@vesk/adapter 0.2.91 → 0.2.93

package/dist/client-bundle.d.ts

@@ -132,6 +132,10 @@ export declare function buildRuntimeCode(runtimeDir: string): string;
 /**
  * Names the client runtime actually exports, so the tree-shaken bundle only
  * emits the modules reachable from the used set.
+ *
+ * Parses index-client.js with the AST parser instead of regex so that direct
+ * declarations (export function locals() {}, export const x = 1, export class
+ * Foo {}) are captured alongside re-exports (export { X } from '...').
  */
 export declare function runtimeExportNames(runtimeDir: string): Set<string>;
 /**

package/dist/client-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-bundle.d.ts","sourceRoot":"","sources":["../src/client-bundle.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAmF,MAAM,yBAAyB,CAAC;AAuEnL;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BhE;AAED;;;;;GAKG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7B,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IACtH,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,YAAY,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;iBAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KAC/F,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAmDD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAKzD;AAkCD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B7D;AAiCD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBlD;AA8RD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASxD;AA4CD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,GAAG,MAAM,CAoBnG;AAED,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,CAKtE;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,SAAS,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAwwB7B;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+B3D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAUlE;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/F"}
+{"version":3,"file":"client-bundle.d.ts","sourceRoot":"","sources":["../src/client-bundle.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAmF,MAAM,yBAAyB,CAAC;AAuEnL;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BhE;AAED;;;;;GAKG;AACH,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7B,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IACtH,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,YAAY,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;iBAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KAC/F,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA4DD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAKzD;AAkCD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B7D;AAiCD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBlD;AA8RD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+B5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASxD;AA4CD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,GAAG,MAAM,CAoBnG;AAED,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,CAKtE;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,SAAS,EAAE,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAs1B7B;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+B3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAkClE;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/F"}

package/dist/client-bundle.js

@@ -137,32 +137,41 @@ function isAnyImport(node) {
 }
 /**
  * Generated client-preamble nodes the bundle must not re-emit: the local
- * `const __components = {}` registry plus the `__cleanup` / `__place` helpers —
- * the chunk IIFEs already define their own `__components`, so a second
- * declaration in the same scope would be a syntax error.
+ * `const __components = {}` / `const __hydrators = {}` registries plus the
+ * `__cleanup` / `__place` helpers — the chunk IIFEs already define their own
+ * registries, so a second declaration in the same scope would shadow the live
+ * map (registrations would land on a detached object).
  */
 function isRuntimePreamble(node) {
     if (node.type === 'FunctionDeclaration' && (node.id?.name === '__cleanup' || node.id?.name === '__place')) {
         return true;
     }
     if (node.type === 'VariableDeclaration') {
-        return node.declarations?.[0]?.id?.name === '__components';
+        const name = node.declarations?.[0]?.id?.name;
+        return name === '__components' || name === '__hydrators';
     }
     return false;
 }
 /**
  * `export default __components[<name>];` / `export const <name> = __components[<name>];`
- * aliases emitted by codegen. The bundle registers components on `__components`
- * directly, so these module-level re-exports must go.
+ * aliases emitted by codegen. Hydrate-mode codegen emits the same alias against
+ * `__hydrators`. The bundle registers components on those maps directly, so
+ * these module-level re-exports must go — two surviving `export default`s in
+ * one chunk are a `SyntaxError: Identifier '.default' has already been
+ * declared` that kills every page script.
  */
 function isComponentExport(node) {
+    const isRegistry = (ref) => {
+        const n = ref;
+        return !!n && n.type === 'MemberExpression' && n.object?.type === 'Identifier'
+            && (n.object.name === '__components' || n.object.name === '__hydrators');
+    };
     if (node.type === 'ExportDefaultDeclaration') {
-        const d = node.declaration;
-        return !!d && d.type === 'MemberExpression' && d.object?.type === 'Identifier' && d.object.name === '__components';
+        return isRegistry(node.declaration);
     }
     if (node.type === 'ExportNamedDeclaration') {
         const init = node.declaration?.type === 'VariableDeclaration' ? node.declaration.declarations?.[0]?.init : undefined;
-        return !!init && init.type === 'MemberExpression' && init.object?.type === 'Identifier' && init.object.name === '__components';
+        return isRegistry(init);
     }
     return false;
 }
@@ -582,7 +591,7 @@ function removeRanges(code, ranges) {
  */
 function fallbackReplay(cached, filePath, imports) {
     const comp = cached.compCode ? imports.add(cached.compCode, filePath).replace(/^\n+/, '').replace(/\n+$/, '') : '';
-    const hyd = cached.hydCode ? imports.add(cached.hydCode, filePath).replace(/__components/g, '__hydrators').replace(/^\n+/, '').replace(/\n+$/, '') : '';
+    const hyd = cached.hydCode ? imports.add(cached.hydCode, filePath).replace(/^\n+/, '').replace(/\n+$/, '') : '';
     return [comp, hyd].filter(Boolean).join('\n');
 }
 /**
@@ -929,7 +938,7 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
         const compSpecs = [];
         const hydSpecs = [];
         const compCode = compWithImports ? imports.add(compWithImports, filePath, compSpecs).replace(/^\n+/, '').replace(/\n+$/, '') : '';
-        const hydCode = hydWithImports ? imports.add(hydWithImports, filePath, hydSpecs).replace(/__components/g, '__hydrators').replace(/^\n+/, '').replace(/\n+$/, '') : '';
+        const hydCode = hydWithImports ? imports.add(hydWithImports, filePath, hydSpecs).replace(/^\n+/, '').replace(/\n+$/, '') : '';
         if (rawComp)
             collectRuntimeImports(rawComp);
         if (rawHyd)
@@ -1236,7 +1245,7 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                     const shim = join(tmpBase, `shim-${i}.js`);
                     const shimLines = [`const m = globalThis.__veskShared[${JSON.stringify(file)}];`];
                     if (hasDefault)
-                        shimLines.push(`export default m;`);
+                        shimLines.push(`export default m["default"];`);
                     for (const name of [...named].sort()) {
                         shimLines.push(`export const ${name} = m[${JSON.stringify(name)}];`);
                     }
@@ -1304,30 +1313,53 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                     // Pass the app tsconfig so esbuild resolves tsconfig `paths` aliases
                     // (`@/x`, `@app/x`) inside transitively bundled modules too.
                     const appTsconfig = findTsconfigPath(appDir);
-                    const result = await build({
-                        entryPoints: [tmpFile],
-                        bundle: true,
-                        format: 'iife',
-                        platform: 'browser',
-                        write: false,
-                        logLevel: 'silent',
-                        loader: { '.js': 'tsx' },
-                        // Bundled dependencies (lucide-vesk above all) carry a license
-                        // banner per module, and a barrel import pulls in hundreds of
-                        // them. Those banners were ~339 KB of a 350 KB chunk, which is
-                        // what kept a barrel import from being usable at all. Attribution
-                        // for a dependency stays in its own package; shipping every
-                        // module's header inside our own chunk adds nothing.
-                        legalComments: 'none',
-                        // Shared app modules are NOT inlined here: the resolver below
-                        // redirects them to a generated shim reading
-                        // `globalThis.__veskShared`, so the single copy in
-                        // shared-modules.js serves every route chunk. (esbuild's `alias`
-                        // option only accepts bare package names, so this is a resolver
-                        // rather than a map.)
-                        ...(sharedRedirectPlugin ? { plugins: [sharedRedirectPlugin, serverOnlyGuard] } : { plugins: [serverOnlyGuard] }),
-                        ...(appTsconfig ? { tsconfig: appTsconfig } : {}),
-                    });
+                    // Build an alias map so esbuild can resolve bare specifiers
+                    // (e.g. "vesk-qr") from the app's node_modules. The entry code lives
+                    // in a temp directory, so esbuild's default resolver (walking up from
+                    // the entry file) can't find app-level node_modules. resolveDir
+                    // doesn't exist in this esbuild version, so we alias each bare
+                    // specifier to its resolved absolute path.
+                    const alias = {};
+                    for (const source of entry.importsTable.sources()) {
+                        if (source.startsWith('/') || source.startsWith('./') || source.startsWith('../'))
+                            continue;
+                        let resolved = resolveSsrModule(source, appDir);
+                        if (!resolved)
+                            resolved = resolveImportPath(source, appDir);
+                        if (resolved && !resolved.startsWith('\0builtin:')) {
+                            alias[source] = resolved;
+                        }
+                    }
+                    const result = await Promise.race([
+                        build({
+                            entryPoints: [tmpFile],
+                            bundle: true,
+                            format: 'iife',
+                            platform: 'browser',
+                            write: false,
+                            logLevel: 'silent',
+                            loader: { '.js': 'tsx' },
+                            // Bundled dependencies (lucide-vesk above all) carry a license
+                            // banner per module, and a barrel import pulls in hundreds of
+                            // them. Those banners were ~339 KB of a 350 KB chunk, which is
+                            // what kept a barrel import from being usable at all. Attribution
+                            // for a dependency stays in its own package; shipping every
+                            // module's header inside our own chunk adds nothing.
+                            legalComments: 'none',
+                            // Shared app modules are NOT inlined here: the resolver below
+                            // redirects them to a generated shim reading
+                            // `globalThis.__veskShared`, so the single copy in
+                            // shared-modules.js serves every route chunk. (esbuild's `alias`
+                            // option only accepts bare package names, so this is a resolver
+                            // rather than a map.)
+                            ...(sharedRedirectPlugin ? { plugins: [sharedRedirectPlugin, serverOnlyGuard] } : { plugins: [serverOnlyGuard] }),
+                            ...(appTsconfig ? { tsconfig: appTsconfig } : {}),
+                            // Alias bare specifiers to their resolved absolute paths so
+                            // esbuild can find them from the temp chunk dir.
+                            ...(Object.keys(alias).length ? { alias } : {}),
+                        }),
+                        new Promise((_, reject) => setTimeout(() => reject(new Error('chunk esbuild timeout')), 60000)),
+                    ]);
                     finalCode = result.outputFiles[0].text;
                 }
                 catch (e) {
@@ -1337,22 +1369,22 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                         return x.text + at;
                     }).join(' | ') || err?.message || String(e);
                     console.error('[vesk] chunk bundle failed', entry.name, detail);
-                    // Under --strict this must fail the build. The fallback below is a
-                    // DEVELOPMENT convenience only: it strips the unresolvable import
-                    // and leaves every name it bound dangling, so the chunk parses, the
-                    // build exits 0, and the page dies at hydration with `X is not
-                    // defined` — far from the import that caused it. A wrong-case deep
-                    // import (`lucide-vesk/icons/terminal`) hit exactly this.
-                    if (options?.strict) {
-                        throw new Error(`[vesk] chunk bundle failed: ${entry.name} — ${detail}`);
+                    // A module-scope server-only use is diagnosed here rather than after
+                    // the try: the bundler itself throws when the transitive TCP driver
+                    // (pg → node:net) can't be browser-bundled, which would otherwise
+                    // shadow the real, actionable problem.
+                    if (eagerHits.length > 0) {
+                        const eagerDetail = eagerHits
+                            .map(h => `${h.importer} uses ${h.bindings.map(b => `"${b}"`).join(', ')} from "${h.specifier}" at module scope`)
+                            .join('; ');
+                        console.error('[vesk] server-only package used at module scope in client code', entry.name + ':', eagerDetail);
+                        throw new Error(`[vesk] ${entry.name}: ${eagerDetail}.\n` +
+                            'A module-scope statement runs the moment the browser evaluates the chunk, so a ' +
+                            'server-only package cannot be substituted there. Move that work into an API route ' +
+                            '(app/api/**/route.ts) or a server action — if the binding is only used from inside ' +
+                            'a function, this build already handles it.');
                     }
-                    // Fall back to the historical behavior: strip every import so the
-                    // classic script at least parses. Bindings imported from native-only
-                    // `@vesk/*` libraries get throwing stubs (a readable degradation
-                    // instead of a baffling `X is not defined`); every other stripped
-                    // name stays dangling, which is the pre-existing failure mode.
-                    const stripped = demoteExports(removeCompiledNodes(entry.code, isAnyImport));
-                    finalCode = chunkIIFE(nativeLibraryImportStubs(entry.code) + stripped);
+                    throw new Error(`[vesk] chunk bundle failed: ${entry.name} — ${detail}`);
                 }
                 finally {
                     try {
@@ -1360,25 +1392,6 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
                     }
                     catch { }
                 }
-                // Checked OUTSIDE the try above, deliberately. A TCP driver cannot be
-                // stubbed into a browser bundle — a page that looked fine and failed on
-                // its first query would be worse than a build error — and the catch
-                // block degrades every failure into "strip the imports and carry on",
-                // which is exactly the wrong outcome for this one.
-                if (eagerHits.length > 0) {
-                    // A stub would throw while the chunk is still evaluating, so the page
-                    // would die before a component existed. That is the worst place to
-                    // learn about it: refuse the build instead.
-                    const detail = eagerHits
-                        .map(h => `${h.importer} uses ${h.bindings.map(b => `"${b}"`).join(', ')} from "${h.specifier}" at module scope`)
-                        .join('; ');
-                    console.error('[vesk] server-only package used at module scope in client code', entry.name + ':', detail);
-                    throw new Error(`[vesk] ${entry.name}: ${detail}.\n` +
-                        'A module-scope statement runs the moment the browser evaluates the chunk, so a ' +
-                        'server-only package cannot be substituted there. Move that work into an API route ' +
-                        '(app/api/**/route.ts) or a server action — if the binding is only used from inside ' +
-                        'a function, this build already handles it.');
-                }
                 if (driverHits.length > 0) {
                     const detail = [...new Set(driverHits.map(h => `${h.specifier} (from ${h.importer})`))].join(', ');
                     console.error('[vesk] chunk bundle contains a TCP-only driver', entry.name + ':', detail);
@@ -1494,6 +1507,13 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
         let hydratorLines = [];
         let aliasLines = [];
         let hydratorAliasLines = [];
+        // Mono builds bundle every file into one module scope. External-package
+        // imports (e.g. vesk-qr) are not stripped by stripVskImports/stripRuntimeImport,
+        // so multiple files importing the same package would emit duplicate
+        // `import { X } from "pkg"` declarations — a SyntaxError. Fold them into
+        // one deduped import block instead (mirrors what ChunkImports does for
+        // code-split chunks).
+        const monoImports = new ChunkImports();
         function compileFileMono(filePath, resolvedName) {
             if (seen.has(filePath))
                 return;
@@ -1512,8 +1532,15 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
             if (hydCode)
                 collectRuntimeImports(hydCode);
             // Comp and hyd share the file's top-level bindings — scope together.
-            const strippedComp = compCode ? stripExports(stripVskImports(stripRuntimeImport(compCode))).replace(/^\n+/, '').replace(/\n+$/, '') : '';
-            const strippedHyd = hydCode ? stripExports(stripVskImports(stripRuntimeImport(hydCode))).replace(/__components/g, '__hydrators').replace(/^\n+/, '').replace(/\n+$/, '') : '';
+            let strippedComp = compCode ? stripExports(stripVskImports(stripRuntimeImport(compCode))).replace(/^\n+/, '').replace(/\n+$/, '') : '';
+            let strippedHyd = hydCode ? stripExports(stripVskImports(stripRuntimeImport(hydCode))).replace(/^\n+/, '').replace(/\n+$/, '') : '';
+            // Fold remaining external-package imports into the shared dedup set and
+            // strip them from each file's contribution, so the same package imported
+            // by multiple files only emits one `import` statement.
+            if (monoImports.ok) {
+                strippedComp = strippedComp ? monoImports.add(strippedComp, filePath).replace(/^\n+/, '').replace(/\n+$/, '') : '';
+                strippedHyd = strippedHyd ? monoImports.add(strippedHyd, filePath).replace(/^\n+/, '').replace(/\n+$/, '') : '';
+            }
             const fileCode = [strippedComp, strippedHyd].filter(Boolean).join('\n');
             if (fileCode.trim())
                 componentLines.push(scopeFileContribution(fileCode));
@@ -1554,9 +1581,73 @@ export async function generateClientBundle(routeTree, appDir, componentMap, opti
         for (const [compName, compPath] of compMap) {
             compileFileMono(compPath, compName);
         }
-        const main = await buildMainBundle(routeTree, runtimeDir, false, {
+        // Emit the deduplicated external-package import block at the top of the
+        // bundle so every file can reference those bindings without duplicate
+        // declarations. If the import merge aborted (conflicting bindings), log a
+        // warning and leave imports in place (best-effort, matches historical behaviour).
+        if (monoImports.ok) {
+            const head = monoImports.render();
+            if (head)
+                componentLines.unshift(head);
+        }
+        else {
+            console.error('[vesk] mono import merge aborted:', monoImports.reason);
+        }
+        let main = await buildMainBundle(routeTree, runtimeDir, false, {
             componentLines, hydratorLines, aliasLines, hydratorAliasLines,
         }, !!options?.hmr, !!options?.importRuntime, runtimeImportNames, options?.routeDataCache);
+        // Bundle the monolithic output through esbuild so bare external-package
+        // imports (e.g. vesk-qr) are inlined instead of shipped as filesystem
+        // paths the browser cannot load. Without this, client.js contains
+        // `import ... from "/absolute/path/to/node_modules/…"` — the dev server
+        // answers that with its SPA fallback (text/html), the module script dies,
+        // the router never starts and hydration never completes.
+        const appTsconfig = findTsconfigPath(appDir);
+        const tmpBase = mkdtempSync(join(resolve(appDir, '..'), 'tmp-vesk-mono-'));
+        try {
+            const tmpFile = join(tmpBase, 'entry.js');
+            writeFileSync(tmpFile, main, 'utf-8');
+            const result = await build({
+                entryPoints: [tmpFile],
+                bundle: true,
+                format: 'iife',
+                platform: 'browser',
+                write: false,
+                logLevel: 'silent',
+                loader: { '.js': 'tsx' },
+                legalComments: 'none',
+                ...(appTsconfig ? { tsconfig: appTsconfig } : {}),
+                // Stub optional CJS deps (qrcode-generator via vesk-qr, canvas,
+                // @zxing/*) so esbuild never bundles their CJS source into the client
+                // bundle — that would emit a `__require` shim that throws in the
+                // browser. vesk-qr now lazy-loads them via dynamic import; stubbing
+                // keeps the bundle valid ESM without shipping dead code.
+                plugins: [
+                    {
+                        name: 'stub-browser-packages',
+                        setup(b) {
+                            b.onResolve({ filter: /^(qrcode-generator|canvas|@zxing\/(browser|node))(\/|$)/ }, (args) => ({ path: args.path, namespace: 'browser-stub' }));
+                            b.onLoad({ filter: /.*/, namespace: 'browser-stub' }, () => ({
+                                contents: 'export {}\n',
+                                loader: 'js',
+                            }));
+                        },
+                    },
+                ],
+            });
+            main = result.outputFiles[0].text;
+        }
+        catch (e) {
+            const detail = e?.errors?.map((x) => x.text).join(' | ') || e.message || String(e);
+            console.error('[vesk] client bundle failed', detail);
+            throw new Error(`[vesk] client bundle failed — ${detail}`);
+        }
+        finally {
+            try {
+                rmSync(tmpBase, { recursive: true, force: true });
+            }
+            catch { }
+        }
         // Mono (non-codeSplit) builds are the production path — no incremental cache.
         componentOwners.report('client bundle');
         return { main: await applyTransformPlugins(main, 'client.js'), chunks: [] };
@@ -1600,15 +1691,46 @@ export function buildRuntimeCode(runtimeDir) {
 /**
  * Names the client runtime actually exports, so the tree-shaken bundle only
  * emits the modules reachable from the used set.
+ *
+ * Parses index-client.js with the AST parser instead of regex so that direct
+ * declarations (export function locals() {}, export const x = 1, export class
+ * Foo {}) are captured alongside re-exports (export { X } from '...').
  */
 export function runtimeExportNames(runtimeDir) {
     const indexSrc = readFileSync(join(runtimeDir, 'index-client.js'), 'utf-8');
     const names = new Set();
-    for (const m of indexSrc.matchAll(/export\s*\{([^}]+)\}\s*from/g)) {
-        for (const raw of m[1].split(',')) {
-            const n = raw.trim().split(/\s+as\s+/).pop().trim();
-            if (n)
-                names.add(n);
+    const ast = parse(indexSrc, { filename: join(runtimeDir, 'index-client.js') });
+    for (const node of ast.body) {
+        const n = node;
+        if (n.type === 'ExportNamedDeclaration') {
+            if (n.declaration) {
+                // Direct declaration: export function foo() {}, export const x = 1,
+                // export class Bar {}
+                const decl = n.declaration;
+                if (decl.type === 'FunctionDeclaration' && decl.id) {
+                    names.add(String(decl.id.name));
+                }
+                else if (decl.type === 'ClassDeclaration' && decl.id) {
+                    names.add(String(decl.id.name));
+                }
+                else if (decl.type === 'VariableDeclaration') {
+                    for (const d of decl.declarations) {
+                        if (d.id.type === 'Identifier') {
+                            names.add(String(d.id.name));
+                        }
+                    }
+                }
+            }
+            else if (n.source) {
+                // Re-export: export { X } from '...' or export { X as Y } from '...'
+                for (const spec of n.specifiers) {
+                    if (spec.type === 'ExportSpecifier') {
+                        const exported = spec.exported.name;
+                        if (exported)
+                            names.add(String(exported));
+                    }
+                }
+            }
         }
     }
     return names;
@@ -1700,25 +1822,28 @@ async function bundleRuntimeNames(runtimeDir, names, strict = false) {
         }
         catch { /* not present yet */ }
         writeFileSync(entry, `export { ${unique.join(', ')} } from ${JSON.stringify(indexClient)};\n`);
-        const result = await build({
-            entryPoints: [esbuildPath(entry)],
-            bundle: true,
-            format: 'iife',
-            globalName: '__veskRuntime',
-            platform: 'browser',
-            target: ['es2022'],
-            treeShaking: true,
-            // Do not let esbuild rename identifiers here. This bundle is one large
-            // IIFE built from many runtime modules, and the renaming pass of some
-            // esbuild versions (observed on 0.25.12) emits a free reference to an
-            // undefined minified name (ReferenceError: m is not defined) that kills
-            // client hydration for the whole app. Whitespace-only output keeps the
-            // runtime deterministic at a modest size cost; tree-shaking still prunes
-            // unreachable modules, so names coming out of the IIFE are untouched.
-            minify: false,
-            write: false,
-            logLevel: 'silent',
-        });
+        const result = await Promise.race([
+            build({
+                entryPoints: [esbuildPath(entry)],
+                bundle: true,
+                format: 'iife',
+                globalName: '__veskRuntime',
+                platform: 'browser',
+                target: ['es2022'],
+                treeShaking: true,
+                // Do not let esbuild rename identifiers here. This bundle is one large
+                // IIFE built from many runtime modules, and the renaming pass of some
+                // esbuild versions (observed on 0.25.12) emits a free reference to an
+                // undefined minified name (ReferenceError: m is not defined) that kills
+                // client hydration for the whole app. Whitespace-only output keeps the
+                // runtime deterministic at a modest size cost; tree-shaking still prunes
+                // unreachable modules, so names coming out of the IIFE are untouched.
+                minify: false,
+                write: false,
+                logLevel: 'silent',
+            }),
+            new Promise((_, reject) => setTimeout(() => reject(new Error('runtime esbuild timeout')), 60000)),
+        ]);
         const bundle = result.outputFiles[0].text;
         return `${bundle}\nconst { ${unique.join(', ')} } = __veskRuntime;\nexport { ${unique.join(', ')} };\n`;
     }

package/dist/dev-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../src/dev-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AASjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAO7C,OAAO,KAAK,EAAa,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAgBjG;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;IAC9C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxD,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB;+EAC2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAwDD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mHAAmH;IACnH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B;;8BAE0B;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,WAAW,CAAC;IAChC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChH,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAa3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrD;AAUD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAorBvG"}
+{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../src/dev-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AASjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAO7C,OAAO,KAAK,EAAa,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAgBjG;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;IAC9C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxD,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB;+EAC2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAwDD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mHAAmH;IACnH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B;;8BAE0B;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,WAAW,CAAC;IAChC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChH,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAa3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQrD;AAUD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4sBvG"}

package/dist/dev-server.js

@@ -150,7 +150,10 @@ export function devBootstrapScript() {
 export function injectDevScripts(html) {
     if (!html.includes('</body>'))
         return html;
-    const scripts = '\t<script type="module" src="/_vesk/hmr.js"></script>\n' + devBootstrapScript() + '\n';
+    const scripts = '\t<script type="module" src="/_vesk/client.js"></script>\n' +
+        '\t<script type="module" src="/_vesk/hmr.js"></script>\n' +
+        devBootstrapScript() +
+        '\n';
     return html.replace('</body>', scripts + '</body>');
 }
 const MIME = {
@@ -404,7 +407,12 @@ export async function startDevServer(appDir, options) {
             }
         }
     }
-    await doBuild().catch(() => { });
+    await doBuild();
+    if (pendingInitialError) {
+        console.error(`vesk dev: initial build failed — ${pendingInitialError.message}`);
+        console.error(`vesk dev: cannot start server with a broken build. Fix the errors above and restart.`);
+        process.exit(1);
+    }
     const server = createServer(async (req, res) => {
         const url = new URL(req.url || '/', `http://localhost:${port}`);
         // SSR fetches may run while concurrent sub-requests (e.g. the page's own
@@ -507,6 +515,25 @@ export async function startDevServer(appDir, options) {
             res.end(runtimeBundle);
             return;
         }
+        // Serve the dev client bundle at /_vesk/client.js. The file is written to
+        // devDir/static/client.js by the build step. The SSR-injected script tag
+        // references this exact URL.
+        if (url.pathname === '/_vesk/client.js') {
+            const clientPath = resolve(devDir, 'static', 'client.js');
+            try {
+                if (existsSync(clientPath)) {
+                    res.writeHead(200, { 'Content-Type': 'application/javascript' });
+                    res.end(readFileSync(clientPath, 'utf-8'));
+                    return;
+                }
+            }
+            catch {
+                /* fall through to 404 below */
+            }
+            res.writeHead(404, { 'Content-Type': 'text/plain' });
+            res.end('client.js not built yet');
+            return;
+        }
         // External data scripts (/ssr-data.js?t=...) are emitted by
         // storeDataScriptGlobal once a render serializes SSR data. Without this
         // route the dev SPA fallback served the HTML document as the script's

package/dist/esbuild-fallback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-fallback.d.ts","sourceRoot":"","sources":["../src/esbuild-fallback.ts"],"names":[],"mappings":"AAkCA,wBAAsB,KAAK,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAiBtD"}
+{"version":3,"file":"esbuild-fallback.d.ts","sourceRoot":"","sources":["../src/esbuild-fallback.ts"],"names":[],"mappings":"AAkCA,wBAAsB,KAAK,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAoBtD"}

package/dist/esbuild-fallback.js

@@ -4,7 +4,7 @@
 // the compiler's dependency-free `stripCodeTypes` (acorn-based), so no
 // transformSync path exists anymore.
 let _nativeBuild = null;
-let _nativeDead = false;
+let _nativeDead = process.env.VESK_NO_NATIVE_ESBUILD === 'true';
 let _wasm = null;
 let _wasmReady = null;
 async function loadNative() {
@@ -25,22 +25,25 @@ async function getWasm() {
         _wasmReady = import('esbuild-wasm').then(m => {
             _wasm = m;
             return m;
-        }).catch(() => {
+        }).catch((e) => {
             _wasmReady = null;
-            throw new Error('esbuild-wasm not available — install it with: npm install esbuild-wasm');
+            throw new Error(`esbuild-wasm not available — install it with: npm install esbuild-wasm (underlying: ${e instanceof Error ? e.message : String(e)})`);
         });
     }
     return _wasmReady;
 }
 export async function build(options) {
     await loadNative();
-    if (_nativeBuild) {
+    if (_nativeBuild && !_nativeDead) {
         try {
-            return await _nativeBuild(options);
+            return await Promise.race([
+                _nativeBuild(options),
+                new Promise((_, reject) => setTimeout(() => reject(new Error('esbuild native timeout')), 120000)),
+            ]);
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
-            if (msg.includes('SIGILL') || msg.includes('illegal hardware instruction') || msg.includes('cannot execute binary file')) {
+            if (msg.includes('SIGILL') || msg.includes('illegal hardware instruction') || msg.includes('cannot execute binary file') || msg.includes('esbuild native timeout')) {
                 console.warn('vesk: native esbuild failed, falling back to esbuild-wasm:', msg);
                 _nativeDead = true;
             }

package/dist/platform-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-handler.d.ts","sourceRoot":"","sources":["../src/platform-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AASvE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAMpD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEtC;AAgBD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CA4PjF;AAED,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4GzF;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}
+{"version":3,"file":"platform-handler.d.ts","sourceRoot":"","sources":["../src/platform-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AASvE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAMpD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEtC;AAgBD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CA4PjF;AAED,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmJzF;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}

package/dist/platform-handler.js

@@ -337,17 +337,42 @@ export const sep = '/';
 export const delimiter = ':';
 export const spawnSync = () => ({ status: 0 });
 export const execSync = () => '';
-export const randomBytes = () => ({});
-export const createHash = () => ({ update: () => {}, digest: () => '' });
 `;
-                    return {
-                        contents,
-                        loader: 'js',
-                    };
+                    return { contents, loader: 'js' };
                 });
             },
         });
     }
+    // Edge/neutral targets bundle everything into ESM. CJS dependencies (e.g.
+    // qrcode-generator via vesk-qr) can't be bundled as ESM — esbuild rewrites
+    // their require() calls into `__require` shims that throw in ESM output.
+    // esbuild 0.28's string `external` option does not externalize resolvable
+    // bare specifiers (it emits `__require` shims instead), so resolve these
+    // packages to empty stub modules. Nothing from them is bundled, so no
+    // `__require` definition or call leaks into the edge bundle. vesk-qr and its
+    // optional CJS deps (qrcode-generator, canvas, @zxing/*) are optional at
+    // runtime on edge (they fail gracefully), so stubbing them at build time is
+    // safe and keeps the bundle valid ESM.
+    plugins.push({
+        name: 'stub-edge-packages',
+        setup(build) {
+            build.onResolve({ filter: /^(vesk-qr|qrcode-generator|canvas|@zxing\/(browser|node))(\/|$)/ }, (args) => ({ path: args.path, namespace: 'vesk-edge-stub' }));
+            build.onLoad({ filter: /.*/, namespace: 'vesk-edge-stub' }, () => ({
+                contents: [
+                    'export const CofoundrMatrix = undefined;\n',
+                    'export const generate = undefined;\n',
+                    'export const Qr = undefined;\n',
+                    'export const RawHtml = undefined;\n',
+                    'export const CanvasUnavailableError = undefined;\n',
+                    'export const InvalidConfigError = undefined;\n',
+                    'export const QREncodingError = undefined;\n',
+                    'export const ScanReliabilityError = undefined;\n',
+                    'export const QRError = undefined;\n',
+                ].join(''),
+                loader: 'js',
+            }));
+        },
+    });
     const result = await build({
         entryPoints: [entry],
         bundle: true,
@@ -377,7 +402,18 @@ export const createHash = () => ({ update: () => {}, digest: () => '' });
                         'const require = createRequire(import.meta.url);\n',
                 },
             }
-            : {}),
+            : {
+                // Edge/neutral targets bundle everything into ESM. CJS dependencies
+                // (e.g. qrcode-generator via vesk-qr) can't be bundled as ESM —
+                // esbuild adds `__require` shims that throw in ESM output. Mark them
+                // external so they're left as bare imports instead of `__require`
+                // shims. vesk-qr is ESM but internally requires() its CJS deps,
+                // which would generate __require shims — externalize it too so its
+                // code never enters the bundle. On edge hosts without node_modules
+                // these external imports fail at runtime (expected — CJS packages
+                // don't run on edge), but the bundle itself is valid ESM.
+                external: ['vesk-qr', 'qrcode-generator', 'canvas', '@zxing/browser', '@zxing/node'],
+            }),
         logOverride: { 'direct-eval': 'silent' },
         plugins,
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vesk/adapter",
-  "version": "0.2.91",
+  "version": "0.2.93",
   "type": "module",
   "description": "Vesk adapter — builds deployable .vesk/ output for Deno and Node serverless",
   "main": "./dist/index.js",
@@ -23,9 +23,9 @@
     "sharp": "^0.35.3"
   },
   "dependencies": {
-    "@vesk/compiler": "^0.2.91",
-    "@vesk/runtime": "^0.2.91",
-    "@vesk/types": "^0.2.91"
+    "@vesk/compiler": "^0.2.93",
+    "@vesk/runtime": "^0.2.93",
+    "@vesk/types": "^0.2.93"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",