@davidwells/extract-deps 0.1.5 → 0.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidwells/extract-deps",
-  "version": "0.1.5",
+  "version": "0.1.8",
   "description": "Get imports and requires from a codebase without AST",
   "main": "src/index.js",
   "exports": {

package/src/dep-graph.js

@@ -79,12 +79,17 @@ function verifyImportedValuesExist(dep, targetDeps, targetPath, sourcePath, erro
 
     // Check CommonJS exports
     const exportedNames = new Set()
+    let hasReExportAll = false
     if (targetDeps.moduleExports && targetDeps.moduleExports.length > 0) {
       for (const exp of targetDeps.moduleExports) {
         if (exp.exportType === 'named') {
           exportedNames.add(exp.exportName)
         } else if (exp.exportType === 'default' && exp.keys) {
           exp.keys.forEach(key => exportedNames.add(key))
+        } else if (exp.exportType === 'all') {
+          // Bundler-emitted dynamic re-export-all (Object.keys+forEach,
+          // __exportStar, __reExport). Same semantics as ESM `export * from`.
+          hasReExportAll = true
         }
       }
     }
@@ -92,6 +97,11 @@ function verifyImportedValuesExist(dep, targetDeps, targetPath, sourcePath, erro
     // Check ESM exports
     if (targetDeps.exports && targetDeps.exports.length > 0) {
       for (const exp of targetDeps.exports) {
+        if (exp.exportType === 'all') {
+          // export * from './module' — can't know what names are re-exported without
+          // following the chain, so skip verification for this module
+          hasReExportAll = true
+        }
         const exportedName = exp.exportAlias || exp.exportName
         if (exportedName) {
           exportedNames.add(exportedName)
@@ -99,6 +109,11 @@ function verifyImportedValuesExist(dep, targetDeps, targetPath, sourcePath, erro
       }
     }
 
+    // If module uses export * from, we can't verify names — skip
+    if (hasReExportAll) {
+      return
+    }
+
     // Verify each imported name is exported
     for (const importedName of importedNames) {
       if (!exportedNames.has(importedName)) {
@@ -121,6 +136,10 @@ function verifyImportedValuesExist(dep, targetDeps, targetPath, sourcePath, erro
   // Only applies to ESM imports - CJS require() gets whatever module.exports is
   else {
     if (dep.isESM) {
+      // Namespace imports (import * as X) don't need a default export
+      if (dep.varName && dep.varName.startsWith('*')) {
+        return
+      }
       // ESM import X from 'pkg' requires a default export
       const hasModuleExports = targetDeps.moduleExports && targetDeps.moduleExports.length > 0
       const hasESMExports = targetDeps.exports && targetDeps.exports.length > 0

package/src/get-cjs-exports.js

@@ -41,22 +41,33 @@ function getCjsExports(code) {
   const assignmentExports = getModuleExportsAssignment(code, sanitizedCode)
   const modulePropertyExports = getModuleExportsProperty(code, sanitizedCode)
   const propertyExports = getExportsProperty(code, sanitizedCode)
-  
+
   // Quick pre-checks to avoid expensive regex operations when not needed
   const objectAssignExports = sanitizedCode.includes('Object.assign')
     ? getObjectAssignExports(code, sanitizedCode)
     : []
-  
+
   const definePropertyExports = sanitizedCode.includes('Object.defineProperty')
     ? getDefinePropertyExports(code, sanitizedCode)
     : []
 
+  // Detect dynamic CJS re-export-all patterns emitted by Rollup, tsc, esbuild,
+  // and friends. Cheap substring guard first to avoid the regex work on files
+  // that obviously can't contain these patterns.
+  const reExportAllExports =
+    sanitizedCode.includes('Object.keys(') ||
+    sanitizedCode.includes('__exportStar') ||
+    sanitizedCode.includes('__reExport')
+      ? getReExportAllPatterns(code, sanitizedCode)
+      : []
+
   /*
   console.log('assignmentExports', assignmentExports)
   console.log('modulePropertyExports', modulePropertyExports)
   console.log('propertyExports', propertyExports)
   console.log('objectAssignExports', objectAssignExports)
   console.log('definePropertyExports', definePropertyExports)
+  console.log('reExportAllExports', reExportAllExports)
   /** */
 
   const allExports = []
@@ -65,6 +76,7 @@ function getCjsExports(code) {
     .concat(propertyExports)
     .concat(objectAssignExports)
     .concat(definePropertyExports)
+    .concat(reExportAllExports)
 
   return allExports.sort((a, b) => a.index - b.index)
 }
@@ -372,6 +384,83 @@ function getDefinePropertyExports(originalText = '', sanitizedText = originalTex
   return exportStatements
 }
 
+/**
+ * Detect dynamic CJS re-export-all patterns where a module forwards every
+ * named export of another module at runtime. Bundlers emit these for ESM
+ * `export * from './x'` syntax when targeting CJS:
+ *
+ *   - Rollup:   `Object.keys(X).forEach(function(k){ if (k!=='default' && ...) exports[k]=X[k] })`
+ *   - tsc/tslib: `__exportStar(require('./x'), exports)` / `tslib.__exportStar(...)`
+ *   - esbuild:  `__reExport(stdin_exports, require('./x'))`
+ *
+ * We don't try to resolve the require and merge names — that's recursive and
+ * filesystem-dependent. Instead each match emits `exportType: 'all'`, the same
+ * marker `get-exports.js` uses for ESM `export * from`. Downstream validators
+ * already skip name-verification when they see this marker, so importing a
+ * name that's only available via dynamic re-export no longer false-positives.
+ *
+ * Captures the require path or source-variable name into `from` when visible,
+ * for debugging and future resolve-and-merge work.
+ */
+function getReExportAllPatterns(originalText = '', sanitizedText = originalText) {
+  const exportStatements = []
+
+  // Rollup `Object.keys(X).forEach(function(k){ ... exports[k] = X[k] ... })`.
+  // Allow either `function (k)` or `(k) =>` and any condition on `k` inside.
+  const rollupPattern = /Object\.keys\s*\(\s*(\w+)\s*\)\s*\.forEach\s*\(\s*(?:function\s*\(\s*\w+\s*\)|\(?\s*\w+\s*\)?\s*=>)\s*\{[^}]*exports\s*\[\s*\w+\s*\]\s*=\s*\1\s*\[/g
+  let result
+  while ((result = rollupPattern.exec(sanitizedText)) !== null) {
+    const sourceVar = result[1]
+    exportStatements.push({
+      line: result[0].split('\n')[0].trim(),
+      exportType: 'all',
+      exportName: '',
+      exportValue: result[0],
+      from: sourceVar,
+      index: result.index,
+      isExport: true,
+      isReExportAll: true
+    })
+  }
+
+  // tslib / tsc `__exportStar(<source>, exports)` where source is either
+  // a `require('./x')` call or a bare identifier holding a prior require.
+  const exportStarPattern = /(?:\w+\.)?__exportStar\s*\(\s*(?:require\s*\(\s*['"]([^'"]+)['"]\s*\)|(\w+))\s*,\s*(?:module\.)?exports\s*\)/g
+  while ((result = exportStarPattern.exec(sanitizedText)) !== null) {
+    const from = result[1] || result[2]
+    exportStatements.push({
+      line: result[0].trim(),
+      exportType: 'all',
+      exportName: '',
+      exportValue: result[0],
+      from,
+      index: result.index,
+      isExport: true,
+      isReExportAll: true
+    })
+  }
+
+  // esbuild `__reExport(<exports-target>, <source>)`. The exports-target is
+  // typically an identifier ending in `_exports` or `exports`, and the source
+  // is again a `require()` call or an identifier.
+  const reExportPattern = /__reExport\s*\(\s*\w+\s*,\s*(?:require\s*\(\s*['"]([^'"]+)['"]\s*\)|(\w+))\s*(?:,\s*[^)]*)?\)/g
+  while ((result = reExportPattern.exec(sanitizedText)) !== null) {
+    const from = result[1] || result[2]
+    exportStatements.push({
+      line: result[0].trim(),
+      exportType: 'all',
+      exportName: '',
+      exportValue: result[0],
+      from,
+      index: result.index,
+      isExport: true,
+      isReExportAll: true
+    })
+  }
+
+  return exportStatements
+}
+
 if (require.main === module) {
   const code = `
 // module.exports assignment

package/src/get-imports.js

@@ -1,13 +1,28 @@
 const { isBuiltIn, isRelativeImport, isRelativeImportWithQuotes, getNames, stripComments } = require('./utils')
 
 // https://regex101.com/r/cfEmlm/1
-const IMPORT_REGEX = /import(?:["'\s]*([\w*{}\n\r\t, ]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+;?$/gm
+// Path excludes quotes, newlines, and `;` so multi-statement lines like
+// `import a from 'a'; import b from 'b'` parse as two distinct matches
+// instead of one match that spans the semicolon. The leading separator is
+// `["'\s]+` (not `["'\s]`) so it can consume both the gap whitespace and the
+// opening quote in one go — without that, the path group is left starting on
+// the quote and fails for side-effect imports like `import './foo.js'`.
+// Closing is `\s*["']` (not `["'\s]+;?`) so the captured `line` stops at the
+// closing quote instead of bleeding into the next line's whitespace.
+// Negative lookahead `(?!\s*(?:assert|with)\s*\{)` keeps this from matching
+// import-attributes/assertion imports — those go through ASSERTION_IMPORT_REGEX
+// and would otherwise be double-counted in `getImports`.
+const IMPORT_REGEX = /import(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s]+([^"'`\n;\s]+)\s*["'](?!\s*(?:assert|with)\s*\{)/gm
 // https://regex101.com/r/UDmXlb/1
 const IMPORT_TYPE_REGEX = /import\(['"](.*)['"]\)\.?([A-Za-z_0-9.]*)?/gm
 // https://regex101.com/r/UDjMoV/1
-const DYNAMIC_IMPORT_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= ]+)\s*=\s*)?await\s+import\(([^()]+(?:\([^()]*\)[^()]*)*)\)/gm
+// `await` is optional so `import('./foo').then(...)`, `const p = import('./foo')`,
+// `return import('./foo')`, and `lazy(() => import('./foo'))` all match.
+// `(?<!\.)\b` rejects member access (`obj.import(...)`) and identifiers like
+// `myimport(...)`.
+const DYNAMIC_IMPORT_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= $]+)\s*=\s*)?(?:await\s+)?(?<!\.)\bimport\(([^()]+(?:\([^()]*\)[^()]*)*)\)/gm
 // https://regex101.com/r/example/1
-const ASSERTION_IMPORT_REGEX = /(?:^|\n)\s*import\s+(?:["'\s]*([\w*{}\n\r\t, ]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+(assert|with)\s*\{([^}]+)\};?$/gm
+const ASSERTION_IMPORT_REGEX = /(?:^|\n)\s*import\s+(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s]+([^"'`\n;\s]+)\s*["']\s+(assert|with)\s*\{([^}]+)\}/gm
 
 function getImports(code = '', options = {}) {
   // Strip comments to avoid false positives
@@ -26,8 +41,23 @@ function getStaticImports(targetText = '') {
   let importStatements = []
   var result;
   while((result = IMPORT_REGEX.exec(targetText)) !== null) {
-    const [ line, names, from ] = result
-    const namesValues = (names || '').trim()
+    const [ line, names, rawFrom ] = result
+    // Side-effect imports (e.g. `import './foo.js'`) and unnamed-default imports skip the
+    // optional `from` capture, so the opening quote ends up inside the path group. Strip it.
+    const from = rawFrom.replace(/^["'`]|["'`]$/g, '')
+    // Skip TypeScript type-only imports — erased at compile time, no runtime resolution needed
+    if (/^\s*import\s+type\s/.test(line)) {
+      continue
+    }
+    // Skip false matches where `import` appears inside a string literal (e.g. `= 'import' | 'internal'`)
+    // A valid module path won't contain operators like | = ( )
+    if (/[|=()]/.test(from)) {
+      continue
+    }
+    // Remove inline `type` imports from destructured names — they're erased at compile time
+    // e.g. `{ foo, type Bar, type Baz }` → `{ foo }` (Bar and Baz are type-only)
+    const rawNames = (names || '').trim()
+    const namesValues = rawNames.replace(/,?\s*\btype\s+[\w$]+/g, '').replace(/^,\s*/, '').trim()
     importStatements.push({
       line,
       varType: 'const',
@@ -67,19 +97,21 @@ function getDynamicImports(targetText = '') {
   let importStatements = []
   var result;
   while((result = DYNAMIC_IMPORT_REGEX.exec(targetText)) !== null) {
-    const [ line, varType, names, from ] = result
+    const [ line, varType, names, rawFrom ] = result
     let namesValues = (names || '').trim()
-    
+    // Strip surrounding quotes from dynamic import paths (e.g. './foo.js' → ./foo.js)
+    const from = rawFrom.trim().replace(/^["'`]|["'`]$/g, '')
+
     importStatements.push({
       line,
       varType: varType || '',
       varName: namesValues,
       definitions: names ? getNames(namesValues) : null,
-      from: from.trim(),
+      from,
       index: result.index,
       isImport: true,
-      isRelative: isRelativeImport(from) || isRelativeImportWithQuotes(from),
-      isBuiltIn: isBuiltIn(from.trim()),
+      isRelative: isRelativeImport(from),
+      isBuiltIn: isBuiltIn(from),
       isDynamic: true
     })
   }
@@ -90,7 +122,8 @@ function getAssertionImports(targetText = '') {
   let importStatements = []
   var result;
   while((result = ASSERTION_IMPORT_REGEX.exec(targetText)) !== null) {
-    let [ line, names, from, keyword, assertion ] = result
+    let [ line, names, rawFrom, keyword, assertion ] = result
+    const from = rawFrom.replace(/^["'`]|["'`]$/g, '')
     const namesValues = (names || '').trim()
     // Remove leading newlines and whitespace from the line
     line = line.replace(/^\s+|\s+$/g, '')

package/src/get-requires.js

@@ -1,9 +1,11 @@
 const { isBuiltIn, isRelativeImport, getNames } = require('./utils')
 
 // Updated regex to exclude ES6 dynamic imports
-const REQUIRE_REGEX = /(?!.*await\s+import)(const|var|let)(?:["'\s]*([\w*{}:=\n\r\t,:= ]+)\s*=\s*require\(\s*)?["'\s](.*[@\w_-]+)["'\s]+\);?$|(?!.*await\s+import)require\(["'\s](.*[@\w_-]+)["'\s]\)/gm
+// require() must always be present — previous version made it optional, causing false matches
+// on any const/let/var line containing string literals (e.g. `const x = arr.filter(e => e.type === 'foo')`)
+const REQUIRE_REGEX = /(?!.*await\s+import)(?:(const|var|let)\s+([\w*{}:=\n\r\t,:= $]+)\s*=\s*)?require\(\s*["'](.*[@\w_-]+)["']\s*\);?$/gm
 // https://regex101.com/r/kZ5xCk/3
-const DYNAMIC_REQUIRE_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= ]+)\s*=\s*)?require\(([^()'"]+(?:\([^()]*\)[^()'"]*)*)\)/gm
+const DYNAMIC_REQUIRE_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= $]+)\s*=\s*)?require\(([^()'"]+(?:\([^()]*\)[^()'"]*)*)\)/gm
 
 function getDynamicRequires(code) {
   const results = []
@@ -41,9 +43,9 @@ function getStaticRequires(targetText = '') {
   let requireStatements = []
   var result;
   while((result = REQUIRE_REGEX.exec(targetText)) !== null) {
-    const [ line, varType, names, from, fromTwo ] = result
+    const [ line, varType, names, from ] = result
     // console.log('getStaticRequires result', result)
-    const importLocation = from || fromTwo
+    const importLocation = from
     const importItems = (names || '').trim()
     requireStatements.push({
       line,

package/tests/dep-graph.test.js

@@ -550,4 +550,94 @@ test('verifyNodeModules with returnErrors should collect export mismatch errors'
   assert.ok(result.errors[0].message.includes('does not have a default export'), 'Should be default export error')
 })
 
+// Re-export (export * from) tests
+const ESM_REEXPORT_FIXTURE = path.resolve(__dirname, './fixtures/esm-reexport-fixture/index.js')
+
+test('import from barrel with export * should not fail verification', () => {
+  assert.not.throws(() => {
+    depGraph(ESM_REEXPORT_FIXTURE, { verifyGraph: true })
+  }, 'Importing named exports through export * barrel should not fail')
+})
+
+test('import from barrel with export * should build valid graph', () => {
+  const graph = depGraph(ESM_REEXPORT_FIXTURE, { verifyGraph: true })
+
+  assert.ok(graph instanceof Map, 'Should return a Map')
+  const indexPath = Array.from(graph.keys()).find(key => key.includes('esm-reexport-fixture/index.js'))
+  assert.ok(indexPath, 'Should have index.js in graph')
+
+  const deps = graph.get(indexPath)
+  assert.ok(deps.some(d => d.includes('barrel.js')), 'Should have barrel.js as dependency')
+})
+
+// Namespace import (import * as X) tests
+const ESM_NAMESPACE_FIXTURE = path.resolve(__dirname, './fixtures/esm-namespace-fixture/index.js')
+
+test('namespace import (import * as X) should not require default export', () => {
+  assert.not.throws(() => {
+    depGraph(ESM_NAMESPACE_FIXTURE, { verifyGraph: true })
+  }, 'import * as X should not fail when target has no default export')
+})
+
+test('namespace import should build valid graph', () => {
+  const graph = depGraph(ESM_NAMESPACE_FIXTURE, { verifyGraph: true })
+
+  assert.ok(graph instanceof Map, 'Should return a Map')
+  assert.ok(graph.size > 0, 'Graph should not be empty')
+
+  const indexPath = Array.from(graph.keys()).find(key => key.includes('esm-namespace-fixture/index.js'))
+  assert.ok(indexPath, 'Should have index.js in graph')
+
+  const deps = graph.get(indexPath)
+  assert.ok(deps.some(d => d.includes('utils.js')), 'Should have utils.js as dependency')
+})
+
+// TypeScript patterns fixture — exercises all fixed false positive patterns
+const TS_PATTERNS_FIXTURE = path.resolve(__dirname, './fixtures/ts-patterns-fixture/index.ts')
+
+test('TS patterns: import type, inline type, import * as, $-prefixed names should all pass', () => {
+  // This fixture contains:
+  // - import type { Context } from 'hono' (should be skipped)
+  // - import { helper, type HelperOptions } from './utils.js' (inline type stripped)
+  // - import * as Constants from './constants.js' (namespace import, no default needed)
+  // - import { $transform } from './transforms.js' ($ in name)
+  // - export type = 'import' | 'internal' (type literal, not an import)
+  // - c.req.valid('param'), .filter(), .some(), c.req.header() (not requires)
+  assert.not.throws(() => {
+    depGraph(TS_PATTERNS_FIXTURE, { verifyGraph: true })
+  }, 'All TS patterns should pass verification without errors')
+})
+
+test('TS patterns: should build correct dependency graph', () => {
+  const graph = depGraph(TS_PATTERNS_FIXTURE, { verifyGraph: true })
+
+  assert.ok(graph instanceof Map, 'Should return a Map')
+
+  const indexPath = Array.from(graph.keys()).find(key => key.includes('ts-patterns-fixture/index.ts'))
+  assert.ok(indexPath, 'Should have index.ts in graph')
+
+  const deps = graph.get(indexPath)
+  // Should have utils.ts, constants.ts, transforms.ts as deps
+  assert.ok(deps.some(d => d.includes('utils.ts')), 'Should depend on utils.ts')
+  assert.ok(deps.some(d => d.includes('constants.ts')), 'Should depend on constants.ts')
+  assert.ok(deps.some(d => d.includes('transforms.ts')), 'Should depend on transforms.ts')
+})
+
+test('TS patterns: resolveDepPaths should not include import type packages', () => {
+  const { nodeModules } = resolveDepPaths(TS_PATTERNS_FIXTURE)
+
+  // 'hono' was import type — should NOT appear in nodeModules
+  assert.ok(!nodeModules.includes('hono'), 'import type packages should not appear in nodeModules')
+})
+
+test('TS patterns: resolveDepPaths with returnErrors should have zero errors', () => {
+  const result = resolveDepPaths(TS_PATTERNS_FIXTURE, { returnErrors: true })
+
+  assert.ok(Array.isArray(result.errors), 'Should have errors array')
+  if (result.errors.length > 0) {
+    console.log('Unexpected errors:', result.errors.map(e => e.message))
+  }
+  assert.is(result.errors.length, 0, 'Should have zero verification errors')
+})
+
 test.run()

package/tests/fixtures/esm-namespace-fixture/index.js

@@ -0,0 +1,5 @@
+import * as Utils from './utils.js'
+
+export function main() {
+  return Utils.helper()
+}

package/tests/fixtures/esm-namespace-fixture/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "esm-namespace-fixture",
+  "type": "module"
+}

package/tests/fixtures/esm-namespace-fixture/utils.js

@@ -0,0 +1,7 @@
+export function helper() {
+  return 'hello'
+}
+
+export function other() {
+  return 'world'
+}

package/tests/fixtures/esm-reexport-fixture/barrel.js

@@ -0,0 +1 @@
+export * from './impl.js'

package/tests/fixtures/esm-reexport-fixture/impl.js

@@ -0,0 +1,7 @@
+export function helper() {
+  return 'hello'
+}
+
+export function other() {
+  return 'world'
+}

package/tests/fixtures/esm-reexport-fixture/index.js

@@ -0,0 +1,5 @@
+import { helper, other } from './barrel.js'
+
+export function main() {
+  return helper() + other()
+}

package/tests/fixtures/esm-reexport-fixture/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "esm-reexport-fixture",
+  "type": "module"
+}

package/tests/fixtures/ts-patterns-fixture/constants.ts

@@ -0,0 +1,2 @@
+export const DEFAULT_NAME = 'world'
+export const MAX_RETRIES = 3

package/tests/fixtures/ts-patterns-fixture/index.ts

@@ -0,0 +1,17 @@
+// This fixture exercises TypeScript patterns that previously caused false positives
+import type { Context } from 'hono'
+import { helper, type HelperOptions } from './utils.js'
+import * as Constants from './constants.js'
+import { $transform } from './transforms.js'
+
+export type EnrollmentSource = 'import' | 'internal' | 'manual'
+
+export async function handler(c: Context) {
+  const { email } = c.req.valid('param')
+  const active = items.filter((e) => e.status === 'active')
+  const replied = timeline.some((e) => e.type === 'reply' || e.type === 'stop')
+  const key = c.req.header('Idempotency-Key')
+
+  const result = helper({ name: Constants.DEFAULT_NAME })
+  return $transform(result)
+}

package/tests/fixtures/ts-patterns-fixture/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "ts-patterns-fixture",
+  "type": "module"
+}

package/tests/fixtures/ts-patterns-fixture/transforms.ts

@@ -0,0 +1,7 @@
+export function $transform(value: string): string {
+  return value.toUpperCase()
+}
+
+export function $validate(value: string): boolean {
+  return value.length > 0
+}

package/tests/fixtures/ts-patterns-fixture/utils.ts

@@ -0,0 +1,7 @@
+export interface HelperOptions {
+  name: string
+}
+
+export function helper(opts: HelperOptions): string {
+  return opts.name
+}

package/tests/get-cjs-exports.test.js

@@ -759,4 +759,96 @@ Object.defineProperty(exports, 'version', {
   }
 })
 
+test('detects Rollup-style Object.keys(X).forEach re-export-all', () => {
+  // Matches the pattern emitted by Rollup (and used in AWS SDK v3 dist-cjs)
+  // for ESM `export * from './x'` when targeting CJS.
+  const code = `
+var errors = require('./models/errors');
+Object.keys(errors).forEach(function (k) {
+  if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) exports[k] = errors[k];
+});
+exports.realNamed = realNamed;
+  `
+
+  const found = getCjsExports(code)
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 1, 'Should detect 1 dynamic re-export-all')
+  assert.equal(reExports[0].from, 'errors', 'Should capture the source variable name')
+  assert.is(reExports[0].isReExportAll, true, 'Should set isReExportAll flag')
+
+  // The explicit named export must still be picked up alongside
+  assert.ok(found.some(e => e.exportType === 'named' && e.exportName === 'realNamed'))
+})
+
+test('detects tsc/tslib __exportStar re-export-all', () => {
+  const code = `
+var tslib_1 = require("tslib");
+__exportStar(require("./module-a"), exports);
+tslib_1.__exportStar(require("./module-b"), exports);
+var moduleC = require("./module-c");
+__exportStar(moduleC, exports);
+  `
+
+  const found = getCjsExports(code)
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 3, 'Should detect 3 __exportStar calls')
+
+  const fromValues = reExports.map(e => e.from).sort()
+  assert.equal(fromValues, ['./module-a', './module-b', 'moduleC'].sort())
+})
+
+test('detects esbuild __reExport re-export-all', () => {
+  const code = `
+var stdin_exports = {};
+__export(stdin_exports, { foo: () => foo });
+__reExport(stdin_exports, require("./module-a"));
+var moduleB = require("./module-b");
+__reExport(stdin_exports, moduleB);
+  `
+
+  const found = getCjsExports(code)
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 2, 'Should detect 2 __reExport calls')
+
+  const fromValues = reExports.map(e => e.from).sort()
+  assert.equal(fromValues, ['./module-a', 'moduleB'].sort())
+})
+
+test('re-export-all patterns coexist with explicit named exports', () => {
+  // A real-world file mixes both — make sure both end up in moduleExports.
+  const code = `
+var errors = require('./errors');
+exports.Foo = Foo;
+exports.Bar = Bar;
+Object.keys(errors).forEach(function (k) {
+  if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) exports[k] = errors[k];
+});
+exports.Baz = Baz;
+  `
+
+  const found = getCjsExports(code)
+  const named = found.filter(e => e.exportType === 'named').map(e => e.exportName).sort()
+  assert.equal(named, ['Bar', 'Baz', 'Foo'])
+
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 1)
+  assert.equal(reExports[0].from, 'errors')
+})
+
+test('does NOT flag unrelated Object.keys / forEach calls as re-export-all', () => {
+  // Only the specific `exports[k] = X[k]` shape should trigger detection.
+  const code = `
+Object.keys(someObj).forEach(function (k) {
+  console.log(k, someObj[k]);
+});
+Object.keys(config).forEach((k) => {
+  process.env[k] = config[k];
+});
+  `
+
+  const found = getCjsExports(code)
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 0, 'Should not match Object.keys patterns that do not assign to exports')
+})
+
 test.run()

package/tests/get-imports.test.js

@@ -170,7 +170,7 @@ test('getDynamicImports', async () => {
     varType: 'const',
     varName: 'module',
     definitions: { declaration: 'module', name: 'module' },
-    from: "'./module.js'",
+    from: './module.js',
     isImport: true,
     isRelative: true,
     isBuiltIn: false,
@@ -192,9 +192,9 @@ test('getDynamicImports', async () => {
     varType: 'const',
     varName: 'component',
     definitions: { declaration: 'component', name: 'component' },
-    from: '`./src/${folder}/Button.js`',
+    from: './src/${folder}/Button.js',
     isImport: true,
-    isRelative: false,
+    isRelative: true,
     isBuiltIn: false,
     isDynamic: true
   },
@@ -226,7 +226,7 @@ test('getDynamicImports', async () => {
       ],
       name: '{ default: Component, helper }'
     },
-    from: "'./Component.js'",
+    from: './Component.js',
     isImport: true,
     isRelative: true,
     isBuiltIn: false,
@@ -428,6 +428,103 @@ import realImport from 'real'
   assert.equal(importsFound[0].from, 'real', 'Should find real import')
 })
 
+test('should handle $ in import names', () => {
+  const code = `
+import { $add } from 'dynamodb-toolbox/entity/actions/update'
+import { UpdateItemCommand, $add } from 'dynamodb-toolbox/entity/actions/update'
+import { $remove } from 'dynamodb-toolbox/entity/actions/update'
+  `
+
+  const importsFound = getImports(code)
+
+  assert.equal(importsFound.length, 3, 'Should find 3 imports')
+  assert.equal(importsFound[0].from, 'dynamodb-toolbox/entity/actions/update')
+  assert.equal(importsFound[0].varName, '{ $add }')
+  assert.equal(importsFound[1].varName, '{ UpdateItemCommand, $add }')
+  assert.equal(importsFound[2].varName, '{ $remove }')
+})
+
+test('dynamic import should strip quotes from path', () => {
+  const code = `
+const { findContactEmail } = await import('./sfdc-reverse-lookup.js')
+const { invokeAsync } = await import('../../lib/invoke-async.js')
+const { SNSClient } = await import('@aws-sdk/client-sns')
+  `
+
+  const importsFound = getDynamicImports(code)
+
+  assert.equal(importsFound.length, 3, 'Should find 3 dynamic imports')
+  assert.equal(importsFound[0].from, './sfdc-reverse-lookup.js', 'Should strip quotes from relative path')
+  assert.is(importsFound[0].isRelative, true, 'Should detect as relative')
+  assert.equal(importsFound[1].from, '../../lib/invoke-async.js', 'Should strip quotes from relative path')
+  assert.is(importsFound[1].isRelative, true, 'Should detect as relative')
+  assert.equal(importsFound[2].from, '@aws-sdk/client-sns', 'Should strip quotes from package path')
+})
+
+test('should skip type literal unions containing import keyword', () => {
+  const code = `
+export type EnrollmentSource = 'import' | 'internal' | 'manual'
+export type ActionType = 'import' | 'export'
+const x: 'import' | 'require' = getType()
+  `
+
+  const importsFound = getImports(code)
+  assert.equal(importsFound.length, 0, 'Should not match type literal unions')
+})
+
+test('should remove inline type-only names from destructured imports', () => {
+  const code = `
+import { listReviewActions, type ReviewActionChannel, type ReviewActionStatus } from '../lib/action-review.js'
+import { normalizeWorkflowNodes, type WorkflowNode } from '../../lib/workflow-node.js'
+import { type Foo, bar, type Baz } from 'some-pkg'
+  `
+
+  const importsFound = getImports(code)
+  assert.equal(importsFound.length, 3, 'Should find 3 imports')
+
+  // Type-only names should be removed entirely (not just renamed)
+  const firstDefs = importsFound[0].definitions.destructuredParameters.map(p => p.name)
+  assert.equal(firstDefs.length, 1, 'Should only have 1 runtime import')
+  assert.ok(firstDefs.includes('listReviewActions'), 'Should keep listReviewActions')
+  assert.ok(!firstDefs.includes('ReviewActionChannel'), 'type ReviewActionChannel should be removed')
+  assert.ok(!firstDefs.includes('ReviewActionStatus'), 'type ReviewActionStatus should be removed')
+
+  const secondDefs = importsFound[1].definitions.destructuredParameters.map(p => p.name)
+  assert.equal(secondDefs.length, 1, 'Should only have 1 runtime import')
+  assert.ok(secondDefs.includes('normalizeWorkflowNodes'), 'Should keep normalizeWorkflowNodes')
+  assert.ok(!secondDefs.includes('WorkflowNode'), 'type WorkflowNode should be removed')
+
+  // Third: type Foo and type Baz removed, only bar remains
+  const thirdDefs = importsFound[2].definitions.destructuredParameters.map(p => p.name)
+  assert.equal(thirdDefs.length, 1, 'Should only have 1 runtime import')
+  assert.ok(thirdDefs.includes('bar'), 'Should keep bar')
+})
+
+test('should handle all-type destructured imports', () => {
+  const code = `import { type Foo, type Bar } from 'pkg'`
+
+  const importsFound = getImports(code)
+  assert.equal(importsFound.length, 1, 'Should still find the import statement')
+  // No runtime names to verify — definitions may be empty
+  const defs = importsFound[0].definitions?.destructuredParameters || []
+  const runtimeNames = defs.filter(p => !p.name.startsWith('type '))
+  assert.equal(runtimeNames.length, 0, 'Should have no runtime import names')
+})
+
+test('should skip TypeScript import type statements', () => {
+  const code = `
+import type { Context } from 'hono'
+import type { APIGatewayProxyEventV2 } from 'aws-lambda'
+import type { WsEventType } from './ws-events.js'
+import { realImport } from 'real-package'
+  `
+
+  const importsFound = getImports(code)
+
+  assert.equal(importsFound.length, 1, 'Should only find 1 real import')
+  assert.equal(importsFound[0].from, 'real-package', 'Should find real-package import')
+})
+
 test('should preserve URLs with :// in strings', () => {
   const code = `
 import foo from 'foo' // http://example.com
@@ -439,4 +536,143 @@ import foo from 'foo' // http://example.com
   assert.equal(importsFound[0].from, 'foo', 'Should find foo import')
 })
 
+test('side-effect imports strip surrounding quotes from `from`', () => {
+  // Regression: before the fix, the static-import regex captured the opening quote
+  // inside the path group for side-effect imports (no `from` keyword), producing
+  // values like `'./foo.js` which broke isRelative / isBuiltIn classification.
+  const code = `
+import './message/email/gmail/index.js'
+import "./message/in-app/re-notifications/index.js"
+import 'side-effect-package'
+import "node:fs"
+  `
+
+  const importsFound = normalizeTestResult(getStaticImports(code))
+
+  assert.equal(importsFound.length, 4, 'Should find 4 side-effect imports')
+
+  assert.equal(importsFound[0].from, './message/email/gmail/index.js')
+  assert.is(importsFound[0].isRelative, true, 'single-quoted relative path is relative')
+  assert.is(importsFound[0].isBuiltIn, false)
+
+  assert.equal(importsFound[1].from, './message/in-app/re-notifications/index.js')
+  assert.is(importsFound[1].isRelative, true, 'double-quoted relative path is relative')
+
+  assert.equal(importsFound[2].from, 'side-effect-package')
+  assert.is(importsFound[2].isRelative, false)
+  assert.is(importsFound[2].isBuiltIn, false)
+
+  assert.equal(importsFound[3].from, 'node:fs')
+  assert.is(importsFound[3].isBuiltIn, true, 'node: builtins detected after quote strip')
+})
+
+test('side-effect imports preserve definitions/varName semantics', () => {
+  const code = `import './foo.js'`
+  const [imp] = getStaticImports(code)
+
+  assert.equal(imp.from, './foo.js')
+  assert.is(imp.isRelative, true)
+  assert.is(imp.isImport, true)
+  assert.equal(imp.varName, '', 'side-effect imports have no bound names')
+  assert.is(imp.definitions, null, 'side-effect imports have null definitions')
+})
+
+test('multiple static imports on a single line', () => {
+  // Regression: the `(.*[@\w_-]+)["'\s]+;?$` pattern was greedy plus EOL-anchored,
+  // so a line like `import a from 'a'; import b from 'b';` matched as ONE import
+  // whose path was `a'; import b from 'b`. Tightening the path char-class and
+  // dropping the `$` anchor turns this into separate matches.
+  const code = `import a from 'a'; import b from 'b'; import c from 'c';`
+  const importsFound = normalizeTestResult(getStaticImports(code))
+
+  assert.equal(importsFound.length, 3, 'Should find 3 imports on one line')
+  assert.equal(importsFound[0].from, 'a')
+  assert.equal(importsFound[1].from, 'b')
+  assert.equal(importsFound[2].from, 'c')
+
+  // Verify names parsed independently too
+  assert.equal(importsFound[0].varName, 'a')
+  assert.equal(importsFound[1].varName, 'b')
+  assert.equal(importsFound[2].varName, 'c')
+})
+
+test('static + assertion imports on the same line do not double-count', () => {
+  // The static IMPORT_REGEX uses a negative lookahead for `assert {` / `with {`
+  // so assertion imports flow only through ASSERTION_IMPORT_REGEX instead of
+  // being matched by both.
+  const code = `
+import foo from 'fs'
+import data from './data.json' assert { type: 'json' }
+import styles from './styles.css' with { type: 'css' }
+  `
+
+  const all = normalizeTestResult(getImports(code, { includeAssertionImports: true }))
+  assert.equal(all.length, 3, 'Should not double-count assertion imports')
+
+  // Static-only call must also skip the assertion lines (no partial path matches)
+  const staticOnly = normalizeTestResult(getStaticImports(code))
+  assert.equal(staticOnly.length, 1, 'Static regex should skip assertion-import lines')
+  assert.equal(staticOnly[0].from, 'fs')
+})
+
+test('dynamic imports without await are detected', () => {
+  // Regression: DYNAMIC_IMPORT_REGEX required `await\s+import(`, missing
+  // every lazy-load pattern. `await` is now optional.
+  const code = `
+import('./then-chain.js').then(m => m)
+const eager = import('./eager.js')
+return import('./return.js')
+const Comp = lazy(() => import('./Component.js'))
+const [a, b] = await Promise.all([import('./a.js'), import('./b.js')])
+  `
+
+  const importsFound = normalizeTestResult(getDynamicImports(code))
+  const froms = importsFound.map(i => i.from).sort()
+
+  assert.equal(importsFound.length, 6, 'Should find 6 dynamic imports')
+  assert.equal(froms, [
+    './Component.js',
+    './a.js',
+    './b.js',
+    './eager.js',
+    './return.js',
+    './then-chain.js',
+  ].sort())
+
+  // All flagged as dynamic
+  assert.ok(importsFound.every(i => i.isDynamic), 'All should have isDynamic: true')
+})
+
+test('dynamic-import regex rejects member access and identifier prefixes', () => {
+  // `obj.import('x')` and `myimport('x')` are not dynamic imports — the
+  // `(?<!\.)\b` guard prevents these from matching now that `await` is optional.
+  const code = `
+obj.import('./not-an-import.js')
+myimport('./also-not.js')
+const u = import.meta.url
+const real = import('./real.js')
+  `
+
+  const importsFound = getDynamicImports(code)
+  assert.equal(importsFound.length, 1, 'Should only match the real dynamic import')
+  assert.equal(importsFound[0].from, './real.js')
+})
+
+test('assertion imports strip surrounding quotes from `from`', () => {
+  // Same class of bug as static imports — the assertion regex captured the
+  // opening quote into the path group when the assertion was wrapped tightly.
+  const code = `
+import data from './data.json' assert { type: 'json' }
+import sheet from "./sheet.css" with { type: 'css' }
+  `
+
+  const importsFound = normalizeTestResult(getAssertionImports(code))
+
+  assert.equal(importsFound.length, 2)
+  assert.equal(importsFound[0].from, './data.json')
+  assert.is(importsFound[0].isRelative, true)
+  assert.equal(importsFound[1].from, './sheet.css')
+  assert.is(importsFound[1].isRelative, true)
+})
+
 test.run()

package/tests/get-requires.test.js

@@ -208,4 +208,64 @@ test('getRequires with dynamic requires', async () => {
   ])
 })
 
+test('should not match non-require patterns with string literals', async () => {
+  const code = `
+  const { email: bdrEmail } = c.req.valid('param')
+  const activeBdrs = allActive.filter((u) => u.email !== 'CONFIG')
+  const connections = await Connection.getByMember(bdr.email, 'gmail')
+  const replied = timeline.some((e) => e.type === 'reply' || e.type === 'stop')
+  const lastSent = timeline.find((e) => e.type === 'email_sent')
+  const key = c.req.header('Idempotency-Key')
+  const { enabled, endDate, handoff } = c.req.valid('json')
+  const active = enrollmentItems.filter((e) => e.status === 'active')
+  const { limit } = c.req.valid('query')
+  const vacationPaused = enrollmentItems.filter((e) => e.status === 'paused' && e.pauseReason === 'vacation')
+  const activeEnrollments = enrollmentItems.filter((e) => e.status === 'active' || e.status === 'pending_review')
+  `
+
+  const requiresFound = getRequires(code)
+  assert.equal(requiresFound.length, 0, 'Should not match any non-require patterns')
+})
+
+test('should handle $ and _ in variable names', async () => {
+  const code = `
+  const { $add } = require('dynamodb-toolbox')
+  const $ref = require('reactive')
+  const _lodash = require('lodash')
+  const { _private, __double } = require('internal')
+  const { $$ref, _0x1234 } = require('edge-case')
+  `
+
+  const requiresFound = getRequires(code).filter(r => !r.isDynamic)
+  assert.equal(requiresFound.length, 5, 'Should find 5 requires with special chars')
+  assert.equal(requiresFound[0].from, 'dynamodb-toolbox')
+  assert.equal(requiresFound[0].varName, '{ $add }')
+  assert.equal(requiresFound[1].from, 'reactive')
+  assert.equal(requiresFound[1].varName, '$ref')
+  assert.equal(requiresFound[2].from, 'lodash')
+  assert.equal(requiresFound[2].varName, '_lodash')
+  assert.equal(requiresFound[3].from, 'internal')
+  assert.equal(requiresFound[3].varName, '{ _private, __double }')
+  assert.equal(requiresFound[4].from, 'edge-case')
+  assert.equal(requiresFound[4].varName, '{ $$ref, _0x1234 }')
+})
+
+test('should still match real requires mixed with non-require code', async () => {
+  const code = `
+  const path = require('path')
+  const active = items.filter((e) => e.status === 'active')
+  const { foo, bar } = require('some-pkg')
+  const key = c.req.header('Idempotency-Key')
+  require('side-effect-only')
+  `
+
+  const requiresFound = getRequires(code)
+  // Should only match the 3 real requires, not the filter or req.header
+  const staticRequires = requiresFound.filter(r => !r.isDynamic)
+  assert.equal(staticRequires.length, 3, 'Should find exactly 3 real requires')
+  assert.equal(staticRequires[0].from, 'path')
+  assert.equal(staticRequires[1].from, 'some-pkg')
+  assert.equal(staticRequires[2].from, 'side-effect-only')
+})
+
 test.run()