Script Loader: Walk deps of empty-scoped queued entry points.

A module registered with `scopes => array()` and enqueued is an entry point: it is
emitted as a `<script type="module">` and its imports must resolve in the browser
even though its own bare specifier resolves nowhere. The dependency walk in
`get_import_map()` previously stopped at every empty-scoped node, including the
starting node, leaving the entry's deps absent from the import map.

Stop traversal at *transitive* empty-scoped nodes only. Starting nodes (queue
items and classic-script `module_dependencies`) are now exempt. The leak
prevention for empty-scoped modules reached only via dep edges is preserved.

Author: sirreal

src/wp-includes/class-wp-script-modules.php

@@ -812,20 +812,28 @@ private function get_import_map(): array {
 		 * but they appear via dep edges of other modules — matching prior behavior of
 		 * `get_dependencies()`.
 		 *
-		 * Modules registered with empty scopes (`scopes => array()`) are not traversed:
-		 * their transitive deps are unreachable via bare specifier from any importer, so
-		 * walking through them would leak otherwise-private deps into top-level `imports`.
+		 * Modules registered with empty scopes (`scopes => array()`) reached as a *transitive*
+		 * dep are not traversed: their deps are unreachable via bare specifier from any importer,
+		 * so walking through them would leak otherwise-private deps into top-level `imports`.
+		 *
+		 * The starting nodes (queue items + classic-script module dependencies) are exempt
+		 * from this stop rule: queued empty-scoped modules are still entry points whose deps
+		 * must resolve when their `<script>` tag executes in the browser.
 		 */
 		$collected_dependencies = array();
-		$id_queue               = array_merge( $this->queue, $classic_script_module_dependencies );
+		$id_queue               = array();
+		foreach ( array_merge( $this->queue, $classic_script_module_dependencies ) as $start_id ) {
+			$id_queue[] = array( $start_id, true );
+		}
 		while ( ! empty( $id_queue ) ) {
-			$current_id = array_shift( $id_queue );
+			list( $current_id, $is_starting_node ) = array_shift( $id_queue );
 			if ( ! isset( $this->registered[ $current_id ] ) ) {
 				continue;
 			}
 
-			// Stop at empty-scoped modules.
+			// Stop traversal at transitive empty-scoped modules; entry points are exempt.
 			if (
+				! $is_starting_node &&
 				isset( $this->registered[ $current_id ]['scopes'] ) &&
 				array() === $this->registered[ $current_id ]['scopes']
 			) {
@@ -838,7 +846,7 @@ private function get_import_map(): array {
 					isset( $this->registered[ $dependency['id'] ] )
 				) {
 					$collected_dependencies[ $dependency['id'] ] = true;
-					$id_queue[]                                  = $dependency['id'];
+					$id_queue[]                                  = array( $dependency['id'], false );
 				}
 			}
 		}

tests/phpunit/tests/script-modules/wpScriptModules.php

@@ -3418,6 +3418,66 @@ public function test_scopes_classic_script_module_dep_on_empty_scoped_warns() {
 		$this->assertArrayNotHasKey( 'scopes', $map );
 	}
 
+	/**
+	 * A queued module with `scopes => array()` is treated as an entry point: its transitive
+	 * deps are still walked and emitted in the import map so the entry's imports resolve.
+	 *
+	 * Regression: previously the walk stopped at *every* empty-scoped node, including the
+	 * starting node, leaving the entry's deps absent from the import map.
+	 *
+	 * @covers WP_Script_Modules::get_import_map
+	 */
+	public function test_scopes_empty_queued_entry_still_emits_dep_imports() {
+		$this->script_modules->register(
+			'@plugin/utils',
+			'/wp-content/plugins/x/utils.js',
+			array(),
+			null,
+			array( 'scopes' => array( '/wp-content/plugins/x/' ) )
+		);
+		$this->script_modules->register(
+			'@plugin/lib',
+			'/wp-content/plugins/x/lib.js',
+			array(
+				array(
+					'id'     => '@plugin/utils',
+					'import' => 'dynamic',
+				),
+			),
+			null,
+			array( 'scopes' => array( '/wp-content/plugins/x/' ) )
+		);
+		// Public dep simulating @wordpress/* etc.
+		$this->script_modules->register( '@public/dep', '/wp-content/plugins/x/dep.js' );
+		$this->script_modules->register(
+			'@plugin/main',
+			'/wp-content/plugins/x/main.js',
+			array(
+				'@public/dep',
+				'@plugin/lib',
+				array(
+					'id'     => '@plugin/utils',
+					'import' => 'dynamic',
+				),
+			),
+			null,
+			array( 'scopes' => array() )
+		);
+		$this->script_modules->enqueue( '@plugin/main' );
+
+		$map = $this->get_full_import_map();
+
+		// The queued entry's static and dynamic deps must resolve.
+		$this->assertArrayHasKey( '@public/dep', $map['imports'] ?? array() );
+		$this->assertArrayHasKey( 'scopes', $map );
+		$this->assertArrayHasKey( '/wp-content/plugins/x/', $map['scopes'] );
+		$this->assertArrayHasKey( '@plugin/lib', $map['scopes']['/wp-content/plugins/x/'] );
+		$this->assertArrayHasKey( '@plugin/utils', $map['scopes']['/wp-content/plugins/x/'] );
+		// The empty-scoped entry itself is not advertised in either map.
+		$this->assertArrayNotHasKey( '@plugin/main', $map['imports'] ?? array() );
+		$this->assertArrayNotHasKey( '@plugin/main', $map['scopes']['/wp-content/plugins/x/'] );
+	}
+
 	/**
 	 * `module_id` resolution to a URL with no slash drops with a warning.
 	 *