fix(client): ship lib/client.js as the DSH browser bundle, not tsc output

[JosephTian876]

What this fixes

@perrylink/dsh-github@0.7.12 publishes exports["./client"].default — lib/client.js — as the Node-side tsc compile of src/client.ts: ordinary ESM with top-level import/export.

The DSH web shell does not import that file as a module. @deepseek-ai/dsh-client-modules installs it with document.createElement('script') and expects a classic script that hands its factory to window.__ModuleLoader__.load({ id, factory }). The browser therefore throws:

Uncaught SyntaxError: Cannot use import statement outside a module
  @ plugins/??…,@perrylink/dsh-github/client.js,…&rev=…

and because the host concatenates several packages into one combo script per batch, that parse error aborts the whole batch. Every client entry in the batch stays unactivated and the UI reports:

Failed to load plugins
@perrylink/dsh-github
web boot: N entries did not activate

Reproduction

Clean headless Edge against a local DSH 0.1.7-alpha.2, same profile, only the artifact swapped:

	window errors	failing batches	Plugins page
0.7.12 artifact	SyntaxError: Cannot use import statement outside a module ×3	1	Failed to load plugins
this branch	none	0	card mounts

The bytes the host serves for this package are verified byte-identical to the built artifact (modulo the host's own ;\n separator and rewritten sourceMappingURL), and the host's composed source map still carries this bundle's mappings.

The change

pnpm build now emits the browser half in the loader's shape:

window.__ModuleLoader__.load({ id: "@perrylink/dsh-github", factory: (require) => {
"use strict";
var module = { exports: {} };
var exports = module.exports;
// …bundled module…
return module.exports;
} });

• react and @deepseek-ai/dsh-client-ui-primitives stay bare require(...) calls — they are rows of the shell's frozen module table — and everything else is inlined.
• A bare specifier in the shared-runtime families (@deepseek-ai/cordis, @deepseek-ai/dsh-client-*) that is not a table row now fails the build with an actionable message, instead of inlining a second copy of a singleton the shell already holds.

file	role
scripts/client-bundle.mjs	the artifact contract: module-table externals, the registration wrapper, and the checks that prove a produced file has it
scripts/build-client.mjs	the build step, also exposed as pnpm build:client
scripts/prepare.mjs	requires typescript and esbuild before it compiles anything — tsc alone overwrites a good committed lib/client.js with plain ESM — and the no-devDependencies git-install fallback now accepts committed artifacts only when they are a real bundle
scripts/verify-artifacts.mjs, test/client-bundle.test.ts	execute the shipped file the way the shell does: as a classic script, against a stub window.__ModuleLoader__

node --check cannot catch this: the package is "type": "module", so Node parses the file as ESM and the import is legal. Executing it as a classic script reproduces the browser's own SyntaxError — which is what the new guard does, and it fails loudly when the 0.7.12 artifact is put back.

esbuild joins devDependencies. The lockfile gains only its importer row: the package was already resolved there as a vitest dependency, and pnpm-workspace.yaml already allowlists its postinstall, so no workspace-config change is needed.

lib/client.js and lib/client.js.map are rebuilt and committed, as this repository already does for every artifact. The cordis plugin face (apply, inject) and the published ./client types are unchanged.

Verification

• pnpm install --frozen-lockfile, typecheck, typecheck:ci, test (189 passed, 3 skipped), test:coverage, lint, build, verify:self-contained, verify:artifacts, pack, check:readmes — all green.
• Build is deterministic; a fresh prepare + build leaves git status clean, so the committed artifact is exactly what the build produces.
• Fault injection: restoring the 0.7.12 artifact makes verify:artifacts, test/client-bundle.test.ts, and prepare (git-install fallback) all fail with the browser's own SyntaxError.
• End-to-end: the packed tarball installed into an isolated DSH profile and driven by headless Edge — 0 window errors, 0 failing batches, card mounted; the same profile with the 0.7.12 artifact reproduces the reported failure.

Follow-up (not in this PR)

lib/types/client.d.ts — the hand-authored published ./client type face — still declares the removed settingsScope member that src/client.ts dropped in 0.7.12.

[JosephTian876]

Rebased onto current main (2111b20, v0.7.15) — the branch is conflict-free again.

The conflicts were all in files this PR replaces:

• CHANGELOG.md — the entry now sits under [Unreleased], above the 0.7.15/0.7.14 sections.
• lib/client.js / lib/client.js.map — these are build artifacts, so I regenerated them with scripts/build-client.mjs rather than merging the text. That matters: the old artifact still carried IconLoadingOutline16, which 0.7.14 removed, so it would have shipped a call to an identifier the current primitives package no longer exports.

Verified on the rebased commit:

• pnpm test — 189 passed, 3 skipped
• pnpm typecheck — clean
• pnpm lint — 0 errors (12 warnings, all pre-existing)
• node scripts/verify-artifacts.mjs — OK
• git merge-tree against main — no conflicts

Meanwhile the defect is still live. Re-measured across published and in-tree artifacts:

ref	top-level import/export	__ModuleLoader__.load
0.7.13	12	0
0.7.14	12	0
0.7.15 (latest)	12	0
current main	12	0

It has now been reported independently in #12 (host 0.1.5-rc.3, market install) — same Failed to load plugins on the next host restart. I hit it on 0.1.7-rc.2, and on a market-managed profile it also comes back after any reinstall or update, because the rollback restores the npm artifact over the local fix.

Nothing about the fix itself changed in the rebase — it just needed to be mergeable again. Happy to adjust if you'd like it split or scoped differently.

[PerryLink]

谢谢提交. 已复核: 产物 sha256 一致, main 仍复现 (ModuleLoader 为 0), 冲突仅 CHANGELOG.md. 仲裁取这条: external 共享运行时更稳, 不带第二份单例. 席位让 #14 收窄, settingsScope 我来补. 要我接手也行.