react-on-rails-pro-node-renderer 17.0.0-rc.3 → 17.0.0-rc.5

package/lib/shared/checkRscPeerCompatibility.js

@@ -41,8 +41,20 @@ const isAtLeast = (actual, floor) => {
     return true;
 };
 const sameTuple = (left, right) => left.every((value, index) => value === right[index]);
-const supportedReactRange = ({ supportedMajor, supportedMinor, minPatch, }) => `${supportedMajor}.${supportedMinor}.x with patch >= ${supportedMajor}.${supportedMinor}.${minPatch}`;
-const isSupportedReactTuple = ([major, minor, patch], { supportedMajor, supportedMinor, minPatch }) => major === supportedMajor && minor === supportedMinor && patch >= minPatch;
+const supportedRscRange = ({ supportedMajor }, { supportedRanges }) => {
+    const supportedMinors = [...new Set(supportedRanges.map((range) => range.rscMinor))].sort((left, right) => left - right);
+    return supportedMinors.map((minor) => `${supportedMajor}.${minor}.x`).join(' or ');
+};
+const supportedReactRange = (rscTuple, { supportedMajor, supportedRanges }) => {
+    const rscMinor = rscTuple[1];
+    const matchingRanges = supportedRanges.filter((range) => range.rscMinor === rscMinor);
+    return matchingRanges
+        .map(({ minor, minPatch }) => `${supportedMajor}.${minor}.x with patch >= ${supportedMajor}.${minor}.${minPatch}`)
+        .join(' or ');
+};
+const isSupportedReactTuple = ([major, minor, patch], rscTuple, { supportedMajor, supportedRanges }) => major === supportedMajor &&
+    supportedRanges.some((range) => rscTuple[1] === range.rscMinor && minor === range.minor && patch >= range.minPatch);
+const isSupportedRscMinor = (rscTuple, { supportedRanges }) => supportedRanges.some((range) => rscTuple[1] === range.rscMinor);
 const proLabel = (proVersion) => proVersion ? `React on Rails Pro (${proVersion})` : 'React on Rails Pro';
 const errorMessage = (pkg, found, want, proVersion) => [
     `[ReactOnRails] Incompatible ${pkg} version.`,
@@ -70,24 +82,30 @@ function checkRscPeerCompatibility(input) {
             message: errorMessage('react-on-rails-rsc', rscVersion, `${reactOnRailsRsc.supportedMajor}.x`, proVersion),
         };
     }
+    if (!isSupportedRscMinor(rscTuple, react)) {
+        return {
+            level: 'error',
+            message: errorMessage('react-on-rails-rsc', rscVersion, supportedRscRange(reactOnRailsRsc, react), proVersion),
+        };
+    }
     // If React is not resolvable (unusual, since RSC requires React), skip this check;
     // an app with React truly absent will fail during normal module loading.
     let reactTuple = null;
     if (reactVersion) {
         reactTuple = parseTuple(reactVersion);
-        if (!isSupportedReactTuple(reactTuple, react)) {
+        if (!isSupportedReactTuple(reactTuple, rscTuple, react)) {
             return {
                 level: 'error',
-                message: errorMessage('react', reactVersion, supportedReactRange(react), proVersion),
+                message: errorMessage('react', reactVersion, supportedReactRange(rscTuple, react), proVersion),
             };
         }
     }
     if (reactDomVersion) {
         const reactDomTuple = parseTuple(reactDomVersion);
-        if (!isSupportedReactTuple(reactDomTuple, react)) {
+        if (!isSupportedReactTuple(reactDomTuple, rscTuple, react)) {
             return {
                 level: 'error',
-                message: errorMessage('react-dom', reactDomVersion, supportedReactRange(react), proVersion),
+                message: errorMessage('react-dom', reactDomVersion, supportedReactRange(rscTuple, react), proVersion),
             };
         }
         if (reactTuple && !sameTuple(reactTuple, reactDomTuple)) {

package/lib/shared/configBuilder.d.ts

@@ -25,6 +25,7 @@ export interface Config {
     includeTimerPolyfills?: boolean;
     replayServerAsyncOperationLogs: boolean;
     maxVMPoolSize: number;
+    enableHealthEndpoints: boolean;
 }
 export declare function getConfig(): Config;
 export declare function logSanitizedConfig(): void;

package/lib/shared/configBuilder.js

@@ -109,6 +109,9 @@ function defaultReplayServerAsyncOperationLogs() {
     }
     return env.NODE_ENV?.toLowerCase() === 'development';
 }
+function truthyHealthEndpointFlag(value) {
+    return value === '1' || (0, truthy_js_1.default)(value);
+}
 const defaultConfig = {
     // Use env port if we run on Heroku
     port: Number(env.RENDERER_PORT) || DEFAULT_PORT,
@@ -142,6 +145,8 @@ const defaultConfig = {
     // Maximum number of VM contexts to keep in memory. Defaults to 2 since typically only two contexts
     // are needed - one for the server bundle and one for React Server Components (RSC) if enabled.
     maxVMPoolSize: (env.MAX_VM_POOL_SIZE && parseInt(env.MAX_VM_POOL_SIZE, 10)) || 2,
+    // Built-in /health and /ready probe endpoints are opt-in.
+    enableHealthEndpoints: truthyHealthEndpointFlag(env.RENDERER_ENABLE_HEALTH_ENDPOINTS),
 };
 function envValuesUsed() {
     return {
@@ -163,6 +168,7 @@ function envValuesUsed() {
         INCLUDE_TIMER_POLYFILLS: !('includeTimerPolyfills' in userConfig) && env.INCLUDE_TIMER_POLYFILLS,
         REPLAY_SERVER_ASYNC_OPERATION_LOGS: !userConfig.replayServerAsyncOperationLogs && env.REPLAY_SERVER_ASYNC_OPERATION_LOGS,
         MAX_VM_POOL_SIZE: !userConfig.maxVMPoolSize && env.MAX_VM_POOL_SIZE,
+        RENDERER_ENABLE_HEALTH_ENDPOINTS: !('enableHealthEndpoints' in userConfig) && env.RENDERER_ENABLE_HEALTH_ENDPOINTS,
     };
 }
 function sanitizedSettings(aConfig, defaultValue) {
@@ -248,6 +254,7 @@ function buildConfig(providedUserConfig) {
         password: env.RENDERER_PASSWORD,
         // Re-evaluate env-derived defaults at build time in case env vars are set post-import.
         replayServerAsyncOperationLogs: defaultReplayServerAsyncOperationLogs(),
+        enableHealthEndpoints: truthyHealthEndpointFlag(env.RENDERER_ENABLE_HEALTH_ENDPOINTS),
     };
     config = { ...runtimeDefaultConfig, ...userConfig };
     if (explicitUndefinedPassword) {
@@ -269,6 +276,8 @@ function buildConfig(providedUserConfig) {
             'Use RENDERER_SERVER_BUNDLE_CACHE_PATH instead.');
     }
     config.supportModules = (0, truthy_js_1.default)(config.supportModules);
+    // Coerce in case a user config passes an env-derived string (e.g. "true").
+    config.enableHealthEndpoints = truthyHealthEndpointFlag(config.enableHealthEndpoints);
     if (config.maxVMPoolSize <= 0 || !Number.isInteger(config.maxVMPoolSize)) {
         throw new Error('maxVMPoolSize must be a positive integer');
     }

package/lib/shared/rscPeerSupport.d.ts

@@ -5,8 +5,15 @@ export declare const RSC_PEER_SUPPORT: {
     };
     readonly react: {
         readonly supportedMajor: 19;
-        readonly supportedMinor: 0;
-        readonly minPatch: 4;
+        readonly supportedRanges: readonly [{
+            readonly rscMinor: 0;
+            readonly minor: 0;
+            readonly minPatch: 4;
+        }, {
+            readonly rscMinor: 2;
+            readonly minor: 2;
+            readonly minPatch: 7;
+        }];
     };
 };
 //# sourceMappingURL=rscPeerSupport.d.ts.map

package/lib/shared/rscPeerSupport.js

@@ -26,6 +26,13 @@ exports.RSC_PEER_SUPPORT = void 0;
 // (the stable 19.0.5 ship/pin is tracked by issue #3634).
 exports.RSC_PEER_SUPPORT = {
     reactOnRailsRsc: { recommendedMin: '19.0.2', supportedMajor: 19 },
-    react: { supportedMajor: 19, supportedMinor: 0, minPatch: 4 },
+    react: {
+        supportedMajor: 19,
+        supportedRanges: [
+            { rscMinor: 0, minor: 0, minPatch: 4 },
+            // React 19.2.7 is the coordinated floor for react-on-rails-rsc 19.2.x.
+            { rscMinor: 2, minor: 2, minPatch: 7 },
+        ],
+    },
 };
 //# sourceMappingURL=rscPeerSupport.js.map

package/lib/shared/utils.d.ts

@@ -3,6 +3,7 @@ import { MoveOptions, CopyOptions } from 'fs-extra';
 import { Readable, Writable, PassThrough } from 'stream';
 import type { TracingContext } from './tracing.js';
 import type { RenderResult } from '../worker/vm.js';
+import { remapStackTrace } from '../worker/vmSourceMapSupport.js';
 export declare const TRUNCATION_FILLER = "\n... TRUNCATED ...\n";
 export declare const SHUTDOWN_WORKER_MESSAGE = "NODE_RENDERER_SHUTDOWN_WORKER";
 export declare function workerIdLabel(): number | "NO WORKER ID";
@@ -10,6 +11,9 @@ export declare function smartTrim(value: unknown, maxLength?: number): string |
 export interface ResponseResult {
     headers: {
         'Cache-Control'?: string;
+        'Content-Type'?: string;
+        'X-Content-Type-Options'?: string;
+        [key: string]: string | undefined;
     };
     status: number;
     data?: unknown;
@@ -27,8 +31,10 @@ export type RequestInfo = {
  * @param request Either a rendering request (auto-labeled) or a { label, content } pair
  * @param error The error that was thrown (typed as `unknown` to minimize casts in `catch`)
  * @param context Optional context to include in the error message
+ * @param stackRemapper Defaults to scanning registered source-map bundles. VM request paths pass a
+ * registration-scoped remapper to avoid rewriting unrelated bundle paths.
  */
-export declare function formatExceptionMessage(request: RequestInfo, error: unknown, context?: string): string;
+export declare function formatExceptionMessage(request: RequestInfo, error: unknown, context?: string, stackRemapper?: typeof remapStackTrace): string;
 export declare function saveMultipartFile(multipartFile: MultipartFile, destinationPath: string): Promise<void>;
 export interface Asset {
     type: 'asset';

package/lib/shared/utils.js

@@ -74,6 +74,7 @@ const errorReporter = __importStar(require("./errorReporter.js"));
 const configBuilder_js_1 = require("./configBuilder.js");
 const log_js_1 = __importDefault(require("./log.js"));
 const fileExistsAsync_js_1 = __importDefault(require("./fileExistsAsync.js"));
+const vmSourceMapSupport_js_1 = require("../worker/vmSourceMapSupport.js");
 exports.TRUNCATION_FILLER = '\n... TRUNCATED ...\n';
 exports.SHUTDOWN_WORKER_MESSAGE = 'NODE_RENDERER_SHUTDOWN_WORKER';
 function workerIdLabel() {
@@ -121,10 +122,14 @@ function errorResponseResult(msg, tracingContext) {
  * @param request Either a rendering request (auto-labeled) or a { label, content } pair
  * @param error The error that was thrown (typed as `unknown` to minimize casts in `catch`)
  * @param context Optional context to include in the error message
+ * @param stackRemapper Defaults to scanning registered source-map bundles. VM request paths pass a
+ * registration-scoped remapper to avoid rewriting unrelated bundle paths.
  */
-function formatExceptionMessage(request, error, context) {
+function formatExceptionMessage(request, error, context, stackRemapper = vmSourceMapSupport_js_1.remapStackTrace) {
     const label = 'renderingRequest' in request ? 'JS code for rendering request was:' : request.label;
     const content = 'renderingRequest' in request ? request.renderingRequest : request.content;
+    const rawStack = error.stack;
+    const stack = stackRemapper(rawStack) ?? rawStack;
     return `${context ? `\nContext:\n${context}\n` : ''}
 ${label}
 ${smartTrim(content)}
@@ -133,7 +138,7 @@ EXCEPTION MESSAGE:
 ${error.message || error}
 
 STACK:
-${error.stack}`;
+${stack}`;
 }
 // https://github.com/fastify/fastify-multipart?tab=readme-ov-file#usage
 const pump = (0, util_1.promisify)(stream_1.pipeline);
@@ -205,13 +210,24 @@ const delay = (milliseconds) => new Promise((resolve) => {
     setTimeout(resolve, milliseconds);
 });
 exports.delay = delay;
+// Keep aligned with ReactOnRailsPro::RollingDeploy::SAFE_HASH_PATTERN.
+const BUNDLE_TIMESTAMP_PATH_COMPONENT_PATTERN = /^[A-Za-z0-9_][A-Za-z0-9._-]*$/;
+function bundleTimestampPathComponent(bundleTimestamp) {
+    const pathComponent = String(bundleTimestamp);
+    if (!BUNDLE_TIMESTAMP_PATH_COMPONENT_PATTERN.test(pathComponent)) {
+        throw new Error(`Invalid bundle timestamp path component: ${pathComponent}. ` +
+            'Expected only letters, digits, dots, underscores, and hyphens.');
+    }
+    return pathComponent;
+}
 function getBundleDirectory(bundleTimestamp) {
     const { serverBundleCachePath } = (0, configBuilder_js_1.getConfig)();
-    return path_1.default.join(serverBundleCachePath, `${bundleTimestamp}`);
+    return path_1.default.resolve(serverBundleCachePath, bundleTimestampPathComponent(bundleTimestamp));
 }
 function getRequestBundleFilePath(bundleTimestamp) {
-    const bundleDirectory = getBundleDirectory(bundleTimestamp);
-    return path_1.default.join(bundleDirectory, `${bundleTimestamp}.js`);
+    const pathComponent = bundleTimestampPathComponent(bundleTimestamp);
+    const bundleDirectory = getBundleDirectory(pathComponent);
+    return path_1.default.join(bundleDirectory, `${pathComponent}.js`);
 }
 function getAssetPath(bundleTimestamp, filename) {
     const bundleDirectory = getBundleDirectory(bundleTimestamp);

package/lib/worker/handleIncrementalRenderRequest.d.ts

@@ -1,8 +1,10 @@
 import type { ResponseResult } from '../shared/utils';
+import type { ExecutionContext } from './vm';
 export type IncrementalRenderSink = {
     /** Called for every subsequent NDJSON object after the first one */
     add: (chunk: unknown) => Promise<void>;
-    handleRequestClosed: () => void;
+    handleRequestClosed: () => Promise<void>;
+    executionContext: ExecutionContext;
 };
 export type UpdateChunk = {
     bundleTimestamp: string | number;

package/lib/worker/handleIncrementalRenderRequest.js

@@ -102,6 +102,7 @@ async function handleIncrementalRenderRequest(initial) {
         return {
             response,
             sink: {
+                executionContext,
                 add: async (chunk) => {
                     try {
                         assertIsUpdateChunk(chunk);
@@ -122,20 +123,24 @@ async function handleIncrementalRenderRequest(initial) {
                         }
                     }
                 },
-                handleRequestClosed: () => {
+                handleRequestClosed: async () => {
                     if (!onRequestClosedUpdateChunk) {
                         return;
                     }
                     const bundlePath = (0, utils_1.getRequestBundleFilePath)(onRequestClosedUpdateChunk.bundleTimestamp);
-                    executionContext
-                        .runInVM(onRequestClosedUpdateChunk.updateChunk, bundlePath)
-                        .catch((err) => {
+                    try {
+                        const result = await executionContext.runInVM(onRequestClosedUpdateChunk.updateChunk, bundlePath);
+                        if ((0, utils_1.isErrorRenderResult)(result)) {
+                            throw new Error(result.exceptionMessage);
+                        }
+                    }
+                    catch (err) {
                         log_1.default.error({
                             msg: 'Error running onRequestClosedUpdateChunk',
                             err,
                             onRequestClosedUpdateChunk,
                         });
-                    });
+                    }
                 },
             },
         };

package/lib/worker/vm.d.ts

@@ -3,9 +3,11 @@ import type { Readable } from 'stream';
 import type { ReactOnRails as ROR } from 'react-on-rails' with { 'resolution-mode': 'import' };
 import type { Context } from 'vm';
 import SharedConsoleHistory from '../shared/sharedConsoleHistory.js';
+import { type BundleSourceMapRegistration } from './vmSourceMapSupport.js';
 export interface VMContext {
     context: Context;
     sharedConsoleHistory: SharedConsoleHistory;
+    sourceMapRegistration: BundleSourceMapRegistration;
     lastUsed: number;
 }
 /**
@@ -17,6 +19,19 @@ export declare function hasVMContextForBundle(bundlePath: string): boolean;
  * Get a specific VM context by bundle path
  */
 export declare function getVMContext(bundlePath: string): VMContext | undefined;
+/**
+ * Whether this worker has at least one bundle compiled into a VM context.
+ * Used by the built-in /ready readiness endpoint: a worker with zero loaded
+ * bundles cannot serve render requests until a bundle is uploaded.
+ *
+ * This intentionally stays false while a bundle is still compiling in
+ * vmCreationPromises; /ready flips to 200 only after compilation finishes and
+ * the compiled context is stored in vmContexts.
+ *
+ * Pool eviction can remove older bundle contexts, but readiness remains true as
+ * long as at least one compiled bundle remains in the pool.
+ */
+export declare function hasAnyVMContext(): boolean;
 /**
  * The type of the result returned by executing the code payload sent in the rendering request.
  */
@@ -39,6 +54,7 @@ export declare class VMContextNotFoundError extends Error {
 export type ExecutionContext = {
     runInVM: (renderingRequest: string, bundleFilePath: string, vmCluster?: typeof cluster) => Promise<RenderResult>;
     getVMContext: (bundleFilePath: string) => VMContext | undefined;
+    release: () => void;
 };
 /**
  * Builds an ExecutionContext that manages VM execution for a set of bundles.

package/lib/worker/vm.js

@@ -53,6 +53,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.VMContextNotFoundError = void 0;
 exports.hasVMContextForBundle = hasVMContextForBundle;
 exports.getVMContext = getVMContext;
+exports.hasAnyVMContext = hasAnyVMContext;
 exports.buildExecutionContext = buildExecutionContext;
 exports.resetVM = resetVM;
 exports.removeVM = removeVM;
@@ -72,12 +73,55 @@ const log_js_1 = __importDefault(require("../shared/log.js"));
 const configBuilder_js_1 = require("../shared/configBuilder.js");
 const utils_js_1 = require("../shared/utils.js");
 const errorReporter = __importStar(require("../shared/errorReporter.js"));
+const vmSourceMapSupport_js_1 = require("./vmSourceMapSupport.js");
 const readFileAsync = (0, util_1.promisify)(fs_1.default.readFile);
+// Length of the `Module.wrap` prefix that is prepended to the first line of a
+// wrapped bundle. Needed to correct first-line stack-frame columns before
+// source map lookups.
+const MODULE_WRAP_FIRST_LINE_PREFIX_LENGTH = module_1.default.wrap('\n').indexOf('\n');
 const writeFileAsync = (0, util_1.promisify)(fs_1.default.writeFile);
 // Store contexts by their bundle file paths
 const vmContexts = new Map();
 // Track VM creation promises to handle concurrent buildVM requests
 const vmCreationPromises = new Map();
+// Execution contexts can outlive VM pool entries while a request is still
+// running. Keep source maps for those evicted contexts until the request
+// releases them, then drop both the registration and parsed-map cache.
+const activeSourceMapRequestCounts = new Map();
+const evictedSourceMapRegistrations = new Set();
+function retainSourceMapRegistration(sourceMapRegistration) {
+    activeSourceMapRequestCounts.set(sourceMapRegistration, (activeSourceMapRequestCounts.get(sourceMapRegistration) ?? 0) + 1);
+}
+function releaseSourceMapRegistration(sourceMapRegistration) {
+    const currentCount = activeSourceMapRequestCounts.get(sourceMapRegistration) ?? 0;
+    if (currentCount <= 1) {
+        activeSourceMapRequestCounts.delete(sourceMapRegistration);
+        const wasEvicted = evictedSourceMapRegistrations.delete(sourceMapRegistration);
+        // Eviction deletes the VM first today; keep the guard so future callers do
+        // not unregister a source map for a live pooled VM.
+        let isStillInPool = false;
+        for (const vmContext of vmContexts.values()) {
+            if (vmContext.sourceMapRegistration === sourceMapRegistration) {
+                isStillInPool = true;
+                break;
+            }
+        }
+        if (wasEvicted && !isStillInPool) {
+            (0, vmSourceMapSupport_js_1.unregisterBundleForSourceMaps)(sourceMapRegistration);
+        }
+        return;
+    }
+    activeSourceMapRequestCounts.set(sourceMapRegistration, currentCount - 1);
+}
+function retireSourceMapRegistrationAfterEviction(sourceMapRegistration) {
+    (0, vmSourceMapSupport_js_1.retireMissingSourceMapRetry)(sourceMapRegistration);
+    if ((activeSourceMapRequestCounts.get(sourceMapRegistration) ?? 0) > 0) {
+        evictedSourceMapRegistrations.add(sourceMapRegistration);
+    }
+    else {
+        (0, vmSourceMapSupport_js_1.unregisterBundleForSourceMaps)(sourceMapRegistration);
+    }
+}
 /**
  * Returns all bundle paths that have a VM context
  * @internal Used in tests
@@ -91,12 +135,35 @@ function hasVMContextForBundle(bundlePath) {
 function getVMContext(bundlePath) {
     return vmContexts.get(bundlePath);
 }
+/**
+ * Whether this worker has at least one bundle compiled into a VM context.
+ * Used by the built-in /ready readiness endpoint: a worker with zero loaded
+ * bundles cannot serve render requests until a bundle is uploaded.
+ *
+ * This intentionally stays false while a bundle is still compiling in
+ * vmCreationPromises; /ready flips to 200 only after compilation finishes and
+ * the compiled context is stored in vmContexts.
+ *
+ * Pool eviction can remove older bundle contexts, but readiness remains true as
+ * long as at least one compiled bundle remains in the pool.
+ */
+function hasAnyVMContext() {
+    return vmContexts.size > 0;
+}
 const extendContext = (contextObject, additionalContext) => {
     if (log_js_1.default.level === 'debug') {
         log_js_1.default.debug(`Adding ${Object.keys(additionalContext).join(', ')} to context object.`);
     }
     Object.assign(contextObject, additionalContext);
 };
+const readPrepareStackTraceHook = (context) => {
+    try {
+        return vm_1.default.runInContext('typeof Error === "undefined" ? undefined : Error.prepareStackTrace', context);
+    }
+    catch {
+        return undefined;
+    }
+};
 // Helper function to manage VM pool size
 function manageVMPoolSize() {
     const { maxVMPoolSize } = (0, configBuilder_js_1.getConfig)();
@@ -105,9 +172,11 @@ function manageVMPoolSize() {
     }
     const sortedEntries = Array.from(vmContexts.entries()).sort(([, a], [, b]) => a.lastUsed - b.lastUsed);
     while (sortedEntries.length > maxVMPoolSize) {
-        const oldestPath = sortedEntries.shift()?.[0];
-        if (oldestPath) {
+        const oldestEntry = sortedEntries.shift();
+        if (oldestEntry) {
+            const [oldestPath, oldestContext] = oldestEntry;
             vmContexts.delete(oldestPath);
+            retireSourceMapRegistrationAfterEviction(oldestContext.sourceMapRegistration);
             log_js_1.default.debug(`Removed VM for bundle ${oldestPath} due to pool size limit (max: ${maxVMPoolSize})`);
         }
     }
@@ -139,12 +208,29 @@ async function buildVM(filePath) {
     // than a try/finally inside the IIFE, because an IIFE's finally block can
     // execute synchronously (before `vmCreationPromises.set`) when the code throws
     // before the first `await`, which would leave a stale rejected promise in the map.
+    let sourceMapRegistration;
     const vmCreationPromise = (async () => {
         try {
             const { supportModules, stubTimers, additionalContext } = (0, configBuilder_js_1.getConfig)();
             const additionalContextIsObject = additionalContext !== null && additionalContext.constructor === Object;
             const sharedConsoleHistory = new sharedConsoleHistory_js_1.default();
-            const contextObject = { sharedConsoleHistory };
+            // Request-derived bundle paths are built from validated timestamp path components.
+            // Direct `buildExecutionContext` callers pass trusted internal bundle paths.
+            // codeql[js/path-injection]
+            const bundleContents = await readFileAsync(filePath, 'utf8');
+            const firstLineColumnOffset = additionalContextIsObject || supportModules ? MODULE_WRAP_FIRST_LINE_PREFIX_LENGTH : 0;
+            const preloadedSourceMap = await (0, vmSourceMapSupport_js_1.preloadSourceMapJsonForBundle)(filePath, bundleContents);
+            const currentSourceMapRegistration = (0, vmSourceMapSupport_js_1.registerBundleForSourceMaps)(filePath, firstLineColumnOffset, bundleContents, preloadedSourceMap.sourceMapJson, preloadedSourceMap.retryMissingSourceMap);
+            sourceMapRegistration = currentSourceMapRegistration;
+            // Host callback used by the in-VM `Error.prepareStackTrace` hook (see
+            // vmSourceMapSupport.ts) to remap bundle stack frames to original
+            // TS/JS sources. Only resolves positions for registered bundle paths.
+            const contextObject = {
+                sharedConsoleHistory,
+                [vmSourceMapSupport_js_1.SOURCE_MAP_LOOKUP_ATTEMPT_CONTEXT_KEY]: vmSourceMapSupport_js_1.createSourceMapLookupAttempt,
+                [vmSourceMapSupport_js_1.SOURCE_MAP_RESOLVER_CONTEXT_KEY]: (fileName, lineNumber, columnNumber, lookupAttempt) => (0, vmSourceMapSupport_js_1.resolveOriginalPositionForRegistration)(currentSourceMapRegistration, fileName, lineNumber, columnNumber, lookupAttempt),
+                [vmSourceMapSupport_js_1.SOURCE_MAP_STACK_REMAPPER_CONTEXT_KEY]: (stack) => (0, vmSourceMapSupport_js_1.remapStackTrace)(stack, currentSourceMapRegistration),
+            };
             if (supportModules) {
                 // IMPORTANT: When adding anything to this object, update:
                 // 1. docs/oss/building-features/node-renderer/js-configuration.md
@@ -217,20 +303,29 @@ async function buildVM(filePath) {
                 vm_1.default.runInContext(`function clearImmediate() {}`, context);
                 vm_1.default.runInContext(`function queueMicrotask() {}`, context);
             }
-            // Run bundle code in created context:
-            const bundleContents = await readFileAsync(filePath, 'utf8');
+            // Install lazy source-mapped stack traces for errors created inside the
+            // VM. Must run before the bundle is evaluated so the bundle's own error
+            // handling (e.g. react-on-rails `handleError`) sees remapped stacks.
+            vm_1.default.runInContext(vmSourceMapSupport_js_1.PREPARE_STACK_TRACE_INSTALL_SCRIPT, context);
+            const installedPrepareStackTrace = readPrepareStackTraceHook(context);
             // If node-specific code is provided then it must be wrapped into a module wrapper. The bundle
             // may need the `require` function, which is not available when running in vm unless passed in.
+            // Pass `filename` so stack frames point at the real bundle path (instead of
+            // `evalmachine.<anonymous>`), which also keys lazy source map resolution.
             if (additionalContextIsObject || supportModules) {
-                vm_1.default.runInContext(module_1.default.wrap(bundleContents), context)(exports, require, module, filePath, path_1.default.dirname(filePath));
+                vm_1.default.runInContext(module_1.default.wrap(bundleContents), context, { filename: filePath })(exports, require, module, filePath, path_1.default.dirname(filePath));
             }
             else {
-                vm_1.default.runInContext(bundleContents, context);
+                vm_1.default.runInContext(bundleContents, context, { filename: filePath });
+            }
+            if (readPrepareStackTraceHook(context) !== installedPrepareStackTrace) {
+                log_js_1.default.warn('Bundle replaced Error.prepareStackTrace; source-mapped stack traces are disabled for bundle %s', filePath);
             }
             // Only now, after VM is fully initialized, store the context
             const newVmContext = {
                 context,
                 sharedConsoleHistory,
+                sourceMapRegistration: currentSourceMapRegistration,
                 lastUsed: Date.now(),
             };
             vmContexts.set(filePath, newVmContext);
@@ -247,8 +342,18 @@ async function buildVM(filePath) {
             return newVmContext;
         }
         catch (error) {
+            // Materialize/remap the stack before reporting so failed bundle builds
+            // still include original source locations, then retire the registration:
+            // failed builds never enter the VM pool and cannot be reused.
+            (0, vmSourceMapSupport_js_1.remapErrorStack)(error, sourceMapRegistration);
             log_js_1.default.error({ error }, 'Caught Error when creating context in buildVM');
             errorReporter.error(error);
+            if (sourceMapRegistration) {
+                (0, vmSourceMapSupport_js_1.unregisterBundleForSourceMaps)(sourceMapRegistration);
+            }
+            else {
+                (0, vmSourceMapSupport_js_1.unregisterBundleForSourceMaps)(filePath);
+            }
             throw error;
         }
     })();
@@ -305,23 +410,53 @@ async function getOrBuildVMContext(bundleFilePath, buildVmsIfNeeded) {
  * @see handleIncrementalRenderRequest.ts for how update chunks access the same context
  */
 async function buildExecutionContext(bundlePaths, buildVmsIfNeeded) {
+    const retainedSourceMapRegistrations = new Set();
+    const retainSourceMapRegistrationOnce = (sourceMapRegistration) => {
+        if (retainedSourceMapRegistrations.has(sourceMapRegistration)) {
+            return;
+        }
+        retainSourceMapRegistration(sourceMapRegistration);
+        retainedSourceMapRegistrations.add(sourceMapRegistration);
+    };
     const mapBundleFilePathToVMContext = new Map();
-    await Promise.all(bundlePaths.map(async (bundleFilePath) => {
-        const vmContext = await getOrBuildVMContext(bundleFilePath, buildVmsIfNeeded);
-        vmContext.lastUsed = Date.now();
-        mapBundleFilePathToVMContext.set(bundleFilePath, vmContext);
+    let buildRejected = false;
+    let firstBuildRejection;
+    // Wait for every parallel build callback before releasing retained source-map
+    // registrations; otherwise a sibling build can retain after an early rejection.
+    await Promise.allSettled(bundlePaths.map(async (bundleFilePath) => {
+        try {
+            const vmContext = await getOrBuildVMContext(bundleFilePath, buildVmsIfNeeded);
+            retainSourceMapRegistrationOnce(vmContext.sourceMapRegistration);
+            vmContext.lastUsed = Date.now();
+            mapBundleFilePathToVMContext.set(bundleFilePath, vmContext);
+        }
+        catch (error) {
+            if (!buildRejected) {
+                buildRejected = true;
+                firstBuildRejection = error;
+            }
+            throw error;
+        }
     }));
+    if (buildRejected) {
+        retainedSourceMapRegistrations.forEach(releaseSourceMapRegistration);
+        throw firstBuildRejection;
+    }
     // This Map persists for the lifetime of this ExecutionContext (one HTTP request).
     // It allows data to be shared between the initial render and subsequent update chunks.
     // Example: asyncPropsManager is stored here during initial render and accessed by update chunks.
     const sharedExecutionContext = new Map();
+    let released = false;
     const runInVM = async (renderingRequest, bundleFilePath, vmCluster) => {
+        let sourceMapRegistrationForRequest;
         try {
             const { serverBundleCachePath } = (0, configBuilder_js_1.getConfig)();
             const vmContext = mapBundleFilePathToVMContext.get(bundleFilePath);
             if (!vmContext) {
                 throw new VMContextNotFoundError(bundleFilePath);
             }
+            sourceMapRegistrationForRequest = vmContext.sourceMapRegistration;
+            const remapStackTraceForRequest = (stack) => (0, vmSourceMapSupport_js_1.remapStackTrace)(stack, vmContext.sourceMapRegistration);
             // Update last used timestamp
             vmContext.lastUsed = Date.now();
             const { context, sharedConsoleHistory } = vmContext;
@@ -361,7 +496,7 @@ async function buildExecutionContext(bundlePaths, buildVmsIfNeeded) {
             });
             if ((0, utils_js_1.isReadableStream)(result)) {
                 const newStreamAfterHandlingError = (0, utils_js_1.handleStreamError)(result, (error) => {
-                    const msg = (0, utils_js_1.formatExceptionMessage)({ renderingRequest }, error, 'Error in a rendering stream');
+                    const msg = (0, utils_js_1.formatExceptionMessage)({ renderingRequest }, error, 'Error in a rendering stream', remapStackTraceForRequest);
                     errorReporter.message(msg);
                 });
                 return newStreamAfterHandlingError;
@@ -382,7 +517,9 @@ async function buildExecutionContext(bundlePaths, buildVmsIfNeeded) {
             return result;
         }
         catch (exception) {
-            const exceptionMessage = (0, utils_js_1.formatExceptionMessage)({ renderingRequest }, exception);
+            const exceptionMessage = (0, utils_js_1.formatExceptionMessage)({ renderingRequest }, exception, undefined, sourceMapRegistrationForRequest
+                ? (stack) => (0, vmSourceMapSupport_js_1.remapStackTrace)(stack, sourceMapRegistrationForRequest)
+                : (_stack) => undefined);
             log_js_1.default.debug('Caught exception in rendering request: %s', exceptionMessage);
             return Promise.resolve({ exceptionMessage });
         }
@@ -390,19 +527,36 @@ async function buildExecutionContext(bundlePaths, buildVmsIfNeeded) {
     return {
         getVMContext: (bundleFilePath) => mapBundleFilePathToVMContext.get(bundleFilePath),
         runInVM,
+        release: () => {
+            if (released) {
+                return;
+            }
+            released = true;
+            retainedSourceMapRegistrations.forEach(releaseSourceMapRegistration);
+        },
     };
 }
 /** @internal Used in tests */
 function resetVM() {
     vmContexts.clear();
     vmCreationPromises.clear();
+    activeSourceMapRequestCounts.clear();
+    evictedSourceMapRegistrations.clear();
+    (0, vmSourceMapSupport_js_1.resetSourceMapSupport)();
 }
 // Optional: Add a method to remove a specific VM if needed
 /**
  * @public TODO: Remove the line below when this function is actually used
  */
 function removeVM(bundlePath) {
+    const vmContext = vmContexts.get(bundlePath);
     vmContexts.delete(bundlePath);
     vmCreationPromises.delete(bundlePath);
+    if (vmContext) {
+        retireSourceMapRegistrationAfterEviction(vmContext.sourceMapRegistration);
+    }
+    else {
+        (0, vmSourceMapSupport_js_1.unregisterBundleForSourceMaps)(bundlePath);
+    }
 }
 //# sourceMappingURL=vm.js.map