@vzn/vx 0.0.18 → 0.0.22

package/src/workspace/config-imports.ts

@@ -19,17 +19,125 @@
 //   - RELATIVE specifiers only. A bare specifier is a package; it moves when
 //     the lockfile moves, which the workspace fingerprint already covers.
 //   - Descend only through files owned by NO project. A config reaching into
-//     another project (this repo's `apps/docs/vx.config.ts` imports
-//     `../../src/index.ts`) records that edge and STOPS there — following it
-//     would drag substantially all of core `src/` into the closure, and the
-//     containment channel already selects the project that owns it.
+//     another project (say a site's `vx.config.ts` importing
+//     `../core/src/index.ts`) records that edge and STOPS there — following
+//     it would drag substantially all of that project's `src/` into the
+//     closure, and the containment channel already selects the project that
+//     owns it.
 
+import { existsSync } from 'node:fs'
 import { realpath } from 'node:fs/promises'
+import { builtinModules } from 'node:module'
 import path from 'node:path'
 import type { ProjectMeta } from './workspace.js'
 
+const BUILTINS = new Set(builtinModules)
+
+/**
+ * One transpiler per loader, made on first use: constructing one costs
+ * 42 µs against 12 µs for the scan itself (measured 2026-09-16), and a
+ * fresh one per config put 1000 cold evaluations 130 ms behind.
+ */
+const transpilers: Partial<Record<'ts' | 'js', Bun.Transpiler>> = {}
+function scanner(loader: 'ts' | 'js'): Bun.Transpiler {
+  return (transpilers[loader] ??= new Bun.Transpiler({ loader }))
+}
+
+/**
+ * Whether Bun's own parser finds an ESM `export` in `source` — the one
+ * syntax that makes Bun evaluate a file as a module whatever else it says.
+ * Without one, a file that touches `module`, `exports`, `require`, `this`
+ * or `__dirname` at the top level is CommonJS to Bun. False on source the
+ * parser refuses: the evaluation names that error.
+ */
+export function hasEsmExport(source: string, loader: 'ts' | 'js'): boolean {
+  try {
+    return scanner(loader).scan(source).exports.length > 0
+  } catch {
+    return false
+  }
+}
+
+/** The package a bare specifier names: `@scope/name` or the first segment. */
+function packageOf(spec: string): string {
+  const parts = spec.split('/')
+  return spec.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0]!
+}
+
+const SPECIFIER =
+  /\b(?:from|import)\s*\(?\s*["']([^"'./][^"']*)["']|\brequire\s*\(\s*["']([^"'./][^"']*)["']/g
+
+/** Whether a specifier is one the walk would have to look up at all. */
+function needsLookup(spec: string): boolean {
+  if (spec.includes(':') || BUILTINS.has(spec)) return false
+  return !(spec === '@vzn/vx' || spec.startsWith('@vzn/vx/'))
+}
+
+/**
+ * A textual pass before the transpiler's: its scan costs ~50 µs per config
+ * in situ (1000 cold evaluations: 50 ms, measured 2026-09-16), and most
+ * configs import `@vzn/vx` and nothing else. Every static specifier is a
+ * quoted string after `from`, `import` or `require(`; a candidate found
+ * here is checked exactly by the scan (a comment or a type-only import is
+ * the scan's to drop), and a source with no candidate skips it.
+ */
+function hasBareCandidate(source: string): boolean {
+  SPECIFIER.lastIndex = 0
+  for (let m = SPECIFIER.exec(source); m !== null; m = SPECIFIER.exec(source)) {
+    if (needsLookup(m[1] ?? m[2] ?? '')) return true
+  }
+  return false
+}
+
+/**
+ * The bare specifiers of `source` that no `node_modules/<package>` above
+ * `fromDir` provides — the imports Bun would AUTO-INSTALL from the npm
+ * registry rather than fail, when no `node_modules` exists anywhere above
+ * (measured 2026-09-16: sixteen registry connections and 150 ms before
+ * "cannot find"; with one present, 0 and 1 ms). A config is evaluated in
+ * the user's process with the user's network: a fresh clone before its
+ * install, or a typo, must be a refusal, never a download. Builtins
+ * (`node:fs`, `fs`, `bun:sqlite`) and `@vzn/vx` (served by the core alias
+ * inside the compiled binary) are never in the list; relative and absolute
+ * specifiers resolve by path and are the loader's to refuse.
+ */
+export function unprovidedBareImports(
+  source: string,
+  fromDir: string,
+  loader: 'ts' | 'js',
+): string[] {
+  if (!hasBareCandidate(source)) return []
+  let specifiers: string[]
+  try {
+    specifiers = scanner(loader)
+      .scanImports(source)
+      .map((i) => i.path)
+  } catch {
+    return [] // unparseable: the evaluation names the syntax error
+  }
+  const out: string[] = []
+  for (const spec of specifiers) {
+    if (spec.startsWith('.') || spec.startsWith('/') || !needsLookup(spec)) continue
+    const pkg = packageOf(spec)
+    let dir = path.resolve(fromDir)
+    let provided = false
+    for (;;) {
+      if (existsSync(path.join(dir, 'node_modules', pkg))) {
+        provided = true
+        break
+      }
+      const up = path.dirname(dir)
+      if (up === dir) break
+      dir = up
+    }
+    if (!provided && !out.includes(spec)) out.push(spec)
+  }
+  return out
+}
+
 /**
- * Absolute resolved targets of the RELATIVE specifiers in `source`.
+ * Absolute resolved targets of the RELATIVE specifiers in `source`; one that
+ * does not resolve contributes the paths it names.
  *
  * Paths come back realpath'd, because `Bun.resolveSync` realpaths them — see
  * the caller, which realpaths everything it compares against for exactly that
@@ -39,7 +147,9 @@ import type { ProjectMeta } from './workspace.js'
 function scanLocalImports(source: string, fromDir: string, loader: 'ts' | 'js'): string[] {
   let specifiers: string[]
   try {
-    specifiers = new Bun.Transpiler({ loader }).scanImports(source).map((i) => i.path)
+    specifiers = scanner(loader)
+      .scanImports(source)
+      .map((i) => i.path)
   } catch {
     return [] // unparseable source contributes no edges
   }
@@ -49,9 +159,18 @@ function scanLocalImports(source: string, fromDir: string, loader: 'ts' | 'js'):
     try {
       out.push(Bun.resolveSync(spec, fromDir))
     } catch {
-      // Unresolvable (deleted, typo, extensionless miss) — a config that will
-      // not load cannot be shown to import anything, and failing selection
-      // over it would break a working build.
+      // Unresolvable: most often the change itself deleted or renamed the
+      // target, and the config that imports it is exactly the project the
+      // change broke. The edge is the path the specifier names (and, bare
+      // of an extension, the files Bun would have tried), so the deleted
+      // path in the diff still reaches its importer (item 958). Selection
+      // may widen; it is never hashed.
+      const named = path.resolve(fromDir, spec)
+      out.push(named)
+      if (path.extname(spec) === '') {
+        for (const ext of RESOLVED_EXTENSIONS)
+          out.push(named + ext, path.join(named, 'index' + ext))
+      }
     }
   }
   return out
@@ -91,6 +210,9 @@ async function realDirIndex(projects: readonly ProjectMeta[]): Promise<Map<strin
 
 const TS_EXT = new Set(['.ts', '.mts', '.cts'])
 
+/** The extensions Bun tries for a specifier that names none. */
+const RESOLVED_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs', '.json']
+
 /** The deepest project containing `file`, or undefined when none does. */
 function ownerOf(file: string, dirToName: ReadonlyMap<string, string>): string | undefined {
   let dir = path.dirname(file)