fix(rendering/module-loader): resilient nested esm.sh pre-fetch

deno.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1095",
+  "version": "0.1.1098",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "minimumDependencyAge": {

extensions/ext-observability-opentelemetry/deno.json

@@ -53,19 +53,19 @@
   },
   "imports": {
     "@opentelemetry/api": "npm:@opentelemetry/api@1.9.1",
-    "@opentelemetry/auto-instrumentations-node": "npm:@opentelemetry/auto-instrumentations-node@0.77.0",
-    "@opentelemetry/core": "npm:@opentelemetry/core@2.8.0",
-    "@opentelemetry/context-async-hooks": "npm:@opentelemetry/context-async-hooks@2.8.0",
-    "@opentelemetry/api-logs": "npm:@opentelemetry/api-logs@0.219.0",
-    "@opentelemetry/exporter-logs-otlp-http": "npm:@opentelemetry/exporter-logs-otlp-http@0.219.0",
-    "@opentelemetry/exporter-metrics-otlp-http": "npm:@opentelemetry/exporter-metrics-otlp-http@0.219.0",
-    "@opentelemetry/sdk-logs": "npm:@opentelemetry/sdk-logs@0.219.0",
-    "@opentelemetry/sdk-metrics": "npm:@opentelemetry/sdk-metrics@2.8.0",
-    "@opentelemetry/sdk-node": "npm:@opentelemetry/sdk-node@0.219.0",
-    "@opentelemetry/sdk-trace-base": "npm:@opentelemetry/sdk-trace-base@2.8.0",
-    "@opentelemetry/exporter-trace-otlp-http": "npm:@opentelemetry/exporter-trace-otlp-http@0.219.0",
-    "@opentelemetry/resources": "npm:@opentelemetry/resources@2.8.0",
-    "@opentelemetry/semantic-conventions": "npm:@opentelemetry/semantic-conventions@1.41.1",
+    "@opentelemetry/auto-instrumentations-node": "npm:@opentelemetry/auto-instrumentations-node@0.78.0",
+    "@opentelemetry/core": "npm:@opentelemetry/core@2.9.0",
+    "@opentelemetry/context-async-hooks": "npm:@opentelemetry/context-async-hooks@2.9.0",
+    "@opentelemetry/api-logs": "npm:@opentelemetry/api-logs@0.220.0",
+    "@opentelemetry/exporter-logs-otlp-http": "npm:@opentelemetry/exporter-logs-otlp-http@0.220.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "npm:@opentelemetry/exporter-metrics-otlp-http@0.220.0",
+    "@opentelemetry/sdk-logs": "npm:@opentelemetry/sdk-logs@0.220.0",
+    "@opentelemetry/sdk-metrics": "npm:@opentelemetry/sdk-metrics@2.9.0",
+    "@opentelemetry/sdk-node": "npm:@opentelemetry/sdk-node@0.220.0",
+    "@opentelemetry/sdk-trace-base": "npm:@opentelemetry/sdk-trace-base@2.9.0",
+    "@opentelemetry/exporter-trace-otlp-http": "npm:@opentelemetry/exporter-trace-otlp-http@0.220.0",
+    "@opentelemetry/resources": "npm:@opentelemetry/resources@2.9.0",
+    "@opentelemetry/semantic-conventions": "npm:@opentelemetry/semantic-conventions@1.43.0",
     "@std/assert": "jsr:@std/assert@1.0.19",
     "@std/testing/bdd": "jsr:@std/testing@1.0.17/bdd",
     "veryfront/extensions": "../../src/extensions/index.ts",

extensions/ext-observability-opentelemetry/src/index.ts

@@ -936,12 +936,12 @@ class OtlpTracingExporter implements TracingExporter {
       this.logProvider = new otel.sdkLogs.LoggerProvider({
         resource,
         processors: [
-          new otel.sdkLogs.BatchLogRecordProcessor(
-            new otel.logsExporter.OTLPLogExporter({
+          new otel.sdkLogs.BatchLogRecordProcessor({
+            exporter: new otel.logsExporter.OTLPLogExporter({
               url: cfg.logsUrl,
               headers: cfg.logsHeaders,
             }),
-          ),
+          }),
         ],
       });
       otel.apiLogs.logs.setGlobalLoggerProvider(this.logProvider);
@@ -1100,12 +1100,12 @@ class OpenTelemetryNodeTelemetryProvider implements NodeTelemetryProvider {
 
     const logRecordProcessors = logsEnabled
       ? [
-        new otel.sdkLogs.BatchLogRecordProcessor(
-          new otel.logsExporter.OTLPLogExporter({
+        new otel.sdkLogs.BatchLogRecordProcessor({
+          exporter: new otel.logsExporter.OTLPLogExporter({
             url: options.logsEndpoint,
             headers: headersOrDefault(options.logsHeaders, options.exporterHeaders),
           }),
-        ),
+        }),
       ]
       : [];
 

src/rendering/orchestrator/module-loader/esm-rewriter.test.ts

@@ -1,7 +1,8 @@
 import "#veryfront/schemas/_test-setup.ts";
-import { assertEquals } from "#veryfront/testing/assert.ts";
-import { describe, it } from "#veryfront/testing/bdd.ts";
-import { rewriteEsmPaths } from "./esm-rewriter.ts";
+import { assertEquals, assertMatch, assertRejects } from "#veryfront/testing/assert.ts";
+import { afterEach, beforeEach, describe, it } from "#veryfront/testing/bdd.ts";
+import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
+import { fetchEsmModule, rewriteEsmPaths } from "./esm-rewriter.ts";
 
 describe("rendering/orchestrator/module-loader/esm-rewriter", () => {
   describe("rewriteEsmPaths", () => {
@@ -55,4 +56,115 @@ describe("rendering/orchestrator/module-loader/esm-rewriter", () => {
       assertEquals(result.includes('"react"'), true);
     });
   });
+
+  describe("fetchEsmModule", () => {
+    const tmpDir = "/tmp/esm-rewriter-test";
+    const files = new Map<string, string>();
+    const localAdapter = {
+      fs: {
+        writeFile(path: string, content: string) {
+          files.set(path, content);
+          return Promise.resolve();
+        },
+      },
+    } as unknown as RuntimeAdapter;
+    let originalFetch: typeof fetch;
+
+    beforeEach(() => {
+      files.clear();
+      originalFetch = globalThis.fetch;
+    });
+
+    afterEach(() => {
+      globalThis.fetch = originalFetch;
+    });
+
+    function jsonResponse(body: string, status = 200): Response {
+      return new Response(body, {
+        status,
+        headers: { "Content-Type": "application/javascript" },
+      });
+    }
+
+    it("resolves the top-level URL when all nested URLs succeed", async () => {
+      const esmCache = new Map<string, string>();
+      globalThis.fetch = ((input: RequestInfo | URL) => {
+        const url = typeof input === "string" ? input : input.toString();
+        if (url === "https://esm.sh/root") {
+          return Promise.resolve(
+            jsonResponse(`import { a } from "https://esm.sh/a";`),
+          );
+        }
+        if (url === "https://esm.sh/a") return Promise.resolve(jsonResponse(`export const a = 1;`));
+        return Promise.resolve(new Response("not found", { status: 404 }));
+      }) as typeof fetch;
+
+      const result = await fetchEsmModule("https://esm.sh/root", tmpDir, localAdapter, esmCache);
+      assertEquals(result.startsWith(tmpDir), true);
+      // The root's reference to the nested URL should have been rewritten to
+      // the cached file path.
+      const rootContent = files.get(result) ?? "";
+      assertMatch(rootContent, /file:\/\//);
+      assertEquals(/esm\.sh\/a/.test(rootContent), false);
+    });
+
+    it("does not abort the render when a nested URL fetch fails", async () => {
+      const esmCache = new Map<string, string>();
+      globalThis.fetch = ((input: RequestInfo | URL) => {
+        const url = typeof input === "string" ? input : input.toString();
+        if (url === "https://esm.sh/root") {
+          return Promise.resolve(
+            jsonResponse(
+              `import { a } from "https://esm.sh/a";\nimport("https://esm.sh/broken");`,
+            ),
+          );
+        }
+        if (url === "https://esm.sh/a") return Promise.resolve(jsonResponse(`export const a = 1;`));
+        if (url === "https://esm.sh/broken") {
+          return Promise.resolve(new Response("upstream broken", { status: 500 }));
+        }
+        return Promise.resolve(new Response("not found", { status: 404 }));
+      }) as typeof fetch;
+
+      const result = await fetchEsmModule("https://esm.sh/root", tmpDir, localAdapter, esmCache);
+      const rootContent = files.get(result) ?? "";
+      // Successful URL replaced with file://; failed URL preserved for runtime
+      // resolution instead of aborting the whole render.
+      assertMatch(rootContent, /file:\/\//);
+      assertMatch(rootContent, /esm\.sh\/broken/);
+    });
+
+    it("still throws when a nested URL is imported statically", async () => {
+      // The emitted module's own import graph must be local before the runtime
+      // loader is handed it. Leaving a static dependency remote would change
+      // that contract, so this failure stays fatal.
+      const esmCache = new Map<string, string>();
+      globalThis.fetch = ((input: RequestInfo | URL) => {
+        const url = typeof input === "string" ? input : input.toString();
+        if (url === "https://esm.sh/root") {
+          return Promise.resolve(jsonResponse(`import { b } from "https://esm.sh/broken";`));
+        }
+        if (url === "https://esm.sh/broken") {
+          return Promise.resolve(new Response("upstream broken", { status: 500 }));
+        }
+        return Promise.resolve(new Response("not found", { status: 404 }));
+      }) as typeof fetch;
+
+      await assertRejects(
+        () => fetchEsmModule("https://esm.sh/root", tmpDir, localAdapter, esmCache),
+        Error,
+      );
+    });
+
+    it("still throws when the top-level URL itself fails", async () => {
+      const esmCache = new Map<string, string>();
+      globalThis.fetch =
+        (() => Promise.resolve(new Response("upstream broken", { status: 500 }))) as typeof fetch;
+
+      await assertRejects(
+        () => fetchEsmModule("https://esm.sh/root", tmpDir, localAdapter, esmCache),
+        Error,
+      );
+    });
+  });
 });

src/rendering/orchestrator/module-loader/esm-rewriter.ts

@@ -2,11 +2,34 @@ import { rendererLogger } from "#veryfront/utils";
 import { MODULE_NOT_FOUND } from "#veryfront/errors";
 import type { RuntimeAdapter } from "#veryfront/platform/adapters/base.ts";
 import { generateHash } from "./cache.ts";
+import { parseImports } from "#veryfront/transforms/esm/lexer.ts";
 
 const logger = rendererLogger.component("module-loader");
 
 type PathResolver = (path: string) => string;
 
+/**
+ * Specifiers `code` imports statically, as opposed to through `import(...)` or
+ * merely mentioning in a string.
+ *
+ * A lex failure returns every discovered specifier as static, so an unparseable
+ * bundle keeps the pre-graceful-degradation behaviour of failing loudly rather
+ * than quietly shipping a remote dependency.
+ */
+async function staticImportSpecifiers(code: string): Promise<Set<string>> {
+  try {
+    const imports = await parseImports(code);
+    return new Set(
+      imports.filter((imp) => imp.d === -1 && imp.n).map((imp) => imp.n as string),
+    );
+  } catch (error) {
+    logger.debug("Could not lex a fetched module; treating its imports as static", {
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return new Set(code.match(/https:\/\/esm\.sh\/[^"']+/g) ?? []);
+  }
+}
+
 function escapeRegExp(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -77,20 +100,46 @@ export async function fetchEsmModule(
   }
 
   const urlArray = Array.from(allEsmUrls);
-  const cachedPaths = await Promise.all(
+  const staticUrls = await staticImportSpecifiers(code);
+  // Nested pre-fetches of a URL this module only reaches lazily are
+  // best-effort: a broken esm.sh build for one package logs a warning and the
+  // URL stays in the emitted code for the runtime to resolve at call time. A
+  // URL the module imports statically is part of its own import graph and must
+  // still resolve here, so the emitted artifact's static dependencies stay
+  // local. See `transforms/esm/specifier-resolver.ts` for the same rule on the
+  // SSR transform path.
+  const settledPaths = await Promise.allSettled(
     urlArray.map((esmUrl) => fetchEsmModule(esmUrl, tmpDir, localAdapter, esmCache)),
   );
 
   if (urlArray.length) {
     const replacementMap = new Map<string, string>();
     for (let i = 0; i < urlArray.length; i++) {
       const url = urlArray[i];
-      const cached = cachedPaths[i];
-      if (url && cached) replacementMap.set(url, `file://${cached}`);
+      const result = settledPaths[i];
+      if (!url || !result) continue;
+      if (result.status === "fulfilled") {
+        replacementMap.set(url, `file://${result.value}`);
+        continue;
+      }
+
+      // A statically imported dependency must be local before this module is
+      // handed to the runtime loader, so its failure stays fatal.
+      if (staticUrls.has(url)) throw result.reason;
+
+      logger.warn("Leaving an unfetchable lazy esm.sh module for runtime resolution", {
+        url,
+        error: result.reason instanceof Error ? result.reason.message : String(result.reason),
+      });
     }
 
-    const combinedPattern = new RegExp(urlArray.map(escapeRegExp).join("|"), "g");
-    code = code.replace(combinedPattern, (m) => replacementMap.get(m) ?? m);
+    if (replacementMap.size) {
+      const combinedPattern = new RegExp(
+        Array.from(replacementMap.keys()).map(escapeRegExp).join("|"),
+        "g",
+      );
+      code = code.replace(combinedPattern, (m) => replacementMap.get(m) ?? m);
+    }
   }
 
   const hash = await generateHash(url);