webpack 5.110.2 → 5.111.0

package/lib/runtime/MakeDeferredNamespaceObjectRuntime.js

@@ -290,7 +290,17 @@ class MakeOptimizedDeferredNamespaceObjectRuntimeModule extends HelperRuntimeMod
 				]),
 				"};",
 				hasAsync
-					? `if(isAsync) obj[${RuntimeGlobals.deferredModuleAsyncTransitiveDependenciesSymbol}] = asyncDeps;`
+					? // `evaluating` is on the stack, so awaiting it would deadlock;
+						// `evaluating-async` is suspended and must still be awaited.
+						`if(isAsync) obj[${RuntimeGlobals.deferredModuleAsyncTransitiveDependenciesSymbol}] = asyncDeps.filter(${runtimeTemplate.basicFunction(
+							"id",
+							[
+								`${cst} dep = __webpack_module_cache__[id];`,
+								"if (dep && dep.evaluating) return false;",
+								"r(id);",
+								"return true;"
+							]
+						)});`
 					: "",
 				"return obj;"
 			]),
@@ -312,11 +322,17 @@ class MakeDeferredNamespaceObjectRuntimeModule extends HelperRuntimeModule {
 
 	/**
 	 * @param {boolean} hasAsyncRuntime if async module is used.
+	 * @param {boolean} sealed a call site builds a namespace from a known export list
+	 * @param {boolean} synthesized a call site builds one from the module's exports
 	 */
-	constructor(hasAsyncRuntime) {
+	constructor(hasAsyncRuntime, sealed, synthesized) {
 		super("make deferred namespace object");
 		/** @type {boolean} */
 		this.hasAsyncRuntime = hasAsyncRuntime;
+		/** @type {boolean} */
+		this.sealed = sealed;
+		/** @type {boolean} */
+		this.synthesized = synthesized;
 	}
 
 	/**
@@ -330,237 +346,342 @@ class MakeDeferredNamespaceObjectRuntimeModule extends HelperRuntimeModule {
 		const lt = runtimeTemplate.renderLet();
 		const fn = RuntimeGlobals.makeDeferredNamespaceObject;
 		const hasAsync = this.hasAsyncRuntime;
+		// A build reaches only the shapes its call sites ask for, so the other
+		// one's branches are dead weight in every bundle that ships this runtime.
+		const sealed = this.sealed;
+		const synthesized = this.synthesized;
 		const init = `${runtimeTemplate.optionalChaining("init", "()")};`;
-		return `${fn} = ${runtimeTemplate.basicFunction("moduleId, mode", [
-			// Per the TC39 import-defer spec, deferred namespaces are
-			// distinct from their eager counterparts and the same module
-			// referenced from multiple defer-import sites must yield the
-			// same object. Cache the Proxy / fake namespace per-moduleId so
-			// repeated calls (including across files) share identity.
-			//
-			// Bit 16 (`createFakeNamespaceObject`'s "return value when
-			// it's Promise-like" flag added by
-			// `RuntimeTemplate.moduleNamespacePromise` for dynamic
-			// imports) is irrelevant for deferred namespaces — the value
-			// passed into `createFakeNamespaceObject` here is always the
-			// resolved module exports (after unwrapping the async-module
-			// export symbol when present), never a Promise. Strip it
-			// once so all downstream behavior, the cache key, and the
-			// `createFakeNamespaceObject` call below see the same shape
-			// mode. This keeps static defer (mode 8) and dynamic
-			// `await import.defer` (mode 8 | 16) sharing the same
-			// Deferred Module Namespace object, while still keying by
-			// `(moduleId, mode)` so distinct exports-type shapes
-			// (e.g. one importer treats a CJS module as
-			// "default-with-named", another as "namespace") get
-			// distinct cache entries.
-			"mode &= ~16;",
-			`${lt} byMode = __webpack_module_deferred_namespace_cache__[moduleId];`,
-			"if (byMode && byMode[mode] !== undefined) return byMode[mode];",
-			"if (!byMode) byMode = __webpack_module_deferred_namespace_cache__[moduleId] = {};",
-			`${cst} cachedModule = __webpack_module_cache__[moduleId];`,
-			"if (cachedModule && cachedModule.error === undefined && !(mode & 8)) {",
-			Template.indent([
-				`${lt} exports = cachedModule.exports;`,
-				hasAsync
-					? `if (${RuntimeGlobals.asyncModuleExportSymbol} in exports) exports = exports[${RuntimeGlobals.asyncModuleExportSymbol}];`
+		return `${fn} = ${runtimeTemplate.basicFunction(
+			"moduleId, mode, exportNames",
+			[
+				// Per the TC39 import-defer spec, deferred namespaces are
+				// distinct from their eager counterparts and the same module
+				// referenced from multiple defer-import sites must yield the
+				// same object. Cache the Proxy / fake namespace per-moduleId so
+				// repeated calls (including across files) share identity.
+				//
+				// Bit 16 (`createFakeNamespaceObject`'s "return value when
+				// it's Promise-like" flag added by
+				// `RuntimeTemplate.moduleNamespacePromise` for dynamic
+				// imports) is irrelevant for deferred namespaces — the value
+				// passed into `createFakeNamespaceObject` here is always the
+				// resolved module exports (after unwrapping the async-module
+				// export symbol when present), never a Promise. Strip it
+				// once so all downstream behavior, the cache key, and the
+				// `createFakeNamespaceObject` call below see the same shape
+				// mode. This keeps static defer (mode 8) and dynamic
+				// `await import.defer` (mode 8 | 16) sharing the same
+				// Deferred Module Namespace object, while still keying by
+				// `(moduleId, mode)` so distinct exports-type shapes
+				// (e.g. one importer treats a CJS module as
+				// "default-with-named", another as "namespace") get
+				// distinct cache entries.
+				"mode &= ~16;",
+				// Only a real ES module namespace has the spec's exotic shape; a
+				// synthesized one (JSON, asset, CommonJS interop) keeps the old form.
+				sealed && synthesized
+					? "if (!(mode & 8)) exportNames = undefined;"
 					: "",
-				`return byMode[mode] = ${RuntimeGlobals.createFakeNamespaceObject}(exports, mode);`
-			]),
-			"}",
-			"",
-			`${lt} init = ${runtimeTemplate.basicFunction("", [
-				// A deferred namespace that forces evaluation of a module that is
-				// already evaluating (a cycle) must throw rather than expose its
-				// partial exports.
-				`${cst} evaluatingModule = __webpack_module_cache__[moduleId];`,
-				'if (evaluatingModule !== undefined && (evaluatingModule.evaluating || evaluatingModule.evaluatingAsync)) throw new TypeError("Cannot access a deferred module namespace while the module is being evaluated");',
-				`ns = ${RuntimeGlobals.require}(moduleId);`,
-				hasAsync
-					? `if (${RuntimeGlobals.asyncModuleExportSymbol} in ns) ns = ns[${RuntimeGlobals.asyncModuleExportSymbol}];`
+				`${lt} byMode = __webpack_module_deferred_namespace_cache__[moduleId];`,
+				"if (byMode && byMode[mode] !== undefined) return byMode[mode];",
+				"if (!byMode) byMode = __webpack_module_deferred_namespace_cache__[moduleId] = {};",
+				synthesized
+					? `${cst} cachedModule = __webpack_module_cache__[moduleId];`
 					: "",
-				"init = null;",
-				"if (mode & 8 || mode & 4 && ns.__esModule && typeof ns === 'object') {",
-				Template.indent([
-					// Drop only the read-side traps after init: with the
-					// resolved namespace's own keys mirrored onto
-					// `ns_target` below, the default `Reflect` behavior
-					// returns the right values via the live-binding
-					// getters, so we no longer need to intercept `get` /
-					// `has` / `ownKeys` / `getOwnPropertyDescriptor`.
-					//
-					// The mutation traps (`set`, `deleteProperty`,
-					// `defineProperty`) are kept because per the TC39
-					// import-defer spec, `[[Set]]` / `[[Delete]]` /
-					// `[[DefineOwnProperty]]` on a Deferred Module
-					// Namespace Exotic Object never succeed — and the
-					// proxy target itself remains extensible
-					// (architecturally we cannot freeze it up-front),
-					// so without these traps `ns.notExported = "x"`
-					// after evaluation would silently create a property
-					// on the target instead of returning false.
-					"delete handler.get;",
-					"delete handler.has;",
-					"delete handler.ownKeys;",
-					"delete handler.getOwnPropertyDescriptor;"
-				]),
-				"} else {",
-				Template.indent([
-					`ns = ${RuntimeGlobals.createFakeNamespaceObject}(ns, mode);`
-				]),
-				"}",
-				// Mirror own properties from the resolved namespace onto the proxy
-				// target so that proxy invariants hold for callers that structurally
-				// introspect via `Object.keys` / `Object.getOwnPropertyNames` /
-				// `Object.getOwnPropertyDescriptor`: when our trap reports a
-				// non-configurable descriptor for a key, the target must also have
-				// that key with a matching descriptor.
-				//
-				// `__esModule` and `Symbol.toStringTag` are intentionally skipped:
-				// the proxy synthesizes "Deferred Module" / true regardless of what
-				// the underlying namespace exposes (per the TC39 import-defer
-				// proposal, the [[StringTag]] of a Deferred Module Namespace
-				// Exotic Object is "Deferred Module"), and the target was already
-				// pre-populated with those values below.
-				`${cst} keys = Reflect.ownKeys(ns);`,
-				"for (var i = 0; i < keys.length; i++) {",
-				Template.indent([
-					`${cst} k = keys[i];`,
-					'if (k === "__esModule" || k === Symbol.toStringTag) continue;',
-					`if (!${runtimeTemplate.objectHasOwn("ns_target", "k")}) {`,
-					Template.indent([
-						"try { Object.defineProperty(ns_target, k, Reflect.getOwnPropertyDescriptor(ns, k)); } catch (_) {}"
-					]),
-					"}"
-				]),
-				"}"
-			])};`,
-			"",
-			// The proxy target is a fresh placeholder, separate from
-			// `__webpack_module_deferred_exports__[moduleId]` (which is reused
-			// by `__webpack_require__` as `module.exports` for deferred-loaded
-			// modules and would conflict with our pre-populated synthetic
-			// `__esModule` / `Symbol.toStringTag` non-configurable properties).
-			// Using a dedicated target keeps the proxy invariant-compliant
-			// without interfering with the module's own exports object.
-			`${cst} ns_target = { __proto__: null };`,
-			// Pre-populate the synthetic deferred-namespace properties with
-			// fully non-configurable, non-writable, non-enumerable descriptors
-			// (matching the TC39 import-defer spec for Module Namespace
-			// Exotic Objects). The trap returns the same descriptors below.
-			'Object.defineProperty(ns_target, "__esModule", { value: true });',
-			'Object.defineProperty(ns_target, Symbol.toStringTag, { value: "Deferred Module" });',
-			`${lt} ns = ns_target;`,
-			`${cst} handler = {`,
-			Template.indent([
-				"__proto__: null,",
-				// Per the TC39 import-defer proposal, `IsSymbolLikeNamespaceKey`
-				// returns true for any Symbol-keyed access (and for "then"); such
-				// accesses go through `OrdinaryGetOwnProperty` and must not
-				// trigger evaluation of the deferred module. The Symbol checks
-				// below short-circuit to the pre-populated target without
-				// running `init()`.
-				`${runtimeTemplate.method("get", "_, name", [
-					"switch (name) {",
-					Template.indent([
-						'case "__esModule": return true;',
-						'case Symbol.toStringTag: return "Deferred Module";',
-						'case "then": return undefined;'
-					]),
-					"}",
-					'if (typeof name === "symbol") return ns_target[name];',
-					init,
-					"return ns[name];"
-				])},`,
-				`${runtimeTemplate.method("has", "_, name", [
-					"switch (name) {",
-					Template.indent(
-						[
-							'case "__esModule":',
-							"case Symbol.toStringTag:",
+				synthesized
+					? "if (cachedModule && cachedModule.error === undefined && !(mode & 8)) {"
+					: "",
+				synthesized
+					? Template.indent([
+							`${lt} exports = cachedModule.exports;`,
 							hasAsync
-								? `case ${RuntimeGlobals.deferredModuleAsyncTransitiveDependenciesSymbol}:`
+								? `if (${RuntimeGlobals.asyncModuleExportSymbol} in exports) exports = exports[${RuntimeGlobals.asyncModuleExportSymbol}];`
 								: "",
-							Template.indent("return true;"),
-							'case "then":',
-							Template.indent("return false;")
-						].filter(Boolean)
-					),
-					"}",
-					'if (typeof name === "symbol") return name in ns_target;',
-					init,
-					"return name in ns;"
-				])},`,
-				`${runtimeTemplate.method("ownKeys", "", [
-					init,
-					`${cst} filtered = Reflect.ownKeys(ns).filter(${runtimeTemplate.expressionFunction(
-						'x !== "then" && x !== Symbol.toStringTag',
-						"x"
-					)});`,
-					`${cst} keys = ${
-						runtimeTemplate.supportsSpread()
-							? "[...filtered, Symbol.toStringTag]"
-							: "filtered.concat([Symbol.toStringTag])"
-					};`,
-					"return keys;"
-				])},`,
-				`${runtimeTemplate.method("getOwnPropertyDescriptor", "_, name", [
-					"switch (name) {",
+							`return byMode[mode] = ${RuntimeGlobals.createFakeNamespaceObject}(exports, mode);`
+						])
+					: "",
+				synthesized ? "}" : "",
+				"",
+				`${lt} init = ${runtimeTemplate.basicFunction("", [
+					// A deferred namespace that forces evaluation of a module that is
+					// already evaluating (a cycle) must throw rather than expose its
+					// partial exports.
+					`${cst} evaluatingModule = __webpack_module_cache__[moduleId];`,
+					'if (evaluatingModule !== undefined && (evaluatingModule.evaluating || evaluatingModule.evaluatingAsync)) throw new TypeError("Cannot access a deferred module namespace while the module is being evaluated");',
+					`ns = ${RuntimeGlobals.require}(moduleId);`,
+					hasAsync
+						? `if (${RuntimeGlobals.asyncModuleExportSymbol} in ns) ns = ns[${RuntimeGlobals.asyncModuleExportSymbol}];`
+						: "",
+					"init = null;",
+					synthesized
+						? "if (mode & 8 || mode & 4 && ns.__esModule && typeof ns === 'object') {"
+						: "",
 					Template.indent([
-						// Match the descriptors actually defined on `ns_target`
-						// (non-configurable, non-writable, non-enumerable) so the
-						// proxy invariant holds for both the trap result and any
-						// post-init forwarding via the deleted-handler path.
-						'case "__esModule": return { value: true, writable: false, enumerable: false, configurable: false };',
-						'case Symbol.toStringTag: return { value: "Deferred Module", writable: false, enumerable: false, configurable: false };',
-						'case "then": return undefined;'
+						// Drop only the read-side traps after init: with the
+						// resolved namespace's own keys mirrored onto
+						// `ns_target` below, the default `Reflect` behavior
+						// returns the right values via the live-binding
+						// getters, so we no longer need to intercept `get` /
+						// `has` / `ownKeys` / `getOwnPropertyDescriptor`.
+						//
+						// The mutation traps (`set`, `deleteProperty`,
+						// `defineProperty`) are kept because per the TC39
+						// import-defer spec, `[[Set]]` / `[[Delete]]` /
+						// `[[DefineOwnProperty]]` on a Deferred Module
+						// Namespace Exotic Object never succeed — and the
+						// proxy target itself remains extensible
+						// (architecturally we cannot freeze it up-front),
+						// so without these traps `ns.notExported = "x"`
+						// after evaluation would silently create a property
+						// on the target instead of returning false.
+						// A sealed target holds placeholder values, so the read traps stay to
+						// keep the live bindings visible.
+						sealed && synthesized ? "if (!exportNames) {" : "",
+						synthesized
+							? Template.indent([
+									"delete handler.get;",
+									"delete handler.has;",
+									"delete handler.ownKeys;",
+									"delete handler.getOwnPropertyDescriptor;"
+								])
+							: "",
+						sealed && synthesized ? "}" : ""
 					]),
-					"}",
-					'if (typeof name === "symbol") return Reflect.getOwnPropertyDescriptor(ns_target, name);',
-					init,
-					`${lt} desc = Reflect.getOwnPropertyDescriptor(ns, name);`,
-					'if (mode & 2 && name == "default" && !desc) {',
-					Template.indent("desc = { value: ns, configurable: true };"),
-					"}",
-					"return desc;"
-				])},`,
-				// `defineProperty` always rejects, but per the TC39 spec it
-				// must still trigger evaluation for string keys (the spec
-				// algorithm calls `[[GetOwnProperty]]` first, which forces
-				// evaluation on a deferred namespace). Symbol keys go through
-				// OrdinaryDefineOwnProperty and do not trigger eval.
-				`${runtimeTemplate.method("defineProperty", "_, name", [
-					'if (typeof name === "symbol" || name === "then") return false;',
-					init,
-					"return false;"
-				])},`,
-				// `deleteProperty` rejects, but per the TC39 spec it must
-				// still trigger evaluation for string keys (the spec
-				// algorithm calls `GetModuleExportsList` for non-symbol-like
-				// keys, forcing evaluation on a deferred namespace).
-				`${runtimeTemplate.method("deleteProperty", "_, name", [
-					'if (typeof name === "symbol" || name === "then") return false;',
-					init,
-					"return false;"
-				])},`,
-				// `set` always returns false without triggering evaluation —
-				// the spec [[Set]] algorithm for Module Namespaces is just
-				// "return false" (no [[GetOwnProperty]], no eval).
-				`set: ${runtimeTemplate.returningFunction("false")},`
-			]),
-			"}",
-			// we don't fully emulate ES Module semantics in this Proxy to align with normal webpack esm namespace object.
-			"return byMode[mode] = new Proxy(ns_target, handler);"
-		])};`;
+					synthesized ? "} else {" : "",
+					synthesized
+						? Template.indent([
+								`ns = ${RuntimeGlobals.createFakeNamespaceObject}(ns, mode);`
+							])
+						: "",
+					synthesized ? "}" : "",
+					// Mirror own properties from the resolved namespace onto the proxy
+					// target so that proxy invariants hold for callers that structurally
+					// introspect via `Object.keys` / `Object.getOwnPropertyNames` /
+					// `Object.getOwnPropertyDescriptor`: when our trap reports a
+					// non-configurable descriptor for a key, the target must also have
+					// that key with a matching descriptor.
+					//
+					// `__esModule` and `Symbol.toStringTag` are intentionally skipped:
+					// the proxy synthesizes "Deferred Module" / true regardless of what
+					// the underlying namespace exposes (per the TC39 import-defer
+					// proposal, the [[StringTag]] of a Deferred Module Namespace
+					// Exotic Object is "Deferred Module"), and the target was already
+					// pre-populated with those values below.
+					synthesized
+						? `${cst} keys = ${sealed ? "exportNames ? [] : " : ""}Reflect.ownKeys(ns);`
+						: "",
+					synthesized ? "for (var i = 0; i < keys.length; i++) {" : "",
+					synthesized
+						? Template.indent([
+								`${cst} k = keys[i];`,
+								'if (k === "__esModule" || k === Symbol.toStringTag) continue;',
+								`if (!${runtimeTemplate.objectHasOwn("ns_target", "k")}) {`,
+								Template.indent([
+									"try { Object.defineProperty(ns_target, k, Reflect.getOwnPropertyDescriptor(ns, k)); } catch (_) {}"
+								]),
+								"}"
+							])
+						: "",
+					synthesized ? "}" : ""
+				])};`,
+				"",
+				// The proxy target is a fresh placeholder, separate from
+				// `__webpack_module_deferred_exports__[moduleId]` (which is reused
+				// by `__webpack_require__` as `module.exports` for deferred-loaded
+				// modules and would conflict with our pre-populated synthetic
+				// `__esModule` / `Symbol.toStringTag` non-configurable properties).
+				// Using a dedicated target keeps the proxy invariant-compliant
+				// without interfering with the module's own exports object.
+				`${cst} ns_target = { __proto__: null };`,
+				// With the export list known at build time the target carries the spec's
+				// keys and is sealed, so `[[IsExtensible]]` is false up front.
+				sealed
+					? `${synthesized ? "if (exportNames) " : ""}for (var e = 0; e < exportNames.length; e++) ns_target[exportNames[e]] = undefined;`
+					: "",
+				// Pre-populate the synthetic deferred-namespace properties with
+				// fully non-configurable, non-writable, non-enumerable descriptors
+				// (matching the TC39 import-defer spec for Module Namespace
+				// Exotic Objects). The trap returns the same descriptors below.
+				// `__esModule` is not one of the spec's keys, so a sealed namespace omits
+				// it; the synthesized form keeps it for interop.
+				synthesized
+					? `${sealed ? "if (!exportNames) " : ""}Object.defineProperty(ns_target, "__esModule", { value: true });`
+					: "",
+				'Object.defineProperty(ns_target, Symbol.toStringTag, { value: "Deferred Module" });',
+				sealed
+					? `${synthesized ? "if (exportNames) " : ""}Object.seal(ns_target);`
+					: "",
+				`${lt} ns = ns_target;`,
+				`${cst} handler = {`,
+				Template.indent([
+					"__proto__: null,",
+					// Per the TC39 import-defer proposal, `IsSymbolLikeNamespaceKey`
+					// returns true for any Symbol-keyed access (and for "then"); such
+					// accesses go through `OrdinaryGetOwnProperty` and must not
+					// trigger evaluation of the deferred module. The Symbol checks
+					// below short-circuit to the pre-populated target without
+					// running `init()`.
+					`${runtimeTemplate.method("get", "_, name", [
+						"switch (name) {",
+						Template.indent([
+							// webpack's interop marker, read as a property by
+							// `o.__esModule ? o.default : o`, so a sealed namespace
+							// answers it too even though it is not one of its keys.
+							'case "__esModule": return true;',
+							'case Symbol.toStringTag: return "Deferred Module";',
+							'case "then": return undefined;'
+						]),
+						"}",
+						'if (typeof name === "symbol") return ns_target[name];',
+						init,
+						// A sealed namespace has exactly the spec's keys, so anything
+						// else is absent rather than read off the exports object.
+						sealed
+							? `${synthesized ? "if (exportNames) " : ""}return name in ns_target ? ns[name] : undefined;`
+							: "",
+						synthesized ? "return ns[name];" : ""
+					])},`,
+					`${runtimeTemplate.method("has", "_, name", [
+						"switch (name) {",
+						Template.indent(
+							[
+								synthesized
+									? `case "__esModule": ${sealed ? "if (!exportNames) " : ""}return true;${sealed ? " break;" : ""}`
+									: "",
+								"case Symbol.toStringTag:",
+								hasAsync
+									? `case ${RuntimeGlobals.deferredModuleAsyncTransitiveDependenciesSymbol}:`
+									: "",
+								Template.indent("return true;"),
+								'case "then":',
+								Template.indent("return false;")
+							].filter(Boolean)
+						),
+						"}",
+						'if (typeof name === "symbol") return name in ns_target;',
+						init,
+						sealed
+							? `${synthesized ? "if (exportNames) " : ""}return name in ns_target;`
+							: "",
+						synthesized ? "return name in ns;" : ""
+					])},`,
+					`${runtimeTemplate.method("ownKeys", "", [
+						init,
+						// The sealed target already carries the spec's keys, sorted.
+						sealed
+							? `${synthesized ? "if (exportNames) " : ""}return Reflect.ownKeys(ns_target);`
+							: "",
+						synthesized
+							? `${cst} filtered = Reflect.ownKeys(ns).filter(${runtimeTemplate.expressionFunction(
+									'x !== "then" && x !== Symbol.toStringTag',
+									"x"
+								)});`
+							: "",
+						synthesized
+							? `${cst} keys = ${
+									runtimeTemplate.supportsSpread()
+										? "[...filtered, Symbol.toStringTag]"
+										: "filtered.concat([Symbol.toStringTag])"
+								};`
+							: "",
+						synthesized ? "return keys;" : ""
+					])},`,
+					`${runtimeTemplate.method("getOwnPropertyDescriptor", "_, name", [
+						"switch (name) {",
+						Template.indent([
+							// Match the descriptors actually defined on `ns_target`
+							// (non-configurable, non-writable, non-enumerable) so the
+							// proxy invariant holds for both the trap result and any
+							// post-init forwarding via the deleted-handler path.
+							synthesized
+								? `case "__esModule": ${sealed ? "if (!exportNames) " : ""}return { value: true, writable: false, enumerable: false, configurable: false };${sealed ? " break;" : ""}`
+								: "",
+							'case Symbol.toStringTag: return { value: "Deferred Module", writable: false, enumerable: false, configurable: false };',
+							'case "then": return undefined;'
+						]),
+						"}",
+						'if (typeof name === "symbol") return Reflect.getOwnPropertyDescriptor(ns_target, name);',
+						init,
+						// A namespace exposes data properties; webpack backs the exports
+						// with getters, so the spec's shape is synthesized here.
+						sealed
+							? `${synthesized ? "if (exportNames) " : ""}return name in ns_target ? { value: ns[name], writable: true, enumerable: true, configurable: false } : undefined;`
+							: "",
+						synthesized
+							? `${lt} desc = Reflect.getOwnPropertyDescriptor(ns, name);`
+							: "",
+						synthesized ? 'if (mode & 2 && name == "default" && !desc) {' : "",
+						synthesized
+							? Template.indent("desc = { value: ns, configurable: true };")
+							: "",
+						synthesized ? "}" : "",
+						synthesized ? "return desc;" : ""
+					])},`,
+					// `defineProperty` always rejects, but per the TC39 spec it
+					// must still trigger evaluation for string keys (the spec
+					// algorithm calls `[[GetOwnProperty]]` first, which forces
+					// evaluation on a deferred namespace). Symbol keys go through
+					// OrdinaryDefineOwnProperty and do not trigger eval.
+					`${runtimeTemplate.method("defineProperty", "_, name", [
+						'if (typeof name === "symbol" || name === "then") return false;',
+						init,
+						"return false;"
+					])},`,
+					// `deleteProperty` rejects, but per the TC39 spec it must
+					// still trigger evaluation for string keys (the spec
+					// algorithm calls `GetModuleExportsList` for non-symbol-like
+					// keys, forcing evaluation on a deferred namespace).
+					`${runtimeTemplate.method("deleteProperty", "_, name", [
+						'if (typeof name === "symbol" || name === "then") return false;',
+						init,
+						"return false;"
+					])},`,
+					// `set` always returns false without triggering evaluation —
+					// the spec [[Set]] algorithm for Module Namespaces is just
+					// "return false" (no [[GetOwnProperty]], no eval).
+					`set: ${runtimeTemplate.returningFunction("false")},`
+				]),
+				"}",
+				// we don't fully emulate ES Module semantics in this Proxy to align with normal webpack esm namespace object.
+				"return byMode[mode] = new Proxy(ns_target, handler);"
+			]
+		)};`;
 	}
 }
 
+/**
+ * The module's export names, sorted, when the graph knows them exhaustively.
+ * Only a `namespace` module takes the sealed path, and names are never mangled
+ * here: materializing a namespace clears `canMangleUse` on every export.
+ * @param {ModuleGraph} moduleGraph the module graph
+ * @param {Module} module the deferred module
+ * @param {ExportsType} exportsType the module's exports type
+ * @returns {string[] | null} sorted export names, or null when unknown
+ */
+const getKnownExportNames = (moduleGraph, module, exportsType) => {
+	if (exportsType !== "namespace") return null;
+	const exportsInfo = moduleGraph.getExportsInfo(module);
+	if (exportsInfo.otherExportsInfo.provided !== false) return null;
+	const names = [];
+	for (const exportInfo of exportsInfo.orderedExports) {
+		// `false` is a definitive "not an export" (webpack records `__esModule`
+		// that way); anything but a definitive answer means the list is unknown.
+		if (exportInfo.provided === false) continue;
+		if (exportInfo.provided !== true) return null;
+		// A namespace never exposes `then`, so it is not one of the spec's keys.
+		if (exportInfo.name === "then") continue;
+		names.push(exportInfo.name);
+	}
+	return names.sort();
+};
+
 module.exports.MakeDeferredNamespaceObjectRuntimeModule =
 	MakeDeferredNamespaceObjectRuntimeModule;
 module.exports.MakeOptimizedDeferredNamespaceObjectRuntimeModule =
 	MakeOptimizedDeferredNamespaceObjectRuntimeModule;
 module.exports.getDeferredCycleModuleIds = getDeferredCycleModuleIds;
 module.exports.getDeferredCycleModules = getDeferredCycleModules;
+module.exports.getKnownExportNames = getKnownExportNames;
 module.exports.getMakeDeferredNamespaceModeFromExportsType =
 	getMakeDeferredNamespaceModeFromExportsType;
 module.exports.getOptimizedDeferredModule = getOptimizedDeferredModule;

package/lib/runtime/NonceRuntimeModule.js

@@ -23,6 +23,15 @@ class NonceRuntimeModule extends RuntimeModule {
 		return false;
 	}
 
+	/**
+	 * The `[handlerMap, key]` pairs this module installs onto a chunk handler map
+	 * such as `__webpack_require__.f`, or `null` where it cannot name them.
+	 * @returns {[string, string][] | null} installed chunk handlers (do not mutate)
+	 */
+	getInstalledChunkHandlers() {
+		return RuntimeModule.NO_CHUNK_HANDLERS;
+	}
+
 	/**
 	 * Generates runtime code for this runtime module.
 	 * @returns {string | null} runtime code