tecton 0.4.0

package/src/report.js

@@ -0,0 +1,110 @@
+// Output: the interactive HTML page, a Markdown summary (for PR comments) and plain JSON.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+
+/** @param {import('./types.js').ReportModel} model */
+export function toHtml(model) {
+  const tpl = fs.readFileSync(path.join(here, 'report', 'template.html'), 'utf8');
+  // built from src/report/client/ by scripts/build.js (it also bundles layout.js, for the module file diagrams)
+  const client = fs.readFileSync(path.join(here, 'report', 'dist', 'client.js'), 'utf8').replace(/<\/script/gi, '<\\/script');
+  const data = JSON.stringify(model).replace(/</g, '\\u003c').replace(/[\u2028\u2029]/g, (ch) => (ch === '\u2028' ? '\\u2028' : '\\u2029'));
+  const title = `${model.project} · Tecton`.replace(/[<&]/g, (c) => (c === '<' ? '&lt;' : '&amp;'));
+  const font = (file) => fs.readFileSync(path.join(here, 'report', 'fonts', file)).toString('base64');
+  const fonts = `@font-face{font-family:"Geist";src:url(data:font/woff2;base64,${font('Geist-Variable.woff2')}) format("woff2");font-weight:100 900;font-display:swap}`
+    + `@font-face{font-family:"Geist Mono";src:url(data:font/woff2;base64,${font('GeistMono-Variable.woff2')}) format("woff2");font-weight:100 900;font-display:swap}`;
+  const favicon = fs.readFileSync(path.join(here, '..', 'brand', 'tecton-favicon.svg'), 'utf8');
+  const faviconUri = `data:image/svg+xml,${encodeURIComponent(favicon.replace(/\s+/g, ' ').trim())}`;
+  return tpl.split('__FAVICON__').join(faviconUri).split('__FONTS__').join(fonts).split('__TITLE__').join(title).split('__DATA__').join(data).split('__CLIENT__').join(client);
+}
+
+// product signals from the brand: green new, red removed, orange rule break
+const COLORS = { add: '#16A34A', rem: '#DC2626', viol: '#EA580C', same: '#8C8A85' };
+const mid = (s) => `m_${s.replace(/[^A-Za-z0-9_]/g, '_')}`;
+const q = (s) => s.replace(/"/g, '#quot;');
+
+/** A Markdown summary with a Mermaid graph of only the parts that changed (good for PR comments). */
+/** @param {import('./types.js').ReportModel} model */
+export function toMarkdown(model) {
+  const { summary: S, violations, edges, nodes } = model;
+  const lines = [];
+  lines.push(`### Tecton: ${model.curLabel} vs ${model.baseLabel || '(no base)'}`);
+  lines.push('');
+  const V = S.violations;
+  const status = V.newErrors ? `❌ ${V.newErrors} new rule break${V.newErrors === 1 ? '' : 's'}` : '✅ no new rule breaks';
+  lines.push(`${status} · modules +${S.modules.added}/−${S.modules.removed} · dependencies +${S.deps.added}/−${S.deps.removed}${V.fixed ? ` · ${V.fixed} fixed` : ''}`);
+  lines.push('');
+  if (model.hasBase && S.touched && S.touched.files) {
+    const mods = nodes.filter((n) => n.touched).sort((a, b) => b.touched - a.touched || a.id.localeCompare(b.id));
+    const names = mods.slice(0, 8).map((n) => `\`${n.id}\``).join(', ') + (mods.length > 8 ? ` and ${mods.length - 8} more` : '');
+    lines.push(`Touches ${S.touched.files} file${S.touched.files === 1 ? '' : 's'} in ${mods.length} module${mods.length === 1 ? '' : 's'}: ${names}`);
+    lines.push('');
+  }
+
+  const shown = violations.filter((v) => v.status !== 'existing');
+  if (shown.length) {
+    lines.push('| | Rule | Where |');
+    lines.push('|---|---|---|');
+    for (const v of shown) {
+      const icon = v.status === 'fixed' ? '✅ fixed' : v.severity === 'error' ? '❌ new' : '⚠️ new';
+      const where = v.kind === 'cycle' ? v.members.join(' ⇄ ') : `\`${v.from}\` → \`${v.to}\``;
+      const ev = v.imports[0] ? ` (e.g. \`${v.imports[0].file}:${v.imports[0].line}\`)` : '';
+      lines.push(`| ${icon} | ${v.rule} | ${where}${ev} |`);
+    }
+    lines.push('');
+  }
+
+  const sys = model.system;
+  if (sys && model.hasBase) {
+    const bullets = [];
+    const mark = (st) => (st === 'added' ? '\u2795' : '\u2796');
+    sys.apps.filter((a) => a.status !== 'same').forEach((a) => bullets.push(`${mark(a.status)} app **${a.name}** (${a.framework})`));
+    for (const a of sys.apps) {
+      for (const [g, label] of [['pages', 'page'], ['api', 'route'], ['endpoints', 'endpoint'], ['jobs', 'job'], ['schedules', 'schedule']]) {
+        (a.groups[g] || []).filter((x) => x.status !== 'same').forEach((x) => bullets.push(`${mark(x.status)} ${label} \`${x.methods && x.methods.length ? `${x.methods.join('/')} ` : ''}${x.label}\`${x.human ? ` (${x.human})` : ''} in ${a.name}`));
+      }
+    }
+    sys.stores.filter((x) => x.status !== 'same').forEach((x) => bullets.push(`${mark(x.status)} ${x.kind === 'Queue' ? 'queue' : 'data store'} **${x.name}**`));
+    sys.outside.filter((x) => x.status !== 'same').forEach((x) => bullets.push(`${mark(x.status)} outside service **${x.name}** (${x.kind})`));
+    if (bullets.length) {
+      lines.push('<details><summary>System changes (' + bullets.length + ')</summary>', '');
+      lines.push(...bullets.slice(0, 40).map((b) => `- ${b}`));
+      if (bullets.length > 40) lines.push(`- \u2026and ${bullets.length - 40} more`);
+      lines.push('', '</details>', '');
+    }
+  }
+
+  const violEdges = new Set(violations.filter((v) => v.status === 'new').flatMap((v) => v.edges));
+  const changed = edges.filter((e) => e.status !== 'same' || e.countBase !== e.countCur || violEdges.has(e.id));
+  if (changed.length) {
+    const ids = new Set();
+    changed.forEach((e) => { ids.add(e.from); ids.add(e.to); });
+    lines.push('```mermaid');
+    lines.push('graph TD');
+    for (const id of ids) {
+      const n = nodes.find((x) => x.id === id);
+      const label = n.status === 'added' ? `${id} (new)` : n.status === 'removed' ? `${id} (removed)` : id;
+      lines.push(`  ${mid(id)}["${q(label)}"]`);
+    }
+    const styles = [];
+    changed.forEach((e, i) => {
+      const lbl = e.status === 'added' ? `+${e.countCur}` : e.status === 'removed' ? `−${e.countBase}` : `${e.countBase}→${e.countCur}`;
+      const arrow = e.status === 'removed' ? '-.->' : violEdges.has(e.id) ? '==>' : '-->';
+      lines.push(`  ${mid(e.from)} ${arrow}|"${violEdges.has(e.id) ? '⚠ ' : ''}${lbl}"| ${mid(e.to)}`);
+      const color = violEdges.has(e.id) ? COLORS.viol : e.status === 'added' ? COLORS.add : e.status === 'removed' ? COLORS.rem : COLORS.same;
+      styles.push(`  linkStyle ${i} stroke:${color},stroke-width:${violEdges.has(e.id) ? 3 : 2}px`);
+    });
+    lines.push(...styles);
+    for (const id of ids) {
+      const n = nodes.find((x) => x.id === id);
+      if (n.status === 'added') lines.push(`  style ${mid(id)} stroke:${COLORS.add},stroke-width:2px`);
+      if (n.status === 'removed') lines.push(`  style ${mid(id)} stroke:${COLORS.rem},stroke-dasharray:4 3`);
+    }
+    lines.push('```');
+  } else {
+    lines.push('_No architectural changes._');
+  }
+  return lines.join('\n') + '\n';
+}

package/src/rules.js

@@ -0,0 +1,82 @@
+// House rules: "this part of the app must not depend on that part".
+import { nameMatches } from './graph.js';
+
+/**
+ * Rule shapes (in tecton.config.json → "rules"):
+ *   { "name": "...", "from": "components", "to": ["db", "npm:pg"] }      // forbidden targets
+ *   { "name": "...", "from": "lib", "allow": ["utils", "types"] }        // the ONLY internal modules allowed
+ * "from"/"to"/"allow" accept module names with * wildcards. npm packages are written "npm:<name>".
+ * Optional "severity": "error" (default, fails CI) or "warn".
+ * Top-level "cycles": "warn" (default) | "error" | "off" flags modules that depend on each other in a loop.
+ */
+/**
+ * @param {Pick<import('./types.js').Graph, 'modules' | 'edges'>} graph
+ * @param {import('./types.js').Config} cfg
+ * @returns {import('./types.js').Violation[]}
+ */
+export function evaluate(graph, cfg) {
+  const rules = (cfg.rules || []).map((r, i) => ({ ...r, key: r.name || `rule ${i + 1}`, severity: r.severity || 'error' }));
+  const out = [];
+
+  for (const e of graph.edges.values()) {
+    for (const r of rules) {
+      if (!r.from || ![].concat(r.from).some((p) => nameMatches(p, e.from))) continue;
+      let broken = false;
+      if (r.to && [].concat(r.to).some((p) => nameMatches(p, e.to))) broken = true;
+      if (r.allow && !e.external && ![].concat(r.allow).some((p) => nameMatches(p, e.to))) broken = true;
+      if (!broken) continue;
+      out.push({
+        id: `${r.key}|${e.from}|${e.to}`,
+        kind: 'rule', rule: r.key, message: r.message || null, severity: r.severity,
+        from: e.from, to: e.to, edges: [`${e.from}→${e.to}`], count: e.count, imports: e.imports,
+      });
+    }
+  }
+
+  const cycleMode = cfg.cycles ?? 'warn';
+  if (cycleMode !== 'off') {
+    for (const scc of stronglyConnected(graph)) {
+      const members = new Set(scc);
+      const edgeKeys = [...graph.edges.values()]
+        .filter((e) => members.has(e.from) && members.has(e.to))
+        .map((e) => `${e.from}→${e.to}`).sort();
+      const sorted = [...scc].sort();
+      out.push({
+        id: `cycle|${sorted.join('|')}`,
+        kind: 'cycle', rule: 'No circular dependencies', message: null, severity: cycleMode,
+        from: sorted[0], to: sorted[sorted.length - 1], members: sorted, edges: edgeKeys,
+        count: edgeKeys.length, imports: edgeKeys.flatMap((k) => graph.edges.get(k).imports.slice(0, 5)),
+      });
+    }
+  }
+  return out;
+}
+
+/** Tarjan's algorithm over internal modules; returns groups of 2+ modules that form a loop. */
+function stronglyConnected(graph) {
+  const adj = new Map();
+  for (const m of graph.modules.keys()) adj.set(m, []);
+  for (const e of graph.edges.values()) if (!e.external) adj.get(e.from)?.push(e.to);
+  let index = 0;
+  const idx = new Map(); const low = new Map(); const onStack = new Set(); const stack = []; const res = [];
+  const visit = (v) => {
+    idx.set(v, index); low.set(v, index); index++;
+    stack.push(v); onStack.add(v);
+    for (const w of adj.get(v) || []) {
+      if (!idx.has(w)) { visit(w); low.set(v, Math.min(low.get(v), low.get(w))); } else if (onStack.has(w)) low.set(v, Math.min(low.get(v), idx.get(w)));
+    }
+    if (low.get(v) === idx.get(v)) {
+      const comp = [];
+      let w;
+      do { w = stack.pop(); onStack.delete(w); comp.push(w); } while (w !== v);
+      if (comp.length > 1) res.push(comp);
+    }
+  };
+  for (const v of [...adj.keys()].sort()) if (!idx.has(v)) visit(v);
+  return res;
+}
+
+/** Packages that rules mention by name, so they get drawn on the map even if externals are hidden. */
+export function packagesNamedInRules(cfg) {
+  return (cfg.rules || []).flatMap((r) => [].concat(r.to || [])).filter((p) => p.startsWith('npm:'));
+}

package/src/scan.js

@@ -0,0 +1,306 @@
+// Reading source files (from disk or from a git commit) and pulling out their imports.
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+export const CODE_EXT = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts', '.cts'];
+// single-file components: only their <script> blocks are code
+export const SFC_EXT = ['.vue', '.svelte'];
+const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'out', '.next', '.nuxt',
+  'coverage', '.turbo', '.vercel', '.cache', '.output', '.svelte-kit']);
+const CONFIG_FILES = ['tsconfig.json', 'jsconfig.json'];
+// other files the system view reads: example env files (service URLs) and vercel.json (cron schedules)
+const EXTRA_RE = /(^|\/)(\.env\.(example|sample|template|dist|defaults)|vercel\.json)$/;
+
+export const isCode = (p) => (CODE_EXT.includes(path.posix.extname(p)) && !p.endsWith('.d.ts')) || SFC_EXT.includes(path.posix.extname(p));
+export const isExtra = (p) => EXTRA_RE.test(p);
+
+/** The code part of a file: for .vue/.svelte, the <script> blocks with everything else blanked (line numbers kept). */
+export function codeOf(file, text) {
+  if (text == null || !SFC_EXT.includes(path.posix.extname(file))) return text;
+  const out = text.replace(/[^\n]/g, ' ').split('');
+  const re = /<script\b[^>]*>([\s\S]*?)<\/script\s*>/gi;
+  let m;
+  while ((m = re.exec(text))) {
+    const start = m.index + m[0].indexOf('>') + 1;
+    for (let i = 0; i < m[1].length; i++) out[start + i] = m[1][i];
+  }
+  return out.join('');
+}
+
+/**
+ * Run git and return its output as text.
+ * @overload
+ * @param {string} cwd
+ * @param {string[]} args
+ * @returns {string}
+ */
+/**
+ * Run git with `input` on stdin and return the raw bytes (for `cat-file --batch`).
+ * @overload
+ * @param {string} cwd
+ * @param {string[]} args
+ * @param {string} input
+ * @returns {Buffer}
+ */
+/**
+ * @param {string} cwd
+ * @param {string[]} args
+ * @param {string} [input]
+ * @returns {string | Buffer}
+ */
+export function git(cwd, args, input) {
+  return execFileSync('git', args, {
+    cwd, input: input === undefined ? undefined : Buffer.from(input, 'utf8'),
+    encoding: input === undefined ? 'utf8' : null, // stdin callers get raw bytes back
+    maxBuffer: 1 << 30, stdio: ['pipe', 'pipe', 'pipe'],
+  });
+}
+
+export function gitInfo(dir) {
+  try {
+    const top = git(dir, ['rev-parse', '--show-toplevel']).trim();
+    const prefix = path.relative(top, dir).split(path.sep).join('/');
+    return { top, prefix };
+  } catch {
+    return null;
+  }
+}
+
+export function refExists(dir, ref) {
+  try { git(dir, ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`]); return true; } catch { return false; }
+}
+
+/**
+ * The files as they are on disk right now (respecting .gitignore when inside a repo).
+ * @param {string} dir
+ * @returns {import('./types.js').Source}
+ */
+export function workingTreeSource(dir) {
+  let files;
+  const gi = gitInfo(dir);
+  if (gi) {
+    files = git(dir, ['ls-files', '-co', '--exclude-standard', '-z', '--', '.'])
+      .split('\0').filter(Boolean)
+      .filter((f) => fs.existsSync(path.join(dir, f))); // drop deleted-but-still-tracked files
+  } else {
+    files = [];
+    const walk = (rel) => {
+      for (const ent of fs.readdirSync(path.join(dir, rel), { withFileTypes: true })) {
+        if (ent.name.startsWith('.') && ent.isDirectory()) continue;
+        const r = rel ? `${rel}/${ent.name}` : ent.name;
+        if (ent.isDirectory()) { if (!SKIP_DIRS.has(ent.name)) walk(r); } else files.push(r);
+      }
+    };
+    walk('');
+  }
+  files = files.map((f) => f.split(path.sep).join('/'))
+    .filter((f) => !f.split('/').some((s) => SKIP_DIRS.has(s)));
+  return {
+    label: 'working tree',
+    files: files.filter(isCode).sort(),
+    manifests: files.filter((f) => f === 'package.json' || f.endsWith('/package.json')).sort(),
+    extras: files.filter(isExtra).sort(),
+    read: (rel) => { try { return fs.readFileSync(path.join(dir, rel), 'utf8'); } catch { return null; } },
+  };
+}
+
+/**
+ * The files as they were at a git ref (branch, tag or commit).
+ * @param {string} dir
+ * @param {string} ref
+ * @returns {import('./types.js').Source}
+ */
+export function gitRefSource(dir, ref) {
+  const { prefix } = gitInfo(dir);
+  const top = git(dir, ['rev-parse', '--show-toplevel']).trim();
+  const pre = prefix ? `${prefix}/` : '';
+  const all = git(top, ['ls-tree', '-r', '--name-only', '-z', ref, '--', prefix || '.'])
+    .split('\0').filter(Boolean)
+    .filter((f) => f.startsWith(pre))
+    .map((f) => f.slice(pre.length))
+    .filter((f) => !f.split('/').some((s) => SKIP_DIRS.has(s)));
+  const code = all.filter(isCode).sort();
+  const manifests = all.filter((f) => f === 'package.json' || f.endsWith('/package.json')).sort();
+  const extras = all.filter(isExtra).sort();
+  const wanted = [...code, ...manifests, ...extras, ...CONFIG_FILES.filter((c) => all.includes(c))];
+
+  // Read every file in one `git cat-file --batch` call instead of one process per file.
+  const contents = new Map();
+  if (wanted.length) {
+    const buf = git(top, ['cat-file', '--batch'], wanted.map((f) => `${ref}:${pre}${f}`).join('\n') + '\n');
+    let pos = 0;
+    for (const f of wanted) {
+      const nl = buf.indexOf(10, pos);
+      const header = buf.slice(pos, nl).toString('utf8');
+      pos = nl + 1;
+      if (header.endsWith(' missing')) continue;
+      const size = Number(header.split(' ')[2]);
+      contents.set(f, buf.slice(pos, pos + size).toString('utf8'));
+      pos += size + 1;
+    }
+  }
+  return { label: ref, files: code, manifests, extras, read: (rel) => contents.get(rel) ?? null };
+}
+
+/**
+ * Blank out comments (keeping newlines so line numbers stay right) while leaving strings intact.
+ * Handles '...', "...", `...${ ... }...` and // and /* comments. Regex literals are not special-cased.
+ */
+export function stripComments(src) {
+  const out = src.split('');
+  const stack = []; // template-literal nesting: brace depth inside each ${ }
+  let i = 0;
+  let mode = 'code';
+  let braces = 0;
+  const blank = (a, b) => { for (let k = a; k < b; k++) if (out[k] !== '\n') out[k] = ' '; };
+  while (i < src.length) {
+    const c = src[i];
+    const n = src[i + 1];
+    if (mode === 'code') {
+      if (c === '/' && n === '/') { const e = src.indexOf('\n', i); const end = e < 0 ? src.length : e; blank(i, end); i = end; continue; }
+      if (c === '/' && n === '*') { const e = src.indexOf('*/', i + 2); const end = e < 0 ? src.length : e + 2; blank(i, end); i = end; continue; }
+      if (c === "'" || c === '"') { mode = c; i++; continue; }
+      if (c === '`') { mode = '`'; i++; continue; }
+      if (c === '{') braces++;
+      if (c === '}') {
+        if (stack.length && braces === stack[stack.length - 1]) { stack.pop(); mode = '`'; i++; continue; }
+        braces--;
+      }
+      i++;
+    } else if (mode === "'" || mode === '"') {
+      if (c === '\\') { i += 2; continue; }
+      if (c === mode || c === '\n') mode = 'code';
+      i++;
+    } else { // template literal
+      if (c === '\\') { i += 2; continue; }
+      if (c === '`') { mode = 'code'; i++; continue; }
+      if (c === '$' && n === '{') { stack.push(braces); mode = 'code'; i += 2; continue; }
+      i++;
+    }
+  }
+  return out.join('');
+}
+
+const IMPORT_RES = [
+  // import x from 'y' | import { a, type b } from "y" | import 'y' | export * from 'y' | export { a } from 'y'
+  /(?:^|[^.\w$])(?:import|export)\s+(?:type\s+)?(?:[\w*{}\s,$]+?\s+from\s*)?['"]([^'"\n]+)['"]/g,
+  // require('y')
+  /(?:^|[^.\w$])require\s*\(\s*['"]([^'"\n]+)['"]\s*\)/g,
+  // import('y')
+  /(?:^|[^.\w$])import\s*\(\s*['"]([^'"\n]+)['"]\s*\)/g,
+];
+
+export function extractImports(src) {
+  const code = stripComments(src);
+  const lineStarts = [0];
+  for (let i = 0; i < code.length; i++) if (code[i] === '\n') lineStarts.push(i + 1);
+  const lineOf = (idx) => {
+    let lo = 0; let hi = lineStarts.length - 1;
+    while (lo < hi) { const mid = (lo + hi + 1) >> 1; if (lineStarts[mid] <= idx) lo = mid; else hi = mid - 1; }
+    return lo + 1;
+  };
+  const found = [];
+  const seen = new Set();
+  for (const re of IMPORT_RES) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code))) {
+      const spec = m[1];
+      const line = lineOf(m.index + m[0].indexOf(spec));
+      const key = `${spec}@${line}`;
+      if (!seen.has(key)) { seen.add(key); found.push({ spec, line }); }
+    }
+  }
+  return found.sort((a, b) => a.line - b.line);
+}
+
+// ---------- resolving an import string to a file (or an npm package) ----------
+
+const BUILTINS = new Set(['assert', 'async_hooks', 'buffer', 'child_process', 'cluster', 'console', 'constants',
+  'crypto', 'dgram', 'diagnostics_channel', 'dns', 'domain', 'events', 'fs', 'http', 'http2', 'https', 'inspector',
+  'module', 'net', 'os', 'path', 'perf_hooks', 'process', 'punycode', 'querystring', 'readline', 'repl', 'stream',
+  'string_decoder', 'sys', 'timers', 'tls', 'trace_events', 'tty', 'url', 'util', 'v8', 'vm', 'wasi',
+  'worker_threads', 'zlib']);
+
+export function parseJsonc(text) {
+  const noComments = stripComments(text).replace(/,(\s*[}\]])/g, '$1');
+  return JSON.parse(noComments);
+}
+
+/** Read "paths" aliases (e.g. "@/*": ["src/*"]) from tsconfig/jsconfig, plus any from tecton config. */
+export function loadAliases(source, cfgAliases = {}) {
+  const aliases = [];
+  for (const name of CONFIG_FILES) {
+    const text = source.readConfig ? source.readConfig(name) : source.read(name);
+    if (!text) continue;
+    let json;
+    try { json = parseJsonc(text); } catch { continue; }
+    const co = json.compilerOptions || {};
+    const baseUrl = path.posix.normalize(co.baseUrl || '.');
+    for (const [pattern, targets] of Object.entries(co.paths || {})) {
+      aliases.push({ pattern, targets: targets.map((t) => path.posix.join(baseUrl, t)) });
+    }
+    if (co.baseUrl) aliases.push({ baseUrl });
+    break;
+  }
+  for (const [pattern, target] of Object.entries(cfgAliases)) {
+    aliases.unshift({ pattern, targets: [].concat(target) });
+  }
+  return aliases;
+}
+
+export function makeResolver(fileSet, aliases) {
+  const exts = CODE_EXT;
+  const tryFile = (p) => {
+    p = path.posix.normalize(p).replace(/^\.\//, '');
+    if (p.startsWith('../')) return null;
+    if (fileSet.has(p)) return p;
+    for (const e of exts) if (fileSet.has(p + e)) return p + e;
+    // TS ESM style: './foo.js' actually points at './foo.ts'
+    const m = p.match(/\.(m|c)?jsx?$/);
+    if (m) {
+      const stem = p.slice(0, -m[0].length);
+      for (const e of exts) if (fileSet.has(stem + e)) return stem + e;
+    }
+    for (const e of exts) if (fileSet.has(`${p}/index${e}`)) return `${p}/index${e}`;
+    return null;
+  };
+
+  return function resolve(fromFile, spec) {
+    if (spec.startsWith('.') || spec.startsWith('/')) {
+      const base = spec.startsWith('/') ? spec.slice(1) : path.posix.join(path.posix.dirname(fromFile), spec);
+      const file = tryFile(base);
+      return file ? { kind: 'file', file } : { kind: 'unresolved' };
+    }
+    for (const a of aliases) {
+      if (a.baseUrl) {
+        const file = tryFile(path.posix.join(a.baseUrl, spec));
+        if (file) return { kind: 'file', file };
+        continue;
+      }
+      const star = a.pattern.indexOf('*');
+      let captured = null;
+      if (star < 0) {
+        if (spec === a.pattern) captured = '';
+        else if (a.pattern.endsWith('/') && spec.startsWith(a.pattern)) captured = spec.slice(a.pattern.length);
+      } else {
+        const pre = a.pattern.slice(0, star);
+        const post = a.pattern.slice(star + 1);
+        if (spec.startsWith(pre) && spec.endsWith(post) && spec.length >= pre.length + post.length) {
+          captured = spec.slice(pre.length, spec.length - post.length);
+        }
+      }
+      if (captured === null) continue;
+      for (const t of a.targets) {
+        const file = tryFile(t.includes('*') ? t.replace('*', captured) : path.posix.join(t, captured));
+        if (file) return { kind: 'file', file };
+      }
+    }
+    const bare = spec.replace(/^node:/, '');
+    if (spec.startsWith('node:') || BUILTINS.has(bare.split('/')[0])) return { kind: 'builtin' };
+    const parts = spec.split('/');
+    const pkg = spec.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
+    return { kind: 'package', pkg };
+  };
+}