npm - @transclude/core - Versions diffs - 0.1.1 → 0.3.0 - Mend

@transclude/core 0.1.1 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (38) hide show

package/LICENSE +1 -1
package/README.md +65 -14
package/bin/build.js +22 -4
package/bin/check.js +30 -8
package/bin/dev.js +10 -2
package/bin/release.js +19 -4
package/package.json +13 -4
package/skills/transclude/SKILL.md +219 -0
package/skills/transclude/references/elements.md +206 -0
package/skills/transclude/references/fragments.md +168 -0
package/skills/transclude/references/server.md +155 -0
package/src/address.js +9 -2
package/src/app.js +110 -81
package/src/compiler/ambient.js +99 -0
package/src/compiler/bind.js +34 -27
package/src/compiler/codegen.js +59 -35
package/src/compiler/directives.js +29 -0
package/src/compiler/expr.js +10 -1
package/src/compiler/html.js +41 -0
package/src/compiler/index.js +63 -11
package/src/compiler/script.js +40 -11
package/src/compiler/shim.js +24 -45
package/src/compiler/types.js +32 -5
package/src/csp.js +7 -1
package/src/document.js +63 -12
package/src/extract.js +9 -8
package/src/negotiate.js +1 -1
package/src/plugin.js +28 -7
package/src/precache.js +11 -1
package/src/project.js +29 -1
package/src/proxy.js +9 -1
package/src/rewrite.js +12 -5
package/src/routes.js +1 -1
package/src/runtime/index.js +12 -9
package/src/server.js +2 -2
package/src/sitemap.js +3 -3
package/src/static-cache.js +6 -3
package/src/typecheck.js +105 -11

package/src/compiler/codegen.js CHANGED Viewed

@@ -9,14 +9,10 @@
 import { Scope, collectRefs, emit, parseExpr } from './expr.js';
 import { splitInterpolations } from './interp.js';
+import { parseEach as readEach } from './directives.js';
+import { escapeAttr, escapeText, RAW_TEXT, VOID } from './html.js';
-const VOID = new Set([
-  'area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input',
-  'link', 'meta', 'param', 'source', 'track', 'wbr',
-]);
-// Content is not entity-decoded by the parser and must not be escaped by us.
-const RAW_TEXT = new Set(['script', 'style']);
 // Hoisted out of a page body into <head>.
 const HEAD_TAGS = new Set(['title', 'meta', 'link', 'base']);
@@ -39,6 +35,28 @@ export class CompileError extends Error {
   }
 }
+/**
+ * An attribute name is emitted exactly as written, so `${…}` in one reaches the
+ * page as those characters rather than as a value. Nothing downstream reads it,
+ * which made this the one interpolation mistake that rendered instead of
+ * failing. A spread parses as an attribute name too, and is caught here.
+ *
+ * @param {object} el
+ * @throws {CompileError} when a name holds an interpolation
+ */
+function assertStaticAttrNames(el) {
+  for (const attr of el.attrs ?? []) {
+    if (!attr.name.includes('${')) continue;
+    throw new CompileError(
+      `<${el.tagName}> interpolates an attribute name: "${attr.name}". ` +
+        `Only a value takes \${…}, so write the name out. To choose between two, ` +
+        `put the condition in the value: class="\${cond ? 'a' : 'b'}".`,
+      el,
+    );
+  }
+}
 /**
  * @param {object[]} nodes
  * @param {object} [opts]
@@ -46,14 +64,17 @@ export class CompileError extends Error {
  */
 export function compileFragment(nodes, opts = {}) {
   const gen = new Codegen(opts);
-  gen.emitChildren(nodes, gen.body, gen.rootScope, true);
+  gen.emitChildren(nodes, gen.body, gen.rootScope, { topLevel: true });
   // `<html>` is read separately, because the fragment parser drops it: a nested
   // html start tag is not something that can appear in a body, so parse5 throws
   // it away attributes and all. `splitBlocks` reads it in document mode, where
   // it is the element it names.
+  // `<body>` is read the same way, for the same reason.
   const htmlNode = opts.html ?? null;
-  const htmlAttrs = htmlNode?.attrs?.length ? gen.htmlAttrsJs(htmlNode, gen.rootScope) : null;
+  const bodyNode = opts.body ?? null;
+  const htmlAttrs = htmlNode?.attrs?.length ? gen.openTagAttrsJs(htmlNode, gen.rootScope) : null;
+  const bodyAttrs = bodyNode?.attrs?.length ? gen.openTagAttrsJs(bodyNode, gen.rootScope) : null;
   const body = joinOut(gen.body);
   const head = joinOut(gen.head);
@@ -86,6 +107,7 @@ export function compileFragment(nodes, opts = {}) {
     title: title.code,
     hasTitle: gen.title.length > 0,
     htmlAttrs,
+    bodyAttrs,
     warnings: gen.warnings,
     reads: gen.reads,
     components: [...gen.used.entries()].map(([tag, ref]) => ({ tag, ref })),
@@ -230,7 +252,7 @@ class Codegen {
   // ---- traversal ----------------------------------------------------------
-  emitChildren(nodes, out, scope, topLevel = false) {
+  emitChildren(nodes, out, scope, { topLevel = false } = {}) {
     let i = 0;
     while (i < nodes.length) {
       const node = nodes[i];
@@ -242,7 +264,7 @@ class Codegen {
         if (slot) {
           const target = this.slots.get(slot) ?? [];
           this.slots.set(slot, target);
-          this.emitChildren(childrenOf(node), target, scope, false);
+          this.emitChildren(childrenOf(node), target, scope);
           i++;
           continue;
         }
@@ -336,7 +358,7 @@ class Codegen {
   emitNodeAt(node, out, scope, topLevel) {
     if (node.nodeName === '#text') {
-      this.emitText(node.value ?? '', out, scope, node, false);
+      this.emitText(node.value ?? '', out, scope, node);
       return;
     }
     // Authoring comments are stripped. They still count as "insignificant" when
@@ -553,6 +575,7 @@ class Codegen {
   }
   emitElement(el, out, scope, topLevel) {
+    assertStaticAttrNames(el);
     const tag = el.tagName;
     // In a layout, <slot> is where the child's content goes. In a component it
@@ -568,14 +591,14 @@ class Codegen {
         return;
       }
       this.c(out, `if (${filled}) { __o += ${filled}; } else {`);
-      this.emitChildren(fallback, out, scope, false);
+      this.emitChildren(fallback, out, scope);
       this.c(out, `}`);
       return;
     }
     // A <template> carrying a directive is structural: consumed, children emitted.
     if (tag === 'template' && directivesOf(el).size > 0) {
-      this.emitChildren(childrenOf(el), out, scope, false);
+      this.emitChildren(childrenOf(el), out, scope);
       return;
     }
@@ -605,11 +628,11 @@ class Codegen {
       for (const child of childrenOf(el)) {
         if (child.nodeName === '#text') {
           assertRawTextSafe(tag, child.value ?? '', el);
-          this.emitText(child.value ?? '', target, scope, child, true);
+          this.emitText(child.value ?? '', target, scope, child, { raw: true });
         }
       }
     } else {
-      this.emitChildren(childrenOf(el), target, scope, false);
+      this.emitChildren(childrenOf(el), target, scope);
     }
     this.s(target, `</${tag}>`);
@@ -632,7 +655,7 @@ class Codegen {
     this.c(out, `__o += __sh(${ref}, {${props}}${this.fragments ? ', __fragment' : ''});`);
     // Light DOM children fill <slot>.
-    this.emitChildren(childrenOf(el), out, scope, false);
+    this.emitChildren(childrenOf(el), out, scope);
     this.s(out, `</${tag}>`);
   }
@@ -750,7 +773,7 @@ class Codegen {
     const uid = ++this.uid;
     if (children.length) {
       this.c(out, `const __fb${uid} = (() => { let __o = '';`);
-      this.emitChildren(children, out, scope, false);
+      this.emitChildren(children, out, scope);
       this.c(out, `return __o; })();`);
     }
@@ -772,7 +795,7 @@ class Codegen {
     const children = childrenOf(el);
     if (children.length) {
       this.c(out, `const __sl${id} = (() => { let __o = '';`);
-      this.emitChildren(children, out, scope, false);
+      this.emitChildren(children, out, scope);
       this.c(out, `return __o; })();`);
     }
@@ -824,14 +847,18 @@ class Codegen {
   }
   /**
-   * `<html lang="en" data-theme="${theme}">` as `{ "lang": "en", "data-theme": theme }`.
+   * `<html lang="en" data-theme="${theme}">` as `{ "lang": "en", "data-theme": theme }`,
+   * and the same for `<body>`.
    *
    * An object rather than serialized markup, because the chain merges these by
    * name: a root layout setting the theme and a page setting `dir` must both
    * survive, and two `data-theme` attributes in one tag would leave the parser
    * taking the first, which is the outermost. `renderDocument` serializes.
    */
-  htmlAttrsJs(el, scope) {
+  openTagAttrsJs(el, scope) {
+    // `<html>` and `<body>` are read by a second parse, so neither reaches
+    // emitElement and neither is checked by it.
+    assertStaticAttrNames(el);
     const pairs = el.attrs
       .filter((attr) => !DIRECTIVES.has(attr.name))
       .map((attr) => {
@@ -858,7 +885,7 @@ class Codegen {
       .join(' + ');
   }
-  emitText(value, out, scope, node, raw) {
+  emitText(value, out, scope, node, { raw = false } = {}) {
     const start = node?.sourceCodeLocation?.startLine ?? this.at;
     let line = start;
@@ -918,7 +945,9 @@ function assertRawTextSafe(tag, text, el) {
 function isJsonCall(source) {
   try {
     const node = parseExpr(source);
-    return node.type === 'CallExpression' && node.callee?.type === 'Identifier' && node.callee.name === 'json';
+    if (node.type !== 'CallExpression') return false;
+    if (node.callee?.type !== 'Identifier') return false;
+    return node.callee.name === 'json';
   } catch {
     return false;
   }
@@ -933,7 +962,7 @@ export const ANCHOR_CLOSE = '<!--]-->';
  *
  * @param {object[]} nodes
  * @param {number} i where the `if` is
- * @returns {{ chain: Array<{ node: object, kind: string, cond?: string }>, next: number }|null}
+ * @returns {{ chain: Array<{ node: object, kind: string, cond: string|null }>, next: number }|null}
  *   null when the element carries no `if`, so there is no chain to gather
  */
 export function gatherChain(nodes, i) {
@@ -952,7 +981,10 @@ export function gatherChain(nodes, i) {
       continue;
     }
     if (d?.has('else')) {
-      chain.push({ node: nodes[k], kind: 'else' });
+      // `cond: null` rather than absent, so every entry in the chain is one
+      // shape. `emitBranches` reads `kind` to decide, and never reads the
+      // condition of an `else`.
+      chain.push({ node: nodes[k], kind: 'else', cond: null });
       next = k + 1;
     }
     break;
@@ -995,14 +1027,14 @@ function nextSignificant(nodes, from) {
 function parseEach(value, node) {
-  const m = /^\s*([A-Za-z_$][\w$]*)\s*(?:,\s*([A-Za-z_$][\w$]*)\s*)?\s+of\s+([\s\S]+?)\s*$/.exec(value);
-  if (!m) {
+  const spec = readEach(value);
+  if (!spec) {
     throw new CompileError(
       `each="${value}" is malformed. Expected each="item of list" or each="item, index of list"`,
       node,
     );
   }
-  return { item: m[1], index: m[2] || null, list: m[3] };
+  return spec;
 }
 // ---- output ---------------------------------------------------------------
@@ -1051,11 +1083,3 @@ function joinOut(entries) {
   return { code: lines.join('\n'), at };
 }
-// parse5 hands us decoded text, so static output has to be re-encoded.
-function escapeText(value) {
-  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-}
-function escapeAttr(value) {
-  return value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');
-}

package/src/compiler/directives.js ADDED Viewed

@@ -0,0 +1,29 @@
+// What a directive value means. One answer, because three files ask.
+//
+// `each` was parsed by the same regular expression written out in bind.js,
+// codegen.js and shim.js. Three copies of one rule is three places to change and
+// two to forget, and the three do different things with the answer: one emits a
+// loop, one emits a binding, one emits the JS tsc checks. They agreed by luck.
+/**
+ * `item of items`, or `item, i of items`.
+ *
+ * The value is an expression, not an interpolation: there is no `${}` in it. A
+ * parser that treated it as one would read the whole thing as text and get the
+ * volatile set wrong, which is a silent bug rather than a loud one.
+ */
+const EACH = /^\s*([A-Za-z_$][\w$]*)\s*(?:,\s*([A-Za-z_$][\w$]*)\s*)?\s+of\s+([\s\S]+?)\s*$/;
+/**
+ * The three parts of an `each`, or null when it does not parse.
+ *
+ * @param {string} value the attribute as written
+ * @returns {{ item: string, index: string|null, list: string }|null}
+ */
+export function parseEach(value) {
+  const found = EACH.exec(value ?? '');
+  if (!found) return null;
+  const [, item, index, list] = found;
+  return { item, index: index ?? null, list };
+}

package/src/compiler/expr.js CHANGED Viewed

@@ -175,6 +175,14 @@ export function chainOf(node, scope, computed = []) {
   return null;
 }
+/**
+ * Every jsep node key that can hold another node. Anything else on a node is a
+ * name, a value or a flag, and walking into one finds nothing.
+ */
+const CHILD_KEYS = [
+  'argument', 'left', 'right', 'test', 'consequent', 'alternate', 'object', 'property',
+];
 /**
  * Every data or loop-variable path an expression reads.
  *
@@ -212,9 +220,10 @@ export function collectRefs(node, scope, out = []) {
       return out;
     default:
-      for (const key of ['argument', 'left', 'right', 'test', 'consequent', 'alternate', 'object', 'property']) {
+      for (const key of CHILD_KEYS) {
         if (node[key]) collectRefs(node[key], scope, out);
       }
       for (const element of node.elements ?? []) collectRefs(element, scope, out);
       return out;
   }

package/src/compiler/html.js ADDED Viewed

@@ -0,0 +1,41 @@
+// Facts about HTML that both compiler passes need.
+//
+// These are the spec's, not this codebase's, so they belong in one place and
+// never change for a reason either pass would know about. Both lists were
+// written out twice, in codegen.js and bind.js, and agreed by luck.
+/** Elements with no closing tag and no children. */
+export const VOID = new Set([
+  'area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input',
+  'link', 'meta', 'param', 'source', 'track', 'wbr',
+]);
+/**
+ * Elements whose text is not entity-decoded by the parser, so escaping it would
+ * change what the browser reads. `&amp;` is one character in prose and five in
+ * JavaScript.
+ */
+export const RAW_TEXT = new Set(['script', 'style']);
+/** parse5 hands back decoded text, so static output has to be re-encoded. */
+export function escapeText(value) {
+  return value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+/**
+ * A static attribute value.
+ *
+ * Three characters, and `>` is deliberately not one of them: a quoted attribute
+ * value may hold one, and leaving it is what a serializer does. That has a
+ * consequence worth knowing, because `content="a > b"` then reaches the page
+ * with a bare `>` in it, and anything scanning compiled markup for the end of a
+ * tag has to be quote-aware rather than stopping at the first one. `mergeHead`
+ * in document.js is that scanner, and it had this wrong once.
+ *
+ * The runtime escapes `>` as well, so an interpolated value and a static one
+ * come out spelled differently and parse the same. That is not worth making
+ * agree: the runtime ships to a browser and must not import from here.
+ */
+export function escapeAttr(value) {
+  return value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');
+}

package/src/compiler/index.js CHANGED Viewed

@@ -2,6 +2,7 @@
 import { parse, parseFragment } from 'parse5';
 import { compileFragment, childrenOf, CompileError } from './codegen.js';
+import { escapeAttr } from './html.js';
 import { lineMap, sourceMap } from './sourcemap.js';
 import { compileBindings } from './bind.js';
 import {
@@ -15,7 +16,14 @@ import {
 export { CompileError, ScriptError };
-const PAGE_EXPORTS = new Set(['css', 'load', 'render', 'renderHead', 'renderTitle', 'renderHtmlAttrs', 'layouts', 'client', 'elements', 'headScript']);
+// Everything the generated page and layout modules define at the top level. A
+// block naming one of these is checked whether it exports it or merely declares
+// it, because both land in the same scope.
+const PAGE_EXPORTS = new Set([
+  'css', 'load', 'render', 'renderHead', 'renderTitle', 'renderHtmlAttrs',
+  'layouts', 'client', 'elements', 'headScript', 'hasTitle', 'includes',
+  'renderBodyAttrs',
+]);
 const COMPONENT_EXPORTS = new Set([
   'tag', 'light', 'css', 'elements', 'propDefs', 'propAttrs', 'stateDefs', 'members', 'render',
   'coerce', 'def', 'init', 'define', 'default', 'bind', 'update', 'volatile', 'formAssociated',
@@ -107,10 +115,17 @@ export function splitBlocks(source) {
   // away with its attributes. In document mode it is the element it names, and a
   // `<html>` inside a script block or a comment is still not one, because this
   // is the real parser rather than a search for a string.
-  const html =
-    parse(source, { sourceCodeLocationInfo: true }).childNodes.find((n) => n.nodeName === 'html') ??
-    null;
-  const out = { server: null, properties: null, state: null, client: [], head: [], styles: [], nodes: [], html };
+  const document = parse(source, { sourceCodeLocationInfo: true });
+  const html = document.childNodes.find((n) => n.nodeName === 'html') ?? null;
+  // `<body>` is dropped by the fragment parser for the same reason `<html>` is,
+  // and was silently going missing: writing `<body class="admin">` in a page
+  // produced no attribute and no error. In document mode it is a real element.
+  // parse5's ChildNode union does not carry `childNodes`; in document mode this
+  // one is the html element and does.
+  const parent = /** @type {{ childNodes?: Array<{ nodeName: string }> }|null} */ (html);
+  const body = parent?.childNodes?.find((n) => n.nodeName === 'body') ?? null;
+  const out = { server: null, properties: null, state: null, client: [], head: [], styles: [], nodes: [], html, body };
   for (const node of doc.childNodes) {
     if (node.nodeName === 'script') {
@@ -141,6 +156,12 @@ export function splitBlocks(source) {
       // before first paint, or a `pagereveal` listener, which fires too early for
       // any script in the body to see.
       else if (attrs.has('head')) out.head.push({ ...block, attrs: node.attrs ?? [] });
+      // A `src` means there is no code here to compile, so this is markup: an
+      // ordinary external script the page wants in its body. Read as a client
+      // block it became an empty one and the tag was dropped, `src` and all,
+      // with nothing said. A nested `<script src>` was always markup; only a
+      // top-level one went missing.
+      else if (attrs.has('src')) out.nodes.push(node);
       else out.client.push(block);
       continue;
     }
@@ -355,6 +376,21 @@ const MARK = {
   title: '/*@transclude:title*/',
 };
+/**
+ * A page: the `<script server>` block, the markup, and whatever layouts wrap it.
+ *
+ * `filename` is what an error message says, which is the short route id.
+ * `sourcePath` is what the source map names, which is a path an editor opens.
+ *
+ * @param {string} source
+ * @param {{ components?: Map<string, string>, shadowTags?: Set<string>,
+ *   runtime: string, filename?: string, sourcePath?: string|null,
+ *   layouts?: string[],
+ *   client?: { tags: string[], hasScript: boolean, needed: boolean } }} options
+ * @returns {{ code: string, map: object|null, warnings: string[],
+ *   components: string[] }} the module, a line-level map or null when there is
+ *   no markup to map, whatever the template warned about, and the tags it used
+ */
 export function compilePage(
   source,
   {
@@ -375,11 +411,18 @@ export function compilePage(
   const server = blocks.server
     ? bindDefaultExport(blocks.server, '__load', where)
-    : { code: 'const __load = null;', exports: [], imports: [], defaultNode: null };
+    : { code: 'const __load = null;', exports: [], imports: [], declared: [], defaultNode: null };
   assertNoCollisions(server.exports, PAGE_EXPORTS, where);
+  assertNoCollisions(server.declared ?? [], PAGE_EXPORTS, where, 'declares');
   assertNoActionsObject(server.exports, where);
-  const template = compileFragment(blocks.nodes, { components, shadowTags, page: true, html: blocks.html });
+  const template = compileFragment(blocks.nodes, {
+    components,
+    shadowTags,
+    page: true,
+    html: blocks.html,
+    body: blocks.body,
+  });
   assertIncludesResolve(template.regionIncludes, template.regions);
   const code = `
@@ -413,6 +456,10 @@ export function renderHtmlAttrs(__d) {
   return ${template.htmlAttrs ?? '{}'};
 }
+export function renderBodyAttrs(__d) {
+  return ${template.bodyAttrs ?? '{}'};
+}
 export function renderHead(__d) {
   let __o = '';
 ${MARK.head}
@@ -485,8 +532,9 @@ export function compileLayout(source, { id, components = new Map(), shadowTags =
   const server = blocks.server
     ? bindDefaultExport(blocks.server, '__load', where)
-    : { code: 'const __load = null;', exports: [], imports: [], defaultNode: null };
+    : { code: 'const __load = null;', exports: [], imports: [], declared: [], defaultNode: null };
   assertNoCollisions(server.exports, PAGE_EXPORTS, where);
+  assertNoCollisions(server.declared ?? [], PAGE_EXPORTS, where, 'declares');
   assertNoActionsObject(server.exports, where);
   const template = compileFragment(blocks.nodes, {
@@ -495,6 +543,7 @@ export function compileLayout(source, { id, components = new Map(), shadowTags =
     page: true,
     layout: true,
     html: blocks.html,
+    body: blocks.body,
   });
   const warnings = [...template.warnings];
@@ -527,6 +576,10 @@ export function renderHtmlAttrs(__d) {
   return ${template.htmlAttrs ?? '{}'};
 }
+export function renderBodyAttrs(__d) {
+  return ${template.bodyAttrs ?? '{}'};
+}
 export function renderHead(__d) {
   let __o = '';
 ${indent(template.head)}
@@ -539,7 +592,7 @@ ${slotBodies(template)}
   return __out;
 }
-export default { css, headScript, elements, hasTitle, load, renderTitle, renderHead, renderHtmlAttrs, render };
+export default { css, headScript, elements, hasTitle, load, renderTitle, renderHead, renderHtmlAttrs, renderBodyAttrs, render };
 `;
   return { code, warnings, components: template.components.map((c) => c.tag) };
@@ -844,8 +897,7 @@ function headScript(blocks, where) {
 /** A static attribute, escaped the way an HTML serializer must. */
 function serializeAttr({ name, value }) {
   if (value === '') return ` ${name}`;
-  const escaped = value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/"/g, '&quot;');
-  return ` ${name}="${escaped}"`;
+  return ` ${name}="${escapeAttr(value)}"`;
 }
 function elementsExport(used) {

package/src/compiler/script.js CHANGED Viewed

@@ -34,7 +34,7 @@ const PARSE_OPTIONS = {
  * @param {{ flags?: string[] }} [options]
  * @returns {{ code: string, exports: string[],
  *   imports: Array<{ source: string, specifiers: string }>,
- *   defaultNode: object|null, flags: object }}
+ *   declared: string[], defaultNode: object|null, flags: object }}
  */
 export function bindDefaultExport(block, name, label, { flags = [] } = {}) {
   const { code: source, line = 1 } = block;
@@ -56,9 +56,10 @@ export function bindDefaultExport(block, name, label, { flags = [] } = {}) {
   const node = ast.body.find((s) => s.type === 'ExportDefaultDeclaration') ?? null;
   const exports = namedExportsOf(ast, source, line, label).filter((n) => !flags.includes(n));
   const imports = importsOf(ast);
+  const declared = topLevelNames(ast);
   if (!node) {
-    return { code: `${code}\nconst ${name} = null;`, exports, imports, defaultNode: null, flags: found };
+    return { code: `${code}\nconst ${name} = null;`, exports, imports, declared, defaultNode: null, flags: found };
   }
   // Slicing the *declaration* rather than the statement means
@@ -71,7 +72,7 @@ export function bindDefaultExport(block, name, label, { flags = [] } = {}) {
     ';' +
     code.slice(node.end);
-  return { code: rewritten, exports, imports, defaultNode: node.declaration, flags: found };
+  return { code: rewritten, exports, imports, declared, defaultNode: node.declaration, flags: found };
 }
 /**
@@ -368,6 +369,9 @@ function scopedNames(statements) {
   return (statements ?? []).flatMap(declaredNames);
 }
+/** Keys acorn puts on every node. They hold positions, never child nodes. */
+const NODE_BOOKKEEPING = new Set(['type', 'start', 'end', 'loc', 'range']);
 /**
  * Identifiers a subtree reads from outside itself.
  *
@@ -405,8 +409,12 @@ function freeNames(node, bound, out) {
     case 'ArrowFunctionExpression': {
       const inner = new Set(bound);
       if (node.id) inner.add(node.id.name);
-      for (const param of node.params) for (const name of patternNames(param)) inner.add(name);
-      if (node.body.type === 'BlockStatement') for (const name of scopedNames(node.body.body)) inner.add(name);
+      for (const param of node.params) {
+        for (const name of patternNames(param)) inner.add(name);
+      }
+      if (node.body.type === 'BlockStatement') {
+        for (const name of scopedNames(node.body.body)) inner.add(name);
+      }
       // A default is evaluated in the function's own scope, so it sees the params.
       for (const param of node.params) freeNames(param, inner, out);
       freeNames(node.body, inner, out);
@@ -462,7 +470,7 @@ function freeNames(node, bound, out) {
     default:
       for (const key of Object.keys(node)) {
-        if (key === 'type' || key === 'start' || key === 'end' || key === 'loc' || key === 'range') continue;
+        if (NODE_BOOKKEEPING.has(key)) continue;
         freeNames(node[key], bound, out);
       }
       return out;
@@ -506,19 +514,20 @@ function importsOf(ast) {
 }
 /**
- * Guards against a block exporting a name the generated module already uses.
+ * Guards against a block using a name the generated module already defines.
  *
- * @param {string[]} exports
+ * @param {string[]} names
  * @param {Set<string>} reserved
  * @param {string} label
+ * @param {string} [verb] how the block used it, for the message
  * @returns {void}
  * @throws naming the first collision
  */
-export function assertNoCollisions(exports, reserved, label) {
-  for (const name of exports) {
+export function assertNoCollisions(names, reserved, label, verb = 'exports') {
+  for (const name of names) {
     if (reserved.has(name)) {
       throw new ScriptError(
-        `${label}: exports "${name}", which the generated module already defines. ` +
+        `${label}: ${verb} "${name}", which the generated module already defines. ` +
           `Reserved: ${[...reserved].join(', ')}.`,
       );
     }
@@ -586,6 +595,26 @@ function namedExportsOf(ast, code, lineOffset, label) {
   return names;
 }
+/**
+ * Every name a block binds at the top level, imports included.
+ *
+ * The generated module puts this block's code beside its own `export const`
+ * statements, so any of these can collide, not only the exported ones. An
+ * import was the case that got through: `import { elements } from './x.js'`
+ * binds `elements` and exports nothing, so the export check never saw it and
+ * the build failed inside rolldown, pointing at a virtual module.
+ *
+ * @param {object} ast
+ * @returns {string[]}
+ */
+function topLevelNames(ast) {
+  return ast.body.flatMap((statement) =>
+    statement.type === 'ImportDeclaration'
+      ? statement.specifiers.map((spec) => spec.local.name)
+      : declaredNames(statement),
+  );
+}
 function patternNames(node) {
   switch (node.type) {
     case 'Identifier':