@davidwells/extract-deps 0.1.7 → 0.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidwells/extract-deps",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Get imports and requires from a codebase without AST",
   "main": "src/index.js",
   "exports": {

package/src/dep-graph.js

@@ -79,18 +79,22 @@ function verifyImportedValuesExist(dep, targetDeps, targetPath, sourcePath, erro
 
     // Check CommonJS exports
     const exportedNames = new Set()
+    let hasReExportAll = false
     if (targetDeps.moduleExports && targetDeps.moduleExports.length > 0) {
       for (const exp of targetDeps.moduleExports) {
         if (exp.exportType === 'named') {
           exportedNames.add(exp.exportName)
         } else if (exp.exportType === 'default' && exp.keys) {
           exp.keys.forEach(key => exportedNames.add(key))
+        } else if (exp.exportType === 'all') {
+          // Bundler-emitted dynamic re-export-all (Object.keys+forEach,
+          // __exportStar, __reExport). Same semantics as ESM `export * from`.
+          hasReExportAll = true
         }
       }
     }
 
     // Check ESM exports
-    let hasReExportAll = false
     if (targetDeps.exports && targetDeps.exports.length > 0) {
       for (const exp of targetDeps.exports) {
         if (exp.exportType === 'all') {

package/src/get-cjs-exports.js

@@ -41,22 +41,33 @@ function getCjsExports(code) {
   const assignmentExports = getModuleExportsAssignment(code, sanitizedCode)
   const modulePropertyExports = getModuleExportsProperty(code, sanitizedCode)
   const propertyExports = getExportsProperty(code, sanitizedCode)
-  
+
   // Quick pre-checks to avoid expensive regex operations when not needed
   const objectAssignExports = sanitizedCode.includes('Object.assign')
     ? getObjectAssignExports(code, sanitizedCode)
     : []
-  
+
   const definePropertyExports = sanitizedCode.includes('Object.defineProperty')
     ? getDefinePropertyExports(code, sanitizedCode)
     : []
 
+  // Detect dynamic CJS re-export-all patterns emitted by Rollup, tsc, esbuild,
+  // and friends. Cheap substring guard first to avoid the regex work on files
+  // that obviously can't contain these patterns.
+  const reExportAllExports =
+    sanitizedCode.includes('Object.keys(') ||
+    sanitizedCode.includes('__exportStar') ||
+    sanitizedCode.includes('__reExport')
+      ? getReExportAllPatterns(code, sanitizedCode)
+      : []
+
   /*
   console.log('assignmentExports', assignmentExports)
   console.log('modulePropertyExports', modulePropertyExports)
   console.log('propertyExports', propertyExports)
   console.log('objectAssignExports', objectAssignExports)
   console.log('definePropertyExports', definePropertyExports)
+  console.log('reExportAllExports', reExportAllExports)
   /** */
 
   const allExports = []
@@ -65,6 +76,7 @@ function getCjsExports(code) {
     .concat(propertyExports)
     .concat(objectAssignExports)
     .concat(definePropertyExports)
+    .concat(reExportAllExports)
 
   return allExports.sort((a, b) => a.index - b.index)
 }
@@ -372,6 +384,83 @@ function getDefinePropertyExports(originalText = '', sanitizedText = originalTex
   return exportStatements
 }
 
+/**
+ * Detect dynamic CJS re-export-all patterns where a module forwards every
+ * named export of another module at runtime. Bundlers emit these for ESM
+ * `export * from './x'` syntax when targeting CJS:
+ *
+ *   - Rollup:   `Object.keys(X).forEach(function(k){ if (k!=='default' && ...) exports[k]=X[k] })`
+ *   - tsc/tslib: `__exportStar(require('./x'), exports)` / `tslib.__exportStar(...)`
+ *   - esbuild:  `__reExport(stdin_exports, require('./x'))`
+ *
+ * We don't try to resolve the require and merge names — that's recursive and
+ * filesystem-dependent. Instead each match emits `exportType: 'all'`, the same
+ * marker `get-exports.js` uses for ESM `export * from`. Downstream validators
+ * already skip name-verification when they see this marker, so importing a
+ * name that's only available via dynamic re-export no longer false-positives.
+ *
+ * Captures the require path or source-variable name into `from` when visible,
+ * for debugging and future resolve-and-merge work.
+ */
+function getReExportAllPatterns(originalText = '', sanitizedText = originalText) {
+  const exportStatements = []
+
+  // Rollup `Object.keys(X).forEach(function(k){ ... exports[k] = X[k] ... })`.
+  // Allow either `function (k)` or `(k) =>` and any condition on `k` inside.
+  const rollupPattern = /Object\.keys\s*\(\s*(\w+)\s*\)\s*\.forEach\s*\(\s*(?:function\s*\(\s*\w+\s*\)|\(?\s*\w+\s*\)?\s*=>)\s*\{[^}]*exports\s*\[\s*\w+\s*\]\s*=\s*\1\s*\[/g
+  let result
+  while ((result = rollupPattern.exec(sanitizedText)) !== null) {
+    const sourceVar = result[1]
+    exportStatements.push({
+      line: result[0].split('\n')[0].trim(),
+      exportType: 'all',
+      exportName: '',
+      exportValue: result[0],
+      from: sourceVar,
+      index: result.index,
+      isExport: true,
+      isReExportAll: true
+    })
+  }
+
+  // tslib / tsc `__exportStar(<source>, exports)` where source is either
+  // a `require('./x')` call or a bare identifier holding a prior require.
+  const exportStarPattern = /(?:\w+\.)?__exportStar\s*\(\s*(?:require\s*\(\s*['"]([^'"]+)['"]\s*\)|(\w+))\s*,\s*(?:module\.)?exports\s*\)/g
+  while ((result = exportStarPattern.exec(sanitizedText)) !== null) {
+    const from = result[1] || result[2]
+    exportStatements.push({
+      line: result[0].trim(),
+      exportType: 'all',
+      exportName: '',
+      exportValue: result[0],
+      from,
+      index: result.index,
+      isExport: true,
+      isReExportAll: true
+    })
+  }
+
+  // esbuild `__reExport(<exports-target>, <source>)`. The exports-target is
+  // typically an identifier ending in `_exports` or `exports`, and the source
+  // is again a `require()` call or an identifier.
+  const reExportPattern = /__reExport\s*\(\s*\w+\s*,\s*(?:require\s*\(\s*['"]([^'"]+)['"]\s*\)|(\w+))\s*(?:,\s*[^)]*)?\)/g
+  while ((result = reExportPattern.exec(sanitizedText)) !== null) {
+    const from = result[1] || result[2]
+    exportStatements.push({
+      line: result[0].trim(),
+      exportType: 'all',
+      exportName: '',
+      exportValue: result[0],
+      from,
+      index: result.index,
+      isExport: true,
+      isReExportAll: true
+    })
+  }
+
+  return exportStatements
+}
+
 if (require.main === module) {
   const code = `
 // module.exports assignment

package/src/get-imports.js

@@ -1,13 +1,28 @@
 const { isBuiltIn, isRelativeImport, isRelativeImportWithQuotes, getNames, stripComments } = require('./utils')
 
 // https://regex101.com/r/cfEmlm/1
-const IMPORT_REGEX = /import(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+;?$/gm
+// Path excludes quotes, newlines, and `;` so multi-statement lines like
+// `import a from 'a'; import b from 'b'` parse as two distinct matches
+// instead of one match that spans the semicolon. The leading separator is
+// `["'\s]+` (not `["'\s]`) so it can consume both the gap whitespace and the
+// opening quote in one go — without that, the path group is left starting on
+// the quote and fails for side-effect imports like `import './foo.js'`.
+// Closing is `\s*["']` (not `["'\s]+;?`) so the captured `line` stops at the
+// closing quote instead of bleeding into the next line's whitespace.
+// Negative lookahead `(?!\s*(?:assert|with)\s*\{)` keeps this from matching
+// import-attributes/assertion imports — those go through ASSERTION_IMPORT_REGEX
+// and would otherwise be double-counted in `getImports`.
+const IMPORT_REGEX = /import(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s]+([^"'`\n;\s]+)\s*["'](?!\s*(?:assert|with)\s*\{)/gm
 // https://regex101.com/r/UDmXlb/1
 const IMPORT_TYPE_REGEX = /import\(['"](.*)['"]\)\.?([A-Za-z_0-9.]*)?/gm
 // https://regex101.com/r/UDjMoV/1
-const DYNAMIC_IMPORT_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= $]+)\s*=\s*)?await\s+import\(([^()]+(?:\([^()]*\)[^()]*)*)\)/gm
+// `await` is optional so `import('./foo').then(...)`, `const p = import('./foo')`,
+// `return import('./foo')`, and `lazy(() => import('./foo'))` all match.
+// `(?<!\.)\b` rejects member access (`obj.import(...)`) and identifiers like
+// `myimport(...)`.
+const DYNAMIC_IMPORT_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= $]+)\s*=\s*)?(?:await\s+)?(?<!\.)\bimport\(([^()]+(?:\([^()]*\)[^()]*)*)\)/gm
 // https://regex101.com/r/example/1
-const ASSERTION_IMPORT_REGEX = /(?:^|\n)\s*import\s+(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+(assert|with)\s*\{([^}]+)\};?$/gm
+const ASSERTION_IMPORT_REGEX = /(?:^|\n)\s*import\s+(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s]+([^"'`\n;\s]+)\s*["']\s+(assert|with)\s*\{([^}]+)\}/gm
 
 function getImports(code = '', options = {}) {
   // Strip comments to avoid false positives
@@ -26,7 +41,10 @@ function getStaticImports(targetText = '') {
   let importStatements = []
   var result;
   while((result = IMPORT_REGEX.exec(targetText)) !== null) {
-    const [ line, names, from ] = result
+    const [ line, names, rawFrom ] = result
+    // Side-effect imports (e.g. `import './foo.js'`) and unnamed-default imports skip the
+    // optional `from` capture, so the opening quote ends up inside the path group. Strip it.
+    const from = rawFrom.replace(/^["'`]|["'`]$/g, '')
     // Skip TypeScript type-only imports — erased at compile time, no runtime resolution needed
     if (/^\s*import\s+type\s/.test(line)) {
       continue
@@ -104,7 +122,8 @@ function getAssertionImports(targetText = '') {
   let importStatements = []
   var result;
   while((result = ASSERTION_IMPORT_REGEX.exec(targetText)) !== null) {
-    let [ line, names, from, keyword, assertion ] = result
+    let [ line, names, rawFrom, keyword, assertion ] = result
+    const from = rawFrom.replace(/^["'`]|["'`]$/g, '')
     const namesValues = (names || '').trim()
     // Remove leading newlines and whitespace from the line
     line = line.replace(/^\s+|\s+$/g, '')

package/tests/get-cjs-exports.test.js

@@ -759,4 +759,96 @@ Object.defineProperty(exports, 'version', {
   }
 })
 
+test('detects Rollup-style Object.keys(X).forEach re-export-all', () => {
+  // Matches the pattern emitted by Rollup (and used in AWS SDK v3 dist-cjs)
+  // for ESM `export * from './x'` when targeting CJS.
+  const code = `
+var errors = require('./models/errors');
+Object.keys(errors).forEach(function (k) {
+  if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) exports[k] = errors[k];
+});
+exports.realNamed = realNamed;
+  `
+
+  const found = getCjsExports(code)
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 1, 'Should detect 1 dynamic re-export-all')
+  assert.equal(reExports[0].from, 'errors', 'Should capture the source variable name')
+  assert.is(reExports[0].isReExportAll, true, 'Should set isReExportAll flag')
+
+  // The explicit named export must still be picked up alongside
+  assert.ok(found.some(e => e.exportType === 'named' && e.exportName === 'realNamed'))
+})
+
+test('detects tsc/tslib __exportStar re-export-all', () => {
+  const code = `
+var tslib_1 = require("tslib");
+__exportStar(require("./module-a"), exports);
+tslib_1.__exportStar(require("./module-b"), exports);
+var moduleC = require("./module-c");
+__exportStar(moduleC, exports);
+  `
+
+  const found = getCjsExports(code)
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 3, 'Should detect 3 __exportStar calls')
+
+  const fromValues = reExports.map(e => e.from).sort()
+  assert.equal(fromValues, ['./module-a', './module-b', 'moduleC'].sort())
+})
+
+test('detects esbuild __reExport re-export-all', () => {
+  const code = `
+var stdin_exports = {};
+__export(stdin_exports, { foo: () => foo });
+__reExport(stdin_exports, require("./module-a"));
+var moduleB = require("./module-b");
+__reExport(stdin_exports, moduleB);
+  `
+
+  const found = getCjsExports(code)
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 2, 'Should detect 2 __reExport calls')
+
+  const fromValues = reExports.map(e => e.from).sort()
+  assert.equal(fromValues, ['./module-a', 'moduleB'].sort())
+})
+
+test('re-export-all patterns coexist with explicit named exports', () => {
+  // A real-world file mixes both — make sure both end up in moduleExports.
+  const code = `
+var errors = require('./errors');
+exports.Foo = Foo;
+exports.Bar = Bar;
+Object.keys(errors).forEach(function (k) {
+  if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) exports[k] = errors[k];
+});
+exports.Baz = Baz;
+  `
+
+  const found = getCjsExports(code)
+  const named = found.filter(e => e.exportType === 'named').map(e => e.exportName).sort()
+  assert.equal(named, ['Bar', 'Baz', 'Foo'])
+
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 1)
+  assert.equal(reExports[0].from, 'errors')
+})
+
+test('does NOT flag unrelated Object.keys / forEach calls as re-export-all', () => {
+  // Only the specific `exports[k] = X[k]` shape should trigger detection.
+  const code = `
+Object.keys(someObj).forEach(function (k) {
+  console.log(k, someObj[k]);
+});
+Object.keys(config).forEach((k) => {
+  process.env[k] = config[k];
+});
+  `
+
+  const found = getCjsExports(code)
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 0, 'Should not match Object.keys patterns that do not assign to exports')
+})
+
 test.run()

package/tests/get-imports.test.js

@@ -536,4 +536,143 @@ import foo from 'foo' // http://example.com
   assert.equal(importsFound[0].from, 'foo', 'Should find foo import')
 })
 
+test('side-effect imports strip surrounding quotes from `from`', () => {
+  // Regression: before the fix, the static-import regex captured the opening quote
+  // inside the path group for side-effect imports (no `from` keyword), producing
+  // values like `'./foo.js` which broke isRelative / isBuiltIn classification.
+  const code = `
+import './message/email/gmail/index.js'
+import "./message/in-app/re-notifications/index.js"
+import 'side-effect-package'
+import "node:fs"
+  `
+
+  const importsFound = normalizeTestResult(getStaticImports(code))
+
+  assert.equal(importsFound.length, 4, 'Should find 4 side-effect imports')
+
+  assert.equal(importsFound[0].from, './message/email/gmail/index.js')
+  assert.is(importsFound[0].isRelative, true, 'single-quoted relative path is relative')
+  assert.is(importsFound[0].isBuiltIn, false)
+
+  assert.equal(importsFound[1].from, './message/in-app/re-notifications/index.js')
+  assert.is(importsFound[1].isRelative, true, 'double-quoted relative path is relative')
+
+  assert.equal(importsFound[2].from, 'side-effect-package')
+  assert.is(importsFound[2].isRelative, false)
+  assert.is(importsFound[2].isBuiltIn, false)
+
+  assert.equal(importsFound[3].from, 'node:fs')
+  assert.is(importsFound[3].isBuiltIn, true, 'node: builtins detected after quote strip')
+})
+
+test('side-effect imports preserve definitions/varName semantics', () => {
+  const code = `import './foo.js'`
+  const [imp] = getStaticImports(code)
+
+  assert.equal(imp.from, './foo.js')
+  assert.is(imp.isRelative, true)
+  assert.is(imp.isImport, true)
+  assert.equal(imp.varName, '', 'side-effect imports have no bound names')
+  assert.is(imp.definitions, null, 'side-effect imports have null definitions')
+})
+
+test('multiple static imports on a single line', () => {
+  // Regression: the `(.*[@\w_-]+)["'\s]+;?$` pattern was greedy plus EOL-anchored,
+  // so a line like `import a from 'a'; import b from 'b';` matched as ONE import
+  // whose path was `a'; import b from 'b`. Tightening the path char-class and
+  // dropping the `$` anchor turns this into separate matches.
+  const code = `import a from 'a'; import b from 'b'; import c from 'c';`
+  const importsFound = normalizeTestResult(getStaticImports(code))
+
+  assert.equal(importsFound.length, 3, 'Should find 3 imports on one line')
+  assert.equal(importsFound[0].from, 'a')
+  assert.equal(importsFound[1].from, 'b')
+  assert.equal(importsFound[2].from, 'c')
+
+  // Verify names parsed independently too
+  assert.equal(importsFound[0].varName, 'a')
+  assert.equal(importsFound[1].varName, 'b')
+  assert.equal(importsFound[2].varName, 'c')
+})
+
+test('static + assertion imports on the same line do not double-count', () => {
+  // The static IMPORT_REGEX uses a negative lookahead for `assert {` / `with {`
+  // so assertion imports flow only through ASSERTION_IMPORT_REGEX instead of
+  // being matched by both.
+  const code = `
+import foo from 'fs'
+import data from './data.json' assert { type: 'json' }
+import styles from './styles.css' with { type: 'css' }
+  `
+
+  const all = normalizeTestResult(getImports(code, { includeAssertionImports: true }))
+  assert.equal(all.length, 3, 'Should not double-count assertion imports')
+
+  // Static-only call must also skip the assertion lines (no partial path matches)
+  const staticOnly = normalizeTestResult(getStaticImports(code))
+  assert.equal(staticOnly.length, 1, 'Static regex should skip assertion-import lines')
+  assert.equal(staticOnly[0].from, 'fs')
+})
+
+test('dynamic imports without await are detected', () => {
+  // Regression: DYNAMIC_IMPORT_REGEX required `await\s+import(`, missing
+  // every lazy-load pattern. `await` is now optional.
+  const code = `
+import('./then-chain.js').then(m => m)
+const eager = import('./eager.js')
+return import('./return.js')
+const Comp = lazy(() => import('./Component.js'))
+const [a, b] = await Promise.all([import('./a.js'), import('./b.js')])
+  `
+
+  const importsFound = normalizeTestResult(getDynamicImports(code))
+  const froms = importsFound.map(i => i.from).sort()
+
+  assert.equal(importsFound.length, 6, 'Should find 6 dynamic imports')
+  assert.equal(froms, [
+    './Component.js',
+    './a.js',
+    './b.js',
+    './eager.js',
+    './return.js',
+    './then-chain.js',
+  ].sort())
+
+  // All flagged as dynamic
+  assert.ok(importsFound.every(i => i.isDynamic), 'All should have isDynamic: true')
+})
+
+test('dynamic-import regex rejects member access and identifier prefixes', () => {
+  // `obj.import('x')` and `myimport('x')` are not dynamic imports — the
+  // `(?<!\.)\b` guard prevents these from matching now that `await` is optional.
+  const code = `
+obj.import('./not-an-import.js')
+myimport('./also-not.js')
+const u = import.meta.url
+const real = import('./real.js')
+  `
+
+  const importsFound = getDynamicImports(code)
+  assert.equal(importsFound.length, 1, 'Should only match the real dynamic import')
+  assert.equal(importsFound[0].from, './real.js')
+})
+
+test('assertion imports strip surrounding quotes from `from`', () => {
+  // Same class of bug as static imports — the assertion regex captured the
+  // opening quote into the path group when the assertion was wrapped tightly.
+  const code = `
+import data from './data.json' assert { type: 'json' }
+import sheet from "./sheet.css" with { type: 'css' }
+  `
+
+  const importsFound = normalizeTestResult(getAssertionImports(code))
+
+  assert.equal(importsFound.length, 2)
+  assert.equal(importsFound[0].from, './data.json')
+  assert.is(importsFound[0].isRelative, true)
+  assert.equal(importsFound[1].from, './sheet.css')
+  assert.is(importsFound[1].isRelative, true)
+})
+
 test.run()