fix(anywidget): preserve virtual ESM URLs

[Light2Dark]

📝 Summary

Anywidget _esm values may already be importable URLs, including marimo virtual files produced by mo_data.js. EsmSpec.from_esm() previously sent those virtual-file URLs back through JavaScript virtualization, creating a second file whose contents were only the first URL. Importing that file failed with Unexpected token '.'.

Preserve supported virtual-file, HTTP(S), and JavaScript data URLs when minting an EsmSpec. Inline JavaScript still becomes a virtual file, including source that begins with a URL-like JavaScript label. URL recognition mirrors the frontend's trusted virtual-file shape so malformed paths are not passed through.

📋 Pre-Review Checklist

• For large changes, or changes that affect the public API: this change was discussed or approved through an issue, on Discord, or the community discussions (not applicable: focused bug fix with no public API change).
• Any AI generated code has been reviewed line-by-line by the human PR author, who stands by it.
• Video or media evidence is provided for any visual changes (not applicable: backend URL handling only).

✅ Merge Checklist

• I have read the contributor guidelines.
• Documentation has been updated where applicable, including docstrings for API changes (not applicable: no public API change).
• Tests have been added for the changes made.

Written by GPT-5.6 on Codex

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
marimo-docs	Ready	Preview	Aug 28, 2026 12:33pm

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[cubic-dev-ai]

All reported issues were addressed across 2 files

_{You’re at about 99% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>