Module loader 

Module resolution and loading for rule files.

Rules are ES modules. They may import from lanekeep and from each other; nothing else resolves. There is no node_modules lookup, no bare-specifier resolution, and no way to reach a file outside the rules root.

Confinement

The rules root is canonicalized once at construction, and every resolved module is canonicalized and checked against it. Canonicalizing rather than comparing strings is what makes the check hold against symlinks: a link inside the root pointing at /etc/passwd resolves to a path outside the root and is rejected, where a lexical comparison would see an innocent-looking relative path and allow it.

Traversal is also rejected lexically, before touching the filesystem, so ../../secrets produces a message about escaping the root rather than a confusing “not found”.

Structs

RuleLoader

Adapts RuleRoot to the engine’s loader interface.

RuleResolver

Adapts RuleRoot to the engine’s resolver interface.

RuleRoot

Where rule modules live, and what may be imported.

Enums

ResolveError

Why a module specifier could not be resolved.

Constants

HOST_MODULE

The specifier that resolves to lanekeep’s own module.

Type Aliases

BuiltinSource

Resolves a built-in rule name to its embedded source.

LoadedModules

Every module the loader read, with the source it read.