@webjsdev/cli 0.10.58 → 0.10.60

package/README.md

@@ -33,7 +33,7 @@ npx @webjsdev/cli create my-app
 cd my-app && npm run dev
 ```
 
-Both `webjs create` and `create-webjs-app` auto-install dependencies in the new directory using your detected package manager (npm / pnpm / yarn / bun). Pass `--no-install` to opt out.
+Both `webjs create` and `create-webjs-app` auto-install dependencies in the new directory using your detected package manager (npm / pnpm / yarn / bun: the invoking tool, else the enclosing project's lockfile). Pass `--no-install` to opt out.
 
 ## Commands
 

package/bin/webjs.js

@@ -103,6 +103,8 @@ const USAGE = `webjs commands:
                                                   --json emits the structured results (with stable codes). --strict additionally fails on every remaining warning.
                                                   Per-check severity is CONFIG: map a code to off/warn/error under "webjs": { "doctor": { "gate": {...} } }
                                                   in package.json, so CI gates on a chosen subset without every warning becoming fatal
+  webjs audit [--json]                            Run the npm / bun dependency audit, failing at "webjs": { "audit": { "level" } } (default high)
+                                                  and above, minus the advisories "webjs.audit.ignore" accepts, each with its reason
   webjs types                                     Generate .webjs/routes.d.ts (typed Route union + per-route params)
   webjs typecheck [tsc args...]                   Type-check the app with the project's tsc --noEmit (non-zero on errors)
   webjs create <name> [--template full-stack|api] [--db sqlite|postgres] [--runtime node|bun] [--no-install] [--skip-ci]  Scaffold a new webjs app
@@ -226,6 +228,22 @@ const HELP = {
     ],
     examples: ['webjs elision', 'webjs elision --json', 'webjs elision --verify', 'webjs elision --verify --routes /,/blog/hello'],
   },
+  audit: {
+    usage: 'webjs audit [--json]',
+    summary:
+      'Run the package manager\'s dependency audit (npm or bun, found by the nearest lockfile) and fail on any advisory at or above ' +
+      'webjs.audit.level (default high), except the ones webjs.audit.ignore lists, each with the reason it is safe to accept.',
+    options: [
+      { flag: '--json', description: 'Emit { ok, manager, level, failing[], ignored[], stale[] } as JSON.' },
+    ],
+    notes: [
+      'Config lives in package.json, in one place:',
+      '"webjs": { "audit": { "level": "high", "ignore": [{ "id": "GHSA-...", "reason": "..." }] } }.',
+      'An entry with no reason, an unknown key, or a bad level exits 1 naming it. An ignored id',
+      'the audit no longer reports is printed as stale, so the list shrinks when a fix ships.',
+    ],
+    examples: ['webjs audit', 'webjs audit --json'],
+  },
   doctor: {
     usage: 'webjs doctor [--json] [--strict]',
     summary: 'Verify project health. Each result carries a stable code so an agent branches on the failure kind.',
@@ -482,6 +500,14 @@ async function main() {
         // too, but that runs too late to affect the port the CLI computes.
         loadAppEnv(process.cwd());
         const port = resolvePort(flag(rest, '--port'));
+        // Exit with the supervisor (#1521): when its IPC channel closes, the
+        // parent is gone (killed outright, or crashed), and a child left
+        // running would hold the port against the next `webjs dev`. Unref'd
+        // so the channel itself never keeps this process alive.
+        if (process.connected) {
+          process.channel?.unref?.();
+          process.on('disconnect', () => process.exit(0));
+        }
         await startServer({ appDir: process.cwd(), port, dev: true });
         break;
       }
@@ -502,22 +528,21 @@ async function main() {
       loadAppEnv(process.cwd());
       await runPhaseBeforeSteps('dev', devTasks.dev.before, process.cwd());
       const killTasks = await startDevParallelTasks(devTasks.dev.parallel, process.cwd());
-      process.on('SIGINT', () => { killTasks(); process.exit(0); });
-      process.on('SIGTERM', () => { killTasks(); process.exit(0); });
 
-      // Decide how to run: in-process (`--no-hot`), or re-exec'd under the host
-      // runtime's hot-reload supervisor (`node --watch` on Node, `bun --hot` on
-      // Bun, #514). The branch logic lives in the pure `planDevSupervisor` so it
-      // is unit-testable without spawning a process.
-      const { existsSync } = await import('node:fs');
+      // Decide how to run: in-process (`--no-hot`), or in a child under WebJs's
+      // reload supervisor (#1521), which restarts it on a change on Node and
+      // runs it under `bun --hot` on Bun (#514), and brings a crashed child
+      // back on either. The branch logic lives in the pure `planDevSupervisor`
+      // so it is unit-testable without spawning a process.
       const plan = planDevSupervisor({
         isBun: !!process.versions.bun,
         argv: process.argv.slice(1),
         noHot: rest.includes('--no-hot'),
-        exists: (p) => existsSync(p),
       });
 
       if (plan.mode === 'inline') {
+        process.on('SIGINT', () => { killTasks(); process.exit(0); });
+        process.on('SIGTERM', () => { killTasks(); process.exit(0); });
         const { startServer } = await import('@webjsdev/server');
         loadAppEnv(process.cwd());
         const port = resolvePort(flag(rest, '--port'));
@@ -526,12 +551,13 @@ async function main() {
         break;
       }
 
-      const child = spawn(process.execPath, plan.args, {
-        stdio: 'inherit',
+      const { superviseDevServer } = await import('../lib/dev-reload.js');
+      superviseDevServer({
         cwd: process.cwd(),
+        plan,
         env: { ...process.env, __WEBJS_DEV_CHILD: '1' },
+        onExit: (code) => { killTasks(); process.exit(code); },
       });
-      child.on('exit', (code) => { killTasks(); process.exit(code ?? 0); });
       break;
     }
     case 'start': {
@@ -749,7 +775,32 @@ async function main() {
         const useBrowserDir = !hasConfig && !serverOnly && existsSync(join(cwd, 'test', 'browser'));
         // Only resolve + run when there is actually something to run, so a
         // `webjs test` with no browser tests stays a no-op (not a hard error).
+        // Zero browser test files is a pass, not a failure (#1491). WTR throws
+        // `Could not find any test files` on an empty match, so an app with no
+        // browser tests yet (what `gallery:clear` leaves) would fail its own CI
+        // on this layer. Check the globs first and skip with a note. `null`
+        // patterns mean the config's `files` is not a plain literal, so WTR
+        // runs unchanged and reports for itself.
+        let noBrowserTests = false;
         if (hasConfig || useBrowserDir) {
+          const { readFile } = await import('node:fs/promises');
+          const { readWtrFilePatterns, findBrowserTestFiles } = await import('../lib/browser-test-files.js');
+          let patterns = ['test/browser/**/*.test.js'];
+          if (hasConfig) {
+            const cfg = existsSync(join(cwd, 'web-test-runner.config.js'))
+              ? 'web-test-runner.config.js' : 'web-test-runner.config.mjs';
+            patterns = readWtrFilePatterns(await readFile(join(cwd, cfg), 'utf8'));
+          }
+          if (patterns && (await findBrowserTestFiles(cwd, patterns)).length === 0) {
+            noBrowserTests = true;
+            console.log(
+              '\nwebjs test: no browser tests yet (no file matches '
+              + (patterns.length ? patterns.join(', ') : 'the configured `files`')
+              + '), skipping the browser layer.',
+            );
+          }
+        }
+        if ((hasConfig || useBrowserDir) && !noBrowserTests) {
           // Resolve the app's @web/test-runner bin and spawn it with the current
           // runtime, dropping `npx` (#570; absent in a pure oven/bun image).
           let wtrPath;
@@ -977,6 +1028,60 @@ async function main() {
       }
       break;
     }
+    case 'audit': {
+      // Dependency audit with a reviewable allowlist (#1492). npm has no ignore
+      // flag, so both managers' JSON reports are parsed and filtered the same
+      // way here (see lib/audit.js for why each part fails closed).
+      const cwd = process.cwd();
+      const json = rest.includes('--json');
+      const { readAuditConfigFrom, detectAuditManager, parseAuditReport, applyAuditConfig } = await import('../lib/audit.js');
+      const { config, errors } = readAuditConfigFrom(cwd);
+      if (errors.length) {
+        for (const e of errors) console.error(`webjs audit: ${e}`);
+        process.exit(1);
+      }
+      const pm = detectAuditManager(cwd);
+      if (pm !== 'npm' && pm !== 'bun') {
+        console.error(`webjs audit: drives npm and bun audits; this project uses ${pm}. Run \`${pm} audit\` directly.`);
+        process.exit(1);
+      }
+      const { spawnSync } = await import('node:child_process');
+      const res = spawnSync(pm, ['audit', '--json'], {
+        cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, shell: process.platform === 'win32',
+      });
+      const advisories = res.error ? null : parseAuditReport(pm, res.stdout || '');
+      if (!advisories) {
+        console.error(`webjs audit: \`${pm} audit --json\` produced no report${res.error ? ` (${res.error.message})` : ''}.`);
+        if (res.stderr) console.error(res.stderr.trim());
+        process.exit(1);
+      }
+      const { failing, ignored, stale } = applyAuditConfig(advisories, config);
+      const reasonOf = (id) => config.ignore.find((i) => i.id.toUpperCase() === id.toUpperCase())?.reason || '';
+      if (json) {
+        console.log(JSON.stringify({
+          ok: failing.length === 0, manager: pm, level: config.level, failing,
+          ignored: ignored.map((a) => ({ ...a, reason: reasonOf(a.id) })), stale,
+        }, null, 2));
+        process.exit(failing.length ? 1 : 0);
+      }
+      console.log(`webjs audit: ${pm} audit, failing at ${config.level} and above`);
+      for (const a of ignored) {
+        console.log(`  ignored ${a.id} (${a.severity}, ${a.packages.join(', ')}): ${reasonOf(a.id)}`);
+      }
+      for (const i of stale) {
+        console.log(`  stale   ${i.id} is no longer reported; remove it from webjs.audit.ignore`);
+      }
+      if (failing.length) {
+        for (const a of failing) {
+          console.log(`  FAIL    ${a.id} (${a.severity}, ${a.packages.join(', ')}): ${a.title}${a.url ? ` ${a.url}` : ''}`);
+        }
+        console.log(`\nwebjs audit: ${failing.length} advisor${failing.length === 1 ? 'y' : 'ies'} at ${config.level} or above. ` +
+          'Upgrade the dependency, or, when no patched release exists and it cannot reach users, add it to webjs.audit.ignore with a reason.');
+        process.exit(1);
+      }
+      console.log(`webjs audit: no ${config.level}+ advisories outside the allowlist ✓`);
+      break;
+    }
     case 'doctor': {
       // Project-health checklist (#266). The checks are PURE (in lib/doctor.js);
       // this branch only renders them and owns the exit code. The exit is

package/lib/audit.js

@@ -0,0 +1,218 @@
+/**
+ * `webjs audit`: the dependency audit with a reviewable allowlist (#1492).
+ *
+ * A freshly generated app used to fail its own `Security: dependency audit`
+ * CI step on the day it was created, because the dev toolchain reaches an
+ * advisory with NO patched release (braces, GHSA-vfj7-8cjw-p6xm, through the
+ * Tailwind watcher and the test runner's globber). Nothing can be upgraded,
+ * so the step was red until someone deleted it, which also throws away the
+ * signal for every advisory that DOES have a fix.
+ *
+ * So the app declares the advisories it accepts, in ONE place, each with the
+ * reason it is safe, under `webjs.audit` in package.json:
+ *
+ *   "audit": {
+ *     "level": "high",
+ *     "ignore": [{ "id": "GHSA-...", "reason": "why this cannot reach users" }]
+ *   }
+ *
+ * and `webjs audit` runs the package manager's own audit (`npm audit --json`
+ * or `bun audit --json`) and filters that report here, the same way for both,
+ * since npm has no ignore flag at all. Every other advisory at or above
+ * `level` still fails.
+ *
+ * The config fails CLOSED, like the doctor gate: an entry without an id or a
+ * reason, an unknown key, or a bad level exits 1 naming the problem, because
+ * an allowlist that silently stopped applying (or silently applied to
+ * everything) would be worse than none. An ignored id that no longer appears in
+ * the report is printed as stale, so the list shrinks when upstream ships a fix.
+ *
+ * @module audit
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+export const AUDIT_LEVELS = ['low', 'moderate', 'high', 'critical'];
+
+/**
+ * @typedef {{ id: string, reason: string }} AuditIgnore
+ * @typedef {{ level: string, ignore: AuditIgnore[] }} AuditConfig
+ * @typedef {{ id: string, url: string, severity: string, title: string, packages: string[] }} Advisory
+ */
+
+/**
+ * Read and validate `webjs.audit` from a parsed package.json.
+ *
+ * @param {Record<string, any>} pkg
+ * @returns {{ config: AuditConfig, errors: string[] }}
+ */
+export function readAuditConfig(pkg) {
+  /** @type {AuditConfig} */
+  const config = { level: 'high', ignore: [] };
+  /** @type {string[]} */
+  const errors = [];
+  const raw = pkg?.webjs?.audit;
+  if (raw === undefined) return { config, errors };
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+    return { config, errors: ['webjs.audit must be an object'] };
+  }
+  for (const key of Object.keys(raw)) {
+    if (key !== 'level' && key !== 'ignore') errors.push(`webjs.audit: unknown key "${key}" (expected "level" or "ignore")`);
+  }
+  if (raw.level !== undefined) {
+    if (!AUDIT_LEVELS.includes(raw.level)) errors.push(`webjs.audit.level must be one of ${AUDIT_LEVELS.join(', ')}`);
+    else config.level = raw.level;
+  }
+  if (raw.ignore !== undefined) {
+    if (!Array.isArray(raw.ignore)) {
+      errors.push('webjs.audit.ignore must be an array of { id, reason }');
+    } else {
+      raw.ignore.forEach((entry, i) => {
+        const at = `webjs.audit.ignore[${i}]`;
+        if (!entry || typeof entry !== 'object') { errors.push(`${at} must be an object { id, reason }`); return; }
+        const extra = Object.keys(entry).filter((k) => k !== 'id' && k !== 'reason');
+        if (extra.length) errors.push(`${at}: unknown key "${extra[0]}" (expected "id" and "reason")`);
+        if (typeof entry.id !== 'string' || !/^(GHSA(-[0-9a-z]{4}){3}|CVE-\d{4}-\d+)$/i.test(entry.id)) {
+          errors.push(`${at}.id must be an advisory id such as GHSA-xxxx-xxxx-xxxx or CVE-2024-12345`);
+          return;
+        }
+        if (typeof entry.reason !== 'string' || entry.reason.trim() === '') {
+          errors.push(`${at} (${entry.id}) needs a non-empty "reason" saying why it is safe to accept`);
+          return;
+        }
+        config.ignore.push({ id: entry.id, reason: entry.reason });
+      });
+    }
+  }
+  return { config, errors };
+}
+
+/**
+ * Which package manager's audit to run. Walks up from `cwd` to the first
+ * lockfile, since an app inside a workspace has its lockfile at the root.
+ * Only bun and npm have an audit this command drives; anything else is
+ * reported as unsupported by the caller.
+ *
+ * @param {string} cwd
+ * @returns {'bun' | 'npm' | 'pnpm' | 'yarn'}
+ */
+export function detectAuditManager(cwd) {
+  let dir = cwd;
+  for (;;) {
+    if (existsSync(join(dir, 'bun.lock')) || existsSync(join(dir, 'bun.lockb'))) return 'bun';
+    if (existsSync(join(dir, 'package-lock.json')) || existsSync(join(dir, 'npm-shrinkwrap.json'))) return 'npm';
+    if (existsSync(join(dir, 'pnpm-lock.yaml'))) return 'pnpm';
+    if (existsSync(join(dir, 'yarn.lock'))) return 'yarn';
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return process.versions.bun ? 'bun' : 'npm';
+}
+
+/** The advisory id at the end of a GitHub advisory url. */
+function idFromUrl(url) {
+  const m = /(GHSA(?:-[0-9a-z]{4}){3})/i.exec(url || '');
+  return m ? m[1] : '';
+}
+
+/**
+ * The source advisories in an `npm audit --json` (v2 report format) report,
+ * deduplicated by id. A vulnerability entry whose `via` holds only package
+ * NAMES is a dependent of one of these, not an advisory of its own, so it is
+ * covered by filtering the advisories it inherits from.
+ *
+ * @param {any} report
+ * @returns {Advisory[]}
+ */
+export function npmAdvisories(report) {
+  /** @type {Map<string, Advisory>} */
+  const byId = new Map();
+  for (const [name, vuln] of Object.entries(report?.vulnerabilities || {})) {
+    for (const via of /** @type {any} */ (vuln).via || []) {
+      if (!via || typeof via !== 'object') continue;
+      const id = idFromUrl(via.url) || String(via.source ?? via.url);
+      const cur = byId.get(id);
+      if (cur) { if (!cur.packages.includes(name)) cur.packages.push(name); continue; }
+      byId.set(id, { id, url: via.url || '', severity: via.severity || 'low', title: via.title || '', packages: [name] });
+    }
+  }
+  return [...byId.values()];
+}
+
+/**
+ * Split advisories into the ones that still fail and the ones the allowlist
+ * accepted, keeping only those at or above `level`.
+ *
+ * @param {Advisory[]} advisories
+ * @param {AuditConfig} config
+ * @returns {{ failing: Advisory[], ignored: Advisory[], stale: AuditIgnore[] }}
+ */
+export function applyAuditConfig(advisories, config) {
+  const floor = AUDIT_LEVELS.indexOf(config.level);
+  const atLevel = advisories.filter((a) => AUDIT_LEVELS.indexOf(a.severity) >= floor);
+  const ids = new Set(config.ignore.map((i) => i.id.toUpperCase()));
+  const failing = atLevel.filter((a) => !ids.has(a.id.toUpperCase()));
+  const ignored = atLevel.filter((a) => ids.has(a.id.toUpperCase()));
+  const seen = new Set(advisories.map((a) => a.id.toUpperCase()));
+  const stale = config.ignore.filter((i) => !seen.has(i.id.toUpperCase()));
+  return { failing, ignored, stale };
+}
+
+/**
+ * The source advisories in a `bun audit --json` report, which is keyed by
+ * package name with a list of advisories each.
+ *
+ * @param {any} report
+ * @returns {Advisory[]}
+ */
+export function bunAdvisories(report) {
+  /** @type {Map<string, Advisory>} */
+  const byId = new Map();
+  for (const [name, list] of Object.entries(report || {})) {
+    if (!Array.isArray(list)) continue;
+    for (const adv of list) {
+      const id = idFromUrl(adv?.url) || String(adv?.id ?? adv?.url);
+      const cur = byId.get(id);
+      if (cur) { if (!cur.packages.includes(name)) cur.packages.push(name); continue; }
+      byId.set(id, { id, url: adv?.url || '', severity: adv?.severity || 'low', title: adv?.title || '', packages: [name] });
+    }
+  }
+  return [...byId.values()];
+}
+
+/**
+ * Parse a package manager's `audit --json` stdout into advisories. Both
+ * managers exit non-zero when they find anything, so the exit code says
+ * nothing; an unparseable stdout (a registry outage, an old manager) returns
+ * `null` and the caller fails closed.
+ *
+ * @param {'bun' | 'npm'} pm
+ * @param {string} stdout
+ * @returns {Advisory[] | null}
+ */
+export function parseAuditReport(pm, stdout) {
+  let report;
+  try { report = JSON.parse(stdout); } catch { return null; }
+  if (!report || typeof report !== 'object') return null;
+  if (pm === 'npm') {
+    if (report.error) return null;
+    return npmAdvisories(report);
+  }
+  return bunAdvisories(report);
+}
+
+/**
+ * Read `webjs.audit` from the package.json in `cwd`.
+ *
+ * @param {string} cwd
+ */
+export function readAuditConfigFrom(cwd) {
+  const p = join(cwd, 'package.json');
+  if (!existsSync(p)) return { config: { level: 'high', ignore: [] }, errors: ['no package.json in this directory'] };
+  try {
+    return readAuditConfig(JSON.parse(readFileSync(p, 'utf8')));
+  } catch (e) {
+    return { config: { level: 'high', ignore: [] }, errors: [`package.json is not valid JSON: ${/** @type {Error} */ (e).message}`] };
+  }
+}

package/lib/browser-test-files.js

@@ -0,0 +1,125 @@
+/**
+ * Decide whether `webjs test --browser` has anything to run (#1491).
+ *
+ * web-test-runner throws `Could not find any test files with pattern(s)` when
+ * its `files` globs match nothing, so an app with no browser tests yet (the
+ * state `npm run gallery:clear` leaves behind) fails its own CI on the browser
+ * layer. A missing layer is not a failing layer: the server layer already
+ * passes with zero files, and the browser layer should too. WTR raises the
+ * error while building its session groups, after it has started, so the check
+ * has to happen here, before it is spawned.
+ *
+ * The globs are read from the config's SOURCE rather than by importing it,
+ * because the scaffold's config top-level-awaits a warmed webjs handler (the
+ * whole app boots) just to answer a question a file walk can answer. When the
+ * `files` value is not a plain literal (computed, imported, spread), the
+ * patterns come back `null` and the caller runs WTR exactly as before, so a
+ * config this reader does not understand never turns into a silent skip.
+ *
+ * @module browser-test-files
+ */
+import { readdir } from 'node:fs/promises';
+import { join, relative, sep, matchesGlob } from 'node:path';
+
+/**
+ * Pull the `files` globs out of a web-test-runner config's source text.
+ * Accepts `files: 'one/glob'` and `files: ['a', "b", ...]` with only string
+ * literals inside the array. Anything else returns `null` (unknown).
+ *
+ * @param {string} source
+ * @returns {string[] | null}
+ */
+export function readWtrFilePatterns(source) {
+  // Strip line + block comments first, so a commented-out `files:` cannot
+  // match and a comment inside the array does not read as a non-literal.
+  const code = stripComments(source);
+  const single = code.match(/\bfiles\s*:\s*(['"])([^'"]+)\1\s*[,}\n]/);
+  if (single) return [single[2]];
+  const arr = code.match(/\bfiles\s*:\s*\[([\s\S]*?)\]/);
+  if (!arr) return null;
+  const body = arr[1].trim();
+  if (body === '') return [];
+  const out = [];
+  // Every comma-separated element must be a quoted string literal.
+  for (const raw of body.split(',')) {
+    const el = raw.trim();
+    if (el === '') continue; // trailing comma
+    const m = el.match(/^(['"])([^'"]*)\1$/);
+    if (!m) return null;
+    out.push(m[2]);
+  }
+  return out;
+}
+
+/**
+ * Walk `cwd` and return the app-relative paths (forward slashes) matching
+ * the include globs and none of the `!`-prefixed exclude globs. Skips
+ * `node_modules` and dot directories, which WTR's globber skips too.
+ *
+ * @param {string} cwd
+ * @param {string[]} patterns
+ * @returns {Promise<string[]>}
+ */
+export async function findBrowserTestFiles(cwd, patterns) {
+  const include = patterns.filter((p) => !p.startsWith('!')).map(normalize);
+  const exclude = patterns.filter((p) => p.startsWith('!')).map((p) => normalize(p.slice(1)));
+  if (include.length === 0) return [];
+  const found = [];
+  const walk = async (dir) => {
+    let entries;
+    try { entries = await readdir(dir, { withFileTypes: true }); }
+    catch { return; }
+    for (const ent of entries) {
+      if (ent.name === 'node_modules' || ent.name.startsWith('.')) continue;
+      const full = join(dir, ent.name);
+      if (ent.isDirectory()) { await walk(full); continue; }
+      if (!ent.isFile()) continue;
+      const rel = relative(cwd, full).split(sep).join('/');
+      if (include.some((g) => matchesGlob(rel, g)) && !exclude.some((g) => matchesGlob(rel, g))) {
+        found.push(rel);
+      }
+    }
+  };
+  await walk(cwd);
+  return found;
+}
+
+/**
+ * Remove `//` and `/* *\/` comments while leaving string literals intact. A
+ * regex strip is not enough: a glob such as `test/**\/browser` contains the
+ * very `/*` that opens a block comment.
+ *
+ * @param {string} src
+ * @returns {string}
+ */
+function stripComments(src) {
+  let out = '';
+  let quote = '';
+  for (let i = 0; i < src.length; i++) {
+    const c = src[i];
+    if (quote) {
+      out += c;
+      if (c === '\\') { out += src[++i] ?? ''; continue; }
+      if (c === quote) quote = '';
+      continue;
+    }
+    if (c === '"' || c === "'" || c === '`') { quote = c; out += c; continue; }
+    if (c === '/' && src[i + 1] === '/') {
+      while (i < src.length && src[i] !== '\n') i++;
+      out += '\n';
+      continue;
+    }
+    if (c === '/' && src[i + 1] === '*') {
+      const end = src.indexOf('*/', i + 2);
+      i = end === -1 ? src.length : end + 1;
+      continue;
+    }
+    out += c;
+  }
+  return out;
+}
+
+/** @param {string} p */
+function normalize(p) {
+  return p.replace(/^\.\//, '');
+}