veryfront 0.1.626 → 0.1.627

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.626",
+    "version": "0.1.627",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "workspace": [

package/esm/src/platform/adapters/runtime/deno/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/runtime/deno/adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,QAAQ,EACR,kBAAkB,EAElB,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,YAAY,EACZ,MAAM,EACN,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,gBAAgB,EACjB,MAAM,eAAe,CAAC;AAyHvB,cAAM,qBAAsB,YAAW,iBAAiB;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAKhD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWrC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC;IAY/C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAYrC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKlD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW;CAuErE;AAED,cAAM,sBAAuB,YAAW,kBAAkB;IACxD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIpC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIrC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAGnC;AAED,cAAM,iBAAkB,YAAW,aAAa;IAC9C,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB;CASrD;AAED,cAAM,gBAAiB,YAAW,YAAY;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE;IAejE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAanC;AAwBD,qBAAa,WAAY,YAAW,cAAc;IAChD,QAAQ,CAAC,EAAE,EAAG,MAAM,CAAU;IAC9B,QAAQ,CAAC,IAAI,UAAU;IACvB,QAAQ,CAAC,EAAE,wBAA+B;IAC1C,QAAQ,CAAC,GAAG,yBAAgC;IAC5C,QAAQ,CAAC,MAAM,oBAA2B;IAC1C,QAAQ,CAAC,KAAK,mBAA0B;IAExC,QAAQ,CAAC,YAAY;;;;;;;;;;MAUnB;IAEF,OAAO,CAAC,YAAY,CAA2B;IAE/C,KAAK,CACH,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAC3D,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,MAAM,CAAC;IAuEZ,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/runtime/deno/adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,QAAQ,EACR,kBAAkB,EAElB,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,YAAY,EACZ,MAAM,EACN,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,gBAAgB,EACjB,MAAM,eAAe,CAAC;AAyHvB,cAAM,qBAAsB,YAAW,iBAAiB;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAKhD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWrC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC;IAY/C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAYrC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKlD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,WAAW;CAuErE;AAED,cAAM,sBAAuB,YAAW,kBAAkB;IACxD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIpC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIrC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAGnC;AAED,cAAM,iBAAkB,YAAW,aAAa;IAC9C,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB;CAYrD;AAED,cAAM,gBAAiB,YAAW,YAAY;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE;IAejE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAanC;AAwBD,qBAAa,WAAY,YAAW,cAAc;IAChD,QAAQ,CAAC,EAAE,EAAG,MAAM,CAAU;IAC9B,QAAQ,CAAC,IAAI,UAAU;IACvB,QAAQ,CAAC,EAAE,wBAA+B;IAC1C,QAAQ,CAAC,GAAG,yBAAgC;IAC5C,QAAQ,CAAC,MAAM,oBAA2B;IAC1C,QAAQ,CAAC,KAAK,mBAA0B;IAExC,QAAQ,CAAC,YAAY;;;;;;;;;;MAUnB;IAEF,OAAO,CAAC,YAAY,CAA2B;IAE/C,KAAK,CACH,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAC3D,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,MAAM,CAAC;IAuEZ,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/esm/src/platform/adapters/runtime/deno/adapter.js

@@ -212,12 +212,15 @@ class DenoEnvironmentAdapter {
 }
 class DenoServerAdapter {
     upgradeWebSocket(request) {
-        if (typeof dntShim.Deno === "undefined") {
+        // Access native Deno via `self` to bypass dnt shim transform.
+        // dnt rewrites `globalThis.Deno` to @deno/shim-deno, which lacks upgradeWebSocket.
+        const nativeDeno = self["Deno"];
+        if (typeof nativeDeno?.upgradeWebSocket !== "function") {
             throw NOT_SUPPORTED.create({
                 detail: "DenoServerAdapter.upgradeWebSocket() can only be used in Deno runtime",
             });
         }
-        const { socket, response } = dntShim.Deno.upgradeWebSocket(request);
+        const { socket, response } = nativeDeno.upgradeWebSocket(request);
         return { socket, response };
     }
 }

package/esm/src/platform/compat/http/websocket.js

@@ -1,4 +1,3 @@
-import * as dntShim from "../../../../_dnt.shims.js";
 import { isDeno } from "../runtime.js";
 import { NOT_SUPPORTED } from "../../../errors/index.js";
 export function upgradeWebSocket(request, options) {
@@ -14,9 +13,17 @@ export function isWebSocketUpgrade(request) {
     return request.headers.get("upgrade")?.toLowerCase() === "websocket";
 }
 function upgradeWebSocketDeno(request, options) {
+    // Access native Deno via `self` to bypass dnt shim transform.
+    // dnt rewrites `globalThis.Deno` to @deno/shim-deno, which lacks upgradeWebSocket.
+    const nativeDeno = self["Deno"];
+    if (typeof nativeDeno?.upgradeWebSocket !== "function") {
+        throw NOT_SUPPORTED.create({
+            detail: "Deno.upgradeWebSocket() is not available in this runtime.",
+        });
+    }
     const denoOptions = options?.protocol
         ? { protocol: options.protocol }
         : undefined;
-    const { socket, response } = dntShim.Deno.upgradeWebSocket(request, denoOptions);
+    const { socket, response } = nativeDeno.upgradeWebSocket(request, denoOptions);
     return { socket, response };
 }

package/esm/src/routing/api/module-loader/external-import-rewriter.d.ts

@@ -15,12 +15,26 @@ export declare function readProjectDependencies(projectDir: string, fs: FileSyst
 export declare function generateCompiledBinaryRequireShim(projectDir: string): string;
 export declare function getNodeExternalPackagesToResolve(userDeps: Map<string, string>): string[];
 export declare function resolveNodePackageToFileUrl(projectDir: string, packageName: string, fs: FileSystem, pathToFileURL: typeof import("node:url").pathToFileURL): Promise<string | null>;
+/** Location of an ESM-only user dependency, used to rewrite imports to real ES module URLs. */
+export interface EsmDependencyLocation {
+    /** file:// URL of the package's ESM entry point. */
+    entryUrl: string;
+    /** Absolute path of the package's root directory (used to contain subpath imports). */
+    packageDir: string;
+}
+/**
+ * Identify the subset of user dependencies that are ESM-only and resolve each
+ * to file:// URLs so the compiled-binary loader can import them as real ES
+ * modules instead of transpiling them to CommonJS. CJS dependencies are omitted
+ * and continue to load through the `createRequire`-based shim.
+ */
+export declare function resolveEsmUserDependencies(projectDir: string, fs: FileSystem, userDeps: Map<string, string>): Promise<Map<string, EsmDependencyLocation>>;
 export declare function loadVeryfrontExportsMap(projectDir: string, fs: FileSystem): Promise<Record<string, {
     import?: string;
 }>>;
 export declare function rewriteNodeExternalImports(code: string, projectDir: string, fs: FileSystem, userDeps: Map<string, string>): Promise<string>;
 export declare function rewriteCompiledBinaryVeryfrontImports(code: string): string;
-export declare function rewriteCompiledBinaryUserDependencyImports(code: string, userDeps: Map<string, string>): string;
+export declare function rewriteCompiledBinaryUserDependencyImports(code: string, userDeps: Map<string, string>, esmDeps?: Map<string, EsmDependencyLocation>): string;
 export declare function rewriteDenoNpmDependencyImports(code: string, projectDir: string, fs: FileSystem, userDeps: Map<string, string>): Promise<string>;
 export declare function rewriteDenoNodeBuiltinImports(code: string): string;
 export declare function rewriteExternalImports(code: string, projectDir: string, fs: FileSystem, userDeps?: Map<string, string>): Promise<string>;

package/esm/src/routing/api/module-loader/external-import-rewriter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-import-rewriter.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/external-import-rewriter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAQjE,wGAAwG;AACxG,eAAO,MAAM,aAAa,mVAkChB,CAAC;AAEX,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAS9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+E5E;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAUxF;AAED,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,cAAc,UAAU,EAAE,aAAa,GACrD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxB;AAED,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAW9C;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA6EjB;AAED,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB1E;AAED,wBAAgB,0CAA0C,CACxD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,MAAM,CAoDR;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA0BjB;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBlE;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa,GACxC,OAAO,CAAC,MAAM,CAAC,CAkCjB"}
+{"version":3,"file":"external-import-rewriter.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/external-import-rewriter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AASjE,wGAAwG;AACxG,eAAO,MAAM,aAAa,mVAkChB,CAAC;AAEX,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAS9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA+E5E;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAUxF;AAED,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,cAAc,UAAU,EAAE,aAAa,GACrD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxB;AAED,+FAA+F;AAC/F,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,UAAU,EAAE,MAAM,CAAC;CACpB;AAoCD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAmC7C;AAED,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAW9C;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA6EjB;AAED,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB1E;AAED,wBAAgB,0CAA0C,CACxD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,GAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAa,GACtD,MAAM,CAgGR;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAAC,MAAM,CAAC,CA0BjB;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBlE;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,UAAU,EACd,QAAQ,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa,GACxC,OAAO,CAAC,MAAM,CAAC,CAmCjB"}

package/esm/src/routing/api/module-loader/external-import-rewriter.js

@@ -2,6 +2,7 @@ import { isCompiledBinary, serverLogger } from "../../../utils/index.js";
 import * as pathHelper from "../../../platform/compat/path/index.js";
 import { isDeno, isNode } from "../../../platform/compat/runtime.js";
 import { rewriteNpmImports } from "../../../transforms/npm-import-rewrites.js";
+import { isWithinDirectory } from "../../../security/path-validation.js";
 import { resolveExportEntry, toCjsDestructureBindings } from "./loader-helpers.js";
 const logger = serverLogger.component("api");
 /** Node.js built-in module names — shared across the CJS shim, esbuild externals, and Deno rewrites. */
@@ -168,6 +169,79 @@ export async function resolveNodePackageToFileUrl(projectDir, packageName, fs, p
         return null;
     }
 }
+/**
+ * Decide whether an installed package must be loaded as a real ES module.
+ *
+ * ESM-only packages (e.g. `"type": "module"` packages that use `import.meta` or
+ * top-level await) cannot be evaluated as CommonJS via the compiled-binary
+ * `new Function` shim. We treat a package as ESM when its package.json declares
+ * `"type": "module"` or its resolved entry point is a `.mjs` file.
+ */
+function isEsmPackage(pkgJson, entry) {
+    if (pkgJson.type === "module")
+        return true;
+    return entry.endsWith(".mjs");
+}
+/**
+ * Resolve a package's ESM entry point, preferring the conditional `import`
+ * export, then the `module` field, then `main`.
+ */
+function resolveEsmEntry(pkgJson) {
+    const exportsField = pkgJson.exports;
+    if (exportsField && typeof exportsField === "object") {
+        const dot = exportsField["."];
+        const fromExports = resolveExportEntry(dot ?? exportsField);
+        if (fromExports)
+            return fromExports;
+    }
+    else if (typeof exportsField === "string") {
+        return exportsField;
+    }
+    const moduleField = pkgJson.module;
+    if (typeof moduleField === "string")
+        return moduleField;
+    const mainField = pkgJson.main;
+    if (typeof mainField === "string")
+        return mainField;
+    return "index.js";
+}
+/**
+ * Identify the subset of user dependencies that are ESM-only and resolve each
+ * to file:// URLs so the compiled-binary loader can import them as real ES
+ * modules instead of transpiling them to CommonJS. CJS dependencies are omitted
+ * and continue to load through the `createRequire`-based shim.
+ */
+export async function resolveEsmUserDependencies(projectDir, fs, userDeps) {
+    const esmDeps = new Map();
+    for (const name of userDeps.keys()) {
+        const packageDir = pathHelper.resolve(pathHelper.join(projectDir, "node_modules", name));
+        try {
+            const pkgJson = JSON.parse(await fs.readTextFile(pathHelper.join(packageDir, "package.json")));
+            const entry = resolveEsmEntry(pkgJson);
+            if (!entry || !isEsmPackage(pkgJson, entry))
+                continue;
+            // The entry path comes from the dependency's own package.json, which is
+            // attacker-influenceable (a malicious/compromised package could set
+            // "main": "../../../etc/passwd"). Reject entries that resolve outside the
+            // package directory so a crafted package.json cannot turn into a file://
+            // import that escapes node_modules. This mirrors the containment guard the
+            // CJS loader shim enforces via __vf_assertContained.
+            const entryPath = pathHelper.resolve(pathHelper.join(packageDir, entry));
+            if (!isWithinDirectory(packageDir, entryPath)) {
+                logger.warn(`Skipping ESM dependency ${name}: entry escapes package directory (${entry})`);
+                continue;
+            }
+            esmDeps.set(name, {
+                entryUrl: pathHelper.toFileUrl(entryPath).href,
+                packageDir,
+            });
+        }
+        catch (_) {
+            /* expected: package.json missing/invalid → treat as CJS */
+        }
+    }
+    return esmDeps;
+}
 export async function loadVeryfrontExportsMap(projectDir, fs) {
     const vfPackagePath = pathHelper.join(projectDir, "node_modules", "veryfront");
     const vfPackageJsonPath = pathHelper.join(vfPackagePath, "package.json");
@@ -251,10 +325,39 @@ export function rewriteCompiledBinaryVeryfrontImports(code) {
     transformed = transformed.replace(/import\s*\(\s*["']veryfront\/([^"']+)["']\s*\)/g, (_match, subpath) => `import("./_vf_${subpath.replace(/\//g, "_")}.mjs")`);
     return transformed;
 }
-export function rewriteCompiledBinaryUserDependencyImports(code, userDeps) {
+export function rewriteCompiledBinaryUserDependencyImports(code, userDeps, esmDeps = new Map()) {
     let transformed = code;
     for (const name of userDeps.keys()) {
         const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        // ESM-only dependencies are rewritten to real ES module file:// URLs so that
+        // import.meta, top-level await, etc. work. They must NOT be transpiled to
+        // CommonJS and evaluated via the `new Function` shim (see __vf_loadCjs).
+        const esm = esmDeps.get(name);
+        if (esm) {
+            // Resolve a subpath import to a contained file:// URL. The subpath comes
+            // from the handler source; reject any that escape the package directory
+            // (e.g. "pkg/../../secret") by leaving the import untouched so it fails to
+            // resolve rather than reading outside node_modules.
+            const subpathUrl = (subpath, original) => {
+                const target = pathHelper.resolve(pathHelper.join(esm.packageDir, subpath));
+                if (!isWithinDirectory(esm.packageDir, target)) {
+                    logger.warn(`Skipping ESM subpath import that escapes package directory: ${original}`);
+                    return null;
+                }
+                return pathHelper.toFileUrl(target).href;
+            };
+            transformed = transformed.replace(new RegExp(`from\\s+["']${escaped}(/[^"']+)["']`, "g"), (match, subpath) => {
+                const url = subpathUrl(subpath, match);
+                return url ? `from "${url}"` : match;
+            });
+            transformed = transformed.replace(new RegExp(`from\\s+["']${escaped}["']`, "g"), () => `from "${esm.entryUrl}"`);
+            transformed = transformed.replace(new RegExp(`import\\s*\\(\\s*["']${escaped}(/[^"']+)["']\\s*\\)`, "g"), (match, subpath) => {
+                const url = subpathUrl(subpath, match);
+                return url ? `import("${url}")` : match;
+            });
+            transformed = transformed.replace(new RegExp(`import\\s*\\(\\s*["']${escaped}["']\\s*\\)`, "g"), () => `import("${esm.entryUrl}")`);
+            continue;
+        }
         transformed = transformed.replace(new RegExp(`import\\s+(\\w+)\\s+from\\s+["']${escaped}["']`, "g"), (_, localName) => `const ${localName} = __vf_interopDefault(require("${name}"))`);
         transformed = transformed.replace(new RegExp(`import\\s+(\\{[^}]+\\})\\s+from\\s+["']${escaped}["']`, "g"), (_, bindings) => `const ${toCjsDestructureBindings(bindings)} = require("${name}")`);
         transformed = transformed.replace(new RegExp(`import\\s+\\*\\s+as\\s+(\\w+)\\s+from\\s+["']${escaped}["']`, "g"), (_, localName) => `const ${localName} = require("${name}")`);
@@ -324,7 +427,8 @@ export async function rewriteExternalImports(code, projectDir, fs, userDeps = ne
         // injected by the esbuild banner) to load CJS packages from node_modules,
         // since npm: specifiers only work for packages embedded at compile time.
         if (isCompiledBinary()) {
-            transformed = rewriteCompiledBinaryUserDependencyImports(transformed, userDeps);
+            const esmDeps = await resolveEsmUserDependencies(projectDir, fs, userDeps);
+            transformed = rewriteCompiledBinaryUserDependencyImports(transformed, userDeps, esmDeps);
         }
         else {
             transformed = await rewriteDenoNpmDependencyImports(transformed, projectDir, fs, userDeps);

package/esm/src/routing/api/module-loader/loader.d.ts

@@ -1,5 +1,5 @@
 import type { APIRoute, LoadModuleOptions } from "./types.js";
-export { generateCompiledBinaryRequireShim, getNodeExternalPackagesToResolve, loadVeryfrontExportsMap, resolveNodePackageToFileUrl, rewriteCompiledBinaryUserDependencyImports, rewriteCompiledBinaryVeryfrontImports, rewriteDenoNodeBuiltinImports, rewriteDenoNpmDependencyImports, rewriteNodeExternalImports, } from "./external-import-rewriter.js";
+export { generateCompiledBinaryRequireShim, getNodeExternalPackagesToResolve, loadVeryfrontExportsMap, resolveEsmUserDependencies, resolveNodePackageToFileUrl, rewriteCompiledBinaryUserDependencyImports, rewriteCompiledBinaryVeryfrontImports, rewriteDenoNodeBuiltinImports, rewriteDenoNpmDependencyImports, rewriteNodeExternalImports, } from "./external-import-rewriter.js";
 export { toCjsDestructureBindings } from "./loader-helpers.js";
 export declare function loadHandlerModule(options: LoadModuleOptions): Promise<APIRoute | null>;
 //# sourceMappingURL=loader.d.ts.map

package/esm/src/routing/api/module-loader/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/loader.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkB9D,OAAO,EACL,iCAAiC,EACjC,gCAAgC,EAChC,uBAAuB,EACvB,2BAA2B,EAC3B,0CAA0C,EAC1C,qCAAqC,EACrC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyBtF"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/loader.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkB9D,OAAO,EACL,iCAAiC,EACjC,gCAAgC,EAChC,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,0CAA0C,EAC1C,qCAAqC,EACrC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyBtF"}

package/esm/src/routing/api/module-loader/loader.js

@@ -14,7 +14,7 @@ import { isCompiledBinary } from "../../../utils/index.js";
 import { wrapWithCurrentContext } from "../../../platform/adapters/fs/veryfront/multi-project-adapter.js";
 import { isWithinDirectory } from "../../../security/path-validation.js";
 import { generateCompiledBinaryRequireShim, NODE_BUILTINS, readProjectDependencies, rewriteExternalImports, } from "./external-import-rewriter.js";
-export { generateCompiledBinaryRequireShim, getNodeExternalPackagesToResolve, loadVeryfrontExportsMap, resolveNodePackageToFileUrl, rewriteCompiledBinaryUserDependencyImports, rewriteCompiledBinaryVeryfrontImports, rewriteDenoNodeBuiltinImports, rewriteDenoNpmDependencyImports, rewriteNodeExternalImports, } from "./external-import-rewriter.js";
+export { generateCompiledBinaryRequireShim, getNodeExternalPackagesToResolve, loadVeryfrontExportsMap, resolveEsmUserDependencies, resolveNodePackageToFileUrl, rewriteCompiledBinaryUserDependencyImports, rewriteCompiledBinaryVeryfrontImports, rewriteDenoNodeBuiltinImports, rewriteDenoNpmDependencyImports, rewriteNodeExternalImports, } from "./external-import-rewriter.js";
 const logger = serverLogger.component("api");
 export { toCjsDestructureBindings } from "./loader-helpers.js";
 export function loadHandlerModule(options) {

package/esm/src/server/handlers/preview/hmr.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hmr.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/hmr.handler.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,eAAe,EAEpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAuBrB,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAK7D,qBAAa,UAAW,SAAQ,WAAW;IACzC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAgD;IAC1E,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA6B;IAC7D,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAK;IAChD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAS;IAEnC,QAAQ,EAAE,eAAe,CAKvB;IAEF,OAAO,CAAC,MAAM,CAAC,UAAU;IAsCnB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAuIvE;;;;;OAKG;YACW,wBAAwB;IAuCtC,MAAM,CAAC,cAAc,IAAI,MAAM;IAI/B,MAAM,CAAC,UAAU,IAAI;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;IAID,MAAM,CAAC,+BAA+B,IAAI,MAAM,IAAI;IAWpD,MAAM,CAAC,QAAQ,IAAI,IAAI;CAaxB"}
+{"version":3,"file":"hmr.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/hmr.handler.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,eAAe,EAEpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAuBrB,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAK7D,qBAAa,UAAW,SAAQ,WAAW;IACzC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAgD;IAC1E,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA6B;IAC7D,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAK;IAChD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAS;IAEnC,QAAQ,EAAE,eAAe,CAKvB;IAEF,OAAO,CAAC,MAAM,CAAC,UAAU;IAsCnB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA4IvE;;;;;OAKG;YACW,wBAAwB;IAuCtC,MAAM,CAAC,cAAc,IAAI,MAAM;IAI/B,MAAM,CAAC,UAAU,IAAI;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;IAID,MAAM,CAAC,+BAA+B,IAAI,MAAM,IAAI;IAWpD,MAAM,CAAC,QAAQ,IAAI,IAAI;CAaxB"}

package/esm/src/server/handlers/preview/hmr.handler.js

@@ -1,6 +1,7 @@
 import * as dntShim from "../../../../_dnt.shims.js";
 import { HMR_MAX_MESSAGES_PER_MINUTE, serverLogger } from "../../../utils/index.js";
 import { RateLimiter } from "../../../modules/server/index.js";
+import { VeryfrontError } from "../../../errors/index.js";
 import { BaseHandler } from "../response/base.js";
 import { HandlerPriority, } from "../types.js";
 import { ReloadNotifier } from "../../reload-notifier.js";
@@ -173,6 +174,10 @@ export class HMRHandler extends BaseHandler {
             return this.respond(response);
         }
         catch (error) {
+            if (error instanceof VeryfrontError && error.status === 501) {
+                logger.warn("WebSocket upgrade not supported by runtime", { error });
+                return this.respond(new Response("WebSocket not supported", { status: 501 }));
+            }
             logger.error("WebSocket upgrade failed", { error });
             return this.respond(new Response("WebSocket upgrade failed", { status: 500 }));
         }

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.626";
+export declare const VERSION = "0.1.627";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.626";
+export const VERSION = "0.1.627";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.626",
+  "version": "0.1.627",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",