Nested export-star expansion breaks OpenAI SDK webhooks re-exports

[Vercantez]

Summary

@secure-exec/nodejs currently expands export * from ... re-exports only one hop deep in packages/nodejs/src/module-source.ts.

That breaks packages that use nested star re-exports, including the OpenAI SDK. In our case this surfaced as OpenRouter-backed Pi sessions inside AgentOS returning empty output because the loader rewrote one of the OpenAI SDK webhooks modules into an empty module.

Concrete failure

The OpenAI SDK has this chain:

• openai/resources/webhooks.mjs -> export * from "./webhooks/index.mjs"
• openai/resources/webhooks/index.mjs -> export * from "./webhooks.mjs"
• openai/resources/webhooks/webhooks.mjs -> export class Webhooks ...

Because expandStarReExports() only looks at direct named exports from the first target, it sees no named exports on the intermediate module and replaces the star re-export with nothing.

That leads to runtime failures like:

• The requested module './webhooks.mjs' does not provide an export named 'Webhooks'

Expected behavior

Star re-export expansion should resolve named exports recursively across nested export * chains (with cycle protection), not just one hop deep.

Repro direction

A minimal regression can be expressed with three files:

• entry.mjs: export * from "./nested/index.mjs"
• nested/index.mjs: export * from "./leaf.mjs"
• nested/leaf.mjs: export class Webhooks {}

Running transformSourceForImportSync() on entry.mjs should preserve the Webhooks named export by rewriting to an explicit named re-export instead of deleting it.

Proposed fix

Recursively collect named exports when resolving star re-exports, and add a unit test in packages/nodejs/test/module-source.test.ts that covers the nested chain.

I have a patch ready and will open a PR next.