Fail closed on subpath imports of configured packages

[rafaeljbgomes]

Problem or use case

A configured package root import, such as import "date-fns", is redirected to a sandbox proxy. A package subpath import, such as import "date-fns/format", is not currently redirected and remains in the host bundle. This can make an application appear to rely on isolation when that import lies outside the demonstrated boundary.

Proposed change

Fail the Webpack build when a configured package is imported through a subpath. The diagnostic should name the configured package, the offending request, and explain that only exact root-package imports are isolated today.

This issue intentionally does not implement full subpath proxy generation; that is separate future work.

Alternatives considered

Full subpath proxy support could preserve more import patterns, but requires an explicit export-shape policy and compatibility evidence. Allowing the import silently is less safe because it leaves the dependency in the host bundle.

Security and compatibility impact

Configured root imports must retain their current redirect behavior. Configured-package subpath imports will become explicit build failures rather than silently bypassing the isolation boundary. Unconfigured package subpaths must remain unaffected.

Primary scope

Webpack plugin or proxy generation.

Acceptance criteria

• ESM and CommonJS configured-package subpath requests fail deterministically during Webpack compilation.
• The diagnostic identifies the request and remediation path.
• Exact configured root imports still redirect to generated proxies.
• Unconfigured package requests are unaffected.
• Focused import-redirection fixtures cover root, subpath, and unconfigured requests.
• Isolation-coverage documentation and the canonical specification are updated.

Would you like to contribute an implementation?

Implementation contributions are welcome. Please keep the change fail-closed and avoid introducing undocumented partial subpath support.