fix(registry-verification): support imports on Windows

.changeset/registry-verification-windows.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/registry-verification": patch
+---
+
+Fixes site builds on Windows failing when the plugin registry verifier is imported.

.github/workflows/ci.yml

@@ -135,6 +135,9 @@ jobs:
       # leave them unbuilt and their tests would fail to resolve workspace
       # links to dist/.
       - run: pnpm run --filter emdash... --filter "@emdash-cms/aggregator" --filter "@emdash-cms/labeler" --filter "@emdash-cms/plugin-cli" --filter "@emdash-cms/registry-*" --filter "@emdash-cms/plugin-types" build
+      - name: Check registry-verification package
+        if: matrix.shardIndex == 1
+        run: pnpm --filter @emdash-cms/registry-verification test:package
       - run: pnpm --filter emdash exec vitest run --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
         env:
           EMDASH_TEST_PG: postgres://postgres:test@localhost:5432/emdash_test

apps/release-action/dist/index.js

@@ -8161,7 +8161,7 @@ function createGzipDecoder() {
 //#endregion
 //#region ../../packages/registry-verification/dist/index.js
 var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __require = /* @__PURE__ */ createRequire("file:///emdash-registry-verification.js");
+var __require = /* @__PURE__ */ createRequire("file:///C:/emdash-registry-verification.js");
 const DEFAULT_FETCH_LIMITS = {
 	headerTimeoutMs: 1e4,
 	totalTimeoutMs: 3e4,

packages/registry-verification/scripts/check-packed-output.mjs

@@ -1,9 +1,12 @@
+import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
 import { createReadStream } from "node:fs";
 import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { pipeline } from "node:stream/promises";
+import { fileURLToPath } from "node:url";
 import { createGunzip } from "node:zlib";
 
 import { unpackTar } from "modern-tar/fs";
@@ -42,6 +45,17 @@ try {
 	if (publishedOutput.includes("createRequire(import.meta.url)")) {
 		throw new Error("Packed verifier output cannot be safely rebundled");
 	}
+	const requireUrl = publishedOutput.match(/createRequire\("([^"\n]+)"\)/)?.[1];
+	if (!requireUrl) {
+		throw new Error("Packed verifier output is missing the CJS interop shim");
+	}
+	// Check both path conventions regardless of the platform running this test.
+	fileURLToPath(requireUrl, { windows: true });
+	fileURLToPath(requireUrl, { windows: false });
+	const require = createRequire(requireUrl);
+	assert.equal(typeof require("crypto").createHash, "function");
+	assert.equal(typeof require("util").promisify, "function");
+
 	if (
 		publishedBundleOutput.includes("createRequire") ||
 		publishedBundleOutput.includes("@sigstore") ||

packages/registry-verification/tsdown.config.ts

@@ -2,12 +2,13 @@ import { defineConfig } from "tsdown";
 
 // Consumers rebundle this artifact, where import.meta.url may no longer name a file.
 // The generated require only resolves Node builtins, so a stable absolute base is sufficient.
+// A drive letter keeps the synthetic URL valid on Windows.
 const rebundleSafeRequire = {
 	name: "rebundle-safe-require",
 	renderChunk(code: string) {
 		return code.replace(
 			"createRequire(import.meta.url)",
-			'createRequire("file:///emdash-registry-verification.js")',
+			'createRequire("file:///C:/emdash-registry-verification.js")',
 		);
 	},
 };