Robert/js modules in document support by robert-matusewicz · Pull Request #23 · bluecontract/blue-quickjs

robert-matusewicz · 2026-05-04T11:34:59Z

No description provided.

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

…lder Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

…minism checks - move quickjs-runtime specs from src/lib to src/test - group runtime tests by execution profile - migrate gas goldens, dv parity, host gas, binary parity, and module-pack parity into libs/test-harness - trim quickjs-native-harness legacy script to native-only CLI/report coverage - run both new and legacy native harness suites in GitHub Actions - add missing determinism coverage for compat-regexp-v1, replay stability, and init boundary checks

- fix prettier formatting in runtime, test-harness, native harness, and consumer app files - move vitest to quickjs-runtime dependencies for nx dependency checks - clean up helper/test files to satisfy eslint and prettier

…tion

Remove compat-regexp-v1 from the public execution profile registry, runtime validation, docs, and tests. RegExp-compatible coverage now uses compat-general-v1, which remains the supported profile for deterministic RegExp behavior. Also delete the dedicated compat-regexp-v1 runtime spec and update related type unions and profile lists so artifacts only accept the remaining public profiles.

Introduce @blue-quickjs/blue-documents for building and validating BlueQuickjs JavaScript document workflows. The library supports JavaScript library source documents, npm-origin library imports, import locks, environment contract merging, step artifact builds, document inspection, canonical JSON hashing, and source integrity checks. Wire the new document workflows into blue-quickjs CLI with commands for mporting npm libraries, building library artifacts, creating import locks, building step documents into ProgramArtifact.v2, and inspecting Blue documents. Add Vitest coverage for library artifact creation, import lock validation, contract merging, step artifact generation from locked libraries, and local npm package imports.

Add an end-to-end example showing how to import a pinned npm package into a Blue document, lock it through a generated library artifact, process the user document into a ProgramArtifact.v2, and run it with the CLI. Add a create-step-document CLI command that emits JSON or YAML user documents from an entry file plus a library artifact, including import lock creation and output directory creation. Add YAML support for the CLI/example flow and update TypeScript project references needed by the affected workspace packages.

Introduce runtime APIs for building ModulePack.v1 artifacts directly from source maps and module source entries. The builder normalizes specifiers and line endings, resolves reachable static imports, supports explicit bare import aliases, computes canonical graph hashes, and reports deterministic compatibility diagnostics before evaluation. Extract module-pack graph hashing into a shared runtime helper and export the new builder, hash utilities, and validateModulePack API. Add acorn for module parsing. Fix module export lookup so an explicitly exported undefined value is not treated as a missing export, and cover the new builder, hash, validation, and undefined-export behavior with tests.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b204cf060

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-04T11:39:44Z

+  const packageName = parts[0] ?? specifier;
+  const rest = parts.slice(1);


Reject non-package import specifiers before materialization

parsePackageImportSpecifier accepts any string and uses the first path segment as packageName without validation, so specifiers like ../lib or ./x produce packageName values such as .. or .. In materializeModulePackAsPackage, those names are joined into node_modules/<packageName>, which can escape or collapse the intended package directory and write files in unintended locations, breaking builds and allowing path traversal through crafted import-lock specifiers.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-04T11:39:44Z

+  const exports: Record<string, string> = {
+    '.': `./${entryPath}`,
+  };
+  if (options.exportSubpath) {
+    exports[options.exportSubpath] = `./${entryPath}`;


Preserve existing exports when materializing same package twice

Each call to materializeModulePackAsPackage rewrites package.json with a fresh exports object containing only . plus the current exportSubpath. If a step imports multiple subpaths from the same package (for example pkg/a and pkg/b), the second write drops the first subpath export and later resolution of that import fails. The function should merge with existing exports for the package root instead of replacing them on every call.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-04T11:39:44Z

+  if (abiId === 'Host.v2') {
+    return HOST_V2_HASH;
+  }
+  return HOST_V1_HASH;


Error on unknown ABI IDs when selecting manifest hash

abiManifestHashFor falls back to HOST_V1_HASH for every ABI ID other than Host.v2, so unsupported IDs silently get a Host.v1 manifest hash. That can emit internally inconsistent program artifacts (e.g., abiId: "Foo.v3" paired with Host.v1 hash) instead of failing fast, which makes downstream evaluation and verification behavior ambiguous.

Useful? React with 👍 / 👎.

cursoragent and others added 30 commits March 15, 2026 00:11

clarify raw script semantics and classify surface mismatches

630b065

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add deterministic bundler library and compatibility scanning

07fecf8

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add profile-gated regexp compatibility through runtime init

686b2fc

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add chess.js bundled reuse fixtures and parity tests

3692941

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

fix quickjs submodule pin and docs origin

95c5b19

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add P13 architecture docs and feature-flag quickjs pin

30a6237

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add module-pack builder API and v2 artifact validation scaffolding

86057a2

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

introduce deterministic-builder package and align P14 docs

82f0a5e

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

emit compatibility reports and program artifacts from module-pack bui…

da7b9df

…lder Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

accept ProgramArtifact.v2 script mode in evaluate pipeline

17e3801

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add shared execution profile registry and wire runtime checks

a1563c6

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add module-pack runtime execution path for ProgramArtifact v2

737e4fa

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add module-pack smoke parity fixtures for node and browser

221b3f7

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add native module-pack fixture assertions with gas and tape

12cf629

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

migrate compatibility fixtures to compat-general profile

5d9610f

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

enable deterministic promise job draining for compat profiles

224c8e9

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add async promise and queueMicrotask parity fixtures

f3d937b

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

enable compat-profile console shim through host emit

b18c858

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

enable compat-profile stable sort with parity fixtures

92284b6

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add dv2 byte-string codec foundation APIs

0540599

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add quickjs dv2 codec entrypoints and plan updates

9d6f120

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

wire Host.v2 DV2 bytes across runtime boundaries

4dabc2b

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add binary library compatibility fixtures and parity checks

44e024a

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

add initial blue-quickjs CLI command suite

4645fa4

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

Add source-map remapping and richer CLI diagnostics

4554492

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

Add parity report runner for cross-environment validation

c5e2736

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

Extend parity report with gas-delta aware compare modes

e20bf7e

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

Gate native harness tests with parity report snapshots

73b5e11

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

Add gas delta baseline enforcement for parity report

8c3abf2

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

Support strict parity checks with gas delta baseline normalization

929e2e2

Co-authored-by: piotr-blue <piotr-blue@users.noreply.github.com>

robert-matusewicz and others added 28 commits April 24, 2026 10:35

fix: Make pnpm exec nx affected -t lint pass

2b4b891

fix: Fix pnpm exec nx affected -t typecheck

be95114

fix(build): make QuickJS source preparation work in CI

6cd304c

fix: pnpm nx run quickjs-wasm-build:build

096b5e9

fix(ci): run certifier Playwright tests with PLAYWRIGHT_BROWSER

a52630a

fix(ci): pack public tarballs without pnpm filter recursion

8abe509

fix(ci): generate pack manifests without pnpm pack --json

b9645ef

fix(ci): isolate npm tarball installs from pnpm env in consumer proof

c9a76cb

fix(ci): use npm for consumer-proof tarball verification steps

b642170

fix(ci): avoid pruning consumer-proof tarball installs after setup

750ce71

fix(ci): build public packages before consumer-proof packaging

0cb89e4

fix(ci): let quickjs wasm build bootstrap emsdk in consumer-proof matrix

9ffc1d0

fix(ci): install emsdk only for linux consumer-proof builds

f3e4d82

fix(ci): load deterministic bundler source directly in certifier scripts

dcf29a9

feat: drop node 20 support

392b625

fix: normalize MSYS-style paths in quickjs-wasm-build metadata genera…

8948a4b

…tion

Fix broken build for main job

07f5267

bypass cache in ci.yml to narrow down the issue

685089b

Update playground files

537b718

Update playground screent

140c431

Redo the documentation to make it more readable and shorter

8569048

Remove unusefull steps from ci

5d98963

robert-matusewicz closed this May 4, 2026

chatgpt-codex-connector Bot reviewed May 4, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Robert/js modules in document support#23

Robert/js modules in document support#23
robert-matusewicz wants to merge 143 commits intomainfrom
robert/js-modules-in-document-support

robert-matusewicz commented May 4, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 4, 2026

Uh oh!

chatgpt-codex-connector Bot May 4, 2026

Uh oh!

chatgpt-codex-connector Bot May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		const packageName = parts[0] ?? specifier;
		const rest = parts.slice(1);

Conversation

robert-matusewicz commented May 4, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants