fix(exports): allow CommonJS entry resolution

[jihtsan]

Types of changes

• Bug fix (a non-breaking change which fixes an issue)

Description

require.resolve('nuxt-security') fails with ERR_PACKAGE_PATH_NOT_EXPORTED because the package entry only has types and import conditions. Add a default condition pointing at the existing ESM entry, preserving the order and targets of both existing conditions.

This addresses the package-path resolution failure reported in #681. The separate Bun/Nuxt compatibility warning in that Issue has not been reproduced; Bun is unavailable in the verification environment.

Validation

• Reproduced the error using the actual npm nuxt-security@2.6.0 tarball in a temporary consumer.
• Built and packed the patched package, then verified CommonJS require.resolve, a real ESM import returning the module function, and resolution with the types condition. ESM/types resolve to the same entries before and after the fix. The consumer used the checkout's installed dependencies for the real module import.
• Added a regression test with a temporary consumer for CommonJS, ESM and types-condition resolution.
• Node 24.20.0 / Yarn 1.22.19: yarn dev:prepare, yarn lint, yarn prepack, and yarn test passed (155 tests passed, one existing skipped test; all 19 files passed).

Refs #681.

Checklist

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.

[vercel]

@jihtsan is attempting to deploy a commit to the Baroshem's projects Team on Vercel.

A member of the Team first needs to authorize it.