fix(vite): strip deno:: prefix from server-side stack traces (#3464)

Stack traces from server-side errors in Fresh 2 Vite apps leaked the
internal `\0deno::{type}::{specifier}` virtual module IDs used by the
deno plugin, displayed as `deno::N::…` in frames like
`at async eval (deno::0::https:/jsr.io/@fresh/core/2.1.0/src/render.ts:9:332)`.

The plugin's `load` hook returned the loader's code with its inline
`//# sourceMappingURL=` data URL untouched. That inline source map
embeds `sources` as a *relative* path (e.g.
`packages/plugin-vite/demo/routes/tests/throw.tsx`). When V8 cannot
apply the source map, it falls back to the module ID — the `\0deno::…`
virtual ID — leaking it into stack frames. When V8 *does* apply the
relative source path, it can be resolved against the module URL's
directory, producing doubled paths like
`packages/fresh/src/packages/fresh/src/segments.ts`.

This patch:

- Rewrites the inline source map in the deno-specifier branch of the
  `load` hook so `sources` is the absolute specifier with an empty
  `sourceRoot`, while keeping the inline `//# sourceMappingURL=`
  comment in place for V8 to pick up natively.
- Returns the rewritten map as the explicit `map` field too, so Rollup
  composes consistent `sources` during production builds.
- For the Babel-transformed JSX branch, rewrites both the inline and
  the explicit map's `sources` to the specifier with `sourceRoot: ""`.
- Skips the rewrite for non-JS media (JSON, CSS, …) since appending a
  `//# sourceMappingURL=` comment would corrupt those payloads.
- Adds unit tests for the two new helpers, plus dev-server and prod-build
  integration tests that fetch `/tests/throw` and assert the response
  contains neither `deno::N::` nor doubled cwd paths.

Closes bartlomieju/orchid-inbox#56

Author: fibibot

packages/plugin-vite/src/plugins/deno.ts

@@ -190,12 +190,32 @@ export function deno(): Plugin {
           isDev,
         });
         if (maybeJsx !== null) {
+          if (maybeJsx.map) {
+            // Babel reads the loader's inline source map but inherits its
+            // `sources` (relative path). Rewrite to the absolute specifier
+            // with an empty `sourceRoot` so stack frames show the real URL
+            // instead of the `\0deno::…` virtual ID and don't double the cwd.
+            maybeJsx.map.sources = [specifier];
+            maybeJsx.map.sourceRoot = "";
+          }
+          // Babel emits its own inline `//# sourceMappingURL=` comment via
+          // `sourceMaps: "both"`. Rewrite that one too so V8 stack traces
+          // (which read the inline map natively) point at the specifier.
+          maybeJsx.code = rewriteInlineSourceMapSources(
+            maybeJsx.code,
+            specifier,
+          );
           return maybeJsx;
         }
 
-        return {
-          code,
-        };
+        // For non-JS media (JSON, CSS, …) the loaded code is not JavaScript,
+        // so appending a `//# sourceMappingURL=` comment would corrupt it.
+        // Those modules don't show up in JS stack traces, so leave them alone.
+        if (!isJsMediaType(result.mediaType)) {
+          return { code };
+        }
+
+        return rewriteLoadedSourceMap(code, specifier);
       }
 
       if (id.startsWith("\0")) {
@@ -368,6 +388,94 @@ function getDenoType(id: string, type: string): RequestedModuleType {
   }
 }
 
+// Builds a 1:1 (line-by-line, column 0) source map so that Vite/V8 can
+// rewrite stack frames from `\0deno::{type}::{specifier}` virtual IDs back
+// to the original specifier. Uses an absolute URL/path in `sources` combined
+// with an empty `sourceRoot` to avoid Vite resolving sources relative to the
+// cwd, which would produce doubled paths like
+// `packages/fresh/src/packages/fresh/src/segments.ts`.
+export function identitySourceMap(source: string, code: string) {
+  const lineCount = code.split("\n").length;
+  // VLQ "AAAA" → [genCol=0, srcIdx=0, srcLine=0, srcCol=0]
+  // ";AACA"   → newline, then deltas [0, 0, +1, 0]
+  let mappings = "AAAA";
+  for (let i = 1; i < lineCount; i++) {
+    mappings += ";AACA";
+  }
+  return {
+    version: 3,
+    sources: [source],
+    sourcesContent: [code],
+    names: [] as string[],
+    mappings,
+    sourceRoot: "",
+  };
+}
+
+const INLINE_SOURCE_MAP_RE =
+  /\n?\/\/# sourceMappingURL=data:application\/json(?:;charset=[^;]+)?;base64,([A-Za-z0-9+/=]+)\s*$/;
+
+// `ssrLoader.load()` returns code with an inline `//# sourceMappingURL=` data
+// URL whose `sources` array contains a path relative to the cwd. Without
+// fixing this up, stack traces either leak the `\0deno::…` virtual module ID
+// (when V8 falls back to the module ID) or display doubled cwd paths like
+// `packages/fresh/src/packages/fresh/src/segments.ts` (the caveat described
+// in denoland/fresh#3464).
+//
+// Rewrites the inline source map (if any) so `sources` is the absolute
+// specifier with an empty `sourceRoot`. The inline comment itself is kept in
+// place so that V8 picks it up natively for stack-trace translation. When the
+// loader did not emit a source map, an identity map is appended so the
+// virtual ID is still replaced in stack traces. The same map is also
+// returned alongside the code so Rollup (production builds) sees consistent
+// `sources` during source-map chaining.
+export function rewriteLoadedSourceMap(code: string, source: string) {
+  const match = code.match(INLINE_SOURCE_MAP_RE);
+  if (match !== null) {
+    try {
+      const parsed = JSON.parse(atob(match[1]));
+      parsed.sources = [source];
+      parsed.sourceRoot = "";
+      const start = match.index!;
+      const reencoded = btoa(JSON.stringify(parsed));
+      const newCode = code.slice(0, start) +
+        `\n//# sourceMappingURL=data:application/json;base64,${reencoded}`;
+      return { code: newCode, map: parsed };
+    } catch {
+      // fall through to identity map
+    }
+  }
+  const map = identitySourceMap(source, code);
+  const encoded = btoa(JSON.stringify(map));
+  return {
+    code:
+      `${code}\n//# sourceMappingURL=data:application/json;base64,${encoded}`,
+    map,
+  };
+}
+
+// Rewrites just the `sources` of an existing inline `//# sourceMappingURL=`
+// comment in JS code, without touching mappings or appending a new comment
+// when none exists. Used after Babel has already produced its own source
+// map and we only need to fix the specifier.
+export function rewriteInlineSourceMapSources(
+  code: string,
+  source: string,
+): string {
+  const match = code.match(INLINE_SOURCE_MAP_RE);
+  if (match === null) return code;
+  try {
+    const parsed = JSON.parse(atob(match[1]));
+    parsed.sources = [source];
+    parsed.sourceRoot = "";
+    const reencoded = btoa(JSON.stringify(parsed));
+    return code.slice(0, match.index!) +
+      `\n//# sourceMappingURL=data:application/json;base64,${reencoded}`;
+  } catch {
+    return code;
+  }
+}
+
 function babelTransform(
   options: {
     media: MediaType;

packages/plugin-vite/src/plugins/deno_test.ts

@@ -0,0 +1,95 @@
+import { expect } from "@std/expect/expect";
+import { identitySourceMap, rewriteLoadedSourceMap } from "./deno.ts";
+
+Deno.test("identitySourceMap - single line", () => {
+  const map = identitySourceMap("jsr:@fresh/core/src/render.ts", "foo();");
+  expect(map.version).toBe(3);
+  expect(map.sources).toEqual(["jsr:@fresh/core/src/render.ts"]);
+  expect(map.sourcesContent).toEqual(["foo();"]);
+  expect(map.sourceRoot).toBe("");
+  // Single line => single segment, no `;` separators.
+  expect(map.mappings).toBe("AAAA");
+});
+
+Deno.test("identitySourceMap - multi line", () => {
+  const code = "a;\nb;\nc;";
+  const map = identitySourceMap("https://example.com/mod.js", code);
+  // Three lines => `AAAA` + `;AACA` per additional line.
+  expect(map.mappings).toBe("AAAA;AACA;AACA");
+  expect(map.sources).toEqual(["https://example.com/mod.js"]);
+  expect(map.sourceRoot).toBe("");
+});
+
+Deno.test("identitySourceMap - keeps full URL in sources to avoid doubled cwd paths", () => {
+  // Regression test for the caveat from denoland/fresh#3464: Vite resolves
+  // source-map `sources` entries relative to the (virtual) module location
+  // and falls back to concatenating the cwd. Using absolute URLs/paths in
+  // `sources` together with `sourceRoot: ""` prevents the doubling.
+  const map = identitySourceMap(
+    "file:///abs/path/to/segments.ts",
+    "export const x = 1;",
+  );
+  expect(map.sources[0]).toBe("file:///abs/path/to/segments.ts");
+  expect(map.sourceRoot).toBe("");
+});
+
+Deno.test("rewriteLoadedSourceMap - rewrites inline map sources to absolute", () => {
+  const inputMap = {
+    version: 3,
+    sources: ["packages/foo/src/bar.ts"],
+    sourcesContent: ["original;"],
+    names: [],
+    mappings: "AAAA",
+  };
+  const inlined = btoa(JSON.stringify(inputMap));
+  const body = "transformed;";
+  const code =
+    `${body}\n//# sourceMappingURL=data:application/json;base64,${inlined}`;
+
+  const result = rewriteLoadedSourceMap(
+    code,
+    "https://jsr.io/@fresh/core/2.1.0/src/render.ts",
+  );
+
+  // The returned map (also embedded inline) has `sources` rewritten.
+  expect(result.map.sources).toEqual([
+    "https://jsr.io/@fresh/core/2.1.0/src/render.ts",
+  ]);
+  expect(result.map.sourceRoot).toBe("");
+  expect(result.map.mappings).toBe("AAAA");
+
+  // The inline `//# sourceMappingURL=` comment is preserved (rewritten) so
+  // V8 can apply it natively for stack-trace translation.
+  const m = result.code.match(
+    /\/\/# sourceMappingURL=data:application\/json;base64,([A-Za-z0-9+/=]+)/,
+  );
+  expect(m).not.toBeNull();
+  const reparsed = JSON.parse(atob(m![1]));
+  expect(reparsed.sources).toEqual([
+    "https://jsr.io/@fresh/core/2.1.0/src/render.ts",
+  ]);
+  expect(reparsed.sourceRoot).toBe("");
+  // The original transformed code is preserved before the comment.
+  expect(result.code.startsWith(body)).toBe(true);
+});
+
+Deno.test("rewriteLoadedSourceMap - appends identity map when no inline map", () => {
+  const result = rewriteLoadedSourceMap(
+    "foo();\nbar();",
+    "jsr:@fresh/core/src/render.ts",
+  );
+  expect(result.map.sources).toEqual(["jsr:@fresh/core/src/render.ts"]);
+  expect(result.map.sourceRoot).toBe("");
+  expect(result.map.mappings).toBe("AAAA;AACA");
+  // The original code is preserved and an inline source map is appended.
+  expect(result.code.startsWith("foo();\nbar();")).toBe(true);
+  expect(result.code).toContain(
+    "//# sourceMappingURL=data:application/json;base64,",
+  );
+});
+
+Deno.test("rewriteLoadedSourceMap - falls back to identity on malformed inline map", () => {
+  const code = "foo();\n//# sourceMappingURL=data:application/json;base64,!!!";
+  const result = rewriteLoadedSourceMap(code, "file:///abs.ts");
+  expect(result.map.sources).toEqual(["file:///abs.ts"]);
+});

packages/plugin-vite/tests/build_test.ts

@@ -128,6 +128,25 @@ integrationTest("vite build - without routes/ dir", async () => {
   );
 });
 
+integrationTest(
+  "vite build - strips deno:: from server stack traces",
+  async () => {
+    // Regression test for denoland/fresh#3464. Without identity source
+    // maps in the deno plugin, server-side stack traces contained the
+    // virtual module ID `\0deno::{type}::{specifier}` (rendered as
+    // `deno::N::…`) instead of the original specifier.
+    await launchProd(
+      { cwd: viteResult.tmp },
+      async (address) => {
+        const res = await fetch(`${address}/tests/throw`);
+        const text = await res.text();
+        expect(text).toContain("FAIL");
+        expect(text).not.toMatch(/deno::\d+::/);
+      },
+    );
+  },
+);
+
 integrationTest("vite build - load json inside npm package", async () => {
   await launchProd(
     { cwd: viteResult.tmp },

packages/plugin-vite/tests/dev_server_test.ts

@@ -471,6 +471,24 @@ integrationTest("vite dev - source mapped stack traces", async () => {
   expect(text).toContain("throw.tsx:5:11");
 });
 
+integrationTest(
+  "vite dev - strips deno:: prefix from stack traces",
+  async () => {
+    // Regression test for denoland/fresh#3464: the deno plugin's virtual
+    // module IDs (`\0deno::{type}::{specifier}`) used to leak into stack
+    // traces. The plugin now rewrites the loader's source maps so frames
+    // reference the original `jsr:` / `https:` / `file://` specifier.
+    const res = await fetch(`${demoServer.address()}/tests/throw`);
+    const text = await res.text();
+    expect(text).toContain("FAIL");
+    expect(text).not.toMatch(/deno::\d+::/);
+    // And no doubled cwd paths from a missing `sourceRoot` (the caveat
+    // described in the issue).
+    const cwd = Deno.cwd().replaceAll("\\", "/");
+    expect(text).not.toContain(`${cwd}${cwd}`);
+  },
+);
+
 integrationTest("vite dev - client side <Head>", async () => {
   await withBrowser(async (page) => {
     await page.goto(`${demoServer.address()}/tests/head_counter`, {