runner: shim @a2ui/web_core's import attributes for the live preview

[GreenFlux]

Summary

Demos built on @a2ui/react publish and embed fine (/d, /embed are Vite builds) but their live preview on /edit and /share fails at setup with:

SyntaxError: /node_modules/@a2ui/web_core/src/v0_9/index.js: Support for the experimental syntax 'moduleAttributes' isn't currently enabled (44:68)

The classic Sandpack bundler's babel 6 cannot parse import attributes, and @a2ui/web_core 0.12 uses import x from './schemas/x.json' with { type: 'json' } in exactly two of its ~140 files, the v0.9 and v0.8 entry points.

This PR:

• lets a DEP_SHIMS entry name individual files to shadow in place ({ files: [...] }) instead of a single self-contained dist, the same per-file shadowing shimHandsontable already does for prerelease builds. The package's own package.json and exports map stay the packager's copy, so subpath imports and the shadowed files' relative imports keep resolving.
• strips import attributes in the dependency pre-transpile: import ... with {}, export ... from ... with {}, and the options argument of import(). Babel 8 parses the clause by default; emptying the node leaves a plain JSON import for the bundler's own loader.
• shims those two @a2ui/web_core files. The shim cache key now includes the file path so multi-file entries do not collide.
• adds a live e2e (e2e/dep-shims-live.spec.ts, opt-in via E2E_LIVE=1) that boots the failing project through a stubbed ?payload= against the real hosted bundler and asserts the grid renders with no parse error. The project is a fixture, so no demo is created.

Reproduces on https://demos.handsontable.com/edit/34326g6e4v (the A2UI recipe demo embedded by handsontable/handsontable#13734).

Test plan

• pnpm test in runner/: 2,726 passing, including new dep-shims cases for per-file shadowing, attribute stripping on import, export-from, and import(), per-file cache keys, and an ES2017 parse of the shadowed output.
• pnpm typecheck clean.
• Live e2e against the local build (E2E_LIVE=1 npx playwright test e2e/dep-shims-live.spec.ts): passes in 9 s, grid rendered, JSON schema import served by the bundler.
• Same spec against production (E2E_BASE_URL=https://demos.handsontable.com), which has no shim: fails, preview never renders. The test discriminates.
• After deploy: /edit/34326g6e4v previews.

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches the Sandpack dependency shim and transpile path used by all live previews; scope is narrow (new shim shape + attribute stripping) but incorrect shadowing could break other packages.

Overview
Fixes live Sandpack preview failures for @a2ui/web_core 0.12 demos where babel 6 rejects import attributes (with { type: "json" }) in the package’s v0.8/v0.9 entry files.

Dependency shims now support a { files: [...] } mode that shadows only specific paths under /node_modules (like prerelease Handsontable), leaving the packager’s package.json / exports intact. @a2ui/web_core is registered to shim those two entry files; shim cache keys include the file path.

Pre-transpile adds a Babel plugin that strips import/export attributes and dynamic import() options so the classic bundler can parse the shadowed sources and use its JSON loader.

Tests: unit cases in dep-shims.test.mjs for per-file shadowing, attribute stripping, and caching; an opt-in live Playwright spec (E2E_LIVE=1) boots an a2ui-hotgrid fixture via stubbed ?payload= and asserts the Handsontable grid renders without moduleAttributes parse errors.

^{Reviewed by Cursor Bugbot for commit 523d259. Bugbot is set up for automated code reviews on this repo. Configure here.}