mirror of
https://github.com/stablyai/orca.git
synced 2026-10-21 16:03:26 +00:00
NeilandOrca
03c3e6e722
The three detection regexes ran over raw source, so a preload containing
`const help = "Call require('fs')"` failed the build with a node-builtin
violation, and a comment mentioning a module call did the same — nothing
minifies preload chunks, so comments survive into the emitted output.
A safe preload could not build.
Mask lexical spans first: one pass marks every comment and string
character while preserving offsets, and a match is vetoed only when its
module keyword lands on a masked offset. The regexes still run over the
original source, so real specifiers are unaffected, and template
interpolations stay unmasked — `${require('fs')}` is still a violation.
Rollup's resolved import lists remain the authoritative check.
Costs 104 production lines against a program rule that wants strictly
net-negative code. A dependency-free lexer cannot be written smaller, and
the alternative — trusting chunk metadata alone — would drop detection of
the renamed and non-literal `require` forms the guard exists to catch.
Co-authored-by: Orca <help@stably.ai>