@remix-run/assets 0.5.0 → 0.6.0

package/dist/lib/routes.js

@@ -1,99 +1,143 @@
-import { getRoutePatternCaptures, RoutePattern, } from '@remix-run/route-pattern';
-import { createHref } from '@remix-run/route-pattern/href';
-import { createMatcher } from '@remix-run/route-pattern/match';
-import { getRelativeFilePath, isAbsoluteFilePath, normalizeFilePath, normalizePathname, resolveFilePath, } from './paths.js';
-function normalizeFilePattern(pattern) {
-    if (isAbsoluteFilePath(pattern)) {
-        throw new Error(`File route patterns must be relative to the asset server root.\nPattern: ${pattern}`);
-    }
-    return normalizePathname(pattern);
-}
-export function compileRoutes(basePath, routeConfigs) {
-    if (routeConfigs.every((routeConfig) => Object.keys(routeConfig.fileMap).length === 0)) {
-        throw new Error('createAssetServer() requires at least one configured fileMap entry.');
-    }
-    let compiledRoutes = routeConfigs.flatMap((routeConfig) => Object.entries(routeConfig.fileMap).map(([urlPattern, filePattern]) => compileRoute({
-        filePattern,
-        urlPattern,
-    }, {
-        basePath,
-        rootDir: routeConfig.rootDir,
-    })));
+import * as fs from 'node:fs';
+import { isAbsoluteFilePath, normalizeFilePath, normalizePathname, resolveFilePath, } from './paths.js';
+export function compileRoutes(basePath, mountConfigs) {
+    let compiledMounts = mountConfigs.flatMap((mountConfig) => {
+        let configMounts = Object.entries(mountConfig.mounts).map(([urlRoot, fileRoot]) => compileMount(urlRoot, fileRoot, {
+            basePath,
+            rootDir: mountConfig.rootDir,
+        }));
+        validateNoOverlappingMounts(configMounts);
+        return configMounts;
+    });
+    validateNoOverlappingUrlRoots(compiledMounts);
     return {
         resolveUrlPathname(pathname) {
-            let normalizedPathname = normalizePathname(pathname);
-            for (let route of compiledRoutes) {
-                let match = route.urlMatcher.match(`http://remix.run${normalizedPathname}`);
-                if (!match)
-                    continue;
-                let relativeFilePath = decodeURIComponent(createHref(route.filePattern, match.params)).replace(/^\/+/, '');
-                return resolveFilePath(route.rootDir, relativeFilePath);
-            }
-            return null;
+            return matchUrlPathname(pathname)?.filePath ?? null;
         },
+        matchUrlPathname,
         toUrlPathname(filePath) {
-            let normalizedFilePath = normalizeFilePath(filePath);
-            for (let route of compiledRoutes) {
-                let relativeFilePath = getRelativeFilePath(route.rootDir, normalizedFilePath);
-                let match = route.fileMatcher.match(`http://remix.run/${relativeFilePath}`);
-                if (!match)
-                    continue;
-                return normalizePathname(createHref(route.urlPattern, match.params));
-            }
-            return null;
+            return matchFilePath(filePath)?.urlPathname ?? null;
         },
+        matchFilePath,
     };
+    function matchUrlPathname(pathname) {
+        let normalizedPathname = normalizePathname(pathname);
+        for (let mount of compiledMounts) {
+            let relativePathname = getPathWithinRoot(mount.urlRoot, normalizedPathname);
+            if (relativePathname === null)
+                continue;
+            let filePath = resolveFilePath(mount.fileRoot, decodeURIComponent(relativePathname));
+            if (getPathWithinRoot(mount.fileRoot, filePath) === null)
+                return null;
+            return {
+                filePath,
+                fileRoot: mount.fileRootValue,
+                urlPathname: normalizedPathname,
+                urlRoot: mount.urlRoot,
+            };
+        }
+        return null;
+    }
+    function matchFilePath(filePath) {
+        let normalizedFilePath = normalizeFilePath(filePath);
+        for (let mount of compiledMounts) {
+            let relativeFilePath = getPathWithinRoot(mount.fileRoot, normalizedFilePath);
+            if (relativeFilePath === null)
+                continue;
+            let encodedFilePath = relativeFilePath.split('/').map(encodeURIComponent).join('/');
+            return {
+                filePath: normalizedFilePath,
+                fileRoot: mount.fileRootValue,
+                urlPathname: joinUrlPath(mount.urlRoot, encodedFilePath),
+                urlRoot: mount.urlRoot,
+            };
+        }
+        return null;
+    }
 }
-function compileRoute(route, options) {
-    let basePath = normalizePathname(options.basePath).replace(/\/+$/, '') || '/';
-    let relativeUrlPattern = normalizePathname(route.urlPattern);
-    let urlPatternSource = normalizePathname(`${basePath.replace(/\/+$/, '')}/${relativeUrlPattern.replace(/^\/+/, '')}`);
-    let filePatternSource = normalizeFilePattern(route.filePattern);
-    let urlPattern = RoutePattern.parse(urlPatternSource);
-    let filePattern = RoutePattern.parse(filePatternSource);
-    validateNoUnnamedWildcards(urlPattern, 'URL');
-    validateNoUnnamedWildcards(filePattern, 'File');
-    validateRoutePatterns(urlPattern, filePattern);
+function compileMount(urlRoot, fileRoot, options) {
+    if (isAbsoluteFilePath(fileRoot)) {
+        throw new TypeError(`mounts values must be relative to rootDir. Received "${fileRoot}".`);
+    }
     return {
-        rootDir: normalizeFilePath(options.rootDir).replace(/\/+$/, ''),
-        urlPattern,
-        urlMatcher: createMatcher(urlPattern),
-        filePattern,
-        fileMatcher: createMatcher(stripDotSegments(filePatternSource)),
+        fileRoot: resolveMountFileRoot(options.rootDir, fileRoot),
+        fileRootValue: fileRoot,
+        urlRoot: joinUrlPath(normalizeMountUrlRoot(options.basePath), normalizeMountUrlRoot(urlRoot)),
+        urlRootKey: urlRoot,
     };
 }
-function stripDotSegments(pattern) {
-    let segments = [];
-    for (let segment of pattern.split('/')) {
-        if (segment === '' || segment === '.')
-            continue;
-        if (segment === '..') {
-            segments.pop();
-            continue;
-        }
-        segments.push(segment);
+function normalizeMountUrlRoot(urlRoot) {
+    let normalizedRoot = normalizePathname(urlRoot).replace(/\/+$/, '') || '/';
+    let url = new URL(normalizedRoot, 'http://remix.run');
+    if (url.search !== '' ||
+        url.hash !== '' ||
+        getUrlPathSegmentCount(url.pathname) !== getUrlPathSegmentCount(normalizedRoot)) {
+        throw new TypeError(`mounts keys must be URL pathnames without query strings, fragments, or encoded dot segments. Received "${urlRoot}".`);
     }
-    return segments.join('/');
+    return url.pathname.replace(/\/+$/, '') || '/';
 }
-function validateRoutePatterns(urlPattern, filePattern) {
-    let urlCaptures = getPathnameCaptures(urlPattern);
-    let fileCaptures = getPathnameCaptures(filePattern);
-    if (urlCaptures.length !== fileCaptures.length) {
-        throw new Error(`Route patterns must have matching capture structure.\nURL: ${urlPattern}\nFile: ${filePattern}`);
+function resolveMountFileRoot(rootDir, fileRoot) {
+    let resolvedRoot = resolveFilePath(rootDir, fileRoot);
+    try {
+        resolvedRoot = normalizeFilePath(fs.realpathSync(resolvedRoot));
+    }
+    catch (error) {
+        if (!isUnresolvedPathError(error, resolvedRoot))
+            throw error;
     }
-    for (let i = 0; i < urlCaptures.length; i++) {
-        let urlCapture = urlCaptures[i];
-        let fileCapture = fileCaptures[i];
-        if (urlCapture.type !== fileCapture.type || urlCapture.name !== fileCapture.name) {
-            throw new Error(`Route patterns must have matching capture structure.\nURL: ${urlPattern}\nFile: ${filePattern}`);
+    return resolvedRoot.replace(/\/+$/, '') || '/';
+}
+function getUrlPathSegmentCount(pathname) {
+    return pathname.split('/').filter((segment) => segment !== '').length;
+}
+function joinUrlPath(root, path) {
+    if (path === '' || path === '/')
+        return normalizeMountUrlRoot(root);
+    return normalizePathname(`${root.replace(/\/+$/, '')}/${path.replace(/^\/+/, '')}`);
+}
+function getPathWithinRoot(root, value) {
+    if (value === root)
+        return '';
+    if (root === '/')
+        return value.slice(1);
+    if (!value.startsWith(`${root}/`))
+        return null;
+    return value.slice(root.length + 1);
+}
+function validateNoOverlappingMounts(mounts) {
+    for (let index = 0; index < mounts.length; index++) {
+        let mount = mounts[index];
+        for (let otherIndex = index + 1; otherIndex < mounts.length; otherIndex++) {
+            let otherMount = mounts[otherIndex];
+            if (rootsOverlap(mount.fileRoot, otherMount.fileRoot)) {
+                throw new TypeError(`mounts values must not overlap. Received "${mount.fileRootValue}" and "${otherMount.fileRootValue}", resolving to "${mount.fileRoot}" and "${otherMount.fileRoot}".`);
+            }
         }
     }
 }
-function validateNoUnnamedWildcards(pattern, label) {
-    if (getRoutePatternCaptures(pattern).some((capture) => capture.part === 'pathname' && capture.type === '*' && capture.name === '*')) {
-        throw new Error(`${label} route patterns must use named wildcards for reversible mapping.\nPattern: ${pattern}`);
+function validateNoOverlappingUrlRoots(mounts) {
+    for (let index = 0; index < mounts.length; index++) {
+        let mount = mounts[index];
+        for (let otherIndex = index + 1; otherIndex < mounts.length; otherIndex++) {
+            let otherMount = mounts[otherIndex];
+            if (!rootsOverlap(mount.urlRoot, otherMount.urlRoot))
+                continue;
+            throw new TypeError(`mounts keys must not overlap. Received "${mount.urlRootKey}" and "${otherMount.urlRootKey}".`);
+        }
     }
 }
-function getPathnameCaptures(pattern) {
-    return getRoutePatternCaptures(pattern).filter((capture) => capture.part === 'pathname');
+function rootsOverlap(root, otherRoot) {
+    return (root === otherRoot ||
+        root === '/' ||
+        otherRoot === '/' ||
+        root.startsWith(`${otherRoot}/`) ||
+        otherRoot.startsWith(`${root}/`));
+}
+function isUnresolvedPathError(error, filePath) {
+    // Windows reports UNKNOWN rather than ENOENT when a UNC share cannot be reached.
+    return (error instanceof Error &&
+        'code' in error &&
+        (error.code === 'ENOENT' ||
+            error.code === 'ENOTDIR' ||
+            (error.code === 'UNKNOWN' && filePath.startsWith('//'))));
 }

package/dist/lib/scripts/compiler.js

@@ -315,8 +315,8 @@ export function createScriptCompiler(options) {
     function getStableUrl(identityPath) {
         let stableUrlPathname = resolvedOptions.routes.toUrlPathname(identityPath);
         if (!stableUrlPathname) {
-            throw createAssetServerCompilationError(`File ${identityPath} is outside all configured fileMap entries.`, {
-                code: 'FILE_OUTSIDE_FILE_MAP',
+            throw createAssetServerCompilationError(`File ${identityPath} is outside all configured mounts.`, {
+                code: 'FILE_OUTSIDE_MOUNTS',
             });
         }
         return stableUrlPathname;

package/dist/lib/scripts/resolve.js

@@ -35,7 +35,7 @@ export async function resolveModule(record, transformed, args) {
         let resolvedSpec = resolvedImports.get(unresolved.specifier);
         if (!resolvedSpec?.absolutePath) {
             return failResolve(createAssetServerCompilationError(`Failed to resolve import "${displaySpecifier}" in ${transformed.resolvedPath}. ` +
-                `Ensure it resolves to a file within the configured asset server fileMap, or mark it as external.`, {
+                `Ensure it resolves to a file within a configured asset server mount, or mark it as external.`, {
                 code: 'IMPORT_RESOLUTION_FAILED',
             }), trackedFiles, trackedResolutions, transformed.resolvedPath, { isWatchIgnored: args.isWatchIgnored, trackedResolution });
         }
@@ -54,9 +54,9 @@ export async function resolveModule(record, transformed, args) {
         }
         let stableUrlPathname = args.routes.toUrlPathname(resolvedImport.identityPath);
         if (!stableUrlPathname) {
-            return failResolve(createAssetServerCompilationError(`Import "${displaySpecifier}" in ${transformed.resolvedPath}, resolved to "${resolvedImport.identityPath}", is outside all configured fileMap entries. ` +
-                `Add a matching fileMap entry for this file path, or mark this import as external.`, {
-                code: 'IMPORT_OUTSIDE_FILE_MAP',
+            return failResolve(createAssetServerCompilationError(`Import "${displaySpecifier}" in ${transformed.resolvedPath}, resolved to "${resolvedImport.identityPath}", is outside all configured mounts. ` +
+                `Add a matching mount for this file path, or mark this import as external.`, {
+                code: 'IMPORT_OUTSIDE_MOUNTS',
             }), trackedFiles, trackedResolutions, transformed.resolvedPath, { isWatchIgnored: args.isWatchIgnored, trackedResolution });
         }
         deps.add(resolvedImport.identityPath);
@@ -98,7 +98,7 @@ export async function resolveModule(record, transformed, args) {
         }
         if (!resolvedSpec?.absolutePath) {
             return failResolve(createAssetServerCompilationError(`Failed to resolve accepted HMR dependency "${displaySpecifier}" in ${transformed.resolvedPath}. ` +
-                `Ensure it resolves to a file within the configured asset server fileMap, or mark it as external.`, {
+                `Ensure it resolves to a file within a configured asset server mount, or mark it as external.`, {
                 code: 'IMPORT_RESOLUTION_FAILED',
             }), trackedFiles, trackedResolutions, transformed.resolvedPath, { isWatchIgnored: args.isWatchIgnored, trackedResolution });
         }
@@ -117,9 +117,9 @@ export async function resolveModule(record, transformed, args) {
         }
         let stableUrlPathname = args.routes.toUrlPathname(resolvedImport.identityPath);
         if (!stableUrlPathname) {
-            return failResolve(createAssetServerCompilationError(`Accepted HMR dependency "${displaySpecifier}" in ${transformed.resolvedPath}, resolved to "${resolvedImport.identityPath}", is outside all configured fileMap entries. ` +
-                `Add a matching fileMap entry for this file path, or mark this import as external.`, {
-                code: 'IMPORT_OUTSIDE_FILE_MAP',
+            return failResolve(createAssetServerCompilationError(`Accepted HMR dependency "${displaySpecifier}" in ${transformed.resolvedPath}, resolved to "${resolvedImport.identityPath}", is outside all configured mounts. ` +
+                `Add a matching mount for this file path, or mark this import as external.`, {
+                code: 'IMPORT_OUTSIDE_MOUNTS',
             }), trackedFiles, trackedResolutions, transformed.resolvedPath, { isWatchIgnored: args.isWatchIgnored, trackedResolution });
         }
         if (trackedResolution) {
@@ -234,7 +234,7 @@ async function batchResolveSpecifiers(specifiers, importerPath, resolverFactory)
                 throw createAssetServerCompilationError(normalizedResolution.importerPath === getInjectedPackageImporterPath()
                     ? `Failed to resolve injected import "${specifier}" from asset server.`
                     : `Failed to resolve import "${normalizedResolution.specifier}" in ${normalizedResolution.importerPath}. ` +
-                        `Ensure it resolves to a file within the configured asset server fileMap, or mark it as external.`, {
+                        `Ensure it resolves to a file within a configured asset server mount, or mark it as external.`, {
                     code: 'IMPORT_RESOLUTION_FAILED',
                 });
             }

package/dist/lib/scripts/transform.js

@@ -109,8 +109,8 @@ export async function transformModule(record, args) {
     try {
         let stableUrlPathname = args.routes.toUrlPathname(record.identityPath);
         if (!stableUrlPathname) {
-            throw createAssetServerCompilationError(`File ${record.identityPath} is outside all configured fileMap entries.`, {
-                code: 'FILE_OUTSIDE_FILE_MAP',
+            throw createAssetServerCompilationError(`File ${record.identityPath} is outside all configured mounts.`, {
+                code: 'FILE_OUTSIDE_MOUNTS',
             });
         }
         let analysis = await analyzeModuleSource(sourceText, resolvedPath, transformOptions, {

package/dist/lib/styles/resolve.js

@@ -70,8 +70,8 @@ export function resolveServedStyleOrThrow(filePath, args) {
     }
     let stableUrlPathname = args.routes.toUrlPathname(identityPath);
     if (!stableUrlPathname) {
-        throw createAssetServerCompilationError(`File ${identityPath} is outside all configured fileMap entries.`, {
-            code: 'FILE_OUTSIDE_FILE_MAP',
+        throw createAssetServerCompilationError(`File ${identityPath} is outside all configured mounts.`, {
+            code: 'FILE_OUTSIDE_MOUNTS',
         });
     }
     return { identityPath, stableUrlPathname };
@@ -107,9 +107,9 @@ function resolveImportDependency(url, importerPath, placeholder, args) {
         });
     }
     if (!args.routes.toUrlPathname(identityPath)) {
-        throw createAssetServerCompilationError(`Import "${url}" in ${importerPath}, resolved to "${identityPath}", is outside all configured fileMap entries. ` +
-            `Add a matching fileMap entry for this file path, or mark this import as external.`, {
-            code: 'IMPORT_OUTSIDE_FILE_MAP',
+        throw createAssetServerCompilationError(`Import "${url}" in ${importerPath}, resolved to "${identityPath}", is outside all configured mounts. ` +
+            `Add a matching mount for this file path, or mark this import as external.`, {
+            code: 'IMPORT_OUTSIDE_MOUNTS',
         });
     }
     return {
@@ -156,9 +156,9 @@ function resolveUrlDependency(url, importerPath, placeholder, args) {
         });
     }
     if (!args.routes.toUrlPathname(identityPath)) {
-        throw createAssetServerCompilationError(`URL "${url}" in ${importerPath}, resolved to "${identityPath}", is outside all configured fileMap entries. ` +
-            `Add a matching fileMap entry for this file path.`, {
-            code: 'URL_OUTSIDE_FILE_MAP',
+        throw createAssetServerCompilationError(`URL "${url}" in ${importerPath}, resolved to "${identityPath}", is outside all configured mounts. ` +
+            `Add a matching mount for this file path.`, {
+            code: 'URL_OUTSIDE_MOUNTS',
         });
     }
     let parsedRequest = parseResolvedFileRequest({ hash, search });

package/dist/lib/styles/transform.js

@@ -34,8 +34,8 @@ export async function transformStyle(record, args) {
     try {
         let stableUrlPathname = args.routes.toUrlPathname(record.identityPath);
         if (!stableUrlPathname) {
-            throw createAssetServerCompilationError(`File ${record.identityPath} is outside all configured fileMap entries.`, {
-                code: 'FILE_OUTSIDE_FILE_MAP',
+            throw createAssetServerCompilationError(`File ${record.identityPath} is outside all configured mounts.`, {
+                code: 'FILE_OUTSIDE_MOUNTS',
             });
         }
         let transformResult = runLightningTransform(resolvedPath, rawBytes, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remix-run/assets",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Fetch-based server for compiling browser JS/TS and CSS assets on demand",
   "author": "Michael Jackson <mjijackson@gmail.com>",
   "license": "MIT",
@@ -42,19 +42,18 @@
     "picomatch": "^4.0.4",
     "source-map-js": "^1.2.1",
     "@remix-run/file-storage": "^0.13.7",
-    "@remix-run/headers": "^0.21.1",
     "@remix-run/mime": "^0.4.2",
-    "@remix-run/route-pattern": "^0.24.0"
+    "@remix-run/headers": "^0.21.1"
   },
   "devDependencies": {
     "@types/node": "^24.6.0",
     "@types/picomatch": "^4.0.3",
     "typescript": "^7.0.2",
-    "@remix-run/assert": "0.3.0",
-    "@remix-run/node-hmr": "^0.1.0",
     "@remix-run/node-tsx": "^0.1.1",
+    "@remix-run/node-hmr": "^0.1.0",
+    "@remix-run/assert": "0.3.0",
     "@remix-run/test": "0.6.0",
-    "@remix-run/ui": "0.5.0"
+    "@remix-run/ui": "0.8.0"
   },
   "keywords": [
     "remix",

package/src/assets.ts

@@ -1,4 +1,6 @@
 export { createAssetServer } from './lib/asset-server.ts'
 export { defineFileTransform } from './lib/files/config.ts'
+export type { AssetAccessDetails, AssetAccessRule } from './lib/access.ts'
 export type { AssetServer, AssetServerOptions, BrowserHmrChannel } from './lib/asset-server.ts'
+export type { AssetDetails, AssetKind, AssetStatus } from './lib/inspection.ts'
 export type { ModuleLoader } from './lib/loaders.ts'

package/src/lib/access.ts

@@ -4,9 +4,30 @@ import { createFileMatcher } from './file-matcher.ts'
 import { isInjectedPackageFilePath } from './injected-packages.ts'
 import { normalizeFilePath } from './paths.ts'
 
-type AccessPolicy = {
+/** Access-policy result for an inspected asset file. */
+export interface AssetAccessDetails {
+  /** Whether the asset server may serve the file. */
+  allowed: boolean
+  /** The first configured rule that allowed the file, when one matched. */
+  allowedBy?: AssetAccessRule
+  /** The first matching `denyFiles` pattern, when access was denied. */
+  deniedBy?: string
+}
+
+/** Rule that allows an inspected asset file to be served. */
+export type AssetAccessRule =
+  /** A matching `allowFiles` entry. */
+  | { kind: 'file'; value: string }
+  /** A runtime file provided internally by the asset server. */
+  | { kind: 'injected'; value: string }
+  /** A matching `allowPackages` entry. */
+  | { kind: 'package'; value: string }
+
+export type AccessPolicy = {
+  getAllowedPackageRoots(): readonly string[]
   getPackageWatchDirectories(): readonly string[]
   handleFileEvent(filePath: string): void
+  inspect(filePath: string): AssetAccessDetails
   isAllowed(filePath: string): boolean
 }
 
@@ -29,13 +50,15 @@ export function createAccessPolicy(options: {
   packageSearchRoots?: readonly string[]
   rootDir: string
 }): AccessPolicy {
-  let allowMatchers = options.allowFiles.map((pattern) =>
-    createFileMatcher(pattern, options.rootDir),
-  )
+  let allowMatchers = options.allowFiles.map((pattern) => ({
+    matcher: createFileMatcher(pattern, options.rootDir),
+    pattern,
+  }))
   let allowPackageNames = normalizePackageNames(options.allowPackages, 'allowPackages')
-  let denyMatchers = (options.denyFiles ?? []).map((pattern) =>
-    createFileMatcher(pattern, options.rootDir),
-  )
+  let denyMatchers = (options.denyFiles ?? []).map((pattern) => ({
+    matcher: createFileMatcher(pattern, options.rootDir),
+    pattern,
+  }))
   let packageSearchRoots = [options.rootDir, ...(options.packageSearchRoots ?? [])]
   let packageRootPaths = createPackageRootPaths({
     allowPackageNames,
@@ -57,14 +80,44 @@ export function createAccessPolicy(options: {
     packageRootsDirty = false
   }
 
-  function isAllowedPackage(filePath: string): boolean {
-    if (allowPackageNames.size === 0) return false
+  function getAllowedPackageName(filePath: string): string | undefined {
+    if (allowPackageNames.size === 0) return undefined
     refreshPackageRootPathTries()
 
-    return isPathInPackageRootPathTrie(filePath, allowPackageRootPathTrie)
+    return getPackageNameFromRootPathTrie(filePath, allowPackageRootPathTrie)
+  }
+
+  function inspect(filePath: string): AssetAccessDetails {
+    if (isInjectedPackageFilePath(filePath)) {
+      return { allowed: true, allowedBy: { kind: 'injected', value: '@remix-run/assets' } }
+    }
+
+    let allowedBy: AssetAccessRule | undefined
+    let allowMatch = allowMatchers.find(({ matcher }) => matcher(filePath))
+    if (allowMatch) {
+      allowedBy = { kind: 'file', value: allowMatch.pattern }
+    } else {
+      let packageName = getAllowedPackageName(filePath)
+      if (packageName !== undefined) {
+        allowedBy = { kind: 'package', value: packageName }
+      }
+    }
+
+    if (!allowedBy) return { allowed: false }
+
+    let denyMatch = denyMatchers.find(({ matcher }) => matcher(filePath))
+    if (denyMatch) {
+      return { allowed: false, allowedBy, deniedBy: denyMatch.pattern }
+    }
+
+    return { allowed: true, allowedBy }
   }
 
   return {
+    getAllowedPackageRoots() {
+      refreshPackageRootPathTries()
+      return [...packageRootPaths.keys()]
+    },
     getPackageWatchDirectories() {
       if (allowPackageNames.size === 0) return []
       return packageStateDirectories
@@ -75,13 +128,9 @@ export function createAccessPolicy(options: {
 
       packageRootsDirty = true
     },
+    inspect,
     isAllowed(filePath) {
-      if (isInjectedPackageFilePath(filePath)) return true
-      if (!allowMatchers.some((matcher) => matcher(filePath)) && !isAllowedPackage(filePath)) {
-        return false
-      }
-      if (denyMatchers.length > 0 && denyMatchers.some((matcher) => matcher(filePath))) return false
-      return true
+      return inspect(filePath).allowed
     },
   }
 }
@@ -121,7 +170,7 @@ type PackageJson = {
 
 type PackageRootPathTrie = {
   children: Map<string, PackageRootPathTrie>
-  packageRoot: boolean
+  packageName?: string
 }
 
 type PackageRootQueueItem = {
@@ -132,8 +181,8 @@ type PackageRootQueueItem = {
 function createPackageRootPaths(options: {
   allowPackageNames: ReadonlySet<string>
   searchRoots: readonly string[]
-}): Set<string> {
-  let allowPackageRootPaths = new Set<string>()
+}): Map<string, string> {
+  let allowPackageRootPaths = new Map<string, string>()
   let allowQueue: PackageRootQueueItem[] = []
   let seenAllowedPackageRoots = new Set<string>()
   let searchRoots = normalizePackageSearchRoots(options.searchRoots)
@@ -155,13 +204,13 @@ function createPackageRootPaths(options: {
   }
 
   while (allowQueue.length > 0) {
-    let { packageJsonPath } = allowQueue.shift()!
+    let { packageJsonPath, packageName } = allowQueue.shift()!
     let packageRootPath = normalizeFilePath(path.dirname(packageJsonPath))
     if (seenAllowedPackageRoots.has(packageRootPath)) continue
     seenAllowedPackageRoots.add(packageRootPath)
 
     let packageJson = readPackageJson(packageJsonPath)
-    allowPackageRootPaths.add(packageRootPath)
+    allowPackageRootPaths.set(packageRootPath, packageName)
 
     for (let dependencyName of Object.keys(packageJson.dependencies ?? {})) {
       validatePackageName(
@@ -197,10 +246,12 @@ function createPackageRootPaths(options: {
   return allowPackageRootPaths
 }
 
-function createPackageRootPathTrie(packageRootPaths: ReadonlySet<string>): PackageRootPathTrie {
+function createPackageRootPathTrie(
+  packageRootPaths: ReadonlyMap<string, string>,
+): PackageRootPathTrie {
   let rootNode = createPackageRootPathTrieNode()
 
-  for (let packageRootPath of packageRootPaths) {
+  for (let [packageRootPath, packageName] of packageRootPaths) {
     let node = rootNode
     for (let segment of getFilePathSegments(packageRootPath)) {
       let childNode = node.children.get(segment)
@@ -210,7 +261,7 @@ function createPackageRootPathTrie(packageRootPaths: ReadonlySet<string>): Packa
       }
       node = childNode
     }
-    node.packageRoot = true
+    node.packageName = packageName
   }
 
   return rootNode
@@ -219,22 +270,24 @@ function createPackageRootPathTrie(packageRootPaths: ReadonlySet<string>): Packa
 function createPackageRootPathTrieNode(): PackageRootPathTrie {
   return {
     children: new Map(),
-    packageRoot: false,
   }
 }
 
-function isPathInPackageRootPathTrie(filePath: string, trie: PackageRootPathTrie): boolean {
+function getPackageNameFromRootPathTrie(
+  filePath: string,
+  trie: PackageRootPathTrie,
+): string | undefined {
   let node = trie
-  if (node.packageRoot) return true
+  if (node.packageName !== undefined) return node.packageName
 
   for (let segment of getFilePathSegments(filePath)) {
     let childNode = node.children.get(segment)
-    if (!childNode) return false
-    if (childNode.packageRoot) return true
+    if (!childNode) return undefined
+    if (childNode.packageName !== undefined) return childNode.packageName
     node = childNode
   }
 
-  return false
+  return undefined
 }
 
 function getFilePathSegments(filePath: string): string[] {