fix: include package.json in SSR function files to resolve ESM import…

apps/admin/netlify.toml

@@ -7,8 +7,21 @@
 
 # See apps/dashboard/netlify.toml for why this exists — a real, confirmed
 # bug from an actual authenticated deploy (ROADMAP.md #4/#13).
+#
+# `.../ssr/package.json` added here for the same underlying reason:
+# Netlify's function packager only zips up what it can statically trace
+# from ssr.mjs's imports, PLUS whatever included_files explicitly lists —
+# the plain `package.json` (`{"type":"module"}`) adapter-netlify writes
+# into the function directory, to make Node treat dist/server/**/*.js as
+# real ESM instead of defaulting to CommonJS, is neither imported nor
+# previously listed here, so it never reached the deployed function at
+# all despite existing in every local build — confirmed via a real deploy
+# still throwing "Cannot use import statement outside a module" even
+# after that fix landed. Same root cause as the rest of this list: a file
+# read at runtime, not statically imported, is invisible to the tracer
+# unless named here explicitly.
 [functions.ssr]
-  included_files = ["netlify/functions/ssr/routes/**", "netlify/functions/ssr/api/**", "netlify/functions/ssr/dist/**"]
+  included_files = ["netlify/functions/ssr/routes/**", "netlify/functions/ssr/api/**", "netlify/functions/ssr/dist/**", "netlify/functions/ssr/package.json"]
 
 [[redirects]]
   from = "/*"

apps/dashboard/netlify.toml

@@ -11,8 +11,17 @@
 # can trace from ssr.mjs's static imports; routes/ and dist/server/ are
 # read at runtime via fs.readdirSync/dynamic import(), invisible to that
 # tracer. See ROADMAP.md #4/#13's "real live deploy" account.
+#
+# `.../ssr/package.json` added for the identical reason, found the same
+# way (a real live deploy, this time on apps/admin — still throwing
+# "Cannot use import statement outside a module" even after adapter-netlify
+# was fixed to write that file): the file exists in every local build, but
+# was neither imported nor listed here, so the tracer never included it in
+# the deployed function either. Anything read at runtime instead of
+# statically imported has to be named in this list explicitly — no
+# exceptions, package.json included.
 [functions.ssr]
-  included_files = ["netlify/functions/ssr/routes/**", "netlify/functions/ssr/api/**", "netlify/functions/ssr/dist/**"]
+  included_files = ["netlify/functions/ssr/routes/**", "netlify/functions/ssr/api/**", "netlify/functions/ssr/dist/**", "netlify/functions/ssr/package.json"]
 
 [[redirects]]
   from = "/*"

apps/marketing/netlify.toml

@@ -18,8 +18,15 @@
 # can trace from ssr.mjs's static imports; routes/ and dist/server/ are
 # read at runtime via fs.readdirSync/dynamic import(), invisible to that
 # tracer. See ROADMAP.md #4/#13's "real live deploy" account.
+#
+# `.../ssr/package.json` added for the identical reason — see
+# apps/dashboard/netlify.toml's copy of this comment for the full account
+# (found via a real live deploy of apps/admin, not this app, since
+# marketing's "ssg" render mode never invokes the function for its own
+# homepage — but the same bug applies here the moment any route here uses
+# ssr/isr/csr).
 [functions.ssr]
-  included_files = ["netlify/functions/ssr/routes/**", "netlify/functions/ssr/api/**", "netlify/functions/ssr/dist/**"]
+  included_files = ["netlify/functions/ssr/routes/**", "netlify/functions/ssr/api/**", "netlify/functions/ssr/dist/**", "netlify/functions/ssr/package.json"]
 
 [[redirects]]
   from = "/*"

packages/cli/dist/index.js

@@ -5372,7 +5372,7 @@ hydrateCsrRoutes();
   functions = "netlify/functions"
 
 [functions.ssr]
-  included_files = ["netlify/functions/ssr/routes/**", "netlify/functions/ssr/api/**", "netlify/functions/ssr/dist/**"]
+  included_files = ["netlify/functions/ssr/routes/**", "netlify/functions/ssr/api/**", "netlify/functions/ssr/dist/**", "netlify/functions/ssr/package.json"]
 
 [[redirects]]
   from = "/*"

packages/scaffold/src/scaffoldAppFiles.ts

@@ -274,8 +274,18 @@ export async function scaffoldAppFiles(appDir: string, appName: string, opts: Sc
       // can't see it" case (the same class of problem Vercel's own tracer
       // had with react/react-dom, ROADMAP.md #4, just missing here for a
       // different reason).
+      //
+      // `.../ssr/package.json` in the list too — a second, later real bug:
+      // adapter-netlify writes a plain package.json (`{"type":"module"}`)
+      // straight into the function directory so Node treats the ESM
+      // dist/server/**/*.js output as real ESM instead of defaulting to
+      // CommonJS. That file is neither statically imported nor previously
+      // listed here either, so it hit the exact same "invisible to the
+      // tracer" problem as routes/api/dist above — confirmed via a real
+      // live deploy still throwing "Cannot use import statement outside a
+      // module" even after adapter-netlify was fixed to write it.
       `[functions.ssr]\n` +
-      `  included_files = ["netlify/functions/ssr/routes/**", "netlify/functions/ssr/api/**", "netlify/functions/ssr/dist/**"]\n\n` +
+      `  included_files = ["netlify/functions/ssr/routes/**", "netlify/functions/ssr/api/**", "netlify/functions/ssr/dist/**", "netlify/functions/ssr/package.json"]\n\n` +
       `[[redirects]]\n` +
       `  from = "/*"\n` +
       `  to = "/.netlify/functions/ssr"\n` +