fix(deps): check dynamic imports in onlyImport (#1019)

Author: sxzz

docs/options/dependencies.md

@@ -107,7 +107,7 @@ In this example, the output is only allowed to import `cac`. If any chunk import
 - Type declaration output (`.d.ts`) is checked as well.
 
 ::: warning
-Only ESM output is checked. CJS output (`require` calls) is not detected.
+ES imports and dynamic `import()` expressions are checked. CJS `require()` calls are not detected.
 :::
 
 ### `deps.neverBundle`

docs/zh-CN/options/dependencies.md

@@ -107,7 +107,7 @@ export default defineConfig({
 - 类型声明产物（`.d.ts`）同样会被检查。
 
 ::: warning
-仅检查 ESM 产物。CJS 产物（`require` 调用）不会被检测。
+会检查 ES 导入和动态 `import()` 表达式。CJS `require()` 调用不会被检测。
 :::
 
 ### `deps.neverBundle`

skills/tsdown/references/option-dependencies.md

@@ -119,7 +119,7 @@ export default defineConfig({
 - Relative imports between code-split chunks are always allowed.
 - Declaration output (`.d.ts`) is checked too.
 
-**Limitation:** Only ESM output is checked. CJS output (`require` calls) is not detected.
+**Limitation:** ES imports and dynamic `import()` expressions are checked. CJS `require()` calls are not detected.
 
 ### `deps.skipNodeModulesBundle`
 

src/features/deps.ts

@@ -5,7 +5,7 @@ import { blue, underline, yellow } from 'ansis'
 import { createDebug } from 'obug'
 import { RE_DTS, RE_NODE_MODULES } from 'rolldown-plugin-dts/internal'
 import { and, id, importerId, include } from 'rolldown/filter'
-import { parse } from 'rolldown/utils'
+import { parse, Visitor, type ESTree } from 'rolldown/utils'
 import {
   matchPattern,
   resolveRegex,
@@ -56,7 +56,8 @@ export interface DepsConfig {
    * Node built-in modules are always allowed to be imported
    * when `platform` is `node`.
    *
-   * Note: Only ESM output is checked. CJS output (`require` calls) is not detected.
+   * Note: ES imports and dynamic import expressions are checked. CJS
+   * `require` calls are not detected.
    */
   onlyImport?: Arrayable<string | RegExp>
   /**
@@ -273,18 +274,9 @@ export function DepsPlugin(
             moduleIds.some((id) => chunk.code.includes(id))
           ) {
             const { program } = await parse(chunk.fileName, chunk.code)
-            for (const stmt of program.body) {
-              if (
-                stmt.type !== 'ImportDeclaration' &&
-                stmt.type !== 'ExportAllDeclaration' &&
-                stmt.type !== 'ExportNamedDeclaration'
-              ) {
-                continue
-              }
-              const source = stmt.source?.value
-
+            for (const source of collectImportSources(program)) {
               // relative imports of sibling chunks emitted by code splitting
-              if (!source || source[0] === '.') continue
+              if (source[0] === '.') continue
               if (platform === 'node' && isBuiltin(source)) continue
               if (matchPattern(parsePackageSpecifier(source)[0], onlyImport)) {
                 continue
@@ -421,6 +413,40 @@ export function DepsPlugin(
   }
 }
 
+function collectImportSources(program: ESTree.Program): string[] {
+  const sources: string[] = []
+
+  new Visitor({
+    ImportDeclaration(node) {
+      sources.push(node.source.value)
+    },
+    ExportAllDeclaration(node) {
+      sources.push(node.source.value)
+    },
+    ExportNamedDeclaration(node) {
+      if (node.source) sources.push(node.source.value)
+    },
+    ImportExpression(node) {
+      const source = getStaticString(node.source)
+      if (source) sources.push(source)
+    },
+  }).visit(program)
+
+  return sources
+}
+
+function getStaticString(value: ESTree.Expression): string | undefined {
+  if (value.type === 'Literal' && typeof value.value === 'string') {
+    return value.value
+  }
+
+  if (value.type !== 'TemplateLiteral') return
+  if (value.expressions.length || value.quasis.length !== 1) return
+
+  const { cooked, raw } = value.quasis[0].value
+  return cooked ?? raw
+}
+
 export function parsePackageSpecifier(
   id: string,
 ): [name: string, subpath: string] {

tests/e2e.test.ts

@@ -357,6 +357,22 @@ describe('deps', () => {
       ).rejects.toThrow('but is not included in')
     })
 
+    test('should throw error for unlisted dynamic imports', async (context) => {
+      const files = {
+        'index.ts': `export const load = (): Promise<unknown> => import('cac')`,
+      }
+      await expect(() =>
+        testBuild({
+          context,
+          files,
+          options: {
+            deps: { onlyImport: [] },
+            plugins: [pluginMockDepCode],
+          },
+        }),
+      ).rejects.toThrow('but is not included in')
+    })
+
     test('should always allow node builtin modules when platform is node', async (context) => {
       const files = {
         'index.ts': `import path from 'node:path'