Load bundled CommonJS dependencies: settled exports, merged requires, semver's tokens, fs.realpath, whole-export members

docs/content/limitations/builtin-function-values.mdx

@@ -4,6 +4,7 @@ Some builtins can be stored and passed as functions:
 - Supported zero-argument `node:os` functions and `querystring.escape`/`unescape`.
 - `util.isDeepStrictEqual`, `styleText`, `stripVTControlCharacters`, `toUSVString`, `inherits`, `deprecate`, `callbackify`, `debuglog`, and `debug`.
 - `fs.existsSync`, `unlinkSync`, `chmodSync`, `chownSync`, `renameSync`, and `closeSync`, and `fs/promises.unlink`, `chmod`, and `rename`.
+- `fs.realpathSync`, called with a string path and options that keep the UTF-8 encoding (none, `"utf8"`, or an object without another `encoding`, such as fs.realpath's cache object). Other paths or encodings throw `SC1090` where the call runs.
 
 In JavaScript, `setTimeout`, `setInterval`, `setImmediate`, `clearTimeout`, `clearInterval`, `clearImmediate`, `queueMicrotask`, and `process.nextTick` are function values wherever they are stored, including conditional and logical expressions and assignments: `typeof` answers `"function"`, identity holds across spellings, and calls schedule as the direct calls do, returning the same numeric timer handles.
 Calls through these values bypass `node:test` mock timers.

packages/compiler/src/frontend/lowering/binding-analysis.ts

@@ -61,6 +61,73 @@ export function bindingNeverReassigned(lowerer: Lowerer, sym: ts.Symbol, decl: t
   return !written;
 }
 
+/** True when a module-scope variable's value is settled before the
+ * top-level statement `at` runs, and stays that way: its declaration is a
+ * top-level statement above `at`, and every write (the initializer
+ * included) sits in top-level code above `at`, outside any function or
+ * class body. A CommonJS export of the binding at `at` then copies the
+ * value the binding keeps forever, so reading the binding itself is
+ * exact (esbuild hoists a bundled module's top-level `const` to such a
+ * `var`). */
+export function bindingSettledBefore(lowerer: Lowerer, sym: ts.Symbol, at: ts.Statement): boolean {
+  const sf = at.getSourceFile();
+  if (at.parent !== sf) return false;
+  const decls = sym.declarations;
+  if (decls.length !== 1) return false;
+  const decl = decls[0]!;
+  if (!ts.isVariableDeclaration(decl) || !ts.isIdentifier(decl.name)) return false;
+  const stmt = decl.parent?.parent;
+  if (stmt === undefined || !ts.isVariableStatement(stmt) || stmt.parent !== sf) return false;
+  const limit = at.getStart(sf);
+  if (stmt.getEnd() > limit) return false;
+  const symText = ts.symbolName(sym);
+  const namesSym = (e: ts.Node): boolean =>
+    ts.isIdentifier(e) && e.text === symText && lowerer.resolveValueSymbol(e) === sym;
+  let settled = true;
+  // `nested`: inside a function or class body, where code can run later.
+  const scanTarget = (t: ts.Expression, nested: boolean): void => {
+    let e: ts.Expression = t;
+    while (ts.isParenthesizedExpression(e)) e = e.expression;
+    let hit = namesSym(e);
+    if (!hit && (ts.isArrayLiteralExpression(e) || ts.isObjectLiteralExpression(e))) {
+      const walk = (n: ts.Node): void => {
+        if (namesSym(n)) hit = true;
+        else n.forEachChild(walk);
+      };
+      walk(e);
+    }
+    if (hit && (nested || t.getEnd() > limit)) settled = false;
+  };
+  const visit = (n: ts.Node, nested: boolean): void => {
+    if (!settled) return;
+    const inner =
+      nested ||
+      ts.isFunctionLike(n) ||
+      ts.isClassDeclaration(n) ||
+      ts.isClassExpression(n) ||
+      ts.isClassStaticBlockDeclaration(n);
+    if (ts.isBinaryExpression(n)) {
+      const k = n.operatorToken.kind;
+      if (k >= ts.SyntaxKind.FirstAssignment && k <= ts.SyntaxKind.LastAssignment) {
+        scanTarget(n.left, nested);
+      }
+    } else if (
+      (ts.isPrefixUnaryExpression(n) || ts.isPostfixUnaryExpression(n)) &&
+      (n.operator === ts.SyntaxKind.PlusPlusToken || n.operator === ts.SyntaxKind.MinusMinusToken)
+    ) {
+      scanTarget(n.operand as ts.Expression, nested);
+    } else if (
+      (ts.isForOfStatement(n) || ts.isForInStatement(n)) &&
+      !ts.isVariableDeclarationList(n.initializer)
+    ) {
+      scanTarget(n.initializer as ts.Expression, nested);
+    }
+    n.forEachChild((c) => visit(c, inner));
+  };
+  sf.forEachChild((c) => visit(c, false));
+  return settled;
+}
+
 /** Strips the value-preserving wrappers off an expression: parens,
  * non-null assertions, `as`/`satisfies`/angle-bracket casts. What
  * remains is the expression that actually evaluates. */