@skuba-lib/api 2.3.0-rolldown-cdk-bundle-plugin-20260804050549 → 2.3.0-rolldown-cdk-bundle-plugin-20260804234000

package/lib/{index-J1Qqgryi.d.cts → index-BEmN8nSJ.d.cts}

@@ -40,7 +40,8 @@ interface LambdaAssetOptions {
    * This is the directory holding the `package.json` that depends on them; in a
    * workspace, that is the individual package rather than the workspace root.
    *
-   * Defaults to `process.cwd()`.
+   * Relative paths resolve against rolldown's `cwd`, which defaults to
+   * `process.cwd()`.
    */
   projectRoot?: string;
   /**
@@ -49,7 +50,8 @@ interface LambdaAssetOptions {
    * pnpm keeps this at the workspace root, so its directory is also where the
    * workspace config and patches are staged from.
    *
-   * Defaults to the nearest lock file, walking up from `process.cwd()`.
+   * Defaults to the nearest lock file, walking up from rolldown's `cwd`, which
+   * defaults to `process.cwd()`. A relative path resolves against that `cwd`.
    */
   depsLockFilePath?: string;
 }
@@ -59,12 +61,13 @@ interface LambdaAssetOptions {
  * The plugin supports ESM output and pnpm only. It makes no assumptions about
  * how you bundle; it only augments what rolldown has already written:
  *
- * 1. Writes a `package.json` of `type: 'module'`.
- * 2. Installs `nodeModules` into the output directory with pnpm, staging the
+ * 1. Emits any extra `assets` into the build output alongside the bundle, via
+ *    rolldown's `emitFile`.
+ * 2. Writes a `package.json` of `type: 'module'`.
+ * 3. Installs `nodeModules` into the output directory with pnpm, staging the
  *    workspace config, `.npmrc`, lock file and patches to do so.
- * 3. Strips those install-only files back out, leaving the bundle, the
+ * 4. Strips those install-only files back out, leaving the bundle, the
  *    generated `package.json` and `node_modules`.
- * 4. Copies any extra `assets` into the output directory alongside the bundle.
  *
  * The result can be handed to CDK as `aws_lambda.Code.fromAsset(outputDir)`.
  *

package/lib/{index-J1Qqgryi.d.mts → index-BEmN8nSJ.d.mts}

@@ -40,7 +40,8 @@ interface LambdaAssetOptions {
    * This is the directory holding the `package.json` that depends on them; in a
    * workspace, that is the individual package rather than the workspace root.
    *
-   * Defaults to `process.cwd()`.
+   * Relative paths resolve against rolldown's `cwd`, which defaults to
+   * `process.cwd()`.
    */
   projectRoot?: string;
   /**
@@ -49,7 +50,8 @@ interface LambdaAssetOptions {
    * pnpm keeps this at the workspace root, so its directory is also where the
    * workspace config and patches are staged from.
    *
-   * Defaults to the nearest lock file, walking up from `process.cwd()`.
+   * Defaults to the nearest lock file, walking up from rolldown's `cwd`, which
+   * defaults to `process.cwd()`. A relative path resolves against that `cwd`.
    */
   depsLockFilePath?: string;
 }
@@ -59,12 +61,13 @@ interface LambdaAssetOptions {
  * The plugin supports ESM output and pnpm only. It makes no assumptions about
  * how you bundle; it only augments what rolldown has already written:
  *
- * 1. Writes a `package.json` of `type: 'module'`.
- * 2. Installs `nodeModules` into the output directory with pnpm, staging the
+ * 1. Emits any extra `assets` into the build output alongside the bundle, via
+ *    rolldown's `emitFile`.
+ * 2. Writes a `package.json` of `type: 'module'`.
+ * 3. Installs `nodeModules` into the output directory with pnpm, staging the
  *    workspace config, `.npmrc`, lock file and patches to do so.
- * 3. Strips those install-only files back out, leaving the bundle, the
+ * 4. Strips those install-only files back out, leaving the bundle, the
  *    generated `package.json` and `node_modules`.
- * 4. Copies any extra `assets` into the output directory alongside the bundle.
  *
  * The result can be handed to CDK as `aws_lambda.Code.fromAsset(outputDir)`.
  *

package/lib/index.cjs

@@ -4,7 +4,7 @@ const require_cdk_index = require("./cdk/index.cjs");
 const require_git = require("./git-BGcWTYZJ.cjs");
 const require_github = require("./github-B2fQutQz.cjs");
 const require_net = require("./net-zrteIHld.cjs");
-const require_rolldown = require("./rolldown-CbJyS-Uy.cjs");
+const require_rolldown = require("./rolldown-CN3DH_Tw.cjs");
 Object.defineProperty(exports, "Buildkite", {
 	enumerable: true,
 	get: function() {

package/lib/index.d.cts

@@ -3,5 +3,5 @@ import { t as index_d_exports$1 } from "./cdk/index.cjs";
 import { t as index_d_exports$2 } from "./index-CLEYcnJY.cjs";
 import { t as index_d_exports$3 } from "./index-CPm5rAMy.cjs";
 import { t as index_d_exports$4 } from "./index-C9lVo3vU.cjs";
-import { t as index_d_exports$5 } from "./index-J1Qqgryi.cjs";
+import { t as index_d_exports$5 } from "./index-BEmN8nSJ.cjs";
 export { index_d_exports as Buildkite, index_d_exports$1 as Cdk, index_d_exports$2 as Git, index_d_exports$3 as GitHub, index_d_exports$4 as Net, index_d_exports$5 as Rolldown };

package/lib/index.d.mts

@@ -3,5 +3,5 @@ import { t as index_d_exports$1 } from "./cdk/index.mjs";
 import { t as index_d_exports$2 } from "./index-CLEYcnJY.mjs";
 import { t as index_d_exports$3 } from "./index-CwdiFn_m.mjs";
 import { t as index_d_exports$4 } from "./index-C9lVo3vU.mjs";
-import { t as index_d_exports$5 } from "./index-J1Qqgryi.mjs";
+import { t as index_d_exports$5 } from "./index-BEmN8nSJ.mjs";
 export { index_d_exports as Buildkite, index_d_exports$1 as Cdk, index_d_exports$2 as Git, index_d_exports$3 as GitHub, index_d_exports$4 as Net, index_d_exports$5 as Rolldown };

package/lib/index.mjs

@@ -3,5 +3,5 @@ import { t as cdk_exports } from "./cdk/index.mjs";
 import { t as git_exports } from "./git-DKqd7R1V.mjs";
 import { t as github_exports } from "./github-EDhl9ON9.mjs";
 import { t as net_exports } from "./net-97EvMPiP.mjs";
-import { t as rolldown_exports } from "./rolldown-08iefo1V.mjs";
+import { t as rolldown_exports } from "./rolldown--bMMtGC0.mjs";
 export { buildkite_exports as Buildkite, cdk_exports as Cdk, git_exports as Git, github_exports as GitHub, net_exports as Net, rolldown_exports as Rolldown };

package/lib/rolldown/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_rolldown = require("../rolldown-CbJyS-Uy.cjs");
+const require_rolldown = require("../rolldown-CN3DH_Tw.cjs");
 exports.lambdaAsset = require_rolldown.lambdaAsset;

package/lib/rolldown/index.d.cts

@@ -1,2 +1,2 @@
-import { i as lambdaAsset, n as LambdaAssetFile, r as LambdaAssetOptions } from "../index-J1Qqgryi.cjs";
+import { i as lambdaAsset, n as LambdaAssetFile, r as LambdaAssetOptions } from "../index-BEmN8nSJ.cjs";
 export { type LambdaAssetFile, type LambdaAssetOptions, lambdaAsset };

package/lib/rolldown/index.d.mts

@@ -1,2 +1,2 @@
-import { i as lambdaAsset, n as LambdaAssetFile, r as LambdaAssetOptions } from "../index-J1Qqgryi.mjs";
+import { i as lambdaAsset, n as LambdaAssetFile, r as LambdaAssetOptions } from "../index-BEmN8nSJ.mjs";
 export { type LambdaAssetFile, type LambdaAssetOptions, lambdaAsset };

package/lib/rolldown/index.mjs

@@ -1,2 +1,2 @@
-import { n as lambdaAsset } from "../rolldown-08iefo1V.mjs";
+import { n as lambdaAsset } from "../rolldown--bMMtGC0.mjs";
 export { lambdaAsset };

package/lib/{rolldown-08iefo1V.mjs → rolldown--bMMtGC0.mjs}

@@ -7,7 +7,7 @@ import fs from "fs-extra";
 import * as path from "node:path";
 import { findUp } from "find-up";
 import { pathToFileURL } from "node:url";
-import { parse, stringify } from "yaml";
+import { isMap, parseDocument } from "yaml";
 //#region src/rolldown/pnpm.ts
 const PNPM_LOCK = "pnpm-lock.yaml";
 const PNPM_WORKSPACE_YAML = "pnpm-workspace.yaml";
@@ -31,24 +31,38 @@ const PNPM_INSTALL_COMMAND = [
 	"--no-frozen-lockfile"
 ];
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const parseJsonFile = async (filePath) => {
+const readJsonFile = async (filePath) => {
 	try {
-		return JSON.parse(await fs.promises.readFile(filePath, "utf-8"));
+		return await fs.readJson(filePath);
 	} catch (err) {
 		throw new Error(`Failed to parse ${filePath} as JSON: ${err.message}`);
 	}
 };
 /**
-* Reads the `packageManager` pin from the workspace root manifest.
+* Reads a `name@version` package manager pin from a manifest, preferring the
+* `packageManager` field and falling back to `devEngines.packageManager`.
+*
+* `devEngines.packageManager` is either an object `{ name, version }` or an
+* array of them; a pin is only returned when both `name` and `version` are
+* present, since corepack needs the version to activate.
+*/
+const readPin = (parsed) => {
+	if (typeof parsed.packageManager === "string") return parsed.packageManager;
+	const raw = (isRecord(parsed.devEngines) ? parsed.devEngines : void 0)?.packageManager;
+	const packageManager = Array.isArray(raw) ? raw[0] : raw;
+	if (isRecord(packageManager) && typeof packageManager.name === "string" && typeof packageManager.version === "string") return `${packageManager.name}@${packageManager.version}`;
+};
+/**
+* Reads the package manager pin from the workspace root manifest.
 *
 * Forwarding it to the output directory keeps the staged install on the same
 * pnpm version as the project.
 */
-const readPackageManagerField = async (workspaceRoot) => {
+const readPackageManagerPin = async (workspaceRoot) => {
 	const pkgPath = path.join(workspaceRoot, "package.json");
 	if (!await pathExists(pkgPath)) return;
-	const parsed = await parseJsonFile(pkgPath);
-	return isRecord(parsed) && typeof parsed.packageManager === "string" ? parsed.packageManager : void 0;
+	const parsed = await readJsonFile(pkgPath);
+	return isRecord(parsed) ? readPin(parsed) : void 0;
 };
 /**
 * The output directory installs a subset of the workspace's dependencies, so
@@ -56,15 +70,12 @@ const readPackageManagerField = async (workspaceRoot) => {
 * install on an unused patch unless this is set.
 */
 const allowUnusedPatches = (content) => {
-	let doc;
-	try {
-		doc = parse(content);
-	} catch (err) {
-		throw new Error(`Failed to parse ${PNPM_WORKSPACE_YAML}: ${err.message}`);
-	}
-	if (!isRecord(doc)) return content;
-	doc.allowUnusedPatches = true;
-	return stringify(doc);
+	const doc = parseDocument(content);
+	const [error] = doc.errors;
+	if (error) throw new Error(`Failed to parse ${PNPM_WORKSPACE_YAML}: ${error.message}`);
+	if (!isMap(doc.contents)) return content;
+	doc.set("allowUnusedPatches", true);
+	return doc.toString();
 };
 /**
 * Stages the pnpm config that an install in `outputDir` needs.
@@ -76,19 +87,24 @@ const allowUnusedPatches = (content) => {
 * credentials that must not ship in the asset.
 */
 const stageWorkspaceFiles = async (workspaceRoot, outputDir, stagedFiles = []) => {
-	for (const file of PNPM_WORKSPACE_FILES) {
+	const present = (await Promise.all(PNPM_WORKSPACE_FILES.map(async (file) => {
 		const src = path.join(workspaceRoot, file);
-		if (!await pathExists(src)) continue;
+		return await pathExists(src) ? {
+			file,
+			src
+		} : void 0;
+	}))).filter((entry) => entry !== void 0);
+	for (const { file } of present) stagedFiles.push(path.join(outputDir, file));
+	await Promise.all(present.map(async ({ file, src }) => {
 		const dest = path.join(outputDir, file);
 		if (file === PNPM_WORKSPACE_YAML) await fs.promises.writeFile(dest, allowUnusedPatches(await fs.promises.readFile(src, "utf8")));
 		else await fs.promises.copyFile(src, dest);
-		stagedFiles.push(dest);
-	}
+	}));
 	const patchesSrc = path.join(workspaceRoot, PNPM_PATCHES_DIR);
 	if (await pathExists(patchesSrc)) {
 		const patchesDest = path.join(outputDir, PNPM_PATCHES_DIR);
-		await fs.copy(patchesSrc, patchesDest);
 		stagedFiles.push(patchesDest);
+		await fs.copy(patchesSrc, patchesDest);
 	}
 	return stagedFiles;
 };
@@ -105,7 +121,7 @@ const extractDependencies = async (resolveFrom, modules) => {
 		} catch {
 			modPkgPath = void 0;
 		}
-		const parsed = modPkgPath ? await parseJsonFile(modPkgPath) : void 0;
+		const parsed = modPkgPath ? await readJsonFile(modPkgPath) : void 0;
 		const version = isRecord(parsed) && typeof parsed.version === "string" ? parsed.version.trim() : void 0;
 		if (!version) throw new Error(`Cannot extract version for module '${mod}'. Check that it's referenced in your package.json or installed.`);
 		result[mod] = version;
@@ -115,30 +131,46 @@ const extractDependencies = async (resolveFrom, modules) => {
 //#endregion
 //#region src/rolldown/lambdaAsset.ts
 const PLUGIN_NAME = "skuba:lambda-asset";
-const resolveOutputDir = ({ dir, file }) => {
+const resolveOutputDir = ({ dir, file }, cwd) => {
 	if (!dir) throw new Error(`${PLUGIN_NAME} requires \`output.dir\`; it prepares a deployable directory, so a single \`output.file\`${file ? ` (${file})` : ""} has nowhere to install into.`);
-	return path.resolve(dir);
+	return path.resolve(cwd, dir);
 };
-const resolveLockFile = async (depsLockFilePath) => {
-	if (!depsLockFilePath) return findUp(PNPM_LOCK);
-	const resolved = path.resolve(depsLockFilePath);
+const resolveLockFile = async (depsLockFilePath, cwd) => {
+	if (!depsLockFilePath) return findUp(PNPM_LOCK, { cwd });
+	const resolved = path.resolve(cwd, depsLockFilePath);
 	if (!await pathExists(resolved)) throw new Error(`${PLUGIN_NAME} cannot find a ${PNPM_LOCK} at '${depsLockFilePath}'.`);
 	return resolved;
 };
+const toPosix = (p) => p.split(path.sep).join("/");
 /**
-* Copies extra `assets` into the output directory alongside the bundle.
+* Emits extra `assets` into the build output alongside the bundle.
 *
-* `from` is resolved relative to `projectRoot`, and `to` relative to the
-* output directory, creating parent directories as needed. Directories are
-* copied recursively.
+* `from` is resolved relative to `projectRoot`; `to` becomes the emitted
+* `fileName`, which rolldown writes relative to the output directory, creating
+* parent directories as needed. Directories are emitted recursively, one asset
+* per file. `originalFileName` points rolldown at each source file so watch mode
+* rebuilds when it changes.
 */
-const copyAssets = async (outputDir, projectRoot, assets) => {
-	for (const asset of assets) {
+const emitAssets = async (emit, projectRoot, assets) => {
+	await Promise.all(assets.map(async (asset) => {
 		const from = path.resolve(projectRoot, asset.from);
-		const to = path.join(outputDir, asset.to ?? path.basename(asset.from));
-		await fs.ensureDir(path.dirname(to));
-		await fs.copy(from, to);
-	}
+		const to = asset.to ?? path.basename(asset.from);
+		const normalized = path.normalize(to);
+		if (path.isAbsolute(normalized) || normalized === "." || normalized === ".." || normalized.startsWith(`..${path.sep}`)) throw new Error(`${PLUGIN_NAME} refuses to copy asset '${asset.from}' to '${asset.to}': it escapes the output directory.`);
+		const files = (await fs.promises.stat(from)).isDirectory() ? (await fs.promises.readdir(from, {
+			recursive: true,
+			withFileTypes: true
+		})).filter((entry) => entry.isFile()).map((entry) => path.join(entry.parentPath, entry.name)) : [from];
+		await Promise.all(files.map(async (absFile) => {
+			const rel = path.relative(from, absFile);
+			emit({
+				type: "asset",
+				fileName: toPosix(rel ? path.join(to, rel) : to),
+				originalFileName: absFile,
+				source: await fs.promises.readFile(absFile)
+			});
+		}));
+	}));
 };
 const writeOutputPackageJson = (outputDir, fields = {}) => fs.promises.writeFile(path.join(outputDir, "package.json"), JSON.stringify({
 	type: "module",
@@ -160,12 +192,13 @@ const stripInstallFiles = async (outputDir, stagedFiles, cause) => {
 * The plugin supports ESM output and pnpm only. It makes no assumptions about
 * how you bundle; it only augments what rolldown has already written:
 *
-* 1. Writes a `package.json` of `type: 'module'`.
-* 2. Installs `nodeModules` into the output directory with pnpm, staging the
+* 1. Emits any extra `assets` into the build output alongside the bundle, via
+*    rolldown's `emitFile`.
+* 2. Writes a `package.json` of `type: 'module'`.
+* 3. Installs `nodeModules` into the output directory with pnpm, staging the
 *    workspace config, `.npmrc`, lock file and patches to do so.
-* 3. Strips those install-only files back out, leaving the bundle, the
+* 4. Strips those install-only files back out, leaving the bundle, the
 *    generated `package.json` and `node_modules`.
-* 4. Copies any extra `assets` into the output directory alongside the bundle.
 *
 * The result can be handed to CDK as `aws_lambda.Code.fromAsset(outputDir)`.
 *
@@ -189,41 +222,50 @@ const stripInstallFiles = async (outputDir, stagedFiles, cause) => {
 */
 const lambdaAsset = ({ nodeModules = [], assets = [], projectRoot: projectRootOption, depsLockFilePath: depsLockFilePathOption } = {}) => {
 	const prepared = /* @__PURE__ */ new Set();
+	let cwd = process.cwd();
 	return {
 		name: PLUGIN_NAME,
-		buildStart() {
+		async buildStart(options) {
+			cwd = options.cwd;
 			prepared.clear();
+			if (assets.length) {
+				const projectRoot = path.resolve(cwd, projectRootOption ?? ".");
+				await emitAssets((file) => this.emitFile(file), projectRoot, assets);
+			}
 		},
 		async writeBundle(outputOptions) {
-			const outputDir = resolveOutputDir(outputOptions);
+			const outputDir = resolveOutputDir(outputOptions, cwd);
 			if (prepared.has(outputDir)) return;
 			prepared.add(outputDir);
-			const projectRoot = path.resolve(projectRootOption ?? process.cwd());
-			await copyAssets(outputDir, projectRoot, assets);
+			const projectRoot = path.resolve(cwd, projectRootOption ?? ".");
 			if (!nodeModules.length) {
 				await writeOutputPackageJson(outputDir);
 				return;
 			}
-			const depsLockFilePath = await resolveLockFile(depsLockFilePathOption);
+			const depsLockFilePath = await resolveLockFile(depsLockFilePathOption, cwd);
 			if (!depsLockFilePath) throw new Error(`${PLUGIN_NAME} cannot find a ${PNPM_LOCK}, which \`nodeModules\` requires. Specify one with \`depsLockFilePath\`.`);
 			const workspaceRoot = path.dirname(depsLockFilePath);
 			const projectPackageJson = path.join(projectRoot, "package.json");
 			if (!await pathExists(projectPackageJson)) throw new Error(`${PLUGIN_NAME} cannot find a package.json in '${projectRoot}', which \`nodeModules\` requires. Specify the directory with \`projectRoot\`.`);
 			await writeOutputPackageJson(outputDir, {
 				dependencies: await extractDependencies(projectPackageJson, nodeModules),
-				packageManager: await readPackageManagerField(workspaceRoot)
+				packageManager: await readPackageManagerPin(workspaceRoot)
 			});
 			const stagedFiles = [];
 			try {
 				await stageWorkspaceFiles(workspaceRoot, outputDir, stagedFiles);
 				const lockDest = path.join(outputDir, PNPM_LOCK);
-				await fs.promises.copyFile(depsLockFilePath, lockDest);
 				stagedFiles.push(lockDest);
+				await fs.promises.copyFile(depsLockFilePath, lockDest);
 				log.plain(log.bold(PLUGIN_NAME), "installing", log.bold(nodeModules.join(", ")));
 				const [bin, ...args] = PNPM_INSTALL_COMMAND;
 				await createExec({ cwd: outputDir })(bin, ...args);
 			} catch (err) {
-				await stripInstallFiles(outputDir, stagedFiles, err);
+				await stripInstallFiles(outputDir, [
+					...stagedFiles,
+					path.join(outputDir, "package.json"),
+					path.join(outputDir, "node_modules")
+				], err);
 				throw err;
 			}
 			await stripInstallFiles(outputDir, stagedFiles);

package/lib/{rolldown-CbJyS-Uy.cjs → rolldown-CN3DH_Tw.cjs}

@@ -33,24 +33,38 @@ const PNPM_INSTALL_COMMAND = [
 	"--no-frozen-lockfile"
 ];
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const parseJsonFile = async (filePath) => {
+const readJsonFile = async (filePath) => {
 	try {
-		return JSON.parse(await fs_extra.default.promises.readFile(filePath, "utf-8"));
+		return await fs_extra.default.readJson(filePath);
 	} catch (err) {
 		throw new Error(`Failed to parse ${filePath} as JSON: ${err.message}`);
 	}
 };
 /**
-* Reads the `packageManager` pin from the workspace root manifest.
+* Reads a `name@version` package manager pin from a manifest, preferring the
+* `packageManager` field and falling back to `devEngines.packageManager`.
+*
+* `devEngines.packageManager` is either an object `{ name, version }` or an
+* array of them; a pin is only returned when both `name` and `version` are
+* present, since corepack needs the version to activate.
+*/
+const readPin = (parsed) => {
+	if (typeof parsed.packageManager === "string") return parsed.packageManager;
+	const raw = (isRecord(parsed.devEngines) ? parsed.devEngines : void 0)?.packageManager;
+	const packageManager = Array.isArray(raw) ? raw[0] : raw;
+	if (isRecord(packageManager) && typeof packageManager.name === "string" && typeof packageManager.version === "string") return `${packageManager.name}@${packageManager.version}`;
+};
+/**
+* Reads the package manager pin from the workspace root manifest.
 *
 * Forwarding it to the output directory keeps the staged install on the same
 * pnpm version as the project.
 */
-const readPackageManagerField = async (workspaceRoot) => {
+const readPackageManagerPin = async (workspaceRoot) => {
 	const pkgPath = node_path.join(workspaceRoot, "package.json");
 	if (!await require_fs.pathExists(pkgPath)) return;
-	const parsed = await parseJsonFile(pkgPath);
-	return isRecord(parsed) && typeof parsed.packageManager === "string" ? parsed.packageManager : void 0;
+	const parsed = await readJsonFile(pkgPath);
+	return isRecord(parsed) ? readPin(parsed) : void 0;
 };
 /**
 * The output directory installs a subset of the workspace's dependencies, so
@@ -58,15 +72,12 @@ const readPackageManagerField = async (workspaceRoot) => {
 * install on an unused patch unless this is set.
 */
 const allowUnusedPatches = (content) => {
-	let doc;
-	try {
-		doc = (0, yaml.parse)(content);
-	} catch (err) {
-		throw new Error(`Failed to parse ${PNPM_WORKSPACE_YAML}: ${err.message}`);
-	}
-	if (!isRecord(doc)) return content;
-	doc.allowUnusedPatches = true;
-	return (0, yaml.stringify)(doc);
+	const doc = (0, yaml.parseDocument)(content);
+	const [error] = doc.errors;
+	if (error) throw new Error(`Failed to parse ${PNPM_WORKSPACE_YAML}: ${error.message}`);
+	if (!(0, yaml.isMap)(doc.contents)) return content;
+	doc.set("allowUnusedPatches", true);
+	return doc.toString();
 };
 /**
 * Stages the pnpm config that an install in `outputDir` needs.
@@ -78,19 +89,24 @@ const allowUnusedPatches = (content) => {
 * credentials that must not ship in the asset.
 */
 const stageWorkspaceFiles = async (workspaceRoot, outputDir, stagedFiles = []) => {
-	for (const file of PNPM_WORKSPACE_FILES) {
+	const present = (await Promise.all(PNPM_WORKSPACE_FILES.map(async (file) => {
 		const src = node_path.join(workspaceRoot, file);
-		if (!await require_fs.pathExists(src)) continue;
+		return await require_fs.pathExists(src) ? {
+			file,
+			src
+		} : void 0;
+	}))).filter((entry) => entry !== void 0);
+	for (const { file } of present) stagedFiles.push(node_path.join(outputDir, file));
+	await Promise.all(present.map(async ({ file, src }) => {
 		const dest = node_path.join(outputDir, file);
 		if (file === PNPM_WORKSPACE_YAML) await fs_extra.default.promises.writeFile(dest, allowUnusedPatches(await fs_extra.default.promises.readFile(src, "utf8")));
 		else await fs_extra.default.promises.copyFile(src, dest);
-		stagedFiles.push(dest);
-	}
+	}));
 	const patchesSrc = node_path.join(workspaceRoot, PNPM_PATCHES_DIR);
 	if (await require_fs.pathExists(patchesSrc)) {
 		const patchesDest = node_path.join(outputDir, PNPM_PATCHES_DIR);
-		await fs_extra.default.copy(patchesSrc, patchesDest);
 		stagedFiles.push(patchesDest);
+		await fs_extra.default.copy(patchesSrc, patchesDest);
 	}
 	return stagedFiles;
 };
@@ -107,7 +123,7 @@ const extractDependencies = async (resolveFrom, modules) => {
 		} catch {
 			modPkgPath = void 0;
 		}
-		const parsed = modPkgPath ? await parseJsonFile(modPkgPath) : void 0;
+		const parsed = modPkgPath ? await readJsonFile(modPkgPath) : void 0;
 		const version = isRecord(parsed) && typeof parsed.version === "string" ? parsed.version.trim() : void 0;
 		if (!version) throw new Error(`Cannot extract version for module '${mod}'. Check that it's referenced in your package.json or installed.`);
 		result[mod] = version;
@@ -117,30 +133,46 @@ const extractDependencies = async (resolveFrom, modules) => {
 //#endregion
 //#region src/rolldown/lambdaAsset.ts
 const PLUGIN_NAME = "skuba:lambda-asset";
-const resolveOutputDir = ({ dir, file }) => {
+const resolveOutputDir = ({ dir, file }, cwd) => {
 	if (!dir) throw new Error(`${PLUGIN_NAME} requires \`output.dir\`; it prepares a deployable directory, so a single \`output.file\`${file ? ` (${file})` : ""} has nowhere to install into.`);
-	return node_path.resolve(dir);
+	return node_path.resolve(cwd, dir);
 };
-const resolveLockFile = async (depsLockFilePath) => {
-	if (!depsLockFilePath) return (0, find_up.findUp)(PNPM_LOCK);
-	const resolved = node_path.resolve(depsLockFilePath);
+const resolveLockFile = async (depsLockFilePath, cwd) => {
+	if (!depsLockFilePath) return (0, find_up.findUp)(PNPM_LOCK, { cwd });
+	const resolved = node_path.resolve(cwd, depsLockFilePath);
 	if (!await require_fs.pathExists(resolved)) throw new Error(`${PLUGIN_NAME} cannot find a ${PNPM_LOCK} at '${depsLockFilePath}'.`);
 	return resolved;
 };
+const toPosix = (p) => p.split(node_path.sep).join("/");
 /**
-* Copies extra `assets` into the output directory alongside the bundle.
+* Emits extra `assets` into the build output alongside the bundle.
 *
-* `from` is resolved relative to `projectRoot`, and `to` relative to the
-* output directory, creating parent directories as needed. Directories are
-* copied recursively.
+* `from` is resolved relative to `projectRoot`; `to` becomes the emitted
+* `fileName`, which rolldown writes relative to the output directory, creating
+* parent directories as needed. Directories are emitted recursively, one asset
+* per file. `originalFileName` points rolldown at each source file so watch mode
+* rebuilds when it changes.
 */
-const copyAssets = async (outputDir, projectRoot, assets) => {
-	for (const asset of assets) {
+const emitAssets = async (emit, projectRoot, assets) => {
+	await Promise.all(assets.map(async (asset) => {
 		const from = node_path.resolve(projectRoot, asset.from);
-		const to = node_path.join(outputDir, asset.to ?? node_path.basename(asset.from));
-		await fs_extra.default.ensureDir(node_path.dirname(to));
-		await fs_extra.default.copy(from, to);
-	}
+		const to = asset.to ?? node_path.basename(asset.from);
+		const normalized = node_path.normalize(to);
+		if (node_path.isAbsolute(normalized) || normalized === "." || normalized === ".." || normalized.startsWith(`..${node_path.sep}`)) throw new Error(`${PLUGIN_NAME} refuses to copy asset '${asset.from}' to '${asset.to}': it escapes the output directory.`);
+		const files = (await fs_extra.default.promises.stat(from)).isDirectory() ? (await fs_extra.default.promises.readdir(from, {
+			recursive: true,
+			withFileTypes: true
+		})).filter((entry) => entry.isFile()).map((entry) => node_path.join(entry.parentPath, entry.name)) : [from];
+		await Promise.all(files.map(async (absFile) => {
+			const rel = node_path.relative(from, absFile);
+			emit({
+				type: "asset",
+				fileName: toPosix(rel ? node_path.join(to, rel) : to),
+				originalFileName: absFile,
+				source: await fs_extra.default.promises.readFile(absFile)
+			});
+		}));
+	}));
 };
 const writeOutputPackageJson = (outputDir, fields = {}) => fs_extra.default.promises.writeFile(node_path.join(outputDir, "package.json"), JSON.stringify({
 	type: "module",
@@ -162,12 +194,13 @@ const stripInstallFiles = async (outputDir, stagedFiles, cause) => {
 * The plugin supports ESM output and pnpm only. It makes no assumptions about
 * how you bundle; it only augments what rolldown has already written:
 *
-* 1. Writes a `package.json` of `type: 'module'`.
-* 2. Installs `nodeModules` into the output directory with pnpm, staging the
+* 1. Emits any extra `assets` into the build output alongside the bundle, via
+*    rolldown's `emitFile`.
+* 2. Writes a `package.json` of `type: 'module'`.
+* 3. Installs `nodeModules` into the output directory with pnpm, staging the
 *    workspace config, `.npmrc`, lock file and patches to do so.
-* 3. Strips those install-only files back out, leaving the bundle, the
+* 4. Strips those install-only files back out, leaving the bundle, the
 *    generated `package.json` and `node_modules`.
-* 4. Copies any extra `assets` into the output directory alongside the bundle.
 *
 * The result can be handed to CDK as `aws_lambda.Code.fromAsset(outputDir)`.
 *
@@ -191,41 +224,50 @@ const stripInstallFiles = async (outputDir, stagedFiles, cause) => {
 */
 const lambdaAsset = ({ nodeModules = [], assets = [], projectRoot: projectRootOption, depsLockFilePath: depsLockFilePathOption } = {}) => {
 	const prepared = /* @__PURE__ */ new Set();
+	let cwd = process.cwd();
 	return {
 		name: PLUGIN_NAME,
-		buildStart() {
+		async buildStart(options) {
+			cwd = options.cwd;
 			prepared.clear();
+			if (assets.length) {
+				const projectRoot = node_path.resolve(cwd, projectRootOption ?? ".");
+				await emitAssets((file) => this.emitFile(file), projectRoot, assets);
+			}
 		},
 		async writeBundle(outputOptions) {
-			const outputDir = resolveOutputDir(outputOptions);
+			const outputDir = resolveOutputDir(outputOptions, cwd);
 			if (prepared.has(outputDir)) return;
 			prepared.add(outputDir);
-			const projectRoot = node_path.resolve(projectRootOption ?? process.cwd());
-			await copyAssets(outputDir, projectRoot, assets);
+			const projectRoot = node_path.resolve(cwd, projectRootOption ?? ".");
 			if (!nodeModules.length) {
 				await writeOutputPackageJson(outputDir);
 				return;
 			}
-			const depsLockFilePath = await resolveLockFile(depsLockFilePathOption);
+			const depsLockFilePath = await resolveLockFile(depsLockFilePathOption, cwd);
 			if (!depsLockFilePath) throw new Error(`${PLUGIN_NAME} cannot find a ${PNPM_LOCK}, which \`nodeModules\` requires. Specify one with \`depsLockFilePath\`.`);
 			const workspaceRoot = node_path.dirname(depsLockFilePath);
 			const projectPackageJson = node_path.join(projectRoot, "package.json");
 			if (!await require_fs.pathExists(projectPackageJson)) throw new Error(`${PLUGIN_NAME} cannot find a package.json in '${projectRoot}', which \`nodeModules\` requires. Specify the directory with \`projectRoot\`.`);
 			await writeOutputPackageJson(outputDir, {
 				dependencies: await extractDependencies(projectPackageJson, nodeModules),
-				packageManager: await readPackageManagerField(workspaceRoot)
+				packageManager: await readPackageManagerPin(workspaceRoot)
 			});
 			const stagedFiles = [];
 			try {
 				await stageWorkspaceFiles(workspaceRoot, outputDir, stagedFiles);
 				const lockDest = node_path.join(outputDir, PNPM_LOCK);
-				await fs_extra.default.promises.copyFile(depsLockFilePath, lockDest);
 				stagedFiles.push(lockDest);
+				await fs_extra.default.promises.copyFile(depsLockFilePath, lockDest);
 				require_logging.log.plain(require_logging.log.bold(PLUGIN_NAME), "installing", require_logging.log.bold(nodeModules.join(", ")));
 				const [bin, ...args] = PNPM_INSTALL_COMMAND;
 				await require_exec.createExec({ cwd: outputDir })(bin, ...args);
 			} catch (err) {
-				await stripInstallFiles(outputDir, stagedFiles, err);
+				await stripInstallFiles(outputDir, [
+					...stagedFiles,
+					node_path.join(outputDir, "package.json"),
+					node_path.join(outputDir, "node_modules")
+				], err);
 				throw err;
 			}
 			await stripInstallFiles(outputDir, stagedFiles);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skuba-lib/api",
-  "version": "2.3.0-rolldown-cdk-bundle-plugin-20260804050549",
+  "version": "2.3.0-rolldown-cdk-bundle-plugin-20260804234000",
   "description": "Node.js development API for skuba",
   "homepage": "https://github.com/seek-oss/skuba#readme",
   "bugs": {