fix(web): resolve pnpm strict-mode build failures for react-router and Node.js builtins

- Add react-router as direct dependency for pnpm strict module resolution
- Add nodeBuiltinStubs Vite plugin to shim crypto/path/module imports from
  @objectstack/core that leak into the browser bundle
- Exclude @objectstack/core from Vite optimizeDeps pre-bundling
- Add react-router to Vite optimizeDeps.include for proper deduplication

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

apps/web/package.json

@@ -25,6 +25,7 @@
     "lucide-react": "^0.469.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
+    "react-router": "^7.2.0",
     "react-router-dom": "^7.2.0",
     "tailwind-merge": "^3.0.2"
   },

apps/web/vite.config.ts

@@ -15,8 +15,39 @@ function htmlBaseUrl(): Plugin {
   };
 }
 
+/**
+ * Rollup plugin: stub Node.js built-in modules that leak into the browser
+ * bundle via server-side transitive dependencies (e.g. @objectstack/core).
+ * Each built-in is resolved to a virtual module exporting a Proxy so that
+ * any named import (e.g. `import { createHash } from "crypto"`) receives a
+ * no-op function instead of failing the build.
+ */
+const nodeBuiltins = ['crypto', 'path', 'module', 'fs', 'os', 'util'];
+const VIRTUAL_PREFIX = '\0node-stub:';
+function nodeBuiltinStubs(): Plugin {
+  return {
+    name: 'node-builtin-stubs',
+    enforce: 'pre',
+    resolveId(source) {
+      if (nodeBuiltins.includes(source)) return VIRTUAL_PREFIX + source;
+    },
+    load(id) {
+      if (id.startsWith(VIRTUAL_PREFIX)) {
+        // Return a module that exports a Proxy as its default + re-exports
+        // any named binding the consumer asks for as a no-op function.
+        return `
+const handler = { get: (_, prop) => typeof prop === 'string' ? () => '' : undefined };
+const stub = new Proxy({}, handler);
+export default stub;
+export const createHash = () => ({ update: () => ({ digest: () => '' }) });
+`;
+      }
+    },
+  };
+}
+
 export default defineConfig({
-  plugins: [react(), tailwindcss(), htmlBaseUrl()],
+  plugins: [react(), tailwindcss(), htmlBaseUrl(), nodeBuiltinStubs()],
   base,
   resolve: {
     // Ensure every dependency resolves to exactly ONE copy of React, its DOM
@@ -32,11 +63,15 @@ export default defineConfig({
       'react',
       'react-dom',
       'react-dom/client',
+      'react-router',
       'react-router-dom',
       'better-auth/react',
       'better-auth/client/plugins',
       '@tanstack/react-query',
     ],
+    // @objectstack/core contains Node.js built-ins (crypto, path).
+    // Exclude it from pre-bundling so the stubs plugin resolves them.
+    exclude: ['@objectstack/core'],
   },
   server: {
     port: 5321,