111 is caused by the Rollup (`unbuild` uses Rollup under the hood) incorrectly bundling `@npmcli/config` (and its transitive dependency `cacache`, which requires its own `package.json`).

The PR provides a workaround by changing how dists are bundled. A test case has also been added to ensure the CLI itself should never crash.

111

This is a workaround that works for now. I am still investigating a better solution that solves the issue once and for all.

Here are the backgrounds behind #111 and this PR:

@npmcli/config requires cacache, and cacache requires its own package.json. This causes @rollup/plugin-commonjs to panic. Instead of using the correct named exports generated from @rollup/plugin-json, @rollup/plugin-commonjs try to wrap the exports with its interop code, causing cacache to fail.
- Solution: change @rollup/plugin-commonjs's requireReturnsDefault to auto, disable @rollup/plugin-json's namedExports optimization.
@npmcli/config also requires semver/function/valid. Since @npmcli/config is a CJS module, require('semver/function/valid') works just fine. However, when Rollup bundles the dist, it transforms require('semver/function/valid') into import 'semver/function/valid' which is an invalid ESM import (missing the extname, it should be import 'semver/function/valid.js'), causing the error of #111.
- Solution: bundle the entire semver as well, preventing transitive dependency from becoming external.
- Bundling semver would cause another build error, since unbuild includes @types/semver to be parsed by the rollup.
- Solution: enable rollup-plugin-dts's respectExternal.