[cramforce]

Stacked on #1458. One commit per fix, in the order a bundled package hits them while it loads.

Summary

• Settled variable exports. module.exports = x and module.exports = { x } copy x's value at that statement. Every var or let export used to be fenced. esbuild hoists a bundled module's top-level const to a var in its __commonJS chunk, so a bundle stopped at load (into-stream's module.exports = intoStream2, async-sema's Sema). The export now compiles when the binding's declaration and every write sit in top-level code above it, outside functions and classes. A later write keeps the fence.
• Members of a var- or const-bound function export. The package rewrite that reaches module.exports.x through a whole-function export now accepts a function expression or arrow bound to a var/const, and require bindings above the export. Without this, into-stream's .default/.object read undefined.
• Merged require declarations. A minifier merges var minimatch = require_minimatch(), Minimatch = minimatch.Minimatch, … (glob). Inside such a statement the required module was never stored, so the member read undefined and later references failed. A package-file stage now splits a top-level declaration that mixes require initializers with other declarators into one declaration per declarator, in order and on the same lines.
• semver's token table. exports = module.exports = SemVer comes before var t = exports.tokens = {}, and the hoisted SemVer reads t. The export store counted as a possible early call, so t became runtime-optional and tok's t[n] = R++ was fenced at load. A reference that only stores or extends the function now counts as settled when no top-level code up to the settling statement can re-enter the module: no user-code call, construction, require, or read of module/exports. The split stage also respells var t = exports.tokens = {} as var t = {}; exports.tokens = t;; before, writes through t silently never reached exports.tokens.
• fs.realpathSync as a value (fs.realpath, under glob). The value is an adapter over the native call. Node's options can change the result's encoding, so the adapter takes the call only for a string path with UTF-8 options (none, "utf8", or an object without another encoding, such as fs.realpath's cache object). Other shapes throw a located SC1090 fence. Documented on the builtin function values page.
• Members attached to a whole export, in program files. module.exports = format; module.exports.shout = shout (with or without exports =) attaches shout to the function. Reading format.shout through a requirer's binding answered undefined, and calling it threw. Reads now resolve to the member's value when it is written once; calls resolve when the function ignores this, and otherwise fence by name. Applying the package rewrite to program files was not the fix: it turns member exports into expandos, which breaks destructured requires (corpus 6431).

Follow-up (int/bc round 7 regression). The relaxation above (require bindings before the export count as inert) also let the rewrite respell a function declaration's member exports as members of the function. cross-spawn 7's typed module.exports.sync = spawnSync then needed a dynamic value and failed at load (SC1101). Behind requires, only a function bound to a variable is respelled now; declarations keep their member exports (npm-static case 2596-function-export-members, plus a unit test). Gate for that commit against the previous tip: all 3434 programs identical except the fs-extra-package shim-path artifact. The driver passes.

Evidence

All npm-static cases use real esbuild 0.27 output (--bundle --platform=node --format=cjs --minify-whitespace --minify-syntax) unless noted:

• 2591-bundled-var-export (into-stream's shape);
• 2592-bundled-merged-requires (glob's merged declaration over a minimatch-like ES5 constructor);
• 2593-bundled-semver-tokens (semver 6's load-time shape, with the hoisted constructor reading the table);
• 2594-fs-realpath-values, with fs.realpath 1.0.0 vendored unmodified.

Each matches Node byte for byte. Each fails on #1458's tip, either with the fence or with wrong output.

Corpus programs:

• 6484-cjs-settled-exports/: a hoisted var function export, a table settled by loops and conditionals, and var/let classes;
• 6485-cjs-whole-export-members/: both export spellings, reads and calls.

Unit and coverage tests:

• cjs-settled-exports.test.ts: fences stay for later writes and for this-reading member calls;
• npm-static-cjs-exports-alias.test.ts and npm-static-split-declarations.test.ts: rewritten modules run against their originals under Node.

The real packages: semver 6.3.1's chunk now loads, and glob 8.0.3's bundle gets past Minimatch and fs.realpath. Remaining stops are listed in the notes.

• Zero-cost gate against Compile polyfill packages that are Node builtins as the builtins #1458's tip, with the full corpus (--corpus=all, 3432 programs): bench, self and corpus are byte-identical except fs-extra-package, whose IR differs only by the fs-extra shim's absolute checkout path (identical once /vercel/sandbox/{pbase,cand} is normalized). Bench geomean −1.21%.
• The self-hosted compiler builds, and self-hosting-native-driver.test.ts passes on the final tip (1213 s).
• pnpm lint, pnpm format:check and test:ts7 --baselines-only pass; only the new fixtures' baselines were added.
• The npm, npm-static and package-shims suites, the frontend unit tests and cjs-settled-exports.test.ts pass 1137 of 1138. The one failure, node24-url-authority, comes from the sandbox's Node 24.15 versus the pinned 24.22.

Note for reviewers: fs.realpathSync as a value (commit "Store fs.realpathSync as a function value") was also on another agent's queue; it is complete here, so that work can be dropped.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
scriptc	Ready	Preview, v0	Oct 21, 2026 6:48am UTC

[cramforce]

Closing this under the scope-B plan the maintainer approved (native compilation for typed code; Node islands for the rest). Loading bundled CommonJS dependencies, which covers settled var exports, merged require declarations, semver's token table and members attached to a whole export, is CommonJS export-object emulation. Under scope B those packages run as Node islands rather than through more native emulation (D1/D2 in the plan), so this branch will not merge.

What is salvaged:

• The tsc interop-helper unwrapping from Unwrap tsc's interop helpers around builtins; lower re-exports of empty and entry namespaces #1584 (npm-static-tsc-helpers.ts, with the tsc-builtin-interop npm case and its unit tests) is needed by typed, tsc-emitted packages. It is reopened against main as Unwrap tsc's interop helpers around builtin modules in packages #1683.
• fs.realpathSync as a value already landed separately in Bind builtin static functions and read Buffer.alloc, fs.realpathSync and String methods as values #1553.

What is not salvaged:

• Pass the exports object as this to exported functions that read sibling exports #1610 (passing the exports object as this to exported functions) was also merged only into this branch. It is a CommonJS export-form mechanism of the same kind as module-member-this.ts, which the plan deletes under D2, so it goes to islands with the rest of this PR.
• The bundled-ESM half of Unwrap tsc's interop helpers around builtins; lower re-exports of empty and entry namespaces #1584 (empty and entry namespace re-exports in esbuild bundles) is bundler interop (D1).

The branch stays in place for reference.