Assorted fixes

[FredKSchott]

Hope you don't mind that these are all together.

• Added: if (!depManifestLoc || !depManifest) {
  • More correct, and better for TypeScript usage
• Added: loc: require.resolve(...
  • Turns out we were relying on Rollup to do this for us, and sometimes didn't pass full file paths (if foundEntrypoint was a partial like index, coming from from "module": "index" in a package.json).
• Removed: autoDetectNamedExports() auto-detection
  • This ended up being too hacky, and introduced a whole can of worms like Run autoDetectExports in a sandbox #488
  • Resolves Run autoDetectExports in a sandbox #488 by removing
• Added: (Is it installed?) message
  • This came from a user reported issue, where Snowpack said "cannot resolve "some-package" and the user thought that it was a problem with Snowpack, and not the fact that the package was a peer dependency that hadn't been installed properly.

[stramel]

After publishing this fix, we should probably deprecate the versions that include that vulnerability?

[FredKSchott]

Which vuln, our use of autoDetectNamedExports? This was only a concern for our CDN's usage of Snowpack, where would be running on many, untrusted packages. For the general user, the removed code was no different than require()-ing a dependency that you'd chosen to use in your project.

[stramel]

Yeah, I was referring to #488. Just making sure we cover our bases. I guess it sounded worse than it is when skimming the issue you wrote.

[drwpow]

Nice! These are all small enough 1 PR makes sense.