@gjsify/rolldown-plugin-gjsify 0.25.1 → 0.26.1

package/lib/app/nativescript.js

@@ -24,7 +24,7 @@
 // "this package IS the native implementation" sense and therefore routes to a
 // `globals.mjs` it does not ship → `@gjsify/empty`. The slot vocabulary's
 // `native` means "the RUNTIME provides this, use its value", so the bridge
-// packages are mis-declared; that is tracked in STATUS.md and must be settled
+// packages are mis-declared; that is tracked in status/open-todos.md and must be settled
 // before this table is composed. A direct `import … from
 // '@gjsify/native-fs-bridge'` already hits the derived map (plain key hit) and
 // is emptied TODAY — same root cause, listed in the same TODO.

package/lib/app/node.d.ts

@@ -30,7 +30,9 @@ export declare function enableGjsRegistersForNode(baseAliases: Record<string, st
  *
  * Two signals qualify, and BOTH must gate the same things:
  *  - `nodeGiGlobalsInject` — the CLI's post-tree-shake detection found bare GJS
- *    ambient globals (`print`/`imports`/`ARGV`/…) in the bundled output;
+ *    ambient globals (`print`/`imports`/`ARGV`/…) OR a static
+ *    `@gjsify/node-gi/*` import (the externalised spelling of the bare
+ *    `system`/`gettext`/`cairo` built-ins) in the bundled output;
  *  - `registerInject` (the `--globals` auto/explicit inject stub) — the user
  *    asked for GJS registers on the node target explicitly.
  *
@@ -46,11 +48,16 @@ export declare function enableGjsRegistersForNode(baseAliases: Record<string, st
  * routing and the `@girs/*` emptying both stay, so a cross-platform package's
  * node bundle keeps loading on plain Node without node-gi installed.
  *
- * KNOWN NARROWNESS (pre-dates this predicate, tracked in STATUS.md): the
- * `nodeGiGlobalsInject` detector keys on BARE ambient globals, so a genuine GJS
- * source that uses `gi://` but logs via `console.log` and passes no `--globals`
- * is not recognised — its `@girs/*` AND its registers are both emptied. The two
- * are now at parity; widening the signal itself is the separate fix.
+ * KNOWN NARROWNESS (pre-dates this predicate, tracked in status/open-todos.md): the
+ * `nodeGiGlobalsInject` detector keys on bare ambient globals + static
+ * `@gjsify/node-gi/*` imports, so a genuine GJS source whose ONLY platform
+ * reach is `gi://` (no ambient global, no bare `system`/`gettext`/`cairo`) is
+ * still not recognised — its `@girs/*` AND its registers are both emptied. A
+ * surviving `gi://` import CANNOT simply become a third signal: its shim loads
+ * node-gi lazily precisely so a gjs-gated `gi://` import in a cross-platform
+ * package keeps that package's node bundle loadable on plain Node (#641,
+ * pinned by `tests/e2e/node-gi-globals-inject`), and injecting the eager
+ * globals shim for it would break exactly that.
  */
 export declare function isGjsSourceBuild(options: {
     nodeGiGlobalsInject?: boolean;

package/lib/app/node.js

@@ -92,7 +92,9 @@ export function enableGjsRegistersForNode(baseAliases) {
  *
  * Two signals qualify, and BOTH must gate the same things:
  *  - `nodeGiGlobalsInject` — the CLI's post-tree-shake detection found bare GJS
- *    ambient globals (`print`/`imports`/`ARGV`/…) in the bundled output;
+ *    ambient globals (`print`/`imports`/`ARGV`/…) OR a static
+ *    `@gjsify/node-gi/*` import (the externalised spelling of the bare
+ *    `system`/`gettext`/`cairo` built-ins) in the bundled output;
  *  - `registerInject` (the `--globals` auto/explicit inject stub) — the user
  *    asked for GJS registers on the node target explicitly.
  *
@@ -108,11 +110,16 @@ export function enableGjsRegistersForNode(baseAliases) {
  * routing and the `@girs/*` emptying both stay, so a cross-platform package's
  * node bundle keeps loading on plain Node without node-gi installed.
  *
- * KNOWN NARROWNESS (pre-dates this predicate, tracked in STATUS.md): the
- * `nodeGiGlobalsInject` detector keys on BARE ambient globals, so a genuine GJS
- * source that uses `gi://` but logs via `console.log` and passes no `--globals`
- * is not recognised — its `@girs/*` AND its registers are both emptied. The two
- * are now at parity; widening the signal itself is the separate fix.
+ * KNOWN NARROWNESS (pre-dates this predicate, tracked in status/open-todos.md): the
+ * `nodeGiGlobalsInject` detector keys on bare ambient globals + static
+ * `@gjsify/node-gi/*` imports, so a genuine GJS source whose ONLY platform
+ * reach is `gi://` (no ambient global, no bare `system`/`gettext`/`cairo`) is
+ * still not recognised — its `@girs/*` AND its registers are both emptied. A
+ * surviving `gi://` import CANNOT simply become a third signal: its shim loads
+ * node-gi lazily precisely so a gjs-gated `gi://` import in a cross-platform
+ * package keeps that package's node bundle loadable on plain Node (#641,
+ * pinned by `tests/e2e/node-gi-globals-inject`), and injecting the eager
+ * globals shim for it would break exactly that.
  */
 export function isGjsSourceBuild(options) {
     return Boolean(options.nodeGiGlobalsInject || options.registerInject);
@@ -166,14 +173,16 @@ export const setupForNode = async (input) => {
     const format = input.pluginOptions.format ?? 'esm';
     const exclude = input.pluginOptions.exclude ?? [];
     const entryPoints = await globToEntryPoints(input.input, exclude);
-    // When the CLI's pre-build detection (`detectNodeGiGlobals`) found GJS
-    // ambient globals in the bundled output, wrap the entry so it side-effect
-    // imports the node-gi globals shim BEFORE the user code runs. The import is
-    // injected ONLY when detected — a bundle that never touches `print`/`imports`
-    // stays free of `@gjsify/node-gi/globals`, so it loads on plain Node without
-    // node-gi installed (the eager-native-load regression guard, same lesson as
-    // the lazy `gi://` shim in #641). Reuses the SAME virtual-entry wrapper the
-    // GJS `--globals auto` machinery uses.
+    // When the CLI's pre-build detection (`detectNodeGiGlobals`) recognised a
+    // genuine GJS source (bare ambient globals OR a static `@gjsify/node-gi/*`
+    // import in the bundled output), wrap the entry so it side-effect imports
+    // the node-gi globals shim BEFORE the user code runs. The import is
+    // injected ONLY when detected — a bundle that neither touches
+    // `print`/`imports` nor retains a bare `system`/`gettext`/`cairo` import
+    // stays free of `@gjsify/node-gi/globals`, so it loads on plain Node
+    // without node-gi installed (the eager-native-load regression guard, same
+    // lesson as the lazy `gi://` shim in #641). Reuses the SAME virtual-entry
+    // wrapper the GJS `--globals auto` machinery uses.
     const sideEffectImports = [];
     if (input.pluginOptions.nodeGiGlobalsInject)
         sideEffectImports.push(NODE_GI_GLOBALS_SPECIFIER);
@@ -192,9 +201,10 @@ export const setupForNode = async (input) => {
      * TWO signals answer that ONE question and both must count:
      *
      *  - `nodeGiGlobalsInject` — the CLI detected BARE GJS ambient globals
-     *    (`print`/`imports`/`ARGV`) in the tree-shaken output. Only genuine GJS
-     *    source has those (the detector deliberately ignores the
-     *    `globalThis.imports` isomorphic-guard shape).
+     *    (`print`/`imports`/`ARGV`) or a static `@gjsify/node-gi/*` import
+     *    (a retained bare `system`/`gettext`/`cairo` built-in) in the
+     *    tree-shaken output. Only genuine GJS source has those (the detector
+     *    deliberately ignores the `globalThis.imports` isomorphic-guard shape).
      *  - `autoGlobalsInject` — the user named EXPLICIT `--globals` (e.g.
      *    `--globals auto,dom`), i.e. asked for the DOM surface on Node.
      *

package/lib/globals.d.ts

@@ -1,4 +1,4 @@
 export { resolveGlobalsList, writeRegisterInjectFile, isRegisterPathResolvable, filterResolvableRegisterPaths } from './utils/scan-globals.js';
-export { detectFreeGlobals, detectGjsAmbientGlobals, GJS_AMBIENT_GLOBALS } from './utils/detect-free-globals.js';
+export { detectFreeGlobals, detectGjsAmbientGlobals, detectNodeGiModuleImports, GJS_AMBIENT_GLOBALS, } from './utils/detect-free-globals.js';
 export { detectAutoGlobals, detectNodeGiGlobals, describeGiBackedInjection } from './utils/auto-globals.js';
 export type { AutoGlobalsResult, DetectAutoGlobalsOptions, AnalysisOptions } from './utils/auto-globals.js';

package/lib/globals.js

@@ -5,5 +5,5 @@
 // stub that the plugin picks up via its `autoGlobalsInject` option. See the
 // "Tree-shakeable Globals" section in AGENTS.md for the architecture.
 export { resolveGlobalsList, writeRegisterInjectFile, isRegisterPathResolvable, filterResolvableRegisterPaths } from './utils/scan-globals.js';
-export { detectFreeGlobals, detectGjsAmbientGlobals, GJS_AMBIENT_GLOBALS } from './utils/detect-free-globals.js';
+export { detectFreeGlobals, detectGjsAmbientGlobals, detectNodeGiModuleImports, GJS_AMBIENT_GLOBALS, } from './utils/detect-free-globals.js';
 export { detectAutoGlobals, detectNodeGiGlobals, describeGiBackedInjection } from './utils/auto-globals.js';

package/lib/utils/auto-globals.d.ts

@@ -136,13 +136,24 @@ type GjsifyPluginFactory = (options: PluginOptions) => GjsifyFactoryReturn | Pro
  */
 export declare function detectAutoGlobals(analysisOptions: AnalysisOptions, pluginOptions: Omit<PluginOptions, 'autoGlobalsInject'>, gjsifyPluginFactory: GjsifyPluginFactory, verbose?: boolean, options?: DetectAutoGlobalsOptions, bundler?: AnalysisBundler): Promise<AutoGlobalsResult>;
 /**
- * `--app node` GJS-ambient-globals detection (the reverse of `--globals auto`).
+ * `--app node` genuine-GJS-source detection (the reverse of `--globals auto`).
  *
- * Runs ONE in-memory node bundle (no injection) and scans each chunk for the
- * GJS ambient globals (`print`/`printerr`/`log`/`logError`/`ARGV`/`imports`)
- * that `@gjsify/node-gi/globals` seeds. Returns `true` iff any is referenced in
- * the bundled, tree-shaken output — the signal the CLI uses to flip
- * `pluginOptions.nodeGiGlobalsInject` for the final build.
+ * Runs ONE in-memory node bundle (no injection) and scans each chunk for TWO
+ * signals, either of which flips `pluginOptions.nodeGiGlobalsInject` for the
+ * final build:
+ *
+ *  1. a GJS ambient global (`print`/`printerr`/`log`/`logError`/`ARGV`/
+ *     `imports`) referenced as a BARE identifier — the legacy GJS-source shape
+ *     `@gjsify/node-gi/globals` seeds (`detectGjsAmbientGlobals`);
+ *  2. a STATIC import of `@gjsify/node-gi` (root or subpath) — the shape the
+ *     bare GJS built-ins (`system`/`gettext`/`cairo`) are externalised to, i.e.
+ *     the PORTABLE GJS-source spelling (`detectNodeGiModuleImports`). A bundle
+ *     retaining one is already bound to the bridge at load, so flipping
+ *     injection cannot cost plain-Node loadability — while a portable GJS app
+ *     with no ambient global at all (e.g. `system.programArgs` instead of
+ *     `ARGV`) would otherwise get its `@girs/*` bodies emptied and its globals
+ *     shim dropped (the `gjsify storybook --runtime node` no-`requireGi`
+ *     regression).
  *
  * A SINGLE pass suffices (unlike the GJS register-injection loop): the shim is
  * EXTERNAL, so injecting it adds no bundled code that could reference more

package/lib/utils/auto-globals.js

@@ -36,7 +36,7 @@ const defaultBundler = async ({ rolldownInput, format }) => {
         await build.close();
     }
 };
-import { detectFreeGlobals, detectGjsAmbientGlobals } from './detect-free-globals.js';
+import { detectFreeGlobals, detectGjsAmbientGlobals, detectNodeGiModuleImports } from './detect-free-globals.js';
 import { resolveGlobalsList, writeRegisterInjectFile, filterResolvableRegisterPaths, isRegisterPathResolvable, } from './scan-globals.js';
 import { GJS_GLOBALS_MAP, GJS_GI_BACKED_REGISTERS } from '@gjsify/resolve-npm/globals-map';
 import { REGISTER_GLOBALS_CLOSURE } from '@gjsify/resolve-npm/register-globals-closure';
@@ -330,7 +330,11 @@ export async function detectAutoGlobals(analysisOptions, pluginOptions, gjsifyPl
                         console.error(`[gjsify-auto-globals] parse failed on chunk #${i} — wrote ${path} for inspection`);
                     }
                     catch {
-                        /* ignore */
+                        // Deliberately swallowed, and the ONLY reason this
+                        // catch is legitimate: writing the debug dump is
+                        // best-effort (permissions, disk), and letting its
+                        // failure escape would replace the real parse error
+                        // `e` — rethrown below — with a misleading one.
                     }
                 }
                 throw e;
@@ -405,13 +409,24 @@ export async function detectAutoGlobals(analysisOptions, pluginOptions, gjsifyPl
     return applyExcludeGlobals(detected, currentInject, extraRegisterPaths, options.excludeGlobals, cwd);
 }
 /**
- * `--app node` GJS-ambient-globals detection (the reverse of `--globals auto`).
+ * `--app node` genuine-GJS-source detection (the reverse of `--globals auto`).
  *
- * Runs ONE in-memory node bundle (no injection) and scans each chunk for the
- * GJS ambient globals (`print`/`printerr`/`log`/`logError`/`ARGV`/`imports`)
- * that `@gjsify/node-gi/globals` seeds. Returns `true` iff any is referenced in
- * the bundled, tree-shaken output — the signal the CLI uses to flip
- * `pluginOptions.nodeGiGlobalsInject` for the final build.
+ * Runs ONE in-memory node bundle (no injection) and scans each chunk for TWO
+ * signals, either of which flips `pluginOptions.nodeGiGlobalsInject` for the
+ * final build:
+ *
+ *  1. a GJS ambient global (`print`/`printerr`/`log`/`logError`/`ARGV`/
+ *     `imports`) referenced as a BARE identifier — the legacy GJS-source shape
+ *     `@gjsify/node-gi/globals` seeds (`detectGjsAmbientGlobals`);
+ *  2. a STATIC import of `@gjsify/node-gi` (root or subpath) — the shape the
+ *     bare GJS built-ins (`system`/`gettext`/`cairo`) are externalised to, i.e.
+ *     the PORTABLE GJS-source spelling (`detectNodeGiModuleImports`). A bundle
+ *     retaining one is already bound to the bridge at load, so flipping
+ *     injection cannot cost plain-Node loadability — while a portable GJS app
+ *     with no ambient global at all (e.g. `system.programArgs` instead of
+ *     `ARGV`) would otherwise get its `@girs/*` bodies emptied and its globals
+ *     shim dropped (the `gjsify storybook --runtime node` no-`requireGi`
+ *     regression).
  *
  * A SINGLE pass suffices (unlike the GJS register-injection loop): the shim is
  * EXTERNAL, so injecting it adds no bundled code that could reference more
@@ -481,6 +496,8 @@ export async function detectNodeGiGlobals(analysisOptions, pluginOptions, gjsify
     for (const code of chunkCodes) {
         if (detectGjsAmbientGlobals(code).size > 0)
             return true;
+        if (detectNodeGiModuleImports(code))
+            return true;
     }
     return false;
 }

package/lib/utils/detect-free-globals.d.ts

@@ -33,3 +33,30 @@ export declare const GJS_AMBIENT_GLOBALS: ReadonlySet<string>;
  * `ignoreHostMembers`.
  */
 export declare function detectGjsAmbientGlobals(code: string): Set<string>;
+/**
+ * Detect a STATIC import of `@gjsify/node-gi` (root or any subpath) in a
+ * bundled `--app node` chunk — the second genuine-GJS-source signal next to
+ * `detectGjsAmbientGlobals`.
+ *
+ * Why this is a signal: the bare GJS built-in modules (`system`/`gettext`/
+ * `cairo`) are rewritten to `@gjsify/node-gi/<name>` and kept EXTERNAL as
+ * top-level import statements, so any bundle whose tree-shaken graph retains
+ * one is ALREADY bound to the bridge at load — Node resolves the external at
+ * link time and fails without node-gi installed. Treating that bundle as a
+ * GJS-source build therefore cannot cost plain-Node loadability; NOT treating
+ * it as one is how a portable GJS app that spells `ARGV` as
+ * `system.programArgs` (the AGENTS.md-mandated spelling) lost its `@girs/*`
+ * bodies and its globals shim in one go — `gjsify storybook --runtime node`
+ * emitted a bundle with no `requireGi` at all.
+ *
+ * Why a surviving `gi://` import is deliberately NOT a signal: its shim loads
+ * node-gi LAZILY through a `require('@gjsify/node-gi/gi')` CALL — not an import
+ * statement, so this scan is structurally blind to it, by design. A
+ * cross-platform package with a gjs-gated `gi://` import stays loadable on
+ * plain Node (the #641 lesson, pinned by `tests/e2e/node-gi-globals-inject`),
+ * and flipping injection for it would break exactly that.
+ *
+ * Scans import/re-export STATEMENTS via the AST (never text), so a quoted
+ * `'@gjsify/node-gi/system'` inside a test name or template cannot trigger.
+ */
+export declare function detectNodeGiModuleImports(code: string): boolean;

package/lib/utils/detect-free-globals.js

@@ -413,3 +413,78 @@ export function detectGjsAmbientGlobals(code) {
         ignoreHostMembers: true,
     });
 }
+/** The node-gi reverse-bridge package every `--app node` GJS shim resolves to. */
+import { ALIASES_GJS_FOR_NODE } from '@gjsify/resolve-npm';
+const NODE_GI_PACKAGE = '@gjsify/node-gi';
+/**
+ * The BARE GJS built-ins, i.e. the PRE-ALIAS spelling of the same fact.
+ * Derived from the alias table so the two cannot drift.
+ *
+ * Why both spellings must count: the analysis pass that calls this runs with
+ * `nodeGiGlobalsInject` still FALSE, so the GJS-source routing that rewrites
+ * `system` → `@gjsify/node-gi/system` has not happened yet. Looking only for
+ * the aliased form makes the signal appear only AFTER the decision it is
+ * supposed to trigger — chicken-and-egg, and the same shape as the bug this
+ * detector was added to fix.
+ *
+ * Measured (CI, adwaita-storybook `--app node`): the FINAL bundle carries
+ * `import e from "@gjsify/node-gi/system"` and zero `gi://`, because the
+ * inject never fired, `@girs/*` were emptied to `{}`, and nothing was left to
+ * rewrite. The bundle then passes `node --check` and dies at runtime with
+ * `class extends undefined`.
+ */
+const GJS_BARE_BUILTINS = new Set(Object.keys(ALIASES_GJS_FOR_NODE));
+/**
+ * Is `source` the `@gjsify/node-gi` package root, one of its subpaths, or the
+ * bare GJS built-in that resolves to one on the node target?
+ */
+function isNodeGiSpecifier(source) {
+    if (typeof source !== 'string')
+        return false;
+    if (source === NODE_GI_PACKAGE || source.startsWith(`${NODE_GI_PACKAGE}/`))
+        return true;
+    return GJS_BARE_BUILTINS.has(source);
+}
+/**
+ * Detect a STATIC import of `@gjsify/node-gi` (root or any subpath) in a
+ * bundled `--app node` chunk — the second genuine-GJS-source signal next to
+ * `detectGjsAmbientGlobals`.
+ *
+ * Why this is a signal: the bare GJS built-in modules (`system`/`gettext`/
+ * `cairo`) are rewritten to `@gjsify/node-gi/<name>` and kept EXTERNAL as
+ * top-level import statements, so any bundle whose tree-shaken graph retains
+ * one is ALREADY bound to the bridge at load — Node resolves the external at
+ * link time and fails without node-gi installed. Treating that bundle as a
+ * GJS-source build therefore cannot cost plain-Node loadability; NOT treating
+ * it as one is how a portable GJS app that spells `ARGV` as
+ * `system.programArgs` (the AGENTS.md-mandated spelling) lost its `@girs/*`
+ * bodies and its globals shim in one go — `gjsify storybook --runtime node`
+ * emitted a bundle with no `requireGi` at all.
+ *
+ * Why a surviving `gi://` import is deliberately NOT a signal: its shim loads
+ * node-gi LAZILY through a `require('@gjsify/node-gi/gi')` CALL — not an import
+ * statement, so this scan is structurally blind to it, by design. A
+ * cross-platform package with a gjs-gated `gi://` import stays loadable on
+ * plain Node (the #641 lesson, pinned by `tests/e2e/node-gi-globals-inject`),
+ * and flipping injection for it would break exactly that.
+ *
+ * Scans import/re-export STATEMENTS via the AST (never text), so a quoted
+ * `'@gjsify/node-gi/system'` inside a test name or template cannot trigger.
+ */
+export function detectNodeGiModuleImports(code) {
+    const ast = acorn.parse(code, {
+        ecmaVersion: 'latest',
+        sourceType: 'module',
+        allowHashBang: true,
+    });
+    for (const node of ast.body) {
+        if (node.type === 'ImportDeclaration' && isNodeGiSpecifier(node.source.value))
+            return true;
+        if ((node.type === 'ExportNamedDeclaration' || node.type === 'ExportAllDeclaration') &&
+            node.source &&
+            isNodeGiSpecifier(node.source.value)) {
+            return true;
+        }
+    }
+    return false;
+}

package/lib/utils/entry-points.js

@@ -13,24 +13,64 @@
 // not parseable as runtime modules. esbuild handled this implicitly via
 // its loader table; Rolldown's Oxc parser errors on declaration-only
 // shapes (`get foo(): T;`).
+//
+// DETERMINISM — entry ORDER is an input to the emitted BYTES, so each
+// pattern's expansion is sorted. Rolldown derives every module's and
+// external's exec order from a DFS that starts at the entries IN ORDER
+// (`sort_modules.rs`), and each emitted chunk renders its import statements
+// sorted by that exec order (`compute_cross_chunk_links.rs`) — so a
+// multi-entry `--library` build emits differently-ordered `lib/esm/*.js`
+// import statements when the entry order changes, and every app bundle that
+// inlines those libs (the committed `dist/*.gjs.mjs`) inherits the drift.
+// fast-glob does NOT pin that order: its concurrent directory walker yields
+// matches in COMPLETION order, so sibling directories race (measured: 9
+// distinct orderings in 60 runs over one 6-subdir tree). That race is what
+// made the committed GJS bundles reproduce on CI but not on developer
+// machines (`verify-committed-bundles.mjs`'s `system`/`gi://GioUnix`
+// hoisted-import swap; the `makeCallable`/`mapSysname` module-order
+// divergence noted in release-cut.yml). The sort is `Array.prototype.sort`'s
+// UTF-16 code-unit order — locale-independent, unlike the `strcoll`-based
+// ordering some readdir paths apply. The pattern-LIST order is the user's
+// explicit input (entry execution order) and is preserved; only each
+// pattern's own expansion is canonicalized. Guarded by
+// `packages/infra/cli/src/entry-points.spec.ts` and
+// `tests/e2e/deterministic-library-build/`.
 import fastGlob from 'fast-glob';
 const DEFAULT_IGNORE = ['**/*.d.ts'];
+/** Expand ONE pattern to its lexicographically sorted match list. */
+async function expandPattern(pattern, ignore) {
+    const matched = await fastGlob([pattern], { ignore });
+    return matched.sort();
+}
 export const globToEntryPoints = async (_entryPoints, ignore = []) => {
     if (_entryPoints === undefined)
         return undefined;
     const fullIgnore = [...DEFAULT_IGNORE, ...ignore];
     if (typeof _entryPoints === 'string') {
-        const expanded = await fastGlob([_entryPoints], { ignore: fullIgnore });
-        return expanded;
+        return await expandPattern(_entryPoints, fullIgnore);
     }
     if (Array.isArray(_entryPoints)) {
-        return await fastGlob(_entryPoints, { ignore: fullIgnore });
+        // Per-pattern expansion (not one combined fast-glob call): the
+        // combined call would interleave matches across patterns in walker
+        // order, losing both the sort and the user's pattern order. Overlapping
+        // patterns are deduped like fast-glob's `unique` did — first
+        // occurrence wins.
+        const out = [];
+        const seen = new Set();
+        for (const pattern of _entryPoints) {
+            for (const matched of await expandPattern(pattern, fullIgnore)) {
+                if (!seen.has(matched)) {
+                    seen.add(matched);
+                    out.push(matched);
+                }
+            }
+        }
+        return out;
     }
     const entryPoints = {};
     for (const input in _entryPoints) {
         const output = _entryPoints[input];
-        const inputs = await fastGlob(input, { ignore: fullIgnore });
-        for (const matched of inputs) {
+        for (const matched of await expandPattern(input, fullIgnore)) {
             entryPoints[matched] = output;
         }
     }

package/lib/utils/inline-static-reads.js

@@ -158,7 +158,7 @@ function tryInlineCall(node, ctx, _src) {
         if (hasWithFileTypes(node.arguments[1]))
             return undefined;
         const path = evalPathExpr(node.arguments[0], ctx);
-        if (path && existsSyncSafe(path) && isDirectorySafe(path)) {
+        if (path && existsSync(path) && isDirectorySafe(path)) {
             try {
                 const names = readdirSync(path);
                 return {
@@ -178,7 +178,7 @@ function tryInlineCall(node, ctx, _src) {
             return {
                 start: node.start,
                 end: node.end,
-                replacement: existsSyncSafe(path) ? 'true' : 'false',
+                replacement: existsSync(path) ? 'true' : 'false',
             };
         }
     }
@@ -204,7 +204,7 @@ function tryInlineCall(node, ctx, _src) {
         //    where Node's PnP hooks make `existsSync` return true at build
         //    time but the path doesn't exist under GJS at runtime).
         const isZip = path !== undefined && path.includes('.zip/');
-        if (path !== undefined && (isZip || !existsSyncSafe(path))) {
+        if (path !== undefined && (isZip || !existsSync(path))) {
             return {
                 start: node.start,
                 end: node.end,
@@ -231,7 +231,7 @@ function tryInlineReadFile(node, ctx, forceTextEncoding) {
     const path = evalPathExpr(node.arguments[0], ctx);
     if (!path)
         return undefined;
-    if (!existsSyncSafe(path) || isDirectorySafe(path))
+    if (!existsSync(path) || isDirectorySafe(path))
         return undefined;
     let encoding;
     if (forceTextEncoding) {
@@ -580,14 +580,9 @@ function jsLiteral(v) {
 function jsStringLiteral(s) {
     return JSON.stringify(s);
 }
-function existsSyncSafe(path) {
-    try {
-        return existsSync(path);
-    }
-    catch {
-        return false;
-    }
-}
+// NOTE: `existsSync` needs no wrapper — it never throws by contract (Node
+// returns false on any error, and the GJS/Bun/Deno node:fs shims match).
+// `statSync` below genuinely throws (ENOENT etc.), hence its guarded helper.
 function isDirectorySafe(path) {
     try {
         return statSync(path).isDirectory();

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/rolldown-plugin-gjsify",
-    "version": "0.25.1",
+    "version": "0.26.1",
     "description": "Rolldown / Rollup / Vite plugin orchestrator for GJS, Node, and Browser targets",
     "type": "module",
     "main": "lib/index.js",
@@ -55,11 +55,11 @@
     ],
     "license": "MIT",
     "dependencies": {
-        "@gjsify/console": "^0.25.1",
-        "@gjsify/resolve-npm": "^0.25.1",
-        "@gjsify/rolldown-plugin-deepkit": "^0.25.1",
-        "@gjsify/rolldown-plugin-pnp": "^0.25.1",
-        "@gjsify/vite-plugin-blueprint": "^0.25.1",
+        "@gjsify/console": "^0.26.1",
+        "@gjsify/resolve-npm": "^0.26.1",
+        "@gjsify/rolldown-plugin-deepkit": "^0.26.1",
+        "@gjsify/rolldown-plugin-pnp": "^0.26.1",
+        "@gjsify/vite-plugin-blueprint": "^0.26.1",
         "@rollup/pluginutils": "^5.4.0",
         "acorn": "^8.17.0",
         "acorn-walk": "^8.3.5",
@@ -68,7 +68,7 @@
         "sass": "^1.101.0"
     },
     "peerDependencies": {
-        "@gjsify/lightningcss-native": "^0.25.1",
+        "@gjsify/lightningcss-native": "^0.26.1",
         "rolldown": "^1.1.4"
     },
     "peerDependenciesMeta": {