rea-agents 6.2.0 → 6.4.0

package/dist/application/javascript/JavaScriptArtifactPathResolution.js

@@ -1,5 +1,6 @@
-import { builtinModules } from "node:module";
+import { isBuiltin } from "node:module";
 import { posix } from "node:path";
+import { normalizeJoinedLogicalPath, logicalPathEscapesRoot, } from "../../domain/artifactIdentity.js";
 import { admitsCanonicalPathSyntax, hasScheme, htmlUrlText, looksExternal, percentDecodeUrlPath, stripQueryAndFragment, } from "../../domain/artifactPathSyntax.js";
 const EXTENSIONS = [
     ".js",
@@ -11,60 +12,59 @@ const EXTENSIONS = [
     ".html",
     ".node",
 ];
-const NODE_BUILTINS = new Set(builtinModules.map((name) => name.replace(/^node:/u, "")));
-/** Resolve one declaration under its exact syntax/metadata context. */
-export const resolveArtifactPathByContext = (input) => resolvePackagePath(input, new Set());
-const resolvePackagePath = (input, packageChain, mode = "full", exportsTargetUrl = false) => {
-    const rejected = rejectDeclaration(input);
+/** Resolve one declaration while preserving its original input identity. */
+export const resolveArtifactPathByContext = (input) => {
+    const resolution = resolvePath(input);
+    return resolution.status === "resolved"
+        ? {
+            declared_path: input.declaredPath,
+            resolution_context: input.context,
+            resolved_path: resolution.resolvedPath,
+            resolution_status: resolution.status,
+            limitations: resolution.limitations,
+        }
+        : {
+            declared_path: input.declaredPath,
+            resolution_context: input.context,
+            resolved_path: null,
+            resolution_status: resolution.status,
+            limitations: resolution.limitations,
+        };
+};
+const resolvePath = (input) => {
+    const rejected = rejectDeclaration(input.declaredPath);
     if (rejected !== null)
         return rejected;
-    const candidate = contextualCandidate(input, exportsTargetUrl);
+    const candidate = contextualCandidate(input);
     if (typeof candidate !== "string")
         return candidate;
-    const confined = confineCandidate(input, candidate);
+    const confined = confineCandidate(candidate);
     if (typeof confined !== "string")
         return confined;
     if (input.context === "html-reference")
-        return outcome(input, resolveFileCandidates(input, [confined]) ?? {
-            resolvedPath: null,
-            status: "not-found",
-            limitations: [
+        return (resolveFileCandidates(input, [confined]) ??
+            unresolvedCandidate("not-found", [
                 `The exact HTML resource ${confined} was not found among the selected application files.`,
-            ],
-        });
-    // An exports target names one exact file; Node tries no extension or index.
-    const resolved = exportsTargetUrl
-        ? (resolveFileCandidates(input, [confined]) ??
-            exactExportsTargetNotFound(confined))
-        : mode === "files-and-index"
-            ? (resolveFileCandidates(input, [
-                ...fileCandidates(confined),
-                ...indexCandidates(confined),
-            ]) ?? notFoundCandidate())
-            : resolveCandidate(input, confined, packageChain);
-    return outcome(input, resolved);
+            ]));
+    return resolveCandidate(input, confined, new Set());
 };
-const rejectDeclaration = (input) => {
-    const declared = input.declaredPath;
+const rejectDeclaration = (declared) => {
     if (declared.length === 0)
-        return unresolvedOutcome(input, "rejected", [
-            "The declared path is empty.",
-        ]);
+        return unresolvedCandidate("rejected", ["The declared path is empty."]);
     if (declared.includes("\0") || declared.includes("\\"))
-        return unresolvedOutcome(input, "rejected", [
+        return unresolvedCandidate("rejected", [
             "NUL and backslash path syntax are not admitted for canonical artifact paths.",
         ]);
     if (!admitsCanonicalPathSyntax(declared))
-        return unresolvedOutcome(input, "rejected", [
+        return unresolvedCandidate("rejected", [
             "Encoded dot or separator bytes are rejected before artifact path resolution.",
         ]);
     return null;
 };
-const contextualCandidate = (input, exportsTargetUrl) => {
+const contextualCandidate = (input) => {
     const { context } = input;
     let declared = context === "html-reference" ||
         context === "url-reference" ||
-        exportsTargetUrl ||
         (context === "module-specifier" && input.moduleKind !== "require")
         ? stripQueryAndFragment(input.declaredPath)
         : input.declaredPath;
@@ -75,64 +75,117 @@ const contextualCandidate = (input, exportsTargetUrl) => {
         if (fileUrl !== undefined)
             return fileUrl;
         if (hasScheme(declared))
-            return unresolvedOutcome(input, "external", [
+            return unresolvedCandidate("external", [
                 "URL and Node builtin schemes are outside static artifact module resolution.",
             ]);
         if (!declared.startsWith(".") && !declared.startsWith("/"))
             return bareModuleCandidate(input, declared);
+        if (input.moduleKind !== "require") {
+            const decoded = decodeModuleUrlPath(declared);
+            if (typeof decoded !== "string")
+                return decoded;
+            declared = decoded;
+        }
     }
     else if (looksExternal(declared))
-        return unresolvedOutcome(input, "external", [
+        return unresolvedCandidate("external", [
             "URL schemes and protocol-relative URLs are outside this local artifact path context.",
         ]);
-    // Exports targets use URL paths for both loaders; legacy main fields remain literal.
-    if (exportsTargetUrl ||
-        (context === "module-specifier" && input.moduleKind !== "require")) {
-        try {
-            declared = decodeURIComponent(declared);
-        }
-        catch (cause) {
-            void cause;
-            return unresolvedOutcome(input, "rejected", [
-                "The module URL path contains malformed percent encoding.",
-            ]);
-        }
-        if (declared.includes("\0"))
-            return unresolvedOutcome(input, "rejected", [
-                "The decoded module URL path contains NUL.",
-            ]);
+    return relativeCandidate(input.sourcePath, declared);
+};
+const decodeModuleUrlPath = (declared) => {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(declared);
     }
-    const relative = declared.startsWith("/") ? declared.slice(1) : declared;
-    return declared.startsWith("/")
-        ? relative
-        : posix.join(posix.dirname(input.sourcePath), relative);
+    catch (cause) {
+        void cause;
+        return unresolvedCandidate("rejected", [
+            "The module URL path contains malformed percent encoding.",
+        ]);
+    }
+    return decoded.includes("\0")
+        ? unresolvedCandidate("rejected", [
+            "The decoded module URL path contains NUL.",
+        ])
+        : decoded;
 };
+const relativeCandidate = (sourcePath, declared) => declared.startsWith("/")
+    ? declared.slice(1)
+    : posix.join(posix.dirname(sourcePath), declared);
 const bareModuleCandidate = (input, declared) => {
     const packageName = barePackageName(declared);
-    if (packageName === null ||
-        NODE_BUILTINS.has(packageName) ||
-        declared.startsWith("#"))
-        return unresolvedOutcome(input, "external", [
+    if (packageName === null || isBuiltin(declared) || declared.startsWith("#"))
+        return unresolvedCandidate("external", [
             "The bare specifier is a Node builtin, package import map, or invalid package name.",
         ]);
-    if (declared !== packageName)
-        return unresolvedOutcome(input, "external", [
-            "Bare package subpaths remain unresolved unless an exact package-exports subpath model is available.",
-        ]);
+    const subpath = declared === packageName ? "." : `.${declared.slice(packageName.length)}`;
     const source = input.files.get(input.sourcePath);
     let directory = posix.dirname(input.sourcePath);
     while (true) {
-        const candidate = posix.join(directory, "node_modules", declared);
-        if (hasContainerCandidate(input.files, candidate, source?.container_sha256))
-            return candidate;
+        const candidate = posix.join(directory, "node_modules", packageName);
+        if (subpath === ".") {
+            const direct = resolveFileCandidates(input, fileCandidates(candidate));
+            if (direct !== null)
+                return direct;
+        }
+        if (hasContainerDirectory(input.files, candidate, source?.container_sha256))
+            return resolvePackageSpecifier(input, candidate, subpath);
         if (directory === "." || directory === "")
             break;
         directory = posix.dirname(directory);
     }
-    return unresolvedOutcome(input, "external", [
+    return unresolvedCandidate("external", [
         "No matching bare package was inventoried in an enclosing node_modules directory.",
     ]);
 };
+/** Package roots and exact subpaths share metadata and exports selection. */
+const resolvePackageSpecifier = (input, directory, subpath) => {
+    const metadata = readPackageMetadata(input, directory);
+    if (metadata.kind === "unavailable")
+        return unresolvedCandidate("unavailable", [metadata.limitation]);
+    const rawExports = metadata.kind === "available"
+        ? Reflect.get(metadata.value, "exports")
+        : undefined;
+    if (rawExports === undefined || rawExports === null) {
+        if (subpath === ".")
+            return resolveDirectory(input, directory, metadata, new Set());
+        // Preserve the trailing slash for a package directory request.
+        const candidate = confineCandidate(`${directory}/${subpath.slice(2)}`);
+        return typeof candidate === "string"
+            ? resolveCandidate(input, candidate, new Set())
+            : candidate;
+    }
+    const exported = selectPackageExport(rawExports, subpath, input.moduleKind);
+    const packagePath = posix.join(directory, "package.json");
+    if (exported.status === "rejected")
+        return unresolvedCandidate("rejected", [
+            `Package metadata ${packagePath}: ${exported.limitation}`,
+        ]);
+    if (exported.status === "unmatched")
+        return unresolvedCandidate("external", [
+            `Directory package metadata ${packagePath} declares no exports target ${subpath === "." ? "for the active conditions" : `for subpath ${subpath}`}; exports encapsulation permits no file or index lookup. It declares ${exported.declared.join(", ") || "a root target only"}.`,
+        ]);
+    if (exported.status === "blocked")
+        return unresolvedCandidate("external", [
+            `Directory package metadata ${packagePath} blocks subpath ${subpath} with an explicit null exports target.`,
+        ]);
+    return resolveExportTarget(input, packagePath, exported.value);
+};
+/** An exports target is a URL naming one exact file for both Node loaders. */
+const resolveExportTarget = (input, packagePath, target) => {
+    const rejected = rejectDeclaration(target);
+    if (rejected !== null)
+        return rejected;
+    const decoded = decodeModuleUrlPath(stripQueryAndFragment(target));
+    if (typeof decoded !== "string")
+        return decoded;
+    const candidate = confineCandidate(relativeCandidate(packagePath, decoded));
+    if (typeof candidate !== "string")
+        return candidate;
+    return (resolveFileCandidates(input, [candidate]) ??
+        exactExportsTargetNotFound(candidate));
+};
 const barePackageName = (specifier) => {
     const segments = specifier.split("/");
     if (specifier.startsWith("@"))
@@ -141,20 +194,28 @@ const barePackageName = (specifier) => {
             : null;
     return segments[0] === "" ? null : (segments[0] ?? null);
 };
-const hasContainerCandidate = (files, candidate, containerSha256) => [
-    ...fileCandidates(candidate),
-    ...indexCandidates(candidate),
-    posix.join(candidate, "package.json"),
-].some((path) => {
-    const file = files.get(path);
-    return (file !== undefined &&
-        (containerSha256 === undefined ||
-            file.container_sha256 === containerSha256));
-});
+const hasContainerDirectory = (files, candidate, containerSha256) => {
+    if ([...indexCandidates(candidate), posix.join(candidate, "package.json")].some((path) => {
+        const file = files.get(path);
+        return (file !== undefined &&
+            (containerSha256 === undefined ||
+                file.container_sha256 === containerSha256));
+    }))
+        return true;
+    // Inventory has files rather than directory entries. Any same-container
+    // descendant establishes a package directory even without package.json.
+    const prefix = `${candidate}/`;
+    for (const [path, file] of files)
+        if (path.startsWith(prefix) &&
+            (containerSha256 === undefined ||
+                file.container_sha256 === containerSha256))
+            return true;
+    return false;
+};
 const htmlCandidate = (input) => {
     const declared = stripQueryAndFragment(htmlUrlText(input.declaredPath));
     if (looksExternal(declared))
-        return unresolvedOutcome(input, "external", [
+        return unresolvedCandidate("external", [
             "External HTML references are not mapped to local artifact assets.",
         ]);
     const rawBase = input.htmlBaseHref;
@@ -162,151 +223,156 @@ const htmlCandidate = (input) => {
         ? rawBase
         : stripQueryAndFragment(htmlUrlText(rawBase));
     if (base !== undefined && base !== null && looksExternal(base))
-        return unresolvedOutcome(input, "external", [
+        return unresolvedCandidate("external", [
             "The document base href is external, so its script reference is not a local artifact path.",
         ]);
     // Removing URL tabs and newlines can join an encoded dot or separator that
     // the raw declaration split, so admit the parsed URL text again.
     if (!admitsCanonicalPathSyntax(declared))
-        return unresolvedOutcome(input, "rejected", [
+        return unresolvedCandidate("rejected", [
             "Encoded dot or separator bytes are rejected before artifact path resolution.",
         ]);
     const declaredPath = percentDecodeUrlPath(declared);
     if (declaredPath === null)
-        return unresolvedOutcome(input, "rejected", [
+        return unresolvedCandidate("rejected", [
             "The HTML reference path percent-decodes to NUL or to bytes that are not UTF-8.",
         ]);
     if (declaredPath.startsWith("/"))
         return declaredPath.slice(1);
     if (base === undefined || base === null || base === "")
-        return posix.join(posix.dirname(input.sourcePath), declaredPath);
+        return declaredPath === ""
+            ? input.sourcePath
+            : posix.join(posix.dirname(input.sourcePath), declaredPath);
     // A local base href is a second untrusted path input; apply the same
     // admission rules a declared path gets so it cannot smuggle traversal or
     // separator syntax past canonicalization.
     if (!admitsCanonicalPathSyntax(base))
-        return unresolvedOutcome(input, "rejected", [
+        return unresolvedCandidate("rejected", [
             "The document base href uses NUL, backslash, or encoded dot and separator bytes that are not admitted for canonical artifact paths.",
         ]);
     const decodedBase = percentDecodeUrlPath(base);
     if (decodedBase === null)
-        return unresolvedOutcome(input, "rejected", [
+        return unresolvedCandidate("rejected", [
             "The document base href path percent-decodes to NUL or to bytes that are not UTF-8.",
         ]);
     const basePath = decodedBase.startsWith("/")
         ? decodedBase.slice(1)
         : posix.join(posix.dirname(input.sourcePath), decodedBase);
+    if (declaredPath === "")
+        return emptyHtmlReference(decodedBase, basePath);
     return posix.join(htmlBaseDirectory(decodedBase, basePath), declaredPath);
 };
+const emptyHtmlReference = (base, basePath) => {
+    if (!htmlBaseIsDirectory(base))
+        return basePath;
+    const confined = confineCandidate(basePath);
+    if (typeof confined !== "string")
+        return confined;
+    return unresolvedCandidate("not-found", [
+        `The HTML reference resolves to directory ${confined || "."}, not an exact selected application file.`,
+    ]);
+};
 /**
  * The directory a relative HTML reference resolves against. A base path
  * ending in "/" or in a "." or ".." segment is already a directory, because a
  * relative reference resolves against the base URL's directory and those
  * segments are dropped rather than stepped through.
  */
-const htmlBaseDirectory = (base, basePath) => base.endsWith("/") ||
+const htmlBaseIsDirectory = (base) => base.endsWith("/") ||
     base.endsWith("/.") ||
     base.endsWith("/..") ||
     base === "." ||
-    base === ".."
-    ? basePath
-    : posix.dirname(basePath);
-const confineCandidate = (input, candidate) => {
-    const normalized = posix.normalize(candidate);
-    if (normalized === ".." ||
-        normalized.startsWith("../") ||
-        normalized.startsWith("/"))
-        return unresolvedOutcome(input, "rejected", [
+    base === "..";
+const htmlBaseDirectory = (base, basePath) => htmlBaseIsDirectory(base) ? basePath : posix.dirname(basePath);
+const confineCandidate = (candidate) => {
+    const normalized = normalizeJoinedLogicalPath(candidate);
+    if (logicalPathEscapesRoot(normalized))
+        return unresolvedCandidate("rejected", [
             "The resolved candidate escapes the canonical artifact root.",
         ]);
     return normalized === "." ? "" : normalized;
 };
-const resolveCandidate = (input, candidate, packageChain) => {
-    const direct = resolveFileCandidates(input, fileCandidates(candidate));
-    if (direct !== null)
-        return direct;
+const readPackageMetadata = (input, directory) => {
+    const path = posix.join(directory, "package.json");
+    const file = input.files.get(path);
     const source = input.files.get(input.sourcePath);
-    const packagePath = posix.join(candidate, "package.json");
-    const packageFile = input.files.get(packagePath);
-    if (packageFile === undefined ||
-        (source !== undefined &&
-            packageFile.container_sha256 !== source.container_sha256))
-        return (resolveFileCandidates(input, indexCandidates(candidate)) ??
-            notFoundCandidate());
-    if (!packageFile.text.included)
-        return {
-            resolvedPath: null,
-            status: "unavailable",
-            limitations: [
-                `Directory package metadata ${packagePath} was inventoried but its text is unavailable: ${packageFile.text.reason}.`,
-            ],
-        };
-    const main = packageEntry(packageFile.text.value, input.moduleKind, input.context === "module-specifier" &&
-        !input.declaredPath.startsWith(".") &&
-        !input.declaredPath.startsWith("/") &&
-        !hasScheme(input.declaredPath));
-    if (main.status === "invalid")
-        return {
-            resolvedPath: null,
-            status: "unavailable",
-            limitations: [
-                `Directory package metadata ${packagePath} is not valid package JSON.`,
-            ],
-        };
-    if (main.status === "rejected")
-        return {
-            resolvedPath: null,
-            status: "rejected",
-            limitations: [`Package metadata ${packagePath}: ${main.limitation}`],
-        };
-    if (main.status === "unmatched")
+    if (file === undefined ||
+        (source !== undefined && file.container_sha256 !== source.container_sha256))
+        return { kind: "absent" };
+    if (!file.text.included)
         return {
-            resolvedPath: null,
-            status: "external",
-            limitations: [
-                `Directory package metadata ${packagePath} declares no exports target for the active conditions; it declares ${main.declared.join(", ")}.`,
-            ],
+            kind: "unavailable",
+            limitation: `Directory package metadata ${path} was inventoried but its text is unavailable: ${file.text.reason}.`,
         };
-    if (packageChain.has(packagePath)) {
+    let value;
+    try {
+        value = JSON.parse(file.text.value);
+    }
+    catch (cause) {
+        void cause;
         return {
-            resolvedPath: null,
-            status: "unavailable",
-            limitations: [
-                `Directory package entrypoint cycle includes ${packagePath}.`,
-            ],
+            kind: "unavailable",
+            limitation: `Directory package metadata ${path} is not valid package JSON.`,
         };
     }
-    if (main.status === "missing")
-        return (resolveFileCandidates(input, indexCandidates(candidate)) ??
+    return typeof value === "object" && value !== null
+        ? { kind: "available", path, value }
+        : {
+            kind: "unavailable",
+            limitation: `Directory package metadata ${path} is not valid package JSON.`,
+        };
+};
+/** File and directory lookup never interprets a nested directory's exports. */
+const resolveCandidate = (input, candidate, packageChain) => resolveFileCandidates(input, fileCandidates(candidate)) ??
+    resolveDirectory(input, candidate, readPackageMetadata(input, candidate), packageChain);
+const resolveDirectory = (input, directory, metadata, packageChain) => {
+    if (metadata.kind === "absent")
+        return (resolveFileCandidates(input, indexCandidates(directory)) ??
             notFoundCandidate());
+    if (metadata.kind === "unavailable")
+        return unresolvedCandidate("unavailable", [metadata.limitation]);
+    if (packageChain.has(metadata.path))
+        return unresolvedCandidate("unavailable", [
+            `Directory package entrypoint cycle includes ${metadata.path}.`,
+        ]);
+    const preferred = [
+        Reflect.get(metadata.value, "main"),
+        ...(input.moduleKind === undefined
+            ? [Reflect.get(metadata.value, "module")]
+            : []),
+    ];
+    const entry = preferred.find((value) => value !== undefined);
+    if (entry === undefined)
+        return (resolveFileCandidates(input, indexCandidates(directory)) ??
+            notFoundCandidate());
+    if (typeof entry !== "string" || entry.length === 0)
+        return unresolvedCandidate("unavailable", [
+            `Directory package metadata ${metadata.path} is not valid package JSON.`,
+        ]);
     const entryInput = {
-        declaredPath: main.value,
-        sourcePath: packagePath,
+        declaredPath: entry,
+        sourcePath: metadata.path,
         context: "package-entrypoint",
         files: input.files,
+        ...(input.moduleKind === undefined ? {} : { moduleKind: input.moduleKind }),
     };
-    const chain = new Set([...packageChain, packagePath]);
-    if (main.source === "legacy") {
-        const entry = resolvePackagePath(entryInput, chain, "files-and-index");
-        if (entry.resolution_status !== "not-found")
-            return candidateOutcome(entry);
-        const index = resolveFileCandidates(input, indexCandidates(candidate));
-        if (index !== null)
-            return index;
-    }
-    // Preserve recursive artifact package lookup only after legacy file/index fallbacks.
-    return candidateOutcome(resolvePackagePath(entryInput, chain, "full", main.source === "exports"));
+    const rejected = rejectDeclaration(entryInput.declaredPath);
+    if (rejected !== null)
+        return rejected;
+    const candidate = contextualCandidate(entryInput);
+    if (typeof candidate !== "string")
+        return candidate;
+    const confined = confineCandidate(candidate);
+    if (typeof confined !== "string")
+        return confined;
+    const selected = resolveFileCandidates(entryInput, [
+        ...fileCandidates(confined),
+        ...indexCandidates(confined),
+    ]) ?? resolveFileCandidates(input, indexCandidates(directory));
+    if (selected !== null)
+        return selected;
+    return resolveCandidate(entryInput, confined, new Set([...packageChain, metadata.path]));
 };
-const candidateOutcome = (nested) => nested.resolution_status === "resolved"
-    ? {
-        resolvedPath: nested.resolved_path,
-        status: nested.resolution_status,
-        limitations: nested.limitations,
-    }
-    : {
-        resolvedPath: null,
-        status: nested.resolution_status,
-        limitations: nested.limitations,
-    };
 const resolveFileCandidates = (input, candidates) => {
     const source = input.files.get(input.sourcePath);
     for (const path of candidates) {
@@ -323,50 +389,44 @@ const fileCandidates = (candidate) => [
     ...EXTENSIONS.map((extension) => `${candidate}${extension}`),
 ];
 const indexCandidates = (candidate) => EXTENSIONS.map((extension) => posix.join(candidate, `index${extension}`));
-const packageEntry = (text, moduleKind, useExports) => {
-    try {
-        const value = JSON.parse(text);
-        if (typeof value !== "object" || value === null)
-            return { status: "invalid" };
-        const rawExports = Reflect.get(value, "exports");
-        if (useExports && rawExports !== undefined && rawExports !== null) {
-            const exported = packageExport(rawExports, moduleKind);
-            return exported.status === "value"
-                ? { ...exported, source: "exports" }
-                : exported;
+/** Only exact non-directory keys participate; wildcard expansion is unsupported. */
+const selectPackageExport = (value, subpath, moduleKind) => {
+    let target = value;
+    let declared = [];
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        const keys = Object.keys(value);
+        const hasSubpaths = keys.some((key) => key.startsWith("."));
+        if (hasSubpaths && keys.some((key) => !key.startsWith(".")))
+            return {
+                status: "rejected",
+                limitation: "The package exports configuration mixes subpath keys and condition keys.",
+            };
+        declared = keys;
+        if (hasSubpaths) {
+            if (subpath.endsWith("/") ||
+                subpath.includes("*") ||
+                !Object.hasOwn(value, subpath))
+                return { status: "unmatched", declared };
+            target = Reflect.get(value, subpath);
         }
-        // Node imports and requires ignore the bundler-only module field. Keep
-        // that fallback for callers without an explicit module-loading kind.
-        const preferred = [
-            Reflect.get(value, "main"),
-            ...(moduleKind === undefined ? [Reflect.get(value, "module")] : []),
-        ];
-        const entry = preferred.find((candidate) => candidate !== undefined);
-        if (entry === undefined)
-            return { status: "missing" };
-        const legacy = packagePathValue(entry);
-        return legacy.status === "value" ? { ...legacy, source: "legacy" } : legacy;
-    }
-    catch (cause) {
-        // Reflect-based manifest reads fail closed as invalid.
-        void cause;
-        return { status: "invalid" };
+        else if (subpath !== ".")
+            return { status: "unmatched", declared };
     }
-};
-const packageExport = (value, moduleKind) => {
-    const root = typeof value === "object" && value !== null && Object.hasOwn(value, ".")
-        ? Reflect.get(value, ".")
-        : value;
-    const flattened = exportTargets(root, packageExportConditions(moduleKind));
-    if (flattened.kind === "invalid")
-        return { status: "rejected", limitation: flattened.limitation };
-    const first = flattened.kind === "unmatched" ? undefined : flattened.values[0];
-    return first === undefined
-        ? {
+    else if (subpath !== ".")
+        return { status: "unmatched", declared };
+    const selected = selectExportTarget(target, packageExportConditions(moduleKind));
+    if (selected.kind === "invalid" || selected.kind === "invalid-config")
+        return { status: "rejected", limitation: selected.limitation };
+    if (selected.kind === "unmatched")
+        return {
             status: "unmatched",
-            declared: typeof root === "object" && root !== null ? Object.keys(root) : [],
-        }
-        : { status: "value", value: first };
+            declared: typeof target === "object" && target !== null
+                ? Object.keys(target)
+                : declared,
+        };
+    return selected.kind === "blocked"
+        ? { status: "blocked" }
+        : { status: "value", value: selected.value };
 };
 const invalidExportTarget = (value, reason) => ({
     kind: "invalid",
@@ -389,21 +449,24 @@ const forbiddenExportSegment = (value) => value
  * An array skips unmatched and invalid entries, stops at its first string, and
  * preserves the final invalid-versus-null refusal if no string is selected.
  */
-const exportTargets = (value, conditions) => {
+const selectExportTarget = (value, conditions) => {
     if (typeof value === "string") {
         if (!value.startsWith("./"))
             return invalidExportTarget(value, 'must start with "./"');
         const forbidden = forbiddenExportSegment(value);
         return forbidden === undefined
-            ? { kind: "targets", values: [value] }
+            ? { kind: "value", value }
             : invalidExportTarget(value, `contains forbidden path segment ${JSON.stringify(forbidden)} before URL normalization`);
     }
     if (value === null)
-        return { kind: "targets", values: [] };
+        return { kind: "blocked" };
     if (Array.isArray(value)) {
         let invalid = null;
         for (const entry of value) {
-            const nested = exportTargets(entry, conditions);
+            const nested = selectExportTarget(entry, conditions);
+            // Node's array fallback catches invalid targets, not invalid configuration.
+            if (nested.kind === "invalid-config")
+                return nested;
             if (nested.kind === "invalid") {
                 invalid = nested.limitation;
                 continue;
@@ -411,19 +474,27 @@ const exportTargets = (value, conditions) => {
             if (nested.kind === "unmatched")
                 continue;
             invalid = null;
-            if (nested.values.length > 0)
+            if (nested.kind === "value")
                 return nested;
         }
         return invalid === null
-            ? { kind: "targets", values: [] }
+            ? { kind: "blocked" }
             : { kind: "invalid", limitation: invalid };
     }
     if (typeof value !== "object")
         return invalidExportTarget(value, "must be a relative string, object, array, or null");
+    for (const key of Object.keys(value)) {
+        const numeric = Number(key);
+        if (String(numeric) === key && numeric >= 0 && numeric < 0xffff_ffff)
+            return {
+                kind: "invalid-config",
+                limitation: `The package exports configuration contains numeric condition key ${JSON.stringify(key)}.`,
+            };
+    }
     for (const [condition, target] of Object.entries(value)) {
         if (!conditions.has(condition))
             continue;
-        const nested = exportTargets(target, conditions);
+        const nested = selectExportTarget(target, conditions);
         if (nested.kind !== "unmatched")
             return nested;
     }
@@ -433,17 +504,16 @@ const exportTargets = (value, conditions) => {
  * Node selects an exports target by walking the declared keys in order and
  * taking the first whose condition is active for the calling resolver.
  * "default" is always active, and "node" plus "node-addons" are active for the
- * built-in resolver that owns installed-package imports and requires.
+ * built-in resolver that owns installed-package imports and requires. The
+ * supported Node runtimes also activate "module-sync" for both loaders.
  */
 const packageExportConditions = (moduleKind) => new Set([
     "node",
     "node-addons",
+    "module-sync",
     ...(moduleKind === undefined ? [] : [moduleKind]),
     "default",
 ]);
-const packagePathValue = (value) => typeof value === "string" && value.length > 0
-    ? { status: "value", value }
-    : { status: "invalid" };
 const notFoundCandidate = () => ({
     resolvedPath: null,
     status: "not-found",
@@ -473,19 +543,4 @@ const fileUrlPath = (value) => {
         return undefined;
     }
 };
-const outcome = (input, resolution) => resolution.status === "resolved"
-    ? {
-        declared_path: input.declaredPath,
-        resolution_context: input.context,
-        resolved_path: resolution.resolvedPath,
-        resolution_status: resolution.status,
-        limitations: resolution.limitations,
-    }
-    : {
-        declared_path: input.declaredPath,
-        resolution_context: input.context,
-        resolved_path: null,
-        resolution_status: resolution.status,
-        limitations: resolution.limitations,
-    };
-const unresolvedOutcome = (input, status, limitations) => outcome(input, { resolvedPath: null, status, limitations });
+const unresolvedCandidate = (status, limitations) => ({ resolvedPath: null, status, limitations });