@_linked/server 2.15.0 → 2.16.0

package/lib/esm/utils/linkedDependencies.d.ts

@@ -0,0 +1,66 @@
+/**
+ * A linked package found in the app's dependency tree, wherever it is
+ * installed: a workspace member, a localized checkout, or a registry install.
+ */
+export interface LinkedDependency {
+    packageName: string;
+    /** Realpath of the package root. */
+    path: string;
+}
+/**
+ * A package whose backend providers the server loads at boot: one whose
+ * package.json declares `"linkedPackage": true`. That flag is the only test —
+ * not the package's scope. `@_linked/localize` is in the `@_linked` scope and
+ * is a CLI tool, not a linked package; a custom-scope package with the flag is
+ * a linked package. The CLI's workspace discovery uses the same flag.
+ *
+ * The legacy `"lincd": true` flag is deliberately NOT enough. Those packages
+ * import the old `lincd` core, and loading them at boot is what produced
+ * "Multiple versions of LINCD are loaded" before boot loading was narrowed to
+ * workspace members.
+ */
+export declare function isLinkedPackageJson(json: any): boolean;
+/**
+ * Find an installed package the way Node does: `<dir>/node_modules/<name>`,
+ * then each parent directory's `node_modules`. Returns null when it is not
+ * installed (an optional dependency, say) rather than throwing.
+ */
+export declare function readInstalledPackage(name: string, fromDir: string): {
+    root: string;
+    json: any;
+} | null;
+/**
+ * Every linked package reachable from the app's `dependencies`, each one AFTER
+ * the linked packages it depends on. Providers register middleware in the
+ * order they are indexed, so a package's middleware must not run before that
+ * of a package it builds on (e.g. anything reading `request.linkedAuth` after
+ * @_linked/auth's JWT middleware).
+ *
+ * Only linked packages are recursed into — the same rule the workspace-only
+ * filter used — so the walk reads a few dozen package.json files, not the
+ * whole of node_modules. Each package's dependencies are resolved from its
+ * REAL location, so a symlinked workspace or localized checkout resolves its
+ * own dependencies the way Node will when it loads it.
+ */
+export declare function discoverLinkedDependencies(appDir: string, appPackageJson: any): LinkedDependency[];
+/**
+ * Whether the dev SSR runner BUNDLES `pkgName` (it is in Vite's
+ * `ssr.noExternal`) rather than handing it to Node.
+ *
+ * This decides which loader a package's backend must be loaded with. A module
+ * has to be evaluated by the same loader that evaluates the package everywhere
+ * else in the SSR graph, or it runs twice:
+ *
+ *  - `vite.ssrLoadModule('<external pkg>/backend')` transforms that entry and
+ *    its relative imports even though the package is external, while the app's
+ *    bare imports of the same package are evaluated by Node — two copies of the
+ *    package's module state.
+ *  - a plain `import()` of a BUNDLED package goes to Node, while the app's
+ *    imports of it are evaluated by Vite — the same split the other way round.
+ *
+ * Vite matches `noExternal` entries against the bare package name, so a
+ * subpath (`pkg/backend`) is covered by an entry for `pkg`.
+ */
+export declare function isBundledBySsr(pkgName: string, noExternal: unknown): boolean;
+/** The dev SSR runner's resolved `noExternal`, wherever this Vite keeps it. */
+export declare function ssrNoExternalOf(vite: any): unknown;

package/lib/esm/utils/linkedDependencies.js

@@ -0,0 +1,123 @@
+import * as fs from 'fs';
+import * as path from 'path';
+/**
+ * A package whose backend providers the server loads at boot: one whose
+ * package.json declares `"linkedPackage": true`. That flag is the only test —
+ * not the package's scope. `@_linked/localize` is in the `@_linked` scope and
+ * is a CLI tool, not a linked package; a custom-scope package with the flag is
+ * a linked package. The CLI's workspace discovery uses the same flag.
+ *
+ * The legacy `"lincd": true` flag is deliberately NOT enough. Those packages
+ * import the old `lincd` core, and loading them at boot is what produced
+ * "Multiple versions of LINCD are loaded" before boot loading was narrowed to
+ * workspace members.
+ */
+export function isLinkedPackageJson(json) {
+    if (!json || typeof json.name !== 'string')
+        return false;
+    return json.linkedPackage === true;
+}
+/**
+ * Find an installed package the way Node does: `<dir>/node_modules/<name>`,
+ * then each parent directory's `node_modules`. Returns null when it is not
+ * installed (an optional dependency, say) rather than throwing.
+ */
+export function readInstalledPackage(name, fromDir) {
+    let dir = path.resolve(fromDir);
+    while (true) {
+        const root = path.join(dir, 'node_modules', name);
+        const pkgJsonPath = path.join(root, 'package.json');
+        if (fs.existsSync(pkgJsonPath)) {
+            try {
+                return { root, json: JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8')) };
+            }
+            catch (_a) {
+                return null;
+            }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Every linked package reachable from the app's `dependencies`, each one AFTER
+ * the linked packages it depends on. Providers register middleware in the
+ * order they are indexed, so a package's middleware must not run before that
+ * of a package it builds on (e.g. anything reading `request.linkedAuth` after
+ * @_linked/auth's JWT middleware).
+ *
+ * Only linked packages are recursed into — the same rule the workspace-only
+ * filter used — so the walk reads a few dozen package.json files, not the
+ * whole of node_modules. Each package's dependencies are resolved from its
+ * REAL location, so a symlinked workspace or localized checkout resolves its
+ * own dependencies the way Node will when it loads it.
+ */
+export function discoverLinkedDependencies(appDir, appPackageJson) {
+    var _a;
+    const out = [];
+    const seen = new Set();
+    if (appPackageJson === null || appPackageJson === void 0 ? void 0 : appPackageJson.name)
+        seen.add(appPackageJson.name);
+    const visit = (name, fromDir) => {
+        var _a;
+        if (seen.has(name))
+            return;
+        seen.add(name);
+        const installed = readInstalledPackage(name, fromDir);
+        if (!installed || !isLinkedPackageJson(installed.json))
+            return;
+        let realRoot = installed.root;
+        try {
+            realRoot = fs.realpathSync(installed.root);
+        }
+        catch (_b) { }
+        for (const dep of Object.keys((_a = installed.json.dependencies) !== null && _a !== void 0 ? _a : {})) {
+            visit(dep, realRoot);
+        }
+        out.push({ packageName: name, path: realRoot });
+    };
+    for (const name of Object.keys((_a = appPackageJson === null || appPackageJson === void 0 ? void 0 : appPackageJson.dependencies) !== null && _a !== void 0 ? _a : {})) {
+        visit(name, appDir);
+    }
+    return out;
+}
+/**
+ * Whether the dev SSR runner BUNDLES `pkgName` (it is in Vite's
+ * `ssr.noExternal`) rather than handing it to Node.
+ *
+ * This decides which loader a package's backend must be loaded with. A module
+ * has to be evaluated by the same loader that evaluates the package everywhere
+ * else in the SSR graph, or it runs twice:
+ *
+ *  - `vite.ssrLoadModule('<external pkg>/backend')` transforms that entry and
+ *    its relative imports even though the package is external, while the app's
+ *    bare imports of the same package are evaluated by Node — two copies of the
+ *    package's module state.
+ *  - a plain `import()` of a BUNDLED package goes to Node, while the app's
+ *    imports of it are evaluated by Vite — the same split the other way round.
+ *
+ * Vite matches `noExternal` entries against the bare package name, so a
+ * subpath (`pkg/backend`) is covered by an entry for `pkg`.
+ */
+export function isBundledBySsr(pkgName, noExternal) {
+    if (noExternal === true)
+        return true;
+    const entries = Array.isArray(noExternal)
+        ? noExternal
+        : noExternal
+            ? [noExternal]
+            : [];
+    return entries.some((entry) => typeof entry === 'string'
+        ? entry === pkgName
+        : entry instanceof RegExp
+            ? entry.test(pkgName)
+            : false);
+}
+/** The dev SSR runner's resolved `noExternal`, wherever this Vite keeps it. */
+export function ssrNoExternalOf(vite) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    return ((_c = (_b = (_a = vite === null || vite === void 0 ? void 0 : vite.config) === null || _a === void 0 ? void 0 : _a.ssr) === null || _b === void 0 ? void 0 : _b.noExternal) !== null && _c !== void 0 ? _c : (_g = (_f = (_e = (_d = vite === null || vite === void 0 ? void 0 : vite.config) === null || _d === void 0 ? void 0 : _d.environments) === null || _e === void 0 ? void 0 : _e.ssr) === null || _f === void 0 ? void 0 : _f.resolve) === null || _g === void 0 ? void 0 : _g.noExternal);
+}
+//# sourceMappingURL=linkedDependencies.js.map

package/lib/esm/utils/linkedDependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkedDependencies.js","sourceRoot":"","sources":["../../../src/utils/linkedDependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAY7B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAS;IAC3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,OAAe;IAEf,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACpD,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC3E,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAc,EACd,cAAmB;;IAEnB,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAExD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE;;QAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/D,IAAI,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAAC,WAAM,CAAC,CAAA,CAAC;QACV,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAA,SAAS,CAAC,IAAI,CAAC,YAAY,mCAAI,EAAE,CAAC,EAAE,CAAC;YACjE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,YAAY,mCAAI,EAAE,CAAC,EAAE,CAAC;QACnE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,UAAmB;IACjE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QACvC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,UAAU;YACV,CAAC,CAAC,CAAC,UAAU,CAAC;YACd,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5B,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,KAAK,KAAK,OAAO;QACnB,CAAC,CAAC,KAAK,YAAY,MAAM;YACvB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YACrB,CAAC,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,IAAS;;IACvC,OAAO,CACL,MAAA,MAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,GAAG,0CAAE,UAAU,mCAC7B,MAAA,MAAA,MAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,YAAY,0CAAE,GAAG,0CAAE,OAAO,0CAAE,UAAU,CACrD,CAAC;AACJ,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\n/**\n * A linked package found in the app's dependency tree, wherever it is\n * installed: a workspace member, a localized checkout, or a registry install.\n */\nexport interface LinkedDependency {\n  packageName: string;\n  /** Realpath of the package root. */\n  path: string;\n}\n\n/**\n * A package whose backend providers the server loads at boot: one whose\n * package.json declares `\"linkedPackage\": true`. That flag is the only test —\n * not the package's scope. `@_linked/localize` is in the `@_linked` scope and\n * is a CLI tool, not a linked package; a custom-scope package with the flag is\n * a linked package. The CLI's workspace discovery uses the same flag.\n *\n * The legacy `\"lincd\": true` flag is deliberately NOT enough. Those packages\n * import the old `lincd` core, and loading them at boot is what produced\n * \"Multiple versions of LINCD are loaded\" before boot loading was narrowed to\n * workspace members.\n */\nexport function isLinkedPackageJson(json: any): boolean {\n  if (!json || typeof json.name !== 'string') return false;\n  return json.linkedPackage === true;\n}\n\n/**\n * Find an installed package the way Node does: `<dir>/node_modules/<name>`,\n * then each parent directory's `node_modules`. Returns null when it is not\n * installed (an optional dependency, say) rather than throwing.\n */\nexport function readInstalledPackage(\n  name: string,\n  fromDir: string\n): { root: string; json: any } | null {\n  let dir = path.resolve(fromDir);\n  while (true) {\n    const root = path.join(dir, 'node_modules', name);\n    const pkgJsonPath = path.join(root, 'package.json');\n    if (fs.existsSync(pkgJsonPath)) {\n      try {\n        return { root, json: JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8')) };\n      } catch {\n        return null;\n      }\n    }\n    const parent = path.dirname(dir);\n    if (parent === dir) return null;\n    dir = parent;\n  }\n}\n\n/**\n * Every linked package reachable from the app's `dependencies`, each one AFTER\n * the linked packages it depends on. Providers register middleware in the\n * order they are indexed, so a package's middleware must not run before that\n * of a package it builds on (e.g. anything reading `request.linkedAuth` after\n * @_linked/auth's JWT middleware).\n *\n * Only linked packages are recursed into — the same rule the workspace-only\n * filter used — so the walk reads a few dozen package.json files, not the\n * whole of node_modules. Each package's dependencies are resolved from its\n * REAL location, so a symlinked workspace or localized checkout resolves its\n * own dependencies the way Node will when it loads it.\n */\nexport function discoverLinkedDependencies(\n  appDir: string,\n  appPackageJson: any\n): LinkedDependency[] {\n  const out: LinkedDependency[] = [];\n  const seen = new Set<string>();\n  if (appPackageJson?.name) seen.add(appPackageJson.name);\n\n  const visit = (name: string, fromDir: string) => {\n    if (seen.has(name)) return;\n    seen.add(name);\n    const installed = readInstalledPackage(name, fromDir);\n    if (!installed || !isLinkedPackageJson(installed.json)) return;\n    let realRoot = installed.root;\n    try {\n      realRoot = fs.realpathSync(installed.root);\n    } catch {}\n    for (const dep of Object.keys(installed.json.dependencies ?? {})) {\n      visit(dep, realRoot);\n    }\n    out.push({ packageName: name, path: realRoot });\n  };\n\n  for (const name of Object.keys(appPackageJson?.dependencies ?? {})) {\n    visit(name, appDir);\n  }\n  return out;\n}\n\n/**\n * Whether the dev SSR runner BUNDLES `pkgName` (it is in Vite's\n * `ssr.noExternal`) rather than handing it to Node.\n *\n * This decides which loader a package's backend must be loaded with. A module\n * has to be evaluated by the same loader that evaluates the package everywhere\n * else in the SSR graph, or it runs twice:\n *\n *  - `vite.ssrLoadModule('<external pkg>/backend')` transforms that entry and\n *    its relative imports even though the package is external, while the app's\n *    bare imports of the same package are evaluated by Node — two copies of the\n *    package's module state.\n *  - a plain `import()` of a BUNDLED package goes to Node, while the app's\n *    imports of it are evaluated by Vite — the same split the other way round.\n *\n * Vite matches `noExternal` entries against the bare package name, so a\n * subpath (`pkg/backend`) is covered by an entry for `pkg`.\n */\nexport function isBundledBySsr(pkgName: string, noExternal: unknown): boolean {\n  if (noExternal === true) return true;\n  const entries = Array.isArray(noExternal)\n    ? noExternal\n    : noExternal\n      ? [noExternal]\n      : [];\n  return entries.some((entry) =>\n    typeof entry === 'string'\n      ? entry === pkgName\n      : entry instanceof RegExp\n        ? entry.test(pkgName)\n        : false\n  );\n}\n\n/** The dev SSR runner's resolved `noExternal`, wherever this Vite keeps it. */\nexport function ssrNoExternalOf(vite: any): unknown {\n  return (\n    vite?.config?.ssr?.noExternal ??\n    vite?.config?.environments?.ssr?.resolve?.noExternal\n  );\n}\n"]}

package/package.json

@@ -10,7 +10,7 @@
     "type": "git",
     "url": "git+https://github.com/linked-fw/server.git"
   },
-  "version": "2.15.0",
+  "version": "2.16.0",
   "packageManager": "npm@11.20.0",
   "linkedPackage": true,
   "type": "module",
@@ -68,7 +68,7 @@
     "@changesets/cli": "^3.0.0",
     "@jest/globals": "^29.7.0",
     "@types/jest": "^29.5.14",
-    "@types/node": "^20.12.7",
+    "@types/node": "^24.0.0",
     "@types/react-dom": "^19.3.0",
     "copyfiles": "^2.4.1",
     "cross-env": "^7.0.3",