esm.run causing duplicate code to run due to bundling

[e111077]

Description

When attempting to import two modules from the same package, in the case where module A imports module C and B imports C, if the user were to import both A & B:

import 'https://esm.run/<package>/A.js';
import 'https://esm.run/<package>/B.js';

they would both import and run any side effects in Package C.

Affected jsDelivr links

https://esm.run/@material/web/button/filled-button.js
https://esm.run/@material/web/button/outlined-button.js

both run customElements.define('md-ripple') which causes a custom element registry breakage

(repro link: https://lit.dev/playground/#gist=59778e3d268c095c623299971752425c)

Response headers

filled-button

Request URL:
https://cdn.jsdelivr.net/npm/@material/web/button/filled-button.js/+esm
Request Method:
GET
Status Code:
200
Remote Address:
151.101.1.229:443
Referrer Policy:
strict-origin-when-cross-origin
Accept-Ranges:
bytes
Access-Control-Allow-Origin:
*
Access-Control-Expose-Headers:
*
Age:
1269
Alt-Svc:
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
Cache-Control:
public, max-age=604800, s-maxage=43200
Content-Encoding:
br
Content-Length:
7180
Content-Type:
application/javascript; charset=utf-8
Cross-Origin-Resource-Policy:
cross-origin
Date:
Fri, 08 Sep 2023 23:12:27 GMT
Etag:
W/"6863-x81hs/tlNsu0MZYwM/BM1eNDqbE"
Link:
</npm/tslib@2.6.2/+esm>; rel="modulepreload"; nopush, </npm/lit@2.8.0/decorators.js/+esm>; rel="modulepreload"; nopush, </npm/lit@2.8.0/+esm>; rel="modulepreload"; nopush, </npm/lit@2.8.0/directives/class-map.js/+esm>; rel="modulepreload"; nopush, </npm/lit@2.8.0/static-html.js/+esm>; rel="modulepreload"; nopush
Strict-Transport-Security:
max-age=31536000; includeSubDomains; preload
Timing-Allow-Origin:
*
Vary:
Accept-Encoding
X-Cache:
MISS, HIT
X-Content-Type-Options:
nosniff
X-Jsd-Version:
1.0.0-pre.17
X-Jsd-Version-Type:
version
X-Served-By:
cache-fra-eddf8230027-FRA, cache-sjc1000141-SJC
:authority:
cdn.jsdelivr.net
:method:
GET
:path:
/npm/@material/web/button/filled-button.js/+esm
:scheme:
https
Accept:
*/*
Accept-Encoding:
gzip, deflate, br
Accept-Language:
en-US,en;q=0.9
Cache-Control:
no-cache
Origin:
null
Pragma:
no-cache
Referer:
https://playground.lit.dev/
Sec-Ch-Ua:
"Chromium";v="116", "Not)A;Brand";v="24", "Google Chrome";v="116"
Sec-Ch-Ua-Mobile:
?0
Sec-Ch-Ua-Platform:
"macOS"
Sec-Fetch-Dest:
script
Sec-Fetch-Mode:
cors
Sec-Fetch-Site:
cross-site
User-Agent:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36

outlined-button

Request URL:
https://cdn.jsdelivr.net/npm/@material/web/button/outlined-button.js/+esm
Request Method:
GET
Status Code:
200
Remote Address:
151.101.1.229:443
Referrer Policy:
strict-origin-when-cross-origin
Accept-Ranges:
bytes
Access-Control-Allow-Origin:
*
Access-Control-Expose-Headers:
*
Age:
1155
Alt-Svc:
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
Cache-Control:
public, max-age=604800, s-maxage=43200
Content-Encoding:
br
Content-Length:
6947
Content-Type:
application/javascript; charset=utf-8
Cross-Origin-Resource-Policy:
cross-origin
Date:
Fri, 08 Sep 2023 23:12:27 GMT
Etag:
W/"62cf-j9FMXQ6tyD3iMZqMhYbUo257NjM"
Link:
</npm/tslib@2.6.2/+esm>; rel="modulepreload"; nopush, </npm/lit@2.8.0/decorators.js/+esm>; rel="modulepreload"; nopush, </npm/lit@2.8.0/+esm>; rel="modulepreload"; nopush, </npm/lit@2.8.0/directives/class-map.js/+esm>; rel="modulepreload"; nopush, </npm/lit@2.8.0/static-html.js/+esm>; rel="modulepreload"; nopush
Strict-Transport-Security:
max-age=31536000; includeSubDomains; preload
Timing-Allow-Origin:
*
Vary:
Accept-Encoding
X-Cache:
MISS, HIT
X-Content-Type-Options:
nosniff
X-Jsd-Version:
1.0.0-pre.17
X-Jsd-Version-Type:
version
X-Served-By:
cache-fra-eddf8230043-FRA, cache-sjc1000141-SJC
:authority:
cdn.jsdelivr.net
:method:
GET
:path:
/npm/@material/web/button/outlined-button.js/+esm
:scheme:
https
Accept:
*/*
Accept-Encoding:
gzip, deflate, br
Accept-Language:
en-US,en;q=0.9
Cache-Control:
no-cache
Origin:
null
Pragma:
no-cache
Referer:
https://playground.lit.dev/
Sec-Ch-Ua:
"Chromium";v="116", "Not)A;Brand";v="24", "Google Chrome";v="116"
Sec-Ch-Ua-Mobile:
?0
Sec-Ch-Ua-Platform:
"macOS"
Sec-Fetch-Dest:
script
Sec-Fetch-Mode:
cors
Sec-Fetch-Site:
cross-site
User-Agent:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36

Information

• Device OS: Mac
• Browser & Version: Chrome 116
• VPN provider (if you use one): none
• Your location (country/region): US California

Requisites

• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• I checked the documentation to understand that the issue I am reporting is not normal behavior.
• I understand that not filling out this template correctly will lead to the issue being closed.

Additional content

Perhaps if a package has package provides package.json exports bundling can be split by those entrypoints or maybe a flag to turn off bunding?