chore(deps): migrate frontend to cucumber ESM (gherkin 40, messages 33) — browser-fixed

[tdjager]

What

Re-applies the cucumber major bump reverted in #820, this time with the browser-runtime fix:

• @cucumber/gherkin 39.1.0 → 40.0.0
• @cucumber/messages 32.3.1 → 33.0.2

The bug that took down the editor (and how this fixes it)

@cucumber/messages 33 (pure ESM) runs this at import time (dist/version.js):

import { createRequire } from 'node:module';
export const version = createRequire(import.meta.url)('../package.json').version;

createRequire is a Node-only API. In the browser the bundler stubs node:module to an empty object, so the call threw TypeError: createRequire is not a function — crashing every view that imports the gherkin parser (src/gherkin/parser.js), i.e. the entire editor (blank /editor/*). The first attempt (#818) shipped this because the only verification was Node-based vitest, where createRequire exists.

Fix: alias node:module to a tiny browser shim (src/shims/node-module.js) that provides a harmless createRequire (we don't use the version string). Scoped to the build only via process.env.VITEST, so Node-based vitest keeps the real module. Also re-adds test.server.deps.inline: [/@cucumber\//] for the vmThreads pool ("Linked modules must use the same context").

Verification — in a real browser this time

• vite build succeeds; createRequire no longer present in any built asset.
• Served the built dist via vite preview → /editor mounts (was blank <!---->), zero createRequire errors.
• Dev server + import('/src/gherkin/parser.js') → parseFeature(...) parses feature name, scenario, and all 4 steps correctly under gherkin 40 / messages 33.
• npx vitest run src/gherkin/ → 30 pass. npm audit → 0 vulnerabilities. markdown-it 14.2.0 override retained.

Custom config reported (per CLAUDE.md)

No custom CSS. Two build-config additions: the node:module resolve alias (browser shim) and the vitest deps.inline for @cucumber/*. Both are dependency-compat shims, not UI changes.

Note

Draft — not auto-merging. Given the prior incident, I'd suggest a browser smoke-test on the PR preview deployment before merge.

[github-actions]

Preview Deployment — editor — editor

Your changes have been deployed to a preview environment:

URL: https://editor.pr821.rig.prd1.gn2.quattro.rijksapps.nl

This deployment will be automatically cleaned up when the PR is closed.