Windows: 0.37.0 import fails on bundled registry verifier createRequire URL

[Hey-Maite]

Windows: EmDash 0.37.0 fails during module load with invalid file:/// createRequire URL

Summary

On Windows, EmDash 0.37.0 cannot be imported by an Astro project. Module evaluation throws before Astro loads its config because the bundled registry verifier calls createRequire("file:///emdash-registry-verification.js"). Node rejects this root file URL on Windows.

Environment

• OS: Windows 11 (PowerShell)
• Node.js: v24.11.1 (also reproduced with v22.16.0, the documented minimum)
• EmDash: 0.37.0
• Astro: 7.3.2
• Vite: 8.3.0
• Package manager: pnpm 11.9.0

Reproduction

1. Create an Astro project and install emdash@0.37.0 (and @emdash-cms/plugin-forms@0.2.6, which imports the API bundle).
2. Run:

node -e "import('emdash').then(()=>console.log('ok')).catch(e=>console.error(e.stack))"

Actual result

TypeError [ERR_INVALID_ARG_VALUE]: The argument 'filename' must be a file URL object, file URL string, or absolute path string. Received 'file:///emdash-registry-verification.js'
    at createRequire (node:internal/modules/cjs/loader:1963:13)
    at .../node_modules/emdash/dist/api-Dz6rgoa3.mjs:3789:33

The same error occurs under Node v22.16.0. It prevents astro build, astro check, and any test importing emdash.

Expected result

The package should import successfully on Windows under the supported Node versions.

Suspected cause

The bundled output uses a POSIX-root file URL string (file:///emdash-registry-verification.js) as the anchor for createRequire. On Windows, Node requires a Windows absolute path or a file URL with a drive letter.

Impact

All Windows Astro projects using EmDash 0.37.0 are blocked before application code executes.

[emdashbot]

Completed

Triage EmDash Windows import failure caused by invalid createRequire anchor in registry-verification build output.

• Confirm source of invalid createRequire URL
• Identify fix approach and triage disposition
• Report triage with evidence and next step

Outcome: Confirmed the Windows failure is caused by the `rebundleSafeRequire` plugin in `packages/registry-verification/tsdown.config.ts`. For the Node-only `index.ts` entry, that plugin rewrites every `createRequire(import.meta.url)` to `createRequire("file:///emdash-registry-verification.js")` before publishing. On POSIX and in workerd the root file URL is accepted, but on Windows Node rejects it because it has no drive letter/host and does not satisfy the absolute-path requirement, so importing `emdash` crashes before Astro loads its config.

The same invalid string also appears in `apps/release-action/dist/index.js`, because the release action rebuilds/bundles the verifier output.

Fixing this is straightforward but intersects with an intentional compatibility choice: the static file URL was added in #2746 to make the package safe when rebundled into an Astro Cloudflare workerd application. Any fix needs to keep that path working on Cloudflare while also producing a Windows-valid anchor. Options include:

• Remove the renderChunk rewrite so the Node entry keeps `createRequire(import.meta.url)` and update `scripts/check-packed-output.mjs` to reject the invalid root file URL instead of rejecting all uses of `import.meta.url`.
• Replace the rewrite with a runtime expression such as `createRequire(fileURLToPath(new URL(import.meta.url)))`.

A complete fix also needs a regression test (e.g. asserting the packed `dist/index.js` never contains the root `file:///emdash-registry-verification.js` anchor), plus a changeset for `@emdash-cms/registry-verification`. Because the choice affects the prior Cloudflare workerd fix, maintainer approval of the approach is requested before implementing it.

Mode: triage

View live dashboard · Run: ad60432f-7550-4cc8-b566-c874e758859d