diff --git a/extensions/ext-bundler-esbuild/src/plugin-adapter.ts b/extensions/ext-bundler-esbuild/src/plugin-adapter.ts
index 2d909ef0b2..4544481feb 100644
--- a/extensions/ext-bundler-esbuild/src/plugin-adapter.ts
+++ b/extensions/ext-bundler-esbuild/src/plugin-adapter.ts
@@ -63,6 +63,7 @@ export function toEsbuildPlugin(
                 namespace: args.namespace,
                 suffix: args.suffix,
                 pluginData: args.pluginData,
+                with: args.with,
               };
               const result = await callback(loadArgs);
               if (result == null) return result ?? null;
diff --git a/scripts/lint/check-sanitizer-baseline.ts b/scripts/lint/check-sanitizer-baseline.ts
index 6545507214..ac39c14d10 100644
--- a/scripts/lint/check-sanitizer-baseline.ts
+++ b/scripts/lint/check-sanitizer-baseline.ts
@@ -28,7 +28,7 @@ import {
 // audits removed opt-outs. Platform/compat process and opaque-deps suites now
 // restore the globals and child processes they touch instead of suppressing
 // leak reports.
-export const SANITIZER_OPT_OUT_BASELINE = 340;
+export const SANITIZER_OPT_OUT_BASELINE = 338;
 
 const OPT_OUT_PATTERN = /sanitize(?:Resources|Ops|Exit)\s*:\s*false/g;
 
diff --git a/src/extensions/bundler/bundler.ts b/src/extensions/bundler/bundler.ts
index 2567aed188..5a4f5ac715 100644
--- a/src/extensions/bundler/bundler.ts
+++ b/src/extensions/bundler/bundler.ts
@@ -234,6 +234,8 @@ export interface OnLoadArgs {
   namespace: string;
   suffix?: string;
   pluginData?: unknown;
+  /** Import attributes of the import that loads the file. */
+  with?: Record<string, string>;
 }
 
 /** Result returned from an `onLoad` callback. */
diff --git a/src/routing/api/module-loader/compiled-cjs-bundling.test.ts b/src/routing/api/module-loader/compiled-cjs-bundling.test.ts
new file mode 100644
index 0000000000..20eb7b5f81
--- /dev/null
+++ b/src/routing/api/module-loader/compiled-cjs-bundling.test.ts
@@ -0,0 +1,1969 @@
+import "#veryfront/schemas/_test-setup.ts";
+import { assert, assertEquals, assertRejects, assertThrows } from "#veryfront/testing/assert.ts";
+import { afterEach, describe, it } from "#veryfront/testing/bdd.ts";
+import { type PluginBuild, stop as stopBundler, transform } from "veryfront/extensions/bundler";
+import {
+  bindDynamicImports,
+  builtinModuleName,
+  codeString,
+  createCompiledBuiltinPlugin,
+  createDependencyFilePredicate,
+  createDependencyResolvePlugin,
+  createImportExternalsPlugin,
+  createImportMetaResolve,
+  createNativeAddonPlugin,
+  createRuntimeRequire,
+  dependencyJsonLoad,
+  nodePreferredFile,
+  nodeRelativeFile,
+  PackageTypeLookup,
+  prepareCommonJSFile,
+  prepareDependencyFile,
+  prepareDependencyJson,
+  prepareModuleFile,
+  prependRuntimeRequire,
+  resolveLiteralCalls,
+  rewriteImportSpecifiers,
+  type RuntimeRequireHost,
+} from "./compiled-cjs-bundling.ts";
+
+type ResolveHandler = (args: Record<string, unknown>) => unknown;
+type Plugin = { setup(build: PluginBuild): void | Promise<void> };
+
+/** The onResolve or onLoad handlers a plugin registers, in order. */
+async function handlers(plugin: Plugin, hook: "onResolve" | "onLoad"): Promise<ResolveHandler[]> {
+  const registered: ResolveHandler[] = [];
+  const register = (_options: unknown, handler: ResolveHandler) => registered.push(handler);
+  const build = {
+    onResolve: hook === "onResolve" ? register : () => {},
+    onLoad: hook === "onLoad" ? register : () => {},
+    onDispose: () => {},
+  };
+  await plugin.setup(build as unknown as PluginBuild);
+  return registered;
+}
+
+const resolveHandlers = (plugin: Plugin) => handlers(plugin, "onResolve");
+
+/** Throws the code of the error `fn` throws, or undefined. */
+function errorCode(fn: () => unknown): unknown {
+  try {
+    fn();
+  } catch (error) {
+    return (error as { code?: unknown }).code;
+  }
+  return undefined;
+}
+
+describe("routing/api/module-loader/compiled-cjs-bundling (inbox#4177)", () => {
+  describe("codeString()", () => {
+    it("writes a string literal that cannot end a script or a line", () => {
+      const value = "</script><!--\u2028\u2029\"'\\";
+      const literal = codeString(value);
+      assert(!/[<>\u2028\u2029]/.test(literal), literal);
+      assertEquals(new Function(`return ${literal};`)(), value);
+    });
+  });
+
+  describe("builtinModuleName()", () => {
+    it("names built-ins with or without the node: prefix, including subpaths", () => {
+      assertEquals(builtinModuleName("fs"), "fs");
+      assertEquals(builtinModuleName("node:fs"), "fs");
+      assertEquals(builtinModuleName("fs/promises"), "fs/promises");
+      assertEquals(builtinModuleName("left-pad"), undefined);
+    });
+
+    it("treats prefix-only built-ins as npm packages without the prefix", () => {
+      assertEquals(builtinModuleName("test"), undefined);
+      assertEquals(builtinModuleName("node:test"), "test");
+    });
+  });
+
+  describe("PackageTypeLookup", () => {
+    const manifests: Record<string, string> = {
+      "/app/package.json": JSON.stringify({ type: "module" }),
+      "/app/node_modules/typed/package.json": JSON.stringify({ type: "commonjs" }),
+    };
+    const lookup = () =>
+      new PackageTypeLookup((path) => Promise.resolve(manifests[path] ?? null), "/app");
+
+    it("reads the nearest package.json inside the project", async () => {
+      assertEquals(await lookup().of("/app/src/lib"), "module");
+      assertEquals(await lookup().of("/app/node_modules/typed/lib"), "commonjs");
+    });
+
+    it("walks up from a path under the canonical root as well", async () => {
+      const both = new PackageTypeLookup(
+        (path) =>
+          Promise.resolve(
+            path === "/real/app/node_modules/esm/package.json"
+              ? JSON.stringify({ type: "module" })
+              : null,
+          ),
+        ["/app", "/real/app"],
+      );
+      assertEquals(await both.of("/real/app/node_modules/esm/lib/deep"), "module");
+    });
+
+    it("stops at node_modules, as Node does, so a package without a manifest is CommonJS", async () => {
+      assertEquals(await lookup().of("/app/node_modules/bare/lib"), undefined);
+      assertEquals(await lookup().of("/app/node_modules/@scope/bare"), undefined);
+    });
+  });
+
+  describe("nodePreferredFile()", () => {
+    const files = new Set(["/d/impl.js", "/d/lib/index.js", "/d/data.json", "/d/entry.js"]);
+    const isFile = (path: string) => Promise.resolve(files.has(path));
+
+    it("prefers Node's extensions over a TypeScript sibling the bundler probed", async () => {
+      assertEquals(await nodePreferredFile("/d/impl.ts", "./impl", "/d", isFile), "/d/impl.js");
+      assertEquals(
+        await nodePreferredFile("/d/lib/index.tsx", "./lib", "/d", isFile),
+        "/d/lib/index.js",
+      );
+      assertEquals(await nodePreferredFile("/d/data.mjs", "./data", "/d", isFile), "/d/data.json");
+    });
+
+    it("keeps a path the import named exactly or a package chose", async () => {
+      assertEquals(await nodePreferredFile("/d/impl.ts", "./impl.ts", "/d", isFile), "/d/impl.ts");
+      assertEquals(
+        await nodePreferredFile("/d/node_modules/p/index.cjs", "p", "/d", isFile),
+        "/d/node_modules/p/index.cjs",
+      );
+      assertEquals(await nodePreferredFile("/d/only.ts", "./only", "/d", isFile), "/d/only.ts");
+      // Node checks the exact path before adding an extension.
+      assertEquals(await nodePreferredFile("/d/entry", "./entry", "/d", isFile), "/d/entry");
+    });
+
+    it("reads a backslash-relative require() id as relative where the host does", async () => {
+      assertEquals(
+        await nodePreferredFile("/d/impl.ts", ".\\impl", "/d", isFile, "\\"),
+        "/d/impl.js",
+      );
+      // Elsewhere a backslash is part of a name, as in Node.
+      assertEquals(
+        await nodePreferredFile("/d/impl.ts", ".\\impl", "/d", isFile, "/"),
+        "/d/impl.ts",
+      );
+    });
+  });
+
+  describe("nodeRelativeFile()", () => {
+    const files = new Set([
+      "/d/impl.js",
+      "/d/impl.ts",
+      "/d/exact",
+      "/d/lib/index.js",
+      "/d/lib/index.ts",
+      "/d/pkg/package.json",
+      "/d/addon.node",
+    ]);
+    const isFile = (path: string) => Promise.resolve(files.has(path));
+
+    it("picks Node's candidates for an extensionless relative import", async () => {
+      assertEquals(await nodeRelativeFile("./impl", "/d", isFile), "/d/impl.js");
+      assertEquals(await nodeRelativeFile("./lib", "/d", isFile), "/d/lib/index.js");
+      assertEquals(await nodeRelativeFile("/d/impl", "/x", isFile), "/d/impl.js");
+      assertEquals(await nodeRelativeFile("./addon", "/d", isFile), "/d/addon.node");
+    });
+
+    it("leaves exact files, package directories, bare and missing imports to the bundler", async () => {
+      assertEquals(await nodeRelativeFile("./impl.ts", "/d", isFile), null);
+      assertEquals(await nodeRelativeFile("./exact", "/d", isFile), null);
+      assertEquals(await nodeRelativeFile("./pkg", "/d", isFile), null);
+      assertEquals(await nodeRelativeFile("impl", "/d", isFile), null);
+      assertEquals(await nodeRelativeFile("./missing", "/d", isFile), null);
+    });
+  });
+
+  describe("createDependencyFilePredicate()", () => {
+    const links: Record<string, string> = {
+      "/app": "/real/app",
+      "/real/app/node_modules/linked": "/real/app/packages/linked",
+      "/real/app/node_modules/@s/w": "/real/app/packages/w",
+      "/real/app/node_modules/@ls": "/real/app/packages/ls",
+      "/real/app/node_modules/out": "/elsewhere/out",
+      "/real/app/node_modules/self": "/real/app",
+      "/real/app/node_modules/inner": "/real/app/node_modules/plain",
+    };
+    const entries: Record<string, { name: string; isDirectory: boolean; isSymlink?: boolean }[]> = {
+      "/real/app/node_modules": [
+        { name: "linked", isDirectory: false, isSymlink: true },
+        { name: "@s", isDirectory: true, isSymlink: false },
+        { name: "@ls", isDirectory: false, isSymlink: true },
+        { name: "plain", isDirectory: true, isSymlink: false },
+        { name: "out", isDirectory: false },
+        { name: "self", isDirectory: false, isSymlink: true },
+        { name: "inner", isDirectory: false, isSymlink: true },
+        { name: "dead", isDirectory: false, isSymlink: true },
+      ],
+      "/real/app/node_modules/@s": [{ name: "w", isDirectory: false, isSymlink: true }],
+      "/real/app/node_modules/@ls": [{ name: "pkg", isDirectory: true, isSymlink: false }],
+    };
+    const fs = {
+      realPath(path: string) {
+        if (path.endsWith("/dead")) return Promise.reject(new Error("dangling"));
+        return Promise.resolve(links[path] ?? path);
+      },
+      async *readDir(path: string) {
+        const listed = entries[path];
+        if (!listed) throw new Error("no such directory");
+        yield* listed;
+      },
+    };
+
+    it("counts node_modules under both roots and in-project workspace links", async () => {
+      const isDependency = await createDependencyFilePredicate("/app", fs);
+      assert(isDependency("/app/node_modules/x/index.js"));
+      assert(isDependency("/real/app/node_modules/x/index.js"));
+      assert(isDependency("/real/app/packages/linked/index.js"));
+      assert(isDependency("/real/app/packages/w/index.js"));
+      // A linked scope directory holds plain package directories.
+      assert(isDependency("/real/app/packages/ls/pkg/index.js"));
+    });
+
+    it("never counts project code, the project root or targets outside the project", async () => {
+      const isDependency = await createDependencyFilePredicate("/app", fs);
+      assert(!isDependency("/real/app/pages/api/route.ts"));
+      assert(!isDependency("/real/app/package.json"));
+      assert(!isDependency("/elsewhere/out/index.js"));
+      assert(!isDependency(""));
+    });
+
+    it("uses the given root when the project has no host directory", async () => {
+      const isDependency = await createDependencyFilePredicate("/virtual", {
+        realPath: () => Promise.reject(new Error("no host directory")),
+        readDir: fs.readDir,
+      });
+      assert(isDependency("/virtual/node_modules/x/index.js"));
+      assert(!isDependency("/virtual/pages/index.ts"));
+    });
+  });
+
+  describe("createCompiledBuiltinPlugin()", () => {
+    it("keeps built-ins external, with a required id unchanged", async () => {
+      const [builtins] = await resolveHandlers(createCompiledBuiltinPlugin(() => true));
+      assertEquals(builtins!({ path: "fs", kind: "require-call", importer: "/d/a.js" }), {
+        path: "fs",
+        external: true,
+      });
+      assertEquals(builtins!({ path: "path", kind: "import-statement", importer: "/d/a.js" }), {
+        path: "node:path",
+        external: true,
+      });
+      assertEquals(
+        builtins!({ path: "left-pad", kind: "require-call", importer: "/d/a.js" }),
+        undefined,
+      );
+    });
+
+    it("leaves other importers to the resolvers after it", async () => {
+      const [builtins] = await resolveHandlers(
+        createCompiledBuiltinPlugin((importer) => importer.includes("/node_modules/")),
+      );
+      assertEquals(
+        builtins!({ path: "fs", kind: "import-statement", importer: "/d/src/route.ts" }),
+        undefined,
+      );
+      assertEquals(
+        builtins!({ path: "fs", kind: "import-statement", importer: "/d/node_modules/p/a.js" }),
+        { path: "node:fs", external: true },
+      );
+    });
+  });
+
+  describe("createNativeAddonPlugin()", () => {
+    it("rejects a native addon once it is loaded, naming only the file", async () => {
+      assertEquals(await resolveHandlers(createNativeAddonPlugin()), []);
+      const [native] = await handlers(createNativeAddonPlugin(), "onLoad");
+      assertEquals(native!({ path: "/srv/app/node_modules/x/build/addon.node" }), {
+        errors: [{ text: 'Native addons are not supported in API routes: "addon.node"' }],
+      });
+    });
+  });
+
+  describe("createDependencyResolvePlugin()", () => {
+    const files = new Set(["/d/node_modules/p/impl.js", "/d/node_modules/p/addon.node"]);
+    const isFile = (path: string) => Promise.resolve(files.has(path));
+    const isDependency = (path: string) => path.startsWith("/d/node_modules/");
+    const args = (path: string, importer = "/d/node_modules/p/index.js") => ({
+      path,
+      importer,
+      resolveDir: importer.slice(0, importer.lastIndexOf("/")),
+      kind: "require-call",
+    });
+
+    it("resolves a dependency's relative import in Node's order", async () => {
+      const [, handler] = await resolveHandlers(
+        createDependencyResolvePlugin(isDependency, isFile),
+      );
+      assertEquals(await handler!(args("./impl")), { path: "/d/node_modules/p/impl.js" });
+      assertEquals(await handler!(args("./missing")), undefined);
+      assertEquals(await handler!(args("./impl", "/d/pages/api/route.ts")), undefined);
+    });
+
+    it("reads a backslash in a require() id as a separator where the host does", async () => {
+      const withPackage = new Set([...files, "/d/node_modules/p/dir/package.json"]);
+      const resolved: unknown[] = [];
+      const hooks: ResolveHandler[] = [];
+      const build = {
+        onResolve: (_options: unknown, handler: ResolveHandler) => hooks.push(handler),
+        onLoad: () => {},
+        onDispose: () => {},
+        resolve: (path: string, options: { kind: string }) => {
+          resolved.push([path, options.kind]);
+          return Promise.resolve({ path: "/d/node_modules/p/dir/main.js", errors: [] });
+        },
+      };
+      createDependencyResolvePlugin(
+        isDependency,
+        (path) => Promise.resolve(withPackage.has(path)),
+        "\\",
+      ).setup(build as unknown as PluginBuild);
+      const handler = hooks[1]!;
+      assertEquals(await handler(args(".\\impl")), { path: "/d/node_modules/p/impl.js" });
+      // A directory whose package.json decides goes to the bundler as a path.
+      assertEquals(
+        ((await handler(args(".\\dir"))) as { path: string }).path,
+        "/d/node_modules/p/dir/main.js",
+      );
+      assertEquals(resolved, [["./dir", "require-call"]]);
+      // An import specifier is a URL: a backslash there is part of a name.
+      assertEquals(await handler({ ...args(".\\impl"), kind: "import-statement" }), undefined);
+      const [, posix] = await resolveHandlers(
+        createDependencyResolvePlugin(isDependency, isFile, "/"),
+      );
+      assertEquals(await posix!(args(".\\impl")), undefined);
+    });
+
+    it("leaves a native addon found by Node's extension order to the loader", async () => {
+      const [, handler] = await resolveHandlers(
+        createDependencyResolvePlugin(isDependency, isFile),
+      );
+      assertEquals(await handler!(args("./addon")), { path: "/d/node_modules/p/addon.node" });
+    });
+
+    it("resolves a linked workspace package's package imports from its node_modules", async () => {
+      const calls: unknown[] = [];
+      const build = {
+        onResolve: (options: { filter: RegExp }, handler: ResolveHandler) => {
+          filters.push(options.filter);
+          registered.push(handler);
+        },
+        onLoad: () => {},
+        resolve: (path: string, options: Record<string, unknown>) => {
+          calls.push({ path, ...options });
+          // Only /d/node_modules exists, as the bundler needs.
+          return Promise.resolve(
+            path === "missing" || options.resolveDir !== "/d/node_modules"
+              ? { errors: [{ text: "Could not resolve" }] }
+              : { path: "/d/node_modules/pg/index.js", errors: [], suffix: "?q" },
+          );
+        },
+      };
+      const registered: ResolveHandler[] = [];
+      const filters: RegExp[] = [];
+      const workspace = (path: string) => path.startsWith("/d/packages/") || isDependency(path);
+      await createDependencyResolvePlugin(workspace, isFile).setup(
+        build as unknown as PluginBuild,
+      );
+      const [bare] = registered;
+      // A package's own `#import` resolves from its package.json, as before.
+      assertEquals(["pg", "@s/p", "#own", "./x", "/x"].map((id) => filters[0]!.test(id)), [
+        true,
+        true,
+        false,
+        false,
+        false,
+      ]);
+      const result = await bare!({ ...args("pg", "/d/packages/w/index.js") });
+      assertEquals((result as { path: string }).path, "/d/node_modules/pg/index.js");
+      assertEquals((result as { suffix: string }).suffix, "?q");
+      const tried = (path: string, ...dirs: string[]) =>
+        dirs.map((resolveDir) => ({
+          path,
+          kind: "require-call",
+          importer: "/d/packages/w/index.js",
+          resolveDir,
+          pluginData: { vfFromNodeModules: true },
+        }));
+      assertEquals(
+        calls,
+        tried("pg", "/d/packages/w/node_modules", "/d/packages/node_modules", "/d/node_modules"),
+      );
+      calls.length = 0;
+      assertEquals(await bare!({ ...args("missing", "/d/packages/w/index.js") }), {
+        errors: [{ text: "Could not resolve" }],
+      });
+      // Its own second resolution, files in node_modules, project code and
+      // built-ins resolve as before.
+      assertEquals(
+        await bare!({
+          ...args("pg", "/d/packages/w/index.js"),
+          pluginData: { vfFromNodeModules: true },
+        }),
+        undefined,
+      );
+      assertEquals(await bare!(args("pg")), undefined);
+      assertEquals(await bare!(args("pg", "/d/pages/api/route.ts")), undefined);
+      assertEquals(await bare!(args("fs", "/d/packages/w/index.js")), undefined);
+      assertEquals(
+        await bare!(args("data:text/javascript,1", "/d/packages/w/index.js")),
+        undefined,
+      );
+      assertEquals(
+        calls,
+        tried(
+          "missing",
+          "/d/packages/w/node_modules",
+          "/d/packages/node_modules",
+          "/d/node_modules",
+          "/node_modules",
+        ),
+      );
+    });
+  });
+
+  describe("createImportExternalsPlugin()", () => {
+    it("keeps imports of the packages external and leaves require() to the bundler", async () => {
+      const [handler] = await resolveHandlers(createImportExternalsPlugin(["dual", "@s/p.js"]));
+      for (const kind of ["import-statement", "dynamic-import"]) {
+        assertEquals(await handler!({ path: "dual/sub", kind }), {
+          path: "dual/sub",
+          external: true,
+        });
+      }
+      assertEquals(await handler!({ path: "@s/p.js", kind: "import-statement" }), {
+        path: "@s/p.js",
+        external: true,
+      });
+      assertEquals(await handler!({ path: "dual", kind: "require-call" }), undefined);
+      assertEquals(await handler!({ path: "dual", kind: "require-resolve" }), undefined);
+    });
+
+    it("bundles a dependency's nested copy instead of the project's external one", async () => {
+      // /d/node_modules/dual links to /d/store/dual; p holds its own copy.
+      const resolved: Record<string, string> = {
+        "/d/src/route.ts": "/d/store/dual/index.js",
+        "/d/node_modules/p/index.js": "/d/node_modules/p/node_modules/dual/index.js",
+        "/d/node_modules/q/index.js": "/d/store/dual/index.js",
+      };
+      const registered: ResolveHandler[] = [];
+      const seen: unknown[] = [];
+      const build = {
+        onResolve: (_options: unknown, handler: ResolveHandler) => registered.push(handler),
+        onLoad: () => {},
+        resolve: (path: string, options: { importer: string; pluginData: unknown }) => {
+          seen.push(options.pluginData);
+          const target = path === "dual/feature" || path === "dual/query"
+            ? "/d/store/dual/dist/feature.js"
+            : resolved[options.importer];
+          return Promise.resolve(
+            path === "dual/missing" || target === undefined
+              ? { errors: [{ text: "Could not resolve" }] }
+              : {
+                path: target,
+                errors: [],
+                namespace: "file",
+                suffix: path === "dual/query" ? "?mode=x" : "",
+              },
+          );
+        },
+      };
+      await createImportExternalsPlugin(["dual"], {
+        isDependencyFile: (path) => path.startsWith("/d/node_modules/"),
+        nodeModules: ["/d/node_modules", "/d/node_modules"],
+        realPath: (path) =>
+          Promise.resolve(path === "/d/node_modules/dual" ? "/d/store/dual" : path),
+      }).setup(build as unknown as PluginBuild);
+      const [handler] = registered;
+      const args = (importer: string, path = "dual") => ({
+        path,
+        importer,
+        kind: "import-statement",
+        resolveDir: importer.slice(0, importer.lastIndexOf("/")),
+      });
+      const external = { path: "dual", external: true };
+      assertEquals(await handler!(args("/d/node_modules/p/index.js")), {
+        path: "/d/node_modules/p/node_modules/dual/index.js",
+        namespace: "file",
+        suffix: "",
+        sideEffects: undefined,
+        pluginData: undefined,
+      });
+      assertEquals(await handler!(args("/d/node_modules/q/index.js")), external);
+      // A subpath names the file the package's exports map it to.
+      assertEquals(await handler!(args("/d/node_modules/q/index.js", "dual/feature")), {
+        path: "file:///d/node_modules/dual/dist/feature.js",
+        external: true,
+      });
+      // A target's query is part of the module's URL, as in Node.
+      assertEquals(await handler!(args("/d/node_modules/q/index.js", "dual/query")), {
+        path: "file:///d/node_modules/dual/dist/feature.js?mode=x",
+        external: true,
+      });
+      // Route code and the plugin's own lookup stay as before.
+      assertEquals(await handler!(args("/d/src/route.ts")), external);
+      // A copy that refuses the path fails the build, as Node would fail.
+      assertEquals(await handler!(args("/d/node_modules/p/index.js", "dual/missing")), {
+        errors: [{ text: "Could not resolve" }],
+      });
+      assertEquals(
+        await handler!({ ...args("/d/node_modules/p/index.js"), pluginData: seen[0] }),
+        undefined,
+      );
+      assertEquals(seen.length, 5);
+    });
+
+    it("registers nothing without packages", async () => {
+      assertEquals(await resolveHandlers(createImportExternalsPlugin([])), []);
+    });
+  });
+
+  describe("prepareDependencyFile() without parsing", () => {
+    const input = (contents: string, logicalPath: string, packageType?: string) => ({
+      build: {} as PluginBuild,
+      contents,
+      logicalPath,
+      resolvedPath: logicalPath,
+      packageType,
+      isDependencyFile: () => true,
+      isFile: () => Promise.resolve(false),
+    });
+
+    it("leaves a file that reads no CommonJS names and no import.meta as it is", async () => {
+      const contents = 'module.exports = exports.name = "other";';
+      for (
+        const [path, type] of [["/d/a.js"], ["/d/bin/tool"], ["/d/a.cjs", "module"], ["/d/a.ts"]]
+      ) {
+        assertEquals(await prepareDependencyFile(input(contents, path!, type)), contents);
+      }
+      const esm = 'export { x } from "./other";';
+      assertEquals(await prepareDependencyFile(input(esm, "/d/a.js", "module")), esm);
+      assertEquals(await prepareDependencyFile(input(esm, "/d/a.mjs")), esm);
+      // So do imports the bundler follows or expands: literals, and relative
+      // templates and concatenations.
+      const imports = [
+        'export const a = () => import("./a.js");',
+        "export const b = (n) => import(`./locale/${n}.js`);",
+        'export const c = (n) => import("../locale/" + n);',
+      ].join("\n");
+      assertEquals(await prepareDependencyFile(input(imports, "/d/a.mjs")), imports);
+    });
+
+    it("binds an import() the bundler cannot follow to the file", async () => {
+      const code = await bindDynamicImports(
+        'export const load = (id) => import(id, { with: { type: "json" } });\n' +
+          "export const text = 'import(id)';",
+        "/d/node_modules/p/a.mjs",
+        "file:///d/node_modules/p/a.mjs",
+      );
+      const marker = /import\((__vf_dynamic_import_\w+)\(id\), \{ with/.exec(code)?.[1];
+      assert(marker !== undefined, code);
+      // Strings are not code; the resolver is a hoisted declaration at the end.
+      assert(code.includes("export const text = 'import(id)';\nfunction " + marker), code);
+      assert(code.includes('"file:///d/node_modules/p/a.mjs"'), code);
+    });
+
+    it("prepares a file with an extension Node has no loader for as CommonJS", async () => {
+      // Node's require() runs it as CommonJS even in a `"type": "module"` scope.
+      for (const type of [undefined, "module"]) {
+        const code = await prepareDependencyFile(
+          input(
+            "module.exports = [__filename, arguments.length];",
+            "/d/node_modules/p/entry.foo",
+            type,
+          ),
+        );
+        assert(code.includes('module.exports = ["/d/node_modules/p/entry.foo", '), code);
+        assert(code.includes("return arguments;"), code);
+      }
+    });
+
+    it("gives an ES module no require binding, as Node does", async () => {
+      for (const [path, type] of [["/d/a.mjs"], ["/d/a.js", "module"], ["/d/a.mts"]]) {
+        const code = await prepareDependencyFile(
+          input("export const kind = typeof require;", path!, type),
+        );
+        const kind = new Function(
+          "require",
+          code.replace("export const kind =", "return"),
+        )(() => "route");
+        assertEquals(kind, "undefined", code);
+      }
+      // An ES module is strict: assigning the unbound name throws.
+      const assigned = await prepareDependencyFile(
+        input("export function swap() { require = () => 1; }", "/d/a.mjs"),
+      );
+      const swap = new Function(
+        '"use strict";\n' + assigned.replace("export function", "return function"),
+      )();
+      assertThrows(() => swap(), ReferenceError);
+    });
+
+    it("loads a JSON import as require()'s module unless it has a query", () => {
+      assertEquals(dependencyJsonLoad('{"a":1}', { type: "json" }).loader, "js");
+      assertEquals(dependencyJsonLoad('{"a":1}').loader, "js");
+      assertEquals(dependencyJsonLoad('\uFEFF{"a":1}', { type: "json" }, "?v=1"), {
+        contents: '{"a":1}',
+        loader: "json",
+      });
+      assertEquals(dependencyJsonLoad('{"a":1}', undefined, "?v=1").loader, "js");
+    });
+
+    it("turns dependency JSON into a CommonJS module and rejects bad JSON", () => {
+      const module = { exports: {} };
+      new Function("module", prepareDependencyJson('{"a":[1]}'))(module);
+      assertEquals(module.exports, { a: [1] });
+      assertThrows(() => prepareDependencyJson("{"), SyntaxError);
+      const bom = { exports: {} };
+      new Function("module", prepareDependencyJson('\uFEFF{"b":2}'))(bom);
+      assertEquals(bom.exports, { b: 2 });
+    });
+
+    it("leaves files that are neither JavaScript nor CommonJS alone", async () => {
+      // Node loads no `.tsx` file.
+      const contents = "export const d = __dirname;";
+      assertEquals(await prepareDependencyFile(input(contents, "/d/a.tsx")), contents);
+    });
+  });
+
+  describe("rewriteImportSpecifiers()", () => {
+    it("rewrites parsed imports and leaves strings that read like imports", async () => {
+      const code = [
+        'import a from "fs";',
+        'const later = () => import("fs");',
+        "const text = 'from \"fs\"';",
+        "const call = 'import(\"fs\")';",
+        'export * from "dep/sub";',
+      ].join("\n");
+      const probes: string[] = [];
+      const rewritten = await rewriteImportSpecifiers(code, (probe) => {
+        probes.push(probe);
+        return Promise.resolve(
+          probe.replaceAll('"fs"', '"node:fs"').replaceAll('"dep/sub"', '"file:///d/sub.js"'),
+        );
+      });
+      assertEquals(probes, ['export * from "fs";\nexport * from "dep/sub";']);
+      assertEquals(
+        rewritten,
+        [
+          'import a from "node:fs";',
+          'const later = () => import("node:fs");',
+          "const text = 'from \"fs\"';",
+          "const call = 'import(\"fs\")';",
+          'export * from "file:///d/sub.js";',
+        ].join("\n"),
+      );
+    });
+
+    it("skips a module without imports and fails closed on a lost import", async () => {
+      assertEquals(
+        await rewriteImportSpecifiers("export const a = 1;", () => Promise.reject()),
+        "export const a = 1;",
+      );
+      const error = await rewriteImportSpecifiers('import "fs";', () => Promise.resolve("")).then(
+        () => null,
+        (caught: Error) => caught.message,
+      );
+      assertEquals(error, "[API] handler build failed: import specifiers could not be rewritten");
+    });
+  });
+
+  describe("resolveLiteralCalls()", () => {
+    it("replaces resolved literal calls once per specifier and keeps the rest", async () => {
+      const asked: string[] = [];
+      const code = await resolveLiteralCalls(
+        `M("./a"); M('./a'); M("missing"); M(name); const r = M; M("x\\"y");`,
+        "M",
+        (specifier) => {
+          asked.push(specifier);
+          return Promise.resolve(specifier === "./a" ? "/d/a.js" : null);
+        },
+      );
+      assertEquals(
+        code,
+        `"/d/a.js"; "/d/a.js"; M("missing"); M(name); const r = M; M("x\\"y");`,
+      );
+      assertEquals(asked, ["./a", "missing"]);
+    });
+  });
+
+  describe("createImportMetaResolve()", () => {
+    const resolve = createImportMetaResolve(
+      "file:///app/node_modules/p/index.js",
+      ["test"],
+      (id) => (id === "fs" || id === "test" ? {} : undefined),
+    );
+
+    it("resolves URLs and relative paths against the module", () => {
+      assertEquals(resolve("./data.json"), "file:///app/node_modules/p/data.json");
+      assertEquals(resolve("../q"), "file:///app/node_modules/q");
+      assertEquals(resolve("/etc/x"), "file:///etc/x");
+      assertEquals(resolve("node:path"), "node:path");
+      assertEquals(resolve("https://example.com/a"), "https://example.com/a");
+    });
+
+    it("gives built-ins their node: id and rejects package names", () => {
+      assertEquals(resolve("fs"), "node:fs");
+      assertEquals(errorCode(() => resolve("test")), "ERR_MODULE_NOT_FOUND");
+      assertEquals(errorCode(() => resolve("left-pad")), "ERR_MODULE_NOT_FOUND");
+    });
+
+    it("rejects a POSIX file URL with a host, as Node does", () => {
+      assertEquals(errorCode(() => resolve("file://remote-host/x")), "ERR_INVALID_FILE_URL_HOST");
+      assertEquals(errorCode(() => resolve("//remote-host/x")), "ERR_INVALID_FILE_URL_HOST");
+      assertEquals(resolve("file://localhost/x"), "file:///x");
+      const windows = createImportMetaResolve(
+        "file:///C:/p/i.js",
+        [],
+        () => undefined,
+        undefined,
+        "win32",
+      );
+      assertEquals(windows("file://server/share/x"), "file://server/share/x");
+    });
+
+    it("reports a malformed package.json instead of a missing package", () => {
+      const malformed = createImportMetaResolve("file:///p/i.js", [], () => undefined, () => {
+        throw Object.assign(new Error("Invalid package config"), {
+          code: "ERR_INVALID_PACKAGE_CONFIG",
+        });
+      });
+      assertEquals(errorCode(() => malformed("pkg")), "ERR_INVALID_PACKAGE_CONFIG");
+    });
+  });
+
+  describe("createRuntimeRequire()", () => {
+    const builtins: Record<string, unknown> = {
+      fs: { kind: "fs" },
+      "node:fs": { kind: "fs" },
+      "vf-state": { loads: 0 },
+    };
+    const files: Record<string, string> = {
+      "/app/data.json": '{"a":1}',
+      "/app/link.json": "", // a link to /outside.json
+      "/app/code.js": "module.exports = 'project';",
+      "/app/node_modules/p/dialects/pg.js": [
+        "exports.base = require('../base').name;",
+        "exports.fs = require('fs').kind;",
+        "exports.file = __filename;",
+        "exports.self = this === exports;",
+      ].join("\n"),
+      "/app/node_modules/p/base.js": "#!/usr/bin/env node\nexports.name = 'base';",
+      "/app/node_modules/p/dir/index.json": '{"dir":true}',
+      "/app/node_modules/p/cycle-a.js":
+        "exports.early = 1; exports.b = require('./cycle-b').seen; exports.late = 2;",
+      "/app/node_modules/p/cycle-b.js": "exports.seen = require('./cycle-a').early;",
+      "/app/node_modules/p/throws.js": "throw new Error('boom');",
+      "/app/node_modules/p/bare.js": "require('lodash');",
+      "/app/node_modules/p/dialects/mysql.js": [
+        "exports.driver = require('driver').name;",
+        "exports.sub = require('driver/extra').name;",
+        "exports.scoped = require('@s/conds');",
+        "exports.mainOnly = require('mainonly');",
+        "exports.local = require('nested');",
+      ].join("\n"),
+      "/app/node_modules/driver/package.json": JSON.stringify({
+        exports: {
+          ".": { import: "./esm.mjs", require: "./cjs.js" },
+          "./extra": "./extra.js",
+        },
+      }),
+      "/app/node_modules/driver/cjs.js": "exports.name = 'driver';",
+      "/app/node_modules/driver/extra.js": "exports.name = 'extra';",
+      "/app/node_modules/@s/conds/package.json": JSON.stringify({
+        exports: [{ browser: "./browser.js", default: "./node.js" }],
+      }),
+      "/app/node_modules/@s/conds/node.js": "module.exports = 'conds';",
+      "/app/node_modules/mainonly/package.json": JSON.stringify({ main: "lib/entry" }),
+      "/app/node_modules/mainonly/lib/entry.js": "module.exports = 'main';",
+      "/app/node_modules/p/node_modules/nested/index.js": "module.exports = 'nested';",
+      "/app/node_modules/p/sealed.js": "require('driver/hidden');",
+      "/app/node_modules/p/split.js":
+        "require.ensure(['./base'], function (r) { exports.base = r('./base').name; });",
+      "/app/node_modules/p/meta.js": [
+        "exports.id = module.id;",
+        "exports.filename = module.filename;",
+        "exports.path = module.path;",
+        "exports.paths = module.paths;",
+        "exports.loadedDuring = module.loaded;",
+        "exports.ownRequire = module.require === require;",
+        "exports.cached = require.cache[__filename] === module;",
+      ].join("\n"),
+      "/app/node_modules/p/counter.js":
+        "var state = require('vf-state'); state.loads++; module.exports = state.loads;",
+      "/app/node_modules/p/addon.node": "",
+      "/app/node_modules/p/esm.mjs": "export {};",
+      "/app/node_modules/p/patterns.js": [
+        "exports.feature = require('patterned/feature/a');",
+        "exports.longest = require('patterned/feature/deep/b');",
+        "exports.exact = require('patterned/exact');",
+        "exports.own = require('#own');",
+        "exports.ownPattern = require('#lib/x');",
+        "exports.ownPackage = require('#dep');",
+      ].join("\n"),
+      "/app/node_modules/p/package.json": JSON.stringify({
+        imports: {
+          "#own": "./base.js",
+          "#lib/*": "./lib/*.js",
+          "#dep": "driver/extra",
+          "#outside": "../escape.js",
+          "#up": "./../sibling.js",
+          "#fallback": ["../invalid.js", "./base.js"],
+        },
+      }),
+      "/app/node_modules/p/lib/x.js": "module.exports = 'lib x';",
+      "/app/node_modules/p/no-import.js": "require('#missing');",
+      "/app/node_modules/p/escape-import.js": "require('#outside');",
+      "/app/node_modules/patterned/package.json": JSON.stringify({
+        exports: {
+          "./feature/*": "./features/*.js",
+          "./feature/deep/*": { node: "./deep/*.js" },
+          "./exact": "./exact.js",
+          "./*.js": null,
+        },
+      }),
+      "/app/node_modules/patterned/features/a.js": "module.exports = 'feature a';",
+      "/app/node_modules/patterned/deep/b.js": "module.exports = 'deep b';",
+      "/app/node_modules/patterned/exact.js": "module.exports = 'exact';",
+      "/app/node_modules/p/broken-pkg.js": "require('broken');",
+      "/app/node_modules/broken/package.json": "{",
+      "/app/node_modules/broken/index.js": "module.exports = 'broken';",
+      "/app/node_modules/p/outside-pattern.js": "require('patterned/feature/../../escape');",
+      "/app/node_modules/p/bom.json": '\uFEFF{"bom":true}',
+      "/app/node_modules/p/plugin/package.json": JSON.stringify({ main: "lib/main" }),
+      "/app/node_modules/p/plugin/lib/main.js": "module.exports = 'plugin main';",
+      "/app/node_modules/p/plugin/index.js": "module.exports = 'plugin index';",
+      "/app/node_modules/p/dirmain/package.json": JSON.stringify({ main: "lib" }),
+      "/app/node_modules/p/dirmain/lib/index.js": "module.exports = 'main dir index';",
+      "/app/node_modules/p/badmain/package.json": JSON.stringify({ main: "missing" }),
+      "/app/node_modules/p/badmain/index.js": "module.exports = 'fallback index';",
+      "/app/node_modules/p/binding.node": "",
+      "/app/node_modules/sibling.js": "module.exports = 'file beside the package';",
+      "/app/node_modules/sibling/index.js": "module.exports = 'package';",
+      "/app/node_modules/blocked/package.json": JSON.stringify({
+        exports: {
+          ".": { node: null, default: "./fallback.js" },
+          "./later": [null, "./later.js"],
+          "./escape": "./../sibling/index.js",
+          "./nested": "./node_modules/x.js",
+          "./encoded": "./%2e%2e/sibling/index.js",
+          "./empty": "./a//b.js",
+          "./ok": { import: "./esm.mjs", node: { require: "./ok.js" } },
+          "./space": "./a%20b.js",
+          "./arrinvalid": ["../invalid", "./later.js"],
+          "./query": "./ok.js?mode=x",
+          "./fragment": "./ok.js#part",
+          "./badescape": "./%E0%A4%A.js",
+        },
+      }),
+      "/app/node_modules/blocked/a b.js": "module.exports = 'space';",
+      "/app/node_modules/mixed/package.json": JSON.stringify({
+        exports: { ".": "./ok.js", default: "./ok.js" },
+      }),
+      "/app/node_modules/mixed/ok.js": "module.exports = 'ok';",
+      "/app/node_modules/pat/package.json": JSON.stringify({
+        exports: { "./feature*": "./feature*.js" },
+      }),
+      "/app/node_modules/pat/feature.js": "module.exports = 'feature';",
+      "/app/node_modules/pat/featureX.js": "module.exports = 'featureX';",
+      "/app/node_modules/p/badplug/package.json": "{",
+      "/app/node_modules/p/badplug/index.js": "module.exports = 'index';",
+      "/app/node_modules/shadow/package.json": JSON.stringify({
+        exports: { ".": "./main.js", "./sub": "./sub.js" },
+      }),
+      "/app/node_modules/shadow/main.js": "module.exports = 'top main';",
+      "/app/node_modules/shadow/sub.js": "module.exports = 'top sub';",
+      "/app/node_modules/p/node_modules/shadow/package.json": JSON.stringify({
+        exports: { ".": "./main.js" },
+      }),
+      "/app/node_modules/p/node_modules/shadow/main.js": "module.exports = 'nested main';",
+      "/app/node_modules/p/node_modules/badnested/package.json": "{",
+      "/app/node_modules/badnested/package.json": JSON.stringify({ main: "index.js" }),
+      "/app/node_modules/badnested/index.js": "module.exports = 'top';",
+      "/app/node_modules/p/shadowed.js": "module.exports = require('shadow');",
+      "/app/node_modules/p/shadow-sub.js": "require('shadow/sub');",
+      "/app/node_modules/p/bad-nested.js": "require('badnested');",
+      "/app/node_modules/esmtype/package.json": JSON.stringify({ type: "module" }),
+      "/app/node_modules/esmtype/index.js": "export default 1;",
+      "/app/node_modules/esmtype/legacy.cjs": "module.exports = 'cjs';",
+      "/app/node_modules/blocked/fallback.js": "module.exports = 'fallback';",
+      "/app/node_modules/blocked/later.js": "module.exports = 'later';",
+      "/app/node_modules/blocked/node_modules/x.js": "module.exports = 'x';",
+      "/app/node_modules/blocked/a/b.js": "module.exports = 'b';",
+      "/app/node_modules/blocked/ok.js": "module.exports = 'ok';",
+      "/app/node_modules/p/escape-imports.js": "require('#up');",
+      "/app/node_modules/linked/index.js": "module.exports = 'linked';",
+      "/app/node_modules/.store/linked/index.js": "module.exports = 'linked';",
+      "/app/node_modules/bommain/package.json": '\uFEFF{"main":"main.js"}',
+      "/app/node_modules/bommain/main.js": "module.exports = 'bom main';",
+      "/app/node_modules/badscope/package.json": "{",
+      "/app/node_modules/badscope/plugin.js": "module.exports = 'plugin';",
+      "/app/node_modules/badscope/p.cjs": "module.exports = 'cjs';",
+      "/app/node_modules/rootonly/package.json": JSON.stringify({ main: "main.js" }),
+      "/app/node_modules/rootonly/main.js": "module.exports = 'root';",
+      "/app/node_modules/p/flaky.js": "module.exports = 'read';",
+      "/app/node_modules/p/shared.js": "",
+      "/app/node_modules/p/fails.js": "",
+      "/app/node_modules/p/typed.cts": "const n: number = 2; module.exports = n;",
+      "/app/node_modules/p/typed.ts": "const t: number = 3; module.exports = t;",
+      "/app/node_modules/esmtype/typed.ts": "export default 1;",
+      "/app/node_modules/cond/package.json": JSON.stringify({
+        exports: {
+          ".": { "module-sync": "./sync.js", import: "./esm.js", require: "./cjs.js" },
+          "./q": "./cjs.js?mode=x",
+        },
+      }),
+      "/app/node_modules/cond/sync.js": "",
+      "/app/node_modules/cond/esm.js": "",
+      "/app/node_modules/cond/cjs.js": "module.exports = 'cjs';",
+      "/app/node_modules/b/package.json": JSON.stringify({ main: "index.js" }),
+      "/app/node_modules/b/index.js": "",
+    };
+    let reads = 0;
+    let unreadable = "";
+    const host: RuntimeRequireHost = {
+      // Like Deno's, it knows bare prefix-only names that Node does not.
+      getBuiltinModule: (id) => id === "test" ? { kind: "test" } : builtins[id],
+      isFile: (path) => path in files,
+      realpathSync: (path) =>
+        path === "/app/link.json"
+          ? "/outside.json"
+          : path === "/app/node_modules/linked/index.js"
+          ? "/app/node_modules/.store/linked/index.js"
+          : path,
+      readFileSync: (path) => {
+        reads++;
+        if (path === unreadable) throw new Error("EACCES");
+        return files[path]!;
+      },
+      compile: (source) =>
+        new Function(
+          "exports",
+          "require",
+          "module",
+          "__filename",
+          "__dirname",
+          source,
+        ) as ReturnType<
+          RuntimeRequireHost["compile"]
+        >,
+      isAbsolute: (path) => path.startsWith("/"),
+      relative: (from, to) =>
+        to.startsWith(from + "/") ? to.slice(from.length + 1) : to === from ? "" : "../" + to,
+      join: (...paths) => {
+        const parts: string[] = [];
+        for (const part of paths.join("/").split("/")) {
+          if (part === "..") parts.pop();
+          else if (part !== "." && part !== "") parts.push(part);
+        }
+        return "/" + parts.join("/");
+      },
+      dirname: (path) => path.slice(0, path.lastIndexOf("/")),
+      sep: "/",
+      stripTypes: (source) => source.replace(/: number/g, ""),
+      toFileUrl: (path) => "file://" + path,
+      cwd: () => "/app/node_modules/p",
+    };
+    const { require, bundled, requireFrom } = createRuntimeRequire(
+      host,
+      "/app",
+      ["test"],
+      ["/app/node_modules"],
+      "/app",
+    );
+    const asImport = { [Symbol.for("veryfront.importConditions")]: true } as {
+      paths?: unknown;
+    };
+
+    it("serves any built-in, including a computed id", () => {
+      assertEquals(require("fs"), { kind: "fs" });
+      assertEquals(require("node:" + "fs"), { kind: "fs" });
+      assertEquals(require.resolve("fs"), "fs");
+    });
+
+    it("treats a bare prefix-only name as a package", () => {
+      assertEquals(errorCode(() => require("test")), "MODULE_NOT_FOUND");
+      assertEquals(errorCode(() => require.resolve("test")), "MODULE_NOT_FOUND");
+    });
+
+    it("loads project JSON once and resolves existing project paths", () => {
+      const first = require("/app/data.json");
+      assertEquals(first, { a: 1 });
+      assert(require("/app/data.json") === first);
+      assertEquals(reads, 1);
+      assertEquals(require.resolve("/app/code.js"), "/app/code.js");
+      assertEquals(require.resolve("/app/data"), "/app/data.json");
+      assertEquals(require("/app/node_modules/p/dir"), { dir: true });
+    });
+
+    it("keeps Node's require.resolve paths API", () => {
+      const fromP = requireFrom("/app/node_modules/p");
+      // A relative entry resolves from the working directory.
+      assertEquals(
+        fromP.resolve("nested", { paths: ["."] }),
+        "/app/node_modules/p/node_modules/nested/index.js",
+      );
+      assertEquals(fromP.resolve("driver", { paths: ["/app"] }), "/app/node_modules/driver/cjs.js");
+      assertEquals(
+        errorCode(() => fromP.resolve("driver", { paths: "/app" })),
+        "ERR_INVALID_ARG_VALUE",
+      );
+      assertEquals(
+        errorCode(() => fromP.resolve("driver", { paths: [7] })),
+        "ERR_INVALID_ARG_TYPE",
+      );
+      assertEquals(fromP.resolve.paths("fs"), null);
+      assertEquals(fromP.resolve.paths("../x"), ["/app/node_modules/p"]);
+      assertEquals(fromP.resolve.paths("driver"), [
+        "/app/node_modules/p/node_modules",
+        "/app/node_modules",
+      ]);
+      assertEquals(errorCode(() => fromP.resolve.paths(7)), "ERR_INVALID_ARG_TYPE");
+    });
+
+    it("runs a dependency's JavaScript as CommonJS, once, with its own require", () => {
+      const dialect = require("/app/node_modules/p/dialects/" + "pg");
+      assertEquals(dialect, {
+        base: "base",
+        fs: "fs",
+        file: "/app/node_modules/p/dialects/pg.js",
+        self: true,
+      });
+      assert(require("/app/node_modules/p/dialects/pg.js") === dialect);
+    });
+
+    it("runs a require.ensure callback at once, at the top and in a loaded module", () => {
+      let ensured: unknown;
+      require.ensure([], (inner) => {
+        ensured = inner("fs");
+      });
+      assertEquals(ensured, { kind: "fs" });
+      assertEquals(require("/app/node_modules/p/split.js"), { base: "base" });
+    });
+
+    it("looks a package up from a loaded module, as Node's require() does", () => {
+      assertEquals(require("/app/node_modules/p/dialects/mysql.js"), {
+        driver: "driver",
+        sub: "extra",
+        scoped: "conds",
+        mainOnly: "main",
+        local: "nested",
+      });
+      assertEquals(errorCode(() => require("/app/node_modules/p/bare.js")), "MODULE_NOT_FOUND");
+      // A subpath the package does not export is its refusal, not a missing
+      // package, as in Node.
+      assertEquals(
+        errorCode(() => require("/app/node_modules/p/sealed.js")),
+        "ERR_PACKAGE_PATH_NOT_EXPORTED",
+      );
+    });
+
+    it("hands a cycle the exports so far, as Node does", () => {
+      assertEquals(require("/app/node_modules/p/cycle-a.js"), { early: 1, b: 1, late: 2 });
+    });
+
+    it("forgets a module whose body throws", () => {
+      for (let attempt = 0; attempt < 2; attempt++) {
+        let message: unknown;
+        try {
+          require("/app/node_modules/p/throws.js");
+        } catch (error) {
+          message = (error as Error).message;
+        }
+        assertEquals(message, "boom");
+      }
+    });
+
+    it("fails closed for packages, project code and paths outside the project", () => {
+      for (
+        const id of [
+          "left-pad",
+          "./missing.json",
+          "/app/code.js",
+          "/app/link.json",
+          "/app",
+          "/app/node_modules/p/bare.js",
+        ]
+      ) {
+        assertEquals(errorCode(() => require(id)), "MODULE_NOT_FOUND", String(id));
+      }
+      assertEquals(errorCode(() => require.resolve("/app/missing.js")), "MODULE_NOT_FOUND");
+      // A wrong argument is Node's TypeError, never a missing module that an
+      // optional dependency's fallback would catch.
+      for (const id of [42, undefined, null, {}, () => {}]) {
+        assertThrows(() => require(id), TypeError, 'The "id" argument must be of type string');
+        assertEquals(errorCode(() => require(id)), "ERR_INVALID_ARG_TYPE", String(id));
+        assertThrows(
+          () => require.resolve(id),
+          TypeError,
+          'The "request" argument must be of type string',
+        );
+        assertEquals(errorCode(() => require.resolve(id)), "ERR_INVALID_ARG_TYPE", String(id));
+      }
+      assertEquals(errorCode(() => require("")), "ERR_INVALID_ARG_VALUE");
+    });
+
+    it("resolves a relative id from the project root", () => {
+      assert(require("./data.json") === require("/app/data.json"));
+      assertEquals(require.resolve("./data"), "/app/data.json");
+      assertEquals(require.resolve("driver"), "/app/node_modules/driver/cjs.js");
+    });
+
+    it("gives each module Node's module object and shares one cache", () => {
+      const meta = require("/app/node_modules/p/meta.js");
+      assertEquals(meta, {
+        id: "/app/node_modules/p/meta.js",
+        filename: "/app/node_modules/p/meta.js",
+        path: "/app/node_modules/p",
+        // Within the project only.
+        paths: ["/app/node_modules/p/node_modules", "/app/node_modules"],
+        loadedDuring: false,
+        ownRequire: true,
+        cached: true,
+      });
+      const cached = require.cache["/app/node_modules/p/meta.js"] as unknown as { loaded: boolean };
+      assertEquals(cached.loaded, true);
+    });
+
+    it("reloads a module deleted from require.cache", () => {
+      const first = require("/app/node_modules/p/counter.js");
+      assertEquals(require("/app/node_modules/p/counter.js"), first);
+      delete require.cache["/app/node_modules/p/counter.js"];
+      assertEquals(require("/app/node_modules/p/counter.js"), (first as number) + 1);
+    });
+
+    it("runs a bundled file through the module cache computed requires share", () => {
+      let runs = 0;
+      const seen: unknown[] = [];
+      const body = (exports: unknown, module: { exports: unknown }) => {
+        runs++;
+        // In the cache before its body runs, as in Node: a cycle sees it.
+        seen.push(require.cache["/app/node_modules/p/shared.js"] === module);
+        seen.push(require("/app/node_modules/p/" + "shared.js") === exports);
+        module.exports = { runs };
+      };
+      const module = bundled("node_modules/p/shared.js", body)!;
+      assertEquals(module.exports, { runs: 1 });
+      assertEquals(seen, [true, true]);
+      assert(bundled("node_modules/p/shared.js", body) === module);
+      assert(require("/app/node_modules/p/shared.js") === module.exports);
+      assertEquals(runs, 1);
+      // Deleted from the cache, it runs again on its next load.
+      delete require.cache["/app/node_modules/p/shared.js"];
+      assertEquals(bundled("node_modules/p/shared.js", body)!.exports, { runs: 2 });
+      // A body that throws leaves the cache and runs again next time.
+      let fail = true;
+      const flaky = () => {
+        if (fail) throw new Error("boom");
+      };
+      assertThrows(() => bundled("node_modules/p/fails.js", flaky), Error, "boom");
+      assert(!("/app/node_modules/p/fails.js" in require.cache));
+      fail = false;
+      assert(bundled("node_modules/p/fails.js", flaky) !== null);
+      // A file a computed require loaded first is the module the bundle gets.
+      const counter = require("/app/node_modules/p/counter.js");
+      assert(bundled("node_modules/p/counter.js", body)!.exports === counter);
+      // A link is keyed by its real path; project code is the bundler's own.
+      assert(
+        bundled("node_modules/linked/index.js", () => {}) ===
+          require.cache["/app/node_modules/.store/linked/index.js"],
+      );
+      delete require.cache["/app/node_modules/.store/linked/index.js"];
+      assertEquals(bundled("src/own.js", body), null);
+      assertEquals(bundled(7, body), null);
+    });
+
+    it("reads Node's package config: BOMs, malformed scopes and root ids", () => {
+      assertEquals(require("bommain"), "bom main");
+      assertEquals(
+        errorCode(() => require("/app/node_modules/badscope/plugin.js")),
+        "ERR_INVALID_PACKAGE_CONFIG",
+      );
+      // Node reads no package type for a .cjs file.
+      assertEquals(require("/app/node_modules/badscope/p.cjs"), "cjs");
+      for (const id of ["rootonly/", "rootonly//", "rootonly/.", "rootonly/./"]) {
+        assertEquals(require(id), "root");
+      }
+      assertEquals(errorCode(() => require("rootonly/../b")), "MODULE_NOT_FOUND");
+      assertEquals(errorCode(() => require("./rootonly")), "MODULE_NOT_FOUND");
+    });
+
+    it("drops a module whose source cannot be read, so the next load reads it again", () => {
+      unreadable = "/app/node_modules/p/flaky.js";
+      assertThrows(() => require("/app/node_modules/p/flaky.js"), Error, "EACCES");
+      unreadable = "";
+      assertEquals(require("/app/node_modules/p/flaky.js"), "read");
+    });
+
+    it("strips TypeScript's types, as Node 24 does, and refuses a TypeScript module", () => {
+      assertEquals(require("/app/node_modules/p/typed.cts"), 2);
+      assertEquals(require("/app/node_modules/p/typed.ts"), 3);
+      assertEquals(
+        errorCode(() => require("/app/node_modules/esmtype/typed.ts")),
+        "ERR_REQUIRE_ESM",
+      );
+      const { require: noStrip } = createRuntimeRequire(
+        { ...host, stripTypes: undefined },
+        "/app",
+        [],
+        ["/app/node_modules"],
+      );
+      assertEquals(
+        errorCode(() => noStrip("/app/node_modules/p/typed.cts")),
+        "ERR_UNKNOWN_FILE_EXTENSION",
+      );
+    });
+
+    it("resolves with the import conditions for import.meta.resolve", () => {
+      // require() cannot run the ES module that module-sync names.
+      assertEquals(require("cond"), "cjs");
+      assertEquals(require.resolve("cond"), "/app/node_modules/cond/cjs.js");
+      assertEquals(require.resolve("cond", asImport), "file:///app/node_modules/cond/sync.js");
+      assertEquals(require.resolve("cond/q"), "/app/node_modules/cond/cjs.js");
+      assertEquals(
+        require.resolve("cond/q", asImport),
+        "file:///app/node_modules/cond/cjs.js?mode=x",
+      );
+      assertEquals(
+        requireFrom("/app/node_modules/p").resolve("#own", asImport),
+        "file:///app/node_modules/p/base.js",
+      );
+      // The import conditions apply to that call only.
+      assertEquals(require.resolve("cond"), "/app/node_modules/cond/cjs.js");
+    });
+
+    it("takes Node's paths option in require.resolve", () => {
+      assertEquals(
+        require.resolve("driver", { paths: ["/app/node_modules/p", 7, "relative"] }),
+        "/app/node_modules/driver/cjs.js",
+      );
+      assertEquals(
+        require.resolve("nested", { paths: ["/app/node_modules/p"] }),
+        "/app/node_modules/p/node_modules/nested/index.js",
+      );
+      assertEquals(
+        errorCode(() => require.resolve("nested", { paths: ["/app"] })),
+        "MODULE_NOT_FOUND",
+      );
+      assertEquals(
+        require.resolve("./base", { paths: ["/app/node_modules/p"] }),
+        "/app/node_modules/p/base.js",
+      );
+    });
+
+    it("loads a directory and an extension as Node does", () => {
+      assertEquals(require("/app/node_modules/p/bom.json"), { bom: true });
+      assertEquals(require("/app/node_modules/p/" + "plugin"), "plugin main");
+      assertEquals(require("/app/node_modules/p/dirmain"), "main dir index");
+      assertEquals(require("/app/node_modules/p/badmain"), "fallback index");
+      assertEquals(errorCode(() => require("/app/node_modules/p/binding")), "ERR_DLOPEN_FAILED");
+      assertEquals(
+        require.resolve("/app/node_modules/p/binding"),
+        "/app/node_modules/p/binding.node",
+      );
+      // A file named like the package comes first, as in Node.
+      assertEquals(require("sibling"), "file beside the package");
+    });
+
+    it("stops at a null condition and keeps package targets inside the package", () => {
+      assertEquals(require("blocked/ok"), "ok");
+      // In an array a null falls through to the next item, as in Node.
+      assertEquals(require("blocked/later"), "later");
+      // A target's escapes name the file; its query or fragment does not.
+      assertEquals(require("blocked/space"), "space");
+      assertEquals(require("blocked/query"), "ok");
+      assertEquals(require.resolve("blocked/fragment"), "/app/node_modules/blocked/ok.js");
+      // An invalid item in an array falls through too.
+      assertEquals(require("blocked/arrinvalid"), "later");
+      assertEquals(requireFrom("/app/node_modules/p")("#fallback"), { name: "base" });
+      // Node's `*` never matches the empty string.
+      assertEquals(require("pat/featureX"), "featureX");
+      assertEquals(errorCode(() => require("pat/feature")), "ERR_PACKAGE_PATH_NOT_EXPORTED");
+      // Nor does Node accept exports that mix subpaths and conditions. A
+      // directory whose package.json is malformed is an error, not absent.
+      assertEquals(errorCode(() => require("mixed")), "ERR_INVALID_PACKAGE_CONFIG");
+      assertEquals(
+        errorCode(() => require("/app/node_modules/p/badplug")),
+        "ERR_INVALID_PACKAGE_CONFIG",
+      );
+      // A null condition blocks the path; a target that leaves the package is
+      // invalid; one whose escapes Node cannot decode names no file.
+      assertEquals(errorCode(() => require("blocked")), "ERR_PACKAGE_PATH_NOT_EXPORTED");
+      for (const id of ["blocked/escape", "blocked/nested", "blocked/encoded", "blocked/empty"]) {
+        assertEquals(errorCode(() => require(id)), "ERR_INVALID_PACKAGE_TARGET", id);
+      }
+      assertEquals(errorCode(() => require("blocked/badescape")), "MODULE_NOT_FOUND");
+      assertEquals(
+        errorCode(() => require("/app/node_modules/p/escape-imports.js")),
+        "ERR_INVALID_PACKAGE_TARGET",
+      );
+      // import.meta.resolve reports a package's refusal as it is, too.
+      for (
+        const [id, code] of [
+          ["blocked", "ERR_PACKAGE_PATH_NOT_EXPORTED"],
+          ["blocked/escape", "ERR_INVALID_PACKAGE_TARGET"],
+          ["#missing", "ERR_PACKAGE_IMPORT_NOT_DEFINED"],
+          ["mixed", "ERR_INVALID_PACKAGE_CONFIG"],
+        ]
+      ) {
+        const resolveImport = createImportMetaResolve(
+          "file:///app/node_modules/p/index.mjs",
+          [],
+          () => undefined,
+          (specifier) => requireFrom("/app/node_modules/p").resolve(specifier, asImport),
+        );
+        assertEquals(errorCode(() => resolveImport(id)), code, id);
+      }
+    });
+
+    it("stops at the nearest copy of a package that refuses the path", () => {
+      assertEquals(require("/app/node_modules/p/shadowed.js"), "nested main");
+      assertEquals(
+        errorCode(() => require("/app/node_modules/p/shadow-sub.js")),
+        "ERR_PACKAGE_PATH_NOT_EXPORTED",
+      );
+      // A malformed nearest copy is Node's config error, not a missing package.
+      assertEquals(
+        errorCode(() => require("/app/node_modules/p/bad-nested.js")),
+        "ERR_INVALID_PACKAGE_CONFIG",
+      );
+      // From elsewhere the top-level copy still serves both.
+      assertEquals(require("shadow/sub"), "top sub");
+      assertEquals(require("badnested"), "top");
+    });
+
+    it("rejects a .js file its package declares an ES module", () => {
+      assertEquals(
+        errorCode(() => require("/app/node_modules/esmtype/index.js")),
+        "ERR_REQUIRE_ESM",
+      );
+      assertEquals(require("/app/node_modules/esmtype/legacy.cjs"), "cjs");
+    });
+
+    it("resolves to the real path that keys require.cache", () => {
+      const resolved = require.resolve("linked");
+      assertEquals(resolved, "/app/node_modules/.store/linked/index.js");
+      assertEquals(require("linked"), "linked");
+      assertEquals((require.cache[resolved] as { exports: unknown }).exports, "linked");
+    });
+
+    it("gives a bundled file the require of its own directory, once per directory", () => {
+      const own = requireFrom("/app/node_modules/p/dialects");
+      assert(requireFrom("/app/node_modules/p/dialects") === own);
+      assertEquals((own("./" + "pg") as { base: string }).base, "base");
+      assertEquals(own.resolve("../" + "base"), "/app/node_modules/p/base.js");
+      assertEquals(own("nested"), "nested");
+      assertEquals(errorCode(() => requireFrom(7)("./pg")), "MODULE_NOT_FOUND");
+    });
+
+    it("treats a backslash-relative id as relative where the host separator is one", () => {
+      const winFiles: Record<string, string> = {
+        "C:\\app\\node_modules\\p\\plugin.js": "module.exports = 'plugin';",
+      };
+      const win: RuntimeRequireHost = {
+        ...host,
+        isFile: (path) => path in winFiles,
+        realpathSync: (path) => path,
+        readFileSync: (path) => winFiles[path]!,
+        isAbsolute: (path) => /^[A-Z]:\\/.test(path),
+        relative: (from, to) =>
+          to.startsWith(from + "\\") ? to.slice(from.length + 1) : to === from ? "" : "..\\x",
+        join: (...paths) => {
+          const parts: string[] = [];
+          for (const part of paths.join("\\").split(/[\\/]/)) {
+            if (part === "..") parts.pop();
+            else if (part !== "." && part !== "") parts.push(part);
+          }
+          return parts.join("\\");
+        },
+        dirname: (path) => path.slice(0, path.lastIndexOf("\\")),
+        sep: "\\",
+      };
+      const { requireFrom: from } = createRuntimeRequire(win, "C:\\app", [], [
+        "C:\\app\\node_modules",
+      ]);
+      const own = from("C:\\app\\node_modules\\p\\lib");
+      assertEquals(own("..\\plugin"), "plugin");
+      assertEquals(own.resolve("..\\plugin.js"), "C:\\app\\node_modules\\p\\plugin.js");
+      // Nor can a backslash smuggle a path into a package name.
+      assertEquals(errorCode(() => own("x\\..\\..\\plugin")), "MODULE_NOT_FOUND");
+    });
+
+    it("rejects a native addon and an ES module with Node's codes", () => {
+      assertEquals(errorCode(() => require("/app/node_modules/p/addon.node")), "ERR_DLOPEN_FAILED");
+      assertEquals(errorCode(() => require("/app/node_modules/p/esm.mjs")), "ERR_REQUIRE_ESM");
+    });
+
+    it("matches exports patterns and the package's own imports", () => {
+      assertEquals(require("/app/node_modules/p/patterns.js"), {
+        feature: "feature a",
+        longest: "deep b",
+        exact: "exact",
+        own: { name: "base" },
+        ownPattern: "lib x",
+        ownPackage: { name: "extra" },
+      });
+      for (
+        const [file, code] of [
+          ["no-import", "ERR_PACKAGE_IMPORT_NOT_DEFINED"],
+          ["escape-import", "ERR_INVALID_PACKAGE_TARGET"],
+          ["outside-pattern", "MODULE_NOT_FOUND"],
+        ]
+      ) {
+        assertEquals(errorCode(() => require(`/app/node_modules/p/${file}.js`)), code, file);
+      }
+      assertEquals(
+        errorCode(() => require("/app/node_modules/p/broken-pkg.js")),
+        "ERR_INVALID_PACKAGE_CONFIG",
+      );
+    });
+
+    it("names a project path relative to the project and hides any other", () => {
+      const message = (id: string) => {
+        try {
+          require(id);
+        } catch (error) {
+          return (error as Error).message;
+        }
+      };
+      assertEquals(message("/app/code.js"), 'Cannot find module "code.js"');
+      assertEquals(
+        message("/app/link.json"),
+        'Cannot find module "a path outside this project or missing"',
+      );
+    });
+  });
+
+  describe("prependRuntimeRequire()", () => {
+    // A name clash makes the bundler parse the bundle; its service must stop.
+    afterEach(async () => {
+      await stopBundler();
+    });
+
+    it("binds require to the runtime require with the host built-ins", async () => {
+      const code = await prependRuntimeRequire("export {};\n", "/app", ["/app/node_modules"], "/w");
+      assert(code.includes(createRuntimeRequire.toString()), code);
+      assert(code.includes('import __vf_runtime_process from "node:process";'), code);
+      assert(
+        code.includes(
+          '}, "/app", ["test","test/reporters","sqlite","sea"], ["/app/node_modules"], "/w");',
+        ),
+        code,
+      );
+      assert(
+        code.includes(
+          "const { require, bundled: __vf_runtime_bundled, requireFrom: __vf_runtime_require_from } = (",
+        ),
+        code,
+      );
+      assert(code.endsWith("\nexport {};\n"), code);
+    });
+
+    it("keeps a hashbang on the first line", async () => {
+      const code = await prependRuntimeRequire(
+        "#!/usr/bin/env node\nexport {};\n",
+        "/app",
+        [],
+        "/",
+      );
+      assert(code.startsWith("#!/usr/bin/env node\nimport __vf_runtime_process from "), code);
+    });
+
+    it("picks helper names the bundle does not already use", async () => {
+      const code = await prependRuntimeRequire("const __vf_runtime_fs = 1;\n", "/app", [], "/");
+      assert(code.includes("import * as __vf_runtime___fs from"), code);
+    });
+
+    it("renames the helper calls dependency preparation wrote", async () => {
+      const bundled = 'var r = __vf_require_from("/app/node_modules/p")("./x");';
+      const code = await prependRuntimeRequire(bundled, "/app", [], "/");
+      const body = code.slice(code.indexOf("var r = "));
+      assert(!/\b__vf_require_from\b/.test(body), body);
+      assert(body.includes('__vf_runtime_require_from("/app/node_modules/p")'), body);
+    });
+
+    it("keeps a route's own declaration of the helper name and still binds the helper", async () => {
+      const bundled = [
+        "const __vf_require_from = (id) => 'route:' + id;",
+        "export const own = __vf_require_from('a');",
+      ].join("\n");
+      const code = await prependRuntimeRequire(bundled, "/app", [], "/");
+      // It must parse: a clashing prologue binding is a redeclaration error.
+      // (Bun cannot import a data URL this long, so the check parses it.)
+      await transform(code, { loader: "js", format: "esm", logLevel: "silent" });
+      // The route keeps its own name; the prologue binds the helper elsewhere.
+      const text = code.replaceAll('"', "'");
+      assert(text.includes("const __vf_require_from = (id) => 'route:' + id;"));
+      assert(text.includes("own = __vf_require_from('a')"), text);
+      assert(/requireFrom: (\w+)/.exec(text)?.[1] !== "__vf_require_from");
+    });
+
+    // esbuild 0.28 prints its CommonJS helper like this.
+    const helper = (inner: string, error = "e") =>
+      [
+        `var __commonJS = (cb, mod) => function ${inner}() {`,
+        "  try {",
+        "    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;",
+        `  } catch (${error}) {`,
+        `    throw mod = 0, ${error};`,
+        "  }",
+        "};",
+      ].join("\n");
+
+    it("runs bundled CommonJS files through the runtime module cache", async () => {
+      // A direct eval in the bundle makes the bundler rename the helper's locals.
+      for (const [inner, error] of [["__require", "e"], ["__require2", "e2"]]) {
+        const code = await prependRuntimeRequire(helper(inner!, error) + "\n", "/app", [], "/w");
+        assert(code.includes(`  } catch (${error}) {\n    throw mod = 0, ${error};`), code);
+        assert(code.includes(`var __commonJS = (cb, mod) => function ${inner}() {`), code);
+        assert(code.includes("const managed = __vf_runtime_bundled(key, cb[key]);"), code);
+        // A file the runtime does not manage keeps the bundler's own cache.
+        assert(code.includes("return mod || (0, cb[key])((mod = { exports: {} })"), code);
+      }
+    });
+
+    it("fails the build on a CommonJS helper it does not know", async () => {
+      await assertRejects(
+        () =>
+          prependRuntimeRequire(
+            "var __commonJS = (cb, mod) => () => mod || cb();\n",
+            "/app",
+            [],
+            "/",
+          ),
+        Error,
+        "unexpected CommonJS helper",
+      );
+    });
+  });
+
+  describe("parsing dependency files", () => {
+    // The bundler parses each file; its service process must not outlive a test.
+    afterEach(async () => {
+      await stopBundler();
+    });
+
+    const resolveRelative = (specifier: string) =>
+      Promise.resolve(specifier.startsWith("./") ? "/d/p/" + specifier.slice(2) + ".js" : null);
+
+    describe("prepareCommonJSFile()", () => {
+      it("gives top-level arguments Node's five wrapper arguments", async () => {
+        const code = await prepareCommonJSFile(
+          [
+            '"use strict";',
+            "exports.req = arguments[1];",
+            "exports.rest = [arguments.length, arguments[3], arguments[4]];",
+            "exports.inner = (function () { return arguments[0]; })('own');",
+            "exports.arrow = (() => arguments[2] === module)();",
+          ].join("\n"),
+          "/d/p/index.js",
+          undefined,
+          () => Promise.resolve(null),
+        );
+        assert(code !== null);
+        assert(code.startsWith('"use strict";\nvar __vf_arguments_'), code);
+        const module = { exports: {} as Record<string, unknown> };
+        const requireFrom = (directory: string) => ({ directory });
+        new Function("exports", "module", "__vf_require_from", code)(
+          module.exports,
+          module,
+          requireFrom,
+        );
+        assertEquals(module.exports, {
+          req: { directory: "/d/p" },
+          rest: [5, "/d/p/index.js", "/d/p"],
+          inner: "own",
+          arrow: true,
+        });
+      });
+
+      it("throws a SyntaxError when a file Node parses as CommonJS has ES module syntax", async () => {
+        const esm = "export const a = __dirname;";
+        for (const [path, type] of [["/d/p/a.cjs"], ["/d/p/a.js", "commonjs"], ["/d/p/a.cts"]]) {
+          const code = await prepareCommonJSFile(esm, path!, type, () => Promise.resolve(null));
+          assert(code !== null, path);
+          assertThrows(() => new Function(code)(), SyntaxError, "uses ES module syntax", path);
+        }
+        // Without a declared type, the syntax decides, as Node's detection does.
+        assertEquals(
+          await prepareCommonJSFile(esm, "/d/p/a.js", undefined, () => Promise.resolve(null)),
+          null,
+        );
+      });
+
+      it("binds __dirname and __filename and resolves require.resolve literals", async () => {
+        const code = await prepareCommonJSFile(
+          [
+            "exports.d = __dirname;",
+            "exports.f = __filename;",
+            'exports.a = require.resolve("./a");',
+            'exports.b = require.resolve("fs");',
+            'exports.c = require.resolve("missing");',
+            "exports.e = require.resolve(name);",
+            'exports.g = require("./g");',
+            "exports.h = require(`./h`);",
+            'exports.i = require("./dialects/" + name);',
+            "exports.j = typeof require;",
+            "exports.k = function (require) { return require(name); };",
+          ].join("\n"),
+          "/d/p/index.cjs",
+          "module",
+          resolveRelative,
+        );
+        assert(code !== null);
+        for (
+          const part of [
+            'exports.d = "/d/p";',
+            'exports.f = "/d/p/index.cjs";',
+            'exports.a = "/d/p/a.js";',
+            'exports.b = "fs";',
+            'exports.c = (__vf_require_from("/d/p", module)).resolve("missing");',
+            'exports.e = (__vf_require_from("/d/p", module)).resolve(name);',
+            'exports.g = __vf_require_from("/d/p", module, true)(require("./g"));',
+            'exports.h = __vf_require_from("/d/p", module, true)(require("./h"));',
+            'exports.i = (__vf_require_from("/d/p", module))("./dialects/" + name);',
+            'exports.j = typeof (__vf_require_from("/d/p", module));',
+            "return require2(name);",
+          ]
+        ) {
+          assert(code.includes(part), code);
+        }
+      });
+
+      it("declares the CommonJS names in a file a direct eval may read", async () => {
+        const code = await prepareCommonJSFile(
+          [
+            '"use strict";',
+            'exports.p = eval("require")("./p");',
+            'exports.s = require("./s");',
+            'exports.d = eval("__dirname");',
+          ].join("\n"),
+          "/d/p/index.cjs",
+          undefined,
+          resolveRelative,
+        );
+        assert(code !== null);
+        assert(
+          code.startsWith(
+            '"use strict";\nvar require = (__vf_require_from("/d/p", module)), __dirname = "/d/p", ' +
+              '__filename = "/d/p/index.cjs";\n',
+          ),
+          code,
+        );
+        assert(code.includes('exports.s = require("./s");'), code);
+        const hashbang = await prepareCommonJSFile(
+          '#!/usr/bin/env node\neval("x");',
+          "/d/p/bin.cjs",
+          undefined,
+          resolveRelative,
+        );
+        assert(hashbang?.startsWith("#!/usr/bin/env node\nvar require = "), String(hashbang));
+        // Every direct spelling counts; the indirect ones see globals in Node too.
+        for (const direct of ['(eval)("require")', 'eval /* c */ ("__dirname")', "((eval))(x)"]) {
+          const spelled = await prepareCommonJSFile(
+            `module.exports = ${direct};`,
+            "/d/p/index.cjs",
+            undefined,
+            resolveRelative,
+          );
+          assert(spelled?.startsWith("var require = "), String(spelled));
+        }
+        for (const indirect of ['(0, eval)("x")', 'eval?.("x")', 'obj.eval("x")']) {
+          const spelled = await prepareCommonJSFile(
+            `module.exports = [${indirect}, __filename];`,
+            "/d/p/index.cjs",
+            undefined,
+            resolveRelative,
+          );
+          assert(!spelled?.includes("var require = "), String(spelled));
+        }
+      });
+
+      it("prepares an extensionless file and a .js file outside a module package", async () => {
+        const entry = await prepareCommonJSFile(
+          "exports.d = __dirname;",
+          "/d/p/entry",
+          "module",
+          resolveRelative,
+        );
+        assert(entry?.includes('exports.d = "/d/p";'), String(entry));
+        const js = await prepareCommonJSFile(
+          "exports.d = __dirname;",
+          "/d/p/a.js",
+          undefined,
+          resolveRelative,
+        );
+        assert(js?.includes('exports.d = "/d/p";'), String(js));
+      });
+
+      it("prepares a .jsx file as Node's .js loader would", async () => {
+        const code = await prepareCommonJSFile(
+          "exports.d = __dirname;",
+          "/d/p/view.jsx",
+          undefined,
+          resolveRelative,
+        );
+        assert(code?.includes('exports.d = "/d/p";'), String(code));
+      });
+
+      it("prepares a .ts file by its package type and syntax, as Node 24 loads it", async () => {
+        const commonJS = await prepareCommonJSFile(
+          "const n: number = 1;\nexports.d = __dirname + n;",
+          "/d/p/index.ts",
+          undefined,
+          resolveRelative,
+        );
+        assert(commonJS?.includes('exports.d = "/d/p" + n;'), String(commonJS));
+        assertEquals(
+          await prepareCommonJSFile(
+            "exports.d = __dirname;",
+            "/d/p/index.ts",
+            "module",
+            resolveRelative,
+          ),
+          null,
+        );
+        assertEquals(
+          await prepareCommonJSFile(
+            "export const d: string = __dirname;",
+            "/d/p/esm.ts",
+            undefined,
+            resolveRelative,
+          ),
+          null,
+        );
+      });
+
+      it("prepares a .cts file as CommonJS TypeScript", async () => {
+        const code = await prepareCommonJSFile(
+          "const d: string = __dirname;\nexports.d = d;",
+          "/d/p/index.cts",
+          "module",
+          resolveRelative,
+        );
+        assert(code?.includes('const d = "/d/p";'), String(code));
+      });
+
+      it("leaves files Node loads as ESM alone", async () => {
+        const source = "export const d = typeof __dirname;";
+        assertEquals(
+          await prepareCommonJSFile(source, "/d/p/a.js", "module", resolveRelative),
+          null,
+        );
+        assertEquals(
+          await prepareCommonJSFile(source, "/d/p/a.js", undefined, resolveRelative),
+          null,
+        );
+        assertEquals(
+          await prepareCommonJSFile(source, "/d/p/entry", undefined, resolveRelative),
+          null,
+        );
+        assertEquals(
+          await prepareCommonJSFile(source, "/d/p/a.mjs", undefined, resolveRelative),
+          null,
+        );
+      });
+    });
+
+    describe("prepareModuleFile()", () => {
+      it("makes import.meta locations constants and resolves literals", async () => {
+        const code = await prepareModuleFile(
+          'export const u = import.meta.url;\nexport const f = import.meta.filename;\nexport const d = import.meta.dirname;\nexport const a = import.meta.resolve("./a");\n',
+          "/d/p/index.mjs",
+          resolveRelative,
+        );
+        for (
+          const part of [
+            'u = "file:///d/p/index.mjs"',
+            'f = "/d/p/index.mjs"',
+            'd = "/d/p"',
+            'a = "/d/p/a.js"',
+          ]
+        ) {
+          assert(code.includes(part), code);
+        }
+        assert(!code.includes("function __vf_import_meta_resolve_"), code);
+      });
+
+      it("yields the same output for the same file", async () => {
+        const source = "export const r = import.meta.resolve(name);\n";
+        assertEquals(
+          await prepareModuleFile(source, "/d/p/a.mjs", resolveRelative),
+          await prepareModuleFile(source, "/d/p/a.mjs", resolveRelative),
+        );
+      });
+
+      it("binds other uses to a resolver of the file, after any hashbang", async () => {
+        const code = await prepareModuleFile(
+          "#!/usr/bin/env node\nconst meta = import.meta;\nexport const r = import.meta.resolve(name);\nexport const m = meta;\n",
+          "/d/p/cli.ts",
+          resolveRelative,
+        );
+        assert(code.startsWith("#!/usr/bin/env node\nfunction __vf_import_meta_resolve_"), code);
+        assert(code.includes(createImportMetaResolve.toString()), code);
+        assert(
+          // Node's shape: a null prototype, its keys in order, `main` false.
+          /const (__vf_import_meta_resolve_\w+)_meta = \{ __proto__: null, dirname: "\/d\/p", filename: "\/d\/p\/cli\.ts", main: false, resolve: \1, url: "file:\/\/\/d\/p\/cli\.ts" \};/
+            .test(code),
+          code,
+        );
+      });
+    });
+
+    describe("prepareDependencyFile()", () => {
+      const resolved: Record<
+        string,
+        { path?: string; external?: boolean; errors?: unknown[]; suffix?: string }
+      > = {
+        "./a": { path: "/d/node_modules/p/a.js" },
+        "pkg/q": { path: "/d/node_modules/pkg/q.js", suffix: "?mode=x" },
+        pkg: { path: "/d/node_modules/pkg/main.js" },
+        ext: { path: "ext", external: true },
+        project: { path: "/d/src/project.js" },
+        broken: { errors: [{ text: "x" }] },
+      };
+      const build = {
+        resolve: (specifier: string) => Promise.resolve(resolved[specifier] ?? { errors: [{}] }),
+      } as unknown as PluginBuild;
+      const input = (contents: string, logicalPath: string, withResolve = true) => ({
+        build: withResolve ? build : ({} as PluginBuild),
+        contents,
+        logicalPath,
+        resolvedPath: logicalPath,
+        packageType: undefined,
+        isDependencyFile: (path: string) => path.startsWith("/d/node_modules/"),
+        isFile: () => Promise.resolve(false),
+      });
+
+      it("resolves require.resolve literals only to dependency files", async () => {
+        const code = await prepareDependencyFile(
+          input(
+            ["./a", "ext", "project", "broken"].map((id) =>
+              `require.resolve(${JSON.stringify(id)});`
+            )
+              .join("\n"),
+            "/d/node_modules/p/index.js",
+          ),
+        );
+        for (
+          const part of [
+            '"/d/node_modules/p/a.js";',
+            '(__vf_require_from("/d/node_modules/p", module)).resolve("ext");',
+            '(__vf_require_from("/d/node_modules/p", module)).resolve("project");',
+            '(__vf_require_from("/d/node_modules/p", module)).resolve("broken");',
+          ]
+        ) {
+          assert(code.includes(part), code);
+        }
+        const unresolved = await prepareDependencyFile(
+          input('require.resolve("./a");', "/d/node_modules/p/index.js", false),
+        );
+        assert(
+          unresolved.includes('(__vf_require_from("/d/node_modules/p", module)).resolve("./a");'),
+          unresolved,
+        );
+      });
+
+      it("parses a file whose only CommonJS name is a computed require", async () => {
+        const computed = await prepareDependencyFile(
+          input('module.exports = require("./dialects/" + name);', "/d/node_modules/p/index.js"),
+        );
+        assert(
+          computed.includes(
+            '(__vf_require_from("/d/node_modules/p", module))("./dialects/" + name)',
+          ),
+          computed,
+        );
+        // A direct eval may read a name the text never spells out.
+        const evaluated = await prepareDependencyFile(
+          input('exports.d = eval("__dir" + "name");', "/d/node_modules/p/index.js"),
+        );
+        assert(evaluated.includes('__dirname = "/d/node_modules/p"'), evaluated);
+        const parenthesized = await prepareDependencyFile(
+          input('exports.d = (eval)("__dir" + "name");', "/d/node_modules/p/index.js"),
+        );
+        assert(parenthesized.includes('__dirname = "/d/node_modules/p"'), parenthesized);
+        // An assignment to require keeps the name, which stays a valid target.
+        const assigned = await prepareDependencyFile(
+          input(
+            'require = require("esm")(module);\nmodule.exports = require(name);',
+            "/d/node_modules/p/index.js",
+          ),
+        );
+        // The file assigns its own binding, never the route's.
+        assert(assigned.includes('require = require("esm")(module);'), assigned);
+        assert(assigned.includes("module.exports = require(name);"), assigned);
+        assert(
+          assigned.includes('var require = (__vf_require_from("/d/node_modules/p", module));'),
+          assigned,
+        );
+        for (const operator of ["||=", "&&=", "??=", "+="]) {
+          const compound = await prepareDependencyFile(
+            input(`require ${operator} wrap(require);`, "/d/node_modules/p/index.js"),
+          );
+          assert(compound.includes("var require = "), compound);
+        }
+        // A comparison is not an assignment.
+        const compared = await prepareDependencyFile(
+          input("module.exports = require == null;", "/d/node_modules/p/index.js"),
+        );
+        assert(!compared.includes("var require = "), compared);
+        // A file that reads only `arguments`, or a CommonJS file with only
+        // ES module syntax, is parsed too.
+        const args = await prepareDependencyFile(
+          input("module.exports = arguments.length;", "/d/node_modules/p/index.js"),
+        );
+        assert(args.includes("return arguments;"), args);
+        const forced = await prepareDependencyFile(
+          input("export default 1;", "/d/node_modules/p/index.cjs"),
+        );
+        assert(forced.includes("SyntaxError"), forced);
+        // Literal calls stay for the bundler, each marked as this module's
+        // own, so one a callback makes later still names it as the parent.
+        const literal = "module.exports = [require(\"./a\"), require( 'b' )];";
+        assertEquals(
+          await prepareDependencyFile(input(literal, "/d/node_modules/p/index.js")),
+          'module.exports = [__vf_require_from("/d/node_modules/p", module, true)(require("./a")), ' +
+            '__vf_require_from("/d/node_modules/p", module, true)(require("b"))];\n',
+        );
+        // An ES module's literal require stays for the bundler, as it was.
+        const mixed = 'import x from "./x";\nexport default [x, require("./other")];';
+        assertEquals(await prepareDependencyFile(input(mixed, "/d/node_modules/p/a.js")), mixed);
+      });
+
+      it("resolves import.meta.resolve literals in an ESM file", async () => {
+        const code = await prepareDependencyFile(
+          input(
+            ["fs", "./x.js", "https://e.test/m.js", "pkg", "ext", "pkg/q"].map((id) =>
+              `import.meta.resolve(${JSON.stringify(id)});`
+            ).join("\n"),
+            "/d/node_modules/p/index.mjs",
+          ),
+        );
+        for (
+          const part of [
+            '"node:fs";',
+            '"file:///d/node_modules/p/x.js";',
+            '"https://e.test/m.js";',
+            '"file:///d/node_modules/pkg/main.js";',
+            // A package target's query stays in the URL, as in Node.
+            '"file:///d/node_modules/pkg/q.js?mode=x";',
+            "_resolve_",
+          ]
+        ) {
+          assert(code.includes(part), code);
+        }
+      });
+
+      it("leaves an ESM file that reads no import.meta unchanged", async () => {
+        const contents = "export const d = typeof __dirname;";
+        assertEquals(
+          await prepareDependencyFile(input(contents, "/d/node_modules/p/a.mjs")),
+          contents,
+        );
+      });
+    });
+  });
+});
diff --git a/src/routing/api/module-loader/compiled-cjs-bundling.ts b/src/routing/api/module-loader/compiled-cjs-bundling.ts
new file mode 100644
index 0000000000..3b8987533b
--- /dev/null
+++ b/src/routing/api/module-loader/compiled-cjs-bundling.ts
@@ -0,0 +1,2023 @@
+/**
+ * CommonJS dependencies of an API route in the compiled binary.
+ *
+ * A compiled binary cannot load a CommonJS file from disk at runtime: Deno's
+ * `require` there reads only the files embedded at compile time, and importing
+ * a `.cjs` file evaluates it as ESM. So the route build bundles a project's
+ * CommonJS dependencies into the route module itself, and esbuild supplies Node
+ * resolution and interop. These pieces keep the bundled code runnable:
+ *
+ * - A `require()` of a built-in stays external. esbuild emits it as a call to
+ *   the module's free `require`, which {@link prependRuntimeRequire} binds to
+ *   built-ins imported statically, so nothing loads `node:module` at runtime.
+ * - {@link prepareCommonJSFile} parses each dependency file once. A CommonJS
+ *   file gets `__dirname` and `__filename` as constants wherever it reads them
+ *   unbound, and each `require.resolve("literal")` becomes the path Node would
+ *   return. What is left for runtime, a computed `require()` or
+ *   `require.resolve()`, gets built-ins, existing project paths and JSON files;
+ *   anything else throws `MODULE_NOT_FOUND`.
+ * - Inside dependencies, an extensionless `require()` prefers the file Node
+ *   would load ({@link createDependencyResolvePlugin}), not a TypeScript
+ *   sibling the project's own resolution would pick.
+ * - A native addon cannot be bundled or loaded; the build rejects it with a
+ *   clear message rather than an esbuild loader error.
+ *
+ * @module routing/api/module-loader/compiled-cjs-bundling
+ */
+import { builtinModules } from "node:module";
+import { build as bundle, transform } from "veryfront/extensions/bundler";
+import type { Plugin, PluginBuild } from "veryfront/extensions/bundler";
+import * as pathHelper from "#veryfront/compat/path";
+import { isWithinDirectory } from "#veryfront/security/path-validation.ts";
+import {
+  parseImports,
+  parseMaskedImports,
+  replaceSpecifiers,
+} from "#veryfront/transforms/esm/lexer.ts";
+
+// Names Node accepts only with the `node:` prefix. A bare `test` is an npm package.
+const PREFIX_ONLY_BUILTINS = new Set(["test", "test/reporters", "sqlite", "sea"]);
+// Names Node accepts without the prefix.
+const BUILTINS = new Set(
+  builtinModules
+    .map((name) => name.replace(/^node:/, ""))
+    .filter((name) => !PREFIX_ONLY_BUILTINS.has(name)),
+);
+
+/** The built-in module a specifier names, without its `node:` prefix. */
+export function builtinModuleName(specifier: string): string | undefined {
+  if (specifier.startsWith("node:")) {
+    const name = specifier.slice(5);
+    return BUILTINS.has(name) || PREFIX_ONLY_BUILTINS.has(name) ? name : undefined;
+  }
+  return BUILTINS.has(specifier) ? specifier : undefined;
+}
+
+const NATIVE_ADDON = /\.node$/i;
+
+/**
+ * `value` as a JavaScript string literal for generated code: JSON, with the
+ * characters that could end a surrounding script or line escaped as well.
+ */
+export function codeString(value: string): string {
+  return JSON.stringify(value).replace(
+    /[<>\u2028\u2029]/g,
+    (character) => "\\u" + character.charCodeAt(0).toString(16).padStart(4, "0"),
+  );
+}
+
+// Names only the file, never the host path.
+function nativeAddonError(path: string) {
+  return {
+    errors: [{
+      text: `Native addons are not supported in API routes: ${
+        JSON.stringify(pathHelper.basename(path))
+      }`,
+    }],
+  };
+}
+
+/**
+ * Keeps built-ins external for the importers `appliesTo` accepts. A
+ * `require()` of one keeps its id, for the runtime `require` of
+ * {@link prependRuntimeRequire}. A dependency's built-ins must be claimed
+ * before the project's import map, which does not apply to it; project code's
+ * after it, so that a project can map a built-in name to its own module.
+ */
+export function createCompiledBuiltinPlugin(appliesTo: (importer: string) => boolean): Plugin {
+  return {
+    name: "vf-compiled-builtins",
+    setup(build) {
+      build.onResolve({ filter: /.*/ }, (args) => {
+        const name = builtinModuleName(args.path);
+        if (name === undefined || !appliesTo(args.importer)) return undefined;
+        if (args.kind === "require-call") return { path: args.path, external: true };
+        return { path: `node:${name}`, external: true };
+      });
+    },
+  };
+}
+
+/**
+ * Fails the build on a native addon once a path resolves to one: a package
+ * whose name ends in `.node` is fine. Must run before any plugin that loads
+ * files itself.
+ */
+export function createNativeAddonPlugin(): Plugin {
+  return {
+    name: "vf-native-addons",
+    setup(build) {
+      build.onLoad({ filter: NATIVE_ADDON }, (args) => nativeAddonError(args.path));
+    },
+  };
+}
+
+/**
+ * Resolution options of a compiled-binary route build. Bundled packages read
+ * the `node` and `module-sync` conditions and `main`, as Node 24 does; Node
+ * never reads `module`. `node-addons` stays off, as under Node's `--no-addons`:
+ * the compiled binary cannot load a native addon, so a package's universal
+ * entry is the one it can run.
+ * The extension order serves project code, and
+ * {@link createDependencyResolvePlugin} restores Node's order inside packages.
+ */
+export const COMPILED_RESOLVE_OPTIONS = {
+  mainFields: ["main"],
+  conditions: ["node", "module-sync"],
+  resolveExtensions: [".ts", ".tsx", ".js", ".jsx", ".mjs", ".json"],
+};
+
+/** Whether a path is a regular file on the host. */
+export type IsFile = (path: string) => Promise<boolean>;
+
+// Extensions Node's require() tries, in order, for an extensionless path.
+const NODE_REQUIRE_EXTENSIONS = [".js", ".json", ".node"];
+
+/**
+ * The file Node would load for a relative or absolute import that the bundler
+ * resolved to `resolvedPath`. The bundler's extension order serves project
+ * code and puts TypeScript first. When it added an extension Node's require()
+ * does not try, to the path or to its directory's `index`, Node's own
+ * candidates for the same stem win. A path the import named exactly, or one a
+ * package's `exports` or `main` chose, is kept.
+ */
+export async function nodePreferredFile(
+  resolvedPath: string,
+  specifier: string,
+  resolveDir: string,
+  isFile: IsFile,
+  sep: string = pathHelper.sep,
+): Promise<string> {
+  specifier = requirePath(specifier, sep);
+  const relative = specifier.startsWith("./") || specifier.startsWith("../") ||
+    specifier === "." || specifier === ".." || pathHelper.isAbsolute(specifier);
+  const extension = pathHelper.extname(resolvedPath);
+  // An extensionless path is the file the import named exactly; Node checks it first.
+  if (!relative || extension === "" || NODE_REQUIRE_EXTENSIONS.includes(extension)) {
+    return resolvedPath;
+  }
+  const stem = resolvedPath.slice(0, resolvedPath.length - extension.length);
+  const named = pathHelper.resolve(resolveDir, specifier);
+  if (stem !== named && stem !== pathHelper.join(named, "index")) return resolvedPath;
+  for (const candidate of NODE_REQUIRE_EXTENSIONS) {
+    if (await isFile(stem + candidate)) return stem + candidate;
+  }
+  return resolvedPath;
+}
+
+const RELATIVE_SPECIFIER = /^(?:\.\.?(?:\/|$)|\/)/;
+// Also a Windows path relative to the importer; see requirePath().
+const RELATIVE_REQUIRE_FILTER = /^(?:\.\.?(?:[\\/]|$)|\/)/;
+
+/**
+ * A `require()` id with Windows separators written as `/` when the host
+ * separates paths with a backslash, where Node's require() reads `.\\x` as
+ * relative. Elsewhere, and for ES module specifiers, which are URLs, a
+ * backslash is part of a name.
+ */
+export function requirePath(specifier: string, sep: string = pathHelper.sep): string {
+  return sep === "\\" && /^\.\.?\\/.test(specifier) ? specifier.replaceAll("\\", "/") : specifier;
+}
+// A package name: not a path and not a package's own `#import`, which
+// resolves from the importer's package. A URL is told apart in the handler
+// (the bundler's filters are Go regular expressions, without lookahead).
+const BARE_SPECIFIER = /^[^./#]/;
+const URL_SPECIFIER = /^[a-z][a-z0-9+.-]*:/i;
+const LITERAL_REQUIRE_CALL = /\brequire\s*\(\s*(["'])[^"'\\\n]*\1\s*\)/g;
+const IN_NODE_MODULES = /[\\/]node_modules[\\/]/;
+const FROM_NODE_MODULES = "vfFromNodeModules";
+
+/**
+ * The file Node's require() loads for a relative or absolute extensionless
+ * import, when that may differ from the bundler's pick: the path plus `.js`,
+ * `.json` or `.node`, or its directory's `index` with one of them. Null when
+ * the bundler picks the same file: the path names an existing file exactly,
+ * it is a package directory whose `main` decides, or Node finds nothing.
+ */
+export async function nodeRelativeFile(
+  specifier: string,
+  resolveDir: string,
+  isFile: IsFile,
+): Promise<string | null> {
+  if (!RELATIVE_SPECIFIER.test(specifier)) return null;
+  const base = pathHelper.resolve(resolveDir, specifier);
+  if (await isFile(base)) return null;
+  for (const extension of NODE_REQUIRE_EXTENSIONS) {
+    if (await isFile(base + extension)) return base + extension;
+  }
+  if (await isFile(pathHelper.join(base, "package.json"))) return null;
+  for (const extension of NODE_REQUIRE_EXTENSIONS) {
+    const index = pathHelper.join(base, "index" + extension);
+    if (await isFile(index)) return index;
+  }
+  return null;
+}
+
+/**
+ * Resolves the imports of dependency files the way Node does. The bundler's
+ * extension order serves project code and would load a TypeScript sibling
+ * first, so relative imports are probed in Node's order, with a few file
+ * checks and no second resolution. Package imports of a linked workspace
+ * package skip the project's tsconfig `paths`. Must run after
+ * {@link createCompiledBuiltinPlugin} and before the project's own resolvers.
+ */
+export function createDependencyResolvePlugin(
+  isDependencyFile: (path: string) => boolean,
+  isFile: IsFile,
+  sep: string = pathHelper.sep,
+): Plugin {
+  return {
+    name: "vf-dependency-resolve",
+    setup(build) {
+      // A workspace package linked from node_modules lives outside it, where
+      // the bundler would apply the project's tsconfig `paths` to its package
+      // imports. Resolving from its own node_modules directory instead looks
+      // packages up as Node does, and the bundler applies no tsconfig there.
+      build.onResolve({ filter: BARE_SPECIFIER }, async (args) => {
+        const data = args.pluginData as Record<string, unknown> | undefined;
+        if (data?.[FROM_NODE_MODULES] === true || !build.resolve) return undefined;
+        if (!args.importer || !isDependencyFile(args.importer)) return undefined;
+        if (
+          IN_NODE_MODULES.test(args.importer) || URL_SPECIFIER.test(args.path) ||
+          builtinModuleName(args.path) !== undefined
+        ) {
+          return undefined;
+        }
+        // The bundler needs a directory that exists; from the nearest
+        // `node_modules` it looks further up itself, as Node does.
+        let result: Awaited<ReturnType<NonNullable<PluginBuild["resolve"]>>> | undefined;
+        let directory = args.resolveDir;
+        for (;;) {
+          result = await build.resolve(args.path, {
+            kind: args.kind,
+            importer: args.importer,
+            resolveDir: pathHelper.join(directory, "node_modules"),
+            pluginData: { [FROM_NODE_MODULES]: true },
+          });
+          if (!result.errors?.length) break;
+          // The bundler looks further up from a `node_modules` that exists.
+          // A missing one fails, so the search moves up; one whose copy of
+          // the package refuses the id ends it, as in Node.
+          if (
+            await isFile(
+              pathHelper.join(directory, "node_modules", packageName(args.path), "package.json"),
+            )
+          ) {
+            return { errors: result.errors };
+          }
+          const parent = pathHelper.dirname(directory);
+          if (parent === directory) return { errors: result.errors };
+          directory = parent;
+        }
+        return {
+          path: result.path,
+          external: result.external,
+          namespace: result.namespace,
+          suffix: result.suffix,
+          sideEffects: result.sideEffects,
+          pluginData: result.pluginData,
+        };
+      });
+      build.onResolve({ filter: RELATIVE_REQUIRE_FILTER }, async (args) => {
+        if (!args.importer || !isDependencyFile(args.importer)) return undefined;
+        const required = args.kind === "require-call" || args.kind === "require-resolve";
+        const path = required ? requirePath(args.path, sep) : args.path;
+        if (!RELATIVE_SPECIFIER.test(path)) return undefined;
+        const file = await nodeRelativeFile(path, args.resolveDir, isFile);
+        if (file !== null) return { path: file };
+        if (path === args.path || !build.resolve) return undefined;
+        // The bundler reads `.\\x` as a package name; it resolves the path.
+        const data = args.pluginData as Record<string, unknown> | undefined;
+        if (data?.[RESOLVING_WINDOWS_PATH] === true) return undefined;
+        const result = await build.resolve(path, {
+          kind: args.kind,
+          importer: args.importer,
+          resolveDir: args.resolveDir,
+          pluginData: { [RESOLVING_WINDOWS_PATH]: true },
+        });
+        if (result.errors?.length) return { errors: result.errors };
+        return {
+          path: result.path,
+          external: result.external,
+          namespace: result.namespace,
+          suffix: result.suffix,
+          sideEffects: result.sideEffects,
+          pluginData: result.pluginData,
+        };
+      });
+    },
+  };
+}
+
+/** How {@link createImportExternalsPlugin} tells a nested copy of a package apart. */
+export interface ImportExternalsOptions {
+  /** Whether an importer is an installed dependency file. */
+  readonly isDependencyFile: (path: string) => boolean;
+  /** The project's top-level `node_modules` directories, as given and canonical. */
+  readonly nodeModules: readonly string[];
+  /** A path with symlinks followed, or null when it does not exist. */
+  readonly realPath: (path: string) => Promise<string | null>;
+}
+
+/**
+ * Keeps the given packages external for `import` and `import()` only. A
+ * package that loads from disk as ESM may also export CommonJS to `require`;
+ * a `require()` of it from a bundled dependency bundles that CommonJS entry,
+ * since the runtime `require` cannot load packages. With `options`, an import
+ * from a dependency stays external only if it resolves to the project's
+ * top-level copy; a nested copy the dependency holds is bundled instead.
+ * Must run where esbuild's own resolution would apply: after the project's
+ * import map and aliases.
+ */
+export function createImportExternalsPlugin(
+  names: Iterable<string>,
+  options?: ImportExternalsOptions,
+): Plugin {
+  const escaped = [...names].map((name) => name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  const filter = new RegExp(`^(?:${escaped.join("|")})(?:/.*)?$`);
+  // The real directory of each top-level package, which the external import
+  // loads at runtime.
+  type Copy = { readonly logical: string; readonly real: string };
+  const topLevel = new Map<string, Promise<Copy[]>>();
+  const topLevelDirectories = (name: string) => {
+    let directories = topLevel.get(name);
+    if (directories === undefined) {
+      directories = Promise.all(
+        (options?.nodeModules ?? []).map(async (root) => {
+          const logical = pathHelper.join(root, name);
+          const real = await options!.realPath(logical);
+          return real === null ? null : { logical, real };
+        }),
+      ).then((copies) => copies.filter((copy): copy is Copy => copy !== null));
+      topLevel.set(name, directories);
+    }
+    return directories;
+  };
+  return {
+    name: "vf-import-externals",
+    setup(build) {
+      if (escaped.length === 0) return;
+      build.onResolve({ filter }, async (args) => {
+        if (args.kind !== "import-statement" && args.kind !== "dynamic-import") return undefined;
+        const data = args.pluginData as Record<string, unknown> | undefined;
+        if (data?.[RESOLVING_EXTERNAL] === true) return undefined;
+        const external = { path: args.path, external: true };
+        // A dependency may hold its own copy in a nested node_modules, which
+        // Node loads for it instead of the project's.
+        if (
+          !options || !build.resolve || !args.importer || !options.isDependencyFile(args.importer)
+        ) {
+          return external;
+        }
+        const result = await build.resolve(args.path, {
+          kind: args.kind,
+          importer: args.importer,
+          resolveDir: args.resolveDir,
+          pluginData: { [RESOLVING_EXTERNAL]: true },
+        });
+        // The nearest copy refusing the path is Node's answer, even if the
+        // project's copy would serve it.
+        if (result.errors?.length) return { errors: result.errors };
+        if (!result.path || result.external) return external;
+        const name = packageName(args.path);
+        const real = (await options.realPath(result.path)) ?? result.path;
+        const copy = (await topLevelDirectories(name)).find((directory) =>
+          isWithinDirectory(directory.real, real)
+        );
+        if (copy !== undefined) {
+          // The import rewrite maps a subpath onto the package directory as
+          // written; the file this one resolved to honours the package's
+          // `exports`, so the import names it.
+          if (args.path === name) return external;
+          const file = pathHelper.join(copy.logical, pathHelper.relative(copy.real, real));
+          // A target's query or fragment is part of the module's URL, as in Node.
+          return { path: pathHelper.toFileUrl(file).href + (result.suffix ?? ""), external: true };
+        }
+        return {
+          path: result.path,
+          namespace: result.namespace,
+          suffix: result.suffix,
+          sideEffects: result.sideEffects,
+          pluginData: result.pluginData,
+        };
+      });
+    },
+  };
+}
+
+// The package a bare specifier names: its first segment, or two when scoped.
+function packageName(specifier: string): string {
+  const parts = specifier.split("/");
+  return parts.slice(0, specifier.startsWith("@") ? 2 : 1).join("/");
+}
+
+const RESOLVING_EXTERNAL = "vfResolvingExternal";
+const RESOLVING_WINDOWS_PATH = "vfResolvingWindowsPath";
+
+/** Reads a package.json as text, or null when the directory has none. */
+export type ReadManifest = (path: string) => Promise<string | null>;
+
+/**
+ * The `type` field of the package.json that scopes a directory, as Node uses it
+ * to decide whether a `.js` file is ESM. Like Node, the search stops at a
+ * `node_modules` directory, so a dependency without a package.json is
+ * CommonJS whatever the project declares. It never leaves the project.
+ */
+export class PackageTypeLookup {
+  readonly #byDirectory = new Map<string, Promise<string | undefined>>();
+  readonly #roots: string[];
+
+  /**
+   * `projectDirs` are the project root as given and as canonical: the bundler
+   * reports paths with symlinks followed.
+   */
+  constructor(
+    private readonly readManifest: ReadManifest,
+    projectDirs: string | readonly string[],
+  ) {
+    this.#roots = (typeof projectDirs === "string" ? [projectDirs] : [...projectDirs])
+      .map((directory) => pathHelper.resolve(directory));
+  }
+
+  of(directory: string): Promise<string | undefined> {
+    let found = this.#byDirectory.get(directory);
+    if (!found) {
+      found = this.#read(directory);
+      this.#byDirectory.set(directory, found);
+    }
+    return found;
+  }
+
+  async #read(directory: string): Promise<string | undefined> {
+    if (pathHelper.basename(directory) === "node_modules") return undefined;
+    const manifest = await this.readManifest(pathHelper.join(directory, "package.json"));
+    if (manifest !== null) {
+      try {
+        // Node drops a byte order mark before parsing a package.json.
+        const text = manifest.charCodeAt(0) === 0xfeff ? manifest.slice(1) : manifest;
+        const type = (JSON.parse(text) as { type?: unknown }).type;
+        return typeof type === "string" ? type : undefined;
+      } catch {
+        // Node rejects a malformed package.json; esbuild reports it as well.
+        return undefined;
+      }
+    }
+    const parent = pathHelper.dirname(directory);
+    if (parent === directory || !this.#roots.some((root) => isWithinDirectory(root, parent))) {
+      return undefined;
+    }
+    return await this.of(parent);
+  }
+}
+
+/** Host operations {@link createDependencyFilePredicate} needs. */
+export interface DependencyRootFileSystem {
+  realPath(path: string): Promise<string>;
+  readDir(
+    path: string,
+  ): AsyncIterable<{ name: string; isDirectory: boolean; isSymlink?: boolean }>;
+}
+
+async function directoryEntries(fs: DependencyRootFileSystem, path: string) {
+  const entries: { name: string; isDirectory: boolean; isSymlink?: boolean }[] = [];
+  try {
+    for await (const entry of fs.readDir(path)) entries.push(entry);
+  } catch {
+    // expected: no such directory, as for an adapter-backed project
+  }
+  return entries;
+}
+
+/**
+ * Paths in `node_modules` that may be links: package entries, including the
+ * packages inside `@scope` directories. Only a link can point outside
+ * `node_modules`; a host that does not say whether an entry is one gets every
+ * entry checked.
+ */
+async function possibleLinks(fs: DependencyRootFileSystem, modules: string): Promise<string[]> {
+  const links: string[] = [];
+  for (const entry of await directoryEntries(fs, modules)) {
+    const path = pathHelper.join(modules, entry.name);
+    // A linked `@scope` directory holds plain package directories.
+    if (entry.name.startsWith("@") && entry.isSymlink !== false) links.push(path);
+    const scoped = entry.name.startsWith("@")
+      ? (await directoryEntries(fs, path)).map((inner) => ({
+        ...inner,
+        path: pathHelper.join(path, inner.name),
+      }))
+      : [{ ...entry, path }];
+    for (const candidate of scoped) {
+      if (candidate.isSymlink !== false) links.push(candidate.path);
+    }
+  }
+  return links;
+}
+
+/**
+ * Directories inside the project that `node_modules` links to, as npm, Yarn
+ * and pnpm workspaces do. The project root and node_modules never count.
+ */
+async function linkedWorkspaceDirectories(
+  fs: DependencyRootFileSystem,
+  root: string,
+): Promise<string[]> {
+  const modules = pathHelper.join(root, "node_modules");
+  const targets: string[] = [];
+  for (const link of await possibleLinks(fs, modules)) {
+    const target = await fs.realPath(link).catch(() => null); // null: a dangling link
+    if (
+      target !== null && target !== link && target !== root &&
+      isWithinDirectory(root, target) && !isWithinDirectory(modules, target)
+    ) {
+      targets.push(target);
+    }
+  }
+  return targets;
+}
+
+/**
+ * The directories that hold installed dependencies' files: the project's
+ * `node_modules`, under either the given or the canonical root (esbuild
+ * reports paths with symlinks followed), and each workspace package that
+ * `node_modules` links to inside the project.
+ */
+export async function dependencyDirectories(
+  projectDir: string,
+  fs: DependencyRootFileSystem,
+): Promise<string[]> {
+  const given = pathHelper.resolve(projectDir);
+  // null: an adapter-backed project may have no host directory
+  const canonical = await fs.realPath(given).catch(() => null);
+  const directories = [
+    pathHelper.join(given, "node_modules"),
+    ...(canonical === null ? [] : [
+      pathHelper.join(canonical, "node_modules"),
+      ...await linkedWorkspaceDirectories(fs, canonical),
+    ]),
+  ];
+  return [...new Set(directories)];
+}
+
+/** Whether a path is a file inside one of the {@link dependencyDirectories}. */
+export function dependencyFilePredicate(directories: readonly string[]): (path: string) => boolean {
+  const prefixes = directories.map((directory) => directory + pathHelper.sep);
+  return (path) => {
+    if (path === "") return false;
+    const resolved = pathHelper.resolve(path);
+    return prefixes.some((prefix) => resolved.startsWith(prefix));
+  };
+}
+
+/** {@link dependencyFilePredicate} of the project's {@link dependencyDirectories}. */
+export async function createDependencyFilePredicate(
+  projectDir: string,
+  fs: DependencyRootFileSystem,
+): Promise<(path: string) => boolean> {
+  return dependencyFilePredicate(await dependencyDirectories(projectDir, fs));
+}
+
+// Extensions Node has its own loader for, or refuses; any other file Node's
+// require() runs as CommonJS.
+const KNOWN_EXTENSION = /\.(?:[cm]?[jt]s|[jt]sx|json|node)$/i;
+
+// The loader that parses a dependency file, by extension.
+const LOADERS: Record<string, "js" | "jsx" | "ts" | "tsx"> = {
+  ".ts": "ts",
+  ".mts": "ts",
+  ".cts": "ts",
+  ".tsx": "tsx",
+  ".jsx": "jsx",
+};
+
+/**
+ * A name `contents` does not contain, derived from the file alone, so that the
+ * same file always yields the same output: the route module is cached by a
+ * hash of its code.
+ */
+async function markerFor(prefix: string, filePath: string, contents: string): Promise<string> {
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(filePath + "\0" + contents),
+  );
+  let marker = prefix + [...new Uint8Array(digest).slice(0, 16)]
+    .map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  while (contents.includes(marker)) marker += "_";
+  return marker;
+}
+
+/** Resolves a `require.resolve` literal to a path, or null to leave it for runtime. */
+export type ResolveRequireLiteral = (specifier: string) => Promise<string | null>;
+
+/**
+ * A dependency file as Node would run it when Node loads it as CommonJS (a
+ * `.cjs` or `.cts` file, or a `.js` or extensionless one as below), or null
+ * when Node loads it as ESM: a `.mjs` file, a `.js` or `.jsx` file in a
+ * `"type": "module"` package, or a `.js`, `.jsx` or extensionless file with
+ * ESM syntax, which esbuild bundles as ESM whatever its package says.
+ *
+ * The file is parsed, not matched as text, so strings and comments are never
+ * touched. Unbound reads of `__dirname` and `__filename` become constants, so
+ * a file's own binding of either name still wins, and nothing wraps the file:
+ * its hashbang and directive prologue are unchanged, and its top-level
+ * `arguments` holds Node's five wrapper arguments. A file Node must parse as
+ * CommonJS (`.cjs`, `.cts`, or `"type": "commonjs"`) that has ES module
+ * syntax throws a `SyntaxError` when it runs, as Node throws when it loads it. Each unbound
+ * `require.resolve("literal")` becomes the string Node returns: the id of a
+ * built-in, or the path `resolve` finds. One that does not resolve is left for
+ * runtime, where it throws `MODULE_NOT_FOUND` as Node does, so an optional
+ * dependency probed this way still falls back.
+ */
+export async function prepareCommonJSFile(
+  contents: string,
+  filePath: string,
+  packageType: string | undefined,
+  resolve: ResolveRequireLiteral,
+): Promise<string | null> {
+  const cjsExtension = /\.c[jt]s$/i.test(filePath);
+  // Node's require() loads `.jsx` through its `.js` loader too.
+  // Node 24 loads `.ts` by the same rules, with its types stripped.
+  const jsExtension = /\.(?:jsx?|ts)$/i.test(filePath);
+  // Node's require() loads a file without an extension, or with one it has
+  // no loader for, as CommonJS, whatever its package declares; a package
+  // `main` may name one.
+  const extensionless = !KNOWN_EXTENSION.test(filePath);
+  if (!cjsExtension && !extensionless && !(jsExtension && packageType !== "module")) return null;
+  // Node parses these as CommonJS whatever their syntax: ES module syntax is
+  // a SyntaxError there, not a reason to load the file as a module.
+  const forcedCommonJS = cjsExtension || (jsExtension && packageType === "commonjs");
+
+  // The source does not contain the name, so every occurrence in the output
+  // is one the parser put there. It never reaches the bundle.
+  const marker = await markerFor("__vf_require_resolve_", filePath, contents);
+  const requireMarker = await markerFor("__vf_require_call_", filePath, contents);
+  const argumentsMarker = await markerFor("__vf_arguments_", filePath, contents);
+  const result = await bundle({
+    stdin: {
+      contents,
+      loader: LOADERS[pathHelper.extname(filePath).toLowerCase()] ?? "js",
+      sourcefile: filePath,
+    },
+    bundle: false,
+    write: false,
+    metafile: true,
+    platform: "neutral",
+    logLevel: "silent",
+    define: {
+      "require.resolve": marker,
+      require: requireMarker,
+      __dirname: JSON.stringify(pathHelper.dirname(filePath)),
+      __filename: JSON.stringify(filePath),
+      // Only the file's own top-level `arguments`: a function has its own.
+      arguments: argumentsMarker,
+    },
+  });
+  const format = Object.values(result.metafile?.inputs ?? {})[0]?.format;
+  if (format === "esm") {
+    if (!forcedCommonJS) return null;
+    // Thrown when the file runs, as Node throws when it loads it.
+    return `throw new SyntaxError(${
+      JSON.stringify(
+        `${pathHelper.basename(filePath)} uses ES module syntax, but Node loads it as CommonJS`,
+      )
+    });\n`;
+  }
+  const code = result.outputFiles?.[0]?.text;
+  if (code === undefined) throw new Error(`No output for dependency file ${filePath}`);
+
+  const rewritten = await resolveLiteralCalls(
+    code,
+    marker,
+    async (specifier) =>
+      builtinModuleName(specifier) === undefined ? await resolve(specifier) : specifier,
+  );
+  // A literal require() goes back to the bundler, which bundles it. Any other
+  // use of `require`, such as a computed id, runs at runtime with the require
+  // of this file's directory, as in Node; so does a require.resolve call left
+  // unresolved, which throws there as in Node.
+  const directory = pathHelper.dirname(filePath);
+  // The module's own require when the runtime made its record, so a call it
+  // makes later still names it as the parent.
+  const boundRequire = `(${BUNDLED_REQUIRE_FROM}(${codeString(directory)}, module))`;
+  // Code in a direct eval sees the file's own bindings, which no rewrite of
+  // the source reaches; the file declares them, as Node's wrapper does. Its
+  // requires then all run at runtime. A file that assigns to `require` also
+  // keeps the name: a call is no assignment target.
+  // The parser prints every direct-eval spelling, `(eval)(x)` and comments
+  // included, as `eval(`; an indirect `(0, eval)(x)` or `eval?.(x)` stays.
+  const directEval = /(?<![\w$.])eval\(/.test(rewritten);
+  // `=`, and compound assignments such as `||=`, but not a comparison.
+  const assigned = new RegExp(
+    `${requireMarker}\\s*(?:\\*\\*|<<|>>>?|&&|\\|\\||\\?\\?|[-+*/%&|^])?=(?!=)`,
+  ).test(rewritten);
+  // A literal require is marked as this module's own, so one a callback
+  // makes after the file's body has finished still names it as the parent.
+  const ownedRequire = (specifier: string) =>
+    directEval || assigned
+      ? `require(${JSON.stringify(specifier)})`
+      : `${BUNDLED_REQUIRE_FROM}(${codeString(directory)}, module, true)(require(${
+        JSON.stringify(specifier)
+      }))`;
+  const prepared = rewritten
+    .replace(
+      literalRequire(requireMarker),
+      (_whole, double, single, template) => ownedRequire(double ?? single ?? template),
+    )
+    .replaceAll(marker, `${requireMarker}.resolve`)
+    .replaceAll(requireMarker, directEval || assigned ? "require" : boundRequire);
+  const wrapperArguments = prepared.includes(argumentsMarker);
+  if (!directEval && !assigned && !wrapperArguments) return prepared;
+  // After a hashbang and the directive prologue, so "use strict" still applies.
+  const head = /^(?:#![^\n]*\n)?(?:(["'])[^"'\n]*\1;\n)*/.exec(prepared)?.[0] ?? "";
+  // Node's wrapper gives each file its own `require`, which the file may
+  // reassign; the route's own binding must stay untouched.
+  const bindings = directEval
+    ? `var require = ${boundRequire}, __dirname = ${codeString(directory)}, ` +
+      `__filename = ${codeString(filePath)};\n`
+    : assigned
+    ? `var require = ${boundRequire};\n`
+    : "";
+  // The bundler's wrapper passes `exports` and `module` only; Node's passes
+  // these five, which a file may read through `arguments`.
+  const tuple = wrapperArguments
+    ? `var ${argumentsMarker} = (function () { return arguments; })(exports, ${
+      directEval || assigned ? "require" : boundRequire
+    }, module, ${codeString(filePath)}, ${codeString(directory)});\n`
+    : "";
+  return head + bindings + tuple + prepared.slice(head.length);
+}
+
+// A call of `marker` with one string literal as the bundler prints it; a
+// template literal only without substitutions.
+function literalRequire(marker: string): RegExp {
+  return new RegExp(
+    `${marker}\\((?:"([^"\\\\\\n]*)"|'([^'\\\\\\n]*)'|\`([^\`\\\\\\n$]*)\`)\\)`,
+    "g",
+  );
+}
+
+/**
+ * Replaces each call of `marker` with one string literal argument by the
+ * string `resolve` returns for it. A call it returns null for, and any other
+ * use of `marker`, is left unchanged. The literal must be as the bundler
+ * prints it: quoted, with no escapes.
+ */
+export async function resolveLiteralCalls(
+  code: string,
+  marker: string,
+  resolve: (specifier: string) => Promise<string | null>,
+): Promise<string> {
+  const literalCall = new RegExp(`${marker}\\((["'])([^"'\\\\\\n]*)\\1\\)`, "g");
+  const resolved = new Map<string, string | null>();
+  for (const match of code.matchAll(literalCall)) {
+    const specifier = match[2]!;
+    if (!resolved.has(specifier)) resolved.set(specifier, await resolve(specifier));
+  }
+  return code.replace(literalCall, (whole, _quote, specifier: string) => {
+    const target = resolved.get(specifier);
+    return typeof target === "string" ? JSON.stringify(target) : whole;
+  });
+}
+
+/** Resolves an `import.meta.resolve` literal to a URL, or null to leave it for runtime. */
+export type ResolveImportMetaLiteral = (specifier: string) => Promise<string | null>;
+
+/**
+ * An ES module dependency file with its `import.meta` locations pointing at
+ * the file itself, not at the route bundle it ends up in. Unbound reads of
+ * `import.meta.url`, `import.meta.filename` and `import.meta.dirname` become
+ * constants. Each `import.meta.resolve("literal")` becomes the URL `resolve`
+ * finds. Any other use of `import.meta.resolve`, computed or detached, calls a
+ * resolver bound to the file: it resolves URLs and relative paths against the
+ * file, built-ins to their `node:` ids, and package names and the package's
+ * own `#imports` through the runtime `require`'s lookup with the `import`
+ * condition. Any other read of `import.meta` gets an object with these four
+ * properties.
+ */
+export async function prepareModuleFile(
+  contents: string,
+  filePath: string,
+  resolve: ResolveImportMetaLiteral,
+  suffix = "",
+): Promise<string> {
+  // The module's URL keeps the query or fragment it was imported with.
+  const url = pathHelper.toFileUrl(filePath).href + suffix;
+  const marker = await markerFor("__vf_import_meta_resolve_", filePath, contents);
+  // An ES module has no `require`; the route module's binding of that name
+  // must not show through. The file's unbound uses read a name nothing
+  // declares, so, as in Node's strict ES modules, `typeof` reads
+  // "undefined" and a call or an assignment throws a ReferenceError.
+  const requireMarker = `${marker}_require`;
+  const result = await bundle({
+    stdin: {
+      contents,
+      loader: LOADERS[pathHelper.extname(filePath).toLowerCase()] ?? "js",
+      sourcefile: filePath,
+    },
+    bundle: false,
+    write: false,
+    platform: "neutral",
+    logLevel: "silent",
+    define: {
+      // The most specific name wins: `import.meta` alone is any other use.
+      "import.meta": `${marker}_meta`,
+      "import.meta.resolve": marker,
+      "import.meta.url": JSON.stringify(url),
+      "import.meta.filename": JSON.stringify(filePath),
+      "import.meta.dirname": JSON.stringify(pathHelper.dirname(filePath)),
+      require: requireMarker,
+    },
+  });
+  const code = result.outputFiles?.[0]?.text;
+  if (code === undefined) throw new Error(`No output for dependency file ${filePath}`);
+  if (!code.includes(marker)) return code;
+
+  const rewritten = await resolveLiteralCalls(code, marker, resolve);
+  if (!rewritten.replaceAll(requireMarker, "").includes(marker)) return rewritten;
+  const prologue = [
+    // The resolver is a declaration, so it is hoisted: a cyclic import may
+    // call into the file before its body runs.
+    `function ${marker}(specifier) {`,
+    `  return ${importResolver(url, filePath)}(specifier);`,
+    "}",
+    // Node's import.meta of an imported module: a null prototype, and
+    // `main` false.
+    `const ${marker}_meta = { __proto__: null, dirname: ${
+      codeString(pathHelper.dirname(filePath))
+    }, filename: ${codeString(filePath)}, main: false, resolve: ${marker}, url: ${
+      codeString(url)
+    } };`,
+  ].join("\n");
+  // A hashbang is only valid as the first line.
+  const hashbangEnd = rewritten.startsWith("#!") ? rewritten.indexOf("\n") + 1 : 0;
+  return rewritten.slice(0, hashbangEnd) + prologue + "\n" + rewritten.slice(hashbangEnd);
+}
+
+// The source of an expression that is the runtime `import.meta.resolve` of
+// the dependency file at `filePath`, whose URL is `url`; see
+// {@link createImportMetaResolve}.
+function importResolver(url: string, filePath: string): string {
+  return `(${createImportMetaResolve.toString()})(${codeString(url)}, ${
+    JSON.stringify([...PREFIX_ONLY_BUILTINS])
+  }, (id) => globalThis.process?.getBuiltinModule?.(id), (id) => typeof ${BUNDLED_REQUIRE_FROM} === "function" ? ${BUNDLED_REQUIRE_FROM}(${
+    codeString(pathHelper.dirname(filePath))
+  }).resolve(id, { [Symbol.for("veryfront.importConditions")]: true }) : null, globalThis.process?.platform)`;
+}
+
+/**
+ * `code`, a dependency file, with each `import()` the bundler cannot follow
+ * bound to the file: its specifier resolves as `import.meta.resolve` in the
+ * file would (see {@link createImportMetaResolve}), so a relative path loads
+ * the file's sibling and a package name the file's own dependency, not
+ * whatever the route bundle's location would give. A specifier that does not
+ * resolve rejects the import, as Node's does. A literal specifier, and a
+ * relative template or concatenation the bundler expands into the files it
+ * matches, stay for the bundler.
+ */
+export async function bindDynamicImports(
+  code: string,
+  filePath: string,
+  url: string,
+): Promise<string> {
+  if (!/\bimport\s*\(/.test(code)) return code;
+  const { masked, imports, unmask } = await parseMaskedImports(code);
+  const computed = imports.filter((entry) =>
+    // A dynamic import whose specifier is no literal.
+    entry.d >= 0 && entry.n === undefined &&
+    !/^\s*(["'`])\.\.?\//.test(masked.slice(entry.s, entry.e))
+  );
+  if (computed.length === 0) return code;
+  const marker = await markerFor("__vf_dynamic_import_", filePath, code);
+  let result = masked;
+  for (const entry of [...computed].sort((a, b) => b.s - a.s)) {
+    result = result.slice(0, entry.s) + `${marker}(${result.slice(entry.s, entry.e)})` +
+      result.slice(entry.e);
+  }
+  // A declaration at the end, so it is hoisted without displacing a hashbang
+  // or a directive prologue. A specifier that fails to resolve becomes one
+  // whose conversion to a string throws, so `import()` rejects with the error
+  // rather than throwing it.
+  const resolver = [
+    "",
+    `function ${marker}(specifier) {`,
+    "  try {",
+    `    return ${importResolver(url, filePath)}(specifier);`,
+    "  } catch (error) {",
+    "    return { toString() { throw error; } };",
+    "  }",
+    "}",
+    "",
+  ].join("\n");
+  return unmask(result) + resolver;
+}
+
+/**
+ * The runtime `import.meta.resolve` of a bundled dependency module at
+ * `moduleUrl`: URLs and relative paths resolve against the module, built-ins
+ * to their `node:` ids, and a package name or `#import` to the URL
+ * `resolvePackage` finds. One it cannot find throws `ERR_MODULE_NOT_FOUND`.
+ *
+ * {@link prepareModuleFile} embeds this function's source in the module, so
+ * it must not refer to anything outside its own body.
+ */
+export function createImportMetaResolve(
+  moduleUrl: string,
+  prefixOnlyNames: readonly string[],
+  getBuiltinModule: (id: string) => unknown,
+  resolvePackage: (id: string) => string | null = () => null,
+  platform: string = "linux",
+): (specifier: unknown) => string {
+  const windows = platform === "win32";
+  // A POSIX file URL names no host; Node rejects one that does.
+  const local = (url: URL) => {
+    if (url.protocol === "file:" && url.hostname !== "" && !windows) {
+      const error = new TypeError(
+        'File URL host must be "localhost" or empty on ' + platform,
+      ) as TypeError & { code?: string };
+      error.code = "ERR_INVALID_FILE_URL_HOST";
+      throw error;
+    }
+    return url.href;
+  };
+  return (specifier) => {
+    const id = String(specifier);
+    if (/^[a-z][a-z0-9+.-]*:/i.test(id)) return local(new URL(id));
+    if (/^(?:\.\.?(?:\/|$)|\/)/.test(id)) return local(new URL(id, moduleUrl));
+    // A bare prefix-only name such as `test` is a package, as in Node.
+    if (!prefixOnlyNames.includes(id) && getBuiltinModule(id) !== undefined) return "node:" + id;
+    let found: string | null = null;
+    try {
+      found = resolvePackage(id);
+    } catch (error) {
+      // A package's own refusal is reported as it is, as in Node; anything
+      // else is not found, reported below with ESM's code.
+      const code = (error as { code?: unknown })?.code;
+      if (
+        code === "ERR_INVALID_PACKAGE_CONFIG" || code === "ERR_PACKAGE_PATH_NOT_EXPORTED" ||
+        code === "ERR_PACKAGE_IMPORT_NOT_DEFINED" || code === "ERR_INVALID_PACKAGE_TARGET"
+      ) {
+        throw error;
+      }
+    }
+    if (found !== null) return found;
+    const error = new Error(
+      "Cannot find package " + JSON.stringify(id) + " imported from a bundled dependency",
+    ) as Error & { code?: string };
+    error.code = "ERR_MODULE_NOT_FOUND";
+    throw error;
+  };
+}
+
+/**
+ * The name a bundled CommonJS dependency calls for the `require` of its own
+ * directory; see {@link RuntimeRequireBinding.requireFrom}.
+ */
+export const BUNDLED_REQUIRE_FROM = "__vf_require_from";
+
+/**
+ * A dependency's JSON file as a CommonJS module, which the runtime `require`
+ * caches like any bundled dependency, so a computed `require()` of the same
+ * file returns the same object, as in Node. Malformed JSON fails the build, as
+ * the bundler's JSON loader would.
+ */
+export function prepareDependencyJson(contents: string): string {
+  // Node drops a byte order mark before parsing JSON.
+  const json = contents.charCodeAt(0) === 0xfeff ? contents.slice(1) : contents;
+  JSON.parse(json);
+  return `module.exports = JSON.parse(${JSON.stringify(json)});\n`;
+}
+
+/**
+ * How the build loads a dependency's JSON file: the CommonJS module of
+ * {@link prepareDependencyJson}, which the runtime `require` caches. Node 24
+ * gives a `{ type: "json" }` import of the file that same module. An import
+ * with a query or fragment is a module of its own, as in Node, so it loads
+ * as plain JSON.
+ */
+export function dependencyJsonLoad(
+  contents: string,
+  attributes?: Readonly<Record<string, string>>,
+  suffix = "",
+): { contents: string; loader: "js" | "json" } {
+  if (attributes?.type === "json" && suffix !== "") {
+    const json = contents.charCodeAt(0) === 0xfeff ? contents.slice(1) : contents;
+    return { contents: json, loader: "json" };
+  }
+  return { contents: prepareDependencyJson(contents), loader: "js" };
+}
+
+/** Input for {@link prepareDependencyFile}. */
+export interface DependencyFileInput {
+  readonly build: PluginBuild;
+  readonly contents: string;
+  /** The file's path as the project sees it. */
+  readonly logicalPath: string;
+  /** The path the bundler resolved, used as the importer for resolution. */
+  readonly resolvedPath: string;
+  /** The `type` field of the package.json that scopes the file. */
+  readonly packageType: string | undefined;
+  readonly isDependencyFile: (path: string) => boolean;
+  readonly isFile: IsFile;
+  /** The query or fragment the file was imported with, as the bundler reports it. */
+  readonly suffix?: string;
+}
+
+/**
+ * A bundled dependency file as Node would run it: see
+ * {@link prepareCommonJSFile} and {@link prepareModuleFile}. A literal
+ * location resolves at build time only to a file inside the project's
+ * dependencies.
+ */
+export async function prepareDependencyFile(input: DependencyFileInput): Promise<string> {
+  return await bindDynamicImports(
+    await prepareDependencySource(input),
+    input.logicalPath,
+    pathHelper.toFileUrl(input.logicalPath).href + (input.suffix ?? ""),
+  );
+}
+
+async function prepareDependencySource(input: DependencyFileInput): Promise<string> {
+  const { build, contents, logicalPath, resolvedPath, isDependencyFile } = input;
+  // A file Node parses as CommonJS whatever its syntax.
+  const forcedCommonJS = /\.c[jt]s$/i.test(logicalPath) ||
+    (/\.(?:jsx?|ts)$/i.test(logicalPath) && input.packageType === "commonjs");
+  // Most package files read none of these names; parsing them would change
+  // nothing. The check is textual, so it can only send extra files to the parser.
+  // An ES module by its extension or package, where any `require` is free.
+  const knownModule = /\.m[jt]s$/i.test(logicalPath) ||
+    (/\.(?:jsx?|ts)$/i.test(logicalPath) && input.packageType === "module");
+  const importMeta = /\bimport\.meta\b/.test(contents) ||
+    (knownModule && /\brequire\b/.test(contents));
+  const readsCommonJSNames = contents.includes("__dirname") ||
+    contents.includes("__filename") ||
+    /\barguments\b/.test(contents) ||
+    // Any use of require but a call with a string literal, which the bundler
+    // bundles: a computed id must resolve from this file's directory.
+    /\brequire\b/.test(contents.replace(LITERAL_REQUIRE_CALL, "")) ||
+    // A direct eval, in any spelling, may read any of them.
+    /\beval\b/.test(contents) ||
+    // ES module syntax, which such a file must not run as.
+    (forcedCommonJS && /\b(?:import|export)\b/.test(contents));
+  // A literal require, which the bundler bundles; a CommonJS file marks it as
+  // its own, see prepareCommonJSFile.
+  const literalRequires = /\brequire\s*\(\s*["'`]/.test(contents);
+  if (!readsCommonJSNames && !importMeta && !literalRequires) return contents;
+  const resolveDir = pathHelper.dirname(resolvedPath);
+  const dependencyPath = async (
+    specifier: string,
+    kind: "require-resolve" | "import-statement",
+  ) => {
+    if (!build.resolve) return null;
+    const result = await build.resolve(specifier, { kind, importer: resolvedPath, resolveDir });
+    if (result.errors?.length || !result.path || result.external) return null;
+    if (!isDependencyFile(result.path)) return null;
+    // Only require() reads a Windows backslash as a separator.
+    const sep = kind === "require-resolve" ? pathHelper.sep : "/";
+    return {
+      path: await nodePreferredFile(result.path, specifier, resolveDir, input.isFile, sep),
+      // A package target's query or fragment: import.meta.resolve keeps it.
+      suffix: result.suffix ?? "",
+    };
+  };
+  const commonJS = await prepareCommonJSFile(
+    contents,
+    logicalPath,
+    input.packageType,
+    async (specifier) => (await dependencyPath(specifier, "require-resolve"))?.path ?? null,
+  );
+  if (commonJS !== null) return commonJS;
+  // An ES module's literal require stays for the bundler, as it was.
+  if (!readsCommonJSNames && !importMeta) return contents;
+  if (!importMeta && !/\brequire\b/.test(contents)) return contents;
+  const moduleUrl = pathHelper.toFileUrl(logicalPath).href + (input.suffix ?? "");
+  return await prepareModuleFile(contents, logicalPath, async (specifier) => {
+    const builtin = builtinModuleName(specifier);
+    if (builtin !== undefined) return "node:" + builtin;
+    // A `#name` resolves through the package's own `imports`, below.
+    if (URL_SPECIFIER.test(specifier) || RELATIVE_SPECIFIER.test(specifier)) {
+      const url = new URL(specifier, moduleUrl);
+      // A file URL with a host is Node's runtime error; the resolver throws it.
+      return url.protocol === "file:" && url.hostname !== "" && pathHelper.sep === "/"
+        ? null
+        : url.href;
+    }
+    const found = await dependencyPath(specifier, "import-statement");
+    return found === null ? null : pathHelper.toFileUrl(found.path).href + found.suffix;
+  }, input.suffix ?? "");
+}
+
+/**
+ * Applies a text rewrite of import specifiers to the parsed imports of `code`
+ * only. A bundle holds package code whose strings may read like imports, such
+ * as `'from "fs"'`; those stay as written. `rewrite` sees one
+ * `export * from "specifier";` line per distinct specifier and must keep one
+ * import per line.
+ */
+export async function rewriteImportSpecifiers(
+  code: string,
+  rewrite: (probe: string) => Promise<string>,
+): Promise<string> {
+  const specifiers = [
+    ...new Set(
+      (await parseImports(code))
+        .map((entry) => entry.n)
+        .filter((specifier): specifier is string => typeof specifier === "string"),
+    ),
+  ];
+  if (specifiers.length === 0) return code;
+  const probe = specifiers.map((specifier) => `export * from ${JSON.stringify(specifier)};`);
+  const rewritten = (await parseImports(await rewrite(probe.join("\n")))).map((entry) => entry.n);
+  if (rewritten.length !== specifiers.length || rewritten.some((entry) => entry === undefined)) {
+    throw new Error("[API] handler build failed: import specifiers could not be rewritten");
+  }
+  const replacements = new Map(
+    specifiers.map((specifier, index) => [specifier, rewritten[index]!]),
+  );
+  return await replaceSpecifiers(code, (specifier) => replacements.get(specifier));
+}
+
+/** Host operations the runtime `require` uses; see {@link createRuntimeRequire}. */
+export interface RuntimeRequireHost {
+  getBuiltinModule(id: string): unknown;
+  isFile(path: string): boolean;
+  realpathSync(path: string): string;
+  readFileSync(path: string, encoding: "utf8"): string;
+  /** Compiles a CommonJS module body. */
+  compile(source: string, filename: string): CommonJSModuleBody;
+  /** Node's `stripTypeScriptTypes`, when the runtime has it. */
+  stripTypes?: (source: string) => string;
+  /** A path's `file:` URL. */
+  toFileUrl(path: string): string;
+  /** The process's working directory, which relative `paths` entries resolve from. */
+  cwd(): string;
+  isAbsolute(path: string): boolean;
+  relative(from: string, to: string): string;
+  join(...paths: string[]): string;
+  dirname(path: string): string;
+  readonly sep: string;
+}
+
+/** A compiled CommonJS module body, called with `this` set to `exports`. */
+export type CommonJSModuleBody = (
+  exports: unknown,
+  require: RuntimeRequire,
+  module: RuntimeModule,
+  filename: string,
+  dirname: string,
+) => void;
+
+/** The `module` a CommonJS file the runtime `require` loads sees. */
+export interface RuntimeModule {
+  exports: unknown;
+  id: string;
+  filename: string;
+  path: string;
+  /** The `node_modules` directories its package ids are looked up in. */
+  paths: string[];
+  loaded: boolean;
+  /** The module that first required it, if it was required from a module. */
+  parent: RuntimeModule | undefined;
+  children: RuntimeModule[];
+  require: RuntimeRequire;
+}
+
+/** {@link createRuntimeRequire}'s result. */
+export interface RuntimeRequireBinding {
+  readonly require: RuntimeRequire;
+  /**
+   * Runs a CommonJS file the bundler bundled, named by `key` relative to the
+   * bundle's working directory, through the module cache that computed
+   * requires use, as Node's one cache: it runs once, is in `require.cache`
+   * before its body runs, leaves it if the body throws, and runs again once
+   * deleted from it. Null for a file that is not a dependency, which the
+   * bundler caches itself.
+   */
+  readonly bundled: (
+    key: unknown,
+    body: (exports: unknown, module: { exports: unknown }) => void,
+  ) => { exports: unknown } | null;
+  /**
+   * The `require` of a bundled dependency file in `directory`, for the calls
+   * the bundler left to runtime, such as a computed relative id.
+   */
+  readonly requireFrom: {
+    (directory: unknown, module?: unknown): RuntimeRequire;
+    /**
+     * With `bind`, marks the bundled literal require that the caller makes
+     * next as `module`'s own, and returns a function that hands back its
+     * result: `requireFrom(directory, module, true)(require("./lazy"))`.
+     */
+    (directory: unknown, module: unknown, bind: true): <T>(value: T) => T;
+  };
+}
+
+/** The runtime `require` of a bundled route; see {@link createRuntimeRequire}. */
+export interface RuntimeRequire {
+  (id: unknown): unknown;
+  /** Node's `require.resolve`, including its `paths` option and `paths()` helper. */
+  resolve: ((id: unknown, options?: { paths?: unknown }) => string) & {
+    paths(request: unknown): string[] | null;
+  };
+  /** Loaded modules by real path; deleting one makes the next load run it again. */
+  cache: Record<string, { exports: unknown }>;
+  /** webpack's `require.ensure`: everything is loaded already. */
+  ensure(ids: unknown, callback: (require: RuntimeRequire) => void): void;
+}
+
+/**
+ * The `require` that esbuild's output calls for anything it did not bundle:
+ * a computed id, or a built-in. Ids resolve as Node's `require()` resolves
+ * them, from the project for route code and from its own directory for a
+ * module this loaded:
+ *
+ * - A built-in loads under any id Node accepts.
+ * - A path finds a file in Node's order: the path, then with `.js` or
+ *   `.json`, then its `index.js` or `index.json`.
+ * - A package name is looked up in `node_modules` upwards, through the
+ *   package's `exports` (exact keys and `*` patterns; `node`, `require` and
+ *   `default` conditions, or `import` and `module-sync` for a bundled module's
+ *   `import.meta.resolve`) or its `main`. A `#name` reads the `imports` of the
+ *   package that holds the module.
+ *
+ * Whatever it finds must have its real path inside the project, and nothing
+ * looks above it. JSON loads from anywhere in the project. JavaScript loads
+ * only from the project's dependencies, as CommonJS, with its own `require`
+ * and `module`, its TypeScript types stripped as Node 24 strips them. A native
+ * addon or an ES module throws. Each file loads once, and bundled files share
+ * the same cache; see {@link RuntimeRequireBinding.bundled}. `require.cache` holds them by real
+ * path, `require.resolve` returns the path it found and takes Node's `paths`
+ * option, and `require.ensure`, which code written for webpack calls, runs
+ * its callback. Anything else throws `MODULE_NOT_FOUND`, so optional
+ * dependencies probed in a `try` still fall back.
+ *
+ * Errors name a path relative to the project, never the host path.
+ * {@link prependRuntimeRequire} embeds this function's source in the route
+ * module, so it must not refer to anything outside its own body.
+ */
+export function createRuntimeRequire(
+  host: RuntimeRequireHost,
+  projectRoot: string,
+  prefixOnlyNames: readonly string[],
+  dependencyDirectories: readonly string[],
+  bundleRoot?: string,
+): RuntimeRequireBinding {
+  // Tables without a prototype: `in` reads only their own keys and does not
+  // depend on built-ins that route code could replace later.
+  const prefixOnly: Record<string, true> = Object.create(null);
+  for (const name of prefixOnlyNames) prefixOnly[name] = true;
+  const modules: Record<string, RuntimeModule> = Object.create(null);
+  // Set while resolving for `import.meta.resolve`, which reads a package map's
+  // `import` condition where require() reads `require`; see `resolve`.
+  let importing = false;
+  const failure = (message: string, code: string) => {
+    const error = new Error(message) as Error & { code?: string };
+    error.code = code;
+    return error;
+  };
+  // Node's argument checks throw a TypeError, before any lookup, so code that
+  // catches `MODULE_NOT_FOUND` never mistakes a wrong argument for a missing
+  // optional dependency.
+  const invalidArgument = (message: string, code: string) => {
+    const error = new TypeError(message) as TypeError & { code?: string };
+    error.code = code;
+    return error;
+  };
+  const received = (value: unknown) =>
+    value === null || value === undefined
+      ? "Received " + value
+      : typeof value === "function"
+      ? "Received function " + ((value as { name?: string }).name || "<anonymous>")
+      : typeof value === "object"
+      ? "Received an instance of " +
+        ((value as { constructor?: { name?: string } }).constructor?.name || "Object")
+      : "Received type " + typeof value + " (" + String(value) + ")";
+  function requireString(value: unknown, name: string): asserts value is string {
+    if (typeof value !== "string") {
+      throw invalidArgument(
+        'The "' + name + '" argument must be of type string. ' + received(value),
+        "ERR_INVALID_ARG_TYPE",
+      );
+    }
+  }
+  const dependencyPrefixes = dependencyDirectories.map((directory) => directory + host.sep);
+  const builtin = (id: unknown) => {
+    // A bare prefix-only name such as `test` is an npm package, as in Node.
+    if (typeof id !== "string" || id in prefixOnly) return undefined;
+    return host.getBuiltinModule(id);
+  };
+  const missing = (label: string) =>
+    failure("Cannot find module " + JSON.stringify(label), "MODULE_NOT_FOUND");
+  // An existing file whose real path is in the project.
+  const projectFile = (path: string) => {
+    if (!host.isFile(path)) return null;
+    let real: string;
+    try {
+      real = host.realpathSync(path);
+    } catch {
+      return null;
+    }
+    const relative = host.relative(projectRoot, real);
+    const up = relative === ".." || relative.startsWith(".." + host.sep);
+    if (relative === "" || up || host.isAbsolute(relative)) return null;
+    return { path, real, relative };
+  };
+  // A path relative to the requiring file; on Windows a backslash separates too.
+  const relativeId = (id: string) =>
+    id === "." || id === ".." || id.startsWith("./") || id.startsWith("../") ||
+    id.startsWith("." + host.sep) || id.startsWith(".." + host.sep);
+  const first = (candidates: string[]) => {
+    for (const candidate of candidates) {
+      const found = projectFile(candidate);
+      if (found !== null) return found;
+    }
+    return null;
+  };
+  const asFile = (base: string) => first([base, base + ".js", base + ".json", base + ".node"]);
+  const asIndex = (directory: string) =>
+    first(["index.js", "index.json", "index.node"].map((name) => host.join(directory, name)));
+  // A file at `base` in Node's order: the file with Node's extensions, then
+  // the directory's package.json `main`, then its index.
+  const findFile = (base: string) => {
+    const file = asFile(base);
+    if (file !== null) return file;
+    const manifest = readManifest(base);
+    // Node refuses a directory whose package.json is malformed.
+    if (manifest === null) throw invalidConfig(base);
+    const main = manifest?.main;
+    if (typeof main === "string") {
+      const target = host.join(base, main);
+      const found = asFile(target) ?? asIndex(target);
+      if (found !== null) return found;
+    }
+    return asIndex(base);
+  };
+  // The target a package's `exports` or `imports` gives `require()`: the
+  // `node`, `require` and `default` conditions, in the order it lists them.
+  // null blocks the path, even when a later condition would match; undefined
+  // means no condition matched.
+  const conditionalTarget = (
+    value: unknown,
+    valid: (target: string) => boolean = () => true,
+  ): string | null | undefined => {
+    if (typeof value === "string") return value;
+    if (Array.isArray(value)) {
+      // As in Node, the first item that resolves to a valid target wins; a
+      // null, unmatched or invalid item falls through to the next.
+      for (const item of value) {
+        const target = conditionalTarget(item, valid);
+        if (typeof target === "string" && valid(target)) return target;
+      }
+      return null;
+    }
+    if (value === null || typeof value !== "object") return null;
+    for (const [condition, item] of Object.entries(value)) {
+      // `module-sync` only for an import: this require() cannot run an ES
+      // module, which is when Node turns the condition off too.
+      const active = condition === "node" || condition === "default" ||
+        (importing
+          ? condition === "import" || condition === "module-sync"
+          : condition === "require");
+      if (!active) continue;
+      const target = conditionalTarget(item, valid);
+      if (target !== undefined) return target;
+    }
+    return undefined;
+  };
+  // A key of a package's `exports` or `imports` map, as Node matches it: an
+  // exact key, else the `*` pattern with the longest prefix, whose match
+  // replaces each `*` in the target.
+  const mapTarget = (
+    map: Record<string, unknown>,
+    key: string,
+    valid: (target: string) => boolean,
+  ): string | null => {
+    if (!key.includes("*") && Object.hasOwn(map, key)) {
+      return conditionalTarget(map[key], valid) ?? null;
+    }
+    let best: { pattern: string; match: string } | null = null;
+    for (const pattern of Object.keys(map)) {
+      const star = pattern.indexOf("*");
+      if (star === -1 || pattern.indexOf("*", star + 1) !== -1) continue;
+      const prefix = pattern.slice(0, star);
+      const suffix = pattern.slice(star + 1);
+      if (
+        key.length < pattern.length || !key.startsWith(prefix) || !key.endsWith(suffix) ||
+        key === prefix
+      ) {
+        continue;
+      }
+      const longer = best === null || prefix.length > best.pattern.indexOf("*") ||
+        (prefix.length === best.pattern.indexOf("*") && pattern.length > best.pattern.length);
+      if (longer) best = { pattern, match: key.slice(prefix.length, key.length - suffix.length) };
+    }
+    if (best === null) return null;
+    const target = conditionalTarget(map[best.pattern], valid);
+    return typeof target === "string" ? target.split("*").join(best.match) : null;
+  };
+  // Node's error for a malformed package.json, which it never skips.
+  const invalidConfig = (packageDir: string) =>
+    failure(
+      "Invalid package config " +
+        JSON.stringify(host.relative(projectRoot, host.join(packageDir, "package.json"))),
+      "ERR_INVALID_PACKAGE_CONFIG",
+    );
+  const readManifest = (packageDir: string): Record<string, unknown> | null | undefined => {
+    const manifestPath = host.join(packageDir, "package.json");
+    if (!host.isFile(manifestPath)) return undefined;
+    try {
+      const text = host.readFileSync(manifestPath, "utf8");
+      // Node drops a byte order mark before parsing a package.json.
+      const manifest = JSON.parse(text.charCodeAt(0) === 0xfeff ? text.slice(1) : text);
+      return manifest !== null && typeof manifest === "object" ? manifest : null;
+    } catch {
+      return null; // Node rejects a malformed package.json
+    }
+  };
+  // A `./` target of a package map, which Node rejects if any later segment
+  // is empty, `.`, `..` or `node_modules`, so it cannot leave its package.
+  // A target is a URL path, so its escapes name the file: `%20` is a space.
+  // Its query or fragment is not part of the file's path. False for a valid
+  // target whose escapes name no file.
+  const targetSegments = (target: string) => {
+    if (!target.startsWith("./")) return null;
+    const decoded: string[] = [];
+    let undecodable = false;
+    for (const segment of target.slice(2).split(/[?#]/)[0]!.split(/[\\/]/)) {
+      let name: string;
+      try {
+        name = decodeURIComponent(segment);
+      } catch {
+        // Node never decodes it, so it names no file, but the target is valid.
+        undecodable = true;
+        continue;
+      }
+      const lower = name.toLowerCase();
+      if (
+        lower === "" || lower === "." || lower === ".." || lower === "node_modules" ||
+        /[\\/]/.test(name)
+      ) {
+        return null;
+      }
+      decoded.push(name);
+    }
+    return undecodable ? false : decoded;
+  };
+  // A package map's errors, as Node reports them: a broken package is never
+  // mistaken for a missing optional one.
+  const manifestLabel = (packageDir: string) =>
+    JSON.stringify(host.relative(projectRoot, host.join(packageDir, "package.json")));
+  const packageTarget = (packageDir: string, target: string) => {
+    const segments = targetSegments(target);
+    if (segments === false) return null;
+    if (segments === null) {
+      throw failure(
+        "Invalid package target " + JSON.stringify(target) + " in " + manifestLabel(packageDir),
+        "ERR_INVALID_PACKAGE_TARGET",
+      );
+    }
+    const path = host.join(packageDir, ...segments);
+    // An import keeps the target's query or fragment in the module's URL.
+    const suffix = /[?#][\s\S]*$/.exec(target)?.[0] ?? "";
+    const found = projectFile(path);
+    if (found !== null) return { ...found, suffix };
+    // import.meta.resolve names the target without loading it, as in Node.
+    if (!importing || !inProject(packageDir)) return null;
+    return { path, real: path, relative: host.relative(projectRoot, path), suffix };
+  };
+  const validExport = (target: string) => targetSegments(target) !== null;
+  // An `imports` target may also name a package.
+  const validImport = (target: string) =>
+    validExport(target) ||
+    !(target.startsWith(".") || target.startsWith("/") || target.startsWith("#") ||
+      /^[a-z][a-z0-9+.-]*:/i.test(target));
+  // The `type` of the package.json that scopes a file, as Node reads it.
+  const packageType = (file: string) => packageScope(host.dirname(file))?.manifest.type;
+  const inProject = (directory: string) => {
+    const relative = host.relative(projectRoot, directory);
+    return !(relative === ".." || relative.startsWith(".." + host.sep) ||
+      host.isAbsolute(relative));
+  };
+  // A package's file for `subpath` ("" or "/sub"), as Node's require() picks
+  // it; false when its `exports` target names no file, which ends Node's
+  // search. A subpath `exports` does not define, or a malformed package.json,
+  // throws Node's error.
+  const packageFile = (packageDir: string, subpath: string) => {
+    const manifest = readManifest(packageDir);
+    if (manifest === null) throw invalidConfig(packageDir);
+    const exports = manifest?.exports;
+    if (exports !== undefined && exports !== null) {
+      const key = "." + subpath;
+      const keys = typeof exports === "object" && !Array.isArray(exports)
+        ? Object.keys(exports)
+        : [];
+      const subpathKeys = keys.filter((name) => name.startsWith(".")).length;
+      // Node rejects an `exports` object that mixes subpaths and conditions.
+      if (subpathKeys > 0 && subpathKeys !== keys.length) throw invalidConfig(packageDir);
+      const target = subpathKeys > 0
+        ? mapTarget(exports as Record<string, unknown>, key, validExport)
+        : key === "."
+        ? conditionalTarget(exports, validExport) ?? null
+        : null;
+      if (target === null) {
+        throw failure(
+          "Package subpath " + JSON.stringify(key) + ' is not defined by "exports" in ' +
+            manifestLabel(packageDir),
+          "ERR_PACKAGE_PATH_NOT_EXPORTED",
+        );
+      }
+      return packageTarget(packageDir, target) ?? false;
+    }
+    return findFile(host.join(packageDir, subpath));
+  };
+  // A package name looked up in `node_modules` from `directory` upwards, as
+  // Node's require() does, never above the project.
+  const findPackage = (id: string, directory: string, self = true) => {
+    const parts = id.split("/");
+    const nameLength = id.startsWith("@") ? 2 : 1;
+    if (
+      parts.length < nameLength ||
+      parts.some((part, index) =>
+        part === ".." ||
+        // The name itself; Node reads `pkg/`, `pkg//` and `pkg/.` as the package.
+        (index < nameLength && (part === "" || part === ".")) ||
+        // A Windows separator would let the name walk out of node_modules.
+        (host.sep !== "/" && part.includes(host.sep))
+      )
+    ) {
+      return null;
+    }
+    const name = parts.slice(0, nameLength).join("/");
+    const subpath = parts.length > nameLength ? "/" + parts.slice(nameLength).join("/") : "";
+    // Node first lets a package with `exports` name itself, before any copy
+    // in `node_modules`.
+    const scope = self ? packageScope(directory) : null;
+    if (scope != null && scope.manifest.name === name && scope.manifest.exports != null) {
+      return packageFile(scope.directory, subpath) || null;
+    }
+    let current = directory;
+    while (inProject(current)) {
+      if (!current.endsWith(host.sep + "node_modules")) {
+        const found = packageFile(host.join(current, "node_modules", name), subpath);
+        if (found === false) return null;
+        if (found !== null) return found;
+      }
+      const parent = host.dirname(current);
+      if (parent === current) return null;
+      current = parent;
+    }
+    return null;
+  };
+  // The nearest package.json that scopes `directory`, as Node finds it:
+  // never past a `node_modules` directory or the project. Node refuses to
+  // load a file, or resolve from one, whose package scope is malformed.
+  const packageScope = (directory: string) => {
+    let current = directory;
+    while (inProject(current) && !current.endsWith(host.sep + "node_modules")) {
+      const manifest = readManifest(current);
+      if (manifest === null) throw invalidConfig(current);
+      if (manifest !== undefined) return { directory: current, manifest };
+      const parent = host.dirname(current);
+      if (parent === current) return null;
+      current = parent;
+    }
+    return null;
+  };
+  // A `#name` from the `imports` of the package that holds `directory`.
+  const packageImport = (id: string, directory: string) => {
+    const scope = packageScope(directory);
+    const imports = scope?.manifest.imports;
+    const target = scope == null || imports === null || typeof imports !== "object" ||
+        Array.isArray(imports)
+      ? null
+      : mapTarget(imports as Record<string, unknown>, id, validImport);
+    if (target === null) {
+      throw failure(
+        "Package import specifier " + JSON.stringify(id) + " is not defined" +
+          (scope == null ? "" : " in " + manifestLabel(scope.directory)),
+        "ERR_PACKAGE_IMPORT_NOT_DEFINED",
+      );
+    }
+    if (target.startsWith("./")) return packageTarget(scope!.directory, target);
+    if (target.startsWith("#") || target.startsWith("/") || target.startsWith(".")) {
+      throw failure(
+        "Invalid package target " + JSON.stringify(target) + " in " +
+          manifestLabel(scope!.directory),
+        "ERR_INVALID_PACKAGE_TARGET",
+      );
+    }
+    return findPackage(target, scope!.directory);
+  };
+  // `self` is false for a `paths` entry, which only searches; the caller's
+  // own package scope is read once, from where the call was made.
+  const find = (id: unknown, directory: string | undefined, self = true) => {
+    if (typeof id !== "string") return null;
+    // Node reads the caller's package scope first, for a self-reference, so
+    // a malformed one fails every id that is not a built-in.
+    if (self && directory !== undefined) packageScope(directory);
+    if (host.isAbsolute(id)) return findFile(id);
+    if (directory === undefined) return null;
+    if (relativeId(id)) return findFile(host.join(directory, id));
+    if (id.startsWith("#")) return packageImport(id, directory);
+    return findPackage(id, directory, self);
+  };
+  const label = (id: unknown) =>
+    typeof id === "string" && (host.isAbsolute(id) || relativeId(id))
+      ? "a path outside this project or missing"
+      : String(id);
+  // The bundled module whose body is running: the parent of what its literal
+  // and directory-bound requires load. A module the runtime require runs
+  // has its own require, which names it.
+  let active: RuntimeModule | undefined;
+  // The module whose literal require is about to run, set by `requireFrom`
+  // with `bind` just before the call: a call a module's callback makes after
+  // its body has finished still names that module as the parent. The next
+  // load takes it.
+  let pending: RuntimeModule | undefined;
+  // The module records this runtime made.
+  const records = new WeakSet<RuntimeModule>();
+  // Records `child` as loaded by `parent`, once, as Node's module graph does.
+  const adopt = (parent: RuntimeModule | undefined, child: RuntimeModule) => {
+    if (parent !== undefined && !parent.children.includes(child)) parent.children.push(child);
+    return child;
+  };
+  const newModule = (
+    real: string,
+    parent: RuntimeModule | undefined,
+    require: (module: () => RuntimeModule) => RuntimeRequire,
+  ) => {
+    const directory = host.dirname(real);
+    const module: RuntimeModule = {
+      exports: {},
+      id: real,
+      filename: real,
+      path: directory,
+      paths: lookupPaths(directory),
+      loaded: false,
+      parent,
+      children: [],
+      require: require(() => module),
+    };
+    records.add(module);
+    return adopt(parent, module);
+  };
+  // A module whose load failed leaves the cache and its parent's children,
+  // as in Node.
+  const drop = (module: RuntimeModule) => {
+    if (modules[module.id] === module) delete modules[module.id];
+    const siblings = module.parent?.children;
+    const index = siblings?.indexOf(module) ?? -1;
+    if (index !== -1) siblings!.splice(index, 1);
+  };
+  const evaluate = (real: string, parent: RuntimeModule | undefined) => {
+    const directory = host.dirname(real);
+    const module = newModule(real, parent, (owner) => create(directory, owner));
+    const require = module.require;
+    modules[real] = module;
+    try {
+      // Reading may fail too; the module then leaves the cache, as in Node.
+      let source = host.readFileSync(real, "utf8");
+      // Node 24 strips TypeScript's types and runs the rest as JavaScript.
+      if (/\.c?ts$/i.test(real)) {
+        if (host.stripTypes === undefined) {
+          throw failure(
+            "TypeScript is not supported here: " + JSON.stringify(host.relative(projectRoot, real)),
+            "ERR_UNKNOWN_FILE_EXTENSION",
+          );
+        }
+        source = host.stripTypes(source);
+      }
+      // A hashbang is not JavaScript; Node ignores it too.
+      host.compile(source.startsWith("#!") ? "//" + source : source, real).call(
+        module.exports,
+        module.exports,
+        require,
+        module,
+        real,
+        directory,
+      );
+    } catch (error) {
+      drop(module);
+      throw error;
+    }
+    module.loaded = true;
+    return module.exports;
+  };
+  const isDependency = (real: string) =>
+    dependencyPrefixes.some((prefix) => real.startsWith(prefix));
+  const load = (found: { real: string; relative: string }, parent: RuntimeModule | undefined) => {
+    const real = found.real;
+    if (real in modules) return adopt(parent, modules[real]!).exports;
+    if (real.endsWith(".json")) {
+      const text = host.readFileSync(real, "utf8");
+      // Node drops a byte order mark before parsing JSON.
+      const exports = JSON.parse(text.charCodeAt(0) === 0xfeff ? text.slice(1) : text);
+      // A complete module record, as a bundled load of the file makes.
+      const module = newModule(real, parent, (self) => create(host.dirname(real), self));
+      module.exports = exports;
+      module.loaded = true;
+      modules[real] = module;
+      return exports;
+    }
+    if (!isDependency(real)) throw missing(found.relative);
+    const name = JSON.stringify(real.slice(real.lastIndexOf(host.sep) + 1));
+    if (/\.node$/i.test(real)) {
+      throw failure("Native addons are not supported in API routes: " + name, "ERR_DLOPEN_FAILED");
+    }
+    if (/\.m[jt]s$/i.test(real) || (/\.(?:js|ts)$/i.test(real) && packageType(real) === "module")) {
+      throw failure("require() of an ES module is not supported here: " + name, "ERR_REQUIRE_ESM");
+    }
+    return evaluate(real, parent);
+  };
+  // Node's `paths` option: each entry is a directory to resolve from, a
+  // relative one from the working directory; anything else is an error.
+  const findFrom = (id: unknown, directory: string | undefined, options: unknown) => {
+    const paths = options !== null && typeof options === "object"
+      ? (options as { paths?: unknown }).paths
+      : undefined;
+    if (paths === undefined) return find(id, directory);
+    if (!Array.isArray(paths)) {
+      throw failure("The property 'options.paths' is invalid", "ERR_INVALID_ARG_VALUE");
+    }
+    // As in Node, an absolute id, a `#name` and the caller's own package
+    // name resolve from the caller, whatever the paths.
+    if (typeof id !== "string") return null;
+    if (host.isAbsolute(id) || id.startsWith("#")) return find(id, directory);
+    const scope = directory === undefined ? null : packageScope(directory);
+    const name = id.split("/").slice(0, id.startsWith("@") ? 2 : 1).join("/");
+    if (
+      scope != null && !relativeId(id) && scope.manifest.name === name &&
+      scope.manifest.exports != null
+    ) {
+      return findPackage(id, directory!);
+    }
+    for (const path of paths) {
+      if (typeof path !== "string") {
+        throw failure("A paths entry must be of type string", "ERR_INVALID_ARG_TYPE");
+      }
+      const found = find(id, host.isAbsolute(path) ? path : host.join(host.cwd(), path), false);
+      if (found !== null) return found;
+    }
+    return null;
+  };
+  // The `node_modules` directories a package id is looked up in from
+  // `directory`, nearest first, within the project, as Node's `module.paths`.
+  const lookupPaths = (directory: string) => {
+    const lookups: string[] = [];
+    let current = directory;
+    while (inProject(current)) {
+      if (!current.endsWith(host.sep + "node_modules")) {
+        lookups.push(host.join(current, "node_modules"));
+      }
+      const parent = host.dirname(current);
+      if (parent === current) break;
+      current = parent;
+    }
+    return lookups;
+  };
+  // A require() for `directory`; `owner` is the module it belongs to, if any.
+  const create = (directory: string | undefined, owner?: () => RuntimeModule) => {
+    const require = ((id: unknown) => {
+      // A literal require bound to its module names that module as the parent.
+      const parent = owner?.() ?? pending ?? active;
+      pending = undefined;
+      requireString(id, "id");
+      if (id === "") {
+        throw invalidArgument(
+          "The argument 'id' must be a non-empty string. Received ''",
+          "ERR_INVALID_ARG_VALUE",
+        );
+      }
+      const module = builtin(id);
+      if (module !== undefined) return module;
+      const found = find(id, directory);
+      if (found === null) throw missing(label(id));
+      return load(found, parent);
+    }) as RuntimeRequire;
+    const resolve = (id: unknown, options?: { paths?: unknown }) => {
+      requireString(id, "request");
+      if (builtin(id) !== undefined) return id as string;
+      // A bundled module's import.meta.resolve asks with this key for its
+      // package maps' import conditions.
+      const asImport = options !== null && typeof options === "object" &&
+        (options as Record<symbol, unknown>)[Symbol.for("veryfront.importConditions")] === true;
+      importing = asImport;
+      let found: ReturnType<typeof find>;
+      try {
+        found = findFrom(id, directory, options);
+      } finally {
+        importing = false;
+      }
+      if (found === null) throw missing(label(id));
+      // For an import, the module's URL, as import.meta.resolve returns it.
+      if (asImport) {
+        return host.toFileUrl(found.real) + ("suffix" in found ? found.suffix : "");
+      }
+      // Node returns the real path, which also keys require.cache.
+      return found.real;
+    };
+    // The directories Node would search for `request`: none for a built-in,
+    // the module's own for a path, and its `node_modules` chain, within the
+    // project, for a package.
+    const resolvePaths = (request: unknown) => {
+      requireString(request, "request");
+      if (builtin(request) !== undefined) return null;
+      if (directory === undefined) return [];
+      return relativeId(request) ? [directory] : lookupPaths(directory);
+    };
+    require.resolve = Object.assign(resolve, { paths: resolvePaths });
+    require.cache = modules;
+    // Code written for webpack; the callback runs at once, as nothing is split.
+    require.ensure = (_ids: unknown, callback: (require: RuntimeRequire) => void) => {
+      callback(require);
+    };
+    return require;
+  };
+  const byDirectory: Record<string, RuntimeRequire> = Object.create(null);
+  // Hands back a literal require's result, and drops an owner it left unused,
+  // such as for an ES module the bundler loads itself.
+  const settle = <T>(value: T) => {
+    pending = undefined;
+    return value;
+  };
+  const requireFrom = ((directory: unknown, module?: unknown, bind?: unknown) => {
+    // A record of this runtime's for a file in `directory`.
+    const own = records.has(module as RuntimeModule) &&
+      (module as RuntimeModule).path === directory;
+    // `bind`: the bundled literal require that follows belongs to `module`.
+    if (bind === true) {
+      pending = own ? module as RuntimeModule : undefined;
+      return settle;
+    }
+    if (own) return (module as RuntimeModule).require;
+    if (typeof directory !== "string") return create(undefined);
+    return byDirectory[directory] ??= create(directory);
+  }) as RuntimeRequireBinding["requireFrom"];
+  // The real path of each bundled file, by the bundler's key; null when it
+  // is not a dependency file.
+  const bundledPaths: Record<string, string | null> = Object.create(null);
+  const bundledPath = (key: string) => {
+    if (key in bundledPaths) return bundledPaths[key]!;
+    let real: string | null = null;
+    try {
+      // The bundler names files relative to its working directory, with
+      // symlinks followed; this keys them the way computed requires do.
+      const path = host.realpathSync(host.join(bundleRoot!, key));
+      if (dependencyPrefixes.some((prefix) => path.startsWith(prefix))) real = path;
+    } catch {
+      // Not a file path, such as a key in another namespace.
+    }
+    return bundledPaths[key] = real;
+  };
+  return {
+    // Route code's computed ids resolve from the project, as Node's would.
+    require: create(projectRoot),
+    requireFrom,
+    bundled: (key, body) => {
+      // The module whose literal require this is, when it is no longer running.
+      const parent = pending ?? active;
+      pending = undefined;
+      if (bundleRoot === undefined || typeof key !== "string") return null;
+      const real = bundledPath(key);
+      if (real === null) return null;
+      const cached = modules[real];
+      if (cached !== undefined) return adopt(parent, cached);
+      const module = newModule(real, parent, (self) => create(host.dirname(real), self));
+      modules[real] = module;
+      const previous = active;
+      active = module;
+      try {
+        body.call(module.exports, module.exports, module);
+      } catch (error) {
+        drop(module);
+        throw error;
+      } finally {
+        active = previous;
+      }
+      module.loaded = true;
+      return module;
+    },
+  };
+}
+
+// Whether every occurrence of `name` in `code` is a call that dependency
+// preparation wrote: `name("...")`, or the `typeof name === "function"` guard.
+function onlyHelperCalls(code: string, name: string): boolean {
+  const all = code.match(new RegExp(`\\b${name}\\b`, "g"))?.length ?? 0;
+  const calls = code.match(
+    new RegExp(`\\b${name}\\("|\\btypeof ${name} === "function"`, "g"),
+  )?.length ?? 0;
+  return all === calls;
+}
+
+// esbuild's helper that runs a bundled CommonJS file once, as esbuild 0.28
+// prints it. Its names may carry a numeric suffix, and a direct eval in the
+// bundle renames its locals. {@link prependRuntimeRequire} routes it through
+// the runtime module cache.
+const COMMONJS_HELPER = new RegExp(
+  [
+    "var (__commonJS\\d*) = \\((\\w+), (\\w+)\\) => function (__require\\d*)\\(\\) \\{\\n",
+    "  try \\{\\n",
+    "    return \\3 \\|\\| \\(0, \\2\\[(__getOwnPropNames\\d*)\\(\\2\\)\\[0\\]\\]\\)",
+    "\\(\\(\\3 = \\{ exports: \\{\\} \\}\\)\\.exports, \\3\\), \\3\\.exports;\\n",
+    "  \\} catch \\((\\w+)\\) \\{\\n",
+    "    throw \\3 = 0, \\6;\\n",
+    "  \\}\\n",
+    "\\};",
+  ].join(""),
+);
+
+/**
+ * Binds the module-level `require` that esbuild's output calls for anything it
+ * did not bundle, to {@link createRuntimeRequire}. esbuild's ESM output never
+ * declares a top-level `require` (it renames a route's own binding of that
+ * name), so the prologue cannot collide with route code. Each bundled
+ * CommonJS dependency then runs through the runtime module cache; see
+ * {@link RuntimeRequireBinding.bundled}. `bundleRoot` is the bundle's working
+ * directory, which its file names are relative to.
+ */
+export async function prependRuntimeRequire(
+  code: string,
+  projectRoot: string,
+  dependencyDirectories: readonly string[],
+  bundleRoot: string,
+): Promise<string> {
+  let prefix = "__vf_runtime";
+  while (code.includes(prefix)) prefix += "_";
+  // Dependency code calls the helper by a fixed name, which route code may
+  // declare too. The prologue binds it under a name the bundle does not use,
+  // and only the free references, which are dependency calls, are renamed.
+  const requireFrom = `${prefix}_require_from`;
+  if (onlyHelperCalls(code, BUNDLED_REQUIRE_FROM)) {
+    code = code.replace(new RegExp(`\\b${BUNDLED_REQUIRE_FROM}\\b`, "g"), requireFrom);
+  } else {
+    // Some other use of the name, such as a declaration in route code: the
+    // parser tells free references apart, as the bundler does.
+    code = (await transform(code, {
+      loader: "js",
+      format: "esm",
+      platform: "neutral",
+      logLevel: "silent",
+      define: { [BUNDLED_REQUIRE_FROM]: requireFrom },
+    })).code;
+  }
+  const bundled = `${prefix}_bundled`;
+  if (/\bvar __commonJS\d* = /.test(code)) {
+    if (!COMMONJS_HELPER.test(code)) {
+      // Another bundler version: fail closed rather than run modules twice.
+      throw new Error("[API] handler build failed: unexpected CommonJS helper in the bundle");
+    }
+    code = code.replace(
+      COMMONJS_HELPER,
+      (
+        _whole,
+        helper: string,
+        cb: string,
+        mod: string,
+        inner: string,
+        ownNames: string,
+        error: string,
+      ) =>
+        [
+          `var ${helper} = (${cb}, ${mod}) => function ${inner}() {`,
+          `  const key = ${ownNames}(${cb})[0];`,
+          `  const managed = ${bundled}(key, ${cb}[key]);`,
+          "  if (managed !== null) return managed.exports;",
+          "  try {",
+          `    return ${mod} || (0, ${cb}[key])((${mod} = { exports: {} }).exports, ${mod}), ${mod}.exports;`,
+          `  } catch (${error}) {`,
+          `    throw ${mod} = 0, ${error};`,
+          "  }",
+          "};",
+        ].join("\n"),
+    );
+  }
+  const host = [
+    `getBuiltinModule: (id) => ${prefix}_process.getBuiltinModule(id)`,
+    `isFile: (path) => { try { return ${prefix}_fs.statSync(path).isFile(); } catch { return false; } }`,
+    `realpathSync: ${prefix}_fs.realpathSync`,
+    `readFileSync: ${prefix}_fs.readFileSync`,
+    // Captured now: route code runs after the prologue.
+    `compile: ((F) => (source) => new F("exports", "require", "module", "__filename", "__dirname", source))(Function)`,
+    `stripTypes: ${prefix}_process.getBuiltinModule("node:module")?.stripTypeScriptTypes`,
+    `isAbsolute: ${prefix}_path.isAbsolute`,
+    `relative: ${prefix}_path.relative`,
+    `join: ${prefix}_path.join`,
+    `dirname: ${prefix}_path.dirname`,
+    `sep: ${prefix}_path.sep`,
+    `toFileUrl: (path) => ${prefix}_url.pathToFileURL(path).href`,
+    `cwd: () => ${prefix}_process.cwd()`,
+  ];
+  const lines = [
+    `import ${prefix}_process from "node:process";`,
+    `import * as ${prefix}_fs from "node:fs";`,
+    `import * as ${prefix}_path from "node:path";`,
+    `import * as ${prefix}_url from "node:url";`,
+    `const { require, bundled: ${bundled}, requireFrom: ${requireFrom} } = (${createRuntimeRequire.toString()})({ ${
+      host.join(", ")
+    } }, ${JSON.stringify(projectRoot)}, ${JSON.stringify([...PREFIX_ONLY_BUILTINS])}, ${
+      JSON.stringify(dependencyDirectories)
+    }, ${JSON.stringify(bundleRoot)});`,
+  ];
+  // A hashbang is only valid as the first line.
+  const hashbangEnd = code.startsWith("#!") ? code.indexOf("\n") + 1 : 0;
+  return code.slice(0, hashbangEnd) + lines.join("\n") + "\n" + code.slice(hashbangEnd);
+}
diff --git a/src/routing/api/module-loader/external-import-rewriter.test.ts b/src/routing/api/module-loader/external-import-rewriter.test.ts
index 2da0bd57e5..c2a4c60b54 100644
--- a/src/routing/api/module-loader/external-import-rewriter.test.ts
+++ b/src/routing/api/module-loader/external-import-rewriter.test.ts
@@ -1,17 +1,10 @@
 import "#veryfront/schemas/_test-setup.ts";
-import {
-  assert,
-  assertEquals,
-  assertStringIncludes,
-  assertThrows,
-} from "#veryfront/testing/assert.ts";
+import { assertEquals, assertStringIncludes, assertThrows } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
 import type { FileInfo } from "#veryfront/platform/adapters/base.ts";
 import type { FileSystem } from "#veryfront/platform/compat/fs.ts";
 import {
-  generateCompiledBinaryRequireShim,
   getNodeExternalPackagesToResolve,
-  NODE_BUILTINS,
   resolveEsmUserDependencies,
   resolveVeryfrontPackageExport,
   rewriteCompiledBinaryUserDependencyImports,
@@ -116,45 +109,12 @@ describe("external-import-rewriter", () => {
   describe("rewriteCompiledBinaryUserDependencyImports", () => {
     const deps = new Map([["lodash", "^4"]]);
 
-    it("rewrites a default import to interop require", () => {
-      const out = rewriteCompiledBinaryUserDependencyImports(
-        `import _ from "lodash";`,
-        deps,
-      );
-      assertEquals(out, `const _ = __vf_interopDefault(require("lodash"));`);
-    });
-
-    it("rewrites a namespace import to require", () => {
-      const out = rewriteCompiledBinaryUserDependencyImports(
-        `import * as _ from "lodash";`,
-        deps,
-      );
-      assertEquals(out, `const _ = require("lodash");`);
-    });
-
-    it("rewrites a named import to a destructuring require", () => {
-      const out = rewriteCompiledBinaryUserDependencyImports(
-        `import { merge } from "lodash";`,
-        deps,
-      );
-      assertStringIncludes(out, `= require("lodash")`);
-      assertStringIncludes(out, "merge");
-    });
-
-    it("rewrites a dynamic import to a resolved require promise", () => {
-      const out = rewriteCompiledBinaryUserDependencyImports(
-        `const m = import("lodash");`,
-        deps,
-      );
-      assertStringIncludes(out, `Promise.resolve(require("lodash"))`);
-    });
-
-    it("rewrites a subpath import including the subpath in require", () => {
-      const out = rewriteCompiledBinaryUserDependencyImports(
-        `import merge from "lodash/merge";`,
-        deps,
-      );
-      assertStringIncludes(out, `require("lodash/merge")`);
+    // The route build bundles CommonJS dependencies (inbox#4177), so an import
+    // of one never reaches this rewrite; it must not be turned into require().
+    it("leaves imports of CommonJS dependencies untouched", () => {
+      const code =
+        `import _ from "lodash";\nimport merge from "lodash/merge";\nconst m = import("lodash");`;
+      assertEquals(rewriteCompiledBinaryUserDependencyImports(code, deps), code);
     });
 
     it("leaves imports for packages not in userDeps untouched", () => {
@@ -383,21 +343,6 @@ describe("external-import-rewriter", () => {
     });
   });
 
-  describe("generateCompiledBinaryRequireShim", () => {
-    it("emits a self-contained CJS require shim referencing the project dir", () => {
-      const shim = generateCompiledBinaryRequireShim("/srv/app");
-      // Declares the require shim and embeds the project package.json path.
-      assertStringIncludes(shim, "__vf_createRequire");
-      assertStringIncludes(shim, "/srv/app/package.json");
-      // Embeds the node builtin set used for routing builtin requires.
-      assertStringIncludes(shim, JSON.stringify(NODE_BUILTINS));
-      // Defines a require function and an interop helper.
-      assertStringIncludes(shim, "var require = function(id)");
-      assertStringIncludes(shim, "__vf_interopDefault");
-      assert(shim.length > 0);
-    });
-  });
-
   describe("Node Veryfront package imports", () => {
     // An API route that imports `veryfront/tool` must reach the SAME module
     // instance the running server uses, or `toolRegistry.get()` looks into a
diff --git a/src/routing/api/module-loader/external-import-rewriter.ts b/src/routing/api/module-loader/external-import-rewriter.ts
index 00b9bd3931..873ac6f936 100644
--- a/src/routing/api/module-loader/external-import-rewriter.ts
+++ b/src/routing/api/module-loader/external-import-rewriter.ts
@@ -50,109 +50,6 @@ export async function readProjectDependencies(
   return await readProjectDependenciesForRoute(projectDir, fs);
 }
 
-/**
- * Generates a CJS module loader shim for compiled Deno binaries.
- *
- * In compiled binaries, `createRequire()` can resolve module paths and load
- * built-in modules (fs, path, etc.), but cannot load CJS files from disk
- * (loadMaybeCjs fails with "path not found"). This shim works around that
- * limitation by using `Deno.readTextFileSync` to read CJS files and
- * `new Function` to evaluate them in a proper CJS wrapper with require,
- * exports, module, __filename, and __dirname bindings.
- */
-export function generateCompiledBinaryRequireShim(projectDir: string): string {
-  const builtinSet = JSON.stringify(NODE_BUILTINS);
-  const safeProjectDir = JSON.stringify(projectDir + "/package.json");
-  const safeProjectRoot = JSON.stringify(pathHelper.resolve(projectDir));
-
-  return `
-import { createRequire as __vf_createRequire } from "node:module";
-import { dirname as __vf_dirname, resolve as __vf_resolve } from "node:path";
-var __vf_builtinRequire = __vf_createRequire(${safeProjectDir});
-var __vf_builtinSet = new Set(${builtinSet});
-var __vf_projectRoot = ${safeProjectRoot};
-// VULN-FS-5: Canonicalize the project root so containment checks using
-// Deno.realPathSync(resolved) compare canonical-vs-canonical. Without this,
-// when the project itself is opened via a symlink, the realpath'd resolved
-// module path has a different prefix than the non-canonical projectRoot and
-// legitimate dependencies would be rejected.
-try { __vf_projectRoot = Deno.realPathSync(__vf_projectRoot); } catch (_) { /* expected: projectRoot may not exist at shim init in some environments */ }
-var __vf_cache = Object.create(null);
-// Resolve symlinks so containment compares canonical paths. A module that does
-// not exist yet cannot be canonicalized, so fall back to its parent directory,
-// which is what carries a symlinked project root; only if that fails too is the
-// plain resolved path used.
-function __vf_canonicalize(candidate) {
-  try {
-    return Deno.realPathSync(candidate);
-  } catch (_) { /* expected: candidate may not exist */ }
-  try {
-    var parent = __vf_dirname(candidate);
-    return Deno.realPathSync(parent) + candidate.slice(parent.length);
-  } catch (_) { /* expected: parent may not exist either */ }
-  return __vf_resolve(candidate);
-}
-function __vf_assertContained(resolved) {
-  var norm = __vf_resolve(resolved).replace(/\\\\/g, "/");
-  var root = __vf_projectRoot.replace(/\\\\/g, "/");
-  if (!norm.startsWith(root + "/") && norm !== root) {
-    throw new Error("CJS loader blocked path outside project: " + resolved);
-  }
-}
-function __vf_loadCjs(id, parentDir) {
-  if (id.startsWith("node:")) return __vf_builtinRequire(id);
-  if (__vf_builtinSet.has(id)) return __vf_builtinRequire(id);
-  var slashIdx = id.indexOf("/");
-  if (slashIdx > 0 && __vf_builtinSet.has(id.slice(0, slashIdx))) return __vf_builtinRequire(id);
-  var resolved;
-  if (id.startsWith(".") || id.startsWith("/")) {
-    resolved = __vf_resolve(parentDir, id);
-    if (!resolved.match(/\\.[a-zA-Z0-9]+$/)) {
-      var exts = [".js", ".cjs", ".json", "/index.js", "/index.cjs", "/index.json"];
-      for (var i = 0; i < exts.length; i++) {
-        try { Deno.statSync(resolved + exts[i]); resolved += exts[i]; break; } catch (_) { /* expected: probing file extensions */ }
-      }
-    }
-  } else {
-    resolved = __vf_builtinRequire.resolve(id);
-  }
-  // VULN-FS-5: Canonicalize before asserting containment, so the candidate and
-  // the already-canonical project root are compared like with like, then assert
-  // once. Checking the non-canonical path first rejected dependencies genuinely
-  // inside a project whose root is reached through a symlink, which is the
-  // ordinary case for package managers, CI checkouts and macOS /tmp.
-  // Canonicalizing first also keeps the guard against symlinked node_modules
-  // entries pointing outside the root: the escape is only visible once resolved.
-  resolved = __vf_canonicalize(resolved);
-  __vf_assertContained(resolved);
-  if (resolved in __vf_cache) return __vf_cache[resolved];
-  var code = Deno.readTextFileSync(resolved);
-  if (resolved.endsWith(".json")) {
-    var json = JSON.parse(code);
-    __vf_cache[resolved] = json;
-    return json;
-  }
-  var mod = { exports: {} };
-  __vf_cache[resolved] = mod.exports;
-  var dir = __vf_dirname(resolved);
-  var childReq = function(childId) { return __vf_loadCjs(childId, dir); };
-  childReq.resolve = function(childId) {
-    if (childId.startsWith(".") || childId.startsWith("/")) return __vf_resolve(dir, childId);
-    return __vf_builtinRequire.resolve(childId);
-  };
-  childReq.ensure = function(mods, cb) { cb(); };
-  var fn = new Function("exports", "require", "module", "__filename", "__dirname", "global", "globalThis", "Worker", code);
-  fn(mod.exports, childReq, mod, resolved, dir, globalThis, globalThis, undefined);
-  __vf_cache[resolved] = mod.exports;
-  return mod.exports;
-}
-function __vf_interopDefault(m) { return m && m.__esModule && m.default !== undefined ? m.default : m; }
-var require = function(id) { return __vf_loadCjs(id, ${JSON.stringify(projectDir)}); };
-require.resolve = function(id) { return __vf_builtinRequire.resolve(id); };
-require.ensure = function(mods, cb) { cb(); };
-`.trim();
-}
-
 export function getNodeExternalPackagesToResolve(userDeps: Map<string, string>): string[] {
   return getNodeExternalPackagesToResolveForRoute(userDeps);
 }
diff --git a/src/routing/api/module-loader/loader-helpers.test.ts b/src/routing/api/module-loader/loader-helpers.test.ts
index d58a6aebd7..d14289ffe9 100644
--- a/src/routing/api/module-loader/loader-helpers.test.ts
+++ b/src/routing/api/module-loader/loader-helpers.test.ts
@@ -5,7 +5,6 @@ import {
   FILE_EXTENSIONS,
   getLoaderForFile,
   resolveExportEntry,
-  toCjsDestructureBindings,
   validateModulePath,
 } from "./loader-helpers.ts";
 
@@ -34,15 +33,6 @@ describe("routing/api/module-loader helpers", () => {
     assertEquals(resolveExportEntry({ require: "./cjs.js" }), undefined);
   });
 
-  it("converts CJS destructuring bindings", () => {
-    assertEquals(
-      toCjsDestructureBindings("{ parse as parsePdf, version }"),
-      "{ parse: parsePdf, version }",
-    );
-    assertEquals(toCjsDestructureBindings("{ foo, bar }"), "{ foo, bar }");
-    assertEquals(toCjsDestructureBindings("{   }"), "{}");
-  });
-
   it("returns the expected file loaders and extensions", () => {
     assertEquals(
       FILE_EXTENSIONS,
@@ -54,6 +44,8 @@ describe("routing/api/module-loader helpers", () => {
     assertEquals(getLoaderForFile("file.jsx"), "jsx", "jsx files must use the jsx loader");
     assertEquals(getLoaderForFile("file.json"), "json", "json files must use the json loader");
     assertEquals(getLoaderForFile("file.mjs"), "js", "mjs files must use the js loader");
+    assertEquals(getLoaderForFile("file.cts"), "ts", "cts files are CommonJS TypeScript");
+    assertEquals(getLoaderForFile("file.mts"), "ts", "mts files are ESM TypeScript");
     assertEquals(getLoaderForFile("noext"), "js", "unmapped extensions fall back to the js loader");
   });
 });
diff --git a/src/routing/api/module-loader/loader-helpers.ts b/src/routing/api/module-loader/loader-helpers.ts
index bfba9f40df..2b7dba6ee2 100644
--- a/src/routing/api/module-loader/loader-helpers.ts
+++ b/src/routing/api/module-loader/loader-helpers.ts
@@ -6,6 +6,8 @@ const EXT_TO_LOADER: Record<string, "tsx" | "jsx" | "ts" | "js" | "json"> = {
   tsx: "tsx",
   jsx: "jsx",
   ts: "ts",
+  mts: "ts",
+  cts: "ts",
   json: "json",
 };
 
@@ -46,23 +48,6 @@ export function resolveExportEntry(entry: unknown): string | undefined {
   return undefined;
 }
 
-export function toCjsDestructureBindings(bindings: string): string {
-  const inner = bindings.trim().replace(/^\{\s*/, "").trimEnd().replace(/\}$/, "");
-  if (!inner) return "{}";
-
-  const converted = inner
-    .split(",")
-    .map((part) => part.trim())
-    .filter(Boolean)
-    .map((part) => {
-      const aliasMatch = part.match(/^([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)$/);
-      if (aliasMatch) return `${aliasMatch[1]}: ${aliasMatch[2]}`;
-      return part;
-    });
-
-  return `{ ${converted.join(", ")} }`;
-}
-
 export function getLoaderForFile(filePath: string): "tsx" | "jsx" | "ts" | "js" | "json" {
   const ext = filePath.split(".").pop() ?? "";
   return EXT_TO_LOADER[ext] ?? "js";
diff --git a/src/routing/api/module-loader/loader.test.ts b/src/routing/api/module-loader/loader.test.ts
index f1e2ff2cc9..1cc8044847 100644
--- a/src/routing/api/module-loader/loader.test.ts
+++ b/src/routing/api/module-loader/loader.test.ts
@@ -6,7 +6,6 @@ import {
   assertMatch,
   assertNotEquals,
   assertRejects,
-  assertThrows,
 } from "#veryfront/testing/assert.ts";
 import { afterAll, describe, it } from "#veryfront/testing/bdd.ts";
 import { join, toFileUrl } from "#veryfront/compat/path";
@@ -15,7 +14,6 @@ import {
   bundledModuleScopeDiscriminator,
   bundlerForcesTypeScript,
   canDirectImportSpecifier,
-  generateCompiledBinaryRequireShim,
   getNodeExternalPackagesToResolve,
   getUserDependencies,
   isBareModuleSpecifier,
@@ -31,7 +29,6 @@ import {
   rewriteDenoNodeBuiltinImports,
   rewriteDenoNpmDependencyImports,
   rewriteNodeExternalImports,
-  toCjsDestructureBindings,
   typeScriptBuildOptions,
 } from "./loader.ts";
 import { __setCompiledBinaryForTests } from "#veryfront/security/sandbox/isolation-capability.ts";
@@ -1668,21 +1665,6 @@ describe("loadHandlerModule", { sanitizeResources: false, sanitizeOps: false },
     assertEquals(typeof route?.GET, "function");
   });
 
-  it("converts aliased named imports to valid CJS destructuring", () => {
-    assertEquals(
-      toCjsDestructureBindings("{ parse as parsePdf, version }"),
-      "{ parse: parsePdf, version }",
-    );
-    assertEquals(
-      toCjsDestructureBindings("{ default as foo, bar as baz }"),
-      "{ default: foo, bar: baz }",
-    );
-    assertEquals(
-      toCjsDestructureBindings("{ foo, bar }"),
-      "{ foo, bar }",
-    );
-  });
-
   it("builds the node external package resolution list without duplicates", () => {
     const packages = getNodeExternalPackagesToResolve(
       new Map([
@@ -1823,32 +1805,6 @@ describe("loadHandlerModule", { sanitizeResources: false, sanitizeOps: false },
     assertMatch(rewritten, /import\("\.\/_vf_tool\.mjs"\)/);
   });
 
-  it("rewrites compiled-binary user dependency imports to require-based shims", () => {
-    const source = [
-      'import thing from "my-lib";',
-      'import { alpha as beta } from "my-lib";',
-      'import * as namespace from "my-lib";',
-      'import combo, { gamma } from "my-lib";',
-      'import widget from "my-lib/subpath";',
-      'const loaded = import("my-lib/subpath");',
-    ].join("\n");
-
-    const rewritten = rewriteCompiledBinaryUserDependencyImports(
-      source,
-      new Map([["my-lib", "^1.0.0"]]),
-    );
-
-    assertMatch(rewritten, /const thing = __vf_interopDefault\(require\("my-lib"\)\)/);
-    assertMatch(rewritten, /const \{ alpha: beta \} = require\("my-lib"\)/);
-    assertMatch(rewritten, /const namespace = require\("my-lib"\)/);
-    assertMatch(
-      rewritten,
-      /const __vf_tmp_combo = require\("my-lib"\); const combo = __vf_interopDefault\(__vf_tmp_combo\); const \{ gamma \} = __vf_tmp_combo/,
-    );
-    assertMatch(rewritten, /const widget = require\("my-lib\/subpath"\)/);
-    assertMatch(rewritten, /Promise\.resolve\(require\("my-lib\/subpath"\)\)/);
-  });
-
   it("rewrites ESM-only user dependency imports to real file:// module URLs", () => {
     const source = [
       'import thing from "esm-lib";',
@@ -1895,7 +1851,7 @@ describe("loadHandlerModule", { sanitizeResources: false, sanitizeOps: false },
     assertEquals(rewritten.includes('require("esm-lib")'), false);
   });
 
-  it("keeps CJS deps on the require shim while ESM deps use file:// URLs", () => {
+  it("rewrites ESM deps to file:// URLs and leaves bundled CJS deps alone", () => {
     const source = [
       'import esm from "esm-lib";',
       'import cjs from "cjs-lib";',
@@ -1914,7 +1870,7 @@ describe("loadHandlerModule", { sanitizeResources: false, sanitizeOps: false },
     );
 
     assertMatch(rewritten, /import esm from "file:\/\/\/proj\/node_modules\/esm-lib\/index\.mjs"/);
-    assertMatch(rewritten, /const cjs = __vf_interopDefault\(require\("cjs-lib"\)\)/);
+    assertMatch(rewritten, /import cjs from "cjs-lib"/);
   });
 
   it("detects ESM dependencies via type:module and .mjs entry points", async () => {
@@ -5416,209 +5372,6 @@ describe("loadHandlerModule", { sanitizeResources: false, sanitizeOps: false },
   });
 });
 
-/**
- * Load the emitted compiled-binary shim as a real module so its containment
- * checks are exercised instead of being re-implemented by the test.
- */
-async function importCompiledBinaryRequireShim(
-  projectDir: string,
-): Promise<(id: string) => unknown> {
-  const shimPath = join(projectDir, "vf-require-shim.mjs");
-  await fs.writeTextFile(
-    shimPath,
-    `${generateCompiledBinaryRequireShim(projectDir)}\nexport { require as vfRequire };\n`,
-  );
-  const module = await import(toFileUrl(shimPath).href) as {
-    vfRequire: (id: string) => unknown;
-  };
-  return module.vfRequire;
-}
-
-// VULN-FS-5: compiled-binary CJS loader must enforce project-root containment
-// on BOTH branches of __vf_loadCjs (relative/absolute ids AND bare-package
-// ids), and must re-canonicalise via Deno.realPathSync so that a symlinked
-// node_modules entry cannot escape the project root.
-describe("generateCompiledBinaryRequireShim - static checks (VULN-FS-5)", () => {
-  it("emits a __vf_assertContained call after bare-package resolution", () => {
-    const shim = generateCompiledBinaryRequireShim("/fake/project");
-    // The original (vulnerable) layout called __vf_assertContained only inside
-    // the relative/absolute branch. The fix moves the assertion to run after
-    // both branches (i.e. AFTER the `} else { resolved = ...resolve(id); }`).
-    const elseIdx = shim.indexOf("__vf_builtinRequire.resolve(id)");
-    const assertIdx = shim.indexOf("__vf_assertContained(resolved)", elseIdx);
-    assertEquals(
-      assertIdx > elseIdx,
-      true,
-      "containment check must follow bare-package resolution",
-    );
-  });
-
-  it("canonicalises the resolved path before checking containment", () => {
-    const shim = generateCompiledBinaryRequireShim("/fake/project");
-    assertEquals(shim.includes("Deno.realPathSync"), true);
-    // The containment check must run on the canonical path. Asserting on the
-    // pre-canonical one instead compares a non-canonical candidate against an
-    // already-canonical root, which rejects legitimate dependencies whenever
-    // the project root is itself a symlink.
-    const canonIdx = shim.indexOf("resolved = __vf_canonicalize(resolved)");
-    const assertIdx = shim.indexOf("__vf_assertContained(resolved)", canonIdx);
-    assertEquals(
-      canonIdx !== -1 && assertIdx > canonIdx,
-      true,
-      "the resolved path must be canonicalised before it is containment-checked",
-    );
-  });
-
-  it("canonicalises __vf_projectRoot at shim init so symlinked project roots are not falsely rejected", () => {
-    // Regression: prior to the fix, __vf_projectRoot was only path.resolve()'d,
-    // so when realPathSync(resolved) returned a canonical path whose prefix
-    // differed from a symlinked projectRoot, every legitimate dep was blocked.
-    const shim = generateCompiledBinaryRequireShim("/fake/project");
-    const rootInitIdx = shim.indexOf("var __vf_projectRoot =");
-    const canonIdx = shim.indexOf(
-      "Deno.realPathSync(__vf_projectRoot)",
-      rootInitIdx,
-    );
-    const fnIdx = shim.indexOf("function __vf_assertContained");
-    assertEquals(
-      canonIdx > rootInitIdx && canonIdx < fnIdx,
-      true,
-      "__vf_projectRoot must be realPathSync'd between its declaration and the assertContained definition",
-    );
-  });
-
-  denoIt("the emitted containment check rejects paths outside the project root", async () => {
-    // Execute the shim the generator actually emits: a local re-implementation
-    // would keep passing even if the emitted __vf_assertContained were gutted.
-    const projectDir = Deno.realPathSync(await makeTempDir());
-    const packageDir = join(projectDir, "node_modules", "ok");
-    await fs.mkdir(packageDir, { recursive: true });
-    await fs.writeTextFile(join(packageDir, "index.js"), "module.exports = { ok: true };");
-
-    const vfRequire = await importCompiledBinaryRequireShim(projectDir);
-
-    assertEquals(
-      (vfRequire(join(packageDir, "index.js")) as { ok: boolean }).ok,
-      true,
-      "in-project CJS must load",
-    );
-    assertThrows(
-      () => vfRequire("/etc/passwd"),
-      Error,
-      "blocked path outside project",
-      "absolute host paths must be refused",
-    );
-    assertThrows(
-      () => vfRequire(`${projectDir}ile/secret.js`),
-      Error,
-      "blocked path outside project",
-      "prefix-sibling dirs must be refused",
-    );
-    assertThrows(
-      () => vfRequire(join(projectDir, "node_modules", "..", "..", "escape.js")),
-      Error,
-      "blocked path outside project",
-      "'..' segments must be normalised before the containment check",
-    );
-
-    try {
-      await fs.remove(projectDir, { recursive: true });
-    } catch (_) { /* best effort */ }
-  });
-});
-
-describe("generateCompiledBinaryRequireShim - symlink resistance (VULN-FS-5)", {
-  sanitizeResources: false,
-  sanitizeOps: false,
-}, () => {
-  denoIt("re-canonicalisation via realPathSync catches a node_modules symlink escape", async () => {
-    // Create a project root, a decoy "evil" package whose entry file is a
-    // symlink pointing at a file outside the project root. If the shim only
-    // checked the pre-symlink path, the containment test would pass but the
-    // readTextFileSync would still leak the external file. The emitted shim is
-    // executed here so the realPathSync + second __vf_assertContained is the
-    // thing under test, not a copy of it.
-    const projectDir = Deno.realPathSync(await makeTempDir());
-    const outsideDir = Deno.realPathSync(await makeTempDir());
-    const outsideFile = join(outsideDir, "secret.txt");
-    await fs.writeTextFile(outsideFile, "top-secret-contents");
-
-    const nodeModules = join(projectDir, "node_modules", "evil");
-    await fs.mkdir(nodeModules, { recursive: true });
-    const symlinkEntry = join(nodeModules, "index.js");
-    try {
-      await Deno.symlink(outsideFile, symlinkEntry);
-    } catch (e) {
-      // On platforms without symlink permission, skip this test rather than
-      // misreport a failure. The static check above still covers the fix.
-      const msg = e instanceof Error ? e.message : String(e);
-      if (msg.includes("permission") || msg.includes("not supported")) return;
-      throw e;
-    }
-
-    const vfRequire = await importCompiledBinaryRequireShim(projectDir);
-
-    const error = assertThrows(
-      () => vfRequire(symlinkEntry),
-      Error,
-      "blocked path outside project",
-      "a symlinked dependency escaping the project root must be rejected",
-    );
-    assertEquals(
-      (error as Error).message.includes("top-secret-contents"),
-      false,
-      "the outside file contents must never reach the caller",
-    );
-
-    // Clean up.
-    try {
-      await fs.remove(projectDir, { recursive: true });
-    } catch (_) { /* best effort */ }
-    try {
-      await fs.remove(outsideDir, { recursive: true });
-    } catch (_) { /* best effort */ }
-  });
-
-  denoIt("accepts dependencies through a symlinked project root", async () => {
-    // Regression for #4091. The previous version of this test re-implemented
-    // __vf_assertContained locally and only ever called it with the already
-    // canonicalised path, so it passed without ever exercising the check that
-    // actually rejected these dependencies. The emitted shim is executed here
-    // so the containment check itself is the thing under test.
-    const realProject = Deno.realPathSync(await makeTempDir());
-    const symlinkedProject = `${realProject}-link`;
-    try {
-      await Deno.symlink(realProject, symlinkedProject);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      if (msg.includes("permission") || msg.includes("not supported")) return;
-      throw e;
-    }
-
-    const depDir = join(realProject, "node_modules", "ok");
-    await fs.mkdir(depDir, { recursive: true });
-    await fs.writeTextFile(join(depDir, "index.js"), "module.exports = { ok: true };");
-
-    // The project root is handed to the shim as the symlinked path, which is
-    // what happens with package managers, CI checkouts, and macOS /tmp.
-    const vfRequire = await importCompiledBinaryRequireShim(symlinkedProject);
-
-    assertEquals(
-      (vfRequire(join(symlinkedProject, "node_modules", "ok", "index.js")) as { ok: boolean })
-        .ok,
-      true,
-      "a dependency genuinely inside the project must load when the root is a symlink",
-    );
-
-    try {
-      await fs.remove(symlinkedProject);
-    } catch (_) { /* best effort */ }
-    try {
-      await fs.remove(realProject, { recursive: true });
-    } catch (_) { /* best effort */ }
-  });
-});
-
 describe("isSpecifierResolutionError", () => {
   // Direct import leaves specifier resolution to the runtime, which knows
   // nothing about the project's `@/` alias — those routes used to 500 with a
diff --git a/src/routing/api/module-loader/loader.ts b/src/routing/api/module-loader/loader.ts
index b707eb8509..411ae02189 100644
--- a/src/routing/api/module-loader/loader.ts
+++ b/src/routing/api/module-loader/loader.ts
@@ -43,11 +43,26 @@ import { withSpan } from "#veryfront/observability/tracing/otlp-setup.ts";
 import { wrapWithCurrentContext } from "#veryfront/platform/adapters/fs/veryfront/multi-project-adapter.ts";
 import { isWithinDirectory } from "#veryfront/security/path-validation.ts";
 import {
-  generateCompiledBinaryRequireShim,
   NODE_BUILTINS,
   readProjectDependencies,
+  resolveEsmUserDependencies as resolveEsmUserDependencyLocations,
   rewriteExternalImports,
 } from "./external-import-rewriter.ts";
+import {
+  COMPILED_RESOLVE_OPTIONS,
+  createCompiledBuiltinPlugin,
+  createDependencyResolvePlugin,
+  createImportExternalsPlugin,
+  createNativeAddonPlugin,
+  dependencyDirectories,
+  dependencyFilePredicate,
+  dependencyJsonLoad,
+  type IsFile,
+  PackageTypeLookup,
+  prepareDependencyFile,
+  prependRuntimeRequire,
+  rewriteImportSpecifiers,
+} from "./compiled-cjs-bundling.ts";
 import {
   MAX_WORKER_MODULE_SOURCE_BYTES,
   type PreparedWorkerModule,
@@ -66,7 +81,6 @@ import { tryGetRegistryScopeId } from "#veryfront/cache/cache-key-builder.ts";
 import { getProjectEnvSnapshot } from "#veryfront/server/project-env/storage.ts";
 import { currentRequestContext } from "#veryfront/platform/request-context-access.ts";
 export {
-  generateCompiledBinaryRequireShim,
   getNodeExternalPackagesToResolve,
   loadVeryfrontExportsMap,
   resolveEsmUserDependencies,
@@ -102,8 +116,6 @@ const MAX_TYPESCRIPT_CONFIG_BYTES = 1024 * 1024;
 const ROUTE_RUNTIME_SHIM_SPECIFIER = "veryfront:route-runtime-shim";
 const ROUTE_RUNTIME_SHIM_NAMESPACE = "veryfront-route-runtime-shim";
 
-export { toCjsDestructureBindings } from "./loader-helpers.ts";
-
 export function loadHandlerModule(options: LoadHostModuleOptions): Promise<APIRoute | null> {
   if (!isExplicitHostProjectCodeExecutionAllowed(options)) {
     return Promise.reject(
@@ -1300,6 +1312,71 @@ async function loadValidatedJSModule(
   );
 }
 
+/** Whether a path the bundler resolved is an installed dependency's file. */
+type DependencyFilePredicate = (path: string) => boolean;
+
+const noDependencyFiles: DependencyFilePredicate = () => false;
+
+/** The project root with symlinks followed, or as given when it has none on the host. */
+async function canonicalProjectRoot(projectDir: string): Promise<string> {
+  try {
+    return await realPath(projectDir);
+  } catch {
+    // expected: an adapter-backed project may have no host directory
+    return pathHelper.resolve(projectDir);
+  }
+}
+
+/** Whether a path is a regular file on the host. */
+/**
+ * A project resolver's target that is an installed dependency file, as a
+ * file-namespace result: there the project boundary prepares it as a
+ * dependency, and it is the same module the dependency's own imports reach.
+ * Undefined for any other target, which the resolver's namespace loads.
+ */
+export async function dependencyTarget(
+  path: string,
+  suffix: string | undefined,
+  isDependencyFile: DependencyFilePredicate,
+): Promise<{ path: string; suffix?: string } | undefined> {
+  if (!isDependencyFile(path)) return undefined;
+  for (const extension of [...FILE_EXTENSIONS, ".cjs", ".json"]) {
+    if (await hostIsFile(path + extension)) {
+      return suffix ? { path: path + extension, suffix } : { path: path + extension };
+    }
+  }
+  return undefined;
+}
+
+/** A path with symlinks followed, or null when it does not exist. */
+async function hostRealPath(path: string): Promise<string | null> {
+  try {
+    return await realPath(path);
+  } catch {
+    return null; // expected: no such file
+  }
+}
+
+const hostIsFile: IsFile = async (path) => {
+  try {
+    return (await createFileSystem().stat(path)).isFile;
+  } catch {
+    return false; // expected: no such file
+  }
+};
+
+/** Reads a package.json through the project snapshot, or null when there is none. */
+function snapshotManifestReader(sourceSnapshot: ProjectSourceSnapshot) {
+  return async (path: string): Promise<string | null> => {
+    try {
+      return await sourceSnapshot.readTextFile(path);
+    } catch (error) {
+      if (error instanceof ProjectBoundaryViolationError) throw error;
+      return null; // expected: no package.json here
+    }
+  };
+}
+
 function createImportMapPlugin(
   projectDir: string,
   sourceSnapshot: ProjectSourceSnapshot,
@@ -1308,6 +1385,7 @@ function createImportMapPlugin(
   denoImports: DenoImportMap,
   workerImportMap: DenoImportMap | null,
   config?: VeryfrontConfig,
+  isDependencyFile: DependencyFilePredicate = noDependencyFiles,
 ): Plugin {
   // A project's own veryfront config wins over its Deno config for the same
   // specifier, matching how the rest of the build reads resolve options.
@@ -1325,8 +1403,11 @@ function createImportMapPlugin(
   return {
     name: "import-map",
     setup(build) {
-      build.onResolve({ filter: /.*/ }, (args) => {
+      build.onResolve({ filter: /.*/ }, async (args) => {
         if (args.path.startsWith("node:")) return { path: args.path, external: true };
+        // A dependency resolves its own imports as Node does: the project's
+        // import map does not apply inside node_modules.
+        if (isDependencyFile(args.importer)) return undefined;
 
         if (
           !REMOTE_URL_SPECIFIER.test(args.path) &&
@@ -1409,6 +1490,12 @@ function createImportMapPlugin(
           `Import map resolved: ${args.path} -> ${projectModuleLabel(absolutePath, projectDir)}`,
         );
 
+        const dependency = await dependencyTarget(
+          absolutePath,
+          moduleSuffixOfSpecifier(resolvedPath),
+          isDependencyFile,
+        );
+        if (dependency) return dependency;
         return {
           path: absolutePath,
           namespace: "import-map",
@@ -1728,13 +1815,16 @@ function createProjectAliasPlugin(
   routeModulePath: string,
   allowedHosts: string[],
   workerImportMap: DenoImportMap | null,
+  isDependencyFile: DependencyFilePredicate = noDependencyFiles,
 ): Plugin {
   const projectRoot = pathHelper.resolve(projectDir);
 
   return {
     name: "vf-project-alias",
     setup(build) {
-      build.onResolve({ filter: /^@\// }, (args) => {
+      build.onResolve({ filter: /^@\// }, async (args) => {
+        // `@/` names a project file only in project code, never in a dependency.
+        if (isDependencyFile(args.importer)) return undefined;
         const aliasedPath = args.path.slice(2);
         const absolutePath = pathHelper.resolve(projectRoot, modulePathOfSpecifier(aliasedPath));
         if (!isWithinDirectory(projectRoot, absolutePath)) {
@@ -1746,6 +1836,12 @@ function createProjectAliasPlugin(
           return { errors: [{ text: `Project alias escapes project: ${args.path}` }] };
         }
 
+        const dependency = await dependencyTarget(
+          absolutePath,
+          moduleSuffixOfSpecifier(aliasedPath),
+          isDependencyFile,
+        );
+        if (dependency) return dependency;
         return {
           path: absolutePath,
           namespace: "vf-project-alias",
@@ -1775,12 +1871,16 @@ function createAdapterResolvePlugin(
   routeModulePath: string,
   allowedHosts: string[],
   workerImportMap: DenoImportMap | null,
+  isDependencyFile: DependencyFilePredicate = noDependencyFiles,
 ): Plugin {
   return {
     name: "vf-adapter-resolve",
     setup(build) {
-      build.onResolve({ filter: /^\.\.?\// }, (args) => {
+      build.onResolve({ filter: /^\.\.?\// }, async (args) => {
         if (args.namespace === "http-url" || args.namespace === "import-map") return undefined;
+        // Node resolves a dependency's relative imports, including directory
+        // indexes and .json files; the project boundary still loads them.
+        if (isDependencyFile(args.importer)) return undefined;
 
         const baseDir = args.importer ? pathHelper.dirname(args.importer) : args.resolveDir;
         if (!baseDir) return undefined;
@@ -1804,6 +1904,12 @@ function createAdapterResolvePlugin(
             args.importer ? projectModuleLabel(args.importer, projectDir) : "stdin"
           }) -> ${projectModuleLabel(absolutePath, projectDir)}`,
         );
+        const dependency = await dependencyTarget(
+          absolutePath,
+          moduleSuffixOfSpecifier(args.path),
+          isDependencyFile,
+        );
+        if (dependency) return dependency;
         return {
           path: absolutePath,
           namespace: "vf-adapter",
@@ -1864,7 +1970,13 @@ function createProjectBoundaryPlugin(
   routeModulePath: string,
   allowedHosts: string[],
   workerImportMap: DenoImportMap | null,
+  isDependencyFile: DependencyFilePredicate = noDependencyFiles,
+  canonicalProjectDir: string = projectDir,
 ): Plugin {
+  const packageTypes = new PackageTypeLookup(snapshotManifestReader(sourceSnapshot), [
+    projectDir,
+    canonicalProjectDir,
+  ]);
   return {
     name: "vf-project-boundary",
     setup(build) {
@@ -1872,10 +1984,17 @@ function createProjectBoundaryPlugin(
         try {
           const source = await sourceSnapshot.read(args.path);
           const executableModule = !isJSONModulePath(source.logicalPath);
+          const commonJS = mayBeCommonJSDependency(source.logicalPath);
+          // An installed dependency the compiled binary bundles gets the trust
+          // it has everywhere else, where it loads at runtime unscanned: its
+          // code is not held to the route-code rules, which reject ordinary
+          // package code such as computed property reads. It still loads only
+          // from inside the project.
+          const dependency = isDependencyFile(args.path);
           // JSON is parsed as data, never executed; see the note above.
-          if (executableModule) {
+          if (executableModule && !dependency) {
             const scan = await validateHTTPImports(source.contents, allowedHosts, {
-              commonJS: mayBeCommonJSDependency(source.logicalPath),
+              commonJS,
               path: projectModuleLabel(source.logicalPath, projectDir),
             });
             await validateBundledLocalWorkerEntries({
@@ -1888,6 +2007,31 @@ function createProjectBoundaryPlugin(
               importMap: workerImportMap,
             });
           }
+          // A dependency's JSON is a CommonJS module, which the runtime module
+          // cache shares with a computed require() and a `{ type: "json" }`
+          // import of the same file.
+          if (!executableModule && dependency) {
+            return {
+              ...dependencyJsonLoad(source.contents, args.with, args.suffix),
+              resolveDir: pathHelper.dirname(source.logicalPath),
+            };
+          }
+          if (executableModule && dependency) {
+            return {
+              contents: await prepareDependencyFile({
+                build,
+                contents: source.contents,
+                logicalPath: source.logicalPath,
+                resolvedPath: args.path,
+                packageType: await packageTypes.of(pathHelper.dirname(source.logicalPath)),
+                isDependencyFile,
+                isFile: hostIsFile,
+                suffix: args.suffix,
+              }),
+              loader: getLoaderForFile(source.logicalPath),
+              resolveDir: pathHelper.dirname(source.logicalPath),
+            };
+          }
           return {
             contents: executableModule
               ? await rewriteBundledImportMetaUrl(
@@ -2069,22 +2213,25 @@ function buildTranspiledModuleSource(
       // rewritten to a resolvable specifier. Excluding it left a bare `import "zod"`
       // in the temp handler that Deno cannot resolve → "not a dependency and not in
       // import map" → 500. (The Node path already always-resolves zod via
-      // getNodeExternalPackagesToResolve.) On the compiled binary, keeping zod in
-      // userDeps routes it through rewriteCompiledBinaryUserDependencyImports like
-      // any other npm package, so its import resolves from the project's
-      // node_modules via the createRequire shim. zod is still force-externalized
-      // below, never bundled inline. See veryfront-issue-inbox#217.
+      // getNodeExternalPackagesToResolve.) On the compiled binary, zod is handled
+      // like any other npm package: imported from node_modules when it is ESM,
+      // bundled when it is CommonJS. Elsewhere it is force-externalized below,
+      // never bundled inline. See veryfront-issue-inbox#217.
       const userDeps = getUserDependencies(allDeps);
+      const compiled = isDeno && isCompiledBinary();
 
-      // Always externalize user npm dependencies. The bundled handler is loaded
-      // from a temp file and user deps are resolved at runtime:
+      // User npm dependencies the bundled handler resolves at runtime:
       //   - Node.js: via file:// URLs pointing to node_modules
-      //   - Deno (compiled or not): via createRequire or npm: specifiers
-      // Bundling CJS deps inline (especially complex ones like pdf-parse/pdf.js)
-      // breaks their internal global state management during esbuild's CJS→ESM
-      // conversion.
+      //   - Deno source run: via npm: specifiers
+      //   - Compiled binary: ESM dependencies via file:// URLs. A compiled
+      //     binary cannot load a CommonJS file from disk at runtime, so its
+      //     CommonJS dependencies are bundled into the handler instead, with
+      //     esbuild's Node resolution and interop (see compiled-cjs-bundling.ts).
+      const runtimeDeps = compiled
+        ? await externalEsmUserDependencies(projectDir, sourceSnapshot, userDeps)
+        : userDeps;
       const userExternals: string[] = [];
-      for (const name of userDeps.keys()) {
+      for (const name of runtimeDeps.keys()) {
         userExternals.push(name, `${name}/*`);
       }
 
@@ -2094,13 +2241,22 @@ function buildTranspiledModuleSource(
       // When esbuild bundles CJS into ESM output, these become __require() shims that
       // fail at runtime. Inject a createRequire-based shim so require() works in ESM.
       // Use projectDir as the resolve base so require() finds the project's node_modules.
+      // The compiled binary binds `require` after the build instead.
       const safeProjectDir = JSON.stringify(projectDir + "/package.json");
-      const requireShim = isDeno && isCompiledBinary()
-        ? generateCompiledBinaryRequireShim(projectDir)
-        : [
-          'import { createRequire as __vf_createRequire } from "node:module";',
-          `var require = __vf_createRequire(${safeProjectDir});`,
-        ].join("\n");
+      const requireShim = compiled ? "" : [
+        'import { createRequire as __vf_createRequire } from "node:module";',
+        `var require = __vf_createRequire(${safeProjectDir});`,
+      ].join("\n");
+      const canonicalRoot = compiled ? await canonicalProjectRoot(projectDir) : projectDir;
+      const dependencyDirs = compiled
+        ? await dependencyDirectories(projectDir, {
+          realPath,
+          readDir: (path) => createFileSystem().readDir(path),
+        })
+        : [];
+      const isDependencyFile = compiled
+        ? dependencyFilePredicate(dependencyDirs)
+        : noDependencyFiles;
       const routeSourceUrl = pathHelper.toFileUrl(resolvedPath).href;
       const workerShim = [
         `const __vf_routeSourceUrl = ${JSON.stringify(routeSourceUrl)};`,
@@ -2113,7 +2269,7 @@ function buildTranspiledModuleSource(
       const routeRuntimeShim = [
         requireShim,
         workerShim,
-        "export { require, Worker };",
+        compiled ? "export { Worker };" : "export { require, Worker };",
       ].join("\n");
 
       const buildOptions = typescriptDecoratorOptions
@@ -2129,18 +2285,23 @@ function buildTranspiledModuleSource(
         jsx: "automatic",
         jsxImportSource: "react",
         resolveExtensions: [".ts", ".tsx", ".js", ".jsx", ".mjs"],
+        // Bundled CommonJS packages resolve as Node resolves them for require().
+        ...(compiled ? COMPILED_RESOLVE_OPTIONS : {}),
         // Injection binds only free identifiers and lets esbuild rename either
         // side of a collision. A raw banner would redeclare a route import such
         // as `import { Worker } from "worker-package"` and emit invalid ESM.
         inject: [ROUTE_RUNTIME_SHIM_SPECIFIER],
         external: [
-          "zod",
+          // The compiled binary bundles a CommonJS zod like any other package.
+          ...(compiled ? [] : ["zod"]),
           "node:*",
           ...NODE_BUILTINS,
           "veryfront",
           "veryfront/*",
           "@opentelemetry/*",
-          ...userExternals,
+          // The compiled binary keeps them external through a plugin, which
+          // can tell an import from a require().
+          ...(compiled ? [] : userExternals),
         ],
         stdin: {
           contents: await rewriteBundledImportMetaUrl(source, routeSourceUrl, denoImports),
@@ -2149,6 +2310,13 @@ function buildTranspiledModuleSource(
           sourcefile: resolvedPath,
         },
         plugins: [
+          ...(compiled
+            ? [
+              createNativeAddonPlugin(),
+              createCompiledBuiltinPlugin(isDependencyFile),
+              createDependencyResolvePlugin(isDependencyFile, hostIsFile),
+            ]
+            : []),
           createRouteRuntimeShimPlugin(routeRuntimeShim),
           createImportMapPlugin(
             projectDir,
@@ -2158,6 +2326,7 @@ function buildTranspiledModuleSource(
             denoImports,
             workerImportMap,
             config,
+            isDependencyFile,
           ),
           createProjectAliasPlugin(
             sourceSnapshot,
@@ -2165,6 +2334,7 @@ function buildTranspiledModuleSource(
             resolvedPath,
             allowedHosts,
             workerImportMap,
+            isDependencyFile,
           ),
           createAdapterResolvePlugin(
             sourceSnapshot,
@@ -2172,7 +2342,22 @@ function buildTranspiledModuleSource(
             resolvedPath,
             allowedHosts,
             workerImportMap,
+            isDependencyFile,
           ),
+          ...(compiled
+            ? [
+              // After the import map, so that a project can map a built-in name.
+              createCompiledBuiltinPlugin(() => true),
+              createImportExternalsPlugin(runtimeDeps.keys(), {
+                isDependencyFile,
+                nodeModules: [
+                  pathHelper.join(projectDir, "node_modules"),
+                  pathHelper.join(canonicalRoot, "node_modules"),
+                ],
+                realPath: hostRealPath,
+              }),
+            ]
+            : []),
           createHTTPPlugin({
             allowedHosts,
             projectDir,
@@ -2185,6 +2370,8 @@ function buildTranspiledModuleSource(
             resolvedPath,
             allowedHosts,
             workerImportMap,
+            isDependencyFile,
+            canonicalRoot,
           ),
         ],
         // Only the opt-in decorator transform needs a working directory: adding
@@ -2202,10 +2389,18 @@ function buildTranspiledModuleSource(
       if (result.errors?.length) throw buildFailure(result.errors, projectDir, workingDir);
 
       logger.debug(`built handler ${projectModuleLabel(resolvedPath, projectDir)}`);
-      const js = result.outputFiles?.[0]?.text ?? "export {}";
+      const output = result.outputFiles?.[0]?.text ?? "export {}";
+      const js = compiled
+        ? await prependRuntimeRequire(output, canonicalRoot, dependencyDirs, workingDir)
+        : output;
       logger.debug(`transpiled size ${js.length} bytes`);
 
-      return await rewriteExternalImports(js, projectDir, sourceSnapshot, userDeps);
+      // Only dependencies left external are rewritten. The compiled bundle
+      // holds package code whose strings may read like imports, so there only
+      // parsed import specifiers are.
+      const rewrite = (code: string) =>
+        rewriteExternalImports(code, projectDir, sourceSnapshot, runtimeDeps);
+      return compiled ? await rewriteImportSpecifiers(js, rewrite) : await rewrite(js);
     },
     { "api.modulePath": modulePath, "api.projectDir": projectDir },
   );
@@ -2251,6 +2446,23 @@ async function readFileWithExtensions(
   );
 }
 
+/**
+ * The user dependencies a compiled-binary route imports at runtime: the ESM
+ * ones. The build bundles the rest, which are CommonJS.
+ */
+async function externalEsmUserDependencies(
+  projectDir: string,
+  sourceSnapshot: ProjectSourceSnapshot,
+  userDeps: Map<string, string>,
+): Promise<Map<string, string>> {
+  const esmDeps = await resolveEsmUserDependencyLocations(projectDir, sourceSnapshot, userDeps);
+  const external = new Map<string, string>();
+  for (const [name, version] of userDeps) {
+    if (esmDeps.has(name)) external.set(name, version);
+  }
+  return external;
+}
+
 export function getUserDependencies(
   allDeps: ReadonlyMap<string, string>,
 ): Map<string, string> {
@@ -2401,8 +2613,8 @@ async function importModuleFromCode(
       }
     }
 
-    // Note: user npm dependencies are externalized and loaded at runtime via
-    // a custom CJS loader (see generateCompiledBinaryRequireShim), no shims needed.
+    // Note: ESM user dependencies load from file:// URLs and CommonJS ones are
+    // bundled into the handler (see compiled-cjs-bundling.ts), no shims needed.
   }
 
   await fs.writeTextFile(tempFile, transformedCode);
diff --git a/src/transforms/import-rewriter/core.test.ts b/src/transforms/import-rewriter/core.test.ts
index 208142d36d..c841d4368b 100644
--- a/src/transforms/import-rewriter/core.test.ts
+++ b/src/transforms/import-rewriter/core.test.ts
@@ -143,12 +143,13 @@ describe("import rewrite compatibility golden tests", () => {
       rewriteCompiledBinaryVeryfrontImports(`import { x } from "veryfront/agent";`),
       `import { x } from "./_vf_agent.mjs";`,
     );
-    assertStringIncludes(
+    // CommonJS dependencies are bundled, so their imports are left alone.
+    assertEquals(
       rewriteCompiledBinaryUserDependencyImports(
         `const m = import("lodash/merge");`,
         new Map([["lodash", "^4"]]),
       ),
-      `Promise.resolve(require("lodash/merge"))`,
+      `const m = import("lodash/merge");`,
     );
     assertEquals(
       rewriteDenoNodeBuiltinImports(`import { readFile } from "fs";`),
diff --git a/src/transforms/import-rewriter/route-adapter.ts b/src/transforms/import-rewriter/route-adapter.ts
index 178bde8147..4a7bd14595 100644
--- a/src/transforms/import-rewriter/route-adapter.ts
+++ b/src/transforms/import-rewriter/route-adapter.ts
@@ -4,10 +4,7 @@ import { serverLogger } from "#veryfront/utils";
 import { parseImports, replaceSpecifiers } from "#veryfront/transforms/esm/lexer.ts";
 import { resolveContainedPackagePath } from "./package-resolution.ts";
 import { isWithinDirectory } from "#veryfront/security/path-validation.ts";
-import {
-  resolveExportEntry as resolveRouteExportEntry,
-  toCjsDestructureBindings,
-} from "#veryfront/routing/api/module-loader/loader-helpers.ts";
+import { resolveExportEntry as resolveRouteExportEntry } from "#veryfront/routing/api/module-loader/loader-helpers.ts";
 import { rethrowProjectBoundaryViolation } from "#veryfront/routing/api/module-loader/project-source-snapshot.ts";
 
 const logger = serverLogger.component("api");
@@ -126,8 +123,7 @@ function resolveEsmEntry(pkgJson: Record<string, unknown>): string | undefined {
 /**
  * Identify the subset of user dependencies that are ESM-only and resolve each
  * to file:// URLs so the compiled-binary loader can import them as real ES
- * modules instead of transpiling them to CommonJS. CJS dependencies are omitted
- * and continue to load through the `createRequire`-based shim.
+ * modules. CommonJS dependencies are omitted: the route build bundles them.
  */
 export async function resolveEsmUserDependenciesForRoute(
   projectDir: string,
@@ -150,8 +146,7 @@ export async function resolveEsmUserDependenciesForRoute(
       // attacker-influenceable (a malicious/compromised package could set
       // "main": "../../../etc/passwd"). Reject entries that resolve outside the
       // package directory so a crafted package.json cannot turn into a file://
-      // import that escapes node_modules. This mirrors the containment guard the
-      // CJS loader shim enforces via __vf_assertContained.
+      // import that escapes node_modules.
       const entryPath = pathHelper.resolve(pathHelper.join(packageDir, entry));
       if (!isWithinDirectory(packageDir, entryPath)) {
         logger.warn(`Skipping ESM dependency ${name}: entry escapes package directory (${entry})`);
@@ -204,9 +199,9 @@ export function rewriteCompiledUserDependencyImportsForRoute(
   for (const name of userDeps.keys()) {
     const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
-    // ESM-only dependencies are rewritten to real ES module file:// URLs so that
-    // import.meta, top-level await, etc. work. They must NOT be transpiled to
-    // CommonJS and evaluated via the `new Function` shim (see __vf_loadCjs).
+    // ESM dependencies are rewritten to real ES module file:// URLs so that
+    // import.meta, top-level await, etc. work. The route build bundles
+    // CommonJS dependencies, so no import of one is left to rewrite.
     const esm = esmDeps.get(name);
     if (esm) {
       // Resolve a subpath import to a contained file:// URL. The subpath comes
@@ -244,53 +239,7 @@ export function rewriteCompiledUserDependencyImportsForRoute(
         new RegExp(`import\\s*\\(\\s*["']${escaped}["']\\s*\\)`, "g"),
         () => `import("${esm.entryUrl}")`,
       );
-      continue;
     }
-
-    transformed = transformed.replace(
-      new RegExp(`import\\s+(\\w+)\\s+from\\s+["']${escaped}["']`, "g"),
-      (_, localName) => `const ${localName} = __vf_interopDefault(require("${name}"))`,
-    );
-    transformed = transformed.replace(
-      new RegExp(`import\\s+(\\{[^}]+\\})\\s+from\\s+["']${escaped}["']`, "g"),
-      (_, bindings) => `const ${toCjsDestructureBindings(bindings)} = require("${name}")`,
-    );
-    transformed = transformed.replace(
-      new RegExp(`import\\s+\\*\\s+as\\s+(\\w+)\\s+from\\s+["']${escaped}["']`, "g"),
-      (_, localName) => `const ${localName} = require("${name}")`,
-    );
-    transformed = transformed.replace(
-      new RegExp(
-        `import\\s+(\\w+)\\s*,\\s*(\\{[^}]+\\})\\s+from\\s+["']${escaped}["']`,
-        "g",
-      ),
-      (_, defaultName, bindings) => {
-        const tmp = `__vf_tmp_${defaultName}`;
-        return `const ${tmp} = require("${name}"); const ${defaultName} = __vf_interopDefault(${tmp}); const ${
-          toCjsDestructureBindings(bindings)
-        } = ${tmp}`;
-      },
-    );
-    transformed = transformed.replace(
-      new RegExp(
-        `import\\s+(\\w+|\\*\\s+as\\s+\\w+|\\{[^}]+\\})\\s+from\\s+["']${escaped}(/[^"']+)["']`,
-        "g",
-      ),
-      (_, binding, subpath) => {
-        const trimmedBinding = String(binding).trim();
-        if (trimmedBinding.startsWith("{")) {
-          return `const ${toCjsDestructureBindings(trimmedBinding)} = require("${name}${subpath}")`;
-        }
-        const name_ = trimmedBinding.startsWith("*")
-          ? trimmedBinding.replace(/\*\s+as\s+/, "")
-          : trimmedBinding;
-        return `const ${name_} = require("${name}${subpath}")`;
-      },
-    );
-    transformed = transformed.replace(
-      new RegExp(`import\\s*\\(\\s*["']${escaped}(/[^"']*)?["']\\s*\\)`, "g"),
-      (_, subpath) => `Promise.resolve(require("${name}${subpath || ""}"))`,
-    );
   }
 
   return transformed;
diff --git a/tests/integration/compiled-binary-e2e.suite.ts b/tests/integration/compiled-binary-e2e.suite.ts
index 20444175dd..db3cfda872 100644
--- a/tests/integration/compiled-binary-e2e.suite.ts
+++ b/tests/integration/compiled-binary-e2e.suite.ts
@@ -780,6 +780,93 @@ export function GET() {
     });
   });
 
+  // veryfront-issue-inbox#4177: a compiled binary cannot load a CommonJS file
+  // from disk at runtime, so the route build bundles CommonJS dependencies.
+  it("should bundle CommonJS dependencies of compiled-binary API routes", async () => {
+    const projectDir = await createTestProject(
+      "api-cjs-deps-test",
+      `
+export default function Home() {
+  return <div>Home Page</div>;
+}
+`,
+      {
+        "package.json": JSON.stringify({
+          name: "test-api-cjs-deps",
+          type: "module",
+          dependencies: {
+            react: "^19.0.0",
+            "react-dom": "^19.0.0",
+            legacy: "1.0.0",
+            "esm-only": "1.0.0",
+          },
+        }),
+        "node_modules/legacy/package.json": JSON.stringify({
+          name: "legacy",
+          version: "1.0.0",
+          exports: { ".": { require: "./lib/index.js", default: "./lib/index.js" } },
+        }),
+        // Ordinary package code the route-code checks reject: computed reads,
+        // directory and extensionless requires.
+        "node_modules/legacy/lib/index.js": `"use strict";
+var fs = require("fs");
+var path = require("path");
+var data = require("./data");
+var util = require("./util");
+var optional;
+try { optional = require("not-installed-optional"); } catch (error) { optional = error.code; }
+exports.name = data.name;
+exports.ownFile = path.basename(__filename);
+exports.readsSibling = fs.readFileSync(path.join(__dirname, "data.json"), "utf8").length > 0;
+exports.optional = optional;
+exports.picked = util.pick(data, "name");
+`,
+        "node_modules/legacy/lib/data.json": JSON.stringify({ name: "legacy-data" }),
+        "node_modules/legacy/lib/util/index.js": `exports.pick = function (object, key) {
+  return object[key];
+};
+`,
+        "node_modules/esm-only/package.json": JSON.stringify({
+          name: "esm-only",
+          version: "1.0.0",
+          type: "module",
+          exports: "./index.js",
+        }),
+        "node_modules/esm-only/index.js": `export const kind = "esm";\n`,
+        "pages/api/cjs.ts": `
+import legacy, { name } from "legacy";
+import { kind } from "esm-only";
+
+export function GET() {
+  return Response.json({ legacy, name, kind });
+}
+`,
+      },
+    );
+
+    await withServer(projectDir, async (server) => {
+      const response = await fetch(`http://127.0.0.1:${server.port}/api/cjs`);
+      const body = await response.text();
+
+      assertEquals(
+        response.status,
+        200,
+        `Should return 200\nResponse body: ${body}\n${server.logs.join("").slice(-16000)}`,
+      );
+      assertEquals(JSON.parse(body), {
+        legacy: {
+          name: "legacy-data",
+          ownFile: "index.js",
+          readsSibling: true,
+          optional: "MODULE_NOT_FOUND",
+          picked: "legacy-data",
+        },
+        name: "legacy-data",
+        kind: "esm",
+      });
+    });
+  });
+
   it("fails closed when API isolation conflicts with a broad host execution grant", async () => {
     const projectDir = await createTestProject(
       "isolation-fail-closed-test",
diff --git a/tests/integration/semantic-unit-boundary/src/routing/api/module-loader/compiled-cjs-bundling.test.ts b/tests/integration/semantic-unit-boundary/src/routing/api/module-loader/compiled-cjs-bundling.test.ts
new file mode 100644
index 0000000000..906bad421f
--- /dev/null
+++ b/tests/integration/semantic-unit-boundary/src/routing/api/module-loader/compiled-cjs-bundling.test.ts
@@ -0,0 +1,1264 @@
+import "#veryfront/schemas/_test-setup.ts";
+import { assert, assertEquals, assertRejects } from "#veryfront/testing/assert.ts";
+import { describe, it } from "#veryfront/testing/bdd.ts";
+import { mkdir, readdir, readFile, realpath, stat, symlink, writeFile } from "node:fs/promises";
+import { relative } from "node:path";
+import process from "node:process";
+import { pathToFileURL } from "node:url";
+import { withTempDir } from "#veryfront/testing/deno-compat.ts";
+import * as esbuild from "veryfront/extensions/bundler";
+import type { Plugin } from "veryfront/extensions/bundler";
+import {
+  COMPILED_RESOLVE_OPTIONS,
+  createCompiledBuiltinPlugin,
+  createDependencyFilePredicate,
+  createDependencyResolvePlugin,
+  createImportExternalsPlugin,
+  createNativeAddonPlugin,
+  dependencyDirectories,
+  dependencyJsonLoad,
+  PackageTypeLookup,
+  prepareDependencyFile,
+  prependRuntimeRequire,
+} from "#veryfront/routing/api/module-loader/compiled-cjs-bundling.ts";
+import { dependencyTarget } from "#veryfront/routing/api/module-loader/loader.ts";
+
+async function writeFiles(root: string, files: Record<string, string>): Promise<void> {
+  for (const [relative, contents] of Object.entries(files)) {
+    const path = `${root}/${relative}`;
+    await mkdir(path.slice(0, path.lastIndexOf("/")), { recursive: true });
+    await writeFile(path, contents);
+  }
+}
+
+const isFile = async (path: string) => {
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false; // expected: no such file
+  }
+};
+
+const hostFs = {
+  realPath: (path: string) => realpath(path),
+  async *readDir(path: string) {
+    for (const entry of await readdir(path, { withFileTypes: true })) {
+      yield {
+        name: entry.name,
+        isDirectory: entry.isDirectory(),
+        isSymlink: entry.isSymbolicLink(),
+      };
+    }
+  },
+};
+
+/** Prepares dependency files the way the compiled route build does. */
+function dependencyFilePlugin(
+  projectDir: string,
+  isDependencyFile: (path: string) => boolean,
+): Plugin {
+  const packageTypes = new PackageTypeLookup(async (path) => {
+    try {
+      return await readFile(path, "utf8");
+    } catch {
+      return null; // expected: no package.json here
+    }
+  }, projectDir);
+  return {
+    name: "test-dependency-files",
+    setup(build) {
+      // Every dependency file, as the route build's boundary loads them.
+      build.onLoad({ filter: /.*/ }, async (args) => {
+        if (!isDependencyFile(args.path)) return undefined;
+        const contents = await readFile(args.path, "utf8");
+        if (args.path.endsWith(".json")) {
+          return dependencyJsonLoad(contents, args.with, args.suffix);
+        }
+        return {
+          contents: await prepareDependencyFile({
+            build,
+            contents,
+            logicalPath: args.path,
+            resolvedPath: args.path,
+            packageType: await packageTypes.of(args.path.slice(0, args.path.lastIndexOf("/"))),
+            isDependencyFile,
+            isFile,
+            suffix: args.suffix,
+          }),
+          loader: "js",
+        };
+      });
+    },
+  };
+}
+
+/** Bundles a route the way the compiled binary does and imports the result. */
+async function bundleAndImport(
+  projectDir: string,
+  route: string,
+  importExternals: string[] = [],
+): Promise<Record<string, unknown>> {
+  const isDependencyFile = await createDependencyFilePredicate(projectDir, hostFs);
+  try {
+    const result = await esbuild.build({
+      bundle: true,
+      write: false,
+      format: "esm",
+      platform: "neutral",
+      target: "es2022",
+      ...COMPILED_RESOLVE_OPTIONS,
+      logLevel: "silent",
+      stdin: {
+        contents: route,
+        loader: "ts",
+        resolveDir: projectDir,
+        sourcefile: `${projectDir}/route.ts`,
+      },
+      plugins: [
+        createNativeAddonPlugin(),
+        createCompiledBuiltinPlugin(isDependencyFile),
+        createDependencyResolvePlugin(isDependencyFile, isFile),
+        createCompiledBuiltinPlugin(() => true),
+        createImportExternalsPlugin(importExternals, {
+          isDependencyFile,
+          nodeModules: [`${projectDir}/node_modules`],
+          realPath: async (path) => {
+            try {
+              return await realpath(path);
+            } catch {
+              return null; // expected: no such package
+            }
+          },
+        }),
+        dependencyFilePlugin(projectDir, isDependencyFile),
+      ],
+    });
+    const code = await prependRuntimeRequire(
+      result.outputFiles?.[0]?.text ?? "",
+      projectDir,
+      await dependencyDirectories(projectDir, hostFs),
+      // The bundler names files relative to its working directory.
+      process.cwd(),
+    );
+    const file = `${projectDir}/handler.mjs`;
+    await writeFile(file, code);
+    return await import(pathToFileURL(file).href);
+  } finally {
+    await esbuild.stop();
+  }
+}
+
+/** Runs a test in a fresh project directory, with symlinks in its path followed. */
+function inProject(fn: (projectDir: string) => Promise<void>): Promise<void> {
+  return withTempDir(async (dir) => fn(await realpath(dir)), { prefix: "vf-cjs-bundle-" });
+}
+
+// The compiled binary bundles a route's CommonJS dependencies (inbox#4177).
+describe("compiled-binary route bundling of CommonJS dependencies", () => {
+  it("runs exports maps, built-in and JSON requires, __dirname and optional requires", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/legacy/package.json": JSON.stringify({
+          name: "legacy",
+          // The node condition must win over default, as it does in Node.
+          exports: { ".": { node: "./lib/index.js", default: "./lib/missing.js" } },
+        }),
+        "node_modules/legacy/lib/index.js": [
+          '"use strict";',
+          'var fs = require("fs");',
+          'var path = require("node:path");',
+          'var data = require("./data");',
+          "var optional;",
+          'try { optional = require("not-installed"); } catch (error) { optional = error.code; }',
+          "exports.name = data.name;",
+          "exports.ownFile = path.basename(__filename);",
+          'exports.readsSibling = fs.existsSync(path.join(__dirname, "data.json"));',
+          "exports.optional = optional;",
+        ].join("\n"),
+        "node_modules/legacy/lib/data.json": JSON.stringify({ name: "legacy-data" }),
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'const require = (id: string) => "route:" + id;\n' +
+          'export const routeRequire = require("x");\n' +
+          'import legacy from "legacy";\nexport { legacy };\n',
+      );
+      assertEquals(mod.legacy, {
+        name: "legacy-data",
+        ownFile: "index.js",
+        readsSibling: true,
+        optional: "MODULE_NOT_FOUND",
+      });
+      // esbuild renames a route's own `require`, so the prologue cannot clash.
+      assertEquals(mod.routeRequire, "route:x");
+    });
+  });
+
+  it("serves require.resolve and computed requires left for runtime", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/assets/package.json": JSON.stringify({ name: "assets", main: "index.js" }),
+        "node_modules/assets/data/en.json": JSON.stringify({ hello: "world" }),
+        "node_modules/assets/index.js": [
+          'var path = require("path");',
+          'exports.asset = require.resolve("./data/en.json");',
+          'exports.own = require.resolve("assets/package.json");',
+          'exports.builtin = require.resolve("fs");',
+          "var missing;",
+          'try { require.resolve("optional-native"); } catch (error) { missing = error.code; }',
+          "exports.missing = missing;",
+          'var computed = path.join(__dirname, "data", "en.json");',
+          "exports.computedPath = require.resolve(computed);",
+          "exports.computed = require(computed).hello;",
+          "exports.cached = require(computed) === require(computed);",
+          "var outside;",
+          'var hosts = ["", "etc", "hosts"].join("/");',
+          "try { require(hosts); } catch (error) { outside = [error.code, error.message]; }",
+          "exports.outside = outside;",
+          "var prefixOnly;",
+          'try { require.resolve("test"); } catch (error) { prefixOnly = error.code; }',
+          "exports.prefixOnly = prefixOnly;",
+          // A computed built-in id is never seen by the bundler.
+          'var fsId = ["f", "s"].join("");',
+          "exports.computedBuiltin = typeof require(fsId).readFileSync;",
+          'exports.computedPrefixed = typeof require("node:" + "events");',
+          "exports.computedResolve = require.resolve(fsId);",
+          "var bareTest;",
+          'try { require(["te", "st"].join("")); } catch (error) { bareTest = error.code; }',
+          "exports.bareTest = bareTest;",
+        ].join("\n"),
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import assets from "assets";\nexport { assets };\n',
+      );
+      const asset = `${projectDir}/node_modules/assets/data/en.json`;
+      assertEquals(mod.assets, {
+        asset,
+        own: `${projectDir}/node_modules/assets/package.json`,
+        builtin: "fs",
+        missing: "MODULE_NOT_FOUND",
+        computedPath: asset,
+        computed: "world",
+        cached: true,
+        outside: [
+          "MODULE_NOT_FOUND",
+          'Cannot find module "a path outside this project or missing"',
+        ],
+        prefixOnly: "MODULE_NOT_FOUND",
+        computedBuiltin: "function",
+        computedPrefixed: "function",
+        computedResolve: "fs",
+        bareTest: "MODULE_NOT_FOUND",
+      });
+    });
+  });
+
+  it("gives ESM dependency files no CommonJS bindings", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/scoped/package.json": JSON.stringify({
+          name: "scoped",
+          type: "module",
+          main: "index.js",
+        }),
+        "node_modules/scoped/index.js": "export const mode = typeof __dirname;\n",
+        "node_modules/plain/package.json": JSON.stringify({ name: "plain", module: "index.js" }),
+        "node_modules/plain/index.js": "export const mode = typeof __filename;\n",
+      });
+      await bundleAndImport(
+        projectDir,
+        'import { mode as a } from "scoped";\nimport { mode as b } from "plain";\nexport const modes = [a, b];\n',
+      );
+      // Checked in the bundle, not at runtime: Bun defines both names in ESM too.
+      const code = await readFile(`${projectDir}/handler.mjs`, "utf8");
+      assert(code.includes("typeof __dirname") && code.includes("typeof __filename"), code);
+    });
+  });
+
+  it("parses a CommonJS file instead of matching its text", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/parsed/package.json": JSON.stringify({ name: "parsed", main: "index.js" }),
+        "node_modules/parsed/data.json": "{}",
+        "node_modules/parsed/index.js": [
+          "var text = 'require.resolve(\"./data.json\")';",
+          "/*",
+          "export default 1",
+          "*/",
+          "var __filename = 'own';",
+          "exports.text = text;",
+          "exports.dir = __dirname;",
+          "exports.file = __filename;",
+          "exports.firstArgument = arguments[0] === exports;",
+        ].join("\n"),
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import parsed from "parsed";\nexport { parsed };\n',
+      );
+      assertEquals(mod.parsed, {
+        text: 'require.resolve("./data.json")',
+        dir: `${projectDir}/node_modules/parsed`,
+        file: "own",
+        // No wrapper of ours: arguments are the bundler's CommonJS wrapper's.
+        firstArgument: true,
+      });
+    });
+  });
+
+  it("bundles a workspace package that node_modules links to", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "packages/linked/package.json": JSON.stringify({ name: "linked", main: "index.js" }),
+        "packages/linked/index.js":
+          'exports.dir = __dirname;\nexports.self = require.resolve("./index.js");',
+      });
+      await mkdir(`${projectDir}/node_modules`, { recursive: true });
+      await symlink("../packages/linked", `${projectDir}/node_modules/linked`);
+      const mod = await bundleAndImport(
+        projectDir,
+        'import linked from "linked";\nexport { linked };\n',
+      );
+      assertEquals(mod.linked, {
+        dir: `${projectDir}/packages/linked`,
+        self: `${projectDir}/packages/linked/index.js`,
+      });
+    });
+  });
+
+  it("resolves inside dependencies in Node's order", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/order/package.json": JSON.stringify({ name: "order", main: "index.js" }),
+        "node_modules/order/index.js":
+          'exports.impl = require("./impl");\nexports.data = require("./data");',
+        "node_modules/order/data.mjs": 'export default "mjs";',
+        "node_modules/order/data.json": '"json"',
+        // A workspace package resolves outside node_modules, where the
+        // bundler's own order would pick the TypeScript sibling.
+        "packages/wsorder/package.json": JSON.stringify({ name: "wsorder", main: "index.js" }),
+        "packages/wsorder/index.js": 'module.exports = require("./impl");',
+        "packages/wsorder/impl.js": 'module.exports = "js";',
+        "packages/wsorder/impl.ts": 'export default "ts";',
+        "node_modules/order/impl.js": 'module.exports = "js";',
+        "node_modules/order/impl.ts": 'export default "ts";',
+        "node_modules/modonly/package.json": JSON.stringify({ name: "modonly", module: "esm.js" }),
+        "node_modules/modonly/index.js": 'module.exports = "index";',
+        "node_modules/modonly/esm.js": 'export default "module";',
+        // An extensionless main and a default index pick .js over .ts too.
+        "node_modules/mainpkg/package.json": JSON.stringify({ name: "mainpkg", main: "impl" }),
+        "node_modules/mainpkg/impl.js": 'module.exports = "js";',
+        "node_modules/mainpkg/impl.ts": 'export default "ts";',
+        "node_modules/idxpkg/package.json": JSON.stringify({ name: "idxpkg" }),
+        "node_modules/idxpkg/index.js": 'module.exports = "js";',
+        "node_modules/idxpkg/index.ts": 'export default "ts";',
+      });
+      await symlink("../packages/wsorder", `${projectDir}/node_modules/wsorder`);
+      const mod = await bundleAndImport(
+        projectDir,
+        'import order from "order";\nimport modonly from "modonly";\nimport wsorder from "wsorder";\n' +
+          'import mainpkg from "mainpkg";\nimport idxpkg from "idxpkg";\n' +
+          "export const picked = [order.impl, order.data, modonly, wsorder, mainpkg, idxpkg];\n",
+      );
+      assertEquals(mod.picked, ["js", "json", "index", "js", "js", "js"]);
+    });
+  });
+
+  it("keeps a route's own require binding when nothing is bundled", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "helper.ts": 'export const require = (id: string) => "helper:" + id;\n',
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import { require } from "./helper.ts";\nexport const value = require("q");\n',
+      );
+      assertEquals(mod.value, "helper:q");
+    });
+  });
+
+  it("runs a dependency file a computed path requires", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/dialects/package.json": JSON.stringify({
+          name: "dialects",
+          main: "index.js",
+        }),
+        "node_modules/dialects/index.js": [
+          'var path = require("path");',
+          "exports.load = function (name) {",
+          '  return require(path.join(__dirname, "dialects", name + ".js"));',
+          "};",
+        ].join("\n"),
+        "node_modules/dialects/dialects/pg.js": [
+          'var base = require("../base");',
+          'exports.name = base.prefix + "pg";',
+          'exports.sep = require("path").sep;',
+          // Never seen by the bundler: only this computed load reaches it.
+          'exports.driver = require("driver");',
+        ].join("\n"),
+        "node_modules/driver/package.json": JSON.stringify({
+          name: "driver",
+          exports: { ".": { import: "./index.mjs", require: "./index.cjs" } },
+        }),
+        "node_modules/driver/index.cjs": 'module.exports = "driver";',
+        "node_modules/dialects/base.js": 'exports.prefix = "dialect:";',
+        "src/secret.js": 'module.exports = "project code";',
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import dialects from "dialects";\n' +
+          "export const pg = dialects.load('pg');\n" +
+          "export const again = dialects.load('pg') === pg;\n" +
+          "let project;\n" +
+          'try { dialects.load("../../../src/secret"); } catch (error) { project = (error as { code?: string }).code; }\n' +
+          "export { project };\n",
+      );
+      assertEquals(mod.pg, { name: "dialect:pg", sep: "/", driver: "driver" });
+      assertEquals(mod.again, true);
+      assertEquals(mod.project, "MODULE_NOT_FOUND");
+    });
+  });
+
+  it("bundles a direct-eval dependency beside one that imports an external package", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/usesub/package.json": JSON.stringify({ name: "usesub", main: "index.js" }),
+        "node_modules/usesub/index.js": 'exports.load = () => import("esmsub/feature");',
+        "node_modules/esmsub/package.json": JSON.stringify({
+          name: "esmsub",
+          type: "module",
+          exports: { ".": "./index.js", "./feature": "./dist/feature.js" },
+        }),
+        "node_modules/esmsub/index.js": 'export default "root";',
+        "node_modules/esmsub/dist/feature.js": 'export default "feature";',
+        "node_modules/evaler/package.json": JSON.stringify({ name: "evaler", main: "index.js" }),
+        "node_modules/evaler/index.js": [
+          '"use strict";',
+          'exports.plugin = eval("require")("./plugin").name;',
+        ].join("\n"),
+        "node_modules/evaler/plugin.js": 'exports.name = "plugin";',
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        [
+          'import u from "usesub";',
+          'import e from "evaler";',
+          "export const evaler = e.plugin;",
+          "export const feature = (await u.load()).default;",
+        ].join("\n"),
+        ["esmsub"],
+      );
+      assertEquals({ ...mod }, { evaler: "plugin", feature: "feature" });
+    });
+  });
+
+  it("shares one module cache with computed requires while modules load", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/cyc/package.json": JSON.stringify({ name: "cyc", main: "a.js" }),
+        "node_modules/cyc/counter.js": "module.exports = { a: 0, c: 0 };",
+        "node_modules/cyc/a.js": [
+          'require("./counter").a++;',
+          "exports.early = true;",
+          // b requires this file by a computed path while it is still loading.
+          'exports.sawPartial = require("./b").sawPartial;',
+          'exports.runs = require("./counter").a;',
+          "exports.reload = () => {",
+          '  delete require.cache[require.resolve("./c")];',
+          '  return require("./c");',
+          "};",
+          'exports.first = require("./c");',
+          'exports.early2 = require(["./early", "js"].join(".")) === require("./early");',
+        ].join("\n"),
+        "node_modules/cyc/b.js": [
+          'var path = require("path");',
+          'var a = require(path.join(__dirname, "a" + ".js"));',
+          "exports.sawPartial = a.early === true && a.runs === undefined;",
+        ].join("\n"),
+        "node_modules/cyc/c.js": 'module.exports = { n: ++require("./counter").c };',
+        // A top-level return leaves early; the module is still cached.
+        "node_modules/cyc/early.js": "exports.x = 1;\nif (exports.x) return;\nexports.y = 2;",
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import cyc from "cyc";\nexport const result = cyc;\n',
+      );
+      const cyc = mod.result as Record<string, unknown> & { reload(): { n: number } };
+      assertEquals(cyc.sawPartial, true);
+      assertEquals(cyc.runs, 1);
+      assertEquals(cyc.first, { n: 1 });
+      assertEquals(cyc.early2, true);
+      // Deleted from require.cache, the bundled file runs again, as in Node.
+      assertEquals(cyc.reload(), { n: 2 });
+    });
+  });
+
+  it("runs dependency files the way Node 24 loads them", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/node24/package.json": JSON.stringify({ name: "node24", main: "index.js" }),
+        "node_modules/node24/index.js": [
+          'var path = require("path");',
+          "exports.wrapper = [arguments.length, typeof arguments[1], path.basename(arguments[3])];",
+          'exports.sync = require("dual").kind;',
+          'try { require("./forced.cjs"); } catch (error) { exports.forced = error.name; }',
+          'try { exports.typed = require(["./typed", "cts"].join(".")); } catch (error) { exports.typed = error.code; }',
+          'exports.bom = require("./bom/x.js");',
+        ].join("\n"),
+        "node_modules/node24/forced.cjs": "export default 1;",
+        "node_modules/node24/typed.cts": "const n: number = 2;\nmodule.exports = n;",
+        // A byte order mark does not make a package.json malformed.
+        "node_modules/node24/bom/package.json": '\uFEFF{"type":"module"}',
+        "node_modules/node24/bom/x.js": "export const kind = 'esm';",
+        "node_modules/dual/package.json": JSON.stringify({
+          name: "dual",
+          exports: { ".": { "module-sync": "./sync.mjs", require: "./legacy.cjs" } },
+        }),
+        "node_modules/dual/sync.mjs": 'export const kind = "sync";',
+        "node_modules/dual/legacy.cjs": 'exports.kind = "legacy";',
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import node24 from "node24";\nexport const result = node24;\n',
+      );
+      const result = mod.result as Record<string, unknown>;
+      assertEquals(result.wrapper, [5, "function", "index.js"]);
+      assertEquals(result.sync, "sync");
+      assertEquals(result.forced, "SyntaxError");
+      // Deno, which the compiled binary runs on, strips types as Node 24 does; a
+      // runtime without the stripper refuses the file instead of running it.
+      const strips = typeof (await import("node:module")).stripTypeScriptTypes === "function";
+      assertEquals(result.typed, strips ? 2 : "ERR_UNKNOWN_FILE_EXTENSION");
+      assertEquals((result.bom as { kind: string }).kind, "esm");
+    });
+  });
+
+  it("keeps Node's CommonJS scoping rules for dependency files", async () => {
+    await inProject(async (projectDir) => {
+      // A `paths` entry relative to the working directory.
+      const vendor = relative(process.cwd(), `${projectDir}/vendor`);
+      await writeFiles(projectDir, {
+        "package.json": JSON.stringify({ imports: { "#config": "./config.json" } }),
+        "config.json": '{"from":"project"}',
+        "vendor/node_modules/vended/index.js": "module.exports = 'vended';",
+        "node_modules/scopes/package.json": JSON.stringify({ name: "scopes", main: "index.js" }),
+        "node_modules/scopes/index.js": [
+          // A wrapper parameter the file replaces, here with a compound assignment.
+          'require &&= require("./swap")(require);',
+          "exports.swapped = require.swapped;",
+          'exports.custom = require("./mod");',
+          'exports.jsonData = require("esmod/data.json");',
+          'exports.self = require(["self", "ref"].join("-"));',
+          // A file with no package.json of its own: its scope ends at node_modules.
+          'try { require("loose/x.js"); } catch (error) { exports.loose = error.code; }',
+          `exports.vended = require.resolve("vended", { paths: [${JSON.stringify(vendor)}] });`,
+          'try { require.resolve("vended", { paths: "x" }); } catch (error) { exports.badPaths = error.code; }',
+          'try { require.resolve("vended", { paths: [7] }); } catch (error) { exports.badEntry = error.code; }',
+          "exports.lookups = [",
+          '  require.resolve.paths("fs"),',
+          '  require.resolve.paths("./a"),',
+          '  require.resolve.paths("x")[0],',
+          "];",
+        ].join("\n"),
+        "node_modules/scopes/swap.js": [
+          "module.exports = function (original) {",
+          "  var swapped = function (id) { return original(id); };",
+          "  swapped.resolve = original.resolve;",
+          "  swapped.swapped = true;",
+          "  return swapped;",
+          "};",
+        ].join("\n"),
+        // Node runs a file with an unknown extension as CommonJS, even in a
+        // `"type": "module"` scope.
+        "node_modules/scopes/mod/package.json": JSON.stringify({
+          type: "module",
+          main: "entry.foo",
+        }),
+        "node_modules/scopes/mod/entry.foo":
+          "module.exports = [require('path').basename(__filename), arguments.length];",
+        "node_modules/loose/x.js": 'module.exports = require("#config");',
+        "node_modules/self-ref/package.json": JSON.stringify({
+          name: "self-ref",
+          exports: { ".": "./outer.js" },
+        }),
+        "node_modules/self-ref/outer.js":
+          'exports.which = "outer";\nexports.self = require(["self", "ref"].join("-")).which;',
+        "node_modules/self-ref/node_modules/self-ref/package.json": JSON.stringify({
+          name: "self-ref",
+          main: "inner.js",
+        }),
+        "node_modules/self-ref/node_modules/self-ref/inner.js": 'exports.which = "inner";',
+        "node_modules/esmod/package.json": JSON.stringify({
+          name: "esmod",
+          type: "module",
+          main: "index.js",
+          imports: { "#not-built": "./dist/later.js" },
+        }),
+        "node_modules/esmod/index.js": [
+          'import data from "./data.json" with { type: "json" };',
+          'import queried from "./data.json?v=1" with { type: "json" };',
+          "export { data, queried };",
+          "export const req = typeof require;",
+          'export const missing = import.meta.resolve(["#not", "built"].join("-"));',
+        ].join("\n"),
+        "node_modules/esmod/data.json": '{"kind":"json"}',
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import scopes from "scopes";\nimport * as esmod from "esmod";\nexport const result = { scopes, esmod: { ...esmod } };\n',
+      );
+      const { scopes, esmod } = mod.result as Record<string, Record<string, unknown>>;
+      assertEquals(scopes!.swapped, true);
+      assertEquals(scopes!.custom, ["entry.foo", 5]);
+      assertEquals(scopes!.self, { which: "outer", self: "outer" });
+      // No package scope defines the `#import`; the project's own is not visible.
+      assertEquals(scopes!.loose, "ERR_PACKAGE_IMPORT_NOT_DEFINED");
+      assertEquals(scopes!.vended, `${projectDir}/vendor/node_modules/vended/index.js`);
+      assertEquals(scopes!.badPaths, "ERR_INVALID_ARG_VALUE");
+      assertEquals(scopes!.badEntry, "ERR_INVALID_ARG_TYPE");
+      assertEquals(scopes!.lookups, [
+        null,
+        [`${projectDir}/node_modules/scopes`],
+        `${projectDir}/node_modules/scopes/node_modules`,
+      ]);
+      // Node 24 gives a JSON import the module require() caches; one with a
+      // query is a module of its own.
+      assertEquals(esmod!.data, { kind: "json" });
+      assert(esmod!.data === scopes!.jsonData);
+      assertEquals(esmod!.queried, { kind: "json" });
+      assert(esmod!.queried !== esmod!.data);
+      assertEquals(esmod!.req, "undefined");
+      assertEquals(
+        esmod!.missing,
+        pathToFileURL(`${projectDir}/node_modules/esmod/dist/later.js`).href,
+      );
+    });
+  });
+
+  it("keeps Node's module graph, package scopes and import.meta", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/graph/package.json": JSON.stringify({
+          name: "graph",
+          main: "index.js",
+          exports: { ".": "./index.js", "./*": "./*" },
+          imports: { "#own": "./a.js" },
+        }),
+        "node_modules/graph/index.js": [
+          'var path = require("path");',
+          "var name = (m) => m && path.basename(m.filename);",
+          'var a = require("./a.js");',
+          'var b = require(["./b", "js"].join("."));',
+          "var children = module.children.map(name);",
+          // JSON a computed require loads first gets a complete cache entry.
+          'var json = require.resolve("./data.json");',
+          "require([json].join(''));",
+          "var entry = require.cache[json];",
+          "var badscope = require(path.join(__dirname, '..', 'badscope', 'a.cjs'));",
+          "module.exports = {",
+          "  children: children,",
+          "  aParent: name(require.cache[require.resolve('./a.js')].parent),",
+          "  cParent: name(require.cache[require.resolve('./c.js')].parent),",
+          "  bChildren: require.cache[require.resolve('./b.js')].children.map(name),",
+          "  json: [entry.loaded, name(entry), typeof entry.require, name(entry.parent)],",
+          // The caller's own package resolves before any paths.
+          "  scoped: [",
+          '    path.basename(require.resolve("graph", { paths: [] })),',
+          '    path.basename(require.resolve("#own", { paths: ["/"] })),',
+          "    path.basename(require.resolve(__filename, { paths: [] })),",
+          "  ],",
+          "  badscope: badscope,",
+          "};",
+        ].join("\n"),
+        "node_modules/graph/a.js": "module.exports = 'a';",
+        "node_modules/graph/b.js": "module.exports = require(['./c', 'js'].join('.'));",
+        "node_modules/graph/c.js": "module.exports = 'c';",
+        "node_modules/graph/data.json": '{"d":1}',
+        // A malformed scope lets its `.cjs` file run, but no id resolves from it.
+        "node_modules/badscope/package.json": "{bad",
+        "node_modules/badscope/a.cjs": [
+          "var codes = [];",
+          'for (var id of ["#x", "./b.cjs", "graph"]) {',
+          "  try { require([id].join('')); codes.push('loaded'); } catch (e) { codes.push(e.code); }",
+          "}",
+          'codes.push(typeof require("path").join);',
+          "module.exports = codes;",
+        ].join("\n"),
+        "node_modules/badscope/b.cjs": "module.exports = 'b';",
+        "node_modules/meta/package.json": JSON.stringify({
+          name: "meta",
+          type: "module",
+          main: "index.js",
+        }),
+        "node_modules/meta/index.js": [
+          "const meta = import.meta;",
+          "export const shape = [Object.getPrototypeOf(meta), meta.main, Object.keys(meta)];",
+          "const code = (f) => { try { f(); return 'ok'; } catch (e) { return e.code ?? e.name; } };",
+          'export const hosts = [code(() => import.meta.resolve("file://remote-host/x")), code(() => import.meta.resolve(["//remote-host", "x"].join("/"))), code(() => import.meta.resolve("file://localhost/x"))];',
+          "export const assign = code(() => { require = () => 1; });",
+        ].join("\n"),
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import graph from "graph";\nimport * as meta from "meta";\nexport const result = { graph, meta: { ...meta } };\n',
+      );
+      const { graph, meta } = mod.result as Record<string, Record<string, unknown>>;
+      assertEquals(graph!.children, ["a.js", "b.js"]);
+      assertEquals(graph!.aParent, "index.js");
+      assertEquals(graph!.cParent, "b.js");
+      assertEquals(graph!.bChildren, ["c.js"]);
+      assertEquals(graph!.json, [true, "data.json", "function", "index.js"]);
+      assertEquals(graph!.scoped, ["index.js", "a.js", "index.js"]);
+      assertEquals(graph!.badscope, [
+        "ERR_INVALID_PACKAGE_CONFIG",
+        "ERR_INVALID_PACKAGE_CONFIG",
+        "ERR_INVALID_PACKAGE_CONFIG",
+        "function",
+      ]);
+      assertEquals(meta!.shape, [null, false, ["dirname", "filename", "main", "resolve", "url"]]);
+      assertEquals(meta!.hosts, [
+        "ERR_INVALID_FILE_URL_HOST",
+        "ERR_INVALID_FILE_URL_HOST",
+        "ok",
+      ]);
+      assertEquals(meta!.assign, "ReferenceError");
+    });
+  });
+
+  it("keeps a module's own require, failed loads and malformed packages as Node does", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/later/package.json": JSON.stringify({ name: "later", main: "index.js" }),
+        "node_modules/later/index.js": [
+          'var path = require("path");',
+          "var name = (m) => m && path.basename(m.filename);",
+          "var codes = [];",
+          // A failed load leaves no child behind, bundled or computed.
+          'try { require("./throws.js"); } catch (e) { codes.push(e.message); }',
+          "try { require(['./throws2', 'js'].join('.')); } catch (e) { codes.push(e.message); }",
+          'for (var id of ["bad", "./baddir", "bad/index.js"]) {',
+          "  try { require([id].join('')); codes.push('loaded'); } catch (e) { codes.push(e.code); }",
+          "}",
+          // A direct eval in another spelling still sees the file's own require.
+          'var viaEval = (eval)("require")("./plugin.js");',
+          "exports.codes = codes;",
+          "exports.viaEval = viaEval;",
+          // A require made after the body ran still names this module.
+          "exports.load = function () {",
+          "  var loaded = require(['./lazy', 'js'].join('.'));",
+          "  return [name(require.cache[require.resolve('./lazy.js')].parent), module.children.map(name)];",
+          "};",
+        ].join("\n"),
+        "node_modules/later/throws.js": "throw new Error('bundled');",
+        "node_modules/later/throws2.js": "throw new Error('computed');",
+        "node_modules/later/lazy.js": "module.exports = 'lazy';",
+        "node_modules/later/plugin.js": "module.exports = 'plugin';",
+        "node_modules/later/baddir/package.json": "{bad",
+        "node_modules/later/baddir/index.js": "module.exports = 1;",
+        "node_modules/bad/package.json": "{bad",
+        "node_modules/bad/index.js": "module.exports = 1;",
+        "node_modules/badmeta/package.json": JSON.stringify({
+          name: "badmeta",
+          type: "module",
+          main: "index.js",
+        }),
+        "node_modules/badmeta/index.js": [
+          "let code;",
+          'try { import.meta.resolve(["bad"].join("")); code = "ok"; } catch (e) { code = e.code; }',
+          "export { code };",
+        ].join("\n"),
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import later from "later";\nimport { code } from "badmeta";\nexport const result = { later, lazy: later.load(), code };\n',
+      );
+      const result = mod.result as {
+        later: Record<string, unknown>;
+        lazy: unknown;
+        code: unknown;
+      };
+      assertEquals(result.later.codes, [
+        "bundled",
+        "computed",
+        "ERR_INVALID_PACKAGE_CONFIG",
+        "ERR_INVALID_PACKAGE_CONFIG",
+        "ERR_INVALID_PACKAGE_CONFIG",
+      ]);
+      assertEquals(result.later.viaEval, "plugin");
+      assertEquals(result.lazy, ["index.js", ["plugin.js", "lazy.js"]]);
+      assertEquals(result.code, "ERR_INVALID_PACKAGE_CONFIG");
+    });
+  });
+
+  it("binds a dependency's later literal requires and computed imports to the dependency", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/deferred/package.json": JSON.stringify({
+          name: "deferred",
+          main: "index.js",
+        }),
+        "node_modules/deferred/index.js": [
+          'var path = require("path");',
+          "var name = (m) => m && path.basename(m.filename);",
+          // A literal require made after the body ran: bundled, yet still this
+          // module's child.
+          "exports.lazy = function () {",
+          '  require("./lazy.js");',
+          "  return [name(require.cache[require.resolve('./lazy.js')].parent), module.children.map(name)];",
+          "};",
+          // Node checks the argument before any lookup.
+          "exports.codes = function () {",
+          "  var codes = [];",
+          "  for (var value of [7, undefined, {}]) {",
+          "    try { require(value); codes.push('loaded'); } catch (e) { codes.push(e.name + ' ' + e.code); }",
+          "    try { require.resolve(value); codes.push('resolved'); } catch (e) { codes.push(e.name + ' ' + e.code); }",
+          "  }",
+          "  try { require(''); } catch (e) { codes.push(e.name + ' ' + e.code); }",
+          "  return codes;",
+          "};",
+          // Imports the bundler cannot follow resolve from this file.
+          "exports.load = function (id) { return import(id); };",
+        ].join("\n"),
+        "node_modules/deferred/lazy.js": "module.exports = 'lazy';",
+        "node_modules/deferred/plugin.mjs": "export default 'plugin';",
+        "node_modules/deferred/node_modules/inner/package.json": JSON.stringify({
+          name: "inner",
+          type: "module",
+          exports: "./main.js",
+        }),
+        "node_modules/deferred/node_modules/inner/main.js": "export default 'inner';",
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import deferred from "deferred";\nexport { deferred };\n',
+      );
+      const deferred = mod.deferred as {
+        lazy: () => unknown;
+        codes: () => unknown;
+        load: (id: unknown) => Promise<{ default: unknown }>;
+      };
+      assertEquals(deferred.lazy(), ["index.js", ["lazy.js"]]);
+      assertEquals(deferred.codes(), [
+        "TypeError ERR_INVALID_ARG_TYPE",
+        "TypeError ERR_INVALID_ARG_TYPE",
+        "TypeError ERR_INVALID_ARG_TYPE",
+        "TypeError ERR_INVALID_ARG_TYPE",
+        "TypeError ERR_INVALID_ARG_TYPE",
+        "TypeError ERR_INVALID_ARG_TYPE",
+        "TypeError ERR_INVALID_ARG_VALUE",
+      ]);
+      assertEquals((await deferred.load("./plugin.mjs")).default, "plugin");
+      assertEquals((await deferred.load("inner")).default, "inner");
+      // One that does not resolve rejects, as Node's import() does.
+      const missing = deferred.load("missing-package");
+      assert(missing instanceof Promise);
+      const error = await missing.then(() => null, (reason) => reason);
+      assertEquals((error as { code?: unknown }).code, "ERR_MODULE_NOT_FOUND");
+    });
+  });
+
+  it("stops a linked workspace package's lookup at the copy that refuses an id", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "packages/linked/package.json": JSON.stringify({ name: "linked", main: "index.js" }),
+        "packages/linked/index.js": 'module.exports = require("q/sub");',
+        // The nearest copy does not export `./sub`; the project's would.
+        "packages/linked/node_modules/q/package.json": JSON.stringify({
+          name: "q",
+          exports: { ".": "./index.js" },
+        }),
+        "packages/linked/node_modules/q/index.js": "module.exports = 'nearest';",
+        "node_modules/q/package.json": JSON.stringify({ name: "q" }),
+        "node_modules/q/sub.js": "module.exports = 'project';",
+      });
+      await symlink("../packages/linked", `${projectDir}/node_modules/linked`);
+      await assertRejects(() =>
+        bundleAndImport(projectDir, 'import linked from "linked";\nexport { linked };\n')
+      );
+    });
+  });
+
+  it("shares one module between a bundled require and a computed one", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/plugins/package.json": JSON.stringify({ name: "plugins", main: "index.js" }),
+        "node_modules/plugins/index.js": [
+          'var path = require("path");',
+          'var bundled = require("./plugin");',
+          'var data = require("./data.json");',
+          "bundled.count++;",
+          'exports.same = require(path.join(__dirname, "plugin.js")) === bundled;',
+          'exports.count = require(path.join(__dirname, "plu" + "gin")).count;',
+          'exports.sameJson = require(path.join(__dirname, "data.json")) === data;',
+          "exports.cached = require.cache[require.resolve(path.join(__dirname, 'plugin'))].exports === bundled;",
+        ].join("\n"),
+        "node_modules/plugins/plugin.js": "exports.count = 0;",
+        "node_modules/plugins/data.json": '{"name":"data"}',
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import plugins from "plugins";\nexport { plugins };\n',
+      );
+      assertEquals(mod.plugins, { same: true, count: 1, sameJson: true, cached: true });
+    });
+  });
+
+  it("resolves a workspace package's imports past the project's tsconfig paths", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "tsconfig.json": JSON.stringify({
+          compilerOptions: { baseUrl: ".", paths: { "pg": ["./mock/pg.js"] } },
+        }),
+        "mock/pg.js": 'module.exports = "mock";',
+        "node_modules/pg/package.json": JSON.stringify({ name: "pg", main: "index.js" }),
+        "node_modules/pg/index.js": 'module.exports = "pg";',
+        "packages/workspace/package.json": JSON.stringify({ name: "workspace", main: "index.js" }),
+        "packages/workspace/index.js": 'module.exports = require("pg");',
+      });
+      await mkdir(`${projectDir}/node_modules`, { recursive: true });
+      await symlink("../packages/workspace", `${projectDir}/node_modules/workspace`);
+      const mod = await bundleAndImport(
+        projectDir,
+        'import workspace from "workspace";\nimport pg from "pg";\nexport const picked = [workspace, pg];\n',
+      );
+      // The route's own import still follows the project's paths.
+      assertEquals(mod.picked, ["pg", "mock"]);
+    });
+  });
+
+  it("keeps the query of a dependency module in its import.meta.url", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/queried/package.json": JSON.stringify({
+          name: "queried",
+          type: "module",
+          main: "index.js",
+        }),
+        "node_modules/queried/index.js": 'export { url, sibling } from "./child.js?v=1";',
+        "node_modules/queried/child.js": [
+          "export const url = import.meta.url;",
+          'export const sibling = import.meta.resolve("./other.js");',
+        ].join("\n"),
+      });
+      const mod = await bundleAndImport(projectDir, 'export * from "queried";\n');
+      const base = pathToFileURL(`${projectDir}/node_modules/queried`).href;
+      assertEquals({ ...mod }, { url: `${base}/child.js?v=1`, sibling: `${base}/other.js` });
+    });
+  });
+
+  it("prepares an extensionless CommonJS entry", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/bare/package.json": JSON.stringify({ name: "bare", main: "entry" }),
+        "node_modules/bare/entry": [
+          "exports.dir = __dirname;",
+          "exports.file = __filename;",
+          'exports.self = require.resolve("./entry");',
+        ].join("\n"),
+      });
+      const mod = await bundleAndImport(projectDir, 'import bare from "bare";\nexport { bare };\n');
+      const entry = `${projectDir}/node_modules/bare/entry`;
+      assertEquals(mod.bare, { dir: `${projectDir}/node_modules/bare`, file: entry, self: entry });
+    });
+  });
+
+  it("keeps import.meta locations of a dependency module its own", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/meta/package.json": JSON.stringify({
+          name: "meta",
+          type: "module",
+          main: "index.js",
+          // import.meta.resolve reads the import condition.
+          imports: { "#worker": { import: "./worker.mjs", require: "./worker.cjs" } },
+        }),
+        "node_modules/meta/worker.mjs": "export {};",
+        "node_modules/meta/worker.cjs": "",
+        "node_modules/meta/index.js": [
+          "const meta = import.meta;",
+          "const resolve = import.meta.resolve;",
+          'const name = ["./data", "json"].join(".");',
+          "export const url = import.meta.url;",
+          "export const dir = meta.dirname;",
+          "export const detached = resolve(name);",
+          'export const builtin = import.meta.resolve("fs");',
+          'export const computedBuiltin = resolve(["node", "path"].join(":"));',
+          'export const sibling = import.meta.resolve("other");',
+          'export const computedBare = resolve(["oth", "er"].join(""));',
+          'export const computedImport = resolve(["#work", "er"].join(""));',
+          'export const suffixed = import.meta.resolve("suffixed/feature");',
+          "let missing;",
+          'try { resolve(["not", "installed"].join("-")); } catch (error) { missing = error.code; }',
+          "export const computedMissing = missing;",
+        ].join("\n"),
+        "node_modules/other/package.json": JSON.stringify({ name: "other", main: "main.js" }),
+        "node_modules/suffixed/package.json": JSON.stringify({
+          name: "suffixed",
+          exports: { "./feature": "./feature.js?mode=x" },
+        }),
+        "node_modules/suffixed/feature.js": "export {};",
+        "node_modules/other/main.js": "module.exports = 1;",
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'export * from "meta";\n',
+      );
+      const base = pathToFileURL(`${projectDir}/node_modules`).href;
+      assertEquals({ ...mod }, {
+        url: `${base}/meta/index.js`,
+        dir: `${projectDir}/node_modules/meta`,
+        detached: `${base}/meta/data.json`,
+        builtin: "node:fs",
+        computedBuiltin: "node:path",
+        sibling: `${base}/other/main.js`,
+        computedBare: `${base}/other/main.js`,
+        computedImport: `${base}/meta/worker.mjs`,
+        // Node keeps a package target's query.
+        suffixed: `${base}/suffixed/feature.js?mode=x`,
+        computedMissing: "ERR_MODULE_NOT_FOUND",
+      });
+    });
+  });
+
+  it("bundles a package whose name ends in .node", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/client.node/package.json": JSON.stringify({
+          name: "client.node",
+          main: "index.js",
+        }),
+        "node_modules/client.node/index.js": 'module.exports = "client";',
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import client from "client.node";\nexport { client };\n',
+      );
+      assertEquals(mod.client, "client");
+    });
+  });
+
+  it("bundles the CommonJS entry of a package it keeps external for imports", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/dual/package.json": JSON.stringify({
+          name: "dual",
+          exports: { ".": { import: "./index.mjs", require: "./index.cjs" } },
+        }),
+        "node_modules/dual/index.mjs": 'export default "esm";',
+        "node_modules/dual/index.cjs": 'module.exports = "cjs";',
+        "node_modules/user/package.json": JSON.stringify({ name: "user", main: "index.js" }),
+        "node_modules/user/index.js": 'module.exports = require("dual");',
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import user from "user";\nexport { user };\nexport const later = () => import("dual");\n',
+        ["dual"],
+      );
+      assertEquals(mod.user, "cjs");
+      const code = await readFile(`${projectDir}/handler.mjs`, "utf8");
+      assert(code.includes('import("dual")'), code);
+    });
+  });
+
+  it("bundles a dependency's own copy of a package the project keeps external", async () => {
+    await inProject(async (projectDir) => {
+      const esm = (value: string) => ({
+        "package.json": JSON.stringify({ name: "esmpkg", type: "module", main: "index.js" }),
+        "index.js": `export default ${JSON.stringify(value)};`,
+      });
+      const files: Record<string, string> = {
+        "node_modules/user/package.json": JSON.stringify({
+          name: "user",
+          type: "module",
+          main: "index.js",
+        }),
+        "node_modules/user/index.js": 'export { default } from "esmpkg";',
+        "node_modules/other/package.json": JSON.stringify({
+          name: "other",
+          type: "module",
+          main: "index.js",
+        }),
+        "node_modules/other/index.js": 'export const load = () => import("esmpkg");',
+      };
+      for (const [name, contents] of Object.entries(esm("top"))) {
+        files[`node_modules/esmpkg/${name}`] = contents;
+      }
+      for (const [name, contents] of Object.entries(esm("nested"))) {
+        files[`node_modules/user/node_modules/esmpkg/${name}`] = contents;
+      }
+      await writeFiles(projectDir, files);
+      const mod = await bundleAndImport(
+        projectDir,
+        'import user from "user";\nexport { user };\nexport { load } from "other";\n',
+        ["esmpkg"],
+      );
+      assertEquals(mod.user, "nested");
+      const code = await readFile(`${projectDir}/handler.mjs`, "utf8");
+      // The dependency without its own copy still imports the project's.
+      assert(code.includes('import("esmpkg")'), code);
+      assert(!code.includes('"top"'), code);
+    });
+  });
+
+  it("resolves a computed relative require from the bundled file's directory", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/loader/package.json": JSON.stringify({
+          name: "loader",
+          main: "lib/index.js",
+        }),
+        "node_modules/loader/lib/index.js": [
+          "var name = ['p', 'g'].join('');",
+          'exports.dialect = require("./dialects/" + name).name;',
+          'exports.path = require.resolve("./dialects/" + name);',
+          "exports.kind = typeof require;",
+          'exports.static = require("./dialects/base").name;',
+        ].join("\n"),
+        "node_modules/loader/lib/dialects/pg.js": 'exports.name = "pg";',
+        "node_modules/loader/lib/dialects/base.js": 'exports.name = "base";',
+        // A project file at the same relative path must not be picked.
+        "dialects/pg.js": 'exports.name = "project";',
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import loader from "loader";\nexport { loader };\n',
+      );
+      assertEquals(mod.loader, {
+        dialect: "pg",
+        path: `${projectDir}/node_modules/loader/lib/dialects/pg.js`,
+        kind: "function",
+        static: "base",
+      });
+    });
+  });
+
+  it("gives a dependency that uses direct eval its own CommonJS names", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/evaler/package.json": JSON.stringify({ name: "evaler", main: "index.js" }),
+        "node_modules/evaler/index.js": [
+          '"use strict";',
+          'exports.plugin = eval("require")("./plugin").name;',
+          'exports.dir = eval("__dirname");',
+          'exports.file = eval("__filename");',
+          'exports.json = require("./data.json").v;',
+          "exports.strict = (function () { return this; })() === undefined;",
+        ].join("\n"),
+        "node_modules/evaler/plugin.js": 'exports.name = "plugin";',
+        "node_modules/evaler/data.json": '{"v":1}',
+        "plugin.js": 'exports.name = "project";',
+      });
+      const mod = await bundleAndImport(
+        projectDir,
+        'import evaler from "evaler";\nexport { evaler };\n',
+      );
+      assertEquals(mod.evaler, {
+        plugin: "plugin",
+        dir: `${projectDir}/node_modules/evaler`,
+        file: `${projectDir}/node_modules/evaler/index.js`,
+        json: 1,
+        strict: true,
+      });
+    });
+  });
+
+  it("imports the file an external package's exports map a subpath to", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/esmpkg/package.json": JSON.stringify({
+          name: "esmpkg",
+          type: "module",
+          exports: { ".": "./index.js", "./feature": "./dist/feature.js" },
+        }),
+        "node_modules/esmpkg/index.js": 'export default "root";',
+        "node_modules/esmpkg/dist/feature.js": 'export default "feature";',
+        "node_modules/other/package.json": JSON.stringify({
+          name: "other",
+          type: "module",
+          main: "index.js",
+        }),
+        "node_modules/other/index.js": 'export const load = () => import("esmpkg/feature");',
+      });
+      const mod = await bundleAndImport(projectDir, 'export { load } from "other";\n', ["esmpkg"]);
+      const feature = await (mod.load as () => Promise<{ default: string }>)();
+      assertEquals(feature.default, "feature");
+    });
+  });
+
+  it("resolves a dependency's import.meta.resolve of its own #import", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/hashed/package.json": JSON.stringify({
+          name: "hashed",
+          type: "module",
+          main: "index.js",
+          imports: { "#worker": "./worker.js" },
+        }),
+        "node_modules/hashed/index.js": 'export const worker = import.meta.resolve("#worker");',
+        "node_modules/hashed/worker.js": "export {};",
+      });
+      const mod = await bundleAndImport(projectDir, 'export * from "hashed";\n');
+      assertEquals(
+        mod.worker,
+        pathToFileURL(`${projectDir}/node_modules/hashed/worker.js`).href,
+      );
+    });
+  });
+
+  it("hands a project resolver's target inside a dependency to the file namespace", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/pkg/lib/index.js": "module.exports = __dirname;",
+        "node_modules/pkg/data.json": "{}",
+        "src/own.ts": "export {};",
+      });
+      const isDependencyFile = await createDependencyFilePredicate(projectDir, hostFs);
+      assertEquals(
+        await dependencyTarget(`${projectDir}/node_modules/pkg/lib/index`, "?v", isDependencyFile),
+        { path: `${projectDir}/node_modules/pkg/lib/index.js`, suffix: "?v" },
+      );
+      assertEquals(
+        await dependencyTarget(
+          `${projectDir}/node_modules/pkg/data.json`,
+          undefined,
+          isDependencyFile,
+        ),
+        { path: `${projectDir}/node_modules/pkg/data.json` },
+      );
+      // Project files and missing files stay with the resolver's own namespace.
+      assertEquals(
+        await dependencyTarget(`${projectDir}/src/own`, undefined, isDependencyFile),
+        undefined,
+      );
+      assertEquals(
+        await dependencyTarget(
+          `${projectDir}/node_modules/pkg/missing`,
+          undefined,
+          isDependencyFile,
+        ),
+        undefined,
+      );
+    });
+  });
+
+  it("rejects a native addon at build time", async () => {
+    await inProject(async (projectDir) => {
+      await writeFiles(projectDir, {
+        "node_modules/native/package.json": JSON.stringify({ name: "native", main: "index.js" }),
+        "node_modules/native/index.js": 'module.exports = require("./build/binding.node");',
+        "node_modules/native/build/binding.node": "not a real addon",
+      });
+      const error = await assertRejects(() =>
+        bundleAndImport(projectDir, 'import native from "native";\nexport { native };\n')
+      );
+      assert(
+        String((error as Error).message).includes(
+          'Native addons are not supported in API routes: "binding.node"',
+        ),
+        String(error),
+      );
+    });
+  });
+});