refactor: improve type safety in core, plugins and tests

[chenjiahan]

Summary

Improve type safety in core hooks, server helpers, plugin configuration, and tests by replacing unsafe arguments with explicit types and using array length assertions where appropriate. Upgrade rspack-chain to 2.3.1 to use its more precise configuration types. Skip unconfigured loaders when copying plugin rules and default missing CSS importLoaders to zero.

Related links

• rspack-chain v2.3.1 release notes

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T07:02:14.276878Z	fe27793	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[SoonIter]

<agent: daily-job rstack ecosystem-ci>

Ecosystem CI regression: rsbuild/plugins, rsbuild/lynx-stack, and rsbuild/modernjs

Attribution: Confirmed source

Impact: Three downstream suites no longer type-check against Rsbuild main because exported rspack-chain getters and merge patches are now stricter.

Why this PR

This PR upgraded rspack-chain from 2.2.0 to 2.3.1 and adapted Rsbuild's own call sites, so the stricter T | undefined getter results and typed merge patches now reach downstream consumers through @rsbuild/core. The failures start at its merge commit and match those exact type changes. This exposed downstream compatibility constraints rather than introducing a runtime product regression.

Suggested next step

The downstream owners should narrow optional getter results before use and preserve chain merge semantics. Fixes are already available in rsbuild-plugin-mdx#84, rsbuild-plugin-stylus#15, rsbuild-plugin-typed-css-modules#88, and modern.js#8856. For Lynx, verify a structured RuleSetRule to chain patch conversion with the rspeedy build/tests before merging a repair.

Evidence and attribution checks

• Current run: https://github.com/rstackjs/rstack-ecosystem-ci/actions/runs/34098918430
• Tested upstream: rsbuild at 35e3a2dbdf3d37b41aa6e80067c77744fbc0eb6d
• First bad / previous good: 40acc976 / run 34094692861 after 656313d / run 34075977028
• Failure signatures: loader getters become string | undefined; CSS loader options become optional; RuleSetRule no longer matches the named merge patch; library can no longer be spread without narrowing; manifest publicPath can be a function.
• Flaky/pre-existing check: none of these signatures appears in the previous green run; all persist in later runs.
• Config check: not applicable; these are compile-time failures in unconditional downstream build paths.
• Alternatives ruled out: all three failing plugin repositories used identical commits in the green and first-bad runs. The failing Modern.js files and Lynx css.ts did not change across their downstream HEAD advances. Later Rsbuild PRs chore: enable import recommended lint preset #8438 and refactor: use named React imports #8439 retain the same signatures and do not touch the relevant type surface.