# web-infra-dev/rspack — codebase unpack

> Canonical page: https://codevetter.com/unpack/rspack

This is a deterministic Repo Unpack scan of web-infra-dev/rspack — a structural map, not a review, security audit, or maintainer-endorsed description.

- Scanned commit: 179a0934f3091463419827fc2767af07b2fd38ed (2026-10-01)
- Last upstream commit: fix(types): allow omitting child compiler plugins (#15948)
- Generated by codevetter 1.15.0 on 2026-10-02
- 3997 files scanned · 13.9 MB

Source inspection; upstream code and tests were not executed.

## Languages

- JavaScript: 13875 files
- TypeScript: 3496 files
- Rust: 1384 files
- JSON: 909 files
- CSS: 891 files
- Markdown: 500 files
- TOML: 112 files
- HTML: 101 files

## Repository structure

- crates/ — 1317 files
- tests/ — 1316 files
- website/ — 569 files
- packages/ — 535 files
- xtask/ — 90 files
- .github/ — 46 files
- .agents/ — 45 files
- examples/ — 18 files

Probable source entrypoint: `Cargo.toml` (inferred from the tree, not upstream docs)

## Source layout — crates/

- crates/css-module-lexer/ — 20 files
- crates/node_binding/ — 8 files
- crates/rspack/ — 22 files
- crates/rspack_allocator/ — 2 files
- crates/rspack_binding_api/ — 135 files
- crates/rspack_binding_build/ — 3 files
- crates/rspack_binding_builder/ — 3 files

## Package

- Cargo.toml: null v0.102.8 — 0 declared dependencies

## Structural health signals

Average score 5.8/10 across 96 files; 75 hotspots. These are deterministic review leads, not proof of a bug.

## Recent history

- 179a0934f309 (2026-10-01) fix(types): allow omitting child compiler plugins (#15948)
- d925696de8f6 (2026-10-01) test: migrate persistent caching example to TypeScript (#15937)
- 81eca8ee3a51 (2026-09-30) perf(sources): compact retained source storage (#15944)
- 61dc72bca106 (2026-09-30) chore: release version 2.2.8 (#15907)
- 52c94ccffdcd (2026-09-30) fix(binding): release transient TSFN callbacks (#15938)

## Overview

Rspack is a Rust-based web bundler for application developers and tool authors who want a webpack-compatible JavaScript API, plugin hooks, and loader ecosystem. Its TypeScript layer handles configuration and developer-facing APIs while a Node-API binding delegates compilation, graph processing, and asset generation to Rust. The inspected implementation distinguishes persistent build caching from incremental recovery within a compiler lifecycle, and exposes build, development-server, and preview commands. This brief describes source at commit 179a0934f3091463419827fc2767af07b2fd38ed; inspection was bounded and no repository code was executed.

## System map

Rspack has three cooperating runtime layers: the JavaScript API, the native binding, and the Rust compilation engine. Compiler and Compilation have different lifetimes, while filesystem adapters and callback bridges connect the layers. Distribution includes npm packages, native bindings, and WASM variants rather than a single hosted service. The documentation website and repository automation have separate build responsibilities.
- The public core entrypoint attaches exports to the rspack function, aliases both rspack and webpack to that function, and provides CommonJS-compatible module.exports behavior. — [packages/rspack/src/index.ts#L1-16](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/index.ts#L1-L16)
- The CLI executable conditionally enables Node compile caching outside CI, imports the built CLI package, constructs RspackCLI, and passes process.argv to run. — [packages/rspack-cli/bin/rspack.js#L4-26](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/bin/rspack.js#L4-L26) [packages/rspack-cli/package.json#L14-24](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/package.json#L14-L24)
- Compiler.#getInstance lazily constructs binding.JsCompiler with raw options, builtin plugins, hook registrations, filesystem adapters, resolver access, cache, and binding helpers. — [packages/rspack/src/Compiler.ts#L944-1000](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L944-L1000)
- The Rust compiler constructs normal and context module factories, runs passes against Compilation, and collects plugin-driver diagnostics into that compilation. — [crates/rspack_core/src/compiler/mod.rs#L337-382](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/mod.rs#L337-L382) [crates/rspack_core/src/compiler/mod.rs#L633-645](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/mod.rs#L633-L645)
- NodeEnvironmentPlugin installs a CachedInputFileSystem with a 60000 ms duration, Node fs output, and either NativeWatchFileSystem or NodeWatchFileSystem according to experiments.nativeWatcher. — [packages/rspack/src/node/NodeEnvironmentPlugin.ts#L47-64](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/node/NodeEnvironmentPlugin.ts#L47-L64)
- Experimental new-cache storage supports optional memory and filesystem layers; its database selects TurboDatabase on native targets and NoopDatabase on WASM. — [crates/rspack_core/src/new_cache/cache.rs#L10-38](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/new_cache/cache.rs#L10-L38) [crates/rspack_core/src/new_cache/db/mod.rs#L23-30](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/new_cache/db/mod.rs#L23-L30)
- The Cargo workspace includes crates and xtask members with Rust 2024 metadata; pnpm includes packages, bindings, website, and test workspaces, and root scripts build the binding before JS in build:cli:dev. — [Cargo.toml#L1-14](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/Cargo.toml#L1-L14) [pnpm-workspace.yaml#L1-16](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/pnpm-workspace.yaml#L1-L16) [package.json#L13-25](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/package.json#L13-L25)
- Release automation builds platform-specific npm bindings including WASI and browser variants; the separate website package uses rs doc and React/Rspress dependencies. — [.github/workflows/reusable-release-npm.yml#L97-115](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.github/workflows/reusable-release-npm.yml#L97-L115) [website/package.json#L7-29](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/website/package.json#L7-L29)

## Feature catalog

The inspected public surface includes programmatic compilation, CLI building, live development, and static preview. Configuration controls target environments, loaders, optimization, output, caching, and watch behavior. Public plugin namespaces expose federation, runtime, and chunk-loading capabilities. Compatibility has documented exceptions, so the webpack-shaped API does not establish universal feature parity.
- rspack accepts single or multiple configurations; array configurations create a MultiCompiler and register each child's named dependencies. — [packages/rspack/src/rspack.ts#L31-48](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/rspack.ts#L31-L48) [packages/rspack/src/rspack.ts#L95-123](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/rspack.ts#L95-L123)
- The default CLI build command has build, bundle, and b aliases; --json streams stats to stdout or a requested file, and compilation errors set exitCode to 1. — [packages/rspack-cli/src/commands/build.ts#L39-99](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/commands/build.ts#L39-L99) [packages/rspack-cli/src/commands/build.ts#L120-137](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/commands/build.ts#L120-L137)
- serve has server, s, and dev aliases and exposes hot, host, port, and browser-opening options; it requires the optional @rspack/dev-server package. — [packages/rspack-cli/src/commands/serve.ts#L40-91](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/commands/serve.ts#L40-L91) [packages/rspack-cli/package.json#L52-59](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/package.json#L52-L59)
- preview serves a requested directory, output.path, or context/dist using an empty-entry compiler; it disables HMR and preserves configured proxy and historyApiFallback settings. — [packages/rspack-cli/src/commands/preview.ts#L80-97](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/commands/preview.ts#L80-L97) [packages/rspack-cli/src/commands/preview.ts#L118-136](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/commands/preview.ts#L118-L136)
- JavaScript loader execution supports pitching and reverse-order normal execution, optional worker delegation, cached loader results, source maps, and additional data. — [packages/rspack/src/loader-runner/index.ts#L1084-1131](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/loader-runner/index.ts#L1084-L1131) [packages/rspack/src/loader-runner/index.ts#L1136-1203](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/loader-runner/index.ts#L1136-L1203)
- The bundling pipeline includes tree shaking, splitting, JS/CSS minification, and source-map generation; options processing installs SplitChunksPlugin conditionally and warns about mixed modern-module library formats. — [.agents/ARCHITECTURE.md#L139-152](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/ARCHITECTURE.md#L139-L152) [packages/rspack/src/rspackOptionsApply.ts#L325-350](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/rspackOptionsApply.ts#L325-L350)
- Public namespaces expose ModuleFederationPlugin and ModuleFederationPluginV1, container/reference plugins, WebAssembly loading, and JavaScript chunk-loading plugins. — [packages/rspack/src/exports.ts#L230-251](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/exports.ts#L230-L251) [packages/rspack/src/exports.ts#L287-319](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/exports.ts#L287-L319)
- Filesystem caching exposes readonly, version, memory-generation, and idle-timeout controls; HTTP URI imports separately expose allowedUris, remote cache/lockfile locations, frozen, upgrade, and custom httpClient options. — [crates/rspack_core/src/new_cache/mod.rs#L70-94](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/new_cache/mod.rs#L70-L94) [packages/rspack/src/builtin-plugin/HttpUriPlugin.ts#L15-45](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/builtin-plugin/HttpUriPlugin.ts#L15-L45)

## Data flow

Configuration enters through either the JavaScript API or CLI loading, then becomes normalized options and native binding inputs. Loader results and compiler passes populate compilation state before assets cross the output filesystem boundary. Rebuilds carry changed paths and prior artifacts into a new compilation. Cache storage follows a separate path with namespaced keys, memory lookup, disk restoration, and deferred persistence.
- CLI config loading resolves an explicit path or discovers rspack.config, passes env and CLI options to baseLoadConfig with fresh:true, and rejects exports that are neither an object nor an array. — [packages/rspack-cli/src/utils/loadConfig.ts#L21-44](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/utils/loadConfig.ts#L21-L44) [packages/rspack-cli/src/utils/loadConfig.ts#L252-276](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/utils/loadConfig.ts#L252-L276)
- loadExtendedConfig resolves file URLs, relative/absolute paths, or packages, recursively merges base configuration beneath the current result, and accumulates loaded paths in a WeakMap. — [packages/rspack-cli/src/utils/loadConfig.ts#L174-213](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/utils/loadConfig.ts#L174-L213) [packages/rspack-cli/src/utils/loadConfig.ts#L222-246](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/utils/loadConfig.ts#L222-L246)
- createCompiler normalizes options and installs the Node environment before user plugins; it then applies full defaults and options-driven plugins before initialize. — [packages/rspack/src/rspack.ts#L51-88](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/rspack.ts#L51-L88)
- The JS-to-Rust boundary includes builtin rule references and virtual files in raw options, and adapts input filesystem callbacks only when ThreadsafeInputNodeFS.needsBinding permits it. — [packages/rspack/src/Compiler.ts#L956-988](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L956-L988)
- Normal loaders consume content, sourceMap, and additionalData; a cache hit restores these values, while executed loaders return transformed values that can be stored for reuse. — [packages/rspack/src/loader-runner/index.ts#L1136-1203](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/loader-runner/index.ts#L1136-L1203)
- Pass execution checks is_enabled, recovers pass-associated incremental artifacts, invokes cache restore hooks, runs the pass, then invokes save hooks and captures artifacts only after success. — [crates/rspack_core/src/compilation/pass.rs#L65-96](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compilation/pass.rs#L65-L96)
- CompilerCache prefixes facade names with compiler_path; Cache.get checks memory first, falls through to disk only for NotCached, and records disk hits or misses in memory. — [crates/rspack_core/src/new_cache/cache.rs#L45-76](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/new_cache/cache.rs#L45-L76) [crates/rspack_core/src/new_cache/cache.rs#L142-168](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/new_cache/cache.rs#L142-L168)
- Asset output strips filename queries, joins the target with the configured output path, compares existing content when configured, writes through output_filesystem, and calls asset_emitted with source and target metadata. — [crates/rspack_core/src/compiler/mod.rs#L495-511](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/mod.rs#L495-L511) [crates/rspack_core/src/compiler/mod.rs#L527-573](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/mod.rs#L527-L573)

## Behavior traces

Four concrete source traces were followed: CLI startup and build, asset emission, watch rebuild, and experimental filesystem-cache persistence. Their order crosses JavaScript callbacks and asynchronous Rust execution. Several lifecycle hooks can suppress output, request another pass, or delay shutdown. The traces describe implemented control flow without asserting successful execution.
- Startup proceeds runCLI → new RspackCLI → run → registerCommands → each command.apply → CAC.parse; run then awaits the action promise captured by wrapAction. — [packages/rspack-cli/bin/rspack.js#L17-20](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/bin/rspack.js#L17-L20) [packages/rspack-cli/src/cli.ts#L83-92](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/cli.ts#L83-L92) [packages/rspack-cli/src/cli.ts#L181-201](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/cli.ts#L181-L201)
- Build startup proceeds runBuild → setDefaultNodeEnv/normalizeCommonOptions → buildCompilerConfig → loadConfig/buildConfig → createCompiler; a watch compiler returns immediately, while a one-shot compiler runs and closes before reporting stats. — [packages/rspack-cli/src/commands/build.ts#L23-25](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/commands/build.ts#L23-L25) [packages/rspack-cli/src/cli.ts#L95-121](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/cli.ts#L95-L121) [packages/rspack-cli/src/commands/build.ts#L103-117](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/commands/build.ts#L103-L117)
- Compiler.run rejects concurrent execution, invokes beforeRun → run → compile, and may repeat compile after needAdditionalPass and additionalPass before its final done callback. — [packages/rspack/src/Compiler.ts#L563-565](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L563-L565) [packages/rspack/src/Compiler.ts#L595-622](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L595-L622) [packages/rspack/src/Compiler.ts#L625-646](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L625-L646)
- Compiler.compile invokes beforeCompile → compile hook → #build; initial #build calls JsCompiler.build, whose callbackified future calls Rust Compiler.build → build_inner → compile → after_compile → compile_done. — [packages/rspack/src/Compiler.ts#L798-818](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L798-L818) [packages/rspack/src/Compiler.ts#L850-865](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L850-L865) [crates/rspack_binding_api/src/lib.rs#L440-463](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_binding_api/src/lib.rs#L440-L463) [crates/rspack_core/src/compiler/mod.rs#L320-330](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/mod.rs#L320-L330)
- Output proceeds compile_done → should_record → should_emit; unless should_emit returns false, emit_assets resolves output.path, runs cleaning, calls emit, writes selected assets, and calls after_emit. — [crates/rspack_core/src/compiler/mod.rs#L386-439](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/mod.rs#L386-L439) [crates/rspack_core/src/compiler/mod.rs#L447-493](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/mod.rs#L447-L493)
- A watch invalidation merges changed/removed paths and either queues invalidation during a running build or enters #go; #go pauses the watcher, assigns deltas, invokes watchRun → compile, and completed delivery watches current dependency sets again. — [packages/rspack/src/Watching.ts#L251-290](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Watching.ts#L251-L290) [packages/rspack/src/Watching.ts#L313-359](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Watching.ts#L313-L359) [packages/rspack/src/Watching.ts#L473-490](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Watching.ts#L473-L490)
- Subsequent #build calls JsCompiler.rebuild with file arrays; Rust rebuild_inner clears resolver/plugin caches, creates a hot Compilation, stores the previous compilation in IncrementalArtifacts, then compiles and emits through compile_done. — [packages/rspack/src/Compiler.ts#L850-864](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L850-L864) [crates/rspack_binding_api/src/lib.rs#L478-496](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_binding_api/src/lib.rs#L478-L496) [crates/rspack_core/src/compiler/rebuild.rs#L73-134](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/rebuild.rs#L73-L134)
- Experimental persistence proceeds create_cache → IdleFileCache background job → FileCacheStrategy.db_init/validation; build completion calls cache.beginIdle, while Compiler.close calls cache.shutdown, whose binding awaits native shutdown before native compiler close. — [crates/rspack_core/src/new_cache/mod.rs#L70-94](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/new_cache/mod.rs#L70-L94) [crates/rspack_core/src/new_cache/idle_file_cache.rs#L54-88](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/new_cache/idle_file_cache.rs#L54-L88) [packages/rspack/src/Compiler.ts#L572-575](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L572-L575) [packages/rspack/src/Compiler.ts#L832-847](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L832-L847)

## Testing signals

Tests and CI were inspected, not executed; no passing result is claimed. The inspected harness uses Rstest through rs test, Playwright integration for browser behavior, TypeScript checks, and Rust tests. It includes explicit exclusions and opt-in compatibility suites that limit what a default run establishes. This was bounded source inspection, not exhaustive coverage analysis.
- The integration package uses rs test with base and hottest projects; the Rstest configuration supplies shared setup files, globals, snapshot formatting, and three retries in CI. — [tests/rspack-test/package.json#L9-14](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/package.json#L9-L14) [tests/rspack-test/rstack.config.mts#L15-19](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/rstack.config.mts#L15-L19) [tests/rspack-test/rstack.config.mts#L81-110](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/rstack.config.mts#L81-L110)
- NewCache.test.mjs defaults to newCacheCases; normalCases/configCases compatibility runs require NEW_CACHE_CASES selection, and the cache processor asserts cache-stat snapshots and expected unchanged-build hit rates. — [tests/rspack-test/NewCache.test.mjs#L4-16](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/NewCache.test.mjs#L4-L16) [tests/rspack-test/NewCache.test.mjs#L39-65](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/NewCache.test.mjs#L39-L65) [packages/rspack-test-tools/src/case/cache.ts#L99-130](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-test-tools/src/case/cache.ts#L99-L130)
- The new-cache runner explicitly excludes max-age, restored loader diagnostics, coffee-loader, extract-amd, restored async-block binding access, and stateful rebuild-module cases; its comments describe unfinished compatibility. — [tests/rspack-test/NewCache.test.mjs#L19-36](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/NewCache.test.mjs#L19-L36)
- Incremental-watch testing reuses watchCases through createWatchIncrementalCase; native watcher tests run in a separate project with retry:0 and maxConcurrency:1. — [tests/rspack-test/Incremental-watch.test.mjs#L7-23](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/Incremental-watch.test.mjs#L7-L23) [tests/rspack-test/rstack.config.mts#L148-169](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/rstack.config.mts#L148-L169)
- Browser E2E uses @rstest/playwright configuration; the inspected cross-origin lazy-compilation test clicks a dynamic-import trigger and asserts a rendered component plus a text/plain POST request. — [tests/e2e/config.ts#L16-37](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/e2e/config.ts#L16-L37) [tests/e2e/cases/lazy-compilation/cross-origin/index.test.ts#L118-156](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/e2e/cases/lazy-compilation/cross-origin/index.test.ts#L118-L156)
- API type tests invoke tsc --noEmit separately for bundler and NodeNext module-resolution configurations, providing compile-time checks rather than runtime behavior tests. — [tests/type-tests/package.json#L5-11](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/type-tests/package.json#L5-L11)
- Inspected Rust snapshot tests use tokio::test for unchanged and changed filesystem states; Rust CI runs codegen, Clippy, formatting, workspace tests with exclusions, and separate watcher jobs. — [crates/rspack_core/src/new_cache/snapshot/file_system_info/tests/hash.rs#L6-31](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/new_cache/snapshot/file_system_info/tests/hash.rs#L6-L31) [.github/workflows/reusable-rust-test.yml#L56-65](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.github/workflows/reusable-rust-test.yml#L56-L65) [.github/workflows/reusable-rust-test.yml#L108-142](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.github/workflows/reusable-rust-test.yml#L108-L142)
- JS CI downloads binding artifacts and invokes test:ci on supported targets; WASM runs use WASM=1, but the harness excludes cache, incremental, native watcher, and several API/stat suites under WASM. — [.github/workflows/reusable-build-test.yml#L123-145](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.github/workflows/reusable-build-test.yml#L123-L145) [.github/workflows/reusable-build-test.yml#L183-191](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.github/workflows/reusable-build-test.yml#L183-L191) [tests/rspack-test/rstack.config.mts#L21-44](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/rstack.config.mts#L21-L44) [package.json#L45-46](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/package.json#L45-L46)

## Risk map

The principal sensitive boundaries are executable build inputs, output deletion/writes, remote-resource fetching, and native-backed JavaScript lifetimes. Source contains protective conditions as well as compatibility limitations. The observations below are not confirmed vulnerabilities, and the single resource-exhaustion concern is explicitly a hypothesis. Partial inspection does not establish the absence of other guards or tests.
- Configuration loading invokes an external config loader with parameters, and plugins/loaders execute supplied functions; this is an execution trust boundary for build inputs. — [packages/rspack-cli/src/utils/loadConfig.ts#L21-32](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/utils/loadConfig.ts#L21-L32) [packages/rspack/src/rspack.ts#L68-74](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/rspack.ts#L68-L74) [packages/rspack/src/loader-runner/index.ts#L1176-1195](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/loader-runner/index.ts#L1176-L1195)
- output.clean can recursively remove the configured output directory, while CLI outputPath resolves against cwd; these operations target configured filesystem locations rather than a repository-root confinement boundary. — [packages/rspack-cli/src/cli.ts#L218-222](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/cli.ts#L218-L222) [crates/rspack_core/src/compiler/mod.rs#L578-606](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/mod.rs#L578-L606)
- HTTP imports cross a network boundary guarded by allowed_uris; redirect validation permits only HTTP(S) and rechecks the target against allowed URIs. — [crates/rspack_plugin_schemes/src/http_uri/mod.rs#L30-43](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_plugin_schemes/src/http_uri/mod.rs#L30-L43) [crates/rspack_plugin_schemes/src/http_uri/mod.rs#L61-92](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_plugin_schemes/src/http_uri/mod.rs#L61-L92)
- Hypothesis: the inspected Node HTTP client may consume substantial memory for large or highly compressed responses because it decompresses streams, collects every chunk, and concatenates the body without a size limit visible in this function. (inferred) — [packages/rspack/src/builtin-plugin/HttpUriPlugin.ts#L64-95](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/builtin-plugin/HttpUriPlugin.ts#L64-L95)
- Native-backed class access depends on wrapper-specific stale-target policies and hook/loader execution windows; retained Compilation wrappers deliberately resolve to the latest native compilation after rebuild. — [.agents/BINDING.md#L35-76](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/BINDING.md#L35-L76) [.agents/BINDING.md#L80-98](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/BINDING.md#L80-L98)
- Native close extends a compiler reference to a static lifetime under an explicit N-API ownership argument, waits for in-flight work to become idle, and releases compiler-scoped callback handles in finally. — [crates/rspack_binding_api/src/lib.rs#L502-543](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_binding_api/src/lib.rs#L502-L543) [crates/rspack_binding_api/src/compiler.rs#L52-69](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_binding_api/src/compiler.rs#L52-L69)
- PluginDriver::new panics through expect when plugin.apply returns an error; Compiler.compile also documents that afterCompile ordering is driven from Rust, making plugin initialization and hook sequencing high-impact coupling points. — [crates/rspack_core/src/plugin/plugin_driver.rs#L43-57](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/plugin/plugin_driver.rs#L43-L57) [packages/rspack/src/Compiler.ts#L812-817](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L812-L817)
- New-cache compatibility exclusions and WASM cache-suite exclusions limit default validation; the WASM database is a no-op, so native persistence behavior must not be assumed for that target. — [tests/rspack-test/NewCache.test.mjs#L19-36](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/NewCache.test.mjs#L19-L36) [tests/rspack-test/rstack.config.mts#L34-44](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/rstack.config.mts#L34-L44) [crates/rspack_core/src/new_cache/db/mod.rs#L23-30](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/new_cache/db/mod.rs#L23-L30)

## Extension points

Rspack offers extension seams at the CLI, configuration, compiler hooks, native plugins, module-type parsing, loaders, filesystems, and cache services. JavaScript and Rust plugin models meet through staged hook registrations. New behavior should attach to the owning lifecycle rather than bypass its boundaries. The inspected factories and registries make these integration points concrete.
- New CLI commands implement apply(cli) and join RspackCLI.registerCommands' builtin command list; asynchronous actions use wrapAction so run can await their failures. — [packages/rspack-cli/src/cli.ts#L83-92](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/cli.ts#L83-L92) [packages/rspack-cli/src/cli.ts#L193-201](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/cli.ts#L193-L201) [packages/rspack-cli/src/commands/build.ts#L120-137](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/commands/build.ts#L120-L137)
- Configuration accepts function plugins called with the compiler as receiver and argument, or object plugins with apply(compiler); definePlugin provides typed identity helpers for both shapes. — [packages/rspack/src/rspack.ts#L68-75](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/rspack.ts#L68-L75) [packages/rspack-cli/src/cli.ts#L430-438](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack-cli/src/cli.ts#L430-L438)
- Rust plugins implement Plugin: Debug + Send + Sync with apply(ApplyContext), name, and clear_cache; PluginExt boxes implementations into BoxPlugin. — [crates/rspack_core/src/plugin/mod.rs#L12-33](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/plugin/mod.rs#L12-L33)
- PluginDriver supplies ApplyContext with compiler/compilation/factory hooks and a ModuleType-keyed parser-and-generator builder registry. — [crates/rspack_core/src/plugin/plugin_driver.rs#L14-28](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/plugin/plugin_driver.rs#L14-L28) [crates/rspack_core/src/plugin/plugin_driver.rs#L37-58](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/plugin/plugin_driver.rs#L37-L58)
- PassExt supports run_pass, cache-aware execution, incremental artifact groups, before/after cache hooks, and is_enabled, allowing conditional compilation transformations within the shared runner. — [crates/rspack_core/src/compilation/pass.rs#L15-52](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compilation/pass.rs#L15-L52)
- CompilerBuilder accepts extra plugins and independent readable, intermediate, and writable filesystem implementations; build combines configured builtin plugins with supplied plugins. — [crates/rspack/src/builder/mod.rs#L417-456](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack/src/builder/mod.rs#L417-L456)
- JavaScript hook bridging partitions taps by stage ranges, skips unused hooks, and updates non-skippable registration kinds when hook usage changes. — [packages/rspack/src/Compiler.ts#L1064-1079](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L1064-L1079) [packages/rspack/src/Compiler.ts#L1105-1137](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/Compiler.ts#L1105-L1137)
- Compiler.get_cache exposes namespaced CacheFacade views, while HttpUriPlugin accepts a custom httpClient and configurable filesystem-backed remote cache/lockfile locations. — [crates/rspack_core/src/compiler/mod.rs#L211-212](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/mod.rs#L211-L212) [crates/rspack_core/src/new_cache/cache.rs#L165-168](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/new_cache/cache.rs#L165-L168) [packages/rspack/src/builtin-plugin/HttpUriPlugin.ts#L21-45](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/packages/rspack/src/builtin-plugin/HttpUriPlugin.ts#L21-L45) [crates/rspack_plugin_schemes/src/http_uri/mod.rs#L104-110](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_plugin_schemes/src/http_uri/mod.rs#L104-L110)

## Contributor handoff

Use this brief as a source map for the pinned commit, then recheck the exact subsystem before editing. Tests and CI were inspected, not executed, and the bounded inventory does not establish exhaustive coverage or passing behavior. Repository conventions require building consumed artifacts before validation and reusing existing test harnesses. Cache ownership, native lifetimes, and hook ordering deserve focused attention because changes cross runtime boundaries.
- For future authorized validation, build JS changes with build:js, Rust changes with build:binding:dev, or both with build:cli:dev before running tests that consume those artifacts. — [AGENTS.md#L5-7](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/AGENTS.md#L5-L7) [.agents/DEVELOPMENT.md#L11-24](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/DEVELOPMENT.md#L11-L24)
- Focused integration validation uses pnpm --dir tests/rspack-test run test -t followed by a case pattern; base, HMR, E2E, type, and Rust checks have separate documented commands. — [.agents/DEVELOPMENT.md#L26-33](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/DEVELOPMENT.md#L26-L33) [tests/rspack-test/package.json#L9-14](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/tests/rspack-test/package.json#L9-L14)
- Add JavaScript cases beneath existing case directories and reuse runners; AGENTS.md forbids ordinary new inline/crate-local Rust tests despite the testing guide's older inline-test example. — [AGENTS.md#L9-12](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/AGENTS.md#L9-L12) [website/docs/en/contribute/development/testing.mdx#L19-34](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/website/docs/en/contribute/development/testing.mdx#L19-L34) [website/docs/en/contribute/development/testing.mdx#L75-86](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/website/docs/en/contribute/development/testing.mdx#L75-L86)
- Before binding changes, account for both conversion directions, native-backed wrapper access windows, stale-target policies, and compiler-scoped thread-safe callback release. — [.agents/BINDING.md#L15-25](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/BINDING.md#L15-L25) [.agents/BINDING.md#L50-76](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/BINDING.md#L50-L76) [.agents/BINDING.md#L154-180](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/BINDING.md#L154-L180)
- Cache edits must preserve independence from incremental recovery: cache:false cannot clear IncrementalPasses, incremental:false cannot disable cache lookup/storage, and prior compilations belong to IncrementalArtifacts. — [.agents/CACHE_AND_INCREMENTAL.md#L166-183](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/CACHE_AND_INCREMENTAL.md#L166-L183) [crates/rspack_core/src/compiler/rebuild.rs#L111-118](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/rebuild.rs#L111-L118)
- Scheduling edits should follow the documented preference for Rayon for synchronous CPU work and rspack_parallel for async orchestration; asset emission already uses a semaphore-limited parallel scope. — [.agents/ARCHITECTURE.md#L274-281](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/ARCHITECTURE.md#L274-L281) [crates/rspack_core/src/compiler/mod.rs#L447-480](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/crates/rspack_core/src/compiler/mod.rs#L447-L480)
- Public behavior changes require relevant English and Chinese documentation and the PR template; compatibility policy permits documented limitations, and the support table explicitly records partial plugin support. — [AGENTS.md#L14-17](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/AGENTS.md#L14-L17) [.github/PULL_REQUEST_TEMPLATE.md#L1-7](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.github/PULL_REQUEST_TEMPLATE.md#L1-L7) [.agents/API_DESIGN.md#L7-32](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/API_DESIGN.md#L7-L32) [website/components/PluginSupportStatusTable.tsx#L75-81](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/website/components/PluginSupportStatusTable.tsx#L75-L81)
- Use the pinned nightly toolchain and pnpm version, and check Clone/error-handling conventions before Rust edits; inspected test scripts and CI definitions are validation instructions, not evidence that checks passed. — [rust-toolchain.toml#L1-5](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/rust-toolchain.toml#L1-L5) [package.json#L52-66](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/package.json#L52-L66) [.agents/CODE_STYLE.md#L51-61](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.agents/CODE_STYLE.md#L51-L61) [.github/workflows/reusable-build-test.yml#L142-145](https://github.com/web-infra-dev/rspack/blob/179a0934f3091463419827fc2767af07b2fd38ed/.github/workflows/reusable-build-test.yml#L142-L145)

Source repository: https://github.com/web-infra-dev/rspack
Full evidence corpus: https://github.com/Codevetter/codevetter/tree/main/benchmarks/repo-unpacks/rspack.json

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)