@yao-pkg/pkg 6.12.0 → 6.13.1

package/lib-es5/follow.js

@@ -8,6 +8,7 @@ const resolve_1 = require("resolve");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const common_1 = require("./common");
+const resolver_1 = require("./resolver");
 const PROOF = 'a-proof-that-main-is-captured.js';
 function parentDirectoriesContain(parent, directory) {
     let currentParent = parent;
@@ -22,69 +23,167 @@ function parentDirectoriesContain(parent, directory) {
         currentParent = newParent;
     }
 }
+/**
+ * Check if a specifier looks like a valid npm package name
+ * npm package names must be lowercase and can only contain:
+ * - lowercase letters, digits, hyphens, underscores, dots
+ * - can be scoped (@scope/package)
+ * This helps filter out generated aliases like "connectNonLiteral"
+ */
+function isValidPackageName(specifier) {
+    // Scoped packages: @scope/package
+    if (specifier.startsWith('@')) {
+        const parts = specifier.split('/');
+        if (parts.length < 2)
+            return false;
+        // Scope must start with @ and both parts must be valid
+        return /^@[a-z0-9_.-]+$/.test(parts[0]) && /^[a-z0-9_.-]+$/.test(parts[1]);
+    }
+    // Regular package: must be lowercase with allowed characters
+    // Package name is the part before the first '/' (if any)
+    const packageName = specifier.split('/')[0];
+    return /^[a-z0-9_.-]+$/.test(packageName);
+}
 function follow(x, opts) {
     // TODO async version
-    return new Promise((resolve) => {
-        resolve((0, resolve_1.sync)(x, {
-            basedir: opts.basedir,
-            extensions: opts.extensions,
-            isFile: (file) => {
-                if (opts.ignoreFile &&
-                    path_1.default.join(path_1.default.dirname(opts.ignoreFile), PROOF) === file) {
-                    return true;
+    return new Promise((resolve, reject) => {
+        // Try ESM-aware resolution first for non-relative specifiers
+        // Skip if the specifier doesn't look like a valid npm package name
+        // (e.g., generated aliases like "connectNonLiteral")
+        if (!x.startsWith('.') &&
+            !x.startsWith('/') &&
+            !path_1.default.isAbsolute(x) &&
+            isValidPackageName(x)) {
+            try {
+                let extensions;
+                if (Array.isArray(opts.extensions)) {
+                    extensions = opts.extensions;
                 }
-                let stat;
-                try {
-                    stat = fs_1.default.statSync(file);
+                else if (opts.extensions) {
+                    extensions = [opts.extensions];
                 }
-                catch (e) {
-                    const ex = e;
-                    if (ex && (ex.code === 'ENOENT' || ex.code === 'ENOTDIR'))
-                        return false;
-                    throw ex;
-                }
-                return stat.isFile() || stat.isFIFO();
-            },
-            isDirectory: (directory) => {
-                if (opts.ignoreFile &&
-                    parentDirectoriesContain(opts.ignoreFile, directory)) {
-                    return false;
+                else {
+                    extensions = ['.js', '.json', '.node'];
                 }
-                let stat;
-                try {
-                    stat = fs_1.default.statSync(directory);
+                const result = (0, resolver_1.resolveModule)(x, {
+                    basedir: opts.basedir || process.cwd(),
+                    extensions,
+                });
+                // Only use ESM resolution result if it's an actual ESM package
+                // For CJS packages, fall through to standard CommonJS resolution
+                // to ensure all callbacks (catchReadFile, catchPackageFilter) are handled correctly
+                if (result.isESM) {
+                    // This is a real ESM package, handle it here
+                    if (opts.catchReadFile) {
+                        // Find the package.json for this resolved module
+                        let currentDir = path_1.default.dirname(result.resolved);
+                        while (currentDir !== path_1.default.dirname(currentDir)) {
+                            const pkgPath = path_1.default.join(currentDir, 'package.json');
+                            // Honor ignoreFile to ensure correct package marker determination
+                            if (opts.ignoreFile &&
+                                path_1.default.normalize(pkgPath) === path_1.default.normalize(opts.ignoreFile)) {
+                                // Skip this package.json as it's marked to be ignored
+                                currentDir = path_1.default.dirname(currentDir);
+                                continue;
+                            }
+                            if (fs_1.default.existsSync(pkgPath)) {
+                                // Check if this package.json is in node_modules (not the root package)
+                                if (currentDir.includes('node_modules')) {
+                                    opts.catchReadFile(pkgPath);
+                                    // Also call catchPackageFilter if provided
+                                    if (opts.catchPackageFilter) {
+                                        const pkgContent = JSON.parse(fs_1.default.readFileSync(pkgPath, 'utf8'));
+                                        // If package doesn't have a "main" field but we resolved via exports,
+                                        // add a synthetic "main" field so runtime resolution works
+                                        if (!pkgContent.main) {
+                                            const relativePath = path_1.default.relative(currentDir, result.resolved);
+                                            pkgContent.main = `./${relativePath.replace(/\\/g, '/')}`;
+                                        }
+                                        opts.catchPackageFilter(pkgContent, currentDir, currentDir);
+                                    }
+                                    break;
+                                }
+                            }
+                            currentDir = path_1.default.dirname(currentDir);
+                        }
+                    }
+                    // ESM package resolved successfully
+                    resolve(result.resolved);
+                    return;
                 }
-                catch (e) {
-                    const ex = e;
-                    if (ex && (ex.code === 'ENOENT' || ex.code === 'ENOTDIR')) {
+                // CJS package - fall through to standard CommonJS resolution
+                // to handle all callbacks properly
+            }
+            catch (error) {
+                // ESM resolution failed - fall through to standard CommonJS resolution
+            }
+        }
+        // Use standard CommonJS resolution
+        try {
+            resolve((0, resolve_1.sync)(x, {
+                basedir: opts.basedir,
+                extensions: opts.extensions,
+                isFile: (file) => {
+                    if (opts.ignoreFile &&
+                        path_1.default.join(path_1.default.dirname(opts.ignoreFile), PROOF) === file) {
+                        return true;
+                    }
+                    let stat;
+                    try {
+                        stat = fs_1.default.statSync(file);
+                    }
+                    catch (e) {
+                        const ex = e;
+                        if (ex && (ex.code === 'ENOENT' || ex.code === 'ENOTDIR'))
+                            return false;
+                        throw ex;
+                    }
+                    return stat.isFile() || stat.isFIFO();
+                },
+                isDirectory: (directory) => {
+                    if (opts.ignoreFile &&
+                        parentDirectoriesContain(opts.ignoreFile, directory)) {
                         return false;
                     }
-                    throw ex;
-                }
-                return stat.isDirectory();
-            },
-            readFileSync: (file) => {
-                if (opts.ignoreFile && opts.ignoreFile === file) {
-                    return Buffer.from(`{"main":"${PROOF}"}`);
-                }
-                if (opts.catchReadFile) {
-                    opts.catchReadFile(file);
-                }
-                return fs_1.default.readFileSync(file);
-            },
-            packageFilter: (config, base, dir) => {
-                if (opts.catchPackageFilter) {
-                    opts.catchPackageFilter(config, base, dir);
-                }
-                return config;
-            },
-            /** function to synchronously resolve a potential symlink to its real path */
-            // realpathSync?: (file: string) => string;
-            realpathSync: (file) => {
-                const file2 = (0, common_1.toNormalizedRealPath)(file);
-                return file2;
-            },
-        }));
+                    let stat;
+                    try {
+                        stat = fs_1.default.statSync(directory);
+                    }
+                    catch (e) {
+                        const ex = e;
+                        if (ex && (ex.code === 'ENOENT' || ex.code === 'ENOTDIR')) {
+                            return false;
+                        }
+                        throw ex;
+                    }
+                    return stat.isDirectory();
+                },
+                readFileSync: (file) => {
+                    if (opts.ignoreFile && opts.ignoreFile === file) {
+                        return Buffer.from(`{"main":"${PROOF}"}`);
+                    }
+                    if (opts.catchReadFile) {
+                        opts.catchReadFile(file);
+                    }
+                    return fs_1.default.readFileSync(file);
+                },
+                packageFilter: (config, base, dir) => {
+                    if (opts.catchPackageFilter) {
+                        opts.catchPackageFilter(config, base, dir);
+                    }
+                    return config;
+                },
+                /** function to synchronously resolve a potential symlink to its real path */
+                // realpathSync?: (file: string) => string;
+                realpathSync: (file) => {
+                    const file2 = (0, common_1.toNormalizedRealPath)(file);
+                    return file2;
+                },
+            }));
+        }
+        catch (error) {
+            reject(error);
+        }
     });
 }
 exports.follow = follow;

package/lib-es5/index.js

@@ -149,7 +149,6 @@ async function needViaCache(target) {
     return c;
 }
 async function exec(argv2) {
-    var _a, _b;
     const argv = (0, minimist_1.default)(argv2, {
         boolean: [
             'b',
@@ -413,7 +412,10 @@ async function exec(argv2) {
         await needWithDryRun(target);
         target.fabricator = fabricatorForTarget(target);
         if (bytecode) {
-            await needWithDryRun(Object.assign(Object.assign({}, target.fabricator), { forceBuild }));
+            await needWithDryRun({
+                ...target.fabricator,
+                forceBuild,
+            });
         }
     }
     if (dryRunResults.fetched && !dryRunResults.built) {
@@ -433,7 +435,7 @@ async function exec(argv2) {
                 try {
                     (0, mach_o_1.signMachOExecutable)(signedBinaryPath);
                 }
-                catch (_c) {
+                catch {
                     throw (0, log_1.wasReported)('Cannot generate bytecode', [
                         'pkg fails to run "codesign" utility. Due to the mandatory signing',
                         'requirement of macOS, executables must be signed. Please ensure the',
@@ -450,7 +452,7 @@ async function exec(argv2) {
     // marker
     let marker;
     if (configJson) {
-        options_1.default.set(configJson === null || configJson === void 0 ? void 0 : configJson.pkg);
+        options_1.default.set(configJson?.pkg);
         marker = {
             config: configJson,
             base: path_1.default.dirname(config),
@@ -458,7 +460,7 @@ async function exec(argv2) {
         };
     }
     else {
-        options_1.default.set(inputJson === null || inputJson === void 0 ? void 0 : inputJson.pkg);
+        options_1.default.set(inputJson?.pkg);
         marker = {
             config: inputJson || {},
             base: path_1.default.dirname(input),
@@ -473,13 +475,13 @@ async function exec(argv2) {
     }
     if (argv['public-packages']) {
         params.publicPackages = argv['public-packages'].split(',');
-        if (((_a = params.publicPackages) === null || _a === void 0 ? void 0 : _a.indexOf('*')) !== -1) {
+        if (params.publicPackages?.indexOf('*') !== -1) {
             params.publicPackages = ['*'];
         }
     }
     if (argv['no-dict']) {
         params.noDictionary = argv['no-dict'].split(',');
-        if (((_b = params.noDictionary) === null || _b === void 0 ? void 0 : _b.indexOf('*')) !== -1) {
+        if (params.noDictionary?.indexOf('*') !== -1) {
             params.noDictionary = ['*'];
         }
     }
@@ -531,7 +533,7 @@ async function exec(argv2) {
                     // users can always replace the signature if necessary
                     (0, mach_o_1.signMachOExecutable)(target.output);
                 }
-                catch (_d) {
+                catch {
                     if (target.arch === 'arm64') {
                         log_1.log.warn('Unable to sign the macOS executable', [
                             'Due to the mandatory code signing requirement, before the',

package/lib-es5/mach-o.js

@@ -58,7 +58,7 @@ function signMachOExecutable(executable) {
             stdio: 'inherit',
         });
     }
-    catch (_a) {
+    catch {
         (0, child_process_1.execFileSync)('ldid', ['-Cadhoc', '-S', executable], { stdio: 'inherit' });
     }
 }

package/lib-es5/options.js

@@ -1,13 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 class Options {
+    options;
     constructor() {
         this.options = {
             dictionary: {},
         };
     }
     set(options) {
-        this.options = options !== null && options !== void 0 ? options : this.options;
+        this.options = options ?? this.options;
     }
     get() {
         return this.options;

package/lib-es5/packer.js

@@ -27,13 +27,22 @@ function hasAnyStore(record) {
 }
 function packer({ records, entrypoint, bytecode, }) {
     const stripes = [];
-    for (const snap in records) {
+    // If the entrypoint was a .mjs file that got transformed, update its extension
+    if (records[entrypoint]?.wasTransformed && entrypoint.endsWith('.mjs')) {
+        entrypoint = `${entrypoint.slice(0, -4)}.js`;
+    }
+    for (let snap in records) {
         if (records[snap]) {
             const record = records[snap];
             const { file } = record;
             if (!hasAnyStore(record)) {
                 continue;
             }
+            // If .mjs file was transformed to CJS, rename it to .js in the snapshot
+            // This prevents Node.js from treating it as an ES module
+            if (record.wasTransformed && snap.endsWith('.mjs')) {
+                snap = `${snap.slice(0, -4)}.js`;
+            }
             (0, assert_1.default)(record[common_1.STORE_STAT], 'packer: no STORE_STAT');
             (0, assert_1.default)(record[common_1.STORE_BLOB] ||
                 record[common_1.STORE_CONTENT] ||
@@ -87,7 +96,7 @@ function packer({ records, entrypoint, bytecode, }) {
                 }
                 else if (store === common_1.STORE_STAT) {
                     if (typeof value === 'object') {
-                        const newStat = Object.assign({}, value);
+                        const newStat = { ...value };
                         const buffer = Buffer.from(JSON.stringify(newStat));
                         stripes.push({ snap, store, buffer });
                     }

package/lib-es5/producer.js

@@ -127,14 +127,13 @@ function getPrebuildEnvPrefix(pkgName) {
         .replace(/^_/, '')}`;
 }
 function nativePrebuildInstall(target, nodeFile) {
-    var _a, _b;
     const prebuildInstall = path_1.default.join(__dirname, '../node_modules/.bin/prebuild-install');
     const dir = findPackageJson(nodeFile);
     const packageJson = JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, 'package.json'), { encoding: 'utf-8' }));
     // only try prebuild-install for packages that actually use it or if
     // explicitly configured via environment variables
     const envPrefix = getPrebuildEnvPrefix(packageJson.name);
-    if (((_a = packageJson.dependencies) === null || _a === void 0 ? void 0 : _a['prebuild-install']) == null &&
+    if (packageJson.dependencies?.['prebuild-install'] == null &&
         ![
             `${envPrefix}_binary_host`,
             `${envPrefix}_binary_host_mirror`,
@@ -155,7 +154,7 @@ function nativePrebuildInstall(target, nodeFile) {
     if (!fs_1.default.existsSync(`${nodeFile}.bak`)) {
         fs_1.default.copyFileSync(nodeFile, `${nodeFile}.bak`);
     }
-    const napiVersions = (_b = packageJson === null || packageJson === void 0 ? void 0 : packageJson.binary) === null || _b === void 0 ? void 0 : _b.napi_versions;
+    const napiVersions = packageJson?.binary?.napi_versions;
     const options = [
         '--platform',
         types_1.platform[target.platform],
@@ -298,7 +297,7 @@ function producer({ backpack, bakes, slash, target, symLinks, doCompress, native
                     // clone to prevent 'skip' propagate
                     // to other targets, since same stripe
                     // is used for several targets
-                    const stripe = Object.assign({}, stripes.shift());
+                    const stripe = { ...stripes.shift() };
                     prevStripe = stripe;
                     if (stripe.buffer) {
                         if (stripe.store === common_1.STORE_BLOB) {

package/lib-es5/resolver.js

@@ -0,0 +1,142 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveModule = void 0;
+const resolve_1 = require("resolve");
+const resolve_exports_1 = require("resolve.exports");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const common_1 = require("./common");
+const log_1 = require("./log");
+/**
+ * Resolve using package.json "exports" field (ESM-style)
+ * @param packageName - Package name (e.g., 'nanoid')
+ * @param subpath - Subpath within package (e.g., './url-alphabet')
+ * @param packageRoot - Absolute path to package root
+ * @returns Resolved path or null if not found
+ */
+function resolveWithExports(packageName, subpath, packageRoot) {
+    try {
+        const packageJsonPath = path_1.default.join(packageRoot, 'package.json');
+        if (!fs_1.default.existsSync(packageJsonPath)) {
+            return null;
+        }
+        const pkg = JSON.parse(fs_1.default.readFileSync(packageJsonPath, 'utf8'));
+        // Check if package has exports field
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const pkgAny = pkg;
+        if (!pkgAny.exports) {
+            return null;
+        }
+        // Use resolve.exports to handle the exports field
+        // For pkg's context, we're bundling CJS code, so try 'require' condition first
+        // Then fallback to 'import' for ESM-only packages
+        let resolved = (0, resolve_exports_1.exports)(pkgAny, subpath, {
+            require: true, // Try require first
+        });
+        // Fallback to import condition for ESM-only packages
+        if (!resolved) {
+            resolved = (0, resolve_exports_1.exports)(pkgAny, subpath, {
+                require: false, // This enables import condition
+            });
+        }
+        if (resolved) {
+            // resolved can be a string or array
+            const resolvedPath = Array.isArray(resolved) ? resolved[0] : resolved;
+            const fullPath = path_1.default.join(packageRoot, resolvedPath);
+            if (fs_1.default.existsSync(fullPath)) {
+                return fullPath;
+            }
+        }
+        return null;
+    }
+    catch (error) {
+        log_1.log.debug(`Failed to resolve with exports field: ${packageName}${subpath}`);
+        return null;
+    }
+}
+/**
+ * Try to resolve a module specifier as an ESM package
+ * @param specifier - Module specifier (e.g., 'nanoid', 'nanoid/url-alphabet')
+ * @param basedir - Base directory for resolution
+ * @returns Resolved path or null
+ */
+function tryResolveESM(specifier, basedir) {
+    try {
+        // Parse package name and subpath
+        let packageName;
+        let subpath;
+        if (specifier.startsWith('@')) {
+            // Scoped package: @org/pkg or @org/pkg/subpath
+            const parts = specifier.split('/');
+            packageName = `${parts[0]}/${parts[1]}`;
+            subpath = parts.length > 2 ? `./${parts.slice(2).join('/')}` : '.';
+        }
+        else {
+            // Regular package: pkg or pkg/subpath
+            const slashIndex = specifier.indexOf('/');
+            if (slashIndex === -1) {
+                packageName = specifier;
+                subpath = '.';
+            }
+            else {
+                packageName = specifier.substring(0, slashIndex);
+                subpath = `./${specifier.substring(slashIndex + 1)}`;
+            }
+        }
+        // Use resolveSync to find the package root (works with pnpm and other layouts)
+        // Try to resolve the package.json to get the package root
+        try {
+            const pkgJsonPath = (0, resolve_1.sync)(path_1.default.join(packageName, 'package.json'), {
+                basedir,
+                preserveSymlinks: false,
+            });
+            const packageRoot = path_1.default.dirname(pkgJsonPath);
+            // Try to resolve with exports field
+            const resolved = resolveWithExports(packageName, subpath, packageRoot);
+            if (resolved) {
+                return resolved;
+            }
+        }
+        catch {
+            // If package.json resolution fails, fall through to return null
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve a module specifier with ESM support
+ * Falls back to standard CommonJS resolution if ESM resolution fails
+ *
+ * @param specifier - Module specifier to resolve
+ * @param options - Resolution options
+ * @returns Resolved file path and ESM flag
+ */
+function resolveModule(specifier, options) {
+    const { basedir, extensions = ['.js', '.json', '.node'] } = options;
+    // First, try ESM-style resolution with exports field
+    const esmResolved = tryResolveESM(specifier, basedir);
+    if (esmResolved) {
+        // Use isESMFile which walks up to find the correct package.json
+        return {
+            resolved: esmResolved,
+            isESM: (0, common_1.isESMFile)(esmResolved),
+        };
+    }
+    // Fallback to standard CommonJS resolution
+    const resolved = (0, resolve_1.sync)(specifier, {
+        basedir,
+        extensions,
+    });
+    return {
+        resolved,
+        isESM: false, // CJS resolution
+    };
+}
+exports.resolveModule = resolveModule;
+//# sourceMappingURL=resolver.js.map

package/lib-es5/sea.js

@@ -21,7 +21,7 @@ const exists = async (path) => {
     try {
         return await (0, promises_1.stat)(path);
     }
-    catch (_a) {
+    catch {
         return false;
     }
 };
@@ -75,15 +75,15 @@ async function extract(os, archivePath) {
 }
 /** Verify the checksum of downloaded NodeJS archive */
 async function verifyChecksum(filePath, checksumUrl, fileName) {
-    var _a;
     const response = await fetch(checksumUrl);
     if (!response.ok) {
         throw new Error(`Failed to download checksum file from ${checksumUrl}`);
     }
     const checksums = await response.text();
-    const expectedChecksum = (_a = checksums
+    const expectedChecksum = checksums
         .split('\n')
-        .find((line) => line.includes(fileName))) === null || _a === void 0 ? void 0 : _a.split(' ')[0];
+        .find((line) => line.includes(fileName))
+        ?.split(' ')[0];
     if (!expectedChecksum) {
         throw new Error(`Checksum for ${fileName} not found`);
     }
@@ -252,7 +252,14 @@ async function sea(entryPoint, opts) {
         // docs: https://nodejs.org/api/single-executable-applications.html
         const blobPath = (0, path_1.join)(tmpDir, 'sea-prep.blob');
         const seaConfigFilePath = (0, path_1.join)(tmpDir, 'sea-config.json');
-        const seaConfig = Object.assign({ main: entryPoint, output: blobPath }, Object.assign(Object.assign({}, defaultSeaConfig), (opts.seaConfig || {})));
+        const seaConfig = {
+            main: entryPoint,
+            output: blobPath,
+            ...{
+                ...defaultSeaConfig,
+                ...(opts.seaConfig || {}),
+            },
+        };
         log_1.log.info('Creating sea-config.json file...');
         await (0, promises_1.writeFile)(seaConfigFilePath, JSON.stringify(seaConfig));
         log_1.log.info('Generating the blob...');
@@ -269,7 +276,7 @@ async function sea(entryPoint, opts) {
                     // users can always replace the signature if necessary
                     (0, mach_o_1.signMachOExecutable)(output);
                 }
-                catch (_a) {
+                catch {
                     if (target.arch === 'arm64') {
                         log_1.log.warn('Unable to sign the macOS executable', [
                             'Due to the mandatory code signing requirement, before the',