@webjsdev/server 0.8.38 → 0.8.40

package/src/vendor.js

@@ -47,7 +47,6 @@ import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
 import { digestBase64 } from './crypto-utils.js';
 import { BUFFERED_MARKER } from './conditional-get.js';
-import { resolveDepVersions } from './bun-pin-rewrite.js';
 
 /**
  * Set of package names whose importmap entries are populated by the
@@ -70,8 +69,8 @@ const BUILTIN = new Set(['@webjsdev/core', '@webjsdev/core/']);
 /**
  * Server-only framework packages that must NEVER be vendored to the browser.
  * Unlike `@webjsdev/core` (browser-bound, served locally via `/__webjs/core/*`),
- * these are pure server packages: the CLI (and its `webjs-bun.mjs` bootstrap
- * import, #675), the SSR runtime, the MCP server. A stray browser-graph scan
+ * these are pure server packages: the CLI, the SSR runtime, the MCP server. A
+ * stray browser-graph scan
  * that surfaces one of them must not push it onto the jspm path (#713). Matched
  * on the extracted package name, so subpaths (`@webjsdev/cli/bin/webjs.js`) are
  * covered. `@webjsdev/ui` is intentionally absent: its components ARE
@@ -158,10 +157,6 @@ function isServerOnlyFile(name) {
   if (/\.server\.(js|ts|mjs|mts)$/.test(name)) return true;
   if (/^route\.(js|ts|mjs|mts)$/.test(name)) return true;
   if (/^middleware\.(js|ts|mjs|mts)$/.test(name)) return true;
-  // The zero-install Bun bootstrap (#675): a server-only entry that imports
-  // `@webjsdev/cli`. It never loads in the browser, so keep it out of the
-  // vendor scan, else the CLI would be pushed onto the jspm path (#713).
-  if (name === 'webjs-bun.mjs') return true;
   return false;
 }
 
@@ -284,26 +279,6 @@ export function getPackageVersion(pkgName, appDir) {
   }
 }
 
-/**
- * Declared dep versions for the zero-install importmap fallback (#699): the
- * SAME source the Bun server pin uses (`resolveDepVersions`), so the browser
- * importmap and the server resolve a vendor from one source. Returns a map of
- * package name to the bun.lock exact (when present) else the package.json
- * declared semver (an exact or an inline-safe range). Covers `dependencies` and
- * `devDependencies` (what `resolveDepVersions` reads), NOT `peerDependencies`.
- * Empty when there is no readable package.json. Used only as a fallback when
- * `getPackageVersion` (require.resolve against node_modules) finds nothing.
- * @param {string} appDir
- * @returns {Record<string, string>}
- */
-export function declaredVendorVersions(appDir) {
-  let pkgText;
-  try { pkgText = readFileSync(join(appDir, 'package.json'), 'utf8'); } catch { return {}; }
-  let lockText = null;
-  try { lockText = readFileSync(join(appDir, 'bun.lock'), 'utf8'); } catch { /* optional */ }
-  return resolveDepVersions(pkgText, lockText);
-}
-
 /**
  * Read the installed package's declared `dependencies` + `peerDependencies`
  * from its `package.json`, hoist-aware (same resolution as `getPackageVersion`,
@@ -679,18 +654,11 @@ function mergePerInstall(fragments) {
  */
 export async function vendorImportMapEntries(bareImports, appDir) {
   const installs = [];
-  // Zero-install fallback (#699). When node_modules is absent (Bun
-  // zero-install), `getPackageVersion` (require.resolve) finds nothing, so the
-  // entry would be dropped and the browser bare import would 404. Fall back to
-  // the SAME source the Bun server pin uses, so the importmap and the server
-  // resolve a vendor from one source: bun.lock exact when present, else the
-  // package.json declared semver (jspm resolves a range, so a range works).
-  const declared = declaredVendorVersions(appDir);
   for (const spec of bareImports) {
     if (BUILTIN.has(spec)) continue;
     const pkg = extractPackageName(spec);
     if (!pkg || BUILTIN.has(pkg) || FRAMEWORK_SERVER_ONLY.has(pkg)) continue;
-    const version = getPackageVersion(pkg, appDir) || declared[pkg];
+    const version = getPackageVersion(pkg, appDir);
     if (!version) continue;
     // Splice the version into the specifier: 'dayjs/plugin/utc' with
     // version 1.11.13 becomes 'dayjs@1.11.13/plugin/utc'. jspm.io's

package/webjs-config.schema.json

@@ -17,11 +17,6 @@
       "type": "boolean",
       "default": true
     },
-    "pin": {
-      "description": "Bun zero-install dependency version-pinning switch (#685). Default true, Bun only. When on, an onLoad transform rewrites a declared dep's bare import specifier to its package.json / bun.lock version so Bun auto-install fetches the pinned version instead of latest (#684). Set to false to leave specifiers bare (zero-install resolves to latest). Read by readPinEnabled in dev.js; the WEBJS_PIN env override wins over this. No effect on Node.",
-      "type": "boolean",
-      "default": true
-    },
     "clientRouter": {
       "description": "Client-router switch (#629). Default true: the client router auto-enables in the browser whenever @webjsdev/core loads, so any page with a component gets SPA-style navigation with no import. Set to false to opt the whole app out (pure MPA, full-page navigation). Read by readClientRouterEnabled in dev.js.",
       "type": "boolean",

package/src/bun-pin-rewrite.js

@@ -1,192 +0,0 @@
-/**
- * Pin Bun zero-install dependency versions by rewriting bare import specifiers
- * to inline-versioned ones (#685).
- *
- * Under Bun zero-install (`bun run dev` / `start` via the `webjs-bun.mjs`
- * bootstrap, no `node_modules`), Bun's auto-install fetches `latest` for a bare
- * `import 'zod'`, ignoring package.json and `bun.lock` (#684). But Bun honors an
- * INLINE version in the specifier (`import 'zod@1.0.0'`), and that survives the
- * `onResolve` bypass because it is part of the specifier the loader receives. So
- * an `onLoad` transform that rewrites `import 'zod'` to `import 'zod@<pinned>'`
- * (the version from package.json / `bun.lock`) makes auto-install fetch the
- * pinned version. This module is the runtime-neutral, unit-testable core; the
- * Bun `onLoad` glue (which supplies `Bun.Transpiler().scanImports` and the
- * resolved dep versions) lives in the Bun-side plugin.
- *
- * The specifier set comes from `Bun.Transpiler.scanImports`, which is
- * AST-accurate (a plain string that merely looks like a specifier is NOT
- * listed), so we never rewrite a non-import string. The in-source replacement is
- * additionally anchored on the `from` / `import` / `require` keyword so an
- * identical non-import string literal elsewhere is left alone.
- */
-
-/**
- * Resolve the version to pin each DECLARED dependency to: the exact version from
- * `bun.lock` when present (precise and reproducible), else the package.json
- * declared value passed through as-is when it is an inline-safe semver. Bun's
- * inline specifier resolves a range the standard way (`zod@^3.20.0` picks the
- * highest matching `3.x`, verified), so passing the declared range through is
- * the correct semver behaviour, the same a fresh `bun install` would pick. Only
- * declared deps are returned, so the rewrite never pins a transitive dep through
- * an app import (those follow from the pinned direct deps' own manifests).
- *
- * A protocol range (`workspace:`, `file:`, `link:`, git / URL) and a bare
- * wildcard (`*`, `x`, empty) are NOT valid inline specifiers, so they are left
- * BARE (resolving to latest, exactly as before this feature, never to a broken
- * specifier). For reproducibility across machines, commit a `bun.lock` (its
- * exact pin then wins over a floating range).
- *
- * Runtime-neutral: takes the two file contents (the Bun glue reads them via
- * `Bun.file`), so this stays unit-testable on Node.
- *
- * @param {string} pkgJsonText  package.json contents
- * @param {string | null} [bunLockText]  bun.lock contents, when present
- * @returns {Record<string, string>}  package name -> version
- */
-export function resolveDepVersions(pkgJsonText, bunLockText) {
-  /** @type {Record<string, string>} */
-  const out = {};
-  let pkg;
-  try { pkg = JSON.parse(pkgJsonText); } catch { return out; }
-  const declared = { ...pkg.dependencies, ...pkg.devDependencies };
-
-  // bun.lock pins each package as `"name": ["name@<exact>", ...]`. Extract the
-  // exact version for each DECLARED dep, anchored on its name so a substring
-  // match cannot cross to another package. This is the precise source.
-  /** @type {Record<string, string>} */
-  const lockExact = {};
-  if (bunLockText) {
-    for (const name of Object.keys(declared)) {
-      const esc = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-      const m = bunLockText.match(new RegExp('"' + esc + '"\\s*:\\s*\\[\\s*"' + esc + '@([^"]+)"'));
-      if (m && isExactVersion(m[1])) lockExact[name] = m[1];
-    }
-  }
-
-  for (const [name, range] of Object.entries(declared)) {
-    // bun.lock exact wins (precise and reproducible). Otherwise pass the
-    // declared semver through as an inline specifier: Bun resolves an exact,
-    // caret, tilde, or comparator range the standard way (highest match), so
-    // `name@^1.2.3` is correct, not broken. A protocol range (`workspace:`,
-    // `file:`, git / URL) and a bare wildcard (`*`, `x`, empty) are NOT
-    // inline-safe, so they are left BARE (latest, as before).
-    if (lockExact[name]) out[name] = lockExact[name];
-    else if (isInlineableVersion(range)) out[name] = range;
-  }
-  return out;
-}
-
-/**
- * Whether a version string is an EXACT semver (the only form valid as a Bun
- * inline specifier): `1.2.3`, with an optional prerelease / build suffix
- * (`1.2.3-rc.1`, `1.2.3+build`). Rejects any range operator (`^ ~ > < = * x | -`
- * space), a dist-tag (`latest`), and a protocol range (`workspace:` etc.).
- * @param {unknown} v
- * @returns {boolean}
- */
-function isExactVersion(v) {
-  return typeof v === 'string' && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(v);
-}
-
-/**
- * Whether a declared package.json version is safe to forward verbatim as a Bun
- * inline specifier (`name@<v>`). Accepts a single-token semver: an exact version
- * (with an optional prerelease / build suffix, `1.2.3`, `1.0.0-rc.3`) or a caret
- * / tilde / comparator range over a numeric core WITHOUT a suffix (`^1.2.3`,
- * `~1.2`, `>=1.2.3`, `^3`). Bun resolves these the standard way (highest match)
- * at auto-install time.
- *
- * Rejects, so they are left BARE: a RANGE OPERATOR combined with a prerelease /
- * build suffix (`^1.0.0-rc.3`, `~1.0.0-beta.1`, #703): Bun zero-install ENOENTs
- * on a caret-prerelease inline specifier (verified, `drizzle-orm@^1.0.0-rc.3`
- * errors while the exact `drizzle-orm@1.0.0-rc.3` resolves). Also a protocol
- * range (`workspace:`, `file:`, `link:`, `git+...`, an `http(s)://` URL, any
- * value with a `:`), a bare wildcard (`*`, `x`, `X`, empty), a multi-token range
- * (a space, a `||` union, a hyphen `1 - 2` range, which would break the
- * specifier string), and a dist-tag (`latest`, `next`, which auto-install
- * resolves unreliably). A rejected value resolves to latest, the pre-feature
- * behaviour, never a broken specifier.
- * @param {unknown} v
- * @returns {boolean}
- */
-function isInlineableVersion(v) {
-  if (typeof v !== 'string') return false;
-  const m = /^(>=|<=|>|<|=|\^|~)?(\d+(?:\.\d+){0,2})([-+][0-9A-Za-z.-]+)?$/.exec(v);
-  if (!m) return false;
-  // A range operator (group 1) plus a prerelease / build suffix (group 3) is not
-  // inline-resolvable under Bun zero-install (#703). An exact version with a
-  // suffix, or a range with no suffix, is fine.
-  return !(m[1] && m[3]);
-}
-
-/**
- * The npm package name a specifier belongs to: `@scope/name[/sub]` or
- * `name[/sub]`. Returns null for a bare scope with no name.
- * @param {string} p
- * @returns {string | null}
- */
-export function packageNameOf(p) {
-  if (p.startsWith('@')) {
-    const parts = p.split('/');
-    return parts.length >= 2 && parts[0] && parts[1] ? parts[0] + '/' + parts[1] : null;
-  }
-  return p.split('/')[0] || null;
-}
-
-/**
- * Whether a specifier should be left untouched: relative, the `#` app alias, a
- * protocol/builtin (`node:`, `bun:`, `http:`...), or already version-pinned.
- * @param {string} p
- * @param {string} name
- * @returns {boolean}
- */
-function skipSpecifier(p, name) {
-  if (!p || p[0] === '.' || p[0] === '#') return true;
-  // A protocol/builtin has a colon before any slash (node:fs, bun:sqlite, http:).
-  // A scope `@scope/x` has no leading colon, so it is not caught here.
-  const firstSlash = p.indexOf('/');
-  const head = firstSlash === -1 ? p : p.slice(0, firstSlash);
-  if (head.includes(':')) return true;
-  // Already versioned: the name is immediately followed by `@<something>`.
-  if (p.slice(name.length).startsWith('@')) return true;
-  return false;
-}
-
-/**
- * Rewrite bare specifiers of DECLARED deps to `name@version` (keeping any
- * subpath). `name` -> `name@v`, `name/sub` -> `name@v/sub`,
- * `@scope/name/sub` -> `@scope/name@v/sub`.
- *
- * @param {string} src  module source
- * @param {Array<{ kind: string, path: string }>} imports  Bun.Transpiler.scanImports output
- * @param {Record<string, string>} depVersions  package name -> version (exact preferred, e.g. from bun.lock)
- * @returns {string} the rewritten source (unchanged when nothing matched)
- */
-export function rewriteDepSpecifiers(src, imports, depVersions) {
-  /** @type {Map<string, string>} specifier -> versioned specifier */
-  const remap = new Map();
-  for (const imp of imports) {
-    const p = imp && imp.path;
-    if (!p || remap.has(p)) continue;
-    const name = packageNameOf(p);
-    if (!name || skipSpecifier(p, name)) continue;
-    const ver = depVersions[name];
-    if (!ver) continue;
-    remap.set(p, name + '@' + ver + p.slice(name.length));
-  }
-  if (remap.size === 0) return src;
-
-  let out = src;
-  for (const [from, to] of remap) {
-    const q = from.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    // Anchor on the import/export/require form so an identical non-import
-    // string literal is not touched: `from 'x'`, `import 'x'`, `import('x')`,
-    // `require('x')`. The optional `(` covers dynamic import / require. The
-    // leading `(^|[^\w.$])` boundary keeps a method call (`db.select().from('x')`,
-    // a `.import(...)` member) or a keyword-suffixed identifier (`xfrom 'x'`)
-    // from matching, which an unanchored keyword would wrongly rewrite.
-    const re = new RegExp("(^|[^\\w.$])((?:from|import|require)\\s*\\(?\\s*)(['\"])" + q + "\\3", 'g');
-    out = out.replace(re, (_m, pre, lead, quote) => pre + lead + quote + to + quote);
-  }
-  return out;
-}