keycloak-js ESM does not work

[robrez]

Description

The dependency on js-sha256 causes the esm you vend to not work properly. Please consider switching libraries (eg: https://www.npmjs.com/package/@noble/hashes). It is also possible to use rollup to make an esm-compatible build of js-sha256 (eg: https://github.com/bundled-es-modules)

Filed separately: emn178/js-sha256#44

Discussion

No response

Motivation

No response

Details

No response

[codespearhead]

Can you elaborate on how "js-sha256 causes the ESM-compatible build to not work properly"?

[robrez]

Sure, hopefully this helps: https://stackblitz.com/edit/vitejs-vite-pvidyi?file=README.md

To be less terse and provide additional commentary to accompany the stackblitz above

• js-sha256 is vended as CJS
  • There is no "module" field in its package.json
  • There is only a "main" field which points to a CJS file

While the ESM spec does say that it's fine to import CJS from ESM, in practice it causes nothing but pain for dependents.

The pain is that build tooling must be given special instructions whenever a dependency is introduced that imports CJS. This might be shrugged off as not a big deal whenever someone adds ESM that imports CJS as a direct dependency. However this is pretty awful when you add a direct dependency that adds a transitive dependency that uses import statements on CJS. You end up having to document code with blurbs such as, "If you add this package as a dependency, then be sure your build tooling is updated to handle the fact that it imports CJS". And the need for such documentation becomes viral on any packages that depend on your package.

[jonkoops]

Duplicate of #15769