@cplieger/deadset-ts 3.4.0 → 3.5.0

package/README.md

@@ -8,7 +8,7 @@ deadset-ts is a command-line analyzer for TypeScript and JavaScript projects. It
 
 deadset-ts is report-only. It never edits source, and it refuses any `--fix` flag.
 
-**Status: pre-release.** This version implements contract 3.1.0 and ships the analyzer's foundation: one compiler session per run over the projects `analysis.configurations` declares, in the order it lists them, each a compiler configuration file below the target, or, where it declares none, every `tsconfig` project discovered under the target (the explicit scope, every `tsconfig*.json`, each project's `references`), a fail-closed read of every project's diagnostics, configuration decoding against the contract's closed key list with `print-config` and its provenance, `print-projects`, the report-only guard, the symbol inventory of every declaration a project's own files hold down to its class and type members, the one-pass reference resolution over that inventory, which resolves each file's identifiers in batches ([batch-cap calibration](docs/batch-cap-calibration.md) is the measurement behind the batch size), and the root set `print-roots` prints. A root is a declaration the analysis keeps live without a reference: what a file exports when the manifest names it through `main`, `module`, `types`, `bin` or `exports`, or when `ts.entry_files` matches it; a library target's published API; the configuration, setup and test files of Vitest, Stryker and Playwright, the flat configuration of ESLint, and a worker or service worker a call addresses by a string literal; and every declaration a `roots.patterns` entry names. An entry that names nothing is reported as `DS1704` and fails the run. The entry-point conventions of other tools are not read, and `DECLINED_CONVENTIONS` lists each one with the reason. Seven exemption classes hold a declaration back from the sweep, and `print-retained` lists what each one held back: `interface-satisfaction`, a member an interface requires of a class whose value reaches that interface; `decorator`, a decorated member and every member of a decorated class; `injection-container`, a decorated property of a class a dependency-injection container constructs, being a class passed to a call `ts.injection_registrations` names or one a parameter of whose constructor carries a decorator; `framework-lifecycle`, a member a `ts.lifecycle_contracts` entry lists, on a class that is the entry's component by a decorator or a call the entry names or by extending a class it names; `serialization-contract`, the properties of a class whose values reach `JSON.stringify` or a declaration `ts.serializers` names, and those and its `toJSON` and `toString` where a value is passed to an `unknown` or `any` parameter of a function outside the analysis; and, at the lowest confidence, `template-field`, a member an action of a template under `analysis.template_dirs` names, and `reflective-lookup`, a member a literal key of an element access or of `Reflect.get`, `Reflect.set` or `Reflect.has` names. None of them holds back a `#private` member. The analysis is reached through the command, and through `run()` for a caller that runs the command in-process; no other verb reports findings yet, so `analyze`, `explain` and `describe` exit with a usage message. The one runtime dependency is the `typescript` package at exactly 7.0.2, installed under the `@typescript/native` name until TypeScript 7.1 ships a compiler API the tooling can share.
+**Status: pre-release.** This version implements contract 3.2.0 and ships the analyzer's foundation: one compiler session per run over the projects `analysis.configurations` declares, in the order it lists them, each a compiler configuration file below the target, or, where it declares none, every `tsconfig` project discovered under the target (the explicit scope, every `tsconfig*.json`, each project's `references`), a fail-closed read of every project's diagnostics, configuration decoding against the contract's closed key list with `print-config` and its provenance, `print-projects`, the report-only guard, the symbol inventory of every declaration a project's own files hold down to its class and type members, the one-pass reference resolution over that inventory, which resolves each file's identifiers in batches ([batch-cap calibration](docs/batch-cap-calibration.md) is the measurement behind the batch size), and the root set `print-roots` prints. A root is a declaration the analysis keeps live without a reference: what a file exports when the manifest names it through `main`, `module`, `types`, `bin` or `exports`, or when `ts.entry_files` matches it; a library target's published API; the configuration, setup and test files of Vitest, Stryker and Playwright, the flat configuration of ESLint, and a worker or service worker a call addresses by a string literal; and every declaration a `roots.patterns` entry names. An entry that names nothing is reported as `DS1704` and fails the run. The entry-point conventions of other tools are not read, and `DECLINED_CONVENTIONS` lists each one with the reason. Seven exemption classes hold a declaration back from the sweep, and `print-retained` lists what each one held back: `interface-satisfaction`, a member an interface requires of a class whose value reaches that interface; `decorator`, a decorated member and every member of a decorated class; `injection-container`, a decorated property of a class a dependency-injection container constructs, being a class passed to a call `ts.injection_registrations` names or one a parameter of whose constructor carries a decorator; `framework-lifecycle`, a member a `ts.lifecycle_contracts` entry lists, on a class that is the entry's component by a decorator or a call the entry names or by extending a class it names; `serialization-contract`, the properties of a class whose values reach `JSON.stringify` or a declaration `ts.serializers` names, and those and its `toJSON` and `toString` where a value is passed to an `unknown` or `any` parameter of a function outside the analysis; and, at the lowest confidence, `template-field`, a member an action of a template under `analysis.template_dirs` names, and `reflective-lookup`, a member a literal key of an element access or of `Reflect.get`, `Reflect.set` or `Reflect.has` names. None of them holds back a `#private` member. The analysis is reached through the command, and through `run()` for a caller that runs the command in-process; no other verb reports findings yet, so `analyze`, `explain` and `describe` exit with a usage message. The one runtime dependency is the `typescript` package at exactly 7.0.2, installed under the `@typescript/native` name until TypeScript 7.1 ships a compiler API the tooling can share.
 
 ## Install
 

package/dist/src/components.js

@@ -1,7 +1,7 @@
 /**
- * The dead components of one graph: the strongly connected components of the subgraph
- * the dead declarations induce, ordered so a report is worked from the top down, each
- * with the root members a deletion starts at and what falls with it.
+ * The dead components of one graph. A component is a set of dead declarations one
+ * deletion removes together: its root members, which are where the deletion starts,
+ * and every dead declaration that falls with them, being dead only through them.
  */
 import { OUTSIDE } from "./graph.js";
 /** The name every component identifier this analyzer mints starts with. */
@@ -10,21 +10,21 @@ const ANALYZER = "deadset-ts";
 const ID_DIGITS = 4;
 /** The index of a declaration the component walk has not reached. */
 const UNVISITED = -1;
-/** What a report carries for one component: its roots and what falls, and its members in full. */
+/** What a report carries for one component: its roots and counts, and its members in full. */
 export function listing(component, cascade) {
     return {
         roots: component.roots,
         members: cascade === "full" ? component.members : [],
-        symbolCount: component.falls.length,
+        symbolCount: component.members.length,
         deletableLines: component.deletableLines,
     };
 }
 /**
- * Groups the declarations `dead` marks into components and orders them so each precedes
- * every component it reaches, two that neither reaches ordered by their first member's
- * site. `dead` and `testOfDeadCode` hold one flag per declaration of the graph; the dead
- * set arrives rather than being read from a sweep, so a set several sweeps intersect is
- * grouped over this graph's edges the same way.
+ * Groups the declarations `dead` marks into components, ordered by their first member's
+ * site; `dead` and `testOfDeadCode` hold one flag per declaration of the graph. Root
+ * members sit on the cycles no other cycle references. A cycle two roots both reach is
+ * dead only through both, so a component is a weakly connected part of the dead
+ * subgraph: no dead declaration of one references a declaration of another.
  */
 export function componentsOf(graph, dead, testOfDeadCode) {
     const { at, adjacent } = deadSubgraph(graph, dead, testOfDeadCode);
@@ -32,25 +32,21 @@ export function componentsOf(graph, dead, testOfDeadCode) {
         return [];
     }
     const { componentOf, members } = connected(adjacent);
-    const { edges, into } = condense(adjacent, componentOf, members.length);
-    const falls = fallSets(edges, members, into);
-    const outsideReference = externallyReferenced(adjacent, componentOf);
+    const referenced = referencedCycles(adjacent, componentOf, members.length);
+    const groups = joined(adjacent);
     const idOf = (position) => graph.symbols[at[position] ?? 0]?.id ?? "";
-    return order(edges, members).map((group, place) => {
-        const own = members[group] ?? [];
-        const roots = own.filter((position) => {
-            // A dead member of a dead container is never a root: the container is where the
-            // deletion starts and the member falls with it.
+    return groups.map((group, place) => {
+        const roots = group.filter((position) => {
+            // A dead member's dead container is on the member's own cycle, and the container
+            // is where the deletion starts.
             const container = graph.parent[at[position] ?? 0] ?? OUTSIDE;
-            return outsideReference[position] !== true && dead[container] !== true;
+            return referenced[componentOf[position] ?? 0] !== true && dead[container] !== true;
         });
-        const fallen = falls[group] ?? [];
         return {
             id: `${ANALYZER}/c-${String(place + 1).padStart(ID_DIGITS, "0")}`,
-            members: own.map(idOf),
+            members: group.map(idOf),
             roots: roots.map(idOf),
-            falls: fallen.map(idOf),
-            deletableLines: linesSpanned(fallen.map((position) => graph.symbols[at[position] ?? 0])),
+            deletableLines: linesSpanned(group.map((position) => graph.symbols[at[position] ?? 0])),
         };
     });
 }
@@ -127,10 +123,9 @@ function deadSubgraph(graph, dead, testOfDeadCode) {
     return { at, adjacent };
 }
 /**
- * Each declaration's component and each component's members by site, by Tarjan's
+ * Each declaration's cycle and each cycle's members by site, by Tarjan's
  * algorithm in one pass. The walk keeps its own stack of frames, so a chain of any length
- * is walked without growing the call stack. Components are closed in an order in which
- * each follows every component it reaches.
+ * is walked without growing the call stack.
  */
 function connected(adjacent) {
     const index = adjacent.map(() => UNVISITED);
@@ -193,97 +188,57 @@ function connected(adjacent) {
     });
     return { componentOf, members };
 }
-/**
- * Per component, the components it reaches in one step, and how many components reach
- * it, each pair counted once. An edge inside a component is not an edge between two, so
- * the result is acyclic.
- */
-function condense(adjacent, componentOf, count) {
-    const edges = Array.from({ length: count }, () => []);
-    const into = Array.from({ length: count }, () => 0);
-    const seen = new Set();
+/** Per cycle, whether a dead declaration outside it references one of its members. */
+function referencedCycles(adjacent, componentOf, count) {
+    const referenced = Array.from({ length: count }, () => false);
     adjacent.forEach((targets, from) => {
         for (const to of targets) {
-            const a = componentOf[from] ?? 0;
-            const b = componentOf[to] ?? 0;
-            const pair = `${String(a)}>${String(b)}`;
-            if (a === b || seen.has(pair)) {
-                continue;
-            }
-            seen.add(pair);
-            edges[a]?.push(b);
-            into[b] = (into[b] ?? 0) + 1;
-        }
-    });
-    return { edges, into };
-}
-/** Per dead declaration, whether a dead component other than its own references it. */
-function externallyReferenced(adjacent, componentOf) {
-    const referenced = adjacent.map(() => false);
-    adjacent.forEach((targets, from) => {
-        for (const to of targets) {
-            if (componentOf[from] !== componentOf[to]) {
-                referenced[to] = true;
+            const cycle = componentOf[to] ?? 0;
+            if (componentOf[from] !== cycle) {
+                referenced[cycle] = true;
             }
         }
     });
     return referenced;
 }
 /**
- * The components in the order a report is worked in. Tarjan closes each component after
- * every one it reaches, so reading the closing order backwards is a topological order,
- * and one pass over it gives each component its depth below the roots.
+ * The weakly connected parts of the dead subgraph, each its positions in ascending
+ * order, ordered by their first position. Positions follow the graph's declaration
+ * order, so a part's first position is its first member's site.
  */
-function order(edges, members) {
-    const sequence = edges.map((_targets, component) => component).reverse();
-    const depth = edges.map(() => 0);
-    for (const from of sequence) {
-        for (const to of edges[from] ?? []) {
-            depth[to] = Math.max(depth[to] ?? 0, (depth[from] ?? 0) + 1);
-        }
-    }
-    return sequence.sort((a, b) => (depth[a] ?? 0) - (depth[b] ?? 0) || (members[a]?.[0] ?? 0) - (members[b]?.[0] ?? 0));
-}
-/**
- * Per component, the dead declarations one deletion of it removes. A root of the
- * condensation carries its members and every component only it reaches; any other
- * component carries its own members alone, because what it reaches is reached through a
- * root above it as well.
- */
-function fallSets(edges, members, into) {
-    // Each root's walk stamps what it reaches with the root's own number, so the walks
-    // share one array rather than allocating one per root.
-    const stamp = edges.map(() => UNVISITED);
-    const reach = new Map();
-    const owners = edges.map(() => 0);
-    edges.forEach((_targets, root) => {
-        if (into[root] !== 0) {
-            return;
-        }
-        const reached = [root];
-        stamp[root] = root;
-        // An array's iterator reads its length at every step, so what a step pushes is
-        // walked in the same loop.
-        for (const at of reached) {
-            for (const to of edges[at] ?? []) {
-                if (stamp[to] !== root) {
-                    stamp[to] = root;
-                    reached.push(to);
-                }
-            }
-        }
-        reach.set(root, reached);
-        for (const component of reached) {
-            owners[component] = (owners[component] ?? 0) + 1;
+function joined(adjacent) {
+    const leader = adjacent.map((_edges, position) => position);
+    const find = (position) => {
+        let top = position;
+        while ((leader[top] ?? top) !== top) {
+            top = leader[top] ?? top;
+        }
+        // Every position on the walk points at the top afterwards, so a later find is short.
+        for (let step = position; step !== top;) {
+            const next = leader[step] ?? top;
+            leader[step] = top;
+            step = next;
+        }
+        return top;
+    };
+    adjacent.forEach((targets, from) => {
+        for (const to of targets) {
+            const a = find(from);
+            const b = find(to);
+            // The smaller position leads, so a part's leader is its first position.
+            leader[Math.max(a, b)] = Math.min(a, b);
         }
     });
-    return members.map((own, component) => {
-        const set = [...own];
-        for (const other of reach.get(component) ?? []) {
-            if (other !== component && owners[other] === 1) {
-                set.push(...(members[other] ?? []));
-            }
+    const parts = new Map();
+    adjacent.forEach((_edges, position) => {
+        const top = find(position);
+        const part = parts.get(top);
+        if (part === undefined) {
+            parts.set(top, [position]);
+        }
+        else {
+            part.push(position);
         }
-        return set.sort((a, b) => a - b);
     });
+    return [...parts.values()];
 }

package/dist/src/config.js

@@ -34,6 +34,12 @@ export function defaultConfig() {
             maxFindings: 0,
             failOn: "deny",
         },
+        providers: {
+            analyzers: [
+                { shape: "installed", name: "deadset-go", languages: ["go"], command: "deadset-go" },
+                { shape: "installed", name: "deadset-ts", languages: ["ts"], command: "deadset-ts" },
+            ],
+        },
         ts: {
             testFiles: ["**/*.test.{ts,tsx,mts,cts}"],
             entryFiles: [],

package/dist/src/kinds.js

@@ -10,3 +10,43 @@
  * code the Contract fixes arrives here as a failing test.
  */
 export const FIXED_SEVERITY_CODES = ["DS1703", "DS1704"];
+/**
+ * The code of every live issue kind, in ascending order. A severity key names one of
+ * them or a family prefix whose range holds one; a key naming a retired code, an
+ * unassigned code or a range holding no live kind is an unimplemented key, so every
+ * severity a configuration sets is one some analyzer reports under. A test compares
+ * this list against the Contract release the analyzer is written against.
+ */
+export const LIVE_CODES = [
+    "DS1001",
+    "DS1002",
+    "DS1003",
+    "DS1004",
+    "DS1005",
+    "DS1006",
+    "DS1101",
+    "DS1102",
+    "DS1103",
+    "DS1104",
+    "DS1201",
+    "DS1203",
+    "DS1204",
+    "DS1301",
+    "DS1302",
+    "DS1303",
+    "DS1501",
+    "DS1502",
+    "DS1601",
+    "DS1605",
+    "DS1701",
+    "DS1702",
+    "DS1703",
+    "DS1704",
+    "DS1705",
+    "DS1801",
+    "DS1802",
+    "DS1803",
+    "DS1805",
+    "DS1807",
+    "DS1809",
+];

package/dist/src/print.js

@@ -1,4 +1,4 @@
-import { renderOrigin } from "./config.js";
+import { renderOrigin, } from "./config.js";
 /** One declaration entry as a document writes it: the members of its shape alone. */
 function declarationOf(entry) {
     switch (entry.shape) {
@@ -10,6 +10,14 @@ function declarationOf(entry) {
             return { global: entry.global };
     }
 }
+/** One provider entry as a document writes it: the members of its shape alone. */
+function providerOf(entry) {
+    const installed = { name: entry.name, languages: entry.languages, command: entry.command };
+    if (entry.shape === "installed") {
+        return installed;
+    }
+    return { ...installed, source: entry.source, version: entry.version, digest: entry.digest };
+}
 /**
  * The resolved configuration and its provenance as one JSON object, indented,
  * ending in a newline.
@@ -51,6 +59,7 @@ export function printConfig(config, provenance) {
             max_findings: config.reporters.maxFindings,
             fail_on: config.reporters.failOn,
         },
+        providers: { analyzers: config.providers.analyzers.map(providerOf) },
         go: {},
         ts: {
             test_files: config.ts.testFiles,

package/dist/src/resolve.js

@@ -1,5 +1,5 @@
 import { ConfigError, defaultConfig, } from "./config.js";
-import { FIXED_SEVERITY_CODES } from "./kinds.js";
+import { FIXED_SEVERITY_CODES, LIVE_CODES } from "./kinds.js";
 import { checkDocument, malformed, nestFlags, SCHEMA_ROOT, SEVERITY_SECTION, } from "./schema.js";
 /** Names the command-line flags in a refusal, where a document is named by its path. */
 const FLAGS_LABEL = "the command-line flags";
@@ -8,6 +8,12 @@ const FAMILY_KEY_LENGTH = 4;
 const SEVERITY_KEY = /^DS[0-9]{2}([0-9]{2})?$/u;
 const EXEMPTION_CLASS = /^[a-z][a-z0-9-]*$/u;
 const CONTRACT_VERSION_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+$/u;
+const ANALYZER_NAME = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/u;
+const PROVIDER_SOURCE = /^(go|npm):[^ \t\r\n]+$/u;
+const PROVIDER_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/u;
+const PROVIDER_DIGEST = /^sha256:[0-9a-f]{64}$/u;
+/** The members only an acquirable provider entry carries. */
+const ACQUIRABLE_MEMBERS = ["source", "version", "digest"];
 /** The members only a platform build configuration carries. */
 const PLATFORM_MEMBERS = ["os", "arch", "tags"];
 /** The member only a project build configuration carries. */
@@ -223,8 +229,8 @@ function readDelimiters(analysis, label) {
     };
 }
 /**
- * A severity key that names no setting, because the Contract fixes the severity of
- * the kind or kinds it names.
+ * A severity key that names no setting: it names no live kind, or the Contract
+ * fixes the severity of the kind or kinds it names.
  */
 function unimplementedSeverityKey(label, path, reason) {
     return new ConfigError("unimplemented-key", path, `${label}: key ${JSON.stringify(path)} is not implemented: ${reason}`);
@@ -245,16 +251,19 @@ function spellCodes(codes) {
     }
     return `${codes.slice(0, -1).join(", ")} and ${String(codes[codes.length - 1])}`;
 }
+/** Whether one severity key names a live kind: the code itself, or a family holding one. */
+function namesLiveKind(code) {
+    return LIVE_CODES.some((candidate) => code === candidate || (code.length === FAMILY_KEY_LENGTH && candidate.startsWith(code)));
+}
 /**
  * The severity object, one code at a time.
  *
- * A key is one issue-kind code or one two-digit family prefix, and a key naming a
- * kind whose severity the Contract fixes, or a family prefix whose range holds
- * one, is an unimplemented key rather than a setting.
+ * A key is one issue-kind code or one two-digit family prefix. A key naming no
+ * live kind, and a key naming a kind whose severity the Contract fixes or a family
+ * prefix whose range holds one, is an unimplemented key rather than a setting.
  *
- * Whether a key names a kind this analyzer reports is not decided here. This
- * analyzer reports no issue kind, so the question has one answer for every key
- * and asking it would refuse the whole object.
+ * Whether a key names a kind this analyzer reports is not decided here: a live
+ * kind of another language is a setting the analyzer of that language reads.
  */
 function readSeverity(document, label) {
     const object = section(document, SEVERITY_SECTION, SEVERITY_SECTION, label);
@@ -267,6 +276,11 @@ function readSeverity(document, label) {
         if (!SEVERITY_KEY.test(code)) {
             throw unimplementedSeverityKey(label, path, "a severity key is one issue-kind code or one two-digit family prefix");
         }
+        if (!namesLiveKind(code)) {
+            throw unimplementedSeverityKey(label, path, code.length === FAMILY_KEY_LENGTH
+                ? "the family this prefix names holds no live issue kind"
+                : "the code names no live issue kind");
+        }
         const fixed = fixedByContract(code);
         if (fixed.length > 0) {
             throw unimplementedSeverityKey(label, path, `the Contract fixes the severity of ${spellCodes(fixed)}, which this key names`);
@@ -384,6 +398,68 @@ function readLifecycleContracts(ts, label) {
     }
     return value.map((entry, index) => readLifecycleContract(entry, `${path}[${String(index)}]`, label));
 }
+/** One string member a provider entry requires, refused where it fails `pattern`. */
+function readMatching(entry, name, at, label, pattern) {
+    const path = `${at}.${name}`;
+    const value = requireMember(readString(entry, name, path, label), path, label);
+    if (!pattern.test(value)) {
+        throw malformed(label, path, `${JSON.stringify(value)} does not match ${pattern.source}`);
+    }
+    return value;
+}
+/**
+ * One provider entry, read as the one shape its members name: a member only an
+ * acquirable analyzer carries makes it acquirable, and then it carries all three.
+ */
+function readProvider(entry, at, label) {
+    if (!isRecord(entry)) {
+        throw malformed(label, at, "is not an object");
+    }
+    const name = readMatching(entry, "name", at, label, ANALYZER_NAME);
+    const languages = readStrings(entry, "languages", `${at}.languages`, label, 1, LANGUAGES);
+    if (languages === undefined) {
+        throw malformed(label, `${at}.languages`, "is required and names nothing");
+    }
+    const commandPath = `${at}.command`;
+    const command = requireMember(readString(entry, "command", commandPath, label), commandPath, label);
+    if (!ACQUIRABLE_MEMBERS.some((member) => Object.hasOwn(entry, member))) {
+        return { shape: "installed", name, languages, command };
+    }
+    return {
+        shape: "acquirable",
+        name,
+        languages,
+        command,
+        source: readMatching(entry, "source", at, label, PROVIDER_SOURCE),
+        version: readMatching(entry, "version", at, label, PROVIDER_VERSION),
+        digest: readMatching(entry, "digest", at, label, PROVIDER_DIGEST),
+    };
+}
+/**
+ * The provider list. Every file a run writes for an analyzer is keyed by the
+ * entry's name, so a list naming one name twice is refused at the later entry.
+ */
+function readProviders(providers, label) {
+    const path = "providers.analyzers";
+    const value = member(providers, "analyzers");
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Array.isArray(value)) {
+        throw malformed(label, path, "is not an array");
+    }
+    const read = value.map((entry, index) => readProvider(entry, `${path}[${String(index)}]`, label));
+    const first = new Map();
+    read.forEach((entry, index) => {
+        const earlier = first.get(entry.name);
+        if (earlier !== undefined) {
+            throw malformed(label, `${path}[${String(index)}].name`, `${JSON.stringify(entry.name)} is already the name of ${path}[${String(earlier)}], ` +
+                "and every entry's name keys the files a run writes for it");
+        }
+        first.set(entry.name, index);
+    });
+    return read;
+}
 /**
  * Reads one already-parsed configuration document as the settings it supplies,
  * refusing every constraint the closed key list declares that a parse cannot
@@ -400,6 +476,7 @@ function readDoc(value, label) {
     const consumers = section(value, "consumers", "consumers", label);
     const roots = section(value, "roots", "roots", label);
     const reporters = section(value, "reporters", "reporters", label);
+    const providers = section(value, "providers", "providers", label);
     const ts = section(value, "ts", "ts", label);
     section(value, "go", "go", label);
     section(value, "provenance", "provenance", label);
@@ -427,6 +504,7 @@ function readDoc(value, label) {
         cascade: readEnum(reporters, "cascade", "reporters.cascade", label, CASCADES),
         maxFindings: readCount(reporters, "max_findings", "reporters.max_findings", label),
         failOn: readEnum(reporters, "fail_on", "reporters.fail_on", label, SEVERITIES),
+        providers: readProviders(providers, label),
         testFiles: readStrings(ts, "test_files", "ts.test_files", label, 1),
         entryFiles: readStrings(ts, "entry_files", "ts.entry_files", label, 0),
         injectionRegistrations: readDeclarations(ts, "injection_registrations", "ts.injection_registrations", label),
@@ -630,6 +708,9 @@ function settleAll(inputs) {
             maxFindings: at("reporters.max_findings", defaults.reporters.maxFindings, (doc) => doc.maxFindings),
             failOn: at("reporters.fail_on", defaults.reporters.failOn, (doc) => doc.failOn),
         },
+        providers: {
+            analyzers: at("providers.analyzers", defaults.providers.analyzers, (doc) => doc.providers),
+        },
         ts: {
             testFiles: at("ts.test_files", defaults.ts.testFiles, (doc) => doc.testFiles),
             entryFiles: at("ts.entry_files", defaults.ts.entryFiles, (doc) => doc.entryFiles),

package/dist/src/run.js

@@ -47,8 +47,14 @@ export const SETTING_OPTIONS = new Map([
 ]);
 /** The options that take a value and are not settings. */
 const PLAIN_OPTIONS = new Set(["target", "config", "central", "scope"]);
-/** The setting options whose value is a number rather than a string. */
-const NUMBER_OPTIONS = new Set(["max-findings"]);
+/**
+ * The setting options whose value is an integer rather than a string. A value
+ * written other than as digits is passed on as the string it is, so resolution
+ * refuses it by its type rather than reading `1e2` as 100.
+ */
+const INTEGER_OPTIONS = new Set(["max-findings"]);
+/** An integer as an option writes it: an optional minus sign and digits alone. */
+const INTEGER_TEXT = /^-?[0-9]+$/u;
 /**
  * The first option whose name carries a source-edit token, because every verb
  * reports and never edits. The match is on the name alone, so an option whose
@@ -116,7 +122,7 @@ function inputsOf(host, options) {
         if (value === undefined) {
             continue;
         }
-        flat[path] = NUMBER_OPTIONS.has(name) ? Number(value) : value;
+        flat[path] = INTEGER_OPTIONS.has(name) && INTEGER_TEXT.test(value) ? Number(value) : value;
         flagLabels.set(path, `--${name}`);
     }
     const flags = Object.keys(flat).length === 0 ? undefined : JSON.stringify(flat);

package/dist/src/schema.js

@@ -1,5 +1,6 @@
 import { ConfigError } from "./config.js";
 const leaf = { kind: "leaf" };
+const integer = { kind: "leaf", integer: true };
 /** A list of declarations, each entry in one of the three shapes the `ts` section states. */
 const declarations = {
     kind: "list",
@@ -44,10 +45,26 @@ export const SCHEMA_ROOT = {
                 formats: leaf,
                 sort: leaf,
                 cascade: leaf,
-                max_findings: leaf,
+                max_findings: integer,
                 fail_on: leaf,
             },
         },
+        providers: {
+            kind: "section",
+            members: {
+                analyzers: {
+                    kind: "list",
+                    members: {
+                        name: leaf,
+                        languages: leaf,
+                        command: leaf,
+                        source: leaf,
+                        version: leaf,
+                        digest: leaf,
+                    },
+                },
+            },
+        },
         go: { kind: "section", members: {} },
         ts: {
             kind: "section",
@@ -244,6 +261,21 @@ function skipScalar(cursor) {
         cursor.at += 1;
     }
 }
+/** A number the document writes as an optional minus sign and digits alone. */
+const INTEGER_TEXT = /^-?[0-9]+$/u;
+/** The start of a JSON number: a minus sign or a digit. */
+const NUMBER_START = /^[-0-9]/u;
+/**
+ * Refuses a number written with a fraction or an exponent where the key list
+ * declares an integer. A parse reads `100.0` and `1e2` as the integer 100, so only
+ * the text can tell them apart. A scalar that is no number is the decoder's to
+ * refuse by its type.
+ */
+function checkInteger(text, at, label) {
+    if (NUMBER_START.test(text) && !INTEGER_TEXT.test(text)) {
+        throw malformed(label, at, `${text} is written with a fraction or an exponent, and an integer is digits alone`);
+    }
+}
 function walkValue(cursor, at, node, label) {
     skipSpace(cursor);
     const ch = cursor.text.charCodeAt(cursor.at);
@@ -261,7 +293,11 @@ function walkValue(cursor, at, node, label) {
         readName(cursor, at, label);
         return;
     }
+    const start = cursor.at;
     skipScalar(cursor);
+    if (node.integer === true) {
+        checkInteger(cursor.text.slice(start, cursor.at), at, label);
+    }
 }
 function walkObject(cursor, at, node, label) {
     const seen = new Set();