[PR #2018] feat(javascript): resolve package exports and imports wildcard patterns #4969

New issue

Open

opened 2026-10-31 00:57:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:57:31 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2018
Author: @AWUQAQ
Created: 10/12/2026
Status: 🔄 Open

Base: main ← Head: feat/javascript-package-pattern-keys

📝 Commits (10+)

1cd1532 feat(javascript): resolve package exports and imports wildcard patterns
98b4dd0 fix(javascript): validate pattern captures like Node across both maps
0a35320 fix(javascript): split capture segments on both separators and keep target class
e20f503 fix(javascript): require hash-prefixed imports pattern keys and add acceptance coverage
61234cc fix(javascript): follow imports pattern keys without the hash prefix
fe0f005 chore(ci): merge current main verification fixes
d44d46b fix(process): report no remaining time after a provider deadline fires
8ea9dc7 fix(javascript): preserve selected package pattern URL ownership
1541e60 fix(javascript): confine expanded package targets to their owner
3669b33 chore: merge pinned main and preserve deadline regression coverage

📊 Changes

13 files changed (+2100 additions, -179 deletions)

View changed files

📝 docs/javascript-artifact-reconstruction.md (+21 -6)
📝 src/application/javascript/JavaScriptArtifactPathResolution.syntheticRootEscape.test.ts (+32 -0)
📝 src/application/javascript/JavaScriptArtifactPathResolution.test.ts (+1167 -24)
📝 src/application/javascript/JavaScriptArtifactPathResolution.ts (+301 -113)
📝 src/domain/javascript/javascriptPackageImportAliases.test.ts (+33 -10)
📝 src/domain/javascript/javascriptPackageImportAliases.ts (+36 -20)
➕ src/domain/javascript/javascriptPackagePatternKeys.test.ts (+63 -0)
📝 src/domain/javascript/javascriptPackageSubpathPatterns.test.ts (+4 -1)
📝 src/domain/javascript/javascriptPackageSubpathPatterns.ts (+15 -4)
📝 tests/acceptance/applications/javascriptPackageExportPatternOwners.test.ts (+1 -1)
➕ tests/acceptance/applications/packageImportPatternKeysCli.test.ts (+196 -0)
📝 tests/boundary/filesystem/javascript-applications/javascriptModuleRelationships.test.ts (+161 -0)
📝 tests/boundary/filesystem/javascript-applications/javascriptModuleSpecifierPaths.test.ts (+70 -0)

📄 Description

Summary

Fixes #2017. Resolve single-* pattern keys in package exports and imports maps during static JavaScript artifact analysis. Exact keys take precedence; patterns use Node's prefix/suffix ordering and capture at least one character. Literal stars and dollar sequences remain literal text.

The target owner validates declarations and captures separately, expands the selected normalized URL, and retains declared/expanded evidence. Selected targets keep exact-file and directory-form semantics, reject surviving encoded separators, and remain confined to the retained artifact/container. File finalization does not retry array entries. Recursive aliases and external-package imports targets retain explicit unresolved outcomes.

Main integration

Merged main 92213a915 in 25e9d1570b5248e1d084f7ee6c286fda5566d8c3. Resolved the three overlapping resolver, resolver-test, and imports-lookup files while retaining main's JSON-document owner, raw ESM classification, Windows host-path uncertainty, permission/ownership facts, and source provenance.

Extend main's shared javascriptPackageSubpathPatterns owner to return the selected capture. Both maps consume it; the superseded parallel matcher is removed.
Unmatched imports keys are deterministic misses even when unrelated patterns exist. Unsupported recursive/external-package targets remain unavailable where lookup could affect dependency ownership.
Preserve URL above-root markers before normalization for legacy subpaths and expanded targets. Add exports/imports regressions for leaving and re-entering the synthetic URL namespace.
Retain the previous directory-form and opaque-base repairs. Opaque identities are checked after expansion and cannot collide with target/capture text.
Update prior unsupported-pattern assertions to verify resolved files through the current source and CLI/MCP ownership contracts. Adapt direct resolver tests to main's shared JSON-document boundary.

Verification

Executed on Windows x64 with locked dependencies. Initial build/CLI/MCP runs used the Node distribution's npm 11.19.1; a final locked reinstall and check:fast also pass with repository-pinned npm 11.16.0.

Node 22.23.4, 24.22.1, 26.12.1: 410 source tests pass per version across the resolver, synthetic-root, pattern, and import-alias suites.
Focused production graph and CLI/stdio MCP ownership checks: 25 passed, 2 existing Windows skips. Includes 15 module-relationship tests and 10 public CLI/MCP tests.
The native-Node/production-graph URL finalization regression also passes on Node 22 and 26.
Encoded exports URL rejection/decoded-file identity boundary checks: 18 passed.
Typecheck, formatting, lint/module boundaries, architecture guards, production-reachability analysis, typed lint, docs:check, and diff whitespace checks pass. Lint and typed lint report zero errors with advisory warnings.
npm run check stops at ordinary Knip: unused staticFileUrlPath and unused type ObjcClassImportBindingCoverage. Both identical findings reproduce on unmodified main 92213a915; neither file is changed by this PR. Remaining static gates were executed separately. These unrelated findings were not suppressed or included as feature fixes.

Validation used an LF worktree and the matching published Windows native artifact. Lone-surrogate regressions use retained logical inventory identities, not native-loader execution on malformed filesystem names. The full CI result is recorded below; older successful checks on d82a1a62f do not validate this merge.

CI follow-up

CI run 40441742823 tested synthetic merge e8dc9fb31 against main 620784381. Mergeability and Author readiness pass; the remaining red jobs are test failures.

A separate checkout of that exact unmodified main was built and compared with the PR head on Windows/Node 24.22.1 using the same locked dependencies:

Apple application/provider-binding source suites: both revisions give 35 passed and the same 9 failures (inventory-root/bundle identity validation).
Electron application/empty-literal suites: both give 33 passed and the same 2 failures (IPC pairing counts and bridge path identities).
Exact CLI dossier and Java bitness checks: the same 3 failures reproduce on both revisions.
The native Info.plist case also fails on unmodified main, as in CI; it passes locally on the older PR head.

Thus 15 of the 17 failures in the combined Portable report reproduce on unmodified CI main. The other two are Linux-only extraction/close tests that explicitly skip Windows; no local execution or definitive attribution is claimed for those two. The Portable report aggregates existing source/shard failures, rather than introducing seventeen additional failures. No unrelated assertions or production code were weakened or changed, and no blind CI rerun was requested.

Author readiness

Human owner: @AWUQAQ

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2018 **Author:** [@AWUQAQ](https://github.com/AWUQAQ) **Created:** 10/12/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feat/javascript-package-pattern-keys` --- ### 📝 Commits (10+) - [`1cd1532`](https://github.com/morluto/rea/commit/1cd15328b5ea07c3456d17e3b4bae5e42988d141) feat(javascript): resolve package exports and imports wildcard patterns - [`98b4dd0`](https://github.com/morluto/rea/commit/98b4dd029f381543a2a6f86005225726d7ab2c21) fix(javascript): validate pattern captures like Node across both maps - [`0a35320`](https://github.com/morluto/rea/commit/0a353200848209ae0e686459eef3a3ae42d9b5bd) fix(javascript): split capture segments on both separators and keep target class - [`e20f503`](https://github.com/morluto/rea/commit/e20f503dd5a11e076668c127cf4ab128c3e50506) fix(javascript): require hash-prefixed imports pattern keys and add acceptance coverage - [`61234cc`](https://github.com/morluto/rea/commit/61234ccb2db82f42d3fd010f5a85a654d47fb914) fix(javascript): follow imports pattern keys without the hash prefix - [`fe0f005`](https://github.com/morluto/rea/commit/fe0f0055bef392e392142adc1733d80c4e417281) chore(ci): merge current main verification fixes - [`d44d46b`](https://github.com/morluto/rea/commit/d44d46b76ac24b9d3913cc470520a5aeee193d8e) fix(process): report no remaining time after a provider deadline fires - [`8ea9dc7`](https://github.com/morluto/rea/commit/8ea9dc78dd0b7a698c0fe7c68b4b097e452d1a91) fix(javascript): preserve selected package pattern URL ownership - [`1541e60`](https://github.com/morluto/rea/commit/1541e60271dfb1f752a659300f0021889fe1264c) fix(javascript): confine expanded package targets to their owner - [`3669b33`](https://github.com/morluto/rea/commit/3669b337b4d1dca767cc80abdbf817fd836f24d4) chore: merge pinned main and preserve deadline regression coverage ### 📊 Changes **13 files changed** (+2100 additions, -179 deletions) <details> <summary>View changed files</summary> 📝 `docs/javascript-artifact-reconstruction.md` (+21 -6) 📝 `src/application/javascript/JavaScriptArtifactPathResolution.syntheticRootEscape.test.ts` (+32 -0) 📝 `src/application/javascript/JavaScriptArtifactPathResolution.test.ts` (+1167 -24) 📝 `src/application/javascript/JavaScriptArtifactPathResolution.ts` (+301 -113) 📝 `src/domain/javascript/javascriptPackageImportAliases.test.ts` (+33 -10) 📝 `src/domain/javascript/javascriptPackageImportAliases.ts` (+36 -20) ➕ `src/domain/javascript/javascriptPackagePatternKeys.test.ts` (+63 -0) 📝 `src/domain/javascript/javascriptPackageSubpathPatterns.test.ts` (+4 -1) 📝 `src/domain/javascript/javascriptPackageSubpathPatterns.ts` (+15 -4) 📝 `tests/acceptance/applications/javascriptPackageExportPatternOwners.test.ts` (+1 -1) ➕ `tests/acceptance/applications/packageImportPatternKeysCli.test.ts` (+196 -0) 📝 `tests/boundary/filesystem/javascript-applications/javascriptModuleRelationships.test.ts` (+161 -0) 📝 `tests/boundary/filesystem/javascript-applications/javascriptModuleSpecifierPaths.test.ts` (+70 -0) </details> ### 📄 Description ## Summary Fixes #2017. Resolve single-`*` pattern keys in package `exports` and `imports` maps during static JavaScript artifact analysis. Exact keys take precedence; patterns use Node's prefix/suffix ordering and capture at least one character. Literal stars and dollar sequences remain literal text. The target owner validates declarations and captures separately, expands the selected normalized URL, and retains declared/expanded evidence. Selected targets keep exact-file and directory-form semantics, reject surviving encoded separators, and remain confined to the retained artifact/container. File finalization does not retry array entries. Recursive aliases and external-package imports targets retain explicit unresolved outcomes. ## Main integration Merged main `92213a915` in `25e9d1570b5248e1d084f7ee6c286fda5566d8c3`. Resolved the three overlapping resolver, resolver-test, and imports-lookup files while retaining main's JSON-document owner, raw ESM classification, Windows host-path uncertainty, permission/ownership facts, and source provenance. - Extend main's shared `javascriptPackageSubpathPatterns` owner to return the selected capture. Both maps consume it; the superseded parallel matcher is removed. - Unmatched imports keys are deterministic misses even when unrelated patterns exist. Unsupported recursive/external-package targets remain unavailable where lookup could affect dependency ownership. - Preserve URL above-root markers before normalization for legacy subpaths and expanded targets. Add exports/imports regressions for leaving and re-entering the synthetic URL namespace. - Retain the previous directory-form and opaque-base repairs. Opaque identities are checked after expansion and cannot collide with target/capture text. - Update prior unsupported-pattern assertions to verify resolved files through the current source and CLI/MCP ownership contracts. Adapt direct resolver tests to main's shared JSON-document boundary. ## Verification Executed on Windows x64 with locked dependencies. Initial build/CLI/MCP runs used the Node distribution's npm 11.19.1; a final locked reinstall and `check:fast` also pass with repository-pinned npm 11.16.0. - Node 22.23.4, 24.22.1, 26.12.1: 410 source tests pass per version across the resolver, synthetic-root, pattern, and import-alias suites. - Focused production graph and CLI/stdio MCP ownership checks: 25 passed, 2 existing Windows skips. Includes 15 module-relationship tests and 10 public CLI/MCP tests. - The native-Node/production-graph URL finalization regression also passes on Node 22 and 26. - Encoded exports URL rejection/decoded-file identity boundary checks: 18 passed. - Typecheck, formatting, lint/module boundaries, architecture guards, production-reachability analysis, typed lint, docs:check, and diff whitespace checks pass. Lint and typed lint report zero errors with advisory warnings. - `npm run check` stops at ordinary Knip: unused `staticFileUrlPath` and unused type `ObjcClassImportBindingCoverage`. Both identical findings reproduce on unmodified main `92213a915`; neither file is changed by this PR. Remaining static gates were executed separately. These unrelated findings were not suppressed or included as feature fixes. Validation used an LF worktree and the matching published Windows native artifact. Lone-surrogate regressions use retained logical inventory identities, not native-loader execution on malformed filesystem names. The full CI result is recorded below; older successful checks on `d82a1a62f` do not validate this merge. ## CI follow-up [CI run 40441742823](https://github.com/morluto/rea/actions/runs/40441742823) tested synthetic merge `e8dc9fb31` against main `620784381`. Mergeability and Author readiness pass; the remaining red jobs are test failures. A separate checkout of that exact unmodified main was built and compared with the PR head on Windows/Node 24.22.1 using the same locked dependencies: - Apple application/provider-binding source suites: both revisions give 35 passed and the same 9 failures (inventory-root/bundle identity validation). - Electron application/empty-literal suites: both give 33 passed and the same 2 failures (IPC pairing counts and bridge path identities). - Exact CLI dossier and Java bitness checks: the same 3 failures reproduce on both revisions. - The native Info.plist case also fails on unmodified main, as in CI; it passes locally on the older PR head. Thus 15 of the 17 failures in the combined Portable report reproduce on unmodified CI main. The other two are Linux-only extraction/close tests that explicitly skip Windows; no local execution or definitive attribution is claimed for those two. The Portable report aggregates existing source/shard failures, rather than introducing seventeen additional failures. No unrelated assertions or production code were weakened or changed, and no blind CI rerun was requested. ## Author readiness Human owner: @AWUQAQ - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-31 00:57:31 +00:00

bsakaguchi referenced this issue

2026-11-01 21:11:07 +00:00

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425

bsakaguchi referenced this issue

2026-11-01 21:42:24 +00:00

[PR #4969] [CLOSED] Fix typo in README and add repository description #6700