veryfront 0.1.1102 → 0.1.1104

package/esm/src/transforms/esm/import-attributes.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Import attribute rewrites anchored to lexer-reported positions.
+ *
+ * Every edit here is bounded by a range es-module-lexer reported for a real
+ * import statement, so module source embedded in a string literal (the
+ * `#deno-config` stub, the generated RSC bundles) is never touched. A plain
+ * regex over the module text cannot make that distinction.
+ *
+ * @module transforms/esm/import-attributes
+ */
+/**
+ * Rewrite the withdrawn `assert` spelling of an import attribute clause to
+ * `with`, for both the static and the dynamic form.
+ *
+ * esbuild treats `import-assertions` as a feature separate from
+ * `import-attributes` and drops the clause when the configured target does not
+ * claim it, which turns a working JSON import into "Attempted to load JSON
+ * module without specifying \"type\": \"json\"" at load time. Preserving the
+ * clause verbatim is no better: Node 22 and Deno 2 removed the keyword, so the
+ * only output that runs anywhere is `with`.
+ */
+export declare function upgradeImportAssertions(code: string): Promise<string>;
+/**
+ * Drop `with { type: "json" }` from every import whose specifier the caller
+ * accepts, leaving all other attributes in place.
+ *
+ * Only a lone JSON type attribute is removed. An import that declares anything
+ * else is describing something this rewrite knows nothing about, so it is left
+ * exactly as written.
+ */
+export declare function stripJsonImportAttributes(code: string, shouldStrip: (specifier: string) => boolean): Promise<string>;
+//# sourceMappingURL=import-attributes.d.ts.map

package/esm/src/transforms/esm/import-attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-attributes.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/import-attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgEH;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB3E;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAC1C,OAAO,CAAC,MAAM,CAAC,CAmBjB"}

package/esm/src/transforms/esm/import-attributes.js

@@ -0,0 +1,116 @@
+/**
+ * Import attribute rewrites anchored to lexer-reported positions.
+ *
+ * Every edit here is bounded by a range es-module-lexer reported for a real
+ * import statement, so module source embedded in a string literal (the
+ * `#deno-config` stub, the generated RSC bundles) is never touched. A plain
+ * regex over the module text cannot make that distinction.
+ *
+ * @module transforms/esm/import-attributes
+ */
+import { parseMaskedImports } from "./lexer.js";
+const ASSERT_KEYWORD = "assert";
+/**
+ * The legacy `assert` keyword following a static import specifier.
+ *
+ * es-module-lexer 2 no longer models assertions, so it ends the statement at
+ * the specifier and the clause sits immediately after it. Matching is confined
+ * to the specifier's own line, which is what the withdrawn grammar required.
+ */
+const STATIC_ASSERT_KEYWORD = /[^\S\r\n]*assert(?=[\s{])/y;
+/** The legacy `assert` key opening the options argument of a dynamic import. */
+const DYNAMIC_ASSERT_KEY = /^\s*,\s*\{\s*assert(?=\s*:)/;
+/** A `with` clause on a static import, capturing the attribute object. */
+const STATIC_WITH_CLAUSE = /^\s*with\s*(\{[^{}]*\})\s*$/;
+/** The options argument of a dynamic import, capturing the attribute object. */
+const DYNAMIC_WITH_ARGUMENT = /^\s*,\s*\{\s*with\s*:\s*(\{[^{}]*\})\s*,?\s*\}\s*$/;
+/** An attribute object declaring a JSON module type and nothing else. */
+const JSON_TYPE_ATTRIBUTE = /^\{\s*(["']?)type\1\s*:\s*(["'])json\2\s*,?\s*\}$/;
+/**
+ * The range holding everything a specifier declares after its own text: the
+ * `with` clause of a static import, or the options argument of a dynamic one.
+ *
+ * The range is empty when the import declares no attributes.
+ */
+function attributeRange(imp) {
+    // Static: `e` indexes the closing quote and `se` ends the statement before
+    // any semicolon, so the clause and its keyword lie between them.
+    if (imp.d === -1)
+        return { start: imp.e + 1, end: imp.se };
+    // Dynamic: `e` is already past the closing quote and `se` is past the
+    // closing paren, so the comma and the options argument lie between them.
+    return { start: imp.e, end: imp.se - 1 };
+}
+/** Whether the declared attributes are exactly a JSON module type. */
+function declaresJsonTypeOnly(clause, isDynamic) {
+    const attributes = (isDynamic ? DYNAMIC_WITH_ARGUMENT : STATIC_WITH_CLAUSE).exec(clause)?.[1];
+    return attributes !== undefined && JSON_TYPE_ATTRIBUTE.test(attributes);
+}
+/** Position of the legacy `assert` keyword this import uses, or `null`. */
+function findAssertKeyword(masked, imp) {
+    if (imp.d === -1) {
+        STATIC_ASSERT_KEYWORD.lastIndex = imp.se;
+        const match = STATIC_ASSERT_KEYWORD.exec(masked);
+        return match === null ? null : STATIC_ASSERT_KEYWORD.lastIndex - ASSERT_KEYWORD.length;
+    }
+    const { start, end } = attributeRange(imp);
+    if (start >= end)
+        return null;
+    const match = DYNAMIC_ASSERT_KEY.exec(masked.slice(start, end));
+    return match === null ? null : start + match[0].length - ASSERT_KEYWORD.length;
+}
+/**
+ * Rewrite the withdrawn `assert` spelling of an import attribute clause to
+ * `with`, for both the static and the dynamic form.
+ *
+ * esbuild treats `import-assertions` as a feature separate from
+ * `import-attributes` and drops the clause when the configured target does not
+ * claim it, which turns a working JSON import into "Attempted to load JSON
+ * module without specifying \"type\": \"json\"" at load time. Preserving the
+ * clause verbatim is no better: Node 22 and Deno 2 removed the keyword, so the
+ * only output that runs anywhere is `with`.
+ */
+export async function upgradeImportAssertions(code) {
+    if (!code.includes(ASSERT_KEYWORD))
+        return code;
+    const { masked, imports, unmask } = await parseMaskedImports(code);
+    let result = masked;
+    for (let i = imports.length - 1; i >= 0; i--) {
+        const imp = imports[i];
+        if (!imp?.n)
+            continue;
+        const keyword = findAssertKeyword(masked, imp);
+        if (keyword === null)
+            continue;
+        result = result.slice(0, keyword) + "with" + result.slice(keyword + ASSERT_KEYWORD.length);
+    }
+    return unmask(result);
+}
+/**
+ * Drop `with { type: "json" }` from every import whose specifier the caller
+ * accepts, leaving all other attributes in place.
+ *
+ * Only a lone JSON type attribute is removed. An import that declares anything
+ * else is describing something this rewrite knows nothing about, so it is left
+ * exactly as written.
+ */
+export async function stripJsonImportAttributes(code, shouldStrip) {
+    if (!code.includes("with"))
+        return code;
+    const { masked, imports, unmask } = await parseMaskedImports(code);
+    let result = masked;
+    for (let i = imports.length - 1; i >= 0; i--) {
+        const imp = imports[i];
+        if (!imp?.n)
+            continue;
+        if (!shouldStrip(unmask(imp.n)))
+            continue;
+        const { start, end } = attributeRange(imp);
+        if (start >= end)
+            continue;
+        if (!declaresJsonTypeOnly(masked.slice(start, end), imp.d > -1))
+            continue;
+        result = result.slice(0, start) + result.slice(end);
+    }
+    return unmask(result);
+}

package/esm/src/transforms/esm/import-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-parser.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/import-parser.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAKtE,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,uBAAuB;IAC/B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,UAAU,EAAE,WAAW,EAAE,CAAC;IAC1B,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAKD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,uBAAuB,CAAC,CA0HlC"}
+{"version":3,"file":"import-parser.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/import-parser.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAKtE,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,uBAAuB;IAC/B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,UAAU,EAAE,WAAW,EAAE,CAAC;IAC1B,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAwCD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,uBAAuB,CAAC,CA2HlC"}

package/esm/src/transforms/esm/import-parser.js

@@ -1,6 +1,8 @@
 import { compileContent } from "../mdx/compiler/index.js";
 import { getEsbuild } from "../../platform/compat/esbuild.js";
-import { join } from "../../platform/compat/path/index.js";
+import { dirname, join, relative } from "../../platform/compat/path/index.js";
+import { computeHash } from "../../utils/hash-utils.js";
+import { LRUCache } from "../../utils/lru-wrapper.js";
 import { createFileSystem } from "../../platform/compat/fs.js";
 import { isFrameworkSourcePath, resolveRelativeFrameworkSourceImport, } from "../../platform/compat/framework-source-resolver.js";
 import { isCrossProjectImport, parseCrossProjectImport } from "./path-resolver.js";
@@ -8,19 +10,43 @@ import { parseImports } from "./lexer.js";
 import { getLoaderFromPath } from "./transform-utils.js";
 const EXTENSIONS = [".tsx", ".ts", ".jsx", ".js", ".mdx"];
 const HAS_EXTENSION_RE = /\.(tsx?|jsx?|mjs|cjs|mdx|css)$/;
+/**
+ * Compiled MDX, keyed by project, file and content hash.
+ *
+ * Dependency parsing runs on every render, including every memory, Redis and
+ * MDX-ESM cache hit, and recurses through the dependency tree. Without this the
+ * full remark/rehype compile of every MDX file is paid again on each of them,
+ * for a result that cannot change while the content does not.
+ */
+const COMPILED_MDX_CACHE_MAX_ENTRIES = 200;
+const compiledMdxCache = new LRUCache({
+    maxEntries: COMPILED_MDX_CACHE_MAX_ENTRIES,
+});
+async function compileMdxForParsing(code, filePath, projectDir) {
+    const cacheKey = `${projectDir}::${filePath}::${await computeHash(code)}`;
+    const cached = compiledMdxCache.get(cacheKey);
+    if (cached !== undefined)
+        return cached;
+    const compiled = await compileContent("development", projectDir, code, undefined, filePath, "server");
+    compiledMdxCache.set(cacheKey, compiled.compiledCode);
+    return compiled.compiledCode;
+}
 export async function parseLocalImports(code, filePath, projectDir, adapter) {
-    if (filePath.endsWith(".css") || filePath.endsWith(".json")) {
+    // Markdown compiles to a fixed template whose only import is the bare JSX
+    // runtime, which this parser discards, so the answer for a `.md` file is
+    // always "no dependencies". Compiling one to learn that is pure cost on a
+    // path that runs per render.
+    if (filePath.endsWith(".css") || filePath.endsWith(".json") || /\.md$/i.test(filePath)) {
         return { imports: [], cssImports: [], crossProjectImports: [], missing: [] };
     }
-    // MDX/Markdown is not JSX, so handing the raw source to esbuild under the
-    // `jsx` loader fails with "<stdin>:1:1: ERROR: Syntax error" — which surfaced
-    // to users as "Component has missing dependencies" for a file that exists.
-    // Compile content to JSX first, exactly as the transform pipeline's parse
-    // stage does, then read the imports out of that.
+    // MDX is not JSX, so handing the raw source to esbuild under the `jsx` loader
+    // fails with "<stdin>:1:1: ERROR: Syntax error", which surfaced to users as
+    // "Component has missing dependencies" for a file that exists. Compile
+    // content to JSX first, exactly as the transform pipeline's parse stage does,
+    // then read the imports out of that.
     let parseSource = code;
-    if (/\.mdx?$/i.test(filePath)) {
-        const compiled = await compileContent("development", projectDir, code, undefined, filePath, "server");
-        parseSource = compiled.compiledCode;
+    if (/\.mdx$/i.test(filePath)) {
+        parseSource = await compileMdxForParsing(code, filePath, projectDir);
     }
     const esbuild = await getEsbuild();
     const result = await esbuild.transform(parseSource, {
@@ -49,19 +75,24 @@ export async function parseLocalImports(code, filePath, projectDir, adapter) {
         // below and are dropped without even being reported as missing, so an MDX
         // file's sibling components are never recursively transformed.
         if (specifier.startsWith("file://")) {
-            const absolutePath = fileUrlToPath(specifier);
-            if (absolutePath && await checkFileExists(absolutePath, adapter)) {
-                const entry = { specifier, absolutePath };
-                if (absolutePath.endsWith(".css"))
+            const targetPath = fileUrlToPath(specifier);
+            // A rewritten specifier carries a server path the author never wrote, and
+            // this record is read back verbatim in the "Component has missing
+            // dependencies" build error. Report what the author wrote instead.
+            const authoredSpecifier = toAuthoredSpecifier(targetPath, specifier, filePath);
+            const resolved = targetPath ? await resolveExistingFilePath(targetPath, adapter) : null;
+            if (resolved) {
+                const entry = { specifier: authoredSpecifier, absolutePath: resolved };
+                if (resolved.endsWith(".css"))
                     cssImports.push(entry);
                 else
                     localImports.push(entry);
                 continue;
             }
             missingImports.push({
-                specifier,
+                specifier: authoredSpecifier,
                 fromFile: filePath,
-                reason: `File not found: ${absolutePath ?? specifier}`,
+                reason: `File not found: tried extensions ${EXTENSIONS.join(", ")}`,
             });
             continue;
         }
@@ -116,6 +147,17 @@ export async function parseLocalImports(code, filePath, projectDir, adapter) {
     }
     return { imports: localImports, cssImports, crossProjectImports, missing: missingImports };
 }
+/**
+ * The specifier as the author most likely wrote it, reconstructed from the
+ * absolute path a compile step rewrote it to. Falls back to the file name when
+ * the URL cannot be read, so no server path escapes into a user-facing report.
+ */
+function toAuthoredSpecifier(targetPath, specifier, fromFile) {
+    if (!targetPath)
+        return `./${specifier.slice(specifier.lastIndexOf("/") + 1)}`;
+    const relativePath = relative(dirname(fromFile), targetPath);
+    return relativePath.startsWith(".") ? relativePath : `./${relativePath}`;
+}
 /** Filesystem path behind a `file://` specifier, or null when it is not one. */
 function fileUrlToPath(specifier) {
     try {
@@ -147,7 +189,15 @@ async function resolveLocalImportPath(fromFile, importSpecifier, adapter) {
             return resolvedFrameworkImport;
     }
     const fromDir = fromFile.substring(0, fromFile.lastIndexOf("/"));
-    const basePath = resolveRelative(fromDir, importSpecifier);
+    return await resolveExistingFilePath(resolveRelative(fromDir, importSpecifier), adapter);
+}
+/**
+ * Path of the file a local import points at: the adapter's own resolution
+ * first, then the extension and directory-index probes. Every local import
+ * shape resolves through here, so an extensionless or directory specifier
+ * behaves the same however it reached this module.
+ */
+async function resolveExistingFilePath(basePath, adapter) {
     if (adapter?.fs.resolveFile) {
         try {
             const normalizedPath = basePath.replace(/^\/+/, "");
@@ -160,7 +210,7 @@ async function resolveLocalImportPath(fromFile, importSpecifier, adapter) {
             // Fall through to traditional resolution
         }
     }
-    if (HAS_EXTENSION_RE.test(importSpecifier)) {
+    if (HAS_EXTENSION_RE.test(basePath)) {
         return (await checkFileExists(basePath, adapter)) ? basePath : null;
     }
     for (const ext of EXTENSIONS) {

package/esm/src/transforms/esm/lexer.d.ts

@@ -2,6 +2,24 @@ import type { ImportSpecifier } from "../../extensions/bundler/module-lexer.js";
 export type { ImportSpecifier };
 export declare function initLexer(): Promise<void>;
 export declare function parseImports(code: string): Promise<readonly ImportSpecifier[]>;
+/** A parse whose positions index into a masked copy of the source. */
+export interface MaskedParse {
+    /** The source with HTTP URLs replaced by fixed-width placeholders. */
+    masked: string;
+    /** Specifiers whose every positional field indexes into {@link masked}. */
+    imports: readonly ImportSpecifier[];
+    /** Restore the masked HTTP URLs in a string derived from {@link masked}. */
+    unmask: (text: string) => string;
+}
+/**
+ * Parse imports and hand back the masked source the positions belong to.
+ *
+ * Masking changes offsets, so `imp.s`, `imp.a` and friends are meaningless
+ * against the original text. Callers that splice by position must edit
+ * `masked` and run the result through `unmask`; callers that only need
+ * specifier names should use {@link parseImports} instead.
+ */
+export declare function parseMaskedImports(code: string): Promise<MaskedParse>;
 /**
  * Replace import specifiers (the path string) in the code.
  * Safe for simple re-mappings like aliases or rewriting URLs.

package/esm/src/transforms/esm/lexer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lexer.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/lexer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAe,MAAM,0CAA0C,CAAC;AAE7F,YAAY,EAAE,eAAe,EAAE,CAAC;AAuDhC,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAS/C;AAyBD,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAqBpF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7E,OAAO,CAAC,MAAM,CAAC,CAoCjB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GACnE,OAAO,CAAC,MAAM,CAAC,CAsBjB"}
+{"version":3,"file":"lexer.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/lexer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAe,MAAM,0CAA0C,CAAC;AAE7F,YAAY,EAAE,eAAe,EAAE,CAAC;AAuDhC,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAS/C;AAyBD,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAqBpF;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,4EAA4E;IAC5E,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAc3E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7E,OAAO,CAAC,MAAM,CAAC,CAoCjB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GACnE,OAAO,CAAC,MAAM,CAAC,CAsBjB"}

package/esm/src/transforms/esm/lexer.js

@@ -86,6 +86,27 @@ export async function parseImports(code) {
         return restoredN === imp.n ? imp : { ...imp, n: restoredN };
     });
 }
+/**
+ * Parse imports and hand back the masked source the positions belong to.
+ *
+ * Masking changes offsets, so `imp.s`, `imp.a` and friends are meaningless
+ * against the original text. Callers that splice by position must edit
+ * `masked` and run the result through `unmask`; callers that only need
+ * specifier names should use {@link parseImports} instead.
+ */
+export async function parseMaskedImports(code) {
+    await initLexer();
+    const { masked, urlMap } = maskHttpUrls(code);
+    let imports;
+    try {
+        imports = getLexer().parse(masked);
+    }
+    catch (error) {
+        logParseError(error, masked);
+        throw error;
+    }
+    return { masked, imports, unmask: (text) => unmaskHttpUrls(text, urlMap) };
+}
 /**
  * Replace import specifiers (the path string) in the code.
  * Safe for simple re-mappings like aliases or rewriting URLs.

package/esm/src/transforms/esm/specifier-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"specifier-resolver.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/specifier-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,EACL,KAAK,YAAY,EAQlB,MAAM,yBAAyB,CAAC;AAEjC,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAoH/F,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,EAAE,YAAY,EACrB,eAAe,EAAE,iBAAiB,GACjC,OAAO,CAAC,qBAAqB,CAAC,CAuChC;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,YAAY,EACrB,eAAe,EAAE,iBAAiB,GACjC,OAAO,CAAC,eAAe,CAAC,CAa1B"}
+{"version":3,"file":"specifier-resolver.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/specifier-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,EACL,KAAK,YAAY,EAQlB,MAAM,yBAAyB,CAAC;AAEjC,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AA+H/F,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,EAAE,YAAY,EACrB,eAAe,EAAE,iBAAiB,GACjC,OAAO,CAAC,qBAAqB,CAAC,CAuChC;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,YAAY,EACrB,eAAe,EAAE,iBAAiB,GACjC,OAAO,CAAC,eAAe,CAAC,CAa1B"}

package/esm/src/transforms/esm/specifier-resolver.js

@@ -9,6 +9,8 @@
 import { basename } from "../../platform/compat/path/index.js";
 import { resolveImport } from "../../modules/import-map/resolver.js";
 import { rendererLogger } from "../../utils/index.js";
+import { parseBarePackageSpecifier } from "../shared/package-specifier.js";
+import { isServerOnlyPackage } from "../shared/server-only-packages.js";
 import { parseImports, replaceSpecifiers } from "./lexer.js";
 const logger = rendererLogger.component("specifier-resolver");
 import { isCanonicalReactEsmUrl, isExternalScheme, isHttpUrl, isInternalBare, isParentHttpModule, isRelative, resolveBareSpecifier, } from "./http-cache-helpers.js";
@@ -26,6 +28,17 @@ function isLocalMappedSpecifier(specifier) {
 async function resolveSpecifier(specifier, baseUrl, options, cacheHttpModule) {
     if (isExternalScheme(specifier))
         return null;
+    // Server-only packages (`redis`, `pg`, …), including their explicit `npm:`
+    // form, must never be routed through esm.sh. esm.sh either 500s building them
+    // or emits a browser bundle with Node built-ins stubbed that can never
+    // connect. The framework's adapters only `import()` them behind a lazy,
+    // configured code path, so leaving the specifier external lets the runtime
+    // resolve the real package (node_modules on Node, npm: on Deno) if and when
+    // the backend is actually used — and costs nothing when it is not.
+    const serverOnlyCandidate = specifier.startsWith("npm:") ? specifier.slice(4) : specifier;
+    const serverOnlyParsed = parseBarePackageSpecifier(serverOnlyCandidate);
+    if (serverOnlyParsed && isServerOnlyPackage(serverOnlyParsed.packageName))
+        return null;
     if (isInternalBare(specifier)) {
         const mapped = resolveImport(specifier, options.importMap);
         if (mapped === specifier)

package/esm/src/transforms/esm/transform-utils.d.ts

@@ -12,9 +12,17 @@ export declare function computeShortContentHash(content: string): Promise<string
  * that consumes this output requires the attribute to load a JSON module, so
  * dropping it turns a working import into a load-time error:
  * `Attempted to load JSON module without specifying "type": "json"`.
+ *
+ * `import-assertions` is the separate feature key esbuild uses for the
+ * withdrawn `assert { type: "json" }` spelling of the same clause. It is
+ * enabled for the same reason, so the clause reaches the output instead of
+ * vanishing. The output must not keep that spelling though, because Node 22
+ * and Deno 2 removed the keyword, so every consumer of these options runs the
+ * result through `upgradeImportAssertions` to rewrite it to `with`.
  */
 export declare const ESBUILD_SUPPORTED_FEATURES: {
     readonly "import-attributes": true;
+    readonly "import-assertions": true;
 };
 export declare function getLoaderFromPath(filePath: string): Loader;
 export declare function needsTransform(filePath: string): boolean;

package/esm/src/transforms/esm/transform-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transform-utils.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/transform-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAGhE;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAExE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B;;CAAyC,CAAC;AAajF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExD"}
+{"version":3,"file":"transform-utils.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/transform-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAGhE;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAExE;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0BAA0B;;;CAG7B,CAAC;AAaX,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/esm/src/transforms/esm/transform-utils.js

@@ -14,8 +14,18 @@ export function computeShortContentHash(content) {
  * that consumes this output requires the attribute to load a JSON module, so
  * dropping it turns a working import into a load-time error:
  * `Attempted to load JSON module without specifying "type": "json"`.
+ *
+ * `import-assertions` is the separate feature key esbuild uses for the
+ * withdrawn `assert { type: "json" }` spelling of the same clause. It is
+ * enabled for the same reason, so the clause reaches the output instead of
+ * vanishing. The output must not keep that spelling though, because Node 22
+ * and Deno 2 removed the keyword, so every consumer of these options runs the
+ * result through `upgradeImportAssertions` to rewrite it to `with`.
  */
-export const ESBUILD_SUPPORTED_FEATURES = { "import-attributes": true };
+export const ESBUILD_SUPPORTED_FEATURES = {
+    "import-attributes": true,
+    "import-assertions": true,
+};
 const EXTENSION_LOADERS = {
     ".tsx": "tsx",
     ".ts": "ts",

package/esm/src/transforms/import-rewriter/project-paths.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Project-relative path helpers shared by the rewrite strategies.
+ *
+ * Several strategies need the path of the file being transformed expressed
+ * relative to the project root: the alias and relative strategies to build
+ * module URLs, the asset strategy to name the importer in its message.
+ */
+/**
+ * Path of `filePath` relative to `projectDir`, or null when the file is not
+ * inside the project.
+ *
+ * The check is on a path boundary, so `/projectile/src/Header.tsx` is not
+ * treated as living inside `/project`.
+ */
+export declare function relativeToProjectDir(filePath: string, projectDir: string): string | null;
+/**
+ * Best-effort project-relative path, for callers that need a path to build a
+ * module URL from and have no useful fallback.
+ *
+ * A file outside the project can still be a copy of a project file staged
+ * somewhere else (a temp bundle directory, for example), so the project
+ * directory name is looked up in the path before giving up and returning the
+ * input unchanged.
+ */
+export declare function getProjectRelativePath(filePath: string, projectDir: string): string;
+//# sourceMappingURL=project-paths.d.ts.map

package/esm/src/transforms/import-rewriter/project-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-paths.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/import-rewriter/project-paths.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQxF;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAanF"}

package/esm/src/transforms/import-rewriter/project-paths.js

@@ -0,0 +1,49 @@
+/**
+ * Project-relative path helpers shared by the rewrite strategies.
+ *
+ * Several strategies need the path of the file being transformed expressed
+ * relative to the project root: the alias and relative strategies to build
+ * module URLs, the asset strategy to name the importer in its message.
+ */
+/** Normalize separators and drop any trailing slash. */
+function normalizeDir(dir) {
+    return dir.replace(/\\/g, "/").replace(/\/+$/, "");
+}
+/**
+ * Path of `filePath` relative to `projectDir`, or null when the file is not
+ * inside the project.
+ *
+ * The check is on a path boundary, so `/projectile/src/Header.tsx` is not
+ * treated as living inside `/project`.
+ */
+export function relativeToProjectDir(filePath, projectDir) {
+    const normalizedFilePath = filePath.replace(/\\/g, "/");
+    const normalizedProjectDir = normalizeDir(projectDir);
+    if (normalizedFilePath === normalizedProjectDir)
+        return "";
+    if (!normalizedFilePath.startsWith(`${normalizedProjectDir}/`))
+        return null;
+    return normalizedFilePath.slice(normalizedProjectDir.length + 1);
+}
+/**
+ * Best-effort project-relative path, for callers that need a path to build a
+ * module URL from and have no useful fallback.
+ *
+ * A file outside the project can still be a copy of a project file staged
+ * somewhere else (a temp bundle directory, for example), so the project
+ * directory name is looked up in the path before giving up and returning the
+ * input unchanged.
+ */
+export function getProjectRelativePath(filePath, projectDir) {
+    const direct = relativeToProjectDir(filePath, projectDir);
+    if (direct !== null)
+        return direct;
+    if (!filePath.startsWith("/"))
+        return filePath;
+    const pathParts = filePath.split("/");
+    const lastProjectPart = normalizeDir(projectDir).split("/").at(-1);
+    const projectIndex = lastProjectPart ? pathParts.indexOf(lastProjectPart) : -1;
+    if (projectIndex >= 0)
+        return pathParts.slice(projectIndex + 1).join("/");
+    return filePath;
+}

package/esm/src/transforms/import-rewriter/strategies/alias-strategy.d.ts

@@ -4,7 +4,6 @@ export declare class AliasStrategy implements ImportRewriteStrategy {
     readonly priority = 1;
     matches(specifier: string, _ctx: RewriteContext): boolean;
     rewrite(info: ImportSpecifierInfo, ctx: RewriteContext): RewriteResult;
-    private getRelativeFilePath;
 }
 export declare const aliasStrategy: AliasStrategy;
 //# sourceMappingURL=alias-strategy.d.ts.map

package/esm/src/transforms/import-rewriter/strategies/alias-strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alias-strategy.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/import-rewriter/strategies/alias-strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,aAAa,EACd,MAAM,aAAa,CAAC;AAGrB,qBAAa,aAAc,YAAW,qBAAqB;IACzD,QAAQ,CAAC,IAAI,WAAW;IACxB,QAAQ,CAAC,QAAQ,KAAK;IAEtB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO;IAIzD,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,cAAc,GAAG,aAAa;IAyCtE,OAAO,CAAC,mBAAmB;CAoB5B;AAED,eAAO,MAAM,aAAa,eAAsB,CAAC"}
+{"version":3,"file":"alias-strategy.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/import-rewriter/strategies/alias-strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,aAAa,EACd,MAAM,aAAa,CAAC;AAIrB,qBAAa,aAAc,YAAW,qBAAqB;IACzD,QAAQ,CAAC,IAAI,WAAW;IACxB,QAAQ,CAAC,QAAQ,KAAK;IAEtB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO;IAIzD,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,cAAc,GAAG,aAAa;CAwCvE;AAED,eAAO,MAAM,aAAa,eAAsB,CAAC"}

package/esm/src/transforms/import-rewriter/strategies/alias-strategy.js

@@ -1,4 +1,5 @@
 import { normalizeExtension } from "../url-builder.js";
+import { getProjectRelativePath } from "../project-paths.js";
 export class AliasStrategy {
     name = "alias";
     priority = 1;
@@ -11,7 +12,7 @@ export class AliasStrategy {
         if (ctx.target === "ssr") {
             let normalizedPath = normalizeExtension(path);
             // Add .js if no extension present
-            if (!/\.(tsx?|jsx?|mjs|cjs|mdx|css|js)$/.test(normalizedPath)) {
+            if (!/\.(tsx?|jsx?|mjs|cjs|mdx|css)$/.test(normalizedPath)) {
                 normalizedPath = `${normalizedPath}.js`;
             }
             return { specifier: `/_vf_modules/${normalizedPath}` };
@@ -22,38 +23,22 @@ export class AliasStrategy {
         // but module path is "_vf_modules/components/elements/Textarea.js").
         if (ctx.moduleServerUrl) {
             let normalizedPath = normalizeExtension(path);
-            if (!/\.(tsx?|jsx?|mjs|cjs|mdx|css|js)$/.test(normalizedPath)) {
+            if (!/\.(tsx?|jsx?|mjs|cjs|mdx|css)$/.test(normalizedPath)) {
                 normalizedPath = `${normalizedPath}.js`;
             }
             return { specifier: `${ctx.moduleServerUrl}/${normalizedPath}` };
         }
         // Fallback: Use relative paths when no module server is configured.
         // This is used for local development without a module server.
-        const relativeFilePath = this.getRelativeFilePath(ctx.filePath, ctx.projectDir);
+        const relativeFilePath = getProjectRelativePath(ctx.filePath, ctx.projectDir);
         const fileDir = relativeFilePath.substring(0, relativeFilePath.lastIndexOf("/"));
         const depth = fileDir.split("/").filter(Boolean).length;
         const prefix = depth === 0 ? "./" : "../".repeat(depth);
         let relativePath = normalizeExtension(`${prefix}${path}`);
-        if (!/\.(tsx?|jsx?|mjs|cjs|mdx|css|js)$/.test(relativePath)) {
+        if (!/\.(tsx?|jsx?|mjs|cjs|mdx|css)$/.test(relativePath)) {
             relativePath = `${relativePath}.js`;
         }
         return { specifier: relativePath };
     }
-    getRelativeFilePath(filePath, projectDir) {
-        const normalizedProjectDir = projectDir.replace(/\\/g, "/").replace(/\/$/, "");
-        if (filePath.startsWith(normalizedProjectDir)) {
-            return filePath.substring(normalizedProjectDir.length + 1);
-        }
-        if (!filePath.startsWith("/"))
-            return filePath;
-        const pathParts = filePath.split("/");
-        const projectParts = normalizedProjectDir.split("/");
-        const lastProjectPart = projectParts.at(-1);
-        const projectIndex = lastProjectPart ? pathParts.indexOf(lastProjectPart) : -1;
-        if (projectIndex >= 0) {
-            return pathParts.slice(projectIndex + 1).join("/");
-        }
-        return filePath;
-    }
 }
 export const aliasStrategy = new AliasStrategy();

package/esm/src/transforms/import-rewriter/strategies/asset-strategy.d.ts

@@ -1,4 +1,4 @@
-import type { ImportRewriteStrategy, ImportSpecifierInfo, RewriteContext, RewriteResult } from "../types.js";
+import { type ImportRewriteStrategy, type ImportSpecifierInfo, type RewriteContext, type RewriteResult } from "../types.js";
 /**
  * Reject `import logo from "@/assets/logo.svg"`.
  *

package/esm/src/transforms/import-rewriter/strategies/asset-strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"asset-strategy.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/import-rewriter/strategies/asset-strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,aAAa,EACd,MAAM,aAAa,CAAC;AAarB;;;;;;;;;;;;;GAaG;AACH,qBAAa,aAAc,YAAW,qBAAqB;IACzD,QAAQ,CAAC,IAAI,WAAW;IAGxB,QAAQ,CAAC,QAAQ,OAAO;IAExB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO;IAIzD,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,cAAc,GAAG,aAAa;CAiBvE;AAED,eAAO,MAAM,aAAa,eAAsB,CAAC"}
+{"version":3,"file":"asset-strategy.d.ts","sourceRoot":"","sources":["../../../../../src/src/transforms/import-rewriter/strategies/asset-strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAkErB;;;;;;;;;;;;;GAaG;AACH,qBAAa,aAAc,YAAW,qBAAqB;IACzD,QAAQ,CAAC,IAAI,WAAW;IAGxB,QAAQ,CAAC,QAAQ,OAAO;IAExB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO;IAWzD,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,cAAc,GAAG,aAAa;CAevE;AAED,eAAO,MAAM,aAAa,eAAsB,CAAC"}