[cramforce]

Stacked on #1434. This branch is based on opt/npm-cjs-exports and merges #1425 (opt/native-undici) for its package-shim registry. Review those first.

Summary

Polyfills that are builtins. Several small npm packages exist only to back-fill Node APIs for old Node versions and browsers. On Node 24, their modules evaluate to the builtin itself. scriptc now compiles a require() of such a package as that builtin expression, at the require's position. The package's own files never join the program, so their feature-detection code (conditional module.exports, {}.toString, typeof window) no longer has to compile.

A require resolves to its builtin in three places:

• an opted-in package's files, using the version installed where Node's resolution from that file finds it;
• the program's own CommonJS files;
• an esbuild __commonJS chunk whose module key names the package and its version (pnpm's node_modules/.pnpm/<name>@<version>/node_modules/<name>/<file>). The chunk's call sites become the builtin and the chunk disappears.

The table lives in builtin-package-aliases.ts. package-shims.ts consults it through the installed version, like the undici entries. Each entry is limited to the major versions whose Node entry file I read:

Package	Versions	Compiles as	Why it is identical on Node 24
isarray	0.x, 1.x, 2.x	Array.isArray	module.exports = Array.isArray || function …. Node always has Array.isArray, so the export is that function.
safe-buffer	5.x	require("buffer")	module.exports = buffer whenever Buffer.from, alloc, allocUnsafe and allocUnsafeSlow exist, which they do since Node 6. The rest of the file only builds the unexported SafeBuffer fallback.
process-nextick-args	2.x	process	module.exports = process unless process.version is v0.x or a pre-1.8 v1.x. Consumers read .nextTick, which is process.nextTick.
inherits	2.x (main file inherits.js)	require("util").inherits	2.0.1 exports require('util').inherits directly. 2.0.3 and later do the same whenever it is a function, which it always is on Node. The browser file is not aliased.
util-deprecate	1.x (main file node.js)	require("util").deprecate	The Node entry is exactly module.exports = require('util').deprecate. The browser file is not aliased.

readable-stream (maintainer-approved divergence). 2.x, 3.x and 4.x compile as node:stream. For 2.x and 4.x that is the package's own READABLE_STREAM=disable behavior:

• In 2.x, readable.js exports stream.Readable carrying Readable, Writable, Duplex, Transform, PassThrough and Stream. writable.js exports stream.Writable. duplex.js, transform.js and passthrough.js read the entry.
• In 4.x, lib/ours/index.js exports a plain object of named stream exports.
• The lib/_stream_*.js files map to the matching builtin classes in every aliased major. Under Node they load the package's own implementations in every environment, so this part goes beyond the disable mode.
• How the entry's export is used picks the replacement. If every use reads one of the carried class names (stream.Transform, { Transform } = require(…)), the replacement is the builtin module. If every use is a value use (inherits(X, Readable), Readable.from), it is stream.Readable. A mixture of the two, or any 4.x value use, keeps the package's own module.
• 3.x (a copy of Node 10's streams): readable.js exports stream.Readable carrying the stream classes, Stream, finished and pipeline; it has no root subpath files. Its own disable branch throws on Node 24: it copies every stream export onto stream.Readable with Object.assign, and Readable inherits the getter-only promises accessor. So 3.x maps the members its default branch exports onto the builtin's, and the docs say this is not a mode the package itself offers on Node 24.
• The divergence is documented on the limitations page, in the dependencies page's built-in packages section, and in internal/compatibility/README.md.

Global detection. A condition built from typeof tests whose answers are static now folds:

• an identifier nothing declares answers "undefined", Node's answer for window, self and document;
• global, globalThis and process answer "object";
• this covers esbuild's minified typeof x < "u" as well as !==, &&, || and ! chains.

So the untaken arm of typeof window < "u" ? window : … never lowers. A detection chain used as a receiver, as in readable-stream's (typeof global < "u" ? global : typeof window < "u" ? window : …).Uint8Array || function () {}, resolves to the global object it selects. JavaScript files no longer report a name that the same file feature-tests with typeof as undeclared; a reached use still meets its located refusal. TypeScript files keep the error and its hint.

Fixes found along the way:

• typeof global.setTimeout and typeof globalThis.queueMicrotask answered "string", the identity token's type. They now answer "function".
• var p = process (the shape process-nextick-args consumers take once it compiles as process) silently lost process's members: p.nextTick was not a function. A var alias of a surfaced global other than the global object now aliases like the const spelling when nothing reassigns it and no earlier code can read it, the rule var Buffer = buffer.Buffer already followed.
• var Transform = require("stream").Transform; new Transform(…) was refused, while the const and destructured spellings compiled. The declaration was already alias plumbing (builtinMemberRequireDecl); stream and EventEmitter construction now follows it too.

Evidence

• npm-static cases. All three check stdout and exit status against Node, and that util-deprecate's warning reaches stderr on both sides. readable-stream runs with READABLE_STREAM=disable on the Node side.
  • 2585-builtin-polyfill-aliases: the published releases of the five polyfills, installed under a consumer package.
  • 2586-readable-stream-builtin: readable-stream 2.3.8 (with its dependencies) through the entry's members, its value, the transform, passthrough, writable and duplex subpaths, and lib/_stream_passthrough.js. Also the 4.7.0 entry.
  • 2587-bundled-polyfill-aliases: real esbuild 0.27 output of a pnpm-installed source using all six packages.
• Corpus programs:
  • readable-stream-disable/ sets READABLE_STREAM=disable before its first require, so Node takes the same branch. Its header notes that default-environment output differs: rs.Readable === stream.Readable is false there.
  • readable-stream-3/ runs the vendored readable-stream 3.6.2 under Node, without the disable variable, and keeps to behavior its streams share with the builtin: piping through transforms, the pipeline and finished callbacks, and error propagation. Before the alias it was refused (SC2013, no declarations).
  • global-detection-typeof.cjs: the detection idioms, the folded chains, the selected global's members, and typeof through the global object.
• Unit tests:
  • the alias table per major;
  • pnpm key parsing;
  • bundled chunk aliasing, run against the original bundle under Node;
  • the use-dependent readable-stream replacement, including the mixed case that keeps the chunk.
• The npm-static suite (120 tests), the affected npm cases, the corpus selection, pnpm lint, pnpm format:check and test:ts7 --baselines-only all pass.
• Zero-cost gate against this branch's merge base: PASS. All 2502 programs (bench, self, corpus) are byte-identical. Bench geomean is −1.6% and self +0.6%, both within tolerance.
• Zero-cost gate for the readable-stream 3.x commit (together with the stacked unloaded change), against 8a40fb5: PASS. All 2502 programs (bench, self, corpus) are byte-identical; bench geomean is −0.18%.
• The self-hosted compiler builds its IR cleanly, and self-hosting-native-driver.test.ts passes.
• pnpm format:check also flags lowerer.ts and type-mapper.ts. Those come from Compile undici from a built-in implementation #1425's tree; this branch does not touch them.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
scriptc	Ready	Preview, v0	Oct 20, 2026 11:22pm UTC

[vercel-security-reviewer]

Security review details

[vercel]

Additional findings

1. packages/compiler/src/frontend/npm-static-bundled-chunks.ts:562-564 — Builtin alias replacements can bind to a local process or Array instead of the builtin, changing the required package's value or making initialization fail.

   

2. packages/compiler/src/frontend/package-shims.ts:180-185 — An installed polyfill marked unloaded in scriptc.packages is still rewritten to its builtin, so its require succeeds instead of throwing MODULE_NOT_FOUND.

   

3. packages/compiler/shims/undici/core/request.ts:230-233 — A Host header containing CR/LF bypasses value validation and is written verbatim to the socket, allowing header or request injection in compiled undici clients.

   

[vercel]

Additional findings

1. packages/compiler/shims/fs-extra/core/api.ts:1083-1085 — Recursive copySync can delete a source file when a nested destination symlink points back into the source tree because child paths bypass the same-inode check.