fix: set ssr:true when bundling backend functions

getBaseBackendBuildConfig never set Vite's build.ssr option, so Vite
defaulted to a browser-target build. Any *.backend.ts file importing a
real Node builtin module (e.g. node:crypto) got that import
externalized to a broken __vite-browser-external:* stub instead of a
working import, breaking the bundle at build time.

Backend functions run server-side, never in a browser, so ssr:true is
the correct target. Affects both the existing cloud round-trip and any
future local-execution path, since both share this config.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: tyffical

packages/plugins/apps/src/vite/build-config.test.ts

@@ -0,0 +1,75 @@
+// Unless explicitly stated otherwise all files in this repository are licensed under the MIT License.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2019-Present Datadog, Inc.
+
+/**
+ * Real, unmocked test: getBaseBackendBuildConfig must produce a working
+ * bundle for a backend function that imports a real Node built-in module
+ * (e.g. node:crypto), not the browser-target `__vite-browser-external:*`
+ * externalization stub Vite falls back to when `build.ssr` isn't set.
+ *
+ * Discovered while building a local-execution POC: without `ssr: true`,
+ * Vite defaults to a browser-target build, and any `*.backend.ts` file that
+ * imports a real Node built-in fails to bundle correctly -- this affects
+ * dev-server.ts's existing bundleBackendFunction() today (both the current
+ * cloud round-trip and any future local-execution path), not just new code.
+ */
+
+import { outputFileSync } from '@dd/core/helpers/fs';
+import { getTempWorkingDir } from '@dd/tests/_jest/helpers/env';
+import { build } from 'vite';
+
+import { getBaseBackendBuildConfig } from './build-config';
+
+describe('getBaseBackendBuildConfig', () => {
+    test('bundles a backend function that imports a real Node builtin module with a working import, not a browser-external stub', async () => {
+        const workingDir = getTempWorkingDir(`build-config-ssr-${Date.now()}`);
+        const absolutePath = `${workingDir}/src/usesCrypto.backend.ts`;
+
+        outputFileSync(
+            absolutePath,
+            `
+            import { randomBytes } from 'node:crypto';
+            export async function usesCrypto() {
+                return randomBytes(4).toString('hex');
+            }
+        `,
+        );
+
+        const virtualId = 'virtual:dd-backend-test:usesCrypto';
+        const virtualContent = `import { usesCrypto } from ${JSON.stringify(absolutePath)};\nexport async function main($) { return await usesCrypto(); }`;
+        const baseConfig = getBaseBackendBuildConfig(
+            workingDir,
+            { [virtualId]: virtualContent },
+            [],
+        );
+
+        const result = await build({
+            ...baseConfig,
+            build: {
+                ...baseConfig.build,
+                write: false,
+                rollupOptions: {
+                    ...baseConfig.build.rollupOptions,
+                    input: virtualId,
+                    output: baseConfig.build.rollupOptions.output,
+                },
+            },
+        });
+
+        const output = Array.isArray(result) ? result[0] : result;
+        if (!('output' in output)) {
+            throw new Error('Unexpected vite.build result');
+        }
+        const chunk = output.output[0];
+        const code = chunk.type === 'chunk' ? chunk.code : '';
+
+        // Without `ssr: true`, Vite externalizes node:crypto to
+        // `__vite-browser-external:node:crypto`, which has no real exports --
+        // calling randomBytes() from it throws at runtime, and the import
+        // specifier itself is rewritten away from 'node:crypto'. Assert the
+        // real, working import survived instead.
+        expect(code).toContain("from 'node:crypto'");
+        expect(code).not.toContain('__vite-browser-external');
+    });
+});

packages/plugins/apps/src/vite/build-config.ts

@@ -48,6 +48,12 @@ export function getBaseBackendBuildConfig(
         build: {
             minify: false,
             target: 'esnext',
+            // Backend functions run server-side, never in a browser. Without
+            // this, Vite defaults to a browser-target build and externalizes
+            // real Node builtin imports (node:crypto, fs, etc.) to a
+            // `__vite-browser-external:*` stub with no real exports, silently
+            // breaking any backend function that imports one directly.
+            ssr: true,
             rollupOptions: {
                 output: { format: 'es', exports: 'named', inlineDynamicImports: true },
                 preserveEntrySignatures: 'exports-only',
@@ -63,6 +69,17 @@ export function getBaseBackendBuildConfig(
         resolve: {
             extensions: [...BACKEND_CODE_EXTENSIONS, '.json'],
         },
+        // Vite's SSR build mode (enabled above) externalizes any real npm
+        // dependency it finds in node_modules by default, on the assumption
+        // a server runtime can `require()` it at runtime. Backend-function
+        // bundles don't get that guarantee: dev-server.ts writes them to a
+        // standalone temp file, and the local-execution path imports the
+        // bundle from a data: URL with no filesystem context at all -- so
+        // every real dependency must be inlined, matching the pre-ssr:true
+        // browser-mode behavior this config otherwise replaces.
+        ssr: {
+            noExternal: true,
+        },
         plugins: [createVirtualPlugin('dd-backend-resolve', virtualEntries), ...plugins],
     };
 }