oj v0.2.10

Fixed

• Client bundles that name a node builtin's exports (import { createHmac } from "crypto" in code shared with the server, the webhook/session-auth shape) build and serve again: the node-builtin shims are CommonJS now, like Vite's browser-external stubs, so a named import interops into an undefined property read instead of failing the bundle with a rolldown MISSING_EXPORT at link time. Production shims are Vite's bare exports object; dev shims use the warning Proxy from Vite's dep optimizer stub, so an exercised access names itself without breaking the page. Bare builtin subpaths (fs/promises, timers/promises, ...) are shimmed too, and, matching Vite's resolution order, an installed package that shares a builtin's name (events, punycode) now wins over the shim.
• Build plugins can spawn workers: node:worker_threads (terser, workbox/vite-plugin-pwa, jest-worker) rides deno_runtime's web workers, and the engine shipped the default worker callback, a process panic ("not implemented: web workers are not supported") that killed oj build for every PWA-enabled project. The engine now provides a real worker factory (recursive, byonm service stack rebuilt per worker thread from the same recipe as the main engine) and gives each worker its main module as bootstrap location, which the worker runtime requires before user code runs ("Invalid URL: 'null'" otherwise). Node resourceLimits are enforced the way Deno CLI enforces them (V8 heap constraints, resolved values readable from the polyfill, a near-heap-limit callback), so a capped worker dies with ERR_WORKER_OUT_OF_MEMORY instead of aborting the whole build, and a worker spawned without limits inherits the engine's own heap cap rather than escaping it. Workers share the parent's SharedArrayBuffer and compiled-wasm stores (Atomics-based pools work), its BroadcastChannel bus, and its blob store, matching Node's process-wide semantics. This was the most common build-failure shape in compatibility testing after 0.2.9.