@b9g/libuild 0.1.3 → 0.1.5

package/src/libuild.cjs

@@ -35,19 +35,17 @@ __export(libuild_exports, {
   transformSrcToDist: () => transformSrcToDist
 });
 module.exports = __toCommonJS(libuild_exports);
-var FS2 = __toESM(require("fs/promises"), 1);
-var Path2 = __toESM(require("path"), 1);
+var FS3 = __toESM(require("fs/promises"), 1);
+var Path3 = __toESM(require("path"), 1);
 var import_child_process = require("child_process");
 var ESBuild = __toESM(require("esbuild"), 1);
-var TS = __toESM(require("typescript"), 1);
 
-// src/umd-plugin.ts
+// src/plugins/umd.ts
 var FS = __toESM(require("fs/promises"), 1);
 var Path = __toESM(require("path"), 1);
-var import_magic_string = __toESM(require("magic-string"), 1);
 function umdPlugin(options) {
   return {
-    name: "umd-wrapper",
+    name: "umd",
     setup(build3) {
       build3.onEnd(async (result) => {
         if (result.errors.length > 0)
@@ -57,7 +55,7 @@ function umdPlugin(options) {
           const files = await FS.readdir(outputDir);
           for (const file of files) {
             if (file.endsWith(".js") && !file.endsWith(".js.map")) {
-              await wrapWithUmd(Path.join(outputDir, file), options.globalName);
+              await wrapWithUMD(Path.join(outputDir, file), options.globalName);
             }
           }
         }
@@ -65,20 +63,9 @@ function umdPlugin(options) {
     }
   };
 }
-async function wrapWithUmd(filePath, globalName) {
+async function wrapWithUMD(filePath, globalName) {
   const code = await FS.readFile(filePath, "utf-8");
-  const ms = new import_magic_string.default(code);
-  const sourcemapComment = code.match(/\/\/# sourceMappingURL=.+$/m);
-  if (sourcemapComment) {
-    const index = code.lastIndexOf(sourcemapComment[0]);
-    ms.remove(index, index + sourcemapComment[0].length);
-  }
-  const exportsMatch = code.match(/\nmodule\.exports\s*=\s*([^;]+);?\s*$/);
-  if (exportsMatch) {
-    const index = code.lastIndexOf(exportsMatch[0]);
-    ms.overwrite(index, index + exportsMatch[0].length, `
-return ${exportsMatch[1]};`);
-  }
+  let modifiedCode = code.replace(/\nmodule\.exports\s*=\s*([^;]+);?\s*$/, "\nreturn $1;");
   const umdHeader = `(function (root, factory) {
   if (typeof define === 'function' && define.amd) {
     // AMD
@@ -94,18 +81,144 @@ return ${exportsMatch[1]};`);
 `;
   const umdFooter = `
 }));`;
-  ms.prepend(umdHeader);
-  ms.append(umdFooter);
-  const result = ms.toString();
-  const map = ms.generateMap({
-    file: Path.basename(filePath),
-    source: Path.basename(filePath).replace(".js", ".ts"),
-    includeContent: true
-  });
+  const result = umdHeader + modifiedCode + umdFooter;
   await FS.writeFile(filePath, result);
-  await FS.writeFile(filePath + ".map", map.toString());
-  await FS.writeFile(filePath, result + `
-//# sourceMappingURL=${Path.basename(filePath)}.map`);
+}
+
+// src/plugins/external.ts
+function externalEntrypointsPlugin(options) {
+  return {
+    name: "external-entrypoints",
+    setup(build3) {
+      const { entryNames, currentEntry, outputExtension } = options;
+      const externalEntries = currentEntry ? entryNames.filter((name) => name !== currentEntry) : entryNames;
+      build3.onResolve({ filter: /^\.\// }, (args) => {
+        const withoutExt = args.path.replace(/\.(ts|js)$/, "");
+        const entryName = withoutExt.replace(/^\.\//, "");
+        if (externalEntries.includes(entryName)) {
+          return {
+            path: `./${entryName}${outputExtension}`,
+            external: true
+          };
+        }
+      });
+    }
+  };
+}
+
+// src/plugins/dts.ts
+var FS2 = __toESM(require("fs/promises"), 1);
+var Path2 = __toESM(require("path"), 1);
+function dtsPlugin(options) {
+  return {
+    name: "dts",
+    setup(build3) {
+      const entryFiles = [];
+      build3.onLoad({ filter: /\.tsx?$/ }, async (args) => {
+        if (!entryFiles.includes(args.path)) {
+          entryFiles.push(args.path);
+        }
+        return void 0;
+      });
+      build3.onEnd(async (result) => {
+        if (result.errors.length > 0) {
+          return;
+        }
+        let TS;
+        try {
+          TS = await import("typescript");
+        } catch {
+          return;
+        }
+        const tsFiles = entryFiles.filter((file) => {
+          if (!file.endsWith(".ts"))
+            return false;
+          return options.entryPoints.some((entryPoint) => {
+            const normalizedEntry = Path2.resolve(entryPoint);
+            const normalizedFile = Path2.resolve(file);
+            return normalizedEntry === normalizedFile;
+          });
+        });
+        if (tsFiles.length === 0) {
+          return;
+        }
+        try {
+          const compilerOptions = {
+            declaration: true,
+            emitDeclarationOnly: true,
+            outDir: options.outDir,
+            rootDir: options.rootDir,
+            skipLibCheck: true,
+            esModuleInterop: true,
+            target: TS.ScriptTarget.ES2020,
+            module: TS.ModuleKind.ESNext,
+            isolatedModules: true,
+            // Prevent cross-file type dependencies
+            noResolve: true
+            // Don't resolve imports - only process the specific files
+          };
+          const program = TS.createProgram(tsFiles, compilerOptions);
+          const emitResult = program.emit();
+          if (emitResult.diagnostics.length > 0) {
+            const diagnostics = TS.formatDiagnosticsWithColorAndContext(emitResult.diagnostics, {
+              getCanonicalFileName: (path) => path,
+              getCurrentDirectory: () => process.cwd(),
+              getNewLine: () => "\n"
+            });
+            result.errors.push({
+              id: "typescript-declarations",
+              pluginName: "dts",
+              text: `TypeScript declaration generation failed:
+${diagnostics}`,
+              location: null,
+              notes: [],
+              detail: void 0
+            });
+          }
+        } catch (error) {
+          result.errors.push({
+            id: "typescript-plugin-error",
+            pluginName: "dts",
+            text: `TypeScript plugin error: ${error.message}`,
+            location: null,
+            notes: [],
+            detail: void 0
+          });
+        }
+        await addTripleSlashReferences(tsFiles, options.outDir);
+      });
+    }
+  };
+}
+async function addTripleSlashReferences(tsFiles, outDir) {
+  for (const tsFile of tsFiles) {
+    const baseName = Path2.basename(tsFile, Path2.extname(tsFile));
+    const jsPath = Path2.join(outDir, `${baseName}.js`);
+    const dtsPath = Path2.join(outDir, `${baseName}.d.ts`);
+    const [jsExists, dtsExists] = await Promise.all([
+      FS2.access(jsPath).then(() => true).catch(() => false),
+      FS2.access(dtsPath).then(() => true).catch(() => false)
+    ]);
+    if (!jsExists || !dtsExists)
+      continue;
+    const content = await FS2.readFile(jsPath, "utf-8");
+    const referenceComment = `/// <reference types="./${baseName}.d.ts" />`;
+    let modifiedContent;
+    if (content.startsWith("#!")) {
+      const firstNewline = content.indexOf("\n");
+      if (firstNewline !== -1) {
+        modifiedContent = content.slice(0, firstNewline + 1) + `${referenceComment}
+` + content.slice(firstNewline + 1);
+      } else {
+        modifiedContent = content + `
+${referenceComment}`;
+      }
+    } else {
+      modifiedContent = `${referenceComment}
+${content}`;
+    }
+    await FS2.writeFile(jsPath, modifiedContent);
+  }
 }
 
 // src/libuild.ts
@@ -120,11 +233,15 @@ function isValidEntrypoint(filename) {
     return false;
   return true;
 }
-async function findEntryPoints(srcDir) {
-  const files = await FS2.readdir(srcDir);
-  return files.filter(isValidEntrypoint).map((file) => Path2.basename(file, Path2.extname(file))).sort();
+async function findEntrypoints(srcDir) {
+  const files = await FS3.readdir(srcDir);
+  return files.filter(isValidEntrypoint).map((file) => Path3.basename(file, Path3.extname(file))).sort();
 }
-async function detectMainEntry(pkg, entries) {
+function detectMainEntry(pkg, entries) {
+  function extractEntryFromPath(path) {
+    const match = path.match(/\.\/src\/([^.]+)/);
+    return match ? match[1] : void 0;
+  }
   if (pkg.exports && pkg.exports["."]) {
     const dotExport = pkg.exports["."];
     let importPath;
@@ -134,18 +251,24 @@ async function detectMainEntry(pkg, entries) {
       importPath = dotExport.import;
     }
     if (importPath) {
-      const match = importPath.match(/\.\/src\/([^.]+)/);
-      if (match && entries.includes(match[1])) {
-        return match[1];
+      const entry = extractEntryFromPath(importPath);
+      if (entry && entries.includes(entry)) {
+        return entry;
       }
     }
   }
   if (pkg.main && typeof pkg.main === "string") {
-    const mainBase = Path2.basename(pkg.main, Path2.extname(pkg.main));
+    const mainBase = Path3.basename(pkg.main, Path3.extname(pkg.main));
     if (entries.includes(mainBase)) {
       return mainBase;
     }
   }
+  if (pkg.module && typeof pkg.module === "string") {
+    const moduleBase = Path3.basename(pkg.module, Path3.extname(pkg.module));
+    if (entries.includes(moduleBase)) {
+      return moduleBase;
+    }
+  }
   if (entries.includes("index")) {
     return "index";
   }
@@ -236,7 +359,7 @@ function generateExports(entries, mainEntry, options, existingExports = {}) {
         if (!isValidEntrypoint(filename)) {
           throw new Error(`Export path '${existing}' references '${filename}' which is not a valid entrypoint. Valid entrypoints cannot start with '_' or '.' and must be .ts/.js files in src/.`);
         }
-        const entry = Path2.basename(filename, Path2.extname(filename));
+        const entry = Path3.basename(filename, Path3.extname(filename));
         return options.formats.cjs ? {
           types: `./src/${entry}.d.ts`,
           import: existing,
@@ -265,7 +388,7 @@ function generateExports(entries, mainEntry, options, existingExports = {}) {
           if (!isValidEntrypoint(filename)) {
             throw new Error(`Export import path '${existing.import}' references '${filename}' which is not a valid entrypoint. Valid entrypoints cannot start with '_' or '.' and must be .ts/.js files in src/.`);
           }
-          const entry = Path2.basename(filename, Path2.extname(filename));
+          const entry = Path3.basename(filename, Path3.extname(filename));
           return {
             ...existing,
             types: existing.types || `./src/${entry}.d.ts`,
@@ -313,14 +436,6 @@ function generateExports(entries, mainEntry, options, existingExports = {}) {
     if (!exports2[`${key}.js`]) {
       exports2[`${key}.js`] = exports2[key];
     }
-    if (entry === "jsx-runtime") {
-      if (!exports2["./jsx-dev-runtime"]) {
-        exports2["./jsx-dev-runtime"] = exports2[key];
-      }
-      if (!exports2["./jsx-dev-runtime.js"]) {
-        exports2["./jsx-dev-runtime.js"] = exports2[key];
-      }
-    }
   }
   if (options.formats.umd && !exports2["./umd"]) {
     exports2["./umd"] = {
@@ -352,6 +467,30 @@ function transformSrcToDist(value) {
   }
   return value;
 }
+function transformBinPaths(value) {
+  if (typeof value === "string") {
+    if (value.startsWith("./dist/src/")) {
+      return value.replace("./dist/", "");
+    }
+    if (value.startsWith("dist/src/")) {
+      return value.replace("dist/", "");
+    }
+    if (value.startsWith("./src/")) {
+      return value.replace("./", "");
+    }
+    if (value.startsWith("src/") || value === "src") {
+      return value;
+    }
+    return value;
+  } else if (typeof value === "object" && value !== null) {
+    const transformed = {};
+    for (const [key, val] of Object.entries(value)) {
+      transformed[key] = transformBinPaths(val);
+    }
+    return transformed;
+  }
+  return value;
+}
 function fixExportsForDist(obj) {
   if (typeof obj === "string") {
     if (obj.includes("/dist/") && obj.includes("/src/")) {
@@ -374,6 +513,8 @@ function fixExportsForDist(obj) {
     for (const [key, val] of Object.entries(obj)) {
       if (key === "files" && Array.isArray(val)) {
         fixed[key] = val.filter((file) => file !== "dist/" && file !== "dist").concat(val.includes("dist/") || val.includes("dist") ? ["src/"] : []);
+      } else if (key === "bin") {
+        fixed[key] = val;
       } else {
         fixed[key] = fixExportsForDist(val);
       }
@@ -401,7 +542,9 @@ function cleanPackageJSON(pkg, mainEntry, options) {
     "bin",
     "scripts",
     "dependencies",
+    "devDependencies",
     "peerDependencies",
+    "peerDependenciesMeta",
     "optionalDependencies",
     "bundledDependencies",
     "engines",
@@ -428,7 +571,7 @@ function cleanPackageJSON(pkg, mainEntry, options) {
           cleaned[field] = transformSrcToDist(filteredScripts);
         }
       } else if (field === "bin") {
-        cleaned[field] = transformSrcToDist(pkg[field]);
+        cleaned[field] = transformBinPaths(pkg[field]);
       } else if (pathFields.includes(field)) {
         cleaned[field] = transformSrcToDist(pkg[field]);
       } else {
@@ -448,36 +591,50 @@ function cleanPackageJSON(pkg, mainEntry, options) {
 }
 async function fileExists(filePath) {
   try {
-    await FS2.access(filePath);
+    await FS3.access(filePath);
     return true;
   } catch {
     return false;
   }
 }
+function validatePath(inputPath, basePath) {
+  if (Path3.isAbsolute(inputPath)) {
+    throw new Error(`Absolute paths are not allowed: ${inputPath}`);
+  }
+  if (inputPath.includes("..")) {
+    throw new Error(`Path traversal is not allowed: ${inputPath}`);
+  }
+  const resolvedPath = Path3.resolve(basePath, inputPath);
+  const resolvedBase = Path3.resolve(basePath);
+  if (!resolvedPath.startsWith(resolvedBase + Path3.sep) && resolvedPath !== resolvedBase) {
+    throw new Error(`Path ${inputPath} resolves outside the project directory`);
+  }
+  return resolvedPath;
+}
 async function build2(cwd, save = false) {
-  console.log("Building with libuild...");
-  const srcDir = Path2.join(cwd, "src");
-  const distDir = Path2.join(cwd, "dist");
-  const distSrcDir = Path2.join(distDir, "src");
+  console.info("Building with libuild...");
+  const srcDir = Path3.join(cwd, "src");
+  const distDir = Path3.join(cwd, "dist");
+  const distSrcDir = Path3.join(distDir, "src");
   if (!await fileExists(srcDir)) {
     throw new Error("No src/ directory found");
   }
-  const pkgPath = Path2.join(cwd, "package.json");
-  const pkg = JSON.parse(await FS2.readFile(pkgPath, "utf-8"));
+  const pkgPath = Path3.join(cwd, "package.json");
+  const pkg = JSON.parse(await FS3.readFile(pkgPath, "utf-8"));
   if (!pkg.private) {
     console.warn("\u26A0\uFE0F  WARNING: Root package.json is not private - this could lead to accidental publishing of development package.json");
     console.warn("   Consider setting 'private: true' in your root package.json");
   }
-  const gitignorePath = Path2.join(cwd, ".gitignore");
+  const gitignorePath = Path3.join(cwd, ".gitignore");
   if (await fileExists(gitignorePath)) {
-    const gitignoreContent = await FS2.readFile(gitignorePath, "utf-8");
+    const gitignoreContent = await FS3.readFile(gitignorePath, "utf-8");
     const isDistIgnored = gitignoreContent.includes("dist/") || gitignoreContent.includes("/dist") || gitignoreContent.includes("dist\n") || gitignoreContent.includes("dist\r\n");
     if (!isDistIgnored) {
       console.warn("\u26A0\uFE0F  WARNING: dist/ directory is not in .gitignore - built files should not be committed");
       console.warn("   Add 'dist/' to your .gitignore file");
     }
   }
-  const entries = await findEntryPoints(srcDir);
+  const entries = await findEntrypoints(srcDir);
   if (entries.length === 0) {
     throw new Error("No entry points found in src/");
   }
@@ -490,23 +647,40 @@ async function build2(cwd, save = false) {
       umd: entries.includes("umd")
     }
   };
-  const mainEntry = await detectMainEntry(pkg, entries);
-  console.log("  Found entries:", entries.join(", "));
-  console.log("  Main entry:", mainEntry);
+  const mainEntry = detectMainEntry(pkg, entries);
+  console.info("  Found entries:", entries.join(", "));
+  console.info("  Main entry:", mainEntry);
   if (options.formats.cjs) {
-    console.log("  Formats: ESM, CJS" + (options.formats.umd ? ", UMD" : ""));
+    console.info("  Formats: ESM, CJS" + (options.formats.umd ? ", UMD" : ""));
   } else {
-    console.log("  Formats: ESM" + (options.formats.umd ? ", UMD" : "") + " (no main field - CJS disabled)");
+    console.info("  Formats: ESM" + (options.formats.umd ? ", UMD" : "") + " (no main field - CJS disabled)");
   }
-  if (await fileExists(distDir)) {
-    await FS2.rm(distDir, { recursive: true });
+  const tempDistDir = `${distDir}.tmp.${Date.now()}.${Math.random().toString(36).substr(2, 9)}`;
+  try {
+    await FS3.mkdir(tempDistDir, { recursive: true });
+    if (await fileExists(distDir)) {
+      await FS3.rm(distDir, { recursive: true });
+    }
+    await FS3.rename(tempDistDir, distDir);
+  } catch (error) {
+    try {
+      if (await fileExists(tempDistDir)) {
+        await FS3.rm(tempDistDir, { recursive: true });
+      }
+    } catch {
+    }
+    throw error;
   }
-  await FS2.mkdir(distDir, { recursive: true });
+  const externalDeps = [
+    ...Object.keys(pkg.dependencies || {}),
+    ...Object.keys(pkg.peerDependencies || {}),
+    ...Object.keys(pkg.optionalDependencies || {})
+  ];
   const entryPoints = [];
   const umdEntries = [];
   for (const entry of entries) {
-    const entryPath = Path2.join(srcDir, `${entry}.ts`);
-    const jsEntryPath = Path2.join(srcDir, `${entry}.js`);
+    const entryPath = Path3.join(srcDir, `${entry}.ts`);
+    const jsEntryPath = Path3.join(srcDir, `${entry}.js`);
     const actualPath = await fileExists(entryPath) ? entryPath : jsEntryPath;
     if (!await fileExists(actualPath)) {
       throw new Error(`Entry point file not found: ${actualPath}. Expected ${entry}.ts or ${entry}.js in src/ directory.`);
@@ -518,105 +692,75 @@ async function build2(cwd, save = false) {
     }
   }
   if (entryPoints.length > 0) {
-    console.log(`  Building ${entryPoints.length} entries (ESM)...`);
+    const entryNames = entryPoints.map((path) => {
+      const name = Path3.basename(path, Path3.extname(path));
+      return name;
+    });
+    console.info(`  Building ${entryPoints.length} entries (ESM)...`);
     await ESBuild.build({
       entryPoints,
       outdir: distSrcDir,
       format: "esm",
-      entryNames: "[name]",
       outExtension: { ".js": ".js" },
       bundle: true,
-      splitting: true,
-      // Enable shared chunk extraction
       minify: false,
-      sourcemap: true,
-      external: Object.keys(pkg.dependencies || {}),
+      sourcemap: false,
+      external: externalDeps,
       platform: "node",
-      target: "node16"
+      target: "node16",
+      plugins: [
+        externalEntrypointsPlugin({
+          entryNames,
+          outputExtension: ".js"
+        }),
+        dtsPlugin({
+          outDir: distSrcDir,
+          rootDir: srcDir,
+          entryPoints
+        })
+      ]
     });
     if (options.formats.cjs) {
-      console.log(`  Building ${entryPoints.length} entries (CJS)...`);
+      console.info(`  Building ${entryPoints.length} entries (CJS)...`);
       await ESBuild.build({
         entryPoints,
         outdir: distSrcDir,
         format: "cjs",
-        entryNames: "[name]",
         outExtension: { ".js": ".cjs" },
         bundle: true,
         minify: false,
-        sourcemap: true,
-        external: Object.keys(pkg.dependencies || {}),
+        sourcemap: false,
+        external: externalDeps,
         platform: "node",
-        target: "node16"
-        // Note: CJS doesn't support splitting, but building together still helps with consistency
+        target: "node16",
+        plugins: [
+          externalEntrypointsPlugin({
+            entryNames,
+            outputExtension: ".cjs"
+          })
+        ]
       });
     }
   }
   for (const umdPath of umdEntries) {
-    const entry = Path2.basename(umdPath, Path2.extname(umdPath));
-    console.log(`  Building ${entry} (UMD)...`);
+    const entry = Path3.basename(umdPath, Path3.extname(umdPath));
+    console.info(`  Building ${entry} (UMD)...`);
     const globalName = pkg.name.includes("/") ? pkg.name.split("/").pop().replace(/-/g, "").charAt(0).toUpperCase() + pkg.name.split("/").pop().replace(/-/g, "").slice(1) : pkg.name.replace(/-/g, "").charAt(0).toUpperCase() + pkg.name.replace(/-/g, "").slice(1);
     await ESBuild.build({
       entryPoints: [umdPath],
       outdir: distSrcDir,
       format: "cjs",
-      entryNames: "[name]",
       bundle: true,
       minify: false,
-      sourcemap: true,
-      external: Object.keys(pkg.dependencies || {}),
+      sourcemap: false,
+      external: externalDeps,
       platform: "node",
       target: "node16",
       plugins: [umdPlugin({ globalName })]
     });
   }
-  console.log("  Generating TypeScript declarations...");
-  const allTsFiles = [...entryPoints, ...umdEntries].filter((file) => file.endsWith(".ts"));
-  if (allTsFiles.length > 0) {
-    const compilerOptions = {
-      declaration: true,
-      emitDeclarationOnly: true,
-      outDir: distSrcDir,
-      rootDir: srcDir,
-      skipLibCheck: true,
-      esModuleInterop: true,
-      target: TS.ScriptTarget.ES2020,
-      module: TS.ModuleKind.ESNext
-    };
-    const program = TS.createProgram(allTsFiles, compilerOptions);
-    const emitResult = program.emit();
-    if (emitResult.diagnostics.length > 0) {
-      const diagnostics = TS.formatDiagnosticsWithColorAndContext(emitResult.diagnostics, {
-        getCanonicalFileName: (path) => path,
-        getCurrentDirectory: () => cwd,
-        getNewLine: () => "\n"
-      });
-      throw new Error(`TypeScript declaration generation failed:
-${diagnostics}`);
-    }
-  }
-  for (const entry of entries) {
-    if (entry === "umd")
-      continue;
-    const jsPath = Path2.join(distSrcDir, `${entry}.js`);
-    const dtsPath = Path2.join(distSrcDir, `${entry}.d.ts`);
-    if (await fileExists(jsPath) && await fileExists(dtsPath)) {
-      const content = await FS2.readFile(jsPath, "utf-8");
-      if (content.startsWith("#!")) {
-        const lines = content.split("\n");
-        const shebang = lines[0];
-        const rest = lines.slice(1).join("\n");
-        await FS2.writeFile(jsPath, `${shebang}
-/// <reference types="./${entry}.d.ts" />
-${rest}`);
-      } else {
-        await FS2.writeFile(jsPath, `/// <reference types="./${entry}.d.ts" />
-${content}`);
-      }
-    }
-  }
   const autoDiscoveredFiles = [];
-  console.log("  Generating package.json...");
+  console.info("  Generating package.json...");
   const cleanedPkg = cleanPackageJSON(pkg, mainEntry, options);
   const exportsResult = generateExports(entries, mainEntry, options, pkg.exports);
   cleanedPkg.exports = fixExportsForDist(exportsResult.exports);
@@ -626,7 +770,7 @@ ${content}`);
       console.warn(`   - ${staleExport}`);
     }
     if (save) {
-      console.log("   Removing stale exports from root package.json (--save mode)");
+      console.info("   Removing stale exports from root package.json (--save mode)");
     } else {
       console.warn("   Use --save to remove these from root package.json");
     }
@@ -639,62 +783,71 @@ ${content}`);
     }
   }
   const fixedDistPkg = fixExportsForDist(cleanedPkg);
-  await FS2.writeFile(
-    Path2.join(distDir, "package.json"),
+  await FS3.writeFile(
+    Path3.join(distDir, "package.json"),
     JSON.stringify(fixedDistPkg, null, 2) + "\n"
   );
   const defaultFilesToCopy = ["README.md", "LICENSE", "CHANGELOG.md"];
   for (const file of defaultFilesToCopy) {
-    const srcPath = Path2.join(cwd, file);
+    const srcPath = Path3.join(cwd, file);
     if (await fileExists(srcPath)) {
-      console.log(`  Copying ${file}...`);
-      await FS2.copyFile(srcPath, Path2.join(distDir, file));
+      console.info(`  Copying ${file}...`);
+      await FS3.copyFile(srcPath, Path3.join(distDir, file));
     }
   }
   const commonFiles = ["README.md", "LICENSE", "CHANGELOG.md", "COPYING", "AUTHORS"];
   if (pkg.files && Array.isArray(pkg.files)) {
     for (const commonFile of commonFiles) {
-      const commonPath = Path2.join(cwd, commonFile);
+      const commonPath = Path3.join(cwd, commonFile);
       if (await fileExists(commonPath) && !pkg.files.includes(commonFile)) {
-        console.log(`  Auto-discovered ${commonFile}, adding to files field...`);
+        console.info(`  Auto-discovered ${commonFile}, adding to files field...`);
         pkg.files.push(commonFile);
         autoDiscoveredFiles.push(commonFile);
       }
     }
   }
   if (pkg.files && Array.isArray(pkg.files)) {
-    console.log("  Copying files from package.json files field...");
+    console.info("  Copying files from package.json files field...");
     for (const pattern of pkg.files) {
       if (typeof pattern === "string" && (pattern.includes("src") || pattern.includes("dist"))) {
         continue;
       }
       if (typeof pattern === "string") {
-        const srcPath = Path2.join(cwd, pattern);
-        const destPath = Path2.join(distDir, pattern);
-        if (await fileExists(srcPath)) {
-          const stat2 = await FS2.stat(srcPath);
+        const validatedSrcPath = validatePath(pattern, cwd);
+        const validatedDestPath = validatePath(pattern, distDir);
+        if (await fileExists(validatedSrcPath)) {
+          const stat2 = await FS3.stat(validatedSrcPath);
+          if (stat2.isSymbolicLink()) {
+            throw new Error(`Symbolic links are not allowed in files field: ${pattern}`);
+          }
           if (stat2.isDirectory()) {
-            console.log(`  Copying directory ${pattern}/...`);
-            await FS2.mkdir(Path2.dirname(destPath), { recursive: true });
-            await FS2.cp(srcPath, destPath, { recursive: true });
+            console.info(`  Copying directory ${pattern}/...`);
+            await FS3.mkdir(Path3.dirname(validatedDestPath), { recursive: true });
+            await FS3.cp(validatedSrcPath, validatedDestPath, { recursive: true });
+          } else if (stat2.isFile()) {
+            console.info(`  Copying ${pattern}...`);
+            await FS3.mkdir(Path3.dirname(validatedDestPath), { recursive: true });
+            await FS3.copyFile(validatedSrcPath, validatedDestPath);
           } else {
-            console.log(`  Copying ${pattern}...`);
-            await FS2.mkdir(Path2.dirname(destPath), { recursive: true });
-            await FS2.copyFile(srcPath, destPath);
+            throw new Error(`Unsupported file type for ${pattern}. Only regular files and directories are allowed.`);
           }
         } else if (pattern.includes("*")) {
           const baseDir = pattern.split("*")[0].replace(/\/$/, "");
-          if (baseDir && await fileExists(Path2.join(cwd, baseDir))) {
-            console.log(`  Copying pattern ${pattern}...`);
-            const baseSrcPath = Path2.join(cwd, baseDir);
-            const baseDestPath = Path2.join(distDir, baseDir);
-            await FS2.mkdir(Path2.dirname(baseDestPath), { recursive: true });
-            await FS2.cp(baseSrcPath, baseDestPath, { recursive: true });
+          if (baseDir) {
+            const validatedBaseSrcPath = validatePath(baseDir, cwd);
+            const validatedBaseDestPath = validatePath(baseDir, distDir);
+            if (await fileExists(validatedBaseSrcPath)) {
+              console.info(`  Copying pattern ${pattern}...`);
+              await FS3.mkdir(Path3.dirname(validatedBaseDestPath), { recursive: true });
+              await FS3.cp(validatedBaseSrcPath, validatedBaseDestPath, { recursive: true });
+            } else {
+              throw new Error(`Pattern base directory not found for "${pattern}". Expected directory: ${validatedBaseSrcPath}`);
+            }
           } else {
-            throw new Error(`Pattern base directory not found for "${pattern}". Expected directory: ${Path2.join(cwd, baseDir)}`);
+            throw new Error(`Invalid pattern "${pattern}". Pattern must have a base directory before the wildcard.`);
           }
         } else {
-          throw new Error(`File specified in files field not found: ${srcPath}. Remove "${pattern}" from package.json files field or create the file.`);
+          throw new Error(`File specified in files field not found: ${validatedSrcPath}. Remove "${pattern}" from package.json files field or create the file.`);
         }
       } else {
         throw new Error(`Invalid files field entry: ${JSON.stringify(pattern)}. Files field entries must be strings.`);
@@ -702,7 +855,7 @@ ${content}`);
     }
   }
   if (save) {
-    console.log("  Updating root package.json...");
+    console.info("  Updating root package.json...");
     const rootPkg2 = { ...pkg };
     rootPkg2.private = true;
     if (options.formats.cjs) {
@@ -711,7 +864,7 @@ ${content}`);
     rootPkg2.module = `./dist/src/${mainEntry}.js`;
     rootPkg2.types = `./dist/src/${mainEntry}.d.ts`;
     if (rootPkg2.typings && typeof rootPkg2.typings === "string") {
-      rootPkg2.typings = rootPkg2.typings.startsWith("./dist/") ? rootPkg2.typings : "./" + Path2.join("dist", rootPkg2.typings);
+      rootPkg2.typings = rootPkg2.typings.startsWith("./dist/") ? rootPkg2.typings : "./" + Path3.join("dist", rootPkg2.typings);
     }
     const rootExports = {};
     for (const [key, value] of Object.entries(cleanedPkg.exports)) {
@@ -730,12 +883,20 @@ ${content}`);
     if (rootPkg2.bin) {
       if (typeof rootPkg2.bin === "string") {
         if (!rootPkg2.bin.startsWith("./dist/")) {
-          rootPkg2.bin = "./" + Path2.join("dist", rootPkg2.bin);
+          if (rootPkg2.bin.startsWith("dist/")) {
+            rootPkg2.bin = "./" + rootPkg2.bin;
+          } else {
+            rootPkg2.bin = "./" + Path3.join("dist", rootPkg2.bin);
+          }
         }
       } else {
         for (const [name, binPath] of Object.entries(rootPkg2.bin)) {
           if (typeof binPath === "string" && !binPath.startsWith("./dist/")) {
-            rootPkg2.bin[name] = "./" + Path2.join("dist", binPath);
+            if (binPath.startsWith("dist/")) {
+              rootPkg2.bin[name] = "./" + binPath;
+            } else {
+              rootPkg2.bin[name] = "./" + Path3.join("dist", binPath);
+            }
           }
         }
       }
@@ -755,51 +916,52 @@ ${content}`);
         rootPkg2.files.push("dist/");
       }
     }
-    await FS2.writeFile(pkgPath, JSON.stringify(rootPkg2, null, 2) + "\n");
+    await FS3.writeFile(pkgPath, JSON.stringify(rootPkg2, null, 2) + "\n");
   } else {
-    console.log("  Skipping root package.json update (use --save to enable)");
+    console.info("  Skipping root package.json update (use --save to enable)");
   }
-  console.log("\nBuild complete!");
-  console.log(`
+  console.info("\nBuild complete!");
+  console.info(`
   Output: ${distDir}`);
-  console.log(`
+  console.info(`
   Entries: ${entries.length}`);
   if (options.formats.cjs) {
-    console.log(`
+    console.info(`
   Formats: ESM, CJS${options.formats.umd ? ", UMD" : ""}`);
   } else {
-    console.log(`
+    console.info(`
   Formats: ESM${options.formats.umd ? ", UMD" : ""}`);
   }
   let rootPkg = pkg;
   if (save) {
-    rootPkg = JSON.parse(await FS2.readFile(pkgPath, "utf-8"));
+    rootPkg = JSON.parse(await FS3.readFile(pkgPath, "utf-8"));
   }
   return { distPkg: fixedDistPkg, rootPkg };
 }
-async function publish(cwd, save = true) {
+async function publish(cwd, save = true, extraArgs = []) {
   await build2(cwd, save);
-  console.log("\nPublishing to npm...");
-  const distDir = Path2.join(cwd, "dist");
-  const distPkgPath = Path2.join(distDir, "package.json");
+  console.info("\nPublishing to npm...");
+  const distDir = Path3.join(cwd, "dist");
+  const distPkgPath = Path3.join(distDir, "package.json");
   if (!await fileExists(distPkgPath)) {
     throw new Error("No dist/package.json found. Run 'libuild build' first.");
   }
-  const distPkg = JSON.parse(await FS2.readFile(distPkgPath, "utf-8"));
+  const distPkg = JSON.parse(await FS3.readFile(distPkgPath, "utf-8"));
   const publishArgs = ["publish"];
   if (distPkg.name.startsWith("@")) {
     publishArgs.push("--access", "public");
   }
+  publishArgs.push(...extraArgs);
   const proc = (0, import_child_process.spawn)("npm", publishArgs, {
     cwd: distDir,
     stdio: "inherit"
   });
-  const exitCode = await new Promise((resolve) => {
-    proc.on("close", resolve);
+  const exitCode = await new Promise((resolve3) => {
+    proc.on("close", resolve3);
   });
   if (exitCode === 0) {
-    const distPkg2 = JSON.parse(await FS2.readFile(distPkgPath, "utf-8"));
-    console.log(`
+    const distPkg2 = JSON.parse(await FS3.readFile(distPkgPath, "utf-8"));
+    console.info(`
 Published ${distPkg2.name}@${distPkg2.version}!`);
   } else {
     throw new Error("npm publish failed");
@@ -811,4 +973,3 @@ Published ${distPkg2.name}@${distPkg2.version}!`);
   publish,
   transformSrcToDist
 });
-//# sourceMappingURL=libuild.cjs.map