From ce2b876a34ed9d8da23d5cfa69d42c91f3484a03 Mon Sep 17 00:00:00 2001
From: Anthony Fu <github@antfu.me>
Date: Tue, 12 May 2026 18:01:17 +0900
Subject: [PATCH] fix(devframe): bundle agnostic ohash digest to keep
 node:crypto out of browser

`ohash/crypto` resolves to its `node` variant under tsdown's default
conditions, inlining `node:crypto.createHash` into the bundled
`utils/hash.mjs` chunk that is transitively re-exported through the
`client` entry. Force the agnostic (pure-JS) variant by aliasing
`ohash/crypto` to the path produced by `mlly.resolveSync` without the
`node` condition. Both implementations emit identical SHA-256 +
base64url output, so existing hash snapshots remain stable.
---
 packages/devframe/package.json     |  3 ++-
 packages/devframe/tsdown.config.ts | 13 +++++++++++++
 pnpm-lock.yaml                     |  6 ++++++
 pnpm-workspace.yaml                |  1 +
 4 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/packages/devframe/package.json b/packages/devframe/package.json
index 4bc5770..af03011 100644
--- a/packages/devframe/package.json
+++ b/packages/devframe/package.json
@@ -89,6 +89,7 @@
     "human-id": "catalog:inlined",
     "immer": "catalog:deps",
     "launch-editor": "catalog:deps",
+    "mlly": "catalog:build",
     "obug": "catalog:deps",
     "ohash": "catalog:deps",
     "open": "catalog:deps",
@@ -100,7 +101,7 @@
     "whenexpr": "catalog:deps"
   },
   "inlinedDependencies": {
-    "ansis": "4.2.0",
+    "ansis": "4.3.0",
     "bundle-name": "4.1.0",
     "default-browser": "5.5.0",
     "default-browser-id": "5.0.1",
diff --git a/packages/devframe/tsdown.config.ts b/packages/devframe/tsdown.config.ts
index d52020b..b22164c 100644
--- a/packages/devframe/tsdown.config.ts
+++ b/packages/devframe/tsdown.config.ts
@@ -1,6 +1,19 @@
+import { fileURLToPath } from 'node:url'
+import { resolveSync } from 'mlly'
 import { defineConfig } from 'tsdown'
 
+// Resolve `ohash/crypto` without the `node` condition so the pure-JS digest
+// is bundled. The default resolution honours `node`, which inlines
+// `node:crypto.createHash` into outputs that are later shipped to the
+// browser via the `client` entry.
+const ohashCryptoAgnostic = fileURLToPath(
+  resolveSync('ohash/crypto', { url: import.meta.url, conditions: ['import'] }),
+)
+
 export default defineConfig({
+  alias: {
+    'ohash/crypto': ohashCryptoAgnostic,
+  },
   entry: {
     'index': 'src/index.ts',
     'rpc/index': 'src/rpc/index.ts',
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 8c8edb0..03ab94f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -15,6 +15,9 @@ catalogs:
     '@preact/preset-vite':
       specifier: ^2.10.5
       version: 2.10.5
+    mlly:
+      specifier: ^1.8.2
+      version: 1.8.2
     tsdown:
       specifier: ^0.22.0
       version: 0.22.0
@@ -345,6 +348,9 @@ importers:
       launch-editor:
         specifier: catalog:deps
         version: 2.13.2
+      mlly:
+        specifier: catalog:build
+        version: 1.8.2
       obug:
         specifier: catalog:deps
         version: 2.1.1
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 8ea462c..e37db43 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -23,6 +23,7 @@ catalogs:
     '@antfu/ni': ^30.1.0
     '@nuxt/kit': ^4.4.5
     '@preact/preset-vite': ^2.10.5
+    mlly: ^1.8.2
     tsdown: ^0.22.0
     tsx: ^4.21.0
     turbo: ^2.9.12