fix(plugins): hoist id/version regexes into defineNativePlugin to avoid TDZ on Workers (#1370) (#1542)

* fix(plugins): hoist id/version regexes into defineNativePlugin to avoid TDZ on Workers

Module-scope regex consts (SIMPLE_ID/SCOPED_ID/SEMVER_PATTERN) could be read before initialization during the worker's circular module init under ssr.noExternal, throwing "Cannot access 'SIMPLE_ID' before initialization" and 500-ing every route on Cloudflare Workers. Moving them function-local makes them evaluate at call time, eliminating the temporal dead zone regardless of bundle ordering.

Closes #1370

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Update .changeset/fix-define-plugin-tdz.md

Co-authored-by: emdashbot[bot] <273199577+emdashbot[bot]@users.noreply.github.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Matt Kane <m@mk.gg>
Co-authored-by: emdashbot[bot] <273199577+emdashbot[bot]@users.noreply.github.com>

Author: 4 people

.changeset/fix-define-plugin-tdz.md

@@ -0,0 +1,5 @@
+---
+"emdash": patch
+---
+
+Fixes a crash that returned HTTP 500 on every route on Cloudflare Workers when native plugins are registered with `definePlugin` (`Cannot access 'SIMPLE_ID' before initialization`). Plugin registration is now safe regardless of bundle ordering.

packages/core/src/plugins/define-plugin.ts

@@ -22,11 +22,6 @@ import type {
 	PluginStorageConfig,
 } from "./types.js";
 
-// Plugin ID validation patterns
-const SIMPLE_ID = /^[a-z0-9-]+$/;
-const SCOPED_ID = /^@[a-z0-9-]+\/[a-z0-9-]+$/;
-const SEMVER_PATTERN = /^\d+\.\d+\.\d+/;
-
 /**
  * Define a native EmDash plugin.
  *
@@ -94,6 +89,20 @@ export function definePlugin<TStorage extends PluginStorageConfig>(
 function defineNativePlugin<TStorage extends PluginStorageConfig>(
 	definition: PluginDefinition<TStorage>,
 ): ResolvedPlugin<TStorage> {
+	// Declared function-local (not module scope) on purpose. Under
+	// `ssr.noExternal` the worker entry can instantiate native plugins during a
+	// circular module init, reaching this function before module-scope consts
+	// initialize -> "Cannot access 'SIMPLE_ID' before initialization" -> every
+	// route 500s on Cloudflare Workers. Call-time consts evaluate after the
+	// literals are parsed, so the temporal dead zone cannot occur regardless of
+	// bundle ordering. See #1370.
+	// oxlint-disable-next-line e18e/prefer-static-regex -- call-time on purpose (see #1370)
+	const SIMPLE_ID = /^[a-z0-9-]+$/;
+	// oxlint-disable-next-line e18e/prefer-static-regex -- call-time on purpose (see #1370)
+	const SCOPED_ID = /^@[a-z0-9-]+\/[a-z0-9-]+$/;
+	// oxlint-disable-next-line e18e/prefer-static-regex -- call-time on purpose (see #1370)
+	const SEMVER_PATTERN = /^\d+\.\d+\.\d+/;
+
 	const {
 		id,
 		version,

packages/core/tests/unit/plugins/define-plugin.test.ts

@@ -161,6 +161,24 @@ describe("definePlugin", () => {
 		});
 	});
 
+	// Regression: #1370 — the id/version validation patterns must stay
+	// function-local (evaluated at call time). As module-scope consts, a
+	// circular module init on Cloudflare Workers could reach defineNativePlugin
+	// before they initialized, throwing "Cannot access 'SIMPLE_ID' before
+	// initialization" and 500-ing every route. Validation must keep working.
+	describe("#1370 — call-time validation regexes", () => {
+		it("validates id and version on every call", () => {
+			expect(definePlugin({ id: "first", version: "1.0.0" }).id).toBe("first");
+			expect(definePlugin({ id: "@scope/second", version: "2.3.4" }).version).toBe("2.3.4");
+			expect(() => definePlugin({ id: "Bad_Id", version: "1.0.0" })).toThrow(
+				INVALID_PLUGIN_ID_PATTERN,
+			);
+			expect(() => definePlugin({ id: "ok", version: "nope" })).toThrow(
+				INVALID_PLUGIN_VERSION_PATTERN,
+			);
+		});
+	});
+
 	describe("capability validation", () => {
 		it("accepts valid capabilities", () => {
 			const plugin = definePlugin({