fix: register non-JS modules so we can report violations

danielroe · danielroe · commit 566ff3df7242 · 2026-03-09T14:26:08.000Z
diff --git a/src/index.ts b/src/index.ts
@@ -515,9 +515,12 @@ export const ImpoundPlugin = createUnplugin<ImpoundOptions>((globalOptions) => {
     // shared transform logic for module graph building and flushing pending violations.
     async function traceTransform(code: string, id: string, getCombinedSourcemap?: () => unknown): Promise<void> {
       await init
+      let importMap = new Map<string, ImportLocation>()
+      let originalCode: string | undefined
+      let sourceMap: unknown
+
       try {
         const [imports] = parse(code, id)
-        const importMap = new Map<string, ImportLocation>()
         for (const imp of imports) {
           if (imp.n) {
             const { line, column } = offsetToLineColumn(code, imp.s)
@@ -531,8 +534,6 @@ export const ImpoundPlugin = createUnplugin<ImpoundOptions>((globalOptions) => {
         }
 
         // extract the combined source map for original-source snippets.
-        let originalCode: string | undefined
-        let sourceMap: unknown
         if (getCombinedSourcemap) {
           try {
             const map = getCombinedSourcemap() as { mappings?: string, sourcesContent?: (string | null)[] } | undefined
@@ -548,28 +549,31 @@ export const ImpoundPlugin = createUnplugin<ImpoundOptions>((globalOptions) => {
             // getCombinedSourcemap may throw &mdash; fall back to transformed code
           }
         }
-
-        const graphEntry: ModuleGraphEntry = { code, originalCode, sourceMap, imports: importMap }
-        moduleGraph.set(id, graphEntry)
-        // Also store under normalized key forms so enrichAndReport can find it
-        // when the importer path format differs (e.g. with/without query string)
-        /* v8 ignore start -- defensive normalization for framework-specific virtual module IDs */
-        const bareId = id.split('?')[0]!
-        if (bareId !== id)
-          moduleGraph.set(bareId, graphEntry)
-        if (isAbsolute(id) && globalOptions.cwd) {
-          const relId = relative(globalOptions.cwd, id)
-          moduleGraph.set(relId, graphEntry)
-          const relBareId = relId.split('?')[0]!
-          if (relBareId !== relId)
-            moduleGraph.set(relBareId, graphEntry)
-        }
-        /* v8 ignore stop */
       }
       catch {
-        // If parsing fails (e.g. non-JS asset), just skip
+        // If parsing fails (e.g. non-JS asset like a raw Vue SFC), use empty imports.
+        // We still register the module in the graph so that resolveId can find
+        // the importer and report violations immediately instead of deferring them.
+        importMap = new Map()
       }
 
+      const graphEntry: ModuleGraphEntry = { code, originalCode, sourceMap, imports: importMap }
+      moduleGraph.set(id, graphEntry)
+      // Also store under normalized key forms so enrichAndReport can find it
+      // when the importer path format differs (e.g. with/without query string)
+      /* v8 ignore start -- defensive normalization for framework-specific virtual module IDs */
+      const bareId = id.split('?')[0]!
+      if (bareId !== id)
+        moduleGraph.set(bareId, graphEntry)
+      if (isAbsolute(id) && globalOptions.cwd) {
+        const relId = relative(globalOptions.cwd, id)
+        moduleGraph.set(relId, graphEntry)
+        const relBareId = relId.split('?')[0]!
+        if (relBareId !== relId)
+          moduleGraph.set(relBareId, graphEntry)
+      }
+      /* v8 ignore stop */
+
       // Flush any violations that were waiting for this module's transform.
       // Check multiple key forms since resolveId may use relative paths while
       // transform receives absolute paths (or vice versa with query strings).
diff --git a/test/index.test.ts b/test/index.test.ts
@@ -934,6 +934,28 @@ describe('trace mode (deferred violations)', () => {
     // Should not throw &mdash; just skip the dynamic import entry
   })
 
+  it('registers module in graph even when parsing fails (e.g. Vue SFC)', async () => {
+    // When es-module-lexer can't parse a file (like a raw Vue SFC), the module should
+    // still be registered in the graph so that resolveId can report violations immediately.
+    const plugins = ImpoundPlugin.rollup({ trace: true, patterns: [['secret', 'Not allowed']] })
+    const pluginArray = Array.isArray(plugins) ? plugins : [plugins]
+    const impoundPlugin = pluginArray.find(p => p.name === 'impound')!
+    const tracePlugin = pluginArray.find(p => p.name === 'impound:trace')!
+
+    const errors: string[] = []
+    const context = { error: (msg: string) => errors.push(msg) }
+
+    // Transform with unparseable SFC content &mdash; parse will fail
+    await (tracePlugin as any).transform('<script setup>\nimport secret from "secret"\n</script>', 'app.vue')
+
+    // resolveId should find the importer in the graph and report immediately
+    await (impoundPlugin as any).resolveId.call(context, 'secret', 'app.vue')
+    expect(errors).toHaveLength(1)
+    expect(errors[0]).toContain('Not allowed')
+    // No Code: section since parsing failed and import locations are empty
+    expect(errors[0]).not.toContain('Code:')
+  })
+
   it('tracks resolved imports across multiple resolveIds from same importer', async () => {
     const plugins = ImpoundPlugin.rollup({ trace: true, patterns: [['secret', 'Not allowed']] })
     const pluginArray = Array.isArray(plugins) ? plugins : [plugins]
