Should not expose dependencies package's require

[Stuk]

In montage we depend on collections, and currently a user can do require("montage/collections"). This shouldn't be possible

[kriskowal]

That’s debatable, and fixing that emergent pattern would require significant complication. We would need to separate public and private module identifier name spaces and there would be some overlap.

A related issue is that we don’t mimic Node’s module identifier namespace semantics perfectly. That is, in Node, you can only access internal modules with relative module identifiers and dependencies only with top-level module identifiers.

If we solve one inconsistency, we can probably solve both.

[kriskowal]

It’s worth noting that separating those name spaces would have some impact on how we use module identifiers throughout Montage.

[Stuk]

To add to the debate: dependencies are an implementation detail. One should be able to swap them out without affecting the accesible API.

[kriskowal]

We should entertain an experiment in v2. We can separate the internal and external name spaces of a package, and instead of normalizing module identifiers to be relative to the package root, decide whether to use the internal or external name space based on whether the identifier starts with . or ... This would make our implementation match the behavior of Node.js, and break everything that uses mr@<2, but would be feasible in the v2 timeline (which I’m holding in suspended animation until further notice).

This would be a pretty significant refactor. Would you up for it any time in the next six months @Stuk?

[Stuk]

I can add it to the plate and see what happens :)