fix(registry-verification): use Windows-valid synthetic URL for createRequire shim

EmDash-Run: 9e7c91e5-80af-4c34-8c1b-be105396b012

Author: emdashbot[bot]

.changeset/fix-windows-registry-verification.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/registry-verification": patch
+---
+
+Fixes the generated `createRequire` shim in the ESM build so the synthetic file URL includes a drive letter. The previous driveless URL (`file:///emdash-registry-verification.js`) was rejected by `fileURLToPath()` on Windows, causing builds that inline this package (such as `emdash@0.37.0` on Windows) to fail when the Astro config was loaded.

packages/registry-verification/scripts/check-packed-output.mjs

@@ -2,8 +2,9 @@ import { execFileSync } from "node:child_process";
 import { createReadStream } from "node:fs";
 import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import path, { join } from "node:path";
 import { pipeline } from "node:stream/promises";
+import { fileURLToPath } from "node:url";
 import { createGunzip } from "node:zlib";
 
 import { unpackTar } from "modern-tar/fs";
@@ -42,6 +43,27 @@ try {
 	if (publishedOutput.includes("createRequire(import.meta.url)")) {
 		throw new Error("Packed verifier output cannot be safely rebundled");
 	}
+
+	// On Windows, fileURLToPath() rejects driveless file:/// URLs. The synthetic
+	// base used for the CJS interop shim must include a drive letter so it is
+	// accepted as a valid absolute file URL on every platform.
+	const requireUrlMatch = publishedOutput.match(/__require = .*?createRequire\("([^"]+)"\)/);
+	if (!requireUrlMatch) {
+		throw new Error("Packed verifier output is missing the CJS interop shim");
+	}
+	const syntheticRequireUrl = requireUrlMatch[1];
+	if (!/^file:\/\/\/[A-Za-z]:\//.test(syntheticRequireUrl)) {
+		throw new Error(
+			`Packed verifier createRequire URL is not Windows-valid: ${syntheticRequireUrl}`,
+		);
+	}
+	const resolvedPath = fileURLToPath(syntheticRequireUrl);
+	if (!path.isAbsolute(resolvedPath)) {
+		throw new Error(
+			`Packed verifier createRequire URL did not resolve to an absolute path: ${resolvedPath}`,
+		);
+	}
+
 	if (
 		publishedBundleOutput.includes("createRequire") ||
 		publishedBundleOutput.includes("@sigstore") ||

packages/registry-verification/tsdown.config.ts

@@ -5,9 +5,13 @@ import { defineConfig } from "tsdown";
 const rebundleSafeRequire = {
 	name: "rebundle-safe-require",
 	renderChunk(code: string) {
+		// Consumers rebundle this artifact, so `import.meta.url` may no longer name
+		// a real file. The generated `require` only resolves Node builtins, so any
+		// absolute file URL is sufficient. The URL must include a synthetic drive
+		// letter: on Windows `fileURLToPath()` rejects driveless `file:///...` URLs.
 		return code.replace(
 			"createRequire(import.meta.url)",
-			'createRequire("file:///emdash-registry-verification.js")',
+			'createRequire("file:///C:/emdash-registry-verification.js")',
 		);
 	},
 };