@davidwells/extract-deps 0.1.8 → 0.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidwells/extract-deps",
-  "version": "0.1.8",
+  "version": "0.1.11",
   "description": "Get imports and requires from a codebase without AST",
   "main": "src/index.js",
   "exports": {

package/src/dep-graph.js

@@ -140,6 +140,15 @@ function verifyImportedValuesExist(dep, targetDeps, targetPath, sourcePath, erro
       if (dep.varName && dep.varName.startsWith('*')) {
         return
       }
+      // Side-effect imports (`import './foo.js'`) bind no values — no export required.
+      if (!dep.varName && !dep.definitions) {
+        return
+      }
+      // Dynamic imports (`import('./foo.js')`) resolve to the module's
+      // namespace object, not the default export.
+      if (dep.isDynamic) {
+        return
+      }
       // ESM import X from 'pkg' requires a default export
       const hasModuleExports = targetDeps.moduleExports && targetDeps.moduleExports.length > 0
       const hasESMExports = targetDeps.exports && targetDeps.exports.length > 0

package/src/get-cjs-exports.js

@@ -1,6 +1,6 @@
 // Extracts CommonJS module.exports and exports patterns from JavaScript code
 
-const { getNames, extractExportName } = require('./utils')
+const { getNames, extractExportName, stripCommentsAndStrings } = require('./utils')
 
 // Matches: module.exports = ... or exports = module.exports = ...
 // https://regex101.com/r/example/cjs-1
@@ -35,8 +35,11 @@ function stripComments(code) {
 }
 
 function getCjsExports(code) {
-  // Strip comments to prevent false positives from commented code
-  const sanitizedCode = stripComments(code)
+  // Single tokenizer-based pass that blanks comments and code-bearing
+  // strings/templates together. Length is preserved so the position-based
+  // logic below (which slices into the original `code` for full export
+  // values) keeps working off the same indices.
+  const sanitizedCode = stripCommentsAndStrings(code)
 
   const assignmentExports = getModuleExportsAssignment(code, sanitizedCode)
   const modulePropertyExports = getModuleExportsProperty(code, sanitizedCode)

package/src/get-exports.js

@@ -1,4 +1,4 @@
-const { getNames, extractExportName, stripComments } = require('./utils')
+const { getNames, extractExportName, stripComments, stripStringContents } = require('./utils')
 
 // https://regex101.com/r/example/1
 const EXPORT_DEFAULT_REGEX = /export\s+default\s+(?:(?:async\s+)?function\s+([\w$]+)|class\s+([\w$]+)|([\w$]+|\([^)]*\)\s*=>|{[\s\S]*?}|\[[\s\S]*?\]|'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`|[\w$]+(?:\s*[+\-*/%]\s*[\w$]+)*))/gm
@@ -16,8 +16,12 @@ const EXPORT_TYPE_REGEX = /export\s+(?:type|interface)\s+([\w$]+)/gm
 const EXPORT_ASSERTION_REGEX = /export\s+(?:["'\s]*([\w*{}\n\r\t, ]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+(assert|with)\s*\{([^}]+)\};?$/gm
 
 function getExports(code = '', options = {}) {
-  // Strip comments to avoid false positives
+  // Comments first, then strings — order matters. Running stripStringContents
+  // alone would mis-pair an apostrophe inside a JSDoc comment (`Netlify's …`)
+  // with a later quote and shift subsequent backtick pairing, which could
+  // swallow real `export` declarations a few lines later.
   code = stripComments(code)
+  code = stripStringContents(code)
   const defaultExports = getDefaultExports(code)
   const namedExports = getNamedExports(code)
   const namedDeclarationExports = getNamedDeclarationExports(code)

package/src/get-imports.js

@@ -1,4 +1,4 @@
-const { isBuiltIn, isRelativeImport, isRelativeImportWithQuotes, getNames, stripComments } = require('./utils')
+const { isBuiltIn, isRelativeImport, isRelativeImportWithQuotes, getNames, stripComments, stripStringContents } = require('./utils')
 
 // https://regex101.com/r/cfEmlm/1
 // Path excludes quotes, newlines, and `;` so multi-statement lines like
@@ -12,7 +12,12 @@ const { isBuiltIn, isRelativeImport, isRelativeImportWithQuotes, getNames, strip
 // Negative lookahead `(?!\s*(?:assert|with)\s*\{)` keeps this from matching
 // import-attributes/assertion imports — those go through ASSERTION_IMPORT_REGEX
 // and would otherwise be double-counted in `getImports`.
-const IMPORT_REGEX = /import(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s]+([^"'`\n;\s]+)\s*["'](?!\s*(?:assert|with)\s*\{)/gm
+// Leading anchor `(?:^|(?<=[;\n]))` requires `import` to start a line (the `^`
+// matches at every line start under the `m` flag) or follow a `;` on the same
+// line. Without this, string literals like `'note: import preview'` get parsed
+// as `import preview` — the old regex was safe from this only because of its
+// `$` anchor, which we removed to support multi-statement lines.
+const IMPORT_REGEX = /(?:^|(?<=[;\n]))\s*import(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s]+([^"'`\n;\s]+)\s*["'](?!\s*(?:assert|with)\s*\{)/gm
 // https://regex101.com/r/UDmXlb/1
 const IMPORT_TYPE_REGEX = /import\(['"](.*)['"]\)\.?([A-Za-z_0-9.]*)?/gm
 // https://regex101.com/r/UDjMoV/1
@@ -20,13 +25,24 @@ const IMPORT_TYPE_REGEX = /import\(['"](.*)['"]\)\.?([A-Za-z_0-9.]*)?/gm
 // `return import('./foo')`, and `lazy(() => import('./foo'))` all match.
 // `(?<!\.)\b` rejects member access (`obj.import(...)`) and identifiers like
 // `myimport(...)`.
+//
+// TypeScript inline-import-type forms (`: import('./x').Foo`, `typeof
+// import('./x')`) are matched here too. They get `isDynamic: true` and the
+// validators already skip default-export checks for dynamic imports, so they
+// produce no false positives. The relationship is real for compilation
+// (renaming/deleting the target breaks `tsc`), so keeping the dep-graph edge
+// is the more conservative choice for smart-ci's change detection.
 const DYNAMIC_IMPORT_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= $]+)\s*=\s*)?(?:await\s+)?(?<!\.)\bimport\(([^()]+(?:\([^()]*\)[^()]*)*)\)/gm
 // https://regex101.com/r/example/1
 const ASSERTION_IMPORT_REGEX = /(?:^|\n)\s*import\s+(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s]+([^"'`\n;\s]+)\s*["']\s+(assert|with)\s*\{([^}]+)\}/gm
 
 function getImports(code = '', options = {}) {
-  // Strip comments to avoid false positives
+  // Strip comments FIRST so apostrophes/backticks inside JSDoc text get
+  // removed before `stripStringContents` looks for string literals.
+  // (Running the two in the opposite order let comment chars masquerade as
+  // string openers and swallow real `import`/`export` lines further down.)
   code = stripComments(code)
+  code = stripStringContents(code)
   const staticImports = getStaticImports(code)
   const dynamicImports = getDynamicImports(code)
   if (options.includeAssertionImports) {
@@ -41,7 +57,11 @@ function getStaticImports(targetText = '') {
   let importStatements = []
   var result;
   while((result = IMPORT_REGEX.exec(targetText)) !== null) {
-    const [ line, names, rawFrom ] = result
+    let [ line, names, rawFrom ] = result
+    // The leading `(?:^|(?<=[;\n]))\s*` anchor pulls in any whitespace/newline
+    // separator that precedes the `import` keyword; trim it back off so `line`
+    // reads as the source author wrote it.
+    line = line.replace(/^\s+/, '')
     // Side-effect imports (e.g. `import './foo.js'`) and unnamed-default imports skip the
     // optional `from` capture, so the opening quote ends up inside the path group. Strip it.
     const from = rawFrom.replace(/^["'`]|["'`]$/g, '')

package/src/get-requires.js

@@ -1,4 +1,4 @@
-const { isBuiltIn, isRelativeImport, getNames } = require('./utils')
+const { isBuiltIn, isRelativeImport, getNames, stripComments, stripStringContents } = require('./utils')
 
 // Updated regex to exclude ES6 dynamic imports
 // require() must always be present — previous version made it optional, causing false matches
@@ -65,6 +65,12 @@ function getStaticRequires(targetText = '') {
 }
 
 function getRequires(code) {
+  // Strip comments first, then strings — order matters. `stripComments`
+  // alone would mis-eat `//` inside strings; running it first instead means
+  // comment chars (incl. apostrophes/backticks inside JSDoc) disappear
+  // before `stripStringContents` looks for real string literals.
+  code = stripComments(code)
+  code = stripStringContents(code)
   const staticRequires = getStaticRequires(code)
   const dynamicRequires = getDynamicRequires(code)
   return staticRequires.concat(dynamicRequires).sort((a, b) => a.index - b.index)

package/src/utils.js

@@ -4,6 +4,118 @@ const builtinModules = require('module').builtinModules
 const COMMENT_RE = /\/\*[\s\S]*?\*\/|\/\/.*(?:\r?\n|$)/g
 const PROTOCOL_PLACEHOLDER = '__PROTO_SLASH__'
 
+// Single-quoted and double-quoted strings can't contain unescaped newlines
+// (per JS spec — they'd need `\n` escapes or `\<NL>` line continuations). The
+// `[^"\\\n]` / `[^'\\\n]` char classes enforce that, so an unbalanced quote
+// followed by a newline doesn't sweep up the next several lines as "string".
+// Template literals (`` `...` ``) DO span newlines, so their inner class only
+// excludes backtick and backslash. Escape sequences (`\.`) are allowed in all
+// three so escaped quotes don't prematurely end the match.
+// Note: this treats `${...}` interpolations as part of the string body — code
+// inside `${...}` (rare, but possible: `${import('./x.js')}`) gets blanked too.
+// Acceptable for the change-detection use case; a full tokenizer would be
+// needed to preserve interpolations.
+const STRING_LITERAL_RE = /"(?:[^"\\\n]|\\[\s\S])*"|'(?:[^'\\\n]|\\[\s\S])*'|`(?:[^`\\]|\\[\s\S])*`/g
+
+// Strings whose bodies contain these tokens are treated as embedded code
+// samples (template strings, generator helpers, fenced docs) and get blanked.
+// Plain module specifiers like `'lodash'` or `'./foo.js'` don't contain any
+// of these as words, so they pass through untouched and remain extractable.
+const EMBEDDED_CODE_RE = /\b(?:import|export|require|module\.exports)\b/
+
+/**
+ * Blank the contents of every string/template literal in `code` that looks
+ * like it contains embedded code (its body mentions `import`, `export`,
+ * `require`, or `module.exports`). The opening and closing quote chars are
+ * preserved, as are newlines. Total length is preserved so character indices
+ * remain stable.
+ *
+ * Strings whose bodies don't reference those keywords — including ordinary
+ * module specifiers like `'lodash'`, paths like `'./foo.js'`, URLs, and
+ * arbitrary user text — pass through untouched, so the static-import/require
+ * regexes can still read their content.
+ *
+ * Without this pass, regex-based extractors falsely match `import`, `export`,
+ * and `require` keywords that appear inside code samples embedded in strings.
+ *
+ * Run this BEFORE `stripComments` — the existing comment regex would otherwise
+ * mis-strip `//` and `/* *\/` sequences that occur inside strings.
+ *
+ * Caveat: `${...}` interpolations inside template literals are treated as
+ * part of the body, so a runtime `${import('./x.js')}` inside a template
+ * would be blanked. Very rare in practice; a proper tokenizer would be
+ * needed to do better.
+ *
+ * @param {string} code
+ * @returns {string}
+ */
+function stripStringContents(code) {
+  return code.replace(STRING_LITERAL_RE, (match) => {
+    const body = match.slice(1, -1)
+    if (!EMBEDDED_CODE_RE.test(body)) {
+      // Plain string — leave it alone so module specifiers stay extractable.
+      return match
+    }
+    const opener = match[0]
+    const closer = match[match.length - 1]
+    const middle = body.replace(/[^\n]/g, ' ')
+    return opener + middle + closer
+  })
+}
+
+// Unified regex matching whichever comes first at each position: block
+// comment, line comment, single-quoted string, double-quoted string, or
+// template literal. Matching left-to-right means a comment that starts
+// first consumes its body — including any apostrophes or backticks inside
+// — before they can start a spurious string match a few lines later. That
+// solves the JSDoc-apostrophe-shifts-backtick-pairing class of bugs that
+// arose when comments and strings were stripped in two separate passes.
+const COMMENT_OR_STRING_RE = /\/\*[\s\S]*?\*\/|\/\/[^\n]*|"(?:[^"\\\n]|\\[\s\S])*"|'(?:[^'\\\n]|\\[\s\S])*'|`(?:[^`\\]|\\[\s\S])*`/g
+
+/**
+ * Single-regex pass that blanks comment bodies and code-bearing
+ * string/template bodies together. Solves two bugs that occurred when the
+ * string-strip and comment-strip ran in separate passes:
+ *
+ *   - Apostrophes inside JSDoc comments (e.g. `* Netlify's \`...`) were
+ *     mis-paired with later quotes, which shifted subsequent backtick
+ *     pairing and could swallow real `export` declarations a few lines
+ *     later in the same file.
+ *   - `//` and `/* *\/` sequences inside string bodies were mis-stripped
+ *     as comments.
+ *
+ * Length is preserved (each consumed char replaced by a space or newline
+ * kept verbatim) so downstream character indices stay valid.
+ *
+ * Strings whose bodies don't reference `import` / `export` / `require` /
+ * `module.exports` pass through unchanged, so module specifiers like
+ * `'lodash'` or `'./foo.js'` stay readable by the downstream regexes.
+ *
+ * Caveat: `${...}` interpolations inside template literals are part of the
+ * body, so `${import('./x.js')}` inside a template gets blanked. Rare in
+ * practice; a full parser would be needed otherwise.
+ *
+ * @param {string} code
+ * @returns {string}
+ */
+function stripCommentsAndStrings(code) {
+  return code.replace(COMMENT_OR_STRING_RE, (match) => {
+    const first = match[0]
+    // Comments (line or block) are fully blanked — they have no extractable
+    // content. Newlines are preserved so line counts hold.
+    if (first === '/') {
+      return match.replace(/[^\n]/g, ' ')
+    }
+    // Strings/templates — only blank if the body references code keywords;
+    // otherwise leave the literal intact so `'lodash'` etc. remain readable.
+    const body = match.slice(1, -1)
+    if (!EMBEDDED_CODE_RE.test(body)) {
+      return match
+    }
+    return first + body.replace(/[^\n]/g, ' ') + first
+  })
+}
+
 /**
  * Strip comments from code, preserving :// in URLs
  * @param {string} code
@@ -232,6 +344,8 @@ function extractExportName(exportValue) {
 
 module.exports = {
   stripComments,
+  stripStringContents,
+  stripCommentsAndStrings,
   isBuiltIn,
   isRelativeImport,
   isRelativeImportWithQuotes,

package/tests/dep-graph.test.js

@@ -592,6 +592,66 @@ test('namespace import should build valid graph', () => {
   assert.ok(deps.some(d => d.includes('utils.js')), 'Should have utils.js as dependency')
 })
 
+// Side-effect imports — `import './register.js'` runs the module for its
+// effects and binds no values. The validator must not require a default export.
+const ESM_SIDE_EFFECT_FIXTURE = path.resolve(__dirname, './fixtures/esm-side-effect-fixture/index.js')
+
+test('side-effect import should not require default export', () => {
+  assert.not.throws(() => {
+    depGraph(ESM_SIDE_EFFECT_FIXTURE, { verifyGraph: true })
+  }, "import './x' should not fail when target has only named exports")
+})
+
+test('side-effect import should still build the dep edge', () => {
+  const graph = depGraph(ESM_SIDE_EFFECT_FIXTURE, { verifyGraph: true })
+  const indexPath = Array.from(graph.keys()).find(key => key.includes('esm-side-effect-fixture/index.js'))
+  assert.ok(indexPath, 'Should have index.js in graph')
+
+  const deps = graph.get(indexPath)
+  assert.ok(deps.some(d => d.includes('register.js')), 'Should have register.js as dependency')
+})
+
+// Dynamic imports — `await import('./x.js')` resolves to the namespace
+// object, not the default export. Same skip semantics.
+const ESM_DYNAMIC_FIXTURE = path.resolve(__dirname, './fixtures/esm-dynamic-import-fixture/index.js')
+
+test('dynamic import should not require default export', () => {
+  assert.not.throws(() => {
+    depGraph(ESM_DYNAMIC_FIXTURE, { verifyGraph: true })
+  }, "import('./x') should not fail when target has only named exports")
+})
+
+// End-to-end coverage of the string/template/comment noise that historically
+// produced false-positive dep edges. The fixture contains real + fake
+// imports, requires, and exports embedded in template literals, double-
+// quoted strings, single-quoted strings, escaped-quote strings, tagged
+// templates, JSON-shaped strings, and comments. Only ONE real edge should
+// be produced (→ real.js), and no errors should fire.
+const STRING_NOISE_FIXTURE = path.resolve(__dirname, './fixtures/string-noise-fixture/index.js')
+
+test('string/template/comment noise produces no false-positive edges', () => {
+  let graph
+  assert.not.throws(() => {
+    graph = depGraph(STRING_NOISE_FIXTURE, { verifyGraph: true })
+  }, 'should not throw on the noise fixture')
+
+  const indexPath = Array.from(graph.keys()).find(k => k.includes('string-noise-fixture/index.js'))
+  assert.ok(indexPath, 'index.js should be in the graph')
+
+  const deps = graph.get(indexPath)
+  assert.equal(deps.length, 1, 'should produce exactly one edge — the real import')
+  assert.ok(deps[0].includes('real.js'), 'the one edge should be to real.js')
+})
+
+test('dynamic import should still build the dep edge', () => {
+  const graph = depGraph(ESM_DYNAMIC_FIXTURE, { verifyGraph: true })
+  const indexPath = Array.from(graph.keys()).find(key => key.includes('esm-dynamic-import-fixture/index.js'))
+  assert.ok(indexPath, 'Should have index.js in graph')
+
+  const deps = graph.get(indexPath)
+  assert.ok(deps.some(d => d.includes('pipeline.js')), 'Should have pipeline.js as dependency')
+})
+
 // TypeScript patterns fixture — exercises all fixed false positive patterns
 const TS_PATTERNS_FIXTURE = path.resolve(__dirname, './fixtures/ts-patterns-fixture/index.ts')
 

package/tests/fixtures/esm-dynamic-import-fixture/index.js

@@ -0,0 +1,11 @@
+// Dynamic import resolves to the module's namespace object, not the
+// default export. The target has only named exports and no default;
+// validation must not flag this as "missing default export".
+export async function load() {
+  const pipeline = await import('./pipeline.js')
+  return pipeline.run()
+}
+
+export function eager() {
+  return import('./pipeline.js').then((m) => m.run())
+}

package/tests/fixtures/esm-dynamic-import-fixture/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "esm-dynamic-import-fixture",
+  "type": "module"
+}

package/tests/fixtures/esm-dynamic-import-fixture/pipeline.js

@@ -0,0 +1,6 @@
+// Named exports only — no default. Dynamic importers should still validate.
+export function run() {
+  return 'pipeline result'
+}
+
+export const VERSION = 1

package/tests/fixtures/esm-side-effect-fixture/index.js

@@ -0,0 +1,7 @@
+// Importing './register.js' for its side effects only — no values are bound.
+// The target file has no default export; that must be fine.
+import './register.js'
+
+export function main() {
+  return 'hello'
+}

package/tests/fixtures/esm-side-effect-fixture/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "esm-side-effect-fixture",
+  "type": "module"
+}

package/tests/fixtures/esm-side-effect-fixture/register.js

@@ -0,0 +1,6 @@
+// Pure side-effect module — registers something on a shared registry and
+// exports a single named binding. Critically, no default export.
+const registry = (globalThis.__test_registry = globalThis.__test_registry || [])
+registry.push('side-effect-fixture')
+
+export const REGISTERED = true

package/tests/fixtures/string-noise-fixture/index.js

@@ -0,0 +1,50 @@
+// Regression fixture: every kind of string/template/comment noise that
+// previously fooled the extractors, alongside one real import edge that
+// MUST still be detected. The dep-graph test for this fixture asserts that
+// exactly one edge (→ real.js) is produced.
+
+import { realThing } from './real.js'
+
+// --- Single-line comment with a fake import that must be ignored ---
+// import fakeCommented from './fake-commented.js'
+
+/*
+ * Multi-line comment with fake imports/requires inside
+ * import fakeMultiline from './fake-multiline.js'
+ * const fakeReq = require('./fake-multiline-require.js')
+ */
+
+// --- Template literal with embedded code (the original user-reported case) ---
+const codeSample = `
+import fakeStatic from './fake-template-static.js'
+await import('./fake-template-dynamic.js')
+const fakeReq = require('./fake-template-require.js')
+module.exports.fakeCjs = 'fake'
+export const fakeEsm = 'fake'
+`
+
+// --- Double-quoted string holding a code snippet (the astro/config case) ---
+const astroConfigSnippet = "import { defineConfig } from 'astro/config'"
+
+// --- Single-quoted string mentioning the word `import` in prose ---
+const docHint = 'Tip: run import preview from the dashboard'
+
+// --- URL containing keyword-like words (passes through unchanged) ---
+const docsUrl = 'https://npmjs.com/package/some-pkg'
+
+// --- Escaped quotes inside strings ---
+const escapedDq = "He said \"import fakeEscaped from './fake.js'\""
+const escapedSq = 'She said \'export const fakeEsc = 1\''
+
+// --- Adjacent strings on a single line ---
+const adjacent = 'import a' + ' from ' + '"./fake.js"'
+
+// --- Tagged template literal — still a template literal ---
+const html = String.raw`<pre>import fakeTagged from './fake-tagged.js'</pre>`
+
+// --- JSON-like string with an import-related package name ---
+const pkgJson = '{ "name": "import-utils", "main": "./lib/index.js" }'
+
+export function run() {
+  return realThing()
+}

package/tests/fixtures/string-noise-fixture/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "string-noise-fixture",
+  "type": "module"
+}

package/tests/fixtures/string-noise-fixture/real.js

@@ -0,0 +1,3 @@
+export function realThing() {
+  return 'real'
+}

package/tests/get-cjs-exports.test.js

@@ -851,4 +851,22 @@ Object.keys(config).forEach((k) => {
   assert.equal(reExports.length, 0, 'Should not match Object.keys patterns that do not assign to exports')
 })
 
+test('ignores CJS exports embedded in template literals and strings', () => {
+  const code = `
+module.exports.realName = 'real'
+exports.alsoReal = 'real'
+
+const template = \`
+module.exports.fakeName = 'fake'
+exports.alsoFake = 'fake'
+\`
+
+const dq = "module.exports.stringFake = 'fake'"
+  `
+
+  const found = getCjsExports(code)
+  const names = found.map(e => e.exportName).filter(Boolean).sort()
+  assert.equal(names, ['alsoReal', 'realName'], 'Only the real CJS exports should be detected')
+})
+
 test.run()

package/tests/get-exports.test.js

@@ -563,4 +563,56 @@ export const real = 'value' // this comment should be stripped
   assert.equal(foundExports[2].exportName, 'real', 'Should find real export')
 })
 
+test('apostrophe inside JSDoc with surrounding backticks does not swallow later exports', () => {
+  // Regression: when `stripStringContents` ran BEFORE `stripComments`, an
+  // apostrophe inside a JSDoc block (e.g. `Netlify's \`promptType: 'foo'\``)
+  // was treated as the opener of a single-quoted string and consumed text up
+  // to the next `'`, shifting every subsequent backtick pair by one. The
+  // newly mis-paired template literal then spanned multiple lines, including
+  // the real `export async function` declaration that followed the JSDoc,
+  // and the embedded-code heuristic blanked it. The fix runs `stripComments`
+  // first so JSDoc-internal punctuation is gone before string matching.
+  //
+  // This fixture replicates the structural shape of the AWS SDK adapter file
+  // that originally surfaced the bug: a JSDoc block containing both an
+  // apostrophe and multiple backticks, followed by an `export async function`,
+  // followed by ANOTHER JSDoc with backticks.
+  const code = `
+/**
+ * Stuff with \`code-one\`. Netlify's \`promptType: 'foo'\`. End \`Error\` on
+ * non-2xx upstream responses or malformed bodies.
+ */
+export async function generateThing(request) {
+  return request
+}
+/** Test seam: override the global \`fetch\` for unit tests. */
+export const helper = 1
+  `
+
+  const found = getExports(code)
+  const names = found.map(e => e.exportName).sort()
+  assert.equal(
+    names,
+    ['generateThing', 'helper'],
+    'Both exports must survive past the JSDoc apostrophe+backtick combo'
+  )
+})
+
+test('ignores ESM exports embedded in template literals and strings', () => {
+  const code = `
+export const real = 'real'
+
+const template = \`
+export const fake = 'fake'
+export default function fakeDefault() {}
+\`
+
+const dq = "export { foo } from 'fake'"
+  `
+
+  const found = getExports(code)
+  const names = found.map(e => e.exportName).filter(Boolean).sort()
+  assert.equal(names, ['real'], 'Only the real export should be detected')
+})
+
 test.run() 

package/tests/get-imports.test.js

@@ -577,6 +577,84 @@ test('side-effect imports preserve definitions/varName semantics', () => {
   assert.is(imp.definitions, null, 'side-effect imports have null definitions')
 })
 
+test('ignores import statements embedded in template-literal strings', () => {
+  // Regression: code samples embedded in template literals (codegen, doc
+  // strings, test fixtures) were being parsed as real imports. The
+  // `stripStringContents` pass in `getImports` blanks those bodies first.
+  const code = `
+import real from './real.js'
+
+const template = \`
+import fakeStatic from './fake-static.js'
+await import('./fake-dynamic.js')
+const fakeFs = require('./fake-fs.js')
+\`
+
+const code = "import { foo } from 'fake-double-quoted'"
+const more = 'import bar from "fake-single-quoted"'
+  `
+
+  const importsFound = normalizeTestResult(getImports(code))
+  const froms = importsFound.map(i => i.from).sort()
+  assert.equal(froms, ['./real.js'], 'Only the real top-level import should match')
+})
+
+test('preserves module specifiers — plain strings without code keywords pass through', () => {
+  // The string-stripping heuristic only blanks string bodies that contain
+  // import/export/require/module.exports keywords. Plain module specifiers
+  // like 'lodash' or './foo.js' must NOT be touched, or `getImports` would
+  // lose its `from` value entirely.
+  const code = `
+import lodash from 'lodash'
+import foo from './foo.js'
+import url from 'https://esm.sh/some-pkg'
+import scoped from '@scope/pkg/sub/path'
+  `
+
+  const importsFound = normalizeTestResult(getImports(code))
+  const froms = importsFound.map(i => i.from).sort()
+  assert.equal(froms, [
+    '../lodash'.replace('../', ''),
+    './foo.js',
+    '@scope/pkg/sub/path',
+    'https://esm.sh/some-pkg',
+  ].sort())
+})
+
+test('does not match the word `import` inside string literals', () => {
+  // Regression: dropping the trailing `$` anchor (to enable multi-statement
+  // lines) let any quoted string containing the word `import` followed by
+  // text and a closing quote get parsed as a real import. The fix anchors
+  // `import` to a line start or `;`, so `'note: import preview'` is ignored.
+  const code = `
+import { handler as importPreviewHandler } from '../functions/contacts/import-preview.js'
+const route = createRoute({
+  summary: 'Contacts — import preview',
+  description: 'Triggers the import flow',
+})
+const msg = 'See docs: import preview from your dashboard'
+  `
+
+  const importsFound = normalizeTestResult(getStaticImports(code))
+  assert.equal(importsFound.length, 1, 'Should only find the real import')
+  assert.equal(importsFound[0].from, '../functions/contacts/import-preview.js')
+  assert.equal(importsFound[0].varName, '{ handler as importPreviewHandler }')
+})
+
+test('matches indented imports without leaking whitespace into `line`', () => {
+  // The anchor regex consumes any leading whitespace/newline before `import`;
+  // make sure that doesn't bleed into the captured `line` string.
+  const code = `
+  import foo from 'foo'
+\timport bar from 'bar'
+  `
+
+  const importsFound = normalizeTestResult(getStaticImports(code))
+  assert.equal(importsFound.length, 2)
+  assert.equal(importsFound[0].line, "import foo from 'foo'")
+  assert.equal(importsFound[1].line, "import bar from 'bar'")
+})
+
 test('multiple static imports on a single line', () => {
   // Regression: the `(.*[@\w_-]+)["'\s]+;?$` pattern was greedy plus EOL-anchored,
   // so a line like `import a from 'a'; import b from 'b';` matched as ONE import
@@ -643,6 +721,34 @@ const [a, b] = await Promise.all([import('./a.js'), import('./b.js')])
   assert.ok(importsFound.every(i => i.isDynamic), 'All should have isDynamic: true')
 })
 
+test('dynamic-import regex includes TypeScript inline-import-type expressions', () => {
+  // Intentionally inclusive: `import('./x').TypeName` and `typeof import('./x')`
+  // are type-only and erased at runtime, but the *file* relationship is real
+  // (renaming/deleting the target breaks `tsc`). Including them keeps the dep
+  // graph conservative for change-detection purposes. The validators already
+  // skip default-export checks for `isDynamic: true`, so this produces no
+  // false positives, and `tsc` is the right tool for runtime misuse.
+  const code = `
+function approve(payload: unknown): import('../types.js').ArtifactTypeApproval {
+  return payload as any
+}
+type Cfg = typeof import('./config.js')
+type Promised = import('./x.js').Then
+const real = import('./real.js')
+const chain = import('./api.js').then(m => m.run())
+  `
+
+  const importsFound = getDynamicImports(code)
+  const froms = importsFound.map(i => i.from).sort()
+  assert.equal(
+    froms,
+    ['../types.js', './api.js', './config.js', './real.js', './x.js'].sort(),
+    'Should match all import() forms — type-position and runtime alike'
+  )
+  // All flagged dynamic — validators key on this to skip default-export checks
+  assert.ok(importsFound.every(i => i.isDynamic))
+})
+
 test('dynamic-import regex rejects member access and identifier prefixes', () => {
   // `obj.import('x')` and `myimport('x')` are not dynamic imports — the
   // `(?<!\.)\b` guard prevents these from matching now that `await` is optional.

package/tests/get-requires.test.js

@@ -268,4 +268,22 @@ test('should still match real requires mixed with non-require code', async () =>
   assert.equal(staticRequires[2].from, 'side-effect-only')
 })
 
+test('ignores requires embedded in template literals, strings, and comments', () => {
+  const code = `
+const real = require('./real.js')
+
+const template = \`
+const fake = require('./fake-template.js')
+\`
+
+// const commented = require('./commented.js')
+
+const dq = "const fakeStr = require('./fake-string.js')"
+  `
+
+  const found = getRequires(code)
+  const froms = found.map(r => r.from).sort()
+  assert.equal(froms, ['./real.js'], 'Only the real require should match')
+})
+
 test.run()

package/tests/utils.test.js

@@ -0,0 +1,145 @@
+const { test } = require('uvu')
+const assert = require('uvu/assert')
+const { stripStringContents, stripComments } = require('../src/utils')
+
+// `stripStringContents` blanks the bodies of string/template literals whose
+// content references `import`/`export`/`require`/`module.exports`. Plain
+// strings pass through. Length and newlines are preserved.
+
+test('stripStringContents — leaves plain module specifiers untouched', () => {
+  // The whole point: a `require('lodash')` call must keep `lodash` so the
+  // require regex can read the path. Blanking it would break extraction.
+  const input = `const x = require('lodash')\nimport foo from './foo.js'`
+  assert.equal(stripStringContents(input), input)
+})
+
+test('stripStringContents — blanks template literal that contains code', () => {
+  const input = '`\nimport fake from "./fake.js"\nexport const x = 1\n`'
+  const output = stripStringContents(input)
+
+  // Length preserved
+  assert.equal(output.length, input.length, 'should preserve total length')
+  // Newlines preserved
+  assert.equal(
+    (output.match(/\n/g) || []).length,
+    (input.match(/\n/g) || []).length,
+    'should preserve newline count'
+  )
+  // The body must not still contain the keywords
+  assert.not.match(output, /import/)
+  assert.not.match(output, /export/)
+  // Opening/closing backticks survive
+  assert.is(output[0], '`')
+  assert.is(output[output.length - 1], '`')
+})
+
+test('stripStringContents — blanks double-quoted strings with code', () => {
+  const input = `const x = "import { defineConfig } from 'astro/config'"`
+  const output = stripStringContents(input)
+
+  assert.equal(output.length, input.length)
+  assert.not.match(output, /import/)
+  // Outer `"` chars preserved at the original positions
+  const openIdx = input.indexOf('"')
+  const closeIdx = input.lastIndexOf('"')
+  assert.is(output[openIdx], '"')
+  assert.is(output[closeIdx], '"')
+})
+
+test('stripStringContents — blanks single-quoted strings with code', () => {
+  const input = `const msg = 'export const fake = 1'`
+  const output = stripStringContents(input)
+  assert.equal(output.length, input.length)
+  assert.not.match(output, /export/)
+})
+
+test('stripStringContents — strings without code keywords are preserved verbatim', () => {
+  const cases = [
+    `const x = 'hello world'`,
+    `const u = 'https://example.com/path/to/thing.json'`,
+    `const p = './some/path/with-dashes/and.dots'`,
+    `const t = \`plain template with \${interpolation}\``,
+  ]
+  for (const input of cases) {
+    assert.equal(stripStringContents(input), input, `should leave alone: ${input}`)
+  }
+})
+
+test('stripStringContents — handles escaped quotes inside strings', () => {
+  // `"He said \"import fake\""` — the escaped quote should NOT close the
+  // string early. The body contains `import`, so it gets blanked.
+  const input = `const m = "He said \\"import fakeEscaped from './fake.js'\\""`
+  const output = stripStringContents(input)
+  assert.equal(output.length, input.length)
+  assert.not.match(output, /import\s+fakeEscaped/)
+  // The trailing chars after the real closing quote should be unchanged
+  assert.is(output[output.length - 1], '"')
+})
+
+test('stripStringContents — unbalanced quote followed by newline is NOT a string', () => {
+  // Single/double-quoted strings can't cross newlines per JS spec. An
+  // unterminated quote followed by a newline must not start a multi-line
+  // sweep that swallows the next several lines.
+  const input = `import React from react"\n\nimport real from './real.js'`
+  const output = stripStringContents(input)
+  // The second `import real from './real.js'` MUST survive unchanged
+  assert.ok(output.includes("import real from './real.js'"))
+})
+
+test('stripStringContents — template literal across many lines blanks all of them', () => {
+  const input = '`line 1\nimport x from "./fake.js"\nline 3\n`'
+  const output = stripStringContents(input)
+  assert.equal(output.length, input.length)
+  // Inner `import` gone
+  assert.not.match(output, /import\s+x/)
+  // Newlines preserved so line numbers still line up
+  assert.equal((output.match(/\n/g) || []).length, 3)
+})
+
+test('stripStringContents — adjacent strings on one line are matched independently', () => {
+  // `'import' + ' from ' + '"./fake"'` — three separate strings.
+  // Only the first contains the `import` keyword, so only it is blanked.
+  const input = `const x = 'import' + ' from ' + '"./fake.js"'`
+  const output = stripStringContents(input)
+  assert.equal(output.length, input.length)
+  // The middle string ` from ` and last string `"./fake.js"` are preserved
+  assert.ok(output.includes("' from '"))
+  assert.ok(output.includes(`'"./fake.js"'`))
+})
+
+test('stripStringContents — tagged template literals are still blanked', () => {
+  // `String.raw\`<div>import fakeTagged from './fake.js'</div>\`` — the
+  // backtick portion is a template literal regardless of the tag prefix.
+  const input = "const html = String.raw`<div>import fakeTagged from './fake.js'</div>`"
+  const output = stripStringContents(input)
+  assert.equal(output.length, input.length)
+  assert.not.match(output, /import\s+fakeTagged/)
+  // The tag identifier `String.raw` must survive
+  assert.ok(output.includes('String.raw'))
+})
+
+test('stripStringContents — preserves :// URL strings (they have no code keywords)', () => {
+  const input = `const url = 'https://npmjs.com/package/import-utils'`
+  // Note: `import-utils` contains `import` followed by `-` (non-word).
+  // `\bimport\b` matches at that boundary, so the body IS blanked. This is
+  // a conservative blanking but it's harmless — we don't try to extract
+  // from inside the URL string anyway.
+  const output = stripStringContents(input)
+  assert.equal(output.length, input.length)
+})
+
+test('stripStringContents — neutralizes // inside code-bearing strings so stripComments cannot eat them', () => {
+  // For strings whose bodies DO trigger the heuristic (contain import/export
+  // etc.), the body becomes spaces and any `//` or `/* */` inside is gone
+  // before stripComments runs. Result: the surrounding code is preserved.
+  // Strings WITHOUT those keywords still hit the pre-existing `stripComments`
+  // limitation, which is outside the scope of this helper.
+  const input = `const x = "// import fakeCmt from './fake.js'"\nconst y = 1`
+  const after = stripComments(stripStringContents(input))
+  // The outer quoted-string structure must remain intact — `stripComments`
+  // would have eaten from `//` to end of line if we hadn't blanked first.
+  assert.ok(after.startsWith('const x = "'), 'opening of the string survives')
+  assert.ok(after.includes('"\nconst y = 1'), 'closing quote and following code survive')
+})
+
+test.run()