fix(pack): bundle direct tsdown picomatch require

[fengmk2]

Summary

Fixes the bundled tsdown build so direct createRequire(...)("picomatch") calls are rewritten to the bundled local CJS entry, matching the existing handling for assigned require calls.

This prevents vp pack from depending on an undeclared runtime picomatch resolution when installed with pnpm hoist: false.

Root Cause

The core package build step already scans bundled tsdown output for third-party CJS requires and creates local bundled entry files. It handled patterns like:

const require = createRequire(import.meta.url);
require("pkg");

but missed direct-call patterns like:

createRequire(import.meta.url)("picomatch");

As a result, picomatch remained a runtime package lookup from @voidzero-dev/vite-plus-core/dist/tsdown/main-*.js.

Validation

• pnpm -F @voidzero-dev/vite-plus-core build
• pnpm -F vite-plus snap-test-global command-pack-picomatch-hoist-false
• git diff --check -- packages/core/build-support/find-create-require.ts packages/cli/snap-tests-global/command-pack-picomatch-hoist-false

Fixes #1731

---

Note

Medium Risk
Changes core build-time AST rewriting for bundled tsdown CJS requires; incorrect detection could break pack/runtime resolution, but scope is limited to the existing replaceThirdPartyCjsRequires path.

Overview
Extends the tsdown re-bundle step’s createRequire scanner so inline createRequire(...)("picomatch") (and similar) calls get rewritten to local bundled CJS entry paths, not only const require = createRequire(...); require("pkg").

The AST helpers now return flat RequireCall lists, share literal-argument extraction, and add findDirectCreateRequireCalls for both static-import and getBuiltinModule createRequire patterns.

Adds a global snap fixture command-pack-picomatch-hoist-false (pnpm hoist: false) to assert vp pack completes without relying on hoisted picomatch.

^{Reviewed by Cursor Bugbot for commit 03f5f91. Configure here.}

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	97317a7
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a1d2e71512fed0008ad408b

[fengmk2]

@cursor review

[pkg-pr-new]

Open in StackBlitz

vite-plus

npm i https://pkg.pr.new/voidzero-dev/vite-plus@1732

@voidzero-dev/vite-plus-core

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-core@1732

@voidzero-dev/vite-plus-prompts

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-prompts@1732

@voidzero-dev/vite-plus-test

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-test@1732

@voidzero-dev/vite-plus-cli-darwin-arm64

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-darwin-arm64@1732

@voidzero-dev/vite-plus-cli-darwin-x64

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-darwin-x64@1732

@voidzero-dev/vite-plus-cli-linux-arm64-gnu

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-linux-arm64-gnu@1732

@voidzero-dev/vite-plus-cli-linux-arm64-musl

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-linux-arm64-musl@1732

@voidzero-dev/vite-plus-cli-linux-x64-gnu

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-linux-x64-gnu@1732

@voidzero-dev/vite-plus-cli-linux-x64-musl

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-linux-x64-musl@1732

@voidzero-dev/vite-plus-cli-win32-arm64-msvc

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-win32-arm64-msvc@1732

@voidzero-dev/vite-plus-cli-win32-x64-msvc

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-cli-win32-x64-msvc@1732

@voidzero-dev/vite-plus-darwin-arm64

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-darwin-arm64@1732

@voidzero-dev/vite-plus-darwin-x64

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-darwin-x64@1732

@voidzero-dev/vite-plus-linux-arm64-gnu

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-linux-arm64-gnu@1732

@voidzero-dev/vite-plus-linux-arm64-musl

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-linux-arm64-musl@1732

@voidzero-dev/vite-plus-linux-x64-gnu

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-linux-x64-gnu@1732

@voidzero-dev/vite-plus-linux-x64-musl

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-linux-x64-musl@1732

@voidzero-dev/vite-plus-win32-arm64-msvc

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-win32-arm64-msvc@1732

@voidzero-dev/vite-plus-win32-x64-msvc

npm i https://pkg.pr.new/voidzero-dev/vite-plus/@voidzero-dev/vite-plus-win32-x64-msvc@1732

commit: 4e0ce48

[fengmk2]

@cursor review

[fengmk2]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 03f5f91. Configure here.}