@davidwells/extract-deps 0.1.7 → 0.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidwells/extract-deps",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Get imports and requires from a codebase without AST",
   "main": "src/index.js",
   "exports": {

package/src/dep-graph.js

@@ -79,18 +79,22 @@ function verifyImportedValuesExist(dep, targetDeps, targetPath, sourcePath, erro
 
     // Check CommonJS exports
     const exportedNames = new Set()
+    let hasReExportAll = false
     if (targetDeps.moduleExports && targetDeps.moduleExports.length > 0) {
       for (const exp of targetDeps.moduleExports) {
         if (exp.exportType === 'named') {
           exportedNames.add(exp.exportName)
         } else if (exp.exportType === 'default' && exp.keys) {
           exp.keys.forEach(key => exportedNames.add(key))
+        } else if (exp.exportType === 'all') {
+          // Bundler-emitted dynamic re-export-all (Object.keys+forEach,
+          // __exportStar, __reExport). Same semantics as ESM `export * from`.
+          hasReExportAll = true
         }
       }
     }
 
     // Check ESM exports
-    let hasReExportAll = false
     if (targetDeps.exports && targetDeps.exports.length > 0) {
       for (const exp of targetDeps.exports) {
         if (exp.exportType === 'all') {
@@ -136,6 +140,15 @@ function verifyImportedValuesExist(dep, targetDeps, targetPath, sourcePath, erro
       if (dep.varName && dep.varName.startsWith('*')) {
         return
       }
+      // Side-effect imports (`import './foo.js'`) bind no values — no export required.
+      if (!dep.varName && !dep.definitions) {
+        return
+      }
+      // Dynamic imports (`import('./foo.js')`) resolve to the module's
+      // namespace object, not the default export.
+      if (dep.isDynamic) {
+        return
+      }
       // ESM import X from 'pkg' requires a default export
       const hasModuleExports = targetDeps.moduleExports && targetDeps.moduleExports.length > 0
       const hasESMExports = targetDeps.exports && targetDeps.exports.length > 0

package/src/get-cjs-exports.js

@@ -1,6 +1,6 @@
 // Extracts CommonJS module.exports and exports patterns from JavaScript code
 
-const { getNames, extractExportName } = require('./utils')
+const { getNames, extractExportName, stripStringContents } = require('./utils')
 
 // Matches: module.exports = ... or exports = module.exports = ...
 // https://regex101.com/r/example/cjs-1
@@ -35,28 +35,44 @@ function stripComments(code) {
 }
 
 function getCjsExports(code) {
+  // Blank string/template literal contents before stripping comments so
+  // `exports.X = ...` lines embedded inside template literals aren't matched
+  // as real exports, and so the comment regex doesn't mis-strip `//` inside
+  // string bodies.
+  code = stripStringContents(code)
   // Strip comments to prevent false positives from commented code
   const sanitizedCode = stripComments(code)
 
   const assignmentExports = getModuleExportsAssignment(code, sanitizedCode)
   const modulePropertyExports = getModuleExportsProperty(code, sanitizedCode)
   const propertyExports = getExportsProperty(code, sanitizedCode)
-  
+
   // Quick pre-checks to avoid expensive regex operations when not needed
   const objectAssignExports = sanitizedCode.includes('Object.assign')
     ? getObjectAssignExports(code, sanitizedCode)
     : []
-  
+
   const definePropertyExports = sanitizedCode.includes('Object.defineProperty')
     ? getDefinePropertyExports(code, sanitizedCode)
     : []
 
+  // Detect dynamic CJS re-export-all patterns emitted by Rollup, tsc, esbuild,
+  // and friends. Cheap substring guard first to avoid the regex work on files
+  // that obviously can't contain these patterns.
+  const reExportAllExports =
+    sanitizedCode.includes('Object.keys(') ||
+    sanitizedCode.includes('__exportStar') ||
+    sanitizedCode.includes('__reExport')
+      ? getReExportAllPatterns(code, sanitizedCode)
+      : []
+
   /*
   console.log('assignmentExports', assignmentExports)
   console.log('modulePropertyExports', modulePropertyExports)
   console.log('propertyExports', propertyExports)
   console.log('objectAssignExports', objectAssignExports)
   console.log('definePropertyExports', definePropertyExports)
+  console.log('reExportAllExports', reExportAllExports)
   /** */
 
   const allExports = []
@@ -65,6 +81,7 @@ function getCjsExports(code) {
     .concat(propertyExports)
     .concat(objectAssignExports)
     .concat(definePropertyExports)
+    .concat(reExportAllExports)
 
   return allExports.sort((a, b) => a.index - b.index)
 }
@@ -372,6 +389,83 @@ function getDefinePropertyExports(originalText = '', sanitizedText = originalTex
   return exportStatements
 }
 
+/**
+ * Detect dynamic CJS re-export-all patterns where a module forwards every
+ * named export of another module at runtime. Bundlers emit these for ESM
+ * `export * from './x'` syntax when targeting CJS:
+ *
+ *   - Rollup:   `Object.keys(X).forEach(function(k){ if (k!=='default' && ...) exports[k]=X[k] })`
+ *   - tsc/tslib: `__exportStar(require('./x'), exports)` / `tslib.__exportStar(...)`
+ *   - esbuild:  `__reExport(stdin_exports, require('./x'))`
+ *
+ * We don't try to resolve the require and merge names — that's recursive and
+ * filesystem-dependent. Instead each match emits `exportType: 'all'`, the same
+ * marker `get-exports.js` uses for ESM `export * from`. Downstream validators
+ * already skip name-verification when they see this marker, so importing a
+ * name that's only available via dynamic re-export no longer false-positives.
+ *
+ * Captures the require path or source-variable name into `from` when visible,
+ * for debugging and future resolve-and-merge work.
+ */
+function getReExportAllPatterns(originalText = '', sanitizedText = originalText) {
+  const exportStatements = []
+
+  // Rollup `Object.keys(X).forEach(function(k){ ... exports[k] = X[k] ... })`.
+  // Allow either `function (k)` or `(k) =>` and any condition on `k` inside.
+  const rollupPattern = /Object\.keys\s*\(\s*(\w+)\s*\)\s*\.forEach\s*\(\s*(?:function\s*\(\s*\w+\s*\)|\(?\s*\w+\s*\)?\s*=>)\s*\{[^}]*exports\s*\[\s*\w+\s*\]\s*=\s*\1\s*\[/g
+  let result
+  while ((result = rollupPattern.exec(sanitizedText)) !== null) {
+    const sourceVar = result[1]
+    exportStatements.push({
+      line: result[0].split('\n')[0].trim(),
+      exportType: 'all',
+      exportName: '',
+      exportValue: result[0],
+      from: sourceVar,
+      index: result.index,
+      isExport: true,
+      isReExportAll: true
+    })
+  }
+
+  // tslib / tsc `__exportStar(<source>, exports)` where source is either
+  // a `require('./x')` call or a bare identifier holding a prior require.
+  const exportStarPattern = /(?:\w+\.)?__exportStar\s*\(\s*(?:require\s*\(\s*['"]([^'"]+)['"]\s*\)|(\w+))\s*,\s*(?:module\.)?exports\s*\)/g
+  while ((result = exportStarPattern.exec(sanitizedText)) !== null) {
+    const from = result[1] || result[2]
+    exportStatements.push({
+      line: result[0].trim(),
+      exportType: 'all',
+      exportName: '',
+      exportValue: result[0],
+      from,
+      index: result.index,
+      isExport: true,
+      isReExportAll: true
+    })
+  }
+
+  // esbuild `__reExport(<exports-target>, <source>)`. The exports-target is
+  // typically an identifier ending in `_exports` or `exports`, and the source
+  // is again a `require()` call or an identifier.
+  const reExportPattern = /__reExport\s*\(\s*\w+\s*,\s*(?:require\s*\(\s*['"]([^'"]+)['"]\s*\)|(\w+))\s*(?:,\s*[^)]*)?\)/g
+  while ((result = reExportPattern.exec(sanitizedText)) !== null) {
+    const from = result[1] || result[2]
+    exportStatements.push({
+      line: result[0].trim(),
+      exportType: 'all',
+      exportName: '',
+      exportValue: result[0],
+      from,
+      index: result.index,
+      isExport: true,
+      isReExportAll: true
+    })
+  }
+
+  return exportStatements
+}
+
 if (require.main === module) {
   const code = `
 // module.exports assignment

package/src/get-exports.js

@@ -1,4 +1,4 @@
-const { getNames, extractExportName, stripComments } = require('./utils')
+const { getNames, extractExportName, stripComments, stripStringContents } = require('./utils')
 
 // https://regex101.com/r/example/1
 const EXPORT_DEFAULT_REGEX = /export\s+default\s+(?:(?:async\s+)?function\s+([\w$]+)|class\s+([\w$]+)|([\w$]+|\([^)]*\)\s*=>|{[\s\S]*?}|\[[\s\S]*?\]|'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`|[\w$]+(?:\s*[+\-*/%]\s*[\w$]+)*))/gm
@@ -16,6 +16,10 @@ const EXPORT_TYPE_REGEX = /export\s+(?:type|interface)\s+([\w$]+)/gm
 const EXPORT_ASSERTION_REGEX = /export\s+(?:["'\s]*([\w*{}\n\r\t, ]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+(assert|with)\s*\{([^}]+)\};?$/gm
 
 function getExports(code = '', options = {}) {
+  // Blank string/template contents first so embedded `export` keywords inside
+  // string literals don't get parsed as real exports, and so `stripComments`
+  // doesn't mis-strip `//` or `/* */` that appear inside strings.
+  code = stripStringContents(code)
   // Strip comments to avoid false positives
   code = stripComments(code)
   const defaultExports = getDefaultExports(code)

package/src/get-imports.js

@@ -1,15 +1,47 @@
-const { isBuiltIn, isRelativeImport, isRelativeImportWithQuotes, getNames, stripComments } = require('./utils')
+const { isBuiltIn, isRelativeImport, isRelativeImportWithQuotes, getNames, stripComments, stripStringContents } = require('./utils')
 
 // https://regex101.com/r/cfEmlm/1
-const IMPORT_REGEX = /import(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+;?$/gm
+// Path excludes quotes, newlines, and `;` so multi-statement lines like
+// `import a from 'a'; import b from 'b'` parse as two distinct matches
+// instead of one match that spans the semicolon. The leading separator is
+// `["'\s]+` (not `["'\s]`) so it can consume both the gap whitespace and the
+// opening quote in one go — without that, the path group is left starting on
+// the quote and fails for side-effect imports like `import './foo.js'`.
+// Closing is `\s*["']` (not `["'\s]+;?`) so the captured `line` stops at the
+// closing quote instead of bleeding into the next line's whitespace.
+// Negative lookahead `(?!\s*(?:assert|with)\s*\{)` keeps this from matching
+// import-attributes/assertion imports — those go through ASSERTION_IMPORT_REGEX
+// and would otherwise be double-counted in `getImports`.
+// Leading anchor `(?:^|(?<=[;\n]))` requires `import` to start a line (the `^`
+// matches at every line start under the `m` flag) or follow a `;` on the same
+// line. Without this, string literals like `'note: import preview'` get parsed
+// as `import preview` — the old regex was safe from this only because of its
+// `$` anchor, which we removed to support multi-statement lines.
+const IMPORT_REGEX = /(?:^|(?<=[;\n]))\s*import(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s]+([^"'`\n;\s]+)\s*["'](?!\s*(?:assert|with)\s*\{)/gm
 // https://regex101.com/r/UDmXlb/1
 const IMPORT_TYPE_REGEX = /import\(['"](.*)['"]\)\.?([A-Za-z_0-9.]*)?/gm
 // https://regex101.com/r/UDjMoV/1
-const DYNAMIC_IMPORT_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= $]+)\s*=\s*)?await\s+import\(([^()]+(?:\([^()]*\)[^()]*)*)\)/gm
+// `await` is optional so `import('./foo').then(...)`, `const p = import('./foo')`,
+// `return import('./foo')`, and `lazy(() => import('./foo'))` all match.
+// `(?<!\.)\b` rejects member access (`obj.import(...)`) and identifiers like
+// `myimport(...)`.
+//
+// TypeScript inline-import-type forms (`: import('./x').Foo`, `typeof
+// import('./x')`) are matched here too. They get `isDynamic: true` and the
+// validators already skip default-export checks for dynamic imports, so they
+// produce no false positives. The relationship is real for compilation
+// (renaming/deleting the target breaks `tsc`), so keeping the dep-graph edge
+// is the more conservative choice for smart-ci's change detection.
+const DYNAMIC_IMPORT_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= $]+)\s*=\s*)?(?:await\s+)?(?<!\.)\bimport\(([^()]+(?:\([^()]*\)[^()]*)*)\)/gm
 // https://regex101.com/r/example/1
-const ASSERTION_IMPORT_REGEX = /(?:^|\n)\s*import\s+(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+(assert|with)\s*\{([^}]+)\};?$/gm
+const ASSERTION_IMPORT_REGEX = /(?:^|\n)\s*import\s+(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s]+([^"'`\n;\s]+)\s*["']\s+(assert|with)\s*\{([^}]+)\}/gm
 
 function getImports(code = '', options = {}) {
+  // Blank string/template contents first so the comment stripper doesn't
+  // mis-strip `//` or `/* */` sequences inside literals, and so the regex
+  // doesn't pick up `import`/`export` keywords that appear inside strings
+  // (e.g. fenced code in JSDoc-style template literals).
+  code = stripStringContents(code)
   // Strip comments to avoid false positives
   code = stripComments(code)
   const staticImports = getStaticImports(code)
@@ -26,7 +58,14 @@ function getStaticImports(targetText = '') {
   let importStatements = []
   var result;
   while((result = IMPORT_REGEX.exec(targetText)) !== null) {
-    const [ line, names, from ] = result
+    let [ line, names, rawFrom ] = result
+    // The leading `(?:^|(?<=[;\n]))\s*` anchor pulls in any whitespace/newline
+    // separator that precedes the `import` keyword; trim it back off so `line`
+    // reads as the source author wrote it.
+    line = line.replace(/^\s+/, '')
+    // Side-effect imports (e.g. `import './foo.js'`) and unnamed-default imports skip the
+    // optional `from` capture, so the opening quote ends up inside the path group. Strip it.
+    const from = rawFrom.replace(/^["'`]|["'`]$/g, '')
     // Skip TypeScript type-only imports — erased at compile time, no runtime resolution needed
     if (/^\s*import\s+type\s/.test(line)) {
       continue
@@ -104,7 +143,8 @@ function getAssertionImports(targetText = '') {
   let importStatements = []
   var result;
   while((result = ASSERTION_IMPORT_REGEX.exec(targetText)) !== null) {
-    let [ line, names, from, keyword, assertion ] = result
+    let [ line, names, rawFrom, keyword, assertion ] = result
+    const from = rawFrom.replace(/^["'`]|["'`]$/g, '')
     const namesValues = (names || '').trim()
     // Remove leading newlines and whitespace from the line
     line = line.replace(/^\s+|\s+$/g, '')

package/src/get-requires.js

@@ -1,4 +1,4 @@
-const { isBuiltIn, isRelativeImport, getNames } = require('./utils')
+const { isBuiltIn, isRelativeImport, getNames, stripComments, stripStringContents } = require('./utils')
 
 // Updated regex to exclude ES6 dynamic imports
 // require() must always be present — previous version made it optional, causing false matches
@@ -65,6 +65,11 @@ function getStaticRequires(targetText = '') {
 }
 
 function getRequires(code) {
+  // Blank string/template contents first so `require()` calls embedded in
+  // string literals (e.g. fenced code in template strings) aren't matched as
+  // real requires. Then strip comments so `// require('./fake')` is ignored.
+  code = stripStringContents(code)
+  code = stripComments(code)
   const staticRequires = getStaticRequires(code)
   const dynamicRequires = getDynamicRequires(code)
   return staticRequires.concat(dynamicRequires).sort((a, b) => a.index - b.index)

package/src/utils.js

@@ -4,6 +4,65 @@ const builtinModules = require('module').builtinModules
 const COMMENT_RE = /\/\*[\s\S]*?\*\/|\/\/.*(?:\r?\n|$)/g
 const PROTOCOL_PLACEHOLDER = '__PROTO_SLASH__'
 
+// Single-quoted and double-quoted strings can't contain unescaped newlines
+// (per JS spec — they'd need `\n` escapes or `\<NL>` line continuations). The
+// `[^"\\\n]` / `[^'\\\n]` char classes enforce that, so an unbalanced quote
+// followed by a newline doesn't sweep up the next several lines as "string".
+// Template literals (`` `...` ``) DO span newlines, so their inner class only
+// excludes backtick and backslash. Escape sequences (`\.`) are allowed in all
+// three so escaped quotes don't prematurely end the match.
+// Note: this treats `${...}` interpolations as part of the string body — code
+// inside `${...}` (rare, but possible: `${import('./x.js')}`) gets blanked too.
+// Acceptable for the change-detection use case; a full tokenizer would be
+// needed to preserve interpolations.
+const STRING_LITERAL_RE = /"(?:[^"\\\n]|\\[\s\S])*"|'(?:[^'\\\n]|\\[\s\S])*'|`(?:[^`\\]|\\[\s\S])*`/g
+
+// Strings whose bodies contain these tokens are treated as embedded code
+// samples (template strings, generator helpers, fenced docs) and get blanked.
+// Plain module specifiers like `'lodash'` or `'./foo.js'` don't contain any
+// of these as words, so they pass through untouched and remain extractable.
+const EMBEDDED_CODE_RE = /\b(?:import|export|require|module\.exports)\b/
+
+/**
+ * Blank the contents of every string/template literal in `code` that looks
+ * like it contains embedded code (its body mentions `import`, `export`,
+ * `require`, or `module.exports`). The opening and closing quote chars are
+ * preserved, as are newlines. Total length is preserved so character indices
+ * remain stable.
+ *
+ * Strings whose bodies don't reference those keywords — including ordinary
+ * module specifiers like `'lodash'`, paths like `'./foo.js'`, URLs, and
+ * arbitrary user text — pass through untouched, so the static-import/require
+ * regexes can still read their content.
+ *
+ * Without this pass, regex-based extractors falsely match `import`, `export`,
+ * and `require` keywords that appear inside code samples embedded in strings.
+ *
+ * Run this BEFORE `stripComments` — the existing comment regex would otherwise
+ * mis-strip `//` and `/* *\/` sequences that occur inside strings.
+ *
+ * Caveat: `${...}` interpolations inside template literals are treated as
+ * part of the body, so a runtime `${import('./x.js')}` inside a template
+ * would be blanked. Very rare in practice; a proper tokenizer would be
+ * needed to do better.
+ *
+ * @param {string} code
+ * @returns {string}
+ */
+function stripStringContents(code) {
+  return code.replace(STRING_LITERAL_RE, (match) => {
+    const body = match.slice(1, -1)
+    if (!EMBEDDED_CODE_RE.test(body)) {
+      // Plain string — leave it alone so module specifiers stay extractable.
+      return match
+    }
+    const opener = match[0]
+    const closer = match[match.length - 1]
+    const middle = body.replace(/[^\n]/g, ' ')
+    return opener + middle + closer
+  })
+}
+
 /**
  * Strip comments from code, preserving :// in URLs
  * @param {string} code
@@ -232,6 +291,7 @@ function extractExportName(exportValue) {
 
 module.exports = {
   stripComments,
+  stripStringContents,
   isBuiltIn,
   isRelativeImport,
   isRelativeImportWithQuotes,

package/tests/dep-graph.test.js

@@ -592,6 +592,66 @@ test('namespace import should build valid graph', () => {
   assert.ok(deps.some(d => d.includes('utils.js')), 'Should have utils.js as dependency')
 })
 
+// Side-effect imports — `import './register.js'` runs the module for its
+// effects and binds no values. The validator must not require a default export.
+const ESM_SIDE_EFFECT_FIXTURE = path.resolve(__dirname, './fixtures/esm-side-effect-fixture/index.js')
+
+test('side-effect import should not require default export', () => {
+  assert.not.throws(() => {
+    depGraph(ESM_SIDE_EFFECT_FIXTURE, { verifyGraph: true })
+  }, "import './x' should not fail when target has only named exports")
+})
+
+test('side-effect import should still build the dep edge', () => {
+  const graph = depGraph(ESM_SIDE_EFFECT_FIXTURE, { verifyGraph: true })
+  const indexPath = Array.from(graph.keys()).find(key => key.includes('esm-side-effect-fixture/index.js'))
+  assert.ok(indexPath, 'Should have index.js in graph')
+
+  const deps = graph.get(indexPath)
+  assert.ok(deps.some(d => d.includes('register.js')), 'Should have register.js as dependency')
+})
+
+// Dynamic imports — `await import('./x.js')` resolves to the namespace
+// object, not the default export. Same skip semantics.
+const ESM_DYNAMIC_FIXTURE = path.resolve(__dirname, './fixtures/esm-dynamic-import-fixture/index.js')
+
+test('dynamic import should not require default export', () => {
+  assert.not.throws(() => {
+    depGraph(ESM_DYNAMIC_FIXTURE, { verifyGraph: true })
+  }, "import('./x') should not fail when target has only named exports")
+})
+
+// End-to-end coverage of the string/template/comment noise that historically
+// produced false-positive dep edges. The fixture contains real + fake
+// imports, requires, and exports embedded in template literals, double-
+// quoted strings, single-quoted strings, escaped-quote strings, tagged
+// templates, JSON-shaped strings, and comments. Only ONE real edge should
+// be produced (→ real.js), and no errors should fire.
+const STRING_NOISE_FIXTURE = path.resolve(__dirname, './fixtures/string-noise-fixture/index.js')
+
+test('string/template/comment noise produces no false-positive edges', () => {
+  let graph
+  assert.not.throws(() => {
+    graph = depGraph(STRING_NOISE_FIXTURE, { verifyGraph: true })
+  }, 'should not throw on the noise fixture')
+
+  const indexPath = Array.from(graph.keys()).find(k => k.includes('string-noise-fixture/index.js'))
+  assert.ok(indexPath, 'index.js should be in the graph')
+
+  const deps = graph.get(indexPath)
+  assert.equal(deps.length, 1, 'should produce exactly one edge — the real import')
+  assert.ok(deps[0].includes('real.js'), 'the one edge should be to real.js')
+})
+
+test('dynamic import should still build the dep edge', () => {
+  const graph = depGraph(ESM_DYNAMIC_FIXTURE, { verifyGraph: true })
+  const indexPath = Array.from(graph.keys()).find(key => key.includes('esm-dynamic-import-fixture/index.js'))
+  assert.ok(indexPath, 'Should have index.js in graph')
+
+  const deps = graph.get(indexPath)
+  assert.ok(deps.some(d => d.includes('pipeline.js')), 'Should have pipeline.js as dependency')
+})
+
 // TypeScript patterns fixture — exercises all fixed false positive patterns
 const TS_PATTERNS_FIXTURE = path.resolve(__dirname, './fixtures/ts-patterns-fixture/index.ts')
 

package/tests/fixtures/esm-dynamic-import-fixture/index.js

@@ -0,0 +1,11 @@
+// Dynamic import resolves to the module's namespace object, not the
+// default export. The target has only named exports and no default;
+// validation must not flag this as "missing default export".
+export async function load() {
+  const pipeline = await import('./pipeline.js')
+  return pipeline.run()
+}
+
+export function eager() {
+  return import('./pipeline.js').then((m) => m.run())
+}

package/tests/fixtures/esm-dynamic-import-fixture/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "esm-dynamic-import-fixture",
+  "type": "module"
+}

package/tests/fixtures/esm-dynamic-import-fixture/pipeline.js

@@ -0,0 +1,6 @@
+// Named exports only — no default. Dynamic importers should still validate.
+export function run() {
+  return 'pipeline result'
+}
+
+export const VERSION = 1

package/tests/fixtures/esm-side-effect-fixture/index.js

@@ -0,0 +1,7 @@
+// Importing './register.js' for its side effects only — no values are bound.
+// The target file has no default export; that must be fine.
+import './register.js'
+
+export function main() {
+  return 'hello'
+}

package/tests/fixtures/esm-side-effect-fixture/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "esm-side-effect-fixture",
+  "type": "module"
+}

package/tests/fixtures/esm-side-effect-fixture/register.js

@@ -0,0 +1,6 @@
+// Pure side-effect module — registers something on a shared registry and
+// exports a single named binding. Critically, no default export.
+const registry = (globalThis.__test_registry = globalThis.__test_registry || [])
+registry.push('side-effect-fixture')
+
+export const REGISTERED = true

package/tests/fixtures/string-noise-fixture/index.js

@@ -0,0 +1,50 @@
+// Regression fixture: every kind of string/template/comment noise that
+// previously fooled the extractors, alongside one real import edge that
+// MUST still be detected. The dep-graph test for this fixture asserts that
+// exactly one edge (→ real.js) is produced.
+
+import { realThing } from './real.js'
+
+// --- Single-line comment with a fake import that must be ignored ---
+// import fakeCommented from './fake-commented.js'
+
+/*
+ * Multi-line comment with fake imports/requires inside
+ * import fakeMultiline from './fake-multiline.js'
+ * const fakeReq = require('./fake-multiline-require.js')
+ */
+
+// --- Template literal with embedded code (the original user-reported case) ---
+const codeSample = `
+import fakeStatic from './fake-template-static.js'
+await import('./fake-template-dynamic.js')
+const fakeReq = require('./fake-template-require.js')
+module.exports.fakeCjs = 'fake'
+export const fakeEsm = 'fake'
+`
+
+// --- Double-quoted string holding a code snippet (the astro/config case) ---
+const astroConfigSnippet = "import { defineConfig } from 'astro/config'"
+
+// --- Single-quoted string mentioning the word `import` in prose ---
+const docHint = 'Tip: run import preview from the dashboard'
+
+// --- URL containing keyword-like words (passes through unchanged) ---
+const docsUrl = 'https://npmjs.com/package/some-pkg'
+
+// --- Escaped quotes inside strings ---
+const escapedDq = "He said \"import fakeEscaped from './fake.js'\""
+const escapedSq = 'She said \'export const fakeEsc = 1\''
+
+// --- Adjacent strings on a single line ---
+const adjacent = 'import a' + ' from ' + '"./fake.js"'
+
+// --- Tagged template literal — still a template literal ---
+const html = String.raw`<pre>import fakeTagged from './fake-tagged.js'</pre>`
+
+// --- JSON-like string with an import-related package name ---
+const pkgJson = '{ "name": "import-utils", "main": "./lib/index.js" }'
+
+export function run() {
+  return realThing()
+}

package/tests/fixtures/string-noise-fixture/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "string-noise-fixture",
+  "type": "module"
+}

package/tests/fixtures/string-noise-fixture/real.js

@@ -0,0 +1,3 @@
+export function realThing() {
+  return 'real'
+}

package/tests/get-cjs-exports.test.js

@@ -759,4 +759,114 @@ Object.defineProperty(exports, 'version', {
   }
 })
 
+test('detects Rollup-style Object.keys(X).forEach re-export-all', () => {
+  // Matches the pattern emitted by Rollup (and used in AWS SDK v3 dist-cjs)
+  // for ESM `export * from './x'` when targeting CJS.
+  const code = `
+var errors = require('./models/errors');
+Object.keys(errors).forEach(function (k) {
+  if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) exports[k] = errors[k];
+});
+exports.realNamed = realNamed;
+  `
+
+  const found = getCjsExports(code)
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 1, 'Should detect 1 dynamic re-export-all')
+  assert.equal(reExports[0].from, 'errors', 'Should capture the source variable name')
+  assert.is(reExports[0].isReExportAll, true, 'Should set isReExportAll flag')
+
+  // The explicit named export must still be picked up alongside
+  assert.ok(found.some(e => e.exportType === 'named' && e.exportName === 'realNamed'))
+})
+
+test('detects tsc/tslib __exportStar re-export-all', () => {
+  const code = `
+var tslib_1 = require("tslib");
+__exportStar(require("./module-a"), exports);
+tslib_1.__exportStar(require("./module-b"), exports);
+var moduleC = require("./module-c");
+__exportStar(moduleC, exports);
+  `
+
+  const found = getCjsExports(code)
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 3, 'Should detect 3 __exportStar calls')
+
+  const fromValues = reExports.map(e => e.from).sort()
+  assert.equal(fromValues, ['./module-a', './module-b', 'moduleC'].sort())
+})
+
+test('detects esbuild __reExport re-export-all', () => {
+  const code = `
+var stdin_exports = {};
+__export(stdin_exports, { foo: () => foo });
+__reExport(stdin_exports, require("./module-a"));
+var moduleB = require("./module-b");
+__reExport(stdin_exports, moduleB);
+  `
+
+  const found = getCjsExports(code)
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 2, 'Should detect 2 __reExport calls')
+
+  const fromValues = reExports.map(e => e.from).sort()
+  assert.equal(fromValues, ['./module-a', 'moduleB'].sort())
+})
+
+test('re-export-all patterns coexist with explicit named exports', () => {
+  // A real-world file mixes both — make sure both end up in moduleExports.
+  const code = `
+var errors = require('./errors');
+exports.Foo = Foo;
+exports.Bar = Bar;
+Object.keys(errors).forEach(function (k) {
+  if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) exports[k] = errors[k];
+});
+exports.Baz = Baz;
+  `
+
+  const found = getCjsExports(code)
+  const named = found.filter(e => e.exportType === 'named').map(e => e.exportName).sort()
+  assert.equal(named, ['Bar', 'Baz', 'Foo'])
+
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 1)
+  assert.equal(reExports[0].from, 'errors')
+})
+
+test('does NOT flag unrelated Object.keys / forEach calls as re-export-all', () => {
+  // Only the specific `exports[k] = X[k]` shape should trigger detection.
+  const code = `
+Object.keys(someObj).forEach(function (k) {
+  console.log(k, someObj[k]);
+});
+Object.keys(config).forEach((k) => {
+  process.env[k] = config[k];
+});
+  `
+
+  const found = getCjsExports(code)
+  const reExports = found.filter(e => e.exportType === 'all')
+  assert.equal(reExports.length, 0, 'Should not match Object.keys patterns that do not assign to exports')
+})
+
+test('ignores CJS exports embedded in template literals and strings', () => {
+  const code = `
+module.exports.realName = 'real'
+exports.alsoReal = 'real'
+
+const template = \`
+module.exports.fakeName = 'fake'
+exports.alsoFake = 'fake'
+\`
+
+const dq = "module.exports.stringFake = 'fake'"
+  `
+
+  const found = getCjsExports(code)
+  const names = found.map(e => e.exportName).filter(Boolean).sort()
+  assert.equal(names, ['alsoReal', 'realName'], 'Only the real CJS exports should be detected')
+})
+
 test.run()

package/tests/get-exports.test.js

@@ -563,4 +563,21 @@ export const real = 'value' // this comment should be stripped
   assert.equal(foundExports[2].exportName, 'real', 'Should find real export')
 })
 
+test('ignores ESM exports embedded in template literals and strings', () => {
+  const code = `
+export const real = 'real'
+
+const template = \`
+export const fake = 'fake'
+export default function fakeDefault() {}
+\`
+
+const dq = "export { foo } from 'fake'"
+  `
+
+  const found = getExports(code)
+  const names = found.map(e => e.exportName).filter(Boolean).sort()
+  assert.equal(names, ['real'], 'Only the real export should be detected')
+})
+
 test.run() 

package/tests/get-imports.test.js

@@ -536,4 +536,249 @@ import foo from 'foo' // http://example.com
   assert.equal(importsFound[0].from, 'foo', 'Should find foo import')
 })
 
+test('side-effect imports strip surrounding quotes from `from`', () => {
+  // Regression: before the fix, the static-import regex captured the opening quote
+  // inside the path group for side-effect imports (no `from` keyword), producing
+  // values like `'./foo.js` which broke isRelative / isBuiltIn classification.
+  const code = `
+import './message/email/gmail/index.js'
+import "./message/in-app/re-notifications/index.js"
+import 'side-effect-package'
+import "node:fs"
+  `
+
+  const importsFound = normalizeTestResult(getStaticImports(code))
+
+  assert.equal(importsFound.length, 4, 'Should find 4 side-effect imports')
+
+  assert.equal(importsFound[0].from, './message/email/gmail/index.js')
+  assert.is(importsFound[0].isRelative, true, 'single-quoted relative path is relative')
+  assert.is(importsFound[0].isBuiltIn, false)
+
+  assert.equal(importsFound[1].from, './message/in-app/re-notifications/index.js')
+  assert.is(importsFound[1].isRelative, true, 'double-quoted relative path is relative')
+
+  assert.equal(importsFound[2].from, 'side-effect-package')
+  assert.is(importsFound[2].isRelative, false)
+  assert.is(importsFound[2].isBuiltIn, false)
+
+  assert.equal(importsFound[3].from, 'node:fs')
+  assert.is(importsFound[3].isBuiltIn, true, 'node: builtins detected after quote strip')
+})
+
+test('side-effect imports preserve definitions/varName semantics', () => {
+  const code = `import './foo.js'`
+  const [imp] = getStaticImports(code)
+
+  assert.equal(imp.from, './foo.js')
+  assert.is(imp.isRelative, true)
+  assert.is(imp.isImport, true)
+  assert.equal(imp.varName, '', 'side-effect imports have no bound names')
+  assert.is(imp.definitions, null, 'side-effect imports have null definitions')
+})
+
+test('ignores import statements embedded in template-literal strings', () => {
+  // Regression: code samples embedded in template literals (codegen, doc
+  // strings, test fixtures) were being parsed as real imports. The
+  // `stripStringContents` pass in `getImports` blanks those bodies first.
+  const code = `
+import real from './real.js'
+
+const template = \`
+import fakeStatic from './fake-static.js'
+await import('./fake-dynamic.js')
+const fakeFs = require('./fake-fs.js')
+\`
+
+const code = "import { foo } from 'fake-double-quoted'"
+const more = 'import bar from "fake-single-quoted"'
+  `
+
+  const importsFound = normalizeTestResult(getImports(code))
+  const froms = importsFound.map(i => i.from).sort()
+  assert.equal(froms, ['./real.js'], 'Only the real top-level import should match')
+})
+
+test('preserves module specifiers — plain strings without code keywords pass through', () => {
+  // The string-stripping heuristic only blanks string bodies that contain
+  // import/export/require/module.exports keywords. Plain module specifiers
+  // like 'lodash' or './foo.js' must NOT be touched, or `getImports` would
+  // lose its `from` value entirely.
+  const code = `
+import lodash from 'lodash'
+import foo from './foo.js'
+import url from 'https://esm.sh/some-pkg'
+import scoped from '@scope/pkg/sub/path'
+  `
+
+  const importsFound = normalizeTestResult(getImports(code))
+  const froms = importsFound.map(i => i.from).sort()
+  assert.equal(froms, [
+    '../lodash'.replace('../', ''),
+    './foo.js',
+    '@scope/pkg/sub/path',
+    'https://esm.sh/some-pkg',
+  ].sort())
+})
+
+test('does not match the word `import` inside string literals', () => {
+  // Regression: dropping the trailing `$` anchor (to enable multi-statement
+  // lines) let any quoted string containing the word `import` followed by
+  // text and a closing quote get parsed as a real import. The fix anchors
+  // `import` to a line start or `;`, so `'note: import preview'` is ignored.
+  const code = `
+import { handler as importPreviewHandler } from '../functions/contacts/import-preview.js'
+const route = createRoute({
+  summary: 'Contacts — import preview',
+  description: 'Triggers the import flow',
+})
+const msg = 'See docs: import preview from your dashboard'
+  `
+
+  const importsFound = normalizeTestResult(getStaticImports(code))
+  assert.equal(importsFound.length, 1, 'Should only find the real import')
+  assert.equal(importsFound[0].from, '../functions/contacts/import-preview.js')
+  assert.equal(importsFound[0].varName, '{ handler as importPreviewHandler }')
+})
+
+test('matches indented imports without leaking whitespace into `line`', () => {
+  // The anchor regex consumes any leading whitespace/newline before `import`;
+  // make sure that doesn't bleed into the captured `line` string.
+  const code = `
+  import foo from 'foo'
+\timport bar from 'bar'
+  `
+
+  const importsFound = normalizeTestResult(getStaticImports(code))
+  assert.equal(importsFound.length, 2)
+  assert.equal(importsFound[0].line, "import foo from 'foo'")
+  assert.equal(importsFound[1].line, "import bar from 'bar'")
+})
+
+test('multiple static imports on a single line', () => {
+  // Regression: the `(.*[@\w_-]+)["'\s]+;?$` pattern was greedy plus EOL-anchored,
+  // so a line like `import a from 'a'; import b from 'b';` matched as ONE import
+  // whose path was `a'; import b from 'b`. Tightening the path char-class and
+  // dropping the `$` anchor turns this into separate matches.
+  const code = `import a from 'a'; import b from 'b'; import c from 'c';`
+  const importsFound = normalizeTestResult(getStaticImports(code))
+
+  assert.equal(importsFound.length, 3, 'Should find 3 imports on one line')
+  assert.equal(importsFound[0].from, 'a')
+  assert.equal(importsFound[1].from, 'b')
+  assert.equal(importsFound[2].from, 'c')
+
+  // Verify names parsed independently too
+  assert.equal(importsFound[0].varName, 'a')
+  assert.equal(importsFound[1].varName, 'b')
+  assert.equal(importsFound[2].varName, 'c')
+})
+
+test('static + assertion imports on the same line do not double-count', () => {
+  // The static IMPORT_REGEX uses a negative lookahead for `assert {` / `with {`
+  // so assertion imports flow only through ASSERTION_IMPORT_REGEX instead of
+  // being matched by both.
+  const code = `
+import foo from 'fs'
+import data from './data.json' assert { type: 'json' }
+import styles from './styles.css' with { type: 'css' }
+  `
+
+  const all = normalizeTestResult(getImports(code, { includeAssertionImports: true }))
+  assert.equal(all.length, 3, 'Should not double-count assertion imports')
+
+  // Static-only call must also skip the assertion lines (no partial path matches)
+  const staticOnly = normalizeTestResult(getStaticImports(code))
+  assert.equal(staticOnly.length, 1, 'Static regex should skip assertion-import lines')
+  assert.equal(staticOnly[0].from, 'fs')
+})
+
+test('dynamic imports without await are detected', () => {
+  // Regression: DYNAMIC_IMPORT_REGEX required `await\s+import(`, missing
+  // every lazy-load pattern. `await` is now optional.
+  const code = `
+import('./then-chain.js').then(m => m)
+const eager = import('./eager.js')
+return import('./return.js')
+const Comp = lazy(() => import('./Component.js'))
+const [a, b] = await Promise.all([import('./a.js'), import('./b.js')])
+  `
+
+  const importsFound = normalizeTestResult(getDynamicImports(code))
+  const froms = importsFound.map(i => i.from).sort()
+
+  assert.equal(importsFound.length, 6, 'Should find 6 dynamic imports')
+  assert.equal(froms, [
+    './Component.js',
+    './a.js',
+    './b.js',
+    './eager.js',
+    './return.js',
+    './then-chain.js',
+  ].sort())
+
+  // All flagged as dynamic
+  assert.ok(importsFound.every(i => i.isDynamic), 'All should have isDynamic: true')
+})
+
+test('dynamic-import regex includes TypeScript inline-import-type expressions', () => {
+  // Intentionally inclusive: `import('./x').TypeName` and `typeof import('./x')`
+  // are type-only and erased at runtime, but the *file* relationship is real
+  // (renaming/deleting the target breaks `tsc`). Including them keeps the dep
+  // graph conservative for change-detection purposes. The validators already
+  // skip default-export checks for `isDynamic: true`, so this produces no
+  // false positives, and `tsc` is the right tool for runtime misuse.
+  const code = `
+function approve(payload: unknown): import('../types.js').ArtifactTypeApproval {
+  return payload as any
+}
+type Cfg = typeof import('./config.js')
+type Promised = import('./x.js').Then
+const real = import('./real.js')
+const chain = import('./api.js').then(m => m.run())
+  `
+
+  const importsFound = getDynamicImports(code)
+  const froms = importsFound.map(i => i.from).sort()
+  assert.equal(
+    froms,
+    ['../types.js', './api.js', './config.js', './real.js', './x.js'].sort(),
+    'Should match all import() forms — type-position and runtime alike'
+  )
+  // All flagged dynamic — validators key on this to skip default-export checks
+  assert.ok(importsFound.every(i => i.isDynamic))
+})
+
+test('dynamic-import regex rejects member access and identifier prefixes', () => {
+  // `obj.import('x')` and `myimport('x')` are not dynamic imports — the
+  // `(?<!\.)\b` guard prevents these from matching now that `await` is optional.
+  const code = `
+obj.import('./not-an-import.js')
+myimport('./also-not.js')
+const u = import.meta.url
+const real = import('./real.js')
+  `
+
+  const importsFound = getDynamicImports(code)
+  assert.equal(importsFound.length, 1, 'Should only match the real dynamic import')
+  assert.equal(importsFound[0].from, './real.js')
+})
+
+test('assertion imports strip surrounding quotes from `from`', () => {
+  // Same class of bug as static imports — the assertion regex captured the
+  // opening quote into the path group when the assertion was wrapped tightly.
+  const code = `
+import data from './data.json' assert { type: 'json' }
+import sheet from "./sheet.css" with { type: 'css' }
+  `
+
+  const importsFound = normalizeTestResult(getAssertionImports(code))
+
+  assert.equal(importsFound.length, 2)
+  assert.equal(importsFound[0].from, './data.json')
+  assert.is(importsFound[0].isRelative, true)
+  assert.equal(importsFound[1].from, './sheet.css')
+  assert.is(importsFound[1].isRelative, true)
+})
+
 test.run()

package/tests/get-requires.test.js

@@ -268,4 +268,22 @@ test('should still match real requires mixed with non-require code', async () =>
   assert.equal(staticRequires[2].from, 'side-effect-only')
 })
 
+test('ignores requires embedded in template literals, strings, and comments', () => {
+  const code = `
+const real = require('./real.js')
+
+const template = \`
+const fake = require('./fake-template.js')
+\`
+
+// const commented = require('./commented.js')
+
+const dq = "const fakeStr = require('./fake-string.js')"
+  `
+
+  const found = getRequires(code)
+  const froms = found.map(r => r.from).sort()
+  assert.equal(froms, ['./real.js'], 'Only the real require should match')
+})
+
 test.run()

package/tests/utils.test.js

@@ -0,0 +1,145 @@
+const { test } = require('uvu')
+const assert = require('uvu/assert')
+const { stripStringContents, stripComments } = require('../src/utils')
+
+// `stripStringContents` blanks the bodies of string/template literals whose
+// content references `import`/`export`/`require`/`module.exports`. Plain
+// strings pass through. Length and newlines are preserved.
+
+test('stripStringContents — leaves plain module specifiers untouched', () => {
+  // The whole point: a `require('lodash')` call must keep `lodash` so the
+  // require regex can read the path. Blanking it would break extraction.
+  const input = `const x = require('lodash')\nimport foo from './foo.js'`
+  assert.equal(stripStringContents(input), input)
+})
+
+test('stripStringContents — blanks template literal that contains code', () => {
+  const input = '`\nimport fake from "./fake.js"\nexport const x = 1\n`'
+  const output = stripStringContents(input)
+
+  // Length preserved
+  assert.equal(output.length, input.length, 'should preserve total length')
+  // Newlines preserved
+  assert.equal(
+    (output.match(/\n/g) || []).length,
+    (input.match(/\n/g) || []).length,
+    'should preserve newline count'
+  )
+  // The body must not still contain the keywords
+  assert.not.match(output, /import/)
+  assert.not.match(output, /export/)
+  // Opening/closing backticks survive
+  assert.is(output[0], '`')
+  assert.is(output[output.length - 1], '`')
+})
+
+test('stripStringContents — blanks double-quoted strings with code', () => {
+  const input = `const x = "import { defineConfig } from 'astro/config'"`
+  const output = stripStringContents(input)
+
+  assert.equal(output.length, input.length)
+  assert.not.match(output, /import/)
+  // Outer `"` chars preserved at the original positions
+  const openIdx = input.indexOf('"')
+  const closeIdx = input.lastIndexOf('"')
+  assert.is(output[openIdx], '"')
+  assert.is(output[closeIdx], '"')
+})
+
+test('stripStringContents — blanks single-quoted strings with code', () => {
+  const input = `const msg = 'export const fake = 1'`
+  const output = stripStringContents(input)
+  assert.equal(output.length, input.length)
+  assert.not.match(output, /export/)
+})
+
+test('stripStringContents — strings without code keywords are preserved verbatim', () => {
+  const cases = [
+    `const x = 'hello world'`,
+    `const u = 'https://example.com/path/to/thing.json'`,
+    `const p = './some/path/with-dashes/and.dots'`,
+    `const t = \`plain template with \${interpolation}\``,
+  ]
+  for (const input of cases) {
+    assert.equal(stripStringContents(input), input, `should leave alone: ${input}`)
+  }
+})
+
+test('stripStringContents — handles escaped quotes inside strings', () => {
+  // `"He said \"import fake\""` — the escaped quote should NOT close the
+  // string early. The body contains `import`, so it gets blanked.
+  const input = `const m = "He said \\"import fakeEscaped from './fake.js'\\""`
+  const output = stripStringContents(input)
+  assert.equal(output.length, input.length)
+  assert.not.match(output, /import\s+fakeEscaped/)
+  // The trailing chars after the real closing quote should be unchanged
+  assert.is(output[output.length - 1], '"')
+})
+
+test('stripStringContents — unbalanced quote followed by newline is NOT a string', () => {
+  // Single/double-quoted strings can't cross newlines per JS spec. An
+  // unterminated quote followed by a newline must not start a multi-line
+  // sweep that swallows the next several lines.
+  const input = `import React from react"\n\nimport real from './real.js'`
+  const output = stripStringContents(input)
+  // The second `import real from './real.js'` MUST survive unchanged
+  assert.ok(output.includes("import real from './real.js'"))
+})
+
+test('stripStringContents — template literal across many lines blanks all of them', () => {
+  const input = '`line 1\nimport x from "./fake.js"\nline 3\n`'
+  const output = stripStringContents(input)
+  assert.equal(output.length, input.length)
+  // Inner `import` gone
+  assert.not.match(output, /import\s+x/)
+  // Newlines preserved so line numbers still line up
+  assert.equal((output.match(/\n/g) || []).length, 3)
+})
+
+test('stripStringContents — adjacent strings on one line are matched independently', () => {
+  // `'import' + ' from ' + '"./fake"'` — three separate strings.
+  // Only the first contains the `import` keyword, so only it is blanked.
+  const input = `const x = 'import' + ' from ' + '"./fake.js"'`
+  const output = stripStringContents(input)
+  assert.equal(output.length, input.length)
+  // The middle string ` from ` and last string `"./fake.js"` are preserved
+  assert.ok(output.includes("' from '"))
+  assert.ok(output.includes(`'"./fake.js"'`))
+})
+
+test('stripStringContents — tagged template literals are still blanked', () => {
+  // `String.raw\`<div>import fakeTagged from './fake.js'</div>\`` — the
+  // backtick portion is a template literal regardless of the tag prefix.
+  const input = "const html = String.raw`<div>import fakeTagged from './fake.js'</div>`"
+  const output = stripStringContents(input)
+  assert.equal(output.length, input.length)
+  assert.not.match(output, /import\s+fakeTagged/)
+  // The tag identifier `String.raw` must survive
+  assert.ok(output.includes('String.raw'))
+})
+
+test('stripStringContents — preserves :// URL strings (they have no code keywords)', () => {
+  const input = `const url = 'https://npmjs.com/package/import-utils'`
+  // Note: `import-utils` contains `import` followed by `-` (non-word).
+  // `\bimport\b` matches at that boundary, so the body IS blanked. This is
+  // a conservative blanking but it's harmless — we don't try to extract
+  // from inside the URL string anyway.
+  const output = stripStringContents(input)
+  assert.equal(output.length, input.length)
+})
+
+test('stripStringContents — neutralizes // inside code-bearing strings so stripComments cannot eat them', () => {
+  // For strings whose bodies DO trigger the heuristic (contain import/export
+  // etc.), the body becomes spaces and any `//` or `/* */` inside is gone
+  // before stripComments runs. Result: the surrounding code is preserved.
+  // Strings WITHOUT those keywords still hit the pre-existing `stripComments`
+  // limitation, which is outside the scope of this helper.
+  const input = `const x = "// import fakeCmt from './fake.js'"\nconst y = 1`
+  const after = stripComments(stripStringContents(input))
+  // The outer quoted-string structure must remain intact — `stripComments`
+  // would have eaten from `//` to end of line if we hadn't blanked first.
+  assert.ok(after.startsWith('const x = "'), 'opening of the string survives')
+  assert.ok(after.includes('"\nconst y = 1'), 'closing quote and following code survive')
+})
+
+test.run()