fix(registry-verification): support imports on Windows

[logelog]

What does this PR do?

Fixes Windows site builds failing while loading the Astro configuration. The bundled registry verifier uses a synthetic createRequire URL without a drive letter, which Node.js rejects on Windows.

Adds a drive letter to that URL and extends the packed-output check to validate Windows and POSIX paths and load the required Node builtins. CI runs this check after building the package. Updates the committed release action bundle to include the fix.

Closes #2978

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (if applicable). Not applicable: no admin UI changes.
• I have added and reviewed the user-facing changeset
• New features link to an approved Discussion. Not applicable: bug fix.
• I have included screenshots below if this PR changes the UI. Not applicable: no UI changes.

Screenshots / test output

Screenshots: not applicable.

• The new packed-output regression check fails on the original bundle with ERR_INVALID_FILE_URL_PATH and passes after the fix. It checks Windows path rules even on Linux.
• pnpm --filter @emdash-cms/registry-verification test: 114 tests and 38 Workerd tests passed.
• pnpm --filter @emdash-cms/release-action test: 15 tests passed. Its typecheck and rebuild consistency check also passed.
• pnpm build, pnpm typecheck, pnpm lint, pnpm format:check, and git diff --check passed.
• Native Windows 11 Pro 25H2, Node.js v24.19.0: the package rebuilt from this branch passed the unchanged packed-output script and a direct import.
• Windows site verification used Astro 7.2.3, @emdash-cms/cloudflare 0.37.0, and @emdash-cms/plugin-forms 0.2.6. EmDash 0.37.0 reproduced the reported config-loading failure. The published candidate at 516574d, with the same URL fix, built successfully and served the homepage and setup-status endpoint with HTTP 200 in local preview.

The Windows site build logged non-fatal Google Fonts network and chunk-size warnings.

[changeset-bot]

🦋 Changeset detected

Latest commit: 78c4f6a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 21 packages

Name	Type
@emdash-cms/registry-verification	Patch
emdash	Patch
@emdash-cms/labeler	Patch
@emdash-cms/release-action	Patch
@emdash-cms/release-service	Patch
@emdash-cms/release-verifier	Patch
@emdash-cms/cloudflare	Patch
@emdash-cms/sandbox-workerd	Patch
@emdash-cms/fixture-perf-site	Patch
@emdash-cms/perf-demo-site	Patch
@emdash-cms/cache-demo-site	Patch
@emdash-cms/do-demo-site	Patch
@emdash-cms/do-solo-demo-site	Patch
@emdash-cms/admin	Patch
@emdash-cms/auth	Patch
@emdash-cms/blocks	Patch
create-emdash	Patch
@emdash-cms/gutenberg-to-portable-text	Patch
@emdash-cms/x402	Patch
@emdash-cms/auth-atproto	Patch
@emdash-cms/plugin-embeds	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[emdashbot]

This is the right fix for the reported Windows issue. The synthetic createRequire URL used by @emdash-cms/registry-verification needs a drive letter to avoid ERR_INVALID_FILE_URL_PATH when consumers rebundle it on Windows, and the extended test:package check validates the shim under both Windows and POSIX path conventions. No AGENTS.md concerns apply here (no SQL, auth, UI, content-table, or hot-path query changes).

However, the committed GitHub Action bundle in apps/release-action/dist/index.js still inlines the old file:///emdash-registry-verification.js string. The typecheck CI job rebuilds @emdash-cms/release-action (which bundles @emdash-cms/registry-verification because its tsdown config sets noExternal: [/.*/]) and then runs git diff --exit-code -- apps/release-action/dist/index.js. Once this PR changes the upstream source, the regenerated action dist will differ from what is committed, so that guard will fail on main after merge.

The PR needs to rebuild and commit apps/release-action/dist/index.js with the new URL.

[emdashbot]

[needs fixing] The source URL now includes a drive letter, but the committed GitHub Action artifact still carries the old URL. apps/release-action/dist/index.js bundles @emdash-cms/registry-verification and still contains:

var __require = /* @__PURE__ */ createRequire("file:///emdash-registry-verification.js");

The typecheck CI job rebuilds @emdash-cms/release-action and then runs git diff --exit-code -- apps/release-action/dist/index.js. Because that build inlines the changed registry-verification output, the committed dist will differ after this change and the CI guard will fail.

Fix by rebuilding and committing the regenerated action bundle:

pnpm build
pnpm --filter @emdash-cms/release-action build

then commit apps/release-action/dist/index.js.

[pkg-pr-new]

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@3069

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@3069

@emdash-cms/auth-atproto

npm i https://pkg.pr.new/@emdash-cms/auth-atproto@3069

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@3069

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@3069

@emdash-cms/contentful-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/contentful-to-portable-text@3069

emdash

npm i https://pkg.pr.new/emdash@3069

create-emdash

npm i https://pkg.pr.new/create-emdash@3069

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@3069

@emdash-cms/plugin-cli

npm i https://pkg.pr.new/@emdash-cms/plugin-cli@3069

@emdash-cms/plugin-types

npm i https://pkg.pr.new/@emdash-cms/plugin-types@3069

@emdash-cms/registry-client

npm i https://pkg.pr.new/@emdash-cms/registry-client@3069

@emdash-cms/registry-lexicons

npm i https://pkg.pr.new/@emdash-cms/registry-lexicons@3069

@emdash-cms/registry-moderation

npm i https://pkg.pr.new/@emdash-cms/registry-moderation@3069

@emdash-cms/registry-verification

npm i https://pkg.pr.new/@emdash-cms/registry-verification@3069

@emdash-cms/sandbox-workerd

npm i https://pkg.pr.new/@emdash-cms/sandbox-workerd@3069

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@3069

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@3069

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@3069

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@3069

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@3069

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@3069

@emdash-cms/plugin-field-kit

npm i https://pkg.pr.new/@emdash-cms/plugin-field-kit@3069

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@3069

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@3069

commit: 78c4f6a

[emdashbot]

This re-review confirms the prior blocker is resolved and the fix is otherwise clean.

The previous review asked for apps/release-action/dist/index.js to be rebuilt and committed with the new synthetic createRequire URL. The diff now updates that bundle line from file:///emdash-registry-verification.js to file:///C:/emdash-registry-verification.js, so the git diff --exit-code -- apps/release-action/dist/index.js guard in the typecheck CI job will pass after merge.

What I checked:

• The tsdown.config.ts plugin now emits the drive-letter URL, and the comment explains why it is needed without lapsing into reviewer-facing justification.
• scripts/check-packed-output.mjs validates the packed output with both Windows and POSIX fileURLToPath conventions and confirms Node builtins resolve through the shim, which is a meaningful regression test rather than a tautological string match.
• The new CI step runs pnpm --filter @emdash-cms/registry-verification test:package on shard 1, after the build step already covers the registry-* packages.
• A tree-wide search shows the old file:///emdash-registry-verification.js URL no longer appears in source or committed bundles; only the diff itself references it.
• The changeset is a proportional patch entry: it leads with a present-tense observable fix and identifies the affected audience (Windows site builds).

No AGENTS.md concerns apply here (no SQL, auth, UI, content-table queries, or logged-out hot-path changes). Approving.

[github-actions]

Overlapping PRs

This PR modifies files that are also changed by other open PRs:

• fix(registry-verification): use Windows-valid synthetic URL for createRequire shim #3070 (3 shared files)

This may cause merge conflicts or duplicated work. A maintainer will coordinate.