@webjsdev/server 0.8.36 → 0.8.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.36",
+  "version": "0.8.38",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",

package/src/action-seed.js

@@ -50,7 +50,7 @@
 
 import * as nodeModule from 'node:module';
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { readFileSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { stringify } from '@webjsdev/core';
@@ -307,7 +307,14 @@ function seedLoadHook(url, context, nextLoad) {
  * @param {string} appDir
  * @returns {((src: string, loader: 'ts' | 'js') => string) | null}
  */
-function buildBunPinTransform(appDir) {
+export function buildBunPinTransform(appDir) {
+  // Pinning is for TRUE zero-install only. When `node_modules` exists (an
+  // installed app, or a workspace member like this repo's own examples), Bun
+  // resolves bare specifiers from it, so injecting an inline version would
+  // bypass that. Worse, for a workspace-linked dep it would swap the local
+  // package for the published one (the #698 blog-on-Bun regression). So skip
+  // pinning entirely when node_modules is present; Bun uses the installed copy.
+  if (existsSync(join(appDir, 'node_modules'))) return null;
   let pkgText;
   try { pkgText = readFileSync(join(appDir, 'package.json'), 'utf8'); } catch { return null; }
   let lockText = null;

package/src/bun-pin-rewrite.js

@@ -22,10 +22,19 @@
 
 /**
  * Resolve the version to pin each DECLARED dependency to: the exact version from
- * `bun.lock` when present (precise), else the package.json range/value as-is
- * (Bun resolves a range in an inline specifier). Only declared deps are
- * returned, so the rewrite never pins a transitive dep through an app import
- * (those follow from the pinned direct deps' own manifests).
+ * `bun.lock` when present (precise and reproducible), else the package.json
+ * declared value passed through as-is when it is an inline-safe semver. Bun's
+ * inline specifier resolves a range the standard way (`zod@^3.20.0` picks the
+ * highest matching `3.x`, verified), so passing the declared range through is
+ * the correct semver behaviour, the same a fresh `bun install` would pick. Only
+ * declared deps are returned, so the rewrite never pins a transitive dep through
+ * an app import (those follow from the pinned direct deps' own manifests).
+ *
+ * A protocol range (`workspace:`, `file:`, `link:`, git / URL) and a bare
+ * wildcard (`*`, `x`, empty) are NOT valid inline specifiers, so they are left
+ * BARE (resolving to latest, exactly as before this feature, never to a broken
+ * specifier). For reproducibility across machines, commit a `bun.lock` (its
+ * exact pin then wins over a floating range).
  *
  * Runtime-neutral: takes the two file contents (the Bun glue reads them via
  * `Bun.file`), so this stays unit-testable on Node.
@@ -55,14 +64,14 @@ export function resolveDepVersions(pkgJsonText, bunLockText) {
   }
 
   for (const [name, range] of Object.entries(declared)) {
-    // ONLY an EXACT version can be an inline specifier: Bun zero-install
-    // auto-install resolves `name@1.2.3` but ENOENTs on a range or dist-tag
-    // (`name@^1.2`, `name@latest`) and on a protocol range (`workspace:`,
-    // `file:`, ...). So pin to the bun.lock exact when present, else an exact
-    // package.json pin; a range without a lock is left BARE (it resolves to
-    // latest, exactly as before this feature, never to a broken specifier).
+    // bun.lock exact wins (precise and reproducible). Otherwise pass the
+    // declared semver through as an inline specifier: Bun resolves an exact,
+    // caret, tilde, or comparator range the standard way (highest match), so
+    // `name@^1.2.3` is correct, not broken. A protocol range (`workspace:`,
+    // `file:`, git / URL) and a bare wildcard (`*`, `x`, empty) are NOT
+    // inline-safe, so they are left BARE (latest, as before).
     if (lockExact[name]) out[name] = lockExact[name];
-    else if (isExactVersion(range)) out[name] = range;
+    else if (isInlineableVersion(range)) out[name] = range;
   }
   return out;
 }
@@ -79,6 +88,37 @@ function isExactVersion(v) {
   return typeof v === 'string' && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(v);
 }
 
+/**
+ * Whether a declared package.json version is safe to forward verbatim as a Bun
+ * inline specifier (`name@<v>`). Accepts a single-token semver: an exact version
+ * (with an optional prerelease / build suffix, `1.2.3`, `1.0.0-rc.3`) or a caret
+ * / tilde / comparator range over a numeric core WITHOUT a suffix (`^1.2.3`,
+ * `~1.2`, `>=1.2.3`, `^3`). Bun resolves these the standard way (highest match)
+ * at auto-install time.
+ *
+ * Rejects, so they are left BARE: a RANGE OPERATOR combined with a prerelease /
+ * build suffix (`^1.0.0-rc.3`, `~1.0.0-beta.1`, #703): Bun zero-install ENOENTs
+ * on a caret-prerelease inline specifier (verified, `drizzle-orm@^1.0.0-rc.3`
+ * errors while the exact `drizzle-orm@1.0.0-rc.3` resolves). Also a protocol
+ * range (`workspace:`, `file:`, `link:`, `git+...`, an `http(s)://` URL, any
+ * value with a `:`), a bare wildcard (`*`, `x`, `X`, empty), a multi-token range
+ * (a space, a `||` union, a hyphen `1 - 2` range, which would break the
+ * specifier string), and a dist-tag (`latest`, `next`, which auto-install
+ * resolves unreliably). A rejected value resolves to latest, the pre-feature
+ * behaviour, never a broken specifier.
+ * @param {unknown} v
+ * @returns {boolean}
+ */
+function isInlineableVersion(v) {
+  if (typeof v !== 'string') return false;
+  const m = /^(>=|<=|>|<|=|\^|~)?(\d+(?:\.\d+){0,2})([-+][0-9A-Za-z.-]+)?$/.exec(v);
+  if (!m) return false;
+  // A range operator (group 1) plus a prerelease / build suffix (group 3) is not
+  // inline-resolvable under Bun zero-install (#703). An exact version with a
+  // suffix, or a range with no suffix, is fine.
+  return !(m[1] && m[3]);
+}
+
 /**
  * The npm package name a specifier belongs to: `@scope/name[/sub]` or
  * `name[/sub]`. Returns null for a bare scope with no name.

package/src/vendor.js

@@ -47,6 +47,7 @@ import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
 import { digestBase64 } from './crypto-utils.js';
 import { BUFFERED_MARKER } from './conditional-get.js';
+import { resolveDepVersions } from './bun-pin-rewrite.js';
 
 /**
  * Set of package names whose importmap entries are populated by the
@@ -66,6 +67,18 @@ import { BUFFERED_MARKER } from './conditional-get.js';
  */
 const BUILTIN = new Set(['@webjsdev/core', '@webjsdev/core/']);
 
+/**
+ * Server-only framework packages that must NEVER be vendored to the browser.
+ * Unlike `@webjsdev/core` (browser-bound, served locally via `/__webjs/core/*`),
+ * these are pure server packages: the CLI (and its `webjs-bun.mjs` bootstrap
+ * import, #675), the SSR runtime, the MCP server. A stray browser-graph scan
+ * that surfaces one of them must not push it onto the jspm path (#713). Matched
+ * on the extracted package name, so subpaths (`@webjsdev/cli/bin/webjs.js`) are
+ * covered. `@webjsdev/ui` is intentionally absent: its components ARE
+ * browser-bound, so it stays vendorable.
+ */
+const FRAMEWORK_SERVER_ONLY = new Set(['@webjsdev/cli', '@webjsdev/server', '@webjsdev/mcp']);
+
 /**
  * Scan source files under `dir` for bare import specifiers reachable
  * from the browser. Returns a Set of package names.
@@ -90,6 +103,12 @@ export async function scanBareImports(dir, skipFiles) {
   const found = new Set();
   await walk(dir, found, skipFiles);
   for (const b of BUILTIN) found.delete(b);
+  // Drop server-only framework packages (and their subpaths) so they never
+  // reach the importmap / jspm path (#713).
+  for (const spec of found) {
+    const p = extractPackageName(spec);
+    if (p && FRAMEWORK_SERVER_ONLY.has(p)) found.delete(spec);
+  }
   return found;
 }
 
@@ -139,6 +158,10 @@ function isServerOnlyFile(name) {
   if (/\.server\.(js|ts|mjs|mts)$/.test(name)) return true;
   if (/^route\.(js|ts|mjs|mts)$/.test(name)) return true;
   if (/^middleware\.(js|ts|mjs|mts)$/.test(name)) return true;
+  // The zero-install Bun bootstrap (#675): a server-only entry that imports
+  // `@webjsdev/cli`. It never loads in the browser, so keep it out of the
+  // vendor scan, else the CLI would be pushed onto the jspm path (#713).
+  if (name === 'webjs-bun.mjs') return true;
   return false;
 }
 
@@ -261,6 +284,26 @@ export function getPackageVersion(pkgName, appDir) {
   }
 }
 
+/**
+ * Declared dep versions for the zero-install importmap fallback (#699): the
+ * SAME source the Bun server pin uses (`resolveDepVersions`), so the browser
+ * importmap and the server resolve a vendor from one source. Returns a map of
+ * package name to the bun.lock exact (when present) else the package.json
+ * declared semver (an exact or an inline-safe range). Covers `dependencies` and
+ * `devDependencies` (what `resolveDepVersions` reads), NOT `peerDependencies`.
+ * Empty when there is no readable package.json. Used only as a fallback when
+ * `getPackageVersion` (require.resolve against node_modules) finds nothing.
+ * @param {string} appDir
+ * @returns {Record<string, string>}
+ */
+export function declaredVendorVersions(appDir) {
+  let pkgText;
+  try { pkgText = readFileSync(join(appDir, 'package.json'), 'utf8'); } catch { return {}; }
+  let lockText = null;
+  try { lockText = readFileSync(join(appDir, 'bun.lock'), 'utf8'); } catch { /* optional */ }
+  return resolveDepVersions(pkgText, lockText);
+}
+
 /**
  * Read the installed package's declared `dependencies` + `peerDependencies`
  * from its `package.json`, hoist-aware (same resolution as `getPackageVersion`,
@@ -636,11 +679,18 @@ function mergePerInstall(fragments) {
  */
 export async function vendorImportMapEntries(bareImports, appDir) {
   const installs = [];
+  // Zero-install fallback (#699). When node_modules is absent (Bun
+  // zero-install), `getPackageVersion` (require.resolve) finds nothing, so the
+  // entry would be dropped and the browser bare import would 404. Fall back to
+  // the SAME source the Bun server pin uses, so the importmap and the server
+  // resolve a vendor from one source: bun.lock exact when present, else the
+  // package.json declared semver (jspm resolves a range, so a range works).
+  const declared = declaredVendorVersions(appDir);
   for (const spec of bareImports) {
     if (BUILTIN.has(spec)) continue;
     const pkg = extractPackageName(spec);
-    if (!pkg || BUILTIN.has(pkg)) continue;
-    const version = getPackageVersion(pkg, appDir);
+    if (!pkg || BUILTIN.has(pkg) || FRAMEWORK_SERVER_ONLY.has(pkg)) continue;
+    const version = getPackageVersion(pkg, appDir) || declared[pkg];
     if (!version) continue;
     // Splice the version into the specifier: 'dayjs/plugin/utc' with
     // version 1.11.13 becomes 'dayjs@1.11.13/plugin/utc'. jspm.io's
@@ -1208,7 +1258,7 @@ export async function pinAll(appDir, opts = {}) {
   for (const spec of bare) {
     if (BUILTIN.has(spec)) continue;
     const pkg = extractPackageName(spec);
-    if (!pkg || BUILTIN.has(pkg)) continue;
+    if (!pkg || BUILTIN.has(pkg) || FRAMEWORK_SERVER_ONLY.has(pkg)) continue;
     const version = getPackageVersion(pkg, appDir);
     if (!version) continue;
     const subpath = spec.slice(pkg.length);