@bobfrankston/importgen 0.1.36 → 0.1.37

package/index.js

@@ -211,13 +211,35 @@ function collectDependencies(packageJsonPath, visited, dependencies, htmlDir, no
                 searchDir = parent;
             }
             if (!depPrefix) {
-                // Not in any ancestor node_modules (e.g. file: dep outside
-                // the workspace, no junction yet). Use the resolved real
-                // path relative to htmlDir — strictly more correct than
-                // the old `nodeModulesPrefix/depName` guess.
+                // Transitive dep that npm placed in a NESTED node_modules
+                // (not hoisted to an ancestor of htmlDir). nodeModulesPrefix
+                // tracks that nested location through the recursion. Use it
+                // when the package physically resolves there — this is a
+                // path under the app's node_modules tree that the browser
+                // can actually fetch (junctions traverse transparently).
+                const nestedCandidate = `${nodeModulesPrefix}/${depName}`;
+                if (fs.existsSync(path.join(htmlDir, nestedCandidate))) {
+                    depPrefix = nestedCandidate;
+                }
+            }
+            if (!depPrefix) {
+                // Last resort: not found in any node_modules at all (e.g. a
+                // file: dep with no junction). Use the resolved real path —
+                // which may escape the app dir; the RED FLAG below catches that.
                 const rel = path.relative(htmlDir, depPath).split(path.sep).join('/');
                 depPrefix = rel.startsWith('.') ? rel : `./${rel}`;
             }
+            // RED FLAG: a `../`-escaping path leaves the HTML file's
+            // directory. The dev server's served root rarely extends
+            // above the app dir, so the browser will almost certainly
+            // 404 on it and the page breaks. We still emit the entry
+            // (it's the only real location we found), but flag it in
+            // the generated HTML so the breakage is not silent.
+            if (depPrefix.startsWith('../')) {
+                const warning = `${depName} -> ${depPrefix}/${entryFile} escapes the app directory; the browser will likely fail to load it unless the dev server serves a high-enough root. Add ${depName} to the app's node_modules.`;
+                console.warn(`${ts()} [generate-importmap] Warning: ${warning}`);
+                warnings.push(warning);
+            }
             dependencies.set(depName, `${depPrefix}/${entryFile}`);
             // Bug 3: trailing-slash variant for deep imports
             // (`import "pkg/sub.js"` requires `"pkg/": "<root>/"`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/importgen",
-  "version": "0.1.36",
+  "version": "0.1.37",
   "description": "Generate ES Module import maps from package.json dependencies for native browser module loading",
   "main": "index.js",
   "types": "./index.d.ts",