veryfront 0.1.1127 → 0.1.1132

package/esm/src/rendering/orchestrator/module-collection.js

@@ -17,6 +17,16 @@ export const MODULE_LOAD_HARD_TIMEOUT_MS = 45_000;
 export const DATA_FETCH_TIMEOUT_MS = 15_000;
 /** Timeout for SSR rendering stage */
 export const SSR_RENDER_TIMEOUT_MS = 20_000;
+/**
+ * Human-readable label for the module-loading timeout.
+ *
+ * Falls back to the route pathname when the slug is empty — the index route's
+ * slug is `""`, which otherwise produced a blank timeout label
+ * (`"Module loading for "`) that named no route when a cold load stalled.
+ */
+export function moduleLoadLabel(slug, pathname) {
+    return `Module loading for ${slug || pathname || "unknown route"}`;
+}
 /**
  * Collect modules that need to be loaded for data fetching.
  *

package/esm/src/rendering/orchestrator/pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/orchestrator/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAUH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AASzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA4DhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxE,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,wBAAwB,CAAC;IAC3C,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,qBAAqB,EAAE,sBAAsB,CAAC;CAC1E;AAqCD,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,mBAAmB,CAAgC;gBAE/C,MAAM,EAAE,oBAAoB;IAcxC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,oBAAoB;IA0B5B;;;;OAIG;YACW,yBAAyB;IAWvC;;;OAGG;IACH,gBAAgB,IAAI,IAAI;IAKxB,OAAO,CAAC,UAAU;YAOJ,0BAA0B;IAaxC;;;;;;;;;OASG;YACW,qBAAqB;IAiFnC;;;OAGG;YACW,mBAAmB;IAqHjC,OAAO,CAAC,uBAAuB;IAkCzB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAqU9E,+EAA+E;IACzE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAsHzE,kBAAkB;YA2ClB,cAAc;IAW5B,OAAO,CAAC,uBAAuB;YAYjB,kBAAkB;IA6FhC,OAAO,CAAC,kBAAkB;YAQZ,uBAAuB;IAmBrC;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;CAStB"}
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../../src/src/rendering/orchestrator/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAUH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AASzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA6DhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxE,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,wBAAwB,CAAC;IAC3C,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,OAAO,qBAAqB,EAAE,sBAAsB,CAAC;CAC1E;AAqCD,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,mBAAmB,CAAgC;gBAE/C,MAAM,EAAE,oBAAoB;IAcxC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,oBAAoB;IA0B5B;;;;OAIG;YACW,yBAAyB;IAWvC;;;OAGG;IACH,gBAAgB,IAAI,IAAI;IAKxB,OAAO,CAAC,UAAU;YAOJ,0BAA0B;IAaxC;;;;;;;;;OASG;YACW,qBAAqB;IAiFnC;;;OAGG;YACW,mBAAmB;IAqHjC,OAAO,CAAC,uBAAuB;IAkCzB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAqU9E,+EAA+E;IACzE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAsHzE,kBAAkB;YA2ClB,cAAc;IAW5B,OAAO,CAAC,uBAAuB;YAYjB,kBAAkB;IA6FhC,OAAO,CAAC,kBAAkB;YAQZ,uBAAuB;IAmBrC;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;CAStB"}

package/esm/src/rendering/orchestrator/pipeline.js

@@ -45,7 +45,7 @@ import { determineClientModuleStrategy } from "../rsc/client-module-strategy.js"
 // Extracted modules
 import { EMPTY_LAYOUT_RESULT, isDotPath } from "./path-helpers.js";
 import { cachePageCss, CSS_SSR_TIMEOUT_MS, getCachedPageCss, getPageCssCacheKey, } from "./css-cache.js";
-import { collectModulesToLoad, DATA_FETCH_TIMEOUT_MS, hasDataFetchingFunction, MODULE_LOAD_HARD_TIMEOUT_MS, MODULE_LOAD_TIMEOUT_MS, SSR_RENDER_TIMEOUT_MS, } from "./module-collection.js";
+import { collectModulesToLoad, DATA_FETCH_TIMEOUT_MS, hasDataFetchingFunction, MODULE_LOAD_HARD_TIMEOUT_MS, MODULE_LOAD_TIMEOUT_MS, moduleLoadLabel, SSR_RENDER_TIMEOUT_MS, } from "./module-collection.js";
 const renderPageLog = logger.component("render-page");
 const renderPipelineLog = logger.component("render-pipeline");
 const resolvePageDataLog = logger.component("resolve-page-data");
@@ -251,7 +251,7 @@ export class RenderPipeline {
         const loadedModules = await profilePhase("render.load_modules", () => withSpan(SpanNames.RENDER_LOAD_MODULES, () => withProgressTimeoutThrow((control) => this.loadModulesInParallel(modulesToLoad, options, control), {
             idleTimeoutMs: MODULE_LOAD_TIMEOUT_MS,
             hardTimeoutMs: options.abortSignal ? undefined : MODULE_LOAD_HARD_TIMEOUT_MS,
-            label: `Module loading for ${slug}`,
+            label: moduleLoadLabel(slug, options.url?.pathname ?? ""),
             signal: options.abortSignal,
         }), { "render.module_count": modulesToLoad.length }));
         const dataJobs = loadedModules.filter((m) => options?.staticDataOnly

package/esm/src/routing/api/context-builder.d.ts

@@ -35,6 +35,13 @@ export interface APIContext {
  * behave identically. Handlers must not care which one ran them.
  */
 export declare function createJsonHelper(_request: Request): APIContext["json"];
+/**
+ * Build the `ctx.text` response helper.
+ *
+ * Exported for the isolation Worker so both execution modes share Fetch's
+ * null-body status handling instead of maintaining separate implementations.
+ */
+export declare function createTextHelper(): APIContext["text"];
 /**
  * Build the `ctx.body` request-body reader.
  *

package/esm/src/routing/api/context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-builder.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAI3D,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,QAAQ,CAAC;IACvD;;;;;;OAMG;IACH,IAAI,EAAE,CAAC,CAAC,GAAG,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,QAAQ,CAAC;IACtD,EAAE,EAAE,iBAAiB,CAAC;CACvB;AAgBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAGtE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAiBrE;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,iBAAiB,GACpB,UAAU,CAqBZ;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GACxC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB"}
+{"version":3,"file":"context-builder.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAI3D,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,QAAQ,CAAC;IACvD;;;;;;OAMG;IACH,IAAI,EAAE,CAAC,CAAC,GAAG,OAAO,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,QAAQ,CAAC;IACtD,EAAE,EAAE,iBAAiB,CAAC;CACvB;AA0BD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAGtE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAAC,MAAM,CAAC,CAErD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAiBrE;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,iBAAiB,GACpB,UAAU,CAmBZ;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GACxC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB"}

package/esm/src/routing/api/context-builder.js

@@ -2,8 +2,17 @@ import { parseCookies } from "../../utils/cookie-utils.js";
 import { INVALID_ARGUMENT } from "../../errors/index.js";
 import { flattenRouteParams } from "../flatten-route-params.js";
 export { parseCookies };
+/**
+ * Statuses that the Fetch spec forbids from carrying a body. Constructing
+ * `new Response(body, { status })` with a non-null `body` (an empty string
+ * still counts) throws `Response with null body status cannot have body`, so
+ * the helpers below must send `null` for these.
+ */
+const NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);
 function createResponse(body, contentType, init) {
-    return new Response(body, {
+    const status = init?.status;
+    const hasNullBodyStatus = status !== undefined && NULL_BODY_STATUSES.has(status);
+    return new Response(hasNullBodyStatus ? null : body, {
         ...init,
         headers: {
             "Content-Type": contentType,
@@ -20,6 +29,15 @@ function createResponse(body, contentType, init) {
 export function createJsonHelper(_request) {
     return (data, init) => createResponse(JSON.stringify(data), "application/json", init);
 }
+/**
+ * Build the `ctx.text` response helper.
+ *
+ * Exported for the isolation Worker so both execution modes share Fetch's
+ * null-body status handling instead of maintaining separate implementations.
+ */
+export function createTextHelper() {
+    return (data, init) => createResponse(data, "text/plain", init);
+}
 /**
  * Build the `ctx.body` request-body reader.
  *
@@ -52,7 +70,7 @@ export function createContext(request, match, fs) {
     const url = new URL(request.url);
     const json = createJsonHelper(request);
     const body = createBodyReader(request);
-    const text = (data, init) => createResponse(data, "text/plain", init);
+    const text = createTextHelper();
     return {
         request,
         req: request,

package/esm/src/routing/api/module-loader/external-import-rewriter.d.ts

@@ -1,4 +1,5 @@
 import type { FileSystem } from "../../../platform/compat/fs.js";
+import type { EsmDependencyLocation as RouteEsmDependencyLocation } from "../../../transforms/import-rewriter/route-adapter.js";
 /** Node.js built-in module names — shared across the CJS shim, esbuild externals, and Deno rewrites. */
 export declare const NODE_BUILTINS: readonly ["assert", "buffer", "child_process", "cluster", "console", "constants", "crypto", "dgram", "dns", "events", "fs", "http", "http2", "https", "module", "net", "os", "path", "perf_hooks", "process", "querystring", "readline", "stream", "string_decoder", "timers", "tls", "tty", "url", "util", "v8", "vm", "worker_threads", "zlib"];
 export declare function readProjectDependencies(projectDir: string, fs: FileSystem): Promise<Map<string, string>>;
@@ -15,13 +16,7 @@ export declare function readProjectDependencies(projectDir: string, fs: FileSyst
 export declare function generateCompiledBinaryRequireShim(projectDir: string): string;
 export declare function getNodeExternalPackagesToResolve(userDeps: Map<string, string>): string[];
 export declare function resolveNodePackageToFileUrl(projectDir: string, packageName: string, fs: FileSystem, pathToFileURL: typeof import("node:url").pathToFileURL): Promise<string | null>;
-/** Location of an ESM-only user dependency, used to rewrite imports to real ES module URLs. */
-export interface EsmDependencyLocation {
-    /** file:// URL of the package's ESM entry point. */
-    entryUrl: string;
-    /** Absolute path of the package's root directory (used to contain subpath imports). */
-    packageDir: string;
-}
+export type EsmDependencyLocation = RouteEsmDependencyLocation;
 /**
  * Identify the subset of user dependencies that are ESM-only and resolve each
  * to file:// URLs so the compiled-binary loader can import them as real ES

package/esm/src/routing/api/module-loader/external-import-rewriter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-import-rewriter.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/external-import-rewriter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAUjE,wGAAwG;AACxG,eAAO,MAAM,aAAa,mVAkChB,CAAC;AAEX,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAS9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+E5E;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAUxF;AAED,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,cAAc,UAAU,EAAE,aAAa,GACrD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxB;AAED,+FAA+F;AAC/F,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,UAAU,EAAE,MAAM,CAAC;CACpB;AAoCD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAmC7C;AAED,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAW9C;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA+DjB;AAED,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB1E;AAED,wBAAgB,0CAA0C,CACxD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,GAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAa,GACtD,MAAM,CAgGR;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBlE;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa,GACxC,OAAO,CAAC,MAAM,CAAC,CAmCjB"}
+{"version":3,"file":"external-import-rewriter.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/external-import-rewriter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAejE,OAAO,KAAK,EACV,qBAAqB,IAAI,0BAA0B,EACpD,MAAM,sDAAsD,CAAC;AAK9D,wGAAwG;AACxG,eAAO,MAAM,aAAa,mVAAsB,CAAC;AAEjD,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAE9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+E5E;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAExF;AAED,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,cAAc,UAAU,EAAE,aAAa,GACrD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxB;AAED,MAAM,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAE/D;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAE7C;AAED,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAW9C;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA+DjB;AAED,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,0CAA0C,CACxD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,GAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAa,GACtD,MAAM,CAER;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa,GACxC,OAAO,CAAC,MAAM,CAAC,CAmCjB"}

package/esm/src/routing/api/module-loader/external-import-rewriter.js

@@ -3,55 +3,13 @@ import * as pathHelper from "../../../platform/compat/path/index.js";
 import { isDeno, isNode } from "../../../platform/compat/runtime.js";
 import { rewriteNpmImports } from "../../../transforms/npm-import-rewrites.js";
 import { parseImports, replaceSpecifiers } from "../../../transforms/esm/lexer.js";
-import { isWithinDirectory } from "../../../security/path-validation.js";
-import { resolveExportEntry, toCjsDestructureBindings } from "./loader-helpers.js";
+import { getNodeExternalPackagesToResolveForRoute, NODE_BUILTINS as ROUTE_NODE_BUILTINS, readProjectDependenciesForRoute, resolveEsmUserDependenciesForRoute, rewriteCompiledUserDependencyImportsForRoute, rewriteCompiledVeryfrontImportsForRoute, rewriteDenoNodeBuiltinsForRoute, rewriteDenoNpmDependencyImportsForRoute, } from "../../../transforms/import-rewriter/route-adapter.js";
+import { resolveExportEntry } from "./loader-helpers.js";
 const logger = serverLogger.component("api");
 /** Node.js built-in module names — shared across the CJS shim, esbuild externals, and Deno rewrites. */
-export const NODE_BUILTINS = [
-    "assert",
-    "buffer",
-    "child_process",
-    "cluster",
-    "console",
-    "constants",
-    "crypto",
-    "dgram",
-    "dns",
-    "events",
-    "fs",
-    "http",
-    "http2",
-    "https",
-    "module",
-    "net",
-    "os",
-    "path",
-    "perf_hooks",
-    "process",
-    "querystring",
-    "readline",
-    "stream",
-    "string_decoder",
-    "timers",
-    "tls",
-    "tty",
-    "url",
-    "util",
-    "v8",
-    "vm",
-    "worker_threads",
-    "zlib",
-];
+export const NODE_BUILTINS = ROUTE_NODE_BUILTINS;
 export async function readProjectDependencies(projectDir, fs) {
-    try {
-        const content = await fs.readTextFile(pathHelper.join(projectDir, "package.json"));
-        const pkg = JSON.parse(content);
-        return new Map(Object.entries(pkg.dependencies ?? {}));
-    }
-    catch (_) {
-        /* expected: package.json may not exist */
-        return new Map();
-    }
+    return await readProjectDependenciesForRoute(projectDir, fs);
 }
 /**
  * Generates a CJS module loader shim for compiled Deno binaries.
@@ -143,13 +101,7 @@ require.ensure = function(mods, cb) { cb(); };
 `.trim();
 }
 export function getNodeExternalPackagesToResolve(userDeps) {
-    const externalPackagesToResolve = ["zod"];
-    for (const name of userDeps.keys()) {
-        if (!externalPackagesToResolve.includes(name)) {
-            externalPackagesToResolve.push(name);
-        }
-    }
-    return externalPackagesToResolve;
+    return getNodeExternalPackagesToResolveForRoute(userDeps);
 }
 export async function resolveNodePackageToFileUrl(projectDir, packageName, fs, pathToFileURL) {
     const packagePath = pathHelper.join(projectDir, "node_modules", packageName);
@@ -170,42 +122,6 @@ export async function resolveNodePackageToFileUrl(projectDir, packageName, fs, p
         return null;
     }
 }
-/**
- * Decide whether an installed package must be loaded as a real ES module.
- *
- * ESM-only packages (e.g. `"type": "module"` packages that use `import.meta` or
- * top-level await) cannot be evaluated as CommonJS via the compiled-binary
- * `new Function` shim. We treat a package as ESM when its package.json declares
- * `"type": "module"` or its resolved entry point is a `.mjs` file.
- */
-function isEsmPackage(pkgJson, entry) {
-    if (pkgJson.type === "module")
-        return true;
-    return entry.endsWith(".mjs");
-}
-/**
- * Resolve a package's ESM entry point, preferring the conditional `import`
- * export, then the `module` field, then `main`.
- */
-function resolveEsmEntry(pkgJson) {
-    const exportsField = pkgJson.exports;
-    if (exportsField && typeof exportsField === "object") {
-        const dot = exportsField["."];
-        const fromExports = resolveExportEntry(dot ?? exportsField);
-        if (fromExports)
-            return fromExports;
-    }
-    else if (typeof exportsField === "string") {
-        return exportsField;
-    }
-    const moduleField = pkgJson.module;
-    if (typeof moduleField === "string")
-        return moduleField;
-    const mainField = pkgJson.main;
-    if (typeof mainField === "string")
-        return mainField;
-    return "index.js";
-}
 /**
  * Identify the subset of user dependencies that are ESM-only and resolve each
  * to file:// URLs so the compiled-binary loader can import them as real ES
@@ -213,35 +129,7 @@ function resolveEsmEntry(pkgJson) {
  * and continue to load through the `createRequire`-based shim.
  */
 export async function resolveEsmUserDependencies(projectDir, fs, userDeps) {
-    const esmDeps = new Map();
-    for (const name of userDeps.keys()) {
-        const packageDir = pathHelper.resolve(pathHelper.join(projectDir, "node_modules", name));
-        try {
-            const pkgJson = JSON.parse(await fs.readTextFile(pathHelper.join(packageDir, "package.json")));
-            const entry = resolveEsmEntry(pkgJson);
-            if (!entry || !isEsmPackage(pkgJson, entry))
-                continue;
-            // The entry path comes from the dependency's own package.json, which is
-            // attacker-influenceable (a malicious/compromised package could set
-            // "main": "../../../etc/passwd"). Reject entries that resolve outside the
-            // package directory so a crafted package.json cannot turn into a file://
-            // import that escapes node_modules. This mirrors the containment guard the
-            // CJS loader shim enforces via __vf_assertContained.
-            const entryPath = pathHelper.resolve(pathHelper.join(packageDir, entry));
-            if (!isWithinDirectory(packageDir, entryPath)) {
-                logger.warn(`Skipping ESM dependency ${name}: entry escapes package directory (${entry})`);
-                continue;
-            }
-            esmDeps.set(name, {
-                entryUrl: pathHelper.toFileUrl(entryPath).href,
-                packageDir,
-            });
-        }
-        catch (_) {
-            /* expected: package.json missing/invalid → treat as CJS */
-        }
-    }
-    return esmDeps;
+    return await resolveEsmUserDependenciesForRoute(projectDir, fs, userDeps);
 }
 export async function loadVeryfrontExportsMap(projectDir, fs) {
     const vfPackagePath = pathHelper.join(projectDir, "node_modules", "veryfront");
@@ -310,103 +198,16 @@ export async function rewriteNodeExternalImports(code, projectDir, fs, userDeps)
     return await replaceSpecifiers(code, (specifier) => replacements.get(specifier));
 }
 export function rewriteCompiledBinaryVeryfrontImports(code) {
-    let transformed = code;
-    transformed = transformed.replace(/from\s+["']veryfront["']/g, 'from "./_vf_runtime.mjs"');
-    transformed = transformed.replace(/import\s*\(\s*["']veryfront["']\s*\)/g, 'import("./_vf_runtime.mjs")');
-    transformed = transformed.replace(/from\s+["']veryfront\/([^"']+)["']/g, (_match, subpath) => `from "./_vf_${subpath.replace(/\//g, "_")}.mjs"`);
-    transformed = transformed.replace(/import\s*\(\s*["']veryfront\/([^"']+)["']\s*\)/g, (_match, subpath) => `import("./_vf_${subpath.replace(/\//g, "_")}.mjs")`);
-    return transformed;
+    return rewriteCompiledVeryfrontImportsForRoute(code);
 }
 export function rewriteCompiledBinaryUserDependencyImports(code, userDeps, esmDeps = new Map()) {
-    let transformed = code;
-    for (const name of userDeps.keys()) {
-        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-        // ESM-only dependencies are rewritten to real ES module file:// URLs so that
-        // import.meta, top-level await, etc. work. They must NOT be transpiled to
-        // CommonJS and evaluated via the `new Function` shim (see __vf_loadCjs).
-        const esm = esmDeps.get(name);
-        if (esm) {
-            // Resolve a subpath import to a contained file:// URL. The subpath comes
-            // from the handler source; reject any that escape the package directory
-            // (e.g. "pkg/../../secret") by leaving the import untouched so it fails to
-            // resolve rather than reading outside node_modules.
-            const subpathUrl = (subpath, original) => {
-                const target = pathHelper.resolve(pathHelper.join(esm.packageDir, subpath));
-                if (!isWithinDirectory(esm.packageDir, target)) {
-                    logger.warn(`Skipping ESM subpath import that escapes package directory: ${original}`);
-                    return null;
-                }
-                return pathHelper.toFileUrl(target).href;
-            };
-            transformed = transformed.replace(new RegExp(`from\\s+["']${escaped}(/[^"']+)["']`, "g"), (match, subpath) => {
-                const url = subpathUrl(subpath, match);
-                return url ? `from "${url}"` : match;
-            });
-            transformed = transformed.replace(new RegExp(`from\\s+["']${escaped}["']`, "g"), () => `from "${esm.entryUrl}"`);
-            transformed = transformed.replace(new RegExp(`import\\s*\\(\\s*["']${escaped}(/[^"']+)["']\\s*\\)`, "g"), (match, subpath) => {
-                const url = subpathUrl(subpath, match);
-                return url ? `import("${url}")` : match;
-            });
-            transformed = transformed.replace(new RegExp(`import\\s*\\(\\s*["']${escaped}["']\\s*\\)`, "g"), () => `import("${esm.entryUrl}")`);
-            continue;
-        }
-        transformed = transformed.replace(new RegExp(`import\\s+(\\w+)\\s+from\\s+["']${escaped}["']`, "g"), (_, localName) => `const ${localName} = __vf_interopDefault(require("${name}"))`);
-        transformed = transformed.replace(new RegExp(`import\\s+(\\{[^}]+\\})\\s+from\\s+["']${escaped}["']`, "g"), (_, bindings) => `const ${toCjsDestructureBindings(bindings)} = require("${name}")`);
-        transformed = transformed.replace(new RegExp(`import\\s+\\*\\s+as\\s+(\\w+)\\s+from\\s+["']${escaped}["']`, "g"), (_, localName) => `const ${localName} = require("${name}")`);
-        transformed = transformed.replace(new RegExp(`import\\s+(\\w+)\\s*,\\s*(\\{[^}]+\\})\\s+from\\s+["']${escaped}["']`, "g"), (_, defaultName, bindings) => {
-            const tmp = `__vf_tmp_${defaultName}`;
-            return `const ${tmp} = require("${name}"); const ${defaultName} = __vf_interopDefault(${tmp}); const ${toCjsDestructureBindings(bindings)} = ${tmp}`;
-        });
-        transformed = transformed.replace(new RegExp(`import\\s+(\\w+|\\*\\s+as\\s+\\w+|\\{[^}]+\\})\\s+from\\s+["']${escaped}(/[^"']+)["']`, "g"), (_, binding, subpath) => {
-            const trimmedBinding = String(binding).trim();
-            if (trimmedBinding.startsWith("{")) {
-                return `const ${toCjsDestructureBindings(trimmedBinding)} = require("${name}${subpath}")`;
-            }
-            const name_ = trimmedBinding.startsWith("*")
-                ? trimmedBinding.replace(/\*\s+as\s+/, "")
-                : trimmedBinding;
-            return `const ${name_} = require("${name}${subpath}")`;
-        });
-        transformed = transformed.replace(new RegExp(`import\\s*\\(\\s*["']${escaped}(/[^"']*)?["']\\s*\\)`, "g"), (_, subpath) => `Promise.resolve(require("${name}${subpath || ""}"))`);
-    }
-    return transformed;
+    return rewriteCompiledUserDependencyImportsForRoute(code, userDeps, esmDeps);
 }
 export async function rewriteDenoNpmDependencyImports(code, projectDir, fs, userDeps) {
-    const importedSpecifiers = new Set((await parseImports(code))
-        .map((imp) => imp.n)
-        .filter((specifier) => typeof specifier === "string"));
-    const replacements = new Map();
-    for (const specifier of importedSpecifiers) {
-        const entry = [...userDeps].find(([name]) => specifier === name || specifier.startsWith(`${name}/`));
-        if (!entry)
-            continue;
-        const [name, version] = entry;
-        let resolvedVersion = version;
-        try {
-            const pkgPath = pathHelper.join(projectDir, "node_modules", name, "package.json");
-            const pkgContent = await fs.readTextFile(pkgPath);
-            const pkg = JSON.parse(pkgContent);
-            if (pkg.version)
-                resolvedVersion = pkg.version;
-        }
-        catch (_) {
-            /* expected: installed package.json may not exist, fall back to declared range */
-        }
-        const subpath = specifier.slice(name.length);
-        replacements.set(specifier, `npm:${name}@${resolvedVersion}${subpath}`);
-    }
-    if (replacements.size === 0)
-        return code;
-    return await replaceSpecifiers(code, (specifier) => replacements.get(specifier));
+    return await rewriteDenoNpmDependencyImportsForRoute(code, projectDir, fs, userDeps);
 }
 export function rewriteDenoNodeBuiltinImports(code) {
-    let transformed = code;
-    for (const mod of NODE_BUILTINS) {
-        const escaped = mod.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-        transformed = transformed.replace(new RegExp(`from\\s+["']${escaped}["']`, "g"), `from "node:${mod}"`);
-        transformed = transformed.replace(new RegExp(`import\\s*\\(\\s*["']${escaped}["']\\s*\\)`, "g"), `import("node:${mod}")`);
-    }
-    return transformed;
+    return rewriteDenoNodeBuiltinsForRoute(code);
 }
 export async function rewriteExternalImports(code, projectDir, fs, userDeps = new Map()) {
     let transformed = code;

package/esm/src/server/dev-server/file-watch-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-watch-setup.d.ts","sourceRoot":"","sources":["../../../../src/src/server/dev-server/file-watch-setup.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AA4E3D;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMhF;AAED,qBAAa,cAAc;IAUvB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,iBAAiB;IACzB,OAAO,CAAC,oBAAoB,CAAC;IAd/B,OAAO,CAAC,WAAW,CAAC,CAAoB;IACxC,OAAO,CAAC,iBAAiB,CAAC,CAAkB;IAC5C,OAAO,CAAC,gBAAgB,CAAC,CAAuB;IAChD,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,aAAa,CAAc;IACnC,uEAAuE;IACvE,OAAO,CAAC,aAAa,CAA6B;gBAGxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,MAAM,EAClB,iBAAiB,GAAE,MAAM,IAAe,EACxC,oBAAoB,CAAC,GAAE,MAAM,OAAO,CAAC,IAAI,CAAC,aAAA,EAClD,iBAAiB,CAAC,EAAE,MAAM,EAAE;IAKxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YA8Bd,aAAa;YA2Bb,kBAAkB;YAiClB,gBAAgB;IAkB9B;;;OAGG;IACH,OAAO,CAAC,eAAe;IAMvB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAMzB,8CAA8C;IAC9C,OAAO,CAAC,WAAW;IASnB,6DAA6D;YAC/C,kBAAkB;YAkBlB,wBAAwB;YA6BxB,yBAAyB;IAMvC,UAAU;IAIV,OAAO,IAAI,IAAI;CAYhB"}
+{"version":3,"file":"file-watch-setup.d.ts","sourceRoot":"","sources":["../../../../src/src/server/dev-server/file-watch-setup.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAuF3D;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAItD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMhF;AAED,qBAAa,cAAc;IAUvB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,iBAAiB;IACzB,OAAO,CAAC,oBAAoB,CAAC;IAd/B,OAAO,CAAC,WAAW,CAAC,CAAoB;IACxC,OAAO,CAAC,iBAAiB,CAAC,CAAkB;IAC5C,OAAO,CAAC,gBAAgB,CAAC,CAAuB;IAChD,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,aAAa,CAAc;IACnC,uEAAuE;IACvE,OAAO,CAAC,aAAa,CAA6B;gBAGxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,MAAM,EAClB,iBAAiB,GAAE,MAAM,IAAe,EACxC,oBAAoB,CAAC,GAAE,MAAM,OAAO,CAAC,IAAI,CAAC,aAAA,EAClD,iBAAiB,CAAC,EAAE,MAAM,EAAE;IAKxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YA8Bd,aAAa;YA2Bb,kBAAkB;YAiClB,gBAAgB;IAkB9B;;;OAGG;IACH,OAAO,CAAC,eAAe;IAMvB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAMzB,8CAA8C;IAC9C,OAAO,CAAC,WAAW;IASnB,6DAA6D;YAC/C,kBAAkB;YAkBlB,wBAAwB;YA6BxB,yBAAyB;IAMvC,UAAU;IAIV,OAAO,IAAI,IAAI;CAYhB"}

package/esm/src/server/dev-server/file-watch-setup.js

@@ -43,6 +43,11 @@ const IGNORED_PATH_PATTERNS = [
  * would wrongly suppress legitimate updates.
  */
 const IGNORED_ARTIFACT_EXTENSIONS = new Set([".log", ".tmp"]);
+/**
+ * Generated file names written at project root during dev-server request
+ * handling. These files are not source and must not trigger HMR.
+ */
+const TRANSIENT_MIDDLEWARE_MODULE_RE = /^\.vf-middleware-.+\.mjs$/;
 /**
  * Project-root directory names that contain runtime data (not source code)
  * and should be excluded from HMR. Matched by first path segment relative
@@ -69,6 +74,10 @@ function hasIgnoredArtifactExtension(path) {
     }
     return false;
 }
+function hasIgnoredArtifactFileName(path) {
+    const fileName = path.split(/[\\/]/).at(-1)?.toLowerCase() ?? "";
+    return TRANSIENT_MIDDLEWARE_MODULE_RE.test(fileName);
+}
 /**
  * Check if a path should be ignored for HMR purposes — either because it lives
  * in a generated/output directory or because it is a generated-artifact file.
@@ -77,7 +86,8 @@ function hasIgnoredArtifactExtension(path) {
  */
 export function shouldIgnorePath(path) {
     return IGNORED_PATH_PATTERNS.some((pattern) => path.includes(pattern)) ||
-        hasIgnoredArtifactExtension(path);
+        hasIgnoredArtifactExtension(path) ||
+        hasIgnoredArtifactFileName(path);
 }
 /**
  * Whether a path lives inside a generated build-output directory, evaluated

package/esm/src/server/dev-server/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../../src/src/server/dev-server/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAGtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAM7D,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEnD,UAAU,qBAAqB;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAkFD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAkC/B;AAgJD,wBAAsB,eAAe,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,eAAe,EACvB,cAAc,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAClD,OAAO,CAAC,IAAI,CAAC,CASf"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../../src/src/server/dev-server/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAGtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAM7D,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEnD,UAAU,qBAAqB;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAkFD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAqC/B;AA2LD,wBAAsB,eAAe,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,eAAe,EACvB,cAAc,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAClD,OAAO,CAAC,IAAI,CAAC,CASf"}

package/esm/src/server/dev-server/middleware.js

@@ -85,12 +85,15 @@ export async function loadMiddlewareFile(projectDir, adapter, options = {}) {
             continue;
         try {
             logger.debug(`Loading ${middlewareFile}`);
-            if (isVirtualFilesystem(adapter.fs)) {
-                return await loadMiddlewareFromVirtualFS(middlewarePath, adapter, options.throwOnError === true, middlewareFile);
-            }
-            const middlewareUrl = `file://${middlewarePath}?t=${Date.now()}-${dntShim.crypto.randomUUID()}`;
-            const middlewareModule = await import(middlewareUrl);
-            return normalizeMiddlewareExport(middlewareModule, options.throwOnError === true, middlewareFile);
+            // Transpile via the embedded esbuild before importing, for both FS kinds.
+            // A `deno compile` binary does not transpile an external on-disk `.ts` at
+            // import time, so a raw `import(middleware.ts)` throws on TS syntax and
+            // takes down every route. The virtual-FS path already transpiled; the
+            // real-FS path now does too (writing the output adjacent to the source so
+            // its bare/relative imports resolve identically to the original file).
+            return isVirtualFilesystem(adapter.fs)
+                ? await loadMiddlewareFromVirtualFS(middlewarePath, adapter, options.throwOnError === true, middlewareFile)
+                : await loadMiddlewareFromRealFS(middlewarePath, adapter, options.throwOnError === true, middlewareFile);
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
@@ -101,10 +104,12 @@ export async function loadMiddlewareFile(projectDir, adapter, options = {}) {
     }
     return [];
 }
-async function loadMiddlewareFromVirtualFS(middlewarePath, adapter, strictExport, sourceFile = "middleware.ts") {
-    const fs = createFileSystem();
-    const content = await adapter.fs.readFile(middlewarePath);
-    const source = typeof content === "string" ? content : new TextDecoder().decode(content);
+/**
+ * Transpile a middleware source file to ESM JavaScript via the embedded esbuild.
+ * A `deno compile` binary cannot transpile an external `.ts` at import time, so
+ * middleware is always transpiled to JS before it is imported.
+ */
+async function transpileMiddlewareSource(source, middlewarePath) {
     const loader = getEsbuildLoader(middlewarePath);
     const { build } = await import("../../extensions/bundler/index.js");
     const result = await build({
@@ -124,7 +129,13 @@ async function loadMiddlewareFromVirtualFS(middlewarePath, adapter, strictExport
     if (firstError) {
         throw COMPILATION_ERROR.create({ detail: `Failed to transpile middleware: ${firstError}` });
     }
-    const js = result.outputFiles?.[0]?.text ?? "export default []";
+    return result.outputFiles?.[0]?.text ?? "export default []";
+}
+async function loadMiddlewareFromVirtualFS(middlewarePath, adapter, strictExport, sourceFile = "middleware.ts") {
+    const fs = createFileSystem();
+    const content = await adapter.fs.readFile(middlewarePath);
+    const source = typeof content === "string" ? content : new TextDecoder().decode(content);
+    const js = await transpileMiddlewareSource(source, middlewarePath);
     const tempDir = await fs.makeTempDir({ prefix: "vf-middleware-" });
     const tempFile = join(tempDir, "middleware.mjs");
     try {
@@ -136,6 +147,29 @@ async function loadMiddlewareFromVirtualFS(middlewarePath, adapter, strictExport
         await fs.remove(tempDir, { recursive: true });
     }
 }
+/**
+ * Load a real-filesystem middleware file. Transpiles to ESM JS and imports the
+ * output from a temp file written ADJACENT to the source, so the middleware's
+ * bare (`veryfront/middleware`) and relative imports resolve exactly as they
+ * would when importing the original file. This is what lets a TypeScript root
+ * `middleware.ts` load under the compiled binary, where a raw `import()` of a
+ * `.ts` is not transpiled by the `deno compile` runtime.
+ */
+async function loadMiddlewareFromRealFS(middlewarePath, adapter, strictExport, sourceFile = "middleware.ts") {
+    const fs = createFileSystem();
+    const content = await adapter.fs.readFile(middlewarePath);
+    const source = typeof content === "string" ? content : new TextDecoder().decode(content);
+    const js = await transpileMiddlewareSource(source, middlewarePath);
+    const tempFile = join(dirname(middlewarePath), `.vf-middleware-${dntShim.crypto.randomUUID()}.mjs`);
+    try {
+        await fs.writeTextFile(tempFile, js);
+        const middlewareModule = await import(`file://${tempFile}?v=${Date.now()}`);
+        return normalizeMiddlewareExport(middlewareModule, strictExport, sourceFile);
+    }
+    finally {
+        await fs.remove(tempFile).catch(() => { });
+    }
+}
 /** Describe the shape of the default export that was rejected. */
 function describeDefaultExport(exported) {
     if (Array.isArray(exported)) {

package/esm/src/server/handlers/dev/files/esbuild-plugins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-plugins.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/files/esbuild-plugins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA6B,MAAM,EAAe,MAAM,yCAAyC,CAAC;AAG9G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAS5E,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,sCAAsC,CAAC;AAgC9C,MAAM,WAAW,uBAAuB;IACtC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AASD,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAE5E,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,uBAAuB,CAAC,CAmClC;AAoBD,gFAAgF;AAChF,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,uBAA4B,GACpC,MAAM,CA2KR;AAKD,UAAU,yBAAyB;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AA+DD,kFAAkF;AAClF,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,yBAAyB,GAAG,OAAe,GACnD,MAAM,CAqER;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAUjD"}
+{"version":3,"file":"esbuild-plugins.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/files/esbuild-plugins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA6B,MAAM,EAAe,MAAM,yCAAyC,CAAC;AAG9G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAS5E,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,sCAAsC,CAAC;AAgC9C,MAAM,WAAW,uBAAuB;IACtC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AASD,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAE5E,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,uBAAuB,CAAC,CAmClC;AAoBD,gFAAgF;AAChF,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,uBAA4B,GACpC,MAAM,CA2KR;AAKD,UAAU,yBAAyB;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAuED,kFAAkF;AAClF,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,yBAAyB,GAAG,OAAe,GACnD,MAAM,CAqFR;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAUjD"}

package/esm/src/server/handlers/dev/files/esbuild-plugins.js

@@ -236,6 +236,13 @@ function isBareImport(path) {
         !path.startsWith("http://") &&
         !path.startsWith("https://"));
 }
+/**
+ * A Node built-in module specifier (`node:crypto`, `node:fs`, …). These are
+ * server-only and must never be rewritten to an esm.sh URL for a browser bundle.
+ */
+function isNodeBuiltinSpecifier(path) {
+    return path === "node" || path.startsWith("node:");
+}
 function toEsmUrl(path) {
     return ESM_PACKAGE_MAP[path] ?? `https://esm.sh/${path}`;
 }
@@ -292,6 +299,21 @@ export function createBareExternalPlugin(options = false) {
                     return undefined;
                 if (args.kind !== "import-statement" && args.kind !== "dynamic-import")
                     return undefined;
+                // Fail closed on Node built-ins. This plugin only runs for browser
+                // bundles (platform: "browser"), where a server-only `node:*` import can
+                // never work: rewriting it to an esm.sh URL silently ships a module that
+                // 404s on esm.sh and throws (e.g. `createHash is not a function`) at
+                // hydration. Surface a clear build error instead of a broken rewrite.
+                if (isNodeBuiltinSpecifier(args.path)) {
+                    return {
+                        errors: [{
+                                text: `Cannot bundle server-only import "${args.path}" for the browser. ` +
+                                    `Node built-in modules are not available on the client. Move it into a ` +
+                                    `server component, an API route, or middleware — or gate the code behind a ` +
+                                    `"use client" boundary that does not import it.`,
+                            }],
+                    };
+                }
                 // Keep import-map-resolved specifiers as bare externals — the browser's
                 // <script type="importmap"> resolves them to the correct CDN URL.
                 if (importMapOwnsSpecifier(args.path, importMapImports)) {

package/esm/src/server/handlers/request/module/page-data-endpoint-handler.js

@@ -239,16 +239,39 @@ function refreshStalePageData(cacheKey, resolve, cachePolicy) {
         }
     });
 }
+/**
+ * Only http(s) and root-relative destinations may be encoded for the client to
+ * follow. The client follows the destination with `window.location.href`, which
+ * would EXECUTE a `javascript:`/`data:` URL — unlike the full-page 302 path where
+ * the browser ignores such a Location. Protocol-relative `//host` is rejected too
+ * (it is easy to smuggle past a naive "starts with /" check). Blocked
+ * destinations fall through to normal error handling instead of being followed.
+ */
+function isFollowableRedirect(destination) {
+    if (destination.startsWith("/")) {
+        const baseOrigin = "https://veryfront.local";
+        try {
+            return new URL(destination, baseOrigin).origin === baseOrigin;
+        }
+        catch {
+            return false;
+        }
+    }
+    return /^https?:\/\//i.test(destination);
+}
 /**
  * A redirect() from getServerData is thrown up the pipeline as a VeryfrontError
  * whose `context.redirect` holds the destination (mirrors extractRedirectLocation
- * in the SSR service). Returns null for any other error.
+ * in the SSR service). Returns null for any other error, or for a redirect whose
+ * destination is not safe to hand to the client to follow.
  */
 function extractRedirectFromError(error) {
     const context = error?.context;
     const redirect = context?.redirect;
     if (!redirect || typeof redirect.destination !== "string")
         return null;
+    if (!isFollowableRedirect(redirect.destination))
+        return null;
     return { destination: redirect.destination, permanent: redirect.permanent === true };
 }
 function buildPageDataCacheKey(ctx, slug, url) {