Function create_node_api_scope_values 

pub unsafe fn create_node_api_scope_values(
    cx: &mut JSContext,
    global: Handle<'_, *mut JSObject>,
    scope_name: &str,
)

Create Node API scope values for privileged evaluate_js (REQ-SEC-002).

Creates a temporary scope object on global with a randomized name (e.g., __bao_7f3a9c2e) and puts all Node API values into it. The IIFE wrapper in wrap_privileged_script then:

1. Extracts the scope object: var __scope = globalThis[scopeName]
2. Deletes the scope: delete globalThis[scopeName]
3. Deletes global Buffer: delete globalThis.Buffer
4. Passes scope values as function parameters to the user script

The scope name is randomized per-call to prevent adversarial enumeration. __bao_setEnv/__bao_delEnv are installed on the scope object (not global) and passed into the process.env Proxy as factory parameters, eliminating them from the global surface entirely.

Safety

Caller must ensure cx is a valid JSContext pointer and global is a valid handle to the global object. This function is called from servo’s register_script_thread_callback, which runs on the script thread.