[GH-ISSUE #1838] [Feature] Resolve exact package-private import aliases in static application graphs #618

New issue

Closed

opened 2026-10-15 18:26:40 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:26:40 +00:00

Owner

Originally created by @AWUQAQ on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1838

Before submitting

I searched the open and closed issues and pull requests for a related proposal.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Current limitation

Static JavaScript application analysis leaves package-private import aliases — # specifiers resolved through a package.json imports map — unresolved. On current main, an owned fixture whose root package.json declares {"imports":{"#config":"./config.cjs"}} and whose entry file requires #config produces resolved_path: null, external with the limitation "The bare specifier is a Node builtin, package import map, or invalid package name." Node resolves it to config.cjs. This was the second gap documented in #1365; the exports-subpath half landed in #1424 and this half remains.

Use cases

Multi-file Node/Electron packages increasingly use imports aliases as the native replacement for bundler path aliases, avoiding deep relative paths. When an analyzed application uses them, real dependency edges are dropped from the application graph: traces that reach a # import stop at an "external" edge even though the target file is inventoried.

Desired outcome and success criteria

An initial increment resolving exact #alias keys:

Resolve against the importer's actual package scope — the nearest enclosing package.json. A module inside node_modules/fixture must use that package's imports map, never the application root's.
Reuse the existing condition, array, and null target selection shared with exports subpaths.
Selected targets resolve as exact files relative to the owning package root, package-local relative targets only; no extension or index fallback.
A missing key, explicit null, or out-of-scope alias reports a precise reason; no fall-through to files, indexes, or another package's map.
Acceptance would compare real Node import/require resolution with the compiled CLI and real stdio MCP graphs on owned small fixtures, including nested node_modules scope checks.

Authority boundaries and non-goals

No package installation, network access, or target execution; no new tool or dependency; no TypeScript paths model or browser import maps. Wildcards (#internal/*), recursive aliases, and external-package targets remain explicit unknowns unless separately agreed — the boundary sketched in #1365. Alias resolution must not cross package scopes even within the same artifact container.

Alternatives considered

Keeping unresolved edges is honest today; calling the live host resolver would give the selected host filesystem authority over an artifact-confined graph; rewriting the target package's declarations would change the input evidence.

Possible direction

Mirror the exact-key lookup and exact-file resolution from #1424: the new logic is mainly the enclosing-package-scope walk with container identity checks, delegating to the existing exportTargets machinery.

References

#1365 — original proposal (closed by the exports-subpath half)
#1424 — implementation of the exports-subpath half
Node package imports

Originally created by @AWUQAQ on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1838 ### Before submitting - [x] I searched the open and closed issues and pull requests for a related proposal. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Current limitation Static JavaScript application analysis leaves package-private import aliases — `#` specifiers resolved through a package.json `imports` map — unresolved. On current main, an owned fixture whose root package.json declares `{"imports":{"#config":"./config.cjs"}}` and whose entry file requires `#config` produces `resolved_path: null, external` with the limitation "The bare specifier is a Node builtin, package import map, or invalid package name." Node resolves it to `config.cjs`. This was the second gap documented in #1365; the exports-subpath half landed in #1424 and this half remains. ### Use cases Multi-file Node/Electron packages increasingly use `imports` aliases as the native replacement for bundler path aliases, avoiding deep relative paths. When an analyzed application uses them, real dependency edges are dropped from the application graph: traces that reach a `#` import stop at an "external" edge even though the target file is inventoried. ### Desired outcome and success criteria An initial increment resolving exact `#alias` keys: - Resolve against the importer's actual package scope — the nearest enclosing package.json. A module inside `node_modules/fixture` must use that package's `imports` map, never the application root's. - Reuse the existing condition, array, and null target selection shared with exports subpaths. - Selected targets resolve as exact files relative to the owning package root, package-local relative targets only; no extension or index fallback. - A missing key, explicit null, or out-of-scope alias reports a precise reason; no fall-through to files, indexes, or another package's map. - Acceptance would compare real Node import/require resolution with the compiled CLI and real stdio MCP graphs on owned small fixtures, including nested node_modules scope checks. ### Authority boundaries and non-goals No package installation, network access, or target execution; no new tool or dependency; no TypeScript paths model or browser import maps. Wildcards (`#internal/*`), recursive aliases, and external-package targets remain explicit unknowns unless separately agreed — the boundary sketched in #1365. Alias resolution must not cross package scopes even within the same artifact container. ### Alternatives considered Keeping unresolved edges is honest today; calling the live host resolver would give the selected host filesystem authority over an artifact-confined graph; rewriting the target package's declarations would change the input evidence. ### Possible direction Mirror the exact-key lookup and exact-file resolution from #1424: the new logic is mainly the enclosing-package-scope walk with container identity checks, delegating to the existing `exportTargets` machinery. ### References - #1365 — original proposal (closed by the exports-subpath half) - #1424 — implementation of the exports-subpath half - [Node package imports](https://nodejs.org/docs/latest/api/packages.html#imports)

bsakaguchi

2026-10-15 18:26:40 +00:00