importmap-plus 2.0.0 → 2.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a89ba9297f9e04e1f3a892ea319d509ce9300789f648327c3b4b1cf72c0951d7
-  data.tar.gz: c088e5ab5732c9f132bfa63a60d2a7d9243ac85690670e1a040e3658fc1fb091
+  metadata.gz: 1d0e4b656e7047b77938a8b92681f72ec7af73034c2c94517ef2ff37d725b76d
+  data.tar.gz: 9a83c644e76fab4892e074ea8f254877b4351c55b071294f4edd3c965167054f
 SHA512:
-  metadata.gz: 81f2d28ee6c2d724917e338451d4a0f2baef86feb1bcc5477feca8114f13213787d9164b6befc8e7e02cf24e5ec0f810e13d05195be4e27c689bc70db5fd9311
-  data.tar.gz: 3cbd693b24887409203b8f75294798c3ee4b08dec82a90eb404de2a24e7ba7f273d4babd48a72c3a1608f8f263b4804b27dcfbf624edbb69252ea8ea6b346d63
+  metadata.gz: 39c36fbd0719746f4ca30e21632731f1d91ebc4e524132c2592b2d0a1432315cf8e2d3e7b70fffa935cbc4d3135a14d561dd86d52c6de3a18fd41030f91209a1
+  data.tar.gz: c9eaf6a0f2b07be30f46487d07ffa17ebaa538efd443d23d677fd8e95509b4d50b193162a136dec8d9d6888b5414cbfe7b832d0929b0d0f9d6373de35ad2f0bf

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## Unreleased
+
+### Fixed
+
+- **`bin/importmap doctor` no longer reports comments and prose as unpinned
+  imports.** The import scanner read `from "…"` and `import "…"` wherever the
+  text appeared, so a line comment such as `// e.g. 'en' from 'en-US'` and
+  strings such as turbo_power's `` `…provided in the "from" attribute for
+  the "…` `` came back as `error … imports " attribute for the ", which isn't
+  pinned`. Line comments are now discounted before scanning (strings and
+  regex literals are still consumed whole, so `"https://…"` is safe), and a
+  quoted text that can't be a module specifier — whitespace, a backtick, a
+  `${` interpolation, or no word character at all — is not reported.
+
 ## 1.2.0
 
 ### Added

data/lib/importmap/import_scanner.rb

@@ -6,16 +6,19 @@ require "importmap/module_inspector"
 #
 # Like Importmap::ModuleInspector and Importmap::PackageGraph::IMPORT_REGEXP
 # this reads the source with regexes rather than parsing JavaScript, so an
-# import statement spelled out inside a string literal is reported too, and a
-# form the regexp can't read — a magic comment between the keyword and the
+# import statement spelled out inside a string literal is reported too — unless
+# what it names can't be a module specifier at all — and a form the regexp
+# can't read — a magic comment between the keyword and the
 # specifier, a specifier built at runtime — isn't reported at all. Both
 # mistakes are the cautious direction for the one caller: a specifier reported
 # that the browser never asks for costs a pin, and a specifier missed leaves
 # the app exactly as broken as it was before anyone ran the check.
 #
-# Block comments are discounted first, through ModuleInspector#code, because a
-# published bundle is full of `/** @typedef {import('./slide.js').Slide} */` —
-# type annotations naming files the package never loads.
+# Comments are discounted first, through
+# ModuleInspector#code_without_line_comments, because a published bundle is
+# full of `/** @typedef {import('./slide.js').Slide} */` — type annotations
+# naming files the package never loads — and app code is full of prose like
+# `// 'en' from 'en-US'`.
 class Importmap::ImportScanner
   Import = Struct.new(:specifier, :kind, keyword_init: true) # :nodoc:
 
@@ -38,6 +41,12 @@ class Importmap::ImportScanner
       (?:from|import)\s*(["'])([^"'\n]*)\3
     )
   /x.freeze # :nodoc:
+  # What a quoted `from "…"` or `import "…"` has to hold to name a module
+  # rather than be prose the regexp above found in a string: something, no
+  # whitespace or backtick, no `${` interpolation, and at least one word
+  # character — `"from" attribute for the "`, `["import",","]` and
+  # `` `import("${url}")` `` are all strings, never specifiers.
+  SPECIFIER_REGEXP = /\A(?!.*\$\{)[^\s`]*\w[^\s`]*\z/.freeze # :nodoc:
 
   attr_reader :source
 
@@ -46,7 +55,9 @@ class Importmap::ImportScanner
   end
 
   def imports
-    @imports ||= Importmap::ModuleInspector.new(source).code.scan(IMPORT_REGEXP).map do |_, dynamic, _, static|
+    @imports ||= Importmap::ModuleInspector.new(source).code_without_line_comments.scan(IMPORT_REGEXP).filter_map do |_, dynamic, _, static|
+      next unless (dynamic || static).match?(SPECIFIER_REGEXP)
+
       dynamic ? Import.new(specifier: dynamic, kind: :dynamic) : Import.new(specifier: static, kind: :static)
     end
   end

data/lib/importmap/module_inspector.rb

@@ -144,6 +144,14 @@ class Importmap::ModuleInspector
     @code ||= without_block_comments
   end
 
+  # #code with its line comments discounted too, for Importmap::ImportScanner:
+  # prose such as `// e.g. 'en' from 'en-US'` reads as an import otherwise.
+  # Strings and regex literals are still consumed whole first, so the `//` of
+  # `"https://…"` or `/\/\//` never opens a comment.
+  def code_without_line_comments
+    @code_without_line_comments ||= without_block_comments(line_comments: true)
+  end
+
   private
     def statements
       @statements ||= without_block_comments(statements_only: true)
@@ -170,12 +178,15 @@ class Importmap::ModuleInspector
     # reads as an import statement while the text inside it stops being read
     # as code at all. That mode feeds only the ES-module check, where the
     # `[//]` trap above can at worst send a package on to the next CDN.
-    def without_block_comments(statements_only: false)
+    # With +line_comments+ alone they go but literals are kept, for the import
+    # scanner: the trap there can at worst miss an import in the doctor's
+    # report, where prose in a comment is a false error on every run.
+    def without_block_comments(statements_only: false, line_comments: statements_only)
       scanner = StringScanner.new(source)
       kept    = +""
 
       until scanner.eos?
-        if scanner.skip(BLOCK_COMMENT_REGEXP) || (statements_only && scanner.skip(LINE_COMMENT_REGEXP))
+        if scanner.skip(BLOCK_COMMENT_REGEXP) || (line_comments && scanner.skip(LINE_COMMENT_REGEXP))
           next
         elsif (literal = scanner.scan(STRING_REGEXP)) ||
               (regexp_literal_next?(kept, scanner) && (literal = scanner.scan(REGEXP_LITERAL_REGEXP)))

data/lib/importmap/version.rb

@@ -1,6 +1,6 @@
 module Importmap
   # importmap-plus versions independently of the importmap-rails it forks.
   # UPSTREAM_VERSION is the importmap-rails release this tracks.
-  VERSION = "2.0.0"
+  VERSION = "2.0.1"
   UPSTREAM_VERSION = "2.2.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: importmap-plus
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.1
 platform: ruby
 authors:
 - David Heinemeier Hansson