test: lock in lenient ESM for ambiguous and CJS-typed packages

## Problem

tsx is intentionally more lenient than Node when classifying ambiguous
packages: a `.js`/`.ts` file in a `package.json` without `"type"` (or
with `"type": "commonjs"`) that mixes ESM `import`/`export` syntax with
explicit `require()` calls runs successfully. tsx classifies the file as
CJS and esbuild rewrites the ESM imports while passing `require`
through. Plain Node detection refuses these files (`ReferenceError:
require is not defined in ES module scope`); tsx's existing lenient
behavior is what lets a decade of pre-ESM TypeScript projects keep
running.

This contract was not exercised by any test. A speculative "match Node's
syntax detection" refactor against an earlier head of this branch passed
the full suite while silently breaking every hybrid file. These tests
close that gap.

## Changes

New `commonjs-mode-contracts.ts` block `lenient ESM in
CommonJS-classified files`, exercising four shapes through the existing
`commonJsModes` loop (`omitted type` and `explicit commonjs` shapes per
test):

- hybrid `import` + bare `require()` in `.ts`
- TypeScript `import x = require()` interop combined with bare
`require()`
- hybrid `import` + bare `require()` in `.js`
- `export` paired with bare `require()` of a `.cjs` sibling

Each test asserts exit 0, expected stdout, and empty stderr, with the
existing `onTestFail(() => console.log(label, result))` pattern so the
failing shape is visible.

Author: privatenumber

tests/specs/commonjs-mode-contracts.ts

@@ -147,4 +147,168 @@ export const commonJsModeContracts = (node: NodeApis) => describe('CommonJS mode
 			});
 		}
 	});
+
+	// tsx is intentionally more lenient than Node for ambiguous-`type` and
+	// explicit `"commonjs"` packages: a `.js`/`.ts` file that mixes ESM
+	// `import`/`export` syntax with explicit `require()` calls still runs,
+	// because tsx classifies the file as CJS and esbuild rewrites the ESM
+	// imports while leaving `require` intact. Plain Node would refuse the
+	// same file with `ReferenceError: require is not defined in ES module
+	// scope`. Any "match Node's syntax detection" refactor of the classifier
+	// must keep these passing or be split behind a feature flag.
+	describe('lenient ESM in CommonJS-classified files', () => {
+		// Hybrid `import` + bare `require()` in a TypeScript file. The naive
+		// failure mode is detection promoting the file to "module", which
+		// drops `require` from scope.
+		test('hybrid import and require() in .ts runs', async () => {
+			for (const { label, packageJson } of commonJsModes) {
+				await using fixture = await createFixture({
+					'package.json': createPackageJson(packageJson),
+					'entry.ts': `
+						import { posix } from 'node:path';
+
+						const config = require('./config.json');
+
+						console.log(JSON.stringify({
+							joined: posix.join('/', 'foo'),
+							config,
+						}));
+						`,
+					'config.json': JSON.stringify({ loaded: true }),
+				});
+
+				const result = await node.tsx(['entry.ts'], fixture.path);
+				onTestFail(() => {
+					console.log(label, result);
+				});
+
+				expect({
+					failed: result.failed,
+					exitCode: result.exitCode,
+					stdout: result.stdout,
+					stderr: result.stderr,
+				}).toEqual({
+					failed: false,
+					exitCode: 0,
+					stdout: '{"joined":"/foo","config":{"loaded":true}}',
+					stderr: '',
+				});
+			}
+		});
+
+		// TypeScript `import x = require()` interop combined with additional
+		// bare `require()` calls. Detection promotion would break the bare
+		// `require()` even when the `import =` form is preserved.
+		test('TypeScript import = require() interop with bare require() runs', async () => {
+			for (const { label, packageJson } of commonJsModes) {
+				await using fixture = await createFixture({
+					'package.json': createPackageJson(packageJson),
+					'entry.ts': `
+						import path = require('node:path');
+
+						const config = require('./config.json');
+
+						console.log(JSON.stringify({
+							joined: path.posix.join('/', 'foo'),
+							config,
+						}));
+						`,
+					'config.json': JSON.stringify({ loaded: true }),
+				});
+
+				const result = await node.tsx(['entry.ts'], fixture.path);
+				onTestFail(() => {
+					console.log(label, result);
+				});
+
+				expect({
+					failed: result.failed,
+					exitCode: result.exitCode,
+					stdout: result.stdout,
+					stderr: result.stderr,
+				}).toEqual({
+					failed: false,
+					exitCode: 0,
+					stdout: '{"joined":"/foo","config":{"loaded":true}}',
+					stderr: '',
+				});
+			}
+		});
+
+		// Same hybrid shape, but in a `.js` file with no TypeScript syntax.
+		// Detection refactors that key off ESM tokens in plain JS regress
+		// here too -- the `.js` extension is not a hint either way without
+		// a `"type"` field.
+		test('hybrid import and require() in .js runs', async () => {
+			for (const { label, packageJson } of commonJsModes) {
+				await using fixture = await createFixture({
+					'package.json': createPackageJson(packageJson),
+					'entry.js': `
+						import { posix } from 'node:path';
+
+						const config = require('./config.json');
+
+						console.log(JSON.stringify({
+							joined: posix.join('/', 'foo'),
+							config,
+						}));
+						`,
+					'config.json': JSON.stringify({ loaded: true }),
+				});
+
+				const result = await node.tsx(['entry.js'], fixture.path);
+				onTestFail(() => {
+					console.log(label, result);
+				});
+
+				expect({
+					failed: result.failed,
+					exitCode: result.exitCode,
+					stdout: result.stdout,
+					stderr: result.stderr,
+				}).toEqual({
+					failed: false,
+					exitCode: 0,
+					stdout: '{"joined":"/foo","config":{"loaded":true}}',
+					stderr: '',
+				});
+			}
+		});
+
+		// `export` paired with bare `require()` against a sibling `.cjs`
+		// module. Symmetric coverage with the `import` cases above and
+		// pins the export-side of the lenient contract.
+		test('export with bare require() of a .cjs sibling runs', async () => {
+			for (const { label, packageJson } of commonJsModes) {
+				await using fixture = await createFixture({
+					'package.json': createPackageJson(packageJson),
+					'entry.ts': `
+						const local = require('./util.cjs');
+
+						export const result = local.value;
+
+						console.log('result:', result);
+						`,
+					'util.cjs': 'module.exports.value = "from-cjs";',
+				});
+
+				const result = await node.tsx(['entry.ts'], fixture.path);
+				onTestFail(() => {
+					console.log(label, result);
+				});
+
+				expect({
+					failed: result.failed,
+					exitCode: result.exitCode,
+					stdout: result.stdout,
+					stderr: result.stderr,
+				}).toEqual({
+					failed: false,
+					exitCode: 0,
+					stdout: 'result: from-cjs',
+					stderr: '',
+				});
+			}
+		});
+	});
 });