JavaScript Package Exports More Than Just Main

[BekaValentine]

In the current implementation of the rules for JS, it looks to be true that the package-level exports consist of all the exports of all the files in the package. This seems to be intentional, to support package imports of the form require("pkg"), but this has the consequence of bringing into scope way more things than are actually in scope in JS.

The actual behavior is that the exports of only the package's main file should be accessible via package imports, but there isn't currently a mechanism to determine in a file is the package main.

For name resolution this is sub-optimal. But for VEA, this is a major issue because it means there will be many false positives.

cc @hendrikvanantwerpen

[hendrikvanantwerpen]

In the current implementation of the rules for JS, it looks to be true that the package-level exports consist of all the exports of all the files in the package.

That's true and it sounds like this turns out to be more of a problem than useful.

This seems to be intentional, to support package imports of the form require("pkg")

I don't think these kind of require statements were the reason for that behavior. But if we don't have tests for those yet, it is a good idea to add some to see if we cover(ed) these cases correctly.

I've opened #340 which changes the behavior to only export the main module from the top-level package name.