veryfront 0.1.47 → 0.1.49

package/src/src/routing/api/module-loader/loader.ts

@@ -16,9 +16,187 @@ import { isDeno, isNode } from "../../../platform/compat/runtime.js";
 import { withSpan } from "../../../observability/tracing/otlp-setup.js";
 import { isCompiledBinary } from "../../../utils/index.js";
 import { wrapWithCurrentContext } from "../../../platform/adapters/fs/veryfront/multi-project-adapter.js";
+import { isWithinDirectory } from "../../../security/path-validation.js";
 
 const logger = serverLogger.component("api");
 
+/**
+ * Validates that a module path is contained within the project directory.
+ * Prevents path traversal attacks that could load arbitrary files from the host.
+ */
+function validateModulePath(modulePath: string, projectDir: string): void {
+  const resolved = pathHelper.resolve(modulePath);
+  const resolvedProject = pathHelper.resolve(projectDir);
+
+  if (!isWithinDirectory(resolvedProject, resolved)) {
+    throw toError(
+      createError({
+        type: "api",
+        message: `[API] module path escapes project directory: ${modulePath}`,
+      }),
+    );
+  }
+}
+
+/** Node.js built-in module names — shared across the CJS shim, esbuild externals, and Deno rewrites. */
+const NODE_BUILTINS = [
+  "assert",
+  "buffer",
+  "child_process",
+  "cluster",
+  "console",
+  "constants",
+  "crypto",
+  "dgram",
+  "dns",
+  "events",
+  "fs",
+  "http",
+  "http2",
+  "https",
+  "module",
+  "net",
+  "os",
+  "path",
+  "perf_hooks",
+  "process",
+  "querystring",
+  "readline",
+  "stream",
+  "string_decoder",
+  "timers",
+  "tls",
+  "tty",
+  "url",
+  "util",
+  "v8",
+  "vm",
+  "worker_threads",
+  "zlib",
+] as const;
+
+async function readProjectDependencies(
+  projectDir: string,
+  fs: FileSystem,
+): Promise<Map<string, string>> {
+  try {
+    const content = await fs.readTextFile(pathHelper.join(projectDir, "package.json"));
+    const pkg = JSON.parse(content) as { dependencies?: Record<string, string> };
+    return new Map(Object.entries(pkg.dependencies ?? {}));
+  } catch {
+    return new Map();
+  }
+}
+
+/**
+ * Generates a CJS module loader shim for compiled Deno binaries.
+ *
+ * In compiled binaries, `createRequire()` can resolve module paths and load
+ * built-in modules (fs, path, etc.), but cannot load CJS files from disk
+ * (loadMaybeCjs fails with "path not found"). This shim works around that
+ * limitation by using `Deno.readTextFileSync` to read CJS files and
+ * `new Function` to evaluate them in a proper CJS wrapper with require,
+ * exports, module, __filename, and __dirname bindings.
+ */
+function generateCompiledBinaryRequireShim(projectDir: string): string {
+  const builtinSet = JSON.stringify(NODE_BUILTINS);
+  const safeProjectDir = JSON.stringify(projectDir + "/package.json");
+  const safeProjectRoot = JSON.stringify(pathHelper.resolve(projectDir));
+
+  return `
+import { createRequire as __vf_createRequire } from "node:module";
+import { dirname as __vf_dirname, resolve as __vf_resolve } from "node:path";
+var __vf_builtinRequire = __vf_createRequire(${safeProjectDir});
+var __vf_builtinSet = new Set(${builtinSet});
+var __vf_projectRoot = ${safeProjectRoot};
+var __vf_cache = Object.create(null);
+function __vf_assertContained(resolved) {
+  var norm = __vf_resolve(resolved).replace(/\\\\/g, "/");
+  var root = __vf_projectRoot.replace(/\\\\/g, "/");
+  if (!norm.startsWith(root + "/") && norm !== root) {
+    throw new Error("CJS loader blocked path outside project: " + resolved);
+  }
+}
+function __vf_loadCjs(id, parentDir) {
+  if (id.startsWith("node:")) return __vf_builtinRequire(id);
+  if (__vf_builtinSet.has(id)) return __vf_builtinRequire(id);
+  var slashIdx = id.indexOf("/");
+  if (slashIdx > 0 && __vf_builtinSet.has(id.slice(0, slashIdx))) return __vf_builtinRequire(id);
+  var resolved;
+  if (id.startsWith(".") || id.startsWith("/")) {
+    resolved = __vf_resolve(parentDir, id);
+    if (!resolved.match(/\\.[a-zA-Z0-9]+$/)) {
+      var exts = [".js", ".cjs", ".json", "/index.js", "/index.cjs", "/index.json"];
+      for (var i = 0; i < exts.length; i++) {
+        try { Deno.statSync(resolved + exts[i]); resolved += exts[i]; break; } catch {}
+      }
+    }
+    __vf_assertContained(resolved);
+  } else {
+    resolved = __vf_builtinRequire.resolve(id);
+  }
+  if (resolved in __vf_cache) return __vf_cache[resolved];
+  var code = Deno.readTextFileSync(resolved);
+  if (resolved.endsWith(".json")) {
+    var json = JSON.parse(code);
+    __vf_cache[resolved] = json;
+    return json;
+  }
+  var mod = { exports: {} };
+  __vf_cache[resolved] = mod.exports;
+  var dir = __vf_dirname(resolved);
+  var childReq = function(childId) { return __vf_loadCjs(childId, dir); };
+  childReq.resolve = function(childId) {
+    if (childId.startsWith(".") || childId.startsWith("/")) return __vf_resolve(dir, childId);
+    return __vf_builtinRequire.resolve(childId);
+  };
+  childReq.ensure = function(mods, cb) { cb(); };
+  var fn = new Function("exports", "require", "module", "__filename", "__dirname", "global", "globalThis", "Worker", code);
+  fn(mod.exports, childReq, mod, resolved, dir, globalThis, globalThis, undefined);
+  __vf_cache[resolved] = mod.exports;
+  return mod.exports;
+}
+function __vf_interopDefault(m) { return m && m.__esModule && m.default !== undefined ? m.default : m; }
+var require = function(id) { return __vf_loadCjs(id, ${JSON.stringify(projectDir)}); };
+require.resolve = function(id) { return __vf_builtinRequire.resolve(id); };
+require.ensure = function(mods, cb) { cb(); };
+`.trim();
+}
+
+function resolveExportEntry(entry: unknown): string | undefined {
+  if (typeof entry === "string") return entry;
+  if (entry && typeof entry === "object") {
+    const obj = entry as Record<string, unknown>;
+    // Prefer import > default > first string value
+    for (const key of ["import", "default"]) {
+      const val = obj[key];
+      if (typeof val === "string") return val;
+      if (val && typeof val === "object") {
+        const nested = val as Record<string, unknown>;
+        if (typeof nested.default === "string") return nested.default;
+      }
+    }
+  }
+  return undefined;
+}
+
+export function toCjsDestructureBindings(bindings: string): string {
+  const inner = bindings.trim().replace(/^\{\s*/, "").replace(/\s*\}$/, "");
+  if (!inner) return "{}";
+
+  const converted = inner
+    .split(",")
+    .map((part) => part.trim())
+    .filter(Boolean)
+    .map((part) => {
+      const aliasMatch = part.match(/^([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)$/);
+      if (aliasMatch) return `${aliasMatch[1]}: ${aliasMatch[2]}`;
+      return part;
+    });
+
+  return `{ ${converted.join(", ")} }`;
+}
+
 const FILE_EXTENSIONS: string[] = ["", ".ts", ".tsx", ".js", ".jsx", ".mjs"];
 
 const EXT_TO_LOADER: Record<string, "tsx" | "jsx" | "ts" | "js" | "json"> = {
@@ -40,6 +218,8 @@ export function loadHandlerModule(options: LoadModuleOptions): Promise<APIRoute
       const { projectDir, modulePath, adapter, config } = options;
       const fs = createFileSystem();
 
+      validateModulePath(modulePath, projectDir);
+
       try {
         const module = await loadModule({ modulePath, projectDir, adapter, fs, config });
         return extractAPIRouteHandlers(module);
@@ -163,6 +343,13 @@ function createImportMapPlugin(
           ? resolvedPath
           : pathHelper.resolve(projectDir, resolvedPath);
 
+        if (!isWithinDirectory(pathHelper.resolve(projectDir), absolutePath)) {
+          logger.error(
+            `[API] Import map entry escapes project directory: ${args.path} -> ${absolutePath}`,
+          );
+          return { errors: [{ text: `Import map path escapes project: ${args.path}` }] };
+        }
+
         logger.debug(`Import map resolved: ${args.path} -> ${absolutePath}`);
 
         return { path: absolutePath, namespace: "import-map" };
@@ -176,6 +363,7 @@ function createImportMapPlugin(
               adapter,
               args.path,
               FILE_EXTENSIONS,
+              projectDir,
             );
 
             return {
@@ -195,7 +383,10 @@ function createImportMapPlugin(
 }
 
 /** Resolves relative imports through the adapter's virtual FS for remote projects. */
-function createAdapterResolvePlugin(adapter: RuntimeAdapter): Plugin {
+function createAdapterResolvePlugin(
+  adapter: RuntimeAdapter,
+  projectDir: string,
+): Plugin {
   return {
     name: "vf-adapter-resolve",
     setup(build) {
@@ -206,6 +397,16 @@ function createAdapterResolvePlugin(adapter: RuntimeAdapter): Plugin {
         if (!baseDir) return undefined;
 
         const absolutePath = pathHelper.resolve(baseDir, args.path);
+
+        if (!isWithinDirectory(pathHelper.resolve(projectDir), absolutePath)) {
+          logger.error(
+            `[API] Adapter resolve path escapes project: ${args.path} -> ${absolutePath}`,
+          );
+          return {
+            errors: [{ text: `Relative import escapes project: ${args.path}` }],
+          };
+        }
+
         logger.debug(
           `[API] Adapter resolve: ${args.path} (from ${
             args.importer || "stdin"
@@ -227,6 +428,7 @@ function createAdapterResolvePlugin(adapter: RuntimeAdapter): Plugin {
               adapter,
               args.path,
               FILE_EXTENSIONS,
+              projectDir,
             );
 
             return {
@@ -259,6 +461,7 @@ function loadAndTranspileModule(
         adapter,
         modulePath,
         FILE_EXTENSIONS,
+        projectDir,
       );
 
       if (!source) {
@@ -275,8 +478,46 @@ function loadAndTranspileModule(
       const allowedHosts = await loadSecurityConfig(projectDir, adapter);
       validateHTTPImports(source, allowedHosts);
 
+      const allDeps = await readProjectDependencies(projectDir, fs);
+
+      // Filter out framework-managed packages from user deps. These are already
+      // handled by the framework's own external/rewrite logic and should not be
+      // treated as user npm packages.
+      const frameworkPackages = new Set(["ai", "zod", "veryfront", "react", "react-dom", "path"]);
+      const frameworkPrefixes = ["@ai-sdk/", "@opentelemetry/", "node:", "veryfront/"];
+      const userDeps = new Map<string, string>();
+      for (const [name, version] of allDeps) {
+        if (frameworkPackages.has(name)) continue;
+        if (frameworkPrefixes.some((p) => name.startsWith(p))) continue;
+        userDeps.set(name, version);
+      }
+
+      // Always externalize user npm dependencies. The bundled handler is loaded
+      // from a temp file and user deps are resolved at runtime:
+      //   - Node.js: via file:// URLs pointing to node_modules
+      //   - Deno (compiled or not): via createRequire or npm: specifiers
+      // Bundling CJS deps inline (especially complex ones like pdf-parse/pdf.js)
+      // breaks their internal global state management during esbuild's CJS→ESM
+      // conversion.
+      const userExternals: string[] = [];
+      for (const name of userDeps.keys()) {
+        userExternals.push(name, `${name}/*`);
+      }
+
       const { build } = await import("esbuild");
 
+      // Many npm packages use CJS require() for Node built-ins (e.g. require('fs')).
+      // When esbuild bundles CJS into ESM output, these become __require() shims that
+      // fail at runtime. Inject a createRequire-based shim so require() works in ESM.
+      // Use projectDir as the resolve base so require() finds the project's node_modules.
+      const safeProjectDir = JSON.stringify(projectDir + "/package.json");
+      const requireShim = isDeno && isCompiledBinary()
+        ? generateCompiledBinaryRequireShim(projectDir)
+        : [
+          'import { createRequire as __vf_createRequire } from "node:module";',
+          `var require = __vf_createRequire(${safeProjectDir});`,
+        ].join("\n");
+
       const result: BuildResult = await build({
         bundle: true,
         write: false,
@@ -286,6 +527,7 @@ function loadAndTranspileModule(
         jsx: "automatic",
         jsxImportSource: "react",
         resolveExtensions: [".ts", ".tsx", ".js", ".jsx", ".mjs"],
+        banner: { js: requireShim },
         external: [
           "ai",
           "ai/*",
@@ -293,10 +535,11 @@ function loadAndTranspileModule(
           "@ai-sdk/*",
           "zod",
           "node:*",
+          ...NODE_BUILTINS,
           "veryfront",
           "veryfront/*",
           "@opentelemetry/*",
-          "path",
+          ...userExternals,
         ],
         stdin: {
           contents: source,
@@ -306,7 +549,7 @@ function loadAndTranspileModule(
         },
         plugins: [
           createImportMapPlugin(projectDir, adapter, config),
-          createAdapterResolvePlugin(adapter),
+          createAdapterResolvePlugin(adapter, projectDir),
           createHTTPPlugin(allowedHosts),
         ],
       });
@@ -325,7 +568,7 @@ function loadAndTranspileModule(
       const js = result.outputFiles?.[0]?.text ?? "export {}";
       logger.debug(`transpiled size ${js.length} bytes`);
 
-      return loadModuleFromCode(js, projectDir, fs);
+      return loadModuleFromCode(js, projectDir, fs, userDeps);
     },
     { "api.modulePath": modulePath, "api.projectDir": projectDir },
   );
@@ -335,9 +578,25 @@ async function readFileWithExtensions(
   adapter: RuntimeAdapter,
   basePath: string,
   extensions: string[],
+  projectDir?: string,
 ): Promise<{ filePath: string; contents: string }> {
+  const resolvedProjectDir = projectDir ? pathHelper.resolve(projectDir) : undefined;
+
   for (const ext of extensions) {
     const filePath = ext ? basePath + ext : basePath;
+
+    if (resolvedProjectDir) {
+      const resolved = pathHelper.resolve(filePath);
+      if (!isWithinDirectory(resolvedProjectDir, resolved)) {
+        throw toError(
+          createError({
+            type: "api",
+            message: `[API] file path escapes project directory: ${filePath}`,
+          }),
+        );
+      }
+    }
+
     try {
       const contents = await adapter.fs.readFile(filePath);
       return { filePath, contents };
@@ -358,11 +617,12 @@ async function loadModuleFromCode(
   code: string,
   projectDir: string,
   fs: FileSystem,
+  userDeps: Map<string, string> = new Map(),
 ): Promise<APIRoute> {
   const tempDir = await fs.makeTempDir({ prefix: "vf-api-" });
   const tempFile = pathHelper.join(tempDir, "handler.mjs");
 
-  const transformedCode = await rewriteExternalImports(code, projectDir, fs);
+  const transformedCode = await rewriteExternalImports(code, projectDir, fs, userDeps);
 
   // In compiled Deno binaries, external modules loaded from temp files cannot
   // resolve "veryfront" since the source is embedded in the binary's virtual FS.
@@ -390,6 +650,9 @@ async function loadModuleFromCode(
         await fs.writeTextFile(pathHelper.join(tempDir, shimName), shimCode);
       }
     }
+
+    // Note: user npm dependencies are externalized and loaded at runtime via
+    // a custom CJS loader (see generateCompiledBinaryRequireShim), no shims needed.
   }
 
   await fs.writeTextFile(tempFile, transformedCode);
@@ -409,6 +672,7 @@ async function rewriteExternalImports(
   code: string,
   projectDir: string,
   fs: FileSystem,
+  userDeps: Map<string, string> = new Map(),
 ): Promise<string> {
   let transformed = code;
 
@@ -427,10 +691,7 @@ async function rewriteExternalImports(
           let entryPoint: string | undefined;
 
           if (pkgJson.exports) {
-            const dotExport = pkgJson.exports["."];
-            if (typeof dotExport === "string") entryPoint = dotExport;
-            else if (dotExport?.import) entryPoint = dotExport.import;
-            else if (dotExport?.default) entryPoint = dotExport.default;
+            entryPoint = resolveExportEntry(pkgJson.exports["."]);
           }
 
           entryPoint ||= pkgJson.module || pkgJson.main || "index.js";
@@ -453,27 +714,53 @@ async function rewriteExternalImports(
         "@ai-sdk/provider-utils",
       ];
 
+      for (const name of userDeps.keys()) {
+        if (!externalPackagesToResolve.includes(name)) {
+          externalPackagesToResolve.push(name);
+        }
+      }
+
       for (const pkg of externalPackagesToResolve) {
         const escapedPkg = pkg.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
-        const staticImportRegex = new RegExp(`from\\s*["']${escapedPkg}["']`, "g");
-        const dynamicImportRegex = new RegExp(`import\\s*\\(\\s*["']${escapedPkg}["']\\s*\\)`, "g");
+        // Match both exact imports (from "pkg") and subpath imports (from "pkg/sub")
+        const staticImportRegex = new RegExp(`from\\s*["']${escapedPkg}(/[^"']*)?["']`, "g");
+        const dynamicImportRegex = new RegExp(
+          `import\\s*\\(\\s*["']${escapedPkg}(/[^"']*)?["']\\s*\\)`,
+          "g",
+        );
 
         const needsStatic = staticImportRegex.test(transformed);
+        staticImportRegex.lastIndex = 0;
         const needsDynamic = dynamicImportRegex.test(transformed);
+        dynamicImportRegex.lastIndex = 0;
         if (!needsStatic && !needsDynamic) continue;
 
+        const packageDir = pathToFileURL(pathHelper.join(projectDir, "node_modules", pkg)).href;
         const resolvedUrl = await resolvePackageToFileUrl(pkg);
-        if (!resolvedUrl) continue;
 
         if (needsStatic) {
-          transformed = transformed.replace(staticImportRegex, `from "${resolvedUrl}"`);
-          logger.debug(`Resolved ${pkg} -> ${resolvedUrl}`);
+          transformed = transformed.replace(staticImportRegex, (_, subpath) => {
+            if (subpath) {
+              const subUrl = `${packageDir}${subpath}`;
+              logger.debug(`Resolved ${pkg}${subpath} -> ${subUrl}`);
+              return `from "${subUrl}"`;
+            }
+            if (!resolvedUrl) return `from "${pkg}"`;
+            logger.debug(`Resolved ${pkg} -> ${resolvedUrl}`);
+            return `from "${resolvedUrl}"`;
+          });
         }
 
         if (needsDynamic) {
-          transformed = transformed.replace(dynamicImportRegex, `import("${resolvedUrl}")`);
-          logger.debug(`Resolved dynamic import ${pkg} -> ${resolvedUrl}`);
+          transformed = transformed.replace(dynamicImportRegex, (_, subpath) => {
+            if (subpath) {
+              const subUrl = `${packageDir}${subpath}`;
+              return `import("${subUrl}")`;
+            }
+            if (!resolvedUrl) return `import("${pkg}")`;
+            return `import("${resolvedUrl}")`;
+          });
         }
       }
 
@@ -577,6 +864,108 @@ async function rewriteExternalImports(
       transformed = transformed.replace(pattern, replacement);
     }
 
+    // Rewrite bare Node.js built-in imports to node: prefix for Deno compatibility.
+    // npm packages often use require('fs') / from "fs" without the node: prefix.
+    for (const mod of NODE_BUILTINS) {
+      const escaped = mod.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      transformed = transformed.replace(
+        new RegExp(`from\\s+["']${escaped}["']`, "g"),
+        `from "node:${mod}"`,
+      );
+      transformed = transformed.replace(
+        new RegExp(`import\\s*\\(\\s*["']${escaped}["']\\s*\\)`, "g"),
+        `import("node:${mod}")`,
+      );
+    }
+
+    // Rewrite user-installed npm dependencies.
+    // In non-compiled Deno: use npm: specifiers (resolved by Deno's npm support).
+    // In compiled binaries: use the createRequire-based `require` shim (already
+    // injected by the esbuild banner) to load CJS packages from node_modules,
+    // since npm: specifiers only work for packages embedded at compile time.
+    if (isCompiledBinary()) {
+      for (const name of userDeps.keys()) {
+        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        // Default imports: import foo from "pkg" → const foo = __vf_interopDefault(require("pkg"))
+        // interopDefault unwraps .default for ESM packages transpiled to CJS
+        transformed = transformed.replace(
+          new RegExp(`import\\s+(\\w+)\\s+from\\s+["']${escaped}["']`, "g"),
+          (_, localName) => `const ${localName} = __vf_interopDefault(require("${name}"))`,
+        );
+        // Named imports: import { a, b } from "pkg" → const { a, b } = require("pkg")
+        transformed = transformed.replace(
+          new RegExp(`import\\s+(\\{[^}]+\\})\\s+from\\s+["']${escaped}["']`, "g"),
+          (_, bindings) => `const ${toCjsDestructureBindings(bindings)} = require("${name}")`,
+        );
+        // Namespace imports: import * as foo from "pkg" → const foo = require("pkg")
+        transformed = transformed.replace(
+          new RegExp(`import\\s+\\*\\s+as\\s+(\\w+)\\s+from\\s+["']${escaped}["']`, "g"),
+          (_, localName) => `const ${localName} = require("${name}")`,
+        );
+        // Mixed imports: import foo, { bar } from "pkg"
+        transformed = transformed.replace(
+          new RegExp(
+            `import\\s+(\\w+)\\s*,\\s*(\\{[^}]+\\})\\s+from\\s+["']${escaped}["']`,
+            "g",
+          ),
+          (_, defaultName, bindings) => {
+            const tmp = `__vf_tmp_${defaultName}`;
+            return `const ${tmp} = require("${name}"); const ${defaultName} = __vf_interopDefault(${tmp}); const ${
+              toCjsDestructureBindings(bindings)
+            } = ${tmp}`;
+          },
+        );
+        // Subpath static imports: from "pkg/sub" → require("pkg/sub")
+        transformed = transformed.replace(
+          new RegExp(
+            `import\\s+(\\w+|\\*\\s+as\\s+\\w+|\\{[^}]+\\})\\s+from\\s+["']${escaped}(/[^"']+)["']`,
+            "g",
+          ),
+          (_, binding, subpath) => {
+            const trimmedBinding = String(binding).trim();
+            if (trimmedBinding.startsWith("{")) {
+              return `const ${
+                toCjsDestructureBindings(trimmedBinding)
+              } = require("${name}${subpath}")`;
+            }
+            const name_ = trimmedBinding.startsWith("*")
+              ? trimmedBinding.replace(/\*\s+as\s+/, "")
+              : trimmedBinding;
+            return `const ${name_} = require("${name}${subpath}")`;
+          },
+        );
+        // Dynamic imports: import("pkg") → Promise.resolve(require("pkg"))
+        transformed = transformed.replace(
+          new RegExp(`import\\s*\\(\\s*["']${escaped}(/[^"']*)?["']\\s*\\)`, "g"),
+          (_, subpath) => `Promise.resolve(require("${name}${subpath || ""}"))`,
+        );
+      }
+    } else {
+      for (const [name, version] of userDeps) {
+        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        // Resolve exact installed version from node_modules (falls back to range)
+        let resolvedVersion = version;
+        try {
+          const pkgPath = pathHelper.join(projectDir, "node_modules", name, "package.json");
+          const pkgContent = await fs.readTextFile(pkgPath);
+          const pkg = JSON.parse(pkgContent) as { version?: string };
+          if (pkg.version) resolvedVersion = pkg.version;
+        } catch {
+          // Fall back to declared range
+        }
+        // Static: from "pkg" and from "pkg/sub"
+        transformed = transformed.replace(
+          new RegExp(`from\\s+["']${escaped}(/[^"']*)?["']`, "g"),
+          (_, subpath) => `from "npm:${name}@${resolvedVersion}${subpath || ""}"`,
+        );
+        // Dynamic: import("pkg") and import("pkg/sub")
+        transformed = transformed.replace(
+          new RegExp(`import\\s*\\(\\s*["']${escaped}(/[^"']*)?["']\\s*\\)`, "g"),
+          (_, subpath) => `import("npm:${name}@${resolvedVersion}${subpath || ""}")`,
+        );
+      }
+    }
+
     // In compiled binaries, "veryfront" resolves to embedded source that can't be
     // imported from external temp files. Rewrite to use local runtime shims.
     if (isCompiledBinary()) {
@@ -655,11 +1044,26 @@ async function registerVfModules(subpaths: Set<string>): Promise<void> {
     Record<string, unknown>
   >;
 
+  // __VERYFRONT_MODULES__ is populated by the discovery transpiler via hash
+  // imports (#veryfront/...) which resolve correctly in compiled binaries.
+  // Check it first before attempting bare specifier dynamic imports.
+  const discoveryModules = (dntShim.dntGlobalThis as Record<string, unknown>).__VERYFRONT_MODULES__ as
+    | Record<string, Record<string, unknown>>
+    | undefined;
+
   for (const subpath of subpaths) {
     if (modules[subpath]) continue;
 
+    const specifier = `veryfront/${subpath}`;
+
+    const fromDiscovery = discoveryModules?.[specifier];
+    if (fromDiscovery) {
+      modules[subpath] = fromDiscovery;
+      logger.debug(`[API] Registered module ${specifier} from discovery globals`);
+      continue;
+    }
+
     try {
-      const specifier = `veryfront/${subpath}`;
       modules[subpath] = await import(specifier) as Record<string, unknown>;
       logger.debug(`[API] Registered module ${specifier} on globalThis`);
     } catch (e) {

package/src/src/routing/api/openapi/path-utils.ts

@@ -97,45 +97,6 @@ export function extractPathParams(pattern: string): PathParam[] {
   return params;
 }
 
-/**
- * Convert file path to route pattern.
- *
- * Transforms a file system path to an API route pattern.
- *
- * @param filePath - File path relative to pages/api or app directory
- * @param routePrefix - Prefix to add (e.g., "/api")
- * @returns Route pattern
- *
- * @example
- * ```typescript
- * filePathToPattern("users/[id]/route.ts", "/api")
- * // → "/api/users/[id]"
- *
- * filePathToPattern("users/[id].ts", "/api")
- * // → "/api/users/[id]"
- * ```
- */
-export function filePathToPattern(filePath: string, routePrefix: string = ""): string {
-  let pattern = filePath
-    .replace(/\.(ts|tsx|js|jsx)$/, "")
-    .replace(/\/route$/, "")
-    .replace(/\/index$/, "");
-
-  if (!pattern.startsWith("/")) pattern = `/${pattern}`;
-
-  if (routePrefix && !pattern.startsWith(routePrefix)) {
-    pattern = `${routePrefix}${pattern}`;
-  }
-
-  pattern = pattern.replace(/\/+/g, "/");
-
-  if (pattern.length > 1 && pattern.endsWith("/")) {
-    pattern = pattern.slice(0, -1);
-  }
-
-  return pattern;
-}
-
 /**
  * Generate a unique operation ID from method and path.
  *

package/src/src/routing/api/openapi/spec-generator.ts

@@ -11,6 +11,7 @@ import type { VeryfrontConfig } from "../../../config/index.js";
 import type { DynamicRouter, RouteEntry } from "../api-route-matcher.js";
 import { loadHandlerModule } from "../module-loader/loader.js";
 import {
+  getDefaultStatusDescription,
   OPENAPI_METADATA,
   type OpenAPIOperation,
   type OpenAPIParameter,
@@ -261,23 +262,3 @@ function toYaml(obj: unknown, indent: number): string {
 
   return String(obj);
 }
-
-function getDefaultStatusDescription(statusCode: number): string {
-  const descriptions: Record<number, string> = {
-    200: "Successful response",
-    201: "Resource created",
-    204: "No content",
-    400: "Bad request",
-    401: "Unauthorized",
-    403: "Forbidden",
-    404: "Not found",
-    409: "Conflict",
-    422: "Unprocessable entity",
-    429: "Too many requests",
-    500: "Internal server error",
-    502: "Bad gateway",
-    503: "Service unavailable",
-  };
-
-  return descriptions[statusCode] || `Response with status ${statusCode}`;
-}