@skuba-lib/api 2.3.0-rolldown-cdk-bundle-plugin-20260804001207 → 2.3.0-rolldown-cdk-bundle-plugin-20260804050549

package/lib/fs-BBMaW7WT.cjs

@@ -0,0 +1,21 @@
+const require_rolldown_runtime = require("./rolldown-runtime-DakpK96I.cjs");
+const require_error = require("./error-BSBcaHO0.cjs");
+let fs_extra = require("fs-extra");
+fs_extra = require_rolldown_runtime.__toESM(fs_extra, 1);
+//#region ../../src/utils/fs.ts
+const pathExists = async (filePath) => {
+	try {
+		await fs_extra.default.promises.access(filePath);
+		return true;
+	} catch (error) {
+		if (require_error.isErrorWithCode(error, "ENOENT")) return false;
+		throw error;
+	}
+};
+//#endregion
+Object.defineProperty(exports, "pathExists", {
+	enumerable: true,
+	get: function() {
+		return pathExists;
+	}
+});

package/lib/fs-BrQNZY8y.mjs

@@ -0,0 +1,14 @@
+import { t as isErrorWithCode } from "./error-CxiNRw9A.mjs";
+import fs from "fs-extra";
+//#region ../../src/utils/fs.ts
+const pathExists = async (filePath) => {
+	try {
+		await fs.promises.access(filePath);
+		return true;
+	} catch (error) {
+		if (isErrorWithCode(error, "ENOENT")) return false;
+		throw error;
+	}
+};
+//#endregion
+export { pathExists as t };

package/lib/git/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_git = require("../git-BeGqD0KV.cjs");
+const require_git = require("../git-BGcWTYZJ.cjs");
 exports.commit = require_git.commit;
 exports.commitAllChanges = require_git.commitAllChanges;
 exports.currentBranch = require_git.currentBranch;

package/lib/git/index.mjs

@@ -1,2 +1,2 @@
-import { a as push, d as getHeadCommitMessage, f as currentBranch, g as commit, h as findRoot, i as fastForwardBranch, l as getOwnerAndRepo, m as getChangedFiles, n as isFileGitIgnored, p as commitAllChanges, r as reset, u as getHeadCommitId } from "../git-DyhV01cl.mjs";
+import { a as push, d as getHeadCommitMessage, f as currentBranch, g as commit, h as findRoot, i as fastForwardBranch, l as getOwnerAndRepo, m as getChangedFiles, n as isFileGitIgnored, p as commitAllChanges, r as reset, u as getHeadCommitId } from "../git-DKqd7R1V.mjs";
 export { commit, commitAllChanges, currentBranch, fastForwardBranch, findRoot, getChangedFiles, getHeadCommitId, getHeadCommitMessage, getOwnerAndRepo, isFileGitIgnored, push, reset };

package/lib/{git-BeGqD0KV.cjs → git-BGcWTYZJ.cjs}

@@ -1,5 +1,5 @@
 const require_rolldown_runtime = require("./rolldown-runtime-DakpK96I.cjs");
-const require_error = require("./error-BSBcaHO0.cjs");
+const require_fs = require("./fs-BBMaW7WT.cjs");
 let fs_extra = require("fs-extra");
 fs_extra = require_rolldown_runtime.__toESM(fs_extra, 1);
 let isomorphic_git = require("isomorphic-git");
@@ -39,17 +39,6 @@ const findRoot$1 = async ({ dir }) => {
 	}
 };
 //#endregion
-//#region ../../src/utils/fs.ts
-const pathExists = async (filePath) => {
-	try {
-		await fs_extra.default.promises.access(filePath);
-		return true;
-	} catch (error) {
-		if (require_error.isErrorWithCode(error, "ENOENT")) return false;
-		throw error;
-	}
-};
-//#endregion
 //#region src/git/getChangedFiles.ts
 const mapState = (row) => {
 	if (row[1] === 0) return "added";
@@ -140,7 +129,7 @@ const getChangedFilesFromRefs = async ({ dir, src, dst }) => {
 const createIsLfsFilter = async (gitRoot) => {
 	if (!gitRoot) return () => false;
 	const lfsFile = `${gitRoot}/.gitattributes`;
-	if (!await pathExists(lfsFile)) return () => false;
+	if (!await require_fs.pathExists(lfsFile)) return () => false;
 	const filter = (0, ignore.default)().add((await fs_extra.default.promises.readFile(lfsFile, "utf8")).split("\n").map((l) => l.trim()).filter((l) => !l.startsWith("#") && l.includes("filter=lfs")).map((l) => l.split(/\s+/)[0]).flatMap((l) => l ? [l] : []));
 	return (pathname) => filter.ignores(pathname);
 };

package/lib/{git-DyhV01cl.mjs → git-DKqd7R1V.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
-import { t as isErrorWithCode } from "./error-CxiNRw9A.mjs";
+import { t as pathExists } from "./fs-BrQNZY8y.mjs";
 import fs from "fs-extra";
 import git, { findRoot } from "isomorphic-git";
 import path from "path";
@@ -34,17 +34,6 @@ const findRoot$1 = async ({ dir }) => {
 	}
 };
 //#endregion
-//#region ../../src/utils/fs.ts
-const pathExists = async (filePath) => {
-	try {
-		await fs.promises.access(filePath);
-		return true;
-	} catch (error) {
-		if (isErrorWithCode(error, "ENOENT")) return false;
-		throw error;
-	}
-};
-//#endregion
 //#region src/git/getChangedFiles.ts
 const mapState = (row) => {
 	if (row[1] === 0) return "added";

package/lib/github/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_git = require("../git-BeGqD0KV.cjs");
-const require_github = require("../github-C91l-j0Z.cjs");
+const require_git = require("../git-BGcWTYZJ.cjs");
+const require_github = require("../github-B2fQutQz.cjs");
 exports.apiTokenFromEnvironment = require_git.apiTokenFromEnvironment;
 exports.buildNameFromEnvironment = require_git.buildNameFromEnvironment;
 exports.createCheckRun = require_github.createCheckRun;

package/lib/github/index.mjs

@@ -1,3 +1,3 @@
-import { c as enabledFromEnvironment, o as apiTokenFromEnvironment, s as buildNameFromEnvironment } from "../git-DyhV01cl.mjs";
-import { a as putIssueComment, i as uploadFileChanges, n as readFileChanges, o as getPullRequestNumber, r as uploadAllFileChanges, s as createCheckRun } from "../github-CmHDTIHw.mjs";
+import { c as enabledFromEnvironment, o as apiTokenFromEnvironment, s as buildNameFromEnvironment } from "../git-DKqd7R1V.mjs";
+import { a as putIssueComment, i as uploadFileChanges, n as readFileChanges, o as getPullRequestNumber, r as uploadAllFileChanges, s as createCheckRun } from "../github-EDhl9ON9.mjs";
 export { apiTokenFromEnvironment, buildNameFromEnvironment, createCheckRun, enabledFromEnvironment, getPullRequestNumber, putIssueComment, readFileChanges, uploadAllFileChanges, uploadFileChanges };

package/lib/{github-C91l-j0Z.cjs → github-B2fQutQz.cjs}

@@ -1,6 +1,6 @@
 const require_rolldown_runtime = require("./rolldown-runtime-DakpK96I.cjs");
 const require_logging = require("./logging-BqpzZfsF.cjs");
-const require_git = require("./git-BeGqD0KV.cjs");
+const require_git = require("./git-BGcWTYZJ.cjs");
 let fs_extra = require("fs-extra");
 fs_extra = require_rolldown_runtime.__toESM(fs_extra, 1);
 let path = require("path");

package/lib/{github-CmHDTIHw.mjs → github-EDhl9ON9.mjs}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
 import { n as pluralise } from "./logging-BQNEupxh.mjs";
-import { c as enabledFromEnvironment, h as findRoot, i as fastForwardBranch, l as getOwnerAndRepo, m as getChangedFiles, o as apiTokenFromEnvironment, s as buildNameFromEnvironment, u as getHeadCommitId } from "./git-DyhV01cl.mjs";
+import { c as enabledFromEnvironment, h as findRoot, i as fastForwardBranch, l as getOwnerAndRepo, m as getChangedFiles, o as apiTokenFromEnvironment, s as buildNameFromEnvironment, u as getHeadCommitId } from "./git-DKqd7R1V.mjs";
 import fs from "fs-extra";
 import path from "path";
 //#region src/github/octokit.ts

package/lib/index-J1Qqgryi.d.cts

@@ -0,0 +1,94 @@
+import { Plugin } from "rolldown";
+//#region src/rolldown/lambdaAsset.d.ts
+interface LambdaAssetFile {
+  /**
+   * Path to the file or directory to copy, resolved relative to `projectRoot`.
+   */
+  from: string;
+  /**
+   * Destination path relative to the output directory.
+   *
+   * Defaults to the basename of `from`, placing it at the top of the output
+   * directory.
+   */
+  to?: string;
+}
+interface LambdaAssetOptions {
+  /**
+   * npm packages to install into the output directory rather than embed in the
+   * bundle.
+   *
+   * Versions are resolved from the copy installed under `projectRoot`. Mark
+   * these packages `external` in your rolldown config too, otherwise they will
+   * be bundled _and_ installed.
+   *
+   * Packages with native binaries (e.g. `sharp`) are the usual candidates.
+   */
+  nodeModules?: string[];
+  /**
+   * Extra files or directories to copy into the output directory alongside the
+   * bundle, e.g. static assets or configuration the handler reads at runtime.
+   *
+   * Each `from` is resolved relative to `projectRoot`; each `to` defaults to
+   * the basename of `from` and is resolved relative to the output directory.
+   */
+  assets?: LambdaAssetFile[];
+  /**
+   * Directory that `nodeModules` versions are resolved from, and that `assets`
+   * are copied from.
+   *
+   * This is the directory holding the `package.json` that depends on them; in a
+   * workspace, that is the individual package rather than the workspace root.
+   *
+   * Defaults to `process.cwd()`.
+   */
+  projectRoot?: string;
+  /**
+   * Path to the `pnpm-lock.yaml` to install against.
+   *
+   * pnpm keeps this at the workspace root, so its directory is also where the
+   * workspace config and patches are staged from.
+   *
+   * Defaults to the nearest lock file, walking up from `process.cwd()`.
+   */
+  depsLockFilePath?: string;
+}
+/**
+ * Prepares a rolldown output directory for deployment as a Lambda asset.
+ *
+ * The plugin supports ESM output and pnpm only. It makes no assumptions about
+ * how you bundle; it only augments what rolldown has already written:
+ *
+ * 1. Writes a `package.json` of `type: 'module'`.
+ * 2. Installs `nodeModules` into the output directory with pnpm, staging the
+ *    workspace config, `.npmrc`, lock file and patches to do so.
+ * 3. Strips those install-only files back out, leaving the bundle, the
+ *    generated `package.json` and `node_modules`.
+ * 4. Copies any extra `assets` into the output directory alongside the bundle.
+ *
+ * The result can be handed to CDK as `aws_lambda.Code.fromAsset(outputDir)`.
+ *
+ * @example
+ * ```js
+ * // rolldown.config.mjs
+ * import { Rolldown } from 'skuba';
+ *
+ * export default {
+ *   input: 'src/lambda.ts',
+ *   output: { dir: 'lib' },
+ *   external: ['sharp'],
+ *   plugins: [
+ *     Rolldown.lambdaAsset({
+ *       nodeModules: ['sharp'],
+ *       assets: [{ from: 'src/config.json' }],
+ *     }),
+ *   ],
+ * };
+ * ```
+ */
+declare const lambdaAsset: ({ nodeModules, assets, projectRoot: projectRootOption, depsLockFilePath: depsLockFilePathOption }?: LambdaAssetOptions) => Plugin;
+declare namespace index_d_exports {
+  export { LambdaAssetFile, LambdaAssetOptions, lambdaAsset };
+}
+//#endregion
+export { lambdaAsset as i, LambdaAssetFile as n, LambdaAssetOptions as r, index_d_exports as t };

package/lib/index-J1Qqgryi.d.mts

@@ -0,0 +1,94 @@
+import { Plugin } from "rolldown";
+//#region src/rolldown/lambdaAsset.d.ts
+interface LambdaAssetFile {
+  /**
+   * Path to the file or directory to copy, resolved relative to `projectRoot`.
+   */
+  from: string;
+  /**
+   * Destination path relative to the output directory.
+   *
+   * Defaults to the basename of `from`, placing it at the top of the output
+   * directory.
+   */
+  to?: string;
+}
+interface LambdaAssetOptions {
+  /**
+   * npm packages to install into the output directory rather than embed in the
+   * bundle.
+   *
+   * Versions are resolved from the copy installed under `projectRoot`. Mark
+   * these packages `external` in your rolldown config too, otherwise they will
+   * be bundled _and_ installed.
+   *
+   * Packages with native binaries (e.g. `sharp`) are the usual candidates.
+   */
+  nodeModules?: string[];
+  /**
+   * Extra files or directories to copy into the output directory alongside the
+   * bundle, e.g. static assets or configuration the handler reads at runtime.
+   *
+   * Each `from` is resolved relative to `projectRoot`; each `to` defaults to
+   * the basename of `from` and is resolved relative to the output directory.
+   */
+  assets?: LambdaAssetFile[];
+  /**
+   * Directory that `nodeModules` versions are resolved from, and that `assets`
+   * are copied from.
+   *
+   * This is the directory holding the `package.json` that depends on them; in a
+   * workspace, that is the individual package rather than the workspace root.
+   *
+   * Defaults to `process.cwd()`.
+   */
+  projectRoot?: string;
+  /**
+   * Path to the `pnpm-lock.yaml` to install against.
+   *
+   * pnpm keeps this at the workspace root, so its directory is also where the
+   * workspace config and patches are staged from.
+   *
+   * Defaults to the nearest lock file, walking up from `process.cwd()`.
+   */
+  depsLockFilePath?: string;
+}
+/**
+ * Prepares a rolldown output directory for deployment as a Lambda asset.
+ *
+ * The plugin supports ESM output and pnpm only. It makes no assumptions about
+ * how you bundle; it only augments what rolldown has already written:
+ *
+ * 1. Writes a `package.json` of `type: 'module'`.
+ * 2. Installs `nodeModules` into the output directory with pnpm, staging the
+ *    workspace config, `.npmrc`, lock file and patches to do so.
+ * 3. Strips those install-only files back out, leaving the bundle, the
+ *    generated `package.json` and `node_modules`.
+ * 4. Copies any extra `assets` into the output directory alongside the bundle.
+ *
+ * The result can be handed to CDK as `aws_lambda.Code.fromAsset(outputDir)`.
+ *
+ * @example
+ * ```js
+ * // rolldown.config.mjs
+ * import { Rolldown } from 'skuba';
+ *
+ * export default {
+ *   input: 'src/lambda.ts',
+ *   output: { dir: 'lib' },
+ *   external: ['sharp'],
+ *   plugins: [
+ *     Rolldown.lambdaAsset({
+ *       nodeModules: ['sharp'],
+ *       assets: [{ from: 'src/config.json' }],
+ *     }),
+ *   ],
+ * };
+ * ```
+ */
+declare const lambdaAsset: ({ nodeModules, assets, projectRoot: projectRootOption, depsLockFilePath: depsLockFilePathOption }?: LambdaAssetOptions) => Plugin;
+declare namespace index_d_exports {
+  export { LambdaAssetFile, LambdaAssetOptions, lambdaAsset };
+}
+//#endregion
+export { lambdaAsset as i, LambdaAssetFile as n, LambdaAssetOptions as r, index_d_exports as t };

package/lib/index.cjs

@@ -1,9 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_buildkite = require("./buildkite-CM-xlOq5.cjs");
 const require_cdk_index = require("./cdk/index.cjs");
-const require_git = require("./git-BeGqD0KV.cjs");
-const require_github = require("./github-C91l-j0Z.cjs");
+const require_git = require("./git-BGcWTYZJ.cjs");
+const require_github = require("./github-B2fQutQz.cjs");
 const require_net = require("./net-zrteIHld.cjs");
+const require_rolldown = require("./rolldown-CbJyS-Uy.cjs");
 Object.defineProperty(exports, "Buildkite", {
 	enumerable: true,
 	get: function() {
@@ -34,3 +35,9 @@ Object.defineProperty(exports, "Net", {
 		return require_net.net_exports;
 	}
 });
+Object.defineProperty(exports, "Rolldown", {
+	enumerable: true,
+	get: function() {
+		return require_rolldown.rolldown_exports;
+	}
+});

package/lib/index.d.cts

@@ -3,4 +3,5 @@ import { t as index_d_exports$1 } from "./cdk/index.cjs";
 import { t as index_d_exports$2 } from "./index-CLEYcnJY.cjs";
 import { t as index_d_exports$3 } from "./index-CPm5rAMy.cjs";
 import { t as index_d_exports$4 } from "./index-C9lVo3vU.cjs";
-export { index_d_exports as Buildkite, index_d_exports$1 as Cdk, index_d_exports$2 as Git, index_d_exports$3 as GitHub, index_d_exports$4 as Net };
+import { t as index_d_exports$5 } from "./index-J1Qqgryi.cjs";
+export { index_d_exports as Buildkite, index_d_exports$1 as Cdk, index_d_exports$2 as Git, index_d_exports$3 as GitHub, index_d_exports$4 as Net, index_d_exports$5 as Rolldown };

package/lib/index.d.mts

@@ -3,4 +3,5 @@ import { t as index_d_exports$1 } from "./cdk/index.mjs";
 import { t as index_d_exports$2 } from "./index-CLEYcnJY.mjs";
 import { t as index_d_exports$3 } from "./index-CwdiFn_m.mjs";
 import { t as index_d_exports$4 } from "./index-C9lVo3vU.mjs";
-export { index_d_exports as Buildkite, index_d_exports$1 as Cdk, index_d_exports$2 as Git, index_d_exports$3 as GitHub, index_d_exports$4 as Net };
+import { t as index_d_exports$5 } from "./index-J1Qqgryi.mjs";
+export { index_d_exports as Buildkite, index_d_exports$1 as Cdk, index_d_exports$2 as Git, index_d_exports$3 as GitHub, index_d_exports$4 as Net, index_d_exports$5 as Rolldown };

package/lib/index.mjs

@@ -1,6 +1,7 @@
 import { t as buildkite_exports } from "./buildkite-B0gyBRNS.mjs";
 import { t as cdk_exports } from "./cdk/index.mjs";
-import { t as git_exports } from "./git-DyhV01cl.mjs";
-import { t as github_exports } from "./github-CmHDTIHw.mjs";
+import { t as git_exports } from "./git-DKqd7R1V.mjs";
+import { t as github_exports } from "./github-EDhl9ON9.mjs";
 import { t as net_exports } from "./net-97EvMPiP.mjs";
-export { buildkite_exports as Buildkite, cdk_exports as Cdk, git_exports as Git, github_exports as GitHub, net_exports as Net };
+import { t as rolldown_exports } from "./rolldown-08iefo1V.mjs";
+export { buildkite_exports as Buildkite, cdk_exports as Cdk, git_exports as Git, github_exports as GitHub, net_exports as Net, rolldown_exports as Rolldown };

package/lib/rolldown/index.cjs

@@ -0,0 +1,3 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown = require("../rolldown-CbJyS-Uy.cjs");
+exports.lambdaAsset = require_rolldown.lambdaAsset;

package/lib/rolldown/index.d.cts

@@ -0,0 +1,2 @@
+import { i as lambdaAsset, n as LambdaAssetFile, r as LambdaAssetOptions } from "../index-J1Qqgryi.cjs";
+export { type LambdaAssetFile, type LambdaAssetOptions, lambdaAsset };

package/lib/rolldown/index.d.mts

@@ -0,0 +1,2 @@
+import { i as lambdaAsset, n as LambdaAssetFile, r as LambdaAssetOptions } from "../index-J1Qqgryi.mjs";
+export { type LambdaAssetFile, type LambdaAssetOptions, lambdaAsset };

package/lib/rolldown/index.mjs

@@ -0,0 +1,2 @@
+import { n as lambdaAsset } from "../rolldown-08iefo1V.mjs";
+export { lambdaAsset };

package/lib/rolldown-08iefo1V.mjs

@@ -0,0 +1,237 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { t as log } from "./logging-BQNEupxh.mjs";
+import { t as createExec } from "./exec-Dp89sakg.mjs";
+import { t as pathExists } from "./fs-BrQNZY8y.mjs";
+import { findPackageJSON } from "node:module";
+import fs from "fs-extra";
+import * as path from "node:path";
+import { findUp } from "find-up";
+import { pathToFileURL } from "node:url";
+import { parse, stringify } from "yaml";
+//#region src/rolldown/pnpm.ts
+const PNPM_LOCK = "pnpm-lock.yaml";
+const PNPM_WORKSPACE_YAML = "pnpm-workspace.yaml";
+const PNPM_PATCHES_DIR = "patches";
+const PNPM_WORKSPACE_FILES = [
+	PNPM_WORKSPACE_YAML,
+	".npmrc",
+	".pnpmfile.cjs",
+	".pnpmfile.mjs"
+];
+/**
+* Files that `pnpm install` leaves behind which record machine-local paths and
+* timestamps, and so would churn the CDK asset hash on every build.
+*/
+const PNPM_METADATA_FILES = [path.join("node_modules", ".modules.yaml"), path.join("node_modules", ".pnpm-workspace-state-v1.json")];
+const PNPM_INSTALL_COMMAND = [
+	"pnpm",
+	"install",
+	"--config.node-linker=hoisted",
+	"--config.package-import-method=clone-or-copy",
+	"--no-frozen-lockfile"
+];
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parseJsonFile = async (filePath) => {
+	try {
+		return JSON.parse(await fs.promises.readFile(filePath, "utf-8"));
+	} catch (err) {
+		throw new Error(`Failed to parse ${filePath} as JSON: ${err.message}`);
+	}
+};
+/**
+* Reads the `packageManager` pin from the workspace root manifest.
+*
+* Forwarding it to the output directory keeps the staged install on the same
+* pnpm version as the project.
+*/
+const readPackageManagerField = async (workspaceRoot) => {
+	const pkgPath = path.join(workspaceRoot, "package.json");
+	if (!await pathExists(pkgPath)) return;
+	const parsed = await parseJsonFile(pkgPath);
+	return isRecord(parsed) && typeof parsed.packageManager === "string" ? parsed.packageManager : void 0;
+};
+/**
+* The output directory installs a subset of the workspace's dependencies, so
+* most `patchedDependencies` entries have nothing to apply to. pnpm fails the
+* install on an unused patch unless this is set.
+*/
+const allowUnusedPatches = (content) => {
+	let doc;
+	try {
+		doc = parse(content);
+	} catch (err) {
+		throw new Error(`Failed to parse ${PNPM_WORKSPACE_YAML}: ${err.message}`);
+	}
+	if (!isRecord(doc)) return content;
+	doc.allowUnusedPatches = true;
+	return stringify(doc);
+};
+/**
+* Stages the pnpm config that an install in `outputDir` needs.
+*
+* Patch files are staged from `patches`, where `pnpm patch-commit` writes them.
+*
+* Every path written is appended to `stagedFiles` so the caller can strip it
+* back out once the install is done; `.npmrc` in particular may hold registry
+* credentials that must not ship in the asset.
+*/
+const stageWorkspaceFiles = async (workspaceRoot, outputDir, stagedFiles = []) => {
+	for (const file of PNPM_WORKSPACE_FILES) {
+		const src = path.join(workspaceRoot, file);
+		if (!await pathExists(src)) continue;
+		const dest = path.join(outputDir, file);
+		if (file === PNPM_WORKSPACE_YAML) await fs.promises.writeFile(dest, allowUnusedPatches(await fs.promises.readFile(src, "utf8")));
+		else await fs.promises.copyFile(src, dest);
+		stagedFiles.push(dest);
+	}
+	const patchesSrc = path.join(workspaceRoot, PNPM_PATCHES_DIR);
+	if (await pathExists(patchesSrc)) {
+		const patchesDest = path.join(outputDir, PNPM_PATCHES_DIR);
+		await fs.copy(patchesSrc, patchesDest);
+		stagedFiles.push(patchesDest);
+	}
+	return stagedFiles;
+};
+/**
+* Resolves the installed version of each module, as seen from `resolveFrom`.
+*/
+const extractDependencies = async (resolveFrom, modules) => {
+	const result = {};
+	const base = pathToFileURL(resolveFrom);
+	for (const mod of modules) {
+		let modPkgPath;
+		try {
+			modPkgPath = findPackageJSON(mod, base);
+		} catch {
+			modPkgPath = void 0;
+		}
+		const parsed = modPkgPath ? await parseJsonFile(modPkgPath) : void 0;
+		const version = isRecord(parsed) && typeof parsed.version === "string" ? parsed.version.trim() : void 0;
+		if (!version) throw new Error(`Cannot extract version for module '${mod}'. Check that it's referenced in your package.json or installed.`);
+		result[mod] = version;
+	}
+	return result;
+};
+//#endregion
+//#region src/rolldown/lambdaAsset.ts
+const PLUGIN_NAME = "skuba:lambda-asset";
+const resolveOutputDir = ({ dir, file }) => {
+	if (!dir) throw new Error(`${PLUGIN_NAME} requires \`output.dir\`; it prepares a deployable directory, so a single \`output.file\`${file ? ` (${file})` : ""} has nowhere to install into.`);
+	return path.resolve(dir);
+};
+const resolveLockFile = async (depsLockFilePath) => {
+	if (!depsLockFilePath) return findUp(PNPM_LOCK);
+	const resolved = path.resolve(depsLockFilePath);
+	if (!await pathExists(resolved)) throw new Error(`${PLUGIN_NAME} cannot find a ${PNPM_LOCK} at '${depsLockFilePath}'.`);
+	return resolved;
+};
+/**
+* Copies extra `assets` into the output directory alongside the bundle.
+*
+* `from` is resolved relative to `projectRoot`, and `to` relative to the
+* output directory, creating parent directories as needed. Directories are
+* copied recursively.
+*/
+const copyAssets = async (outputDir, projectRoot, assets) => {
+	for (const asset of assets) {
+		const from = path.resolve(projectRoot, asset.from);
+		const to = path.join(outputDir, asset.to ?? path.basename(asset.from));
+		await fs.ensureDir(path.dirname(to));
+		await fs.copy(from, to);
+	}
+};
+const writeOutputPackageJson = (outputDir, fields = {}) => fs.promises.writeFile(path.join(outputDir, "package.json"), JSON.stringify({
+	type: "module",
+	...fields
+}, null, 2));
+/**
+* Strips the install-only files back out of the output directory.
+*
+* `.npmrc` may hold registry credentials, so one path failing to remove must
+* not skip the rest, and the caller must hear about it.
+*/
+const stripInstallFiles = async (outputDir, stagedFiles, cause) => {
+	const reasons = (await Promise.allSettled([...stagedFiles, ...PNPM_METADATA_FILES.map((file) => path.join(outputDir, file))].map((file) => fs.remove(file)))).flatMap((result) => result.status === "rejected" ? [String(result.reason)] : []);
+	if (reasons.length) throw new Error(`${PLUGIN_NAME} could not strip install-only files from '${outputDir}'; these may include registry credentials and must not be deployed. ${reasons.join("; ")}`, { cause });
+};
+/**
+* Prepares a rolldown output directory for deployment as a Lambda asset.
+*
+* The plugin supports ESM output and pnpm only. It makes no assumptions about
+* how you bundle; it only augments what rolldown has already written:
+*
+* 1. Writes a `package.json` of `type: 'module'`.
+* 2. Installs `nodeModules` into the output directory with pnpm, staging the
+*    workspace config, `.npmrc`, lock file and patches to do so.
+* 3. Strips those install-only files back out, leaving the bundle, the
+*    generated `package.json` and `node_modules`.
+* 4. Copies any extra `assets` into the output directory alongside the bundle.
+*
+* The result can be handed to CDK as `aws_lambda.Code.fromAsset(outputDir)`.
+*
+* @example
+* ```js
+* // rolldown.config.mjs
+* import { Rolldown } from 'skuba';
+*
+* export default {
+*   input: 'src/lambda.ts',
+*   output: { dir: 'lib' },
+*   external: ['sharp'],
+*   plugins: [
+*     Rolldown.lambdaAsset({
+*       nodeModules: ['sharp'],
+*       assets: [{ from: 'src/config.json' }],
+*     }),
+*   ],
+* };
+* ```
+*/
+const lambdaAsset = ({ nodeModules = [], assets = [], projectRoot: projectRootOption, depsLockFilePath: depsLockFilePathOption } = {}) => {
+	const prepared = /* @__PURE__ */ new Set();
+	return {
+		name: PLUGIN_NAME,
+		buildStart() {
+			prepared.clear();
+		},
+		async writeBundle(outputOptions) {
+			const outputDir = resolveOutputDir(outputOptions);
+			if (prepared.has(outputDir)) return;
+			prepared.add(outputDir);
+			const projectRoot = path.resolve(projectRootOption ?? process.cwd());
+			await copyAssets(outputDir, projectRoot, assets);
+			if (!nodeModules.length) {
+				await writeOutputPackageJson(outputDir);
+				return;
+			}
+			const depsLockFilePath = await resolveLockFile(depsLockFilePathOption);
+			if (!depsLockFilePath) throw new Error(`${PLUGIN_NAME} cannot find a ${PNPM_LOCK}, which \`nodeModules\` requires. Specify one with \`depsLockFilePath\`.`);
+			const workspaceRoot = path.dirname(depsLockFilePath);
+			const projectPackageJson = path.join(projectRoot, "package.json");
+			if (!await pathExists(projectPackageJson)) throw new Error(`${PLUGIN_NAME} cannot find a package.json in '${projectRoot}', which \`nodeModules\` requires. Specify the directory with \`projectRoot\`.`);
+			await writeOutputPackageJson(outputDir, {
+				dependencies: await extractDependencies(projectPackageJson, nodeModules),
+				packageManager: await readPackageManagerField(workspaceRoot)
+			});
+			const stagedFiles = [];
+			try {
+				await stageWorkspaceFiles(workspaceRoot, outputDir, stagedFiles);
+				const lockDest = path.join(outputDir, PNPM_LOCK);
+				await fs.promises.copyFile(depsLockFilePath, lockDest);
+				stagedFiles.push(lockDest);
+				log.plain(log.bold(PLUGIN_NAME), "installing", log.bold(nodeModules.join(", ")));
+				const [bin, ...args] = PNPM_INSTALL_COMMAND;
+				await createExec({ cwd: outputDir })(bin, ...args);
+			} catch (err) {
+				await stripInstallFiles(outputDir, stagedFiles, err);
+				throw err;
+			}
+			await stripInstallFiles(outputDir, stagedFiles);
+		}
+	};
+};
+//#endregion
+//#region src/rolldown/index.ts
+var rolldown_exports = /* @__PURE__ */ __exportAll({ lambdaAsset: () => lambdaAsset });
+//#endregion
+export { lambdaAsset as n, rolldown_exports as t };

package/lib/rolldown-CbJyS-Uy.cjs

@@ -0,0 +1,250 @@
+const require_rolldown_runtime = require("./rolldown-runtime-DakpK96I.cjs");
+const require_logging = require("./logging-BqpzZfsF.cjs");
+const require_exec = require("./exec-BGMWpmZ7.cjs");
+const require_fs = require("./fs-BBMaW7WT.cjs");
+let fs_extra = require("fs-extra");
+fs_extra = require_rolldown_runtime.__toESM(fs_extra, 1);
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let find_up = require("find-up");
+let node_module = require("node:module");
+let node_url = require("node:url");
+let yaml = require("yaml");
+//#region src/rolldown/pnpm.ts
+const PNPM_LOCK = "pnpm-lock.yaml";
+const PNPM_WORKSPACE_YAML = "pnpm-workspace.yaml";
+const PNPM_PATCHES_DIR = "patches";
+const PNPM_WORKSPACE_FILES = [
+	PNPM_WORKSPACE_YAML,
+	".npmrc",
+	".pnpmfile.cjs",
+	".pnpmfile.mjs"
+];
+/**
+* Files that `pnpm install` leaves behind which record machine-local paths and
+* timestamps, and so would churn the CDK asset hash on every build.
+*/
+const PNPM_METADATA_FILES = [node_path.join("node_modules", ".modules.yaml"), node_path.join("node_modules", ".pnpm-workspace-state-v1.json")];
+const PNPM_INSTALL_COMMAND = [
+	"pnpm",
+	"install",
+	"--config.node-linker=hoisted",
+	"--config.package-import-method=clone-or-copy",
+	"--no-frozen-lockfile"
+];
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parseJsonFile = async (filePath) => {
+	try {
+		return JSON.parse(await fs_extra.default.promises.readFile(filePath, "utf-8"));
+	} catch (err) {
+		throw new Error(`Failed to parse ${filePath} as JSON: ${err.message}`);
+	}
+};
+/**
+* Reads the `packageManager` pin from the workspace root manifest.
+*
+* Forwarding it to the output directory keeps the staged install on the same
+* pnpm version as the project.
+*/
+const readPackageManagerField = async (workspaceRoot) => {
+	const pkgPath = node_path.join(workspaceRoot, "package.json");
+	if (!await require_fs.pathExists(pkgPath)) return;
+	const parsed = await parseJsonFile(pkgPath);
+	return isRecord(parsed) && typeof parsed.packageManager === "string" ? parsed.packageManager : void 0;
+};
+/**
+* The output directory installs a subset of the workspace's dependencies, so
+* most `patchedDependencies` entries have nothing to apply to. pnpm fails the
+* install on an unused patch unless this is set.
+*/
+const allowUnusedPatches = (content) => {
+	let doc;
+	try {
+		doc = (0, yaml.parse)(content);
+	} catch (err) {
+		throw new Error(`Failed to parse ${PNPM_WORKSPACE_YAML}: ${err.message}`);
+	}
+	if (!isRecord(doc)) return content;
+	doc.allowUnusedPatches = true;
+	return (0, yaml.stringify)(doc);
+};
+/**
+* Stages the pnpm config that an install in `outputDir` needs.
+*
+* Patch files are staged from `patches`, where `pnpm patch-commit` writes them.
+*
+* Every path written is appended to `stagedFiles` so the caller can strip it
+* back out once the install is done; `.npmrc` in particular may hold registry
+* credentials that must not ship in the asset.
+*/
+const stageWorkspaceFiles = async (workspaceRoot, outputDir, stagedFiles = []) => {
+	for (const file of PNPM_WORKSPACE_FILES) {
+		const src = node_path.join(workspaceRoot, file);
+		if (!await require_fs.pathExists(src)) continue;
+		const dest = node_path.join(outputDir, file);
+		if (file === PNPM_WORKSPACE_YAML) await fs_extra.default.promises.writeFile(dest, allowUnusedPatches(await fs_extra.default.promises.readFile(src, "utf8")));
+		else await fs_extra.default.promises.copyFile(src, dest);
+		stagedFiles.push(dest);
+	}
+	const patchesSrc = node_path.join(workspaceRoot, PNPM_PATCHES_DIR);
+	if (await require_fs.pathExists(patchesSrc)) {
+		const patchesDest = node_path.join(outputDir, PNPM_PATCHES_DIR);
+		await fs_extra.default.copy(patchesSrc, patchesDest);
+		stagedFiles.push(patchesDest);
+	}
+	return stagedFiles;
+};
+/**
+* Resolves the installed version of each module, as seen from `resolveFrom`.
+*/
+const extractDependencies = async (resolveFrom, modules) => {
+	const result = {};
+	const base = (0, node_url.pathToFileURL)(resolveFrom);
+	for (const mod of modules) {
+		let modPkgPath;
+		try {
+			modPkgPath = (0, node_module.findPackageJSON)(mod, base);
+		} catch {
+			modPkgPath = void 0;
+		}
+		const parsed = modPkgPath ? await parseJsonFile(modPkgPath) : void 0;
+		const version = isRecord(parsed) && typeof parsed.version === "string" ? parsed.version.trim() : void 0;
+		if (!version) throw new Error(`Cannot extract version for module '${mod}'. Check that it's referenced in your package.json or installed.`);
+		result[mod] = version;
+	}
+	return result;
+};
+//#endregion
+//#region src/rolldown/lambdaAsset.ts
+const PLUGIN_NAME = "skuba:lambda-asset";
+const resolveOutputDir = ({ dir, file }) => {
+	if (!dir) throw new Error(`${PLUGIN_NAME} requires \`output.dir\`; it prepares a deployable directory, so a single \`output.file\`${file ? ` (${file})` : ""} has nowhere to install into.`);
+	return node_path.resolve(dir);
+};
+const resolveLockFile = async (depsLockFilePath) => {
+	if (!depsLockFilePath) return (0, find_up.findUp)(PNPM_LOCK);
+	const resolved = node_path.resolve(depsLockFilePath);
+	if (!await require_fs.pathExists(resolved)) throw new Error(`${PLUGIN_NAME} cannot find a ${PNPM_LOCK} at '${depsLockFilePath}'.`);
+	return resolved;
+};
+/**
+* Copies extra `assets` into the output directory alongside the bundle.
+*
+* `from` is resolved relative to `projectRoot`, and `to` relative to the
+* output directory, creating parent directories as needed. Directories are
+* copied recursively.
+*/
+const copyAssets = async (outputDir, projectRoot, assets) => {
+	for (const asset of assets) {
+		const from = node_path.resolve(projectRoot, asset.from);
+		const to = node_path.join(outputDir, asset.to ?? node_path.basename(asset.from));
+		await fs_extra.default.ensureDir(node_path.dirname(to));
+		await fs_extra.default.copy(from, to);
+	}
+};
+const writeOutputPackageJson = (outputDir, fields = {}) => fs_extra.default.promises.writeFile(node_path.join(outputDir, "package.json"), JSON.stringify({
+	type: "module",
+	...fields
+}, null, 2));
+/**
+* Strips the install-only files back out of the output directory.
+*
+* `.npmrc` may hold registry credentials, so one path failing to remove must
+* not skip the rest, and the caller must hear about it.
+*/
+const stripInstallFiles = async (outputDir, stagedFiles, cause) => {
+	const reasons = (await Promise.allSettled([...stagedFiles, ...PNPM_METADATA_FILES.map((file) => node_path.join(outputDir, file))].map((file) => fs_extra.default.remove(file)))).flatMap((result) => result.status === "rejected" ? [String(result.reason)] : []);
+	if (reasons.length) throw new Error(`${PLUGIN_NAME} could not strip install-only files from '${outputDir}'; these may include registry credentials and must not be deployed. ${reasons.join("; ")}`, { cause });
+};
+/**
+* Prepares a rolldown output directory for deployment as a Lambda asset.
+*
+* The plugin supports ESM output and pnpm only. It makes no assumptions about
+* how you bundle; it only augments what rolldown has already written:
+*
+* 1. Writes a `package.json` of `type: 'module'`.
+* 2. Installs `nodeModules` into the output directory with pnpm, staging the
+*    workspace config, `.npmrc`, lock file and patches to do so.
+* 3. Strips those install-only files back out, leaving the bundle, the
+*    generated `package.json` and `node_modules`.
+* 4. Copies any extra `assets` into the output directory alongside the bundle.
+*
+* The result can be handed to CDK as `aws_lambda.Code.fromAsset(outputDir)`.
+*
+* @example
+* ```js
+* // rolldown.config.mjs
+* import { Rolldown } from 'skuba';
+*
+* export default {
+*   input: 'src/lambda.ts',
+*   output: { dir: 'lib' },
+*   external: ['sharp'],
+*   plugins: [
+*     Rolldown.lambdaAsset({
+*       nodeModules: ['sharp'],
+*       assets: [{ from: 'src/config.json' }],
+*     }),
+*   ],
+* };
+* ```
+*/
+const lambdaAsset = ({ nodeModules = [], assets = [], projectRoot: projectRootOption, depsLockFilePath: depsLockFilePathOption } = {}) => {
+	const prepared = /* @__PURE__ */ new Set();
+	return {
+		name: PLUGIN_NAME,
+		buildStart() {
+			prepared.clear();
+		},
+		async writeBundle(outputOptions) {
+			const outputDir = resolveOutputDir(outputOptions);
+			if (prepared.has(outputDir)) return;
+			prepared.add(outputDir);
+			const projectRoot = node_path.resolve(projectRootOption ?? process.cwd());
+			await copyAssets(outputDir, projectRoot, assets);
+			if (!nodeModules.length) {
+				await writeOutputPackageJson(outputDir);
+				return;
+			}
+			const depsLockFilePath = await resolveLockFile(depsLockFilePathOption);
+			if (!depsLockFilePath) throw new Error(`${PLUGIN_NAME} cannot find a ${PNPM_LOCK}, which \`nodeModules\` requires. Specify one with \`depsLockFilePath\`.`);
+			const workspaceRoot = node_path.dirname(depsLockFilePath);
+			const projectPackageJson = node_path.join(projectRoot, "package.json");
+			if (!await require_fs.pathExists(projectPackageJson)) throw new Error(`${PLUGIN_NAME} cannot find a package.json in '${projectRoot}', which \`nodeModules\` requires. Specify the directory with \`projectRoot\`.`);
+			await writeOutputPackageJson(outputDir, {
+				dependencies: await extractDependencies(projectPackageJson, nodeModules),
+				packageManager: await readPackageManagerField(workspaceRoot)
+			});
+			const stagedFiles = [];
+			try {
+				await stageWorkspaceFiles(workspaceRoot, outputDir, stagedFiles);
+				const lockDest = node_path.join(outputDir, PNPM_LOCK);
+				await fs_extra.default.promises.copyFile(depsLockFilePath, lockDest);
+				stagedFiles.push(lockDest);
+				require_logging.log.plain(require_logging.log.bold(PLUGIN_NAME), "installing", require_logging.log.bold(nodeModules.join(", ")));
+				const [bin, ...args] = PNPM_INSTALL_COMMAND;
+				await require_exec.createExec({ cwd: outputDir })(bin, ...args);
+			} catch (err) {
+				await stripInstallFiles(outputDir, stagedFiles, err);
+				throw err;
+			}
+			await stripInstallFiles(outputDir, stagedFiles);
+		}
+	};
+};
+//#endregion
+//#region src/rolldown/index.ts
+var rolldown_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ lambdaAsset: () => lambdaAsset });
+//#endregion
+Object.defineProperty(exports, "lambdaAsset", {
+	enumerable: true,
+	get: function() {
+		return lambdaAsset;
+	}
+});
+Object.defineProperty(exports, "rolldown_exports", {
+	enumerable: true,
+	get: function() {
+		return rolldown_exports;
+	}
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skuba-lib/api",
-  "version": "2.3.0-rolldown-cdk-bundle-plugin-20260804001207",
+  "version": "2.3.0-rolldown-cdk-bundle-plugin-20260804050549",
   "description": "Node.js development API for skuba",
   "homepage": "https://github.com/seek-oss/skuba#readme",
   "bugs": {
@@ -39,6 +39,10 @@
       "import": "./lib/net/index.mjs",
       "require": "./lib/net/index.cjs"
     },
+    "./rolldown": {
+      "import": "./lib/rolldown/index.mjs",
+      "require": "./lib/rolldown/index.cjs"
+    },
     "./package.json": "./package.json"
   },
   "main": "./lib/index.cjs",
@@ -50,7 +54,8 @@
     "cdk",
     "git",
     "github",
-    "net"
+    "net",
+    "rolldown"
   ],
   "dependencies": {
     "@octokit/graphql": "^9.0.0",
@@ -58,13 +63,23 @@
     "@octokit/types": "^16.0.0",
     "concurrently": "^10.0.0",
     "execa": "^9.6.1",
+    "find-up": "^8.0.0",
     "fs-extra": "^11.0.0",
     "ignore": "^7.0.0",
     "isomorphic-git": "^1.37.6",
     "npm-run-path": "^6.0.0",
     "npm-which": "^3.0.1",
+    "yaml": "^2.9.0",
     "zod": "^4.3.5"
   },
+  "peerDependencies": {
+    "rolldown": "^1.1.0"
+  },
+  "peerDependenciesMeta": {
+    "rolldown": {
+      "optional": true
+    }
+  },
   "engines": {
     "node": ">=22.14.0"
   },

package/rolldown/package.json

@@ -0,0 +1,6 @@
+{
+  "type": "module",
+  "main": "../lib/rolldown/index.cjs",
+  "module": "../lib/rolldown/index.mjs",
+  "types": "../lib/rolldown/index.d.cts"
+}