@nativescript/vite 8.0.0-alpha.1 → 8.0.0-alpha.10

package/hmr/server/websocket.js

@@ -1,23 +1,24 @@
 import { createRequire } from 'node:module';
-import { normalizeStrayCoreStringLiterals, fixDanglingCoreFrom, normalizeAnyCoreSpecToBridge } from './core-sanitize.js';
+import { normalizeStrayCoreStringLiterals, fixDanglingCoreFrom, normalizeAnyCoreSpecToBridge, isDeepCoreSubpath, rewriteSpecifiersForDevice } from './core-sanitize.js';
+import { buildDefaultExportFooter, buildShapeInstallHeader, hasNamespaceReExport, rewriteNamespaceReExportsForShape } from './ns-core-cjs-shape.js';
 // AST tooling for robust transformations
 import { parse as babelParse } from '@babel/parser';
 import { genCode } from '../helpers/babel.js';
 import babelCore from '@babel/core';
-import pluginTransformTypescript from '@babel/plugin-transform-typescript';
 import traverse from '@babel/traverse';
 // Ensure traverse callable across CJS/ESM builds
 const babelTraverse = traverse?.default || traverse;
 import * as t from '@babel/types';
-import { existsSync, readFileSync } from 'fs';
+import { existsSync, readFileSync, statSync } from 'fs';
 import { astNormalizeModuleImportsAndHelpers, astVerifyAndAnnotateDuplicates } from '../helpers/ast-normalizer.js';
+import { getCjsNamedExports } from '../helpers/cjs-named-exports.js';
 import { stripRtCoreSentinel, stripDanglingViteCjsImports } from '../helpers/sanitize.js';
 import { WebSocketServer } from 'ws';
 import * as path from 'path';
 import { createHash } from 'crypto';
 import * as PAT from './constants.js';
 import { getVendorManifest, resolveVendorSpecifier } from '../shared/vendor/registry.js';
-import { getPackageJson, getProjectFilePath } from '../../helpers/project.js';
+import { getMonorepoWorkspaceRoot, getPackageJson, getProjectFilePath, getProjectRootPath } from '../../helpers/project.js';
 import { loadPrebuiltVendorManifest } from '../shared/vendor/manifest-loader.js';
 import '../vendor-bootstrap.js';
 import { NS_NATIVE_TAGS } from './compiler.js';
@@ -30,12 +31,83 @@ import { typescriptServerStrategy } from '../frameworks/typescript/server/strate
 import { buildInlineTemplateBlock, createProcessSfcCode, extractTemplateRender, processTemplateVariantMinimal } from '../frameworks/vue/server/sfc-transforms.js';
 import { astExtractImportsAndStripTypes } from '../helpers/ast-extract.js';
 import { getProjectAppPath, getProjectAppRelativePath, getProjectAppVirtualPath } from '../../helpers/utils.js';
+import { buildRuntimeConfig, generateImportMap } from './import-map.js';
+import { getCliFlags } from '../../helpers/cli-flags.js';
+import { normalizeCoreSub as normalizeCoreSubCanonical } from '../../helpers/ns-core-url.js';
+import { isRuntimeGraphExcludedPath, matchesRuntimeGraphModuleId, normalizeRuntimeGraphPath, shouldIncludeRuntimeGraphFile, shouldSkipRuntimeGraphDirectoryName } from './runtime-graph-filter.js';
+import { resolveAngularCoreHmrImportSource, rewriteAngularEntryRegisterOnly } from './websocket-angular-entry.js';
+import { angularSourceHasSemanticDecorator, canonicalizeTransformRequestCacheKey, collectAngularEvictionUrls, collectAngularHotUpdateRoots, collectAngularTransformCacheInvalidationUrls, collectAngularTransitiveImportersForInvalidation, collectGraphUpdateModulesForHotUpdate, normalizeHotReloadMatchPath, shouldInvalidateAngularTransitiveImporters, shouldSuppressDefaultViteHotUpdate, shouldSuppressViteFullReloadPayload } from './websocket-angular-hot-update.js';
+import { classifyGraphUpsert, shouldBroadcastGraphUpsertDelta, shouldBumpGraphVersion } from './websocket-graph-upsert.js';
+import { classifyBootRoute, classifyHmrUpdateKind, createColdBootRequestCounter, formatHmrUpdateSummary, formatPopulateInitialGraphSummary, formatServerStartupBanner } from './perf-instrumentation.js';
+import { createHmrPendingMessage } from './websocket-hmr-pending.js';
+import { extractVitePrebundleId, filterExistingNodeModulesTransformCandidates, getBlockedDeviceNodeModulesReason, getFlattenedManifestMap, isCoreGlobalsReference, isEsmFrameworkPackageSpecifier, isLikelyNativeScriptPluginSpecifier, isLikelyNativeScriptRuntimePluginSpecifier, isNativeScriptCoreModule, isNativeScriptPluginModule, normalizeNativeScriptCoreSpecifier, normalizeNodeModulesSpecifier, resolveCandidateFilePath, resolveInternalRuntimePluginBareSpecifier, resolveNodeModulesPackageBoundary, resolveVendorFromCandidate, resolveVendorRouting, rewriteFsAbsoluteToNsM, shouldPreserveBareRuntimePluginSubpathImport, stripDecoratedServePrefixes, tryReadRawExplicitJavaScriptModule, viteDepsPathToBareSpecifier, } from './websocket-module-specifiers.js';
+import { ensureNativeScriptModuleBindings, getProcessCodeResolvedSpecifierOverrides } from './websocket-module-bindings.js';
+import { collectStaticExportNamesFromFile, collectStaticExportOriginsFromFile, ensureVersionedCoreImports, extractDirectExportedNames, normalizeCoreExportOriginsForRuntime, parseCoreBridgeRequest, resolveRuntimeCoreModulePath } from './websocket-core-bridge.js';
+import { createSharedTransformRequestRunner } from './shared-transform-request.js';
+import { formatNsMHmrServeTag, getNumericServeVersionTag, rewriteNsMImportPathForHmr } from './websocket-ns-m-paths.js';
+import { ensureDynamicHmrImportHelper } from './websocket-served-module-helpers.js';
+export { ensureNativeScriptModuleBindings, getProcessCodeResolvedSpecifierOverrides } from './websocket-module-bindings.js';
+export { stripDecoratedServePrefixes, tryReadRawExplicitJavaScriptModule } from './websocket-module-specifiers.js';
+export { collectStaticExportNamesFromFile, collectStaticExportOriginsFromFile, ensureVersionedCoreImports, normalizeCoreExportOriginsForRuntime, parseCoreBridgeRequest } from './websocket-core-bridge.js';
+export { rewriteAngularEntryRegisterOnly } from './websocket-angular-entry.js';
+// Re-export the canonical URL rewriter from `websocket-ns-m-paths.js` so the
+// existing test suites (which import from `./websocket.js`) keep working
+// without churn while the implementation lives in a focused module.
+export { formatNsMHmrServeTag, rewriteNsMImportPathForHmr } from './websocket-ns-m-paths.js';
+export { angularSourceHasSemanticDecorator, canonicalizeTransformRequestCacheKey, collectAngularEvictionUrls, collectAngularHotUpdateRoots, collectAngularTransformCacheInvalidationUrls, collectAngularTransitiveImportersForInvalidation, collectGraphUpdateModulesForHotUpdate, createSharedTransformRequestRunner, normalizeHotReloadMatchPath, shouldInvalidateAngularTransitiveImporters, shouldSuppressDefaultViteHotUpdate, shouldSuppressViteFullReloadPayload, classifyGraphUpsert, shouldBroadcastGraphUpsertDelta, shouldBumpGraphVersion };
+const pluginTransformTypescript = (() => {
+    const requireFromHere = createRequire(import.meta.url);
+    const loaded = requireFromHere('@babel/plugin-transform-typescript');
+    return loaded?.default || loaded;
+})();
+// Build a serialized process.env object from CLI --env.* flags.
+// This is injected into every HTTP-served module so app code referencing
+// process.env.TEST_ENV (etc.) works on device in HMR dev mode.
+const __processEnvEntries = { NODE_ENV: 'development' };
+try {
+    const flags = getCliFlags();
+    for (const [k, v] of Object.entries(flags || {})) {
+        // Skip internal NativeScript build flags
+        if (['ios', 'android', 'visionos', 'platform', 'hmr', 'verbose'].includes(k))
+            continue;
+        __processEnvEntries[k] = String(v);
+    }
+}
+catch { }
+const __processEnvJson = JSON.stringify(__processEnvEntries);
 const { parse, compileTemplate, compileScript } = vueSfcCompiler;
 const APP_ROOT_DIR = getProjectAppPath();
 const APP_VIRTUAL_PREFIX = getProjectAppVirtualPath();
 const APP_VIRTUAL_WITH_SLASH = `${APP_VIRTUAL_PREFIX}/`;
 const DEFAULT_MAIN_ENTRY = getProjectAppRelativePath('app.ts');
 const DEFAULT_MAIN_ENTRY_VIRTUAL = getProjectAppVirtualPath('app.ts');
+// Memoized resolver for the project bootstrap entry as a posix
+// project-relative path (e.g. `/src/main.ts`). This mirrors the
+// resolution the cold-boot wrapper performs (`getPackageJson().main` →
+// project-relative under `/<APP_ROOT_DIR>/`) so the eviction set for
+// HMR always lines up with the URL the runtime actually re-imports.
+// Resolved at first call and cached: `package.json` is read at startup
+// and never changes during a dev session, so it's safe to memoize.
+let __ns_bootstrap_entry_rel_cached = null;
+function getBootstrapEntryRelPath() {
+    if (__ns_bootstrap_entry_rel_cached)
+        return __ns_bootstrap_entry_rel_cached;
+    let entry = DEFAULT_MAIN_ENTRY_VIRTUAL;
+    try {
+        const pkg = getPackageJson();
+        const main = (pkg && pkg.main) || DEFAULT_MAIN_ENTRY;
+        const abs = getProjectFilePath(main).replace(/\\/g, '/');
+        const marker = `/${APP_ROOT_DIR}/`;
+        const idx = abs.indexOf(marker);
+        entry = idx >= 0 ? abs.substring(idx) : DEFAULT_MAIN_ENTRY_VIRTUAL;
+    }
+    catch { }
+    if (!entry.startsWith('/')) {
+        entry = '/' + entry;
+    }
+    __ns_bootstrap_entry_rel_cached = entry;
+    return entry;
+}
 const STRATEGY_REGISTRY = new Map([
     ['vue', vueServerStrategy],
     ['angular', angularServerStrategy],
@@ -43,255 +115,177 @@ const STRATEGY_REGISTRY = new Map([
     ['typescript', typescriptServerStrategy],
 ]);
 function resolveFrameworkStrategy(flavor) {
-    return STRATEGY_REGISTRY.get(flavor);
+    const strategy = STRATEGY_REGISTRY.get(flavor);
+    if (!strategy) {
+        throw new Error(`[ns-hmr] Unsupported framework strategy: ${flavor}`);
+    }
+    return strategy;
 }
 let ACTIVE_STRATEGY;
+function isSocketClientOpen(client) {
+    if (!client) {
+        return false;
+    }
+    const openState = typeof client.OPEN === 'number' ? client.OPEN : 1;
+    return client.readyState === openState;
+}
+function getHmrSocketRoleFromRequestUrl(requestUrl) {
+    try {
+        const url = new URL(requestUrl || '/ns-hmr', 'http://localhost');
+        return url.searchParams.get('ns_hmr_role') || 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+function getHmrSocketRole(client) {
+    if (!client) {
+        return 'unknown';
+    }
+    return typeof client.__nsHmrClientRole === 'string' && client.__nsHmrClientRole ? client.__nsHmrClientRole : 'unknown';
+}
+function shouldAllowLocalCoreSanitizerPaths(contextLabel) {
+    return /\bnode_modules\/@nativescript\/vite\/hmr\/(?:client|frameworks)\//.test(contextLabel);
+}
+export function prepareAngularEntryForDevice(code, importerPath, sfcFileMap, depFileMap, projectRoot, verbose = false, outputDirOverrideRel, httpOrigin, resolveVendorAsHttp = false) {
+    const rewrittenCode = rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot, verbose, outputDirOverrideRel, httpOrigin, resolveVendorAsHttp);
+    return rewriteAngularEntryRegisterOnly(rewrittenCode, resolveAngularCoreHmrImportSource(rewrittenCode, httpOrigin));
+}
 const processSfcCode = createProcessSfcCode(processCodeForDevice);
 // Bare specifiers and special skip patterns (virtual, data:, etc.)
 const VENDOR_PACKAGES = /^[A-Za-z@][^:\/\s]*$/;
 const SKIP_PATTERNS = /^(?:data:|blob:|node:|virtual:|vite:|\0|\/@@?id|\/__vite|__vite|__x00__)/;
-// Minimal helpers to support vendor pre-bundle detection
-function extractVitePrebundleId(spec) {
-    const m = spec.match(/\.vite\/deps\/([^?]+?)\.[mc]?js/);
-    if (m)
-        return m[1];
-    const m2 = spec.match(/__x00__([^?]+?)\.[mc]?js/);
-    if (m2)
-        return m2[1];
-    return null;
-}
-function getFlattenedManifestMap(manifest) {
-    const map = new Map();
-    const mods = Object.keys(manifest.modules || {});
-    for (const canonical of mods) {
-        const flat = canonical.replace(/\./g, '__').replace(/\//g, '_');
-        map.set(flat, canonical);
-        const alias = manifest.aliases?.[canonical];
-        if (alias) {
-            const aliasFlat = String(alias).replace(/\./g, '__').replace(/\//g, '_');
-            map.set(aliasFlat, canonical);
+const MODULE_IMPORT_ANALYSIS_PLUGINS = ['typescript', 'jsx', 'importMeta', 'topLevelAwait', 'classProperties', 'classPrivateProperties', 'classPrivateMethods', 'decorators-legacy'];
+function collectTopLevelImportRecords(code) {
+    if (!code || typeof code !== 'string' || !/\bimport\b/.test(code)) {
+        return [];
+    }
+    try {
+        const ast = babelParse(code, {
+            sourceType: 'module',
+            plugins: MODULE_IMPORT_ANALYSIS_PLUGINS,
+        });
+        const body = ast?.program?.body;
+        if (!Array.isArray(body)) {
+            return [];
         }
+        return body
+            .filter((node) => t.isImportDeclaration(node) && typeof node.start === 'number' && typeof node.end === 'number' && typeof node.source?.value === 'string')
+            .map((node) => ({
+            start: node.start,
+            end: node.end,
+            text: code.slice(node.start, node.end),
+            source: node.source.value,
+            hasOnlyNamedSpecifiers: Array.isArray(node.specifiers) && node.specifiers.length > 0 && node.specifiers.every((spec) => t.isImportSpecifier(spec)),
+            namedBindings: Array.isArray(node.specifiers)
+                ? node.specifiers
+                    .filter((spec) => t.isImportSpecifier(spec) && typeof spec.start === 'number' && typeof spec.end === 'number')
+                    .map((spec) => ({
+                    importedName: t.isIdentifier(spec.imported) ? spec.imported.name : String(spec.imported?.value || ''),
+                    text: code.slice(spec.start, spec.end),
+                }))
+                : [],
+        }));
+    }
+    catch {
+        return [];
     }
-    return map;
-}
-// NativeScript module detectors
-function isCoreGlobalsReference(spec) {
-    return /@nativescript(?:[\/_-])core(?:[\/_-])globals/.test(spec || '');
-}
-function isNativeScriptCoreModule(spec) {
-    return /^(?:@nativescript[\/_-]core|@nativescript\/core)(?:\b|\/)/i.test(spec || '');
 }
-function isNativeScriptPluginModule(spec) {
-    return /^@nativescript\//i.test(spec || '') && !isNativeScriptCoreModule(spec || '');
+function hoistTopLevelStaticImports(code) {
+    const imports = collectTopLevelImportRecords(code);
+    if (!imports.length) {
+        return code;
+    }
+    let stripped = code;
+    for (const imp of [...imports].sort((left, right) => right.start - left.start)) {
+        stripped = stripped.slice(0, imp.start) + stripped.slice(imp.end);
+    }
+    const hoisted = [];
+    const seen = new Set();
+    for (const imp of imports) {
+        const text = imp.text.trim();
+        if (!text || seen.has(text)) {
+            continue;
+        }
+        seen.add(text);
+        hoisted.push(text);
+    }
+    if (!hoisted.length) {
+        return stripped;
+    }
+    return `${hoisted.join('\n')}\n${stripped.replace(/^\s*\n+/, '')}`;
 }
-// Looser detector for NativeScript plugin-style specifiers that should be resolved
-// via device require() rather than HTTP during HMR. This includes popular community
-// scopes in addition to @nativescript/* (excluding core).
-function isLikelyNativeScriptPluginSpecifier(spec) {
-    if (!spec)
-        return false;
-    const s = spec.replace(PAT.QUERY_PATTERN, '');
-    // Absolute or relative paths are not bare packages
-    if (/^(?:\.|\/|https?:\/\/)/i.test(s))
-        return false;
-    // App alias paths like '@/...' are not vendor packages
-    if (s.startsWith('@@/'))
-        return false; // extremely rare double '@' alias
-    if (s.startsWith('~/'))
-        return false; // NativeScript tilde alias (app root)
-    if (s.startsWith('@/'))
-        return false; // Common Vite alias for src
-    // .vue SFCs are not vendor packages
-    if (/\.vue(?:\?|$)/i.test(s))
-        return false;
-    // Exclude core and vue runtime which are handled by dedicated bridges
-    if (/^@nativescript\/core(\b|\/)/i.test(s))
-        return false;
-    if (/^(?:vue|nativescript-vue)(?:\b|\/)/i.test(s))
-        return false;
-    // Treat any other bare package id as device-resolved (require) during HMR
-    return true;
+export function buildBootProgressSnippet(bootModuleLabel) {
+    const normalizedLabel = JSON.stringify(String(bootModuleLabel || '').replace(/\\/g, '/'));
+    return [
+        `const __nsBootGlobal=globalThis;`,
+        `try{if(!__nsBootGlobal.__NS_HMR_BOOT_COMPLETE__){const __nsBootApi=__nsBootGlobal.__NS_HMR_DEV_OVERLAY__;if(__nsBootApi&&typeof __nsBootApi.setBootStage==='function'){const __nsBootCount=(__nsBootGlobal.__NS_HMR_BOOT_MODULE_COUNT__=Number(__nsBootGlobal.__NS_HMR_BOOT_MODULE_COUNT__||0)+1);__nsBootGlobal.__NS_HMR_BOOT_LAST_MODULE__=${normalizedLabel};const __nsBootNow=Date.now();const __nsBootLast=Number(__nsBootGlobal.__NS_HMR_BOOT_LAST_PROGRESS_AT__||0);if(__nsBootCount<=8||__nsBootCount%6===0||__nsBootNow-__nsBootLast>90){__nsBootGlobal.__NS_HMR_BOOT_LAST_PROGRESS_AT__=__nsBootNow;const __nsBootProgress=Math.min(94,82+Math.min(10,Math.round((Math.log(__nsBootCount+1)/Math.LN2)*2)));__nsBootApi.setBootStage('importing-main',{detail:'Evaluated '+__nsBootCount+' modules\\n'+__nsBootGlobal.__NS_HMR_BOOT_LAST_MODULE__,attempt:Number(__nsBootGlobal.__NS_HMR_BOOT_MAIN_ATTEMPT__||1),attempts:Number(__nsBootGlobal.__NS_HMR_BOOT_MAIN_ATTEMPTS__||6),progress:__nsBootProgress});}}}}catch(__nsBootErr){}`,
+        `if(!__nsBootGlobal.__NS_HMR_BOOT_COMPLETE__){const __nsBootCount=Number(__nsBootGlobal.__NS_HMR_BOOT_MODULE_COUNT__||0);if(__nsBootCount<=24||__nsBootCount%8===0){await new Promise((resolve)=>setTimeout(resolve,0));}}`,
+        '',
+    ].join('\n');
 }
-export function ensureNativeScriptModuleBindings(code) {
-    // Proceed even if a vendor manifest isn't available; we'll still vendor-bind
-    // likely NativeScript plugin-style specifiers (e.g., 'pinia', '@scope/pkg')
-    // via require() so device can resolve them from the app bundle.
-    const importRegex = /(^|\n)\s*import\s+([\s\S]*?)\s+from\s+["']([^"']+)["'];?/gm;
-    const sideEffectRegex = /(^|\n)\s*import\s+["']([^"']+)["'];?/gm;
-    // Collect non-vendor imports so we can hoist them above the injected vendor prelude.
-    // This ensures any residual ESM imports (like SFCs) remain at the true top-level for parsers
-    // that require imports to precede other statements.
-    const preservedImports = [];
-    const modules = new Map();
-    const getModuleBinding = (canonical) => {
-        let entry = modules.get(canonical);
-        if (!entry) {
-            entry = {
-                default: new Set(),
-                namespace: new Set(),
-                named: [],
-                sideEffectOnly: false,
-            };
-            modules.set(canonical, entry);
+function rewriteVitePrebundleImportsForDevice(code, preserveVendorImports) {
+    const imports = collectTopLevelImportRecords(code);
+    if (!imports.length) {
+        return code;
+    }
+    const edits = [];
+    for (const imp of imports) {
+        const source = imp.source;
+        const depMatch = source.match(/(?:^|\/)node_modules\/\.vite\/deps\/(.+)$/);
+        const depPath = depMatch?.[1] || (source.startsWith('.vite/deps/') ? source.slice('.vite/deps/'.length) : null);
+        if (!depPath) {
+            continue;
         }
-        return entry;
-    };
-    const parseNamedImports = (clause, binding) => {
-        const inner = clause.replace(/^\{/, '').replace(/\}$/, '');
-        inner
-            .split(',')
-            .map((segment) => segment.trim())
-            .filter(Boolean)
-            .forEach((segment) => {
-            const [imported, local] = segment.split(/\s+as\s+/i).map((s) => s.trim());
-            const resolvedImported = imported;
-            const resolvedLocal = local || imported;
-            if (resolvedImported) {
-                binding.named.push({
-                    imported: resolvedImported,
-                    local: resolvedLocal,
-                });
+        let replacement = '';
+        if (preserveVendorImports) {
+            const canonical = resolveVendorFromCandidate(`.vite/deps/${depPath}`);
+            const bareSpecifier = canonical || viteDepsPathToBareSpecifier(depPath);
+            if (bareSpecifier) {
+                replacement = imp.text.replace(source, bareSpecifier);
             }
-        });
-    };
-    // Handle "import ... from 'x'" forms
-    code = code.replace(importRegex, (full, pfx, clause, rawSpec) => {
-        // Capture original for potential preservation (strip the leading newline to avoid double spacing when hoisted)
-        const original = full.replace(/^\n/, '');
-        // Do not touch type-only imports other than hoisting
-        if (full.trimStart().startsWith('import type')) {
-            preservedImports.push(original);
-            return pfx || '';
-        }
-        const specifier = rawSpec.replace(PAT.QUERY_PATTERN, '');
-        let canonical = resolveVendorFromCandidate(specifier);
-        // If not found in vendor manifest, treat well-known NativeScript plugin-style packages
-        // as require() based modules so the device can resolve them from the app bundle or vendor.
-        if (!canonical && isLikelyNativeScriptPluginSpecifier(specifier)) {
-            canonical = specifier;
-        }
-        // CRITICAL: never vendor-inject @nativescript/core here — preserve for the later core-bridge pass.
-        if (canonical && /^@nativescript\/core(\b|\/)/i.test(canonical)) {
-            preservedImports.push(original);
-            return pfx || '';
-        }
-        if (!canonical) {
-            preservedImports.push(original);
-            return pfx || '';
-        }
-        const binding = getModuleBinding(canonical);
-        const trimmed = String(clause).trim();
-        if (!trimmed) {
-            binding.sideEffectOnly = true;
-            return pfx || ''; // erase the import line
-        }
-        // namespace: import * as ns from 'x'
-        if (trimmed.startsWith('*')) {
-            const m = trimmed.match(/\*\s+as\s+(\w+)/i);
-            if (m?.[1])
-                binding.namespace.add(m[1]);
-            return pfx || '';
-        }
-        // named: import { a, b as c } from 'x'
-        if (trimmed.startsWith('{')) {
-            parseNamedImports(trimmed, binding);
-            return pfx || '';
-        }
-        // default + named: import Default, { a as A } from 'x'
-        if (trimmed.includes(',') && trimmed.includes('{')) {
-            const [defaultPart, namedPart] = trimmed.split(/,(.+)/, 2);
-            const def = defaultPart.trim();
-            if (def)
-                binding.default.add(def);
-            if (namedPart)
-                parseNamedImports(namedPart.trim(), binding);
-            return pfx || '';
-        }
-        // default only
-        binding.default.add(trimmed);
-        return pfx || '';
-    });
-    // Handle side-effect only imports: import 'x'
-    code = code.replace(sideEffectRegex, (full, _pfx, rawSpec) => {
-        const original = full.replace(/^\n/, '');
-        const specifier = rawSpec.replace(PAT.QUERY_PATTERN, '');
-        let canonical = resolveVendorFromCandidate(specifier);
-        if (!canonical && isLikelyNativeScriptPluginSpecifier(specifier)) {
-            canonical = specifier;
-        }
-        if (canonical && /^@nativescript\/core(\b|\/)/i.test(canonical)) {
-            preservedImports.push(original);
-            return _pfx || '';
-        }
-        if (!canonical) {
-            preservedImports.push(original);
-            return _pfx || '';
-        }
-        const binding = getModuleBinding(canonical);
-        binding.sideEffectOnly = true;
-        return _pfx || '';
-    });
-    // If there are no vendor modules to bind, still hoist preserved imports if any were collected.
-    if (!modules.size) {
-        if (preservedImports.length) {
-            const preserved = preservedImports.join('') + '\n';
-            return preserved + code;
         }
+        edits.push({
+            start: imp.start,
+            end: imp.end,
+            text: replacement,
+        });
+    }
+    if (!edits.length) {
         return code;
     }
-    let injection = 'const __nsVendorRegistry = (globalThis.__nsVendorRegistry ||= new Map());\n';
-    // Soft vendor fallback mode: when a plugin module is not available during HMR, provide a stub so the module can instantiate.
-    // Toggle with globalThis.__NS_VENDOR_SOFT__ (default true)
-    // Use JS-safe global access (no TS casts) to avoid syntax errors on device
-    injection += "const __NS_VENDOR_SOFT__ = (typeof globalThis.__NS_VENDOR_SOFT__ !== 'undefined' ? !!globalThis.__NS_VENDOR_SOFT__ : true);\n";
-    // Provide a require fallback that throws lazily so callers can soft-stub in the catch block.
-    injection += "const __nsVendorRequire = (typeof globalThis.__nsRequire === 'function' ? globalThis.__nsRequire : (typeof globalThis.require === 'function' ? globalThis.require : (spec => { throw new Error('__nsVendorRequire unavailable'); })));\n";
-    // One-time diagnostic if require is missing; avoid spewing on every module
-    injection += "try { (globalThis.__NS_VENDOR_ONCE__ ||= { loggedRequireMissing: false }); if (!globalThis.__NS_VENDOR_ONCE__.loggedRequireMissing && typeof __nsVendorRequire !== 'function') { console.warn('[ns-hmr][vendor][require-missing] using soft stubs=', __NS_VENDOR_SOFT__); globalThis.__NS_VENDOR_ONCE__.loggedRequireMissing = true; } } catch {}\n";
-    injection += "function __nsMissing(name){ try { const fn = function(){ try { console.warn('[ns-hmr][vendor][stub]', name); } catch {} }; return new Proxy(fn, { get: (_t, p) => __nsMissing(name + '.' + String(p)) }); } catch { return {}; } }\n";
-    // Helper utils to simplify robust property/default selection without using optional chaining/nullish
-    injection += "function __nsHasInstall(x){ try { return (typeof x === 'function') || (typeof x === 'object' && x && typeof x.install === 'function'); } catch { return false; } }\n";
-    injection += "function __nsDefault(mod){ try { return (mod && mod['default'] !== undefined) ? mod['default'] : mod; } catch { return mod; } }\n";
-    injection += "function __nsNestedDefault(mod){ try { return (mod && mod.default && (typeof mod.default.default === 'function' || (typeof mod.default.default === 'object' && mod.default.default && typeof mod.default.default.install === 'function'))) ? mod.default.default : undefined; } catch { return undefined; } }\n";
-    injection += "function __nsPick(mod, name){ try { if (mod && mod['default'] && mod['default'][name] !== undefined) return mod['default'][name]; } catch {} try { if (mod && mod[name] !== undefined) return mod[name]; } catch {} try { if (mod && typeof mod['default'] === 'function' && mod['default'].name === name) return mod['default']; } catch {} return undefined; }\n";
-    let index = 0;
-    for (const [canonical, binding] of modules) {
-        const cacheKey = JSON.stringify(canonical);
-        const moduleVar = `__nsVendorModule_${index++}`;
-        injection += `const ${moduleVar} = __nsVendorRegistry.has(${cacheKey}) ? __nsVendorRegistry.get(${cacheKey}) : (() => { try { const mod = __nsVendorRequire(${cacheKey}); __nsVendorRegistry.set(${cacheKey}, mod); return mod; } catch (e) { try { console.error('[ns-hmr][vendor][require-failed]', ${cacheKey}, (e && (e.message||e)) ); } catch {} try { if (__NS_VENDOR_SOFT__) { const stub = __nsMissing(${cacheKey}); __nsVendorRegistry.set(${cacheKey}, stub); return stub; } } catch {} throw e; } })();\n`;
-        binding.namespace.forEach((alias) => {
-            // For namespace imports, expose both the raw module and a default fallback for interop consumers
-            injection += `const ${alias} = ${moduleVar};\n`;
-            injection += `(${alias} && typeof ${alias} === 'object' && !('default' in ${alias})) && (${alias}.default = ${alias});\n`;
-        });
-        if (binding.named.length) {
-            // Bind each named import robustly from either default or namespace using helper.
-            for (const { imported, local } of binding.named) {
-                const localName = local;
-                const importedName = imported;
-                injection += `const ${localName} = __nsPick(${moduleVar}, ${JSON.stringify(importedName)});\n`;
-            }
-        }
-        if (binding.default.size) {
-            // Create one stable default candidate per module and reuse for all default locals
-            const defVar = `${moduleVar}__def`;
-            injection += `const ${defVar} = __nsDefault(${moduleVar});\n`;
-            binding.default.forEach((localName) => {
-                injection += `const ${localName} = (__nsHasInstall(${defVar})
-          ? ${defVar}
-          : (__nsHasInstall(${moduleVar})
-            ? ${moduleVar}
-            : (function(){ const _n = __nsNestedDefault(${moduleVar}); return _n !== undefined ? _n : ${defVar}; })()));\n`;
-            });
-        }
-        if (binding.sideEffectOnly && !binding.namespace.size && !binding.named.length && !binding.default.size) {
-            injection += `void ${moduleVar};\n`;
+    let next = code;
+    for (const edit of edits.sort((left, right) => right.start - left.start)) {
+        next = next.slice(0, edit.start) + edit.text + next.slice(edit.end);
+    }
+    return next;
+}
+function buildNodeModuleProvenancePrelude(sourceId) {
+    if (!sourceId) {
+        return '';
+    }
+    const cleaned = sourceId.replace(PAT.QUERY_PATTERN, '');
+    let normalized = normalizeNodeModulesSpecifier(cleaned);
+    if (!normalized) {
+        const viteDepsMatch = cleaned.match(/(?:^|\/)node_modules\/\.vite\/deps\/([^?#]+)/);
+        if (viteDepsMatch?.[1]) {
+            normalized = `.vite/deps/${viteDepsMatch[1]}`;
         }
     }
-    injection += '\n';
-    // Hoist preserved non-vendor imports to the very top for maximum ESM compatibility
-    const preserved = preservedImports.length ? preservedImports.join('') + '\n' : '';
-    return preserved + injection + code;
+    if (!normalized) {
+        return '';
+    }
+    let packageSpecifier = normalized;
+    let via = 'node_modules';
+    if (normalized.startsWith('.vite/deps/')) {
+        via = 'vite-deps';
+        packageSpecifier = viteDepsPathToBareSpecifier(normalized.slice('.vite/deps/'.length)) || normalized;
+    }
+    const rootPackage = resolveNodeModulesPackageBoundary(packageSpecifier, getProjectRootPath()).packageName;
+    if (!rootPackage) {
+        return '';
+    }
+    return `try { const __nsRecord = globalThis.__NS_RECORD_MODULE_PROVENANCE__; if (typeof __nsRecord === 'function') { __nsRecord(${JSON.stringify(rootPackage)}, ${JSON.stringify({ kind: 'http-esm', specifier: packageSpecifier, url: sourceId, via })}); } } catch {}\n`;
 }
 // Guard any bare dynamic import(spec) occurring in assembled module code.
 // We cannot override native dynamic import globally; for SFC assembler outputs we inline
@@ -318,113 +312,6 @@ function guardBareDynamicImports(code) {
         return code;
     }
 }
-function normalizeNativeScriptCoreSpecifier(spec) {
-    let normalized = spec.replace(/@nativescript[_-]core/gi, '@nativescript/core').replace(/@nativescript\/core\/index\.js$/i, '@nativescript/core/index.js');
-    if (normalized.startsWith('/node_modules/')) {
-        const idx = normalized.toLowerCase().indexOf('@nativescript/core');
-        if (idx !== -1) {
-            normalized = normalized.slice(idx);
-        }
-    }
-    if (normalized.toLowerCase().startsWith('@nativescript/core')) {
-        normalized = normalized.replace(/\?[^"'`]*$/, '');
-    }
-    return normalized;
-}
-function normalizeNodeModulesSpecifier(spec) {
-    if (!spec) {
-        return null;
-    }
-    let normalized = spec.replace(/\\/g, '/');
-    const idx = normalized.lastIndexOf('/node_modules/');
-    if (idx === -1) {
-        return null;
-    }
-    let subPath = normalized.slice(idx + '/node_modules/'.length);
-    if (!subPath) {
-        return null;
-    }
-    subPath = subPath.replace(PAT.QUERY_PATTERN, '');
-    if (!subPath) {
-        return null;
-    }
-    // Skip Vite pre-bundled deps that we already map to vendor
-    if (subPath.startsWith('.vite/')) {
-        return null;
-    }
-    return subPath.startsWith('/') ? subPath.slice(1) : subPath;
-}
-function resolveVendorFromCandidate(specifier) {
-    if (!specifier) {
-        return null;
-    }
-    const manifest = getVendorManifest();
-    if (!manifest) {
-        return null;
-    }
-    const cleaned = specifier.replace(PAT.QUERY_PATTERN, '');
-    const direct = resolveVendorSpecifier(cleaned);
-    if (direct) {
-        return direct;
-    }
-    const flattenedId = extractVitePrebundleId(cleaned);
-    if (flattenedId) {
-        const flattenedMap = getFlattenedManifestMap(manifest);
-        const flatMatch = flattenedMap.get(flattenedId);
-        if (flatMatch) {
-            return flatMatch;
-        }
-        for (const [flatKey, canonical] of flattenedMap.entries()) {
-            if (flattenedId === flatKey || flattenedId.startsWith(`${flatKey}_`)) {
-                return canonical;
-            }
-        }
-        const guessedId = flattenedId.replace(/__/g, '.').replace(/_/g, '/');
-        if (guessedId && guessedId !== flattenedId) {
-            const guessedCanonical = resolveVendorSpecifier(guessedId);
-            if (guessedCanonical) {
-                return guessedCanonical;
-            }
-            const prefix = findVendorPrefix(guessedId, manifest);
-            if (prefix) {
-                return prefix;
-            }
-        }
-    }
-    const normalizedCore = normalizeNativeScriptCoreSpecifier(cleaned);
-    if (normalizedCore !== cleaned) {
-        const nsCanonical = resolveVendorSpecifier(normalizedCore);
-        if (nsCanonical) {
-            return nsCanonical;
-        }
-    }
-    const nodeModulesSpecifier = normalizeNodeModulesSpecifier(cleaned);
-    if (nodeModulesSpecifier) {
-        const canonical = resolveVendorSpecifier(nodeModulesSpecifier);
-        if (canonical) {
-            return canonical;
-        }
-        const prefix = findVendorPrefix(nodeModulesSpecifier, manifest);
-        if (prefix) {
-            return prefix;
-        }
-    }
-    const prefix = findVendorPrefix(cleaned, manifest);
-    if (prefix) {
-        return prefix;
-    }
-    return null;
-}
-function findVendorPrefix(specifier, manifest) {
-    const { modules } = manifest;
-    const keys = Object.keys(modules || {});
-    for (const key of keys) {
-        if (specifier === key || specifier.startsWith(`${key}/`)) {
-            return key;
-        }
-    }
-    return null;
-}
 function stripCoreGlobalsImports(code) {
     const pattern = /^\s*(?:import\s+(?:[^'"\n]*from\s+)?|export\s+\*\s+from\s+)["'][^"']*(?:@nativescript(?:[/_-])core(?:[\/_-])globals|@nativescript_core_globals)[^"']*["'];?\s*$/gm;
     return code.replace(pattern, '');
@@ -452,18 +339,14 @@ function ensureVariableDynamicImportHelper(code) {
         `};\n`;
     return `${helper}${code}`;
 }
-// Final safety net for plain dynamic import(expressions) that might slip through
-// Vite's helper transformation. We rewrite occurrences of `import(` to `__ns_import(`
-// and inject a small wrapper that maps the anomalous request '@' to a harmless stub.
 function ensureGuardPlainDynamicImports(code, origin) {
     try {
         if (!code || !/\bimport\s*\(/.test(code))
             return code;
-        const w = `const __ns_import = (s) => { try { if (s === '@') { return import(new URL('/ns/m/__invalid_at__.mjs', import.meta.url).href); } } catch {} return import(s); }\n`;
-        // Replace only when `import(` is not part of an identifier or property (no preceding "." or word char)
+        const wrapper = `const __ns_import = (s) => { try { if (s === '@') { return import(new URL('/ns/m/__invalid_at__.mjs', import.meta.url).href); } } catch {} return import(s); }\n`;
         const replaced = code.replace(/(^|[^\.\w$])import\s*\(/g, (_m, p1) => `${p1}__ns_import(`);
         if (replaced !== code) {
-            return w + replaced;
+            return wrapper + replaced;
         }
         return code;
     }
@@ -471,13 +354,63 @@ function ensureGuardPlainDynamicImports(code, origin) {
         return code;
     }
 }
-// Heal accidental "import ... = expr" assignments produced by upstream transforms.
-// These are invalid JS; convert to equivalent const assignments.
+// `ensureDynamicHmrImportHelper` lives in
+// `./websocket-served-module-helpers.js`. See that file for the
+// architectural rationale and the current helper implementation.
+async function expandStarExports(code, server, projectRoot, verbose, sharedTransformer) {
+    const STAR_RE = /^[ \t]*(export\s+\*\s+from\s+["'])([^"']+)(["'];?)[ \t]*$/gm;
+    let match;
+    const replacements = [];
+    while ((match = STAR_RE.exec(code)) !== null) {
+        const url = match[2];
+        if (!url.includes('/node_modules/'))
+            continue;
+        replacements.push({ full: match[0], url, prefix: match[1], suffix: match[3] });
+    }
+    if (!replacements.length)
+        return code;
+    // Pull target URLs through the shared runner when it's available so each
+    // node_modules path shares the 60s TTL cache with the main /ns/m pipeline
+    // and respects the global concurrency gate. Fan them out in parallel —
+    // this block used to be a serial `for await` loop, which dominated cold
+    // boot on apps with dozens of star-re-exports.
+    const transformer = sharedTransformer ?? ((url) => server.transformRequest(url));
+    const resolved = await Promise.all(replacements.map(async (rep) => {
+        try {
+            let vitePath = rep.url.replace(/^https?:\/\/[^/]+/, '');
+            vitePath = vitePath.replace(/^\/ns\/m\//, '/');
+            vitePath = vitePath.replace(/^\/__ns_boot__\/[^/]+/, '');
+            vitePath = vitePath.replace(/\/__ns_hmr__\/[^/]+/, '');
+            const result = await transformer(vitePath);
+            if (!result?.code)
+                return null;
+            const names = extractExportedNames(result.code);
+            if (!names.length)
+                return null;
+            if (verbose) {
+                console.log(`[ns/m] expanded export* -> ${names.length} names from ${vitePath}`);
+            }
+            return { rep, names };
+        }
+        catch {
+            return null;
+        }
+    }));
+    for (const entry of resolved) {
+        if (!entry)
+            continue;
+        const explicit = `export { ${entry.names.join(', ')} } from ${JSON.stringify(entry.rep.url)};`;
+        code = code.replace(entry.rep.full, explicit);
+    }
+    return code;
+}
+function extractExportedNames(code) {
+    return extractDirectExportedNames(code);
+}
 function repairImportEqualsAssignments(code) {
     try {
         if (!code || typeof code !== 'string')
             return code;
-        // import { a, b as c } = expr; -> const { a, b: c } = expr;
         code = code.replace(/(^|\n)\s*import\s*\{([^}]+)\}\s*=\s*([^;]+);?/g, (_m, p1, specList, rhs) => {
             const cleaned = String(specList)
                 .split(',')
@@ -487,56 +420,28 @@ function repairImportEqualsAssignments(code) {
                 .join(', ');
             return `${p1}const { ${cleaned} } = ${rhs};`;
         });
-        // import * as ns = expr; -> const ns = (expr);
-        code = code.replace(/(^|\n)\s*import\s*\*\s*as\s*([A-Za-z_$][\w$]*)\s*=\s*([^;]+);?/g, (_m, p1, ns, rhs) => {
-            return `${p1}const ${ns} = (${rhs});`;
-        });
-        // import name = expr; -> const name = expr;
-        code = code.replace(/(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*=\s*([^;]+);?/g, (_m, p1, id, rhs) => {
-            return `${p1}const ${id} = ${rhs};`;
-        });
+        code = code.replace(/(^|\n)\s*import\s*\*\s*as\s*([A-Za-z_$][\w$]*)\s*=\s*([^;]+);?/g, (_m, p1, ns, rhs) => `${p1}const ${ns} = (${rhs});`);
+        code = code.replace(/(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*=\s*([^;]+);?/g, (_m, p1, id, rhs) => `${p1}const ${id} = ${rhs};`);
     }
     catch { }
     return code;
 }
-// Ensure imports of the NativeScript-Vue runtime bridge '/ns/rt' are versioned to
-// bust the device HTTP loader cache whenever the HMR graph version increments.
 function ensureVersionedRtImports(code, origin, ver) {
     if (!code || !origin || !Number.isFinite(ver))
         return code;
-    // Static imports: import { ... } from ".../ns/rt" (plus optional version)
     code = code.replace(/(from\s+["'])(?:https?:\/\/[^"']+)?\/(?:\ns|ns)\/rt(?:\/[\d]+)?(["'])/g, (_m, p1, p3) => `${p1}/ns/rt/${ver}${p3}`);
-    // Dynamic imports: import(".../ns/rt") (plus optional version)
     code = code.replace(/(import\(\s*["'])(?:https?:\/\/[^"']+)?\/(?:\@ns|ns)\/rt(?:\/[\d]+)?(["']\s*\))/g, (_m, p1, p3) => `${p1}/ns/rt/${ver}${p3}`);
     return code;
 }
-// Ensure imports of @nativescript/core resolve via the unified /ns/core bridge to keep a single realm
-function ensureVersionedCoreImports(code, origin, ver) {
-    try {
-        // Static imports already handled in rewriteImports; just ensure absolute origin prefix and version
-        code = code.replace(/(["'])\/ns\/core(\?p=[^"']+)?\1/g, (_m, q, qp) => `${q}/ns/core/${ver}${qp || ''}${q}`);
-        // Dynamic imports already handled in rewriteImports; ensure origin and version
-        code = code.replace(/import\(\s*(["'])\/ns\/core(\?p=[^"']+)?\1\s*\)/g, (_m, q, qp) => `import(${q}/ns/core/${ver}${qp || ''}${q})`);
-    }
-    catch { }
-    return code;
-}
-// Hardened removal of Vite's virtual dynamic-import-helper. Some variants (side-effect only
-// or minified forms) slipped past earlier regexes causing runtime attempts to resolve
-// /@id/__x00__vite/dynamic-import-helper.js which does not exist in the device mirror.
-// We aggressively strip any reference and inline a helper if necessary.
 function stripViteDynamicImportVirtual(code) {
     if (!/\/@id\/__x00__vite\/dynamic-import-helper/.test(code)) {
         return code;
     }
     const original = code;
-    // Remove any import lines referencing the virtual helper (with or without bindings)
     code = code.replace(/^[\t ]*import[^\n]*\/@id\/__x00__vite\/dynamic-import-helper[^\n]*$/gm, '');
-    // If any raw spec strings remain (e.g. concatenated), neutralize them
     if (/\/@id\/__x00__vite\/dynamic-import-helper/.test(code)) {
         code = code.replace(/\/@id\/__x00__vite\/dynamic-import-helper[^"'`)]*/g, '/__NS_UNUSED_DYNAMIC_IMPORT_HELPER__');
     }
-    // Ensure helper present
     if (!/__variableDynamicImportRuntimeHelper/.test(code)) {
         const inline = `const __variableDynamicImportRuntimeHelper = (map, request, importMode) => {\n  try { if (request === '@') { return import('/ns/m/__invalid_at__.mjs'); } } catch {}\n  const loader = map && (map[request] || map[request?.replace(/\\\\/g, '/')]);\n  if (!loader) { const e = new Error('Cannot dynamically import: ' + request); /*@ts-ignore*/ e.code = 'ERR_MODULE_NOT_FOUND'; return Promise.reject(e); }\n  try { return loader(importMode); } catch (e) { return Promise.reject(e); }\n};\n`;
         code = inline + code;
@@ -546,17 +451,7 @@ function stripViteDynamicImportVirtual(code) {
     }
     return code;
 }
-// Small snippet injected into device-delivered modules to capture any require('http(s)://') calls
-const REQUIRE_GUARD_SNIPPET = `// [guard] install require('http(s)://') detector\n(()=>{try{var g=globalThis;if(g.__NS_REQUIRE_GUARD_INSTALLED__){}else{var mk=function(o,l){return function(){try{var s=arguments[0];if(typeof s==='string'&&/^(?:https?:)\\/\\//.test(s)){var e=new Error('[ns-hmr][require-guard] require of URL: '+s+' via '+l);try{console.error(e.message+'\\n'+(e.stack||''));}catch(e2){}try{g.__NS_REQUIRE_GUARD_LAST__={spec:s,stack:e.stack,label:l,ts:Date.now()};}catch(e3){}}}catch(e1){}return o.apply(this, arguments);};};if(typeof g.require==='function'&&!g.require.__NS_REQ_GUARDED__){var o1=g.require;g.require=mk(o1,'require');g.require.__NS_REQ_GUARDED__=true;}if(typeof g.__nsRequire==='function'&&!g.__nsRequire.__NS_REQ_GUARDED__){var o2=g.__nsRequire;g.__nsRequire=mk(o2,'__nsRequire');g.__nsRequire.__NS_REQ_GUARDED__=true;}g.__NS_REQUIRE_GUARD_INSTALLED__=true;}}catch(e){}})();\n`;
-// ============================================================================
-// HELPER FUNCTIONS
-// ============================================================================
-// Origin invariant: we own both client and server. All URLs must use an explicit
-// http(s)://host:port origin with no trailing slash. Build it deterministically
-// where needed; do not post-sanitize.
-/**
- * Check if an import spec should be remapped to dep-*.mjs
- */
+const REQUIRE_GUARD_SNIPPET = `// [guard] install require('http(s)://') detector\n(()=>{try{var g=globalThis;if(g.__NS_REQUIRE_GUARD_INSTALLED__){}else{var mk=function(o,l){return function(){try{var s=arguments[0];if(typeof s==='string'&&/^(?:https?:)\\/\\//.test(s)){var e=new Error('[ns-hmr][require-guard] require of URL: '+s+' via '+l);console.error(e.message+'\\n'+(e.stack||''));try{g.__NS_REQUIRE_GUARD_LAST__={spec:s,stack:e.stack,label:l,ts:Date.now()};}catch(e3){}}}catch(e1){}return o.apply(this, arguments);};};if(typeof g.require==='function'&&!g.require.__NS_REQ_GUARDED__){var o1=g.require;g.require=mk(o1,'require');g.require.__NS_REQ_GUARDED__=true;}if(typeof g.__nsRequire==='function'&&!g.__nsRequire.__NS_REQ_GUARDED__){var o2=g.__nsRequire;g.__nsRequire=mk(o2,'__nsRequire');g.__nsRequire.__NS_REQ_GUARDED__=true;}g.__NS_REQUIRE_GUARD_INSTALLED__=true;}}catch(e){}})();\n`;
 function shouldRemapImport(spec) {
     if (!spec || typeof spec !== 'string')
         return false;
@@ -577,12 +472,9 @@ function shouldRemapImport(spec) {
     }
     return true;
 }
-// (legacy wrapSfcWithStableDefault removed; full SFCs now delegate to /ns/asm)
 function removeNamedImports(code, names) {
     const regex = /^(\s*import\s*\{)([^}]*)(\}\s*from\s*['"][^'"]+['"];?)/gm;
     return code.replace(regex, (_m, p1, specList, p3) => {
-        // Only strip for known globalized framework sources (Vue/Nativescript-Vue).
-        // Keep imports from all other packages (Pinia, third-party libs, app modules) intact.
         const srcMatch = /from\s*['"]\s*([^'"\s]+)\s*['"]/i.exec(_m);
         const src = (srcMatch?.[1] || '').toLowerCase();
         const isVueSource = /^(?:vue|nativescript-vue)(?:\b|\/)/i.test(src);
@@ -681,7 +573,7 @@ function normalizeImportPath(spec, importerDir) {
     else if (spec.startsWith('./') || spec.startsWith('../')) {
         key = path.posix.normalize(path.posix.join(importerDir, spec));
         if (!key.startsWith('/')) {
-            key = '/' + key;
+            key = `/${key}`;
         }
     }
     else {
@@ -748,6 +640,70 @@ function findDependencyFileName(depFileMap, key) {
     }
     return undefined;
 }
+function isRuntimePluginRootEntrySpecifier(specifier, projectRoot) {
+    if (!specifier) {
+        return false;
+    }
+    const cleaned = specifier.replace(PAT.QUERY_PATTERN, '');
+    const normalized = normalizeNodeModulesSpecifier(cleaned) || cleaned.replace(/^\/+/, '');
+    if (!normalized) {
+        return false;
+    }
+    const { packageName, subpath } = resolveNodeModulesPackageBoundary(normalized, projectRoot);
+    if (!packageName || !isLikelyNativeScriptRuntimePluginSpecifier(packageName, projectRoot)) {
+        return false;
+    }
+    if (!subpath) {
+        return true;
+    }
+    if (subpath.includes('/')) {
+        return false;
+    }
+    const pkgBaseName = packageName.split('/').pop() || '';
+    const withoutExt = /(?:\.(?:ios|android|visionos))?\.(?:ts|tsx|js|jsx|mjs|mts|cts)$/i.test(subpath) ? subpath.replace(/\.[^.]+$/, '') : subpath;
+    const withoutPlatform = withoutExt.replace(/\.(ios|android|visionos)$/i, '');
+    return withoutPlatform === 'index' || withoutPlatform === pkgBaseName;
+}
+function collectMixedRuntimePluginHttpRootPackages(code, projectRoot) {
+    const nonRootSubpathPackages = new Set();
+    const rootEntryPackages = new Set();
+    const visitSpecifier = (rawSpecifier) => {
+        if (!rawSpecifier) {
+            return;
+        }
+        const specifier = normalizeNativeScriptCoreSpecifier(rawSpecifier).replace(PAT.QUERY_PATTERN, '');
+        if (!specifier) {
+            return;
+        }
+        if (/^https?:\/\//.test(specifier) || specifier.startsWith('/ns/')) {
+            return;
+        }
+        if (/^(?:\.|\/)/.test(specifier) && !specifier.includes('/node_modules/')) {
+            return;
+        }
+        const normalized = normalizeNodeModulesSpecifier(specifier) || specifier.replace(/^\/+/, '');
+        if (!normalized) {
+            return;
+        }
+        const { packageName } = resolveNodeModulesPackageBoundary(normalized, projectRoot);
+        if (!packageName || !isLikelyNativeScriptRuntimePluginSpecifier(packageName, projectRoot)) {
+            return;
+        }
+        if (isRuntimePluginRootEntrySpecifier(normalized, projectRoot)) {
+            rootEntryPackages.add(packageName);
+            return;
+        }
+        nonRootSubpathPackages.add(packageName);
+    };
+    for (const pattern of [PAT.IMPORT_PATTERN_1, PAT.IMPORT_PATTERN_2, PAT.IMPORT_PATTERN_3, PAT.IMPORT_PATTERN_SIDE_EFFECT]) {
+        pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.exec(code)) !== null) {
+            visitSpecifier(match[2]);
+        }
+    }
+    return new Set(Array.from(nonRootSubpathPackages).filter((packageName) => rootEntryPackages.has(packageName)));
+}
 function collectImportDependencies(code, importerPath) {
     const importerDir = path.posix.dirname(importerPath);
     const deps = new Set();
@@ -809,68 +765,15 @@ function cleanCode(code) {
     result = ACTIVE_STRATEGY.preClean(result);
     result = ACTIVE_STRATEGY.rewriteFrameworkImports(result);
     // Vendor manifest-driven import rewrites
+    // NOTE: Static and side-effect vendor imports are intentionally NOT rewritten here.
+    // They are left as import statements so that ensureNativeScriptModuleBindings()
+    // (called later in processCodeForDevice) can transform them using the robust
+    // __nsVendorRequire + __nsPick pattern that works on device.
+    // Only dynamic imports are handled here since ensureNativeScriptModuleBindings
+    // does not process dynamic import() calls.
     try {
         const manifest = getVendorManifest();
         if (manifest) {
-            // Pattern: capture full import statement (static) with optional bindings
-            // import X from 'pkg'; | import {a,b as c} from "pkg"; | import * as ns from 'pkg';
-            const staticImportRE = /(import\s+([^;]*?)\s+from\s*["'])([^"']+)(["'];?)/g;
-            result = result.replace(staticImportRE, (full, pre, bindings, spec, post) => {
-                // Do not vendor-rewrite @nativescript/core — handled by the unified HTTP bridge later
-                if (isNativeScriptCoreModule(spec))
-                    return full;
-                const resolved = resolveVendorSpecifier(spec);
-                if (!resolved || /^@nativescript\/core(\b|\/)/i.test(resolved))
-                    return full; // not vendor or is core
-                // Determine binding style
-                const trimmed = (bindings || '').trim();
-                let injected = '';
-                if (!trimmed || trimmed === '') {
-                    // Side-effect import: import 'pkg'; -> we drop it (vendor already evaluated)
-                    return `/* vendor side-effect dropped: ${spec} */`;
-                }
-                // Default + named or default only
-                // Examples of trimmed:
-                //   defaultExport
-                //   { a, b as c }
-                //   * as ns
-                //   defaultExport, { a, b }
-                const globalAccessor = `globalThis.__nsVendor && globalThis.__nsVendor(${JSON.stringify(resolved)})`;
-                const ensureHelper = `globalThis.__nsVendor=require? (globalThis.__nsVendor|| (globalThis.__nsVendor=(id)=>{const m=(globalThis.__NS_VENDOR_MANIFEST__?globalThis.__NS_VENDOR_MANIFEST__.modules[id]:null);return (globalThis.__nsModules && globalThis.__nsModules.get? (globalThis.__nsModules.get(id)||globalThis.__nsModules.get(m?.id||id)):undefined);})):globalThis.__nsVendor`;
-                if (trimmed.startsWith('{')) {
-                    // Named only
-                    injected = `${ensureHelper}; const ${trimmed} = ${globalAccessor} || {};`;
-                }
-                else if (trimmed.startsWith('*')) {
-                    // Namespace import: * as ns
-                    const m = /\*\s+as\s+(\w+)/.exec(trimmed);
-                    if (m) {
-                        injected = `${ensureHelper}; const ${m[1]} = ${globalAccessor} || {};`;
-                    }
-                }
-                else if (trimmed.includes(',')) {
-                    // default plus named
-                    const parts = trimmed.split(',');
-                    const def = parts[0].trim();
-                    const named = parts.slice(1).join(',').trim();
-                    injected = `${ensureHelper}; const __vmod = ${globalAccessor} || {}; const ${def} = __vmod.default || __vmod; const ${named} = __vmod;`;
-                }
-                else {
-                    // default only
-                    injected = `${ensureHelper}; const ${trimmed} = (${globalAccessor}||{}).default || ${globalAccessor};`;
-                }
-                return injected;
-            });
-            // Bare side-effect imports: import 'pkg';
-            const sideEffectRE = /(import\s*["'])([^"']+)(["'];?)/g;
-            result = result.replace(sideEffectRE, (full, pre, spec, post) => {
-                if (isNativeScriptCoreModule(spec))
-                    return full;
-                const resolved = resolveVendorSpecifier(spec);
-                if (!resolved || /^@nativescript\/core(\b|\/)/i.test(resolved))
-                    return full;
-                return `/* vendor side-effect skipped: ${spec} */`;
-            });
             // Dynamic import rewrites: import('pkg') -> Promise.resolve(__nsVendor('id'))
             const dynImportRE = /(import\(\s*["'])([^"']+)(["']\s*\))/g;
             result = result.replace(dynImportRE, (full, pre, spec, post) => {
@@ -999,6 +902,20 @@ function toAppModuleBaseId(importPath, projectRoot) {
     const base = projectRelative.replace(/\.mjs$/i, '');
     return `/${base}`;
 }
+function toNodeModulesHttpModuleId(importPath) {
+    const nodeModulesSpecifier = normalizeNodeModulesSpecifier(importPath);
+    if (!nodeModulesSpecifier) {
+        return null;
+    }
+    return `/ns/m/node_modules/${nodeModulesSpecifier}`;
+}
+// `rewriteNsMImportPathForHmr` and `getNumericServeVersionTag` live in
+// `./websocket-ns-m-paths.js`. The path rewriter is part of the
+// "Stable URL + Explicit Invalidation" architecture and must be a
+// single source of truth so the canonicalization rules can't drift
+// between modules. They are imported above and re-exported below for
+// tests / external callers that historically reached them through this
+// module.
 function normalizeAbsoluteFilesystemImport(spec, importerPath, projectRoot) {
     if (!spec || typeof spec !== 'string') {
         return null;
@@ -1025,13 +942,211 @@ function normalizeAbsoluteFilesystemImport(spec, importerPath, projectRoot) {
     }
     return absolute;
 }
+/**
+ * After the Angular linker runs on code that Vite has already resolved (bare
+ * specifiers → full URLs), the linker injects NEW import statements with bare
+ * specifiers (e.g. `import {Component} from '@angular/core'`).  These cause:
+ *   1. Duplicate-identifier SyntaxErrors (the name was already imported via URL)
+ *   2. Unresolvable bare specifiers at runtime on device
+ *
+ * This function:
+ *   • builds a map  packageName → resolvedURL  from existing resolved imports
+ *   • collects all binding names already imported per package
+ *   • for each bare-specifier import, removes duplicate bindings
+ *   • rewrites any genuinely-new bindings to use the resolved URL
+ */
+function deduplicateLinkerImports(code) {
+    if (!code)
+        return code;
+    try {
+        const imports = collectTopLevelImportRecords(code);
+        if (!imports.length) {
+            return code;
+        }
+        // ── Step 1: collect resolved imports already in the file ──────────
+        const pkgUrlMap = new Map();
+        const pkgBindings = new Map();
+        for (const imp of imports) {
+            const url = imp.source;
+            if (!/^https?:\/\//.test(url) && !url.startsWith('/')) {
+                continue;
+            }
+            const nmIdx = url.lastIndexOf('/node_modules/');
+            if (nmIdx === -1)
+                continue;
+            const afterNm = url.substring(nmIdx + '/node_modules/'.length);
+            const parts = afterNm.split('/');
+            const pkg = parts[0].startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
+            if (!pkgUrlMap.has(pkg))
+                pkgUrlMap.set(pkg, url);
+            if (imp.namedBindings.length) {
+                if (!pkgBindings.has(pkg))
+                    pkgBindings.set(pkg, new Set());
+                for (const binding of imp.namedBindings) {
+                    if (binding.importedName)
+                        pkgBindings.get(pkg).add(binding.importedName);
+                }
+            }
+        }
+        if (pkgUrlMap.size === 0)
+            return code;
+        // ── Step 2: rewrite bare-specifier imports ───────────────────────
+        const edits = [];
+        for (const imp of imports) {
+            if (!imp.hasOnlyNamedSpecifiers) {
+                continue;
+            }
+            const specifier = imp.source;
+            if (specifier.startsWith('/') || specifier.startsWith('.') || specifier.startsWith('http')) {
+                continue;
+            }
+            const parts = specifier.split('/');
+            const pkg = specifier.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
+            const url = pkgUrlMap.get(pkg);
+            if (!url) {
+                continue;
+            }
+            const existing = pkgBindings.get(pkg) || new Set();
+            const newBindings = imp.namedBindings.filter((binding) => !existing.has(binding.importedName));
+            if (newBindings.length === 0) {
+                edits.push({ start: imp.start, end: imp.end, text: '' });
+                continue;
+            }
+            if (newBindings.length === imp.namedBindings.length) {
+                continue;
+            }
+            for (const binding of newBindings) {
+                existing.add(binding.importedName);
+            }
+            edits.push({
+                start: imp.start,
+                end: imp.end,
+                text: `import { ${newBindings.map((binding) => binding.text).join(', ')} } from ${JSON.stringify(url)};`,
+            });
+        }
+        if (!edits.length) {
+            return code;
+        }
+        let next = code;
+        for (const edit of edits.sort((left, right) => right.start - left.start)) {
+            next = next.slice(0, edit.start) + edit.text + next.slice(edit.end);
+        }
+        return next;
+    }
+    catch {
+        return code;
+    }
+}
+export function wrapCommonJsModuleForDevice(code, absolutePath) {
+    if (!code)
+        return code;
+    try {
+        const hasExportDefault = /\bexport\s+default\b/.test(code) || /export\s*\{\s*default\s*(?:as\s*default)?\s*\}/.test(code);
+        const hasNamedExports = /\bexport\s+(?:const|let|var|function|class|async)\b/.test(code) || /\bexport\s*\{/.test(code);
+        const hasCjsExports = /\bmodule\s*\.\s*exports\b/.test(code) || /\bexports\s*\.\s*\w/.test(code);
+        if (hasExportDefault || hasNamedExports || !hasCjsExports) {
+            return code;
+        }
+        const namedExports = new Set();
+        const exportsRe = /\bexports\s*\.\s*([A-Za-z_$][\w$]*)\s*=/g;
+        let em;
+        while ((em = exportsRe.exec(code)) !== null) {
+            const name = em[1];
+            if (name !== '__esModule' && name !== 'default') {
+                namedExports.add(name);
+            }
+        }
+        const defPropRe = /Object\s*\.\s*defineProperty\s*\(\s*exports\s*,\s*['"]([^'"]+)['"]/g;
+        while ((em = defPropRe.exec(code)) !== null) {
+            const name = em[1];
+            if (name !== '__esModule' && name !== 'default') {
+                namedExports.add(name);
+            }
+        }
+        // Static enumeration only sees `exports.foo = ...` and `Object.defineProperty(exports, 'foo', ...)`.
+        // Real-world packages like lodash attach their entire surface to a function inside an IIFE and
+        // then `module.exports = thatFunction`. Static analysis returns zero in that case. To handle
+        // these modules we ALSO load the package in the dev-server's Node context (only when we have a
+        // node_modules path) and merge the runtime keys. See `helpers/cjs-named-exports.ts` for the
+        // reasoning and safety boundaries.
+        if (absolutePath) {
+            try {
+                for (const n of getCjsNamedExports(absolutePath)) {
+                    namedExports.add(n);
+                }
+            }
+            catch {
+                /* fall through to whatever we caught statically */
+            }
+        }
+        let suffix = `\nvar __cjs_mod = module.exports;\nexport default __cjs_mod;\n`;
+        if (namedExports.size) {
+            const entries = Array.from(namedExports);
+            const temps = entries.map((name, i) => `var __cjs_e${i} = __cjs_mod[${JSON.stringify(name)}];`);
+            const reExports = entries.map((name, i) => `__cjs_e${i} as ${name}`);
+            suffix += `${temps.join(' ')}\nexport { ${reExports.join(', ')} };\n`;
+        }
+        const prelude = `var module = { exports: {} }; var exports = module.exports;\n` +
+            `var __ns_cjs_require_base = (typeof globalThis.__nsBaseRequire === 'function' ? globalThis.__nsBaseRequire : (typeof globalThis.__nsRequire === 'function' ? globalThis.__nsRequire : (typeof globalThis.require === 'function' ? globalThis.require : undefined)));\n` +
+            `var __ns_cjs_require_kind = (typeof globalThis.__nsBaseRequire === 'function' ? 'base-require' : (typeof globalThis.__nsRequire === 'function' ? 'vendor-require' : 'global-require'));\n` +
+            `var require = function(spec) {\n` +
+            `  if (!__ns_cjs_require_base) { throw new Error('require is not defined'); }\n` +
+            // Resolve relative specifiers against the HTTP-served module's URL
+            // before delegating to NS's runtime require. Without this step,
+            // \`require('./base64-vlq')\` inside a CJS module served from
+            // \`http://.../ns/m/node_modules/source-map-js/lib/source-map-generator.js\`
+            // would pass a literal '"./base64-vlq"' to the native require, which
+            // has no notion of the current HTTP-module's location and either
+            // throws "Module not found" or fetches an arbitrary filesystem path
+            // that happens to parse as code (producing misleading syntax errors
+            // like "missing ) after argument list" from unrelated modules).
+            `  var __nsResolvedSpec = spec;\n` +
+            `  try {\n` +
+            `    if (typeof spec === 'string' && (spec.indexOf('./') === 0 || spec.indexOf('../') === 0)) {\n` +
+            `      var __nsParentUrl = (typeof import.meta !== 'undefined' && import.meta && typeof import.meta.url === 'string') ? import.meta.url : null;\n` +
+            `      if (__nsParentUrl) {\n` +
+            `        var __nsResolvedUrl = new URL(spec, __nsParentUrl);\n` +
+            `        // Common Node-style bare extensions: prefer .js if the resolved URL lacks an extension in its last path segment.\n` +
+            `        if (!/\\.[A-Za-z0-9]+$/.test(__nsResolvedUrl.pathname.split('/').pop() || '')) {\n` +
+            `          __nsResolvedUrl.pathname = __nsResolvedUrl.pathname.replace(/\\/+$/, '') + '.js';\n` +
+            `        }\n` +
+            `        __nsResolvedSpec = __nsResolvedUrl.href;\n` +
+            `      }\n` +
+            `    }\n` +
+            `  } catch (e) {}\n` +
+            `  try { var __nsRecord = globalThis.__NS_RECORD_MODULE_PROVENANCE__; if (typeof __nsRecord === 'function') { __nsRecord(String(__nsResolvedSpec), { kind: __ns_cjs_require_kind, specifier: String(spec), url: __nsResolvedSpec !== spec ? __nsResolvedSpec : undefined, via: 'cjs-wrapper', parent: (typeof import.meta !== 'undefined' && import.meta && import.meta.url) ? import.meta.url : undefined }); } } catch (e) {}\n` +
+            `  var mod = __ns_cjs_require_base(__nsResolvedSpec);\n` +
+            `  try {\n` +
+            `    if (mod && (typeof mod === 'object' || typeof mod === 'function') && mod.default !== undefined) {\n` +
+            `      var keys = [];\n` +
+            `      try { keys = Object.keys(mod); } catch (e) {}\n` +
+            `      var defaultOnly = keys.length === 1 && keys[0] === 'default';\n` +
+            `      var esModuleOnly = keys.length === 2 && keys.indexOf('default') !== -1 && keys.indexOf('__esModule') !== -1;\n` +
+            `      if (mod.__esModule || defaultOnly || esModuleOnly) { return mod.default; }\n` +
+            `    }\n` +
+            `  } catch (e) {}\n` +
+            `  return mod;\n` +
+            `};\n`;
+        return `${prelude}${code}${suffix}`;
+    }
+    catch {
+        return code;
+    }
+}
 /**
  * Process code for device: inject globals, remove framework imports
  */
-function processCodeForDevice(code, isVitePreBundled) {
+function processCodeForDevice(code, isVitePreBundled, preserveVendorImports = false, isNodeModule = false, sourceId, options) {
     let result = code;
+    const resolvedSpecifierOverrides = options?.resolvedSpecifierOverrides || getProcessCodeResolvedSpecifierOverrides(sourceId, getProjectRootPath());
+    const bindingOptions = {
+        preserveNonPluginVendorImports: preserveVendorImports,
+        resolvedSpecifierOverrides,
+    };
     // Ensure Angular partial declarations are linked before any sanitizers run so runtime never hits the JIT path.
     result = linkAngularPartialsIfNeeded(result);
+    // Post-linker: deduplicate/resolve imports the Angular linker injected with bare specifiers
+    result = deduplicateLinkerImports(result);
     // First: aggressively strip any lingering virtual dynamic-import-helper before anything else.
     // Doing this up-front prevents downstream dependency collection from seeing the virtual id.
     result = stripViteDynamicImportVirtual(result);
@@ -1042,13 +1157,17 @@ function processCodeForDevice(code, isVitePreBundled) {
     // Inject ALL NativeScript/build globals at the top (matching global-defines.ts)
     // This ensures any code using __DEV__, __ANDROID__, __IOS__, etc. works correctly
     const allGlobals = [
+        // Minimal process shim — populated with CLI --env.* flags at module load time.
+        // In production builds, Vite/Rollup replaces process.env.* statically.
+        // In HMR dev mode the code runs as-is on device, so we need the shim.
+        `if (typeof process === "undefined") { globalThis.process = { env: ${__processEnvJson} }; } else if (!process.env) { process.env = ${__processEnvJson}; }`,
         'const __ANDROID__ = globalThis.__ANDROID__ !== undefined ? globalThis.__ANDROID__ : false;',
         'const __IOS__ = globalThis.__IOS__ !== undefined ? globalThis.__IOS__ : false;',
         'const __VISIONOS__ = globalThis.__VISIONOS__ !== undefined ? globalThis.__VISIONOS__ : false;',
         'const __APPLE__ = globalThis.__APPLE__ !== undefined ? globalThis.__APPLE__ : (__IOS__ || __VISIONOS__);',
         'const __DEV__ = globalThis.__DEV__ !== undefined ? globalThis.__DEV__ : false;',
         'const __COMMONJS__ = globalThis.__COMMONJS__ !== undefined ? globalThis.__COMMONJS__ : false;',
-        'const __NS_WEBPACK__ = globalThis.__NS_WEBPACK__ !== undefined ? globalThis.__NS_WEBPACK__ : true;',
+        'const __NS_WEBPACK__ = globalThis.__NS_WEBPACK__ !== undefined ? globalThis.__NS_WEBPACK__ : false;',
         'const __NS_ENV_VERBOSE__ = globalThis.__NS_ENV_VERBOSE__ !== undefined ? !!globalThis.__NS_ENV_VERBOSE__ : false;',
         "const __CSS_PARSER__ = globalThis.__CSS_PARSER__ !== undefined ? globalThis.__CSS_PARSER__ : 'css-tree';",
         'const __UI_USE_XML_PARSER__ = globalThis.__UI_USE_XML_PARSER__ !== undefined ? globalThis.__UI_USE_XML_PARSER__ : true;',
@@ -1056,19 +1175,29 @@ function processCodeForDevice(code, isVitePreBundled) {
         'const __TEST__ = globalThis.__TEST__ !== undefined ? globalThis.__TEST__ : false;',
     ];
     result = allGlobals.join('\n') + '\n' + result;
-    // Prefer AST-based normalization for imports and helper aliases; fallback regex if parsing fails
-    try {
-        result = astNormalizeModuleImportsAndHelpers(result);
+    const nodeModuleProvenancePrelude = buildNodeModuleProvenancePrelude(sourceId);
+    if (nodeModuleProvenancePrelude) {
+        result = nodeModuleProvenancePrelude + result;
     }
-    catch { }
-    // Verify there are no duplicate top-level const/let bindings after AST normalization
-    try {
-        result = astVerifyAndAnnotateDuplicates(result);
+    // AST normalization: inject /ns/rt helper aliases for underscore-prefixed identifiers.
+    // ONLY for app source files — library code in node_modules should be served as-is.
+    // Running the normalizer on libraries like tslib injects harmful destructures
+    // (e.g., `const { SuppressedError } = __ns_rt_ns_1`) that shadow globals.
+    if (!isNodeModule) {
+        try {
+            result = astNormalizeModuleImportsAndHelpers(result);
+        }
+        catch { }
+        // Verify there are no duplicate top-level const/let bindings after AST normalization
+        try {
+            result = astVerifyAndAnnotateDuplicates(result);
+        }
+        catch { }
     }
-    catch { }
-    // If AST marker present, skip regex-based helper alias injection to avoid duplicates
-    // Accept both line and block comment markers emitted by the normalizer
-    if (!/^\s*(?:\/\/|\/\*) \[ast-normalized\]/m.test(result)) {
+    // If AST marker present OR this is a node_modules file, skip regex-based helper
+    // alias injection. Library code should NOT get /ns/rt destructures injected —
+    // underscore-prefixed identifiers in libraries are internal variables, not NS helpers.
+    if (!isNodeModule && !/^\s*(?:\/\/|\/\*) \[ast-normalized\]/m.test(result)) {
         try {
             const underscored = new Set();
             const re = /(^|[^.\w$])_([A-Za-z]\w*)\b/g;
@@ -1149,7 +1278,11 @@ function processCodeForDevice(code, isVitePreBundled) {
         result = result.replace(/(^|\n)([\t ]*import\s+[^;]*?\s+from)\s*\n\s*("\/?node_modules\/\.vite\/deps\/[^"\n]+"\s*;?\s*)/gm, (_m, p1, p2, p3) => `${p1}${p2} ${p3}`);
     }
     catch { }
-    result = ensureNativeScriptModuleBindings(result);
+    // When preserveVendorImports is true (HMR /ns/m/ endpoint), skip the
+    // __nsVendorRequire + __nsPick rewrite. Vendor imports stay as bare
+    // specifiers so the device-side import map resolves them via V8's native
+    // module system, which correctly handles export * re-exports.
+    result = ensureNativeScriptModuleBindings(result, bindingOptions);
     // Repair any accidental "import ... = expr" assignments that may have slipped in.
     try {
         result = repairImportEqualsAssignments(result);
@@ -1158,10 +1291,7 @@ function processCodeForDevice(code, isVitePreBundled) {
     // Strip Vite prebundle deps imports (both named and side-effect) and any malformed const string artifacts
     // Example problematic line observed: const "/node_modules/.vite/deps/@nativescript_firebase-messaging.js?v=...";
     if (/node_modules\/\.vite\/deps\//.test(result)) {
-        // Named imports from prebundle deps
-        result = result.replace(/^[\t ]*import\s+[^;]*from\s+["']\/?node_modules\/\.vite\/deps\/[^"']+["'];?\s*$/gm, '');
-        // Side-effect only imports from prebundle deps
-        result = result.replace(/^[\t ]*import\s+["']\/?node_modules\/\.vite\/deps\/[^"']+["'];?\s*$/gm, '');
+        result = rewriteVitePrebundleImportsForDevice(result, preserveVendorImports);
         // Malformed const string lines accidentally produced by upstream transforms
         result = result.replace(/^[\t ]*const\s+["']\/?node_modules\/\.vite\/deps\/[^"']+["'];?\s*$/gm, '// [hmr-sanitize] stripped malformed const prebundle ref\n');
         // Naked string-only lines pointing at prebundle deps
@@ -1248,7 +1378,7 @@ function processCodeForDevice(code, isVitePreBundled) {
     }
     // Ensure vendor bindings also apply after potential wrapper injections above
     // (idempotent: second pass will be a no-op if imports already consumed).
-    result = ensureNativeScriptModuleBindings(result);
+    result = ensureNativeScriptModuleBindings(result, bindingOptions);
     try {
         result = repairImportEqualsAssignments(result);
     }
@@ -1289,17 +1419,17 @@ function processCodeForDevice(code, isVitePreBundled) {
         result = normalizeStrayCoreStringLiterals(result);
     }
     catch { }
+    try {
+        result = fixDanglingCoreFrom(result);
+    }
+    catch { }
+    try {
+        result = normalizeAnyCoreSpecToBridge(result);
+    }
+    catch { }
     result = ensureVariableDynamicImportHelper(result);
     // Normalize any lingering @nativescript/core imports to the /ns/core bridge (non-destructive best-effort)
     try {
-        result = result.replace(/from\s+["']@nativescript\/core([^"'\n]*)["']/g, (_m, sub) => {
-            const qp = (sub || '').trim().replace(/^\//, '');
-            return `from "/ns/core${qp ? `?p=${qp}` : ''}"`;
-        });
-        result = result.replace(/import\(\s*["']@nativescript\/core([^"'\n]*)["']\s*\)/g, (_m, sub) => {
-            const qp = (sub || '').trim().replace(/^\//, '');
-            return `import("/ns/core${qp ? `?p=${qp}` : ''}")`;
-        });
         // Rewrite named imports from the /ns/core bridge into default import + destructuring.
         // This makes `import { Frame } from '@nativescript/core'` work even if the bridge provides only a default export.
         {
@@ -1315,6 +1445,9 @@ function processCodeForDevice(code, isVitePreBundled) {
                 .join(', ');
             const reNamed = /(^|\n)\s*import\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[\d]+)?(?:\?p=[^"']+)?)['"];?\s*/gm;
             result = result.replace(reNamed, (_full, pfx, specList, src) => {
+                // Deep subpath URLs serve actual ESM with real named exports — skip.
+                if (isDeepCoreSubpath(src))
+                    return _full;
                 __core_ns_seq++;
                 const tmp = `__ns_core_ns${__core_ns_seq}`;
                 const decl = `const { ${toDestructureCore(specList)} } = ${tmp};`;
@@ -1322,6 +1455,8 @@ function processCodeForDevice(code, isVitePreBundled) {
             });
             const reMixed = /(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*,\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[\d]+)?(?:\?p=[^"']+)?)['"];?\s*/gm;
             result = result.replace(reMixed, (_full, pfx, defName, specList, src) => {
+                if (isDeepCoreSubpath(src))
+                    return _full;
                 const decl = `const { ${toDestructureCore(specList)} } = ${defName};`;
                 return `${pfx}import ${defName} from ${JSON.stringify(src)};\n${decl}\n`;
             });
@@ -1335,8 +1470,19 @@ function processCodeForDevice(code, isVitePreBundled) {
         // Keep a single semicolon before the import to avoid generating ';;'
         result = result.replace(/;\s*import\s+/g, ';\nimport ');
         result = result.replace(/}\s*import\s+/g, '}\nimport ');
-        // Fallback: ensure any static import that isn't at start of line gets a newline before it
-        result = result.replace(/([^\n])\s*(import\s+[^;\n]*\s+from\s*["'][^"']+["'])/g, '$1\n$2');
+        // Fallback: ensure any static import that isn't at start of line gets a newline before it.
+        //
+        // Only match after **structural** statement-ending characters: `;`, `}`, `)`, `]`. We
+        // deliberately do NOT include `'`, `"`, or `` ` `` here — those are string-literal
+        // terminators (and openers!), and including them caused the regex to fire inside
+        // example code embedded in error strings. Concrete failure observed:
+        // `@supabase/realtime-js` throws an Error whose message contains the literal
+        // `'  import ws from "ws"\n' +`. With `'` in the delimiter class, the engine matched
+        // the opening `'` of that string literal as a "statement terminator" and rewrote the
+        // example to `'\nimport ws from "..."` — splitting the string across two lines and
+        // producing a SyntaxError on device. The structural delimiters below do not appear
+        // inside string-literal openers, so the rewrite is safe.
+        result = result.replace(/([;}\)\]])\s*(import\s+[^;\n]*\s+from\s*["'][^"']+["'])/g, '$1\n$2');
     }
     catch { }
     // Collapse duplicate destructuring from the same temp namespace var (e.g., multiple const { x } = __ns_rt_ns1)
@@ -1370,22 +1516,13 @@ function processCodeForDevice(code, isVitePreBundled) {
     // always come before any statements that might reference their bindings. This ordering avoids
     // device runtimes that are stricter about imports-first semantics during module instantiation.
     try {
-        const importLineRe = /^\s*import\s+[^;]+;?\s*$/gm;
-        const lines = [];
-        result = result.replace(importLineRe, (imp) => {
-            lines.push(imp.trim());
-            return '';
-        });
-        if (lines.length) {
-            const hoisted = Array.from(new Set(lines)).join('\n') + '\n';
-            result = hoisted + result;
-        }
+        result = hoistTopLevelStaticImports(result);
     }
     catch { }
     // Final safety: normalize any lingering named imports from /ns/rt into default+destructure
-    // Skip when AST normalization marker present to avoid introducing duplicate temp imports
+    // Skip for node_modules (no /ns/rt helpers needed) and when AST marker present
     try {
-        if (!/^\s*\/\* \[ast-normalized\] \*\//m.test(result)) {
+        if (!isNodeModule && !/^\s*\/\* \[ast-normalized\] \*\//m.test(result)) {
             result = ensureDestructureRtImports(result);
         }
     }
@@ -1531,6 +1668,16 @@ function assertNoOptimizedArtifacts(code, contextLabel) {
                 }
             }
             if (localCore.test(ln)) {
+                // Comments can never cause split-realm risk at runtime — skip them.
+                // Library authors commonly reference @nativescript/core in comments
+                // (e.g. TSDoc /// <reference> directives, module resolution notes).
+                const trimmed = ln.trimStart();
+                if (trimmed.startsWith('//') || trimmed.startsWith('/*') || trimmed.startsWith('*')) {
+                    continue;
+                }
+                if (shouldAllowLocalCoreSanitizerPaths(contextLabel)) {
+                    continue;
+                }
                 offenders.push(`${i + 1}: ${ln.substring(0, 200)} [local-core-path]`);
             }
             if (offenders.length >= 10)
@@ -1555,6 +1702,7 @@ function assertNoOptimizedArtifacts(code, contextLabel) {
 function ensureDestructureCoreImports(code) {
     try {
         let result = code;
+        let coreImportCounter = 0;
         const toDestructure = (specList) => specList
             .split(',')
             .map((s) => s.trim())
@@ -1567,13 +1715,19 @@ function ensureDestructureCoreImports(code) {
         // import { A, B } from '/ns/core[/ver][?p=...]'
         const reNamed = /(^|\n)\s*import\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[\d]+)?(?:\?p=[^"']+)?)['"];?\s*/gm;
         result = result.replace(reNamed, (_full, pfx, specList, src) => {
-            const tmp = `__ns_core_ns_re`; // temp binding name is not reused elsewhere after hoist
+            // Deep subpath URLs serve actual ESM with real named exports — skip.
+            if (isDeepCoreSubpath(src))
+                return _full;
+            const tmp = `__ns_core_ns_re${coreImportCounter > 0 ? `_${coreImportCounter}` : ''}`;
+            coreImportCounter++;
             const decl = `const { ${toDestructure(specList)} } = ${tmp};`;
             return `${pfx}import ${tmp} from ${JSON.stringify(src)};\n${decl}\n`;
         });
         // import Default, { A, B } from '/ns/core[...]'
         const reMixed = /(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*,\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[\d]+)?(?:\?p=[^"']+)?)['"];?\s*/gm;
         result = result.replace(reMixed, (_full, pfx, defName, specList, src) => {
+            if (isDeepCoreSubpath(src))
+                return _full;
             const decl = `const { ${toDestructure(specList)} } = ${defName};`;
             return `${pfx}import ${defName} from ${JSON.stringify(src)};\n${decl}\n`;
         });
@@ -1685,14 +1839,21 @@ function dedupeRtNamedImportsAgainstDestructures(code) {
 /**
  * THE SINGLE REWRITE FUNCTION - used everywhere for consistency
  */
-function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot, verbose = false, outputDirOverrideRel, httpOrigin) {
+export function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot, verbose = false, outputDirOverrideRel, httpOrigin, resolveVendorAsHttp = false) {
     let result = code;
     const httpOriginSafe = httpOrigin;
+    const mixedRuntimePluginHttpRootPackages = collectMixedRuntimePluginHttpRootPackages(result, projectRoot);
+    const isDynamicImportPrefix = (prefix) => /import\(\s*["']?$/.test(prefix.trimStart());
     const importerDir = path.posix.dirname(importerPath);
+    // Resolved once per `rewriteImports` call so the per-import `/@fs/` rewriter
+    // can convert workspace-lib paths back into our `/ns/m/` pipeline. Memoized
+    // upstream — calling here is cheap and we reuse the value below.
+    const monorepoWorkspaceRootForRewrite = getMonorepoWorkspaceRoot(projectRoot);
     // Determine importer output relative path (project-relative .mjs) to compute relative imports consistently
     const importerOutRel = outputDirOverrideRel || getProjectRelativeImportPath(importerPath, projectRoot) || stripToProjectRelative(importerPath, projectRoot).replace(/\.(ts|js|tsx|jsx|mjs|mts|cts)$/i, '.mjs');
     const importerOutDir = importerOutRel ? path.posix.dirname(importerOutRel) : '';
     const ensureRel = (p) => (p.startsWith('.') ? p : `./${p}`);
+    const isNsSfcSpecifier = (spec) => /^(?:https?:\/\/[^/]+)?\/ns\/sfc(?:\/\d+)?(?:\/|$)/.test(spec.replace(PAT.QUERY_PATTERN, ''));
     // Normalize all @nativescript/core imports to the unified HTTP ESM core bridge to guarantee a single realm on device
     try {
         let coreAliasIdx = 0;
@@ -1754,7 +1915,23 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
             const cleanPath = jsonPath.split('?')[0];
             // Resolve the JSON file path relative to the importer
             let fullPath;
-            if (cleanPath.startsWith('/')) {
+            if (cleanPath.startsWith('/@fs/')) {
+                // Vite filesystem URL: `/@fs/<abs-path>`. Strip the `/@fs` prefix
+                // (4 chars, leaving the leading `/`) to recover the absolute
+                // path. This matches `rewriteFsAbsoluteToNsM`'s convention and
+                // covers both bare specifiers Vite pre-resolved out of the
+                // project root (e.g. `emojibase-data/en/compact.json` →
+                // `/@fs/.../node_modules/.../compact.json`) and tsconfig
+                // path-alias targets that resolve outside the project root
+                // (e.g. `~shared/...metadata.json` → `/@fs/.../tools/...json`).
+                // Without this branch the next `else if` would `path.join` the
+                // `/@fs/...` URL onto `projectRoot`, collapsing the leading `/`
+                // and producing a malformed nested path that always misses on
+                // `existsSync` and triggers a `ReferenceError` at runtime when
+                // the JSON-import-failed comment leaves the binding undefined.
+                fullPath = cleanPath.slice('/@fs'.length);
+            }
+            else if (cleanPath.startsWith('/')) {
                 // Absolute from project root
                 fullPath = path.join(projectRoot, cleanPath);
             }
@@ -1776,7 +1953,7 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
                 return `const ${varName} = ${jsonContent};`;
             }
             else {
-                console.warn(`[rewrite] JSON file not found: ${fullPath}`);
+                console.warn(`[rewrite] JSON file not found: ${fullPath} (specifier=${jsonPath})`);
             }
         }
         catch (error) {
@@ -1827,14 +2004,48 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
         if (spec === '@') {
             const stub = `/ns/m/__invalid_at__.mjs`;
             if (verbose) {
-                try {
-                    console.warn(`[rewrite] mapped bare '@' spec to stub: ${stub}`);
-                }
-                catch { }
+                console.warn(`[rewrite] mapped bare '@' spec to stub: ${stub}`);
             }
             return `${prefix}${stub}${suffix}`;
         }
         spec = normalizeNativeScriptCoreSpecifier(spec);
+        // Pull `/@fs/<abs-path>` URLs back into the `/ns/m/` pipeline so they
+        // hit our CJS/UMD-wrapping handler. Vite emits `/@fs/...` for any
+        // resolved id outside the configured `root` — including hoisted
+        // `node_modules/<pkg>` entries and workspace libs in monorepos. Left
+        // untouched, the device fetches them through Vite's standard
+        // middleware which never invokes `wrapCommonJsModuleForDevice`, so a
+        // UMD module like papaparse crashes on `(this).Papa = factory()`
+        // because top-level `this` is `undefined` in ESM context.
+        if (spec.startsWith('/@fs/')) {
+            const rewritten = rewriteFsAbsoluteToNsM(spec, projectRoot, monorepoWorkspaceRootForRewrite);
+            if (rewritten) {
+                if (httpOriginSafe) {
+                    return `${prefix}${httpOriginSafe}${rewritten}${suffix}`;
+                }
+                return `${prefix}${rewritten}${suffix}`;
+            }
+            // Path resolves outside both roots — leave Vite's URL alone as a
+            // last resort. The original behaviour was to fall through here
+            // and let downstream branches (e.g. `normalizeNodeModulesSpecifier`)
+            // handle paths whose abs form happens to contain `/node_modules/`,
+            // so preserve that for the unrewritable case below.
+        }
+        // Route Vite virtual modules (/@solid-refresh, etc.) through /ns/m/ so their
+        // internal imports (e.g. solid-js) get vendor-rewritten by our pipeline.
+        // Skip known Vite internals (/@vite/, /@id/) which are handled elsewhere.
+        // `/@fs/` is intentionally excluded above; if we ever reach here with a
+        // `/@fs/` spec it means the rewrite-to-`/ns/m/` pass couldn't anchor it
+        // under projectRoot or workspaceRoot, so we fall through and rely on the
+        // `normalizeNodeModulesSpecifier` branch below for paths that still
+        // contain a `/node_modules/<pkg>/` segment.
+        if (spec.startsWith('/@') && !/^\/@(?:vite|id|fs)\//.test(spec)) {
+            const out = `/ns/m${spec}`;
+            if (httpOriginSafe) {
+                return `${prefix}${httpOriginSafe}${out}${suffix}`;
+            }
+            return `${prefix}${out}${suffix}`;
+        }
         // Route internal NS endpoints to absolute HTTP origin for device
         if (spec.startsWith('/ns/')) {
             if (httpOriginSafe) {
@@ -1846,20 +2057,50 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
             return `${prefix}${spec}${suffix}`;
         }
         const nodeModulesSpecifier = normalizeNodeModulesSpecifier(spec);
-        const candidateNativeScriptSpec = nodeModulesSpecifier ?? spec;
-        const vendorCanonical = resolveVendorFromCandidate(nodeModulesSpecifier ?? spec);
-        if (vendorCanonical) {
-            if (nodeModulesSpecifier) {
-                return `${prefix}${nodeModulesSpecifier.replace(PAT.QUERY_PATTERN, '')}${suffix}`;
+        const normalizedRuntimePluginSpec = nodeModulesSpecifier || spec.replace(PAT.QUERY_PATTERN, '').replace(/^\/+/, '');
+        if (normalizedRuntimePluginSpec && mixedRuntimePluginHttpRootPackages.size > 0) {
+            const { packageName } = resolveNodeModulesPackageBoundary(normalizedRuntimePluginSpec, projectRoot);
+            if (packageName && mixedRuntimePluginHttpRootPackages.has(packageName)) {
+                const httpNodeModulesSpecifier = nodeModulesSpecifier || normalizedRuntimePluginSpec;
+                const httpSpec = `/ns/m/node_modules/${httpNodeModulesSpecifier}`;
+                if (httpOriginSafe) {
+                    return `${prefix}${httpOriginSafe}${httpSpec}${suffix}`;
+                }
+                return `${prefix}${httpSpec}${suffix}`;
             }
-            return `${prefix}${spec.replace(PAT.QUERY_PATTERN, '')}${suffix}`;
         }
-        if (isNativeScriptPluginModule(candidateNativeScriptSpec)) {
-            const bareSpecifier = candidateNativeScriptSpec.replace(PAT.QUERY_PATTERN, '');
-            return `${prefix}${bareSpecifier}${suffix}`;
+        if (shouldPreserveBareRuntimePluginSubpathImport(spec, projectRoot)) {
+            const httpSpec = `/ns/m/node_modules/${spec.replace(PAT.QUERY_PATTERN, '').replace(/^\/+/, '')}`;
+            if (httpOriginSafe) {
+                return `${prefix}${httpOriginSafe}${httpSpec}${suffix}`;
+            }
+            return `${prefix}${httpSpec}${suffix}`;
         }
+        const candidateNativeScriptSpec = nodeModulesSpecifier ?? spec;
+        // ── Node modules routing ──────────────────────────────────────
+        // Uses the package's own package.json exports field to determine
+        // whether an import is the main entry (→ vendor bridge) or a
+        // subpath entry (→ HTTP). This replaces the old heuristic-based
+        // approach that tried to guess from file paths.
         if (nodeModulesSpecifier) {
-            return `${prefix}${nodeModulesSpecifier}${suffix}`;
+            const vendorRouting = resolveVendorRouting(nodeModulesSpecifier, projectRoot);
+            if (vendorRouting) {
+                if (vendorRouting.route === 'vendor') {
+                    return `${prefix}${vendorRouting.bareSpec}${suffix}`;
+                }
+                // Vendor package but subpath/platform-specific → HTTP
+                const httpSpec = `/ns/m/node_modules/${nodeModulesSpecifier}`;
+                if (httpOriginSafe) {
+                    return `${prefix}${httpOriginSafe}${httpSpec}${suffix}`;
+                }
+                return `${prefix}${httpSpec}${suffix}`;
+            }
+            // Not a vendor package → serve via HTTP from Vite dev server
+            const httpSpec = `/ns/m/node_modules/${nodeModulesSpecifier}`;
+            if (httpOriginSafe) {
+                return `${prefix}${httpOriginSafe}${httpSpec}${suffix}`;
+            }
+            return `${prefix}${httpSpec}${suffix}`;
         }
         // Handle .vue imports
         if (PAT.VUE_FILE_PATTERN.test(spec)) {
@@ -1883,7 +2124,7 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
                 return `${prefix}${out}${suffix}`;
             }
             // Case B: plain .vue module → rewrite to SFC endpoint or local artifact
-            const vueKey = resolveVueKey(spec.replace(PAT.QUERY_PATTERN, ''));
+            const vueKey = resolveVueKey(spec.replace(PAT.QUERY_PATTERN, '')) || '';
             if (vueKey) {
                 if (true) {
                     const absVue = vueKey.startsWith('/') ? vueKey : '/' + vueKey;
@@ -1913,9 +2154,25 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
         // Rewrite relative application imports to HTTP for served modules
         if (spec.startsWith('./') || spec.startsWith('../')) {
             const absMaybe = normalizeImportPath(spec, importerDir);
+            const nodeModulesHttpSpec = absMaybe ? toNodeModulesHttpModuleId(absMaybe) : null;
+            if (nodeModulesHttpSpec) {
+                if (isDynamicImportPrefix(prefix)) {
+                    if (verbose)
+                        console.log(`[rewrite][http] dynamic relative node_modules import → ${nodeModulesHttpSpec} (from ${spec})`);
+                    return `__nsDynamicHmrImport(${JSON.stringify(nodeModulesHttpSpec)})`;
+                }
+                if (verbose)
+                    console.log(`[rewrite][http] relative node_modules import → ${nodeModulesHttpSpec} (from ${spec})`);
+                return `${prefix}${nodeModulesHttpSpec}${suffix}`;
+            }
             const baseId = absMaybe ? toAppModuleBaseId(absMaybe, projectRoot) : null; // e.g. /src/foo.mjs
             if (baseId) {
                 const httpSpec = `/ns/m${baseId}`;
+                if (isDynamicImportPrefix(prefix)) {
+                    if (verbose)
+                        console.log(`[rewrite][http] dynamic relative app import → ${httpSpec} (from ${spec})`);
+                    return `__nsDynamicHmrImport(${JSON.stringify(httpSpec)})`;
+                }
                 if (verbose)
                     console.log(`[rewrite][http] relative app import → ${httpSpec} (from ${spec})`);
                 return `${prefix}${httpSpec}${suffix}`;
@@ -1928,6 +2185,11 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
             const baseId = toAppModuleBaseId(spec, projectRoot);
             if (baseId) {
                 const httpSpec = `/ns/m${baseId}`;
+                if (isDynamicImportPrefix(prefix)) {
+                    if (verbose)
+                        console.log(`[rewrite][http] dynamic app import → ${httpSpec} (from ${spec})`);
+                    return `__nsDynamicHmrImport(${JSON.stringify(httpSpec)})`;
+                }
                 if (verbose)
                     console.log(`[rewrite][http] absolute app import → ${httpSpec} (from ${spec})`);
                 return `${prefix}${httpSpec}${suffix}`;
@@ -1951,6 +2213,27 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
                 return `${prefix}./${depFile}${suffix}`;
             }
         }
+        // Bare npm package specifier fallback — route to /ns/m/node_modules/.
+        // This catches specifiers like `source-map-js/lib/source-map-generator.js`
+        // emitted by helpers such as the CommonJS compat transform, which Vite
+        // would normally resolve to an absolute path but which pass through the
+        // rewriter as bare strings here. Under HMR (core external) bundle.mjs
+        // depends on these resolving over HTTP rather than via a filesystem
+        // bare-specifier lookup, which iOS can't satisfy and which crashes with
+        // "Module not found".
+        if (spec && !spec.startsWith('/') && !spec.startsWith('./') && !spec.startsWith('../') && !/^https?:\/\//i.test(spec) && !spec.startsWith('ns-vendor:') && !spec.startsWith('@nativescript/core')) {
+            // Only treat as a package spec if it looks like one — disallow
+            // plain identifiers like `moment` unresolved (those are left alone
+            // for existing vendor-routing paths to handle).
+            const bareNpmRe = /^(?:@[A-Za-z0-9][\w.-]*\/)?[A-Za-z0-9][\w.-]*(?:\/[\w.\-/]+)?$/;
+            if (bareNpmRe.test(spec)) {
+                const httpSpec = `/ns/m/node_modules/${spec}`;
+                if (httpOriginSafe) {
+                    return `${prefix}${httpOriginSafe}${httpSpec}${suffix}`;
+                }
+                return `${prefix}${httpSpec}${suffix}`;
+            }
+        }
         // Leave everything else unchanged (vendor imports, etc.)
         return `${prefix}${spec}${suffix}`;
     };
@@ -1959,16 +2242,17 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
     result = result.replace(PAT.IMPORT_PATTERN_2, replaceVueImport);
     result = result.replace(PAT.EXPORT_PATTERN, replaceVueImport);
     result = result.replace(PAT.IMPORT_PATTERN_3, replaceVueImport);
+    // Side-effect imports (import "spec") — must run AFTER named-import patterns
+    // since IMPORT_PATTERN_1 already handles `import ... from "spec"`.
+    result = result.replace(PAT.IMPORT_PATTERN_SIDE_EFFECT, replaceVueImport);
+    result = ensureDynamicHmrImportHelper(result);
     // Extra guard: map any lingering dynamic import('@') to a safe stub module path
     // to prevent device runtime normalization errors.
     // Example matched: import('@') or import("@") with optional whitespace before closing paren
     result = result.replace(/(import\(\s*['"])@(['"]\s*\))/g, (_m) => {
         const stubExpr = `import(new URL('/ns/m/__invalid_at__.mjs', import.meta.url).href)`;
         if (verbose) {
-            try {
-                console.warn(`[rewrite] mapped dynamic import('@') to /ns/m/__invalid_at__.mjs via import.meta.url`);
-            }
-            catch { }
+            console.warn(`[rewrite] mapped dynamic import('@') to /ns/m/__invalid_at__.mjs via import.meta.url`);
         }
         return stubExpr;
     });
@@ -1977,10 +2261,7 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
     result = result.replace(/(from\s*['"])@(['"])/g, (_m, p1, p2) => {
         const stub = `/ns/m/__invalid_at__.mjs`;
         if (verbose) {
-            try {
-                console.warn(`[rewrite] mapped static from '@' to ${stub}`);
-            }
-            catch { }
+            console.warn(`[rewrite] mapped static from '@' to ${stub}`);
         }
         return `${p1}${stub}${p2}`;
     });
@@ -1988,10 +2269,7 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
     result = result.replace(/(import\s*(?!\()\s*['"])@(['"])/g, (_m, p1, p2) => {
         const stub = `/ns/m/__invalid_at__.mjs`;
         if (verbose) {
-            try {
-                console.warn(`[rewrite] mapped side-effect import '@' to ${stub}`);
-            }
-            catch { }
+            console.warn(`[rewrite] mapped side-effect import '@' to ${stub}`);
         }
         return `${p1}${stub}${p2}`;
     });
@@ -1999,6 +2277,11 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
     // In HTTP mode, skip legacy local-path rewrite to avoid mixing module origins
     result = result.replace(PAT.VUE_FILE_IMPORT, (_m, p1, spec, p3) => {
         if (httpOrigin) {
+            if (isNsSfcSpecifier(spec)) {
+                if (verbose)
+                    console.log(`[rewrite] .vue already routed (VUE_FILE_IMPORT http): ${spec}`);
+                return `${p1}${spec}${p3}`;
+            }
             // Route via /ns/sfc with full query preserved
             try {
                 let base = spec;
@@ -2048,6 +2331,13 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
                 console.log(`[rewrite][http] internal ns import (dynamic) → ${spec} via import.meta.url`);
             return expr;
         }
+        const nodeModulesHttpSpec = toNodeModulesHttpModuleId(spec);
+        if (nodeModulesHttpSpec) {
+            const expr = `import(new URL('${nodeModulesHttpSpec}', import.meta.url).href)`;
+            if (verbose)
+                console.log(`[rewrite][http] absolute dynamic node_modules import → ${nodeModulesHttpSpec} via import.meta.url (from ${spec})`);
+            return expr;
+        }
         const baseId = toAppModuleBaseId(spec, projectRoot);
         if (!baseId)
             return match;
@@ -2064,6 +2354,8 @@ function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot,
 function createHmrWebSocketPlugin(opts) {
     const verbose = !!opts.verbose;
     let wss = null;
+    let sharedTransformRequest;
+    const pendingAngularReloadSuppressions = new Map();
     const sfcFileMap = new Map();
     const depFileMap = new Map();
     // Generic module manifest (spec -> emitted relative .mjs path)
@@ -2074,14 +2366,42 @@ function createHmrWebSocketPlugin(opts) {
     let registrySent = false;
     let vendorBootstrapDone = false;
     let pluginRoot;
-    let graphVersion = 0;
+    // graphVersion starts at 1 so the very first /ns/m response uses a stable
+    // `v1` URL tag (see dynamic-import helper at lines 398-432). Keeping it
+    // stable during cold boot prevents double-loads when the graph fills up
+    // lazily as modules are served.
+    let graphVersion = 1;
     // Transactional HMR batches: map graphVersion -> ordered list of changed ids for that version
     const txnBatches = new Map();
     const graph = new Map();
+    // Tracks the background initial-graph population so handleHotUpdate can
+    // await completion before computing delta roots for the first HMR event.
+    let graphInitialPopulationPromise = null;
+    // Cold-boot /ns/m request counter — populated the first time a /ns/m
+    // request arrives, finalized when the request window goes idle.
+    // See Shared across requests so a single counter spans the whole cold boot.
+    let coldBootCounter = null;
+    function rememberAngularReloadSuppression(root, file, ttlMs = 3000) {
+        const absPath = normalizeHotReloadMatchPath(file);
+        const relPath = normalizeHotReloadMatchPath(file, root);
+        pendingAngularReloadSuppressions.set(absPath, {
+            absPath,
+            relPath,
+            expiresAt: Date.now() + ttlMs,
+        });
+    }
+    function pruneAngularReloadSuppressions(now = Date.now()) {
+        for (const [key, entry] of pendingAngularReloadSuppressions) {
+            if (!entry || entry.expiresAt <= now) {
+                pendingAngularReloadSuppressions.delete(key);
+            }
+        }
+    }
     // Compute a dependency-closed, topologically sorted list of modules for a given set of changed ids.
     // Only include application modules we can serve (e.g., under /src and known .vue/.ts/.js entries in the graph).
     function computeTxnOrderForChanged(changedIds) {
-        const includeExt = (id) => ACTIVE_STRATEGY.matchesFile(id) || /\.(ts|js|mjs|tsx|jsx)$/i.test(id);
+        const includeAppModule = (id) => matchesRuntimeGraphModuleId(id, APP_VIRTUAL_WITH_SLASH, /\.(ts|js|mjs|tsx|jsx)$/i);
+        const includeExt = (id) => ACTIVE_STRATEGY.matchesFile(id) || includeAppModule(id);
         const isApp = (id) => id.startsWith(APP_VIRTUAL_WITH_SLASH);
         const roots = changedIds.map(normalizeGraphId).filter((id) => graph.has(id) && (isApp(id) || ACTIVE_STRATEGY.matchesFile(id)) && includeExt(id));
         const toVisit = new Set();
@@ -2220,7 +2540,7 @@ function createHmrWebSocketPlugin(opts) {
             catch { }
         });
     }
-    function upsertGraphModule(rawId, code, deps) {
+    function upsertGraphModule(rawId, code, deps, options) {
         const id = normalizeGraphId(rawId);
         const normDeps = deps
             .map((d) => normalizeGraphId(d))
@@ -2229,19 +2549,25 @@ function createHmrWebSocketPlugin(opts) {
             .sort();
         const hash = computeHash(code);
         const existing = graph.get(id);
-        if (existing && existing.hash === hash && existing.deps.length === normDeps.length && existing.deps.every((d, i) => d === normDeps[i]))
-            return; // unchanged
-        graphVersion++;
+        const classification = classifyGraphUpsert(existing, hash, normDeps);
+        if (classification === 'unchanged')
+            return existing;
+        // Version bumps are only meaningful for live edits — serve-time graph
+        // warm-ups and the initial bulk walk should leave graphVersion stable.
+        const bumpVersion = shouldBumpGraphVersion(classification, options?.bumpVersion !== false);
+        if (bumpVersion) {
+            graphVersion++;
+        }
         const gm = { id, deps: normDeps, hash };
         graph.set(id, gm);
         if (verbose) {
-            try {
-                console.log('[hmr-ws][graph] upsert', { id, deps: normDeps, hash, graphVersion });
-                console.log('[hmr-ws][graph] size', graph.size);
-            }
-            catch { }
+            console.log('[hmr-ws][graph] upsert', { id, deps: normDeps, hash, graphVersion, classification, bumpVersion });
+            console.log('[hmr-ws][graph] size', graph.size);
+        }
+        if (shouldBroadcastGraphUpsertDelta(classification, options?.emitDeltaOnInsert === true, options?.broadcastDelta !== false)) {
+            emitDelta([gm], []);
         }
-        emitDelta([gm], []);
+        return gm;
     }
     function isTypescriptFlavor() {
         try {
@@ -2261,6 +2587,8 @@ function createHmrWebSocketPlugin(opts) {
     async function populateInitialGraph(server) {
         if (graph.size)
             return; // already populated
+        const tStart = Date.now();
+        const versionAtStart = graphVersion;
         const root = server.config.root || process.cwd();
         // Avoid direct require in ESM build: lazily obtain fs & path via createRequire or dynamic import
         let fs;
@@ -2276,21 +2604,33 @@ function createHmrWebSocketPlugin(opts) {
             fs = await import('fs');
             pathMod = await import('path');
         }
+        // Route every bulk transform through `sharedTransformRequest` when it's
+        // already been wired up — this way the background walk shares the 60s
+        // TTL cache with live /ns/m requests, so the device sees cached results
+        // for any file the walker already visited. The fallback keeps the
+        // walker working during server tests where the shared runner isn't
+        // constructed yet.
+        const bulkTransform = (rel) => {
+            if (sharedTransformRequest) {
+                return sharedTransformRequest(rel);
+            }
+            return server.transformRequest(rel);
+        };
         async function walk(dir) {
             for (const name of fs.readdirSync(dir)) {
-                const full = pathMod.join(dir, name);
-                if (name === 'node_modules' || name.startsWith('.'))
+                if (name === 'node_modules' || name.startsWith('.') || shouldSkipRuntimeGraphDirectoryName(name))
                     continue;
+                const full = pathMod.join(dir, name);
                 try {
                     const stat = fs.statSync(full);
                     if (stat.isDirectory())
                         await walk(full);
                     else if (stat.isFile()) {
-                        if (/\.(vue|ts|js|mjs|tsx|jsx)$/.test(name)) {
+                        if (shouldIncludeRuntimeGraphFile(full, /\.(vue|ts|js|mjs|tsx|jsx)$/i)) {
                             const rel = '/' + pathMod.relative(root, full).split(pathMod.sep).join('/');
                             // Transform via Vite to gather deps (ignore failures)
                             try {
-                                const transformed = await server.transformRequest(rel);
+                                const transformed = await bulkTransform(rel);
                                 const code = transformed?.code || '';
                                 const deps = [];
                                 // fallback to import relationships via moduleGraph
@@ -2301,7 +2641,10 @@ function createHmrWebSocketPlugin(opts) {
                                             deps.push(m.id.split('?')[0]);
                                     }
                                 }
-                                upsertGraphModule(rel, code, deps);
+                                // bumpVersion: false — the initial walk is a bulk load, not a live
+                                // edit. Keeping graphVersion stable during cold boot avoids double
+                                // cache-key drift.
+                                upsertGraphModule(rel, code, deps, { bumpVersion: false });
                             }
                             catch { }
                         }
@@ -2314,6 +2657,37 @@ function createHmrWebSocketPlugin(opts) {
             await walk(pathMod.join(root, 'src'));
         }
         catch { }
+        // Diagnostic summary. Gated behind the verbose flag so the
+        // dev console stays quiet on a normal save. Flip
+        // NS_VITE_VERBOSE=1 to surface slow cold-boot walks; a
+        // `bumpedVersion=no` result is the happy path, `yes`
+        // indicates a regression.
+        if (verbose) {
+            console.info(formatPopulateInitialGraphSummary({
+                moduleCount: graph.size,
+                durationMs: Date.now() - tStart,
+                graphVersion,
+                bumpedVersion: graphVersion !== versionAtStart,
+            }));
+        }
+    }
+    // Kick off `populateInitialGraph` in the background (non-awaited) so /ns/m
+    // responses are never blocked on a full tree walk. Returns the shared
+    // promise so hot-update code paths can await completion before computing
+    // delta roots for the first HMR event.
+    function ensureInitialGraphPopulationStarted(server) {
+        if (graphInitialPopulationPromise) {
+            return graphInitialPopulationPromise;
+        }
+        if (graph.size) {
+            graphInitialPopulationPromise = Promise.resolve();
+            return graphInitialPopulationPromise;
+        }
+        graphInitialPopulationPromise = populateInitialGraph(server).catch((error) => {
+            if (verbose)
+                console.warn('[hmr-ws][graph] background initial population failed', error);
+        });
+        return graphInitialPopulationPromise;
     }
     return {
         name: 'nativescript-hmr-websocket',
@@ -2323,6 +2697,163 @@ function createHmrWebSocketPlugin(opts) {
             const httpServer = server.httpServer;
             if (!httpServer)
                 return;
+            const wsAny = server.ws;
+            if (!wsAny.__NS_ANGULAR_FULL_RELOAD_FILTER_INSTALLED__) {
+                const originalSend = server.ws.send.bind(server.ws);
+                wsAny.__NS_ANGULAR_FULL_RELOAD_FILTER_INSTALLED__ = true;
+                server.ws.send = ((payload, ...rest) => {
+                    pruneAngularReloadSuppressions();
+                    if (shouldSuppressViteFullReloadPayload({
+                        payload,
+                        pendingEntries: pendingAngularReloadSuppressions.values(),
+                        root: pluginRoot,
+                    })) {
+                        if (verbose) {
+                            console.log('[hmr-ws][angular] suppressed vite full-reload payload', payload);
+                        }
+                        return;
+                    }
+                    return originalSend(payload, ...rest);
+                });
+            }
+            // Transform concurrency. Historically we defaulted to 1 to avoid
+            // race conditions during HTTP HMR startup, but the shared runner
+            // already has per-URL coalescing and an async-cached result map,
+            // so higher fan-out is safe and dramatically reduces cold-boot
+            // time. We cap at 8 by default to match typical dev machines and
+            // respect Vite's internal worker pool limits. Override via the
+            // `NS_VITE_HMR_TRANSFORM_CONCURRENCY` env var when needed.
+            const configuredTransformConcurrency = Number.parseInt(process.env.NS_VITE_HMR_TRANSFORM_CONCURRENCY || '', 10);
+            const transformConcurrency = Number.isFinite(configuredTransformConcurrency) && configuredTransformConcurrency > 0 ? configuredTransformConcurrency : 8;
+            // Keep transformed code cached for longer across HMR updates so
+            // that unchanged neighbours of an edited file don't re-run
+            // through the Angular/TypeScript/Vite transform pipeline. The
+            // HMR flow explicitly invalidates affected URLs, so a longer TTL
+            // is safe. Override with `NS_VITE_HMR_TRANSFORM_CACHE_MS`.
+            const configuredTransformCacheMs = Number.parseInt(process.env.NS_VITE_HMR_TRANSFORM_CACHE_MS || '', 10);
+            const transformCacheMs = Number.isFinite(configuredTransformCacheMs) && configuredTransformCacheMs >= 0 ? configuredTransformCacheMs : 60000;
+            sharedTransformRequest = createSharedTransformRequestRunner((url) => server.transformRequest(url), (url, timeoutMs) => {
+                console.warn('[ns:m] slow transformRequest for', url, '(>' + timeoutMs + 'ms)');
+            }, {
+                maxConcurrent: transformConcurrency,
+                resultCacheTtlMs: transformCacheMs,
+                getResultCacheKey: (url) => canonicalizeTransformRequestCacheKey(url, pluginRoot || process.cwd()),
+            });
+            // Always-on startup banner — prints once per dev server process
+            // so anyone investigating perf can immediately see which build
+            // is live and what knobs are active.
+            try {
+                let pkgVersion = 'unknown';
+                try {
+                    const req = createRequire(import.meta.url);
+                    const pkg = req('@nativescript/vite/package.json');
+                    if (pkg && typeof pkg.version === 'string')
+                        pkgVersion = pkg.version;
+                }
+                catch {
+                    // `@nativescript/vite/package.json` is not always exported; fall
+                    // back to reading the file from disk next to this module.
+                    try {
+                        const here = new URL(import.meta.url).pathname;
+                        const pkgPath = path.resolve(path.dirname(here), '..', '..', 'package.json');
+                        if (existsSync(pkgPath)) {
+                            const parsed = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+                            if (parsed && typeof parsed.version === 'string')
+                                pkgVersion = parsed.version;
+                        }
+                    }
+                    catch { }
+                }
+                if (verbose) {
+                    console.info(formatServerStartupBanner({
+                        version: pkgVersion,
+                        transformConcurrency,
+                        transformCacheMs,
+                        lazyInitialGraph: true,
+                        graphVersion,
+                    }));
+                }
+            }
+            catch { }
+            // Always-on cold-boot request trace. Runs in front of every
+            // other middleware so it catches all NS dev routes (/ns/m/*,
+            // /ns/rt/*, /ns/core/*, /__ns_boot__/*, etc.) with a single
+            // hook. Closes itself after an idle window so HMR edits don't
+            // get rolled into the cold-boot numbers. The idle window is
+            // generous by default (5s) because V8's HTTP ESM resolver
+            // pauses between dep levels while parsing — a too-tight window
+            // was closing after the first wave and under-reporting boot by
+            // 100x. Override via `NS_VITE_HMR_BOOT_TRACE_IDLE_MS` when
+            // profiling something tricky.
+            try {
+                const configuredIdleMs = Number.parseInt(process.env.NS_VITE_HMR_BOOT_TRACE_IDLE_MS || '', 10);
+                const idleWindowMs = Number.isFinite(configuredIdleMs) && configuredIdleMs > 0 ? configuredIdleMs : 5000;
+                const configuredSummaryEvery = Number.parseInt(process.env.NS_VITE_HMR_BOOT_TRACE_PROGRESS_EVERY || '', 10);
+                const summaryEvery = Number.isFinite(configuredSummaryEvery) && configuredSummaryEvery >= 0 ? configuredSummaryEvery : 25;
+                if (!coldBootCounter) {
+                    coldBootCounter = createColdBootRequestCounter({
+                        summaryEvery,
+                        idleWindowMs,
+                        // Gated on the verbose flag so cold-boot progress and
+                        // the final window-closed summary stay quiet by
+                        // default. Flip NS_VITE_VERBOSE=1 to surface them.
+                        log: (line) => {
+                            if (!verbose)
+                                return;
+                            console.info(line);
+                        },
+                    });
+                }
+            }
+            catch { }
+            server.middlewares.use((req, res, next) => {
+                try {
+                    const urlObj = new URL(req.url || '', 'http://localhost');
+                    const route = classifyBootRoute(urlObj.pathname);
+                    if (route === 'other')
+                        return next();
+                    if (!coldBootCounter)
+                        return next();
+                    const handle = coldBootCounter.record(urlObj.pathname);
+                    const finishOnce = () => {
+                        try {
+                            handle.finish();
+                        }
+                        catch { }
+                    };
+                    try {
+                        res.once('finish', finishOnce);
+                        res.once('close', finishOnce);
+                    }
+                    catch { }
+                }
+                catch { }
+                next();
+            });
+            // Give `populateInitialGraph` a head start. Previously this only
+            // kicked off on the first /ns/m hit, which meant populate was
+            // competing with the device for the same 8 transform slots
+            // throughout the first 4-5 seconds of cold boot. Starting at
+            // `configureServer` time gives populate the full app
+            // build/launch window (typically 2-3s on simulator) as a head
+            // start, so more of its work lands before the device even
+            // connects. Disable via `NS_VITE_HMR_DISABLE_POPULATE=1` when
+            // profiling whether populate is helping or hurting a specific
+            // app.
+            try {
+                const disablePopulate = process.env.NS_VITE_HMR_DISABLE_POPULATE === '1' || process.env.NS_VITE_HMR_DISABLE_POPULATE === 'true';
+                if (disablePopulate) {
+                    if (verbose)
+                        console.info('[hmr-ws][populate] disabled via NS_VITE_HMR_DISABLE_POPULATE');
+                    // Short-circuit: mark as resolved so /ns/m never schedules it and
+                    // HMR still works (handleHotUpdate just has no pre-warmed graph).
+                    graphInitialPopulationPromise = Promise.resolve();
+                }
+                else {
+                    ensureInitialGraphPopulationStarted(server);
+                }
+            }
+            catch { }
             // Attempt early vendor manifest bootstrap once per server.
             if (!vendorBootstrapDone) {
                 vendorBootstrapDone = true;
@@ -2366,20 +2897,63 @@ function createHmrWebSocketPlugin(opts) {
             });
             // Additional connection diagnostics
             wss.on('connection', (ws, req) => {
+                const role = getHmrSocketRoleFromRequestUrl(req.url);
+                ws.__nsHmrClientRole = role;
                 try {
                     if (verbose) {
                         const ra = req.socket?.remoteAddress;
                         const rp = req.socket?.remotePort;
-                        console.log('[hmr-ws] Client connected', ra + (rp ? ':' + rp : ''));
+                        console.log('[hmr-ws] Client connected', { role, remote: ra + (rp ? ':' + rp : '') });
                     }
                 }
                 catch { }
+                ws.on('close', () => {
+                    try {
+                        if (verbose) {
+                            const ra = req.socket?.remoteAddress;
+                            const rp = req.socket?.remotePort;
+                            console.log('[hmr-ws] Client disconnected', { role, remote: ra + (rp ? ':' + rp : '') });
+                        }
+                    }
+                    catch { }
+                });
             });
             wss.on('error', (err) => {
+                console.warn('[hmr-ws] server error:', err?.message || String(err));
+            });
+            // Import map endpoint: GET /ns/import-map.json
+            // Returns the import map + runtime config for __nsConfigureRuntime()
+            server.middlewares.use(async (req, res, next) => {
                 try {
-                    console.warn('[hmr-ws] server error:', err?.message || String(err));
+                    const urlObj = new URL(req.url || '', 'http://localhost');
+                    if (urlObj.pathname !== '/ns/import-map.json')
+                        return next();
+                    res.setHeader('Access-Control-Allow-Origin', '*');
+                    res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
+                    if (req.method === 'OPTIONS') {
+                        res.statusCode = 204;
+                        res.end();
+                        return;
+                    }
+                    // Determine origin from request headers or server config
+                    const host = req.headers.host || 'localhost:5173';
+                    const protocol = 'http';
+                    const origin = `${protocol}://${host}`;
+                    const runtimeConfig = buildRuntimeConfig({
+                        origin,
+                        flavor: ACTIVE_STRATEGY?.flavor || 'typescript',
+                    });
+                    res.setHeader('Content-Type', 'application/json');
+                    res.end(JSON.stringify({
+                        importMap: JSON.parse(runtimeConfig.importMap),
+                        volatilePatterns: runtimeConfig.volatilePatterns,
+                    }, null, 2));
+                }
+                catch (err) {
+                    console.error('[import-map] error generating import map:', err?.message || err);
+                    res.statusCode = 500;
+                    res.end(JSON.stringify({ error: 'Failed to generate import map' }));
                 }
-                catch { }
             });
             // Dev-only HTTP ESM loader endpoint for device clients
             // 1) Legacy JSON module endpoint (kept temporarily): GET /ns-module?path=/abs -> { path, code, additionalFiles }
@@ -2415,13 +2989,16 @@ function createHmrWebSocketPlugin(opts) {
                     // Transform via Vite with variant resolution (same as ws ns:fetch-module)
                     const hasExt = /\.(ts|tsx|js|jsx|mjs|mts|cts|vue)$/i.test(spec);
                     const baseNoExt = hasExt ? spec.replace(/\.(ts|tsx|js|jsx|mjs|mts|cts)$/i, '') : spec;
+                    const transformRoot = server.config?.root || process.cwd();
+                    const transformWorkspaceRoot = getMonorepoWorkspaceRoot(transformRoot);
                     const candidates = [];
                     if (hasExt)
                         candidates.push(spec);
                     candidates.push(baseNoExt + '.ts', baseNoExt + '.js', baseNoExt + '.tsx', baseNoExt + '.jsx', baseNoExt + '.mjs', baseNoExt + '.mts', baseNoExt + '.cts', baseNoExt + '.vue', baseNoExt + '/index.ts', baseNoExt + '/index.js', baseNoExt + '/index.tsx', baseNoExt + '/index.jsx', baseNoExt + '/index.mjs');
+                    const transformCandidates = filterExistingNodeModulesTransformCandidates(spec, candidates, transformRoot, transformWorkspaceRoot);
                     let transformed = null;
                     let resolvedCandidate = null;
-                    for (const cand of candidates) {
+                    for (const cand of transformCandidates) {
                         try {
                             const r = await server.transformRequest(cand);
                             if (r?.code) {
@@ -2443,7 +3020,10 @@ function createHmrWebSocketPlugin(opts) {
                     code = REQUIRE_GUARD_SNIPPET + code;
                     // Apply same sanitation/rewrite pipeline used for WS path
                     code = cleanCode(code);
-                    code = processCodeForDevice(code, false);
+                    // preserveVendorImports=true: vendor imports stay as bare specifiers
+                    // for the device-side import map (ns-vendor://) instead of being
+                    // transformed to __nsVendorRequire calls with fragile __nsPick lookups.
+                    code = processCodeForDevice(code, false, true, /(?:^|\/)node_modules\//.test(resolvedCandidate || spec), resolvedCandidate || spec);
                     code = rewriteImports(code, spec, sfcFileMap, depFileMap, server.config?.root || process.cwd(), !!verbose, undefined, getServerOrigin(server));
                     code = ensureVariableDynamicImportHelper(code);
                     // Enforce upstream guarantee: no optimized deps or virtual ids remain
@@ -2455,18 +3035,6 @@ function createHmrWebSocketPlugin(opts) {
                         res.setHeader('Content-Type', 'application/json');
                         return void res.end(JSON.stringify({ error: e?.message || String(e) }));
                     }
-                    // Optional diagnostics: when ?diag=1, inject simple entry/exit logs to help isolate
-                    // execution-time failures on device without changing semantics.
-                    try {
-                        const wantDiag = urlObj.searchParams.get('diag') === '1';
-                        if (wantDiag) {
-                            const importerPath = spec.replace(/[?#].*$/, '');
-                            const enter = `try { console.log('[sfc][enter]', ${JSON.stringify(importerPath)}, 'hasReq=', (typeof globalThis.__nsRequire==='function'||typeof globalThis.require==='function')); } catch {}`;
-                            const exit = `\n;try { console.log('[sfc][loaded]', ${JSON.stringify(importerPath)}); } catch {}`;
-                            code = `${enter}\n${code}${exit}`;
-                        }
-                    }
-                    catch { }
                     try {
                         const origin = getServerOrigin(server);
                         code = ensureVersionedRtImports(code, origin, graphVersion);
@@ -2499,7 +3067,7 @@ function createHmrWebSocketPlugin(opts) {
                             if (seen.has(depBase))
                                 continue;
                             seen.add(depBase);
-                            const depCandidates = [depBase + '.ts', depBase + '.js', depBase + '.tsx', depBase + '.jsx', depBase + '.mjs', depBase + '.mts', depBase + '.cts', depBase + '.vue', depBase + '/index.ts', depBase + '/index.js', depBase + '/index.tsx', depBase + '/index.jsx', depBase + '/index.mjs'];
+                            const depCandidates = filterExistingNodeModulesTransformCandidates(depBase, [depBase + '.ts', depBase + '.js', depBase + '.tsx', depBase + '.jsx', depBase + '.mjs', depBase + '.mts', depBase + '.cts', depBase + '.vue', depBase + '/index.ts', depBase + '/index.js', depBase + '/index.tsx', depBase + '/index.jsx', depBase + '/index.mjs'], transformRoot, transformWorkspaceRoot);
                             let depTrans = null;
                             let depResolved = null;
                             for (const c of depCandidates) {
@@ -2516,7 +3084,7 @@ function createHmrWebSocketPlugin(opts) {
                             if (depTrans?.code && depResolved) {
                                 let depCode = depTrans.code;
                                 depCode = cleanCode(depCode);
-                                depCode = processCodeForDevice(depCode, false);
+                                depCode = processCodeForDevice(depCode, false, true, /(?:^|\/)node_modules\//.test(depResolved), depResolved);
                                 depCode = rewriteImports(depCode, depResolved, sfcFileMap, depFileMap, server.config?.root || process.cwd(), !!verbose, undefined, getServerOrigin(server));
                                 depCode = ensureVariableDynamicImportHelper(depCode);
                                 try {
@@ -2558,6 +3126,23 @@ function createHmrWebSocketPlugin(opts) {
                     const urlObj = new URL(req.url || '', 'http://localhost');
                     if (!urlObj.pathname.startsWith('/ns/m'))
                         return next();
+                    // Previously we awaited `populateInitialGraph(server)` here so
+                    // graphVersion would be non-zero for the first /ns/m request.
+                    // That gave deterministic URL tags but blocked the cold boot on a
+                    // full src/ tree walk (hundreds of transformRequest calls, 3-6s).
+                    //
+                    // graphVersion now starts at 1 and stays stable during cold boot
+                    // (see `upsertGraphModule`'s bumpVersion option and the inline
+                    // comment at the graphVersion declaration). We kick off the
+                    // initial population in the background so it doesn't block the
+                    // first response. `handleHotUpdate` awaits the same promise so
+                    // the first HMR event still sees a fully populated graph.
+                    ensureInitialGraphPopulationStarted(server);
+                    // Cold-boot counter is now hooked via the leading boot-trace
+                    // middleware (see `configureServer` — it records the request
+                    // and tracks finish() via res.on('close'/'finish')). This
+                    // handler used to record here but that missed the
+                    // round-trip timing and didn't track per-route breakdowns.
                     res.setHeader('Access-Control-Allow-Origin', '*');
                     res.setHeader('Content-Type', 'application/javascript; charset=utf-8');
                     // Disable caching for dev ESM endpoints to avoid device-side stale module reuse
@@ -2567,7 +3152,8 @@ function createHmrWebSocketPlugin(opts) {
                     // Support both query (?path=/abs) and path-style (/ns/m/abs)
                     let spec = urlObj.searchParams.get('path') || '';
                     // Optional graph version pin for deterministic boot
-                    const forcedVer = urlObj.searchParams.get('v');
+                    let forcedVer = urlObj.searchParams.get('v');
+                    let bootTaggedRequest = false;
                     if (!spec) {
                         const base = '/ns/m';
                         let rest = urlObj.pathname.slice(base.length);
@@ -2585,22 +3171,26 @@ function createHmrWebSocketPlugin(opts) {
                         res.end('export {}\n');
                         return;
                     }
+                    const serverRoot = (server.config?.root || process.cwd());
+                    const monorepoWorkspaceRoot = getMonorepoWorkspaceRoot(serverRoot);
                     spec = spec.replace(/[?#].*$/, '');
-                    // Accept path-based HMR cache-busting: /ns/m/__ns_hmr__/<tag>/<real-spec>
+                    // Accept path-based boot/HMR prefixes:
+                    //   /ns/m/__ns_boot__/b1/<real-spec>
+                    //   /ns/m/__ns_hmr__/<tag>/<real-spec>
+                    //   /ns/m/__ns_boot__/b1/__ns_hmr__/<tag>/<real-spec>
                     // The iOS HTTP ESM loader canonicalizes cache keys by stripping query params,
                     // so we must carry the cache-buster in the path.
                     try {
-                        const m = spec.match(/^\/?__ns_hmr__\/[^\/]+(\/.*)?$/);
-                        if (m) {
-                            spec = m[1] || '/';
-                        }
+                        const decorated = stripDecoratedServePrefixes(spec);
+                        spec = decorated.cleanedSpec;
+                        bootTaggedRequest = decorated.bootTaggedRequest;
+                        forcedVer || (forcedVer = decorated.forcedVer);
                     }
                     catch { }
                     // Normalize absolute filesystem paths back to project-relative ids (e.g. /src/app.ts)
                     try {
-                        const projectRoot = (server.config?.root || process.cwd());
                         const toPosix = (p) => p.replace(/\\/g, '/');
-                        const rootPosix = toPosix(projectRoot);
+                        const rootPosix = toPosix(serverRoot);
                         const specPosix = toPosix(spec);
                         // If spec is an absolute path under the project root, convert to '/'+relative
                         const isAbsFs = /^\//.test(specPosix) || /^[A-Za-z]:\//.test(spec); // posix or win drive
@@ -2615,27 +3205,78 @@ function createHmrWebSocketPlugin(opts) {
                         }
                     }
                     catch { }
+                    // Serve Vite virtual modules (/@id/ prefix). These are internal
+                    // virtual modules (e.g., \0nsvite:nsconfig-json for ~/package.json)
+                    // that don't exist on disk. Decode the ID and load via plugin container.
+                    if (spec.startsWith('/@id/')) {
+                        try {
+                            // First try Vite's transform pipeline directly
+                            const vr = await sharedTransformRequest(spec);
+                            if (vr?.code) {
+                                res.statusCode = 200;
+                                res.end(vr.code);
+                                return;
+                            }
+                        }
+                        catch { }
+                        try {
+                            // Fallback: decode the virtual module ID (__x00__ → \0) and
+                            // load through the plugin container directly
+                            const rawId = spec.slice('/@id/'.length).replace(/__x00__/g, '\0');
+                            const loadResult = await server.pluginContainer.load(rawId);
+                            if (loadResult) {
+                                const code = typeof loadResult === 'string' ? loadResult : loadResult.code;
+                                if (code) {
+                                    res.statusCode = 200;
+                                    res.end(code);
+                                    return;
+                                }
+                            }
+                        }
+                        catch { }
+                    }
                     if (spec.startsWith('@/'))
                         spec = APP_VIRTUAL_WITH_SLASH + spec.slice(2);
                     if (spec.startsWith('./'))
                         spec = spec.slice(1);
+                    const blockedNodeModulesReason = getBlockedDeviceNodeModulesReason(spec);
+                    if (blockedNodeModulesReason) {
+                        res.statusCode = 404;
+                        res.end(`// [ns:m] blocked device import\nthrow new Error(${JSON.stringify(`[ns/m] ${blockedNodeModulesReason}`)});\nexport {};\n`);
+                        return;
+                    }
                     if (!spec.startsWith('/'))
                         spec = '/' + spec;
                     const hasExt = /\.(ts|tsx|js|jsx|mjs|mts|cts|vue)$/i.test(spec);
                     const baseNoExt = hasExt ? spec.replace(/\.(ts|tsx|js|jsx|mjs|mts|cts)$/i, '') : spec;
                     const candidates = [...(hasExt ? [spec] : []), baseNoExt + '.ts', baseNoExt + '.js', baseNoExt + '.tsx', baseNoExt + '.jsx', baseNoExt + '.mjs', baseNoExt + '.mts', baseNoExt + '.cts', baseNoExt + '.vue', baseNoExt + '/index.ts', baseNoExt + '/index.js', baseNoExt + '/index.tsx', baseNoExt + '/index.jsx', baseNoExt + '/index.mjs'];
+                    const transformCandidates = filterExistingNodeModulesTransformCandidates(spec, candidates, serverRoot, monorepoWorkspaceRoot);
                     let transformed = null;
                     let resolvedCandidate = null;
-                    for (const cand of candidates) {
-                        try {
-                            const r = await server.transformRequest(cand);
-                            if (r?.code) {
-                                transformed = r;
-                                resolvedCandidate = cand;
-                                break;
+                    const rawExplicitModule = tryReadRawExplicitJavaScriptModule(spec, serverRoot);
+                    if (rawExplicitModule) {
+                        transformed = { code: rawExplicitModule.code };
+                        resolvedCandidate = rawExplicitModule.resolvedId;
+                    }
+                    // Queue and dedupe transformRequest calls so heavy app graphs do not
+                    // overwhelm Vite with concurrent work. Slow-transform warnings start only
+                    // when the transform actually begins executing, and requests stay pending
+                    // until Vite returns a real result.
+                    const transformWithTimeout = (url, timeoutMs = 120000) => {
+                        return sharedTransformRequest(url, timeoutMs);
+                    };
+                    if (!transformed?.code) {
+                        for (const cand of transformCandidates) {
+                            try {
+                                const r = await transformWithTimeout(cand);
+                                if (r?.code) {
+                                    transformed = r;
+                                    resolvedCandidate = cand;
+                                    break;
+                                }
                             }
+                            catch { }
                         }
-                        catch { }
                     }
                     // Fallback 1: ask Vite to resolve the id, then transform the resolved id (handles aliases and virtual ids)
                     if (!transformed?.code) {
@@ -2643,7 +3284,7 @@ function createHmrWebSocketPlugin(opts) {
                             const rid = await server.pluginContainer?.resolveId?.(spec, undefined);
                             const ridStr = typeof rid === 'string' ? rid : rid?.id || null;
                             if (ridStr) {
-                                const r = await server.transformRequest(ridStr);
+                                const r = await transformWithTimeout(ridStr);
                                 if (r?.code) {
                                     transformed = r;
                                     resolvedCandidate = ridStr;
@@ -2652,27 +3293,55 @@ function createHmrWebSocketPlugin(opts) {
                         }
                         catch { }
                     }
-                    // Fallback 2: try /@fs absolute path under project root (Vite file system alias)
+                    // Fallback 1b: if spec is a /node_modules/ path, extract bare specifier
+                    // and try resolveId with that. This handles package.json "exports" field
+                    // resolution (e.g., solid-js/jsx-runtime → solid-js/dist/solid.js).
+                    if (!transformed?.code && spec.includes('/node_modules/')) {
+                        try {
+                            const nmIdx = spec.lastIndexOf('/node_modules/');
+                            const bare = spec.slice(nmIdx + '/node_modules/'.length);
+                            if (bare && !bare.startsWith('.')) {
+                                const rid = await server.pluginContainer?.resolveId?.(bare, undefined);
+                                const ridStr = typeof rid === 'string' ? rid : rid?.id || null;
+                                if (ridStr) {
+                                    const r = await sharedTransformRequest(ridStr);
+                                    if (r?.code) {
+                                        transformed = r;
+                                        resolvedCandidate = ridStr;
+                                    }
+                                }
+                            }
+                        }
+                        catch { }
+                    }
+                    // Fallback 2: try /@fs absolute path under project root (Vite file system alias).
+                    // In a monorepo with hoisted node_modules the file may live above
+                    // `serverRoot`, so try the workspace root next.
                     if (!transformed?.code) {
                         try {
-                            const projectRoot = (server.config?.root || process.cwd());
                             const toPosix = (p) => p.replace(/\\/g, '/');
-                            const rootPosix = toPosix(projectRoot).replace(/\/$/, '');
-                            const absPosix = `${rootPosix}${spec.startsWith('/') ? '' : '/'}${spec}`;
-                            const fsId = `/@fs${absPosix}`;
-                            const r = await server.transformRequest(fsId);
-                            if (r?.code) {
-                                transformed = r;
-                                resolvedCandidate = fsId;
+                            const rootsToTry = [serverRoot, ...(monorepoWorkspaceRoot && path.resolve(monorepoWorkspaceRoot) !== path.resolve(serverRoot) ? [monorepoWorkspaceRoot] : [])];
+                            for (const root of rootsToTry) {
+                                const rootPosix = toPosix(root).replace(/\/$/, '');
+                                const absPosix = `${rootPosix}${spec.startsWith('/') ? '' : '/'}${spec}`;
+                                const fsId = `/@fs${absPosix}`;
+                                if (resolveCandidateFilePath(fsId, serverRoot, monorepoWorkspaceRoot)) {
+                                    const r = await transformWithTimeout(fsId);
+                                    if (r?.code) {
+                                        transformed = r;
+                                        resolvedCandidate = fsId;
+                                        break;
+                                    }
+                                }
                             }
                         }
                         catch { }
                     }
                     // Fallback 3: try adding ?import to hint Vite's transform pipeline
                     if (!transformed?.code) {
-                        for (const cand of candidates) {
+                        for (const cand of transformCandidates) {
                             try {
-                                const r = await server.transformRequest(`${cand}${cand.includes('?') ? '&' : '?'}import`);
+                                const r = await transformWithTimeout(`${cand}${cand.includes('?') ? '&' : '?'}import`);
                                 if (r?.code) {
                                     transformed = r;
                                     resolvedCandidate = `${cand}?import`;
@@ -2682,39 +3351,80 @@ function createHmrWebSocketPlugin(opts) {
                             catch { }
                         }
                     }
-                    // Post-transform: inject cache-busting version for all internal /ns/m/* imports to avoid stale module reuse on device.
-                    // IMPORTANT: use PATH-based busting (not query) because the iOS HTTP ESM loader strips query params
-                    // when computing module cache keys.
+                    // Solid HMR: patch @@solid-refresh's $$refreshESM to do inline patching
+                    // during module re-evaluation instead of deferring to hot.accept() callback.
+                    // In NativeScript's HTTP ESM environment, accept callbacks are registered
+                    // but not invoked by the HMR client. By adding a direct patchRegistry()
+                    // call when hot.data already has a stored registry, component updates
+                    // apply immediately when the module re-evaluates.
                     try {
-                        if (transformed?.code) {
-                            const ver = Number(global.graphVersion || graphVersion || 0);
-                            let code = transformed.code;
-                            const prefix = `/ns/m/__ns_hmr__/v${ver}`;
-                            const rewrite = (p) => {
-                                try {
-                                    if (!p || typeof p !== 'string')
-                                        return p;
-                                    if (!p.startsWith('/ns/m/'))
-                                        return p;
-                                    if (p.startsWith('/ns/m/__ns_hmr__/'))
-                                        return p;
-                                    return prefix + p.slice('/ns/m'.length);
+                        if (transformed?.code && ACTIVE_STRATEGY?.flavor === 'solid' && (resolvedCandidate || spec || '').includes('@solid-refresh')) {
+                            const PATCH_SENTINEL = '/* __ns_solid_refresh_patched__ */';
+                            const alreadyPatched = transformed.code.includes(PATCH_SENTINEL);
+                            if (verbose) {
+                                console.log('[hmr-ws][solid] @solid-refresh patch check:', { spec: resolvedCandidate || spec, alreadyPatched, codeLen: transformed.code.length });
+                            }
+                            if (!alreadyPatched) {
+                                let patchedCode = transformed.code;
+                                // Patch 1: Bypass shouldWarnAndDecline() — the vendor-bundled solid-js
+                                // may not have the 'development' condition active, making DEV empty/undefined.
+                                // In NativeScript HMR mode we are always in dev, so force it to return false.
+                                const declineCheck = 'function shouldWarnAndDecline() {';
+                                if (patchedCode.includes(declineCheck)) {
+                                    patchedCode = patchedCode.replace(declineCheck, `${PATCH_SENTINEL}\nfunction shouldWarnAndDecline() { return false; /* NS HMR: always allow refresh */ }\nfunction __original_shouldWarnAndDecline() {`);
+                                    if (verbose) {
+                                        console.log('[hmr-ws][solid] bypassed shouldWarnAndDecline() for NativeScript HMR');
+                                    }
                                 }
-                                catch {
-                                    return p;
+                                // Patch 2: Force createMemo path in createProxy.
+                                // Without the 'development' condition, $DEVCOMP is not set on components,
+                                // so createProxy falls through to `return s(props)` — a direct call with
+                                // no reactive subscription. When patchComponent fires update() (the signal
+                                // setter), nobody is listening. By forcing the createMemo path, HMRComp
+                                // subscribes to the signal and re-renders when the component changes.
+                                const proxyCondition = 'if (!s || $DEVCOMP in s) {';
+                                if (patchedCode.includes(proxyCondition)) {
+                                    patchedCode = patchedCode.replace(proxyCondition, 'if (true) { /* NS HMR: always use createMemo for reactive HMR updates */');
+                                    if (verbose) {
+                                        console.log('[hmr-ws][solid] forced createMemo path in createProxy for NativeScript HMR');
+                                    }
+                                }
+                                // Patch 3: Inline patchRegistry call so updates apply immediately
+                                // on module re-evaluation (accept callbacks are not invoked by the HMR client).
+                                // The injected `console.log` helpers run inside the user's runtime
+                                // when @solid-refresh re-evaluates a module, so they are a runtime
+                                // concern (stripped if the user disables the patch). Keeping them
+                                // behind the patch sentinel rather than the dev-server `verbose`
+                                // flag is intentional — the patch only runs when Solid HMR fires.
+                                const marker = 'hot.data[SOLID_REFRESH] = hot.data[SOLID_REFRESH] || registry;';
+                                if (patchedCode.includes(marker)) {
+                                    const patchCode = [
+                                        `console.log('[solid-refresh][$$refreshESM] hot.data keys=', hot.data ? Object.keys(hot.data) : 'no-data', 'has=', !!(hot.data && hot.data[SOLID_REFRESH]));`,
+                                        `if (hot.data[SOLID_REFRESH]) {`,
+                                        `  console.log('[solid-refresh][$$refreshESM] patching: oldComponents=', hot.data[SOLID_REFRESH].components ? hot.data[SOLID_REFRESH].components.size : 0, 'newComponents=', registry.components ? registry.components.size : 0);`,
+                                        `  var _shouldInvalidate = patchRegistry(hot.data[SOLID_REFRESH], registry);`,
+                                        `  console.log('[solid-refresh][$$refreshESM] patchRegistry result: shouldInvalidate=', _shouldInvalidate);`,
+                                        `} else {`,
+                                        `  console.log('[solid-refresh][$$refreshESM] first load — creating registry, components=', registry.components ? registry.components.size : 0);`,
+                                        `}`,
+                                    ].join('\n    ');
+                                    patchedCode = patchedCode.replace(marker, `${patchCode}\n    ${marker}`);
+                                    if (verbose) {
+                                        console.log('[hmr-ws][solid] added inline patchRegistry for NativeScript HMR');
+                                    }
                                 }
-                            };
-                            // 1) Static imports: import ... from "/ns/m/..."
-                            code = code.replace(/(from\s*["'])(\/ns\/m\/[^"'?]+)(["'])/g, (_m, a, p, b) => `${a}${rewrite(p)}${b}`);
-                            // 2) Side-effect imports: import "/ns/m/..."
-                            code = code.replace(/(import\s*(?!\()\s*["'])(\/ns\/m\/[^"'?]+)(["'])/g, (_m, a, p, b) => `${a}${rewrite(p)}${b}`);
-                            // 3) Dynamic imports: import("/ns/m/...")
-                            code = code.replace(/(import\(\s*["'])(\/ns\/m\/[^"'?]+)(["']\s*\))/g, (_m, a, p, b) => `${a}${rewrite(p)}${b}`);
-                            // 4) new URL("/ns/m/...", import.meta.url)
-                            code = code.replace(/(new\s+URL\(\s*["'])(\/ns\/m\/[^"'?]+)(["']\s*,\s*import\.meta\.url\s*\))/g, (_m, a, p, b) => `${a}${rewrite(p)}${b}`);
-                            // 5) __ns_import(new URL('/ns/m/...', import.meta.url).href)
-                            code = code.replace(/(new\s+URL\(\s*["'])(\/ns\/m\/[^"'?]+)(["']\s*,\s*import\.meta\.url\s*\)\.href)/g, (_m, a, p, b) => `${a}${rewrite(p)}${b}`);
-                            transformed.code = code;
+                                // Work on a copy to avoid mutating Vite's cached TransformResult
+                                transformed = { ...transformed, code: patchedCode };
+                            }
+                        }
+                    }
+                    catch { }
+                    // NOTE: Path-based cache busting for /ns/m/* imports is applied in the
+                    // finalize step below (after rewriteImports adds the /ns/m/ prefix).
+                    // The block here only handles TypeScript-specific graph population.
+                    try {
+                        if (transformed?.code) {
+                            const code = transformed.code;
                             // TypeScript-specific graph population: when TS flavor is active
                             // and this is an application module under the virtual app root,
                             // upsert it into the HMR graph so ns:hmr-full-graph is non-empty.
@@ -2723,15 +3433,14 @@ function createHmrWebSocketPlugin(opts) {
                                     const id = (resolvedCandidate || spec).replace(/[?#].*$/, '');
                                     // Only track app modules (under APP_VIRTUAL_WITH_SLASH) and ts/js/tsx/jsx/mjs.
                                     const isApp = id.startsWith(APP_VIRTUAL_WITH_SLASH) || id.startsWith('/app/');
-                                    if (isApp && /\.(ts|tsx|js|jsx|mjs|mts|cts)$/i.test(id)) {
+                                    if (isApp && /\.(ts|tsx|js|jsx|mjs|mts|cts)$/i.test(id) && !isRuntimeGraphExcludedPath(id)) {
                                         const deps = Array.from(collectImportDependencies(code, id));
                                         if (verbose) {
-                                            try {
-                                                console.log('[hmr-ws][ts-graph] candidate', { id, depsCount: deps.length });
-                                            }
-                                            catch { }
+                                            console.log('[hmr-ws][ts-graph] candidate', { id, depsCount: deps.length });
                                         }
-                                        upsertGraphModule(id, code, deps);
+                                        // Serve-time warm-up: no live edit happened, so don't bump
+                                        // graphVersion.
+                                        upsertGraphModule(id, code, deps, { bumpVersion: false });
                                     }
                                 }
                             }
@@ -2843,7 +3552,7 @@ export const piniaSymbol = p.piniaSymbol;
                         if (!transformed?.code) {
                             // Emit a module that throws with context for easier on-device debugging
                             try {
-                                const tried = Array.from(new Set(candidates)).slice(0, 12);
+                                const tried = Array.from(new Set(transformCandidates.length > 0 ? transformCandidates : candidates)).slice(0, 12);
                                 const out = `// [ns:m] transform miss path=${spec} tried=${tried.length}\n` + `throw new Error(${JSON.stringify(`[ns/m] transform failed for ${spec} (tried ${tried.length} candidates).`)});\nexport {};\n`;
                                 res.statusCode = 404;
                                 res.end(out);
@@ -2860,8 +3569,33 @@ export const piniaSymbol = p.piniaSymbol;
                     // Prepend guard to capture any URL-based require attempts
                     code = REQUIRE_GUARD_SNIPPET + code;
                     code = cleanCode(code);
-                    code = processCodeForDevice(code, false);
-                    code = rewriteImports(code, resolvedCandidate || spec, sfcFileMap, depFileMap, server.config?.root || process.cwd(), !!verbose, undefined, getServerOrigin(server));
+                    const isNodeMod = /(?:^|\/)node_modules\//.test(resolvedCandidate || spec || '');
+                    code = processCodeForDevice(code, false, true, isNodeMod, resolvedCandidate || spec);
+                    // Solid HMR: The NativeScript iOS/Android runtime provides import.meta.hot
+                    // natively (via InitializeImportMetaHot in HMRSupport.mm) with C++-backed
+                    // persistent hot.data that survives across module re-evaluations.
+                    // cleanCode() strips Vite's __vite__createHotContext assignment, which is
+                    // correct — the runtime's native hot context is better.
+                    const projectRoot = server.config?.root || process.cwd();
+                    const serverOrigin = getServerOrigin(server);
+                    if (ACTIVE_STRATEGY?.flavor === 'angular') {
+                        code = prepareAngularEntryForDevice(code, resolvedCandidate || spec, sfcFileMap, depFileMap, projectRoot, !!verbose, undefined, serverOrigin, true);
+                    }
+                    else {
+                        code = rewriteImports(code, resolvedCandidate || spec, sfcFileMap, depFileMap, projectRoot, !!verbose, undefined, serverOrigin, true);
+                    }
+                    // Expand `export * from "url"` into explicit named re-exports.
+                    // NativeScript's HTTP ESM loader may not propagate star-re-exports across
+                    // HTTP module boundaries (the namespace object gets direct exports but
+                    // misses re-exported names). By expanding to `export { a, b } from "url"`,
+                    // the engine sees explicit named exports and resolves them correctly.
+                    try {
+                        code = await expandStarExports(code, server, server.config?.root || process.cwd(), verbose, sharedTransformRequest);
+                    }
+                    catch (e) {
+                        if (verbose)
+                            console.warn('[ns/m] export* expansion failed:', e?.message);
+                    }
                     // Dedupe any /ns/rt named imports that duplicate destructured bindings off default /ns/rt
                     try {
                         code = dedupeRtNamedImportsAgainstDestructures(code);
@@ -2888,6 +3622,28 @@ export const piniaSymbol = p.piniaSymbol;
                         }
                     }
                     catch { }
+                    // Final pass: deduplicate/resolve any bare-specifier imports that slipped
+                    // through the pipeline (e.g., extracted from JSDoc comments by import-splitting
+                    // regexes, or injected by the Angular linker on already-resolved code).
+                    try {
+                        code = deduplicateLinkerImports(code);
+                    }
+                    catch { }
+                    // CJS/UMD wrapping: if a module uses module.exports but has no ESM export default,
+                    // wrap it with CJS shims so the device HTTP ESM loader can consume it.
+                    // This handles npm packages that use CommonJS but aren't pre-bundled by Vite.
+                    //
+                    // Key constraints this must handle:
+                    //  - CJS modules often declare local vars with the same names as their exports
+                    //    (e.g. `function createLTTB() {...}; exports.createLTTB = createLTTB;`)
+                    //    so `export var { createLTTB }` would cause a duplicate declaration.
+                    //  - UMD modules reference `this` at top level (undefined in ESM) but
+                    //    typically fall back to `self` or `globalThis`.
+                    //  - `module`, `exports` must be shims since they don't exist in ESM.
+                    try {
+                        code = wrapCommonJsModuleForDevice(code, resolvedCandidate || null);
+                    }
+                    catch { }
                     try {
                         assertNoOptimizedArtifacts(code, `NS M ${resolvedCandidate || spec}`);
                     }
@@ -2907,35 +3663,81 @@ export const piniaSymbol = p.piniaSymbol;
                         }
                     }
                     catch { }
+                    // `/ns/rt` and `/ns/core` URL versioning.
+                    //
+                    // Older versions of the server emitted `/ns/rt/<ver>` and
+                    // `/ns/core/<ver>` so V8's HTTP module cache would see a
+                    // fresh URL on every save. The runtime canonicalizer
+                    // (`CanonicalizeHttpUrlKey` in HMRSupport.mm) collapses
+                    // these version segments to the bare `/ns/rt` and
+                    // `/ns/core` keys before lookup, so V8 actually saw a
+                    // single cache entry — but the server was doing extra
+                    // work to inject a version segment that the runtime then
+                    // immediately stripped. Now that the runtime supports
+                    // explicit eviction (and these bridge endpoints don't
+                    // change at HMR time anyway), the version segment is
+                    // purely vestigial.
+                    //
+                    // Rather than rip the helpers out (which would touch
+                    // every ensureVersionedImports caller and risk bumping
+                    // older runtimes), we keep them but pass `verNum=0`. The
+                    // helpers still normalize URL shape (strip the absolute
+                    // origin prefix when present) but emit a stable
+                    // `/ns/rt/0` / `/ns/core/0` URL — which collapses to
+                    // `/ns/rt` / `/ns/core` in the runtime.
                     try {
-                        const verNum = Number(forcedVer || graphVersion || 0);
+                        const verNum = 0;
                         code = ensureVersionedRtImports(code, getServerOrigin(server), verNum);
                         code = ACTIVE_STRATEGY.ensureVersionedImports(code, getServerOrigin(server), verNum);
                         code = ensureVersionedCoreImports(code, getServerOrigin(server), verNum);
                     }
                     catch { }
-                    // Finalize: also stamp all internal /ns/m imports with ?v=<ver> after all rewrites
+                    // `/ns/m` URL finalize step.
+                    //
+                    // `rewriteNsMImportPathForHmr` is a canonicalizer: it
+                    // strips legacy `__ns_hmr__/<tag>/` segments and adds
+                    // `__ns_boot__/b1/` only for boot-tagged requests. The
+                    // `ver` parameter is preserved on the signature for API
+                    // compatibility but is ignored for app modules (cache
+                    // busting is driven by `__nsInvalidateModules`, not URL
+                    // versioning). We pass `'v0'` as a stable placeholder —
+                    // the canonicalizer emits the same URL regardless of
+                    // this value, but a constant placeholder makes the
+                    // contract explicit.
+                    //
+                    // SFC URLs (line below, `/ns/sfc/${verTag}/...`) still
+                    // embed a version because the Vue SFC pathway does not
+                    // yet have an eviction protocol. The runtime
+                    // canonicalizer does NOT strip `/ns/sfc/<ver>/`, so Vue
+                    // users still see per-save SFC re-fetches — that's a
+                    // known follow-up.
                     try {
-                        const ver = String(forcedVer || graphVersion || 0);
+                        const verTag = (() => {
+                            const numeric = getNumericServeVersionTag(forcedVer, Number(graphVersion || 0));
+                            return numeric > 0 ? `v${numeric}` : 'v0';
+                        })();
                         const origin = getServerOrigin(server);
+                        const rewritePath = (p) => rewriteNsMImportPathForHmr(p, 'v0', bootTaggedRequest);
+                        // /ns/m URL forms — all collapse to canonical stable
+                        // URLs via the Phase 3a rewriter.
                         // 1) Static imports: import ... from "/ns/m/..."
-                        code = code.replace(/(from\s*["'])(\/ns\/m\/[^"'?]+)(["'])/g, `$1$2?v=${ver}$3`);
+                        code = code.replace(/(from\s*["'])(\/ns\/m\/[^"'?]+)(["'])/g, (_m, a, p, b) => `${a}${rewritePath(p)}${b}`);
                         // 2) Side-effect imports: import "/ns/m/..."
-                        code = code.replace(/(import\s*(?!\()\s*["'])(\/ns\/m\/[^"'?]+)(["'])/g, `$1$2?v=${ver}$3`);
+                        code = code.replace(/(import\s*(?!\()\s*["'])(\/ns\/m\/[^"'?]+)(["'])/g, (_m, a, p, b) => `${a}${rewritePath(p)}${b}`);
                         // 3) Dynamic imports: import("/ns/m/...")
-                        code = code.replace(/(import\(\s*["'])(\/ns\/m\/[^"'?]+)(["']\s*\))/g, `$1$2?v=${ver}$3`);
+                        code = code.replace(/(import\(\s*["'])(\/ns\/m\/[^"'?]+)(["']\s*\))/g, (_m, a, p, b) => `${a}${rewritePath(p)}${b}`);
                         // 4) new URL("/ns/m/...", import.meta.url)
-                        code = code.replace(/(new\s+URL\(\s*["'])(\/ns\/m\/[^"'?]+)(["']\s*,\s*import\.meta\.url\s*\))/g, `$1$2?v=${ver}$3`);
+                        code = code.replace(/(new\s+URL\(\s*["'])(\/ns\/m\/[^"'?]+)(["']\s*,\s*import\.meta\.url\s*\))/g, (_m, a, p, b) => `${a}${rewritePath(p)}${b}`);
                         // 5) __ns_import(new URL('/ns/m/...', import.meta.url).href)
-                        code = code.replace(/(new\s+URL\(\s*["'])(\/ns\/m\/[^"'?]+)(["']\s*,\s*import\.meta\.url\s*\)\.href)/g, `$1$2?v=${ver}$3`);
-                        // 6) Force absolute HTTP for new URL('/ns/m/...', import.meta.url).href → "${origin}/ns/m/..."
+                        code = code.replace(/(new\s+URL\(\s*["'])(\/ns\/m\/[^"'?]+)(["']\s*,\s*import\.meta\.url\s*\)\.href)/g, (_m, a, p, b) => `${a}${rewritePath(p)}${b}`);
+                        // 6) Force absolute HTTP for new URL('/ns/m/...', import.meta.url).href → canonical stable URL.
                         try {
-                            code = code.replace(/new\s+URL\(\s*["'](\/ns\/m\/[^"'?]+)(?:\?[^"']*)?["']\s*,\s*import\.meta\.url\s*\)\.href/g, (_m, p1) => `${JSON.stringify(`${origin}${p1}?v=${ver}`)}`);
+                            code = code.replace(/new\s+URL\(\s*["'](\/ns\/m\/[^"'?]+)(?:\?[^"']*)?["']\s*,\s*import\.meta\.url\s*\)\.href/g, (_m, p1) => `${JSON.stringify(`${origin}${rewritePath(p1)}`)}`);
                         }
                         catch { }
-                        // 7) Also fix SFC new URL('/ns/sfc/...', import.meta.url).href → "${origin}/ns/sfc/<ver>/..."
+                        // 7) SFC URLs (Vue) — still versioned. See header comment.
                         try {
-                            code = code.replace(/new\s+URL\(\s*["']\/ns\/sfc(\/[^"'?]+)(?:\?[^"']*)?["']\s*,\s*import\.meta\.url\s*\)\.href/g, (_m, p1) => `${JSON.stringify(`${origin}/ns/sfc/${ver}${p1}`)}`);
+                            code = code.replace(/new\s+URL\(\s*["']\/ns\/sfc(\/[^"'?]+)(?:\?[^"']*)?["']\s*,\s*import\.meta\.url\s*\)\.href/g, (_m, p1) => `${JSON.stringify(`${origin}/ns/sfc/${verTag}${p1}`)}`);
                         }
                         catch { }
                     }
@@ -2946,13 +3748,25 @@ export const piniaSymbol = p.piniaSymbol;
                         code = ensureDestructureCoreImports(code);
                     }
                     catch { }
+                    // Boot-time module graph progress: while the app is still replacing the
+                    // placeholder, emit lightweight progress updates as /ns/m modules begin
+                    // evaluating. This keeps the overlay moving during large initial graphs.
+                    try {
+                        if (bootTaggedRequest) {
+                            const bootModuleLabel = String(spec || '').replace(/\\/g, '/');
+                            const bootProgressSnippet = buildBootProgressSnippet(bootModuleLabel);
+                            code = bootProgressSnippet + code;
+                            code = hoistTopLevelStaticImports(code);
+                        }
+                    }
+                    catch { }
                     // Dev-only: link-check static imports to surface missing bindings early
                     try {
                         const devCheck = process.env.NODE_ENV !== 'production';
                         if (devCheck) {
                             const ast = babelParse(code, {
                                 sourceType: 'module',
-                                plugins: ['typescript', 'importMeta'],
+                                plugins: MODULE_IMPORT_ANALYSIS_PLUGINS,
                             });
                             const imports = [];
                             babelTraverse(ast, {
@@ -3036,6 +3850,15 @@ export const piniaSymbol = p.piniaSymbol;
                                         continue;
                                     const hasDefault = /\bexport\s+default\b/.test(targetCode) || /export\s*\{\s*default\s*(?:as\s*default)?\s*\}/.test(targetCode);
                                     if (!hasDefault) {
+                                        // CJS/UMD modules won't have `export default` — they get CJS-wrapped
+                                        // by the serving pipeline. Only warn, don't fatally block the importer.
+                                        const hasCjsPattern = /\bmodule\s*\.\s*exports\b/.test(targetCode) || /\bexports\s*\.\s*\w/.test(targetCode);
+                                        if (hasCjsPattern) {
+                                            if (verbose) {
+                                                console.warn(`[ns:m][link-check] CJS module without export default: ${u.pathname} (will be CJS-wrapped at serve time)`);
+                                            }
+                                            continue;
+                                        }
                                         const msg = `[link-check] Missing default export in ${u.pathname}${u.search} (imported by ${resolvedCandidate || spec})`;
                                         // Emit a module that throws to surface the exact offender
                                         res.statusCode = 200;
@@ -3047,19 +3870,15 @@ export const piniaSymbol = p.piniaSymbol;
                         }
                     }
                     catch (eLC) {
-                        try {
+                        if (verbose) {
                             console.warn('[ns:m][link-check] failed', eLC?.message || eLC);
                         }
-                        catch { }
                     }
                     res.statusCode = 200;
                     res.end(code);
                 }
                 catch (e) {
-                    try {
-                        console.warn('[sfc-asm] error serving', req.url, e && e.message ? e.message : e);
-                    }
-                    catch { }
+                    console.warn('[sfc-asm] error serving', req.url, e && e.message ? e.message : e);
                     res.statusCode = 500;
                     res.end('export {}\n');
                 }
@@ -3092,8 +3911,10 @@ export const piniaSymbol = p.piniaSymbol;
                         `let __cached_rt = null;\n` +
                         `let __cached_vm = null;\n` +
                         `const __RT_REALM_TAG = (globalThis.__NS_RT_REALM__ ||= Math.random().toString(36).slice(2));\n` +
-                        // Unconditional one-shot evaluation marker to confirm bridge is executed on device
-                        `try { if (!(globalThis.__NS_RT_ONCE__ && globalThis.__NS_RT_ONCE__.eval)) { (globalThis.__NS_RT_ONCE__ ||= {}).eval = true; console.log('[ns-rt] evaluated', { rtRealm: __RT_REALM_TAG }); } } catch {}\n` +
+                        // One-shot evaluation marker to confirm the bridge is executed on
+                        // device. Gated on __NS_ENV_VERBOSE__ so it stays silent unless
+                        // the developer opts in via NS_VITE_VERBOSE / VITE_DEBUG_LOGS.
+                        `try { if (!(globalThis.__NS_RT_ONCE__ && globalThis.__NS_RT_ONCE__.eval)) { (globalThis.__NS_RT_ONCE__ ||= {}).eval = true; if (globalThis.__NS_ENV_VERBOSE__) console.log('[ns-rt] evaluated', { rtRealm: __RT_REALM_TAG }); } } catch {}\n` +
                         `function __ensure(){\n` +
                         `  if (__cached_rt) return __cached_rt;\n` +
                         `  let vm = null;\n` +
@@ -3185,7 +4006,7 @@ export const piniaSymbol = p.piniaSymbol;
                         `export const vShow = (__ensure().vShow);\n` +
                         `export const createApp = (...a) => (__ensure().createApp)(...a);\n` +
                         `export const registerElement = (...a) => (__ensure().registerElement)(...a);\n` +
-                        `export const $navigateTo = (...a) => { const vm = (__cached_vm || (void __ensure(), __cached_vm)); const rt = __ensure(); try { if (!(g && g.Frame)) { const ns = (__ns_core_bridge && (__ns_core_bridge.__esModule && __ns_core_bridge.default ? __ns_core_bridge.default : (__ns_core_bridge.default || __ns_core_bridge))) || __ns_core_bridge || {}; if (ns) { if (!g.Frame && ns.Frame) g.Frame = ns.Frame; if (!g.Page && ns.Page) g.Page = ns.Page; if (!g.Application && (ns.Application||ns.app||ns.application)) g.Application = (ns.Application||ns.app||ns.application); } } } catch {} try { const hmrRealm = (g && g.__NS_HMR_REALM__) || 'unknown'; const hasTop = !!(g && g.Frame && g.Frame.topmost && g.Frame.topmost()); const top = hasTop ? g.Frame.topmost() : null; const ctor = top && top.constructor && top.constructor.name; } catch {} if (g && typeof g.__nsNavigateUsingApp === 'function') { try { return g.__nsNavigateUsingApp(...a); } catch (e) { try { console.error('[ns-rt] $navigateTo app navigator error', e); } catch {} throw e; } } try { console.error('[ns-rt] $navigateTo unavailable: app navigator missing'); } catch {} throw new Error('$navigateTo unavailable: app navigator missing'); } ;\n` +
+                        `export const $navigateTo = (...a) => { const vm = (__cached_vm || (void __ensure(), __cached_vm)); const rt = __ensure(); try { if (!(g && g.Frame)) { const ns = (__ns_core_bridge && (__ns_core_bridge.__esModule && __ns_core_bridge.default ? __ns_core_bridge.default : (__ns_core_bridge.default || __ns_core_bridge))) || __ns_core_bridge || {}; if (ns) { if (!g.Frame && ns.Frame) g.Frame = ns.Frame; if (!g.Page && ns.Page) g.Page = ns.Page; if (!g.Application && (ns.Application||ns.app||ns.application)) g.Application = (ns.Application||ns.app||ns.application); } } } catch {} try { const hmrRealm = (g && g.__NS_HMR_REALM__) || 'unknown'; const hasTop = !!(g && g.Frame && g.Frame.topmost && g.Frame.topmost()); const top = hasTop ? g.Frame.topmost() : null; const ctor = top && top.constructor && top.constructor.name; } catch {} if (g && typeof g.__nsNavigateUsingApp === 'function') { try { return g.__nsNavigateUsingApp(...a); } catch (e) { console.error('[ns-rt] $navigateTo app navigator error', e); throw e; } } console.error('[ns-rt] $navigateTo unavailable: app navigator missing'); throw new Error('$navigateTo unavailable: app navigator missing'); } ;\n` +
                         `export const $navigateBack = (...a) => { const vm = (__cached_vm || (void __ensure(), __cached_vm)); const rt = __ensure(); const impl = (vm && (vm.$navigateBack || (vm.default && vm.default.$navigateBack))) || (rt && (rt.$navigateBack || (rt.runtimeHelpers && rt.runtimeHelpers.navigateBack))); let res; try { const via = (impl && (impl === (vm && vm.$navigateBack) || impl === (vm && vm.default && vm.default.$navigateBack))) ? 'vm' : (impl ? 'rt' : 'none'); } catch {} try { if (typeof impl === 'function') res = impl(...a); } catch {} try { const top = (g && g.Frame && g.Frame.topmost && g.Frame.topmost()); if (!res && top && top.canGoBack && top.canGoBack()) { res = top.goBack(); } } catch {} try { const hook = g && (g.__NS_HMR_ON_NAVIGATE_BACK || g.__NS_HMR_ON_BACK || g.__nsAttemptBackRemount); if (typeof hook === 'function') hook(); } catch {} return res; }\n` +
                         `export const $showModal = (...a) => { const vm = (__cached_vm || (void __ensure(), __cached_vm)); const rt = __ensure(); const impl = (vm && (vm.$showModal || (vm.default && vm.default.$showModal))) || (rt && (rt.$showModal || (rt.runtimeHelpers && rt.runtimeHelpers.showModal))); try { if (typeof impl === 'function') return impl(...a); } catch (e) { } return undefined; }\n` +
                         `export default {\n` +
@@ -3247,35 +4068,262 @@ export const piniaSymbol = p.piniaSymbol;
                     return next();
                 }
             });
+            // 2.5.1) Catch-all redirect for stray /node_modules/@nativescript/core/*
+            // requests — route them to the /ns/core bridge so they get the same
+            // __DEV__/__IOS__ preamble and specifier rewriting. Without this,
+            // Vite's default /node_modules/ handler serves the raw file, which
+            // references bare __DEV__ and crashes at module eval.
+            server.middlewares.use((req, _res, next) => {
+                try {
+                    const urlObj = new URL(req.url || '', 'http://localhost');
+                    const coreNmPrefix = '/node_modules/@nativescript/core';
+                    if (!urlObj.pathname.startsWith(coreNmPrefix))
+                        return next();
+                    const sub = urlObj.pathname.slice(coreNmPrefix.length).replace(/^\/+/, '');
+                    if (sub === '' || sub === 'index.js' || sub === 'index') {
+                        req.url = `/ns/core`;
+                    }
+                    else {
+                        req.url = `/ns/core/${sub}`;
+                    }
+                    return next();
+                }
+                catch {
+                    return next();
+                }
+            });
             // 2.6) ESM bridge for @nativescript/core: GET /ns/core[/<ver>][?p=sub/path]
+            //
+            // Since bundle.mjs no longer bundles @nativescript/core (it is
+            // declared external in the rolldown config under HMR), this
+            // endpoint is the ONE place core is evaluated. Every consumer —
+            // bundle.mjs's own `@nativescript/core*` imports (resolved to
+            // full HTTP URLs in the entry virtual module), externalized
+            // vendor packages, HTTP-served app modules — all end up here.
+            // No more proxy bridge, no enumeration, no namespace detection,
+            // no prototype-polluted maps. We just serve Vite's authoritative
+            // transformed module content.
+            //
+            // iOS caches by URL path, so each unique URL is evaluated exactly
+            // once per app lifetime. Every class identity is shared, every
+            // `register()` side effect runs once, every `Application` reference
+            // is the same iosApp singleton. The entire class of "does not
+            // provide an export named X" and "Cannot redefine property" errors
+            // is eliminated by construction.
             server.middlewares.use(async (req, res, next) => {
                 try {
                     const urlObj = new URL(req.url || '', 'http://localhost');
-                    if (!(urlObj.pathname === '/ns/core' || /^\/ns\/core\/[\d]+$/.test(urlObj.pathname)))
+                    const coreRequest = parseCoreBridgeRequest(urlObj.pathname, urlObj.searchParams, Number(graphVersion || 0));
+                    if (!coreRequest)
                         return next();
                     res.setHeader('Access-Control-Allow-Origin', '*');
                     res.setHeader('Content-Type', 'application/javascript; charset=utf-8');
                     res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0');
                     res.setHeader('Pragma', 'no-cache');
                     res.setHeader('Expires', '0');
-                    const verSeg = urlObj.pathname.replace(/^\/ns\/core\/?/, '');
-                    const ver = /^[0-9]+$/.test(verSeg) ? verSeg : String(graphVersion || 0);
-                    const sub = urlObj.searchParams.get('p') || '';
-                    const key = sub ? `@nativescript/core/${sub}` : `@nativescript/core`;
-                    // HTTP-only core bridge: do NOT use require/createRequire. Export a proxy that maps
-                    // property access to globalThis first, then to any available vendor registry module.
-                    let code = REQUIRE_GUARD_SNIPPET +
-                        `// [ns-core-bridge][v${ver}] HTTP-only ESM bridge (default proxy only)\n` +
-                        `const g = globalThis;\n` +
-                        `const reg = (g.__nsVendorRegistry ||= new Map());\n` +
-                        `const __getVendorCore = () => { try { const m = reg && reg.get ? (reg.get(${JSON.stringify(key)}) || reg.get('@nativescript/core')) : null; return (m && (m.__esModule && m.default ? m.default : (m.default || m))) || m || null; } catch { return null; } };\n` +
-                        `const __core = new Proxy({}, { get(_t, p){ if (p === 'default') return __core; if (p === Symbol.toStringTag) return 'Module'; try { const v = g[p]; if (v !== undefined) return v; } catch {} try { const vc = __getVendorCore(); return vc ? vc[p] : undefined; } catch {} return undefined; } });\n` +
-                        `// Default export: namespace-like proxy\n` +
-                        `export default __core;\n`;
+                    const { normalizedSub, sub, ver } = coreRequest;
+                    const resolveModuleId = async (moduleId) => {
+                        const resolved = await server.pluginContainer?.resolveId?.(moduleId, undefined);
+                        return typeof resolved === 'string' ? resolved : resolved?.id || null;
+                    };
+                    let modulePath = null;
+                    if (sub) {
+                        const resolvedSubpath = normalizedSub || sub;
+                        modulePath = await resolveRuntimeCoreModulePath(resolvedSubpath, resolveModuleId);
+                        if (!modulePath) {
+                            modulePath = `/node_modules/@nativescript/core/${resolvedSubpath}`;
+                        }
+                    }
+                    else {
+                        modulePath = (await resolveModuleId('@nativescript/core')) || '/node_modules/@nativescript/core/index.js';
+                    }
+                    const transformed = await sharedTransformRequest(modulePath);
+                    if (!transformed?.code) {
+                        res.statusCode = 500;
+                        res.setHeader('Content-Type', 'application/json');
+                        res.end(JSON.stringify({ error: 'core-transform-failed', modulePath, sub: sub || null }));
+                        return;
+                    }
+                    // Vite's transform output references module IDs with /@fs,
+                    // relative specifiers, or absolute project paths. Rewrite
+                    // those to URLs iOS can fetch over HTTP.
+                    let rewritten = rewriteSpecifiersForDevice(transformed.code, getServerOrigin(server), Number(ver));
+                    // Invariant D (CJS/ESM interop shape) — EXPORT-SIDE fix.
+                    //
+                    // `@nativescript/core/index.js` declares namespace
+                    // re-exports like:
+                    //     export * as Utils from './utils';
+                    // The ES spec says these produce Module Namespace Objects
+                    // with [[Prototype]] = null. Consumers that reach them
+                    // via direct ESM import — `import { Utils } from
+                    // '@nativescript/core'` — get the raw null-proto value,
+                    // bypassing any CJS `require` shim we install. Most
+                    // consumers tolerate this, but CJS-style interop (most
+                    // notably zone.js's `patchMethod`) calls
+                    // `hasOwnProperty` on the target and crashes on
+                    // null-proto.
+                    //
+                    // We rewrite the re-export to a shape-wrapped const:
+                    //     import * as __ns_re_Utils__ from './utils';
+                    //     export const Utils = __NS_CJS_SHAPE__(__ns_re_Utils__);
+                    // so the EXPORT itself is a plain object — visible to
+                    // both ESM and CJS consumers consistently.
+                    //
+                    // We only pay the rewrite cost when the module actually
+                    // contains namespace re-exports (i.e., the main
+                    // `index.js`). Subpaths (`/utils`, `/http`, …) don't
+                    // re-export via `export * as`; they expose named
+                    // exports directly, so the rewrite is a no-op on them.
+                    if (hasNamespaceReExport(rewritten)) {
+                        rewritten = rewriteNamespaceReExportsForShape(rewritten);
+                    }
+                    // Prepend the build-time defines (__DEV__, __IOS__, __ANDROID__,
+                    // __APPLE__, …) that @nativescript/core source references directly.
+                    // Vite's `define` config substitutes these in user-code transforms but
+                    // skips node_modules by default; since core is now external and served
+                    // over HTTP from this endpoint, the served transformed code still has
+                    // bare identifiers like `if (__DEV__) …`. Without these consts, V8
+                    // hits `ReferenceError: __DEV__ is not defined` at module eval because
+                    // globalThis.__DEV__ is set by bundle.mjs's body AFTER all static
+                    // imports (including these core modules) have resolved.
+                    //
+                    // We inject LITERAL boolean values based on CLI flags + dev-server
+                    // mode rather than reading from globalThis, so the defines are
+                    // resolved even before bundle.mjs's body runs.
+                    const __cliFlags = getCliFlags() || {};
+                    const __platformIsAndroid = !!__cliFlags.android;
+                    const __platformIsVisionOS = !!__cliFlags.visionos;
+                    const __platformIsIOS = !__platformIsAndroid && !__platformIsVisionOS;
+                    const preamble = [
+                        `const __ANDROID__ = ${__platformIsAndroid ? 'true' : 'false'};`,
+                        `const __IOS__ = ${__platformIsIOS ? 'true' : 'false'};`,
+                        `const __VISIONOS__ = ${__platformIsVisionOS ? 'true' : 'false'};`,
+                        `const __APPLE__ = __IOS__ || __VISIONOS__;`,
+                        `const __DEV__ = ${server.config?.mode === 'development' ? 'true' : 'false'};`,
+                        `const __COMMONJS__ = false;`,
+                        `const __NS_WEBPACK__ = false;`,
+                        `const __NS_ENV_VERBOSE__ = globalThis.__NS_ENV_VERBOSE__ !== undefined ? !!globalThis.__NS_ENV_VERBOSE__ : false;`,
+                        `const __CSS_PARSER__ = 'css-tree';`,
+                        `const __UI_USE_XML_PARSER__ = true;`,
+                        `const __UI_USE_EXTERNAL_RENDERER__ = false;`,
+                        `const __TEST__ = false;`,
+                    ].join('\n');
+                    // Boot-time instrumentation + module self-registration.
+                    //
+                    //   - URL canonicalization: the same logical module must
+                    //     always resolve to byte-identical URLs across every
+                    //     emitter. The /ns/core handler records the first URL
+                    //     seen for each canonical sub (or '' for main) in
+                    //     `globalThis.__NS_CORE_FIRST_URL__` and fails hard on
+                    //     mismatch so drift in any emitter surfaces
+                    //     immediately, before the realm splits.
+                    //   - CJS/ESM boot order: CommonJS
+                    //     `require('@nativescript/core/...')` calls from
+                    //     vendor install() hooks must resolve to the SAME
+                    //     ESM namespace that ran this side-effect preamble.
+                    //     The registration below keys the namespace object
+                    //     under BOTH the bare specifier and the canonical
+                    //     subpath (and raw subpath for back-compat) so the
+                    //     vendor shim's `createRequire` and the main-entry
+                    //     `_nsReq` hit on any lookup form.
+                    const rawSub = normalizedSub || sub || '';
+                    const canonicalSub = normalizeCoreSubCanonical(rawSub);
+                    const registrationKeySet = new Set();
+                    registrationKeySet.add(canonicalSub ? `@nativescript/core/${canonicalSub}` : '@nativescript/core');
+                    registrationKeySet.add(canonicalSub);
+                    if (rawSub && rawSub !== canonicalSub) {
+                        registrationKeySet.add(`@nativescript/core/${rawSub}`);
+                        registrationKeySet.add(rawSub);
+                    }
+                    const registrationKeys = Array.from(registrationKeySet).map((k) => JSON.stringify(k));
+                    const canonicalUrl = `${getServerOrigin(server)}` + (canonicalSub ? `/ns/core/${canonicalSub}` : '/ns/core');
+                    const instrumentationHeader = [
+                        `/* @nativescript/core bridge — canonical URL: ${canonicalUrl} */`,
+                        `try { if (typeof globalThis !== 'undefined') {`,
+                        `  const __nsFirst = globalThis.__NS_CORE_FIRST_URL__ || (globalThis.__NS_CORE_FIRST_URL__ = Object.create(null));`,
+                        `  const __nsSeen = globalThis.__NS_CORE_FETCHED_URLS__ || (globalThis.__NS_CORE_FETCHED_URLS__ = []);`,
+                        `  const __nsKey = ${JSON.stringify(canonicalSub)};`,
+                        `  const __nsUrl = ${JSON.stringify(canonicalUrl)};`,
+                        `  __nsSeen.push(__nsUrl);`,
+                        `  if (typeof __nsFirst[__nsKey] === 'string' && __nsFirst[__nsKey] !== __nsUrl) {`,
+                        `    throw new Error('[ns-core] URL drift for sub=' + __nsKey + ': first=' + __nsFirst[__nsKey] + ' now=' + __nsUrl);`,
+                        `  }`,
+                        `  if (!__nsFirst[__nsKey]) __nsFirst[__nsKey] = __nsUrl;`,
+                        `  globalThis.__NS_CORE_EVAL_COUNT__ = (globalThis.__NS_CORE_EVAL_COUNT__ || 0) + 1;`,
+                        `} } catch (e) { console.warn('[ns-core] instrumentation failed:', (e && e.message) || e); }`,
+                    ].join('\n');
+                    // CJS/ESM interop shape — REGISTRATION side.
+                    //
+                    // The actual shape installer runs earlier in the module
+                    // body (between preamble and selfImport; see
+                    // buildShapeInstallHeader). At this point we just read
+                    // globalThis.__NS_CJS_SHAPE__ and apply it to the self
+                    // namespace before registering under the CJS key space.
+                    //
+                    // Why shape self at registration: consumers that reach
+                    // `@nativescript/core` via `require()` (legacy vendors,
+                    // `globalThis.require` shim) look up the registry. They
+                    // expect a plain object (Object.prototype in chain) so
+                    // `.hasOwnProperty` / `.toString` work. Shaping once on
+                    // registration — the shape function is identity-preserving
+                    // via WeakMap — gives a stable, shared, CJS-compatible
+                    // view without copying on every require.
+                    const registrationFooter = [
+                        `try { if (typeof globalThis !== 'undefined') {`,
+                        `  const __nsReg = globalThis.__NS_CORE_MODULES__ || (globalThis.__NS_CORE_MODULES__ = Object.create(null));`,
+                        `  const __nsShapeFn = typeof globalThis.__NS_CJS_SHAPE__ === 'function' ? globalThis.__NS_CJS_SHAPE__ : function (x) { return x; };`,
+                        `  const __nsSelfRaw = (typeof __ns_core_self_ns__ !== 'undefined') ? __ns_core_self_ns__ : { default: undefined };`,
+                        `  const __nsSelf = __nsShapeFn(__nsSelfRaw);`,
+                        ...registrationKeys.map((k) => `  __nsReg[${k}] = __nsSelf;`),
+                        `} } catch (e) { console.warn('[ns-core] self-register failed:', (e && e.message) || e); }`,
+                    ].join('\n');
+                    // Bind `import * as __ns_core_self_ns__` to the module's
+                    // own export namespace so the footer can stash it into
+                    // the registry. Self-import is a no-op at eval time —
+                    // V8 resolves it to the module record we're already
+                    // evaluating and the final namespace is the same object
+                    // the registry receives. We use the CANONICAL URL here
+                    // so the self-import participates in Invariant A along
+                    // with every other @nativescript/core URL.
+                    const canonicalUrlForSelf = canonicalSub ? `/ns/core/${canonicalSub}` : '/ns/core';
+                    const selfImport = `import * as __ns_core_self_ns__ from ${JSON.stringify(canonicalUrlForSelf)};`;
+                    // Invariant D — SHAPE INSTALLER.
+                    //
+                    // Emits idempotent body-code that installs
+                    // globalThis.__NS_CJS_SHAPE__ BEFORE `rewritten`'s body
+                    // runs. This matters because the rewrite step above may
+                    // have produced statements like
+                    // `export const Utils = (typeof globalThis.__NS_CJS_SHAPE__ ...)(__ns_re_Utils__);`
+                    // that execute during module evaluation. Without the
+                    // installer running first, the ternary falls back to
+                    // identity — still safe, but the null-proto namespace
+                    // leaks through and consumers that expect a plain
+                    // object would still crash.
+                    //
+                    // Placement is important: BEFORE selfImport in the
+                    // concatenation. ESM imports are hoisted regardless of
+                    // textual position, but body code executes in source
+                    // order. Placing the installer first guarantees it
+                    // runs before any body statement in `rewritten`.
+                    //
+                    // Install is idempotent: `|| (globalThis.X = ...)` so
+                    // whichever /ns/core module evaluates first wins and
+                    // every subsequent module becomes a no-op.
+                    const shapeInstallHeader = buildShapeInstallHeader();
+                    // Invariant D — DEFAULT EXPORT BRIDGE.
+                    //
+                    // See `buildDefaultExportFooter` in ns-core-cjs-shape.ts
+                    // for the full rationale (consumer matrix, skip conditions,
+                    // why the default isn't shaped). The short version:
+                    // upstream rewrites turn `import { X } from '@nativescript/core'`
+                    // into a DEFAULT import, and the bridge has to provide one.
+                    const defaultExportFooter = buildDefaultExportFooter(rewritten);
+                    const moduleCode = [instrumentationHeader, preamble, shapeInstallHeader, selfImport, rewritten, defaultExportFooter, registrationFooter].join('\n');
                     res.statusCode = 200;
-                    res.end(code);
+                    res.end(moduleCode);
                 }
                 catch (e) {
+                    console.warn('[ns-core-bridge] serve failed:', e?.message);
                     next();
                 }
             });
@@ -3285,14 +4333,11 @@ export const piniaSymbol = p.piniaSymbol;
                     const urlObj = new URL(req.url || '', 'http://localhost');
                     if (!(urlObj.pathname === '/ns/entry-rt'))
                         return next();
-                    try {
-                        if (verbose) {
-                            const ra = req.socket?.remoteAddress;
-                            const rp = req.socket?.remotePort;
-                            console.log('[hmr-http] GET /ns/entry-rt from', ra + (rp ? ':' + rp : ''));
-                        }
+                    if (verbose) {
+                        const ra = req.socket?.remoteAddress;
+                        const rp = req.socket?.remotePort;
+                        console.log('[hmr-http] GET /ns/entry-rt from', ra + (rp ? ':' + rp : ''));
                     }
-                    catch { }
                     res.setHeader('Access-Control-Allow-Origin', '*');
                     res.setHeader('Content-Type', 'application/javascript; charset=utf-8');
                     res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0');
@@ -3300,18 +4345,41 @@ export const piniaSymbol = p.piniaSymbol;
                     res.setHeader('Expires', '0');
                     let content = '';
                     try {
-                        const req = createRequire(import.meta.url);
-                        const entryRtPath = req.resolve('@nativescript/vite/hmr/entry-runtime.js');
-                        const fs = req('fs');
-                        content = fs.readFileSync(entryRtPath, 'utf-8');
+                        const _req = createRequire(import.meta.url);
+                        const entryRtPath = _req.resolve('@nativescript/vite/hmr/entry-runtime.js');
+                        content = readFileSync(entryRtPath, 'utf-8');
                     }
                     catch (e) {
-                        content = 'export default async function start(){ console.error("[/ns/entry-rt] not found"); }\n';
+                        // .js not found (source tree without build) — transform .ts on the fly
+                        try {
+                            const tsPath = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..', 'entry-runtime.ts');
+                            if (existsSync(tsPath)) {
+                                const tsSource = readFileSync(tsPath, 'utf-8');
+                                const result = babelCore.transformSync(tsSource, {
+                                    filename: tsPath,
+                                    plugins: [[pluginTransformTypescript, { isTSX: false, allowDeclareFields: true }]],
+                                    sourceType: 'module',
+                                });
+                                if (result?.code) {
+                                    content = result.code;
+                                }
+                            }
+                        }
+                        catch (e2) {
+                            if (verbose)
+                                console.warn('[hmr-http] entry-runtime.ts transform failed', e2);
+                        }
+                        if (!content) {
+                            content = 'export default async function start(){ console.error("[/ns/entry-rt] not found"); }\n';
+                        }
                     }
+                    if (verbose)
+                        console.log('[hmr-http] /ns/entry-rt serving', content.length, 'bytes');
                     res.statusCode = 200;
                     res.end(content);
                 }
                 catch (e) {
+                    console.warn('[hmr-http] /ns/entry-rt error', e);
                     next();
                 }
             });
@@ -3514,10 +4582,7 @@ export const piniaSymbol = p.piniaSymbol;
                         }
                         if (!transformed?.code) {
                             if (verbose) {
-                                try {
-                                    console.warn(`[sfc][serve] transform miss for`, fullSpec);
-                                }
-                                catch { }
+                                console.warn(`[sfc][serve] transform miss for`, fullSpec);
                             }
                             // Emit an erroring module to surface the failure at import site with helpful hints
                             try {
@@ -3633,10 +4698,7 @@ export const piniaSymbol = p.piniaSymbol;
                                 }
                                 catch (eTplSelf) {
                                     if (verbose) {
-                                        try {
-                                            console.warn('[sfc][template][self-compile][fail]', fullSpec, eTplSelf?.message);
-                                        }
-                                        catch { }
+                                        console.warn('[sfc][template][self-compile][fail]', fullSpec, eTplSelf?.message);
                                     }
                                     code = transformed.code || 'export {}\n';
                                     code = processTemplateVariantMinimal(code);
@@ -3741,7 +4803,7 @@ export const piniaSymbol = p.piniaSymbol;
                             code = outCode;
                         }
                         catch { }
-                        code = processCodeForDevice(code, false);
+                        code = processCodeForDevice(code, false, true, /(?:^|\/)node_modules\//.test(fullSpec), fullSpec);
                         // Transform static .vue imports into static imports from the assembler (no TLA) via AST
                         try {
                             const importerPath = fullSpec.replace(/[?#].*$/, '');
@@ -3803,10 +4865,7 @@ export const piniaSymbol = p.piniaSymbol;
                         }
                         catch (eTsVar) {
                             if (verbose) {
-                                try {
-                                    console.warn('[sfc][variant:script][babel-ts][fail]', fullSpec, eTsVar?.message);
-                                }
-                                catch { }
+                                console.warn('[sfc][variant:script][babel-ts][fail]', fullSpec, eTsVar?.message);
                             }
                         }
                     }
@@ -3870,10 +4929,7 @@ export const piniaSymbol = p.piniaSymbol;
                     const kind = isVariant ? `variant:${variantType || 'unknown'}` : 'full';
                     const sig = `// [sfc] kind=${kind} path=${importerPath} len=${code.length} default=${hasDefault} wrapped=${false}\n`;
                     if (verbose) {
-                        try {
-                            console.log(`[sfc][serve] ${fullSpec} kind=${kind} default=${hasDefault} bytes=${code.length}`);
-                        }
-                        catch { }
+                        console.log(`[sfc][serve] ${fullSpec} kind=${kind} default=${hasDefault} bytes=${code.length}`);
                     }
                     // Ensure script variants always provide a default export if they declare a component
                     if (!hasDefault) {
@@ -3942,16 +4998,10 @@ export const piniaSymbol = p.piniaSymbol;
                     // 6) Object property forms (rare in template output) render: (...) => {}
                     const hasRender = /export\s+function\s+render\s*\(/.test(templateCode) || /(?:^|\n)\s*function\s+render\s*\(/.test(templateCode) || /export\s+(?:const|let|var)\s+render\s*=/.test(templateCode) || /(?:^|\n)\s*(?:const|let|var)\s+render\s*=/.test(templateCode) || /\brender\s*[:=]\s*/.test(templateCode) || /export\s*\{\s*render\s*(?:as\s*render)?\s*\}/.test(templateCode);
                     if (hasRender && verbose) {
-                        try {
-                            console.log('[sfc-meta] detected render for', base);
-                        }
-                        catch { }
+                        console.log('[sfc-meta] detected render for', base);
                     }
                     else if (!hasRender && verbose) {
-                        try {
-                            console.warn('[sfc-meta] render NOT detected for', base);
-                        }
-                        catch { }
+                        console.warn('[sfc-meta] render NOT detected for', base);
                     }
                     const hash = createHash('md5').update(base).digest('hex').slice(0, 8);
                     const payload = {
@@ -4085,10 +5135,7 @@ export const piniaSymbol = p.piniaSymbol;
                             }
                             catch (eScript) {
                                 if (verbose) {
-                                    try {
-                                        console.warn('[sfc-asm][compileScript] failed', base, eScript?.message);
-                                    }
-                                    catch { }
+                                    console.warn('[sfc-asm][compileScript] failed', base, eScript?.message);
                                 }
                                 // Retry without inlineTemplate
                                 try {
@@ -4104,10 +5151,7 @@ export const piniaSymbol = p.piniaSymbol;
                                 }
                                 catch (eNoInline) {
                                     if (verbose) {
-                                        try {
-                                            console.warn('[sfc-asm][compileScript][no-inline-fallback] failed', base, eNoInline?.message);
-                                        }
-                                        catch { }
+                                        console.warn('[sfc-asm][compileScript][no-inline-fallback] failed', base, eNoInline?.message);
                                     }
                                 }
                             }
@@ -4138,10 +5182,7 @@ export const piniaSymbol = p.piniaSymbol;
                                 }
                                 catch (eNoInline) {
                                     if (verbose) {
-                                        try {
-                                            console.warn('[sfc-asm][compileScript][no-inline-fallback] failed', base, eNoInline?.message);
-                                        }
-                                        catch { }
+                                        console.warn('[sfc-asm][compileScript][no-inline-fallback] failed', base, eNoInline?.message);
                                     }
                                 }
                             }
@@ -4164,20 +5205,14 @@ export const piniaSymbol = p.piniaSymbol;
                                     });
                                     compiledTplCode = (ct && (ct.code || '')) || '';
                                     if (ct?.errors?.length && verbose) {
-                                        try {
-                                            console.warn('[sfc-asm][compileTemplate][errors]', base, ct.errors);
-                                        }
-                                        catch { }
+                                        console.warn('[sfc-asm][compileTemplate][errors]', base, ct.errors);
                                     }
                                 }
                             }
                             catch (eTpl) {
                                 templateErr = eTpl;
                                 if (verbose) {
-                                    try {
-                                        console.warn('[sfc-asm][compileTemplate] failed', base, eTpl?.message);
-                                    }
-                                    catch { }
+                                    console.warn('[sfc-asm][compileTemplate] failed', base, eTpl?.message);
                                 }
                                 // Fallback: use the variant-transformed template code if available
                                 try {
@@ -4240,10 +5275,7 @@ export const piniaSymbol = p.piniaSymbol;
                                 }
                                 catch (eExtract) {
                                     if (verbose) {
-                                        try {
-                                            console.warn('[sfc-asm][extractTemplateRender] failed', base, eExtract?.message);
-                                        }
-                                        catch { }
+                                        console.warn('[sfc-asm][extractTemplateRender] failed', base, eExtract?.message);
                                     }
                                 }
                             }
@@ -4293,11 +5325,10 @@ export const piniaSymbol = p.piniaSymbol;
                             parts.push(scriptTransformed);
                             parts.push(renderDecl);
                             parts.push(`try { if (!__ns_sfc__.render) Object.defineProperty(__ns_sfc__, 'render', { configurable: true, enumerable: true, get(){ const r = (typeof __ns_getRender==='function' ? __ns_getRender() : undefined); Object.defineProperty(__ns_sfc__, 'render', { value: r, writable: true, configurable: true, enumerable: true }); return r; }, set(v){ Object.defineProperty(__ns_sfc__, 'render', { value: v, writable: true, configurable: true, enumerable: true }); } }); } catch(_e){}`);
-                            parts.push(`// diagnostic: hadScriptDefaultPre=${hadScriptDefaultPre} triedInlineTemplate=${triedInlineTemplate} renderOk=${renderOk} tplBytes=${compiledTplCode.length} scriptBytes=${(compiledScript || '').length} templateErr=${templateErr ? templateErr?.message : ''}`);
                             parts.push(`export function render(){ const f = (typeof __ns_getRender==='function' ? __ns_getRender() : (__ns_sfc__ && __ns_sfc__.render)); return typeof f==='function' ? f.apply(this, arguments) : undefined; }`);
                             parts.push(`export default __ns_sfc__`);
                             let inlineCode = parts.filter(Boolean).join('\n');
-                            inlineCode = processCodeForDevice(inlineCode, false);
+                            inlineCode = processCodeForDevice(inlineCode, false, true);
                             try {
                                 inlineCode = ensureVersionedCoreImports(inlineCode, getServerOrigin(server), Number(ver));
                             }
@@ -4322,10 +5353,7 @@ export const piniaSymbol = p.piniaSymbol;
                                 }
                                 catch (eTs) {
                                     if (verbose) {
-                                        try {
-                                            console.warn('[sfc-asm][babel-ts][fail]', base, eTs?.message);
-                                        }
-                                        catch { }
+                                        console.warn('[sfc-asm][babel-ts][fail]', base, eTs?.message);
                                     }
                                 }
                                 // Hoist imports + strip residual TS via AST
@@ -4335,18 +5363,12 @@ export const piniaSymbol = p.piniaSymbol;
                                     importLines = astRes.imports;
                                     scriptTransformed = astRes.body;
                                     if (astRes.diagnostics.length && verbose) {
-                                        try {
-                                            console.warn('[sfc-asm][ast]', base, astRes.diagnostics.join('; '));
-                                        }
-                                        catch { }
+                                        console.warn('[sfc-asm][ast]', base, astRes.diagnostics.join('; '));
                                     }
                                 }
                                 catch (eAst) {
                                     if (verbose) {
-                                        try {
-                                            console.warn('[sfc-asm][ast][fail]', base, eAst?.message);
-                                        }
-                                        catch { }
+                                        console.warn('[sfc-asm][ast][fail]', base, eAst?.message);
                                     }
                                 }
                                 // Ensure renderDecl ends with closing brace ONLY for function declaration forms
@@ -4372,12 +5394,11 @@ export const piniaSymbol = p.piniaSymbol;
                                         outParts.push(renderDecl);
                                 }
                                 outParts.push(`try { if (!__ns_sfc__.render) Object.defineProperty(__ns_sfc__, 'render', { configurable: true, enumerable: true, get(){ const r = (typeof __ns_getRender==='function' ? __ns_getRender() : (typeof __ns_render==='function' ? __ns_render : undefined)); Object.defineProperty(__ns_sfc__, 'render', { value: r, writable: true, configurable: true, enumerable: true }); return r; }, set(v){ Object.defineProperty(__ns_sfc__, 'render', { value: v, writable: true, configurable: true, enumerable: true }); } }); } catch(_e){}`);
-                                outParts.push(`// diagnostic: hadScriptDefaultPre=${hadScriptDefaultPre} triedInlineTemplate=${triedInlineTemplate} renderOk=${renderOk} tplBytes=${compiledTplCode.length} scriptBytes=${(compiledScript || '').length} templateErr=${templateErr ? templateErr?.message : ''}`);
                                 // Export named render as a function that resolves lazily
                                 outParts.push('export function render(){ const f = (typeof __ns_getRender==="function" ? __ns_getRender() : (typeof __ns_render==="function" ? __ns_render : (__ns_sfc__ && __ns_sfc__.render))); return typeof f === "function" ? f.apply(this, arguments) : undefined; }');
                                 outParts.push('export default __ns_sfc__');
                                 let inlineCode2 = outParts.filter(Boolean).join('\n');
-                                inlineCode2 = processCodeForDevice(inlineCode2, false);
+                                inlineCode2 = processCodeForDevice(inlineCode2, false, true);
                                 try {
                                     inlineCode2 = ensureVersionedCoreImports(inlineCode2, getServerOrigin(server), Number(ver));
                                 }
@@ -4673,12 +5694,11 @@ export const piniaSymbol = p.piniaSymbol;
                     }
                     let asm;
                     if (inlineOk) {
-                        const diagLine = `// diagnostic:inlineOk ver=${ver} inlineBlock=${!!(inlineBlock && inlineBlock.trim())} helperBindingsLen=${helperBindings.length} renderDeclLen=${renderDecl.length}`;
                         if (inlineBlock && inlineBlock.trim()) {
-                            asm = [`// [sfc-asm] ${base} (inlined template body)`, `export * from ${JSON.stringify(scriptUrl)};`, `import * as __script from ${JSON.stringify(scriptUrl)};`, inlineBlock, `const __ns_sfc__ = (__script && __script.default) ? __script.default : {};`, `try { if (typeof __ns_render === 'function' && !__ns_sfc__.render) __ns_sfc__.render = __ns_render; } catch {}`, `export default __ns_sfc__;`, diagLine].join('\n');
+                            asm = [`// [sfc-asm] ${base} (inlined template body)`, `export * from ${JSON.stringify(scriptUrl)};`, `import * as __script from ${JSON.stringify(scriptUrl)};`, inlineBlock, `const __ns_sfc__ = (__script && __script.default) ? __script.default : {};`, `try { if (typeof __ns_render === 'function' && !__ns_sfc__.render) __ns_sfc__.render = __ns_render; } catch {}`, `export default __ns_sfc__;`].join('\n');
                         }
                         else {
-                            asm = [`// [sfc-asm] ${base} (inlined template)`, `export * from ${JSON.stringify(scriptUrl)};`, `import * as __script from ${JSON.stringify(scriptUrl)};`, helperBindings, renderDecl, `const __ns_sfc__ = (__script && __script.default) ? __script.default : {};`, `try { if (typeof __ns_render === 'function' && !__ns_sfc__.render) __ns_sfc__.render = __ns_render; } catch {}`, `export default __ns_sfc__;`, diagLine].filter(Boolean).join('\n');
+                            asm = [`// [sfc-asm] ${base} (inlined template)`, `export * from ${JSON.stringify(scriptUrl)};`, `import * as __script from ${JSON.stringify(scriptUrl)};`, helperBindings, renderDecl, `const __ns_sfc__ = (__script && __script.default) ? __script.default : {};`, `try { if (typeof __ns_render === 'function' && !__ns_sfc__.render) __ns_sfc__.render = __ns_render; } catch {}`, `export default __ns_sfc__;`].filter(Boolean).join('\n');
                         }
                     }
                     else {
@@ -4689,7 +5709,7 @@ export const piniaSymbol = p.piniaSymbol;
                     }
                     // Run full device processing so helper aliasing and globals are consistent in this path too
                     let code = REQUIRE_GUARD_SNIPPET + asm;
-                    code = processCodeForDevice(code, false);
+                    code = processCodeForDevice(code, false, true, /(?:^|\/)node_modules\//.test(base), base);
                     try {
                         code = ensureVersionedCoreImports(code, getServerOrigin(server), Number(ver));
                     }
@@ -4862,7 +5882,7 @@ export const piniaSymbol = p.piniaSymbol;
                                     let code = transformed.code;
                                     // Reuse existing sanitation chain (lightweight)
                                     code = cleanCode(code);
-                                    code = processCodeForDevice(code, false);
+                                    code = processCodeForDevice(code, false, true, /(?:^|\/)node_modules\//.test(resolvedCandidate || spec), resolvedCandidate || spec);
                                     try {
                                         code = ensureVersionedCoreImports(code, getServerOrigin(server), graphVersion);
                                     }
@@ -4917,7 +5937,7 @@ export const piniaSymbol = p.piniaSymbol;
                                             if (depTrans?.code && depResolved) {
                                                 let depCode = depTrans.code;
                                                 depCode = cleanCode(depCode);
-                                                depCode = processCodeForDevice(depCode, false);
+                                                depCode = processCodeForDevice(depCode, false, true, /(?:^|\/)node_modules\//.test(depResolved), depResolved);
                                                 try {
                                                     depCode = ensureVersionedCoreImports(depCode, getServerOrigin(server), graphVersion);
                                                 }
@@ -4950,8 +5970,8 @@ export const piniaSymbol = p.piniaSymbol;
                                                 ts: Date.now(),
                                                 delta: true,
                                             };
-                                            wss.clients.forEach((c) => {
-                                                if (c.readyState === c.OPEN) {
+                                            wss?.clients.forEach((c) => {
+                                                if (isSocketClientOpen(c)) {
                                                     try {
                                                         c.send(JSON.stringify(single));
                                                     }
@@ -4990,32 +6010,33 @@ export const piniaSymbol = p.piniaSymbol;
                     if (verbose)
                         console.warn('[hmr-ws][graph] initial population failed', e);
                 }
-                // Send SFC registry on first connection
-                if (!registrySent) {
-                    try {
-                        await ACTIVE_STRATEGY.buildRegistry({
-                            server,
-                            sfcFileMap,
-                            depFileMap,
-                            wss: wss,
-                            verbose,
-                            helpers: {
-                                cleanCode,
-                                collectImportDependencies,
-                                isCoreGlobalsReference,
-                                isNativeScriptCoreModule,
-                                isNativeScriptPluginModule,
-                                resolveVendorFromCandidate,
-                                createHash: (value) => createHash('md5').update(value).digest('hex'),
-                                rewriteImports,
-                                processSfcCode,
-                            },
-                        });
-                        registrySent = true;
-                    }
-                    catch (error) {
-                        console.warn('[hmr-ws] Failed to send registry:', error);
-                    }
+                // Send SFC registry on every connection (not just the first).
+                // When the NativeScript app restarts (e.g. CLI auto-reload), the new
+                // JS context has an empty sfcArtifactMap. Without the registry the
+                // rescue-mount cannot find the root .vue component.
+                try {
+                    await ACTIVE_STRATEGY.buildRegistry({
+                        server,
+                        sfcFileMap,
+                        depFileMap,
+                        wss: wss,
+                        verbose,
+                        helpers: {
+                            cleanCode,
+                            collectImportDependencies,
+                            isCoreGlobalsReference,
+                            isNativeScriptCoreModule,
+                            isNativeScriptPluginModule,
+                            resolveVendorFromCandidate,
+                            createHash: (value) => createHash('md5').update(value).digest('hex'),
+                            rewriteImports,
+                            processSfcCode,
+                        },
+                    });
+                    registrySent = true;
+                }
+                catch (error) {
+                    console.warn('[hmr-ws] Failed to send registry:', error);
                 }
                 emitFullGraph(ws);
                 // After sending registry & graph also send current module manifest if any
@@ -5038,16 +6059,134 @@ export const piniaSymbol = p.piniaSymbol;
             if (!wss) {
                 return;
             }
+            if (isRuntimeGraphExcludedPath(file)) {
+                return;
+            }
+            // Always-on update timing. Captures the four phases (await,
+            // framework, broadcast, total) plus invalidated module count
+            // and recipient count. Emitted at the end of this function via
+            // `emitHmrUpdateSummary()`. Single line, always-on so a
+            // 6-second `.ts` save is immediately visible without flipping
+            // verbose.
+            const updateRoot = server.config.root || process.cwd();
+            const updateRel = (() => {
+                try {
+                    return '/' + path.posix.normalize(path.relative(updateRoot, file)).split(path.sep).join('/');
+                }
+                catch {
+                    return file;
+                }
+            })();
+            const updateMetrics = {
+                file: updateRel,
+                kind: classifyHmrUpdateKind(file),
+                t0: Date.now(),
+                tAfterAwait: 0,
+                tAfterFramework: 0,
+                tEnd: 0,
+                invalidated: 0,
+                recipients: 0,
+                // Narrowing diagnostic — populated by the angular branch when
+                // the changed file is `.ts`, otherwise remains undefined and is
+                // omitted from the summary line entirely.
+                narrowed: undefined,
+                emitted: false,
+            };
+            // Broadcast a "pending" notification at the very start of
+            // handleHotUpdate so the client can show the HMR-applying
+            // overlay BEFORE we spend time on graph updates / transforms /
+            // dependency analysis (typically 7–200ms on a warm cache).
+            // Without this, the overlay only appears at `ns:angular-update`
+            // broadcast time and the user perceives a "delayed" reaction
+            // to their save.
+            //
+            // Fire-and-forget: a failed pending broadcast must never
+            // hold up the actual update. The client treats receipt of
+            // `ns:angular-update` (or `ns:css-updates`) as authoritative;
+            // the pending message is purely a UX hint.
+            try {
+                const pendingPayload = JSON.stringify(createHmrPendingMessage({
+                    origin: getServerOrigin(server),
+                    path: updateMetrics.file,
+                    kind: updateMetrics.kind,
+                    timestamp: updateMetrics.t0,
+                }));
+                wss.clients.forEach((client) => {
+                    if (isSocketClientOpen(client)) {
+                        try {
+                            client.send(pendingPayload);
+                        }
+                        catch { }
+                    }
+                });
+            }
+            catch { }
+            const emitHmrUpdateSummary = () => {
+                if (updateMetrics.emitted)
+                    return;
+                updateMetrics.emitted = true;
+                updateMetrics.tEnd = Date.now();
+                try {
+                    const awaitMs = (updateMetrics.tAfterAwait || updateMetrics.t0) - updateMetrics.t0;
+                    const frameworkMs = (updateMetrics.tAfterFramework || updateMetrics.tAfterAwait || updateMetrics.t0) - (updateMetrics.tAfterAwait || updateMetrics.t0);
+                    const broadcastMs = updateMetrics.tEnd - (updateMetrics.tAfterFramework || updateMetrics.tAfterAwait || updateMetrics.t0);
+                    const totalMs = updateMetrics.tEnd - updateMetrics.t0;
+                    console.info(formatHmrUpdateSummary({
+                        file: updateMetrics.file,
+                        kind: updateMetrics.kind,
+                        awaitMs,
+                        frameworkMs,
+                        broadcastMs,
+                        totalMs,
+                        invalidated: updateMetrics.invalidated,
+                        recipients: updateMetrics.recipients,
+                        narrowed: updateMetrics.narrowed,
+                    }));
+                }
+                catch { }
+            };
+            // The first /ns/m request kicks off populateInitialGraph in the
+            // background. If an HMR update races in before that walk
+            // completes, we'd lose transitive-importer data. Await
+            // completion here so the delta computation below always sees a
+            // populated graph.
+            if (graphInitialPopulationPromise) {
+                try {
+                    await graphInitialPopulationPromise;
+                }
+                catch { }
+            }
+            updateMetrics.tAfterAwait = Date.now();
             // Graph update for this file change (wrapped to avoid aborting rest of handler)
             try {
-                const mod = server.moduleGraph.getModuleById(file) || server.moduleGraph.getModuleById(file + '?vue');
-                if (mod) {
-                    const deps = Array.from(mod.importedModules)
-                        .map((m) => (m.id || '').replace(/\?.*$/, ''))
-                        .filter(Boolean);
-                    const transformed = await server.transformRequest(mod.id);
-                    const code = transformed?.code || '';
-                    upsertGraphModule((mod.id || '').replace(/\?.*$/, ''), code, deps);
+                const skipAngularHtmlGraphUpdate = ACTIVE_STRATEGY.flavor === 'angular' && /\.(html|htm)$/i.test(file);
+                if (!skipAngularHtmlGraphUpdate) {
+                    const graphTargets = collectGraphUpdateModulesForHotUpdate({
+                        file,
+                        flavor: ACTIVE_STRATEGY.flavor,
+                        modules: ctx.modules,
+                        getModuleById: (id) => server.moduleGraph.getModuleById(id),
+                        verbose,
+                    });
+                    for (const mod of graphTargets) {
+                        if (!mod?.id)
+                            continue;
+                        try {
+                            const deps = Array.from(mod.importedModules || [])
+                                .map((m) => (m.id || '').replace(/\?.*$/, ''))
+                                .filter(Boolean);
+                            const transformed = await server.transformRequest(mod.id);
+                            const code = transformed?.code || '';
+                            upsertGraphModule((mod.id || '').replace(/\?.*$/, ''), code, deps, {
+                                emitDeltaOnInsert: true,
+                                broadcastDelta: ACTIVE_STRATEGY.flavor !== 'angular',
+                            });
+                        }
+                        catch (error) {
+                            if (verbose)
+                                console.warn('[hmr-ws][v2] failed graph update target', mod.id, error);
+                        }
+                    }
                 }
             }
             catch (e) {
@@ -5068,6 +6207,7 @@ export const piniaSymbol = p.piniaSymbol;
                 console.log(`[hmr-ws] Hot update for: ${file}`);
             // Handle CSS updates
             if (file.endsWith('.css')) {
+                updateMetrics.tAfterFramework = Date.now();
                 try {
                     let rel = '/' + path.posix.normalize(path.relative(root, file)).split(path.sep).join('/');
                     const origin = getServerOrigin(server);
@@ -5084,14 +6224,16 @@ export const piniaSymbol = p.piniaSymbol;
                         ],
                     };
                     wss.clients.forEach((client) => {
-                        if (client.readyState === client.OPEN) {
+                        if (isSocketClientOpen(client)) {
                             client.send(JSON.stringify(msg));
+                            updateMetrics.recipients += 1;
                         }
                     });
                 }
                 catch (error) {
                     console.warn('[hmr-ws] CSS update failed:', error);
                 }
+                emitHmrUpdateSummary();
                 return;
             }
             // Framework-specific hot update handling
@@ -5099,31 +6241,281 @@ export const piniaSymbol = p.piniaSymbol;
                 // For Angular, react to component TS or external template HTML changes under /src
                 const isHtml = file.endsWith('.html');
                 const isTs = file.endsWith('.ts');
+                const angularHotUpdateRoots = collectAngularHotUpdateRoots({
+                    file,
+                    modules: ctx.modules,
+                    getModuleById: (id) => server.moduleGraph.getModuleById(id),
+                    getModulesByFile: (targetFile) => server.moduleGraph.getModulesByFile?.(targetFile),
+                });
+                if (verbose) {
+                    console.info(`[ns-hmr-diag][server] hot-update file=${file} isHtml=${isHtml} isTs=${isTs} ctxModules=${Array.from(ctx.modules || []).length} hotUpdateRoots=${angularHotUpdateRoots.length} (${angularHotUpdateRoots
+                        .map((m) => m?.id ?? '(none)')
+                        .slice(0, 8)
+                        .join(', ')}${angularHotUpdateRoots.length > 8 ? ', …' : ''})`);
+                }
                 if (!(isHtml || isTs))
                     return;
+                updateMetrics.invalidated += angularHotUpdateRoots.length;
+                if (angularHotUpdateRoots.length) {
+                    for (const mod of angularHotUpdateRoots) {
+                        try {
+                            server.moduleGraph.invalidateModule(mod);
+                        }
+                        catch (invalidationError) {
+                            if (verbose) {
+                                console.warn('[hmr-ws][angular] hot-update root invalidation failed', mod?.id, invalidationError);
+                            }
+                        }
+                    }
+                    if (verbose) {
+                        console.log('[hmr-ws][angular] invalidated hot-update root modules:', angularHotUpdateRoots.length);
+                    }
+                }
+                const angularTransitiveInvalidationRoots = (angularHotUpdateRoots.length ? angularHotUpdateRoots : ctx.modules);
+                // Read the source for `.ts/.tsx/.js/.jsx` edits so
+                // `shouldInvalidateAngularTransitiveImporters` can
+                // distinguish leaf modules (constants/utils) from real
+                // Angular files. If `ctx.read()` throws (file deleted, race
+                // against the watcher), `angularChangedSource` stays
+                // undefined and we fall back to the conservative "always
+                // invalidate transitively" behavior.
+                let angularChangedSource;
+                if (isTs) {
+                    try {
+                        angularChangedSource = await ctx.read();
+                    }
+                    catch {
+                        angularChangedSource = undefined;
+                    }
+                }
+                const angularNeedsTransitive = shouldInvalidateAngularTransitiveImporters({
+                    flavor: ACTIVE_STRATEGY.flavor,
+                    file,
+                    source: angularChangedSource,
+                });
+                // Surface the narrowing decision on every `.ts` Angular hot
+                // update (HTML routes always invalidate transitively and
+                // aren't subject to narrowing, so we leave them as
+                // `undefined` — the field is omitted from the summary line).
+                // The boolean is the inverse of `angularNeedsTransitive`
+                // because "needs transitive" is the broad (un-narrowed)
+                // behavior.
+                if (isTs) {
+                    updateMetrics.narrowed = !angularNeedsTransitive;
+                }
+                // Stable URL + Explicit Invalidation:
+                //
+                // Compute the transitive importer closure ONCE here and reuse
+                // it for (a) `server.moduleGraph.invalidateModule` (so Vite's
+                // transform pipeline re-runs on next request), (b) the shared
+                // transform-request cache, and (c) the runtime eviction set
+                // we broadcast in `ns:angular-update`. Consolidating this
+                // removes a redundant graph walk and guarantees the three
+                // consumers see the exact same set of importers (otherwise a
+                // late module-graph mutation between calls could leave an
+                // asymmetric narrowed/broad mix).
+                //
+                // We separate Vite-transform narrowing from runtime eviction:
+                // `angularNeedsTransitive` answers the question "does the
+                // changed file's symbol shape change such that importers
+                // must be re-transformed by Vite?". The runtime, however,
+                // has a stricter requirement: ESM live bindings only refresh
+                // if the importing module re-evaluates inside V8. A
+                // constants file with no Angular decorator does NOT need a
+                // Vite re-transform of its importers (their compiled JS is
+                // identical), but its importers still hold stale bindings to
+                // the OLD constants Module record. After eviction + re-import
+                // of `main.ts`, V8 sees the cached importers, returns them
+                // unchanged, and they continue to read the OLD values. The
+                // user-visible symptom: HMR completes successfully, logs are
+                // clean, but the simulator does not reflect the change.
+                //
+                // The fix: ALWAYS compute the transitive importer closure
+                // for runtime eviction. Only skip Vite's
+                // `moduleGraph.invalidate` + transform-cache purge when
+                // `angularNeedsTransitive` is false — those are the genuine
+                // narrowing wins (saves re-transform work on the server).
+                // The eviction set always includes importers so V8 re-fetches
+                // and re-binds them.
+                if (verbose) {
+                    console.info(`[ns-hmr-diag][server] angularNeedsTransitive=${angularNeedsTransitive} (file=${path.basename(file)})`);
+                }
+                let transitiveImporters = [];
+                try {
+                    transitiveImporters = collectAngularTransitiveImportersForInvalidation({
+                        modules: angularTransitiveInvalidationRoots,
+                        isExcluded: (id) => id.includes('/node_modules/'),
+                        maxDepth: 16,
+                    });
+                    if (verbose) {
+                        console.info(`[ns-hmr-diag][server] transitiveImporters count=${transitiveImporters.length} firstN=`, transitiveImporters.slice(0, 16).map((m) => m?.id ?? '(none)'));
+                    }
+                    if (angularNeedsTransitive) {
+                        updateMetrics.invalidated += transitiveImporters.length;
+                        for (const mod of transitiveImporters) {
+                            try {
+                                server.moduleGraph.invalidateModule(mod);
+                            }
+                            catch (invalidationError) {
+                                if (verbose) {
+                                    console.warn('[hmr-ws][angular] transitive importer invalidation failed', mod?.id, invalidationError);
+                                }
+                            }
+                        }
+                        if (verbose && transitiveImporters.length) {
+                            console.log('[hmr-ws][angular] invalidated transitive importers:', transitiveImporters.length);
+                        }
+                    }
+                    else if (isTs && typeof angularChangedSource === 'string') {
+                        // Surfacing this log unconditionally lets the user
+                        // immediately confirm whether narrowing fired for a
+                        // given `.ts` edit (the summary line below still
+                        // emits `narrowed=yes`/`no`, but having both makes
+                        // the decision easier to spot in noisy logs and lets
+                        // the user diff scenarios without flipping
+                        // `NS_HMR_VERBOSE=true`).
+                        //
+                        // Narrowing means "skip Vite re-transform" (the
+                        // importers still get evicted from the V8 module
+                        // registry so live bindings refresh). The importer
+                        // count is appended so the distinction is visible.
+                        console.log(`[hmr-ws][angular] narrowed transitive invalidation (no @Component/@Directive/@Pipe/@Injectable/@NgModule): ${updateRel} — Vite transform skipped, runtime eviction includes ${transitiveImporters.length} importer(s)`);
+                    }
+                }
+                catch (error) {
+                    if (verbose)
+                        console.warn('[hmr-ws][angular] transitive importer collection failed', error);
+                }
+                try {
+                    // Purge shared transform cache for the changed file +
+                    // hot-update roots unconditionally (their transform
+                    // output IS different now). Transitive importers are
+                    // only purged when narrowing decides their output may
+                    // have changed; otherwise their cached transforms are
+                    // still valid (compiled JS is identical even though the
+                    // runtime must re-evaluate them to refresh ESM bindings).
+                    const transformCacheInvalidationUrls = new Set(collectAngularTransformCacheInvalidationUrls({
+                        file,
+                        isTs,
+                        hotUpdateRoots: angularHotUpdateRoots,
+                        transitiveImporters: angularNeedsTransitive ? transitiveImporters : [],
+                        projectRoot: server.config.root || process.cwd(),
+                    }));
+                    if (transformCacheInvalidationUrls.size) {
+                        sharedTransformRequest.invalidateMany(transformCacheInvalidationUrls);
+                        if (verbose) {
+                            console.log('[hmr-ws][angular] purged shared transform cache entries:', transformCacheInvalidationUrls.size);
+                        }
+                    }
+                }
+                catch (error) {
+                    if (verbose)
+                        console.warn('[hmr-ws][angular] shared transform cache purge failed', error);
+                }
+                updateMetrics.tAfterFramework = Date.now();
                 try {
                     const root = server.config.root || process.cwd();
                     const rel = '/' + path.posix.normalize(path.relative(root, file)).split(path.sep).join('/');
+                    rememberAngularReloadSuppression(root, file);
                     const origin = getServerOrigin(server);
+                    const bootstrapEntryRel = getBootstrapEntryRelPath();
+                    // Stable URL + Explicit Invalidation:
+                    //
+                    // `evictPaths` is the canonical list of `/ns/m/<rel>` URLs
+                    // the runtime must drop from `g_moduleRegistry` before
+                    // re-importing `importerEntry`. Older versions of the
+                    // server signaled invalidation by bumping a global
+                    // `graphVersion` counter and embedding it in every URL —
+                    // but V8 keys the module registry by full URL, so a v1 →
+                    // v2 bump effectively flushed the entire dependency
+                    // graph from the cache and forced the runtime to
+                    // re-fetch + re-eval every transitively-imported module
+                    // on each save (~3s HMR cycles, dominated by Vite's
+                    // single-threaded transform pipeline). The new model:
+                    //
+                    //   1. URLs are stable: `/ns/m/<rel>` everywhere, no `vN`.
+                    //   2. The server walks the inverse-dependency closure and
+                    //      sends only the modules that actually need to be
+                    //      re-evaluated (typically O(1) for component edits,
+                    //      or the changed file + entry for narrowed edits).
+                    //   3. The client calls `__nsInvalidateModules(evictPaths)`
+                    //      and re-imports `importerEntry`, which causes V8 to
+                    //      refetch ONLY those modules. Everything else stays
+                    //      hot in the registry.
+                    //
+                    // Invariants enforced by `collectAngularEvictionUrls`:
+                    //   - Always includes the changed file (so the new source
+                    //     is fetched).
+                    //   - Always includes `importerEntry` (so re-import
+                    //     re-evaluates).
+                    //   - Excludes node_modules (vendor packages are stable).
+                    //   - Excludes virtual / runtime-graph-excluded ids.
+                    //   - Origin-prefixed: `http://host:port/ns/m/<rel>`.
+                    let evictPaths = [];
+                    try {
+                        evictPaths = collectAngularEvictionUrls({
+                            file,
+                            hotUpdateRoots: angularHotUpdateRoots,
+                            transitiveImporters,
+                            projectRoot: root,
+                            origin,
+                            bootstrapEntry: bootstrapEntryRel,
+                        });
+                    }
+                    catch (error) {
+                        if (verbose) {
+                            console.warn('[ns-hmr-diag][server] eviction set computation failed', error);
+                        }
+                    }
+                    if (verbose) {
+                        try {
+                            const tsRel = rel.replace(/\.(html|htm)$/i, '.ts');
+                            const jsRel = rel.replace(/\.(html|htm)$/i, '.js');
+                            const containsRelatedTs = evictPaths.some((u) => u.endsWith(tsRel));
+                            const containsRelatedJs = evictPaths.some((u) => u.endsWith(jsRel));
+                            const sample = evictPaths.slice(0, 32);
+                            console.info(`[ns-hmr-diag][server] evict-set count=${evictPaths.length} importerEntry=${bootstrapEntryRel ?? '(none)'} containsRelatedTs=${containsRelatedTs} containsRelatedJs=${containsRelatedJs} firstN=`, sample);
+                            if (evictPaths.length > sample.length) {
+                                console.info(`[ns-hmr-diag][server] evict-set hidden=${evictPaths.length - sample.length} (showed first ${sample.length})`);
+                            }
+                        }
+                        catch { }
+                    }
                     const msg = {
                         type: 'ns:angular-update',
                         origin,
                         path: rel,
+                        version: graphVersion,
                         timestamp: Date.now(),
+                        evictPaths,
+                        importerEntry: bootstrapEntryRel,
                     };
+                    if (verbose) {
+                        console.log('[hmr-ws][angular] broadcasting update', Array.from(wss.clients || []).map((client) => ({
+                            role: getHmrSocketRole(client),
+                            readyState: client.readyState,
+                            openState: client.OPEN,
+                        })));
+                    }
                     wss.clients.forEach((client) => {
-                        if (client.readyState === client.OPEN) {
+                        if (isSocketClientOpen(client)) {
                             client.send(JSON.stringify(msg));
+                            updateMetrics.recipients += 1;
                         }
                     });
                 }
                 catch (error) {
                     console.warn('[hmr-ws][angular] update failed:', error);
                 }
+                emitHmrUpdateSummary();
+                if (shouldSuppressDefaultViteHotUpdate({ flavor: ACTIVE_STRATEGY.flavor, file })) {
+                    return [];
+                }
                 return;
             }
             // TypeScript flavor: emit generic graph delta for app XML/TS/style changes
             if (ACTIVE_STRATEGY.flavor === 'typescript') {
+                updateMetrics.tAfterFramework = Date.now();
                 try {
                     const rel = '/' + path.posix.normalize(path.relative(root, file)).split(path.sep).join('/');
                     if (verbose)
@@ -5131,15 +6523,52 @@ export const piniaSymbol = p.piniaSymbol;
                     // Treat the changed file itself as a graph module with no deps. We only
                     // care that its hash/identity changes so the client sees a delta and can
                     // perform a TS root reset. Code is not used for execution here.
-                    upsertGraphModule(rel, '', []);
-                    const gm = graph.get(normalizeGraphId(rel));
-                    if (gm)
-                        emitDelta([gm], []);
+                    upsertGraphModule(rel, '', [], { emitDeltaOnInsert: true });
                 }
                 catch (e) {
                     if (verbose)
                         console.warn('[hmr-ws][ts] failed to emit delta for', file, e);
                 }
+                emitHmrUpdateSummary();
+                return;
+            }
+            // Solid flavor: emit graph delta for app TSX/TS/JSX file changes.
+            // The common graph-update block above (moduleGraph lookup) may have
+            // already emitted a delta if the file was in Vite's module graph.
+            // This handler ensures a delta is emitted even if the module wasn't
+            // found (e.g. new file, or moduleGraph mismatch), and provides
+            // Solid-specific logging. The client-side processQueue handles
+            // propagation from non-component .ts files to .tsx component boundaries.
+            if (ACTIVE_STRATEGY.flavor === 'solid') {
+                const isSolidFile = /\.(tsx?|jsx?)$/i.test(file);
+                if (!isSolidFile)
+                    return;
+                updateMetrics.tAfterFramework = Date.now();
+                try {
+                    const rel = '/' + path.posix.normalize(path.relative(root, file)).split(path.sep).join('/');
+                    if (verbose)
+                        console.log('[hmr-ws][solid] app file hot update', { file, rel });
+                    // If the common block already upserted (hash changed), this will
+                    // detect unchanged hash and no-op. If the common block missed it
+                    // (module not in Vite's graph), this forces the delta emission.
+                    const normalizedId = normalizeGraphId(rel);
+                    const existing = graph.get(normalizedId);
+                    if (!existing) {
+                        // Module not in graph yet — force upsert with timestamp-based
+                        // hash so the client sees a change.
+                        upsertGraphModule(rel, `/* solid-hmr ${Date.now()} */`, [], { emitDeltaOnInsert: true });
+                    }
+                    // Log what we're sending so devs can trace the flow on the server side.
+                    if (verbose) {
+                        const gm = graph.get(normalizedId);
+                        console.log('[hmr-ws][solid] delta module', { id: gm?.id, hash: gm?.hash });
+                    }
+                }
+                catch (e) {
+                    if (verbose)
+                        console.warn('[hmr-ws][solid] failed to handle hot update for', file, e);
+                }
+                emitHmrUpdateSummary();
                 return;
             }
             // Handle .vue file updates
@@ -5148,7 +6577,8 @@ export const piniaSymbol = p.piniaSymbol;
                     console.log('[hmr-ws] Not a .vue file, skipping');
                 return;
             }
-            console.log('[hmr-ws] Processing .vue file update...');
+            if (verbose)
+                console.log('[hmr-ws] Processing .vue file update...');
             try {
                 const root = server.config.root || process.cwd();
                 let rel = '/' + path.posix.normalize(path.relative(root, file)).split(path.sep).join('/');
@@ -5249,6 +6679,7 @@ export const piniaSymbol = p.piniaSymbol;
                 // Rewrite ONLY .vue imports (everything else is now inlined)
                 const projectRoot = server.config.root || process.cwd();
                 code = rewriteImports(code, rel, sfcFileMap, depFileMap, projectRoot, opts.verbose, undefined);
+                upsertGraphModule(rel, code, [...deps, ...vueDeps]);
                 // Add HMR runtime prelude (CRITICAL for runtime)
                 const hmrPrelude = `
 // Embedded HMR Runtime for NativeScript runtime
@@ -5291,7 +6722,7 @@ if (typeof __VUE_HMR_RUNTIME__ === 'undefined') {
         if (typeof spec === 'string' && /^(?:https?:)\/\//.test(spec)) {
           const err = new Error('[ns-hmr][require-guard] require of URL: ' + spec + ' via ' + label);
           const stack = err.stack || '';
-          try { console.error(err.message + '\n' + stack); } catch {}
+          console.error(err.message + '\n' + stack);
           try { g.__NS_REQUIRE_GUARD_LAST__ = { spec, stack, label, ts: Date.now() }; } catch {}
         }
       } catch {}
@@ -5324,7 +6755,7 @@ if (typeof __VUE_HMR_RUNTIME__ === 'undefined') {
                     version: graphVersion,
                 };
                 wss.clients.forEach((client) => {
-                    if (client.readyState === client.OPEN) {
+                    if (isSocketClientOpen(client)) {
                         client.send(JSON.stringify(registryUpdateMsg));
                     }
                 });
@@ -5424,6 +6855,10 @@ if (typeof __VUE_HMR_RUNTIME__ === 'undefined') {
                 console.warn('[hmr-ws] HMR update failed:', error);
                 console.error(error);
             }
+            // Vue path emits update summary at the end of the function so
+            // every framework branch gets exactly one log line. Idempotent
+            // — if any branch already emitted, this is a no-op.
+            emitHmrUpdateSummary();
             // CRITICAL: Return empty array to prevent Vite's default HMR
             return [];
         },
@@ -5495,4 +6930,6 @@ function getServerOrigin(server) {
 // Test-only export: allow unit tests to run the sanitizer on snippets without booting a server
 // Safe in production builds; this is a named export that tests can import explicitly.
 export const __test_processCodeForDevice = processCodeForDevice;
+export const __test_resolveVendorRouting = resolveVendorRouting;
+export const __test_getBlockedDeviceNodeModulesReason = getBlockedDeviceNodeModulesReason;
 //# sourceMappingURL=websocket.js.map