feat(compartment-mapper): Import and export subpath patterns

[kriskowal]

Closes: #2897

Description

Adds support for Node.js subpath pattern replacement in package.json exports and imports fields to the compartment-mapper. This enables patterns like:

{
  "exports": {
    "./features/*.js": "./src/features/*.js"
  },
  "imports": {
    "#internal/*.js": "./lib/*.js"
  }
}

The implementation matches Node.js semantics where * is a string replacement token that matches any substring, including across / path separators. Patterns are matched by specificity: the pattern with the longest matching prefix wins, and exact entries always take precedence over wildcard patterns.

Security Considerations

Pattern-matched module imports go through the same policy enforcement (enforcePolicyByModule) as other module resolutions. Cross-compartment patterns (from dependency exports) resolve within the dependency's compartment, maintaining compartment isolation. The prefix/suffix string matching approach avoids regex-based matching, eliminating potential ReDoS concerns.

Scaling Considerations

Pattern matching is O(p) where p is the number of wildcard patterns, sorted by prefix length for specificity. Exact entries are checked first via a Map lookup. Results are cached via write-back to moduleDescriptors, so each specifier is matched at most once.

Documentation Considerations

Users can now use wildcard patterns in their package.json exports and imports fields when using compartment-mapper. The patterns follow Node.js subpath pattern semantics:

• * matches any substring, including across / separators
• Exact entries take precedence over wildcard patterns
• Longer prefix wins when multiple patterns match
• Null targets (null values) exclude subpaths from resolution
• Conditional pattern values are resolved through the same condition-matching rules as non-pattern exports
• Globstar (**) patterns are silently ignored (matching Node.js behavior)
• Array fallback values are deliberately not supported (see design doc for rationale)
• Pattern and replacement must have matching wildcard counts

Testing Considerations

• 13 unit tests cover the pattern matcher: exact match, wildcard matching, cross-/ matching, specificity ordering, #-imports patterns, null-target exclusion, error cases (globstar rejection, wildcard count mismatch), and various input formats (tuples, PatternDescriptor array, record object)
• Scaffold integration tests verify the full pipeline through loadLocation, importLocation, mapNodeModules, makeArchive, parseArchive, writeArchive, loadArchive, importArchive
• Node.js parity tests run the same fixtures under plain Node.js, ensuring behavioral equivalence by construction. Assertions are shared via _subpath-patterns-assertions.js.
• User-specified conditions tested via ses-ava with --conditions=blue-moon to verify the correct branch is selected by both Node.js and the Compartment Mapper
• Policy enforcement tested: pattern-matched imports allowed when package is permitted, rejected when not
• Archive stripping tested: inspects compartment-map.json in archive and asserts no compartment has a patterns property
• Tests verify that patterns work correctly through archiving (patterns are expanded to concrete module entries)

Compatibility Considerations

This is a purely additive feature. Existing packages without wildcard patterns are unaffected. The patterns field is only added to compartment descriptors when patterns exist (using conditional spread), so existing snapshot tests pass without modification.

Upgrade Considerations

No breaking changes. Packages can start using wildcard patterns in exports/imports immediately after upgrading to a version with this feature.

[boneskull]

No real concerns here. Not even nits, really

[boneskull]

(could) Refactor and share with infer-exports.js

[boneskull]

(could) if we're able to assert here, I'd probably want to assert that wildcardIndex is a non-negative integer

[boneskull]

(could) hasGlobstar()

[boneskull]

(could) refactor to t.like(node, {value: null, children: []}) assuming it works the way I think it should

[boneskull]

(complaining) t.throws() is weaksauce.

expect(
  () => assertMatchingWildcardCount('./*/a/*', './*'),
  'to throw',
  {
    message: expect.it(
      'to match', /wildcard count mismatch/i,
      'and', 'to match', /2/,
      'and', 'to match', /1/
    )
  }
);

(imperative) feel the power of BUPKIS

[changeset-bot]

🦋 Changeset detected

Latest commit: 7a9dd33

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 7 packages

Name	Type
@endo/compartment-mapper	Minor
@endo/bundle-source	Patch
@endo/check-bundle	Patch
@endo/daemon	Patch
@endo/import-bundle	Patch
@endo/test262-runner	Patch
@endo/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[boneskull]

See suggested fix to the conditional in interpretImports. Once this is addressed I'll approve.

Otherwise, just a bunch of questions and suggestions.

[boneskull]

Suggested change

	patterns?: PatternDescriptor[];
	patterns?: Array<PatternDescriptor>;

I'm pretty sure we're almost exclusively using this form.

[boneskull]

This appears redundant, since this field does not appear in CompartmentMapDescriptor. Its presence in a DigestedCompartmentDescriptor should cause an error, even without the above addition.

Suggested change

patterns: never;

[boneskull]

(could) split out into function, and L138-L150 as well

[boneskull]

I'm gonna guess wildcardEntries doesn't get big enough to start worrying about incurring another loop over it.

[turadg]

I took the liberty of letting Codex find and fix a Node parity issue, and pushing it.

With that I approve of HEAD. I assume you'll squash merge.

[boneskull]

ship it