ci: add dist externals verification step

.github/workflows/ci.yml

@@ -28,6 +28,37 @@ jobs:
       - name: Build
         run: npm run build
 
+      - name: Verify dist externals
+        run: |
+          node -e "
+          const fs = require('fs');
+          const dist = 'dist/index.js';
+          if (!fs.existsSync(dist)) process.exit(0);
+          const pkg = JSON.parse(fs.readFileSync('package.json', 'utf-8'));
+          const peerDeps = Object.keys(pkg.peerDependencies || {});
+          const builtins = new Set(['assert','buffer','child_process','cluster','console','constants','crypto','dgram','dns','domain','events','fs','http','http2','https','inspector','module','net','os','path','perf_hooks','process','punycode','querystring','readline','repl','stream','string_decoder','sys','timers','tls','trace_events','tty','url','util','v8','vm','wasi','worker_threads','zlib']);
+          const shared = ['@quartz-community/','preact','@jackyzha0/quartz','vfile'];
+          const content = fs.readFileSync(dist, 'utf-8');
+          const re = /^\s*(?:import\s+.*\s+from|export\s+.*\s+from)\s+[\"']([^\"'./][^\"']*)[\"']/gm;
+          const unexpected = new Set();
+          for (const m of content.matchAll(re)) {
+            const s = m[1];
+            if (s.startsWith('node:')) continue;
+            const bare = s.includes('/') && s.startsWith('@') ? s.split('/').slice(0,2).join('/') : s.split('/')[0];
+            if (builtins.has(bare)) continue;
+            if (shared.some(p => s.startsWith(p))) continue;
+            if (peerDeps.some(d => s === d || s.startsWith(d + '/'))) continue;
+            unexpected.add(s);
+          }
+          if (unexpected.size > 0) {
+            console.error('ERROR: dist/ has unbundled external imports that will fail at runtime:');
+            for (const u of unexpected) console.error('  - ' + u);
+            console.error('Move these from dependencies to devDependencies so tsup bundles them.');
+            process.exit(1);
+          }
+          console.log('dist/ externals verified: all imports are bundled or allowlisted.');
+          "
+
   publish:
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest