Fatal(err)
+    }
+    t.Cleanup(func() { store.close() })
+    for name, body := range map[string]string{
+      "base/packs/base.pack":                  "packbin",
+      "base/staging/base-0123.lock":           "lockowner",
+      "base/staging/keep.bin":                 "kept!",
+      "overlay/staging/transient/partial.bin": "gone",
+    } {
+      file := filepath.Join(store.path, filepath.FromSlash(name))
+      if err := os.MkdirAll(filepath.Dir(file), 0700); err != nil {
+        t.Fatal(err)
+      }
+      if err := os.WriteFile(file, []byte(body), 0600); err != nil {
+        t.Fatal(err)
+      }
+    }
+    return store
+  }
+  removeOnce := func(t *testing.T, store *artifactStore, removals map[string]string) {
+    store.accountingListed = func(directory string) {
+      target, ok := removals[directory]
+      if !ok {
+        return
+      }
+      delete(removals, directory)
+      if err := os.RemoveAll(filepath.Join(store.path, filepath.FromSlash(target))); err != nil {
+        t.Fatal(err)
+      }
+    }
+  }
+
+  baseline, err := accountArtifactStore(populate(t))
+  if err != nil {
+    t.Fatal(err)
+  }
+  if baseline.BaseBytes != 7 || baseline.BaseFiles != 1 || baseline.StagingBytes != 5+9+4 || baseline.StagingFiles != 3 {
+    t.Fatalf("baseline accounting: %+v", baseline)
+  }
+
+  store := populate(t)
+  removals := map[string]string{
+    "base/staging":    "base/staging/base-0123.lock",
+    "overlay/staging": "overlay/staging/transient",
+  }
+  removeOnce(t, store, removals)
+  vanished, err := accountArtifactStore(store)
+  if err != nil {
+    t.Fatalf("accounting failed on removed entries: %v", err)
+  }
+  if len(removals) != 0 {
+    t.Fatalf("removals not reached: %v", removals)
+  }
+  if vanished.BaseBytes != 7 || vanished.BaseFiles != 1 || vanished.StagingBytes != 5 || vanished.StagingFiles != 1 {
+    t.Fatalf("accounting kept removed entries: %+v", vanished)
+  }
+
+  store = populate(t)
+  deep := filepath.Join(store.path, "overlay", "staging", filepath.FromSlash(strings.Repeat("d/", 5)))
+  if err := os.MkdirAll(deep, 0700); err != nil {
+    t.Fatal(err)
+  }
+  removeOnce(t, store, map[string]string{"base/staging": "base/staging/base-0123.lock"})
+  if _, err := accountArtifactStore(store); err == nil || !strings.Contains(err.Error(), "directory depth policy") {
+    t.Fatalf("depth policy not enforced beside a removed entry: %v", err)
+  }
+}

package/cmd/ttsc-cache/main.go

@@ -187,7 +187,7 @@ func serve(source io.Reader, destination io.Writer, store *artifactStore) error
       if len(current.ActionID) != 32 || len(current.OutputID) != 32 || current.BodySize < 0 || current.BodySize > 512<<20 {
         return errors.New("invalid full Go cache put identity or body size")
       }
-      // Go 1.26 writes an extra newline after the encoded request.
+      // Go 1.26 and 1.27 write an extra newline after the encoded request.
       separator, err := input.ReadByte()
       if err != nil || separator != '\n' {
         return errors.New("missing Go cache request separator")

package/cmd/ttsc-cache/protocol_test.go

@@ -12,7 +12,7 @@ import (
   "testing"
 )
 
-// TestCacheProtocol verifies the Go 1.26 request framing and response contract.
+// TestCacheProtocol verifies the Go 1.26 and 1.27 request framing and response contract.
 //
 // Verifies: the helper advertises capabilities, echoes IDs, returns local hits and misses, writes a bounded usage receipt, and refuses malformed body transport.
 // 1. Send real Go-style request headers and separate base64 body values through the in-process server.
@@ -20,7 +20,7 @@ import (
 // 3. Break JSON, base64 and body framing independently and require terminal failure.
 //
 // @evidence contracts/testing.md#behavioral-verification Calls the production protocol loop against an actual temporary store, parses its public JSON responses and reads the post-close local usage receipt.
-// @evidence contracts/testing.md#independent-expectations The Go 1.26 cacheprog Request and Response fields, the extra request separator, and SHA-256 of literal bytes define expected framing and identities.
+// @evidence contracts/testing.md#independent-expectations The cacheprog Request and Response fields, identical in Go 1.26 and 1.27, the extra request separator, and SHA-256 of literal bytes define expected framing and identities.
 // @evidence contracts/testing.md#distinguishing-cases Covers startup, two misses, a large put/hit, empty body, unknown command, close, malformed JSON, bad base64 and truncated body; stock Go subprocess interoperability is a separate installed-boundary check.
 // @evidence contracts/testing.md#execution-ownership This Go unit test calls serve directly without compiling a helper or launching a Go client; each case owns a temporary store.
 func TestCacheProtocol(t *testing.T) {

package/cmd/ttsc-cache/publisher_seal_test.go

@@ -28,7 +28,7 @@ import (
 // @evidence contracts/testing.md#execution-ownership This discoverable Go integration test builds a local helper and two private modules, serves one loopback pack, and removes all files through t.TempDir; no consumer install or external network is involved.
 func TestPublisherSeal(t *testing.T) {
   if !supportedGoVersion.MatchString(runtime.Version()) {
-    t.Skip("publisher protocol requires a stock Go 1.26 patch release")
+    t.Skip("publisher protocol requires a stock Go 1.26 or 1.27 patch release")
   }
   goBinary, err := exec.LookPath("go")
   if err != nil {

package/cmd/ttsc-cache/stock_go_failure_test.go

@@ -25,7 +25,7 @@ import (
 // @evidence contracts/testing.md#execution-ownership This narrow Go subprocess test uses a temporary helper and tiny local module; it never installs a consumer or runs the product E2E suite.
 func TestStockGoCacheFailures(t *testing.T) {
   if !supportedGoVersion.MatchString(runtime.Version()) {
-    t.Skip("the helper protocol requires a stock Go 1.26 patch release")
+    t.Skip("the helper protocol requires a stock Go 1.26 or 1.27 patch release")
   }
   root := t.TempDir()
   helperSource := filepath.Join(root, "broken-helper.go")

package/cmd/ttsc-cache/stock_go_test.go

@@ -24,11 +24,11 @@ import (
 //
 // @evidence contracts/testing.md#behavioral-verification Runs stock go build with GOCACHEPROG through the production helper executable, then observes compiler commands and archive bytes.
 // @evidence contracts/testing.md#independent-expectations Identical source and dependency bytes under -trimpath should request the same actions; a changed dependency version must change the archive and require compilation.
-// @evidence contracts/testing.md#distinguishing-cases Exercises stock Go 1.26 protocol startup, put/get, path quoting, source and module-cache relocation, and a changed dependency version.
+// @evidence contracts/testing.md#distinguishing-cases Exercises stock Go 1.26 or 1.27 protocol startup, put/get, path quoting, source and module-cache relocation, and a changed dependency version.
 // @evidence contracts/testing.md#execution-ownership The test runs stock Go in temporary directories with a private file proxy and never contacts the network or publishes a release artifact.
 func TestStockGoCacheClient(t *testing.T) {
   if !supportedGoVersion.MatchString(runtime.Version()) {
-    t.Skip("the helper protocol requires a stock Go 1.26 patch release")
+    t.Skip("the helper protocol requires a stock Go 1.26 or 1.27 patch release")
   }
   root := filepath.Join(t.TempDir(), "native artifact path with spaces")
   if err := os.MkdirAll(root, 0700); err != nil {

package/cmd/ttsc-cache/store.go

@@ -29,6 +29,11 @@ type artifactStore struct {
   pinned      map[string]bool
   verified    map[string]bool
   receiptName string
+
+  // accountingListed is told each directory batch accounting has listed,
+  // before it stats the batch's entries. Nil outside tests, which use it to
+  // remove an entry the way a concurrent preparation does.
+  accountingListed func(directory string)
 }
 
 func openArtifactStore(directory string, manifest *packageartifacts.Manifest) (*artifactStore, error) {

package/cmd/ttsc-cache/tuple.go

@@ -50,7 +50,7 @@ func readGoTuple(goBinary string) (packageartifacts.Tuple, error) {
     return tuple, errors.New("publisher artifacts require effective CGO_ENABLED=0 and no GOFLAGS")
   }
   if !supportedGoVersion.MatchString(values["GOVERSION"]) {
-    return tuple, errors.New("publisher cache protocol requires a stock Go 1.26 patch release")
+    return tuple, errors.New("publisher cache protocol requires a stock Go 1.26 or 1.27 patch release")
   }
   if values["GOVERSION"] == "" || values["GOOS"] == "" || values["GOARCH"] == "" {
     return tuple, errors.New("Go did not report a complete artifact tuple")
@@ -78,7 +78,11 @@ func readGoTuple(goBinary string) (packageartifacts.Tuple, error) {
   }, nil
 }
 
-var supportedGoVersion = regexp.MustCompile(`^go1\.26\.(0|[1-9][0-9]*)$`)
+// supportedGoVersion admits the stock Go releases whose GOCACHEPROG framing and
+// ActionID semantics the helper was checked against. Go 1.27 keeps Go 1.26's
+// request and response wire format; its changes fix client-side lock and
+// error handling, so publisher packs stay valid within each release line.
+var supportedGoVersion = regexp.MustCompile(`^go1\.2[67]\.(0|[1-9][0-9]*)$`)
 
 func runGoProbe(goBinary string, arguments ...string) ([]byte, error) {
   ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)

package/cmd/ttsc-cache/tuple_test.go

@@ -23,7 +23,7 @@ import (
 // @evidence contracts/testing.md#execution-ownership Runs bounded local Go identity probes without building source modules, downloading packages or writing repository files.
 func TestReadGoTuple(t *testing.T) {
   if !supportedGoVersion.MatchString(runtime.Version()) {
-    t.Skip("the artifact tuple requires a stock Go 1.26 patch release")
+    t.Skip("the artifact tuple requires a stock Go 1.26 or 1.27 patch release")
   }
   goBinary, err := exec.LookPath("go")
   if err != nil {

package/cmd/ttscgraph/main.go

@@ -10,6 +10,8 @@ import (
   "os"
   "runtime"
   "strings"
+
+  "github.com/samchon/ttsc/packages/ttsc/internal/graph"
 )
 
 // Build metadata; overwritten via -ldflags in release builds.
@@ -55,13 +57,16 @@ func run(args []string) int {
   return 2
 }
 
+// printVersion names the build and the TypeScript compiler it links, which is
+// how a platform package's per-target producers tell themselves apart.
 func printVersion(w io.Writer) {
   fmt.Fprintf(
     w,
-    "ttscgraph %s (commit %s, built %s, %s/%s, go %s)\n",
+    "ttscgraph %s (commit %s, built %s, typescript %s, %s/%s, go %s)\n",
     version,
     commit,
     date,
+    graph.TypescriptVersion(),
     runtime.GOOS,
     runtime.GOARCH,
     runtime.Version(),

package/cmd/ttscgraph/run_help_version_and_bad_flags_exit_codes_test.go

@@ -5,6 +5,8 @@ import (
   "errors"
   "strings"
   "testing"
+
+  "github.com/samchon/ttsc/packages/ttsc/internal/graph"
 )
 
 // TestRunHelpVersionAndBadFlagsExitCodes verifies the top-level run dispatcher
@@ -24,7 +26,7 @@ import (
 //  4. With getwd forced to fail, run dump and run serve exit 2 and explain why.
 //
 // @evidence contracts/testing.md#behavioral-verification Calls the actual top-level dispatcher in-process. Help and version require status zero and their named text, unknown command requires status two and Usage:, dump/serve bad flags require status two only, and both failing cwd branches require status two plus could not resolve working directory. These are returned statuses, not OS exit transport assertions.
-// @evidence contracts/testing.md#independent-expectations The expected exit codes (0 for help and version, 2 for an unknown command, a bad dump or serve flag, and a failed working-directory lookup) and message fragments (ttscgraph, Usage:, could not resolve working directory) are literals from the documented command surface, written independently of run. The version check compares with the package's own version variable, so it only proves the version string is printed.
+// @evidence contracts/testing.md#independent-expectations The expected exit codes (0 for help and version, 2 for an unknown command, a bad dump or serve flag, and a failed working-directory lookup) and message fragments (ttscgraph, Usage:, could not resolve working directory) are literals from the documented command surface, written independently of run. The version check compares with the package's own version variable and the linked compiler's own version, so it proves those strings are printed, not that they are correct.
 // @evidence contracts/testing.md#distinguishing-cases run --help and run --version exit 0, printing the command name / version; run --bogus (unknown command) exits 2 and prints usage; run dump --nope and run serve --nope exit 2 (flag parse failure). 4. With getwd forced to fail, run dump and run serve exit 2 and explain why.
 // @evidence contracts/testing.md#execution-ownership TestRunHelpVersionAndBadFlagsExitCodes is a Go source-unit entry. It calls the package's top-level run dispatcher in-process with stdout, stderr and the getwd seam replaced; every case returns before a Program is loaded or a serve session starts, so nothing is installed, built or launched.
 func TestRunHelpVersionAndBadFlagsExitCodes(t *testing.T) {
@@ -50,6 +52,9 @@ func TestRunHelpVersionAndBadFlagsExitCodes(t *testing.T) {
   if got := versionOut.String(); !strings.Contains(got, "ttscgraph") || !strings.Contains(got, version) {
     t.Fatalf("run --version did not print a version string:\n%s", got)
   }
+  if got, want := versionOut.String(), "typescript "+graph.TypescriptVersion()+","; !strings.Contains(got, want) {
+    t.Fatalf("run --version did not name the linked compiler %q:\n%s", want, got)
+  }
 
   // An unknown command is an invalid invocation: print usage and exit 2.
   var badErr bytes.Buffer

package/cmd/ttscgraph/serve.go

@@ -632,8 +632,8 @@ func missingRootInputs(configs []*shimtsoptions.ParsedCommandLine, sourceHashes
   missing := []string{}
   for _, parsed := range configs {
     for _, file := range parsed.FileNames() {
-      if _, tracked := sourceHashes[file]; !tracked {
-        missing = append(missing, file)
+      if _, tracked := sourceHashes[string(file)]; !tracked {
+        missing = append(missing, string(file))
       }
     }
   }
@@ -678,8 +678,10 @@ func serveProducer() graph.Producer {
 func configFiles(configs []*shimtsoptions.ParsedCommandLine) []string {
   files := []string{}
   for _, parsed := range configs {
-    files = append(files, parsed.ConfigName())
-    files = append(files, parsed.ExtendedSourceFiles()...)
+    files = append(files, string(parsed.ConfigName()))
+    for _, extended := range parsed.ExtendedSourceFiles() {
+      files = append(files, string(extended))
+    }
   }
   return compactSortedStrings(files)
 }
@@ -699,9 +701,9 @@ func projectRootFilesFromConfigs(configs []*shimtsoptions.ParsedCommandLine, rel
     if reload {
       current = parsed.ReloadFileNamesOfParsedCommandLine(driver.DefaultFS())
     }
-    config := current.ConfigName()
+    config := string(current.ConfigName())
     for _, file := range current.FileNames() {
-      roots = append(roots, config+"\x00"+file)
+      roots = append(roots, config+"\x00"+string(file))
     }
   }
   return compactSortedStrings(roots)
@@ -714,7 +716,7 @@ func parsedConfigs(program *driver.Program) ([]*shimtsoptions.ParsedCommandLine,
   resolved := make(map[string]*shimtsoptions.ParsedCommandLine)
   for _, parsed := range program.TSProgram.GetResolvedProjectReferences() {
     if parsed != nil {
-      resolved[shimtspath.ResolvePath(parsed.ConfigName())] = parsed
+      resolved[shimtspath.ResolvePath(string(parsed.ConfigName()))] = parsed
     }
   }
   configs := []*shimtsoptions.ParsedCommandLine{}
@@ -723,14 +725,14 @@ func parsedConfigs(program *driver.Program) ([]*shimtsoptions.ParsedCommandLine,
   for len(pending) > 0 {
     parsed := pending[0]
     pending = pending[1:]
-    config := shimtspath.ResolvePath(parsed.ConfigName())
+    config := shimtspath.ResolvePath(string(parsed.ConfigName()))
     if _, exists := seen[config]; exists {
       continue
     }
     seen[config] = struct{}{}
     configs = append(configs, parsed)
-    for _, reference := range parsed.ResolvedProjectReferencePaths() {
-      reference = shimtspath.ResolvePath(reference)
+    for _, referencePath := range parsed.ResolvedProjectReferencePaths() {
+      reference := shimtspath.ResolvePath(string(referencePath))
       child := resolved[reference]
       if child == nil {
         fs := program.FS
@@ -783,23 +785,23 @@ func hashProgramSources(program *driver.Program) (map[string][sha256.Size]byte,
   for _, source := range program.TSProgram.SourceFiles() {
     // Virtual sources (tsgo's `bundled:///` libs) have no on-disk identity;
     // real project files always carry an absolute path.
-    if source == nil || !filepath.IsAbs(source.FileName()) {
+    if source == nil || !filepath.IsAbs(string(source.FileName())) {
       continue
     }
-    info, err := os.Stat(source.FileName())
+    info, err := os.Stat(string(source.FileName()))
     if err != nil {
       if errors.Is(err, os.ErrNotExist) {
         // The file vanished while the compiler session was loading. Hash the
         // resident text so the next snapshot revisits the path, observes the
         // deletion, and reloads instead of serving the vanished file forever.
-        hashes[source.FileName()] = sha256.Sum256([]byte(source.Text()))
+        hashes[string(source.FileName())] = sha256.Sum256([]byte(source.Text()))
       }
       continue
     }
     if info.IsDir() {
       continue
     }
-    content, err := os.ReadFile(source.FileName())
+    content, err := os.ReadFile(string(source.FileName()))
     if err != nil {
       return nil, nil, fmt.Errorf("ttscgraph: read %s: %w", source.FileName(), err)
     }
@@ -807,22 +809,22 @@ func hashProgramSources(program *driver.Program) (map[string][sha256.Size]byte,
     // The bytes were read, so their digest is a fact regardless of whether they
     // match what the checker holds. When they do not, the manifest's text and
     // disk digests disagree, which is precisely what a consumer needs to see.
-    digests[source.FileName()] = graph.Digest(rawHash)
+    digests[string(source.FileName())] = graph.Digest(rawHash)
     // Disk identity and checker text come from the same captured bytes. The
     // compiler filesystem strips BOMs and decodes UTF-16 before parsing.
     decoded, ok := shimvfs.DecodeBytes(string(content))
     if !ok {
       return nil, nil, fmt.Errorf("ttscgraph: decode %s", source.FileName())
     }
-    expected := driver.ApplySourcePreambleToFile(source.FileName(), decoded, program.SourcePreamble)
+    expected := driver.ApplySourcePreambleToFile(string(source.FileName()), decoded, program.SourcePreamble)
     if source.Text() == expected {
-      hashes[source.FileName()] = rawHash
+      hashes[string(source.FileName())] = rawHash
     } else {
       // Force the next snapshot to revisit a file that changed while the
       // compiler session was loading instead of blessing mismatched disk text.
       mismatchHash := rawHash
       mismatchHash[0] ^= 0xff
-      hashes[source.FileName()] = mismatchHash
+      hashes[string(source.FileName())] = mismatchHash
     }
   }
   return hashes, digests, nil
@@ -962,10 +964,10 @@ func auxiliaryInputs(program *driver.Program, cwd string) []auxiliaryInput {
   }
   for _, source := range program.TSProgram.SourceFiles() {
     file := source.FileName()
-    if file == "" || strings.HasPrefix(file, "bundled:///") {
+    if file == "" || strings.HasPrefix(string(file), "bundled:///") {
       continue
     }
-    directory := filepath.Dir(file)
+    directory := filepath.Dir(string(file))
     for _, path := range appendAncestorInputs(nil, directory, cwd) {
       inputs = append(inputs, auxiliaryInput{path: path})
     }

package/cmd/ttscgraph/serve_shards.go

@@ -1213,16 +1213,16 @@ func advanceServeGraphProvenance(
       return graph.Provenance{}, graph.Provenance{}, false
     }
     physical := source.FileName()
-    index, ok := positions[physical]
+    index, ok := positions[string(physical)]
     if !ok {
       return graph.Provenance{}, graph.Provenance{}, false
     }
     updated := graph.SourceDigest{
-      File:    physical,
+      File:    string(physical),
       Checker: graph.Digest(sha256.Sum256([]byte(source.Text()))),
-      Disk:    diskDigests[physical],
+      Disk:    diskDigests[string(physical)],
     }
-    wireFile, ok := wireSources[physical]
+    wireFile, ok := wireSources[string(physical)]
     if !ok {
       return graph.Provenance{}, graph.Provenance{}, false
     }
@@ -1344,7 +1344,7 @@ func authoredGraphFiles(program *driver.Program) map[string]bool {
     if !graph.IsWorkspaceSourceFile(file) {
       continue
     }
-    authored[file.FileName()] = true
+    authored[string(file.FileName())] = true
   }
   return authored
 }
@@ -1357,8 +1357,8 @@ func reverseGraphDependencies(program *driver.Program) map[string][]string {
     if !graph.IsWorkspaceSourceFile(file) {
       continue
     }
-    authored[file.FileName()] = true
-    authoredByPath[string(file.Path())] = file.FileName()
+    authored[string(file.FileName())] = true
+    authoredByPath[string(shimast.SourceFilePathKey(file))] = string(file.FileName())
   }
   add := func(target, dependent string) {
     if !authored[target] || target == dependent {
@@ -1376,8 +1376,8 @@ func reverseGraphDependencies(program *driver.Program) map[string][]string {
       continue
     }
     for _, referencedPath := range shimcompiler.GetReferencedFilePaths(program.TSProgram, source) {
-      if target, ok := authoredByPath[referencedPath]; ok {
-        add(target, source.FileName())
+      if target, ok := authoredByPath[string(referencedPath)]; ok {
+        add(target, string(source.FileName()))
       }
     }
   }
@@ -1393,25 +1393,36 @@ func reverseGraphDependencies(program *driver.Program) map[string][]string {
   return reverse
 }
 
+// serveGraphResolutionDigests digests each source's resolved references.
+// Projecting a target resolves its symlinks on disk, and a widely imported
+// file is the target of many references, so each target is projected once per
+// call rather than once per import.
 func serveGraphResolutionDigests(program *driver.Program, project string) (map[string]string, error) {
   digests := map[string]string{}
+  projected := map[string]string{}
   for _, source := range program.TSProgram.SourceFiles() {
     raw := shimcompiler.GetReferencedFilePaths(program.TSProgram, source)
     references := make([]string, 0, len(raw))
     for _, reference := range raw {
-      target := program.TSProgram.GetSourceFileByPath(shimtspath.Path(reference))
+      target := program.TSProgram.GetSourceFileByPath(shimtspath.PathKey(reference))
       if target == nil {
         continue
       }
-      file, err := serveGraphFile(project, target.FileName(), program.TSProgram.UseCaseSensitiveFileNames())
-      if err != nil {
-        return nil, err
+      name := string(target.FileName())
+      file, ok := projected[name]
+      if !ok {
+        var err error
+        file, err = serveGraphFile(project, name, program.TSProgram.UseCaseSensitiveFileNames())
+        if err != nil {
+          return nil, err
+        }
+        projected[name] = file
       }
       references = append(references, file)
     }
     sort.Strings(references)
     digest, _ := digestJSON(references)
-    digests[source.FileName()] = digest
+    digests[string(source.FileName())] = digest
   }
   return digests, nil
 }
@@ -1421,7 +1432,7 @@ func serveGraphResolutionDigests(program *driver.Program, project string) (map[s
 // spelling and authored-source boundary remain the shard ownership coordinates.
 func graphSourceFile(program *driver.Program, file string) *shimast.SourceFile {
   source := program.SourceFile(file)
-  if graph.IsWorkspaceSourceFile(source) && source.FileName() == file {
+  if graph.IsWorkspaceSourceFile(source) && string(source.FileName()) == file {
     return source
   }
   return nil

package/cmd/ttscgraph/serve_shards_abandoned_generation_converges_on_retry_test.go

@@ -55,7 +55,7 @@ func TestServeShardsAbandonedGenerationConvergesOnRetry(t *testing.T) {
   if abandoned.Sequence != committed.Sequence+1 {
     t.Fatalf("abandoned sequence = %d, want %d", abandoned.Sequence, committed.Sequence+1)
   }
-  abandonedKey := session.graphStore.sourceKeys[indexKeyFile]
+  abandonedKey := session.graphStore.sourceKeys[string(indexKeyFile)]
   if abandonedKey == "" {
     t.Fatal("abandoned source has no committed shard key")
   }
@@ -83,7 +83,7 @@ func TestServeShardsAbandonedGenerationConvergesOnRetry(t *testing.T) {
   if converged.Sequence != abandoned.Sequence+1 {
     t.Fatalf("converged sequence = %d, want %d", converged.Sequence, abandoned.Sequence+1)
   }
-  convergedKey := session.graphStore.sourceKeys[indexKeyFile]
+  convergedKey := session.graphStore.sourceKeys[string(indexKeyFile)]
   if convergedKey == "" || convergedKey == abandonedKey {
     t.Fatalf("edited source kept the abandoned shard identity %q", convergedKey)
   }