fix(playground): align package targets and alias self-references with CommonJS

[samchon]

Problem

The Playground Execute sandbox now supports the three root package.json#exports forms reported in #670, but several adjacent package-target decisions still disagree with Node's CommonJS package algorithm:

• an array falls through when its first target is valid but the file is missing;
• an inactive nested condition stops an outer condition map instead of letting it continue;
• bare or escaping export targets are treated as pack keys;
• a manifest that mixes subpath and condition keys is accepted;
• a package installed under an npm alias cannot require itself by its manifest name.

Each difference changes which browser code executes or turns a valid installed dependency into an unavailable-package error.

Evidence

Exact Node 22 controls and the current public sandbox produced:

Case	Node	Playground sandbox
["./missing.cjs", "./available.cjs"]	MODULE_NOT_FOUND for the selected missing target	Loads available.cjs
["available.cjs", "./available.cjs"]	Skips the invalid target and loads the second	Loads the second
{ "require": { "development": "./dev.cjs" }, "default": "./available.cjs" }	Loads the outer default	Reports unavailable
Export target "available.cjs"	ERR_INVALID_PACKAGE_TARGET	Loads the file
Mixed { ".": "./root.cjs", "require": "./other.cjs" }	ERR_INVALID_PACKAGE_CONFIG	Loads a branch
Package mounted as alias, manifest name actual, internal require("actual/sub")	Resolves the same package	Searches for another mounted package and fails

The alias path is live. installPlaygroundDependencies mounts an npm alias under the requested dependency name while retaining the downloaded manifest's actual name.

Node's package contract also requires export targets to begin with ./ and rejects traversal, node_modules segments, and encoded separator escapes after that prefix. The current resolver removes an optional ./ and concatenates the result with the pack package key.

Consequence surface

The shared reducer owns root, exact subpath, wildcard subpath, nested condition, array, and null targets. The target validator must therefore cover every one of those shapes.

Behavior to preserve:

• the three root forms fixed by fix(playground): support valid CommonJS root package.json.exports shapes in the Execute sandbox #670;
• exports encapsulation, ordered conditions, pattern precedence, and null blockers fixed by fix(playground): resolve sandbox requires through the package manifest's exports boundary #820;
• explicit active conditions require and default, with node and import inactive in the browser CommonJS evaluator;
• main and index fallback for packages without exports;
• relative requires, scoped names, JSON modules, cycles, and failed-evaluation cache eviction;
• the stable requested-specifier error context.

This issue does not add ESM evaluation, Node builtins, package imports, filesystem access, or every Node resolution error code.

Approach

Replace the flattened string-candidate reducer with a package-target result that distinguishes:

• resolved target;
• blocked target;
• unresolved conditional branch;
• invalid target.

Validate a string target before pack lookup. Arrays may skip invalid or unresolved entries, but once a valid target is selected, a missing file is a missing module rather than a reason to try another target. Conditional objects continue in manifest order when an active nested branch is unresolved.

Reject manifests that mix subpath and condition keys. For a bare request from inside a mounted package, compare the requested package name with that mount's parsed manifest name; matching requests resolve through the current mount so npm aliases retain self-reference.

Acceptance and verification

• Invalid-first arrays fall through; valid-but-missing-first arrays do not.
• Nested inactive branches permit a later active outer condition.
• Bare, absolute, parent-traversing, node_modules, encoded slash, and encoded backslash targets fail.
• Root and subpath maps with mixed key families fail.
• Exact and pattern targets remain confined after wildcard replacement.
• Unscoped and scoped npm aliases resolve self-references by manifest name, while unrelated package requests do not.
• fix(playground): support valid CommonJS root package.json.exports shapes in the Execute sandbox #670 and fix(playground): resolve sandbox requires through the package manifest's exports boundary #820 regressions remain green.
• Direct controls compare the decision matrix with Node.
• Run:

pnpm --filter @ttsc/playground build
pnpm --filter @ttsc/test-playground start -- --include=create_sandbox_require
pnpm --filter @ttsc/test-playground start

Coordination

#670 is resolved in public releases beginning with 0.19.0. #820 is the direct manifest-boundary predecessor. This issue covers verified cases outside those issues' completed acceptance matrices and should not reopen either one.

[samchon]

A fresh package-algorithm pass adds two boundary requirements and rejects one over-broad interpretation.

First, condition objects must reject integer property keys. Exact Node 22 reports ERR_INVALID_PACKAGE_CONFIG for:

{
  "exports": {
    "0": "./zero.cjs",
    "default": "./available.cjs"
  }
}

The current sandbox silently skips "0" and loads default. Node's resolver validates every condition-object key before testing the active set, so the fix must reject numeric keys even when that key is inactive.

Second, manifest-name self-reference is conditional on the caller package declaring exports. An npm alias with only:

{
  "name": "actual-no-exports",
  "main": "./index.cjs"
}

must not resolve an internal require("actual-no-exports/sub") back through the alias mount. Exact Node and the current sandbox both fail that control. The alias fix must preserve it and enable self-reference only when the caller's own manifest has an exports field.

I also tested an exact export key containing a parent segment. The exact Node control accepted the tested key after CommonJS request normalization, despite the documentation's broader path-guidance example. I am not adding a blanket key rejection from prose alone. Target strings and wildcard substitutions remain confined as the issue states; exact-key behavior will follow executable Node controls.

[samchon]

Implemented in #980 and published in @ttsc/playground@0.21.0.

The resolver now carries an explicit package-target decision instead of flattening every branch into interchangeable string candidates. That distinction is what allows the browser CommonJS evaluator to match the tested Node 22 behavior:

• an array may skip an invalid target, but a valid selected target whose file is missing blocks fallback;
• an unresolved nested inactive condition lets the enclosing condition map continue in declaration order;
• null remains a blocker;
• targets must be package-relative and remain confined after wildcard substitution;
• absolute, parent-traversing, node_modules, bare, and encoded separator escapes are rejected;
• manifests cannot mix subpath and condition key families;
• integer condition keys are rejected even when inactive;
• npm aliases may resolve the manifest package name as a self-reference only when the caller package declares exports; and
• self-reference stops at the nearest package scope instead of leaking across mounts.

The implementation also normalizes URL export targets consistently and completes the legacy main / directory index fallback matrix without weakening exports encapsulation.

Direct Node 22 controls were used for the decision matrix, including the intentionally surprising “valid target selected but file missing” array behavior. The original three root forms from #670 and the ordered-condition, pattern, and blocker behavior from #820 remained green.

The complete Playground suite passed all 35 features, including root, exact and pattern exports, aliases, scoped names, relative requires, JSON, cycles, failed-evaluation cache eviction, invalid target confinement, and legacy fallbacks.

Release: https://github.com/samchon/ttsc/releases/tag/v0.21.0