fix: bundle dev plugins whose dependencies only declare main or touch node builtins

lib/admin/__tests__/plugin-dev.test.ts

@@ -1,3 +1,4 @@
+// @vitest-environment node
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import path from 'node:path';
@@ -46,6 +47,23 @@ describe('dev plugins', () => {
     expect(await getEnabledPluginFrameOrigins()).toContain('https://video.example.com');
   });
 
+  it('bundles src/ with packages that only declare main and touch Node builtins', async () => {
+    // Shaped like asn1js (no "exports") and asmcrypto (require('crypto')
+    // behind a runtime check), which the S/MIME plugin pulls in.
+    await devPlugin('deps', { ...BASE, id: 'deps' }, {
+      'src/index.js': "import { value } from 'legacy-pkg';\nexport default value;",
+      'node_modules/legacy-pkg/package.json': JSON.stringify({ name: 'legacy-pkg', main: 'lib/main.js' }),
+      'node_modules/legacy-pkg/lib/main.js':
+        "exports.value = typeof process !== 'undefined' && process.versions?.node ? require('crypto') : 42;",
+    });
+    const { listDevPlugins, readDevBundle } = await import('../plugin-dev');
+
+    const [entry] = await listDevPlugins();
+
+    expect(entry?.plugin.id).toBe('deps');
+    expect(await readDevBundle(entry)).not.toContain('esbuild failed');
+  });
+
   it('refuses an entrypoint outside the plugin folder', async () => {
     // The bundle route serves the file without a session.
     await writeFile(path.join(dir, 'secret.js'), 'TOP SECRET');