@statewalker/webrun-modules 0.1.0

package/dist/resolution/node-builtins.d.ts

@@ -0,0 +1,24 @@
+import type { ModuleTarget } from "../types.js";
+/** Strip a `node:` prefix and any subpath, returning the core module name. */
+export declare function nodeBuiltinName(spec: string): string | undefined;
+export declare function isNodeBuiltin(spec: string): boolean;
+/**
+ * Map a Node-builtin specifier under a given target:
+ * - `browser` → a `@jspm/core` browser-polyfill package ref (served locally).
+ * - `node`    → `{ external }` (leave the `node:`-prefixed specifier in place).
+ *
+ * The subpath is `nodelibs/${name}` (not `nodelibs/browser/…`): `@jspm/core`'s
+ * `exports` map (`"./nodelibs/*"` → `default: "./nodelibs/browser/*.js"`) supplies
+ * the `browser` segment via the export condition. Hard-coding it here would make
+ * the wildcard expand to `nodelibs/browser/browser/${name}.js` — a path that
+ * doesn't exist.
+ */
+export declare function resolveNodeBuiltin(spec: string, target: ModuleTarget): {
+    ref: {
+        pkg: string;
+        subpath: string;
+    };
+} | {
+    external: string;
+} | undefined;
+//# sourceMappingURL=node-builtins.d.ts.map

package/dist/resolution/node-builtins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-builtins.d.ts","sourceRoot":"","sources":["../../src/resolution/node-builtins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgDhD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,GACnB;IAAE,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAK9E"}

package/dist/resolution/resolve-entry.d.ts

@@ -0,0 +1,9 @@
+import type { ModuleTarget, PackageManifest } from "../types.js";
+/**
+ * Resolve a package + subpath to the concrete file path inside the package,
+ * honoring `package.json` `exports` conditions for the given `target`, with a
+ * `main`/`module`/`browser` legacy fallback. Returns a package-relative path
+ * (e.g. `"dist/index.js"`).
+ */
+export declare function resolveEntry(manifest: PackageManifest, subpath: string | undefined, target: ModuleTarget): string;
+//# sourceMappingURL=resolve-entry.d.ts.map

package/dist/resolution/resolve-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-entry.d.ts","sourceRoot":"","sources":["../../src/resolution/resolve-entry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAsBjE;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,YAAY,GACnB,MAAM,CA+BR"}

package/dist/server/new-module-server.d.ts

@@ -0,0 +1,4 @@
+import type { ModuleServer, ModuleServerOptions } from "../types.js";
+/** Create a module/dependency server over an injected `FilesApi` cache. */
+export declare function newModuleServer(options: ModuleServerOptions): ModuleServer;
+//# sourceMappingURL=new-module-server.d.ts.map

package/dist/server/new-module-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"new-module-server.d.ts","sourceRoot":"","sources":["../../src/server/new-module-server.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAGV,YAAY,EACZ,mBAAmB,EAGpB,MAAM,aAAa,CAAC;AA2BrB,2EAA2E;AAC3E,wBAAgB,eAAe,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAsV1E"}

package/dist/server/specifiers.d.ts

@@ -0,0 +1,11 @@
+/** Split a bare specifier into package name + optional subpath (scope-aware). */
+export declare function parseSpecifier(spec: string): {
+    pkg: string;
+    subpath?: string;
+};
+/**
+ * Relative URL from one canonical module id to another (both are slash paths with
+ * no leading slash, filename last). Keeps served imports mount-prefix-portable.
+ */
+export declare function relativeUrl(fromId: string, toId: string): string;
+//# sourceMappingURL=specifiers.d.ts.map

package/dist/server/specifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"specifiers.d.ts","sourceRoot":"","sources":["../../src/server/specifiers.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAU9E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAQhE"}

package/dist/sources/npm-registry-source.d.ts

@@ -0,0 +1,29 @@
+import type { FilesApi } from "@statewalker/webrun-files";
+import type { ModuleRef, PackageManifest, Source } from "../types.js";
+export interface NpmRegistrySourceOptions {
+    /** Registry base URL. Defaults to the public npm registry. */
+    registryUrl?: string;
+    /** Injectable fetch (tests supply a fake; defaults to global `fetch`). */
+    fetch?: typeof fetch;
+    /** Factory for the in-memory package tree. Defaults to `new MemFilesApi()`. */
+    createFiles?: () => FilesApi;
+}
+/** Registry metadata shape (only the fields we read). */
+interface RegistryMeta {
+    "dist-tags"?: Record<string, string>;
+    versions?: Record<string, PackageManifest & {
+        dist?: {
+            tarball?: string;
+        };
+    }>;
+}
+/**
+ * The default acquisition `Source`: resolves a version from npm registry
+ * metadata, downloads the tarball, untars it into a fresh `FilesApi`, and returns
+ * the package files + manifest. Fully isomorphic (`fetch` + pure-JS untar).
+ */
+export declare function npmRegistrySource(opts?: NpmRegistrySourceOptions): Source;
+/** Resolve a dist-tag, exact version, or semver range to a concrete version. */
+export declare function resolveVersion(meta: RegistryMeta, spec: string | undefined, ref: ModuleRef): string;
+export {};
+//# sourceMappingURL=npm-registry-source.d.ts.map

package/dist/sources/npm-registry-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-registry-source.d.ts","sourceRoot":"","sources":["../../src/sources/npm-registry-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAG1D,OAAO,KAAK,EAAiB,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAIrF,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,QAAQ,CAAC;CAC9B;AAED,yDAAyD;AACzD,UAAU,YAAY;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG;QAAE,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;CAC9E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,wBAA6B,GAAG,MAAM,CAkC7E;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,SAAS,GACb,MAAM,CAYR"}

package/dist/sources/untar.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Untar an npm `.tgz` (gzipped ustar) into a map of path → bytes, isomorphically
+ * (no `node:zlib`, no `Buffer`). npm tarballs prefix every entry with `package/`;
+ * that prefix is stripped so keys are relative to the package root.
+ */
+export declare function untarTgz(tgz: Uint8Array): Map<string, Uint8Array>;
+/** Parse a raw ustar archive (512-byte blocks). */
+export declare function untar(buf: Uint8Array): Map<string, Uint8Array>;
+//# sourceMappingURL=untar.d.ts.map

package/dist/sources/untar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"untar.d.ts","sourceRoot":"","sources":["../../src/sources/untar.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAEjE;AAQD,mDAAmD;AACnD,wBAAgB,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAkB9D"}

package/dist/transform/index.d.ts

@@ -0,0 +1,15 @@
+import type { PackageManifest, SourceFormat, Transform } from "../types.js";
+/** The default per-file transform: dispatch ESM/TS/JSX vs CJS by `file.format`. */
+export declare function newDefaultTransform(): Transform;
+/**
+ * Decide a file's `SourceFormat` from its extension, the package `type`, and
+ * (for ambiguous `.js`) a content sniff. Mirrors Node: `.mjs`=ESM, `.cjs`=CJS,
+ * `.js` follows `package.json#type`; with no `type`, a package `.js` is CJS
+ * (Node's default) unless real ESM syntax is present. Definitive CJS markers
+ * (`module.exports`/`exports.x`) win over a loose `import`/`export` word-match,
+ * so a CJS file with "export" in a string is not mis-read as ESM.
+ */
+export declare function detectFormat(path: string, source: string, manifest?: PackageManifest): SourceFormat;
+export { newCjsTransform } from "./transform-cjs.js";
+export { newEsmTransform } from "./transform-esm.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/transform/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transform/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAc,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxF,mFAAmF;AACnF,wBAAgB,mBAAmB,IAAI,SAAS,CAQ/C;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,eAAe,GACzB,YAAY,CAad;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/transform/scan.d.ts

@@ -0,0 +1,11 @@
+import { parse as parseCjs } from "cjs-module-lexer";
+import type { SourceFormat } from "../types.js";
+/**
+ * List the import specifiers a file's transform will rewrite — the exact same set
+ * the ESM/CJS transforms discover — so the server can pre-resolve them (async)
+ * before running the synchronous rewrite. For TS/JSX the raw source is scanned;
+ * `es-module-lexer` tolerates types well enough to find every specifier.
+ */
+export declare function scanSpecifiers(source: string, format: SourceFormat): Promise<string[]>;
+export { parseCjs };
+//# sourceMappingURL=scan.d.ts.map

package/dist/transform/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/transform/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,IAAI,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQhD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAY5F;AAGD,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/transform/to-js.d.ts

@@ -0,0 +1,10 @@
+import type { SourceFormat } from "../types.js";
+/**
+ * Strip TS/JSX to plain JS (leave already-ESM/CJS JS untouched). Shared by the
+ * ESM transform and the specifier scanner so both see the *same* JS — raw TS/JSX
+ * cannot be lexed directly (`es-module-lexer` throws on JSX). JSX uses the
+ * automatic runtime, so scanning the output also surfaces the `react/jsx-runtime`
+ * import the runtime injects.
+ */
+export declare function toJs(source: string, format: SourceFormat, path?: string): string;
+//# sourceMappingURL=to-js.d.ts.map

package/dist/transform/to-js.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"to-js.d.ts","sourceRoot":"","sources":["../../src/transform/to-js.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;GAMG;AACH,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAOhF"}

package/dist/transform/transform-cjs.d.ts

@@ -0,0 +1,13 @@
+import type { Transform } from "../types.js";
+/**
+ * Transform a CommonJS file into served, browser-runnable ESM — no global runtime
+ * registry: each static `require` target is a static namespace import, so the ESM
+ * module graph itself provides load ordering and circular-dep handling. The CJS
+ * body runs synchronously against a synthetic `require` that maps specifiers to
+ * those namespaces; named exports (via `cjs-module-lexer`) are re-exported as
+ * eval-time snapshots (valid because the body executed synchronously above).
+ * Computed `require(expr)` hits the synthetic require's miss path (throws) — the
+ * declared `esbuild-wasm` fallback's job.
+ */
+export declare function newCjsTransform(): Transform;
+//# sourceMappingURL=transform-cjs.d.ts.map

package/dist/transform/transform-cjs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform-cjs.d.ts","sourceRoot":"","sources":["../../src/transform/transform-cjs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,aAAa,CAAC;AAgBzD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,SAAS,CAyD3C"}

package/dist/transform/transform-esm.d.ts

@@ -0,0 +1,9 @@
+import type { Transform } from "../types.js";
+/**
+ * The default per-file transform for ESM (and TS/JSX) sources: transpile to plain
+ * JS, then rewrite every static/dynamic-string import & re-export specifier in
+ * place via `rewrite`, leaving quotes and everything else byte-for-byte intact.
+ * Computed dynamic specifiers (no static string) are left untouched.
+ */
+export declare function newEsmTransform(): Transform;
+//# sourceMappingURL=transform-esm.d.ts.map

package/dist/transform/transform-esm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform-esm.d.ts","sourceRoot":"","sources":["../../src/transform/transform-esm.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,aAAa,CAAC;AAKzD;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,SAAS,CAsB3C"}

package/dist/types.d.ts

@@ -0,0 +1,127 @@
+import type { FilesApi } from "@statewalker/webrun-files";
+/**
+ * Public contract for `@statewalker/webrun-modules`. Types only — the resolver
+ * core, the default npm `Source`, and the transforms are implemented separately.
+ * Contract source: notes/2026/2026-07/2026-07-23/grill-module-webrun-modules.md
+ */
+/** The build target — selects `exports` conditions and is part of the cache key. */
+export type ModuleTarget = "browser" | "node";
+/**
+ * A reference to resolve: either an npm package (with optional pinned version and
+ * subpath) or a URL (a local project script served by this server, or an already
+ * resolved local URL).
+ */
+export type ModuleRef = {
+    pkg: string;
+    version?: string;
+    subpath?: string;
+} | {
+    url: string;
+};
+/** The result of resolving a `ModuleRef`: a directly `import`-able local URL. */
+export interface ResolvedModule {
+    /** Importable URL — `/{name}@{version}/{subpath}` for a package, carries `basePath`. */
+    url: string;
+    target: ModuleTarget;
+}
+/**
+ * The version-dedupe map produced by `prime` and reusable as a pin input. One
+ * artifact, two roles: a partial lockfile pins only the names it lists; `prime`
+ * writes the complete one back to the cache.
+ */
+export type Lockfile = Record<string, string>;
+/** A parsed `package.json` (only the fields resolution reads). */
+export interface PackageManifest {
+    name: string;
+    version: string;
+    main?: string;
+    module?: string;
+    browser?: string | Record<string, string | false>;
+    exports?: unknown;
+    imports?: unknown;
+    dependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    [key: string]: unknown;
+}
+/** A package acquired by a `Source`: its untarred files plus parsed manifest. */
+export interface LoadedPackage {
+    name: string;
+    version: string;
+    /** The untarred package tree — every file individually addressable. */
+    files: FilesApi;
+    manifest: PackageManifest;
+}
+/**
+ * Pluggable acquisition seam. The default impl fetches an npm registry tarball and
+ * untars it in memory; JSR and direct-URL are alternative impls.
+ */
+export interface Source {
+    /** Whether this source handles the given reference (npm | jsr | url). */
+    matches(ref: ModuleRef): boolean;
+    /** Resolve a concrete version, fetch bytes, untar, parse the manifest. */
+    load(ref: ModuleRef): Promise<LoadedPackage>;
+}
+/** The source-file kinds the transform distinguishes. */
+export type SourceFormat = "esm" | "cjs" | "ts" | "tsx";
+export interface SourceFile {
+    path: string;
+    source: string;
+    format: SourceFormat;
+}
+/**
+ * Pluggable per-file transform seam. Turns one raw file into browser-runnable ESM,
+ * passing every discovered specifier through `rewrite` (which returns the
+ * same-origin, prefix-portable relative URL to emit).
+ */
+export interface Transform {
+    transform(file: SourceFile, rewrite: (specifier: string) => string): Promise<string>;
+}
+export interface ModuleServerOptions {
+    /** Injected cache — NodeFilesApi / browser-OPFS / MemFilesApi. Never node:fs. */
+    cache: FilesApi;
+    /** Optional: local project files served under their own paths (authored scripts). */
+    project?: FilesApi;
+    /** Acquisition sources; defaults to `[npmRegistrySource()]`. */
+    sources?: Source[];
+    /** Per-file transform; defaults to the sucrase-based ESM + CJS-interop transform. */
+    transform?: Transform;
+    /** Selects `exports` conditions and cache key. Defaults to `"browser"`. */
+    target?: ModuleTarget;
+    /** Optional lockfile input for reproducible resolution; also written by `prime`. */
+    lock?: Lockfile;
+    /** Mount prefix, e.g. `"/deps/v1/"`. Defaults to `"/"`. */
+    basePath?: string;
+    /** Prefix (relative to `basePath`) for external package URLs, isolating npm
+     *  deps under e.g. `"deps/"` while authored project files stay at `~/`.
+     *  Defaults to `""` — packages served alongside project files. */
+    depsPath?: string;
+}
+export interface ModuleServer {
+    /** Resolve a single reference to an importable local URL (resolve-on-miss). */
+    resolve(ref: ModuleRef, importer?: string): Promise<ResolvedModule>;
+    /** Walk the entry's whole graph, warm the cache, write `lock`. */
+    prime(entry: ModuleRef): Promise<ResolvedModule>;
+    /** Prime an entry and return every reachable module URL (the exact set of
+     *  scripts required to run it, `basePath`-prefixed, sorted). */
+    listResources(entry: ModuleRef): Promise<string[]>;
+    /** List every file of a package (raw, package-relative paths), loading it if
+     *  needed — the full package contents, not just the reachable subset. */
+    listPackageFiles(ref: ModuleRef): Promise<string[]>;
+    /** Standard Web handler; serves the cache and matches under `basePath`. */
+    fetch(request: Request): Promise<Response>;
+    /** The resolved graph — also the persisted lockfile. */
+    readonly lock: Lockfile;
+}
+/** Thrown when a package / version / subpath cannot be resolved. */
+export declare class ModuleResolveError extends Error {
+    readonly ref: ModuleRef;
+    readonly reason: string;
+    constructor(ref: ModuleRef, reason: string);
+}
+/** Thrown when a file cannot be transformed to runnable ESM. */
+export declare class ModuleTransformError extends Error {
+    readonly path: string;
+    readonly reason: string;
+    constructor(path: string, reason: string);
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;;;GAIG;AAEH,oFAAoF;AACpF,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC;AAE9C;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAwB,CAAC;AAErE,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,yEAAyE;IACzE,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC;IACjC,0EAA0E;IAC1E,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC9C;AAED,yDAAyD;AACzD,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;AAExD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,KAAK,EAAE,QAAQ,CAAC;IAChB,qFAAqF;IACrF,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qFAAqF;IACrF,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,oFAAoF;IACpF,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;sEAEkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACpE,kEAAkE;IAClE,KAAK,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACjD;oEACgE;IAChE,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD;6EACyE;IACzE,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpD,2EAA2E;IAC3E,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,oEAAoE;AACpE,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,GAAG,EAAE,SAAS;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,MAAM;CAK1B;AAED,gEAAgE;AAChE,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAK1B"}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@statewalker/webrun-modules",
+  "version": "0.1.0",
+  "private": false,
+  "type": "module",
+  "description": "Isomorphic module/dependency server: resolve + download + transform npm and authored TS/JS into browser-runnable ESM served from a local FilesApi cache, with no runtime CDN dependency",
+  "homepage": "https://github.com/statewalker/webrun-wire",
+  "author": {
+    "name": "Mikhail Kotelnikov",
+    "email": "mikhail.kotelnikov@gmail.com"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git@github.com:statewalker/webrun-wire.git"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "dependencies": {
+    "@statewalker/webrun-files": "^0.7.0",
+    "@statewalker/webrun-files-mem": "^0.7.2",
+    "es-module-lexer": "^2.0.0",
+    "sucrase": "^3.35.1",
+    "@jspm/generator": "^2.6.1",
+    "cjs-module-lexer": "^1.4.1",
+    "resolve.exports": "^2.0.3",
+    "npm-package-arg": "^12.0.0",
+    "semver": "^7.6.3",
+    "@jspm/core": "^2.1.0",
+    "fflate": "^0.8.2"
+  },
+  "devDependencies": {
+    "@statewalker/webrun-files-node": "^0.7.0",
+    "@types/node": "^25.6.0",
+    "@types/semver": "^7.5.8",
+    "rimraf": "^6.1.3",
+    "rolldown": "^1.0.0-rc.16",
+    "tsx": "^4.21.0",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.4"
+  },
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "rimraf dist && rolldown -c && tsc --emitDeclarationOnly --declaration",
+    "test": "vitest run",
+    "lint": "biome check src tests",
+    "example": "tsx examples/full-cycle.ts",
+    "example:full-cycle": "tsx examples/full-cycle.ts",
+    "example:server": "tsx examples/http-server.ts",
+    "example:site": "tsx examples/site-pipeline.ts"
+  }
+}

package/src/index.ts

@@ -0,0 +1,26 @@
+export { newModuleServer } from "./server/new-module-server.js";
+export { parseSpecifier, relativeUrl } from "./server/specifiers.js";
+export type { NpmRegistrySourceOptions } from "./sources/npm-registry-source.js";
+export { npmRegistrySource } from "./sources/npm-registry-source.js";
+export { untarTgz } from "./sources/untar.js";
+export {
+  detectFormat,
+  newCjsTransform,
+  newDefaultTransform,
+  newEsmTransform,
+} from "./transform/index.js";
+export type {
+  LoadedPackage,
+  Lockfile,
+  ModuleRef,
+  ModuleServer,
+  ModuleServerOptions,
+  ModuleTarget,
+  PackageManifest,
+  ResolvedModule,
+  Source,
+  SourceFile,
+  SourceFormat,
+  Transform,
+} from "./types.js";
+export { ModuleResolveError, ModuleTransformError } from "./types.js";

package/src/resolution/node-builtins.ts

@@ -0,0 +1,79 @@
+import type { ModuleTarget } from "../types.js";
+
+/** Node core module names (static list — an isomorphic lib can't read `node:module`). */
+const NODE_BUILTINS = new Set([
+  "assert",
+  "async_hooks",
+  "buffer",
+  "child_process",
+  "cluster",
+  "console",
+  "constants",
+  "crypto",
+  "dgram",
+  "diagnostics_channel",
+  "dns",
+  "domain",
+  "events",
+  "fs",
+  "http",
+  "http2",
+  "https",
+  "inspector",
+  "module",
+  "net",
+  "os",
+  "path",
+  "perf_hooks",
+  "process",
+  "punycode",
+  "querystring",
+  "readline",
+  "repl",
+  "stream",
+  "string_decoder",
+  "sys",
+  "timers",
+  "tls",
+  "trace_events",
+  "tty",
+  "url",
+  "util",
+  "v8",
+  "vm",
+  "wasi",
+  "worker_threads",
+  "zlib",
+]);
+
+/** Strip a `node:` prefix and any subpath, returning the core module name. */
+export function nodeBuiltinName(spec: string): string | undefined {
+  const bare = spec.replace(/^node:/, "");
+  const root = bare.split("/")[0];
+  return NODE_BUILTINS.has(root) ? bare : undefined;
+}
+
+export function isNodeBuiltin(spec: string): boolean {
+  return nodeBuiltinName(spec) !== undefined;
+}
+
+/**
+ * Map a Node-builtin specifier under a given target:
+ * - `browser` → a `@jspm/core` browser-polyfill package ref (served locally).
+ * - `node`    → `{ external }` (leave the `node:`-prefixed specifier in place).
+ *
+ * The subpath is `nodelibs/${name}` (not `nodelibs/browser/…`): `@jspm/core`'s
+ * `exports` map (`"./nodelibs/*"` → `default: "./nodelibs/browser/*.js"`) supplies
+ * the `browser` segment via the export condition. Hard-coding it here would make
+ * the wildcard expand to `nodelibs/browser/browser/${name}.js` — a path that
+ * doesn't exist.
+ */
+export function resolveNodeBuiltin(
+  spec: string,
+  target: ModuleTarget,
+): { ref: { pkg: string; subpath: string } } | { external: string } | undefined {
+  const name = nodeBuiltinName(spec);
+  if (name === undefined) return undefined;
+  if (target === "node") return { external: `node:${name}` };
+  return { ref: { pkg: "@jspm/core", subpath: `nodelibs/${name}` } };
+}

package/src/resolution/resolve-entry.ts

@@ -0,0 +1,65 @@
+import { legacy, resolve as resolveExports } from "resolve.exports";
+import type { ModuleTarget, PackageManifest } from "../types.js";
+
+/** Strip a leading `./` or `/` so the result is a package-relative file path. */
+function norm(p: string): string {
+  return p.replace(/^\.?\//, "");
+}
+
+type ResolveOpts = { browser: boolean; conditions: string[]; require?: boolean };
+
+/** Call resolve.exports, swallowing its "no known conditions" throw. */
+function tryResolve(
+  manifest: PackageManifest,
+  entry: string,
+  opts: ResolveOpts,
+): string[] | undefined {
+  try {
+    return resolveExports(manifest, entry, opts) as string[] | undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Resolve a package + subpath to the concrete file path inside the package,
+ * honoring `package.json` `exports` conditions for the given `target`, with a
+ * `main`/`module`/`browser` legacy fallback. Returns a package-relative path
+ * (e.g. `"dist/index.js"`).
+ */
+export function resolveEntry(
+  manifest: PackageManifest,
+  subpath: string | undefined,
+  target: ModuleTarget,
+): string {
+  const browser = target === "browser";
+  const clean = (subpath ?? "").replace(/^\.?\//, "");
+  const entry = clean ? `./${clean}` : ".";
+
+  if (manifest.exports !== undefined) {
+    const conditions = browser ? ["browser"] : ["node"];
+    // resolve.exports *throws* when no condition matches — try ESM (import) then
+    // CJS-only (require) exports maps, swallowing the no-match throw.
+    const out =
+      tryResolve(manifest, entry, { browser, conditions }) ??
+      tryResolve(manifest, entry, { browser, conditions, require: true });
+    if (out?.length) return norm(out[0]);
+    // exports present but subpath not exported: fall through to the raw path.
+  }
+
+  if (entry === ".") {
+    const leg = legacy(manifest, {
+      browser,
+      fields: browser ? ["browser", "module", "main"] : ["module", "main"],
+    });
+    if (typeof leg === "string") return norm(leg);
+    // `exports` present but neither `.` nor a legacy main resolves: the package has
+    // no root entry (e.g. `@jspm/core`). Fabricating `index.js` here yields a dead
+    // URL that 404s; fail loudly instead (Node throws ERR_PACKAGE_PATH_NOT_EXPORTED).
+    if (manifest.exports !== undefined) {
+      throw new Error(`${manifest.name}: package has no root entry ("." is not exported)`);
+    }
+  }
+
+  return clean || "index.js";
+}