alpha nerd
659ef5a62b
All checks were successful
NYX Security Scan / nyx-scan (pull_request) Successful in 5m53s
The published package could not be used at all. `require('nomyo-js')`
succeeded, but constructing a client threw:
Cannot find module './node'
Platform selection was done with a runtime require:
const NodeSecureMemory = require('./node').NodeSecureMemory;
Rollup flattens every module into one file, so './node' and './browser'
no longer exist at runtime — and because the calls sit inside function
bodies, rollup left them as literal runtime requires rather than
resolving them. The failure was therefore deferred to first use: module
load and Object.keys() both looked fine, so nothing noticed. The
SecureCompletionClient constructor calls createSecureMemory() and
createHttpClient(), which made every client unconstructable.
Confirmed present at 057ff6c, this branch's merge base, so the npm
package has never worked.
Platform implementations are now injected by the entry points, which is
what src/node.ts and src/browser.ts always claimed to do (they merely
re-exported ./index). createSecureMemory/createHttpClient consult a
registered factory and throw a directive error if none was registered.
No require fallback is kept: leaving one would put an unresolvable
relative require back in the bundle, and bundlers resolve requires
statically, so webpack/vite would fail on a path that does not exist in
dist/. Jest registers the platform via tests/setup.ts instead.
This also keeps the Node HTTP client and the optional native addon out
of the browser bundle, which previously carried both.
Second defect found while verifying: dist/esm/index.mjs contained 13
require() calls (crypto, fs, path, jose, nomyo-native) that the source
loads lazily. `require` does not exist in ES module scope, so an ESM
consumer crashed with "require is not defined" as soon as one ran —
using keyDir for key persistence would have hit it on every Node
version. Node 24 masked the crypto case by having a global crypto. The
ESM output now carries a createRequire shim.
tests/integration/bundle.test.ts covers the artefact that actually
ships: both bundles construct a client, expose the API, resolve the
platform layer, keep Node-only modules out of the browser build, and the
ESM entry is imported and used by a real spawned Node process. Every
other suite runs against src/ through ts-jest, where these paths resolve
normally — which is precisely why this went unnoticed.
Verified end to end by installing the packed tarball into a clean
project: CommonJS and ESM both construct a client and run fs-backed key
generation on Node 18.19.1 and 24.18.0.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
61 lines
2 KiB
JavaScript
61 lines
2 KiB
JavaScript
import typescript from '@rollup/plugin-typescript';
|
|
import resolve from '@rollup/plugin-node-resolve';
|
|
import commonjs from '@rollup/plugin-commonjs';
|
|
|
|
const target = process.env.TARGET || 'node';
|
|
|
|
const config = {
|
|
input: target === 'browser' ? 'src/browser.ts' : 'src/node.ts',
|
|
plugins: [
|
|
resolve(),
|
|
commonjs(),
|
|
typescript({
|
|
tsconfig: './tsconfig.json',
|
|
declaration: false,
|
|
declarationDir: undefined
|
|
})
|
|
]
|
|
};
|
|
|
|
// Extensions are explicit rather than bare `.js`: the package is not
|
|
// "type": "module", so Node treats a .js file as CommonJS. An ES-format bundle
|
|
// named .js therefore fails to import on Node < 22, and only works above that
|
|
// because Node re-parses it after guessing — at a cost on every import.
|
|
if (target === 'node') {
|
|
config.output = [
|
|
{
|
|
file: 'dist/node/index.js',
|
|
format: 'cjs',
|
|
exports: 'named'
|
|
},
|
|
{
|
|
file: 'dist/esm/index.mjs',
|
|
format: 'es',
|
|
// The source loads several modules lazily via require(): the crypto
|
|
// fallback, fs/path for key persistence, the optional native addon,
|
|
// and jose. `require` does not exist in ES module scope, so without
|
|
// this shim an ESM consumer crashes with "require is not defined"
|
|
// the moment one of those paths runs. Node-only output, so
|
|
// node:module is safe here.
|
|
banner: "import { createRequire as __nomyoCreateRequire } from 'node:module';\n"
|
|
+ 'const require = __nomyoCreateRequire(import.meta.url);'
|
|
}
|
|
];
|
|
config.external = ['crypto', 'https', 'fs', 'path'];
|
|
} else if (target === 'browser') {
|
|
config.output = [
|
|
{
|
|
file: 'dist/browser/index.mjs',
|
|
format: 'es',
|
|
name: 'Nomyo'
|
|
},
|
|
{
|
|
file: 'dist/browser/index.cjs',
|
|
format: 'cjs',
|
|
exports: 'named',
|
|
name: 'Nomyo'
|
|
}
|
|
];
|
|
}
|
|
|
|
export default config;
|