@gjsify/rolldown-plugin-gjsify 0.36.0 → 0.38.0

package/lib/utils/detect-free-globals.js

@@ -1,107 +1,73 @@
 // Detect free (unbound) global identifiers in bundled JS output.
 //
-// Used by the `--globals auto` two-pass build: the first esbuild pass
-// produces a minified bundle without globals injection, this module
-// parses it with acorn and finds references to known GJS globals that
-// are not locally declared. The result feeds the second pass's inject
-// stub so only actually-needed globals are registered.
+// Drives the `--globals auto` iterative build (`auto-globals.ts`): each analysis pass
+// bundles UNMINIFIED and without injection, this module parses that output with acorn
+// and finds references to known GJS globals that are not locally declared, and the
+// result feeds the next pass's inject stub so only actually-needed globals are
+// registered. Minification is forbidden in those passes because it aliases
+// `globalThis` to a short variable and defeats the MemberExpression patterns below.
 import * as acorn from 'acorn';
 import * as walk from 'acorn-walk';
 import { GJS_GLOBALS_MAP } from '@gjsify/resolve-npm/globals-map';
 const KNOWN_GLOBALS = new Set(Object.keys(GJS_GLOBALS_MAP));
 /**
- * Method markers — `<host>.<method>(…)` patterns that imply a global
- * identifier should be injected even though the identifier itself never
- * appears in the bundle.
+ * `<host>.<method>` patterns that must inject a global even though the identifier
+ * itself never appears in the bundle: a project calling `navigator.getGamepads()`
+ * references no gamepad identifier, yet still needs `@gjsify/gamepad/register` to
+ * patch the method onto `navigator`.
  *
- * Example: a project that calls `navigator.getGamepads()` doesn't reference
- * any of the gamepad-related identifiers in the globals map, but it still
- * needs `@gjsify/gamepad/register` to patch `navigator` with the method.
- * This marker maps `navigator.getGamepads` → inject the `GamepadEvent`
- * register path (which is the gamepad package's register entry).
- *
- * Keyed by `host.method` (lowercase host, exact method name). Values are
- * KNOWN_GLOBALS identifiers — the detector adds them as free globals if
- * the corresponding member expression is found in the bundle.
+ * Keyed `host.method` (exact names); values are KNOWN_GLOBALS identifiers the detector
+ * adds as free globals when the member expression is found.
  */
 const METHOD_MARKERS = {
-    // Gamepad API — navigator.getGamepads is patched on by @gjsify/gamepad/register
+    // Patched on by @gjsify/gamepad/register
     'navigator.getGamepads': 'GamepadEvent',
-    // WebRTC — navigator.mediaDevices is patched on by @gjsify/webrtc/register/media-devices
+    // Patched on by @gjsify/webrtc/register/media-devices
     'navigator.mediaDevices': 'MediaDevices',
-    // WebAssembly Promise APIs — the runtime stubs throw at first call, so
-    // any reference to these methods needs the `@gjsify/webassembly` polyfill.
-    // The register entry replaces the stubs with wrappers around the working
-    // synchronous `new WebAssembly.{Module,Instance}` constructors.
+    // The runtime stubs throw at first call, so any reference needs the
+    // `@gjsify/webassembly` polyfill, whose register replaces them with wrappers around
+    // the working synchronous `new WebAssembly.{Module,Instance}` constructors.
     'WebAssembly.compile': 'WebAssembly',
     'WebAssembly.compileStreaming': 'WebAssembly',
     'WebAssembly.instantiate': 'WebAssembly',
     'WebAssembly.instantiateStreaming': 'WebAssembly',
     'WebAssembly.validate': 'WebAssembly',
-    // Note: URL.createObjectURL / URL.revokeObjectURL don't need markers —
-    // they are first-class static methods on @gjsify/url's URL class, so the
-    // free `URL` identifier (detected directly, maps to
-    // @gjsify/node-globals/register/url in GJS_GLOBALS_MAP) already pulls in
-    // the correct register module.
+    // `URL.createObjectURL`/`revokeObjectURL` need no marker: they are first-class
+    // statics on @gjsify/url's URL class, so the directly-detected free `URL` already
+    // pulls the right register module.
 };
 /**
- * wasm-bindgen-generated function-name patterns that imply a global
- * identifier should be injected. wasm-bindgen emits its host-API
- * import bindings as top-level functions named
- * `__wbg_<jsName>_<hash>` where `<jsName>` is the property name of the
- * JS API the WASM module wants to call. The body looks like:
- *
- *     function __wbg_crypto_574e78ad8b13b65f(arg0) {
- *         const ret = getObject(arg0).crypto;
- *         return addHeapObject(ret);
- *     }
- *
- * `getObject(arg0)` is a runtime heap dereference (the object is one
- * of the host bridges registered by wasm-bindgen at init time —
- * typically `globalThis`, `window`, or `self`). The MemberExpression
- * visitor can't follow that — `node.object` is a CallExpression, not
- * an Identifier — so the underlying `.crypto` access is invisible to
- * the static scan.
+ * wasm-bindgen function-name patterns that must inject a global. wasm-bindgen emits its
+ * host-API import bindings as top-level `__wbg_<jsName>_<hash>` functions whose body is
+ * `getObject(arg0).<jsName>` — a runtime heap dereference the MemberExpression visitor
+ * cannot follow (`node.object` is a CallExpression), so the underlying property access
+ * is invisible to the static scan.
  *
- * Matching on the FUNCTION-NAME pattern instead is high precision
- * (no false positives — `__wbg_` is wasm-bindgen-reserved) and high
- * recall (the names are extremely stable across wasm-bindgen
- * versions). Add an entry whenever a new wasm-bindgen-built npm
- * package surfaces a needed global that the static scan misses.
- *
- * Keyed by the `<jsName>` extracted from the `__wbg_<jsName>_<hash>`
- * function name; value is the gjsify global to inject.
+ * Matching the FUNCTION NAME instead is high precision (`__wbg_` is
+ * wasm-bindgen-reserved) and high recall (the names are stable across versions). Add an
+ * entry whenever a wasm-bindgen-built package needs a global the scan misses. Keyed by
+ * `<jsName>`; value is the gjsify global to inject.
  */
 const WASM_BINDGEN_MARKERS = {
-    // crypto.getRandomValues chain — wasm-bindgen's canonical
-    // crypto-import binding pattern. Used by ed25519-dalek, ring, rand
-    // (when targeting wasm), and most Rust crates that touch
-    // randomness or hashing. Loro is the driving real-world consumer:
-    // its CRDT operations need crypto.getRandomValues for peer-id
-    // generation and ChangeID nonces.
+    // wasm-bindgen's canonical crypto-import binding chain — ed25519-dalek, ring, rand
+    // and most Rust crates touching randomness or hashing. Loro drives it: its CRDT ops
+    // need crypto.getRandomValues for peer ids and ChangeID nonces.
     crypto: 'crypto',
     getRandomValues: 'crypto',
-    // Legacy IE prefix path — wasm-bindgen probes for `msCrypto` as a
-    // fallback when `crypto` isn't available. Doesn't apply to GJS
-    // (we ship a real `crypto`), but flagging the marker keeps the
-    // detector self-documenting.
+    // Legacy IE fallback wasm-bindgen probes when `crypto` is absent. Irrelevant to GJS
+    // (we ship a real `crypto`); mapped so the marker set is self-documenting.
     msCrypto: 'crypto',
 };
 /**
- * Match the wasm-bindgen function-name shape — return the `<jsName>`
- * part of `__wbg_<jsName>_<hash>` or `null`. wasm-bindgen hashes are
- * 8–16 hex chars in practice, but we accept any alphanumeric trailer
- * so the pattern survives future format tweaks.
+ * The `<jsName>` part of `__wbg_<jsName>_<hash>`, or null. Hashes are 8–16 hex chars in
+ * practice; any alphanumeric trailer is accepted so the pattern survives format tweaks.
  */
 const WBG_NAME_RE = /^__wbg_([A-Za-z][A-Za-z0-9]*)_[A-Za-z0-9]+$/;
 function wbgJsNameFor(fnName) {
     const match = fnName.match(WBG_NAME_RE);
     return match?.[1] ?? null;
 }
-/**
- * Extract all bound names from a binding pattern
- * (Identifier, ObjectPattern, ArrayPattern, AssignmentPattern, RestElement).
- */
+/** Every name bound by a binding pattern. */
 function extractBindingNames(node) {
     if (!node)
         return [];
@@ -123,10 +89,20 @@ function extractBindingNames(node) {
     }
 }
 /**
- * Core scanner shared by `detectFreeGlobals` (web/Node globals map) and
- * `detectGjsAmbientGlobals` (the `--app node` GJS-ambient set). Parametrised so
- * the GJS path stays byte-identical while the node path can use a different
- * known-globals set + the stricter host-member typeof handling.
+ * Core scanner behind `detectFreeGlobals` (web/Node globals map) and
+ * `detectGjsAmbientGlobals` (the `--app node` GJS-ambient set), parametrised so the node
+ * path can use a different known-globals set and the stricter host-member handling.
+ *
+ * "Free" = referenced but never declared in the module
+ * (var/let/const/function/class/import/param/catch).
+ *
+ * A `typeof X` presence-check guard (`typeof document !== 'undefined'`) that is the SOLE
+ * occurrence of `X` does NOT count as a use. Such guards are pervasive in isomorphic npm
+ * packages; on GJS the guarded branch is dead, but a bundler cannot DCE a `typeof`
+ * expression since its value depends on the runtime. Injecting for one of those can hard-
+ * error the analysis bundle when the polyfill package is not installed. If `X` also
+ * appears in a genuine reference position the injection still fires; the resolvability
+ * gate in `auto-globals.ts` covers the remaining case.
  */
 function scanFreeGlobals(code, opts) {
     const knownGlobals = opts.knownGlobals;
@@ -135,14 +111,11 @@ function scanFreeGlobals(code, opts) {
     const ast = acorn.parse(code, {
         ecmaVersion: 'latest',
         sourceType: 'module',
-        // Some bundled chunks carry an embedded `#!shebang` line —
-        // notably any project bundling its own CLI gets the
-        // `#!/usr/bin/env -S gjs -m` shebang hoisted to byte 0.
-        // Acorn rejects shebangs by default; allow them so the
-        // free-globals analyzer doesn't choke on its own input.
+        // Acorn rejects shebangs by default, and any project bundling its own CLI gets
+        // one hoisted to byte 0.
         allowHashBang: true,
     });
-    // --- Pass 1: collect all declared names across the entire module ---
+    // Pass 1: every declared name in the module.
     const declaredNames = new Set();
     walk.simple(ast, {
         VariableDeclarator(node) {
@@ -196,24 +169,17 @@ function scanFreeGlobals(code, opts) {
             }
         },
     });
-    // --- Pass 2: find Identifier nodes in reference position ---
-    // Also detects MemberExpressions like `globalThis.X` / `global.X` /
-    // `window.X` / `self.X` where X is a known global. esbuild's `define`
-    // config replaces `global`/`window` with `globalThis`, but we accept
-    // all four host-object names for safety (esbuild also never renames
-    // these because they are language keywords / pre-defined globals).
+    // Pass 2: Identifier nodes in reference position, plus `host.X` MemberExpressions
+    // where X is a known global. `transform.define` already maps `global`/`window` to
+    // `globalThis`, but every host-object name is accepted for safety.
     const freeGlobals = new Set();
-    // Globals seen only inside `typeof X` expressions so far. Moved into
-    // freeGlobals the moment the same name is detected in a real-use
-    // position. Names that remain here at the end were only ever
-    // presence-checked — not genuinely used — and are excluded from the
-    // injection set (see JSDoc above).
+    // Globals seen ONLY inside `typeof X` so far; promoted to freeGlobals the moment the
+    // name appears in a real-use position, and excluded from injection if it never does.
     const typeofGuardGlobals = new Set();
     const HOST_OBJECTS = new Set(['globalThis', 'global', 'window', 'self', 'globalObject']);
     walk.ancestor(ast, {
         MemberExpression(node) {
-            // Only dot-access — skip computed (bracket) access since the
-            // property is then a dynamic Expression, not a known name.
+            // Dot-access only: a computed property is a dynamic Expression, not a name.
             if (node.computed)
                 return;
             if (node.object.type !== 'Identifier')
@@ -222,12 +188,8 @@ function scanFreeGlobals(code, opts) {
                 return;
             const objName = node.object.name;
             const propName = node.property.name;
-            // Pattern A: globalThis.X / global.X / window.X / self.X
-            // The property is a known global identifier itself.
+            // Pattern A: `<host>.X` where the property is itself a known global.
             if (HOST_OBJECTS.has(objName)) {
-                // The node GJS-ambient detector ignores host-member forms — they
-                // are the isomorphic-guard shape, not genuine GJS source (see
-                // `ignoreHostMembers`). Bare-identifier detection still applies.
                 if (opts.ignoreHostMembers)
                     return;
                 if (knownGlobals.has(propName)) {
@@ -235,10 +197,7 @@ function scanFreeGlobals(code, opts) {
                 }
                 return;
             }
-            // Pattern B: known-instance method markers like
-            // `navigator.getGamepads` → marker map forwards to a global
-            // identifier that triggers the right register path even though
-            // the identifier itself never appears in the bundle.
+            // Pattern B: METHOD_MARKERS.
             const markerKey = `${objName}.${propName}`;
             const markerTarget = methodMarkers[markerKey];
             if (markerTarget && knownGlobals.has(markerTarget)) {
@@ -246,13 +205,8 @@ function scanFreeGlobals(code, opts) {
             }
         },
         FunctionDeclaration(node) {
-            // Pattern C: wasm-bindgen marker hook. The function name
-            // matches `__wbg_<jsName>_<hash>` and `<jsName>` is a known
-            // host API. The body would be `getObject(arg0).<jsName>` —
-            // an unfollowable runtime heap dereference — but the
-            // function NAME tells us exactly which global is needed.
-            // See WASM_BINDGEN_MARKERS for the why + which jsNames are
-            // mapped.
+            // Pattern C: WASM_BINDGEN_MARKERS, keyed on the function NAME because the
+            // body's property access is an unfollowable heap dereference.
             if (!node.id)
                 return;
             const jsName = wbgJsNameFor(node.id.name);
@@ -265,14 +219,11 @@ function scanFreeGlobals(code, opts) {
         },
         Identifier(node, ancestors) {
             const name = node.name;
-            // Quick filter: only check known globals
             if (!knownGlobals.has(name))
                 return;
-            // Skip if locally declared
             if (declaredNames.has(name))
                 return;
-            // Determine if this Identifier is in a reference position
-            // by checking the parent node.
+            // Reference position is decided from the parent node.
             const parent = ancestors[ancestors.length - 2];
             if (!parent) {
                 freeGlobals.add(name);
@@ -293,7 +244,6 @@ function scanFreeGlobals(code, opts) {
                         return;
                     break;
                 }
-                // Method/property definitions in classes
                 case 'MethodDefinition':
                 case 'PropertyDefinition': {
                     const def = parent;
@@ -315,8 +265,7 @@ function scanFreeGlobals(code, opts) {
                         return;
                     break;
                 }
-                // Declaration ids (function name, class name, variable id)
-                // are already in declaredNames, but guard anyway
+                // Declaration ids are already in declaredNames; guarded anyway.
                 case 'FunctionDeclaration':
                 case 'FunctionExpression':
                 case 'ClassDeclaration':
@@ -332,15 +281,11 @@ function scanFreeGlobals(code, opts) {
                         return;
                     break;
                 }
-                // import { X } / import X — already in declaredNames
                 case 'ImportSpecifier':
                 case 'ImportDefaultSpecifier':
                 case 'ImportNamespaceSpecifier':
                     return;
-                // `typeof X` — presence-check guard. Defer: record in the
-                // typeof-guard set and only promote to freeGlobals if the
-                // same name also appears in a real-use position elsewhere
-                // in the bundle. See JSDoc on detectFreeGlobals.
+                // `typeof X` — presence-check guard, deferred until a real use shows up.
                 case 'UnaryExpression': {
                     const unary = parent;
                     if (unary.operator === 'typeof') {
@@ -352,8 +297,7 @@ function scanFreeGlobals(code, opts) {
                     break;
                 }
             }
-            // Real-use position. Promote from typeofGuardGlobals if
-            // this name was previously seen only as a typeof argument.
+            // Real use — promote out of the typeof-guard set.
             typeofGuardGlobals.delete(name);
             freeGlobals.add(name);
         },
@@ -361,9 +305,8 @@ function scanFreeGlobals(code, opts) {
     return freeGlobals;
 }
 /**
- * Parse bundled JS output and return the set of free (unbound) identifiers that
- * match the known web/Node GJS globals from `GJS_GLOBALS_MAP`. Drives the
- * `--app gjs --globals auto` injection. See `scanFreeGlobals` for the rules.
+ * Free identifiers in bundled output that match the known web/Node globals in
+ * `GJS_GLOBALS_MAP` — drives `--app gjs --globals auto`. Rules: `scanFreeGlobals`.
  */
 export function detectFreeGlobals(code) {
     return scanFreeGlobals(code, {
@@ -373,14 +316,9 @@ export function detectFreeGlobals(code) {
     });
 }
 /**
- * The GJS ambient globals that exist implicitly under gjs but not on Node:
- * `print`/`printerr`/`log`/`logError`, the `ARGV` array, and the legacy
- * `imports` object (`imports.gi.Gtk`, `imports.system`, `imports.gettext`).
- * `@gjsify/node-gi/globals` seeds these on `globalThis` when imported.
- *
- * This is the REVERSE of `GJS_GLOBALS_MAP` (which maps Node/Web globals onto
- * GJS): it's the set the `--app node` target injects the node-gi globals shim
- * for. Kept here next to the detector so the two never drift.
+ * The globals that exist implicitly under gjs but not on Node, seeded on `globalThis` by
+ * `@gjsify/node-gi/globals`. The REVERSE of `GJS_GLOBALS_MAP`: the set whose presence
+ * makes `--app node` inject that shim. Kept beside the detector so the two never drift.
  */
 export const GJS_AMBIENT_GLOBALS = new Set([
     'print',
@@ -391,21 +329,12 @@ export const GJS_AMBIENT_GLOBALS = new Set([
     'imports',
 ]);
 /**
- * Detect references to the GJS ambient globals (`GJS_AMBIENT_GLOBALS`) in a
- * bundled `--app node` chunk — the signal that the bundle needs
- * `@gjsify/node-gi/globals` injected.
+ * References to `GJS_AMBIENT_GLOBALS` in a bundled `--app node` chunk — the signal that
+ * the bundle needs `@gjsify/node-gi/globals`.
  *
- * Runs on the bundled output AFTER tree-shaking (same property the GJS path
- * relies on), so a `print`/`imports` reference behind a statically-dead branch
- * does not trigger injection. Detects only BARE free identifiers — the genuine
- * GJS-source shape (`print(...)`, `imports.gi.Gtk`). The `globalThis.imports` /
- * `globalThis.print` host-member form is the cross-platform isomorphic-GUARD
- * shape (`if (typeof globalThis.imports !== 'undefined') { … }`) and is
- * deliberately ignored: injecting `@gjsify/node-gi/globals` for it would break
- * plain-Node loadability of a package that merely gates GJS usage (the bare
- * external import is unresolvable without node-gi; the shim eagerly loads the
- * native addon). Pure `typeof imports` probes are deferred too. See
- * `ignoreHostMembers`.
+ * Runs on the output AFTER tree-shaking, so a reference behind a statically-dead branch
+ * does not trigger injection, and matches only BARE identifiers (`print(...)`,
+ * `imports.gi.Gtk`) — see `ignoreHostMembers` for why the host-member form is ignored.
  */
 export function detectGjsAmbientGlobals(code) {
     return scanFreeGlobals(code, {
@@ -413,25 +342,21 @@ export function detectGjsAmbientGlobals(code) {
         ignoreHostMembers: true,
     });
 }
-/** The node-gi reverse-bridge package every `--app node` GJS shim resolves to. */
 import { ALIASES_GJS_FOR_NODE } from '@gjsify/resolve-npm';
+/** The node-gi reverse-bridge package every `--app node` GJS shim resolves to. */
 const NODE_GI_PACKAGE = '@gjsify/node-gi';
 /**
- * The BARE GJS built-ins, i.e. the PRE-ALIAS spelling of the same fact.
- * Derived from the alias table so the two cannot drift.
- *
- * Why both spellings must count: the analysis pass that calls this runs with
- * `nodeGiGlobalsInject` still FALSE, so the GJS-source routing that rewrites
- * `system` → `@gjsify/node-gi/system` has not happened yet. Looking only for
- * the aliased form makes the signal appear only AFTER the decision it is
- * supposed to trigger — chicken-and-egg, and the same shape as the bug this
- * detector was added to fix.
+ * The BARE GJS built-ins — the PRE-ALIAS spelling of the same fact, derived from the
+ * alias table so the two cannot drift.
  *
- * Measured (CI, adwaita-storybook `--app node`): the FINAL bundle carries
- * `import e from "@gjsify/node-gi/system"` and zero `gi://`, because the
- * inject never fired, `@girs/*` were emptied to `{}`, and nothing was left to
- * rewrite. The bundle then passes `node --check` and dies at runtime with
- * `class extends undefined`.
+ * Both spellings must count because the analysis pass that calls this runs with
+ * `nodeGiGlobalsInject` still FALSE: the routing that rewrites `system` →
+ * `@gjsify/node-gi/system` has not happened yet, so looking only for the aliased form
+ * makes the signal appear AFTER the decision it is supposed to trigger. Measured on
+ * adwaita-storybook `--app node`: the final bundle carried `import e from
+ * "@gjsify/node-gi/system"` and zero `gi://` — inject never fired, `@girs/*` were
+ * emptied to `{}`, nothing was left to rewrite. It passes `node --check` and dies at
+ * runtime with `class extends undefined`.
  */
 const GJS_BARE_BUILTINS = new Set(Object.keys(ALIASES_GJS_FOR_NODE));
 /**
@@ -446,30 +371,26 @@ function isNodeGiSpecifier(source) {
     return GJS_BARE_BUILTINS.has(source);
 }
 /**
- * Detect a STATIC import of `@gjsify/node-gi` (root or any subpath) in a
- * bundled `--app node` chunk — the second genuine-GJS-source signal next to
- * `detectGjsAmbientGlobals`.
+ * A STATIC import of `@gjsify/node-gi` (root or subpath) in a bundled `--app node`
+ * chunk — the second genuine-GJS-source signal beside `detectGjsAmbientGlobals`.
  *
- * Why this is a signal: the bare GJS built-in modules (`system`/`gettext`/
- * `cairo`) are rewritten to `@gjsify/node-gi/<name>` and kept EXTERNAL as
- * top-level import statements, so any bundle whose tree-shaken graph retains
- * one is ALREADY bound to the bridge at load — Node resolves the external at
- * link time and fails without node-gi installed. Treating that bundle as a
- * GJS-source build therefore cannot cost plain-Node loadability; NOT treating
- * it as one is how a portable GJS app that spells `ARGV` as
- * `system.programArgs` (the AGENTS.md-mandated spelling) lost its `@girs/*`
- * bodies and its globals shim in one go — `gjsify storybook --runtime node`
- * emitted a bundle with no `requireGi` at all.
+ * It is a signal because the bare GJS built-ins are rewritten to
+ * `@gjsify/node-gi/<name>` and kept EXTERNAL as top-level imports: a tree-shaken graph
+ * that retains one is ALREADY bound to the bridge at load (Node resolves the external
+ * at link time and fails without node-gi), so treating it as a GJS-source build cannot
+ * cost plain-Node loadability. NOT treating it as one is how a portable GJS app
+ * spelling `ARGV` as `system.programArgs` lost its `@girs/*` bodies and its globals
+ * shim in one go — `gjsify storybook --runtime node` emitted a bundle with no
+ * `requireGi` at all.
  *
- * Why a surviving `gi://` import is deliberately NOT a signal: its shim loads
- * node-gi LAZILY through a `require('@gjsify/node-gi/gi')` CALL — not an import
- * statement, so this scan is structurally blind to it, by design. A
- * cross-platform package with a gjs-gated `gi://` import stays loadable on
- * plain Node (the #641 lesson, pinned by `tests/e2e/node-gi-globals-inject`),
- * and flipping injection for it would break exactly that.
+ * A surviving `gi://` import is deliberately NOT a signal: its shim loads node-gi LAZILY
+ * through a `require('@gjsify/node-gi/gi')` CALL, so this scan is structurally blind to
+ * it by design. A cross-platform package with a gjs-gated `gi://` import stays loadable
+ * on plain Node (#641, pinned by `tests/e2e/node-gi-globals-inject`), and flipping
+ * injection for it would break exactly that.
  *
- * Scans import/re-export STATEMENTS via the AST (never text), so a quoted
- * `'@gjsify/node-gi/system'` inside a test name or template cannot trigger.
+ * Scans import/re-export STATEMENTS via the AST, never text, so a quoted specifier in a
+ * test name or template cannot trigger.
  */
 export function detectNodeGiModuleImports(code) {
     const ast = acorn.parse(code, {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/rolldown-plugin-gjsify",
-    "version": "0.36.0",
+    "version": "0.38.0",
     "description": "Rolldown / Rollup / Vite plugin orchestrator for GJS, Node, and Browser targets",
     "type": "module",
     "main": "lib/index.js",
@@ -55,11 +55,11 @@
     ],
     "license": "MIT",
     "dependencies": {
-        "@gjsify/console": "^0.36.0",
-        "@gjsify/resolve-npm": "^0.36.0",
-        "@gjsify/rolldown-plugin-deepkit": "^0.36.0",
-        "@gjsify/rolldown-plugin-pnp": "^0.36.0",
-        "@gjsify/vite-plugin-blueprint": "^0.36.0",
+        "@gjsify/console": "^0.38.0",
+        "@gjsify/resolve-npm": "^0.38.0",
+        "@gjsify/rolldown-plugin-deepkit": "^0.38.0",
+        "@gjsify/rolldown-plugin-pnp": "^0.38.0",
+        "@gjsify/vite-plugin-blueprint": "^0.38.0",
         "@rollup/pluginutils": "^5.4.0",
         "acorn": "^8.17.0",
         "acorn-walk": "^8.3.5",
@@ -68,7 +68,7 @@
         "sass": "^1.101.0"
     },
     "peerDependencies": {
-        "@gjsify/lightningcss-native": "^0.36.0",
+        "@gjsify/lightningcss-native": "^0.38.0",
         "rolldown": "^1.1.4"
     },
     "peerDependenciesMeta": {