@davidwells/extract-deps 0.1.9 → 0.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidwells/extract-deps",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Get imports and requires from a codebase without AST",
   "main": "src/index.js",
   "exports": {

package/src/get-cjs-exports.js

@@ -1,6 +1,6 @@
 // Extracts CommonJS module.exports and exports patterns from JavaScript code
 
-const { getNames, extractExportName, stripStringContents } = require('./utils')
+const { getNames, extractExportName, stripCommentsAndStrings } = require('./utils')
 
 // Matches: module.exports = ... or exports = module.exports = ...
 // https://regex101.com/r/example/cjs-1
@@ -35,13 +35,11 @@ function stripComments(code) {
 }
 
 function getCjsExports(code) {
-  // Blank string/template literal contents before stripping comments so
-  // `exports.X = ...` lines embedded inside template literals aren't matched
-  // as real exports, and so the comment regex doesn't mis-strip `//` inside
-  // string bodies.
-  code = stripStringContents(code)
-  // Strip comments to prevent false positives from commented code
-  const sanitizedCode = stripComments(code)
+  // Single tokenizer-based pass that blanks comments and code-bearing
+  // strings/templates together. Length is preserved so the position-based
+  // logic below (which slices into the original `code` for full export
+  // values) keeps working off the same indices.
+  const sanitizedCode = stripCommentsAndStrings(code)
 
   const assignmentExports = getModuleExportsAssignment(code, sanitizedCode)
   const modulePropertyExports = getModuleExportsProperty(code, sanitizedCode)

package/src/get-exports.js

@@ -16,12 +16,12 @@ const EXPORT_TYPE_REGEX = /export\s+(?:type|interface)\s+([\w$]+)/gm
 const EXPORT_ASSERTION_REGEX = /export\s+(?:["'\s]*([\w*{}\n\r\t, ]+)from\s*)?["'\s](.*[@\w_-]+)["'\s]+(assert|with)\s*\{([^}]+)\};?$/gm
 
 function getExports(code = '', options = {}) {
-  // Blank string/template contents first so embedded `export` keywords inside
-  // string literals don't get parsed as real exports, and so `stripComments`
-  // doesn't mis-strip `//` or `/* */` that appear inside strings.
-  code = stripStringContents(code)
-  // Strip comments to avoid false positives
+  // Comments first, then strings — order matters. Running stripStringContents
+  // alone would mis-pair an apostrophe inside a JSDoc comment (`Netlify's …`)
+  // with a later quote and shift subsequent backtick pairing, which could
+  // swallow real `export` declarations a few lines later.
   code = stripComments(code)
+  code = stripStringContents(code)
   const defaultExports = getDefaultExports(code)
   const namedExports = getNamedExports(code)
   const namedDeclarationExports = getNamedDeclarationExports(code)

package/src/get-imports.js

@@ -37,13 +37,12 @@ const DYNAMIC_IMPORT_REGEX = /(?:(const|var|let)\s+([\w*{}\n\r\t,:= $]+)\s*=\s*)
 const ASSERTION_IMPORT_REGEX = /(?:^|\n)\s*import\s+(?:["'\s]*([\w*{}\n\r\t, $]+)from\s*)?["'\s]+([^"'`\n;\s]+)\s*["']\s+(assert|with)\s*\{([^}]+)\}/gm
 
 function getImports(code = '', options = {}) {
-  // Blank string/template contents first so the comment stripper doesn't
-  // mis-strip `//` or `/* */` sequences inside literals, and so the regex
-  // doesn't pick up `import`/`export` keywords that appear inside strings
-  // (e.g. fenced code in JSDoc-style template literals).
-  code = stripStringContents(code)
-  // Strip comments to avoid false positives
+  // Strip comments FIRST so apostrophes/backticks inside JSDoc text get
+  // removed before `stripStringContents` looks for string literals.
+  // (Running the two in the opposite order let comment chars masquerade as
+  // string openers and swallow real `import`/`export` lines further down.)
   code = stripComments(code)
+  code = stripStringContents(code)
   const staticImports = getStaticImports(code)
   const dynamicImports = getDynamicImports(code)
   if (options.includeAssertionImports) {

package/src/get-requires.js

@@ -65,11 +65,12 @@ function getStaticRequires(targetText = '') {
 }
 
 function getRequires(code) {
-  // Blank string/template contents first so `require()` calls embedded in
-  // string literals (e.g. fenced code in template strings) aren't matched as
-  // real requires. Then strip comments so `// require('./fake')` is ignored.
-  code = stripStringContents(code)
+  // Strip comments first, then strings — order matters. `stripComments`
+  // alone would mis-eat `//` inside strings; running it first instead means
+  // comment chars (incl. apostrophes/backticks inside JSDoc) disappear
+  // before `stripStringContents` looks for real string literals.
   code = stripComments(code)
+  code = stripStringContents(code)
   const staticRequires = getStaticRequires(code)
   const dynamicRequires = getDynamicRequires(code)
   return staticRequires.concat(dynamicRequires).sort((a, b) => a.index - b.index)

package/src/utils.js

@@ -63,6 +63,59 @@ function stripStringContents(code) {
   })
 }
 
+// Unified regex matching whichever comes first at each position: block
+// comment, line comment, single-quoted string, double-quoted string, or
+// template literal. Matching left-to-right means a comment that starts
+// first consumes its body — including any apostrophes or backticks inside
+// — before they can start a spurious string match a few lines later. That
+// solves the JSDoc-apostrophe-shifts-backtick-pairing class of bugs that
+// arose when comments and strings were stripped in two separate passes.
+const COMMENT_OR_STRING_RE = /\/\*[\s\S]*?\*\/|\/\/[^\n]*|"(?:[^"\\\n]|\\[\s\S])*"|'(?:[^'\\\n]|\\[\s\S])*'|`(?:[^`\\]|\\[\s\S])*`/g
+
+/**
+ * Single-regex pass that blanks comment bodies and code-bearing
+ * string/template bodies together. Solves two bugs that occurred when the
+ * string-strip and comment-strip ran in separate passes:
+ *
+ *   - Apostrophes inside JSDoc comments (e.g. `* Netlify's \`...`) were
+ *     mis-paired with later quotes, which shifted subsequent backtick
+ *     pairing and could swallow real `export` declarations a few lines
+ *     later in the same file.
+ *   - `//` and `/* *\/` sequences inside string bodies were mis-stripped
+ *     as comments.
+ *
+ * Length is preserved (each consumed char replaced by a space or newline
+ * kept verbatim) so downstream character indices stay valid.
+ *
+ * Strings whose bodies don't reference `import` / `export` / `require` /
+ * `module.exports` pass through unchanged, so module specifiers like
+ * `'lodash'` or `'./foo.js'` stay readable by the downstream regexes.
+ *
+ * Caveat: `${...}` interpolations inside template literals are part of the
+ * body, so `${import('./x.js')}` inside a template gets blanked. Rare in
+ * practice; a full parser would be needed otherwise.
+ *
+ * @param {string} code
+ * @returns {string}
+ */
+function stripCommentsAndStrings(code) {
+  return code.replace(COMMENT_OR_STRING_RE, (match) => {
+    const first = match[0]
+    // Comments (line or block) are fully blanked — they have no extractable
+    // content. Newlines are preserved so line counts hold.
+    if (first === '/') {
+      return match.replace(/[^\n]/g, ' ')
+    }
+    // Strings/templates — only blank if the body references code keywords;
+    // otherwise leave the literal intact so `'lodash'` etc. remain readable.
+    const body = match.slice(1, -1)
+    if (!EMBEDDED_CODE_RE.test(body)) {
+      return match
+    }
+    return first + body.replace(/[^\n]/g, ' ') + first
+  })
+}
+
 /**
  * Strip comments from code, preserving :// in URLs
  * @param {string} code
@@ -292,6 +345,7 @@ function extractExportName(exportValue) {
 module.exports = {
   stripComments,
   stripStringContents,
+  stripCommentsAndStrings,
   isBuiltIn,
   isRelativeImport,
   isRelativeImportWithQuotes,

package/tests/get-exports.test.js

@@ -563,6 +563,41 @@ export const real = 'value' // this comment should be stripped
   assert.equal(foundExports[2].exportName, 'real', 'Should find real export')
 })
 
+test('apostrophe inside JSDoc with surrounding backticks does not swallow later exports', () => {
+  // Regression: when `stripStringContents` ran BEFORE `stripComments`, an
+  // apostrophe inside a JSDoc block (e.g. `Netlify's \`promptType: 'foo'\``)
+  // was treated as the opener of a single-quoted string and consumed text up
+  // to the next `'`, shifting every subsequent backtick pair by one. The
+  // newly mis-paired template literal then spanned multiple lines, including
+  // the real `export async function` declaration that followed the JSDoc,
+  // and the embedded-code heuristic blanked it. The fix runs `stripComments`
+  // first so JSDoc-internal punctuation is gone before string matching.
+  //
+  // This fixture replicates the structural shape of the AWS SDK adapter file
+  // that originally surfaced the bug: a JSDoc block containing both an
+  // apostrophe and multiple backticks, followed by an `export async function`,
+  // followed by ANOTHER JSDoc with backticks.
+  const code = `
+/**
+ * Stuff with \`code-one\`. Netlify's \`promptType: 'foo'\`. End \`Error\` on
+ * non-2xx upstream responses or malformed bodies.
+ */
+export async function generateThing(request) {
+  return request
+}
+/** Test seam: override the global \`fetch\` for unit tests. */
+export const helper = 1
+  `
+
+  const found = getExports(code)
+  const names = found.map(e => e.exportName).sort()
+  assert.equal(
+    names,
+    ['generateThing', 'helper'],
+    'Both exports must survive past the JSDoc apostrophe+backtick combo'
+  )
+})
+
 test('ignores ESM exports embedded in template literals and strings', () => {
   const code = `
 export const real = 'real'