importmap-plus 2.0.2 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '068b0fd351d34f6741037740731f5545ec5e98530ddd935abc45d18ac92b30e1'
-  data.tar.gz: 6482173bb6db3322fa43711fce8ccf0c9ac48d7b35c0b572e5b68d45f11d0445
+  metadata.gz: 79dc17549a50164758c2fe012056e4c64ca1290f09d5ef9a6c9c52b5df64b3c7
+  data.tar.gz: 3c4eddba8ee4c5c95a898dd5ebb2a50a2f34e4c7022d03cbbdb2d515c13a9589
 SHA512:
-  metadata.gz: 22b1de80057a17f315ab8230d5537400985c9f67c1c50faa184336856de9e3e1d8f06ea815392c78a0fef30bffa3373bd25b206ab638cf056c8447faa674fe44
-  data.tar.gz: 444fca5f51ec92e43ab7163bb14ce92791727b3a93242298e776a753cc243e218f17fdf3acb6c873842012bf38867862fa37bf4eb99e0464ed8e72061254c33f
+  metadata.gz: 1a84cb54c15c6bc465d3f2a5c3bf3f337a28601ea14f3d402b6894e1cf128173d14995ea0c0968bfb5851128f38b502003a902db25ab479e1ee75a5c521de17d
+  data.tar.gz: c0a778797572cba636a5c3cb90049393fb5ba5229cd8dc01222ed932cd840e664e9a448c312575cf3937e64148322fb12754c4dd3afee3b8cb9aa7aa6603bd39

data/CHANGELOG.md

@@ -1,6 +1,62 @@
 # Changelog
 
-## Unreleased
+## 2.1.0
+
+### Added
+
+- **Every app's map is finalized once it has booted, in every environment.**
+  After initialization the engine calls the new `Importmap::Map#finalize!`:
+  every pin and directory is deeply frozen, Ractor-shareable on Ruby 3+ (but
+  for a pinned value no Ractor can share, below), and so is every set of pins
+  the map publishes after it. A development reload, the
+  cache sweeper, and a `pin` or `draw` after boot work as before, each
+  publishing a new, frozen set, so nothing that pins or reloads starts raising.
+  `Importmap::Map#finalized?` says whether a map has been. Outside the engine
+  (an `Importmap::Map.new` passed to the helpers) `finalize!` is yours to call.
+
+### Changed
+
+- **Behaviour change: the pins are frozen once the app has booted.** Changing
+  one in place, such as `importmap.packages["md5"].preload = false`, raises
+  `FrozenError` in development and test as well as production. Change the map
+  with `pin`, `pin_all_from` and `draw`; an app that can't sets
+  `config.importmap.finalize = false`, which leaves its pins unfrozen.
+- **A pinned value no Ractor can share is kept as it is, never raised on.** A
+  pin whose `to:` is an object holding a lock, a logger or a lambda over the
+  app's state stays the object the app gave, unfrozen, and works on the main
+  Ractor only; its pin and every other pin are still frozen. The same goes for
+  the class-level URIs below.
+- **`Importmap::Map#packages` and `#directories` return frozen hashes**, the
+  current generation's (see the reload fix below). Change the map with `pin`,
+  `pin_all_from` and `draw`.
+- **The class-level URIs are stored deeply frozen.** `Packager.endpoint`,
+  `Packager.esm_run_resolver` (`EsmRun.resolver`) and `Npm.base_uri` are set
+  once, in an initializer; the URI you assign is frozen in place, so no thread
+  can change it under another. The default minifier is looked for when
+  `importmap/packager` loads rather than on first use; one you set, a lambda
+  over your own state included, is kept as given, and `nil` puts the default
+  back.
+- Every Ruby file in the gem has `# frozen_string_literal: true`, but for the
+  two install templates copied into an app (`bin/importmap` and
+  `config/importmap.rb`), which are the app's files.
+
+### Fixed
+
+- **A request during a reload renders a whole map.** The reloader
+  re-evaluated `config/importmap.rb` into the map every request reads, one pin
+  at a time, so a request mid-reload could render half of the new map and half
+  of the old. Every change now builds the next pin set on a copy and swaps it
+  in whole, and a draw that raises leaves the map it started from. A reload
+  still adds to the map, as before.
+
+- **A render no longer caches the map from before a change.** The rendered
+  JSON and preloads were memoised with an unlocked check-then-set that a pin,
+  `enable_integrity!` or the cache sweeper reset underneath: a render that
+  started first finished after the reset and cached the old map until the next
+  change. Each render is now cached in the pin set it read, under a lock, and
+  renders that miss together all get the one that was kept.
+
+## 2.0.2
 
 ### Fixed
 

data/README.md

@@ -64,7 +64,7 @@ bundle exec rake test          # the command tests talk to live CDNs (jspm, jsDe
 cd docs && bin/dev             # the docs site, a docs-kit app at docs/
 ```
 
-Releases are cut with `bin/release`, which tags a version and publishes a GitHub Release; that fires `.github/workflows/release.yml` (RubyGems trusted publishing) and `.github/workflows/deploy-docs.yml` (the docs site).
+Releases are cut with `bin/release` (the zoolutions release kit), which bumps the version and lockfile pins, pushes `main` and publishes a GitHub Release; that fires `.github/workflows/release.yml` (RubyGems trusted publishing) and `.github/workflows/deploy-docs.yml` (the docs site).
 
 ## License
 

data/Rakefile

@@ -1,9 +1,14 @@
+# frozen_string_literal: true
+
 require "bundler/setup"
 
 APP_RAKEFILE = File.expand_path("test/dummy/Rakefile", __dir__)
 load "rails/tasks/engine.rake"
 
-require "bundler/gem_tasks"
+# No `bundler/gem_tasks`: its `release` task (tag + `gem push` from this machine)
+# would merge into the release kit's `rake release[X.Y.Z]` (rakelib/release.rake)
+# and publish with a local API key. Releases go through bin/release; the gem is
+# built and pushed by release.yml over trusted publishing.
 
 require "rake/testtask"
 

data/app/controllers/importmap/freshness.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Importmap::Freshness
   def stale_when_importmap_changes
     etag { Rails.application.importmap.digest(resolver: helpers) if request.format&.html? }

data/app/helpers/importmap/importmap_tags_helper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Importmap::ImportmapTagsHelper
   # Setup all script tags needed to use an importmap-powered entrypoint (which defaults to application.js)
   def javascript_importmap_tags(entry_point = "application", importmap: Rails.application.importmap)

data/lib/importmap/batch_resolver.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "importmap/provider_chain"
 
 # Resolves a group of specs against a CDN, batch first and then one at a time.

data/lib/importmap/commands.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "thor"
 require "importmap/packager"
 require "importmap/package_graph"

data/lib/importmap/doctor.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "net/http"
 require "uri"
 require "pathname"

data/lib/importmap/early_hints.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # The modulepreload links of javascript_importmap_tags, sent ahead of the
 # response as 103 Early Hints.
 #

data/lib/importmap/engine.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "importmap/map"
 require "importmap/early_hints"
 
@@ -13,6 +15,7 @@ module Importmap
     config.importmap.rescuable_asset_errors = []
     config.importmap.preload_strategy = :all
     config.importmap.early_hints = true
+    config.importmap.finalize = true
 
     config.autoload_once_paths = %W( #{root}/app/helpers #{root}/app/controllers )
 
@@ -72,5 +75,17 @@ module Importmap
         app.config.importmap.rescuable_asset_errors << Sprockets::Rails::Helper::AssetNotFound
       end
     end
+
+    # Once the app has booted, in every environment, its map is finalized:
+    # every pin is deeply frozen (Ractor-shareable), and so is every set of
+    # pins a development reload, a cache sweep or a later pin publishes, so
+    # reloading works as before. Registered from an initializer, so it runs
+    # after the after_initialize blocks of config/application.rb and the
+    # environment files.
+    initializer "importmap.finalize" do |app|
+      app.config.after_initialize do
+        app.importmap.finalize! if app.config.importmap.finalize
+      end
+    end
   end
 end

data/lib/importmap/esm_run.rb

@@ -1,5 +1,8 @@
+# frozen_string_literal: true
+
 require "uri"
 require "json"
+require "importmap/shareable"
 
 # Everything this gem knows about jsDelivr's bundling endpoint
 # (https://www.jsdelivr.com/esm): one minified ESM file per package, with its
@@ -32,8 +35,14 @@ class Importmap::EsmRun
 
   # The jsDelivr data API versions are resolved through. Also readable and
   # writable as Importmap::Packager.esm_run_resolver, which is where an app
-  # that points this at a mirror has always set it.
-  singleton_class.attr_accessor :resolver
+  # that points this at a mirror has always set it, in an initializer.
+  singleton_class.attr_reader :resolver
+
+  def self.resolver=(value)
+    # A boot-time setting, written before the commands that read it, and
+    # stored deeply frozen (Ractor-shareable), so none can change it in place.
+    @resolver = Importmap::Shareable.make(value) # rubocop:disable ThreadSafety/ClassInstanceVariable
+  end
   self.resolver = URI("https://data.jsdelivr.com/v1/packages/npm/")
 
   class << self

data/lib/importmap/graph.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "pathname"
 require "set"
 require "importmap/import_scanner"
@@ -24,9 +26,16 @@ class Importmap::Graph
   # requiring the CLI onto the request path to borrow it would be a poor trade.
   REMOTE_PATH_REGEXP = %r{\A(?:[a-zA-Z][a-zA-Z0-9+\-.]*:)?//}.freeze # :nodoc:
 
-  def initialize(map, roots: [])
-    @map   = map
-    @roots = Array(roots).map { |root| Pathname.new(root) }
+  # +entries+ are the expanded pins to walk when given (Importmap::Map passes
+  # those of the generation it is rendering), +map+'s otherwise. One graph
+  # serves every render of a generation, so its file reads are memoised under
+  # a lock.
+  def initialize(map, roots: [], entries: nil)
+    @roots        = Array(roots).map { |root| Pathname.new(root) }
+    @entries      = (entries || map.each_expanded_package).to_h
+    @keys_by_path = @entries.each_with_object({}) { |(key, mapping), keys| keys[mapping.path] ||= key }
+    @edges        = {}
+    @lock         = Mutex.new
   end
 
   # The keys reachable from +entry_points+ through static imports, the entry
@@ -45,21 +54,21 @@ class Importmap::Graph
   end
 
   private
-    def entries
-      @entries ||= @map.each_expanded_package.to_h
-    end
+    attr_reader :entries
 
     # The key a path belongs to, for resolving a relative import back into the
     # map. Two keys can name one file; the first one drawn wins, and since both
     # resolve to the same asset path the preload set can't tell them apart
     # anyway.
-    def keys_by_path
-      @keys_by_path ||= entries.each_with_object({}) { |(key, mapping), keys| keys[mapping.path] ||= key }
-    end
+    attr_reader :keys_by_path
 
+    # The file is read outside the lock; the first render to store its edges
+    # wins.
     def edges_from(key)
-      @edges ||= {}
-      @edges[key] ||= compute_edges(entries[key])
+      @lock.synchronize { @edges[key] } || begin
+        edges = compute_edges(entries[key])
+        @lock.synchronize { @edges[key] ||= edges }
+      end
     end
 
     def compute_edges(mapping)

data/lib/importmap/http_retries.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "net/http"
 require "openssl"
 
@@ -9,6 +11,9 @@ module Importmap::HttpRetries
   RETRYABLE_ERRORS = [ SocketError, SystemCallError, Timeout::Error, EOFError, OpenSSL::SSL::SSLError, Net::ProtocolError ].freeze # :nodoc:
   RETRYABLE_CODES  = %w[ 429 500 502 503 504 ].freeze # :nodoc:
 
+  # Boot-time settings, also written as Packager.retry_attempts and
+  # retry_wait. The defaults are an Integer and a Float, so shareable; a
+  # value an app writes is kept as given.
   singleton_class.attr_accessor :attempts, :wait
   self.attempts = 3
   self.wait = 0.5

data/lib/importmap/import_scanner.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "importmap/module_inspector"
 
 # Every module specifier a JavaScript file names, in source order, with whether

data/lib/importmap/integrity.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "digest"
 
 # The subresource-integrity hash of a file, in the form the import map's

data/lib/importmap/map.rb

@@ -1,8 +1,14 @@
+# frozen_string_literal: true
+
 require "pathname"
 require "importmap/graph"
+require "importmap/pin_set"
 
 class Importmap::Map
-  attr_reader :packages, :directories
+  # The current generation's, frozen: change the map through #pin,
+  # #pin_all_from and #draw.
+  def packages = @pins.packages
+  def directories = @pins.directories
 
   PIN_REGEX = /^pin\s+["']([^"']+)["']/.freeze # :nodoc:
 
@@ -13,21 +19,25 @@ class Importmap::Map
   class InvalidFile < StandardError; end
 
   def initialize
-    @integrity = false
-    @packages, @directories = {}, {}
-    @cache = {}
+    @pins = Importmap::PinSet.new
+    # Serialises the writers (draws, pins, sweeps), each of which builds the
+    # next Importmap::PinSet on a draft. A render never takes it, so no
+    # request waits while config/importmap.rb is re-evaluated.
+    @writer = Mutex.new
   end
 
   def draw(path = nil, &block)
-    if path && File.exist?(path)
-      begin
-        instance_eval(File.read(path), path.to_s)
-      rescue StandardError => e
-        Rails.logger.error "Unable to parse import map from #{path}: #{e.message}"
-        raise InvalidFile, "Unable to parse import map from #{path}: #{e.message}"
+    drafting do
+      if path && File.exist?(path)
+        begin
+          instance_eval(File.read(path), path.to_s)
+        rescue StandardError => e
+          Rails.logger.error "Unable to parse import map from #{path}: #{e.message}"
+          raise InvalidFile, "Unable to parse import map from #{path}: #{e.message}"
+        end
+      elsif block_given?
+        instance_eval(&block)
       end
-    elsif block_given?
-      instance_eval(&block)
     end
 
     self
@@ -66,20 +76,32 @@ class Importmap::Map
   # * For Propshaft, you must configure +config.assets.integrity_hash_algorithm+
   # * External CDN packages should provide their own integrity hashes
   def enable_integrity!
-    clear_cache
-    @integrity = true
+    drafting { |draft| draft.integrity = true }
   end
 
   def pin(name, to: nil, preload: true, integrity: true)
-    clear_cache
-    @packages[name] = MappedFile.new(name: name, path: to || "#{name}.js", preload: preload, integrity: integrity)
+    drafting { |draft| draft.packages[name] = MappedFile.new(name: name, path: to || "#{name}.js", preload: preload, integrity: integrity) }
   end
 
   def pin_all_from(dir, under: nil, to: nil, preload: true, integrity: true)
-    clear_cache
-    @directories[dir] = MappedDir.new(dir: dir, under: under, path: to, preload: preload, integrity: integrity)
+    drafting { |draft| draft.directories[dir] = MappedDir.new(dir: dir, under: under, path: to, preload: preload, integrity: integrity) }
+  end
+
+  # Deep-freezes every pin and directory, Ractor-shareable where Ruby has
+  # Ractors, and every set of them the map publishes from now on: the engine
+  # calls it once the app has booted (config.importmap.finalize). The map
+  # still changes as before: a draw, a pin, a development reload or a cache
+  # sweep publishes a new, finalized set, so no reader is ever handed a pin
+  # another thread can change. A value the app pinned that no Ractor can
+  # share is left as it is (see Importmap::Shareable). Returns the map.
+  def finalize!
+    @writer.synchronize { @pins = @pins.finalized }
+    self
   end
 
+  # Whether #finalize! has been called.
+  def finalized? = @pins.finalized?
+
   # Returns an array of all the resolved module paths of the pinned packages. The `resolver` must respond to
   # `path_to_asset`, such as `ActionController::Base.helpers` or `ApplicationController.helpers`. You'll want to use the
   # resolver that has been configured for the `asset_host` you want these resolved paths to use. In case you need to
@@ -136,12 +158,12 @@ class Importmap::Map
   #   # Use a custom cache key for different asset hosts
   #   packages = importmap.preloaded_module_packages(resolver: helpers, cache_key: "cdn_host")
   def preloaded_module_packages(resolver:, entry_point: "application", cache_key: :preloaded_module_packages)
-    cache_as(cache_key) do
-      expanded_preloading_packages_and_directories(entry_point:).filter_map do |_, package|
+    cache_as(cache_key) do |pins|
+      expanded_preloading_packages_and_directories(pins, entry_point:).filter_map do |_, package|
         resolved_path = resolve_asset_path(package.path, resolver: resolver)
         next unless resolved_path
 
-        resolved_integrity = resolve_integrity_value(package.integrity, package.path, resolver: resolver)
+        resolved_integrity = resolve_integrity_value(pins, package.integrity, package.path, resolver: resolver)
 
         package = MappedFile.new(
           name: package.name,
@@ -161,9 +183,9 @@ class Importmap::Map
   # want these resolved paths to use. In case you need to resolve for different asset hosts, you can pass in a custom
   # `cache_key` to vary the cache used by this method for the different cases.
   def to_json(resolver:, cache_key: :json)
-    cache_as(cache_key) do
-      packages = expanded_packages_and_directories
-      map = build_import_map(packages, resolver: resolver)
+    cache_as(cache_key) do |pins|
+      packages = expanded_packages_and_directories(pins)
+      map = build_import_map(pins, packages, resolver: resolver)
       JSON.pretty_generate(map)
     end
   end
@@ -199,24 +221,44 @@ class Importmap::Map
   # #to_json is about to resolve, before a resolver has touched it. Returns an
   # Enumerator without a block.
   def each_expanded_package(&block)
-    expanded_packages_and_directories.each(&block)
+    expanded_packages_and_directories(@pins).each(&block)
   end
 
   private
     MappedDir  = Struct.new(:dir, :path, :under, :preload, :integrity, keyword_init: true)
     MappedFile = Struct.new(:name, :path, :preload, :integrity, keyword_init: true)
 
+    # Memoised in the generation it renders, which the block is handed: a
+    # render reads one Importmap::PinSet start to finish, so a draw landing
+    # mid-render can neither mix two versions of the map into it nor have it
+    # cached over the newer one.
     def cache_as(name)
-      if result = @cache[name.to_s]
-        result
-      else
-        @cache[name.to_s] = yield
-      end
+      pins = @pins
+      pins.fetch(name.to_s) { yield pins }
     end
 
+    # The same pins as a new generation, so every render is redone. Inside a
+    # draw there is nothing to do: the draw publishes a new generation itself.
     def clear_cache
-      @cache.clear
-      @graph = nil
+      return if @writer.owned?
+
+      @writer.synchronize { @pins = @pins.recached }
+    end
+
+    # Every change is written into a draft of the current generation and the
+    # finished generation published whole. A pin inside a draw lands in that
+    # draw's draft; a draw that raises publishes nothing.
+    def drafting
+      return yield @draft if @writer.owned?
+
+      @writer.synchronize do
+        @draft = @pins.draft
+        result = yield @draft
+        @pins = @draft.to_pin_set
+        result
+      ensure
+        @draft = nil
+      end
     end
 
     def rescuable_asset_error?(error)
@@ -242,29 +284,29 @@ class Importmap::Map
       end
     end
 
-    def build_import_map(packages, resolver:)
+    def build_import_map(pins, packages, resolver:)
       map = { "imports" => resolve_asset_paths(packages, resolver: resolver) }
-      integrity = build_integrity_hash(packages, resolver: resolver)
+      integrity = build_integrity_hash(pins, packages, resolver: resolver)
       map["integrity"] = integrity unless integrity.empty?
       map
     end
 
-    def build_integrity_hash(packages, resolver:)
+    def build_integrity_hash(pins, packages, resolver:)
       packages.filter_map do |name, mapping|
         next unless mapping.integrity
 
         resolved_path = resolve_asset_path(mapping.path, resolver: resolver)
         next unless resolved_path
 
-        integrity_value = resolve_integrity_value(mapping.integrity, mapping.path, resolver: resolver)
+        integrity_value = resolve_integrity_value(pins, mapping.integrity, mapping.path, resolver: resolver)
         next unless integrity_value
 
         [resolved_path, integrity_value]
       end.to_h
     end
 
-    def resolve_integrity_value(integrity, path, resolver:)
-      return unless @integrity
+    def resolve_integrity_value(pins, integrity, path, resolver:)
+      return unless pins.integrity
 
       case integrity
       when true
@@ -274,9 +316,9 @@ class Importmap::Map
       end
     end
 
-    def expanded_preloading_packages_and_directories(entry_point:)
-      preloading = expanded_packages_and_directories.select { |name, mapping| mapping.preload.in?([true, false]) ? mapping.preload : (Array(mapping.preload) & Array(entry_point)).any? }
-      reachable_only(preloading, entry_point: entry_point)
+    def expanded_preloading_packages_and_directories(pins, entry_point:)
+      preloading = expanded_packages_and_directories(pins).select { |name, mapping| mapping.preload.in?([true, false]) ? mapping.preload : (Array(mapping.preload) & Array(entry_point)).any? }
+      reachable_only(pins, preloading, entry_point: entry_point)
     end
 
     # With config.importmap.preload_strategy == :reachable, a pin that says
@@ -285,32 +327,33 @@ class Importmap::Map
     # page without anyone maintaining a `preload: false` for it and for
     # everything it depends on. A pin naming the entry point is the app
     # overruling the graph, and `preload: false` is off either way.
-    def reachable_only(packages, entry_point:)
+    def reachable_only(pins, packages, entry_point:)
       return packages unless Rails.application.config.importmap.preload_strategy == :reachable
 
-      reachable = graph.reachable_from(Array(entry_point))
+      reachable = graph(pins).reachable_from(Array(entry_point))
       packages.select { |name, mapping| mapping.preload != true || reachable.include?(name) }
     end
 
-    # Memoised beside the rendered map rather than inside it: #cache_as shares
-    # one namespace with the cache_key the preload helper passes, which is the
-    # entry point's own name, so an app with an entry point named "graph" would
-    # read this back as its preload set. Dropped by the same clear_cache the
-    # sweeper calls when a .js file under a watched directory changes.
-    def graph
-      @graph ||= Importmap::Graph.new(self, roots: asset_paths)
+    # Memoised in the generation beside its renders, under a Symbol: every
+    # #cache_as key is a String, and the preload helper passes the entry
+    # point's own name as one, so an app with an entry point named "graph"
+    # can't read this back as its preload set. Redone with the rest of the
+    # generation's cache when a draw, or the sweeper seeing a .js file under a
+    # watched directory change, publishes a new one.
+    def graph(pins)
+      pins.fetch(:graph) { Importmap::Graph.new(self, roots: asset_paths, entries: expanded_packages_and_directories(pins)) }
     end
 
     def asset_paths
       (config = Rails.application.config).respond_to?(:assets) ? config.assets.paths : []
     end
 
-    def expanded_packages_and_directories
-      @packages.dup.tap { |expanded| expand_directories_into expanded }
+    def expanded_packages_and_directories(pins)
+      pins.packages.dup.tap { |expanded| expand_directories_into expanded, pins.directories }
     end
 
-    def expand_directories_into(paths)
-      @directories.values.each do |mapping|
+    def expand_directories_into(paths, directories)
+      directories.values.each do |mapping|
         if (absolute_path = absolute_root_of(mapping.dir)).exist?
           find_javascript_files_in_tree(absolute_path).each do |filename|
             module_filename = filename.relative_path_from(absolute_path)

data/lib/importmap/minifier.rb

@@ -1,5 +1,8 @@
+# frozen_string_literal: true
+
 require "open3"
 require "tmpdir"
+require "importmap/shareable"
 
 # Minifies a vendored package with whichever JavaScript minifier is installed:
 # bun, esbuild or terser, looked up in node_modules/.bin and then on PATH.
@@ -8,11 +11,12 @@ require "tmpdir"
 class Importmap::Minifier
   Error = Class.new(StandardError)
 
-  TOOLS = {
+  # Shareable: the lambdas capture nothing, and their self is this class.
+  TOOLS = Importmap::Shareable.make({
     "bun"     => ->(input, output) { [ "build", "--no-bundle", "--minify", "--format=esm", "--target=browser", input, "--outfile=#{output}" ] },
     "esbuild" => ->(input, output) { [ input, "--minify", "--format=esm", "--outfile=#{output}" ] },
     "terser"  => ->(input, output) { [ input, "--module", "--compress", "--mangle", "--output", output ] }
-  }.freeze # :nodoc:
+  }) # :nodoc:
 
   class << self
     def detect

data/lib/importmap/module_inspector.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "strscan"
 
 # Decides whether a downloaded ESM file can stand alone as the single file an

data/lib/importmap/npm.rb

@@ -1,7 +1,10 @@
+# frozen_string_literal: true
+
 require "net/http"
 require "uri"
 require "json"
 require "importmap/http_retries"
+require "importmap/shareable"
 
 class Importmap::Npm
   include Importmap::HttpRetries
@@ -11,7 +14,14 @@ class Importmap::Npm
   Error     = Class.new(StandardError)
   HTTPError = Class.new(Error)
 
-  singleton_class.attr_accessor :base_uri
+  # The registry, or a mirror of it set in an initializer.
+  singleton_class.attr_reader :base_uri
+
+  def self.base_uri=(value)
+    # A boot-time setting, written before the commands that read it, and
+    # stored deeply frozen (Ractor-shareable), so none can change it in place.
+    @base_uri = Importmap::Shareable.make(value) # rubocop:disable ThreadSafety/ClassInstanceVariable
+  end
   self.base_uri = URI("https://registry.npmjs.org")
 
   def initialize(importmap_path = "config/importmap.rb", vendor_path: "vendor/javascript")

data/lib/importmap/package_graph.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "uri"
 require "importmap/module_inspector"
 require "importmap/integrity"

data/lib/importmap/packager.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "net/http"
 require "uri"
 require "json"
@@ -8,6 +10,7 @@ require "importmap/vendored_graph"
 require "importmap/http_retries"
 require "importmap/integrity"
 require "importmap/esm_run"
+require "importmap/shareable"
 
 class Importmap::Packager
   include Importmap::HttpRetries
@@ -132,7 +135,14 @@ class Importmap::Packager
     end
   end
 
-  singleton_class.attr_accessor :endpoint
+  # jspm's generator, or another one set in an initializer.
+  singleton_class.attr_reader :endpoint
+
+  def self.endpoint=(value)
+    # A boot-time setting, written before the commands that read it, and
+    # stored deeply frozen (Ractor-shareable), so none can change it in place.
+    @endpoint = Importmap::Shareable.make(value) # rubocop:disable ThreadSafety/ClassInstanceVariable
+  end
   self.endpoint = URI("https://api.jspm.io/generate")
 
   # CDNs reset connections and rate-limit bursts. Each request is tried this
@@ -158,12 +168,17 @@ class Importmap::Packager
   end
 
   # Anything responding to #call(source) => String. Defaults to the first of
-  # bun, esbuild or terser found on the machine.
-  singleton_class.attr_writer :minifier
+  # bun, esbuild or terser found on the machine, looked for when this file
+  # loads, and stored shareable; assigning nil puts that default back. A
+  # minifier an app sets is used as given: a callable is seldom shareable, and
+  # only the CLI's own thread calls it.
+  singleton_class.attr_reader :minifier
 
-  def self.minifier
-    @minifier ||= Importmap::Minifier.new
+  def self.minifier=(value)
+    # A boot-time setting, written before the commands that read it.
+    @minifier = value || Importmap::Shareable.make(Importmap::Minifier.new) # rubocop:disable ThreadSafety/ClassInstanceVariable
   end
+  self.minifier = nil
 
   attr_reader :vendor_path
 

data/lib/importmap/pin_set.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require "importmap/shareable"
+
+# One generation of an Importmap::Map: its pins, its pin_all_from directories
+# and whether integrity is on, frozen together, plus the cache of what was
+# rendered from them.
+#
+# The map never changes a generation in place. A draw, a pin or a cache sweep
+# writes into a Draft of the current one and the map swaps the finished
+# generation in whole, so a request rendering mid-reload renders the
+# generation before it rather than a half-drawn map. What a render caches
+# lands in the generation it read: a swap leaves the old cache behind, where
+# clearing one shared cache would let a render that started before the change
+# write the old map back into it.
+class Importmap::PinSet
+  # A generation being drawn: the same things, writable, for the one writer
+  # holding the map's lock. The generation it publishes is finalized when the
+  # one it was drafted from was.
+  Draft = Struct.new(:packages, :directories, :integrity, :finalized) do
+    def to_pin_set = Importmap::PinSet.new(packages: packages, directories: directories, integrity: integrity, finalized: finalized)
+  end
+
+  attr_reader :packages, :directories, :integrity
+
+  def initialize(packages: {}, directories: {}, integrity: false, finalized: false)
+    @packages    = finalized ? deep_freeze(packages) : packages.freeze
+    @directories = finalized ? deep_freeze(directories) : directories.freeze
+    @integrity   = integrity
+    @finalized   = finalized
+    @lock        = Mutex.new
+    @cache       = {}
+    freeze
+  end
+
+  # Whether every pin and directory is deeply frozen: Ractor-shareable where
+  # Ruby has Ractors, but for a value an app gave that no Ractor can share.
+  def finalized? = @finalized
+
+  def draft
+    Draft.new(packages.dup, directories.dup, integrity, finalized?)
+  end
+
+  # The same pins with an empty cache: what a sweep publishes when a watched
+  # .js file changes and every render has to be redone.
+  def recached
+    self.class.new(packages: packages, directories: directories, integrity: integrity, finalized: finalized?)
+  end
+
+  # The same pins deeply frozen, as a new generation with an empty cache.
+  # Every generation drafted from it is finalized in turn.
+  def finalized
+    finalized? ? self : self.class.new(packages: packages, directories: directories, integrity: integrity, finalized: true)
+  end
+
+  # The value cached under +key+, else the block's. The block runs outside the
+  # lock, because it calls the app's asset resolver, which may take locks of
+  # its own; when two renders miss at once the first one stored is kept and
+  # both return it.
+  def fetch(key)
+    cached = @lock.synchronize { @cache[key] }
+    return cached if cached
+
+    rendered = yield
+    @lock.synchronize { @cache[key] ||= rendered }
+  end
+
+  private
+    # Each pin on its own, so one holding a value no Ractor can share (see
+    # Importmap::Shareable) leaves only itself unshared. The pins are the
+    # map's own structs: one that can't be shared is still frozen, around the
+    # value the app gave it.
+    def deep_freeze(entries)
+      entries.each_value { |entry| Importmap::Shareable.make(entry).freeze }
+      Importmap::Shareable.make(entries.freeze)
+    end
+end

data/lib/importmap/provider_chain.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "importmap/packager"
 
 # The CDNs a package that names none of its own is asked of, in order.

data/lib/importmap/reloader.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support"
 require "active_support/core_ext/module/delegation"
 

data/lib/importmap/shareable.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+# Deep-freezes a value set once at boot and read by every thread after it, so
+# no reader can be handed something another thread is still changing:
+# Ractor.make_shareable where Ruby has Ractors (CRuby 3.0+), which also lets
+# a non-main Ractor read it. Where it hasn't (JRuby, TruffleRuby) the value
+# and the hashes, arrays, structs and strings inside it are frozen. Freezes in
+# place and returns the value.
+#
+# Never raises. A value no Ractor can share (a lambda that closes over the
+# app's state, a logger, anything holding a Mutex or an IO) is returned as it
+# is, and keeps working on the main Ractor only. A Hash, Array or Struct
+# around a Proc that can't be shared is frozen around it; the Proc is not.
+module Importmap::Shareable
+  def self.make(value)
+    return freeze_all(value) unless ractors?
+    return value if ::Ractor.shareable?(value)
+    return value unless freezable?(value)
+
+    ::Ractor.make_shareable(value)
+  rescue ::Ractor::Error
+    value
+  end
+
+  def self.ractors? = defined?(::Ractor) ? true : false
+
+  # Whether Ractor.make_shareable can run on +value+ in place without giving
+  # up half-way, which would leave it half-frozen (a logger, frozen around the
+  # Monitor it can't share). Everything but a Proc is tried on a copy first,
+  # which raises without touching the original. A Proc can't be copied, but
+  # make_shareable checks a Proc before it freezes it, so it needs no dry run;
+  # one inside any other object is never tried. +seen+ holds the hashes,
+  # arrays and structs already being checked, so one that holds itself ends.
+  def self.freezable?(value, seen = {}.compare_by_identity)
+    case value
+    when Hash, Array, Struct
+      return true if seen.key?(value)
+
+      seen[value] = true
+      value.is_a?(Hash) ? value.all? { |key, item| freezable?(key, seen) && freezable?(item, seen) } : value.all? { |item| freezable?(item, seen) }
+    when Proc then true
+    else
+      ::Ractor.make_shareable(value, copy: true) unless ::Ractor.shareable?(value)
+      true
+    end
+  rescue ::Ractor::Error, TypeError
+    false
+  end
+
+  # Without Ractors: the value itself, and the hashes, arrays, structs and
+  # strings inside it. Any other object inside it is left as it is.
+  # +seen+ as in freezable?.
+  def self.freeze_all(value, seen = {}.compare_by_identity)
+    return value if seen.key?(value)
+
+    seen[value] = true
+    case value
+    when Hash then value.each { |key, item| freeze_nested(key, seen); freeze_nested(item, seen) }
+    when Array, Struct then value.each { |item| freeze_nested(item, seen) }
+    end
+    value.freeze
+  end
+
+  def self.freeze_nested(value, seen)
+    freeze_all(value, seen) if value.is_a?(Hash) || value.is_a?(Array) || value.is_a?(Struct) || value.is_a?(String)
+  end
+  private_class_method :ractors?, :freezable?, :freeze_all, :freeze_nested
+end

data/lib/importmap/vendored_graph.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "fileutils"
 require "pathname"
 

data/lib/importmap/version.rb

@@ -1,6 +1,8 @@
+# frozen_string_literal: true
+
 module Importmap
   # importmap-plus versions independently of the importmap-rails it forks.
   # UPSTREAM_VERSION is the importmap-rails release this tracks.
-  VERSION = "2.0.2"
+  VERSION = "2.1.0"
   UPSTREAM_VERSION = "2.2.3"
 end

data/lib/importmap-plus.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # The entry point Bundler requires for `gem "importmap-plus"`. The constants
 # stay under Importmap:: so this gem drops into any app that used
 # importmap-rails without touching a single call site.

data/lib/importmap-rails.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Importmap
 end
 

data/lib/install/install.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 APPLICATION_LAYOUT_PATH = Rails.root.join("app/views/layouts/application.html.erb")
 
 if APPLICATION_LAYOUT_PATH.exist?

data/lib/tasks/importmap_tasks.rake

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 namespace :importmap do
   desc "Setup Importmap for the app"
   task :install do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: importmap-plus
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.1.0
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -17,6 +17,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 6.0.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -24,6 +27,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 6.0.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9.0'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
@@ -31,6 +37,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 6.0.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -38,6 +47,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 6.0.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9.0'
 - !ruby/object:Gem::Dependency
   name: actionpack
   requirement: !ruby/object:Gem::Requirement
@@ -45,6 +57,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 6.0.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -52,6 +67,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 6.0.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9.0'
 description: 'A drop-in replacement for importmap-rails. Same Importmap:: API, same
   pins, same import map, plus `bin/importmap pin --minify`, `--from esm.run` for jsDelivr''s
   bundled builds, `--lock` to hold a package at a version, and a pin comment that
@@ -86,8 +104,10 @@ files:
 - lib/importmap/npm.rb
 - lib/importmap/package_graph.rb
 - lib/importmap/packager.rb
+- lib/importmap/pin_set.rb
 - lib/importmap/provider_chain.rb
 - lib/importmap/reloader.rb
+- lib/importmap/shareable.rb
 - lib/importmap/vendored_graph.rb
 - lib/importmap/version.rb
 - lib/install/bin/importmap
@@ -99,7 +119,7 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/zoolutions/importmap-plus
-  source_code_uri: https://github.com/zoolutions/importmap-plus
+  source_code_uri: https://github.com/zoolutions/importmap-plus/tree/main
   changelog_uri: https://github.com/zoolutions/importmap-plus/blob/main/CHANGELOG.md
 rdoc_options: []
 require_paths: