@gjsify/rolldown-plugin-gjsify 0.4.21 → 0.4.23

package/lib/utils/detect-free-globals.js

@@ -44,6 +44,60 @@ const METHOD_MARKERS = {
     // @gjsify/node-globals/register/url in GJS_GLOBALS_MAP) already pulls in
     // the correct register module.
 };
+/**
+ * wasm-bindgen-generated function-name patterns that imply a global
+ * identifier should be injected. wasm-bindgen emits its host-API
+ * import bindings as top-level functions named
+ * `__wbg_<jsName>_<hash>` where `<jsName>` is the property name of the
+ * JS API the WASM module wants to call. The body looks like:
+ *
+ *     function __wbg_crypto_574e78ad8b13b65f(arg0) {
+ *         const ret = getObject(arg0).crypto;
+ *         return addHeapObject(ret);
+ *     }
+ *
+ * `getObject(arg0)` is a runtime heap dereference (the object is one
+ * of the host bridges registered by wasm-bindgen at init time —
+ * typically `globalThis`, `window`, or `self`). The MemberExpression
+ * visitor can't follow that — `node.object` is a CallExpression, not
+ * an Identifier — so the underlying `.crypto` access is invisible to
+ * the static scan.
+ *
+ * Matching on the FUNCTION-NAME pattern instead is high precision
+ * (no false positives — `__wbg_` is wasm-bindgen-reserved) and high
+ * recall (the names are extremely stable across wasm-bindgen
+ * versions). Add an entry whenever a new wasm-bindgen-built npm
+ * package surfaces a needed global that the static scan misses.
+ *
+ * Keyed by the `<jsName>` extracted from the `__wbg_<jsName>_<hash>`
+ * function name; value is the gjsify global to inject.
+ */
+const WASM_BINDGEN_MARKERS = {
+    // crypto.getRandomValues chain — wasm-bindgen's canonical
+    // crypto-import binding pattern. Used by ed25519-dalek, ring, rand
+    // (when targeting wasm), and most Rust crates that touch
+    // randomness or hashing. Loro is the driving real-world consumer:
+    // its CRDT operations need crypto.getRandomValues for peer-id
+    // generation and ChangeID nonces.
+    crypto: 'crypto',
+    getRandomValues: 'crypto',
+    // Legacy IE prefix path — wasm-bindgen probes for `msCrypto` as a
+    // fallback when `crypto` isn't available. Doesn't apply to GJS
+    // (we ship a real `crypto`), but flagging the marker keeps the
+    // detector self-documenting.
+    msCrypto: 'crypto',
+};
+/**
+ * Match the wasm-bindgen function-name shape — return the `<jsName>`
+ * part of `__wbg_<jsName>_<hash>` or `null`. wasm-bindgen hashes are
+ * 8–16 hex chars in practice, but we accept any alphanumeric trailer
+ * so the pattern survives future format tweaks.
+ */
+const WBG_NAME_RE = /^__wbg_([A-Za-z][A-Za-z0-9]*)_[A-Za-z0-9]+$/;
+function wbgJsNameFor(fnName) {
+    const match = fnName.match(WBG_NAME_RE);
+    return match?.[1] ?? null;
+}
 /**
  * Extract all bound names from a binding pattern
  * (Identifier, ObjectPattern, ArrayPattern, AssignmentPattern, RestElement).
@@ -192,6 +246,24 @@ export function detectFreeGlobals(code) {
                 freeGlobals.add(markerTarget);
             }
         },
+        FunctionDeclaration(node) {
+            // Pattern C: wasm-bindgen marker hook. The function name
+            // matches `__wbg_<jsName>_<hash>` and `<jsName>` is a known
+            // host API. The body would be `getObject(arg0).<jsName>` —
+            // an unfollowable runtime heap dereference — but the
+            // function NAME tells us exactly which global is needed.
+            // See WASM_BINDGEN_MARKERS for the why + which jsNames are
+            // mapped.
+            if (!node.id)
+                return;
+            const jsName = wbgJsNameFor(node.id.name);
+            if (!jsName)
+                return;
+            const target = WASM_BINDGEN_MARKERS[jsName];
+            if (target && KNOWN_GLOBALS.has(target)) {
+                freeGlobals.add(target);
+            }
+        },
         Identifier(node, ancestors) {
             const name = node.name;
             // Quick filter: only check known globals

package/lib/utils/inline-static-reads.js

@@ -151,6 +151,12 @@ function tryInlineCall(node, ctx, src) {
         }
     }
     if (calleeName === 'readdirSync') {
+        // We inline as a plain string[] — refuse if the caller asks for
+        // Dirent[] via { withFileTypes: true }. Otherwise the consumer's
+        // child.isFile() call would throw at runtime ("isFile is not a
+        // function" on a string).
+        if (hasWithFileTypes(node.arguments[1]))
+            return undefined;
         const path = evalPathExpr(node.arguments[0], ctx);
         if (path && existsSyncSafe(path) && isDirectorySafe(path)) {
             try {
@@ -476,6 +482,30 @@ function evalEncodingExpr(node) {
     }
     return undefined;
 }
+/**
+ * Detect `{ withFileTypes: true }` in a readdirSync options argument.
+ * Any non-literal or absence returns `false` (safe — we only abort
+ * inlining for an unambiguous `true`).
+ */
+function hasWithFileTypes(node) {
+    if (!node || node.type !== 'ObjectExpression')
+        return false;
+    for (const p of node.properties) {
+        if (p.type !== 'Property' || p.computed)
+            continue;
+        const key = p.key.type === 'Identifier'
+            ? p.key.name
+            : p.key.type === 'Literal'
+                ? String(p.key.value)
+                : undefined;
+        if (key !== 'withFileTypes')
+            continue;
+        if (p.value.type === 'Literal' && p.value.value === true)
+            return true;
+        return false;
+    }
+    return false;
+}
 function canonicalEncoding(v) {
     const lc = v.toLowerCase();
     if (lc === 'utf8' || lc === 'utf-8')
@@ -488,12 +518,20 @@ function canonicalEncoding(v) {
 }
 /**
  * Get the leaf identifier name of a callee. Recognises:
- *   `foo`               → "foo"
- *   `path.foo`          → "foo"
- *   `node:path.foo`     → "foo" (rare)
- *   `fs.foo` / `fs.promises.foo` → "foo"
+ *   `foo`               → "foo"          (assumed named import)
+ *   `path.foo`          → "foo"          (path module namespace/default import)
+ *   `fs.foo`            → "foo"          (fs module — caller validates context)
+ *
+ * For MemberExpression callees, the object identifier is restricted to a
+ * known module namespace name (`path`, `fs`, `JSON`). Otherwise `arr.join(',')`
+ * (Array.prototype.join) would resolve to `path.join`, and our static
+ * evaluator would happily treat a free `dir.join('/')` array call as
+ * `path.join('/')` → `'/'` → catastrophic root-directory scan. See PR for
+ * the TypeDoc bundling incident this prevents.
+ *
  * Returns `undefined` for computed/dynamic callees.
  */
+const PATH_NAMESPACE_OBJECTS = new Set(['path', 'fs']);
 function identifierName(node) {
     if (!node)
         return undefined;
@@ -501,8 +539,17 @@ function identifierName(node) {
         return node.name;
     if (node.type === 'MemberExpression' && !node.computed) {
         const me = node;
-        if (me.property.type === 'Identifier')
-            return me.property.name;
+        if (me.property.type !== 'Identifier')
+            return undefined;
+        // The object must be a known namespace identifier — otherwise we
+        // misidentify Array.prototype methods (`arr.join`, `arr.includes`)
+        // and userland method calls as path/fs functions.
+        if (me.object.type !== 'Identifier')
+            return undefined;
+        const obj = me.object.name;
+        if (!PATH_NAMESPACE_OBJECTS.has(obj))
+            return undefined;
+        return me.property.name;
     }
     return undefined;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/rolldown-plugin-gjsify",
-    "version": "0.4.21",
+    "version": "0.4.23",
     "description": "Rolldown / Rollup / Vite plugin orchestrator for GJS, Node, and Browser targets",
     "type": "module",
     "main": "lib/index.js",
@@ -45,11 +45,11 @@
     ],
     "license": "MIT",
     "dependencies": {
-        "@gjsify/console": "^0.4.21",
-        "@gjsify/resolve-npm": "^0.4.21",
-        "@gjsify/rolldown-plugin-deepkit": "^0.4.21",
-        "@gjsify/rolldown-plugin-pnp": "^0.4.21",
-        "@gjsify/vite-plugin-blueprint": "^0.4.21",
+        "@gjsify/console": "^0.4.23",
+        "@gjsify/resolve-npm": "^0.4.23",
+        "@gjsify/rolldown-plugin-deepkit": "^0.4.23",
+        "@gjsify/rolldown-plugin-pnp": "^0.4.23",
+        "@gjsify/vite-plugin-blueprint": "^0.4.23",
         "@rollup/pluginutils": "^5.3.0",
         "acorn": "^8.16.0",
         "acorn-walk": "^8.3.5",
@@ -57,7 +57,7 @@
         "lightningcss": "^1.32.0"
     },
     "peerDependencies": {
-        "@gjsify/lightningcss-native": "^0.4.21",
+        "@gjsify/lightningcss-native": "^0.4.23",
         "rolldown": "^1.0.0-rc.18"
     },
     "peerDependenciesMeta": {
@@ -69,7 +69,7 @@
         }
     },
     "devDependencies": {
-        "@types/node": "^25.6.2",
+        "@types/node": "^25.9.1",
         "rolldown": "^1.0.0",
         "typescript": "^6.0.3"
     }