Handle package names with nested paths in import maps

Packages with nested paths (e.g., "photoswipe/lightbox" or
"@github/webauthn-json/browser-ponyfill") were not being correctly
identified, leading to issues when checking for outdated versions. This
update modifies the package name extraction logic to correctly handle
such cases.

Fixes #321,

Author: rafaelfranca

.github/prompts/fix-issue.prompt.md

@@ -1,5 +1,5 @@
 ---
-mode: agent
+agent: agent
 description: 'Fix an issue in the importmap-rails gem by following a systematic process.'
 ---
 # GitHub Issue Fixer Prompt

.github/prompts/generate-commit-message.prompt.md

@@ -1,5 +1,5 @@
 ---
-mode: agent
+agent: agent
 description: 'Generate clear, descriptive commit messages for importmap-rails changes'
 ---
 # Commit Message Generator

lib/importmap/npm.rb

@@ -54,6 +54,10 @@ def packages_with_versions
     with_versions = importmap.scan(/^pin .*(?<=npm:|npm\/|skypack\.dev\/|unpkg\.com\/)([^@\/]+)@(\d+\.\d+\.\d+(?:[^\/\s"']*))/) |
       importmap.scan(/#{PIN_REGEX} #.*@(\d+\.\d+\.\d+(?:[^\s]*)).*$/)
 
+    with_versions.map! do |package, version|
+      [extract_base_package_name(package), version]
+    end.uniq!
+
     vendored_packages_without_version(with_versions).each do |package, path|
       $stdout.puts "Ignoring #{package} (#{path}) since no version is specified in the importmap"
     end
@@ -138,6 +142,17 @@ def post_json(uri, body)
       raise HTTPError, "Unexpected transport error (#{error.class}: #{error.message})"
     end
 
+    def extract_base_package_name(package)
+      if package.start_with?("@")
+        # Scoped packages can have nested paths, e.g. @scope/package/subpath
+        parts = package.split("/", 3)
+        parts.size > 2 ? parts.first(2).join("/") : package
+      else
+        # Non-scoped packages - just take the first part
+        package.split("/").first
+      end
+    end
+
     def vendored_packages_without_version(packages_with_versions)
       versioned_packages = packages_with_versions.map(&:first).to_set
 

test/fixtures/files/nested_package_path_import_map.rb

@@ -0,0 +1,2 @@
+pin "photoswipe/lightbox", to: "https://ga.jspm.io/npm:photoswipe@5.4.4/dist/photoswipe-lightbox.esm.js"
+pin "photoswipe", to: "https://ga.jspm.io/npm:photoswipe@5.4.4/dist/photoswipe.esm.js"

test/fixtures/files/nested_package_with_comment_import_map.rb

@@ -0,0 +1 @@
+pin "photoswipe/lightbox", to: "https://ga.jspm.io/npm:photoswipe@5.4.4/dist/photoswipe-lightbox.esm.js" # @5.4.4

test/fixtures/files/scoped_package_import_map.rb

@@ -0,0 +1 @@
+pin "@github/webauthn-json", to: "https://ga.jspm.io/npm:@github/webauthn-json@2.1.1/dist/esm/webauthn-json.js" # @2.1.1

test/fixtures/files/scoped_package_with_nested_path_import_map.rb

@@ -0,0 +1 @@
+pin "@github/webauthn-json/browser-ponyfill", to: "https://ga.jspm.io/npm:@github/webauthn-json@2.1.1/dist/esm/webauthn-json.browser-ponyfill.js" # @2.1.1

test/npm_test.rb

@@ -46,6 +46,56 @@ class Importmap::NpmTest < ActiveSupport::TestCase
     end
   end
 
+  test "extracts package name and version from nested package path" do
+    npm = Importmap::Npm.new(file_fixture("nested_package_path_import_map.rb"))
+    packages = npm.packages_with_versions
+
+    assert_equal(1, packages.size)
+    assert_equal('photoswipe', packages[0][0])
+    assert_equal('5.4.4', packages[0][1])
+  end
+
+  test "extracts only base package name from nested package path with version comment" do
+    npm = Importmap::Npm.new(file_fixture("nested_package_with_comment_import_map.rb"))
+    packages = npm.packages_with_versions
+
+    assert_equal(1, packages.size)
+    assert_equal('photoswipe', packages[0][0])
+    assert_equal('5.4.4', packages[0][1])
+  end
+
+  test "handles scoped package with nested path" do
+    npm = Importmap::Npm.new(file_fixture("scoped_package_with_nested_path_import_map.rb"))
+    packages = npm.packages_with_versions
+
+    assert_equal(1, packages.size)
+    assert_equal('@github/webauthn-json', packages[0][0])
+    assert_equal('2.1.1', packages[0][1])
+  end
+
+  test "handles regular scoped package without nested path" do
+    npm = Importmap::Npm.new(file_fixture("scoped_package_import_map.rb"))
+    packages = npm.packages_with_versions
+
+    assert_equal(1, packages.size)
+    assert_equal('@github/webauthn-json', packages[0][0])
+    assert_equal('2.1.1', packages[0][1])
+  end
+
+  test "successful outdated packages with nested package path using mock" do
+    npm = Importmap::Npm.new(file_fixture("nested_package_path_import_map.rb"))
+    response = { "dist-tags" => { "latest" => '5.5.0' } }.to_json
+
+    npm.stub(:get_json, response) do
+      outdated_packages = npm.outdated_packages
+
+      assert_equal(1, outdated_packages.size)
+      assert_equal('photoswipe', outdated_packages[0].name)
+      assert_equal('5.4.4', outdated_packages[0].current_version)
+      assert_equal('5.5.0', outdated_packages[0].latest_version)
+    end
+  end
+
   test "warns (and ignores) vendored packages without version" do
     Dir.mktmpdir do |vendor_path|
       foo_path = create_vendored_file(vendor_path, "foo.js")