@warlock.js/core 5.28.0 → 5.30.0

package/esm/openapi/security.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"security.mjs","names":[],"sources":["../../../../../../../core/src/openapi/security.ts"],"sourcesContent":["import type { AuthDescriptor, OpenApiSecurityRequirement, OpenApiSecurityScheme, WarningSink } from \"./types\";\n\n/**\n * The marker `authMiddleware()` attaches to the middleware it returns.\n * Core reads it structurally; it never imports the auth package.\n */\nexport const AUTH_DESCRIPTOR_SYMBOL = Symbol.for(\"warlock.auth\");\n\nfunction isAuthSource(value: unknown): value is AuthDescriptor[\"sources\"][number] {\n  if (value === \"header\") {\n    return true;\n  }\n\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    typeof (value as { cookie?: unknown }).cookie === \"string\" &&\n    (value as { cookie: string }).cookie.length > 0\n  );\n}\n\n/**\n * Validate an auth descriptor. Returns `undefined` for anything that is not\n * `{ sources: (\"header\" | { cookie: string })[], userTypes?: string[] }` with at least one source.\n */\nexport function parseAuthDescriptor(value: unknown): AuthDescriptor | undefined {\n  if (typeof value !== \"object\" || value === null) {\n    return undefined;\n  }\n\n  const { sources, userTypes } = value as { sources?: unknown; userTypes?: unknown };\n\n  if (!Array.isArray(sources) || sources.length === 0 || !sources.every(isAuthSource)) {\n    return undefined;\n  }\n\n  if (userTypes !== undefined && !(Array.isArray(userTypes) && userTypes.every((type) => typeof type === \"string\"))) {\n    return undefined;\n  }\n\n  return { sources: [...sources], userTypes: Array.isArray(userTypes) ? [...userTypes] : [] };\n}\n\n/**\n * Combine the descriptors of every guard on a route (group middleware is already merged into\n * the route): unique sources, union of user types.\n *\n * Middleware without a descriptor is ordinary middleware and is ignored silently. A function\n * that carries a descriptor of the wrong shape is reported through `warn`.\n *\n * @returns `undefined` when the route has no valid auth descriptor.\n */\nexport function readRouteAuth(middleware: unknown, warn: WarningSink): AuthDescriptor | undefined {\n  if (!Array.isArray(middleware)) {\n    return undefined;\n  }\n\n  const sources: AuthDescriptor[\"sources\"] = [];\n  const userTypes: string[] = [];\n  let found = false;\n\n  for (const fn of middleware) {\n    if (typeof fn !== \"function\") {\n      continue;\n    }\n\n    const raw = Reflect.get(fn, AUTH_DESCRIPTOR_SYMBOL);\n\n    if (raw === undefined) {\n      continue;\n    }\n\n    const descriptor = parseAuthDescriptor(raw);\n\n    if (!descriptor) {\n      warn(\"a middleware carries a malformed warlock.auth descriptor; the route is documented without security.\");\n\n      continue;\n    }\n\n    found = true;\n\n    for (const source of descriptor.sources) {\n      const duplicate = sources.some((existing) =>\n        typeof existing === \"string\" || typeof source === \"string\"\n          ? existing === source\n          : existing.cookie === source.cookie,\n      );\n\n      if (!duplicate) {\n        sources.push(source);\n      }\n    }\n\n    for (const type of descriptor.userTypes) {\n      if (!userTypes.includes(type)) {\n        userTypes.push(type);\n      }\n    }\n  }\n\n  return found ? { sources, userTypes } : undefined;\n}\n\n/**\n * Collects the security schemes the routes actually use and turns descriptors into\n * per-operation requirements. A dual header + cookie guard is an OR: one requirement each.\n */\nexport class SecuritySchemes {\n  public readonly schemes: Record<string, OpenApiSecurityScheme> = {};\n\n  private readonly cookieSchemeNames = new Map<string, string>();\n\n  public requirementsFor(descriptor: AuthDescriptor): OpenApiSecurityRequirement[] {\n    return descriptor.sources.map((source) => {\n      if (source === \"header\") {\n        this.schemes.bearerAuth = { type: \"http\", scheme: \"bearer\", bearerFormat: \"JWT\" };\n\n        return { bearerAuth: [] };\n      }\n\n      const name = this.cookieScheme(source.cookie);\n\n      return { [name]: [] };\n    });\n  }\n\n  private cookieScheme(cookie: string): string {\n    const existing = this.cookieSchemeNames.get(cookie);\n\n    if (existing) {\n      return existing;\n    }\n\n    // The first cookie keeps the conventional name; a second, different cookie gets its own.\n    const name =\n      this.cookieSchemeNames.size === 0 ? \"cookieAuth\" : `cookieAuth_${cookie.replace(/[^A-Za-z0-9._-]/g, \"\")}`;\n\n    this.cookieSchemeNames.set(cookie, name);\n    this.schemes[name] = { type: \"apiKey\", in: \"cookie\", name: cookie };\n\n    return name;\n  }\n\n  public hasSchemes(): boolean {\n    return Object.keys(this.schemes).length > 0;\n  }\n}\n"],"mappings":";;;;;AAMA,MAAa,yBAAyB,OAAO,IAAI,cAAc;AAE/D,SAAS,aAAa,OAA4D;CAChF,IAAI,UAAU,UACZ,OAAO;CAGT,OACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA+B,WAAW,YACjD,MAA6B,OAAO,SAAS;AAElD;;;;;AAMA,SAAgB,oBAAoB,OAA4C;CAC9E,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC;CAGF,MAAM,EAAE,SAAS,cAAc;CAE/B,IAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW,KAAK,CAAC,QAAQ,MAAM,YAAY,GAChF;CAGF,IAAI,cAAc,UAAa,EAAE,MAAM,QAAQ,SAAS,KAAK,UAAU,OAAO,SAAS,OAAO,SAAS,QAAQ,IAC7G;CAGF,OAAO;EAAE,SAAS,CAAC,GAAG,OAAO;EAAG,WAAW,MAAM,QAAQ,SAAS,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC;CAAE;AAC5F;;;;;;;;;;AAWA,SAAgB,cAAc,YAAqB,MAA+C;CAChG,IAAI,CAAC,MAAM,QAAQ,UAAU,GAC3B;CAGF,MAAM,UAAqC,CAAC;CAC5C,MAAM,YAAsB,CAAC;CAC7B,IAAI,QAAQ;CAEZ,KAAK,MAAM,MAAM,YAAY;EAC3B,IAAI,OAAO,OAAO,YAChB;EAGF,MAAM,MAAM,QAAQ,IAAI,IAAI,sBAAsB;EAElD,IAAI,QAAQ,QACV;EAGF,MAAM,aAAa,oBAAoB,GAAG;EAE1C,IAAI,CAAC,YAAY;GACf,KAAK,qGAAqG;GAE1G;EACF;EAEA,QAAQ;EAER,KAAK,MAAM,UAAU,WAAW,SAO9B,IAAI,CANc,QAAQ,MAAM,aAC9B,OAAO,aAAa,YAAY,OAAO,WAAW,WAC9C,aAAa,SACb,SAAS,WAAW,OAAO,MAGpB,GACX,QAAQ,KAAK,MAAM;EAIvB,KAAK,MAAM,QAAQ,WAAW,WAC5B,IAAI,CAAC,UAAU,SAAS,IAAI,GAC1B,UAAU,KAAK,IAAI;CAGzB;CAEA,OAAO,QAAQ;EAAE;EAAS;CAAU,IAAI;AAC1C;;;;;AAMA,IAAa,kBAAb,MAA6B;;iBACsC,CAAC;2CAE7B,IAAI,IAAoB;;CAE7D,AAAO,gBAAgB,YAA0D;EAC/E,OAAO,WAAW,QAAQ,KAAK,WAAW;GACxC,IAAI,WAAW,UAAU;IACvB,KAAK,QAAQ,aAAa;KAAE,MAAM;KAAQ,QAAQ;KAAU,cAAc;IAAM;IAEhF,OAAO,EAAE,YAAY,CAAC,EAAE;GAC1B;GAIA,OAAO,GAFM,KAAK,aAAa,OAAO,MAEzB,IAAI,CAAC,EAAE;EACtB,CAAC;CACH;CAEA,AAAQ,aAAa,QAAwB;EAC3C,MAAM,WAAW,KAAK,kBAAkB,IAAI,MAAM;EAElD,IAAI,UACF,OAAO;EAIT,MAAM,OACJ,KAAK,kBAAkB,SAAS,IAAI,eAAe,cAAc,OAAO,QAAQ,oBAAoB,EAAE;EAExG,KAAK,kBAAkB,IAAI,QAAQ,IAAI;EACvC,KAAK,QAAQ,QAAQ;GAAE,MAAM;GAAU,IAAI;GAAU,MAAM;EAAO;EAElE,OAAO;CACT;CAEA,AAAO,aAAsB;EAC3B,OAAO,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,SAAS;CAC5C;AACF"}
+{"version":3,"file":"security.mjs","names":[],"sources":["../../../../../../../../packages/core/src/openapi/security.ts"],"sourcesContent":["import type { AuthDescriptor, OpenApiSecurityRequirement, OpenApiSecurityScheme, WarningSink } from \"./types\";\n\n/**\n * The marker `authMiddleware()` attaches to the middleware it returns.\n * Core reads it structurally; it never imports the auth package.\n */\nexport const AUTH_DESCRIPTOR_SYMBOL = Symbol.for(\"warlock.auth\");\n\nfunction isAuthSource(value: unknown): value is AuthDescriptor[\"sources\"][number] {\n  if (value === \"header\") {\n    return true;\n  }\n\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    typeof (value as { cookie?: unknown }).cookie === \"string\" &&\n    (value as { cookie: string }).cookie.length > 0\n  );\n}\n\n/**\n * Validate an auth descriptor. Returns `undefined` for anything that is not\n * `{ sources: (\"header\" | { cookie: string })[], userTypes?: string[] }` with at least one source.\n */\nexport function parseAuthDescriptor(value: unknown): AuthDescriptor | undefined {\n  if (typeof value !== \"object\" || value === null) {\n    return undefined;\n  }\n\n  const { sources, userTypes } = value as { sources?: unknown; userTypes?: unknown };\n\n  if (!Array.isArray(sources) || sources.length === 0 || !sources.every(isAuthSource)) {\n    return undefined;\n  }\n\n  if (userTypes !== undefined && !(Array.isArray(userTypes) && userTypes.every((type) => typeof type === \"string\"))) {\n    return undefined;\n  }\n\n  return { sources: [...sources], userTypes: Array.isArray(userTypes) ? [...userTypes] : [] };\n}\n\n/**\n * Combine the descriptors of every guard on a route (group middleware is already merged into\n * the route): unique sources, union of user types.\n *\n * Middleware without a descriptor is ordinary middleware and is ignored silently. A function\n * that carries a descriptor of the wrong shape is reported through `warn`.\n *\n * @returns `undefined` when the route has no valid auth descriptor.\n */\nexport function readRouteAuth(middleware: unknown, warn: WarningSink): AuthDescriptor | undefined {\n  if (!Array.isArray(middleware)) {\n    return undefined;\n  }\n\n  const sources: AuthDescriptor[\"sources\"] = [];\n  const userTypes: string[] = [];\n  let found = false;\n\n  for (const fn of middleware) {\n    if (typeof fn !== \"function\") {\n      continue;\n    }\n\n    const raw = Reflect.get(fn, AUTH_DESCRIPTOR_SYMBOL);\n\n    if (raw === undefined) {\n      continue;\n    }\n\n    const descriptor = parseAuthDescriptor(raw);\n\n    if (!descriptor) {\n      warn(\"a middleware carries a malformed warlock.auth descriptor; the route is documented without security.\");\n\n      continue;\n    }\n\n    found = true;\n\n    for (const source of descriptor.sources) {\n      const duplicate = sources.some((existing) =>\n        typeof existing === \"string\" || typeof source === \"string\"\n          ? existing === source\n          : existing.cookie === source.cookie,\n      );\n\n      if (!duplicate) {\n        sources.push(source);\n      }\n    }\n\n    for (const type of descriptor.userTypes) {\n      if (!userTypes.includes(type)) {\n        userTypes.push(type);\n      }\n    }\n  }\n\n  return found ? { sources, userTypes } : undefined;\n}\n\n/**\n * Collects the security schemes the routes actually use and turns descriptors into\n * per-operation requirements. A dual header + cookie guard is an OR: one requirement each.\n */\nexport class SecuritySchemes {\n  public readonly schemes: Record<string, OpenApiSecurityScheme> = {};\n\n  private readonly cookieSchemeNames = new Map<string, string>();\n\n  public requirementsFor(descriptor: AuthDescriptor): OpenApiSecurityRequirement[] {\n    return descriptor.sources.map((source) => {\n      if (source === \"header\") {\n        this.schemes.bearerAuth = { type: \"http\", scheme: \"bearer\", bearerFormat: \"JWT\" };\n\n        return { bearerAuth: [] };\n      }\n\n      const name = this.cookieScheme(source.cookie);\n\n      return { [name]: [] };\n    });\n  }\n\n  private cookieScheme(cookie: string): string {\n    const existing = this.cookieSchemeNames.get(cookie);\n\n    if (existing) {\n      return existing;\n    }\n\n    // The first cookie keeps the conventional name; a second, different cookie gets its own.\n    const name =\n      this.cookieSchemeNames.size === 0 ? \"cookieAuth\" : `cookieAuth_${cookie.replace(/[^A-Za-z0-9._-]/g, \"\")}`;\n\n    this.cookieSchemeNames.set(cookie, name);\n    this.schemes[name] = { type: \"apiKey\", in: \"cookie\", name: cookie };\n\n    return name;\n  }\n\n  public hasSchemes(): boolean {\n    return Object.keys(this.schemes).length > 0;\n  }\n}\n"],"mappings":";;;;;AAMA,MAAa,yBAAyB,OAAO,IAAI,cAAc;AAE/D,SAAS,aAAa,OAA4D;CAChF,IAAI,UAAU,UACZ,OAAO;CAGT,OACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA+B,WAAW,YACjD,MAA6B,OAAO,SAAS;AAElD;;;;;AAMA,SAAgB,oBAAoB,OAA4C;CAC9E,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC;CAGF,MAAM,EAAE,SAAS,cAAc;CAE/B,IAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW,KAAK,CAAC,QAAQ,MAAM,YAAY,GAChF;CAGF,IAAI,cAAc,UAAa,EAAE,MAAM,QAAQ,SAAS,KAAK,UAAU,OAAO,SAAS,OAAO,SAAS,QAAQ,IAC7G;CAGF,OAAO;EAAE,SAAS,CAAC,GAAG,OAAO;EAAG,WAAW,MAAM,QAAQ,SAAS,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC;CAAE;AAC5F;;;;;;;;;;AAWA,SAAgB,cAAc,YAAqB,MAA+C;CAChG,IAAI,CAAC,MAAM,QAAQ,UAAU,GAC3B;CAGF,MAAM,UAAqC,CAAC;CAC5C,MAAM,YAAsB,CAAC;CAC7B,IAAI,QAAQ;CAEZ,KAAK,MAAM,MAAM,YAAY;EAC3B,IAAI,OAAO,OAAO,YAChB;EAGF,MAAM,MAAM,QAAQ,IAAI,IAAI,sBAAsB;EAElD,IAAI,QAAQ,QACV;EAGF,MAAM,aAAa,oBAAoB,GAAG;EAE1C,IAAI,CAAC,YAAY;GACf,KAAK,qGAAqG;GAE1G;EACF;EAEA,QAAQ;EAER,KAAK,MAAM,UAAU,WAAW,SAO9B,IAAI,CANc,QAAQ,MAAM,aAC9B,OAAO,aAAa,YAAY,OAAO,WAAW,WAC9C,aAAa,SACb,SAAS,WAAW,OAAO,MAGpB,GACX,QAAQ,KAAK,MAAM;EAIvB,KAAK,MAAM,QAAQ,WAAW,WAC5B,IAAI,CAAC,UAAU,SAAS,IAAI,GAC1B,UAAU,KAAK,IAAI;CAGzB;CAEA,OAAO,QAAQ;EAAE;EAAS;CAAU,IAAI;AAC1C;;;;;AAMA,IAAa,kBAAb,MAA6B;;iBACsC,CAAC;2CAE7B,IAAI,IAAoB;;CAE7D,AAAO,gBAAgB,YAA0D;EAC/E,OAAO,WAAW,QAAQ,KAAK,WAAW;GACxC,IAAI,WAAW,UAAU;IACvB,KAAK,QAAQ,aAAa;KAAE,MAAM;KAAQ,QAAQ;KAAU,cAAc;IAAM;IAEhF,OAAO,EAAE,YAAY,CAAC,EAAE;GAC1B;GAIA,OAAO,GAFM,KAAK,aAAa,OAAO,MAEzB,IAAI,CAAC,EAAE;EACtB,CAAC;CACH;CAEA,AAAQ,aAAa,QAAwB;EAC3C,MAAM,WAAW,KAAK,kBAAkB,IAAI,MAAM;EAElD,IAAI,UACF,OAAO;EAIT,MAAM,OACJ,KAAK,kBAAkB,SAAS,IAAI,eAAe,cAAc,OAAO,QAAQ,oBAAoB,EAAE;EAExG,KAAK,kBAAkB,IAAI,QAAQ,IAAI;EACvC,KAAK,QAAQ,QAAQ;GAAE,MAAM;GAAU,IAAI;GAAU,MAAM;EAAO;EAElE,OAAO;CACT;CAEA,AAAO,aAAsB;EAC3B,OAAO,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,SAAS;CAC5C;AACF"}

package/esm/openapi/types.d.mts

@@ -1,6 +1,6 @@
 import { Route } from "../router/types.mjs";
 
-//#region ../core/src/openapi/types.d.ts
+//#region ../../packages/core/src/openapi/types.d.ts
 /**
  * A JSON Schema fragment (OpenAPI 3.1 schemas are JSON Schema 2020-12).
  */

package/esm/openapi/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../core/src/openapi/types.ts"],"mappings":";;;;;AAKA;KAAY,aAAA,GAAgB,MAAM;AAAA,KAEtB,gBAAA;EACV,IAAA;EACA,EAAA;EACA,QAAA;EACA,WAAA;EACA,KAAA;EACA,OAAA;EACA,MAAA,EAAQ,aAAa;AAAA;AAAA,KAGX,kBAAA;EACV,QAAA;EACA,OAAA,EAAS,MAAM;IAAW,MAAA,EAAQ,aAAA;EAAA;AAAA;AAAA,KAGxB,eAAA;EACV,WAAA;EACA,OAAA,GAAU,MAAM;IAAW,MAAA,EAAQ,aAAA;EAAA;AAAA;AAAA,KAGzB,0BAAA,GAA6B,MAAM;AAAA,KAEnC,gBAAA;EACV,WAAA;EACA,OAAA;EACA,WAAA;EACA,IAAA;EACA,UAAA,GAAa,gBAAA;EACb,WAAA,GAAc,kBAAA;EACd,SAAA,EAAW,MAAA,SAAe,eAAA;EAC1B,QAAA,GAAW,0BAAA;AAAA;AAAA,KAGD,qBAAA;EACN,IAAA;EAAc,MAAA;EAAkB,YAAA;AAAA;EAChC,IAAA;EAAgB,EAAA;EAAc,IAAA;AAAA;AAAA,KAExB,iBAAA;EACV,OAAA,GAAU,MAAA,SAAe,aAAA;EACzB,eAAA,GAAkB,MAAA,SAAe,qBAAA;AAAA;AAAA,KAGvB,eAAA;EACV,OAAA;EACA,iBAAA;EACA,IAAA;IAAQ,KAAA;IAAe,OAAA;IAAiB,WAAA;EAAA;EACxC,OAAA;IAAY,GAAA;EAAA;EACZ,IAAA;IAAS,IAAA;EAAA;EACT,KAAA,EAAO,MAAA,SAAe,MAAA,SAAe,gBAAA;EACrC,UAAA,GAAa,iBAAA;AAAA;;;;;KAOH,+BAAA;EACV,MAAA;EACA,QAAA;EACA,UAAA;EACA,MAAA;AAAA;;;;;KAOU,cAAA;EACV,IAAA;IAAQ,KAAA;IAAe,OAAA;IAAiB,WAAA;EAAA,GA/Bb;EAiC3B,OAAA,aAhCyB;EAkCzB,YAAA;EAjCiC;;;;;EAuCjC,mBAAA,IAAuB,QAAA,kCAxCE;EA0CzB,kBAAA,GAAqB,+BAA+B;AAAA;AAAA,KAG1C,kBAAA;EACV,QAAA,EAAU,eAAe;EACzB,QAAA;AAAA;;KAIU,iBAAA,GAAoB,IAAA,CAAK,KAAA,mCACnC,OAAA,CACE,IAAA,CAAK,KAAA;;;;;KAOG,cAAA;EACV,OAAA;IAAuB,MAAA;EAAA;EACvB,SAAA;AAAA;AAAA,KAGU,WAAA,IAAe,OAAe"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/openapi/types.ts"],"mappings":";;;;;AAKA;KAAY,aAAA,GAAgB,MAAM;AAAA,KAEtB,gBAAA;EACV,IAAA;EACA,EAAA;EACA,QAAA;EACA,WAAA;EACA,KAAA;EACA,OAAA;EACA,MAAA,EAAQ,aAAa;AAAA;AAAA,KAGX,kBAAA;EACV,QAAA;EACA,OAAA,EAAS,MAAM;IAAW,MAAA,EAAQ,aAAA;EAAA;AAAA;AAAA,KAGxB,eAAA;EACV,WAAA;EACA,OAAA,GAAU,MAAM;IAAW,MAAA,EAAQ,aAAA;EAAA;AAAA;AAAA,KAGzB,0BAAA,GAA6B,MAAM;AAAA,KAEnC,gBAAA;EACV,WAAA;EACA,OAAA;EACA,WAAA;EACA,IAAA;EACA,UAAA,GAAa,gBAAA;EACb,WAAA,GAAc,kBAAA;EACd,SAAA,EAAW,MAAA,SAAe,eAAA;EAC1B,QAAA,GAAW,0BAAA;AAAA;AAAA,KAGD,qBAAA;EACN,IAAA;EAAc,MAAA;EAAkB,YAAA;AAAA;EAChC,IAAA;EAAgB,EAAA;EAAc,IAAA;AAAA;AAAA,KAExB,iBAAA;EACV,OAAA,GAAU,MAAA,SAAe,aAAA;EACzB,eAAA,GAAkB,MAAA,SAAe,qBAAA;AAAA;AAAA,KAGvB,eAAA;EACV,OAAA;EACA,iBAAA;EACA,IAAA;IAAQ,KAAA;IAAe,OAAA;IAAiB,WAAA;EAAA;EACxC,OAAA;IAAY,GAAA;EAAA;EACZ,IAAA;IAAS,IAAA;EAAA;EACT,KAAA,EAAO,MAAA,SAAe,MAAA,SAAe,gBAAA;EACrC,UAAA,GAAa,iBAAA;AAAA;;;;;KAOH,+BAAA;EACV,MAAA;EACA,QAAA;EACA,UAAA;EACA,MAAA;AAAA;;;;;KAOU,cAAA;EACV,IAAA;IAAQ,KAAA;IAAe,OAAA;IAAiB,WAAA;EAAA,GA/Bb;EAiC3B,OAAA,aAhCyB;EAkCzB,YAAA;EAjCiC;;;;;EAuCjC,mBAAA,IAAuB,QAAA,kCAxCE;EA0CzB,kBAAA,GAAqB,+BAA+B;AAAA;AAAA,KAG1C,kBAAA;EACV,QAAA,EAAU,eAAe;EACzB,QAAA;AAAA;;KAIU,iBAAA,GAAoB,IAAA,CAAK,KAAA,mCACnC,OAAA,CACE,IAAA,CAAK,KAAA;;;;;KAOG,cAAA;EACV,OAAA;IAAuB,MAAA;EAAA;EACvB,SAAA;AAAA;AAAA,KAGU,WAAA,IAAe,OAAe"}

package/esm/production/assert-dist-ready-to-start.mjs

@@ -1,6 +1,6 @@
 import { readDistBuildManifestAsync } from "./dist-build-manifest.mjs";
 
-//#region ../core/src/production/assert-dist-ready-to-start.ts
+//#region ../../packages/core/src/production/assert-dist-ready-to-start.ts
 /**
 * Decide whether `outDir` is fit for `warlock start` to boot.
 *

package/esm/production/assert-dist-ready-to-start.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"assert-dist-ready-to-start.mjs","names":[],"sources":["../../../../../../../core/src/production/assert-dist-ready-to-start.ts"],"sourcesContent":["import { readDistBuildManifestAsync } from \"./dist-build-manifest\";\n\n/**\n * Whether `dist` is safe for `warlock start` to boot, and — when it is\n * not — the reason to show the developer.\n */\nexport type DistReadiness =\n  | { ready: true }\n  | {\n      ready: false;\n      reason: string;\n    };\n\n/**\n * Decide whether `outDir` is fit for `warlock start` to boot.\n *\n * Checks the build-success marker a promoted build writes — not any\n * particular output file. Before this existed, `start` only failed on a\n * broken `dist` by accident, because it happened to need a file (the client\n * manifest) that an incomplete build never wrote. That guard said nothing\n * when the missing piece was anything else, and named no reason. This\n * refuses explicitly and says why.\n */\nexport async function checkDistReadyToStartAsync(outDir: string): Promise<DistReadiness> {\n  const manifest = await readDistBuildManifestAsync(outDir);\n\n  if (manifest) {\n    return { ready: true };\n  }\n\n  return {\n    ready: false,\n    reason:\n      `\"${outDir}\" was not produced by a successful \\`warlock build\\` run ` +\n      \"(no build-success marker found). Run `warlock build` before `warlock start`.\",\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,eAAsB,2BAA2B,QAAwC;CAGvF,IAAI,MAFmB,2BAA2B,MAAM,GAGtD,OAAO,EAAE,OAAO,KAAK;CAGvB,OAAO;EACL,OAAO;EACP,QACE,IAAI,OAAO;CAEf;AACF"}
+{"version":3,"file":"assert-dist-ready-to-start.mjs","names":[],"sources":["../../../../../../../../packages/core/src/production/assert-dist-ready-to-start.ts"],"sourcesContent":["import { readDistBuildManifestAsync } from \"./dist-build-manifest\";\n\n/**\n * Whether `dist` is safe for `warlock start` to boot, and — when it is\n * not — the reason to show the developer.\n */\nexport type DistReadiness =\n  | { ready: true }\n  | {\n      ready: false;\n      reason: string;\n    };\n\n/**\n * Decide whether `outDir` is fit for `warlock start` to boot.\n *\n * Checks the build-success marker a promoted build writes — not any\n * particular output file. Before this existed, `start` only failed on a\n * broken `dist` by accident, because it happened to need a file (the client\n * manifest) that an incomplete build never wrote. That guard said nothing\n * when the missing piece was anything else, and named no reason. This\n * refuses explicitly and says why.\n */\nexport async function checkDistReadyToStartAsync(outDir: string): Promise<DistReadiness> {\n  const manifest = await readDistBuildManifestAsync(outDir);\n\n  if (manifest) {\n    return { ready: true };\n  }\n\n  return {\n    ready: false,\n    reason:\n      `\"${outDir}\" was not produced by a successful \\`warlock build\\` run ` +\n      \"(no build-success marker found). Run `warlock build` before `warlock start`.\",\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAuBA,eAAsB,2BAA2B,QAAwC;CAGvF,IAAI,MAFmB,2BAA2B,MAAM,GAGtD,OAAO,EAAE,OAAO,KAAK;CAGvB,OAAO;EACL,OAAO;EACP,QACE,IAAI,OAAO;CAEf;AACF"}

package/esm/production/assert-generated-imports.mjs

@@ -1,6 +1,6 @@
 import { builtinModules } from "node:module";
 
-//#region ../core/src/production/assert-generated-imports.ts
+//#region ../../packages/core/src/production/assert-generated-imports.ts
 /**
 * Raised when generated code would ship an import the app cannot resolve.
 *

package/esm/production/assert-generated-imports.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"assert-generated-imports.mjs","names":[],"sources":["../../../../../../../core/src/production/assert-generated-imports.ts"],"sourcesContent":["import { builtinModules } from \"node:module\";\n\n/**\n * A specifier the builder wrote into generated code that the consuming app does\n * not declare.\n */\nexport type UndeclaredImport = {\n  /** File the import was written into, relative to the generation directory. */\n  file: string;\n  /** The specifier exactly as emitted. */\n  specifier: string;\n  /** The package the specifier resolves to — `@scope/name` for a deep import. */\n  packageName: string;\n};\n\nexport type GeneratedFile = {\n  file: string;\n  content: string;\n};\n\n/**\n * Raised when generated code would ship an import the app cannot resolve.\n *\n * Carries every violation rather than the first, so a build reports the whole\n * problem in one pass instead of one specifier per re-run.\n */\nexport class UndeclaredGeneratedImportError extends Error {\n  public constructor(public readonly violations: UndeclaredImport[]) {\n    super(\n      [\n        `Generated code imports ${violations.length} package(s) the application does not declare:`,\n        \"\",\n        ...violations.map(\n          ({ file, specifier, packageName }) =>\n            `  ${file} → \"${specifier}\" (requires \"${packageName}\" in the app's dependencies)`,\n        ),\n        \"\",\n        \"Generated code may only import packages the app itself declares. A framework-internal\",\n        \"dependency must be reached through a re-export from @warlock.js/core — a bare specifier\",\n        \"resolves by accident under npm/yarn hoisting and fails under pnpm's strict layout.\",\n      ].join(\"\\n\"),\n    );\n\n    this.name = \"UndeclaredGeneratedImportError\";\n  }\n}\n\n// The clause between `import` and `from` excludes `;` and both quote\n// characters so the lazy match cannot run past the end of its own statement.\n// Allowing it to would let a side-effect import (`import \"./bootstrap\";`) bind\n// to the `from` of the NEXT statement and disappear from the results.\nconst IMPORT_PATTERN =\n  /(?:import|export)\\s+(?:[^\"';]*?\\sfrom\\s*)?[\"']([^\"']+)[\"']|import\\s*\\(\\s*[\"']([^\"']+)[\"']\\s*\\)/g;\n\n/**\n * Every module specifier a source file references — static, side-effect,\n * re-export and dynamic `import()` forms alike.\n *\n * Regex is sufficient and deliberate here: the input is code this builder wrote\n * itself, so it has no comments, no strings that look like imports, and no\n * syntax the pattern could misread. Parsing it with a full AST would buy\n * nothing and cost a dependency in the build path.\n */\nexport function extractSpecifiers(content: string): string[] {\n  const specifiers: string[] = [];\n\n  for (const match of content.matchAll(IMPORT_PATTERN)) {\n    const specifier = match[1] ?? match[2];\n\n    if (specifier) {\n      specifiers.push(specifier);\n    }\n  }\n\n  return specifiers;\n}\n\n/**\n * The package a specifier resolves to — `@scope/name` or `name`, ignoring any\n * deep path after it. Returns undefined for anything that is not a package:\n * relative paths, absolute paths, URLs, and Node builtins.\n */\nexport function resolvePackageName(specifier: string): string | undefined {\n  if (\n    specifier.startsWith(\".\") ||\n    specifier.startsWith(\"/\") ||\n    specifier.startsWith(\"node:\") ||\n    specifier.includes(\"://\")\n  ) {\n    return undefined;\n  }\n\n  const segments = specifier.split(\"/\");\n  const packageName = specifier.startsWith(\"@\") ? segments.slice(0, 2).join(\"/\") : segments[0];\n\n  if (!packageName) {\n    return undefined;\n  }\n\n  if (builtinModules.includes(packageName)) {\n    return undefined;\n  }\n\n  return packageName;\n}\n\n/**\n * Find every import in generated code that the app does not declare.\n *\n * `dependencies` only, deliberately: the artifact this checks is a production\n * bundle, so a package the app lists as a dev dependency is not guaranteed to\n * be installed where it runs.\n */\nexport function findUndeclaredImports(\n  files: GeneratedFile[],\n  declaredDependencies: string[],\n): UndeclaredImport[] {\n  const declared = new Set(declaredDependencies);\n  const violations: UndeclaredImport[] = [];\n\n  for (const { file, content } of files) {\n    for (const specifier of extractSpecifiers(content)) {\n      const packageName = resolvePackageName(specifier);\n\n      if (!packageName || declared.has(packageName)) {\n        continue;\n      }\n\n      violations.push({ file, specifier, packageName });\n    }\n  }\n\n  return violations;\n}\n\n/**\n * Fail the build when generated code would import something the app cannot\n * resolve.\n *\n * This is the part that stops the defect class from returning. Rewriting the\n * one bad specifier fixes today's bundle; only the assertion stops the next\n * change to the generator from reintroducing it — under npm or yarn the mistake\n * is invisible, because hoisting resolves it by accident.\n *\n * @throws {UndeclaredGeneratedImportError} listing every violation found.\n */\nexport function assertGeneratedImportsAreDeclared(\n  files: GeneratedFile[],\n  declaredDependencies: string[],\n): void {\n  const violations = findUndeclaredImports(files, declaredDependencies);\n\n  if (violations.length > 0) {\n    throw new UndeclaredGeneratedImportError(violations);\n  }\n}\n"],"mappings":";;;;;;;;;AA0BA,IAAa,iCAAb,cAAoD,MAAM;CACxD,AAAO,YAAY,AAAgB,YAAgC;EACjE,MACE;GACE,0BAA0B,WAAW,OAAO;GAC5C;GACA,GAAG,WAAW,KACX,EAAE,MAAM,WAAW,kBAClB,KAAK,KAAK,MAAM,UAAU,eAAe,YAAY,6BACzD;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,KAAK,IAAI,CACb;EAdiC;EAgBjC,KAAK,OAAO;CACd;AACF;AAMA,MAAM,iBACJ;;;;;;;;;;AAWF,SAAgB,kBAAkB,SAA2B;CAC3D,MAAM,aAAuB,CAAC;CAE9B,KAAK,MAAM,SAAS,QAAQ,SAAS,cAAc,GAAG;EACpD,MAAM,YAAY,MAAM,MAAM,MAAM;EAEpC,IAAI,WACF,WAAW,KAAK,SAAS;CAE7B;CAEA,OAAO;AACT;;;;;;AAOA,SAAgB,mBAAmB,WAAuC;CACxE,IACE,UAAU,WAAW,GAAG,KACxB,UAAU,WAAW,GAAG,KACxB,UAAU,WAAW,OAAO,KAC5B,UAAU,SAAS,KAAK,GAExB;CAGF,MAAM,WAAW,UAAU,MAAM,GAAG;CACpC,MAAM,cAAc,UAAU,WAAW,GAAG,IAAI,SAAS,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,SAAS;CAE1F,IAAI,CAAC,aACH;CAGF,IAAI,eAAe,SAAS,WAAW,GACrC;CAGF,OAAO;AACT;;;;;;;;AASA,SAAgB,sBACd,OACA,sBACoB;CACpB,MAAM,WAAW,IAAI,IAAI,oBAAoB;CAC7C,MAAM,aAAiC,CAAC;CAExC,KAAK,MAAM,EAAE,MAAM,aAAa,OAC9B,KAAK,MAAM,aAAa,kBAAkB,OAAO,GAAG;EAClD,MAAM,cAAc,mBAAmB,SAAS;EAEhD,IAAI,CAAC,eAAe,SAAS,IAAI,WAAW,GAC1C;EAGF,WAAW,KAAK;GAAE;GAAM;GAAW;EAAY,CAAC;CAClD;CAGF,OAAO;AACT;;;;;;;;;;;;AAaA,SAAgB,kCACd,OACA,sBACM;CACN,MAAM,aAAa,sBAAsB,OAAO,oBAAoB;CAEpE,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,+BAA+B,UAAU;AAEvD"}
+{"version":3,"file":"assert-generated-imports.mjs","names":[],"sources":["../../../../../../../../packages/core/src/production/assert-generated-imports.ts"],"sourcesContent":["import { builtinModules } from \"node:module\";\n\n/**\n * A specifier the builder wrote into generated code that the consuming app does\n * not declare.\n */\nexport type UndeclaredImport = {\n  /** File the import was written into, relative to the generation directory. */\n  file: string;\n  /** The specifier exactly as emitted. */\n  specifier: string;\n  /** The package the specifier resolves to — `@scope/name` for a deep import. */\n  packageName: string;\n};\n\nexport type GeneratedFile = {\n  file: string;\n  content: string;\n};\n\n/**\n * Raised when generated code would ship an import the app cannot resolve.\n *\n * Carries every violation rather than the first, so a build reports the whole\n * problem in one pass instead of one specifier per re-run.\n */\nexport class UndeclaredGeneratedImportError extends Error {\n  public constructor(public readonly violations: UndeclaredImport[]) {\n    super(\n      [\n        `Generated code imports ${violations.length} package(s) the application does not declare:`,\n        \"\",\n        ...violations.map(\n          ({ file, specifier, packageName }) =>\n            `  ${file} → \"${specifier}\" (requires \"${packageName}\" in the app's dependencies)`,\n        ),\n        \"\",\n        \"Generated code may only import packages the app itself declares. A framework-internal\",\n        \"dependency must be reached through a re-export from @warlock.js/core — a bare specifier\",\n        \"resolves by accident under npm/yarn hoisting and fails under pnpm's strict layout.\",\n      ].join(\"\\n\"),\n    );\n\n    this.name = \"UndeclaredGeneratedImportError\";\n  }\n}\n\n// The clause between `import` and `from` excludes `;` and both quote\n// characters so the lazy match cannot run past the end of its own statement.\n// Allowing it to would let a side-effect import (`import \"./bootstrap\";`) bind\n// to the `from` of the NEXT statement and disappear from the results.\nconst IMPORT_PATTERN =\n  /(?:import|export)\\s+(?:[^\"';]*?\\sfrom\\s*)?[\"']([^\"']+)[\"']|import\\s*\\(\\s*[\"']([^\"']+)[\"']\\s*\\)/g;\n\n/**\n * Every module specifier a source file references — static, side-effect,\n * re-export and dynamic `import()` forms alike.\n *\n * Regex is sufficient and deliberate here: the input is code this builder wrote\n * itself, so it has no comments, no strings that look like imports, and no\n * syntax the pattern could misread. Parsing it with a full AST would buy\n * nothing and cost a dependency in the build path.\n */\nexport function extractSpecifiers(content: string): string[] {\n  const specifiers: string[] = [];\n\n  for (const match of content.matchAll(IMPORT_PATTERN)) {\n    const specifier = match[1] ?? match[2];\n\n    if (specifier) {\n      specifiers.push(specifier);\n    }\n  }\n\n  return specifiers;\n}\n\n/**\n * The package a specifier resolves to — `@scope/name` or `name`, ignoring any\n * deep path after it. Returns undefined for anything that is not a package:\n * relative paths, absolute paths, URLs, and Node builtins.\n */\nexport function resolvePackageName(specifier: string): string | undefined {\n  if (\n    specifier.startsWith(\".\") ||\n    specifier.startsWith(\"/\") ||\n    specifier.startsWith(\"node:\") ||\n    specifier.includes(\"://\")\n  ) {\n    return undefined;\n  }\n\n  const segments = specifier.split(\"/\");\n  const packageName = specifier.startsWith(\"@\") ? segments.slice(0, 2).join(\"/\") : segments[0];\n\n  if (!packageName) {\n    return undefined;\n  }\n\n  if (builtinModules.includes(packageName)) {\n    return undefined;\n  }\n\n  return packageName;\n}\n\n/**\n * Find every import in generated code that the app does not declare.\n *\n * `dependencies` only, deliberately: the artifact this checks is a production\n * bundle, so a package the app lists as a dev dependency is not guaranteed to\n * be installed where it runs.\n */\nexport function findUndeclaredImports(\n  files: GeneratedFile[],\n  declaredDependencies: string[],\n): UndeclaredImport[] {\n  const declared = new Set(declaredDependencies);\n  const violations: UndeclaredImport[] = [];\n\n  for (const { file, content } of files) {\n    for (const specifier of extractSpecifiers(content)) {\n      const packageName = resolvePackageName(specifier);\n\n      if (!packageName || declared.has(packageName)) {\n        continue;\n      }\n\n      violations.push({ file, specifier, packageName });\n    }\n  }\n\n  return violations;\n}\n\n/**\n * Fail the build when generated code would import something the app cannot\n * resolve.\n *\n * This is the part that stops the defect class from returning. Rewriting the\n * one bad specifier fixes today's bundle; only the assertion stops the next\n * change to the generator from reintroducing it — under npm or yarn the mistake\n * is invisible, because hoisting resolves it by accident.\n *\n * @throws {UndeclaredGeneratedImportError} listing every violation found.\n */\nexport function assertGeneratedImportsAreDeclared(\n  files: GeneratedFile[],\n  declaredDependencies: string[],\n): void {\n  const violations = findUndeclaredImports(files, declaredDependencies);\n\n  if (violations.length > 0) {\n    throw new UndeclaredGeneratedImportError(violations);\n  }\n}\n"],"mappings":";;;;;;;;;AA0BA,IAAa,iCAAb,cAAoD,MAAM;CACxD,AAAO,YAAY,AAAgB,YAAgC;EACjE,MACE;GACE,0BAA0B,WAAW,OAAO;GAC5C;GACA,GAAG,WAAW,KACX,EAAE,MAAM,WAAW,kBAClB,KAAK,KAAK,MAAM,UAAU,eAAe,YAAY,6BACzD;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,KAAK,IAAI,CACb;EAdiC;EAgBjC,KAAK,OAAO;CACd;AACF;AAMA,MAAM,iBACJ;;;;;;;;;;AAWF,SAAgB,kBAAkB,SAA2B;CAC3D,MAAM,aAAuB,CAAC;CAE9B,KAAK,MAAM,SAAS,QAAQ,SAAS,cAAc,GAAG;EACpD,MAAM,YAAY,MAAM,MAAM,MAAM;EAEpC,IAAI,WACF,WAAW,KAAK,SAAS;CAE7B;CAEA,OAAO;AACT;;;;;;AAOA,SAAgB,mBAAmB,WAAuC;CACxE,IACE,UAAU,WAAW,GAAG,KACxB,UAAU,WAAW,GAAG,KACxB,UAAU,WAAW,OAAO,KAC5B,UAAU,SAAS,KAAK,GAExB;CAGF,MAAM,WAAW,UAAU,MAAM,GAAG;CACpC,MAAM,cAAc,UAAU,WAAW,GAAG,IAAI,SAAS,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,SAAS;CAE1F,IAAI,CAAC,aACH;CAGF,IAAI,eAAe,SAAS,WAAW,GACrC;CAGF,OAAO;AACT;;;;;;;;AASA,SAAgB,sBACd,OACA,sBACoB;CACpB,MAAM,WAAW,IAAI,IAAI,oBAAoB;CAC7C,MAAM,aAAiC,CAAC;CAExC,KAAK,MAAM,EAAE,MAAM,aAAa,OAC9B,KAAK,MAAM,aAAa,kBAAkB,OAAO,GAAG;EAClD,MAAM,cAAc,mBAAmB,SAAS;EAEhD,IAAI,CAAC,eAAe,SAAS,IAAI,WAAW,GAC1C;EAGF,WAAW,KAAK;GAAE;GAAM;GAAW;EAAY,CAAC;CAClD;CAGF,OAAO;AACT;;;;;;;;;;;;AAaA,SAAgB,kCACd,OACA,sBACM;CACN,MAAM,aAAa,sBAAsB,OAAO,oBAAoB;CAEpE,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,+BAA+B,UAAU;AAEvD"}

package/esm/production/build-app-production.mjs

@@ -1,6 +1,6 @@
 import { ProductionBuilder } from "./production-builder.mjs";
 
-//#region ../core/src/production/build-app-production.ts
+//#region ../../packages/core/src/production/build-app-production.ts
 /**
 * Build the application for production
 * Options are loaded from warlock.config.ts

package/esm/production/build-app-production.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"build-app-production.mjs","names":[],"sources":["../../../../../../../core/src/production/build-app-production.ts"],"sourcesContent":["import { ProductionBuilder } from \"./production-builder\";\n\n/**\n * Build the application for production\n * Options are loaded from warlock.config.ts\n */\nexport async function buildAppProduction() {\n  const builder = new ProductionBuilder();\n  await builder.build();\n}\n"],"mappings":";;;;;;;AAMA,eAAsB,qBAAqB;CAEzC,MAAM,IADc,kBACR,CAAC,CAAC,MAAM;AACtB"}
+{"version":3,"file":"build-app-production.mjs","names":[],"sources":["../../../../../../../../packages/core/src/production/build-app-production.ts"],"sourcesContent":["import { ProductionBuilder } from \"./production-builder\";\n\n/**\n * Build the application for production\n * Options are loaded from warlock.config.ts\n */\nexport async function buildAppProduction() {\n  const builder = new ProductionBuilder();\n  await builder.build();\n}\n"],"mappings":";;;;;;;AAMA,eAAsB,qBAAqB;CAEzC,MAAM,IADc,kBACR,CAAC,CAAC,MAAM;AACtB"}

package/esm/production/build-contributions.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/production/build-contributions.ts
+//#region ../../packages/core/src/production/build-contributions.ts
 const ErrorWithCause = Error;
 /**
 * The only keys a `build` contribution may carry.

package/esm/production/build-contributions.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"build-contributions.mjs","names":[],"sources":["../../../../../../../core/src/production/build-contributions.ts"],"sourcesContent":["import type { Connector, ConnectorBuildContext, ConnectorEsbuildPatch } from \"../connectors/types\";\n\n/**\n * `Error` with the `cause` option typed. Same shim as\n * `application.ts` — lib.es2022 declares `cause` on `ErrorOptions`, but the\n * package still compiles against an older lib in some consumers.\n */\ntype ErrorWithCauseConstructor = new (message: string, options: { cause: unknown }) => Error;\n\nconst ErrorWithCause = Error as ErrorWithCauseConstructor;\n\n/**\n * The only keys a `build` contribution may carry.\n *\n * The runtime half of the closed-contribution constraint: the\n * type already makes `build: { plugins: [...] }` unrepresentable, but a\n * plain `warlock.config.js`, an `as any`, or a connector compiled against an\n * older core all slip past the type. Rejected rather than ignored — the same\n * posture as the `tsconfig` guard in `resolve-build-config`: dropping the key\n * quietly would leave the author believing their plugin ran.\n */\nconst ALLOWED_CONTRIBUTION_KEYS = [\"generate\", \"emit\", \"typings\"] as const;\n\n/**\n * What the generate pass produced, merged across every contributor.\n */\nexport type GenerateContributionsResult = {\n  /** Entry lines in contributor order, appended after `./routes` */\n  entryImports: string[];\n  /** The contributors' esbuild patches, merged into one */\n  esbuild: ConnectorEsbuildPatch;\n};\n\n/**\n * Reject a contribution object carrying anything but the two hooks.\n *\n * @throws Error naming the connector and the offending key\n */\nexport function assertClosedContribution(connector: Connector): void {\n  const contribution = connector.build;\n\n  if (!contribution) return;\n\n  for (const key of Object.keys(contribution)) {\n    if ((ALLOWED_CONTRIBUTION_KEYS as readonly string[]).includes(key)) continue;\n\n    throw new Error(\n      `Connector \"${connector.name}\" declares an unsupported build contribution key \"${key}\". ` +\n        `A build contribution carries exactly these optional hooks — ` +\n        `${ALLOWED_CONTRIBUTION_KEYS.join(\", \")} — and no data. ` +\n        `Anything a hook needs (plugins, pipelines, aliases) must be constructed inside ` +\n        `that hook, so it never lands in the connector's static import graph.`,\n    );\n  }\n}\n\n/**\n * Drain every connector's `generate` hook, in array order, sequentially.\n *\n * Semantics are copied from `Application.runStartupValidators`\n * (`application.ts:304-329`) on purpose: ordered, awaited one at a time, and\n * a throw is rethrown wrapped in an error NAMING the contributor. A\n * contributor failure IS the build failing — that is what makes\n * \"green build, no client bundle\" unrepresentable rather than merely\n * unlikely.\n */\nexport async function runGenerateContributions(\n  connectors: readonly Connector[],\n  context: ConnectorBuildContext,\n): Promise<GenerateContributionsResult> {\n  const entryImports: string[] = [];\n  let esbuild: ConnectorEsbuildPatch = {};\n\n  for (const connector of connectors) {\n    assertClosedContribution(connector);\n\n    const generate = connector.build?.generate;\n\n    if (!generate) continue;\n\n    const result = await runHook(connector, \"generate\", () => generate(context));\n\n    if (!result) continue;\n\n    if (result.entryImports) {\n      entryImports.push(...result.entryImports);\n    }\n\n    if (result.esbuild) {\n      esbuild = mergeEsbuildPatches(esbuild, result.esbuild);\n    }\n  }\n\n  return { entryImports, esbuild };\n}\n\n/**\n * Drain every connector's `emit` hook, in array order, sequentially.\n *\n * Runs after esbuild and before `.warlock/production` is removed, so a hook\n * may still read what `generate` wrote there.\n */\nexport async function runEmitContributions(\n  connectors: readonly Connector[],\n  context: ConnectorBuildContext,\n): Promise<void> {\n  for (const connector of connectors) {\n    assertClosedContribution(connector);\n\n    const emit = connector.build?.emit;\n\n    if (!emit) continue;\n\n    await runHook(connector, \"emit\", () => emit(context));\n  }\n}\n\n/**\n * Drain every connector's `typings` hook, in array order, sequentially.\n * Connectors without one — every API-only app — are skipped without error.\n */\nexport async function runTypingsContributions(\n  connectors: readonly Connector[],\n  context: ConnectorBuildContext,\n): Promise<void> {\n  for (const connector of connectors) {\n    assertClosedContribution(connector);\n\n    const typings = connector.build?.typings;\n\n    if (!typings) continue;\n\n    await runHook(connector, \"typings\", () => typings(context));\n  }\n}\n\n/**\n * Merge two contributor patches. Later wins, except:\n *\n * - `define` merges per key — two contributors defining different\n *   `import.meta.env.*` entries must both survive; a wholesale replace would\n *   drop one silently.\n * - `external` concatenates and dedupes — it is a set of package names, and\n *   under `singleBundle` each contributor adds its own optional peers.\n * - `loader` merges per extension, for the same reason as `define`.\n * - `plugins` concatenate in contribution order. They are constructed inside\n *   a hook, so this does not reopen the closed-contribution constraint.\n */\nexport function mergeEsbuildPatches(\n  base: ConnectorEsbuildPatch,\n  patch: ConnectorEsbuildPatch,\n): ConnectorEsbuildPatch {\n  const merged: ConnectorEsbuildPatch = { ...base, ...patch };\n\n  if (base.define || patch.define) {\n    merged.define = { ...base.define, ...patch.define };\n  }\n\n  if (base.external || patch.external) {\n    merged.external = dedupe([...(base.external ?? []), ...(patch.external ?? [])]);\n  }\n\n  if (base.loader || patch.loader) {\n    merged.loader = { ...base.loader, ...patch.loader };\n  }\n\n  if (base.plugins || patch.plugins) {\n    merged.plugins = [...(base.plugins ?? []), ...(patch.plugins ?? [])];\n  }\n\n  return merged;\n}\n\n/**\n * Concatenation order preserved — esbuild does not care, but a stable order\n * keeps build output diffable.\n */\nexport function dedupe(values: string[]): string[] {\n  return [...new Set(values)];\n}\n\n/**\n * Run one hook and rename its failure after the connector that owns it.\n */\nasync function runHook<Result>(\n  connector: Connector,\n  hook: \"generate\" | \"emit\" | \"typings\",\n  run: () => Result | Promise<Result>,\n): Promise<Result> {\n  try {\n    return await run();\n  } catch (error) {\n    const cause = error instanceof Error ? error.message : String(error);\n\n    throw new ErrorWithCause(\n      `Build contribution \"${connector.name}\" failed during ${hook}: ${cause}. ` +\n        `The build cannot continue — an artifact this connector was responsible for ` +\n        `is missing, and shipping the bundle without it would fail at runtime instead.`,\n      { cause: error },\n    );\n  }\n}\n"],"mappings":";AASA,MAAM,iBAAiB;;;;;;;;;;;AAYvB,MAAM,4BAA4B;CAAC;CAAY;CAAQ;AAAS;;;;;;AAiBhE,SAAgB,yBAAyB,WAA4B;CACnE,MAAM,eAAe,UAAU;CAE/B,IAAI,CAAC,cAAc;CAEnB,KAAK,MAAM,OAAO,OAAO,KAAK,YAAY,GAAG;EAC3C,IAAK,0BAAgD,SAAS,GAAG,GAAG;EAEpE,MAAM,IAAI,MACR,cAAc,UAAU,KAAK,oDAAoD,IAAI,iEAEhF,0BAA0B,KAAK,IAAI,EAAE,oKAG5C;CACF;AACF;;;;;;;;;;;AAYA,eAAsB,yBACpB,YACA,SACsC;CACtC,MAAM,eAAyB,CAAC;CAChC,IAAI,UAAiC,CAAC;CAEtC,KAAK,MAAM,aAAa,YAAY;EAClC,yBAAyB,SAAS;EAElC,MAAM,WAAW,UAAU,OAAO;EAElC,IAAI,CAAC,UAAU;EAEf,MAAM,SAAS,MAAM,QAAQ,WAAW,kBAAkB,SAAS,OAAO,CAAC;EAE3E,IAAI,CAAC,QAAQ;EAEb,IAAI,OAAO,cACT,aAAa,KAAK,GAAG,OAAO,YAAY;EAG1C,IAAI,OAAO,SACT,UAAU,oBAAoB,SAAS,OAAO,OAAO;CAEzD;CAEA,OAAO;EAAE;EAAc;CAAQ;AACjC;;;;;;;AAQA,eAAsB,qBACpB,YACA,SACe;CACf,KAAK,MAAM,aAAa,YAAY;EAClC,yBAAyB,SAAS;EAElC,MAAM,OAAO,UAAU,OAAO;EAE9B,IAAI,CAAC,MAAM;EAEX,MAAM,QAAQ,WAAW,cAAc,KAAK,OAAO,CAAC;CACtD;AACF;;;;;AAMA,eAAsB,wBACpB,YACA,SACe;CACf,KAAK,MAAM,aAAa,YAAY;EAClC,yBAAyB,SAAS;EAElC,MAAM,UAAU,UAAU,OAAO;EAEjC,IAAI,CAAC,SAAS;EAEd,MAAM,QAAQ,WAAW,iBAAiB,QAAQ,OAAO,CAAC;CAC5D;AACF;;;;;;;;;;;;;AAcA,SAAgB,oBACd,MACA,OACuB;CACvB,MAAM,SAAgC;EAAE,GAAG;EAAM,GAAG;CAAM;CAE1D,IAAI,KAAK,UAAU,MAAM,QACvB,OAAO,SAAS;EAAE,GAAG,KAAK;EAAQ,GAAG,MAAM;CAAO;CAGpD,IAAI,KAAK,YAAY,MAAM,UACzB,OAAO,WAAW,OAAO,CAAC,GAAI,KAAK,YAAY,CAAC,GAAI,GAAI,MAAM,YAAY,CAAC,CAAE,CAAC;CAGhF,IAAI,KAAK,UAAU,MAAM,QACvB,OAAO,SAAS;EAAE,GAAG,KAAK;EAAQ,GAAG,MAAM;CAAO;CAGpD,IAAI,KAAK,WAAW,MAAM,SACxB,OAAO,UAAU,CAAC,GAAI,KAAK,WAAW,CAAC,GAAI,GAAI,MAAM,WAAW,CAAC,CAAE;CAGrE,OAAO;AACT;;;;;AAMA,SAAgB,OAAO,QAA4B;CACjD,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;;;;AAKA,eAAe,QACb,WACA,MACA,KACiB;CACjB,IAAI;EACF,OAAO,MAAM,IAAI;CACnB,SAAS,OAAO;EACd,MAAM,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAEnE,MAAM,IAAI,eACR,uBAAuB,UAAU,KAAK,kBAAkB,KAAK,IAAI,MAAM,6JAGvE,EAAE,OAAO,MAAM,CACjB;CACF;AACF"}
+{"version":3,"file":"build-contributions.mjs","names":[],"sources":["../../../../../../../../packages/core/src/production/build-contributions.ts"],"sourcesContent":["import type { Connector, ConnectorBuildContext, ConnectorEsbuildPatch } from \"../connectors/types\";\n\n/**\n * `Error` with the `cause` option typed. Same shim as\n * `application.ts` — lib.es2022 declares `cause` on `ErrorOptions`, but the\n * package still compiles against an older lib in some consumers.\n */\ntype ErrorWithCauseConstructor = new (message: string, options: { cause: unknown }) => Error;\n\nconst ErrorWithCause = Error as ErrorWithCauseConstructor;\n\n/**\n * The only keys a `build` contribution may carry.\n *\n * The runtime half of the closed-contribution constraint: the\n * type already makes `build: { plugins: [...] }` unrepresentable, but a\n * plain `warlock.config.js`, an `as any`, or a connector compiled against an\n * older core all slip past the type. Rejected rather than ignored — the same\n * posture as the `tsconfig` guard in `resolve-build-config`: dropping the key\n * quietly would leave the author believing their plugin ran.\n */\nconst ALLOWED_CONTRIBUTION_KEYS = [\"generate\", \"emit\", \"typings\"] as const;\n\n/**\n * What the generate pass produced, merged across every contributor.\n */\nexport type GenerateContributionsResult = {\n  /** Entry lines in contributor order, appended after `./routes` */\n  entryImports: string[];\n  /** The contributors' esbuild patches, merged into one */\n  esbuild: ConnectorEsbuildPatch;\n};\n\n/**\n * Reject a contribution object carrying anything but the two hooks.\n *\n * @throws Error naming the connector and the offending key\n */\nexport function assertClosedContribution(connector: Connector): void {\n  const contribution = connector.build;\n\n  if (!contribution) return;\n\n  for (const key of Object.keys(contribution)) {\n    if ((ALLOWED_CONTRIBUTION_KEYS as readonly string[]).includes(key)) continue;\n\n    throw new Error(\n      `Connector \"${connector.name}\" declares an unsupported build contribution key \"${key}\". ` +\n        `A build contribution carries exactly these optional hooks — ` +\n        `${ALLOWED_CONTRIBUTION_KEYS.join(\", \")} — and no data. ` +\n        `Anything a hook needs (plugins, pipelines, aliases) must be constructed inside ` +\n        `that hook, so it never lands in the connector's static import graph.`,\n    );\n  }\n}\n\n/**\n * Drain every connector's `generate` hook, in array order, sequentially.\n *\n * Semantics are copied from `Application.runStartupValidators`\n * (`application.ts:304-329`) on purpose: ordered, awaited one at a time, and\n * a throw is rethrown wrapped in an error NAMING the contributor. A\n * contributor failure IS the build failing — that is what makes\n * \"green build, no client bundle\" unrepresentable rather than merely\n * unlikely.\n */\nexport async function runGenerateContributions(\n  connectors: readonly Connector[],\n  context: ConnectorBuildContext,\n): Promise<GenerateContributionsResult> {\n  const entryImports: string[] = [];\n  let esbuild: ConnectorEsbuildPatch = {};\n\n  for (const connector of connectors) {\n    assertClosedContribution(connector);\n\n    const generate = connector.build?.generate;\n\n    if (!generate) continue;\n\n    const result = await runHook(connector, \"generate\", () => generate(context));\n\n    if (!result) continue;\n\n    if (result.entryImports) {\n      entryImports.push(...result.entryImports);\n    }\n\n    if (result.esbuild) {\n      esbuild = mergeEsbuildPatches(esbuild, result.esbuild);\n    }\n  }\n\n  return { entryImports, esbuild };\n}\n\n/**\n * Drain every connector's `emit` hook, in array order, sequentially.\n *\n * Runs after esbuild and before `.warlock/production` is removed, so a hook\n * may still read what `generate` wrote there.\n */\nexport async function runEmitContributions(\n  connectors: readonly Connector[],\n  context: ConnectorBuildContext,\n): Promise<void> {\n  for (const connector of connectors) {\n    assertClosedContribution(connector);\n\n    const emit = connector.build?.emit;\n\n    if (!emit) continue;\n\n    await runHook(connector, \"emit\", () => emit(context));\n  }\n}\n\n/**\n * Drain every connector's `typings` hook, in array order, sequentially.\n * Connectors without one — every API-only app — are skipped without error.\n */\nexport async function runTypingsContributions(\n  connectors: readonly Connector[],\n  context: ConnectorBuildContext,\n): Promise<void> {\n  for (const connector of connectors) {\n    assertClosedContribution(connector);\n\n    const typings = connector.build?.typings;\n\n    if (!typings) continue;\n\n    await runHook(connector, \"typings\", () => typings(context));\n  }\n}\n\n/**\n * Merge two contributor patches. Later wins, except:\n *\n * - `define` merges per key — two contributors defining different\n *   `import.meta.env.*` entries must both survive; a wholesale replace would\n *   drop one silently.\n * - `external` concatenates and dedupes — it is a set of package names, and\n *   under `singleBundle` each contributor adds its own optional peers.\n * - `loader` merges per extension, for the same reason as `define`.\n * - `plugins` concatenate in contribution order. They are constructed inside\n *   a hook, so this does not reopen the closed-contribution constraint.\n */\nexport function mergeEsbuildPatches(\n  base: ConnectorEsbuildPatch,\n  patch: ConnectorEsbuildPatch,\n): ConnectorEsbuildPatch {\n  const merged: ConnectorEsbuildPatch = { ...base, ...patch };\n\n  if (base.define || patch.define) {\n    merged.define = { ...base.define, ...patch.define };\n  }\n\n  if (base.external || patch.external) {\n    merged.external = dedupe([...(base.external ?? []), ...(patch.external ?? [])]);\n  }\n\n  if (base.loader || patch.loader) {\n    merged.loader = { ...base.loader, ...patch.loader };\n  }\n\n  if (base.plugins || patch.plugins) {\n    merged.plugins = [...(base.plugins ?? []), ...(patch.plugins ?? [])];\n  }\n\n  return merged;\n}\n\n/**\n * Concatenation order preserved — esbuild does not care, but a stable order\n * keeps build output diffable.\n */\nexport function dedupe(values: string[]): string[] {\n  return [...new Set(values)];\n}\n\n/**\n * Run one hook and rename its failure after the connector that owns it.\n */\nasync function runHook<Result>(\n  connector: Connector,\n  hook: \"generate\" | \"emit\" | \"typings\",\n  run: () => Result | Promise<Result>,\n): Promise<Result> {\n  try {\n    return await run();\n  } catch (error) {\n    const cause = error instanceof Error ? error.message : String(error);\n\n    throw new ErrorWithCause(\n      `Build contribution \"${connector.name}\" failed during ${hook}: ${cause}. ` +\n        `The build cannot continue — an artifact this connector was responsible for ` +\n        `is missing, and shipping the bundle without it would fail at runtime instead.`,\n      { cause: error },\n    );\n  }\n}\n"],"mappings":";AASA,MAAM,iBAAiB;;;;;;;;;;;AAYvB,MAAM,4BAA4B;CAAC;CAAY;CAAQ;AAAS;;;;;;AAiBhE,SAAgB,yBAAyB,WAA4B;CACnE,MAAM,eAAe,UAAU;CAE/B,IAAI,CAAC,cAAc;CAEnB,KAAK,MAAM,OAAO,OAAO,KAAK,YAAY,GAAG;EAC3C,IAAK,0BAAgD,SAAS,GAAG,GAAG;EAEpE,MAAM,IAAI,MACR,cAAc,UAAU,KAAK,oDAAoD,IAAI,iEAEhF,0BAA0B,KAAK,IAAI,EAAE,oKAG5C;CACF;AACF;;;;;;;;;;;AAYA,eAAsB,yBACpB,YACA,SACsC;CACtC,MAAM,eAAyB,CAAC;CAChC,IAAI,UAAiC,CAAC;CAEtC,KAAK,MAAM,aAAa,YAAY;EAClC,yBAAyB,SAAS;EAElC,MAAM,WAAW,UAAU,OAAO;EAElC,IAAI,CAAC,UAAU;EAEf,MAAM,SAAS,MAAM,QAAQ,WAAW,kBAAkB,SAAS,OAAO,CAAC;EAE3E,IAAI,CAAC,QAAQ;EAEb,IAAI,OAAO,cACT,aAAa,KAAK,GAAG,OAAO,YAAY;EAG1C,IAAI,OAAO,SACT,UAAU,oBAAoB,SAAS,OAAO,OAAO;CAEzD;CAEA,OAAO;EAAE;EAAc;CAAQ;AACjC;;;;;;;AAQA,eAAsB,qBACpB,YACA,SACe;CACf,KAAK,MAAM,aAAa,YAAY;EAClC,yBAAyB,SAAS;EAElC,MAAM,OAAO,UAAU,OAAO;EAE9B,IAAI,CAAC,MAAM;EAEX,MAAM,QAAQ,WAAW,cAAc,KAAK,OAAO,CAAC;CACtD;AACF;;;;;AAMA,eAAsB,wBACpB,YACA,SACe;CACf,KAAK,MAAM,aAAa,YAAY;EAClC,yBAAyB,SAAS;EAElC,MAAM,UAAU,UAAU,OAAO;EAEjC,IAAI,CAAC,SAAS;EAEd,MAAM,QAAQ,WAAW,iBAAiB,QAAQ,OAAO,CAAC;CAC5D;AACF;;;;;;;;;;;;;AAcA,SAAgB,oBACd,MACA,OACuB;CACvB,MAAM,SAAgC;EAAE,GAAG;EAAM,GAAG;CAAM;CAE1D,IAAI,KAAK,UAAU,MAAM,QACvB,OAAO,SAAS;EAAE,GAAG,KAAK;EAAQ,GAAG,MAAM;CAAO;CAGpD,IAAI,KAAK,YAAY,MAAM,UACzB,OAAO,WAAW,OAAO,CAAC,GAAI,KAAK,YAAY,CAAC,GAAI,GAAI,MAAM,YAAY,CAAC,CAAE,CAAC;CAGhF,IAAI,KAAK,UAAU,MAAM,QACvB,OAAO,SAAS;EAAE,GAAG,KAAK;EAAQ,GAAG,MAAM;CAAO;CAGpD,IAAI,KAAK,WAAW,MAAM,SACxB,OAAO,UAAU,CAAC,GAAI,KAAK,WAAW,CAAC,GAAI,GAAI,MAAM,WAAW,CAAC,CAAE;CAGrE,OAAO;AACT;;;;;AAMA,SAAgB,OAAO,QAA4B;CACjD,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;;;;AAKA,eAAe,QACb,WACA,MACA,KACiB;CACjB,IAAI;EACF,OAAO,MAAM,IAAI;CACnB,SAAS,OAAO;EACd,MAAM,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAEnE,MAAM,IAAI,eACR,uBAAuB,UAAU,KAAK,kBAAkB,KAAK,IAAI,MAAM,6JAGvE,EAAE,OAAO,MAAM,CACjB;CACF;AACF"}

package/esm/production/bundle-framework-dependencies.mjs

@@ -2,7 +2,7 @@ import { isBuiltin } from "node:module";
 import path from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 
-//#region ../core/src/production/bundle-framework-dependencies.ts
+//#region ../../packages/core/src/production/bundle-framework-dependencies.ts
 /**
 * The package name a bare specifier addresses, discarding any subpath:
 * `ajv/dist/jtd` → `ajv`, `@fastify/static/lib/x` → `@fastify/static`.

package/esm/production/bundle-framework-dependencies.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-framework-dependencies.mjs","names":[],"sources":["../../../../../../../core/src/production/bundle-framework-dependencies.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { isBuiltin } from \"node:module\";\nimport path from \"node:path\";\nimport type { Plugin } from \"esbuild\";\n\n/**\n * The package name a bare specifier addresses, discarding any subpath:\n * `ajv/dist/jtd` → `ajv`, `@fastify/static/lib/x` → `@fastify/static`.\n */\nexport function packageNameOfSpecifier(specifier: string): string {\n  const segments = specifier.split(\"/\");\n\n  return specifier.startsWith(\"@\") ? segments.slice(0, 2).join(\"/\") : (segments[0] ?? specifier);\n}\n\n/**\n * A specifier Node would resolve through `node_modules` — not a path. Both\n * separators are rejected because esbuild hands plugins Windows paths as\n * written, and `path.isAbsolute` is what catches a drive-letter root.\n */\nexport function isBareSpecifier(specifier: string): boolean {\n  return (\n    specifier.length > 0 &&\n    !specifier.startsWith(\".\") &&\n    !specifier.startsWith(\"/\") &&\n    !specifier.startsWith(\"\\\\\") &&\n    !path.isAbsolute(specifier)\n  );\n}\n\n/**\n * The `dependencies` of the package that owns `file`, or `undefined` when the\n * walk reaches the filesystem root without finding a package.\n *\n * **The nearest `package.json` is not necessarily the owner.** Packages\n * publish TYPE-MARKER manifests — `glob/dist/commonjs/package.json` is the\n * two-line `{\"type\":\"commonjs\"}` that tells Node how to read the files beside\n * it — and a walk that stops at the first `package.json` it sees stops there,\n * reads no `dependencies`, and concludes the package declares nothing. Every\n * import from such a directory is then judged undeclared: `glob`'s own\n * `require(\"path-scurry\")` was left external and the built app died on it at\n * startup. A manifest with no `name` is not a package, so the walk continues\n * past it.\n */\nfunction findOwningDependencies(file: string): ReadonlySet<string> | undefined {\n  let dir = path.dirname(file);\n\n  for (;;) {\n    const manifestPath = path.join(dir, \"package.json\");\n\n    if (existsSync(manifestPath)) {\n      try {\n        const manifest = JSON.parse(readFileSync(manifestPath, \"utf8\")) as {\n          name?: string;\n          dependencies?: Record<string, string>;\n        };\n\n        if (typeof manifest.name === \"string\" && manifest.name.length > 0) {\n          return new Set(Object.keys(manifest.dependencies ?? {}));\n        }\n      } catch {\n        // An unreadable or malformed manifest is not evidence about\n        // anything. Keep walking; the enclosing package may still answer.\n      }\n    }\n\n    const parent = path.dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n}\n\n/**\n * Whether `file` is code the APP owns — inside the app root and not inside\n * any `node_modules` below it. A file under `node_modules` is a package's\n * code that happens to sit beneath the app directory, which is the opposite\n * of what this asks.\n */\nfunction isAppOwnedFile(file: string, appRoot: string): boolean {\n  const relative = path.relative(appRoot, file);\n\n  if (relative.startsWith(\"..\") || path.isAbsolute(relative)) return false;\n\n  return !relative.split(/[\\\\/]/).includes(\"node_modules\");\n}\n\n/**\n * Decide, per import edge, whether a bare specifier stays a bare specifier in\n * the emitted bundle or is bundled into it.\n *\n * **The defect.** The bundler ran `packages: \"external\"`, so EVERY bare\n * specifier survived verbatim into an artifact that Node then resolves from\n * the artifact's own location — inside the app's `dist/`. That is right for\n * the app's own dependencies and wrong for everything else, because the\n * bundle does not contain only app code: `buildAliasMapFromTsconfig` maps\n * `@warlock.js/*` onto its on-disk SOURCE (mandatory — those packages have\n * no built output in a source checkout, canon `5f684f28`), so the framework's\n * own compiled source is inlined into the app's bundle, and with it the bare\n * `@fastify/http-proxy`, `find-my-way`, `fast-jwt` and `@mongez/*` imports it\n * makes. The app never declared any of those. Under npm/yarn hoisting they\n * resolve by accident; under a strict pnpm tree the built app cannot boot.\n *\n * `assertGeneratedImports` already refuses this for the code the builder\n * GENERATES. This is the same rule for the framework source that generated\n * code pulls in — the half no assertion could reach, because rewriting the\n * import is not an option there: the framework is entitled to its own\n * dependencies.\n *\n * **The rule.** A bare specifier is external — today's behaviour, unchanged —\n * unless BOTH of:\n *\n * 1. the importer is not app-owned code, and\n * 2. the specifier names a package the importer's OWN package declares in\n *    `dependencies`.\n *\n * Then it is bundled, and esbuild resolves it from the importer, which is the\n * only resolution that can be correct: `@fastify/ajv-compiler` needs ajv 8\n * while another dependent needs ajv 6, and under pnpm each has its own nested\n * copy. A flat `alias` map cannot express that — it collapses a name to one\n * target for the whole build and produces exactly the \"Could not resolve\n * ajv/dist/jtd\" class of failure. Resolving per edge is not an optimisation\n * here; it is the difference between working and not.\n *\n * Condition 2 is what keeps canon `5f684f28` intact. An optional peer reached\n * through `await import(...)` — `nodemailer`, `socket.io`, `vite`, the AI\n * SDKs — is declared as a `peerDependency`, never a `dependency`, precisely\n * because it may not be installed at all. Reading only `dependencies` leaves\n * every one of them external without needing a list of their names to\n * maintain, which is the failure mode a hand-written exclusion list has.\n *\n * Transitivity falls out rather than being coded: once `@fastify/http-proxy`\n * is bundled, IT is a non-app-owned importer, so its own `@fastify/reply-from`\n * dependency is judged by the same two conditions and resolved from\n * http-proxy's directory — the nested copy Node itself would have loaded.\n */\nexport function bundleFrameworkDependencies(options: {\n  appRoot: string;\n  /**\n   * The keys of the esbuild `alias` map this same build is configured with.\n   *\n   * They MUST be excluded here, and the reason is a trap worth naming: an\n   * `onResolve` callback pre-empts esbuild's built-in resolver, and `alias`\n   * lives in that resolver. A plugin that answers `external: true` for\n   * `@warlock.js/core` therefore beats the alias pointing it at core's\n   * source — the framework silently stops being bundled at all, the build\n   * still succeeds, and the artifact is a 2.8 KB entry file importing a\n   * package the app cannot resolve. Returning `undefined` for these hands\n   * them back to the resolver, alias intact.\n   *\n   * Matched as esbuild matches them: the exact key, or the key followed by a\n   * subpath.\n   */\n  aliasKeys: readonly string[];\n}): Plugin {\n  const appRoot = path.resolve(options.appRoot);\n  const aliasKeys = [...options.aliasKeys];\n\n  function isAliased(specifier: string): boolean {\n    return aliasKeys.some((key) => specifier === key || specifier.startsWith(`${key}/`));\n  }\n\n  // Keyed by the importer's DIRECTORY: the walk and the manifest read are\n  // identical for every file in it, and a bundle of this size resolves\n  // thousands of edges out of a few hundred directories.\n  const dependenciesByDir = new Map<string, ReadonlySet<string> | undefined>();\n\n  function declaredDependenciesOf(importer: string): ReadonlySet<string> | undefined {\n    const dir = path.dirname(importer);\n    if (dependenciesByDir.has(dir)) return dependenciesByDir.get(dir);\n\n    const result = findOwningDependencies(importer);\n    dependenciesByDir.set(dir, result);\n\n    return result;\n  }\n\n  return {\n    name: \"warlock:bundle-framework-dependencies\",\n    setup(build) {\n      // Everything is inspected and the bare-specifier test is made in code:\n      // a `filter` cheap enough to be worth writing cannot tell `C:\\…` (an\n      // absolute Windows path, and what the tsconfig aliases resolve to) from\n      // a package called `c`. Externalising one of those would be silent and\n      // fatal.\n      build.onResolve({ filter: /.*/ }, (args) => {\n        if (args.namespace !== \"file\" && args.namespace !== \"\") return undefined;\n\n        const specifier = args.path;\n\n        if (!isBareSpecifier(specifier)) return undefined;\n\n        if (isAliased(specifier)) return undefined;\n\n        // A builtin is never external in the sense that matters — esbuild\n        // already leaves `node:fs` alone and Node always has it.\n        if (specifier.startsWith(\"node:\") || isBuiltin(specifier)) return undefined;\n\n        const importer = args.importer;\n\n        // Nothing on disk to ask. An entry point has no importer at all, and\n        // a virtual or generated importer has no package around it — either\n        // way there is no manifest that could declare this, so it keeps the\n        // behaviour it had before this plugin existed.\n        if (!importer || !path.isAbsolute(importer)) {\n          return { path: specifier, external: true };\n        }\n\n        if (isAppOwnedFile(importer, appRoot)) {\n          return { path: specifier, external: true };\n        }\n\n        const declared = declaredDependenciesOf(importer);\n\n        if (!declared?.has(packageNameOfSpecifier(specifier))) {\n          return { path: specifier, external: true };\n        }\n\n        // Declared by the package that imports it: let esbuild's own\n        // resolver take it, from this importer, and bundle the result.\n        return undefined;\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;AASA,SAAgB,uBAAuB,WAA2B;CAChE,MAAM,WAAW,UAAU,MAAM,GAAG;CAEpC,OAAO,UAAU,WAAW,GAAG,IAAI,SAAS,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAK,SAAS,MAAM;AACtF;;;;;;AAOA,SAAgB,gBAAgB,WAA4B;CAC1D,OACE,UAAU,SAAS,KACnB,CAAC,UAAU,WAAW,GAAG,KACzB,CAAC,UAAU,WAAW,GAAG,KACzB,CAAC,UAAU,WAAW,IAAI,KAC1B,CAAC,KAAK,WAAW,SAAS;AAE9B;;;;;;;;;;;;;;;AAgBA,SAAS,uBAAuB,MAA+C;CAC7E,IAAI,MAAM,KAAK,QAAQ,IAAI;CAE3B,SAAS;EACP,MAAM,eAAe,KAAK,KAAK,KAAK,cAAc;EAElD,IAAI,WAAW,YAAY,GACzB,IAAI;GACF,MAAM,WAAW,KAAK,MAAM,aAAa,cAAc,MAAM,CAAC;GAK9D,IAAI,OAAO,SAAS,SAAS,YAAY,SAAS,KAAK,SAAS,GAC9D,OAAO,IAAI,IAAI,OAAO,KAAK,SAAS,gBAAgB,CAAC,CAAC,CAAC;EAE3D,QAAQ,CAGR;EAGF,MAAM,SAAS,KAAK,QAAQ,GAAG;EAC/B,IAAI,WAAW,KAAK,OAAO;EAC3B,MAAM;CACR;AACF;;;;;;;AAQA,SAAS,eAAe,MAAc,SAA0B;CAC9D,MAAM,WAAW,KAAK,SAAS,SAAS,IAAI;CAE5C,IAAI,SAAS,WAAW,IAAI,KAAK,KAAK,WAAW,QAAQ,GAAG,OAAO;CAEnE,OAAO,CAAC,SAAS,MAAM,OAAO,CAAC,CAAC,SAAS,cAAc;AACzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,4BAA4B,SAkBjC;CACT,MAAM,UAAU,KAAK,QAAQ,QAAQ,OAAO;CAC5C,MAAM,YAAY,CAAC,GAAG,QAAQ,SAAS;CAEvC,SAAS,UAAU,WAA4B;EAC7C,OAAO,UAAU,MAAM,QAAQ,cAAc,OAAO,UAAU,WAAW,GAAG,IAAI,EAAE,CAAC;CACrF;CAKA,MAAM,oCAAoB,IAAI,IAA6C;CAE3E,SAAS,uBAAuB,UAAmD;EACjF,MAAM,MAAM,KAAK,QAAQ,QAAQ;EACjC,IAAI,kBAAkB,IAAI,GAAG,GAAG,OAAO,kBAAkB,IAAI,GAAG;EAEhE,MAAM,SAAS,uBAAuB,QAAQ;EAC9C,kBAAkB,IAAI,KAAK,MAAM;EAEjC,OAAO;CACT;CAEA,OAAO;EACL,MAAM;EACN,MAAM,OAAO;GAMX,MAAM,UAAU,EAAE,QAAQ,KAAK,IAAI,SAAS;IAC1C,IAAI,KAAK,cAAc,UAAU,KAAK,cAAc,IAAI,OAAO;IAE/D,MAAM,YAAY,KAAK;IAEvB,IAAI,CAAC,gBAAgB,SAAS,GAAG,OAAO;IAExC,IAAI,UAAU,SAAS,GAAG,OAAO;IAIjC,IAAI,UAAU,WAAW,OAAO,KAAK,UAAU,SAAS,GAAG,OAAO;IAElE,MAAM,WAAW,KAAK;IAMtB,IAAI,CAAC,YAAY,CAAC,KAAK,WAAW,QAAQ,GACxC,OAAO;KAAE,MAAM;KAAW,UAAU;IAAK;IAG3C,IAAI,eAAe,UAAU,OAAO,GAClC,OAAO;KAAE,MAAM;KAAW,UAAU;IAAK;IAK3C,IAAI,CAFa,uBAAuB,QAE5B,CAAC,EAAE,IAAI,uBAAuB,SAAS,CAAC,GAClD,OAAO;KAAE,MAAM;KAAW,UAAU;IAAK;GAM7C,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"bundle-framework-dependencies.mjs","names":[],"sources":["../../../../../../../../packages/core/src/production/bundle-framework-dependencies.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { isBuiltin } from \"node:module\";\nimport path from \"node:path\";\nimport type { Plugin } from \"esbuild\";\n\n/**\n * The package name a bare specifier addresses, discarding any subpath:\n * `ajv/dist/jtd` → `ajv`, `@fastify/static/lib/x` → `@fastify/static`.\n */\nexport function packageNameOfSpecifier(specifier: string): string {\n  const segments = specifier.split(\"/\");\n\n  return specifier.startsWith(\"@\") ? segments.slice(0, 2).join(\"/\") : (segments[0] ?? specifier);\n}\n\n/**\n * A specifier Node would resolve through `node_modules` — not a path. Both\n * separators are rejected because esbuild hands plugins Windows paths as\n * written, and `path.isAbsolute` is what catches a drive-letter root.\n */\nexport function isBareSpecifier(specifier: string): boolean {\n  return (\n    specifier.length > 0 &&\n    !specifier.startsWith(\".\") &&\n    !specifier.startsWith(\"/\") &&\n    !specifier.startsWith(\"\\\\\") &&\n    !path.isAbsolute(specifier)\n  );\n}\n\n/**\n * The `dependencies` of the package that owns `file`, or `undefined` when the\n * walk reaches the filesystem root without finding a package.\n *\n * **The nearest `package.json` is not necessarily the owner.** Packages\n * publish TYPE-MARKER manifests — `glob/dist/commonjs/package.json` is the\n * two-line `{\"type\":\"commonjs\"}` that tells Node how to read the files beside\n * it — and a walk that stops at the first `package.json` it sees stops there,\n * reads no `dependencies`, and concludes the package declares nothing. Every\n * import from such a directory is then judged undeclared: `glob`'s own\n * `require(\"path-scurry\")` was left external and the built app died on it at\n * startup. A manifest with no `name` is not a package, so the walk continues\n * past it.\n */\nfunction findOwningDependencies(file: string): ReadonlySet<string> | undefined {\n  let dir = path.dirname(file);\n\n  for (;;) {\n    const manifestPath = path.join(dir, \"package.json\");\n\n    if (existsSync(manifestPath)) {\n      try {\n        const manifest = JSON.parse(readFileSync(manifestPath, \"utf8\")) as {\n          name?: string;\n          dependencies?: Record<string, string>;\n        };\n\n        if (typeof manifest.name === \"string\" && manifest.name.length > 0) {\n          return new Set(Object.keys(manifest.dependencies ?? {}));\n        }\n      } catch {\n        // An unreadable or malformed manifest is not evidence about\n        // anything. Keep walking; the enclosing package may still answer.\n      }\n    }\n\n    const parent = path.dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n}\n\n/**\n * Whether `file` is code the APP owns — inside the app root and not inside\n * any `node_modules` below it. A file under `node_modules` is a package's\n * code that happens to sit beneath the app directory, which is the opposite\n * of what this asks.\n */\nfunction isAppOwnedFile(file: string, appRoot: string): boolean {\n  const relative = path.relative(appRoot, file);\n\n  if (relative.startsWith(\"..\") || path.isAbsolute(relative)) return false;\n\n  return !relative.split(/[\\\\/]/).includes(\"node_modules\");\n}\n\n/**\n * Decide, per import edge, whether a bare specifier stays a bare specifier in\n * the emitted bundle or is bundled into it.\n *\n * **The defect.** The bundler ran `packages: \"external\"`, so EVERY bare\n * specifier survived verbatim into an artifact that Node then resolves from\n * the artifact's own location — inside the app's `dist/`. That is right for\n * the app's own dependencies and wrong for everything else, because the\n * bundle does not contain only app code: `buildAliasMapFromTsconfig` maps\n * `@warlock.js/*` onto its on-disk SOURCE (mandatory — those packages have\n * no built output in a source checkout, canon `5f684f28`), so the framework's\n * own compiled source is inlined into the app's bundle, and with it the bare\n * `@fastify/http-proxy`, `find-my-way`, `fast-jwt` and `@mongez/*` imports it\n * makes. The app never declared any of those. Under npm/yarn hoisting they\n * resolve by accident; under a strict pnpm tree the built app cannot boot.\n *\n * `assertGeneratedImports` already refuses this for the code the builder\n * GENERATES. This is the same rule for the framework source that generated\n * code pulls in — the half no assertion could reach, because rewriting the\n * import is not an option there: the framework is entitled to its own\n * dependencies.\n *\n * **The rule.** A bare specifier is external — today's behaviour, unchanged —\n * unless BOTH of:\n *\n * 1. the importer is not app-owned code, and\n * 2. the specifier names a package the importer's OWN package declares in\n *    `dependencies`.\n *\n * Then it is bundled, and esbuild resolves it from the importer, which is the\n * only resolution that can be correct: `@fastify/ajv-compiler` needs ajv 8\n * while another dependent needs ajv 6, and under pnpm each has its own nested\n * copy. A flat `alias` map cannot express that — it collapses a name to one\n * target for the whole build and produces exactly the \"Could not resolve\n * ajv/dist/jtd\" class of failure. Resolving per edge is not an optimisation\n * here; it is the difference between working and not.\n *\n * Condition 2 is what keeps canon `5f684f28` intact. An optional peer reached\n * through `await import(...)` — `nodemailer`, `socket.io`, `vite`, the AI\n * SDKs — is declared as a `peerDependency`, never a `dependency`, precisely\n * because it may not be installed at all. Reading only `dependencies` leaves\n * every one of them external without needing a list of their names to\n * maintain, which is the failure mode a hand-written exclusion list has.\n *\n * Transitivity falls out rather than being coded: once `@fastify/http-proxy`\n * is bundled, IT is a non-app-owned importer, so its own `@fastify/reply-from`\n * dependency is judged by the same two conditions and resolved from\n * http-proxy's directory — the nested copy Node itself would have loaded.\n */\nexport function bundleFrameworkDependencies(options: {\n  appRoot: string;\n  /**\n   * The keys of the esbuild `alias` map this same build is configured with.\n   *\n   * They MUST be excluded here, and the reason is a trap worth naming: an\n   * `onResolve` callback pre-empts esbuild's built-in resolver, and `alias`\n   * lives in that resolver. A plugin that answers `external: true` for\n   * `@warlock.js/core` therefore beats the alias pointing it at core's\n   * source — the framework silently stops being bundled at all, the build\n   * still succeeds, and the artifact is a 2.8 KB entry file importing a\n   * package the app cannot resolve. Returning `undefined` for these hands\n   * them back to the resolver, alias intact.\n   *\n   * Matched as esbuild matches them: the exact key, or the key followed by a\n   * subpath.\n   */\n  aliasKeys: readonly string[];\n}): Plugin {\n  const appRoot = path.resolve(options.appRoot);\n  const aliasKeys = [...options.aliasKeys];\n\n  function isAliased(specifier: string): boolean {\n    return aliasKeys.some((key) => specifier === key || specifier.startsWith(`${key}/`));\n  }\n\n  // Keyed by the importer's DIRECTORY: the walk and the manifest read are\n  // identical for every file in it, and a bundle of this size resolves\n  // thousands of edges out of a few hundred directories.\n  const dependenciesByDir = new Map<string, ReadonlySet<string> | undefined>();\n\n  function declaredDependenciesOf(importer: string): ReadonlySet<string> | undefined {\n    const dir = path.dirname(importer);\n    if (dependenciesByDir.has(dir)) return dependenciesByDir.get(dir);\n\n    const result = findOwningDependencies(importer);\n    dependenciesByDir.set(dir, result);\n\n    return result;\n  }\n\n  return {\n    name: \"warlock:bundle-framework-dependencies\",\n    setup(build) {\n      // Everything is inspected and the bare-specifier test is made in code:\n      // a `filter` cheap enough to be worth writing cannot tell `C:\\…` (an\n      // absolute Windows path, and what the tsconfig aliases resolve to) from\n      // a package called `c`. Externalising one of those would be silent and\n      // fatal.\n      build.onResolve({ filter: /.*/ }, (args) => {\n        if (args.namespace !== \"file\" && args.namespace !== \"\") return undefined;\n\n        const specifier = args.path;\n\n        if (!isBareSpecifier(specifier)) return undefined;\n\n        if (isAliased(specifier)) return undefined;\n\n        // A builtin is never external in the sense that matters — esbuild\n        // already leaves `node:fs` alone and Node always has it.\n        if (specifier.startsWith(\"node:\") || isBuiltin(specifier)) return undefined;\n\n        const importer = args.importer;\n\n        // Nothing on disk to ask. An entry point has no importer at all, and\n        // a virtual or generated importer has no package around it — either\n        // way there is no manifest that could declare this, so it keeps the\n        // behaviour it had before this plugin existed.\n        if (!importer || !path.isAbsolute(importer)) {\n          return { path: specifier, external: true };\n        }\n\n        if (isAppOwnedFile(importer, appRoot)) {\n          return { path: specifier, external: true };\n        }\n\n        const declared = declaredDependenciesOf(importer);\n\n        if (!declared?.has(packageNameOfSpecifier(specifier))) {\n          return { path: specifier, external: true };\n        }\n\n        // Declared by the package that imports it: let esbuild's own\n        // resolver take it, from this importer, and bundle the result.\n        return undefined;\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;AASA,SAAgB,uBAAuB,WAA2B;CAChE,MAAM,WAAW,UAAU,MAAM,GAAG;CAEpC,OAAO,UAAU,WAAW,GAAG,IAAI,SAAS,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAK,SAAS,MAAM;AACtF;;;;;;AAOA,SAAgB,gBAAgB,WAA4B;CAC1D,OACE,UAAU,SAAS,KACnB,CAAC,UAAU,WAAW,GAAG,KACzB,CAAC,UAAU,WAAW,GAAG,KACzB,CAAC,UAAU,WAAW,IAAI,KAC1B,CAAC,KAAK,WAAW,SAAS;AAE9B;;;;;;;;;;;;;;;AAgBA,SAAS,uBAAuB,MAA+C;CAC7E,IAAI,MAAM,KAAK,QAAQ,IAAI;CAE3B,SAAS;EACP,MAAM,eAAe,KAAK,KAAK,KAAK,cAAc;EAElD,IAAI,WAAW,YAAY,GACzB,IAAI;GACF,MAAM,WAAW,KAAK,MAAM,aAAa,cAAc,MAAM,CAAC;GAK9D,IAAI,OAAO,SAAS,SAAS,YAAY,SAAS,KAAK,SAAS,GAC9D,OAAO,IAAI,IAAI,OAAO,KAAK,SAAS,gBAAgB,CAAC,CAAC,CAAC;EAE3D,QAAQ,CAGR;EAGF,MAAM,SAAS,KAAK,QAAQ,GAAG;EAC/B,IAAI,WAAW,KAAK,OAAO;EAC3B,MAAM;CACR;AACF;;;;;;;AAQA,SAAS,eAAe,MAAc,SAA0B;CAC9D,MAAM,WAAW,KAAK,SAAS,SAAS,IAAI;CAE5C,IAAI,SAAS,WAAW,IAAI,KAAK,KAAK,WAAW,QAAQ,GAAG,OAAO;CAEnE,OAAO,CAAC,SAAS,MAAM,OAAO,CAAC,CAAC,SAAS,cAAc;AACzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,4BAA4B,SAkBjC;CACT,MAAM,UAAU,KAAK,QAAQ,QAAQ,OAAO;CAC5C,MAAM,YAAY,CAAC,GAAG,QAAQ,SAAS;CAEvC,SAAS,UAAU,WAA4B;EAC7C,OAAO,UAAU,MAAM,QAAQ,cAAc,OAAO,UAAU,WAAW,GAAG,IAAI,EAAE,CAAC;CACrF;CAKA,MAAM,oCAAoB,IAAI,IAA6C;CAE3E,SAAS,uBAAuB,UAAmD;EACjF,MAAM,MAAM,KAAK,QAAQ,QAAQ;EACjC,IAAI,kBAAkB,IAAI,GAAG,GAAG,OAAO,kBAAkB,IAAI,GAAG;EAEhE,MAAM,SAAS,uBAAuB,QAAQ;EAC9C,kBAAkB,IAAI,KAAK,MAAM;EAEjC,OAAO;CACT;CAEA,OAAO;EACL,MAAM;EACN,MAAM,OAAO;GAMX,MAAM,UAAU,EAAE,QAAQ,KAAK,IAAI,SAAS;IAC1C,IAAI,KAAK,cAAc,UAAU,KAAK,cAAc,IAAI,OAAO;IAE/D,MAAM,YAAY,KAAK;IAEvB,IAAI,CAAC,gBAAgB,SAAS,GAAG,OAAO;IAExC,IAAI,UAAU,SAAS,GAAG,OAAO;IAIjC,IAAI,UAAU,WAAW,OAAO,KAAK,UAAU,SAAS,GAAG,OAAO;IAElE,MAAM,WAAW,KAAK;IAMtB,IAAI,CAAC,YAAY,CAAC,KAAK,WAAW,QAAQ,GACxC,OAAO;KAAE,MAAM;KAAW,UAAU;IAAK;IAG3C,IAAI,eAAe,UAAU,OAAO,GAClC,OAAO;KAAE,MAAM;KAAW,UAAU;IAAK;IAK3C,IAAI,CAFa,uBAAuB,QAE5B,CAAC,EAAE,IAAI,uBAAuB,SAAS,CAAC,GAClD,OAAO;KAAE,MAAM;KAAW,UAAU;IAAK;GAM7C,CAAC;EACH;CACF;AACF"}

package/esm/production/dist-build-manifest.mjs

@@ -1,7 +1,7 @@
 import path from "path";
 import { getJsonFileAsync, putJsonFileAsync } from "@warlock.js/fs";
 
-//#region ../core/src/production/dist-build-manifest.ts
+//#region ../../packages/core/src/production/dist-build-manifest.ts
 /**
 * Name of the marker file `warlock build` writes into the output directory
 * as the last step before promoting it to `dist`, and the only thing

package/esm/production/dist-build-manifest.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dist-build-manifest.mjs","names":[],"sources":["../../../../../../../core/src/production/dist-build-manifest.ts"],"sourcesContent":["import { getJsonFileAsync, putJsonFileAsync } from \"@warlock.js/fs\";\nimport path from \"path\";\n\n/**\n * Name of the marker file `warlock build` writes into the output directory\n * as the last step before promoting it to `dist`, and the only thing\n * `warlock start` trusts to tell a genuine build from stale or\n * hand-assembled output.\n *\n * Hidden (leading dot) so it never collides with a route, a static asset, or\n * anything an app might legitimately name `manifest.json`.\n */\nexport const DIST_BUILD_MANIFEST_FILE_NAME = \".warlock-build.json\";\n\n/**\n * Recorded once, at the end of a build that reached the promote step. Its\n * presence — with `status: \"success\"` — is the whole contract `warlock\n * start` checks. Not any particular output file, which a future build shape\n * could rename or drop.\n */\nexport type DistBuildManifest = {\n  status: \"success\";\n  builtAt: string;\n};\n\n/**\n * Write the build-success marker into an output directory (the temp\n * directory a build assembled, before it is promoted to `dist`).\n */\nexport async function writeDistBuildManifestAsync(directory: string): Promise<void> {\n  const manifest: DistBuildManifest = {\n    status: \"success\",\n    builtAt: new Date().toISOString(),\n  };\n\n  await putJsonFileAsync(path.join(directory, DIST_BUILD_MANIFEST_FILE_NAME), manifest);\n}\n\n/**\n * Read the build-success marker out of `dist`.\n *\n * Returns `undefined` for every way the marker can fail to back a real\n * build: missing, unreadable, malformed JSON, or present without\n * `status: \"success\"`. \"Never built\", \"build failed before promoting\", and\n * \"someone hand-edited dist\" all collapse to the same outcome, because\n * `warlock start` treats them identically — refuse, and say why.\n */\nexport async function readDistBuildManifestAsync(\n  directory: string,\n): Promise<DistBuildManifest | undefined> {\n  try {\n    const manifest = await getJsonFileAsync<DistBuildManifest>(\n      path.join(directory, DIST_BUILD_MANIFEST_FILE_NAME),\n    );\n\n    if (manifest?.status !== \"success\") {\n      return undefined;\n    }\n\n    return manifest;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,MAAa,gCAAgC;;;;;AAiB7C,eAAsB,4BAA4B,WAAkC;CAClF,MAAM,WAA8B;EAClC,QAAQ;EACR,0BAAS,IAAI,KAAK,EAAC,CAAC,YAAY;CAClC;CAEA,MAAM,iBAAiB,KAAK,KAAK,WAAW,6BAA6B,GAAG,QAAQ;AACtF;;;;;;;;;;AAWA,eAAsB,2BACpB,WACwC;CACxC,IAAI;EACF,MAAM,WAAW,MAAM,iBACrB,KAAK,KAAK,WAAW,6BAA6B,CACpD;EAEA,IAAI,UAAU,WAAW,WACvB;EAGF,OAAO;CACT,QAAQ;EACN;CACF;AACF"}
+{"version":3,"file":"dist-build-manifest.mjs","names":[],"sources":["../../../../../../../../packages/core/src/production/dist-build-manifest.ts"],"sourcesContent":["import { getJsonFileAsync, putJsonFileAsync } from \"@warlock.js/fs\";\nimport path from \"path\";\n\n/**\n * Name of the marker file `warlock build` writes into the output directory\n * as the last step before promoting it to `dist`, and the only thing\n * `warlock start` trusts to tell a genuine build from stale or\n * hand-assembled output.\n *\n * Hidden (leading dot) so it never collides with a route, a static asset, or\n * anything an app might legitimately name `manifest.json`.\n */\nexport const DIST_BUILD_MANIFEST_FILE_NAME = \".warlock-build.json\";\n\n/**\n * Recorded once, at the end of a build that reached the promote step. Its\n * presence — with `status: \"success\"` — is the whole contract `warlock\n * start` checks. Not any particular output file, which a future build shape\n * could rename or drop.\n */\nexport type DistBuildManifest = {\n  status: \"success\";\n  builtAt: string;\n};\n\n/**\n * Write the build-success marker into an output directory (the temp\n * directory a build assembled, before it is promoted to `dist`).\n */\nexport async function writeDistBuildManifestAsync(directory: string): Promise<void> {\n  const manifest: DistBuildManifest = {\n    status: \"success\",\n    builtAt: new Date().toISOString(),\n  };\n\n  await putJsonFileAsync(path.join(directory, DIST_BUILD_MANIFEST_FILE_NAME), manifest);\n}\n\n/**\n * Read the build-success marker out of `dist`.\n *\n * Returns `undefined` for every way the marker can fail to back a real\n * build: missing, unreadable, malformed JSON, or present without\n * `status: \"success\"`. \"Never built\", \"build failed before promoting\", and\n * \"someone hand-edited dist\" all collapse to the same outcome, because\n * `warlock start` treats them identically — refuse, and say why.\n */\nexport async function readDistBuildManifestAsync(\n  directory: string,\n): Promise<DistBuildManifest | undefined> {\n  try {\n    const manifest = await getJsonFileAsync<DistBuildManifest>(\n      path.join(directory, DIST_BUILD_MANIFEST_FILE_NAME),\n    );\n\n    if (manifest?.status !== \"success\") {\n      return undefined;\n    }\n\n    return manifest;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,MAAa,gCAAgC;;;;;AAiB7C,eAAsB,4BAA4B,WAAkC;CAClF,MAAM,WAA8B;EAClC,QAAQ;EACR,0BAAS,IAAI,KAAK,EAAC,CAAC,YAAY;CAClC;CAEA,MAAM,iBAAiB,KAAK,KAAK,WAAW,6BAA6B,GAAG,QAAQ;AACtF;;;;;;;;;;AAWA,eAAsB,2BACpB,WACwC;CACxC,IAAI;EACF,MAAM,WAAW,MAAM,iBACrB,KAAK,KAAK,WAAW,6BAA6B,CACpD;EAEA,IAAI,UAAU,WAAW,WACvB;EAGF,OAAO;CACT,QAAQ;EACN;CACF;AACF"}

package/esm/production/esbuild-plugins.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 
-//#region ../core/src/production/esbuild-plugins.ts
+//#region ../../packages/core/src/production/esbuild-plugins.ts
 const esmRequire = createRequire(import.meta.url);
 const nativeNodeModulesPlugin = {
 	name: "native-node-modules",

package/esm/production/esbuild-plugins.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-plugins.mjs","names":[],"sources":["../../../../../../../core/src/production/esbuild-plugins.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport type { OnLoadArgs, OnResolveArgs, PluginBuild } from \"esbuild\";\n\nconst esmRequire = createRequire(import.meta.url);\n\nexport const nativeNodeModulesPlugin = {\n  name: \"native-node-modules\",\n  setup(build: PluginBuild) {\n    build.onResolve({ filter: /\\.node$/, namespace: \"file\" }, (args: OnResolveArgs) => ({\n      path: esmRequire.resolve(args.path, { paths: [args.resolveDir] }),\n      namespace: \"node-file\",\n    }));\n\n    build.onLoad({ filter: /.*/, namespace: \"node-file\" }, (args: OnLoadArgs) => ({\n      contents: `\n          import path from ${JSON.stringify(args.path)}\n          try { module.exports = require(path) }\n          catch {}\n        `,\n    }));\n\n    build.onResolve({ filter: /\\.node$/, namespace: \"node-file\" }, (args: OnResolveArgs) => ({\n      path: args.path,\n      namespace: \"file\",\n    }));\n\n    const opts = build.initialOptions;\n    opts.loader = opts.loader || {};\n    opts.loader[\".node\"] = \"file\";\n  },\n};\n"],"mappings":";;;AAGA,MAAM,aAAa,cAAc,OAAO,KAAK,GAAG;AAEhD,MAAa,0BAA0B;CACrC,MAAM;CACN,MAAM,OAAoB;EACxB,MAAM,UAAU;GAAE,QAAQ;GAAW,WAAW;EAAO,IAAI,UAAyB;GAClF,MAAM,WAAW,QAAQ,KAAK,MAAM,EAAE,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;GAChE,WAAW;EACb,EAAE;EAEF,MAAM,OAAO;GAAE,QAAQ;GAAM,WAAW;EAAY,IAAI,UAAsB,EAC5E,UAAU;6BACa,KAAK,UAAU,KAAK,IAAI,EAAE;;;UAInD,EAAE;EAEF,MAAM,UAAU;GAAE,QAAQ;GAAW,WAAW;EAAY,IAAI,UAAyB;GACvF,MAAM,KAAK;GACX,WAAW;EACb,EAAE;EAEF,MAAM,OAAO,MAAM;EACnB,KAAK,SAAS,KAAK,UAAU,CAAC;EAC9B,KAAK,OAAO,WAAW;CACzB;AACF"}
+{"version":3,"file":"esbuild-plugins.mjs","names":[],"sources":["../../../../../../../../packages/core/src/production/esbuild-plugins.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport type { OnLoadArgs, OnResolveArgs, PluginBuild } from \"esbuild\";\n\nconst esmRequire = createRequire(import.meta.url);\n\nexport const nativeNodeModulesPlugin = {\n  name: \"native-node-modules\",\n  setup(build: PluginBuild) {\n    build.onResolve({ filter: /\\.node$/, namespace: \"file\" }, (args: OnResolveArgs) => ({\n      path: esmRequire.resolve(args.path, { paths: [args.resolveDir] }),\n      namespace: \"node-file\",\n    }));\n\n    build.onLoad({ filter: /.*/, namespace: \"node-file\" }, (args: OnLoadArgs) => ({\n      contents: `\n          import path from ${JSON.stringify(args.path)}\n          try { module.exports = require(path) }\n          catch {}\n        `,\n    }));\n\n    build.onResolve({ filter: /\\.node$/, namespace: \"node-file\" }, (args: OnResolveArgs) => ({\n      path: args.path,\n      namespace: \"file\",\n    }));\n\n    const opts = build.initialOptions;\n    opts.loader = opts.loader || {};\n    opts.loader[\".node\"] = \"file\";\n  },\n};\n"],"mappings":";;;AAGA,MAAM,aAAa,cAAc,OAAO,KAAK,GAAG;AAEhD,MAAa,0BAA0B;CACrC,MAAM;CACN,MAAM,OAAoB;EACxB,MAAM,UAAU;GAAE,QAAQ;GAAW,WAAW;EAAO,IAAI,UAAyB;GAClF,MAAM,WAAW,QAAQ,KAAK,MAAM,EAAE,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;GAChE,WAAW;EACb,EAAE;EAEF,MAAM,OAAO;GAAE,QAAQ;GAAM,WAAW;EAAY,IAAI,UAAsB,EAC5E,UAAU;6BACa,KAAK,UAAU,KAAK,IAAI,EAAE;;;UAInD,EAAE;EAEF,MAAM,UAAU;GAAE,QAAQ;GAAW,WAAW;EAAY,IAAI,UAAyB;GACvF,MAAM,KAAK;GACX,WAAW;EACb,EAAE;EAEF,MAAM,OAAO,MAAM;EACnB,KAAK,SAAS,KAAK,UAAU,CAAC;EAC9B,KAAK,OAAO,WAAW;CACzB;AACF"}

package/esm/production/esbuild-preflight.mjs

@@ -1,7 +1,7 @@
 import { EsbuildBinaryMissingError } from "../errors/esbuild-binary-missing-error.mjs";
 import esbuild from "esbuild";
 
-//#region ../core/src/production/esbuild-preflight.ts
+//#region ../../packages/core/src/production/esbuild-preflight.ts
 /**
 * The exact substring esbuild's own loader throws when the platform-specific
 * binary package (e.g. `@esbuild/win32-x64`) never got installed. This is

package/esm/production/esbuild-preflight.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-preflight.mjs","names":[],"sources":["../../../../../../../core/src/production/esbuild-preflight.ts"],"sourcesContent":["import esbuild from \"esbuild\";\nimport { EsbuildBinaryMissingError } from \"../errors/esbuild-binary-missing-error\";\n\nexport { EsbuildBinaryMissingError };\n\n/**\n * The exact substring esbuild's own loader throws when the platform-specific\n * binary package (e.g. `@esbuild/win32-x64`) never got installed. This is\n * the signature pnpm's build-script approval gate leaves behind: it blocks\n * esbuild's postinstall script, so the binary is never linked into place,\n * and any later call into esbuild dies with this message instead of a\n * project-shaped one.\n *\n * Source: `pkgAndSubpathForCurrentPlatform` in esbuild's `lib/main.js`.\n */\nconst UNLINKED_BINARY_SIGNATURE = \"could not be found, and is needed by esbuild\";\n\n/**\n * A cheap operation that forces esbuild to resolve and invoke its platform\n * binary. Injectable so tests can simulate a missing binary without deleting\n * anything from a real install.\n */\nexport type EsbuildProbe = () => void;\n\n/**\n * The default probe: a trivial `transformSync` call. Trivial input keeps the\n * cost negligible while still forcing esbuild to resolve and run its native\n * binary, which is the only way an unlinked binary actually surfaces.\n */\nfunction runDefaultProbe(): void {\n  esbuild.transformSync(\"\", { loader: \"js\" });\n}\n\n/**\n * Fail fast, before dev or build does any other work, when esbuild's native\n * binary is not linked.\n *\n * A healthy esbuild install is a no-op. A binary genuinely missing — because\n * a platform package was never installed, or a package manager blocked its\n * postinstall script — is turned into {@link EsbuildBinaryMissingError}, a\n * message that names the cause and the fix. Any other failure (a real syntax\n * error, an unrelated platform mismatch, …) is rethrown unchanged — this\n * preflight only owns the one known failure mode.\n *\n * @param probe Overrides the default `esbuild.transformSync` invocation.\n * Intended for tests only.\n * @throws {EsbuildBinaryMissingError} when the platform binary is missing or unlinked.\n */\nexport function assertEsbuildBinaryIsLinked(probe: EsbuildProbe = runDefaultProbe): void {\n  try {\n    probe();\n  } catch (error) {\n    if (isUnlinkedBinaryError(error)) {\n      throw new EsbuildBinaryMissingError({ cause: error });\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Narrow an unknown thrown value down to esbuild's known \"binary not\n * linked\" failure, identified by the fixed substring esbuild itself throws.\n */\nfunction isUnlinkedBinaryError(error: unknown): boolean {\n  return error instanceof Error && error.message.includes(UNLINKED_BINARY_SIGNATURE);\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,MAAM,4BAA4B;;;;;;AAclC,SAAS,kBAAwB;CAC/B,QAAQ,cAAc,IAAI,EAAE,QAAQ,KAAK,CAAC;AAC5C;;;;;;;;;;;;;;;;AAiBA,SAAgB,4BAA4B,QAAsB,iBAAuB;CACvF,IAAI;EACF,MAAM;CACR,SAAS,OAAO;EACd,IAAI,sBAAsB,KAAK,GAC7B,MAAM,IAAI,0BAA0B,EAAE,OAAO,MAAM,CAAC;EAGtD,MAAM;CACR;AACF;;;;;AAMA,SAAS,sBAAsB,OAAyB;CACtD,OAAO,iBAAiB,SAAS,MAAM,QAAQ,SAAS,yBAAyB;AACnF"}
+{"version":3,"file":"esbuild-preflight.mjs","names":[],"sources":["../../../../../../../../packages/core/src/production/esbuild-preflight.ts"],"sourcesContent":["import esbuild from \"esbuild\";\nimport { EsbuildBinaryMissingError } from \"../errors/esbuild-binary-missing-error\";\n\nexport { EsbuildBinaryMissingError };\n\n/**\n * The exact substring esbuild's own loader throws when the platform-specific\n * binary package (e.g. `@esbuild/win32-x64`) never got installed. This is\n * the signature pnpm's build-script approval gate leaves behind: it blocks\n * esbuild's postinstall script, so the binary is never linked into place,\n * and any later call into esbuild dies with this message instead of a\n * project-shaped one.\n *\n * Source: `pkgAndSubpathForCurrentPlatform` in esbuild's `lib/main.js`.\n */\nconst UNLINKED_BINARY_SIGNATURE = \"could not be found, and is needed by esbuild\";\n\n/**\n * A cheap operation that forces esbuild to resolve and invoke its platform\n * binary. Injectable so tests can simulate a missing binary without deleting\n * anything from a real install.\n */\nexport type EsbuildProbe = () => void;\n\n/**\n * The default probe: a trivial `transformSync` call. Trivial input keeps the\n * cost negligible while still forcing esbuild to resolve and run its native\n * binary, which is the only way an unlinked binary actually surfaces.\n */\nfunction runDefaultProbe(): void {\n  esbuild.transformSync(\"\", { loader: \"js\" });\n}\n\n/**\n * Fail fast, before dev or build does any other work, when esbuild's native\n * binary is not linked.\n *\n * A healthy esbuild install is a no-op. A binary genuinely missing — because\n * a platform package was never installed, or a package manager blocked its\n * postinstall script — is turned into {@link EsbuildBinaryMissingError}, a\n * message that names the cause and the fix. Any other failure (a real syntax\n * error, an unrelated platform mismatch, …) is rethrown unchanged — this\n * preflight only owns the one known failure mode.\n *\n * @param probe Overrides the default `esbuild.transformSync` invocation.\n * Intended for tests only.\n * @throws {EsbuildBinaryMissingError} when the platform binary is missing or unlinked.\n */\nexport function assertEsbuildBinaryIsLinked(probe: EsbuildProbe = runDefaultProbe): void {\n  try {\n    probe();\n  } catch (error) {\n    if (isUnlinkedBinaryError(error)) {\n      throw new EsbuildBinaryMissingError({ cause: error });\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Narrow an unknown thrown value down to esbuild's known \"binary not\n * linked\" failure, identified by the fixed substring esbuild itself throws.\n */\nfunction isUnlinkedBinaryError(error: unknown): boolean {\n  return error instanceof Error && error.message.includes(UNLINKED_BINARY_SIGNATURE);\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,MAAM,4BAA4B;;;;;;AAclC,SAAS,kBAAwB;CAC/B,QAAQ,cAAc,IAAI,EAAE,QAAQ,KAAK,CAAC;AAC5C;;;;;;;;;;;;;;;;AAiBA,SAAgB,4BAA4B,QAAsB,iBAAuB;CACvF,IAAI;EACF,MAAM;CACR,SAAS,OAAO;EACd,IAAI,sBAAsB,KAAK,GAC7B,MAAM,IAAI,0BAA0B,EAAE,OAAO,MAAM,CAAC;EAGtD,MAAM;CACR;AACF;;;;;AAMA,SAAS,sBAAsB,OAAyB;CACtD,OAAO,iBAAiB,SAAS,MAAM,QAAQ,SAAS,yBAAyB;AACnF"}

package/esm/production/production-builder.mjs

@@ -23,7 +23,7 @@ import { ensureDirectoryAsync, fileExistsAsync, getFileAsync, getJsonFileAsync,
 import glob from "fast-glob";
 import esbuild from "esbuild";
 
-//#region ../core/src/production/production-builder.ts
+//#region ../../packages/core/src/production/production-builder.ts
 /**
 * Recreates `require`, `__filename` and `__dirname` at the top of an ESM bundle.
 *