build: the initial-chunk guard covers Navara's whole dependency closure

Review of Task 0:
- build/navaraDependencies.js reads the dependency closure of
  @navaramap/three and @navaramap/three-default-plugin from node_modules
  (dependencies and peers) and drops what the app's other bundled
  dependencies reach too (Cesium is served as a script, so draco3d, which
  only Cesium shares, stays engine-only), plus three and postprocessing:
  88 packages today (the @navaramap/* packages, @takram/*, @react-three/
  fiber, @sparkjsdev/spark, astronomy-engine, d3*, draco3d, n8ao,
  three-stdlib, …). The browser build's initialChunkGuard fails on a
  module from any of them in an initial chunk. Tested on a fixture tree.
- check-main-chunk's budget measures the entry the page loads (the same
  chunk the composition check reads), falling back to phase 4's largest
  index-*.js only for a dist without a page.

Build clean: no Navara-only module in the initial chunks; main chunk
2,869,565 bytes (gzip 889,041).

build/initialChunkGuard.js

@@ -5,7 +5,11 @@
 // (what Rollup put in each chunk), and fails the build otherwise;
 // scripts/check-main-chunk.mjs checks the built files' text as well.
 
-/** Module ids that only the Navara engine may load. */
+/**
+ * Module ids that only the Navara engine may load, when no package list is
+ * given (the browser build passes the full dependency closure,
+ * navaraDependencies.js).
+ */
 export const ENGINE_ONLY_MODULES =
   /[\\/]node_modules[\\/](?:three|@navaramap[\\/][^\\/]+|postprocessing)[\\/]/;
 
@@ -32,21 +36,24 @@ export function initialChunkViolations(bundle, pattern = ENGINE_ONLY_MODULES) {
 }
 
 /** The Rollup plugin: fails generateBundle when an initial chunk holds three or Navara. */
-export function initialChunkGuard({ log = console.log } = {}) {
+export function initialChunkGuard({
+  log = console.log,
+  pattern = ENGINE_ONLY_MODULES,
+} = {}) {
   return {
     name: 'gev-initial-chunk-guard',
     generateBundle(_options, bundle) {
-      const violations = initialChunkViolations(bundle);
+      const violations = initialChunkViolations(bundle, pattern);
       if (violations.length) {
         this.error(
-          'three/Navara in the Cesium-mode initial chunks:\n' +
+          'Navara-only modules in the Cesium-mode initial chunks:\n' +
             violations
               .map(({ chunk, module }) => `  ${chunk}: ${module}`)
               .join('\n'),
         );
         return;
       }
-      log('[initial-chunks] no three or Navara modules in the initial chunks');
+      log('[initial-chunks] no Navara-only modules in the initial chunks');
     },
   };
 }

build/navaraDependencies.js

@@ -0,0 +1,73 @@
+// The packages only the Navara engine brings: the dependency closure of
+// @navaramap/three and @navaramap/three-default-plugin (dependencies and
+// peer dependencies, read from node_modules), without the packages the
+// app's other bundled dependencies reach too (Cesium is external), plus
+// three and postprocessing, which
+// the Cesium-mode page never loads statically either. The initial-chunk
+// guard (initialChunkGuard.js) fails the build when one of them is in an
+// initial chunk.
+
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+
+export const NAVARA_ROOTS = Object.freeze([
+  '@navaramap/three',
+  '@navaramap/three-default-plugin',
+]);
+const ALWAYS_ENGINE_ONLY = Object.freeze(['three', 'postprocessing']);
+// Not bundled: vite-plugin-cesium serves Cesium as a script, so what only
+// Cesium reaches (draco3d, …) is not in the app's bundled graph.
+const EXTERNAL = Object.freeze(['cesium']);
+
+function readManifest(root, name) {
+  const file = path.join(root, 'node_modules', name, 'package.json');
+  return existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : null;
+}
+
+/** Every package reachable from `names` through installed manifests. */
+export function dependencyClosure(root, names) {
+  const seen = new Set();
+  const queue = [...names];
+  while (queue.length) {
+    const name = queue.pop();
+    if (seen.has(name)) continue;
+    const manifest = readManifest(root, name);
+    if (!manifest) continue;
+    seen.add(name);
+    for (const next of Object.keys({
+      ...manifest.dependencies,
+      ...manifest.peerDependencies,
+    }))
+      queue.push(next);
+  }
+  return seen;
+}
+
+/** The engine-only package names, sorted. */
+export function navaraOnlyPackages(root) {
+  const app = JSON.parse(readFileSync(path.join(root, 'package.json'), 'utf8'));
+  const navara = dependencyClosure(root, NAVARA_ROOTS);
+  const appRoots = Object.keys(app.dependencies ?? {}).filter(
+    (name) =>
+      !navara.has(name) &&
+      !ALWAYS_ENGINE_ONLY.includes(name) &&
+      !EXTERNAL.includes(name),
+  );
+  const shared = dependencyClosure(root, appRoots);
+  return [
+    ...new Set([
+      ...[...navara].filter((name) => !shared.has(name)),
+      ...ALWAYS_ENGINE_ONLY,
+    ]),
+  ].sort();
+}
+
+/** A module-id pattern matching node_modules/<package>/ for the names. */
+export function packagePattern(names) {
+  const escaped = names.map((name) =>
+    name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace('/', '[\\\\/]'),
+  );
+  return new RegExp(
+    `[\\\\/]node_modules[\\\\/](?:${escaped.join('|')})[\\\\/]`,
+  );
+}

build/vite.js

@@ -1,3 +1,4 @@
+import { fileURLToPath } from 'node:url';
 import { applicationHtmlPlugin } from './application-html.js';
 import cesium from 'vite-plugin-cesium';
 import { DEFAULT_ALLOWED_HOSTS, hostCheckPlugin } from './allowedHosts.js';
@@ -5,6 +6,7 @@ import { embedFramingPlugin } from './embed-framing.js';
 import { panelBuildPlugin } from './panel.js';
 import { navaraChunkFileNames, navaraWorkerAssets } from './navaraAssets.js';
 import { initialChunkGuard } from './initialChunkGuard.js';
+import { navaraOnlyPackages, packagePattern } from './navaraDependencies.js';
 
 /**
  * Content-Security-Policy for every document the dev/preview server serves.
@@ -134,7 +136,14 @@ export function createBrowserViteConfig({
       // The lazy chunk with the Navara engine is named navara-engine.
       rollupOptions: {
         // initialChunkGuard: no three/Navara module in the initial chunks.
-        plugins: [navaraWorkerAssets(), initialChunkGuard()],
+        plugins: [
+          navaraWorkerAssets(),
+          initialChunkGuard({
+            pattern: packagePattern(
+              navaraOnlyPackages(fileURLToPath(new URL('..', import.meta.url))),
+            ),
+          }),
+        ],
         output: { chunkFileNames: navaraChunkFileNames },
       },
     },