@nativescript/vite 8.0.0-alpha.14 → 8.0.0-alpha.16

package/hmr/server/websocket.js

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-import { normalizeStrayCoreStringLiterals, fixDanglingCoreFrom, normalizeAnyCoreSpecToBridge, isDeepCoreSubpath, rewriteSpecifiersForDevice } from './core-sanitize.js';
+import { sanitizeStrayCoreReferences, isDeepCoreSubpath, rewriteSpecifiersForDevice } from './core-sanitize.js';
 import { buildDefaultExportFooter, buildShapeInstallHeader, hasNamespaceReExport, rewriteNamespaceReExportsForShape } from './ns-core-cjs-shape.js';
 // AST tooling for robust transformations
 import { parse as babelParse } from '@babel/parser';
@@ -33,7 +33,7 @@ import { astExtractImportsAndStripTypes } from '../helpers/ast-extract.js';
 import { getProjectAppPath, getProjectAppRelativePath, getProjectAppVirtualPath } from '../../helpers/utils.js';
 import { buildRuntimeConfig, generateImportMap } from './import-map.js';
 import { getCliFlags } from '../../helpers/cli-flags.js';
-import { normalizeCoreSub as normalizeCoreSubCanonical } from '../../helpers/ns-core-url.js';
+import { buildCoreUrl, buildCoreUrlPath, normalizeCoreSub as normalizeCoreSubCanonical } from '../../helpers/ns-core-url.js';
 import { isRuntimeGraphExcludedPath, matchesRuntimeGraphModuleId, normalizeRuntimeGraphPath, shouldIncludeRuntimeGraphFile, shouldSkipRuntimeGraphDirectoryName } from './runtime-graph-filter.js';
 import { resolveAngularCoreHmrImportSource, rewriteAngularEntryRegisterOnly } from './websocket-angular-entry.js';
 import { angularSourceHasSemanticDecorator, canonicalizeTransformRequestCacheKey, collectAngularEvictionUrls, collectAngularHotUpdateRoots, collectAngularTransformCacheInvalidationUrls, collectAngularTransitiveImportersForInvalidation, collectGraphUpdateModulesForHotUpdate, normalizeHotReloadMatchPath, shouldInvalidateAngularTransitiveImporters, shouldSuppressDefaultViteHotUpdate, shouldSuppressViteFullReloadPayload } from './websocket-angular-hot-update.js';
@@ -43,13 +43,13 @@ import { classifyBootRoute, classifyHmrUpdateKind, createColdBootRequestCounter,
 import { createHmrPendingMessage } from './websocket-hmr-pending.js';
 import { extractVitePrebundleId, filterExistingNodeModulesTransformCandidates, getBlockedDeviceNodeModulesReason, getFlattenedManifestMap, isCoreGlobalsReference, isEsmFrameworkPackageSpecifier, isLikelyNativeScriptPluginSpecifier, isLikelyNativeScriptRuntimePluginSpecifier, isNativeScriptCoreModule, isNativeScriptPluginModule, normalizeNativeScriptCoreSpecifier, normalizeNodeModulesSpecifier, resolveCandidateFilePath, resolveInternalRuntimePluginBareSpecifier, resolveNodeModulesPackageBoundary, resolveVendorFromCandidate, resolveVendorRouting, rewriteFsAbsoluteToNsM, shouldPreserveBareRuntimePluginSubpathImport, stripDecoratedServePrefixes, tryReadRawExplicitJavaScriptModule, viteDepsPathToBareSpecifier, } from './websocket-module-specifiers.js';
 import { ensureNativeScriptModuleBindings, getProcessCodeResolvedSpecifierOverrides } from './websocket-module-bindings.js';
-import { collectStaticExportNamesFromFile, collectStaticExportOriginsFromFile, ensureVersionedCoreImports, extractDirectExportedNames, normalizeCoreExportOriginsForRuntime, parseCoreBridgeRequest, resolveRuntimeCoreModulePath } from './websocket-core-bridge.js';
+import { collectStaticExportNamesFromFile, collectStaticExportOriginsFromFile, extractDirectExportedNames, normalizeCoreExportOriginsForRuntime, parseCoreBridgeRequest, resolveRuntimeCoreModulePath } from './websocket-core-bridge.js';
 import { createSharedTransformRequestRunner } from './shared-transform-request.js';
 import { formatNsMHmrServeTag, getNumericServeVersionTag, rewriteNsMImportPathForHmr } from './websocket-ns-m-paths.js';
 import { ensureDynamicHmrImportHelper } from './websocket-served-module-helpers.js';
 export { ensureNativeScriptModuleBindings, getProcessCodeResolvedSpecifierOverrides } from './websocket-module-bindings.js';
 export { stripDecoratedServePrefixes, tryReadRawExplicitJavaScriptModule } from './websocket-module-specifiers.js';
-export { collectStaticExportNamesFromFile, collectStaticExportOriginsFromFile, ensureVersionedCoreImports, normalizeCoreExportOriginsForRuntime, parseCoreBridgeRequest } from './websocket-core-bridge.js';
+export { collectStaticExportNamesFromFile, collectStaticExportOriginsFromFile, normalizeCoreExportOriginsForRuntime, parseCoreBridgeRequest } from './websocket-core-bridge.js';
 export { rewriteAngularEntryRegisterOnly } from './websocket-angular-entry.js';
 // Re-export the canonical URL rewriter from `websocket-ns-m-paths.js` so the
 // existing test suites (which import from `./websocket.js`) keep working
@@ -458,8 +458,7 @@ function stripViteDynamicImportVirtual(code) {
 // is install-once-per-isolate, dedupes per-URL (so semver's ~30 deep
 // imports produce ~30 lines on the first boot and 0 on subsequent
 // boots within the same isolate), and uses `console.warn` so the
-// message reads as advisory (the round-3 finding in
-// LATEST-05-07-2026-HMR_ANGULAR_DEBUG_SESSION.md). Forensic detail
+// message reads as advisory. Forensic detail
 // (stack) lives on `globalThis.__NS_REQUIRE_GUARD_LAST__` for
 // post-mortem inspection. Set `globalThis.__NS_REQUIRE_GUARD_VERBOSE__`
 // to `true` before any module loads to restore per-call logging.
@@ -1209,6 +1208,22 @@ function processCodeForDevice(code, isVitePreBundled, preserveVendorImports = fa
     // Running the normalizer on libraries like tslib injects harmful destructures
     // (e.g., `const { SuppressedError } = __ns_rt_ns_1`) that shadow globals.
     if (!isNodeModule) {
+        // CRITICAL ORDERING: canonicalise any bare `@nativescript/core[/sub]`
+        // specifiers to `/ns/core[/sub]` BEFORE the AST normaliser sees them.
+        // `astNormalizeModuleImportsAndHelpers` defensively rewrites bare
+        // `@nativescript/core` imports and emits a one-shot
+        // `[ast-normalizer] unexpected @nativescript/core spec` warning —
+        // the warning means the upstream rewriter regressed. For Vue SFC
+        // `<script>` blocks the bare specifier flows through Vite's
+        // transform pipeline without a per-statement source-string rewrite
+        // (Vite's resolver only edits the module graph, not the emitted
+        // code), so the only upstream rewriter that can canonicalise these
+        // in dev mode is this regex sweep. Running it here keeps the AST
+        // normaliser purely a tripwire instead of an active rewriter.
+        try {
+            result = sanitizeStrayCoreReferences(result);
+        }
+        catch { }
         try {
             result = astNormalizeModuleImportsAndHelpers(result);
         }
@@ -1413,8 +1428,7 @@ function processCodeForDevice(code, isVitePreBundled, preserveVendorImports = fa
         const vendorCoreRE1 = /globalThis\.__nsVendor\s*\(\s*["']@nativescript\/core["']\s*\)/g;
         const vendorCoreRE2 = /__nsVendor\s*\(\s*["']@nativescript\/core["']\s*\)/g;
         if (vendorCoreRE1.test(result) || vendorCoreRE2.test(result)) {
-            // Ensure an import for the core bridge exists
-            const hasImport = /import\s+__ns_core_bridge\s+from\s+["'][^"']*\/(?:\@ns|ns)\/core(?:\/[\d]+)?(?:\?p=[^"']+)?["']\s*;?/.test(result) || /(^|\n)\s*import\s+__ns_core_bridge\s+from\s+["']\/(?:\@ns|ns)\/core["']\s*;?/m.test(result);
+            const hasImport = /import\s+__ns_core_bridge\s+from\s+["'][^"']*\/(?:\@ns|ns)\/core(?:\/[^"']+)?["']\s*;?/.test(result) || /(^|\n)\s*import\s+__ns_core_bridge\s+from\s+["']\/(?:\@ns|ns)\/core["']\s*;?/m.test(result);
             if (!hasImport) {
                 result = `import __ns_core_bridge from "/ns/core";\n` + result;
             }
@@ -1428,7 +1442,7 @@ function processCodeForDevice(code, isVitePreBundled, preserveVendorImports = fa
         const reqCoreRE1 = /(^|[^.\w$])require\(\s*["']@nativescript\/core([^"'\n]*)["']\s*\)/g;
         const reqCoreRE2 = /(?:globalThis|window|self)\.require\(\s*["']@nativescript\/core([^"'\n]*)["']\s*\)/g;
         if (reqCoreRE1.test(result) || reqCoreRE2.test(result)) {
-            const hasImport = /import\s+__ns_core_bridge\s+from\s+["'][^"']*\/(?:\@ns|ns)\/core(?:\/[\d]+)?(?:\?p=[^"']+)?["']\s*;?/.test(result) || /(^|\n)\s*import\s+__ns_core_bridge\s+from\s+["']\/(?:\@ns|ns)\/core["']\s*;?/m.test(result);
+            const hasImport = /import\s+__ns_core_bridge\s+from\s+["'][^"']*\/(?:\@ns|ns)\/core(?:\/[^"']+)?["']\s*;?/.test(result) || /(^|\n)\s*import\s+__ns_core_bridge\s+from\s+["']\/(?:\@ns|ns)\/core["']\s*;?/m.test(result);
             if (!hasImport) {
                 result = `import __ns_core_bridge from "/ns/core";\n` + result;
             }
@@ -1437,21 +1451,11 @@ function processCodeForDevice(code, isVitePreBundled, preserveVendorImports = fa
         }
     }
     catch { }
-    // Normalize stray string-literal side-effect lines that still reference @nativescript/core
-    // into proper imports of the unified core bridge. This prevents the local-core-path
-    // fast-fail from triggering due to upstream transforms that emitted naked literals.
-    try {
-        result = normalizeStrayCoreStringLiterals(result);
-    }
-    catch { }
-    try {
-        result = fixDanglingCoreFrom(result);
-    }
-    catch { }
-    try {
-        result = normalizeAnyCoreSpecToBridge(result);
-    }
-    catch { }
+    // Apply the three-pass safety net for stray @nativescript/core references
+    // (naked string literals, dangling `from` merges, lingering resolved-path
+    // references). Centralised in core-sanitize.sanitizeStrayCoreReferences so
+    // every NS-M emitter applies the same passes in the same order.
+    result = sanitizeStrayCoreReferences(result);
     result = ensureVariableDynamicImportHelper(result);
     // Normalize any lingering @nativescript/core imports to the /ns/core bridge (non-destructive best-effort)
     try {
@@ -1468,7 +1472,7 @@ function processCodeForDevice(code, isVitePreBundled, preserveVendorImports = fa
                 return m.length === 2 ? `${m[0].trim()}: ${m[1].trim()}` : seg;
             })
                 .join(', ');
-            const reNamed = /(^|\n)\s*import\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[\d]+)?(?:\?p=[^"']+)?)['"];?\s*/gm;
+            const reNamed = /(^|\n)\s*import\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[^"']+)?)['"];?\s*/gm;
             result = result.replace(reNamed, (_full, pfx, specList, src) => {
                 // Deep subpath URLs serve actual ESM with real named exports — skip.
                 if (isDeepCoreSubpath(src))
@@ -1478,7 +1482,7 @@ function processCodeForDevice(code, isVitePreBundled, preserveVendorImports = fa
                 const decl = `const { ${toDestructureCore(specList)} } = ${tmp};`;
                 return `${pfx}import ${tmp} from ${JSON.stringify(src)};\n${decl}\n`;
             });
-            const reMixed = /(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*,\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[\d]+)?(?:\?p=[^"']+)?)['"];?\s*/gm;
+            const reMixed = /(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*,\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[^"']+)?)['"];?\s*/gm;
             result = result.replace(reMixed, (_full, pfx, defName, specList, src) => {
                 if (isDeepCoreSubpath(src))
                     return _full;
@@ -1723,7 +1727,10 @@ function assertNoOptimizedArtifacts(code, contextLabel) {
     }
 }
 // Ensure there are no lingering named imports from the unified core bridge.
-// Converts named imports from /ns/core[/ver][?p=...] into default import + destructuring.
+// Converts named imports from `/ns/core[/<sub>]` into default import +
+// destructuring. The package-main bridge serves a shape-shifted module whose
+// named exports come from `__ns_core_bridge.default` rather than ESM named
+// exports, so a named-import binding would be `undefined` at evaluation.
 function ensureDestructureCoreImports(code) {
     try {
         let result = code;
@@ -1737,8 +1744,8 @@ function ensureDestructureCoreImports(code) {
             return m.length === 2 ? `${m[0].trim()}: ${m[1].trim()}` : seg;
         })
             .join(', ');
-        // import { A, B } from '/ns/core[/ver][?p=...]'
-        const reNamed = /(^|\n)\s*import\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[\d]+)?(?:\?p=[^"']+)?)['"];?\s*/gm;
+        // import { A, B } from '/ns/core[/<sub>]'
+        const reNamed = /(^|\n)\s*import\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[^"']+)?)['"];?\s*/gm;
         result = result.replace(reNamed, (_full, pfx, specList, src) => {
             // Deep subpath URLs serve actual ESM with real named exports — skip.
             if (isDeepCoreSubpath(src))
@@ -1748,8 +1755,8 @@ function ensureDestructureCoreImports(code) {
             const decl = `const { ${toDestructure(specList)} } = ${tmp};`;
             return `${pfx}import ${tmp} from ${JSON.stringify(src)};\n${decl}\n`;
         });
-        // import Default, { A, B } from '/ns/core[...]'
-        const reMixed = /(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*,\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[\d]+)?(?:\?p=[^"']+)?)['"];?\s*/gm;
+        // import Default, { A, B } from '/ns/core[/<sub>]'
+        const reMixed = /(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*,\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[^"']+)?)['"];?\s*/gm;
         result = result.replace(reMixed, (_full, pfx, defName, specList, src) => {
             if (isDeepCoreSubpath(src))
                 return _full;
@@ -1866,6 +1873,27 @@ function dedupeRtNamedImportsAgainstDestructures(code) {
  */
 export function rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot, verbose = false, outputDirOverrideRel, httpOrigin, resolveVendorAsHttp = false) {
     let result = code;
+    // Pre-normalize concatenated imports onto their own lines.
+    //
+    // Babel's `genCode(ast, { retainLines: true })` in
+    // `astNormalizeModuleImportsAndHelpers` (which runs before us in the SFC
+    // asm pipeline, and in several other hot paths) can emit multiple
+    // statements on a single line, e.g.:
+    //   `} = __ns_rt_ns_1;import { $goTo } from "../utils";import PageWrapper from ...;`
+    //
+    // IMPORT_PATTERN_1/_2/_3/SIDE_EFFECT all anchor on `(?:^|\n)\s*import`,
+    // so any import past the first one on a single line is silently dropped
+    // by the rewriter. Downstream that leaves bare relative specifiers like
+    // `../utils` to be resolved by the iOS HTTP ESM loader, which interprets
+    // them relative to the `/ns/asm/0?path=...` URL and 404s on the
+    // resulting `/ns/utils`. Splitting `;import` onto its own line makes the
+    // existing patterns match every import, restoring the rewrite contract.
+    //
+    // Mirrors the same normalization already performed in
+    // `core-sanitize.ts::normalizeStrayCoreStringLiterals` (`;\s*import` →
+    // `;\nimport`) but applied universally at the rewriter entry point so
+    // every caller benefits without having to opt in.
+    result = result.replace(/;\s*import\s+/g, ';\nimport ');
     const httpOriginSafe = httpOrigin;
     const mixedRuntimePluginHttpRootPackages = collectMixedRuntimePluginHttpRootPackages(result, projectRoot);
     const isDynamicImportPrefix = (prefix) => /import\(\s*["']?$/.test(prefix.trimStart());
@@ -1883,10 +1911,31 @@ export function rewriteImports(code, importerPath, sfcFileMap, depFileMap, proje
     try {
         let coreAliasIdx = 0;
         const mkAlias = () => `__NSC${coreAliasIdx++}`;
-        const coreUrl = (sub) => {
-            const p = (sub || '').replace(/^\//, '');
-            return `${httpOriginSafe || ''}/ns/core` + (p ? `?p=${p}` : '');
-        };
+        // Use the canonical PATH form `/ns/core/<sub>`. The iOS HTTP ESM
+        // loader caches module records by URL string — every emitter
+        // (`buildCoreUrl()` / `buildCoreUrlPath()`, the runtime import map,
+        // vendor `require()` shims, app-side rewrites, the cold-boot
+        // preload in `entry-runtime.ts`) MUST produce the same byte
+        // string for the same logical core subpath. A divergence creates
+        // two distinct V8 module records for the same source. Each gets
+        // its own class
+        // identities (TextBase, View, etc.), and side-effect patches
+        // applied to one (e.g. @nativescript-community/text's
+        // `TextBase.prototype.setTextDecorationAndTransform` override
+        // installed when vendor.mjs evaluates `overrideSpanAndFormattedString()`
+        // from `@nativescript-community/ui-label/index-common.js`) are
+        // invisible to the other — manifesting as inconsistent line-height /
+        // letter-spacing rendering between HMR and no-HMR.
+        //
+        // Mirrors `normalizeCoreSub()` (helpers/ns-core-url.ts) so the URL
+        // produced here is byte-identical to what `buildCoreUrl()` produces
+        // for the bundle entry, import map, and external-urls plugin.
+        // Delegate to the ONE canonical URL builder so every emitter (this
+        // rewriter, core-sanitize, the runtime import map, the ns-core-external-urls
+        // build plugin, and main-entry) produces byte-identical URLs for
+        // the same logical core module. Any drift here would re-introduce
+        // the realm-split bug.
+        const coreUrl = (sub) => (httpOriginSafe ? buildCoreUrl(httpOriginSafe, sub) : buildCoreUrlPath(sub));
         // Case 1: import { A, B } from '@nativescript/core[/sub]'
         result = result.replace(/(^|\n)\s*import\s*\{\s*([^}]+?)\s*\}\s*from\s+["']@nativescript\/core([^"'\n]*)["'];?/g, (_m, pfx, names, sub) => {
             const alias = mkAlias();
@@ -2238,6 +2287,40 @@ export function rewriteImports(code, importerPath, sfcFileMap, depFileMap, proje
                 return `${prefix}./${depFile}${suffix}`;
             }
         }
+        // ── Bare specifier vendor routing ────────────────────────────
+        // Bare specifiers like `pinia`, `dayjs`, `lodash` never reach
+        // the `nodeModulesSpecifier` branch above because
+        // `normalizeNodeModulesSpecifier` keys on a literal
+        // `/node_modules/` segment in the path. Without this check
+        // they'd fall straight into the HTTP fallback below and get
+        // rewritten to `/ns/m/node_modules/<spec>`, which serves the
+        // package source over HTTP and bypasses the device-side import
+        // map's `<pkg>` → `ns-vendor://<pkg>` entry. For CJS/UMD
+        // packages (e.g. Pinia) the bare HTTP path doesn't expose the
+        // full named-exports surface (only the default export round-
+        // trips), so consumers like
+        // `import { defineStore } from "pinia"` blow up at instantiate
+        // time with `SyntaxError: ... does not provide an export named
+        // 'defineStore'`. Preserving the bare spec lets the vendor
+        // bridge serve it from the prebuilt `bundle.mjs`, which already
+        // re-exports the full CJS surface. Subpath imports
+        // (`pinia/plugins/foo`) intentionally fall through to the
+        // HTTP fallback — `resolveVendorRouting` returns
+        // `{ route: 'http' }` for non-main-entry subpaths even when the
+        // root package is in the manifest, mirroring the
+        // `nodeModulesSpecifier` branch.
+        if (spec && !spec.startsWith('/') && !spec.startsWith('./') && !spec.startsWith('../') && !/^https?:\/\//i.test(spec) && !spec.startsWith('ns-vendor:') && !spec.startsWith('@nativescript/core')) {
+            const bareNpmRe = /^(?:@[A-Za-z0-9][\w.-]*\/)?[A-Za-z0-9][\w.-]*(?:\/[\w.\-/]+)?$/;
+            if (bareNpmRe.test(spec)) {
+                const bareVendorRouting = resolveVendorRouting(spec, projectRoot);
+                if (bareVendorRouting?.route === 'vendor') {
+                    if (verbose) {
+                        console.log(`[rewrite] bare vendor import: ${spec} → ${bareVendorRouting.bareSpec}`);
+                    }
+                    return `${prefix}${bareVendorRouting.bareSpec}${suffix}`;
+                }
+            }
+        }
         // Bare npm package specifier fallback — route to /ns/m/node_modules/.
         // This catches specifiers like `source-map-js/lib/source-map-generator.js`
         // emitted by helpers such as the CommonJS compat transform, which Vite
@@ -3133,7 +3216,6 @@ function createHmrWebSocketPlugin(opts) {
                         const origin = getServerOrigin(server);
                         code = ensureVersionedRtImports(code, origin, graphVersion);
                         code = ACTIVE_STRATEGY.ensureVersionedImports(code, origin, graphVersion);
-                        code = ensureVersionedCoreImports(code, origin, graphVersion);
                     }
                     catch { }
                     // Compute rel .mjs output path
@@ -3190,7 +3272,6 @@ function createHmrWebSocketPlugin(opts) {
                                 try {
                                     depCode = ensureVersionedRtImports(depCode, getServerOrigin(server), graphVersion);
                                     depCode = ACTIVE_STRATEGY.ensureVersionedImports(depCode, getServerOrigin(server), graphVersion);
-                                    depCode = ensureVersionedCoreImports(depCode, getServerOrigin(server), graphVersion);
                                 }
                                 catch { }
                                 let depRel = depResolved.replace(/^\//, '').replace(/\.(tsx?|jsx?)$/i, '.mjs');
@@ -3838,16 +3919,14 @@ export const piniaSymbol = p.piniaSymbol;
                         code = ensureGuardPlainDynamicImports(code, getServerOrigin(server));
                     }
                     catch { }
-                    // Extra hardening: normalize any remaining core references to the unified bridge
-                    // - Stray string-literals
-                    // - Dangling `from` merges
-                    // - Any spec (including /node_modules resolves) that still references '@nativescript/core'
-                    // Do this right before the final fast-fail assertion. If a rewrite occurred, add a small marker for diagnostics.
+                    // Extra hardening before the fast-fail assertion: run the
+                    // consolidated stray-core-reference safety net. If any
+                    // rewrite occurred, leave a diagnostic marker so the
+                    // pipeline review log explains why the served code carries
+                    // it.
                     try {
                         const __before = code;
-                        code = normalizeStrayCoreStringLiterals(code);
-                        code = fixDanglingCoreFrom(code);
-                        code = normalizeAnyCoreSpecToBridge(code);
+                        code = sanitizeStrayCoreReferences(code);
                         if (code !== __before) {
                             code = `// [hmr-sanitize] core-literal->bridge\n` + code;
                         }
@@ -3920,7 +3999,6 @@ export const piniaSymbol = p.piniaSymbol;
                         const verNum = 0;
                         code = ensureVersionedRtImports(code, getServerOrigin(server), verNum);
                         code = ACTIVE_STRATEGY.ensureVersionedImports(code, getServerOrigin(server), verNum);
-                        code = ensureVersionedCoreImports(code, getServerOrigin(server), verNum);
                     }
                     catch { }
                     // `/ns/m` URL finalize step.
@@ -4135,7 +4213,12 @@ export const piniaSymbol = p.piniaSymbol;
                     const origin = getServerOrigin(server);
                     let code = `// [ns-rt][v2.3] NativeScript-Vue runtime bridge (module-scoped cache, no globals)\n` +
                         `const __origin = ((typeof globalThis !== 'undefined' && globalThis && globalThis.__NS_HTTP_ORIGIN__) || (new URL(import.meta.url)).origin);\n` +
-                        `let __ns_core_bridge = null; try { import(__origin + "/ns/core/${rtVer}").then(m => { __ns_core_bridge = m; }).catch(() => {}); } catch {}\n` +
+                        // Always target the canonical, unversioned `/ns/core` URL — the
+                        // runtime import map maps bare `@nativescript/core` to the same
+                        // URL, so vendor `require('@nativescript/core')` and this dynamic
+                        // import end up at one iOS HTTP-ESM module record (and one class
+                        // identity realm).
+                        `let __ns_core_bridge = null; try { import(__origin + "/ns/core").then(m => { __ns_core_bridge = m; }).catch(() => {}); } catch {}\n` +
                         `const g = globalThis;\n` +
                         `const reg = (g.__nsVendorRegistry ||= new Map());\n` +
                         `const req = reg && reg.get ? (g.__nsVendorRequire || g.__nsRequire || g.require) : (g.__nsRequire || g.require);\n` +
@@ -4358,7 +4441,7 @@ export const piniaSymbol = p.piniaSymbol;
                     return next();
                 }
             });
-            // 2.6) ESM bridge for @nativescript/core: GET /ns/core[/<ver>][?p=sub/path]
+            // 2.6) ESM bridge for @nativescript/core: GET /ns/core[/<sub>]
             //
             // Since bundle.mjs no longer bundles @nativescript/core (it is
             // declared external in the rolldown config under HMR), this
@@ -4382,12 +4465,29 @@ export const piniaSymbol = p.piniaSymbol;
                     const coreRequest = parseCoreBridgeRequest(urlObj.pathname, urlObj.searchParams, Number(graphVersion || 0));
                     if (!coreRequest)
                         return next();
+                    // Non-canonical incoming URL — every emitter is supposed
+                    // to canonicalize before hitting the device. Promote the
+                    // drift to a 301 redirect so iOS still gets the file at
+                    // the canonical URL (no realm split) but the offending
+                    // caller is forced to update. We log the offending raw
+                    // pathname so the regression source is easy to find.
+                    if (coreRequest.canonicalPath) {
+                        try {
+                            console.warn(`[ns-core-bridge] 301 ${urlObj.pathname}${urlObj.search} → ${coreRequest.canonicalPath} (non-canonical core URL — please update emitter)`);
+                        }
+                        catch { }
+                        res.setHeader('Access-Control-Allow-Origin', '*');
+                        res.setHeader('Location', coreRequest.canonicalPath);
+                        res.statusCode = 301;
+                        res.end();
+                        return;
+                    }
                     res.setHeader('Access-Control-Allow-Origin', '*');
                     res.setHeader('Content-Type', 'application/javascript; charset=utf-8');
                     res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0');
                     res.setHeader('Pragma', 'no-cache');
                     res.setHeader('Expires', '0');
-                    const { normalizedSub, sub, ver } = coreRequest;
+                    const { normalizedSub, sub } = coreRequest;
                     const resolveModuleId = async (moduleId) => {
                         const resolved = await server.pluginContainer?.resolveId?.(moduleId, undefined);
                         return typeof resolved === 'string' ? resolved : resolved?.id || null;
@@ -4413,7 +4513,7 @@ export const piniaSymbol = p.piniaSymbol;
                     // Vite's transform output references module IDs with /@fs,
                     // relative specifiers, or absolute project paths. Rewrite
                     // those to URLs iOS can fetch over HTTP.
-                    let rewritten = rewriteSpecifiersForDevice(transformed.code, getServerOrigin(server), Number(ver));
+                    let rewritten = rewriteSpecifiersForDevice(transformed.code, getServerOrigin(server), Number(graphVersion || 0));
                     // Invariant D (CJS/ESM interop shape) — EXPORT-SIDE fix.
                     //
                     // `@nativescript/core/index.js` declares namespace
@@ -5144,17 +5244,16 @@ export const piniaSymbol = p.piniaSymbol;
                     code = ensureVariableDynamicImportHelper(code);
                     try {
                         // For variant requests under /ns/sfc, prefer the version from the path segment when present
-                        // so that any internal '/ns/rt', '/ns/core', or '/ns/sfc' imports are aligned with the same version.
+                        // so that any internal '/ns/rt' or '/ns/sfc' imports are aligned with the same version.
+                        // `/ns/core` URLs are intentionally unversioned (realm-split history).
                         const verNum = Number(verFromPath || '0');
                         if (Number.isFinite(verNum) && verNum > 0) {
                             code = ensureVersionedRtImports(code, getServerOrigin(server), verNum);
                             code = ACTIVE_STRATEGY.ensureVersionedImports(code, getServerOrigin(server), verNum);
-                            code = ensureVersionedCoreImports(code, getServerOrigin(server), verNum);
                         }
                         else {
                             code = ensureVersionedRtImports(code, getServerOrigin(server), graphVersion);
                             code = ACTIVE_STRATEGY.ensureVersionedImports(code, getServerOrigin(server), graphVersion);
-                            code = ensureVersionedCoreImports(code, getServerOrigin(server), graphVersion);
                         }
                     }
                     catch { }
@@ -5164,7 +5263,7 @@ export const piniaSymbol = p.piniaSymbol;
                     }
                     catch { }
                     // CRITICAL: As a last step for script/template variants, re-run AST normalization and strip
-                    // any sentinel destructures that could cause duplicate locals, then re-apply core versioning.
+                    // any sentinel destructures that could cause duplicate locals, then re-apply rt versioning.
                     try {
                         code = astNormalizeModuleImportsAndHelpers(code);
                     }
@@ -5178,11 +5277,9 @@ export const piniaSymbol = p.piniaSymbol;
                         const verNum = Number(verFromPath || '0');
                         if (Number.isFinite(verNum) && verNum > 0) {
                             code = ensureVersionedRtImports(code, getServerOrigin(server), verNum);
-                            code = ensureVersionedCoreImports(code, getServerOrigin(server), verNum);
                         }
                         else {
                             code = ensureVersionedRtImports(code, getServerOrigin(server), graphVersion);
-                            code = ensureVersionedCoreImports(code, getServerOrigin(server), graphVersion);
                         }
                     }
                     catch { }
@@ -5595,10 +5692,6 @@ export const piniaSymbol = p.piniaSymbol;
                             parts.push(`export default __ns_sfc__`);
                             let inlineCode = parts.filter(Boolean).join('\n');
                             inlineCode = processCodeForDevice(inlineCode, false, true);
-                            try {
-                                inlineCode = ensureVersionedCoreImports(inlineCode, getServerOrigin(server), Number(ver));
-                            }
-                            catch { }
                             try {
                                 inlineCode = ensureDestructureCoreImports(inlineCode);
                             }
@@ -5665,10 +5758,6 @@ export const piniaSymbol = p.piniaSymbol;
                                 outParts.push('export default __ns_sfc__');
                                 let inlineCode2 = outParts.filter(Boolean).join('\n');
                                 inlineCode2 = processCodeForDevice(inlineCode2, false, true);
-                                try {
-                                    inlineCode2 = ensureVersionedCoreImports(inlineCode2, getServerOrigin(server), Number(ver));
-                                }
-                                catch { }
                                 try {
                                     inlineCode2 = ensureDestructureCoreImports(inlineCode2);
                                 }
@@ -5872,7 +5961,6 @@ export const piniaSymbol = p.piniaSymbol;
                                     const origin = getServerOrigin(server);
                                     inlineCode2 = ensureVersionedRtImports(inlineCode2, origin, Number(ver));
                                     inlineCode2 = ACTIVE_STRATEGY.ensureVersionedImports(inlineCode2, origin, Number(ver));
-                                    inlineCode2 = ensureVersionedCoreImports(inlineCode2, origin, Number(ver));
                                 }
                                 catch { }
                                 // Normalize imports/helpers via AST to ensure _defineComponent and other helpers are bound once
@@ -5976,10 +6064,6 @@ export const piniaSymbol = p.piniaSymbol;
                     // Run full device processing so helper aliasing and globals are consistent in this path too
                     let code = REQUIRE_GUARD_SNIPPET + asm;
                     code = processCodeForDevice(code, false, true, /(?:^|\/)node_modules\//.test(base), base);
-                    try {
-                        code = ensureVersionedCoreImports(code, getServerOrigin(server), Number(ver));
-                    }
-                    catch { }
                     code = rewriteImports(code, base, sfcFileMap, depFileMap, projectRoot, !!verbose, undefined, getServerOrigin(server));
                     try {
                         code = ensureDestructureCoreImports(code);
@@ -5991,7 +6075,6 @@ export const piniaSymbol = p.piniaSymbol;
                         const origin = getServerOrigin(server);
                         code = ensureVersionedRtImports(code, origin, Number(ver));
                         code = ACTIVE_STRATEGY.ensureVersionedImports(code, origin, Number(ver));
-                        code = ensureVersionedCoreImports(code, origin, Number(ver));
                     }
                     catch { }
                     // Inline-template body path already runs processCodeForDevice (AST + sanitizers); no additional _defineComponent fix needed
@@ -6149,10 +6232,6 @@ export const piniaSymbol = p.piniaSymbol;
                                     // Reuse existing sanitation chain (lightweight)
                                     code = cleanCode(code);
                                     code = processCodeForDevice(code, false, true, /(?:^|\/)node_modules\//.test(resolvedCandidate || spec), resolvedCandidate || spec);
-                                    try {
-                                        code = ensureVersionedCoreImports(code, getServerOrigin(server), graphVersion);
-                                    }
-                                    catch { }
                                     code = rewriteImports(code, spec, sfcFileMap, depFileMap, server.config?.root || process.cwd(), !!verbose, undefined, getServerOrigin(server));
                                     code = ensureVariableDynamicImportHelper(code);
                                     code = ensureGuardPlainDynamicImports(code, origin);
@@ -6204,10 +6283,6 @@ export const piniaSymbol = p.piniaSymbol;
                                                 let depCode = depTrans.code;
                                                 depCode = cleanCode(depCode);
                                                 depCode = processCodeForDevice(depCode, false, true, /(?:^|\/)node_modules\//.test(depResolved), depResolved);
-                                                try {
-                                                    depCode = ensureVersionedCoreImports(depCode, getServerOrigin(server), graphVersion);
-                                                }
-                                                catch { }
                                                 depCode = rewriteImports(depCode, depResolved, sfcFileMap, depFileMap, server.config?.root || process.cwd(), !!verbose, undefined, getServerOrigin(server));
                                                 depCode = ensureVariableDynamicImportHelper(depCode);
                                                 depCode = ensureGuardPlainDynamicImports(depCode, origin);