Refs: - https://publint.dev/docs/ Some thoughts: - All js packages should be verified by `publint` - This process should part of `CI` - Not sure if `publint` could catch https://github.com/rolldown/rolldown/pull/6926, but it's indeed a motivator.