@base44/functions-compiler 0.1.0

package/lib/src/deno-bundle.js

@@ -0,0 +1,146 @@
+/**
+ * Bundle engine. Compiles a prepared worker tree (user files + injected shim +
+ * generated entry) into a single workerd ESM module using Deno's own resolver
+ * via the `deno-resolver` adapter over `@deno/loader`: `npm:`, `jsr:`, and
+ * `https:` specifiers resolve exactly as Deno resolves them (multiple versions,
+ * nested deps, correct exports).
+ *
+ * The loader reads source from a real filesystem, so the tree is materialized
+ * into a per-request temp dir, compiled, and removed. `node:` builtins stay
+ * external (workerd's `nodejs_compat` provides them) and `cloudflare:*` stays
+ * external (provided by the runtime).
+ */
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { build } from "esbuild";
+import { denoResolverPlugin } from "./esbuild/deno-resolver.js";
+import { nodeBuiltinRequirePlugin } from "./esbuild/node-builtin-require.js";
+import { privateDataSourcesVirtualPlugin } from "./esbuild/private-data-sources-virtual.js";
+import { runtimeContextVirtualPlugin } from "./esbuild/runtime-context-virtual.js";
+import { runtimeVirtualPlugin } from "./esbuild/runtime-virtual.js";
+import { USER_NAMESPACE, userFilesPlugin } from "./esbuild/user-files.js";
+/**
+ * Compile `prepared` to a single ESM module string. Resolution/compile failures
+ * (user-attributable) return `{ ok: false }`; infrastructure failures (temp dir,
+ * missing output) throw.
+ */
+export async function bundleToModule(prepared, nodeModulesDir = "none") {
+    const dir = await mkdtemp(path.join(tmpdir(), "b44-bundle-"));
+    try {
+        // Only deno.json (the loader's config) and the materialized node_modules
+        // touch disk — user source is served from memory by userFilesPlugin, so a
+        // malicious import can't traverse to another build's files.
+        await writeFile(path.join(dir, "deno.json"), JSON.stringify({ nodeModulesDir }));
+        let result;
+        try {
+            result = await build({
+                entryPoints: [prepared.entry],
+                absWorkingDir: dir,
+                bundle: true,
+                write: false,
+                format: "esm",
+                platform: "browser",
+                target: "es2022",
+                // "node" is active because workerd runs with nodejs_compat: packages
+                // like unicorn-magic gate their full API behind the "node" exports
+                // condition and ship a stripped default entry, so without it consumers
+                // (npm-run-path) import names that don't exist and the bundle fails.
+                // Conditions are a set — when a package lists both "workerd" and
+                // "node", its own exports-map key order still decides which wins.
+                conditions: ["workerd", "worker", "browser", "module", "node"],
+                external: ["cloudflare:*"],
+                // workerd ESM lacks __dirname/__filename; define rewrites only free refs
+                // (npm/Emscripten glue), leaving loader-bound CJS locals intact.
+                define: { __dirname: '"/"', __filename: '"/index.js"' },
+                minify: true,
+                sourcemap: false,
+                // Errors are surfaced structurally (return value / BuildFailure); keep
+                // esbuild from dumping diagnostics to the service's stderr.
+                logLevel: "silent",
+                plugins: [
+                    // CJS require() of a node builtin → static re-export (workerd throws
+                    // on esbuild's lowered __require). Runs before the Deno resolver.
+                    nodeBuiltinRequirePlugin(),
+                    userFilesPlugin(prepared.files, prepared.entry),
+                    privateDataSourcesVirtualPlugin(),
+                    runtimeContextVirtualPlugin(),
+                    runtimeVirtualPlugin(),
+                    denoResolverPlugin({ configPath: path.join(dir, "deno.json") }),
+                ],
+            });
+        }
+        catch (e) {
+            const errors = buildFailureErrors(e, dir);
+            if (errors)
+                return { ok: false, errors };
+            throw e;
+        }
+        const outputs = result.outputFiles ?? [];
+        if (outputs.length !== 1) {
+            // bundle:true with code-splitting off yields exactly one module; anything
+            // else means a plugin claimed the entry or emitted extra files — a bug.
+            throw new Error(`expected single-module output, got ${outputs.length} file(s)`);
+        }
+        return {
+            ok: true,
+            module: outputs[0].text,
+            warnings: result.warnings.map((w) => w.text),
+        };
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+}
+/** Flatten an esbuild `BuildFailure` into compile diagnostics, rewriting the
+ *  temp-dir-absolute file paths back to the paths the user typed. Returns null
+ *  if `e` is not an esbuild failure (so the caller rethrows it). */
+function buildFailureErrors(e, dir) {
+    if (typeof e !== "object" || e === null || !("errors" in e))
+        return null;
+    const raw = e.errors;
+    if (!Array.isArray(raw))
+        return null;
+    return raw.map((m) => normalizeError(m, dir));
+}
+function normalizeError(m, dir) {
+    const message = m.text ?? "bundle error";
+    const item = { message };
+    // The Deno loader transpiles before esbuild sees the source, so a syntax
+    // error's real location lives in the message text
+    // (`… at file:///<abs>/main.ts:LINE:COL`) while esbuild's structured
+    // `location` points at the importing entry. Prefer the embedded one so the
+    // diagnostic points at the user's file.
+    const embedded = message.match(/file:\/\/(\/[^\s:]+):(\d+):(\d+)/);
+    if (embedded) {
+        item.file = relativizeFile(embedded[1], dir);
+        item.line = Number(embedded[2]);
+        item.column = Number(embedded[3]);
+    }
+    const loc = m.location;
+    if (item.file === undefined && loc?.file) {
+        item.file = relativizeFile(loc.file, dir);
+    }
+    if (item.line === undefined && typeof loc?.line === "number") {
+        item.line = loc.line;
+    }
+    if (item.column === undefined && typeof loc?.column === "number") {
+        item.column = loc.column;
+    }
+    if (loc?.lineText)
+        item.lineText = loc.lineText;
+    if (loc?.suggestion)
+        item.suggestion = loc.suggestion;
+    return item;
+}
+/** Normalize the file in a diagnostic to the path the user typed. User files are
+ *  virtual keys esbuild prefixes with the namespace (`user:main.ts`); deps are
+ *  temp-dir-absolute (`<dir>/node_modules/foo/…`). Strip either prefix. */
+function relativizeFile(file, dir) {
+    if (file.startsWith(`${USER_NAMESPACE}:`)) {
+        return file.slice(USER_NAMESPACE.length + 1);
+    }
+    const prefix = dir.endsWith(path.sep) ? dir : dir + path.sep;
+    return file.startsWith(prefix) ? file.slice(prefix.length) : file;
+}
+//# sourceMappingURL=deno-bundle.js.map

package/lib/src/deno-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deno-bundle.js","sourceRoot":"","sources":["../../src/deno-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAqB,KAAK,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC5F,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAW1E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAwB,EACxB,iBAAkC,MAAM;IAExC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,yEAAyE;QACzE,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAC3B,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC,CACnC,CAAC;QAEF,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC;gBACnB,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC7B,aAAa,EAAE,GAAG;gBAClB,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK;gBACb,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,QAAQ;gBAChB,qEAAqE;gBACrE,mEAAmE;gBACnE,uEAAuE;gBACvE,qEAAqE;gBACrE,iEAAiE;gBACjE,kEAAkE;gBAClE,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC;gBAC9D,QAAQ,EAAE,CAAC,cAAc,CAAC;gBAC1B,yEAAyE;gBACzE,iEAAiE;gBACjE,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE;gBACvD,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,KAAK;gBAChB,uEAAuE;gBACvE,4DAA4D;gBAC5D,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE;oBACP,qEAAqE;oBACrE,kEAAkE;oBAClE,wBAAwB,EAAE;oBAC1B,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;oBAC/C,+BAA+B,EAAE;oBACjC,2BAA2B,EAAE;oBAC7B,oBAAoB,EAAE;oBACtB,kBAAkB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;iBAChE;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACzC,MAAM,CAAC,CAAC;QACV,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,0EAA0E;YAC1E,wEAAwE;YACxE,MAAM,IAAI,KAAK,CACb,sCAAsC,OAAO,CAAC,MAAM,UAAU,CAC/D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAC7C,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;oEAEoE;AACpE,SAAS,kBAAkB,CAAC,CAAU,EAAE,GAAW;IACjD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,GAAG,GAAI,CAAkB,CAAC,MAAM,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CACrB,CAAwC,EACxC,GAAW;IAEX,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,cAAc,CAAC;IACzC,MAAM,IAAI,GAAoB,EAAE,OAAO,EAAE,CAAC;IAE1C,yEAAyE;IACzE,kDAAkD;IAClD,qEAAqE;IACrE,2EAA2E;IAC3E,wCAAwC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACnE,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,CAAC,QAMN,CAAC;IACT,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,IAAI,GAAG,EAAE,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAChD,IAAI,GAAG,EAAE,UAAU;QAAE,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;2EAE2E;AAC3E,SAAS,cAAc,CAAC,IAAY,EAAE,GAAW;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAC7D,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC"}

package/lib/src/errors.d.ts

@@ -0,0 +1,16 @@
+/** A user-code problem the bundler can't translate; `file` is attached to the
+ *  diagnostic when known. Surfaced to the caller as an `ok:false` compile error. */
+export declare class DenoCompatError extends Error {
+    readonly file?: string;
+    constructor(message: string, file?: string);
+}
+/** One flattened compile diagnostic. Shape is part of the HTTP contract — the
+ *  Python `BundlerClient` and the builder agent read these fields. */
+export interface BundleErrorItem {
+    message: string;
+    file?: string;
+    line?: number;
+    column?: number;
+    lineText?: string;
+    suggestion?: string;
+}

package/lib/src/errors.js

@@ -0,0 +1,11 @@
+/** A user-code problem the bundler can't translate; `file` is attached to the
+ *  diagnostic when known. Surfaced to the caller as an `ok:false` compile error. */
+export class DenoCompatError extends Error {
+    file;
+    constructor(message, file) {
+        super(message);
+        this.name = "DenoCompatError";
+        this.file = file;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/lib/src/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;oFACoF;AACpF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAU;IACvB,YAAY,OAAe,EAAE,IAAa;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/lib/src/esbuild/deno-resolver.d.ts

@@ -0,0 +1,26 @@
+/**
+ * esbuild resolver/loader over `@deno/loader` (Deno's own resolver crates,
+ * compiled to WASM). A thin in-repo adapter — the published
+ * `@deno/esbuild-plugin` is the same idea, but it throws the build away on
+ * unresolved *optional* dependencies and reports transpile errors against the
+ * importer. We own the glue so we can fix both:
+ *
+ *   - Optional deps that aren't installed are left external (the import survives
+ *     to runtime, where the author's try/catch handles the miss) instead of
+ *     failing the bundle. This covers declared optional deps such as axios's
+ *     `follow-redirects` -> `debug` and undeclared guarded requires such as
+ *     mysql2 -> `cardinal`, matching the old resolver's leniency.
+ *   - Transpile/syntax errors are reported with the offending file + position,
+ *     not the importing entry.
+ *
+ * The heavy lifting (npm/jsr/https resolution, multi-version, exports maps) stays
+ * in `@deno/loader`.
+ */
+import type { Plugin } from "esbuild";
+interface DenoResolverOptions {
+    /** Path to the deno.json controlling resolution (we write one per bundle with
+     *  `nodeModulesDir: auto` so the loader auto-fetches npm deps under Node). */
+    configPath?: string;
+}
+export declare function denoResolverPlugin(options?: DenoResolverOptions): Plugin;
+export {};

package/lib/src/esbuild/deno-resolver.js

@@ -0,0 +1,436 @@
+/**
+ * esbuild resolver/loader over `@deno/loader` (Deno's own resolver crates,
+ * compiled to WASM). A thin in-repo adapter — the published
+ * `@deno/esbuild-plugin` is the same idea, but it throws the build away on
+ * unresolved *optional* dependencies and reports transpile errors against the
+ * importer. We own the glue so we can fix both:
+ *
+ *   - Optional deps that aren't installed are left external (the import survives
+ *     to runtime, where the author's try/catch handles the miss) instead of
+ *     failing the bundle. This covers declared optional deps such as axios's
+ *     `follow-redirects` -> `debug` and undeclared guarded requires such as
+ *     mysql2 -> `cardinal`, matching the old resolver's leniency.
+ *   - Transpile/syntax errors are reported with the offending file + position,
+ *     not the importing entry.
+ *
+ * The heavy lifting (npm/jsr/https resolution, multi-version, exports maps) stays
+ * in `@deno/loader`.
+ */
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { isBuiltin } from "node:module";
+import { homedir } from "node:os";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { MediaType, RequestedModuleType, ResolutionMode, ResolveError, Workspace, } from "@deno/loader";
+import { logEvent } from "../log.js";
+import { USER_NAMESPACE } from "./user-files.js";
+// Schemes the loader resolves to; each becomes an esbuild namespace so imports
+// inside a loaded module re-enter resolution with the scheme as context.
+const NAMESPACES = ["file", "http", "https", "data", "npm", "jsr"];
+// We also resolve imports *from* in-memory user files (served by the user-files
+// plugin) but never load them — that plugin owns their contents.
+const RESOLVE_NAMESPACES = [...NAMESPACES, USER_NAMESPACE];
+export function denoResolverPlugin(options = {}) {
+    return {
+        name: "deno-resolver",
+        async setup(build) {
+            // Security: stop a dependency or data: module from reading host files.
+            // Allow file: reads only from where deps live — the global cache, or this
+            // build's temp node_modules in "auto" mode — and resolve symlinks first so
+            // a crafted link can't point out of those folders.
+            const baseDir = options.configPath
+                ? path.dirname(options.configPath)
+                : undefined;
+            const depRoots = [denoCacheRoot(), baseDir]
+                .filter((d) => Boolean(d))
+                .map(canonicalPath);
+            const pathUnderDeps = (absPath) => {
+                const p = canonicalPath(absPath);
+                return depRoots.some((root) => {
+                    const rel = path.relative(root, p);
+                    return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+                });
+            };
+            const workspace = new Workspace({
+                platform: "browser",
+                nodeConditions: build.initialOptions.conditions,
+                configPath: options.configPath,
+            });
+            const dispose = (createdLoader) => {
+                createdLoader?.[Symbol.dispose]?.();
+                workspace[Symbol.dispose]?.();
+            };
+            let loader;
+            try {
+                // createLoader() is async and can reject; the WASM can also trap with
+                // "unreachable" (a Rust panic in the loader). esbuild does NOT run
+                // onDispose for a setup() that rejected, so on any failure here we must
+                // dispose the Workspace ourselves — otherwise its WASM allocation stays
+                // resident in the still-alive worker until GC.
+                loader = await workspace.createLoader();
+            }
+            catch (err) {
+                dispose();
+                logEvent("error", "base44.bundler.workspace_disposed_on_setup_failure", {
+                    phase: "create_loader",
+                    wasm_trap: errMessage(err) === "unreachable",
+                });
+                throw err;
+            }
+            build.onDispose(() => dispose(loader));
+            const externals = (build.initialOptions.external ?? []).map(toRegex);
+            const onResolve = async (args) => {
+                // node: builtins (and configured externals) stay external — workerd's
+                // nodejs_compat provides the builtins. require()-of-builtin is claimed
+                // earlier by node-builtin-require, so this is the import-kind path.
+                if (isBuiltin(args.path) ||
+                    externals.some((re) => re.test(args.path))) {
+                    return { path: args.path, external: true };
+                }
+                const mode = args.kind === "require-call" || args.kind === "require-resolve"
+                    ? ResolutionMode.Require
+                    : ResolutionMode.Import;
+                const importer = args.namespace === USER_NAMESPACE && baseDir
+                    ? path.join(baseDir, args.importer)
+                    : args.importer;
+                try {
+                    const resolved = await loader.resolve(args.path, importer, mode);
+                    // A non-builtin specifier that still resolves to a builtin (rare) —
+                    // externalize it like any other node: import.
+                    if (resolved.startsWith("node:")) {
+                        return { path: resolved, external: true };
+                    }
+                    if (resolved.startsWith("file:") &&
+                        !pathUnderDeps(fileURLToPath(resolved))) {
+                        return { errors: [fileOutsideCacheError(args.path)] };
+                    }
+                    return toEsbuildPath(resolved);
+                }
+                catch (err) {
+                    // DELTA: an uninstalled *optional* dependency is not a build failure.
+                    // Leave it external so the import survives to runtime (where the
+                    // author's try/catch turns the missing module into a no-op).
+                    if (isOptionalDependency(err)) {
+                        return { path: args.path, external: true };
+                    }
+                    // Restore the main/module lookup the loader skips (see
+                    // resolveEntryFromPackageJson). Before the externalize branch: a
+                    // resolvable package must be bundled, not left as a broken require().
+                    const fallbackUrl = resolveEntryFromPackageJson(err, args.path, mode, pathUnderDeps);
+                    if (fallbackUrl) {
+                        logEvent("info", "base44.bundler.package_entry_fallback", {
+                            specifier: args.path,
+                        });
+                        if (fallbackUrl.startsWith("file:") &&
+                            !pathUnderDeps(fileURLToPath(fallbackUrl))) {
+                            return { errors: [fileOutsideCacheError(args.path)] };
+                        }
+                        return toEsbuildPath(fallbackUrl);
+                    }
+                    // Some published packages guard undeclared optional deps with
+                    // try/catch instead of listing them in package.json. The loader
+                    // cannot identify those as optional, so preserve the old resolver's
+                    // runtime fallback only for catchable references originating inside
+                    // deps. `dynamic-import` is the ESM spelling of the same guarded
+                    // pattern (`await import("x")`, often tagged webpackIgnore/
+                    // @vite-ignore — pragmas esbuild does not honor). Static imports must
+                    // still fail the build.
+                    //
+                    // Two shapes of "package not found": a typed ResolveError with
+                    // ERR_MODULE_NOT_FOUND, or a bare Error reading "Could not find
+                    // package X from referrer Y" (what @mastra/core -> @ast-grep/napi
+                    // hits — neither the type nor the code). Match exactly those; other
+                    // ResolveError codes (exports-map, version conflicts) must keep
+                    // failing the build with their attributed diagnostic.
+                    if ((isMissingDependency(err) ||
+                        MISSING_PACKAGE.test(errMessage(err))) &&
+                        (args.kind === "require-call" ||
+                            args.kind === "require-resolve" ||
+                            args.kind === "dynamic-import") &&
+                        isBareSpecifier(args.path) &&
+                        args.namespace !== USER_NAMESPACE &&
+                        pathUnderDeps(importer)) {
+                        logEvent("info", "base44.bundler.undeclared_optional_externalized", {
+                            specifier: args.path,
+                            referrer_package: packageFromImporter(importer),
+                        });
+                        return { path: args.path, external: true };
+                    }
+                    // These mean "genuinely not a dependency" — let esbuild report a
+                    // normal "could not resolve" error with the importer location.
+                    if (NOT_A_DEP.test(errMessage(err))) {
+                        return null;
+                    }
+                    throw err;
+                }
+            };
+            build.onResolve({ filter: /.*/ }, onResolve);
+            for (const namespace of RESOLVE_NAMESPACES) {
+                build.onResolve({ filter: /.*/, namespace }, onResolve);
+            }
+            const onLoad = async (args) => {
+                // Defense in depth if a file: path slips past onResolve.
+                if (args.namespace === "file" && !pathUnderDeps(args.path)) {
+                    return { errors: [fileOutsideCacheError(args.path)] };
+                }
+                const url = isUrlScheme(args.path)
+                    ? args.path
+                    : pathToFileURL(args.path).toString();
+                try {
+                    const res = await loader.load(url, moduleType(args));
+                    if (res.kind === "external") {
+                        return undefined;
+                    }
+                    return { contents: res.code, loader: mediaToLoader(res.mediaType) };
+                }
+                catch (err) {
+                    // DELTA: the loader transpiles here, so syntax errors surface as a
+                    // throw. Report a located error against the file being loaded rather
+                    // than letting esbuild attribute it to the importing entry.
+                    //
+                    // A WASM "unreachable" trap (a Rust panic in @deno/loader) also
+                    // surfaces here as a throw and would otherwise be indistinguishable
+                    // from a user syntax error — swallowed into a compile_error and never
+                    // counted as a trap. Emit an observability signal for it (the
+                    // onResolve path rethrows, so resolve-phase traps already surface as
+                    // base44.bundler.crash with wasm_trap:true) while keeping the
+                    // user-facing located-error return unchanged.
+                    if (errMessage(err) === "unreachable") {
+                        logEvent("error", "base44.bundler.load_wasm_trap", {
+                            phase: "load",
+                        });
+                    }
+                    return { errors: [locatedError(err, args.path)] };
+                }
+            };
+            for (const namespace of NAMESPACES) {
+                build.onLoad({ filter: /.*/, namespace }, onLoad);
+            }
+        },
+    };
+}
+function toEsbuildPath(resolved) {
+    if (resolved.startsWith("file:")) {
+        return { path: fileURLToPath(resolved), namespace: "file" };
+    }
+    for (const scheme of ["http", "https", "data", "npm", "jsr"]) {
+        if (resolved.startsWith(`${scheme}:`)) {
+            return { path: resolved, namespace: scheme };
+        }
+    }
+    return { path: resolved };
+}
+function isUrlScheme(p) {
+    return ["http:", "https:", "data:", "npm:", "jsr:"].some((s) => p.startsWith(s));
+}
+function moduleType(args) {
+    switch (args.with?.type) {
+        case "text":
+            return RequestedModuleType.Text;
+        case "bytes":
+            return RequestedModuleType.Bytes;
+        case "json":
+            return RequestedModuleType.Json;
+        default:
+            return args.path.endsWith(".json")
+                ? RequestedModuleType.Json
+                : RequestedModuleType.Default;
+    }
+}
+function mediaToLoader(type) {
+    switch (type) {
+        case MediaType.Jsx:
+            return "jsx";
+        case MediaType.Tsx:
+            return "tsx";
+        case MediaType.TypeScript:
+        case MediaType.Mts:
+        case MediaType.Cts:
+            return "ts";
+        case MediaType.Json:
+            return "json";
+        case MediaType.Css:
+            return "css";
+        case MediaType.Wasm:
+            return "binary";
+        case MediaType.JavaScript:
+        case MediaType.Mjs:
+        case MediaType.Cjs:
+            return "js";
+        default:
+            return "js";
+    }
+}
+// esbuild passes configured externals to plugins; match them here too.
+function toRegex(external) {
+    return new RegExp("^" +
+        external.replace(/[-/\\^$+?.()|[\]{}]/g, "\\$&").replace(/\*/g, ".*") +
+        "$");
+}
+const NOT_A_DEP = /not a dependency and not in import map|Relative import path ".*?" not prefixed with/;
+// An npm package the loader could not locate at all. Some shapes arrive as a
+// typed ResolveError; this family arrives as a bare Error carrying only text.
+const MISSING_PACKAGE = /Could not find package .*? from referrer/;
+function isBareSpecifier(specifier) {
+    return (!specifier.startsWith(".") &&
+        !specifier.startsWith("/") &&
+        !specifier.startsWith("#") &&
+        !specifier.includes("\\") &&
+        !/^[a-zA-Z][a-zA-Z\d+.-]*:/.test(specifier));
+}
+function packageFromImporter(importer) {
+    const parts = canonicalPath(importer).split(path.sep);
+    const nodeModulesIndex = parts.lastIndexOf("node_modules");
+    const registryIndex = parts.lastIndexOf("registry.npmjs.org");
+    const markerIndex = Math.max(nodeModulesIndex, registryIndex);
+    if (markerIndex < 0)
+        return undefined;
+    const packageIndex = markerIndex + 1;
+    const first = parts[packageIndex];
+    if (!first)
+        return undefined;
+    return first.startsWith("@") && parts[packageIndex + 1]
+        ? `${first}/${parts[packageIndex + 1]}`
+        : first;
+}
+function errMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+// Same wording as the user-files plugin so the message is consistent.
+function fileOutsideCacheError(spec) {
+    return {
+        text: `Cannot import "${spec}": filesystem imports are not allowed`,
+    };
+}
+// Where the loader caches npm; prod sets DENO_DIR, else Deno's per-OS default.
+function denoCacheRoot() {
+    if (process.env.DENO_DIR)
+        return path.resolve(process.env.DENO_DIR);
+    const home = homedir();
+    switch (process.platform) {
+        case "darwin":
+            return path.join(home, "Library", "Caches", "deno");
+        case "win32":
+            return path.join(process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local"), "deno");
+        default:
+            return path.join(process.env.XDG_CACHE_HOME ?? path.join(home, ".cache"), "deno");
+    }
+}
+// Resolve symlinks before the containment check so a link can't escape an
+// allowed root; fall back to the normalized path when it doesn't exist yet.
+function canonicalPath(p) {
+    try {
+        return realpathSync(path.resolve(p));
+    }
+    catch {
+        return path.resolve(p);
+    }
+}
+// `@deno/loader` sets `isOptionalDependency` on ResolveError when an optional
+// npm dependency can't be found (ERR_MODULE_NOT_FOUND).
+function isOptionalDependency(err) {
+    return err instanceof ResolveError && err.isOptionalDependency === true;
+}
+function isMissingDependency(err) {
+    return err instanceof ResolveError && err.code === "ERR_MODULE_NOT_FOUND";
+}
+function locatedError(err, file) {
+    const text = errMessage(err);
+    // The loader embeds the position in the message (`… :LINE:COL`).
+    const m = text.match(/:(\d+):(\d+)\b/);
+    return {
+        text,
+        location: m ? { file, line: Number(m[1]), column: Number(m[2]) } : { file },
+    };
+}
+const ENTRY_EXTENSIONS = [".js", ".mjs", ".cjs", ".json"];
+const INDEX_BASENAMES = ["index.js", "index.mjs", "index.cjs", "index.json"];
+function isFile(p) {
+    try {
+        return statSync(p).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/** Resolve a package.json entry (a module ID) as Node does: literal path, then
+ *  appended extensions, then directory index. Returns the file or null. */
+function resolveNodeEntry(pkgDir, entry) {
+    const target = path.resolve(pkgDir, entry);
+    if (isFile(target))
+        return target;
+    for (const ext of ENTRY_EXTENSIONS) {
+        if (isFile(target + ext))
+            return target + ext;
+    }
+    for (const index of INDEX_BASENAMES) {
+        const candidate = path.join(target, index);
+        if (isFile(candidate))
+            return candidate;
+    }
+    return null;
+}
+/** @deno/loader hardcodes IsCjsResolutionMode::ExplicitTypeCommonJs, so a
+ *  package with no `"type"` (CommonJS by Node's default) is treated as ESM;
+ *  lacking an `exports` map, its `main` field is skipped and it resolves to a
+ *  non-existent `<pkg>/index.js`. The Deno CLI (ImplicitTypeCommonJs) reads
+ *  `main` instead. On that ERR_MODULE_NOT_FOUND, read package.json and return
+ *  the real entry as a `file://` URL, or null when not this case / unrecoverable. */
+function resolveEntryFromPackageJson(err, specifier, mode, pathUnderDeps) {
+    if (!(err instanceof ResolveError) || err.code !== "ERR_MODULE_NOT_FOUND") {
+        return null;
+    }
+    const msg = errMessage(err);
+    const m = msg.match(/Cannot find module '(file:\/\/\/.+?)'/);
+    if (!m)
+        return null;
+    let attempted;
+    try {
+        attempted = fileURLToPath(m[1]);
+    }
+    catch {
+        return null;
+    }
+    const base = path.basename(attempted);
+    if (base !== "index.js" && base !== "index.mjs")
+        return null;
+    // Only recover the loader's *synthesized* package-root probe. An explicit
+    // `pkg/index.js` (or `./index.js`) import that resolves to this same path was
+    // a deliberate request for that file — redirecting it to main/module would
+    // silently load a different entry, so let the missing-file error stand.
+    if (specifier.endsWith(`/${base}`))
+        return null;
+    const pkgDir = path.dirname(attempted);
+    // Fail closed: never touch a package.json (or its entries) outside the cache.
+    if (!pathUnderDeps(pkgDir))
+        return null;
+    const pkgJsonPath = path.join(pkgDir, "package.json");
+    try {
+        const pkg = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
+        // An `exports` map governs resolution; the loader would have used it, so a
+        // miss here is a genuine error — don't override the contract via legacy fields.
+        if (pkg.exports != null)
+            return null;
+        // Deno's ImplicitTypeCommonJs classifies these type-less packages as CJS and
+        // runs `main`, so prefer it for parity. A string `browser` entry wins first
+        // (the workerd/browser-targeted build, avoids bundling a Node entry). require()
+        // never falls through to `module` — an ESM/browser entry is not require-safe.
+        const browser = typeof pkg.browser === "string" ? pkg.browser : undefined;
+        const fields = mode === ResolutionMode.Require
+            ? [browser, pkg.main]
+            : [browser, pkg.main, pkg.module];
+        for (const entry of fields) {
+            if (typeof entry !== "string" || !entry)
+                continue;
+            const resolved = resolveNodeEntry(pkgDir, entry);
+            if (resolved && pathUnderDeps(resolved)) {
+                return pathToFileURL(resolved).toString();
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=deno-resolver.js.map