Commit Graph
8 Commits
Author SHA1 Message Date
haelyra 64fdb301cd Merge PR #3457: validate static carrier dependencies with the maintained TypeScript parser 2026-10-10 17:44:35 -04:00
montjeffrey 5ce12fb9f9 fix(carriers): ignore member calls named require or import, and warn on deeply nested arguments
- Call patterns now skip a require/import preceded by a dot, with or
  without whitespace or optional chaining, so records.require('./label')
  and obj?.import('./x') are method calls rather than module loads.
- Replace the one-level dynamic-argument pattern with a balanced-paren
  scan over the string-free skeleton, so require(path.join(__dirname,
  getName())) and require(a(b(c()))) are reported as dynamic.

Rescanning all 802 repository JavaScript files against the previous head
changes 6 results, each a newly reported dynamic argument nested deeper
than one level (docker eval checks and one test); no specifier or package
result changes. The real registry is unchanged: 35/35 resolved, zero
failures or warnings.
2026-10-09 17:52:55 -04:00
montjeffrey bdb2ceb230 fix(carriers): follow Node's CommonJS candidates, see regex after a block, ignore non-import from
- An extensionless require now tries only the path, .js, .json, and a
  directory's index.js/index.json, as Node does; .cjs and .mjs must be
  named, so require('./helper') no longer passes on helper.cjs alone.
- Treat `}` as a statement boundary, so a regex after a block is read as
  a regex and cannot swallow a later require.
- Decide whether a paren opens a condition from the token before the
  keyword, ignoring whitespace, so `obj.\nif(x) / 2` and
  `obj?. while(x) / 2` stay method calls followed by division.
- Record which slots came from template literals and skip them for
  static `from` and side-effect `import`, which accept only a quoted
  string; a tagged template named `from` is no longer an import.
  A template passed to import() is still a dependency.

Rescanning all 802 repository JavaScript files against dd14493e changes
no result, and the real registry still reports 35/35 resolved with zero
failures or warnings.
2026-10-09 17:48:27 -04:00
montjeffrey fa3f459a93 fix(carriers): resolve imports exactly, reject backslash separators, see regex after a condition
- Track whether each relative specifier arrives through require or
  through import()/static import, and resolve the import forms by exact
  path. Node's ESM resolver adds no extension and rejects directory
  imports even from a CommonJS file, so import('./helper') and
  import('./data') no longer pass on helper.js or data/index.json alone.
  require keeps the CommonJS extension and index candidates.
- Stop normalizing backslashes in relative specifiers. Linux and macOS
  read them as filename characters, so require('./lib\helper.js') now
  fails as non-portable-separator instead of resolving to lib/helper.js.
- Record whether each closing paren ends an if/while/for/with condition,
  so a `/` right after one starts a regex. A method named `if` and calls
  nested inside a condition still read as division.

extractReferences gains an `imports` list. Rescanning all 802 repository
JavaScript files against the previous scanner changes no result, and the
real registry still reports 35/35 resolved with zero failures.
2026-10-09 16:15:55 -04:00
montjeffrey d00b379f70 fix(carriers): keep keyword patterns from spanning an interpolation 2026-10-08 16:49:08 +00:00
montjeffrey 0d3c85bd54 fix(carriers): match spaced calls, cook escapes, treat Windows and file URLs as absolute 2026-10-08 16:48:33 +00:00
montjeffrey 6abf02bb49 feat(carriers): flag absolute and package imports a carrier cannot ship 2026-10-08 15:47:34 +00:00
montjeffrey 840a72b6c1 feat(carriers): validate carrier runtime closure in CI 2026-10-08 15:35:03 +00:00