@nubjs/nub-win32-arm64 0.0.42 → 0.0.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nubjs/nub-win32-arm64",
-  "version": "0.0.42",
+  "version": "0.0.45",
   "description": "Nub binary for win32-arm64",
   "license": "MIT",
   "repository": "https://github.com/nubjs/nub",

package/runtime/polyfills.cjs

@@ -32,6 +32,38 @@ const __require = createRequire(__filename);
 function installSyncPolyfills(preloaded) {
   preloaded = preloaded || {};
 
+  // ── Web Storage: neutralize the throwing localStorage getter ────────
+  // When nub injects `--experimental-webstorage` on the 22.4–24 band AND the user
+  // did NOT pass `--localstorage-file`, Node installs a `localStorage` global that
+  // is a getter THROWING `ERR_INVALID_ARG_VALUE` on ANY access — even
+  // `typeof localStorage` throws, so feature-detection is impossible and the throw
+  // can surface before user code expects it. The spawn layer signals this case via
+  // the internal `__NUB_NEUTRALIZE_LOCALSTORAGE` env var (set iff flag-injected ∧
+  // no user file). Replace the throwing getter with a plain `undefined` value —
+  // matching Node 25+'s clean shape — so `typeof localStorage === "undefined"` is
+  // true and no throw occurs; `sessionStorage`, which needs only the flag, keeps
+  // working. This runs in the preload BEFORE any user code, so the throwing getter
+  // is never observed. When the user passes `--localstorage-file`, the env var is
+  // absent and `localStorage` works normally (we do not touch it). We deliberately
+  // KEEP the env var set so it inherits to the whole process subtree: a `node`- or
+  // `nub`-spawned grandchild re-inherits the webstorage flag via NODE_OPTIONS and
+  // would otherwise re-install the throwing getter with no neutralize signal. It's
+  // an internal `__NUB_*` plumbing var that's explicitly fine to leak to children.
+  // Neutralization is idempotent — a descendant re-running this preload with the
+  // var still set just re-defines `localStorage` to undefined again, which is
+  // harmless. The descriptor is configurable+writable so user code can still assign
+  // its own `localStorage`.
+  if (process.env.__NUB_NEUTRALIZE_LOCALSTORAGE) {
+    try {
+      Object.defineProperty(globalThis, "localStorage", {
+        value: undefined,
+        configurable: true,
+        writable: true,
+        enumerable: false,
+      });
+    } catch { /* descriptor non-configurable on this runtime: leave Node's behavior */ }
+  }
+
   // ── reportError (WinterTC min-common-API, not in any Node) ──────────
   // Defined NON-ENUMERABLE so it is invisible to `Object.keys(globalThis)` /
   // for-in / structured-clone-of-keys — that invisibility-to-enumeration IS the

package/runtime/preload-common.cjs

@@ -159,6 +159,44 @@ function installUserHookDetector() {
   try { module_.registerHooks = wrapped; } catch {}
 }
 
+// ── Internal `module.register()` without the DEP0205 leak ────────────
+// `module.register()` is the loader-WORKER registration surface (async ESM hooks in
+// a dedicated thread). nub uses it for the compat tier (18.19–22.14, where the sync
+// `module.registerHooks` doesn't exist) and for the fast tier's
+// `--no-experimental-require-module` fallback (where `require(esm)` is off, so the
+// in-thread sync hooks can't load transform-core.mjs synchronously). On Node 26+,
+// `module.register()` emits a one-shot `[DEP0205]` DeprecationWarning steering callers
+// to `module.registerHooks()` — but nub CANNOT use `registerHooks` on these paths
+// (no sync surface on compat; no sync core load when require(esm) is disabled), and
+// the deprecation is for nub's OWN internal call, not anything the user wrote: the
+// user has no action to take, so the warning is pure noise on their stderr. Suppress
+// exactly that DEP0205 emission for the duration of nub's own register() call, then
+// restore `process.emitWarning` untouched, so a user's later `module.register()` (or
+// any other deprecation) still warns normally. Default-preserving: only nub's
+// internal call is silenced, only for DEP0205, only on the versions that emit it.
+function registerLoaderWorker(specifier, parentURL, options) {
+  const realEmitWarning = process.emitWarning;
+  let restored = false;
+  const restore = () => {
+    if (restored) return;
+    restored = true;
+    try { process.emitWarning = realEmitWarning; } catch {}
+  };
+  try {
+    process.emitWarning = function (warning, ...rest) {
+      // Node calls emitWarning(msg, 'DeprecationWarning', 'DEP0205', ...) for the
+      // module.register() deprecation. Swallow only that exact code; pass everything
+      // else (including any non-DEP0205 deprecation) straight through.
+      const code = typeof rest[0] === "object" && rest[0] !== null ? rest[0].code : rest[1];
+      if (code === "DEP0205") return;
+      return realEmitWarning.call(this, warning, ...rest);
+    };
+    return module_.register(specifier, parentURL, options);
+  } finally {
+    restore();
+  }
+}
+
 function makeHooks(core, watchReporting) {
   installUserHookDetector();
 
@@ -763,6 +801,7 @@ function reenableUserCompileCache() {
 
 module.exports = {
   installWatchReporting,
+  registerLoaderWorker,
   makeHooks,
   installCjsRequireHooks,
   preloadPolyfillPackages,

package/runtime/preload.cjs

@@ -143,7 +143,11 @@ if (!requireEsmDisabled) {
   // through the registered loader-worker hooks. User require(esm) of THEIR own ES
   // modules still gets Node's native ERR_REQUIRE_ESM, exactly as the flag promises.
   const { pathToFileURL } = require("node:url");
-  module_.register("./preload-async-hooks.mjs", pathToFileURL(__filename).href);
+  // Via the shared helper so Node 26+'s DEP0205 (steering to module.registerHooks) is
+  // not leaked onto the user's stderr — nub is forced onto module.register here
+  // because require(esm) is off, so registerHooks' in-thread sync core load is
+  // impossible; the user has no action to take. See registerLoaderWorker.
+  common.registerLoaderWorker("./preload-async-hooks.mjs", pathToFileURL(__filename).href);
 
   // Sync, non-require(esm) polyfills still install (none of them require(esm)).
   // Clobbered-polyfill packages are CJS requires, unaffected by the flag.

package/runtime/preload.mjs

@@ -80,7 +80,11 @@ if (__isFastTier) {
   // Compat path: ESM `import` hooks run in a dedicated loader worker thread. That
   // worker resolves PnP deps via pnpapi.resolveRequest itself (preload-async-
   // hooks.mjs), so no Yarn `.pnp.loader.mjs` registration is needed here either.
-  module.register("./preload-async-hooks.mjs", import.meta.url);
+  // Via the shared helper so any DEP0205 from nub's own register() call (Node 26+,
+  // if this compat path is ever reached there) is not leaked onto the user's stderr.
+  // On the compat tier proper (18.19–22.14) registerHooks doesn't exist, so the
+  // loader-worker is the only hook surface; the user has no action to take.
+  common.registerLoaderWorker("./preload-async-hooks.mjs", import.meta.url);
   // (The main-thread require() shim's module-format + decorator detection is a
   // synchronous native addon call now — no parser warm-up; the old
   // `await core.ensureParser()` for the ESM-only oxc-parser is gone.)

package/runtime/transform-core.mjs

@@ -160,22 +160,6 @@ export const TRANSPILE_EXTS = new Set([".ts", ".tsx", ".mts", ".cts", ".jsx"]);
 export const DATA_EXTS = { ".jsonc": "jsonc", ".json5": "json5", ".toml": "toml", ".yaml": "yaml", ".yml": "yaml", ".txt": "txt" };
 export const TS_PARENT_EXTS = new Set([".ts", ".tsx", ".mts", ".cts"]);
 
-// Reserved words / literals that cannot be a lexical binding name in a module
-// (modules are strict mode). A data file with a top-level key like `package`
-// (e.g. a Cargo.toml `[package]` table) must NOT emit `export const package = …`
-// — that is a SyntaxError that takes down the whole module, default export
-// included. Such keys stay reachable via the default export. Matches bun, which
-// deoptimizes invalid-identifier keys rather than failing the whole module.
-const RESERVED_EXPORT_NAMES = new Set([
-  "break", "case", "catch", "class", "const", "continue", "debugger", "default",
-  "delete", "do", "else", "enum", "export", "extends", "false", "finally", "for",
-  "function", "if", "import", "in", "instanceof", "new", "null", "return", "super",
-  "switch", "this", "throw", "true", "try", "typeof", "var", "void", "while", "with",
-  // Strict-mode (modules are always strict) future-reserved + restricted names:
-  "implements", "interface", "let", "package", "private", "protected", "public",
-  "static", "yield", "await", "eval", "arguments",
-]);
-
 // Packages resolved from Nub's distribution, not the user's.
 export const VENDORED_PACKAGES = new Set(["@oxc-project/runtime"]);
 
@@ -689,15 +673,12 @@ export function loadData(url, ext) {
     return { format: "module", source: "export default undefined;\n", shortCircuit: true };
   }
 
-  let code = `const _data = ${JSON.stringify(parsed)};\nexport default _data;\n`;
-  if (typeof parsed === "object" && !Array.isArray(parsed)) {
-    for (const key of Object.keys(parsed)) {
-      // Emit a named export only for keys that are valid, non-reserved binding
-      // identifiers; everything else remains reachable via the default export.
-      if (/^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key) && !RESERVED_EXPORT_NAMES.has(key)) {
-        code += `export const ${key} = _data[${JSON.stringify(key)}];\n`;
-      }
-    }
-  }
+  // Default export only. Data modules deliberately do NOT emit per-key named
+  // exports: named imports of data are categorically un-typeable in TypeScript
+  // (a `declare module "*.yaml"` wildcard has no per-key export index signature),
+  // and default-only matches Node's own JSON modules. Consumers destructure the
+  // default — `import cfg from "./c.yaml"; const { host } = cfg;` — which the
+  // `@nubjs/types` `Record<string, unknown>` default type makes sound.
+  const code = `export default ${JSON.stringify(parsed)};\n`;
   return { format: "module", source: code, shortCircuit: true };
 }

package/runtime/version.mjs

@@ -9,4 +9,4 @@
 // previously lived as a literal inside preload.mjs, which `make version` patched,
 // while the worker carried a hand-maintained "…-compat" copy that `make version`
 // never touched — a latent staleness bug this module closes.)
-export const NUB_VERSION = "0.0.42";
+export const NUB_VERSION = "0.0.45";