ts-node-pack 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Turadg Aleahmad
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,77 @@
+# ts-node-pack
+
+Pack a TypeScript package into a Node-compatible npm tarball — without modifying the source tree, without bundling, and without changing module resolution semantics.
+
+Given a TypeScript package whose sources use `.ts` files and `.ts` in relative import specifiers, `ts-node-pack` produces a `.tgz` whose contents are plain `.js` + `.d.ts` with correct `.js` specifiers, ready to `npm install` into any Node ESM project.
+
+## Why
+
+TypeScript 5.7 introduced [`rewriteRelativeImportExtensions`](https://www.typescriptlang.org/docs/handbook/release-notes/typescript-5-7.html#path-rewriting-for-relative-paths), which lets you author `import './foo.ts'` and have `tsc` emit `import './foo.js'` in the compiled `.js`. But:
+
+- `tsc` does **not** rewrite `.ts` specifiers inside emitted `.d.ts` files.
+- Your `package.json` (`main`, `module`, `exports`, `types`) still points at `.ts`.
+- You probably don't want the `.ts` sources in the published tarball at all.
+
+`ts-node-pack` wraps `tsc` + `npm pack` and fills in exactly those gaps.
+
+## Install
+
+```sh
+npm install --save-dev ts-node-pack
+```
+
+Requires Node ≥ 20 and TypeScript ≥ 5.7 available in the package being packed (resolved via `npx tsc`).
+
+## Usage
+
+```sh
+ts-node-pack <packageDir> [--tsconfig <path>] [--emit-only] [--keep-temp] [--verbose]
+```
+
+| Flag                | Description                                                                                  |
+| ------------------- | -------------------------------------------------------------------------------------------- |
+| `--tsconfig <path>` | tsconfig to extend. Defaults to `tsconfig.build.json` if present, otherwise `tsconfig.json`. |
+| `--emit-only`       | Run emit + rewrites + validation, but skip `npm pack`. Prints the staging directory.         |
+| `--keep-temp`       | Do not delete the temporary staging directory on exit.                                       |
+| `-v`, `--verbose`   | Log each pipeline phase to stderr.                                                           |
+| `-h`, `--help`      | Show help.                                                                                   |
+
+The resulting `<name>-<version>.tgz` is written to the current working directory.
+
+### Example
+
+```sh
+cd my-project
+ts-node-pack ./packages/core --verbose
+npm install ./my-core-1.2.3.tgz
+```
+
+## Pipeline
+
+1. **Resolve package** — read `package.json`, pick tsconfig.
+2. **Stage** — create `mkdtemp()/package/`.
+3. **Derived tsconfig** — write `tsconfig.emit.json` _inside the temp dir_ that `extends` the chosen tsconfig (by absolute path) and forces `outDir`, `declaration`, `rewriteRelativeImportExtensions: true`, `noEmit: false`. If the base tsconfig enables `sourceMap`, `inlineSourceMap`, or `declarationMap`, `inlineSources: true` is also set so debuggers get full source-level fidelity without any `.ts` files in the tarball.
+4. **Emit** — run `tsc -p` against the derived config.
+5. **Rewrite `.d.ts`** — for each emitted `.d.ts`, rewrite `./foo.ts` → `./foo.js` in `import` / `export from` / dynamic `import()` specifiers. Non-relative specifiers are left alone.
+6. **Rewrite `package.json`** — rewrite `.ts` → `.js` (and → `.d.ts` under `types` conditions) in `main`, `module`, `types`, `typings`, `bin`, `exports`, and the `files` array. Strip `devDependencies` and `scripts`.
+7. **Copy assets** — `README*`, `LICENSE*`, `CHANGELOG*`, `NOTICE*`. Source `.ts` files are never copied.
+8. **Validate** — fail if any `.ts` specifier remains in emitted `.js` / `.d.ts` / `package.json`, or if a referenced entry point does not exist.
+9. **Pack** — `npm pack` in the staging directory; move the tarball to the original CWD.
+10. **Cleanup** — remove `.ts-node-pack/` and the temp directory (unless `--keep-temp`).
+
+The source tree is never mutated. All intermediate artifacts (derived tsconfig, staging dir, tarball) live under a single `mkdtemp()` directory that is removed on exit.
+
+### Sourcemaps
+
+If your tsconfig has `sourceMap` (or `inlineSourceMap` / `declarationMap`) enabled, `ts-node-pack` automatically forces `inlineSources: true` so each emitted `.map` embeds its source text via `sourcesContent`. This gives full source-level debugging and "Go to Definition" without shipping `.ts` files — sidestepping dual-resolution hazards where a downstream bundler or TS project might pick `./foo.ts` over `./foo.js`. Detection is a shallow read of the chosen tsconfig; if you inherit `sourceMap` from a base config via `extends`, set it explicitly at the leaf.
+
+## Non-goals
+
+- No bundling.
+- No AST transforms.
+- No custom module resolution.
+- No `npm publish` logic.
+
+## License
+
+MIT

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "ts-node-pack",
+  "version": "0.1.0",
+  "description": "Pack a TypeScript package into a Node-compatible npm tarball without modifying the source tree",
+  "keywords": [
+    "cli",
+    "esm",
+    "npm",
+    "pack",
+    "typescript"
+  ],
+  "license": "MIT",
+  "author": "Turadg Aleahmad <turadg@aleahmad.net>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/turadg/ts-node-pack.git"
+  },
+  "bin": {
+    "ts-node-pack": "./src/cli.js"
+  },
+  "files": [
+    "src"
+  ],
+  "type": "module",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "packageManager": "pnpm@10.33.0",
+  "dependencies": {
+    "npm-packlist": "^10.0.4",
+    "ts-blank-space": "^0.8.0"
+  },
+  "types": "./src/index.d.ts"
+}

package/src/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/src/cli.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+
+import { parseArgs } from "node:util";
+import { resolve } from "node:path";
+import { tsNodePack } from "./index.js";
+
+const { values, positionals } = parseArgs({
+  allowPositionals: true,
+  options: {
+    tsconfig: { type: "string" },
+    "emit-only": { type: "boolean", default: false },
+    "keep-temp": { type: "boolean", default: false },
+    verbose: { type: "boolean", short: "v", default: false },
+    help: { type: "boolean", short: "h", default: false },
+  },
+});
+
+if (values.help || positionals.length === 0) {
+  console.log(`Usage: ts-node-pack <packageDir> [options]
+
+Options:
+  --tsconfig <path>   Path to tsconfig (default: tsconfig.build.json or tsconfig.json)
+  --emit-only         Emit compiled files without packing
+  --keep-temp         Keep temporary staging directory
+  -v, --verbose       Verbose output
+  -h, --help          Show this help message
+`);
+  process.exit(values.help ? 0 : 1);
+}
+
+const packageDir = resolve(positionals[0]);
+
+try {
+  const result = await tsNodePack(packageDir, {
+    tsconfig: values.tsconfig,
+    emitOnly: values["emit-only"],
+    keepTemp: values["keep-temp"],
+    verbose: values.verbose,
+  });
+  console.log(result);
+} catch (err) {
+  console.error(err.message);
+  process.exit(1);
+}

package/src/index.d.ts

@@ -0,0 +1,82 @@
+export interface TsNodePackOptions {
+    tsconfig?: string;
+    emitOnly?: boolean;
+    keepTemp?: boolean;
+    verbose?: boolean;
+}
+/**
+ * Main pipeline: pack a TypeScript package into a Node-compatible tarball.
+ * Returns the path to the .tgz file (or the staging dir if --emit-only).
+ */
+export declare function tsNodePack(packageDir: string, options?: TsNodePackOptions): Promise<string>;
+/**
+ * Rewrite .ts/.tsx extensions to .js in relative import/export specifiers.
+ *
+ * Why regex is sound here:
+ *
+ *   The input is exclusively tsc-generated .d.ts files, not arbitrary source.
+ *   tsc emits a highly constrained subset of syntax in declarations:
+ *
+ *   - Import/export specifiers are always single-line string literals.
+ *   - Specifiers are always wrapped in matching quotes (' or ").
+ *   - Relative paths always start with ./ or ../ (tsc never normalizes these).
+ *   - No template literals, concatenation, or computed specifiers appear.
+ *   - The only keywords introducing module specifiers are `from`, `import`,
+ *     and `import()`.
+ *
+ *   Because the grammar of specifiers in .d.ts output is regular (a finite
+ *   set of keyword prefixes + a quoted string literal), regex matches it
+ *   exactly — no ambiguity, no context-sensitivity, no false positives.
+ *
+ *   If tsc ever adds native .d.ts rewriting (TypeScript#56556), this
+ *   function becomes a no-op: the `if (rewritten !== original)` guard
+ *   in rewriteDtsFiles means no file is touched.
+ *
+ * Handles:
+ *  - Named/default/type imports:  import { x } from './foo.js'
+ *  - Re-exports:                  export { x } from './foo.js'
+ *  - Star re-exports:             export * from './foo.js'
+ *  - Side-effect imports:         import './foo.js'
+ *  - Dynamic imports:             import('./foo.js')
+ *  - .tsx extensions:             import './component.js'
+ *
+ * Does NOT rewrite (by design):
+ *  - Non-relative specifiers:     import 'lodash'
+ *  - Already-.js specifiers:      import './foo.js'
+ *  - import.meta.url:             not a module specifier
+ *  - require():                   not valid in ESM .d.ts
+ *  - Bare string literals:        const x = './foo.ts'
+ */
+export declare const TS_SPECIFIER_PATTERNS: RegExp[];
+export declare function rewriteTsSpecifiers(content: any): any;
+/**
+ * Resolve `workspace:` protocol specifiers in the package's dependency
+ * fields to concrete versions, matching yarn-berry and pnpm behavior.
+ *
+ * Translation rules:
+ *   workspace:*       → <version>
+ *   workspace:^       → ^<version>
+ *   workspace:~       → ~<version>
+ *   workspace:<range> → <range>
+ *
+ * Walks upward from packageDir to find the workspace root (the first
+ * ancestor whose package.json has a `workspaces` field), expands its
+ * workspace globs to locate sibling packages, and builds a
+ * `name → version` map.
+ *
+ * Throws if the package has `workspace:` specifiers but no workspace
+ * root can be found, or if a referenced sibling package is unknown.
+ * These failure modes indicate a broken workspace, not a ts-node-pack
+ * bug — surface them loudly rather than shipping an unpublishable
+ * tarball.
+ */
+export declare function resolveWorkspaceDependencies(pkg: any, packageDir: any, log: any): Promise<any>;
+/**
+ * Translate a single `workspace:` specifier into the published form.
+ *  workspace:*       → <version>
+ *  workspace:^       → ^<version>
+ *  workspace:~       → ~<version>
+ *  workspace:<range> → <range>
+ */
+export declare function resolveWorkspaceSpec(spec: any, version: any): any;
+export declare function rewritePackageJson(pkg: any): any;

package/src/index.js

@@ -0,0 +1,771 @@
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import {
+  copyFile,
+  mkdir,
+  mkdtemp,
+  readdir,
+  readFile,
+  rm,
+  unlink,
+  writeFile,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, relative, resolve } from "node:path";
+import { promisify } from "node:util";
+import packlist from "npm-packlist";
+import tsBlankSpace from "ts-blank-space";
+
+const execFileAsync = promisify(execFile);
+
+                                    
+                    
+                     
+                     
+                    
+ 
+
+/**
+ * Main pipeline: pack a TypeScript package into a Node-compatible tarball.
+ * Returns the path to the .tgz file (or the staging dir if --emit-only).
+ */
+export async function tsNodePack(
+  packageDir        ,
+  options                    = {},
+)                  {
+  const { tsconfig, emitOnly, keepTemp, verbose } = options;
+  const log = verbose ? (...args           ) => console.error("[ts-node-pack]", ...args) : () => {};
+
+  packageDir = resolve(packageDir);
+
+  // ── Phase 1: Resolve package ──────────────────────────────────────────
+  log("Phase 1: Resolving package...");
+  const pkgJsonPath = join(packageDir, "package.json");
+  const pkgJson = JSON.parse(await readFile(pkgJsonPath, "utf8"));
+  log(`Package: ${pkgJson.name}@${pkgJson.version}`);
+
+  const tsconfigPath = resolveTsconfig(packageDir, tsconfig);
+  log(`Using tsconfig: ${tsconfigPath}`);
+
+  // ── Phase 2: Create staging directory ─────────────────────────────────
+  log("Phase 2: Creating staging directory...");
+  const tmpDir = await mkdtemp(join(tmpdir(), "ts-node-pack-"));
+  const stagingDir = join(tmpDir, "package");
+  await mkdir(stagingDir, { recursive: true });
+  log(`Staging: ${stagingDir}`);
+
+  try {
+    // ── Phase 3: Generate derived tsconfig ────────────────────────────────
+    // Written inside the temp dir — never touches the source tree.
+    // `extends` takes an absolute path; paths defined by the base tsconfig
+    // (include/files/exclude/rootDir/paths) resolve relative to the base
+    // config's own location, which is still inside packageDir, so globs
+    // continue to work.
+    log("Phase 3: Generating derived tsconfig...");
+    const emitConfigPath = join(tmpDir, "tsconfig.emit.json");
+
+    // Because the emit config lives outside packageDir, tsc's typeRoots
+    // walk-up (which starts at the config's directory) can't reach
+    // packageDir/node_modules/@types. Pin typeRoots explicitly when that
+    // directory exists so entries named in the base config's `types`
+    // field — e.g. `types: ["node"]` — can be resolved. TS 6.0 made this
+    // explicit opt-in (no more auto-inclusion of every @types package),
+    // which surfaces the missing resolution as a clear TS2688 error
+    // rather than silent "Cannot find module 'node:util'".
+    const atTypesDir = join(packageDir, "node_modules", "@types");
+    const hasAtTypes = existsSync(atTypesDir);
+
+    const emitConfig = {
+      extends: tsconfigPath,
+      compilerOptions: {
+        // Force rootDir so emit preserves the source layout — otherwise
+        // tsc infers the common ancestor and strips the `src/` prefix,
+        // breaking `main`/`exports` that reference `./src/...`.
+        rootDir: packageDir,
+        outDir: stagingDir,
+        declaration: true,
+        // ts-blank-space handles .js emit (Phase 6); tsc only emits .d.ts.
+        emitDeclarationOnly: true,
+        // Extract types from JS+JSDoc sources in mixed packages.
+        allowJs: true,
+        noEmit: false,
+        // Incremental/composite would try to write a .tsbuildinfo whose
+        // path tsc computes relative to the base config, producing
+        // garbled paths when our outDir crosses directory trees.
+        incremental: false,
+        composite: false,
+        tsBuildInfoFile: null,
+        ...(hasAtTypes ? { typeRoots: [atTypesDir] } : {}),
+      },
+    };
+    await writeFile(emitConfigPath, JSON.stringify(emitConfig, null, 2) + "\n");
+
+    // ── Phase 4: Copy the npm-packlist into staging ──────────────────────
+    // `npm-packlist` is the same file-enumeration engine `npm pack` uses
+    // internally. It applies `files`, `.npmignore`, the npm default
+    // includes (package.json, README*, LICENSE*) and default excludes
+    // (.git, node_modules, ...) — so the staging directory ends up as a
+    // faithful mirror of whatever `npm pack` would have produced from
+    // the source tree, minus our downstream transforms (ts-blank-space,
+    // declaration emit, specifier rewrite).
+    log("Phase 4: Enumerating package files via npm-packlist...");
+    // npm-packlist's tree-based API (v7+) expects a node with `path` +
+    // parsed `package.json`. We fabricate a minimal tree rather than
+    // pulling in @npmcli/arborist — we don't need bundled-dependency
+    // resolution, workspace walking, or the rest of arborist's
+    // machinery, just the pack-file list.
+    //
+    // `isProjectRoot: true` sends npm-packlist down the
+    // "root package" branch of `gatherBundles`, which looks only at
+    // bundleDependencies (missing here, so no-op). Without this, it
+    // takes the "bundled dep of some other project" branch and tries
+    // to walk `edgesOut` — which doesn't exist on our hand-built tree.
+    const packFiles = await packlist({
+      path: packageDir,
+      package: pkgJson,
+      isProjectRoot: true,
+    });
+    // Pre-create every parent directory serially (mkdir on the same
+    // path from multiple concurrent calls can race), then copy files
+    // in parallel.
+    const dirs = new Set        (
+      packFiles.map((rel) => dirname(join(stagingDir, rel))),
+    );
+    for (const d of dirs) await mkdir(d, { recursive: true });
+    await Promise.all(
+      packFiles.map((rel) =>
+        copyFile(join(packageDir, rel), join(stagingDir, rel)),
+      ),
+    );
+    log(`Copied ${packFiles.length} file(s) into staging`);
+
+    // ── Phase 5: Emit declarations via tsc ──────────────────────────────
+    // tsc reads sources from packageDir (the base config's include
+    // resolves there) and writes .d.ts files into stagingDir via outDir.
+    // The copies from Phase 4 are left alone — tsc's outputs land
+    // alongside them. tsc may emit declarations for files outside the
+    // `files` array (e.g. test/); those won't make it into the final
+    // tarball because npm pack only ships what `files` references.
+    log("Phase 5: Emitting .d.ts files via tsc...");
+    await runTsc(emitConfigPath, packageDir, log);
+
+    // ── Phase 6: Strip types and rewrite specifiers ─────────────────────
+    // Single-pass transform of every staging file that could contain a
+    // relative module specifier: .ts/.mts get ts-blank-space'd then
+    // specifier-rewritten (one read, one write, original unlinked);
+    // .js/.mjs/.d.ts/.d.mts just get specifier-rewritten in place.
+    // ts-blank-space preserves line and column positions, so no
+    // sourcemaps are needed for debugging.
+    log("Phase 6: Stripping types and rewriting specifiers...");
+    const { strippedCount, rewrittenCount } = await processStagingFiles(
+      stagingDir,
+      log,
+    );
+    log(
+      `Stripped ${strippedCount} type-annotated file(s); rewrote ${rewrittenCount} other file(s)`,
+    );
+
+    // ── Phase 7: Rewrite package.json ───────────────────────────────────
+    // README, LICENSE, and any other npm-always-included files already
+    // landed in staging via Phase 4. We overwrite the copy of
+    // package.json with a rewritten one: first resolve any
+    // `workspace:*` protocol specifiers (required for monorepo
+    // packages to publish), then flip entry paths and strip dev-only
+    // fields.
+    log("Phase 7: Rewriting package.json...");
+    const resolvedPkg = await resolveWorkspaceDependencies(
+      pkgJson,
+      packageDir,
+      log,
+    );
+    const rewrittenPkg = rewritePackageJson(resolvedPkg);
+    await writeFile(
+      join(stagingDir, "package.json"),
+      JSON.stringify(rewrittenPkg, null, 2) + "\n",
+    );
+
+    // ── Phase 8: Validate ─────────────────────────────────────────────────
+    log("Phase 8: Validating...");
+    await validate(stagingDir, rewrittenPkg, log);
+
+    // ── Phase 9: Pack ─────────────────────────────────────────────────────
+    if (!emitOnly) {
+      log("Phase 9: Packing...");
+      const tgzPath = await pack(stagingDir, log);
+      const tgzName = basename(tgzPath);
+      const dest = join(process.cwd(), tgzName);
+      await copyFile(tgzPath, dest);
+      log(`Created: ${dest}`);
+      return dest;
+    }
+
+    log(`Emit-only mode. Staging directory: ${stagingDir}`);
+    return stagingDir;
+  } finally {
+    // ── Phase 10: Cleanup ───────────────────────────────────────────────
+    if (!emitOnly && !keepTemp) {
+      log("Phase 10: Cleaning up temp directory...");
+      await rm(tmpDir, { recursive: true, force: true });
+    } else if (keepTemp) {
+      log(`Keeping temp directory: ${tmpDir}`);
+    }
+  }
+}
+
+// ── Phase helpers ──────────────────────────────────────────────────────────
+
+function resolveTsconfig(packageDir, tsconfigOption) {
+  if (tsconfigOption) {
+    const p = resolve(packageDir, tsconfigOption);
+    if (!existsSync(p)) {
+      throw new Error(`tsconfig not found: ${p}`);
+    }
+    return p;
+  }
+
+  const buildConfig = join(packageDir, "tsconfig.build.json");
+  if (existsSync(buildConfig)) return buildConfig;
+
+  const defaultConfig = join(packageDir, "tsconfig.json");
+  if (existsSync(defaultConfig)) return defaultConfig;
+
+  throw new Error(`No tsconfig found in ${packageDir}. Provide one with --tsconfig.`);
+}
+
+/**
+ * Walk upward from `startDir`, returning the first `node_modules/.bin/<name>`
+ * that exists. Mirrors how npm composes `$PATH` for scripts in a workspace.
+ * Returns null when nothing is found before the filesystem root.
+ */
+function findLocalBin(startDir, name) {
+  let dir = startDir;
+  while (true) {
+    const candidate = join(dir, "node_modules", ".bin", name);
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+async function runTsc(emitConfigPath, cwd, log) {
+  // Prefer a local tsc so users control the compiler version (and to avoid
+  // npx resolving to macOS's /usr/bin/tsc — the TeX/Smalltalk compiler —
+  // when no local install exists). In a monorepo, the package's own
+  // node_modules/.bin may be empty while the workspace root has the
+  // binary, so walk upward the same way npm's `$PATH` composition does.
+  const binName = process.platform === "win32" ? "tsc.cmd" : "tsc";
+  const localTsc = findLocalBin(cwd, binName);
+  const useLocal = localTsc !== null;
+  const [cmd, argv] = useLocal
+    ? [localTsc, ["-p", emitConfigPath]]
+    : ["npx", ["--yes", "tsc", "-p", emitConfigPath]];
+  log(useLocal ? `Using local tsc: ${localTsc}` : "Using npx tsc (no local install found)");
+  try {
+    const { stdout, stderr } = await execFileAsync(cmd, argv, {
+      cwd,
+      maxBuffer: 10 * 1024 * 1024,
+    });
+    if (stdout.trim()) log(stdout.trim());
+    if (stderr.trim()) log(stderr.trim());
+  } catch (err) {
+    const output = [err.stdout, err.stderr].filter(Boolean).join("\n").trim();
+    if (output) console.error(output);
+    throw new Error("TypeScript compilation failed");
+  }
+}
+
+/**
+ * Walk stagingDir for every file that might contain a relative module
+ * specifier — .ts/.mts (strip types then rewrite), and .js/.mjs/.d.ts/
+ * .d.mts (rewrite specifiers only). Each file is read once and, if
+ * changed, written once. Sourcemap files (.d.ts.map, .d.mts.map) are
+ * skipped because they're binary-encoded JSON with no specifiers.
+ *
+ * Throws if ts-blank-space rejects a .ts/.mts file (non-erasable
+ * syntax like `enum`, `namespace`, or parameter properties).
+ */
+async function processStagingFiles(stagingDir, log) {
+  const files = await findFiles(
+    stagingDir,
+    (name) =>
+      (name.endsWith(".ts") && !name.endsWith(".d.ts")) ||
+      (name.endsWith(".mts") && !name.endsWith(".d.mts")) ||
+      name.endsWith(".js") ||
+      name.endsWith(".mjs") ||
+      (name.endsWith(".d.ts") && !name.endsWith(".d.ts.map")) ||
+      (name.endsWith(".d.mts") && !name.endsWith(".d.mts.map")),
+  );
+  let strippedCount = 0;
+  let rewrittenCount = 0;
+  for (const srcPath of files) {
+    const rel = relative(stagingDir, srcPath);
+    const isTs = srcPath.endsWith(".ts") && !srcPath.endsWith(".d.ts");
+    const isMts = srcPath.endsWith(".mts") && !srcPath.endsWith(".d.mts");
+    const source = await readFile(srcPath, "utf8");
+
+    let content = source;
+    if (isTs || isMts) {
+      const errors           = [];
+      content = tsBlankSpace(source, (node) => {
+        errors.push(
+          `${rel}: unsupported non-erasable syntax: ${String(node.getText?.() ?? node).slice(0, 80)}`,
+        );
+      });
+      if (errors.length > 0) {
+        throw new Error(
+          "ts-blank-space rejected non-erasable TypeScript:\n  " +
+            errors.join("\n  "),
+        );
+      }
+    }
+    content = rewriteTsSpecifiers(content);
+
+    if (isTs || isMts) {
+      const destPath = srcPath.replace(
+        isMts ? /\.mts$/ : /\.ts$/,
+        isMts ? ".mjs" : ".js",
+      );
+      await writeFile(destPath, content);
+      await unlink(srcPath);
+      strippedCount++;
+      log(`  Stripped: ${rel} → ${basename(destPath)}`);
+    } else if (content !== source) {
+      await writeFile(srcPath, content);
+      rewrittenCount++;
+      log(`  Rewrote: ${rel}`);
+    }
+  }
+  return { strippedCount, rewrittenCount };
+}
+
+/**
+ * Rewrite .ts/.tsx extensions to .js in relative import/export specifiers.
+ *
+ * Why regex is sound here:
+ *
+ *   The input is exclusively tsc-generated .d.ts files, not arbitrary source.
+ *   tsc emits a highly constrained subset of syntax in declarations:
+ *
+ *   - Import/export specifiers are always single-line string literals.
+ *   - Specifiers are always wrapped in matching quotes (' or ").
+ *   - Relative paths always start with ./ or ../ (tsc never normalizes these).
+ *   - No template literals, concatenation, or computed specifiers appear.
+ *   - The only keywords introducing module specifiers are `from`, `import`,
+ *     and `import()`.
+ *
+ *   Because the grammar of specifiers in .d.ts output is regular (a finite
+ *   set of keyword prefixes + a quoted string literal), regex matches it
+ *   exactly — no ambiguity, no context-sensitivity, no false positives.
+ *
+ *   If tsc ever adds native .d.ts rewriting (TypeScript#56556), this
+ *   function becomes a no-op: the `if (rewritten !== original)` guard
+ *   in rewriteDtsFiles means no file is touched.
+ *
+ * Handles:
+ *  - Named/default/type imports:  import { x } from './foo.js'
+ *  - Re-exports:                  export { x } from './foo.js'
+ *  - Star re-exports:             export * from './foo.js'
+ *  - Side-effect imports:         import './foo.js'
+ *  - Dynamic imports:             import('./foo.js')
+ *  - .tsx extensions:             import './component.js'
+ *
+ * Does NOT rewrite (by design):
+ *  - Non-relative specifiers:     import 'lodash'
+ *  - Already-.js specifiers:      import './foo.js'
+ *  - import.meta.url:             not a module specifier
+ *  - require():                   not valid in ESM .d.ts
+ *  - Bare string literals:        const x = './foo.ts'
+ */
+// Three shapes for a relative TypeScript specifier in a string literal:
+//   1. `from './foo.js'`         — named/default/type imports, re-exports
+//   2. `import './foo.js'`       — bare side-effect imports
+//   3. `import('./foo.js')`      — dynamic imports
+//
+// The extension capture group matches `ts`, `tsx`, or `mts`. Rewriting
+// turns `.ts`/`.tsx` into `.js` and `.mts` into `.mjs`, matching the
+// output extensions ts-blank-space produces in Phase 6.
+//
+// Used both to rewrite specifiers and (in the validator) to detect any
+// specifier that slipped through. Must stay in sync with each other.
+export const TS_SPECIFIER_PATTERNS = [
+  /(from\s*['"])(\.\.?\/[^'"]*?)\.(tsx?|mts)(['"])/g,
+  /(import\s+['"])(\.\.?\/[^'"]*?)\.(tsx?|mts)(['"])/g,
+  /(import\s*\(\s*['"])(\.\.?\/[^'"]*?)\.(tsx?|mts)(['"]\s*\))/g,
+];
+
+export function rewriteTsSpecifiers(content) {
+  for (const pattern of TS_SPECIFIER_PATTERNS) {
+    content = content.replace(pattern, (_m, pre, path, ext, post) =>
+      pre + path + (ext === "mts" ? ".mjs" : ".js") + post,
+    );
+  }
+  return content;
+}
+
+const DEP_FIELDS_WITH_WORKSPACE = [
+  "dependencies",
+  "peerDependencies",
+  "optionalDependencies",
+  "devDependencies",
+];
+
+/**
+ * Resolve `workspace:` protocol specifiers in the package's dependency
+ * fields to concrete versions, matching yarn-berry and pnpm behavior.
+ *
+ * Translation rules:
+ *   workspace:*       → <version>
+ *   workspace:^       → ^<version>
+ *   workspace:~       → ~<version>
+ *   workspace:<range> → <range>
+ *
+ * Walks upward from packageDir to find the workspace root (the first
+ * ancestor whose package.json has a `workspaces` field), expands its
+ * workspace globs to locate sibling packages, and builds a
+ * `name → version` map.
+ *
+ * Throws if the package has `workspace:` specifiers but no workspace
+ * root can be found, or if a referenced sibling package is unknown.
+ * These failure modes indicate a broken workspace, not a ts-node-pack
+ * bug — surface them loudly rather than shipping an unpublishable
+ * tarball.
+ */
+export async function resolveWorkspaceDependencies(pkg, packageDir, log) {
+  if (!hasWorkspaceDeps(pkg)) return pkg;
+
+  const workspaceRoot = await findWorkspaceRoot(packageDir);
+  if (!workspaceRoot) {
+    throw new Error(
+      `${pkg.name || "package"}: found 'workspace:' dependencies but no workspace root ancestor has a 'workspaces' field`,
+    );
+  }
+  log(`Resolving workspace: deps against workspace root ${workspaceRoot}`);
+
+  const versionMap = await buildWorkspaceVersionMap(workspaceRoot);
+
+  const result = { ...pkg };
+  for (const field of DEP_FIELDS_WITH_WORKSPACE) {
+    const deps = result[field];
+    if (!deps || typeof deps !== "object") continue;
+    const updated = { ...deps };
+    for (const [name, spec] of Object.entries(updated)) {
+      if (typeof spec !== "string" || !spec.startsWith("workspace:")) continue;
+      const version = versionMap.get(name);
+      if (!version) {
+        throw new Error(
+          `${pkg.name || "package"}: ${field}["${name}"] = "${spec}" but no workspace package named "${name}" was found under ${workspaceRoot}`,
+        );
+      }
+      const resolved = resolveWorkspaceSpec(spec, version);
+      updated[name] = resolved;
+      log(`  ${field}["${name}"]: ${spec} → ${resolved}`);
+    }
+    result[field] = updated;
+  }
+  return result;
+}
+
+function hasWorkspaceDeps(pkg) {
+  for (const field of DEP_FIELDS_WITH_WORKSPACE) {
+    const deps = pkg[field];
+    if (!deps || typeof deps !== "object") continue;
+    for (const spec of Object.values(deps)) {
+      if (typeof spec === "string" && spec.startsWith("workspace:")) return true;
+    }
+  }
+  return false;
+}
+
+async function findWorkspaceRoot(startDir) {
+  let dir = startDir;
+  while (true) {
+    try {
+      const pkg = JSON.parse(
+        await readFile(join(dir, "package.json"), "utf8"),
+      );
+      if (pkg.workspaces) return dir;
+    } catch {
+      // Missing or unreadable package.json — not the root, keep going.
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+async function buildWorkspaceVersionMap(workspaceRoot) {
+  const rootPkg = JSON.parse(
+    await readFile(join(workspaceRoot, "package.json"), "utf8"),
+  );
+  const patterns           = Array.isArray(rootPkg.workspaces)
+    ? rootPkg.workspaces
+    : rootPkg.workspaces?.packages || [];
+
+  const map = new Map                ();
+  for (const pattern of patterns) {
+    const dirs = await expandWorkspacePattern(workspaceRoot, pattern);
+    for (const d of dirs) {
+      try {
+        const pkg = JSON.parse(
+          await readFile(join(d, "package.json"), "utf8"),
+        );
+        if (pkg.name && pkg.version) map.set(pkg.name, pkg.version);
+      } catch {
+        // Missing or malformed sibling package.json — skip.
+      }
+    }
+  }
+  return map;
+}
+
+/**
+ * Expand a workspace pattern (e.g. "packages/*", "apps/*", "solo") into
+ * concrete directory paths. Supports `*` as a single-segment wildcard.
+ * `**` is not supported — no real-world agoric-sdk-style workspace uses
+ * it, and implementing recursive globs without a library is more code
+ * than it's worth for the common case.
+ */
+async function expandWorkspacePattern(workspaceRoot, pattern) {
+  if (pattern.includes("**")) {
+    throw new Error(`Unsupported workspace pattern: "${pattern}" (globstar ** is not supported)`);
+  }
+  const parts = pattern.split("/").filter((p) => p.length > 0);
+  let currentDirs = [workspaceRoot];
+  for (const part of parts) {
+    const next           = [];
+    for (const base of currentDirs) {
+      if (part === "*") {
+        try {
+          const entries = await readdir(base, { withFileTypes: true });
+          for (const e of entries) {
+            if (e.isDirectory()) next.push(join(base, e.name));
+          }
+        } catch {
+          // base doesn't exist — skip.
+        }
+      } else if (part.includes("*")) {
+        const regex = new RegExp(
+          "^" +
+            part.replace(/[.+^$()|[\]\\]/g, "\\$&").replace(/\*/g, ".*") +
+            "$",
+        );
+        try {
+          const entries = await readdir(base, { withFileTypes: true });
+          for (const e of entries) {
+            if (e.isDirectory() && regex.test(e.name)) next.push(join(base, e.name));
+          }
+        } catch {
+          // base doesn't exist — skip.
+        }
+      } else {
+        next.push(join(base, part));
+      }
+    }
+    currentDirs = next;
+  }
+  return currentDirs;
+}
+
+/**
+ * Translate a single `workspace:` specifier into the published form.
+ *  workspace:*       → <version>
+ *  workspace:^       → ^<version>
+ *  workspace:~       → ~<version>
+ *  workspace:<range> → <range>
+ */
+export function resolveWorkspaceSpec(spec, version) {
+  if (typeof spec !== "string" || !spec.startsWith("workspace:")) return spec;
+  const rest = spec.slice("workspace:".length);
+  if (rest === "" || rest === "*") return version;
+  if (rest === "^") return `^${version}`;
+  if (rest === "~") return `~${version}`;
+  return rest;
+}
+
+export function rewritePackageJson(pkg) {
+  const result = { ...pkg };
+
+  // Remove development-only fields that aren't needed in the published package
+  delete result.devDependencies;
+  delete result.scripts;
+
+  // Rewrite entry points
+  if (result.main) result.main = rewriteTsToJs(result.main);
+  if (result.module) result.module = rewriteTsToJs(result.module);
+
+  // Rewrite or derive types
+  if (result.types) {
+    result.types = rewriteTsToDts(result.types);
+  } else if (result.typings) {
+    result.typings = rewriteTsToDts(result.typings);
+  } else if (result.main) {
+    result.types = result.main.replace(/\.js$/, ".d.ts");
+  }
+
+  // Rewrite bin
+  if (result.bin) {
+    if (typeof result.bin === "string") {
+      result.bin = rewriteTsToJs(result.bin);
+    } else if (typeof result.bin === "object") {
+      for (const [key, value] of Object.entries(result.bin)) {
+        result.bin[key] = rewriteTsToJs(value);
+      }
+    }
+  }
+
+  // Rewrite exports
+  if (result.exports) {
+    result.exports = rewriteExportsValue(result.exports, false);
+  }
+
+  // Rewrite files array
+  if (Array.isArray(result.files)) {
+    result.files = result.files.flatMap((f) => {
+      if (typeof f === "string" && /\.tsx?$/.test(f)) {
+        return [rewriteTsToJs(f), rewriteTsToDts(f)];
+      }
+      return [f];
+    });
+  }
+
+  return result;
+}
+
+function rewriteTsToJs(p) {
+  return typeof p === "string" ? p.replace(/\.tsx?$/, ".js") : p;
+}
+
+function rewriteTsToDts(p) {
+  return typeof p === "string" ? p.replace(/\.tsx?$/, ".d.ts") : p;
+}
+
+function rewriteExportsValue(value, isTypesKey) {
+  if (typeof value === "string") {
+    return isTypesKey ? rewriteTsToDts(value) : rewriteTsToJs(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => rewriteExportsValue(v, isTypesKey));
+  }
+  if (typeof value === "object" && value !== null) {
+    const result = {};
+    for (const [key, val] of Object.entries(value)) {
+      result[key] = rewriteExportsValue(val, key === "types");
+    }
+    return result;
+  }
+  return value;
+}
+
+async function validate(stagingDir, pkg, log) {
+  const errors = [];
+
+  // Check .js and .d.ts files for remaining .ts specifiers
+  const allFiles = await findFiles(
+    stagingDir,
+    (name) => name.endsWith(".js") || name.endsWith(".d.ts"),
+  );
+
+  for (const filePath of allFiles) {
+    const raw = await readFile(filePath, "utf8");
+    // Strip block and line comments before scanning so JSDoc examples that
+    // literally contain strings like `import './foo.js'` don't register as
+    // false positives. Comment stripping here is intentionally coarse
+    // (doesn't understand strings-containing-comment-markers) — good enough
+    // for tsc-emitted output, where comments are well-behaved.
+    const content = raw
+      .replace(/\/\*[\s\S]*?\*\//g, "")
+      .replace(/(^|[^:])\/\/.*$/gm, "$1");
+    const relPath = relative(stagingDir, filePath);
+
+    for (const pattern of TS_SPECIFIER_PATTERNS) {
+      for (const m of content.matchAll(pattern)) {
+        errors.push(`${relPath}: remaining .ts specifier: ${m[0]}`);
+      }
+    }
+  }
+
+  // Check package.json for .ts references in entry points
+  const entryFields = ["main", "module", "types", "typings"];
+  for (const field of entryFields) {
+    if (typeof pkg[field] === "string" && /(?<!\.d)\.tsx?$/.test(pkg[field])) {
+      errors.push(`package.json "${field}" still references .ts: ${pkg[field]}`);
+    }
+  }
+
+  // Non-fatal: yarn/npm tolerate `bin`/`main` pointing at missing
+  // files. Real transformation bugs are caught by the specifier
+  // checks above.
+  const referencedFiles = collectReferencedFiles(pkg);
+  for (const ref of referencedFiles) {
+    if (!existsSync(join(stagingDir, ref))) {
+      log(`  Warning: referenced file missing from tarball: ${ref}`);
+    }
+  }
+
+  if (errors.length > 0) {
+    const msg = "Validation failed:\n  " + errors.join("\n  ");
+    throw new Error(msg);
+  }
+
+  log(`Validated ${allFiles.length} file(s), no issues found`);
+}
+
+function collectReferencedFiles(pkg) {
+  const refs = new Set        ();
+
+  for (const field of ["main", "module", "types", "typings"]) {
+    if (typeof pkg[field] === "string") {
+      refs.add(pkg[field].replace(/^\.\//, ""));
+    }
+  }
+
+  if (typeof pkg.bin === "string") {
+    refs.add(pkg.bin.replace(/^\.\//, ""));
+  } else if (typeof pkg.bin === "object" && pkg.bin !== null) {
+    for (const v of Object.values(pkg.bin)) {
+      if (typeof v === "string") refs.add(v.replace(/^\.\//, ""));
+    }
+  }
+
+  if (pkg.exports) {
+    collectExportsRefs(pkg.exports, refs);
+  }
+
+  return refs;
+}
+
+function collectExportsRefs(value, refs) {
+  if (typeof value === "string") {
+    refs.add(value.replace(/^\.\//, ""));
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const v of value) collectExportsRefs(v, refs);
+    return;
+  }
+  if (typeof value === "object" && value !== null) {
+    for (const v of Object.values(value)) {
+      collectExportsRefs(v, refs);
+    }
+  }
+}
+
+async function pack(stagingDir, log) {
+  const { stdout } = await execFileAsync("npm", ["pack"], {
+    cwd: stagingDir,
+  });
+  const tgzName = stdout.trim().split("\n").pop();
+  return join(stagingDir, tgzName);
+}
+
+async function findFiles(dir, test) {
+  const results = [];
+  const entries = await readdir(dir, { withFileTypes: true, recursive: true });
+  for (const entry of entries) {
+    if (entry.isFile() && test(entry.name)) {
+      results.push(join(entry.parentPath, entry.name));
+    }
+  }
+  return results;
+}