veryfront 0.1.47 → 0.1.49

package/esm/src/routing/api/module-loader/loader.js

@@ -11,7 +11,176 @@ import { isDeno, isNode } from "../../../platform/compat/runtime.js";
 import { withSpan } from "../../../observability/tracing/otlp-setup.js";
 import { isCompiledBinary } from "../../../utils/index.js";
 import { wrapWithCurrentContext } from "../../../platform/adapters/fs/veryfront/multi-project-adapter.js";
+import { isWithinDirectory } from "../../../security/path-validation.js";
 const logger = serverLogger.component("api");
+/**
+ * Validates that a module path is contained within the project directory.
+ * Prevents path traversal attacks that could load arbitrary files from the host.
+ */
+function validateModulePath(modulePath, projectDir) {
+    const resolved = pathHelper.resolve(modulePath);
+    const resolvedProject = pathHelper.resolve(projectDir);
+    if (!isWithinDirectory(resolvedProject, resolved)) {
+        throw toError(createError({
+            type: "api",
+            message: `[API] module path escapes project directory: ${modulePath}`,
+        }));
+    }
+}
+/** Node.js built-in module names — shared across the CJS shim, esbuild externals, and Deno rewrites. */
+const NODE_BUILTINS = [
+    "assert",
+    "buffer",
+    "child_process",
+    "cluster",
+    "console",
+    "constants",
+    "crypto",
+    "dgram",
+    "dns",
+    "events",
+    "fs",
+    "http",
+    "http2",
+    "https",
+    "module",
+    "net",
+    "os",
+    "path",
+    "perf_hooks",
+    "process",
+    "querystring",
+    "readline",
+    "stream",
+    "string_decoder",
+    "timers",
+    "tls",
+    "tty",
+    "url",
+    "util",
+    "v8",
+    "vm",
+    "worker_threads",
+    "zlib",
+];
+async function readProjectDependencies(projectDir, fs) {
+    try {
+        const content = await fs.readTextFile(pathHelper.join(projectDir, "package.json"));
+        const pkg = JSON.parse(content);
+        return new Map(Object.entries(pkg.dependencies ?? {}));
+    }
+    catch {
+        return new Map();
+    }
+}
+/**
+ * Generates a CJS module loader shim for compiled Deno binaries.
+ *
+ * In compiled binaries, `createRequire()` can resolve module paths and load
+ * built-in modules (fs, path, etc.), but cannot load CJS files from disk
+ * (loadMaybeCjs fails with "path not found"). This shim works around that
+ * limitation by using `Deno.readTextFileSync` to read CJS files and
+ * `new Function` to evaluate them in a proper CJS wrapper with require,
+ * exports, module, __filename, and __dirname bindings.
+ */
+function generateCompiledBinaryRequireShim(projectDir) {
+    const builtinSet = JSON.stringify(NODE_BUILTINS);
+    const safeProjectDir = JSON.stringify(projectDir + "/package.json");
+    const safeProjectRoot = JSON.stringify(pathHelper.resolve(projectDir));
+    return `
+import { createRequire as __vf_createRequire } from "node:module";
+import { dirname as __vf_dirname, resolve as __vf_resolve } from "node:path";
+var __vf_builtinRequire = __vf_createRequire(${safeProjectDir});
+var __vf_builtinSet = new Set(${builtinSet});
+var __vf_projectRoot = ${safeProjectRoot};
+var __vf_cache = Object.create(null);
+function __vf_assertContained(resolved) {
+  var norm = __vf_resolve(resolved).replace(/\\\\/g, "/");
+  var root = __vf_projectRoot.replace(/\\\\/g, "/");
+  if (!norm.startsWith(root + "/") && norm !== root) {
+    throw new Error("CJS loader blocked path outside project: " + resolved);
+  }
+}
+function __vf_loadCjs(id, parentDir) {
+  if (id.startsWith("node:")) return __vf_builtinRequire(id);
+  if (__vf_builtinSet.has(id)) return __vf_builtinRequire(id);
+  var slashIdx = id.indexOf("/");
+  if (slashIdx > 0 && __vf_builtinSet.has(id.slice(0, slashIdx))) return __vf_builtinRequire(id);
+  var resolved;
+  if (id.startsWith(".") || id.startsWith("/")) {
+    resolved = __vf_resolve(parentDir, id);
+    if (!resolved.match(/\\.[a-zA-Z0-9]+$/)) {
+      var exts = [".js", ".cjs", ".json", "/index.js", "/index.cjs", "/index.json"];
+      for (var i = 0; i < exts.length; i++) {
+        try { Deno.statSync(resolved + exts[i]); resolved += exts[i]; break; } catch {}
+      }
+    }
+    __vf_assertContained(resolved);
+  } else {
+    resolved = __vf_builtinRequire.resolve(id);
+  }
+  if (resolved in __vf_cache) return __vf_cache[resolved];
+  var code = Deno.readTextFileSync(resolved);
+  if (resolved.endsWith(".json")) {
+    var json = JSON.parse(code);
+    __vf_cache[resolved] = json;
+    return json;
+  }
+  var mod = { exports: {} };
+  __vf_cache[resolved] = mod.exports;
+  var dir = __vf_dirname(resolved);
+  var childReq = function(childId) { return __vf_loadCjs(childId, dir); };
+  childReq.resolve = function(childId) {
+    if (childId.startsWith(".") || childId.startsWith("/")) return __vf_resolve(dir, childId);
+    return __vf_builtinRequire.resolve(childId);
+  };
+  childReq.ensure = function(mods, cb) { cb(); };
+  var fn = new Function("exports", "require", "module", "__filename", "__dirname", "global", "globalThis", "Worker", code);
+  fn(mod.exports, childReq, mod, resolved, dir, globalThis, globalThis, undefined);
+  __vf_cache[resolved] = mod.exports;
+  return mod.exports;
+}
+function __vf_interopDefault(m) { return m && m.__esModule && m.default !== undefined ? m.default : m; }
+var require = function(id) { return __vf_loadCjs(id, ${JSON.stringify(projectDir)}); };
+require.resolve = function(id) { return __vf_builtinRequire.resolve(id); };
+require.ensure = function(mods, cb) { cb(); };
+`.trim();
+}
+function resolveExportEntry(entry) {
+    if (typeof entry === "string")
+        return entry;
+    if (entry && typeof entry === "object") {
+        const obj = entry;
+        // Prefer import > default > first string value
+        for (const key of ["import", "default"]) {
+            const val = obj[key];
+            if (typeof val === "string")
+                return val;
+            if (val && typeof val === "object") {
+                const nested = val;
+                if (typeof nested.default === "string")
+                    return nested.default;
+            }
+        }
+    }
+    return undefined;
+}
+export function toCjsDestructureBindings(bindings) {
+    const inner = bindings.trim().replace(/^\{\s*/, "").replace(/\s*\}$/, "");
+    if (!inner)
+        return "{}";
+    const converted = inner
+        .split(",")
+        .map((part) => part.trim())
+        .filter(Boolean)
+        .map((part) => {
+        const aliasMatch = part.match(/^([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)$/);
+        if (aliasMatch)
+            return `${aliasMatch[1]}: ${aliasMatch[2]}`;
+        return part;
+    });
+    return `{ ${converted.join(", ")} }`;
+}
 const FILE_EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mjs"];
 const EXT_TO_LOADER = {
     tsx: "tsx",
@@ -27,6 +196,7 @@ export function loadHandlerModule(options) {
     return withSpan("api.loadHandlerModule", async () => {
         const { projectDir, modulePath, adapter, config } = options;
         const fs = createFileSystem();
+        validateModulePath(modulePath, projectDir);
         try {
             const module = await loadModule({ modulePath, projectDir, adapter, fs, config });
             return extractAPIRouteHandlers(module);
@@ -118,12 +288,16 @@ function createImportMapPlugin(projectDir, adapter, config) {
                 const absolutePath = pathHelper.isAbsolute(resolvedPath)
                     ? resolvedPath
                     : pathHelper.resolve(projectDir, resolvedPath);
+                if (!isWithinDirectory(pathHelper.resolve(projectDir), absolutePath)) {
+                    logger.error(`[API] Import map entry escapes project directory: ${args.path} -> ${absolutePath}`);
+                    return { errors: [{ text: `Import map path escapes project: ${args.path}` }] };
+                }
                 logger.debug(`Import map resolved: ${args.path} -> ${absolutePath}`);
                 return { path: absolutePath, namespace: "import-map" };
             });
             build.onLoad({ filter: /.*/, namespace: "import-map" }, wrapWithCurrentContext(async (args) => {
                 try {
-                    const { filePath, contents } = await readFileWithExtensions(adapter, args.path, FILE_EXTENSIONS);
+                    const { filePath, contents } = await readFileWithExtensions(adapter, args.path, FILE_EXTENSIONS, projectDir);
                     return {
                         contents,
                         loader: getLoaderForFile(filePath),
@@ -140,7 +314,7 @@ function createImportMapPlugin(projectDir, adapter, config) {
     };
 }
 /** Resolves relative imports through the adapter's virtual FS for remote projects. */
-function createAdapterResolvePlugin(adapter) {
+function createAdapterResolvePlugin(adapter, projectDir) {
     return {
         name: "vf-adapter-resolve",
         setup(build) {
@@ -151,6 +325,12 @@ function createAdapterResolvePlugin(adapter) {
                 if (!baseDir)
                     return undefined;
                 const absolutePath = pathHelper.resolve(baseDir, args.path);
+                if (!isWithinDirectory(pathHelper.resolve(projectDir), absolutePath)) {
+                    logger.error(`[API] Adapter resolve path escapes project: ${args.path} -> ${absolutePath}`);
+                    return {
+                        errors: [{ text: `Relative import escapes project: ${args.path}` }],
+                    };
+                }
                 logger.debug(`[API] Adapter resolve: ${args.path} (from ${args.importer || "stdin"}) -> ${absolutePath}`);
                 return { path: absolutePath, namespace: "vf-adapter" };
             });
@@ -161,7 +341,7 @@ function createAdapterResolvePlugin(adapter) {
             // cannot resolve the per-project adapter and all file reads fail silently.
             build.onLoad({ filter: /.*/, namespace: "vf-adapter" }, wrapWithCurrentContext(async (args) => {
                 try {
-                    const { filePath, contents } = await readFileWithExtensions(adapter, args.path, FILE_EXTENSIONS);
+                    const { filePath, contents } = await readFileWithExtensions(adapter, args.path, FILE_EXTENSIONS, projectDir);
                     return {
                         contents,
                         loader: getLoaderForFile(filePath),
@@ -179,7 +359,7 @@ function createAdapterResolvePlugin(adapter) {
 }
 function loadAndTranspileModule(modulePath, projectDir, adapter, fs, config) {
     return withSpan("api.loadAndTranspileModule", async () => {
-        const { filePath: resolvedPath, contents: source } = await readFileWithExtensions(adapter, modulePath, FILE_EXTENSIONS);
+        const { filePath: resolvedPath, contents: source } = await readFileWithExtensions(adapter, modulePath, FILE_EXTENSIONS, projectDir);
         if (!source) {
             throw toError(createError({
                 type: "file",
@@ -189,7 +369,43 @@ function loadAndTranspileModule(modulePath, projectDir, adapter, fs, config) {
         const loader = getEsbuildLoader(resolvedPath);
         const allowedHosts = await loadSecurityConfig(projectDir, adapter);
         validateHTTPImports(source, allowedHosts);
+        const allDeps = await readProjectDependencies(projectDir, fs);
+        // Filter out framework-managed packages from user deps. These are already
+        // handled by the framework's own external/rewrite logic and should not be
+        // treated as user npm packages.
+        const frameworkPackages = new Set(["ai", "zod", "veryfront", "react", "react-dom", "path"]);
+        const frameworkPrefixes = ["@ai-sdk/", "@opentelemetry/", "node:", "veryfront/"];
+        const userDeps = new Map();
+        for (const [name, version] of allDeps) {
+            if (frameworkPackages.has(name))
+                continue;
+            if (frameworkPrefixes.some((p) => name.startsWith(p)))
+                continue;
+            userDeps.set(name, version);
+        }
+        // Always externalize user npm dependencies. The bundled handler is loaded
+        // from a temp file and user deps are resolved at runtime:
+        //   - Node.js: via file:// URLs pointing to node_modules
+        //   - Deno (compiled or not): via createRequire or npm: specifiers
+        // Bundling CJS deps inline (especially complex ones like pdf-parse/pdf.js)
+        // breaks their internal global state management during esbuild's CJS→ESM
+        // conversion.
+        const userExternals = [];
+        for (const name of userDeps.keys()) {
+            userExternals.push(name, `${name}/*`);
+        }
         const { build } = await import("esbuild");
+        // Many npm packages use CJS require() for Node built-ins (e.g. require('fs')).
+        // When esbuild bundles CJS into ESM output, these become __require() shims that
+        // fail at runtime. Inject a createRequire-based shim so require() works in ESM.
+        // Use projectDir as the resolve base so require() finds the project's node_modules.
+        const safeProjectDir = JSON.stringify(projectDir + "/package.json");
+        const requireShim = isDeno && isCompiledBinary()
+            ? generateCompiledBinaryRequireShim(projectDir)
+            : [
+                'import { createRequire as __vf_createRequire } from "node:module";',
+                `var require = __vf_createRequire(${safeProjectDir});`,
+            ].join("\n");
         const result = await build({
             bundle: true,
             write: false,
@@ -199,6 +415,7 @@ function loadAndTranspileModule(modulePath, projectDir, adapter, fs, config) {
             jsx: "automatic",
             jsxImportSource: "react",
             resolveExtensions: [".ts", ".tsx", ".js", ".jsx", ".mjs"],
+            banner: { js: requireShim },
             external: [
                 "ai",
                 "ai/*",
@@ -206,10 +423,11 @@ function loadAndTranspileModule(modulePath, projectDir, adapter, fs, config) {
                 "@ai-sdk/*",
                 "zod",
                 "node:*",
+                ...NODE_BUILTINS,
                 "veryfront",
                 "veryfront/*",
                 "@opentelemetry/*",
-                "path",
+                ...userExternals,
             ],
             stdin: {
                 contents: source,
@@ -219,7 +437,7 @@ function loadAndTranspileModule(modulePath, projectDir, adapter, fs, config) {
             },
             plugins: [
                 createImportMapPlugin(projectDir, adapter, config),
-                createAdapterResolvePlugin(adapter),
+                createAdapterResolvePlugin(adapter, projectDir),
                 createHTTPPlugin(allowedHosts),
             ],
         });
@@ -233,12 +451,22 @@ function loadAndTranspileModule(modulePath, projectDir, adapter, fs, config) {
         logger.info(`built handler ${resolvedPath}`);
         const js = result.outputFiles?.[0]?.text ?? "export {}";
         logger.debug(`transpiled size ${js.length} bytes`);
-        return loadModuleFromCode(js, projectDir, fs);
+        return loadModuleFromCode(js, projectDir, fs, userDeps);
     }, { "api.modulePath": modulePath, "api.projectDir": projectDir });
 }
-async function readFileWithExtensions(adapter, basePath, extensions) {
+async function readFileWithExtensions(adapter, basePath, extensions, projectDir) {
+    const resolvedProjectDir = projectDir ? pathHelper.resolve(projectDir) : undefined;
     for (const ext of extensions) {
         const filePath = ext ? basePath + ext : basePath;
+        if (resolvedProjectDir) {
+            const resolved = pathHelper.resolve(filePath);
+            if (!isWithinDirectory(resolvedProjectDir, resolved)) {
+                throw toError(createError({
+                    type: "api",
+                    message: `[API] file path escapes project directory: ${filePath}`,
+                }));
+            }
+        }
         try {
             const contents = await adapter.fs.readFile(filePath);
             return { filePath, contents };
@@ -252,10 +480,10 @@ async function readFileWithExtensions(adapter, basePath, extensions) {
         message: `File not found: ${basePath}`,
     }));
 }
-async function loadModuleFromCode(code, projectDir, fs) {
+async function loadModuleFromCode(code, projectDir, fs, userDeps = new Map()) {
     const tempDir = await fs.makeTempDir({ prefix: "vf-api-" });
     const tempFile = pathHelper.join(tempDir, "handler.mjs");
-    const transformedCode = await rewriteExternalImports(code, projectDir, fs);
+    const transformedCode = await rewriteExternalImports(code, projectDir, fs, userDeps);
     // In compiled Deno binaries, external modules loaded from temp files cannot
     // resolve "veryfront" since the source is embedded in the binary's virtual FS.
     // Write runtime shims: a root shim for `from "veryfront"` and per-subpath shims
@@ -276,6 +504,8 @@ async function loadModuleFromCode(code, projectDir, fs) {
                 await fs.writeTextFile(pathHelper.join(tempDir, shimName), shimCode);
             }
         }
+        // Note: user npm dependencies are externalized and loaded at runtime via
+        // a custom CJS loader (see generateCompiledBinaryRequireShim), no shims needed.
     }
     await fs.writeTextFile(tempFile, transformedCode);
     try {
@@ -290,7 +520,7 @@ async function loadModuleFromCode(code, projectDir, fs) {
         await fs.remove(tempDir, { recursive: true });
     }
 }
-async function rewriteExternalImports(code, projectDir, fs) {
+async function rewriteExternalImports(code, projectDir, fs, userDeps = new Map()) {
     let transformed = code;
     if (isNode) {
         try {
@@ -303,13 +533,7 @@ async function rewriteExternalImports(code, projectDir, fs) {
                     const pkgJson = JSON.parse(await fs.readTextFile(packageJsonPath));
                     let entryPoint;
                     if (pkgJson.exports) {
-                        const dotExport = pkgJson.exports["."];
-                        if (typeof dotExport === "string")
-                            entryPoint = dotExport;
-                        else if (dotExport?.import)
-                            entryPoint = dotExport.import;
-                        else if (dotExport?.default)
-                            entryPoint = dotExport.default;
+                        entryPoint = resolveExportEntry(pkgJson.exports["."]);
                     }
                     entryPoint ||= pkgJson.module || pkgJson.main || "index.js";
                     if (!entryPoint)
@@ -330,24 +554,47 @@ async function rewriteExternalImports(code, projectDir, fs) {
                 "@ai-sdk/provider",
                 "@ai-sdk/provider-utils",
             ];
+            for (const name of userDeps.keys()) {
+                if (!externalPackagesToResolve.includes(name)) {
+                    externalPackagesToResolve.push(name);
+                }
+            }
             for (const pkg of externalPackagesToResolve) {
                 const escapedPkg = pkg.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-                const staticImportRegex = new RegExp(`from\\s*["']${escapedPkg}["']`, "g");
-                const dynamicImportRegex = new RegExp(`import\\s*\\(\\s*["']${escapedPkg}["']\\s*\\)`, "g");
+                // Match both exact imports (from "pkg") and subpath imports (from "pkg/sub")
+                const staticImportRegex = new RegExp(`from\\s*["']${escapedPkg}(/[^"']*)?["']`, "g");
+                const dynamicImportRegex = new RegExp(`import\\s*\\(\\s*["']${escapedPkg}(/[^"']*)?["']\\s*\\)`, "g");
                 const needsStatic = staticImportRegex.test(transformed);
+                staticImportRegex.lastIndex = 0;
                 const needsDynamic = dynamicImportRegex.test(transformed);
+                dynamicImportRegex.lastIndex = 0;
                 if (!needsStatic && !needsDynamic)
                     continue;
+                const packageDir = pathToFileURL(pathHelper.join(projectDir, "node_modules", pkg)).href;
                 const resolvedUrl = await resolvePackageToFileUrl(pkg);
-                if (!resolvedUrl)
-                    continue;
                 if (needsStatic) {
-                    transformed = transformed.replace(staticImportRegex, `from "${resolvedUrl}"`);
-                    logger.debug(`Resolved ${pkg} -> ${resolvedUrl}`);
+                    transformed = transformed.replace(staticImportRegex, (_, subpath) => {
+                        if (subpath) {
+                            const subUrl = `${packageDir}${subpath}`;
+                            logger.debug(`Resolved ${pkg}${subpath} -> ${subUrl}`);
+                            return `from "${subUrl}"`;
+                        }
+                        if (!resolvedUrl)
+                            return `from "${pkg}"`;
+                        logger.debug(`Resolved ${pkg} -> ${resolvedUrl}`);
+                        return `from "${resolvedUrl}"`;
+                    });
                 }
                 if (needsDynamic) {
-                    transformed = transformed.replace(dynamicImportRegex, `import("${resolvedUrl}")`);
-                    logger.debug(`Resolved dynamic import ${pkg} -> ${resolvedUrl}`);
+                    transformed = transformed.replace(dynamicImportRegex, (_, subpath) => {
+                        if (subpath) {
+                            const subUrl = `${packageDir}${subpath}`;
+                            return `import("${subUrl}")`;
+                        }
+                        if (!resolvedUrl)
+                            return `import("${pkg}")`;
+                        return `import("${resolvedUrl}")`;
+                    });
                 }
             }
             const vfPackagePath = pathHelper.join(projectDir, "node_modules", "veryfront");
@@ -442,6 +689,69 @@ async function rewriteExternalImports(code, projectDir, fs) {
         for (const { pattern, replacement } of rewrites) {
             transformed = transformed.replace(pattern, replacement);
         }
+        // Rewrite bare Node.js built-in imports to node: prefix for Deno compatibility.
+        // npm packages often use require('fs') / from "fs" without the node: prefix.
+        for (const mod of NODE_BUILTINS) {
+            const escaped = mod.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            transformed = transformed.replace(new RegExp(`from\\s+["']${escaped}["']`, "g"), `from "node:${mod}"`);
+            transformed = transformed.replace(new RegExp(`import\\s*\\(\\s*["']${escaped}["']\\s*\\)`, "g"), `import("node:${mod}")`);
+        }
+        // Rewrite user-installed npm dependencies.
+        // In non-compiled Deno: use npm: specifiers (resolved by Deno's npm support).
+        // In compiled binaries: use the createRequire-based `require` shim (already
+        // injected by the esbuild banner) to load CJS packages from node_modules,
+        // since npm: specifiers only work for packages embedded at compile time.
+        if (isCompiledBinary()) {
+            for (const name of userDeps.keys()) {
+                const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+                // Default imports: import foo from "pkg" → const foo = __vf_interopDefault(require("pkg"))
+                // interopDefault unwraps .default for ESM packages transpiled to CJS
+                transformed = transformed.replace(new RegExp(`import\\s+(\\w+)\\s+from\\s+["']${escaped}["']`, "g"), (_, localName) => `const ${localName} = __vf_interopDefault(require("${name}"))`);
+                // Named imports: import { a, b } from "pkg" → const { a, b } = require("pkg")
+                transformed = transformed.replace(new RegExp(`import\\s+(\\{[^}]+\\})\\s+from\\s+["']${escaped}["']`, "g"), (_, bindings) => `const ${toCjsDestructureBindings(bindings)} = require("${name}")`);
+                // Namespace imports: import * as foo from "pkg" → const foo = require("pkg")
+                transformed = transformed.replace(new RegExp(`import\\s+\\*\\s+as\\s+(\\w+)\\s+from\\s+["']${escaped}["']`, "g"), (_, localName) => `const ${localName} = require("${name}")`);
+                // Mixed imports: import foo, { bar } from "pkg"
+                transformed = transformed.replace(new RegExp(`import\\s+(\\w+)\\s*,\\s*(\\{[^}]+\\})\\s+from\\s+["']${escaped}["']`, "g"), (_, defaultName, bindings) => {
+                    const tmp = `__vf_tmp_${defaultName}`;
+                    return `const ${tmp} = require("${name}"); const ${defaultName} = __vf_interopDefault(${tmp}); const ${toCjsDestructureBindings(bindings)} = ${tmp}`;
+                });
+                // Subpath static imports: from "pkg/sub" → require("pkg/sub")
+                transformed = transformed.replace(new RegExp(`import\\s+(\\w+|\\*\\s+as\\s+\\w+|\\{[^}]+\\})\\s+from\\s+["']${escaped}(/[^"']+)["']`, "g"), (_, binding, subpath) => {
+                    const trimmedBinding = String(binding).trim();
+                    if (trimmedBinding.startsWith("{")) {
+                        return `const ${toCjsDestructureBindings(trimmedBinding)} = require("${name}${subpath}")`;
+                    }
+                    const name_ = trimmedBinding.startsWith("*")
+                        ? trimmedBinding.replace(/\*\s+as\s+/, "")
+                        : trimmedBinding;
+                    return `const ${name_} = require("${name}${subpath}")`;
+                });
+                // Dynamic imports: import("pkg") → Promise.resolve(require("pkg"))
+                transformed = transformed.replace(new RegExp(`import\\s*\\(\\s*["']${escaped}(/[^"']*)?["']\\s*\\)`, "g"), (_, subpath) => `Promise.resolve(require("${name}${subpath || ""}"))`);
+            }
+        }
+        else {
+            for (const [name, version] of userDeps) {
+                const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+                // Resolve exact installed version from node_modules (falls back to range)
+                let resolvedVersion = version;
+                try {
+                    const pkgPath = pathHelper.join(projectDir, "node_modules", name, "package.json");
+                    const pkgContent = await fs.readTextFile(pkgPath);
+                    const pkg = JSON.parse(pkgContent);
+                    if (pkg.version)
+                        resolvedVersion = pkg.version;
+                }
+                catch {
+                    // Fall back to declared range
+                }
+                // Static: from "pkg" and from "pkg/sub"
+                transformed = transformed.replace(new RegExp(`from\\s+["']${escaped}(/[^"']*)?["']`, "g"), (_, subpath) => `from "npm:${name}@${resolvedVersion}${subpath || ""}"`);
+                // Dynamic: import("pkg") and import("pkg/sub")
+                transformed = transformed.replace(new RegExp(`import\\s*\\(\\s*["']${escaped}(/[^"']*)?["']\\s*\\)`, "g"), (_, subpath) => `import("npm:${name}@${resolvedVersion}${subpath || ""}")`);
+            }
+        }
         // In compiled binaries, "veryfront" resolves to embedded source that can't be
         // imported from external temp files. Rewrite to use local runtime shims.
         if (isCompiledBinary()) {
@@ -496,11 +806,21 @@ function extractSubpathsFromCode(code) {
  */
 async function registerVfModules(subpaths) {
     const modules = (dntShim.dntGlobalThis.__vfModules ?? {});
+    // __VERYFRONT_MODULES__ is populated by the discovery transpiler via hash
+    // imports (#veryfront/...) which resolve correctly in compiled binaries.
+    // Check it first before attempting bare specifier dynamic imports.
+    const discoveryModules = dntShim.dntGlobalThis.__VERYFRONT_MODULES__;
     for (const subpath of subpaths) {
         if (modules[subpath])
             continue;
+        const specifier = `veryfront/${subpath}`;
+        const fromDiscovery = discoveryModules?.[specifier];
+        if (fromDiscovery) {
+            modules[subpath] = fromDiscovery;
+            logger.debug(`[API] Registered module ${specifier} from discovery globals`);
+            continue;
+        }
         try {
-            const specifier = `veryfront/${subpath}`;
             modules[subpath] = await import(specifier);
             logger.debug(`[API] Registered module ${specifier} on globalThis`);
         }

package/esm/src/routing/api/openapi/path-utils.d.ts

@@ -56,25 +56,6 @@ export declare function toOpenAPIPath(pattern: string): string;
  * ```
  */
 export declare function extractPathParams(pattern: string): PathParam[];
-/**
- * Convert file path to route pattern.
- *
- * Transforms a file system path to an API route pattern.
- *
- * @param filePath - File path relative to pages/api or app directory
- * @param routePrefix - Prefix to add (e.g., "/api")
- * @returns Route pattern
- *
- * @example
- * ```typescript
- * filePathToPattern("users/[id]/route.ts", "/api")
- * // → "/api/users/[id]"
- *
- * filePathToPattern("users/[id].ts", "/api")
- * // → "/api/users/[id]"
- * ```
- */
-export declare function filePathToPattern(filePath: string, routePrefix?: string): string;
 /**
  * Generate a unique operation ID from method and path.
  *

package/esm/src/routing/api/openapi/path-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/openapi/path-utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,QAAQ,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,CAyB9D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,GAAE,MAAW,GAAG,MAAM,CAmBpF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAYxE"}
+{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/openapi/path-utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,QAAQ,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,CAyB9D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAYxE"}

package/esm/src/routing/api/openapi/path-utils.js

@@ -71,40 +71,6 @@ export function extractPathParams(pattern) {
     }
     return params;
 }
-/**
- * Convert file path to route pattern.
- *
- * Transforms a file system path to an API route pattern.
- *
- * @param filePath - File path relative to pages/api or app directory
- * @param routePrefix - Prefix to add (e.g., "/api")
- * @returns Route pattern
- *
- * @example
- * ```typescript
- * filePathToPattern("users/[id]/route.ts", "/api")
- * // → "/api/users/[id]"
- *
- * filePathToPattern("users/[id].ts", "/api")
- * // → "/api/users/[id]"
- * ```
- */
-export function filePathToPattern(filePath, routePrefix = "") {
-    let pattern = filePath
-        .replace(/\.(ts|tsx|js|jsx)$/, "")
-        .replace(/\/route$/, "")
-        .replace(/\/index$/, "");
-    if (!pattern.startsWith("/"))
-        pattern = `/${pattern}`;
-    if (routePrefix && !pattern.startsWith(routePrefix)) {
-        pattern = `${routePrefix}${pattern}`;
-    }
-    pattern = pattern.replace(/\/+/g, "/");
-    if (pattern.length > 1 && pattern.endsWith("/")) {
-        pattern = pattern.slice(0, -1);
-    }
-    return pattern;
-}
 /**
  * Generate a unique operation ID from method and path.
  *

package/esm/src/routing/api/openapi/spec-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec-generator.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/openapi/spec-generator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,yBAAyB,CAAC;AAEzE,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AAUpB,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,WAAW,CAAC,CAkCtB;AAmID,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAEpD"}
+{"version":3,"file":"spec-generator.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/openapi/spec-generator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,yBAAyB,CAAC;AAEzE,OAAO,EAOL,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AAUpB,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,WAAW,CAAC,CAkCtB;AAmID,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAEpD"}

package/esm/src/routing/api/openapi/spec-generator.js

@@ -6,7 +6,7 @@
  * @module routing/api/openapi/spec-generator
  */
 import { loadHandlerModule } from "../module-loader/loader.js";
-import { OPENAPI_METADATA, } from "./types.js";
+import { getDefaultStatusDescription, OPENAPI_METADATA, } from "./types.js";
 import { extractPathParams, generateOperationId, toOpenAPIPath } from "./path-utils.js";
 import { logger as baseLogger } from "../../../utils/index.js";
 const logger = baseLogger.component("open-api");
@@ -181,21 +181,3 @@ function toYaml(obj, indent) {
     }
     return String(obj);
 }
-function getDefaultStatusDescription(statusCode) {
-    const descriptions = {
-        200: "Successful response",
-        201: "Resource created",
-        204: "No content",
-        400: "Bad request",
-        401: "Unauthorized",
-        403: "Forbidden",
-        404: "Not found",
-        409: "Conflict",
-        422: "Unprocessable entity",
-        429: "Too many requests",
-        500: "Internal server error",
-        502: "Bad gateway",
-        503: "Service unavailable",
-    };
-    return descriptions[statusCode] || `Response with status ${statusCode}`;
-}

package/esm/src/routing/api/openapi/types.d.ts

@@ -99,4 +99,5 @@ export interface OpenAPIResponse {
         };
     };
 }
+export declare function getDefaultStatusDescription(statusCode: number): string;
 //# sourceMappingURL=types.d.ts.map