@wular/pnext 0.0.1

package/src/runtime/server.ts

@@ -0,0 +1,3453 @@
+import { createHash } from 'node:crypto';
+import { builtinModules, createRequire } from 'node:module';
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { copyFile, mkdir, readFile, rm, stat, symlink, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { build, transform, type Loader, type Metafile, type OnLoadResult, type OnResolveResult, type Plugin } from 'esbuild';
+import {
+  applyBundledSourceTransforms,
+  applyServerSourcePreTransforms,
+  applyServerSourceTransforms,
+  extraLoadableExtensions,
+  getAssetExtensions,
+  getBundlerExtensions,
+  getCssExtensions,
+  getImportAliasExtensions,
+  onLoadableExtensionsChanged,
+  serverDefineOptions,
+  sourceNeedsServerTransforms,
+  type ServerEsbuildPluginOptions,
+} from '../extensions';
+import {
+  frameworkRuntimeAliasEntries,
+  pathToFileHref,
+  pnextAliases,
+  type CompatAliasTarget,
+  type ResolvedConfig,
+} from '../config';
+import {
+  rewriteDynamicCallTargets,
+  rewriteLiteralDynamicCalls,
+  sourceHasDynamicImport,
+} from '../dynamic/source';
+import { cacheRoot, devArtifactUsable, noteDevArtifactWritten } from '../dev/module-cache';
+import { readNodeModuleBundle, writeNodeModuleBundle } from '../dev/node-module-bundle-cache';
+import { setBasePathPrefix, setTrailingSlashUrls } from '../routing/href';
+import {
+  getExternalPackagePolicy,
+  isEsmModuleEntry,
+  isEsmModuleFile,
+  isPackageSubpathUnexported,
+  resolveExternalLoadTarget,
+  resolveImport,
+  resolveLinkedPackageSpecifier,
+  resolveNestedPackageFromImporter,
+  resolveVendorPackageSpecifier,
+  clearVendorPackageResolutions,
+  clearProvidedEntryResolutions,
+  provideEntryResolution,
+  workspacePackageRoots,
+} from '../resolve/imports';
+import { clearNodeModulesResolutionCache } from '../resolve/engine';
+import { cachedExistsSync, clearNodeModulesFsCache } from '../utils/fs-cache';
+import {
+  clientReferenceExportNames,
+  clientReferenceModuleSource,
+  hasUseClientDirective,
+} from '../client/reference-stub';
+import { reactCompatEnabled } from '../render/hooks';
+import { escapeRegex } from '../utils/source';
+import { writeFileAtomic } from '../utils/fs';
+import {
+  addCommonJsNamedExports,
+  canonicalVendorCode,
+  noteVendorContentId,
+  vendorContentId,
+  cjsEntryMayHaveNamedExports,
+  cjsNamedExportFacade,
+  heavyProfRow,
+  clearVendorPipeline,
+  copyBrowserReadyEsmDist,
+  dropVendorBundle,
+  dropVendorGroup,
+  nextVendorTraceSeq,
+  outsideVendorSlot,
+  trackPreplanBuild,
+  rewriteEmittedRefs,
+  vendorBundle,
+  vendorBundleMemHit,
+  vendorTraceEnabled,
+  vendorTraceRow,
+  verifyVendorArtifact,
+  type VendorBuildPlan,
+  type VendorGroupMember,
+  type VendorGroupPlan,
+} from './vendor';
+
+const require = createRequire(import.meta.url);
+
+// B4/B5: extra esbuild resolve conditions layered onto the server (RSC) vendor
+// bundle. Core always applies `react-server` (the server graph IS the RSC
+// layer). Compat can add `next-js` (only when cacheComponents is on) via the
+// setter. Kept as a module-level seam so core carries no static edge into
+// compat's config reader.
+export type ServerBundleTarget =
+  | CompatAliasTarget
+  | 'edge'
+  | 'pages-api'
+  | 'pages-api-edge'
+  | 'pages'
+  | 'pages-edge';
+
+let extraServerBundleConditions: (target: ServerBundleTarget) => string[] = () => [];
+
+/** Install compat-driven extra vendor-bundle conditions (B5 `next-js`). */
+export function setServerBundleConditions(
+  factory: ((target: ServerBundleTarget) => string[]) | undefined,
+): void {
+  extraServerBundleConditions = factory ?? (() => []);
+}
+
+export function serverBundleTargetForRuntime(runtime: string | undefined): ServerBundleTarget {
+  return runtime === 'edge' || runtime === 'experimental-edge' ? 'edge' : 'server';
+}
+
+export function pagesApiBundleTargetForRuntime(runtime: string | undefined): ServerBundleTarget {
+  return runtime === 'edge' || runtime === 'experimental-edge' ? 'pages-api-edge' : 'pages-api';
+}
+
+/**
+ * Pages-router PAGE SSR layer: Next compiles it in the server bundle with `node` (or
+ * `edge-light`/`browser` for edge) export conditions but WITHOUT `react-server` - a pages page is
+ * not part of the RSC layer, so `library/react`-style react-server splits must resolve to `default`.
+ */
+export function pagesBundleTargetForRuntime(runtime: string | undefined): ServerBundleTarget {
+  return runtime === 'edge' || runtime === 'experimental-edge' ? 'pages-edge' : 'pages';
+}
+
+function serverBundleConditions(target: ServerBundleTarget): string[] {
+  // Preserve the original client-target conditions (module/import) to avoid
+  // regressing the browser SSR vendor bundle; only the RSC/server layer gains
+  // `react-server`. Compat-added conditions (next-js) prepend for either target.
+  const base =
+    target === 'client'
+      ? ['module', 'import']
+      : target === 'edge'
+        ? ['react-server', 'edge-light', 'browser', 'module', 'import']
+        : target === 'pages-api-edge'
+          ? ['edge-light', 'browser', 'module', 'import']
+          : target === 'pages-api'
+            ? ['node', 'require', 'import']
+            : target === 'pages-edge'
+              ? ['edge-light', 'browser', 'module', 'import']
+              : target === 'pages'
+                ? ['node', 'module', 'import']
+                : ['react-server', 'node', 'module', 'import'];
+  return [...new Set([...extraServerBundleConditions(target), ...base])];
+}
+
+export function serverBundleRequireConditions(target: ServerBundleTarget): string[] {
+  const base =
+    target === 'client'
+      ? ['module', 'require']
+      : target === 'edge'
+        ? ['react-server', 'edge-light', 'browser', 'module', 'require']
+        : target === 'pages-api-edge'
+          ? ['edge-light', 'browser', 'module', 'require']
+          : target === 'pages-api'
+            ? ['node', 'require']
+            : target === 'pages-edge'
+              ? ['edge-light', 'browser', 'module', 'require']
+              : target === 'pages'
+                ? ['node', 'module', 'require']
+                : ['react-server', 'node', 'module', 'require'];
+  return [...new Set([...extraServerBundleConditions(target), ...base])];
+}
+
+const runtimeConfigs = new Map<string, RuntimeConfig>();
+const aliasCache = new WeakMap<ResolvedConfig, Map<string, string>>();
+const packageRootCache = new WeakMap<ResolvedConfig, string[]>();
+const registeredSignatures = new WeakMap<ResolvedConfig, Set<string>>();
+const rootPathCache = new Map<string, string[]>();
+const runtimeConfigLookupCache = new Map<string, RuntimeConfig | null>();
+const firstAliasCache = new Map<string, string | null>();
+const transformCache = new Map<string, TransformCacheEntry>();
+const nodeModuleTransformCache = new Map<string, TransformCacheEntry>();
+// Freshness of generated `.pnext-require.cjs` sidecars (see inlineModuleScopeRequires).
+const requireSidecarCache = new Map<string, { mtimeMs: number; size: number }>();
+const registeredLoadRoots = new Set<string>();
+let resolveRegistered = false;
+let nodeModulesLoadRegistered = false;
+// A live Bun.plugin forces every later import through the plugin pipeline (and
+// pnext's own src through transformSource), so importing the compat graph with
+// the plugins already up costs ~5x. build/start load compat before they ever
+// register a runtime; dev arms the plugins on the first request instead.
+let pluginsDeferred = false;
+const deferredPluginRoots = new Set<string>();
+
+const packageJsxLoaders = {
+  '.js': 'jsx',
+  '.mjs': 'jsx',
+  '.cjs': 'jsx',
+} satisfies Record<string, Loader>;
+
+interface RuntimeConfig {
+  root: string;
+  roots: Set<string>;
+  aliases: Map<string, string>;
+  /** Full resolved config, so compile sites can invoke config-aware extensions. */
+  resolved: ResolvedConfig;
+  missingImportError: (specifier: string) => string | undefined;
+}
+
+interface TransformCacheEntry {
+  mtimeMs: number;
+  size: number;
+  code: string;
+}
+
+export function registerServerRuntime(config: ResolvedConfig, sourceFiles: string[] = []) {
+  // Server-rendered Links emit canonical (slashed) hrefs under trailingSlash.
+  setTrailingSlashUrls(Boolean(config.trailingSlash));
+  // File-convention metadata asset hrefs (og-image, manifest) carry the
+  // basePath prefix; core render reads it through the href seam.
+  setBasePathPrefix(typeof config.basePath === 'string' ? config.basePath : '');
+  if (typeof Bun === 'undefined') return;
+  const sourceRoots = [...new Set(sourceFiles.map(file => sourceRootForFile(config, file)))].sort();
+  const signature = sourceRoots.join('\0');
+  let registered = registeredSignatures.get(config);
+  if (!registered) {
+    registered = new Set();
+    registeredSignatures.set(config, registered);
+  }
+  if (registered.has(signature)) return;
+  registered.add(signature);
+
+  const aliases = aliasesForConfig(config);
+  const roots = [
+    ...rootPaths(config.appPath),
+    ...rootPaths(path.join(config.outPath, 'cache', 'server')),
+    // The pnext src root, so the framework's own source transforms too.
+    ...rootPaths(path.join(import.meta.dirname, '..')),
+    ...sourceRoots.flatMap(rootPaths),
+  ];
+  const key = rootPaths(config.appPath).join('\0');
+  const missingImportError = (specifier: string) =>
+    getImportAliasExtensions().missingImportError(config, specifier);
+  const existing = runtimeConfigs.get(key);
+  if (existing) {
+    for (const root of roots) existing.roots.add(root);
+    for (const [specifier, target] of aliases) existing.aliases.set(specifier, target);
+    existing.resolved = config;
+    existing.missingImportError = missingImportError;
+  } else {
+    runtimeConfigs.set(key, {
+      root: config.root,
+      roots: new Set(roots),
+      aliases: new Map(aliases),
+      resolved: config,
+      missingImportError,
+    });
+  }
+  runtimeConfigLookupCache.clear();
+  firstAliasCache.clear();
+  if (pluginsDeferred) {
+    for (const root of roots) deferredPluginRoots.add(root);
+    return;
+  }
+  registerResolvePlugin();
+  registerNodeModulesLoadPlugin();
+  for (const root of roots) registerLoadPlugin(root);
+}
+
+/**
+ * Hold the Bun module plugins back until installServerRuntimePlugins() runs, so
+ * whatever the process still has to import of its own code loads natively.
+ */
+export function deferServerRuntimePlugins(): void {
+  pluginsDeferred = true;
+}
+
+/** Arm the plugins deferServerRuntimePlugins() held back. Idempotent, cheap. */
+export function installServerRuntimePlugins(): void {
+  if (!pluginsDeferred) return;
+  pluginsDeferred = false;
+  registerResolvePlugin();
+  registerNodeModulesLoadPlugin();
+  for (const root of deferredPluginRoots) registerLoadPlugin(root);
+  deferredPluginRoots.clear();
+}
+
+export function clearServerRuntimeCaches() {
+  clearVendorPipeline();
+  clearVendorNativeCaches();
+  vendorEntryResolutions.clear();
+  clearVendorPackageResolutions();
+  vendorLayerRecords.clear();
+  vendorSharedEntries.clear();
+  vendorSharedLoaded.clear();
+  vendorReuseVerdicts.clear();
+  vendorReuseLoaded.clear();
+  vendorReuseProbes.clear();
+  vendorLayerProbeMemo.clear();
+  // The marker memo tracks files under `.pnext`; a wipe takes them with it.
+  esmDistPackages.clear();
+  clearProvidedEntryResolutions();
+  clearNodeModulesResolutionCache();
+  clearNodeModulesFsCache();
+}
+
+function resolveRuntimeTarget(target: string) {
+  return path.isAbsolute(target) ? target : require.resolve(target);
+}
+
+function aliasesForConfig(config: ResolvedConfig) {
+  let aliases = aliasCache.get(config);
+  if (!aliases) {
+    aliases = new Map<string, string>();
+    for (const [specifier, target] of Object.entries(coreAliases(config, 'server'))) {
+      aliases.set(specifier, resolveRuntimeTarget(target));
+    }
+    aliasCache.set(config, aliases);
+  }
+  return aliases;
+}
+
+function coreAliases(config: ResolvedConfig, target: CompatAliasTarget): Record<string, string> {
+  return {
+    ...frameworkRuntimeAliasEntries(),
+    ...pnextAliases(target),
+    ...getImportAliasExtensions().aliases(config, target),
+  };
+}
+
+const aliasSpecifierFilter =
+  /^(?:@wular\/pnext\/cache|preact(?:\/|$)|react(?:-dom)?(?:\/|$)|react-compiler-runtime$|next(?:\/|$)|server-only$|client-only$|@vercel\/og$)/;
+
+function registerResolvePlugin() {
+  if (resolveRegistered) return;
+  resolveRegistered = true;
+  Bun.plugin({
+    name: 'pnext-server-runtime-resolve',
+    setup(plugin) {
+      plugin.onResolve({ filter: aliasSpecifierFilter }, args => {
+        const runtime = runtimeConfigForFile(args.importer);
+        const resolved = runtime?.aliases.get(args.path) ?? firstAliasForSpecifier(args.path);
+        const target = resolved ? serverRequireAlias(args.path, resolved, args.kind) : undefined;
+        if (target) return { path: target };
+        const message = (runtime ?? firstRuntimeConfig())?.missingImportError(args.path);
+        if (message) throw new Error(message);
+        return undefined;
+      });
+      plugin.onResolve({ filter: /^[^./].*/ }, ({ path: specifier, importer }) => {
+        const runtime = runtimeConfigForFile(importer);
+        const target = runtime && resolveExternalLoadTarget({
+          root: runtime.root,
+          fromFile: importer,
+          specifier,
+          target: 'server',
+        });
+        if (!target) return undefined;
+        return { path: target };
+      });
+    },
+  });
+}
+
+function registerLoadPlugin(root: string) {
+  if (registeredLoadRoots.has(root)) return;
+  registeredLoadRoots.add(root);
+  // eslint-disable-next-line turbo/no-undeclared-env-vars
+  if (process.env.PNEXT_DEBUG_LOADPLUGIN) {
+    console.error(`[loadplugin] register root=${root} extras=${currentLoadExtras().join(',')}`);
+  }
+  loadPluginExtras.set(root, currentLoadExtras());
+  Bun.plugin({
+    name: `pnext-server-runtime-load-${hashRoot(root)}`,
+    setup(plugin) {
+      plugin.onLoad({ filter: rootFilter(root) }, async ({ path: file }) => ({
+        contents: await transformSource(file),
+        loader: 'js',
+      }));
+    },
+  });
+}
+
+// The load plugin's filter regex latches the page extensions known at registration time. A root registered
+// BEFORE compat adds `mdx`/`md` (boot order shifts under load) would let those modules fall through to Bun's
+// file loader, whose default export is the file path and renders as a bogus JSX tag - so a late registration
+// extends every latched root with an extras-only plugin.
+const loadPluginExtras = new Map<string, string[]>();
+
+function currentLoadExtras(): string[] {
+  return extraLoadableExtensions().filter(ext => /^[a-z0-9]+$/i.test(ext));
+}
+
+onLoadableExtensionsChanged(() => {
+  for (const [root, seen] of loadPluginExtras) {
+    const fresh = currentLoadExtras().filter(ext => !seen.includes(ext));
+    if (fresh.length === 0) continue;
+    loadPluginExtras.set(root, [...seen, ...fresh]);
+    const exts = fresh.map(escapeRegex).join('|');
+    const filter = new RegExp(
+      `^${escapeRegex(root)}(?!.*\\/node_modules\\/)(?:/.*)?\\.(?:${exts})$`,
+    );
+    Bun.plugin({
+      name: `pnext-server-runtime-load-extras-${hashRoot(root)}-${fresh.join('-')}`,
+      setup(plugin) {
+        plugin.onLoad({ filter }, async ({ path: file }) => ({
+          contents: await transformSource(file),
+          loader: 'js',
+        }));
+      },
+    });
+  }
+});
+
+function registerNodeModulesLoadPlugin() {
+  if (nodeModulesLoadRegistered) return;
+  nodeModulesLoadRegistered = true;
+  Bun.plugin({
+    name: 'pnext-server-node-modules-load',
+    setup(plugin) {
+      plugin.onLoad(
+        {
+          filter:
+            /\/node_modules\/.*(?:\.mjs|\.esm\.js|\/(?:es|esm|dist\/esm|build\/modern)\/.*\.js)$/,
+        },
+        async ({ path: file }) => {
+          const code = await transformNodeModuleSource(file);
+          return { contents: code, loader: 'js' };
+        },
+      );
+    },
+  });
+}
+
+function runtimeConfigForFile(file: string | undefined) {
+  if (!file) return undefined;
+  const key = path.resolve(file);
+  if (runtimeConfigLookupCache.has(key)) {
+    return runtimeConfigLookupCache.get(key) ?? undefined;
+  }
+  for (const config of runtimeConfigs.values()) {
+    for (const root of config.roots) {
+      if (isInside(root, file)) {
+        runtimeConfigLookupCache.set(key, config);
+        return config;
+      }
+    }
+  }
+  runtimeConfigLookupCache.set(key, null);
+  return undefined;
+}
+
+function sourceRootForFile(config: ResolvedConfig, file: string) {
+  const dir = path.dirname(file);
+  if (isInside(config.appPath, dir)) return config.appPath;
+  return packageRootsForConfig(config).find(root => isInside(root, dir)) ?? dir;
+}
+
+function packageRootsForConfig(config: ResolvedConfig) {
+  let roots = packageRootCache.get(config);
+  if (!roots) {
+    roots = workspacePackageRoots(config.workspaceRoot);
+    packageRootCache.set(config, roots);
+  }
+  return roots;
+}
+
+function firstRuntimeConfig() {
+  for (const config of runtimeConfigs.values()) return config;
+  return undefined;
+}
+
+function firstAliasForSpecifier(specifier: string) {
+  if (firstAliasCache.has(specifier)) return firstAliasCache.get(specifier) ?? undefined;
+  for (const config of runtimeConfigs.values()) {
+    const target = config.aliases.get(specifier);
+    if (target) {
+      firstAliasCache.set(specifier, target);
+      return target;
+    }
+  }
+  firstAliasCache.set(specifier, null);
+  return undefined;
+}
+
+async function transformSource(file: string) {
+  const fileStat = await stat(file);
+  const cached = transformCache.get(file);
+  if (cached?.mtimeMs === fileStat.mtimeMs && cached.size === fileStat.size) {
+    return cached.code;
+  }
+  // The in-memory cache is empty on every restart, so a restarted server
+  // re-transforms the whole materialized module set on the request path.
+  const diskCache = transformCacheFile(file, fileStat);
+  if (diskCache) {
+    const code = await readFile(diskCache, 'utf8').catch(() => undefined);
+    if (code !== undefined) {
+      transformCache.set(file, { mtimeMs: fileStat.mtimeMs, size: fileStat.size, code });
+      return code;
+    }
+  }
+
+  const runtime = runtimeConfigForFile(file);
+  let raw = await readFile(file, 'utf8');
+  // Raw markdown compiles through the MDX pipeline first; materialized
+  // cache/server copies were already compiled in place (dev/imports) and would
+  // be corrupted by a second pass.
+  if (/\.mdx?$/.test(file) && !file.includes(`${path.sep}cache${path.sep}server${path.sep}`)) {
+    const { compileMdx } = await import('../compat/mdx/compile');
+    raw = (await compileMdx(raw, file, runtime?.root ?? path.dirname(file))).code;
+  }
+  const source = await inlineModuleScopeRequires(
+    rewriteServerSource(raw, file, {
+      root: runtime?.root,
+    }),
+    file,
+    runtime?.root,
+  );
+  const result = await transform(source, {
+    loader: esbuildLoader(file),
+    jsx: 'automatic',
+    jsxImportSource: 'preact',
+    sourcefile: file,
+    target: 'es2022',
+    ...serverDefineOptions(),
+  });
+  transformCache.set(file, {
+    mtimeMs: fileStat.mtimeMs,
+    size: fileStat.size,
+    code: result.code,
+  });
+  if (diskCache) {
+    await mkdir(path.dirname(diskCache), { recursive: true }).catch(() => undefined);
+    void writeFileAtomic(diskCache, result.code).catch(() => undefined);
+  }
+  return result.code;
+}
+
+// eslint-disable-next-line turbo/no-undeclared-env-vars
+const transformDiskCacheDisabled = process.env.PNEXT_TRANSFORM_DISK_CACHE === '0';
+const materializedSegment = `${path.sep}cache${path.sep}server${path.sep}`;
+
+/**
+ * Where a transform of `file` is remembered across restarts. Only for the
+ * materialized `cache/server` modules: they are hash-named build output under
+ * our own cache root, so the key (path + mtime + size + the define/extension
+ * inputs of the transform) is complete, and the whole tree is discarded when
+ * a build or a config change rewrites it.
+ */
+function transformCacheFile(file: string, fileStat: { mtimeMs: number; size: number }) {
+  if (transformDiskCacheDisabled) return undefined;
+  const at = file.lastIndexOf(materializedSegment);
+  if (at === -1) return undefined;
+  const cacheRoot = file.slice(0, at + materializedSegment.length);
+  const key = `${file}\0${fileStat.mtimeMs}\0${fileStat.size}\0${currentLoadExtras().join(',')}\0${JSON.stringify(serverDefineOptions())}`;
+  return path.join(cacheRoot, 'transform', `${hashBundleSpecifier(key)}.js`);
+}
+
+// A synchronous `require('./x')` of an app source module fails at runtime with `require() async
+// module ... is unsupported`: the load plugin's onLoad hook makes every app `[jt]sx?` module an
+// ASYNC Bun module, and Bun cannot `require` one. Bun does not route relative `require-call`s
+// through onResolve plugins (only bare specifiers reach them), so the alias trick cannot intercept
+// them at resolve time. Instead each such require is rewritten to a sibling
+// `<x>.pnext-require.cjs` compiled to CommonJS: a real `.cjs` on disk is deliberately excluded by
+// rootFilter, so Bun loads it natively and synchronously.
+//
+// Only requires that resolve to a rootFilter-matched app module are rewritten (a
+// `.cjs`/`.json`/node_modules require already loads synchronously). The sidecar is a distinct module
+// instance from the module's ESM copy - acceptable here, since the require path was an outright
+// crash before and such modules are typically leaf value modules.
+//
+// Both the source form and the BUILT form are matched: the server bundle keeps such a require
+// unbundled and emits esbuild's `__require("file:///abs/path/...")` shim call, which loads the very
+// same async app module at runtime.
+const REQUIRE_CALL = /\b(?:__)?require\(\s*(['"])((?:\.\.?\/|\/|file:\/\/)[^'"]+)\1\s*\)/g;
+
+async function inlineModuleScopeRequires(
+  source: string,
+  file: string,
+  root: string | undefined,
+): Promise<string> {
+  if (!root || !source.includes('require(')) return source;
+  const filter = rootFilter(root);
+  const sidecars = new Map<string, string>();
+  const pending: Promise<void>[] = [];
+  const seen = new Set<string>();
+  for (const match of source.matchAll(REQUIRE_CALL)) {
+    const specifier = match[2]!;
+    if (seen.has(specifier)) continue;
+    seen.add(specifier);
+    const target = requireCallTarget(root, file, specifier);
+    if (!target || !filter.test(target)) continue;
+    pending.push(
+      requireCjsSidecar(target).then(sidecar => {
+        if (sidecar) sidecars.set(specifier, sidecar);
+      }),
+    );
+  }
+  if (pending.length === 0) return source;
+  await Promise.all(pending);
+  if (sidecars.size === 0) return source;
+  return source.replace(REQUIRE_CALL, (whole, quote: string, specifier: string) => {
+    const sidecar = sidecars.get(specifier);
+    return sidecar ? `require(${quote}${sidecar}${quote})` : whole;
+  });
+}
+
+/** The module a rewritable `require(...)` call resolves to, if any. */
+function requireCallTarget(root: string, file: string, specifier: string): string | undefined {
+  if (specifier.startsWith('file://')) {
+    try {
+      return resolveImport(root, file, fileURLToPath(specifier));
+    } catch {
+      return undefined;
+    }
+  }
+  return resolveImport(root, file, specifier);
+}
+
+// Compile an app module to a sibling `.pnext-require.cjs` (CommonJS), reusing a
+// mtime/size-cached copy. Returns the sidecar path, or undefined on any failure
+// (the original require is then left as-is). The module runs through the same
+// server source pipeline as a normal load so the CJS copy behaves like the ESM
+// one; nested module-scope requires inside it are NOT recursively inlined.
+async function requireCjsSidecar(target: string): Promise<string | undefined> {
+  try {
+    const sidecar = requireCjsSidecarPath(target);
+    const fileStat = await stat(target);
+    const cached = requireSidecarCache.get(target);
+    if (cached?.mtimeMs === fileStat.mtimeMs && cached.size === fileStat.size) return sidecar;
+    const runtime = runtimeConfigForFile(target);
+    const source = rewriteServerSource(await readFile(target, 'utf8'), target, {
+      root: runtime?.root,
+    });
+    const result = await transform(source, {
+      loader: esbuildLoader(target),
+      jsx: 'automatic',
+      jsxImportSource: 'preact',
+      sourcefile: target,
+      target: 'es2022',
+      format: 'cjs',
+      ...serverDefineOptions(),
+    });
+    await writeFile(sidecar, result.code);
+    requireSidecarCache.set(target, { mtimeMs: fileStat.mtimeMs, size: fileStat.size });
+    return sidecar;
+  } catch {
+    return undefined;
+  }
+}
+
+function requireCjsSidecarPath(target: string): string {
+  return `${target.replace(/\.[^./\\]+$/, '')}.pnext-require.cjs`;
+}
+
+async function transformNodeModuleSource(file: string) {
+  const fileStat = await stat(file);
+  const cached = nodeModuleTransformCache.get(file);
+  if (cached?.mtimeMs === fileStat.mtimeMs && cached.size === fileStat.size) {
+    return cached.code;
+  }
+  // The in-memory cache is empty on every restart, so a restarted server
+  // re-BUNDLES each of these packages on the request path.
+  const record = nodeModuleBundleRecordFile(file, fileStat);
+  const reused = record ? await readNodeModuleBundle(record) : undefined;
+  if (reused !== undefined) {
+    nodeModuleTransformCache.set(file, { mtimeMs: fileStat.mtimeMs, size: fileStat.size, code: reused });
+    return reused;
+  }
+
+  const { code, inputs } = await bundleNodeModuleSource(file);
+  nodeModuleTransformCache.set(file, {
+    mtimeMs: fileStat.mtimeMs,
+    size: fileStat.size,
+    code,
+  });
+  if (record) void writeNodeModuleBundle(record, inputs, code);
+  return code;
+}
+
+/**
+ * Where a bundle of `file` is remembered across restarts. The entry's own stat is in the name, but
+ * the build inlines the package's relative graph too, so the record carries every esbuild input and
+ * is only reused while all of them still stat the same. A record that cannot be validated is a miss.
+ */
+function nodeModuleBundleRecordFile(file: string, fileStat: { mtimeMs: number; size: number }) {
+  if (transformDiskCacheDisabled) return undefined;
+  const outPath = (runtimeConfigForFile(file) ?? firstRuntimeConfig())?.resolved.outPath;
+  if (!outPath) return undefined;
+  const key = `${file}\0${fileStat.mtimeMs}\0${fileStat.size}\0${currentLoadExtras().join(',')}\0${JSON.stringify(serverDefineOptions())}`;
+  return path.join(cacheRoot(outPath), 'node-module-bundle', `${hashBundleSpecifier(key)}.json`);
+}
+
+async function bundleNodeModuleSource(file: string) {
+  const resolved = runtimeConfigForFile(file)?.resolved;
+  const extensionPlugins = resolved ? getBundlerExtensions().serverEsbuildPlugins(resolved) : [];
+  const result = await build({
+    // The marker entry only resolves when the extension chain is present.
+    entryPoints: [
+      (resolved
+        ? getBundlerExtensions().serverBundleEntry(file, path.dirname(file), file)
+        : undefined) ?? file,
+    ],
+    bundle: true,
+    write: false,
+    format: 'esm',
+    platform: 'neutral',
+    target: 'es2022',
+    loader: packageJsxLoaders,
+    jsx: 'automatic',
+    jsxImportSource: 'preact',
+    packages: 'external',
+    logLevel: 'silent',
+    metafile: true,
+    ...serverDefineOptions(),
+    plugins: [
+      serverAssetPlugin(),
+      ...extensionPlugins,
+      runtimeAliasBuildPlugin(undefined, 'server', { bundleRequireAliases: true }),
+    ],
+  });
+  const output = result.outputFiles[0];
+  if (!output) throw new Error(`Failed to bundle ${file}`);
+  // Packages can ship 'use cache' functions too (Next allows it); everything
+  // else in the source chain was already settled by the bundle above (imports
+  // resolved by the plugins, constants inlined by esbuild `define`).
+  return {
+    code: applyBundledSourceTransforms(output.text, file),
+    inputs: Object.keys(result.metafile.inputs).map(input => path.resolve(input)),
+  };
+}
+
+/**
+ * The one vendor-compile entry point. Every demand - a module compile's import scan, an esbuild
+ * resolve callback, a transitive dependency of another vendor bundle - arrives here and is scheduled
+ * by the pipeline in `./vendor`. `nested` marks demands raised from inside a running vendor build;
+ * see `withVendorSlot` for why they must not queue.
+ */
+export async function externalServerPackageHref(
+  config: ResolvedConfig,
+  specifier: string,
+  target: CompatAliasTarget,
+  resolveDir = config.root,
+  conditionTarget: ServerBundleTarget = target,
+  nested = false,
+) {
+  let plan = vendorBuildPlan(config, specifier, target, resolveDir, conditionTarget);
+  const aliased = await crossLayerReusePlan(config, specifier, resolveDir, target, conditionTarget, plan);
+  if (aliased) plan = aliased;
+  if (vendorTraceEnabled()) {
+    vendorTraceRow({
+      kind: 'request',
+      specifier,
+      resolveDir,
+      target,
+      conditionTarget,
+      memHit: vendorBundleMemHit(plan.key),
+      atMs: performance.now(),
+    });
+  }
+  let file = await vendorBundle(plan, nested);
+  // A `pnext build` wiping the output directory under a running server
+  // deletes vendor bundles; re-write instead of handing out a dead path.
+  if (!cachedExistsSync(file) || !(await compiledModuleUsable(file))) {
+    dropVendorBundle(plan.key, file);
+    if (plan.group) dropVendorGroup(plan.group.key);
+    file = await vendorBundle(plan, nested);
+  }
+  return pathToFileHref(file);
+}
+
+/**
+ * Artifact identity: what the bundle is compiled FROM, never who asked. Keying on the importer's
+ * directory (what `require.resolve` fell back to when a package publishes no `require` condition)
+ * split one package into one build per importing directory.
+ */
+function vendorArtifactKey(
+  config: ResolvedConfig,
+  target: CompatAliasTarget,
+  conditionTarget: ServerBundleTarget,
+  source: string,
+) {
+  return `${config.outPath}\0${target}\0${conditionTarget}\0${source}`;
+}
+
+function vendorArtifactFile(config: ResolvedConfig, key: string) {
+  return path.join(config.outPath, 'cache', 'server', 'vendor', `${hashBundleSpecifier(key)}.mjs`);
+}
+
+/**
+ * The file this specifier names - the artifact's identity. Resolved with `import` on top of the
+ * layer's conditions because that is what esbuild adds for an ESM entry point: without it a package
+ * publishing only an `import` condition resolves to nothing, and the key falls back to the
+ * importer's directory - the duplicate-build shape this path exists to remove.
+ */
+function resolveVendorEntry(
+  config: ResolvedConfig,
+  specifier: string,
+  resolveDir: string,
+  conditionTarget: ServerBundleTarget,
+) {
+  if (path.isAbsolute(specifier)) return path.resolve(specifier);
+  // Every demand builds a plan before dedup can see it, so this resolve runs
+  // once per DEMAND, not once per artifact — and the same specifier arrives
+  // from hundreds of importers. The answer is pure in its inputs.
+  const key = `${config.root}\0${conditionTarget}\0${resolveDir}\0${specifier}`;
+  if (vendorEntryResolutions.has(key)) return vendorEntryResolutions.get(key);
+  const entry = resolveVendorPackageSpecifier(
+    config.root,
+    path.join(resolveDir, 'pnext-resolve.ts'),
+    specifier,
+    [...serverBundleConditions(conditionTarget), 'import'],
+  );
+  vendorEntryResolutions.set(key, entry);
+  return entry;
+}
+
+const vendorEntryResolutions = new Map<string, string | undefined>();
+
+function vendorBuildPlan(
+  config: ResolvedConfig,
+  specifier: string,
+  target: CompatAliasTarget,
+  resolveDir: string,
+  conditionTarget: ServerBundleTarget,
+): VendorBuildPlan {
+  const entry = resolveVendorEntry(config, specifier, resolveDir, conditionTarget);
+  // An unresolvable specifier has no artifact identity to key on; keep the old
+  // importer-scoped key so the demand still compiles (and still dedups per dir).
+  const key = vendorArtifactKey(
+    config,
+    target,
+    conditionTarget,
+    entry ?? `${path.resolve(resolveDir)}\0${specifier}`,
+  );
+  const file = vendorArtifactFile(config, key);
+  return {
+    key,
+    file,
+    prepare: () =>
+      prepareVendorArtifact(config, specifier, resolveDir, conditionTarget, file, target, entry),
+    buildOne: nested =>
+      writeExternalServerPackageBundle(
+        config,
+        specifier,
+        target,
+        resolveDir,
+        file,
+        conditionTarget,
+        nested,
+      ),
+    group: entry
+      ? vendorGroupPlan(config, { specifier, entry, file }, target, resolveDir, conditionTarget)
+      : undefined,
+  };
+}
+
+/**
+ * A vendor artifact this process just wrote is trusted for the rest of the run.
+ * Without the note, a cache folder that started without a marker (every cold
+ * boot) distrusts what was just written, and `externalServerPackageHref`'s
+ * liveness check rebuilds every bundle a second time.
+ */
+async function writeVendorArtifact(file: string, code: string) {
+  const id = await publishVendorContent(file, code);
+  if (id === undefined) {
+    await writeFileAtomic(file, code);
+    noteDevArtifactWritten(file);
+  }
+  return id;
+}
+
+// --------------------------------------------------------------------------
+// content-addressed artifacts and the cross-layer verdict
+// --------------------------------------------------------------------------
+
+// eslint-disable-next-line turbo/no-undeclared-env-vars
+const vendorContentDisabled = () => process.env.PNEXT_VENDOR_CONTENT === '0';
+
+function vendorContentFile(vendorDir: string, id: string) {
+  return path.join(vendorDir, `${id}.content.mjs`);
+}
+
+/** Entries only: a chunk reaches its entry by relative path, so it stays put. */
+async function publishVendorContent(file: string, code: string) {
+  const vendorDir = path.dirname(file);
+  if (vendorContentDisabled() || path.basename(vendorDir) !== 'vendor') return undefined;
+  const id = hashBundleSpecifier(canonicalVendorCode(code));
+  const content = vendorContentFile(vendorDir, id);
+  if (!cachedExistsSync(content)) await writeFileAtomic(content, code);
+  noteDevArtifactWritten(content);
+  await linkVendorArtifact(file, content);
+  noteVendorContentId(file, id);
+  noteDevArtifactWritten(file);
+  return id;
+}
+
+/** The layer-keyed path becomes an alias to the shared bytes. */
+async function linkVendorArtifact(file: string, content: string) {
+  await rm(file, { force: true }).catch(() => undefined);
+  try {
+    await symlink(path.basename(content), file);
+  } catch {
+    await copyFile(content, file);
+  }
+}
+
+/** What one layer's build of an entry saw, for the cross-layer comparison. */
+interface VendorLayerRecord {
+  inputs: string;
+  externals: string;
+  blocked: boolean;
+  id: string;
+}
+
+// Keyed by output path exactly as `vendorArtifactKey` is: a verdict holds for
+// ONE app's conditions, aliases and defines, and several run in one process.
+const vendorLayerRecords = new Map<string, Map<string, VendorLayerRecord>>();
+/** Entries proven layer-independent -> the content id both layers resolve to. */
+const vendorSharedEntries = new Map<string, Map<string, string>>();
+const vendorSharedLoaded = new Set<string>();
+
+function vendorSharedFor(config: ResolvedConfig) {
+  let shared = vendorSharedEntries.get(config.outPath);
+  if (!shared) {
+    shared = new Map();
+    vendorSharedEntries.set(config.outPath, shared);
+  }
+  return shared;
+}
+
+/** Only these two layers were ever the duplicated half. */
+function vendorLayerKey(target: CompatAliasTarget, conditionTarget: ServerBundleTarget) {
+  if (target === 'server' && conditionTarget === 'server') return 'server';
+  if (target === 'client' && conditionTarget === 'client') return 'client';
+  return undefined;
+}
+
+function vendorSharedFile(config: ResolvedConfig) {
+  return path.join(config.outPath, 'cache', 'server', 'vendor', 'layer-shared.json');
+}
+
+/** Verdicts from earlier runs, so reuse lands on the first demand of this one. */
+function loadVendorSharedEntries(config: ResolvedConfig) {
+  if (vendorSharedLoaded.has(config.outPath)) return;
+  vendorSharedLoaded.add(config.outPath);
+  try {
+    const stored = JSON.parse(readFileSync(vendorSharedFile(config), 'utf8')) as Record<string, string>;
+    const shared = vendorSharedFor(config);
+    for (const [entry, id] of Object.entries(stored)) shared.set(entry, id);
+  } catch {
+    // No verdicts yet; they are written as builds settle.
+  }
+}
+
+function persistVendorSharedEntries(config: ResolvedConfig) {
+  void writeFileAtomic(
+    vendorSharedFile(config),
+    JSON.stringify(Object.fromEntries(vendorSharedFor(config))),
+  ).catch(() => undefined);
+}
+
+/** Offline verdict: externals compare as content ids, so this is a fixpoint. */
+function recordVendorLayerBuild(
+  config: ResolvedConfig,
+  entry: string | undefined,
+  target: CompatAliasTarget,
+  conditionTarget: ServerBundleTarget,
+  metafile: Metafile | undefined,
+  code: string,
+  id: string | undefined,
+) {
+  const layer = entry && id && metafile && vendorLayerKey(target, conditionTarget);
+  if (!layer || !entry || !id || !metafile) return;
+  loadVendorSharedEntries(config);
+  const externals = new Set<string>();
+  let blocked = /['"]use (?:client|server|cache)['"]/.test(code);
+  for (const meta of Object.values(metafile.inputs)) {
+    for (const reference of meta.imports) {
+      if (!reference.external) continue;
+      const target_ = reference.path.startsWith('file:')
+        ? fileURLToPath(reference.path)
+        : undefined;
+      // A shim outside the vendor tree is this layer's own alias target: the
+      // artifact is layer-specific whatever else matches.
+      if (target_ && path.basename(path.dirname(target_)) !== 'vendor') blocked = true;
+      externals.add(target_ ? (vendorContentId(target_) ?? target_) : reference.path);
+    }
+  }
+  const record: VendorLayerRecord = {
+    inputs: Object.keys(metafile.inputs).sort().join('\n'),
+    externals: [...externals].sort().join('\n'),
+    blocked,
+    id,
+  };
+  const recordKey = `${config.outPath}\0${entry}`;
+  let byLayer = vendorLayerRecords.get(recordKey);
+  if (!byLayer) {
+    byLayer = new Map();
+    vendorLayerRecords.set(recordKey, byLayer);
+  }
+  byLayer.set(layer, record);
+  const server = byLayer.get('server');
+  const client = byLayer.get('client');
+  if (!server || !client || server.blocked || client.blocked) return;
+  if (server.inputs !== client.inputs || server.externals !== client.externals) return;
+  vendorSharedFor(config).set(entry, server.id);
+  persistVendorSharedEntries(config);
+}
+
+/** A proven-shared entry's content file, or undefined to compile as usual. */
+function reusableVendorContent(
+  config: ResolvedConfig,
+  entry: string | undefined,
+  target: CompatAliasTarget,
+  conditionTarget: ServerBundleTarget,
+) {
+  if (vendorContentDisabled() || !entry || !vendorLayerKey(target, conditionTarget)) return undefined;
+  loadVendorSharedEntries(config);
+  const id = vendorSharedFor(config).get(entry);
+  if (!id) return undefined;
+  const content = vendorContentFile(path.join(config.outPath, 'cache', 'server', 'vendor'), id);
+  return existsSync(content) ? content : undefined;
+}
+
+// --------------------------------------------------------------------------
+// pre-build cross-layer reuse verdict (PNEXT_VENDOR_REUSE=0 to disable)
+// --------------------------------------------------------------------------
+
+// eslint-disable-next-line turbo/no-undeclared-env-vars
+const vendorReuseEnabled = () => process.env.PNEXT_VENDOR_REUSE !== '0';
+// eslint-disable-next-line turbo/no-undeclared-env-vars
+const vendorReuseExtEnabled = () => process.env.PNEXT_VENDOR_REUSE_EXT !== '0';
+
+/** Alias targets that differ by layer (compat/index.ts); prefix-matches subpaths. */
+const VENDOR_LAYER_ALIASES = new Set([
+  'react',
+  'react-dom',
+  'next/cache',
+  'next/navigation',
+  'next/script',
+  'next/server',
+  'server-only',
+  'client-only',
+]);
+
+function isVendorLayerAlias(external: string) {
+  return (
+    VENDOR_LAYER_ALIASES.has(external) ||
+    VENDOR_LAYER_ALIASES.has(external.split('/').slice(0, 2).join('/'))
+  );
+}
+
+interface VendorReuseVerdict {
+  stat: string;
+  conds: string;
+  reusable: boolean;
+  reason?: string;
+}
+
+const vendorReuseVerdicts = new Map<string, Map<string, VendorReuseVerdict>>();
+const vendorReuseLoaded = new Set<string>();
+const vendorReuseProbes = new Map<string, Promise<boolean>>();
+
+function vendorReuseFile(config: ResolvedConfig) {
+  return path.join(config.outPath, 'cache', 'server', 'vendor', 'reuse-verdicts.json');
+}
+
+function vendorReuseFor(config: ResolvedConfig) {
+  let verdicts = vendorReuseVerdicts.get(config.outPath);
+  if (!verdicts) {
+    verdicts = new Map();
+    vendorReuseVerdicts.set(config.outPath, verdicts);
+  }
+  return verdicts;
+}
+
+/** Verdicts persist per checkout: probes are paid once, restarts read the store. */
+function loadVendorReuseVerdicts(config: ResolvedConfig) {
+  if (vendorReuseLoaded.has(config.outPath)) return;
+  vendorReuseLoaded.add(config.outPath);
+  try {
+    const stored = JSON.parse(readFileSync(vendorReuseFile(config), 'utf8')) as Record<
+      string,
+      VendorReuseVerdict
+    >;
+    const verdicts = vendorReuseFor(config);
+    for (const [key, verdict] of Object.entries(stored)) verdicts.set(key, verdict);
+  } catch {
+    // No store yet; verdicts are written as probes settle.
+  }
+}
+
+function persistVendorReuseVerdicts(config: ResolvedConfig) {
+  void writeFileAtomic(
+    vendorReuseFile(config),
+    JSON.stringify(Object.fromEntries(vendorReuseFor(config))),
+  ).catch(() => undefined);
+}
+
+/** Probe results shared across verdict pairs — node_modules bytes are immutable per process. */
+const vendorLayerProbeMemo = new Map<string, Promise<VendorLayerProbe>>();
+
+type VendorLayerProbe = Awaited<ReturnType<typeof probeVendorLayer>>;
+
+function probeVendorLayerMemo(config: ResolvedConfig, entry: string, conditions: string[]) {
+  if (!vendorReuseExtEnabled()) return probeVendorLayer(config, entry, conditions);
+  const key = `${config.outPath}\0${entry}\0${conditions.join(',')}`;
+  let probe = vendorLayerProbeMemo.get(key);
+  if (!probe) {
+    probe = probeVendorLayer(config, entry, conditions);
+    probe.catch(() => vendorLayerProbeMemo.delete(key));
+    vendorLayerProbeMemo.set(key, probe);
+  }
+  return probe;
+}
+
+/** Metafile-only probe of one layer's view of an entry (never writes, no slots). */
+async function probeVendorLayer(config: ResolvedConfig, entry: string, conditions: string[]) {
+  const result = await build({
+    entryPoints: [entry],
+    absWorkingDir: config.root,
+    bundle: true,
+    write: false,
+    metafile: true,
+    format: 'esm',
+    platform: 'neutral',
+    target: 'es2022',
+    conditions,
+    mainFields: ['module', 'main'],
+    loader: { '.js': 'jsx', '.mjs': 'jsx', '.cjs': 'jsx', '.css': 'empty' },
+    jsx: 'automatic',
+    jsxImportSource: 'preact',
+    logLevel: 'silent',
+    packages: 'external',
+  });
+  const externals = new Set<string>();
+  for (const meta of Object.values(result.metafile.inputs)) {
+    for (const reference of meta.imports) if (reference.external) externals.add(reference.path);
+  }
+  return {
+    inputs: Object.keys(result.metafile.inputs).sort().join('\n'),
+    externals: [...externals].sort(),
+    directive: /['"]use (?:client|server|cache)['"]/.test(
+      result.outputFiles.map(file => file.text).join(''),
+    ),
+  };
+}
+
+async function computeVendorReuseVerdict(
+  config: ResolvedConfig,
+  serverEntry: string,
+  clientEntry: string,
+  otherTarget: ServerBundleTarget = 'client',
+): Promise<{ reusable: boolean; reason?: string }> {
+  const tp = performance.now();
+  const done = (v: { reusable: boolean; reason?: string }) => {
+    heavyProfRow({ k: 'reuse-probe', entry: serverEntry, other: otherTarget, ms: performance.now() - tp, ...v });
+    return v;
+  };
+  // A finished server build already proved itself layer-specific: skip both probes.
+  if (vendorReuseExtEnabled()) {
+    const recorded = vendorLayerRecords.get(`${config.outPath}\0${serverEntry}`)?.get('server');
+    if (recorded?.blocked) return done({ reusable: false, reason: 'recorded-blocked' });
+  }
+  const [server, client] = await Promise.all([
+    probeVendorLayerMemo(config, serverEntry, serverBundleConditions('server')),
+    probeVendorLayerMemo(config, clientEntry, serverBundleConditions(otherTarget)),
+  ]);
+  if (server.inputs !== client.inputs) return done({ reusable: false, reason: 'inputs-differ' });
+  if (server.externals.join('\n') !== client.externals.join('\n')) {
+    return done({ reusable: false, reason: 'externals-differ' });
+  }
+  const aliasHit = server.externals.filter(isVendorLayerAlias);
+  if (aliasHit.length > 0) return done({ reusable: false, reason: `layer-alias: ${aliasHit.join(',')}` });
+  if (server.directive || client.directive) return done({ reusable: false, reason: 'directive' });
+  return done({ reusable: true });
+}
+
+/** Whether the client demand may resolve to the server-layer artifact. */
+function crossLayerReuseVerdict(
+  config: ResolvedConfig,
+  serverEntry: string,
+  clientEntry: string,
+  otherTarget: ServerBundleTarget = 'client',
+): Promise<boolean> {
+  loadVendorReuseVerdicts(config);
+  const key =
+    otherTarget === 'client'
+      ? `${serverEntry}\0${clientEntry}`
+      : `${otherTarget}:${serverEntry}\0${clientEntry}`;
+  const stats = [statSync(serverEntry, { throwIfNoEntry: false }), statSync(clientEntry, { throwIfNoEntry: false })];
+  if (stats.some(entryStat => !entryStat)) return Promise.resolve(false);
+  const stat_ = stats.map(entryStat => `${entryStat!.mtimeMs}:${entryStat!.size}`).join('|');
+  const conds = JSON.stringify([serverBundleConditions('server'), serverBundleConditions(otherTarget)]);
+  const stored = vendorReuseFor(config).get(key);
+  if (stored?.stat === stat_ && stored.conds === conds) {
+    return Promise.resolve(stored.reusable);
+  }
+  const probeKey = `${config.outPath}\0${key}`;
+  let probe = vendorReuseProbes.get(probeKey);
+  if (!probe) {
+    probe = computeVendorReuseVerdict(config, serverEntry, clientEntry, otherTarget)
+      .catch(error => ({
+        reusable: false,
+        reason: `probe-failed: ${(error instanceof Error ? error.message : String(error)).slice(0, 160)}`,
+      }))
+      .then(verdict => {
+        vendorReuseFor(config).set(key, { stat: stat_, conds, ...verdict });
+        persistVendorReuseVerdicts(config);
+        return verdict.reusable;
+      })
+      .finally(() => vendorReuseProbes.delete(probeKey));
+    vendorReuseProbes.set(probeKey, probe);
+  }
+  return probe;
+}
+
+/**
+ * Alias a client-layer vendor demand onto the server-layer plan when the two builds are proven
+ * byte-equivalent. The swap happens BEFORE enqueue, so the demand lands on the server build's
+ * `pendingBundles` slot through ordinary dedup - no new cross-layer wait edges enter the scheduler.
+ * A server build that is neither on disk nor pending is never waited for.
+ */
+async function crossLayerReusePlan(
+  config: ResolvedConfig,
+  specifier: string,
+  resolveDir: string,
+  target: CompatAliasTarget,
+  conditionTarget: ServerBundleTarget,
+  clientPlan: VendorBuildPlan,
+): Promise<VendorBuildPlan | undefined> {
+  if (!vendorReuseEnabled() || vendorContentDisabled()) return undefined;
+  // An edge demand proven condition-independent lands on the server plan —
+  // one build serves both, and the server artifact keeps client reuse alive.
+  if (target === 'server' && conditionTarget === 'edge' && vendorReuseExtEnabled()) {
+    if (vendorBundleMemHit(clientPlan.key) || existsSync(clientPlan.file)) return undefined;
+    const edgeEntry = resolveVendorEntry(config, specifier, resolveDir, 'edge');
+    const serverEntry = resolveVendorEntry(config, specifier, resolveDir, 'server');
+    if (!edgeEntry || !serverEntry || edgeEntry !== serverEntry) return undefined;
+    const reusable = await crossLayerReuseVerdict(config, serverEntry, edgeEntry, 'edge').catch(() => false);
+    return reusable ? vendorBuildPlan(config, specifier, 'server', resolveDir, 'server') : undefined;
+  }
+  if (vendorLayerKey(target, conditionTarget) !== 'client') return undefined;
+  // An in-flight or on-disk client artifact already settles cheaper than a probe.
+  if (vendorBundleMemHit(clientPlan.key) || existsSync(clientPlan.file)) return undefined;
+  const clientEntry = resolveVendorEntry(config, specifier, resolveDir, conditionTarget);
+  const serverEntry = resolveVendorEntry(config, specifier, resolveDir, 'server');
+  if (!clientEntry || !serverEntry) return undefined;
+  const serverPlan = vendorBuildPlan(config, specifier, 'server', resolveDir, 'server');
+  if (!vendorBundleMemHit(serverPlan.key) && !existsSync(serverPlan.file)) return undefined;
+  const reusable = await crossLayerReuseVerdict(config, serverEntry, clientEntry).catch(() => false);
+  return reusable ? serverPlan : undefined;
+}
+
+/** Cache hit and no-compile fast paths, in front of every build. */
+async function prepareVendorArtifact(
+  config: ResolvedConfig,
+  specifier: string,
+  resolveDir: string,
+  conditionTarget: ServerBundleTarget,
+  file: string,
+  target: CompatAliasTarget,
+  entry: string | undefined,
+) {
+  // Vendor bundles are keyed by resolved package path (version-specific under
+  // pnpm), so an existing file is already current. Reuse it across dev restarts
+  // instead of re-bundling the whole dependency graph.
+  if (existsSync(file) && (await compiledModuleUsable(file))) return file;
+  await mkdir(path.dirname(file), { recursive: true });
+  // An earlier build proved this entry layer-independent: the other layer's
+  // content IS this layer's artifact, so the demand settles without compiling.
+  const shared = reusableVendorContent(config, entry, target, conditionTarget);
+  if (shared && (await compiledModuleUsable(shared))) {
+    await linkVendorArtifact(file, shared);
+    noteDevArtifactWritten(file);
+    return shared;
+  }
+  // A package that already ships a browser-ready ESM dist is copied, not compiled - the bundler would
+  // only reproduce it. Sits in FRONT of the pass, never replaces it: anything the predicate rejects
+  // falls through unchanged, and the copy is resolved exactly as the bundler would have. The copies
+  // load natively now (rootFilter skips the vendor tree), so an app that configures `compiler.define`
+  // must take the bundling path instead - that is where the defines are applied.
+  if (vendorLoadsNatively() && serverDefineOptions().define) return undefined;
+  const distDir = `${file.replace(/\.mjs$/, '')}.dist`;
+  const distEntry = await copyBrowserReadyEsmDist(
+    resolveVendorPackageSpecifier(
+      config.root,
+      path.join(resolveDir, 'pnext-resolve.ts'),
+      specifier,
+      serverBundleConditions(conditionTarget),
+    ) ?? '',
+    distDir,
+  );
+  if (distEntry) {
+    // Native loading means the `.js` copies need their own type marker: an app
+    // without `"type": "module"` would otherwise have Bun read them as
+    // CommonJS and choke on their `export` syntax.
+    await markEsmDistPackage(distDir);
+    noteDevArtifactWritten(distEntry);
+  }
+  return distEntry;
+}
+
+/**
+ * Bisect switch for the vendor-tree load-plugin exclusion. Deliberately NOT `PNEXT_VENDOR_NATIVE` -
+ * that name already gates the plugin-free bundler, and sharing it would arm that opt-in path by
+ * accident whenever this one was bisected.
+ */
+function vendorLoadsNatively() {
+  // eslint-disable-next-line turbo/no-undeclared-env-vars
+  return process.env.PNEXT_VENDOR_DIST_NATIVE !== '0';
+}
+
+// --------------------------------------------------------------------------
+// pre-planned vendor policy (PNEXT_VENDOR_PREPLAN=1 opt-in, server layer only)
+// --------------------------------------------------------------------------
+
+// eslint-disable-next-line turbo/no-undeclared-env-vars
+const vendorPreplanEnabled = () => process.env.PNEXT_VENDOR_PREPLAN === '1';
+
+interface VendorPreplanVerdict {
+  stat: string;
+  conds: string;
+  safe: boolean;
+  reason?: string;
+}
+
+const vendorPreplanVerdicts = new Map<string, Map<string, VendorPreplanVerdict>>();
+const vendorPreplanLoaded = new Set<string>();
+const vendorPreplanProbes = new Map<string, Promise<VendorPreplanVerdict>>();
+
+const vendorPreplanStats = {
+  preplanRefs: 0,
+  fallbackRefs: 0,
+  enqueued: 0,
+  composedBuilds: 0,
+  packagesRouted: 0,
+  packagesRejected: 0,
+  reasons: [] as string[],
+};
+
+export function vendorPreplanReport() {
+  return { ...vendorPreplanStats, reasons: vendorPreplanStats.reasons.slice(0, 60) };
+}
+
+// eslint-disable-next-line turbo/no-undeclared-env-vars
+const vendorPreplanDebug = () => process.env.PNEXT_VENDOR_PREPLAN_DEBUG === '1';
+let preplanReportFlush: ReturnType<typeof setTimeout> | undefined;
+function schedulePreplanReport() {
+  if (!vendorPreplanDebug()) return;
+  if (preplanReportFlush) clearTimeout(preplanReportFlush);
+  preplanReportFlush = setTimeout(() => {
+    console.error(`pnext vendor preplan ${JSON.stringify(vendorPreplanReport())}`);
+    console.error(`pnext vendor native ${JSON.stringify(vendorNativeReport())}`);
+  }, 3000);
+  preplanReportFlush.unref?.();
+}
+
+function vendorPreplanFile(config: ResolvedConfig) {
+  return path.join(config.outPath, 'cache', 'server', 'vendor', 'preplan-verdicts.json');
+}
+
+function vendorPreplanFor(config: ResolvedConfig) {
+  let verdicts = vendorPreplanVerdicts.get(config.outPath);
+  if (!verdicts) {
+    verdicts = new Map();
+    vendorPreplanVerdicts.set(config.outPath, verdicts);
+  }
+  return verdicts;
+}
+
+/** Probe verdicts persist per checkout, reuse-verdict style. */
+function loadVendorPreplanVerdicts(config: ResolvedConfig) {
+  if (vendorPreplanLoaded.has(config.outPath)) return;
+  vendorPreplanLoaded.add(config.outPath);
+  try {
+    const stored = JSON.parse(readFileSync(vendorPreplanFile(config), 'utf8')) as Record<
+      string,
+      VendorPreplanVerdict
+    >;
+    const verdicts = vendorPreplanFor(config);
+    for (const [key, verdict] of Object.entries(stored)) verdicts.set(key, verdict);
+  } catch {
+    // No store yet; verdicts are written as probes settle.
+  }
+}
+
+function persistVendorPreplanVerdicts(config: ResolvedConfig) {
+  void writeFileAtomic(
+    vendorPreplanFile(config),
+    JSON.stringify(Object.fromEntries(vendorPreplanFor(config))),
+  ).catch(() => undefined);
+}
+
+/** Does this entry's graph change shape under `react-server` (or carry directives)? */
+function vendorPreplanEntryVerdict(
+  config: ResolvedConfig,
+  entry: string,
+  conditions: string[],
+): Promise<VendorPreplanVerdict> | VendorPreplanVerdict {
+  loadVendorPreplanVerdicts(config);
+  const entryStat = statSync(entry, { throwIfNoEntry: false });
+  if (!entryStat) return { stat: '', conds: '', safe: false, reason: 'entry missing' };
+  const stat_ = `${entryStat.mtimeMs}:${entryStat.size}`;
+  const conds = JSON.stringify(conditions);
+  const stored = vendorPreplanFor(config).get(entry);
+  if (stored?.stat === stat_ && stored.conds === conds) return stored;
+  const probeKey = `${config.outPath}\0${entry}\0${conds}`;
+  let probe = vendorPreplanProbes.get(probeKey);
+  if (!probe) {
+    probe = computeVendorPreplanVerdict(config, entry, conditions, stat_, conds)
+      .catch(error => ({
+        stat: stat_,
+        conds,
+        safe: false,
+        reason: `probe-failed: ${(error instanceof Error ? error.message : String(error)).slice(0, 160)}`,
+      }))
+      .then(verdict => {
+        vendorPreplanFor(config).set(entry, verdict);
+        persistVendorPreplanVerdicts(config);
+        return verdict;
+      })
+      .finally(() => vendorPreplanProbes.delete(probeKey));
+    vendorPreplanProbes.set(probeKey, probe);
+  }
+  return probe;
+}
+
+async function computeVendorPreplanVerdict(
+  config: ResolvedConfig,
+  entry: string,
+  conditions: string[],
+  stat_: string,
+  conds: string,
+): Promise<VendorPreplanVerdict> {
+  const [rsc, plain] = await Promise.all([
+    probeVendorLayer(config, entry, conditions),
+    probeVendorLayer(config, entry, conditions.filter(condition => condition !== 'react-server')),
+  ]);
+  if (rsc.inputs !== plain.inputs) {
+    return { stat: stat_, conds, safe: false, reason: 'react-server inputs differ' };
+  }
+  if (rsc.externals.join('\n') !== plain.externals.join('\n')) {
+    return { stat: stat_, conds, safe: false, reason: 'react-server externals differ' };
+  }
+  if (rsc.directive || plain.directive) {
+    return { stat: stat_, conds, safe: false, reason: 'directive' };
+  }
+  return { stat: stat_, conds, safe: true };
+}
+
+/**
+ * May THIS package's build emit pre-planned refs? Any rejection routes the whole build to the awaited
+ * plugin decisions - always available, always correct. ESM-only keeps the exec surface off the
+ * fire-and-forget path: a CJS parent's artifact is imported (facade exec) the moment its build
+ * returns, before any drain could cover its children.
+ */
+async function vendorPreplanPackageSafe(
+  config: ResolvedConfig,
+  packageName: string | undefined,
+  entry: string | undefined,
+  target: CompatAliasTarget,
+  conditionTarget: ServerBundleTarget,
+): Promise<boolean> {
+  if (!vendorPreplanEnabled() || target !== 'server' || conditionTarget !== 'server') return false;
+  const reject = (reason: string) => {
+    vendorPreplanStats.packagesRejected += 1;
+    vendorPreplanStats.reasons.push(`${packageName ?? '?'}: ${reason}`);
+    schedulePreplanReport();
+    return false;
+  };
+  if (!packageName || !entry || !path.isAbsolute(entry)) return reject('unresolved entry');
+  if (/\.[cm]?tsx?$/.test(entry)) return reject('ts entry');
+  if (!isEsmModuleEntry(entry)) return reject('cjs entry');
+  if (getExternalPackagePolicy().transpile(packageName)) return reject('transpilePackages');
+  const verdict = await vendorPreplanEntryVerdict(config, entry, serverBundleConditions('server'));
+  if (!verdict.safe) return reject(verdict.reason ?? 'react-server divergence');
+  vendorPreplanStats.packagesRouted += 1;
+  schedulePreplanReport();
+  return true;
+}
+
+/** Mirror of `externalServerPackageHref`'s liveness recheck, minus the await(er). */
+function enqueuePreplanBuild(plan: VendorBuildPlan) {
+  vendorPreplanStats.enqueued += 1;
+  trackPreplanBuild(
+    (async () => {
+      let file = await vendorBundle(plan, false);
+      if (!cachedExistsSync(file) || !(await compiledModuleUsable(file))) {
+        dropVendorBundle(plan.key, file);
+        if (plan.group) dropVendorGroup(plan.group.key);
+        file = await vendorBundle(plan, false);
+      }
+    })(),
+  );
+}
+
+/**
+ * The deterministic-href emit: classify the dep once from pure inputs, hand
+ * back its artifact path pre-build, and enqueue the build without awaiting it.
+ * `undefined` routes the reference to the awaited plugin decision unchanged.
+ * Every emitted href is exactly what `externalServerPackageHref` would have
+ * returned for this demand, so flag-on artifacts stay byte-identical.
+ */
+async function preplanDependencyDecision(
+  config: ResolvedConfig,
+  target: CompatAliasTarget,
+  conditionTarget: ServerBundleTarget,
+  specifier: string,
+  resolveDir: string,
+): Promise<OnResolveResult | undefined> {
+  const depName = packageNameFromSpecifier(specifier);
+  if (!depName || !isPackageSpecifier(specifier)) return undefined;
+  if (builtinModules.includes(depName) || isBunBuiltin(depName)) return undefined;
+  if (getExternalPackagePolicy().external(depName)) return undefined;
+  if (getExternalPackagePolicy().transpile(depName)) return undefined;
+  const entry = resolveVendorEntry(config, specifier, resolveDir, conditionTarget);
+  if (!entry || /\.[cm]?tsx?$/.test(entry) || !isEsmModuleEntry(entry)) return undefined;
+  const plan = vendorBuildPlan(config, specifier, target, resolveDir, conditionTarget);
+  if (cachedExistsSync(plan.file)) {
+    if (!(await compiledModuleUsable(plan.file))) return undefined;
+  } else {
+    // Both prepare fast paths settle on a DIFFERENT file than `plan.file`, so
+    // their demands keep the awaited path (which is nearly free for them).
+    if (reusableVendorContent(config, entry, target, conditionTarget)) return undefined;
+    if (!(vendorLoadsNatively() && serverDefineOptions().define)) {
+      const distEntry = await copyBrowserReadyEsmDist(
+        resolveVendorPackageSpecifier(
+          config.root,
+          path.join(resolveDir, 'pnext-resolve.ts'),
+          specifier,
+          serverBundleConditions(conditionTarget),
+        ) ?? '',
+        `${plan.file.replace(/\.mjs$/, '')}.dist`,
+      );
+      if (distEntry) return undefined;
+    }
+  }
+  enqueuePreplanBuild(plan);
+  return { path: pathToFileHref(plan.file), external: true };
+}
+
+const esmDistPackages = new Set<string>();
+
+async function markEsmDistPackage(distDir: string) {
+  if (esmDistPackages.has(distDir)) return;
+  esmDistPackages.add(distDir);
+  const marker = path.join(distDir, 'package.json');
+  if (existsSync(marker)) return;
+  await writeFile(marker, '{"type":"module"}').catch(() => undefined);
+}
+
+/**
+ * Can this compiled artifact be imported as-is? Two O(1) checks - the file itself, and the cache
+ * folder's marker - replace the whole-graph walk that read back every compiled module and checked
+ * each of its `cache/server/` edges. Both guard the same hazard: a `pnext build` wiping `.pnext`
+ * under a running server can strand a dangling import, and Bun caches a failed load for the life of
+ * the process.
+ */
+// eslint-disable-next-line @typescript-eslint/require-await
+export async function compiledModuleUsable(file: string): Promise<boolean> {
+  return devArtifactUsable(file);
+}
+
+/**
+ * The group this subpath belongs to. Same-package imports are inlined (externalizing would lose a
+ * CommonJS entry's named exports), so a build per subpath re-parses the package's whole graph per
+ * subpath; the subpaths demanded together become entries of one `splitting: true` build instead.
+ *
+ * Restricted to ESM entries: an entry esbuild has to convert from CommonJS goes through
+ * `addCommonJsNamedExports`, whose export recovery reads the shape of a single-file bundle and does
+ * not survive being split into chunks.
+ */
+function vendorGroupPlan(
+  config: ResolvedConfig,
+  member: VendorGroupMember,
+  target: CompatAliasTarget,
+  resolveDir: string,
+  conditionTarget: ServerBundleTarget,
+): VendorGroupPlan | undefined {
+  const packageName = packageNameFromSpecifier(member.specifier);
+  const packageRoot = packageName && vendorPackageRoot(member.entry, packageName);
+  if (!packageName || !packageRoot || !isEsmModuleEntry(member.entry)) return undefined;
+  return {
+    key: `${config.outPath}\0${target}\0${conditionTarget}\0${packageRoot}`,
+    member,
+    build: (members, external, nested) =>
+      buildVendorGroup(
+        config,
+        packageName,
+        members,
+        external,
+        target,
+        resolveDir,
+        conditionTarget,
+        nested,
+      ),
+  };
+}
+
+/**
+ * The installed package directory an entry belongs to — the grouping identity,
+ * so a nested (non-hoisted) copy never shares a group with the hoisted one.
+ */
+function vendorPackageRoot(entry: string, packageName: string) {
+  const marker = `${path.sep}node_modules${path.sep}`;
+  const index = entry.lastIndexOf(marker);
+  if (index < 0) return undefined;
+  return path.join(entry.slice(0, index + marker.length), packageName);
+}
+
+/**
+ * One esbuild pass for the subpaths demanded together, with the shared graph split into chunks so it
+ * is parsed once instead of once per subpath. Siblings already on disk are externalized rather than
+ * re-parsed, which keeps artifacts handed out earlier valid across a growth round.
+ */
+async function buildVendorGroup(
+  config: ResolvedConfig,
+  packageName: string,
+  members: readonly VendorGroupMember[],
+  external: readonly VendorGroupMember[],
+  target: CompatAliasTarget,
+  resolveDir: string,
+  conditionTarget: ServerBundleTarget,
+  nested: boolean,
+) {
+  const built = members.filter(member => !existsSync(member.file));
+  if (built.length === 0) return;
+  // Only a sibling whose artifact is ON DISK can be externalized — one still
+  // compiling (a solo build this round did not wait for) must be inlined, or
+  // this bundle would import a file that is not there yet.
+  const siblings = new Map(
+    [...external, ...members]
+      .filter(member => !built.includes(member) && existsSync(member.file))
+      .map(member => [member.specifier, pathToFileHref(member.file)] as const),
+  );
+  const outdir = path.dirname(built[0]!.file);
+  const context = { nestedExternalFiles: [] as string[] };
+  const entryFiles = new Set(built.map(member => member.file));
+  // The plugin-chain fallback builds from bare specifiers; hand the interop
+  // plugin each member's already-resolved entry.
+  for (const member of built) provideEntryResolution(member.specifier, resolveDir, member.entry);
+  const entryPoints = built.map(member => ({
+    in:
+      getBundlerExtensions().serverBundleEntry(member.specifier, resolveDir, member.entry) ??
+      member.specifier,
+    out: path.basename(member.file, '.mjs'),
+  }));
+  const trace: VendorBuildTrace | undefined = vendorTraceEnabled()
+    ? { plugins: [], entry: built[0]!.entry }
+    : undefined;
+  const traceSeq = trace ? nextVendorTraceSeq() : 0;
+  const traceStart = performance.now();
+  const traceRow = (outputs: { text: string }[] | undefined, error?: unknown) => {
+    if (!trace) return;
+    traceVendorBuild({
+      seq: traceSeq,
+      specifier: packageName,
+      resolveDir,
+      target,
+      conditionTarget,
+      conditions: serverBundleConditions(conditionTarget),
+      startMs: traceStart,
+      outBytes: (outputs ?? []).reduce((sum, output) => sum + output.text.length, 0),
+      trace,
+      ok: !error,
+      ...(error
+        // eslint-disable-next-line @typescript-eslint/no-base-to-string
+        ? { error: (error instanceof Error ? error.message : String(error)).slice(0, 300) }
+        : {}),
+    });
+  };
+  const preplan =
+    vendorPreplanEnabled() &&
+    (
+      await Promise.all(
+        built.map(member =>
+          vendorPreplanPackageSafe(config, packageName, member.entry, target, conditionTarget),
+        ),
+      )
+    ).every(Boolean);
+  let outputFiles;
+  try {
+    outputFiles = await profileRuntimeStep(
+      `vendor bundle ${packageName} [${target}/${conditionTarget}] (${built.length} entries)`,
+      async () =>
+        (await buildVendorNative({
+          preplan,
+          config,
+          target,
+          conditionTarget,
+          resolveDir,
+          bailKey: `${packageName}\0${target}\0${conditionTarget}\0${outdir}`,
+          packageName,
+          // Resolved entries, not the bare specifiers the plugin build uses:
+          // `packages: 'external'` refuses to bundle a bare entry point.
+          entryPoints: built.map(member => ({
+            in: member.entry,
+            out: path.basename(member.file, '.mjs'),
+          })),
+          outdir,
+          splitting: true,
+          siblings,
+          ownEntries: new Map(built.map(member => [member.entry, member.file])),
+          isEntry: output => entryFiles.has(output),
+          nested,
+          context,
+          trace,
+        })) ??
+        (await buildVendorGroupWithPlugins(
+          config,
+          packageName,
+          siblings,
+          target,
+          resolveDir,
+          conditionTarget,
+          outdir,
+          entryPoints,
+          context,
+          trace,
+          preplan,
+        )),
+    );
+  } catch (error) {
+    traceRow(undefined, error);
+    throw error;
+  }
+  traceRow(outputFiles);
+  await mkdir(path.join(outdir, 'chunks'), { recursive: true });
+  // Chunks first: an entry must never be readable before what it imports is.
+  for (const output of [...outputFiles].sort(
+    (a, b) => Number(entryFiles.has(a.path)) - Number(entryFiles.has(b.path)),
+  )) {
+    const bundled = entryFiles.has(output.path)
+      ? addCommonJsNamedExports(output.text)
+      : output.text;
+    // Packages can ship 'use cache' functions too (Next allows it); client
+    // bundles keep the source untouched.
+    const code =
+      target === 'server' ? applyBundledSourceTransforms(bundled, output.path) : bundled;
+    await writeVendorArtifact(output.path, code);
+  }
+  await emitNestedExternalTraceCopies(built[0]!.file, context.nestedExternalFiles);
+}
+
+// vendor plugin-callback attribution (PNEXT_VENDOR_PROFILE=1, dormant otherwise). Every
+// onResolve/onLoad is an IPC round trip esbuild's bundler blocks on, against the one JS thread that
+// answers them; counts separate "our callbacks are slow" from "we answer many questions".
+
+// eslint-disable-next-line turbo/no-undeclared-env-vars
+const vendorProfileEnabled = process.env.PNEXT_VENDOR_PROFILE === '1';
+const vendorProfileTotals = new Map<string, number>();
+
+function vendorProfileCount(key: string, by = 1) {
+  vendorProfileTotals.set(key, (vendorProfileTotals.get(key) ?? 0) + by);
+}
+
+export function vendorProfileReport() {
+  return Object.fromEntries(
+    [...vendorProfileTotals].sort((a, b) => b[1] - a[1]).map(([k, v]) => [k, Math.round(v)]),
+  );
+}
+
+// Printed once the callbacks go quiet, so one page's whole plugin chain lands
+// in a single line instead of interleaving with the build it is measuring.
+let vendorProfileFlush: ReturnType<typeof setTimeout> | undefined;
+function scheduleVendorProfileReport() {
+  if (vendorProfileFlush) clearTimeout(vendorProfileFlush);
+  vendorProfileFlush = setTimeout(() => {
+    console.log(`pnext vendor profile ${JSON.stringify(vendorProfileReport())}`);
+  }, 3000);
+  vendorProfileFlush.unref?.();
+}
+
+function profiledVendorPlugins(plugins: Plugin[]): Plugin[] {
+  if (!vendorProfileEnabled) return plugins;
+  return plugins.map(plugin => ({
+    name: plugin.name,
+    setup(build) {
+      const wrap =
+        (kind: 'resolve' | 'load', register: (options: any, cb: any) => void) =>
+        (options: any, callback: any) =>
+          register(options, async (args: any) => {
+            vendorProfileCount(`${plugin.name}:${kind}#`);
+            const start = performance.now();
+            try {
+              return await (callback as (a: unknown) => unknown)(args);
+            } finally {
+              vendorProfileCount(`${plugin.name}:${kind}ms`, performance.now() - start);
+              scheduleVendorProfileReport();
+            }
+          });
+      return plugin.setup({
+        ...build,
+        onResolve: wrap('resolve', build.onResolve.bind(build)),
+        onLoad: wrap('load', build.onLoad.bind(build)),
+      });
+    },
+  }));
+}
+
+/** The plugin chain, for whatever the plugin-free build could not express. */
+async function buildVendorGroupWithPlugins(
+  config: ResolvedConfig,
+  packageName: string,
+  siblings: ReadonlyMap<string, string>,
+  target: CompatAliasTarget,
+  resolveDir: string,
+  conditionTarget: ServerBundleTarget,
+  outdir: string,
+  entryPoints: { in: string; out: string }[],
+  context: { nestedExternalFiles: string[] },
+  trace?: VendorBuildTrace,
+  preplan = false,
+) {
+  const pluginStart = performance.now();
+  const groupPlugins = profiledVendorPlugins([
+    serverAssetPlugin(config),
+    ...getBundlerExtensions().serverEsbuildPlugins(
+      config,
+      vendorPluginOptions(config, target, conditionTarget),
+    ),
+    runtimeAliasBuildPlugin(config, target, {
+      bundleRequireAliases: true,
+      reactServerLayer: target === 'server',
+    }),
+    vendorGroupSiblingPlugin(siblings),
+    externalPackageDependencyPlugin(config, packageName, target, conditionTarget, context, preplan),
+    externalBuiltinBuildPlugin(),
+  ]);
+  if (trace) trace.plugins = groupPlugins.map(plugin => plugin.name);
+  const result = await build({
+    entryPoints,
+    absWorkingDir: resolveDir,
+    bundle: true,
+    splitting: true,
+    write: false,
+    outdir,
+    outExtension: { '.js': '.mjs' },
+    chunkNames: 'chunks/[name]-[hash]',
+    format: 'esm',
+    platform: 'neutral',
+    target: 'es2022',
+    conditions: serverBundleConditions(conditionTarget),
+    mainFields: ['module', 'main'],
+    loader: packageJsxLoaders,
+    jsx: 'automatic',
+    jsxImportSource: 'preact',
+    logLevel: 'silent',
+    // Trace-only: the analyzer's per-build input set comes from the metafile.
+    ...(trace ? { metafile: true as const } : {}),
+    ...serverDefineOptions(),
+    plugins: groupPlugins,
+  });
+  vendorNativeStats.pluginBuilds += 1;
+  vendorNativeStats.pluginBuildMs += performance.now() - pluginStart;
+  if (trace) trace.metafile = result.metafile;
+  return result.outputFiles.map(output => ({ path: output.path, text: output.text }));
+}
+
+/** Siblings already compiled stay out of the graph, as plain externals. */
+function vendorGroupSiblingPlugin(siblings: ReadonlyMap<string, string>): Plugin {
+  return {
+    name: 'pnext-vendor-group-siblings',
+    setup(build) {
+      if (siblings.size === 0) return;
+      build.onResolve({ filter: /^[^./].*/ }, args => {
+        if (args.kind === 'entry-point') return undefined;
+        const sibling = siblings.get(args.path);
+        return sibling ? { path: sibling, external: true } : undefined;
+      });
+    },
+  };
+}
+
+// per-file client boundaries inside a package.
+//
+// A package ships its client half as ordinary files carrying a `'use client'` directive next to a
+// directive-less index that re-exports them. From the react-server graph such a file is a client
+// REFERENCE - never code the RSC pass runs - and the module pass already stubs the ones it resolves
+// itself. A vendor bundle reaches them mid-graph instead, where no resolve of ours ever sees the
+// specifier, so the directive was lost inside the bundle: the RSC pass then executed a client
+// component and the app got a SECOND copy of every module the client profile also bundles - two
+// `createContext` calls, so a provider rendered from the client graph is invisible to a consumer
+// rendered from this one.
+//
+// The scan is off wherever it cannot matter: client-target bundles (the SSR pass must run the real
+// component) and non-react apps. On the ones that remain it costs a read per input file, which
+// esbuild was going to make anyway. `PNEXT_VENDOR_CLIENT_BOUNDARY=0` removes the plugin, to bisect.
+
+// No longer a plugin of its own: the scan is composed into the server chain's
+// single claiming onLoad (ServerEsbuildPluginOptions.vendorClientBoundary), so
+// it adds zero plugin-callback round trips. Reads are memoized per config —
+// the same node_modules bytes used to be re-read and re-decoded per build.
+const vendorClientBoundaryLoads = new WeakMap<
+  ResolvedConfig,
+  (file: string) => Promise<OnLoadResult | undefined>
+>();
+
+function vendorClientBoundaryLoad(config: ResolvedConfig) {
+  let load = vendorClientBoundaryLoads.get(config);
+  if (load) return load;
+  const memo = new Map<string, Promise<OnLoadResult | undefined>>();
+  const scan = async (file: string): Promise<OnLoadResult | undefined> => {
+    const source = await readFile(file, 'utf8').catch(() => undefined);
+    if (source === undefined || !hasUseClientDirective(source)) return undefined;
+    return {
+      contents: clientReferenceModuleSource(
+        file,
+        await clientReferenceExportNames(config, file, source),
+        { inlineSymbol: true },
+      ),
+      loader: 'js',
+      resolveDir: path.dirname(file),
+    };
+  };
+  // Only node_modules answers are cached: immutable for the process life, the
+  // same assumption the vendor artifact cache makes. First-party files re-read.
+  load = file => {
+    if (!file.includes(`${path.sep}node_modules${path.sep}`)) return scan(file);
+    let pending = memo.get(file);
+    if (!pending) {
+      pending = scan(file);
+      memo.set(file, pending);
+    }
+    return pending;
+  };
+  vendorClientBoundaryLoads.set(config, load);
+  return load;
+}
+
+/**
+ * Whether the react-server vendor pass scans this build's inputs at all. `target === 'server'` alone
+ * is not the react-server graph: the PAGES router compiles under it too, and there `'use client'` is
+ * inert - Next never runs an RSC pass for a pages route, so the file must be EXECUTED, not stubbed.
+ * Stubbing it there turns a plain exported value into a truthy reference object, which crashes SSR.
+ */
+function vendorPluginOptions(
+  config: ResolvedConfig,
+  target: CompatAliasTarget,
+  conditionTarget: ServerBundleTarget,
+): ServerEsbuildPluginOptions {
+  const boundary =
+    // eslint-disable-next-line turbo/no-undeclared-env-vars
+    process.env.PNEXT_VENDOR_CLIENT_BOUNDARY !== '0' &&
+    target === 'server' &&
+    !isPagesBundleTarget(conditionTarget) &&
+    reactCompatEnabled(config)
+      ? vendorClientBoundaryLoad(config)
+      : undefined;
+  return { vendorClientBoundary: boundary, realPathEntries: true };
+}
+
+function isPagesBundleTarget(target: ServerBundleTarget) {
+  return target === 'pages' || target === 'pages-api' || target === 'pages-api-edge';
+}
+
+// plugin-free vendor builds.
+//
+// The four core plugins above resolve by callback, and a callback is a JS bridge hop the bundler
+// waits on. Each behaviour leaves the callback in one of two ways - an esbuild-native option where
+// it is expressible, or a post-pass over the emitted chunks, where the metafile hands us the same
+// (importer, specifier, kind) triples the resolve callback used to see:
+//
+//   builtins            -> `packages: 'external'` covers them, nothing to do
+//   asset stubs         -> native `loader: empty`; an extension the map does not cover has no
+//                          loader, so the build fails and falls back - the safe direction
+//   framework aliases   -> external by default, post-pass repoints each one at its alias target
+//                          (require-kind separately, against the react-server layer map)
+//   external packages   -> external by default, post-pass runs the policy: nested-version pinning,
+//                          transitive vendor recursion, CommonJS facades
+//
+// What must be BUNDLED rather than externalized - a package's own subpaths, a default-only
+// CommonJS dependency, a cross-package asset - is named in `alias`, which overrides
+// `packages: 'external'` for exactly those specifiers and nothing else. That set is a property of
+// the package, so it is discovered once (`vendorPackageShape`) and every later build starts with it.
+// Anything still unexpressible bails to the plugin build; bailing is always available and always
+// correct, so this path never has to be complete - it has to be RIGHT, which is what the re-bundle
+// gate proves.
+//
+// Off by default: this pipeline is not spending its time in plugin callbacks, and two next-compat
+// behaviours still diverge - see `vendorNativeEnabled`.
+
+/**
+ * OFF by default: it is measurably slower AND not yet equivalent. `app-external` loses four
+ * assertions with it on - `transpilePackages`, the react-server export condition, CJS tree-shaking
+ * and an async external module all 500 - which the re-bundle gate cannot catch, because those
+ * artifacts are structurally sound and semantically wrong.
+ */
+function vendorNativeEnabled() {
+  // eslint-disable-next-line turbo/no-undeclared-env-vars
+  return process.env.PNEXT_VENDOR_NATIVE === '1';
+}
+
+/**
+ * Artifacts whose plugin-free build did not work out. One bail is enough: the
+ * cause is a property of the package (a require-kind alias to a CommonJS shim,
+ * an asset needing real contents), not of the demand, so a retry pays for the
+ * discarded build again and lands in the same place.
+ */
+const vendorNativeBailed = new Set<string>();
+
+/** How the vendor builds of this process split between the two paths. */
+const vendorNativeStats = {
+  attempts: 0,
+  native: 0,
+  bailed: 0,
+  rounds: 0,
+  buildMs: 0,
+  pluginBuilds: 0,
+  pluginBuildMs: 0,
+  planMs: 0,
+  verifyMs: 0,
+  reasons: [] as string[],
+};
+
+export function vendorNativeReport() {
+  return { ...vendorNativeStats, reasons: vendorNativeStats.reasons.slice(0, 40) };
+}
+
+/**
+ * What the asset plugin stubs, minus the extensions whose stub has CONTENT
+ * (images, CSS modules). Those have no loader here on purpose: esbuild fails
+ * the build, and failing is how they reach the plugin path.
+ */
+const vendorEmptyLoaders = {
+  '.css': 'empty',
+  '.scss': 'empty',
+  '.sass': 'empty',
+  '.less': 'empty',
+} satisfies Record<string, Loader>;
+
+/** Discovery is a fixpoint; past this a package is not worth another try. */
+const MAX_VENDOR_NATIVE_ROUNDS = 2;
+
+interface VendorNativeRequest {
+  config: ResolvedConfig;
+  target: CompatAliasTarget;
+  conditionTarget: ServerBundleTarget;
+  resolveDir: string;
+  /** Cache key for the bail set — the artifact this build is producing. */
+  bailKey: string;
+  /** The package the entries belong to; its own subpaths are inlined. */
+  packageName: string | undefined;
+  entryPoints: { in: string; out: string }[] | string[];
+  outdir?: string;
+  splitting: boolean;
+  /** Demanded siblings already on disk (group builds only). */
+  siblings?: ReadonlyMap<string, string>;
+  /** Entries THIS build emits, by resolved entry file: artifacts-to-be. */
+  ownEntries?: ReadonlyMap<string, string>;
+  /** Raised from inside another build: it may never wait on anything shared. */
+  nested: boolean;
+  /** Preplan-safe package: native build with pure ref decisions, no verify. */
+  preplan?: boolean;
+  /** Entry outputs, by emitted path; everything else is a shared chunk. */
+  isEntry: (outputPath: string) => boolean;
+  /** Where a solo build's single output lands, for the verification gate. */
+  soloFile?: string;
+  context: { nestedExternalFiles: string[] };
+  /** Trace-only: filled with the producing pass's plugins/metafile. */
+  trace?: VendorBuildTrace;
+}
+
+/** A repointed reference: the specifier to emit, and the file it must exist at. */
+interface VendorRefTarget {
+  specifier: string;
+  file: string;
+}
+
+/**
+ * Run the plugin-free build, or return undefined to say "use the plugins". Every return path other than the
+ * verified one is a bail, so a caller can treat undefined as "nothing happened" - no artifact is written here.
+ */
+async function buildVendorNative(request: VendorNativeRequest) {
+  vendorNativeStats.attempts += 1;
+  if (
+    (!vendorNativeEnabled() && !request.preplan) ||
+    vendorNativeBailed.has(request.bailKey)
+  ) {
+    return undefined;
+  }
+  // A bail is remembered so the next demand does not pay for the same
+  // discarded build — unless the cause was the fixpoint running out of rounds,
+  // which the package shape this build just recorded has already moved on from.
+  const bail = (why: string, permanent = true) => {
+    if (permanent) vendorNativeBailed.add(request.bailKey);
+    vendorNativeStats.bailed += 1;
+    vendorNativeStats.reasons.push(`${request.packageName ?? '?'}: ${why}`);
+    return undefined;
+  };
+
+  const conditions = serverBundleConditions(request.conditionTarget);
+  // What a package has to keep INSIDE its bundle is a property of the package,
+  // not of one subpath's build, so it is discovered once and reused by every
+  // later build of it — the fixpoint the §4e prototype ran app-wide, amortized
+  // per package here.
+  const shape = vendorPackageShape(request);
+  // Only the FIRST build of a package discovers its shape; the rest wait for that answer instead of racing to
+  // the same rounds. Off the slot, because a waiter that keeps its worker is exactly the inversion this is
+  // here to fix. A nested build never waits - its own parent is holding a slot for it, and a cycle through two
+  // packages would otherwise have nowhere to go.
+  if (!request.nested && shape.discovery) {
+    await outsideVendorSlot(() => shape.discovery!);
+  }
+  const pioneer = !shape.discovery;
+  let settleDiscovery: (() => void) | undefined;
+  if (pioneer) shape.discovery = new Promise<void>(resolve => (settleDiscovery = resolve));
+  try {
+    return await runVendorNativeRounds(request, shape, conditions, bail);
+  } finally {
+    if (pioneer) {
+      shape.discovery = undefined;
+      settleDiscovery?.();
+    }
+  }
+}
+
+async function runVendorNativeRounds(
+  request: VendorNativeRequest,
+  shape: VendorPackageShape,
+  conditions: string[],
+  bail: (why: string, permanent?: boolean) => undefined,
+) {
+  const { config, resolveDir } = request;
+
+  for (let round = 1; round <= MAX_VENDOR_NATIVE_ROUNDS; round += 1) {
+    let result;
+    vendorNativeStats.rounds += 1;
+    const buildStart = performance.now();
+    const nativePlugins = getBundlerExtensions().serverEsbuildPlugins(
+      config,
+      vendorPluginOptions(config, request.target, request.conditionTarget),
+    );
+    if (request.trace) request.trace.plugins = nativePlugins.map(plugin => plugin.name);
+    try {
+      result = await build({
+        entryPoints: (request.entryPoints as (string | { in: string; out: string })[]).map(
+          entry =>
+            typeof entry === 'string'
+              ? (getBundlerExtensions().serverBundleEntry(entry, resolveDir, entry) ?? entry)
+              : {
+                  ...entry,
+                  in:
+                    getBundlerExtensions().serverBundleEntry(entry.in, resolveDir, entry.in) ??
+                    entry.in,
+                },
+        ) as string[],
+        absWorkingDir: resolveDir,
+        bundle: true,
+        ...(request.splitting ? { splitting: true, chunkNames: 'chunks/[name]-[hash]' } : {}),
+        write: false,
+        ...(request.outdir ? { outdir: request.outdir, outExtension: { '.js': '.mjs' } } : {}),
+        format: 'esm',
+        platform: 'neutral',
+        target: 'es2022',
+        conditions,
+        mainFields: ['module', 'main'],
+        loader: { ...packageJsxLoaders, ...vendorEmptyLoaders },
+        jsx: 'automatic',
+        jsxImportSource: 'preact',
+        logLevel: 'silent',
+        metafile: true,
+        ...serverDefineOptions(),
+        // Every bare specifier out — the cheapest possible graph — except the
+        // handful `alias` names, which is how a same-package subpath or a
+        // default-only CommonJS dependency stays INSIDE without giving up
+        // externalization for everything else.
+        packages: 'external',
+        ...(shape.inline.size > 0 ? { alias: Object.fromEntries(shape.inline) } : {}),
+        plugins: nativePlugins,
+      });
+    } catch (error) {
+      vendorNativeStats.buildMs += performance.now() - buildStart;
+      return bail((error instanceof Error ? error.message : String(error)).slice(0, 200));
+    }
+    vendorNativeStats.buildMs += performance.now() - buildStart;
+
+    const inputs = Object.keys(result.metafile.inputs);
+    // An asset whose stub carries content, or one a configured loader rule
+    // claims, is not what `loader: empty` produced. Hand it to the plugins.
+    for (const input of inputs) {
+      const file = path.resolve(resolveDir, input);
+      if (!serverIgnoredAssetFilter.test(file)) continue;
+      if (getAssetExtensions().hasLoaderRuleFor(file)) return bail(`loader rule for ${input}`);
+      if (getCssExtensions().loadCssModuleForClient(file) !== undefined) {
+        return bail(`css module ${input}`);
+      }
+    }
+    // Preplan class is ESM-only across the GRAPH, not just the entry.
+    if (request.preplan) {
+      for (const input of inputs) {
+        const file = path.resolve(resolveDir, input);
+        if (serverIgnoredAssetFilter.test(file) || !cachedExistsSync(file)) continue;
+        if (/\.[cm]?tsx?$/.test(file)) return bail(`ts input ${input}`);
+        if (file.endsWith('.cjs') ||(/\.jsx?$/.test(file) && !isEsmModuleEntry(file))) {
+          return bail(`cjs input ${input}`);
+        }
+      }
+    }
+
+    // Off the slot: everything below is discovery, and the bundler that needed
+    // the worker has already handed its output over. Nothing else in the
+    // pipeline can do this — the plugin chain's discovery runs inside a resolve
+    // callback, with the bundler still open behind it.
+    const planStart = performance.now();
+    const plan = await outsideVendorSlot(() =>
+      planVendorNativeRefs(request, result.metafile, conditions),
+    );
+    vendorNativeStats.planMs += performance.now() - planStart;
+    if (!plan) return bail('unrepresentable reference');
+    if (plan.inline.size > 0) {
+      // Record before deciding: even a bail teaches the package's shape, so the
+      // next build of it starts where this one gave up.
+      let grew = false;
+      for (const [specifier, file] of plan.inline) {
+        if (shape.inline.has(specifier)) continue;
+        shape.inline.set(specifier, file);
+        grew = true;
+      }
+      if (!grew) return bail('inline set stopped converging');
+      if (round === MAX_VENDOR_NATIVE_ROUNDS) return bail('inlining unsettled', false);
+      continue;
+    }
+
+    const outputs = result.outputFiles.map(output => ({
+      path: request.soloFile ?? output.path,
+      text: rewriteEmittedRefs(output.text, ref =>
+        (ref.require ? plan.requires : plan.imports).get(ref.specifier)?.specifier,
+      ),
+    }));
+    const repointed = new Map(
+      [...plan.imports.values(), ...plan.requires.values()].map(t => [t.specifier, t.file]),
+    );
+    // Preplan mode: the drain barrier + byte-eq gates stand in for the
+    // re-bundle verification loop — its cost is one of the two this composes out.
+    if (!request.preplan) {
+      const verifyStart = performance.now();
+      const chunks = new Map(
+        outputs.filter(output => !request.isEntry(output.path)).map(o => [o.path, o.text]),
+      );
+      for (const output of outputs) {
+        if (!request.isEntry(output.path)) continue;
+        const failure = await verifyVendorArtifact(output.path, output.text, repointed, chunks);
+        if (failure) {
+          vendorNativeStats.verifyMs += performance.now() - verifyStart;
+          return bail(`verification: ${failure}`);
+        }
+      }
+      vendorNativeStats.verifyMs += performance.now() - verifyStart;
+    } else {
+      vendorPreplanStats.composedBuilds += 1;
+      schedulePreplanReport();
+    }
+    vendorNativeStats.native += 1;
+    if (request.trace) request.trace.metafile = result.metafile;
+    return outputs;
+  }
+  return undefined;
+}
+
+/**
+ * What one package externalizes and what it keeps inside - discovered once and then reused, so the
+ * rounds a package costs are paid by its FIRST build and no other. Seeded from the manifest: a
+ * declared dependency is external before any build proves it, which keeps a package's own subpaths
+ * (the ones `packages: 'external'` cannot tell apart from dependencies) bundled from the start.
+ */
+interface VendorPackageShape {
+  /** Specifier -> file it must be bundled from, as an esbuild `alias` entry. */
+  inline: Map<string, string>;
+  /** Set while one build is discovering it; every other build awaits this. */
+  discovery?: Promise<void>;
+}
+
+const vendorPackageShapes = new Map<string, VendorPackageShape>();
+
+function vendorPackageShape(request: VendorNativeRequest): VendorPackageShape {
+  const entry = (request.entryPoints as { in?: string }[])[0];
+  const first = typeof entry === 'string' ? entry : entry?.in;
+  // A workspace package resolves to its real source path, which has no
+  // `node_modules` segment to key on — walk up to its manifest instead.
+  const root =
+    (first && request.packageName && vendorPackageRoot(first, request.packageName)) ??
+    (first && nearestManifestDir(path.dirname(first)));
+  if (!root) return { inline: new Map() };
+  const key = `${root}\0${request.target}\0${request.conditionTarget}`;
+  let shape = vendorPackageShapes.get(key);
+  if (!shape) {
+    shape = { inline: new Map() };
+    vendorPackageShapes.set(key, shape);
+  }
+  return shape;
+}
+
+function nearestManifestDir(from: string) {
+  let dir = from;
+  while (true) {
+    if (existsSync(path.join(dir, 'package.json'))) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) return undefined;
+    dir = parent;
+  }
+}
+
+/**
+ * Decide what each external reference in the emitted code means - the work the resolve callbacks used
+ * to do, off the bundler's critical path. Undefined when a reference cannot be expressed as a rewrite
+ * (the caller then bails), or the set of specifiers that must be pulled back INSIDE the bundle.
+ */
+async function planVendorNativeRefs(
+  request: VendorNativeRequest,
+  metafile: Metafile,
+  conditions: string[],
+) {
+  const imports = new Map<string, VendorRefTarget>();
+  const requires = new Map<string, VendorRefTarget>();
+  const inline = new Map<string, string>();
+  const settled = new Set<string>();
+
+  for (const [input, meta] of Object.entries(metafile.inputs)) {
+    // Decisions are a property of the DIRECTORY an import sits in, never of the
+    // file — so a package's several hundred modules all asking for `react`
+    // decide once, and the answer is reused across builds.
+    const importerFile = path.resolve(request.resolveDir, input);
+    const importerDir = path.dirname(importerFile);
+    for (const reference of meta.imports) {
+      if (!reference.external) continue;
+      const specifier = reference.path;
+      const isRequire = reference.kind === 'require-call';
+      const key = `${isRequire ? 'r' : 'i'}\0${specifier}\0${importerDir}`;
+      if (settled.has(key)) continue;
+      settled.add(key);
+
+      // Same package. A subpath THIS build already emits is repointed at that artifact; a sibling on disk at
+      // its own. Everything else becomes its own vendor demand rather than being inlined here - inlining is
+      // what makes a package's shared graph get re-parsed once per subpath, the cost this whole pipeline
+      // exists to remove. Request-scoped, so it sits in front of the shared decision cache.
+      if (packageNameFromSpecifier(specifier) === request.packageName) {
+        const sibling = request.siblings?.get(specifier);
+        if (sibling) {
+          if (!record(imports, specifier, { specifier: sibling, file: fileURLToPath(sibling) })) {
+            return undefined;
+          }
+          continue;
+        }
+        const own = ownEntryArtifact(request, specifier, importerDir, conditions);
+        if (own) {
+          if (!record(imports, specifier, own)) return undefined;
+          continue;
+        }
+        // A subpath nothing demanded: it comes back inside, as the plugin build
+        // would have had it. Demanding it instead can close a cycle back onto
+        // the artifact being built right now, which no scheduler can settle.
+        const resolved = resolveVendorPackageSpecifier(
+          request.config.root,
+          path.join(importerDir, 'pnext-resolve.ts'),
+          specifier,
+          conditions,
+        );
+        if (!resolved) return undefined;
+        inline.set(specifier, resolved);
+        continue;
+      }
+
+      const decision = await (request.preplan
+        ? preplanVendorRef(request, specifier, importerFile, isRequire, conditions)
+        : decideVendorRef(request, specifier, importerFile, isRequire, conditions));
+      if (!decision) return undefined;
+      if (decision.kind === 'keep') continue;
+      if (decision.kind === 'inline') {
+        inline.set(specifier, decision.file);
+        continue;
+      }
+      if (decision.nested) request.context.nestedExternalFiles.push(decision.nested);
+      if (!record(isRequire ? requires : imports, specifier, decision.target)) return undefined;
+    }
+  }
+  return { imports, requires, inline };
+}
+
+/**
+ * The artifact THIS build is already emitting for a same-package specifier, if it is one of its entries. It
+ * is not on disk yet - it is written the moment this build returns - so it is repointed without an existence
+ * check.
+ */
+function ownEntryArtifact(
+  request: VendorNativeRequest,
+  specifier: string,
+  importerDir: string,
+  conditions: string[],
+): VendorRefTarget | undefined {
+  if (!request.ownEntries?.size) return undefined;
+  const entry = resolveVendorPackageSpecifier(
+    request.config.root,
+    path.join(importerDir, 'pnext-resolve.ts'),
+    specifier,
+    conditions,
+  );
+  const artifact = entry && request.ownEntries.get(entry);
+  return artifact ? { specifier: pathToFileHref(artifact), file: artifact } : undefined;
+}
+
+type VendorRefDecision =
+  | { kind: 'keep' }
+  /** Must be bundled: `file` is what an alias entry points the specifier at. */
+  | { kind: 'inline'; file: string }
+  | { kind: 'repoint'; target: VendorRefTarget; nested?: string };
+
+/**
+ * Decisions are pure in (layer, specifier, importing directory), and the same
+ * handful of packages are imported from everywhere, so one answer serves every
+ * build that meets the reference again. Without this the post-pass re-runs the
+ * resolver work the plugin chain at least only did once per bundle.
+ */
+const vendorRefDecisions = new Map<string, Promise<VendorRefDecision | undefined>>();
+
+/** Everything the plugin-free path learned about packages, forgotten. */
+function clearVendorNativeCaches() {
+  vendorRefDecisions.clear();
+  vendorNativeBailed.clear();
+  vendorPackageShapes.clear();
+}
+
+/**
+ * Preplan replacement for `decideVendorRef`: the same classification from pure inputs only - no awaited child
+ * builds, no facade exec. Anything it cannot settle purely returns undefined, bailing the whole package to
+ * the plugin path. Cached beside the plugin-era decisions under a distinct key prefix.
+ */
+function preplanVendorRef(
+  request: VendorNativeRequest,
+  specifier: string,
+  importerFile: string,
+  isRequire: boolean,
+  conditions: string[],
+) {
+  const importerDir = path.dirname(importerFile);
+  const key = `p\0${request.target}\0${request.conditionTarget}\0${isRequire ? 'r' : 'i'}\0${specifier}\0${importerDir}`;
+  let decision = vendorRefDecisions.get(key);
+  if (!decision) {
+    decision = preplanVendorRefUncached(request, specifier, importerFile, isRequire, conditions);
+    vendorRefDecisions.set(key, decision);
+  }
+  return decision;
+}
+
+async function preplanVendorRefUncached(
+  request: VendorNativeRequest,
+  specifier: string,
+  importerFile: string,
+  isRequire: boolean,
+  conditions: string[],
+): Promise<VendorRefDecision | undefined> {
+  const { config, target } = request;
+  const importerDir = path.dirname(importerFile);
+  const keep = { kind: 'keep' } as const;
+  const depName = packageNameFromSpecifier(specifier);
+  if (depName && (builtinModules.includes(depName) || isBunBuiltin(depName))) return keep;
+  // Require-of-external is the async-interop shape that 500ed; not this class.
+  if (isRequire) return undefined;
+  if (aliasSpecifierFilter.test(specifier)) {
+    const resolved = coreAliases(config, target)[specifier] ?? firstAliasForSpecifier(specifier);
+    if (!resolved) return undefined;
+    if (!path.isAbsolute(resolved)) return keep;
+    return { kind: 'repoint', target: { specifier: pathToFileHref(resolved), file: resolved } };
+  }
+  if (serverIgnoredAssetFilter.test(specifier)) {
+    const asset = resolveVendorPackageSpecifier(
+      config.root,
+      path.join(importerDir, 'pnext-resolve.ts'),
+      specifier,
+      conditions,
+    );
+    return asset ? { kind: 'inline', file: asset } : undefined;
+  }
+  if (!depName || !isPackageSpecifier(specifier)) return undefined;
+  if (getExternalPackagePolicy().external(depName)) {
+    const fromImporter = resolveNestedPackageFromImporter(importerFile, specifier, conditions);
+    const fromRoot = resolveVendorPackageSpecifier(
+      config.root,
+      path.join(config.root, 'pnext-resolve.ts'),
+      specifier,
+      conditions,
+    );
+    if (!fromImporter || fromImporter === fromRoot) return keep;
+    return {
+      kind: 'repoint',
+      target: { specifier: fromImporter, file: fromImporter },
+      nested: fromImporter,
+    };
+  }
+  const planned = await preplanDependencyDecision(
+    config,
+    target,
+    request.conditionTarget,
+    specifier,
+    importerDir,
+  );
+  if (!planned?.path) return undefined;
+  return {
+    kind: 'repoint',
+    target: { specifier: planned.path, file: fileURLToPath(planned.path) },
+  };
+}
+
+function decideVendorRef(
+  request: VendorNativeRequest,
+  specifier: string,
+  importerFile: string,
+  isRequire: boolean,
+  conditions: string[],
+) {
+  const importerDir = path.dirname(importerFile);
+  const key = `${request.target}\0${request.conditionTarget}\0${isRequire ? 'r' : 'i'}\0${specifier}\0${importerDir}`;
+  let decision = vendorRefDecisions.get(key);
+  if (!decision) {
+    decision = decideVendorRefUncached(request, specifier, importerFile, isRequire, conditions);
+    vendorRefDecisions.set(key, decision);
+  }
+  return decision;
+}
+
+async function decideVendorRefUncached(
+  request: VendorNativeRequest,
+  specifier: string,
+  importerFile: string,
+  isRequire: boolean,
+  conditions: string[],
+): Promise<VendorRefDecision | undefined> {
+  const { config, target, conditionTarget } = request;
+  const importerDir = path.dirname(importerFile);
+  const keep = { kind: 'keep' } as const;
+  const depName = packageNameFromSpecifier(specifier);
+  if (depName && (builtinModules.includes(depName) || isBunBuiltin(depName))) return keep;
+
+  // Framework aliases. A require-call reads the react-server layer — a package
+  // probing `'useState' in require('react')` must see false — so the two kinds
+  // of reference to one specifier are repointed separately.
+  if (aliasSpecifierFilter.test(specifier)) {
+    const resolved = coreAliases(config, target)[specifier] ?? firstAliasForSpecifier(specifier);
+    if (!resolved) return undefined;
+    if (isRequire) {
+      // A CommonJS shim swap (`next/navigation` -> navigation.cjs) is the one
+      // alias the plugin BUNDLES; leave that build to the plugin.
+      if (serverRequireAlias(specifier, resolved, 'require-call') !== resolved) return undefined;
+      const layerAliases =
+        target === 'server' ? getImportAliasExtensions().reactServerLayerAliases(config) : undefined;
+      const layer = layerAliases?.[specifier] ?? resolved;
+      const file = path.isAbsolute(layer) ? layer : require.resolve(layer);
+      return { kind: 'repoint', target: { specifier: file, file } };
+    }
+    if (!path.isAbsolute(resolved)) return keep;
+    return { kind: 'repoint', target: { specifier: pathToFileHref(resolved), file: resolved } };
+  }
+
+  // An asset the bundler externalized (a cross-package CSS import) has to come
+  // back inside, where `loader: empty` stubs it.
+  if (serverIgnoredAssetFilter.test(specifier)) {
+    const asset = resolveVendorPackageSpecifier(
+      config.root,
+      path.join(importerDir, 'pnext-resolve.ts'),
+      specifier,
+      conditions,
+    );
+    return asset ? { kind: 'inline', file: asset } : undefined;
+  }
+  if (!depName || !isPackageSpecifier(specifier)) return undefined;
+
+  // B7: a serverExternalPackage stays external, pinned to the importing
+  // package's own copy when that differs from the hoisted root version.
+  if (getExternalPackagePolicy().external(depName)) {
+    const fromImporter = resolveNestedPackageFromImporter(importerFile, specifier, conditions);
+    const fromRoot = resolveVendorPackageSpecifier(
+      config.root,
+      path.join(config.root, 'pnext-resolve.ts'),
+      specifier,
+      conditions,
+    );
+    if (!fromImporter || fromImporter === fromRoot) return keep;
+    return {
+      kind: 'repoint',
+      target: { specifier: fromImporter, file: fromImporter },
+      nested: fromImporter,
+    };
+  }
+
+  const resolvedEntry = resolveVendorPackageSpecifier(
+    config.root,
+    path.join(importerDir, 'pnext-resolve.ts'),
+    specifier,
+    conditions,
+  );
+  // A CommonJS dependency loses its named exports when externalized, so it is
+  // inlined unless a verified facade can republish them.
+  const commonJs = Boolean(resolvedEntry) && !isEsmModuleEntry(resolvedEntry!);
+  if (commonJs && !(await cjsEntryMayHaveNamedExports(resolvedEntry!))) {
+    return { kind: 'inline', file: resolvedEntry! };
+  }
+  let vendored: string;
+  const tv = performance.now();
+  try {
+    vendored = await externalServerPackageHref(
+      config,
+      specifier,
+      target,
+      importerDir,
+      conditionTarget,
+      // Raised from inside a running build: must not queue behind it.
+      true,
+    );
+  } catch (error) {
+    if (isResolveFailure(error)) return keep;
+    return undefined;
+  }
+  if (vendorTraceEnabled()) {
+    vendorTraceRow({
+      kind: 'edge',
+      from: request.packageName ?? '?',
+      fromTarget: target,
+      fromCondition: conditionTarget,
+      to: specifier,
+      toResolveDir: importerDir,
+    });
+  }
+  if (commonJs) {
+    heavyProfRow({ k: 'dep-build-wait', site: 'ref', spec: specifier, ms: performance.now() - tv });
+    const tf = performance.now();
+    const facade = await cjsNamedExportFacade(fileURLToPath(vendored), vendored);
+    heavyProfRow({ k: 'facade-wait', site: 'ref', spec: specifier, ms: performance.now() - tf });
+    if (!facade) return { kind: 'inline', file: resolvedEntry! };
+    return {
+      kind: 'repoint',
+      target: { specifier: pathToFileHref(facade), file: facade },
+    };
+  }
+  return {
+    kind: 'repoint',
+    target: { specifier: vendored, file: fileURLToPath(vendored) },
+  };
+}
+
+/**
+ * Record one specifier's target. A chunk mixes importers, so a specifier that two importers resolve
+ * DIFFERENTLY (a pinned nested version for one of them) cannot be rewritten in place - that is a bail, not a
+ * choice.
+ */
+function record(
+  targets: Map<string, VendorRefTarget>,
+  specifier: string,
+  target: VendorRefTarget,
+) {
+  const existing = targets.get(specifier);
+  if (existing) return existing.specifier === target.specifier;
+  targets.set(specifier, target);
+  return true;
+}
+
+async function writeExternalServerPackageBundle(
+  config: ResolvedConfig,
+  specifier: string,
+  target: CompatAliasTarget,
+  resolveDir: string,
+  file: string,
+  conditionTarget: ServerBundleTarget,
+  nested: boolean,
+) {
+  const context = { nestedExternalFiles: [] as string[] };
+  // The layer is part of the label: the same specifier legitimately compiles
+  // once per target, and a profile that cannot tell those apart reads as
+  // duplication that is not there.
+  const bundled = await profileRuntimeStep(`vendor bundle ${specifier} [${target}/${conditionTarget}]`, () =>
+    bundleExternalPackage(
+      config,
+      specifier,
+      target,
+      resolveDir,
+      conditionTarget,
+      context,
+      file,
+      nested,
+    ),
+  );
+  // Packages can ship 'use cache' functions too (Next allows it); client
+  // bundles keep the source untouched.
+  const code =
+    target === 'server' ? applyBundledSourceTransforms(bundled.code, specifier) : bundled.code;
+  const id = await writeVendorArtifact(file, code);
+  recordVendorLayerBuild(
+    config,
+    resolveVendorEntry(config, specifier, resolveDir, conditionTarget),
+    target,
+    conditionTarget,
+    bundled.metafile,
+    code,
+    id,
+  );
+  // When this vendor bundle pins a transitive external to a nested version distinct from the hoisted root
+  // copy, Node/webpack file tracing surfaces that dependency's source as a `.js` artifact in the server
+  // output. Emit a `.js` trace copy of each such source so build tooling that scans `**/*.js` - never `.mjs` -
+  // observes the bundled transitive too. These are trace artifacts only; nothing imports them.
+  await emitNestedExternalTraceCopies(file, context.nestedExternalFiles);
+  return file;
+}
+
+/** Trace-only side channel: what the esbuild pass that produced the code did. */
+interface VendorBuildTrace {
+  plugins: string[];
+  entry?: string;
+  metafile?: Metafile;
+}
+
+/** Emit one JSONL build row from a finished (or failed) vendor esbuild pass. */
+function traceVendorBuild(row: {
+  seq: number;
+  specifier: string;
+  resolveDir: string;
+  target: string;
+  conditionTarget: ServerBundleTarget;
+  conditions: string[];
+  startMs: number;
+  outBytes: number;
+  trace: VendorBuildTrace;
+  ok: boolean;
+  error?: string;
+}) {
+  const inputs = row.trace.metafile?.inputs ?? {};
+  const inputFiles = Object.keys(inputs);
+  const endMs = performance.now();
+  vendorTraceRow({
+    seq: row.seq,
+    specifier: row.specifier,
+    resolveDir: row.resolveDir,
+    target: row.target,
+    conditionTarget: row.conditionTarget,
+    entry: row.trace.entry,
+    conditions: row.conditions,
+    startMs: row.startMs,
+    endMs,
+    ms: endMs - row.startMs,
+    inputCount: inputFiles.length,
+    inputBytes: inputFiles.reduce((sum, input) => sum + (inputs[input]?.bytes ?? 0), 0),
+    inputFiles,
+    outBytes: row.outBytes,
+    plugins: row.trace.plugins,
+    ok: row.ok,
+    ...(row.error ? { error: row.error } : {}),
+  });
+}
+
+async function bundleExternalPackage(
+  config: ResolvedConfig,
+  specifier: string,
+  target: CompatAliasTarget,
+  resolveDir: string,
+  conditionTarget: ServerBundleTarget,
+  context?: { nestedExternalFiles: string[] },
+  /** The artifact this bundle becomes — the plugin-free path's identity. */
+  file?: string,
+  nested = false,
+) {
+  if (!vendorTraceEnabled()) {
+    return bundleExternalPackageImpl(
+      config,
+      specifier,
+      target,
+      resolveDir,
+      conditionTarget,
+      context,
+      file,
+      nested,
+    );
+  }
+  const trace: VendorBuildTrace = { plugins: [] };
+  const seq = nextVendorTraceSeq();
+  const startMs = performance.now();
+  const common = {
+    seq,
+    specifier,
+    resolveDir,
+    target,
+    conditionTarget,
+    conditions: serverBundleConditions(conditionTarget),
+    startMs,
+    trace,
+  };
+  try {
+    const result = await bundleExternalPackageImpl(
+      config,
+      specifier,
+      target,
+      resolveDir,
+      conditionTarget,
+      context,
+      file,
+      nested,
+      trace,
+    );
+    traceVendorBuild({ ...common, outBytes: result.code.length, ok: true });
+    return result;
+  } catch (error) {
+    traceVendorBuild({
+      ...common,
+      outBytes: 0,
+      ok: false,
+      error: (error instanceof Error ? error.message : String(error)).slice(0, 300),
+    });
+    throw error;
+  }
+}
+
+async function bundleExternalPackageImpl(
+  config: ResolvedConfig,
+  specifier: string,
+  target: CompatAliasTarget,
+  resolveDir: string,
+  conditionTarget: ServerBundleTarget,
+  context?: { nestedExternalFiles: string[] },
+  /** The artifact this bundle becomes — the plugin-free path's identity. */
+  file?: string,
+  nested = false,
+  trace?: VendorBuildTrace,
+) {
+  const packageName = packageNameFromSpecifier(specifier);
+  const resolvedEntry = resolveVendorPackageSpecifier(
+    config.root,
+    path.join(resolveDir, 'pnext-resolve.ts'),
+    specifier,
+    serverBundleConditions(conditionTarget),
+  );
+  const requiredEntry =
+    resolvedEntry &&
+    !isEsmModuleFile(resolvedEntry) &&
+    getExternalPackagePolicy().esmExternals() === true
+      ? resolveVendorPackageSpecifier(
+          config.root,
+          path.join(resolveDir, 'pnext-resolve.ts'),
+          specifier,
+          serverBundleRequireConditions(conditionTarget),
+        )
+      : undefined;
+  if (
+    packageName &&
+    resolvedEntry?.match(/\.[cm]?tsx?$/) &&
+    !getExternalPackagePolicy().transpile(packageName)
+  ) {
+    throw new Error(
+      `${path.relative(config.root, resolvedEntry)}\nModule parse failed: Unexpected token`,
+    );
+  }
+  const entry =
+    requiredEntry ??
+    resolveLinkedPackageSpecifier(
+      config.root,
+      path.join(resolveDir, 'pnext-resolve.ts'),
+      specifier,
+      serverBundleConditions(conditionTarget),
+    ) ??
+    specifier;
+  // `packages: 'external'` refuses to bundle a BARE entry point, so the
+  // plugin-free path needs the resolved file — which is the same file esbuild
+  // would have resolved the specifier to.
+  const nativeEntry = path.isAbsolute(entry) ? entry : resolvedEntry;
+  if (trace) trace.entry = nativeEntry ?? resolvedEntry;
+  const preplan =
+    vendorPreplanEnabled() &&
+    (await vendorPreplanPackageSafe(
+      config,
+      packageName,
+      nativeEntry ?? resolvedEntry,
+      target,
+      conditionTarget,
+    ));
+  const native =
+    file && nativeEntry
+      ? await buildVendorNative({
+          preplan,
+          config,
+          target,
+          conditionTarget,
+          resolveDir,
+          bailKey: file,
+          packageName,
+          entryPoints: [nativeEntry],
+          splitting: false,
+          ownEntries: new Map([[nativeEntry, file]]),
+          isEntry: () => true,
+          soloFile: file,
+          nested,
+          context: context ?? { nestedExternalFiles: [] },
+          trace,
+        })
+      : undefined;
+  if (native?.[0]) return { code: addCommonJsNamedExports(native[0].text), metafile: undefined };
+
+  let bundled: string;
+  let metafile: Metafile | undefined;
+  const pluginStart = performance.now();
+  const vendorPlugins = profiledVendorPlugins([
+    serverAssetPlugin(config),
+    ...getBundlerExtensions().serverEsbuildPlugins(
+      config,
+      vendorPluginOptions(config, target, conditionTarget),
+    ),
+    runtimeAliasBuildPlugin(config, target, {
+      bundleRequireAliases: true,
+      // The server vendor bundle IS the react-server layer (client-target
+      // bundles are the SSR pass and keep the full-hooks shim).
+      reactServerLayer: target === 'server',
+    }),
+    externalPackageDependencyPlugin(config, specifier, target, conditionTarget, context, preplan),
+    externalBuiltinBuildPlugin(),
+  ]);
+  if (trace) trace.plugins = vendorPlugins.map(plugin => plugin.name);
+  // Bare entry: hand the interop plugin the resolution already computed above.
+  if (!path.isAbsolute(entry) && resolvedEntry) {
+    provideEntryResolution(entry, resolveDir, resolvedEntry);
+  }
+  try {
+    const result = await build({
+      entryPoints: [
+        getBundlerExtensions().serverBundleEntry(
+          entry,
+          resolveDir,
+          path.isAbsolute(entry) ? entry : resolvedEntry,
+        ) ?? entry,
+      ],
+      absWorkingDir: resolveDir,
+      bundle: true,
+      write: false,
+      format: 'esm',
+      platform: 'neutral',
+      target: 'es2022',
+      conditions: serverBundleConditions(conditionTarget),
+      mainFields: ['module', 'main'],
+      loader: packageJsxLoaders,
+      jsx: 'automatic',
+      jsxImportSource: 'preact',
+      logLevel: 'silent',
+      // The verdict is computed offline from this, after the build settles.
+      metafile: true,
+      ...serverDefineOptions(),
+      plugins: vendorPlugins,
+    });
+    const output = result.outputFiles[0];
+    if (!output) throw new Error(`Failed to bundle ${specifier}`);
+    vendorNativeStats.pluginBuilds += 1;
+    vendorNativeStats.pluginBuildMs += performance.now() - pluginStart;
+    bundled = output.text;
+    metafile = result.metafile;
+    if (trace) trace.metafile = result.metafile;
+  } catch (error) {
+    // A subpath the package deliberately withholds from this layer
+    // (`"node": null`) is not a broken dependency: browser-only code reaches it
+    // behind a `typeof window` guard that never runs on the server, and Next's
+    // server compilers drop that branch before their resolver ever sees it.
+    // Vending a module that throws Node's own error keeps the guarded import
+    // out of the build while still failing loudly if anything evaluates it.
+    if (
+      !isPackageSubpathUnexported(
+        config.root,
+        path.join(resolveDir, 'pnext-resolve.ts'),
+        specifier,
+        serverBundleConditions(conditionTarget),
+      )
+    ) {
+      throw error;
+    }
+    return { code: unexportedSubpathModule(specifier), metafile: undefined };
+  }
+  return { code: addCommonJsNamedExports(bundled), metafile };
+}
+
+function unexportedSubpathModule(specifier: string) {
+  const packageName = packageNameFromSpecifier(specifier);
+  const subpath = packageName && specifier !== packageName ? `.${specifier.slice(packageName.length)}` : '.';
+  const message = `Package subpath '${subpath}' is not defined by "exports" in ${packageName ?? specifier}`;
+  return `throw Object.assign(new Error(${JSON.stringify(message)}), { code: 'ERR_PACKAGE_PATH_NOT_EXPORTED' });\n`;
+}
+
+function runtimeAliasBuildPlugin(
+  config?: ResolvedConfig,
+  target: CompatAliasTarget = 'server',
+  options: { bundleRequireAliases?: boolean; reactServerLayer?: boolean } = {},
+): Plugin {
+  const aliases = config ? coreAliases(config, target) : undefined;
+  // A node_modules package bundled into the RSC (react-server) layer that requires 'react' must observe the
+  // react-server subset - no client-hook dispatcher - exactly like the framework's own react-server modules,
+  // so a package's `'useState' in require('react')` probe reads false on the server. ESM named imports stay
+  // external and resolve at runtime against the full-hooks server shim (kept for pages/api back-compat), so
+  // this narrow require-call override never breaks them.
+  const reactServerLayerAliases =
+    config && options.reactServerLayer
+      ? getImportAliasExtensions().reactServerLayerAliases(config)
+      : undefined;
+  return {
+    name: 'pnext-runtime-build-alias',
+    setup(build) {
+      build.onResolve({ filter: /^\.\/preact$/ }, args => {
+        // `./preact` is the compat react shim's private import. It also appears in MIRRORED copies of the
+        // shim (build-cache outputs under node_modules paths) where no sibling preact file exists - those
+        // must resolve to the single compat instance too. Only a REAL sibling ./preact.* opts out.
+        const hasRealSibling = ['.ts', '.tsx', '.js', '.mjs', '.jsx'].some(ext =>
+          existsSync(path.join(args.resolveDir, `preact${ext}`)),
+        );
+        const compatPreact = path.resolve(import.meta.dirname, '..', 'compat', 'react', 'preact.ts');
+        if (hasRealSibling && path.resolve(args.resolveDir, 'preact.ts') !== compatPreact)
+          return undefined;
+        return { path: compatPreact };
+      });
+      build.onResolve({ filter: /^\.\.\/client\/errors\/primitive-throw$/ }, args => {
+        const compatPreact = path.resolve(import.meta.dirname, '..', 'compat', 'react', 'preact.ts');
+        if (path.resolve(args.importer) !== compatPreact) return undefined;
+        return { path: path.resolve(import.meta.dirname, '..', 'compat', 'client', 'errors', 'primitive-throw.ts') };
+      });
+      build.onResolve({ filter: aliasSpecifierFilter }, args => {
+        const resolved = aliases?.[args.path] ?? firstAliasForSpecifier(args.path);
+        if (!resolved) return undefined;
+        const requireTarget = serverRequireAlias(args.path, resolved, args.kind);
+        if (requireTarget !== resolved) return { path: requireTarget };
+        if (options.bundleRequireAliases && args.kind === 'require-call') {
+          const layerTarget = serverRequireAlias(
+            args.path,
+            reactServerLayerAliases?.[args.path] ?? resolved,
+            args.kind,
+          );
+          return { path: path.isAbsolute(layerTarget) ? layerTarget : require.resolve(layerTarget) };
+        }
+        return {
+          path: path.isAbsolute(resolved) ? pathToFileHref(resolved) : resolved,
+          external: true,
+        };
+      });
+    },
+  };
+}
+
+function serverRequireAlias(specifier: string, target: string, kind: string | undefined): string {
+  if (kind !== 'require-call') return target;
+  if (specifier === 'next/navigation' && target.endsWith(`${path.sep}navigation.ts`)) {
+    return path.join(path.dirname(target), 'navigation.cjs');
+  }
+  if (specifier === 'next/router' && target.endsWith(`${path.sep}router.ts`)) {
+    return path.join(path.dirname(target), 'router.cjs');
+  }
+  return target;
+}
+
+function externalPackageDependencyPlugin(
+  config: ResolvedConfig,
+  entrySpecifier: string,
+  target: CompatAliasTarget,
+  conditionTarget: ServerBundleTarget,
+  context?: { nestedExternalFiles: string[] },
+  preplan = false,
+): Plugin {
+  const entryPackageName = packageNameFromSpecifier(entrySpecifier);
+  return {
+    name: 'pnext-external-package-dependencies',
+    setup(build) {
+      build.onResolve({ filter: /^[^./].*/ }, async args => {
+        if (!isPackageSpecifier(args.path)) return undefined;
+        if (packageNameFromSpecifier(args.path) === entryPackageName) return undefined;
+        if (preplan && args.kind !== 'require-call') {
+          const planned = await preplanDependencyDecision(
+            config,
+            target,
+            conditionTarget,
+            args.path,
+            args.resolveDir,
+          );
+          if (planned) {
+            vendorPreplanStats.preplanRefs += 1;
+            return planned;
+          }
+          vendorPreplanStats.fallbackRefs += 1;
+        }
+        // Off the slot for the whole decision: it ends in a nested vendor
+        // build, and holding a worker across that is what caps real
+        // parallelism at dependency depth (`PNEXT_VENDOR_YIELD=0` pins the old
+        // behaviour for bisecting). The resolver work in front of it is cheap
+        // and off-slot too, exactly as the plugin-free path's post-pass runs it.
+        const decision = await yieldVendorSlotWhile(() =>
+          externalDependencyDecision(config, target, conditionTarget, args.path, args.resolveDir, args.importer),
+        );
+        if (decision?.vendored && vendorTraceEnabled()) {
+          vendorTraceRow({
+            kind: 'edge',
+            from: entrySpecifier,
+            fromTarget: target,
+            fromCondition: conditionTarget,
+            to: args.path,
+            toResolveDir: args.resolveDir,
+          });
+        }
+        if (decision?.nested && context) context.nestedExternalFiles.push(decision.nested);
+        // eslint-disable-next-line @typescript-eslint/only-throw-error
+        if (decision?.error) throw decision.error;
+        return decision?.result;
+      });
+    },
+  };
+}
+
+/** What one external reference resolves to, plus the effects the caller replays. */
+interface ExternalDependencyDecision {
+  result: OnResolveResult | undefined;
+  /** A transitive dep pinned to a nested copy, for the trace-copy pass. */
+  nested?: string;
+  /** A build failure, re-thrown per caller rather than cached as a value. */
+  error?: unknown;
+  /** Trace-only: the dep was deferred to a vendor bundle of its own. */
+  vendored?: boolean;
+}
+
+/**
+ * NOT memoized on (layer, specifier, importing directory), though it looks pure in them: the answer
+ * also depends on what is on disk when it is asked - `externalServerPackageHref` re-checks its
+ * artifact's liveness per demand, and the facade gate re-executes a bundle that may have been
+ * replaced. Caching it lost `app-external` outright, so the seam stays as the plugin chain had it.
+ */
+async function externalDependencyDecision(
+  config: ResolvedConfig,
+  target: CompatAliasTarget,
+  conditionTarget: ServerBundleTarget,
+  specifier: string,
+  resolveDir: string,
+  importer: string | undefined,
+): Promise<ExternalDependencyDecision> {
+  // B7: a serverExternalPackage transitive dep stays external (Node resolves it
+  // from node_modules at runtime) instead of being bundled.
+  const depName = packageNameFromSpecifier(specifier);
+  if (depName && getExternalPackagePolicy().external(depName)) {
+    // Transitive-version correctness: the runtime resolves a bare external from the VENDOR bundle's own
+    // location, which walks up to the hoisted root copy - wrong when the importing package pulls a distinct
+    // nested version (pnpm virtual store, npm nesting). Resolve the dep from the IMPORTING package's real
+    // path here, at build time, and when that is a copy distinct from the hoisted root version, pin the
+    // external to that exact resolved file so the correct version loads at runtime. A hoisted dep stays a
+    // portable bare external. Bundling the nested copy inline instead regresses to a resolve ERROR for the
+    // bundle's other bare externals, so keep it external and only pin the path.
+    const conditions = serverBundleConditions(conditionTarget);
+    const fromImporter = importer
+      ? resolveNestedPackageFromImporter(importer, specifier, conditions)
+      : undefined;
+    const fromRoot = resolveVendorPackageSpecifier(
+      config.root,
+      path.join(config.root, 'pnext-resolve.ts'),
+      specifier,
+      conditions,
+    );
+    if (fromImporter && fromImporter !== fromRoot) {
+      return { result: { path: fromImporter, external: true }, nested: fromImporter };
+    }
+    return { result: { path: specifier, external: true } };
+  }
+  const resolvedEntry = resolveVendorPackageSpecifier(
+    config.root,
+    path.join(resolveDir, 'pnext-resolve.ts'),
+    specifier,
+    serverBundleConditions(conditionTarget),
+  );
+  // A CommonJS dependency loses its named exports when externalized (esbuild emits only `default` for a CJS
+  // entry), so it is inlined here instead. `isEsmModuleEntry` first checks CONTENT, not just extension and
+  // `package.json#type` - most "CJS" entries are plain-.js ESM and inline for no reason. What is left gets a
+  // verified named-export facade when it publishes names, and is inlined only when it does not.
+  const commonJs = Boolean(resolvedEntry) && !isEsmModuleEntry(resolvedEntry!);
+  if (commonJs && !(await cjsEntryMayHaveNamedExports(resolvedEntry!))) return { result: undefined };
+  let resolvedPackage: string;
+  const tv = performance.now();
+  try {
+    resolvedPackage = await externalServerPackageHref(
+      config,
+      specifier,
+      target,
+      resolveDir,
+      conditionTarget,
+      // Raised from inside a running build: must not queue behind it.
+      true,
+    );
+  } catch (error) {
+    if (isResolveFailure(error)) return { result: { path: specifier, external: true } };
+    return { result: undefined, error };
+  }
+  if (commonJs) {
+    heavyProfRow({ k: 'dep-build-wait', site: 'plugin', spec: specifier, ms: performance.now() - tv });
+    const tf = performance.now();
+    const facade = await cjsNamedExportFacade(fileURLToPath(resolvedPackage), resolvedPackage);
+    heavyProfRow({ k: 'facade-wait', site: 'plugin', spec: specifier, ms: performance.now() - tf });
+    if (!facade) return { result: undefined };
+    return { result: { path: pathToFileHref(facade), external: true }, vendored: true };
+  }
+  return { result: { path: resolvedPackage, external: true }, vendored: true };
+}
+
+/** `PNEXT_VENDOR_YIELD=0` keeps the slot across a nested dependency's build. */
+function yieldVendorSlotWhile<T>(task: () => Promise<T>) {
+  // eslint-disable-next-line turbo/no-undeclared-env-vars
+  return process.env.PNEXT_VENDOR_YIELD === '0' ? task() : outsideVendorSlot(task);
+}
+
+function isResolveFailure(error: unknown) {
+  const details = error instanceof Error ? `${error.message}\n${error.stack ?? ''}` : String(error);
+  return details.includes('Could not resolve');
+}
+
+async function profileRuntimeStep<T>(label: string, task: () => Promise<T>) {
+  // eslint-disable-next-line turbo/no-undeclared-env-vars
+  if (!process.env.PNEXT_DEV_PROFILE) return task();
+  const start = performance.now();
+  try {
+    return await task();
+  } finally {
+    console.log(`dev-profile compat ${label} in ${formatDuration(performance.now() - start)}`);
+  }
+}
+
+function formatDuration(durationMs: number) {
+  const ms = Math.max(0, durationMs);
+  if (ms < 10) return `${ms.toFixed(1)}ms`;
+  if (ms < 1000) return `${Math.round(ms)}ms`;
+  return `${(ms / 1000).toFixed(ms < 10000 ? 2 : 1)}s`;
+}
+
+function externalBuiltinBuildPlugin(): Plugin {
+  return {
+    name: 'pnext-external-builtins',
+    setup(build) {
+      build.onResolve({ filter: /^[^./].*/ }, args => {
+        const packageName = packageNameFromSpecifier(args.path);
+        if (!packageName || (!builtinModules.includes(packageName) && !isBunBuiltin(packageName))) {
+          return undefined;
+        }
+        return { path: args.path, external: true };
+      });
+    },
+  };
+}
+
+function isBunBuiltin(specifier: string) {
+  return specifier === 'bun' || specifier.startsWith('bun:');
+}
+
+function serverAssetPlugin(config?: ResolvedConfig): Plugin {
+  return {
+    name: 'pnext-empty-server-assets',
+    setup(build) {
+      build.onResolve({ filter: serverIgnoredAssetFilter }, args => {
+        const resolved = resolveAssetPath(args.path, args.resolveDir);
+        // A configured `turbopack.rules` loader chain for this extension (e.g.
+        // `*.svg`) preempts the generic asset pipeline: defer so the compat
+        // loader-rule plugin's onLoad runs the chain against the real file.
+        if (getAssetExtensions().hasLoaderRuleFor(resolved)) {
+          return undefined;
+        }
+        return { path: resolved, namespace: 'pnext-empty-server-asset' };
+      });
+      build.onLoad({ filter: /.*/, namespace: 'pnext-empty-server-asset' }, async args => ({
+        contents: getCssExtensions().loadCssModuleForClient(args.path) ?? (isCssFile(args.path)
+          ? ''
+          : isStaticImageFile(args.path)
+            ? await staticImageModuleSource(config, args.path)
+            : 'export default "";'),
+        loader: 'js',
+      }));
+    },
+  };
+}
+
+/**
+ * Whether `rewriteServerSource` can possibly change `source`. One regex scan
+ * over the union of the core dynamic tokens and every registered transform's
+ * own sniff tokens (see `withSniff`); most modules trigger nothing and skip the
+ * whole chain.
+ */
+export function needsServerSourceRewrite(source: string) {
+  return sourceHasDynamicImport(source) || sourceNeedsServerTransforms(source);
+}
+
+export function rewriteServerSource(
+  source: string,
+  file: string,
+  options: { nextFonts?: boolean; root?: string } = {},
+) {
+  const root = options.root ?? path.dirname(file);
+  const rewritten = sourceHasDynamicImport(source)
+    ? rewriteDynamicCallTargets(
+        rewriteLiteralDynamicCalls(source, file),
+        specifier => resolveImport(root, file, specifier),
+        file,
+      )
+    : source;
+  // Compat pre-transforms (next/font/root-params) run before generic server
+  // transforms (use-cache/action tags). Pure-core apps register no transforms.
+  if (options.nextFonts === false) return rewritten;
+  if (!sourceNeedsServerTransforms(rewritten)) return rewritten;
+  return applyServerSourceTransforms(
+    applyServerSourcePreTransforms(rewritten, file, options.root),
+    file,
+    options.root,
+  );
+}
+
+export function runtimeImportTarget(specifier: string, format: 'esm' | 'cjs' = 'esm') {
+  if (isRelativeOrAbsoluteSpecifier(specifier)) return specifier;
+  const target = firstAliasForSpecifier(specifier);
+  if (!target) return specifier;
+  return format === 'esm' ? pathToFileHref(target) : target;
+}
+
+export function runtimeServerImportTarget(specifier: string) {
+  return runtimeImportTarget(specifier, 'esm');
+}
+
+function isRelativeOrAbsoluteSpecifier(specifier: string) {
+  return specifier.startsWith('.') || specifier.startsWith('/') || specifier.startsWith('file:');
+}
+
+function isPackageSpecifier(specifier: string) {
+  if (isRelativeOrAbsoluteSpecifier(specifier)) return false;
+  if (specifier.startsWith('#')) return false;
+  if (specifier.startsWith('node:')) return false;
+  if (specifier.includes(':')) return false;
+  const packageName = packageNameFromSpecifier(specifier);
+  return Boolean(packageName && !builtinModules.includes(packageName));
+}
+
+function isInside(root: string, file: string) {
+  const relative = path.relative(root, file);
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+
+function rootPaths(root: string) {
+  const key = path.resolve(root);
+  const cached = rootPathCache.get(key);
+  if (cached) return cached;
+  const paths = new Set([path.resolve(root)]);
+  try {
+    paths.add(realpathSync.native(root));
+  } catch {
+    // The dev cache root is registered before it exists.
+  }
+  const resolved = [...paths];
+  rootPathCache.set(key, resolved);
+  return resolved;
+}
+
+function rootFilter(root: string) {
+  // Base source extensions plus any extra loadable extensions registered by
+  // compat (e.g. mdx/md via pageExtensions). Without these, `.mdx` modules skip
+  // the transform load hook and resolve as raw assets (default export = path).
+  const extras = currentLoadExtras().map(escapeRegex);
+  const exts = ['[jt]sx?', ...extras].join('|');
+  // Exclude `next.config.{js,cjs,mjs,ts}`: it is loaded for its exported value (often CommonJS
+  // `module.exports = ...`), not as part of the app's server module graph. Routing it through the
+  // ES-module source transform drops the CJS exports, silently disabling next.config
+  // rewrites/redirects.
+  // Exclude the vendor tree under the cache root: the `*.dist/` copies copyBrowserReadyEsmDist
+  // publishes are verbatim third-party ESM the copy predicate has already proved needs no server
+  // rewrite, but they are `.js`, so each was read and re-transformed on every boot. Bun loads them
+  // natively instead. Two clauses because the vendor tree is reachable from two registered roots.
+  const vendorGuard = vendorLoadsNatively()
+    ? `${root.endsWith(`${path.sep}cache${path.sep}server`) ? '(?!\\/vendor\\/)' : ''}(?!.*\\/cache\\/server\\/vendor\\/)`
+    : '';
+  return new RegExp(
+    `^${escapeRegex(root)}${vendorGuard}(?!.*\\/node_modules\\/)(?!\\/next\\.config\\.(?:js|cjs|mjs|ts)$)(?:/.*)?\\.(?:${exts})$`,
+  );
+}
+
+function esbuildLoader(file: string) {
+  if (file.endsWith('.tsx')) return 'tsx';
+  if (file.endsWith('.ts')) return 'ts';
+  // Workspace .js/.jsx may contain JSX (Next allows it); jsx is a js superset.
+  return 'jsx';
+}
+
+function hashRoot(value: string) {
+  let hash = 5381;
+  for (const char of value) hash = ((hash << 5) + hash) ^ char.charCodeAt(0);
+  return (hash >>> 0).toString(36);
+}
+
+function hashBundleSpecifier(value: string) {
+  return createHash('sha256').update(value).digest('hex').slice(0, 16);
+}
+
+// Trace copies of nested transitive externals (a version distinct from the
+// hoisted root copy) written alongside the vendor bundle as `.js`, so file
+// tracing / server-bundle scans observe the bundled dependency the way
+// webpack's bundled transitive would appear. Trace-only: never imported.
+async function emitNestedExternalTraceCopies(vendorFile: string, sources: readonly string[]) {
+  const dir = path.dirname(vendorFile);
+  for (const source of new Set(sources)) {
+    try {
+      const content = await readFile(source, 'utf8');
+      const out = path.join(dir, `${hashBundleSpecifier(source)}.trace.js`);
+      if (!existsSync(out)) await writeFileAtomic(out, content);
+    } catch {
+      // A source that cannot be read is simply not traced.
+    }
+  }
+}
+
+
+const serverIgnoredAssetFilter =
+  /\.(?:css|scss|sass|woff2?|ttf|otf|eot|png|jpe?g|gif|webp|avif|svg|ico|bmp)(?:$|[?#])/;
+
+function isCssFile(file: string) {
+  return file.endsWith('.css');
+}
+
+function isStaticImageFile(file: string) {
+  return /\.(?:png|jpe?g|gif|webp|avif|svg|ico|bmp)(?:$|[?#])/.test(file);
+}
+
+function resolveAssetPath(specifier: string, resolveDir: string) {
+  const [sourcePath = '', hash = ''] = specifier.split('#', 2);
+  const resolved = path.isAbsolute(sourcePath) ? sourcePath : path.resolve(resolveDir, sourcePath);
+  return hash ? `${resolved}#${hash}` : resolved;
+}
+
+async function staticImageModuleSource(config: ResolvedConfig | undefined, file: string) {
+  const [sourcePath = ''] = file.split('#', 1);
+  const bytes = new Uint8Array(await readFile(sourcePath));
+  const emitted: { relative: string; bytes: Uint8Array }[] = [];
+  const emit = (relative: string, data: Uint8Array) => {
+    emitted.push({ relative, bytes: data });
+    return `/${relative}`;
+  };
+  const compat = await getAssetExtensions().staticAssetModule({ sourcePath, bytes, emit });
+  const source = compat ?? coreStaticAssetModule(sourcePath, bytes, emit);
+  if (config) {
+    for (const asset of emitted) {
+      const target = path.join(config.outPath, 'public', ...asset.relative.split('/'));
+      await mkdir(path.dirname(target), { recursive: true });
+      if (!existsSync(target)) await Bun.write(target, asset.bytes);
+    }
+  }
+  return source;
+}
+
+// Core's generic static-asset module: emit the file under a hashed media URL
+// and export it as the default (a plain URL string) when no compat override is
+// registered. next/image compat replaces this with a full StaticImageData shape.
+function coreStaticAssetModule(
+  sourcePath: string,
+  bytes: Uint8Array,
+  emit: (relative: string, bytes: Uint8Array) => string,
+): string {
+  const ext = path.extname(sourcePath).toLowerCase() || '.bin';
+  const hash = createHash('sha256').update(bytes).digest('hex').slice(0, 8);
+  const base = path.basename(sourcePath, path.extname(sourcePath)).replace(/[^A-Za-z0-9_-]+/g, '-');
+  const relative = getAssetExtensions().staticAssetRelativePath({ sourcePath, hash, base, ext });
+  const src = emit(relative, bytes);
+  return `const src = ${JSON.stringify(src)};\nexport default src;\nexport { src };\n`;
+}
+
+function packageNameFromSpecifier(specifier: string) {
+  const normalized = specifier.startsWith('node:') ? specifier.slice(5) : specifier;
+  const parts = normalized.split('/');
+  return normalized.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
+}