@nativescript/vite 8.0.0-alpha.6 → 8.0.0-alpha.60

package/hmr/server/websocket-served-module-helpers.js

@@ -1,9 +1,99 @@
 import { parse as babelParse } from '@babel/parser';
 import * as t from '@babel/types';
+import { existsSync, readFileSync } from 'fs';
+import * as path from 'path';
 import * as PAT from './constants.js';
 import { isDeepCoreSubpath } from './core-sanitize.js';
-import { extractDirectExportedNames } from './websocket-core-bridge.js';
-const MODULE_IMPORT_ANALYSIS_PLUGINS = ['typescript', 'jsx', 'importMeta', 'topLevelAwait', 'classProperties', 'classPrivateProperties', 'classPrivateMethods', 'decorators-legacy'];
+import { getCjsNamedExports } from '../helpers/cjs-named-exports.js';
+import { getMonorepoWorkspaceRoot } from '../../helpers/project.js';
+import { extractDirectExportedNames, parseExportSpecList } from './websocket-core-bridge.js';
+import { resolveCandidateFilePath } from './websocket-module-specifiers.js';
+let cachedWorkspaceCoreRoot;
+/**
+ * Absolute root of @nativescript/core when it is consumed from monorepo
+ * source (`<workspace>/packages/core` in the NativeScript repo) rather than
+ * node_modules. Returns null for standalone apps.
+ */
+export function getWorkspaceCoreSourceRoot() {
+    if (cachedWorkspaceCoreRoot !== undefined)
+        return cachedWorkspaceCoreRoot;
+    cachedWorkspaceCoreRoot = null;
+    try {
+        const wsRoot = getMonorepoWorkspaceRoot();
+        if (wsRoot) {
+            const pkgPath = path.join(wsRoot, 'packages/core/package.json');
+            if (existsSync(pkgPath)) {
+                const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+                if (pkg?.name === '@nativescript/core') {
+                    cachedWorkspaceCoreRoot = path.resolve(wsRoot, 'packages/core').replace(/\\/g, '/');
+                }
+            }
+        }
+    }
+    catch { }
+    return cachedWorkspaceCoreRoot;
+}
+/**
+ * True when a served module path points into @nativescript/core consumed from
+ * monorepo source. These modules are library code: the app-source HMR passes
+ * (AST normalization, /ns/rt underscore-helper alias injection) must NOT run
+ * on them — they exist for compiled app/SFC output, and on core sources they
+ * misread internals (e.g. `ClassInfo._getBase`) as Vue template helpers and
+ * inject destructures that shadow real bindings or TDZ-crash on the circular
+ * /ns/rt dependency. In standalone apps core lives under node_modules and is
+ * already excluded by the node_modules check.
+ */
+export function isWorkspaceCoreModulePath(p) {
+    if (!p)
+        return false;
+    const coreRoot = getWorkspaceCoreSourceRoot();
+    if (!coreRoot)
+        return false;
+    const normalized = String(p).split('?')[0].replace(/\\/g, '/');
+    return normalized.includes(coreRoot + '/') || /(^|\/)packages\/core\//.test(normalized);
+}
+/**
+ * True when a served module path points into the @nativescript/vite package
+ * routed via its monorepo build output (`dist/packages/vite/...`). Apps that
+ * consume the package via `file:../../dist/packages/vite` get a node_modules
+ * SYMLINK, and require.resolve follows it to the real dist path — so the
+ * served URL carries no `node_modules/` segment and escapes the node_modules
+ * library check. Like core source, this is library code: the app-source HMR
+ * passes (AST normalization, /ns/rt alias injection) must not run on it —
+ * e.g. the HMR client bundle already carries its own `__ns_rt_ns_re` import,
+ * and a second injected one is a duplicate-declaration SyntaxError on device.
+ */
+export function isWorkspaceVitePackageModulePath(p) {
+    if (!p)
+        return false;
+    const normalized = String(p).split('?')[0].replace(/\\/g, '/');
+    return /(^|\/)dist\/packages\/vite\//.test(normalized);
+}
+/**
+ * Single classification point for the /ns/m served-module pipeline. The
+ * app-source passes inside processCodeForDevice (AST normalization, /ns/rt
+ * underscore-helper alias injection) must run ONLY on 'app' modules; 'library'
+ * code is served as-is plus import rewriting. Three things count as library:
+ *   - anything under node_modules
+ *   - @nativescript/core consumed from monorepo source (packages/core)
+ *   - the @nativescript/vite package served from its dist build output
+ *     (file:../../dist/packages/vite symlinks resolve to the real dist path,
+ *     so no node_modules segment appears in the URL)
+ * Add the next workspace-library case HERE, not at a call site.
+ */
+export function classifyServedModule(p) {
+    if (!p)
+        return 'app';
+    const normalized = String(p).split('?')[0].replace(/\\/g, '/');
+    if (/(?:^|\/)node_modules\//.test(normalized))
+        return 'library';
+    if (isWorkspaceCoreModulePath(normalized))
+        return 'library';
+    if (isWorkspaceVitePackageModulePath(normalized))
+        return 'library';
+    return 'app';
+}
+export const MODULE_IMPORT_ANALYSIS_PLUGINS = ['typescript', 'jsx', 'importMeta', 'topLevelAwait', 'classProperties', 'classPrivateProperties', 'classPrivateMethods', 'decorators-legacy'];
 export function collectTopLevelImportRecords(code) {
     if (!code || typeof code !== 'string' || !/\bimport\b/.test(code)) {
         return [];
@@ -63,14 +153,27 @@ export function hoistTopLevelStaticImports(code) {
     }
     return `${hoisted.join('\n')}\n${stripped.replace(/^\s*\n+/, '')}`;
 }
+// Boot-progress instrumentation snippet (server-side string-only).
+//
+// Injected at the top of every `__ns_boot__/b1`-tagged module the dev
+// server serves during cold boot. The snippet is FULLY SYNCHRONOUS —
+// even one conditional top-level `await` would mark the module async
+// in V8, propagating an async-promise chain through the entire boot
+// graph and tripping the iOS 10 s top-level-await deadline (see
+// `ModuleInternal.mm::pumpAsyncProgress`). It just bumps the
+// `__NS_HMR_BOOT_MODULE_COUNT__` / `__NS_HMR_BOOT_LAST_MODULE__`
+// globals; the 250 ms heartbeat in `session-bootstrap.ts` owns
+// `setBootStage` and runs `boot-progress.ts::computeBootImportProgress`
+// against those counters plus elapsed wall-clock to drive the bar.
+// The iOS runtime's `MaybePumpJSThreadDuringBoot` keeps the JS-thread
+// CFRunLoop ticking between sync fetches so the heartbeat can fire
+// during the otherwise-blocking cold-boot module walk.
+//
+// Regression-tested by `websocket-integrity.spec.ts` (snippet stays
+// fully synchronous + propagates exactly via the boot-tag prefix).
 export function buildBootProgressSnippet(bootModuleLabel) {
     const normalizedLabel = JSON.stringify(String(bootModuleLabel || '').replace(/\\/g, '/'));
-    return [
-        `const __nsBootGlobal=globalThis;`,
-        `try{if(!__nsBootGlobal.__NS_HMR_BOOT_COMPLETE__){const __nsBootApi=__nsBootGlobal.__NS_HMR_DEV_OVERLAY__;if(__nsBootApi&&typeof __nsBootApi.setBootStage==='function'){const __nsBootCount=(__nsBootGlobal.__NS_HMR_BOOT_MODULE_COUNT__=Number(__nsBootGlobal.__NS_HMR_BOOT_MODULE_COUNT__||0)+1);__nsBootGlobal.__NS_HMR_BOOT_LAST_MODULE__=${normalizedLabel};const __nsBootNow=Date.now();const __nsBootLast=Number(__nsBootGlobal.__NS_HMR_BOOT_LAST_PROGRESS_AT__||0);if(__nsBootCount<=8||__nsBootCount%6===0||__nsBootNow-__nsBootLast>90){__nsBootGlobal.__NS_HMR_BOOT_LAST_PROGRESS_AT__=__nsBootNow;const __nsBootProgress=Math.min(94,82+Math.min(10,Math.round((Math.log(__nsBootCount+1)/Math.LN2)*2)));__nsBootApi.setBootStage('importing-main',{detail:'Evaluated '+__nsBootCount+' modules\\n'+__nsBootGlobal.__NS_HMR_BOOT_LAST_MODULE__,attempt:Number(__nsBootGlobal.__NS_HMR_BOOT_MAIN_ATTEMPT__||1),attempts:Number(__nsBootGlobal.__NS_HMR_BOOT_MAIN_ATTEMPTS__||6),progress:__nsBootProgress});}}}}catch(__nsBootErr){}`,
-        `if(!__nsBootGlobal.__NS_HMR_BOOT_COMPLETE__){const __nsBootCount=Number(__nsBootGlobal.__NS_HMR_BOOT_MODULE_COUNT__||0);if(__nsBootCount<=24||__nsBootCount%8===0){await new Promise((resolve)=>setTimeout(resolve,0));}}`,
-        '',
-    ].join('\n');
+    return [`const __nsBootGlobal=globalThis;`, `try{if(!__nsBootGlobal.__NS_HMR_BOOT_COMPLETE__){__nsBootGlobal.__NS_HMR_BOOT_MODULE_COUNT__=Number(__nsBootGlobal.__NS_HMR_BOOT_MODULE_COUNT__||0)+1;__nsBootGlobal.__NS_HMR_BOOT_LAST_MODULE__=${normalizedLabel};}}catch(__nsBootErr){}`, ''].join('\n');
 }
 export function stripCoreGlobalsImports(code) {
     const pattern = /^\s*(?:import\s+(?:[^'"\n]*from\s+)?|export\s+\*\s+from\s+)["'][^"']*(?:@nativescript(?:[/_-])core(?:[\/_-])globals|@nativescript_core_globals)[^"']*["'];?\s*$/gm;
@@ -99,7 +202,7 @@ export function ensureVariableDynamicImportHelper(code) {
         `};\n`;
     return `${helper}${code}`;
 }
-export function ensureGuardPlainDynamicImports(code, _origin) {
+export function ensureGuardPlainDynamicImports(code) {
     try {
         if (!code || !/\bimport\s*\(/.test(code))
             return code;
@@ -114,20 +217,21 @@ export function ensureGuardPlainDynamicImports(code, _origin) {
         return code;
     }
 }
-// alpha.59 — Stable URL helper for dynamic imports.
+// Stable URL helper for dynamic imports.
 //
-// Pre-alpha.59 the helper synthesized `/ns/m/__ns_hmr__/<tag>/<rest>` URLs
-// from `globalThis.__NS_HMR_GRAPH_VERSION__` and an importer-derived tag.
-// That tag flowed straight into V8's `g_moduleRegistry` cache key — so a
-// `graphVersion` bump on every save effectively flushed the whole module
-// graph (HMR latency was dominated by Vite re-transforming the unchanged
-// closure on every save, ~3s per cycle).
+// Older versions of the helper synthesized
+// `/ns/m/__ns_hmr__/<tag>/<rest>` URLs from
+// `globalThis.__NS_HMR_GRAPH_VERSION__` and an importer-derived tag.
+// That tag flowed straight into V8's `g_moduleRegistry` cache key — so
+// a `graphVersion` bump on every save effectively flushed the whole
+// module graph (HMR latency was dominated by Vite re-transforming the
+// unchanged closure on every save).
 //
-// alpha.59 inverts that contract:
+// The current contract inverts that:
 //   * The runtime canonicalizes any URL shape (boot prefix, hmr prefix,
 //     stable) to a single key via `CanonicalizeHttpUrlKey`.
 //   * The Angular client receives an explicit eviction set in
-//     `ns:angular-update` and calls `__nsInvalidateModules` before
+//     `ns:angular-update` and calls `__NS_DEV__.invalidateModules` before
 //     re-importing the entry, so V8 only refetches modules that
 //     actually changed.
 //   * The dynamic-import helper no longer needs to busy-construct
@@ -143,10 +247,10 @@ export function ensureGuardPlainDynamicImports(code, _origin) {
 //   2. `/ns/m/...` specs that don't yet have a boot prefix get one
 //      added when the caller is itself a boot-tagged module. This
 //      keeps the boot-progress instrumentation flowing through the
-//      transitive cold-boot graph on alpha.59 + alpha.59 boot
-//      sequences. Once HMR takes over (`__NS_HMR_BOOT_COMPLETE__` is
-//      set on the global), no prefix is added — the runtime
-//      canonicalizer collapses any historical prefix to the same key.
+//      transitive cold-boot graph during cold-boot sequences. Once HMR
+//      takes over (`__NS_HMR_BOOT_COMPLETE__` is set on the global), no
+//      prefix is added — the runtime canonicalizer collapses any
+//      historical prefix to the same key.
 //   3. Everything else is a pass-through `import(spec)`.
 export function ensureDynamicHmrImportHelper(code) {
     try {
@@ -175,40 +279,198 @@ export function ensureDynamicHmrImportHelper(code) {
         return code;
     }
 }
-function extractExportedNames(code) {
-    return extractDirectExportedNames(code);
+/**
+ * Star-export expansion must be TRANSITIVE.
+ *
+ * The expansion below replaces `export * from "url"` with an explicit named
+ * list, so any name missing from that list is silently dropped from the
+ * importer's export surface — the device then fails at link time with
+ * "does not provide an export named '<name>'". Real packages routinely chain
+ * star re-exports (`index.ios.js → export * from './canvas'` →
+ * `canvas.ios.js → export * from './canvas.common'`), so the name set for a
+ * star target is the union of its direct exports, its named re-exports, and
+ * — recursively — every nested `export * from` chain, cycles included.
+ *
+ * This mirrors `collectStaticExportOriginsFromFile` in
+ * `websocket-core-bridge.ts`, which solved the identical problem for the
+ * /ns/core bridge (see its `Application` comment). That walker reads files
+ * from disk; this one works on Vite-transformed code via the shared
+ * transformer, because star targets here are served URLs (aliases, /@fs
+ * paths, platform-extension resolution already applied by Vite's resolver).
+ * If you change export-name semantics in one walker, check the other.
+ */
+const STAR_EXPANSION_MAX_DEPTH = 64;
+/**
+ * Normalize a star-export target (served URL or nested transformed
+ * specifier) into a root-relative path feedable to Vite's transform
+ * pipeline. Returns null for specifiers that cannot be walked (bare ids,
+ * relative specs with no parent context).
+ */
+function normalizeStarExportTargetPath(spec, parentVitePath) {
+    let p = String(spec || '').trim();
+    if (!p)
+        return null;
+    p = p.replace(/^https?:\/\/[^/]+/, '');
+    p = p.replace(/[?#].*$/, '');
+    p = p.replace(/^\/ns\/m\//, '/');
+    p = p.replace(/^\/__ns_boot__\/[^/]+/, '');
+    p = p.replace(/\/__ns_hmr__\/[^/]+/, '');
+    if (p.startsWith('.')) {
+        // Vite's import analysis normally rewrites nested specifiers to
+        // root-relative URLs; resolve any relative stragglers against the
+        // parent module's directory.
+        const parent = String(parentVitePath || '')
+            .replace(/\\/g, '/')
+            .replace(/[?#].*$/, '');
+        if (!parent.startsWith('/'))
+            return null;
+        p = path.posix.normalize(path.posix.join(path.posix.dirname(parent), p));
+    }
+    return p.startsWith('/') ? p : null;
+}
+function scanModuleExportSurface(code) {
+    const ownNames = new Set(extractDirectExportedNames(code));
+    for (const m of code.matchAll(/\bexport\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s*["'][^"']+["']/g)) {
+        ownNames.add(m[1]);
+    }
+    for (const m of code.matchAll(/\bexport\s*\{([^}]+)\}\s*from\s*["'][^"']+["']/g)) {
+        for (const { exportedName } of parseExportSpecList(m[1])) {
+            ownNames.add(exportedName);
+        }
+    }
+    const starSources = [];
+    // Tolerate trailing comments/code on the line (see the identical fix in
+    // websocket-core-bridge.ts: a strict `$` anchor silently skipped
+    // `export * from './layouts'; // barrel export` lines).
+    for (const m of code.matchAll(/^[ \t]*export\s+\*\s+from\s+["']([^"']+)["'][^\n]*$/gm)) {
+        starSources.push(m[1]);
+    }
+    return { ownNames, starSources };
+}
+/**
+ * Recursively collect the full export-name set of a star-export target,
+ * following nested `export * from` chains. Cycle-safe via the DFS `stack`
+ * set (a revisited module contributes nothing new at that point — its names
+ * are already being collected by the outer visit, matching spec
+ * GetExportedNames semantics). Returns null when the target itself cannot
+ * be transformed; partial failures deeper in the chain are reported through
+ * `diagnostics` while still returning every name that could be collected.
+ */
+async function collectStarTargetExportNames(vitePath, transformer, stack, depth, diagnostics) {
+    if (stack.has(vitePath))
+        return new Set();
+    if (depth > STAR_EXPANSION_MAX_DEPTH) {
+        diagnostics.push(`star-export chain deeper than ${STAR_EXPANSION_MAX_DEPTH} at ${vitePath}`);
+        return null;
+    }
+    let targetCode;
+    try {
+        targetCode = (await transformer(vitePath))?.code ?? undefined;
+    }
+    catch { }
+    if (!targetCode) {
+        diagnostics.push(`unresolvable star-export target ${vitePath}`);
+        return null;
+    }
+    const surface = scanModuleExportSurface(targetCode);
+    const names = new Set(surface.ownNames);
+    stack.add(vitePath);
+    try {
+        for (const spec of surface.starSources) {
+            const childPath = normalizeStarExportTargetPath(spec, vitePath);
+            if (!childPath) {
+                diagnostics.push(`unwalkable nested star-export specifier ${JSON.stringify(spec)} in ${vitePath}`);
+                continue;
+            }
+            const childNames = await collectStarTargetExportNames(childPath, transformer, stack, depth + 1, diagnostics);
+            if (!childNames)
+                continue;
+            for (const n of childNames)
+                names.add(n);
+        }
+    }
+    finally {
+        stack.delete(vitePath);
+    }
+    // `export *` never re-exports default.
+    names.delete('default');
+    return names;
 }
-export async function expandStarExports(code, server, _projectRoot, verbose) {
-    const STAR_RE = /^[ \t]*(export\s+\*\s+from\s+["'])([^"']+)(["'];?)[ \t]*$/gm;
+export async function expandStarExports(code, server, projectRoot, verbose, sharedTransformer, importerId) {
+    const STAR_RE = /^[ \t]*export\s+\*\s+from\s+["']([^"']+)["'];?(?=[ \t]*(?:\/\/[^\n]*)?$)/gm;
     let match;
     const replacements = [];
     while ((match = STAR_RE.exec(code)) !== null) {
-        const url = match[2];
+        const url = match[1];
         if (!url.includes('/node_modules/'))
             continue;
-        replacements.push({ full: match[0], url, prefix: match[1], suffix: match[3] });
+        replacements.push({ full: match[0], url });
     }
     if (!replacements.length)
         return code;
-    for (const rep of replacements) {
-        try {
-            let vitePath = rep.url.replace(/^https?:\/\/[^/]+/, '');
-            vitePath = vitePath.replace(/^\/ns\/m\//, '/');
-            vitePath = vitePath.replace(/^\/__ns_boot__\/[^/]+/, '');
-            vitePath = vitePath.replace(/\/__ns_hmr__\/[^/]+/, '');
-            const result = await server.transformRequest(vitePath);
-            if (!result?.code)
-                continue;
-            const names = extractExportedNames(result.code);
-            if (!names.length)
-                continue;
-            const explicit = `export { ${names.join(', ')} } from ${JSON.stringify(rep.url)};`;
-            code = code.replace(rep.full, explicit);
-            if (verbose) {
-                console.log(`[ns/m] expanded export* -> ${names.length} names from ${vitePath}`);
+    // Names already exported lexically by the importing module. Per spec,
+    // lexical exports shadow star-exported names — re-emitting them in an
+    // explicit list would be a duplicate-export SyntaxError on device.
+    const claimed = new Set(scanModuleExportSurface(code).ownNames);
+    // Resolve each star-export target in parallel through the shared runner
+    // (when provided) so they share the /ns/m TTL cache and concurrency gate.
+    const baseTransformer = sharedTransformer ?? ((url) => server.transformRequest(url));
+    // A bare `/node_modules/<pkg>/...` URL is NOT transformable on its own:
+    // Vite's bare-specifier resolver is gated by the package's
+    // `package.json#exports` and refuses internal sub-paths even when the file
+    // is on disk (e.g. `css-tree/lib/version.js`, `css-what/dist/esm/types.js`),
+    // and in a monorepo the package is hoisted ABOVE the app's `root` so the
+    // path doesn't exist relative to it at all. Either way the transform
+    // returns nothing and the star target is mis-reported as "unresolvable",
+    // silently dropping its names from the importer's export surface. Mirror the
+    // main /ns/m route (`filterExistingNodeModulesTransformCandidates`): resolve
+    // the path to a concrete file under the project or workspace root and feed
+    // the `/@fs/<abs>` form to Vite, which bypasses the `exports` gate. Falls
+    // back to the raw URL for anything that doesn't resolve to a real file.
+    const workspaceRoot = projectRoot ? getMonorepoWorkspaceRoot(projectRoot) : null;
+    const transformer = (url) => {
+        if (projectRoot && url.includes('/node_modules/')) {
+            const abs = resolveCandidateFilePath(url, projectRoot, workspaceRoot);
+            if (abs) {
+                // Posix-normalize and guarantee a leading slash so Windows drive
+                // letters produce the `/@fs/C:/...` form Vite expects.
+                const absPosix = abs.replace(/\\/g, '/');
+                return baseTransformer(`/@fs${absPosix.startsWith('/') ? '' : '/'}${absPosix}`);
             }
         }
-        catch { }
+        return baseTransformer(url);
+    };
+    const resolved = await Promise.all(replacements.map(async (rep) => {
+        const diagnostics = [];
+        const vitePath = normalizeStarExportTargetPath(rep.url, null);
+        if (!vitePath) {
+            diagnostics.push(`unwalkable star-export URL ${rep.url}`);
+            return { rep, names: null, diagnostics };
+        }
+        const names = await collectStarTargetExportNames(vitePath, transformer, new Set(), 0, diagnostics);
+        if (verbose && names) {
+            console.log(`[ns/m] expanded export* -> ${names.size} names from ${vitePath}${diagnostics.length ? ' (partial)' : ''}`);
+        }
+        return { rep, names, diagnostics };
+    }));
+    for (const entry of resolved) {
+        if (entry.diagnostics.length) {
+            // Always-on: an incomplete expansion silently narrows the importer's
+            // export surface, which surfaces on device as a link-time
+            // "does not provide an export named ..." with no server-side trace.
+            console.warn(`[ns/m][export*] incomplete star-export expansion${importerId ? ` in ${importerId}` : ''} for ${entry.rep.url}: ${entry.diagnostics.join('; ')}`);
+        }
+        if (!entry.names)
+            continue;
+        // First star wins for names provided by multiple siblings; duplicates
+        // would be a SyntaxError, and spec-ambiguous names have no good answer.
+        const emit = Array.from(entry.names).filter((n) => !claimed.has(n));
+        for (const n of emit)
+            claimed.add(n);
+        // An empty list still keeps the dependency edge (side effects,
+        // evaluation order) via a side-effect import.
+        const explicit = emit.length ? `export { ${emit.join(', ')} } from ${JSON.stringify(entry.rep.url)};` : `import ${JSON.stringify(entry.rep.url)};`;
+        code = code.replace(entry.rep.full, explicit);
     }
     return code;
 }
@@ -231,11 +493,17 @@ export function repairImportEqualsAssignments(code) {
     catch { }
     return code;
 }
-export function ensureVersionedRtImports(code, origin, ver) {
-    if (!code || !origin || !Number.isFinite(ver))
+// Canonicalize `/ns/rt` imports: collapse any versioned form
+// (`/ns/rt/<n>`, `/@ns/rt/<n>`) to the single unversioned `/ns/rt` URL.
+// One canonical URL per bridge module — the runtime treats the literal
+// URL as module identity, so emitting `/ns/rt/<ver>` would mint a new
+// module realm per graph version. (The GET route still ACCEPTS the
+// versioned form for stale in-flight code; see ns-rt-route.ts.)
+export function canonicalizeRtImports(code, origin) {
+    if (!code || !origin)
         return code;
-    code = code.replace(/(from\s+["'])(?:https?:\/\/[^"']+)?\/(?:\@ns|ns)\/rt(?:\/[\d]+)?(["'])/g, (_m, p1, p3) => `${p1}/ns/rt/${ver}${p3}`);
-    code = code.replace(/(import\(\s*["'])(?:https?:\/\/[^"']+)?\/(?:\@ns|ns)\/rt(?:\/[\d]+)?(["']\s*\))/g, (_m, p1, p3) => `${p1}/ns/rt/${ver}${p3}`);
+    code = code.replace(/(from\s+["'])(?:https?:\/\/[^"']+)?\/(?:\@ns|ns)\/rt(?:\/[\d]+)?(["'])/g, (_m, p1, p3) => `${p1}/ns/rt${p3}`);
+    code = code.replace(/(import\(\s*["'])(?:https?:\/\/[^"']+)?\/(?:\@ns|ns)\/rt(?:\/[\d]+)?(["']\s*\))/g, (_m, p1, p3) => `${p1}/ns/rt${p3}`);
     return code;
 }
 export function stripViteDynamicImportVirtual(code) {
@@ -243,7 +511,13 @@ export function stripViteDynamicImportVirtual(code) {
         return code;
     }
     const original = code;
-    code = code.replace(/^[\t ]*import[^\n]*\/@id\/__x00__vite\/dynamic-import-helper[^\n]*$/gm, '');
+    // Statement-scoped, NOT line-anchored: Vite 8 emits its injected imports
+    // concatenated on ONE line with the module's original first line, e.g.
+    //   import …"/@vite/client";import …"/@id/__x00__vite/dynamic-import-helper.js";/**
+    // A `^…$`-anchored replace would delete the whole line — including the
+    // module's leading `/**`, leaving an orphaned JSDoc body that is a
+    // SyntaxError ("Unexpected token '*'") on device.
+    code = code.replace(/import\s+[^;'"\n]*['"][^'"\n]*\/@id\/__x00__vite\/dynamic-import-helper[^'"\n]*['"]\s*;?/g, '');
     if (/\/@id\/__x00__vite\/dynamic-import-helper/.test(code)) {
         code = code.replace(/\/@id\/__x00__vite\/dynamic-import-helper[^"'`)]*/g, '/__NS_UNUSED_DYNAMIC_IMPORT_HELPER__');
     }
@@ -288,44 +562,52 @@ export function extractExportMetadata(code) {
     return { hasDefault, named: Array.from(named) };
 }
 function shouldAllowLocalCoreSanitizerPaths(contextLabel) {
-    return /\bnode_modules\/@nativescript\/vite\/hmr\/(?:client|frameworks)\//.test(contextLabel);
+    // The @nativescript/vite HMR runtime (client + framework strategies)
+    // legitimately references local core paths in strings — allow it whether it
+    // is served from node_modules or from the monorepo dist output
+    // (`file:../../dist/packages/vite` symlinks resolve to the real dist path,
+    // so no node_modules segment appears in the served URL).
+    return /\b(?:node_modules\/@nativescript\/vite|dist\/packages\/vite)\/hmr\/(?:client|frameworks)\//.test(contextLabel);
 }
 export function assertNoOptimizedArtifacts(code, contextLabel) {
-    try {
-        const offenders = [];
-        const lines = code.split('\n');
-        const tests = [/\b__VITE_PLUGIN__\b/, /\b__VITE_PRELOAD__\b/];
-        const localCore = /(^|[^\w@])(?:\.\.?\/|\/)??@nativescript[\/_-]core\//i;
-        for (let i = 0; i < lines.length; i++) {
-            const line = lines[i];
-            for (const re of tests) {
-                if (re.test(line)) {
-                    offenders.push(`${i + 1}: ${line.substring(0, 200)}`);
-                    break;
-                }
-            }
-            if (localCore.test(line)) {
-                const trimmed = line.trimStart();
-                if (trimmed.startsWith('//') || trimmed.startsWith('/*') || trimmed.startsWith('*')) {
-                    continue;
-                }
-                if (shouldAllowLocalCoreSanitizerPaths(contextLabel)) {
-                    continue;
-                }
-                offenders.push(`${i + 1}: ${line.substring(0, 200)} [local-core-path]`);
-            }
-            if (offenders.length >= 10)
+    const offenders = [];
+    const lines = code.split('\n');
+    const tests = [/\b__VITE_PLUGIN__\b/, /\b__VITE_PRELOAD__\b/];
+    const localCore = /(^|[^\w@])(?:\.\.?\/|\/)??@nativescript[\/_-]core\//i;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const re of tests) {
+            if (re.test(line)) {
+                offenders.push(`${i + 1}: ${line.substring(0, 200)}`);
                 break;
+            }
         }
-        if (offenders.length) {
-            const msg = `[sanitize-fail] Optimized deps/virtual id artifacts detected in ${contextLabel}. These cannot be evaluated by the device HTTP ESM loader. Offending lines (first ${Math.min(5, offenders.length)} shown):\n` + offenders.slice(0, 5).join('\n');
-            const error = new Error(msg);
-            error.code = 'NS_SANITIZE_FAIL';
-            error.offenders = offenders;
-            throw error;
+        if (localCore.test(line)) {
+            const trimmed = line.trimStart();
+            if (trimmed.startsWith('//') || trimmed.startsWith('/*') || trimmed.startsWith('*')) {
+                continue;
+            }
+            if (shouldAllowLocalCoreSanitizerPaths(contextLabel)) {
+                continue;
+            }
+            // Only module-resolution contexts (import/export/require) leak to the
+            // device ESM loader. A core path appearing as plain runtime string data
+            // — e.g. component-builder's `const CORE_UI_BARREL = '@nativescript/core/ui'`
+            // passed to `global.loadModule()`, which reads the bundler module
+            // registry, not the ESM loader — is legitimate and must not fail serving.
+            if (!/(?:\bimport\b|\bexport\b|\bfrom\s*["']|\brequire\s*\()/.test(line)) {
+                continue;
+            }
+            offenders.push(`${i + 1}: ${line.substring(0, 200)} [local-core-path]`);
         }
-    }
-    catch (error) {
+        if (offenders.length >= 10)
+            break;
+    }
+    if (offenders.length) {
+        const msg = `[sanitize-fail] Optimized deps/virtual id artifacts detected in ${contextLabel}. These cannot be evaluated by the device HTTP ESM loader. Offending lines (first ${Math.min(5, offenders.length)} shown):\n` + offenders.slice(0, 5).join('\n');
+        const error = new Error(msg);
+        error.code = 'NS_SANITIZE_FAIL';
+        error.offenders = offenders;
         throw error;
     }
 }
@@ -342,7 +624,7 @@ export function ensureDestructureCoreImports(code) {
             return match.length === 2 ? `${match[0].trim()}: ${match[1].trim()}` : seg;
         })
             .join(', ');
-        const reNamed = /(^|\n)\s*import\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[\d]+)?(?:\?p=[^"']+)?)['"];?\s*/gm;
+        const reNamed = /(^|\n)\s*import\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[^"']+)?)['"];?\s*/gm;
         result = result.replace(reNamed, (_full, prefix, specList, src) => {
             if (isDeepCoreSubpath(src))
                 return _full;
@@ -351,7 +633,7 @@ export function ensureDestructureCoreImports(code) {
             const decl = `const { ${toDestructure(specList)} } = ${tempName};`;
             return `${prefix}import ${tempName} from ${JSON.stringify(src)};\n${decl}\n`;
         });
-        const reMixed = /(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*,\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[\d]+)?(?:\?p=[^"']+)?)['"];?\s*/gm;
+        const reMixed = /(^|\n)\s*import\s+([A-Za-z_$][\w$]*)\s*,\s*\{([^}]+)\}\s*from\s*["']((?:https?:\/\/[^"']+)?\/ns\/core(?:\/[^"']+)?)['"];?\s*/gm;
         result = result.replace(reMixed, (_full, prefix, defName, specList, src) => {
             if (isDeepCoreSubpath(src))
                 return _full;
@@ -536,7 +818,7 @@ export function deduplicateLinkerImports(code) {
         return code;
     }
 }
-export function wrapCommonJsModuleForDevice(code) {
+export function wrapCommonJsModuleForDevice(code, absolutePath) {
     if (!code)
         return code;
     try {
@@ -562,6 +844,22 @@ export function wrapCommonJsModuleForDevice(code) {
                 namedExports.add(name);
             }
         }
+        // Static enumeration only sees `exports.foo = ...` and `Object.defineProperty(exports, 'foo', ...)`.
+        // Real-world packages like lodash attach their entire surface to a function inside an IIFE and
+        // then `module.exports = thatFunction`. Static analysis returns zero in that case. To handle
+        // these modules we ALSO load the package in the dev-server's Node context (only when we have a
+        // node_modules path) and merge the runtime keys. See `helpers/cjs-named-exports.ts` for the
+        // reasoning and safety boundaries.
+        if (absolutePath) {
+            try {
+                for (const n of getCjsNamedExports(absolutePath)) {
+                    namedExports.add(n);
+                }
+            }
+            catch {
+                /* fall through to whatever we caught statically */
+            }
+        }
         let suffix = `\nvar __cjs_mod = module.exports;\nexport default __cjs_mod;\n`;
         if (namedExports.size) {
             const entries = Array.from(namedExports);