refactor: migrate @rolldown/pluginutils package from rolldown repository

[shulaoda]

Description

Refs rolldown/rolldown#8653. Companion PR: rolldown/rolldown#9317.

Ports @rolldown/pluginutils from rolldown/rolldown so it follows its own release cadence rather than rolldown's.

Why

When @rolldown/pluginutils shipped from the rolldown repo, every rolldown release published a new pluginutils version. Plugins in this repo pin specific (often pre-release) versions, and prerelease semver semantics (^1.0.0-rc.16 does not match 1.0.0-rc.17) prevented node_modules dedupe — users with rolldown plus any plugin that uses pluginutils ended up with several copies side by side.

Releasing pluginutils from this repo lets it follow stable semver. Once rolldown's companion PR switches to depending on ^1.0.0, the package manager can dedupe across rolldown and any plugin author who later depends on pluginutils.

Changes

• packages/pluginutils/: source ported from rolldown/rolldown at v1.0.0.
  • Build switched to tsdown (matches other packages in this repo). Output is .mjs with dist/index.mjs and dist/filter/index.mjs; tsdown auto-extracts the shared filter implementation into a single chunk so the two entries don't duplicate code.
  • exports-consistency.test.ts dropped (the dual exports + publishConfig.exports setup is gone — single exports map now).
  • Two oxlint-disable-next-line typescript/no-unsafe-type-assertion annotations added where the original casts are intentional: one workaround for microsoft/TypeScript#17002, one runtime probe on a generic.
  • Source reformatted with oxfmt to match repo style.
• scripts/release.ts: register pluginutils for the existing @vitejs/release-scripts flow. The existing getPkgDir (packages/${pkgName.replace('plugin-', '')}) already resolves correctly for the bare name.
• .github/workflows/publish.yml, .github/workflows/release-tag.yml: extend tag triggers to pluginutils@*. The existing tag-parsing shell expression handles the bare prefix.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typescript@​5.9.3

View full report

[sapphi-red]

Was this marked as draft because of the lack of github actions pinning?

[shulaoda]

Was this marked as draft because of the lack of github actions pinning?

This is because the CI hadn’t passed before. I was planning to take a look into it.