@exodus/stasis 1.0.0-beta.5 → 1.0.0-beta.7

package/src/loaders/php.js

@@ -861,9 +861,10 @@ export function phpClassDependencies(content) {
     if (impl) for (const nm of impl[1].split(',')) add(nm)
   }
 
-  // catch (A | B $e): capture the type list up to `$var`. The lazy `[^)]*?` (no
-  // second whitespace quantifier) keeps matching linear on adversarial input.
-  for (const m of stripped.matchAll(/\bcatch\s*\(([^)]*?)\$\w+/giu)) {
+  // catch (A | B $e), or PHP 8's catch (A | B) with no variable: capture the type
+  // list up to `$var` or `)`. One quantifier with nothing after it keeps matching
+  // linear on adversarial input.
+  for (const m of stripped.matchAll(/\bcatch\s*\(([^)$]*)/giu)) {
     for (const nm of m[1].split('|')) add(nm)
   }
 

package/src/metro-resolver.js

@@ -64,7 +64,7 @@ function getPackageForModule(absModulePath) {
 export function createMetroResolver({
   projectDir,
   platform,
-  sourceExts = ['js', 'json', 'ts'],
+  sourceExts = ['js', 'jsx', 'json', 'ts', 'tsx'],
   mainFields = ['react-native', 'browser', 'main'],
   conditionNames = ['react-native'],
   conditionsByPlatform = { web: ['browser'] },

package/src/resolve-fields.js

@@ -4,6 +4,7 @@ import { pathToFileURL } from 'node:url'
 
 import { isTypeDeclaration, stripTypeDeclaration, toPosix } from '@exodus/stasis-core/util'
 import {
+  inNodeModules,
   isDir,
   isFile,
   locatePackage,
@@ -174,12 +175,16 @@ function resolveSourceFile(base, opts) {
   // source siblings once the literal file (the bare probe above) is absent, so the on-disk `.js`
   // always wins over its `.ts` twin. Literal siblings only -- no platform suffixes (tsc has none);
   // extensionless bases keep going through the appended-extension loop below (sourceExts carries
-  // ts, and tsx under --jsx). Placed before that loop so `x.js` -> `x.ts` beats a pathological
-  // `x.js.<ext>`, matching tsc's candidate order.
+  // ts and tsx). Placed before that loop so `x.js` -> `x.ts` beats a pathological
+  // `x.js.<ext>`, matching tsc's candidate order. Never into node_modules: where tsc's pick, the
+  // first sibling on disk, lies there by its real path, nothing maps (inNodeModules), as the shared
+  // fallback refuses its own -- never a later sibling tsc wouldn't pick. The resolver drops
+  // `typescript` for an importer there.
   if (opts.typescript) {
-    for (const cand of typescriptSiblings(base, { tsx: opts.sourceExts.includes('tsx') })) {
+    for (const cand of typescriptSiblings(base)) {
       const hit = probePath(cand, true)
-      if (hit) return hit
+      if (hit === null) continue
+      return typeof hit === 'string' && inNodeModules(hit, opts.host) ? null : hit
     }
   }
   for (const ext of opts.sourceExts) {
@@ -220,7 +225,7 @@ function resolveFileOrDir(base, opts) {
 // resolveEntryThroughMap and resolveSourceFile); leave it off for the esbuild-parity
 // `--mainFields` path. `typescript` adds tsc's extension substitution (a missing `x.js` probes
 // its `x.ts` sibling; see resolveSourceFile) plus the shared miss fallback (see below), and
-// `typescriptPaths` (a loadTsconfigPaths matcher) its tsconfig alias mapping.
+// `typescriptPaths` (a tsconfig paths matcher; see resolveTypescriptFallback) its tsconfig alias mapping.
 // `metroKeepEntryOnBrowserFalse` overrides the module-level toggle
 // (METRO_KEEP_ENTRY_ON_BROWSER_FALSE) per resolver -- primarily so tests can cover both branches.
 // `host` is the filesystem view (@exodus/stasis-core/host), the real disk by default.
@@ -229,7 +234,7 @@ export function createFieldResolver({
   mainFields = ['main'],
   platform = null,
   preferNative = false,
-  sourceExts = ['js', 'json', 'ts'],
+  sourceExts = ['js', 'jsx', 'json', 'ts', 'tsx'],
   metro = false,
   typescript = false,
   typescriptPaths = null,
@@ -237,9 +242,12 @@ export function createFieldResolver({
   host = diskHost,
 } = {}) {
   const opts = { platform, preferNative, sourceExts, mainFields, metro, typescript, metroKeepEntryOnBrowserFalse, host }
+  // An importer in node_modules gets no --typescript mapping (inNodeModules), wherever its import lands.
+  const fromNodeModules = { ...opts, typescript: false }
   // `callConditions` (from scan) is the parent's format-driven condition set, so `exports`
   // delegation matches Node resolving from THAT file; falls back to configured `conditions`.
   const resolve = function resolve(parentFile, specifier, callConditions) {
+    const fileOpts = typescript && inNodeModules(parentFile, host) ? fromNodeModules : opts
     const conds = new Set(callConditions ?? conditions)
     const viaNode = (spec) => {
       try {
@@ -269,7 +277,7 @@ export function createFieldResolver({
         // Browser-map targets are relative to the PACKAGE ROOT, not the importing file; a
         // bare-module target re-enters resolution below.
         if (r.startsWith('.') || isAbsolute(r)) {
-          return resolveFileOrDir(isAbsolute(r) ? r : resolvePath(imp.pkgDir, r), opts)
+          return resolveFileOrDir(isAbsolute(r) ? r : resolvePath(imp.pkgDir, r), fileOpts)
         }
         spec = r
       }
@@ -280,7 +288,7 @@ export function createFieldResolver({
 
     if (spec.startsWith('.') || isAbsolute(spec)) {
       const base = isAbsolute(spec) ? spec : resolvePath(dirname(parentFile), spec)
-      return resolveFileOrDir(base, opts)
+      return resolveFileOrDir(base, fileOpts)
     }
 
     const loc = locatePackage(dirname(parentFile), spec, host)
@@ -289,12 +297,12 @@ export function createFieldResolver({
     // `exports` wins over mainFields; Node's algorithm resolves it (with conditions) correctly.
     if (pkg.exports != null) return viaNode(spec)
     // A bare package import resolves its directory via the same dir algorithm as any other.
-    if (loc.subpath === '') return resolveFileOrDir(loc.pkgDir, opts)
+    if (loc.subpath === '') return resolveFileOrDir(loc.pkgDir, fileOpts)
     const sub = `./${loc.subpath}`
     const r = matchRedirect(mergeRedirectMap(pkg, mainFields), sub)
     if (r === false) return { empty: true }
     const target = typeof r === 'string' ? r : sub
-    return resolveFileOrDir(join(loc.pkgDir, target), opts)
+    return resolveFileOrDir(join(loc.pkgDir, target), fileOpts)
   }
   if (!typescript) return resolve
   // --typescript: when the whole field flow leaves the specifier unresolved, give tsc's mapping
@@ -308,7 +316,6 @@ export function createFieldResolver({
     if (resolved) return resolved
     const hit = resolveTypescriptFallback(parentFile, specifier, {
       conditions: new Set(callConditions ?? conditions),
-      tsx: sourceExts.includes('tsx'),
       paths: typescriptPaths,
       host,
     })

package/src/resolve-typescript.js

@@ -8,7 +8,7 @@ import { diskHost } from '@exodus/stasis-core/host'
 // everywhere: when normal resolution misses and tsc would land on an on-disk TypeScript source,
 // complete the miss with that file. It never rewrites a resolution that succeeded, so an on-disk
 // `.js` always beats its `.ts` twin. The rules, in the shapes they apply to:
-//   - extension substitution: `./x.js` -> `./x.ts` (`.jsx` -> `.tsx` under --jsx, `.mjs` -> `.mts`,
+//   - extension substitution: `./x.js` -> `./x.ts` (`.jsx` -> `.tsx`, `.mjs` -> `.mts`,
 //     `.cjs` -> `.cts`) -- tsc never rewrites specifiers, so TS sources import each other by their
 //     OUTPUT names, and the specifier names a file that only exists as its TS source;
 //   - extension/index completion for an extensionless path (`./util` -> `./util.ts`,
@@ -16,13 +16,13 @@ import { diskHost } from '@exodus/stasis-core/host'
 //   - the same substitution applied to manifest-declared targets: a package `main`, an `exports`
 //     target, a `#name` `imports` target naming a compiled file whose only on-disk form is TS;
 //   - tsconfig `compilerOptions.paths` aliases (see loadTsconfigPaths), consulted for bare
-//     specifiers nothing else resolved.
+//     specifiers nothing else resolved. Node never probed an alias target, so its completion also
+//     tries the JS extensions after the TS ones (`@/x` -> x.ts, then x.js), as tsc does.
 // This module also homes the generic manifest helpers (readJson/locatePackage/nearestPackage)
 // both resolvers share -- it is the dependency-free lower layer, importing from neither.
 
 // tsc's extension substitution table: the JS output extensions mapped back to the TS source
-// siblings that may sit on disk in their place. `.tsx` entries apply only when the caller can
-// carry/parse .tsx (i.e. --jsx). JS_OUTPUT_EXTS is derived, so the two cannot drift.
+// siblings that may sit on disk in their place. JS_OUTPUT_EXTS is derived, so the two cannot drift.
 const TS_SIBLING_EXTS = new Map([
   ['.js', ['.ts', '.tsx']],
   ['.jsx', ['.tsx']],
@@ -36,12 +36,12 @@ const JS_OUTPUT_EXTS = new Set(TS_SIBLING_EXTS.keys())
 // extname sees no extension in './.js', matching the extensionless gates downstream). Candidates
 // spelling a type declaration (./x.d.js -> ./x.d.ts) are returned too: every probe site refuses
 // declarations (types-only, erased at runtime), so the screen lives at probe time, once.
-export function typescriptSiblings(name, { tsx = false } = {}) {
+export function typescriptSiblings(name) {
   const ext = extname(name)
   const exts = TS_SIBLING_EXTS.get(ext)
   if (!exts) return []
   const stem = name.slice(0, -ext.length)
-  return exts.filter((e) => tsx || e !== '.tsx').map((e) => `${stem}${e}`)
+  return exts.map((e) => `${stem}${e}`)
 }
 
 // Extensions that never take the appended-`.ts` completion: JS outputs (substitution territory)
@@ -49,6 +49,15 @@ export function typescriptSiblings(name, { tsx = false } = {}) {
 // completed like an extensionless name, matching tsc's candidate list.
 const NO_COMPLETION_EXTS = new Set([...JS_OUTPUT_EXTS, '.ts', '.tsx', '.mts', '.cts', '.json'])
 
+// `path`'s real path, or `path` itself where it has none (not on disk).
+function realpathOr(path, host) {
+  try {
+    return host.realpath(path)
+  } catch {
+    return path
+  }
+}
+
 export function isFile(p, host = diskHost) {
   return host.stat(p)?.isFile() ?? false
 }
@@ -113,8 +122,13 @@ export function nearestPackage(file, host = diskHost) {
 // (a `.d.ts` is types-only, erased at runtime -- tsc records it for types, never for emit).
 const probe = (p, host) => (!isTypeDeclaration(p) && isFile(p, host) ? p : null)
 
-// LOAD_INDEX with TS completions: dir/index.ts (+ index.tsx under tsx). Node/tsc already probed
-// the .js/.json indexes before the fallback ever runs.
+// The extensions tsc's completion appends, in its order (tryAddingExtensions): .ts, .tsx, then --
+// with `js`, for a path Node never probed (a tsconfig paths target) -- .js, .jsx. A path Node
+// already completed needs only the TS ones. .d.ts (tsc's third) is never a target (see probe).
+const completionExts = (js) => (js ? ['.ts', '.tsx', '.js', '.jsx'] : ['.ts', '.tsx'])
+
+// LOAD_INDEX with tsc's completions: dir/index.ts, dir/index.tsx (+ index.js/index.jsx with `js`).
+// Without `js`, Node already probed the .js/.json indexes before the fallback ever runs.
 function probeIndex(dir, exts, host) {
   for (const ext of exts) {
     const hit = probe(join(dir, `index${ext}`), host)
@@ -130,13 +144,14 @@ function probeIndex(dir, exts, host) {
 // LOAD_AS_DIRECTORY) then its index. `dirOnly` skips the file rules for specs Node treats as
 // directory-only ('.', '..', a trailing '/'), so './' never probes the pathological '.ts' dotfile.
 // `completion`/`dir` are off for exports/imports targets: Node requires those to name exact files,
-// so only substitution applies (matching tsc's node16 rules).
-function probeTypescriptTarget(base, { tsx = false, dirOnly = false, completion = true, dir = true, host = diskHost } = {}) {
-  const exts = tsx ? ['.ts', '.tsx'] : ['.ts']
+// so only substitution applies (matching tsc's node16 rules). `js` completes JS extensions too, for
+// a base Node never probed (see completionExts).
+function probeTypescriptTarget(base, { js = false, dirOnly = false, completion = true, dir = true, host = diskHost } = {}) {
+  const exts = completionExts(js)
   if (!dirOnly) {
     const literal = probe(base, host)
     if (literal) return literal
-    for (const cand of typescriptSiblings(base, { tsx })) {
+    for (const cand of typescriptSiblings(base)) {
       const hit = probe(cand, host)
       if (hit) return hit
     }
@@ -154,7 +169,7 @@ function probeTypescriptTarget(base, { tsx = false, dirOnly = false, completion
       // LOAD_AS_FILE(main) with substitution/completion, then LOAD_INDEX(main); a broken main
       // falls through to the package index, like Node.
       const entry = resolvePath(base, main)
-      const hit = probeTypescriptTarget(entry, { tsx, dir: false, host }) ?? probeIndex(entry, exts, host)
+      const hit = probeTypescriptTarget(entry, { js, dir: false, host }) ?? probeIndex(entry, exts, host)
       if (hit) return hit
     }
     return probeIndex(base, exts, host)
@@ -228,9 +243,9 @@ function manifestTargets(map, subpathKey, conditions) {
 // tsc's mapping of `key` ('.' or './sub') through the `exports` of the package in `pkgDir` (or of
 // a '#name' key through its `imports`): the targets `conditions` select, substitution only (Node
 // requires exports/imports targets to name exact files), the first on disk; or null.
-export function typescriptExportsTarget(pkgDir, exports, key, { conditions = new Set(), tsx = false, host = diskHost } = {}) {
+export function typescriptExportsTarget(pkgDir, exports, key, { conditions = new Set(), host = diskHost } = {}) {
   for (const target of manifestTargets(exports, key, conditions)) {
-    const hit = probeTypescriptTarget(resolvePath(pkgDir, target), { tsx, completion: false, dir: false, host })
+    const hit = probeTypescriptTarget(resolvePath(pkgDir, target), { completion: false, dir: false, host })
     if (hit) return hit
   }
   return null
@@ -299,24 +314,48 @@ function resolveExtendsTarget(fromFile, target, host) {
   throw new Error(`tsconfig extends target not found: '${target}' (from ${fromFile})`)
 }
 
-// Effective { paths, pathsDir, baseUrl } across the `extends` chain: bases apply in order, the
-// extending file overrides them; `paths` replaces wholesale (tsc never deep-merges it) and
-// remembers its declaring dir; `baseUrl` is resolved against its declaring file.
-function loadConfigChain(file, seen, host) {
-  if (seen.has(file)) throw new Error(`tsconfig extends cycle at ${file}`)
-  seen.add(file)
+// The configs a tsconfig's `extends` chain reads, as { file, raw }: each base (in the order
+// `extends` names them) before the config extending it, and `file` last. A base two configs share
+// is listed under each, so folding the list in order, later over earlier, is tsc's nested merge,
+// where the second extender's resolved options carry the shared base's again. Like tsc's, the
+// cycle check is per branch: `extending` holds the configs extending `file`, and only a config that
+// extends itself, directly or not, throws.
+function* tsconfigChain(file, host, extending = new Set()) {
+  if (extending.has(file)) throw new Error(`tsconfig extends cycle at ${file}`)
   const raw = parseJsonc(host.readFile(file).toString('utf8'), file)
-  const acc = {}
-  for (const base of [].concat(raw?.extends ?? [])) {
-    Object.assign(acc, loadConfigChain(resolveExtendsTarget(file, base, host), seen, host))
-  }
-  const co = raw?.compilerOptions ?? {}
-  if (typeof co.baseUrl === 'string') acc.baseUrl = resolvePath(dirname(file), co.baseUrl)
-  if (co.paths != null) {
-    acc.paths = co.paths
-    acc.pathsDir = dirname(file)
+  extending.add(file)
+  for (const base of [].concat(raw?.extends ?? [])) yield* tsconfigChain(resolveExtendsTarget(file, base, host), host, extending)
+  extending.delete(file)
+  yield { file, raw }
+}
+
+// tsc's path-valued compilerOptions (a list's element by element), each made absolute against the
+// dir of the config declaring it, or, when it starts with `${configDir}`, against the loaded one's.
+const TSCONFIG_PATH_OPTIONS = new Set(['baseUrl', 'declarationDir', 'generateCpuProfile', 'generateTrace', 'outDir', 'outFile', 'rootDir', 'tsBuildInfoFile'])
+const TSCONFIG_PATH_LIST_OPTIONS = new Set(['rootDirs', 'typeRoots'])
+const CONFIG_DIR = '${configDir}'
+const tsconfigPath = (value, dir, configDir) => {
+  if (typeof value !== 'string') return value
+  return value.startsWith(CONFIG_DIR) ? resolvePath(configDir, value.replace(CONFIG_DIR, './')) : resolvePath(dir, value)
+}
+
+// The `compilerOptions` a tsconfig resolves to across its `extends` chain, merged one level deep
+// as tsc merges them: each base in order, the extending file's own over them (`null` unsetting an
+// option), each path-valued option absolute, and `paths` as declared, with tsc's `pathsBasePath`,
+// the dir of the config declaring it.
+export function loadTsconfigCompilerOptions(file, host = diskHost) {
+  let options = {}
+  for (const { file: at, raw } of tsconfigChain(file, host)) {
+    const own = { ...raw?.compilerOptions }
+    for (const [name, value] of Object.entries(own)) {
+      if (TSCONFIG_PATH_OPTIONS.has(name)) own[name] = tsconfigPath(value, dirname(at), dirname(file))
+      else if (TSCONFIG_PATH_LIST_OPTIONS.has(name) && Array.isArray(value)) own[name] = value.map((p) => tsconfigPath(p, dirname(at), dirname(file)))
+    }
+    delete own.pathsBasePath // tsc's own, never a config's
+    if (own.paths != null) own.pathsBasePath = dirname(at)
+    options = { ...options, ...own }
   }
-  return acc
+  return options
 }
 
 // Load a tsconfig's `compilerOptions.paths` into a matcher, following `extends`. Returns null when
@@ -324,11 +363,12 @@ function loadConfigChain(file, seen, host) {
 // substituted targets of the BEST-matching key -- exact match first, else the '*' pattern with the
 // longest matched prefix, exactly one key, its targets in order (tsc tries no other key when they
 // all miss) -- resolved against `baseUrl`, or against the declaring config's dir without one
-// (TS 4.1 paths-without-baseUrl). Only `extends`/`baseUrl`/`paths` are read; malformed shapes
-// (a non-array value, more than one '*' in a key or target) fail closed like tsc's config errors.
+// (TS 4.1 paths-without-baseUrl), or, starting with `${configDir}`, against `file`'s. Only
+// `baseUrl`/`paths` are used; malformed shapes (a non-array value, more than one '*' in a key or
+// target) fail closed like tsc's config errors.
 export function loadTsconfigPaths(file, host = diskHost) {
   if (file == null) return null
-  const { paths, pathsDir, baseUrl } = loadConfigChain(file, new Set(), host)
+  const { paths, pathsBasePath, baseUrl } = loadTsconfigCompilerOptions(file, host)
   if (paths == null || typeof paths !== 'object' || Object.keys(paths).length === 0) return null
   const starCount = (s) => s.split('*').length - 1
   for (const [key, targets] of Object.entries(paths)) {
@@ -339,7 +379,7 @@ export function loadTsconfigPaths(file, host = diskHost) {
       if (starCount(t) > 1) throw new Error(`tsconfig paths pattern '${t}' has more than one '*' (${file})`)
     }
   }
-  const base = baseUrl ?? pathsDir
+  const base = typeof baseUrl === 'string' ? baseUrl : pathsBasePath
   return {
     matchPaths(spec) {
       let targets = null
@@ -360,22 +400,84 @@ export function loadTsconfigPaths(file, host = diskHost) {
         targets = paths[best.key].map((t) => ({ target: t, wildcard }))
       }
       return targets.map(({ target, wildcard }) =>
-        resolvePath(base, wildcard == null ? target : target.replace('*', wildcard)))
+        tsconfigPath(wildcard == null ? target : target.replace('*', wildcard), base, dirname(file)))
     },
   }
 }
 
-// The tsconfig `--typescript` reads: an explicit `--tsconfig` path must exist (fail closed on a
-// typo); with none given, the project root's tsconfig.json applies when present, like tsc's own
-// discovery from a directory.
+// The tsconfig an explicit `--tsconfig` names, resolved against `baseDir`; it must exist (fail
+// closed on a typo). Without one, each package's own applies (packageTsconfigPaths).
 export function discoverTsconfig(baseDir, explicit, host = diskHost) {
-  if (explicit != null) {
-    const p = resolvePath(baseDir, explicit)
-    if (!isFile(p, host)) throw new Error(`tsconfig not found: ${explicit}`)
-    return p
+  const p = resolvePath(baseDir, explicit)
+  if (!isFile(p, host)) throw new Error(`tsconfig not found: ${explicit}`)
+  return p
+}
+
+// Whether `dir` holds a package: a package.json naming one. One with no name is a `type` marker,
+// its files the package's above (as vfs-bundle's holdsPackage reads it).
+const holdsNamedPackage = (dir, host) => isFile(join(dir, 'package.json'), host) && readJson(join(dir, 'package.json'), host)?.name !== undefined
+
+// Whether `dir` declares a monorepo's workspaces: a pnpm-workspace.yaml, or a package.json
+// `workspaces` (npm's and yarn's).
+const declaresWorkspaces = (dir, host) => isFile(join(dir, 'pnpm-workspace.yaml'), host) || Boolean(readJson(join(dir, 'package.json'), host)?.workspaces)
+
+// The `paths` --typescript honours without --tsconfig: those of the tsconfig.json beside the
+// package.json of the package the importing file is in, as a matcher whose matchPaths(spec,
+// parentFile) is loadTsconfigPaths's for that config. The project is read up from `cwd` as the
+// State reads it: the directories holding a package.json, up to one holding .git or
+// pnpm-workspace.yaml, or up to `projectCwd` (the State's PROJECT_CWD, as yarn sets it). In a monorepo -- where one of those declares workspaces -- a file's package is
+// the nearest directory at or above it, up to that workspace root, holding a named package.json
+// (the root itself where none below it does); outside one, every file takes the one config beside
+// the nearest named package.json at or above `cwd` (or the top-most package.json, where none is
+// named). Never in node_modules: no walk enters a node_modules directory, and resolveTypescriptFallback
+// matches no alias for a file under one. Each config loads once, when first matched; with `lenient`,
+// one that doesn't load matches nothing instead of throwing.
+export function packageTsconfigPaths(cwd, { host = diskHost, lenient = false, projectCwd } = {}) {
+  const stop = projectCwd ? realpathOr(resolvePath(projectCwd), host) : null
+  const dirs = [] // cwd and above, while the State's walk would go on; real paths, as importers are read
+  for (let dir = realpathOr(resolvePath(cwd), host); basename(dir) !== 'node_modules'; dir = dirname(dir)) {
+    dirs.push(dir)
+    if (dir === stop) break
+    if (host.stat(join(dir, '.git')) !== null || isFile(join(dir, 'pnpm-workspace.yaml'), host)) break
+    if (dirname(dir) === dir) break
+  }
+  const workspaceRoot = dirs.find((dir) => declaresWorkspaces(dir, host)) ?? null
+  const projectPackage = workspaceRoot === null
+    ? dirs.find((dir) => holdsNamedPackage(dir, host)) ?? dirs.findLast((dir) => isFile(join(dir, 'package.json'), host)) ?? null
+    : null
+  // The package directory `parentFile` is in, or null outside the workspace root. By its real path,
+  // as inNodeModules reads it: a linked workspace package reached through node_modules takes its
+  // own config, read where it lies, so a relative `extends` resolves as tsc resolves it.
+  const packageOf = (parentFile) => {
+    if (workspaceRoot === null) return projectPackage
+    for (let dir = dirname(realpathOr(parentFile, host)); basename(dir) !== 'node_modules'; dir = dirname(dir)) {
+      if (dir === workspaceRoot || holdsNamedPackage(dir, host)) return dir
+      if (dirname(dir) === dir) return null
+    }
+    return null
+  }
+  const matchers = new Map() // package dir -> loadTsconfigPaths matcher, or null
+  const matcherOf = (dir) => {
+    if (!matchers.has(dir)) {
+      const file = join(dir, 'tsconfig.json')
+      let matcher = null
+      if (isFile(file, host)) {
+        try {
+          matcher = loadTsconfigPaths(file, host)
+        } catch (error) {
+          if (!lenient) throw error
+        }
+      }
+      matchers.set(dir, matcher)
+    }
+    return matchers.get(dir)
+  }
+  return {
+    matchPaths(spec, parentFile) {
+      const dir = packageOf(parentFile)
+      return dir === null ? [] : (matcherOf(dir)?.matchPaths(spec) ?? [])
+    },
   }
-  const p = join(baseDir, 'tsconfig.json')
-  return isFile(p, host) ? p : null
 }
 
 // --- the fallback dispatcher ---
@@ -384,31 +486,43 @@ export function discoverTsconfig(baseDir, explicit, host = diskHost) {
 // the file rules are skipped for them, exactly as Node skips LOAD_AS_FILE.
 const DIR_ONLY_SPEC = /(?:^|\/)\.{1,2}$|\/$/u
 
-// tsconfig paths map first-party aliases; a dependency's own bare imports must never be hijacked
-// by the app's aliases (tsc doesn't resolve node_modules files' imports through the app config).
-const IN_NODE_MODULES = /(?:^|[\\/])node_modules[\\/]/u
+// A node_modules path segment, the last one included (the directory itself).
+const IN_NODE_MODULES = /(?:^|[\\/])node_modules(?:[\\/]|$)/u
+
+// Whether `file` lies in node_modules, by its real path where it has one (by its own, where it
+// doesn't): --typescript maps nothing from or into an installed package. A monorepo's workspace
+// packages, linked in through node_modules, really lie outside it, so they keep the mapping.
+export const inNodeModules = (file, host = diskHost) => IN_NODE_MODULES.test(realpathOr(file, host))
 
 // Resolve `spec` from `parentFile` the way tsc would complete a resolution BOTH Node and the
-// legacy-field resolver missed. Returns the absolute path of the on-disk source, or null.
-// `conditions` gates exports/imports maps (same set the failed resolution used); `tsx` widens the
-// substitutions to .tsx; `paths` is a loadTsconfigPaths matcher (or null). Dispatch by shape:
+// legacy-field resolver missed. Returns the absolute path of the on-disk source, or null -- always
+// null from or into node_modules (inNodeModules). `conditions` gates exports/imports maps (same set
+// the failed resolution used); `paths` is a tsconfig paths matcher (loadTsconfigPaths, or
+// packageTsconfigPaths), or null. Dispatch by shape:
 //   '#name'        -> the parent package's `imports` targets, substitution only;
 //   relative/abs   -> path substitution/completion (+ directory main/index);
-//   bare           -> tsconfig paths aliases first (tsc consults them before node_modules), then
+//   bare           -> tsconfig paths aliases first (tsc consults them before node_modules; JS
+//                     completion too, as Node never probed the target), then
 //                     the named package: its `exports` targets (substitution only) when it has
 //                     them, else its `main`/index (bare root) or subpath (substitution/completion).
-export function resolveTypescriptFallback(parentFile, spec, { conditions = new Set(), tsx = false, paths = null, host = diskHost } = {}) {
+export function resolveTypescriptFallback(parentFile, spec, { conditions = new Set(), paths = null, host = diskHost } = {}) {
+  if (inNodeModules(parentFile, host)) return null
+  const hit = typescriptTarget(parentFile, spec, { conditions, paths, host })
+  return hit == null || inNodeModules(hit, host) ? null : hit
+}
+
+function typescriptTarget(parentFile, spec, { conditions, paths, host }) {
   if (spec.startsWith('#')) {
     const scope = nearestPackage(parentFile, host)
-    return scope?.pkg.imports ? typescriptExportsTarget(scope.pkgDir, scope.pkg.imports, spec, { conditions, tsx, host }) : null
+    return scope?.pkg.imports ? typescriptExportsTarget(scope.pkgDir, scope.pkg.imports, spec, { conditions, host }) : null
   }
   if (spec.startsWith('./') || spec.startsWith('../') || spec === '.' || spec === '..' || isAbsolute(spec)) {
     const base = isAbsolute(spec) ? spec : resolvePath(dirname(parentFile), spec)
-    return probeTypescriptTarget(base, { tsx, dirOnly: DIR_ONLY_SPEC.test(spec), host })
+    return probeTypescriptTarget(base, { dirOnly: DIR_ONLY_SPEC.test(spec), host })
   }
-  if (paths && !IN_NODE_MODULES.test(parentFile)) {
-    for (const target of paths.matchPaths(spec)) {
-      const hit = probeTypescriptTarget(target, { tsx, dirOnly: target.endsWith('/'), host })
+  if (paths) {
+    for (const target of paths.matchPaths(spec, parentFile)) {
+      const hit = probeTypescriptTarget(target, { js: true, dirOnly: target.endsWith('/'), host })
       if (hit) return hit
     }
   }
@@ -417,11 +531,11 @@ export function resolveTypescriptFallback(parentFile, spec, { conditions = new S
   const pkg = readJson(join(loc.pkgDir, 'package.json'), host) ?? {}
   if (pkg.exports != null) {
     // `exports` fully governs a bare import (main is not a fallback); targets name exact files.
-    return typescriptExportsTarget(loc.pkgDir, pkg.exports, loc.subpath === '' ? '.' : `./${loc.subpath}`, { conditions, tsx, host })
+    return typescriptExportsTarget(loc.pkgDir, pkg.exports, loc.subpath === '' ? '.' : `./${loc.subpath}`, { conditions, host })
   }
   if (loc.subpath === '') {
     // Bare package root: LOAD_AS_DIRECTORY only (never `node_modules/dep.ts`).
-    return probeTypescriptTarget(loc.pkgDir, { tsx, dirOnly: true, host })
+    return probeTypescriptTarget(loc.pkgDir, { dirOnly: true, host })
   }
-  return probeTypescriptTarget(join(loc.pkgDir, loc.subpath), { tsx, dirOnly: DIR_ONLY_SPEC.test(spec), host })
+  return probeTypescriptTarget(join(loc.pkgDir, loc.subpath), { dirOnly: DIR_ONLY_SPEC.test(spec), host })
 }

package/src/sbom.js

@@ -10,7 +10,9 @@ const DEFAULT_TOOL = { name: '@exodus/stasis', version: pkg.version, vendor: 'Ex
 // Web Crypto (global) instead of node:crypto, keeping this module dependency-light.
 const newUuid = () => globalThis.crypto.randomUUID()
 
-// purl types we can mint; an ecosystem with no registered type (`soldeer`) gets no purl rather than a fabricated one.
+// purl types we can mint; an ecosystem with no registered type (`soldeer`) gets no purl rather than a fabricated one,
+// and so does a crate vendored from git or from a source not known (`cargo-git`, `cargo-unknown`): `pkg:cargo` names
+// crates.io's crate of that name, which it may not be.
 const PURL_TYPES = new Set(['npm', 'composer', 'cargo', 'github'])
 
 // Infer an artifact's ecosystem from its loader formats: PHP bundles map to Composer, everything