@webjsdev/server 0.9.0 → 0.10.0

package/src/module-side-effect.js

@@ -0,0 +1,284 @@
+/**
+ * Whether a module runs code when it loads (#1689), read lexically from its
+ * source. The dev hot swap (`dev-hot-classify.js`, through `hotVerdict` in
+ * `dev/handler.js`) walks an edit up the shipped importer graph to the
+ * component modules that re-import it, and a module passed through on the way
+ * must have no module-scope side effect, since re-evaluating it at a new
+ * version would repeat that effect in the open tab. Lifted from the component
+ * elision analyser this check used to live in, which #1686 removed.
+ *
+ * @module module-side-effect
+ */
+import { redactToPlaceholders } from './js-scan.js';
+
+/**
+ * Constructors that produce inert DATA with no side effect, so a module-scope
+ * `export const X = new Set([...])` (a lookup table, a compiled RegExp, a
+ * parsed URL) does no work at load (#623). Any constructor NOT in this set
+ * (`new WebSocket()`, `new Worker()`, `new EventSource()`, `new Audio()`) IS a
+ * side effect.
+ */
+const PURE_DATA_CONSTRUCTORS = new Set([
+  'Set', 'Map', 'WeakSet', 'WeakMap', 'Date', 'RegExp', 'Array', 'Object',
+  'Number', 'String', 'Boolean', 'BigInt', 'Symbol',
+  'Error', 'TypeError', 'RangeError', 'SyntaxError',
+  'URL', 'URLSearchParams', 'ArrayBuffer', 'DataView',
+  'Int8Array', 'Uint8Array', 'Uint8ClampedArray', 'Int16Array', 'Uint16Array',
+  'Int32Array', 'Uint32Array', 'Float32Array', 'Float64Array',
+  'BigInt64Array', 'BigUint64Array',
+]);
+
+/**
+ * Marks where `hasModuleScopeSideEffect` dropped a top-level `{...}` body from
+ * its depth-0 frame, so an arrow followed by a block body is not mistaken for
+ * an expression body that runs on into the next statement. Removed again
+ * before the call scan.
+ */
+const BLOCK = '\x01';
+
+/** `function`, `function*`, `async function name` up to its parameter list's `(`. */
+const FUNCTION_PARAMS_RE = /(?<![\w$.])function\s*\*?\s*(?:[A-Za-z_$][\w$]*)?\s*\(/g;
+
+/**
+ * The text before an arrow's `=>` when that arrow is a declarator initializer
+ * (`const usd = (m) =>`, `let f = async x =>`, `, g = (a) =>`). The parameter
+ * list must hold no parens, so a call in a parameter default
+ * (`(a = init()) =>`) keeps its arrow unrecognised and still counts.
+ */
+const ARROW_DECLARATOR_RE =
+  /(?:(?<![\w$.])(?:const|let|var)\s+|,\s*)[A-Za-z_$][\w$]*\s*=\s*(?:async\s*)?(?:\([^()]*\)|[A-Za-z_$][\w$]*)\s*$/;
+
+/**
+ * An expression body that ends this way cannot stop at the newline (a binary
+ * operator, `?`, `:`, or a curried `=>`). Postfix `++` / `--` and a regex
+ * literal's closing `/` end a statement, so neither is listed.
+ */
+const BODY_CONTINUES_RE = /(?:=>|&&|\|\||\?\?|[?:=*%|&^<>]|(?<![+])\+|(?<![-])-)\s*$/;
+
+/** A line starting this way continues the previous one: no statement starts with it. */
+const LINE_CONTINUES_RE = /^\s*(?:\?|:|&&|\|\||\.(?![.\d])|\*|%|=(?!>)|\|)/;
+
+/**
+ * Removes the two depth-0 shapes that look like calls and run nothing at module
+ * load: a `function` declaration's parameter list (a default such as
+ * `now = Date.now()` runs per call) and an arrow's expression body when the
+ * arrow initializes a declarator (`const usd = (m) => Math.round(m) / MICROS`).
+ *
+ * The arrow body ends at a `,` or `;` at its own paren/bracket depth 0, at a
+ * `)` / `]` closing something outside it, or at a newline once the body has
+ * content, unless `BODY_CONTINUES_RE` / `LINE_CONTINUES_RE` prove the
+ * expression carries on. Ending early is always safe, because whatever is left
+ * stays in the frame and is still scanned; ending late could swallow a real
+ * statement, so every rule errs towards ending.
+ *
+ * @param {string} frame depth-0 text, with `BLOCK` where a `{...}` was dropped
+ * @returns {string | null} the frame without those parts, or null when a
+ *   parameter list does not close (the caller then reports a side effect)
+ */
+function blankDeclarationOnlyCode(frame) {
+  let out = '';
+  let last = 0;
+  for (const m of frame.matchAll(FUNCTION_PARAMS_RE)) {
+    if (m.index < last) continue;
+    const open = m.index + m[0].length - 1;
+    let depth = 0;
+    let close = -1;
+    for (let j = open; j < frame.length; j++) {
+      if (frame[j] === '(') depth++;
+      else if (frame[j] === ')' && --depth === 0) { close = j; break; }
+    }
+    if (close < 0) return null;
+    out += frame.slice(last, open + 1);
+    last = close;
+  }
+  frame = out + frame.slice(last);
+
+  out = '';
+  let depth = 0;
+  for (let i = 0; i < frame.length; i++) {
+    const c = frame[i];
+    if (c === '(' || c === '[') depth++;
+    else if ((c === ')' || c === ']') && depth > 0) depth--;
+    if (depth === 0 && c === '=' && frame[i + 1] === '>' && ARROW_DECLARATOR_RE.test(out)) {
+      out += '=>';
+      i = arrowBodyEnd(frame, i + 2) - 1;
+      continue;
+    }
+    out += c;
+  }
+  return out;
+}
+
+/**
+ * Index where an arrow's expression body starting at `start` ends (see
+ * `blankDeclarationOnlyCode`).
+ *
+ * @param {string} frame
+ * @param {number} start index just past the `=>`
+ * @returns {number}
+ */
+function arrowBodyEnd(frame, start) {
+  let depth = 0;
+  let i = start;
+  for (; i < frame.length; i++) {
+    const c = frame[i];
+    if (c === '(' || c === '[') { depth++; continue; }
+    if (c === ')' || c === ']') {
+      if (depth === 0) return i;
+      depth--;
+      continue;
+    }
+    if (depth > 0) continue;
+    if (c === ',' || c === ';') return i;
+    if (c === '\n') {
+      const body = frame.slice(start, i);
+      if (!body.trim() || BODY_CONTINUES_RE.test(body)) continue;
+      if (LINE_CONTINUES_RE.test(frame.slice(i + 1))) continue;
+      return i;
+    }
+  }
+  return i;
+}
+
+/**
+ * Module-scope work, detected by an ALLOWLIST of safe top-level forms rather
+ * than a denylist of browser globals. A module that runs ANY code when it
+ * loads (other than registering a component) has a side effect that a second
+ * evaluation would repeat, so the dev hot swap (#1689) refuses to pass an edit
+ * through it and reloads instead (`side-effect-module` in
+ * `dev-hot-classify.js`). Unlike a global
+ * denylist this does not rot as browsers add APIs: a brand-new global trips it
+ * automatically, because it is the CALL (or `new`, or dynamic `import()`), not
+ * the global's name, that is recognised.
+ *
+ * Rule: at brace depth 0 (so code inside function / class / method bodies and
+ * template holes, which do not run at module load, is ignored), the only
+ * permitted forms are declarations (`import` / `export` / `function` / `class`
+ * / `const` / `let` / `var`) and the component registration call
+ * (`X.register(...)` / `customElements.define(...)`). Any other call, any
+ * `new`, any dynamic `import(...)`, or top-level `await` is a side effect.
+ *
+ * Scans the redacted copy (strings / templates / comments blanked, regex
+ * literals and nested `${...}` interpolation tracked by the lexer) so template
+ * prose and JSDoc cannot trip it; quoted-string bodies, which redaction keeps
+ * verbatim for other rules, are blanked here too so a string like `"foo()"` or
+ * `"{"` is not read as a call and cannot unbalance the brace scan. The
+ * unbalanced-brace and unterminated-string fallbacks below are defense in
+ * depth: with the lexer tracking regex literals, neither should trigger on
+ * valid code, but if either does the module counts as having a side effect
+ * rather than risk hiding one.
+ *
+ * PASS TYPE-ERASED SOURCE for a TypeScript module. Redaction blanks comments
+ * and literals, NOT type syntax, and TS annotations are call-shaped often
+ * enough to matter: `readonly (readonly [number, number, number])[]` is an
+ * identifier immediately followed by `(`, so a module holding nothing but a
+ * typed data literal reads as running code at module scope (#1423). The dev
+ * handler strips types before it calls this; a caller handing it `.ts` source
+ * as authored is opting into that false positive.
+ *
+ * A `function` declaration's parameter list and the expression body of an
+ * arrow that initializes a `const` / `let` / `var` declarator are dropped from
+ * the frame first (`blankDeclarationOnlyCode`): `now = Date.now()` and
+ * `(m) => Math.round(m) / MICROS` declare code, they do not run it.
+ *
+ * Over-detection is safe (a pure top-level helper call, or an arrow outside a
+ * declarator whose body calls something, only costs a reload). The accepted
+ * residual misses, all
+ * contrived and structural (so they do not rot), are a call buried inside a
+ * top-level object / array initializer or a destructuring default, and a
+ * side-effecting tagged-template hole evaluated at module scope.
+ *
+ * @param {string} src module source, type-erased if it came from a TypeScript file
+ * @param {string[]} [literals] the redaction's literal bodies, when already computed
+ * @returns {boolean}
+ */
+export function hasModuleScopeSideEffect(src, literals) {
+  let redacted = src;
+  if (!literals) {
+    const r = redactToPlaceholders(src);
+    redacted = r.redacted;
+    literals = r.literals;
+  }
+  // Keep only depth-0 text (outside every `{}`). Skip quoted-string bodies so
+  // braces/parens inside a string neither desync the depth nor read as a call.
+  let depth = 0;
+  let frame = '';
+  for (let i = 0; i < redacted.length; i++) {
+    const c = redacted[i];
+    if (c === "'" || c === '"') {
+      i++;
+      let closed = false;
+      while (i < redacted.length) {
+        const d = redacted[i];
+        if (d === '\\') { i += 2; continue; }
+        if (d === '\n') break;       // a real quoted string never spans a newline
+        if (d === c) { closed = true; break; }
+        i++;
+      }
+      // Not closed on its line is an unterminated string OR a regex literal
+      // containing a quote that desynced the upstream redaction (regex bodies
+      // are not tracked, so a stray quote shifts quote pairing). Either way the
+      // lexical state is unreliable below here, so answer conservatively.
+      if (!closed) return true;
+      if (depth === 0) frame += "''";
+      continue;
+    }
+    if (c === '{') { if (depth === 0) frame += BLOCK; depth++; continue; }
+    if (c === '}') { if (depth > 0) depth--; continue; }
+    if (depth === 0) frame += c;
+  }
+  // Unbalanced braces mean a construct we could not lexically resolve (a regex
+  // literal with a stray brace is the common case). Report a side effect
+  // rather than risk a hidden top-level statement.
+  if (depth !== 0) return true;
+  // Parameter lists and declarator arrow bodies are declarations, not code
+  // that runs at load.
+  const declared = blankDeclarationOnlyCode(frame);
+  if (declared === null) return true;
+  frame = declared.replaceAll(BLOCK, '');
+  // Optional-chaining call/index: `foo?.()`, `x?.[i]()` (the `?.` defeats the
+  // identifier-before-paren match below).
+  if (/\?\.\s*[([]/.test(frame)) return true;
+  // Top-level `new X`: a pure-data builtin constructor (Set / Map / Date /
+  // RegExp / typed array / URL / ...) is inert module data, not a side effect, so
+  // it is no side effect (#623); any other constructor is one. Catches
+  // both `new X` and `new X(...)` (the constructor's own `(`, if present, is
+  // then skipped in the call scan below).
+  for (const nm of frame.matchAll(/(?<![.\w])new\s+([A-Za-z_$][\w$]*)/g)) {
+    if (!PURE_DATA_CONSTRUCTORS.has(nm[1])) return true;
+  }
+  // Top-level `await`.
+  if (/(?<![.\w])await\s/.test(frame)) return true;
+  // A call: `(` preceded (ignoring whitespace) by an identifier, `)`, or `]`.
+  const CALL_RE = /(?:([A-Za-z_$][\w$]*)|[)\]])\s*\(/g;
+  // Identifiers that precede a `(` WITHOUT it being a call (keywords + a
+  // `function` declaration's parameter list).
+  const NOT_A_CALL = new Set([
+    'if', 'for', 'while', 'switch', 'catch', 'with', 'return', 'typeof',
+    'instanceof', 'void', 'delete', 'in', 'of', 'yield', 'do', 'else',
+    'case', 'default', 'function', 'await', 'new', 'async',
+  ]);
+  let m;
+  while ((m = CALL_RE.exec(frame)) !== null) {
+    const ident = m[1];
+    if (ident === 'import') return true;                 // dynamic import()
+    if (ident && NOT_A_CALL.has(ident)) continue;
+    // A `function`-declaration parameter list (`function name(` or
+    // `async function name(`) is not a call.
+    if (ident && /\bfunction\s*\*?\s*$/.test(frame.slice(0, m.index))) continue;
+    // The component registration call is the one permitted top-level call.
+    if (ident === 'register' || ident === 'define') continue;
+    // `extends WebComponent(...)` is the reactive-prop factory (#597 /
+    // #599): a class-declaration construct, not an independent side-effecting
+    // statement. Scoped to the `extends` position, so a top-level
+    // `WebComponent(...)` call used anywhere else still counts as a side
+    // effect (#604).
+    if (ident === 'WebComponent' && /\bextends\s+$/.test(frame.slice(0, m.index))) continue;
+    // A `new X(...)` constructor call: the `new`-prefixed cases were already
+    // vetted above (a non-pure constructor returned true; a pure-data one is
+    // inert), so its `(` here is not an independent side-effecting call.
+    if (ident && /(?<![.\w])new\s+$/.test(frame.slice(0, m.index))) continue;
+    return true;                                         // any other top-level call
+  }
+  return false;
+}

package/src/public-files.js

@@ -0,0 +1,73 @@
+/**
+ * `public/` served at the URL root, as in Next.js: `public/logo.png` is
+ * `/logo.png`, `public/robots.txt` is `/robots.txt`, `public/sw.js` is
+ * `/sw.js`. There is no `/public/` URL prefix.
+ *
+ * Resolution order matches Next: the framework's own assets, then the app's
+ * source modules, then a public file, then the routes. So a public file beats
+ * a DYNAMIC route at the same URL, and a public file at the same URL as a
+ * static page, a `route.ts` or a metadata route is a boot error
+ * (`no-public-route-conflict`, see app-layout.js), since one would silently
+ * shadow the other.
+ *
+ * @module public-files
+ */
+import { readdirSync, statSync } from 'node:fs';
+import { join, sep } from 'node:path';
+
+/**
+ * Every file under `<appDir>/public`, as the URL path it is served at
+ * (`/images/a.png`). Symlinks are not followed. Empty when there is no
+ * `public/` directory.
+ * @param {string} appDir
+ * @returns {Set<string>}
+ */
+export function buildPublicIndex(appDir) {
+  /** @type {Set<string>} */
+  const out = new Set();
+  const root = join(appDir, 'public');
+  /** @param {string} dir @param {string} prefix */
+  const walk = (dir, prefix) => {
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (e.isSymbolicLink()) continue;
+      const url = `${prefix}/${e.name}`;
+      if (e.isDirectory()) walk(join(dir, e.name), url);
+      else if (e.isFile()) out.add(url);
+    }
+  };
+  walk(root, '');
+  return out;
+}
+
+/**
+ * The file a URL path names under `<appDir>/public`, or null when the path
+ * escapes the directory (a `..%2F` that survived URL parsing) or is a
+ * directory path. Does not check existence.
+ * @param {string} appDir
+ * @param {string} urlPath decoded pathname
+ * @returns {string | null}
+ */
+export function publicFilePath(appDir, urlPath) {
+  if (!urlPath || urlPath === '/' || urlPath.endsWith('/')) return null;
+  const root = join(appDir, 'public') + sep;
+  const abs = join(root, urlPath);
+  return abs.startsWith(root) ? abs : null;
+}
+
+/**
+ * Whether a URL path is a public file. Production answers from the boot-time
+ * index; dev checks the disk so a file added while the server runs is served
+ * at once.
+ * @param {string} appDir
+ * @param {string} urlPath
+ * @param {{ dev: boolean, index?: Set<string> | null }} opts
+ * @returns {string | null} the absolute file, or null
+ */
+export function resolvePublicFile(appDir, urlPath, { dev, index }) {
+  const abs = publicFilePath(appDir, urlPath);
+  if (!abs) return null;
+  if (!dev && index) return index.has(urlPath) ? abs : null;
+  try { return statSync(abs).isFile() ? abs : null; } catch { return null; }
+}

package/src/redirect-location.js

@@ -0,0 +1,19 @@
+/**
+ * A redirect target as an HTTP header value.
+ *
+ * A header value must be a ByteString, so `new Response(null, { headers: {
+ * location: '/日本' } })` throws ("Cannot convert argument to a ByteString")
+ * inside the very catch block that is answering a thrown `redirect()`, which
+ * turns a navigation into a 500. Next.js percent-encodes the target, so this
+ * does the same for every run of characters outside visible ASCII (a space
+ * included) and leaves everything else, an existing `%xx` escape among it,
+ * untouched. Applied at every site that answers a thrown `redirect()`. A lone
+ * surrogate (half an emoji, from truncated user input) is replaced with U+FFFD
+ * first, since encodeURIComponent throws URIError on one.
+ *
+ * @param {unknown} url
+ * @returns {string}
+ */
+export function headerSafeLocation(url) {
+  return String(url).replace(/[^\x21-\x7e]+/gu, (run) => encodeURIComponent(run.toWellFormed()));
+}

package/src/redirects.js

@@ -135,9 +135,10 @@ export function readTrailingSlashPolicy(pkg) {
  *
  * @param {Request} req
  * @param {'never' | 'always' | 'ignore'} policy
+ * @param {(path: string) => boolean} [isPublicFile] a url that is a `public/` file is left alone
  * @returns {Response | null}
  */
-export function applyTrailingSlash(req, policy) {
+export function applyTrailingSlash(req, policy, isPublicFile) {
   if (policy !== 'never' && policy !== 'always') return null;
   let url;
   try {
@@ -153,6 +154,13 @@ export function applyTrailingSlash(req, policy) {
   // `//host`): canonicalizing it would emit a protocol-relative, cross-origin
   // Location (an open redirect). Let the router handle the weird path instead.
   if (!isSameOriginPath(path)) return null;
+  // A `public/` file is served at exactly its own url (a file is a leaf, even
+  // one with no extension such as `/LICENSE`), so it is never canonicalized.
+  if (typeof isPublicFile === 'function') {
+    let decoded = path;
+    try { decoded = decodeURIComponent(path); } catch { /* keep raw */ }
+    if (isPublicFile(decoded)) return null;
+  }
 
   /** @type {string | null} */
   let canonical = null;

package/src/route-frontier.js

@@ -0,0 +1,151 @@
+/**
+ * Route modules never ship to the browser (#1686, Plan v2 workstream 1).
+ *
+ * A page, layout or boundary module (error, not-found, forbidden, unauthorized,
+ * global-not-found, loading) runs ONLY on the server, the way a Next.js server
+ * component does. Nothing in the browser ever read a page export: the boot
+ * script is a list of bare `import "<url>"` lines and the client router never
+ * imports a route module. So the boot imports each route module's component
+ * FRONTIER instead: the shipping components reachable from it on a path that
+ * does not pass through another component (a component's own subtree loads
+ * with it).
+ *
+ * This replaced a lexical guess about whether a page did "client work" at
+ * module scope, which decided whether the page itself shipped. The guess had
+ * false positives (`new Intl.DateTimeFormat()`, `Array.from(...)`, a class-name
+ * helper call at module scope), and a page wrongly judged to ship had its
+ * server-only import refused by `no-server-import-in-browser-module`. With no
+ * route module ever shipping, there is nothing to guess.
+ *
+ * Pure and graph-only: it reads no file.
+ *
+ * @module
+ */
+
+const SERVER_FILE_RE = /\.server\.m?[jt]s$/;
+
+/**
+ * The component frontier of every route module.
+ *
+ * @param {Iterable<string>} routeFiles  absolute route-module paths (`collectBootRouteModules`)
+ * @param {Map<string, Set<string>>} moduleGraph  file -> its static imports
+ * @param {Set<string>} componentFiles  every registered component's file
+ * @param {Set<string>} skip  files that never load in the browser (route-table files)
+ * @returns {Map<string, string[]>}  route file -> component files to import in its place (possibly empty)
+ */
+export function routeFrontiers(routeFiles, moduleGraph, componentFiles, skip) {
+  /** @type {Map<string, string[]>} */
+  const out = new Map();
+  for (const file of routeFiles) {
+    /** @type {string[]} */
+    const frontier = [];
+    const visited = new Set([file]);
+    const queue = [file];
+    while (queue.length) {
+      const cur = /** @type {string} */ (queue.shift());
+      const deps = moduleGraph.get(cur);
+      if (!deps) continue;
+      for (const dep of deps) {
+        if (visited.has(dep)) continue;
+        visited.add(dep);
+        // A skipped file never loads; a `.server.*` module is a stub in the
+        // browser, so nothing behind it can load either (inside or outside appDir).
+        if (skip.has(dep) || SERVER_FILE_RE.test(dep)) continue;
+        // A component is imported in the route module's place, and its own
+        // subtree loads with it, so the walk stops there.
+        if (componentFiles.has(dep)) { frontier.push(dep); continue; }
+        // Anything else (a helper, a barrel, core) is only a carrier on the way
+        // to components: walked, never emitted.
+        queue.push(dep);
+      }
+    }
+    out.set(file, frontier);
+  }
+  return out;
+}
+
+/**
+ * Every route module the client boot could be asked to stand in for, with its
+ * kind: pages, layouts and every boundary (error, loading, not-found,
+ * forbidden, unauthorized, global-not-found). None of them ships; each is
+ * replaced in the boot by its component frontier. `global-error` is left out:
+ * it renders its own document with no boot script.
+ *
+ * Route-ness comes from the route table, never from a file name (a plain
+ * helper may be called `page.ts`). A file used as more than one kind keeps
+ * the first kind found, pages first.
+ *
+ * @param {any} routeTable  the router's table (`buildRouteTable`)
+ * @returns {Map<string, 'page'|'layout'|'error'|'loading'|'not-found'|'forbidden'|'unauthorized'|'global-not-found'>}
+ */
+export function routeModuleKinds(routeTable) {
+  /** @type {Map<string, any>} */
+  const kinds = new Map();
+  const add = (/** @type {string|undefined} */ f, /** @type {string} */ kind) => { if (f && !kinds.has(f)) kinds.set(f, kind); };
+  const pages = routeTable.pages || [];
+  for (const page of pages) add(page.file, 'page');
+  for (const [key, kind] of /** @type {const} */ ([
+    ['layouts', 'layout'], ['errors', 'error'], ['loadings', 'loading'], ['notFounds', 'not-found'],
+    ['forbiddens', 'forbidden'], ['unauthorizeds', 'unauthorized'],
+  ])) {
+    for (const page of pages) for (const f of page[key] || []) add(f, kind);
+  }
+  add(routeTable.notFound, 'not-found');
+  if (routeTable.notFounds) for (const f of routeTable.notFounds.values()) add(f, 'not-found');
+  add(routeTable.globalNotFound, 'global-not-found');
+  return kinds;
+}
+
+/**
+ * The route modules `routeModuleKinds` lists, as an array.
+ * @param {any} routeTable
+ * @returns {string[]}
+ */
+export function collectBootRouteModules(routeTable) {
+  return [...routeModuleKinds(routeTable).keys()];
+}
+
+/**
+ * Every route-table file the browser must never load: the boot route modules
+ * plus `global-error`. The serve gate refuses these (#1686), and the gate and
+ * vendor walks stop at them, so a page-only import is neither servable nor
+ * vendored.
+ * @param {any} routeTable
+ * @returns {Set<string>}
+ */
+export function routeTableFiles(routeTable) {
+  const files = new Set(routeModuleKinds(routeTable).keys());
+  if (routeTable.globalError) files.add(routeTable.globalError);
+  return files;
+}
+
+/**
+ * A memoized "does this module lead to a component" test over the static
+ * graph, stopping at `.server` files. A side-effect import of a barrel of
+ * component imports is how a route module registers components, and the boot
+ * already loads those in its place, so route-module hints skip it.
+ * @param {Map<string, Set<string>>} moduleGraph
+ * @param {Set<string>} componentFiles
+ * @returns {(abs: string) => boolean}
+ */
+export function leadsToComponent(moduleGraph, componentFiles) {
+  /** @type {Map<string, boolean>} */
+  const memo = new Map();
+  return (abs) => {
+    const hit = memo.get(abs);
+    if (hit !== undefined) return hit;
+    const seen = new Set([abs]);
+    const work = [abs];
+    let found = false;
+    while (work.length && !found) {
+      for (const dep of moduleGraph.get(/** @type {string} */ (work.pop())) || []) {
+        if (seen.has(dep) || SERVER_FILE_RE.test(dep)) continue;
+        if (componentFiles.has(dep)) { found = true; break; }
+        seen.add(dep);
+        work.push(dep);
+      }
+    }
+    memo.set(abs, found);
+    return found;
+  };
+}