Bundling SSR Modules using CommonJS exports alias results in ReferenceError: exports is not defined

Describe the bug

When importing an SSR module, if

• it uses the exports alias instead of module.exports,
• ssr.noExternal is declared with the module

Vite is unable to evaluate it. This can also happen with the more common module.exports, but seems to not be guaranteed.

While this behavior may seem esoteric due to modern proliferation of module.exports, this is a feature of Node since v0.1.16 and has not been deprecated. In addition, there are instances of various npm modules in the wild which use this method of exporting fields, including, but not limited to:

• chokidar
• cookie
• consolidate
• d3 (node)
• @material-ui/core
• mysql2
• topcoat-preact

…and much, much, more searchable on GitHub. I believe this is also an output of some bundlers.

Reproduction

https://github.com/GrygrFlzr/vite-cjs-ssr

git clone https://github.com/GrygrFlzr/vite-cjs-ssr.git
cd vite-cjs-ssr
npm i
npm run dev

Visit http://localhost:3000 to trigger SSR, which consists of a very simple script that uses the cookie npm module. The page will render exports is not defined and errors will show up in the server console:

6:29:45 PM [vite] new dependencies found: cookie, updating...
6:29:45 PM [vite] Error when evaluating SSR module /node_modules/cookie/index.js:
ReferenceError: exports is not defined
    at /node_modules/cookie/index.js:15:1
    at instantiateModule (C:\Users\GrygrFlzr\Documents\projects\vite-cjs\node_modules\vite\dist\node\chunks\dep-efe32886.js:68893:166)
ReferenceError: exports is not defined
    at /node_modules/cookie/index.js:13:1
    at instantiateModule (C:\Users\GrygrFlzr\Documents\projects\vite-cjs\node_modules\vite\dist\node\chunks\dep-efe32886.js:68893:166)

System Info

• vite version: 2.1.2
• Operating System: Windows 10 10.0.19042
• Node version: 14.16.0
• Package manager and version: npm 6.14.11

[benmccann]

Vite is an integral part of SvelteKit that provides many benefits such as code changes showing up instantly, code splitting for fast loading sites, etc. The Vite team has been nothing but helpful in resolving issues and have both fixed issues for us and accepted patches from us. Vite 2.7 to be released shortly will solve the majority of issues we’re aware of and we’re already working on Vite 2.8 with additional fixes. I’m aware Vite issues have been some of the most common to encounter with SvelteKit, but that’s changing very rapidly and we’re definitely not dropping Vite. Also, the majority of 1.0 blockers are in SvelteKit itself and not in Vite.

[IsaacHub]

If a package bundler called vite is ruining the reputation and preventing the release of the most loved JS framework SvelteKit for several months, then why don’t Svelte team and Rich Harris drop/discard the vite thing entirely ? They can utilize a bundler which actually works, their own rollup maybe? All the blocking issues for sveltekit belong to vite. Or is this a core issue of sveltekit way of SSR implementation?