fix: keep production SSR routes on one module graph

[steve8708]

What changed

Keep production SSR routes and Core hooks in one Vite module graph. Production externalization had split @agent-native/core and the React singleton packages from the app's route graph, allowing Nitro to emit one traced react-router copy and another inlined copy with different context objects.

This restores the Core source alias during production builds and stops externalizing Core, React, React DOM, React Router, and TanStack Query from the intermediate SSR graph. Native yjs and caller-provided externals remain unchanged.

The Nitro noExternals and serverless copier variants were tested against the same failure and did not remove the duplicate runtime; this fixes the split at the Vite boundary.

Verification

• Exact pinned Netlify Design build (NITRO_PRESET=netlify) completed successfully.
• The built function output contains exactly one file with useLocation() may be used only in the context of a <Router>: _chunks/server4.mjs.
• Direct invocation of the built server handler for GET /design/abc returned 200 HTML with no Router-context error.
• Focused Vite SSR-graph regression test passed.
• pnpm guards: all 77 checks passed.
• Re-recorded the Analytics and @agent-native/docs entries in scripts/serverless-function-baseline.json with the guard's --update; the intended unified SSR graph is the shipped runtime and the PR preview size guard now measures it.

The broad local deploy spec is currently unable to resolve h3 from its generated /tmp worker module; it fails before exercising this change.

[github-actions]

Here's a visual recap of what changed:

Open the full interactive recap

[builder-io-integration]

Builder reviewed your changes and found 1 potential issue 🟡

Review Details

Code Review Summary

This incremental update preserves the intended single SSR module graph by removing production externalization for Core and the React singleton packages and by applying the Core source alias during builds. The focused test and build claims are directionally consistent with that goal, and the diff remains narrowly scoped. However, the production alias change also affects bare @agent-native/core imports in server/action graphs, not only the route/client entries that need singleton unification.

Key Finding

• 🟡 MEDIUM — Applying getCoreSourceAliases() during production builds maps bare @agent-native/core to the browser barrel. That can pull the React client surface into serverless action graphs instead of preserving the package's Node/default entry, contributing to the substantial server bundle increases reflected in the updated baselines. The alias should be scoped by entry/context or bare server imports should remain on the compiled Node export.

This was identified by one of two independent balanced reviews and is sufficiently concrete to warrant fixing because the changed line alters production package entry resolution. The prior review's clean findings were not resubmitted. Risk assessment: standard, due to shared production build and package-resolution behavior.

🧪 Browser testing: Skipped — the PR changes build configuration, tests, release metadata, and serverless bundle baselines; it does not introduce user-facing browser UI behavior.

[builder-io-integration]

🟡 Keep bare Core server imports on the Node entry

getCoreSourceAliases() maps the bare @agent-native/core specifier to src/index.browser.ts (the root entry mapping is defined earlier in this file). Applying these aliases during production builds overrides the package's Node/default export for SSR and action imports, pulling the browser client barrel into serverless graphs; the corresponding server bundle baselines increase substantially. Please scope the alias to route/client entries or preserve the compiled Node entry for bare server imports.

Additional Info

Found by 1 of 2 independent review agents; based on the changed production alias line and getCoreSourceAliases root mapping.