@ttsc/playground 0.18.3 → 0.19.0

package/src/npm/collectExternalPackageNames.ts

@@ -1,9 +1,6 @@
 import { BUILT_IN_PLAYGROUND_PACKAGES } from "./BUILT_IN_PLAYGROUND_PACKAGES";
 import { packageNameFromSpecifier } from "./packageNameFromSpecifier";
 
-const MODULE_SPECIFIER_REGEXP =
-  /\b(?:import|export)\s+(?:type\s+)?(?:[^"'()]*?\s+from\s*)?["']([^"']+)["']|import\s*\(\s*["']([^"']+)["']\s*\)|require\s*\(\s*["']([^"']+)["']\s*\)/g;
-
 /**
  * Scan `source` for `import` / `require` specifiers and return the unique
  * sorted list of bare npm package names that are not in `ignoredPackages`.
@@ -21,14 +18,270 @@ export function collectExternalPackageNames(
   return [...found].sort();
 }
 
+/**
+ * Collect the string specifiers of every executable module-loading construct in
+ * `source`: `import`/`export ... from`, side-effect `import "x"`, dynamic
+ * `import("x")`, and `require("x")` calls.
+ *
+ * The scan tokenizes `source` first so import/export/require lookalikes that
+ * live inside comments, string or template contents, or regular-expression
+ * literals never become package requests — only real code-level string
+ * arguments are returned. Specifiers that cannot be resolved statically (a
+ * template-literal or computed argument) are intentionally skipped so inert
+ * text cannot drive a network install.
+ */
 function collectModuleSpecifiers(source: string): string[] {
+  const tokens = tokenize(source);
   const out: string[] = [];
-  MODULE_SPECIFIER_REGEXP.lastIndex = 0;
-  for (;;) {
-    const match = MODULE_SPECIFIER_REGEXP.exec(source);
-    if (!match) break;
-    const specifier = match[1] ?? match[2] ?? match[3];
-    if (specifier) out.push(specifier);
+  const asString = (token: Token | undefined): string | null =>
+    token && token.kind === "string" ? token.value : null;
+  const isOpenParen = (token: Token | undefined): boolean =>
+    token !== undefined && token.kind === "punct" && token.value === "(";
+  const isMemberAccess = (token: Token | undefined): boolean =>
+    token !== undefined && token.kind === "punct" && token.value === ".";
+
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (!token || token.kind !== "word") continue;
+
+    if (token.value === "require") {
+      // `obj.require(...)` is an unrelated method call, not CommonJS require.
+      if (isMemberAccess(tokens[i - 1])) continue;
+      if (isOpenParen(tokens[i + 1])) {
+        const spec = asString(tokens[i + 2]);
+        if (spec !== null) out.push(spec);
+      }
+      continue;
+    }
+
+    if (token.value === "import" || token.value === "export") {
+      // `foo.import(...)` / `import.meta` are not module-loading imports.
+      if (token.value === "import" && isMemberAccess(tokens[i - 1])) continue;
+      // Dynamic `import("x")`.
+      if (token.value === "import" && isOpenParen(tokens[i + 1])) {
+        const spec = asString(tokens[i + 2]);
+        if (spec !== null) out.push(spec);
+        continue;
+      }
+      // Side-effect `import "x"`.
+      if (token.value === "import") {
+        const bare = asString(tokens[i + 1]);
+        if (bare !== null) {
+          out.push(bare);
+          continue;
+        }
+      }
+      // `import ... from "x"` / `export ... from "x"`.
+      const spec = findFromSpecifier(tokens, i + 1);
+      if (spec !== null) out.push(spec);
+    }
   }
   return out;
 }
+
+/**
+ * From token index `start`, find the specifier of a `... from "x"` clause,
+ * bounded to the current statement. Stops at a `;` terminator or the start of
+ * another `import`/`export` so a local `export const x = ...` never borrows a
+ * later statement's `from`.
+ */
+function findFromSpecifier(tokens: Token[], start: number): string | null {
+  for (let i = start; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (!token) break;
+    if (token.kind === "punct" && token.value === ";") return null;
+    if (
+      token.kind === "word" &&
+      (token.value === "import" || token.value === "export")
+    )
+      return null;
+    if (token.kind === "word" && token.value === "from") {
+      const next = tokens[i + 1];
+      return next && next.kind === "string" ? next.value : null;
+    }
+  }
+  return null;
+}
+
+type Token =
+  // An identifier or keyword.
+  | { kind: "word"; value: string }
+  // A single- or double-quoted string literal, with escapes decoded to their
+  // literal characters so a specifier survives unchanged.
+  | { kind: "string"; value: string }
+  // A single punctuation character.
+  | { kind: "punct"; value: string }
+  // An opaque value token — number, template literal, or regular-expression
+  // literal — whose contents can never be a static specifier.
+  | { kind: "other" };
+
+// Keywords after which a `/` begins a regular-expression literal rather than a
+// division operator. After any other word (an identifier or value keyword such
+// as `this`), `/` is division.
+const REGEX_PRECEDING_KEYWORDS = new Set([
+  "return",
+  "typeof",
+  "instanceof",
+  "in",
+  "of",
+  "new",
+  "delete",
+  "void",
+  "do",
+  "else",
+  "yield",
+  "await",
+  "case",
+  "throw",
+]);
+
+/**
+ * Lexically tokenize `source` into the coarse token stream the specifier
+ * collector needs. Comments are dropped; strings, templates, regex literals,
+ * and numbers become single tokens so their contents cannot leak into the
+ * grammar match.
+ */
+function tokenize(source: string): Token[] {
+  const tokens: Token[] = [];
+  const n = source.length;
+  const isIdStart = (c: string): boolean =>
+    (c >= "a" && c <= "z") || (c >= "A" && c <= "Z") || c === "_" || c === "$";
+  const isIdPart = (c: string): boolean =>
+    isIdStart(c) || (c >= "0" && c <= "9");
+  const isDigit = (c: string): boolean => c >= "0" && c <= "9";
+
+  // A `/` opens a regex only in operator/statement position — never right after
+  // a value (identifier, number, string, template, regex, `)` or `]`).
+  const regexAllowed = (): boolean => {
+    const prev = tokens[tokens.length - 1];
+    if (!prev) return true;
+    if (prev.kind === "string" || prev.kind === "other") return false;
+    if (prev.kind === "word") return REGEX_PRECEDING_KEYWORDS.has(prev.value);
+    return prev.value !== ")" && prev.value !== "]";
+  };
+
+  let i = 0;
+  while (i < n) {
+    const c = source[i]!;
+    // Whitespace.
+    if (
+      c === " " ||
+      c === "\t" ||
+      c === "\r" ||
+      c === "\n" ||
+      c === "\f" ||
+      c === "\v"
+    ) {
+      i++;
+      continue;
+    }
+    // Line comment.
+    if (c === "/" && source[i + 1] === "/") {
+      i += 2;
+      while (i < n && source[i] !== "\n") i++;
+      continue;
+    }
+    // Block comment.
+    if (c === "/" && source[i + 1] === "*") {
+      i += 2;
+      while (i < n && !(source[i] === "*" && source[i + 1] === "/")) i++;
+      i += 2;
+      continue;
+    }
+    // Regular-expression literal.
+    if (c === "/" && regexAllowed()) {
+      i++;
+      let inClass = false;
+      while (i < n) {
+        const d = source[i];
+        if (d === "\\") {
+          i += 2;
+          continue;
+        }
+        if (d === "\n") break;
+        if (d === "[") inClass = true;
+        else if (d === "]") inClass = false;
+        else if (d === "/" && !inClass) {
+          i++;
+          break;
+        }
+        i++;
+      }
+      while (i < n && isIdPart(source[i]!)) i++; // flags
+      tokens.push({ kind: "other" });
+      continue;
+    }
+    // String literal.
+    if (c === '"' || c === "'") {
+      i++;
+      let value = "";
+      while (i < n) {
+        const d = source[i]!;
+        if (d === "\\") {
+          value += source[i + 1] ?? "";
+          i += 2;
+          continue;
+        }
+        if (d === c) {
+          i++;
+          break;
+        }
+        if (d === "\n") break; // unterminated single-line string
+        value += d;
+        i++;
+      }
+      tokens.push({ kind: "string", value });
+      continue;
+    }
+    // Template literal. Contents (including `${...}` expressions) are treated as
+    // opaque: a template specifier is not statically resolvable.
+    if (c === "`") {
+      i++;
+      let depth = 0;
+      while (i < n) {
+        const d = source[i];
+        if (d === "\\") {
+          i += 2;
+          continue;
+        }
+        if (depth === 0 && d === "`") {
+          i++;
+          break;
+        }
+        if (d === "$" && source[i + 1] === "{") {
+          depth++;
+          i += 2;
+          continue;
+        }
+        if (depth > 0 && d === "}") {
+          depth--;
+          i++;
+          continue;
+        }
+        i++;
+      }
+      tokens.push({ kind: "other" });
+      continue;
+    }
+    // Identifier / keyword.
+    if (isIdStart(c)) {
+      let j = i + 1;
+      while (j < n && isIdPart(source[j]!)) j++;
+      tokens.push({ kind: "word", value: source.slice(i, j) });
+      i = j;
+      continue;
+    }
+    // Numeric literal.
+    if (isDigit(c) || (c === "." && isDigit(source[i + 1] ?? ""))) {
+      let j = i + 1;
+      while (j < n && /[0-9a-fA-FxXoObBeE._]/.test(source[j]!)) j++;
+      tokens.push({ kind: "other" });
+      i = j;
+      continue;
+    }
+    // Single punctuation character.
+    tokens.push({ kind: "punct", value: c });
+    i++;
+  }
+  return tokens;
+}

package/src/sandbox/createSandboxRequire.ts

@@ -64,15 +64,13 @@ export function createSandboxRequire(
       return null;
     }
     if (subpath === null) {
-      // bare "name": honor exports["."] → string, else main, else index.
-      const exportsAny = pj.exports;
-      if (typeof exportsAny === "object" && exportsAny !== null) {
-        const root = (exportsAny as Record<string, unknown>)["."];
-        const r = pickConditionalExport(root);
-        if (r) {
-          const resolved = `${pkg}/${stripDotSlash(r)}`;
-          return has(resolved) ? resolved : null;
-        }
+      // bare "name": honor the root `exports` entry (string, subpath table
+      // "." key, or bare condition map) → CJS target, else main, else index.
+      const root = rootExportTarget(pj.exports);
+      const r = pickConditionalExport(root);
+      if (r) {
+        const resolved = `${pkg}/${stripDotSlash(r)}`;
+        return has(resolved) ? resolved : null;
       }
       if (typeof pj.main === "string") {
         return tryPaths(
@@ -220,6 +218,31 @@ export function createSandboxRequire(
   };
 }
 
+/**
+ * Reduce a `package.json` `exports` field to the value describing its ROOT
+ * (".") entry, ready for {@link pickConditionalExport}. Node accepts three valid
+ * root shapes and they must all resolve consistently:
+ *
+ * - A bare string target — `"exports": "./index.cjs"`;
+ * - A subpath table keyed by "." — `{ ".": <target>, "./sub": ... }`;
+ * - A bare condition map whose keys are all conditions, not subpaths — `{
+ *   "require": "./index.cjs", "default": "./index.cjs" }`.
+ *
+ * Node forbids mixing subpath keys with condition keys, so the presence of any
+ * "."-prefixed key decides the interpretation: a subpath table exposes its root
+ * as `exports["."]`, while a condition map is itself the root target. Returns
+ * null when `exports` is absent, empty, or describes no root entry.
+ */
+function rootExportTarget(exports: unknown): unknown {
+  if (typeof exports === "string") return exports;
+  if (!exports || typeof exports !== "object") return null;
+  const obj = exports as Record<string, unknown>;
+  const keys = Object.keys(obj);
+  if (keys.length === 0) return null;
+  const hasSubpathKey = keys.some((k) => k === "." || k.startsWith("./"));
+  return hasSubpathKey ? obj["."] : obj;
+}
+
 function pickConditionalExport(value: unknown): string | null {
   if (typeof value === "string") return value;
   if (value && typeof value === "object") {