@hyperfrontend/project-scope 0.2.1 → 0.2.3

package/heuristics/dependencies/index.cjs.js

@@ -1,413 +1,24 @@
 'use strict';
 
-var node_path = require('node:path');
-var node_fs = require('node:fs');
-
-/**
- * Safe copies of Map built-in via factory function.
- *
- * Since constructors cannot be safely captured via Object.assign, this module
- * provides a factory function that uses Reflect.construct internally.
- *
- * These references are captured at module initialization time to protect against
- * prototype pollution attacks. Import only what you need for tree-shaking.
- *
- * @module @hyperfrontend/immutable-api-utils/built-in-copy/map
- */
-const _Map = globalThis.Map;
-const _Reflect$2 = globalThis.Reflect;
-/**
- * (Safe copy) Creates a new Map using the captured Map constructor.
- * Use this instead of `new Map()`.
- *
- * @param iterable - Optional iterable of key-value pairs.
- * @returns A new Map instance.
- */
-const createMap = (iterable) => _Reflect$2.construct(_Map, iterable ? [iterable] : []);
-
-/**
- * Safe copies of Object built-in methods.
- *
- * These references are captured at module initialization time to protect against
- * prototype pollution attacks. Import only what you need for tree-shaking.
- *
- * @module @hyperfrontend/immutable-api-utils/built-in-copy/object
- */
-const _Object = globalThis.Object;
-/**
- * (Safe copy) Prevents modification of existing property attributes and values,
- * and prevents the addition of new properties.
- */
-const freeze = _Object.freeze;
-/**
- * (Safe copy) Returns the names of the enumerable string properties and methods of an object.
- */
-const keys = _Object.keys;
-/**
- * (Safe copy) Returns an array of key/values of the enumerable own properties of an object.
- */
-const entries = _Object.entries;
-/**
- * (Safe copy) Returns an array of values of the enumerable own properties of an object.
- */
-const values = _Object.values;
-/**
- * (Safe copy) Adds one or more properties to an object, and/or modifies attributes of existing properties.
- */
-const defineProperties = _Object.defineProperties;
-
-/**
- * Safe copies of Set built-in via factory function.
- *
- * Since constructors cannot be safely captured via Object.assign, this module
- * provides a factory function that uses Reflect.construct internally.
- *
- * These references are captured at module initialization time to protect against
- * prototype pollution attacks. Import only what you need for tree-shaking.
- *
- * @module @hyperfrontend/immutable-api-utils/built-in-copy/set
- */
-const _Set = globalThis.Set;
-const _Reflect$1 = globalThis.Reflect;
-/**
- * (Safe copy) Creates a new Set using the captured Set constructor.
- * Use this instead of `new Set()`.
- *
- * @param iterable - Optional iterable of values.
- * @returns A new Set instance.
- */
-const createSet = (iterable) => _Reflect$1.construct(_Set, iterable ? [iterable] : []);
-
-/**
- * Safe copies of Error built-ins via factory functions.
- *
- * Since constructors cannot be safely captured via Object.assign, this module
- * provides factory functions that use Reflect.construct internally.
- *
- * These references are captured at module initialization time to protect against
- * prototype pollution attacks. Import only what you need for tree-shaking.
- *
- * @module @hyperfrontend/immutable-api-utils/built-in-copy/error
- */
-const _Error = globalThis.Error;
-const _Reflect = globalThis.Reflect;
-/**
- * (Safe copy) Creates a new Error using the captured Error constructor.
- * Use this instead of `new Error()`.
- *
- * @param message - Optional error message.
- * @param options - Optional error options.
- * @returns A new Error instance.
- */
-const createError = (message, options) => _Reflect.construct(_Error, [message, options]);
-
-/**
- * Safe copies of JSON built-in methods.
- *
- * These references are captured at module initialization time to protect against
- * prototype pollution attacks. Import only what you need for tree-shaking.
- *
- * @module @hyperfrontend/immutable-api-utils/built-in-copy/json
- */
-const _JSON = globalThis.JSON;
-/**
- * (Safe copy) Converts a JavaScript Object Notation (JSON) string into an object.
- */
-const parse = _JSON.parse;
-/**
- * (Safe copy) Converts a JavaScript value to a JavaScript Object Notation (JSON) string.
- */
-const stringify = _JSON.stringify;
-
-/**
- * Safe copies of Array built-in static methods.
- *
- * These references are captured at module initialization time to protect against
- * prototype pollution attacks. Import only what you need for tree-shaking.
- *
- * @module @hyperfrontend/immutable-api-utils/built-in-copy/array
- */
-const _Array = globalThis.Array;
-/**
- * (Safe copy) Determines whether the passed value is an Array.
- */
-const isArray = _Array.isArray;
-
-/**
- * Safe copies of Console built-in methods.
- *
- * These references are captured at module initialization time to protect against
- * prototype pollution attacks. Import only what you need for tree-shaking.
- *
- * @module @hyperfrontend/immutable-api-utils/built-in-copy/console
- */
-const _console = globalThis.console;
-/**
- * (Safe copy) Outputs a message to the console.
- */
-const log = _console.log.bind(_console);
-/**
- * (Safe copy) Outputs a warning message to the console.
- */
-const warn = _console.warn.bind(_console);
-/**
- * (Safe copy) Outputs an error message to the console.
- */
-const error = _console.error.bind(_console);
-/**
- * (Safe copy) Outputs an informational message to the console.
- */
-const info = _console.info.bind(_console);
-/**
- * (Safe copy) Outputs a debug message to the console.
- */
-const debug = _console.debug.bind(_console);
-/**
- * (Safe copy) Outputs a stack trace to the console.
- */
-_console.trace.bind(_console);
-/**
- * (Safe copy) Displays an interactive listing of the properties of a specified object.
- */
-_console.dir.bind(_console);
-/**
- * (Safe copy) Displays tabular data as a table.
- */
-_console.table.bind(_console);
-/**
- * (Safe copy) Writes an error message to the console if the assertion is false.
- */
-_console.assert.bind(_console);
-/**
- * (Safe copy) Clears the console.
- */
-_console.clear.bind(_console);
-/**
- * (Safe copy) Logs the number of times that this particular call to count() has been called.
- */
-_console.count.bind(_console);
-/**
- * (Safe copy) Resets the counter used with console.count().
- */
-_console.countReset.bind(_console);
-/**
- * (Safe copy) Creates a new inline group in the console.
- */
-_console.group.bind(_console);
-/**
- * (Safe copy) Creates a new inline group in the console that is initially collapsed.
- */
-_console.groupCollapsed.bind(_console);
-/**
- * (Safe copy) Exits the current inline group.
- */
-_console.groupEnd.bind(_console);
-/**
- * (Safe copy) Starts a timer with a name specified as an input parameter.
- */
-_console.time.bind(_console);
-/**
- * (Safe copy) Stops a timer that was previously started.
- */
-_console.timeEnd.bind(_console);
-/**
- * (Safe copy) Logs the current value of a timer that was previously started.
- */
-_console.timeLog.bind(_console);
-
-const registeredClasses = [];
-
-/**
- * Returns the data type of the target.
- * Uses native `typeof` operator, however, makes distinction between `null`, `array`, and `object`.
- * Also, when classes are registered via `registerClass`, it checks if objects are instance of any known registered class.
- *
- * @param target - The target to get the data type of.
- * @returns The data type of the target.
- */
-const getType = (target) => {
-    if (target === null)
-        return 'null';
-    const nativeDataType = typeof target;
-    if (nativeDataType === 'object') {
-        if (isArray(target))
-            return 'array';
-        for (const registeredClass of registeredClasses) {
-            if (target instanceof registeredClass)
-                return registeredClass.name;
-        }
-    }
-    return nativeDataType;
-};
-
-/* eslint-disable @typescript-eslint/no-explicit-any */
-/**
- * Creates a wrapper function that only executes the wrapped function if the condition function returns true.
- *
- * @param func - The function to be conditionally executed.
- * @param conditionFunc - A function that returns a boolean, determining if `func` should be executed.
- * @returns A wrapped version of `func` that executes conditionally.
- */
-function createConditionalExecutionFunction(func, conditionFunc) {
-    return function (...args) {
-        if (conditionFunc()) {
-            return func(...args);
-        }
-    };
-}
-
-/* eslint-disable @typescript-eslint/no-explicit-any */
-/**
- * Creates a wrapper function that silently ignores any errors thrown by the wrapped void function.
- * This function is specifically for wrapping functions that do not return a value (void functions).
- * Exceptions are swallowed without any logging or handling.
- *
- * @param func - The void function to be wrapped.
- * @returns A wrapped version of the input function that ignores errors.
- */
-function createErrorIgnoringFunction(func) {
-    return function (...args) {
-        try {
-            func(...args);
-        }
-        catch {
-            // Deliberately swallowing/ignoring the exception
-        }
-    };
-}
-
-/* eslint-disable @typescript-eslint/no-unused-vars */
-/**
- * A no-operation function (noop) that does nothing regardless of the arguments passed.
- * It is designed to be as permissive as possible in its typing without using the `Function` keyword.
- *
- * @param args - Any arguments passed to the function (ignored)
- */
-const noop = (...args) => {
-    // Intentionally does nothing
-};
-
-const logLevels = ['none', 'error', 'warn', 'log', 'info', 'debug'];
-const priority = {
-    error: 4,
-    warn: 3,
-    log: 2,
-    info: 1,
-    debug: 0,
-};
-/**
- * Validates whether a given string is a valid log level.
- *
- * @param level - The log level to validate
- * @returns True if the level is valid, false otherwise
- */
-function isValidLogLevel(level) {
-    return logLevels.includes(level);
-}
-/**
- * Creates a log level configuration manager for controlling logging behavior.
- * Provides methods to get, set, and evaluate log levels based on priority.
- *
- * @param level - The initial log level (defaults to 'error')
- * @returns A configuration object with log level management methods
- * @throws {Error} When the provided level is not a valid log level
- */
-function createLogLevelConfig(level = 'error') {
-    if (!isValidLogLevel(level)) {
-        throw createError('Cannot create log level configuration with a valid default log level');
-    }
-    const state = { level };
-    const getLogLevel = () => state.level;
-    const setLogLevel = (level) => {
-        if (!isValidLogLevel(level)) {
-            throw createError(`Cannot set value '${level}' level. Expected levels are ${logLevels}.`);
-        }
-        state.level = level;
-    };
-    const shouldLog = (level) => {
-        if (state.level === 'none' || level === 'none' || !isValidLogLevel(level)) {
-            return false;
-        }
-        return priority[level] >= priority[state.level];
-    };
-    return freeze({
-        getLogLevel,
-        setLogLevel,
-        shouldLog,
-    });
-}
-
-/**
- * Creates a logger instance with configurable log level filtering.
- * Each log function is wrapped to respect the current log level setting.
- *
- * @param error - Function to handle error-level logs (required)
- * @param warn - Function to handle warning-level logs (optional, defaults to noop)
- * @param log - Function to handle standard logs (optional, defaults to noop)
- * @param info - Function to handle info-level logs (optional, defaults to noop)
- * @param debug - Function to handle debug-level logs (optional, defaults to noop)
- * @returns A frozen logger object with log methods and level control
- * @throws {ErrorLevelFn} When any provided log function is invalid
- */
-function createLogger(error, warn = noop, log = noop, info = noop, debug = noop) {
-    if (notValidLogFn(error)) {
-        throw createError(notFnMsg('error'));
-    }
-    if (notValidLogFn(warn)) {
-        throw createError(notFnMsg('warn'));
-    }
-    if (notValidLogFn(log)) {
-        throw createError(notFnMsg('log'));
-    }
-    if (notValidLogFn(info)) {
-        throw createError(notFnMsg('info'));
-    }
-    if (notValidLogFn(debug)) {
-        throw createError(notFnMsg('debug'));
-    }
-    const { setLogLevel, getLogLevel, shouldLog } = createLogLevelConfig();
-    const wrapLogFn = (fn, level) => {
-        if (fn === noop)
-            return fn;
-        const condition = () => shouldLog(level);
-        return createConditionalExecutionFunction(createErrorIgnoringFunction(fn), condition);
-    };
-    return freeze({
-        error: wrapLogFn(error, 'error'),
-        warn: wrapLogFn(warn, 'warn'),
-        log: wrapLogFn(log, 'log'),
-        info: wrapLogFn(info, 'info'),
-        debug: wrapLogFn(debug, 'debug'),
-        setLogLevel,
-        getLogLevel,
-    });
-}
-/**
- * Validates whether a given value is a valid log function.
- *
- * @param fn - The value to validate
- * @returns True if the value is not a function (invalid), false if it is valid
- */
-function notValidLogFn(fn) {
-    return getType(fn) !== 'function' && fn !== noop;
-}
-/**
- * Generates an error message for invalid log function parameters.
- *
- * @param label - The name of the log function that failed validation
- * @returns A formatted error message string
- */
-function notFnMsg(label) {
-    return `Cannot create a logger when ${label} is not a function`;
-}
-
-createLogger(error, warn, log, info, debug);
+const node_path = require('node:path');
+const index_cjs_js$7 = require('../../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/map/index.cjs.js');
+const index_cjs_js$2 = require('../../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/object/index.cjs.js');
+const index_cjs_js = require('../../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/set/index.cjs.js');
+const node_fs = require('node:fs');
+const index_cjs_js$4 = require('../../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/array/index.cjs.js');
+const index_cjs_js$3 = require('../../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/console/index.cjs.js');
+const index_cjs_js$5 = require('../../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/json/index.cjs.js');
+const index_cjs_js$1 = require('../../_dependencies/@hyperfrontend/logging/index.cjs.js');
+const index_cjs_js$6 = require('../../_dependencies/@hyperfrontend/immutable-api-utils/built-in-copy/error/index.cjs.js');
+const { isSafePath } = require('../../_shared/core/fs/guard/index.cjs.js');
+const { isFile, isDirectory, exists } = require('../../_shared/core/fs/stat/index.cjs.js');
+const { isWithinRoot } = require('../../_shared/core/path/confine/index.cjs.js');
 
 /**
  * Global log level registry.
  * Tracks all created scoped loggers to allow global log level changes.
  */
-const loggerRegistry = createSet();
+const loggerRegistry = index_cjs_js.createSet();
 /** Redacted placeholder for sensitive values */
 const REDACTED = '[REDACTED]';
 /**
@@ -441,17 +52,24 @@ function isSensitiveKey(key) {
  *
  * @param obj - Object to sanitize
  * @returns New object with sensitive values redacted
+ *
+ * @example Sanitizing sensitive data
+ * ```typescript
+ * const config = { apiKey: 'secret123', endpoint: 'https://api.example.com' }
+ * const safe = sanitize(config)
+ * // => { apiKey: '[REDACTED]', endpoint: 'https://api.example.com' }
+ * ```
  */
 function sanitize(obj) {
     if (obj === null || obj === undefined) {
         return obj;
     }
-    if (isArray(obj)) {
+    if (index_cjs_js$4.isArray(obj)) {
         return obj.map((item) => sanitize(item));
     }
     if (typeof obj === 'object') {
         const result = {};
-        for (const [key, value] of entries(obj)) {
+        for (const [key, value] of index_cjs_js$2.entries(obj)) {
             if (isSensitiveKey(key)) {
                 result[key] = REDACTED;
             }
@@ -476,9 +94,9 @@ function sanitize(obj) {
  */
 function formatMessage(namespace, message, meta) {
     const prefix = `[${namespace}]`;
-    if (meta && keys(meta).length > 0) {
+    if (meta && index_cjs_js$2.keys(meta).length > 0) {
         const sanitizedMeta = sanitize(meta);
-        return `${prefix} ${message} ${stringify(sanitizedMeta)}`;
+        return `${prefix} ${message} ${index_cjs_js$5.stringify(sanitizedMeta)}`;
     }
     return `${prefix} ${message}`;
 }
@@ -491,7 +109,7 @@ function formatMessage(namespace, message, meta) {
  * @param options - Logger configuration options
  * @returns A configured scoped logger instance
  *
- * @example
+ * @example Creating a scoped logger
  * ```typescript
  * const logger = createScopedLogger('project-scope')
  * logger.setLogLevel('debug')
@@ -510,9 +128,9 @@ function createScopedLogger(namespace, options = {}) {
         const processedMeta = sanitizeSecrets && meta ? sanitize(meta) : meta;
         baseFn(formatMessage(namespace, message, processedMeta));
     };
-    const baseLogger = createLogger(createLogFn(error), createLogFn(warn), createLogFn(log), createLogFn(info), createLogFn(debug));
+    const baseLogger = index_cjs_js$1.createLogger(createLogFn(index_cjs_js$3.error), createLogFn(index_cjs_js$3.warn), createLogFn(index_cjs_js$3.log), createLogFn(index_cjs_js$3.info), createLogFn(index_cjs_js$3.debug));
     baseLogger.setLogLevel(level);
-    const scopedLogger = freeze({
+    const scopedLogger = index_cjs_js$2.freeze({
         error: (message, meta) => baseLogger.error(message, meta),
         warn: (message, meta) => baseLogger.warn(message, meta),
         log: (message, meta) => baseLogger.log(message, meta),
@@ -528,7 +146,7 @@ function createScopedLogger(namespace, options = {}) {
  * Default logger instance for the project-scope library.
  * Use this for general logging within the library.
  *
- * @example
+ * @example Using the default logger
  * ```typescript
  * import { logger } from '@hyperfrontend/project-scope/core'
  *
@@ -546,10 +164,19 @@ const fsLogger = createScopedLogger('project-scope:fs');
  * @param code - The category code for this type of filesystem failure
  * @param context - Additional context including path, operation, and cause
  * @returns A configured Error object with code and context properties
+ *
+ * @example Creating a file system error
+ * ```typescript
+ * throw createFileSystemError(
+ *   'Cannot read file',
+ *   'FS_READ_ERROR',
+ *   { path: './missing.txt', operation: 'read' }
+ * )
+ * ```
  */
 function createFileSystemError(message, code, context) {
-    const error = createError(message);
-    defineProperties(error, {
+    const error = index_cjs_js$6.createError(message);
+    index_cjs_js$2.defineProperties(error, {
         code: { value: code, enumerable: true },
         context: { value: context, enumerable: true },
     });
@@ -563,7 +190,7 @@ function createFileSystemError(message, code, context) {
  * @returns File contents as string
  * @throws {Error} If file doesn't exist or can't be read
  *
- * @example
+ * @example Reading file contents
  * ```typescript
  * import { readFileContent } from '@hyperfrontend/project-scope'
  *
@@ -572,6 +199,9 @@ function createFileSystemError(message, code, context) {
  * ```
  */
 function readFileContent(filePath, encoding = 'utf-8') {
+    if (!isSafePath(filePath)) {
+        throw createFileSystemError(`Unsafe file path: ${filePath}`, 'FS_READ_ERROR', { path: filePath, operation: 'read' });
+    }
     if (!node_fs.existsSync(filePath)) {
         fsLogger.debug('File not found', { path: filePath });
         throw createFileSystemError(`File not found: ${filePath}`, 'FS_NOT_FOUND', { path: filePath, operation: 'read' });
@@ -590,9 +220,17 @@ function readFileContent(filePath, encoding = 'utf-8') {
  * @param filePath - Path to file
  * @param encoding - File encoding (default: utf-8)
  * @returns File contents or null if file doesn't exist
+ *
+ * @example Reading file if it exists
+ * ```typescript
+ * const content = readFileIfExists('./optional-config.json')
+ * if (content) {
+ *   // File existed, use content
+ * }
+ * ```
  */
 function readFileIfExists(filePath, encoding = 'utf-8') {
-    if (!node_fs.existsSync(filePath)) {
+    if (!isSafePath(filePath) || !node_fs.existsSync(filePath)) {
         return null;
     }
     try {
@@ -603,66 +241,6 @@ function readFileIfExists(filePath, encoding = 'utf-8') {
     }
 }
 
-createScopedLogger('project-scope:fs:write');
-
-/**
- * Get file stats with error handling.
- *
- * @param filePath - Path to file
- * @param followSymlinks - Whether to follow symlinks (default: true)
- * @returns File stats or null if path doesn't exist
- */
-function getFileStat(filePath, followSymlinks = true) {
-    if (!node_fs.existsSync(filePath)) {
-        return null;
-    }
-    try {
-        const stat = followSymlinks ? node_fs.statSync(filePath) : node_fs.lstatSync(filePath);
-        return {
-            isFile: stat.isFile(),
-            isDirectory: stat.isDirectory(),
-            isSymlink: stat.isSymbolicLink(),
-            size: stat.size,
-            created: stat.birthtime,
-            modified: stat.mtime,
-            accessed: stat.atime,
-            mode: stat.mode,
-        };
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Check if path is a file.
- *
- * @param filePath - Path to check
- * @returns True if path is a file
- */
-function isFile(filePath) {
-    const stats = getFileStat(filePath);
-    return stats?.isFile ?? false;
-}
-/**
- * Check if path is a directory.
- *
- * @param dirPath - Path to check
- * @returns True if path is a directory
- */
-function isDirectory(dirPath) {
-    const stats = getFileStat(dirPath);
-    return stats?.isDirectory ?? false;
-}
-/**
- * Check if path exists.
- *
- * @param filePath - Path to check
- * @returns True if path exists
- */
-function exists(filePath) {
-    return node_fs.existsSync(filePath);
-}
-
 const fsDirLogger = createScopedLogger('project-scope:fs:dir');
 /**
  * List immediate contents of a directory.
@@ -671,7 +249,7 @@ const fsDirLogger = createScopedLogger('project-scope:fs:dir');
  * @returns Array of entries with metadata for each file/directory
  * @throws {Error} If directory doesn't exist or isn't a directory
  *
- * @example
+ * @example Listing directory contents
  * ```typescript
  * import { readDirectory } from '@hyperfrontend/project-scope'
  *
@@ -714,6 +292,8 @@ function readDirectory(dirPath) {
 
 createScopedLogger('project-scope:fs:traversal');
 
+createScopedLogger('project-scope:fs:write');
+
 const packageLogger = createScopedLogger('project-scope:project:package');
 /**
  * Verifies that a value is an object with only string values,
@@ -725,7 +305,7 @@ const packageLogger = createScopedLogger('project-scope:project:package');
 function isStringRecord(value) {
     if (typeof value !== 'object' || value === null)
         return false;
-    return values(value).every((v) => typeof v === 'string');
+    return index_cjs_js$2.values(value).every((v) => typeof v === 'string');
 }
 /**
  * Extracts and normalizes the workspaces field from package.json,
@@ -735,12 +315,12 @@ function isStringRecord(value) {
  * @returns Normalized workspace patterns or undefined if invalid
  */
 function parseWorkspaces(value) {
-    if (isArray(value) && value.every((v) => typeof v === 'string')) {
+    if (index_cjs_js$4.isArray(value) && value.every((v) => typeof v === 'string')) {
         return value;
     }
     if (typeof value === 'object' && value !== null) {
         const obj = value;
-        if (isArray(obj['packages'])) {
+        if (index_cjs_js$4.isArray(obj['packages'])) {
             return { packages: obj['packages'] };
         }
     }
@@ -754,7 +334,7 @@ function parseWorkspaces(value) {
  */
 function validatePackageJson(data) {
     if (typeof data !== 'object' || data === null) {
-        throw createError('package.json must be an object');
+        throw index_cjs_js$6.createError('package.json must be an object');
     }
     const pkg = data;
     return {
@@ -783,6 +363,16 @@ function validatePackageJson(data) {
  *
  * @param projectPath - Project directory path or path to package.json
  * @returns Parsed package.json or null if not found
+ *
+ * @example Reading package.json if it exists
+ * ```typescript
+ * import { readPackageJsonIfExists } from '@hyperfrontend/project-scope'
+ *
+ * const pkg = readPackageJsonIfExists('/path/to/project')
+ * if (pkg) {
+ *   console.log('Found:', pkg.name)
+ * }
+ * ```
  */
 function readPackageJsonIfExists(projectPath) {
     const packageJsonPath = projectPath.endsWith('package.json') ? projectPath : node_path.join(projectPath, 'package.json');
@@ -792,7 +382,7 @@ function readPackageJsonIfExists(projectPath) {
         return null;
     }
     try {
-        const validated = validatePackageJson(parse(content));
+        const validated = validatePackageJson(index_cjs_js$5.parse(content));
         packageLogger.debug('Package.json loaded', { path: packageJsonPath, name: validated.name });
         return validated;
     }
@@ -849,6 +439,10 @@ function resolveImportPath(importPath, fromFile, projectPath, extensions) {
     }
     const fromDir = node_path.dirname(fromFile);
     const absolutePath = node_path.resolve(fromDir, importPath);
+    // why: An import string comes from untrusted source code; reject targets that escape the project root before any stat, so a hostile `../../etc/passwd` can't probe the filesystem.
+    if (!isWithinRoot(projectPath, absolutePath)) {
+        return null;
+    }
     if (exists(absolutePath)) {
         if (isFile(absolutePath)) {
             return node_path.relative(projectPath, absolutePath);
@@ -916,7 +510,7 @@ function collectSourceFiles(dir, extensions, maxDepth, currentDepth = 0) {
  * @param options - Configuration for graph building
  * @returns Dependency graph with nodes, roots, and leaves
  *
- * @example
+ * @example Building a dependency graph
  * ```typescript
  * import { buildDependencyGraph } from '@hyperfrontend/project-scope'
  *
@@ -936,8 +530,8 @@ function buildDependencyGraph(projectPath, options) {
     const maxDepth = options?.maxDepth ?? 10;
     const includeExternal = options?.includeExternal ?? false;
     depsLogger.debug('Building dependency graph', { projectPath, extensions, maxDepth, includeExternal });
-    const nodes = createMap();
-    const incomingEdges = createMap();
+    const nodes = index_cjs_js$7.createMap();
+    const incomingEdges = index_cjs_js$7.createMap();
     const srcDir = node_path.join(projectPath, 'src');
     let sourceFiles;
     if (exists(srcDir) && isDirectory(srcDir)) {
@@ -956,7 +550,7 @@ function buildDependencyGraph(projectPath, options) {
             dependencies: [],
             dependents: [],
         });
-        incomingEdges.set(relativePath, createSet());
+        incomingEdges.set(relativePath, index_cjs_js.createSet());
     }
     for (const file of sourceFiles) {
         const relativePath = node_path.relative(projectPath, file);
@@ -1017,12 +611,21 @@ function buildDependencyGraph(projectPath, options) {
  *
  * @param graph - Dependency graph
  * @returns Array of circular dependencies found
+ *
+ * @example Finding circular dependencies
+ * ```typescript
+ * import { buildDependencyGraph, findCircularDependencies } from '@hyperfrontend/project-scope'
+ *
+ * const graph = buildDependencyGraph('/workspace')
+ * const cycles = findCircularDependencies(graph)
+ * cycles.forEach(c => console.log(`Cycle: ${c.cycle.join(' -> ')}`))
+ * ```
  */
 function findCircularDependencies(graph) {
     depsLogger.debug('Searching for circular dependencies', { nodeCount: graph.nodes.size });
     const cycles = [];
-    const visited = createSet();
-    const recursionStack = createSet();
+    const visited = index_cjs_js.createSet();
+    const recursionStack = index_cjs_js.createSet();
     const path = [];
     /**
      * Depth-first search to detect cycles.
@@ -1077,6 +680,16 @@ function findCircularDependencies(graph) {
  *
  * @param projectPath - Project directory
  * @returns Dependencies grouped by runtime, dev, peer, and optional
+ *
+ * @example Getting project dependencies
+ * ```typescript
+ * import { getProjectDependencies } from '@hyperfrontend/project-scope'
+ *
+ * const deps = getProjectDependencies('/path/to/project')
+ * console.log('Runtime:', deps.runtime)     // ['express', 'lodash']
+ * console.log('Dev:', deps.development)     // ['jest', 'typescript']
+ * console.log('Total:', deps.total)         // 15
+ * ```
  */
 function getProjectDependencies(projectPath) {
     const packageJson = readPackageJsonIfExists(projectPath);
@@ -1089,11 +702,11 @@ function getProjectDependencies(projectPath) {
             total: 0,
         };
     }
-    const runtime = packageJson.dependencies ? keys(packageJson.dependencies) : [];
-    const development = packageJson.devDependencies ? keys(packageJson.devDependencies) : [];
-    const peer = packageJson.peerDependencies ? keys(packageJson.peerDependencies) : [];
-    const optional = packageJson.optionalDependencies ? keys(packageJson.optionalDependencies) : [];
-    const allDeps = createSet([...runtime, ...development, ...peer, ...optional]);
+    const runtime = packageJson.dependencies ? index_cjs_js$2.keys(packageJson.dependencies) : [];
+    const development = packageJson.devDependencies ? index_cjs_js$2.keys(packageJson.devDependencies) : [];
+    const peer = packageJson.peerDependencies ? index_cjs_js$2.keys(packageJson.peerDependencies) : [];
+    const optional = packageJson.optionalDependencies ? index_cjs_js$2.keys(packageJson.optionalDependencies) : [];
+    const allDeps = index_cjs_js.createSet([...runtime, ...development, ...peer, ...optional]);
     return {
         runtime,
         development,
@@ -1106,4 +719,3 @@ function getProjectDependencies(projectPath) {
 exports.buildDependencyGraph = buildDependencyGraph;
 exports.findCircularDependencies = findCircularDependencies;
 exports.getProjectDependencies = getProjectDependencies;
-//# sourceMappingURL=index.cjs.js.map