fix(build): unwrap default-only exports in @InQuirer modules

- Add footer to @InQuirer packages to unwrap { default: fn } -> fn
- Remove KNOWN_DEFAULT_ONLY_MODULES whitelist (no longer needed)
- confirm/input/password now export functions directly
- search/select/checkbox keep named exports (Separator) + default
- Ensures CJS compatibility without .default accessor

Author: jdalton

scripts/build-externals/esbuild-config.mjs

@@ -171,6 +171,10 @@ export function getPackageSpecificOptions(packageName) {
   } else if (packageName.startsWith('@inquirer/')) {
     // Inquirer packages have heavy dependencies we might not need.
     opts.external = [...(opts.external || []), 'rxjs/operators']
+    // Inquirer packages export default only - unwrap for CJS compatibility
+    opts.footer = {
+      js: 'if (module.exports && module.exports.default && Object.keys(module.exports).length === 1) { module.exports = module.exports.default; }',
+    }
   } else if (packageName === '@socketregistry/packageurl-js') {
     // packageurl-js imports from socket-lib, creating a circular dependency.
     // Mark socket-lib imports as external to avoid bundling issues.
@@ -270,6 +274,9 @@ export function getEsbuildConfig(entryPoint, outfile, packageOpts = {}) {
     // Banner for generated code
     banner: {
       js: '"use strict";',
+      ...packageOpts.banner,
     },
+    // Footer for generated code (if needed)
+    ...(packageOpts.footer && { footer: packageOpts.footer }),
   }
 }

scripts/validate/external-exports.mjs

@@ -23,16 +23,6 @@ const { pluralize } = require('#socketsecurity/lib/words')
 
 const logger = getDefaultLogger()
 
-// Modules that only export { default } but are correctly handled in code
-// via .default accessor (e.g., confirmExport.default ?? confirmExport)
-const KNOWN_DEFAULT_ONLY_MODULES = new Set([
-  '@inquirer/confirm.js',
-  '@inquirer/input.js',
-  '@inquirer/password.js',
-  '@inquirer/search.js',
-  '@inquirer/select.js',
-])
-
 /**
  * Get all .js files and directories in the external directory.
  */
@@ -90,16 +80,6 @@ function checkExternalExport(filePath) {
 
       // If only key is 'default', it's wrapped incorrectly
       if (keys.length === 1 && keys[0] === 'default') {
-        // Check if this is a known module that's correctly handled in code
-        if (KNOWN_DEFAULT_ONLY_MODULES.has(normalizedPath)) {
-          return {
-            path: normalizedPath,
-            ok: true,
-            keys: 'default-only (handled)',
-            note: 'Uses .default accessor in code',
-          }
-        }
-
         return {
           path: normalizedPath,
           ok: false,