@davidwells/extract-deps 0.1.4 → 0.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidwells/extract-deps",
-  "version": "0.1.4",
+  "version": "0.1.7",
   "description": "Get imports and requires from a codebase without AST",
   "main": "src/index.js",
   "exports": {

package/src/dep-graph.js

@@ -40,6 +40,17 @@ function resolveImportPath(baseDir, importPath) {
     }
   }
 
+  // TypeScript convention: imports use .js/.mjs extensions that resolve to .ts/.mts files
+  // e.g. `import { foo } from './bar.js'` resolves to `./bar.ts`
+  const tsExtMap = { '.js': '.ts', '.mjs': '.mts', '.jsx': '.tsx' }
+  const importExt = path.extname(importPath)
+  if (tsExtMap[importExt]) {
+    const tsPath = path.resolve(baseDir, importPath.slice(0, -importExt.length) + tsExtMap[importExt])
+    if (isFileSync(tsPath)) {
+      return tsPath
+    }
+  }
+
   // Try directory with index file
   const indexExtensions = ['/index.js', '/index.mjs', '/index.ts']
   for (const indexExt of indexExtensions) {
@@ -79,8 +90,14 @@ function verifyImportedValuesExist(dep, targetDeps, targetPath, sourcePath, erro
     }
 
     // Check ESM exports
+    let hasReExportAll = false
     if (targetDeps.exports && targetDeps.exports.length > 0) {
       for (const exp of targetDeps.exports) {
+        if (exp.exportType === 'all') {
+          // export * from './module' — can't know what names are re-exported without
+          // following the chain, so skip verification for this module
+          hasReExportAll = true
+        }
         const exportedName = exp.exportAlias || exp.exportName
         if (exportedName) {
           exportedNames.add(exportedName)
@@ -88,6 +105,11 @@ function verifyImportedValuesExist(dep, targetDeps, targetPath, sourcePath, erro
       }
     }
 
+    // If module uses export * from, we can't verify names — skip
+    if (hasReExportAll) {
+      return
+    }
+
     // Verify each imported name is exported
     for (const importedName of importedNames) {
       if (!exportedNames.has(importedName)) {
@@ -110,6 +132,10 @@ function verifyImportedValuesExist(dep, targetDeps, targetPath, sourcePath, erro
   // Only applies to ESM imports - CJS require() gets whatever module.exports is
   else {
     if (dep.isESM) {
+      // Namespace imports (import * as X) don't need a default export
+      if (dep.varName && dep.varName.startsWith('*')) {
+        return
+      }
       // ESM import X from 'pkg' requires a default export
       const hasModuleExports = targetDeps.moduleExports && targetDeps.moduleExports.length > 0
       const hasESMExports = targetDeps.exports && targetDeps.exports.length > 0

package/src/get-imports.js

@@ -1,13 +1,13 @@
 const { isBuiltIn, isRelativeImport, isRelativeImportWithQuotes, getNames, stripComments } = require('./utils')
 
 // https://regex101.com/r/cfEmlm/1
-const IMPORT_REGEX = /import(?:["'\s]*([\w*{}\n\r\t, ]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+;?$/gm
+const IMPORT_REGEX = /import(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+;?$/gm
 // https://regex101.com/r/UDmXlb/1
 const IMPORT_TYPE_REGEX = /import\(['"](.*)['"]\)\.?([A-Za-z_0-9.]*)?/gm
 // https://regex101.com/r/UDjMoV/1
-const DYNAMIC_IMPORT_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= ]+)\s*=\s*)?await\s+import\(([^()]+(?:\([^()]*\)[^()]*)*)\)/gm
+const DYNAMIC_IMPORT_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= $]+)\s*=\s*)?await\s+import\(([^()]+(?:\([^()]*\)[^()]*)*)\)/gm
 // https://regex101.com/r/example/1
-const ASSERTION_IMPORT_REGEX = /(?:^|\n)\s*import\s+(?:["'\s]*([\w*{}\n\r\t, ]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+(assert|with)\s*\{([^}]+)\};?$/gm
+const ASSERTION_IMPORT_REGEX = /(?:^|\n)\s*import\s+(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+(assert|with)\s*\{([^}]+)\};?$/gm
 
 function getImports(code = '', options = {}) {
   // Strip comments to avoid false positives
@@ -27,7 +27,19 @@ function getStaticImports(targetText = '') {
   var result;
   while((result = IMPORT_REGEX.exec(targetText)) !== null) {
     const [ line, names, from ] = result
-    const namesValues = (names || '').trim()
+    // Skip TypeScript type-only imports — erased at compile time, no runtime resolution needed
+    if (/^\s*import\s+type\s/.test(line)) {
+      continue
+    }
+    // Skip false matches where `import` appears inside a string literal (e.g. `= 'import' | 'internal'`)
+    // A valid module path won't contain operators like | = ( )
+    if (/[|=()]/.test(from)) {
+      continue
+    }
+    // Remove inline `type` imports from destructured names — they're erased at compile time
+    // e.g. `{ foo, type Bar, type Baz }` → `{ foo }` (Bar and Baz are type-only)
+    const rawNames = (names || '').trim()
+    const namesValues = rawNames.replace(/,?\s*\btype\s+[\w$]+/g, '').replace(/^,\s*/, '').trim()
     importStatements.push({
       line,
       varType: 'const',
@@ -67,19 +79,21 @@ function getDynamicImports(targetText = '') {
   let importStatements = []
   var result;
   while((result = DYNAMIC_IMPORT_REGEX.exec(targetText)) !== null) {
-    const [ line, varType, names, from ] = result
+    const [ line, varType, names, rawFrom ] = result
     let namesValues = (names || '').trim()
-    
+    // Strip surrounding quotes from dynamic import paths (e.g. './foo.js' → ./foo.js)
+    const from = rawFrom.trim().replace(/^["'`]|["'`]$/g, '')
+
     importStatements.push({
       line,
       varType: varType || '',
       varName: namesValues,
       definitions: names ? getNames(namesValues) : null,
-      from: from.trim(),
+      from,
       index: result.index,
       isImport: true,
-      isRelative: isRelativeImport(from) || isRelativeImportWithQuotes(from),
-      isBuiltIn: isBuiltIn(from.trim()),
+      isRelative: isRelativeImport(from),
+      isBuiltIn: isBuiltIn(from),
       isDynamic: true
     })
   }

package/src/get-requires.js

@@ -1,9 +1,11 @@
 const { isBuiltIn, isRelativeImport, getNames } = require('./utils')
 
 // Updated regex to exclude ES6 dynamic imports
-const REQUIRE_REGEX = /(?!.*await\s+import)(const|var|let)(?:["'\s]*([\w*{}:=\n\r\t,:= ]+)\s*=\s*require\(\s*)?["'\s](.*[@\w_-]+)["'\s]+\);?$|(?!.*await\s+import)require\(["'\s](.*[@\w_-]+)["'\s]\)/gm
+// require() must always be present — previous version made it optional, causing false matches
+// on any const/let/var line containing string literals (e.g. `const x = arr.filter(e => e.type === 'foo')`)
+const REQUIRE_REGEX = /(?!.*await\s+import)(?:(const|var|let)\s+([\w*{}:=\n\r\t,:= $]+)\s*=\s*)?require\(\s*["'](.*[@\w_-]+)["']\s*\);?$/gm
 // https://regex101.com/r/kZ5xCk/3
-const DYNAMIC_REQUIRE_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= ]+)\s*=\s*)?require\(([^()'"]+(?:\([^()]*\)[^()'"]*)*)\)/gm
+const DYNAMIC_REQUIRE_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= $]+)\s*=\s*)?require\(([^()'"]+(?:\([^()]*\)[^()'"]*)*)\)/gm
 
 function getDynamicRequires(code) {
   const results = []
@@ -41,9 +43,9 @@ function getStaticRequires(targetText = '') {
   let requireStatements = []
   var result;
   while((result = REQUIRE_REGEX.exec(targetText)) !== null) {
-    const [ line, varType, names, from, fromTwo ] = result
+    const [ line, varType, names, from ] = result
     // console.log('getStaticRequires result', result)
-    const importLocation = from || fromTwo
+    const importLocation = from
     const importItems = (names || '').trim()
     requireStatements.push({
       line,

package/tests/dep-graph.test.js

@@ -550,4 +550,94 @@ test('verifyNodeModules with returnErrors should collect export mismatch errors'
   assert.ok(result.errors[0].message.includes('does not have a default export'), 'Should be default export error')
 })
 
+// Re-export (export * from) tests
+const ESM_REEXPORT_FIXTURE = path.resolve(__dirname, './fixtures/esm-reexport-fixture/index.js')
+
+test('import from barrel with export * should not fail verification', () => {
+  assert.not.throws(() => {
+    depGraph(ESM_REEXPORT_FIXTURE, { verifyGraph: true })
+  }, 'Importing named exports through export * barrel should not fail')
+})
+
+test('import from barrel with export * should build valid graph', () => {
+  const graph = depGraph(ESM_REEXPORT_FIXTURE, { verifyGraph: true })
+
+  assert.ok(graph instanceof Map, 'Should return a Map')
+  const indexPath = Array.from(graph.keys()).find(key => key.includes('esm-reexport-fixture/index.js'))
+  assert.ok(indexPath, 'Should have index.js in graph')
+
+  const deps = graph.get(indexPath)
+  assert.ok(deps.some(d => d.includes('barrel.js')), 'Should have barrel.js as dependency')
+})
+
+// Namespace import (import * as X) tests
+const ESM_NAMESPACE_FIXTURE = path.resolve(__dirname, './fixtures/esm-namespace-fixture/index.js')
+
+test('namespace import (import * as X) should not require default export', () => {
+  assert.not.throws(() => {
+    depGraph(ESM_NAMESPACE_FIXTURE, { verifyGraph: true })
+  }, 'import * as X should not fail when target has no default export')
+})
+
+test('namespace import should build valid graph', () => {
+  const graph = depGraph(ESM_NAMESPACE_FIXTURE, { verifyGraph: true })
+
+  assert.ok(graph instanceof Map, 'Should return a Map')
+  assert.ok(graph.size > 0, 'Graph should not be empty')
+
+  const indexPath = Array.from(graph.keys()).find(key => key.includes('esm-namespace-fixture/index.js'))
+  assert.ok(indexPath, 'Should have index.js in graph')
+
+  const deps = graph.get(indexPath)
+  assert.ok(deps.some(d => d.includes('utils.js')), 'Should have utils.js as dependency')
+})
+
+// TypeScript patterns fixture — exercises all fixed false positive patterns
+const TS_PATTERNS_FIXTURE = path.resolve(__dirname, './fixtures/ts-patterns-fixture/index.ts')
+
+test('TS patterns: import type, inline type, import * as, $-prefixed names should all pass', () => {
+  // This fixture contains:
+  // - import type { Context } from 'hono' (should be skipped)
+  // - import { helper, type HelperOptions } from './utils.js' (inline type stripped)
+  // - import * as Constants from './constants.js' (namespace import, no default needed)
+  // - import { $transform } from './transforms.js' ($ in name)
+  // - export type = 'import' | 'internal' (type literal, not an import)
+  // - c.req.valid('param'), .filter(), .some(), c.req.header() (not requires)
+  assert.not.throws(() => {
+    depGraph(TS_PATTERNS_FIXTURE, { verifyGraph: true })
+  }, 'All TS patterns should pass verification without errors')
+})
+
+test('TS patterns: should build correct dependency graph', () => {
+  const graph = depGraph(TS_PATTERNS_FIXTURE, { verifyGraph: true })
+
+  assert.ok(graph instanceof Map, 'Should return a Map')
+
+  const indexPath = Array.from(graph.keys()).find(key => key.includes('ts-patterns-fixture/index.ts'))
+  assert.ok(indexPath, 'Should have index.ts in graph')
+
+  const deps = graph.get(indexPath)
+  // Should have utils.ts, constants.ts, transforms.ts as deps
+  assert.ok(deps.some(d => d.includes('utils.ts')), 'Should depend on utils.ts')
+  assert.ok(deps.some(d => d.includes('constants.ts')), 'Should depend on constants.ts')
+  assert.ok(deps.some(d => d.includes('transforms.ts')), 'Should depend on transforms.ts')
+})
+
+test('TS patterns: resolveDepPaths should not include import type packages', () => {
+  const { nodeModules } = resolveDepPaths(TS_PATTERNS_FIXTURE)
+
+  // 'hono' was import type — should NOT appear in nodeModules
+  assert.ok(!nodeModules.includes('hono'), 'import type packages should not appear in nodeModules')
+})
+
+test('TS patterns: resolveDepPaths with returnErrors should have zero errors', () => {
+  const result = resolveDepPaths(TS_PATTERNS_FIXTURE, { returnErrors: true })
+
+  assert.ok(Array.isArray(result.errors), 'Should have errors array')
+  if (result.errors.length > 0) {
+    console.log('Unexpected errors:', result.errors.map(e => e.message))
+  }
+  assert.is(result.errors.length, 0, 'Should have zero verification errors')
+})
+
 test.run()

package/tests/fixtures/esm-namespace-fixture/index.js

@@ -0,0 +1,5 @@
+import * as Utils from './utils.js'
+
+export function main() {
+  return Utils.helper()
+}

package/tests/fixtures/esm-namespace-fixture/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "esm-namespace-fixture",
+  "type": "module"
+}

package/tests/fixtures/esm-namespace-fixture/utils.js

@@ -0,0 +1,7 @@
+export function helper() {
+  return 'hello'
+}
+
+export function other() {
+  return 'world'
+}

package/tests/fixtures/esm-reexport-fixture/barrel.js

@@ -0,0 +1 @@
+export * from './impl.js'

package/tests/fixtures/esm-reexport-fixture/impl.js

@@ -0,0 +1,7 @@
+export function helper() {
+  return 'hello'
+}
+
+export function other() {
+  return 'world'
+}

package/tests/fixtures/esm-reexport-fixture/index.js

@@ -0,0 +1,5 @@
+import { helper, other } from './barrel.js'
+
+export function main() {
+  return helper() + other()
+}

package/tests/fixtures/esm-reexport-fixture/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "esm-reexport-fixture",
+  "type": "module"
+}

package/tests/fixtures/node-module-named-export/node_modules/fake-named-pkg/index.js

@@ -1,4 +1,3 @@
-// Only has named export, no default export
 export function namedFunc() {
-  return 'Hello from named export'
+  return 'hello'
 }

package/tests/fixtures/ts-patterns-fixture/constants.ts

@@ -0,0 +1,2 @@
+export const DEFAULT_NAME = 'world'
+export const MAX_RETRIES = 3

package/tests/fixtures/ts-patterns-fixture/index.ts

@@ -0,0 +1,17 @@
+// This fixture exercises TypeScript patterns that previously caused false positives
+import type { Context } from 'hono'
+import { helper, type HelperOptions } from './utils.js'
+import * as Constants from './constants.js'
+import { $transform } from './transforms.js'
+
+export type EnrollmentSource = 'import' | 'internal' | 'manual'
+
+export async function handler(c: Context) {
+  const { email } = c.req.valid('param')
+  const active = items.filter((e) => e.status === 'active')
+  const replied = timeline.some((e) => e.type === 'reply' || e.type === 'stop')
+  const key = c.req.header('Idempotency-Key')
+
+  const result = helper({ name: Constants.DEFAULT_NAME })
+  return $transform(result)
+}

package/tests/fixtures/ts-patterns-fixture/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "ts-patterns-fixture",
+  "type": "module"
+}

package/tests/fixtures/ts-patterns-fixture/transforms.ts

@@ -0,0 +1,7 @@
+export function $transform(value: string): string {
+  return value.toUpperCase()
+}
+
+export function $validate(value: string): boolean {
+  return value.length > 0
+}

package/tests/fixtures/ts-patterns-fixture/utils.ts

@@ -0,0 +1,7 @@
+export interface HelperOptions {
+  name: string
+}
+
+export function helper(opts: HelperOptions): string {
+  return opts.name
+}

package/tests/get-imports.test.js

@@ -170,7 +170,7 @@ test('getDynamicImports', async () => {
     varType: 'const',
     varName: 'module',
     definitions: { declaration: 'module', name: 'module' },
-    from: "'./module.js'",
+    from: './module.js',
     isImport: true,
     isRelative: true,
     isBuiltIn: false,
@@ -192,9 +192,9 @@ test('getDynamicImports', async () => {
     varType: 'const',
     varName: 'component',
     definitions: { declaration: 'component', name: 'component' },
-    from: '`./src/${folder}/Button.js`',
+    from: './src/${folder}/Button.js',
     isImport: true,
-    isRelative: false,
+    isRelative: true,
     isBuiltIn: false,
     isDynamic: true
   },
@@ -226,7 +226,7 @@ test('getDynamicImports', async () => {
       ],
       name: '{ default: Component, helper }'
     },
-    from: "'./Component.js'",
+    from: './Component.js',
     isImport: true,
     isRelative: true,
     isBuiltIn: false,
@@ -428,6 +428,103 @@ import realImport from 'real'
   assert.equal(importsFound[0].from, 'real', 'Should find real import')
 })
 
+test('should handle $ in import names', () => {
+  const code = `
+import { $add } from 'dynamodb-toolbox/entity/actions/update'
+import { UpdateItemCommand, $add } from 'dynamodb-toolbox/entity/actions/update'
+import { $remove } from 'dynamodb-toolbox/entity/actions/update'
+  `
+
+  const importsFound = getImports(code)
+
+  assert.equal(importsFound.length, 3, 'Should find 3 imports')
+  assert.equal(importsFound[0].from, 'dynamodb-toolbox/entity/actions/update')
+  assert.equal(importsFound[0].varName, '{ $add }')
+  assert.equal(importsFound[1].varName, '{ UpdateItemCommand, $add }')
+  assert.equal(importsFound[2].varName, '{ $remove }')
+})
+
+test('dynamic import should strip quotes from path', () => {
+  const code = `
+const { findContactEmail } = await import('./sfdc-reverse-lookup.js')
+const { invokeAsync } = await import('../../lib/invoke-async.js')
+const { SNSClient } = await import('@aws-sdk/client-sns')
+  `
+
+  const importsFound = getDynamicImports(code)
+
+  assert.equal(importsFound.length, 3, 'Should find 3 dynamic imports')
+  assert.equal(importsFound[0].from, './sfdc-reverse-lookup.js', 'Should strip quotes from relative path')
+  assert.is(importsFound[0].isRelative, true, 'Should detect as relative')
+  assert.equal(importsFound[1].from, '../../lib/invoke-async.js', 'Should strip quotes from relative path')
+  assert.is(importsFound[1].isRelative, true, 'Should detect as relative')
+  assert.equal(importsFound[2].from, '@aws-sdk/client-sns', 'Should strip quotes from package path')
+})
+
+test('should skip type literal unions containing import keyword', () => {
+  const code = `
+export type EnrollmentSource = 'import' | 'internal' | 'manual'
+export type ActionType = 'import' | 'export'
+const x: 'import' | 'require' = getType()
+  `
+
+  const importsFound = getImports(code)
+  assert.equal(importsFound.length, 0, 'Should not match type literal unions')
+})
+
+test('should remove inline type-only names from destructured imports', () => {
+  const code = `
+import { listReviewActions, type ReviewActionChannel, type ReviewActionStatus } from '../lib/action-review.js'
+import { normalizeWorkflowNodes, type WorkflowNode } from '../../lib/workflow-node.js'
+import { type Foo, bar, type Baz } from 'some-pkg'
+  `
+
+  const importsFound = getImports(code)
+  assert.equal(importsFound.length, 3, 'Should find 3 imports')
+
+  // Type-only names should be removed entirely (not just renamed)
+  const firstDefs = importsFound[0].definitions.destructuredParameters.map(p => p.name)
+  assert.equal(firstDefs.length, 1, 'Should only have 1 runtime import')
+  assert.ok(firstDefs.includes('listReviewActions'), 'Should keep listReviewActions')
+  assert.ok(!firstDefs.includes('ReviewActionChannel'), 'type ReviewActionChannel should be removed')
+  assert.ok(!firstDefs.includes('ReviewActionStatus'), 'type ReviewActionStatus should be removed')
+
+  const secondDefs = importsFound[1].definitions.destructuredParameters.map(p => p.name)
+  assert.equal(secondDefs.length, 1, 'Should only have 1 runtime import')
+  assert.ok(secondDefs.includes('normalizeWorkflowNodes'), 'Should keep normalizeWorkflowNodes')
+  assert.ok(!secondDefs.includes('WorkflowNode'), 'type WorkflowNode should be removed')
+
+  // Third: type Foo and type Baz removed, only bar remains
+  const thirdDefs = importsFound[2].definitions.destructuredParameters.map(p => p.name)
+  assert.equal(thirdDefs.length, 1, 'Should only have 1 runtime import')
+  assert.ok(thirdDefs.includes('bar'), 'Should keep bar')
+})
+
+test('should handle all-type destructured imports', () => {
+  const code = `import { type Foo, type Bar } from 'pkg'`
+
+  const importsFound = getImports(code)
+  assert.equal(importsFound.length, 1, 'Should still find the import statement')
+  // No runtime names to verify — definitions may be empty
+  const defs = importsFound[0].definitions?.destructuredParameters || []
+  const runtimeNames = defs.filter(p => !p.name.startsWith('type '))
+  assert.equal(runtimeNames.length, 0, 'Should have no runtime import names')
+})
+
+test('should skip TypeScript import type statements', () => {
+  const code = `
+import type { Context } from 'hono'
+import type { APIGatewayProxyEventV2 } from 'aws-lambda'
+import type { WsEventType } from './ws-events.js'
+import { realImport } from 'real-package'
+  `
+
+  const importsFound = getImports(code)
+
+  assert.equal(importsFound.length, 1, 'Should only find 1 real import')
+  assert.equal(importsFound[0].from, 'real-package', 'Should find real-package import')
+})
+
 test('should preserve URLs with :// in strings', () => {
   const code = `
 import foo from 'foo' // http://example.com

package/tests/get-requires.test.js

@@ -208,4 +208,64 @@ test('getRequires with dynamic requires', async () => {
   ])
 })
 
+test('should not match non-require patterns with string literals', async () => {
+  const code = `
+  const { email: bdrEmail } = c.req.valid('param')
+  const activeBdrs = allActive.filter((u) => u.email !== 'CONFIG')
+  const connections = await Connection.getByMember(bdr.email, 'gmail')
+  const replied = timeline.some((e) => e.type === 'reply' || e.type === 'stop')
+  const lastSent = timeline.find((e) => e.type === 'email_sent')
+  const key = c.req.header('Idempotency-Key')
+  const { enabled, endDate, handoff } = c.req.valid('json')
+  const active = enrollmentItems.filter((e) => e.status === 'active')
+  const { limit } = c.req.valid('query')
+  const vacationPaused = enrollmentItems.filter((e) => e.status === 'paused' && e.pauseReason === 'vacation')
+  const activeEnrollments = enrollmentItems.filter((e) => e.status === 'active' || e.status === 'pending_review')
+  `
+
+  const requiresFound = getRequires(code)
+  assert.equal(requiresFound.length, 0, 'Should not match any non-require patterns')
+})
+
+test('should handle $ and _ in variable names', async () => {
+  const code = `
+  const { $add } = require('dynamodb-toolbox')
+  const $ref = require('reactive')
+  const _lodash = require('lodash')
+  const { _private, __double } = require('internal')
+  const { $$ref, _0x1234 } = require('edge-case')
+  `
+
+  const requiresFound = getRequires(code).filter(r => !r.isDynamic)
+  assert.equal(requiresFound.length, 5, 'Should find 5 requires with special chars')
+  assert.equal(requiresFound[0].from, 'dynamodb-toolbox')
+  assert.equal(requiresFound[0].varName, '{ $add }')
+  assert.equal(requiresFound[1].from, 'reactive')
+  assert.equal(requiresFound[1].varName, '$ref')
+  assert.equal(requiresFound[2].from, 'lodash')
+  assert.equal(requiresFound[2].varName, '_lodash')
+  assert.equal(requiresFound[3].from, 'internal')
+  assert.equal(requiresFound[3].varName, '{ _private, __double }')
+  assert.equal(requiresFound[4].from, 'edge-case')
+  assert.equal(requiresFound[4].varName, '{ $$ref, _0x1234 }')
+})
+
+test('should still match real requires mixed with non-require code', async () => {
+  const code = `
+  const path = require('path')
+  const active = items.filter((e) => e.status === 'active')
+  const { foo, bar } = require('some-pkg')
+  const key = c.req.header('Idempotency-Key')
+  require('side-effect-only')
+  `
+
+  const requiresFound = getRequires(code)
+  // Should only match the 3 real requires, not the filter or req.header
+  const staticRequires = requiresFound.filter(r => !r.isDynamic)
+  assert.equal(staticRequires.length, 3, 'Should find exactly 3 real requires')
+  assert.equal(staticRequires[0].from, 'path')
+  assert.equal(staticRequires[1].from, 'some-pkg')
+  assert.equal(staticRequires[2].from, 'side-effect-only')
+})
+
 test.run()

package/.claude/settings.local.json

@@ -1,17 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(node:*)",
-      "Bash(npm audit:*)",
-      "Bash(npm view:*)",
-      "Bash(npm pack:*)",
-      "Bash(tar:*)",
-      "Bash(npm install)",
-      "Bash(npm test)",
-      "Bash(npm test:*)",
-      "Bash(npm run types:*)"
-    ],
-    "deny": [],
-    "ask": []
-  }
-}

package/types/dep-graph.d.ts

@@ -1,45 +0,0 @@
-/**
- * Build dependency graph for a file and its dependencies
- * @param {string} filePath - File to analyze
- * @param {object} options - Options
- * @param {boolean} [options.buildGraph] - If true, build and return dependency graph. Default: true
- * @param {boolean} [options.verifyGraph] - If true, verify imports/exports. Default: true
- * @param {boolean} [options.verifyNodeModules] - If true, verify node_modules packages can be resolved. Default: false
- * @param {boolean} [options.includeNodeModules] - If true, include node_modules package names in the graph. Default: false
- * @param {boolean} [options.throwOnFirstError] - If true, throw immediately on first error. Default: false
- * @param {boolean} [options.returnErrors] - If true, return { graph, errors } instead of throwing. Default: false
- * @returns {Map<string, string[]>|{graph: Map, errors: Error[]}|undefined} - Dependency graph, or { graph, errors } if returnErrors is true. Returns undefined if buildGraph is false.
- */
-export function depGraph(filePath: string, options?: {
-    buildGraph?: boolean;
-    verifyGraph?: boolean;
-    verifyNodeModules?: boolean;
-    includeNodeModules?: boolean;
-    throwOnFirstError?: boolean;
-    returnErrors?: boolean;
-}): Map<string, string[]> | {
-    graph: Map<any, any>;
-    errors: Error[];
-} | undefined;
-/**
- * Get all dependency file paths in build order (dependencies first), deduplicated
- * @param {string} filePath - Entry file path
- * @param {object} options - Options to pass to depGraph
- * @param {boolean} [options.verifyGraph] - If true, verify imports/exports. Default: true
- * @param {boolean} [options.verifyNodeModules] - If true, verify node_modules packages can be resolved. Default: false
- * @param {boolean} [options.throwOnFirstError] - If true, throw immediately on first error. Default: false
- * @param {boolean} [options.returnErrors] - If true, include errors array in result instead of throwing
- * @returns {{ files: string[], nodeModules: string[], builtIns: string[], errors?: Error[] }} - Object with files in topological order, npm packages, and Node.js built-ins
- */
-export function resolveDepPaths(filePath: string, options?: {
-    verifyGraph?: boolean;
-    verifyNodeModules?: boolean;
-    throwOnFirstError?: boolean;
-    returnErrors?: boolean;
-}): {
-    files: string[];
-    nodeModules: string[];
-    builtIns: string[];
-    errors?: Error[];
-};
-//# sourceMappingURL=dep-graph.d.ts.map

package/types/dep-graph.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dep-graph.d.ts","sourceRoot":"","sources":["../src/dep-graph.js"],"names":[],"mappings":"AA4RA;;;;;;;;;;;GAWG;AACH,mCAVW,MAAM,YAEd;IAA0B,UAAU,GAA5B,OAAO;IACW,WAAW,GAA7B,OAAO;IACW,iBAAiB,GAAnC,OAAO;IACW,kBAAkB,GAApC,OAAO;IACW,iBAAiB,GAAnC,OAAO;IACW,YAAY,GAA9B,OAAO;CACf,GAAU,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAC;IAAC,KAAK,gBAAM;IAAC,MAAM,EAAE,KAAK,EAAE,CAAA;CAAC,GAAC,SAAS,CA8BzE;AAGD;;;;;;;;;GASG;AACH,0CARW,MAAM,YAEd;IAA0B,WAAW,GAA7B,OAAO;IACW,iBAAiB,GAAnC,OAAO;IACW,iBAAiB,GAAnC,OAAO;IACW,YAAY,GAA9B,OAAO;CACf,GAAU;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAA;CAAE,CAkF5F"}