webpack 5.108.4 → 5.109.1

package/lib/asset/AssetGenerator.js

@@ -23,7 +23,10 @@ const {
 	JAVASCRIPT_TYPES,
 	NO_TYPES
 } = require("../ModuleSourceTypeConstants");
-const { ASSET_MODULE_TYPE } = require("../ModuleTypeConstants");
+const {
+	ASSET_MODULE_TYPE,
+	ASSET_MODULE_TYPE_WEBMANIFEST
+} = require("../ModuleTypeConstants");
 const RuntimeGlobals = require("../RuntimeGlobals");
 const createHash = require("../util/createHash");
 const { makePathsRelative } = require("../util/identifier");
@@ -45,6 +48,7 @@ const getMimeTypes = memoize(() => require("../util/mimeTypes"));
 /** @typedef {import("../../declarations/WebpackOptions").AssetResourceGeneratorOptions} AssetResourceGeneratorOptions */
 /** @typedef {import("../../declarations/WebpackOptions").RawPublicPath} RawPublicPath */
 /** @typedef {import("../ChunkGraph")} ChunkGraph */
+/** @typedef {import("../Compilation")} Compilation */
 /** @typedef {import("../Compilation").AssetInfo} AssetInfo */
 /** @typedef {import("../Generator").GenerateContext} GenerateContext */
 /** @typedef {import("../Generator").UpdateHashContext} UpdateHashContext */
@@ -56,12 +60,28 @@ const getMimeTypes = memoize(() => require("../util/mimeTypes"));
 /** @typedef {import("../Module").SourceTypes} SourceTypes */
 /** @typedef {import("../ModuleGraph")} ModuleGraph */
 /** @typedef {import("../NormalModule")} NormalModule */
+/** @typedef {import("../dependencies/URLDependency")} URLDependency */
 /** @typedef {import("../RuntimeTemplate")} RuntimeTemplate */
 /** @typedef {import("../util/Hash")} Hash */
 /** @typedef {import("../util/runtime").RuntimeSpec} RuntimeSpec */
 
 /** @typedef {(source: string | Buffer, context: { filename: string, module: Module }) => string} DataUrlFunction */
 
+// slash separating a module type from its subtype (`css/auto` -> `css`)
+const TYPE_SEPARATOR_CHAR_CODE = 47;
+
+/**
+ * Whether a module type's prefix (the part before `/`) equals `prefix`, without
+ * allocating the substring `type.split("/")[0]` would produce.
+ * @param {string} type module type (e.g. `javascript/auto`)
+ * @param {string} prefix expected prefix (e.g. `javascript`)
+ * @returns {boolean} whether the type's prefix equals `prefix`
+ */
+const typePrefixEquals = (type, prefix) =>
+	type.startsWith(prefix) &&
+	(type.length === prefix.length ||
+		type.charCodeAt(prefix.length) === TYPE_SEPARATOR_CHAR_CODE);
+
 /**
  * Merges maybe arrays.
  * @template T
@@ -156,14 +176,10 @@ const encodeDataUri = (encoding, source) => {
 		case false: {
 			const content = source.source();
 
-			if (typeof content !== "string") {
-				encodedContent = content.toString("utf8");
-			}
+			encodedContent =
+				typeof content === "string" ? content : content.toString("utf8");
 
-			encodedContent = encodeURIComponent(
-				/** @type {string} */
-				(encodedContent)
-			).replace(
+			encodedContent = encodeURIComponent(encodedContent).replace(
 				/[!'()*]/g,
 				(character) =>
 					`%${/** @type {number} */ (character.codePointAt(0)).toString(16)}`
@@ -192,9 +208,9 @@ const decodeDataUriContent = (encoding, content) => {
 
 	// If we can't decode return the original body
 	try {
-		return Buffer.from(decodeURIComponent(content), "ascii");
+		return Buffer.from(decodeURIComponent(content), "utf8");
 	} catch (_) {
-		return Buffer.from(content, "ascii");
+		return Buffer.from(content, "utf8");
 	}
 };
 
@@ -209,6 +225,7 @@ class AssetGenerator extends Generator {
 	 * @param {RawPublicPath=} publicPath override for output.assetModulePublicPath
 	 * @param {AssetModuleOutputPath=} outputPath the output path for the emitted file which is not included in the runtime import
 	 * @param {boolean=} emit generate output asset
+	 * @param {Compilation=} compilation the compilation (`getTypes` has no generate context, so the analyzable-output decision reads `output.module`/`output.publicPath` from here)
 	 */
 	constructor(
 		moduleGraph,
@@ -216,7 +233,8 @@ class AssetGenerator extends Generator {
 		filename,
 		publicPath,
 		outputPath,
-		emit
+		emit,
+		compilation
 	) {
 		super();
 		/** @type {AssetGeneratorOptions["dataUrl"] | undefined} */
@@ -229,6 +247,8 @@ class AssetGenerator extends Generator {
 		this.outputPath = outputPath;
 		/** @type {boolean | undefined} */
 		this.emit = emit;
+		/** @type {Compilation | undefined} */
+		this._compilation = compilation;
 		/** @type {ModuleGraph} */
 		this._moduleGraph = moduleGraph;
 	}
@@ -697,36 +717,101 @@ class AssetGenerator extends Generator {
 		}
 	}
 
+	/**
+	 * Returns whether the effective publicPath yields a chunk-independent absolute
+	 * url (scheme-relative, protocol-absolute, or root-absolute) with no hash tokens.
+	 * Only then is a `new URL` literal correct for every chunk the asset is shared by,
+	 * so the `module.exports` wrapper can be dropped in favor of the `asset-url` type.
+	 * @returns {boolean} true when the publicPath is a token-free absolute string
+	 */
+	_hasAbsolutePublicPath() {
+		const publicPath =
+			this.publicPath !== undefined
+				? this.publicPath
+				: this._compilation && this._compilation.outputOptions.publicPath;
+		return (
+			typeof publicPath === "string" &&
+			!publicPath.includes("[") &&
+			(publicPath.startsWith("/") ||
+				/^[a-z][a-z\d+\-.]*:\/\//i.test(publicPath))
+		);
+	}
+
 	/**
 	 * Returns the source types available for this module.
 	 * @param {NormalModule} module fresh module
 	 * @returns {SourceTypes} available types (do not mutate)
 	 */
 	getTypes(module) {
-		/** @type {Set<string>} */
-		const sourceTypes = new Set();
 		const connections = this._moduleGraph.getIncomingConnections(module);
 
+		// Only ESM output can drop a bare `new URL()` to an analyzable asset-url; without
+		// it every JS consumer needs the wrapper, so skip the per-connection dependency
+		// probe entirely and keep the pre-existing cheap path.
+		const isModule = Boolean(
+			this._compilation && this._compilation.outputOptions.module
+		);
+
+		// Collapse the incoming origin types into flags instead of a Set of prefixes:
+		// on assets shared by many modules this loop runs millions of times, so avoid
+		// the per-connection `split("/")` allocation and stop early when the result is fixed.
+		let hasOrigin = false;
+		// JS origin that needs the `module.exports = …` wrapper (not a `new URL` ref).
+		let hasOtherJs = false;
+		// JS origin via `new URL(…, import.meta.url)` — droppable to `asset-url` in ESM.
+		let hasUrlJs = false;
+		// A manifest embeds a bare URL string (like css/html), so its icons must
+		// resolve to `ASSET_URL_TYPE` rather than the JS runtime form.
+		let hasUrl = false;
 		for (const connection of connections) {
-			if (!connection.originModule) {
+			const originModule = connection.originModule;
+			if (!originModule) {
 				continue;
 			}
-
-			sourceTypes.add(connection.originModule.type.split("/")[0]);
+			hasOrigin = true;
+			const originType = originModule.type;
+			if (originType === ASSET_MODULE_TYPE_WEBMANIFEST) {
+				hasUrl = true;
+			} else if (typePrefixEquals(originType, JAVASCRIPT_TYPE)) {
+				// Only a bare `new URL()` becomes the analyzable literal; relative and
+				// prefetch/preload refs keep the runtime form and still need the wrapper.
+				const dependency = isModule && connection.dependency;
+				if (
+					dependency &&
+					dependency.type === "new URL()" &&
+					!(/** @type {URLDependency} */ (dependency).relative) &&
+					!(/** @type {URLDependency} */ (dependency).prefetch) &&
+					!(/** @type {URLDependency} */ (dependency).preload)
+				) {
+					hasUrlJs = true;
+				} else {
+					hasOtherJs = true;
+				}
+			} else if (
+				typePrefixEquals(originType, CSS_TYPE) ||
+				typePrefixEquals(originType, HTML_TYPE)
+			) {
+				hasUrl = true;
+			}
+			// Once a non-URL JS consumer and a url consumer coexist the result is fixed.
+			if (hasOtherJs && hasUrl) break;
 		}
 
+		const jsAsAssetUrl =
+			isModule && hasUrlJs && !hasOtherJs && this._hasAbsolutePublicPath();
+		// JS wrapper is needed for non-URL JS consumers, or URL consumers not dropped to asset-url.
+		const wantJs = hasOtherJs || (hasUrlJs && !jsAsAssetUrl);
+		const wantUrl = hasUrl || jsAsAssetUrl;
+
 		if (
 			(module.buildInfo &&
 				/** @type {AssetModuleBuildInfo} */ (module.buildInfo).dataUrl) ||
 			this.emit === false
 		) {
-			if (sourceTypes.size > 0) {
-				if (
-					sourceTypes.has(JAVASCRIPT_TYPE) &&
-					(sourceTypes.has(CSS_TYPE) || sourceTypes.has(HTML_TYPE))
-				) {
+			if (hasOrigin) {
+				if (wantJs && wantUrl) {
 					return JAVASCRIPT_AND_ASSET_URL_TYPES;
-				} else if (sourceTypes.has(CSS_TYPE) || sourceTypes.has(HTML_TYPE)) {
+				} else if (wantUrl) {
 					return ASSET_URL_TYPES;
 				}
 				return JAVASCRIPT_TYPES;
@@ -735,13 +820,10 @@ class AssetGenerator extends Generator {
 			return NO_TYPES;
 		}
 
-		if (sourceTypes.size > 0) {
-			if (
-				sourceTypes.has(JAVASCRIPT_TYPE) &&
-				(sourceTypes.has(CSS_TYPE) || sourceTypes.has(HTML_TYPE))
-			) {
+		if (hasOrigin) {
+			if (wantJs && wantUrl) {
 				return ASSET_AND_JAVASCRIPT_AND_ASSET_URL_TYPES;
-			} else if (sourceTypes.has(CSS_TYPE) || sourceTypes.has(HTML_TYPE)) {
+			} else if (wantUrl) {
 				return ASSET_AND_ASSET_URL_TYPES;
 			}
 			return ASSET_AND_JAVASCRIPT_TYPES;

package/lib/asset/AssetModulesPlugin.js

@@ -5,15 +5,21 @@
 
 "use strict";
 
+const { RawSource } = require("webpack-sources");
+const HotUpdateChunk = require("../HotUpdateChunk");
 const {
 	ASSET_MODULE_TYPE,
 	ASSET_MODULE_TYPE_BYTES,
 	ASSET_MODULE_TYPE_INLINE,
 	ASSET_MODULE_TYPE_RESOURCE,
-	ASSET_MODULE_TYPE_SOURCE
+	ASSET_MODULE_TYPE_SOURCE,
+	ASSET_MODULE_TYPE_WEBMANIFEST
 } = require("../ModuleTypeConstants");
 const { compareModulesByFullName } = require("../util/comparators");
+const createHash = require("../util/createHash");
+const { getUndoPath } = require("../util/identifier");
 const memoize = require("../util/memoize");
+const { PUBLIC_PATH_AUTO } = require("../util/publicPathPlaceholder");
 
 /** @typedef {import("webpack-sources").Source} Source */
 /** @typedef {import("schema-utils").Schema} Schema */
@@ -57,8 +63,14 @@ const getAssetSourceGenerator = memoize(() =>
 );
 const getAssetBytesGenerator = memoize(() => require("./AssetBytesGenerator"));
 const getAssetModule = memoize(() => require("./AssetModule"));
+const getWebManifestParser = memoize(() => require("./WebManifestParser"));
+const getWebManifestGenerator = memoize(() =>
+	require("./WebManifestGenerator")
+);
 
 const type = ASSET_MODULE_TYPE;
+// Source type produced by `WebManifestGenerator` (its emitted, rewritten JSON).
+const WEBMANIFEST_SOURCE_TYPE = "webmanifest";
 const PLUGIN_NAME = "AssetModulesPlugin";
 
 /**
@@ -240,7 +252,8 @@ class AssetModulesPlugin {
 								filename,
 								publicPath,
 								outputPath,
-								generatorOptions.emit !== false
+								generatorOptions.emit !== false,
+								compilation
 							);
 						});
 				}
@@ -353,6 +366,83 @@ class AssetModulesPlugin {
 					return result;
 				});
 
+				// A Web App Manifest (`asset/webmanifest`, gated on `experiments.html`)
+				// parses/emits like an asset, but its icon URLs are rewritten in place
+				// and the emitted file needs its own per-file public-path resolution.
+				if (compilation.options.experiments.html) {
+					normalModuleFactory.hooks.createParser
+						.for(ASSET_MODULE_TYPE_WEBMANIFEST)
+						.tap(PLUGIN_NAME, () => {
+							const WebManifestParser = getWebManifestParser();
+
+							return new WebManifestParser();
+						});
+					normalModuleFactory.hooks.createGenerator
+						.for(ASSET_MODULE_TYPE_WEBMANIFEST)
+						.tap(PLUGIN_NAME, () => {
+							const WebManifestGenerator = getWebManifestGenerator();
+
+							return new WebManifestGenerator(compilation.moduleGraph);
+						});
+
+					compilation.hooks.renderManifest.tap(
+						PLUGIN_NAME,
+						(result, options) => {
+							const { chunk, codeGenerationResults } = options;
+							if (chunk instanceof HotUpdateChunk) return result;
+							const { chunkGraph, outputOptions } = compilation;
+							const modules =
+								chunkGraph.getOrderedChunkModulesIterableBySourceType(
+									chunk,
+									WEBMANIFEST_SOURCE_TYPE,
+									compareModulesByFullName(compilation.compiler)
+								);
+							if (!modules) return result;
+							for (const module of modules) {
+								const codeGenResult = codeGenerationResults.get(
+									module,
+									chunk.runtime
+								);
+								const source = codeGenResult.sources.get(
+									WEBMANIFEST_SOURCE_TYPE
+								);
+								if (!source) continue;
+								const filename = /** @type {string} */ (
+									codeGenResult.data && codeGenResult.data.get("filename")
+								);
+								if (!filename) continue;
+								// Icon URLs resolve relative to the manifest's own location.
+								const undoPath = getUndoPath(
+									filename,
+									/** @type {string} */ (outputOptions.path),
+									false
+								);
+								const content = source
+									.source()
+									.toString()
+									.split(PUBLIC_PATH_AUTO)
+									.join(undoPath);
+								const hash = createHash(outputOptions.hashFunction || "md4");
+								hash.update(content);
+								const contentHash = /** @type {string} */ (
+									hash.digest(outputOptions.hashDigest || "hex")
+								).slice(0, outputOptions.hashDigestLength || 20);
+								result.push({
+									render: () => new RawSource(content),
+									filename,
+									info: { immutable: true },
+									auxiliary: true,
+									identifier: `webManifestModule${chunkGraph.getModuleId(
+										module
+									)}|${filename}`,
+									hash: contentHash
+								});
+							}
+							return result;
+						}
+					);
+				}
+
 				compilation.hooks.prepareModuleExecution.tap(
 					PLUGIN_NAME,
 					(options, context) => {

package/lib/asset/WebManifestGenerator.js

@@ -0,0 +1,164 @@
+/*
+	MIT License http://www.opensource.org/licenses/mit-license.php
+	Author Alexander Akait @alexander-akait
+*/
+
+"use strict";
+
+const { RawSource, ReplaceSource } = require("webpack-sources");
+const { ASSET_URL_TYPE } = require("../ModuleSourceTypeConstants");
+const createHash = require("../util/createHash");
+const nonNumericOnlyHash = require("../util/nonNumericOnlyHash");
+const { PUBLIC_PATH_AUTO } = require("../util/publicPathPlaceholder");
+const AssetGenerator = require("./AssetGenerator");
+
+/** @typedef {import("webpack-sources").Source} Source */
+/** @typedef {import("../CodeGenerationResults")} CodeGenerationResults */
+/** @typedef {import("../Compilation").DependencyConstructor} DependencyConstructor */
+/** @typedef {import("../Dependency")} Dependency */
+/** @typedef {import("../DependencyTemplate").DependencyTemplateContext} DependencyTemplateContext */
+/** @typedef {import("../Generator").GenerateContext} GenerateContext */
+/** @typedef {import("../Module").SourceType} SourceType */
+/** @typedef {import("../Module").SourceTypes} SourceTypes */
+/** @typedef {import("../ModuleGraph")} ModuleGraph */
+/** @typedef {import("../NormalModule")} NormalModule */
+
+const WEBMANIFEST_TYPE = "webmanifest";
+const WEBMANIFEST_TYPES = new Set([WEBMANIFEST_TYPE]);
+const WEBMANIFEST_AND_ASSET_URL_TYPES = new Set([
+	WEBMANIFEST_TYPE,
+	ASSET_URL_TYPE
+]);
+
+/**
+ * A Web App Manifest is a "typed asset": a variant of `AssetGenerator` (reusing
+ * its filename/hash and `ASSET_URL_TYPE` machinery) whose emitted content is the
+ * raw JSON with each icon `src` rewritten to its bundled asset URL. The manifest
+ * itself is emitted — with its own URL exposed to the referencing
+ * `<link rel="manifest">` — by `AssetModulesPlugin`'s `renderManifest`, which
+ * resolves the per-file public path (like the CSS/HTML plugins).
+ */
+class WebManifestGenerator extends AssetGenerator {
+	/**
+	 * @param {ModuleGraph} moduleGraph the module graph
+	 */
+	constructor(moduleGraph) {
+		super(moduleGraph, undefined, undefined, undefined, undefined, true);
+	}
+
+	/**
+	 * Returns the source types available for this module.
+	 * @param {NormalModule} module fresh module
+	 * @returns {SourceTypes} available types (do not mutate)
+	 */
+	getTypes(module) {
+		// Expose the manifest's own URL only when it is referenced (from HTML).
+		const connections = this._moduleGraph.getIncomingConnections(module);
+		const referenced = !connections[Symbol.iterator]().next().done;
+		return referenced ? WEBMANIFEST_AND_ASSET_URL_TYPES : WEBMANIFEST_TYPES;
+	}
+
+	/**
+	 * Returns the estimated size for the requested source type.
+	 * @param {NormalModule} module the module
+	 * @param {SourceType=} type source type
+	 * @returns {number} estimate size of the module
+	 */
+	getSize(module, type) {
+		const originalSource = module.originalSource();
+		return originalSource ? originalSource.size() : 0;
+	}
+
+	/**
+	 * Rewrites each icon `src` in the raw manifest to its emitted asset URL.
+	 * @param {NormalModule} module the manifest module
+	 * @param {GenerateContext} generateContext context for generate
+	 * @returns {string} the rewritten manifest content
+	 */
+	_rewrite(module, generateContext) {
+		const originalSource = /** @type {Source} */ (module.originalSource());
+		const source = new ReplaceSource(originalSource);
+		// `HtmlSourceDependency.Template` only reads `moduleGraph`/`runtimeTemplate`/
+		// `codeGenerationResults`; the rest is filled to satisfy the context shape.
+		/** @type {DependencyTemplateContext} */
+		const templateContext = {
+			runtimeTemplate: generateContext.runtimeTemplate,
+			dependencyTemplates: generateContext.dependencyTemplates,
+			moduleGraph: generateContext.moduleGraph,
+			chunkGraph: generateContext.chunkGraph,
+			module,
+			runtime: generateContext.runtime,
+			runtimeRequirements: generateContext.runtimeRequirements,
+			concatenationScope: generateContext.concatenationScope,
+			codeGenerationResults:
+				/** @type {CodeGenerationResults} */
+				(generateContext.codeGenerationResults),
+			initFragments: [],
+			chunkInitFragments: []
+		};
+		for (const dependency of module.dependencies) {
+			const constructor = /** @type {DependencyConstructor} */ (
+				dependency.constructor
+			);
+			const template = templateContext.dependencyTemplates.get(constructor);
+			if (!template) {
+				throw new Error(
+					`No template for dependency: ${dependency.constructor.name}`
+				);
+			}
+			template.apply(dependency, source, templateContext);
+		}
+		return /** @type {string} */ (source.source());
+	}
+
+	/**
+	 * Generates generated code for this runtime module.
+	 * @param {NormalModule} module module for which the code should be generated
+	 * @param {GenerateContext} generateContext context for generate
+	 * @returns {Source | null} generated code
+	 */
+	generate(module, generateContext) {
+		if (!module.originalSource()) return new RawSource("");
+
+		const { type, getData } = generateContext;
+		const content = this._rewrite(module, generateContext);
+
+		// Hash the *rewritten* content (so the filename tracks the icons) and reuse
+		// the asset filename machinery, so a plain (icon-less) manifest emits like a
+		// plain asset (`output.assetModuleFilename`, `[name]`, `[ext]`).
+		const outputOptions = generateContext.runtimeTemplate.outputOptions;
+		const hash = createHash(outputOptions.hashFunction);
+		if (outputOptions.hashSalt) hash.update(outputOptions.hashSalt);
+		hash.update(content);
+		const fullContentHash = /** @type {string} */ (
+			hash.digest(outputOptions.hashDigest)
+		);
+		const contentHash = nonNumericOnlyHash(
+			fullContentHash,
+			/** @type {number} */ (outputOptions.hashDigestLength)
+		);
+		const { filename, assetInfo } = AssetGenerator.getFilenameWithInfo(
+			module,
+			{ filename: undefined, outputPath: undefined },
+			generateContext,
+			contentHash,
+			fullContentHash
+		);
+
+		const data = getData ? getData() : undefined;
+		if (data) {
+			data.set("filename", filename);
+			data.set("assetInfo", assetInfo);
+			if (type === ASSET_URL_TYPE) {
+				data.set("url", {
+					...data.get("url"),
+					[ASSET_URL_TYPE]: PUBLIC_PATH_AUTO + filename
+				});
+			}
+		}
+
+		return type === ASSET_URL_TYPE ? null : new RawSource(content);
+	}
+}
+
+module.exports = WebManifestGenerator;

package/lib/asset/WebManifestParser.js

@@ -0,0 +1,130 @@
+/*
+	MIT License http://www.opensource.org/licenses/mit-license.php
+	Author Alexander Akait @alexander-akait
+*/
+
+"use strict";
+
+const { parse } = require("acorn");
+const Parser = require("../Parser");
+const HtmlSourceDependency = require("../dependencies/HtmlSourceDependency");
+
+/** @typedef {import("estree").Expression} Expression */
+/** @typedef {import("estree").ObjectExpression} ObjectExpression */
+/** @typedef {import("estree").Program} Program */
+/** @typedef {import("estree").Property} Property */
+/** @typedef {import("../Module").BuildInfo} BuildInfo */
+/** @typedef {import("../Parser").ParserState} ParserState */
+/** @typedef {import("../Parser").PreparsedAst} PreparsedAst */
+
+// acorn decorates every node with numeric source offsets (absent from the estree types).
+/** @typedef {{ start: number, end: number }} Positioned */
+
+// A URL carrying its own scheme (`https:`, `data:`, …) is external; it is only
+// bundled when `experiments.buildHttp` is enabled (like an absolute URL in HTML).
+const ABSOLUTE_URL_SCHEME_REGEXP = /^[a-zA-Z][a-zA-Z\d+\-.]*:/;
+// Manifest members whose array items carry an asset `src` (`icons[].src`,
+// `screenshots[].src`, and `shortcuts[].icons[].src` — the last nests under `icons`).
+const ICON_CONTAINER_KEYS = new Set(["icons", "screenshots"]);
+
+/**
+ * Parses a Web App Manifest (`.webmanifest`) so its icon/screenshot `src`
+ * URLs are bundled as assets. Reuses acorn (JSON is a valid JS expression
+ * literal) to recover the exact source offsets, then emits an
+ * `HtmlSourceDependency` per URL so the generator can rewrite it in place.
+ */
+class WebManifestParser extends Parser {
+	/**
+	 * Parses the provided source and updates the parser state.
+	 * @param {string | Buffer | PreparsedAst} source the source to parse
+	 * @param {ParserState} state the parser state
+	 * @returns {ParserState} the parser state
+	 */
+	parse(source, state) {
+		if (Buffer.isBuffer(source)) {
+			source = source.toString("utf8");
+		} else if (typeof source === "object") {
+			throw new Error("webpackAst is unexpected for the WebManifestParser");
+		}
+		if (source[0] === "") {
+			source = source.slice(1);
+		}
+
+		const module = state.module;
+		// Without `buildHttp` there is no handler to fetch remote icons, so an
+		// absolute URL is left as-is rather than rewritten to an ignored asset.
+		const buildHttp = Boolean(state.options.experiments.buildHttp);
+
+		/** @type {Program | undefined} */
+		let ast;
+		try {
+			// Wrap in parens so the top-level object is an expression, not a block.
+			ast = /** @type {Program} */ (
+				/** @type {unknown} */ (parse(`(${source})`, { ecmaVersion: "latest" }))
+			);
+		} catch (_err) {
+			// Not valid JSON — leave the file untouched (still emitted as-is).
+			ast = undefined;
+		}
+
+		const statement = ast && ast.body[0];
+		if (
+			statement &&
+			statement.type === "ExpressionStatement" &&
+			statement.expression.type === "ObjectExpression"
+		) {
+			/**
+			 * @param {ObjectExpression} obj object expression node
+			 * @param {string | undefined} parentKey key of the array/object this node sits in
+			 */
+			const walk = (obj, parentKey) => {
+				for (const prop of obj.properties) {
+					if (prop.type !== "Property") continue;
+					const key =
+						prop.key.type === "Literal" && typeof prop.key.value === "string"
+							? prop.key.value
+							: prop.key.type === "Identifier"
+								? prop.key.name
+								: undefined;
+					const value = /** @type {Expression} */ (prop.value);
+					if (value.type === "ObjectExpression") {
+						walk(value, key);
+					} else if (value.type === "ArrayExpression") {
+						for (const element of value.elements) {
+							if (element && element.type === "ObjectExpression") {
+								walk(element, key);
+							}
+						}
+					} else if (
+						key === "src" &&
+						value.type === "Literal" &&
+						typeof value.value === "string" &&
+						parentKey !== undefined &&
+						ICON_CONTAINER_KEYS.has(parentKey)
+					) {
+						const url = value.value;
+						// Fragment-only refs aren't assets; absolute URLs need `buildHttp`.
+						if (!url || url.startsWith("#")) continue;
+						if (!buildHttp && ABSOLUTE_URL_SCHEME_REGEXP.test(url)) continue;
+						// acorn offsets are into `(${source})`; the leading `(` and the
+						// opening quote cancel, so the inner span is [start, end - 2].
+						const { start, end } = /** @type {Positioned} */ (
+							/** @type {unknown} */ (value)
+						);
+						const dep = new HtmlSourceDependency(url, [start, end - 2]);
+						module.addDependency(dep);
+						module.addCodeGenerationDependency(dep);
+					}
+				}
+			};
+			walk(statement.expression, undefined);
+		}
+
+		/** @type {BuildInfo} */
+		(state.module.buildInfo).strict = true;
+
+		return state;
+	}
+}
+
+module.exports = WebManifestParser;