
Research
/Security News
npm Package Uses Prompt Injection and Token Flooding to Disrupt AI Malware Scanners
A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.
@isl-lang/import-resolver
Advanced tools
ISL import resolution - resolves local module imports, detects cycles, and bundles multi-file specs
ISL Import Resolution and Multi-File Bundling
The Import Resolver package provides functionality for resolving local module imports in ISL specifications, detecting cycles, and bundling multiple ISL files into a single AST.
./foo.isl and ../bar.isl style relative importsnpm install @isl-lang/import-resolver
# or
pnpm add @isl-lang/import-resolver
import { resolveAndBundle } from '@isl-lang/import-resolver';
const result = await resolveAndBundle('./main.isl', {
basePath: './specs',
enableImports: true,
});
if (result.success) {
console.log('Bundled AST:', result.bundle);
} else {
console.error('Errors:', result.errors);
}
import { parseSingleFile } from '@isl-lang/import-resolver';
const source = `
domain MyApp {
version: "1.0.0"
entity User { id: UUID }
}
`;
const result = parseSingleFile(source, 'spec.isl');
if (result.success) {
console.log('Parsed AST:', result.bundle);
} else {
// If the file has imports, this will fail with a clear error
// explaining that single-file mode doesn't support imports
console.error('Errors:', result.errors);
}
Only relative paths are supported:
imports {
User, Email from "./types.isl" # Same directory
Payment from "../billing/payment.isl" # Parent directory
Config from "./config" # Extension optional (.isl added)
}
The following import paths will result in errors:
imports {
User from "types.isl" # ❌ Not relative (missing ./)
User from "/absolute/path.isl" # ❌ Absolute paths not allowed
User from "@stdlib/auth" # ❌ Package imports not yet supported
}
Import specific symbols from a module:
imports {
User from "./types.isl" # Single import
User, Email, UserId from "./types.isl" # Multiple imports
User as AppUser from "./types.isl" # Aliased import
}
When bundling multiple files, the following are merged:
| Fragment Type | Merge Behavior |
|---|---|
| Types | Deduplicated by name (conflict if same name) |
| Entities | Deduplicated by name (conflict if same name) |
| Behaviors | Deduplicated by name (conflict if same name) |
| Invariants | Deduplicated by name (conflict if same name) |
| Policies | Deduplicated by name (conflict if same name) |
| Views | Deduplicated by name (conflict if same name) |
| Scenarios | All merged (duplicates allowed) |
| Chaos | All merged (duplicates allowed) |
By default, duplicate definitions result in errors:
[DUPLICATE_ENTITY] Duplicate entity "User" found:
First defined in: types.isl (line 5)
Also defined in: main.isl (line 10)
Each entity must have a unique name across all modules.
If you need to override definitions, enable shadowing:
const result = await resolveAndBundle('./main.isl', {
enableImports: true,
allowShadowing: true, // Last-write-wins
});
In shadowing mode:
The bundled AST maintains canonical ordering for deterministic output:
Circular dependencies are detected and reported with clear paths:
[CIRCULAR_DEPENDENCY] Circular dependency detected:
→ /specs/a.isl
→ /specs/b.isl
→ /specs/c.isl
→ /specs/a.isl
Circular imports are not allowed.
Consider restructuring your modules to break the cycle.
Diamond dependencies (multiple paths to the same module) are allowed:
main.isl
├── a.isl
│ └── shared.isl
└── b.isl
└── shared.isl
The shared module is only included once in the bundle.
import { hasImports } from '@isl-lang/import-resolver';
const needsImportResolution = hasImports(source);
if (needsImportResolution) {
// Use resolveAndBundle
} else {
// Can use parseSingleFile
}
When imports are disabled and a file has imports:
[IMPORTS_DISABLED] Import resolution is disabled (single-file mode).
Cannot import "./types.isl".
To enable multi-file imports, set 'enableImports: true' in resolver options.
Note: Multi-file mode requires all imported modules to be available.
resolveAndBundle(entryPoint, options)Resolve imports and bundle into a single AST.
interface ResolveAndBundleOptions {
basePath?: string; // Base directory for imports
enableImports?: boolean; // Enable/disable import resolution
allowShadowing?: boolean; // Allow definition shadowing
stripImports?: boolean; // Remove import declarations from bundle
bundleDomainName?: string; // Custom domain name for bundle
bundleVersion?: string; // Custom version for bundle
maxDepth?: number; // Max import depth (default: 100)
}
parseSingleFile(source, filename)Parse a single file without import resolution.
const result = parseSingleFile(source, 'spec.isl');
// Returns BundleResult
hasImports(source)Check if source has import declarations.
const hasImports: boolean = hasImports(source);
validateImportPaths(source)Validate import paths without resolution.
const { valid, errors } = validateImportPaths(source);
createVirtualFS(files, basePath)Create a virtual file system for testing.
const vfs = createVirtualFS({
'main.isl': 'domain Main { ... }',
'types.isl': 'domain Types { ... }',
}, '/test');
@stdlib/auth) not yet supported{ * } from "./module"import * as Types from "./types")| Code | Description |
|---|---|
IMPORTS_DISABLED | Import resolution disabled but file has imports |
MODULE_NOT_FOUND | Import target file not found |
PARSE_ERROR | Failed to parse imported module |
READ_ERROR | Failed to read file |
CIRCULAR_DEPENDENCY | Circular import detected |
MAX_DEPTH_EXCEEDED | Import chain too deep |
DUPLICATE_TYPE | Duplicate type definition |
DUPLICATE_ENTITY | Duplicate entity definition |
DUPLICATE_BEHAVIOR | Duplicate behavior definition |
SYMBOL_NOT_FOUND | Imported symbol not exported |
INVALID_IMPORT_PATH | Import path format invalid |
# Run tests
pnpm test
# Run tests with coverage
pnpm test:coverage
# Run tests in watch mode
pnpm test:watch
MIT
FAQs
ISL import resolution - resolves local module imports, detects cycles, and bundles multi-file specs
The npm package @isl-lang/import-resolver receives a total of 8 weekly downloads. As such, @isl-lang/import-resolver popularity was classified as not popular.
We found that @isl-lang/import-resolver demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.

Product
Socket now detects supply chain risks in project manifests, starting with missing lockfiles that can make dependency installs non-reproducible.

Research
/Security News
The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure.