@_linked/cli 1.31.0 → 1.33.0

package/lib/esm/client-dep-includes.js

@@ -0,0 +1,827 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var _a;
+var _b, _c;
+// `optimizeDeps.include` entries for the third-party client dependencies of
+// linked framework packages.
+//
+// Apps exclude the framework packages (`@_linked/*`, `lincd-*`, anything marked
+// `"linkedPackage": true`) from Vite's dependency optimizer, so the browser
+// loads exactly one copy of each. The cost of that exclusion: Vite no longer
+// crawls into those packages, so it never learns about THEIR dependencies until
+// the browser happens to request one. Two things then go wrong:
+//
+// - a CommonJS dependency (`use-sync-external-store/shim`, `js-cookie`) is
+//   served raw, and the browser fails on `require`/`module.exports`;
+// - any other dependency is discovered mid-session, and Vite re-optimises and
+//   reloads the page — which can mix old and new chunks into two Reacts.
+//
+// So apps used to list every such dependency in `optimizeDeps.include` by hand,
+// including nested installs (`'@_linked/primitives > vaul'`, where npm put vaul
+// under primitives because its React peer range excluded the app's React).
+//
+// Reading `package.json` dependencies would list server-only packages too
+// (bcrypt, express, sharp…), which then fail in esbuild. This module reads the
+// import graph instead: which bare specifiers the framework packages' client
+// entry files actually import, and which of those can run in a browser.
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { isBuiltin } from 'node:module';
+import { init as initLexer, parse as parseImports } from 'es-module-lexer';
+import { isFrameworkPkg, readInstalledPkg } from './installed-packages.js';
+/** Conditions a browser build resolves, in the order a client resolver prefers them. */
+const CLIENT_CONDITIONS = ['browser', 'import', 'module', 'default'];
+/** Conditions never taken for a client file. `development` points at `src/`, scanned separately. */
+const NON_CLIENT_CONDITIONS = new Set([
+    'require',
+    'node',
+    'types',
+    'typings',
+    'development',
+    'deno',
+    'bun',
+    'worker',
+    'react-native',
+]);
+/** Specifiers that are assets, not modules the optimizer can pre-bundle. */
+const ASSET_SPECIFIER = /\.(css|scss|sass|less|styl|pcss|svg|png|jpe?g|gif|webp|avif|ico|bmp|woff2?|ttf|otf|eot|json|wasm|html?|txt|md|glsl)$/i;
+const SOURCE_FILE = /\.(m?[jt]sx?|cjs)$/;
+const IGNORED_SOURCE_FILE = /(\.d\.ts|\.(test|spec|stories)\.[mc]?[jt]sx?)$/;
+const IGNORED_SOURCE_DIR = new Set([
+    'node_modules',
+    '__tests__',
+    '__mocks__',
+    '__fixtures__',
+]);
+/**
+ * Never listed, whoever imports them. `typescript` is a peer of packages that
+ * analyse source at build time (translation key sync); it declares a `browser`
+ * field, so it passes the server-only test, and pre-bundling it costs seconds.
+ */
+export const DEFAULT_DENY = ['typescript'];
+/** A server-only check stops after this many files of one dependency. */
+const MAX_DEP_FILES = 400;
+/** `@scope/name/sub` → `@scope/name`; `name/sub` → `name`. */
+export function packageNameOf(specifier) {
+    const parts = specifier.split('/');
+    return specifier.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
+}
+/** A bare module specifier naming another package (not relative, builtin, virtual, asset or `#import`). */
+export function isBarePackageSpecifier(specifier) {
+    if (!specifier || specifier.startsWith('.') || specifier.startsWith('/'))
+        return false;
+    if (specifier.startsWith('#') || specifier.startsWith('\0'))
+        return false;
+    if (specifier.includes(':') || specifier.includes('?'))
+        return false; // node:, virtual:, http:, ?raw
+    if (isBuiltin(specifier))
+        return false;
+    if (ASSET_SPECIFIER.test(specifier))
+        return false;
+    return /^(@[\w.-]+\/)?[\w.-]/.test(specifier);
+}
+const matchesDeny = (deny, ...values) => deny.some((d) => values.some((v) => (typeof d === 'string' ? d === v : d.test(v))));
+function realpath(p) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            return yield fs.realpath(p);
+        }
+        catch (_a) {
+            return path.resolve(p);
+        }
+    });
+}
+function isFile(p) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            return (yield fs.stat(p)).isFile();
+        }
+        catch (_a) {
+            return false;
+        }
+    });
+}
+function listFiles(dir, accept) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const out = [];
+        const walk = (d) => __awaiter(this, void 0, void 0, function* () {
+            let entries;
+            try {
+                entries = yield fs.readdir(d, { withFileTypes: true });
+            }
+            catch (_a) {
+                return;
+            }
+            yield Promise.all(entries.map((ent) => __awaiter(this, void 0, void 0, function* () {
+                const full = path.join(d, ent.name);
+                if (ent.isDirectory()) {
+                    if (!IGNORED_SOURCE_DIR.has(ent.name))
+                        yield walk(full);
+                }
+                else if (accept(full)) {
+                    out.push(full);
+                }
+            })));
+        });
+        yield walk(dir);
+        return out;
+    });
+}
+/** Pick the target of one export entry for the given conditions (nested condition objects allowed). */
+function pickConditional(target, conditions) {
+    if (typeof target === 'string')
+        return target;
+    if (Array.isArray(target)) {
+        for (const t of target) {
+            const hit = pickConditional(t, conditions);
+            if (hit)
+                return hit;
+        }
+        return null;
+    }
+    if (target && typeof target === 'object') {
+        for (const [key, value] of Object.entries(target)) {
+            if (key === 'default' || conditions.includes(key)) {
+                const hit = pickConditional(value, conditions);
+                if (hit)
+                    return hit;
+            }
+        }
+    }
+    return null;
+}
+/** Normalise `exports` to a subpath map (`{'.': …}`), or null when there is none. */
+function exportsMap(exportsField) {
+    if (exportsField === undefined || exportsField === null)
+        return null;
+    if (typeof exportsField === 'string' || Array.isArray(exportsField))
+        return { '.': exportsField };
+    const keys = Object.keys(exportsField);
+    if (keys.length > 0 && keys.every((k) => !k.startsWith('.')))
+        return { '.': exportsField };
+    return exportsField;
+}
+/**
+ * Resolve a package subpath (`.` or `./shim`) through `exports` for the given
+ * conditions, the way Node does (exact key first, then the longest `*` pattern).
+ * Returns the relative target, `null` when the subpath is not exported, or
+ * `undefined` when the package has no `exports` at all.
+ */
+export function resolveExportsSubpath(json, subpath, conditions) {
+    const map = exportsMap(json === null || json === void 0 ? void 0 : json.exports);
+    if (!map)
+        return undefined;
+    if (subpath in map)
+        return pickConditional(map[subpath], conditions);
+    let best = null;
+    for (const key of Object.keys(map)) {
+        const star = key.indexOf('*');
+        if (star < 0)
+            continue;
+        const prefix = key.slice(0, star);
+        const suffix = key.slice(star + 1);
+        if (subpath.startsWith(prefix) &&
+            subpath.endsWith(suffix) &&
+            subpath.length >= key.length - 1 &&
+            (!best || prefix.length > best.key.indexOf('*'))) {
+            best = {
+                key,
+                star: subpath.slice(prefix.length, subpath.length - suffix.length),
+            };
+        }
+    }
+    if (!best)
+        return null;
+    const target = pickConditional(map[best.key], conditions);
+    return target ? target.split('*').join(best.star) : null;
+}
+/** Probe a file path the way a CommonJS/ESM loader would (extension, then directory index). */
+function probeFile(base) {
+    return __awaiter(this, void 0, void 0, function* () {
+        for (const candidate of [
+            base,
+            `${base}.js`,
+            `${base}.mjs`,
+            `${base}.cjs`,
+            path.join(base, 'index.js'),
+            path.join(base, 'index.mjs'),
+        ]) {
+            if (yield isFile(candidate))
+                return candidate;
+        }
+        return null;
+    });
+}
+/** The file a package subpath resolves to for a browser-or-anything lookup; null when none exists. */
+export function resolvePackageFile(root_1, json_1, subpath_1) {
+    return __awaiter(this, arguments, void 0, function* (root, json, subpath, conditions = [
+        'browser',
+        'import',
+        'module',
+        'default',
+        'require',
+        'node',
+    ]) {
+        const viaExports = resolveExportsSubpath(json, subpath, conditions);
+        if (viaExports !== undefined) {
+            return viaExports ? probeFile(path.join(root, viaExports)) : null;
+        }
+        if (subpath === '.') {
+            const browser = conditions.includes('browser') &&
+                typeof json.browser === 'string' &&
+                json.browser;
+            const main = browser || json.module || json.main || 'index.js';
+            return probeFile(path.join(root, main));
+        }
+        return probeFile(path.join(root, subpath));
+    });
+}
+/** Every string target under client conditions, anywhere in `exports`. */
+function clientExportTargets(json) {
+    const map = exportsMap(json === null || json === void 0 ? void 0 : json.exports);
+    if (!map) {
+        const main = (typeof (json === null || json === void 0 ? void 0 : json.browser) === 'string' && json.browser) ||
+            (json === null || json === void 0 ? void 0 : json.module) ||
+            (json === null || json === void 0 ? void 0 : json.main) ||
+            'index.js';
+        return [main];
+    }
+    const out = [];
+    const visit = (target) => {
+        if (typeof target === 'string')
+            out.push(target);
+        else if (Array.isArray(target))
+            target.forEach(visit);
+        else if (target && typeof target === 'object') {
+            for (const [key, value] of Object.entries(target)) {
+                if (!NON_CLIENT_CONDITIONS.has(key))
+                    visit(value);
+            }
+        }
+    };
+    Object.values(map).forEach(visit);
+    return out;
+}
+/** Expand one export target (possibly a `*` pattern) to the files it can reach. */
+function expandTarget(root, target) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const abs = path.join(root, target);
+        const star = abs.indexOf('*');
+        if (star < 0) {
+            const file = yield probeFile(abs);
+            return file ? [file] : [];
+        }
+        const prefix = abs.slice(0, star);
+        const suffix = abs.slice(star + 1);
+        const dir = prefix.endsWith(path.sep) ? prefix : path.dirname(prefix);
+        return listFiles(dir, (f) => f.startsWith(prefix) && f.endsWith(suffix) && !f.endsWith('.d.ts'));
+    });
+}
+let lexerReady = null;
+let esbuildTransform = null;
+/** The static and literal-dynamic import specifiers of a module, plus `require('x')` calls. */
+export function importSpecifiers(code, file) {
+    return __awaiter(this, void 0, void 0, function* () {
+        lexerReady !== null && lexerReady !== void 0 ? lexerReady : (lexerReady = initLexer);
+        yield lexerReady;
+        let js = code;
+        if (/\.[mc]?tsx?$/.test(file) || /\.jsx$/.test(file)) {
+            esbuildTransform !== null && esbuildTransform !== void 0 ? esbuildTransform : (esbuildTransform = (yield import('esbuild')).transform);
+            try {
+                js = (yield esbuildTransform(code, {
+                    loader: file.endsWith('x')
+                        ? /\.tsx$/.test(file)
+                            ? 'tsx'
+                            : 'jsx'
+                        : 'ts',
+                    format: 'esm',
+                    jsx: 'automatic',
+                    tsconfigRaw: { compilerOptions: { experimentalDecorators: true } },
+                    logLevel: 'silent',
+                })).code;
+            }
+            catch (_a) {
+                return [];
+            }
+        }
+        const out = new Set();
+        try {
+            const [imports] = parseImports(js);
+            for (const imp of imports)
+                if (imp.n)
+                    out.add(imp.n);
+        }
+        catch (_b) {
+            // Not parseable as a module (JSX in a .js file, say): fall back to the textual forms.
+            for (const m of js.matchAll(/(?:\bfrom\s*|\bimport\s*\(?\s*)['"]([^'"\n]+)['"]/g))
+                out.add(m[1]);
+        }
+        for (const m of js.matchAll(/\brequire\s*\(\s*['"]([^'"\n]+)['"]\s*\)/g))
+            out.add(m[1]);
+        return [...out];
+    });
+}
+const CACHE_VERSION = 1;
+function loadCache(file) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const empty = {
+            data: { version: CACHE_VERSION, graphs: {}, serverOnly: {} },
+            dirty: false,
+        };
+        if (!file)
+            return empty;
+        try {
+            const data = JSON.parse(yield fs.readFile(file, 'utf8'));
+            return (data === null || data === void 0 ? void 0 : data.version) === CACHE_VERSION && data.graphs && data.serverOnly
+                ? { data, dirty: false }
+                : empty;
+        }
+        catch (_a) {
+            return empty;
+        }
+    });
+}
+function saveCache(file, cache) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!file || !cache.dirty)
+            return;
+        try {
+            yield fs.mkdir(path.dirname(file), { recursive: true });
+            const tmp = `${file}.${process.pid}.tmp`;
+            yield fs.writeFile(tmp, JSON.stringify(cache.data));
+            yield fs.rename(tmp, file);
+        }
+        catch (_a) {
+            // A cache is an optimisation: an unwritable node_modules just means a full scan next time.
+        }
+    });
+}
+/** Limit concurrent file reads: a few hundred open at once can exceed the fd limit. */
+function semaphore(limit) {
+    let active = 0;
+    const waiting = [];
+    return (fn) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (active >= limit)
+            yield new Promise((r) => waiting.push(r));
+        active++;
+        try {
+            return yield fn();
+        }
+        finally {
+            active--;
+            (_a = waiting.shift()) === null || _a === void 0 ? void 0 : _a();
+        }
+    });
+}
+/** Resolve a relative import to a module file, including the TS-source `./Sibling.js` → `.ts(x)` convention. */
+function resolveRelative(importer, specifier) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (ASSET_SPECIFIER.test(specifier))
+            return null;
+        const base = path.resolve(path.dirname(importer), specifier);
+        const candidates = [];
+        if (/\.[mc]?tsx?$/.test(importer) && /\.jsx?$/.test(base)) {
+            candidates.push(base.replace(/\.jsx?$/, '.ts'), base.replace(/\.jsx?$/, '.tsx'));
+        }
+        candidates.push(base);
+        for (const ext of ['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx'])
+            candidates.push(base + ext);
+        for (const ext of ['.js', '.mjs', '.ts', '.tsx'])
+            candidates.push(path.join(base, 'index' + ext));
+        for (const c of candidates) {
+            if (SOURCE_FILE.test(c) && (yield isFile(c)))
+                return c;
+        }
+        return null;
+    });
+}
+const readLimit = semaphore(64);
+/** Read the module graph reachable from `entries` through relative imports (and `followBare`). */
+function readGraph(entries_1) {
+    return __awaiter(this, arguments, void 0, function* (entries, opts = {}) {
+        var _a;
+        const nodes = new Map();
+        const maxFiles = (_a = opts.maxFiles) !== null && _a !== void 0 ? _a : Infinity;
+        let stopped = false;
+        const visit = (file) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (stopped || nodes.has(file) || nodes.size >= maxFiles)
+                return;
+            const node = { file, bare: [], rel: [] };
+            nodes.set(file, node);
+            const specs = yield readLimit(() => __awaiter(this, void 0, void 0, function* () {
+                try {
+                    return yield importSpecifiers(yield fs.readFile(file, 'utf8'), file);
+                }
+                catch (_a) {
+                    return [];
+                }
+            }));
+            const children = yield Promise.all(specs.map((spec) => __awaiter(this, void 0, void 0, function* () {
+                if (spec.startsWith('.') || spec.startsWith('/')) {
+                    const resolved = yield resolveRelative(file, spec);
+                    if (resolved)
+                        node.rel.push(resolved);
+                    return resolved;
+                }
+                node.bare.push(spec);
+                return opts.followBare ? opts.followBare(spec, file) : null;
+            })));
+            if ((_a = opts.stopWhen) === null || _a === void 0 ? void 0 : _a.call(opts, node)) {
+                stopped = true;
+                return;
+            }
+            yield Promise.all(children.filter((c) => !!c).map(visit));
+        });
+        yield Promise.all(entries.map(visit));
+        return nodes;
+    });
+}
+/** True when the package declares a browser entry anywhere (`browser` field or condition). */
+function hasBrowserEntry(json) {
+    if (json === null || json === void 0 ? void 0 : json.browser)
+        return true;
+    let found = false;
+    const visit = (v) => {
+        if (found || !v || typeof v !== 'object')
+            return;
+        for (const [key, value] of Object.entries(v)) {
+            if (key === 'browser')
+                found = true;
+            else
+                visit(value);
+        }
+    };
+    visit(json === null || json === void 0 ? void 0 : json.exports);
+    return found;
+}
+const isBuiltinSpecifier = (spec) => spec.startsWith('node:') || isBuiltin(spec);
+const subpathOf = (specifier) => {
+    const name = packageNameOf(specifier);
+    return specifier === name ? '.' : `.${specifier.slice(name.length)}`;
+};
+const NODE_CONDITIONS = ['import', 'module', 'default', 'require', 'node'];
+/** `readInstalledPkg`, memoised for one scan. */
+function memoInstalled() {
+    const cache = new Map();
+    return (name, fromDir) => {
+        const key = `${name}\0${fromDir}`;
+        if (!cache.has(key))
+            cache.set(key, readInstalledPkg(name, fromDir));
+        return cache.get(key);
+    };
+}
+/**
+ * Server-only: no browser entry, and the module graph behind the imported
+ * subpath — followed through its own dependencies, as long as those have no
+ * browser entry either — reaches a Node builtin. Such a package (express,
+ * sharp, bcrypt, jsonwebtoken, cookie-parser) serves a framework package's
+ * server code; listing it would make esbuild bundle it for the browser.
+ */
+export function isServerOnlyDependency(root_1, json_1, subpath_1) {
+    return __awaiter(this, arguments, void 0, function* (root, json, subpath, lookup = readInstalledPkg) {
+        if (hasBrowserEntry(json))
+            return false;
+        const entry = yield resolvePackageFile(root, json, subpath, NODE_CONDITIONS);
+        if (!entry)
+            return false;
+        let builtin = false;
+        yield readGraph([entry], {
+            maxFiles: MAX_DEP_FILES,
+            followBare: (spec, importer) => __awaiter(this, void 0, void 0, function* () {
+                if (!isBarePackageSpecifier(spec))
+                    return null;
+                const dep = yield lookup(packageNameOf(spec), path.dirname(importer));
+                if (!dep || hasBrowserEntry(dep.json))
+                    return null;
+                return resolvePackageFile(dep.root, dep.json, subpathOf(spec), NODE_CONDITIONS);
+            }),
+            stopWhen: (node) => (builtin = builtin || node.bare.some(isBuiltinSpecifier)),
+        });
+        return builtin;
+    });
+}
+/** The files a framework package's client code can start from. */
+function clientEntryFiles(pkg) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (pkg.source) {
+            return listFiles(path.join(pkg.root, 'src'), (f) => SOURCE_FILE.test(f) && !IGNORED_SOURCE_FILE.test(f));
+        }
+        return (yield Promise.all(clientExportTargets(pkg.json).map((t) => expandTarget(pkg.root, t)))).flat();
+    });
+}
+/**
+ * Scan the framework packages among `excluded` for the third-party
+ * dependencies their client code imports, and work out the
+ * `optimizeDeps.include` entry for each.
+ *
+ * Framework packages export whole directories (`"./*": "./lib/esm/*.js"`), so
+ * "reachable from the client exports" is every file — server code included. A
+ * file is therefore treated as SERVER code when it imports a Node builtin or a
+ * server-only dependency, or relatively imports a file that does; only the
+ * imports of the remaining files are listed.
+ */
+export function scanLinkedClientDeps(excluded_1) {
+    return __awaiter(this, arguments, void 0, function* (excluded, opts = {}) {
+        var _a, _b, _c, _d, _e;
+        const cwd = path.resolve((_a = opts.cwd) !== null && _a !== void 0 ? _a : process.cwd());
+        const deny = [...DEFAULT_DENY, ...((_b = opts.deny) !== null && _b !== void 0 ? _b : [])];
+        const excludedSet = new Set(excluded);
+        const sourceByName = new Map(((_c = opts.sourceWorkspaces) !== null && _c !== void 0 ? _c : []).map((w) => [w.name, w]));
+        const lookup = memoInstalled();
+        const cache = yield loadCache(opts.cacheFile);
+        const unresolvedExcludes = [];
+        // 1. The excluded packages to scan: every source workspace (Vite does not crawl
+        //    an excluded package, whatever it is), and the installed framework packages.
+        //    A package with a `bin` is a command-line tool (`@_linked/cli`), whose code
+        //    no browser loads; scanning it would only list build tooling.
+        const frameworkPackages = (yield Promise.all([...excludedSet].map((name) => __awaiter(this, void 0, void 0, function* () {
+            const ws = sourceByName.get(name);
+            if (ws) {
+                const root = yield realpath(path.dirname(ws.srcDir));
+                let json = {};
+                try {
+                    json = JSON.parse(yield fs.readFile(path.join(root, 'package.json'), 'utf8'));
+                }
+                catch (_a) { }
+                return { name, root, json, source: true };
+            }
+            const installed = yield lookup(name, cwd);
+            if (!installed) {
+                unresolvedExcludes.push(name);
+                return null;
+            }
+            if (!isFrameworkPkg(name) && installed.json.linkedPackage !== true)
+                return null;
+            return {
+                name,
+                root: yield realpath(installed.root),
+                json: installed.json,
+                source: false,
+            };
+        })))).filter((p) => { var _a; return !!p && !((_a = p.json) === null || _a === void 0 ? void 0 : _a.bin); });
+        // 2. Each package's module graph.
+        const owner = new Map();
+        const nodes = new Map();
+        yield Promise.all(frameworkPackages.map((pkg) => __awaiter(this, void 0, void 0, function* () {
+            const cacheKey = pkg.source ? null : `${pkg.root}\0${pkg.json.version}`;
+            let graph;
+            if (cacheKey && cache.data.graphs[cacheKey]) {
+                graph = new Map(Object.entries(cache.data.graphs[cacheKey]).map(([file, n]) => [
+                    file,
+                    Object.assign({ file }, n),
+                ]));
+            }
+            else {
+                graph = yield readGraph(yield clientEntryFiles(pkg));
+                if (cacheKey) {
+                    cache.data.graphs[cacheKey] = Object.fromEntries([...graph].map(([file, n]) => [file, { bare: n.bare, rel: n.rel }]));
+                    cache.dirty = true;
+                }
+            }
+            for (const [file, node] of graph) {
+                if (nodes.has(file))
+                    continue;
+                nodes.set(file, node);
+                owner.set(file, pkg);
+            }
+        })));
+        // 3. A verdict for every (package, dependency specifier) pair.
+        const verdicts = new Map();
+        const serverOnly = new Map();
+        const pairKey = (pkg, spec) => `${pkg.name}\0${spec}`;
+        const verdictFor = (pkg, spec) => {
+            const key = pairKey(pkg, spec);
+            if (!verdicts.has(key)) {
+                verdicts.set(key, (() => __awaiter(this, void 0, void 0, function* () {
+                    if (!isBarePackageSpecifier(spec))
+                        return null;
+                    const depName = packageNameOf(spec);
+                    if (depName === pkg.name || isFrameworkPkg(depName))
+                        return null;
+                    const installed = yield lookup(depName, pkg.root);
+                    if (!installed)
+                        return { reason: 'unresolved', depName };
+                    if (installed.json.linkedPackage === true)
+                        return null;
+                    const depRoot = yield realpath(installed.root);
+                    const cacheKey = `${depRoot}\0${subpathOf(spec)}`;
+                    if (!serverOnly.has(cacheKey)) {
+                        const persisted = `${cacheKey}\0${installed.json.version}`;
+                        serverOnly.set(cacheKey, persisted in cache.data.serverOnly
+                            ? Promise.resolve(cache.data.serverOnly[persisted])
+                            : isServerOnlyDependency(depRoot, installed.json, subpathOf(spec), lookup).then((v) => {
+                                cache.data.serverOnly[persisted] = v;
+                                cache.dirty = true;
+                                return v;
+                            }));
+                    }
+                    return {
+                        reason: (yield serverOnly.get(cacheKey))
+                            ? 'server-only'
+                            : undefined,
+                        depName,
+                        depRoot,
+                    };
+                }))());
+            }
+            return verdicts.get(key);
+        };
+        yield Promise.all([...nodes.values()].flatMap((n) => n.bare.map((spec) => verdictFor(owner.get(n.file), spec))));
+        // 4. Server code: files importing a builtin or a server-only dependency, and
+        //    every file that relatively imports one of those.
+        const server = new Set();
+        const importers = new Map();
+        for (const node of nodes.values()) {
+            for (const dep of node.rel) {
+                if (!importers.has(dep))
+                    importers.set(dep, []);
+                importers.get(dep).push(node.file);
+            }
+        }
+        const queue = [];
+        for (const node of nodes.values()) {
+            const pkg = owner.get(node.file);
+            for (const spec of node.bare) {
+                if (isBuiltinSpecifier(spec) ||
+                    ((_d = (yield verdicts.get(pairKey(pkg, spec)))) === null || _d === void 0 ? void 0 : _d.reason) === 'server-only') {
+                    server.add(node.file);
+                    queue.push(node.file);
+                    break;
+                }
+            }
+        }
+        while (queue.length) {
+            for (const parent of (_e = importers.get(queue.pop())) !== null && _e !== void 0 ? _e : []) {
+                if (!server.has(parent)) {
+                    server.add(parent);
+                    queue.push(parent);
+                }
+            }
+        }
+        // 5. Entries from client files; everything else is reported as skipped.
+        const rootCopy = new Map();
+        const rootResolution = (depName) => {
+            if (!rootCopy.has(depName)) {
+                rootCopy.set(depName, lookup(depName, cwd).then((r) => (r ? realpath(r.root) : null)));
+            }
+            return rootCopy.get(depName);
+        };
+        const entries = new Map();
+        const clientPairs = new Set();
+        const skipped = new Map();
+        const skip = (specifier, from, reason) => {
+            skipped.set(`${specifier}\0${from}`, { specifier, from, reason });
+        };
+        for (const node of nodes.values()) {
+            if (server.has(node.file))
+                continue;
+            const pkg = owner.get(node.file);
+            for (const spec of node.bare)
+                clientPairs.add(pairKey(pkg, spec));
+        }
+        for (const node of nodes.values()) {
+            const pkg = owner.get(node.file);
+            for (const spec of node.bare) {
+                const key = pairKey(pkg, spec);
+                const verdict = yield verdicts.get(key);
+                if (!verdict)
+                    continue;
+                if (verdict.reason) {
+                    skip(spec, pkg.name, verdict.reason);
+                    continue;
+                }
+                if (!clientPairs.has(key)) {
+                    if (!skipped.has(`${spec}\0${pkg.name}`))
+                        skip(spec, pkg.name, 'server-code');
+                    continue;
+                }
+                if (excludedSet.has(verdict.depName) || excludedSet.has(spec)) {
+                    skip(spec, pkg.name, 'excluded');
+                    continue;
+                }
+                const nested = (yield rootResolution(verdict.depName)) !== verdict.depRoot;
+                const entry = nested ? `${pkg.name} > ${spec}` : spec;
+                if (matchesDeny(deny, entry, spec, verdict.depName)) {
+                    skip(spec, pkg.name, 'denied');
+                    continue;
+                }
+                if (!entries.has(entry)) {
+                    entries.set(entry, {
+                        entry,
+                        specifier: spec,
+                        from: pkg.name,
+                        depName: verdict.depName,
+                        depRoot: verdict.depRoot,
+                        nested,
+                    });
+                }
+            }
+        }
+        for (const { specifier, from } of entries.values())
+            skipped.delete(`${specifier}\0${from}`);
+        yield saveCache(opts.cacheFile, cache);
+        return {
+            entries: [...entries.values()].sort((a, b) => a.entry.localeCompare(b.entry)),
+            skipped: [...skipped.values()].sort((a, b) => a.specifier.localeCompare(b.specifier) || a.from.localeCompare(b.from)),
+            frameworkPackages,
+            unresolvedExcludes,
+            filesScanned: nodes.size,
+        };
+    });
+}
+/** Just the entries, for `optimizeDeps.include`. */
+export function linkedClientDepIncludes(excluded_1) {
+    return __awaiter(this, arguments, void 0, function* (excluded, opts = {}) {
+        return (yield scanLinkedClientDeps(excluded, opts)).entries.map((e) => e.entry);
+    });
+}
+/**
+ * The most recent scan the plugin ran in this process, with the app's own
+ * include list — `linked doctor` loads the app's config and reads this, so it
+ * checks exactly what the dev server would use.
+ */
+export const lastClientDepScan = ((_a = (_b = globalThis)[_c = Symbol.for('@_linked/cli.lastClientDepScan')]) !== null && _a !== void 0 ? _a : (_b[_c] = { current: null }));
+/** Where the scan cache lives: beside Vite's own cache, inside the app's node_modules. */
+export const defaultClientDepCacheFile = (cwd) => path.join(cwd, 'node_modules', '.cache', 'linked', 'client-deps.json');
+const debugEnabled = () => { var _a; return /(^|[\s,])(linked(:[\w*]+)?|\*)($|[\s,])/.test((_a = process.env.DEBUG) !== null && _a !== void 0 ? _a : ''); };
+/**
+ * Adds the scan's entries to `optimizeDeps.include` in dev.
+ *
+ * It is a `config` hook ordered `post` rather than a value computed inside
+ * `createViteConfig`, because the exclude list it reads is only final once the
+ * app has merged its own config on top — an app that excludes every installed
+ * `@_linked/*` package does that in its own `vite.config.ts`. Vite concatenates
+ * the returned array onto the app's own `include`, which is never replaced.
+ */
+export function linkedClientDepIncludesPlugin(opts = {}) {
+    // What the app itself lists, before other plugins add theirs
+    // (@vitejs/plugin-react adds `react`, `react/jsx-runtime`…): `linked doctor`
+    // must not tell anyone to delete an entry they never wrote.
+    let appInclude = [];
+    const snapshot = {
+        name: 'linked:client-dep-includes:app-include',
+        apply: 'serve',
+        config: {
+            order: 'pre',
+            handler(userConfig) {
+                var _a, _b;
+                appInclude = [...((_b = (_a = userConfig.optimizeDeps) === null || _a === void 0 ? void 0 : _a.include) !== null && _b !== void 0 ? _b : [])];
+            },
+        },
+    };
+    return [
+        snapshot,
+        {
+            name: 'linked:client-dep-includes',
+            apply: 'serve',
+            config: {
+                order: 'post',
+                handler(userConfig) {
+                    return __awaiter(this, void 0, void 0, function* () {
+                        var _a, _b, _c, _d, _e, _f;
+                        const optimizeDeps = (_a = userConfig.optimizeDeps) !== null && _a !== void 0 ? _a : {};
+                        // `linked start --api-only` has no browser client to optimise for.
+                        if (optimizeDeps.noDiscovery)
+                            return;
+                        const cwd = path.resolve((_b = userConfig.root) !== null && _b !== void 0 ? _b : process.cwd());
+                        const started = performance.now();
+                        const scan = yield scanLinkedClientDeps((_c = optimizeDeps.exclude) !== null && _c !== void 0 ? _c : [], {
+                            cwd,
+                            sourceWorkspaces: opts.sourceWorkspaces,
+                            deny: opts.deny,
+                            cacheFile: opts.cacheFile === false
+                                ? undefined
+                                : ((_d = opts.cacheFile) !== null && _d !== void 0 ? _d : defaultClientDepCacheFile(cwd)),
+                        });
+                        const existing = new Set((_e = optimizeDeps.include) !== null && _e !== void 0 ? _e : []);
+                        const added = scan.entries
+                            .map((e) => e.entry)
+                            .filter((e) => !existing.has(e));
+                        lastClientDepScan.current = {
+                            cwd,
+                            scan,
+                            appInclude,
+                            exclude: (_f = optimizeDeps.exclude) !== null && _f !== void 0 ? _f : [],
+                        };
+                        if (debugEnabled()) {
+                            console.log(`[linked] optimizeDeps.include: ${added.length} entries for linked packages' client dependencies ` +
+                                `(${Math.round(performance.now() - started)}ms, ${scan.filesScanned} files)` +
+                                added.map((e) => `\n  ${e}`).join(''));
+                        }
+                        return added.length ? { optimizeDeps: { include: added } } : undefined;
+                    });
+                },
+            },
+        },
+    ];
+}
+//# sourceMappingURL=client-dep-includes.js.map