From 39e3153f8ab36e64a24941f501a5910b3de8e57b Mon Sep 17 00:00:00 2001
From: "posthog[bot]" <206114724+posthog[bot]@users.noreply.github.com>
Date: Wed, 17 Jun 2026 13:27:18 +0000
Subject: [PATCH] fix: bundle semver to prevent npx/bunx cache startup crashes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

semver's entry file eagerly require()s its entire ./functions/* and ./ranges/*
submodule tree at load. Because the build left semver external
(skipNodeModulesBundle), a corrupted/partial semver tarball in an npx or bunx
cache threw MODULE_NOT_FOUND (e.g. './ranges/intersects', './functions/sort')
before any wizard code ran — an instant, unrecoverable startup crash.

Force-bundle semver into the output via deps.alwaysBundle so a corrupted runtime
install can no longer surface a missing-submodule crash. semver is
dependency-free, so the bundle stays self-contained; all other deps remain
external. skipNodeModulesBundle and alwaysBundle are mutually exclusive in
tsdown, so this migrates to the default behavior (externalize declared
production deps) and bundles only semver.

Generated-By: PostHog Code
Task-Id: 82411704-9a3d-4c1e-ac18-004f40343691
---
 tsdown.config.ts | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/tsdown.config.ts b/tsdown.config.ts
index 0d39ea90..cb554d6e 100644
--- a/tsdown.config.ts
+++ b/tsdown.config.ts
@@ -20,8 +20,24 @@ export default defineConfig({
     NODE_ENV: process.env.WIZARD_BUILD_NODE_ENV || 'production',
   },
 
-  // Keep npm dependencies external — they're installed at runtime.
-  skipNodeModulesBundle: true,
+  // Keep npm dependencies external — they're installed at runtime — with one
+  // exception: semver is bundled into the output.
+  //
+  // semver's entry file eagerly `require()`s its entire ./functions/* and
+  // ./ranges/* submodule tree at load. When a package runner (npx/bunx)
+  // extracts a corrupted/partial semver tarball into its cache (a known failure
+  // mode when antivirus or a concurrent run interrupts extraction), that eager
+  // require throws MODULE_NOT_FOUND (e.g. './ranges/intersects', './functions/sort')
+  // before any wizard code runs — an instant, unrecoverable startup crash.
+  // Bundling semver means a corrupted runtime install can no longer surface a
+  // missing-submodule crash. semver is dependency-free, so this is self-contained.
+  //
+  // Note: `deps.skipNodeModulesBundle` and `deps.alwaysBundle` are mutually
+  // exclusive in tsdown, so we rely on the default behavior (externalize
+  // production dependencies declared in package.json) and force-bundle semver.
+  deps: {
+    alwaysBundle: ['semver'],
+  },
 
   sourcemap: true,
   clean: true,