[feat] `script.integrity` and import map - Githubissues

tc39 / proposals

Tracking ECMAScript Proposals

https://tc39.github.io/process-document/

18.12k stars 713 forks source link

[feat] `script.integrity` and import map #435

Closed loynoir closed 1 year ago

loynoir commented 1 year ago

Background

There is Subresource Integrity for old days javascript.
deno support import map, and invent own lock file.
node not yet support import map.

Feat

Now, there is ESM. I think there should have a concept update combine two, in flavor of each dependency manager reinvent different lock file.

  "imports": {},
  "scopes": {},
  "integrity": {} | ./lock/file/relative/path/to/import/map,

Additional

As ESM system differ from legacy system, I think, should iter into the inner most dependency, and update field integrity or file flatly.

Related

https://github.com/nodejs/node/issues/44830

Thoughts

For relative path, should be compact for both filesystem and network.
Maybe allow .integrity as a url. Maybe user can store their import map in their dotfile repo?
Maybe design .integrity as an Array<Record<string,string>>, and when importId not uniq, throw error.