fix(devframe): bundle agnostic ohash digest to keep node:crypto out of browser (#6)

`ohash/crypto` resolves to its `node` variant under tsdown's default
conditions, inlining `node:crypto.createHash` into the bundled
`utils/hash.mjs` chunk that is transitively re-exported through the
`client` entry. Force the agnostic (pure-JS) variant by aliasing
`ohash/crypto` to the path produced by `mlly.resolveSync` without the
`node` condition. Both implementations emit identical SHA-256 +
base64url output, so existing hash snapshots remain stable.

Author: antfu

packages/devframe/package.json

@@ -89,6 +89,7 @@
     "human-id": "catalog:inlined",
     "immer": "catalog:deps",
     "launch-editor": "catalog:deps",
+    "mlly": "catalog:build",
     "obug": "catalog:deps",
     "ohash": "catalog:deps",
     "open": "catalog:deps",
@@ -100,7 +101,7 @@
     "whenexpr": "catalog:deps"
   },
   "inlinedDependencies": {
-    "ansis": "4.2.0",
+    "ansis": "4.3.0",
     "bundle-name": "4.1.0",
     "default-browser": "5.5.0",
     "default-browser-id": "5.0.1",

packages/devframe/tsdown.config.ts

@@ -1,6 +1,19 @@
+import { fileURLToPath } from 'node:url'
+import { resolveSync } from 'mlly'
 import { defineConfig } from 'tsdown'
 
+// Resolve `ohash/crypto` without the `node` condition so the pure-JS digest
+// is bundled. The default resolution honours `node`, which inlines
+// `node:crypto.createHash` into outputs that are later shipped to the
+// browser via the `client` entry.
+const ohashCryptoAgnostic = fileURLToPath(
+  resolveSync('ohash/crypto', { url: import.meta.url, conditions: ['import'] }),
+)
+
 export default defineConfig({
+  alias: {
+    'ohash/crypto': ohashCryptoAgnostic,
+  },
   entry: {
     'index': 'src/index.ts',
     'rpc/index': 'src/rpc/index.ts',

pnpm-lock.yaml

@@ -23,6 +23,7 @@ catalogs:
     '@antfu/ni': ^30.1.0
     '@nuxt/kit': ^4.4.5
     '@preact/preset-vite': ^2.10.5
+    mlly: ^1.8.2
     tsdown: ^0.22.0
     tsx: ^4.21.0
     turbo: ^2.9.12