@stealthscale/vite-plugin-product 0.3.0 → 0.3.2

package/README.md

@@ -228,9 +228,11 @@ release.
   the package. The entry of an ES module exports `*` and its default export. The entry of a CommonJS
   module exports the names that Node's `require` returns.
 - The client build runs a first build of the same configuration without the entries, and records the
-  chunk of each module. The second build places each recorded module in the chunk of the same name,
-  and each recorded CommonJS module in a chunk beside it, named with `-cjs`. Rolldown builds the
-  code that only the entries need into chunks that only the entries import.
+  chunk of each module. The first build keeps every export of each module of a provided package that
+  states its side effects, because the entries make the second build keep them. It also records the
+  modules that those exports import. The second build places each recorded module in the chunk of
+  the same name, and each recorded CommonJS module in a chunk beside it, named with `-cjs`. Rolldown
+  builds the code that only the entries need into chunks that only the entries import.
 - The build writes `.product/provided.json`. The file contains the URL of each provided entry and
   the URLs of the chunks that the entry imports, without the chunks of the page's startup. It also
   contains the installed version of each provided package and the page's fallback `language`. The

package/dist/cyclonedx/bom.json

@@ -1 +1 @@
-{"$schema":"http://cyclonedx.org/schema/bom-1.7.schema.json","bomFormat":"CycloneDX","specVersion":"1.7","version":1,"metadata":{"lifecycles":[{"phase":"build"}],"tools":{"components":[{"type":"application","name":"rolldown","version":"1.2.12"},{"type":"application","name":"vite","version":"8.3.3"},{"type":"library","name":"core","group":"@arethetypeswrong","version":"0.18.5","bom-ref":"pkg:npm/%40arethetypeswrong/core@0.18.5","author":"Andrew Branch","description":"The API behind arethetypeswrong.github.io","hashes":[{"alg":"SHA-512","content":"f72b63cc6c318e6f54cfb23d6af7dbb79be542deae93db914444b3263aabce797a58abc8e9dc184e8faf277534d96aeafe64778aa97f3f386f1e129d2480230d"}],"licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40arethetypeswrong/core@0.18.5","externalReferences":[{"url":"https://github.com/arethetypeswrong/arethetypeswrong.github.io.git#packages/core","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=20"}]},{"type":"library","name":"sdk-core","group":"@stealthscale","version":"0.3.0","bom-ref":"pkg:npm/%40stealthscale/sdk-core@0.3.0","description":"Declares the contracts and manifests of plugins, evaluates their conditions, and resolves a product from them, without loading another package at run time.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/sdk-core@0.3.0","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#sdk/core","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/sdk/core#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"testing-config","group":"@stealthscale","version":"0.6.0","bom-ref":"pkg:npm/%40stealthscale/testing-config@0.6.0","description":"Lists every part of the house contract a config, plugin or library package breaks.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/testing-config@0.6.0","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#packages/testing-config","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/packages/testing-config#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"testing","group":"@stealthscale","version":"0.4.0","bom-ref":"pkg:npm/%40stealthscale/testing@0.4.0","description":"Supplies the scratch workspaces, manifests, element measurements and plugin drivers a specification needs.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/testing@0.4.0","externalReferences":[{"url":"git+https://github.com/stealth-scale/scale.git#packages/testing","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"vite-config-typescript","group":"@stealthscale","version":"0.3.0","bom-ref":"pkg:npm/%40stealthscale/vite-config-typescript@0.3.0","description":"Sets the TypeScript options every stealthscale package compiles with.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/vite-config-typescript@0.3.0","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#packages/vite-config-typescript","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/packages/vite-config-typescript#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"vite-config","group":"@stealthscale","version":"0.8.0","bom-ref":"pkg:npm/%40stealthscale/vite-config@0.8.0","description":"Configures a package from five Vite+ tiers and a named layer for every block.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/vite-config@0.8.0","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#packages/vite-config","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/packages/vite-config#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"vite-plugin-base","group":"@stealthscale","version":"0.4.0","bom-ref":"pkg:npm/%40stealthscale/vite-plugin-base@0.4.0","description":"Turns a name and one write step into a bundler plugin that reads the module graph.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/vite-plugin-base@0.4.0","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#packages/vite-plugin-base","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/packages/vite-plugin-base#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"vite-plugin-i18n","group":"@stealthscale","version":"0.3.1","bom-ref":"pkg:npm/%40stealthscale/vite-plugin-i18n@0.3.1","description":"Finds every catalogue an application can reach, types their keys, and answers the module it loads them from.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/vite-plugin-i18n@0.3.1","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#packages/vite-plugin-i18n","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/packages/vite-plugin-i18n#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"node","group":"@types","version":"26.6.4","bom-ref":"pkg:npm/%40types/node@26.6.4","description":"TypeScript definitions for node","hashes":[{"alg":"SHA-512","content":"95d54f0c2ce3edfb1a199acb07436e1ee4ef25cb0d6accac040a8ca25aff720c6b2ddd716eac48af75c988f9c71c9502c63e6c345d6f9d18fd6969eb561e4972"}],"licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40types/node@26.6.4","externalReferences":[{"url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/node","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node","type":"website","comment":"as detected from PackageJson property \"homepage\""}]},{"type":"library","name":"coverage-v8","group":"@vitest","version":"5.0.3","bom-ref":"pkg:npm/%40vitest/coverage-v8@5.0.3","author":"Anthony Fu <anthonyfu117@hotmail.com>","description":"V8 coverage provider for Vitest","hashes":[{"alg":"SHA-512","content":"fa496ccb3ec1bd3d6f094dbc6647f39acd486bbf170f4578d54dc552d45a6b74bebceaff117bcad4ee81bd50fb9754731239ba48e351d9ac9b3af0c37fdbb499"}],"licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40vitest/coverage-v8@5.0.3","externalReferences":[{"url":"https://github.com/vitest-dev/vitest/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs.url\""},{"url":"git+https://github.com/vitest-dev/vitest.git#packages/coverage-v8","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://vitest.dev/guide/coverage","type":"website","comment":"as detected from PackageJson property \"homepage\""}]},{"type":"library","name":"vite-plus-core","group":"@voidzero-dev","version":"1.1.0","bom-ref":"pkg:npm/%40voidzero-dev/vite-plus-core@1.1.0","author":"VoidZero Inc.","description":"The Unified Toolchain for the Web","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40voidzero-dev/vite-plus-core@1.1.0","externalReferences":[{"url":"https://github.com/voidzero-dev/vite-plus/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs.url\""},{"url":"git+https://github.com/voidzero-dev/vite-plus.git#packages/core","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://viteplus.dev/guide","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":"^20.19.0 || ^22.18.0 || >=24.11.0"}]},{"type":"library","name":"typescript","version":"7.0.2","bom-ref":"pkg:npm/typescript@7.0.2","author":"Microsoft Corp.","description":"TypeScript is a language for application scale JavaScript development","hashes":[{"alg":"SHA-512","content":"f0561abbdea8dcd28e85b8ca8bfa8dbc6fd6e63873c646dd9b9b23f406d9ff94f9b16aa7de12602df1b1dbbb11299593bf2cc23fc74b4414dfe6d05349155434"}],"licenses":[{"license":{"id":"Apache-2.0"}}],"purl":"pkg:npm/typescript@7.0.2","externalReferences":[{"url":"https://github.com/microsoft/TypeScript/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs.url\""},{"url":"https://github.com/microsoft/TypeScript.git","type":"vcs","comment":"as detected from PackageJson property \"repository.url\""},{"url":"https://www.typescriptlang.org/","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=16.20.0"}]},{"type":"library","name":"vitest","version":"5.0.3","bom-ref":"pkg:npm/vitest@5.0.3","author":"Anthony Fu <anthonyfu117@hotmail.com>","description":"Next generation testing framework powered by Vite","hashes":[{"alg":"SHA-512","content":"c4cc3ded2deb8ddb63e5d9156adee30aca96069bdc86cdd196941cb54ab0243d0a904464e34bf3d9f27bee50f05bf57387fa64d7c788b5803392876149eb378d"}],"licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/vitest@5.0.3","externalReferences":[{"url":"https://github.com/vitest-dev/vitest/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs.url\""},{"url":"git+https://github.com/vitest-dev/vitest.git#packages/vitest","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://vitest.dev","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":"^22.12.0 || ^24.0.0 || >=26.0.0"}]}]},"component":{"type":"library","name":"vite-plugin-product","group":"@stealthscale","version":"0.3.0","bom-ref":"pkg:npm/%40stealthscale/vite-plugin-product@0.3.0","description":"Composes a product from its plugins while it builds: checks every plugin against the others, resolves the product, and serves it as virtual:product.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/vite-plugin-product@0.3.0","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#packages/vite-plugin-product","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/packages/vite-plugin-product#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}],"evidence":{"licenses":[{"license":{"name":"file: LICENSE","text":{"content":"TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgMjAyNiBTdGVhbHRoIFNjYWxlIEIuVi4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkKb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwKaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cwp0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsCmNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcwpmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsCmNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUgpJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwKRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFCkFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIKTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwKT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUKU09GVFdBUkUuCg==","contentType":"text/plain","encoding":"base64"}}}]}},"supplier":{"name":"Stealth Scale B.V.","url":["https://stealthscale.io"]}},"components":[],"dependencies":[{"ref":"pkg:npm/%40stealthscale/vite-plugin-product@0.3.0"}]}
+{"$schema":"http://cyclonedx.org/schema/bom-1.7.schema.json","bomFormat":"CycloneDX","specVersion":"1.7","version":1,"metadata":{"lifecycles":[{"phase":"build"}],"tools":{"components":[{"type":"application","name":"rolldown","version":"1.2.12"},{"type":"application","name":"vite","version":"8.3.3"},{"type":"library","name":"core","group":"@arethetypeswrong","version":"0.18.5","bom-ref":"pkg:npm/%40arethetypeswrong/core@0.18.5","author":"Andrew Branch","description":"The API behind arethetypeswrong.github.io","hashes":[{"alg":"SHA-512","content":"f72b63cc6c318e6f54cfb23d6af7dbb79be542deae93db914444b3263aabce797a58abc8e9dc184e8faf277534d96aeafe64778aa97f3f386f1e129d2480230d"}],"licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40arethetypeswrong/core@0.18.5","externalReferences":[{"url":"https://github.com/arethetypeswrong/arethetypeswrong.github.io.git#packages/core","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=20"}]},{"type":"library","name":"sdk-core","group":"@stealthscale","version":"0.3.0","bom-ref":"pkg:npm/%40stealthscale/sdk-core@0.3.0","description":"Declares the contracts and manifests of plugins, evaluates their conditions, and resolves a product from them, without loading another package at run time.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/sdk-core@0.3.0","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#sdk/core","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/sdk/core#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"testing-config","group":"@stealthscale","version":"0.6.0","bom-ref":"pkg:npm/%40stealthscale/testing-config@0.6.0","description":"Lists every part of the house contract a config, plugin or library package breaks.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/testing-config@0.6.0","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#packages/testing-config","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/packages/testing-config#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"testing","group":"@stealthscale","version":"0.4.0","bom-ref":"pkg:npm/%40stealthscale/testing@0.4.0","description":"Supplies the scratch workspaces, manifests, element measurements and plugin drivers a specification needs.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/testing@0.4.0","externalReferences":[{"url":"git+https://github.com/stealth-scale/scale.git#packages/testing","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"vite-config-typescript","group":"@stealthscale","version":"0.3.0","bom-ref":"pkg:npm/%40stealthscale/vite-config-typescript@0.3.0","description":"Sets the TypeScript options every stealthscale package compiles with.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/vite-config-typescript@0.3.0","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#packages/vite-config-typescript","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/packages/vite-config-typescript#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"vite-config","group":"@stealthscale","version":"0.8.0","bom-ref":"pkg:npm/%40stealthscale/vite-config@0.8.0","description":"Configures a package from five Vite+ tiers and a named layer for every block.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/vite-config@0.8.0","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#packages/vite-config","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/packages/vite-config#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"vite-plugin-base","group":"@stealthscale","version":"0.5.1","bom-ref":"pkg:npm/%40stealthscale/vite-plugin-base@0.5.1","description":"Turns a name and one write step into a bundler plugin that reads the module graph.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/vite-plugin-base@0.5.1","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#packages/vite-plugin-base","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/packages/vite-plugin-base#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"vite-plugin-i18n","group":"@stealthscale","version":"0.4.0","bom-ref":"pkg:npm/%40stealthscale/vite-plugin-i18n@0.4.0","description":"Finds every catalogue an application can reach, types their keys, and answers the module it loads them from.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/vite-plugin-i18n@0.4.0","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#packages/vite-plugin-i18n","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/packages/vite-plugin-i18n#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}]},{"type":"library","name":"node","group":"@types","version":"26.6.4","bom-ref":"pkg:npm/%40types/node@26.6.4","description":"TypeScript definitions for node","hashes":[{"alg":"SHA-512","content":"95d54f0c2ce3edfb1a199acb07436e1ee4ef25cb0d6accac040a8ca25aff720c6b2ddd716eac48af75c988f9c71c9502c63e6c345d6f9d18fd6969eb561e4972"}],"licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40types/node@26.6.4","externalReferences":[{"url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git#types/node","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node","type":"website","comment":"as detected from PackageJson property \"homepage\""}]},{"type":"library","name":"coverage-v8","group":"@vitest","version":"5.0.3","bom-ref":"pkg:npm/%40vitest/coverage-v8@5.0.3","author":"Anthony Fu <anthonyfu117@hotmail.com>","description":"V8 coverage provider for Vitest","hashes":[{"alg":"SHA-512","content":"fa496ccb3ec1bd3d6f094dbc6647f39acd486bbf170f4578d54dc552d45a6b74bebceaff117bcad4ee81bd50fb9754731239ba48e351d9ac9b3af0c37fdbb499"}],"licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40vitest/coverage-v8@5.0.3","externalReferences":[{"url":"https://github.com/vitest-dev/vitest/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs.url\""},{"url":"git+https://github.com/vitest-dev/vitest.git#packages/coverage-v8","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://vitest.dev/guide/coverage","type":"website","comment":"as detected from PackageJson property \"homepage\""}]},{"type":"library","name":"vite-plus-core","group":"@voidzero-dev","version":"1.1.0","bom-ref":"pkg:npm/%40voidzero-dev/vite-plus-core@1.1.0","author":"VoidZero Inc.","description":"The Unified Toolchain for the Web","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40voidzero-dev/vite-plus-core@1.1.0","externalReferences":[{"url":"https://github.com/voidzero-dev/vite-plus/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs.url\""},{"url":"git+https://github.com/voidzero-dev/vite-plus.git#packages/core","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://viteplus.dev/guide","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":"^20.19.0 || ^22.18.0 || >=24.11.0"}]},{"type":"library","name":"typescript","version":"7.0.2","bom-ref":"pkg:npm/typescript@7.0.2","author":"Microsoft Corp.","description":"TypeScript is a language for application scale JavaScript development","hashes":[{"alg":"SHA-512","content":"f0561abbdea8dcd28e85b8ca8bfa8dbc6fd6e63873c646dd9b9b23f406d9ff94f9b16aa7de12602df1b1dbbb11299593bf2cc23fc74b4414dfe6d05349155434"}],"licenses":[{"license":{"id":"Apache-2.0"}}],"purl":"pkg:npm/typescript@7.0.2","externalReferences":[{"url":"https://github.com/microsoft/TypeScript/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs.url\""},{"url":"https://github.com/microsoft/TypeScript.git","type":"vcs","comment":"as detected from PackageJson property \"repository.url\""},{"url":"https://www.typescriptlang.org/","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=16.20.0"}]},{"type":"library","name":"vitest","version":"5.0.3","bom-ref":"pkg:npm/vitest@5.0.3","author":"Anthony Fu <anthonyfu117@hotmail.com>","description":"Next generation testing framework powered by Vite","hashes":[{"alg":"SHA-512","content":"c4cc3ded2deb8ddb63e5d9156adee30aca96069bdc86cdd196941cb54ab0243d0a904464e34bf3d9f27bee50f05bf57387fa64d7c788b5803392876149eb378d"}],"licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/vitest@5.0.3","externalReferences":[{"url":"https://github.com/vitest-dev/vitest/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs.url\""},{"url":"git+https://github.com/vitest-dev/vitest.git#packages/vitest","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://vitest.dev","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":"^22.12.0 || ^24.0.0 || >=26.0.0"}]}]},"component":{"type":"library","name":"vite-plugin-product","group":"@stealthscale","version":"0.3.2","bom-ref":"pkg:npm/%40stealthscale/vite-plugin-product@0.3.2","description":"Composes a product from its plugins while it builds: checks every plugin against the others, resolves the product, and serves it as virtual:product.","licenses":[{"license":{"id":"MIT"}}],"purl":"pkg:npm/%40stealthscale/vite-plugin-product@0.3.2","externalReferences":[{"url":"https://github.com/stealth-scale/scale/issues","type":"issue-tracker","comment":"as detected from PackageJson property \"bugs\""},{"url":"git+https://github.com/stealth-scale/scale.git#packages/vite-plugin-product","type":"vcs","comment":"as detected from PackageJson property \"repository.url\" and \"repository.directory\""},{"url":"https://github.com/stealth-scale/scale/tree/main/packages/vite-plugin-product#readme","type":"website","comment":"as detected from PackageJson property \"homepage\""}],"properties":[{"name":"cdx:npm:package:constraint:engine:node","value":">=26.0.0"}],"evidence":{"licenses":[{"license":{"name":"file: LICENSE","text":{"content":"TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgMjAyNiBTdGVhbHRoIFNjYWxlIEIuVi4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkKb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwKaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cwp0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsCmNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcwpmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsCmNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUgpJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwKRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFCkFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIKTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwKT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUKU09GVFdBUkUuCg==","contentType":"text/plain","encoding":"base64"}}}]}},"supplier":{"name":"Stealth Scale B.V.","url":["https://stealthscale.io"]}},"components":[],"dependencies":[{"ref":"pkg:npm/%40stealthscale/vite-plugin-product@0.3.2"}]}

package/dist/index.d.mts

@@ -107,9 +107,12 @@ export declare function product(options?: ProductOptions): Plugin;
  * Creates the plugin that provides the product's shared modules to the releases its page loads.
  *
  * @remarks
- *   The client build first runs a build of the same configuration without the facades. It then
- *   builds each module of that first build into the chunk of the same name, and each CommonJS
- *   module into a chunk beside it. It emits each facade as an entry chunk that keeps its exports.
+ *   The client build first runs a build of the same configuration without the facades. The first
+ *   build keeps every export of each module of a provided package that it includes, as the facades
+ *   make the client build keep them. A package qualifies where it states which of its files have
+ *   side effects. The client build then builds each module of the first build into the chunk of the
+ *   same name, and each CommonJS module into a chunk beside it. It emits each facade as an entry
+ *   chunk that keeps its exports.
  *   A facade imports its specifier, and the plugin resolves the specifier from the package that
  *   depends on it, so the facade and the product share one module. Rolldown builds the code that
  *   only the facades need into chunks that only the facades import. The plugin writes

package/dist/index.mjs

@@ -3,33 +3,38 @@ import { build, normalizePath, parseSync } from "vite";
 import { PROVIDED_FILE, RELEASE_FILE, lineOf, releaseProblems, resolveProduct } from "@stealthscale/sdk-core";
 import { dependencies, exportTarget, importer, literal, manifestAt, owning, packageAt, quoted, text } from "@stealthscale/vite-plugin-base";
 import { LOCALES, cataloguesOf } from "@stealthscale/vite-plugin-i18n";
-import { dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, matchesGlob, posix, relative, resolve, sep } from "node:path";
 import { validateHotkey } from "@tanstack/hotkeys";
 import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 //#region src/page.ts
 /**
-* Writes the document and the entry of a page the plugin serves at `index.html`: a product's page
-* or a plugin's standalone page.
+* Writes the document and the entry of the page that the plugin serves at `index.html`. The page
+* is a product's page or a plugin's standalone page.
 */
 /**
 * The page's document, from the project root.
 */
 const DOCUMENT = "index.html";
 /**
-* The language of a document whose page states none.
+* The language of a document whose page has no language.
 */
 const LANGUAGE = "en-US";
 /**
-* Returns the path of the page's document for a specifier that names it, and undefined for any
+* Returns the path of the page's document for a specifier of the document, and undefined for any
 * other specifier.
 *
+* @remarks
+*   The function compares the specifier after `normalizePath`. A build's default input is the
+*   document's path from `path.resolve`, which has backslashes on Windows.
 * @param root - The project root.
-* @param id - The specifier: `index.html`, `/index.html` or the document's path name the document.
+* @param id - The specifier. The document's specifiers are `index.html`, `/index.html` and the
+*   document's path.
 */
 function documentIdOf(root, id) {
 	const document = normalizePath(join(root, DOCUMENT));
-	return id === DOCUMENT || id === `/${DOCUMENT}` || id === document ? document : void 0;
+	const file = normalizePath(id);
+	return file === DOCUMENT || file === `/${DOCUMENT}` || file === document ? document : void 0;
 }
 /**
 * Returns the specifier of a module by its path from the project root, such as `/src/glyphs.tsx`.
@@ -38,8 +43,8 @@ function rootedOf(path) {
 	return posix.join("/", normalizePath(path));
 }
 /**
-* Returns the source of a page's document: its language and title, an element with the id `root`,
-* and the entry.
+* Returns the source of a page's document. The document has its language and title, an element
+* with the id `root`, and the entry.
 */
 function documentSource({ entry, language, title }) {
 	return [
@@ -59,18 +64,18 @@ function documentSource({ entry, language, title }) {
 	].join("\n");
 }
 /**
-* Returns the source of a page's entry: the stylesheet and the static imports, every other module
-* through `import()`, and a call of the render function with the members.
+* Returns the source of a page's entry. The entry imports the stylesheet and the static modules,
+* imports every other module through `import()`, and calls the render function with the members.
 *
 * @remarks
 *   The entry imports the stylesheet and modules without components statically, and the page's
 *   other modules through `import()`. The bundled dev server installs the React refresh runtime in
-*   the entry's own body, and a chunk the entry imports statically runs before that body, so a
-*   component in a chunk the bundler shares between the entry and a lazy module would run before
-*   the runtime and throw. Behind `import()`, every component runs after it. A module the entry
-*   alone imports statically builds into the entry's chunk, so it adds no chunk of its own. The
-*   entry awaits nothing at its top level, because a module with a top-level await makes the
-*   bundler move every module it shares with a lazy module into a chunk of its own.
+*   the entry's own body. A chunk that the entry imports statically runs before that body, so a
+*   component in a chunk that the entry shares with a lazy module would run before the runtime and
+*   throw. A component that the entry imports through `import()` runs after the runtime. A module
+*   that only the entry imports statically builds into the entry's chunk, so it adds no chunk of
+*   its own. The entry does not await at its top level, because a module with a top-level await
+*   makes the bundler move every module it shares with a lazy module into a chunk of its own.
 * @param render - The name of the render function, which the first module exports.
 * @param modules - The modules the entry imports through `import()`, the render function's first.
 * @param members - The members of the object the render function receives.
@@ -428,22 +433,22 @@ function moduleOf(definition, product) {
 //#endregion
 //#region src/chunks.ts
 /**
-* Names the chunk each module of a product builds into: one chunk per plugin, which every page,
-* extension, command and settings section of the plugin shares, and under a build one chunk for the
-* other modules outside the application that the startup or a plugin imports statically.
+* Names the chunk that each module of a product builds into.
 *
 * @remarks
-*   The product imports each web package's main entry statically, through its definition. The main
-*   entry and every module it imports statically build into the chunks the entry loads, because in
-*   the plugin's chunk they would make the first load fetch the whole plugin. Groups that place a
-*   module by its path alone make rolldown 1.2 build a module the groups leave into the chunk of a
-*   lazy module that imports it, and export it from there to the chunks that need it. `import()` of
-*   that lazy module then resolves to a namespace with the other module's exports as well. A module
-*   outside every web package that one plugin's lazy modules alone import goes into the plugin's
-*   chunk. Every other module outside the application that the startup or a plugin's modules import
-*   statically goes into the `dependencies` chunk, so a lazy module's chunk contains the lazy
-*   module alone. A module that only another `import()` loads, such as a page the application
-*   loads on demand, keeps its own chunk, so it does not load with the startup.
+*   Each plugin has one chunk for its pages, extensions, commands and settings sections. A build
+*   also has one chunk for the other modules outside the application that the startup or a plugin
+*   imports statically. The product's definition imports the main entry of each web package
+*   statically. The main entry and every module it imports statically build into the chunks that
+*   the entry loads, because in the plugin's chunk they would make the first load fetch the whole
+*   plugin. Groups that place a module by its path alone make rolldown 1.2 build a module that no
+*   group takes into the chunk of a lazy module that imports it. Rolldown then exports the module
+*   from that chunk to the chunks that need it, and `import()` of the lazy module resolves to a
+*   namespace with the other module's exports as well. A module outside every web package that
+*   only one plugin's lazy modules import goes into the plugin's chunk. Every other module outside
+*   the application that the startup or a plugin's modules import statically goes into the
+*   `dependencies` chunk. A lazy module's chunk then contains the lazy module alone. A module that
+*   only another `import()` loads keeps its own chunk and does not load with the startup.
 */
 /**
 * Name of the chunk that a module outside the application builds into where the startup or a
@@ -451,12 +456,13 @@ function moduleOf(definition, product) {
 */
 const DEPENDENCIES = "dependencies";
 /**
-* Priority of the plugin chunks' group: above the shared chunk's 3, below the vendor chunk's 5.
+* Priority of the plugin chunks' group. It is above the shared chunk's 3 and below the vendor
+* chunk's 5.
 */
 const PRIORITY = 4;
 /**
-* Priority of the dependencies' group: below every other group's, so it claims only the modules
-* they leave.
+* Priority of the dependencies' group. It is below the priority of every other group, so the group
+* claims only the modules that the other groups leave.
 */
 const LAST = 1;
 /**
@@ -466,13 +472,18 @@ const INSTALLED = /(?:^|[\\/])node_modules[\\/]/u;
 /**
 * Returns the id of the plugin whose web package contains a module, or undefined for a module
 * outside every web package.
+*
+* @remarks
+*   The web packages' directories have forward slashes. The function compares the module's id
+*   after `normalizePath`, so an id with backslashes on Windows matches too.
 */
 function ownerOf(id, packages) {
-	return Object.entries(packages).find(([, { directory }]) => id.startsWith(`${directory}${sep}`))?.[0];
+	const file = normalizePath(id);
+	return Object.entries(packages).find(([, { directory }]) => file.startsWith(`${directory}/`))?.[0];
 }
 /**
-* Returns true where the walk over a module's static importers meets a module the test accepts,
-* the module itself included.
+* Returns true where the walk over a module's static importers meets a module that the test
+* accepts. The walk starts at the module itself.
 */
 function leadsTo(id, chunking, ends) {
 	const seen = /* @__PURE__ */ new Set();
@@ -492,28 +503,28 @@ function startup(id, info) {
 	return id === RESOLVED || info?.isEntry === true;
 }
 /**
-* Returns true where an entry of the build or `virtual:product` imports a module statically,
-* directly or through other modules.
+* Returns true where an entry of the build or `virtual:product` imports a module statically. The
+* import may pass through other modules.
 *
 * @remarks
-*   The walk follows each module's static importers back towards the entries, and ends at
-*   `virtual:product`, because every module the product imports statically loads with it. The
-*   standalone page's entry imports the product through `import()`, so no entry imports the
-*   definition statically there. A dynamic import ends the walk elsewhere, because a module behind
-*   one loads after the entry.
+*   The walk follows each module's static importers back towards the entries. It ends at
+*   `virtual:product`, because every module that the product imports statically loads with it. The
+*   standalone page's entry imports the product through `import()`, and no entry imports the
+*   definition statically there. A dynamic import ends the walk elsewhere, because the module that
+*   it imports loads after the entry.
 */
 function initial(id, chunking) {
 	return leadsTo(id, chunking, startup);
 }
 /**
-* Returns the one plugin whose web package's modules import a module outside every web package,
-* directly or through other modules.
+* Returns the one plugin whose web package's modules import a module outside every web package.
+* The import may pass through other modules.
 *
 * @remarks
-*   Returns undefined where an entry or `virtual:product` imports the module statically, where the
-*   walk meets a module outside every web package that no module imports statically, such as a lazy
-*   page of the application, or a module the build does not know, and where the modules of two
-*   plugins import it.
+*   The function returns undefined in four cases. An entry or `virtual:product` imports the module
+*   statically. The walk meets a module outside every web package that no module imports
+*   statically, such as a lazy page of the application. The walk meets a module that the build does
+*   not know. The modules of two plugins import the module.
 */
 function soleOwnerOf(id, chunking, packages) {
 	const owners = /* @__PURE__ */ new Set();
@@ -534,11 +545,13 @@ function soleOwnerOf(id, chunking, packages) {
 	return owners.size === 1 ? sole : void 0;
 }
 /**
-* Returns the chunk a module builds into: `plugin-<id>` for a module of an installed plugin's web
-* package that no entry imports statically, and for a module outside every web package that only
-* that plugin's lazy modules import, and null for every other module.
+* Returns the plugin chunk that a module builds into, or null for a module of no plugin chunk.
 *
-* @param id - The module's id, its absolute path.
+* @remarks
+*   A module of an installed plugin's web package that no entry imports statically builds into
+*   `plugin-<id>`. A module outside every web package that only that plugin's lazy modules import
+*   builds into the same chunk.
+* @param id - The module's id. A file's id is its absolute path.
 * @param chunking - The context rolldown passes a group's name function.
 * @param packages - Each installed plugin's web package, by plugin id.
 */
@@ -549,17 +562,17 @@ function pluginChunkOf(id, chunking, packages) {
 	return sole === void 0 ? null : `plugin-${sole}`;
 }
 /**
-* Returns the chunk a module builds into where the groups with a higher priority leave it:
-* `dependencies` for a module outside the application that the startup or a plugin's modules import
-* statically, and null for every other module.
+* Returns `dependencies` for a module outside the application that the startup or a plugin's
+* modules import statically, and null for every other module.
 *
 * @remarks
-*   A module of the application is a file under the project root and outside its `node_modules`. A
-*   virtual module's id is not an absolute path. The walk over the module's static importers ends
-*   at an entry, at `virtual:product` and at a module of an installed plugin's web package. A
-*   module it does not meet is one that only another `import()` loads, such as a page the
-*   application loads on demand, which keeps its own chunk.
-* @param id - The module's id, its absolute path for a file.
+*   The groups with a higher priority place a module first. A module of the application is a file
+*   under the project root and outside its `node_modules`. A virtual module's id is not an absolute
+*   path. The walk over the module's static importers ends at an entry, at `virtual:product` and at
+*   a module of an installed plugin's web package. A page that the application loads on demand is a
+*   module that only another `import()` loads. The walk does not meet such a module, and the module
+*   keeps its own chunk.
+* @param id - The module's id. A file's id is its absolute path.
 * @param chunking - The context rolldown passes a group's name function.
 * @param root - The project root.
 * @param packages - Each installed plugin's web package, by plugin id.
@@ -572,16 +585,17 @@ function dependencyChunkOf(id, chunking, root, packages) {
 }
 /**
 * Returns the configuration whose groups build each installed plugin's lazy modules into a chunk
-* of its own, and under a build every other module outside the application that the startup or a
-* plugin imports statically into the `dependencies` chunk.
+* of its own.
 *
 * @remarks
-*   Both groups read the web packages the composition found, and the dependencies' group reads the
-*   project root. Both are read when the bundler places a module, after the composition. A dev
-*   server takes no dependencies' group: `import()` of a lazy module resolves to the module's own
-*   exports there without it, and `vite-config` leaves out its library and shared groups there too,
-*   whose chunks would run components before the React refresh runtime is installed.
-* @param placing - The web packages and the project root, which each group reads when the bundler
+*   A build also builds every other module outside the application that the startup or a plugin
+*   imports statically into the `dependencies` chunk. Both groups read the web packages that the
+*   composition found, and the dependencies' group also reads the project root. The bundler calls
+*   both groups after the composition, when it places a module. A dev server has no dependencies'
+*   group, because `import()` of a lazy module resolves to the module's own exports there without
+*   it. `vite-config` leaves out its library and shared groups on a dev server too. Their chunks
+*   would run components before the React refresh runtime is installed.
+* @param placing - The web packages and the project root. Each group reads them when the bundler
 *   places a module.
 * @param command - The command Vite runs under, `build` or `serve`.
 */
@@ -599,15 +613,16 @@ function chunked(placing, command) {
 //#endregion
 //#region src/discover.ts
 /**
-* Finds each installed plugin's web package and contract package among the modules the product's
-* definition loaded.
+* Finds each installed plugin's web package and contract package among the modules that the
+* evaluation of the product's definition loaded.
 *
 * @remarks
-*   The definition imports every installed plugin's manifest, and each manifest names its contract,
-*   so the modules its evaluation loaded already contain both. A package is the one that contains
-*   the module defining the object, matched by identity. A manifest the definition builds itself,
-*   which no module exports, belongs to the definition module's package. No package is imported for
-*   the search alone, so no component package and no React is loaded in Node.
+*   The definition module imports the manifest of every installed plugin, and each manifest
+*   contains its contract. The modules of the evaluation therefore contain both. An object belongs
+*   to the package of the module that defines it, and the search matches objects by identity. No
+*   module exports a manifest that the definition module creates itself, so that manifest belongs
+*   to the package of the definition module. The search imports no package of its own, so Node does
+*   not load a component package or React.
 */
 /**
 * Returns true where a value is an object whose members can be read by name.
@@ -616,10 +631,11 @@ function isRecord(value) {
 	return typeof value === "object" && value !== null;
 }
 /**
-* Returns each installed plugin the definition states with a readable manifest and contract.
+* Returns each installed plugin of the definition that has a readable manifest and contract.
 *
 * @remarks
-*   A definition of another shape installs nothing here, and the resolver's shape check reports it.
+*   The function returns no plugin for a definition of another shape. The resolver's shape check
+*   reports that definition.
 * @param definition - The definition's default export.
 */
 function installationsOf(definition) {
@@ -640,9 +656,9 @@ function installationsOf(definition) {
 *
 * @remarks
 *   A module evaluates after every module it imports, and a module that re-exports an object
-*   imports the module that defines it. The first module that exports an object, in evaluation
-*   order, is therefore the one that defines it.
-* @param loaded - Every module the definition's evaluation loaded, in evaluation order.
+*   imports the module that defines it. The first module in evaluation order that exports an object
+*   is therefore the module that defines it.
+* @param loaded - Every module that the evaluation of the definition loaded, in evaluation order.
 */
 function ownersOf(loaded) {
 	const owners = /* @__PURE__ */ new Map();
@@ -653,13 +669,17 @@ function ownersOf(loaded) {
 	return owners;
 }
 /**
-* Returns the package at a directory, or undefined where its manifest states no name.
+* Returns the package at a directory, or undefined where its manifest has no name.
+*
+* @remarks
+*   The package's directory goes through `normalizePath`, so on Windows it has the forward slashes
+*   of a module id.
 */
 function packageIn(directory) {
 	const manifest = directory === void 0 ? void 0 : manifestAt(directory);
 	const name = manifest === void 0 ? void 0 : text(manifest, "name");
 	return directory === void 0 || name === void 0 ? void 0 : {
-		directory,
+		directory: normalizePath(directory),
 		name
 	};
 }
@@ -667,18 +687,21 @@ function packageIn(directory) {
 * Finds each installed plugin's web package and contract package.
 *
 * @remarks
-*   A web package outside the product's own package and its dependencies is left out, so the
-*   resolver reports the plugin. A contract package is recorded wherever it is, because the build
-*   reads it to leave the plugin's own catalogue out of the namespaces another package publishes.
+*   The function leaves out a web package outside the product's own package and its dependencies,
+*   so the resolver reports the plugin. It records a contract package wherever it is, because the
+*   build reads it to leave the plugin's own catalogue out of the namespaces of other packages. The
+*   function compares directories after `normalizePath`, because on Windows the module runner and
+*   `realpathSync` write them with different separators.
 * @param definition - The definition's default export.
-* @param loaded - Every module the definition's evaluation loaded, in evaluation order.
-* @param root - The product's directory, whose dependencies are walked.
-* @param file - The definition module, whose package a manifest the definition builds belongs to.
+* @param loaded - Every module that the evaluation of the definition loaded, in evaluation order.
+* @param root - The product's directory. The walk over its dependencies starts there.
+* @param file - The definition module. A manifest that the definition module creates belongs to the
+*   package of this module.
 */
 function discover(definition, loaded, root, file) {
 	const owners = ownersOf(loaded);
 	const own = owning(realpathSync(file));
-	const depended = /* @__PURE__ */ new Set([realpathSync(root), ...dependencies(root).map(({ at }) => at)]);
+	const depended = new Set([realpathSync(root), ...dependencies(root).map(({ at }) => at)].map((at) => normalizePath(at)));
 	const contracts = {};
 	const packages = {};
 	for (const { contract, manifest, pluginId } of installationsOf(definition)) {
@@ -1417,108 +1440,6 @@ function facadeOf(specifier, shape) {
 	].join("\n");
 }
 //#endregion
-//#region src/provided/pinned.ts
-/**
-* Returns a map from the id of each module of the first build to the name of its chunk.
-*
-* @remarks
-*   The modules of a static entry's chunk have no pin. The second chunk of one name in file name
-*   order takes the name with `-2` appended, and the third takes it with `-3` appended.
-* @param chunks - The chunks of the first build.
-*/
-function pinnedOf(chunks) {
-	const counts = /* @__PURE__ */ new Map();
-	const pinned = /* @__PURE__ */ new Map();
-	const ordered = chunks.filter(({ isEntry }) => !isEntry).toSorted((one, two) => one.fileName.localeCompare(two.fileName));
-	for (const { modules, name } of ordered) {
-		const count = (counts.get(name) ?? 0) + 1;
-		const pin = count === 1 ? name : `${name}-${String(count)}`;
-		counts.set(name, count);
-		for (const id of Object.keys(modules)) pinned.set(id, pin);
-	}
-	return pinned;
-}
-/**
-* Returns the code-splitting group that places each pinned module in the second build.
-*
-* @remarks
-*   A pinned chunk can import a chunk of the facades' code that imports it back. Rolldown defines a
-*   CommonJS module's wrapper at the top level of its chunk, and an ES module that imports it calls
-*   the wrapper at its own top level. In such a cycle a chunk can call a wrapper that is not
-*   defined yet. The group builds each pin's CommonJS modules into a chunk of their own. As long as
-*   those modules require only CommonJS modules, that chunk imports only rolldown's runtime and
-*   other such chunks. It then runs before every chunk that calls its wrappers.
-* @param pins - Returns a map from the id of each module of the first build to its chunk once the
-*   first build has run.
-*/
-function pinnedGroup(pins) {
-	return {
-		debugName: "pinned",
-		name: (id, chunking) => {
-			const pin = pins()?.get(id);
-			if (pin === void 0) return null;
-			return chunking.getModuleInfo(id)?.inputFormat === "cjs" ? `${pin}-cjs` : pin;
-		}
-	};
-}
-//#endregion
-//#region src/provided/first.ts
-/**
-* Runs a product's first build: the build's own configuration without the facades, written
-* nowhere, whose chunks the second build pins the product's modules to.
-*/
-/**
-* Name of the plugin that marks the first build, which leaves the facades out.
-*/
-const FIRST_BUILD = "stealth:provided-first";
-/**
-* Returns true where a configuration's plugins mark the first build.
-*
-* @param plugins - The resolved plugins of a build.
-*/
-function isFirstBuild(plugins) {
-	return plugins.some(({ name }) => name === FIRST_BUILD);
-}
-/**
-* Returns a plugin option with every nested list flattened into one list.
-*/
-function flattened(option) {
-	return Array.isArray(option) ? option.flatMap((one) => flattened(one)) : [option];
-}
-/**
-* Returns the plugins a caller passed inline, with the second build's own facade plugin left out.
-*/
-function inlinePlugins(plugins, own) {
-	return (plugins ?? []).flatMap((option) => flattened(option)).filter((one) => one !== own);
-}
-/**
-* Returns the chunks of the first build of the configuration a second build resolved.
-*
-* @remarks
-*   The first build reads the same configuration file and the same inline configuration, with the
-*   plugin that marks it, without watching and without writing. A facade plugin of the first build
-*   reads the mark and adds nothing, so the first build places each module as the product's build
-*   does without facades.
-* @param config - The second build's configuration file, inline configuration, mode and root.
-* @param own - The second build's facade plugin, which a caller may have passed inline.
-*/
-async function firstBuild(config, own) {
-	const { configFile, inlineConfig, mode, root } = config;
-	return [await build({
-		...inlineConfig,
-		build: {
-			...inlineConfig.build,
-			watch: null,
-			write: false
-		},
-		configFile: configFile ?? false,
-		logLevel: "silent",
-		mode,
-		plugins: [...inlinePlugins(inlineConfig.plugins, own), { name: FIRST_BUILD }],
-		root
-	})].flat().flatMap(({ output }) => output).filter((file) => file.type === "chunk");
-}
-//#endregion
 //#region src/provided/packages.ts
 /**
 * Lists the packages a page provides to the releases it loads, and the specifiers of each.
@@ -1666,6 +1587,235 @@ function importerOf(provided, specifier) {
 	return owner === void 0 ? void 0 : join(owner.from, "package.json");
 }
 //#endregion
+//#region src/provided/kept.ts
+/**
+* Makes a product's first build keep every export of each module of a provided package that the
+* build includes.
+*
+* @remarks
+*   A facade keeps every export of its specifier's module, so the second build keeps code that the
+*   first build removed from a module the product uses. A published package bundles its components
+*   into few modules, and the code that the first build removed imports modules that the first
+*   build left out. Those modules have no pin, so rolldown builds them into a chunk of their own.
+*   That chunk imports the pinned chunk that imports it. In such a cycle a module can read a
+*   binding of the other chunk before that chunk has run. The first build therefore appends to each
+*   module of a provided package a statement that passes the module's namespace to a global hook.
+*   The statement keeps every export of a module that the build includes, so the first build places
+*   the modules that those exports import. The statement adds no module to the build. The build
+*   leaves out a module whose exports nothing uses when its package has a `sideEffects` field.
+*/
+/**
+* The extensions of an ES module in any package.
+*/
+const MODULES = /* @__PURE__ */ new Set([".mjs", ".mts"]);
+/**
+* The extensions of an ES module in a package that states `"type": "module"`.
+*/
+const TYPED = /* @__PURE__ */ new Set([
+	".js",
+	".jsx",
+	".ts",
+	".tsx"
+]);
+/**
+* The key of the global function that the kept statement passes a module's namespace to. No page
+* defines the function, because no page loads the first build's output.
+*/
+const HOOK = "stealth.kept";
+/**
+* Returns the patterns of a package's files that have side effects, or undefined where the
+* manifest's `sideEffects` is neither false nor an array.
+*/
+function effectsOf(sideEffects) {
+	if (sideEffects === false) return [];
+	if (!Array.isArray(sideEffects)) return void 0;
+	return sideEffects.filter((pattern) => typeof pattern === "string");
+}
+/**
+* Returns the provided packages whose modules the first build keeps whole.
+*
+* @remarks
+*   Each is an installed package whose `sideEffects` is false or a list of patterns. Its directory
+*   goes through `normalizePath`, so on Windows it has the forward slashes of a module id.
+* @param packages - The packages the product provides.
+*/
+function keptPackages(packages) {
+	return packages.flatMap(({ from, name }) => {
+		const directory = packageAt(name, from);
+		const manifest = directory === void 0 ? void 0 : manifestAt(directory);
+		const effects = effectsOf(manifest?.["sideEffects"]);
+		return directory === void 0 || effects === void 0 ? [] : [{
+			directory: normalizePath(directory),
+			effects,
+			typed: manifest?.["type"] === "module"
+		}];
+	});
+}
+/**
+* Returns true where a pattern of a package's `sideEffects` list matches a file at a path relative
+* to the package.
+*
+* @remarks
+*   A pattern without a slash matches the file's name in any directory, as bundlers read the list.
+*/
+function affects(pattern, path) {
+	return matchesGlob(path, pattern.includes("/") ? pattern.replace(/^\.\//u, "") : `**/${pattern}`);
+}
+/**
+* Returns true for an ES module file of a kept package that no side-effect pattern of the package
+* matches. The first build keeps the exports of such a module whole.
+*
+* @remarks
+*   A file below a `node_modules` directory inside the package belongs to another package. The
+*   function compares the id after `normalizePath`, so an id with backslashes on Windows matches
+*   too.
+* @param id - The module's id.
+* @param packages - The packages whose modules the first build keeps whole.
+*/
+function isKept(id, packages) {
+	const file = normalizePath(id);
+	const owner = isAbsolute(file) ? packages.find(({ directory }) => file.startsWith(`${directory}/`)) : void 0;
+	if (owner === void 0) return false;
+	const path = file.slice(owner.directory.length + 1);
+	const extension = extname(file);
+	return (MODULES.has(extension) || owner.typed && TYPED.has(extension)) && !path.split("/").includes("node_modules") && !owner.effects.some((pattern) => affects(pattern, path));
+}
+/**
+* Returns a module's code with the statement that keeps its exports appended. The statement
+* imports the namespace of the module's own file and passes it to a global hook.
+*
+* @param code - The module's code.
+* @param id - The module's id, the absolute path of its file.
+*/
+function keptSourceOf(code, id) {
+	return [
+		code,
+		`import * as __stealthKept from ${quoted(`./${basename(id)}`)};`,
+		`globalThis[Symbol.for(${quoted(HOOK)})]?.(__stealthKept);`,
+		""
+	].join("\n");
+}
+//#endregion
+//#region src/provided/pinned.ts
+/**
+* Returns a map from the id of each module of the first build to the name of its chunk.
+*
+* @remarks
+*   The modules of a static entry's chunk have no pin. The second chunk of one name in file name
+*   order takes the name with `-2` appended, and the third takes it with `-3` appended.
+* @param chunks - The chunks of the first build.
+*/
+function pinnedOf(chunks) {
+	const counts = /* @__PURE__ */ new Map();
+	const pinned = /* @__PURE__ */ new Map();
+	const ordered = chunks.filter(({ isEntry }) => !isEntry).toSorted((one, two) => one.fileName.localeCompare(two.fileName));
+	for (const { modules, name } of ordered) {
+		const count = (counts.get(name) ?? 0) + 1;
+		const pin = count === 1 ? name : `${name}-${String(count)}`;
+		counts.set(name, count);
+		for (const id of Object.keys(modules)) pinned.set(id, pin);
+	}
+	return pinned;
+}
+/**
+* Returns the code-splitting group that places each pinned module in the second build.
+*
+* @remarks
+*   A pinned chunk can import a chunk of the facades' code that imports it back. Rolldown defines a
+*   CommonJS module's wrapper at the top level of its chunk, and an ES module that imports it calls
+*   the wrapper at its own top level. In such a cycle a chunk can call a wrapper that is not
+*   defined yet. The group builds each pin's CommonJS modules into a chunk of their own. As long as
+*   those modules require only CommonJS modules, that chunk imports only rolldown's runtime and
+*   other such chunks. It then runs before every chunk that calls its wrappers.
+* @param pins - Returns a map from the id of each module of the first build to its chunk once the
+*   first build has run.
+*/
+function pinnedGroup(pins) {
+	return {
+		debugName: "pinned",
+		name: (id, chunking) => {
+			const pin = pins()?.get(id);
+			if (pin === void 0) return null;
+			return chunking.getModuleInfo(id)?.inputFormat === "cjs" ? `${pin}-cjs` : pin;
+		}
+	};
+}
+//#endregion
+//#region src/provided/first.ts
+/**
+* Runs a product's first build: the build's own configuration without the facades, written
+* nowhere, whose chunks the second build pins the product's modules to.
+*/
+/**
+* Name of the plugin that marks the first build, which leaves the facades out.
+*/
+const FIRST_BUILD = "stealth:provided-first";
+/**
+* Returns true where a configuration's plugins mark the first build.
+*
+* @param plugins - The resolved plugins of a build.
+*/
+function isFirstBuild(plugins) {
+	return plugins.some(({ name }) => name === FIRST_BUILD);
+}
+/**
+* Returns a plugin option with every nested list flattened into one list.
+*/
+function flattened(option) {
+	return Array.isArray(option) ? option.flatMap((one) => flattened(one)) : [option];
+}
+/**
+* Returns the plugins a caller passed inline, with the second build's own facade plugin left out.
+*/
+function inlinePlugins(plugins, own) {
+	return (plugins ?? []).flatMap((option) => flattened(option)).filter((one) => one !== own);
+}
+/**
+* Returns the plugin that marks the first build and keeps every export of each module of a kept
+* package.
+*/
+function markOf(kept) {
+	return {
+		name: FIRST_BUILD,
+		/**
+		* Appends the statement that keeps every export to each module of a kept package, and leaves
+		* every other module alone.
+		*/
+		transform(code, id) {
+			return isKept(id, kept) ? keptSourceOf(code, id) : null;
+		}
+	};
+}
+/**
+* Returns the chunks of the first build of the configuration a second build resolved.
+*
+* @remarks
+*   The first build reads the same configuration file and the same inline configuration, with the
+*   plugin that marks it, without watching and without writing. A facade plugin of the first build
+*   reads the mark and adds nothing. The plugin that marks the build keeps every export of each
+*   module of a kept package that the build includes, as the facades make the second build keep
+*   them. The first build therefore also places the modules that those exports import.
+* @param config - The second build's configuration file, inline configuration, mode and root.
+* @param own - The second build's facade plugin, which a caller may have passed inline.
+* @param kept - The provided packages whose modules the first build keeps whole.
+*/
+async function firstBuild(config, own, kept) {
+	const { configFile, inlineConfig, mode, root } = config;
+	return [await build({
+		...inlineConfig,
+		build: {
+			...inlineConfig.build,
+			watch: null,
+			write: false
+		},
+		configFile: configFile ?? false,
+		logLevel: "silent",
+		mode,
+		plugins: [...inlinePlugins(inlineConfig.plugins, own), markOf(kept)],
+		root
+	})].flat().flatMap(({ output }) => output).filter((file) => file.type === "chunk");
+}
+//#endregion
 //#region src/provided/manifest.ts
 /**
 * Returns the paths of some chunks and of every chunk that they import statically. The given
@@ -1803,9 +1953,12 @@ async function facadeSourceOf(context, packages, id) {
 * Creates the plugin that provides the product's shared modules to the releases its page loads.
 *
 * @remarks
-*   The client build first runs a build of the same configuration without the facades. It then
-*   builds each module of that first build into the chunk of the same name, and each CommonJS
-*   module into a chunk beside it. It emits each facade as an entry chunk that keeps its exports.
+*   The client build first runs a build of the same configuration without the facades. The first
+*   build keeps every export of each module of a provided package that it includes, as the facades
+*   make the client build keep them. A package qualifies where it states which of its files have
+*   side effects. The client build then builds each module of the first build into the chunk of the
+*   same name, and each CommonJS module into a chunk beside it. It emits each facade as an entry
+*   chunk that keeps its exports.
 *   A facade imports its specifier, and the plugin resolves the specifier from the package that
 *   depends on it, so the facade and the product share one module. Rolldown builds the code that
 *   only the facades need into chunks that only the facades import. The plugin writes
@@ -1830,7 +1983,7 @@ function provided() {
 		async buildStart() {
 			if (state.first || this.environment.config.consumer !== "client") return;
 			state.language = languageOf(state.api);
-			state.pinned = pinnedOf(await firstBuild(this.environment.config, plugin));
+			state.pinned = pinnedOf(await firstBuild(this.environment.config, plugin, keptPackages(state.packages)));
 			for (const facade of facadesOf(state.packages)) this.emitFile(facade);
 		},
 		/**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stealthscale/vite-plugin-product",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Composes a product from its plugins while it builds: checks every plugin against the others, resolves the product, and serves it as virtual:product.",
   "keywords": [
     "plugins",
@@ -43,8 +43,8 @@
     "@stealthscale/testing-config": "^0.6.0",
     "@stealthscale/vite-config": "^0.8.0",
     "@stealthscale/vite-config-typescript": "^0.3.0",
-    "@stealthscale/vite-plugin-base": "^0.4.0",
-    "@stealthscale/vite-plugin-i18n": "^0.3.1",
+    "@stealthscale/vite-plugin-base": "^0.5.1",
+    "@stealthscale/vite-plugin-i18n": "^0.4.0",
     "@types/node": "^26.6",
     "@vitest/coverage-v8": "5.0.3",
     "publint": "^0.3",
@@ -54,8 +54,8 @@
   },
   "peerDependencies": {
     "@stealthscale/sdk-core": "^0.3.0",
-    "@stealthscale/vite-plugin-base": "^0.4.0",
-    "@stealthscale/vite-plugin-i18n": "^0.3.1",
+    "@stealthscale/vite-plugin-base": "^0.5.1",
+    "@stealthscale/vite-plugin-i18n": "^0.4.0",
     "vite": "^8.3"
   },
   "engines": {