From 7bb1cc82c33fb11410735b900e3c9d7ec061a21d Mon Sep 17 00:00:00 2001
From: Tham Kei Lok <tkl48leon@gmail.com>
Date: Tue, 21 Jul 2026 10:00:30 +0700
Subject: [PATCH] Emit real ESM output and drop dead pnpm build config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two follow-ups flagged but deliberately left out of the dependency bump.

builder-bob 0.41 started warning that the esm option is disabled while
exports['.'].import and exports['.'].require are both set, and that
exports['.'].types should not be set alongside them. The warnings were
pointing at a real defect, not a style preference: with esm disabled, bob
emits ESM syntax into lib/module/*.js but writes no `type` marker, so
Node resolves the import condition and then parses those files as
CommonJS. Node 24 papers over it with module syntax detection; with
detection off — which is Node 18/20 behaviour — importing the package
fails outright with ERR_REQUIRE_CYCLE_MODULE.

Enabling esm on the commonjs and module targets makes bob write the
`type` markers, rewrite relative imports to carry .js extensions, and
split declarations into lib/typescript/{commonjs,module}. The typescript
target picks esm up from the other targets, so it needs no option of its
own. The exports map now nests types under each condition, as bob asked.

Verified against a packed tarball resolved from a scratch consumer:
require() lands on lib/commonjs, import() on lib/module, and with syntax
detection disabled the old layout throws while this one resolves. tsc
picks up the commonjs declarations under moduleResolution node16 and the
module ones under bundler.

Separately, onlyBuiltDependencies has zero references in pnpm 11.1.1 —
it, ignoredBuiltDependencies and neverBuiltDependencies were all replaced
by the allowBuilds map. The empty array was dead config with a comment
that overstated it. Removed, and the comment now describes what pnpm 11
actually enforces. Every other setting in the file is still live.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 package.json        | 27 +++++++++++++++++++++------
 pnpm-workspace.yaml |  8 +++-----
 2 files changed, 24 insertions(+), 11 deletions(-)

diff --git a/package.json b/package.json
index e4e8cc3..ac6df36 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,7 @@
   },
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
-  "types": "lib/typescript/index.d.ts",
+  "types": "lib/typescript/commonjs/index.d.ts",
   "react-native": "src/index.ts",
   "source": "src/index.ts",
   "files": [
@@ -21,9 +21,14 @@
   ],
   "exports": {
     ".": {
-      "import": "./lib/module/index.js",
-      "require": "./lib/commonjs/index.js",
-      "types": "./lib/typescript/index.d.ts"
+      "import": {
+        "types": "./lib/typescript/module/index.d.ts",
+        "default": "./lib/module/index.js"
+      },
+      "require": {
+        "types": "./lib/typescript/commonjs/index.d.ts",
+        "default": "./lib/commonjs/index.js"
+      }
     }
   },
   "private": false,
@@ -115,8 +120,18 @@
     "source": "src",
     "output": "lib",
     "targets": [
-      "commonjs",
-      "module",
+      [
+        "commonjs",
+        {
+          "esm": true
+        }
+      ],
+      [
+        "module",
+        {
+          "esm": true
+        }
+      ],
       [
         "typescript",
         {
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 607dc77..0b034f8 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -2,12 +2,10 @@
 # See: https://pnpm.io/supply-chain-security
 
 # 1. Block lifecycle scripts by default
-# Only explicitly approved packages can run postinstall scripts.
+# pnpm runs no dependency's postinstall until it is listed here with an
+# explicit true/false verdict, and fails the install while any are unrecorded.
 # Use `pnpm approve-builds` to manage this list.
-onlyBuiltDependencies: []
-
-# Every dependency that wants a lifecycle script must get an explicit verdict
-# here; pnpm fails the install until one is recorded.
+#
 # unrs-resolver arrives via jest-resolve. Its postinstall only links a prebuilt
 # napi binary, and pnpm already installs the right platform binding as an
 # optional dep, so the test suite resolves fine with the script denied.