Build with tsdown instead of tsup

tsup is no longer maintained (its README now points at tsdown). tsdown is
the rolldown-based successor from the same lineage.

- migrate all 25 build configs; published files now use explicit .mjs/.cjs
  extensions, which is what rolldown emits and removes the ambiguity that
  made module-format detection guess wrong
- code splitting cannot be disabled in tsdown, so the self-contained CJS
  bundles (varlock init-server/init-edge) each get their own build. A
  shared chunk in those would emit a require() that cannot resolve where
  they get injected into webpack/turbopack runtimes
- rolldown otherwise rewrites bare `require` into a shim calling
  createRequire(import.meta.url) at module scope. That is undefined in
  workerd, and it defeats the `typeof require === 'function'` guards that
  keep runtime/crypto.ts evaluable in edge runtimes, so polyfillRequire is
  off
- @env-spec/utils now emits declarations, which lets tsdown inline its
  types. varlock's published d.ts has been shipping a broken import of
  @env-spec/utils/type-utils, hidden only by skipLibCheck
- drop keepNames: it was an esbuild-era workaround, and with tsdown it
  leaked a runtime-chunk import into the parser's declaration files.
  Class names survive without it since these builds never minify
- port keepass's esbuild resolver plugin to a rolldown resolveId hook
- infisical patched its bundle by string-replacing 'use strict', which
  tsdown does not emit. Use a real banner instead
- the extension change breaks extensionless runtime resolution, so the
  nextjs webpack loader and the astro injected route are now explicit
- drop two entries that pointed at files which no longer exist; tsup
  ignored them silently, tsdown errors

Also enable publint and attw on every publishable package's build. Both
fail the build on real errors, so exports and type-resolution problems
surface at build time instead of after publish.

attw profile is per package: esm-only where we only ship esm (the node10
algorithm and require() from a cjs consumer are both out of scope), node16
for the genuinely dual and cjs-only packages.

Fixing what they found:
- repository.url everywhere is a full git+https URL
- @varlock/nextjs-integration declares "type": "commonjs" rather than making
  node sniff it, which is accurate: it is cjs-only to match @next/env. Its
  tsdown config moves to .mts, since node otherwise loads the .ts config as
  CJS and tsdown is ESM-only
- @env-spec/parser declares "type": "module". Its published output is all
  explicit .mjs/.cjs so the field governs nothing there, but src/grammar.js
  is generated by peggy with format: 'es', and that is the one bare .js the
  field does govern
- keepass now emits declarations like every other plugin. dts was off there
  under tsup; it works fine now, and attw flagged the package as untyped
- varlock/test-helpers is internal, so it keeps only the `ts-src` condition
  and is excluded from attw. Vitest resolves dependencies through the ssr
  pipeline, which does not inherit resolve.conditions, so the plugin vitest
  configs now set ssr.resolve.conditions too

Review follow-ups (pullfrog on #1021), all the same class of bug: strings in
source that resolve against built output, which nothing typechecks.

- the turbopack symlink fallback still aliased four .js runtime files. That
  branch only runs when varlock is symlinked, so the framework tests (which
  install from packed tarballs) never execute it
- .github/workflows/deploy-tests.yaml invoked dist/cli/cli-executable.js
- .github/workflows/bundle-size-check.yaml filtered on the removed
  tsup.config.ts, so a change to the active build config would have silently
  skipped the size check

Add a test pinning that invariant for the nextjs integration: every
hardcoded dist path and every relative require.resolve must name a file the
build actually emits, with an explicit extension.

Also drop two tsup-era workarounds that tsdown makes unnecessary, and update
comments that still named tsup.config.ts:

- the `typeof execSync` type workaround for egoist/tsup#1367
- the vite integration force-externalized `crypto` for SSR because esbuild
  stripped the node: prefix, leaving varlock's dist importing bare 'crypto'.
  rolldown preserves the prefix (dist has no bare node builtins at all), and
  vite auto-externalizes node:-prefixed specifiers

Author: theoephraim

.bumpy/migrate-to-tsdown.md

@@ -0,0 +1,29 @@
+---
+"@env-spec/parser": patch
+varlock: patch
+env-spec-language: patch
+"@varlock/ci-env-info": patch
+"@varlock/cloudflare-integration": patch
+"@varlock/expo-integration": patch
+"@varlock/vite-integration": patch
+"@varlock/nextjs-integration": patch
+"@varlock/astro-integration": patch
+"@varlock/azure-key-vault-plugin": patch
+"@varlock/hashicorp-vault-plugin": patch
+"@varlock/pass-plugin": patch
+"@varlock/dashlane-plugin": patch
+"@varlock/aws-secrets-plugin": patch
+"@varlock/doppler-plugin": patch
+"@varlock/keepass-plugin": patch
+"@varlock/passbolt-plugin": patch
+"@varlock/infisical-plugin": patch
+"@varlock/akeyless-plugin": patch
+"@varlock/bitwarden-plugin": patch
+"@varlock/google-secret-manager-plugin": patch
+"@varlock/proton-pass-plugin": patch
+"@varlock/keeper-plugin": patch
+"@varlock/kubernetes-plugin": patch
+"@varlock/1password-plugin": patch
+---
+
+Build with tsdown instead of tsup; published files now use explicit .mjs/.cjs extensions.

.github/workflows/bundle-size-check.yaml

@@ -24,7 +24,7 @@ on:
     paths:
       - 'packages/varlock/src/**'
       - 'packages/varlock/package.json'
-      - 'packages/varlock/tsup.config.ts'
+      - 'packages/varlock/tsdown.config.ts'
       - 'packages/varlock/tsconfig*.json'
       - 'scripts/report-bundle-size.ts'
       - '.github/workflows/bundle-size-check.yaml'

.github/workflows/deploy-tests.yaml

@@ -64,7 +64,7 @@ jobs:
         # via deploy/.env.schema and injects them into the test process
         run: |
           cd framework-tests && bun install
-          node ../packages/varlock/dist/cli/cli-executable.js run --path ./deploy -- bun run test -- --reporter=verbose deploy/
+          node ../packages/varlock/dist/cli/cli-executable.mjs run --path ./deploy -- bun run test -- --reporter=verbose deploy/
         timeout-minutes: 25
         env:
           OP_CI_TOKEN: ${{ secrets.OP_CI_TOKEN }}

bun.lock

@@ -37,6 +37,7 @@
     "packages:sync": "bunx fledgling sync"
   },
   "devDependencies": {
+    "@arethetypeswrong/core": "^0.18.5",
     "@cloudflare/vite-plugin": "^1.37.1",
     "@eslint/js": "^10.0.1",
     "@socketsecurity/bun-security-scanner": "^1.1.2",
@@ -54,7 +55,8 @@
     "eslint-stylistic-airbnb": "^2.0.1",
     "globals": "^17.3.0",
     "lefthook": "^2.1.6",
-    "tsdown": "^0.22.1",
+    "publint": "^0.3.24",
+    "tsdown": "catalog:",
     "turbo": "^2.9.14",
     "typescript": "catalog:",
     "typescript-eslint": "^8.56.1",
@@ -85,7 +87,7 @@
     "ky": "^1.14.3",
     "msw": "^2.12.14",
     "outdent": "^0.8.0",
-    "tsup": "^8.5.1",
+    "tsdown": "^0.22.14",
     "typescript": "^5.9.3",
     "vite": "^7.3.1",
     "vitest": "^4.0.18"

package.json

@@ -5,23 +5,23 @@
   "type": "module",
   "repository": {
     "type": "git",
-    "url": "https://github.com/dmno-dev/varlock.git",
+    "url": "git+https://github.com/dmno-dev/varlock.git",
     "directory": "packages/ci-env-info"
   },
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
+  "main": "dist/index.mjs",
+  "types": "dist/index.d.mts",
   "exports": {
     ".": {
       "ts-src": "./src/index.ts",
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
-      "default": "./dist/index.js"
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs",
+      "default": "./dist/index.mjs"
     }
   },
   "files": ["dist"],
   "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
+    "build": "tsdown",
+    "dev": "tsdown --watch",
     "test": "vitest",
     "test:ci": "vitest --run",
     "typecheck": "tsc --noEmit"
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@types/node": "catalog:",
-    "tsup": "catalog:",
+    "tsdown": "catalog:",
     "typescript": "catalog:",
     "vitest": "catalog:"
   }

packages/ci-env-info/package.json

@@ -1,4 +1,4 @@
-import { defineConfig } from 'tsup';
+import { defineConfig } from 'tsdown';
 
 export default defineConfig({
   entry: ['src/index.ts'],
@@ -7,7 +7,9 @@ export default defineConfig({
   treeshake: true,
   clean: true,
   outDir: 'dist',
+  attw: { level: 'error', profile: 'esm-only' },
+  publint: true,
   format: ['esm'],
-  splitting: false,
+  platform: 'node',
   target: 'esnext',
 });

packages/ci-env-info/tsup.config.ts packages/ci-env-info/tsdown.config.tspackages/ci-env-info/tsup.config.ts renamed to packages/ci-env-info/tsdown.config.ts

@@ -1,32 +1,38 @@
 {
   "name": "@env-spec/parser",
   "version": "0.5.0",
+  "type": "module",
   "description": "Parser for @env-spec enabled dotenv files",
   "homepage": "https://varlock.dev",
   "bugs": "https://github.com/dmno-dev/varlock/issues",
   "repository": {
     "type": "git",
-    "url": "https://github.com/dmno-dev/varlock.git",
+    "url": "git+https://github.com/dmno-dev/varlock.git",
     "directory": "packages/env-spec-parser"
   },
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
+  "main": "dist/index.cjs",
+  "types": "dist/index.d.cts",
   "files": ["dist"],
   "exports": {
     ".": {
       "ts-src": "./src/index.ts",
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.mjs",
-      "require": "./dist/index.js"
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
     }
   },
   "scripts": {
     "dev": "bun run --parallel dev:grammar dev:ts",
     "dev:grammar": "bun run build:grammar:watch",
-    "dev:ts": "tsup --watch",
+    "dev:ts": "tsdown --watch",
     "build:grammar": "peggy -c peggy.config.cjs",
     "build:grammar:watch": "peggy -c peggy.config.cjs -w",
-    "build:lib": "tsup",
+    "build:lib": "tsdown",
     "build": "bun run build:grammar && bun run build:lib",
     "test": "bun run --parallel build:grammar:watch _test:watch",
     "_test:watch": "vitest",
@@ -53,7 +59,7 @@
     "ansis": "catalog:",
     "outdent": "catalog:",
     "peggy": "^5.0.6",
-    "tsup": "catalog:",
+    "tsdown": "catalog:",
     "vitest": "catalog:"
   }
 }

packages/env-spec-parser/package.json

@@ -7,8 +7,8 @@
 // we dont need everything to match 100% - but good to know what differences are
 
 import util from 'node:util';
-import { parseEnvSpecDotEnvFile } from '../dist/index.js';
-import { simpleResolver } from '../dist/simple-resolver.js';
+import { parseEnvSpecDotEnvFile } from '../dist/index.mjs';
+import { simpleResolver } from '../dist/simple-resolver.mjs';
 const COMPARISON_SCENARIOS = {
   scenarios: [
     {

packages/env-spec-parser/scripts/dotenv-comparison.mjs

@@ -3,8 +3,8 @@
 // helpful script for testing the parser - loads .env.playground file
 import {
   expand, parseEnvSpecDotEnvFile,
-} from '../dist/index.js';
-import { simpleResolver } from '../dist/simple-resolver.js';
+} from '../dist/index.mjs';
+import { simpleResolver } from '../dist/simple-resolver.mjs';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';