@hyperfrontend/builder 0.1.0

package/package/index.cjs.js

@@ -0,0 +1,276 @@
+'use strict';
+
+const index_cjs_js$1 = require('../_dependencies/@hyperfrontend/project-scope/core/index.cjs.js');
+const index_cjs_js = require('../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/set/index.cjs.js');
+const index_cjs_js$3 = require('../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/array/index.cjs.js');
+const index_cjs_js$4 = require('../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/object/index.cjs.js');
+const node_fs = require('node:fs');
+const index_cjs_js$2 = require('../_dependencies/@hyperfrontend/logging/index.cjs.js');
+const index_cjs_js$6 = require('../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/regexp/index.cjs.js');
+const index_cjs_js$5 = require('../_dependencies/@hyperfrontend/versioning/repository/parse/index.cjs.js');
+const { writeOutputPackageJson } = require('../_shared/package/json/write/index.cjs.js');
+const { finalizeFilesAllowlist } = require('../_shared/package/finalize-files/index.cjs.js');
+const { readProjectPackageJson } = require('../_shared/package/json/read-package-json/index.cjs.js');
+const { filterWorkspaceDepsFromOutput } = require('../_shared/package/json/filter-deps/index.cjs.js');
+const { synthesizePackageJson } = require('../_shared/package/json/synthesize/index.cjs.js');
+const { generateThirdPartyLicensesContent } = require('../_shared/package/licenses/generate-content/index.cjs.js');
+const { writeThirdPartyLicensesFile } = require('../_shared/package/licenses/write/index.cjs.js');
+
+const log$1 = index_cjs_js$2.logger.channel('builder:package:assets');
+const resolveTargetDir = (outputPath, to) => (!to || to === '.' ? outputPath : index_cjs_js$1.join(outputPath, to));
+const collectFromFiles = (from, files) => {
+    const collected = [];
+    for (const file of files) {
+        const srcFile = index_cjs_js$1.join(from, file);
+        if (index_cjs_js$1.exists(srcFile) && index_cjs_js$1.isFile(srcFile))
+            collected.push(file);
+    }
+    return collected;
+};
+const collectFromGlob = (from, pattern) => {
+    const collected = [];
+    for (const entry of index_cjs_js$1.readDirectoryRecursive(from)) {
+        if (!entry.isFile)
+            continue;
+        const rel = index_cjs_js$1.relativePath(from, entry.path);
+        if (index_cjs_js$1.matchGlobPattern(rel, pattern))
+            collected.push(rel);
+    }
+    return collected;
+};
+const collectAssetFiles = (spec) => {
+    if (spec.files)
+        return collectFromFiles(spec.from, spec.files);
+    if (spec.glob)
+        return collectFromGlob(spec.from, spec.glob);
+    return [];
+};
+/**
+ * Copies one or more asset specs into the build output directory.
+ *
+ * Each spec selects its inputs in one of two ways:
+ * - `spec.files`: explicit list of relative paths under `spec.from`. Missing entries
+ *   are silently skipped.
+ * - `spec.glob`: POSIX-style glob evaluated relative to `spec.from`.
+ *
+ * The destination is `<outputPath>/<spec.to>`, defaulting to the dist root when
+ * `spec.to` is omitted or equal to `'.'`. Specs whose `condition` predicate returns
+ * `false` are skipped entirely.
+ *
+ * @param specs - Asset specifications to materialize.
+ * @param outputPath - Absolute path to the build output directory.
+ * @param srcPkg - Source `package.json`, supplied to each spec's `condition` predicate.
+ *
+ * @example Copying README + LICENSE into the dist root
+ * ```typescript
+ * copyAssets(
+ *   [
+ *     { from: '/abs/libs/foo', files: ['README.md', 'CHANGELOG.md'] },
+ *     { from: '/abs/repo', files: ['LICENSE.md', 'SECURITY.md'] },
+ *   ],
+ *   '/abs/dist/libs/foo',
+ *   srcPkg
+ * )
+ * ```
+ */
+const copyAssets = (specs, outputPath, srcPkg) => {
+    for (const spec of specs) {
+        if (spec.condition && !spec.condition(srcPkg))
+            continue;
+        if (!index_cjs_js$1.exists(spec.from)) {
+            log$1.debug(`asset source missing, skipping: ${spec.from}`);
+            continue;
+        }
+        const target = resolveTargetDir(outputPath, spec.to);
+        const files = collectAssetFiles(spec);
+        for (const file of files) {
+            const srcPath = index_cjs_js$1.join(spec.from, file);
+            const destPath = index_cjs_js$1.join(target, file);
+            index_cjs_js$1.ensureDir(index_cjs_js$1.getDirname(destPath));
+            node_fs.copyFileSync(srcPath, destPath);
+            log$1.debug(`copied ${file}`);
+        }
+    }
+};
+
+const extractRepositoryUrl = (repository) => {
+    if (typeof repository === 'string')
+        return repository;
+    if (repository && typeof repository === 'object')
+        return repository.url;
+    return null;
+};
+const formatLicenseUrl = (platform, baseUrl, fileName) => {
+    if (platform === 'github')
+        return `${baseUrl}/blob/HEAD/${fileName}`;
+    if (platform === 'gitlab')
+        return `${baseUrl}/-/blob/HEAD/${fileName}`;
+    if (platform === 'bitbucket')
+        return `${baseUrl}/src/HEAD/${fileName}`;
+    return null;
+};
+/**
+ * Derives a canonical license-file URL for a dependency from its `package.json`
+ * `repository` field and the discovered LICENSE filename.
+ *
+ * Returns `null` for missing repository fields, unparseable URLs, and platforms
+ * outside the supported set (GitHub, GitLab, Bitbucket).
+ *
+ * @param repository - Source `package.json` `repository` field (string or object form).
+ * @param licenseFileName - Filename of the LICENSE inside the upstream repo.
+ * @returns Resolved license URL, or `null` when one cannot be derived.
+ *
+ * @example Resolving a GitHub LICENSE URL from a string-form repository field
+ * ```typescript
+ * const url = constructLicenseUrl('https://github.com/x/y.git', 'LICENSE')
+ * // → 'https://github.com/x/y/blob/HEAD/LICENSE'
+ * ```
+ */
+const constructLicenseUrl = (repository, licenseFileName) => {
+    const url = extractRepositoryUrl(repository);
+    if (!url)
+        return null;
+    const parsed = index_cjs_js$5.parseRepositoryUrl(url);
+    if (!parsed)
+        return null;
+    return formatLicenseUrl(parsed.platform, parsed.baseUrl, licenseFileName);
+};
+
+const log = index_cjs_js$2.logger.channel('builder:package:licenses');
+const matchPattern = (content, source) => 
+// eslint-disable-next-line workspace/no-unsafe-regex -- @preserve: SPDX patterns are static, vetted strings declared inline
+index_cjs_js$6.createRegExp(source, 'i').test(content);
+const findLicenseFile = (packageDir) => {
+    const match = index_cjs_js$1.readDirectory(packageDir).find((f) => f.isFile && /^license(\.md|\.txt)?$/i.test(f.name));
+    return match?.name ?? null;
+};
+const detectLicenseFromContent = (content) => {
+    if (matchPattern(content, 'MIT License'))
+        return 'MIT';
+    if (matchPattern(content, 'Apache License.*Version 2\\.0'))
+        return 'Apache-2.0';
+    if (matchPattern(content, 'BSD 3-Clause License'))
+        return 'BSD-3-Clause';
+    if (matchPattern(content, 'BSD 2-Clause License'))
+        return 'BSD-2-Clause';
+    if (matchPattern(content, 'ISC License'))
+        return 'ISC';
+    if (matchPattern(content, 'GNU General Public License.*version 3'))
+        return 'GPL-3.0';
+    if (matchPattern(content, 'GNU Lesser General Public License.*version 3'))
+        return 'LGPL-3.0';
+    if (matchPattern(content, 'Mozilla Public License.*2\\.0'))
+        return 'MPL-2.0';
+    return null;
+};
+const resolvePackageDir = (workspaceRoot, depName) => depName.startsWith('@') ? index_cjs_js$1.join(workspaceRoot, 'node_modules', ...depName.split('/')) : index_cjs_js$1.join(workspaceRoot, 'node_modules', depName);
+const collectDependencyLicense = (depName, workspaceRoot) => {
+    const packageDir = resolvePackageDir(workspaceRoot, depName);
+    const pkgPath = index_cjs_js$1.join(packageDir, 'package.json');
+    if (!index_cjs_js$1.exists(pkgPath)) {
+        log.warn(`could not find package.json for ${depName}`);
+        return null;
+    }
+    const pkg = index_cjs_js$1.readJsonFile(pkgPath);
+    const licenseFileName = findLicenseFile(packageDir);
+    let licenseType = typeof pkg.license === 'string' ? pkg.license : 'Unknown';
+    if (licenseFileName) {
+        const detected = detectLicenseFromContent(index_cjs_js$1.readFileContent(index_cjs_js$1.join(packageDir, licenseFileName)));
+        if (detected)
+            licenseType = detected;
+    }
+    const licenseUrl = licenseFileName ? constructLicenseUrl(pkg.repository, licenseFileName) : null;
+    return { name: depName, licenseType, licenseUrl };
+};
+/**
+ * Collects license information for every external dependency of the project
+ * being built.
+ *
+ * The dependency list is supplied by the caller (typically the resolved external
+ * list from the bundle phase, with workspace-internal entries already removed).
+ * For each dependency, the function locates the installed package under
+ * `<workspaceRoot>/node_modules`, parses its `package.json`, scans for a LICENSE
+ * file, and attempts to derive a canonical license URL from the upstream
+ * repository field. Missing dependencies are logged at warn level and dropped
+ * from the result.
+ *
+ * @param workspaceRoot - Absolute path to the workspace root containing
+ * `node_modules`.
+ * @param externals - List of external (non-workspace) dependency names to inspect.
+ * @returns Sorted list of license entries, one per resolvable dependency.
+ *
+ * @example Collecting licenses for a built library's bundle phase externals
+ * ```typescript
+ * const entries = collectThirdPartyLicenses('/abs/repo', ['rollup', 'typescript'])
+ * ```
+ */
+const collectThirdPartyLicenses = (workspaceRoot, externals) => {
+    if (externals.length === 0)
+        return [];
+    const entries = [];
+    for (const dep of externals) {
+        const entry = collectDependencyLicense(dep, workspaceRoot);
+        if (entry)
+            entries.push(entry);
+    }
+    return entries.sort((a, b) => a.name.localeCompare(b.name));
+};
+
+const resolveThirdPartyLicensesFlag = (config, ctx) => {
+    if (typeof config.thirdPartyLicenses === 'boolean')
+        return config.thirdPartyLicenses;
+    return ctx.bundledDeps.length > 0;
+};
+const collectLicenseDeps = (ctx, distDeps) => index_cjs_js$3.from(index_cjs_js.createSet([...ctx.bundledDeps, ...distDeps]));
+/**
+ * Runs the complete package phase: synthesizes and writes the dist
+ * `package.json`, materializes any configured asset specs, and (when
+ * `config.thirdPartyLicenses` is enabled — defaulting to `true` for builds
+ * with at least one bundled dep) emits `THIRD_PARTY_LICENSES.md`.
+ *
+ * The phase consumes:
+ * - the source `package.json` (read fresh from `ctx.projectRoot`)
+ * - the resolved {@link BuildContext} (output path, workspace predicate, assets, discovery)
+ * - the {@link FormatOutputs} aggregated by the bundle phase
+ *
+ * Workspace-internal entries are stripped from the published `dependencies`
+ * map only when both `config.filterWorkspaceDepsFromOutput` and
+ * `ctx.isWorkspacePackage` are present. Inheritance and CDN overrides are
+ * forwarded verbatim to {@link synthesizePackageJson}.
+ *
+ * @param ctx - Resolved build context.
+ * @param config - Top-level builder configuration. Reads `inheritFieldsFrom`,
+ * `filterWorkspaceDepsFromOutput`, `unpkg`, `jsdelivr`, `bin`, and `thirdPartyLicenses`.
+ * The `files` allowlist is owned by {@link finalizeFilesAllowlist}, not this phase.
+ * @param formatOutputs - Outputs collected during the bundle phase.
+ *
+ * @example Driving the package phase from a custom orchestrator
+ * ```typescript
+ * await runPackagePhase(context, config, formatOutputs)
+ * ```
+ */
+const runPackagePhase = async (ctx, config, formatOutputs) => {
+    const srcPkg = readProjectPackageJson(ctx.projectRoot);
+    const bins = config.bin ?? [];
+    const distPkg = synthesizePackageJson(srcPkg, ctx, formatOutputs, {
+        inheritFieldsFrom: config.inheritFieldsFrom,
+        filterWorkspaceDepsFromOutput: config.filterWorkspaceDepsFromOutput,
+        isWorkspacePackage: ctx.isWorkspacePackage,
+        unpkg: config.unpkg,
+        jsdelivr: config.jsdelivr,
+        bins,
+    });
+    writeOutputPackageJson(ctx.outputPath, distPkg);
+    copyAssets(ctx.assets, ctx.outputPath, srcPkg);
+    if (resolveThirdPartyLicensesFlag(config, ctx)) {
+        const distDeps = index_cjs_js$4.keys(distPkg.dependencies ?? {});
+        const externals = collectLicenseDeps(ctx, distDeps);
+        const entries = collectThirdPartyLicenses(ctx.workspaceRoot, externals);
+        if (entries.length > 0) {
+            writeThirdPartyLicensesFile(ctx.outputPath, generateThirdPartyLicensesContent(entries));
+        }
+    }
+};
+
+exports.finalizeFilesAllowlist = finalizeFilesAllowlist;
+exports.runPackagePhase = runPackagePhase;

package/package/index.d.ts

@@ -0,0 +1,56 @@
+import { BuildContext, BuildConfig, FormatOutputs } from '../models';
+
+/**
+ * Finalizes `package.json#files` as the last build step, after every emit phase
+ * (bundle → package → bin → license/asset) and the orphan prune have run.
+ *
+ * The allowlist is reflected from the materialized output tree rather than
+ * predicted from config, so the field names exactly what ships. Call this last:
+ * earlier phases (notably the bin phase) emit files after the package phase
+ * writes the manifest, and reflecting before then would miss those survivors.
+ * An explicit `config.files` short-circuits reflection and is honored verbatim.
+ *
+ * An empty allowlist (only possible via an explicit `config.files: []`) leaves
+ * the manifest untouched.
+ *
+ * @param ctx - Resolved build context (provides `outputPath`).
+ * @param config - Top-level builder configuration; reads the `files` override.
+ *
+ * @example Finalizing the allowlist after the bin phase
+ * ```typescript
+ * const binOutputs = await runBinPhase(ctx, config.bin ?? [])
+ * finalizeFilesAllowlist(ctx, config)
+ * ```
+ */
+declare const finalizeFilesAllowlist: (ctx: BuildContext, config: BuildConfig) => void;
+
+/**
+ * Runs the complete package phase: synthesizes and writes the dist
+ * `package.json`, materializes any configured asset specs, and (when
+ * `config.thirdPartyLicenses` is enabled — defaulting to `true` for builds
+ * with at least one bundled dep) emits `THIRD_PARTY_LICENSES.md`.
+ *
+ * The phase consumes:
+ * - the source `package.json` (read fresh from `ctx.projectRoot`)
+ * - the resolved {@link BuildContext} (output path, workspace predicate, assets, discovery)
+ * - the {@link FormatOutputs} aggregated by the bundle phase
+ *
+ * Workspace-internal entries are stripped from the published `dependencies`
+ * map only when both `config.filterWorkspaceDepsFromOutput` and
+ * `ctx.isWorkspacePackage` are present. Inheritance and CDN overrides are
+ * forwarded verbatim to {@link synthesizePackageJson}.
+ *
+ * @param ctx - Resolved build context.
+ * @param config - Top-level builder configuration. Reads `inheritFieldsFrom`,
+ * `filterWorkspaceDepsFromOutput`, `unpkg`, `jsdelivr`, `bin`, and `thirdPartyLicenses`.
+ * The `files` allowlist is owned by {@link finalizeFilesAllowlist}, not this phase.
+ * @param formatOutputs - Outputs collected during the bundle phase.
+ *
+ * @example Driving the package phase from a custom orchestrator
+ * ```typescript
+ * await runPackagePhase(context, config, formatOutputs)
+ * ```
+ */
+declare const runPackagePhase: (ctx: BuildContext, config: BuildConfig, formatOutputs: FormatOutputs) => Promise<void>;
+
+export { finalizeFilesAllowlist, runPackagePhase };

package/package/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../libs/builder/src/package/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA"}

package/package/index.esm.js

@@ -0,0 +1,231 @@
+import { exists, readDirectory, relativePath, matchGlobPattern, writeJsonFile, join, readJsonFile, ensureDir, getDirname, isFile, readDirectoryRecursive, readFileContent, writeFileContent } from '../_dependencies/@hyperfrontend/project-scope/core/index.esm.js';
+import { createSet } from '../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/set/index.esm.js';
+import { isArray, from } from '../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/array/index.esm.js';
+import { entries, fromEntries, keys } from '../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/object/index.esm.js';
+import { copyFileSync } from 'node:fs';
+import { logger } from '../_dependencies/@hyperfrontend/logging/index.esm.js';
+import { createRegExp } from '../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/regexp/index.esm.js';
+import { parseRepositoryUrl } from '../_dependencies/@hyperfrontend/versioning/repository/parse/index.esm.js';
+import { writeOutputPackageJson } from '../_shared/package/json/write/index.esm.js';
+import { finalizeFilesAllowlist } from '../_shared/package/finalize-files/index.esm.js';
+import { readProjectPackageJson } from '../_shared/package/json/read-package-json/index.esm.js';
+import { filterWorkspaceDepsFromOutput } from '../_shared/package/json/filter-deps/index.esm.js';
+import { synthesizePackageJson } from '../_shared/package/json/synthesize/index.esm.js';
+import { constructLicenseUrl } from '../_shared/package/licenses/license-url/index.esm.js';
+import { generateThirdPartyLicensesContent } from '../_shared/package/licenses/generate-content/index.esm.js';
+import { writeThirdPartyLicensesFile } from '../_shared/package/licenses/write/index.esm.js';
+
+const log$1 = logger.channel('builder:package:assets');
+const resolveTargetDir = (outputPath, to) => (!to || to === '.' ? outputPath : join(outputPath, to));
+const collectFromFiles = (from, files) => {
+    const collected = [];
+    for (const file of files) {
+        const srcFile = join(from, file);
+        if (exists(srcFile) && isFile(srcFile))
+            collected.push(file);
+    }
+    return collected;
+};
+const collectFromGlob = (from, pattern) => {
+    const collected = [];
+    for (const entry of readDirectoryRecursive(from)) {
+        if (!entry.isFile)
+            continue;
+        const rel = relativePath(from, entry.path);
+        if (matchGlobPattern(rel, pattern))
+            collected.push(rel);
+    }
+    return collected;
+};
+const collectAssetFiles = (spec) => {
+    if (spec.files)
+        return collectFromFiles(spec.from, spec.files);
+    if (spec.glob)
+        return collectFromGlob(spec.from, spec.glob);
+    return [];
+};
+/**
+ * Copies one or more asset specs into the build output directory.
+ *
+ * Each spec selects its inputs in one of two ways:
+ * - `spec.files`: explicit list of relative paths under `spec.from`. Missing entries
+ *   are silently skipped.
+ * - `spec.glob`: POSIX-style glob evaluated relative to `spec.from`.
+ *
+ * The destination is `<outputPath>/<spec.to>`, defaulting to the dist root when
+ * `spec.to` is omitted or equal to `'.'`. Specs whose `condition` predicate returns
+ * `false` are skipped entirely.
+ *
+ * @param specs - Asset specifications to materialize.
+ * @param outputPath - Absolute path to the build output directory.
+ * @param srcPkg - Source `package.json`, supplied to each spec's `condition` predicate.
+ *
+ * @example Copying README + LICENSE into the dist root
+ * ```typescript
+ * copyAssets(
+ *   [
+ *     { from: '/abs/libs/foo', files: ['README.md', 'CHANGELOG.md'] },
+ *     { from: '/abs/repo', files: ['LICENSE.md', 'SECURITY.md'] },
+ *   ],
+ *   '/abs/dist/libs/foo',
+ *   srcPkg
+ * )
+ * ```
+ */
+const copyAssets = (specs, outputPath, srcPkg) => {
+    for (const spec of specs) {
+        if (spec.condition && !spec.condition(srcPkg))
+            continue;
+        if (!exists(spec.from)) {
+            log$1.debug(`asset source missing, skipping: ${spec.from}`);
+            continue;
+        }
+        const target = resolveTargetDir(outputPath, spec.to);
+        const files = collectAssetFiles(spec);
+        for (const file of files) {
+            const srcPath = join(spec.from, file);
+            const destPath = join(target, file);
+            ensureDir(getDirname(destPath));
+            copyFileSync(srcPath, destPath);
+            log$1.debug(`copied ${file}`);
+        }
+    }
+};
+
+const log = logger.channel('builder:package:licenses');
+const matchPattern = (content, source) => 
+// eslint-disable-next-line workspace/no-unsafe-regex -- @preserve: SPDX patterns are static, vetted strings declared inline
+createRegExp(source, 'i').test(content);
+const findLicenseFile = (packageDir) => {
+    const match = readDirectory(packageDir).find((f) => f.isFile && /^license(\.md|\.txt)?$/i.test(f.name));
+    return match?.name ?? null;
+};
+const detectLicenseFromContent = (content) => {
+    if (matchPattern(content, 'MIT License'))
+        return 'MIT';
+    if (matchPattern(content, 'Apache License.*Version 2\\.0'))
+        return 'Apache-2.0';
+    if (matchPattern(content, 'BSD 3-Clause License'))
+        return 'BSD-3-Clause';
+    if (matchPattern(content, 'BSD 2-Clause License'))
+        return 'BSD-2-Clause';
+    if (matchPattern(content, 'ISC License'))
+        return 'ISC';
+    if (matchPattern(content, 'GNU General Public License.*version 3'))
+        return 'GPL-3.0';
+    if (matchPattern(content, 'GNU Lesser General Public License.*version 3'))
+        return 'LGPL-3.0';
+    if (matchPattern(content, 'Mozilla Public License.*2\\.0'))
+        return 'MPL-2.0';
+    return null;
+};
+const resolvePackageDir = (workspaceRoot, depName) => depName.startsWith('@') ? join(workspaceRoot, 'node_modules', ...depName.split('/')) : join(workspaceRoot, 'node_modules', depName);
+const collectDependencyLicense = (depName, workspaceRoot) => {
+    const packageDir = resolvePackageDir(workspaceRoot, depName);
+    const pkgPath = join(packageDir, 'package.json');
+    if (!exists(pkgPath)) {
+        log.warn(`could not find package.json for ${depName}`);
+        return null;
+    }
+    const pkg = readJsonFile(pkgPath);
+    const licenseFileName = findLicenseFile(packageDir);
+    let licenseType = typeof pkg.license === 'string' ? pkg.license : 'Unknown';
+    if (licenseFileName) {
+        const detected = detectLicenseFromContent(readFileContent(join(packageDir, licenseFileName)));
+        if (detected)
+            licenseType = detected;
+    }
+    const licenseUrl = licenseFileName ? constructLicenseUrl(pkg.repository, licenseFileName) : null;
+    return { name: depName, licenseType, licenseUrl };
+};
+/**
+ * Collects license information for every external dependency of the project
+ * being built.
+ *
+ * The dependency list is supplied by the caller (typically the resolved external
+ * list from the bundle phase, with workspace-internal entries already removed).
+ * For each dependency, the function locates the installed package under
+ * `<workspaceRoot>/node_modules`, parses its `package.json`, scans for a LICENSE
+ * file, and attempts to derive a canonical license URL from the upstream
+ * repository field. Missing dependencies are logged at warn level and dropped
+ * from the result.
+ *
+ * @param workspaceRoot - Absolute path to the workspace root containing
+ * `node_modules`.
+ * @param externals - List of external (non-workspace) dependency names to inspect.
+ * @returns Sorted list of license entries, one per resolvable dependency.
+ *
+ * @example Collecting licenses for a built library's bundle phase externals
+ * ```typescript
+ * const entries = collectThirdPartyLicenses('/abs/repo', ['rollup', 'typescript'])
+ * ```
+ */
+const collectThirdPartyLicenses = (workspaceRoot, externals) => {
+    if (externals.length === 0)
+        return [];
+    const entries = [];
+    for (const dep of externals) {
+        const entry = collectDependencyLicense(dep, workspaceRoot);
+        if (entry)
+            entries.push(entry);
+    }
+    return entries.sort((a, b) => a.name.localeCompare(b.name));
+};
+
+const resolveThirdPartyLicensesFlag = (config, ctx) => {
+    if (typeof config.thirdPartyLicenses === 'boolean')
+        return config.thirdPartyLicenses;
+    return ctx.bundledDeps.length > 0;
+};
+const collectLicenseDeps = (ctx, distDeps) => from(createSet([...ctx.bundledDeps, ...distDeps]));
+/**
+ * Runs the complete package phase: synthesizes and writes the dist
+ * `package.json`, materializes any configured asset specs, and (when
+ * `config.thirdPartyLicenses` is enabled — defaulting to `true` for builds
+ * with at least one bundled dep) emits `THIRD_PARTY_LICENSES.md`.
+ *
+ * The phase consumes:
+ * - the source `package.json` (read fresh from `ctx.projectRoot`)
+ * - the resolved {@link BuildContext} (output path, workspace predicate, assets, discovery)
+ * - the {@link FormatOutputs} aggregated by the bundle phase
+ *
+ * Workspace-internal entries are stripped from the published `dependencies`
+ * map only when both `config.filterWorkspaceDepsFromOutput` and
+ * `ctx.isWorkspacePackage` are present. Inheritance and CDN overrides are
+ * forwarded verbatim to {@link synthesizePackageJson}.
+ *
+ * @param ctx - Resolved build context.
+ * @param config - Top-level builder configuration. Reads `inheritFieldsFrom`,
+ * `filterWorkspaceDepsFromOutput`, `unpkg`, `jsdelivr`, `bin`, and `thirdPartyLicenses`.
+ * The `files` allowlist is owned by {@link finalizeFilesAllowlist}, not this phase.
+ * @param formatOutputs - Outputs collected during the bundle phase.
+ *
+ * @example Driving the package phase from a custom orchestrator
+ * ```typescript
+ * await runPackagePhase(context, config, formatOutputs)
+ * ```
+ */
+const runPackagePhase = async (ctx, config, formatOutputs) => {
+    const srcPkg = readProjectPackageJson(ctx.projectRoot);
+    const bins = config.bin ?? [];
+    const distPkg = synthesizePackageJson(srcPkg, ctx, formatOutputs, {
+        inheritFieldsFrom: config.inheritFieldsFrom,
+        filterWorkspaceDepsFromOutput: config.filterWorkspaceDepsFromOutput,
+        isWorkspacePackage: ctx.isWorkspacePackage,
+        unpkg: config.unpkg,
+        jsdelivr: config.jsdelivr,
+        bins,
+    });
+    writeOutputPackageJson(ctx.outputPath, distPkg);
+    copyAssets(ctx.assets, ctx.outputPath, srcPkg);
+    if (resolveThirdPartyLicensesFlag(config, ctx)) {
+        const distDeps = keys(distPkg.dependencies ?? {});
+        const externals = collectLicenseDeps(ctx, distDeps);
+        const entries = collectThirdPartyLicenses(ctx.workspaceRoot, externals);
+        if (entries.length > 0) {
+            writeThirdPartyLicensesFile(ctx.outputPath, generateThirdPartyLicensesContent(entries));
+        }
+    }
+};
+
+export { finalizeFilesAllowlist, runPackagePhase };

package/package/json/cdn-paths.d.ts

@@ -0,0 +1,41 @@
+import type { FormatOutputs } from '../../models';
+/**
+ * Resolved CDN paths for `unpkg` and `jsdelivr` package.json fields.
+ */
+export interface CdnPaths {
+    /** Path advertised on the `unpkg` field. */
+    unpkg: string;
+    /** Path advertised on the `jsdelivr` field. */
+    jsdelivr: string;
+}
+/**
+ * Optional overrides accepted by {@link getCdnPaths}.
+ */
+export interface CdnPathOverrides {
+    /** Explicit path for the `unpkg` field. */
+    unpkg?: string;
+    /** Explicit path for the `jsdelivr` field. */
+    jsdelivr?: string;
+}
+/**
+ * Computes the CDN entry paths advertised on the published `package.json`.
+ *
+ * Priority order:
+ * 1. Explicit `opts.unpkg` / `opts.jsdelivr` overrides win for their respective field.
+ * 2. The first UMD bundle, when one was emitted, supplies the default path.
+ * 3. The first IIFE bundle is used when no UMD bundle exists.
+ * 4. When no UMD or IIFE bundles were produced, returns `undefined` so callers can
+ *    skip emitting the fields entirely.
+ *
+ * @param formatOutputs - Aggregated bundle-phase output.
+ * @param opts - Optional explicit overrides for either CDN field.
+ * @returns Resolved CDN paths or `undefined` when no CDN-eligible bundle was produced.
+ *
+ * @example Resolving CDN paths from a UMD-only build
+ * ```typescript
+ * const cdn = getCdnPaths(formatOutputs)
+ * // → { unpkg: './bundle/index.umd.min.js', jsdelivr: './bundle/index.umd.min.js' }
+ * ```
+ */
+export declare const getCdnPaths: (formatOutputs: FormatOutputs, opts?: CdnPathOverrides) => CdnPaths | undefined;
+//# sourceMappingURL=cdn-paths.d.ts.map

package/package/json/cdn-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cdn-paths.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/builder/src/package/json/cdn-paths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEjD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAA;IACb,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,WAAW,GAAI,eAAe,aAAa,EAAE,OAAO,gBAAgB,KAAG,QAAQ,GAAG,SAS9F,CAAA"}

package/package/json/filter-deps.d.ts

@@ -0,0 +1,39 @@
+import type { IsWorkspacePackagePredicate, PackageJson } from '../../models';
+/**
+ * Returns a new `PackageJson` with workspace-internal entries stripped from
+ * `dependencies`. `peerDependencies` and `optionalDependencies` are preserved
+ * verbatim so consumers retain optional integrations.
+ *
+ * If filtering empties the `dependencies` map, the field is removed from the
+ * returned object instead of left as `{}`.
+ *
+ * @param pkg - Source `PackageJson` to filter.
+ * @param isWorkspacePackage - Predicate returning `true` for workspace-internal packages.
+ * @returns Filtered `PackageJson` clone.
+ *
+ * @example Stripping `@hyperfrontend/*` deps before publishing
+ * ```typescript
+ * const filtered = filterWorkspaceDepsFromOutput(srcPkg, byPrefix('@hyperfrontend/'))
+ * ```
+ */
+export declare const filterWorkspaceDepsFromOutput: (pkg: PackageJson, isWorkspacePackage: IsWorkspacePackagePredicate) => PackageJson;
+/**
+ * Returns a new `PackageJson` with bundled-dep entries stripped from `dependencies`.
+ *
+ * When the dist contains pre-passed copies under `_dependencies/<dep>/`, those packages
+ * are no longer transitive runtime requirements — consumers get them inside the tarball.
+ * Removing them from the published `dependencies` field keeps the manifest honest.
+ *
+ * If filtering empties the `dependencies` map, the field is removed entirely.
+ *
+ * @param pkg - Source `PackageJson` to filter.
+ * @param bundledDeps - Bundled-dep package names (typically `BuildContext.bundledDeps`).
+ * @returns Filtered `PackageJson` clone.
+ *
+ * @example Stripping bundled deps from the published dependencies map
+ * ```typescript
+ * const filtered = filterBundledDepsFromOutput(srcPkg, ['rollup', 'postject'])
+ * ```
+ */
+export declare const filterBundledDepsFromOutput: (pkg: PackageJson, bundledDeps: string[]) => PackageJson;
+//# sourceMappingURL=filter-deps.d.ts.map

package/package/json/filter-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter-deps.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/builder/src/package/json/filter-deps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAI5E;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,GAAI,KAAK,WAAW,EAAE,oBAAoB,2BAA2B,KAAG,WAWjH,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,2BAA2B,GAAI,KAAK,WAAW,EAAE,aAAa,MAAM,EAAE,KAAG,WAarF,CAAA"}