fix(scripts): track import meta url package deps

vincentkoc · vincentkoc · commit a1271830948b · 2026-06-20T09:47:27.000+02:00
diff --git a/scripts/lib/package-dist-imports.mjs b/scripts/lib/package-dist-imports.mjs
@@ -11,6 +11,10 @@ function stripSpecifierSuffix(value) {
   return value.replace(/[?#].*$/u, "");
 }
 
+function hasJavaScriptFileExtension(value) {
+  return /\.(?:cjs|js|mjs)$/u.test(path.posix.basename(stripSpecifierSuffix(value)));
+}
+
 function resolveDistImportPath(importerPath, specifier) {
   if (!specifier.startsWith(".")) {
     return null;
@@ -46,6 +50,15 @@ function isImportSpecifierContext(source, index) {
   );
 }
 
+function isImportMetaUrlContext(source, quoteStart, quoteEnd) {
+  const prefix = source.slice(Math.max(0, quoteStart - 32), quoteStart);
+  if (!/\bnew\s+URL\s*\(\s*$/u.test(prefix)) {
+    return false;
+  }
+  const suffix = source.slice(quoteEnd + 1, quoteEnd + 96);
+  return /^\s*,\s*import\.meta\.url\s*,?\s*\)/u.test(suffix);
+}
+
 function collectImportSpecifiers(source) {
   const specifiers = [];
   let inBlockComment = false;
@@ -100,7 +113,10 @@ function collectImportSpecifiers(source) {
     }
 
     if (value.startsWith(".")) {
-      if (isImportSpecifierContext(source, index)) {
+      const isDistDependency =
+        isImportSpecifierContext(source, index) ||
+        (isImportMetaUrlContext(source, index, cursor) && hasJavaScriptFileExtension(value));
+      if (isDistDependency) {
         specifiers.push(value);
       }
     }
diff --git a/test/scripts/check-openclaw-package-tarball.test.ts b/test/scripts/check-openclaw-package-tarball.test.ts
@@ -245,6 +245,90 @@ describe("check-openclaw-package-tarball", () => {
     );
   });
 
+  it("rejects dist files with missing import.meta.url URL dependencies", () => {
+    withTarball(
+      ["dist/index.js"],
+      { "dist/index.js": 'const worker = new URL("./worker.js", import.meta.url);\n' },
+      (tarball) => {
+        const result = spawnSync("node", [CHECK_SCRIPT, tarball], { encoding: "utf8" });
+
+        expect(result.status).not.toBe(0);
+        expect(result.stderr).toContain("dist/index.js imports missing dist/worker.js");
+      },
+      "2026.4.27",
+    );
+  });
+
+  it("rejects formatted import.meta.url URL dependencies", () => {
+    withTarball(
+      ["dist/index.js"],
+      {
+        "dist/index.js": [
+          "const worker = new URL(",
+          '  "./worker.js",',
+          "  import.meta.url,",
+          ");",
+          "",
+        ].join("\n"),
+      },
+      (tarball) => {
+        const result = spawnSync("node", [CHECK_SCRIPT, tarball], { encoding: "utf8" });
+
+        expect(result.status).not.toBe(0);
+        expect(result.stderr).toContain("dist/index.js imports missing dist/worker.js");
+      },
+      "2026.4.27",
+    );
+  });
+
+  it("rejects import.meta.url URL dependencies omitted from the postinstall inventory", () => {
+    withTarball(
+      ["dist/index.js"],
+      {
+        "dist/index.js": 'const worker = new URL("./worker.js", import.meta.url);\n',
+        "dist/worker.js": "export {};\n",
+      },
+      (tarball) => {
+        const result = spawnSync("node", [CHECK_SCRIPT, tarball], { encoding: "utf8" });
+
+        expect(result.status).not.toBe(0);
+        expect(result.stderr).toContain("inventory omits imported dist file dist/worker.js");
+      },
+      "2026.4.27",
+    );
+  });
+
+  it("allows import.meta.url package-root probes", () => {
+    withTarball(
+      ["dist/index.js"],
+      { "dist/index.js": 'const root = new URL("../..", import.meta.url);\n' },
+      (tarball) => {
+        const result = spawnSync("node", [CHECK_SCRIPT, tarball], { encoding: "utf8" });
+
+        expect(result.status, result.stderr).toBe(0);
+        expect(result.stdout).toContain("OpenClaw package tarball integrity passed.");
+      },
+      "2026.4.27",
+    );
+  });
+
+  it("allows import.meta.url source helper probes", () => {
+    withTarball(
+      ["dist/index.js"],
+      {
+        "dist/index.js":
+          'const shim = new URL("./capability-runtime-vitest-shims/config-runtime.ts", import.meta.url);\n',
+      },
+      (tarball) => {
+        const result = spawnSync("node", [CHECK_SCRIPT, tarball], { encoding: "utf8" });
+
+        expect(result.status, result.stderr).toBe(0);
+        expect(result.stdout).toContain("OpenClaw package tarball integrity passed.");
+      },
+      "2026.4.27",
+    );
+  });
+
   it("rejects missing Control UI assets", () => {
     withTarball(
       ["dist/index.js"],
