ttsc 0.34.2 → 0.35.0

package/src/compiler/internal/build/RuntimeBuildCache.ts

@@ -0,0 +1,252 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+import { E2ETrace } from "../../../internal/E2ETrace";
+import { recordCacheFileUse } from "../../../plugin/internal/source/recordCacheFileUse";
+import type { TtscBuildResult } from "../../../structures/internal/TtscBuildResult";
+
+/**
+ * Persist completed private runtime emits as checksummed, atomically published
+ * documents. Readers copy admitted bytes into their own run directory, so cache
+ * collection and concurrent publications cannot remove an executing run's emit.
+ * Input discovery and producer-proof admission belong to the supplied owners.
+ *
+ * @evidence contracts/common.md#principled-implementation Content-addressed snapshots select complete checksummed result and output documents. SHA-256 consumes exact UTF-8 text; native normalization rejects absolute, dot, parent and Windows drive-relative output coordinates. Relocation changes producer output coordinates and private-root stream text while retaining source paths.
+ * @evidence contracts/common.md#clear-and-simple-design One operation coordinates lookup, proof, restore and publication, with private hashing, containment and relocation helpers. Input capture and producer validation remain separate callbacks.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Misses execute the original build exactly once; failed or absent proofs never manufacture successful output. Every transported output must be a normalized private descendant, without filename or consumer-name exceptions.
+ * @evidence contracts/common.md#meaningful-documentation Native prose distinguishes persistent storage, run-owned copies and proof ownership; run states callback stability and failure behavior, and private helper comments identify byte, path and relocation domains.
+ * @evidence contracts/portability.md#os-neutral-implementation Native paths, lstat, relative/join and rename own storage and containment, including Windows drive-relative rejection. Source coordinates remain unchanged; transported symlinks are refused rather than followed.
+ * @evidence contracts/performance.md#efficient-algorithms Lookup hashes snapshot text and reads/hashes the bounded document. Restore and publication scale with output bytes and file count, without unrelated source traversal; normalization scans path bytes and relocation scans output paths and stream text.
+ * @evidence contracts/performance.md#reuse-equivalent-work Equal snapshots reuse completed emits only after independent producer admission and unchanged recapture. A restored run owns its copied bytes and rebased output ledger; concurrent publishers may duplicate compilation but cannot expose partial documents.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Documents are capped at 128 MiB, with fresh output collection limited to a 0.7 raw-byte budget before encoding, and join the existing collected single-file cache population. Snapshots and decoded bytes are invocation-owned; staging removal is attempted in finally and run owners release output. Cleanup or collector failures can retain files; helpers retain no handles or history.
+ */
+export namespace RuntimeBuildCache {
+  const FORMAT = "ttsx-runtime-build-v1";
+  const MAX_BYTES = 128 * 1024 * 1024;
+
+  /**
+   * Reuse a proven private emit, or invoke the original producer once. Capture
+   * returns a deterministic complete input snapshot, or undefined to decline
+   * caching. Admission must validate the producer's extra input observations;
+   * the second argument is the output root that producer actually used. Cache
+   * IO or cache-admission failure costs reuse only. Errors thrown by the
+   * original build retain their normal failure policy.
+   *
+   * @evidence contracts/common.md#principled-implementation Lookup and publication bracket current input snapshots, preserve the actual producer result and require explicit extra-input admission; cache-hit output is copied before the result is rebased.
+   * @evidence contracts/common.md#clear-and-simple-design Snapshot, proof and build callbacks expose their independent responsibilities while the operation alone owns storage and restore cleanup.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts Only successful complete emits are published; malformed, oversized, damaged or unproved documents fall through to the caller's real producer without changing compiler selection.
+   * @evidence contracts/common.md#meaningful-documentation Native prose states complete-snapshot meaning, producer-root coordinates, callback error policy and recoverable cache IO.
+   * @evidence contracts/portability.md#os-neutral-implementation Native lstat refuses aliases, path.relative checks containment and native mkdir/write/rename preserve byte payloads and host path semantics.
+   * @evidence contracts/performance.md#efficient-algorithms Snapshot owners dominate input work; document read/parse/hash and base64 restore scale with bounded encoded bytes, while publication walks only private output and serializes it once.
+   * @evidence contracts/performance.md#reuse-equivalent-work A format-and-snapshot digest names one candidate; checksum, output grammar, producer admission and unchanged recapture are independent reuse gates. Every miss calls build once.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources Call-local decoded outputs and serialized documents are bounded by the 128 MiB admission ceiling, except fresh output collection precedes serialization; partial restores are unlinked and staging removal is attempted in finally. Collector failures can retain files under the existing cache policy.
+   */
+  export function run(props: {
+    /** Collected single-file cache root, or undefined to bypass persistence. */
+    directory?: string;
+    /** Empty private output directory owned by this build's caller. */
+    emitDir: string;
+    /** Fresh complete input snapshot; undefined preserves ordinary execution. */
+    capture: () => string | undefined;
+    /** Producer-specific proof, with its original private output root. */
+    admit: (result: TtscBuildResult, emitDir: string) => boolean;
+    /** Original build operation, including its diagnostic policy. */
+    build: () => TtscBuildResult;
+  }): TtscBuildResult {
+    if (props.directory === undefined) return props.build();
+    let snapshot: string | undefined;
+    try {
+      snapshot = props.capture();
+    } catch {
+      /* An unavailable proof is a miss. */
+    }
+    if (snapshot === undefined) return props.build();
+    const key = digest(FORMAT + "\0" + snapshot);
+    const file = path.join(props.directory, key + ".json");
+    const restored: string[] = [];
+    try {
+      const stat = fs.lstatSync(file);
+      if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_BYTES)
+        throw new Error("unusable runtime cache document");
+      const document = JSON.parse(fs.readFileSync(file, "utf8"));
+      if (
+        document.format !== FORMAT ||
+        typeof document.payload !== "string" ||
+        document.hash !== digest(document.payload)
+      )
+        throw new Error("invalid runtime cache checksum");
+      const entry = JSON.parse(document.payload);
+      if (
+        entry.snapshot !== snapshot ||
+        typeof entry.emitDir !== "string" ||
+        !path.isAbsolute(entry.emitDir) ||
+        entry.result?.status !== 0 ||
+        !Array.isArray(entry.outputs) ||
+        !props.admit(entry.result, entry.emitDir)
+      )
+        throw new Error("unproved runtime cache document");
+      const names = new Set<string>();
+      for (const output of entry.outputs) {
+        if (
+          !Array.isArray(output) ||
+          output.length !== 2 ||
+          typeof output[0] !== "string" ||
+          typeof output[1] !== "string" ||
+          !safeRelative(output[0]) ||
+          names.has(output[0]) ||
+          Buffer.from(output[1], "base64").toString("base64") !== output[1]
+        )
+          throw new Error("invalid runtime cache output");
+        names.add(output[0]);
+      }
+      for (const output of Object.keys(entry.result.emittedSources ?? {}))
+        if (!names.has(path.relative(entry.emitDir, output)))
+          throw new Error("missing runtime cache provenance output");
+      for (const [name, bytes] of entry.outputs) {
+        const target = path.join(props.emitDir, name);
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.writeFileSync(target, Buffer.from(bytes, "base64"), { flag: "wx" });
+        restored.push(target);
+      }
+      if (
+        props.capture() !== snapshot ||
+        !props.admit(entry.result, entry.emitDir)
+      )
+        throw new Error("runtime inputs moved during restore");
+      recordCacheFileUse(file);
+      E2ETrace.capabilityResolution("runtime-build-cache", {
+        outcome: "reused",
+        key,
+      });
+      return relocate(entry.result, entry.emitDir, props.emitDir);
+    } catch {
+      for (const output of restored)
+        try {
+          fs.unlinkSync(output);
+        } catch {
+          /* Rejected cache output cannot prevent the ordinary producer. */
+        }
+    }
+    const result = props.build();
+    if (result.status !== 0) return result;
+    let temporary: string | undefined;
+    try {
+      const outputs: [string, string][] = [];
+      let outputBytes = 0;
+      const pending = [props.emitDir];
+      while (pending.length !== 0) {
+        const directory = pending.pop()!;
+        for (const child of fs.readdirSync(directory, {
+          withFileTypes: true,
+        })) {
+          const target = path.join(directory, child.name);
+          if (child.isSymbolicLink()) throw new Error("aliased runtime output");
+          if (child.isDirectory()) pending.push(target);
+          else if (child.isFile()) {
+            outputBytes += fs.statSync(target).size;
+            if (outputBytes > MAX_BYTES * 0.7) return result;
+            outputs.push([
+              path.relative(props.emitDir, target),
+              fs.readFileSync(target).toString("base64"),
+            ]);
+          } else throw new Error("nonordinary runtime output");
+        }
+      }
+      if (outputs.length === 0) return result;
+      const payload = JSON.stringify({
+        snapshot,
+        emitDir: props.emitDir,
+        result,
+        outputs,
+      });
+      const text = JSON.stringify({
+        format: FORMAT,
+        hash: digest(payload),
+        payload,
+      });
+      if (Buffer.byteLength(text) > MAX_BYTES) return result;
+      if (props.capture() !== snapshot || !props.admit(result, props.emitDir))
+        return result;
+      fs.mkdirSync(props.directory, { recursive: true });
+      if (fs.lstatSync(props.directory).isSymbolicLink()) return result;
+      temporary = path.join(
+        props.directory,
+        `${key}.${crypto.randomUUID()}.tmp`,
+      );
+      fs.writeFileSync(temporary, text, { flag: "wx" });
+      fs.renameSync(temporary, file);
+      E2ETrace.capabilityResolution("runtime-build-cache", {
+        outcome: "recorded",
+        key,
+      });
+    } catch {
+      /* Persistence never replaces a fresh successful result. */
+    } finally {
+      if (temporary !== undefined) {
+        try {
+          fs.unlinkSync(temporary);
+        } catch {
+          /* Rename or later collection owns it. */
+        }
+      }
+    }
+    return result;
+  }
+
+  /** Hash encoded input or document bytes with SHA-256. */
+  function digest(text: string): string {
+    return crypto.createHash("sha256").update(text).digest("hex");
+  }
+
+  /** Admit only a nonempty relative descendant coordinate. */
+  function safeRelative(name: string): boolean {
+    return (
+      name.length !== 0 &&
+      !name.includes("\0") &&
+      !path.isAbsolute(name) &&
+      path.parse(name).root === "" &&
+      path.normalize(name) === name &&
+      name !== "." &&
+      name !== ".." &&
+      !name.startsWith(".." + path.sep)
+    );
+  }
+
+  /** Move producer-owned output coordinates to the current private run. */
+  function relocate(
+    result: TtscBuildResult,
+    previous: string,
+    current: string,
+  ): TtscBuildResult {
+    const move = (output: string): string => {
+      const relative = path.relative(previous, output);
+      if (!safeRelative(relative))
+        throw new Error("runtime provenance escapes its output root");
+      return path.join(current, relative);
+    };
+    return {
+      ...result,
+      emittedFiles: result.emittedFiles?.map(move),
+      emittedSources:
+        result.emittedSources === undefined
+          ? undefined
+          : Object.fromEntries(
+              Object.entries(result.emittedSources).map(([output, sources]) => [
+                move(output),
+                sources,
+              ]),
+            ),
+      emittedSourceProofFailures:
+        result.emittedSourceProofFailures === undefined
+          ? undefined
+          : Object.fromEntries(
+              Object.entries(result.emittedSourceProofFailures).map(
+                ([output, reason]) => [move(output), reason],
+              ),
+            ),
+      stdout: result.stdout.split(previous).join(current),
+      stderr: result.stderr.split(previous).join(current),
+    };
+  }
+}

package/src/compiler/internal/build/RuntimeBuildInputs.ts

@@ -0,0 +1,349 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+import { resolveNodeBinary } from "../../../internal/resolveNodeBinary";
+import { runtimeExecutableIdentity } from "../../../internal/runtimeExecutableIdentity";
+import { PluginContentIdentities } from "../../../plugin/internal/source/PluginContentIdentities";
+import { pluginSourceStateHolds } from "../../../plugin/internal/source/pluginSourceStateHolds";
+import type { TtscBuildResult } from "../../../structures/internal/TtscBuildResult";
+import { CompilerArgumentsInspection } from "../CompilerArgumentsInspection";
+import { resolveTsgo } from "../resolveTsgo";
+import { SidecarEnvironment } from "../sharedHost/SidecarEnvironment";
+import { spawnNative } from "../spawnNative";
+import type { BuildExecution } from "./BuildExecution";
+import { PassthroughFlags } from "./PassthroughFlags";
+import type { RunBuildOptions } from "./RunBuildOptions";
+import { RuntimeInputProof } from "./RuntimeInputProof";
+import { TsgoArguments } from "./TsgoArguments";
+
+/**
+ * Prove runtime build inputs through the selected upstream compiler's read-only
+ * effective configuration and source-selection commands. Repeating selection
+ * discovers added roots and changed resolution candidates without guessing a
+ * project boundary or treating workspace links as immutable dependencies.
+ * Native plugin observations add their independently replayed input closure.
+ * Custom compiler overrides require the physical identity of the installed
+ * package compiler; wrappers with undisclosed external inputs stay fresh.
+ *
+ * @evidence contracts/common.md#principled-implementation The actual selected compiler defines effective options and source membership; content and physical identities cover that closure and package scopes, with separate native producer proof for checks.
+ * @evidence contracts/common.md#clear-and-simple-design One factory supplies input capture and result admission to the runtime document store without changing normal build dispatch.
+ * @evidence contracts/common.md#prohibited-implementation-shortcuts Incomplete descriptors, unsupported effectful compiler modes and unproved native producers and custom compilers without package authority use the existing fresh build rather than weakening diagnostics or substituting a compiler.
+ * @evidence contracts/common.md#meaningful-documentation Native prose describes compiler-owned membership, workspace scope and independent plugin observations.
+ * @evidence contracts/portability.md#os-neutral-implementation The selected executable receives native argv and cwd; source and package scopes use native physical paths and preserve lexical spellings without OS-wide case folding.
+ * @evidence contracts/performance.md#efficient-algorithms Each snapshot runs two read-only native queries and hashes selected source, package, executable and declared host input bytes; shared ancestor sets avoid repeated package-scope walks.
+ * @evidence contracts/performance.md#reuse-equivalent-work A completed emit may be reused only for equal selected input snapshots and currently valid native witnesses; unsupported proof falls back to compilation.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Query buffers and path/hash records are call-local, with source/report bytes unbounded by this factory; the document store owns persistent byte limits and retention.
+ */
+export namespace RuntimeBuildInputs {
+  /**
+   * Construct the proof owners for one private runtime request.
+   * Program-mutating transform hosts need their declared emit-input sidecar.
+   * Check hosts need their declared observation protocol and complete
+   * descriptor discovery; no-plugin builds use the actual compiler's
+   * source/configuration selection directly. Custom selections are reusable
+   * only when they name that same package-backed compiler.
+   *
+   * @evidence contracts/common.md#principled-implementation Eligibility requires a private emitting request, complete descriptor selection and supported check witnesses; captures bracket content identities and native source selection, and result admission requires complete emitted-source ownership.
+   * @evidence contracts/common.md#clear-and-simple-design Two closures share the resolved request while capture owns current selection and admission owns retained generation proof.
+   * @evidence contracts/common.md#prohibited-implementation-shortcuts Native transforms without complete emit observations and arbitrary external-code or profiling modes decline reuse rather than inventing input completeness. Custom compiler overrides need matching installed package identity, including inherited dependency hints; the original build remains the fallback.
+   * @evidence contracts/common.md#meaningful-documentation Native prose states current producer support and private-runtime scope, including why fresh transformation remains necessary.
+   * @evidence contracts/portability.md#os-neutral-implementation Source and package observations use native paths and bracketed byte reads, and upstream probes use the original compiler working directory and argv without shell composition.
+   * @evidence contracts/performance.md#efficient-algorithms Capture performs two upstream selection/config queries, actual executable proofs and O(selected bytes) hashes; unique ancestor and path sets bound duplicate reads within one snapshot. Admission replays only recorded native inputs.
+   * @evidence contracts/performance.md#reuse-equivalent-work Equal deterministic snapshots retain compiler arguments, versions, content, scope manifests, plugin binaries/configuration and environment; graph and host witnesses separately gate cached check reuse.
+   * @evidence contracts/performance.md#bound-retention-and-release-resources The resolved context and closures belong to one build; each capture releases local source and native-output buffers on return, with no resident process or historical map retained.
+   */
+  export function create(
+    options: RunBuildOptions,
+    execution: ReturnType<typeof BuildExecution.resolveExecutionContext>,
+  ):
+    | {
+        capture: () => string | undefined;
+        admit: (result: TtscBuildResult, emitDir: string) => boolean;
+      }
+    | undefined {
+    if (
+      options.runtimeCacheDir === undefined ||
+      typeof options.isolateOutputsTo !== "string" ||
+      options.emit !== true ||
+      options.format === true ||
+      execution.pluginSetupFailure !== undefined ||
+      execution.compilerSelection.inspectionError !== undefined ||
+      PassthroughFlags.forwardsTerminalTsgoFlag(options)
+    )
+      return undefined;
+    const loaded = execution.pluginLoad;
+    if (
+      execution.nativePlugins.some((plugin) =>
+        plugin.stage === "check"
+          ? plugin.capabilities?.checkObservations !== true
+          : plugin.capabilities?.emitObservations !== true,
+      ) ||
+      (loaded !== undefined &&
+        (!loaded.discoveryInputsComplete ||
+          !loaded.descriptorReadsDeclared ||
+          loaded.observationsComplete === false))
+    )
+      return undefined;
+    const emitDir = options.isolateOutputsTo;
+    const args = TsgoArguments.createTsgoBuildArgs(execution, options, {
+      listEmittedFiles: false,
+    });
+    const env = SidecarEnvironment.merge(process.env, options.env);
+    // A custom executable can be a wrapper with undisclosed external inputs.
+    // Inherited hints to the installed compiler still have package authority.
+    if (execution.tsgo.packageJson === "") {
+      try {
+        const packaged = resolveTsgo({
+          cwd: execution.projectRoot,
+          env: SidecarEnvironment.merge(env, { TTSC_TSGO_BINARY: undefined }),
+        });
+        if (
+          fs.realpathSync.native(packaged.binary) !==
+          fs.realpathSync.native(execution.tsgo.binary)
+        )
+          return undefined;
+      } catch {
+        return undefined;
+      }
+    }
+    const identities =
+      execution.identities ??
+      PluginContentIdentities.open({
+        projectRoot: execution.projectRoot,
+        cacheDir: path.dirname(options.runtimeCacheDir),
+        env,
+      });
+    if (identities === undefined) return undefined;
+    let inspected: ReturnType<typeof CompilerArgumentsInspection.inspect>;
+    try {
+      inspected = CompilerArgumentsInspection.inspect(
+        args,
+        execution.compilerSelection.compilerArgsCwd,
+      );
+    } catch {
+      return undefined;
+    }
+    if (
+      inspected.args.some((arg) =>
+        /^--?(?:runExternalCode|generateTrace|generateCpuProfile|pprofDir|diagnostics|extendedDiagnostics|traceResolution|explainFiles|listFiles|listEmittedFiles|build|watch)(?:=|$)/i.test(
+          arg,
+        ),
+      )
+    )
+      return undefined;
+    return {
+      capture: () => {
+        try {
+          if (process.env.TTSC_PLUGIN_DESCRIPTOR_LOAD === "1") return undefined;
+          const node =
+            execution.nativePlugins.length === 0
+              ? undefined
+              : resolveNodeBinary(env, execution.projectRoot, identities);
+          if (execution.nativePlugins.length !== 0 && node === undefined)
+            return undefined;
+          const binaries = [
+            ...new Set([
+              execution.tsgo.binary,
+              ...execution.nativePlugins.map((plugin) => plugin.binary),
+              ...(node === undefined ? [] : [node]),
+            ]),
+          ];
+          const compilerIdentities = binaries.map((binary) =>
+            runtimeExecutableIdentity(binary, identities),
+          );
+          if (compilerIdentities.some((identity) => identity === undefined))
+            return undefined;
+          for (const [directory, state] of Object.entries(
+            loaded?.pluginSources ?? {},
+          ))
+            if (
+              !pluginSourceStateHolds(directory, state, {
+                projectRoot: execution.projectRoot,
+              })
+            )
+              return undefined;
+          const query = (flags: string[]) => {
+            const result = spawnNative(
+              execution.tsgo.binary,
+              [...args, ...flags],
+              { cwd: execution.compilerSelection.compilerArgsCwd, env },
+            );
+            if (result.error || result.status !== 0 || result.signal !== null)
+              throw new Error("runtime input inspection unavailable");
+            return String(result.stdout);
+          };
+          const config = JSON.parse(query(["--showConfig"]));
+          if (
+            !config ||
+            typeof config.compilerOptions !== "object" ||
+            config.compilerOptions === null ||
+            config.references?.length ||
+            config.compilerOptions.runExternalCode === true ||
+            [
+              "generateTrace",
+              "generateCpuProfile",
+              "pprofDir",
+              "diagnostics",
+              "extendedDiagnostics",
+              "traceResolution",
+              "explainFiles",
+              "listFiles",
+              "listEmittedFiles",
+            ].some((name) => config.compilerOptions[name])
+          )
+            return undefined;
+          const listed = query([
+            "--listFilesOnly",
+            "true",
+            "--listEmittedFiles",
+            "false",
+          ])
+            .split(/\r?\n/)
+            .filter((line) => line.length !== 0);
+          if (
+            listed.length === 0 ||
+            !listed.every(
+              (file) =>
+                path.isAbsolute(file) && /\.(?:[cm]?[jt]sx?|json)$/i.test(file),
+            )
+          )
+            return undefined;
+          const inputs = new Set([
+            ...listed,
+            ...execution.project.configPaths,
+            ...inspected.observations.keys(),
+          ]);
+          const scopes = new Set<string>();
+          for (const file of listed) {
+            for (const spelling of [file, fs.realpathSync.native(file)]) {
+              let directory = path.dirname(spelling);
+              while (!scopes.has(directory)) {
+                scopes.add(directory);
+                inputs.add(path.join(directory, "package.json"));
+                const parent = path.dirname(directory);
+                if (parent === directory) break;
+                directory = parent;
+              }
+            }
+          }
+          const hashes = [...inputs].sort().map((file) => {
+            try {
+              const observed = JSON.parse(
+                CompilerArgumentsInspection.observeInputFile(file),
+              );
+              return [file, observed[0], observed[2]];
+            } catch (error) {
+              if (
+                (error as NodeJS.ErrnoException).code !== "ENOENT" &&
+                (error as NodeJS.ErrnoException).code !== "ENOTDIR"
+              )
+                throw error;
+              return [file, null, null];
+            }
+          });
+          const hostInputs: [string, string | null, string | null][] = [];
+          for (const [file, expected] of Object.entries(
+            loaded?.hostInputHashes ?? {},
+          ).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+            const [physical, hash] = RuntimeInputProof.observeHostInput(file);
+            if (
+              hash !== expected ||
+              physical !== loaded?.hostInputRealpaths[file]
+            )
+              return undefined;
+            hostInputs.push([file, physical, hash]);
+          }
+          for (const [file, before] of inspected.observations)
+            if (CompilerArgumentsInspection.observeInputFile(file) !== before)
+              return undefined;
+          // Only private destination values are normalized. The relative layout
+          // remains in the identity because source maps are output-relative.
+          for (const key of [
+            "outDir",
+            "declarationDir",
+            "tsBuildInfoFile",
+            "outFile",
+          ])
+            if (
+              typeof config.compilerOptions[key] === "string" &&
+              (path.resolve(
+                path.dirname(execution.tsconfig),
+                config.compilerOptions[key],
+              ) === options.isolateOutputsTo ||
+                path
+                  .resolve(
+                    path.dirname(execution.tsconfig),
+                    config.compilerOptions[key],
+                  )
+                  .startsWith(emitDir + path.sep))
+            )
+              config.compilerOptions[key] =
+                "<private-output>" +
+                path.relative(
+                  emitDir,
+                  path.resolve(
+                    path.dirname(execution.tsconfig),
+                    config.compilerOptions[key],
+                  ),
+                );
+          // Upstream synthesizes an exclusion for the overridden outDir too.
+          if (Array.isArray(config.exclude))
+            config.exclude = config.exclude.map((name: unknown) =>
+              typeof name === "string" &&
+              path.resolve(path.dirname(execution.tsconfig), name) === emitDir
+                ? "<private-output>"
+                : name,
+            );
+          const environment = Object.entries(env)
+            .filter(([key]) => !/^TTSX_RUNTIME_/i.test(key))
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+          return JSON.stringify({
+            format: 1,
+            version: identities.version,
+            compilerIdentities,
+            config,
+            hashes,
+            hostInputs,
+            environment: crypto
+              .createHash("sha256")
+              .update(JSON.stringify(environment))
+              .digest("hex"),
+            project: execution.tsconfig,
+            cwd: execution.compilerSelection.compilerArgsCwd,
+            layout: path.relative(emitDir, execution.projectRoot),
+            unchecked: options.skipDiagnosticsCheck === true,
+            plugins: execution.nativePlugins,
+            pluginSources: loaded?.pluginSources,
+            descriptor: loaded?.hostInputHashes,
+          });
+        } catch {
+          return undefined;
+        }
+      },
+      admit: (result, emitDir) => {
+        if (
+          result.status !== 0 ||
+          result.emittedSources === undefined ||
+          Object.keys(result.emittedSourceProofFailures ?? {}).length !== 0 ||
+          !Object.values(result.emittedSources).every(
+            (sources) =>
+              Array.isArray(sources) &&
+              sources.length > 0 &&
+              sources.every(
+                (source) =>
+                  typeof source === "string" && path.isAbsolute(source),
+              ),
+          )
+        )
+          return false;
+        if (
+          execution.nativePlugins.length !== 0 &&
+          result.graph?.inputObservations === undefined
+        )
+          return false;
+        return RuntimeInputProof.holds(result, execution.projectRoot, emitDir);
+      },
+    };
+  }
+}