@gjsify/rolldown-plugin-gjsify 0.41.0 → 0.43.0

package/lib/plugins/rewrite-node-modules-paths.js

@@ -18,6 +18,12 @@
 //
 // Hosted as a `transform(code, id)` hook with `order: 'post'`: after the
 // deepkit/blueprint/css pre-transforms, still during module loading, before chunking.
+//
+// TWO SCOPES, one transform. The four cases above are node_modules-only, because
+// they are about a file whose recorded location stopped being true. The static-read
+// INLINER that runs alongside them is not: it folds build-time-resolvable reads in
+// ANY source, first-party included, and it was trapped inside the node_modules gate
+// until 2026-08-22 — see `shouldInline` for the incident that measured the cost.
 import { createRequire } from 'node:module';
 import { dirname, join, relative, resolve } from 'node:path';
 import { inlineStaticReads } from '../utils/inline-static-reads.js';
@@ -39,6 +45,40 @@ export function shouldRewrite(path) {
         return false;
     return true;
 }
+/**
+ * True when the static-read INLINER wants to look at this path — any supported
+ * source, first-party included.
+ *
+ * Deliberately wider than {@link shouldRewrite}, because the two answer different
+ * questions. The inliner asks *is this read resolvable at build time*, which is a
+ * property of the expression and can be true in any file. The rewriter asks *does
+ * this file's `import.meta.url` still mean anything once bundled*, which is only
+ * worth asking of a file whose original location was `node_modules` — the whole
+ * subject of this plugin.
+ *
+ * They were ONE gate until 2026-08-22, and the cost was silent. Each of
+ * `@gjsify/cli`'s own six `readFileSync(new URL(<literal>, import.meta.url))`
+ * template loaders shipped into `dist/cli.gjs.mjs` as a LIVE read pointing at a
+ * `templates/` directory that exists neither in the repo (the sources are in
+ * `src/templates/`; the build copies them to `lib/templates/`) nor in the
+ * published tarball (`files` ships `lib`, not a root `templates`). Measured on a
+ * fresh build: `gjs -m dist/cli.gjs.mjs ship --stage` died with
+ * `ENOENT … packages/infra/cli/templates/app/desktop.tmpl` while the identical
+ * command through `lib/index.js` staged the desktop entry. Two of those six files
+ * carry a comment asserting the inliner handles them, so reading the code
+ * confirmed the belief rather than the behaviour.
+ *
+ * Consequence for a CONSUMER's build, stated because it is a behaviour change: a
+ * statically resolvable read in their own source is baked into their bundle too.
+ * That is the promise the inliner exists to make — a bundle that survives leaving
+ * its build site — and a read meant to stay dynamic keeps working by not being
+ * statically resolvable, since anything the evaluator cannot fold is left alone.
+ */
+export function shouldInline(path) {
+    if (!REWRITE_FILTER.test(path))
+        return false;
+    return !GJSIFY_SHIM_RE.test(path);
+}
 /** The directory the bundle's outfile lives in, from `output.file` or `output.dir`. */
 export function getBundleDirFromOutput(opts) {
     const outFile = opts.file ?? join(opts.dir ?? '.', 'bundle.mjs');
@@ -265,6 +305,11 @@ export function rewriteContents(args, srcInput, bundleDir, runtimeResolve) {
 /**
  * Build a Rolldown plugin that runs the path rewriter as a `transform(code, id)`
  * hook with `order: 'post'`.
+ *
+ * Two scopes in one transform, not two plugins: a second transform would parse
+ * every module a second time, and the inliner's own fast path (skip unless the
+ * source mentions `readFileSync`/`readdirSync`/`existsSync`) already makes the
+ * wider scope nearly free. See {@link shouldInline} for why the scopes differ.
  */
 export function nodeModulesPathRewritePlugin(options) {
     const runtimeResolve = options.runtimeResolve ?? false;
@@ -274,12 +319,19 @@ export function nodeModulesPathRewritePlugin(options) {
             order: 'post',
             filter: { id: REWRITE_FILTER },
             handler(code, id) {
-                if (!id.includes('node_modules'))
-                    return null;
-                const result = rewriteContents({ path: id }, code, options.bundleDir, runtimeResolve);
-                if (!result)
+                if (id.includes('node_modules')) {
+                    const result = rewriteContents({ path: id }, code, options.bundleDir, runtimeResolve);
+                    if (!result)
+                        return null;
+                    return { code: result.code, map: null };
+                }
+                // First-party source: inline statically resolvable reads, and
+                // nothing else. `import.meta.url` here is not rewritten — that
+                // is the node_modules question this plugin was written for.
+                if (!shouldInline(id))
                     return null;
-                return { code: result.code, map: null };
+                const inlined = inlineStaticReads(code, id);
+                return inlined.inlined > 0 ? { code: inlined.contents, map: null } : null;
             },
         },
     };

package/lib/plugins/unresolved-workspace-import.d.ts

@@ -16,6 +16,43 @@ export interface WorkspaceImportGuardOptions {
      * (plus exact-name membership) so the two cannot drift.
      */
     isExternal?: (id: string) => boolean;
+    /**
+     * Last-resort anchor for a `@gjsify/*` the PROJECT cannot resolve — set only
+     * when the thing being bundled is TOOLCHAIN rather than user code, and unset
+     * for every ordinary `gjsify build`.
+     *
+     * A repo build script (`node scripts/x.mjs`, re-entered as `gjsify run
+     * --node-script` on a Node-less host) does not need the WORKSPACE's copy of
+     * `@gjsify/fs` — it needs a working one. Anchored at the script, resolution
+     * finds the workspace symlink, whose `lib/esm` a cold clone has not built
+     * yet; anchored additionally at the running CLI, it finds the copy installed
+     * beside it, which is built by construction.
+     *
+     * Measured on postmarketOS/aarch64 (gjs 1.88.1, no node): without this the
+     * ADR 0002 bootstrap fails at its third step, because `--globals auto` pulls
+     * the whole `@gjsify/<pkg>/register` closure into a one-line script (the
+     * count and the incident are in this package's AGENTS.md § toolchainAnchor).
+     * The alternative is building most of the polyfill tree before the first
+     * script runs, on every host including the ones that never bundle one.
+     *
+     * The value is a FILE PATH inside the running CLI's own install, used as the
+     * IMPORTER of the fallback resolve — not a second resolver. That matters:
+     * `--app gjs` deliberately omits both `import` and `require` from
+     * `conditionNames` (`app/gjs.ts`), and a `createRequire().resolve()` here
+     * would resolve under `require` and hand a `cjs-compat.cjs` shim to a GJS
+     * bundle for the ~3 `@gjsify/*` packages that declare a `require` branch.
+     * Going back through `this.resolve` uses the target's own condition set by
+     * construction, so the rescue can only pick the entry the build would have
+     * picked. The precedent is `commands/tsc.ts`, which resolves
+     * `@gjsify/tsc/bundle` from the project first and the running CLI second for
+     * exactly this reason; `tests/e2e/node-free-bootstrap` states that invariant.
+     *
+     * PROJECT FIRST, ALWAYS: consulted only after normal resolution returns
+     * null, so a workspace that HAS the package keeps using it and nothing about
+     * a warm tree changes. A project resolve that ERRORED is not a null and is
+     * never rescued — see the handler.
+     */
+    toolchainAnchor?: string;
 }
 /**
  * Is `id` a bare `@gjsify/*` package specifier (root or subpath)? Excludes disk
@@ -62,11 +99,16 @@ export interface UnresolvedWorkspaceImportDetails {
      */
     aliasedFrom?: readonly string[];
     importer: string;
+    /**
+     * Set when `this.resolve` THREW instead of answering — the message then names
+     * it rather than listing three causes that cannot apply.
+     */
+    resolverFailure?: string;
 }
 /** A `@gjsify/*` edge the build promised to substitute could not be resolved. */
 export declare class UnresolvedWorkspaceImportError extends Error {
     readonly details: UnresolvedWorkspaceImportDetails;
-    constructor(details: UnresolvedWorkspaceImportDetails);
+    constructor(details: UnresolvedWorkspaceImportDetails, cause?: unknown);
 }
 /**
  * The actionable message: names the specifier, the importer and the likely cause —
@@ -82,6 +124,10 @@ export declare function buildReverseAliasIndex(aliases: Record<string, string> |
  * imports-empty/externals at normal) gets first refusal — only ids NOTHING claimed
  * reach this hook. It then re-runs the resolution Rolldown would have run next
  * (`this.resolve(…, { skipSelf })`) and returns that, so a healthy build resolves
- * each specifier exactly once and behaves identically. Only a genuine `null` throws.
+ * each specifier exactly once and behaves identically.
+ *
+ * A genuine `null` throws — unless `toolchainAnchor` is set and the CLI's own install
+ * has it. A THROW is not a `null`: it is rethrown with this plugin's context and the
+ * original as `cause`, never rescued and never reported as a missing dependency.
  */
 export declare function unresolvedWorkspaceImportPlugin(options: WorkspaceImportGuardOptions): Plugin;

package/lib/plugins/unresolved-workspace-import.js

@@ -72,8 +72,8 @@ export function classifyImport(input) {
 /** A `@gjsify/*` edge the build promised to substitute could not be resolved. */
 export class UnresolvedWorkspaceImportError extends Error {
     details;
-    constructor(details) {
-        super(formatUnresolvedWorkspaceImport(details));
+    constructor(details, cause) {
+        super(formatUnresolvedWorkspaceImport(details), cause === undefined ? undefined : { cause });
         this.name = 'UnresolvedWorkspaceImportError';
         this.details = details;
     }
@@ -83,7 +83,7 @@ export class UnresolvedWorkspaceImportError extends Error {
  * the three things `UNRESOLVED_IMPORT` and the post-hoc `node:` guard cannot.
  */
 export function formatUnresolvedWorkspaceImport(details) {
-    const { target, source, candidate, aliasTarget, aliasedFrom, importer } = details;
+    const { target, source, candidate, aliasTarget, aliasedFrom, importer, resolverFailure } = details;
     // The specifiers `candidate` stood in for: `source` when IT carried the table
     // entry, else the reverse lookup — but only when its fan-in is SMALL. A shared
     // sink inverts to a wall of text (`@gjsify/empty` is the browser target for 49
@@ -114,11 +114,18 @@ export function formatUnresolvedWorkspaceImport(details) {
             `\`--app ${target}\` runtime cannot resolve.`
         : `Leaving it unresolved would silently externalise the ORIGINAL ${substitutedFor.length === 1 ? 'specifier' : 'specifiers'} ${quoted} into the ` +
             `bundle, defeating the substitution the \`--app ${target}\` target exists to perform.`) + symptom;
+    // A resolver that FAILED is not a resolver that found nothing, and the three
+    // likely causes below are all wrong for it: an EACCES on `node_modules`, a
+    // corrupt `package.json`, or a deliberate throw from another `resolveId` hook
+    // (`napi-node-addon`'s `resolveAddonPath`) would otherwise be reported as the
+    // user's missing dependency, with the real error gone from the process.
+    const failure = resolverFailure === undefined ? [] : ['', `The project resolver failed with: ${resolverFailure}`];
     return [
         headline,
         `  imported by: ${importer}`,
         '',
         consequence,
+        ...failure,
         '',
         'Likely causes:',
         '  - `node_modules` is missing or incomplete — run `gjsify install` (`--immutable` in CI).',
@@ -143,6 +150,10 @@ export function buildReverseAliasIndex(aliases) {
         list.sort();
     return index;
 }
+/** One line for the message; the untouched error rides along as `cause`. */
+function describeResolverFailure(err) {
+    return err instanceof Error ? `${err.name}: ${err.message}` : String(err);
+}
 /**
  * Refuse a build whose `@gjsify/*` substitution could not be resolved.
  *
@@ -150,10 +161,14 @@ export function buildReverseAliasIndex(aliases) {
  * imports-empty/externals at normal) gets first refusal — only ids NOTHING claimed
  * reach this hook. It then re-runs the resolution Rolldown would have run next
  * (`this.resolve(…, { skipSelf })`) and returns that, so a healthy build resolves
- * each specifier exactly once and behaves identically. Only a genuine `null` throws.
+ * each specifier exactly once and behaves identically.
+ *
+ * A genuine `null` throws — unless `toolchainAnchor` is set and the CLI's own install
+ * has it. A THROW is not a `null`: it is rethrown with this plugin's context and the
+ * original as `cause`, never rescued and never reported as a missing dependency.
  */
 export function unresolvedWorkspaceImportPlugin(options) {
-    const { target, aliases, isExternal } = options;
+    const { target, aliases, isExternal, toolchainAnchor } = options;
     // Re-entrancy belt: `skipSelf: true` should keep our own `this.resolve` out of
     // this hook, but a hang is a far worse failure than a missed check. Keyed by
     // `candidate\0importer` — the same package legitimately resolves from many.
@@ -185,6 +200,12 @@ export function unresolvedWorkspaceImportPlugin(options) {
                 const importer = typeof rawImporter === 'string' ? rawImporter : undefined;
                 if (extraOptions?.isEntry)
                     return null;
+                // The toolchain fallback below re-enters this hook with the anchor as
+                // the importer. Declining there keeps the probe from rescuing itself:
+                // the anchor cannot answer for the anchor, and the recursion has no
+                // bound of its own.
+                if (toolchainAnchor !== undefined && importer === toolchainAnchor)
+                    return null;
                 const verdict = classifyImport({ source, importer, aliases, isExternal });
                 if (verdict.verdict === 'ignore')
                     return null;
@@ -198,13 +219,29 @@ export function unresolvedWorkspaceImportPlugin(options) {
                 if (inFlight.has(key))
                     return null;
                 inFlight.add(key);
-                let resolved;
+                let resolved = null;
+                // KEPT DELIBERATELY, and NOT as a miss. `this.resolve` re-runs the whole
+                // `pre`-order chain, so it can fail two very different ways. "Nothing is
+                // there" is `null` on both engines — npm `rolldown` always answered that,
+                // and `@gjsify/rolldown-native` now does too (`isResolveMiss`, which is
+                // where the engine mismatch that hid this plugin's diagnostic under GJS
+                // is fixed). What reaches this catch is the OTHER kind: a hook in that
+                // chain throwing on purpose (`napi-node-addon`'s `resolveAddonPath`), an
+                // EACCES, a corrupt `package.json`, a bridge fault. Letting it escape
+                // surfaces it as a bare "plugin `gjsify-alias` threw an error" naming
+                // neither specifier nor importer; swallowing it would report a real fault
+                // as the user's missing dependency. So it is caught, kept, and thrown
+                // BELOW with this plugin's context around it and the original as `cause`.
+                let resolverFailure;
                 try {
                     resolved = await this.resolve(verdict.candidate, importer, {
                         skipSelf: true,
                         kind: extraOptions?.kind,
                     });
                 }
+                catch (err) {
+                    resolverFailure = err;
+                }
                 finally {
                     inFlight.delete(key);
                 }
@@ -212,6 +249,30 @@ export function unresolvedWorkspaceImportPlugin(options) {
                     resolvedCache.set(key, resolved);
                     return resolved;
                 }
+                // Toolchain fallback — see `toolchainAnchor`. Only after a real `null`:
+                // a resolver that ERRORED has not established that the project lacks the
+                // package, and rescuing there would turn "project first, always" into
+                // "project first unless the project errors".
+                if (resolverFailure === undefined && toolchainAnchor !== undefined) {
+                    const fromToolchain = await this.resolve(verdict.candidate, toolchainAnchor, {
+                        skipSelf: true,
+                        kind: extraOptions?.kind,
+                    });
+                    if (fromToolchain) {
+                        // The one visible trace that this artifact is MIXED — some of its
+                        // `@gjsify/*` from the project, this one from the CLI's own
+                        // install, possibly a different major. Without it a rescued build
+                        // and a healthy one have byte-identical logs, and a wrong answer
+                        // that leaves no trace is the expensive kind. Deduplicated by
+                        // `resolvedCache`: one line per (candidate, importer dir, kind).
+                        this.warn(`gjsify: \`${verdict.candidate}\` did not resolve from the project ` +
+                            `(imported by ${importer ?? '<entry>'}) — using the copy installed beside the ` +
+                            `running CLI (${toolchainAnchor}). Build the workspace package to use the ` +
+                            `project's own copy.`);
+                        resolvedCache.set(key, fromToolchain);
+                        return fromToolchain;
+                    }
+                }
                 throw new UnresolvedWorkspaceImportError({
                     target,
                     source,
@@ -219,7 +280,10 @@ export function unresolvedWorkspaceImportPlugin(options) {
                     aliasTarget: verdict.aliasTarget,
                     aliasedFrom: reverseAliases.get(verdict.candidate)?.filter((s) => s !== source),
                     importer: importer ?? '<entry>',
-                });
+                    ...(resolverFailure === undefined
+                        ? {}
+                        : { resolverFailure: describeResolverFailure(resolverFailure) }),
+                }, resolverFailure);
             },
         },
     };

package/lib/types/plugin-options.d.ts

@@ -67,4 +67,16 @@ export interface PluginOptions {
      * the wrapper. Defaults to `false`.
      */
     preserveDefaultExport?: boolean;
+    /**
+     * Where to look for a `@gjsify/*` the PROJECT cannot resolve, when the input is
+     * TOOLCHAIN rather than user code: a file path inside the running CLI's own
+     * install, used as the importer of a second resolve.
+     *
+     * OPT-IN PER CALL SITE, never inferred from the code path. `gjsify build` never
+     * sets it, and neither does a `node <file>` in an ordinary project's package
+     * script — a user's application must still fail loudly on a missing dependency
+     * rather than silently pick up whatever version the CLI ships. Rationale and the
+     * measured incident: `WorkspaceImportGuardOptions.toolchainAnchor`.
+     */
+    toolchainAnchor?: string;
 }

package/lib/utils/detect-free-globals.js

@@ -9,6 +9,7 @@
 import * as acorn from 'acorn';
 import * as walk from 'acorn-walk';
 import { GJS_GLOBALS_MAP } from '@gjsify/resolve-npm/globals-map';
+import { classifyJsxParseFailure, formatSurvivingJsx } from './jsx-survival.js';
 const KNOWN_GLOBALS = new Set(Object.keys(GJS_GLOBALS_MAP));
 /**
  * `<host>.<method>` patterns that must inject a global even though the identifier
@@ -88,6 +89,33 @@ function extractBindingNames(node) {
             return [];
     }
 }
+/**
+ * Parse one analysis chunk, and say what a JSX failure IS.
+ *
+ * This parse is the first thing a `--globals auto` build does with bundled output, so a
+ * `jsx: "preserve"` project with no framework compiler dies HERE — and acorn's own
+ * message is `Unexpected token (3:11)`, which names neither JSX, nor the file, nor a
+ * setting. Every other parse failure is re-thrown untouched: acorn trailing
+ * SpiderMonkey on new syntax is acorn's problem, not the project's, and claiming JSX
+ * for it would be a lie with a fix attached.
+ */
+function parseAnalysisChunk(code) {
+    try {
+        return acorn.parse(code, {
+            ecmaVersion: 'latest',
+            sourceType: 'module',
+            // Acorn rejects shebangs by default, and any project bundling its own CLI gets
+            // one hoisted to byte 0.
+            allowHashBang: true,
+        });
+    }
+    catch (err) {
+        const jsx = classifyJsxParseFailure(code, err);
+        if (jsx === null)
+            throw err;
+        throw new Error(formatSurvivingJsx(jsx, 'the analysis bundle'), { cause: err });
+    }
+}
 /**
  * Core scanner behind `detectFreeGlobals` (web/Node globals map) and
  * `detectGjsAmbientGlobals` (the `--app node` GJS-ambient set), parametrised so the node
@@ -108,13 +136,7 @@ function scanFreeGlobals(code, opts) {
     const knownGlobals = opts.knownGlobals;
     const methodMarkers = opts.methodMarkers ?? {};
     const wasmMarkers = opts.wasmMarkers ?? {};
-    const ast = acorn.parse(code, {
-        ecmaVersion: 'latest',
-        sourceType: 'module',
-        // Acorn rejects shebangs by default, and any project bundling its own CLI gets
-        // one hoisted to byte 0.
-        allowHashBang: true,
-    });
+    const ast = parseAnalysisChunk(code);
     // Pass 1: every declared name in the module.
     const declaredNames = new Set();
     walk.simple(ast, {

package/lib/utils/index.d.ts

@@ -7,3 +7,5 @@ export { detectFreeGlobals } from './detect-free-globals.js';
 export { resolveGlobalsList, writeRegisterInjectFile } from './scan-globals.js';
 export { inlineStaticReads, isAbsoluteFsPath } from './inline-static-reads.js';
 export { GJSIFY_VIRTUAL_PREFIX, isGjsifyVirtualModuleId } from './virtual-module-id.js';
+export { locateSurvivingJsx, classifyJsxParseFailure, formatSurvivingJsx } from './jsx-survival.js';
+export type { SurvivingJsx } from './jsx-survival.js';

package/lib/utils/index.js

@@ -7,3 +7,4 @@ export { detectFreeGlobals } from './detect-free-globals.js';
 export { resolveGlobalsList, writeRegisterInjectFile } from './scan-globals.js';
 export { inlineStaticReads, isAbsoluteFsPath } from './inline-static-reads.js';
 export { GJSIFY_VIRTUAL_PREFIX, isGjsifyVirtualModuleId } from './virtual-module-id.js';
+export { locateSurvivingJsx, classifyJsxParseFailure, formatSurvivingJsx } from './jsx-survival.js';

package/lib/utils/inline-static-reads.d.ts

@@ -1,10 +1,3 @@
-/**
- * Run the inliner on a source string. Returns the rewritten source (or the
- * original string when no inlining applied) and the count of edits applied.
- *
- * Safe to call on any JS source. Files that don't reference `readFileSync` /
- * `readdirSync` / `existsSync` skip the AST parse entirely (cheap fast path).
- */
 export declare function inlineStaticReads(src: string, sourceFilePath: string): {
     contents: string;
     inlined: number;

package/lib/utils/inline-static-reads.js

@@ -41,7 +41,7 @@
 // Anything not statically resolvable is left untouched — the legacy
 // `import.meta.url` rewriter still applies as a fallback.
 import * as acorn from 'acorn';
-import * as walk from 'acorn-walk';
+import { tsPlugin } from 'acorn-typescript';
 import { dirname, join, resolve, basename, relative, extname, posix, win32 } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
@@ -52,35 +52,98 @@ import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
  * Safe to call on any JS source. Files that don't reference `readFileSync` /
  * `readdirSync` / `existsSync` skip the AST parse entirely (cheap fast path).
  */
+const TS_EXT_RE = /\.[cm]?tsx?$/i;
+/**
+ * The TypeScript-capable parser, built once.
+ *
+ * `acorn-typescript` and not the bundler's own parser, and the reason is the
+ * runtime rather than a preference: under GJS the engine is
+ * `@gjsify/rolldown-native`, and npm `rolldown` is "a Rust napi crate that cannot
+ * run under GJS" (`bundler-pick.ts`), loaded only behind a dynamic import on Node.
+ * A top-level `import { parseAst } from 'rolldown/parseAst'` therefore links a
+ * Node-only N-API package into a module that has to load under GJS — measured:
+ * the CLI's own bundle then died at startup with `createRequire: Cannot require
+ * builtin module "fs" synchronously in GJS`. `acorn-typescript` is pure JS, emits
+ * the same ESTree shapes the evaluator below already speaks, and needs
+ * `locations: true` (it refuses to parse without them).
+ */
+const TS_PARSER = acorn.Parser.extend(tsPlugin());
+/**
+ * Parse a source with the parser its extension calls for.
+ *
+ * The TypeScript half is why first-party sources were invisible to this inliner
+ * for as long as it was scoped to `node_modules`: an installed package ships JS,
+ * so plain acorn could always parse it, and nothing ever asked what happens to a
+ * `.ts`. The answer was that `acorn.parse` threw and the `catch` returned
+ * "nothing to inline" — a result indistinguishable from a file that genuinely has
+ * no static reads. Measured on `packages/infra/cli/src/utils/app-metadata.ts`:
+ * `inlined: 0`, while the identical expression in a `.js` file returned
+ * `inlined: 1`.
+ */
+function parseSource(src, sourceFilePath) {
+    const shared = {
+        ecmaVersion: 'latest',
+        sourceType: 'module',
+        allowAwaitOutsideFunction: true,
+        allowReturnOutsideFunction: true,
+        allowImportExportEverywhere: true,
+    };
+    if (!TS_EXT_RE.test(sourceFilePath))
+        return acorn.parse(src, shared);
+    return TS_PARSER.parse(src, { ...shared, locations: true });
+}
+/**
+ * Visit every `CallExpression` in the tree.
+ *
+ * A generic descent rather than `acorn-walk`, and that is not a preference:
+ * `walk.simple` looks its visitor up in a table keyed by node type and throws
+ * `No walker function defined for node type TSInterfaceDeclaration` on the first
+ * interface in a first-party source. A walker with no node table cannot fall
+ * behind the parser — which matters precisely because the parser is now allowed
+ * to emit node types this file has never heard of.
+ */
+function forEachCallExpression(root, visit) {
+    const stack = [root];
+    while (stack.length > 0) {
+        const node = stack.pop();
+        if (node === null || typeof node !== 'object')
+            continue;
+        if (Array.isArray(node)) {
+            for (const child of node)
+                stack.push(child);
+            continue;
+        }
+        if (node.type === 'CallExpression')
+            visit(node);
+        for (const value of Object.values(node)) {
+            if (value !== null && typeof value === 'object')
+                stack.push(value);
+        }
+    }
+}
 export function inlineStaticReads(src, sourceFilePath) {
     if (!src.includes('readFileSync') && !src.includes('readdirSync') && !src.includes('existsSync')) {
         return { contents: src, inlined: 0 };
     }
     let ast;
     try {
-        ast = acorn.parse(src, {
-            ecmaVersion: 'latest',
-            sourceType: 'module',
-            allowAwaitOutsideFunction: true,
-            allowReturnOutsideFunction: true,
-            allowImportExportEverywhere: true,
-        });
+        ast = parseSource(src, sourceFilePath);
     }
     catch {
-        // Source isn't valid JS (CJS source with shebangs, mixed module
-        // syntax, ...). Skip; the rest of the rewriter still runs.
+        // Not parseable as the language its extension claims (a CJS source with
+        // a shebang, mixed module syntax, ...). Skip; the rest of the rewriter
+        // still runs. This catch used to swallow every TypeScript file in the
+        // tree as well — see `parseSource`.
         return { contents: src, inlined: 0 };
     }
     const ctx = {
         sourceUrl: pathToFileURL(sourceFilePath).href,
     };
     const edits = [];
-    walk.simple(ast, {
-        CallExpression(node) {
-            const edit = tryInlineCall(node, ctx, src);
-            if (edit)
-                edits.push(edit);
-        },
+    forEachCallExpression(ast, (node) => {
+        const edit = tryInlineCall(node, ctx, src);
+        if (edit)
+            edits.push(edit);
     });
     if (edits.length === 0)
         return { contents: src, inlined: 0 };

package/lib/utils/jsx-survival.d.ts

@@ -0,0 +1,31 @@
+/** Where the parser stopped, and on what. */
+export interface SurvivingJsx {
+    /** 1-based line, as acorn reports it. */
+    line: number;
+    /** 0-based column, as acorn reports it. */
+    column: number;
+    /** The text around the failure, trimmed so a minified bundle stays readable. */
+    excerpt: string;
+}
+/**
+ * Does `err` — a failure from parsing `code` — say that raw JSX survived? Returns the
+ * location when the position attributes it to JSX, `null` when it does not.
+ *
+ * Split from {@link locateSurvivingJsx} so a caller that ALREADY parsed (and threw) can
+ * attribute its own failure without parsing a second time.
+ */
+export declare function classifyJsxParseFailure(code: string, err: unknown): SurvivingJsx | null;
+/**
+ * Parse `code` as an ES module and report surviving JSX. `null` means either "parses
+ * fine" or "fails for a reason that is not JSX" — the two cases this must not conflate,
+ * because only the first is a healthy bundle and only the second is acorn's problem
+ * rather than the build's.
+ */
+export declare function locateSurvivingJsx(code: string): SurvivingJsx | null;
+/**
+ * The actionable message: what the artifact does, what the runtime will do with it, and
+ * the two settings that fix it. Shared by the post-bundle artifact gate and the
+ * `--globals auto` analysis pass, which hits the same source with a bare
+ * "Unexpected token (3:11)" naming neither JSX nor a setting.
+ */
+export declare function formatSurvivingJsx(found: SurvivingJsx, label: string): string;