feat: add experimental autoIncludeExternalSources option for monorepo support

[johnnyfekete]

First real contribution here, hope I understood the issue correctly 🙂

Overview

Adds experimental autoIncludeExternalSources option to automatically include external source files in zip archives for monorepo setups.
When enabled, WXT analyzes the build output to find imported files from outside the extension directory and includes them in the sources zip. This eliminates the need for manual configuration when extensions import from parent/sibling packages.

The feature is disabled by default for backward compatibility and marked as experimental.

Manual Testing

1. Create a shared file outside your extension: ../shared-lib/utils.ts
2. Import it in your extension: import { util } from '../../../shared-lib/utils';
3. Enable in config: zip: { autoIncludeExternalSources: true }
4. Run wxt zip -b firefox
5. Check sources zip contains the external file's contents

Related Issue

This PR closes #1505

[netlify[bot]]

✅ Deploy Preview for creative-fairy-df92c4 ready!

Name	Link
🔨 Latest commit	0895d28d3b9854e9d6dbde8d588640b511515f84
🔍 Latest deploy log	https://app.netlify.com/projects/creative-fairy-df92c4/deploys/68a4415e91b3350007aecf56
😎 Deploy Preview	https://deploy-preview-1826--creative-fairy-df92c4.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[st3h3n]

This seems to generally work quite well, but I came across a conceptual problem:

Let's say the WXT root is in monorepo/packages/wxt. If you run wxt zip the resulting zip file will include the sources from the other packages in a .. directory. But because of the Zip Slip Vulnerability most zip tools will ignore this directory when unzipping the file.

No problem, just use sourcesRoot: '../', and in order to not include all packages: { excludeSources: '**', includeSources: ['wxt/**'] }. But now the collected external sources will be omitted.

I think excludeSources should either ignore the auto collected sources, or be ignored, or there could be seperate controls for it. While this was also mentioned in this post, I would disagree regarding the includeSources option being ignored, as there are common usecases like includeSources: ['../tsconfig.json', '../package.json', ../assets/**].

[st3h3n]

I've had some more time to look into this. I've found some files are missing:

1. A file which only contains a re-export: export { foo as bar } from 'foobar';
2. Files that only contain build-time content, so .ts files that only export interfaces or types. I would expect .d.ts to also be affected.
3. All .html and .less files. The reason for that is me using Angular. But the plugin that makes it Vite compatible uses Vite to resolve those files so a mechanism that hooks into Vite's resolver should still be able to catch these.

I'm a complete noob at Vite, hence why I didn't try to implement this feature myself, but I suspect that the approach of working from the build chunks backwards cannot solve this.