fix: handle with { type: "file" } import attributes in tsx dev mode

.github/workflows/ci.yml

@@ -259,7 +259,7 @@ jobs:
         run: pnpm install --frozen-lockfile
       - name: Setup codesign dependencies
         env:
-          APPLE_CERT_DATA: ${{ secrets.CSC_LINK }}
+          APPLE_CERT_DATA: ${{ secrets.APPLE_CERT_DATA }}
           APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
         run: |
           curl -L 'https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.29.0/apple-codesign-0.29.0-x86_64-unknown-linux-musl.tar.gz' -o 'rcodesign.tar.gz'
@@ -297,8 +297,8 @@ jobs:
           RELEASE_BUILD: ${{ github.event_name != 'pull_request' && '1' || '' }}
           # Codesigning: only on main/release pushes (fork PRs lack secrets)
           FOSSILIZE_SIGN: ${{ github.event_name == 'push' && (github.ref_name == 'main' || startsWith(github.ref_name, 'release/')) && 'y' || 'n' }}
-          APPLE_CERT_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
-          APPLE_TEAM_ID: ${{ vars.APPLE_TEAM_ID }}
+          APPLE_CERT_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: pnpm run build -- --target ${{ matrix.target }}
       - name: Smoke test
         if: matrix.can-test

script/require-shim.mjs

@@ -1,5 +1,6 @@
 /**
- * ESM preload shim that provides `require` in ESM modules.
+ * ESM preload shim that provides `require` in ESM modules and handles
+ * `with { type: "file" }` import attributes in tsx dev mode.
  *
  * The source code uses bare `require()` for lazy loading (circular dependency
  * breaking, optional features). This works natively in Bun and in the CJS
@@ -13,14 +14,38 @@
  * must use a file-local `createRequire(import.meta.url)` instead of relying
  * on this global shim.
  *
+ * `with { type: "file" }` import attributes are used to embed sidecar files
+ * (e.g. the Ink UI app). Bun supports this natively; esbuild's
+ * text-import-plugin handles it at build time. In tsx dev mode neither
+ * applies, so we register a loader hook that returns the file path as a
+ * string — matching Bun's native behaviour.
+ *
  * Usage: NODE_OPTIONS="--import ./script/require-shim.mjs" tsx script/...
  * Or in package.json scripts via the `pnpm tsx` alias.
  */
 
-import { createRequire } from "node:module";
+import { createRequire, registerHooks } from "node:module";
 
 if (typeof globalThis.require === "undefined") {
   globalThis.require = createRequire(
     new URL("../package.json", import.meta.url)
   );
 }
+
+// Handle `with { type: "file" }` import attributes in Node.js dev mode.
+// Bun supports this natively; esbuild's text-import-plugin handles it at
+// build time. In tsx dev mode neither applies, so we register a synchronous
+// hook that returns the file path as a string — matching Bun's behaviour.
+// registerHooks() is available from Node 22.15+ (our minimum).
+registerHooks({
+  load(url, context, nextLoad) {
+    if (context.importAttributes?.type === "file") {
+      return {
+        format: "module",
+        shortCircuit: true,
+        source: `export default ${JSON.stringify(new URL(url).pathname)};`,
+      };
+    }
+    return nextLoad(url, context);
+  },
+});