Differential legacy builds

[Rich-Harris]

Not yet sure what this looks like

[FredKSchott]

Snowpack treats the idea of optimizing / configuring your build like so:

• By default, snowpack build creates an unoptimized, unbundled, fully modern (ES2020) site build for you.
• "optimize" plugins can be added to your config that take this build directory, and optimize it in some way.
  • ex: @snowpack/plugin-webpack will bundle your site for you, using some set of recommended best practices
  • you can stack multiple optimize plugins (ex: @snowpack/plugin-webpack + a plugin that now gets the bundled build directory, and adds custom preload link elements or something)
• We have an open issue to build some common optimizations into Snowpack via the optimize config
  • These would run before "optimize" plugins, but could still work with them
  • issue: Built-in production optimizations (incl. bundling) FredKSchott/snowpack#1276

From looking at the codebase (and talking to @Rich-Harris) y'all follow this pattern by running the final build through Rollup, however you run it yourself out-of-band after the build has completed. This is fine for now, and you would add differential build support by just extending the Rollup config that you already have set up.

From our perspective, we'd obviously love to see you leveraging Snowpack's plugin ecosystem more here. I'd be curious what it would take to move your custom Rollup optimize pipeline into a Snowpack plugin that others could take advantage of. Currently, we're looking at https://github.com/ParamagicDev/snowpack-plugin-rollup-bundle as the best candidate to become our "official" Rollup plugin.

[backflip]

Unverified assumption: https://github.com/vitejs/vite/tree/main/packages/plugin-legacy might help here.

[seanlail]

If legacy support is added it will likely add security vulnerabilities.

Which is fine... if legacy is opt-in only the user should be warned that it could be dangerous.
The thing to watch out for is that these vulnerabilities are not exposed to the non-legacy / default setup.

This has come up in a few tickets in Sapper and most recently here:
sveltejs/sapper#1760

Relates to #93