@seanhogg/builderforce-webcontainers-core 2026.10.2 → 2026.10.4

package/src/node/childProcess.ts

@@ -0,0 +1,164 @@
+/**
+ * `child_process` over the system's `spawn`: every "process" is another program
+ * of this runtime (node, npm, the shell and its commands). There are no native
+ * executables, so spawning one fails with ENOENT exactly as a missing binary
+ * would. Synchronous variants cannot block a browser thread on another one, so
+ * they throw a clear error instead of hanging.
+ */
+import { EventEmitterBase } from './events.js';
+import { Readable } from './stream/readable.js';
+import { Writable } from './stream/writable.js';
+import type { EventLoop } from './loop.js';
+import type { ChildHandle, System } from '../system/types.js';
+
+interface SpawnOptions {
+  cwd?: string;
+  env?: Record<string, string | undefined>;
+  shell?: boolean | string;
+  stdio?: unknown;
+  signal?: AbortSignal;
+  encoding?: string;
+  maxBuffer?: number;
+}
+
+export interface ChildProcessDeps {
+  system: System;
+  loop: EventLoop;
+  cwd(): string;
+  env(): Record<string, string | undefined>;
+  /** Parent's stdio for `stdio: 'inherit'`. */
+  stdout(chunk: string): void;
+  stderr(chunk: string): void;
+}
+
+const quote = (arg: string) => (/^[\w@%+=:,./-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, `'\\''`)}'`);
+
+class ChildProcess extends EventEmitterBase {
+  pid?: number;
+  exitCode: number | null = null;
+  signalCode: string | null = null;
+  killed = false;
+  connected = false;
+  spawnfile: string;
+  spawnargs: string[];
+  stdin: Writable;
+  stdout: Readable;
+  stderr: Readable;
+  stdio: [Writable, Readable, Readable];
+  private handle?: ChildHandle;
+
+  constructor(deps: ChildProcessDeps, command: string, args: string[], options: SpawnOptions) {
+    super();
+    this.spawnfile = command;
+    this.spawnargs = [command, ...args];
+    this.stdout = new Readable({ read() {} });
+    this.stderr = new Readable({ read() {} });
+    this.stdin = new Writable({
+      write: (chunk: Uint8Array | string, _enc: string, cb: () => void) => {
+        this.handle?.write(typeof chunk === 'string' ? chunk : new TextDecoder().decode(chunk));
+        cb();
+      },
+      final: (cb: () => void) => {
+        this.handle?.closeStdin();
+        cb();
+      },
+    });
+    this.stdio = [this.stdin, this.stdout, this.stderr];
+    const inherit = options.stdio === 'inherit' || (Array.isArray(options.stdio) && options.stdio[1] === 'inherit');
+
+    const env: Record<string, string> = {};
+    for (const [k, v] of Object.entries(options.env ?? deps.env())) if (v !== undefined) env[k] = String(v);
+    const [file, argv] = options.shell ? ['jsh', ['-c', [command, ...args].join(' ')]] : [command, args];
+    const release = deps.loop.hold();
+    try {
+      this.handle = deps.system.spawn(file, argv, { cwd: options.cwd ?? deps.cwd(), env });
+    } catch (error) {
+      release();
+      const code = (error as { code?: string }).code ?? 'ENOENT';
+      const failure = Object.assign(new Error(`spawn ${command} ${code}`), { code, errno: -2, syscall: `spawn ${command}`, path: command, spawnargs: args });
+      queueMicrotask(() => {
+        this.emit('error', failure);
+        this.emit('close', -2, null);
+      });
+      return;
+    }
+    this.pid = this.handle.pid;
+    this.handle.onStdout((chunk) => (inherit ? deps.stdout(chunk) : this.stdout.push(chunk)));
+    this.handle.onStderr((chunk) => (inherit ? deps.stderr(chunk) : this.stderr.push(chunk)));
+    options.signal?.addEventListener('abort', () => this.kill());
+    queueMicrotask(() => this.emit('spawn'));
+    void this.handle.exit.then((code) => {
+      this.exitCode = this.killed ? null : code;
+      this.stdout.push(null);
+      this.stderr.push(null);
+      deps.loop._run(() => {
+        this.emit('exit', this.exitCode, this.signalCode);
+        this.emit('close', this.exitCode, this.signalCode);
+      });
+      release();
+    });
+  }
+
+  kill(signal = 'SIGTERM'): boolean {
+    if (!this.handle || this.exitCode !== null) return false;
+    this.killed = true;
+    this.signalCode = signal;
+    this.handle.kill(signal);
+    return true;
+  }
+
+  send(): boolean {
+    throw Object.assign(new Error('IPC channels are not supported in the browser runtime'), { code: 'ERR_FEATURE_UNAVAILABLE_ON_PLATFORM' });
+  }
+  disconnect(): void {}
+  ref(): void {}
+  unref(): void {}
+}
+
+type ExecCallback = (error: (Error & { code?: number | string }) | null, stdout: string, stderr: string) => void;
+
+function collect(child: ChildProcess, command: string, callback?: ExecCallback): ChildProcess {
+  let stdout = '';
+  let stderr = '';
+  child.stdout.on('data', (c: unknown) => (stdout += String(c)));
+  child.stderr.on('data', (c: unknown) => (stderr += String(c)));
+  child.on('error', (error: Error) => callback?.(error, stdout, stderr));
+  child.on('close', (code: number | null, signal: string | null) => {
+    if (code === -2) return; // already reported through 'error'
+    const error = code === 0 ? null : Object.assign(new Error(`Command failed: ${command}\n${stderr}`), { code: code ?? undefined, killed: child.killed, signal, cmd: command });
+    callback?.(error as (Error & { code?: number }) | null, stdout, stderr);
+  });
+  return child;
+}
+
+const noSync = (name: string) => () => {
+  throw Object.assign(new Error(`child_process.${name} is not supported in the browser runtime (a synchronous child would block the thread it needs). Use the async form.`), { code: 'ERR_FEATURE_UNAVAILABLE_ON_PLATFORM' });
+};
+
+export function createChildProcessModule(deps: ChildProcessDeps): Record<string, unknown> {
+  const spawn = (command: string, args?: string[] | SpawnOptions, options?: SpawnOptions) => {
+    if (!Array.isArray(args)) [options, args] = [args, []];
+    return new ChildProcess(deps, command, args.map(String), options ?? {});
+  };
+  return {
+    spawn,
+    exec(command: string, options?: SpawnOptions | ExecCallback, callback?: ExecCallback) {
+      if (typeof options === 'function') [callback, options] = [options, {}];
+      return collect(new ChildProcess(deps, command, [], { ...options, shell: true }), command, callback);
+    },
+    execFile(file: string, args?: string[] | SpawnOptions | ExecCallback, options?: SpawnOptions | ExecCallback, callback?: ExecCallback) {
+      if (typeof args === 'function') [callback, args, options] = [args, [], {}];
+      else if (!Array.isArray(args)) [callback, options, args] = [options as ExecCallback, args, []];
+      if (typeof options === 'function') [callback, options] = [options, {}];
+      return collect(new ChildProcess(deps, file, args, options ?? {}), [file, ...args].map(quote).join(' '), callback);
+    },
+    fork(modulePath: string, args?: string[] | SpawnOptions, options?: SpawnOptions) {
+      if (!Array.isArray(args)) [options, args] = [args, []];
+      return new ChildProcess(deps, 'node', [modulePath, ...args], options ?? {});
+    },
+    execSync: noSync('execSync'),
+    execFileSync: noSync('execFileSync'),
+    spawnSync: noSync('spawnSync'),
+    ChildProcess,
+  };
+}

package/src/node/crypto.ts

@@ -0,0 +1,187 @@
+/**
+ * The `crypto` module: hashes and HMAC (sync, via hashes.ts), random bytes and
+ * UUIDs (WebCrypto's getRandomValues), pbkdf2, `timingSafeEqual`, and
+ * `webcrypto`/`subtle` passed through. Ciphers, signing and key generation are
+ * not shimmed — they throw a clear error rather than misbehave.
+ */
+import { Buffer } from './buffer.js';
+import { hashAlgorithm, HASHES } from './hashes.js';
+import { Transform } from './stream/index.js';
+
+type Input = string | ArrayBufferView;
+
+const toBytes = (data: Input, encoding?: string): Uint8Array =>
+  typeof data === 'string' ? Buffer.from(data, encoding) : new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+
+const output = (bytes: Uint8Array, encoding?: string) => (encoding && encoding !== 'buffer' ? Buffer.from(bytes).toString(encoding as 'hex') : Buffer.from(bytes));
+
+class Hash extends Transform {
+  private chunks: Uint8Array[] = [];
+  private done = false;
+
+  constructor(private readonly algorithm: string) {
+    super();
+    hashAlgorithm(algorithm);
+  }
+
+  update(data: Input, encoding?: string): this {
+    if (this.done) throw Object.assign(new Error('Digest already called'), { code: 'ERR_CRYPTO_HASH_FINALIZED' });
+    this.chunks.push(toBytes(data, encoding).slice());
+    return this;
+  }
+
+  digest(encoding?: string): string | Buffer {
+    this.done = true;
+    return output(hashAlgorithm(this.algorithm).digest(Buffer.concat(this.chunks)), encoding);
+  }
+
+  copy(): Hash {
+    const copy = new Hash(this.algorithm);
+    copy.chunks = [...this.chunks];
+    return copy;
+  }
+
+  override _transform(chunk: Uint8Array, _encoding: string, callback: () => void): void {
+    this.update(chunk);
+    callback();
+  }
+
+  override _flush(callback: (error?: Error | null, data?: unknown) => void): void {
+    callback(null, this.digest());
+  }
+}
+
+export function hmac(algorithm: string, key: Uint8Array, data: Uint8Array): Uint8Array {
+  const { digest, blockSize } = hashAlgorithm(algorithm);
+  let k = key.length > blockSize ? digest(key) : key;
+  const padded = new Uint8Array(blockSize);
+  padded.set(k);
+  k = padded;
+  const inner = new Uint8Array(blockSize + data.length);
+  const outer = new Uint8Array(blockSize);
+  for (let i = 0; i < blockSize; i++) {
+    inner[i] = k[i]! ^ 0x36;
+    outer[i] = k[i]! ^ 0x5c;
+  }
+  inner.set(data, blockSize);
+  const innerHash = digest(inner);
+  const final = new Uint8Array(blockSize + innerHash.length);
+  final.set(outer);
+  final.set(innerHash, blockSize);
+  return digest(final);
+}
+
+class Hmac extends Hash {
+  private readonly hmacKey: Uint8Array;
+  private readonly parts: Uint8Array[] = [];
+
+  constructor(private readonly hmacAlgorithm: string, key: Input) {
+    super(hmacAlgorithm);
+    this.hmacKey = toBytes(key).slice();
+  }
+
+  override update(data: Input, encoding?: string): this {
+    this.parts.push(toBytes(data, encoding).slice());
+    return this;
+  }
+
+  override digest(encoding?: string): string | Buffer {
+    return output(hmac(this.hmacAlgorithm, this.hmacKey, Buffer.concat(this.parts)), encoding);
+  }
+}
+
+function pbkdf2Sync(password: Input, salt: Input, iterations: number, keylen: number, digest = 'sha1'): Buffer {
+  const pw = toBytes(password);
+  const s = toBytes(salt);
+  const out = new Uint8Array(keylen);
+  for (let block = 1, at = 0; at < keylen; block++) {
+    const input = new Uint8Array(s.length + 4);
+    input.set(s);
+    new DataView(input.buffer).setUint32(s.length, block);
+    let u = hmac(digest, pw, input);
+    const t = u.slice();
+    for (let i = 1; i < iterations; i++) {
+      u = hmac(digest, pw, u);
+      for (let j = 0; j < t.length; j++) t[j] = t[j]! ^ u[j]!;
+    }
+    out.set(t.subarray(0, keylen - at), at);
+    at += t.length;
+  }
+  return Buffer.from(out);
+}
+
+function randomFill<T extends ArrayBufferView>(view: T): T {
+  const bytes = new Uint8Array(view.buffer, view.byteOffset, view.byteLength);
+  for (let i = 0; i < bytes.length; i += 65536) globalThis.crypto.getRandomValues(bytes.subarray(i, i + 65536));
+  return view;
+}
+
+const unsupported = (name: string) => () => {
+  throw Object.assign(new Error(`crypto.${name} is not available in the browser runtime`), { code: 'ERR_FEATURE_UNAVAILABLE_ON_PLATFORM' });
+};
+
+export function createCryptoModule(): Record<string, unknown> {
+  const randomBytes = (size: number, callback?: (error: Error | null, buf: Buffer) => void) => {
+    const buf = randomFill(Buffer.alloc(size));
+    if (callback) queueMicrotask(() => callback(null, buf));
+    return buf;
+  };
+  return {
+    createHash: (algorithm: string) => new Hash(algorithm),
+    createHmac: (algorithm: string, key: Input) => new Hmac(algorithm, key),
+    hash: (algorithm: string, data: Input, encoding = 'hex') => output(hashAlgorithm(algorithm).digest(toBytes(data)), encoding),
+    getHashes: () => Object.keys(HASHES),
+    getCiphers: () => [],
+    getCurves: () => [],
+    randomBytes,
+    pseudoRandomBytes: randomBytes,
+    randomFillSync: (view: ArrayBufferView, offset = 0, size?: number) => {
+      randomFill(new Uint8Array(view.buffer, view.byteOffset + offset, size ?? view.byteLength - offset));
+      return view;
+    },
+    randomFill: (view: ArrayBufferView, ...rest: unknown[]) => {
+      const callback = rest.pop() as (e: Error | null, v: ArrayBufferView) => void;
+      randomFill(view);
+      queueMicrotask(() => callback(null, view));
+    },
+    randomUUID: () => globalThis.crypto.randomUUID(),
+    randomInt(min: number, max?: number | ((e: Error | null, n: number) => void), callback?: (e: Error | null, n: number) => void) {
+      if (typeof max !== 'number') [callback, max, min] = [max as typeof callback, min, 0];
+      const value = min + Math.floor((globalThis.crypto.getRandomValues(new Uint32Array(1))[0]! / 2 ** 32) * (max - min));
+      if (callback) queueMicrotask(() => callback!(null, value));
+      return value;
+    },
+    getRandomValues: <T extends ArrayBufferView>(view: T) => randomFill(view),
+    timingSafeEqual(a: ArrayBufferView, b: ArrayBufferView) {
+      if (a.byteLength !== b.byteLength) throw new RangeError('Input buffers must have the same byte length');
+      const x = new Uint8Array(a.buffer, a.byteOffset, a.byteLength);
+      const y = new Uint8Array(b.buffer, b.byteOffset, b.byteLength);
+      let diff = 0;
+      for (let i = 0; i < x.length; i++) diff |= x[i]! ^ y[i]!;
+      return diff === 0;
+    },
+    pbkdf2Sync,
+    pbkdf2(password: Input, salt: Input, iterations: number, keylen: number, digest: string, callback: (e: Error | null, key?: Buffer) => void) {
+      queueMicrotask(() => {
+        try {
+          callback(null, pbkdf2Sync(password, salt, iterations, keylen, digest));
+        } catch (error) {
+          callback(error as Error);
+        }
+      });
+    },
+    webcrypto: globalThis.crypto,
+    subtle: globalThis.crypto?.subtle,
+    constants: {},
+    createCipheriv: unsupported('createCipheriv'),
+    createDecipheriv: unsupported('createDecipheriv'),
+    createSign: unsupported('createSign'),
+    createVerify: unsupported('createVerify'),
+    generateKeyPairSync: unsupported('generateKeyPairSync'),
+    generateKeyPair: unsupported('generateKeyPair'),
+    createPrivateKey: unsupported('createPrivateKey'),
+    createPublicKey: unsupported('createPublicKey'),
+    scryptSync: unsupported('scryptSync'),
+    scrypt: unsupported('scrypt'),
+  };
+}

package/src/node/esm.ts

@@ -0,0 +1,196 @@
+/**
+ * ES modules → the CommonJS wrapper, so `require` and `import` share one
+ * synchronous loader (`require()` must be sync, and esbuild-wasm has no sync
+ * transform in the browser). es-module-lexer finds every import/export; this
+ * file rewrites just those spans:
+ *
+ *   import d, { a as b } from 'x'   →  const __bfwc_m0 = __bfwc_import("x"); const d = …default; const { a: b } = …
+ *   export const x = 1              →  const x = 1          (+ a live getter `x` on exports)
+ *   export default expr             →  const __bfwc_default = expr
+ *   export { a as b } / export * from 'y' / import('z') / import.meta
+ *
+ * Exports are LIVE (getters over the local bindings). Imported bindings are
+ * snapshots taken when the import statement runs: a cycle that reads a binding
+ * before the other module finished initialising sees `undefined` rather than
+ * the later value. Function declarations are hoisted and exported before any
+ * import runs, which covers the common cyclic case.
+ */
+import { init, parse } from 'es-module-lexer';
+
+/** Resolve before the first transform (the lexer is WebAssembly). */
+export const esmReady: Promise<void> = init;
+
+export const ESM_MARK = Symbol.for('bfwc.esm');
+
+interface Edit {
+  start: number;
+  end: number;
+  text: string;
+}
+
+const IDENT = /^[\p{L}_$][\p{L}\p{N}_$]*$/u;
+
+/** Cheap pre-check before lexing a CommonJS-looking file. */
+export function mayBeEsm(source: string): boolean {
+  return /(?:^|[\s;})])(?:import\s*[\w{*'"]|export\s+|export\s*[{*])/.test(source);
+}
+
+/** Does the lexer see module syntax? (Node's "detect module" for ambiguous .js) */
+export function hasModuleSyntax(source: string): boolean {
+  try {
+    const [imports, exports] = parse(source);
+    return exports.length > 0 || imports.some((i) => i.t === 1 || i.t === 3);
+  } catch {
+    return false;
+  }
+}
+
+/** `a, b as c, default as d` → [[imported, local]]. */
+function parseList(list: string): Array<[string, string]> {
+  return list
+    .split(',')
+    .map((part) => part.trim())
+    .filter(Boolean)
+    .map((part) => {
+      const m = /^(?:type\s+)?("[^"]*"|'[^']*'|[^\s]+)(?:\s+as\s+("[^"]*"|'[^']*'|[^\s]+))?$/.exec(part);
+      if (!m) throw new SyntaxError(`Cannot parse import/export list entry "${part}"`);
+      const unquote = (s: string) => (/^["']/.test(s) ? s.slice(1, -1) : s);
+      return [unquote(m[1]!), unquote(m[2] ?? m[1]!)] as [string, string];
+    });
+}
+
+const access = (ns: string, key: string) => (IDENT.test(key) ? `${ns}.${key}` : `${ns}[${JSON.stringify(key)}]`);
+
+/** After `const`/`let`/`var`, the further declarator names `export const a = 1, b = 2` declares. */
+function extraDeclarators(source: string, from: number): string[] {
+  const names: string[] = [];
+  let depth = 0;
+  for (let i = from; i < source.length; i++) {
+    const ch = source[i]!;
+    if (ch === '"' || ch === "'" || ch === '`') {
+      const quote = ch;
+      for (i++; i < source.length && source[i] !== quote; i++) if (source[i] === '\\') i++;
+      continue;
+    }
+    if (ch === '(' || ch === '[' || ch === '{') depth++;
+    else if (ch === ')' || ch === ']' || ch === '}') depth--;
+    else if (depth === 0 && ch === ';') break;
+    else if (depth === 0 && ch === '\n') {
+      const before = source.slice(from, i).trimEnd();
+      const after = source.slice(i + 1).trimStart();
+      if (!/[,=+\-*/%&|^?:(]$/.test(before) && !/^[,.=+\-*/%&|^?:)]/.test(after)) break;
+    } else if (depth === 0 && ch === ',') {
+      const m = /^\s*([\p{L}_$][\p{L}\p{N}_$]*)/u.exec(source.slice(i + 1));
+      if (m) names.push(m[1]!);
+    }
+    if (depth < 0) break;
+  }
+  return names;
+}
+
+const isIdentChar = (ch: string | undefined) => !!ch && /[\p{L}\p{N}_$]/u.test(ch);
+
+/** The `export` keyword governing the export name at `pos` (not a substring of an identifier). */
+function exportKeywordBefore(source: string, pos: number): number {
+  for (let at = source.lastIndexOf('export', pos - 1); at >= 0; at = source.lastIndexOf('export', at - 1)) {
+    if (!isIdentChar(source[at - 1]) && !isIdentChar(source[at + 6])) return at;
+  }
+  return -1;
+}
+
+export function esmToCjs(source: string): string {
+  const [imports, exports] = parse(source);
+  const edits: Edit[] = [];
+  const getters = new Map<string, string>();
+  const removedKeywords = new Set<number>();
+  const reexportStarts = new Set<number>();
+  let counter = 0;
+  const call = (spec: string) => `__bfwc_import(${JSON.stringify(spec)})`;
+
+  for (const imp of imports) {
+    if (imp.t === 2) {
+      edits.push({ start: imp.ss, end: imp.d, text: '__bfwc_dynamic' });
+      continue;
+    }
+    if (imp.t === 3) {
+      edits.push({ start: imp.s, end: imp.e, text: '__bfwc_meta' });
+      continue;
+    }
+    if (imp.t !== 1 || imp.n === undefined) continue;
+    const statement = source.slice(imp.ss, imp.se);
+    const ns = `__bfwc_m${counter++}`;
+    const load = `const ${ns} = ${call(imp.n)};`;
+
+    if (statement.startsWith('export')) {
+      reexportStarts.add(imp.ss);
+      const nsMatch = /^export\s*\*\s*as\s+("[^"]*"|'[^']*'|[^\s]+)/.exec(statement);
+      if (nsMatch) getters.set(nsMatch[1]!.replace(/^["']|["']$/g, ''), ns);
+      else if (/^export\s*\*/.test(statement)) edits.push({ start: imp.ss, end: imp.se, text: `${load} __bfwc_star(exports, ${ns});` });
+      else for (const [imported, exported] of parseList(/\{([^}]*)\}/.exec(statement)?.[1] ?? '')) getters.set(exported, access(ns, imported));
+      if (!edits.some((e) => e.start === imp.ss)) edits.push({ start: imp.ss, end: imp.se, text: load });
+      continue;
+    }
+
+    const clause = /^import\s*([\s\S]*?)\s*from\s*["']/.exec(statement)?.[1];
+    if (clause === undefined) {
+      edits.push({ start: imp.ss, end: imp.se, text: `${call(imp.n)};` });
+      continue;
+    }
+    const parts: string[] = [load];
+    const braces = /\{([\s\S]*)\}/.exec(clause);
+    const outside = clause.replace(/\{[\s\S]*\}/, '').split(',').map((s) => s.trim()).filter(Boolean);
+    for (const item of outside) {
+      const star = /^\*\s*as\s+(\S+)$/.exec(item);
+      if (star) parts.push(`const ${star[1]} = ${ns};`);
+      else parts.push(`const ${item} = __bfwc_get(${ns}, "default");`);
+    }
+    if (braces) {
+      for (const [imported, local] of parseList(braces[1]!)) parts.push(`const ${local} = __bfwc_get(${ns}, ${JSON.stringify(imported)});`);
+    }
+    edits.push({ start: imp.ss, end: imp.se, text: parts.join(' ') });
+  }
+
+  const listStatements = new Map<number, number>();
+  for (const exp of exports) {
+    const kw = exportKeywordBefore(source, exp.s);
+    if (kw < 0 || reexportStarts.has(kw)) continue;
+    const between = source.slice(kw + 6, exp.s);
+    if (/^\s*\{/.test(between)) {
+      // `export { a, b as c }`: drop the statement, keep the bindings as getters.
+      if (!listStatements.has(kw)) {
+        const close = source.indexOf('}', kw);
+        let end = close + 1;
+        const semi = /^\s*;/.exec(source.slice(end));
+        if (semi) end += semi[0].length;
+        listStatements.set(kw, end);
+        edits.push({ start: kw, end, text: '' });
+      }
+      getters.set(exp.n, exp.ln ?? exp.n);
+      continue;
+    }
+    if (exp.n === 'default' && source.startsWith('default', exp.s) && !between.trim()) {
+      if (exp.ln && exp.ls >= 0) {
+        edits.push({ start: kw, end: exp.e, text: '' }); // `export default function name` → `function name`
+        getters.set('default', exp.ln);
+      } else {
+        edits.push({ start: kw, end: exp.e, text: 'const __bfwc_default =' });
+        getters.set('default', '__bfwc_default');
+      }
+      continue;
+    }
+    if (!removedKeywords.has(kw)) {
+      removedKeywords.add(kw);
+      edits.push({ start: kw, end: kw + 6, text: '' });
+      const decl = /^\s*(const|let|var)\b/.exec(between);
+      if (decl) for (const name of extraDeclarators(source, exp.e)) getters.set(name, name);
+    }
+    getters.set(exp.n, exp.ln ?? exp.n);
+  }
+
+  edits.sort((a, b) => b.start - a.start);
+  let code = source;
+  for (const edit of edits) code = code.slice(0, edit.start) + edit.text + code.slice(edit.end);
+  const getterList = [...getters].map(([name, expr]) => `${JSON.stringify(name)}: () => ${expr}`).join(', ');
+  // One line, so stack-trace line numbers stay aligned with the source.
+  return `"use strict";__bfwc_esm(exports, { ${getterList} });${code}`;
+}