fix(externals): trace CJS require() dependencies in production builds

src/build/plugins/externals.ts

@@ -71,21 +71,33 @@ export function externals(opts: ExternalsOptions): Plugin {
           };
         }
 
-        // Skip nested rollup-node resolutions
-        if (rOpts.custom?.["node-resolve"]) {
-          return null;
-        }
+        let resolved;
 
-        // Resolve by other resolvers
-        let resolved = await this.resolve(id, importer, rOpts);
+        if (rOpts.custom?.["node-resolve"]) {
+          // For nested node-resolve resolutions (e.g., CJS require()),
+          // resolve directly to avoid recursion but still externalize
+          // modules that match the include filter (e.g., native deps).
+          // Only applies when tracing is active (production builds).
+          if (!opts.trace) {
+            return null;
+          }
+          const resolvedPath = tryResolve(id, importer);
+          if (!resolvedPath || !filter(resolvedPath)) {
+            return null;
+          }
+          resolved = { id: resolvedPath };
+        } else {
+          // Resolve by other resolvers
+          resolved = await this.resolve(id, importer, rOpts);
 
-        // Skip rolldown-plugin-commonjs resolver for externals
-        const cjsResolved = resolved?.meta?.commonjs?.resolved;
-        if (cjsResolved) {
-          if (!filter(cjsResolved.id)) {
-            return resolved; // Bundled and wrapped by CJS plugin
+          // Skip rolldown-plugin-commonjs resolver for externals
+          const cjsResolved = resolved?.meta?.commonjs?.resolved;
+          if (cjsResolved) {
+            if (!filter(cjsResolved.id)) {
+              return resolved; // Bundled and wrapped by CJS plugin
+            }
+            resolved = cjsResolved /* non-wrapped */;
           }
-          resolved = cjsResolved /* non-wrapped */;
         }
 
         // Check if not resolved or explicitly marked as excluded

src/presets/_all.gen.ts

@@ -1,7 +1,5 @@
 // Auto-generated using gen-presets script
 
-import _nitro from "./_nitro/preset.ts";
-import _static from "./_static/preset.ts";
 import _alwaysdata from "./alwaysdata/preset.ts";
 import _awsAmplify from "./aws-amplify/preset.ts";
 import _awsLambda from "./aws-lambda/preset.ts";
@@ -27,10 +25,10 @@ import _vercel from "./vercel/preset.ts";
 import _winterjs from "./winterjs/preset.ts";
 import _zeabur from "./zeabur/preset.ts";
 import _zerops from "./zerops/preset.ts";
+import _nitro from "./_nitro/preset.ts";
+import _static from "./_static/preset.ts";
 
 export default [
-  ..._nitro,
-  ..._static,
   ..._alwaysdata,
   ..._awsAmplify,
   ..._awsLambda,
@@ -56,4 +54,6 @@ export default [
   ..._winterjs,
   ..._zeabur,
   ..._zerops,
+  ..._nitro,
+  ..._static,
 ] as const;

test/fixture/server/routes/modules.ts

@@ -8,6 +8,9 @@ import depLib from "@fixture/nitro-lib";
 import subpathLib from "@fixture/nitro-lib/subpath";
 // @ts-ignore
 import extraUtils from "@fixture/nitro-utils/extra";
+// @ts-ignore - Untraced CJS package that require()s @fixture/nitro-native-mock (traced).
+// Simulates: ws (not in traceDeps) -> require('bufferutil') (in NodeNativePackages).
+import cjsUntrace from "nitro-cjs-untrace";
 
 export default () => {
   return {
@@ -16,5 +19,6 @@ export default () => {
     depLib, // expected to all be 2.0.0
     subpathLib, // expected to 2.0.0
     extraUtils,
+    cjsUntrace,
   };
 };

test/presets/node.test.ts

@@ -37,4 +37,15 @@ describe("nitro:preset:node-middleware", async () => {
     const serverNodeModules = resolve(ctx.outDir, "server/node_modules");
     expect(existsSync(resolve(serverNodeModules, "@fixture/nitro-utils/extra.mjs"))).toBe(true);
   });
+
+  it("should trace CJS require() dependencies", () => {
+    // Verifies that packages loaded via CJS require() inside bundled code
+    // are properly externalized and traced (not silently bundled as JS).
+    // This covers the case where @rollup/plugin-node-resolve resolves a
+    // require() call with custom: { "node-resolve": { isRequire: true } }.
+    const serverNodeModules = resolve(ctx.outDir, "server/node_modules");
+    expect(existsSync(resolve(serverNodeModules, "@fixture/nitro-native-mock/index.js"))).toBe(
+      true
+    );
+  });
 });