@mosetta/build 0.0.0-stage → 0.0.9

package/src/packagesResolver.mjs

@@ -0,0 +1,159 @@
+import { path } from './nodeApi.mjs';
+import { exports as resolveExports } from 'resolve.exports';
+import { probeFile, isDirectoryRequest } from './probeFile.mjs';
+import { packageDirOf } from './packageMeta.mjs';
+import { shortHash } from './hash.mjs';
+
+// environment harnesses (CLI, plan packer) need the upward walk — re-export it from this entry
+export { packageDirOf, packageVersionOf } from './packageMeta.mjs';
+
+/**
+ * Package resolution ON TOP of the file port (the "lock scan + code scan" step).
+ *
+ * Resolution used to be port methods and on node hid inside `createRequire` — i.e. an
+ * environment capability. Now it is a SEPARATE abstraction with a single implementation,
+ * identical across environments: the "(importer package, name) → package dir" edges arrive as
+ * DATA (a catalog from the scanner), while the in-package entry is chosen here — the `exports`
+ * map via `resolve.exports`, legacy main/index via `probeFile`. The resolver reads files through
+ * the port: it needs package.json and path probes, but has no environment magic of its own.
+ *
+ * In the CLI the catalog is generated by the scanner before every build iteration; in an isolate
+ * it arrives in the plan. The environment difference lives entirely in the catalog's origin; the
+ * resolver itself does not know about it.
+ */
+
+// Files the build mixes in FROM THE TOOL'S OWN installation, not from the distributive
+// (loader, bootstrap, default facets). The list lives here so that the scanner and the plan
+// packer build `catalog.framework` from the same enumeration.
+export const FRAMEWORK_RESOLUTIONS = [
+  '@mosetta/build',
+  '@mosetta/runtime',
+  '@mosetta/runtime/bootstrap',
+  'systemjs/dist/system.js',
+  'systemjs/dist/extras/named-register.js',
+];
+
+const MAX_WALK_UP = 50;
+
+const notFound = (specifier, fromDir, reason) => {
+  const e = new Error(`Cannot resolve '${specifier}' from '${fromDir}'${reason ? ` (${reason})` : ''}`);
+  e.code = 'MODULE_NOT_FOUND';
+  return e;
+};
+
+// '@scope/name/sub/path' → { name: '@scope/name', subpath: './sub/path' }
+function splitBare(specifier) {
+  const parts = specifier.split('/');
+  const name = specifier.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
+  const rest = specifier.slice(name.length);
+  return { name, subpath: rest ? `.${rest}` : '.' };
+}
+
+export class PackagesResolver {
+  #stamp = null;
+
+  constructor({ fileSystem, catalog }) {
+    this.fileSystem = fileSystem;
+    this.catalog = catalog;
+  }
+
+  /**
+   * Catalog fingerprint — the resolution edges as a whole. The dev server rescans the catalog
+   * on every iteration, and `pnpm add` mid-session changes RESOLUTION without touching a single
+   * source file: the artifact cache needs a signal that notices this. Computed once per resolver.
+   */
+  get stamp() {
+    return (this.#stamp ??= shortHash(JSON.stringify(this.catalog)));
+  }
+
+  /**
+   * Resolve a specifier as seen FROM `fromDir` (importer-relative resolution). Throws on failure.
+   *
+   * `conditions` — the `exports` conditions of the TARGET environment (`['browser','import']`, …).
+   * This is TARGET POLICY, not an environment property: dual packages have different files on the
+   * `require` and `import` branches (zod: `index.cjs` vs `index.js`). `null` — require semantics
+   * (how node's `require()` resolves).
+   */
+  resolve(specifier, fromDir, conditions = null) {
+    if (specifier.startsWith('.') || path.isAbsolute(specifier)) {
+      const target = path.isAbsolute(specifier) ? specifier : path.resolve(fromDir, specifier);
+      const found = probeFile(this.fileSystem, target, { directoryOnly: isDirectoryRequest(specifier) });
+      if (!found) throw notFound(specifier, fromDir);
+      return found;
+    }
+    const { name, subpath } = splitBare(specifier);
+    const pkgDir = this.#packageDirFor(name, fromDir);
+    if (!pkgDir) throw notFound(specifier, fromDir, 'no edge in the package catalog');
+    return this.#entryOf(pkgDir, specifier, subpath, conditions, fromDir);
+  }
+
+  /**
+   * Resolve from the TOOL'S OWN installation, not the distributive: systemjs, `@mosetta/runtime`
+   * and the rest of the FRAMEWORK_RESOLUTIONS list — via precomputed catalog answers.
+   */
+  resolveFramework(specifier) {
+    const hit = this.catalog.framework?.[specifier];
+    if (!hit) throw notFound(specifier, '<framework>', 'not in catalog.framework');
+    return hit;
+  }
+
+  // "name → package dir" edge: from the package owning fromDir up through its parents — the same
+  // directionality as node's node_modules walk, only over recorded edges.
+  #packageDirFor(name, fromDir) {
+    let dir = fromDir;
+    for (let i = 0; i < MAX_WALK_UP; i++) {
+      const pkgDir = packageDirOf(this.fileSystem, path.join(dir, '_'));
+      if (!pkgDir) return null;
+      const dep = this.catalog.edges[pkgDir]?.[name];
+      if (dep) return dep;
+      // parity policy: product code sees only dependencies — the error explains WHAT to fix
+      // instead of a bare "not found"
+      if (this.catalog.devOnly?.[pkgDir]?.[name]) {
+        const e = new Error(
+          `'${name}' is declared in devDependencies (${pkgDir}) but imported by product code — `
+          + `a production build sees only dependencies; move the package to dependencies`,
+        );
+        e.code = 'DEV_DEPENDENCY';
+        throw e;
+      }
+      try {
+        // self-reference: a package importing itself by name (node allows this via exports)
+        if (this.fileSystem.readJson(path.join(pkgDir, 'package.json')).name === name) return pkgDir;
+      } catch { /* no manifest — keep walking up */ }
+      const parent = path.dirname(pkgDir);
+      if (parent === pkgDir) return null;
+      dir = parent;
+    }
+    return null;
+  }
+
+  // Entry inside the package: the `exports` map (the modern path, with encapsulation) or legacy
+  // main/index/path probing. Same order as node: the presence of `exports` disables legacy.
+  #entryOf(pkgDir, specifier, subpath, conditions, fromDir) {
+    let pkg = null;
+    try {
+      pkg = this.fileSystem.readJson(path.join(pkgDir, 'package.json'));
+    } catch { /* package without a manifest — legacy branch */ }
+
+    if (pkg?.exports != null) {
+      let hit;
+      try {
+        // `unsafe: true` — do NOT add conditions on our own. Otherwise resolve.exports implicitly
+        // mixes in `node` and the package resolves to its node branch built for real node
+        // (disk reads, runtime wasm compilation) — a guaranteed failure in an isolate, and simply
+        // the wrong code in a browser artifact. Conditions come from TARGET POLICY
+        // (`conditions.mjs`); resolve.exports always traverses `default` branches.
+        hit = resolveExports(pkg, specifier, { conditions: conditions ?? ['require'], unsafe: true });
+      } catch {
+        throw notFound(specifier, fromDir, 'not in the exports map');
+      }
+      if (!hit?.[0]) throw notFound(specifier, fromDir, 'not in the exports map');
+      return path.join(pkgDir, hit[0]);
+    }
+
+    const target = subpath === '.' ? pkgDir : path.resolve(pkgDir, subpath);
+    const found = probeFile(this.fileSystem, target, { directoryOnly: isDirectoryRequest(specifier) });
+    if (!found) throw notFound(specifier, fromDir);
+    return found;
+  }
+}

package/src/plugins/assets.mjs

@@ -0,0 +1,41 @@
+import { path } from '../nodeApi.mjs';
+import { hashedAssetName } from '../hash.mjs';
+
+export const ASSET_RE = /\.(png|jpe?g|gif|svg|webp|avif|ico|bmp|woff2?|ttf|eot|otf|mp4|webm|mp3|wav|ogg|pdf)$/i;
+
+/**
+ * Rollup plugin: turn `import x from './img.png'` into a value resolved at runtime by
+ * @mosetta/runtime's __asset(rel, import.meta.url). Records {src,out} so the asset file can be
+ * copied co-located with the module. `collected` is a Map(out -> srcAbsPath) (dedup by out name).
+ */
+export function assets(collected, extraExtensions, fileSystem) {
+  // data-level extensibility: `assetExtensions` from mosetta.json widens the built-in
+  // list — a custom asset type in the simple case needs no rollup plugin at all
+  const extraRe = extraExtensions?.length
+    ? new RegExp(`\\.(${extraExtensions.map((e) => e.replace(/^\./, '')).join('|')})$`, 'i')
+    : null;
+  const isAsset = (source) => ASSET_RE.test(source) || (extraRe && extraRe.test(source));
+  return {
+    name: 'mosetta-assets',
+    async resolveId(source, importer) {
+      if (!isAsset(source)) return null;
+      const abs = importer ? path.resolve(path.dirname(importer), source) : path.resolve(source);
+      return { id: `${abs}?mosetta-asset`, external: false };
+    },
+    load(id) {
+      if (!id.endsWith('?mosetta-asset')) return null;
+      const abs = id.slice(0, -'?mosetta-asset'.length);
+      const buf = fileSystem.readFile(abs);
+      // the asset's name derives from its CONTENT: editing an image changes the name inside the
+      // artifact, so the file itself must be watched (the id carries a marker suffix, we watch
+      // the clean path)
+      this.addWatchFile(abs);
+      const out = hashedAssetName(abs, buf);
+      collected.set(out, abs);
+      return (
+        `import { __asset } from '@mosetta/runtime';\n` +
+        `export default __asset(${JSON.stringify('./' + out)}, import.meta.url);\n`
+      );
+    },
+  };
+}

package/src/plugins/cssIntercept.mjs

@@ -0,0 +1,38 @@
+import { path } from '../nodeApi.mjs';
+import { CLIENT_CONDITIONS } from '../conditions.mjs';
+
+/**
+ * Rollup plugin: keep `*.css` imports OUT of the module JS (System artifact carries no CSS),
+ * but record their resolved paths so the CSS pipeline can emit a co-located stylesheet artifact.
+ * Relative imports resolve against the importer; BARE imports ('@mosetta/ui/ui.css')
+ * resolve through the fileSystem FROM the importer's directory — library css lands in the consuming
+ * MODULE's scoped artifact (dependency artifacts carry no css; duplication accepted).
+ * `baseDir` — resolution context for the entry (it has no importer).
+ */
+export function cssIntercept(collected, resolver, baseDir) {
+  return {
+    name: 'mosetta-css-intercept',
+    resolveId(source, importer) {
+      if (!source.endsWith('.css')) return null;
+      const isPathLike = source.startsWith('.') || path.isAbsolute(source);
+      let resolved;
+      if (isPathLike) {
+        resolved = importer
+          ? path.resolve(path.dirname(importer), source)
+          : path.resolve(source);
+      } else {
+        // resolve from the importing file's package first (pnpm: deps live per-package)
+        resolved = resolver.resolve(source, importer ? path.dirname(importer) : baseDir, CLIENT_CONDITIONS);
+      }
+      collected.push(resolved);
+      // css is read by `processCss`, not rollup (a stub is served below) — so we add it to the
+      // watch list here, otherwise a style edit would not invalidate the module artifact
+      this.addWatchFile(resolved);
+      return { id: resolved, external: false };
+    },
+    load(id) {
+      if (id.endsWith('.css')) return 'export default undefined;';
+      return null;
+    },
+  };
+}

package/src/plugins/defineEnv.mjs

@@ -0,0 +1,14 @@
+import replace from '@rollup/plugin-replace';
+
+// Replace `process.env.NODE_ENV` with a string literal at build time.
+// Browsers have no `process`; CJS deps (react, react-dom, scheduler) branch on this, so without
+// it they throw `process is not defined`. The literal also lets dead branches tree-shake out.
+export function defineEnv(mode) {
+  const nodeEnv = mode === 'production' ? 'production' : 'development';
+  return replace({
+    preventAssignment: true,
+    values: {
+      'process.env.NODE_ENV': JSON.stringify(nodeEnv),
+    },
+  });
+}

package/src/plugins/monolithCompat.mjs

@@ -0,0 +1,84 @@
+import { builtinModules, path } from '../nodeApi.mjs';
+
+/**
+ * Monolith compatibility with workerd — the FRAMEWORK DEFAULTS of packing: everything that used
+ * to be a "recipe" in the platform's mosetta.build.mjs lives here in one place and works for any
+ * server facet. None of it requires node — the shims are generated as virtual modules.
+ *
+ * What and why:
+ *  - BARE standard-library names (`fs`, `process`, …): the CJS ecosystem demands them via
+ *    DYNAMIC require too — external would yield "Dynamic require is not supported". We
+ *    substitute a virtual shim that STATICALLY re-exports `node:*` (while `node:*` stays
+ *    external — workerd provides it under nodejs_compat, the runner enables the flags at
+ *    composition);
+ *  - `cjs-module-lexer`: its `import` entry compiles wasm at runtime (forbidden in workerd).
+ *    We resolve WITHOUT conditions (require semantics) — the package's exports map itself
+ *    yields the pure-JS entry `lexer.js` via the `default` branch. This picks an entry the
+ *    author declared, it is not a patch;
+ *  - `graceful-fs`: monkey-patches fs at top level, and workerd's fs is frozen — we substitute
+ *    the fs shim (nobody calls this package's file functions inside the isolate);
+ *  - `@rollup/browser`: fetches its wasm via `fetch(new URL(..., import.meta.url))` and cannot
+ *    accept a precompiled WebAssembly.Module (esbuild-wasm can: `initialize({wasmModule})`).
+ *    The only real patch: the default URL is replaced with `globalThis.__ROLLUP_WASM__`, where
+ *    the action puts the DECLARED wasm module. Goes away once upstream adds a parameter.
+ */
+
+const SHIM_NAMESPACE = 'mosetta-node-shim';
+// there is nothing esbuild can turn a `require()` of an external module into ("Dynamic require
+// is not supported"), so `node:*` require calls also go to the shim — it gives a STATIC binding;
+// `node:*` import declarations stay external (workerd provides them)
+const REQUIRE_KINDS = new Set(['require-call', 'require-resolve']);
+const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const BARE_BUILTINS_RE = new RegExp(`^(${builtinModules.map(escape).join('|')})$`);
+const ROLLUP_WASM_URL_RE = /void 0===(\w+)&&\(\1=new URL\("bindings_wasm_bg\.wasm",[^)]*\)\)/;
+
+export function monolithCompat(fileSystem, resolver) {
+  return {
+    name: 'mosetta-monolith-compat',
+    setup(build) {
+      build.onResolve({ filter: BARE_BUILTINS_RE }, (args) => ({
+        path: args.path,
+        namespace: SHIM_NAMESPACE,
+      }));
+      build.onResolve({ filter: /^node:/ }, (args) => (REQUIRE_KINDS.has(args.kind)
+        ? { path: args.path.slice('node:'.length), namespace: SHIM_NAMESPACE }
+        : null));
+      build.onResolve({ filter: /^graceful-fs$/ }, () => ({ path: 'fs', namespace: SHIM_NAMESPACE }));
+      build.onLoad({ filter: /.*/, namespace: SHIM_NAMESPACE }, (args) => ({
+        contents: `import * as ns from 'node:${args.path}';\n`
+          + 'export default ns.default ?? ns;\n'
+          + `export * from 'node:${args.path}';\n`,
+        loader: 'js',
+      }));
+
+      build.onResolve({ filter: /^cjs-module-lexer$/ }, (args) => ({
+        path: resolver.resolve('cjs-module-lexer', args.resolveDir || path.dirname(args.importer), null),
+      }));
+
+      build.onLoad({ filter: /rollup\.browser\.js$/ }, (args) => ({
+        contents: fileSystem.readFile(args.path, 'utf8')
+          .replace(ROLLUP_WASM_URL_RE, 'void 0===$1&&($1=globalThis.__ROLLUP_WASM__)'),
+        loader: 'js',
+      }));
+    },
+  };
+}
+
+/** esbuild options complementing the plugin: standard library external, URL base and cwd pinned. */
+export function monolithCompatOptions() {
+  return {
+    external: ['node:*'],
+    define: { 'import.meta.url': JSON.stringify('file:///bundle/module.js') },
+    // Small runtime divergences that must be closed before the first line of foreign code:
+    //  - workerd's process has no cwd(), and engines/postcss call it when normalizing paths
+    //    (in the monolith's world all paths are absolute, any root will do);
+    //  - workerd DELIBERATELY withholds FinalizationRegistry (GC observability), while the napi
+    //    bridges of wasm packages (napi-wasm in lightningcss-wasm) register handle disposal in
+    //    it. A no-op means handles are not freed on GC — for a short-lived build isolate that is
+    //    bounded memory, not a production leak.
+    banner: {
+      js: 'globalThis.process&&typeof globalThis.process.cwd!=="function"&&(globalThis.process.cwd=()=>"/");'
+        + 'globalThis.FinalizationRegistry||(globalThis.FinalizationRegistry=class{register(){}unregister(){}});',
+    },
+  };
+}

package/src/plugins/portResolve.mjs

@@ -0,0 +1,80 @@
+import { path } from '../nodeApi.mjs';
+import { CLIENT_CONDITIONS } from '../conditions.mjs';
+import { applyBrowserField, applyBrowserEntry, BROWSER_EMPTY } from '../browserField.mjs';
+import { probeFile, isDirectoryRequest } from '../probeFile.mjs';
+
+const isOwnedByAnotherPlugin = (id) => id.includes('\0') || id.includes('?');
+
+/**
+ * Resolver and loader of the module graph ON TOP OF THE PORT.
+ *
+ * Replaces two at once: `@rollup/plugin-node-resolve` and rollup's BUILT-IN resolver — both hit
+ * the disk past the port, so "a builder without node" held only at the outer layer. Now all
+ * module-graph I/O goes through `fileSystem`, and a second port implementation gets the graph
+ * for free.
+ *
+ * The position in the plugin list is SIGNIFICANT and mirrors the old one: where `nodeResolve`
+ * stood — in its place; where there was no resolver and the built-in worked — last. Otherwise
+ * we would intercept what used to reach `cssIntercept`, `assets`, `commonjs` or the transpiler.
+ */
+export function portResolve(fileSystem, resolver, baseDir) {
+  // Symlinks are dereferenced DELIBERATELY: rollup and node-resolve do this by default
+  // (`preserveSymlinks: false`), and the whole graph currently lives in realpath form — a
+  // workspace package is seen as `packages/react/src/...`, not as a path inside node_modules.
+  // Without this, ids would fork and the same file would enter the bundle twice.
+  const canonical = (file) => {
+    try {
+      return fileSystem.realPath(file);
+    } catch {
+      return file;
+    }
+  };
+
+  return {
+    name: 'mosetta-port-resolve',
+
+    resolveId(source, importer) {
+      if (isOwnedByAnotherPlugin(source)) return null;
+
+      const fromDir = importer && !isOwnedByAnotherPlugin(importer)
+        ? path.dirname(importer)
+        : baseDir;
+
+      if (path.isAbsolute(source) || source.startsWith('.')) {
+        const target = path.isAbsolute(source) ? source : path.resolve(fromDir, source);
+        // a trailing slash disables node's file branch — decide by the ORIGINAL specifier
+        const found = probeFile(fileSystem, target, { directoryOnly: isDirectoryRequest(source) });
+        // the owning package's legacy `browser` map also hits the package's INTERNAL paths
+        return found ? applyBrowserField(fileSystem, canonical(found), CLIENT_CONDITIONS) : null;
+      }
+
+      // bare: exports maps and conditions are policy over the package catalog — the resolver's job
+      try {
+        const resolved = canonical(resolver.resolve(source, fromDir, CLIENT_CONDITIONS));
+        const entry = applyBrowserEntry(fileSystem, source, resolved, CLIENT_CONDITIONS);
+        return applyBrowserField(fileSystem, entry, CLIENT_CONDITIONS);
+      } catch {
+        return null; // let rollup decide: an external import or an honest error
+      }
+    },
+
+    load(id) {
+      // `"…": false` in the browser map — the module does not exist in the browser, serve a stub
+      if (id === BROWSER_EMPTY) return 'export default {};\n';
+      if (isOwnedByAnotherPlugin(id)) return null;
+      try {
+        const code = fileSystem.readFile(id, 'utf8');
+        // The file was read by US, not by rollup — so WE must also put it into the watch list:
+        // rollup fills `bundle.watchFiles` only from its own loader, which never runs with the
+        // port. Without this line the list is empty, and everything resting on it silently
+        // breaks: mtime cache invalidation and the dev server's watching of sources OUTSIDE
+        // `modules/` (in the monorepo that is every workspace library). The path here is already
+        // dereferenced (`canonical`), so a workspace symlink points at the real file.
+        this.addWatchFile(id);
+        return code;
+      } catch {
+        return null;
+      }
+    },
+  };
+}

package/src/plugins/portResolveEsbuild.mjs

@@ -0,0 +1,103 @@
+import { path } from '../nodeApi.mjs';
+import { probeFile, isDirectoryRequest } from '../probeFile.mjs';
+
+const LOADER = { '.ts': 'ts', '.tsx': 'tsx', '.js': 'js', '.mjs': 'js', '.cjs': 'js', '.json': 'json' };
+
+// INPUT sourcemaps are the last channel where the engine hit the disk BY ITSELF: on seeing
+// `//# sourceMappingURL=index.js.map` in a loaded file, esbuild reads that file with its own FS
+// and inlines the vendor's original sources into our map. On disk this works; in an isolate the
+// engine has no FS — and the artifact map diverged between environments (for
+// @pnpm/crypto.polyfill: 252 `sources` entries vs 240). So we pull the map THROUGH THE PORT and
+// inline it; if it is missing, we strip the reference so the engine has nowhere to go. The
+// environment stops influencing the bytes.
+const MAP_URL_RE = /\n?\/\/# sourceMappingURL=([^\s'"]+)[ \t]*\n?$/;
+
+const toBase64 = (bytes) => {
+  let binary = '';
+  for (let i = 0; i < bytes.length; i += 0x8000) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + 0x8000));
+  }
+  return btoa(binary);
+};
+
+function inlineInputSourcemap(fileSystem, file, contents) {
+  const hit = MAP_URL_RE.exec(contents);
+  if (!hit) return contents;
+  const url = hit[1];
+  if (url.startsWith('data:')) return contents; // already inline — nowhere for the engine to go
+  const stripped = contents.slice(0, hit.index);
+  try {
+    const map = fileSystem.readFile(path.resolve(path.dirname(file), decodeURIComponent(url)));
+    const bytes = typeof map === 'string' ? new TextEncoder().encode(map) : map;
+    return `${stripped}\n//# sourceMappingURL=data:application/json;base64,${toBase64(bytes)}\n`;
+  } catch {
+    return stripped; // map missing (or unreachable) — drop the reference: no divergence allowed
+  }
+}
+
+/**
+ * Resolver and loader of private monoliths ON TOP OF THE PORT (esbuild half).
+ *
+ * The client path is built by rollup, monoliths by esbuild, and that is no accident: their
+ * output contracts differ (System with external dependencies vs a self-contained ESM). But the
+ * seam is the same in both engines — `onResolve`/`onLoad`, so the technique is the same too:
+ * esbuild stops hitting the disk with its own resolver, all I/O goes through the port.
+ *
+ * Resolution starts from `args.resolveDir` — esbuild itself puts the importer's directory there,
+ * and for `stdin` the configured `resolveDir`. Our own `dirname(importer)` does not work here:
+ * for stdin the importer is `<stdin>`, not a path.
+ */
+
+// esbuild picks the `exports` branch by the KIND of import: `import` yields the ESM branch,
+// `require()` the CJS one. For a dual package these are DIFFERENT files (zod: index.js vs
+// index.cjs), so the import/require axis cannot be a policy constant — it depends on each
+// individual reference.
+const REQUIRE_KINDS = new Set(['require-call', 'require-resolve']);
+
+export function portResolveEsbuild(fileSystem, resolver, baseDir, conditions, watched = null) {
+  const conditionsFor = (kind) => (REQUIRE_KINDS.has(kind)
+    ? conditions.map((c) => (c === 'import' ? 'require' : c))
+    : conditions);
+
+  // symlinks are dereferenced — as both esbuild and rollup do by default; otherwise one
+  // workspace file would enter the bundle twice under different ids
+  const canonical = (file) => {
+    try {
+      return fileSystem.realPath(file);
+    } catch {
+      return file;
+    }
+  };
+  // resolution also feeds the list: some files are taken over for loading by `monolithCompat`
+  // (vendor patches), so we never see their `onLoad` — yet we must know them for invalidation
+  const seen = (file) => (watched?.add(file), file);
+
+  return {
+    name: 'mosetta-port-resolve-esbuild',
+    setup(build) {
+      build.onResolve({ filter: /.*/ }, (args) => {
+        const fromDir = args.resolveDir
+          || (args.importer && path.isAbsolute(args.importer) ? path.dirname(args.importer) : baseDir);
+        if (path.isAbsolute(args.path) || args.path.startsWith('.')) {
+          const found = probeFile(fileSystem, path.resolve(fromDir, args.path),
+            { directoryOnly: isDirectoryRequest(args.path) });
+          return found ? { path: seen(canonical(found)) } : null;
+        }
+        try {
+          return { path: seen(canonical(resolver.resolve(args.path, fromDir, conditionsFor(args.kind)))) };
+        } catch {
+          return null; // let esbuild report it itself — its message is clear
+        }
+      });
+
+      // esbuild has no `bundle.watchFiles` — only the one who reads the graph knows its
+      // composition, i.e. us; the list is needed outside for mtime invalidation and dev-server
+      // watching
+      build.onLoad({ filter: /.*/ }, (args) => (watched?.add(args.path), {
+        contents: inlineInputSourcemap(fileSystem, args.path, fileSystem.readFile(args.path, 'utf8')),
+        loader: LOADER[path.extname(args.path)] ?? 'js',
+        resolveDir: path.dirname(args.path),
+      }));
+    },
+  };
+}

package/src/plugins/transform.mjs

@@ -0,0 +1,56 @@
+import { path } from '../nodeApi.mjs';
+
+const TS_RE = /\.(ts|tsx)$/;
+const LOADER = { '.ts': 'ts', '.tsx': 'tsx' };
+
+// Transpile policy belongs to the BUILD, not the engine: the engine only knows "string in, string out".
+const TRANSFORM = {
+  jsx: 'automatic',
+  target: 'es2020',
+  tsconfigRaw: { compilerOptions: { experimentalDecorators: true } },
+};
+
+/**
+ * TS/TSX transpilation as an ENGINE CAPABILITY, not a binding to a native binary.
+ *
+ * This used to be `rollup-plugin-esbuild`, pulling the platform esbuild binary — the last
+ * engine-bound node of the client path, not portable into an isolate. Now the plugin asks the
+ * engine for `transform(code, opts)`; which esbuild stands behind it — native or wasm — is
+ * decided by whoever injected the engine. Resolution is not part of this: `portResolve`
+ * covers it entirely.
+ */
+export function transformTs(engine) {
+  return {
+    name: 'mosetta-transform',
+    async transform(code, id) {
+      if (!TS_RE.test(id)) return null;
+      const r = await engine.transform(code, {
+        ...TRANSFORM,
+        loader: LOADER[path.extname(id)],
+        sourcefile: id,
+        sourcemap: true,
+      });
+      return { code: r.code, map: r.map || null };
+    },
+  };
+}
+
+/**
+ * Minification — a post-pass over the finished chunk (prod). Mangling touches only the
+ * artifact's internal scope: the `System.register` name, dependency specifiers and export names
+ * are string literals, so cross-artifact linkage survives it unchanged.
+ */
+export function minifyChunk(engine) {
+  return {
+    name: 'mosetta-minify',
+    async renderChunk(code) {
+      const r = await engine.transform(code, {
+        loader: 'js',
+        minify: true,
+        target: TRANSFORM.target,
+        sourcemap: true,
+      });
+      return { code: r.code, map: r.map || null };
+    },
+  };
+}

package/src/probeFile.mjs

@@ -0,0 +1,65 @@
+import { path } from './nodeApi.mjs';
+
+/**
+ * The extension probing order is build POLICY, inherited from the former
+ * `@rollup/plugin-node-resolve({ extensions })` setting. This is NOT node's list:
+ * `require.resolve` knows only `.js`/`.json`/`.node` and would never find `.ts`.
+ */
+export const PROBE_EXTENSIONS = ['.mjs', '.js', '.ts', '.tsx', '.json'];
+
+// depth of the `main` → directory → `main` chain: protects against a self-pointing package.json
+const MAX_MAIN_DEPTH = 8;
+
+/**
+ * Was a directory requested EXPLICITLY? In node a trailing slash (and also `.` and `..`)
+ * completely disables the file branch: `./lib/` must resolve to the directory even when
+ * `lib.js` sits next to it. The check must use the ORIGINAL specifier — `path.resolve`
+ * strips the slash.
+ */
+export function isDirectoryRequest(source) {
+  return /(?:^|\/)\.{0,2}$/.test(source) || source.endsWith('/');
+}
+
+function directoryMain(fileSystem, dir) {
+  try {
+    const pkg = fileSystem.readJson(path.join(dir, 'package.json'));
+    return typeof pkg?.main === 'string' && pkg.main ? pkg.main : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve a path to a concrete file — the shared probing for both resolvers (rollup and
+ * esbuild), so the rule is ONE and directly testable.
+ *
+ * Replays node's order (`Module._findPath` → `tryExtensions` / `tryPackage`):
+ *   LOAD_AS_FILE      — the exact file, then `+extension`;
+ *   LOAD_AS_DIRECTORY — `main` from the directory's package.json, and only then `index.*`.
+ *
+ * Every item here cost a found bug: directory-over-file priority sent `./foo` to
+ * `foo/index.js` past `foo.js`; skipping `main` sent a directory with its own package.json to
+ * `index.js` past the declared entry; ignoring the trailing slash turned `./lib/` into
+ * `lib.js`. All three — silently.
+ *
+ * Returns an absolute path or null.
+ */
+export function probeFile(fileSystem, target, { directoryOnly = false, depth = 0 } = {}) {
+  if (!directoryOnly) {
+    // a directory is not a file: `exists` does not know that, so we ask separately
+    if (fileSystem.exists(target) && !fileSystem.isDirectory(target)) return target;
+
+    const withExtension = PROBE_EXTENSIONS.map((e) => target + e).find((f) => fileSystem.exists(f));
+    if (withExtension) return withExtension;
+  }
+
+  if (!fileSystem.isDirectory(target)) return null;
+
+  const main = depth < MAX_MAIN_DEPTH ? directoryMain(fileSystem, target) : null;
+  if (main) {
+    const viaMain = probeFile(fileSystem, path.resolve(target, main), { depth: depth + 1 });
+    if (viaMain) return viaMain;
+  }
+
+  return PROBE_EXTENSIONS.map((e) => path.join(target, `index${e}`)).find((f) => fileSystem.exists(f)) ?? null;
+}