test(e2e): Run bundled graphql through node bundler apps and assert instrumentation

Extends the node webpack/vite/rollup/rolldown/esbuild bundler apps from a static
banner-grep into a runtime test: each app bundles a real `graphql` workload (inlined,
only node builtins external) twice — `plain` (no plugin) and `plugin` (Sentry bundler
plugin) — then runs both built bundles and asserts the query still returns data and
that only the `plugin` build emits `auto.graphql.diagnostic_channel` spans.

The entry disables `enableRuntimeChannelInjection` and runs without `--import`, so the
bundler plugin is the only possible injector, making the `plain` build a true negative.
Spans are captured via the `spanEnd` hook (transport/lifecycle-independent). The entry
body is an async function (not top-level await) so it bundles to both ESM and esbuild's
CJS node output.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mydea

dev-packages/e2e-tests/test-applications/node-esbuild/assert.mjs

@@ -1,39 +1,39 @@
 /**
- * Asserts that `sentryEsbuildPlugin` performs build-time instrumentation: its code transform injects
- * the orchestrion "bundler ran" banner into the entry chunk. A plain build (no plugin) does not.
+ * Runs both built bundles and asserts that build-time instrumentation actually fires at runtime:
+ *   - both builds: the graphql query returns data (the SDK/plugin doesn't break the app or crash the
+ *     bundle at boot),
+ *   - `plugin` build: graphql auto-spans appear with origin `auto.graphql.diagnostic_channel`,
+ *   - `plain` build: they do not (negative control — no plugin, runtime hook disabled).
+ *
+ * A boot crash surfaces as a non-zero child exit / missing `__RESULT__` line, which fails the assert
+ * rather than being silently swallowed.
  *
  * @module
  */
-import { readdirSync, readFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
-// A distinctive slice of the orchestrion banner that the bundler plugin's build-time code transform
-// prepends to the entry chunk (see `ORCHESTRION_BUNDLER_MARKER_BANNER` in `@sentry/server-utils`).
-// It is emitted only when the plugin's build-time instrumentation runs, so it tells a `plugin` build
-// apart from a `plain` one. We match against a whitespace-stripped bundle because some bundlers
-// (e.g. Rolldown) pretty-print the injected banner rather than emitting it verbatim.
-const BUILD_TIME_TRANSFORM_MARKER = 'g.bundler=g.bundler||[]';
-
-function bundleText(name) {
-  const files = [];
-  const walk = dir => {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      const full = join(dir, entry.name);
-      if (entry.isDirectory()) {
-        walk(full);
-      } else {
-        files.push(full);
-      }
-    }
-  };
-  walk(join(__dirname, 'dist', name));
-  return files
-    .map(f => readFileSync(f, 'utf8'))
-    .join('\n')
-    .replace(/\s+/g, '');
+const GRAPHQL_ORIGIN = 'auto.graphql.diagnostic_channel';
+
+// Entry filename varies by output format (`.mjs` for ESM bundlers, `.cjs` for esbuild's node/CJS output).
+function entryPath(name) {
+  const dir = join(__dirname, 'dist', name);
+  const entry = ['main.mjs', 'main.cjs', 'main.js'].map(f => join(dir, f)).find(existsSync);
+  if (!entry) throw new Error(`no built entry (main.mjs/.cjs/.js) found in ${dir}`);
+  return entry;
+}
+
+function runBundle(name) {
+  const stdout = execFileSync(process.execPath, [entryPath(name)], { encoding: 'utf8' });
+  const line = stdout.split('\n').find(l => l.startsWith('__RESULT__'));
+  if (!line) {
+    throw new Error(`${name} build did not print a __RESULT__ line. Output:\n${stdout}`);
+  }
+  return JSON.parse(line.slice('__RESULT__'.length));
 }
 
 let failed = false;
@@ -43,13 +43,20 @@ function check(condition, message) {
   if (!condition) failed = true;
 }
 
-const plain = bundleText('plain');
-const plugin = bundleText('plugin');
+const plain = runBundle('plain');
+const plugin = runBundle('plugin');
 
-check(!plain.includes(BUILD_TIME_TRANSFORM_MARKER), 'plain build (no plugin) does not run build-time instrumentation');
+const hasGraphqlOrigin = result => result.spans.some(s => s.origin === GRAPHQL_ORIGIN);
+
+check(plain.data?.hello === 'world', 'plain build: graphql query works');
+check(plugin.data?.hello === 'world', 'plugin build: graphql query works');
+check(
+  !hasGraphqlOrigin(plain),
+  'plain build (no plugin) does not auto-instrument graphql (no auto.graphql.diagnostic_channel span)',
+);
 check(
-  plugin.includes(BUILD_TIME_TRANSFORM_MARKER),
-  'sentryEsbuildPlugin runs build-time instrumentation (injects the orchestrion banner)',
+  hasGraphqlOrigin(plugin),
+  'Sentry bundler plugin auto-instruments graphql at build time (emits auto.graphql.diagnostic_channel span)',
 );
 
 if (failed) {

dev-packages/e2e-tests/test-applications/node-esbuild/build.mjs

@@ -1,23 +1,27 @@
-// Bundles the entrypoint with esbuild twice:
-//   - `plain`:  no Sentry plugin.
-//   - `plugin`: with `sentryEsbuildPlugin` (build-time instrumentation).
-// Only the `plugin` build runs the orchestrion code transform, which prepends the "bundler ran"
-// banner to the entry chunk. Kept unminified so the banner keeps its identifiers (a minifier would
-// rename them); assert.mjs matches it whitespace-insensitively.
+// Bundles the entrypoint with esbuild twice, each a directly-runnable bundle with `graphql` inlined
+// (only node builtins stay external):
+//   - `plain`:  no Sentry plugin -> graphql is not instrumented.
+//   - `plugin`: with `sentryEsbuildPlugin` -> the orchestrion transform instruments graphql at build
+//     time.
+// `assert.mjs` runs both bundles and checks the graphql query works and which auto-spans appear.
+// Kept unminified so the injected snippet keeps its identifiers.
+import { rmSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { build } from 'esbuild';
 import { sentryEsbuildPlugin } from '@sentry/node/esbuild';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
+rmSync(join(__dirname, 'dist'), { recursive: true, force: true });
+
 function run(name, plugins) {
   return build({
     entryPoints: [join(__dirname, 'src', 'entry.mjs')],
-    outdir: join(__dirname, 'dist', name),
+    outfile: join(__dirname, 'dist', name, 'main.cjs'),
     bundle: true,
     platform: 'node',
-    format: 'esm',
+    format: 'cjs',
     minify: false,
     logLevel: 'silent',
     plugins,

dev-packages/e2e-tests/test-applications/node-esbuild/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-esbuild",
-  "description": "ensure the Sentry esbuild plugin performs build-time instrumentation",
+  "description": "ensure the Sentry esbuild plugin build-time instruments a bundled graphql at runtime",
   "version": "1.0.0",
   "private": true,
   "type": "module",
@@ -15,6 +15,7 @@
     "@sentry/bundler-plugins": "file:../../packed/sentry-bundler-plugins-packed.tgz"
   },
   "devDependencies": {
+    "graphql": "16.9.0",
     "esbuild": "0.28.2"
   },
   "volta": {

dev-packages/e2e-tests/test-applications/node-esbuild/src/app.mjs

@@ -1,2 +1,10 @@
-// eslint-disable-next-line no-console
-console.log('this is the application');
+// The real workload the bundle instruments: a `graphql` query. `graphql` is inlined into the bundle
+// (only node builtins stay external), so the `plugin` build's orchestrion transform can rewrite it.
+// graphql 16.x sits in the supported orchestrion range (`>=14.0.0 <17`).
+import { buildSchema, graphql } from 'graphql';
+
+const schema = buildSchema('type Query { hello: String }');
+
+export async function runGraphqlQuery() {
+  return graphql({ schema, source: '{ hello }', rootValue: { hello: () => 'world' } });
+}

dev-packages/e2e-tests/test-applications/node-esbuild/src/entry.mjs

@@ -1,9 +1,42 @@
+// Bundled entrypoint, run directly with `node` (no `--import` runtime hook). `Sentry.init` runs
+// first so the graphql channel subscriber is ready, then the workload is imported and run. Spans are
+// collected via the `spanEnd` hook (transport- and trace-lifecycle-independent) and printed as a
+// single machine-readable line for `assert.mjs`.
+//
+// The body is an async function rather than top-level await so the same source bundles to both ESM
+// and CommonJS (esbuild emits CJS for a node target, which disallows top-level await).
 import * as Sentry from '@sentry/node';
 
-Sentry.init({
-  traceLifecycle: 'static',
-  dsn: 'https://public@dsn.ingest.sentry.io/1337',
-  tracesSampleRate: 1,
-});
+async function main() {
+  Sentry.init({
+    dsn: 'https://public@dsn.ingest.sentry.io/1337',
+    tracesSampleRate: 1,
+    // Isolate the build-time path: with the runtime hook off, the bundler plugin is the only possible
+    // injector, so a `plain` (no-plugin) build is a true negative.
+    enableRuntimeChannelInjection: false,
+    // Hermetic — never hit the network.
+    transport: () => ({ send: () => Promise.resolve({}), flush: () => Promise.resolve(true) }),
+  });
 
-await import('./app.mjs');
+  const spans = [];
+  Sentry.getClient()?.on('spanEnd', span => {
+    const json = Sentry.spanToJSON(span);
+    spans.push({ name: json.name, origin: json.attributes?.['sentry.origin'] });
+  });
+
+  const { runGraphqlQuery } = await import('./app.mjs');
+
+  let data;
+  await Sentry.startSpan({ name: 'graphql-work' }, async () => {
+    const result = await runGraphqlQuery();
+    data = result.data;
+  });
+
+  await Sentry.flush(2000);
+
+  // eslint-disable-next-line no-console
+  console.log(`__RESULT__${JSON.stringify({ data, spans })}`);
+  process.exit(0);
+}
+
+void main();

dev-packages/e2e-tests/test-applications/node-rolldown/assert.mjs

@@ -1,39 +1,39 @@
 /**
- * Asserts that `sentryRollupPlugin` performs build-time instrumentation when bundling with Rolldown: its code transform injects
- * the orchestrion "bundler ran" banner into the entry chunk. A plain build (no plugin) does not.
+ * Runs both built bundles and asserts that build-time instrumentation actually fires at runtime:
+ *   - both builds: the graphql query returns data (the SDK/plugin doesn't break the app or crash the
+ *     bundle at boot),
+ *   - `plugin` build: graphql auto-spans appear with origin `auto.graphql.diagnostic_channel`,
+ *   - `plain` build: they do not (negative control — no plugin, runtime hook disabled).
+ *
+ * A boot crash surfaces as a non-zero child exit / missing `__RESULT__` line, which fails the assert
+ * rather than being silently swallowed.
  *
  * @module
  */
-import { readdirSync, readFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
-// A distinctive slice of the orchestrion banner that the bundler plugin's build-time code transform
-// prepends to the entry chunk (see `ORCHESTRION_BUNDLER_MARKER_BANNER` in `@sentry/server-utils`).
-// It is emitted only when the plugin's build-time instrumentation runs, so it tells a `plugin` build
-// apart from a `plain` one. We match against a whitespace-stripped bundle because some bundlers
-// (e.g. Rolldown) pretty-print the injected banner rather than emitting it verbatim.
-const BUILD_TIME_TRANSFORM_MARKER = 'g.bundler=g.bundler||[]';
-
-function bundleText(name) {
-  const files = [];
-  const walk = dir => {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      const full = join(dir, entry.name);
-      if (entry.isDirectory()) {
-        walk(full);
-      } else {
-        files.push(full);
-      }
-    }
-  };
-  walk(join(__dirname, 'dist', name));
-  return files
-    .map(f => readFileSync(f, 'utf8'))
-    .join('\n')
-    .replace(/\s+/g, '');
+const GRAPHQL_ORIGIN = 'auto.graphql.diagnostic_channel';
+
+// Entry filename varies by output format (`.mjs` for ESM bundlers, `.cjs` for esbuild's node/CJS output).
+function entryPath(name) {
+  const dir = join(__dirname, 'dist', name);
+  const entry = ['main.mjs', 'main.cjs', 'main.js'].map(f => join(dir, f)).find(existsSync);
+  if (!entry) throw new Error(`no built entry (main.mjs/.cjs/.js) found in ${dir}`);
+  return entry;
+}
+
+function runBundle(name) {
+  const stdout = execFileSync(process.execPath, [entryPath(name)], { encoding: 'utf8' });
+  const line = stdout.split('\n').find(l => l.startsWith('__RESULT__'));
+  if (!line) {
+    throw new Error(`${name} build did not print a __RESULT__ line. Output:\n${stdout}`);
+  }
+  return JSON.parse(line.slice('__RESULT__'.length));
 }
 
 let failed = false;
@@ -43,13 +43,20 @@ function check(condition, message) {
   if (!condition) failed = true;
 }
 
-const plain = bundleText('plain');
-const plugin = bundleText('plugin');
+const plain = runBundle('plain');
+const plugin = runBundle('plugin');
 
-check(!plain.includes(BUILD_TIME_TRANSFORM_MARKER), 'plain build (no plugin) does not run build-time instrumentation');
+const hasGraphqlOrigin = result => result.spans.some(s => s.origin === GRAPHQL_ORIGIN);
+
+check(plain.data?.hello === 'world', 'plain build: graphql query works');
+check(plugin.data?.hello === 'world', 'plugin build: graphql query works');
+check(
+  !hasGraphqlOrigin(plain),
+  'plain build (no plugin) does not auto-instrument graphql (no auto.graphql.diagnostic_channel span)',
+);
 check(
-  plugin.includes(BUILD_TIME_TRANSFORM_MARKER),
-  'sentryRollupPlugin runs build-time instrumentation (injects the orchestrion banner)',
+  hasGraphqlOrigin(plugin),
+  'Sentry bundler plugin auto-instruments graphql at build time (emits auto.graphql.diagnostic_channel span)',
 );
 
 if (failed) {

dev-packages/e2e-tests/test-applications/node-rolldown/build.mjs

@@ -1,11 +1,13 @@
-// Bundles the entrypoint with Rolldown twice:
-//   - `plain`:  no Sentry plugin.
-//   - `plugin`: with `sentryRollupPlugin` (build-time instrumentation).
-// Only the `plugin` build runs the orchestrion code transform, which prepends the "bundler ran"
-// banner to the entry chunk. Kept unminified so the banner keeps its identifiers (a minifier would
-// rename them); assert.mjs matches it whitespace-insensitively.
+// Bundles the entrypoint with Rolldown twice, each a directly-runnable ESM bundle with `graphql`
+// inlined (only node builtins stay external):
+//   - `plain`:  no Sentry plugin -> graphql is not instrumented.
+//   - `plugin`: with `sentryRollupPlugin` -> the orchestrion transform instruments graphql at build
+//     time.
 // Rolldown is Rollup API-compatible, so it consumes the same `@sentry/node/rollup` plugin; it also
 // resolves node modules and CommonJS natively, so no extra resolve/commonjs plugins are needed.
+// `assert.mjs` runs both bundles and checks the graphql query works and which auto-spans appear.
+// Kept unminified so the injected snippet keeps its identifiers.
+import { rmSync } from 'node:fs';
 import { builtinModules } from 'node:module';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -15,6 +17,8 @@ import { sentryRollupPlugin } from '@sentry/node/rollup';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const external = [...builtinModules, ...builtinModules.map(m => `node:${m}`)];
 
+rmSync(join(__dirname, 'dist'), { recursive: true, force: true });
+
 async function run(name, extra) {
   const bundle = await rolldown({
     input: join(__dirname, 'src', 'entry.mjs'),

dev-packages/e2e-tests/test-applications/node-rolldown/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-rolldown",
-  "description": "ensure the Sentry rollup plugin performs build-time instrumentation when bundling with rolldown",
+  "description": "ensure the Sentry rollup plugin build-time instruments a bundled graphql when bundling with rolldown at runtime",
   "version": "1.0.0",
   "private": true,
   "type": "module",
@@ -15,6 +15,7 @@
     "@sentry/bundler-plugins": "file:../../packed/sentry-bundler-plugins-packed.tgz"
   },
   "devDependencies": {
+    "graphql": "16.9.0",
     "rolldown": "1.2.5"
   },
   "volta": {

dev-packages/e2e-tests/test-applications/node-rolldown/src/app.mjs

@@ -1,2 +1,10 @@
-// eslint-disable-next-line no-console
-console.log('this is the application');
+// The real workload the bundle instruments: a `graphql` query. `graphql` is inlined into the bundle
+// (only node builtins stay external), so the `plugin` build's orchestrion transform can rewrite it.
+// graphql 16.x sits in the supported orchestrion range (`>=14.0.0 <17`).
+import { buildSchema, graphql } from 'graphql';
+
+const schema = buildSchema('type Query { hello: String }');
+
+export async function runGraphqlQuery() {
+  return graphql({ schema, source: '{ hello }', rootValue: { hello: () => 'world' } });
+}