Take on dependencies to reduce chance of failure

Author: danlapid

packages/dynamic-worker-bundler/README.md

@@ -50,6 +50,7 @@ await worker.getEntrypoint().fetch(request);
 | `externals` | `string[]` | `[]` | Additional modules to exclude (`cloudflare:*` always excluded) |
 | `minify` | `boolean` | `false` | Minify output |
 | `sourcemap` | `boolean` | `false` | Generate inline source maps |
+| `registry` | `string` | `'https://registry.npmjs.org'` | npm registry URL |
 
 ### Returns
 
@@ -119,6 +120,10 @@ interface Env {
 }
 ```
 
+## Future Work
+
+- **Lockfile support**: Read `package-lock.json` / `pnpm-lock.yaml` for deterministic installs
+
 ## License
 
 MIT

packages/dynamic-worker-bundler/build.mjs

@@ -43,7 +43,14 @@ await esbuild.build({
   target: 'es2022',
   sourcemap: true,
   // Mark npm dependencies as external
-  external: ['esbuild-wasm', 'sucrase', 'resolve.exports', 'smol-toml'],
+  external: [
+    'esbuild-wasm',
+    'sucrase',
+    'resolve.exports',
+    'smol-toml',
+    'es-module-lexer',
+    'semver',
+  ],
   plugins: [
     {
       name: 'wasm-external',

packages/dynamic-worker-bundler/package.json

@@ -19,12 +19,15 @@
   },
   "devDependencies": {
     "@types/node": "catalog:",
+    "@types/semver": "^7.0.0",
     "esbuild": "^0.27.0",
     "typescript": "catalog:"
   },
   "dependencies": {
+    "es-module-lexer": "^2.0.0",
     "esbuild-wasm": "^0.27.0",
     "resolve.exports": "^2.0.0",
+    "semver": "^7.0.0",
     "smol-toml": "^1.0.0",
     "sucrase": "^3.0.0"
   },

packages/dynamic-worker-bundler/src/index.ts

@@ -41,6 +41,7 @@ export async function createWorker(options: CreateWorkerOptions): Promise<Create
     target = 'es2022',
     minify = false,
     sourcemap = false,
+    registry,
   } = options;
 
   // Always treat cloudflare:* modules as external (runtime-provided)
@@ -53,7 +54,7 @@ export async function createWorker(options: CreateWorkerOptions): Promise<Create
   // Auto-install dependencies if package.json has dependencies
   const installWarnings: string[] = [];
   if (hasDependencies(files)) {
-    const installResult = await installDependencies(files);
+    const installResult = await installDependencies(files, registry ? { registry } : {});
     files = installResult.files;
     installWarnings.push(...installResult.warnings);
   }

packages/dynamic-worker-bundler/src/installer.ts

@@ -5,6 +5,7 @@
  * a virtual node_modules directory structure.
  */
 
+import * as semver from 'semver';
 import type { Files } from './types.js';
 
 const NPM_REGISTRY = 'https://registry.npmjs.org';
@@ -259,54 +260,11 @@ function resolveVersion(range: string, metadata: NpmPackageMetadata): string | u
     return metadata['dist-tags'][range];
   }
 
-  // For ranges like ^1.0.0, ~1.0.0, >=1.0.0, we need to find the best match
-  // Simple implementation: find the highest version that starts with the major version
+  // Use semver.maxSatisfying to find the best matching version
   const versions = Object.keys(metadata.versions);
+  const match = semver.maxSatisfying(versions, range);
 
-  // Parse the range to extract constraints
-  const cleanRange = range.replace(/^[\^~>=<]+/, '');
-  const [majorStr] = cleanRange.split('.');
-  const major = parseInt(majorStr ?? '0', 10);
-
-  // Filter versions that match the major version (for ^ ranges)
-  // This is a simplified semver matching - in production you'd use a proper semver library
-  if (range.startsWith('^') || range.startsWith('~')) {
-    const matchingVersions = versions
-      .filter((v) => {
-        const [vMajor] = v.split('.');
-        return parseInt(vMajor ?? '0', 10) === major;
-      })
-      .sort(compareVersions)
-      .reverse();
-
-    return matchingVersions[0];
-  }
-
-  // For >= ranges, get the latest
-  if (range.startsWith('>=')) {
-    return metadata['dist-tags']['latest'];
-  }
-
-  // Fallback: try to find any version that might work
-  const sortedVersions = versions.sort(compareVersions).reverse();
-  return sortedVersions[0];
-}
-
-/**
- * Compare two semver versions.
- */
-function compareVersions(a: string, b: string): number {
-  const aParts = a.split('.').map((p) => parseInt(p.replace(/[^0-9]/g, ''), 10) || 0);
-  const bParts = b.split('.').map((p) => parseInt(p.replace(/[^0-9]/g, ''), 10) || 0);
-
-  for (let i = 0; i < 3; i++) {
-    const aVal = aParts[i] ?? 0;
-    const bVal = bParts[i] ?? 0;
-    if (aVal !== bVal) {
-      return aVal - bVal;
-    }
-  }
-  return 0;
+  return match ?? undefined;
 }
 
 /**

packages/dynamic-worker-bundler/src/resolver.ts

@@ -1,3 +1,5 @@
+// Use the asm.js version to avoid WASM (works in workerd)
+import { parse } from 'es-module-lexer/js';
 import * as resolveExports from 'resolve.exports';
 import type { Files } from './types.js';
 
@@ -282,10 +284,36 @@ function normalizeRelativePath(path: string): string {
 /**
  * Parse imports from a JavaScript/TypeScript source file.
  *
- * This is a simple regex-based parser that handles common import patterns.
- * It doesn't handle all edge cases but works for most practical use cases.
+ * Uses es-module-lexer for accurate parsing of ES module syntax.
+ * Falls back to regex for JSX files since es-module-lexer doesn't
+ * handle JSX syntax (e.g., `<div>` is not valid JavaScript).
  */
 export function parseImports(code: string): string[] {
+  try {
+    const [imports] = parse(code);
+    const specifiers: string[] = [];
+
+    for (const imp of imports) {
+      // imp.n is the resolved module specifier (handles escape sequences)
+      // imp.n is undefined for dynamic imports with non-string arguments
+      if (imp.n !== undefined) {
+        specifiers.push(imp.n);
+      }
+    }
+
+    return [...new Set(specifiers)]; // Deduplicate
+  } catch {
+    // es-module-lexer fails on JSX syntax (<Component />) and malformed code
+    // Fall back to regex-based parsing
+    return parseImportsRegex(code);
+  }
+}
+
+/**
+ * Regex-based fallback for parsing imports.
+ * Used when es-module-lexer fails (e.g., on JSX/TSX files).
+ */
+function parseImportsRegex(code: string): string[] {
   const imports: string[] = [];
 
   // Match ES module imports

packages/dynamic-worker-bundler/src/types.ts

@@ -67,6 +67,12 @@ export interface CreateWorkerOptions {
    * @default false
    */
   sourcemap?: boolean;
+
+  /**
+   * npm registry URL for fetching packages.
+   * @default 'https://registry.npmjs.org'
+   */
+  registry?: string;
 }
 
 /**