@prosopo/config 3.3.3 → 3.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/config",
-	"version": "3.3.3",
+	"version": "3.3.5",
 	"description": "Prosopo config library",
 	"type": "module",
 	"scripts": {
@@ -21,7 +21,7 @@
 		"@rollup/plugin-node-resolve": "16.0.3",
 		"@rollup/plugin-typescript": "11.1.6",
 		"@rollup/plugin-wasm": "6.2.2",
-		"@vitejs/plugin-react": "5.1.0",
+		"@vitejs/plugin-react": "6.0.4",
 		"esbuild": "0.28.1",
 		"fast-glob": "3.3.2",
 		"html-webpack-plugin": "5.6.0",
@@ -29,9 +29,10 @@
 		"node-polyfill-webpack-plugin": "4.1.0",
 		"rollup": "4.52.5",
 		"rollup-plugin-import-css": "4.1.1",
+		"rollup-plugin-visualizer": "5.12.0",
 		"terser-webpack-plugin": "5.3.14",
 		"vite-plugin-no-bundle": "4.0.0",
-		"vite-tsconfig-paths": "5.1.4"
+		"vite-tsconfig-paths": "6.1.1"
 	},
 	"devDependencies": {
 		"@babel/plugin-proposal-import-attributes-to-assertions": "7.27.1",
@@ -47,7 +48,7 @@
 		"@rollup/plugin-dynamic-import-vars": "2.1.5",
 		"@rollup/plugin-json": "6.1.0",
 		"@types/node": "22.10.2",
-		"@vitest/coverage-v8": "3.2.4",
+		"@vitest/coverage-v8": "4.1.10",
 		"babel-loader": "9.2.1",
 		"concurrently": "9.0.1",
 		"css-loader": "7.1.2",
@@ -60,14 +61,14 @@
 		"tslib": "2.7.0",
 		"tsx": "4.20.6",
 		"typescript": "5.6.2",
-		"vite": "6.4.1",
+		"vite": "8.1.5",
 		"vite-bundle-visualizer": "1.2.1",
-		"vite-plugin-node-polyfills": "0.24.0",
-		"vite-tsconfig-paths": "5.1.4",
-		"vitest": "3.2.4",
+		"vite-plugin-node-polyfills": "0.28.0",
+		"vite-tsconfig-paths": "6.1.1",
+		"vitest": "4.1.10",
 		"webpack": "5.102.1",
 		"webpack-cli": "5.1.4",
-		"webpack-dev-server": "5.2.5"
+		"webpack-dev-server": "5.2.6"
 	},
 	"repository": {
 		"type": "git",

package/src/dependencies.ts

@@ -185,8 +185,21 @@ export async function getDependencies(
 	}
 
 	let concat = "";
-	const { stdout, stderr } = await exec(cmd);
-	concat = stdout + stderr;
+	// `npm ls` exits non-zero on any invalid/unmet/extraneous dependency (e.g.
+	// Vite 8's optional `yaml` peer being satisfied by a hoisted v1 from
+	// cosmiconfig). It still prints the full tree to stdout in that case, so we
+	// tolerate the non-zero exit and parse whatever was emitted.
+	try {
+		const { stdout, stderr } = await exec(cmd);
+		concat = stdout + stderr;
+	} catch (error) {
+		const execError = error as { stdout?: string; stderr?: string };
+		if (typeof execError.stdout === "string") {
+			concat = execError.stdout + (execError.stderr ?? "");
+		} else {
+			throw error;
+		}
+	}
 
 	let deps: string[] = [];
 	let peerDeps: string[] = [];

package/src/vite/index.ts

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 export { default as VitePluginCloseAndCopy } from "./vite-plugin-close-and-copy.js";
+export { default as VitePluginExternalizeObfuscatorDeadCode } from "./vite-plugin-externalize-obfuscator-deadcode.js";
 export { default as ViteTestConfig } from "./vite.test.config.js";
 export { default as ViteThreadsTestConfig } from "./vite.threads.test.config.js";
 export { default as VitePluginSourceMapExclude } from "./vite-plugin-sourcemap-exclude.js";

package/src/vite/vite-plugin-externalize-obfuscator-deadcode.ts

@@ -0,0 +1,43 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import type { Plugin } from "vite";
+
+// js-confuser's `deadCode` transform injects a fixed set of fake `require()`
+// specifiers into obfuscated sources as unreachable dead code. Rollup (Vite 6)
+// left unresolved imports external with a warning, so these harmless specifiers
+// never broke the build. Rolldown (Vite 8) treats an unresolved import as a hard
+// error, so we restore the old behaviour by marking exactly these known
+// dead-code specifiers as external. They are never executed at runtime.
+const OBFUSCATOR_DEADCODE_SPECIFIERS: ReadonlySet<string> = new Set([
+	"../../package",
+	"../redacted.js",
+	"../utils/isStandaloneExecutable",
+	"./resolve-local-redacted-path",
+	"@redacted/components/package",
+	"@redacted/enterprise-plugin",
+	"@redacted/enterprise-plugin/package",
+]);
+
+export default function VitePluginExternalizeObfuscatorDeadCode(): Plugin {
+	return {
+		name: "externalize-obfuscator-deadcode",
+		enforce: "pre",
+		resolveId(source: string) {
+			if (OBFUSCATOR_DEADCODE_SPECIFIERS.has(source)) {
+				return { id: source, external: true };
+			}
+			return null;
+		},
+	};
+}

package/src/vite/vite.backend.config.ts

@@ -20,6 +20,7 @@ import css from "rollup-plugin-import-css";
 import type { UserConfig } from "vite";
 import { filterDependencies, getDependencies } from "../dependencies.js";
 import { default as ClosePlugin } from "./vite-plugin-close-and-copy.js";
+import VitePluginExternalizeObfuscatorDeadCode from "./vite-plugin-externalize-obfuscator-deadcode.js";
 import VitePluginFixAbsoluteImports from "./vite-plugin-fix-absolute-imports.js";
 
 export default async function (
@@ -51,9 +52,18 @@ export default async function (
 		"biome",
 	]);
 
+	// `punycode` is a deprecated Node builtin that the userland npm package
+	// shadows. Rolldown prefix-matches string externals, so listing the builtin
+	// also externalises deep imports like "punycode/punycode.es6.js" (which
+	// uri-js pulls in). Rollup did not, so this only bites under Vite 8. The
+	// provider image ships the bundle with no node_modules, so an external
+	// subpath is an immediate "Cannot find module" at boot. Bare "punycode"
+	// stays external via the node: alias below.
+	const bundledBuiltins = builtinModules.filter((m) => m !== "punycode");
+
 	// Add the node builtins (path, fs, os, etc.) to the external list
 	const allExternal = [
-		...builtinModules,
+		...bundledBuiltins,
 		...builtinModules.map((m) => `node:${m}`),
 		...external,
 		...optionalPeerDependencies,
@@ -128,7 +138,13 @@ export default async function (
 			},
 			modulePreload: { polyfill: false },
 			rollupOptions: {
-				treeshake: "smallest",
+				treeshake: {
+					// Rolldown has no `preset` support, so Rollup's "smallest" could
+					// not be carried over. Honouring pure annotations recovers part
+					// of that without the risk of moduleSideEffects: false.
+					annotations: true,
+					moduleSideEffects: true,
+				},
 				external: allExternal,
 				watch: false,
 				output: {
@@ -139,6 +155,7 @@ export default async function (
 			},
 		},
 		plugins: [
+			VitePluginExternalizeObfuscatorDeadCode(),
 			// plugin to replace stuff like import blah from string_encoder/lib/string_encoder.js with import blah from string_encoder
 			VitePluginFixAbsoluteImports(),
 			// plugin to close the bundle after build if not in serve mode

package/src/vite/vite.commonjs.config.ts

@@ -20,6 +20,7 @@ import tsconfigPaths from "vite-tsconfig-paths";
 import { getExternalsFromReferences } from "../dependencies.js";
 import VitePluginCloseAndCopy from "./vite-plugin-close-and-copy.js";
 import VitePluginCopy from "./vite-plugin-copy.js";
+import VitePluginExternalizeObfuscatorDeadCode from "./vite-plugin-externalize-obfuscator-deadcode.js";
 
 export default async function (
 	name: string,
@@ -38,6 +39,7 @@ export default async function (
 	return defineConfig({
 		ssr: { external: allExternal },
 		plugins: [
+			VitePluginExternalizeObfuscatorDeadCode(),
 			// @ts-ignore
 			{
 				name: "string-replace-import.meta.url",

package/src/vite/vite.esm.config.ts

@@ -20,6 +20,7 @@ import tsconfigPaths from "vite-tsconfig-paths";
 import { getExternalsFromReferences } from "../dependencies.js";
 import VitePluginCloseAndCopy from "./vite-plugin-close-and-copy.js";
 import VitePluginCopy from "./vite-plugin-copy.js";
+import VitePluginExternalizeObfuscatorDeadCode from "./vite-plugin-externalize-obfuscator-deadcode.js";
 
 export default async function (
 	name: string,
@@ -49,6 +50,7 @@ export default async function (
 	return defineConfig({
 		ssr: { external: allExternal },
 		plugins: [
+			VitePluginExternalizeObfuscatorDeadCode(),
 			// @ts-ignore
 			noBundlePlugin({
 				root: "src",
@@ -75,6 +77,16 @@ export default async function (
 			rollupOptions: {
 				treeshake: false,
 				external: allExternal,
+				output: {
+					// Rolldown otherwise emits a CJS-interop runtime that does
+					// `createRequire(import.meta.url)` from "node:module" at module
+					// scope. That is fatal in a browser: anything importing such a
+					// package (e.g. catcher-demo importing @prosopo/util) dies with
+					// 'Module "node:module" has been externalized for browser
+					// compatibility' before React can mount. Rollup emitted no such
+					// runtime, so this only bites under Vite 8.
+					polyfillRequire: false,
+				},
 			},
 		},
 		esbuild: {

package/src/vite/vite.frontend.config.ts

@@ -21,11 +21,13 @@ import { default as viteReact } from "@vitejs/plugin-react";
 import type { Drop } from "esbuild";
 import type { ExternalOption } from "rollup";
 import css from "rollup-plugin-import-css";
+import { visualizer } from "rollup-plugin-visualizer";
 import type { UserConfig } from "vite";
 import { nodePolyfills } from "vite-plugin-node-polyfills";
 import { filterDependencies, getDependencies } from "../dependencies.js";
 import { VitePluginCloseAndCopy } from "./index.js";
 import type { ClosePluginOptions } from "./vite-plugin-close-and-copy.js";
+import VitePluginExternalizeObfuscatorDeadCode from "./vite-plugin-externalize-obfuscator-deadcode.js";
 
 export default async function (
 	packageName: string,
@@ -51,6 +53,11 @@ export default async function (
 
 	console.info(`Running at ${dir} in ${mode} mode`);
 	const isProduction = mode === "production";
+	// Rollup bundle stats (rollup-plugin-visualizer treemap). Off by default —
+	// set PROSOPO_BUNDLE_STATS=true to generate the stats page and open it in
+	// the browser once the bundle has been built.
+	const openBundleStats =
+		process.env.PROSOPO_BUNDLE_STATS?.trim().toLowerCase() === "true";
 	// NODE_ENV must be wrapped in quotes.
 	// If NODE_ENV ends up out of sync (one set to development and the other set to production), it causes
 	// issues like this: https://github.com/hashicorp/next-mdx-remote/pull/323
@@ -182,14 +189,20 @@ export default async function (
 
 			rollupOptions: {
 				treeshake: {
-					annotations: false,
+					// Respect /*#__PURE__*/ annotations. Ignoring them retained
+					// dead library calls that every consumer then shipped;
+					// honouring them cuts ~17KB gzip off the widget bundle with
+					// a byte-identical detector.
+					annotations: true,
 					propertyReadSideEffects: false,
-					tryCatchDeoptimization: false,
-					moduleSideEffects: "no-external", //true,
-					preset: "smallest",
+					// Measured alternatives, both rejected:
+					//   moduleSideEffects: false        -> widget 8KB gzip LARGER
+					//   propertyWriteSideEffects: false -> detector dies on load
+					//                                     ("Maximum call stack
+					//                                     size exceeded")
+					moduleSideEffects: "no-external",
 					unknownGlobalSideEffects: false,
 				},
-				experimentalLogSideEffects: false,
 				external: rollupExternal,
 				watch: false,
 
@@ -199,9 +212,6 @@ export default async function (
 				},
 
 				plugins: [
-					nodePolyfills({
-						include: ["crypto"],
-					}),
 					// biome-ignore lint/suspicious/noExplicitAny: has to be any to represent object prototype
 					css() as any,
 					// biome-ignore lint/suspicious/noExplicitAny: has to be any to represent object prototype
@@ -235,12 +245,19 @@ export default async function (
 							}
 						},
 					},
-					// visualizer({
-					// 	open: true,
-					// 	template: "treemap", //'list',
-					// 	gzipSize: true,
-					// 	brotliSize: true,
-					// }),
+					// Bundle stats page — only wired in (and opened in the
+					// browser) when PROSOPO_BUNDLE_STATS=true. Defaults off so
+					// normal builds neither emit the report nor pop a window.
+					...(openBundleStats
+						? [
+								visualizer({
+									open: true,
+									template: "treemap",
+									gzipSize: true,
+									brotliSize: true,
+								}),
+							]
+						: []),
 					// I think we can use this plugin to build all packages instead of relying on the tsc step that's
 					// currently a precursor in package.json. However, it fails for the following reason:
 					// https://github.com/rollup/plugins/issues/243
@@ -254,6 +271,13 @@ export default async function (
 			},
 		},
 		plugins: [
+			VitePluginExternalizeObfuscatorDeadCode(),
+			// node polyfills must be a top-level Vite plugin (not inside
+			// build.rollupOptions.plugins) so its inject sub-plugin initialises
+			// before transform runs under Rolldown/Vite 8.
+			nodePolyfills({
+				include: ["crypto"],
+			}),
 			// Not sure if we need this plugin or not, it works without it
 			// @ts-ignore
 			viteReact(),

package/src/vite/vite.test.config.ts

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import fs from "node:fs";
 import path from "node:path";
 import tsconfigPaths from "vite-tsconfig-paths";
 import { defineConfig } from "vitest/config";
@@ -30,10 +31,18 @@ export default function (tsConfigPath?: string) {
 			: "@(|)";
 	console.log(`Filtering tests by type: ${testTypeGlob}`);
 
-	// Determine coverage include paths based on current working directory
+	// Determine coverage include paths based on current working directory.
+	//
+	// Detected by looking for a package alongside the cwd rather than by
+	// matching "/packages/" in the path: workspaces also live in dev/, demos/
+	// and integration/, and those were falling through to the repo-root globs
+	// below, which match `packages/*/src/**` only — so they reported 0/0
+	// coverage no matter what their tests exercised. Neither repo root has a
+	// `src` directory, so this cannot misfire in the other direction.
 	const cwd = process.cwd();
 	const isRunningFromPackage =
-		cwd.includes("/packages/") && cwd.includes("/src") === false;
+		fs.existsSync(path.join(cwd, "package.json")) &&
+		fs.existsSync(path.join(cwd, "src"));
 
 	// If running from a package directory, include local src files
 	// If running from repo root, include all package src files
@@ -73,8 +82,6 @@ export default function (tsConfigPath?: string) {
 			minify: false,
 			sourcemap: false,
 			rollupOptions: {
-				maxParallelFileOps: 1,
-				cache: false,
 				output: {
 					sourcemap: false,
 				},
@@ -82,7 +89,9 @@ export default function (tsConfigPath?: string) {
 		},
 		test: {
 			//root: getRootDir(),
-			reporters: ["basic"],
+			// vitest 4 removed the "basic" reporter; the default reporter with
+			// summary disabled reproduces its terse output.
+			reporters: [["default", { summary: false }]],
 			include: [include],
 			watch: false,
 			exclude: ["**/node_modules/**", "**/dist/**"],
@@ -96,11 +105,7 @@ export default function (tsConfigPath?: string) {
 				enabled: true,
 			},
 			pool: "forks", // forks is slower than 'threads' but more compatible with low-level libs (e.g. bcrypt)
-			poolOptions: {
-				forks: {
-					isolate: true,
-				},
-			},
+			isolate: true,
 			sequence: {
 				shuffle: true,
 			},

package/src/vite/vite.threads.test.config.ts

@@ -73,8 +73,6 @@ export default function (tsConfigPath?: string) {
 			minify: false,
 			sourcemap: false,
 			rollupOptions: {
-				maxParallelFileOps: 1,
-				cache: false,
 				output: {
 					sourcemap: false,
 				},
@@ -82,7 +80,9 @@ export default function (tsConfigPath?: string) {
 		},
 		test: {
 			//root: getRootDir(),
-			reporters: ["basic"],
+			// vitest 4 removed the "basic" reporter; the default reporter with
+			// summary disabled reproduces its terse output.
+			reporters: [["default", { summary: false }]],
 			include: [include],
 			watch: false,
 			exclude: ["**/node_modules/**", "**/dist/**"],
@@ -96,12 +96,9 @@ export default function (tsConfigPath?: string) {
 				enabled: true,
 			},
 			pool: "threads", // use threads for tests that should be run sequentially
-			poolOptions: {
-				threads: {
-					minThreads: 1,
-					maxThreads: 1,
-				},
-			},
+			// vitest 4 removed poolOptions; sequential execution is now expressed via
+			// fileParallelism instead of min/maxThreads.
+			fileParallelism: false,
 			testTimeout: 10000,
 		},
 		plugins: plugins,

package/src/webpack/webpack.config.ts

@@ -80,7 +80,14 @@ export default (mode: string) => {
 								"@babel/plugin-transform-runtime",
 								"@babel/transform-class-properties",
 								"@babel/transform-object-rest-spread",
-								"@babel/plugin-transform-react-jsx",
+								// runtime must be "automatic": rolldown keeps the
+								// `@jsxImportSource @emotion/react` pragma in the emitted
+								// dist files (rollup dropped it), and babel rejects that
+								// pragma under the default "classic" runtime with
+								// "importSource cannot be set when runtime is classic".
+								// The JSX in those files is already transformed, so this
+								// only affects how the leftover pragma is interpreted.
+								["@babel/plugin-transform-react-jsx", { runtime: "automatic" }],
 								[
 									"@babel/plugin-syntax-import-attributes",
 									{ deprecatedAssertSyntax: true },