test(e2e): Cover the runtime --import path and assert exactly one span set

Adds two more variants per bundler app that keep graphql external and run the built
bundle with `node --import @sentry/node/import`, so the runtime diagnostics-channel
hook instruments graphql at load time (the inlined variants exercise the build-time
transform instead). Each app now runs four scenarios:

  - plain            (inlined,  no plugin, no --import): no graphql spans (control)
  - plugin           (inlined,  plugin,    no --import): one set, build-time
  - plain-external   (external, no plugin, --import):    one set, runtime hook
  - plugin-external  (external, plugin,    --import):    one set, runtime hook only

The assert defines "one set" relative to the build-time run and checks every
instrumented scenario emits exactly that count — never zero, never double. The
plugin-external + --import case in particular proves the build-time plugin and the
runtime hook don't both instrument the same module (the plugin can't touch an
external dep, so the runtime hook is the sole injector).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mydea

dev-packages/e2e-tests/test-applications/node-esbuild/assert.mjs

@@ -1,12 +1,18 @@
 /**
- * Runs both built bundles and asserts that build-time instrumentation actually fires at runtime:
- *   - both builds: the graphql query returns data (the SDK/plugin doesn't break the app or crash the
- *     bundle at boot),
- *   - `plugin` build: graphql auto-spans appear with origin `auto.graphql.diagnostic_channel`,
- *   - `plain` build: they do not (negative control — no plugin, runtime hook disabled).
+ * Runs the built bundles across the build-time and runtime instrumentation paths and asserts that
+ * each instrumented scenario emits exactly one set of graphql spans — never zero, never double:
  *
- * A boot crash surfaces as a non-zero child exit / missing `__RESULT__` line, which fails the assert
- * rather than being silently swallowed.
+ *   - `plain`            (inlined, no plugin, no `--import`): no graphql spans (negative control),
+ *   - `plugin`           (inlined, plugin, no `--import`):    one set, via build-time injection,
+ *   - `plain-external`   (external, no plugin, `--import`):   one set, via the runtime hook,
+ *   - `plugin-external`  (external, plugin, `--import`):      one set — the plugin can't instrument
+ *                                                             an external module, so the runtime hook
+ *                                                             is the sole injector and there is no
+ *                                                             double instrumentation.
+ *
+ * "One set" is defined relative to the build-time run (`plugin`), so the count stays correct across
+ * bundlers and graphql versions. A boot crash surfaces as a non-zero child exit / missing `__RESULT__`
+ * line, which fails the assert rather than being silently swallowed.
  *
  * @module
  */
@@ -27,36 +33,50 @@ function entryPath(name) {
   return entry;
 }
 
-function runBundle(name) {
-  const stdout = execFileSync(process.execPath, [entryPath(name)], { encoding: 'utf8' });
+// `withImport` preloads the SDK's runtime diagnostics-channel hook, so it transforms graphql as Node
+// loads it — the mechanism used for external (unbundled) dependencies.
+function run(name, { withImport = false } = {}) {
+  const args = withImport ? ['--import', '@sentry/node/import', entryPath(name)] : [entryPath(name)];
+  const stdout = execFileSync(process.execPath, args, { encoding: 'utf8', cwd: __dirname });
   const line = stdout.split('\n').find(l => l.startsWith('__RESULT__'));
   if (!line) {
-    throw new Error(`${name} build did not print a __RESULT__ line. Output:\n${stdout}`);
+    throw new Error(`${name}${withImport ? ' (--import)' : ''} did not print a __RESULT__ line. Output:\n${stdout}`);
   }
   return JSON.parse(line.slice('__RESULT__'.length));
 }
 
+const graphqlSpanCount = result => result.spans.filter(s => s.origin === GRAPHQL_ORIGIN).length;
+
+const scenarios = {
+  plain: run('plain'),
+  plugin: run('plugin'),
+  plainExternalImport: run('plain-external', { withImport: true }),
+  pluginExternalImport: run('plugin-external', { withImport: true }),
+};
+
+// One set of graphql spans, established by the build-time run.
+const oneSet = graphqlSpanCount(scenarios.plugin);
+
 let failed = false;
 function check(condition, message) {
   // eslint-disable-next-line no-console
   console.log(`${condition ? 'ok  ' : 'FAIL'} - ${message}`);
   if (!condition) failed = true;
 }
 
-const plain = runBundle('plain');
-const plugin = runBundle('plugin');
-
-const hasGraphqlOrigin = result => result.spans.some(s => s.origin === GRAPHQL_ORIGIN);
+for (const [label, result] of Object.entries(scenarios)) {
+  check(result.data?.hello === 'world', `${label}: graphql query works`);
+}
 
-check(plain.data?.hello === 'world', 'plain build: graphql query works');
-check(plugin.data?.hello === 'world', 'plugin build: graphql query works');
+check(oneSet > 0, 'plugin build (build-time) emits a set of graphql spans');
+check(graphqlSpanCount(scenarios.plain) === 0, 'plain build (no plugin, no --import) emits no graphql spans');
 check(
-  !hasGraphqlOrigin(plain),
-  'plain build (no plugin) does not auto-instrument graphql (no auto.graphql.diagnostic_channel span)',
+  graphqlSpanCount(scenarios.plainExternalImport) === oneSet,
+  `external build + --import emits exactly one set of graphql spans (${oneSet}) via the runtime hook`,
 );
 check(
-  hasGraphqlOrigin(plugin),
-  'Sentry bundler plugin auto-instruments graphql at build time (emits auto.graphql.diagnostic_channel span)',
+  graphqlSpanCount(scenarios.pluginExternalImport) === oneSet,
+  `external build + plugin + --import emits exactly one set of graphql spans (${oneSet}), not double`,
 );
 
 if (failed) {

dev-packages/e2e-tests/test-applications/node-esbuild/build.mjs

@@ -1,10 +1,12 @@
-// Bundles the entrypoint with esbuild twice, each a directly-runnable bundle with `graphql` inlined
-// (only node builtins stay external):
-//   - `plain`:  no Sentry plugin -> graphql is not instrumented.
-//   - `plugin`: with `sentryEsbuildPlugin` -> the orchestrion transform instruments graphql at build
-//     time.
-// `assert.mjs` runs both bundles and checks the graphql query works and which auto-spans appear.
-// Kept unminified so the injected snippet keeps its identifiers.
+// Bundles the entrypoint with esbuild four ways, each a directly-runnable CJS bundle:
+//   - `plain` / `plugin`:                   graphql inlined. Only `plugin` (with `sentryEsbuildPlugin`)
+//                                           build-time instruments it. Run without `--import`.
+//   - `plain-external` / `plugin-external`: graphql kept external so the runtime `--import` hook can
+//                                           intercept it at load time. Run with `--import`.
+// esbuild emits CJS (not ESM): its ESM output can't perform the CJS `require('node:async_hooks')` that
+// `@sentry/server-utils` does once inlined, and CJS is the normal esbuild node target. `assert.mjs`
+// runs all four and checks the query works and that exactly one set of graphql spans is emitted in
+// each instrumented scenario. Kept unminified so the injected snippet keeps its identifiers.
 import { rmSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -15,31 +17,34 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 
 rmSync(join(__dirname, 'dist'), { recursive: true, force: true });
 
-function run(name, plugins) {
+// No auth/release/telemetry — we only care about the build-time transforms and defines.
+const makeSentryPlugin = () =>
+  sentryEsbuildPlugin({
+    telemetry: false,
+    sourcemaps: { disable: true },
+    release: { create: false, finalize: false, inject: false },
+  });
+
+function run(name, { external, plugins }) {
   return build({
     entryPoints: [join(__dirname, 'src', 'entry.mjs')],
     outfile: join(__dirname, 'dist', name, 'main.cjs'),
     bundle: true,
     platform: 'node',
     format: 'cjs',
+    // The `*-external` variants keep graphql out of the bundle, so it is resolved from node_modules at
+    // runtime and the `--import` hook can transform it as it loads.
+    external: external ? ['graphql'] : [],
     minify: false,
     logLevel: 'silent',
     plugins,
   });
 }
 
-await run('plain', []);
-await run(
-  'plugin',
-  // No auth/release/telemetry — we only care about the build-time transforms and defines.
-  [
-    sentryEsbuildPlugin({
-      telemetry: false,
-      sourcemaps: { disable: true },
-      release: { create: false, finalize: false, inject: false },
-    }),
-  ],
-);
+await run('plain', { external: false, plugins: [] });
+await run('plugin', { external: false, plugins: [makeSentryPlugin()] });
+await run('plain-external', { external: true, plugins: [] });
+await run('plugin-external', { external: true, plugins: [makeSentryPlugin()] });
 
 // eslint-disable-next-line no-console
-console.log('built plain + plugin with esbuild');
+console.log('built plain + plugin (inlined) and plain-external + plugin-external with esbuild');

dev-packages/e2e-tests/test-applications/node-rolldown/assert.mjs

@@ -1,12 +1,18 @@
 /**
- * Runs both built bundles and asserts that build-time instrumentation actually fires at runtime:
- *   - both builds: the graphql query returns data (the SDK/plugin doesn't break the app or crash the
- *     bundle at boot),
- *   - `plugin` build: graphql auto-spans appear with origin `auto.graphql.diagnostic_channel`,
- *   - `plain` build: they do not (negative control — no plugin, runtime hook disabled).
+ * Runs the built bundles across the build-time and runtime instrumentation paths and asserts that
+ * each instrumented scenario emits exactly one set of graphql spans — never zero, never double:
  *
- * A boot crash surfaces as a non-zero child exit / missing `__RESULT__` line, which fails the assert
- * rather than being silently swallowed.
+ *   - `plain`            (inlined, no plugin, no `--import`): no graphql spans (negative control),
+ *   - `plugin`           (inlined, plugin, no `--import`):    one set, via build-time injection,
+ *   - `plain-external`   (external, no plugin, `--import`):   one set, via the runtime hook,
+ *   - `plugin-external`  (external, plugin, `--import`):      one set — the plugin can't instrument
+ *                                                             an external module, so the runtime hook
+ *                                                             is the sole injector and there is no
+ *                                                             double instrumentation.
+ *
+ * "One set" is defined relative to the build-time run (`plugin`), so the count stays correct across
+ * bundlers and graphql versions. A boot crash surfaces as a non-zero child exit / missing `__RESULT__`
+ * line, which fails the assert rather than being silently swallowed.
  *
  * @module
  */
@@ -27,36 +33,50 @@ function entryPath(name) {
   return entry;
 }
 
-function runBundle(name) {
-  const stdout = execFileSync(process.execPath, [entryPath(name)], { encoding: 'utf8' });
+// `withImport` preloads the SDK's runtime diagnostics-channel hook, so it transforms graphql as Node
+// loads it — the mechanism used for external (unbundled) dependencies.
+function run(name, { withImport = false } = {}) {
+  const args = withImport ? ['--import', '@sentry/node/import', entryPath(name)] : [entryPath(name)];
+  const stdout = execFileSync(process.execPath, args, { encoding: 'utf8', cwd: __dirname });
   const line = stdout.split('\n').find(l => l.startsWith('__RESULT__'));
   if (!line) {
-    throw new Error(`${name} build did not print a __RESULT__ line. Output:\n${stdout}`);
+    throw new Error(`${name}${withImport ? ' (--import)' : ''} did not print a __RESULT__ line. Output:\n${stdout}`);
   }
   return JSON.parse(line.slice('__RESULT__'.length));
 }
 
+const graphqlSpanCount = result => result.spans.filter(s => s.origin === GRAPHQL_ORIGIN).length;
+
+const scenarios = {
+  plain: run('plain'),
+  plugin: run('plugin'),
+  plainExternalImport: run('plain-external', { withImport: true }),
+  pluginExternalImport: run('plugin-external', { withImport: true }),
+};
+
+// One set of graphql spans, established by the build-time run.
+const oneSet = graphqlSpanCount(scenarios.plugin);
+
 let failed = false;
 function check(condition, message) {
   // eslint-disable-next-line no-console
   console.log(`${condition ? 'ok  ' : 'FAIL'} - ${message}`);
   if (!condition) failed = true;
 }
 
-const plain = runBundle('plain');
-const plugin = runBundle('plugin');
-
-const hasGraphqlOrigin = result => result.spans.some(s => s.origin === GRAPHQL_ORIGIN);
+for (const [label, result] of Object.entries(scenarios)) {
+  check(result.data?.hello === 'world', `${label}: graphql query works`);
+}
 
-check(plain.data?.hello === 'world', 'plain build: graphql query works');
-check(plugin.data?.hello === 'world', 'plugin build: graphql query works');
+check(oneSet > 0, 'plugin build (build-time) emits a set of graphql spans');
+check(graphqlSpanCount(scenarios.plain) === 0, 'plain build (no plugin, no --import) emits no graphql spans');
 check(
-  !hasGraphqlOrigin(plain),
-  'plain build (no plugin) does not auto-instrument graphql (no auto.graphql.diagnostic_channel span)',
+  graphqlSpanCount(scenarios.plainExternalImport) === oneSet,
+  `external build + --import emits exactly one set of graphql spans (${oneSet}) via the runtime hook`,
 );
 check(
-  hasGraphqlOrigin(plugin),
-  'Sentry bundler plugin auto-instruments graphql at build time (emits auto.graphql.diagnostic_channel span)',
+  graphqlSpanCount(scenarios.pluginExternalImport) === oneSet,
+  `external build + plugin + --import emits exactly one set of graphql spans (${oneSet}), not double`,
 );
 
 if (failed) {

dev-packages/e2e-tests/test-applications/node-rolldown/build.mjs

@@ -1,12 +1,12 @@
-// Bundles the entrypoint with Rolldown twice, each a directly-runnable ESM bundle with `graphql`
-// inlined (only node builtins stay external):
-//   - `plain`:  no Sentry plugin -> graphql is not instrumented.
-//   - `plugin`: with `sentryRollupPlugin` -> the orchestrion transform instruments graphql at build
-//     time.
+// Bundles the entrypoint with Rolldown four ways, each a directly-runnable ESM bundle:
+//   - `plain` / `plugin`:                   graphql inlined. Only `plugin` (with `sentryRollupPlugin`)
+//                                           build-time instruments it. Run without `--import`.
+//   - `plain-external` / `plugin-external`: graphql kept external so the runtime `--import` hook can
+//                                           intercept it at load time. Run with `--import`.
 // Rolldown is Rollup API-compatible, so it consumes the same `@sentry/node/rollup` plugin; it also
 // resolves node modules and CommonJS natively, so no extra resolve/commonjs plugins are needed.
-// `assert.mjs` runs both bundles and checks the graphql query works and which auto-spans appear.
-// Kept unminified so the injected snippet keeps its identifiers.
+// `assert.mjs` runs all four and checks the query works and that exactly one set of graphql spans is
+// emitted in each instrumented scenario. Kept unminified so the injected snippet keeps its identifiers.
 import { rmSync } from 'node:fs';
 import { builtinModules } from 'node:module';
 import { dirname, join } from 'node:path';
@@ -15,32 +15,36 @@ import { rolldown } from 'rolldown';
 import { sentryRollupPlugin } from '@sentry/node/rollup';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
-const external = [...builtinModules, ...builtinModules.map(m => `node:${m}`)];
+const nodeExternals = [...builtinModules, ...builtinModules.map(m => `node:${m}`)];
 
 rmSync(join(__dirname, 'dist'), { recursive: true, force: true });
 
-async function run(name, extra) {
+// No auth/release/telemetry — we only care about the build-time transforms and defines.
+const makeSentryPlugin = () =>
+  // `sentryRollupPlugin` returns an array of Rollup plugins.
+  sentryRollupPlugin({
+    telemetry: false,
+    sourcemaps: { disable: true },
+    release: { create: false, finalize: false, inject: false },
+  });
+
+async function run(name, { external, plugins }) {
   const bundle = await rolldown({
     input: join(__dirname, 'src', 'entry.mjs'),
-    external,
-    plugins: [...extra],
+    // The `*-external` variants keep graphql out of the bundle, so it is resolved from node_modules at
+    // runtime and the `--import` hook can transform it as it loads.
+    external: external ? [...nodeExternals, 'graphql'] : nodeExternals,
+    plugins: [...plugins],
     onwarn: () => {},
   });
   await bundle.write({ dir: join(__dirname, 'dist', name), format: 'es', entryFileNames: 'main.mjs' });
   await bundle.close();
 }
 
-await run('plain', []);
-await run(
-  'plugin',
-  // `sentryRollupPlugin` returns an array of Rollup plugins. No auth/release/telemetry — we only care
-  // about the build-time transforms and defines.
-  sentryRollupPlugin({
-    telemetry: false,
-    sourcemaps: { disable: true },
-    release: { create: false, finalize: false, inject: false },
-  }),
-);
+await run('plain', { external: false, plugins: [] });
+await run('plugin', { external: false, plugins: makeSentryPlugin() });
+await run('plain-external', { external: true, plugins: [] });
+await run('plugin-external', { external: true, plugins: makeSentryPlugin() });
 
 // eslint-disable-next-line no-console
-console.log('built plain + plugin with rolldown');
+console.log('built plain + plugin (inlined) and plain-external + plugin-external with rolldown');