[GH-ISSUE #2017] [Feature] Resolve wildcard pattern keys in package exports and imports maps #669

New issue

Open

opened 2026-10-15 18:27:07 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:27:07 +00:00

Owner

Originally created by @AWUQAQ on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2017

Before submitting

I searched the open and closed issues and pull requests for a related proposal.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Current limitation

Static JavaScript application analysis leaves wildcard pattern keys unresolved in both package maps. #1424 resolved exact exports subpath keys and 1862 resolved exact # import aliases; both explicitly deferred wildcards, and the community audit in the #1424 thread shows ./* and #internal/* as the remaining no-match rows against real Node. Packages declaring {"exports":{"./*":"./dist/*.js"}} or {"imports":{"#internal/*":"./src/*.mjs"}} leave those edges external even when the target files are inventoried.

Use cases

Wildcard subpaths are a documented, widely used Node pattern — @mui/material-style feature maps and #internal/* module aliases both appear in modern multi-file packages. Applications analyzed with REA that use them get dropped dependency edges: traces reaching a wildcard import stop at an "external" edge.

Desired outcome and success criteria

Resolve single-* pattern keys in both maps:

Exact keys win over pattern keys.
Pattern keys are tried in Node's pattern-key order: longest prefix before the *, then longest suffix; the first key that encloses the request captures its substring.
The capture is substituted into the selected target string, and the expanded target is revalidated through the exact-target pipeline — a capture escaping the package (../, node_modules) is refused like any declared target.
Requests containing a literal * or ending in / never match, keeping the deprecated directory form dead.
Acceptance compares real Node import/require resolution with the compiled CLI and real stdio MCP graphs on owned small fixtures, including precedence, escape attempts, and conditions under pattern keys.

Authority boundaries and non-goals

No package installation, network access, or target execution; no new MCP tool. Recursive # aliases stay refused (with the expanded target named), the directory form (./x/) stays unsupported, multi-asterisk keys never participate, and no bundler alias or TypeScript paths model is introduced. Pattern resolution must not cross package scopes or containers.

Alternatives considered

Keeping unresolved edges is honest today; calling the live host resolver would give the host filesystem authority over an artifact-confined graph; implementing per-map matchers would duplicate semantics that Node defines once.

Possible direction

A shared single-* matcher in the domain layer, delegating from both the exports subpath selection and the imports alias lookup, with substitution followed by the existing exact-target validation.

References

#1365 — original exports proposal
#1424 — exact exports subpaths implementation
#1838 / #1862 — exact # import aliases proposal and implementation
Node package exports patterns

Originally created by @AWUQAQ on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2017 ### Before submitting - [x] I searched the open and closed issues and pull requests for a related proposal. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Current limitation Static JavaScript application analysis leaves wildcard pattern keys unresolved in both package maps. `#1424` resolved exact `exports` subpath keys and `1862` resolved exact `#` import aliases; both explicitly deferred wildcards, and the community audit in the `#1424` thread shows `./*` and `#internal/*` as the remaining no-match rows against real Node. Packages declaring `{"exports":{"./*":"./dist/*.js"}}` or `{"imports":{"#internal/*":"./src/*.mjs"}}` leave those edges external even when the target files are inventoried. ### Use cases Wildcard subpaths are a documented, widely used Node pattern — `@mui/material`-style feature maps and `#internal/*` module aliases both appear in modern multi-file packages. Applications analyzed with REA that use them get dropped dependency edges: traces reaching a wildcard import stop at an "external" edge. ### Desired outcome and success criteria Resolve single-`*` pattern keys in both maps: - Exact keys win over pattern keys. - Pattern keys are tried in Node's pattern-key order: longest prefix before the `*`, then longest suffix; the first key that encloses the request captures its substring. - The capture is substituted into the selected target string, and the expanded target is revalidated through the exact-target pipeline — a capture escaping the package (`../`, `node_modules`) is refused like any declared target. - Requests containing a literal `*` or ending in `/` never match, keeping the deprecated directory form dead. - Acceptance compares real Node import/require resolution with the compiled CLI and real stdio MCP graphs on owned small fixtures, including precedence, escape attempts, and conditions under pattern keys. ### Authority boundaries and non-goals No package installation, network access, or target execution; no new MCP tool. Recursive `#` aliases stay refused (with the expanded target named), the directory form (`./x/`) stays unsupported, multi-asterisk keys never participate, and no bundler alias or TypeScript paths model is introduced. Pattern resolution must not cross package scopes or containers. ### Alternatives considered Keeping unresolved edges is honest today; calling the live host resolver would give the host filesystem authority over an artifact-confined graph; implementing per-map matchers would duplicate semantics that Node defines once. ### Possible direction A shared single-`*` matcher in the domain layer, delegating from both the exports subpath selection and the imports alias lookup, with substitution followed by the existing exact-target validation. ### References - #1365 — original exports proposal - #1424 — exact exports subpaths implementation - #1838 / #1862 — exact `#` import aliases proposal and implementation - [Node package exports patterns](https://nodejs.org/docs/latest/api/packages.html#exports)

bsakaguchi added the

area: domain

enhancement

P2: medium

labels

2026-10-15 18:27:07 +00:00

bsakaguchi commented

2026-10-15 18:27:08 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 12, 2026):

Design & Node.js Subpath Match Review

Resolving wildcard pattern keys in package.json exports and imports fields eliminates false-positive external edge classifications in JS static analysis:

Algorithm Alignment: Node's subpath pattern matching rules require replacing the single * in the key with the matched subpath and substituting it into the * position of the target string.
Safety Boundary: Guard against path traversal when resolving wildcard values (disallowing substitution tokens that resolve to ../ or escape the package directory root).

@matbrgz commented on GitHub (Oct 12, 2026): ### Design & Node.js Subpath Match Review Resolving wildcard pattern keys in `package.json` `exports` and `imports` fields eliminates false-positive external edge classifications in JS static analysis: - **Algorithm Alignment:** Node's subpath pattern matching rules require replacing the single `*` in the key with the matched subpath and substituting it into the `*` position of the target string. - **Safety Boundary:** Guard against path traversal when resolving wildcard values (disallowing substitution tokens that resolve to `../` or escape the package directory root).

bsakaguchi referenced this issue

2026-10-15 18:28:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:14:57 +00:00

[PR #669] [MERGED] fix(native): retain spaced symbols in dyld inventory #2153

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:29:26 +00:00