oj v0.2.24

Fixed

• A dependency that ships raw TypeScript (an exports map pointing straight at .ts/.tsx sources) now renders under dev SSR and TanStack Start dev instead of 500ing with ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING. The runtime refuses to strip types under node_modules, and Vite never externalizes a resolved file it cannot hand to Node (canExternalizeFile allows only js/mjs/cjs), so the Start and SSR module hosts now route TypeScript/JSX dependency files through the transform pipeline, the way ssr.noExternal dependencies already go.
• SSR builds apply the same rule: externalization now resolves a dependency first (Vite's isExternalizable), so one whose resolved file is raw TypeScript/JSX bundles into the server bundle — even when ssr.external names its package — instead of surviving as a bare import that fails the prerender or the built server with the same error. An id listed verbatim in ssr.external is still forced external without the check, exactly as in Vite.
• A .env value can no longer grow without bound through $ references: a doubling chain (B=$A$A, C=$B$B, ...) made a 1KB file demand gigabytes and take the dev server down (dotenv-expand has the same hole). The bytes a value gains through references are capped at 128KB with a warning; literal values of any size are untouched.
• JSON modules no longer emit a named export that cannot bind (export const arguments from an {"arguments": ...} key is a strict-mode syntax error, as are the module's own internal binding and eval, reserved words, Infinity/NaN/globalThis/undefined). The filter is the one Vite 8's JSON plugin (rolldown's dataToEsm port) applies, so plain globals like Object keep their named export.
• %KEY% placeholders in index.html now consume exactly as Vite's /%(\S+?)%/g does. A placeholder whose key is not in the env is skipped whole, so its closing % no longer opens the next match (%UNKNOWN%KNOWN% passes through where oj used to substitute the second key), and a % straight after an opener is key content, so %%T%% passes through instead of becoming %<value>%.
• The compiler reports checked early errors (a private field used outside a class, with in a module, a duplicate let binding) instead of emitting them. The grammar alone accepts these, and TypeScript strip could then produce output no JavaScript parser accepts: 00.#y in a .ts file compiled to 0.#y, which the browser refuses. esbuild rejects the same inputs, so these files already failed under Vite. Where oxc leaves a check to tsc (++eval in a module, import as a JSX tag object lowering to the invalid import.met), the compiler now also validates that the emitted TypeScript/JSX output parses as the module it is served as, and reports a compile error instead of shipping a bare browser SyntaxError. Found by the revived nightly fuzz targets, which now run on the stable toolchain with the sanitizer off.