fix(observability): downgrade tenant build errors to tagged warning-level captures

docs/api-reference/veryfront/extensions.md

@@ -785,7 +785,7 @@ import {
 | Name                                            | Description                                                                                                               | Source                                                                                                                         |
 | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
 | `ApplicationErrorContext`                       | Sanitized context attached when a runtime reports an application error.                                                   | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-error-contract.ts#L5)             |
-| `ApplicationErrorReporter`                      | Provider-neutral application error capture and flush interface.                                                           | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-error-contract.ts#L23)            |
+| `ApplicationErrorReporter`                      | Provider-neutral application error capture and flush interface.                                                           | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-error-contract.ts#L27)            |
 | `ApplicationErrorReporterInitializationContext` | Runtime context passed to an explicitly selected reporter initializer.                                                    | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/observability/application-error-reporter.ts#L9)  |
 | `ApplicationErrorReporterInitializer`           | Application-composition contract for an error-reporting implementation.                                                   | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/observability/application-error-reporter.ts#L20) |
 | `ApplicationErrorReporterSession`               | Reporter and cleanup ownership returned by an application-selected initializer.                                           | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/observability/application-error-reporter.ts#L14) |

docs/api-reference/veryfront/observability.md

@@ -43,13 +43,13 @@ const result = await withSpan("load-data", async () => {
 | Name                                     | Description                                                          | Source                                                                                                                         |
 | ---------------------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
 | `addSpanEvent`                           | Event emitted for add span.                                          | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/tracing/index.ts#L70)                         |
-| `captureApplicationError`                |                                                                      | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-errors.ts#L224)                   |
+| `captureApplicationError`                |                                                                      | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-errors.ts#L266)                   |
 | `createChildSpan`                        | Create child span.                                                   | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/tracing/index.ts#L79)                         |
 | `createFileLogSubscriber`                | Create file log subscriber.                                          | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/file-log-subscriber.ts#L541)                  |
 | `createOpenTelemetryServiceTracer`       | Create open telemetry service tracer.                                | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/tracing/service-tracer.ts#L364)               |
 | `endSpan`                                | End an active tracing span.                                          | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/tracing/index.ts#L57)                         |
 | `extractContext`                         | Context for extract.                                                 | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/tracing/index.ts#L88)                         |
-| `flushApplicationErrors`                 |                                                                      | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-errors.ts#L242)                   |
+| `flushApplicationErrors`                 |                                                                      | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-errors.ts#L294)                   |
 | `getActiveContext`                       | Context for get active.                                              | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/tracing/index.ts#L98)                         |
 | `getErrorCollector`                      | Return error collector.                                              | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/error-collector.ts#L406)                      |
 | `getGlobalMetricsAPI`                    |                                                                      | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/tracing/api-shim.ts#L667)                     |
@@ -58,7 +58,7 @@ const result = await withSpan("load-data", async () => {
 | `getMetricsState`                        | State for get metrics.                                               | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/metrics/index.ts#L38)                         |
 | `getTraceContext`                        | Context for get trace.                                               | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/tracing/otlp-setup.ts#L500)                   |
 | `initAutoInstrumentation`                | Initialize automatic instrumentation wrappers.                       | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/auto-instrument/orchestrator.ts#L15)          |
-| `initializeApplicationErrorReporter`     | Activate an explicitly selected reporter initializer.                | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-errors.ts#L149)                   |
+| `initializeApplicationErrorReporter`     | Activate an explicitly selected reporter initializer.                | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-errors.ts#L153)                   |
 | `initializeOTLP`                         | Initialize OTLP tracing export.                                      | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/tracing/otlp-setup.ts#L113)                   |
 | `initMetrics`                            | Initialize metrics collection.                                       | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/metrics/index.ts#L20)                         |
 | `initTracing`                            | Initialize tracing for the current runtime.                          | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/tracing/index.ts#L18)                         |
@@ -131,10 +131,10 @@ const result = await withSpan("load-data", async () => {
 | Name                                            | Description                                                                     | Source                                                                                                                         |
 | ----------------------------------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
 | `ApplicationErrorContext`                       | Sanitized context attached when a runtime reports an application error.         | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-error-contract.ts#L5)             |
-| `ApplicationErrorReporter`                      | Provider-neutral application error capture and flush interface.                 | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-error-contract.ts#L23)            |
+| `ApplicationErrorReporter`                      | Provider-neutral application error capture and flush interface.                 | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-error-contract.ts#L27)            |
 | `ApplicationErrorReporterInitializationContext` | Runtime context passed to an explicitly selected reporter initializer.          | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/observability/application-error-reporter.ts#L9)  |
 | `ApplicationErrorReporterInitializer`           | Application-composition contract for an error-reporting implementation.         | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/observability/application-error-reporter.ts#L20) |
-| `ApplicationErrorReporterLifecycle`             | Active application-error reporter ownership.                                    | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-errors.ts#L28)                    |
+| `ApplicationErrorReporterLifecycle`             | Active application-error reporter ownership.                                    | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-errors.ts#L29)                    |
 | `ApplicationErrorReporterSession`               | Reporter and cleanup ownership returned by an application-selected initializer. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/extensions/observability/application-error-reporter.ts#L14) |
 | `AttributeValue`                                |                                                                                 | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/tracing/api-shim.ts#L33)                      |
 | `AutoInstrumentConfig`                          | Configuration used by auto instrument.                                          | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/auto-instrument/types.ts#L24)                 |
@@ -237,8 +237,8 @@ import {
 
 | Name                         | Description                                       | Source                                                                                                       |
 | ---------------------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
-| `captureApplicationError`    |                                                   | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-errors.ts#L224) |
-| `flushApplicationErrors`     |                                                   | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-errors.ts#L242) |
+| `captureApplicationError`    |                                                   | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-errors.ts#L266) |
+| `flushApplicationErrors`     |                                                   | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-errors.ts#L294) |
 | `initializeSentry`           | Initialize the process-wide Sentry reporter once. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/sentry.ts#L86)              |
 | `initializeSentryFromEnv`    |                                                   | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/sentry.ts#L70)              |
 | `isSentryEnabled`            | Return whether Sentry is explicitly enabled.      | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/sentry.ts#L39)              |
@@ -250,5 +250,5 @@ import {
 | Name                       | Description                                                             | Source                                                                                                              |
 | -------------------------- | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
 | `ApplicationErrorContext`  | Sanitized context attached when a runtime reports an application error. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-error-contract.ts#L5)  |
-| `ApplicationErrorReporter` | Provider-neutral application error capture and flush interface.         | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-error-contract.ts#L23) |
+| `ApplicationErrorReporter` | Provider-neutral application error capture and flush interface.         | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/application-error-contract.ts#L27) |
 | `SentryConfig`             |                                                                         | [source](https://github.com/veryfront/veryfront-code/blob/main/src/observability/sentry.ts#L18)                     |

docs/guides/errors.md

@@ -135,6 +135,13 @@ MDX compilation failed.
 - **HTTP status:** 500
 - **What to do:** Check your MDX file syntax
 
+### markdown-compile-error
+
+Markdown compilation failed.
+
+- **HTTP status:** 500
+- **What to do:** Check your Markdown file syntax and frontmatter
+
 ### asset-optimization-error
 
 Asset optimization failed.

extensions/ext-bundler-esbuild/src/esbuild-bundler.test.ts

@@ -16,6 +16,7 @@ import { createRequire } from "node:module";
 import type { BuildContext } from "veryfront/extensions/bundler";
 
 import {
+  __markEsbuildSourceDiagnosticForTests,
   __recordOwnershipErrorForTests,
   __resetOwnershipErrorForTests,
   __resetServiceRecoveryForTests,
@@ -72,6 +73,55 @@ function observeEsbuildServices(): {
 }
 
 describe("EsbuildBundler.transform", () => {
+  it("normalizes only trusted esbuild diagnostic accessors to an own marker", () => {
+    const marker = Symbol.for("veryfront.bundler.esbuild-source-diagnostic");
+    const failure = new Error("Transform failed");
+    let errorsGetterReads = 0;
+    Object.defineProperty(failure, "errors", {
+      get() {
+        errorsGetterReads++;
+        return [{ location: { line: 1, column: 1 } }];
+      },
+    });
+    const defineProperty = Object.defineProperty;
+    const previousDefineProperty = Object.getOwnPropertyDescriptor(Object, "defineProperty");
+    assertExists(previousDefineProperty);
+    defineProperty(Object, "defineProperty", {
+      ...previousDefineProperty,
+      value: () => {
+        throw new Error("poisoned Object.defineProperty");
+      },
+    });
+
+    try {
+      __markEsbuildSourceDiagnosticForTests(failure);
+    } finally {
+      defineProperty(Object, "defineProperty", previousDefineProperty);
+    }
+
+    assertEquals(errorsGetterReads, 1);
+    assertEquals(Object.getOwnPropertyDescriptor(failure, marker)?.value, true);
+
+    let locationGetterReads = 0;
+    const accessorLocation = Object.defineProperty({}, "location", {
+      get() {
+        locationGetterReads++;
+        return { line: 1, column: 1 };
+      },
+    });
+    const untrustedLocation = new Error("Transform failed");
+    Object.defineProperty(untrustedLocation, "errors", {
+      get() {
+        return [accessorLocation];
+      },
+    });
+
+    __markEsbuildSourceDiagnosticForTests(untrustedLocation);
+
+    assertEquals(locationGetterReads, 0);
+    assertEquals(Object.getOwnPropertyDescriptor(untrustedLocation, marker), undefined);
+  });
+
   it("compiles TS to JS", async () => {
     const bundler = new EsbuildBundler();
     try {