almostnode 0.2.7 → 0.2.9

package/src/frameworks/tailwind-config-loader.ts

@@ -109,7 +109,7 @@ export function stripTypescriptSyntax(content: string): string {
 
   // Remove type annotations on variables
   // e.g., const config: Config = { ... }
-  result = result.replace(/:\s*Config\s*=/g, ' =');
+  result = result.replace(/:\s*[A-Z]\w*\s*=/g, ' =');
 
   // Remove 'as const' assertions
   result = result.replace(/\s+as\s+const\s*/g, ' ');

package/src/index.ts

@@ -76,6 +76,7 @@ export function createContainer(options?: ContainerOptions): {
   serverBridge: ServerBridge;
   execute: (code: string, filename?: string) => { exports: unknown };
   runFile: (filename: string) => { exports: unknown };
+  createREPL: () => { eval: (code: string) => unknown };
   on: (event: string, listener: (...args: unknown[]) => void) => void;
 } {
   const vfs = new VirtualFS();
@@ -93,6 +94,7 @@ export function createContainer(options?: ContainerOptions): {
     serverBridge,
     execute: (code: string, filename?: string) => runtime.execute(code, filename),
     runFile: (filename: string) => runtime.runFile(filename),
+    createREPL: () => runtime.createREPL(),
     on: (event: string, listener: (...args: unknown[]) => void) => {
       serverBridge.on(event, listener);
     },

package/src/runtime.ts

@@ -9,6 +9,7 @@ import { VirtualFS } from './virtual-fs';
 import type { IRuntime, IExecuteResult, IRuntimeOptions } from './runtime-interface';
 import type { PackageJson } from './types/package-json';
 import { simpleHash } from './utils/hash';
+import { uint8ToBase64, uint8ToHex } from './utils/binary-encoding';
 import { createFsShim, FsShim } from './shims/fs';
 import * as pathShim from './shims/path';
 import { createProcess, Process } from './shims/process';
@@ -456,16 +457,26 @@ function createRequire(
       return null;
     };
 
+    // Apply browser field object remapping for a resolved file within a package
+    const applyBrowserFieldRemap = (resolvedPath: string, pkg: PackageJson, pkgRoot: string): string | null => {
+      if (!pkg.browser || typeof pkg.browser !== 'object') return resolvedPath;
+      const browserMap = pkg.browser as Record<string, string | false>;
+      // Build relative path from package root (e.g., "./lib/node.js")
+      const relPath = './' + pathShim.relative(pkgRoot, resolvedPath);
+      // Also check without extension for common patterns
+      const relPathNoExt = relPath.replace(/\.(js|json|cjs|mjs)$/, '');
+      for (const key of [relPath, relPathNoExt]) {
+        if (key in browserMap) {
+          if (browserMap[key] === false) return null; // Module excluded in browser
+          return tryResolveFile(pathShim.join(pkgRoot, browserMap[key] as string));
+        }
+      }
+      return resolvedPath;
+    };
+
     // Helper to resolve from a node_modules directory
     const tryResolveFromNodeModules = (nodeModulesDir: string, moduleId: string): string | null => {
-      const fullPath = pathShim.join(nodeModulesDir, moduleId);
-
-      // Check if path exists (as file or directory)
-      const resolved = tryResolveFile(fullPath);
-      if (resolved) return resolved;
-
-      // Check if this is a package (has package.json)
-      // For sub-paths like "pkg/sub", we need to find the package root first
+      // Determine the package name and root
       const parts = moduleId.split('/');
       const pkgName = parts[0].startsWith('@') && parts.length > 1
         ? `${parts[0]}/${parts[1]}`  // Scoped package
@@ -474,6 +485,7 @@ function createRequire(
       const pkgRoot = pathShim.join(nodeModulesDir, pkgName);
       const pkgPath = pathShim.join(pkgRoot, 'package.json');
 
+      // Check package.json first — it controls entry points (browser, main, exports)
       const pkg = getParsedPackageJson(pkgPath);
       if (pkg) {
         // Use resolve.exports to handle the exports field
@@ -493,15 +505,27 @@ function createRequire(
           }
         }
 
-        // If this is the package root (no sub-path), use main entry
+        // If this is the package root (no sub-path), use browser/main entry
         if (pkgName === moduleId) {
-          const main = pkg.main || 'index.js';
+          // Prefer browser field (string form) since we're running in a browser
+          let main: string | undefined;
+          if (typeof pkg.browser === 'string') {
+            main = pkg.browser;
+          }
+          if (!main) {
+            main = pkg.main || 'index.js';
+          }
           const mainPath = pathShim.join(pkgRoot, main);
           const resolvedMain = tryResolveFile(mainPath);
           if (resolvedMain) return resolvedMain;
         }
       }
 
+      // Fall back to direct file/directory resolution (for sub-paths or packages without package.json)
+      const fullPath = pathShim.join(nodeModulesDir, moduleId);
+      const resolved = tryResolveFile(fullPath);
+      if (resolved) return resolved;
+
       return null;
     };
 
@@ -548,6 +572,12 @@ function createRequire(
     // Cache before loading to handle circular dependencies
     moduleCache[resolvedPath] = module;
 
+    // Evict oldest entry if cache exceeds bounds
+    const cacheKeys = Object.keys(moduleCache);
+    if (cacheKeys.length > 2000) {
+      delete moduleCache[cacheKeys[0]];
+    }
+
     // Handle JSON files
     if (resolvedPath.endsWith('.json')) {
       const content = vfs.readFileSync(resolvedPath, 'utf8');
@@ -859,6 +889,10 @@ export class Runtime {
     // Initialize esbuild shim with VFS for file access
     esbuildShim.setVFS(vfs);
 
+    // Polyfill Error.captureStackTrace/prepareStackTrace for Safari/WebKit
+    // (V8-specific API used by Express's depd and other npm packages)
+    this.setupStackTracePolyfill();
+
     // Polyfill TextDecoder to handle base64/base64url/hex gracefully
     // (Some CLI tools incorrectly try to use TextDecoder for these)
     this.setupTextDecoderPolyfill();
@@ -907,27 +941,15 @@ export class Runtime {
           : new Uint8Array(input.buffer, input.byteOffset, input.byteLength);
 
         if (this.encoding === 'base64') {
-          let binary = '';
-          for (let i = 0; i < bytes.length; i++) {
-            binary += String.fromCharCode(bytes[i]);
-          }
-          return btoa(binary);
+          return uint8ToBase64(bytes);
         }
 
         if (this.encoding === 'base64url') {
-          let binary = '';
-          for (let i = 0; i < bytes.length; i++) {
-            binary += String.fromCharCode(bytes[i]);
-          }
-          return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+          return uint8ToBase64(bytes).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
         }
 
         if (this.encoding === 'hex') {
-          let hex = '';
-          for (let i = 0; i < bytes.length; i++) {
-            hex += bytes[i].toString(16).padStart(2, '0');
-          }
-          return hex;
+          return uint8ToHex(bytes);
         }
 
         // Fallback: decode as utf-8
@@ -946,6 +968,146 @@ export class Runtime {
     globalThis.TextDecoder = PolyfillTextDecoder as unknown as typeof TextDecoder;
   }
 
+  /**
+   * Polyfill V8's Error.captureStackTrace and Error.prepareStackTrace for Safari/WebKit.
+   * Express's `depd` and other npm packages use these V8-specific APIs which don't
+   * exist in Safari, causing "callSite.getFileName is not a function" errors.
+   */
+  private setupStackTracePolyfill(): void {
+    // Only polyfill if not already available (i.e., not V8/Chrome)
+    if (typeof (Error as any).captureStackTrace === 'function') return;
+
+    // Set a default stackTraceLimit so Math.max(10, undefined) doesn't produce NaN
+    // (depd and other packages read this value)
+    if ((Error as any).stackTraceLimit === undefined) {
+      (Error as any).stackTraceLimit = 10;
+    }
+
+    // Parse a stack trace string into structured frames
+    function parseStack(stack: string): Array<{fn: string, file: string, line: number, col: number}> {
+      if (!stack) return [];
+      const frames: Array<{fn: string, file: string, line: number, col: number}> = [];
+      const lines = stack.split('\n');
+
+      for (const raw of lines) {
+        const line = raw.trim();
+        if (!line || line.startsWith('Error') || line.startsWith('TypeError')) continue;
+
+        let fn = '', file = '', lineNo = 0, colNo = 0;
+
+        // Safari format: "functionName@file:line:col" or "@file:line:col"
+        const safariMatch = line.match(/^(.*)@(.*?):(\d+):(\d+)$/);
+        if (safariMatch) {
+          fn = safariMatch[1] || '';
+          file = safariMatch[2];
+          lineNo = parseInt(safariMatch[3], 10);
+          colNo = parseInt(safariMatch[4], 10);
+          frames.push({ fn, file, line: lineNo, col: colNo });
+          continue;
+        }
+
+        // Chrome format: "at functionName (file:line:col)" or "at file:line:col"
+        const chromeMatch = line.match(/^at\s+(?:(.+?)\s+\()?(.*?):(\d+):(\d+)\)?$/);
+        if (chromeMatch) {
+          fn = chromeMatch[1] || '';
+          file = chromeMatch[2];
+          lineNo = parseInt(chromeMatch[3], 10);
+          colNo = parseInt(chromeMatch[4], 10);
+          frames.push({ fn, file, line: lineNo, col: colNo });
+          continue;
+        }
+      }
+      return frames;
+    }
+
+    // Create a mock CallSite object from a parsed frame
+    function createCallSite(frame: {fn: string, file: string, line: number, col: number}) {
+      return {
+        getFileName: () => frame.file || null,
+        getLineNumber: () => frame.line || null,
+        getColumnNumber: () => frame.col || null,
+        getFunctionName: () => frame.fn || null,
+        getMethodName: () => frame.fn || null,
+        getTypeName: () => null,
+        getThis: () => undefined,
+        getFunction: () => undefined,
+        getEvalOrigin: () => undefined,
+        isNative: () => false,
+        isConstructor: () => false,
+        isToplevel: () => !frame.fn,
+        isEval: () => false,
+        toString: () => frame.fn
+          ? `${frame.fn} (${frame.file}:${frame.line}:${frame.col})`
+          : `${frame.file}:${frame.line}:${frame.col}`,
+      };
+    }
+
+    // Helper: parse stack and create CallSite objects, used by both captureStackTrace and .stack getter
+    function buildCallSites(stack: string, constructorOpt?: Function) {
+      const frames = parseStack(stack);
+      let startIdx = 0;
+      if (constructorOpt && constructorOpt.name) {
+        for (let i = 0; i < frames.length; i++) {
+          if (frames[i].fn === constructorOpt.name) {
+            startIdx = i + 1;
+            break;
+          }
+        }
+      }
+      return frames.slice(startIdx).map(createCallSite);
+    }
+
+    // Symbol to store raw stack string, used by the .stack getter
+    const stackSymbol = Symbol('rawStack');
+
+    // Intercept .stack on Error.prototype so that packages using the V8 pattern
+    // "Error.prepareStackTrace = fn; new Error().stack" also get CallSite objects.
+    // In V8, reading .stack lazily triggers prepareStackTrace; Safari doesn't do this.
+    Object.defineProperty(Error.prototype, 'stack', {
+      get() {
+        const rawStack = (this as any)[stackSymbol];
+        if (rawStack !== undefined && typeof (Error as any).prepareStackTrace === 'function') {
+          const callSites = buildCallSites(rawStack);
+          try {
+            return (Error as any).prepareStackTrace(this, callSites);
+          } catch {
+            return rawStack;
+          }
+        }
+        return rawStack;
+      },
+      set(value: string) {
+        (this as any)[stackSymbol] = value;
+      },
+      configurable: true,
+      enumerable: false,
+    });
+
+    // Polyfill Error.captureStackTrace
+    (Error as any).captureStackTrace = function(target: any, constructorOpt?: Function) {
+      // Temporarily clear prepareStackTrace to get the raw stack string
+      // (otherwise our .stack getter would call prepareStackTrace recursively)
+      const savedPrepare = (Error as any).prepareStackTrace;
+      (Error as any).prepareStackTrace = undefined;
+      const err = new Error();
+      const rawStack = err.stack || '';
+      (Error as any).prepareStackTrace = savedPrepare;
+
+      // If prepareStackTrace is set, provide structured call sites
+      if (typeof savedPrepare === 'function') {
+        const callSites = buildCallSites(rawStack, constructorOpt);
+        try {
+          target.stack = savedPrepare(target, callSites);
+        } catch (e) {
+          console.warn('[almostnode] Error.prepareStackTrace threw:', e);
+          target.stack = rawStack;
+        }
+      } else {
+        target.stack = rawStack;
+      }
+    };
+  }
+
   /**
    * Execute code as a module (synchronous - backward compatible)
    */
@@ -1085,6 +1247,90 @@ ${code}
   getProcess(): Process {
     return this.process;
   }
+
+  /**
+   * Create a REPL context that evaluates expressions and persists state.
+   *
+   * Returns an object with an `eval` method that:
+   * - Returns the value of the last expression (unlike `execute` which returns module.exports)
+   * - Persists variables between calls (`var x = 1` then `x` works)
+   * - Has access to `require`, `console`, `process`, `Buffer` (same as execute)
+   *
+   * Security: The eval runs inside a Generator's local scope via direct eval,
+   * NOT in the global scope. Only the runtime's own require/console/process are
+   * exposed — the same sandbox boundary as execute(). Variables created in the
+   * REPL are confined to the generator's closure and cannot leak to the page.
+   *
+   * Note: `const`/`let` are transformed to `var` so they persist across calls
+   * (var hoists to the generator's function scope, const/let are block-scoped
+   * to each eval call and would be lost).
+   */
+  createREPL(): { eval: (code: string) => unknown } {
+    const require = createRequire(
+      this.vfs,
+      this.fsShim,
+      this.process,
+      '/',
+      this.moduleCache,
+      this.options,
+      this.processedCodeCache
+    );
+    const consoleWrapper = createConsoleWrapper(this.options.onConsole);
+    const process = this.process;
+    const buffer = bufferShim.Buffer;
+
+    // Use a Generator to maintain a persistent eval scope.
+    // Generator functions preserve their local scope across yields, so
+    // var declarations from eval() persist between calls. Direct eval
+    // runs in the generator's scope (not global), providing isolation.
+    const GeneratorFunction = Object.getPrototypeOf(function* () {}).constructor;
+    const replGen = new GeneratorFunction(
+      'require',
+      'console',
+      'process',
+      'Buffer',
+      `var __code, __result;
+while (true) {
+  __code = yield;
+  try {
+    __result = eval(__code);
+    yield { value: __result, error: null };
+  } catch (e) {
+    yield { value: undefined, error: e };
+  }
+}`
+    )(require, consoleWrapper, process, buffer);
+    replGen.next(); // prime the generator
+
+    return {
+      eval(code: string): unknown {
+        // Transform const/let to var for persistence across REPL calls.
+        // var declarations in direct eval are added to the enclosing function
+        // scope (the generator), so they survive across yields.
+        const transformed = code.replace(/^\s*(const|let)\s+/gm, 'var ');
+
+        // Try as expression first (wrapping in parens), fall back to statement.
+        // replGen.next(code) sends code to the generator, which evals it and
+        // yields the result — so the result is in the return value of .next().
+        const exprResult = replGen.next('(' + transformed + ')').value as { value: unknown; error: unknown };
+        if (!exprResult.error) {
+          // Advance past the wait-for-code yield so it's ready for next call
+          replGen.next();
+          return exprResult.value;
+        }
+
+        // Expression parse failed — advance past wait-for-code, then try as statement
+        replGen.next();
+        const stmtResult = replGen.next(transformed).value as { value: unknown; error: unknown };
+        if (stmtResult.error) {
+          replGen.next(); // advance past wait-for-code yield
+          throw stmtResult.error;
+        }
+        replGen.next(); // advance past wait-for-code yield
+        return stmtResult.value;
+      },
+    };
+  }
 }
 
 /**

package/src/server-bridge.ts

@@ -12,6 +12,9 @@ import {
 } from './shims/http';
 import { EventEmitter } from './shims/events';
 import { Buffer } from './shims/stream';
+import { uint8ToBase64 } from './utils/binary-encoding';
+
+const _encoder = new TextEncoder();
 
 /**
  * Interface for virtual servers that can be registered with the bridge
@@ -50,11 +53,13 @@ export interface InitServiceWorkerOptions {
  * Server Bridge manages virtual HTTP servers and routes requests
  */
 export class ServerBridge extends EventEmitter {
+  static DEBUG = false;
   private servers: Map<number, VirtualServer> = new Map();
   private baseUrl: string;
   private options: BridgeOptions;
   private messageChannel: MessageChannel | null = null;
   private serviceWorkerReady: boolean = false;
+  private keepaliveInterval: ReturnType<typeof setInterval> | null = null;
 
   constructor(options: BridgeOptions = {}) {
     super();
@@ -164,6 +169,15 @@ export class ServerBridge extends EventEmitter {
 
     const swUrl = options?.swUrl ?? '/__sw__.js';
 
+    // Set up controllerchange listener BEFORE registration so we don't miss the event.
+    // clients.claim() in the SW's activate handler fires controllerchange, and it can
+    // happen before our activation wait completes.
+    const controllerReady = navigator.serviceWorker.controller
+      ? Promise.resolve()
+      : new Promise<void>((resolve) => {
+          navigator.serviceWorker.addEventListener('controllerchange', () => resolve(), { once: true });
+        });
+
     // Register service worker
     const registration = await navigator.serviceWorker.register(swUrl, {
       scope: '/',
@@ -180,11 +194,13 @@ export class ServerBridge extends EventEmitter {
       if (sw.state === 'activated') {
         resolve();
       } else {
-        sw.addEventListener('statechange', () => {
+        const handler = () => {
           if (sw.state === 'activated') {
+            sw.removeEventListener('statechange', handler);
             resolve();
           }
-        });
+        };
+        sw.addEventListener('statechange', handler);
       }
     });
 
@@ -197,6 +213,36 @@ export class ServerBridge extends EventEmitter {
       this.messageChannel.port2,
     ]);
 
+    // Wait for SW to actually control this page (clients.claim() in SW activate handler)
+    // Without this, fetch requests bypass the SW and go directly to the server
+    await controllerReady;
+
+    // Re-establish communication when the SW loses its port (idle termination)
+    // or when the SW is replaced (new deployment). The SW sends 'sw-needs-init'
+    // to all clients when a request arrives but mainPort is null.
+    const reinit = () => {
+      if (navigator.serviceWorker.controller) {
+        this.messageChannel = new MessageChannel();
+        this.messageChannel.port1.onmessage = this.handleServiceWorkerMessage.bind(this);
+        navigator.serviceWorker.controller.postMessage(
+          { type: 'init', port: this.messageChannel.port2 },
+          [this.messageChannel.port2]
+        );
+      }
+    };
+    navigator.serviceWorker.addEventListener('controllerchange', reinit);
+    navigator.serviceWorker.addEventListener('message', (event) => {
+      if (event.data?.type === 'sw-needs-init') {
+        reinit();
+      }
+    });
+
+    // Keep the SW alive with periodic pings. Browsers terminate idle SWs
+    // after ~30s, losing the MessageChannel port and all in-memory state.
+    this.keepaliveInterval = setInterval(() => {
+      this.messageChannel?.port1.postMessage({ type: 'keepalive' });
+    }, 20_000);
+
     this.serviceWorkerReady = true;
     this.emit('sw-ready');
   }
@@ -207,14 +253,14 @@ export class ServerBridge extends EventEmitter {
   private async handleServiceWorkerMessage(event: MessageEvent): Promise<void> {
     const { type, id, data } = event.data;
 
-    console.log('[ServerBridge] SW message:', type, id, data?.url);
+    ServerBridge.DEBUG && console.log('[ServerBridge] SW message:', type, id, data?.url);
 
     if (type === 'request') {
       const { port, method, url, headers, body, streaming } = data;
 
-      console.log('[ServerBridge] Handling request:', port, method, url, 'streaming:', streaming);
+      ServerBridge.DEBUG && console.log('[ServerBridge] Handling request:', port, method, url, 'streaming:', streaming);
       if (streaming) {
-        console.log('[ServerBridge] 🔴 Will use streaming handler');
+        ServerBridge.DEBUG && console.log('[ServerBridge] 🔴 Will use streaming handler');
       }
 
       try {
@@ -224,21 +270,16 @@ export class ServerBridge extends EventEmitter {
         } else {
           // Handle regular request
           const response = await this.handleRequest(port, method, url, headers, body);
-          console.log('[ServerBridge] Response:', response.statusCode, 'body length:', response.body?.length);
+          ServerBridge.DEBUG && console.log('[ServerBridge] Response:', response.statusCode, 'body length:', response.body?.length);
 
           // Convert body to base64 string to avoid structured cloning issues with Uint8Array
           let bodyBase64 = '';
           if (response.body && response.body.length > 0) {
-            // Convert Uint8Array to base64 string
             const bytes = response.body instanceof Uint8Array ? response.body : new Uint8Array(0);
-            let binary = '';
-            for (let i = 0; i < bytes.length; i++) {
-              binary += String.fromCharCode(bytes[i]);
-            }
-            bodyBase64 = btoa(binary);
+            bodyBase64 = uint8ToBase64(bytes);
           }
 
-          console.log('[ServerBridge] Sending response to SW, body base64 length:', bodyBase64.length);
+          ServerBridge.DEBUG && console.log('[ServerBridge] Sending response to SW, body base64 length:', bodyBase64.length);
 
           this.messageChannel?.port1.postMessage({
             type: 'response',
@@ -287,7 +328,7 @@ export class ServerBridge extends EventEmitter {
     // Check if the server supports streaming (has handleStreamingRequest method)
     const server = virtualServer.server as any;
     if (typeof server.handleStreamingRequest === 'function') {
-      console.log('[ServerBridge] 🟢 Server has streaming support, calling handleStreamingRequest');
+      ServerBridge.DEBUG && console.log('[ServerBridge] 🟢 Server has streaming support, calling handleStreamingRequest');
       // Use streaming handler
       const bodyBuffer = body ? Buffer.from(new Uint8Array(body)) : undefined;
 
@@ -298,7 +339,7 @@ export class ServerBridge extends EventEmitter {
         bodyBuffer,
         // onStart - called with headers
         (statusCode: number, statusMessage: string, respHeaders: Record<string, string>) => {
-          console.log('[ServerBridge] 🟢 onStart called, sending stream-start');
+          ServerBridge.DEBUG && console.log('[ServerBridge] 🟢 onStart called, sending stream-start');
           this.messageChannel?.port1.postMessage({
             type: 'stream-start',
             id,
@@ -307,13 +348,9 @@ export class ServerBridge extends EventEmitter {
         },
         // onChunk - called for each chunk
         (chunk: string | Uint8Array) => {
-          const bytes = typeof chunk === 'string' ? new TextEncoder().encode(chunk) : chunk;
-          let binary = '';
-          for (let i = 0; i < bytes.length; i++) {
-            binary += String.fromCharCode(bytes[i]);
-          }
-          const chunkBase64 = btoa(binary);
-          console.log('[ServerBridge] 🟡 onChunk called, sending stream-chunk, size:', chunkBase64.length);
+          const bytes = typeof chunk === 'string' ? _encoder.encode(chunk) : chunk;
+          const chunkBase64 = uint8ToBase64(bytes);
+          ServerBridge.DEBUG && console.log('[ServerBridge] 🟡 onChunk called, sending stream-chunk, size:', chunkBase64.length);
           this.messageChannel?.port1.postMessage({
             type: 'stream-chunk',
             id,
@@ -322,7 +359,7 @@ export class ServerBridge extends EventEmitter {
         },
         // onEnd - called when response is complete
         () => {
-          console.log('[ServerBridge] 🟢 onEnd called, sending stream-end');
+          ServerBridge.DEBUG && console.log('[ServerBridge] 🟢 onEnd called, sending stream-end');
           this.messageChannel?.port1.postMessage({ type: 'stream-end', id });
         }
       );
@@ -344,14 +381,10 @@ export class ServerBridge extends EventEmitter {
 
       if (response.body && response.body.length > 0) {
         const bytes = response.body instanceof Uint8Array ? response.body : new Uint8Array(0);
-        let binary = '';
-        for (let i = 0; i < bytes.length; i++) {
-          binary += String.fromCharCode(bytes[i]);
-        }
         this.messageChannel?.port1.postMessage({
           type: 'stream-chunk',
           id,
-          data: { chunkBase64: btoa(binary) },
+          data: { chunkBase64: uint8ToBase64(bytes) },
         });
       }
 

package/src/shims/crypto.ts

@@ -16,6 +16,18 @@ export function randomBytes(size: number): Buffer {
   return Buffer.from(array);
 }
 
+export function randomFillSync(
+  buffer: Uint8Array | Buffer,
+  offset?: number,
+  size?: number
+): Uint8Array | Buffer {
+  const start = offset || 0;
+  const len = size !== undefined ? size : (buffer.length - start);
+  const view = new Uint8Array(buffer.buffer, buffer.byteOffset + start, len);
+  crypto.getRandomValues(view);
+  return buffer;
+}
+
 export function randomUUID(): string {
   return crypto.randomUUID();
 }
@@ -808,6 +820,7 @@ async function importKey(
 
 export default {
   randomBytes,
+  randomFillSync,
   randomUUID,
   randomInt,
   getRandomValues,

package/src/shims/esbuild.ts

@@ -717,7 +717,7 @@ export async function build(options: BuildOptions): Promise<BuildResult> {
   // This preserves the original paths for esbuild's output file naming.
   let entryPoints = options.entryPoints;
   if (entryPoints && globalVFS) {
-    const absWorkingDir = options.absWorkingDir || '/';
+    const absWorkingDir = options.absWorkingDir || (typeof globalThis !== 'undefined' && globalThis.process && typeof globalThis.process.cwd === 'function' ? globalThis.process.cwd() : '/');
     entryPoints = entryPoints.map(ep => {
       // Handle paths that came from previous builds with vfs: namespace prefix
       if (ep.includes('vfs:')) {
@@ -750,11 +750,14 @@ export async function build(options: BuildOptions): Promise<BuildResult> {
   }
 
   // In browser, we need write: false to get outputFiles
+  // Pass absWorkingDir so metafile paths are relative to the correct directory
+  const resolvedAbsWorkingDir = options.absWorkingDir || (typeof globalThis !== 'undefined' && globalThis.process && typeof globalThis.process.cwd === 'function' ? globalThis.process.cwd() : '/');
   const result = await esbuildInstance.build({
     ...options,
     entryPoints,
     plugins,
     write: false,
+    absWorkingDir: resolvedAbsWorkingDir,
   }) as BuildResult;
 
   // Strip 'vfs:' namespace prefix from output file paths