fix(bundle-source): apply eval evasion for cjs modules too

packages/bundle-source/src/zip-base64.js

@@ -108,6 +108,35 @@ export async function bundleZipBase64(
     };
   }
 
+  /**
+   * @param {import('@endo/compartment-mapper/src/types.js').Language} parser
+   * @param {Uint8Array} sourceBytes
+   * @param {string} specifier
+   * @param {string} location
+   * @param {string|import('source-map').RawSourceMap} sourceMap
+   */
+  const transformModuleSource = async (
+    parser,
+    sourceBytes,
+    specifier,
+    location,
+    sourceMap,
+  ) => {
+    if (!['mjs', 'cjs'].includes(parser)) {
+      throw Error(`Parser ${parser} not supported in evadeEvalCensor`);
+    }
+    const babelSourceType = parser === 'mjs' ? 'module' : 'script';
+    const source = textDecoder.decode(sourceBytes);
+    let object;
+    ({ code: object, map: sourceMap } = await evadeCensor(source, {
+      sourceType: babelSourceType,
+      sourceMap,
+      sourceMapUrl: new URL(specifier, location).href,
+    }));
+    const objectBytes = textEncoder.encode(object);
+    return { bytes: objectBytes, parser, sourceMap };
+  };
+
   const { bytes, sha512 } = await makeAndHashArchive(powers, entry, {
     dev,
     moduleTransforms: {
@@ -118,15 +147,28 @@ export async function bundleZipBase64(
         _packageLocation,
         { sourceMap },
       ) {
-        const source = textDecoder.decode(sourceBytes);
-        let object;
-        ({ code: object, map: sourceMap } = await evadeCensor(source, {
+        return transformModuleSource(
+          'mjs',
+          sourceBytes,
+          specifier,
+          location,
+          sourceMap,
+        );
+      },
+      async cjs(
+        sourceBytes,
+        specifier,
+        location,
+        _packageLocation,
+        { sourceMap },
+      ) {
+        return transformModuleSource(
+          'cjs',
+          sourceBytes,
+          specifier,
+          location,
           sourceMap,
-          sourceUrl: new URL(specifier, location).href,
-          sourceType: 'module',
-        }));
-        const objectBytes = textEncoder.encode(object);
-        return { bytes: objectBytes, parser: 'mjs', sourceMap };
+        );
       },
     },
     sourceMapHook(sourceMap, sourceDescriptor) {