[steipete]

Bun's inherited __esModule accessor makes tsx unwrap an ordinary ESM namespace and lose explicit exports such as zod.z. This adds a native require(esm) facade with an own enumerable marker, null prototype, and live export bindings. Imported namespaces stay unmarked; explicit marker exports and normal namespace mutation rules are preserved.

Adapts the own-property work in oven-sh/WebKit#279 by @robobun, together with oven-sh/bun#33894. The paired Bun adapter removes the prototype override, covers normal require and require-cache materialization, preserves explicit CJS markers, and keeps native namespaces forwarded through CJS intact. Bun's existing ESM cache invalidation policy is unchanged.

The read-only PR workflow builds the unchanged Linux engine lane, checks JSC results, and qualifies the matching Bun adapter. Publication remains in the separate manual artifact workflow. Engine and Bun must be rebuilt together.

Validation on one AWS Linux c7a.24xlarge:

• Node 24 marker-reflection matrix matches exactly across 10 ESM/CJS shapes; import-first, require-first, cache-first, explicit markers, live bindings, and CJS forwarding controls pass.
• Both minimal Zod reproductions pass, including import-then-require.
• 138 JSC configurations, 159 focused/plugin tests, and four continuous-GC controls pass.
• Fork selection: all 46 result rows pass across 44 files and two dependency checks, with zero regressions.
• Real production UI Vite/tsx builds, grouped and individual modules: Node 2/2, baseline Bun 0/2 with missing zod.z, patched Bun 2/2.
• Broader module/VM run: 1,545 pass, eight skips, 64 existing TODOs. Two unrelated baseline failures and a release-only internal-test-module import error remain; all reproduce before this change.
• Isolated Codex review is scoped-clean through P2.

ABBA performance uses eight measured samples per arm. Warm namespace reads are unchanged (-0.03%); cached require/import are +0.13%/+0.69%. Fresh CJS imports are +2.09%. First ESM require costs +5.87% (47.69 → 50.49 ms per 1,024 modules), and reflection costs +14.42% (52.11 → 59.62 ms per 300,000 iterations) while exposing the additional own marker. The extra facade allocation and enumerable property have a measurable cost on these paths.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.