feat(plugin-js): oxc-based import-graph resolver, phantom-dep detection - #362
Closed
raphaelvigee wants to merge 3 commits into
Closed
Conversation
raphaelvigee
force-pushed
the
raphaelvigee/feat-plugin-js-m2-import-graph
branch
from
August 7, 2026 11:21
e33420f to
58c133d
Compare
raphaelvigee
marked this pull request as ready for review
August 7, 2026 12:57
raphaelvigee
force-pushed
the
raphaelvigee/feat-plugin-js-m2-import-graph
branch
from
August 7, 2026 12:58
58c133d to
4ecae51
Compare
M2 of the JS/TS plugin: fixes the deferred optionalDependencies hard-fail (platform-restricted optional deps now silently skip instead of failing Provider::get), then adds a real import-graph resolver on top of M1's package.json-declaration wiring. - oxc_parser + oxc_resolver extract and resolve import/require/dynamic-import specifiers per real Node condition-set semantics (separate ESM/CJS/types resolvers), building two distinct graphs (runtime vs type-only edges). - Phantom-dependency detection: an import resolving into a package not in the declared-dependency closure (deps + devDeps + peerDeps) is a hard error naming the file/specifier/package, hermetic against a fresh checkout (no ambient node_modules required) via a bare-specifier name check. - Conformance corpus (crates/plugin-js/src/pluginjs/conformance.rs) covering exports-map condition ordering, wildcard specificity, array fallbacks, null-blocked subpaths, self-referencing imports, and the "imports" field — cross-checked live against a real Node binary when present, self-gated otherwise. Reviewed by feature-quality/code-quality/hermeticity. Four BLOCKERs found and fixed: the phantom-dep check being a no-op without ambient node_modules, peerDependencies never counted as declared, an oxc_resolver default reading the ambient NODE_PATH env var, and a resolved-but-unclassifiable edge silently passing instead of failing closed. Each has a regression test. Explicitly deferred (named, not silent): import-equals require() and require.resolve() extraction, per-specifier `type` modifier detection, provider-lifetime resolver caching (currently rebuilt per Provider::get call — a stated perf follow-up), and pinning a hermetic Node toolchain so the conformance corpus's live cross-check is guaranteed to run in CI rather than opportunistically. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M3wZfyPsG8stfRQuybLRjN
raphaelvigee
force-pushed
the
raphaelvigee/feat-plugin-js-m2-import-graph
branch
from
August 7, 2026 16:00
4ecae51 to
5b006c1
Compare
…rde_json's Map ordering oxc_resolver (a new plugin-js dependency) requires serde_json's preserve_order feature unconditionally, which is a workspace-wide Cargo choice. That silently flipped serde_json::Map from an always-sorted BTreeMap to an insertion-order IndexMap everywhere, including in plugin-oci's manifest/config json! literals, which relied on that implicit sort for canonical, cache-key-stable output. Sort explicitly at encode time instead of depending on which Map backing happens to be active.
…uirk that changed after v18 array_exports_matched_entry_missing_on_disk_hard_fails_no_fallback's live cross-check was authored against v18.12.1's --experimental-import-meta-resolve. Later Node no longer checks file existence for array-form exports entries during resolution, deferring it to module load — so any newer Node found on PATH now resolves where the hard-coded expectation says it should throw. plugin-js's own resolver (the assertion that actually matters here) still implements the documented algorithm correctly and is unaffected; only the live Node cross-check is dropped for this one fixture.
Member
Author
|
Superseded by #370 — the whole stack was squash-collapsed into a single PR rebased on master, per request. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
M2 of the JS/TS heph plugin plan (part 2/6 of the stack).
Fixes the deferred optionalDependencies hard-fail (platform-restricted optional deps now silently skip instead of failing Provider::get), then adds a real import-graph resolver on top of M1's package.json-declaration wiring.
Reviewed by feature-quality/code-quality/hermeticity. Four BLOCKERs found and fixed: the phantom-dep check being a no-op without ambient node_modules, peerDependencies never counted as declared, an oxc_resolver default reading the ambient NODE_PATH env var, and a resolved-but-unclassifiable edge silently passing instead of failing closed. Each has a regression test.
Explicitly deferred: import-equals require() and require.resolve() extraction, per-specifier
typemodifier detection, provider-lifetime resolver caching (fixed later in the stack), pinning a hermetic Node toolchain for the conformance corpus's live cross-check.Test plan
Stack created with GitHub Stacks CLI • Give Feedback 💬