fix(compartment-mapper): mapNodeModules should not crawl ESM modules from CJS entrypoints

This changes the logic in mapNodeModules() so that when it reads the `package.json` of the entrypoint, it checks for `type === 'module'`. If this is set, then `import` is added to the `conditions`. If it is not set, then `require` is added to the conditions. The conditions always contain `default`; this has not changed.

This prevents CJS modules from referencing modules in the `CompartmentMapDescriptor` which they would not otherwise load (and in fact _cannot_ load for some value of "_cannot_").

Author: boneskull

packages/compartment-mapper/NEWS.md

@@ -10,6 +10,8 @@ User-visible changes to `@endo/compartment-mapper`:
   occur _if and only if_ dynamic requires are enabled _and_ a policy is
   provided.
 - Improved error messaging for policy enforcement failures.
+- Fixed a bug where `mapNodeModules()` would traverse ESM exports even when
+  provided a CJS entrypoint.
 
 # v1.6.2 (2025-06-17)
 

packages/compartment-mapper/src/node-modules.js

@@ -704,7 +704,6 @@ const graphPackages = async (
   const packageDescriptor = allegedPackageDescriptor;
 
   conditions = new Set(conditions || []);
-  conditions.add('import');
   conditions.add('default');
   conditions.add('endo');
 
@@ -1098,14 +1097,21 @@ export const mapNodeModules = async (
     packageDescriptorLocation,
     moduleSpecifier,
   } = await search(readPowers, moduleLocation, { log });
-
+  conditions = conditions ?? new Set();
+  
   const packageDescriptor = /** @type {typeof parseLocatedJson<unknown>} */ (
     parseLocatedJson
   )(packageDescriptorText, packageDescriptorLocation);
 
   assertPackageDescriptor(packageDescriptor);
   assertFileUrlString(packageLocation);
 
+  if (packageDescriptor.type === 'module') {
+    conditions.add('import');
+  } else {
+    conditions.add('require');
+  }
+
   return compartmentMapForNodeModules(
     readPowers,
     packageLocation,

packages/compartment-mapper/test/fixtures-dual-module/node_modules/app-esm/index.js

@@ -158,3 +158,35 @@ test('mapNodeModules() should not consider peerDependenciesMeta without correspo
     }
   });
 }
+
+test('mapNodeModules() should not traverse ESM exports for CJS entrypoints', async t => {
+  const moduleLocation = new URL(
+    'fixtures-dual-module/node_modules/app/index.js',
+    import.meta.url,
+  ).href;
+  const readPowers = makeReadPowers({ fs, url });
+  const compartmentMap = await mapNodeModules(readPowers, moduleLocation);
+
+  t.is(
+    Object.values(compartmentMap.compartments).find(
+      compartment => compartment.name === 'dual',
+    )?.modules?.dual?.module,
+    './index.cjs',
+  );
+});
+
+test('mapNodeModules() should prefer ESM exports for ESM entrypoints', async t => {
+  const moduleLocation = new URL(
+    'fixtures-dual-module/node_modules/app-esm/index.js',
+    import.meta.url,
+  ).href;
+  const readPowers = makeReadPowers({ fs, url });
+  const compartmentMap = await mapNodeModules(readPowers, moduleLocation);
+
+  t.is(
+    Object.values(compartmentMap.compartments).find(
+      compartment => compartment.name === 'dual',
+    )?.modules?.dual?.module,
+    './index.js',
+  );
+});