module-graph misses a dynamic import() inside a template ${} hole

[vivek7405]

Problem

The module-graph edge scanner misses a dynamic import() whose string-literal specifier sits inside a template-literal ${} interpolation hole, e.g. html`${import('./widget.ts')}`. Since the auth gate and preload derive from the module graph, that module is NOT admitted as a (dynamic) edge, so it can 404 if actually loaded. This is the same "admit fewer / silent 404" family as #753, but for a different, narrower construct.

Root cause: parseFile scans for edges over redactStringsAndTemplates(src, true), which blanks the ENTIRE template body INCLUDING the code inside ${} holes, so DYNAMIC_IMPORT_RE never sees the import(...) inside the hole. This is PRE-EXISTING (confirmed: main misses it identically, so it is not introduced by the #753 fix) and rare (a dynamic import written directly inside a lit-html template interpolation), which is why the #753 differential corpus, which finds zero instances in real source, stays green.

Surfaced by the #753 lexer-vs-AST differential harness: a real TypeScript AST counts ${import('./x')} as an edge, the hand-rolled scanner does not.

Design / approach

The #753 root fix deliberately scans over the fully-blanked mask so no stray keyword inside any literal can anchor a swallow. The trade-off is that ${} hole CODE is blanked too. To capture a real dynamic import inside a hole without reopening the swallow class, the scan needs a mask that keeps ${} hole code readable while still blanking template TEXT + string + regex + comment bodies. Two candidate directions:

• Reuse redactToPlaceholders (js-scan.js, fix: false positives in component scanner and elision analyzer due to string/template literals in code samples #634), which already scans ${} holes as code and replaces string bodies with __STR_<idx>__ placeholders; recover the specifier from the returned literals array (this is how component-scanner.js reads tags). Run DYNAMIC_IMPORT_RE over that placeholder source and map the placeholder back to the literal.
• Or a targeted second pass: after the main scan, additionally scan the code inside each ${} hole for DYNAMIC_IMPORT_RE only (static import ... from cannot appear in an expression position, so only dynamic imports are affected).

Keep it dynamic-only: a static import/export ... from is a statement and cannot appear inside a ${} expression, so only DYNAMIC_IMPORT_RE needs the extra coverage.

Implementation notes (for the implementing agent)

• Where: packages/server/src/module-graph.js parseFile, specifically the for (const m of masked.matchAll(DYNAMIC_IMPORT_RE)) loop (post-IMPORTANT: prove the hand-rolled lexer matches an AST (auth gate / elision / check rest on it) #753 it reads the specifier via m.indices[1]). The static IMPORT_RE / EXPORT_FROM_RE loops do NOT need changing (no statement lives in a ${} hole).
• Landmine: do NOT revert IMPORTANT: prove the hand-rolled lexer matches an AST (auth gate / elision / check rest on it) #753's "scan over the fully-blanked mask" for the static regexes; that is what closes the comment/string/template/regex swallow class (a stray import/export word inside any literal must not anchor a lazy match that eats a real later edge). Any hole-aware scan must NOT reintroduce that: only genuine hole CODE should be readable, template TEXT must stay blanked.
• Mask helpers: redactStringsAndTemplates(src, true) blanks whole template bodies (holes included); redactToPlaceholders(src) (fix: false positives in component scanner and elision analyzer due to string/template literals in code samples #634) keeps ${} holes as code and returns { redacted, literals }; maskComments(src) blanks comments only. Pick the one that keeps holes readable AND keeps the specifier recoverable.
• Invariant: keep it verdict-safe. A dynamic edge is admitted-but-not-preloaded (IMPORTANT: dynamic import() of an app module silently 404s (not in browser-bound graph) #751), so adding it must not preload it; only reachableFromEntries (the gate) should union it. Do not turn a computed import(expr) into an edge (still a documented limitation).
• Tests: add a fixture in packages/server/test/scanner-fuzz/import-edges-differential.test.js (a ${import('./x.ts')} case, pinned on both lexer and AST), and a real buildModuleGraph assertion that the hole edge is captured. The differential's "never miss" corpus claim then holds for this construct too.

Acceptance criteria

• A dynamic import('./x.ts') inside a ${} template hole is captured as a dynamic edge by buildModuleGraph (the module is servable, no 404).
• The IMPORTANT: prove the hand-rolled lexer matches an AST (auth gate / elision / check rest on it) #753 swallow-class fix is preserved (a stray import/export word inside a comment / string / template TEXT / regex still does NOT anchor a phantom or swallow a real edge).
• A computed import(expr) is still NOT an edge (unchanged documented limitation).
• Fixture in packages/server/test/scanner-fuzz/ pins the hole case on both the lexer and the AST; counterfactual reds when the hole-scan is reverted.