@yao-pkg/pkg 6.11.0 → 6.13.0

package/lib-es5/common.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toNormalizedRealPath = exports.removeUplevels = exports.stripSnapshot = exports.insideSnapshot = exports.snapshotify = exports.substituteDenominator = exports.retrieveDenominator = exports.isDotNODE = exports.isDotJSON = exports.isDotJS = exports.isPackageJson = exports.normalizePath = exports.isRootPath = exports.ALIAS_AS_RESOLVABLE = exports.ALIAS_AS_RELATIVE = exports.STORE_STAT = exports.STORE_LINKS = exports.STORE_CONTENT = exports.STORE_BLOB = void 0;
+exports.isESMFile = exports.isESMPackage = exports.toNormalizedRealPath = exports.removeUplevels = exports.stripSnapshot = exports.insideSnapshot = exports.snapshotify = exports.substituteDenominator = exports.retrieveDenominator = exports.unlikelyJavascript = exports.isDotNODE = exports.isDotJSON = exports.isDotJS = exports.isPackageJson = exports.normalizePath = exports.isRootPath = exports.ALIAS_AS_RESOLVABLE = exports.ALIAS_AS_RELATIVE = exports.STORE_STAT = exports.STORE_LINKS = exports.STORE_CONTENT = exports.STORE_BLOB = void 0;
 const assert_1 = __importDefault(require("assert"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -93,6 +93,19 @@ function isDotNODE(file) {
     return path_1.default.extname(file) === '.node';
 }
 exports.isDotNODE = isDotNODE;
+function unlikelyJavascript(file) {
+    const ext = path_1.default.extname(file);
+    // Check single extensions
+    if (['.css', '.html', '.json', '.vue'].includes(ext)) {
+        return true;
+    }
+    // Check for .d.ts files (compound extension)
+    if (file.endsWith('.d.ts')) {
+        return true;
+    }
+    return false;
+}
+exports.unlikelyJavascript = unlikelyJavascript;
 function replaceSlashes(file, slash) {
     if (/^.:\\/.test(file)) {
         if (slash === '/') {
@@ -232,4 +245,84 @@ function toNormalizedRealPath(requestPath) {
     return file;
 }
 exports.toNormalizedRealPath = toNormalizedRealPath;
+/**
+ * Find the nearest package.json file by walking up the directory tree
+ * @param filePath - Starting file path
+ * @returns Path to package.json or null if not found
+ */
+function findNearestPackageJson(filePath) {
+    let dir = path_1.default.dirname(filePath);
+    const { root } = path_1.default.parse(dir);
+    while (dir !== root) {
+        const packageJsonPath = path_1.default.join(dir, 'package.json');
+        if (fs_1.default.existsSync(packageJsonPath)) {
+            return packageJsonPath;
+        }
+        dir = path_1.default.dirname(dir);
+    }
+    return null;
+}
+// Caches for ESM detection performance optimization
+const packageJsonCache = new Map();
+const esmPackageCache = new Map();
+/**
+ * Check if a package.json indicates an ESM package
+ * @param packageJsonPath - Path to package.json
+ * @returns true if "type": "module" is set
+ */
+function isESMPackage(packageJsonPath) {
+    // Check cache first
+    if (esmPackageCache.has(packageJsonPath)) {
+        return esmPackageCache.get(packageJsonPath);
+    }
+    try {
+        const content = fs_1.default.readFileSync(packageJsonPath, 'utf8');
+        const pkg = JSON.parse(content);
+        const result = pkg.type === 'module';
+        esmPackageCache.set(packageJsonPath, result);
+        return result;
+    }
+    catch {
+        esmPackageCache.set(packageJsonPath, false);
+        return false;
+    }
+}
+exports.isESMPackage = isESMPackage;
+/**
+ * Determine if a file should be treated as ESM
+ * Based on file extension and nearest package.json "type" field
+ *
+ * @param filePath - The file path to check
+ * @returns true if file should be treated as ESM
+ */
+function isESMFile(filePath) {
+    // .mjs files are always ESM
+    if (filePath.endsWith('.mjs')) {
+        return true;
+    }
+    // .cjs files are never ESM
+    if (filePath.endsWith('.cjs')) {
+        return false;
+    }
+    // For .js files, check nearest package.json for "type": "module"
+    if (filePath.endsWith('.js')) {
+        const dir = path_1.default.dirname(filePath);
+        // Check cache first
+        if (packageJsonCache.has(dir)) {
+            const cached = packageJsonCache.get(dir);
+            if (cached) {
+                return isESMPackage(cached);
+            }
+            return false;
+        }
+        // Compute and cache
+        const packageJsonPath = findNearestPackageJson(filePath);
+        packageJsonCache.set(dir, packageJsonPath);
+        if (packageJsonPath) {
+            return isESMPackage(packageJsonPath);
+        }
+    }
+    return false;
+}
+exports.isESMFile = isESMFile;
 //# sourceMappingURL=common.js.map

package/lib-es5/detector.js

@@ -86,6 +86,7 @@ function reconstructSpecifiers(specs) {
     return defaults.join(', ');
 }
 function reconstruct(node) {
+    // @ts-expect-error Type mismatch due to @babel/types version in @types/babel__generator
     let v = (0, generator_1.default)(node, { comments: false }).code.replace(/\n/g, '');
     let v2;
     while (true) {
@@ -403,13 +404,14 @@ function parse(body) {
     });
 }
 exports.parse = parse;
-function detect(body, visitor) {
+function detect(body, visitor, file) {
     let json;
     try {
         json = parse(body);
     }
     catch (error) {
-        log_1.log.warn(`Babel parse has failed: ${error.message}`);
+        const fileInfo = file ? ` in ${file}` : '';
+        log_1.log.warn(`Babel parse has failed: ${error.message}${fileInfo}`);
     }
     if (!json) {
         return;

package/lib-es5/esm-transformer.js

@@ -0,0 +1,202 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.transformESMtoCJS = void 0;
+const babel = __importStar(require("@babel/parser"));
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const esbuild = __importStar(require("esbuild"));
+const log_1 = require("./log");
+const common_1 = require("./common");
+/**
+ * Detect ESM features that cannot be safely transformed to CommonJS
+ * These include:
+ * - Top-level await (no CJS equivalent)
+ * - import.meta (no CJS equivalent)
+ *
+ * @param code - The ESM source code to check
+ * @param filename - The filename for error reporting
+ * @returns Array of unsupported features found, or null if parse fails
+ */
+function detectUnsupportedESMFeatures(code, filename) {
+    try {
+        const ast = babel.parse(code, {
+            sourceType: 'module',
+            plugins: [],
+        });
+        if (!ast) {
+            return null;
+        }
+        const unsupportedFeatures = [];
+        // @ts-expect-error Type mismatch due to @babel/types version in @types/babel__traverse
+        (0, traverse_1.default)(ast, {
+            // Detect import.meta usage
+            MetaProperty(path) {
+                if (path.node.meta.name === 'import' &&
+                    path.node.property.name === 'meta') {
+                    unsupportedFeatures.push({
+                        feature: 'import.meta',
+                        line: path.node.loc?.start.line ?? null,
+                        column: path.node.loc?.start.column ?? null,
+                    });
+                }
+            },
+            // Detect top-level await
+            AwaitExpression(path) {
+                // Check if await is at top level (not inside a function)
+                let parent = path.parentPath;
+                let isTopLevel = true;
+                while (parent) {
+                    if (parent.isFunctionDeclaration() ||
+                        parent.isFunctionExpression() ||
+                        parent.isArrowFunctionExpression() ||
+                        parent.isObjectMethod() ||
+                        parent.isClassMethod()) {
+                        isTopLevel = false;
+                        break;
+                    }
+                    parent = parent.parentPath;
+                }
+                if (isTopLevel) {
+                    unsupportedFeatures.push({
+                        feature: 'top-level await',
+                        line: path.node.loc?.start.line ?? null,
+                        column: path.node.loc?.start.column ?? null,
+                    });
+                }
+            },
+            // Detect for-await-of at top level
+            ForOfStatement(path) {
+                if (path.node.await) {
+                    let parent = path.parentPath;
+                    let isTopLevel = true;
+                    while (parent) {
+                        if (parent.isFunctionDeclaration() ||
+                            parent.isFunctionExpression() ||
+                            parent.isArrowFunctionExpression() ||
+                            parent.isObjectMethod() ||
+                            parent.isClassMethod()) {
+                            isTopLevel = false;
+                            break;
+                        }
+                        parent = parent.parentPath;
+                    }
+                    if (isTopLevel) {
+                        unsupportedFeatures.push({
+                            feature: 'top-level for-await-of',
+                            line: path.node.loc?.start.line ?? null,
+                            column: path.node.loc?.start.column ?? null,
+                        });
+                    }
+                }
+            },
+        });
+        return unsupportedFeatures;
+    }
+    catch (error) {
+        // If we can't parse, return null to let the transform attempt proceed
+        log_1.log.debug(`Could not parse ${filename} to detect unsupported ESM features: ${error instanceof Error ? error.message : String(error)}`);
+        return null;
+    }
+}
+/**
+ * Transform ESM code to CommonJS using esbuild
+ * This allows ESM modules to be compiled to bytecode via vm.Script
+ * Uses Babel parser for detecting unsupported ESM features, then esbuild for fast transformation
+ *
+ * @param code - The ESM source code to transform
+ * @param filename - The filename for error reporting
+ * @returns Object with transformed code and success flag
+ */
+function transformESMtoCJS(code, filename) {
+    // Skip files that are unlikely to be JavaScript (e.g., .d.ts, .json, .css)
+    // to avoid Babel parse errors
+    if ((0, common_1.unlikelyJavascript)(filename)) {
+        return {
+            code,
+            isTransformed: false,
+        };
+    }
+    // First, check for unsupported ESM features that can't be safely transformed
+    const unsupportedFeatures = detectUnsupportedESMFeatures(code, filename);
+    if (unsupportedFeatures && unsupportedFeatures.length > 0) {
+        const featureList = unsupportedFeatures
+            .map((f) => {
+            const location = f.line !== null ? ` at line ${f.line}` : '';
+            return `  - ${f.feature}${location}`;
+        })
+            .join('\n');
+        const errorMessage = [
+            `Cannot transform ESM module ${filename} to CommonJS:`,
+            `The following ESM features have no CommonJS equivalent:`,
+            featureList,
+            '',
+            'These features are not supported when compiling to bytecode.',
+            'Consider one of the following:',
+            '  1. Refactor to avoid these features',
+            '  2. Use --no-bytecode flag to keep the module as source code',
+            '  3. Mark the package as public to distribute with sources',
+        ].join('\n');
+        log_1.log.warn(errorMessage);
+        // Return untransformed code rather than throwing
+        // This allows the file to be included as content instead of bytecode
+        return {
+            code,
+            isTransformed: false,
+        };
+    }
+    try {
+        const result = esbuild.transformSync(code, {
+            loader: 'js',
+            format: 'cjs',
+            target: 'node18',
+            sourcemap: false,
+            minify: false,
+            keepNames: true,
+        });
+        if (!result || !result.code) {
+            log_1.log.warn(`esbuild transform returned no code for ${filename}`);
+            return {
+                code,
+                isTransformed: false,
+            };
+        }
+        return {
+            code: result.code,
+            isTransformed: true,
+        };
+    }
+    catch (error) {
+        log_1.log.warn(`Failed to transform ESM to CJS for ${filename}: ${error instanceof Error ? error.message : String(error)}`);
+        return {
+            code,
+            isTransformed: false,
+        };
+    }
+}
+exports.transformESMtoCJS = transformESMtoCJS;
+//# sourceMappingURL=esm-transformer.js.map

package/lib-es5/follow.js

@@ -8,6 +8,7 @@ const resolve_1 = require("resolve");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const common_1 = require("./common");
+const resolver_1 = require("./resolver");
 const PROOF = 'a-proof-that-main-is-captured.js';
 function parentDirectoriesContain(parent, directory) {
     let currentParent = parent;
@@ -22,69 +23,167 @@ function parentDirectoriesContain(parent, directory) {
         currentParent = newParent;
     }
 }
+/**
+ * Check if a specifier looks like a valid npm package name
+ * npm package names must be lowercase and can only contain:
+ * - lowercase letters, digits, hyphens, underscores, dots
+ * - can be scoped (@scope/package)
+ * This helps filter out generated aliases like "connectNonLiteral"
+ */
+function isValidPackageName(specifier) {
+    // Scoped packages: @scope/package
+    if (specifier.startsWith('@')) {
+        const parts = specifier.split('/');
+        if (parts.length < 2)
+            return false;
+        // Scope must start with @ and both parts must be valid
+        return /^@[a-z0-9_.-]+$/.test(parts[0]) && /^[a-z0-9_.-]+$/.test(parts[1]);
+    }
+    // Regular package: must be lowercase with allowed characters
+    // Package name is the part before the first '/' (if any)
+    const packageName = specifier.split('/')[0];
+    return /^[a-z0-9_.-]+$/.test(packageName);
+}
 function follow(x, opts) {
     // TODO async version
-    return new Promise((resolve) => {
-        resolve((0, resolve_1.sync)(x, {
-            basedir: opts.basedir,
-            extensions: opts.extensions,
-            isFile: (file) => {
-                if (opts.ignoreFile &&
-                    path_1.default.join(path_1.default.dirname(opts.ignoreFile), PROOF) === file) {
-                    return true;
+    return new Promise((resolve, reject) => {
+        // Try ESM-aware resolution first for non-relative specifiers
+        // Skip if the specifier doesn't look like a valid npm package name
+        // (e.g., generated aliases like "connectNonLiteral")
+        if (!x.startsWith('.') &&
+            !x.startsWith('/') &&
+            !path_1.default.isAbsolute(x) &&
+            isValidPackageName(x)) {
+            try {
+                let extensions;
+                if (Array.isArray(opts.extensions)) {
+                    extensions = opts.extensions;
                 }
-                let stat;
-                try {
-                    stat = fs_1.default.statSync(file);
+                else if (opts.extensions) {
+                    extensions = [opts.extensions];
                 }
-                catch (e) {
-                    const ex = e;
-                    if (ex && (ex.code === 'ENOENT' || ex.code === 'ENOTDIR'))
-                        return false;
-                    throw ex;
-                }
-                return stat.isFile() || stat.isFIFO();
-            },
-            isDirectory: (directory) => {
-                if (opts.ignoreFile &&
-                    parentDirectoriesContain(opts.ignoreFile, directory)) {
-                    return false;
+                else {
+                    extensions = ['.js', '.json', '.node'];
                 }
-                let stat;
-                try {
-                    stat = fs_1.default.statSync(directory);
+                const result = (0, resolver_1.resolveModule)(x, {
+                    basedir: opts.basedir || process.cwd(),
+                    extensions,
+                });
+                // Only use ESM resolution result if it's an actual ESM package
+                // For CJS packages, fall through to standard CommonJS resolution
+                // to ensure all callbacks (catchReadFile, catchPackageFilter) are handled correctly
+                if (result.isESM) {
+                    // This is a real ESM package, handle it here
+                    if (opts.catchReadFile) {
+                        // Find the package.json for this resolved module
+                        let currentDir = path_1.default.dirname(result.resolved);
+                        while (currentDir !== path_1.default.dirname(currentDir)) {
+                            const pkgPath = path_1.default.join(currentDir, 'package.json');
+                            // Honor ignoreFile to ensure correct package marker determination
+                            if (opts.ignoreFile &&
+                                path_1.default.normalize(pkgPath) === path_1.default.normalize(opts.ignoreFile)) {
+                                // Skip this package.json as it's marked to be ignored
+                                currentDir = path_1.default.dirname(currentDir);
+                                continue;
+                            }
+                            if (fs_1.default.existsSync(pkgPath)) {
+                                // Check if this package.json is in node_modules (not the root package)
+                                if (currentDir.includes('node_modules')) {
+                                    opts.catchReadFile(pkgPath);
+                                    // Also call catchPackageFilter if provided
+                                    if (opts.catchPackageFilter) {
+                                        const pkgContent = JSON.parse(fs_1.default.readFileSync(pkgPath, 'utf8'));
+                                        // If package doesn't have a "main" field but we resolved via exports,
+                                        // add a synthetic "main" field so runtime resolution works
+                                        if (!pkgContent.main) {
+                                            const relativePath = path_1.default.relative(currentDir, result.resolved);
+                                            pkgContent.main = `./${relativePath.replace(/\\/g, '/')}`;
+                                        }
+                                        opts.catchPackageFilter(pkgContent, currentDir, currentDir);
+                                    }
+                                    break;
+                                }
+                            }
+                            currentDir = path_1.default.dirname(currentDir);
+                        }
+                    }
+                    // ESM package resolved successfully
+                    resolve(result.resolved);
+                    return;
                 }
-                catch (e) {
-                    const ex = e;
-                    if (ex && (ex.code === 'ENOENT' || ex.code === 'ENOTDIR')) {
+                // CJS package - fall through to standard CommonJS resolution
+                // to handle all callbacks properly
+            }
+            catch (error) {
+                // ESM resolution failed - fall through to standard CommonJS resolution
+            }
+        }
+        // Use standard CommonJS resolution
+        try {
+            resolve((0, resolve_1.sync)(x, {
+                basedir: opts.basedir,
+                extensions: opts.extensions,
+                isFile: (file) => {
+                    if (opts.ignoreFile &&
+                        path_1.default.join(path_1.default.dirname(opts.ignoreFile), PROOF) === file) {
+                        return true;
+                    }
+                    let stat;
+                    try {
+                        stat = fs_1.default.statSync(file);
+                    }
+                    catch (e) {
+                        const ex = e;
+                        if (ex && (ex.code === 'ENOENT' || ex.code === 'ENOTDIR'))
+                            return false;
+                        throw ex;
+                    }
+                    return stat.isFile() || stat.isFIFO();
+                },
+                isDirectory: (directory) => {
+                    if (opts.ignoreFile &&
+                        parentDirectoriesContain(opts.ignoreFile, directory)) {
                         return false;
                     }
-                    throw ex;
-                }
-                return stat.isDirectory();
-            },
-            readFileSync: (file) => {
-                if (opts.ignoreFile && opts.ignoreFile === file) {
-                    return Buffer.from(`{"main":"${PROOF}"}`);
-                }
-                if (opts.catchReadFile) {
-                    opts.catchReadFile(file);
-                }
-                return fs_1.default.readFileSync(file);
-            },
-            packageFilter: (config, base, dir) => {
-                if (opts.catchPackageFilter) {
-                    opts.catchPackageFilter(config, base, dir);
-                }
-                return config;
-            },
-            /** function to synchronously resolve a potential symlink to its real path */
-            // realpathSync?: (file: string) => string;
-            realpathSync: (file) => {
-                const file2 = (0, common_1.toNormalizedRealPath)(file);
-                return file2;
-            },
-        }));
+                    let stat;
+                    try {
+                        stat = fs_1.default.statSync(directory);
+                    }
+                    catch (e) {
+                        const ex = e;
+                        if (ex && (ex.code === 'ENOENT' || ex.code === 'ENOTDIR')) {
+                            return false;
+                        }
+                        throw ex;
+                    }
+                    return stat.isDirectory();
+                },
+                readFileSync: (file) => {
+                    if (opts.ignoreFile && opts.ignoreFile === file) {
+                        return Buffer.from(`{"main":"${PROOF}"}`);
+                    }
+                    if (opts.catchReadFile) {
+                        opts.catchReadFile(file);
+                    }
+                    return fs_1.default.readFileSync(file);
+                },
+                packageFilter: (config, base, dir) => {
+                    if (opts.catchPackageFilter) {
+                        opts.catchPackageFilter(config, base, dir);
+                    }
+                    return config;
+                },
+                /** function to synchronously resolve a potential symlink to its real path */
+                // realpathSync?: (file: string) => string;
+                realpathSync: (file) => {
+                    const file2 = (0, common_1.toNormalizedRealPath)(file);
+                    return file2;
+                },
+            }));
+        }
+        catch (error) {
+            reject(error);
+        }
     });
 }
 exports.follow = follow;

package/lib-es5/index.js

@@ -149,7 +149,6 @@ async function needViaCache(target) {
     return c;
 }
 async function exec(argv2) {
-    var _a, _b;
     const argv = (0, minimist_1.default)(argv2, {
         boolean: [
             'b',
@@ -413,7 +412,10 @@ async function exec(argv2) {
         await needWithDryRun(target);
         target.fabricator = fabricatorForTarget(target);
         if (bytecode) {
-            await needWithDryRun(Object.assign(Object.assign({}, target.fabricator), { forceBuild }));
+            await needWithDryRun({
+                ...target.fabricator,
+                forceBuild,
+            });
         }
     }
     if (dryRunResults.fetched && !dryRunResults.built) {
@@ -433,7 +435,7 @@ async function exec(argv2) {
                 try {
                     (0, mach_o_1.signMachOExecutable)(signedBinaryPath);
                 }
-                catch (_c) {
+                catch {
                     throw (0, log_1.wasReported)('Cannot generate bytecode', [
                         'pkg fails to run "codesign" utility. Due to the mandatory signing',
                         'requirement of macOS, executables must be signed. Please ensure the',
@@ -450,7 +452,7 @@ async function exec(argv2) {
     // marker
     let marker;
     if (configJson) {
-        options_1.default.set(configJson === null || configJson === void 0 ? void 0 : configJson.pkg);
+        options_1.default.set(configJson?.pkg);
         marker = {
             config: configJson,
             base: path_1.default.dirname(config),
@@ -458,7 +460,7 @@ async function exec(argv2) {
         };
     }
     else {
-        options_1.default.set(inputJson === null || inputJson === void 0 ? void 0 : inputJson.pkg);
+        options_1.default.set(inputJson?.pkg);
         marker = {
             config: inputJson || {},
             base: path_1.default.dirname(input),
@@ -473,13 +475,13 @@ async function exec(argv2) {
     }
     if (argv['public-packages']) {
         params.publicPackages = argv['public-packages'].split(',');
-        if (((_a = params.publicPackages) === null || _a === void 0 ? void 0 : _a.indexOf('*')) !== -1) {
+        if (params.publicPackages?.indexOf('*') !== -1) {
             params.publicPackages = ['*'];
         }
     }
     if (argv['no-dict']) {
         params.noDictionary = argv['no-dict'].split(',');
-        if (((_b = params.noDictionary) === null || _b === void 0 ? void 0 : _b.indexOf('*')) !== -1) {
+        if (params.noDictionary?.indexOf('*') !== -1) {
             params.noDictionary = ['*'];
         }
     }
@@ -531,7 +533,7 @@ async function exec(argv2) {
                     // users can always replace the signature if necessary
                     (0, mach_o_1.signMachOExecutable)(target.output);
                 }
-                catch (_d) {
+                catch {
                     if (target.arch === 'arm64') {
                         log_1.log.warn('Unable to sign the macOS executable', [
                             'Due to the mandatory code signing requirement, before the',

package/lib-es5/mach-o.js

@@ -58,7 +58,7 @@ function signMachOExecutable(executable) {
             stdio: 'inherit',
         });
     }
-    catch (_a) {
+    catch {
         (0, child_process_1.execFileSync)('ldid', ['-Cadhoc', '-S', executable], { stdio: 'inherit' });
     }
 }

package/lib-es5/options.js

@@ -1,13 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 class Options {
+    options;
     constructor() {
         this.options = {
             dictionary: {},
         };
     }
     set(options) {
-        this.options = options !== null && options !== void 0 ? options : this.options;
+        this.options = options ?? this.options;
     }
     get() {
         return this.options;

package/lib-es5/packer.js

@@ -87,7 +87,7 @@ function packer({ records, entrypoint, bytecode, }) {
                 }
                 else if (store === common_1.STORE_STAT) {
                     if (typeof value === 'object') {
-                        const newStat = Object.assign({}, value);
+                        const newStat = { ...value };
                         const buffer = Buffer.from(JSON.stringify(newStat));
                         stripes.push({ snap, store, buffer });
                     }

package/lib-es5/producer.js

@@ -127,14 +127,13 @@ function getPrebuildEnvPrefix(pkgName) {
         .replace(/^_/, '')}`;
 }
 function nativePrebuildInstall(target, nodeFile) {
-    var _a, _b;
     const prebuildInstall = path_1.default.join(__dirname, '../node_modules/.bin/prebuild-install');
     const dir = findPackageJson(nodeFile);
     const packageJson = JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, 'package.json'), { encoding: 'utf-8' }));
     // only try prebuild-install for packages that actually use it or if
     // explicitly configured via environment variables
     const envPrefix = getPrebuildEnvPrefix(packageJson.name);
-    if (((_a = packageJson.dependencies) === null || _a === void 0 ? void 0 : _a['prebuild-install']) == null &&
+    if (packageJson.dependencies?.['prebuild-install'] == null &&
         ![
             `${envPrefix}_binary_host`,
             `${envPrefix}_binary_host_mirror`,
@@ -155,7 +154,7 @@ function nativePrebuildInstall(target, nodeFile) {
     if (!fs_1.default.existsSync(`${nodeFile}.bak`)) {
         fs_1.default.copyFileSync(nodeFile, `${nodeFile}.bak`);
     }
-    const napiVersions = (_b = packageJson === null || packageJson === void 0 ? void 0 : packageJson.binary) === null || _b === void 0 ? void 0 : _b.napi_versions;
+    const napiVersions = packageJson?.binary?.napi_versions;
     const options = [
         '--platform',
         types_1.platform[target.platform],
@@ -298,7 +297,7 @@ function producer({ backpack, bakes, slash, target, symLinks, doCompress, native
                     // clone to prevent 'skip' propagate
                     // to other targets, since same stripe
                     // is used for several targets
-                    const stripe = Object.assign({}, stripes.shift());
+                    const stripe = { ...stripes.shift() };
                     prevStripe = stripe;
                     if (stripe.buffer) {
                         if (stripe.store === common_1.STORE_BLOB) {

package/lib-es5/resolver.js

@@ -0,0 +1,142 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveModule = void 0;
+const resolve_1 = require("resolve");
+const resolve_exports_1 = require("resolve.exports");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const common_1 = require("./common");
+const log_1 = require("./log");
+/**
+ * Resolve using package.json "exports" field (ESM-style)
+ * @param packageName - Package name (e.g., 'nanoid')
+ * @param subpath - Subpath within package (e.g., './url-alphabet')
+ * @param packageRoot - Absolute path to package root
+ * @returns Resolved path or null if not found
+ */
+function resolveWithExports(packageName, subpath, packageRoot) {
+    try {
+        const packageJsonPath = path_1.default.join(packageRoot, 'package.json');
+        if (!fs_1.default.existsSync(packageJsonPath)) {
+            return null;
+        }
+        const pkg = JSON.parse(fs_1.default.readFileSync(packageJsonPath, 'utf8'));
+        // Check if package has exports field
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const pkgAny = pkg;
+        if (!pkgAny.exports) {
+            return null;
+        }
+        // Use resolve.exports to handle the exports field
+        // For pkg's context, we're bundling CJS code, so try 'require' condition first
+        // Then fallback to 'import' for ESM-only packages
+        let resolved = (0, resolve_exports_1.exports)(pkgAny, subpath, {
+            require: true, // Try require first
+        });
+        // Fallback to import condition for ESM-only packages
+        if (!resolved) {
+            resolved = (0, resolve_exports_1.exports)(pkgAny, subpath, {
+                require: false, // This enables import condition
+            });
+        }
+        if (resolved) {
+            // resolved can be a string or array
+            const resolvedPath = Array.isArray(resolved) ? resolved[0] : resolved;
+            const fullPath = path_1.default.join(packageRoot, resolvedPath);
+            if (fs_1.default.existsSync(fullPath)) {
+                return fullPath;
+            }
+        }
+        return null;
+    }
+    catch (error) {
+        log_1.log.debug(`Failed to resolve with exports field: ${packageName}${subpath}`);
+        return null;
+    }
+}
+/**
+ * Try to resolve a module specifier as an ESM package
+ * @param specifier - Module specifier (e.g., 'nanoid', 'nanoid/url-alphabet')
+ * @param basedir - Base directory for resolution
+ * @returns Resolved path or null
+ */
+function tryResolveESM(specifier, basedir) {
+    try {
+        // Parse package name and subpath
+        let packageName;
+        let subpath;
+        if (specifier.startsWith('@')) {
+            // Scoped package: @org/pkg or @org/pkg/subpath
+            const parts = specifier.split('/');
+            packageName = `${parts[0]}/${parts[1]}`;
+            subpath = parts.length > 2 ? `./${parts.slice(2).join('/')}` : '.';
+        }
+        else {
+            // Regular package: pkg or pkg/subpath
+            const slashIndex = specifier.indexOf('/');
+            if (slashIndex === -1) {
+                packageName = specifier;
+                subpath = '.';
+            }
+            else {
+                packageName = specifier.substring(0, slashIndex);
+                subpath = `./${specifier.substring(slashIndex + 1)}`;
+            }
+        }
+        // Use resolveSync to find the package root (works with pnpm and other layouts)
+        // Try to resolve the package.json to get the package root
+        try {
+            const pkgJsonPath = (0, resolve_1.sync)(path_1.default.join(packageName, 'package.json'), {
+                basedir,
+                preserveSymlinks: false,
+            });
+            const packageRoot = path_1.default.dirname(pkgJsonPath);
+            // Try to resolve with exports field
+            const resolved = resolveWithExports(packageName, subpath, packageRoot);
+            if (resolved) {
+                return resolved;
+            }
+        }
+        catch {
+            // If package.json resolution fails, fall through to return null
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve a module specifier with ESM support
+ * Falls back to standard CommonJS resolution if ESM resolution fails
+ *
+ * @param specifier - Module specifier to resolve
+ * @param options - Resolution options
+ * @returns Resolved file path and ESM flag
+ */
+function resolveModule(specifier, options) {
+    const { basedir, extensions = ['.js', '.json', '.node'] } = options;
+    // First, try ESM-style resolution with exports field
+    const esmResolved = tryResolveESM(specifier, basedir);
+    if (esmResolved) {
+        // Use isESMFile which walks up to find the correct package.json
+        return {
+            resolved: esmResolved,
+            isESM: (0, common_1.isESMFile)(esmResolved),
+        };
+    }
+    // Fallback to standard CommonJS resolution
+    const resolved = (0, resolve_1.sync)(specifier, {
+        basedir,
+        extensions,
+    });
+    return {
+        resolved,
+        isESM: false, // CJS resolution
+    };
+}
+exports.resolveModule = resolveModule;
+//# sourceMappingURL=resolver.js.map

package/lib-es5/sea.js

@@ -21,7 +21,7 @@ const exists = async (path) => {
     try {
         return await (0, promises_1.stat)(path);
     }
-    catch (_a) {
+    catch {
         return false;
     }
 };
@@ -75,15 +75,15 @@ async function extract(os, archivePath) {
 }
 /** Verify the checksum of downloaded NodeJS archive */
 async function verifyChecksum(filePath, checksumUrl, fileName) {
-    var _a;
     const response = await fetch(checksumUrl);
     if (!response.ok) {
         throw new Error(`Failed to download checksum file from ${checksumUrl}`);
     }
     const checksums = await response.text();
-    const expectedChecksum = (_a = checksums
+    const expectedChecksum = checksums
         .split('\n')
-        .find((line) => line.includes(fileName))) === null || _a === void 0 ? void 0 : _a.split(' ')[0];
+        .find((line) => line.includes(fileName))
+        ?.split(' ')[0];
     if (!expectedChecksum) {
         throw new Error(`Checksum for ${fileName} not found`);
     }
@@ -252,7 +252,14 @@ async function sea(entryPoint, opts) {
         // docs: https://nodejs.org/api/single-executable-applications.html
         const blobPath = (0, path_1.join)(tmpDir, 'sea-prep.blob');
         const seaConfigFilePath = (0, path_1.join)(tmpDir, 'sea-config.json');
-        const seaConfig = Object.assign({ main: entryPoint, output: blobPath }, Object.assign(Object.assign({}, defaultSeaConfig), (opts.seaConfig || {})));
+        const seaConfig = {
+            main: entryPoint,
+            output: blobPath,
+            ...{
+                ...defaultSeaConfig,
+                ...(opts.seaConfig || {}),
+            },
+        };
         log_1.log.info('Creating sea-config.json file...');
         await (0, promises_1.writeFile)(seaConfigFilePath, JSON.stringify(seaConfig));
         log_1.log.info('Generating the blob...');
@@ -269,7 +276,7 @@ async function sea(entryPoint, opts) {
                     // users can always replace the signature if necessary
                     (0, mach_o_1.signMachOExecutable)(output);
                 }
-                catch (_a) {
+                catch {
                     if (target.arch === 'arm64') {
                         log_1.log.warn('Unable to sign the macOS executable', [
                             'Due to the mandatory code signing requirement, before the',

package/lib-es5/walker.js

@@ -38,6 +38,7 @@ const colors_1 = require("./colors");
 const follow_1 = require("./follow");
 const log_1 = require("./log");
 const detector = __importStar(require("./detector"));
+const esm_transformer_1 = require("./esm-transformer");
 const options_1 = __importDefault(require("./options"));
 // Note: as a developer, you can set the PKG_STRICT_VER variable.
 //       this will turn on some assertion in the walker code below
@@ -63,9 +64,6 @@ function isBuiltin(moduleName) {
         : moduleName;
     return module_1.builtinModules.includes(moduleNameWithoutPrefix);
 }
-function unlikelyJavascript(file) {
-    return ['.css', '.html', '.json', '.vue'].includes(path_1.default.extname(file));
-}
 function isPublic(config) {
     if (config.private) {
         return false;
@@ -232,7 +230,7 @@ function stepDetect(record, marker, derivatives) {
                 return false;
             }
             return true; // can i go inside?
-        });
+        }, record.file);
     }
     catch (error) {
         log_1.log.error(error.message, record.file);
@@ -265,6 +263,12 @@ async function findCommonJunctionPoint(file, realFile) {
     }
 }
 class Walker {
+    params;
+    symLinks;
+    patches;
+    tasks;
+    records;
+    dictionary;
     constructor() {
         this.tasks = [];
         this.records = {};
@@ -348,7 +352,7 @@ class Walker {
             this.append(task);
             return;
         }
-        this.append(Object.assign(Object.assign({}, task), { file: realFile }));
+        this.append({ ...task, file: realFile });
         this.appendStat({
             file: task.file,
             store: common_1.STORE_STAT,
@@ -380,7 +384,7 @@ class Walker {
             this.append(task);
             return;
         }
-        this.append(Object.assign(Object.assign({}, task), { file: realFile }));
+        this.append({ ...task, file: realFile });
         await this.appendSymlink(task.file, realFile);
         this.appendStat({
             file: task.file,
@@ -389,7 +393,7 @@ class Walker {
     }
     async appendFilesFromConfig(marker) {
         const { config, configPath, base } = marker;
-        const pkgConfig = config === null || config === void 0 ? void 0 : config.pkg;
+        const pkgConfig = config?.pkg;
         if (pkgConfig) {
             let { scripts } = pkgConfig;
             if (scripts) {
@@ -606,7 +610,6 @@ class Walker {
         }
     }
     async stepDerivatives_ALIAS_AS_RESOLVABLE(record, marker, derivative) {
-        var _a, _b;
         const newPackages = [];
         const catchReadFile = (file) => {
             (0, assert_1.default)((0, common_1.isPackageJson)(file), `walker: ${file} must be package.json`);
@@ -640,7 +643,7 @@ class Walker {
         }
         if (failure) {
             const { toplevel } = marker;
-            const mainNotFound = newPackages.length > 0 && !((_b = (_a = newPackages[0].marker) === null || _a === void 0 ? void 0 : _a.config) === null || _b === void 0 ? void 0 : _b.main);
+            const mainNotFound = newPackages.length > 0 && !newPackages[0].marker?.config?.main;
             const debug = !toplevel ||
                 derivative.mayExclude ||
                 (mainNotFound && derivative.fromDependencies);
@@ -678,17 +681,33 @@ class Walker {
                 break;
             }
         }
+        // Add all discovered package.json files, not just the one determined by the double-resolution logic
+        // This is necessary because ESM resolution may bypass the standard packageFilter mechanism
+        // However, only include package.json files that are either:
+        // 1. Inside node_modules (dependencies)
+        // 2. Inside the base directory of the current marker (application being packaged)
+        // This prevents including pkg's own package.json when used from source
+        for (const newPackage of newPackages) {
+            if (newPackage.marker) {
+                const file = newPackage.packageJson;
+                const isInNodeModules = file.includes(`${path_1.default.sep}node_modules${path_1.default.sep}`);
+                const isInMarkerBase = marker.base && file.startsWith(marker.base);
+                if (isInNodeModules || isInMarkerBase) {
+                    await this.appendBlobOrContent({
+                        file,
+                        marker: newPackage.marker,
+                        store: common_1.STORE_CONTENT,
+                        reason: record.file,
+                    });
+                }
+            }
+        }
+        // Keep the original logic for determining the marker for the resolved file
         if (newPackageForNewRecords) {
             if (strictVerify) {
                 (0, assert_1.default)(newPackageForNewRecords.packageJson ===
                     (0, common_1.normalizePath)(newPackageForNewRecords.packageJson));
             }
-            await this.appendBlobOrContent({
-                file: newPackageForNewRecords.packageJson,
-                marker: newPackageForNewRecords.marker,
-                store: common_1.STORE_CONTENT,
-                reason: record.file,
-            });
         }
         await this.appendBlobOrContent({
             file: newFile,
@@ -729,7 +748,7 @@ class Walker {
         await this.stepActivate(marker, derivatives1);
         await this.stepDerivatives(record, marker, derivatives1);
         if (store === common_1.STORE_BLOB) {
-            if (unlikelyJavascript(record.file) || (0, common_1.isDotNODE)(record.file)) {
+            if ((0, common_1.unlikelyJavascript)(record.file) || (0, common_1.isDotNODE)(record.file)) {
                 await this.appendBlobOrContent({
                     file: record.file,
                     marker,
@@ -745,7 +764,9 @@ class Walker {
                 });
             }
         }
-        if (store === common_1.STORE_BLOB || this.hasPatch(record)) {
+        if (store === common_1.STORE_BLOB ||
+            (store === common_1.STORE_CONTENT && (0, common_1.isPackageJson)(record.file)) ||
+            this.hasPatch(record)) {
             if (!record.body) {
                 await stepRead(record);
                 this.stepPatch(record);
@@ -753,6 +774,92 @@ class Walker {
                     stepStrip(record);
                 }
             }
+            // Patch package.json files to add synthetic main field if needed
+            if (store === common_1.STORE_CONTENT &&
+                (0, common_1.isPackageJson)(record.file) &&
+                record.body) {
+                try {
+                    const pkgContent = JSON.parse(record.body.toString('utf8'));
+                    let modified = false;
+                    // If package has exports but no main, add a synthetic main field
+                    if (pkgContent.exports && !pkgContent.main) {
+                        // Try to get main from marker.config first (set by catchPackageFilter in follow.ts)
+                        if (marker.config?.main) {
+                            pkgContent.main = marker.config.main;
+                            modified = true;
+                        }
+                        else {
+                            // Fallback: try to infer main from exports field
+                            const { exports } = pkgContent;
+                            if (typeof exports === 'string') {
+                                pkgContent.main = exports;
+                                modified = true;
+                            }
+                            else if (exports && typeof exports === 'object') {
+                                // Handle conditional exports
+                                if (exports['.']) {
+                                    if (typeof exports['.'] === 'string') {
+                                        pkgContent.main = exports['.'];
+                                        modified = true;
+                                    }
+                                    else if (typeof exports['.'] === 'object') {
+                                        // Try to get the best entry point for CJS
+                                        // Prefer: require > node > default
+                                        let mainEntry;
+                                        if (typeof exports['.'].require === 'string' &&
+                                            exports['.'].require) {
+                                            mainEntry = exports['.'].require;
+                                        }
+                                        else if (typeof exports['.'].node === 'string' &&
+                                            exports['.'].node) {
+                                            mainEntry = exports['.'].node;
+                                        }
+                                        else if (typeof exports['.'].default === 'string' &&
+                                            exports['.'].default) {
+                                            mainEntry = exports['.'].default;
+                                        }
+                                        if (mainEntry) {
+                                            pkgContent.main = mainEntry;
+                                            modified = true;
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    // If package has "type": "module", we need to change it to "commonjs"
+                    // because we transform all ESM files to CJS before bytecode compilation
+                    if (pkgContent.type === 'module') {
+                        pkgContent.type = 'commonjs';
+                        modified = true;
+                    }
+                    // Only rewrite if we made changes
+                    if (modified) {
+                        record.body = Buffer.from(JSON.stringify(pkgContent, null, 2), 'utf8');
+                    }
+                }
+                catch (error) {
+                    // Ignore JSON parsing errors
+                }
+            }
+            // Transform ESM to CJS before bytecode compilation
+            // Check all JS-like files (.js, .mjs, .cjs) but only transform ESM ones
+            if (store === common_1.STORE_BLOB &&
+                record.body &&
+                ((0, common_1.isDotJS)(record.file) || record.file.endsWith('.mjs'))) {
+                if ((0, common_1.isESMFile)(record.file)) {
+                    try {
+                        const result = (0, esm_transformer_1.transformESMtoCJS)(record.body.toString('utf8'), record.file);
+                        if (result.isTransformed) {
+                            record.body = Buffer.from(result.code, 'utf8');
+                        }
+                    }
+                    catch (error) {
+                        const message = error instanceof Error ? error.message : String(error);
+                        throw new Error(`Failed to transform ESM module to CJS for file "${record.file}": ${message}`);
+                    }
+                }
+            }
             if (store === common_1.STORE_BLOB) {
                 const derivatives2 = [];
                 stepDetect(record, marker, derivatives2);
@@ -834,8 +941,7 @@ class Walker {
         }
     }
     async readDictionary(marker) {
-        var _a, _b, _c;
-        if (((_a = this.params.noDictionary) === null || _a === void 0 ? void 0 : _a[0]) === '*') {
+        if (this.params.noDictionary?.[0] === '*') {
             return;
         }
         const dd = path_1.default.join(__dirname, '../dictionary');
@@ -843,7 +949,7 @@ class Walker {
         for (const file of files) {
             if (/\.js$/.test(file)) {
                 const name = file.slice(0, -3);
-                if ((_b = this.params.noDictionary) === null || _b === void 0 ? void 0 : _b.includes(file)) {
+                if (this.params.noDictionary?.includes(file)) {
                     continue;
                 }
                 // eslint-disable-next-line import/no-dynamic-require, global-require, @typescript-eslint/no-var-requires
@@ -851,7 +957,7 @@ class Walker {
                 this.dictionary[name] = config;
             }
         }
-        const pkgConfig = (_c = marker.config) === null || _c === void 0 ? void 0 : _c.pkg;
+        const pkgConfig = marker.config?.pkg;
         if (pkgConfig) {
             const { dictionary } = pkgConfig;
             if (dictionary) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yao-pkg/pkg",
-  "version": "6.11.0",
+  "version": "6.13.0",
   "description": "Package your Node.js project into an executable",
   "main": "lib-es5/index.js",
   "license": "MIT",
@@ -24,8 +24,10 @@
   "dependencies": {
     "@babel/generator": "^7.23.0",
     "@babel/parser": "^7.23.0",
+    "@babel/traverse": "^7.23.0",
     "@babel/types": "^7.23.0",
-    "@yao-pkg/pkg-fetch": "3.5.31",
+    "esbuild": "^0.24.0",
+    "@yao-pkg/pkg-fetch": "3.5.32",
     "into-stream": "^6.0.0",
     "minimist": "^1.2.6",
     "multistream": "^4.1.0",
@@ -33,15 +35,16 @@
     "picomatch": "^4.0.2",
     "prebuild-install": "^7.1.1",
     "resolve": "^1.22.10",
+    "resolve.exports": "^2.0.3",
     "stream-meter": "^1.0.4",
-    "tar": "^7.4.3",
+    "tar": "^7.5.6",
     "tinyglobby": "^0.2.11",
     "unzipper": "^0.12.3"
   },
   "devDependencies": {
-    "@babel/core": "^7.23.0",
     "@release-it/conventional-changelog": "^7.0.2",
     "@types/babel__generator": "^7.6.5",
+    "@types/babel__traverse": "^7.20.3",
     "@types/minimist": "^1.2.2",
     "@types/multistream": "^4.1.0",
     "@types/node": "^16.18.113",
@@ -52,7 +55,6 @@
     "@types/unzipper": "^0.10.10",
     "@typescript-eslint/eslint-plugin": "^6.7.4",
     "@typescript-eslint/parser": "^6.7.4",
-    "esbuild": "^0.24.0",
     "esbuild-register": "^3.6.0",
     "eslint": "^8.50.0",
     "eslint-config-airbnb-base": "^15.0.0",