@nativescript/vite 8.0.0-alpha.27 → 8.0.0-alpha.29

package/hmr/server/websocket.js

@@ -32,11 +32,15 @@ import { typescriptServerStrategy } from '../frameworks/typescript/server/strate
 import { buildInlineTemplateBlock, createProcessSfcCode, extractTemplateRender, processTemplateVariantMinimal } from '../frameworks/vue/server/sfc-transforms.js';
 import { astExtractImportsAndStripTypes } from '../helpers/ast-extract.js';
 import { getProjectAppPath, getProjectAppRelativePath, getProjectAppVirtualPath } from '../../helpers/utils.js';
+import { getAppCssState } from '../../helpers/app-css-state.js';
+import { buildVueVendorShim, buildPiniaVendorShim } from './vendor-bare-module-shims.js';
 import { buildRuntimeConfig, generateImportMap } from './import-map.js';
 import { getCliFlags } from '../../helpers/cli-flags.js';
 import { buildCoreUrl, buildCoreUrlPath, normalizeCoreSub as normalizeCoreSubCanonical } from '../../helpers/ns-core-url.js';
 import { resolveDeviceReachableOrigin } from '../../helpers/dev-host.js';
 import { isRuntimeGraphExcludedPath, matchesRuntimeGraphModuleId, normalizeRuntimeGraphPath, shouldIncludeRuntimeGraphFile, shouldSkipRuntimeGraphDirectoryName } from './runtime-graph-filter.js';
+import { getHmrSourceRoots, isWithinHmrScope } from '../../helpers/hmr-scope.js';
+import { getTsConfigData } from '../../helpers/ts-config-paths.js';
 import { resolveAngularCoreHmrImportSource, rewriteAngularEntryRegisterOnly } from './websocket-angular-entry.js';
 import { angularSourceHasSemanticDecorator, canonicalizeTransformRequestCacheKey, collectAngularEvictionUrls, collectAngularHotUpdateRoots, collectAngularTransformCacheInvalidationUrls, collectAngularTransitiveImportersForInvalidation, collectGraphUpdateModulesForHotUpdate, normalizeHotReloadMatchPath, shouldInvalidateAngularTransitiveImporters, shouldSuppressDefaultViteHotUpdate, shouldSuppressViteFullReloadPayload } from './websocket-angular-hot-update.js';
 import { collectCssHotUpdatePaths } from './websocket-css-hot-update.js';
@@ -45,10 +49,11 @@ import { classifyBootRoute, classifyHmrUpdateKind, createColdBootRequestCounter,
 import { createHmrPendingMessage } from './websocket-hmr-pending.js';
 import { extractVitePrebundleId, filterExistingNodeModulesTransformCandidates, getBlockedDeviceNodeModulesReason, getFlattenedManifestMap, isCoreGlobalsReference, isEsmFrameworkPackageSpecifier, isLikelyNativeScriptPluginSpecifier, isLikelyNativeScriptRuntimePluginSpecifier, isNativeScriptCoreModule, isNativeScriptPluginModule, normalizeNativeScriptCoreSpecifier, normalizeNodeModulesSpecifier, resolveCandidateFilePath, resolveInternalRuntimePluginBareSpecifier, resolveNodeModulesPackageBoundary, resolveVendorFromCandidate, resolveVendorRouting, rewriteFsAbsoluteToNsM, shouldPreserveBareRuntimePluginSubpathImport, stripDecoratedServePrefixes, tryReadRawExplicitJavaScriptModule, viteDepsPathToBareSpecifier, } from './websocket-module-specifiers.js';
 import { ensureNativeScriptModuleBindings, getProcessCodeResolvedSpecifierOverrides } from './websocket-module-bindings.js';
-import { collectStaticExportNamesFromFile, collectStaticExportOriginsFromFile, extractDirectExportedNames, normalizeCoreExportOriginsForRuntime, parseCoreBridgeRequest, resolveRuntimeCoreModulePath } from './websocket-core-bridge.js';
+import { collectStaticExportNamesFromFile, collectStaticExportOriginsFromFile, normalizeCoreExportOriginsForRuntime, parseCoreBridgeRequest, resolveRuntimeCoreModulePath } from './websocket-core-bridge.js';
 import { createSharedTransformRequestRunner } from './shared-transform-request.js';
 import { formatNsMHmrServeTag, getNumericServeVersionTag, rewriteNsMImportPathForHmr } from './websocket-ns-m-paths.js';
-import { ensureDynamicHmrImportHelper } from './websocket-served-module-helpers.js';
+import { assertNoOptimizedArtifacts, buildBootProgressSnippet, collectTopLevelImportRecords, deduplicateLinkerImports, dedupeRtNamedImportsAgainstDestructures, ensureDestructureCoreImports, ensureDestructureRtImports, ensureDynamicHmrImportHelper, ensureGuardPlainDynamicImports, ensureVariableDynamicImportHelper, ensureVersionedRtImports, expandStarExports, extractExportMetadata, hoistTopLevelStaticImports, MODULE_IMPORT_ANALYSIS_PLUGINS, repairImportEqualsAssignments, stripCoreGlobalsImports, stripViteDynamicImportVirtual, wrapCommonJsModuleForDevice, } from './websocket-served-module-helpers.js';
+export { buildBootProgressSnippet, wrapCommonJsModuleForDevice };
 export { ensureNativeScriptModuleBindings, getProcessCodeResolvedSpecifierOverrides } from './websocket-module-bindings.js';
 export { stripDecoratedServePrefixes, tryReadRawExplicitJavaScriptModule } from './websocket-module-specifiers.js';
 export { collectStaticExportNamesFromFile, collectStaticExportOriginsFromFile, normalizeCoreExportOriginsForRuntime, parseCoreBridgeRequest } from './websocket-core-bridge.js';
@@ -81,6 +86,22 @@ catch { }
 const __processEnvJson = JSON.stringify(__processEnvEntries);
 const { parse, compileTemplate, compileScript } = vueSfcCompiler;
 const APP_ROOT_DIR = getProjectAppPath();
+// Absolute directories HMR is allowed to react to: the app source dir
+// (`nativescript.config.ts` > `appPath`) plus tsconfig-configured shared
+// libraries. Computed once per process (tsconfig data is itself memoized) and
+// used to scope `handleHotUpdate` so non-source changes.
+let _hmrSourceRoots = null;
+function getHmrSourceRootsCached() {
+    if (_hmrSourceRoots)
+        return _hmrSourceRoots;
+    let tsConfig = {};
+    try {
+        tsConfig = getTsConfigData({ platform: '' });
+    }
+    catch { }
+    _hmrSourceRoots = getHmrSourceRoots(tsConfig);
+    return _hmrSourceRoots;
+}
 const APP_VIRTUAL_PREFIX = getProjectAppVirtualPath();
 const APP_VIRTUAL_WITH_SLASH = `${APP_VIRTUAL_PREFIX}/`;
 const DEFAULT_MAIN_ENTRY = getProjectAppRelativePath('app.ts');
@@ -148,9 +169,6 @@ function getHmrSocketRole(client) {
     }
     return typeof client.__nsHmrClientRole === 'string' && client.__nsHmrClientRole ? client.__nsHmrClientRole : 'unknown';
 }
-function shouldAllowLocalCoreSanitizerPaths(contextLabel) {
-    return /\bnode_modules\/@nativescript\/vite\/hmr\/(?:client|frameworks)\//.test(contextLabel);
-}
 export function prepareAngularEntryForDevice(code, importerPath, sfcFileMap, depFileMap, projectRoot, verbose = false, outputDirOverrideRel, httpOrigin, resolveVendorAsHttp = false) {
     const rewrittenCode = rewriteImports(code, importerPath, sfcFileMap, depFileMap, projectRoot, verbose, outputDirOverrideRel, httpOrigin, resolveVendorAsHttp);
     return rewriteAngularEntryRegisterOnly(rewrittenCode, resolveAngularCoreHmrImportSource(rewrittenCode, httpOrigin));
@@ -159,74 +177,6 @@ const processSfcCode = createProcessSfcCode(processCodeForDevice);
 // Bare specifiers and special skip patterns (virtual, data:, etc.)
 const VENDOR_PACKAGES = /^[A-Za-z@][^:\/\s]*$/;
 const SKIP_PATTERNS = /^(?:data:|blob:|node:|virtual:|vite:|\0|\/@@?id|\/__vite|__vite|__x00__)/;
-const MODULE_IMPORT_ANALYSIS_PLUGINS = ['typescript', 'jsx', 'importMeta', 'topLevelAwait', 'classProperties', 'classPrivateProperties', 'classPrivateMethods', 'decorators-legacy'];
-function collectTopLevelImportRecords(code) {
-    if (!code || typeof code !== 'string' || !/\bimport\b/.test(code)) {
-        return [];
-    }
-    try {
-        const ast = babelParse(code, {
-            sourceType: 'module',
-            plugins: MODULE_IMPORT_ANALYSIS_PLUGINS,
-        });
-        const body = ast?.program?.body;
-        if (!Array.isArray(body)) {
-            return [];
-        }
-        return body
-            .filter((node) => t.isImportDeclaration(node) && typeof node.start === 'number' && typeof node.end === 'number' && typeof node.source?.value === 'string')
-            .map((node) => ({
-            start: node.start,
-            end: node.end,
-            text: code.slice(node.start, node.end),
-            source: node.source.value,
-            hasOnlyNamedSpecifiers: Array.isArray(node.specifiers) && node.specifiers.length > 0 && node.specifiers.every((spec) => t.isImportSpecifier(spec)),
-            namedBindings: Array.isArray(node.specifiers)
-                ? node.specifiers
-                    .filter((spec) => t.isImportSpecifier(spec) && typeof spec.start === 'number' && typeof spec.end === 'number')
-                    .map((spec) => ({
-                    importedName: t.isIdentifier(spec.imported) ? spec.imported.name : String(spec.imported?.value || ''),
-                    text: code.slice(spec.start, spec.end),
-                }))
-                : [],
-        }));
-    }
-    catch {
-        return [];
-    }
-}
-function hoistTopLevelStaticImports(code) {
-    const imports = collectTopLevelImportRecords(code);
-    if (!imports.length) {
-        return code;
-    }
-    let stripped = code;
-    for (const imp of [...imports].sort((left, right) => right.start - left.start)) {
-        stripped = stripped.slice(0, imp.start) + stripped.slice(imp.end);
-    }
-    const hoisted = [];
-    const seen = new Set();
-    for (const imp of imports) {
-        const text = imp.text.trim();
-        if (!text || seen.has(text)) {
-            continue;
-        }
-        seen.add(text);
-        hoisted.push(text);
-    }
-    if (!hoisted.length) {
-        return stripped;
-    }
-    return `${hoisted.join('\n')}\n${stripped.replace(/^\s*\n+/, '')}`;
-}
-// Duplicate of `websocket-served-module-helpers.ts::buildBootProgressSnippet`
-// — both copies must stay in lock-step. See the canonical doc there for
-// why the snippet must remain fully synchronous (top-level await on a
-// boot-tagged module trips the iOS 10 s async-module deadline).
-export function buildBootProgressSnippet(bootModuleLabel) {
-    const normalizedLabel = JSON.stringify(String(bootModuleLabel || '').replace(/\\/g, '/'));
-    return [`const __nsBootGlobal=globalThis;`, `try{if(!__nsBootGlobal.__NS_HMR_BOOT_COMPLETE__){__nsBootGlobal.__NS_HMR_BOOT_MODULE_COUNT__=Number(__nsBootGlobal.__NS_HMR_BOOT_MODULE_COUNT__||0)+1;__nsBootGlobal.__NS_HMR_BOOT_LAST_MODULE__=${normalizedLabel};}}catch(__nsBootErr){}`, ''].join('\n');
-}
 function rewriteVitePrebundleImportsForDevice(code, preserveVendorImports) {
     const imports = collectTopLevelImportRecords(code);
     if (!imports.length) {
@@ -315,145 +265,6 @@ function guardBareDynamicImports(code) {
         return code;
     }
 }
-function stripCoreGlobalsImports(code) {
-    const pattern = /^\s*(?:import\s+(?:[^'"\n]*from\s+)?|export\s+\*\s+from\s+)["'][^"']*(?:@nativescript(?:[/_-])core(?:[\/_-])globals|@nativescript_core_globals)[^"']*["'];?\s*$/gm;
-    return code.replace(pattern, '');
-}
-function ensureVariableDynamicImportHelper(code) {
-    if (!code.includes('__variableDynamicImportRuntimeHelper')) {
-        return code;
-    }
-    if (PAT.VARIABLE_DYNAMIC_IMPORT_HELPER_PATTERN.test(code)) {
-        return code;
-    }
-    const helper = `const __variableDynamicImportRuntimeHelper = (map, request, importMode) => {\n` +
-        `  try { if (request === '@') { return import(new URL('/ns/m/__invalid_at__.mjs', import.meta.url).href); } } catch {}\n` +
-        `  const loader = map && (map[request] || map[request?.replace(/\\\\/g, "/")]);\n` +
-        `  if (!loader) {\n` +
-        `    const error = new Error(\"Cannot dynamically import: \" + request);\n` +
-        `    error.code = 'ERR_MODULE_NOT_FOUND';\n` +
-        `    return Promise.reject(error);\n` +
-        `  }\n` +
-        `  try {\n` +
-        `    return loader(importMode);\n` +
-        `  } catch (err) {\n` +
-        `    return Promise.reject(err);\n` +
-        `  }\n` +
-        `};\n`;
-    return `${helper}${code}`;
-}
-function ensureGuardPlainDynamicImports(code, origin) {
-    try {
-        if (!code || !/\bimport\s*\(/.test(code))
-            return code;
-        const wrapper = `const __ns_import = (s) => { try { if (s === '@') { return import(new URL('/ns/m/__invalid_at__.mjs', import.meta.url).href); } } catch {} return import(s); }\n`;
-        const replaced = code.replace(/(^|[^\.\w$])import\s*\(/g, (_m, p1) => `${p1}__ns_import(`);
-        if (replaced !== code) {
-            return wrapper + replaced;
-        }
-        return code;
-    }
-    catch {
-        return code;
-    }
-}
-// `ensureDynamicHmrImportHelper` lives in
-// `./websocket-served-module-helpers.js`. See that file for the
-// architectural rationale and the current helper implementation.
-async function expandStarExports(code, server, projectRoot, verbose, sharedTransformer) {
-    const STAR_RE = /^[ \t]*(export\s+\*\s+from\s+["'])([^"']+)(["'];?)[ \t]*$/gm;
-    let match;
-    const replacements = [];
-    while ((match = STAR_RE.exec(code)) !== null) {
-        const url = match[2];
-        if (!url.includes('/node_modules/'))
-            continue;
-        replacements.push({ full: match[0], url, prefix: match[1], suffix: match[3] });
-    }
-    if (!replacements.length)
-        return code;
-    // Pull target URLs through the shared runner when it's available so each
-    // node_modules path shares the 60s TTL cache with the main /ns/m pipeline
-    // and respects the global concurrency gate. Fan them out in parallel —
-    // this block used to be a serial `for await` loop, which dominated cold
-    // boot on apps with dozens of star-re-exports.
-    const transformer = sharedTransformer ?? ((url) => server.transformRequest(url));
-    const resolved = await Promise.all(replacements.map(async (rep) => {
-        try {
-            let vitePath = rep.url.replace(/^https?:\/\/[^/]+/, '');
-            vitePath = vitePath.replace(/^\/ns\/m\//, '/');
-            vitePath = vitePath.replace(/^\/__ns_boot__\/[^/]+/, '');
-            vitePath = vitePath.replace(/\/__ns_hmr__\/[^/]+/, '');
-            const result = await transformer(vitePath);
-            if (!result?.code)
-                return null;
-            const names = extractExportedNames(result.code);
-            if (!names.length)
-                return null;
-            if (verbose) {
-                console.log(`[ns/m] expanded export* -> ${names.length} names from ${vitePath}`);
-            }
-            return { rep, names };
-        }
-        catch {
-            return null;
-        }
-    }));
-    for (const entry of resolved) {
-        if (!entry)
-            continue;
-        const explicit = `export { ${entry.names.join(', ')} } from ${JSON.stringify(entry.rep.url)};`;
-        code = code.replace(entry.rep.full, explicit);
-    }
-    return code;
-}
-function extractExportedNames(code) {
-    return extractDirectExportedNames(code);
-}
-function repairImportEqualsAssignments(code) {
-    try {
-        if (!code || typeof code !== 'string')
-            return code;
-        code = code.replace(/(^|\n)\s*import\s*\{([^}]+)\}\s*=\s*([^;]+);?/g, (_m, p1, specList, rhs) => {
-            const cleaned = String(specList)
-                .split(',')
-                .map((s) => s.trim())
-                .filter(Boolean)
-                .map((seg) => seg.replace(/\s+as\s+/i, ': '))
-                .join(', ');
-            return `${p1}const { ${cleaned} } = ${rhs};`;
-        });
-        code = code.replace(/(^|\n)\s*import\s*\*\s*as\s*([A-Za-z_$][\w$]*)\s*=\s*([^;]+);?/g, (_m, p1, ns, rhs) => `${p1}const ${ns} = (${rhs});`);
-        code = code.replace(/(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*=\s*([^;]+);?/g, (_m, p1, id, rhs) => `${p1}const ${id} = ${rhs};`);
-    }
-    catch { }
-    return code;
-}
-function ensureVersionedRtImports(code, origin, ver) {
-    if (!code || !origin || !Number.isFinite(ver))
-        return code;
-    code = code.replace(/(from\s+["'])(?:https?:\/\/[^"']+)?\/(?:\ns|ns)\/rt(?:\/[\d]+)?(["'])/g, (_m, p1, p3) => `${p1}/ns/rt/${ver}${p3}`);
-    code = code.replace(/(import\(\s*["'])(?:https?:\/\/[^"']+)?\/(?:\@ns|ns)\/rt(?:\/[\d]+)?(["']\s*\))/g, (_m, p1, p3) => `${p1}/ns/rt/${ver}${p3}`);
-    return code;
-}
-function stripViteDynamicImportVirtual(code) {
-    if (!/\/@id\/__x00__vite\/dynamic-import-helper/.test(code)) {
-        return code;
-    }
-    const original = code;
-    code = code.replace(/^[\t ]*import[^\n]*\/@id\/__x00__vite\/dynamic-import-helper[^\n]*$/gm, '');
-    if (/\/@id\/__x00__vite\/dynamic-import-helper/.test(code)) {
-        code = code.replace(/\/@id\/__x00__vite\/dynamic-import-helper[^"'`)]*/g, '/__NS_UNUSED_DYNAMIC_IMPORT_HELPER__');
-    }
-    if (!/__variableDynamicImportRuntimeHelper/.test(code)) {
-        const inline = `const __variableDynamicImportRuntimeHelper = (map, request, importMode) => {\n  try { if (request === '@') { return import('/ns/m/__invalid_at__.mjs'); } } catch {}\n  const loader = map && (map[request] || map[request?.replace(/\\\\/g, '/')]);\n  if (!loader) { const e = new Error('Cannot dynamically import: ' + request); /*@ts-ignore*/ e.code = 'ERR_MODULE_NOT_FOUND'; return Promise.reject(e); }\n  try { return loader(importMode); } catch (e) { return Promise.reject(e); }\n};\n`;
-        code = inline + code;
-    }
-    if (code !== original) {
-        code = `// [hmr-sanitize] removed virtual dynamic-import-helper\n${code}`;
-    }
-    return code;
-}
 // Detect (and log) `require('http(s)://...')` calls made from CJS shims.
 // Pattern: HTTP-served ESM modules end up in NS-vite's `__nsRequire`
 // shim with HTTP URLs as their relative resolution targets. The guard
@@ -539,43 +350,6 @@ function stripImportMetaHotBlocks(code) {
     }
     return result;
 }
-// Extract a quick set of export names and whether a default export exists from ESM code.
-// This uses conservative regex scanning for metadata only (no code rewriting).
-function extractExportMetadata(code) {
-    const named = new Set();
-    let hasDefault = /\bexport\s+default\b/.test(code);
-    try {
-        // export const foo, export let foo, export function bar, export class Baz
-        for (const m of code.matchAll(/\bexport\s+(?:const|let|var|function|class)\s+([A-Za-z_$][A-Za-z0-9_$]*)/g)) {
-            if (m[1])
-                named.add(m[1]);
-        }
-        // export { a, b as c }
-        for (const m of code.matchAll(/\bexport\s*\{([^}]+)\}/g)) {
-            const inner = (m[1] || '')
-                .split(',')
-                .map((s) => s.trim())
-                .filter(Boolean);
-            for (const seg of inner) {
-                // forms: name or name as alias or default as name
-                const dm = seg.match(/^([A-Za-z_$][A-Za-z0-9_$]*)(?:\s+as\s+([A-Za-z_$][A-Za-z0-9_$]*))?$/);
-                if (dm) {
-                    const base = dm[1];
-                    const alias = dm[2];
-                    if (base === 'default') {
-                        hasDefault = true;
-                        continue;
-                    }
-                    named.add(alias || base);
-                }
-            }
-        }
-    }
-    catch { }
-    // Remove default if accidentally included
-    named.delete('default');
-    return { hasDefault, named: Array.from(named) };
-}
 function normalizeImportPath(spec, importerDir) {
     if (!spec)
         return null;
@@ -775,8 +549,8 @@ function cleanCode(code) {
     result = result.replace(PAT.VITE_CLIENT_IMPORT, '');
     result = result.replace(PAT.IMPORT_META_HOT_ASSIGNMENT, '');
     // Keep import.meta.hot call sites; runtime now provides a stable import.meta.hot.
-    result = ACTIVE_STRATEGY.preClean(result);
-    result = ACTIVE_STRATEGY.rewriteFrameworkImports(result);
+    result = ACTIVE_STRATEGY.preClean?.(result) ?? result;
+    result = ACTIVE_STRATEGY.rewriteFrameworkImports?.(result) ?? result;
     // Vendor manifest-driven import rewrites
     // NOTE: Static and side-effect vendor imports are intentionally NOT rewritten here.
     // They are left as import statements so that ensureNativeScriptModuleBindings()
@@ -804,13 +578,11 @@ function cleanCode(code) {
     }
     result = result.replace(PAT.VITE_CLIENT_IMPORT, '').replace(PAT.IMPORT_META_HOT_ASSIGNMENT, '');
     // Clean up HMR noise
-    result = ACTIVE_STRATEGY.postClean(result);
+    result = ACTIVE_STRATEGY.postClean?.(result) ?? result;
     result = stripCoreGlobalsImports(result);
     return result;
 }
-// ============================================================================
-// APPLICATION IMPORT HELPERS
-// ============================================================================
+// Application import helpers
 /**
  * Check if a path is an application module (not node_modules, not vendor, not relative)
  * This is generic and works for ANY project structure.
@@ -955,197 +727,6 @@ function normalizeAbsoluteFilesystemImport(spec, importerPath, projectRoot) {
     }
     return absolute;
 }
-/**
- * After the Angular linker runs on code that Vite has already resolved (bare
- * specifiers → full URLs), the linker injects NEW import statements with bare
- * specifiers (e.g. `import {Component} from '@angular/core'`).  These cause:
- *   1. Duplicate-identifier SyntaxErrors (the name was already imported via URL)
- *   2. Unresolvable bare specifiers at runtime on device
- *
- * This function:
- *   • builds a map  packageName → resolvedURL  from existing resolved imports
- *   • collects all binding names already imported per package
- *   • for each bare-specifier import, removes duplicate bindings
- *   • rewrites any genuinely-new bindings to use the resolved URL
- */
-function deduplicateLinkerImports(code) {
-    if (!code)
-        return code;
-    try {
-        const imports = collectTopLevelImportRecords(code);
-        if (!imports.length) {
-            return code;
-        }
-        // ── Step 1: collect resolved imports already in the file ──────────
-        const pkgUrlMap = new Map();
-        const pkgBindings = new Map();
-        for (const imp of imports) {
-            const url = imp.source;
-            if (!/^https?:\/\//.test(url) && !url.startsWith('/')) {
-                continue;
-            }
-            const nmIdx = url.lastIndexOf('/node_modules/');
-            if (nmIdx === -1)
-                continue;
-            const afterNm = url.substring(nmIdx + '/node_modules/'.length);
-            const parts = afterNm.split('/');
-            const pkg = parts[0].startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
-            if (!pkgUrlMap.has(pkg))
-                pkgUrlMap.set(pkg, url);
-            if (imp.namedBindings.length) {
-                if (!pkgBindings.has(pkg))
-                    pkgBindings.set(pkg, new Set());
-                for (const binding of imp.namedBindings) {
-                    if (binding.importedName)
-                        pkgBindings.get(pkg).add(binding.importedName);
-                }
-            }
-        }
-        if (pkgUrlMap.size === 0)
-            return code;
-        // ── Step 2: rewrite bare-specifier imports ───────────────────────
-        const edits = [];
-        for (const imp of imports) {
-            if (!imp.hasOnlyNamedSpecifiers) {
-                continue;
-            }
-            const specifier = imp.source;
-            if (specifier.startsWith('/') || specifier.startsWith('.') || specifier.startsWith('http')) {
-                continue;
-            }
-            const parts = specifier.split('/');
-            const pkg = specifier.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
-            const url = pkgUrlMap.get(pkg);
-            if (!url) {
-                continue;
-            }
-            const existing = pkgBindings.get(pkg) || new Set();
-            const newBindings = imp.namedBindings.filter((binding) => !existing.has(binding.importedName));
-            if (newBindings.length === 0) {
-                edits.push({ start: imp.start, end: imp.end, text: '' });
-                continue;
-            }
-            if (newBindings.length === imp.namedBindings.length) {
-                continue;
-            }
-            for (const binding of newBindings) {
-                existing.add(binding.importedName);
-            }
-            edits.push({
-                start: imp.start,
-                end: imp.end,
-                text: `import { ${newBindings.map((binding) => binding.text).join(', ')} } from ${JSON.stringify(url)};`,
-            });
-        }
-        if (!edits.length) {
-            return code;
-        }
-        let next = code;
-        for (const edit of edits.sort((left, right) => right.start - left.start)) {
-            next = next.slice(0, edit.start) + edit.text + next.slice(edit.end);
-        }
-        return next;
-    }
-    catch {
-        return code;
-    }
-}
-export function wrapCommonJsModuleForDevice(code, absolutePath) {
-    if (!code)
-        return code;
-    try {
-        const hasExportDefault = /\bexport\s+default\b/.test(code) || /export\s*\{\s*default\s*(?:as\s*default)?\s*\}/.test(code);
-        const hasNamedExports = /\bexport\s+(?:const|let|var|function|class|async)\b/.test(code) || /\bexport\s*\{/.test(code);
-        const hasCjsExports = /\bmodule\s*\.\s*exports\b/.test(code) || /\bexports\s*\.\s*\w/.test(code);
-        if (hasExportDefault || hasNamedExports || !hasCjsExports) {
-            return code;
-        }
-        const namedExports = new Set();
-        const exportsRe = /\bexports\s*\.\s*([A-Za-z_$][\w$]*)\s*=/g;
-        let em;
-        while ((em = exportsRe.exec(code)) !== null) {
-            const name = em[1];
-            if (name !== '__esModule' && name !== 'default') {
-                namedExports.add(name);
-            }
-        }
-        const defPropRe = /Object\s*\.\s*defineProperty\s*\(\s*exports\s*,\s*['"]([^'"]+)['"]/g;
-        while ((em = defPropRe.exec(code)) !== null) {
-            const name = em[1];
-            if (name !== '__esModule' && name !== 'default') {
-                namedExports.add(name);
-            }
-        }
-        // Static enumeration only sees `exports.foo = ...` and `Object.defineProperty(exports, 'foo', ...)`.
-        // Real-world packages like lodash attach their entire surface to a function inside an IIFE and
-        // then `module.exports = thatFunction`. Static analysis returns zero in that case. To handle
-        // these modules we ALSO load the package in the dev-server's Node context (only when we have a
-        // node_modules path) and merge the runtime keys. See `helpers/cjs-named-exports.ts` for the
-        // reasoning and safety boundaries.
-        if (absolutePath) {
-            try {
-                for (const n of getCjsNamedExports(absolutePath)) {
-                    namedExports.add(n);
-                }
-            }
-            catch {
-                /* fall through to whatever we caught statically */
-            }
-        }
-        let suffix = `\nvar __cjs_mod = module.exports;\nexport default __cjs_mod;\n`;
-        if (namedExports.size) {
-            const entries = Array.from(namedExports);
-            const temps = entries.map((name, i) => `var __cjs_e${i} = __cjs_mod[${JSON.stringify(name)}];`);
-            const reExports = entries.map((name, i) => `__cjs_e${i} as ${name}`);
-            suffix += `${temps.join(' ')}\nexport { ${reExports.join(', ')} };\n`;
-        }
-        const prelude = `var module = { exports: {} }; var exports = module.exports;\n` +
-            `var __ns_cjs_require_base = (typeof globalThis.__nsBaseRequire === 'function' ? globalThis.__nsBaseRequire : (typeof globalThis.__nsRequire === 'function' ? globalThis.__nsRequire : (typeof globalThis.require === 'function' ? globalThis.require : undefined)));\n` +
-            `var __ns_cjs_require_kind = (typeof globalThis.__nsBaseRequire === 'function' ? 'base-require' : (typeof globalThis.__nsRequire === 'function' ? 'vendor-require' : 'global-require'));\n` +
-            `var require = function(spec) {\n` +
-            `  if (!__ns_cjs_require_base) { throw new Error('require is not defined'); }\n` +
-            // Resolve relative specifiers against the HTTP-served module's URL
-            // before delegating to NS's runtime require. Without this step,
-            // \`require('./base64-vlq')\` inside a CJS module served from
-            // \`http://.../ns/m/node_modules/source-map-js/lib/source-map-generator.js\`
-            // would pass a literal '"./base64-vlq"' to the native require, which
-            // has no notion of the current HTTP-module's location and either
-            // throws "Module not found" or fetches an arbitrary filesystem path
-            // that happens to parse as code (producing misleading syntax errors
-            // like "missing ) after argument list" from unrelated modules).
-            `  var __nsResolvedSpec = spec;\n` +
-            `  try {\n` +
-            `    if (typeof spec === 'string' && (spec.indexOf('./') === 0 || spec.indexOf('../') === 0)) {\n` +
-            `      var __nsParentUrl = (typeof import.meta !== 'undefined' && import.meta && typeof import.meta.url === 'string') ? import.meta.url : null;\n` +
-            `      if (__nsParentUrl) {\n` +
-            `        var __nsResolvedUrl = new URL(spec, __nsParentUrl);\n` +
-            `        // Common Node-style bare extensions: prefer .js if the resolved URL lacks an extension in its last path segment.\n` +
-            `        if (!/\\.[A-Za-z0-9]+$/.test(__nsResolvedUrl.pathname.split('/').pop() || '')) {\n` +
-            `          __nsResolvedUrl.pathname = __nsResolvedUrl.pathname.replace(/\\/+$/, '') + '.js';\n` +
-            `        }\n` +
-            `        __nsResolvedSpec = __nsResolvedUrl.href;\n` +
-            `      }\n` +
-            `    }\n` +
-            `  } catch (e) {}\n` +
-            `  try { var __nsRecord = globalThis.__NS_RECORD_MODULE_PROVENANCE__; if (typeof __nsRecord === 'function') { __nsRecord(String(__nsResolvedSpec), { kind: __ns_cjs_require_kind, specifier: String(spec), url: __nsResolvedSpec !== spec ? __nsResolvedSpec : undefined, via: 'cjs-wrapper', parent: (typeof import.meta !== 'undefined' && import.meta && import.meta.url) ? import.meta.url : undefined }); } } catch (e) {}\n` +
-            `  var mod = __ns_cjs_require_base(__nsResolvedSpec);\n` +
-            `  try {\n` +
-            `    if (mod && (typeof mod === 'object' || typeof mod === 'function') && mod.default !== undefined) {\n` +
-            `      var keys = [];\n` +
-            `      try { keys = Object.keys(mod); } catch (e) {}\n` +
-            `      var defaultOnly = keys.length === 1 && keys[0] === 'default';\n` +
-            `      var esModuleOnly = keys.length === 2 && keys.indexOf('default') !== -1 && keys.indexOf('__esModule') !== -1;\n` +
-            `      if (mod.__esModule || defaultOnly || esModuleOnly) { return mod.default; }\n` +
-            `    }\n` +
-            `  } catch (e) {}\n` +
-            `  return mod;\n` +
-            `};\n`;
-        return `${prelude}${code}${suffix}`;
-    }
-    catch {
-        return code;
-    }
-}
 /**
  * Process code for device: inject globals, remove framework imports
  */
@@ -1678,198 +1259,6 @@ function processCodeForDevice(code, isVitePreBundled, preserveVendorImports = fa
 // Assert that sanitized code no longer contains any Vite optimized deps artifacts
 // or virtual ids that could break the HTTP ESM loader on device. Throws with
 // a helpful diagnostics message if any are found.
-function assertNoOptimizedArtifacts(code, contextLabel) {
-    try {
-        const offenders = [];
-        const lines = code.split('\n');
-        const tests = [
-            // Allow Vite dev indirections like /@id/ and /.vite/deps when served via HTTP.
-            // Only flag clearly invalid virtual placeholders if they surface in output.
-            /\b__VITE_PLUGIN__\b/,
-            /\b__VITE_PRELOAD__\b/,
-        ];
-        // Absolute or relative local @nativescript/core usage indicates a split realm risk; fail fast
-        const localCore = /(^|[^\w@])(?:\.\.?\/|\/)??@nativescript[\/_-]core\//i;
-        for (let i = 0; i < lines.length; i++) {
-            const ln = lines[i];
-            for (const re of tests) {
-                if (re.test(ln)) {
-                    offenders.push(`${i + 1}: ${ln.substring(0, 200)}`);
-                    break;
-                }
-            }
-            if (localCore.test(ln)) {
-                // Comments can never cause split-realm risk at runtime — skip them.
-                // Library authors commonly reference @nativescript/core in comments
-                // (e.g. TSDoc /// <reference> directives, module resolution notes).
-                const trimmed = ln.trimStart();
-                if (trimmed.startsWith('//') || trimmed.startsWith('/*') || trimmed.startsWith('*')) {
-                    continue;
-                }
-                if (shouldAllowLocalCoreSanitizerPaths(contextLabel)) {
-                    continue;
-                }
-                offenders.push(`${i + 1}: ${ln.substring(0, 200)} [local-core-path]`);
-            }
-            if (offenders.length >= 10)
-                break;
-        }
-        if (offenders.length) {
-            const msg = `[sanitize-fail] Optimized deps/virtual id artifacts detected in ${contextLabel}. These cannot be evaluated by the device HTTP ESM loader. Offending lines (first ${Math.min(5, offenders.length)} shown):\n` + offenders.slice(0, 5).join('\n');
-            const err = new Error(msg);
-            // Attach details for server logs / higher-level handlers
-            err.code = 'NS_SANITIZE_FAIL';
-            err.offenders = offenders;
-            throw err;
-        }
-    }
-    catch (e) {
-        // If diagnostics generation itself fails, do not mask the underlying issue
-        throw e;
-    }
-}
-// Ensure there are no lingering named imports from the unified core bridge.
-// Converts named imports from `/ns/core[/<sub>]` into default import +
-// destructuring. The package-main bridge serves a shape-shifted module whose
-// named exports come from `__ns_core_bridge.default` rather than ESM named
-// exports, so a named-import binding would be `undefined` at evaluation.
-function ensureDestructureCoreImports(code) {
-    try {
-        let result = code;
-        let coreImportCounter = 0;
-        const toDestructure = (specList) => specList
-            .split(',')
-            .map((s) => s.trim())
-            .filter(Boolean)
-            .map((seg) => {
-            const m = seg.split(/\s+as\s+/i);
-            return m.length === 2 ? `${m[0].trim()}: ${m[1].trim()}` : seg;
-        })
-            .join(', ');
-        // import { A, B } from '/ns/core[/<sub>]'
-        const reNamed = /(^|\n)\s*import\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[^"']+)?)['"];?\s*/gm;
-        result = result.replace(reNamed, (_full, pfx, specList, src) => {
-            // Deep subpath URLs serve actual ESM with real named exports — skip.
-            if (isDeepCoreSubpath(src))
-                return _full;
-            const tmp = `__ns_core_ns_re${coreImportCounter > 0 ? `_${coreImportCounter}` : ''}`;
-            coreImportCounter++;
-            const decl = `const { ${toDestructure(specList)} } = ${tmp};`;
-            return `${pfx}import ${tmp} from ${JSON.stringify(src)};\n${decl}\n`;
-        });
-        // import Default, { A, B } from '/ns/core[/<sub>]'
-        const reMixed = /(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*,\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[^"']+)?)['"];?\s*/gm;
-        result = result.replace(reMixed, (_full, pfx, defName, specList, src) => {
-            if (isDeepCoreSubpath(src))
-                return _full;
-            const decl = `const { ${toDestructure(specList)} } = ${defName};`;
-            return `${pfx}import ${defName} from ${JSON.stringify(src)};\n${decl}\n`;
-        });
-        return result;
-    }
-    catch {
-        return code;
-    }
-}
-// Converts any named imports from the runtime bridge (/ns/rt[/ver]) into a default import + destructuring.
-// This guarantees helper aliases like _resolveComponent remain bound even if we later normalize imports.
-function ensureDestructureRtImports(code) {
-    try {
-        let result = code;
-        const toDestructure = (specList) => specList
-            .split(',')
-            .map((s) => s.trim())
-            .filter(Boolean)
-            .map((seg) => {
-            // Preserve alias mapping (e.g., resolveComponent as _resolveComponent)
-            const m = seg.split(/\s+as\s+/i);
-            return m.length === 2 ? `${m[0].trim()}: ${m[1].trim()}` : seg;
-        })
-            .join(', ');
-        const reNamed = /(^|\n)\s*import\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/rt(?:\/[\d]+)?)['"];?\s*/gm;
-        result = result.replace(reNamed, (_full, pfx, specList, src) => {
-            const tmp = `__ns_rt_ns_re`;
-            const decl = `const { ${toDestructure(specList)} } = ${tmp};`;
-            return `${pfx}import ${tmp} from ${JSON.stringify(src)};\n${decl}\n`;
-        });
-        const reMixed = /(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*,\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/rt(?:\/[\d]+)?)['"];?\s*/gm;
-        result = result.replace(reMixed, (_full, pfx, defName, specList, _src) => {
-            const decl = `const { ${toDestructure(specList)} } = ${defName};`;
-            return `${pfx}import ${defName} from ${JSON.stringify(_src)};\n${decl}\n`;
-        });
-        return result;
-    }
-    catch {
-        return code;
-    }
-}
-// Remove overlapping named imports from /ns/rt that duplicate bindings already provided
-// by destructuring a default /ns/rt import (e.g., const { $showModal } = __ns_rt_ns_1;).
-function dedupeRtNamedImportsAgainstDestructures(code) {
-    try {
-        let result = code;
-        // Collect bindings created from any destructure of __ns_rt_ns* temps
-        const rtDestructureRE = /(^|\n)\s*const\s*\{([^}]+)\}\s*=\s*(__ns_rt_ns(?:\d+|_re))\s*;?/gm;
-        const rtBound = new Set();
-        let m;
-        while ((m = rtDestructureRE.exec(result)) !== null) {
-            const specList = String(m[2] || '');
-            specList
-                .split(',')
-                .map((s) => s.trim())
-                .filter(Boolean)
-                .forEach((seg) => {
-                const bind = seg.includes(':') ? seg.split(':')[1].trim() : seg;
-                if (bind)
-                    rtBound.add(bind);
-            });
-        }
-        if (!rtBound.size)
-            return result;
-        // For any named import from /ns/rt (versioned or not), drop specifiers that are already bound
-        const rtNamedImportRE = /(^|\n)\s*import\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/rt(?:\/[\d]+)?)["'];?\s*/gm;
-        const edits = [];
-        while ((m = rtNamedImportRE.exec(result)) !== null) {
-            const full = m[0];
-            const pfx = m[1] || '';
-            const specList = String(m[2] || '');
-            const src = m[3];
-            const kept = [];
-            specList
-                .split(',')
-                .map((s) => s.trim())
-                .filter(Boolean)
-                .forEach((seg) => {
-                const importedName = seg.split(/\s+as\s+/i)[0].trim();
-                if (!rtBound.has(importedName))
-                    kept.push(seg);
-            });
-            let replacement = '';
-            if (kept.length) {
-                replacement = `${pfx}import { ${kept.join(', ')} } from ${JSON.stringify(src)};`;
-            }
-            else {
-                replacement = pfx || '';
-            }
-            edits.push({
-                start: rtNamedImportRE.lastIndex - full.length,
-                end: rtNamedImportRE.lastIndex,
-                text: replacement,
-            });
-        }
-        if (edits.length) {
-            edits
-                .sort((a, b) => b.start - a.start)
-                .forEach((e) => {
-                result = result.slice(0, e.start) + e.text + result.slice(e.end);
-            });
-        }
-        return result;
-    }
-    catch {
-        return code;
-    }
-}
 /**
  * THE SINGLE REWRITE FUNCTION - used everywhere for consistency
  */
@@ -2458,9 +1847,7 @@ export function rewriteImports(code, importerPath, sfcFileMap, depFileMap, proje
     });
     return result;
 }
-// ============================================================================
-// PLUGIN
-// ============================================================================
+// Plugin
 function createHmrWebSocketPlugin(opts) {
     const verbose = !!opts.verbose;
     let wss = null;
@@ -3217,7 +2604,7 @@ function createHmrWebSocketPlugin(opts) {
                     try {
                         const origin = getServerOrigin(server);
                         code = ensureVersionedRtImports(code, origin, graphVersion);
-                        code = ACTIVE_STRATEGY.ensureVersionedImports(code, origin, graphVersion);
+                        code = ACTIVE_STRATEGY.ensureVersionedImports?.(code, origin, graphVersion) ?? code;
                     }
                     catch { }
                     // Compute rel .mjs output path
@@ -3273,7 +2660,7 @@ function createHmrWebSocketPlugin(opts) {
                                 }
                                 try {
                                     depCode = ensureVersionedRtImports(depCode, getServerOrigin(server), graphVersion);
-                                    depCode = ACTIVE_STRATEGY.ensureVersionedImports(depCode, getServerOrigin(server), graphVersion);
+                                    depCode = ACTIVE_STRATEGY.ensureVersionedImports?.(depCode, getServerOrigin(server), graphVersion) ?? depCode;
                                 }
                                 catch { }
                                 let depRel = depResolved.replace(/^\//, '').replace(/\.(tsx?|jsx?)$/i, '.mjs');
@@ -3770,79 +3157,10 @@ function createHmrWebSocketPlugin(opts) {
                             const pkg = bare;
                             let code = '';
                             if (pkg === 'vue' || pkg === 'nativescript-vue') {
-                                // Re-export Vue helpers from vendor NativeScript-Vue (fallback to 'vue' if present)
-                                code = `
-const g = globalThis;
-const reg = g.__nsVendorRegistry;
-const req = reg && g.__nsVendorRequire ? g.__nsVendorRequire : (g.__nsRequire || g.require);
-let mod = reg && reg.get('${pkg === 'vue' ? 'nativescript-vue' : 'nativescript-vue'}');
-if (!mod && req) {
-  try { mod = req('${pkg === 'vue' ? 'nativescript-vue' : 'nativescript-vue'}'); } catch {}
-  ${pkg === 'vue' ? "if (!mod) { try { mod = req('vue'); } catch {} }" : ''}
-}
-mod = mod || {};
-const v = (mod.default ?? mod);
-export default v;
-export const defineComponent = v.defineComponent;
-export const resolveComponent = v.resolveComponent;
-export const createVNode = v.createVNode;
-export const createTextVNode = v.createTextVNode;
-export const createCommentVNode = v.createCommentVNode;
-export const Fragment = v.Fragment;
-export const withCtx = v.withCtx;
-export const openBlock = v.openBlock;
-export const createBlock = v.createBlock;
-export const createElementVNode = v.createElementVNode || v.createVNode;
-export const createElementBlock = v.createElementBlock || v.createBlock;
-export const renderSlot = v.renderSlot;
-export const mergeProps = v.mergeProps;
-export const toHandlers = v.toHandlers;
-export const renderList = v.renderList;
-export const normalizeProps = v.normalizeProps;
-export const guardReactiveProps = v.guardReactiveProps;
-export const withDirectives = v.withDirectives;
-export const resolveDirective = v.resolveDirective;
-export const withModifiers = v.withModifiers;
-export const withKeys = v.withKeys;
-export const ref = v.ref;
-export const shallowRef = v.shallowRef;
-export const unref = v.unref;
-export const computed = v.computed;
-export const onMounted = v.onMounted;
-export const onBeforeUnmount = v.onBeforeUnmount;
-export const onUnmounted = v.onUnmounted;
-export const watch = v.watch;
-export const nextTick = v.nextTick;
-export const createApp = v.createApp || (vm && vm.createApp);
-export const registerElement = v.registerElement || (vm && vm.registerElement);
-export const normalizeClass = v.normalizeClass;
-export const normalizeStyle = v.normalizeStyle;
-export const toDisplayString = v.toDisplayString;
-`;
+                                code = buildVueVendorShim(pkg);
                             }
                             else if (pkg === 'pinia') {
-                                // Re-export Pinia APIs from vendor pinia module
-                                code = `
-const g = globalThis;
-const reg = g.__nsVendorRegistry;
-const req = reg && g.__nsVendorRequire ? g.__nsVendorRequire : (g.__nsRequire || g.require);
-let mod = reg && reg.get('pinia');
-if (!mod && req) { try { mod = req('pinia'); } catch {} }
-mod = mod || {};
-const p = (mod.default ?? mod);
-export default p;
-export const createPinia = p.createPinia;
-export const defineStore = p.defineStore;
-export const storeToRefs = p.storeToRefs;
-export const setActivePinia = p.setActivePinia;
-export const getActivePinia = p.getActivePinia;
-export const mapStores = p.mapStores;
-export const mapState = p.mapState;
-export const mapGetters = p.mapGetters;
-export const mapActions = p.mapActions;
-export const mapWritableState = p.mapWritableState;
-export const piniaSymbol = p.piniaSymbol;
-`;
+                                code = buildPiniaVendorShim();
                             }
                             res.statusCode = 200;
                             res.end(code || 'export {}\n');
@@ -4000,7 +3318,7 @@ export const piniaSymbol = p.piniaSymbol;
                     try {
                         const verNum = 0;
                         code = ensureVersionedRtImports(code, getServerOrigin(server), verNum);
-                        code = ACTIVE_STRATEGY.ensureVersionedImports(code, getServerOrigin(server), verNum);
+                        code = ACTIVE_STRATEGY.ensureVersionedImports?.(code, getServerOrigin(server), verNum) ?? code;
                     }
                     catch { }
                     // `/ns/m` URL finalize step.
@@ -5116,11 +4434,11 @@ export const piniaSymbol = p.piniaSymbol;
                         const verNum = Number(verFromPath || '0');
                         if (Number.isFinite(verNum) && verNum > 0) {
                             code = ensureVersionedRtImports(code, getServerOrigin(server), verNum);
-                            code = ACTIVE_STRATEGY.ensureVersionedImports(code, getServerOrigin(server), verNum);
+                            code = ACTIVE_STRATEGY.ensureVersionedImports?.(code, getServerOrigin(server), verNum) ?? code;
                         }
                         else {
                             code = ensureVersionedRtImports(code, getServerOrigin(server), graphVersion);
-                            code = ACTIVE_STRATEGY.ensureVersionedImports(code, getServerOrigin(server), graphVersion);
+                            code = ACTIVE_STRATEGY.ensureVersionedImports?.(code, getServerOrigin(server), graphVersion) ?? code;
                         }
                     }
                     catch { }
@@ -5827,7 +5145,7 @@ export const piniaSymbol = p.piniaSymbol;
                                 try {
                                     const origin = getServerOrigin(server);
                                     inlineCode2 = ensureVersionedRtImports(inlineCode2, origin, Number(ver));
-                                    inlineCode2 = ACTIVE_STRATEGY.ensureVersionedImports(inlineCode2, origin, Number(ver));
+                                    inlineCode2 = ACTIVE_STRATEGY.ensureVersionedImports?.(inlineCode2, origin, Number(ver)) ?? inlineCode2;
                                 }
                                 catch { }
                                 // Normalize imports/helpers via AST to ensure _defineComponent and other helpers are bound once
@@ -5941,7 +5259,7 @@ export const piniaSymbol = p.piniaSymbol;
                     try {
                         const origin = getServerOrigin(server);
                         code = ensureVersionedRtImports(code, origin, Number(ver));
-                        code = ACTIVE_STRATEGY.ensureVersionedImports(code, origin, Number(ver));
+                        code = ACTIVE_STRATEGY.ensureVersionedImports?.(code, origin, Number(ver)) ?? code;
                     }
                     catch { }
                     // Inline-template body path already runs processCodeForDevice (AST + sanitizers); no additional _defineComponent fix needed
@@ -6270,6 +5588,15 @@ export const piniaSymbol = p.piniaSymbol;
             if (isRuntimeGraphExcludedPath(file)) {
                 return;
             }
+            // Authoritative "what triggers HMR" gate, applied before the pending
+            // overlay broadcast below: react only to files inside the app source
+            // dir (`appPath`) or a tsconfig-configured shared library.
+            if (!isWithinHmrScope(file, getHmrSourceRootsCached())) {
+                if (verbose) {
+                    console.log(`[ns-hmr][server] ignored change (outside HMR source scope): ${file}`);
+                }
+                return;
+            }
             // Always-on update timing. Captures the four phases (await,
             // framework, broadcast, total) plus invalidated module count
             // and recipient count. Emitted at the end of this function via
@@ -6512,8 +5839,9 @@ export const piniaSymbol = p.piniaSymbol;
             // the framework's own template-update payload.
             if (!file.endsWith('.css')) {
                 try {
-                    const deps = server.__nsAppCssDeps;
-                    const appCssPath = server.__nsAppCssPath;
+                    const appCssState = getAppCssState(server);
+                    const deps = appCssState?.deps;
+                    const appCssPath = appCssState?.path;
                     if (deps && appCssPath) {
                         const normalizedFile = path.resolve(file).replace(/\\/g, '/');
                         if (deps.has(normalizedFile)) {
@@ -7469,9 +6797,7 @@ if (typeof __VUE_HMR_RUNTIME__ === 'undefined') {
         },
     };
 }
-// ----------
 // Framework-specific HMR WebSocket plugins
-// ----------
 export function hmrWebSocketVue(opts) {
     ACTIVE_STRATEGY = resolveFrameworkStrategy('vue');
     return createHmrWebSocketPlugin(opts);
@@ -7489,37 +6815,14 @@ export function hmrWebSocketTypescript(opts) {
     return createHmrWebSocketPlugin(opts);
 }
 /**
- * Get the dev-server origin string baked into every module the rewriter
- * serves to the device (`/ns/core/...`, `/ns/m/...`, etc.).
- *
- * This MUST agree with the origin `dev-host.ts` bakes into `bundle.mjs`
- * itself. If the two disagree (e.g. the bundle imports
- * `http://localhost:5173/ns/core/utils` while the rewriter splices in
- * `http://192.168.0.8:5173/ns/core/utils`) V8's ESM loader keys those
- * as DIFFERENT modules and the app ends up with two side-by-side
- * realms of `@nativescript/core` — a classic singleton-state split.
- * `internal/debug-sessions/LATEST-05-12-2026-HMR_CORE_REALM_SPLIT.md`
- * documents the symptom.
- *
- * Routing all platforms through `resolveDeviceReachableOrigin` keeps
- * them in lock-step:
- *
- *   - Android wildcard / loopback → `10.0.2.2` (emulator NAT can't
- *     reach the host's LAN IP; physical devices opt in via
- *     `NS_HMR_PREFER_LAN_HOST=1`).
- *
- *   - iOS / visionOS wildcard → `localhost` (simulator shares the
- *     host's network stack; physical devices opt in via the same
- *     `NS_HMR_PREFER_LAN_HOST=1` or `NS_HMR_HOST=<lan-ip>` env).
- *
- *   - Explicit non-loopback `server.host` (e.g. a developer-set LAN
- *     IP) on any platform → trusted verbatim.
- *
- * The old `resolvedUrls.network[0]` preference is intentionally
- * dropped — Vite reports a LAN IP whenever it detects one, but that
- * IP is neither reachable from an Android emulator nor consistent
- * with what `dev-host.ts` selects, so leaning on it created the
- * realm-split risk above.
+ * Dev-server origin baked into every module served to the device
+ * (`/ns/core/...`, `/ns/m/...`). MUST match the origin `dev-host.ts` bakes
+ * into `bundle.mjs`; if they disagree V8 keys them as different modules and
+ * the app ends up with two `@nativescript/core` realms (a singleton-state
+ * split). `resolveDeviceReachableOrigin` keeps every platform in lock-step:
+ * Android wildcard/loopback -> `10.0.2.2`, iOS/visionOS wildcard ->
+ * `localhost`, explicit non-loopback `server.host` -> trusted verbatim
+ * (physical devices opt into LAN via `NS_HMR_PREFER_LAN_HOST`/`NS_HMR_HOST`).
  */
 function getServerOrigin(server) {
     const platform = detectDevHostPlatform();