@cplieger/deadset-ts 3.2.0 → 3.3.1

package/dist/src/template-field.js

@@ -0,0 +1,173 @@
+/**
+ * The template-field class: a member is held back, at the lowest confidence, when a
+ * template under a configured template directory writes its name inside an action,
+ * because a template engine reads the member by that name at run time.
+ *
+ * Every file under a configured directory is a template. An action runs from an
+ * opening delimiter to the first closing one after it, at the pair
+ * `analysis.template_delimiters` sets, `{{` and `}}` by default, and each identifier
+ * it writes outside a quoted string is a name it reads: `{{ user.name }}` names `user`
+ * and `name`. A file holding an unclosed action names nothing. A name reaches the
+ * instance members of classes and the members of interfaces and object types, on any
+ * type, because nothing ties the name to a type.
+ */
+import { ConfigError } from "./config.js";
+import { memberNames } from "./member-names.js";
+import { isAbsolutePath, joinPath, normalizePath } from "./paths.js";
+/** The kinds of declaration an action can name. */
+const READ_BY_A_TEMPLATE = new Set([
+    "method",
+    "class-member",
+    "interface-method",
+    "type-member",
+]);
+/** One identifier, as the grammar of the analyzed language spells one. */
+const IDENTIFIER = /[\p{ID_Start}$_][\p{ID_Continue}$\u200C\u200D]*/uy;
+/** Two strings ordered bytewise. */
+function compare(a, b) {
+    if (a === b) {
+        return 0;
+    }
+    return a < b ? -1 : 1;
+}
+/**
+ * Every template under the configured directories, read once for the run, in path
+ * order and each file once. A directory is named relative to the target root, and
+ * one the target does not hold refuses the run as a usage error: the class would
+ * scan nothing, so a name that no longer matches the tree would silently switch the
+ * exemption it was configured for off. A symbolic link to a directory is not
+ * followed.
+ */
+export function readTemplates(host, targetRoot, analysis) {
+    const files = new Map();
+    const read = (dir) => {
+        const entries = [...host.readDirectory(joinPath(targetRoot, dir))].sort((a, b) => compare(a.name, b.name));
+        for (const entry of entries) {
+            const path = joinPath(dir, entry.name);
+            if (entry.directory) {
+                read(path);
+                continue;
+            }
+            const absolute = joinPath(targetRoot, path);
+            if (!files.has(path) && host.kindOf(absolute) === "file") {
+                files.set(path, host.readFile(absolute));
+            }
+        }
+    };
+    for (const configured of analysis.templateDirs) {
+        const dir = normalizePath(configured);
+        if (isAbsolutePath(dir) ||
+            dir === ".." ||
+            dir.startsWith("../") ||
+            host.kindOf(joinPath(targetRoot, dir)) !== "directory") {
+            throw new ConfigError("malformed", "analysis.template_dirs", `analysis.template_dirs: ${JSON.stringify(configured)} is not a directory below the target root`);
+        }
+        read(dir);
+    }
+    return {
+        delimiters: analysis.templateDelimiters,
+        files: [...files]
+            .map(([path, text]) => ({ path, text }))
+            .sort((a, b) => compare(a.path, b.path)),
+    };
+}
+/** The end of the quoted string that opens at `from`, past its closing quote. */
+function stringEnd(text, from) {
+    const quote = text[from];
+    let at = from + 1;
+    while (at < text.length && text[at] !== quote) {
+        at += text[at] === "\\" ? 2 : 1;
+    }
+    return at + 1;
+}
+/** The identifiers one action's inner text writes outside a quoted string, with their offsets in it. */
+function identifiersOf(inner) {
+    const found = [];
+    let at = 0;
+    while (at < inner.length) {
+        const char = inner[at] ?? "";
+        if (char === '"' || char === "'" || char === "`") {
+            at = stringEnd(inner, at);
+            continue;
+        }
+        if (/[0-9]/u.test(char)) {
+            // A number's letters are part of the number: `1e3` names nothing.
+            while (at < inner.length && /[0-9A-Za-z_.]/u.test(inner[at] ?? "")) {
+                at += 1;
+            }
+            continue;
+        }
+        IDENTIFIER.lastIndex = at;
+        const match = IDENTIFIER.exec(inner);
+        if (match !== null) {
+            found.push({ name: match[0], offset: at });
+            at += match[0].length;
+            continue;
+        }
+        at += 1;
+    }
+    return found;
+}
+/**
+ * Every identifier one template's actions write, in the order the file writes them,
+ * or none where an action is not closed.
+ */
+function namesOf(text, delimiters) {
+    const found = [];
+    let from = 0;
+    for (;;) {
+        const open = text.indexOf(delimiters.left, from);
+        if (open < 0) {
+            return found;
+        }
+        const start = open + delimiters.left.length;
+        const close = text.indexOf(delimiters.right, start);
+        if (close < 0) {
+            return [];
+        }
+        const inner = text.slice(start, close);
+        const action = `${delimiters.left}${inner.trim().replace(/\s+/gu, " ")}${delimiters.right}`;
+        for (const { name, offset } of identifiersOf(inner)) {
+            found.push({ name, offset: start + offset, action });
+        }
+        from = close + delimiters.right.length;
+    }
+}
+/** Where one offset of a template is, its column counted in UTF-16 code units. */
+function positionIn(file, offset) {
+    const before = file.text.slice(0, offset);
+    const lineStart = before.lastIndexOf("\n") + 1;
+    return {
+        path: file.path,
+        line: before.split("\n").length,
+        column: offset - lineStart + 1,
+    };
+}
+/**
+ * The template-field detector: every instance member of a class and every member of
+ * an interface or an object type whose name an action of a configured template
+ * writes, recorded at the identifier.
+ */
+export function templateField(input) {
+    const { templates } = input;
+    if (templates.files.length === 0) {
+        return [];
+    }
+    const members = memberNames(input.project.ownSourceFiles(), input.held);
+    const found = [];
+    for (const file of templates.files) {
+        for (const named of namesOf(file.text, templates.delimiters)) {
+            for (const member of members.get(named.name) ?? []) {
+                if (!READ_BY_A_TEMPLATE.has(member.kind) || member.static) {
+                    continue;
+                }
+                found.push({
+                    id: member.id,
+                    detail: `named by ${named.action}`,
+                    site: positionIn(file, named.offset),
+                });
+            }
+        }
+    }
+    return found;
+}

package/dist/src/verbs/print-config.js

@@ -0,0 +1,9 @@
+import { printConfig } from "../print.js";
+import { resolve } from "../resolve.js";
+import { EXIT_CLEAN } from "./verb.js";
+/** Writes the resolved configuration with the source of every setting. */
+export const printConfigVerb = ({ out, inputs }) => {
+    const { config, provenance } = resolve(inputs());
+    out.write(printConfig(config, provenance));
+    return EXIT_CLEAN;
+};

package/dist/src/verbs/print-projects.js

@@ -0,0 +1,34 @@
+import { diagnosticErrors, discoverProjects, renderDiagnostic } from "../discover.js";
+import { resolveMatrix } from "../resolve.js";
+import { diagnosticsOf, runSession } from "../session.js";
+import { EXIT_CLEAN, EXIT_FAILURE } from "./verb.js";
+/**
+ * Writes the name of every project one run analyzes, one per line, having read each
+ * project's diagnostics first: the identifier the build matrix declares for it, or,
+ * where discovery derived the project, its configuration file's path below the
+ * target root.
+ */
+export const printProjectsVerb = ({ out, err, host, inputs, scope, openClient }) => {
+    const matrix = resolveMatrix(inputs());
+    const scoped = scope();
+    const engine = openClient(false);
+    const discovered = discoverProjects(engine, host, scoped, matrix);
+    const ids = new Map(discovered.projects.map((project) => [project.configFile, project.id]));
+    const failures = [];
+    const { projects } = runSession(engine, discovered.configFiles, (project) => {
+        const errors = diagnosticErrors(diagnosticsOf(project));
+        failures.push(...errors.map(renderDiagnostic));
+        return ids.get(project.configFile) ?? project.configFile;
+    });
+    if (failures.length > 0) {
+        for (const line of failures) {
+            err.write(`${line}\n`);
+        }
+        err.write(`deadset-ts: ${String(failures.length)} error(s); no answer was produced\n`);
+        return EXIT_FAILURE;
+    }
+    for (const id of projects) {
+        out.write(`${id}\n`);
+    }
+    return EXIT_CLEAN;
+};

package/dist/src/verbs/print-retained.js

@@ -0,0 +1,23 @@
+import { runSweep } from "../analysis.js";
+import { retainedLines } from "../exempt.js";
+import { resolve } from "../resolve.js";
+import { EXIT_CLEAN } from "./verb.js";
+/**
+ * Writes every declaration an exemption held back in the production sweep a report is
+ * built from, one per line, and nothing where no exemption held one back. One fact
+ * several configurations found is one record, so the line names no configuration. The
+ * line shape is this command's own rather than a Contract format, so that sort and cut
+ * read it.
+ */
+export const printRetainedVerb = ({ out, host, inputs, scope, openClient }) => {
+    const { config } = resolve(inputs());
+    const scoped = scope();
+    const swept = runSweep(openClient(false), host, scoped, config, {
+        marked: [],
+        mode: { production: true },
+    });
+    for (const line of retainedLines(swept.matrix.union.symbols, swept.retained)) {
+        out.write(`${line}\n`);
+    }
+    return EXIT_CLEAN;
+};

package/dist/src/verbs/print-roots.js

@@ -0,0 +1,36 @@
+import { runRoots } from "../analysis.js";
+import { resolve } from "../resolve.js";
+import { EXIT_CLEAN, EXIT_FINDINGS } from "./verb.js";
+/**
+ * One root as a line: the declaration's reference, why it is a root, and the string
+ * that named it, separated by tabs. A run of several configurations adds the ones
+ * whose project holds the root as a fourth field, and writes the third present and
+ * empty where no string named the root, so every line of one run holds the same
+ * fields.
+ */
+function rootLine(root, several) {
+    const line = `${root.ref}\t${root.kind}`;
+    if (several) {
+        return `${line}\t${root.source}\t${root.configurations.join(" ")}`;
+    }
+    return root.source === "" ? line : `${line}\t${root.source}`;
+}
+/**
+ * Writes the root set of the run, one root per line, and then names on the error
+ * stream, by its issue kind, every configured root or pattern that named nothing;
+ * one such string fails the run. The line shape is this command's own rather than a
+ * Contract format, so that sort and cut read it.
+ */
+export const printRootsVerb = ({ out, err, host, inputs, scope, openClient }) => {
+    const { config, provenance } = resolve(inputs());
+    const scoped = scope();
+    const answer = runRoots(openClient(false), host, scoped, config, provenance);
+    const several = answer.configurations.length > 1;
+    for (const root of answer.roots) {
+        out.write(`${rootLine(root, several)}\n`);
+    }
+    for (const finding of answer.findings) {
+        err.write(`${finding.code}: roots.patterns names nothing: ${finding.symbol.ref}\n`);
+    }
+    return answer.findings.length > 0 ? EXIT_FINDINGS : EXIT_CLEAN;
+};

package/dist/src/verbs/verb.js

@@ -0,0 +1,5 @@
+/** The exit codes the Contract's exit-code table names. */
+export const EXIT_CLEAN = 0;
+export const EXIT_FINDINGS = 1;
+export const EXIT_USAGE = 2;
+export const EXIT_FAILURE = 3;

package/dist/src/verbs/version.js

@@ -0,0 +1,7 @@
+import { CONTRACT_VERSION } from "../version.js";
+import { EXIT_CLEAN } from "./verb.js";
+/** Writes the version the host reports and the Contract version this analyzer implements. */
+export const versionVerb = ({ out, host }) => {
+    out.write(`deadset-ts ${host.analyzerVersion()}\ncontract ${CONTRACT_VERSION}\n`);
+    return EXIT_CLEAN;
+};

package/jsr.json

@@ -1,6 +1,6 @@
 {
   "name": "@cplieger/deadset-ts",
-  "version": "3.2.0",
+  "version": "3.3.1",
   "license": "GPL-3.0-or-later",
   "exports": {
     ".": "./src/index.ts"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cplieger/deadset-ts",
-  "version": "3.2.0",
+  "version": "3.3.1",
   "type": "module",
   "sideEffects": false,
   "description": "Deterministic dead-code analysis for TypeScript, class and type members included",

package/src/analysis.ts

@@ -10,26 +10,32 @@
 
 import type { Diagnostic } from "@typescript/native/unstable/sync";
 import type { Config, Provenance } from "./config.ts";
+import { decorator } from "./decorator.ts";
 import { diagnosticErrors, discoverProjects, DiscoveryError } from "./discover.ts";
 import {
   computeExemptions,
   disabledClasses,
   exemptionsOf,
   retainedIn,
+  type Detector,
   type Detectors,
 } from "./exempt.ts";
+import type { TSExemptionClass } from "./exempt-classes.ts";
 import type { Finding } from "./finding.ts";
 import type { Host } from "./host.ts";
+import { interfaceSatisfaction } from "./interface-satisfaction.ts";
 import { inventory, type Inventory } from "./inventory.ts";
 import { readManifest } from "./manifest.ts";
 import { matrixOf, sweepMatrix, type Configured, type Matrix, type SweepResult } from "./matrix.ts";
 import { relativePath, resolvePath } from "./paths.ts";
 import { byPosition, type Position } from "./position.ts";
+import { reflectiveLookup } from "./reflective-lookup.ts";
 import { references } from "./references.ts";
 import { roots, unmatchedEverywhere, unmatchedRoots, type RootKind, type Roots } from "./roots.ts";
 import type { Scope } from "./scope.ts";
 import { diagnosticsOf, runSession, type Engine, type ProjectView } from "./session.ts";
 import type { Exemption, SweepInput } from "./sweep.ts";
+import { readTemplates, templateField } from "./template-field.ts";
 
 /** The setting whose source decides where a finding about a configured root sits. */
 const ROOTS_SETTING = "roots.patterns";
@@ -211,7 +217,12 @@ export interface RunSweep {
 }
 
 /** The exemption classes this analyzer detects, each by its detector; any other retains nothing. */
-const DETECTORS: Detectors = new Map();
+const DETECTORS: Detectors = new Map<TSExemptionClass, Detector>([
+  ["interface-satisfaction", interfaceSatisfaction],
+  ["template-field", templateField],
+  ["reflective-lookup", reflectiveLookup],
+  ["decorator", decorator],
+]);
 
 /**
  * Sweeps the run the scope and the configuration describe. Each project's references
@@ -233,6 +244,9 @@ export function runSweep(
 ): RunSweep {
   const targetRoot = scope.target.path;
   const disabled = disabledClasses(config);
+  const templates = disabled.has("template-field")
+    ? { delimiters: config.analysis.templateDelimiters, files: [] }
+    : readTemplates(host, targetRoot, config.analysis);
   const read = readProjects(engine, host, scope, config, (project, projectRead) => {
     const resolved = references(project, projectRead.held, targetRoot, {
       testFiles: config.ts.testFiles,
@@ -244,11 +258,15 @@ export function runSweep(
       roots: projectRead.rooted.liveUnderReachability,
       testFiles: resolved.testFilePaths,
     };
-    const exempt = computeExemptions({ project, held: projectRead.held, targetRoot }, detectors, {
-      disabled,
-      mode: input.mode,
-      testFiles: new Set(resolved.testFilePaths),
-    });
+    const exempt = computeExemptions(
+      { project, held: projectRead.held, targetRoot, templates },
+      detectors,
+      {
+        disabled,
+        mode: input.mode,
+        testFiles: new Set(resolved.testFilePaths),
+      },
+    );
     return { configured, exempt };
   });
   const matrix = matrixOf(read.map((one) => one.configured));

package/src/decorator.ts

@@ -0,0 +1,74 @@
+/**
+ * The decorator class: a member a decorator expression is attached to, and every
+ * member of a class a decorator expression is attached to, is held back, because the
+ * decorator receives the member or the class when the class is defined and may reach
+ * the member by its name.
+ *
+ * The rule is read from the tree alone: a decorator is attached where it is written.
+ * The use the decorator itself makes of what it decorates is the reference pass's,
+ * which records it as a `decorator` reference; this class records only that the
+ * declaration is held back, and the member set of a decorated class is every member
+ * the inventory holds for the class, static members included.
+ */
+
+import {
+  isCallExpression,
+  isDecorator,
+  type Decorator,
+  type Node,
+} from "@typescript/native/unstable/ast";
+import type { DetectorInput, Evidence } from "./exempt.ts";
+import { nodeKey, type InventorySymbol, type SymbolKind } from "./inventory.ts";
+import { renderPosition } from "./position.ts";
+
+/** The kinds of declaration a decorator is attached to and holds back. */
+const DECORATED: ReadonlySet<SymbolKind> = new Set(["class", "method", "class-member"]);
+
+/** How one decorator is spelled in a record: its expression, without a call's arguments. */
+function spelled(decorator: Decorator): string {
+  const expression = decorator.expression;
+  const named = isCallExpression(expression) ? expression.expression : expression;
+  return `@${named.getText().replace(/\s+/gu, "")}`;
+}
+
+/**
+ * The decorator detector: each decorated member, and each member of a decorated
+ * class, recorded at the decorator.
+ */
+export function decorator<Brand>(input: DetectorInput<Brand>): readonly Evidence[] {
+  const { project, held, targetRoot } = input;
+  const byId = new Map(held.symbols.map((symbol) => [symbol.id, symbol]));
+  const membersOf = new Map<string, InventorySymbol[]>();
+  for (const symbol of held.symbols) {
+    if (symbol.kind === "method" || symbol.kind === "class-member") {
+      const members = membersOf.get(symbol.parent);
+      if (members === undefined) {
+        membersOf.set(symbol.parent, [symbol]);
+      } else {
+        members.push(symbol);
+      }
+    }
+  }
+
+  const found: Evidence[] = [];
+  for (const file of project.ownSourceFiles()) {
+    const visit = (node: Node): void => {
+      const id = held.declarations.get(nodeKey(file, node));
+      const symbol = id === undefined ? undefined : byId.get(id);
+      if (symbol !== undefined && DECORATED.has(symbol.kind)) {
+        const modifiers = (node as { readonly modifiers?: readonly Node[] }).modifiers ?? [];
+        for (const attached of modifiers.filter(isDecorator)) {
+          const detail = `decorated by ${spelled(attached)}`;
+          const site = renderPosition(file, targetRoot, attached.getStart());
+          const reached = symbol.kind === "class" ? (membersOf.get(symbol.id) ?? []) : [symbol];
+          for (const member of reached) {
+            found.push({ id: member.id, detail, site });
+          }
+        }
+      }
+      node.forEachChild(visit);
+    };
+    file.forEachChild(visit);
+  }
+  return found;
+}

package/src/exempt-classes.ts

@@ -1,6 +1,7 @@
 /**
  * The exemption classes of the Contract's vocabulary, in its order: each class's name,
- * the languages it runs on and the confidence it is recorded at.
+ * the languages it runs on, the confidence it is recorded at and, for a class that runs
+ * on TypeScript, which private members it may retain.
  *
  * The rows are written out rather than read from the Contract at run time, for the
  * reason the fixed severity codes are, and a test holds them equal to the Contract
@@ -11,28 +12,81 @@
 
 import type { Confidence, Language } from "./config.ts";
 
+/**
+ * Whether a class may retain a member declared with the `private` modifier, and one
+ * declared with a `#private` name. The modifier is a compile-time constraint only, so
+ * such a member stays reachable by its name at run time; a private name cannot be
+ * named from outside its class body at all.
+ */
+export interface TypeScriptVisibility {
+  readonly private: boolean;
+  readonly privateName: boolean;
+}
+
 /** One class of the vocabulary. */
 interface ExemptionClassRow {
   readonly class: string;
   readonly languages: readonly Language[];
   readonly confidence: Confidence;
+  /** Present exactly on a class that runs on TypeScript. */
+  readonly typescriptVisibility?: TypeScriptVisibility;
 }
 
 /** Every class of the vocabulary, in the order the Contract lists them. */
 export const EXEMPTION_CLASSES = [
-  { class: "interface-satisfaction", languages: ["go", "ts"], confidence: "certain" },
+  {
+    class: "interface-satisfaction",
+    languages: ["go", "ts"],
+    confidence: "certain",
+    typescriptVisibility: { private: false, privateName: false },
+  },
   { class: "encoding-reflection", languages: ["go"], confidence: "certain" },
   { class: "format-verb-contract", languages: ["go"], confidence: "certain" },
   { class: "errors-duck-typing", languages: ["go"], confidence: "certain" },
-  { class: "enum-group", languages: ["go", "ts"], confidence: "certain" },
+  {
+    class: "enum-group",
+    languages: ["go", "ts"],
+    confidence: "certain",
+    typescriptVisibility: { private: false, privateName: false },
+  },
   { class: "generated-file", languages: ["go"], confidence: "certain" },
   { class: "linkname-cgo-asm-plugin", languages: ["go"], confidence: "certain" },
-  { class: "template-field", languages: ["go", "ts"], confidence: "possible" },
-  { class: "reflective-lookup", languages: ["go", "ts"], confidence: "possible" },
-  { class: "decorator", languages: ["ts"], confidence: "certain" },
-  { class: "injection-container", languages: ["ts"], confidence: "certain" },
-  { class: "framework-lifecycle", languages: ["ts"], confidence: "certain" },
-  { class: "serialization-contract", languages: ["ts"], confidence: "certain" },
+  {
+    class: "template-field",
+    languages: ["go", "ts"],
+    confidence: "possible",
+    typescriptVisibility: { private: true, privateName: false },
+  },
+  {
+    class: "reflective-lookup",
+    languages: ["go", "ts"],
+    confidence: "possible",
+    typescriptVisibility: { private: true, privateName: false },
+  },
+  {
+    class: "decorator",
+    languages: ["ts"],
+    confidence: "certain",
+    typescriptVisibility: { private: true, privateName: false },
+  },
+  {
+    class: "injection-container",
+    languages: ["ts"],
+    confidence: "certain",
+    typescriptVisibility: { private: true, privateName: false },
+  },
+  {
+    class: "framework-lifecycle",
+    languages: ["ts"],
+    confidence: "certain",
+    typescriptVisibility: { private: true, privateName: false },
+  },
+  {
+    class: "serialization-contract",
+    languages: ["ts"],
+    confidence: "certain",
+    typescriptVisibility: { private: true, privateName: false },
+  },
 ] as const satisfies readonly ExemptionClassRow[];
 
 type Row = (typeof EXEMPTION_CLASSES)[number];
@@ -58,10 +112,19 @@ function runsOnTS(row: Row): row is Extract<Row, { readonly class: TSExemptionCl
   return languages.includes("ts");
 }
 
+const TS_ROWS = EXEMPTION_CLASSES.filter(runsOnTS);
+
 /** The classes that run on TypeScript, in the vocabulary's order. */
-export const TS_EXEMPTION_CLASSES: readonly TSExemptionClass[] = EXEMPTION_CLASSES.filter(
-  runsOnTS,
-).map((row) => row.class);
+export const TS_EXEMPTION_CLASSES: readonly TSExemptionClass[] = TS_ROWS.map((row) => row.class);
+
+const VISIBILITY: ReadonlyMap<TSExemptionClass, TypeScriptVisibility> = new Map(
+  TS_ROWS.map((row) => [row.class, row.typescriptVisibility]),
+);
+
+/** Which private members one class that runs on TypeScript may retain. */
+export function typescriptVisibilityOf(exemptionClass: TSExemptionClass): TypeScriptVisibility {
+  return VISIBILITY.get(exemptionClass) ?? { private: false, privateName: false };
+}
 
 /** Whether one name is a class of the vocabulary, whichever language it runs on. */
 export function isExemptionClass(name: string): name is ExemptionClass {

package/src/exempt.ts

@@ -13,13 +13,16 @@ import {
   EXEMPTION_CLASSES,
   isExemptionClass,
   TS_EXEMPTION_CLASSES,
+  typescriptVisibilityOf,
   type ExemptionClass,
   type TSExemptionClass,
+  type TypeScriptVisibility,
 } from "./exempt-classes.ts";
-import type { Inventory, InventorySymbol } from "./inventory.ts";
+import type { Inventory, InventorySymbol, Visibility } from "./inventory.ts";
 import type { Matrix } from "./matrix.ts";
 import { byPosition, positionKey, type Position } from "./position.ts";
 import type { ProjectView } from "./session.ts";
+import type { Templates } from "./template-field.ts";
 import { sweep, type Exemption, type Mode, type SweepInput } from "./sweep.ts";
 
 /** One declaration a detector holds back, and where and why. */
@@ -36,6 +39,8 @@ export interface DetectorInput<Brand> {
   readonly project: ProjectView<Brand>;
   readonly held: Inventory;
   readonly targetRoot: string;
+  /** The configured templates, read once for the run. */
+  readonly templates: Templates;
 }
 
 /**
@@ -77,23 +82,44 @@ export function disabledClasses(config: Config): ReadonlySet<ExemptionClass> {
   return disabled;
 }
 
+/**
+ * Whether a class whose row states `allowed` may retain a member of one visibility. A
+ * declaration the inventory does not hold has no visibility to refuse it by.
+ */
+function retainable(allowed: TypeScriptVisibility, visibility: Visibility | undefined): boolean {
+  if (visibility === "private") {
+    return allowed.private;
+  }
+  if (visibility === "private-name") {
+    return allowed.privateName;
+  }
+  return true;
+}
+
 /**
  * The records one project's detectors found, each class in the vocabulary's order and
- * none of a switched-off class. Under a production mode a record whose evidence is
- * written in a test file holds nothing, as a reference a test file makes is none there.
+ * none of a switched-off class. Evidence on a private member the class's row says it
+ * cannot retain is dropped first, whatever the detector found. Under a production mode
+ * a record whose evidence is written in a test file holds nothing, as a reference a
+ * test file makes is none there.
  */
 export function computeExemptions<Brand>(
   input: DetectorInput<Brand>,
   detectors: Detectors,
   holding: Holding,
 ): readonly Exemption[] {
+  const visibility = new Map(input.held.symbols.map((symbol) => [symbol.id, symbol.visibility]));
   const found: Exemption[] = [];
   for (const exemptionClass of TS_EXEMPTION_CLASSES) {
     const detect = detectors.get(exemptionClass);
     if (detect === undefined || holding.disabled.has(exemptionClass)) {
       continue;
     }
+    const allowed = typescriptVisibilityOf(exemptionClass);
     for (const evidence of detect(input)) {
+      if (!retainable(allowed, visibility.get(evidence.id))) {
+        continue;
+      }
       if (holding.mode.production && holding.testFiles.has(evidence.site.path)) {
         continue;
       }

package/src/findings/dependencies-and-module-machinery.ts

@@ -0,0 +1,4 @@
+import type { Emitter } from "./emitter.ts";
+
+/** The findings of the dependencies-and-module-machinery family, `DS1600` to `DS1699`. */
+export const dependenciesAndModuleMachinery: Emitter = () => [];